From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id A4F0E15806E for ; Tue, 30 May 2023 12:56:05 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id D52D7E09F5; Tue, 30 May 2023 12:56:04 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [IPv6:2001:470:ea4a:1:5054:ff:fec7:86e4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 8361FE09F5 for ; Tue, 30 May 2023 12:56:04 +0000 (UTC) Received: from oystercatcher.gentoo.org (oystercatcher.gentoo.org [148.251.78.52]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id 18494340FF8 for ; Tue, 30 May 2023 12:56:03 +0000 (UTC) Received: from localhost.localdomain (localhost [IPv6:::1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id 7A85AA67 for ; Tue, 30 May 2023 12:56:01 +0000 (UTC) From: "Mike Pagano" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Mike Pagano" Message-ID: <1685451351.43efe29bf4fafaee7fcb400d8d6ea62272a8066c.mpagano@gentoo> Subject: [gentoo-commits] proj/linux-patches:5.10 commit in: / X-VCS-Repository: proj/linux-patches X-VCS-Files: 0000_README 1180_linux-5.10.181.patch X-VCS-Directories: / X-VCS-Committer: mpagano X-VCS-Committer-Name: Mike Pagano X-VCS-Revision: 43efe29bf4fafaee7fcb400d8d6ea62272a8066c X-VCS-Branch: 5.10 Date: Tue, 30 May 2023 12:56:01 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Auto-Response-Suppress: DR, RN, NRN, OOF, AutoReply X-Archives-Salt: 75321cf7-7b2a-4652-a849-3a1a7acb0b04 X-Archives-Hash: e7caebab6b1ffbca2587da80bf8ee00c commit: 43efe29bf4fafaee7fcb400d8d6ea62272a8066c Author: Mike Pagano gentoo org> AuthorDate: Tue May 30 12:55:51 2023 +0000 Commit: Mike Pagano gentoo org> CommitDate: Tue May 30 12:55:51 2023 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=43efe29b Linux patch 5.10.181 Signed-off-by: Mike Pagano gentoo.org> 0000_README | 4 + 1180_linux-5.10.181.patch | 8078 +++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 8082 insertions(+) diff --git a/0000_README b/0000_README index a665318d..366c0d03 100644 --- a/0000_README +++ b/0000_README @@ -763,6 +763,10 @@ Patch: 1179_linux-5.10.180.patch From: https://www.kernel.org Desc: Linux 5.10.180 +Patch: 1180_linux-5.10.181.patch +From: https://www.kernel.org +Desc: Linux 5.10.181 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1180_linux-5.10.181.patch b/1180_linux-5.10.181.patch new file mode 100644 index 00000000..05689177 --- /dev/null +++ b/1180_linux-5.10.181.patch @@ -0,0 +1,8078 @@ +diff --git a/Documentation/devicetree/bindings/usb/cdns,usb3.yaml b/Documentation/devicetree/bindings/usb/cdns,usb3.yaml +index d6af2794d4448..703921e6bcaf9 100644 +--- a/Documentation/devicetree/bindings/usb/cdns,usb3.yaml ++++ b/Documentation/devicetree/bindings/usb/cdns,usb3.yaml +@@ -59,7 +59,7 @@ properties: + description: + size of memory intended as internal memory for endpoints + buffers expressed in KB +- $ref: /schemas/types.yaml#/definitions/uint32 ++ $ref: /schemas/types.yaml#/definitions/uint16 + + cdns,phyrst-a-enable: + description: Enable resetting of PHY if Rx fail is detected +diff --git a/Makefile b/Makefile +index c2f8e1644abdc..4e8289113a81f 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 5 + PATCHLEVEL = 10 +-SUBLEVEL = 180 ++SUBLEVEL = 181 + EXTRAVERSION = + NAME = Dare mighty things + +diff --git a/arch/arm/boot/dts/stm32mp15-pinctrl.dtsi b/arch/arm/boot/dts/stm32mp15-pinctrl.dtsi +index ccf66adbbf623..07c15c1ce9d4c 100644 +--- a/arch/arm/boot/dts/stm32mp15-pinctrl.dtsi ++++ b/arch/arm/boot/dts/stm32mp15-pinctrl.dtsi +@@ -1102,7 +1102,7 @@ + }; + }; + +- sai2a_sleep_pins_c: sai2a-2 { ++ sai2a_sleep_pins_c: sai2a-sleep-2 { + pins { + pinmux = , /* SAI2_SCK_A */ + , /* SAI2_SD_A */ +diff --git a/arch/arm/mach-sa1100/jornada720_ssp.c b/arch/arm/mach-sa1100/jornada720_ssp.c +index 1dbe98948ce30..9627c4cf3e41d 100644 +--- a/arch/arm/mach-sa1100/jornada720_ssp.c ++++ b/arch/arm/mach-sa1100/jornada720_ssp.c +@@ -1,5 +1,5 @@ + // SPDX-License-Identifier: GPL-2.0-only +-/** ++/* + * arch/arm/mac-sa1100/jornada720_ssp.c + * + * Copyright (C) 2006/2007 Kristoffer Ericson +@@ -26,6 +26,7 @@ static unsigned long jornada_ssp_flags; + + /** + * jornada_ssp_reverse - reverses input byte ++ * @byte: input byte to reverse + * + * we need to reverse all data we receive from the mcu due to its physical location + * returns : 01110111 -> 11101110 +@@ -46,6 +47,7 @@ EXPORT_SYMBOL(jornada_ssp_reverse); + + /** + * jornada_ssp_byte - waits for ready ssp bus and sends byte ++ * @byte: input byte to transmit + * + * waits for fifo buffer to clear and then transmits, if it doesn't then we will + * timeout after rounds. Needs mcu running before its called. +@@ -77,6 +79,7 @@ EXPORT_SYMBOL(jornada_ssp_byte); + + /** + * jornada_ssp_inout - decide if input is command or trading byte ++ * @byte: input byte to send (may be %TXDUMMY) + * + * returns : (jornada_ssp_byte(byte)) on success + * : %-ETIMEDOUT on timeout failure +diff --git a/arch/arm64/boot/dts/freescale/imx8mn-var-som.dtsi b/arch/arm64/boot/dts/freescale/imx8mn-var-som.dtsi +index f6287f174355c..24f9e8fd0c8b8 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mn-var-som.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mn-var-som.dtsi +@@ -98,11 +98,17 @@ + #address-cells = <1>; + #size-cells = <0>; + +- ethphy: ethernet-phy@4 { ++ ethphy: ethernet-phy@4 { /* AR8033 or ADIN1300 */ + compatible = "ethernet-phy-ieee802.3-c22"; + reg = <4>; + reset-gpios = <&gpio1 9 GPIO_ACTIVE_LOW>; + reset-assert-us = <10000>; ++ /* ++ * Deassert delay: ++ * ADIN1300 requires 5ms. ++ * AR8033 requires 1ms. ++ */ ++ reset-deassert-us = <20000>; + }; + }; + }; +diff --git a/arch/arm64/boot/dts/qcom/msm8996.dtsi b/arch/arm64/boot/dts/qcom/msm8996.dtsi +index 02b5f6f1d331e..159cdd03e7c01 100644 +--- a/arch/arm64/boot/dts/qcom/msm8996.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8996.dtsi +@@ -1771,8 +1771,11 @@ + interrupts = <0 131 IRQ_TYPE_LEVEL_HIGH>; + phys = <&hsusb_phy1>, <&ssusb_phy_0>; + phy-names = "usb2-phy", "usb3-phy"; ++ snps,hird-threshold = /bits/ 8 <0>; + snps,dis_u2_susphy_quirk; + snps,dis_enblslpm_quirk; ++ snps,is-utmi-l1-suspend; ++ tx-fifo-resize; + }; + }; + +diff --git a/arch/arm64/include/asm/hyp_image.h b/arch/arm64/include/asm/hyp_image.h +index daa1a1da539e7..e068427560510 100644 +--- a/arch/arm64/include/asm/hyp_image.h ++++ b/arch/arm64/include/asm/hyp_image.h +@@ -31,6 +31,9 @@ + */ + #define KVM_NVHE_ALIAS(sym) kvm_nvhe_sym(sym) = sym; + ++/* Defines a linker script alias for KVM nVHE hyp symbols */ ++#define KVM_NVHE_ALIAS_HYP(first, sec) kvm_nvhe_sym(first) = kvm_nvhe_sym(sec); ++ + #endif /* LINKER_SCRIPT */ + + #endif /* __ARM64_HYP_IMAGE_H__ */ +diff --git a/arch/arm64/kernel/image-vars.h b/arch/arm64/kernel/image-vars.h +index c615b285ff5b3..48e43b29a2d5f 100644 +--- a/arch/arm64/kernel/image-vars.h ++++ b/arch/arm64/kernel/image-vars.h +@@ -103,6 +103,17 @@ KVM_NVHE_ALIAS(gic_nonsecure_priorities); + KVM_NVHE_ALIAS(__start___kvm_ex_table); + KVM_NVHE_ALIAS(__stop___kvm_ex_table); + ++/* Position-independent library routines */ ++KVM_NVHE_ALIAS_HYP(clear_page, __pi_clear_page); ++KVM_NVHE_ALIAS_HYP(copy_page, __pi_copy_page); ++KVM_NVHE_ALIAS_HYP(memcpy, __pi_memcpy); ++KVM_NVHE_ALIAS_HYP(memset, __pi_memset); ++ ++#ifdef CONFIG_KASAN ++KVM_NVHE_ALIAS_HYP(__memcpy, __pi_memcpy); ++KVM_NVHE_ALIAS_HYP(__memset, __pi_memset); ++#endif ++ + #endif /* CONFIG_KVM */ + + #endif /* __ARM64_KERNEL_IMAGE_VARS_H */ +diff --git a/arch/arm64/kvm/hyp/nvhe/Makefile b/arch/arm64/kvm/hyp/nvhe/Makefile +index ddde15fe85f2f..230bba1a6716b 100644 +--- a/arch/arm64/kvm/hyp/nvhe/Makefile ++++ b/arch/arm64/kvm/hyp/nvhe/Makefile +@@ -6,9 +6,13 @@ + asflags-y := -D__KVM_NVHE_HYPERVISOR__ + ccflags-y := -D__KVM_NVHE_HYPERVISOR__ + ++lib-objs := clear_page.o copy_page.o memcpy.o memset.o ++lib-objs := $(addprefix ../../../lib/, $(lib-objs)) ++ + obj-y := timer-sr.o sysreg-sr.o debug-sr.o switch.o tlb.o hyp-init.o host.o hyp-main.o + obj-y += ../vgic-v3-sr.o ../aarch32.o ../vgic-v2-cpuif-proxy.o ../entry.o \ + ../fpsimd.o ../hyp-entry.o ++obj-y += $(lib-objs) + + ## + ## Build rules for compiling nVHE hyp code +diff --git a/arch/m68k/kernel/signal.c b/arch/m68k/kernel/signal.c +index 5d12736b4b281..131e87a55cbb7 100644 +--- a/arch/m68k/kernel/signal.c ++++ b/arch/m68k/kernel/signal.c +@@ -882,11 +882,17 @@ static inline int rt_setup_ucontext(struct ucontext __user *uc, struct pt_regs * + } + + static inline void __user * +-get_sigframe(struct ksignal *ksig, size_t frame_size) ++get_sigframe(struct ksignal *ksig, struct pt_regs *tregs, size_t frame_size) + { + unsigned long usp = sigsp(rdusp(), ksig); ++ unsigned long gap = 0; + +- return (void __user *)((usp - frame_size) & -8UL); ++ if (CPU_IS_020_OR_030 && tregs->format == 0xb) { ++ /* USP is unreliable so use worst-case value */ ++ gap = 256; ++ } ++ ++ return (void __user *)((usp - gap - frame_size) & -8UL); + } + + static int setup_frame(struct ksignal *ksig, sigset_t *set, +@@ -904,7 +910,7 @@ static int setup_frame(struct ksignal *ksig, sigset_t *set, + return -EFAULT; + } + +- frame = get_sigframe(ksig, sizeof(*frame) + fsize); ++ frame = get_sigframe(ksig, tregs, sizeof(*frame) + fsize); + + if (fsize) + err |= copy_to_user (frame + 1, regs + 1, fsize); +@@ -976,7 +982,7 @@ static int setup_rt_frame(struct ksignal *ksig, sigset_t *set, + return -EFAULT; + } + +- frame = get_sigframe(ksig, sizeof(*frame)); ++ frame = get_sigframe(ksig, tregs, sizeof(*frame)); + + if (fsize) + err |= copy_to_user (&frame->uc.uc_extra, regs + 1, fsize); +diff --git a/arch/parisc/include/asm/cacheflush.h b/arch/parisc/include/asm/cacheflush.h +index 99663fc1f997f..cc9d096d5cc46 100644 +--- a/arch/parisc/include/asm/cacheflush.h ++++ b/arch/parisc/include/asm/cacheflush.h +@@ -57,6 +57,11 @@ extern void flush_dcache_page(struct page *page); + + #define flush_dcache_mmap_lock(mapping) xa_lock_irq(&mapping->i_pages) + #define flush_dcache_mmap_unlock(mapping) xa_unlock_irq(&mapping->i_pages) ++#define flush_dcache_mmap_lock_irqsave(mapping, flags) \ ++ xa_lock_irqsave(&mapping->i_pages, flags) ++#define flush_dcache_mmap_unlock_irqrestore(mapping, flags) \ ++ xa_unlock_irqrestore(&mapping->i_pages, flags) ++ + + #define flush_icache_page(vma,page) do { \ + flush_kernel_dcache_page(page); \ +diff --git a/arch/parisc/kernel/cache.c b/arch/parisc/kernel/cache.c +index c81ab0cb89255..efa8d2a678a32 100644 +--- a/arch/parisc/kernel/cache.c ++++ b/arch/parisc/kernel/cache.c +@@ -327,6 +327,7 @@ void flush_dcache_page(struct page *page) + struct vm_area_struct *mpnt; + unsigned long offset; + unsigned long addr, old_addr = 0; ++ unsigned long flags; + pgoff_t pgoff; + + if (mapping && !mapping_mapped(mapping)) { +@@ -346,7 +347,7 @@ void flush_dcache_page(struct page *page) + * declared as MAP_PRIVATE or MAP_SHARED), so we only need + * to flush one address here for them all to become coherent */ + +- flush_dcache_mmap_lock(mapping); ++ flush_dcache_mmap_lock_irqsave(mapping, flags); + vma_interval_tree_foreach(mpnt, &mapping->i_mmap, pgoff, pgoff) { + offset = (pgoff - mpnt->vm_pgoff) << PAGE_SHIFT; + addr = mpnt->vm_start + offset; +@@ -369,7 +370,7 @@ void flush_dcache_page(struct page *page) + old_addr = addr; + } + } +- flush_dcache_mmap_unlock(mapping); ++ flush_dcache_mmap_unlock_irqrestore(mapping, flags); + } + EXPORT_SYMBOL(flush_dcache_page); + +diff --git a/arch/parisc/kernel/process.c b/arch/parisc/kernel/process.c +index 5e4381280c97b..c14ee40302d85 100644 +--- a/arch/parisc/kernel/process.c ++++ b/arch/parisc/kernel/process.c +@@ -123,13 +123,18 @@ void machine_power_off(void) + /* It seems we have no way to power the system off via + * software. The user has to press the button himself. */ + +- printk(KERN_EMERG "System shut down completed.\n" +- "Please power this system off now."); ++ printk("Power off or press RETURN to reboot.\n"); + + /* prevent soft lockup/stalled CPU messages for endless loop. */ + rcu_sysrq_start(); + lockup_detector_soft_poweroff(); +- for (;;); ++ while (1) { ++ /* reboot if user presses RETURN key */ ++ if (pdc_iodc_getc() == 13) { ++ printk("Rebooting...\n"); ++ machine_restart(NULL); ++ } ++ } + } + + void (*pm_power_off)(void); +diff --git a/arch/parisc/kernel/traps.c b/arch/parisc/kernel/traps.c +index 2fad7867af100..bd09050dc0af7 100644 +--- a/arch/parisc/kernel/traps.c ++++ b/arch/parisc/kernel/traps.c +@@ -305,8 +305,8 @@ static void handle_break(struct pt_regs *regs) + #endif + + #ifdef CONFIG_KGDB +- if (unlikely(iir == PARISC_KGDB_COMPILED_BREAK_INSN || +- iir == PARISC_KGDB_BREAK_INSN)) { ++ if (unlikely((iir == PARISC_KGDB_COMPILED_BREAK_INSN || ++ iir == PARISC_KGDB_BREAK_INSN)) && !user_mode(regs)) { + kgdb_handle_exception(9, SIGTRAP, 0, regs); + return; + } +diff --git a/arch/powerpc/mm/book3s64/radix_pgtable.c b/arch/powerpc/mm/book3s64/radix_pgtable.c +index ae4ba6a6745d4..5f0a2fa611fa2 100644 +--- a/arch/powerpc/mm/book3s64/radix_pgtable.c ++++ b/arch/powerpc/mm/book3s64/radix_pgtable.c +@@ -1064,8 +1064,8 @@ void radix__ptep_set_access_flags(struct vm_area_struct *vma, pte_t *ptep, + pte_t entry, unsigned long address, int psize) + { + struct mm_struct *mm = vma->vm_mm; +- unsigned long set = pte_val(entry) & (_PAGE_DIRTY | _PAGE_ACCESSED | +- _PAGE_RW | _PAGE_EXEC); ++ unsigned long set = pte_val(entry) & (_PAGE_DIRTY | _PAGE_SOFT_DIRTY | ++ _PAGE_ACCESSED | _PAGE_RW | _PAGE_EXEC); + + unsigned long change = pte_val(entry) ^ pte_val(*ptep); + /* +diff --git a/arch/x86/include/asm/intel-family.h b/arch/x86/include/asm/intel-family.h +index 9abe842dbd843..14b52718917f6 100644 +--- a/arch/x86/include/asm/intel-family.h ++++ b/arch/x86/include/asm/intel-family.h +@@ -98,6 +98,11 @@ + #define INTEL_FAM6_LAKEFIELD 0x8A + #define INTEL_FAM6_ALDERLAKE 0x97 + #define INTEL_FAM6_ALDERLAKE_L 0x9A ++#define INTEL_FAM6_ALDERLAKE_N 0xBE ++ ++#define INTEL_FAM6_RAPTORLAKE 0xB7 ++#define INTEL_FAM6_RAPTORLAKE_P 0xBA ++#define INTEL_FAM6_RAPTORLAKE_S 0xBF + + /* "Small Core" Processors (Atom) */ + +diff --git a/arch/x86/kernel/cpu/topology.c b/arch/x86/kernel/cpu/topology.c +index 37d48ab3d077c..58d17c01d4593 100644 +--- a/arch/x86/kernel/cpu/topology.c ++++ b/arch/x86/kernel/cpu/topology.c +@@ -79,7 +79,7 @@ int detect_extended_topology_early(struct cpuinfo_x86 *c) + * initial apic id, which also represents 32-bit extended x2apic id. + */ + c->initial_apicid = edx; +- smp_num_siblings = LEVEL_MAX_SIBLINGS(ebx); ++ smp_num_siblings = max_t(int, smp_num_siblings, LEVEL_MAX_SIBLINGS(ebx)); + #endif + return 0; + } +@@ -109,7 +109,8 @@ int detect_extended_topology(struct cpuinfo_x86 *c) + */ + cpuid_count(leaf, SMT_LEVEL, &eax, &ebx, &ecx, &edx); + c->initial_apicid = edx; +- core_level_siblings = smp_num_siblings = LEVEL_MAX_SIBLINGS(ebx); ++ core_level_siblings = LEVEL_MAX_SIBLINGS(ebx); ++ smp_num_siblings = max_t(int, smp_num_siblings, LEVEL_MAX_SIBLINGS(ebx)); + core_plus_mask_width = ht_mask_width = BITS_SHIFT_NEXT_LEVEL(eax); + die_level_siblings = LEVEL_MAX_SIBLINGS(ebx); + pkg_mask_width = die_plus_mask_width = BITS_SHIFT_NEXT_LEVEL(eax); +diff --git a/arch/x86/kernel/dumpstack.c b/arch/x86/kernel/dumpstack.c +index b4964300153a1..b9736aac20eef 100644 +--- a/arch/x86/kernel/dumpstack.c ++++ b/arch/x86/kernel/dumpstack.c +@@ -195,7 +195,6 @@ void show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs, + printk("%sCall Trace:\n", log_lvl); + + unwind_start(&state, task, regs, stack); +- stack = stack ? : get_stack_pointer(task, regs); + regs = unwind_get_entry_regs(&state, &partial); + + /* +@@ -214,9 +213,13 @@ void show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs, + * - hardirq stack + * - entry stack + */ +- for ( ; stack; stack = PTR_ALIGN(stack_info.next_sp, sizeof(long))) { ++ for (stack = stack ?: get_stack_pointer(task, regs); ++ stack; ++ stack = stack_info.next_sp) { + const char *stack_name; + ++ stack = PTR_ALIGN(stack, sizeof(long)); ++ + if (get_stack_info(stack, task, &stack_info, &visit_mask)) { + /* + * We weren't on a valid stack. It's possible that +diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c +index 63d8c6c7d1254..ff3b0d8fe0486 100644 +--- a/arch/x86/mm/init.c ++++ b/arch/x86/mm/init.c +@@ -9,6 +9,7 @@ + #include + + #include ++#include + #include + #include + #include +@@ -254,6 +255,24 @@ static void __init probe_page_size_mask(void) + } + } + ++#define INTEL_MATCH(_model) { .vendor = X86_VENDOR_INTEL, \ ++ .family = 6, \ ++ .model = _model, \ ++ } ++/* ++ * INVLPG may not properly flush Global entries ++ * on these CPUs when PCIDs are enabled. ++ */ ++static const struct x86_cpu_id invlpg_miss_ids[] = { ++ INTEL_MATCH(INTEL_FAM6_ALDERLAKE ), ++ INTEL_MATCH(INTEL_FAM6_ALDERLAKE_L ), ++ INTEL_MATCH(INTEL_FAM6_ALDERLAKE_N ), ++ INTEL_MATCH(INTEL_FAM6_RAPTORLAKE ), ++ INTEL_MATCH(INTEL_FAM6_RAPTORLAKE_P), ++ INTEL_MATCH(INTEL_FAM6_RAPTORLAKE_S), ++ {} ++}; ++ + static void setup_pcid(void) + { + if (!IS_ENABLED(CONFIG_X86_64)) +@@ -262,6 +281,12 @@ static void setup_pcid(void) + if (!boot_cpu_has(X86_FEATURE_PCID)) + return; + ++ if (x86_match_cpu(invlpg_miss_ids)) { ++ pr_info("Incomplete global flushes, disabling PCID"); ++ setup_clear_cpu_cap(X86_FEATURE_PCID); ++ return; ++ } ++ + if (boot_cpu_has(X86_FEATURE_PGE)) { + /* + * This can't be cr4_set_bits_and_update_boot() -- the +diff --git a/drivers/acpi/acpica/dbnames.c b/drivers/acpi/acpica/dbnames.c +index 3615e1a6efd8a..b91155ea9c343 100644 +--- a/drivers/acpi/acpica/dbnames.c ++++ b/drivers/acpi/acpica/dbnames.c +@@ -652,6 +652,9 @@ acpi_status acpi_db_display_objects(char *obj_type_arg, char *display_count_arg) + object_info = + ACPI_ALLOCATE_ZEROED(sizeof(struct acpi_object_info)); + ++ if (!object_info) ++ return (AE_NO_MEMORY); ++ + /* Walk the namespace from the root */ + + (void)acpi_walk_namespace(ACPI_TYPE_ANY, ACPI_ROOT_OBJECT, +diff --git a/drivers/acpi/acpica/dswstate.c b/drivers/acpi/acpica/dswstate.c +index 809a0c0536b59..f9ba7695be147 100644 +--- a/drivers/acpi/acpica/dswstate.c ++++ b/drivers/acpi/acpica/dswstate.c +@@ -576,9 +576,14 @@ acpi_ds_init_aml_walk(struct acpi_walk_state *walk_state, + ACPI_FUNCTION_TRACE(ds_init_aml_walk); + + walk_state->parser_state.aml = +- walk_state->parser_state.aml_start = aml_start; +- walk_state->parser_state.aml_end = +- walk_state->parser_state.pkg_end = aml_start + aml_length; ++ walk_state->parser_state.aml_start = ++ walk_state->parser_state.aml_end = ++ walk_state->parser_state.pkg_end = aml_start; ++ /* Avoid undefined behavior: applying zero offset to null pointer */ ++ if (aml_length != 0) { ++ walk_state->parser_state.aml_end += aml_length; ++ walk_state->parser_state.pkg_end += aml_length; ++ } + + /* The next_op of the next_walk will be the beginning of the method */ + +diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c +index 4707d1808ca54..487884420fb0d 100644 +--- a/drivers/acpi/ec.c ++++ b/drivers/acpi/ec.c +@@ -1114,6 +1114,7 @@ static void acpi_ec_remove_query_handlers(struct acpi_ec *ec, + void acpi_ec_remove_query_handler(struct acpi_ec *ec, u8 query_bit) + { + acpi_ec_remove_query_handlers(ec, false, query_bit); ++ flush_workqueue(ec_query_wq); + } + EXPORT_SYMBOL_GPL(acpi_ec_remove_query_handler); + +diff --git a/drivers/base/core.c b/drivers/base/core.c +index 9a874a58d690c..cb859febd03cf 100644 +--- a/drivers/base/core.c ++++ b/drivers/base/core.c +@@ -4352,6 +4352,13 @@ void device_set_of_node_from_dev(struct device *dev, const struct device *dev2) + } + EXPORT_SYMBOL_GPL(device_set_of_node_from_dev); + ++void device_set_node(struct device *dev, struct fwnode_handle *fwnode) ++{ ++ dev->fwnode = fwnode; ++ dev->of_node = to_of_node(fwnode); ++} ++EXPORT_SYMBOL_GPL(device_set_node); ++ + int device_match_name(struct device *dev, const void *name) + { + return sysfs_streq(dev_name(dev), name); +diff --git a/drivers/base/regmap/regcache.c b/drivers/base/regmap/regcache.c +index 7f4b3b62492ca..7fdd702e564ae 100644 +--- a/drivers/base/regmap/regcache.c ++++ b/drivers/base/regmap/regcache.c +@@ -343,6 +343,9 @@ int regcache_sync(struct regmap *map) + const char *name; + bool bypass; + ++ if (WARN_ON(map->cache_type == REGCACHE_NONE)) ++ return -EINVAL; ++ + BUG_ON(!map->cache_ops); + + map->lock(map->lock_arg); +@@ -412,6 +415,9 @@ int regcache_sync_region(struct regmap *map, unsigned int min, + const char *name; + bool bypass; + ++ if (WARN_ON(map->cache_type == REGCACHE_NONE)) ++ return -EINVAL; ++ + BUG_ON(!map->cache_ops); + + map->lock(map->lock_arg); +diff --git a/drivers/block/null_blk/main.c b/drivers/block/null_blk/main.c +index 25db095e943b7..35b390a785dd4 100644 +--- a/drivers/block/null_blk/main.c ++++ b/drivers/block/null_blk/main.c +@@ -1738,6 +1738,11 @@ static int null_init_tag_set(struct nullb *nullb, struct blk_mq_tag_set *set) + + static int null_validate_conf(struct nullb_device *dev) + { ++ if (dev->queue_mode == NULL_Q_RQ) { ++ pr_err("legacy IO path is no longer available\n"); ++ return -EINVAL; ++ } ++ + dev->blocksize = round_down(dev->blocksize, 512); + dev->blocksize = clamp_t(unsigned int, dev->blocksize, 512, 4096); + +diff --git a/drivers/bluetooth/btbcm.c b/drivers/bluetooth/btbcm.c +index d263eac784daa..636db3b7e470b 100644 +--- a/drivers/bluetooth/btbcm.c ++++ b/drivers/bluetooth/btbcm.c +@@ -6,6 +6,7 @@ + * Copyright (C) 2015 Intel Corporation + */ + ++#include + #include + #include + #include +@@ -32,6 +33,43 @@ + /* For kmalloc-ing the fw-name array instead of putting it on the stack */ + typedef char bcm_fw_name[BCM_FW_NAME_LEN]; + ++#ifdef CONFIG_EFI ++static int btbcm_set_bdaddr_from_efi(struct hci_dev *hdev) ++{ ++ efi_guid_t guid = EFI_GUID(0x74b00bd9, 0x805a, 0x4d61, 0xb5, 0x1f, ++ 0x43, 0x26, 0x81, 0x23, 0xd1, 0x13); ++ bdaddr_t efi_bdaddr, bdaddr; ++ efi_status_t status; ++ unsigned long len; ++ int ret; ++ ++ if (!efi_rt_services_supported(EFI_RT_SUPPORTED_GET_VARIABLE)) ++ return -EOPNOTSUPP; ++ ++ len = sizeof(efi_bdaddr); ++ status = efi.get_variable(L"BDADDR", &guid, NULL, &len, &efi_bdaddr); ++ if (status != EFI_SUCCESS) ++ return -ENXIO; ++ ++ if (len != sizeof(efi_bdaddr)) ++ return -EIO; ++ ++ baswap(&bdaddr, &efi_bdaddr); ++ ++ ret = btbcm_set_bdaddr(hdev, &bdaddr); ++ if (ret) ++ return ret; ++ ++ bt_dev_info(hdev, "BCM: Using EFI device address (%pMR)", &bdaddr); ++ return 0; ++} ++#else ++static int btbcm_set_bdaddr_from_efi(struct hci_dev *hdev) ++{ ++ return -EOPNOTSUPP; ++} ++#endif ++ + int btbcm_check_bdaddr(struct hci_dev *hdev) + { + struct hci_rp_read_bd_addr *bda; +@@ -85,9 +123,12 @@ int btbcm_check_bdaddr(struct hci_dev *hdev) + !bacmp(&bda->bdaddr, BDADDR_BCM4345C5) || + !bacmp(&bda->bdaddr, BDADDR_BCM43430A0) || + !bacmp(&bda->bdaddr, BDADDR_BCM43341B)) { +- bt_dev_info(hdev, "BCM: Using default device address (%pMR)", +- &bda->bdaddr); +- set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks); ++ /* Try falling back to BDADDR EFI variable */ ++ if (btbcm_set_bdaddr_from_efi(hdev) != 0) { ++ bt_dev_info(hdev, "BCM: Using default device address (%pMR)", ++ &bda->bdaddr); ++ set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks); ++ } + } + + kfree_skb(skb); +diff --git a/drivers/char/tpm/tpm_tis.c b/drivers/char/tpm/tpm_tis.c +index 14fad16d371fb..3e1bb28b7efdf 100644 +--- a/drivers/char/tpm/tpm_tis.c ++++ b/drivers/char/tpm/tpm_tis.c +@@ -83,6 +83,22 @@ static const struct dmi_system_id tpm_tis_dmi_table[] = { + DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T490s"), + }, + }, ++ { ++ .callback = tpm_tis_disable_irq, ++ .ident = "ThinkStation P360 Tiny", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkStation P360 Tiny"), ++ }, ++ }, ++ { ++ .callback = tpm_tis_disable_irq, ++ .ident = "ThinkPad L490", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad L490"), ++ }, ++ }, + {} + }; + +diff --git a/drivers/clk/tegra/clk-tegra20.c b/drivers/clk/tegra/clk-tegra20.c +index d60ee6e318a55..fb1da5d63f4b2 100644 +--- a/drivers/clk/tegra/clk-tegra20.c ++++ b/drivers/clk/tegra/clk-tegra20.c +@@ -18,24 +18,24 @@ + #define MISC_CLK_ENB 0x48 + + #define OSC_CTRL 0x50 +-#define OSC_CTRL_OSC_FREQ_MASK (3<<30) +-#define OSC_CTRL_OSC_FREQ_13MHZ (0<<30) +-#define OSC_CTRL_OSC_FREQ_19_2MHZ (1<<30) +-#define OSC_CTRL_OSC_FREQ_12MHZ (2<<30) +-#define OSC_CTRL_OSC_FREQ_26MHZ (3<<30) +-#define OSC_CTRL_MASK (0x3f2 | OSC_CTRL_OSC_FREQ_MASK) +- +-#define OSC_CTRL_PLL_REF_DIV_MASK (3<<28) +-#define OSC_CTRL_PLL_REF_DIV_1 (0<<28) +-#define OSC_CTRL_PLL_REF_DIV_2 (1<<28) +-#define OSC_CTRL_PLL_REF_DIV_4 (2<<28) ++#define OSC_CTRL_OSC_FREQ_MASK (3u<<30) ++#define OSC_CTRL_OSC_FREQ_13MHZ (0u<<30) ++#define OSC_CTRL_OSC_FREQ_19_2MHZ (1u<<30) ++#define OSC_CTRL_OSC_FREQ_12MHZ (2u<<30) ++#define OSC_CTRL_OSC_FREQ_26MHZ (3u<<30) ++#define OSC_CTRL_MASK (0x3f2u | OSC_CTRL_OSC_FREQ_MASK) ++ ++#define OSC_CTRL_PLL_REF_DIV_MASK (3u<<28) ++#define OSC_CTRL_PLL_REF_DIV_1 (0u<<28) ++#define OSC_CTRL_PLL_REF_DIV_2 (1u<<28) ++#define OSC_CTRL_PLL_REF_DIV_4 (2u<<28) + + #define OSC_FREQ_DET 0x58 +-#define OSC_FREQ_DET_TRIG (1<<31) ++#define OSC_FREQ_DET_TRIG (1u<<31) + + #define OSC_FREQ_DET_STATUS 0x5c +-#define OSC_FREQ_DET_BUSY (1<<31) +-#define OSC_FREQ_DET_CNT_MASK 0xFFFF ++#define OSC_FREQ_DET_BUSYu (1<<31) ++#define OSC_FREQ_DET_CNT_MASK 0xFFFFu + + #define TEGRA20_CLK_PERIPH_BANKS 3 + +diff --git a/drivers/firmware/arm_sdei.c b/drivers/firmware/arm_sdei.c +index 840754dcc6ca4..5a877d76078f7 100644 +--- a/drivers/firmware/arm_sdei.c ++++ b/drivers/firmware/arm_sdei.c +@@ -44,6 +44,8 @@ static asmlinkage void (*sdei_firmware_call)(unsigned long function_id, + /* entry point from firmware to arch asm code */ + static unsigned long sdei_entry_point; + ++static int sdei_hp_state; ++ + struct sdei_event { + /* These three are protected by the sdei_list_lock */ + struct list_head list; +@@ -302,8 +304,6 @@ int sdei_mask_local_cpu(void) + { + int err; + +- WARN_ON_ONCE(preemptible()); +- + err = invoke_sdei_fn(SDEI_1_0_FN_SDEI_PE_MASK, 0, 0, 0, 0, 0, NULL); + if (err && err != -EIO) { + pr_warn_once("failed to mask CPU[%u]: %d\n", +@@ -316,6 +316,7 @@ int sdei_mask_local_cpu(void) + + static void _ipi_mask_cpu(void *ignored) + { ++ WARN_ON_ONCE(preemptible()); + sdei_mask_local_cpu(); + } + +@@ -323,8 +324,6 @@ int sdei_unmask_local_cpu(void) + { + int err; + +- WARN_ON_ONCE(preemptible()); +- + err = invoke_sdei_fn(SDEI_1_0_FN_SDEI_PE_UNMASK, 0, 0, 0, 0, 0, NULL); + if (err && err != -EIO) { + pr_warn_once("failed to unmask CPU[%u]: %d\n", +@@ -337,6 +336,7 @@ int sdei_unmask_local_cpu(void) + + static void _ipi_unmask_cpu(void *ignored) + { ++ WARN_ON_ONCE(preemptible()); + sdei_unmask_local_cpu(); + } + +@@ -344,6 +344,8 @@ static void _ipi_private_reset(void *ignored) + { + int err; + ++ WARN_ON_ONCE(preemptible()); ++ + err = invoke_sdei_fn(SDEI_1_0_FN_SDEI_PRIVATE_RESET, 0, 0, 0, 0, 0, + NULL); + if (err && err != -EIO) +@@ -390,8 +392,6 @@ static void _local_event_enable(void *data) + int err; + struct sdei_crosscall_args *arg = data; + +- WARN_ON_ONCE(preemptible()); +- + err = sdei_api_event_enable(arg->event->event_num); + + sdei_cross_call_return(arg, err); +@@ -480,8 +480,6 @@ static void _local_event_unregister(void *data) + int err; + struct sdei_crosscall_args *arg = data; + +- WARN_ON_ONCE(preemptible()); +- + err = sdei_api_event_unregister(arg->event->event_num); + + sdei_cross_call_return(arg, err); +@@ -562,8 +560,6 @@ static void _local_event_register(void *data) + struct sdei_registered_event *reg; + struct sdei_crosscall_args *arg = data; + +- WARN_ON(preemptible()); +- + reg = per_cpu_ptr(arg->event->private_registered, smp_processor_id()); + err = sdei_api_event_register(arg->event->event_num, sdei_entry_point, + reg, 0, 0); +@@ -718,6 +714,8 @@ static int sdei_pm_notifier(struct notifier_block *nb, unsigned long action, + { + int rv; + ++ WARN_ON_ONCE(preemptible()); ++ + switch (action) { + case CPU_PM_ENTER: + rv = sdei_mask_local_cpu(); +@@ -766,7 +764,7 @@ static int sdei_device_freeze(struct device *dev) + int err; + + /* unregister private events */ +- cpuhp_remove_state(CPUHP_AP_ARM_SDEI_STARTING); ++ cpuhp_remove_state(sdei_entry_point); + + err = sdei_unregister_shared(); + if (err) +@@ -787,12 +785,15 @@ static int sdei_device_thaw(struct device *dev) + return err; + } + +- err = cpuhp_setup_state(CPUHP_AP_ARM_SDEI_STARTING, "SDEI", ++ err = cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, "SDEI", + &sdei_cpuhp_up, &sdei_cpuhp_down); +- if (err) ++ if (err < 0) { + pr_warn("Failed to re-register CPU hotplug notifier...\n"); ++ return err; ++ } + +- return err; ++ sdei_hp_state = err; ++ return 0; + } + + static int sdei_device_restore(struct device *dev) +@@ -824,7 +825,7 @@ static int sdei_reboot_notifier(struct notifier_block *nb, unsigned long action, + * We are going to reset the interface, after this there is no point + * doing work when we take CPUs offline. + */ +- cpuhp_remove_state(CPUHP_AP_ARM_SDEI_STARTING); ++ cpuhp_remove_state(sdei_hp_state); + + sdei_platform_reset(); + +@@ -1004,13 +1005,15 @@ static int sdei_probe(struct platform_device *pdev) + goto remove_cpupm; + } + +- err = cpuhp_setup_state(CPUHP_AP_ARM_SDEI_STARTING, "SDEI", ++ err = cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, "SDEI", + &sdei_cpuhp_up, &sdei_cpuhp_down); +- if (err) { ++ if (err < 0) { + pr_warn("Failed to register CPU hotplug notifier...\n"); + goto remove_reboot; + } + ++ sdei_hp_state = err; ++ + return 0; + + remove_reboot: +diff --git a/drivers/gpio/gpio-mockup.c b/drivers/gpio/gpio-mockup.c +index 876027fdefc95..e20b60432e01d 100644 +--- a/drivers/gpio/gpio-mockup.c ++++ b/drivers/gpio/gpio-mockup.c +@@ -370,7 +370,7 @@ static void gpio_mockup_debugfs_setup(struct device *dev, + priv->offset = i; + priv->desc = &gc->gpiodev->descs[i]; + +- debugfs_create_file(name, 0200, chip->dbg_dir, priv, ++ debugfs_create_file(name, 0600, chip->dbg_dir, priv, + &gpio_mockup_debugfs_ops); + } + } +diff --git a/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c b/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c +index 930d2b7d34489..9dd41eaf32cb5 100644 +--- a/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c ++++ b/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c +@@ -406,11 +406,8 @@ static enum bp_result get_gpio_i2c_info( + info->i2c_slave_address = record->i2c_slave_addr; + + /* TODO: check how to get register offset for en, Y, etc. */ +- info->gpio_info.clk_a_register_index = +- le16_to_cpu( +- header->gpio_pin[table_index].data_a_reg_index); +- info->gpio_info.clk_a_shift = +- header->gpio_pin[table_index].gpio_bitshift; ++ info->gpio_info.clk_a_register_index = le16_to_cpu(pin->data_a_reg_index); ++ info->gpio_info.clk_a_shift = pin->gpio_bitshift; + + return BP_RESULT_OK; + } +diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c +index e2e79025825f8..a54a309879246 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c ++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c +@@ -1011,7 +1011,7 @@ static void dce_transform_set_pixel_storage_depth( + color_depth = COLOR_DEPTH_101010; + pixel_depth = 0; + expan_mode = 1; +- BREAK_TO_DEBUGGER(); ++ DC_LOG_DC("The pixel depth %d is not valid, set COLOR_DEPTH_101010 instead.", depth); + break; + } + +@@ -1025,8 +1025,7 @@ static void dce_transform_set_pixel_storage_depth( + if (!(xfm_dce->lb_pixel_depth_supported & depth)) { + /*we should use unsupported capabilities + * unless it is required by w/a*/ +- DC_LOG_WARNING("%s: Capability not supported", +- __func__); ++ DC_LOG_DC("%s: Capability not supported", __func__); + } + } + +diff --git a/drivers/gpu/drm/drm_mipi_dsi.c b/drivers/gpu/drm/drm_mipi_dsi.c +index 19fb1d93a4f07..0c806e99e8690 100644 +--- a/drivers/gpu/drm/drm_mipi_dsi.c ++++ b/drivers/gpu/drm/drm_mipi_dsi.c +@@ -221,7 +221,7 @@ mipi_dsi_device_register_full(struct mipi_dsi_host *host, + return dsi; + } + +- dsi->dev.of_node = info->node; ++ device_set_node(&dsi->dev, of_fwnode_handle(info->node)); + dsi->channel = info->channel; + strlcpy(dsi->name, info->type, sizeof(dsi->name)); + +diff --git a/drivers/gpu/drm/exynos/exynos_drm_g2d.h b/drivers/gpu/drm/exynos/exynos_drm_g2d.h +index 74ea3c26deadc..1a5ae781b56c6 100644 +--- a/drivers/gpu/drm/exynos/exynos_drm_g2d.h ++++ b/drivers/gpu/drm/exynos/exynos_drm_g2d.h +@@ -34,11 +34,11 @@ static inline int exynos_g2d_exec_ioctl(struct drm_device *dev, void *data, + return -ENODEV; + } + +-int g2d_open(struct drm_device *drm_dev, struct drm_file *file) ++static inline int g2d_open(struct drm_device *drm_dev, struct drm_file *file) + { + return 0; + } + +-void g2d_close(struct drm_device *drm_dev, struct drm_file *file) ++static inline void g2d_close(struct drm_device *drm_dev, struct drm_file *file) + { } + #endif +diff --git a/drivers/gpu/drm/i915/display/intel_dp.c b/drivers/gpu/drm/i915/display/intel_dp.c +index 1c1931f5c958b..7f633f8b3239a 100644 +--- a/drivers/gpu/drm/i915/display/intel_dp.c ++++ b/drivers/gpu/drm/i915/display/intel_dp.c +@@ -2281,6 +2281,11 @@ static int intel_dp_dsc_compute_config(struct intel_dp *intel_dp, + pipe_config->dsc.slice_count = + drm_dp_dsc_sink_max_slice_count(intel_dp->dsc_dpcd, + true); ++ if (!pipe_config->dsc.slice_count) { ++ drm_dbg_kms(&dev_priv->drm, "Unsupported Slice Count %d\n", ++ pipe_config->dsc.slice_count); ++ return -EINVAL; ++ } + } else { + u16 dsc_max_output_bpp; + u8 dsc_dp_slice_count; +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c +index 108882bbd2b8b..7aa6accb74ad3 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c +@@ -51,11 +51,6 @@ + #define INTF_TPG_RGB_MAPPING 0x11C + #define INTF_PROG_FETCH_START 0x170 + #define INTF_PROG_ROT_START 0x174 +- +-#define INTF_FRAME_LINE_COUNT_EN 0x0A8 +-#define INTF_FRAME_COUNT 0x0AC +-#define INTF_LINE_COUNT 0x0B0 +- + #define INTF_MUX 0x25C + + static const struct dpu_intf_cfg *_intf_offset(enum dpu_intf intf, +diff --git a/drivers/gpu/drm/msm/dp/dp_audio.c b/drivers/gpu/drm/msm/dp/dp_audio.c +index d7e4a39a904e2..0eaaaa94563a3 100644 +--- a/drivers/gpu/drm/msm/dp/dp_audio.c ++++ b/drivers/gpu/drm/msm/dp/dp_audio.c +@@ -577,6 +577,18 @@ static struct hdmi_codec_pdata codec_data = { + .i2s = 1, + }; + ++void dp_unregister_audio_driver(struct device *dev, struct dp_audio *dp_audio) ++{ ++ struct dp_audio_private *audio_priv; ++ ++ audio_priv = container_of(dp_audio, struct dp_audio_private, dp_audio); ++ ++ if (audio_priv->audio_pdev) { ++ platform_device_unregister(audio_priv->audio_pdev); ++ audio_priv->audio_pdev = NULL; ++ } ++} ++ + int dp_register_audio_driver(struct device *dev, + struct dp_audio *dp_audio) + { +diff --git a/drivers/gpu/drm/msm/dp/dp_audio.h b/drivers/gpu/drm/msm/dp/dp_audio.h +index 84e5f4a5d26ba..4ab78880af829 100644 +--- a/drivers/gpu/drm/msm/dp/dp_audio.h ++++ b/drivers/gpu/drm/msm/dp/dp_audio.h +@@ -53,6 +53,8 @@ struct dp_audio *dp_audio_get(struct platform_device *pdev, + int dp_register_audio_driver(struct device *dev, + struct dp_audio *dp_audio); + ++void dp_unregister_audio_driver(struct device *dev, struct dp_audio *dp_audio); ++ + /** + * dp_audio_put() + * +diff --git a/drivers/gpu/drm/msm/dp/dp_display.c b/drivers/gpu/drm/msm/dp/dp_display.c +index 1c3dcbc6cce8c..0bcccf422192c 100644 +--- a/drivers/gpu/drm/msm/dp/dp_display.c ++++ b/drivers/gpu/drm/msm/dp/dp_display.c +@@ -276,6 +276,7 @@ static void dp_display_unbind(struct device *dev, struct device *master, + kthread_stop(dp->ev_tsk); + + dp_power_client_deinit(dp->power); ++ dp_unregister_audio_driver(dev, dp->audio); + dp_aux_unregister(dp->aux); + priv->dp = NULL; + } +diff --git a/drivers/gpu/drm/tegra/sor.c b/drivers/gpu/drm/tegra/sor.c +index 32c83f2e386ca..9d60d1c4cfcea 100644 +--- a/drivers/gpu/drm/tegra/sor.c ++++ b/drivers/gpu/drm/tegra/sor.c +@@ -1153,7 +1153,7 @@ static int tegra_sor_compute_config(struct tegra_sor *sor, + struct drm_dp_link *link) + { + const u64 f = 100000, link_rate = link->rate * 1000; +- const u64 pclk = mode->clock * 1000; ++ const u64 pclk = (u64)mode->clock * 1000; + u64 input, output, watermark, num; + struct tegra_sor_params params; + u32 num_syms_per_line; +diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c +index f5ea8e1d84452..2e32a21bbcbfc 100644 +--- a/drivers/hid/hid-logitech-hidpp.c ++++ b/drivers/hid/hid-logitech-hidpp.c +@@ -828,8 +828,7 @@ static int hidpp_unifying_init(struct hidpp_device *hidpp) + if (ret) + return ret; + +- snprintf(hdev->uniq, sizeof(hdev->uniq), "%04x-%4phD", +- hdev->product, &serial); ++ snprintf(hdev->uniq, sizeof(hdev->uniq), "%4phD", &serial); + dbg_hid("HID++ Unifying: Got serial: %s\n", hdev->uniq); + + name = hidpp_unifying_get_name(hidpp); +@@ -922,6 +921,54 @@ print_version: + return 0; + } + ++/* -------------------------------------------------------------------------- */ ++/* 0x0003: Device Information */ ++/* -------------------------------------------------------------------------- */ ++ ++#define HIDPP_PAGE_DEVICE_INFORMATION 0x0003 ++ ++#define CMD_GET_DEVICE_INFO 0x00 ++ ++static int hidpp_get_serial(struct hidpp_device *hidpp, u32 *serial) ++{ ++ struct hidpp_report response; ++ u8 feature_type; ++ u8 feature_index; ++ int ret; ++ ++ ret = hidpp_root_get_feature(hidpp, HIDPP_PAGE_DEVICE_INFORMATION, ++ &feature_index, ++ &feature_type); ++ if (ret) ++ return ret; ++ ++ ret = hidpp_send_fap_command_sync(hidpp, feature_index, ++ CMD_GET_DEVICE_INFO, ++ NULL, 0, &response); ++ if (ret) ++ return ret; ++ ++ /* See hidpp_unifying_get_serial() */ ++ *serial = *((u32 *)&response.rap.params[1]); ++ return 0; ++} ++ ++static int hidpp_serial_init(struct hidpp_device *hidpp) ++{ ++ struct hid_device *hdev = hidpp->hid_dev; ++ u32 serial; ++ int ret; ++ ++ ret = hidpp_get_serial(hidpp, &serial); ++ if (ret) ++ return ret; ++ ++ snprintf(hdev->uniq, sizeof(hdev->uniq), "%4phD", &serial); ++ dbg_hid("HID++ DeviceInformation: Got serial: %s\n", hdev->uniq); ++ ++ return 0; ++} ++ + /* -------------------------------------------------------------------------- */ + /* 0x0005: GetDeviceNameType */ + /* -------------------------------------------------------------------------- */ +@@ -3855,6 +3902,8 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id) + + if (hidpp->quirks & HIDPP_QUIRK_UNIFYING) + hidpp_unifying_init(hidpp); ++ else if (hid_is_usb(hidpp->hid_dev)) ++ hidpp_serial_init(hidpp); + + connected = hidpp_root_get_protocol_version(hidpp) == 0; + atomic_set(&hidpp->connected, connected); +diff --git a/drivers/hid/wacom.h b/drivers/hid/wacom.h +index 203d27d198b81..3f8b24a57014b 100644 +--- a/drivers/hid/wacom.h ++++ b/drivers/hid/wacom.h +@@ -91,6 +91,7 @@ + #include + #include + #include ++#include + #include + + /* +@@ -167,6 +168,7 @@ struct wacom { + struct delayed_work init_work; + struct wacom_remote *remote; + struct work_struct mode_change_work; ++ struct timer_list idleprox_timer; + bool generic_has_leds; + struct wacom_leds { + struct wacom_group_leds *groups; +@@ -239,4 +241,5 @@ struct wacom_led *wacom_led_find(struct wacom *wacom, unsigned int group, + struct wacom_led *wacom_led_next(struct wacom *wacom, struct wacom_led *cur); + int wacom_equivalent_usage(int usage); + int wacom_initialize_leds(struct wacom *wacom); ++void wacom_idleprox_timeout(struct timer_list *list); + #endif +diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c +index b42785fdf7ed5..a93070f5b214c 100644 +--- a/drivers/hid/wacom_sys.c ++++ b/drivers/hid/wacom_sys.c +@@ -2781,6 +2781,7 @@ static int wacom_probe(struct hid_device *hdev, + INIT_WORK(&wacom->battery_work, wacom_battery_work); + INIT_WORK(&wacom->remote_work, wacom_remote_work); + INIT_WORK(&wacom->mode_change_work, wacom_mode_change_work); ++ timer_setup(&wacom->idleprox_timer, &wacom_idleprox_timeout, TIMER_DEFERRABLE); + + /* ask for the report descriptor to be loaded by HID */ + error = hid_parse(hdev); +@@ -2825,6 +2826,7 @@ static void wacom_remove(struct hid_device *hdev) + cancel_work_sync(&wacom->battery_work); + cancel_work_sync(&wacom->remote_work); + cancel_work_sync(&wacom->mode_change_work); ++ del_timer_sync(&wacom->idleprox_timer); + if (hdev->bus == BUS_BLUETOOTH) + device_remove_file(&hdev->dev, &dev_attr_speed); + +diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c +index 6c64165fae13e..37754a1f733b4 100644 +--- a/drivers/hid/wacom_wac.c ++++ b/drivers/hid/wacom_wac.c +@@ -11,6 +11,7 @@ + #include "wacom_wac.h" + #include "wacom.h" + #include ++#include + + /* resolution for penabled devices */ + #define WACOM_PL_RES 20 +@@ -41,6 +42,43 @@ static int wacom_numbered_button_to_key(int n); + + static void wacom_update_led(struct wacom *wacom, int button_count, int mask, + int group); ++ ++static void wacom_force_proxout(struct wacom_wac *wacom_wac) ++{ ++ struct input_dev *input = wacom_wac->pen_input; ++ ++ wacom_wac->shared->stylus_in_proximity = 0; ++ ++ input_report_key(input, BTN_TOUCH, 0); ++ input_report_key(input, BTN_STYLUS, 0); ++ input_report_key(input, BTN_STYLUS2, 0); ++ input_report_key(input, BTN_STYLUS3, 0); ++ input_report_key(input, wacom_wac->tool[0], 0); ++ if (wacom_wac->serial[0]) { ++ input_report_abs(input, ABS_MISC, 0); ++ } ++ input_report_abs(input, ABS_PRESSURE, 0); ++ ++ wacom_wac->tool[0] = 0; ++ wacom_wac->id[0] = 0; ++ wacom_wac->serial[0] = 0; ++ ++ input_sync(input); ++} ++ ++void wacom_idleprox_timeout(struct timer_list *list) ++{ ++ struct wacom *wacom = from_timer(wacom, list, idleprox_timer); ++ struct wacom_wac *wacom_wac = &wacom->wacom_wac; ++ ++ if (!wacom_wac->hid_data.sense_state) { ++ return; ++ } ++ ++ hid_warn(wacom->hdev, "%s: tool appears to be hung in-prox. forcing it out.\n", __func__); ++ wacom_force_proxout(wacom_wac); ++} ++ + /* + * Percent of battery capacity for Graphire. + * 8th value means AC online and show 100% capacity. +@@ -675,11 +713,14 @@ static int wacom_intuos_get_tool_type(int tool_id) + case 0x802: /* Intuos4/5 13HD/24HD General Pen */ + case 0x8e2: /* IntuosHT2 pen */ + case 0x022: ++ case 0x200: /* Pro Pen 3 */ ++ case 0x04200: /* Pro Pen 3 */ + case 0x10842: /* MobileStudio Pro Pro Pen slim */ + case 0x14802: /* Intuos4/5 13HD/24HD Classic Pen */ + case 0x16802: /* Cintiq 13HD Pro Pen */ + case 0x18802: /* DTH2242 Pen */ + case 0x10802: /* Intuos4/5 13HD/24HD General Pen */ ++ case 0x80842: /* Intuos Pro and Cintiq Pro 3D Pen */ + tool_type = BTN_TOOL_PEN; + break; + +@@ -1927,18 +1968,7 @@ static void wacom_map_usage(struct input_dev *input, struct hid_usage *usage, + static void wacom_wac_battery_usage_mapping(struct hid_device *hdev, + struct hid_field *field, struct hid_usage *usage) + { +- struct wacom *wacom = hid_get_drvdata(hdev); +- struct wacom_wac *wacom_wac = &wacom->wacom_wac; +- struct wacom_features *features = &wacom_wac->features; +- unsigned equivalent_usage = wacom_equivalent_usage(usage->hid); +- +- switch (equivalent_usage) { +- case HID_DG_BATTERYSTRENGTH: +- case WACOM_HID_WD_BATTERY_LEVEL: +- case WACOM_HID_WD_BATTERY_CHARGING: +- features->quirks |= WACOM_QUIRK_BATTERY; +- break; +- } ++ return; + } + + static void wacom_wac_battery_event(struct hid_device *hdev, struct hid_field *field, +@@ -1959,18 +1989,21 @@ static void wacom_wac_battery_event(struct hid_device *hdev, struct hid_field *f + wacom_wac->hid_data.bat_connected = 1; + wacom_wac->hid_data.bat_status = WACOM_POWER_SUPPLY_STATUS_AUTO; + } ++ wacom_wac->features.quirks |= WACOM_QUIRK_BATTERY; + break; + case WACOM_HID_WD_BATTERY_LEVEL: + value = value * 100 / (field->logical_maximum - field->logical_minimum); + wacom_wac->hid_data.battery_capacity = value; + wacom_wac->hid_data.bat_connected = 1; + wacom_wac->hid_data.bat_status = WACOM_POWER_SUPPLY_STATUS_AUTO; ++ wacom_wac->features.quirks |= WACOM_QUIRK_BATTERY; + break; + case WACOM_HID_WD_BATTERY_CHARGING: + wacom_wac->hid_data.bat_charging = value; + wacom_wac->hid_data.ps_connected = value; + wacom_wac->hid_data.bat_connected = 1; + wacom_wac->hid_data.bat_status = WACOM_POWER_SUPPLY_STATUS_AUTO; ++ wacom_wac->features.quirks |= WACOM_QUIRK_BATTERY; + break; + } + } +@@ -1986,18 +2019,15 @@ static void wacom_wac_battery_report(struct hid_device *hdev, + { + struct wacom *wacom = hid_get_drvdata(hdev); + struct wacom_wac *wacom_wac = &wacom->wacom_wac; +- struct wacom_features *features = &wacom_wac->features; + +- if (features->quirks & WACOM_QUIRK_BATTERY) { +- int status = wacom_wac->hid_data.bat_status; +- int capacity = wacom_wac->hid_data.battery_capacity; +- bool charging = wacom_wac->hid_data.bat_charging; +- bool connected = wacom_wac->hid_data.bat_connected; +- bool powered = wacom_wac->hid_data.ps_connected; ++ int status = wacom_wac->hid_data.bat_status; ++ int capacity = wacom_wac->hid_data.battery_capacity; ++ bool charging = wacom_wac->hid_data.bat_charging; ++ bool connected = wacom_wac->hid_data.bat_connected; ++ bool powered = wacom_wac->hid_data.ps_connected; + +- wacom_notify_battery(wacom_wac, status, capacity, charging, +- connected, powered); +- } ++ wacom_notify_battery(wacom_wac, status, capacity, charging, ++ connected, powered); + } + + static void wacom_wac_pad_usage_mapping(struct hid_device *hdev, +@@ -2339,6 +2369,7 @@ static void wacom_wac_pen_event(struct hid_device *hdev, struct hid_field *field + value = field->logical_maximum - value; + break; + case HID_DG_INRANGE: ++ mod_timer(&wacom->idleprox_timer, jiffies + msecs_to_jiffies(100)); + wacom_wac->hid_data.inrange_state = value; + if (!(features->quirks & WACOM_QUIRK_SENSE)) + wacom_wac->hid_data.sense_state = value; +@@ -4812,6 +4843,10 @@ static const struct wacom_features wacom_features_0x3c6 = + static const struct wacom_features wacom_features_0x3c8 = + { "Wacom Intuos BT M", 21600, 13500, 4095, 63, + INTUOSHT3_BT, WACOM_INTUOS_RES, WACOM_INTUOS_RES, 4 }; ++static const struct wacom_features wacom_features_0x3dd = ++ { "Wacom Intuos Pro S", 31920, 19950, 8191, 63, ++ INTUOSP2S_BT, WACOM_INTUOS3_RES, WACOM_INTUOS3_RES, 7, ++ .touch_max = 10 }; + + static const struct wacom_features wacom_features_HID_ANY_ID = + { "Wacom HID", .type = HID_GENERIC, .oVid = HID_ANY_ID, .oPid = HID_ANY_ID }; +@@ -4991,6 +5026,7 @@ const struct hid_device_id wacom_ids[] = { + { BT_DEVICE_WACOM(0x393) }, + { BT_DEVICE_WACOM(0x3c6) }, + { BT_DEVICE_WACOM(0x3c8) }, ++ { BT_DEVICE_WACOM(0x3dd) }, + { USB_DEVICE_WACOM(0x4001) }, + { USB_DEVICE_WACOM(0x4004) }, + { USB_DEVICE_WACOM(0x5000) }, +diff --git a/drivers/hwtracing/coresight/coresight-tmc-etr.c b/drivers/hwtracing/coresight/coresight-tmc-etr.c +index 3309b1344ffc0..3e74f5aed20d7 100644 +--- a/drivers/hwtracing/coresight/coresight-tmc-etr.c ++++ b/drivers/hwtracing/coresight/coresight-tmc-etr.c +@@ -926,7 +926,7 @@ tmc_etr_buf_insert_barrier_packet(struct etr_buf *etr_buf, u64 offset) + + len = tmc_etr_buf_get_data(etr_buf, offset, + CORESIGHT_BARRIER_PKT_SIZE, &bufp); +- if (WARN_ON(len < CORESIGHT_BARRIER_PKT_SIZE)) ++ if (WARN_ON(len < 0 || len < CORESIGHT_BARRIER_PKT_SIZE)) + return -EINVAL; + coresight_insert_barrier_packet(bufp); + return offset + CORESIGHT_BARRIER_PKT_SIZE; +diff --git a/drivers/infiniband/core/user_mad.c b/drivers/infiniband/core/user_mad.c +index 4688a6657c875..3bd0dcde8576d 100644 +--- a/drivers/infiniband/core/user_mad.c ++++ b/drivers/infiniband/core/user_mad.c +@@ -131,6 +131,11 @@ struct ib_umad_packet { + struct ib_user_mad mad; + }; + ++struct ib_rmpp_mad_hdr { ++ struct ib_mad_hdr mad_hdr; ++ struct ib_rmpp_hdr rmpp_hdr; ++} __packed; ++ + #define CREATE_TRACE_POINTS + #include + +@@ -494,11 +499,11 @@ static ssize_t ib_umad_write(struct file *filp, const char __user *buf, + size_t count, loff_t *pos) + { + struct ib_umad_file *file = filp->private_data; ++ struct ib_rmpp_mad_hdr *rmpp_mad_hdr; + struct ib_umad_packet *packet; + struct ib_mad_agent *agent; + struct rdma_ah_attr ah_attr; + struct ib_ah *ah; +- struct ib_rmpp_mad *rmpp_mad; + __be64 *tid; + int ret, data_len, hdr_len, copy_offset, rmpp_active; + u8 base_version; +@@ -506,7 +511,7 @@ static ssize_t ib_umad_write(struct file *filp, const char __user *buf, + if (count < hdr_size(file) + IB_MGMT_RMPP_HDR) + return -EINVAL; + +- packet = kzalloc(sizeof *packet + IB_MGMT_RMPP_HDR, GFP_KERNEL); ++ packet = kzalloc(sizeof(*packet) + IB_MGMT_RMPP_HDR, GFP_KERNEL); + if (!packet) + return -ENOMEM; + +@@ -560,13 +565,13 @@ static ssize_t ib_umad_write(struct file *filp, const char __user *buf, + goto err_up; + } + +- rmpp_mad = (struct ib_rmpp_mad *) packet->mad.data; +- hdr_len = ib_get_mad_data_offset(rmpp_mad->mad_hdr.mgmt_class); ++ rmpp_mad_hdr = (struct ib_rmpp_mad_hdr *)packet->mad.data; ++ hdr_len = ib_get_mad_data_offset(rmpp_mad_hdr->mad_hdr.mgmt_class); + +- if (ib_is_mad_class_rmpp(rmpp_mad->mad_hdr.mgmt_class) ++ if (ib_is_mad_class_rmpp(rmpp_mad_hdr->mad_hdr.mgmt_class) + && ib_mad_kernel_rmpp_agent(agent)) { + copy_offset = IB_MGMT_RMPP_HDR; +- rmpp_active = ib_get_rmpp_flags(&rmpp_mad->rmpp_hdr) & ++ rmpp_active = ib_get_rmpp_flags(&rmpp_mad_hdr->rmpp_hdr) & + IB_MGMT_RMPP_FLAG_ACTIVE; + } else { + copy_offset = IB_MGMT_MAD_HDR; +@@ -615,12 +620,12 @@ static ssize_t ib_umad_write(struct file *filp, const char __user *buf, + tid = &((struct ib_mad_hdr *) packet->msg->mad)->tid; + *tid = cpu_to_be64(((u64) agent->hi_tid) << 32 | + (be64_to_cpup(tid) & 0xffffffff)); +- rmpp_mad->mad_hdr.tid = *tid; ++ rmpp_mad_hdr->mad_hdr.tid = *tid; + } + + if (!ib_mad_kernel_rmpp_agent(agent) +- && ib_is_mad_class_rmpp(rmpp_mad->mad_hdr.mgmt_class) +- && (ib_get_rmpp_flags(&rmpp_mad->rmpp_hdr) & IB_MGMT_RMPP_FLAG_ACTIVE)) { ++ && ib_is_mad_class_rmpp(rmpp_mad_hdr->mad_hdr.mgmt_class) ++ && (ib_get_rmpp_flags(&rmpp_mad_hdr->rmpp_hdr) & IB_MGMT_RMPP_FLAG_ACTIVE)) { + spin_lock_irq(&file->send_lock); + list_add_tail(&packet->list, &file->send_list); + spin_unlock_irq(&file->send_lock); +diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c +index 70dedc0f7827c..0bd55e1fca372 100644 +--- a/drivers/input/joystick/xpad.c ++++ b/drivers/input/joystick/xpad.c +@@ -489,6 +489,9 @@ struct xboxone_init_packet { + } + + ++#define GIP_WIRED_INTF_DATA 0 ++#define GIP_WIRED_INTF_AUDIO 1 ++ + /* + * This packet is required for all Xbox One pads with 2015 + * or later firmware installed (or present from the factory). +@@ -1813,7 +1816,7 @@ static int xpad_probe(struct usb_interface *intf, const struct usb_device_id *id + } + + if (xpad->xtype == XTYPE_XBOXONE && +- intf->cur_altsetting->desc.bInterfaceNumber != 0) { ++ intf->cur_altsetting->desc.bInterfaceNumber != GIP_WIRED_INTF_DATA) { + /* + * The Xbox One controller lists three interfaces all with the + * same interface class, subclass and protocol. Differentiate by +diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +index bc4cbc7542ce2..982c42c873102 100644 +--- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c ++++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +@@ -162,6 +162,18 @@ static void queue_inc_cons(struct arm_smmu_ll_queue *q) + q->cons = Q_OVF(q->cons) | Q_WRP(q, cons) | Q_IDX(q, cons); + } + ++static void queue_sync_cons_ovf(struct arm_smmu_queue *q) ++{ ++ struct arm_smmu_ll_queue *llq = &q->llq; ++ ++ if (likely(Q_OVF(llq->prod) == Q_OVF(llq->cons))) ++ return; ++ ++ llq->cons = Q_OVF(llq->prod) | Q_WRP(llq, llq->cons) | ++ Q_IDX(llq, llq->cons); ++ queue_sync_cons_out(q); ++} ++ + static int queue_sync_prod_in(struct arm_smmu_queue *q) + { + u32 prod; +@@ -1380,8 +1392,7 @@ static irqreturn_t arm_smmu_evtq_thread(int irq, void *dev) + } while (!queue_empty(llq)); + + /* Sync our overflow flag, as we believe we're up to speed */ +- llq->cons = Q_OVF(llq->prod) | Q_WRP(llq, llq->cons) | +- Q_IDX(llq, llq->cons); ++ queue_sync_cons_ovf(q); + return IRQ_HANDLED; + } + +@@ -1439,9 +1450,7 @@ static irqreturn_t arm_smmu_priq_thread(int irq, void *dev) + } while (!queue_empty(llq)); + + /* Sync our overflow flag, as we believe we're up to speed */ +- llq->cons = Q_OVF(llq->prod) | Q_WRP(llq, llq->cons) | +- Q_IDX(llq, llq->cons); +- queue_sync_cons_out(q); ++ queue_sync_cons_ovf(q); + return IRQ_HANDLED; + } + +diff --git a/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c b/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c +index 63f7173b241f0..1598a1ddbf694 100644 +--- a/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c ++++ b/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c +@@ -32,12 +32,26 @@ static const struct of_device_id qcom_smmu_client_of_match[] __maybe_unused = { + + static int qcom_smmu_cfg_probe(struct arm_smmu_device *smmu) + { +- unsigned int last_s2cr = ARM_SMMU_GR0_S2CR(smmu->num_mapping_groups - 1); + struct qcom_smmu *qsmmu = to_qcom_smmu(smmu); ++ unsigned int last_s2cr; + u32 reg; + u32 smr; + int i; + ++ /* ++ * Some platforms support more than the Arm SMMU architected maximum of ++ * 128 stream matching groups. For unknown reasons, the additional ++ * groups don't exhibit the same behavior as the architected registers, ++ * so limit the groups to 128 until the behavior is fixed for the other ++ * groups. ++ */ ++ if (smmu->num_mapping_groups > 128) { ++ dev_notice(smmu->dev, "\tLimiting the stream matching groups to 128\n"); ++ smmu->num_mapping_groups = 128; ++ } ++ ++ last_s2cr = ARM_SMMU_GR0_S2CR(smmu->num_mapping_groups - 1); ++ + /* + * With some firmware versions writes to S2CR of type FAULT are + * ignored, and writing BYPASS will end up written as FAULT in the +diff --git a/drivers/mcb/mcb-pci.c b/drivers/mcb/mcb-pci.c +index dc88232d9af83..53d9202ff9a7c 100644 +--- a/drivers/mcb/mcb-pci.c ++++ b/drivers/mcb/mcb-pci.c +@@ -31,7 +31,7 @@ static int mcb_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) + { + struct resource *res; + struct priv *priv; +- int ret; ++ int ret, table_size; + unsigned long flags; + + priv = devm_kzalloc(&pdev->dev, sizeof(struct priv), GFP_KERNEL); +@@ -90,7 +90,30 @@ static int mcb_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) + if (ret < 0) + goto out_mcb_bus; + +- dev_dbg(&pdev->dev, "Found %d cells\n", ret); ++ table_size = ret; ++ ++ if (table_size < CHAM_HEADER_SIZE) { ++ /* Release the previous resources */ ++ devm_iounmap(&pdev->dev, priv->base); ++ devm_release_mem_region(&pdev->dev, priv->mapbase, CHAM_HEADER_SIZE); ++ ++ /* Then, allocate it again with the actual chameleon table size */ ++ res = devm_request_mem_region(&pdev->dev, priv->mapbase, ++ table_size, ++ KBUILD_MODNAME); ++ if (!res) { ++ dev_err(&pdev->dev, "Failed to request PCI memory\n"); ++ ret = -EBUSY; ++ goto out_mcb_bus; ++ } ++ ++ priv->base = devm_ioremap(&pdev->dev, priv->mapbase, table_size); ++ if (!priv->base) { ++ dev_err(&pdev->dev, "Cannot ioremap\n"); ++ ret = -ENOMEM; ++ goto out_mcb_bus; ++ } ++ } + + mcb_bus_add_devices(priv->bus); + +diff --git a/drivers/media/pci/netup_unidvb/netup_unidvb_core.c b/drivers/media/pci/netup_unidvb/netup_unidvb_core.c +index 77bae14685513..a71814e2772d1 100644 +--- a/drivers/media/pci/netup_unidvb/netup_unidvb_core.c ++++ b/drivers/media/pci/netup_unidvb/netup_unidvb_core.c +@@ -697,7 +697,7 @@ static void netup_unidvb_dma_fini(struct netup_unidvb_dev *ndev, int num) + netup_unidvb_dma_enable(dma, 0); + msleep(50); + cancel_work_sync(&dma->work); +- del_timer(&dma->timeout); ++ del_timer_sync(&dma->timeout); + } + + static int netup_unidvb_dma_setup(struct netup_unidvb_dev *ndev) +diff --git a/drivers/media/radio/radio-shark.c b/drivers/media/radio/radio-shark.c +index 8230da828d0ee..127a3be0e0f07 100644 +--- a/drivers/media/radio/radio-shark.c ++++ b/drivers/media/radio/radio-shark.c +@@ -316,6 +316,16 @@ static int usb_shark_probe(struct usb_interface *intf, + { + struct shark_device *shark; + int retval = -ENOMEM; ++ static const u8 ep_addresses[] = { ++ SHARK_IN_EP | USB_DIR_IN, ++ SHARK_OUT_EP | USB_DIR_OUT, ++ 0}; ++ ++ /* Are the expected endpoints present? */ ++ if (!usb_check_int_endpoints(intf, ep_addresses)) { ++ dev_err(&intf->dev, "Invalid radioSHARK device\n"); ++ return -EINVAL; ++ } + + shark = kzalloc(sizeof(struct shark_device), GFP_KERNEL); + if (!shark) +diff --git a/drivers/media/radio/radio-shark2.c b/drivers/media/radio/radio-shark2.c +index d150f12382c60..f1c5c0a6a335c 100644 +--- a/drivers/media/radio/radio-shark2.c ++++ b/drivers/media/radio/radio-shark2.c +@@ -282,6 +282,16 @@ static int usb_shark_probe(struct usb_interface *intf, + { + struct shark_device *shark; + int retval = -ENOMEM; ++ static const u8 ep_addresses[] = { ++ SHARK_IN_EP | USB_DIR_IN, ++ SHARK_OUT_EP | USB_DIR_OUT, ++ 0}; ++ ++ /* Are the expected endpoints present? */ ++ if (!usb_check_int_endpoints(intf, ep_addresses)) { ++ dev_err(&intf->dev, "Invalid radioSHARK2 device\n"); ++ return -EINVAL; ++ } + + shark = kzalloc(sizeof(struct shark_device), GFP_KERNEL); + if (!shark) +diff --git a/drivers/memstick/host/r592.c b/drivers/memstick/host/r592.c +index eaa2a94d18be4..dd06c18495eb6 100644 +--- a/drivers/memstick/host/r592.c ++++ b/drivers/memstick/host/r592.c +@@ -828,7 +828,7 @@ static void r592_remove(struct pci_dev *pdev) + /* Stop the processing thread. + That ensures that we won't take any more requests */ + kthread_stop(dev->io_thread); +- ++ del_timer_sync(&dev->detect_timer); + r592_enable_device(dev, false); + + while (!error && dev->req) { +diff --git a/drivers/message/fusion/mptlan.c b/drivers/message/fusion/mptlan.c +index 7d3784aa20e58..90cc3cd49a5ee 100644 +--- a/drivers/message/fusion/mptlan.c ++++ b/drivers/message/fusion/mptlan.c +@@ -1430,7 +1430,9 @@ mptlan_remove(struct pci_dev *pdev) + { + MPT_ADAPTER *ioc = pci_get_drvdata(pdev); + struct net_device *dev = ioc->netdev; ++ struct mpt_lan_priv *priv = netdev_priv(dev); + ++ cancel_delayed_work_sync(&priv->post_buckets_task); + if(dev != NULL) { + unregister_netdev(dev); + free_netdev(dev); +diff --git a/drivers/mfd/dln2.c b/drivers/mfd/dln2.c +index 852129ea07666..fc65f9e25fda8 100644 +--- a/drivers/mfd/dln2.c ++++ b/drivers/mfd/dln2.c +@@ -836,6 +836,7 @@ out_stop_rx: + dln2_stop_rx_urbs(dln2); + + out_free: ++ usb_put_dev(dln2->usb_dev); + dln2_free(dln2); + + return ret; +diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c +index c40b92f8d16bf..381e6cdd603a1 100644 +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -3537,7 +3537,11 @@ static int bond_slave_netdev_event(unsigned long event, + unblock_netpoll_tx(); + break; + case NETDEV_FEAT_CHANGE: +- bond_compute_features(bond); ++ if (!bond->notifier_ctx) { ++ bond->notifier_ctx = true; ++ bond_compute_features(bond); ++ bond->notifier_ctx = false; ++ } + break; + case NETDEV_RESEND_IGMP: + /* Propagate to master device */ +@@ -5360,6 +5364,8 @@ static int bond_init(struct net_device *bond_dev) + if (!bond->wq) + return -ENOMEM; + ++ bond->notifier_ctx = false; ++ + spin_lock_init(&bond->stats_lock); + netdev_lockdep_set_classes(bond_dev); + +diff --git a/drivers/net/can/kvaser_pciefd.c b/drivers/net/can/kvaser_pciefd.c +index 9d7445f6ef143..197390dfc6abc 100644 +--- a/drivers/net/can/kvaser_pciefd.c ++++ b/drivers/net/can/kvaser_pciefd.c +@@ -70,10 +70,12 @@ MODULE_DESCRIPTION("CAN driver for Kvaser CAN/PCIe devices"); + #define KVASER_PCIEFD_SYSID_BUILD_REG (KVASER_PCIEFD_SYSID_BASE + 0x14) + /* Shared receive buffer registers */ + #define KVASER_PCIEFD_SRB_BASE 0x1f200 ++#define KVASER_PCIEFD_SRB_FIFO_LAST_REG (KVASER_PCIEFD_SRB_BASE + 0x1f4) + #define KVASER_PCIEFD_SRB_CMD_REG (KVASER_PCIEFD_SRB_BASE + 0x200) + #define KVASER_PCIEFD_SRB_IEN_REG (KVASER_PCIEFD_SRB_BASE + 0x204) + #define KVASER_PCIEFD_SRB_IRQ_REG (KVASER_PCIEFD_SRB_BASE + 0x20c) + #define KVASER_PCIEFD_SRB_STAT_REG (KVASER_PCIEFD_SRB_BASE + 0x210) ++#define KVASER_PCIEFD_SRB_RX_NR_PACKETS_REG (KVASER_PCIEFD_SRB_BASE + 0x214) + #define KVASER_PCIEFD_SRB_CTRL_REG (KVASER_PCIEFD_SRB_BASE + 0x218) + /* EPCS flash controller registers */ + #define KVASER_PCIEFD_SPI_BASE 0x1fc00 +@@ -110,6 +112,9 @@ MODULE_DESCRIPTION("CAN driver for Kvaser CAN/PCIe devices"); + /* DMA support */ + #define KVASER_PCIEFD_SRB_STAT_DMA BIT(24) + ++/* SRB current packet level */ ++#define KVASER_PCIEFD_SRB_RX_NR_PACKETS_MASK 0xff ++ + /* DMA Enable */ + #define KVASER_PCIEFD_SRB_CTRL_DMA_ENABLE BIT(0) + +@@ -528,7 +533,7 @@ static int kvaser_pciefd_set_tx_irq(struct kvaser_pciefd_can *can) + KVASER_PCIEFD_KCAN_IRQ_TOF | KVASER_PCIEFD_KCAN_IRQ_ABD | + KVASER_PCIEFD_KCAN_IRQ_TAE | KVASER_PCIEFD_KCAN_IRQ_TAL | + KVASER_PCIEFD_KCAN_IRQ_FDIC | KVASER_PCIEFD_KCAN_IRQ_BPP | +- KVASER_PCIEFD_KCAN_IRQ_TAR | KVASER_PCIEFD_KCAN_IRQ_TFD; ++ KVASER_PCIEFD_KCAN_IRQ_TAR; + + iowrite32(msk, can->reg_base + KVASER_PCIEFD_KCAN_IEN_REG); + +@@ -556,6 +561,8 @@ static void kvaser_pciefd_setup_controller(struct kvaser_pciefd_can *can) + + if (can->can.ctrlmode & CAN_CTRLMODE_LISTENONLY) + mode |= KVASER_PCIEFD_KCAN_MODE_LOM; ++ else ++ mode &= ~KVASER_PCIEFD_KCAN_MODE_LOM; + + mode |= KVASER_PCIEFD_KCAN_MODE_EEN; + mode |= KVASER_PCIEFD_KCAN_MODE_EPEN; +@@ -574,7 +581,7 @@ static void kvaser_pciefd_start_controller_flush(struct kvaser_pciefd_can *can) + + spin_lock_irqsave(&can->lock, irq); + iowrite32(-1, can->reg_base + KVASER_PCIEFD_KCAN_IRQ_REG); +- iowrite32(KVASER_PCIEFD_KCAN_IRQ_ABD | KVASER_PCIEFD_KCAN_IRQ_TFD, ++ iowrite32(KVASER_PCIEFD_KCAN_IRQ_ABD, + can->reg_base + KVASER_PCIEFD_KCAN_IEN_REG); + + status = ioread32(can->reg_base + KVASER_PCIEFD_KCAN_STAT_REG); +@@ -617,7 +624,7 @@ static int kvaser_pciefd_bus_on(struct kvaser_pciefd_can *can) + iowrite32(0, can->reg_base + KVASER_PCIEFD_KCAN_IEN_REG); + iowrite32(-1, can->reg_base + KVASER_PCIEFD_KCAN_IRQ_REG); + +- iowrite32(KVASER_PCIEFD_KCAN_IRQ_ABD | KVASER_PCIEFD_KCAN_IRQ_TFD, ++ iowrite32(KVASER_PCIEFD_KCAN_IRQ_ABD, + can->reg_base + KVASER_PCIEFD_KCAN_IEN_REG); + + mode = ioread32(can->reg_base + KVASER_PCIEFD_KCAN_MODE_REG); +@@ -721,6 +728,7 @@ static int kvaser_pciefd_stop(struct net_device *netdev) + iowrite32(0, can->reg_base + KVASER_PCIEFD_KCAN_IEN_REG); + del_timer(&can->bec_poll_timer); + } ++ can->can.state = CAN_STATE_STOPPED; + close_candev(netdev); + + return ret; +@@ -1003,8 +1011,7 @@ static int kvaser_pciefd_setup_can_ctrls(struct kvaser_pciefd *pcie) + SET_NETDEV_DEV(netdev, &pcie->pci->dev); + + iowrite32(-1, can->reg_base + KVASER_PCIEFD_KCAN_IRQ_REG); +- iowrite32(KVASER_PCIEFD_KCAN_IRQ_ABD | +- KVASER_PCIEFD_KCAN_IRQ_TFD, ++ iowrite32(KVASER_PCIEFD_KCAN_IRQ_ABD, + can->reg_base + KVASER_PCIEFD_KCAN_IEN_REG); + + pcie->can[i] = can; +@@ -1054,6 +1061,7 @@ static int kvaser_pciefd_setup_dma(struct kvaser_pciefd *pcie) + { + int i; + u32 srb_status; ++ u32 srb_packet_count; + dma_addr_t dma_addr[KVASER_PCIEFD_DMA_COUNT]; + + /* Disable the DMA */ +@@ -1081,6 +1089,15 @@ static int kvaser_pciefd_setup_dma(struct kvaser_pciefd *pcie) + KVASER_PCIEFD_SRB_CMD_RDB1, + pcie->reg_base + KVASER_PCIEFD_SRB_CMD_REG); + ++ /* Empty Rx FIFO */ ++ srb_packet_count = ioread32(pcie->reg_base + KVASER_PCIEFD_SRB_RX_NR_PACKETS_REG) & ++ KVASER_PCIEFD_SRB_RX_NR_PACKETS_MASK; ++ while (srb_packet_count) { ++ /* Drop current packet in FIFO */ ++ ioread32(pcie->reg_base + KVASER_PCIEFD_SRB_FIFO_LAST_REG); ++ srb_packet_count--; ++ } ++ + srb_status = ioread32(pcie->reg_base + KVASER_PCIEFD_SRB_STAT_REG); + if (!(srb_status & KVASER_PCIEFD_SRB_STAT_DI)) { + dev_err(&pcie->pci->dev, "DMA not idle before enabling\n"); +@@ -1423,9 +1440,6 @@ static int kvaser_pciefd_handle_status_packet(struct kvaser_pciefd *pcie, + cmd = KVASER_PCIEFD_KCAN_CMD_AT; + cmd |= ++can->cmd_seq << KVASER_PCIEFD_KCAN_CMD_SEQ_SHIFT; + iowrite32(cmd, can->reg_base + KVASER_PCIEFD_KCAN_CMD_REG); +- +- iowrite32(KVASER_PCIEFD_KCAN_IRQ_TFD, +- can->reg_base + KVASER_PCIEFD_KCAN_IEN_REG); + } else if (p->header[0] & KVASER_PCIEFD_SPACK_IDET && + p->header[0] & KVASER_PCIEFD_SPACK_IRM && + cmdseq == (p->header[1] & KVASER_PCIEFD_PACKET_SEQ_MSK) && +@@ -1714,15 +1728,6 @@ static int kvaser_pciefd_transmit_irq(struct kvaser_pciefd_can *can) + if (irq & KVASER_PCIEFD_KCAN_IRQ_TOF) + netdev_err(can->can.dev, "Tx FIFO overflow\n"); + +- if (irq & KVASER_PCIEFD_KCAN_IRQ_TFD) { +- u8 count = ioread32(can->reg_base + +- KVASER_PCIEFD_KCAN_TX_NPACKETS_REG) & 0xff; +- +- if (count == 0) +- iowrite32(KVASER_PCIEFD_KCAN_CTRL_EFLUSH, +- can->reg_base + KVASER_PCIEFD_KCAN_CTRL_REG); +- } +- + if (irq & KVASER_PCIEFD_KCAN_IRQ_BPP) + netdev_err(can->can.dev, + "Fail to change bittiming, when not in reset mode\n"); +@@ -1824,6 +1829,11 @@ static int kvaser_pciefd_probe(struct pci_dev *pdev, + if (err) + goto err_teardown_can_ctrls; + ++ err = request_irq(pcie->pci->irq, kvaser_pciefd_irq_handler, ++ IRQF_SHARED, KVASER_PCIEFD_DRV_NAME, pcie); ++ if (err) ++ goto err_teardown_can_ctrls; ++ + iowrite32(KVASER_PCIEFD_SRB_IRQ_DPD0 | KVASER_PCIEFD_SRB_IRQ_DPD1, + pcie->reg_base + KVASER_PCIEFD_SRB_IRQ_REG); + +@@ -1844,11 +1854,6 @@ static int kvaser_pciefd_probe(struct pci_dev *pdev, + iowrite32(KVASER_PCIEFD_SRB_CMD_RDB1, + pcie->reg_base + KVASER_PCIEFD_SRB_CMD_REG); + +- err = request_irq(pcie->pci->irq, kvaser_pciefd_irq_handler, +- IRQF_SHARED, KVASER_PCIEFD_DRV_NAME, pcie); +- if (err) +- goto err_teardown_can_ctrls; +- + err = kvaser_pciefd_reg_candev(pcie); + if (err) + goto err_free_irq; +@@ -1856,6 +1861,8 @@ static int kvaser_pciefd_probe(struct pci_dev *pdev, + return 0; + + err_free_irq: ++ /* Disable PCI interrupts */ ++ iowrite32(0, pcie->reg_base + KVASER_PCIEFD_IEN_REG); + free_irq(pcie->pci->irq, pcie); + + err_teardown_can_ctrls: +diff --git a/drivers/net/ethernet/3com/3c589_cs.c b/drivers/net/ethernet/3com/3c589_cs.c +index 09816e84314d0..0197ef6f15826 100644 +--- a/drivers/net/ethernet/3com/3c589_cs.c ++++ b/drivers/net/ethernet/3com/3c589_cs.c +@@ -195,6 +195,7 @@ static int tc589_probe(struct pcmcia_device *link) + { + struct el3_private *lp; + struct net_device *dev; ++ int ret; + + dev_dbg(&link->dev, "3c589_attach()\n"); + +@@ -218,7 +219,15 @@ static int tc589_probe(struct pcmcia_device *link) + + dev->ethtool_ops = &netdev_ethtool_ops; + +- return tc589_config(link); ++ ret = tc589_config(link); ++ if (ret) ++ goto err_free_netdev; ++ ++ return 0; ++ ++err_free_netdev: ++ free_netdev(dev); ++ return ret; + } + + static void tc589_detach(struct pcmcia_device *link) +diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c +index 7667cbb5adfd6..145488449f133 100644 +--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c ++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c +@@ -3397,7 +3397,7 @@ err_clk_disable: + return ret; + } + +-static void bcmgenet_netif_stop(struct net_device *dev) ++static void bcmgenet_netif_stop(struct net_device *dev, bool stop_phy) + { + struct bcmgenet_priv *priv = netdev_priv(dev); + +@@ -3412,7 +3412,8 @@ static void bcmgenet_netif_stop(struct net_device *dev) + /* Disable MAC transmit. TX DMA disabled must be done before this */ + umac_enable_set(priv, CMD_TX_EN, false); + +- phy_stop(dev->phydev); ++ if (stop_phy) ++ phy_stop(dev->phydev); + bcmgenet_disable_rx_napi(priv); + bcmgenet_intr_disable(priv); + +@@ -3438,7 +3439,7 @@ static int bcmgenet_close(struct net_device *dev) + + netif_dbg(priv, ifdown, dev, "bcmgenet_close\n"); + +- bcmgenet_netif_stop(dev); ++ bcmgenet_netif_stop(dev, false); + + /* Really kill the PHY state machine and disconnect from it */ + phy_disconnect(dev->phydev); +@@ -4240,7 +4241,7 @@ static int bcmgenet_suspend(struct device *d) + + netif_device_detach(dev); + +- bcmgenet_netif_stop(dev); ++ bcmgenet_netif_stop(dev, true); + + if (!device_may_wakeup(d)) + phy_suspend(dev->phydev); +diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c +index 686bb873125cc..e18b3b72fc0df 100644 +--- a/drivers/net/ethernet/freescale/fec_main.c ++++ b/drivers/net/ethernet/freescale/fec_main.c +@@ -3850,9 +3850,11 @@ fec_drv_remove(struct platform_device *pdev) + struct device_node *np = pdev->dev.of_node; + int ret; + +- ret = pm_runtime_resume_and_get(&pdev->dev); ++ ret = pm_runtime_get_sync(&pdev->dev); + if (ret < 0) +- return ret; ++ dev_err(&pdev->dev, ++ "Failed to resume device in remove callback (%pe)\n", ++ ERR_PTR(ret)); + + cancel_work_sync(&fep->tx_timeout_work); + fec_ptp_stop(pdev); +@@ -3865,8 +3867,13 @@ fec_drv_remove(struct platform_device *pdev) + of_phy_deregister_fixed_link(np); + of_node_put(fep->phy_node); + +- clk_disable_unprepare(fep->clk_ahb); +- clk_disable_unprepare(fep->clk_ipg); ++ /* After pm_runtime_get_sync() failed, the clks are still off, so skip ++ * disabling them again. ++ */ ++ if (ret >= 0) { ++ clk_disable_unprepare(fep->clk_ahb); ++ clk_disable_unprepare(fep->clk_ipg); ++ } + pm_runtime_put_noidle(&pdev->dev); + pm_runtime_disable(&pdev->dev); + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +index 2070e26a3a358..1ec1709446bab 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +@@ -7023,12 +7023,15 @@ static void hclge_ae_stop(struct hnae3_handle *handle) + /* If it is not PF reset or FLR, the firmware will disable the MAC, + * so it only need to stop phy here. + */ +- if (test_bit(HCLGE_STATE_RST_HANDLING, &hdev->state) && +- hdev->reset_type != HNAE3_FUNC_RESET && +- hdev->reset_type != HNAE3_FLR_RESET) { +- hclge_mac_stop_phy(hdev); +- hclge_update_link_status(hdev); +- return; ++ if (test_bit(HCLGE_STATE_RST_HANDLING, &hdev->state)) { ++ hclge_pfc_pause_en_cfg(hdev, HCLGE_PFC_TX_RX_DISABLE, ++ HCLGE_PFC_DISABLE); ++ if (hdev->reset_type != HNAE3_FUNC_RESET && ++ hdev->reset_type != HNAE3_FLR_RESET) { ++ hclge_mac_stop_phy(hdev); ++ hclge_update_link_status(hdev); ++ return; ++ } + } + + for (i = 0; i < handle->kinfo.num_tqps; i++) +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c +index 9168e39b63641..b3ceaaaeacaeb 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c +@@ -169,8 +169,8 @@ int hclge_mac_pause_en_cfg(struct hclge_dev *hdev, bool tx, bool rx) + return hclge_cmd_send(&hdev->hw, &desc, 1); + } + +-static int hclge_pfc_pause_en_cfg(struct hclge_dev *hdev, u8 tx_rx_bitmap, +- u8 pfc_bitmap) ++int hclge_pfc_pause_en_cfg(struct hclge_dev *hdev, u8 tx_rx_bitmap, ++ u8 pfc_bitmap) + { + struct hclge_desc desc; + struct hclge_pfc_en_cmd *pfc = (struct hclge_pfc_en_cmd *)desc.data; +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.h +index bb2a2d8e92591..42932c879b360 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.h ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.h +@@ -117,6 +117,9 @@ struct hclge_bp_to_qs_map_cmd { + u32 rsvd1; + }; + ++#define HCLGE_PFC_DISABLE 0 ++#define HCLGE_PFC_TX_RX_DISABLE 0 ++ + struct hclge_pfc_en_cmd { + u8 tx_rx_en_bitmap; + u8 pri_en_bitmap; +@@ -164,6 +167,8 @@ void hclge_tm_schd_info_update(struct hclge_dev *hdev, u8 num_tc); + void hclge_tm_pfc_info_update(struct hclge_dev *hdev); + int hclge_tm_dwrr_cfg(struct hclge_dev *hdev); + int hclge_tm_init_hw(struct hclge_dev *hdev, bool init); ++int hclge_pfc_pause_en_cfg(struct hclge_dev *hdev, u8 tx_rx_bitmap, ++ u8 pfc_bitmap); + int hclge_mac_pause_en_cfg(struct hclge_dev *hdev, bool tx, bool rx); + int hclge_pause_addr_cfg(struct hclge_dev *hdev, const u8 *mac_addr); + int hclge_pfc_rx_stats_get(struct hclge_dev *hdev, u64 *stats); +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c +index f7f3e4bbc4770..7d05915c35e38 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c +@@ -1772,7 +1772,10 @@ static int hclgevf_reset_wait(struct hclgevf_dev *hdev) + * might happen in case reset assertion was made by PF. Yes, this also + * means we might end up waiting bit more even for VF reset. + */ +- msleep(5000); ++ if (hdev->reset_type == HNAE3_VF_FULL_RESET) ++ msleep(5000); ++ else ++ msleep(500); + + return 0; + } +diff --git a/drivers/net/ethernet/intel/igb/e1000_mac.c b/drivers/net/ethernet/intel/igb/e1000_mac.c +index fd8eb2f9ab9dc..57e813405b311 100644 +--- a/drivers/net/ethernet/intel/igb/e1000_mac.c ++++ b/drivers/net/ethernet/intel/igb/e1000_mac.c +@@ -426,7 +426,7 @@ void igb_mta_set(struct e1000_hw *hw, u32 hash_value) + static u32 igb_hash_mc_addr(struct e1000_hw *hw, u8 *mc_addr) + { + u32 hash_value, hash_mask; +- u8 bit_shift = 0; ++ u8 bit_shift = 1; + + /* Register count multiplied by bits per register */ + hash_mask = (hw->mac.mta_reg_count * 32) - 1; +@@ -434,7 +434,7 @@ static u32 igb_hash_mc_addr(struct e1000_hw *hw, u8 *mc_addr) + /* For a mc_filter_type of 0, bit_shift is the number of left-shifts + * where 0xFF would still fall within the hash mask. + */ +- while (hash_mask >> bit_shift != 0xFF) ++ while (hash_mask >> bit_shift != 0xFF && bit_shift < 4) + bit_shift++; + + /* The portion of the address that is used for the hash table +diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_txrx.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_txrx.c +index d5d7a2f374935..a0a6dadbcc909 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_txrx.c ++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_txrx.c +@@ -526,9 +526,7 @@ static void otx2_sqe_add_ext(struct otx2_nic *pfvf, struct otx2_snd_queue *sq, + htons(ext->lso_sb - skb_network_offset(skb)); + } else if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6) { + ext->lso_format = pfvf->hw.lso_tsov6_idx; +- +- ipv6_hdr(skb)->payload_len = +- htons(ext->lso_sb - skb_network_offset(skb)); ++ ipv6_hdr(skb)->payload_len = htons(tcp_hdrlen(skb)); + } else if (skb_shinfo(skb)->gso_type & SKB_GSO_UDP_L4) { + __be16 l3_proto = vlan_get_protocol(skb); + struct udphdr *udph = udp_hdr(skb); +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_txrx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_txrx.c +index d5868670f8a58..53ac2383327e5 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_txrx.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_txrx.c +@@ -137,20 +137,22 @@ int mlx5e_napi_poll(struct napi_struct *napi, int budget) + for (i = 0; i < c->num_tc; i++) + busy |= mlx5e_poll_tx_cq(&c->sq[i].cq, budget); + ++ /* budget=0 means we may be in IRQ context, do as little as possible */ ++ if (unlikely(!budget)) ++ goto out; ++ + busy |= mlx5e_poll_xdpsq_cq(&c->xdpsq.cq); + + if (c->xdp) + busy |= mlx5e_poll_xdpsq_cq(&c->rq_xdpsq.cq); + +- if (likely(budget)) { /* budget=0 means: don't poll rx rings */ +- if (xsk_open) +- work_done = mlx5e_poll_rx_cq(&xskrq->cq, budget); ++ if (xsk_open) ++ work_done = mlx5e_poll_rx_cq(&xskrq->cq, budget); + +- if (likely(budget - work_done)) +- work_done += mlx5e_poll_rx_cq(&rq->cq, budget - work_done); ++ if (likely(budget - work_done)) ++ work_done += mlx5e_poll_rx_cq(&rq->cq, budget - work_done); + +- busy |= work_done == budget; +- } ++ busy |= work_done == budget; + + mlx5e_poll_ico_cq(&c->icosq.cq); + if (mlx5e_poll_ico_cq(&c->async_icosq.cq)) +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/devcom.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/devcom.c +index bced2efe9bef4..abd066e952286 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/lib/devcom.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/devcom.c +@@ -110,7 +110,8 @@ struct mlx5_devcom *mlx5_devcom_register_device(struct mlx5_core_dev *dev) + priv->devs[idx] = dev; + devcom = mlx5_devcom_alloc(priv, idx); + if (!devcom) { +- kfree(priv); ++ if (new_priv) ++ kfree(priv); + return ERR_PTR(-ENOMEM); + } + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c +index 112eaef186e19..da4ca0f67e9ce 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c +@@ -887,7 +887,7 @@ static int mlx5_init_once(struct mlx5_core_dev *dev) + + dev->dm = mlx5_dm_create(dev); + if (IS_ERR(dev->dm)) +- mlx5_core_warn(dev, "Failed to init device memory%d\n", err); ++ mlx5_core_warn(dev, "Failed to init device memory %ld\n", PTR_ERR(dev->dm)); + + dev->tracer = mlx5_fw_tracer_create(dev); + dev->hv_vhca = mlx5_hv_vhca_create(dev); +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_ste.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_ste.c +index b01aaec75622f..3b5deb0fe7eb2 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_ste.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_ste.c +@@ -112,7 +112,8 @@ static u32 dr_ste_crc32_calc(const void *input_data, size_t length) + { + u32 crc = crc32(0, input_data, length); + +- return (__force u32)htonl(crc); ++ return (__force u32)((crc >> 24) & 0xff) | ((crc << 8) & 0xff0000) | ++ ((crc >> 8) & 0xff00) | ((crc << 24) & 0xff000000); + } + + u32 mlx5dr_ste_calc_hash_index(u8 *hw_ste_p, struct mlx5dr_ste_htbl *htbl) +diff --git a/drivers/net/ethernet/nvidia/forcedeth.c b/drivers/net/ethernet/nvidia/forcedeth.c +index 2fc10a36afa4a..e14dd1051e58c 100644 +--- a/drivers/net/ethernet/nvidia/forcedeth.c ++++ b/drivers/net/ethernet/nvidia/forcedeth.c +@@ -6138,6 +6138,7 @@ static int nv_probe(struct pci_dev *pci_dev, const struct pci_device_id *id) + return 0; + + out_error: ++ nv_mgmt_release_sema(dev); + if (phystate_orig) + writel(phystate|NVREG_ADAPTCTL_RUNNING, base + NvRegAdapterControl); + out_freering: +diff --git a/drivers/net/ethernet/pasemi/pasemi_mac.c b/drivers/net/ethernet/pasemi/pasemi_mac.c +index 040a15a828b41..c1d7bd168f1d1 100644 +--- a/drivers/net/ethernet/pasemi/pasemi_mac.c ++++ b/drivers/net/ethernet/pasemi/pasemi_mac.c +@@ -1423,7 +1423,7 @@ static void pasemi_mac_queue_csdesc(const struct sk_buff *skb, + write_dma_reg(PAS_DMA_TXCHAN_INCR(txring->chan.chno), 2); + } + +-static int pasemi_mac_start_tx(struct sk_buff *skb, struct net_device *dev) ++static netdev_tx_t pasemi_mac_start_tx(struct sk_buff *skb, struct net_device *dev) + { + struct pasemi_mac * const mac = netdev_priv(dev); + struct pasemi_mac_txring * const txring = tx_ring(mac); +diff --git a/drivers/net/ethernet/sun/cassini.c b/drivers/net/ethernet/sun/cassini.c +index 9ff894ba8d3ea..d245f6e21e8ca 100644 +--- a/drivers/net/ethernet/sun/cassini.c ++++ b/drivers/net/ethernet/sun/cassini.c +@@ -5122,6 +5122,8 @@ err_out_iounmap: + cas_shutdown(cp); + mutex_unlock(&cp->pm_mutex); + ++ vfree(cp->fw_data); ++ + pci_iounmap(pdev, cp->regs); + + +diff --git a/drivers/net/ipvlan/ipvlan_core.c b/drivers/net/ipvlan/ipvlan_core.c +index a33149ee0ddcf..0a5b5ff597c6f 100644 +--- a/drivers/net/ipvlan/ipvlan_core.c ++++ b/drivers/net/ipvlan/ipvlan_core.c +@@ -437,6 +437,9 @@ static int ipvlan_process_v4_outbound(struct sk_buff *skb) + goto err; + } + skb_dst_set(skb, &rt->dst); ++ ++ memset(IPCB(skb), 0, sizeof(*IPCB(skb))); ++ + err = ip_local_out(net, skb->sk, skb); + if (unlikely(net_xmit_eval(err))) + dev->stats.tx_errors++; +@@ -475,6 +478,9 @@ static int ipvlan_process_v6_outbound(struct sk_buff *skb) + goto err; + } + skb_dst_set(skb, dst); ++ ++ memset(IP6CB(skb), 0, sizeof(*IP6CB(skb))); ++ + err = ip6_local_out(net, skb->sk, skb); + if (unlikely(net_xmit_eval(err))) + dev->stats.tx_errors++; +diff --git a/drivers/net/mdio/mdio-mvusb.c b/drivers/net/mdio/mdio-mvusb.c +index d5eabddfdf51b..11e048136ac23 100644 +--- a/drivers/net/mdio/mdio-mvusb.c ++++ b/drivers/net/mdio/mdio-mvusb.c +@@ -73,6 +73,7 @@ static int mvusb_mdio_probe(struct usb_interface *interface, + struct device *dev = &interface->dev; + struct mvusb_mdio *mvusb; + struct mii_bus *mdio; ++ int ret; + + mdio = devm_mdiobus_alloc_size(dev, sizeof(*mvusb)); + if (!mdio) +@@ -93,7 +94,15 @@ static int mvusb_mdio_probe(struct usb_interface *interface, + mdio->write = mvusb_mdio_write; + + usb_set_intfdata(interface, mvusb); +- return of_mdiobus_register(mdio, dev->of_node); ++ ret = of_mdiobus_register(mdio, dev->of_node); ++ if (ret) ++ goto put_dev; ++ ++ return 0; ++ ++put_dev: ++ usb_put_dev(mvusb->udev); ++ return ret; + } + + static void mvusb_mdio_disconnect(struct usb_interface *interface) +diff --git a/drivers/net/phy/dp83867.c b/drivers/net/phy/dp83867.c +index c8031e297faf4..5fabcd15ef77a 100644 +--- a/drivers/net/phy/dp83867.c ++++ b/drivers/net/phy/dp83867.c +@@ -41,6 +41,7 @@ + #define DP83867_STRAP_STS1 0x006E + #define DP83867_STRAP_STS2 0x006f + #define DP83867_RGMIIDCTL 0x0086 ++#define DP83867_DSP_FFE_CFG 0x012c + #define DP83867_RXFCFG 0x0134 + #define DP83867_RXFPMD1 0x0136 + #define DP83867_RXFPMD2 0x0137 +@@ -807,8 +808,27 @@ static int dp83867_phy_reset(struct phy_device *phydev) + + usleep_range(10, 20); + +- return phy_modify(phydev, MII_DP83867_PHYCTRL, ++ err = phy_modify(phydev, MII_DP83867_PHYCTRL, + DP83867_PHYCR_FORCE_LINK_GOOD, 0); ++ if (err < 0) ++ return err; ++ ++ /* Configure the DSP Feedforward Equalizer Configuration register to ++ * improve short cable (< 1 meter) performance. This will not affect ++ * long cable performance. ++ */ ++ err = phy_write_mmd(phydev, DP83867_DEVADDR, DP83867_DSP_FFE_CFG, ++ 0x0e81); ++ if (err < 0) ++ return err; ++ ++ err = phy_write(phydev, DP83867_CTRL, DP83867_SW_RESTART); ++ if (err < 0) ++ return err; ++ ++ usleep_range(10, 20); ++ ++ return 0; + } + + static void dp83867_link_change_notify(struct phy_device *phydev) +diff --git a/drivers/net/phy/mscc/mscc_main.c b/drivers/net/phy/mscc/mscc_main.c +index e14fa72791b0e..ffac713afa551 100644 +--- a/drivers/net/phy/mscc/mscc_main.c ++++ b/drivers/net/phy/mscc/mscc_main.c +@@ -2563,6 +2563,7 @@ static struct phy_driver vsc85xx_driver[] = { + module_phy_driver(vsc85xx_driver); + + static struct mdio_device_id __maybe_unused vsc85xx_tbl[] = { ++ { PHY_ID_VSC8502, 0xfffffff0, }, + { PHY_ID_VSC8504, 0xfffffff0, }, + { PHY_ID_VSC8514, 0xfffffff0, }, + { PHY_ID_VSC8530, 0xfffffff0, }, +diff --git a/drivers/net/tap.c b/drivers/net/tap.c +index d9018d9fe3106..f9b3eb2d8d8b0 100644 +--- a/drivers/net/tap.c ++++ b/drivers/net/tap.c +@@ -713,9 +713,8 @@ static ssize_t tap_get_user(struct tap_queue *q, void *msg_control, + skb_probe_transport_header(skb); + + /* Move network header to the right position for VLAN tagged packets */ +- if ((skb->protocol == htons(ETH_P_8021Q) || +- skb->protocol == htons(ETH_P_8021AD)) && +- __vlan_get_protocol(skb, skb->protocol, &depth) != 0) ++ if (eth_type_vlan(skb->protocol) && ++ vlan_get_protocol_and_depth(skb, skb->protocol, &depth) != 0) + skb_set_network_header(skb, depth); + + rcu_read_lock(); +@@ -1165,9 +1164,8 @@ static int tap_get_user_xdp(struct tap_queue *q, struct xdp_buff *xdp) + } + + /* Move network header to the right position for VLAN tagged packets */ +- if ((skb->protocol == htons(ETH_P_8021Q) || +- skb->protocol == htons(ETH_P_8021AD)) && +- __vlan_get_protocol(skb, skb->protocol, &depth) != 0) ++ if (eth_type_vlan(skb->protocol) && ++ vlan_get_protocol_and_depth(skb, skb->protocol, &depth) != 0) + skb_set_network_header(skb, depth); + + rcu_read_lock(); +diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c +index 7117d559a32e4..8a1619695421b 100644 +--- a/drivers/net/team/team.c ++++ b/drivers/net/team/team.c +@@ -1624,6 +1624,7 @@ static int team_init(struct net_device *dev) + + team->dev = dev; + team_set_no_mode(team); ++ team->notifier_ctx = false; + + team->pcpu_stats = netdev_alloc_pcpu_stats(struct team_pcpu_stats); + if (!team->pcpu_stats) +@@ -3016,7 +3017,11 @@ static int team_device_event(struct notifier_block *unused, + team_del_slave(port->team->dev, dev); + break; + case NETDEV_FEAT_CHANGE: +- team_compute_features(port->team); ++ if (!port->team->notifier_ctx) { ++ port->team->notifier_ctx = true; ++ team_compute_features(port->team); ++ port->team->notifier_ctx = false; ++ } + break; + case NETDEV_PRECHANGEMTU: + /* Forbid to change mtu of underlaying device */ +diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c +index ab91fa5b0194d..57b1e6dc62f07 100644 +--- a/drivers/net/usb/cdc_ncm.c ++++ b/drivers/net/usb/cdc_ncm.c +@@ -180,9 +180,12 @@ static u32 cdc_ncm_check_tx_max(struct usbnet *dev, u32 new_tx) + else + min = ctx->max_datagram_size + ctx->max_ndp_size + sizeof(struct usb_cdc_ncm_nth32); + +- max = min_t(u32, CDC_NCM_NTB_MAX_SIZE_TX, le32_to_cpu(ctx->ncm_parm.dwNtbOutMaxSize)); +- if (max == 0) ++ if (le32_to_cpu(ctx->ncm_parm.dwNtbOutMaxSize) == 0) + max = CDC_NCM_NTB_MAX_SIZE_TX; /* dwNtbOutMaxSize not set */ ++ else ++ max = clamp_t(u32, le32_to_cpu(ctx->ncm_parm.dwNtbOutMaxSize), ++ USB_CDC_NCM_NTB_MIN_OUT_SIZE, ++ CDC_NCM_NTB_MAX_SIZE_TX); + + /* some devices set dwNtbOutMaxSize too low for the above default */ + min = min(min, max); +@@ -1230,6 +1233,9 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev, struct sk_buff *skb, __le32 sign) + * further. + */ + if (skb_out == NULL) { ++ /* If even the smallest allocation fails, abort. */ ++ if (ctx->tx_curr_size == USB_CDC_NCM_NTB_MIN_OUT_SIZE) ++ goto alloc_failed; + ctx->tx_low_mem_max_cnt = min(ctx->tx_low_mem_max_cnt + 1, + (unsigned)CDC_NCM_LOW_MEM_MAX_CNT); + ctx->tx_low_mem_val = ctx->tx_low_mem_max_cnt; +@@ -1248,13 +1254,8 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev, struct sk_buff *skb, __le32 sign) + skb_out = alloc_skb(ctx->tx_curr_size, GFP_ATOMIC); + + /* No allocation possible so we will abort */ +- if (skb_out == NULL) { +- if (skb != NULL) { +- dev_kfree_skb_any(skb); +- dev->net->stats.tx_dropped++; +- } +- goto exit_no_skb; +- } ++ if (!skb_out) ++ goto alloc_failed; + ctx->tx_low_mem_val--; + } + if (ctx->is_ndp16) { +@@ -1447,6 +1448,11 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev, struct sk_buff *skb, __le32 sign) + + return skb_out; + ++alloc_failed: ++ if (skb) { ++ dev_kfree_skb_any(skb); ++ dev->net->stats.tx_dropped++; ++ } + exit_no_skb: + /* Start timer, if there is a remaining non-empty skb */ + if (ctx->tx_curr_skb != NULL && n > 0) +diff --git a/drivers/net/wireless/ath/ath.h b/drivers/net/wireless/ath/ath.h +index f083fb9038c36..f02a308a9ffc5 100644 +--- a/drivers/net/wireless/ath/ath.h ++++ b/drivers/net/wireless/ath/ath.h +@@ -96,11 +96,13 @@ struct ath_keyval { + u8 kv_type; + u8 kv_pad; + u16 kv_len; +- u8 kv_val[16]; /* TK */ +- u8 kv_mic[8]; /* Michael MIC key */ +- u8 kv_txmic[8]; /* Michael MIC TX key (used only if the hardware +- * supports both MIC keys in the same key cache entry; +- * in that case, kv_mic is the RX key) */ ++ struct_group(kv_values, ++ u8 kv_val[16]; /* TK */ ++ u8 kv_mic[8]; /* Michael MIC key */ ++ u8 kv_txmic[8]; /* Michael MIC TX key (used only if the hardware ++ * supports both MIC keys in the same key cache entry; ++ * in that case, kv_mic is the RX key) */ ++ ); + }; + + enum ath_cipher { +diff --git a/drivers/net/wireless/ath/ath11k/dp_rx.c b/drivers/net/wireless/ath/ath11k/dp_rx.c +index 578fdc446bc03..583bcf148403b 100644 +--- a/drivers/net/wireless/ath/ath11k/dp_rx.c ++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c +@@ -324,10 +324,10 @@ int ath11k_dp_rxbufs_replenish(struct ath11k_base *ab, int mac_id, + goto fail_free_skb; + + spin_lock_bh(&rx_ring->idr_lock); +- buf_id = idr_alloc(&rx_ring->bufs_idr, skb, 0, +- rx_ring->bufs_max * 3, GFP_ATOMIC); ++ buf_id = idr_alloc(&rx_ring->bufs_idr, skb, 1, ++ (rx_ring->bufs_max * 3) + 1, GFP_ATOMIC); + spin_unlock_bh(&rx_ring->idr_lock); +- if (buf_id < 0) ++ if (buf_id <= 0) + goto fail_dma_unmap; + + desc = ath11k_hal_srng_src_get_next_entry(ab, srng); +@@ -2564,6 +2564,9 @@ try_again: + cookie); + mac_id = FIELD_GET(DP_RXDMA_BUF_COOKIE_PDEV_ID, cookie); + ++ if (unlikely(buf_id == 0)) ++ continue; ++ + ar = ab->pdevs[mac_id].ar; + rx_ring = &ar->dp.rx_refill_buf_ring; + spin_lock_bh(&rx_ring->idr_lock); +diff --git a/drivers/net/wireless/ath/key.c b/drivers/net/wireless/ath/key.c +index 61b59a804e308..b7b61d4f02bae 100644 +--- a/drivers/net/wireless/ath/key.c ++++ b/drivers/net/wireless/ath/key.c +@@ -503,7 +503,7 @@ int ath_key_config(struct ath_common *common, + + hk.kv_len = key->keylen; + if (key->keylen) +- memcpy(hk.kv_val, key->key, key->keylen); ++ memcpy(&hk.kv_values, key->key, key->keylen); + + if (!(key->flags & IEEE80211_KEY_FLAG_PAIRWISE)) { + switch (vif->type) { +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +index df59706197124..baf5f0afe802e 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +@@ -1350,13 +1350,14 @@ static int brcmf_set_pmk(struct brcmf_if *ifp, const u8 *pmk_data, u16 pmk_len) + { + struct brcmf_pub *drvr = ifp->drvr; + struct brcmf_wsec_pmk_le pmk; +- int i, err; ++ int err; ++ ++ memset(&pmk, 0, sizeof(pmk)); + +- /* convert to firmware key format */ +- pmk.key_len = cpu_to_le16(pmk_len << 1); +- pmk.flags = cpu_to_le16(BRCMF_WSEC_PASSPHRASE); +- for (i = 0; i < pmk_len; i++) +- snprintf(&pmk.key[2 * i], 3, "%02x", pmk_data[i]); ++ /* pass pmk directly */ ++ pmk.key_len = cpu_to_le16(pmk_len); ++ pmk.flags = cpu_to_le16(0); ++ memcpy(pmk.key, pmk_data, pmk_len); + + /* store psk in firmware */ + err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_WSEC_PMK, +diff --git a/drivers/net/wireless/intel/iwlwifi/dvm/sta.c b/drivers/net/wireless/intel/iwlwifi/dvm/sta.c +index e622948661fa8..b307f0e527779 100644 +--- a/drivers/net/wireless/intel/iwlwifi/dvm/sta.c ++++ b/drivers/net/wireless/intel/iwlwifi/dvm/sta.c +@@ -1086,6 +1086,7 @@ static int iwlagn_send_sta_key(struct iwl_priv *priv, + { + __le16 key_flags; + struct iwl_addsta_cmd sta_cmd; ++ size_t to_copy; + int i; + + spin_lock_bh(&priv->sta_lock); +@@ -1105,7 +1106,9 @@ static int iwlagn_send_sta_key(struct iwl_priv *priv, + sta_cmd.key.tkip_rx_tsc_byte2 = tkip_iv32; + for (i = 0; i < 5; i++) + sta_cmd.key.tkip_rx_ttak[i] = cpu_to_le16(tkip_p1k[i]); +- memcpy(sta_cmd.key.key, keyconf->key, keyconf->keylen); ++ /* keyconf may contain MIC rx/tx keys which iwl does not use */ ++ to_copy = min_t(size_t, sizeof(sta_cmd.key.key), keyconf->keylen); ++ memcpy(sta_cmd.key.key, keyconf->key, to_copy); + break; + case WLAN_CIPHER_SUITE_WEP104: + key_flags |= STA_KEY_FLG_KEY_SIZE_MSK; +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c b/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c +index 60296a754af26..34be3f75c2e96 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c +@@ -502,6 +502,11 @@ iwl_mvm_update_mcc(struct iwl_mvm *mvm, const char *alpha2, + struct iwl_mcc_update_resp *mcc_resp = (void *)pkt->data; + + n_channels = __le32_to_cpu(mcc_resp->n_channels); ++ if (iwl_rx_packet_payload_len(pkt) != ++ struct_size(mcc_resp, channels, n_channels)) { ++ resp_cp = ERR_PTR(-EINVAL); ++ goto exit; ++ } + resp_len = sizeof(struct iwl_mcc_update_resp) + + n_channels * sizeof(__le32); + resp_cp = kmemdup(mcc_resp, resp_len, GFP_KERNEL); +@@ -513,6 +518,11 @@ iwl_mvm_update_mcc(struct iwl_mvm *mvm, const char *alpha2, + struct iwl_mcc_update_resp_v3 *mcc_resp_v3 = (void *)pkt->data; + + n_channels = __le32_to_cpu(mcc_resp_v3->n_channels); ++ if (iwl_rx_packet_payload_len(pkt) != ++ struct_size(mcc_resp_v3, channels, n_channels)) { ++ resp_cp = ERR_PTR(-EINVAL); ++ goto exit; ++ } + resp_len = sizeof(struct iwl_mcc_update_resp) + + n_channels * sizeof(__le32); + resp_cp = kzalloc(resp_len, GFP_KERNEL); +diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c +index 4e43efd5d1ea1..dc0a507213ca6 100644 +--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c +@@ -1214,6 +1214,9 @@ static void iwl_pci_remove(struct pci_dev *pdev) + { + struct iwl_trans *trans = pci_get_drvdata(pdev); + ++ if (!trans) ++ return; ++ + iwl_drv_stop(trans->drv); + + iwl_trans_pcie_free(trans); +diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c +index 7f8b7f7697cfd..fac7cc75bc31e 100644 +--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c +@@ -2835,7 +2835,7 @@ static bool iwl_write_to_user_buf(char __user *user_buf, ssize_t count, + void *buf, ssize_t *size, + ssize_t *bytes_copied) + { +- int buf_size_left = count - *bytes_copied; ++ ssize_t buf_size_left = count - *bytes_copied; + + buf_size_left = buf_size_left - (buf_size_left % sizeof(u32)); + if (*size > buf_size_left) +diff --git a/drivers/phy/st/phy-miphy28lp.c b/drivers/phy/st/phy-miphy28lp.c +index 068160a34f5cc..e30305b77f0d1 100644 +--- a/drivers/phy/st/phy-miphy28lp.c ++++ b/drivers/phy/st/phy-miphy28lp.c +@@ -9,6 +9,7 @@ + + #include + #include ++#include + #include + #include + #include +@@ -484,19 +485,11 @@ static inline void miphy28lp_pcie_config_gen(struct miphy28lp_phy *miphy_phy) + + static inline int miphy28lp_wait_compensation(struct miphy28lp_phy *miphy_phy) + { +- unsigned long finish = jiffies + 5 * HZ; + u8 val; + + /* Waiting for Compensation to complete */ +- do { +- val = readb_relaxed(miphy_phy->base + MIPHY_COMP_FSM_6); +- +- if (time_after_eq(jiffies, finish)) +- return -EBUSY; +- cpu_relax(); +- } while (!(val & COMP_DONE)); +- +- return 0; ++ return readb_relaxed_poll_timeout(miphy_phy->base + MIPHY_COMP_FSM_6, ++ val, val & COMP_DONE, 1, 5 * USEC_PER_SEC); + } + + +@@ -805,7 +798,6 @@ static inline void miphy28lp_configure_usb3(struct miphy28lp_phy *miphy_phy) + + static inline int miphy_is_ready(struct miphy28lp_phy *miphy_phy) + { +- unsigned long finish = jiffies + 5 * HZ; + u8 mask = HFC_PLL | HFC_RDY; + u8 val; + +@@ -816,21 +808,14 @@ static inline int miphy_is_ready(struct miphy28lp_phy *miphy_phy) + if (miphy_phy->type == PHY_TYPE_SATA) + mask |= PHY_RDY; + +- do { +- val = readb_relaxed(miphy_phy->base + MIPHY_STATUS_1); +- if ((val & mask) != mask) +- cpu_relax(); +- else +- return 0; +- } while (!time_after_eq(jiffies, finish)); +- +- return -EBUSY; ++ return readb_relaxed_poll_timeout(miphy_phy->base + MIPHY_STATUS_1, ++ val, (val & mask) == mask, 1, ++ 5 * USEC_PER_SEC); + } + + static int miphy_osc_is_ready(struct miphy28lp_phy *miphy_phy) + { + struct miphy28lp_dev *miphy_dev = miphy_phy->phydev; +- unsigned long finish = jiffies + 5 * HZ; + u32 val; + + if (!miphy_phy->osc_rdy) +@@ -839,17 +824,10 @@ static int miphy_osc_is_ready(struct miphy28lp_phy *miphy_phy) + if (!miphy_phy->syscfg_reg[SYSCFG_STATUS]) + return -EINVAL; + +- do { +- regmap_read(miphy_dev->regmap, +- miphy_phy->syscfg_reg[SYSCFG_STATUS], &val); +- +- if ((val & MIPHY_OSC_RDY) != MIPHY_OSC_RDY) +- cpu_relax(); +- else +- return 0; +- } while (!time_after_eq(jiffies, finish)); +- +- return -EBUSY; ++ return regmap_read_poll_timeout(miphy_dev->regmap, ++ miphy_phy->syscfg_reg[SYSCFG_STATUS], ++ val, val & MIPHY_OSC_RDY, 1, ++ 5 * USEC_PER_SEC); + } + + static int miphy28lp_get_resource_byname(struct device_node *child, +diff --git a/drivers/power/supply/bq27xxx_battery.c b/drivers/power/supply/bq27xxx_battery.c +index 72a2bcf3ab32b..c08dd4e6d35ad 100644 +--- a/drivers/power/supply/bq27xxx_battery.c ++++ b/drivers/power/supply/bq27xxx_battery.c +@@ -1681,7 +1681,7 @@ static int bq27xxx_battery_read_health(struct bq27xxx_device_info *di) + return POWER_SUPPLY_HEALTH_GOOD; + } + +-void bq27xxx_battery_update(struct bq27xxx_device_info *di) ++static void bq27xxx_battery_update_unlocked(struct bq27xxx_device_info *di) + { + struct bq27xxx_reg_cache cache = {0, }; + bool has_ci_flag = di->opts & BQ27XXX_O_HAS_CI; +@@ -1732,6 +1732,16 @@ void bq27xxx_battery_update(struct bq27xxx_device_info *di) + di->cache = cache; + + di->last_update = jiffies; ++ ++ if (!di->removed && poll_interval > 0) ++ mod_delayed_work(system_wq, &di->work, poll_interval * HZ); ++} ++ ++void bq27xxx_battery_update(struct bq27xxx_device_info *di) ++{ ++ mutex_lock(&di->lock); ++ bq27xxx_battery_update_unlocked(di); ++ mutex_unlock(&di->lock); + } + EXPORT_SYMBOL_GPL(bq27xxx_battery_update); + +@@ -1742,9 +1752,6 @@ static void bq27xxx_battery_poll(struct work_struct *work) + work.work); + + bq27xxx_battery_update(di); +- +- if (poll_interval > 0) +- schedule_delayed_work(&di->work, poll_interval * HZ); + } + + /* +@@ -1919,10 +1926,8 @@ static int bq27xxx_battery_get_property(struct power_supply *psy, + struct bq27xxx_device_info *di = power_supply_get_drvdata(psy); + + mutex_lock(&di->lock); +- if (time_is_before_jiffies(di->last_update + 5 * HZ)) { +- cancel_delayed_work_sync(&di->work); +- bq27xxx_battery_poll(&di->work.work); +- } ++ if (time_is_before_jiffies(di->last_update + 5 * HZ)) ++ bq27xxx_battery_update_unlocked(di); + mutex_unlock(&di->lock); + + if (psp != POWER_SUPPLY_PROP_PRESENT && di->cache.flags < 0) +@@ -2058,22 +2063,18 @@ EXPORT_SYMBOL_GPL(bq27xxx_battery_setup); + + void bq27xxx_battery_teardown(struct bq27xxx_device_info *di) + { +- /* +- * power_supply_unregister call bq27xxx_battery_get_property which +- * call bq27xxx_battery_poll. +- * Make sure that bq27xxx_battery_poll will not call +- * schedule_delayed_work again after unregister (which cause OOPS). +- */ +- poll_interval = 0; +- +- cancel_delayed_work_sync(&di->work); +- +- power_supply_unregister(di->bat); +- + mutex_lock(&bq27xxx_list_lock); + list_del(&di->list); + mutex_unlock(&bq27xxx_list_lock); + ++ /* Set removed to avoid bq27xxx_battery_update() re-queuing the work */ ++ mutex_lock(&di->lock); ++ di->removed = true; ++ mutex_unlock(&di->lock); ++ ++ cancel_delayed_work_sync(&di->work); ++ ++ power_supply_unregister(di->bat); + mutex_destroy(&di->lock); + } + EXPORT_SYMBOL_GPL(bq27xxx_battery_teardown); +diff --git a/drivers/power/supply/bq27xxx_battery_i2c.c b/drivers/power/supply/bq27xxx_battery_i2c.c +index 3012eb13a08cb..0e32efb10ee78 100644 +--- a/drivers/power/supply/bq27xxx_battery_i2c.c ++++ b/drivers/power/supply/bq27xxx_battery_i2c.c +@@ -179,7 +179,7 @@ static int bq27xxx_battery_i2c_probe(struct i2c_client *client, + i2c_set_clientdata(client, di); + + if (client->irq) { +- ret = devm_request_threaded_irq(&client->dev, client->irq, ++ ret = request_threaded_irq(client->irq, + NULL, bq27xxx_battery_irq_handler_thread, + IRQF_ONESHOT, + di->name, di); +@@ -209,6 +209,7 @@ static int bq27xxx_battery_i2c_remove(struct i2c_client *client) + { + struct bq27xxx_device_info *di = i2c_get_clientdata(client); + ++ free_irq(client->irq, di); + bq27xxx_battery_teardown(di); + + mutex_lock(&battery_mutex); +diff --git a/drivers/power/supply/power_supply_leds.c b/drivers/power/supply/power_supply_leds.c +index d69880cc35931..b7a2778f878de 100644 +--- a/drivers/power/supply/power_supply_leds.c ++++ b/drivers/power/supply/power_supply_leds.c +@@ -34,8 +34,9 @@ static void power_supply_update_bat_leds(struct power_supply *psy) + led_trigger_event(psy->charging_full_trig, LED_FULL); + led_trigger_event(psy->charging_trig, LED_OFF); + led_trigger_event(psy->full_trig, LED_FULL); +- led_trigger_event(psy->charging_blink_full_solid_trig, +- LED_FULL); ++ /* Going from blink to LED on requires a LED_OFF event to stop blink */ ++ led_trigger_event(psy->charging_blink_full_solid_trig, LED_OFF); ++ led_trigger_event(psy->charging_blink_full_solid_trig, LED_FULL); + break; + case POWER_SUPPLY_STATUS_CHARGING: + led_trigger_event(psy->charging_full_trig, LED_FULL); +diff --git a/drivers/power/supply/sbs-charger.c b/drivers/power/supply/sbs-charger.c +index fbfb6a6209617..a30eb42e379a4 100644 +--- a/drivers/power/supply/sbs-charger.c ++++ b/drivers/power/supply/sbs-charger.c +@@ -25,7 +25,7 @@ + #define SBS_CHARGER_REG_STATUS 0x13 + #define SBS_CHARGER_REG_ALARM_WARNING 0x16 + +-#define SBS_CHARGER_STATUS_CHARGE_INHIBITED BIT(1) ++#define SBS_CHARGER_STATUS_CHARGE_INHIBITED BIT(0) + #define SBS_CHARGER_STATUS_RES_COLD BIT(9) + #define SBS_CHARGER_STATUS_RES_HOT BIT(10) + #define SBS_CHARGER_STATUS_BATTERY_PRESENT BIT(14) +diff --git a/drivers/remoteproc/stm32_rproc.c b/drivers/remoteproc/stm32_rproc.c +index 24760d8ea6374..df784fec124f6 100644 +--- a/drivers/remoteproc/stm32_rproc.c ++++ b/drivers/remoteproc/stm32_rproc.c +@@ -301,8 +301,16 @@ static void stm32_rproc_mb_vq_work(struct work_struct *work) + struct stm32_mbox *mb = container_of(work, struct stm32_mbox, vq_work); + struct rproc *rproc = dev_get_drvdata(mb->client.dev); + ++ mutex_lock(&rproc->lock); ++ ++ if (rproc->state != RPROC_RUNNING) ++ goto unlock_mutex; ++ + if (rproc_vq_interrupt(rproc, mb->vq_id) == IRQ_NONE) + dev_dbg(&rproc->dev, "no message found in vq%d\n", mb->vq_id); ++ ++unlock_mutex: ++ mutex_unlock(&rproc->lock); + } + + static void stm32_rproc_mb_callback(struct mbox_client *cl, void *data) +diff --git a/drivers/s390/cio/qdio.h b/drivers/s390/cio/qdio.h +index cd2df4ff8e0ef..919d106141664 100644 +--- a/drivers/s390/cio/qdio.h ++++ b/drivers/s390/cio/qdio.h +@@ -88,15 +88,15 @@ enum qdio_irq_states { + static inline int do_sqbs(u64 token, unsigned char state, int queue, + int *start, int *count) + { +- register unsigned long _ccq asm ("0") = *count; +- register unsigned long _token asm ("1") = token; + unsigned long _queuestart = ((unsigned long)queue << 32) | *start; ++ unsigned long _ccq = *count; + + asm volatile( +- " .insn rsy,0xeb000000008A,%1,0,0(%2)" +- : "+d" (_ccq), "+d" (_queuestart) +- : "d" ((unsigned long)state), "d" (_token) +- : "memory", "cc"); ++ " lgr 1,%[token]\n" ++ " .insn rsy,0xeb000000008a,%[qs],%[ccq],0(%[state])" ++ : [ccq] "+&d" (_ccq), [qs] "+&d" (_queuestart) ++ : [state] "a" ((unsigned long)state), [token] "d" (token) ++ : "memory", "cc", "1"); + *count = _ccq & 0xff; + *start = _queuestart & 0xff; + +@@ -106,16 +106,17 @@ static inline int do_sqbs(u64 token, unsigned char state, int queue, + static inline int do_eqbs(u64 token, unsigned char *state, int queue, + int *start, int *count, int ack) + { +- register unsigned long _ccq asm ("0") = *count; +- register unsigned long _token asm ("1") = token; + unsigned long _queuestart = ((unsigned long)queue << 32) | *start; + unsigned long _state = (unsigned long)ack << 63; ++ unsigned long _ccq = *count; + + asm volatile( +- " .insn rrf,0xB99c0000,%1,%2,0,0" +- : "+d" (_ccq), "+d" (_queuestart), "+d" (_state) +- : "d" (_token) +- : "memory", "cc"); ++ " lgr 1,%[token]\n" ++ " .insn rrf,0xb99c0000,%[qs],%[state],%[ccq],0" ++ : [ccq] "+&d" (_ccq), [qs] "+&d" (_queuestart), ++ [state] "+&d" (_state) ++ : [token] "d" (token) ++ : "memory", "cc", "1"); + *count = _ccq & 0xff; + *start = _queuestart & 0xff; + *state = _state & 0xff; +diff --git a/drivers/s390/cio/qdio_main.c b/drivers/s390/cio/qdio_main.c +index 3e29c26f01856..e3c55fc2363ac 100644 +--- a/drivers/s390/cio/qdio_main.c ++++ b/drivers/s390/cio/qdio_main.c +@@ -31,38 +31,41 @@ MODULE_DESCRIPTION("QDIO base support"); + MODULE_LICENSE("GPL"); + + static inline int do_siga_sync(unsigned long schid, +- unsigned int out_mask, unsigned int in_mask, ++ unsigned long out_mask, unsigned long in_mask, + unsigned int fc) + { +- register unsigned long __fc asm ("0") = fc; +- register unsigned long __schid asm ("1") = schid; +- register unsigned long out asm ("2") = out_mask; +- register unsigned long in asm ("3") = in_mask; + int cc; + + asm volatile( ++ " lgr 0,%[fc]\n" ++ " lgr 1,%[schid]\n" ++ " lgr 2,%[out]\n" ++ " lgr 3,%[in]\n" + " siga 0\n" +- " ipm %0\n" +- " srl %0,28\n" +- : "=d" (cc) +- : "d" (__fc), "d" (__schid), "d" (out), "d" (in) : "cc"); ++ " ipm %[cc]\n" ++ " srl %[cc],28\n" ++ : [cc] "=&d" (cc) ++ : [fc] "d" (fc), [schid] "d" (schid), ++ [out] "d" (out_mask), [in] "d" (in_mask) ++ : "cc", "0", "1", "2", "3"); + return cc; + } + +-static inline int do_siga_input(unsigned long schid, unsigned int mask, +- unsigned int fc) ++static inline int do_siga_input(unsigned long schid, unsigned long mask, ++ unsigned long fc) + { +- register unsigned long __fc asm ("0") = fc; +- register unsigned long __schid asm ("1") = schid; +- register unsigned long __mask asm ("2") = mask; + int cc; + + asm volatile( ++ " lgr 0,%[fc]\n" ++ " lgr 1,%[schid]\n" ++ " lgr 2,%[mask]\n" + " siga 0\n" +- " ipm %0\n" +- " srl %0,28\n" +- : "=d" (cc) +- : "d" (__fc), "d" (__schid), "d" (__mask) : "cc"); ++ " ipm %[cc]\n" ++ " srl %[cc],28\n" ++ : [cc] "=&d" (cc) ++ : [fc] "d" (fc), [schid] "d" (schid), [mask] "d" (mask) ++ : "cc", "0", "1", "2"); + return cc; + } + +@@ -78,23 +81,24 @@ static inline int do_siga_input(unsigned long schid, unsigned int mask, + * Note: For IQDC unicast queues only the highest priority queue is processed. + */ + static inline int do_siga_output(unsigned long schid, unsigned long mask, +- unsigned int *bb, unsigned int fc, ++ unsigned int *bb, unsigned long fc, + unsigned long aob) + { +- register unsigned long __fc asm("0") = fc; +- register unsigned long __schid asm("1") = schid; +- register unsigned long __mask asm("2") = mask; +- register unsigned long __aob asm("3") = aob; + int cc; + + asm volatile( ++ " lgr 0,%[fc]\n" ++ " lgr 1,%[schid]\n" ++ " lgr 2,%[mask]\n" ++ " lgr 3,%[aob]\n" + " siga 0\n" +- " ipm %0\n" +- " srl %0,28\n" +- : "=d" (cc), "+d" (__fc), "+d" (__aob) +- : "d" (__schid), "d" (__mask) +- : "cc"); +- *bb = __fc >> 31; ++ " lgr %[fc],0\n" ++ " ipm %[cc]\n" ++ " srl %[cc],28\n" ++ : [cc] "=&d" (cc), [fc] "+&d" (fc) ++ : [schid] "d" (schid), [mask] "d" (mask), [aob] "d" (aob) ++ : "cc", "0", "1", "2", "3"); ++ *bb = fc >> 31; + return cc; + } + +diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c +index fbc76d69ea0b4..2b77cbbcdccb6 100644 +--- a/drivers/scsi/lpfc/lpfc_debugfs.c ++++ b/drivers/scsi/lpfc/lpfc_debugfs.c +@@ -2159,10 +2159,13 @@ lpfc_debugfs_lockstat_write(struct file *file, const char __user *buf, + char mybuf[64]; + char *pbuf; + int i; ++ size_t bsize; + + memset(mybuf, 0, sizeof(mybuf)); + +- if (copy_from_user(mybuf, buf, nbytes)) ++ bsize = min(nbytes, (sizeof(mybuf) - 1)); ++ ++ if (copy_from_user(mybuf, buf, bsize)) + return -EFAULT; + pbuf = &mybuf[0]; + +@@ -2183,7 +2186,7 @@ lpfc_debugfs_lockstat_write(struct file *file, const char __user *buf, + qp->lock_conflict.wq_access = 0; + } + } +- return nbytes; ++ return bsize; + } + #endif + +diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c +index e38aebcabb26f..70b4868fe2f7d 100644 +--- a/drivers/scsi/storvsc_drv.c ++++ b/drivers/scsi/storvsc_drv.c +@@ -1756,7 +1756,7 @@ static int storvsc_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *scmnd) + + length = scsi_bufflen(scmnd); + payload = (struct vmbus_packet_mpb_array *)&cmd_request->mpb; +- payload_sz = sizeof(cmd_request->mpb); ++ payload_sz = 0; + + if (sg_count) { + unsigned int hvpgoff = 0; +@@ -1764,10 +1764,10 @@ static int storvsc_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *scmnd) + unsigned int hvpg_count = HVPFN_UP(offset_in_hvpg + length); + u64 hvpfn; + +- if (hvpg_count > MAX_PAGE_BUFFER_COUNT) { ++ payload_sz = (hvpg_count * sizeof(u64) + ++ sizeof(struct vmbus_packet_mpb_array)); + +- payload_sz = (hvpg_count * sizeof(u64) + +- sizeof(struct vmbus_packet_mpb_array)); ++ if (hvpg_count > MAX_PAGE_BUFFER_COUNT) { + payload = kzalloc(payload_sz, GFP_ATOMIC); + if (!payload) + return SCSI_MLQUEUE_DEVICE_BUSY; +diff --git a/drivers/spi/spi-fsl-cpm.c b/drivers/spi/spi-fsl-cpm.c +index ee905880769e6..7832ce330b29d 100644 +--- a/drivers/spi/spi-fsl-cpm.c ++++ b/drivers/spi/spi-fsl-cpm.c +@@ -21,6 +21,7 @@ + #include + #include + #include ++#include + + #include "spi-fsl-cpm.h" + #include "spi-fsl-lib.h" +@@ -120,6 +121,21 @@ int fsl_spi_cpm_bufs(struct mpc8xxx_spi *mspi, + mspi->rx_dma = mspi->dma_dummy_rx; + mspi->map_rx_dma = 0; + } ++ if (t->bits_per_word == 16 && t->tx_buf) { ++ const u16 *src = t->tx_buf; ++ u16 *dst; ++ int i; ++ ++ dst = kmalloc(t->len, GFP_KERNEL); ++ if (!dst) ++ return -ENOMEM; ++ ++ for (i = 0; i < t->len >> 1; i++) ++ dst[i] = cpu_to_le16p(src + i); ++ ++ mspi->tx = dst; ++ mspi->map_tx_dma = 1; ++ } + + if (mspi->map_tx_dma) { + void *nonconst_tx = (void *)mspi->tx; /* shut up gcc */ +@@ -173,6 +189,13 @@ void fsl_spi_cpm_bufs_complete(struct mpc8xxx_spi *mspi) + if (mspi->map_rx_dma) + dma_unmap_single(dev, mspi->rx_dma, t->len, DMA_FROM_DEVICE); + mspi->xfer_in_progress = NULL; ++ ++ if (t->bits_per_word == 16 && t->rx_buf) { ++ int i; ++ ++ for (i = 0; i < t->len; i += 2) ++ le16_to_cpus(t->rx_buf + i); ++ } + } + EXPORT_SYMBOL_GPL(fsl_spi_cpm_bufs_complete); + +diff --git a/drivers/spi/spi-fsl-spi.c b/drivers/spi/spi-fsl-spi.c +index 1bad0ceac81b4..63302e21e574c 100644 +--- a/drivers/spi/spi-fsl-spi.c ++++ b/drivers/spi/spi-fsl-spi.c +@@ -203,26 +203,6 @@ static int mspi_apply_cpu_mode_quirks(struct spi_mpc8xxx_cs *cs, + return bits_per_word; + } + +-static int mspi_apply_qe_mode_quirks(struct spi_mpc8xxx_cs *cs, +- struct spi_device *spi, +- int bits_per_word) +-{ +- /* CPM/QE uses Little Endian for words > 8 +- * so transform 16 and 32 bits words into 8 bits +- * Unfortnatly that doesn't work for LSB so +- * reject these for now */ +- /* Note: 32 bits word, LSB works iff +- * tfcr/rfcr is set to CPMFCR_GBL */ +- if (spi->mode & SPI_LSB_FIRST && +- bits_per_word > 8) +- return -EINVAL; +- if (bits_per_word <= 8) +- return bits_per_word; +- if (bits_per_word == 16 || bits_per_word == 32) +- return 8; /* pretend its 8 bits */ +- return -EINVAL; +-} +- + static int fsl_spi_setup_transfer(struct spi_device *spi, + struct spi_transfer *t) + { +@@ -250,9 +230,6 @@ static int fsl_spi_setup_transfer(struct spi_device *spi, + bits_per_word = mspi_apply_cpu_mode_quirks(cs, spi, + mpc8xxx_spi, + bits_per_word); +- else +- bits_per_word = mspi_apply_qe_mode_quirks(cs, spi, +- bits_per_word); + + if (bits_per_word < 0) + return bits_per_word; +@@ -370,14 +347,30 @@ static int fsl_spi_do_one_msg(struct spi_master *master, + * In CPU mode, optimize large byte transfers to use larger + * bits_per_word values to reduce number of interrupts taken. + */ +- if (!(mpc8xxx_spi->flags & SPI_CPM_MODE)) { +- list_for_each_entry(t, &m->transfers, transfer_list) { ++ list_for_each_entry(t, &m->transfers, transfer_list) { ++ if (!(mpc8xxx_spi->flags & SPI_CPM_MODE)) { + if (t->len < 256 || t->bits_per_word != 8) + continue; + if ((t->len & 3) == 0) + t->bits_per_word = 32; + else if ((t->len & 1) == 0) + t->bits_per_word = 16; ++ } else { ++ /* ++ * CPM/QE uses Little Endian for words > 8 ++ * so transform 16 and 32 bits words into 8 bits ++ * Unfortnatly that doesn't work for LSB so ++ * reject these for now ++ * Note: 32 bits word, LSB works iff ++ * tfcr/rfcr is set to CPMFCR_GBL ++ */ ++ if (m->spi->mode & SPI_LSB_FIRST && t->bits_per_word > 8) ++ return -EINVAL; ++ if (t->bits_per_word == 16 || t->bits_per_word == 32) ++ t->bits_per_word = 8; /* pretend its 8 bits */ ++ if (t->bits_per_word == 8 && t->len >= 256 && ++ (mpc8xxx_spi->flags & SPI_CPM1)) ++ t->bits_per_word = 16; + } + } + +@@ -635,8 +628,14 @@ static struct spi_master *fsl_spi_probe(struct device *dev, + if (mpc8xxx_spi->type == TYPE_GRLIB) + fsl_spi_grlib_probe(dev); + +- master->bits_per_word_mask = +- (SPI_BPW_RANGE_MASK(4, 16) | SPI_BPW_MASK(32)) & ++ if (mpc8xxx_spi->flags & SPI_CPM_MODE) ++ master->bits_per_word_mask = ++ (SPI_BPW_RANGE_MASK(4, 8) | SPI_BPW_MASK(16) | SPI_BPW_MASK(32)); ++ else ++ master->bits_per_word_mask = ++ (SPI_BPW_RANGE_MASK(4, 16) | SPI_BPW_MASK(32)); ++ ++ master->bits_per_word_mask &= + SPI_BPW_RANGE_MASK(1, mpc8xxx_spi->max_bits_per_word); + + if (mpc8xxx_spi->flags & SPI_QE_CPU_MODE) +diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c +index bbc420865f0fd..21297cc62571a 100644 +--- a/drivers/spi/spi-imx.c ++++ b/drivers/spi/spi-imx.c +@@ -242,6 +242,18 @@ static bool spi_imx_can_dma(struct spi_master *master, struct spi_device *spi, + return true; + } + ++/* ++ * Note the number of natively supported chip selects for MX51 is 4. Some ++ * devices may have less actual SS pins but the register map supports 4. When ++ * using gpio chip selects the cs values passed into the macros below can go ++ * outside the range 0 - 3. We therefore need to limit the cs value to avoid ++ * corrupting bits outside the allocated locations. ++ * ++ * The simplest way to do this is to just mask the cs bits to 2 bits. This ++ * still allows all 4 native chip selects to work as well as gpio chip selects ++ * (which can use any of the 4 chip select configurations). ++ */ ++ + #define MX51_ECSPI_CTRL 0x08 + #define MX51_ECSPI_CTRL_ENABLE (1 << 0) + #define MX51_ECSPI_CTRL_XCH (1 << 2) +@@ -250,16 +262,16 @@ static bool spi_imx_can_dma(struct spi_master *master, struct spi_device *spi, + #define MX51_ECSPI_CTRL_DRCTL(drctl) ((drctl) << 16) + #define MX51_ECSPI_CTRL_POSTDIV_OFFSET 8 + #define MX51_ECSPI_CTRL_PREDIV_OFFSET 12 +-#define MX51_ECSPI_CTRL_CS(cs) ((cs) << 18) ++#define MX51_ECSPI_CTRL_CS(cs) ((cs & 3) << 18) + #define MX51_ECSPI_CTRL_BL_OFFSET 20 + #define MX51_ECSPI_CTRL_BL_MASK (0xfff << 20) + + #define MX51_ECSPI_CONFIG 0x0c +-#define MX51_ECSPI_CONFIG_SCLKPHA(cs) (1 << ((cs) + 0)) +-#define MX51_ECSPI_CONFIG_SCLKPOL(cs) (1 << ((cs) + 4)) +-#define MX51_ECSPI_CONFIG_SBBCTRL(cs) (1 << ((cs) + 8)) +-#define MX51_ECSPI_CONFIG_SSBPOL(cs) (1 << ((cs) + 12)) +-#define MX51_ECSPI_CONFIG_SCLKCTL(cs) (1 << ((cs) + 20)) ++#define MX51_ECSPI_CONFIG_SCLKPHA(cs) (1 << ((cs & 3) + 0)) ++#define MX51_ECSPI_CONFIG_SCLKPOL(cs) (1 << ((cs & 3) + 4)) ++#define MX51_ECSPI_CONFIG_SBBCTRL(cs) (1 << ((cs & 3) + 8)) ++#define MX51_ECSPI_CONFIG_SSBPOL(cs) (1 << ((cs & 3) + 12)) ++#define MX51_ECSPI_CONFIG_SCLKCTL(cs) (1 << ((cs & 3) + 20)) + + #define MX51_ECSPI_INT 0x10 + #define MX51_ECSPI_INT_TEEN (1 << 0) +diff --git a/drivers/staging/rtl8192e/rtl8192e/rtl_core.c b/drivers/staging/rtl8192e/rtl8192e/rtl_core.c +index 291f98251f7f7..4c201679fc081 100644 +--- a/drivers/staging/rtl8192e/rtl8192e/rtl_core.c ++++ b/drivers/staging/rtl8192e/rtl8192e/rtl_core.c +@@ -50,9 +50,9 @@ static const struct rtl819x_ops rtl819xp_ops = { + }; + + static struct pci_device_id rtl8192_pci_id_tbl[] = { +- {RTL_PCI_DEVICE(0x10ec, 0x8192, rtl819xp_ops)}, +- {RTL_PCI_DEVICE(0x07aa, 0x0044, rtl819xp_ops)}, +- {RTL_PCI_DEVICE(0x07aa, 0x0047, rtl819xp_ops)}, ++ {PCI_DEVICE(0x10ec, 0x8192)}, ++ {PCI_DEVICE(0x07aa, 0x0044)}, ++ {PCI_DEVICE(0x07aa, 0x0047)}, + {} + }; + +diff --git a/drivers/staging/rtl8192e/rtl8192e/rtl_core.h b/drivers/staging/rtl8192e/rtl8192e/rtl_core.h +index 736f1a824cd2e..7bbd884aa5f13 100644 +--- a/drivers/staging/rtl8192e/rtl8192e/rtl_core.h ++++ b/drivers/staging/rtl8192e/rtl8192e/rtl_core.h +@@ -55,11 +55,6 @@ + #define IS_HARDWARE_TYPE_8192SE(_priv) \ + (((struct r8192_priv *)rtllib_priv(dev))->card_8192 == NIC_8192SE) + +-#define RTL_PCI_DEVICE(vend, dev, cfg) \ +- .vendor = (vend), .device = (dev), \ +- .subvendor = PCI_ANY_ID, .subdevice = PCI_ANY_ID, \ +- .driver_data = (kernel_ulong_t)&(cfg) +- + #define TOTAL_CAM_ENTRY 32 + #define CAM_CONTENT_COUNT 8 + +diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c +index 6bb8403580729..075e2a6fb474f 100644 +--- a/drivers/target/iscsi/iscsi_target.c ++++ b/drivers/target/iscsi/iscsi_target.c +@@ -4385,6 +4385,9 @@ int iscsit_close_session(struct iscsi_session *sess) + iscsit_stop_time2retain_timer(sess); + spin_unlock_bh(&se_tpg->session_lock); + ++ if (sess->sess_ops->ErrorRecoveryLevel == 2) ++ iscsit_free_connection_recovery_entries(sess); ++ + /* + * transport_deregister_session_configfs() will clear the + * struct se_node_acl->nacl_sess pointer now as a iscsi_np process context +@@ -4412,9 +4415,6 @@ int iscsit_close_session(struct iscsi_session *sess) + + transport_deregister_session(sess->se_sess); + +- if (sess->sess_ops->ErrorRecoveryLevel == 2) +- iscsit_free_connection_recovery_entries(sess); +- + iscsit_free_all_ooo_cmdsns(sess); + + spin_lock_bh(&se_tpg->session_lock); +diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c +index 0a7e9491b4d14..43f2eed6df78e 100644 +--- a/drivers/tty/serial/8250/8250_core.c ++++ b/drivers/tty/serial/8250/8250_core.c +@@ -1165,6 +1165,7 @@ void serial8250_unregister_port(int line) + uart->port.type = PORT_UNKNOWN; + uart->port.dev = &serial8250_isa_devs->dev; + uart->capabilities = 0; ++ serial8250_init_port(uart); + serial8250_apply_quirks(uart); + uart_add_one_port(&serial8250_reg, &uart->port); + } else { +diff --git a/drivers/tty/serial/8250/8250_exar.c b/drivers/tty/serial/8250/8250_exar.c +index 2d0e7c7e408dc..5c2adf14049b7 100644 +--- a/drivers/tty/serial/8250/8250_exar.c ++++ b/drivers/tty/serial/8250/8250_exar.c +@@ -40,9 +40,19 @@ + #define PCI_DEVICE_ID_COMMTECH_4224PCIE 0x0020 + #define PCI_DEVICE_ID_COMMTECH_4228PCIE 0x0021 + #define PCI_DEVICE_ID_COMMTECH_4222PCIE 0x0022 ++ + #define PCI_DEVICE_ID_EXAR_XR17V4358 0x4358 + #define PCI_DEVICE_ID_EXAR_XR17V8358 0x8358 + ++#define PCI_SUBDEVICE_ID_USR_2980 0x0128 ++#define PCI_SUBDEVICE_ID_USR_2981 0x0129 ++ ++#define PCI_DEVICE_ID_SEALEVEL_710xC 0x1001 ++#define PCI_DEVICE_ID_SEALEVEL_720xC 0x1002 ++#define PCI_DEVICE_ID_SEALEVEL_740xC 0x1004 ++#define PCI_DEVICE_ID_SEALEVEL_780xC 0x1008 ++#define PCI_DEVICE_ID_SEALEVEL_716xC 0x1010 ++ + #define UART_EXAR_INT0 0x80 + #define UART_EXAR_8XMODE 0x88 /* 8X sampling rate select */ + #define UART_EXAR_SLEEP 0x8b /* Sleep mode */ +@@ -596,7 +606,14 @@ exar_pci_probe(struct pci_dev *pcidev, const struct pci_device_id *ent) + + maxnr = pci_resource_len(pcidev, bar) >> (board->reg_shift + 3); + +- nr_ports = board->num_ports ? board->num_ports : pcidev->device & 0x0f; ++ if (pcidev->vendor == PCI_VENDOR_ID_ACCESSIO) ++ nr_ports = BIT(((pcidev->device & 0x38) >> 3) - 1); ++ else if (board->num_ports) ++ nr_ports = board->num_ports; ++ else if (pcidev->vendor == PCI_VENDOR_ID_SEALEVEL) ++ nr_ports = pcidev->device & 0xff; ++ else ++ nr_ports = pcidev->device & 0x0f; + + priv = devm_kzalloc(&pcidev->dev, struct_size(priv, line, nr_ports), GFP_KERNEL); + if (!priv) +@@ -695,22 +712,6 @@ static int __maybe_unused exar_resume(struct device *dev) + + static SIMPLE_DEV_PM_OPS(exar_pci_pm, exar_suspend, exar_resume); + +-static const struct exar8250_board acces_com_2x = { +- .num_ports = 2, +- .setup = pci_xr17c154_setup, +-}; +- +-static const struct exar8250_board acces_com_4x = { +- .num_ports = 4, +- .setup = pci_xr17c154_setup, +-}; +- +-static const struct exar8250_board acces_com_8x = { +- .num_ports = 8, +- .setup = pci_xr17c154_setup, +-}; +- +- + static const struct exar8250_board pbn_fastcom335_2 = { + .num_ports = 2, + .setup = pci_fastcom335_setup, +@@ -794,14 +795,23 @@ static const struct exar8250_board pbn_exar_XR17V8358 = { + (kernel_ulong_t)&bd \ + } + ++#define USR_DEVICE(devid, sdevid, bd) { \ ++ PCI_DEVICE_SUB( \ ++ PCI_VENDOR_ID_USR, \ ++ PCI_DEVICE_ID_EXAR_##devid, \ ++ PCI_VENDOR_ID_EXAR, \ ++ PCI_SUBDEVICE_ID_USR_##sdevid), 0, 0, \ ++ (kernel_ulong_t)&bd \ ++ } ++ + static const struct pci_device_id exar_pci_tbl[] = { +- EXAR_DEVICE(ACCESSIO, COM_2S, acces_com_2x), +- EXAR_DEVICE(ACCESSIO, COM_4S, acces_com_4x), +- EXAR_DEVICE(ACCESSIO, COM_8S, acces_com_8x), +- EXAR_DEVICE(ACCESSIO, COM232_8, acces_com_8x), +- EXAR_DEVICE(ACCESSIO, COM_2SM, acces_com_2x), +- EXAR_DEVICE(ACCESSIO, COM_4SM, acces_com_4x), +- EXAR_DEVICE(ACCESSIO, COM_8SM, acces_com_8x), ++ EXAR_DEVICE(ACCESSIO, COM_2S, pbn_exar_XR17C15x), ++ EXAR_DEVICE(ACCESSIO, COM_4S, pbn_exar_XR17C15x), ++ EXAR_DEVICE(ACCESSIO, COM_8S, pbn_exar_XR17C15x), ++ EXAR_DEVICE(ACCESSIO, COM232_8, pbn_exar_XR17C15x), ++ EXAR_DEVICE(ACCESSIO, COM_2SM, pbn_exar_XR17C15x), ++ EXAR_DEVICE(ACCESSIO, COM_4SM, pbn_exar_XR17C15x), ++ EXAR_DEVICE(ACCESSIO, COM_8SM, pbn_exar_XR17C15x), + + CONNECT_DEVICE(XR17C152, UART_2_232, pbn_connect), + CONNECT_DEVICE(XR17C154, UART_4_232, pbn_connect), +@@ -818,6 +828,10 @@ static const struct pci_device_id exar_pci_tbl[] = { + + IBM_DEVICE(XR17C152, SATURN_SERIAL_ONE_PORT, pbn_exar_ibm_saturn), + ++ /* USRobotics USR298x-OEM PCI Modems */ ++ USR_DEVICE(XR17C152, 2980, pbn_exar_XR17C15x), ++ USR_DEVICE(XR17C152, 2981, pbn_exar_XR17C15x), ++ + /* Exar Corp. XR17C15[248] Dual/Quad/Octal UART */ + EXAR_DEVICE(EXAR, XR17C152, pbn_exar_XR17C15x), + EXAR_DEVICE(EXAR, XR17C154, pbn_exar_XR17C15x), +@@ -837,6 +851,12 @@ static const struct pci_device_id exar_pci_tbl[] = { + EXAR_DEVICE(COMMTECH, 4224PCI335, pbn_fastcom335_4), + EXAR_DEVICE(COMMTECH, 2324PCI335, pbn_fastcom335_4), + EXAR_DEVICE(COMMTECH, 2328PCI335, pbn_fastcom335_8), ++ ++ EXAR_DEVICE(SEALEVEL, 710xC, pbn_exar_XR17V35x), ++ EXAR_DEVICE(SEALEVEL, 720xC, pbn_exar_XR17V35x), ++ EXAR_DEVICE(SEALEVEL, 740xC, pbn_exar_XR17V35x), ++ EXAR_DEVICE(SEALEVEL, 780xC, pbn_exar_XR17V35x), ++ EXAR_DEVICE(SEALEVEL, 716xC, pbn_exar_XR17V35x), + { 0, } + }; + MODULE_DEVICE_TABLE(pci, exar_pci_tbl); +diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c +index b6656898699d1..9617f7ad332d1 100644 +--- a/drivers/tty/serial/8250/8250_pci.c ++++ b/drivers/tty/serial/8250/8250_pci.c +@@ -1839,6 +1839,8 @@ pci_moxa_setup(struct serial_private *priv, + #define PCI_SUBDEVICE_ID_SIIG_DUAL_30 0x2530 + #define PCI_VENDOR_ID_ADVANTECH 0x13fe + #define PCI_DEVICE_ID_INTEL_CE4100_UART 0x2e66 ++#define PCI_DEVICE_ID_ADVANTECH_PCI1600 0x1600 ++#define PCI_DEVICE_ID_ADVANTECH_PCI1600_1611 0x1611 + #define PCI_DEVICE_ID_ADVANTECH_PCI3620 0x3620 + #define PCI_DEVICE_ID_ADVANTECH_PCI3618 0x3618 + #define PCI_DEVICE_ID_ADVANTECH_PCIf618 0xf618 +@@ -4185,6 +4187,9 @@ static SIMPLE_DEV_PM_OPS(pciserial_pm_ops, pciserial_suspend_one, + pciserial_resume_one); + + static const struct pci_device_id serial_pci_tbl[] = { ++ { PCI_VENDOR_ID_ADVANTECH, PCI_DEVICE_ID_ADVANTECH_PCI1600, ++ PCI_DEVICE_ID_ADVANTECH_PCI1600_1611, PCI_ANY_ID, 0, 0, ++ pbn_b0_4_921600 }, + /* Advantech use PCI_DEVICE_ID_ADVANTECH_PCI3620 (0x3620) as 'PCI_SUBVENDOR_ID' */ + { PCI_VENDOR_ID_ADVANTECH, PCI_DEVICE_ID_ADVANTECH_PCI3620, + PCI_DEVICE_ID_ADVANTECH_PCI3620, 0x0001, 0, 0, +diff --git a/drivers/tty/serial/arc_uart.c b/drivers/tty/serial/arc_uart.c +index 17c3fc398fc65..6f7a7d2dcf3aa 100644 +--- a/drivers/tty/serial/arc_uart.c ++++ b/drivers/tty/serial/arc_uart.c +@@ -609,10 +609,11 @@ static int arc_serial_probe(struct platform_device *pdev) + } + uart->baud = val; + +- port->membase = of_iomap(np, 0); +- if (!port->membase) ++ port->membase = devm_platform_ioremap_resource(pdev, 0); ++ if (IS_ERR(port->membase)) { + /* No point of dev_err since UART itself is hosed here */ +- return -ENXIO; ++ return PTR_ERR(port->membase); ++ } + + port->irq = irq_of_parse_and_map(np, 0); + +diff --git a/drivers/tty/vt/vc_screen.c b/drivers/tty/vt/vc_screen.c +index 1dc07f9214d57..01c96537fa36b 100644 +--- a/drivers/tty/vt/vc_screen.c ++++ b/drivers/tty/vt/vc_screen.c +@@ -656,10 +656,17 @@ vcs_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos) + } + } + +- /* The vcs_size might have changed while we slept to grab +- * the user buffer, so recheck. ++ /* The vc might have been freed or vcs_size might have changed ++ * while we slept to grab the user buffer, so recheck. + * Return data written up to now on failure. + */ ++ vc = vcs_vc(inode, &viewed); ++ if (!vc) { ++ if (written) ++ break; ++ ret = -ENXIO; ++ goto unlock_out; ++ } + size = vcs_size(vc, attr, false); + if (size < 0) { + if (written) +diff --git a/drivers/usb/class/usbtmc.c b/drivers/usb/class/usbtmc.c +index 49f59d53b4b26..76ff182427bc6 100644 +--- a/drivers/usb/class/usbtmc.c ++++ b/drivers/usb/class/usbtmc.c +@@ -1898,6 +1898,8 @@ static int usbtmc_ioctl_request(struct usbtmc_device_data *data, + + if (request.req.wLength > USBTMC_BUFSIZE) + return -EMSGSIZE; ++ if (request.req.wLength == 0) /* Length-0 requests are never IN */ ++ request.req.bRequestType &= ~USB_DIR_IN; + + is_in = request.req.bRequestType & USB_DIR_IN; + +diff --git a/drivers/usb/core/usb.c b/drivers/usb/core/usb.c +index db4de5367737a..c4cd9d46f9e3c 100644 +--- a/drivers/usb/core/usb.c ++++ b/drivers/usb/core/usb.c +@@ -207,6 +207,82 @@ int usb_find_common_endpoints_reverse(struct usb_host_interface *alt, + } + EXPORT_SYMBOL_GPL(usb_find_common_endpoints_reverse); + ++/** ++ * usb_find_endpoint() - Given an endpoint address, search for the endpoint's ++ * usb_host_endpoint structure in an interface's current altsetting. ++ * @intf: the interface whose current altsetting should be searched ++ * @ep_addr: the endpoint address (number and direction) to find ++ * ++ * Search the altsetting's list of endpoints for one with the specified address. ++ * ++ * Return: Pointer to the usb_host_endpoint if found, %NULL otherwise. ++ */ ++static const struct usb_host_endpoint *usb_find_endpoint( ++ const struct usb_interface *intf, unsigned int ep_addr) ++{ ++ int n; ++ const struct usb_host_endpoint *ep; ++ ++ n = intf->cur_altsetting->desc.bNumEndpoints; ++ ep = intf->cur_altsetting->endpoint; ++ for (; n > 0; (--n, ++ep)) { ++ if (ep->desc.bEndpointAddress == ep_addr) ++ return ep; ++ } ++ return NULL; ++} ++ ++/** ++ * usb_check_bulk_endpoints - Check whether an interface's current altsetting ++ * contains a set of bulk endpoints with the given addresses. ++ * @intf: the interface whose current altsetting should be searched ++ * @ep_addrs: 0-terminated array of the endpoint addresses (number and ++ * direction) to look for ++ * ++ * Search for endpoints with the specified addresses and check their types. ++ * ++ * Return: %true if all the endpoints are found and are bulk, %false otherwise. ++ */ ++bool usb_check_bulk_endpoints( ++ const struct usb_interface *intf, const u8 *ep_addrs) ++{ ++ const struct usb_host_endpoint *ep; ++ ++ for (; *ep_addrs; ++ep_addrs) { ++ ep = usb_find_endpoint(intf, *ep_addrs); ++ if (!ep || !usb_endpoint_xfer_bulk(&ep->desc)) ++ return false; ++ } ++ return true; ++} ++EXPORT_SYMBOL_GPL(usb_check_bulk_endpoints); ++ ++/** ++ * usb_check_int_endpoints - Check whether an interface's current altsetting ++ * contains a set of interrupt endpoints with the given addresses. ++ * @intf: the interface whose current altsetting should be searched ++ * @ep_addrs: 0-terminated array of the endpoint addresses (number and ++ * direction) to look for ++ * ++ * Search for endpoints with the specified addresses and check their types. ++ * ++ * Return: %true if all the endpoints are found and are interrupt, ++ * %false otherwise. ++ */ ++bool usb_check_int_endpoints( ++ const struct usb_interface *intf, const u8 *ep_addrs) ++{ ++ const struct usb_host_endpoint *ep; ++ ++ for (; *ep_addrs; ++ep_addrs) { ++ ep = usb_find_endpoint(intf, *ep_addrs); ++ if (!ep || !usb_endpoint_xfer_int(&ep->desc)) ++ return false; ++ } ++ return true; ++} ++EXPORT_SYMBOL_GPL(usb_check_int_endpoints); ++ + /** + * usb_find_alt_setting() - Given a configuration, find the alternate setting + * for the given interface. +diff --git a/drivers/usb/dwc3/debugfs.c b/drivers/usb/dwc3/debugfs.c +index 3ebe3e6c284d2..da8b62db49fb2 100644 +--- a/drivers/usb/dwc3/debugfs.c ++++ b/drivers/usb/dwc3/debugfs.c +@@ -327,6 +327,11 @@ static int dwc3_lsp_show(struct seq_file *s, void *unused) + unsigned int current_mode; + unsigned long flags; + u32 reg; ++ int ret; ++ ++ ret = pm_runtime_resume_and_get(dwc->dev); ++ if (ret < 0) ++ return ret; + + spin_lock_irqsave(&dwc->lock, flags); + reg = dwc3_readl(dwc->regs, DWC3_GSTS); +@@ -345,6 +350,8 @@ static int dwc3_lsp_show(struct seq_file *s, void *unused) + } + spin_unlock_irqrestore(&dwc->lock, flags); + ++ pm_runtime_put_sync(dwc->dev); ++ + return 0; + } + +@@ -390,6 +397,11 @@ static int dwc3_mode_show(struct seq_file *s, void *unused) + struct dwc3 *dwc = s->private; + unsigned long flags; + u32 reg; ++ int ret; ++ ++ ret = pm_runtime_resume_and_get(dwc->dev); ++ if (ret < 0) ++ return ret; + + spin_lock_irqsave(&dwc->lock, flags); + reg = dwc3_readl(dwc->regs, DWC3_GCTL); +@@ -409,6 +421,8 @@ static int dwc3_mode_show(struct seq_file *s, void *unused) + seq_printf(s, "UNKNOWN %08x\n", DWC3_GCTL_PRTCAP(reg)); + } + ++ pm_runtime_put_sync(dwc->dev); ++ + return 0; + } + +@@ -458,6 +472,11 @@ static int dwc3_testmode_show(struct seq_file *s, void *unused) + struct dwc3 *dwc = s->private; + unsigned long flags; + u32 reg; ++ int ret; ++ ++ ret = pm_runtime_resume_and_get(dwc->dev); ++ if (ret < 0) ++ return ret; + + spin_lock_irqsave(&dwc->lock, flags); + reg = dwc3_readl(dwc->regs, DWC3_DCTL); +@@ -488,6 +507,8 @@ static int dwc3_testmode_show(struct seq_file *s, void *unused) + seq_printf(s, "UNKNOWN %d\n", reg); + } + ++ pm_runtime_put_sync(dwc->dev); ++ + return 0; + } + +@@ -504,6 +525,7 @@ static ssize_t dwc3_testmode_write(struct file *file, + unsigned long flags; + u32 testmode = 0; + char buf[32]; ++ int ret; + + if (copy_from_user(&buf, ubuf, min_t(size_t, sizeof(buf) - 1, count))) + return -EFAULT; +@@ -521,10 +543,16 @@ static ssize_t dwc3_testmode_write(struct file *file, + else + testmode = 0; + ++ ret = pm_runtime_resume_and_get(dwc->dev); ++ if (ret < 0) ++ return ret; ++ + spin_lock_irqsave(&dwc->lock, flags); + dwc3_gadget_set_test_mode(dwc, testmode); + spin_unlock_irqrestore(&dwc->lock, flags); + ++ pm_runtime_put_sync(dwc->dev); ++ + return count; + } + +@@ -543,12 +571,18 @@ static int dwc3_link_state_show(struct seq_file *s, void *unused) + enum dwc3_link_state state; + u32 reg; + u8 speed; ++ int ret; ++ ++ ret = pm_runtime_resume_and_get(dwc->dev); ++ if (ret < 0) ++ return ret; + + spin_lock_irqsave(&dwc->lock, flags); + reg = dwc3_readl(dwc->regs, DWC3_GSTS); + if (DWC3_GSTS_CURMOD(reg) != DWC3_GSTS_CURMOD_DEVICE) { + seq_puts(s, "Not available\n"); + spin_unlock_irqrestore(&dwc->lock, flags); ++ pm_runtime_put_sync(dwc->dev); + return 0; + } + +@@ -561,6 +595,8 @@ static int dwc3_link_state_show(struct seq_file *s, void *unused) + dwc3_gadget_hs_link_string(state)); + spin_unlock_irqrestore(&dwc->lock, flags); + ++ pm_runtime_put_sync(dwc->dev); ++ + return 0; + } + +@@ -579,6 +615,7 @@ static ssize_t dwc3_link_state_write(struct file *file, + char buf[32]; + u32 reg; + u8 speed; ++ int ret; + + if (copy_from_user(&buf, ubuf, min_t(size_t, sizeof(buf) - 1, count))) + return -EFAULT; +@@ -598,10 +635,15 @@ static ssize_t dwc3_link_state_write(struct file *file, + else + return -EINVAL; + ++ ret = pm_runtime_resume_and_get(dwc->dev); ++ if (ret < 0) ++ return ret; ++ + spin_lock_irqsave(&dwc->lock, flags); + reg = dwc3_readl(dwc->regs, DWC3_GSTS); + if (DWC3_GSTS_CURMOD(reg) != DWC3_GSTS_CURMOD_DEVICE) { + spin_unlock_irqrestore(&dwc->lock, flags); ++ pm_runtime_put_sync(dwc->dev); + return -EINVAL; + } + +@@ -611,12 +653,15 @@ static ssize_t dwc3_link_state_write(struct file *file, + if (speed < DWC3_DSTS_SUPERSPEED && + state != DWC3_LINK_STATE_RECOV) { + spin_unlock_irqrestore(&dwc->lock, flags); ++ pm_runtime_put_sync(dwc->dev); + return -EINVAL; + } + + dwc3_gadget_set_link_state(dwc, state); + spin_unlock_irqrestore(&dwc->lock, flags); + ++ pm_runtime_put_sync(dwc->dev); ++ + return count; + } + +@@ -640,6 +685,11 @@ static int dwc3_tx_fifo_size_show(struct seq_file *s, void *unused) + unsigned long flags; + int mdwidth; + u32 val; ++ int ret; ++ ++ ret = pm_runtime_resume_and_get(dwc->dev); ++ if (ret < 0) ++ return ret; + + spin_lock_irqsave(&dwc->lock, flags); + val = dwc3_core_fifo_space(dep, DWC3_TXFIFO); +@@ -654,6 +704,8 @@ static int dwc3_tx_fifo_size_show(struct seq_file *s, void *unused) + seq_printf(s, "%u\n", val); + spin_unlock_irqrestore(&dwc->lock, flags); + ++ pm_runtime_put_sync(dwc->dev); ++ + return 0; + } + +@@ -664,6 +716,11 @@ static int dwc3_rx_fifo_size_show(struct seq_file *s, void *unused) + unsigned long flags; + int mdwidth; + u32 val; ++ int ret; ++ ++ ret = pm_runtime_resume_and_get(dwc->dev); ++ if (ret < 0) ++ return ret; + + spin_lock_irqsave(&dwc->lock, flags); + val = dwc3_core_fifo_space(dep, DWC3_RXFIFO); +@@ -678,6 +735,8 @@ static int dwc3_rx_fifo_size_show(struct seq_file *s, void *unused) + seq_printf(s, "%u\n", val); + spin_unlock_irqrestore(&dwc->lock, flags); + ++ pm_runtime_put_sync(dwc->dev); ++ + return 0; + } + +@@ -687,12 +746,19 @@ static int dwc3_tx_request_queue_show(struct seq_file *s, void *unused) + struct dwc3 *dwc = dep->dwc; + unsigned long flags; + u32 val; ++ int ret; ++ ++ ret = pm_runtime_resume_and_get(dwc->dev); ++ if (ret < 0) ++ return ret; + + spin_lock_irqsave(&dwc->lock, flags); + val = dwc3_core_fifo_space(dep, DWC3_TXREQQ); + seq_printf(s, "%u\n", val); + spin_unlock_irqrestore(&dwc->lock, flags); + ++ pm_runtime_put_sync(dwc->dev); ++ + return 0; + } + +@@ -702,12 +768,19 @@ static int dwc3_rx_request_queue_show(struct seq_file *s, void *unused) + struct dwc3 *dwc = dep->dwc; + unsigned long flags; + u32 val; ++ int ret; ++ ++ ret = pm_runtime_resume_and_get(dwc->dev); ++ if (ret < 0) ++ return ret; + + spin_lock_irqsave(&dwc->lock, flags); + val = dwc3_core_fifo_space(dep, DWC3_RXREQQ); + seq_printf(s, "%u\n", val); + spin_unlock_irqrestore(&dwc->lock, flags); + ++ pm_runtime_put_sync(dwc->dev); ++ + return 0; + } + +@@ -717,12 +790,19 @@ static int dwc3_rx_info_queue_show(struct seq_file *s, void *unused) + struct dwc3 *dwc = dep->dwc; + unsigned long flags; + u32 val; ++ int ret; ++ ++ ret = pm_runtime_resume_and_get(dwc->dev); ++ if (ret < 0) ++ return ret; + + spin_lock_irqsave(&dwc->lock, flags); + val = dwc3_core_fifo_space(dep, DWC3_RXINFOQ); + seq_printf(s, "%u\n", val); + spin_unlock_irqrestore(&dwc->lock, flags); + ++ pm_runtime_put_sync(dwc->dev); ++ + return 0; + } + +@@ -732,12 +812,19 @@ static int dwc3_descriptor_fetch_queue_show(struct seq_file *s, void *unused) + struct dwc3 *dwc = dep->dwc; + unsigned long flags; + u32 val; ++ int ret; ++ ++ ret = pm_runtime_resume_and_get(dwc->dev); ++ if (ret < 0) ++ return ret; + + spin_lock_irqsave(&dwc->lock, flags); + val = dwc3_core_fifo_space(dep, DWC3_DESCFETCHQ); + seq_printf(s, "%u\n", val); + spin_unlock_irqrestore(&dwc->lock, flags); + ++ pm_runtime_put_sync(dwc->dev); ++ + return 0; + } + +@@ -747,12 +834,19 @@ static int dwc3_event_queue_show(struct seq_file *s, void *unused) + struct dwc3 *dwc = dep->dwc; + unsigned long flags; + u32 val; ++ int ret; ++ ++ ret = pm_runtime_resume_and_get(dwc->dev); ++ if (ret < 0) ++ return ret; + + spin_lock_irqsave(&dwc->lock, flags); + val = dwc3_core_fifo_space(dep, DWC3_EVENTQ); + seq_printf(s, "%u\n", val); + spin_unlock_irqrestore(&dwc->lock, flags); + ++ pm_runtime_put_sync(dwc->dev); ++ + return 0; + } + +@@ -797,6 +891,11 @@ static int dwc3_trb_ring_show(struct seq_file *s, void *unused) + struct dwc3 *dwc = dep->dwc; + unsigned long flags; + int i; ++ int ret; ++ ++ ret = pm_runtime_resume_and_get(dwc->dev); ++ if (ret < 0) ++ return ret; + + spin_lock_irqsave(&dwc->lock, flags); + if (dep->number <= 1) { +@@ -826,6 +925,8 @@ static int dwc3_trb_ring_show(struct seq_file *s, void *unused) + out: + spin_unlock_irqrestore(&dwc->lock, flags); + ++ pm_runtime_put_sync(dwc->dev); ++ + return 0; + } + +@@ -838,6 +939,11 @@ static int dwc3_ep_info_register_show(struct seq_file *s, void *unused) + u32 lower_32_bits; + u32 upper_32_bits; + u32 reg; ++ int ret; ++ ++ ret = pm_runtime_resume_and_get(dwc->dev); ++ if (ret < 0) ++ return ret; + + spin_lock_irqsave(&dwc->lock, flags); + reg = DWC3_GDBGLSPMUX_EPSELECT(dep->number); +@@ -850,6 +956,8 @@ static int dwc3_ep_info_register_show(struct seq_file *s, void *unused) + seq_printf(s, "0x%016llx\n", ep_info); + spin_unlock_irqrestore(&dwc->lock, flags); + ++ pm_runtime_put_sync(dwc->dev); ++ + return 0; + } + +@@ -911,6 +1019,7 @@ void dwc3_debugfs_init(struct dwc3 *dwc) + dwc->regset->regs = dwc3_regs; + dwc->regset->nregs = ARRAY_SIZE(dwc3_regs); + dwc->regset->base = dwc->regs - DWC3_GLOBALS_REGS_START; ++ dwc->regset->dev = dwc->dev; + + root = debugfs_create_dir(dev_name(dwc->dev), usb_debug_root); + dwc->root = root; +diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c +index 64ef97ab9274a..5e5f699a434f4 100644 +--- a/drivers/usb/gadget/function/u_ether.c ++++ b/drivers/usb/gadget/function/u_ether.c +@@ -17,6 +17,7 @@ + #include + #include + #include ++#include + + #include "u_ether.h" + +@@ -974,6 +975,8 @@ int gether_get_host_addr_cdc(struct net_device *net, char *host_addr, int len) + dev = netdev_priv(net); + snprintf(host_addr, len, "%pm", dev->host_mac); + ++ string_upper(host_addr, host_addr); ++ + return strlen(host_addr); + } + EXPORT_SYMBOL_GPL(gether_get_host_addr_cdc); +diff --git a/drivers/usb/host/uhci-pci.c b/drivers/usb/host/uhci-pci.c +index 9b88745d247f5..3316533b8bc29 100644 +--- a/drivers/usb/host/uhci-pci.c ++++ b/drivers/usb/host/uhci-pci.c +@@ -119,11 +119,13 @@ static int uhci_pci_init(struct usb_hcd *hcd) + + uhci->rh_numports = uhci_count_ports(hcd); + +- /* Intel controllers report the OverCurrent bit active on. +- * VIA controllers report it active off, so we'll adjust the +- * bit value. (It's not standardized in the UHCI spec.) ++ /* ++ * Intel controllers report the OverCurrent bit active on. VIA ++ * and ZHAOXIN controllers report it active off, so we'll adjust ++ * the bit value. (It's not standardized in the UHCI spec.) + */ +- if (to_pci_dev(uhci_dev(uhci))->vendor == PCI_VENDOR_ID_VIA) ++ if (to_pci_dev(uhci_dev(uhci))->vendor == PCI_VENDOR_ID_VIA || ++ to_pci_dev(uhci_dev(uhci))->vendor == PCI_VENDOR_ID_ZHAOXIN) + uhci->oc_low = 1; + + /* HP's server management chip requires a longer port reset delay. */ +diff --git a/drivers/usb/misc/sisusbvga/sisusb.c b/drivers/usb/misc/sisusbvga/sisusb.c +index f08de33d9ff38..8ed803c4a251d 100644 +--- a/drivers/usb/misc/sisusbvga/sisusb.c ++++ b/drivers/usb/misc/sisusbvga/sisusb.c +@@ -3014,6 +3014,20 @@ static int sisusb_probe(struct usb_interface *intf, + struct usb_device *dev = interface_to_usbdev(intf); + struct sisusb_usb_data *sisusb; + int retval = 0, i; ++ static const u8 ep_addresses[] = { ++ SISUSB_EP_GFX_IN | USB_DIR_IN, ++ SISUSB_EP_GFX_OUT | USB_DIR_OUT, ++ SISUSB_EP_GFX_BULK_OUT | USB_DIR_OUT, ++ SISUSB_EP_GFX_LBULK_OUT | USB_DIR_OUT, ++ SISUSB_EP_BRIDGE_IN | USB_DIR_IN, ++ SISUSB_EP_BRIDGE_OUT | USB_DIR_OUT, ++ 0}; ++ ++ /* Are the expected endpoints present? */ ++ if (!usb_check_bulk_endpoints(intf, ep_addresses)) { ++ dev_err(&intf->dev, "Invalid USB2VGA device\n"); ++ return -EINVAL; ++ } + + dev_info(&dev->dev, "USB2VGA dongle found at address %d\n", + dev->devnum); +diff --git a/drivers/usb/storage/scsiglue.c b/drivers/usb/storage/scsiglue.c +index e5a971b83e3f5..b8e1109f0e0d4 100644 +--- a/drivers/usb/storage/scsiglue.c ++++ b/drivers/usb/storage/scsiglue.c +@@ -407,22 +407,25 @@ static DEF_SCSI_QCMD(queuecommand) + ***********************************************************************/ + + /* Command timeout and abort */ +-static int command_abort(struct scsi_cmnd *srb) ++static int command_abort_matching(struct us_data *us, struct scsi_cmnd *srb_match) + { +- struct us_data *us = host_to_us(srb->device->host); +- +- usb_stor_dbg(us, "%s called\n", __func__); +- + /* + * us->srb together with the TIMED_OUT, RESETTING, and ABORTING + * bits are protected by the host lock. + */ + scsi_lock(us_to_host(us)); + +- /* Is this command still active? */ +- if (us->srb != srb) { ++ /* is there any active pending command to abort ? */ ++ if (!us->srb) { + scsi_unlock(us_to_host(us)); + usb_stor_dbg(us, "-- nothing to abort\n"); ++ return SUCCESS; ++ } ++ ++ /* Does the command match the passed srb if any ? */ ++ if (srb_match && us->srb != srb_match) { ++ scsi_unlock(us_to_host(us)); ++ usb_stor_dbg(us, "-- pending command mismatch\n"); + return FAILED; + } + +@@ -445,6 +448,14 @@ static int command_abort(struct scsi_cmnd *srb) + return SUCCESS; + } + ++static int command_abort(struct scsi_cmnd *srb) ++{ ++ struct us_data *us = host_to_us(srb->device->host); ++ ++ usb_stor_dbg(us, "%s called\n", __func__); ++ return command_abort_matching(us, srb); ++} ++ + /* + * This invokes the transport reset mechanism to reset the state of the + * device +@@ -456,6 +467,9 @@ static int device_reset(struct scsi_cmnd *srb) + + usb_stor_dbg(us, "%s called\n", __func__); + ++ /* abort any pending command before reset */ ++ command_abort_matching(us, NULL); ++ + /* lock the device pointers and do the reset */ + mutex_lock(&(us->dev_mutex)); + result = us->transport_reset(us); +diff --git a/drivers/usb/typec/altmodes/displayport.c b/drivers/usb/typec/altmodes/displayport.c +index 07b6561720687..0d4b1c0eeefb3 100644 +--- a/drivers/usb/typec/altmodes/displayport.c ++++ b/drivers/usb/typec/altmodes/displayport.c +@@ -503,6 +503,10 @@ static ssize_t pin_assignment_show(struct device *dev, + + mutex_unlock(&dp->lock); + ++ /* get_current_pin_assignments can return 0 when no matching pin assignments are found */ ++ if (len == 0) ++ len++; ++ + buf[len - 1] = '\n'; + return len; + } +diff --git a/drivers/usb/typec/tcpm/tcpm.c b/drivers/usb/typec/tcpm/tcpm.c +index 8333c80b5f7c1..cf0e6a80815ae 100644 +--- a/drivers/usb/typec/tcpm/tcpm.c ++++ b/drivers/usb/typec/tcpm/tcpm.c +@@ -1126,7 +1126,21 @@ static bool svdm_consume_svids(struct tcpm_port *port, const u32 *p, int cnt) + pmdata->svids[pmdata->nsvids++] = svid; + tcpm_log(port, "SVID %d: 0x%x", pmdata->nsvids, svid); + } +- return true; ++ ++ /* ++ * PD3.0 Spec 6.4.4.3.2: The SVIDs are returned 2 per VDO (see Table ++ * 6-43), and can be returned maximum 6 VDOs per response (see Figure ++ * 6-19). If the Respondersupports 12 or more SVID then the Discover ++ * SVIDs Command Shall be executed multiple times until a Discover ++ * SVIDs VDO is returned ending either with a SVID value of 0x0000 in ++ * the last part of the last VDO or with a VDO containing two SVIDs ++ * with values of 0x0000. ++ * ++ * However, some odd dockers support SVIDs less than 12 but without ++ * 0x0000 in the last VDO, so we need to break the Discover SVIDs ++ * request and return false here. ++ */ ++ return cnt == 7; + abort: + tcpm_log(port, "SVID_DISCOVERY_MAX(%d) too low!", SVID_DISCOVERY_MAX); + return false; +diff --git a/drivers/video/fbdev/arcfb.c b/drivers/video/fbdev/arcfb.c +index 1447324ed0b64..08da436265d92 100644 +--- a/drivers/video/fbdev/arcfb.c ++++ b/drivers/video/fbdev/arcfb.c +@@ -523,7 +523,7 @@ static int arcfb_probe(struct platform_device *dev) + + info = framebuffer_alloc(sizeof(struct arcfb_par), &dev->dev); + if (!info) +- goto err; ++ goto err_fb_alloc; + + info->screen_base = (char __iomem *)videomemory; + info->fbops = &arcfb_ops; +@@ -535,7 +535,7 @@ static int arcfb_probe(struct platform_device *dev) + + if (!dio_addr || !cio_addr || !c2io_addr) { + printk(KERN_WARNING "no IO addresses supplied\n"); +- goto err1; ++ goto err_addr; + } + par->dio_addr = dio_addr; + par->cio_addr = cio_addr; +@@ -551,12 +551,12 @@ static int arcfb_probe(struct platform_device *dev) + printk(KERN_INFO + "arcfb: Failed req IRQ %d\n", par->irq); + retval = -EBUSY; +- goto err1; ++ goto err_addr; + } + } + retval = register_framebuffer(info); + if (retval < 0) +- goto err1; ++ goto err_register_fb; + platform_set_drvdata(dev, info); + fb_info(info, "Arc frame buffer device, using %dK of video memory\n", + videomemorysize >> 10); +@@ -580,9 +580,12 @@ static int arcfb_probe(struct platform_device *dev) + } + + return 0; +-err1: ++ ++err_register_fb: ++ free_irq(par->irq, info); ++err_addr: + framebuffer_release(info); +-err: ++err_fb_alloc: + vfree(videomemory); + return retval; + } +diff --git a/drivers/video/fbdev/udlfb.c b/drivers/video/fbdev/udlfb.c +index d9eec1b60e665..0de7b867714a7 100644 +--- a/drivers/video/fbdev/udlfb.c ++++ b/drivers/video/fbdev/udlfb.c +@@ -27,6 +27,8 @@ + #include