diff --git a/config/kernel/linux-odroidxu4-current.config b/config/kernel/linux-odroidxu4-current.config index 4b6305f2b..bba2bdd93 100644 --- a/config/kernel/linux-odroidxu4-current.config +++ b/config/kernel/linux-odroidxu4-current.config @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/arm 5.4.210 Kernel Configuration +# Linux/arm 5.4.211 Kernel Configuration # # diff --git a/config/sources/families/odroidxu4.conf b/config/sources/families/odroidxu4.conf index d71000e4a..0f80bd3d6 100644 --- a/config/sources/families/odroidxu4.conf +++ b/config/sources/families/odroidxu4.conf @@ -19,6 +19,7 @@ case $BRANCH in KERNELSOURCE='https://github.com/hardkernel/linux' KERNELBRANCH='branch:odroid-5.4.y' + KERNELBRANCH='tag:5.4.196-406' KERNELDIR='linux-odroidxu4' ;; diff --git a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.167-168.patch b/patch/kernel/archive/odroidxu4-5.4/patch-5.4.167-168.patch deleted file mode 100644 index 529751cb9..000000000 --- a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.167-168.patch +++ /dev/null @@ -1,2322 +0,0 @@ -diff --git a/Makefile b/Makefile -index 1045f7fc08503..c23f5b17d239f 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 5 - PATCHLEVEL = 4 --SUBLEVEL = 167 -+SUBLEVEL = 168 - EXTRAVERSION = - NAME = Kleptomaniac Octopus - -diff --git a/arch/arm/boot/dts/imx6ull-pinfunc.h b/arch/arm/boot/dts/imx6ull-pinfunc.h -index eb025a9d47592..7328d4ef8559f 100644 ---- a/arch/arm/boot/dts/imx6ull-pinfunc.h -+++ b/arch/arm/boot/dts/imx6ull-pinfunc.h -@@ -82,6 +82,6 @@ - #define MX6ULL_PAD_CSI_DATA04__ESAI_TX_FS 0x01F4 0x0480 0x0000 0x9 0x0 - #define MX6ULL_PAD_CSI_DATA05__ESAI_TX_CLK 0x01F8 0x0484 0x0000 0x9 0x0 - #define MX6ULL_PAD_CSI_DATA06__ESAI_TX5_RX0 0x01FC 0x0488 0x0000 0x9 0x0 --#define MX6ULL_PAD_CSI_DATA07__ESAI_T0 0x0200 0x048C 0x0000 0x9 0x0 -+#define MX6ULL_PAD_CSI_DATA07__ESAI_TX0 0x0200 0x048C 0x0000 0x9 0x0 - - #endif /* __DTS_IMX6ULL_PINFUNC_H */ -diff --git a/arch/arm/boot/dts/socfpga_arria10_socdk_qspi.dts b/arch/arm/boot/dts/socfpga_arria10_socdk_qspi.dts -index b4c0a76a4d1af..4c2fcfcc7baed 100644 ---- a/arch/arm/boot/dts/socfpga_arria10_socdk_qspi.dts -+++ b/arch/arm/boot/dts/socfpga_arria10_socdk_qspi.dts -@@ -12,7 +12,7 @@ - flash0: n25q00@0 { - #address-cells = <1>; - #size-cells = <1>; -- compatible = "n25q00aa"; -+ compatible = "micron,mt25qu02g", "jedec,spi-nor"; - reg = <0>; - spi-max-frequency = <100000000>; - -diff --git a/arch/arm/boot/dts/socfpga_arria5_socdk.dts b/arch/arm/boot/dts/socfpga_arria5_socdk.dts -index 90e676e7019f2..1b02d46496a85 100644 ---- a/arch/arm/boot/dts/socfpga_arria5_socdk.dts -+++ b/arch/arm/boot/dts/socfpga_arria5_socdk.dts -@@ -119,7 +119,7 @@ - flash: flash@0 { - #address-cells = <1>; - #size-cells = <1>; -- compatible = "n25q256a"; -+ compatible = "micron,n25q256a", "jedec,spi-nor"; - reg = <0>; - spi-max-frequency = <100000000>; - -diff --git a/arch/arm/boot/dts/socfpga_cyclone5_socdk.dts b/arch/arm/boot/dts/socfpga_cyclone5_socdk.dts -index 6f138b2b26163..51bb436784e24 100644 ---- a/arch/arm/boot/dts/socfpga_cyclone5_socdk.dts -+++ b/arch/arm/boot/dts/socfpga_cyclone5_socdk.dts -@@ -124,7 +124,7 @@ - flash0: n25q00@0 { - #address-cells = <1>; - #size-cells = <1>; -- compatible = "n25q00"; -+ compatible = "micron,mt25qu02g", "jedec,spi-nor"; - reg = <0>; /* chip select */ - spi-max-frequency = <100000000>; - -diff --git a/arch/arm/boot/dts/socfpga_cyclone5_sockit.dts b/arch/arm/boot/dts/socfpga_cyclone5_sockit.dts -index c155ff02eb6e0..cae9ddd5ed38b 100644 ---- a/arch/arm/boot/dts/socfpga_cyclone5_sockit.dts -+++ b/arch/arm/boot/dts/socfpga_cyclone5_sockit.dts -@@ -169,7 +169,7 @@ - flash: flash@0 { - #address-cells = <1>; - #size-cells = <1>; -- compatible = "n25q00"; -+ compatible = "micron,mt25qu02g", "jedec,spi-nor"; - reg = <0>; - spi-max-frequency = <100000000>; - -diff --git a/arch/arm/boot/dts/socfpga_cyclone5_socrates.dts b/arch/arm/boot/dts/socfpga_cyclone5_socrates.dts -index 8d5d3996f6f27..ca18b959e6559 100644 ---- a/arch/arm/boot/dts/socfpga_cyclone5_socrates.dts -+++ b/arch/arm/boot/dts/socfpga_cyclone5_socrates.dts -@@ -80,7 +80,7 @@ - flash: flash@0 { - #address-cells = <1>; - #size-cells = <1>; -- compatible = "n25q256a"; -+ compatible = "micron,n25q256a", "jedec,spi-nor"; - reg = <0>; - spi-max-frequency = <100000000>; - m25p,fast-read; -diff --git a/arch/arm/boot/dts/socfpga_cyclone5_sodia.dts b/arch/arm/boot/dts/socfpga_cyclone5_sodia.dts -index 99a71757cdf46..3f7aa7bf0863a 100644 ---- a/arch/arm/boot/dts/socfpga_cyclone5_sodia.dts -+++ b/arch/arm/boot/dts/socfpga_cyclone5_sodia.dts -@@ -116,7 +116,7 @@ - flash0: n25q512a@0 { - #address-cells = <1>; - #size-cells = <1>; -- compatible = "n25q512a"; -+ compatible = "micron,n25q512a", "jedec,spi-nor"; - reg = <0>; - spi-max-frequency = <100000000>; - -diff --git a/arch/arm/boot/dts/socfpga_cyclone5_vining_fpga.dts b/arch/arm/boot/dts/socfpga_cyclone5_vining_fpga.dts -index a060718758b67..25874e1b9c829 100644 ---- a/arch/arm/boot/dts/socfpga_cyclone5_vining_fpga.dts -+++ b/arch/arm/boot/dts/socfpga_cyclone5_vining_fpga.dts -@@ -224,7 +224,7 @@ - n25q128@0 { - #address-cells = <1>; - #size-cells = <1>; -- compatible = "n25q128"; -+ compatible = "micron,n25q128", "jedec,spi-nor"; - reg = <0>; /* chip select */ - spi-max-frequency = <100000000>; - m25p,fast-read; -@@ -241,7 +241,7 @@ - n25q00@1 { - #address-cells = <1>; - #size-cells = <1>; -- compatible = "n25q00"; -+ compatible = "micron,mt25qu02g", "jedec,spi-nor"; - reg = <1>; /* chip select */ - spi-max-frequency = <100000000>; - m25p,fast-read; -diff --git a/arch/arm64/boot/dts/rockchip/rk3399-khadas-edge.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-khadas-edge.dtsi -index e87a04477440e..292ca70c512b5 100644 ---- a/arch/arm64/boot/dts/rockchip/rk3399-khadas-edge.dtsi -+++ b/arch/arm64/boot/dts/rockchip/rk3399-khadas-edge.dtsi -@@ -685,7 +685,6 @@ - &sdhci { - bus-width = <8>; - mmc-hs400-1_8v; -- mmc-hs400-enhanced-strobe; - non-removable; - status = "okay"; - }; -diff --git a/arch/arm64/boot/dts/rockchip/rk3399-leez-p710.dts b/arch/arm64/boot/dts/rockchip/rk3399-leez-p710.dts -index 73be38a537960..a72e77c261ef3 100644 ---- a/arch/arm64/boot/dts/rockchip/rk3399-leez-p710.dts -+++ b/arch/arm64/boot/dts/rockchip/rk3399-leez-p710.dts -@@ -49,7 +49,7 @@ - regulator-boot-on; - regulator-min-microvolt = <3300000>; - regulator-max-microvolt = <3300000>; -- vim-supply = <&vcc3v3_sys>; -+ vin-supply = <&vcc3v3_sys>; - }; - - vcc3v3_sys: vcc3v3-sys { -diff --git a/arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4.dts b/arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4.dts -index 1ae1ebd4efdd0..da3b031d4befa 100644 ---- a/arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4.dts -+++ b/arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4.dts -@@ -452,7 +452,7 @@ - status = "okay"; - - bt656-supply = <&vcc_3v0>; -- audio-supply = <&vcc_3v0>; -+ audio-supply = <&vcc1v8_codec>; - sdmmc-supply = <&vcc_sdio>; - gpio1830-supply = <&vcc_3v0>; - }; -diff --git a/arch/s390/kernel/machine_kexec_file.c b/arch/s390/kernel/machine_kexec_file.c -index e7435f3a3d2d2..76cd09879eaf4 100644 ---- a/arch/s390/kernel/machine_kexec_file.c -+++ b/arch/s390/kernel/machine_kexec_file.c -@@ -277,6 +277,7 @@ int arch_kexec_apply_relocations_add(struct purgatory_info *pi, - { - Elf_Rela *relas; - int i, r_type; -+ int ret; - - relas = (void *)pi->ehdr + relsec->sh_offset; - -@@ -311,7 +312,11 @@ int arch_kexec_apply_relocations_add(struct purgatory_info *pi, - addr = section->sh_addr + relas[i].r_offset; - - r_type = ELF64_R_TYPE(relas[i].r_info); -- arch_kexec_do_relocs(r_type, loc, val, addr); -+ ret = arch_kexec_do_relocs(r_type, loc, val, addr); -+ if (ret) { -+ pr_err("Unknown rela relocation: %d\n", r_type); -+ return -ENOEXEC; -+ } - } - return 0; - } -diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c -index 464efedc778b0..2b247014ba452 100644 ---- a/drivers/ata/libata-scsi.c -+++ b/drivers/ata/libata-scsi.c -@@ -3164,8 +3164,19 @@ static unsigned int ata_scsi_pass_thru(struct ata_queued_cmd *qc) - goto invalid_fld; - } - -- if (ata_is_ncq(tf->protocol) && (cdb[2 + cdb_offset] & 0x3) == 0) -- tf->protocol = ATA_PROT_NCQ_NODATA; -+ if ((cdb[2 + cdb_offset] & 0x3) == 0) { -+ /* -+ * When T_LENGTH is zero (No data is transferred), dir should -+ * be DMA_NONE. -+ */ -+ if (scmd->sc_data_direction != DMA_NONE) { -+ fp = 2 + cdb_offset; -+ goto invalid_fld; -+ } -+ -+ if (ata_is_ncq(tf->protocol)) -+ tf->protocol = ATA_PROT_NCQ_NODATA; -+ } - - /* enable LBA */ - tf->flags |= ATA_TFLAG_LBA; -diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c -index baf10b73675e2..774af5ce70dad 100644 ---- a/drivers/block/xen-blkfront.c -+++ b/drivers/block/xen-blkfront.c -@@ -1565,9 +1565,12 @@ static irqreturn_t blkif_interrupt(int irq, void *dev_id) - unsigned long flags; - struct blkfront_ring_info *rinfo = (struct blkfront_ring_info *)dev_id; - struct blkfront_info *info = rinfo->dev_info; -+ unsigned int eoiflag = XEN_EOI_FLAG_SPURIOUS; - -- if (unlikely(info->connected != BLKIF_STATE_CONNECTED)) -+ if (unlikely(info->connected != BLKIF_STATE_CONNECTED)) { -+ xen_irq_lateeoi(irq, XEN_EOI_FLAG_SPURIOUS); - return IRQ_HANDLED; -+ } - - spin_lock_irqsave(&rinfo->ring_lock, flags); - again: -@@ -1583,6 +1586,8 @@ static irqreturn_t blkif_interrupt(int irq, void *dev_id) - unsigned long id; - unsigned int op; - -+ eoiflag = 0; -+ - RING_COPY_RESPONSE(&rinfo->ring, i, &bret); - id = bret.id; - -@@ -1698,6 +1703,8 @@ static irqreturn_t blkif_interrupt(int irq, void *dev_id) - - spin_unlock_irqrestore(&rinfo->ring_lock, flags); - -+ xen_irq_lateeoi(irq, eoiflag); -+ - return IRQ_HANDLED; - - err: -@@ -1705,6 +1712,8 @@ static irqreturn_t blkif_interrupt(int irq, void *dev_id) - - spin_unlock_irqrestore(&rinfo->ring_lock, flags); - -+ /* No EOI in order to avoid further interrupts. */ -+ - pr_alert("%s disabled for further use\n", info->gd->disk_name); - return IRQ_HANDLED; - } -@@ -1744,8 +1753,8 @@ static int setup_blkring(struct xenbus_device *dev, - if (err) - goto fail; - -- err = bind_evtchn_to_irqhandler(rinfo->evtchn, blkif_interrupt, 0, -- "blkif", rinfo); -+ err = bind_evtchn_to_irqhandler_lateeoi(rinfo->evtchn, blkif_interrupt, -+ 0, "blkif", rinfo); - if (err <= 0) { - xenbus_dev_fatal(dev, err, - "bind_evtchn_to_irqhandler failed"); -diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c -index 6ff87cd867121..e4e1b4e94a67b 100644 ---- a/drivers/clk/clk.c -+++ b/drivers/clk/clk.c -@@ -3299,6 +3299,14 @@ static int __clk_core_init(struct clk_core *core) - - clk_prepare_lock(); - -+ /* -+ * Set hw->core after grabbing the prepare_lock to synchronize with -+ * callers of clk_core_fill_parent_index() where we treat hw->core -+ * being NULL as the clk not being registered yet. This is crucial so -+ * that clks aren't parented until their parent is fully registered. -+ */ -+ core->hw->core = core; -+ - ret = clk_pm_runtime_get(core); - if (ret) - goto unlock; -@@ -3452,8 +3460,10 @@ static int __clk_core_init(struct clk_core *core) - out: - clk_pm_runtime_put(core); - unlock: -- if (ret) -+ if (ret) { - hlist_del_init(&core->child_node); -+ core->hw->core = NULL; -+ } - - clk_prepare_unlock(); - -@@ -3699,7 +3709,6 @@ __clk_register(struct device *dev, struct device_node *np, struct clk_hw *hw) - core->num_parents = init->num_parents; - core->min_rate = 0; - core->max_rate = ULONG_MAX; -- hw->core = core; - - ret = clk_core_populate_parent_map(core, init); - if (ret) -@@ -3717,7 +3726,7 @@ __clk_register(struct device *dev, struct device_node *np, struct clk_hw *hw) - goto fail_create_clk; - } - -- clk_core_link_consumer(hw->core, hw->clk); -+ clk_core_link_consumer(core, hw->clk); - - ret = __clk_core_init(core); - if (!ret) -diff --git a/drivers/dma/st_fdma.c b/drivers/dma/st_fdma.c -index 67087dbe2f9fa..f7393c19a1ba3 100644 ---- a/drivers/dma/st_fdma.c -+++ b/drivers/dma/st_fdma.c -@@ -873,4 +873,4 @@ MODULE_LICENSE("GPL v2"); - MODULE_DESCRIPTION("STMicroelectronics FDMA engine driver"); - MODULE_AUTHOR("Ludovic.barre "); - MODULE_AUTHOR("Peter Griffin "); --MODULE_ALIAS("platform: " DRIVER_NAME); -+MODULE_ALIAS("platform:" DRIVER_NAME); -diff --git a/drivers/firmware/scpi_pm_domain.c b/drivers/firmware/scpi_pm_domain.c -index 51201600d789b..800673910b511 100644 ---- a/drivers/firmware/scpi_pm_domain.c -+++ b/drivers/firmware/scpi_pm_domain.c -@@ -16,7 +16,6 @@ struct scpi_pm_domain { - struct generic_pm_domain genpd; - struct scpi_ops *ops; - u32 domain; -- char name[30]; - }; - - /* -@@ -110,8 +109,13 @@ static int scpi_pm_domain_probe(struct platform_device *pdev) - - scpi_pd->domain = i; - scpi_pd->ops = scpi_ops; -- sprintf(scpi_pd->name, "%pOFn.%d", np, i); -- scpi_pd->genpd.name = scpi_pd->name; -+ scpi_pd->genpd.name = devm_kasprintf(dev, GFP_KERNEL, -+ "%pOFn.%d", np, i); -+ if (!scpi_pd->genpd.name) { -+ dev_err(dev, "Failed to allocate genpd name:%pOFn.%d\n", -+ np, i); -+ continue; -+ } - scpi_pd->genpd.power_off = scpi_pd_power_off; - scpi_pd->genpd.power_on = scpi_pd_power_on; - -diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c -index 06cdc22b5501d..5906a8951a6c6 100644 ---- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c -+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c -@@ -2906,8 +2906,8 @@ static void gfx_v9_0_init_pg(struct amdgpu_device *adev) - AMD_PG_SUPPORT_CP | - AMD_PG_SUPPORT_GDS | - AMD_PG_SUPPORT_RLC_SMU_HS)) { -- WREG32(mmRLC_JUMP_TABLE_RESTORE, -- adev->gfx.rlc.cp_table_gpu_addr >> 8); -+ WREG32_SOC15(GC, 0, mmRLC_JUMP_TABLE_RESTORE, -+ adev->gfx.rlc.cp_table_gpu_addr >> 8); - gfx_v9_0_init_gfx_power_gating(adev); - } - } -diff --git a/drivers/iio/adc/stm32-adc.c b/drivers/iio/adc/stm32-adc.c -index 94fde39d9ff7a..d1bbd2b197fc6 100644 ---- a/drivers/iio/adc/stm32-adc.c -+++ b/drivers/iio/adc/stm32-adc.c -@@ -933,6 +933,7 @@ pwr_dwn: - - static void stm32h7_adc_unprepare(struct stm32_adc *adc) - { -+ stm32_adc_writel(adc, STM32H7_ADC_PCSEL, 0); - stm32h7_adc_disable(adc); - stm32h7_adc_enter_pwr_down(adc); - } -diff --git a/drivers/input/touchscreen/of_touchscreen.c b/drivers/input/touchscreen/of_touchscreen.c -index e16ec4c7043a4..2962c3747adc3 100644 ---- a/drivers/input/touchscreen/of_touchscreen.c -+++ b/drivers/input/touchscreen/of_touchscreen.c -@@ -81,8 +81,8 @@ void touchscreen_parse_properties(struct input_dev *input, bool multitouch, - touchscreen_get_prop_u32(dev, "touchscreen-size-x", - input_abs_get_max(input, - axis) + 1, -- &maximum) | -- touchscreen_get_prop_u32(dev, "touchscreen-fuzz-x", -+ &maximum); -+ data_present |= touchscreen_get_prop_u32(dev, "touchscreen-fuzz-x", - input_abs_get_fuzz(input, axis), - &fuzz); - if (data_present) -@@ -95,8 +95,8 @@ void touchscreen_parse_properties(struct input_dev *input, bool multitouch, - touchscreen_get_prop_u32(dev, "touchscreen-size-y", - input_abs_get_max(input, - axis) + 1, -- &maximum) | -- touchscreen_get_prop_u32(dev, "touchscreen-fuzz-y", -+ &maximum); -+ data_present |= touchscreen_get_prop_u32(dev, "touchscreen-fuzz-y", - input_abs_get_fuzz(input, axis), - &fuzz); - if (data_present) -@@ -106,11 +106,11 @@ void touchscreen_parse_properties(struct input_dev *input, bool multitouch, - data_present = touchscreen_get_prop_u32(dev, - "touchscreen-max-pressure", - input_abs_get_max(input, axis), -- &maximum) | -- touchscreen_get_prop_u32(dev, -- "touchscreen-fuzz-pressure", -- input_abs_get_fuzz(input, axis), -- &fuzz); -+ &maximum); -+ data_present |= touchscreen_get_prop_u32(dev, -+ "touchscreen-fuzz-pressure", -+ input_abs_get_fuzz(input, axis), -+ &fuzz); - if (data_present) - touchscreen_set_params(input, axis, 0, maximum, fuzz); - -diff --git a/drivers/md/persistent-data/dm-btree-remove.c b/drivers/md/persistent-data/dm-btree-remove.c -index 9e4d1212f4c16..63f2baed3c8a6 100644 ---- a/drivers/md/persistent-data/dm-btree-remove.c -+++ b/drivers/md/persistent-data/dm-btree-remove.c -@@ -423,9 +423,9 @@ static int rebalance_children(struct shadow_spine *s, - - memcpy(n, dm_block_data(child), - dm_bm_block_size(dm_tm_get_bm(info->tm))); -- dm_tm_unlock(info->tm, child); - - dm_tm_dec(info->tm, dm_block_location(child)); -+ dm_tm_unlock(info->tm, child); - return 0; - } - -diff --git a/drivers/media/usb/dvb-usb-v2/mxl111sf.c b/drivers/media/usb/dvb-usb-v2/mxl111sf.c -index 55b4ae7037a4e..5fbce81b64c77 100644 ---- a/drivers/media/usb/dvb-usb-v2/mxl111sf.c -+++ b/drivers/media/usb/dvb-usb-v2/mxl111sf.c -@@ -931,8 +931,6 @@ static int mxl111sf_init(struct dvb_usb_device *d) - .len = sizeof(eeprom), .buf = eeprom }, - }; - -- mutex_init(&state->msg_lock); -- - ret = get_chip_info(state); - if (mxl_fail(ret)) - pr_err("failed to get chip info during probe"); -@@ -1074,6 +1072,14 @@ static int mxl111sf_get_stream_config_dvbt(struct dvb_frontend *fe, - return 0; - } - -+static int mxl111sf_probe(struct dvb_usb_device *dev) -+{ -+ struct mxl111sf_state *state = d_to_priv(dev); -+ -+ mutex_init(&state->msg_lock); -+ return 0; -+} -+ - static struct dvb_usb_device_properties mxl111sf_props_dvbt = { - .driver_name = KBUILD_MODNAME, - .owner = THIS_MODULE, -@@ -1083,6 +1089,7 @@ static struct dvb_usb_device_properties mxl111sf_props_dvbt = { - .generic_bulk_ctrl_endpoint = 0x02, - .generic_bulk_ctrl_endpoint_response = 0x81, - -+ .probe = mxl111sf_probe, - .i2c_algo = &mxl111sf_i2c_algo, - .frontend_attach = mxl111sf_frontend_attach_dvbt, - .tuner_attach = mxl111sf_attach_tuner, -@@ -1124,6 +1131,7 @@ static struct dvb_usb_device_properties mxl111sf_props_atsc = { - .generic_bulk_ctrl_endpoint = 0x02, - .generic_bulk_ctrl_endpoint_response = 0x81, - -+ .probe = mxl111sf_probe, - .i2c_algo = &mxl111sf_i2c_algo, - .frontend_attach = mxl111sf_frontend_attach_atsc, - .tuner_attach = mxl111sf_attach_tuner, -@@ -1165,6 +1173,7 @@ static struct dvb_usb_device_properties mxl111sf_props_mh = { - .generic_bulk_ctrl_endpoint = 0x02, - .generic_bulk_ctrl_endpoint_response = 0x81, - -+ .probe = mxl111sf_probe, - .i2c_algo = &mxl111sf_i2c_algo, - .frontend_attach = mxl111sf_frontend_attach_mh, - .tuner_attach = mxl111sf_attach_tuner, -@@ -1233,6 +1242,7 @@ static struct dvb_usb_device_properties mxl111sf_props_atsc_mh = { - .generic_bulk_ctrl_endpoint = 0x02, - .generic_bulk_ctrl_endpoint_response = 0x81, - -+ .probe = mxl111sf_probe, - .i2c_algo = &mxl111sf_i2c_algo, - .frontend_attach = mxl111sf_frontend_attach_atsc_mh, - .tuner_attach = mxl111sf_attach_tuner, -@@ -1311,6 +1321,7 @@ static struct dvb_usb_device_properties mxl111sf_props_mercury = { - .generic_bulk_ctrl_endpoint = 0x02, - .generic_bulk_ctrl_endpoint_response = 0x81, - -+ .probe = mxl111sf_probe, - .i2c_algo = &mxl111sf_i2c_algo, - .frontend_attach = mxl111sf_frontend_attach_mercury, - .tuner_attach = mxl111sf_attach_tuner, -@@ -1381,6 +1392,7 @@ static struct dvb_usb_device_properties mxl111sf_props_mercury_mh = { - .generic_bulk_ctrl_endpoint = 0x02, - .generic_bulk_ctrl_endpoint_response = 0x81, - -+ .probe = mxl111sf_probe, - .i2c_algo = &mxl111sf_i2c_algo, - .frontend_attach = mxl111sf_frontend_attach_mercury_mh, - .tuner_attach = mxl111sf_attach_tuner, -diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c -index 470d12e308814..5a2094a281e15 100644 ---- a/drivers/net/ethernet/broadcom/bcmsysport.c -+++ b/drivers/net/ethernet/broadcom/bcmsysport.c -@@ -1277,11 +1277,11 @@ static netdev_tx_t bcm_sysport_xmit(struct sk_buff *skb, - struct bcm_sysport_priv *priv = netdev_priv(dev); - struct device *kdev = &priv->pdev->dev; - struct bcm_sysport_tx_ring *ring; -+ unsigned long flags, desc_flags; - struct bcm_sysport_cb *cb; - struct netdev_queue *txq; - u32 len_status, addr_lo; - unsigned int skb_len; -- unsigned long flags; - dma_addr_t mapping; - u16 queue; - int ret; -@@ -1339,8 +1339,10 @@ static netdev_tx_t bcm_sysport_xmit(struct sk_buff *skb, - ring->desc_count--; - - /* Ports are latched, so write upper address first */ -+ spin_lock_irqsave(&priv->desc_lock, desc_flags); - tdma_writel(priv, len_status, TDMA_WRITE_PORT_HI(ring->index)); - tdma_writel(priv, addr_lo, TDMA_WRITE_PORT_LO(ring->index)); -+ spin_unlock_irqrestore(&priv->desc_lock, desc_flags); - - /* Check ring space and update SW control flow */ - if (ring->desc_count == 0) -@@ -1970,6 +1972,7 @@ static int bcm_sysport_open(struct net_device *dev) - } - - /* Initialize both hardware and software ring */ -+ spin_lock_init(&priv->desc_lock); - for (i = 0; i < dev->num_tx_queues; i++) { - ret = bcm_sysport_init_tx_ring(priv, i); - if (ret) { -diff --git a/drivers/net/ethernet/broadcom/bcmsysport.h b/drivers/net/ethernet/broadcom/bcmsysport.h -index 6d80735fbc7f4..57336ca3f4277 100644 ---- a/drivers/net/ethernet/broadcom/bcmsysport.h -+++ b/drivers/net/ethernet/broadcom/bcmsysport.h -@@ -742,6 +742,7 @@ struct bcm_sysport_priv { - int wol_irq; - - /* Transmit rings */ -+ spinlock_t desc_lock; - struct bcm_sysport_tx_ring *tx_rings; - - /* Receive queue */ -diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c -index c11244a9b7e69..3df25b231ab5c 100644 ---- a/drivers/net/ethernet/intel/igb/igb_main.c -+++ b/drivers/net/ethernet/intel/igb/igb_main.c -@@ -7374,6 +7374,20 @@ static int igb_set_vf_mac_filter(struct igb_adapter *adapter, const int vf, - struct vf_mac_filter *entry = NULL; - int ret = 0; - -+ if ((vf_data->flags & IGB_VF_FLAG_PF_SET_MAC) && -+ !vf_data->trusted) { -+ dev_warn(&pdev->dev, -+ "VF %d requested MAC filter but is administratively denied\n", -+ vf); -+ return -EINVAL; -+ } -+ if (!is_valid_ether_addr(addr)) { -+ dev_warn(&pdev->dev, -+ "VF %d attempted to set invalid MAC filter\n", -+ vf); -+ return -EINVAL; -+ } -+ - switch (info) { - case E1000_VF_MAC_FILTER_CLR: - /* remove all unicast MAC filters related to the current VF */ -@@ -7387,20 +7401,6 @@ static int igb_set_vf_mac_filter(struct igb_adapter *adapter, const int vf, - } - break; - case E1000_VF_MAC_FILTER_ADD: -- if ((vf_data->flags & IGB_VF_FLAG_PF_SET_MAC) && -- !vf_data->trusted) { -- dev_warn(&pdev->dev, -- "VF %d requested MAC filter but is administratively denied\n", -- vf); -- return -EINVAL; -- } -- if (!is_valid_ether_addr(addr)) { -- dev_warn(&pdev->dev, -- "VF %d attempted to set invalid MAC filter\n", -- vf); -- return -EINVAL; -- } -- - /* try to find empty slot in the list */ - list_for_each(pos, &adapter->vf_macs.l) { - entry = list_entry(pos, struct vf_mac_filter, l); -diff --git a/drivers/net/ethernet/intel/igbvf/netdev.c b/drivers/net/ethernet/intel/igbvf/netdev.c -index 77cb2ab7dab40..1082e49ea0560 100644 ---- a/drivers/net/ethernet/intel/igbvf/netdev.c -+++ b/drivers/net/ethernet/intel/igbvf/netdev.c -@@ -2887,6 +2887,7 @@ static int igbvf_probe(struct pci_dev *pdev, const struct pci_device_id *ent) - return 0; - - err_hw_init: -+ netif_napi_del(&adapter->rx_ring->napi); - kfree(adapter->tx_ring); - kfree(adapter->rx_ring); - err_sw_init: -diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c -index 9c42f741ed5ef..74728c0a44a81 100644 ---- a/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c -+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c -@@ -3405,6 +3405,9 @@ static s32 ixgbe_reset_hw_X550em(struct ixgbe_hw *hw) - /* flush pending Tx transactions */ - ixgbe_clear_tx_pending(hw); - -+ /* set MDIO speed before talking to the PHY in case it's the 1st time */ -+ ixgbe_set_mdio_speed(hw); -+ - /* PHY ops must be identified and initialized prior to reset */ - status = hw->phy.ops.init(hw); - if (status == IXGBE_ERR_SFP_NOT_SUPPORTED || -diff --git a/drivers/net/netdevsim/bpf.c b/drivers/net/netdevsim/bpf.c -index 2b74425822ab1..e0a4acc6144bf 100644 ---- a/drivers/net/netdevsim/bpf.c -+++ b/drivers/net/netdevsim/bpf.c -@@ -510,6 +510,7 @@ nsim_bpf_map_alloc(struct netdevsim *ns, struct bpf_offloaded_map *offmap) - goto err_free; - key = nmap->entry[i].key; - *key = i; -+ memset(nmap->entry[i].value, 0, offmap->map.value_size); - } - } - -diff --git a/drivers/net/wireless/marvell/mwifiex/cmdevt.c b/drivers/net/wireless/marvell/mwifiex/cmdevt.c -index e8788c35a453d..ec04515bd9dfa 100644 ---- a/drivers/net/wireless/marvell/mwifiex/cmdevt.c -+++ b/drivers/net/wireless/marvell/mwifiex/cmdevt.c -@@ -322,9 +322,9 @@ static int mwifiex_dnld_sleep_confirm_cmd(struct mwifiex_adapter *adapter) - - adapter->seq_num++; - sleep_cfm_buf->seq_num = -- cpu_to_le16((HostCmd_SET_SEQ_NO_BSS_INFO -+ cpu_to_le16(HostCmd_SET_SEQ_NO_BSS_INFO - (adapter->seq_num, priv->bss_num, -- priv->bss_type))); -+ priv->bss_type)); - - mwifiex_dbg(adapter, CMD, - "cmd: DNLD_CMD: %#x, act %#x, len %d, seqno %#x\n", -diff --git a/drivers/net/wireless/marvell/mwifiex/fw.h b/drivers/net/wireless/marvell/mwifiex/fw.h -index 8b9d0809daf62..076ea1c4b921d 100644 ---- a/drivers/net/wireless/marvell/mwifiex/fw.h -+++ b/drivers/net/wireless/marvell/mwifiex/fw.h -@@ -512,10 +512,10 @@ enum mwifiex_channel_flags { - - #define RF_ANTENNA_AUTO 0xFFFF - --#define HostCmd_SET_SEQ_NO_BSS_INFO(seq, num, type) { \ -- (((seq) & 0x00ff) | \ -- (((num) & 0x000f) << 8)) | \ -- (((type) & 0x000f) << 12); } -+#define HostCmd_SET_SEQ_NO_BSS_INFO(seq, num, type) \ -+ ((((seq) & 0x00ff) | \ -+ (((num) & 0x000f) << 8)) | \ -+ (((type) & 0x000f) << 12)) - - #define HostCmd_GET_SEQ_NO(seq) \ - ((seq) & HostCmd_SEQ_NUM_MASK) -diff --git a/drivers/net/xen-netback/common.h b/drivers/net/xen-netback/common.h -index 32fe131ba366d..f7e746f1c9fb3 100644 ---- a/drivers/net/xen-netback/common.h -+++ b/drivers/net/xen-netback/common.h -@@ -203,6 +203,7 @@ struct xenvif_queue { /* Per-queue data for xenvif */ - unsigned int rx_queue_max; - unsigned int rx_queue_len; - unsigned long last_rx_time; -+ unsigned int rx_slots_needed; - bool stalled; - - struct xenvif_copy_state rx_copy; -diff --git a/drivers/net/xen-netback/rx.c b/drivers/net/xen-netback/rx.c -index 48e2006f96ce6..7f68067c01745 100644 ---- a/drivers/net/xen-netback/rx.c -+++ b/drivers/net/xen-netback/rx.c -@@ -33,28 +33,36 @@ - #include - #include - --static bool xenvif_rx_ring_slots_available(struct xenvif_queue *queue) -+/* -+ * Update the needed ring page slots for the first SKB queued. -+ * Note that any call sequence outside the RX thread calling this function -+ * needs to wake up the RX thread via a call of xenvif_kick_thread() -+ * afterwards in order to avoid a race with putting the thread to sleep. -+ */ -+static void xenvif_update_needed_slots(struct xenvif_queue *queue, -+ const struct sk_buff *skb) - { -- RING_IDX prod, cons; -- struct sk_buff *skb; -- int needed; -- unsigned long flags; -- -- spin_lock_irqsave(&queue->rx_queue.lock, flags); -+ unsigned int needed = 0; - -- skb = skb_peek(&queue->rx_queue); -- if (!skb) { -- spin_unlock_irqrestore(&queue->rx_queue.lock, flags); -- return false; -+ if (skb) { -+ needed = DIV_ROUND_UP(skb->len, XEN_PAGE_SIZE); -+ if (skb_is_gso(skb)) -+ needed++; -+ if (skb->sw_hash) -+ needed++; - } - -- needed = DIV_ROUND_UP(skb->len, XEN_PAGE_SIZE); -- if (skb_is_gso(skb)) -- needed++; -- if (skb->sw_hash) -- needed++; -+ WRITE_ONCE(queue->rx_slots_needed, needed); -+} - -- spin_unlock_irqrestore(&queue->rx_queue.lock, flags); -+static bool xenvif_rx_ring_slots_available(struct xenvif_queue *queue) -+{ -+ RING_IDX prod, cons; -+ unsigned int needed; -+ -+ needed = READ_ONCE(queue->rx_slots_needed); -+ if (!needed) -+ return false; - - do { - prod = queue->rx.sring->req_prod; -@@ -80,13 +88,19 @@ void xenvif_rx_queue_tail(struct xenvif_queue *queue, struct sk_buff *skb) - - spin_lock_irqsave(&queue->rx_queue.lock, flags); - -- __skb_queue_tail(&queue->rx_queue, skb); -- -- queue->rx_queue_len += skb->len; -- if (queue->rx_queue_len > queue->rx_queue_max) { -+ if (queue->rx_queue_len >= queue->rx_queue_max) { - struct net_device *dev = queue->vif->dev; - - netif_tx_stop_queue(netdev_get_tx_queue(dev, queue->id)); -+ kfree_skb(skb); -+ queue->vif->dev->stats.rx_dropped++; -+ } else { -+ if (skb_queue_empty(&queue->rx_queue)) -+ xenvif_update_needed_slots(queue, skb); -+ -+ __skb_queue_tail(&queue->rx_queue, skb); -+ -+ queue->rx_queue_len += skb->len; - } - - spin_unlock_irqrestore(&queue->rx_queue.lock, flags); -@@ -100,6 +114,8 @@ static struct sk_buff *xenvif_rx_dequeue(struct xenvif_queue *queue) - - skb = __skb_dequeue(&queue->rx_queue); - if (skb) { -+ xenvif_update_needed_slots(queue, skb_peek(&queue->rx_queue)); -+ - queue->rx_queue_len -= skb->len; - if (queue->rx_queue_len < queue->rx_queue_max) { - struct netdev_queue *txq; -@@ -134,6 +150,7 @@ static void xenvif_rx_queue_drop_expired(struct xenvif_queue *queue) - break; - xenvif_rx_dequeue(queue); - kfree_skb(skb); -+ queue->vif->dev->stats.rx_dropped++; - } - } - -@@ -474,27 +491,31 @@ void xenvif_rx_action(struct xenvif_queue *queue) - xenvif_rx_copy_flush(queue); - } - --static bool xenvif_rx_queue_stalled(struct xenvif_queue *queue) -+static RING_IDX xenvif_rx_queue_slots(const struct xenvif_queue *queue) - { - RING_IDX prod, cons; - - prod = queue->rx.sring->req_prod; - cons = queue->rx.req_cons; - -+ return prod - cons; -+} -+ -+static bool xenvif_rx_queue_stalled(const struct xenvif_queue *queue) -+{ -+ unsigned int needed = READ_ONCE(queue->rx_slots_needed); -+ - return !queue->stalled && -- prod - cons < 1 && -+ xenvif_rx_queue_slots(queue) < needed && - time_after(jiffies, - queue->last_rx_time + queue->vif->stall_timeout); - } - - static bool xenvif_rx_queue_ready(struct xenvif_queue *queue) - { -- RING_IDX prod, cons; -- -- prod = queue->rx.sring->req_prod; -- cons = queue->rx.req_cons; -+ unsigned int needed = READ_ONCE(queue->rx_slots_needed); - -- return queue->stalled && prod - cons >= 1; -+ return queue->stalled && xenvif_rx_queue_slots(queue) >= needed; - } - - bool xenvif_have_rx_work(struct xenvif_queue *queue, bool test_kthread) -diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c -index d6f44343213cc..d2b3381f71825 100644 ---- a/drivers/net/xen-netfront.c -+++ b/drivers/net/xen-netfront.c -@@ -142,6 +142,9 @@ struct netfront_queue { - struct sk_buff *rx_skbs[NET_RX_RING_SIZE]; - grant_ref_t gref_rx_head; - grant_ref_t grant_rx_ref[NET_RX_RING_SIZE]; -+ -+ unsigned int rx_rsp_unconsumed; -+ spinlock_t rx_cons_lock; - }; - - struct netfront_info { -@@ -364,12 +367,13 @@ static int xennet_open(struct net_device *dev) - return 0; - } - --static void xennet_tx_buf_gc(struct netfront_queue *queue) -+static bool xennet_tx_buf_gc(struct netfront_queue *queue) - { - RING_IDX cons, prod; - unsigned short id; - struct sk_buff *skb; - bool more_to_do; -+ bool work_done = false; - const struct device *dev = &queue->info->netdev->dev; - - BUG_ON(!netif_carrier_ok(queue->info->netdev)); -@@ -386,6 +390,8 @@ static void xennet_tx_buf_gc(struct netfront_queue *queue) - for (cons = queue->tx.rsp_cons; cons != prod; cons++) { - struct xen_netif_tx_response txrsp; - -+ work_done = true; -+ - RING_COPY_RESPONSE(&queue->tx, cons, &txrsp); - if (txrsp.status == XEN_NETIF_RSP_NULL) - continue; -@@ -429,11 +435,13 @@ static void xennet_tx_buf_gc(struct netfront_queue *queue) - - xennet_maybe_wake_tx(queue); - -- return; -+ return work_done; - - err: - queue->info->broken = true; - dev_alert(dev, "Disabled for further use\n"); -+ -+ return work_done; - } - - struct xennet_gnttab_make_txreq { -@@ -753,6 +761,16 @@ static int xennet_close(struct net_device *dev) - return 0; - } - -+static void xennet_set_rx_rsp_cons(struct netfront_queue *queue, RING_IDX val) -+{ -+ unsigned long flags; -+ -+ spin_lock_irqsave(&queue->rx_cons_lock, flags); -+ queue->rx.rsp_cons = val; -+ queue->rx_rsp_unconsumed = RING_HAS_UNCONSUMED_RESPONSES(&queue->rx); -+ spin_unlock_irqrestore(&queue->rx_cons_lock, flags); -+} -+ - static void xennet_move_rx_slot(struct netfront_queue *queue, struct sk_buff *skb, - grant_ref_t ref) - { -@@ -804,7 +822,7 @@ static int xennet_get_extras(struct netfront_queue *queue, - xennet_move_rx_slot(queue, skb, ref); - } while (extra.flags & XEN_NETIF_EXTRA_FLAG_MORE); - -- queue->rx.rsp_cons = cons; -+ xennet_set_rx_rsp_cons(queue, cons); - return err; - } - -@@ -884,7 +902,7 @@ next: - } - - if (unlikely(err)) -- queue->rx.rsp_cons = cons + slots; -+ xennet_set_rx_rsp_cons(queue, cons + slots); - - return err; - } -@@ -938,7 +956,8 @@ static int xennet_fill_frags(struct netfront_queue *queue, - __pskb_pull_tail(skb, pull_to - skb_headlen(skb)); - } - if (unlikely(skb_shinfo(skb)->nr_frags >= MAX_SKB_FRAGS)) { -- queue->rx.rsp_cons = ++cons + skb_queue_len(list); -+ xennet_set_rx_rsp_cons(queue, -+ ++cons + skb_queue_len(list)); - kfree_skb(nskb); - return -ENOENT; - } -@@ -951,7 +970,7 @@ static int xennet_fill_frags(struct netfront_queue *queue, - kfree_skb(nskb); - } - -- queue->rx.rsp_cons = cons; -+ xennet_set_rx_rsp_cons(queue, cons); - - return 0; - } -@@ -1072,7 +1091,9 @@ err: - - if (unlikely(xennet_set_skb_gso(skb, gso))) { - __skb_queue_head(&tmpq, skb); -- queue->rx.rsp_cons += skb_queue_len(&tmpq); -+ xennet_set_rx_rsp_cons(queue, -+ queue->rx.rsp_cons + -+ skb_queue_len(&tmpq)); - goto err; - } - } -@@ -1096,7 +1117,8 @@ err: - - __skb_queue_tail(&rxq, skb); - -- i = ++queue->rx.rsp_cons; -+ i = queue->rx.rsp_cons + 1; -+ xennet_set_rx_rsp_cons(queue, i); - work_done++; - } - -@@ -1258,40 +1280,79 @@ static int xennet_set_features(struct net_device *dev, - return 0; - } - --static irqreturn_t xennet_tx_interrupt(int irq, void *dev_id) -+static bool xennet_handle_tx(struct netfront_queue *queue, unsigned int *eoi) - { -- struct netfront_queue *queue = dev_id; - unsigned long flags; - -- if (queue->info->broken) -- return IRQ_HANDLED; -+ if (unlikely(queue->info->broken)) -+ return false; - - spin_lock_irqsave(&queue->tx_lock, flags); -- xennet_tx_buf_gc(queue); -+ if (xennet_tx_buf_gc(queue)) -+ *eoi = 0; - spin_unlock_irqrestore(&queue->tx_lock, flags); - -+ return true; -+} -+ -+static irqreturn_t xennet_tx_interrupt(int irq, void *dev_id) -+{ -+ unsigned int eoiflag = XEN_EOI_FLAG_SPURIOUS; -+ -+ if (likely(xennet_handle_tx(dev_id, &eoiflag))) -+ xen_irq_lateeoi(irq, eoiflag); -+ - return IRQ_HANDLED; - } - --static irqreturn_t xennet_rx_interrupt(int irq, void *dev_id) -+static bool xennet_handle_rx(struct netfront_queue *queue, unsigned int *eoi) - { -- struct netfront_queue *queue = dev_id; -- struct net_device *dev = queue->info->netdev; -+ unsigned int work_queued; -+ unsigned long flags; - -- if (queue->info->broken) -- return IRQ_HANDLED; -+ if (unlikely(queue->info->broken)) -+ return false; -+ -+ spin_lock_irqsave(&queue->rx_cons_lock, flags); -+ work_queued = RING_HAS_UNCONSUMED_RESPONSES(&queue->rx); -+ if (work_queued > queue->rx_rsp_unconsumed) { -+ queue->rx_rsp_unconsumed = work_queued; -+ *eoi = 0; -+ } else if (unlikely(work_queued < queue->rx_rsp_unconsumed)) { -+ const struct device *dev = &queue->info->netdev->dev; -+ -+ spin_unlock_irqrestore(&queue->rx_cons_lock, flags); -+ dev_alert(dev, "RX producer index going backwards\n"); -+ dev_alert(dev, "Disabled for further use\n"); -+ queue->info->broken = true; -+ return false; -+ } -+ spin_unlock_irqrestore(&queue->rx_cons_lock, flags); - -- if (likely(netif_carrier_ok(dev) && -- RING_HAS_UNCONSUMED_RESPONSES(&queue->rx))) -+ if (likely(netif_carrier_ok(queue->info->netdev) && work_queued)) - napi_schedule(&queue->napi); - -+ return true; -+} -+ -+static irqreturn_t xennet_rx_interrupt(int irq, void *dev_id) -+{ -+ unsigned int eoiflag = XEN_EOI_FLAG_SPURIOUS; -+ -+ if (likely(xennet_handle_rx(dev_id, &eoiflag))) -+ xen_irq_lateeoi(irq, eoiflag); -+ - return IRQ_HANDLED; - } - - static irqreturn_t xennet_interrupt(int irq, void *dev_id) - { -- xennet_tx_interrupt(irq, dev_id); -- xennet_rx_interrupt(irq, dev_id); -+ unsigned int eoiflag = XEN_EOI_FLAG_SPURIOUS; -+ -+ if (xennet_handle_tx(dev_id, &eoiflag) && -+ xennet_handle_rx(dev_id, &eoiflag)) -+ xen_irq_lateeoi(irq, eoiflag); -+ - return IRQ_HANDLED; - } - -@@ -1525,9 +1586,10 @@ static int setup_netfront_single(struct netfront_queue *queue) - if (err < 0) - goto fail; - -- err = bind_evtchn_to_irqhandler(queue->tx_evtchn, -- xennet_interrupt, -- 0, queue->info->netdev->name, queue); -+ err = bind_evtchn_to_irqhandler_lateeoi(queue->tx_evtchn, -+ xennet_interrupt, 0, -+ queue->info->netdev->name, -+ queue); - if (err < 0) - goto bind_fail; - queue->rx_evtchn = queue->tx_evtchn; -@@ -1555,18 +1617,18 @@ static int setup_netfront_split(struct netfront_queue *queue) - - snprintf(queue->tx_irq_name, sizeof(queue->tx_irq_name), - "%s-tx", queue->name); -- err = bind_evtchn_to_irqhandler(queue->tx_evtchn, -- xennet_tx_interrupt, -- 0, queue->tx_irq_name, queue); -+ err = bind_evtchn_to_irqhandler_lateeoi(queue->tx_evtchn, -+ xennet_tx_interrupt, 0, -+ queue->tx_irq_name, queue); - if (err < 0) - goto bind_tx_fail; - queue->tx_irq = err; - - snprintf(queue->rx_irq_name, sizeof(queue->rx_irq_name), - "%s-rx", queue->name); -- err = bind_evtchn_to_irqhandler(queue->rx_evtchn, -- xennet_rx_interrupt, -- 0, queue->rx_irq_name, queue); -+ err = bind_evtchn_to_irqhandler_lateeoi(queue->rx_evtchn, -+ xennet_rx_interrupt, 0, -+ queue->rx_irq_name, queue); - if (err < 0) - goto bind_rx_fail; - queue->rx_irq = err; -@@ -1668,6 +1730,7 @@ static int xennet_init_queue(struct netfront_queue *queue) - - spin_lock_init(&queue->tx_lock); - spin_lock_init(&queue->rx_lock); -+ spin_lock_init(&queue->rx_cons_lock); - - timer_setup(&queue->rx_refill_timer, rx_refill_timeout, 0); - -diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c -index d0cc6c0d74d6b..7dc10c2b4785d 100644 ---- a/drivers/pci/msi.c -+++ b/drivers/pci/msi.c -@@ -827,9 +827,6 @@ static int msix_capability_init(struct pci_dev *dev, struct msix_entry *entries, - goto out_disable; - } - -- /* Ensure that all table entries are masked. */ -- msix_mask_all(base, tsize); -- - ret = msix_setup_entries(dev, base, entries, nvec, affd); - if (ret) - goto out_disable; -@@ -852,6 +849,16 @@ static int msix_capability_init(struct pci_dev *dev, struct msix_entry *entries, - /* Set MSI-X enabled bits and unmask the function */ - pci_intx_for_msi(dev, 0); - dev->msix_enabled = 1; -+ -+ /* -+ * Ensure that all table entries are masked to prevent -+ * stale entries from firing in a crash kernel. -+ * -+ * Done late to deal with a broken Marvell NVME device -+ * which takes the MSI-X mask bits into account even -+ * when MSI-X is disabled, which prevents MSI delivery. -+ */ -+ msix_mask_all(base, tsize); - pci_msix_clear_and_set_ctrl(dev, PCI_MSIX_FLAGS_MASKALL, 0); - - pcibios_free_irq(dev); -@@ -878,7 +885,7 @@ out_free: - free_msi_irqs(dev); - - out_disable: -- pci_msix_clear_and_set_ctrl(dev, PCI_MSIX_FLAGS_ENABLE, 0); -+ pci_msix_clear_and_set_ctrl(dev, PCI_MSIX_FLAGS_MASKALL | PCI_MSIX_FLAGS_ENABLE, 0); - - return ret; - } -diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c -index 44181a2cbf18d..408166bd20f33 100644 ---- a/drivers/scsi/scsi_debug.c -+++ b/drivers/scsi/scsi_debug.c -@@ -2296,11 +2296,11 @@ static int resp_mode_select(struct scsi_cmnd *scp, - __func__, param_len, res); - md_len = mselect6 ? (arr[0] + 1) : (get_unaligned_be16(arr + 0) + 2); - bd_len = mselect6 ? arr[3] : get_unaligned_be16(arr + 6); -- if (md_len > 2) { -+ off = bd_len + (mselect6 ? 4 : 8); -+ if (md_len > 2 || off >= res) { - mk_sense_invalid_fld(scp, SDEB_IN_DATA, 0, -1); - return check_condition_result; - } -- off = bd_len + (mselect6 ? 4 : 8); - mpage = arr[off] & 0x3f; - ps = !!(arr[off] & 0x80); - if (ps) { -diff --git a/drivers/soc/tegra/fuse/fuse-tegra.c b/drivers/soc/tegra/fuse/fuse-tegra.c -index 3eb44e65b3261..1a54bac512b69 100644 ---- a/drivers/soc/tegra/fuse/fuse-tegra.c -+++ b/drivers/soc/tegra/fuse/fuse-tegra.c -@@ -172,7 +172,7 @@ static struct platform_driver tegra_fuse_driver = { - }; - builtin_platform_driver(tegra_fuse_driver); - --bool __init tegra_fuse_read_spare(unsigned int spare) -+u32 __init tegra_fuse_read_spare(unsigned int spare) - { - unsigned int offset = fuse->soc->info->spare + spare * 4; - -diff --git a/drivers/soc/tegra/fuse/fuse.h b/drivers/soc/tegra/fuse/fuse.h -index 7230cb3305033..6996cfc7cbca3 100644 ---- a/drivers/soc/tegra/fuse/fuse.h -+++ b/drivers/soc/tegra/fuse/fuse.h -@@ -53,7 +53,7 @@ struct tegra_fuse { - void tegra_init_revision(void); - void tegra_init_apbmisc(void); - --bool __init tegra_fuse_read_spare(unsigned int spare); -+u32 __init tegra_fuse_read_spare(unsigned int spare); - u32 __init tegra_fuse_read_early(unsigned int offset); - - #ifdef CONFIG_ARCH_TEGRA_2x_SOC -diff --git a/drivers/tty/hvc/hvc_xen.c b/drivers/tty/hvc/hvc_xen.c -index 15da02aeee948..2d2d04c071401 100644 ---- a/drivers/tty/hvc/hvc_xen.c -+++ b/drivers/tty/hvc/hvc_xen.c -@@ -37,6 +37,8 @@ struct xencons_info { - struct xenbus_device *xbdev; - struct xencons_interface *intf; - unsigned int evtchn; -+ XENCONS_RING_IDX out_cons; -+ unsigned int out_cons_same; - struct hvc_struct *hvc; - int irq; - int vtermno; -@@ -138,6 +140,8 @@ static int domU_read_console(uint32_t vtermno, char *buf, int len) - XENCONS_RING_IDX cons, prod; - int recv = 0; - struct xencons_info *xencons = vtermno_to_xencons(vtermno); -+ unsigned int eoiflag = 0; -+ - if (xencons == NULL) - return -EINVAL; - intf = xencons->intf; -@@ -157,7 +161,27 @@ static int domU_read_console(uint32_t vtermno, char *buf, int len) - mb(); /* read ring before consuming */ - intf->in_cons = cons; - -- notify_daemon(xencons); -+ /* -+ * When to mark interrupt having been spurious: -+ * - there was no new data to be read, and -+ * - the backend did not consume some output bytes, and -+ * - the previous round with no read data didn't see consumed bytes -+ * (we might have a race with an interrupt being in flight while -+ * updating xencons->out_cons, so account for that by allowing one -+ * round without any visible reason) -+ */ -+ if (intf->out_cons != xencons->out_cons) { -+ xencons->out_cons = intf->out_cons; -+ xencons->out_cons_same = 0; -+ } -+ if (recv) { -+ notify_daemon(xencons); -+ } else if (xencons->out_cons_same++ > 1) { -+ eoiflag = XEN_EOI_FLAG_SPURIOUS; -+ } -+ -+ xen_irq_lateeoi(xencons->irq, eoiflag); -+ - return recv; - } - -@@ -386,7 +410,7 @@ static int xencons_connect_backend(struct xenbus_device *dev, - if (ret) - return ret; - info->evtchn = evtchn; -- irq = bind_evtchn_to_irq(evtchn); -+ irq = bind_interdomain_evtchn_to_irq_lateeoi(dev->otherend_id, evtchn); - if (irq < 0) - return irq; - info->irq = irq; -@@ -550,7 +574,7 @@ static int __init xen_hvc_init(void) - return r; - - info = vtermno_to_xencons(HVC_COOKIE); -- info->irq = bind_evtchn_to_irq(info->evtchn); -+ info->irq = bind_evtchn_to_irq_lateeoi(info->evtchn); - } - if (info->irq < 0) - info->irq = 0; /* NO_IRQ */ -diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c -index e170c5b4d6f0c..a118c44c70e1e 100644 ---- a/drivers/usb/core/quirks.c -+++ b/drivers/usb/core/quirks.c -@@ -435,6 +435,9 @@ static const struct usb_device_id usb_quirk_list[] = { - { USB_DEVICE(0x1532, 0x0116), .driver_info = - USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL }, - -+ /* Lenovo USB-C to Ethernet Adapter RTL8153-04 */ -+ { USB_DEVICE(0x17ef, 0x720c), .driver_info = USB_QUIRK_NO_LPM }, -+ - /* Lenovo Powered USB-C Travel Hub (4X90S92381, RTL8153 GigE) */ - { USB_DEVICE(0x17ef, 0x721e), .driver_info = USB_QUIRK_NO_LPM }, - -diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c -index d2980e30f3417..c5acf5c39fb18 100644 ---- a/drivers/usb/gadget/composite.c -+++ b/drivers/usb/gadget/composite.c -@@ -1649,14 +1649,14 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl) - u8 endp; - - if (w_length > USB_COMP_EP0_BUFSIZ) { -- if (ctrl->bRequestType == USB_DIR_OUT) { -- goto done; -- } else { -+ if (ctrl->bRequestType & USB_DIR_IN) { - /* Cast away the const, we are going to overwrite on purpose. */ - __le16 *temp = (__le16 *)&ctrl->wLength; - - *temp = cpu_to_le16(USB_COMP_EP0_BUFSIZ); - w_length = USB_COMP_EP0_BUFSIZ; -+ } else { -+ goto done; - } - } - -diff --git a/drivers/usb/gadget/legacy/dbgp.c b/drivers/usb/gadget/legacy/dbgp.c -index 355bc7dab9d5f..6bcbad3825802 100644 ---- a/drivers/usb/gadget/legacy/dbgp.c -+++ b/drivers/usb/gadget/legacy/dbgp.c -@@ -346,14 +346,14 @@ static int dbgp_setup(struct usb_gadget *gadget, - u16 len = 0; - - if (length > DBGP_REQ_LEN) { -- if (ctrl->bRequestType == USB_DIR_OUT) { -- return err; -- } else { -+ if (ctrl->bRequestType & USB_DIR_IN) { - /* Cast away the const, we are going to overwrite on purpose. */ - __le16 *temp = (__le16 *)&ctrl->wLength; - - *temp = cpu_to_le16(DBGP_REQ_LEN); - length = DBGP_REQ_LEN; -+ } else { -+ return err; - } - } - -diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c -index f0aff79f544c3..5f1e15172403e 100644 ---- a/drivers/usb/gadget/legacy/inode.c -+++ b/drivers/usb/gadget/legacy/inode.c -@@ -1336,14 +1336,14 @@ gadgetfs_setup (struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl) - u16 w_length = le16_to_cpu(ctrl->wLength); - - if (w_length > RBUF_SIZE) { -- if (ctrl->bRequestType == USB_DIR_OUT) { -- return value; -- } else { -+ if (ctrl->bRequestType & USB_DIR_IN) { - /* Cast away the const, we are going to overwrite on purpose. */ - __le16 *temp = (__le16 *)&ctrl->wLength; - - *temp = cpu_to_le16(RBUF_SIZE); - w_length = RBUF_SIZE; -+ } else { -+ return value; - } - } - -diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c -index beee3543950fe..ded05c39e4d1c 100644 ---- a/drivers/usb/host/xhci-pci.c -+++ b/drivers/usb/host/xhci-pci.c -@@ -65,6 +65,8 @@ - #define PCI_DEVICE_ID_AMD_YELLOW_CARP_XHCI_4 0x161e - #define PCI_DEVICE_ID_AMD_YELLOW_CARP_XHCI_5 0x15d6 - #define PCI_DEVICE_ID_AMD_YELLOW_CARP_XHCI_6 0x15d7 -+#define PCI_DEVICE_ID_AMD_YELLOW_CARP_XHCI_7 0x161c -+#define PCI_DEVICE_ID_AMD_YELLOW_CARP_XHCI_8 0x161f - - #define PCI_DEVICE_ID_ASMEDIA_1042_XHCI 0x1042 - #define PCI_DEVICE_ID_ASMEDIA_1042A_XHCI 0x1142 -@@ -303,7 +305,9 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) - pdev->device == PCI_DEVICE_ID_AMD_YELLOW_CARP_XHCI_3 || - pdev->device == PCI_DEVICE_ID_AMD_YELLOW_CARP_XHCI_4 || - pdev->device == PCI_DEVICE_ID_AMD_YELLOW_CARP_XHCI_5 || -- pdev->device == PCI_DEVICE_ID_AMD_YELLOW_CARP_XHCI_6)) -+ pdev->device == PCI_DEVICE_ID_AMD_YELLOW_CARP_XHCI_6 || -+ pdev->device == PCI_DEVICE_ID_AMD_YELLOW_CARP_XHCI_7 || -+ pdev->device == PCI_DEVICE_ID_AMD_YELLOW_CARP_XHCI_8)) - xhci->quirks |= XHCI_DEFAULT_PM_RUNTIME_ALLOW; - - if (xhci->quirks & XHCI_RESET_ON_RESUME) -diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c -index 004b6598706b1..50f289b124d0d 100644 ---- a/drivers/usb/serial/cp210x.c -+++ b/drivers/usb/serial/cp210x.c -@@ -1552,6 +1552,8 @@ static int cp2105_gpioconf_init(struct usb_serial *serial) - - /* 2 banks of GPIO - One for the pins taken from each serial port */ - if (intf_num == 0) { -+ priv->gc.ngpio = 2; -+ - if (mode.eci == CP210X_PIN_MODE_MODEM) { - /* mark all GPIOs of this interface as reserved */ - priv->gpio_altfunc = 0xff; -@@ -1562,8 +1564,9 @@ static int cp2105_gpioconf_init(struct usb_serial *serial) - priv->gpio_pushpull = (u8)((le16_to_cpu(config.gpio_mode) & - CP210X_ECI_GPIO_MODE_MASK) >> - CP210X_ECI_GPIO_MODE_OFFSET); -- priv->gc.ngpio = 2; - } else if (intf_num == 1) { -+ priv->gc.ngpio = 3; -+ - if (mode.sci == CP210X_PIN_MODE_MODEM) { - /* mark all GPIOs of this interface as reserved */ - priv->gpio_altfunc = 0xff; -@@ -1574,7 +1577,6 @@ static int cp2105_gpioconf_init(struct usb_serial *serial) - priv->gpio_pushpull = (u8)((le16_to_cpu(config.gpio_mode) & - CP210X_SCI_GPIO_MODE_MASK) >> - CP210X_SCI_GPIO_MODE_OFFSET); -- priv->gc.ngpio = 3; - } else { - return -ENODEV; - } -diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c -index 74203ed5479fa..2397d83434931 100644 ---- a/drivers/usb/serial/option.c -+++ b/drivers/usb/serial/option.c -@@ -1219,6 +1219,14 @@ static const struct usb_device_id option_ids[] = { - .driver_info = NCTRL(2) | RSVD(3) }, - { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1063, 0xff), /* Telit LN920 (ECM) */ - .driver_info = NCTRL(0) | RSVD(1) }, -+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1070, 0xff), /* Telit FN990 (rmnet) */ -+ .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, -+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1071, 0xff), /* Telit FN990 (MBIM) */ -+ .driver_info = NCTRL(0) | RSVD(1) }, -+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1072, 0xff), /* Telit FN990 (RNDIS) */ -+ .driver_info = NCTRL(2) | RSVD(3) }, -+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1073, 0xff), /* Telit FN990 (ECM) */ -+ .driver_info = NCTRL(0) | RSVD(1) }, - { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910), - .driver_info = NCTRL(0) | RSVD(1) | RSVD(3) }, - { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM), -diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c -index e442d400dbb2e..deb72fd7ec504 100644 ---- a/drivers/virtio/virtio_ring.c -+++ b/drivers/virtio/virtio_ring.c -@@ -263,7 +263,7 @@ size_t virtio_max_dma_size(struct virtio_device *vdev) - size_t max_segment_size = SIZE_MAX; - - if (vring_use_dma_api(vdev)) -- max_segment_size = dma_max_mapping_size(&vdev->dev); -+ max_segment_size = dma_max_mapping_size(vdev->dev.parent); - - return max_segment_size; - } -diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c -index 60378f3baaae1..34487bf1d7914 100644 ---- a/fs/fuse/dir.c -+++ b/fs/fuse/dir.c -@@ -1032,7 +1032,7 @@ int fuse_reverse_inval_entry(struct super_block *sb, u64 parent_nodeid, - if (!parent) - return -ENOENT; - -- inode_lock(parent); -+ inode_lock_nested(parent, I_MUTEX_PARENT); - if (!S_ISDIR(parent->i_mode)) - goto unlock; - -diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c -index 3283cc2a4e42c..a48fcd4180c74 100644 ---- a/fs/nfsd/nfs4state.c -+++ b/fs/nfsd/nfs4state.c -@@ -1041,6 +1041,11 @@ hash_delegation_locked(struct nfs4_delegation *dp, struct nfs4_file *fp) - return 0; - } - -+static bool delegation_hashed(struct nfs4_delegation *dp) -+{ -+ return !(list_empty(&dp->dl_perfile)); -+} -+ - static bool - unhash_delegation_locked(struct nfs4_delegation *dp) - { -@@ -1048,7 +1053,7 @@ unhash_delegation_locked(struct nfs4_delegation *dp) - - lockdep_assert_held(&state_lock); - -- if (list_empty(&dp->dl_perfile)) -+ if (!delegation_hashed(dp)) - return false; - - dp->dl_stid.sc_type = NFS4_CLOSED_DELEG_STID; -@@ -4406,7 +4411,7 @@ static void nfsd4_cb_recall_prepare(struct nfsd4_callback *cb) - * queued for a lease break. Don't queue it again. - */ - spin_lock(&state_lock); -- if (dp->dl_time == 0) { -+ if (delegation_hashed(dp) && dp->dl_time == 0) { - dp->dl_time = get_seconds(); - list_add_tail(&dp->dl_recall_lru, &nn->del_recall_lru); - } -diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c -index 876de87f604cd..8c89eaea1583d 100644 ---- a/fs/overlayfs/dir.c -+++ b/fs/overlayfs/dir.c -@@ -113,8 +113,7 @@ kill_whiteout: - goto out; - } - --static int ovl_mkdir_real(struct inode *dir, struct dentry **newdentry, -- umode_t mode) -+int ovl_mkdir_real(struct inode *dir, struct dentry **newdentry, umode_t mode) - { - int err; - struct dentry *d, *dentry = *newdentry; -diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h -index 6934bcf030f0b..a8e9da5f01eb5 100644 ---- a/fs/overlayfs/overlayfs.h -+++ b/fs/overlayfs/overlayfs.h -@@ -409,6 +409,7 @@ struct ovl_cattr { - - #define OVL_CATTR(m) (&(struct ovl_cattr) { .mode = (m) }) - -+int ovl_mkdir_real(struct inode *dir, struct dentry **newdentry, umode_t mode); - struct dentry *ovl_create_real(struct inode *dir, struct dentry *newdentry, - struct ovl_cattr *attr); - int ovl_cleanup(struct inode *dir, struct dentry *dentry); -diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c -index f036d7544d4a6..f5cf0938f298d 100644 ---- a/fs/overlayfs/super.c -+++ b/fs/overlayfs/super.c -@@ -650,10 +650,14 @@ retry: - goto retry; - } - -- work = ovl_create_real(dir, work, OVL_CATTR(attr.ia_mode)); -- err = PTR_ERR(work); -- if (IS_ERR(work)) -- goto out_err; -+ err = ovl_mkdir_real(dir, &work, attr.ia_mode); -+ if (err) -+ goto out_dput; -+ -+ /* Weird filesystem returning with hashed negative (kernfs)? */ -+ err = -EINVAL; -+ if (d_really_is_negative(work)) -+ goto out_dput; - - /* - * Try to remove POSIX ACL xattrs from workdir. We are good if: -diff --git a/include/net/tc_act/tc_tunnel_key.h b/include/net/tc_act/tc_tunnel_key.h -index 0689d9bcdf841..f6a0f09ccc5f9 100644 ---- a/include/net/tc_act/tc_tunnel_key.h -+++ b/include/net/tc_act/tc_tunnel_key.h -@@ -52,7 +52,10 @@ static inline struct ip_tunnel_info *tcf_tunnel_info(const struct tc_action *a) - { - #ifdef CONFIG_NET_CLS_ACT - struct tcf_tunnel_key *t = to_tunnel_key(a); -- struct tcf_tunnel_key_params *params = rtnl_dereference(t->params); -+ struct tcf_tunnel_key_params *params; -+ -+ params = rcu_dereference_protected(t->params, -+ lockdep_is_held(&a->tcfa_lock)); - - return ¶ms->tcft_enc_metadata->u.tun_info; - #else -@@ -69,7 +72,7 @@ tcf_tunnel_info_copy(const struct tc_action *a) - if (tun) { - size_t tun_size = sizeof(*tun) + tun->options_len; - struct ip_tunnel_info *tun_copy = kmemdup(tun, tun_size, -- GFP_KERNEL); -+ GFP_ATOMIC); - - return tun_copy; - } -diff --git a/kernel/audit.c b/kernel/audit.c -index 05ae208ad4423..d67fce9e3f8b8 100644 ---- a/kernel/audit.c -+++ b/kernel/audit.c -@@ -712,7 +712,7 @@ static int kauditd_send_queue(struct sock *sk, u32 portid, - { - int rc = 0; - struct sk_buff *skb; -- static unsigned int failed = 0; -+ unsigned int failed = 0; - - /* NOTE: kauditd_thread takes care of all our locking, we just use - * the netlink info passed to us (e.g. sk and portid) */ -@@ -729,32 +729,30 @@ static int kauditd_send_queue(struct sock *sk, u32 portid, - continue; - } - -+retry: - /* grab an extra skb reference in case of error */ - skb_get(skb); - rc = netlink_unicast(sk, skb, portid, 0); - if (rc < 0) { -- /* fatal failure for our queue flush attempt? */ -+ /* send failed - try a few times unless fatal error */ - if (++failed >= retry_limit || - rc == -ECONNREFUSED || rc == -EPERM) { -- /* yes - error processing for the queue */ - sk = NULL; - if (err_hook) - (*err_hook)(skb); -- if (!skb_hook) -- goto out; -- /* keep processing with the skb_hook */ -+ if (rc == -EAGAIN) -+ rc = 0; -+ /* continue to drain the queue */ - continue; - } else -- /* no - requeue to preserve ordering */ -- skb_queue_head(queue, skb); -+ goto retry; - } else { -- /* it worked - drop the extra reference and continue */ -+ /* skb sent - drop the extra reference and continue */ - consume_skb(skb); - failed = 0; - } - } - --out: - return (rc >= 0 ? 0 : rc); - } - -@@ -1557,7 +1555,8 @@ static int __net_init audit_net_init(struct net *net) - audit_panic("cannot initialize netlink socket in namespace"); - return -ENOMEM; - } -- aunet->sk->sk_sndtimeo = MAX_SCHEDULE_TIMEOUT; -+ /* limit the timeout in case auditd is blocked/stopped */ -+ aunet->sk->sk_sndtimeo = HZ / 10; - - return 0; - } -diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c -index 11ae2747701b5..7777c35e0a171 100644 ---- a/kernel/rcu/tree.c -+++ b/kernel/rcu/tree.c -@@ -1602,7 +1602,7 @@ static void rcu_gp_fqs(bool first_time) - struct rcu_node *rnp = rcu_get_root(); - - WRITE_ONCE(rcu_state.gp_activity, jiffies); -- rcu_state.n_force_qs++; -+ WRITE_ONCE(rcu_state.n_force_qs, rcu_state.n_force_qs + 1); - if (first_time) { - /* Collect dyntick-idle snapshots. */ - force_qs_rnp(dyntick_save_progress_counter); -@@ -2207,7 +2207,7 @@ static void rcu_do_batch(struct rcu_data *rdp) - /* Reset ->qlen_last_fqs_check trigger if enough CBs have drained. */ - if (count == 0 && rdp->qlen_last_fqs_check != 0) { - rdp->qlen_last_fqs_check = 0; -- rdp->n_force_qs_snap = rcu_state.n_force_qs; -+ rdp->n_force_qs_snap = READ_ONCE(rcu_state.n_force_qs); - } else if (count < rdp->qlen_last_fqs_check - qhimark) - rdp->qlen_last_fqs_check = count; - -@@ -2535,10 +2535,10 @@ static void __call_rcu_core(struct rcu_data *rdp, struct rcu_head *head, - } else { - /* Give the grace period a kick. */ - rdp->blimit = DEFAULT_MAX_RCU_BLIMIT; -- if (rcu_state.n_force_qs == rdp->n_force_qs_snap && -+ if (READ_ONCE(rcu_state.n_force_qs) == rdp->n_force_qs_snap && - rcu_segcblist_first_pend_cb(&rdp->cblist) != head) - rcu_force_quiescent_state(); -- rdp->n_force_qs_snap = rcu_state.n_force_qs; -+ rdp->n_force_qs_snap = READ_ONCE(rcu_state.n_force_qs); - rdp->qlen_last_fqs_check = rcu_segcblist_n_cbs(&rdp->cblist); - } - } -@@ -3029,7 +3029,7 @@ int rcutree_prepare_cpu(unsigned int cpu) - /* Set up local state, ensuring consistent view of global state. */ - raw_spin_lock_irqsave_rcu_node(rnp, flags); - rdp->qlen_last_fqs_check = 0; -- rdp->n_force_qs_snap = rcu_state.n_force_qs; -+ rdp->n_force_qs_snap = READ_ONCE(rcu_state.n_force_qs); - rdp->blimit = blimit; - if (rcu_segcblist_empty(&rdp->cblist) && /* No early-boot CBs? */ - !rcu_segcblist_is_offloaded(&rdp->cblist)) -diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c -index 4fc2af4367a7b..36ed8bad3909e 100644 ---- a/kernel/time/timekeeping.c -+++ b/kernel/time/timekeeping.c -@@ -1236,8 +1236,7 @@ int do_settimeofday64(const struct timespec64 *ts) - timekeeping_forward_now(tk); - - xt = tk_xtime(tk); -- ts_delta.tv_sec = ts->tv_sec - xt.tv_sec; -- ts_delta.tv_nsec = ts->tv_nsec - xt.tv_nsec; -+ ts_delta = timespec64_sub(*ts, xt); - - if (timespec64_compare(&tk->wall_to_monotonic, &ts_delta) > 0) { - ret = -EINVAL; -diff --git a/net/core/skbuff.c b/net/core/skbuff.c -index 7dba091bc8617..ac083685214e0 100644 ---- a/net/core/skbuff.c -+++ b/net/core/skbuff.c -@@ -768,7 +768,7 @@ void skb_dump(const char *level, const struct sk_buff *skb, bool full_pkt) - ntohs(skb->protocol), skb->pkt_type, skb->skb_iif); - - if (dev) -- printk("%sdev name=%s feat=0x%pNF\n", -+ printk("%sdev name=%s feat=%pNF\n", - level, dev->name, &dev->features); - if (sk) - printk("%ssk family=%hu type=%u proto=%u\n", -diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c -index 4f71aca156662..f8f79672cc5f3 100644 ---- a/net/ipv4/inet_diag.c -+++ b/net/ipv4/inet_diag.c -@@ -200,6 +200,7 @@ int inet_sk_diag_fill(struct sock *sk, struct inet_connection_sock *icsk, - r->idiag_state = sk->sk_state; - r->idiag_timer = 0; - r->idiag_retrans = 0; -+ r->idiag_expires = 0; - - if (inet_diag_msg_attrs_fill(sk, skb, r, ext, user_ns, net_admin)) - goto errout; -@@ -240,20 +241,17 @@ int inet_sk_diag_fill(struct sock *sk, struct inet_connection_sock *icsk, - r->idiag_timer = 1; - r->idiag_retrans = icsk->icsk_retransmits; - r->idiag_expires = -- jiffies_to_msecs(icsk->icsk_timeout - jiffies); -+ jiffies_delta_to_msecs(icsk->icsk_timeout - jiffies); - } else if (icsk->icsk_pending == ICSK_TIME_PROBE0) { - r->idiag_timer = 4; - r->idiag_retrans = icsk->icsk_probes_out; - r->idiag_expires = -- jiffies_to_msecs(icsk->icsk_timeout - jiffies); -+ jiffies_delta_to_msecs(icsk->icsk_timeout - jiffies); - } else if (timer_pending(&sk->sk_timer)) { - r->idiag_timer = 2; - r->idiag_retrans = icsk->icsk_probes_out; - r->idiag_expires = -- jiffies_to_msecs(sk->sk_timer.expires - jiffies); -- } else { -- r->idiag_timer = 0; -- r->idiag_expires = 0; -+ jiffies_delta_to_msecs(sk->sk_timer.expires - jiffies); - } - - if ((ext & (1 << (INET_DIAG_INFO - 1))) && handler->idiag_info_size) { -@@ -338,16 +336,13 @@ static int inet_twsk_diag_fill(struct sock *sk, - r = nlmsg_data(nlh); - BUG_ON(tw->tw_state != TCP_TIME_WAIT); - -- tmo = tw->tw_timer.expires - jiffies; -- if (tmo < 0) -- tmo = 0; -- - inet_diag_msg_common_fill(r, sk); - r->idiag_retrans = 0; - - r->idiag_state = tw->tw_substate; - r->idiag_timer = 3; -- r->idiag_expires = jiffies_to_msecs(tmo); -+ tmo = tw->tw_timer.expires - jiffies; -+ r->idiag_expires = jiffies_delta_to_msecs(tmo); - r->idiag_rqueue = 0; - r->idiag_wqueue = 0; - r->idiag_uid = 0; -@@ -381,7 +376,7 @@ static int inet_req_diag_fill(struct sock *sk, struct sk_buff *skb, - offsetof(struct sock, sk_cookie)); - - tmo = inet_reqsk(sk)->rsk_timer.expires - jiffies; -- r->idiag_expires = (tmo >= 0) ? jiffies_to_msecs(tmo) : 0; -+ r->idiag_expires = jiffies_delta_to_msecs(tmo); - r->idiag_rqueue = 0; - r->idiag_wqueue = 0; - r->idiag_uid = 0; -diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c -index 7f9cae4c49e7e..16e75a996b749 100644 ---- a/net/ipv6/sit.c -+++ b/net/ipv6/sit.c -@@ -1876,7 +1876,6 @@ static int __net_init sit_init_net(struct net *net) - return 0; - - err_reg_dev: -- ipip6_dev_free(sitn->fb_tunnel_dev); - free_netdev(sitn->fb_tunnel_dev); - err_alloc_dev: - return err; -diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c -index 4d1c335e06e57..49ec9bfb6c8e6 100644 ---- a/net/mac80211/agg-rx.c -+++ b/net/mac80211/agg-rx.c -@@ -9,7 +9,7 @@ - * Copyright 2007, Michael Wu - * Copyright 2007-2010, Intel Corporation - * Copyright(c) 2015-2017 Intel Deutschland GmbH -- * Copyright (C) 2018 Intel Corporation -+ * Copyright (C) 2018-2021 Intel Corporation - */ - - /** -@@ -191,7 +191,8 @@ static void ieee80211_add_addbaext(struct ieee80211_sub_if_data *sdata, - sband = ieee80211_get_sband(sdata); - if (!sband) - return; -- he_cap = ieee80211_get_he_iftype_cap(sband, sdata->vif.type); -+ he_cap = ieee80211_get_he_iftype_cap(sband, -+ ieee80211_vif_type_p2p(&sdata->vif)); - if (!he_cap) - return; - -@@ -292,7 +293,8 @@ void ___ieee80211_start_rx_ba_session(struct sta_info *sta, - goto end; - } - -- if (!sta->sta.ht_cap.ht_supported) { -+ if (!sta->sta.ht_cap.ht_supported && -+ sta->sdata->vif.bss_conf.chandef.chan->band != NL80211_BAND_6GHZ) { - ht_dbg(sta->sdata, - "STA %pM erroneously requests BA session on tid %d w/o QoS\n", - sta->sta.addr, tid); -diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c -index b11883d268759..f140c2b94b2c6 100644 ---- a/net/mac80211/agg-tx.c -+++ b/net/mac80211/agg-tx.c -@@ -9,7 +9,7 @@ - * Copyright 2007, Michael Wu - * Copyright 2007-2010, Intel Corporation - * Copyright(c) 2015-2017 Intel Deutschland GmbH -- * Copyright (C) 2018 - 2019 Intel Corporation -+ * Copyright (C) 2018 - 2021 Intel Corporation - */ - - #include -@@ -106,7 +106,7 @@ static void ieee80211_send_addba_request(struct ieee80211_sub_if_data *sdata, - mgmt->u.action.u.addba_req.start_seq_num = - cpu_to_le16(start_seq_num << 4); - -- ieee80211_tx_skb(sdata, skb); -+ ieee80211_tx_skb_tid(sdata, skb, tid); - } - - void ieee80211_send_bar(struct ieee80211_vif *vif, u8 *ra, u16 tid, u16 ssn) -@@ -213,6 +213,8 @@ ieee80211_agg_start_txq(struct sta_info *sta, int tid, bool enable) - struct ieee80211_txq *txq = sta->sta.txq[tid]; - struct txq_info *txqi; - -+ lockdep_assert_held(&sta->ampdu_mlme.mtx); -+ - if (!txq) - return; - -@@ -290,7 +292,6 @@ static void ieee80211_remove_tid_tx(struct sta_info *sta, int tid) - ieee80211_assign_tid_tx(sta, tid, NULL); - - ieee80211_agg_splice_finish(sta->sdata, tid); -- ieee80211_agg_start_txq(sta, tid, false); - - kfree_rcu(tid_tx, rcu_head); - } -@@ -448,6 +449,42 @@ static void sta_addba_resp_timer_expired(struct timer_list *t) - ieee80211_stop_tx_ba_session(&sta->sta, tid); - } - -+static void ieee80211_send_addba_with_timeout(struct sta_info *sta, -+ struct tid_ampdu_tx *tid_tx) -+{ -+ struct ieee80211_sub_if_data *sdata = sta->sdata; -+ struct ieee80211_local *local = sta->local; -+ u8 tid = tid_tx->tid; -+ u16 buf_size; -+ -+ /* activate the timer for the recipient's addBA response */ -+ mod_timer(&tid_tx->addba_resp_timer, jiffies + ADDBA_RESP_INTERVAL); -+ ht_dbg(sdata, "activated addBA response timer on %pM tid %d\n", -+ sta->sta.addr, tid); -+ -+ spin_lock_bh(&sta->lock); -+ sta->ampdu_mlme.last_addba_req_time[tid] = jiffies; -+ sta->ampdu_mlme.addba_req_num[tid]++; -+ spin_unlock_bh(&sta->lock); -+ -+ if (sta->sta.he_cap.has_he) { -+ buf_size = local->hw.max_tx_aggregation_subframes; -+ } else { -+ /* -+ * We really should use what the driver told us it will -+ * transmit as the maximum, but certain APs (e.g. the -+ * LinkSys WRT120N with FW v1.0.07 build 002 Jun 18 2012) -+ * will crash when we use a lower number. -+ */ -+ buf_size = IEEE80211_MAX_AMPDU_BUF_HT; -+ } -+ -+ /* send AddBA request */ -+ ieee80211_send_addba_request(sdata, sta->sta.addr, tid, -+ tid_tx->dialog_token, tid_tx->ssn, -+ buf_size, tid_tx->timeout); -+} -+ - void ieee80211_tx_ba_session_handle_start(struct sta_info *sta, int tid) - { - struct tid_ampdu_tx *tid_tx; -@@ -462,7 +499,6 @@ void ieee80211_tx_ba_session_handle_start(struct sta_info *sta, int tid) - .timeout = 0, - }; - int ret; -- u16 buf_size; - - tid_tx = rcu_dereference_protected_tid_tx(sta, tid); - -@@ -485,6 +521,7 @@ void ieee80211_tx_ba_session_handle_start(struct sta_info *sta, int tid) - - params.ssn = sta->tid_seq[tid] >> 4; - ret = drv_ampdu_action(local, sdata, ¶ms); -+ tid_tx->ssn = params.ssn; - if (ret) { - ht_dbg(sdata, - "BA request denied - HW unavailable for %pM tid %d\n", -@@ -501,32 +538,7 @@ void ieee80211_tx_ba_session_handle_start(struct sta_info *sta, int tid) - return; - } - -- /* activate the timer for the recipient's addBA response */ -- mod_timer(&tid_tx->addba_resp_timer, jiffies + ADDBA_RESP_INTERVAL); -- ht_dbg(sdata, "activated addBA response timer on %pM tid %d\n", -- sta->sta.addr, tid); -- -- spin_lock_bh(&sta->lock); -- sta->ampdu_mlme.last_addba_req_time[tid] = jiffies; -- sta->ampdu_mlme.addba_req_num[tid]++; -- spin_unlock_bh(&sta->lock); -- -- if (sta->sta.he_cap.has_he) { -- buf_size = local->hw.max_tx_aggregation_subframes; -- } else { -- /* -- * We really should use what the driver told us it will -- * transmit as the maximum, but certain APs (e.g. the -- * LinkSys WRT120N with FW v1.0.07 build 002 Jun 18 2012) -- * will crash when we use a lower number. -- */ -- buf_size = IEEE80211_MAX_AMPDU_BUF_HT; -- } -- -- /* send AddBA request */ -- ieee80211_send_addba_request(sdata, sta->sta.addr, tid, -- tid_tx->dialog_token, params.ssn, -- buf_size, tid_tx->timeout); -+ ieee80211_send_addba_with_timeout(sta, tid_tx); - } - - /* -@@ -571,7 +583,8 @@ int ieee80211_start_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid, - "Requested to start BA session on reserved tid=%d", tid)) - return -EINVAL; - -- if (!pubsta->ht_cap.ht_supported) -+ if (!pubsta->ht_cap.ht_supported && -+ sta->sdata->vif.bss_conf.chandef.chan->band != NL80211_BAND_6GHZ) - return -EINVAL; - - if (WARN_ON_ONCE(!local->ops->ampdu_action)) -@@ -860,6 +873,7 @@ void ieee80211_stop_tx_ba_cb(struct sta_info *sta, int tid, - { - struct ieee80211_sub_if_data *sdata = sta->sdata; - bool send_delba = false; -+ bool start_txq = false; - - ht_dbg(sdata, "Stopping Tx BA session for %pM tid %d\n", - sta->sta.addr, tid); -@@ -877,10 +891,14 @@ void ieee80211_stop_tx_ba_cb(struct sta_info *sta, int tid, - send_delba = true; - - ieee80211_remove_tid_tx(sta, tid); -+ start_txq = true; - - unlock_sta: - spin_unlock_bh(&sta->lock); - -+ if (start_txq) -+ ieee80211_agg_start_txq(sta, tid, false); -+ - if (send_delba) - ieee80211_send_delba(sdata, sta->sta.addr, tid, - WLAN_BACK_INITIATOR, WLAN_REASON_QSTA_NOT_USE); -diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h -index 2c9b3eb8b6525..f4c7e0af896b1 100644 ---- a/net/mac80211/driver-ops.h -+++ b/net/mac80211/driver-ops.h -@@ -1202,8 +1202,11 @@ static inline void drv_wake_tx_queue(struct ieee80211_local *local, - { - struct ieee80211_sub_if_data *sdata = vif_to_sdata(txq->txq.vif); - -- if (local->in_reconfig) -+ /* In reconfig don't transmit now, but mark for waking later */ -+ if (local->in_reconfig) { -+ set_bit(IEEE80211_TXQ_STOP_NETIF_TX, &txq->flags); - return; -+ } - - if (!check_sdata_in_driver(sdata)) - return; -diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c -index ccaf2389ccc1d..5c727af01143f 100644 ---- a/net/mac80211/mlme.c -+++ b/net/mac80211/mlme.c -@@ -2418,11 +2418,18 @@ static void ieee80211_sta_tx_wmm_ac_notify(struct ieee80211_sub_if_data *sdata, - u16 tx_time) - { - struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; -- u16 tid = ieee80211_get_tid(hdr); -- int ac = ieee80211_ac_from_tid(tid); -- struct ieee80211_sta_tx_tspec *tx_tspec = &ifmgd->tx_tspec[ac]; -+ u16 tid; -+ int ac; -+ struct ieee80211_sta_tx_tspec *tx_tspec; - unsigned long now = jiffies; - -+ if (!ieee80211_is_data_qos(hdr->frame_control)) -+ return; -+ -+ tid = ieee80211_get_tid(hdr); -+ ac = ieee80211_ac_from_tid(tid); -+ tx_tspec = &ifmgd->tx_tspec[ac]; -+ - if (likely(!tx_tspec->admitted_time)) - return; - -diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h -index 2eb73be9b9865..be0df78d4a799 100644 ---- a/net/mac80211/sta_info.h -+++ b/net/mac80211/sta_info.h -@@ -180,6 +180,7 @@ struct tid_ampdu_tx { - u8 stop_initiator; - bool tx_stop; - u16 buf_size; -+ u16 ssn; - - u16 failed_bar_ssn; - bool bar_pending; -diff --git a/net/mac80211/util.c b/net/mac80211/util.c -index decd46b383938..c1c117fdf3184 100644 ---- a/net/mac80211/util.c -+++ b/net/mac80211/util.c -@@ -1227,6 +1227,8 @@ _ieee802_11_parse_elems_crc(const u8 *start, size_t len, bool action, - elems->max_idle_period_ie = (void *)pos; - break; - case WLAN_EID_EXTENSION: -+ if (!elen) -+ break; - if (pos[0] == WLAN_EID_EXT_HE_MU_EDCA && - elen >= (sizeof(*elems->mu_edca_param_set) + 1)) { - elems->mu_edca_param_set = (void *)&pos[1]; -diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c -index 0ffbf3d17911a..6062bd5bf132b 100644 ---- a/net/packet/af_packet.c -+++ b/net/packet/af_packet.c -@@ -4453,9 +4453,10 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, - } - - out_free_pg_vec: -- bitmap_free(rx_owner_map); -- if (pg_vec) -+ if (pg_vec) { -+ bitmap_free(rx_owner_map); - free_pg_vec(pg_vec, order, req->tp_block_nr); -+ } - out: - return err; - } -diff --git a/net/rds/connection.c b/net/rds/connection.c -index c85bd6340eaa7..92ff40e7a66cf 100644 ---- a/net/rds/connection.c -+++ b/net/rds/connection.c -@@ -253,6 +253,7 @@ static struct rds_connection *__rds_conn_create(struct net *net, - * should end up here, but if it - * does, reset/destroy the connection. - */ -+ kfree(conn->c_path); - kmem_cache_free(rds_conn_slab, conn); - conn = ERR_PTR(-EOPNOTSUPP); - goto out; -diff --git a/net/sched/act_sample.c b/net/sched/act_sample.c -index 74450b0f69fc5..214f4efdd9920 100644 ---- a/net/sched/act_sample.c -+++ b/net/sched/act_sample.c -@@ -265,14 +265,12 @@ tcf_sample_get_group(const struct tc_action *a, - struct tcf_sample *s = to_sample(a); - struct psample_group *group; - -- spin_lock_bh(&s->tcf_lock); - group = rcu_dereference_protected(s->psample_group, - lockdep_is_held(&s->tcf_lock)); - if (group) { - psample_group_take(group); - *destructor = tcf_psample_group_put; - } -- spin_unlock_bh(&s->tcf_lock); - - return group; - } -diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c -index 7f20fd37e01e0..a4c61205462ac 100644 ---- a/net/sched/cls_api.c -+++ b/net/sched/cls_api.c -@@ -3436,7 +3436,7 @@ static void tcf_sample_get_group(struct flow_action_entry *entry, - int tc_setup_flow_action(struct flow_action *flow_action, - const struct tcf_exts *exts, bool rtnl_held) - { -- const struct tc_action *act; -+ struct tc_action *act; - int i, j, k, err = 0; - - if (!exts) -@@ -3450,6 +3450,7 @@ int tc_setup_flow_action(struct flow_action *flow_action, - struct flow_action_entry *entry; - - entry = &flow_action->entries[j]; -+ spin_lock_bh(&act->tcfa_lock); - if (is_tcf_gact_ok(act)) { - entry->id = FLOW_ACTION_ACCEPT; - } else if (is_tcf_gact_shot(act)) { -@@ -3490,13 +3491,13 @@ int tc_setup_flow_action(struct flow_action *flow_action, - break; - default: - err = -EOPNOTSUPP; -- goto err_out; -+ goto err_out_locked; - } - } else if (is_tcf_tunnel_set(act)) { - entry->id = FLOW_ACTION_TUNNEL_ENCAP; - err = tcf_tunnel_encap_get_tunnel(entry, act); - if (err) -- goto err_out; -+ goto err_out_locked; - } else if (is_tcf_tunnel_release(act)) { - entry->id = FLOW_ACTION_TUNNEL_DECAP; - } else if (is_tcf_pedit(act)) { -@@ -3510,7 +3511,7 @@ int tc_setup_flow_action(struct flow_action *flow_action, - break; - default: - err = -EOPNOTSUPP; -- goto err_out; -+ goto err_out_locked; - } - entry->mangle.htype = tcf_pedit_htype(act, k); - entry->mangle.mask = tcf_pedit_mask(act, k); -@@ -3561,15 +3562,17 @@ int tc_setup_flow_action(struct flow_action *flow_action, - entry->mpls_mangle.ttl = tcf_mpls_ttl(act); - break; - default: -- goto err_out; -+ err = -EOPNOTSUPP; -+ goto err_out_locked; - } - } else if (is_tcf_skbedit_ptype(act)) { - entry->id = FLOW_ACTION_PTYPE; - entry->ptype = tcf_skbedit_ptype(act); - } else { - err = -EOPNOTSUPP; -- goto err_out; -+ goto err_out_locked; - } -+ spin_unlock_bh(&act->tcfa_lock); - - if (!is_tcf_pedit(act)) - j++; -@@ -3583,6 +3586,9 @@ err_out: - tc_cleanup_flow_action(flow_action); - - return err; -+err_out_locked: -+ spin_unlock_bh(&act->tcfa_lock); -+ goto err_out; - } - EXPORT_SYMBOL(tc_setup_flow_action); - -diff --git a/net/sched/sch_cake.c b/net/sched/sch_cake.c -index e8eebe40e0ae9..0eb4d4a568f77 100644 ---- a/net/sched/sch_cake.c -+++ b/net/sched/sch_cake.c -@@ -2724,7 +2724,7 @@ static int cake_init(struct Qdisc *sch, struct nlattr *opt, - q->tins = kvcalloc(CAKE_MAX_TINS, sizeof(struct cake_tin_data), - GFP_KERNEL); - if (!q->tins) -- goto nomem; -+ return -ENOMEM; - - for (i = 0; i < CAKE_MAX_TINS; i++) { - struct cake_tin_data *b = q->tins + i; -@@ -2754,10 +2754,6 @@ static int cake_init(struct Qdisc *sch, struct nlattr *opt, - q->min_netlen = ~0; - q->min_adjlen = ~0; - return 0; -- --nomem: -- cake_destroy(sch); -- return -ENOMEM; - } - - static int cake_dump(struct Qdisc *sch, struct sk_buff *skb) -diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c -index fa3b20e5f4608..06684ac346abd 100644 ---- a/net/smc/af_smc.c -+++ b/net/smc/af_smc.c -@@ -183,7 +183,9 @@ static int smc_release(struct socket *sock) - /* cleanup for a dangling non-blocking connect */ - if (smc->connect_nonblock && sk->sk_state == SMC_INIT) - tcp_abort(smc->clcsock->sk, ECONNABORTED); -- flush_work(&smc->connect_work); -+ -+ if (cancel_work_sync(&smc->connect_work)) -+ sock_put(&smc->sk); /* sock_hold in smc_connect for passive closing */ - - if (sk->sk_state == SMC_LISTEN) - /* smc_close_non_accepted() is called and acquires -diff --git a/scripts/recordmcount.pl b/scripts/recordmcount.pl -index f459ae883a0a6..a4ca050815aba 100755 ---- a/scripts/recordmcount.pl -+++ b/scripts/recordmcount.pl -@@ -252,7 +252,7 @@ if ($arch eq "x86_64") { - - } elsif ($arch eq "s390" && $bits == 64) { - if ($cc =~ /-DCC_USING_HOTPATCH/) { -- $mcount_regex = "^\\s*([0-9a-fA-F]+):\\s*c0 04 00 00 00 00\\s*brcl\\s*0,[0-9a-f]+ <([^\+]*)>\$"; -+ $mcount_regex = "^\\s*([0-9a-fA-F]+):\\s*c0 04 00 00 00 00\\s*(bcrl\\s*0,|jgnop\\s*)[0-9a-f]+ <([^\+]*)>\$"; - $mcount_adjust = 0; - } else { - $mcount_regex = "^\\s*([0-9a-fA-F]+):\\s*R_390_(PC|PLT)32DBL\\s+_mcount\\+0x2\$"; -diff --git a/tools/testing/selftests/kvm/kvm_create_max_vcpus.c b/tools/testing/selftests/kvm/kvm_create_max_vcpus.c -index 231d79e57774e..cfe75536d8a55 100644 ---- a/tools/testing/selftests/kvm/kvm_create_max_vcpus.c -+++ b/tools/testing/selftests/kvm/kvm_create_max_vcpus.c -@@ -12,6 +12,7 @@ - #include - #include - #include -+#include - - #include "test_util.h" - -@@ -43,10 +44,39 @@ int main(int argc, char *argv[]) - { - int kvm_max_vcpu_id = kvm_check_cap(KVM_CAP_MAX_VCPU_ID); - int kvm_max_vcpus = kvm_check_cap(KVM_CAP_MAX_VCPUS); -+ /* -+ * Number of file descriptors reqired, KVM_CAP_MAX_VCPUS for vCPU fds + -+ * an arbitrary number for everything else. -+ */ -+ int nr_fds_wanted = kvm_max_vcpus + 100; -+ struct rlimit rl; - - printf("KVM_CAP_MAX_VCPU_ID: %d\n", kvm_max_vcpu_id); - printf("KVM_CAP_MAX_VCPUS: %d\n", kvm_max_vcpus); - -+ /* -+ * Check that we're allowed to open nr_fds_wanted file descriptors and -+ * try raising the limits if needed. -+ */ -+ TEST_ASSERT(!getrlimit(RLIMIT_NOFILE, &rl), "getrlimit() failed!"); -+ -+ if (rl.rlim_cur < nr_fds_wanted) { -+ rl.rlim_cur = nr_fds_wanted; -+ if (rl.rlim_max < nr_fds_wanted) { -+ int old_rlim_max = rl.rlim_max; -+ rl.rlim_max = nr_fds_wanted; -+ -+ int r = setrlimit(RLIMIT_NOFILE, &rl); -+ if (r < 0) { -+ printf("RLIMIT_NOFILE hard limit is too low (%d, wanted %d)\n", -+ old_rlim_max, nr_fds_wanted); -+ exit(KSFT_SKIP); -+ } -+ } else { -+ TEST_ASSERT(!setrlimit(RLIMIT_NOFILE, &rl), "setrlimit() failed!"); -+ } -+ } -+ - /* - * Upstream KVM prior to 4.8 does not support KVM_CAP_MAX_VCPU_ID. - * Userspace is supposed to use KVM_CAP_MAX_VCPUS as the maximum ID -diff --git a/tools/testing/selftests/net/fcnal-test.sh b/tools/testing/selftests/net/fcnal-test.sh -index 782a8da5d9500..157822331954d 100755 ---- a/tools/testing/selftests/net/fcnal-test.sh -+++ b/tools/testing/selftests/net/fcnal-test.sh -@@ -1491,8 +1491,9 @@ ipv4_addr_bind_vrf() - for a in ${NSA_IP} ${VRF_IP} - do - log_start -+ show_hint "Socket not bound to VRF, but address is in VRF" - run_cmd nettest -s -R -P icmp -l ${a} -b -- log_test_addr ${a} $? 0 "Raw socket bind to local address" -+ log_test_addr ${a} $? 1 "Raw socket bind to local address" - - log_start - run_cmd nettest -s -R -P icmp -l ${a} -d ${NSA_DEV} -b -@@ -1884,7 +1885,7 @@ ipv6_ping_vrf() - log_start - show_hint "Fails since VRF device does not support linklocal or multicast" - run_cmd ${ping6} -c1 -w1 ${a} -- log_test_addr ${a} $? 2 "ping out, VRF bind" -+ log_test_addr ${a} $? 1 "ping out, VRF bind" - done - - for a in ${NSB_IP6} ${NSB_LO_IP6} ${NSB_LINKIP6}%${NSA_DEV} ${MCAST}%${NSA_DEV} -@@ -2890,11 +2891,14 @@ ipv6_addr_bind_novrf() - run_cmd nettest -6 -s -l ${a} -d ${NSA_DEV} -t1 -b - log_test_addr ${a} $? 0 "TCP socket bind to local address after device bind" - -+ # Sadly, the kernel allows binding a socket to a device and then -+ # binding to an address not on the device. So this test passes -+ # when it really should not - a=${NSA_LO_IP6} - log_start -- show_hint "Should fail with 'Cannot assign requested address'" -- run_cmd nettest -6 -s -l ${a} -d ${NSA_DEV} -t1 -b -- log_test_addr ${a} $? 1 "TCP socket bind to out of scope local address" -+ show_hint "Tecnically should fail since address is not on device but kernel allows" -+ run_cmd nettest -6 -s -l ${a} -I ${NSA_DEV} -t1 -b -+ log_test_addr ${a} $? 0 "TCP socket bind to out of scope local address" - } - - ipv6_addr_bind_vrf() -@@ -2935,10 +2939,15 @@ ipv6_addr_bind_vrf() - run_cmd nettest -6 -s -l ${a} -d ${NSA_DEV} -t1 -b - log_test_addr ${a} $? 0 "TCP socket bind to local address with device bind" - -+ # Sadly, the kernel allows binding a socket to a device and then -+ # binding to an address not on the device. The only restriction -+ # is that the address is valid in the L3 domain. So this test -+ # passes when it really should not - a=${VRF_IP6} - log_start -- run_cmd nettest -6 -s -l ${a} -d ${NSA_DEV} -t1 -b -- log_test_addr ${a} $? 1 "TCP socket bind to VRF address with device bind" -+ show_hint "Tecnically should fail since address is not on device but kernel allows" -+ run_cmd nettest -6 -s -l ${a} -I ${NSA_DEV} -t1 -b -+ log_test_addr ${a} $? 0 "TCP socket bind to VRF address with device bind" - - a=${NSA_LO_IP6} - log_start -diff --git a/tools/testing/selftests/net/forwarding/forwarding.config.sample b/tools/testing/selftests/net/forwarding/forwarding.config.sample -index e2adb533c8fcb..e71c61ee4cc67 100644 ---- a/tools/testing/selftests/net/forwarding/forwarding.config.sample -+++ b/tools/testing/selftests/net/forwarding/forwarding.config.sample -@@ -13,6 +13,8 @@ NETIFS[p5]=veth4 - NETIFS[p6]=veth5 - NETIFS[p7]=veth6 - NETIFS[p8]=veth7 -+NETIFS[p9]=veth8 -+NETIFS[p10]=veth9 - - ############################################################################## - # Defines diff --git a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.168-169.patch b/patch/kernel/archive/odroidxu4-5.4/patch-5.4.168-169.patch deleted file mode 100644 index 4d1e82964..000000000 --- a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.168-169.patch +++ /dev/null @@ -1,1471 +0,0 @@ -diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt -index b11e1fd95ee5f..e7f71df9daf1c 100644 ---- a/Documentation/admin-guide/kernel-parameters.txt -+++ b/Documentation/admin-guide/kernel-parameters.txt -@@ -2112,8 +2112,12 @@ - Default is 1 (enabled) - - kvm-intel.emulate_invalid_guest_state= -- [KVM,Intel] Enable emulation of invalid guest states -- Default is 0 (disabled) -+ [KVM,Intel] Disable emulation of invalid guest state. -+ Ignored if kvm-intel.enable_unrestricted_guest=1, as -+ guest state is never invalid for unrestricted guests. -+ This param doesn't apply to nested guests (L2), as KVM -+ never emulates invalid L2 guest state. -+ Default is 1 (enabled) - - kvm-intel.flexpriority= - [KVM,Intel] Disable FlexPriority feature (TPR shadow). -diff --git a/Documentation/hwmon/lm90.rst b/Documentation/hwmon/lm90.rst -index 953315987c06e..03851cbe637ce 100644 ---- a/Documentation/hwmon/lm90.rst -+++ b/Documentation/hwmon/lm90.rst -@@ -123,6 +123,18 @@ Supported chips: - - http://www.maxim-ic.com/quick_view2.cfm/qv_pk/3497 - -+ * Maxim MAX6654 -+ -+ Prefix: 'max6654' -+ -+ Addresses scanned: I2C 0x18, 0x19, 0x1a, 0x29, 0x2a, 0x2b, -+ -+ 0x4c, 0x4d and 0x4e -+ -+ Datasheet: Publicly available at the Maxim website -+ -+ https://www.maximintegrated.com/en/products/sensors/MAX6654.html -+ - * Maxim MAX6657 - - Prefix: 'max6657' -@@ -253,6 +265,16 @@ Supported chips: - - http://www.ti.com/litv/pdf/sbos686 - -+ * Texas Instruments TMP461 -+ -+ Prefix: 'tmp461' -+ -+ Addresses scanned: I2C 0x48 through 0x4F -+ -+ Datasheet: Publicly available at TI website -+ -+ https://www.ti.com/lit/gpn/tmp461 -+ - Author: Jean Delvare - - -@@ -301,6 +323,13 @@ ADT7461, ADT7461A, NCT1008: - * Extended temperature range (breaks compatibility) - * Lower resolution for remote temperature - -+MAX6654: -+ * Better local resolution -+ * Selectable address -+ * Remote sensor type selection -+ * Extended temperature range -+ * Extended resolution only available when conversion rate <= 1 Hz -+ - MAX6657 and MAX6658: - * Better local resolution - * Remote sensor type selection -@@ -336,8 +365,8 @@ SA56004X: - - All temperature values are given in degrees Celsius. Resolution - is 1.0 degree for the local temperature, 0.125 degree for the remote --temperature, except for the MAX6657, MAX6658 and MAX6659 which have a --resolution of 0.125 degree for both temperatures. -+temperature, except for the MAX6654, MAX6657, MAX6658 and MAX6659 which have -+a resolution of 0.125 degree for both temperatures. - - Each sensor has its own high and low limits, plus a critical limit. - Additionally, there is a relative hysteresis value common to both critical -diff --git a/Documentation/networking/bonding.txt b/Documentation/networking/bonding.txt -index e3abfbd32f71e..b020e6ce6dd49 100644 ---- a/Documentation/networking/bonding.txt -+++ b/Documentation/networking/bonding.txt -@@ -191,11 +191,12 @@ ad_actor_sys_prio - ad_actor_system - - In an AD system, this specifies the mac-address for the actor in -- protocol packet exchanges (LACPDUs). The value cannot be NULL or -- multicast. It is preferred to have the local-admin bit set for this -- mac but driver does not enforce it. If the value is not given then -- system defaults to using the masters' mac address as actors' system -- address. -+ protocol packet exchanges (LACPDUs). The value cannot be a multicast -+ address. If the all-zeroes MAC is specified, bonding will internally -+ use the MAC of the bond itself. It is preferred to have the -+ local-admin bit set for this mac but driver does not enforce it. If -+ the value is not given then system defaults to using the masters' -+ mac address as actors' system address. - - This parameter has effect only in 802.3ad mode and is available through - SysFs interface. -diff --git a/Makefile b/Makefile -index c23f5b17d239f..151fd24540125 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 5 - PATCHLEVEL = 4 --SUBLEVEL = 168 -+SUBLEVEL = 169 - EXTRAVERSION = - NAME = Kleptomaniac Octopus - -diff --git a/arch/arm/kernel/entry-armv.S b/arch/arm/kernel/entry-armv.S -index b62d74a2c73a5..4937d514318ec 100644 ---- a/arch/arm/kernel/entry-armv.S -+++ b/arch/arm/kernel/entry-armv.S -@@ -596,11 +596,9 @@ call_fpe: - tstne r0, #0x04000000 @ bit 26 set on both ARM and Thumb-2 - reteq lr - and r8, r0, #0x00000f00 @ mask out CP number -- THUMB( lsr r8, r8, #8 ) - mov r7, #1 -- add r6, r10, #TI_USED_CP -- ARM( strb r7, [r6, r8, lsr #8] ) @ set appropriate used_cp[] -- THUMB( strb r7, [r6, r8] ) @ set appropriate used_cp[] -+ add r6, r10, r8, lsr #8 @ add used_cp[] array offset first -+ strb r7, [r6, #TI_USED_CP] @ set appropriate used_cp[] - #ifdef CONFIG_IWMMXT - @ Test if we need to give access to iWMMXt coprocessors - ldr r5, [r10, #TI_FLAGS] -@@ -609,7 +607,7 @@ call_fpe: - bcs iwmmxt_task_enable - #endif - ARM( add pc, pc, r8, lsr #6 ) -- THUMB( lsl r8, r8, #2 ) -+ THUMB( lsr r8, r8, #6 ) - THUMB( add pc, r8 ) - nop - -diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-zero-plus.dts b/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-zero-plus.dts -index db6ea7b58999b..19f930f43936e 100644 ---- a/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-zero-plus.dts -+++ b/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-zero-plus.dts -@@ -72,7 +72,7 @@ - pinctrl-0 = <&emac_rgmii_pins>; - phy-supply = <®_gmac_3v3>; - phy-handle = <&ext_rgmii_phy>; -- phy-mode = "rgmii"; -+ phy-mode = "rgmii-id"; - status = "okay"; - }; - -diff --git a/arch/parisc/kernel/syscall.S b/arch/parisc/kernel/syscall.S -index a37814cb66c76..8b616aada6492 100644 ---- a/arch/parisc/kernel/syscall.S -+++ b/arch/parisc/kernel/syscall.S -@@ -478,7 +478,7 @@ lws_start: - extrd,u %r1,PSW_W_BIT,1,%r1 - /* sp must be aligned on 4, so deposit the W bit setting into - * the bottom of sp temporarily */ -- or,ev %r1,%r30,%r30 -+ or,od %r1,%r30,%r30 - - /* Clip LWS number to a 32-bit value for 32-bit processes */ - depdi 0, 31, 32, %r20 -diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h -index ea85f23d9e227..1ae7c20f54691 100644 ---- a/arch/x86/include/asm/pgtable.h -+++ b/arch/x86/include/asm/pgtable.h -@@ -1375,8 +1375,8 @@ static inline pmd_t pmd_swp_clear_soft_dirty(pmd_t pmd) - #endif - #endif - --#define PKRU_AD_BIT 0x1 --#define PKRU_WD_BIT 0x2 -+#define PKRU_AD_BIT 0x1u -+#define PKRU_WD_BIT 0x2u - #define PKRU_BITS_PER_PKEY 2 - - #ifdef CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS -diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c -index 8a93d5a494fff..ad2e6d55d4a59 100644 ---- a/drivers/char/ipmi/ipmi_msghandler.c -+++ b/drivers/char/ipmi/ipmi_msghandler.c -@@ -2938,7 +2938,7 @@ cleanup_bmc_device(struct kref *ref) - * with removing the device attributes while reading a device - * attribute. - */ -- schedule_work(&bmc->remove_work); -+ queue_work(remove_work_wq, &bmc->remove_work); - } - - /* -@@ -5156,22 +5156,27 @@ static int ipmi_init_msghandler(void) - if (initialized) - goto out; - -- init_srcu_struct(&ipmi_interfaces_srcu); -- -- timer_setup(&ipmi_timer, ipmi_timeout, 0); -- mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES); -- -- atomic_notifier_chain_register(&panic_notifier_list, &panic_block); -+ rv = init_srcu_struct(&ipmi_interfaces_srcu); -+ if (rv) -+ goto out; - - remove_work_wq = create_singlethread_workqueue("ipmi-msghandler-remove-wq"); - if (!remove_work_wq) { - pr_err("unable to create ipmi-msghandler-remove-wq workqueue"); - rv = -ENOMEM; -- goto out; -+ goto out_wq; - } - -+ timer_setup(&ipmi_timer, ipmi_timeout, 0); -+ mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES); -+ -+ atomic_notifier_chain_register(&panic_notifier_list, &panic_block); -+ - initialized = true; - -+out_wq: -+ if (rv) -+ cleanup_srcu_struct(&ipmi_interfaces_srcu); - out: - mutex_unlock(&ipmi_interfaces_mutex); - return rv; -diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c -index 8ac390c2b5147..bb42a1c92cae5 100644 ---- a/drivers/char/ipmi/ipmi_ssif.c -+++ b/drivers/char/ipmi/ipmi_ssif.c -@@ -1704,6 +1704,9 @@ static int ssif_probe(struct i2c_client *client, const struct i2c_device_id *id) - } - } - -+ ssif_info->client = client; -+ i2c_set_clientdata(client, ssif_info); -+ - rv = ssif_check_and_remove(client, ssif_info); - /* If rv is 0 and addr source is not SI_ACPI, continue probing */ - if (!rv && ssif_info->addr_source == SI_ACPI) { -@@ -1724,9 +1727,6 @@ static int ssif_probe(struct i2c_client *client, const struct i2c_device_id *id) - ipmi_addr_src_to_str(ssif_info->addr_source), - client->addr, client->adapter->name, slave_addr); - -- ssif_info->client = client; -- i2c_set_clientdata(client, ssif_info); -- - /* Now check for system interface capabilities */ - msg[0] = IPMI_NETFN_APP_REQUEST << 2; - msg[1] = IPMI_GET_SYSTEM_INTERFACE_CAPABILITIES_CMD; -@@ -1926,6 +1926,7 @@ static int ssif_probe(struct i2c_client *client, const struct i2c_device_id *id) - - dev_err(&ssif_info->client->dev, - "Unable to start IPMI SSIF: %d\n", rv); -+ i2c_set_clientdata(client, NULL); - kfree(ssif_info); - } - kfree(resp); -diff --git a/drivers/hid/hid-holtek-mouse.c b/drivers/hid/hid-holtek-mouse.c -index b7172c48ef9f0..7c907939bfae1 100644 ---- a/drivers/hid/hid-holtek-mouse.c -+++ b/drivers/hid/hid-holtek-mouse.c -@@ -65,8 +65,23 @@ static __u8 *holtek_mouse_report_fixup(struct hid_device *hdev, __u8 *rdesc, - static int holtek_mouse_probe(struct hid_device *hdev, - const struct hid_device_id *id) - { -+ int ret; -+ - if (!hid_is_usb(hdev)) - return -EINVAL; -+ -+ ret = hid_parse(hdev); -+ if (ret) { -+ hid_err(hdev, "hid parse failed: %d\n", ret); -+ return ret; -+ } -+ -+ ret = hid_hw_start(hdev, HID_CONNECT_DEFAULT); -+ if (ret) { -+ hid_err(hdev, "hw start failed: %d\n", ret); -+ return ret; -+ } -+ - return 0; - } - -diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig -index 13a6b4afb4b36..049563d503b68 100644 ---- a/drivers/hwmon/Kconfig -+++ b/drivers/hwmon/Kconfig -@@ -1132,10 +1132,11 @@ config SENSORS_LM90 - help - If you say yes here you get support for National Semiconductor LM90, - LM86, LM89 and LM99, Analog Devices ADM1032, ADT7461, and ADT7461A, -- Maxim MAX6646, MAX6647, MAX6648, MAX6649, MAX6657, MAX6658, MAX6659, -- MAX6680, MAX6681, MAX6692, MAX6695, MAX6696, ON Semiconductor NCT1008, -- Winbond/Nuvoton W83L771W/G/AWG/ASG, Philips SA56004, GMT G781, and -- Texas Instruments TMP451 sensor chips. -+ Maxim MAX6646, MAX6647, MAX6648, MAX6649, MAX6654, MAX6657, MAX6658, -+ MAX6659, MAX6680, MAX6681, MAX6692, MAX6695, MAX6696, -+ ON Semiconductor NCT1008, Winbond/Nuvoton W83L771W/G/AWG/ASG, -+ Philips SA56004, GMT G781, Texas Instruments TMP451 and TMP461 -+ sensor chips. - - This driver can also be built as a module. If so, the module - will be called lm90. -diff --git a/drivers/hwmon/lm90.c b/drivers/hwmon/lm90.c -index 9b3c9f390ef81..9abb4507f572b 100644 ---- a/drivers/hwmon/lm90.c -+++ b/drivers/hwmon/lm90.c -@@ -35,6 +35,15 @@ - * explicitly as max6659, or if its address is not 0x4c. - * These chips lack the remote temperature offset feature. - * -+ * This driver also supports the MAX6654 chip made by Maxim. This chip can be -+ * at 9 different addresses, similar to MAX6680/MAX6681. The MAX6654 is similar -+ * to MAX6657/MAX6658/MAX6659, but does not support critical temperature -+ * limits. Extended range is available by setting the configuration register -+ * accordingly, and is done during initialization. Extended precision is only -+ * available at conversion rates of 1 Hz and slower. Note that extended -+ * precision is not enabled by default, as this driver initializes all chips -+ * to 2 Hz by design. -+ * - * This driver also supports the MAX6646, MAX6647, MAX6648, MAX6649 and - * MAX6692 chips made by Maxim. These are again similar to the LM86, - * but they use unsigned temperature values and can report temperatures -@@ -61,10 +70,10 @@ - * This driver also supports the G781 from GMT. This device is compatible - * with the ADM1032. - * -- * This driver also supports TMP451 from Texas Instruments. This device is -- * supported in both compatibility and extended mode. It's mostly compatible -- * with ADT7461 except for local temperature low byte register and max -- * conversion rate. -+ * This driver also supports TMP451 and TMP461 from Texas Instruments. -+ * Those devices are supported in both compatibility and extended mode. -+ * They are mostly compatible with ADT7461 except for local temperature -+ * low byte register and max conversion rate. - * - * Since the LM90 was the first chipset supported by this driver, most - * comments will refer to this chipset, but are actually general and -@@ -94,8 +103,8 @@ - * have address 0x4d. - * MAX6647 has address 0x4e. - * MAX6659 can have address 0x4c, 0x4d or 0x4e. -- * MAX6680 and MAX6681 can have address 0x18, 0x19, 0x1a, 0x29, 0x2a, 0x2b, -- * 0x4c, 0x4d or 0x4e. -+ * MAX6654, MAX6680, and MAX6681 can have address 0x18, 0x19, 0x1a, 0x29, -+ * 0x2a, 0x2b, 0x4c, 0x4d or 0x4e. - * SA56004 can have address 0x48 through 0x4F. - */ - -@@ -104,7 +113,7 @@ static const unsigned short normal_i2c[] = { - 0x4d, 0x4e, 0x4f, I2C_CLIENT_END }; - - enum chips { lm90, adm1032, lm99, lm86, max6657, max6659, adt7461, max6680, -- max6646, w83l771, max6696, sa56004, g781, tmp451 }; -+ max6646, w83l771, max6696, sa56004, g781, tmp451, tmp461, max6654 }; - - /* - * The LM90 registers -@@ -145,7 +154,7 @@ enum chips { lm90, adm1032, lm99, lm86, max6657, max6659, adt7461, max6680, - #define LM90_REG_R_TCRIT_HYST 0x21 - #define LM90_REG_W_TCRIT_HYST 0x21 - --/* MAX6646/6647/6649/6657/6658/6659/6695/6696 registers */ -+/* MAX6646/6647/6649/6654/6657/6658/6659/6695/6696 registers */ - - #define MAX6657_REG_R_LOCAL_TEMPL 0x11 - #define MAX6696_REG_R_STATUS2 0x12 -@@ -160,8 +169,12 @@ enum chips { lm90, adm1032, lm99, lm86, max6657, max6659, adt7461, max6680, - - #define LM90_MAX_CONVRATE_MS 16000 /* Maximum conversion rate in ms */ - --/* TMP451 registers */ -+/* TMP451/TMP461 registers */ - #define TMP451_REG_R_LOCAL_TEMPL 0x15 -+#define TMP451_REG_CONALERT 0x22 -+ -+#define TMP461_REG_CHEN 0x16 -+#define TMP461_REG_DFC 0x24 - - /* - * Device flags -@@ -174,7 +187,10 @@ enum chips { lm90, adm1032, lm99, lm86, max6657, max6659, adt7461, max6680, - #define LM90_HAVE_EMERGENCY_ALARM (1 << 5)/* emergency alarm */ - #define LM90_HAVE_TEMP3 (1 << 6) /* 3rd temperature sensor */ - #define LM90_HAVE_BROKEN_ALERT (1 << 7) /* Broken alert */ --#define LM90_PAUSE_FOR_CONFIG (1 << 8) /* Pause conversion for config */ -+#define LM90_HAVE_EXTENDED_TEMP (1 << 8) /* extended temperature support*/ -+#define LM90_PAUSE_FOR_CONFIG (1 << 9) /* Pause conversion for config */ -+#define LM90_HAVE_CRIT (1 << 10)/* Chip supports CRIT/OVERT register */ -+#define LM90_HAVE_CRIT_ALRM_SWP (1 << 11)/* critical alarm bits swapped */ - - /* LM90 status */ - #define LM90_STATUS_LTHRM (1 << 0) /* local THERM limit tripped */ -@@ -184,6 +200,7 @@ enum chips { lm90, adm1032, lm99, lm86, max6657, max6659, adt7461, max6680, - #define LM90_STATUS_RHIGH (1 << 4) /* remote high temp limit tripped */ - #define LM90_STATUS_LLOW (1 << 5) /* local low temp limit tripped */ - #define LM90_STATUS_LHIGH (1 << 6) /* local high temp limit tripped */ -+#define LM90_STATUS_BUSY (1 << 7) /* conversion is ongoing */ - - #define MAX6696_STATUS2_R2THRM (1 << 1) /* remote2 THERM limit tripped */ - #define MAX6696_STATUS2_R2OPEN (1 << 2) /* remote2 is an open circuit */ -@@ -209,6 +226,7 @@ static const struct i2c_device_id lm90_id[] = { - { "max6646", max6646 }, - { "max6647", max6646 }, - { "max6649", max6646 }, -+ { "max6654", max6654 }, - { "max6657", max6657 }, - { "max6658", max6657 }, - { "max6659", max6659 }, -@@ -220,6 +238,7 @@ static const struct i2c_device_id lm90_id[] = { - { "w83l771", w83l771 }, - { "sa56004", sa56004 }, - { "tmp451", tmp451 }, -+ { "tmp461", tmp461 }, - { } - }; - MODULE_DEVICE_TABLE(i2c, lm90_id); -@@ -269,6 +288,10 @@ static const struct of_device_id __maybe_unused lm90_of_match[] = { - .compatible = "dallas,max6649", - .data = (void *)max6646 - }, -+ { -+ .compatible = "dallas,max6654", -+ .data = (void *)max6654 -+ }, - { - .compatible = "dallas,max6657", - .data = (void *)max6657 -@@ -313,6 +336,10 @@ static const struct of_device_id __maybe_unused lm90_of_match[] = { - .compatible = "ti,tmp451", - .data = (void *)tmp451 - }, -+ { -+ .compatible = "ti,tmp461", -+ .data = (void *)tmp461 -+ }, - { }, - }; - MODULE_DEVICE_TABLE(of, lm90_of_match); -@@ -331,80 +358,98 @@ struct lm90_params { - static const struct lm90_params lm90_params[] = { - [adm1032] = { - .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT -- | LM90_HAVE_BROKEN_ALERT, -+ | LM90_HAVE_BROKEN_ALERT | LM90_HAVE_CRIT, - .alert_alarms = 0x7c, - .max_convrate = 10, - }, - [adt7461] = { - .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT -- | LM90_HAVE_BROKEN_ALERT, -+ | LM90_HAVE_BROKEN_ALERT | LM90_HAVE_EXTENDED_TEMP -+ | LM90_HAVE_CRIT, - .alert_alarms = 0x7c, - .max_convrate = 10, - }, - [g781] = { - .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT -- | LM90_HAVE_BROKEN_ALERT, -+ | LM90_HAVE_BROKEN_ALERT | LM90_HAVE_CRIT, - .alert_alarms = 0x7c, - .max_convrate = 8, - }, - [lm86] = { -- .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT, -+ .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT -+ | LM90_HAVE_CRIT, - .alert_alarms = 0x7b, - .max_convrate = 9, - }, - [lm90] = { -- .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT, -+ .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT -+ | LM90_HAVE_CRIT, - .alert_alarms = 0x7b, - .max_convrate = 9, - }, - [lm99] = { -- .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT, -+ .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT -+ | LM90_HAVE_CRIT, - .alert_alarms = 0x7b, - .max_convrate = 9, - }, - [max6646] = { -+ .flags = LM90_HAVE_CRIT, - .alert_alarms = 0x7c, - .max_convrate = 6, - .reg_local_ext = MAX6657_REG_R_LOCAL_TEMPL, - }, -+ [max6654] = { -+ .alert_alarms = 0x7c, -+ .max_convrate = 7, -+ .reg_local_ext = MAX6657_REG_R_LOCAL_TEMPL, -+ }, - [max6657] = { -- .flags = LM90_PAUSE_FOR_CONFIG, -+ .flags = LM90_PAUSE_FOR_CONFIG | LM90_HAVE_CRIT, - .alert_alarms = 0x7c, - .max_convrate = 8, - .reg_local_ext = MAX6657_REG_R_LOCAL_TEMPL, - }, - [max6659] = { -- .flags = LM90_HAVE_EMERGENCY, -+ .flags = LM90_HAVE_EMERGENCY | LM90_HAVE_CRIT, - .alert_alarms = 0x7c, - .max_convrate = 8, - .reg_local_ext = MAX6657_REG_R_LOCAL_TEMPL, - }, - [max6680] = { -- .flags = LM90_HAVE_OFFSET, -+ .flags = LM90_HAVE_OFFSET | LM90_HAVE_CRIT -+ | LM90_HAVE_CRIT_ALRM_SWP, - .alert_alarms = 0x7c, - .max_convrate = 7, - }, - [max6696] = { - .flags = LM90_HAVE_EMERGENCY -- | LM90_HAVE_EMERGENCY_ALARM | LM90_HAVE_TEMP3, -+ | LM90_HAVE_EMERGENCY_ALARM | LM90_HAVE_TEMP3 | LM90_HAVE_CRIT, - .alert_alarms = 0x1c7c, - .max_convrate = 6, - .reg_local_ext = MAX6657_REG_R_LOCAL_TEMPL, - }, - [w83l771] = { -- .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT, -+ .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT | LM90_HAVE_CRIT, - .alert_alarms = 0x7c, - .max_convrate = 8, - }, - [sa56004] = { -- .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT, -+ .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT | LM90_HAVE_CRIT, - .alert_alarms = 0x7b, - .max_convrate = 9, - .reg_local_ext = SA56004_REG_R_LOCAL_TEMPL, - }, - [tmp451] = { - .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT -- | LM90_HAVE_BROKEN_ALERT, -+ | LM90_HAVE_BROKEN_ALERT | LM90_HAVE_EXTENDED_TEMP | LM90_HAVE_CRIT, -+ .alert_alarms = 0x7c, -+ .max_convrate = 9, -+ .reg_local_ext = TMP451_REG_R_LOCAL_TEMPL, -+ }, -+ [tmp461] = { -+ .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT -+ | LM90_HAVE_BROKEN_ALERT | LM90_HAVE_EXTENDED_TEMP | LM90_HAVE_CRIT, - .alert_alarms = 0x7c, - .max_convrate = 9, - .reg_local_ext = TMP451_REG_R_LOCAL_TEMPL, -@@ -632,20 +677,22 @@ static int lm90_update_limits(struct device *dev) - struct i2c_client *client = data->client; - int val; - -- val = lm90_read_reg(client, LM90_REG_R_LOCAL_CRIT); -- if (val < 0) -- return val; -- data->temp8[LOCAL_CRIT] = val; -+ if (data->flags & LM90_HAVE_CRIT) { -+ val = lm90_read_reg(client, LM90_REG_R_LOCAL_CRIT); -+ if (val < 0) -+ return val; -+ data->temp8[LOCAL_CRIT] = val; - -- val = lm90_read_reg(client, LM90_REG_R_REMOTE_CRIT); -- if (val < 0) -- return val; -- data->temp8[REMOTE_CRIT] = val; -+ val = lm90_read_reg(client, LM90_REG_R_REMOTE_CRIT); -+ if (val < 0) -+ return val; -+ data->temp8[REMOTE_CRIT] = val; - -- val = lm90_read_reg(client, LM90_REG_R_TCRIT_HYST); -- if (val < 0) -- return val; -- data->temp_hyst = val; -+ val = lm90_read_reg(client, LM90_REG_R_TCRIT_HYST); -+ if (val < 0) -+ return val; -+ data->temp_hyst = val; -+ } - - val = lm90_read_reg(client, LM90_REG_R_REMOTE_LOWH); - if (val < 0) -@@ -773,7 +820,7 @@ static int lm90_update_device(struct device *dev) - val = lm90_read_reg(client, LM90_REG_R_STATUS); - if (val < 0) - return val; -- data->alarms = val; /* lower 8 bit of alarms */ -+ data->alarms = val & ~LM90_STATUS_BUSY; - - if (data->kind == max6696) { - val = lm90_select_remote_channel(data, 1); -@@ -979,7 +1026,7 @@ static int lm90_get_temp11(struct lm90_data *data, int index) - s16 temp11 = data->temp11[index]; - int temp; - -- if (data->kind == adt7461 || data->kind == tmp451) -+ if (data->flags & LM90_HAVE_EXTENDED_TEMP) - temp = temp_from_u16_adt7461(data, temp11); - else if (data->kind == max6646) - temp = temp_from_u16(temp11); -@@ -1013,7 +1060,7 @@ static int lm90_set_temp11(struct lm90_data *data, int index, long val) - if (data->kind == lm99 && index <= 2) - val -= 16000; - -- if (data->kind == adt7461 || data->kind == tmp451) -+ if (data->flags & LM90_HAVE_EXTENDED_TEMP) - data->temp11[index] = temp_to_u16_adt7461(data, val); - else if (data->kind == max6646) - data->temp11[index] = temp_to_u8(val) << 8; -@@ -1040,7 +1087,7 @@ static int lm90_get_temp8(struct lm90_data *data, int index) - s8 temp8 = data->temp8[index]; - int temp; - -- if (data->kind == adt7461 || data->kind == tmp451) -+ if (data->flags & LM90_HAVE_EXTENDED_TEMP) - temp = temp_from_u8_adt7461(data, temp8); - else if (data->kind == max6646) - temp = temp_from_u8(temp8); -@@ -1073,7 +1120,7 @@ static int lm90_set_temp8(struct lm90_data *data, int index, long val) - if (data->kind == lm99 && index == 3) - val -= 16000; - -- if (data->kind == adt7461 || data->kind == tmp451) -+ if (data->flags & LM90_HAVE_EXTENDED_TEMP) - data->temp8[index] = temp_to_u8_adt7461(data, val); - else if (data->kind == max6646) - data->temp8[index] = temp_to_u8(val); -@@ -1091,7 +1138,7 @@ static int lm90_get_temphyst(struct lm90_data *data, int index) - { - int temp; - -- if (data->kind == adt7461 || data->kind == tmp451) -+ if (data->flags & LM90_HAVE_EXTENDED_TEMP) - temp = temp_from_u8_adt7461(data, data->temp8[index]); - else if (data->kind == max6646) - temp = temp_from_u8(data->temp8[index]); -@@ -1111,7 +1158,7 @@ static int lm90_set_temphyst(struct lm90_data *data, long val) - int temp; - int err; - -- if (data->kind == adt7461 || data->kind == tmp451) -+ if (data->flags & LM90_HAVE_EXTENDED_TEMP) - temp = temp_from_u8_adt7461(data, data->temp8[LOCAL_CRIT]); - else if (data->kind == max6646) - temp = temp_from_u8(data->temp8[LOCAL_CRIT]); -@@ -1147,6 +1194,7 @@ static const u8 lm90_temp_emerg_index[3] = { - static const u8 lm90_min_alarm_bits[3] = { 5, 3, 11 }; - static const u8 lm90_max_alarm_bits[3] = { 6, 4, 12 }; - static const u8 lm90_crit_alarm_bits[3] = { 0, 1, 9 }; -+static const u8 lm90_crit_alarm_bits_swapped[3] = { 1, 0, 9 }; - static const u8 lm90_emergency_alarm_bits[3] = { 15, 13, 14 }; - static const u8 lm90_fault_bits[3] = { 0, 2, 10 }; - -@@ -1172,7 +1220,10 @@ static int lm90_temp_read(struct device *dev, u32 attr, int channel, long *val) - *val = (data->alarms >> lm90_max_alarm_bits[channel]) & 1; - break; - case hwmon_temp_crit_alarm: -- *val = (data->alarms >> lm90_crit_alarm_bits[channel]) & 1; -+ if (data->flags & LM90_HAVE_CRIT_ALRM_SWP) -+ *val = (data->alarms >> lm90_crit_alarm_bits_swapped[channel]) & 1; -+ else -+ *val = (data->alarms >> lm90_crit_alarm_bits[channel]) & 1; - break; - case hwmon_temp_emergency_alarm: - *val = (data->alarms >> lm90_emergency_alarm_bits[channel]) & 1; -@@ -1420,12 +1471,11 @@ static int lm90_detect(struct i2c_client *client, - if (man_id < 0 || chip_id < 0 || config1 < 0 || convrate < 0) - return -ENODEV; - -- if (man_id == 0x01 || man_id == 0x5C || man_id == 0x41) { -+ if (man_id == 0x01 || man_id == 0x5C || man_id == 0xA1) { - config2 = i2c_smbus_read_byte_data(client, LM90_REG_R_CONFIG2); - if (config2 < 0) - return -ENODEV; -- } else -- config2 = 0; /* Make compiler happy */ -+ } - - if ((address == 0x4C || address == 0x4D) - && man_id == 0x01) { /* National Semiconductor */ -@@ -1557,6 +1607,16 @@ static int lm90_detect(struct i2c_client *client, - && (config1 & 0x3f) == 0x00 - && convrate <= 0x07) { - name = "max6646"; -+ } else -+ /* -+ * The chip_id of the MAX6654 holds the revision of the chip. -+ * The lowest 3 bits of the config1 register are unused and -+ * should return zero when read. -+ */ -+ if (chip_id == 0x08 -+ && (config1 & 0x07) == 0x00 -+ && convrate <= 0x07) { -+ name = "max6654"; - } - } else - if (address == 0x4C -@@ -1589,18 +1649,26 @@ static int lm90_detect(struct i2c_client *client, - && convrate <= 0x08) - name = "g781"; - } else -- if (address == 0x4C -- && man_id == 0x55) { /* Texas Instruments */ -- int local_ext; -+ if (man_id == 0x55 && chip_id == 0x00 && -+ (config1 & 0x1B) == 0x00 && convrate <= 0x09) { -+ int local_ext, conalert, chen, dfc; - - local_ext = i2c_smbus_read_byte_data(client, - TMP451_REG_R_LOCAL_TEMPL); -- -- if (chip_id == 0x00 /* TMP451 */ -- && (config1 & 0x1B) == 0x00 -- && convrate <= 0x09 -- && (local_ext & 0x0F) == 0x00) -- name = "tmp451"; -+ conalert = i2c_smbus_read_byte_data(client, -+ TMP451_REG_CONALERT); -+ chen = i2c_smbus_read_byte_data(client, TMP461_REG_CHEN); -+ dfc = i2c_smbus_read_byte_data(client, TMP461_REG_DFC); -+ -+ if ((local_ext & 0x0F) == 0x00 && -+ (conalert & 0xf1) == 0x01 && -+ (chen & 0xfc) == 0x00 && -+ (dfc & 0xfc) == 0x00) { -+ if (address == 0x4c && !(chen & 0x03)) -+ name = "tmp451"; -+ else if (address >= 0x48 && address <= 0x4f) -+ name = "tmp461"; -+ } - } - - if (!name) { /* identification failed */ -@@ -1647,7 +1715,7 @@ static int lm90_init_client(struct i2c_client *client, struct lm90_data *data) - lm90_set_convrate(client, data, 500); /* 500ms; 2Hz conversion rate */ - - /* Check Temperature Range Select */ -- if (data->kind == adt7461 || data->kind == tmp451) { -+ if (data->flags & LM90_HAVE_EXTENDED_TEMP) { - if (config & 0x04) - data->flags |= LM90_FLAG_ADT7461_EXT; - } -@@ -1660,6 +1728,15 @@ static int lm90_init_client(struct i2c_client *client, struct lm90_data *data) - if (data->kind == max6680) - config |= 0x18; - -+ /* -+ * Put MAX6654 into extended range (0x20, extend minimum range from -+ * 0 degrees to -64 degrees). Note that extended resolution is not -+ * possible on the MAX6654 unless conversion rate is set to 1 Hz or -+ * slower, which is intentionally not done by default. -+ */ -+ if (data->kind == max6654) -+ config |= 0x20; -+ - /* - * Select external channel 0 for max6695/96 - */ -@@ -1806,11 +1883,14 @@ static int lm90_probe(struct i2c_client *client, - info->config = data->channel_config; - - data->channel_config[0] = HWMON_T_INPUT | HWMON_T_MIN | HWMON_T_MAX | -- HWMON_T_CRIT | HWMON_T_CRIT_HYST | HWMON_T_MIN_ALARM | -- HWMON_T_MAX_ALARM | HWMON_T_CRIT_ALARM; -+ HWMON_T_MIN_ALARM | HWMON_T_MAX_ALARM; - data->channel_config[1] = HWMON_T_INPUT | HWMON_T_MIN | HWMON_T_MAX | -- HWMON_T_CRIT | HWMON_T_CRIT_HYST | HWMON_T_MIN_ALARM | -- HWMON_T_MAX_ALARM | HWMON_T_CRIT_ALARM | HWMON_T_FAULT; -+ HWMON_T_MIN_ALARM | HWMON_T_MAX_ALARM | HWMON_T_FAULT; -+ -+ if (data->flags & LM90_HAVE_CRIT) { -+ data->channel_config[0] |= HWMON_T_CRIT | HWMON_T_CRIT_ALARM | HWMON_T_CRIT_HYST; -+ data->channel_config[1] |= HWMON_T_CRIT | HWMON_T_CRIT_ALARM | HWMON_T_CRIT_HYST; -+ } - - if (data->flags & LM90_HAVE_OFFSET) - data->channel_config[1] |= HWMON_T_OFFSET; -diff --git a/drivers/infiniband/hw/qib/qib_user_sdma.c b/drivers/infiniband/hw/qib/qib_user_sdma.c -index 5fd28574124fb..fde848b00202b 100644 ---- a/drivers/infiniband/hw/qib/qib_user_sdma.c -+++ b/drivers/infiniband/hw/qib/qib_user_sdma.c -@@ -941,7 +941,7 @@ static int qib_user_sdma_queue_pkts(const struct qib_devdata *dd, - &addrlimit) || - addrlimit > type_max(typeof(pkt->addrlimit))) { - ret = -EINVAL; -- goto free_pbc; -+ goto free_pkt; - } - pkt->addrlimit = addrlimit; - -diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c -index 0b5ed963cb0e1..3e78c26025815 100644 ---- a/drivers/input/mouse/elantech.c -+++ b/drivers/input/mouse/elantech.c -@@ -1588,7 +1588,13 @@ static const struct dmi_system_id no_hw_res_dmi_table[] = { - */ - static int elantech_change_report_id(struct psmouse *psmouse) - { -- unsigned char param[2] = { 0x10, 0x03 }; -+ /* -+ * NOTE: the code is expecting to receive param[] as an array of 3 -+ * items (see __ps2_command()), even if in this case only 2 are -+ * actually needed. Make sure the array size is 3 to avoid potential -+ * stack out-of-bound accesses. -+ */ -+ unsigned char param[3] = { 0x10, 0x03 }; - - if (elantech_write_reg_params(psmouse, 0x7, param) || - elantech_read_reg_params(psmouse, 0x7, param) || -diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c b/drivers/input/touchscreen/atmel_mxt_ts.c -index ae60442efda0d..fb31a9d43162b 100644 ---- a/drivers/input/touchscreen/atmel_mxt_ts.c -+++ b/drivers/input/touchscreen/atmel_mxt_ts.c -@@ -1794,7 +1794,7 @@ static int mxt_read_info_block(struct mxt_data *data) - if (error) { - dev_err(&client->dev, "Error %d parsing object table\n", error); - mxt_free_object_table(data); -- goto err_free_mem; -+ return error; - } - - data->object_table = (struct mxt_object *)(id_buf + MXT_OBJECT_START); -diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c -index 8f94c25395080..d7bda1fa0a6e2 100644 ---- a/drivers/mmc/core/core.c -+++ b/drivers/mmc/core/core.c -@@ -2364,7 +2364,7 @@ void mmc_start_host(struct mmc_host *host) - _mmc_detect_change(host, 0, false); - } - --void mmc_stop_host(struct mmc_host *host) -+void __mmc_stop_host(struct mmc_host *host) - { - if (host->slot.cd_irq >= 0) { - mmc_gpio_set_cd_wake(host, false); -@@ -2373,6 +2373,11 @@ void mmc_stop_host(struct mmc_host *host) - - host->rescan_disable = 1; - cancel_delayed_work_sync(&host->detect); -+} -+ -+void mmc_stop_host(struct mmc_host *host) -+{ -+ __mmc_stop_host(host); - - /* clear pm flags now and let card drivers set them as needed */ - host->pm_flags = 0; -diff --git a/drivers/mmc/core/core.h b/drivers/mmc/core/core.h -index db3c9c68875d8..a6c814fdbf0a9 100644 ---- a/drivers/mmc/core/core.h -+++ b/drivers/mmc/core/core.h -@@ -69,6 +69,7 @@ static inline void mmc_delay(unsigned int ms) - - void mmc_rescan(struct work_struct *work); - void mmc_start_host(struct mmc_host *host); -+void __mmc_stop_host(struct mmc_host *host); - void mmc_stop_host(struct mmc_host *host); - - void _mmc_detect_change(struct mmc_host *host, unsigned long delay, -diff --git a/drivers/mmc/core/host.c b/drivers/mmc/core/host.c -index f7339590a84c8..e955f1ef25643 100644 ---- a/drivers/mmc/core/host.c -+++ b/drivers/mmc/core/host.c -@@ -76,9 +76,18 @@ static void mmc_host_classdev_release(struct device *dev) - kfree(host); - } - -+static int mmc_host_classdev_shutdown(struct device *dev) -+{ -+ struct mmc_host *host = cls_dev_to_mmc_host(dev); -+ -+ __mmc_stop_host(host); -+ return 0; -+} -+ - static struct class mmc_host_class = { - .name = "mmc_host", - .dev_release = mmc_host_classdev_release, -+ .shutdown_pre = mmc_host_classdev_shutdown, - .pm = MMC_HOST_CLASS_DEV_PM_OPS, - }; - -diff --git a/drivers/mmc/host/sdhci-tegra.c b/drivers/mmc/host/sdhci-tegra.c -index c105356ad4cb7..65dfe75120ed6 100644 ---- a/drivers/mmc/host/sdhci-tegra.c -+++ b/drivers/mmc/host/sdhci-tegra.c -@@ -340,23 +340,6 @@ static void tegra_sdhci_set_tap(struct sdhci_host *host, unsigned int tap) - } - } - --static void tegra_sdhci_hs400_enhanced_strobe(struct mmc_host *mmc, -- struct mmc_ios *ios) --{ -- struct sdhci_host *host = mmc_priv(mmc); -- u32 val; -- -- val = sdhci_readl(host, SDHCI_TEGRA_VENDOR_SYS_SW_CTRL); -- -- if (ios->enhanced_strobe) -- val |= SDHCI_TEGRA_SYS_SW_CTRL_ENHANCED_STROBE; -- else -- val &= ~SDHCI_TEGRA_SYS_SW_CTRL_ENHANCED_STROBE; -- -- sdhci_writel(host, val, SDHCI_TEGRA_VENDOR_SYS_SW_CTRL); -- --} -- - static void tegra_sdhci_reset(struct sdhci_host *host, u8 mask) - { - struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host); -@@ -768,6 +751,32 @@ static void tegra_sdhci_set_clock(struct sdhci_host *host, unsigned int clock) - } - } - -+static void tegra_sdhci_hs400_enhanced_strobe(struct mmc_host *mmc, -+ struct mmc_ios *ios) -+{ -+ struct sdhci_host *host = mmc_priv(mmc); -+ u32 val; -+ -+ val = sdhci_readl(host, SDHCI_TEGRA_VENDOR_SYS_SW_CTRL); -+ -+ if (ios->enhanced_strobe) { -+ val |= SDHCI_TEGRA_SYS_SW_CTRL_ENHANCED_STROBE; -+ /* -+ * When CMD13 is sent from mmc_select_hs400es() after -+ * switching to HS400ES mode, the bus is operating at -+ * either MMC_HIGH_26_MAX_DTR or MMC_HIGH_52_MAX_DTR. -+ * To meet Tegra SDHCI requirement at HS400ES mode, force SDHCI -+ * interface clock to MMC_HS200_MAX_DTR (200 MHz) so that host -+ * controller CAR clock and the interface clock are rate matched. -+ */ -+ tegra_sdhci_set_clock(host, MMC_HS200_MAX_DTR); -+ } else { -+ val &= ~SDHCI_TEGRA_SYS_SW_CTRL_ENHANCED_STROBE; -+ } -+ -+ sdhci_writel(host, val, SDHCI_TEGRA_VENDOR_SYS_SW_CTRL); -+} -+ - static unsigned int tegra_sdhci_get_max_clock(struct sdhci_host *host) - { - struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host); -diff --git a/drivers/net/bonding/bond_options.c b/drivers/net/bonding/bond_options.c -index 215c109232893..933087d85549a 100644 ---- a/drivers/net/bonding/bond_options.c -+++ b/drivers/net/bonding/bond_options.c -@@ -1452,7 +1452,7 @@ static int bond_option_ad_actor_system_set(struct bonding *bond, - mac = (u8 *)&newval->value; - } - -- if (!is_valid_ether_addr(mac)) -+ if (is_multicast_ether_addr(mac)) - goto err; - - netdev_dbg(bond->dev, "Setting ad_actor_system to %pM\n", mac); -diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov.h -index 5f327659efa7a..85b688f60b876 100644 ---- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov.h -+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov.h -@@ -202,7 +202,7 @@ int qlcnic_sriov_get_vf_vport_info(struct qlcnic_adapter *, - struct qlcnic_info *, u16); - int qlcnic_sriov_cfg_vf_guest_vlan(struct qlcnic_adapter *, u16, u8); - void qlcnic_sriov_free_vlans(struct qlcnic_adapter *); --void qlcnic_sriov_alloc_vlans(struct qlcnic_adapter *); -+int qlcnic_sriov_alloc_vlans(struct qlcnic_adapter *); - bool qlcnic_sriov_check_any_vlan(struct qlcnic_vf_info *); - void qlcnic_sriov_del_vlan_id(struct qlcnic_sriov *, - struct qlcnic_vf_info *, u16); -diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c -index f7c2f32237cb0..400bc2c3f222e 100644 ---- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c -+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c -@@ -433,7 +433,7 @@ static int qlcnic_sriov_set_guest_vlan_mode(struct qlcnic_adapter *adapter, - struct qlcnic_cmd_args *cmd) - { - struct qlcnic_sriov *sriov = adapter->ahw->sriov; -- int i, num_vlans; -+ int i, num_vlans, ret; - u16 *vlans; - - if (sriov->allowed_vlans) -@@ -444,7 +444,9 @@ static int qlcnic_sriov_set_guest_vlan_mode(struct qlcnic_adapter *adapter, - dev_info(&adapter->pdev->dev, "Number of allowed Guest VLANs = %d\n", - sriov->num_allowed_vlans); - -- qlcnic_sriov_alloc_vlans(adapter); -+ ret = qlcnic_sriov_alloc_vlans(adapter); -+ if (ret) -+ return ret; - - if (!sriov->any_vlan) - return 0; -@@ -2160,7 +2162,7 @@ static int qlcnic_sriov_vf_resume(struct qlcnic_adapter *adapter) - return err; - } - --void qlcnic_sriov_alloc_vlans(struct qlcnic_adapter *adapter) -+int qlcnic_sriov_alloc_vlans(struct qlcnic_adapter *adapter) - { - struct qlcnic_sriov *sriov = adapter->ahw->sriov; - struct qlcnic_vf_info *vf; -@@ -2170,7 +2172,11 @@ void qlcnic_sriov_alloc_vlans(struct qlcnic_adapter *adapter) - vf = &sriov->vf_info[i]; - vf->sriov_vlans = kcalloc(sriov->num_allowed_vlans, - sizeof(*vf->sriov_vlans), GFP_KERNEL); -+ if (!vf->sriov_vlans) -+ return -ENOMEM; - } -+ -+ return 0; - } - - void qlcnic_sriov_free_vlans(struct qlcnic_adapter *adapter) -diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c -index 5632da05145a5..ed218ed2f466d 100644 ---- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c -+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c -@@ -598,7 +598,9 @@ static int __qlcnic_pci_sriov_enable(struct qlcnic_adapter *adapter, - if (err) - goto del_flr_queue; - -- qlcnic_sriov_alloc_vlans(adapter); -+ err = qlcnic_sriov_alloc_vlans(adapter); -+ if (err) -+ goto del_flr_queue; - - return err; - -diff --git a/drivers/net/ethernet/sfc/falcon/rx.c b/drivers/net/ethernet/sfc/falcon/rx.c -index 05ea3523890a9..d516f81ab37a7 100644 ---- a/drivers/net/ethernet/sfc/falcon/rx.c -+++ b/drivers/net/ethernet/sfc/falcon/rx.c -@@ -726,7 +726,10 @@ static void ef4_init_rx_recycle_ring(struct ef4_nic *efx, - efx->rx_bufs_per_page); - rx_queue->page_ring = kcalloc(page_ring_size, - sizeof(*rx_queue->page_ring), GFP_KERNEL); -- rx_queue->page_ptr_mask = page_ring_size - 1; -+ if (!rx_queue->page_ring) -+ rx_queue->page_ptr_mask = 0; -+ else -+ rx_queue->page_ptr_mask = page_ring_size - 1; - } - - void ef4_init_rx_queue(struct ef4_rx_queue *rx_queue) -diff --git a/drivers/net/ethernet/smsc/smc911x.c b/drivers/net/ethernet/smsc/smc911x.c -index 7b65e79d6ae91..82ca29b6781b2 100644 ---- a/drivers/net/ethernet/smsc/smc911x.c -+++ b/drivers/net/ethernet/smsc/smc911x.c -@@ -2069,6 +2069,11 @@ static int smc911x_drv_probe(struct platform_device *pdev) - - ndev->dma = (unsigned char)-1; - ndev->irq = platform_get_irq(pdev, 0); -+ if (ndev->irq < 0) { -+ ret = ndev->irq; -+ goto release_both; -+ } -+ - lp = netdev_priv(ndev); - lp->netdev = ndev; - #ifdef SMC_DYNAMIC_BUS_CONFIG -diff --git a/drivers/net/fjes/fjes_main.c b/drivers/net/fjes/fjes_main.c -index b89b4a3800a4d..bef0133696c31 100644 ---- a/drivers/net/fjes/fjes_main.c -+++ b/drivers/net/fjes/fjes_main.c -@@ -1269,6 +1269,11 @@ static int fjes_probe(struct platform_device *plat_dev) - hw->hw_res.start = res->start; - hw->hw_res.size = resource_size(res); - hw->hw_res.irq = platform_get_irq(plat_dev, 0); -+ if (hw->hw_res.irq < 0) { -+ err = hw->hw_res.irq; -+ goto err_free_control_wq; -+ } -+ - err = fjes_hw_init(&adapter->hw); - if (err) - goto err_free_control_wq; -diff --git a/drivers/net/hamradio/mkiss.c b/drivers/net/hamradio/mkiss.c -index 352f9e75954ce..d2eb33f53993b 100644 ---- a/drivers/net/hamradio/mkiss.c -+++ b/drivers/net/hamradio/mkiss.c -@@ -793,13 +793,14 @@ static void mkiss_close(struct tty_struct *tty) - */ - netif_stop_queue(ax->dev); - -- /* Free all AX25 frame buffers. */ -+ unregister_netdev(ax->dev); -+ -+ /* Free all AX25 frame buffers after unreg. */ - kfree(ax->rbuff); - kfree(ax->xbuff); - - ax->tty = NULL; - -- unregister_netdev(ax->dev); - free_netdev(ax->dev); - } - -diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c -index 2d98373f7a71d..ce3c8f476d75c 100644 ---- a/drivers/net/usb/lan78xx.c -+++ b/drivers/net/usb/lan78xx.c -@@ -64,6 +64,8 @@ - #define LAN7801_USB_PRODUCT_ID (0x7801) - #define LAN78XX_EEPROM_MAGIC (0x78A5) - #define LAN78XX_OTP_MAGIC (0x78F3) -+#define AT29M2AF_USB_VENDOR_ID (0x07C9) -+#define AT29M2AF_USB_PRODUCT_ID (0x0012) - - #define MII_READ 1 - #define MII_WRITE 0 -@@ -4153,6 +4155,10 @@ static const struct usb_device_id products[] = { - /* LAN7801 USB Gigabit Ethernet Device */ - USB_DEVICE(LAN78XX_USB_VENDOR_ID, LAN7801_USB_PRODUCT_ID), - }, -+ { -+ /* ATM2-AF USB Gigabit Ethernet Device */ -+ USB_DEVICE(AT29M2AF_USB_VENDOR_ID, AT29M2AF_USB_PRODUCT_ID), -+ }, - {}, - }; - MODULE_DEVICE_TABLE(usb, products); -diff --git a/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c b/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c -index 20e1c890e73b3..c3e6f3c1b4743 100644 ---- a/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c -+++ b/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c -@@ -236,8 +236,12 @@ static int mtk_xt_get_gpio_n(void *data, unsigned long eint_n, - desc = (const struct mtk_pin_desc *)hw->soc->pins; - *gpio_chip = &hw->chip; - -- /* Be greedy to guess first gpio_n is equal to eint_n */ -- if (desc[eint_n].eint.eint_n == eint_n) -+ /* -+ * Be greedy to guess first gpio_n is equal to eint_n. -+ * Only eint virtual eint number is greater than gpio number. -+ */ -+ if (hw->soc->npins > eint_n && -+ desc[eint_n].eint.eint_n == eint_n) - *gpio_n = eint_n; - else - *gpio_n = mtk_xt_find_eint_num(hw, eint_n); -diff --git a/drivers/pinctrl/stm32/pinctrl-stm32.c b/drivers/pinctrl/stm32/pinctrl-stm32.c -index 138cbc012cd89..f9abd4364fbaa 100644 ---- a/drivers/pinctrl/stm32/pinctrl-stm32.c -+++ b/drivers/pinctrl/stm32/pinctrl-stm32.c -@@ -1186,10 +1186,10 @@ static int stm32_gpiolib_register_bank(struct stm32_pinctrl *pctl, - bank_nr = args.args[1] / STM32_GPIO_PINS_PER_BANK; - bank->gpio_chip.base = args.args[1]; - -- npins = args.args[2]; -- while (!of_parse_phandle_with_fixed_args(np, "gpio-ranges", 3, -- ++i, &args)) -- npins += args.args[2]; -+ /* get the last defined gpio line (offset + nb of pins) */ -+ npins = args.args[0] + args.args[2]; -+ while (!of_parse_phandle_with_fixed_args(np, "gpio-ranges", 3, ++i, &args)) -+ npins = max(npins, (int)(args.args[0] + args.args[2])); - } else { - bank_nr = pctl->nbanks; - bank->gpio_chip.base = bank_nr * STM32_GPIO_PINS_PER_BANK; -diff --git a/drivers/spi/spi-armada-3700.c b/drivers/spi/spi-armada-3700.c -index e450ee17787f0..4a4e2877414a1 100644 ---- a/drivers/spi/spi-armada-3700.c -+++ b/drivers/spi/spi-armada-3700.c -@@ -906,7 +906,7 @@ static int a3700_spi_probe(struct platform_device *pdev) - return 0; - - error_clk: -- clk_disable_unprepare(spi->clk); -+ clk_unprepare(spi->clk); - error: - spi_master_put(master); - out: -diff --git a/drivers/tee/optee/shm_pool.c b/drivers/tee/optee/shm_pool.c -index c41a9a501a6e9..fa75024f16f7f 100644 ---- a/drivers/tee/optee/shm_pool.c -+++ b/drivers/tee/optee/shm_pool.c -@@ -41,10 +41,8 @@ static int pool_op_alloc(struct tee_shm_pool_mgr *poolm, - goto err; - } - -- for (i = 0; i < nr_pages; i++) { -- pages[i] = page; -- page++; -- } -+ for (i = 0; i < nr_pages; i++) -+ pages[i] = page + i; - - shm->flags |= TEE_SHM_REGISTER; - rc = optee_shm_register(shm->ctx, shm, pages, nr_pages, -diff --git a/drivers/tty/serial/8250/8250_fintek.c b/drivers/tty/serial/8250/8250_fintek.c -index 31c91c2f8c6e7..e24161004ddc1 100644 ---- a/drivers/tty/serial/8250/8250_fintek.c -+++ b/drivers/tty/serial/8250/8250_fintek.c -@@ -285,24 +285,6 @@ static void fintek_8250_set_max_fifo(struct fintek_8250 *pdata) - } - } - --static void fintek_8250_goto_highspeed(struct uart_8250_port *uart, -- struct fintek_8250 *pdata) --{ -- sio_write_reg(pdata, LDN, pdata->index); -- -- switch (pdata->pid) { -- case CHIP_ID_F81866: /* set uart clock for high speed serial mode */ -- sio_write_mask_reg(pdata, F81866_UART_CLK, -- F81866_UART_CLK_MASK, -- F81866_UART_CLK_14_769MHZ); -- -- uart->port.uartclk = 921600 * 16; -- break; -- default: /* leave clock speed untouched */ -- break; -- } --} -- - static void fintek_8250_set_termios(struct uart_port *port, - struct ktermios *termios, - struct ktermios *old) -@@ -422,7 +404,6 @@ static int probe_setup_port(struct fintek_8250 *pdata, - - fintek_8250_set_irq_mode(pdata, level_mode); - fintek_8250_set_max_fifo(pdata); -- fintek_8250_goto_highspeed(uart, pdata); - - fintek_8250_exit_key(addr[i]); - -diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c -index 57da62e331848..271bd08f4a255 100644 ---- a/drivers/usb/gadget/function/u_ether.c -+++ b/drivers/usb/gadget/function/u_ether.c -@@ -860,19 +860,23 @@ int gether_register_netdev(struct net_device *net) - { - struct eth_dev *dev; - struct usb_gadget *g; -- struct sockaddr sa; - int status; - - if (!net->dev.parent) - return -EINVAL; - dev = netdev_priv(net); - g = dev->gadget; -+ -+ memcpy(net->dev_addr, dev->dev_mac, ETH_ALEN); -+ net->addr_assign_type = NET_ADDR_RANDOM; -+ - status = register_netdev(net); - if (status < 0) { - dev_dbg(&g->dev, "register_netdev failed, %d\n", status); - return status; - } else { - INFO(dev, "HOST MAC %pM\n", dev->host_mac); -+ INFO(dev, "MAC %pM\n", dev->dev_mac); - - /* two kinds of host-initiated state changes: - * - iff DATA transfer is active, carrier is "on" -@@ -880,15 +884,6 @@ int gether_register_netdev(struct net_device *net) - */ - netif_carrier_off(net); - } -- sa.sa_family = net->type; -- memcpy(sa.sa_data, dev->dev_mac, ETH_ALEN); -- rtnl_lock(); -- status = dev_set_mac_address(net, &sa, NULL); -- rtnl_unlock(); -- if (status) -- pr_warn("cannot set self ethernet address: %d\n", status); -- else -- INFO(dev, "MAC %pM\n", dev->dev_mac); - - return status; - } -diff --git a/fs/f2fs/xattr.c b/fs/f2fs/xattr.c -index 296b3189448a4..cf1bfed1e6621 100644 ---- a/fs/f2fs/xattr.c -+++ b/fs/f2fs/xattr.c -@@ -661,8 +661,17 @@ static int __f2fs_setxattr(struct inode *inode, int index, - } - - last = here; -- while (!IS_XATTR_LAST_ENTRY(last)) -+ while (!IS_XATTR_LAST_ENTRY(last)) { -+ if ((void *)(last) + sizeof(__u32) > last_base_addr || -+ (void *)XATTR_NEXT_ENTRY(last) > last_base_addr) { -+ f2fs_err(F2FS_I_SB(inode), "inode (%lu) has invalid last xattr entry, entry_size: %zu", -+ inode->i_ino, ENTRY_SIZE(last)); -+ set_sbi_flag(F2FS_I_SB(inode), SBI_NEED_FSCK); -+ error = -EFSCORRUPTED; -+ goto exit; -+ } - last = XATTR_NEXT_ENTRY(last); -+ } - - newsize = XATTR_ALIGN(sizeof(struct f2fs_xattr_entry) + len + size); - -diff --git a/include/linux/virtio_net.h b/include/linux/virtio_net.h -index 04e87f4b9417c..a960de68ac69e 100644 ---- a/include/linux/virtio_net.h -+++ b/include/linux/virtio_net.h -@@ -7,9 +7,27 @@ - #include - #include - -+static inline bool virtio_net_hdr_match_proto(__be16 protocol, __u8 gso_type) -+{ -+ switch (gso_type & ~VIRTIO_NET_HDR_GSO_ECN) { -+ case VIRTIO_NET_HDR_GSO_TCPV4: -+ return protocol == cpu_to_be16(ETH_P_IP); -+ case VIRTIO_NET_HDR_GSO_TCPV6: -+ return protocol == cpu_to_be16(ETH_P_IPV6); -+ case VIRTIO_NET_HDR_GSO_UDP: -+ return protocol == cpu_to_be16(ETH_P_IP) || -+ protocol == cpu_to_be16(ETH_P_IPV6); -+ default: -+ return false; -+ } -+} -+ - static inline int virtio_net_hdr_set_proto(struct sk_buff *skb, - const struct virtio_net_hdr *hdr) - { -+ if (skb->protocol) -+ return 0; -+ - switch (hdr->gso_type & ~VIRTIO_NET_HDR_GSO_ECN) { - case VIRTIO_NET_HDR_GSO_TCPV4: - case VIRTIO_NET_HDR_GSO_UDP: -@@ -88,9 +106,12 @@ static inline int virtio_net_hdr_to_skb(struct sk_buff *skb, - if (!skb->protocol) { - __be16 protocol = dev_parse_header_protocol(skb); - -- virtio_net_hdr_set_proto(skb, hdr); -- if (protocol && protocol != skb->protocol) -+ if (!protocol) -+ virtio_net_hdr_set_proto(skb, hdr); -+ else if (!virtio_net_hdr_match_proto(protocol, hdr->gso_type)) - return -EINVAL; -+ else -+ skb->protocol = protocol; - } - retry: - if (!skb_flow_dissect_flow_keys_basic(NULL, skb, &keys, -diff --git a/mm/mempolicy.c b/mm/mempolicy.c -index 87d165923fee2..2c4082f71d258 100644 ---- a/mm/mempolicy.c -+++ b/mm/mempolicy.c -@@ -2143,8 +2143,9 @@ alloc_pages_vma(gfp_t gfp, int order, struct vm_area_struct *vma, - * memory as well. - */ - if (!page && (gfp & __GFP_DIRECT_RECLAIM)) -- page = __alloc_pages_node(hpage_node, -- gfp | __GFP_NORETRY, order); -+ page = __alloc_pages_nodemask(gfp | __GFP_NORETRY, -+ order, hpage_node, -+ nmask); - - goto out; - } -diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c -index 2fdb1b573e8c8..1f84d41e22c36 100644 ---- a/net/ax25/af_ax25.c -+++ b/net/ax25/af_ax25.c -@@ -85,8 +85,10 @@ static void ax25_kill_by_device(struct net_device *dev) - again: - ax25_for_each(s, &ax25_list) { - if (s->ax25_dev == ax25_dev) { -- s->ax25_dev = NULL; - spin_unlock_bh(&ax25_list_lock); -+ lock_sock(s->sk); -+ s->ax25_dev = NULL; -+ release_sock(s->sk); - ax25_disconnect(s, ENETUNREACH); - spin_lock_bh(&ax25_list_lock); - -diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c -index 7ca2ca4bba055..b36af4741ad3c 100644 ---- a/net/netfilter/nfnetlink_log.c -+++ b/net/netfilter/nfnetlink_log.c -@@ -557,7 +557,8 @@ __build_packet_message(struct nfnl_log_net *log, - goto nla_put_failure; - - if (indev && skb->dev && -- skb->mac_header != skb->network_header) { -+ skb_mac_header_was_set(skb) && -+ skb_mac_header_len(skb) != 0) { - struct nfulnl_msg_packet_hw phw; - int len; - -diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c -index a8cb562da3fea..ca21f8f4a47c1 100644 ---- a/net/netfilter/nfnetlink_queue.c -+++ b/net/netfilter/nfnetlink_queue.c -@@ -562,7 +562,8 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue, - goto nla_put_failure; - - if (indev && entskb->dev && -- skb_mac_header_was_set(entskb)) { -+ skb_mac_header_was_set(entskb) && -+ skb_mac_header_len(entskb) != 0) { - struct nfqnl_msg_packet_hw phw; - int len; - -diff --git a/net/phonet/pep.c b/net/phonet/pep.c -index 4577e43cb7778..a07e13f63332c 100644 ---- a/net/phonet/pep.c -+++ b/net/phonet/pep.c -@@ -946,6 +946,8 @@ static int pep_ioctl(struct sock *sk, int cmd, unsigned long arg) - ret = -EBUSY; - else if (sk->sk_state == TCP_ESTABLISHED) - ret = -EISCONN; -+ else if (!pn->pn_sk.sobject) -+ ret = -EADDRNOTAVAIL; - else - ret = pep_sock_enable(sk, NULL, 0); - release_sock(sk); -diff --git a/sound/core/jack.c b/sound/core/jack.c -index fb26196571a7c..8b209750c7a9c 100644 ---- a/sound/core/jack.c -+++ b/sound/core/jack.c -@@ -220,6 +220,10 @@ int snd_jack_new(struct snd_card *card, const char *id, int type, - return -ENOMEM; - - jack->id = kstrdup(id, GFP_KERNEL); -+ if (jack->id == NULL) { -+ kfree(jack); -+ return -ENOMEM; -+ } - - /* don't creat input device for phantom jack */ - if (!phantom_jack) { -diff --git a/sound/drivers/opl3/opl3_midi.c b/sound/drivers/opl3/opl3_midi.c -index 280cc79870cf8..ce38ec09d4087 100644 ---- a/sound/drivers/opl3/opl3_midi.c -+++ b/sound/drivers/opl3/opl3_midi.c -@@ -398,7 +398,7 @@ void snd_opl3_note_on(void *p, int note, int vel, struct snd_midi_channel *chan) - } - if (instr_4op) { - vp2 = &opl3->voices[voice + 3]; -- if (vp->state > 0) { -+ if (vp2->state > 0) { - opl3_reg = reg_side | (OPL3_REG_KEYON_BLOCK + - voice_offset + 3); - reg_val = vp->keyon_reg & ~OPL3_KEYON_BIT; -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index 9514db7c2a86d..022799479a722 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -8101,6 +8101,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x103c, 0x84da, "HP OMEN dc0019-ur", ALC295_FIXUP_HP_OMEN), - SND_PCI_QUIRK(0x103c, 0x84e7, "HP Pavilion 15", ALC269_FIXUP_HP_MUTE_LED_MIC3), - SND_PCI_QUIRK(0x103c, 0x8519, "HP Spectre x360 15-df0xxx", ALC285_FIXUP_HP_SPECTRE_X360), -+ SND_PCI_QUIRK(0x103c, 0x860f, "HP ZBook 15 G6", ALC285_FIXUP_HP_GPIO_AMP_INIT), - SND_PCI_QUIRK(0x103c, 0x861f, "HP Elite Dragonfly G1", ALC285_FIXUP_HP_GPIO_AMP_INIT), - SND_PCI_QUIRK(0x103c, 0x869d, "HP", ALC236_FIXUP_HP_MUTE_LED), - SND_PCI_QUIRK(0x103c, 0x8724, "HP EliteBook 850 G7", ALC285_FIXUP_HP_GPIO_LED), diff --git a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.169-170.patch b/patch/kernel/archive/odroidxu4-5.4/patch-5.4.169-170.patch deleted file mode 100644 index e78f6fa05..000000000 --- a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.169-170.patch +++ /dev/null @@ -1,1469 +0,0 @@ -diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt -index e7f71df9daf1c..165abcb656c5b 100644 ---- a/Documentation/admin-guide/kernel-parameters.txt -+++ b/Documentation/admin-guide/kernel-parameters.txt -@@ -1487,6 +1487,8 @@ - architectures force reset to be always executed - i8042.unlock [HW] Unlock (ignore) the keylock - i8042.kbdreset [HW] Reset device connected to KBD port -+ i8042.probe_defer -+ [HW] Allow deferred probing upon i8042 probe errors - - i810= [HW,DRM] - -diff --git a/Makefile b/Makefile -index 151fd24540125..7380354e49513 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 5 - PATCHLEVEL = 4 --SUBLEVEL = 169 -+SUBLEVEL = 170 - EXTRAVERSION = - NAME = Kleptomaniac Octopus - -diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c -index 3526bb1488e5e..b5022a7f6bae1 100644 ---- a/drivers/android/binder_alloc.c -+++ b/drivers/android/binder_alloc.c -@@ -613,7 +613,7 @@ static void binder_free_buf_locked(struct binder_alloc *alloc, - BUG_ON(buffer->user_data > alloc->buffer + alloc->buffer_size); - - if (buffer->async_transaction) { -- alloc->free_async_space += size + sizeof(struct binder_buffer); -+ alloc->free_async_space += buffer_size + sizeof(struct binder_buffer); - - binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC_ASYNC, - "%d: binder_free_buf size %zd async free %zd\n", -diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig -index 0cfcfb116a03d..5169a38ee47a9 100644 ---- a/drivers/hid/Kconfig -+++ b/drivers/hid/Kconfig -@@ -149,6 +149,7 @@ config HID_APPLEIR - - config HID_ASUS - tristate "Asus" -+ depends on USB_HID - depends on LEDS_CLASS - depends on ASUS_WMI || ASUS_WMI=n - select POWER_SUPPLY -diff --git a/drivers/i2c/i2c-dev.c b/drivers/i2c/i2c-dev.c -index c9ae1895cd48a..7da6ca26a5f56 100644 ---- a/drivers/i2c/i2c-dev.c -+++ b/drivers/i2c/i2c-dev.c -@@ -536,6 +536,9 @@ static long compat_i2cdev_ioctl(struct file *file, unsigned int cmd, unsigned lo - sizeof(rdwr_arg))) - return -EFAULT; - -+ if (!rdwr_arg.msgs || rdwr_arg.nmsgs == 0) -+ return -EINVAL; -+ - if (rdwr_arg.nmsgs > I2C_RDWR_IOCTL_MAX_MSGS) - return -EINVAL; - -diff --git a/drivers/input/joystick/spaceball.c b/drivers/input/joystick/spaceball.c -index cf7cbcd0c29df..6971412990695 100644 ---- a/drivers/input/joystick/spaceball.c -+++ b/drivers/input/joystick/spaceball.c -@@ -19,6 +19,7 @@ - #include - #include - #include -+#include - - #define DRIVER_DESC "SpaceTec SpaceBall 2003/3003/4000 FLX driver" - -@@ -75,9 +76,15 @@ static void spaceball_process_packet(struct spaceball* spaceball) - - case 'D': /* Ball data */ - if (spaceball->idx != 15) return; -- for (i = 0; i < 6; i++) -+ /* -+ * Skip first three bytes; read six axes worth of data. -+ * Axis values are signed 16-bit big-endian. -+ */ -+ data += 3; -+ for (i = 0; i < ARRAY_SIZE(spaceball_axes); i++) { - input_report_abs(dev, spaceball_axes[i], -- (__s16)((data[2 * i + 3] << 8) | data[2 * i + 2])); -+ (__s16)get_unaligned_be16(&data[i * 2])); -+ } - break; - - case 'K': /* Button data */ -diff --git a/drivers/input/mouse/appletouch.c b/drivers/input/mouse/appletouch.c -index 3f06e8a495d80..ff94388416645 100644 ---- a/drivers/input/mouse/appletouch.c -+++ b/drivers/input/mouse/appletouch.c -@@ -916,6 +916,8 @@ static int atp_probe(struct usb_interface *iface, - set_bit(BTN_TOOL_TRIPLETAP, input_dev->keybit); - set_bit(BTN_LEFT, input_dev->keybit); - -+ INIT_WORK(&dev->work, atp_reinit); -+ - error = input_register_device(dev->input); - if (error) - goto err_free_buffer; -@@ -923,8 +925,6 @@ static int atp_probe(struct usb_interface *iface, - /* save our data pointer in this interface device */ - usb_set_intfdata(iface, dev); - -- INIT_WORK(&dev->work, atp_reinit); -- - return 0; - - err_free_buffer: -diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h -index 202e43a6ffae2..0282c4c55e9da 100644 ---- a/drivers/input/serio/i8042-x86ia64io.h -+++ b/drivers/input/serio/i8042-x86ia64io.h -@@ -995,6 +995,24 @@ static const struct dmi_system_id __initconst i8042_dmi_kbdreset_table[] = { - { } - }; - -+static const struct dmi_system_id i8042_dmi_probe_defer_table[] __initconst = { -+ { -+ /* ASUS ZenBook UX425UA */ -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), -+ DMI_MATCH(DMI_PRODUCT_NAME, "ZenBook UX425UA"), -+ }, -+ }, -+ { -+ /* ASUS ZenBook UM325UA */ -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), -+ DMI_MATCH(DMI_PRODUCT_NAME, "ZenBook UX325UA_UM325UA"), -+ }, -+ }, -+ { } -+}; -+ - #endif /* CONFIG_X86 */ - - #ifdef CONFIG_PNP -@@ -1314,6 +1332,9 @@ static int __init i8042_platform_init(void) - if (dmi_check_system(i8042_dmi_kbdreset_table)) - i8042_kbdreset = true; - -+ if (dmi_check_system(i8042_dmi_probe_defer_table)) -+ i8042_probe_defer = true; -+ - /* - * A20 was already enabled during early kernel init. But some buggy - * BIOSes (in MSI Laptops) require A20 to be enabled using 8042 to -diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c -index 6ff6b5710dd4e..bb76ff2f6b1d8 100644 ---- a/drivers/input/serio/i8042.c -+++ b/drivers/input/serio/i8042.c -@@ -44,6 +44,10 @@ static bool i8042_unlock; - module_param_named(unlock, i8042_unlock, bool, 0); - MODULE_PARM_DESC(unlock, "Ignore keyboard lock."); - -+static bool i8042_probe_defer; -+module_param_named(probe_defer, i8042_probe_defer, bool, 0); -+MODULE_PARM_DESC(probe_defer, "Allow deferred probing."); -+ - enum i8042_controller_reset_mode { - I8042_RESET_NEVER, - I8042_RESET_ALWAYS, -@@ -709,7 +713,7 @@ static int i8042_set_mux_mode(bool multiplex, unsigned char *mux_version) - * LCS/Telegraphics. - */ - --static int __init i8042_check_mux(void) -+static int i8042_check_mux(void) - { - unsigned char mux_version; - -@@ -738,10 +742,10 @@ static int __init i8042_check_mux(void) - /* - * The following is used to test AUX IRQ delivery. - */ --static struct completion i8042_aux_irq_delivered __initdata; --static bool i8042_irq_being_tested __initdata; -+static struct completion i8042_aux_irq_delivered; -+static bool i8042_irq_being_tested; - --static irqreturn_t __init i8042_aux_test_irq(int irq, void *dev_id) -+static irqreturn_t i8042_aux_test_irq(int irq, void *dev_id) - { - unsigned long flags; - unsigned char str, data; -@@ -768,7 +772,7 @@ static irqreturn_t __init i8042_aux_test_irq(int irq, void *dev_id) - * verifies success by readinng CTR. Used when testing for presence of AUX - * port. - */ --static int __init i8042_toggle_aux(bool on) -+static int i8042_toggle_aux(bool on) - { - unsigned char param; - int i; -@@ -796,7 +800,7 @@ static int __init i8042_toggle_aux(bool on) - * the presence of an AUX interface. - */ - --static int __init i8042_check_aux(void) -+static int i8042_check_aux(void) - { - int retval = -1; - bool irq_registered = false; -@@ -1003,7 +1007,7 @@ static int i8042_controller_init(void) - - if (i8042_command(&ctr[n++ % 2], I8042_CMD_CTL_RCTR)) { - pr_err("Can't read CTR while initializing i8042\n"); -- return -EIO; -+ return i8042_probe_defer ? -EPROBE_DEFER : -EIO; - } - - } while (n < 2 || ctr[0] != ctr[1]); -@@ -1318,7 +1322,7 @@ static void i8042_shutdown(struct platform_device *dev) - i8042_controller_reset(false); - } - --static int __init i8042_create_kbd_port(void) -+static int i8042_create_kbd_port(void) - { - struct serio *serio; - struct i8042_port *port = &i8042_ports[I8042_KBD_PORT_NO]; -@@ -1346,7 +1350,7 @@ static int __init i8042_create_kbd_port(void) - return 0; - } - --static int __init i8042_create_aux_port(int idx) -+static int i8042_create_aux_port(int idx) - { - struct serio *serio; - int port_no = idx < 0 ? I8042_AUX_PORT_NO : I8042_MUX_PORT_NO + idx; -@@ -1383,13 +1387,13 @@ static int __init i8042_create_aux_port(int idx) - return 0; - } - --static void __init i8042_free_kbd_port(void) -+static void i8042_free_kbd_port(void) - { - kfree(i8042_ports[I8042_KBD_PORT_NO].serio); - i8042_ports[I8042_KBD_PORT_NO].serio = NULL; - } - --static void __init i8042_free_aux_ports(void) -+static void i8042_free_aux_ports(void) - { - int i; - -@@ -1399,7 +1403,7 @@ static void __init i8042_free_aux_ports(void) - } - } - --static void __init i8042_register_ports(void) -+static void i8042_register_ports(void) - { - int i; - -@@ -1440,7 +1444,7 @@ static void i8042_free_irqs(void) - i8042_aux_irq_registered = i8042_kbd_irq_registered = false; - } - --static int __init i8042_setup_aux(void) -+static int i8042_setup_aux(void) - { - int (*aux_enable)(void); - int error; -@@ -1482,7 +1486,7 @@ static int __init i8042_setup_aux(void) - return error; - } - --static int __init i8042_setup_kbd(void) -+static int i8042_setup_kbd(void) - { - int error; - -@@ -1532,7 +1536,7 @@ static int i8042_kbd_bind_notifier(struct notifier_block *nb, - return 0; - } - --static int __init i8042_probe(struct platform_device *dev) -+static int i8042_probe(struct platform_device *dev) - { - int error; - -@@ -1597,6 +1601,7 @@ static struct platform_driver i8042_driver = { - .pm = &i8042_pm_ops, - #endif - }, -+ .probe = i8042_probe, - .remove = i8042_remove, - .shutdown = i8042_shutdown, - }; -@@ -1607,7 +1612,6 @@ static struct notifier_block i8042_kbd_bind_notifier_block = { - - static int __init i8042_init(void) - { -- struct platform_device *pdev; - int err; - - dbg_init(); -@@ -1623,17 +1627,29 @@ static int __init i8042_init(void) - /* Set this before creating the dev to allow i8042_command to work right away */ - i8042_present = true; - -- pdev = platform_create_bundle(&i8042_driver, i8042_probe, NULL, 0, NULL, 0); -- if (IS_ERR(pdev)) { -- err = PTR_ERR(pdev); -+ err = platform_driver_register(&i8042_driver); -+ if (err) - goto err_platform_exit; -+ -+ i8042_platform_device = platform_device_alloc("i8042", -1); -+ if (!i8042_platform_device) { -+ err = -ENOMEM; -+ goto err_unregister_driver; - } - -+ err = platform_device_add(i8042_platform_device); -+ if (err) -+ goto err_free_device; -+ - bus_register_notifier(&serio_bus, &i8042_kbd_bind_notifier_block); - panic_blink = i8042_panic_blink; - - return 0; - -+err_free_device: -+ platform_device_put(i8042_platform_device); -+err_unregister_driver: -+ platform_driver_unregister(&i8042_driver); - err_platform_exit: - i8042_platform_exit(); - return err; -diff --git a/drivers/net/ethernet/freescale/fman/fman_port.c b/drivers/net/ethernet/freescale/fman/fman_port.c -index 47f6fee1f3964..1812434cda847 100644 ---- a/drivers/net/ethernet/freescale/fman/fman_port.c -+++ b/drivers/net/ethernet/freescale/fman/fman_port.c -@@ -1791,7 +1791,7 @@ static int fman_port_probe(struct platform_device *of_dev) - fman = dev_get_drvdata(&fm_pdev->dev); - if (!fman) { - err = -EINVAL; -- goto return_err; -+ goto put_device; - } - - err = of_property_read_u32(port_node, "cell-index", &val); -@@ -1799,7 +1799,7 @@ static int fman_port_probe(struct platform_device *of_dev) - dev_err(port->dev, "%s: reading cell-index for %pOF failed\n", - __func__, port_node); - err = -EINVAL; -- goto return_err; -+ goto put_device; - } - port_id = (u8)val; - port->dts_params.id = port_id; -@@ -1833,7 +1833,7 @@ static int fman_port_probe(struct platform_device *of_dev) - } else { - dev_err(port->dev, "%s: Illegal port type\n", __func__); - err = -EINVAL; -- goto return_err; -+ goto put_device; - } - - port->dts_params.type = port_type; -@@ -1847,7 +1847,7 @@ static int fman_port_probe(struct platform_device *of_dev) - dev_err(port->dev, "%s: incorrect qman-channel-id\n", - __func__); - err = -EINVAL; -- goto return_err; -+ goto put_device; - } - port->dts_params.qman_channel_id = qman_channel_id; - } -@@ -1857,7 +1857,7 @@ static int fman_port_probe(struct platform_device *of_dev) - dev_err(port->dev, "%s: of_address_to_resource() failed\n", - __func__); - err = -ENOMEM; -- goto return_err; -+ goto put_device; - } - - port->dts_params.fman = fman; -@@ -1882,6 +1882,8 @@ static int fman_port_probe(struct platform_device *of_dev) - - return 0; - -+put_device: -+ put_device(&fm_pdev->dev); - return_err: - of_node_put(port_node); - free_port: -diff --git a/drivers/net/ethernet/lantiq_xrx200.c b/drivers/net/ethernet/lantiq_xrx200.c -index 6e504854571cf..94541bf889a23 100644 ---- a/drivers/net/ethernet/lantiq_xrx200.c -+++ b/drivers/net/ethernet/lantiq_xrx200.c -@@ -209,7 +209,7 @@ static int xrx200_hw_receive(struct xrx200_chan *ch) - skb->protocol = eth_type_trans(skb, net_dev); - netif_receive_skb(skb); - net_dev->stats.rx_packets++; -- net_dev->stats.rx_bytes += len - ETH_FCS_LEN; -+ net_dev->stats.rx_bytes += len; - - return 0; - } -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -index 5f4f0f61c83c8..dea884c94568c 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -@@ -3907,12 +3907,11 @@ static int set_feature_arfs(struct net_device *netdev, bool enable) - - static int mlx5e_handle_feature(struct net_device *netdev, - netdev_features_t *features, -- netdev_features_t wanted_features, - netdev_features_t feature, - mlx5e_feature_handler feature_handler) - { -- netdev_features_t changes = wanted_features ^ netdev->features; -- bool enable = !!(wanted_features & feature); -+ netdev_features_t changes = *features ^ netdev->features; -+ bool enable = !!(*features & feature); - int err; - - if (!(changes & feature)) -@@ -3920,22 +3919,22 @@ static int mlx5e_handle_feature(struct net_device *netdev, - - err = feature_handler(netdev, enable); - if (err) { -+ MLX5E_SET_FEATURE(features, feature, !enable); - netdev_err(netdev, "%s feature %pNF failed, err %d\n", - enable ? "Enable" : "Disable", &feature, err); - return err; - } - -- MLX5E_SET_FEATURE(features, feature, enable); - return 0; - } - - int mlx5e_set_features(struct net_device *netdev, netdev_features_t features) - { -- netdev_features_t oper_features = netdev->features; -+ netdev_features_t oper_features = features; - int err = 0; - - #define MLX5E_HANDLE_FEATURE(feature, handler) \ -- mlx5e_handle_feature(netdev, &oper_features, features, feature, handler) -+ mlx5e_handle_feature(netdev, &oper_features, feature, handler) - - err |= MLX5E_HANDLE_FEATURE(NETIF_F_LRO, set_feature_lro); - err |= MLX5E_HANDLE_FEATURE(NETIF_F_HW_VLAN_CTAG_FILTER, -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_domain.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_domain.c -index 56bf900eb753f..dbdb6a9592f09 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_domain.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_domain.c -@@ -2,6 +2,7 @@ - /* Copyright (c) 2019 Mellanox Technologies. */ - - #include -+#include - #include "dr_types.h" - - static int dr_domain_init_cache(struct mlx5dr_domain *dmn) -@@ -64,9 +65,9 @@ static int dr_domain_init_resources(struct mlx5dr_domain *dmn) - } - - dmn->uar = mlx5_get_uars_page(dmn->mdev); -- if (!dmn->uar) { -+ if (IS_ERR(dmn->uar)) { - mlx5dr_err(dmn, "Couldn't allocate UAR\n"); -- ret = -ENOMEM; -+ ret = PTR_ERR(dmn->uar); - goto clean_pd; - } - -diff --git a/drivers/net/ethernet/pensando/ionic/ionic_lif.c b/drivers/net/ethernet/pensando/ionic/ionic_lif.c -index 99ba3551458fc..f9c303d76658a 100644 ---- a/drivers/net/ethernet/pensando/ionic/ionic_lif.c -+++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.c -@@ -1995,7 +1995,7 @@ static int ionic_lif_init(struct ionic_lif *lif) - return -EINVAL; - } - -- lif->dbid_inuse = bitmap_alloc(lif->dbid_count, GFP_KERNEL); -+ lif->dbid_inuse = bitmap_zalloc(lif->dbid_count, GFP_KERNEL); - if (!lif->dbid_inuse) { - dev_err(dev, "Failed alloc doorbell id bitmap, aborting\n"); - return -ENOMEM; -diff --git a/drivers/net/usb/pegasus.c b/drivers/net/usb/pegasus.c -index b744c09346a7c..dda051c94fb4d 100644 ---- a/drivers/net/usb/pegasus.c -+++ b/drivers/net/usb/pegasus.c -@@ -495,11 +495,11 @@ static void read_bulk_callback(struct urb *urb) - goto goon; - - rx_status = buf[count - 2]; -- if (rx_status & 0x1e) { -+ if (rx_status & 0x1c) { - netif_dbg(pegasus, rx_err, net, - "RX packet error %x\n", rx_status); - net->stats.rx_errors++; -- if (rx_status & 0x06) /* long or runt */ -+ if (rx_status & 0x04) /* runt */ - net->stats.rx_length_errors++; - if (rx_status & 0x08) - net->stats.rx_crc_errors++; -diff --git a/drivers/nfc/st21nfca/i2c.c b/drivers/nfc/st21nfca/i2c.c -index 23ed11f91213d..6ea59426ab0bf 100644 ---- a/drivers/nfc/st21nfca/i2c.c -+++ b/drivers/nfc/st21nfca/i2c.c -@@ -533,7 +533,8 @@ static int st21nfca_hci_i2c_probe(struct i2c_client *client, - phy->gpiod_ena = devm_gpiod_get(dev, "enable", GPIOD_OUT_LOW); - if (IS_ERR(phy->gpiod_ena)) { - nfc_err(dev, "Unable to get ENABLE GPIO\n"); -- return PTR_ERR(phy->gpiod_ena); -+ r = PTR_ERR(phy->gpiod_ena); -+ goto out_free; - } - - phy->se_status.is_ese_present = -@@ -544,7 +545,7 @@ static int st21nfca_hci_i2c_probe(struct i2c_client *client, - r = st21nfca_hci_platform_init(phy); - if (r < 0) { - nfc_err(&client->dev, "Unable to reboot st21nfca\n"); -- return r; -+ goto out_free; - } - - r = devm_request_threaded_irq(&client->dev, client->irq, NULL, -@@ -553,15 +554,23 @@ static int st21nfca_hci_i2c_probe(struct i2c_client *client, - ST21NFCA_HCI_DRIVER_NAME, phy); - if (r < 0) { - nfc_err(&client->dev, "Unable to register IRQ handler\n"); -- return r; -+ goto out_free; - } - -- return st21nfca_hci_probe(phy, &i2c_phy_ops, LLC_SHDLC_NAME, -- ST21NFCA_FRAME_HEADROOM, -- ST21NFCA_FRAME_TAILROOM, -- ST21NFCA_HCI_LLC_MAX_PAYLOAD, -- &phy->hdev, -- &phy->se_status); -+ r = st21nfca_hci_probe(phy, &i2c_phy_ops, LLC_SHDLC_NAME, -+ ST21NFCA_FRAME_HEADROOM, -+ ST21NFCA_FRAME_TAILROOM, -+ ST21NFCA_HCI_LLC_MAX_PAYLOAD, -+ &phy->hdev, -+ &phy->se_status); -+ if (r) -+ goto out_free; -+ -+ return 0; -+ -+out_free: -+ kfree_skb(phy->pending_skb); -+ return r; - } - - static int st21nfca_hci_i2c_remove(struct i2c_client *client) -@@ -574,6 +583,8 @@ static int st21nfca_hci_i2c_remove(struct i2c_client *client) - - if (phy->powered) - st21nfca_hci_i2c_disable(phy); -+ if (phy->pending_skb) -+ kfree_skb(phy->pending_skb); - - return 0; - } -diff --git a/drivers/platform/x86/apple-gmux.c b/drivers/platform/x86/apple-gmux.c -index 7e3083deb1c5d..1b86005c0f5f4 100644 ---- a/drivers/platform/x86/apple-gmux.c -+++ b/drivers/platform/x86/apple-gmux.c -@@ -625,7 +625,7 @@ static int gmux_probe(struct pnp_dev *pnp, const struct pnp_device_id *id) - } - - gmux_data->iostart = res->start; -- gmux_data->iolen = res->end - res->start; -+ gmux_data->iolen = resource_size(res); - - if (gmux_data->iolen < GMUX_MIN_IO_LEN) { - pr_err("gmux I/O region too small (%lu < %u)\n", -diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c -index 3c9248d2435e1..e15bb3dfe9956 100644 ---- a/drivers/scsi/lpfc/lpfc_debugfs.c -+++ b/drivers/scsi/lpfc/lpfc_debugfs.c -@@ -2757,8 +2757,8 @@ lpfc_debugfs_nvmeio_trc_write(struct file *file, const char __user *buf, - char mybuf[64]; - char *pbuf; - -- if (nbytes > 64) -- nbytes = 64; -+ if (nbytes > 63) -+ nbytes = 63; - - memset(mybuf, 0, sizeof(mybuf)); - -diff --git a/drivers/scsi/vmw_pvscsi.c b/drivers/scsi/vmw_pvscsi.c -index 0ac342b1deb95..0370ff6dd2efd 100644 ---- a/drivers/scsi/vmw_pvscsi.c -+++ b/drivers/scsi/vmw_pvscsi.c -@@ -578,9 +578,12 @@ static void pvscsi_complete_request(struct pvscsi_adapter *adapter, - * Commands like INQUIRY may transfer less data than - * requested by the initiator via bufflen. Set residual - * count to make upper layer aware of the actual amount -- * of data returned. -+ * of data returned. There are cases when controller -+ * returns zero dataLen with non zero data - do not set -+ * residual count in that case. - */ -- scsi_set_resid(cmd, scsi_bufflen(cmd) - e->dataLen); -+ if (e->dataLen && (e->dataLen < scsi_bufflen(cmd))) -+ scsi_set_resid(cmd, scsi_bufflen(cmd) - e->dataLen); - cmd->result = (DID_OK << 16); - break; - -diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c -index d6491e973fa4c..0d5ae80530498 100644 ---- a/drivers/tee/tee_shm.c -+++ b/drivers/tee/tee_shm.c -@@ -1,26 +1,18 @@ - // SPDX-License-Identifier: GPL-2.0-only - /* -- * Copyright (c) 2015-2016, Linaro Limited -+ * Copyright (c) 2015-2017, 2019-2021 Linaro Limited - */ -+#include - #include --#include --#include - #include -+#include - #include - #include - #include - #include "tee_private.h" - --static void tee_shm_release(struct tee_shm *shm) -+static void tee_shm_release(struct tee_device *teedev, struct tee_shm *shm) - { -- struct tee_device *teedev = shm->teedev; -- -- mutex_lock(&teedev->mutex); -- idr_remove(&teedev->idr, shm->id); -- if (shm->ctx) -- list_del(&shm->link); -- mutex_unlock(&teedev->mutex); -- - if (shm->flags & TEE_SHM_POOL) { - struct tee_shm_pool_mgr *poolm; - -@@ -52,51 +44,6 @@ static void tee_shm_release(struct tee_shm *shm) - tee_device_put(teedev); - } - --static struct sg_table *tee_shm_op_map_dma_buf(struct dma_buf_attachment -- *attach, enum dma_data_direction dir) --{ -- return NULL; --} -- --static void tee_shm_op_unmap_dma_buf(struct dma_buf_attachment *attach, -- struct sg_table *table, -- enum dma_data_direction dir) --{ --} -- --static void tee_shm_op_release(struct dma_buf *dmabuf) --{ -- struct tee_shm *shm = dmabuf->priv; -- -- tee_shm_release(shm); --} -- --static void *tee_shm_op_map(struct dma_buf *dmabuf, unsigned long pgnum) --{ -- return NULL; --} -- --static int tee_shm_op_mmap(struct dma_buf *dmabuf, struct vm_area_struct *vma) --{ -- struct tee_shm *shm = dmabuf->priv; -- size_t size = vma->vm_end - vma->vm_start; -- -- /* Refuse sharing shared memory provided by application */ -- if (shm->flags & TEE_SHM_REGISTER) -- return -EINVAL; -- -- return remap_pfn_range(vma, vma->vm_start, shm->paddr >> PAGE_SHIFT, -- size, vma->vm_page_prot); --} -- --static const struct dma_buf_ops tee_shm_dma_buf_ops = { -- .map_dma_buf = tee_shm_op_map_dma_buf, -- .unmap_dma_buf = tee_shm_op_unmap_dma_buf, -- .release = tee_shm_op_release, -- .map = tee_shm_op_map, -- .mmap = tee_shm_op_mmap, --}; -- - static struct tee_shm *__tee_shm_alloc(struct tee_context *ctx, - struct tee_device *teedev, - size_t size, u32 flags) -@@ -137,6 +84,7 @@ static struct tee_shm *__tee_shm_alloc(struct tee_context *ctx, - goto err_dev_put; - } - -+ refcount_set(&shm->refcount, 1); - shm->flags = flags | TEE_SHM_POOL; - shm->teedev = teedev; - shm->ctx = ctx; -@@ -159,21 +107,6 @@ static struct tee_shm *__tee_shm_alloc(struct tee_context *ctx, - goto err_pool_free; - } - -- if (flags & TEE_SHM_DMA_BUF) { -- DEFINE_DMA_BUF_EXPORT_INFO(exp_info); -- -- exp_info.ops = &tee_shm_dma_buf_ops; -- exp_info.size = shm->size; -- exp_info.flags = O_RDWR; -- exp_info.priv = shm; -- -- shm->dmabuf = dma_buf_export(&exp_info); -- if (IS_ERR(shm->dmabuf)) { -- ret = ERR_CAST(shm->dmabuf); -- goto err_rem; -- } -- } -- - if (ctx) { - teedev_ctx_get(ctx); - mutex_lock(&teedev->mutex); -@@ -182,10 +115,6 @@ static struct tee_shm *__tee_shm_alloc(struct tee_context *ctx, - } - - return shm; --err_rem: -- mutex_lock(&teedev->mutex); -- idr_remove(&teedev->idr, shm->id); -- mutex_unlock(&teedev->mutex); - err_pool_free: - poolm->ops->free(poolm, shm); - err_kfree: -@@ -268,6 +197,7 @@ struct tee_shm *tee_shm_register(struct tee_context *ctx, unsigned long addr, - goto err; - } - -+ refcount_set(&shm->refcount, 1); - shm->flags = flags | TEE_SHM_REGISTER; - shm->teedev = teedev; - shm->ctx = ctx; -@@ -309,22 +239,6 @@ struct tee_shm *tee_shm_register(struct tee_context *ctx, unsigned long addr, - goto err; - } - -- if (flags & TEE_SHM_DMA_BUF) { -- DEFINE_DMA_BUF_EXPORT_INFO(exp_info); -- -- exp_info.ops = &tee_shm_dma_buf_ops; -- exp_info.size = shm->size; -- exp_info.flags = O_RDWR; -- exp_info.priv = shm; -- -- shm->dmabuf = dma_buf_export(&exp_info); -- if (IS_ERR(shm->dmabuf)) { -- ret = ERR_CAST(shm->dmabuf); -- teedev->desc->ops->shm_unregister(ctx, shm); -- goto err; -- } -- } -- - mutex_lock(&teedev->mutex); - list_add_tail(&shm->link, &ctx->list_shm); - mutex_unlock(&teedev->mutex); -@@ -352,6 +266,35 @@ err: - } - EXPORT_SYMBOL_GPL(tee_shm_register); - -+static int tee_shm_fop_release(struct inode *inode, struct file *filp) -+{ -+ tee_shm_put(filp->private_data); -+ return 0; -+} -+ -+static int tee_shm_fop_mmap(struct file *filp, struct vm_area_struct *vma) -+{ -+ struct tee_shm *shm = filp->private_data; -+ size_t size = vma->vm_end - vma->vm_start; -+ -+ /* Refuse sharing shared memory provided by application */ -+ if (shm->flags & TEE_SHM_USER_MAPPED) -+ return -EINVAL; -+ -+ /* check for overflowing the buffer's size */ -+ if (vma->vm_pgoff + vma_pages(vma) > shm->size >> PAGE_SHIFT) -+ return -EINVAL; -+ -+ return remap_pfn_range(vma, vma->vm_start, shm->paddr >> PAGE_SHIFT, -+ size, vma->vm_page_prot); -+} -+ -+static const struct file_operations tee_shm_fops = { -+ .owner = THIS_MODULE, -+ .release = tee_shm_fop_release, -+ .mmap = tee_shm_fop_mmap, -+}; -+ - /** - * tee_shm_get_fd() - Increase reference count and return file descriptor - * @shm: Shared memory handle -@@ -364,10 +307,11 @@ int tee_shm_get_fd(struct tee_shm *shm) - if (!(shm->flags & TEE_SHM_DMA_BUF)) - return -EINVAL; - -- get_dma_buf(shm->dmabuf); -- fd = dma_buf_fd(shm->dmabuf, O_CLOEXEC); -+ /* matched by tee_shm_put() in tee_shm_op_release() */ -+ refcount_inc(&shm->refcount); -+ fd = anon_inode_getfd("tee_shm", &tee_shm_fops, shm, O_RDWR); - if (fd < 0) -- dma_buf_put(shm->dmabuf); -+ tee_shm_put(shm); - return fd; - } - -@@ -377,17 +321,7 @@ int tee_shm_get_fd(struct tee_shm *shm) - */ - void tee_shm_free(struct tee_shm *shm) - { -- /* -- * dma_buf_put() decreases the dmabuf reference counter and will -- * call tee_shm_release() when the last reference is gone. -- * -- * In the case of driver private memory we call tee_shm_release -- * directly instead as it doesn't have a reference counter. -- */ -- if (shm->flags & TEE_SHM_DMA_BUF) -- dma_buf_put(shm->dmabuf); -- else -- tee_shm_release(shm); -+ tee_shm_put(shm); - } - EXPORT_SYMBOL_GPL(tee_shm_free); - -@@ -494,10 +428,15 @@ struct tee_shm *tee_shm_get_from_id(struct tee_context *ctx, int id) - teedev = ctx->teedev; - mutex_lock(&teedev->mutex); - shm = idr_find(&teedev->idr, id); -+ /* -+ * If the tee_shm was found in the IDR it must have a refcount -+ * larger than 0 due to the guarantee in tee_shm_put() below. So -+ * it's safe to use refcount_inc(). -+ */ - if (!shm || shm->ctx != ctx) - shm = ERR_PTR(-EINVAL); -- else if (shm->flags & TEE_SHM_DMA_BUF) -- get_dma_buf(shm->dmabuf); -+ else -+ refcount_inc(&shm->refcount); - mutex_unlock(&teedev->mutex); - return shm; - } -@@ -509,7 +448,25 @@ EXPORT_SYMBOL_GPL(tee_shm_get_from_id); - */ - void tee_shm_put(struct tee_shm *shm) - { -- if (shm->flags & TEE_SHM_DMA_BUF) -- dma_buf_put(shm->dmabuf); -+ struct tee_device *teedev = shm->teedev; -+ bool do_release = false; -+ -+ mutex_lock(&teedev->mutex); -+ if (refcount_dec_and_test(&shm->refcount)) { -+ /* -+ * refcount has reached 0, we must now remove it from the -+ * IDR before releasing the mutex. This will guarantee that -+ * the refcount_inc() in tee_shm_get_from_id() never starts -+ * from 0. -+ */ -+ idr_remove(&teedev->idr, shm->id); -+ if (shm->ctx) -+ list_del(&shm->link); -+ do_release = true; -+ } -+ mutex_unlock(&teedev->mutex); -+ -+ if (do_release) -+ tee_shm_release(teedev, shm); - } - EXPORT_SYMBOL_GPL(tee_shm_put); -diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c -index 94ccf43368dfc..3f5c21f7f9905 100644 ---- a/drivers/usb/gadget/function/f_fs.c -+++ b/drivers/usb/gadget/function/f_fs.c -@@ -1791,11 +1791,15 @@ static void ffs_data_clear(struct ffs_data *ffs) - - BUG_ON(ffs->gadget); - -- if (ffs->epfiles) -+ if (ffs->epfiles) { - ffs_epfiles_destroy(ffs->epfiles, ffs->eps_count); -+ ffs->epfiles = NULL; -+ } - -- if (ffs->ffs_eventfd) -+ if (ffs->ffs_eventfd) { - eventfd_ctx_put(ffs->ffs_eventfd); -+ ffs->ffs_eventfd = NULL; -+ } - - kfree(ffs->raw_descs_data); - kfree(ffs->raw_strings); -@@ -1808,7 +1812,6 @@ static void ffs_data_reset(struct ffs_data *ffs) - - ffs_data_clear(ffs); - -- ffs->epfiles = NULL; - ffs->raw_descs_data = NULL; - ffs->raw_descs = NULL; - ffs->raw_strings = NULL; -diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c -index ded05c39e4d1c..e7533787db411 100644 ---- a/drivers/usb/host/xhci-pci.c -+++ b/drivers/usb/host/xhci-pci.c -@@ -108,7 +108,6 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) - /* Look for vendor-specific quirks */ - if (pdev->vendor == PCI_VENDOR_ID_FRESCO_LOGIC && - (pdev->device == PCI_DEVICE_ID_FRESCO_LOGIC_PDK || -- pdev->device == PCI_DEVICE_ID_FRESCO_LOGIC_FL1100 || - pdev->device == PCI_DEVICE_ID_FRESCO_LOGIC_FL1400)) { - if (pdev->device == PCI_DEVICE_ID_FRESCO_LOGIC_PDK && - pdev->revision == 0x0) { -@@ -143,6 +142,10 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) - pdev->device == PCI_DEVICE_ID_FRESCO_LOGIC_FL1009) - xhci->quirks |= XHCI_BROKEN_STREAMS; - -+ if (pdev->vendor == PCI_VENDOR_ID_FRESCO_LOGIC && -+ pdev->device == PCI_DEVICE_ID_FRESCO_LOGIC_FL1100) -+ xhci->quirks |= XHCI_TRUST_TX_LENGTH; -+ - if (pdev->vendor == PCI_VENDOR_ID_NEC) - xhci->quirks |= XHCI_NEC_HOST; - -diff --git a/drivers/usb/mtu3/mtu3_gadget.c b/drivers/usb/mtu3/mtu3_gadget.c -index 619c4598e64ea..253c8b71d3c49 100644 ---- a/drivers/usb/mtu3/mtu3_gadget.c -+++ b/drivers/usb/mtu3/mtu3_gadget.c -@@ -100,6 +100,13 @@ static int mtu3_ep_enable(struct mtu3_ep *mep) - interval = clamp_val(interval, 1, 16) - 1; - mult = usb_endpoint_maxp_mult(desc) - 1; - } -+ break; -+ case USB_SPEED_FULL: -+ if (usb_endpoint_xfer_isoc(desc)) -+ interval = clamp_val(desc->bInterval, 1, 16); -+ else if (usb_endpoint_xfer_int(desc)) -+ interval = clamp_val(desc->bInterval, 1, 255); -+ - break; - default: - break; /*others are ignored */ -@@ -245,6 +252,7 @@ struct usb_request *mtu3_alloc_request(struct usb_ep *ep, gfp_t gfp_flags) - mreq->request.dma = DMA_ADDR_INVALID; - mreq->epnum = mep->epnum; - mreq->mep = mep; -+ INIT_LIST_HEAD(&mreq->list); - trace_mtu3_alloc_request(mreq); - - return &mreq->request; -diff --git a/drivers/usb/mtu3/mtu3_qmu.c b/drivers/usb/mtu3/mtu3_qmu.c -index 3f414f91b5899..2ea3157ddb6e2 100644 ---- a/drivers/usb/mtu3/mtu3_qmu.c -+++ b/drivers/usb/mtu3/mtu3_qmu.c -@@ -273,6 +273,8 @@ static int mtu3_prepare_tx_gpd(struct mtu3_ep *mep, struct mtu3_request *mreq) - gpd->dw3_info |= cpu_to_le32(GPD_EXT_FLAG_ZLP); - } - -+ /* prevent reorder, make sure GPD's HWO is set last */ -+ mb(); - gpd->dw0_info |= cpu_to_le32(GPD_FLAGS_IOC | GPD_FLAGS_HWO); - - mreq->gpd = gpd; -@@ -306,6 +308,8 @@ static int mtu3_prepare_rx_gpd(struct mtu3_ep *mep, struct mtu3_request *mreq) - gpd->next_gpd = cpu_to_le32(lower_32_bits(enq_dma)); - ext_addr |= GPD_EXT_NGP(mtu, upper_32_bits(enq_dma)); - gpd->dw3_info = cpu_to_le32(ext_addr); -+ /* prevent reorder, make sure GPD's HWO is set last */ -+ mb(); - gpd->dw0_info |= cpu_to_le32(GPD_FLAGS_IOC | GPD_FLAGS_HWO); - - mreq->gpd = gpd; -@@ -445,7 +449,8 @@ static void qmu_tx_zlp_error_handler(struct mtu3 *mtu, u8 epnum) - return; - } - mtu3_setbits(mbase, MU3D_EP_TXCR0(mep->epnum), TX_TXPKTRDY); -- -+ /* prevent reorder, make sure GPD's HWO is set last */ -+ mb(); - /* by pass the current GDP */ - gpd_current->dw0_info |= cpu_to_le32(GPD_FLAGS_BPS | GPD_FLAGS_HWO); - -diff --git a/include/linux/memblock.h b/include/linux/memblock.h -index f491690d54c6c..64b971b2542d6 100644 ---- a/include/linux/memblock.h -+++ b/include/linux/memblock.h -@@ -351,8 +351,8 @@ phys_addr_t memblock_phys_alloc_range(phys_addr_t size, phys_addr_t align, - phys_addr_t start, phys_addr_t end); - phys_addr_t memblock_phys_alloc_try_nid(phys_addr_t size, phys_addr_t align, int nid); - --static inline phys_addr_t memblock_phys_alloc(phys_addr_t size, -- phys_addr_t align) -+static __always_inline phys_addr_t memblock_phys_alloc(phys_addr_t size, -+ phys_addr_t align) - { - return memblock_phys_alloc_range(size, align, 0, - MEMBLOCK_ALLOC_ACCESSIBLE); -diff --git a/include/linux/tee_drv.h b/include/linux/tee_drv.h -index cd15c1b7fae06..e08ace76eba6a 100644 ---- a/include/linux/tee_drv.h -+++ b/include/linux/tee_drv.h -@@ -178,7 +178,7 @@ void tee_device_unregister(struct tee_device *teedev); - * @offset: offset of buffer in user space - * @pages: locked pages from userspace - * @num_pages: number of locked pages -- * @dmabuf: dmabuf used to for exporting to user space -+ * @refcount: reference counter - * @flags: defined by TEE_SHM_* in tee_drv.h - * @id: unique id of a shared memory object on this device - * -@@ -195,7 +195,7 @@ struct tee_shm { - unsigned int offset; - struct page **pages; - size_t num_pages; -- struct dma_buf *dmabuf; -+ refcount_t refcount; - u32 flags; - int id; - }; -diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h -index 3ab5c6bbb90bd..35c108a6b8720 100644 ---- a/include/net/sctp/sctp.h -+++ b/include/net/sctp/sctp.h -@@ -103,6 +103,7 @@ extern struct percpu_counter sctp_sockets_allocated; - int sctp_asconf_mgmt(struct sctp_sock *, struct sctp_sockaddr_entry *); - struct sk_buff *sctp_skb_recv_datagram(struct sock *, int, int, int *); - -+typedef int (*sctp_callback_t)(struct sctp_endpoint *, struct sctp_transport *, void *); - void sctp_transport_walk_start(struct rhashtable_iter *iter); - void sctp_transport_walk_stop(struct rhashtable_iter *iter); - struct sctp_transport *sctp_transport_get_next(struct net *net, -@@ -113,9 +114,8 @@ int sctp_transport_lookup_process(int (*cb)(struct sctp_transport *, void *), - struct net *net, - const union sctp_addr *laddr, - const union sctp_addr *paddr, void *p); --int sctp_for_each_transport(int (*cb)(struct sctp_transport *, void *), -- int (*cb_done)(struct sctp_transport *, void *), -- struct net *net, int *pos, void *p); -+int sctp_transport_traverse_process(sctp_callback_t cb, sctp_callback_t cb_done, -+ struct net *net, int *pos, void *p); - int sctp_for_each_endpoint(int (*cb)(struct sctp_endpoint *, void *), void *p); - int sctp_get_sctp_info(struct sock *sk, struct sctp_association *asoc, - struct sctp_info *info); -diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h -index fd7c3f76040c3..cb05e503c9cd1 100644 ---- a/include/net/sctp/structs.h -+++ b/include/net/sctp/structs.h -@@ -1345,6 +1345,7 @@ struct sctp_endpoint { - - u32 secid; - u32 peer_secid; -+ struct rcu_head rcu; - }; - - /* Recover the outter endpoint structure. */ -@@ -1360,7 +1361,7 @@ static inline struct sctp_endpoint *sctp_ep(struct sctp_ep_common *base) - struct sctp_endpoint *sctp_endpoint_new(struct sock *, gfp_t); - void sctp_endpoint_free(struct sctp_endpoint *); - void sctp_endpoint_put(struct sctp_endpoint *); --void sctp_endpoint_hold(struct sctp_endpoint *); -+int sctp_endpoint_hold(struct sctp_endpoint *ep); - void sctp_endpoint_add_asoc(struct sctp_endpoint *, struct sctp_association *); - struct sctp_association *sctp_endpoint_lookup_assoc( - const struct sctp_endpoint *ep, -diff --git a/include/uapi/linux/nfc.h b/include/uapi/linux/nfc.h -index f6e3c8c9c7449..4fa4e979e948a 100644 ---- a/include/uapi/linux/nfc.h -+++ b/include/uapi/linux/nfc.h -@@ -263,7 +263,7 @@ enum nfc_sdp_attr { - #define NFC_SE_ENABLED 0x1 - - struct sockaddr_nfc { -- sa_family_t sa_family; -+ __kernel_sa_family_t sa_family; - __u32 dev_idx; - __u32 target_idx; - __u32 nfc_protocol; -@@ -271,14 +271,14 @@ struct sockaddr_nfc { - - #define NFC_LLCP_MAX_SERVICE_NAME 63 - struct sockaddr_nfc_llcp { -- sa_family_t sa_family; -+ __kernel_sa_family_t sa_family; - __u32 dev_idx; - __u32 target_idx; - __u32 nfc_protocol; - __u8 dsap; /* Destination SAP, if known */ - __u8 ssap; /* Source SAP to be bound to */ - char service_name[NFC_LLCP_MAX_SERVICE_NAME]; /* Service name URI */; -- size_t service_name_len; -+ __kernel_size_t service_name_len; - }; - - /* NFC socket protocols */ -diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c -index 70f92aaca4110..c800220c404d5 100644 ---- a/net/ipv4/af_inet.c -+++ b/net/ipv4/af_inet.c -@@ -1974,6 +1974,10 @@ static int __init inet_init(void) - - ip_init(); - -+ /* Initialise per-cpu ipv4 mibs */ -+ if (init_ipv4_mibs()) -+ panic("%s: Cannot init ipv4 mibs\n", __func__); -+ - /* Setup TCP slab cache for open requests. */ - tcp_init(); - -@@ -2004,12 +2008,6 @@ static int __init inet_init(void) - - if (init_inet_pernet_ops()) - pr_crit("%s: Cannot init ipv4 inet pernet ops\n", __func__); -- /* -- * Initialise per-cpu ipv4 mibs -- */ -- -- if (init_ipv4_mibs()) -- pr_crit("%s: Cannot init ipv4 mibs\n", __func__); - - ipv4_proc_init(); - -diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c -index 818fc99756256..a71bfa5b02770 100644 ---- a/net/ipv6/udp.c -+++ b/net/ipv6/udp.c -@@ -1132,7 +1132,7 @@ static int udp_v6_send_skb(struct sk_buff *skb, struct flowi6 *fl6, - kfree_skb(skb); - return -EINVAL; - } -- if (skb->len > cork->gso_size * UDP_MAX_SEGMENTS) { -+ if (datalen > cork->gso_size * UDP_MAX_SEGMENTS) { - kfree_skb(skb); - return -EINVAL; - } -diff --git a/net/ncsi/ncsi-netlink.c b/net/ncsi/ncsi-netlink.c -index a33ea45dec054..27700887c3217 100644 ---- a/net/ncsi/ncsi-netlink.c -+++ b/net/ncsi/ncsi-netlink.c -@@ -112,7 +112,11 @@ static int ncsi_write_package_info(struct sk_buff *skb, - pnest = nla_nest_start_noflag(skb, NCSI_PKG_ATTR); - if (!pnest) - return -ENOMEM; -- nla_put_u32(skb, NCSI_PKG_ATTR_ID, np->id); -+ rc = nla_put_u32(skb, NCSI_PKG_ATTR_ID, np->id); -+ if (rc) { -+ nla_nest_cancel(skb, pnest); -+ return rc; -+ } - if ((0x1 << np->id) == ndp->package_whitelist) - nla_put_flag(skb, NCSI_PKG_ATTR_FORCED); - cnest = nla_nest_start_noflag(skb, NCSI_PKG_ATTR_CHANNEL_LIST); -diff --git a/net/sctp/diag.c b/net/sctp/diag.c -index ba9f64fdfd238..7921e77fa55a3 100644 ---- a/net/sctp/diag.c -+++ b/net/sctp/diag.c -@@ -292,9 +292,8 @@ out: - return err; - } - --static int sctp_sock_dump(struct sctp_transport *tsp, void *p) -+static int sctp_sock_dump(struct sctp_endpoint *ep, struct sctp_transport *tsp, void *p) - { -- struct sctp_endpoint *ep = tsp->asoc->ep; - struct sctp_comm_param *commp = p; - struct sock *sk = ep->base.sk; - struct sk_buff *skb = commp->skb; -@@ -304,6 +303,8 @@ static int sctp_sock_dump(struct sctp_transport *tsp, void *p) - int err = 0; - - lock_sock(sk); -+ if (ep != tsp->asoc->ep) -+ goto release; - list_for_each_entry(assoc, &ep->asocs, asocs) { - if (cb->args[4] < cb->args[1]) - goto next; -@@ -346,9 +347,8 @@ release: - return err; - } - --static int sctp_sock_filter(struct sctp_transport *tsp, void *p) -+static int sctp_sock_filter(struct sctp_endpoint *ep, struct sctp_transport *tsp, void *p) - { -- struct sctp_endpoint *ep = tsp->asoc->ep; - struct sctp_comm_param *commp = p; - struct sock *sk = ep->base.sk; - const struct inet_diag_req_v2 *r = commp->r; -@@ -506,8 +506,8 @@ skip: - if (!(idiag_states & ~(TCPF_LISTEN | TCPF_CLOSE))) - goto done; - -- sctp_for_each_transport(sctp_sock_filter, sctp_sock_dump, -- net, &pos, &commp); -+ sctp_transport_traverse_process(sctp_sock_filter, sctp_sock_dump, -+ net, &pos, &commp); - cb->args[2] = pos; - - done: -diff --git a/net/sctp/endpointola.c b/net/sctp/endpointola.c -index 3067deb0fbec1..665a22d5c725b 100644 ---- a/net/sctp/endpointola.c -+++ b/net/sctp/endpointola.c -@@ -184,6 +184,18 @@ void sctp_endpoint_free(struct sctp_endpoint *ep) - } - - /* Final destructor for endpoint. */ -+static void sctp_endpoint_destroy_rcu(struct rcu_head *head) -+{ -+ struct sctp_endpoint *ep = container_of(head, struct sctp_endpoint, rcu); -+ struct sock *sk = ep->base.sk; -+ -+ sctp_sk(sk)->ep = NULL; -+ sock_put(sk); -+ -+ kfree(ep); -+ SCTP_DBG_OBJCNT_DEC(ep); -+} -+ - static void sctp_endpoint_destroy(struct sctp_endpoint *ep) - { - struct sock *sk; -@@ -213,18 +225,13 @@ static void sctp_endpoint_destroy(struct sctp_endpoint *ep) - if (sctp_sk(sk)->bind_hash) - sctp_put_port(sk); - -- sctp_sk(sk)->ep = NULL; -- /* Give up our hold on the sock */ -- sock_put(sk); -- -- kfree(ep); -- SCTP_DBG_OBJCNT_DEC(ep); -+ call_rcu(&ep->rcu, sctp_endpoint_destroy_rcu); - } - - /* Hold a reference to an endpoint. */ --void sctp_endpoint_hold(struct sctp_endpoint *ep) -+int sctp_endpoint_hold(struct sctp_endpoint *ep) - { -- refcount_inc(&ep->base.refcnt); -+ return refcount_inc_not_zero(&ep->base.refcnt); - } - - /* Release a reference to an endpoint and clean up if there are -diff --git a/net/sctp/socket.c b/net/sctp/socket.c -index 2146372adff43..565aa77fe5cbe 100644 ---- a/net/sctp/socket.c -+++ b/net/sctp/socket.c -@@ -5395,11 +5395,12 @@ int sctp_transport_lookup_process(int (*cb)(struct sctp_transport *, void *), - } - EXPORT_SYMBOL_GPL(sctp_transport_lookup_process); - --int sctp_for_each_transport(int (*cb)(struct sctp_transport *, void *), -- int (*cb_done)(struct sctp_transport *, void *), -- struct net *net, int *pos, void *p) { -+int sctp_transport_traverse_process(sctp_callback_t cb, sctp_callback_t cb_done, -+ struct net *net, int *pos, void *p) -+{ - struct rhashtable_iter hti; - struct sctp_transport *tsp; -+ struct sctp_endpoint *ep; - int ret; - - again: -@@ -5408,26 +5409,32 @@ again: - - tsp = sctp_transport_get_idx(net, &hti, *pos + 1); - for (; !IS_ERR_OR_NULL(tsp); tsp = sctp_transport_get_next(net, &hti)) { -- ret = cb(tsp, p); -- if (ret) -- break; -+ ep = tsp->asoc->ep; -+ if (sctp_endpoint_hold(ep)) { /* asoc can be peeled off */ -+ ret = cb(ep, tsp, p); -+ if (ret) -+ break; -+ sctp_endpoint_put(ep); -+ } - (*pos)++; - sctp_transport_put(tsp); - } - sctp_transport_walk_stop(&hti); - - if (ret) { -- if (cb_done && !cb_done(tsp, p)) { -+ if (cb_done && !cb_done(ep, tsp, p)) { - (*pos)++; -+ sctp_endpoint_put(ep); - sctp_transport_put(tsp); - goto again; - } -+ sctp_endpoint_put(ep); - sctp_transport_put(tsp); - } - - return ret; - } --EXPORT_SYMBOL_GPL(sctp_for_each_transport); -+EXPORT_SYMBOL_GPL(sctp_transport_traverse_process); - - /* 7.2.1 Association Status (SCTP_STATUS) - -diff --git a/scripts/recordmcount.pl b/scripts/recordmcount.pl -index a4ca050815aba..dc1d3696af6b8 100755 ---- a/scripts/recordmcount.pl -+++ b/scripts/recordmcount.pl -@@ -252,7 +252,7 @@ if ($arch eq "x86_64") { - - } elsif ($arch eq "s390" && $bits == 64) { - if ($cc =~ /-DCC_USING_HOTPATCH/) { -- $mcount_regex = "^\\s*([0-9a-fA-F]+):\\s*c0 04 00 00 00 00\\s*(bcrl\\s*0,|jgnop\\s*)[0-9a-f]+ <([^\+]*)>\$"; -+ $mcount_regex = "^\\s*([0-9a-fA-F]+):\\s*c0 04 00 00 00 00\\s*(brcl\\s*0,|jgnop\\s*)[0-9a-f]+ <([^\+]*)>\$"; - $mcount_adjust = 0; - } else { - $mcount_regex = "^\\s*([0-9a-fA-F]+):\\s*R_390_(PC|PLT)32DBL\\s+_mcount\\+0x2\$"; -diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c -index 8b9cbe1e8ee22..91f2ba0b225b7 100644 ---- a/security/selinux/hooks.c -+++ b/security/selinux/hooks.c -@@ -5734,7 +5734,7 @@ static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb, - struct common_audit_data ad; - struct lsm_network_audit net = {0,}; - char *addrp; -- u8 proto; -+ u8 proto = 0; - - if (sk == NULL) - return NF_ACCEPT; -diff --git a/security/tomoyo/util.c b/security/tomoyo/util.c -index eba0b3395851e..861fc6f4ebfb7 100644 ---- a/security/tomoyo/util.c -+++ b/security/tomoyo/util.c -@@ -1029,6 +1029,8 @@ bool tomoyo_domain_quota_is_ok(struct tomoyo_request_info *r) - return false; - if (!domain) - return true; -+ if (READ_ONCE(domain->flags[TOMOYO_DIF_QUOTA_WARNED])) -+ return false; - list_for_each_entry_rcu(ptr, &domain->acl_info_list, list, - srcu_read_lock_held(&tomoyo_ss)) { - u16 perm; -@@ -1074,14 +1076,12 @@ bool tomoyo_domain_quota_is_ok(struct tomoyo_request_info *r) - if (count < tomoyo_profile(domain->ns, domain->profile)-> - pref[TOMOYO_PREF_MAX_LEARNING_ENTRY]) - return true; -- if (!domain->flags[TOMOYO_DIF_QUOTA_WARNED]) { -- domain->flags[TOMOYO_DIF_QUOTA_WARNED] = true; -- /* r->granted = false; */ -- tomoyo_write_log(r, "%s", tomoyo_dif[TOMOYO_DIF_QUOTA_WARNED]); -+ WRITE_ONCE(domain->flags[TOMOYO_DIF_QUOTA_WARNED], true); -+ /* r->granted = false; */ -+ tomoyo_write_log(r, "%s", tomoyo_dif[TOMOYO_DIF_QUOTA_WARNED]); - #ifndef CONFIG_SECURITY_TOMOYO_INSECURE_BUILTIN_SETTING -- pr_warn("WARNING: Domain '%s' has too many ACLs to hold. Stopped learning mode.\n", -- domain->domainname->name); -+ pr_warn("WARNING: Domain '%s' has too many ACLs to hold. Stopped learning mode.\n", -+ domain->domainname->name); - #endif -- } - return false; - } -diff --git a/tools/perf/builtin-script.c b/tools/perf/builtin-script.c -index 3a169a026635d..bbf1f2d3387e3 100644 ---- a/tools/perf/builtin-script.c -+++ b/tools/perf/builtin-script.c -@@ -2308,7 +2308,7 @@ static int process_switch_event(struct perf_tool *tool, - if (perf_event__process_switch(tool, event, sample, machine) < 0) - return -1; - -- if (scripting_ops && scripting_ops->process_switch) -+ if (scripting_ops && scripting_ops->process_switch && !filter_cpu(sample)) - scripting_ops->process_switch(event, sample, machine); - - if (!script->show_switch_events) -diff --git a/tools/testing/selftests/net/udpgso.c b/tools/testing/selftests/net/udpgso.c -index c66da6ffd6d8d..7badaf215de28 100644 ---- a/tools/testing/selftests/net/udpgso.c -+++ b/tools/testing/selftests/net/udpgso.c -@@ -156,13 +156,13 @@ struct testcase testcases_v4[] = { - }, - { - /* send max number of min sized segments */ -- .tlen = UDP_MAX_SEGMENTS - CONST_HDRLEN_V4, -+ .tlen = UDP_MAX_SEGMENTS, - .gso_len = 1, -- .r_num_mss = UDP_MAX_SEGMENTS - CONST_HDRLEN_V4, -+ .r_num_mss = UDP_MAX_SEGMENTS, - }, - { - /* send max number + 1 of min sized segments: fail */ -- .tlen = UDP_MAX_SEGMENTS - CONST_HDRLEN_V4 + 1, -+ .tlen = UDP_MAX_SEGMENTS + 1, - .gso_len = 1, - .tfail = true, - }, -@@ -259,13 +259,13 @@ struct testcase testcases_v6[] = { - }, - { - /* send max number of min sized segments */ -- .tlen = UDP_MAX_SEGMENTS - CONST_HDRLEN_V6, -+ .tlen = UDP_MAX_SEGMENTS, - .gso_len = 1, -- .r_num_mss = UDP_MAX_SEGMENTS - CONST_HDRLEN_V6, -+ .r_num_mss = UDP_MAX_SEGMENTS, - }, - { - /* send max number + 1 of min sized segments: fail */ -- .tlen = UDP_MAX_SEGMENTS - CONST_HDRLEN_V6 + 1, -+ .tlen = UDP_MAX_SEGMENTS + 1, - .gso_len = 1, - .tfail = true, - }, -diff --git a/tools/testing/selftests/net/udpgso_bench_tx.c b/tools/testing/selftests/net/udpgso_bench_tx.c -index 17512a43885e7..f1fdaa2702913 100644 ---- a/tools/testing/selftests/net/udpgso_bench_tx.c -+++ b/tools/testing/selftests/net/udpgso_bench_tx.c -@@ -419,6 +419,7 @@ static void usage(const char *filepath) - - static void parse_opts(int argc, char **argv) - { -+ const char *bind_addr = NULL; - int max_len, hdrlen; - int c; - -@@ -446,7 +447,7 @@ static void parse_opts(int argc, char **argv) - cfg_cpu = strtol(optarg, NULL, 0); - break; - case 'D': -- setup_sockaddr(cfg_family, optarg, &cfg_dst_addr); -+ bind_addr = optarg; - break; - case 'l': - cfg_runtime_ms = strtoul(optarg, NULL, 10) * 1000; -@@ -492,6 +493,11 @@ static void parse_opts(int argc, char **argv) - } - } - -+ if (!bind_addr) -+ bind_addr = cfg_family == PF_INET6 ? "::" : "0.0.0.0"; -+ -+ setup_sockaddr(cfg_family, bind_addr, &cfg_dst_addr); -+ - if (optind != argc) - usage(argv[0]); - diff --git a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.170-171.patch b/patch/kernel/archive/odroidxu4-5.4/patch-5.4.170-171.patch deleted file mode 100644 index a57bed9cd..000000000 --- a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.170-171.patch +++ /dev/null @@ -1,909 +0,0 @@ -diff --git a/Makefile b/Makefile -index 7380354e49513..062052f71a976 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 5 - PATCHLEVEL = 4 --SUBLEVEL = 170 -+SUBLEVEL = 171 - EXTRAVERSION = - NAME = Kleptomaniac Octopus - -diff --git a/drivers/infiniband/core/uverbs_marshall.c b/drivers/infiniband/core/uverbs_marshall.c -index b8d715c68ca44..11a0806469162 100644 ---- a/drivers/infiniband/core/uverbs_marshall.c -+++ b/drivers/infiniband/core/uverbs_marshall.c -@@ -66,7 +66,7 @@ void ib_copy_ah_attr_to_user(struct ib_device *device, - struct rdma_ah_attr *src = ah_attr; - struct rdma_ah_attr conv_ah; - -- memset(&dst->grh.reserved, 0, sizeof(dst->grh.reserved)); -+ memset(&dst->grh, 0, sizeof(dst->grh)); - - if ((ah_attr->type == RDMA_AH_ATTR_TYPE_OPA) && - (rdma_ah_get_dlid(ah_attr) > be16_to_cpu(IB_LID_PERMISSIVE)) && -diff --git a/drivers/infiniband/core/uverbs_uapi.c b/drivers/infiniband/core/uverbs_uapi.c -index 00c5478871322..818699b855c5c 100644 ---- a/drivers/infiniband/core/uverbs_uapi.c -+++ b/drivers/infiniband/core/uverbs_uapi.c -@@ -450,6 +450,9 @@ static int uapi_finalize(struct uverbs_api *uapi) - uapi->num_write_ex = max_write_ex + 1; - data = kmalloc_array(uapi->num_write + uapi->num_write_ex, - sizeof(*uapi->write_methods), GFP_KERNEL); -+ if (!data) -+ return -ENOMEM; -+ - for (i = 0; i != uapi->num_write + uapi->num_write_ex; i++) - data[i] = &uapi->notsupp_method; - uapi->write_methods = data; -diff --git a/drivers/input/touchscreen/of_touchscreen.c b/drivers/input/touchscreen/of_touchscreen.c -index 2962c3747adc3..ed5fbcb40e3f0 100644 ---- a/drivers/input/touchscreen/of_touchscreen.c -+++ b/drivers/input/touchscreen/of_touchscreen.c -@@ -77,8 +77,8 @@ void touchscreen_parse_properties(struct input_dev *input, bool multitouch, - axis = multitouch ? ABS_MT_POSITION_X : ABS_X; - data_present = touchscreen_get_prop_u32(dev, "touchscreen-min-x", - input_abs_get_min(input, axis), -- &minimum) | -- touchscreen_get_prop_u32(dev, "touchscreen-size-x", -+ &minimum); -+ data_present |= touchscreen_get_prop_u32(dev, "touchscreen-size-x", - input_abs_get_max(input, - axis) + 1, - &maximum); -@@ -91,8 +91,8 @@ void touchscreen_parse_properties(struct input_dev *input, bool multitouch, - axis = multitouch ? ABS_MT_POSITION_Y : ABS_Y; - data_present = touchscreen_get_prop_u32(dev, "touchscreen-min-y", - input_abs_get_min(input, axis), -- &minimum) | -- touchscreen_get_prop_u32(dev, "touchscreen-size-y", -+ &minimum); -+ data_present |= touchscreen_get_prop_u32(dev, "touchscreen-size-y", - input_abs_get_max(input, - axis) + 1, - &maximum); -diff --git a/drivers/isdn/mISDN/core.c b/drivers/isdn/mISDN/core.c -index 55891e4204460..a41b4b2645941 100644 ---- a/drivers/isdn/mISDN/core.c -+++ b/drivers/isdn/mISDN/core.c -@@ -381,7 +381,7 @@ mISDNInit(void) - err = mISDN_inittimer(&debug); - if (err) - goto error2; -- err = l1_init(&debug); -+ err = Isdnl1_Init(&debug); - if (err) - goto error3; - err = Isdnl2_Init(&debug); -@@ -395,7 +395,7 @@ mISDNInit(void) - error5: - Isdnl2_cleanup(); - error4: -- l1_cleanup(); -+ Isdnl1_cleanup(); - error3: - mISDN_timer_cleanup(); - error2: -@@ -408,7 +408,7 @@ static void mISDN_cleanup(void) - { - misdn_sock_cleanup(); - Isdnl2_cleanup(); -- l1_cleanup(); -+ Isdnl1_cleanup(); - mISDN_timer_cleanup(); - class_unregister(&mISDN_class); - -diff --git a/drivers/isdn/mISDN/core.h b/drivers/isdn/mISDN/core.h -index 23b44d3033279..42599f49c189d 100644 ---- a/drivers/isdn/mISDN/core.h -+++ b/drivers/isdn/mISDN/core.h -@@ -60,8 +60,8 @@ struct Bprotocol *get_Bprotocol4id(u_int); - extern int mISDN_inittimer(u_int *); - extern void mISDN_timer_cleanup(void); - --extern int l1_init(u_int *); --extern void l1_cleanup(void); -+extern int Isdnl1_Init(u_int *); -+extern void Isdnl1_cleanup(void); - extern int Isdnl2_Init(u_int *); - extern void Isdnl2_cleanup(void); - -diff --git a/drivers/isdn/mISDN/layer1.c b/drivers/isdn/mISDN/layer1.c -index 98a3bc6c17009..7b31c25a550e3 100644 ---- a/drivers/isdn/mISDN/layer1.c -+++ b/drivers/isdn/mISDN/layer1.c -@@ -398,7 +398,7 @@ create_l1(struct dchannel *dch, dchannel_l1callback *dcb) { - EXPORT_SYMBOL(create_l1); - - int --l1_init(u_int *deb) -+Isdnl1_Init(u_int *deb) - { - debug = deb; - l1fsm_s.state_count = L1S_STATE_COUNT; -@@ -409,7 +409,7 @@ l1_init(u_int *deb) - } - - void --l1_cleanup(void) -+Isdnl1_cleanup(void) - { - mISDN_FsmFree(&l1fsm_s); - } -diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c -index 03821b46a8cb4..4c22f119ac62f 100644 ---- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c -+++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c -@@ -305,6 +305,10 @@ int aq_ring_rx_clean(struct aq_ring_s *self, - if (!buff->is_eop) { - buff_ = buff; - do { -+ if (buff_->next >= self->size) { -+ err = -EIO; -+ goto err_exit; -+ } - next_ = buff_->next, - buff_ = &self->buff_ring[next_]; - is_rsc_completed = -@@ -327,6 +331,10 @@ int aq_ring_rx_clean(struct aq_ring_s *self, - if (buff->is_error || buff->is_cso_err) { - buff_ = buff; - do { -+ if (buff_->next >= self->size) { -+ err = -EIO; -+ goto err_exit; -+ } - next_ = buff_->next, - buff_ = &self->buff_ring[next_]; - -diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c -index ce237da003ddb..a2326683be170 100644 ---- a/drivers/net/ethernet/intel/i40e/i40e_main.c -+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c -@@ -107,6 +107,24 @@ MODULE_VERSION(DRV_VERSION); - - static struct workqueue_struct *i40e_wq; - -+static void netdev_hw_addr_refcnt(struct i40e_mac_filter *f, -+ struct net_device *netdev, int delta) -+{ -+ struct netdev_hw_addr *ha; -+ -+ if (!f || !netdev) -+ return; -+ -+ netdev_for_each_mc_addr(ha, netdev) { -+ if (ether_addr_equal(ha->addr, f->macaddr)) { -+ ha->refcount += delta; -+ if (ha->refcount <= 0) -+ ha->refcount = 1; -+ break; -+ } -+ } -+} -+ - /** - * i40e_allocate_dma_mem_d - OS specific memory alloc for shared code - * @hw: pointer to the HW structure -@@ -2022,6 +2040,7 @@ static void i40e_undo_add_filter_entries(struct i40e_vsi *vsi, - hlist_for_each_entry_safe(new, h, from, hlist) { - /* We can simply free the wrapper structure */ - hlist_del(&new->hlist); -+ netdev_hw_addr_refcnt(new->f, vsi->netdev, -1); - kfree(new); - } - } -@@ -2369,6 +2388,10 @@ int i40e_sync_vsi_filters(struct i40e_vsi *vsi) - &tmp_add_list, - &tmp_del_list, - vlan_filters); -+ -+ hlist_for_each_entry(new, &tmp_add_list, hlist) -+ netdev_hw_addr_refcnt(new->f, vsi->netdev, 1); -+ - if (retval) - goto err_no_memory_locked; - -@@ -2501,6 +2524,7 @@ int i40e_sync_vsi_filters(struct i40e_vsi *vsi) - if (new->f->state == I40E_FILTER_NEW) - new->f->state = new->state; - hlist_del(&new->hlist); -+ netdev_hw_addr_refcnt(new->f, vsi->netdev, -1); - kfree(new); - } - spin_unlock_bh(&vsi->mac_filter_hash_lock); -@@ -8302,6 +8326,27 @@ int i40e_open(struct net_device *netdev) - return 0; - } - -+/** -+ * i40e_netif_set_realnum_tx_rx_queues - Update number of tx/rx queues -+ * @vsi: vsi structure -+ * -+ * This updates netdev's number of tx/rx queues -+ * -+ * Returns status of setting tx/rx queues -+ **/ -+static int i40e_netif_set_realnum_tx_rx_queues(struct i40e_vsi *vsi) -+{ -+ int ret; -+ -+ ret = netif_set_real_num_rx_queues(vsi->netdev, -+ vsi->num_queue_pairs); -+ if (ret) -+ return ret; -+ -+ return netif_set_real_num_tx_queues(vsi->netdev, -+ vsi->num_queue_pairs); -+} -+ - /** - * i40e_vsi_open - - * @vsi: the VSI to open -@@ -8338,13 +8383,7 @@ int i40e_vsi_open(struct i40e_vsi *vsi) - goto err_setup_rx; - - /* Notify the stack of the actual queue counts. */ -- err = netif_set_real_num_tx_queues(vsi->netdev, -- vsi->num_queue_pairs); -- if (err) -- goto err_set_queues; -- -- err = netif_set_real_num_rx_queues(vsi->netdev, -- vsi->num_queue_pairs); -+ err = i40e_netif_set_realnum_tx_rx_queues(vsi); - if (err) - goto err_set_queues; - -@@ -13766,6 +13805,9 @@ struct i40e_vsi *i40e_vsi_setup(struct i40e_pf *pf, u8 type, - case I40E_VSI_MAIN: - case I40E_VSI_VMDQ2: - ret = i40e_config_netdev(vsi); -+ if (ret) -+ goto err_netdev; -+ ret = i40e_netif_set_realnum_tx_rx_queues(vsi); - if (ret) - goto err_netdev; - ret = register_netdev(vsi->netdev); -@@ -15012,8 +15054,8 @@ static int i40e_probe(struct pci_dev *pdev, const struct pci_device_id *ent) - - if (hw->aq.api_maj_ver == I40E_FW_API_VERSION_MAJOR && - hw->aq.api_min_ver > I40E_FW_MINOR_VERSION(hw)) -- dev_info(&pdev->dev, -- "The driver for the device detected a newer version of the NVM image v%u.%u than expected v%u.%u. Please install the most recent version of the network driver.\n", -+ dev_dbg(&pdev->dev, -+ "The driver for the device detected a newer version of the NVM image v%u.%u than v%u.%u.\n", - hw->aq.api_maj_ver, - hw->aq.api_min_ver, - I40E_FW_API_VERSION_MAJOR, -diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c -index 449eb06e2c7da..309e953ed1e44 100644 ---- a/drivers/net/ethernet/intel/iavf/iavf_main.c -+++ b/drivers/net/ethernet/intel/iavf/iavf_main.c -@@ -2604,8 +2604,11 @@ static int iavf_validate_ch_config(struct iavf_adapter *adapter, - total_max_rate += tx_rate; - num_qps += mqprio_qopt->qopt.count[i]; - } -- if (num_qps > IAVF_MAX_REQ_QUEUES) -+ if (num_qps > adapter->num_active_queues) { -+ dev_err(&adapter->pdev->dev, -+ "Cannot support requested number of queues\n"); - return -EINVAL; -+ } - - ret = iavf_validate_tx_bandwidth(adapter, total_max_rate); - return ret; -diff --git a/drivers/net/ieee802154/atusb.c b/drivers/net/ieee802154/atusb.c -index 23ee0b14cbfa1..2f5e7b31032aa 100644 ---- a/drivers/net/ieee802154/atusb.c -+++ b/drivers/net/ieee802154/atusb.c -@@ -93,7 +93,9 @@ static int atusb_control_msg(struct atusb *atusb, unsigned int pipe, - - ret = usb_control_msg(usb_dev, pipe, request, requesttype, - value, index, data, size, timeout); -- if (ret < 0) { -+ if (ret < size) { -+ ret = ret < 0 ? ret : -ENODATA; -+ - atusb->err = ret; - dev_err(&usb_dev->dev, - "%s: req 0x%02x val 0x%x idx 0x%x, error %d\n", -@@ -861,9 +863,9 @@ static int atusb_get_and_show_build(struct atusb *atusb) - if (!build) - return -ENOMEM; - -- ret = atusb_control_msg(atusb, usb_rcvctrlpipe(usb_dev, 0), -- ATUSB_BUILD, ATUSB_REQ_FROM_DEV, 0, 0, -- build, ATUSB_BUILD_SIZE, 1000); -+ /* We cannot call atusb_control_msg() here, since this request may read various length data */ -+ ret = usb_control_msg(atusb->usb_dev, usb_rcvctrlpipe(usb_dev, 0), ATUSB_BUILD, -+ ATUSB_REQ_FROM_DEV, 0, 0, build, ATUSB_BUILD_SIZE, 1000); - if (ret >= 0) { - build[ret] = 0; - dev_info(&usb_dev->dev, "Firmware: build %s\n", build); -diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c -index 0b61d80ea3f8c..18cc5e4280e83 100644 ---- a/drivers/net/phy/micrel.c -+++ b/drivers/net/phy/micrel.c -@@ -1096,6 +1096,7 @@ static struct phy_driver ksphy_driver[] = { - .probe = kszphy_probe, - .config_init = ksz8081_config_init, - .ack_interrupt = kszphy_ack_interrupt, -+ .soft_reset = genphy_soft_reset, - .config_intr = kszphy_config_intr, - .get_sset_count = kszphy_get_sset_count, - .get_strings = kszphy_get_strings, -diff --git a/drivers/net/usb/rndis_host.c b/drivers/net/usb/rndis_host.c -index f9b359d4e2939..1505fe3f87ed3 100644 ---- a/drivers/net/usb/rndis_host.c -+++ b/drivers/net/usb/rndis_host.c -@@ -608,6 +608,11 @@ static const struct usb_device_id products [] = { - USB_DEVICE_AND_INTERFACE_INFO(0x1630, 0x0042, - USB_CLASS_COMM, 2 /* ACM */, 0x0ff), - .driver_info = (unsigned long) &rndis_poll_status_info, -+}, { -+ /* Hytera Communications DMR radios' "Radio to PC Network" */ -+ USB_VENDOR_AND_INTERFACE_INFO(0x238b, -+ USB_CLASS_COMM, 2 /* ACM */, 0x0ff), -+ .driver_info = (unsigned long)&rndis_info, - }, { - /* RNDIS is MSFT's un-official variant of CDC ACM */ - USB_INTERFACE_INFO(USB_CLASS_COMM, 2 /* ACM */, 0x0ff), -diff --git a/drivers/power/reset/ltc2952-poweroff.c b/drivers/power/reset/ltc2952-poweroff.c -index e4a0cc45b3d11..ec613bcc0a302 100644 ---- a/drivers/power/reset/ltc2952-poweroff.c -+++ b/drivers/power/reset/ltc2952-poweroff.c -@@ -160,8 +160,8 @@ static void ltc2952_poweroff_kill(void) - - static void ltc2952_poweroff_default(struct ltc2952_poweroff *data) - { -- data->wde_interval = 300L * 1E6L; -- data->trigger_delay = ktime_set(2, 500L*1E6L); -+ data->wde_interval = 300L * NSEC_PER_MSEC; -+ data->trigger_delay = ktime_set(2, 500L * NSEC_PER_MSEC); - - hrtimer_init(&data->timer_trigger, CLOCK_MONOTONIC, HRTIMER_MODE_REL); - data->timer_trigger.function = ltc2952_poweroff_timer_trigger; -diff --git a/drivers/power/supply/power_supply_core.c b/drivers/power/supply/power_supply_core.c -index 5c36c430ce8b6..a2f56a68c50d6 100644 ---- a/drivers/power/supply/power_supply_core.c -+++ b/drivers/power/supply/power_supply_core.c -@@ -742,6 +742,10 @@ power_supply_find_ocv2cap_table(struct power_supply_battery_info *info, - return NULL; - - for (i = 0; i < POWER_SUPPLY_OCV_TEMP_MAX; i++) { -+ /* Out of capacity tables */ -+ if (!info->ocv_table[i]) -+ break; -+ - temp_diff = abs(info->ocv_temp[i] - temp); - - if (temp_diff < best_temp_diff) { -diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c -index eeba6180711cd..f3cee64c6d12f 100644 ---- a/drivers/scsi/libiscsi.c -+++ b/drivers/scsi/libiscsi.c -@@ -2948,6 +2948,8 @@ void iscsi_conn_teardown(struct iscsi_cls_conn *cls_conn) - { - struct iscsi_conn *conn = cls_conn->dd_data; - struct iscsi_session *session = conn->session; -+ char *tmp_persistent_address = conn->persistent_address; -+ char *tmp_local_ipaddr = conn->local_ipaddr; - - del_timer_sync(&conn->transport_timer); - -@@ -2969,8 +2971,6 @@ void iscsi_conn_teardown(struct iscsi_cls_conn *cls_conn) - spin_lock_bh(&session->frwd_lock); - free_pages((unsigned long) conn->data, - get_order(ISCSI_DEF_MAX_RECV_SEG_LEN)); -- kfree(conn->persistent_address); -- kfree(conn->local_ipaddr); - /* regular RX path uses back_lock */ - spin_lock_bh(&session->back_lock); - kfifo_in(&session->cmdpool.queue, (void*)&conn->login_task, -@@ -2982,6 +2982,8 @@ void iscsi_conn_teardown(struct iscsi_cls_conn *cls_conn) - mutex_unlock(&session->eh_mutex); - - iscsi_destroy_conn(cls_conn); -+ kfree(tmp_persistent_address); -+ kfree(tmp_local_ipaddr); - } - EXPORT_SYMBOL_GPL(iscsi_conn_teardown); - -diff --git a/drivers/usb/mtu3/mtu3_gadget.c b/drivers/usb/mtu3/mtu3_gadget.c -index 253c8b71d3c49..061da9b82b967 100644 ---- a/drivers/usb/mtu3/mtu3_gadget.c -+++ b/drivers/usb/mtu3/mtu3_gadget.c -@@ -85,7 +85,7 @@ static int mtu3_ep_enable(struct mtu3_ep *mep) - if (usb_endpoint_xfer_int(desc) || - usb_endpoint_xfer_isoc(desc)) { - interval = desc->bInterval; -- interval = clamp_val(interval, 1, 16) - 1; -+ interval = clamp_val(interval, 1, 16); - if (usb_endpoint_xfer_isoc(desc) && comp_desc) - mult = comp_desc->bmAttributes; - } -@@ -97,7 +97,7 @@ static int mtu3_ep_enable(struct mtu3_ep *mep) - if (usb_endpoint_xfer_isoc(desc) || - usb_endpoint_xfer_int(desc)) { - interval = desc->bInterval; -- interval = clamp_val(interval, 1, 16) - 1; -+ interval = clamp_val(interval, 1, 16); - mult = usb_endpoint_maxp_mult(desc) - 1; - } - break; -diff --git a/fs/f2fs/checkpoint.c b/fs/f2fs/checkpoint.c -index f7d27cbbeb860..03dce3980d90a 100644 ---- a/fs/f2fs/checkpoint.c -+++ b/fs/f2fs/checkpoint.c -@@ -1144,7 +1144,8 @@ static bool __need_flush_quota(struct f2fs_sb_info *sbi) - if (!is_journalled_quota(sbi)) - return false; - -- down_write(&sbi->quota_sem); -+ if (!down_write_trylock(&sbi->quota_sem)) -+ return true; - if (is_sbi_flag_set(sbi, SBI_QUOTA_SKIP_FLUSH)) { - ret = false; - } else if (is_sbi_flag_set(sbi, SBI_QUOTA_NEED_REPAIR)) { -diff --git a/fs/xfs/xfs_ioctl.c b/fs/xfs/xfs_ioctl.c -index b3021d9b34a5e..7b7a009425e21 100644 ---- a/fs/xfs/xfs_ioctl.c -+++ b/fs/xfs/xfs_ioctl.c -@@ -714,7 +714,8 @@ xfs_ioc_space( - flags |= XFS_PREALLOC_CLEAR; - if (bf->l_start > XFS_ISIZE(ip)) { - error = xfs_alloc_file_space(ip, XFS_ISIZE(ip), -- bf->l_start - XFS_ISIZE(ip), 0); -+ bf->l_start - XFS_ISIZE(ip), -+ XFS_BMAPI_PREALLOC); - if (error) - goto out_unlock; - } -diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c -index 5240ba9a82db8..54f5b2f080f53 100644 ---- a/kernel/trace/trace.c -+++ b/kernel/trace/trace.c -@@ -3007,7 +3007,7 @@ struct trace_buffer_struct { - char buffer[4][TRACE_BUF_SIZE]; - }; - --static struct trace_buffer_struct *trace_percpu_buffer; -+static struct trace_buffer_struct __percpu *trace_percpu_buffer; - - /* - * Thise allows for lockless recording. If we're nested too deeply, then -@@ -3017,7 +3017,7 @@ static char *get_trace_buf(void) - { - struct trace_buffer_struct *buffer = this_cpu_ptr(trace_percpu_buffer); - -- if (!buffer || buffer->nesting >= 4) -+ if (!trace_percpu_buffer || buffer->nesting >= 4) - return NULL; - - buffer->nesting++; -@@ -3036,7 +3036,7 @@ static void put_trace_buf(void) - - static int alloc_percpu_trace_buffer(void) - { -- struct trace_buffer_struct *buffers; -+ struct trace_buffer_struct __percpu *buffers; - - buffers = alloc_percpu(struct trace_buffer_struct); - if (WARN(!buffers, "Could not allocate percpu trace_printk buffer")) -diff --git a/net/batman-adv/multicast.c b/net/batman-adv/multicast.c -index f5bf931252c4b..09d81f9c2a649 100644 ---- a/net/batman-adv/multicast.c -+++ b/net/batman-adv/multicast.c -@@ -1373,6 +1373,7 @@ batadv_mcast_forw_rtr_node_get(struct batadv_priv *bat_priv, - * @bat_priv: the bat priv with all the soft interface information - * @skb: The multicast packet to check - * @orig: an originator to be set to forward the skb to -+ * @is_routable: stores whether the destination is routable - * - * Return: the forwarding mode as enum batadv_forw_mode and in case of - * BATADV_FORW_SINGLE set the orig to the single originator the skb -@@ -1380,17 +1381,16 @@ batadv_mcast_forw_rtr_node_get(struct batadv_priv *bat_priv, - */ - enum batadv_forw_mode - batadv_mcast_forw_mode(struct batadv_priv *bat_priv, struct sk_buff *skb, -- struct batadv_orig_node **orig) -+ struct batadv_orig_node **orig, int *is_routable) - { - int ret, tt_count, ip_count, unsnoop_count, total_count; - bool is_unsnoopable = false; - unsigned int mcast_fanout; - struct ethhdr *ethhdr; -- int is_routable = 0; - int rtr_count = 0; - - ret = batadv_mcast_forw_mode_check(bat_priv, skb, &is_unsnoopable, -- &is_routable); -+ is_routable); - if (ret == -ENOMEM) - return BATADV_FORW_NONE; - else if (ret < 0) -@@ -1403,7 +1403,7 @@ batadv_mcast_forw_mode(struct batadv_priv *bat_priv, struct sk_buff *skb, - ip_count = batadv_mcast_forw_want_all_ip_count(bat_priv, ethhdr); - unsnoop_count = !is_unsnoopable ? 0 : - atomic_read(&bat_priv->mcast.num_want_all_unsnoopables); -- rtr_count = batadv_mcast_forw_rtr_count(bat_priv, is_routable); -+ rtr_count = batadv_mcast_forw_rtr_count(bat_priv, *is_routable); - - total_count = tt_count + ip_count + unsnoop_count + rtr_count; - -@@ -1723,6 +1723,7 @@ batadv_mcast_forw_want_rtr(struct batadv_priv *bat_priv, - * @bat_priv: the bat priv with all the soft interface information - * @skb: the multicast packet to transmit - * @vid: the vlan identifier -+ * @is_routable: stores whether the destination is routable - * - * Sends copies of a frame with multicast destination to any node that signaled - * interest in it, that is either via the translation table or the according -@@ -1735,7 +1736,7 @@ batadv_mcast_forw_want_rtr(struct batadv_priv *bat_priv, - * is neither IPv4 nor IPv6. NET_XMIT_SUCCESS otherwise. - */ - int batadv_mcast_forw_send(struct batadv_priv *bat_priv, struct sk_buff *skb, -- unsigned short vid) -+ unsigned short vid, int is_routable) - { - int ret; - -@@ -1751,12 +1752,16 @@ int batadv_mcast_forw_send(struct batadv_priv *bat_priv, struct sk_buff *skb, - return ret; - } - -+ if (!is_routable) -+ goto skip_mc_router; -+ - ret = batadv_mcast_forw_want_rtr(bat_priv, skb, vid); - if (ret != NET_XMIT_SUCCESS) { - kfree_skb(skb); - return ret; - } - -+skip_mc_router: - consume_skb(skb); - return ret; - } -diff --git a/net/batman-adv/multicast.h b/net/batman-adv/multicast.h -index 403929013ac47..fc1ffd22a6715 100644 ---- a/net/batman-adv/multicast.h -+++ b/net/batman-adv/multicast.h -@@ -44,7 +44,8 @@ enum batadv_forw_mode { - - enum batadv_forw_mode - batadv_mcast_forw_mode(struct batadv_priv *bat_priv, struct sk_buff *skb, -- struct batadv_orig_node **mcast_single_orig); -+ struct batadv_orig_node **mcast_single_orig, -+ int *is_routable); - - int batadv_mcast_forw_send_orig(struct batadv_priv *bat_priv, - struct sk_buff *skb, -@@ -52,7 +53,7 @@ int batadv_mcast_forw_send_orig(struct batadv_priv *bat_priv, - struct batadv_orig_node *orig_node); - - int batadv_mcast_forw_send(struct batadv_priv *bat_priv, struct sk_buff *skb, -- unsigned short vid); -+ unsigned short vid, int is_routable); - - void batadv_mcast_init(struct batadv_priv *bat_priv); - -@@ -71,7 +72,8 @@ void batadv_mcast_purge_orig(struct batadv_orig_node *orig_node); - - static inline enum batadv_forw_mode - batadv_mcast_forw_mode(struct batadv_priv *bat_priv, struct sk_buff *skb, -- struct batadv_orig_node **mcast_single_orig) -+ struct batadv_orig_node **mcast_single_orig, -+ int *is_routable) - { - return BATADV_FORW_ALL; - } -@@ -88,7 +90,7 @@ batadv_mcast_forw_send_orig(struct batadv_priv *bat_priv, - - static inline int - batadv_mcast_forw_send(struct batadv_priv *bat_priv, struct sk_buff *skb, -- unsigned short vid) -+ unsigned short vid, int is_routable) - { - kfree_skb(skb); - return NET_XMIT_DROP; -diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c -index 7f209390069ea..504e3cb67bed4 100644 ---- a/net/batman-adv/soft-interface.c -+++ b/net/batman-adv/soft-interface.c -@@ -200,6 +200,7 @@ static netdev_tx_t batadv_interface_tx(struct sk_buff *skb, - int gw_mode; - enum batadv_forw_mode forw_mode = BATADV_FORW_SINGLE; - struct batadv_orig_node *mcast_single_orig = NULL; -+ int mcast_is_routable = 0; - int network_offset = ETH_HLEN; - __be16 proto; - -@@ -302,7 +303,8 @@ static netdev_tx_t batadv_interface_tx(struct sk_buff *skb, - send: - if (do_bcast && !is_broadcast_ether_addr(ethhdr->h_dest)) { - forw_mode = batadv_mcast_forw_mode(bat_priv, skb, -- &mcast_single_orig); -+ &mcast_single_orig, -+ &mcast_is_routable); - if (forw_mode == BATADV_FORW_NONE) - goto dropped; - -@@ -367,7 +369,8 @@ send: - ret = batadv_mcast_forw_send_orig(bat_priv, skb, vid, - mcast_single_orig); - } else if (forw_mode == BATADV_FORW_SOME) { -- ret = batadv_mcast_forw_send(bat_priv, skb, vid); -+ ret = batadv_mcast_forw_send(bat_priv, skb, vid, -+ mcast_is_routable); - } else { - if (batadv_dat_snoop_outgoing_arp_request(bat_priv, - skb)) -diff --git a/net/core/lwtunnel.c b/net/core/lwtunnel.c -index 2f9c0de533c75..0b64f015b3b0b 100644 ---- a/net/core/lwtunnel.c -+++ b/net/core/lwtunnel.c -@@ -190,6 +190,10 @@ int lwtunnel_valid_encap_type_attr(struct nlattr *attr, int remaining, - nla_entype = nla_find(attrs, attrlen, RTA_ENCAP_TYPE); - - if (nla_entype) { -+ if (nla_len(nla_entype) < sizeof(u16)) { -+ NL_SET_ERR_MSG(extack, "Invalid RTA_ENCAP_TYPE"); -+ return -EINVAL; -+ } - encap_type = nla_get_u16(nla_entype); - - if (lwtunnel_valid_encap_type(encap_type, -diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c -index c0b8154205237..ce4b28f011485 100644 ---- a/net/ipv4/fib_semantics.c -+++ b/net/ipv4/fib_semantics.c -@@ -654,6 +654,19 @@ static int fib_count_nexthops(struct rtnexthop *rtnh, int remaining, - return nhs; - } - -+static int fib_gw_from_attr(__be32 *gw, struct nlattr *nla, -+ struct netlink_ext_ack *extack) -+{ -+ if (nla_len(nla) < sizeof(*gw)) { -+ NL_SET_ERR_MSG(extack, "Invalid IPv4 address in RTA_GATEWAY"); -+ return -EINVAL; -+ } -+ -+ *gw = nla_get_in_addr(nla); -+ -+ return 0; -+} -+ - /* only called when fib_nh is integrated into fib_info */ - static int fib_get_nhs(struct fib_info *fi, struct rtnexthop *rtnh, - int remaining, struct fib_config *cfg, -@@ -696,7 +709,11 @@ static int fib_get_nhs(struct fib_info *fi, struct rtnexthop *rtnh, - return -EINVAL; - } - if (nla) { -- fib_cfg.fc_gw4 = nla_get_in_addr(nla); -+ ret = fib_gw_from_attr(&fib_cfg.fc_gw4, nla, -+ extack); -+ if (ret) -+ goto errout; -+ - if (fib_cfg.fc_gw4) - fib_cfg.fc_gw_family = AF_INET; - } else if (nlav) { -@@ -706,10 +723,18 @@ static int fib_get_nhs(struct fib_info *fi, struct rtnexthop *rtnh, - } - - nla = nla_find(attrs, attrlen, RTA_FLOW); -- if (nla) -+ if (nla) { -+ if (nla_len(nla) < sizeof(u32)) { -+ NL_SET_ERR_MSG(extack, "Invalid RTA_FLOW"); -+ return -EINVAL; -+ } - fib_cfg.fc_flow = nla_get_u32(nla); -+ } - - fib_cfg.fc_encap = nla_find(attrs, attrlen, RTA_ENCAP); -+ /* RTA_ENCAP_TYPE length checked in -+ * lwtunnel_valid_encap_type_attr -+ */ - nla = nla_find(attrs, attrlen, RTA_ENCAP_TYPE); - if (nla) - fib_cfg.fc_encap_type = nla_get_u16(nla); -@@ -894,6 +919,7 @@ int fib_nh_match(struct fib_config *cfg, struct fib_info *fi, - attrlen = rtnh_attrlen(rtnh); - if (attrlen > 0) { - struct nlattr *nla, *nlav, *attrs = rtnh_attrs(rtnh); -+ int err; - - nla = nla_find(attrs, attrlen, RTA_GATEWAY); - nlav = nla_find(attrs, attrlen, RTA_VIA); -@@ -904,12 +930,17 @@ int fib_nh_match(struct fib_config *cfg, struct fib_info *fi, - } - - if (nla) { -+ __be32 gw; -+ -+ err = fib_gw_from_attr(&gw, nla, extack); -+ if (err) -+ return err; -+ - if (nh->fib_nh_gw_family != AF_INET || -- nla_get_in_addr(nla) != nh->fib_nh_gw4) -+ gw != nh->fib_nh_gw4) - return 1; - } else if (nlav) { - struct fib_config cfg2; -- int err; - - err = fib_gw_from_via(&cfg2, nlav, extack); - if (err) -@@ -932,8 +963,14 @@ int fib_nh_match(struct fib_config *cfg, struct fib_info *fi, - - #ifdef CONFIG_IP_ROUTE_CLASSID - nla = nla_find(attrs, attrlen, RTA_FLOW); -- if (nla && nla_get_u32(nla) != nh->nh_tclassid) -- return 1; -+ if (nla) { -+ if (nla_len(nla) < sizeof(u32)) { -+ NL_SET_ERR_MSG(extack, "Invalid RTA_FLOW"); -+ return -EINVAL; -+ } -+ if (nla_get_u32(nla) != nh->nh_tclassid) -+ return 1; -+ } - #endif - } - -diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c -index a0016f05c4f86..3cdf011a8dd8d 100644 ---- a/net/ipv4/udp.c -+++ b/net/ipv4/udp.c -@@ -2943,7 +2943,7 @@ int udp4_seq_show(struct seq_file *seq, void *v) - { - seq_setwidth(seq, 127); - if (v == SEQ_START_TOKEN) -- seq_puts(seq, " sl local_address rem_address st tx_queue " -+ seq_puts(seq, " sl local_address rem_address st tx_queue " - "rx_queue tr tm->when retrnsmt uid timeout " - "inode ref pointer drops"); - else { -diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c -index 12ab6605d9617..8b44d3b53844e 100644 ---- a/net/ipv6/ip6_vti.c -+++ b/net/ipv6/ip6_vti.c -@@ -795,6 +795,8 @@ vti6_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd) - struct net *net = dev_net(dev); - struct vti6_net *ip6n = net_generic(net, vti6_net_id); - -+ memset(&p1, 0, sizeof(p1)); -+ - switch (cmd) { - case SIOCGETTUNNEL: - if (dev == ip6n->fb_tnl_dev) { -diff --git a/net/ipv6/route.c b/net/ipv6/route.c -index f36db3dd97346..5ef6e27e026e9 100644 ---- a/net/ipv6/route.c -+++ b/net/ipv6/route.c -@@ -5092,6 +5092,19 @@ static void ip6_route_mpath_notify(struct fib6_info *rt, - inet6_rt_notify(RTM_NEWROUTE, rt, info, nlflags); - } - -+static int fib6_gw_from_attr(struct in6_addr *gw, struct nlattr *nla, -+ struct netlink_ext_ack *extack) -+{ -+ if (nla_len(nla) < sizeof(*gw)) { -+ NL_SET_ERR_MSG(extack, "Invalid IPv6 address in RTA_GATEWAY"); -+ return -EINVAL; -+ } -+ -+ *gw = nla_get_in6_addr(nla); -+ -+ return 0; -+} -+ - static int ip6_route_multipath_add(struct fib6_config *cfg, - struct netlink_ext_ack *extack) - { -@@ -5133,10 +5146,18 @@ static int ip6_route_multipath_add(struct fib6_config *cfg, - - nla = nla_find(attrs, attrlen, RTA_GATEWAY); - if (nla) { -- r_cfg.fc_gateway = nla_get_in6_addr(nla); -+ err = fib6_gw_from_attr(&r_cfg.fc_gateway, nla, -+ extack); -+ if (err) -+ goto cleanup; -+ - r_cfg.fc_flags |= RTF_GATEWAY; - } - r_cfg.fc_encap = nla_find(attrs, attrlen, RTA_ENCAP); -+ -+ /* RTA_ENCAP_TYPE length checked in -+ * lwtunnel_valid_encap_type_attr -+ */ - nla = nla_find(attrs, attrlen, RTA_ENCAP_TYPE); - if (nla) - r_cfg.fc_encap_type = nla_get_u16(nla); -@@ -5288,7 +5309,13 @@ static int ip6_route_multipath_del(struct fib6_config *cfg, - - nla = nla_find(attrs, attrlen, RTA_GATEWAY); - if (nla) { -- nla_memcpy(&r_cfg.fc_gateway, nla, 16); -+ err = fib6_gw_from_attr(&r_cfg.fc_gateway, nla, -+ extack); -+ if (err) { -+ last_err = err; -+ goto next_rtnh; -+ } -+ - r_cfg.fc_flags |= RTF_GATEWAY; - } - } -@@ -5296,6 +5323,7 @@ static int ip6_route_multipath_del(struct fib6_config *cfg, - if (err) - last_err = err; - -+next_rtnh: - rtnh = rtnh_next(rtnh, &remaining); - } - -diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c -index 5c727af01143f..ad00f31e20023 100644 ---- a/net/mac80211/mlme.c -+++ b/net/mac80211/mlme.c -@@ -4953,7 +4953,7 @@ static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata, - */ - if (new_sta) { - u32 rates = 0, basic_rates = 0; -- bool have_higher_than_11mbit; -+ bool have_higher_than_11mbit = false; - int min_rate = INT_MAX, min_rate_index = -1; - const struct cfg80211_bss_ies *ies; - int shift = ieee80211_vif_get_shift(&sdata->vif); -diff --git a/net/phonet/pep.c b/net/phonet/pep.c -index a07e13f63332c..0c5d0f7b8b4bb 100644 ---- a/net/phonet/pep.c -+++ b/net/phonet/pep.c -@@ -868,6 +868,7 @@ static struct sock *pep_sock_accept(struct sock *sk, int flags, int *errp, - - err = pep_accept_conn(newsk, skb); - if (err) { -+ __sock_put(sk); - sock_put(newsk); - newsk = NULL; - goto drop; -diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c -index b046fd3cac2cf..1eb339d224ae5 100644 ---- a/net/sched/sch_qfq.c -+++ b/net/sched/sch_qfq.c -@@ -1421,10 +1421,8 @@ static int qfq_init_qdisc(struct Qdisc *sch, struct nlattr *opt, - if (err < 0) - return err; - -- if (qdisc_dev(sch)->tx_queue_len + 1 > QFQ_MAX_AGG_CLASSES) -- max_classes = QFQ_MAX_AGG_CLASSES; -- else -- max_classes = qdisc_dev(sch)->tx_queue_len + 1; -+ max_classes = min_t(u64, (u64)qdisc_dev(sch)->tx_queue_len + 1, -+ QFQ_MAX_AGG_CLASSES); - /* max_cl_shift = floor(log_2(max_classes)) */ - max_cl_shift = __fls(max_classes); - q->max_agg_classes = 1<dev.id)); -+ return sysfs_emit(buf, "%lu\n", topology_get_cpu_scale(cpu->dev.id)); - } - - static void update_topology_flags_workfn(struct work_struct *work); -diff --git a/drivers/base/cacheinfo.c b/drivers/base/cacheinfo.c -index 8d553c92cd322..6a8c2b5881be3 100644 ---- a/drivers/base/cacheinfo.c -+++ b/drivers/base/cacheinfo.c -@@ -377,7 +377,7 @@ static ssize_t size_show(struct device *dev, - { - struct cacheinfo *this_leaf = dev_get_drvdata(dev); - -- return sprintf(buf, "%uK\n", this_leaf->size >> 10); -+ return sysfs_emit(buf, "%uK\n", this_leaf->size >> 10); - } - - static ssize_t shared_cpumap_show_func(struct device *dev, bool list, char *buf) -@@ -407,11 +407,11 @@ static ssize_t type_show(struct device *dev, - - switch (this_leaf->type) { - case CACHE_TYPE_DATA: -- return sprintf(buf, "Data\n"); -+ return sysfs_emit(buf, "Data\n"); - case CACHE_TYPE_INST: -- return sprintf(buf, "Instruction\n"); -+ return sysfs_emit(buf, "Instruction\n"); - case CACHE_TYPE_UNIFIED: -- return sprintf(buf, "Unified\n"); -+ return sysfs_emit(buf, "Unified\n"); - default: - return -EINVAL; - } -@@ -425,11 +425,11 @@ static ssize_t allocation_policy_show(struct device *dev, - int n = 0; - - if ((ci_attr & CACHE_READ_ALLOCATE) && (ci_attr & CACHE_WRITE_ALLOCATE)) -- n = sprintf(buf, "ReadWriteAllocate\n"); -+ n = sysfs_emit(buf, "ReadWriteAllocate\n"); - else if (ci_attr & CACHE_READ_ALLOCATE) -- n = sprintf(buf, "ReadAllocate\n"); -+ n = sysfs_emit(buf, "ReadAllocate\n"); - else if (ci_attr & CACHE_WRITE_ALLOCATE) -- n = sprintf(buf, "WriteAllocate\n"); -+ n = sysfs_emit(buf, "WriteAllocate\n"); - return n; - } - -@@ -441,9 +441,9 @@ static ssize_t write_policy_show(struct device *dev, - int n = 0; - - if (ci_attr & CACHE_WRITE_THROUGH) -- n = sprintf(buf, "WriteThrough\n"); -+ n = sysfs_emit(buf, "WriteThrough\n"); - else if (ci_attr & CACHE_WRITE_BACK) -- n = sprintf(buf, "WriteBack\n"); -+ n = sysfs_emit(buf, "WriteBack\n"); - return n; - } - -diff --git a/drivers/base/core.c b/drivers/base/core.c -index 8b651bfc1d88e..1b016fdd1a750 100644 ---- a/drivers/base/core.c -+++ b/drivers/base/core.c -@@ -1027,7 +1027,7 @@ ssize_t device_show_ulong(struct device *dev, - char *buf) - { - struct dev_ext_attribute *ea = to_ext_attr(attr); -- return snprintf(buf, PAGE_SIZE, "%lx\n", *(unsigned long *)(ea->var)); -+ return sysfs_emit(buf, "%lx\n", *(unsigned long *)(ea->var)); - } - EXPORT_SYMBOL_GPL(device_show_ulong); - -@@ -1057,7 +1057,7 @@ ssize_t device_show_int(struct device *dev, - { - struct dev_ext_attribute *ea = to_ext_attr(attr); - -- return snprintf(buf, PAGE_SIZE, "%d\n", *(int *)(ea->var)); -+ return sysfs_emit(buf, "%d\n", *(int *)(ea->var)); - } - EXPORT_SYMBOL_GPL(device_show_int); - -@@ -1078,7 +1078,7 @@ ssize_t device_show_bool(struct device *dev, struct device_attribute *attr, - { - struct dev_ext_attribute *ea = to_ext_attr(attr); - -- return snprintf(buf, PAGE_SIZE, "%d\n", *(bool *)(ea->var)); -+ return sysfs_emit(buf, "%d\n", *(bool *)(ea->var)); - } - EXPORT_SYMBOL_GPL(device_show_bool); - -@@ -1310,7 +1310,7 @@ static ssize_t online_show(struct device *dev, struct device_attribute *attr, - device_lock(dev); - val = !dev->offline; - device_unlock(dev); -- return sprintf(buf, "%u\n", val); -+ return sysfs_emit(buf, "%u\n", val); - } - - static ssize_t online_store(struct device *dev, struct device_attribute *attr, -diff --git a/drivers/base/cpu.c b/drivers/base/cpu.c -index f00da44ae6fe0..81ec0a1020d60 100644 ---- a/drivers/base/cpu.c -+++ b/drivers/base/cpu.c -@@ -156,7 +156,7 @@ static ssize_t show_crash_notes(struct device *dev, struct device_attribute *att - * operation should be safe. No locking required. - */ - addr = per_cpu_ptr_to_phys(per_cpu_ptr(crash_notes, cpunum)); -- rc = sprintf(buf, "%Lx\n", addr); -+ rc = sysfs_emit(buf, "%Lx\n", addr); - return rc; - } - static DEVICE_ATTR(crash_notes, 0400, show_crash_notes, NULL); -@@ -167,7 +167,7 @@ static ssize_t show_crash_notes_size(struct device *dev, - { - ssize_t rc; - -- rc = sprintf(buf, "%zu\n", sizeof(note_buf_t)); -+ rc = sysfs_emit(buf, "%zu\n", sizeof(note_buf_t)); - return rc; - } - static DEVICE_ATTR(crash_notes_size, 0400, show_crash_notes_size, NULL); -@@ -231,8 +231,7 @@ static struct cpu_attr cpu_attrs[] = { - static ssize_t print_cpus_kernel_max(struct device *dev, - struct device_attribute *attr, char *buf) - { -- int n = snprintf(buf, PAGE_SIZE-2, "%d\n", NR_CPUS - 1); -- return n; -+ return sprintf(buf, "%d\n", NR_CPUS - 1); - } - static DEVICE_ATTR(kernel_max, 0444, print_cpus_kernel_max, NULL); - -@@ -272,7 +271,7 @@ static DEVICE_ATTR(offline, 0444, print_cpus_offline, NULL); - static ssize_t print_cpus_isolated(struct device *dev, - struct device_attribute *attr, char *buf) - { -- int n = 0, len = PAGE_SIZE-2; -+ int n; - cpumask_var_t isolated; - - if (!alloc_cpumask_var(&isolated, GFP_KERNEL)) -@@ -280,7 +279,7 @@ static ssize_t print_cpus_isolated(struct device *dev, - - cpumask_andnot(isolated, cpu_possible_mask, - housekeeping_cpumask(HK_FLAG_DOMAIN)); -- n = scnprintf(buf, len, "%*pbl\n", cpumask_pr_args(isolated)); -+ n = sysfs_emit(buf, "%*pbl\n", cpumask_pr_args(isolated)); - - free_cpumask_var(isolated); - -@@ -292,11 +291,7 @@ static DEVICE_ATTR(isolated, 0444, print_cpus_isolated, NULL); - static ssize_t print_cpus_nohz_full(struct device *dev, - struct device_attribute *attr, char *buf) - { -- int n = 0, len = PAGE_SIZE-2; -- -- n = scnprintf(buf, len, "%*pbl\n", cpumask_pr_args(tick_nohz_full_mask)); -- -- return n; -+ return sysfs_emit(buf, "%*pbl\n", cpumask_pr_args(tick_nohz_full_mask)); - } - static DEVICE_ATTR(nohz_full, 0444, print_cpus_nohz_full, NULL); - #endif -@@ -328,8 +323,8 @@ static ssize_t print_cpu_modalias(struct device *dev, - ssize_t n; - u32 i; - -- n = sprintf(buf, "cpu:type:" CPU_FEATURE_TYPEFMT ":feature:", -- CPU_FEATURE_TYPEVAL); -+ n = sysfs_emit(buf, "cpu:type:" CPU_FEATURE_TYPEFMT ":feature:", -+ CPU_FEATURE_TYPEVAL); - - for (i = 0; i < MAX_CPU_FEATURES; i++) - if (cpu_have_feature(i)) { -@@ -521,56 +516,56 @@ static void __init cpu_dev_register_generic(void) - ssize_t __weak cpu_show_meltdown(struct device *dev, - struct device_attribute *attr, char *buf) - { -- return sprintf(buf, "Not affected\n"); -+ return sysfs_emit(buf, "Not affected\n"); - } - - ssize_t __weak cpu_show_spectre_v1(struct device *dev, - struct device_attribute *attr, char *buf) - { -- return sprintf(buf, "Not affected\n"); -+ return sysfs_emit(buf, "Not affected\n"); - } - - ssize_t __weak cpu_show_spectre_v2(struct device *dev, - struct device_attribute *attr, char *buf) - { -- return sprintf(buf, "Not affected\n"); -+ return sysfs_emit(buf, "Not affected\n"); - } - - ssize_t __weak cpu_show_spec_store_bypass(struct device *dev, - struct device_attribute *attr, char *buf) - { -- return sprintf(buf, "Not affected\n"); -+ return sysfs_emit(buf, "Not affected\n"); - } - - ssize_t __weak cpu_show_l1tf(struct device *dev, - struct device_attribute *attr, char *buf) - { -- return sprintf(buf, "Not affected\n"); -+ return sysfs_emit(buf, "Not affected\n"); - } - - ssize_t __weak cpu_show_mds(struct device *dev, - struct device_attribute *attr, char *buf) - { -- return sprintf(buf, "Not affected\n"); -+ return sysfs_emit(buf, "Not affected\n"); - } - - ssize_t __weak cpu_show_tsx_async_abort(struct device *dev, - struct device_attribute *attr, - char *buf) - { -- return sprintf(buf, "Not affected\n"); -+ return sysfs_emit(buf, "Not affected\n"); - } - - ssize_t __weak cpu_show_itlb_multihit(struct device *dev, - struct device_attribute *attr, char *buf) - { -- return sprintf(buf, "Not affected\n"); -+ return sysfs_emit(buf, "Not affected\n"); - } - - ssize_t __weak cpu_show_srbds(struct device *dev, - struct device_attribute *attr, char *buf) - { -- return sprintf(buf, "Not affected\n"); -+ return sysfs_emit(buf, "Not affected\n"); - } - - static DEVICE_ATTR(meltdown, 0444, cpu_show_meltdown, NULL); -diff --git a/drivers/base/firmware_loader/fallback.c b/drivers/base/firmware_loader/fallback.c -index 5f3e5d8372590..19d18afb30864 100644 ---- a/drivers/base/firmware_loader/fallback.c -+++ b/drivers/base/firmware_loader/fallback.c -@@ -215,7 +215,7 @@ static ssize_t firmware_loading_show(struct device *dev, - loading = fw_sysfs_loading(fw_sysfs->fw_priv); - mutex_unlock(&fw_lock); - -- return sprintf(buf, "%d\n", loading); -+ return sysfs_emit(buf, "%d\n", loading); - } - - /** -diff --git a/drivers/base/memory.c b/drivers/base/memory.c -index 5a8c430fb8ffa..729e93e0c1c13 100644 ---- a/drivers/base/memory.c -+++ b/drivers/base/memory.c -@@ -110,7 +110,7 @@ static ssize_t phys_index_show(struct device *dev, - unsigned long phys_index; - - phys_index = mem->start_section_nr / sections_per_block; -- return sprintf(buf, "%08lx\n", phys_index); -+ return sysfs_emit(buf, "%08lx\n", phys_index); - } - - /* -@@ -120,7 +120,7 @@ static ssize_t phys_index_show(struct device *dev, - static ssize_t removable_show(struct device *dev, struct device_attribute *attr, - char *buf) - { -- return sprintf(buf, "%d\n", (int)IS_ENABLED(CONFIG_MEMORY_HOTREMOVE)); -+ return sysfs_emit(buf, "%d\n", (int)IS_ENABLED(CONFIG_MEMORY_HOTREMOVE)); - } - - /* -@@ -138,17 +138,17 @@ static ssize_t state_show(struct device *dev, struct device_attribute *attr, - */ - switch (mem->state) { - case MEM_ONLINE: -- len = sprintf(buf, "online\n"); -+ len = sysfs_emit(buf, "online\n"); - break; - case MEM_OFFLINE: -- len = sprintf(buf, "offline\n"); -+ len = sysfs_emit(buf, "offline\n"); - break; - case MEM_GOING_OFFLINE: -- len = sprintf(buf, "going-offline\n"); -+ len = sysfs_emit(buf, "going-offline\n"); - break; - default: -- len = sprintf(buf, "ERROR-UNKNOWN-%ld\n", -- mem->state); -+ len = sysfs_emit(buf, "ERROR-UNKNOWN-%ld\n", -+ mem->state); - WARN_ON(1); - break; - } -@@ -358,7 +358,7 @@ static ssize_t phys_device_show(struct device *dev, - struct device_attribute *attr, char *buf) - { - struct memory_block *mem = to_memory_block(dev); -- return sprintf(buf, "%d\n", mem->phys_device); -+ return sysfs_emit(buf, "%d\n", mem->phys_device); - } - - #ifdef CONFIG_MEMORY_HOTREMOVE -@@ -396,7 +396,7 @@ static ssize_t valid_zones_show(struct device *dev, - */ - if (!test_pages_in_a_zone(start_pfn, start_pfn + nr_pages, - &valid_start_pfn, &valid_end_pfn)) -- return sprintf(buf, "none\n"); -+ return sysfs_emit(buf, "none\n"); - start_pfn = valid_start_pfn; - strcat(buf, page_zone(pfn_to_page(start_pfn))->name); - goto out; -@@ -429,7 +429,7 @@ static DEVICE_ATTR_RO(removable); - static ssize_t block_size_bytes_show(struct device *dev, - struct device_attribute *attr, char *buf) - { -- return sprintf(buf, "%lx\n", memory_block_size_bytes()); -+ return sysfs_emit(buf, "%lx\n", memory_block_size_bytes()); - } - - static DEVICE_ATTR_RO(block_size_bytes); -@@ -442,9 +442,9 @@ static ssize_t auto_online_blocks_show(struct device *dev, - struct device_attribute *attr, char *buf) - { - if (memhp_auto_online) -- return sprintf(buf, "online\n"); -+ return sysfs_emit(buf, "online\n"); - else -- return sprintf(buf, "offline\n"); -+ return sysfs_emit(buf, "offline\n"); - } - - static ssize_t auto_online_blocks_store(struct device *dev, -diff --git a/drivers/base/node.c b/drivers/base/node.c -index c9976dc4aa65f..62a052990bb9b 100644 ---- a/drivers/base/node.c -+++ b/drivers/base/node.c -@@ -368,7 +368,7 @@ static ssize_t node_read_meminfo(struct device *dev, - si_meminfo_node(&i, nid); - sreclaimable = node_page_state(pgdat, NR_SLAB_RECLAIMABLE); - sunreclaimable = node_page_state(pgdat, NR_SLAB_UNRECLAIMABLE); -- n = sprintf(buf, -+ n = sysfs_emit(buf, - "Node %d MemTotal: %8lu kB\n" - "Node %d MemFree: %8lu kB\n" - "Node %d MemUsed: %8lu kB\n" -@@ -469,19 +469,19 @@ static DEVICE_ATTR(meminfo, S_IRUGO, node_read_meminfo, NULL); - static ssize_t node_read_numastat(struct device *dev, - struct device_attribute *attr, char *buf) - { -- return sprintf(buf, -- "numa_hit %lu\n" -- "numa_miss %lu\n" -- "numa_foreign %lu\n" -- "interleave_hit %lu\n" -- "local_node %lu\n" -- "other_node %lu\n", -- sum_zone_numa_state(dev->id, NUMA_HIT), -- sum_zone_numa_state(dev->id, NUMA_MISS), -- sum_zone_numa_state(dev->id, NUMA_FOREIGN), -- sum_zone_numa_state(dev->id, NUMA_INTERLEAVE_HIT), -- sum_zone_numa_state(dev->id, NUMA_LOCAL), -- sum_zone_numa_state(dev->id, NUMA_OTHER)); -+ return sysfs_emit(buf, -+ "numa_hit %lu\n" -+ "numa_miss %lu\n" -+ "numa_foreign %lu\n" -+ "interleave_hit %lu\n" -+ "local_node %lu\n" -+ "other_node %lu\n", -+ sum_zone_numa_state(dev->id, NUMA_HIT), -+ sum_zone_numa_state(dev->id, NUMA_MISS), -+ sum_zone_numa_state(dev->id, NUMA_FOREIGN), -+ sum_zone_numa_state(dev->id, NUMA_INTERLEAVE_HIT), -+ sum_zone_numa_state(dev->id, NUMA_LOCAL), -+ sum_zone_numa_state(dev->id, NUMA_OTHER)); - } - static DEVICE_ATTR(numastat, S_IRUGO, node_read_numastat, NULL); - -diff --git a/drivers/base/platform.c b/drivers/base/platform.c -index 0b67d41bab8ff..75623b914b8c2 100644 ---- a/drivers/base/platform.c -+++ b/drivers/base/platform.c -@@ -1009,7 +1009,7 @@ static ssize_t driver_override_show(struct device *dev, - ssize_t len; - - device_lock(dev); -- len = sprintf(buf, "%s\n", pdev->driver_override); -+ len = sysfs_emit(buf, "%s\n", pdev->driver_override); - device_unlock(dev); - return len; - } -diff --git a/drivers/base/power/sysfs.c b/drivers/base/power/sysfs.c -index d7d82db2e4bc4..2786962e08107 100644 ---- a/drivers/base/power/sysfs.c -+++ b/drivers/base/power/sysfs.c -@@ -100,7 +100,7 @@ static const char ctrl_on[] = "on"; - static ssize_t control_show(struct device *dev, struct device_attribute *attr, - char *buf) - { -- return sprintf(buf, "%s\n", -+ return sysfs_emit(buf, "%s\n", - dev->power.runtime_auto ? ctrl_auto : ctrl_on); - } - -@@ -126,7 +126,7 @@ static ssize_t runtime_active_time_show(struct device *dev, - int ret; - u64 tmp = pm_runtime_active_time(dev); - do_div(tmp, NSEC_PER_MSEC); -- ret = sprintf(buf, "%llu\n", tmp); -+ ret = sysfs_emit(buf, "%llu\n", tmp); - return ret; - } - -@@ -138,7 +138,7 @@ static ssize_t runtime_suspended_time_show(struct device *dev, - int ret; - u64 tmp = pm_runtime_suspended_time(dev); - do_div(tmp, NSEC_PER_MSEC); -- ret = sprintf(buf, "%llu\n", tmp); -+ ret = sysfs_emit(buf, "%llu\n", tmp); - return ret; - } - -@@ -171,7 +171,7 @@ static ssize_t runtime_status_show(struct device *dev, - return -EIO; - } - } -- return sprintf(buf, p); -+ return sysfs_emit(buf, p); - } - - static DEVICE_ATTR_RO(runtime_status); -@@ -181,7 +181,7 @@ static ssize_t autosuspend_delay_ms_show(struct device *dev, - { - if (!dev->power.use_autosuspend) - return -EIO; -- return sprintf(buf, "%d\n", dev->power.autosuspend_delay); -+ return sysfs_emit(buf, "%d\n", dev->power.autosuspend_delay); - } - - static ssize_t autosuspend_delay_ms_store(struct device *dev, -@@ -210,11 +210,11 @@ static ssize_t pm_qos_resume_latency_us_show(struct device *dev, - s32 value = dev_pm_qos_requested_resume_latency(dev); - - if (value == 0) -- return sprintf(buf, "n/a\n"); -+ return sysfs_emit(buf, "n/a\n"); - if (value == PM_QOS_RESUME_LATENCY_NO_CONSTRAINT) - value = 0; - -- return sprintf(buf, "%d\n", value); -+ return sysfs_emit(buf, "%d\n", value); - } - - static ssize_t pm_qos_resume_latency_us_store(struct device *dev, -@@ -254,11 +254,11 @@ static ssize_t pm_qos_latency_tolerance_us_show(struct device *dev, - s32 value = dev_pm_qos_get_user_latency_tolerance(dev); - - if (value < 0) -- return sprintf(buf, "auto\n"); -+ return sysfs_emit(buf, "auto\n"); - if (value == PM_QOS_LATENCY_ANY) -- return sprintf(buf, "any\n"); -+ return sysfs_emit(buf, "any\n"); - -- return sprintf(buf, "%d\n", value); -+ return sysfs_emit(buf, "%d\n", value); - } - - static ssize_t pm_qos_latency_tolerance_us_store(struct device *dev, -@@ -290,8 +290,8 @@ static ssize_t pm_qos_no_power_off_show(struct device *dev, - struct device_attribute *attr, - char *buf) - { -- return sprintf(buf, "%d\n", !!(dev_pm_qos_requested_flags(dev) -- & PM_QOS_FLAG_NO_POWER_OFF)); -+ return sysfs_emit(buf, "%d\n", !!(dev_pm_qos_requested_flags(dev) -+ & PM_QOS_FLAG_NO_POWER_OFF)); - } - - static ssize_t pm_qos_no_power_off_store(struct device *dev, -@@ -319,9 +319,9 @@ static const char _disabled[] = "disabled"; - static ssize_t wakeup_show(struct device *dev, struct device_attribute *attr, - char *buf) - { -- return sprintf(buf, "%s\n", device_can_wakeup(dev) -- ? (device_may_wakeup(dev) ? _enabled : _disabled) -- : ""); -+ return sysfs_emit(buf, "%s\n", device_can_wakeup(dev) -+ ? (device_may_wakeup(dev) ? _enabled : _disabled) -+ : ""); - } - - static ssize_t wakeup_store(struct device *dev, struct device_attribute *attr, -@@ -507,7 +507,7 @@ static DEVICE_ATTR_RO(wakeup_prevent_sleep_time_ms); - static ssize_t runtime_usage_show(struct device *dev, - struct device_attribute *attr, char *buf) - { -- return sprintf(buf, "%d\n", atomic_read(&dev->power.usage_count)); -+ return sysfs_emit(buf, "%d\n", atomic_read(&dev->power.usage_count)); - } - static DEVICE_ATTR_RO(runtime_usage); - -@@ -515,8 +515,8 @@ static ssize_t runtime_active_kids_show(struct device *dev, - struct device_attribute *attr, - char *buf) - { -- return sprintf(buf, "%d\n", dev->power.ignore_children ? -- 0 : atomic_read(&dev->power.child_count)); -+ return sysfs_emit(buf, "%d\n", dev->power.ignore_children ? -+ 0 : atomic_read(&dev->power.child_count)); - } - static DEVICE_ATTR_RO(runtime_active_kids); - -@@ -524,12 +524,12 @@ static ssize_t runtime_enabled_show(struct device *dev, - struct device_attribute *attr, char *buf) - { - if (dev->power.disable_depth && (dev->power.runtime_auto == false)) -- return sprintf(buf, "disabled & forbidden\n"); -+ return sysfs_emit(buf, "disabled & forbidden\n"); - if (dev->power.disable_depth) -- return sprintf(buf, "disabled\n"); -+ return sysfs_emit(buf, "disabled\n"); - if (dev->power.runtime_auto == false) -- return sprintf(buf, "forbidden\n"); -- return sprintf(buf, "enabled\n"); -+ return sysfs_emit(buf, "forbidden\n"); -+ return sysfs_emit(buf, "enabled\n"); - } - static DEVICE_ATTR_RO(runtime_enabled); - -@@ -537,9 +537,9 @@ static DEVICE_ATTR_RO(runtime_enabled); - static ssize_t async_show(struct device *dev, struct device_attribute *attr, - char *buf) - { -- return sprintf(buf, "%s\n", -- device_async_suspend_enabled(dev) ? -- _enabled : _disabled); -+ return sysfs_emit(buf, "%s\n", -+ device_async_suspend_enabled(dev) ? -+ _enabled : _disabled); - } - - static ssize_t async_store(struct device *dev, struct device_attribute *attr, -diff --git a/drivers/base/power/wakeup_stats.c b/drivers/base/power/wakeup_stats.c -index c7734914d9144..5568e25d7c9c2 100644 ---- a/drivers/base/power/wakeup_stats.c -+++ b/drivers/base/power/wakeup_stats.c -@@ -42,7 +42,7 @@ static ssize_t active_time_ms_show(struct device *dev, - ktime_t active_time = - ws->active ? ktime_sub(ktime_get(), ws->last_time) : 0; - -- return sprintf(buf, "%lld\n", ktime_to_ms(active_time)); -+ return sysfs_emit(buf, "%lld\n", ktime_to_ms(active_time)); - } - static DEVICE_ATTR_RO(active_time_ms); - -@@ -57,7 +57,7 @@ static ssize_t total_time_ms_show(struct device *dev, - active_time = ktime_sub(ktime_get(), ws->last_time); - total_time = ktime_add(total_time, active_time); - } -- return sprintf(buf, "%lld\n", ktime_to_ms(total_time)); -+ return sysfs_emit(buf, "%lld\n", ktime_to_ms(total_time)); - } - static DEVICE_ATTR_RO(total_time_ms); - -@@ -73,7 +73,7 @@ static ssize_t max_time_ms_show(struct device *dev, - if (active_time > max_time) - max_time = active_time; - } -- return sprintf(buf, "%lld\n", ktime_to_ms(max_time)); -+ return sysfs_emit(buf, "%lld\n", ktime_to_ms(max_time)); - } - static DEVICE_ATTR_RO(max_time_ms); - -@@ -82,7 +82,7 @@ static ssize_t last_change_ms_show(struct device *dev, - { - struct wakeup_source *ws = dev_get_drvdata(dev); - -- return sprintf(buf, "%lld\n", ktime_to_ms(ws->last_time)); -+ return sysfs_emit(buf, "%lld\n", ktime_to_ms(ws->last_time)); - } - static DEVICE_ATTR_RO(last_change_ms); - -@@ -91,7 +91,7 @@ static ssize_t name_show(struct device *dev, struct device_attribute *attr, - { - struct wakeup_source *ws = dev_get_drvdata(dev); - -- return sprintf(buf, "%s\n", ws->name); -+ return sysfs_emit(buf, "%s\n", ws->name); - } - static DEVICE_ATTR_RO(name); - -@@ -106,7 +106,7 @@ static ssize_t prevent_suspend_time_ms_show(struct device *dev, - prevent_sleep_time = ktime_add(prevent_sleep_time, - ktime_sub(ktime_get(), ws->start_prevent_time)); - } -- return sprintf(buf, "%lld\n", ktime_to_ms(prevent_sleep_time)); -+ return sysfs_emit(buf, "%lld\n", ktime_to_ms(prevent_sleep_time)); - } - static DEVICE_ATTR_RO(prevent_suspend_time_ms); - -diff --git a/drivers/base/soc.c b/drivers/base/soc.c -index 7c0c5ca5953d2..735f122c2ba31 100644 ---- a/drivers/base/soc.c -+++ b/drivers/base/soc.c -@@ -76,15 +76,15 @@ static ssize_t soc_info_get(struct device *dev, - struct soc_device *soc_dev = container_of(dev, struct soc_device, dev); - - if (attr == &dev_attr_machine) -- return sprintf(buf, "%s\n", soc_dev->attr->machine); -+ return sysfs_emit(buf, "%s\n", soc_dev->attr->machine); - if (attr == &dev_attr_family) -- return sprintf(buf, "%s\n", soc_dev->attr->family); -+ return sysfs_emit(buf, "%s\n", soc_dev->attr->family); - if (attr == &dev_attr_revision) -- return sprintf(buf, "%s\n", soc_dev->attr->revision); -+ return sysfs_emit(buf, "%s\n", soc_dev->attr->revision); - if (attr == &dev_attr_serial_number) -- return sprintf(buf, "%s\n", soc_dev->attr->serial_number); -+ return sysfs_emit(buf, "%s\n", soc_dev->attr->serial_number); - if (attr == &dev_attr_soc_id) -- return sprintf(buf, "%s\n", soc_dev->attr->soc_id); -+ return sysfs_emit(buf, "%s\n", soc_dev->attr->soc_id); - - return -EINVAL; - -diff --git a/drivers/bluetooth/bfusb.c b/drivers/bluetooth/bfusb.c -index 0e5954cac98e0..00d72f6d8e8e2 100644 ---- a/drivers/bluetooth/bfusb.c -+++ b/drivers/bluetooth/bfusb.c -@@ -629,6 +629,9 @@ static int bfusb_probe(struct usb_interface *intf, const struct usb_device_id *i - data->bulk_out_ep = bulk_out_ep->desc.bEndpointAddress; - data->bulk_pkt_size = le16_to_cpu(bulk_out_ep->desc.wMaxPacketSize); - -+ if (!data->bulk_pkt_size) -+ goto done; -+ - rwlock_init(&data->lock); - - data->reassembly = NULL; -diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c -index 6d643651d69f7..c8f2b991e9cf7 100644 ---- a/drivers/bluetooth/btusb.c -+++ b/drivers/bluetooth/btusb.c -@@ -2568,6 +2568,7 @@ static void btusb_mtk_wmt_recv(struct urb *urb) - skb = bt_skb_alloc(HCI_WMT_MAX_EVENT_SIZE, GFP_ATOMIC); - if (!skb) { - hdev->stat.err_rx++; -+ kfree(urb->setup_packet); - return; - } - -@@ -2588,6 +2589,7 @@ static void btusb_mtk_wmt_recv(struct urb *urb) - data->evt_skb = skb_clone(skb, GFP_ATOMIC); - if (!data->evt_skb) { - kfree_skb(skb); -+ kfree(urb->setup_packet); - return; - } - } -@@ -2596,6 +2598,7 @@ static void btusb_mtk_wmt_recv(struct urb *urb) - if (err < 0) { - kfree_skb(data->evt_skb); - data->evt_skb = NULL; -+ kfree(urb->setup_packet); - return; - } - -@@ -2606,6 +2609,7 @@ static void btusb_mtk_wmt_recv(struct urb *urb) - wake_up_bit(&data->flags, - BTUSB_TX_WAIT_VND_EVT); - } -+ kfree(urb->setup_packet); - return; - } else if (urb->status == -ENOENT) { - /* Avoid suspend failed when usb_kill_urb */ -@@ -2626,6 +2630,7 @@ static void btusb_mtk_wmt_recv(struct urb *urb) - usb_anchor_urb(urb, &data->ctrl_anchor); - err = usb_submit_urb(urb, GFP_ATOMIC); - if (err < 0) { -+ kfree(urb->setup_packet); - /* -EPERM: urb is being killed; - * -ENODEV: device got disconnected - */ -diff --git a/drivers/char/random.c b/drivers/char/random.c -index ffd61aadb7614..60b39af1279a4 100644 ---- a/drivers/char/random.c -+++ b/drivers/char/random.c -@@ -497,6 +497,7 @@ static struct crng_state primary_crng = { - * its value (from 0->1->2). - */ - static int crng_init = 0; -+static bool crng_need_final_init = false; - #define crng_ready() (likely(crng_init > 1)) - static int crng_init_cnt = 0; - static unsigned long crng_global_init_time = 0; -@@ -889,6 +890,38 @@ static void crng_initialize(struct crng_state *crng) - crng->init_time = jiffies - CRNG_RESEED_INTERVAL - 1; - } - -+static void crng_finalize_init(struct crng_state *crng) -+{ -+ if (crng != &primary_crng || crng_init >= 2) -+ return; -+ if (!system_wq) { -+ /* We can't call numa_crng_init until we have workqueues, -+ * so mark this for processing later. */ -+ crng_need_final_init = true; -+ return; -+ } -+ -+ invalidate_batched_entropy(); -+ numa_crng_init(); -+ crng_init = 2; -+ process_random_ready_list(); -+ wake_up_interruptible(&crng_init_wait); -+ kill_fasync(&fasync, SIGIO, POLL_IN); -+ pr_notice("crng init done\n"); -+ if (unseeded_warning.missed) { -+ pr_notice("random: %d get_random_xx warning(s) missed " -+ "due to ratelimiting\n", -+ unseeded_warning.missed); -+ unseeded_warning.missed = 0; -+ } -+ if (urandom_warning.missed) { -+ pr_notice("random: %d urandom warning(s) missed " -+ "due to ratelimiting\n", -+ urandom_warning.missed); -+ urandom_warning.missed = 0; -+ } -+} -+ - #ifdef CONFIG_NUMA - static void do_numa_crng_init(struct work_struct *work) - { -@@ -904,8 +937,8 @@ static void do_numa_crng_init(struct work_struct *work) - crng_initialize(crng); - pool[i] = crng; - } -- mb(); -- if (cmpxchg(&crng_node_pool, NULL, pool)) { -+ /* pairs with READ_ONCE() in select_crng() */ -+ if (cmpxchg_release(&crng_node_pool, NULL, pool) != NULL) { - for_each_node(i) - kfree(pool[i]); - kfree(pool); -@@ -918,8 +951,26 @@ static void numa_crng_init(void) - { - schedule_work(&numa_crng_init_work); - } -+ -+static struct crng_state *select_crng(void) -+{ -+ struct crng_state **pool; -+ int nid = numa_node_id(); -+ -+ /* pairs with cmpxchg_release() in do_numa_crng_init() */ -+ pool = READ_ONCE(crng_node_pool); -+ if (pool && pool[nid]) -+ return pool[nid]; -+ -+ return &primary_crng; -+} - #else - static void numa_crng_init(void) {} -+ -+static struct crng_state *select_crng(void) -+{ -+ return &primary_crng; -+} - #endif - - /* -@@ -1024,39 +1075,23 @@ static void crng_reseed(struct crng_state *crng, struct entropy_store *r) - crng->state[i+4] ^= buf.key[i] ^ rv; - } - memzero_explicit(&buf, sizeof(buf)); -- crng->init_time = jiffies; -+ WRITE_ONCE(crng->init_time, jiffies); - spin_unlock_irqrestore(&crng->lock, flags); -- if (crng == &primary_crng && crng_init < 2) { -- invalidate_batched_entropy(); -- numa_crng_init(); -- crng_init = 2; -- process_random_ready_list(); -- wake_up_interruptible(&crng_init_wait); -- pr_notice("random: crng init done\n"); -- if (unseeded_warning.missed) { -- pr_notice("random: %d get_random_xx warning(s) missed " -- "due to ratelimiting\n", -- unseeded_warning.missed); -- unseeded_warning.missed = 0; -- } -- if (urandom_warning.missed) { -- pr_notice("random: %d urandom warning(s) missed " -- "due to ratelimiting\n", -- urandom_warning.missed); -- urandom_warning.missed = 0; -- } -- } -+ crng_finalize_init(crng); - } - - static void _extract_crng(struct crng_state *crng, - __u8 out[CHACHA_BLOCK_SIZE]) - { -- unsigned long v, flags; -+ unsigned long v, flags, init_time; - -- if (crng_ready() && -- (time_after(crng_global_init_time, crng->init_time) || -- time_after(jiffies, crng->init_time + CRNG_RESEED_INTERVAL))) -- crng_reseed(crng, crng == &primary_crng ? &input_pool : NULL); -+ if (crng_ready()) { -+ init_time = READ_ONCE(crng->init_time); -+ if (time_after(READ_ONCE(crng_global_init_time), init_time) || -+ time_after(jiffies, init_time + CRNG_RESEED_INTERVAL)) -+ crng_reseed(crng, crng == &primary_crng ? -+ &input_pool : NULL); -+ } - spin_lock_irqsave(&crng->lock, flags); - if (arch_get_random_long(&v)) - crng->state[14] ^= v; -@@ -1068,15 +1103,7 @@ static void _extract_crng(struct crng_state *crng, - - static void extract_crng(__u8 out[CHACHA_BLOCK_SIZE]) - { -- struct crng_state *crng = NULL; -- --#ifdef CONFIG_NUMA -- if (crng_node_pool) -- crng = crng_node_pool[numa_node_id()]; -- if (crng == NULL) --#endif -- crng = &primary_crng; -- _extract_crng(crng, out); -+ _extract_crng(select_crng(), out); - } - - /* -@@ -1105,15 +1132,7 @@ static void _crng_backtrack_protect(struct crng_state *crng, - - static void crng_backtrack_protect(__u8 tmp[CHACHA_BLOCK_SIZE], int used) - { -- struct crng_state *crng = NULL; -- --#ifdef CONFIG_NUMA -- if (crng_node_pool) -- crng = crng_node_pool[numa_node_id()]; -- if (crng == NULL) --#endif -- crng = &primary_crng; -- _crng_backtrack_protect(crng, tmp, used); -+ _crng_backtrack_protect(select_crng(), tmp, used); - } - - static ssize_t extract_crng_user(void __user *buf, size_t nbytes) -@@ -1957,6 +1976,8 @@ int __init rand_initialize(void) - { - init_std_data(&input_pool); - init_std_data(&blocking_pool); -+ if (crng_need_final_init) -+ crng_finalize_init(&primary_crng); - crng_initialize(&primary_crng); - crng_global_init_time = jiffies; - if (ratelimit_disable) { -@@ -2150,7 +2171,7 @@ static long random_ioctl(struct file *f, unsigned int cmd, unsigned long arg) - if (crng_init < 2) - return -ENODATA; - crng_reseed(&primary_crng, &input_pool); -- crng_global_init_time = jiffies - 1; -+ WRITE_ONCE(crng_global_init_time, jiffies - 1); - return 0; - default: - return -EINVAL; -@@ -2488,7 +2509,8 @@ void add_hwgenerator_randomness(const char *buffer, size_t count, - * We'll be woken up again once below random_write_wakeup_thresh, - * or when the calling thread is about to terminate. - */ -- wait_event_interruptible(random_write_wait, kthread_should_stop() || -+ wait_event_interruptible(random_write_wait, -+ !system_wq || kthread_should_stop() || - ENTROPY_BITS(&input_pool) <= random_write_wakeup_bits); - mix_pool_bytes(poolp, buffer, count); - credit_entropy_bits(poolp, entropy); -diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c -index 91afeca0c6f82..e43a76b027a2a 100644 ---- a/drivers/gpu/drm/i915/intel_pm.c -+++ b/drivers/gpu/drm/i915/intel_pm.c -@@ -3017,9 +3017,9 @@ static void snb_wm_latency_quirk(struct drm_i915_private *dev_priv) - * The BIOS provided WM memory latency values are often - * inadequate for high resolution displays. Adjust them. - */ -- changed = ilk_increase_wm_latency(dev_priv, dev_priv->wm.pri_latency, 12) | -- ilk_increase_wm_latency(dev_priv, dev_priv->wm.spr_latency, 12) | -- ilk_increase_wm_latency(dev_priv, dev_priv->wm.cur_latency, 12); -+ changed = ilk_increase_wm_latency(dev_priv, dev_priv->wm.pri_latency, 12); -+ changed |= ilk_increase_wm_latency(dev_priv, dev_priv->wm.spr_latency, 12); -+ changed |= ilk_increase_wm_latency(dev_priv, dev_priv->wm.cur_latency, 12); - - if (!changed) - return; -diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c -index 378cfc46fc195..40ca1d4e03483 100644 ---- a/drivers/media/usb/uvc/uvc_driver.c -+++ b/drivers/media/usb/uvc/uvc_driver.c -@@ -1972,7 +1972,6 @@ int uvc_register_video_device(struct uvc_device *dev, - const struct v4l2_file_operations *fops, - const struct v4l2_ioctl_ops *ioctl_ops) - { -- const char *name; - int ret; - - /* Initialize the video buffers queue. */ -@@ -2001,20 +2000,16 @@ int uvc_register_video_device(struct uvc_device *dev, - case V4L2_BUF_TYPE_VIDEO_CAPTURE: - default: - vdev->device_caps = V4L2_CAP_VIDEO_CAPTURE | V4L2_CAP_STREAMING; -- name = "Video Capture"; - break; - case V4L2_BUF_TYPE_VIDEO_OUTPUT: - vdev->device_caps = V4L2_CAP_VIDEO_OUTPUT | V4L2_CAP_STREAMING; -- name = "Video Output"; - break; - case V4L2_BUF_TYPE_META_CAPTURE: - vdev->device_caps = V4L2_CAP_META_CAPTURE | V4L2_CAP_STREAMING; -- name = "Metadata"; - break; - } - -- snprintf(vdev->name, sizeof(vdev->name), "%s %u", name, -- stream->header.bTerminalLink); -+ strscpy(vdev->name, dev->name, sizeof(vdev->name)); - - /* - * Set the driver data before calling video_register_device, otherwise -diff --git a/drivers/mfd/intel-lpss-acpi.c b/drivers/mfd/intel-lpss-acpi.c -index c8fe334b5fe8b..045cbf0cbe53a 100644 ---- a/drivers/mfd/intel-lpss-acpi.c -+++ b/drivers/mfd/intel-lpss-acpi.c -@@ -102,6 +102,7 @@ static int intel_lpss_acpi_probe(struct platform_device *pdev) - { - struct intel_lpss_platform_info *info; - const struct acpi_device_id *id; -+ int ret; - - id = acpi_match_device(intel_lpss_acpi_ids, &pdev->dev); - if (!id) -@@ -115,10 +116,14 @@ static int intel_lpss_acpi_probe(struct platform_device *pdev) - info->mem = platform_get_resource(pdev, IORESOURCE_MEM, 0); - info->irq = platform_get_irq(pdev, 0); - -+ ret = intel_lpss_probe(&pdev->dev, info); -+ if (ret) -+ return ret; -+ - pm_runtime_set_active(&pdev->dev); - pm_runtime_enable(&pdev->dev); - -- return intel_lpss_probe(&pdev->dev, info); -+ return 0; - } - - static int intel_lpss_acpi_remove(struct platform_device *pdev) -diff --git a/drivers/mmc/host/sdhci-pci-core.c b/drivers/mmc/host/sdhci-pci-core.c -index a9151bd27211a..1e19c0d0bca80 100644 ---- a/drivers/mmc/host/sdhci-pci-core.c -+++ b/drivers/mmc/host/sdhci-pci-core.c -@@ -1936,6 +1936,7 @@ static const struct pci_device_id pci_ids[] = { - SDHCI_PCI_DEVICE(INTEL, JSL_SD, intel_byt_sd), - SDHCI_PCI_DEVICE(INTEL, LKF_EMMC, intel_glk_emmc), - SDHCI_PCI_DEVICE(INTEL, LKF_SD, intel_byt_sd), -+ SDHCI_PCI_DEVICE(INTEL, ADL_EMMC, intel_glk_emmc), - SDHCI_PCI_DEVICE(O2, 8120, o2), - SDHCI_PCI_DEVICE(O2, 8220, o2), - SDHCI_PCI_DEVICE(O2, 8221, o2), -diff --git a/drivers/mmc/host/sdhci-pci.h b/drivers/mmc/host/sdhci-pci.h -index 779156ce1ee17..b4ac314790b2c 100644 ---- a/drivers/mmc/host/sdhci-pci.h -+++ b/drivers/mmc/host/sdhci-pci.h -@@ -59,6 +59,7 @@ - #define PCI_DEVICE_ID_INTEL_JSL_SD 0x4df8 - #define PCI_DEVICE_ID_INTEL_LKF_EMMC 0x98c4 - #define PCI_DEVICE_ID_INTEL_LKF_SD 0x98f8 -+#define PCI_DEVICE_ID_INTEL_ADL_EMMC 0x54c4 - - #define PCI_DEVICE_ID_SYSKONNECT_8000 0x8000 - #define PCI_DEVICE_ID_VIA_95D0 0x95d0 -diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c -index 0ad13d78815c5..8b4c1bb77c334 100644 ---- a/drivers/net/can/usb/gs_usb.c -+++ b/drivers/net/can/usb/gs_usb.c -@@ -320,7 +320,7 @@ static void gs_usb_receive_bulk_callback(struct urb *urb) - - /* device reports out of range channel id */ - if (hf->channel >= GS_MAX_INTF) -- goto resubmit_urb; -+ goto device_detach; - - dev = usbcan->canch[hf->channel]; - -@@ -405,6 +405,7 @@ static void gs_usb_receive_bulk_callback(struct urb *urb) - - /* USB failure take down all interfaces */ - if (rc == -ENODEV) { -+ device_detach: - for (rc = 0; rc < GS_MAX_INTF; rc++) { - if (usbcan->canch[rc]) - netif_device_detach(usbcan->canch[rc]->netdev); -@@ -506,6 +507,8 @@ static netdev_tx_t gs_can_start_xmit(struct sk_buff *skb, - - hf->echo_id = idx; - hf->channel = dev->channel; -+ hf->flags = 0; -+ hf->reserved = 0; - - cf = (struct can_frame *)skb->data; - -diff --git a/drivers/net/veth.c b/drivers/net/veth.c -index 44ad412f9a06f..81a79e7132483 100644 ---- a/drivers/net/veth.c -+++ b/drivers/net/veth.c -@@ -254,7 +254,6 @@ static netdev_tx_t veth_xmit(struct sk_buff *skb, struct net_device *dev) - if (rxq < rcv->real_num_rx_queues) { - rq = &rcv_priv->rq[rxq]; - rcv_xdp = rcu_access_pointer(rq->xdp_prog); -- skb_record_rx_queue(skb, rxq); - } - - skb_tx_timestamp(skb); -diff --git a/drivers/staging/greybus/audio_topology.c b/drivers/staging/greybus/audio_topology.c -index cc329b990e165..a8cfea957868a 100644 ---- a/drivers/staging/greybus/audio_topology.c -+++ b/drivers/staging/greybus/audio_topology.c -@@ -983,6 +983,44 @@ static int gbaudio_widget_event(struct snd_soc_dapm_widget *w, - return ret; - } - -+static const struct snd_soc_dapm_widget gbaudio_widgets[] = { -+ [snd_soc_dapm_spk] = SND_SOC_DAPM_SPK(NULL, gbcodec_event_spk), -+ [snd_soc_dapm_hp] = SND_SOC_DAPM_HP(NULL, gbcodec_event_hp), -+ [snd_soc_dapm_mic] = SND_SOC_DAPM_MIC(NULL, gbcodec_event_int_mic), -+ [snd_soc_dapm_output] = SND_SOC_DAPM_OUTPUT(NULL), -+ [snd_soc_dapm_input] = SND_SOC_DAPM_INPUT(NULL), -+ [snd_soc_dapm_switch] = SND_SOC_DAPM_SWITCH_E(NULL, SND_SOC_NOPM, -+ 0, 0, NULL, -+ gbaudio_widget_event, -+ SND_SOC_DAPM_PRE_PMU | -+ SND_SOC_DAPM_POST_PMD), -+ [snd_soc_dapm_pga] = SND_SOC_DAPM_PGA_E(NULL, SND_SOC_NOPM, -+ 0, 0, NULL, 0, -+ gbaudio_widget_event, -+ SND_SOC_DAPM_PRE_PMU | -+ SND_SOC_DAPM_POST_PMD), -+ [snd_soc_dapm_mixer] = SND_SOC_DAPM_MIXER_E(NULL, SND_SOC_NOPM, -+ 0, 0, NULL, 0, -+ gbaudio_widget_event, -+ SND_SOC_DAPM_PRE_PMU | -+ SND_SOC_DAPM_POST_PMD), -+ [snd_soc_dapm_mux] = SND_SOC_DAPM_MUX_E(NULL, SND_SOC_NOPM, -+ 0, 0, NULL, -+ gbaudio_widget_event, -+ SND_SOC_DAPM_PRE_PMU | -+ SND_SOC_DAPM_POST_PMD), -+ [snd_soc_dapm_aif_in] = SND_SOC_DAPM_AIF_IN_E(NULL, NULL, 0, -+ SND_SOC_NOPM, 0, 0, -+ gbaudio_widget_event, -+ SND_SOC_DAPM_PRE_PMU | -+ SND_SOC_DAPM_POST_PMD), -+ [snd_soc_dapm_aif_out] = SND_SOC_DAPM_AIF_OUT_E(NULL, NULL, 0, -+ SND_SOC_NOPM, 0, 0, -+ gbaudio_widget_event, -+ SND_SOC_DAPM_PRE_PMU | -+ SND_SOC_DAPM_POST_PMD), -+}; -+ - static int gbaudio_tplg_create_widget(struct gbaudio_module_info *module, - struct snd_soc_dapm_widget *dw, - struct gb_audio_widget *w, int *w_size) -@@ -1061,77 +1099,37 @@ static int gbaudio_tplg_create_widget(struct gbaudio_module_info *module, - - switch (w->type) { - case snd_soc_dapm_spk: -- *dw = (struct snd_soc_dapm_widget) -- SND_SOC_DAPM_SPK(w->name, gbcodec_event_spk); -+ *dw = gbaudio_widgets[w->type]; - module->op_devices |= GBAUDIO_DEVICE_OUT_SPEAKER; - break; - case snd_soc_dapm_hp: -- *dw = (struct snd_soc_dapm_widget) -- SND_SOC_DAPM_HP(w->name, gbcodec_event_hp); -+ *dw = gbaudio_widgets[w->type]; - module->op_devices |= (GBAUDIO_DEVICE_OUT_WIRED_HEADSET - | GBAUDIO_DEVICE_OUT_WIRED_HEADPHONE); - module->ip_devices |= GBAUDIO_DEVICE_IN_WIRED_HEADSET; - break; - case snd_soc_dapm_mic: -- *dw = (struct snd_soc_dapm_widget) -- SND_SOC_DAPM_MIC(w->name, gbcodec_event_int_mic); -+ *dw = gbaudio_widgets[w->type]; - module->ip_devices |= GBAUDIO_DEVICE_IN_BUILTIN_MIC; - break; - case snd_soc_dapm_output: -- *dw = (struct snd_soc_dapm_widget)SND_SOC_DAPM_OUTPUT(w->name); -- break; - case snd_soc_dapm_input: -- *dw = (struct snd_soc_dapm_widget)SND_SOC_DAPM_INPUT(w->name); -- break; - case snd_soc_dapm_switch: -- *dw = (struct snd_soc_dapm_widget) -- SND_SOC_DAPM_SWITCH_E(w->name, SND_SOC_NOPM, 0, 0, -- widget_kctls, -- gbaudio_widget_event, -- SND_SOC_DAPM_PRE_PMU | -- SND_SOC_DAPM_POST_PMD); -- break; - case snd_soc_dapm_pga: -- *dw = (struct snd_soc_dapm_widget) -- SND_SOC_DAPM_PGA_E(w->name, SND_SOC_NOPM, 0, 0, NULL, 0, -- gbaudio_widget_event, -- SND_SOC_DAPM_PRE_PMU | -- SND_SOC_DAPM_POST_PMD); -- break; - case snd_soc_dapm_mixer: -- *dw = (struct snd_soc_dapm_widget) -- SND_SOC_DAPM_MIXER_E(w->name, SND_SOC_NOPM, 0, 0, NULL, -- 0, gbaudio_widget_event, -- SND_SOC_DAPM_PRE_PMU | -- SND_SOC_DAPM_POST_PMD); -- break; - case snd_soc_dapm_mux: -- *dw = (struct snd_soc_dapm_widget) -- SND_SOC_DAPM_MUX_E(w->name, SND_SOC_NOPM, 0, 0, -- widget_kctls, gbaudio_widget_event, -- SND_SOC_DAPM_PRE_PMU | -- SND_SOC_DAPM_POST_PMD); -+ *dw = gbaudio_widgets[w->type]; - break; - case snd_soc_dapm_aif_in: -- *dw = (struct snd_soc_dapm_widget) -- SND_SOC_DAPM_AIF_IN_E(w->name, w->sname, 0, -- SND_SOC_NOPM, -- 0, 0, gbaudio_widget_event, -- SND_SOC_DAPM_PRE_PMU | -- SND_SOC_DAPM_POST_PMD); -- break; - case snd_soc_dapm_aif_out: -- *dw = (struct snd_soc_dapm_widget) -- SND_SOC_DAPM_AIF_OUT_E(w->name, w->sname, 0, -- SND_SOC_NOPM, -- 0, 0, gbaudio_widget_event, -- SND_SOC_DAPM_PRE_PMU | -- SND_SOC_DAPM_POST_PMD); -+ *dw = gbaudio_widgets[w->type]; -+ dw->sname = w->sname; - break; - default: - ret = -EINVAL; - goto error; - } -+ dw->name = w->name; - - dev_dbg(module->dev, "%s: widget of type %d created\n", dw->name, - dw->id); -diff --git a/drivers/staging/wlan-ng/hfa384x_usb.c b/drivers/staging/wlan-ng/hfa384x_usb.c -index ed4ff78dd02aa..71cca6e1dea46 100644 ---- a/drivers/staging/wlan-ng/hfa384x_usb.c -+++ b/drivers/staging/wlan-ng/hfa384x_usb.c -@@ -3779,18 +3779,18 @@ static void hfa384x_usb_throttlefn(struct timer_list *t) - - spin_lock_irqsave(&hw->ctlxq.lock, flags); - -- /* -- * We need to check BOTH the RX and the TX throttle controls, -- * so we use the bitwise OR instead of the logical OR. -- */ - pr_debug("flags=0x%lx\n", hw->usb_flags); -- if (!hw->wlandev->hwremoved && -- ((test_and_clear_bit(THROTTLE_RX, &hw->usb_flags) && -- !test_and_set_bit(WORK_RX_RESUME, &hw->usb_flags)) | -- (test_and_clear_bit(THROTTLE_TX, &hw->usb_flags) && -- !test_and_set_bit(WORK_TX_RESUME, &hw->usb_flags)) -- )) { -- schedule_work(&hw->usb_work); -+ if (!hw->wlandev->hwremoved) { -+ bool rx_throttle = test_and_clear_bit(THROTTLE_RX, &hw->usb_flags) && -+ !test_and_set_bit(WORK_RX_RESUME, &hw->usb_flags); -+ bool tx_throttle = test_and_clear_bit(THROTTLE_TX, &hw->usb_flags) && -+ !test_and_set_bit(WORK_TX_RESUME, &hw->usb_flags); -+ /* -+ * We need to check BOTH the RX and the TX throttle controls, -+ * so we use the bitwise OR instead of the logical OR. -+ */ -+ if (rx_throttle | tx_throttle) -+ schedule_work(&hw->usb_work); - } - - spin_unlock_irqrestore(&hw->ctlxq.lock, flags); -diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c -index d0f45600b6698..fe9b392bffee3 100644 ---- a/drivers/usb/core/hcd.c -+++ b/drivers/usb/core/hcd.c -@@ -753,6 +753,7 @@ void usb_hcd_poll_rh_status(struct usb_hcd *hcd) - { - struct urb *urb; - int length; -+ int status; - unsigned long flags; - char buffer[6]; /* Any root hubs with > 31 ports? */ - -@@ -770,11 +771,17 @@ void usb_hcd_poll_rh_status(struct usb_hcd *hcd) - if (urb) { - clear_bit(HCD_FLAG_POLL_PENDING, &hcd->flags); - hcd->status_urb = NULL; -+ if (urb->transfer_buffer_length >= length) { -+ status = 0; -+ } else { -+ status = -EOVERFLOW; -+ length = urb->transfer_buffer_length; -+ } - urb->actual_length = length; - memcpy(urb->transfer_buffer, buffer, length); - - usb_hcd_unlink_urb_from_ep(hcd, urb); -- usb_hcd_giveback_urb(hcd, urb, 0); -+ usb_hcd_giveback_urb(hcd, urb, status); - } else { - length = 0; - set_bit(HCD_FLAG_POLL_PENDING, &hcd->flags); -diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c -index d7ab2e88631a0..69dd48f9507e5 100644 ---- a/drivers/usb/core/hub.c -+++ b/drivers/usb/core/hub.c -@@ -1223,7 +1223,7 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type) - */ - if (portchange || (hub_is_superspeed(hub->hdev) && - port_resumed)) -- set_bit(port1, hub->change_bits); -+ set_bit(port1, hub->event_bits); - - } else if (udev->persist_enabled) { - #ifdef CONFIG_PM -diff --git a/kernel/workqueue.c b/kernel/workqueue.c -index 77e6964ae1a99..e90f37e22202a 100644 ---- a/kernel/workqueue.c -+++ b/kernel/workqueue.c -@@ -855,8 +855,17 @@ void wq_worker_running(struct task_struct *task) - - if (!worker->sleeping) - return; -+ -+ /* -+ * If preempted by unbind_workers() between the WORKER_NOT_RUNNING check -+ * and the nr_running increment below, we may ruin the nr_running reset -+ * and leave with an unexpected pool->nr_running == 1 on the newly unbound -+ * pool. Protect against such race. -+ */ -+ preempt_disable(); - if (!(worker->flags & WORKER_NOT_RUNNING)) - atomic_inc(&worker->pool->nr_running); -+ preempt_enable(); - worker->sleeping = 0; - } - diff --git a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.172-173.patch b/patch/kernel/archive/odroidxu4-5.4/patch-5.4.172-173.patch deleted file mode 100644 index bba402e51..000000000 --- a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.172-173.patch +++ /dev/null @@ -1,788 +0,0 @@ -diff --git a/Makefile b/Makefile -index 2f914dd223c81..cb9e6cd0d0249 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 5 - PATCHLEVEL = 4 --SUBLEVEL = 172 -+SUBLEVEL = 173 - EXTRAVERSION = - NAME = Kleptomaniac Octopus - -@@ -1022,7 +1022,7 @@ HOST_LIBELF_LIBS = $(shell pkg-config libelf --libs 2>/dev/null || echo -lelf) - - ifdef CONFIG_STACK_VALIDATION - has_libelf := $(call try-run,\ -- echo "int main() {}" | $(HOSTCC) -xc -o /dev/null $(HOST_LIBELF_LIBS) -,1,0) -+ echo "int main() {}" | $(HOSTCC) $(KBUILD_HOSTLDFLAGS) -xc -o /dev/null $(HOST_LIBELF_LIBS) -,1,0) - ifeq ($(has_libelf),1) - objtool_target := tools/objtool FORCE - else -diff --git a/arch/arm/kernel/perf_callchain.c b/arch/arm/kernel/perf_callchain.c -index 3b69a76d341e7..1626dfc6f6ce6 100644 ---- a/arch/arm/kernel/perf_callchain.c -+++ b/arch/arm/kernel/perf_callchain.c -@@ -62,9 +62,10 @@ user_backtrace(struct frame_tail __user *tail, - void - perf_callchain_user(struct perf_callchain_entry_ctx *entry, struct pt_regs *regs) - { -+ struct perf_guest_info_callbacks *guest_cbs = perf_get_guest_cbs(); - struct frame_tail __user *tail; - -- if (perf_guest_cbs && perf_guest_cbs->is_in_guest()) { -+ if (guest_cbs && guest_cbs->is_in_guest()) { - /* We don't support guest os callchain now */ - return; - } -@@ -98,9 +99,10 @@ callchain_trace(struct stackframe *fr, - void - perf_callchain_kernel(struct perf_callchain_entry_ctx *entry, struct pt_regs *regs) - { -+ struct perf_guest_info_callbacks *guest_cbs = perf_get_guest_cbs(); - struct stackframe fr; - -- if (perf_guest_cbs && perf_guest_cbs->is_in_guest()) { -+ if (guest_cbs && guest_cbs->is_in_guest()) { - /* We don't support guest os callchain now */ - return; - } -@@ -111,18 +113,21 @@ perf_callchain_kernel(struct perf_callchain_entry_ctx *entry, struct pt_regs *re - - unsigned long perf_instruction_pointer(struct pt_regs *regs) - { -- if (perf_guest_cbs && perf_guest_cbs->is_in_guest()) -- return perf_guest_cbs->get_guest_ip(); -+ struct perf_guest_info_callbacks *guest_cbs = perf_get_guest_cbs(); -+ -+ if (guest_cbs && guest_cbs->is_in_guest()) -+ return guest_cbs->get_guest_ip(); - - return instruction_pointer(regs); - } - - unsigned long perf_misc_flags(struct pt_regs *regs) - { -+ struct perf_guest_info_callbacks *guest_cbs = perf_get_guest_cbs(); - int misc = 0; - -- if (perf_guest_cbs && perf_guest_cbs->is_in_guest()) { -- if (perf_guest_cbs->is_user_mode()) -+ if (guest_cbs && guest_cbs->is_in_guest()) { -+ if (guest_cbs->is_user_mode()) - misc |= PERF_RECORD_MISC_GUEST_USER; - else - misc |= PERF_RECORD_MISC_GUEST_KERNEL; -diff --git a/arch/arm/mm/Kconfig b/arch/arm/mm/Kconfig -index fc388eb60e0b7..64cce0c8560ab 100644 ---- a/arch/arm/mm/Kconfig -+++ b/arch/arm/mm/Kconfig -@@ -743,6 +743,7 @@ config SWP_EMULATE - config CPU_BIG_ENDIAN - bool "Build big-endian kernel" - depends on ARCH_SUPPORTS_BIG_ENDIAN -+ depends on !LD_IS_LLD - help - Say Y if you plan on running a kernel in big-endian mode. - Note that your board must be properly built and your board -diff --git a/arch/arm64/kernel/perf_callchain.c b/arch/arm64/kernel/perf_callchain.c -index b0e03e052dd1d..b84ec4ce7d8dc 100644 ---- a/arch/arm64/kernel/perf_callchain.c -+++ b/arch/arm64/kernel/perf_callchain.c -@@ -102,7 +102,9 @@ compat_user_backtrace(struct compat_frame_tail __user *tail, - void perf_callchain_user(struct perf_callchain_entry_ctx *entry, - struct pt_regs *regs) - { -- if (perf_guest_cbs && perf_guest_cbs->is_in_guest()) { -+ struct perf_guest_info_callbacks *guest_cbs = perf_get_guest_cbs(); -+ -+ if (guest_cbs && guest_cbs->is_in_guest()) { - /* We don't support guest os callchain now */ - return; - } -@@ -147,9 +149,10 @@ static int callchain_trace(struct stackframe *frame, void *data) - void perf_callchain_kernel(struct perf_callchain_entry_ctx *entry, - struct pt_regs *regs) - { -+ struct perf_guest_info_callbacks *guest_cbs = perf_get_guest_cbs(); - struct stackframe frame; - -- if (perf_guest_cbs && perf_guest_cbs->is_in_guest()) { -+ if (guest_cbs && guest_cbs->is_in_guest()) { - /* We don't support guest os callchain now */ - return; - } -@@ -160,18 +163,21 @@ void perf_callchain_kernel(struct perf_callchain_entry_ctx *entry, - - unsigned long perf_instruction_pointer(struct pt_regs *regs) - { -- if (perf_guest_cbs && perf_guest_cbs->is_in_guest()) -- return perf_guest_cbs->get_guest_ip(); -+ struct perf_guest_info_callbacks *guest_cbs = perf_get_guest_cbs(); -+ -+ if (guest_cbs && guest_cbs->is_in_guest()) -+ return guest_cbs->get_guest_ip(); - - return instruction_pointer(regs); - } - - unsigned long perf_misc_flags(struct pt_regs *regs) - { -+ struct perf_guest_info_callbacks *guest_cbs = perf_get_guest_cbs(); - int misc = 0; - -- if (perf_guest_cbs && perf_guest_cbs->is_in_guest()) { -- if (perf_guest_cbs->is_user_mode()) -+ if (guest_cbs && guest_cbs->is_in_guest()) { -+ if (guest_cbs->is_user_mode()) - misc |= PERF_RECORD_MISC_GUEST_USER; - else - misc |= PERF_RECORD_MISC_GUEST_KERNEL; -diff --git a/arch/csky/kernel/perf_callchain.c b/arch/csky/kernel/perf_callchain.c -index ab55e98ee8f62..35318a635a5fa 100644 ---- a/arch/csky/kernel/perf_callchain.c -+++ b/arch/csky/kernel/perf_callchain.c -@@ -86,10 +86,11 @@ static unsigned long user_backtrace(struct perf_callchain_entry_ctx *entry, - void perf_callchain_user(struct perf_callchain_entry_ctx *entry, - struct pt_regs *regs) - { -+ struct perf_guest_info_callbacks *guest_cbs = perf_get_guest_cbs(); - unsigned long fp = 0; - - /* C-SKY does not support virtualization. */ -- if (perf_guest_cbs && perf_guest_cbs->is_in_guest()) -+ if (guest_cbs && guest_cbs->is_in_guest()) - return; - - fp = regs->regs[4]; -@@ -110,10 +111,11 @@ void perf_callchain_user(struct perf_callchain_entry_ctx *entry, - void perf_callchain_kernel(struct perf_callchain_entry_ctx *entry, - struct pt_regs *regs) - { -+ struct perf_guest_info_callbacks *guest_cbs = perf_get_guest_cbs(); - struct stackframe fr; - - /* C-SKY does not support virtualization. */ -- if (perf_guest_cbs && perf_guest_cbs->is_in_guest()) { -+ if (guest_cbs && guest_cbs->is_in_guest()) { - pr_warn("C-SKY does not support perf in guest mode!"); - return; - } -diff --git a/arch/nds32/kernel/perf_event_cpu.c b/arch/nds32/kernel/perf_event_cpu.c -index 334c2a6cec23d..8a4f9babb1646 100644 ---- a/arch/nds32/kernel/perf_event_cpu.c -+++ b/arch/nds32/kernel/perf_event_cpu.c -@@ -1363,6 +1363,7 @@ void - perf_callchain_user(struct perf_callchain_entry_ctx *entry, - struct pt_regs *regs) - { -+ struct perf_guest_info_callbacks *guest_cbs = perf_get_guest_cbs(); - unsigned long fp = 0; - unsigned long gp = 0; - unsigned long lp = 0; -@@ -1371,7 +1372,7 @@ perf_callchain_user(struct perf_callchain_entry_ctx *entry, - - leaf_fp = 0; - -- if (perf_guest_cbs && perf_guest_cbs->is_in_guest()) { -+ if (guest_cbs && guest_cbs->is_in_guest()) { - /* We don't support guest os callchain now */ - return; - } -@@ -1479,9 +1480,10 @@ void - perf_callchain_kernel(struct perf_callchain_entry_ctx *entry, - struct pt_regs *regs) - { -+ struct perf_guest_info_callbacks *guest_cbs = perf_get_guest_cbs(); - struct stackframe fr; - -- if (perf_guest_cbs && perf_guest_cbs->is_in_guest()) { -+ if (guest_cbs && guest_cbs->is_in_guest()) { - /* We don't support guest os callchain now */ - return; - } -@@ -1493,20 +1495,23 @@ perf_callchain_kernel(struct perf_callchain_entry_ctx *entry, - - unsigned long perf_instruction_pointer(struct pt_regs *regs) - { -+ struct perf_guest_info_callbacks *guest_cbs = perf_get_guest_cbs(); -+ - /* However, NDS32 does not support virtualization */ -- if (perf_guest_cbs && perf_guest_cbs->is_in_guest()) -- return perf_guest_cbs->get_guest_ip(); -+ if (guest_cbs && guest_cbs->is_in_guest()) -+ return guest_cbs->get_guest_ip(); - - return instruction_pointer(regs); - } - - unsigned long perf_misc_flags(struct pt_regs *regs) - { -+ struct perf_guest_info_callbacks *guest_cbs = perf_get_guest_cbs(); - int misc = 0; - - /* However, NDS32 does not support virtualization */ -- if (perf_guest_cbs && perf_guest_cbs->is_in_guest()) { -- if (perf_guest_cbs->is_user_mode()) -+ if (guest_cbs && guest_cbs->is_in_guest()) { -+ if (guest_cbs->is_user_mode()) - misc |= PERF_RECORD_MISC_GUEST_USER; - else - misc |= PERF_RECORD_MISC_GUEST_KERNEL; -diff --git a/arch/riscv/kernel/perf_callchain.c b/arch/riscv/kernel/perf_callchain.c -index 8d2804f05cf93..22a93009362d7 100644 ---- a/arch/riscv/kernel/perf_callchain.c -+++ b/arch/riscv/kernel/perf_callchain.c -@@ -60,10 +60,11 @@ static unsigned long user_backtrace(struct perf_callchain_entry_ctx *entry, - void perf_callchain_user(struct perf_callchain_entry_ctx *entry, - struct pt_regs *regs) - { -+ struct perf_guest_info_callbacks *guest_cbs = perf_get_guest_cbs(); - unsigned long fp = 0; - - /* RISC-V does not support perf in guest mode. */ -- if (perf_guest_cbs && perf_guest_cbs->is_in_guest()) -+ if (guest_cbs && guest_cbs->is_in_guest()) - return; - - fp = regs->s0; -@@ -84,8 +85,10 @@ void notrace walk_stackframe(struct task_struct *task, - void perf_callchain_kernel(struct perf_callchain_entry_ctx *entry, - struct pt_regs *regs) - { -+ struct perf_guest_info_callbacks *guest_cbs = perf_get_guest_cbs(); -+ - /* RISC-V does not support perf in guest mode. */ -- if (perf_guest_cbs && perf_guest_cbs->is_in_guest()) { -+ if (guest_cbs && guest_cbs->is_in_guest()) { - pr_warn("RISC-V does not support perf in guest mode!"); - return; - } -diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c -index fd73a8aa89d23..8be5750fe5ac3 100644 ---- a/arch/s390/kvm/interrupt.c -+++ b/arch/s390/kvm/interrupt.c -@@ -1982,6 +1982,13 @@ int kvm_s390_is_stop_irq_pending(struct kvm_vcpu *vcpu) - return test_bit(IRQ_PEND_SIGP_STOP, &li->pending_irqs); - } - -+int kvm_s390_is_restart_irq_pending(struct kvm_vcpu *vcpu) -+{ -+ struct kvm_s390_local_interrupt *li = &vcpu->arch.local_int; -+ -+ return test_bit(IRQ_PEND_RESTART, &li->pending_irqs); -+} -+ - void kvm_s390_clear_stop_irq(struct kvm_vcpu *vcpu) - { - struct kvm_s390_local_interrupt *li = &vcpu->arch.local_int; -diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c -index b286818d8d54d..49dc00d82e5ea 100644 ---- a/arch/s390/kvm/kvm-s390.c -+++ b/arch/s390/kvm/kvm-s390.c -@@ -4205,10 +4205,15 @@ void kvm_s390_vcpu_stop(struct kvm_vcpu *vcpu) - spin_lock(&vcpu->kvm->arch.start_stop_lock); - online_vcpus = atomic_read(&vcpu->kvm->online_vcpus); - -- /* SIGP STOP and SIGP STOP AND STORE STATUS has been fully processed */ -+ /* -+ * Set the VCPU to STOPPED and THEN clear the interrupt flag, -+ * now that the SIGP STOP and SIGP STOP AND STORE STATUS orders -+ * have been fully processed. This will ensure that the VCPU -+ * is kept BUSY if another VCPU is inquiring with SIGP SENSE. -+ */ -+ kvm_s390_set_cpuflags(vcpu, CPUSTAT_STOPPED); - kvm_s390_clear_stop_irq(vcpu); - -- kvm_s390_set_cpuflags(vcpu, CPUSTAT_STOPPED); - __disable_ibs_on_vcpu(vcpu); - - for (i = 0; i < online_vcpus; i++) { -diff --git a/arch/s390/kvm/kvm-s390.h b/arch/s390/kvm/kvm-s390.h -index 63d94a5253a8f..d497d3e58784b 100644 ---- a/arch/s390/kvm/kvm-s390.h -+++ b/arch/s390/kvm/kvm-s390.h -@@ -373,6 +373,7 @@ void kvm_s390_destroy_adapters(struct kvm *kvm); - int kvm_s390_ext_call_pending(struct kvm_vcpu *vcpu); - extern struct kvm_device_ops kvm_flic_ops; - int kvm_s390_is_stop_irq_pending(struct kvm_vcpu *vcpu); -+int kvm_s390_is_restart_irq_pending(struct kvm_vcpu *vcpu); - void kvm_s390_clear_stop_irq(struct kvm_vcpu *vcpu); - int kvm_s390_set_irq_state(struct kvm_vcpu *vcpu, - void __user *buf, int len); -diff --git a/arch/s390/kvm/sigp.c b/arch/s390/kvm/sigp.c -index 683036c1c92a8..3dc921e853b6e 100644 ---- a/arch/s390/kvm/sigp.c -+++ b/arch/s390/kvm/sigp.c -@@ -288,6 +288,34 @@ static int handle_sigp_dst(struct kvm_vcpu *vcpu, u8 order_code, - if (!dst_vcpu) - return SIGP_CC_NOT_OPERATIONAL; - -+ /* -+ * SIGP RESTART, SIGP STOP, and SIGP STOP AND STORE STATUS orders -+ * are processed asynchronously. Until the affected VCPU finishes -+ * its work and calls back into KVM to clear the (RESTART or STOP) -+ * interrupt, we need to return any new non-reset orders "busy". -+ * -+ * This is important because a single VCPU could issue: -+ * 1) SIGP STOP $DESTINATION -+ * 2) SIGP SENSE $DESTINATION -+ * -+ * If the SIGP SENSE would not be rejected as "busy", it could -+ * return an incorrect answer as to whether the VCPU is STOPPED -+ * or OPERATING. -+ */ -+ if (order_code != SIGP_INITIAL_CPU_RESET && -+ order_code != SIGP_CPU_RESET) { -+ /* -+ * Lockless check. Both SIGP STOP and SIGP (RE)START -+ * properly synchronize everything while processing -+ * their orders, while the guest cannot observe a -+ * difference when issuing other orders from two -+ * different VCPUs. -+ */ -+ if (kvm_s390_is_stop_irq_pending(dst_vcpu) || -+ kvm_s390_is_restart_irq_pending(dst_vcpu)) -+ return SIGP_CC_BUSY; -+ } -+ - switch (order_code) { - case SIGP_SENSE: - vcpu->stat.instruction_sigp_sense++; -diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c -index 00bccb4d17722..e4f7ac28dcf2b 100644 ---- a/arch/x86/events/core.c -+++ b/arch/x86/events/core.c -@@ -2366,10 +2366,11 @@ static bool perf_hw_regs(struct pt_regs *regs) - void - perf_callchain_kernel(struct perf_callchain_entry_ctx *entry, struct pt_regs *regs) - { -+ struct perf_guest_info_callbacks *guest_cbs = perf_get_guest_cbs(); - struct unwind_state state; - unsigned long addr; - -- if (perf_guest_cbs && perf_guest_cbs->is_in_guest()) { -+ if (guest_cbs && guest_cbs->is_in_guest()) { - /* TODO: We don't support guest os callchain now */ - return; - } -@@ -2475,10 +2476,11 @@ perf_callchain_user32(struct pt_regs *regs, struct perf_callchain_entry_ctx *ent - void - perf_callchain_user(struct perf_callchain_entry_ctx *entry, struct pt_regs *regs) - { -+ struct perf_guest_info_callbacks *guest_cbs = perf_get_guest_cbs(); - struct stack_frame frame; - const unsigned long __user *fp; - -- if (perf_guest_cbs && perf_guest_cbs->is_in_guest()) { -+ if (guest_cbs && guest_cbs->is_in_guest()) { - /* TODO: We don't support guest os callchain now */ - return; - } -@@ -2562,18 +2564,21 @@ static unsigned long code_segment_base(struct pt_regs *regs) - - unsigned long perf_instruction_pointer(struct pt_regs *regs) - { -- if (perf_guest_cbs && perf_guest_cbs->is_in_guest()) -- return perf_guest_cbs->get_guest_ip(); -+ struct perf_guest_info_callbacks *guest_cbs = perf_get_guest_cbs(); -+ -+ if (guest_cbs && guest_cbs->is_in_guest()) -+ return guest_cbs->get_guest_ip(); - - return regs->ip + code_segment_base(regs); - } - - unsigned long perf_misc_flags(struct pt_regs *regs) - { -+ struct perf_guest_info_callbacks *guest_cbs = perf_get_guest_cbs(); - int misc = 0; - -- if (perf_guest_cbs && perf_guest_cbs->is_in_guest()) { -- if (perf_guest_cbs->is_user_mode()) -+ if (guest_cbs && guest_cbs->is_in_guest()) { -+ if (guest_cbs->is_user_mode()) - misc |= PERF_RECORD_MISC_GUEST_USER; - else - misc |= PERF_RECORD_MISC_GUEST_KERNEL; -diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c -index 70758f99c9e47..b33540e1efa88 100644 ---- a/arch/x86/events/intel/core.c -+++ b/arch/x86/events/intel/core.c -@@ -2333,6 +2333,7 @@ static int handle_pmi_common(struct pt_regs *regs, u64 status) - { - struct perf_sample_data data; - struct cpu_hw_events *cpuc = this_cpu_ptr(&cpu_hw_events); -+ struct perf_guest_info_callbacks *guest_cbs; - int bit; - int handled = 0; - -@@ -2386,9 +2387,11 @@ static int handle_pmi_common(struct pt_regs *regs, u64 status) - */ - if (__test_and_clear_bit(55, (unsigned long *)&status)) { - handled++; -- if (unlikely(perf_guest_cbs && perf_guest_cbs->is_in_guest() && -- perf_guest_cbs->handle_intel_pt_intr)) -- perf_guest_cbs->handle_intel_pt_intr(); -+ -+ guest_cbs = perf_get_guest_cbs(); -+ if (unlikely(guest_cbs && guest_cbs->is_in_guest() && -+ guest_cbs->handle_intel_pt_intr)) -+ guest_cbs->handle_intel_pt_intr(); - else - intel_pt_interrupt(); - } -diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c -index 0aaf40be956ff..1f7dfa5aa42da 100644 ---- a/arch/x86/kvm/x86.c -+++ b/arch/x86/kvm/x86.c -@@ -1218,7 +1218,7 @@ static const u32 msrs_to_save_all[] = { - MSR_IA32_UMWAIT_CONTROL, - - MSR_ARCH_PERFMON_FIXED_CTR0, MSR_ARCH_PERFMON_FIXED_CTR1, -- MSR_ARCH_PERFMON_FIXED_CTR0 + 2, MSR_ARCH_PERFMON_FIXED_CTR0 + 3, -+ MSR_ARCH_PERFMON_FIXED_CTR0 + 2, - MSR_CORE_PERF_FIXED_CTR_CTRL, MSR_CORE_PERF_GLOBAL_STATUS, - MSR_CORE_PERF_GLOBAL_CTRL, MSR_CORE_PERF_GLOBAL_OVF_CTRL, - MSR_ARCH_PERFMON_PERFCTR0, MSR_ARCH_PERFMON_PERFCTR1, -diff --git a/drivers/base/devtmpfs.c b/drivers/base/devtmpfs.c -index 30d0523014e0d..5e9b00711357b 100644 ---- a/drivers/base/devtmpfs.c -+++ b/drivers/base/devtmpfs.c -@@ -25,6 +25,7 @@ - #include - #include - #include -+#include - #include - #include "base.h" - -@@ -62,8 +63,15 @@ static struct dentry *public_dev_mount(struct file_system_type *fs_type, int fla - const char *dev_name, void *data) - { - struct super_block *s = mnt->mnt_sb; -+ int err; -+ - atomic_inc(&s->s_active); - down_write(&s->s_umount); -+ err = reconfigure_single(s, flags, data); -+ if (err < 0) { -+ deactivate_locked_super(s); -+ return ERR_PTR(err); -+ } - return dget(s->s_root); - } - -diff --git a/drivers/firmware/qemu_fw_cfg.c b/drivers/firmware/qemu_fw_cfg.c -index 59db70fb45614..314b9bb78e437 100644 ---- a/drivers/firmware/qemu_fw_cfg.c -+++ b/drivers/firmware/qemu_fw_cfg.c -@@ -385,9 +385,7 @@ static void fw_cfg_sysfs_cache_cleanup(void) - struct fw_cfg_sysfs_entry *entry, *next; - - list_for_each_entry_safe(entry, next, &fw_cfg_entry_cache, list) { -- /* will end up invoking fw_cfg_sysfs_cache_delist() -- * via each object's release() method (i.e. destructor) -- */ -+ fw_cfg_sysfs_cache_delist(entry); - kobject_put(&entry->kobj); - } - } -@@ -445,7 +443,6 @@ static void fw_cfg_sysfs_release_entry(struct kobject *kobj) - { - struct fw_cfg_sysfs_entry *entry = to_entry(kobj); - -- fw_cfg_sysfs_cache_delist(entry); - kfree(entry); - } - -@@ -598,20 +595,18 @@ static int fw_cfg_register_file(const struct fw_cfg_file *f) - /* set file entry information */ - entry->size = be32_to_cpu(f->size); - entry->select = be16_to_cpu(f->select); -- memcpy(entry->name, f->name, FW_CFG_MAX_FILE_PATH); -+ strscpy(entry->name, f->name, FW_CFG_MAX_FILE_PATH); - - /* register entry under "/sys/firmware/qemu_fw_cfg/by_key/" */ - err = kobject_init_and_add(&entry->kobj, &fw_cfg_sysfs_entry_ktype, - fw_cfg_sel_ko, "%d", entry->select); -- if (err) { -- kobject_put(&entry->kobj); -- return err; -- } -+ if (err) -+ goto err_put_entry; - - /* add raw binary content access */ - err = sysfs_create_bin_file(&entry->kobj, &fw_cfg_sysfs_attr_raw); - if (err) -- goto err_add_raw; -+ goto err_del_entry; - - /* try adding "/sys/firmware/qemu_fw_cfg/by_name/" symlink */ - fw_cfg_build_symlink(fw_cfg_fname_kset, &entry->kobj, entry->name); -@@ -620,9 +615,10 @@ static int fw_cfg_register_file(const struct fw_cfg_file *f) - fw_cfg_sysfs_cache_enlist(entry); - return 0; - --err_add_raw: -+err_del_entry: - kobject_del(&entry->kobj); -- kfree(entry); -+err_put_entry: -+ kobject_put(&entry->kobj); - return err; - } - -diff --git a/drivers/media/usb/uvc/uvc_video.c b/drivers/media/usb/uvc/uvc_video.c -index 96b85d66e7a87..fe58723fc5ac7 100644 ---- a/drivers/media/usb/uvc/uvc_video.c -+++ b/drivers/media/usb/uvc/uvc_video.c -@@ -1915,6 +1915,10 @@ static int uvc_video_start_transfer(struct uvc_streaming *stream, - if (ep == NULL) - return -EIO; - -+ /* Reject broken descriptors. */ -+ if (usb_endpoint_maxp(&ep->desc) == 0) -+ return -EIO; -+ - ret = uvc_init_video_bulk(stream, ep, gfp_flags); - } - -diff --git a/drivers/mtd/chips/Kconfig b/drivers/mtd/chips/Kconfig -index a7e47e068ad9b..7769a9b556c70 100644 ---- a/drivers/mtd/chips/Kconfig -+++ b/drivers/mtd/chips/Kconfig -@@ -55,12 +55,14 @@ choice - LITTLE_ENDIAN_BYTE, if the bytes are reversed. - - config MTD_CFI_NOSWAP -+ depends on !ARCH_IXP4XX || CPU_BIG_ENDIAN - bool "NO" - - config MTD_CFI_BE_BYTE_SWAP - bool "BIG_ENDIAN_BYTE" - - config MTD_CFI_LE_BYTE_SWAP -+ depends on !ARCH_IXP4XX - bool "LITTLE_ENDIAN_BYTE" - - endchoice -diff --git a/drivers/mtd/maps/Kconfig b/drivers/mtd/maps/Kconfig -index bc82305ebb4c2..ffbf4f6cb9cfe 100644 ---- a/drivers/mtd/maps/Kconfig -+++ b/drivers/mtd/maps/Kconfig -@@ -303,7 +303,7 @@ config MTD_DC21285 - - config MTD_IXP4XX - tristate "CFI Flash device mapped on Intel IXP4xx based systems" -- depends on MTD_CFI && MTD_COMPLEX_MAPPINGS && ARCH_IXP4XX -+ depends on MTD_CFI && MTD_COMPLEX_MAPPINGS && ARCH_IXP4XX && MTD_CFI_ADV_OPTIONS - help - This enables MTD access to flash devices on platforms based - on Intel's IXP4xx family of network processors such as the -diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/hw.c -index f070f25bb735a..df7a14320fd29 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/hw.c -+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/hw.c -@@ -1000,6 +1000,7 @@ int rtl92cu_hw_init(struct ieee80211_hw *hw) - _initpabias(hw); - rtl92c_dm_init(hw); - exit: -+ local_irq_disable(); - local_irq_restore(flags); - return err; - } -diff --git a/fs/fs_context.c b/fs/fs_context.c -index 138b5b4d621d2..a2367c7aef5b3 100644 ---- a/fs/fs_context.c -+++ b/fs/fs_context.c -@@ -585,7 +585,7 @@ static int legacy_parse_param(struct fs_context *fc, struct fs_parameter *param) - param->key); - } - -- if (len > PAGE_SIZE - 2 - size) -+ if (size + len + 2 > PAGE_SIZE) - return invalf(fc, "VFS: Legacy: Cumulative options too large"); - if (strchr(param->key, ',') || - (param->type == fs_value_is_string && -diff --git a/fs/orangefs/orangefs-bufmap.c b/fs/orangefs/orangefs-bufmap.c -index 2bb916d68576f..023b9bc54b7ce 100644 ---- a/fs/orangefs/orangefs-bufmap.c -+++ b/fs/orangefs/orangefs-bufmap.c -@@ -179,7 +179,7 @@ orangefs_bufmap_free(struct orangefs_bufmap *bufmap) - { - kfree(bufmap->page_array); - kfree(bufmap->desc_array); -- kfree(bufmap->buffer_index_array); -+ bitmap_free(bufmap->buffer_index_array); - kfree(bufmap); - } - -@@ -229,8 +229,7 @@ orangefs_bufmap_alloc(struct ORANGEFS_dev_map_desc *user_desc) - bufmap->desc_size = user_desc->size; - bufmap->desc_shift = ilog2(bufmap->desc_size); - -- bufmap->buffer_index_array = -- kzalloc(DIV_ROUND_UP(bufmap->desc_count, BITS_PER_LONG), GFP_KERNEL); -+ bufmap->buffer_index_array = bitmap_zalloc(bufmap->desc_count, GFP_KERNEL); - if (!bufmap->buffer_index_array) - goto out_free_bufmap; - -@@ -253,7 +252,7 @@ orangefs_bufmap_alloc(struct ORANGEFS_dev_map_desc *user_desc) - out_free_desc_array: - kfree(bufmap->desc_array); - out_free_index_array: -- kfree(bufmap->buffer_index_array); -+ bitmap_free(bufmap->buffer_index_array); - out_free_bufmap: - kfree(bufmap); - out: -diff --git a/fs/super.c b/fs/super.c -index 877532baf513d..b289356f302fc 100644 ---- a/fs/super.c -+++ b/fs/super.c -@@ -1470,8 +1470,8 @@ struct dentry *mount_nodev(struct file_system_type *fs_type, - } - EXPORT_SYMBOL(mount_nodev); - --static int reconfigure_single(struct super_block *s, -- int flags, void *data) -+int reconfigure_single(struct super_block *s, -+ int flags, void *data) - { - struct fs_context *fc; - int ret; -diff --git a/include/linux/fs_context.h b/include/linux/fs_context.h -index ba8a58754340d..ebcb91a57e865 100644 ---- a/include/linux/fs_context.h -+++ b/include/linux/fs_context.h -@@ -135,6 +135,8 @@ extern int generic_parse_monolithic(struct fs_context *fc, void *data); - extern int vfs_get_tree(struct fs_context *fc); - extern void put_fs_context(struct fs_context *fc); - extern void fc_drop_locked(struct fs_context *fc); -+int reconfigure_single(struct super_block *s, -+ int flags, void *data); - - /* - * sget() wrappers to be called from the ->get_tree() op. -diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h -index 68ccc5b1913b4..b7ac395513c0f 100644 ---- a/include/linux/perf_event.h -+++ b/include/linux/perf_event.h -@@ -1175,7 +1175,18 @@ extern void perf_event_bpf_event(struct bpf_prog *prog, - enum perf_bpf_event_type type, - u16 flags); - --extern struct perf_guest_info_callbacks *perf_guest_cbs; -+extern struct perf_guest_info_callbacks __rcu *perf_guest_cbs; -+static inline struct perf_guest_info_callbacks *perf_get_guest_cbs(void) -+{ -+ /* -+ * Callbacks are RCU-protected and must be READ_ONCE to avoid reloading -+ * the callbacks between a !NULL check and dereferences, to ensure -+ * pending stores/changes to the callback pointers are visible before a -+ * non-NULL perf_guest_cbs is visible to readers, and to prevent a -+ * module from unloading callbacks while readers are active. -+ */ -+ return rcu_dereference(perf_guest_cbs); -+} - extern int perf_register_guest_info_callbacks(struct perf_guest_info_callbacks *callbacks); - extern int perf_unregister_guest_info_callbacks(struct perf_guest_info_callbacks *callbacks); - -diff --git a/kernel/events/core.c b/kernel/events/core.c -index 6ffe3d3e7b06d..7e124f9abb18b 100644 ---- a/kernel/events/core.c -+++ b/kernel/events/core.c -@@ -6045,18 +6045,25 @@ static void perf_pending_event(struct irq_work *entry) - * Later on, we might change it to a list if there is - * another virtualization implementation supporting the callbacks. - */ --struct perf_guest_info_callbacks *perf_guest_cbs; -+struct perf_guest_info_callbacks __rcu *perf_guest_cbs; - - int perf_register_guest_info_callbacks(struct perf_guest_info_callbacks *cbs) - { -- perf_guest_cbs = cbs; -+ if (WARN_ON_ONCE(rcu_access_pointer(perf_guest_cbs))) -+ return -EBUSY; -+ -+ rcu_assign_pointer(perf_guest_cbs, cbs); - return 0; - } - EXPORT_SYMBOL_GPL(perf_register_guest_info_callbacks); - - int perf_unregister_guest_info_callbacks(struct perf_guest_info_callbacks *cbs) - { -- perf_guest_cbs = NULL; -+ if (WARN_ON_ONCE(rcu_access_pointer(perf_guest_cbs) != cbs)) -+ return -EINVAL; -+ -+ rcu_assign_pointer(perf_guest_cbs, NULL); -+ synchronize_rcu(); - return 0; - } - EXPORT_SYMBOL_GPL(perf_unregister_guest_info_callbacks); -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index 022799479a722..d06205626cd54 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -1926,6 +1926,7 @@ enum { - ALC887_FIXUP_ASUS_BASS, - ALC887_FIXUP_BASS_CHMAP, - ALC1220_FIXUP_GB_DUAL_CODECS, -+ ALC1220_FIXUP_GB_X570, - ALC1220_FIXUP_CLEVO_P950, - ALC1220_FIXUP_CLEVO_PB51ED, - ALC1220_FIXUP_CLEVO_PB51ED_PINS, -@@ -2115,6 +2116,29 @@ static void alc1220_fixup_gb_dual_codecs(struct hda_codec *codec, - } - } - -+static void alc1220_fixup_gb_x570(struct hda_codec *codec, -+ const struct hda_fixup *fix, -+ int action) -+{ -+ static const hda_nid_t conn1[] = { 0x0c }; -+ static const struct coef_fw gb_x570_coefs[] = { -+ WRITE_COEF(0x1a, 0x01c1), -+ WRITE_COEF(0x1b, 0x0202), -+ WRITE_COEF(0x43, 0x3005), -+ {} -+ }; -+ -+ switch (action) { -+ case HDA_FIXUP_ACT_PRE_PROBE: -+ snd_hda_override_conn_list(codec, 0x14, ARRAY_SIZE(conn1), conn1); -+ snd_hda_override_conn_list(codec, 0x1b, ARRAY_SIZE(conn1), conn1); -+ break; -+ case HDA_FIXUP_ACT_INIT: -+ alc_process_coef_fw(codec, gb_x570_coefs); -+ break; -+ } -+} -+ - static void alc1220_fixup_clevo_p950(struct hda_codec *codec, - const struct hda_fixup *fix, - int action) -@@ -2417,6 +2441,10 @@ static const struct hda_fixup alc882_fixups[] = { - .type = HDA_FIXUP_FUNC, - .v.func = alc1220_fixup_gb_dual_codecs, - }, -+ [ALC1220_FIXUP_GB_X570] = { -+ .type = HDA_FIXUP_FUNC, -+ .v.func = alc1220_fixup_gb_x570, -+ }, - [ALC1220_FIXUP_CLEVO_P950] = { - .type = HDA_FIXUP_FUNC, - .v.func = alc1220_fixup_clevo_p950, -@@ -2519,7 +2547,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = { - SND_PCI_QUIRK(0x13fe, 0x1009, "Advantech MIT-W101", ALC886_FIXUP_EAPD), - SND_PCI_QUIRK(0x1458, 0xa002, "Gigabyte EP45-DS3/Z87X-UD3H", ALC889_FIXUP_FRONT_HP_NO_PRESENCE), - SND_PCI_QUIRK(0x1458, 0xa0b8, "Gigabyte AZ370-Gaming", ALC1220_FIXUP_GB_DUAL_CODECS), -- SND_PCI_QUIRK(0x1458, 0xa0cd, "Gigabyte X570 Aorus Master", ALC1220_FIXUP_CLEVO_P950), -+ SND_PCI_QUIRK(0x1458, 0xa0cd, "Gigabyte X570 Aorus Master", ALC1220_FIXUP_GB_X570), - SND_PCI_QUIRK(0x1458, 0xa0ce, "Gigabyte X570 Aorus Xtreme", ALC1220_FIXUP_CLEVO_P950), - SND_PCI_QUIRK(0x1462, 0x11f7, "MSI-GE63", ALC1220_FIXUP_CLEVO_P950), - SND_PCI_QUIRK(0x1462, 0x1228, "MSI-GP63", ALC1220_FIXUP_CLEVO_P950), diff --git a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.173-174.patch b/patch/kernel/archive/odroidxu4-5.4/patch-5.4.173-174.patch deleted file mode 100644 index ae472e081..000000000 --- a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.173-174.patch +++ /dev/null @@ -1,9538 +0,0 @@ -diff --git a/Documentation/admin-guide/hw-vuln/spectre.rst b/Documentation/admin-guide/hw-vuln/spectre.rst -index e05e581af5cfe..985181dba0bac 100644 ---- a/Documentation/admin-guide/hw-vuln/spectre.rst -+++ b/Documentation/admin-guide/hw-vuln/spectre.rst -@@ -468,7 +468,7 @@ Spectre variant 2 - before invoking any firmware code to prevent Spectre variant 2 exploits - using the firmware. - -- Using kernel address space randomization (CONFIG_RANDOMIZE_SLAB=y -+ Using kernel address space randomization (CONFIG_RANDOMIZE_BASE=y - and CONFIG_SLAB_FREELIST_RANDOM=y in the kernel configuration) makes - attacks on the kernel generally more difficult. - -diff --git a/Documentation/devicetree/bindings/display/amlogic,meson-dw-hdmi.yaml b/Documentation/devicetree/bindings/display/amlogic,meson-dw-hdmi.yaml -index fb747682006d9..92dc08b78a176 100644 ---- a/Documentation/devicetree/bindings/display/amlogic,meson-dw-hdmi.yaml -+++ b/Documentation/devicetree/bindings/display/amlogic,meson-dw-hdmi.yaml -@@ -10,6 +10,9 @@ title: Amlogic specific extensions to the Synopsys Designware HDMI Controller - maintainers: - - Neil Armstrong - -+allOf: -+ - $ref: /schemas/sound/name-prefix.yaml# -+ - description: | - The Amlogic Meson Synopsys Designware Integration is composed of - - A Synopsys DesignWare HDMI Controller IP -@@ -101,6 +104,8 @@ properties: - "#sound-dai-cells": - const: 0 - -+ sound-name-prefix: true -+ - required: - - compatible - - reg -diff --git a/Documentation/devicetree/bindings/display/amlogic,meson-vpu.yaml b/Documentation/devicetree/bindings/display/amlogic,meson-vpu.yaml -index d1205a6697a09..766b04501cb96 100644 ---- a/Documentation/devicetree/bindings/display/amlogic,meson-vpu.yaml -+++ b/Documentation/devicetree/bindings/display/amlogic,meson-vpu.yaml -@@ -78,6 +78,10 @@ properties: - interrupts: - maxItems: 1 - -+ amlogic,canvas: -+ description: should point to a canvas provider node -+ $ref: /schemas/types.yaml#/definitions/phandle -+ - power-domains: - maxItems: 1 - description: phandle to the associated power domain -@@ -106,6 +110,7 @@ required: - - port@1 - - "#address-cells" - - "#size-cells" -+ - amlogic,canvas - - examples: - - | -@@ -116,6 +121,7 @@ examples: - interrupts = <3>; - #address-cells = <1>; - #size-cells = <0>; -+ amlogic,canvas = <&canvas>; - - /* CVBS VDAC output port */ - port@0 { -diff --git a/Documentation/driver-api/dmaengine/dmatest.rst b/Documentation/driver-api/dmaengine/dmatest.rst -index ee268d445d38b..d2e1d8b58e7dc 100644 ---- a/Documentation/driver-api/dmaengine/dmatest.rst -+++ b/Documentation/driver-api/dmaengine/dmatest.rst -@@ -143,13 +143,14 @@ Part 5 - Handling channel allocation - Allocating Channels - ------------------- - --Channels are required to be configured prior to starting the test run. --Attempting to run the test without configuring the channels will fail. -+Channels do not need to be configured prior to starting a test run. Attempting -+to run the test without configuring the channels will result in testing any -+channels that are available. - - Example:: - - % echo 1 > /sys/module/dmatest/parameters/run -- dmatest: Could not start test, no channels configured -+ dmatest: No channels configured, continue with any - - Channels are registered using the "channel" parameter. Channels can be requested by their - name, once requested, the channel is registered and a pending thread is added to the test list. -diff --git a/Documentation/driver-api/firewire.rst b/Documentation/driver-api/firewire.rst -index 94a2d7f01d999..d3cfa73cbb2b4 100644 ---- a/Documentation/driver-api/firewire.rst -+++ b/Documentation/driver-api/firewire.rst -@@ -19,7 +19,7 @@ of kernel interfaces is available via exported symbols in `firewire-core` module - Firewire char device data structures - ==================================== - --.. include:: /ABI/stable/firewire-cdev -+.. include:: ../ABI/stable/firewire-cdev - :literal: - - .. kernel-doc:: include/uapi/linux/firewire-cdev.h -@@ -28,7 +28,7 @@ Firewire char device data structures - Firewire device probing and sysfs interfaces - ============================================ - --.. include:: /ABI/stable/sysfs-bus-firewire -+.. include:: ../ABI/stable/sysfs-bus-firewire - :literal: - - .. kernel-doc:: drivers/firewire/core-device.c -diff --git a/Documentation/firmware-guide/acpi/dsd/data-node-references.rst b/Documentation/firmware-guide/acpi/dsd/data-node-references.rst -index febccbc5689d0..1b05e8d0ddff7 100644 ---- a/Documentation/firmware-guide/acpi/dsd/data-node-references.rst -+++ b/Documentation/firmware-guide/acpi/dsd/data-node-references.rst -@@ -5,7 +5,7 @@ - Referencing hierarchical data nodes - =================================== - --:Copyright: |copy| 2018 Intel Corporation -+:Copyright: |copy| 2018, 2021 Intel Corporation - :Author: Sakari Ailus - - ACPI in general allows referring to device objects in the tree only. -@@ -52,12 +52,14 @@ the ANOD object which is also the final target node of the reference. - Name (NOD0, Package() { - ToUUID("daffd814-6eba-4d8c-8a91-bc9bbf4aa301"), - Package () { -+ Package () { "reg", 0 }, - Package () { "random-property", 3 }, - } - }) - Name (NOD1, Package() { - ToUUID("dbb8e3e6-5886-4ba6-8795-1319f52a966b"), - Package () { -+ Package () { "reg", 1 }, - Package () { "anothernode", "ANOD" }, - } - }) -@@ -74,7 +76,11 @@ the ANOD object which is also the final target node of the reference. - Name (_DSD, Package () { - ToUUID("daffd814-6eba-4d8c-8a91-bc9bbf4aa301"), - Package () { -- Package () { "reference", ^DEV0, "node@1", "anothernode" }, -+ Package () { -+ "reference", Package () { -+ ^DEV0, "node@1", "anothernode" -+ } -+ }, - } - }) - } -diff --git a/Makefile b/Makefile -index cb9e6cd0d0249..3075f06f77131 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 5 - PATCHLEVEL = 4 --SUBLEVEL = 173 -+SUBLEVEL = 174 - EXTRAVERSION = - NAME = Kleptomaniac Octopus - -diff --git a/arch/arm/boot/compressed/efi-header.S b/arch/arm/boot/compressed/efi-header.S -index a5983588f96b8..dd53d6eb53ade 100644 ---- a/arch/arm/boot/compressed/efi-header.S -+++ b/arch/arm/boot/compressed/efi-header.S -@@ -9,16 +9,22 @@ - #include - - .macro __nop --#ifdef CONFIG_EFI_STUB -- @ This is almost but not quite a NOP, since it does clobber the -- @ condition flags. But it is the best we can do for EFI, since -- @ PE/COFF expects the magic string "MZ" at offset 0, while the -- @ ARM/Linux boot protocol expects an executable instruction -- @ there. -- .inst MZ_MAGIC | (0x1310 << 16) @ tstne r0, #0x4d000 --#else - AR_CLASS( mov r0, r0 ) - M_CLASS( nop.w ) -+ .endm -+ -+ .macro __initial_nops -+#ifdef CONFIG_EFI_STUB -+ @ This is a two-instruction NOP, which happens to bear the -+ @ PE/COFF signature "MZ" in the first two bytes, so the kernel -+ @ is accepted as an EFI binary. Booting via the UEFI stub -+ @ will not execute those instructions, but the ARM/Linux -+ @ boot protocol does, so we need some NOPs here. -+ .inst MZ_MAGIC | (0xe225 << 16) @ eor r5, r5, 0x4d000 -+ eor r5, r5, 0x4d000 @ undo previous insn -+#else -+ __nop -+ __nop - #endif - .endm - -diff --git a/arch/arm/boot/compressed/head.S b/arch/arm/boot/compressed/head.S -index cbe126297f549..0a2410adc25b3 100644 ---- a/arch/arm/boot/compressed/head.S -+++ b/arch/arm/boot/compressed/head.S -@@ -165,7 +165,8 @@ start: - * were patching the initial instructions of the kernel, i.e - * had started to exploit this "patch area". - */ -- .rept 7 -+ __initial_nops -+ .rept 5 - __nop - .endr - #ifndef CONFIG_THUMB2_KERNEL -diff --git a/arch/arm/boot/dts/armada-38x.dtsi b/arch/arm/boot/dts/armada-38x.dtsi -index 669da3a33d82c..5b82e58a1cf06 100644 ---- a/arch/arm/boot/dts/armada-38x.dtsi -+++ b/arch/arm/boot/dts/armada-38x.dtsi -@@ -165,7 +165,7 @@ - }; - - uart0: serial@12000 { -- compatible = "marvell,armada-38x-uart"; -+ compatible = "marvell,armada-38x-uart", "ns16550a"; - reg = <0x12000 0x100>; - reg-shift = <2>; - interrupts = ; -@@ -175,7 +175,7 @@ - }; - - uart1: serial@12100 { -- compatible = "marvell,armada-38x-uart"; -+ compatible = "marvell,armada-38x-uart", "ns16550a"; - reg = <0x12100 0x100>; - reg-shift = <2>; - interrupts = ; -diff --git a/arch/arm/boot/dts/gemini-nas4220b.dts b/arch/arm/boot/dts/gemini-nas4220b.dts -index e1020e07e1366..60cec653ac7c6 100644 ---- a/arch/arm/boot/dts/gemini-nas4220b.dts -+++ b/arch/arm/boot/dts/gemini-nas4220b.dts -@@ -84,7 +84,7 @@ - partitions { - compatible = "redboot-fis"; - /* Eraseblock at 0xfe0000 */ -- fis-index-block = <0x1fc>; -+ fis-index-block = <0x7f>; - }; - }; - -diff --git a/arch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c b/arch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c -index ee949255ced3f..09ef73b99dd86 100644 ---- a/arch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c -+++ b/arch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c -@@ -154,8 +154,10 @@ static int __init rcar_gen2_regulator_quirk(void) - return -ENODEV; - - for_each_matching_node_and_match(np, rcar_gen2_quirk_match, &id) { -- if (!of_device_is_available(np)) -+ if (!of_device_is_available(np)) { -+ of_node_put(np); - break; -+ } - - ret = of_property_read_u32(np, "reg", &addr); - if (ret) /* Skip invalid entry and continue */ -@@ -164,6 +166,7 @@ static int __init rcar_gen2_regulator_quirk(void) - quirk = kzalloc(sizeof(*quirk), GFP_KERNEL); - if (!quirk) { - ret = -ENOMEM; -+ of_node_put(np); - goto err_mem; - } - -diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi -index e3d17569d98ad..e94f09c2d4e32 100644 ---- a/arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi -+++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi -@@ -6,6 +6,7 @@ - */ - - #include "meson-gxbb.dtsi" -+#include - - / { - aliases { -@@ -64,6 +65,7 @@ - regulator-name = "VDDIO_AO18"; - regulator-min-microvolt = <1800000>; - regulator-max-microvolt = <1800000>; -+ regulator-always-on; - }; - - vcc_3v3: regulator-vcc_3v3 { -@@ -157,6 +159,7 @@ - status = "okay"; - pinctrl-0 = <&hdmi_hpd_pins>, <&hdmi_i2c_pins>; - pinctrl-names = "default"; -+ hdmi-supply = <&vddio_ao18>; - }; - - &hdmi_tx_tmds_port { -diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1028a-qds.dts b/arch/arm64/boot/dts/freescale/fsl-ls1028a-qds.dts -index 078a5010228cd..0b3a93c4155d2 100644 ---- a/arch/arm64/boot/dts/freescale/fsl-ls1028a-qds.dts -+++ b/arch/arm64/boot/dts/freescale/fsl-ls1028a-qds.dts -@@ -161,11 +161,6 @@ - vcc-supply = <&sb_3v3>; - }; - -- rtc@51 { -- compatible = "nxp,pcf2129"; -- reg = <0x51>; -- }; -- - eeprom@56 { - compatible = "atmel,24c512"; - reg = <0x56>; -@@ -209,6 +204,15 @@ - - }; - -+&i2c1 { -+ status = "okay"; -+ -+ rtc@51 { -+ compatible = "nxp,pcf2129"; -+ reg = <0x51>; -+ }; -+}; -+ - &enetc_port1 { - phy-handle = <&qds_phy1>; - phy-connection-type = "rgmii-id"; -diff --git a/arch/arm64/boot/dts/nvidia/tegra186.dtsi b/arch/arm64/boot/dts/nvidia/tegra186.dtsi -index 9abf0cb1dd67f..4457262750734 100644 ---- a/arch/arm64/boot/dts/nvidia/tegra186.dtsi -+++ b/arch/arm64/boot/dts/nvidia/tegra186.dtsi -@@ -709,7 +709,7 @@ - - ccplex@e000000 { - compatible = "nvidia,tegra186-ccplex-cluster"; -- reg = <0x0 0x0e000000 0x0 0x3fffff>; -+ reg = <0x0 0x0e000000 0x0 0x400000>; - - nvidia,bpmp = <&bpmp>; - }; -diff --git a/arch/arm64/boot/dts/qcom/msm8916.dtsi b/arch/arm64/boot/dts/qcom/msm8916.dtsi -index 449843f2184d8..301c1c467c0b7 100644 ---- a/arch/arm64/boot/dts/qcom/msm8916.dtsi -+++ b/arch/arm64/boot/dts/qcom/msm8916.dtsi -@@ -16,8 +16,8 @@ - #size-cells = <2>; - - aliases { -- sdhc1 = &sdhc_1; /* SDC1 eMMC slot */ -- sdhc2 = &sdhc_2; /* SDC2 SD card slot */ -+ mmc0 = &sdhc_1; /* SDC1 eMMC slot */ -+ mmc1 = &sdhc_2; /* SDC2 SD card slot */ - }; - - chosen { }; -diff --git a/arch/arm64/boot/dts/qcom/msm8996.dtsi b/arch/arm64/boot/dts/qcom/msm8996.dtsi -index d303df3887d9f..f1d3c51ea8d0d 100644 ---- a/arch/arm64/boot/dts/qcom/msm8996.dtsi -+++ b/arch/arm64/boot/dts/qcom/msm8996.dtsi -@@ -2098,9 +2098,6 @@ - nvmem-cells = <&gpu_speed_bin>; - nvmem-cell-names = "speed_bin"; - -- qcom,gpu-quirk-two-pass-use-wfi; -- qcom,gpu-quirk-fault-detect-mask; -- - operating-points-v2 = <&gpu_opp_table>; - - gpu_opp_table: opp-table { -diff --git a/arch/arm64/boot/dts/ti/k3-j721e.dtsi b/arch/arm64/boot/dts/ti/k3-j721e.dtsi -index 43ea1ba979220..5a6e74636d6fc 100644 ---- a/arch/arm64/boot/dts/ti/k3-j721e.dtsi -+++ b/arch/arm64/boot/dts/ti/k3-j721e.dtsi -@@ -60,7 +60,7 @@ - i-cache-sets = <256>; - d-cache-size = <0x8000>; - d-cache-line-size = <64>; -- d-cache-sets = <128>; -+ d-cache-sets = <256>; - next-level-cache = <&L2_0>; - }; - -@@ -74,7 +74,7 @@ - i-cache-sets = <256>; - d-cache-size = <0x8000>; - d-cache-line-size = <64>; -- d-cache-sets = <128>; -+ d-cache-sets = <256>; - next-level-cache = <&L2_0>; - }; - }; -@@ -84,7 +84,7 @@ - cache-level = <2>; - cache-size = <0x100000>; - cache-line-size = <64>; -- cache-sets = <2048>; -+ cache-sets = <1024>; - next-level-cache = <&msmc_l3>; - }; - -diff --git a/arch/ia64/kernel/kprobes.c b/arch/ia64/kernel/kprobes.c -index 8a223d0e4918c..fa10d51f62177 100644 ---- a/arch/ia64/kernel/kprobes.c -+++ b/arch/ia64/kernel/kprobes.c -@@ -396,10 +396,83 @@ static void kretprobe_trampoline(void) - { - } - -+/* -+ * At this point the target function has been tricked into -+ * returning into our trampoline. Lookup the associated instance -+ * and then: -+ * - call the handler function -+ * - cleanup by marking the instance as unused -+ * - long jump back to the original return address -+ */ - int __kprobes trampoline_probe_handler(struct kprobe *p, struct pt_regs *regs) - { -- regs->cr_iip = __kretprobe_trampoline_handler(regs, -- dereference_function_descriptor(kretprobe_trampoline), NULL); -+ struct kretprobe_instance *ri = NULL; -+ struct hlist_head *head, empty_rp; -+ struct hlist_node *tmp; -+ unsigned long flags, orig_ret_address = 0; -+ unsigned long trampoline_address = -+ (unsigned long)dereference_function_descriptor(kretprobe_trampoline); -+ -+ INIT_HLIST_HEAD(&empty_rp); -+ kretprobe_hash_lock(current, &head, &flags); -+ -+ /* -+ * It is possible to have multiple instances associated with a given -+ * task either because an multiple functions in the call path -+ * have a return probe installed on them, and/or more than one return -+ * return probe was registered for a target function. -+ * -+ * We can handle this because: -+ * - instances are always inserted at the head of the list -+ * - when multiple return probes are registered for the same -+ * function, the first instance's ret_addr will point to the -+ * real return address, and all the rest will point to -+ * kretprobe_trampoline -+ */ -+ hlist_for_each_entry_safe(ri, tmp, head, hlist) { -+ if (ri->task != current) -+ /* another task is sharing our hash bucket */ -+ continue; -+ -+ orig_ret_address = (unsigned long)ri->ret_addr; -+ if (orig_ret_address != trampoline_address) -+ /* -+ * This is the real return address. Any other -+ * instances associated with this task are for -+ * other calls deeper on the call stack -+ */ -+ break; -+ } -+ -+ regs->cr_iip = orig_ret_address; -+ -+ hlist_for_each_entry_safe(ri, tmp, head, hlist) { -+ if (ri->task != current) -+ /* another task is sharing our hash bucket */ -+ continue; -+ -+ if (ri->rp && ri->rp->handler) -+ ri->rp->handler(ri, regs); -+ -+ orig_ret_address = (unsigned long)ri->ret_addr; -+ recycle_rp_inst(ri, &empty_rp); -+ -+ if (orig_ret_address != trampoline_address) -+ /* -+ * This is the real return address. Any other -+ * instances associated with this task are for -+ * other calls deeper on the call stack -+ */ -+ break; -+ } -+ kretprobe_assert(ri, orig_ret_address, trampoline_address); -+ -+ kretprobe_hash_unlock(current, &flags); -+ -+ hlist_for_each_entry_safe(ri, tmp, &empty_rp, hlist) { -+ hlist_del(&ri->hlist); -+ kfree(ri); -+ } - /* - * By returning a non-zero value, we are telling - * kprobe_handler() that we don't want the post_handler -@@ -412,7 +485,6 @@ void __kprobes arch_prepare_kretprobe(struct kretprobe_instance *ri, - struct pt_regs *regs) - { - ri->ret_addr = (kprobe_opcode_t *)regs->b0; -- ri->fp = NULL; - - /* Replace the return addr with trampoline addr */ - regs->b0 = (unsigned long)dereference_function_descriptor(kretprobe_trampoline); -diff --git a/arch/mips/bcm63xx/clk.c b/arch/mips/bcm63xx/clk.c -index aba6e2d6a736c..dcfa0ea912fe1 100644 ---- a/arch/mips/bcm63xx/clk.c -+++ b/arch/mips/bcm63xx/clk.c -@@ -387,6 +387,12 @@ struct clk *clk_get_parent(struct clk *clk) - } - EXPORT_SYMBOL(clk_get_parent); - -+int clk_set_parent(struct clk *clk, struct clk *parent) -+{ -+ return 0; -+} -+EXPORT_SYMBOL(clk_set_parent); -+ - unsigned long clk_get_rate(struct clk *clk) - { - if (!clk) -diff --git a/arch/mips/cavium-octeon/octeon-platform.c b/arch/mips/cavium-octeon/octeon-platform.c -index 51685f893eab0..c214fe4e678bb 100644 ---- a/arch/mips/cavium-octeon/octeon-platform.c -+++ b/arch/mips/cavium-octeon/octeon-platform.c -@@ -328,6 +328,7 @@ static int __init octeon_ehci_device_init(void) - - pd->dev.platform_data = &octeon_ehci_pdata; - octeon_ehci_hw_start(&pd->dev); -+ put_device(&pd->dev); - - return ret; - } -@@ -391,6 +392,7 @@ static int __init octeon_ohci_device_init(void) - - pd->dev.platform_data = &octeon_ohci_pdata; - octeon_ohci_hw_start(&pd->dev); -+ put_device(&pd->dev); - - return ret; - } -diff --git a/arch/mips/cavium-octeon/octeon-usb.c b/arch/mips/cavium-octeon/octeon-usb.c -index 4017398519cf9..e092d86e63581 100644 ---- a/arch/mips/cavium-octeon/octeon-usb.c -+++ b/arch/mips/cavium-octeon/octeon-usb.c -@@ -544,6 +544,7 @@ static int __init dwc3_octeon_device_init(void) - devm_iounmap(&pdev->dev, base); - devm_release_mem_region(&pdev->dev, res->start, - resource_size(res)); -+ put_device(&pdev->dev); - } - } while (node != NULL); - -diff --git a/arch/mips/include/asm/octeon/cvmx-bootinfo.h b/arch/mips/include/asm/octeon/cvmx-bootinfo.h -index 62787765575ef..ce6e5fddce0bf 100644 ---- a/arch/mips/include/asm/octeon/cvmx-bootinfo.h -+++ b/arch/mips/include/asm/octeon/cvmx-bootinfo.h -@@ -315,7 +315,7 @@ enum cvmx_chip_types_enum { - - /* Functions to return string based on type */ - #define ENUM_BRD_TYPE_CASE(x) \ -- case x: return(#x + 16); /* Skip CVMX_BOARD_TYPE_ */ -+ case x: return (&#x[16]); /* Skip CVMX_BOARD_TYPE_ */ - static inline const char *cvmx_board_type_to_string(enum - cvmx_board_types_enum type) - { -@@ -404,7 +404,7 @@ static inline const char *cvmx_board_type_to_string(enum - } - - #define ENUM_CHIP_TYPE_CASE(x) \ -- case x: return(#x + 15); /* Skip CVMX_CHIP_TYPE */ -+ case x: return (&#x[15]); /* Skip CVMX_CHIP_TYPE */ - static inline const char *cvmx_chip_type_to_string(enum - cvmx_chip_types_enum type) - { -diff --git a/arch/mips/lantiq/clk.c b/arch/mips/lantiq/clk.c -index 4916cccf378fd..7a623684d9b5e 100644 ---- a/arch/mips/lantiq/clk.c -+++ b/arch/mips/lantiq/clk.c -@@ -164,6 +164,12 @@ struct clk *clk_get_parent(struct clk *clk) - } - EXPORT_SYMBOL(clk_get_parent); - -+int clk_set_parent(struct clk *clk, struct clk *parent) -+{ -+ return 0; -+} -+EXPORT_SYMBOL(clk_set_parent); -+ - static inline u32 get_counter_resolution(void) - { - u32 res; -diff --git a/arch/parisc/kernel/traps.c b/arch/parisc/kernel/traps.c -index 82fc011894889..2a1060d747a5d 100644 ---- a/arch/parisc/kernel/traps.c -+++ b/arch/parisc/kernel/traps.c -@@ -783,7 +783,7 @@ void notrace handle_interruption(int code, struct pt_regs *regs) - * unless pagefault_disable() was called before. - */ - -- if (fault_space == 0 && !faulthandler_disabled()) -+ if (faulthandler_disabled() || fault_space == 0) - { - /* Clean up and return if in exception table. */ - if (fixup_exception(regs)) -diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3l-0.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3l-0.dtsi -index c90702b04a530..48e5cd61599c6 100644 ---- a/arch/powerpc/boot/dts/fsl/qoriq-fman3l-0.dtsi -+++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3l-0.dtsi -@@ -79,6 +79,7 @@ fman0: fman@400000 { - #size-cells = <0>; - compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio"; - reg = <0xfc000 0x1000>; -+ fsl,erratum-a009885; - }; - - xmdio0: mdio@fd000 { -@@ -86,6 +87,7 @@ fman0: fman@400000 { - #size-cells = <0>; - compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio"; - reg = <0xfd000 0x1000>; -+ fsl,erratum-a009885; - }; - }; - -diff --git a/arch/powerpc/kernel/btext.c b/arch/powerpc/kernel/btext.c -index 6dfceaa820e42..b0e0b3cd91eec 100644 ---- a/arch/powerpc/kernel/btext.c -+++ b/arch/powerpc/kernel/btext.c -@@ -250,8 +250,10 @@ int __init btext_find_display(int allow_nonstdout) - rc = btext_initialize(np); - printk("result: %d\n", rc); - } -- if (rc == 0) -+ if (rc == 0) { -+ of_node_put(np); - break; -+ } - } - return rc; - } -diff --git a/arch/powerpc/kernel/prom_init.c b/arch/powerpc/kernel/prom_init.c -index 1b65fb7c0bdaa..7f4e2c031a9ab 100644 ---- a/arch/powerpc/kernel/prom_init.c -+++ b/arch/powerpc/kernel/prom_init.c -@@ -2919,7 +2919,7 @@ static void __init fixup_device_tree_efika_add_phy(void) - - /* Check if the phy-handle property exists - bail if it does */ - rv = prom_getprop(node, "phy-handle", prop, sizeof(prop)); -- if (!rv) -+ if (rv <= 0) - return; - - /* -diff --git a/arch/powerpc/kernel/smp.c b/arch/powerpc/kernel/smp.c -index c06cac543f188..4de63ec2e1551 100644 ---- a/arch/powerpc/kernel/smp.c -+++ b/arch/powerpc/kernel/smp.c -@@ -582,6 +582,36 @@ void crash_send_ipi(void (*crash_ipi_callback)(struct pt_regs *)) - } - #endif - -+#ifdef CONFIG_NMI_IPI -+static void crash_stop_this_cpu(struct pt_regs *regs) -+#else -+static void crash_stop_this_cpu(void *dummy) -+#endif -+{ -+ /* -+ * Just busy wait here and avoid marking CPU as offline to ensure -+ * register data is captured appropriately. -+ */ -+ while (1) -+ cpu_relax(); -+} -+ -+void crash_smp_send_stop(void) -+{ -+ static bool stopped = false; -+ -+ if (stopped) -+ return; -+ -+ stopped = true; -+ -+#ifdef CONFIG_NMI_IPI -+ smp_send_nmi_ipi(NMI_IPI_ALL_OTHERS, crash_stop_this_cpu, 1000000); -+#else -+ smp_call_function(crash_stop_this_cpu, NULL, 0); -+#endif /* CONFIG_NMI_IPI */ -+} -+ - #ifdef CONFIG_NMI_IPI - static void nmi_stop_this_cpu(struct pt_regs *regs) - { -@@ -1296,10 +1326,12 @@ void start_secondary(void *unused) - BUG(); - } - -+#ifdef CONFIG_PROFILING - int setup_profiling_timer(unsigned int multiplier) - { - return 0; - } -+#endif - - #ifdef CONFIG_SCHED_SMT - /* cpumask of CPUs with asymetric SMT dependancy */ -diff --git a/arch/powerpc/kernel/watchdog.c b/arch/powerpc/kernel/watchdog.c -index af3c15a1d41eb..75b2a6c4db5a5 100644 ---- a/arch/powerpc/kernel/watchdog.c -+++ b/arch/powerpc/kernel/watchdog.c -@@ -132,6 +132,10 @@ static void set_cpumask_stuck(const struct cpumask *cpumask, u64 tb) - { - cpumask_or(&wd_smp_cpus_stuck, &wd_smp_cpus_stuck, cpumask); - cpumask_andnot(&wd_smp_cpus_pending, &wd_smp_cpus_pending, cpumask); -+ /* -+ * See wd_smp_clear_cpu_pending() -+ */ -+ smp_mb(); - if (cpumask_empty(&wd_smp_cpus_pending)) { - wd_smp_last_reset_tb = tb; - cpumask_andnot(&wd_smp_cpus_pending, -@@ -217,13 +221,44 @@ static void wd_smp_clear_cpu_pending(int cpu, u64 tb) - - cpumask_clear_cpu(cpu, &wd_smp_cpus_stuck); - wd_smp_unlock(&flags); -+ } else { -+ /* -+ * The last CPU to clear pending should have reset the -+ * watchdog so we generally should not find it empty -+ * here if our CPU was clear. However it could happen -+ * due to a rare race with another CPU taking the -+ * last CPU out of the mask concurrently. -+ * -+ * We can't add a warning for it. But just in case -+ * there is a problem with the watchdog that is causing -+ * the mask to not be reset, try to kick it along here. -+ */ -+ if (unlikely(cpumask_empty(&wd_smp_cpus_pending))) -+ goto none_pending; - } - return; - } -+ - cpumask_clear_cpu(cpu, &wd_smp_cpus_pending); -+ -+ /* -+ * Order the store to clear pending with the load(s) to check all -+ * words in the pending mask to check they are all empty. This orders -+ * with the same barrier on another CPU. This prevents two CPUs -+ * clearing the last 2 pending bits, but neither seeing the other's -+ * store when checking if the mask is empty, and missing an empty -+ * mask, which ends with a false positive. -+ */ -+ smp_mb(); - if (cpumask_empty(&wd_smp_cpus_pending)) { - unsigned long flags; - -+none_pending: -+ /* -+ * Double check under lock because more than one CPU could see -+ * a clear mask with the lockless check after clearing their -+ * pending bits. -+ */ - wd_smp_lock(&flags); - if (cpumask_empty(&wd_smp_cpus_pending)) { - wd_smp_last_reset_tb = tb; -@@ -314,8 +349,12 @@ void arch_touch_nmi_watchdog(void) - { - unsigned long ticks = tb_ticks_per_usec * wd_timer_period_ms * 1000; - int cpu = smp_processor_id(); -- u64 tb = get_tb(); -+ u64 tb; - -+ if (!cpumask_test_cpu(cpu, &watchdog_cpumask)) -+ return; -+ -+ tb = get_tb(); - if (tb - per_cpu(wd_timer_tb, cpu) >= ticks) { - per_cpu(wd_timer_tb, cpu) = tb; - wd_smp_clear_cpu_pending(cpu, tb); -diff --git a/arch/powerpc/kvm/book3s_hv_nested.c b/arch/powerpc/kvm/book3s_hv_nested.c -index 9906d203d9d39..613d24b707abe 100644 ---- a/arch/powerpc/kvm/book3s_hv_nested.c -+++ b/arch/powerpc/kvm/book3s_hv_nested.c -@@ -510,7 +510,7 @@ long kvmhv_copy_tofrom_guest_nested(struct kvm_vcpu *vcpu) - if (eaddr & (0xFFFUL << 52)) - return H_PARAMETER; - -- buf = kzalloc(n, GFP_KERNEL); -+ buf = kzalloc(n, GFP_KERNEL | __GFP_NOWARN); - if (!buf) - return H_NO_MEM; - -diff --git a/arch/powerpc/platforms/cell/iommu.c b/arch/powerpc/platforms/cell/iommu.c -index ca9ffc1c8685d..a6a60e2b8f453 100644 ---- a/arch/powerpc/platforms/cell/iommu.c -+++ b/arch/powerpc/platforms/cell/iommu.c -@@ -976,6 +976,7 @@ static int __init cell_iommu_fixed_mapping_init(void) - if (hbase < dbase || (hend > (dbase + dsize))) { - pr_debug("iommu: hash window doesn't fit in" - "real DMA window\n"); -+ of_node_put(np); - return -1; - } - } -diff --git a/arch/powerpc/platforms/cell/pervasive.c b/arch/powerpc/platforms/cell/pervasive.c -index 6af3a6e600a70..80c9c4d715505 100644 ---- a/arch/powerpc/platforms/cell/pervasive.c -+++ b/arch/powerpc/platforms/cell/pervasive.c -@@ -77,6 +77,7 @@ static int cbe_system_reset_exception(struct pt_regs *regs) - switch (regs->msr & SRR1_WAKEMASK) { - case SRR1_WAKEDEC: - set_dec(1); -+ break; - case SRR1_WAKEEE: - /* - * Handle these when interrupts get re-enabled and we take -diff --git a/arch/powerpc/platforms/embedded6xx/hlwd-pic.c b/arch/powerpc/platforms/embedded6xx/hlwd-pic.c -index a1b7f79a8a152..de10c13de15c6 100644 ---- a/arch/powerpc/platforms/embedded6xx/hlwd-pic.c -+++ b/arch/powerpc/platforms/embedded6xx/hlwd-pic.c -@@ -215,6 +215,7 @@ void hlwd_pic_probe(void) - irq_set_chained_handler(cascade_virq, - hlwd_pic_irq_cascade); - hlwd_irq_host = host; -+ of_node_put(np); - break; - } - } -diff --git a/arch/powerpc/platforms/powermac/low_i2c.c b/arch/powerpc/platforms/powermac/low_i2c.c -index bf4be4b53b44d..210435a43bf95 100644 ---- a/arch/powerpc/platforms/powermac/low_i2c.c -+++ b/arch/powerpc/platforms/powermac/low_i2c.c -@@ -582,6 +582,7 @@ static void __init kw_i2c_add(struct pmac_i2c_host_kw *host, - bus->close = kw_i2c_close; - bus->xfer = kw_i2c_xfer; - mutex_init(&bus->mutex); -+ lockdep_register_key(&bus->lock_key); - lockdep_set_class(&bus->mutex, &bus->lock_key); - if (controller == busnode) - bus->flags = pmac_i2c_multibus; -@@ -811,6 +812,7 @@ static void __init pmu_i2c_probe(void) - bus->hostdata = bus + 1; - bus->xfer = pmu_i2c_xfer; - mutex_init(&bus->mutex); -+ lockdep_register_key(&bus->lock_key); - lockdep_set_class(&bus->mutex, &bus->lock_key); - bus->flags = pmac_i2c_multibus; - list_add(&bus->link, &pmac_i2c_busses); -@@ -934,6 +936,7 @@ static void __init smu_i2c_probe(void) - bus->hostdata = bus + 1; - bus->xfer = smu_i2c_xfer; - mutex_init(&bus->mutex); -+ lockdep_register_key(&bus->lock_key); - lockdep_set_class(&bus->mutex, &bus->lock_key); - bus->flags = 0; - list_add(&bus->link, &pmac_i2c_busses); -diff --git a/arch/powerpc/platforms/powernv/opal-lpc.c b/arch/powerpc/platforms/powernv/opal-lpc.c -index 608569082ba0b..123a0e799b7bd 100644 ---- a/arch/powerpc/platforms/powernv/opal-lpc.c -+++ b/arch/powerpc/platforms/powernv/opal-lpc.c -@@ -396,6 +396,7 @@ void __init opal_lpc_init(void) - if (!of_get_property(np, "primary", NULL)) - continue; - opal_lpc_chip_id = of_get_ibm_chip_id(np); -+ of_node_put(np); - break; - } - if (opal_lpc_chip_id < 0) -diff --git a/arch/s390/mm/pgalloc.c b/arch/s390/mm/pgalloc.c -index 46071be897ab0..90943bf3e5eec 100644 ---- a/arch/s390/mm/pgalloc.c -+++ b/arch/s390/mm/pgalloc.c -@@ -255,13 +255,15 @@ void page_table_free(struct mm_struct *mm, unsigned long *table) - /* Free 2K page table fragment of a 4K page */ - bit = (__pa(table) & ~PAGE_MASK)/(PTRS_PER_PTE*sizeof(pte_t)); - spin_lock_bh(&mm->context.lock); -- mask = atomic_xor_bits(&page->_refcount, 1U << (bit + 24)); -+ mask = atomic_xor_bits(&page->_refcount, 0x11U << (bit + 24)); - mask >>= 24; - if (mask & 3) - list_add(&page->lru, &mm->context.pgtable_list); - else - list_del(&page->lru); - spin_unlock_bh(&mm->context.lock); -+ mask = atomic_xor_bits(&page->_refcount, 0x10U << (bit + 24)); -+ mask >>= 24; - if (mask != 0) - return; - } else { -diff --git a/arch/um/include/shared/registers.h b/arch/um/include/shared/registers.h -index 0c50fa6e8a55b..fbb709a222839 100644 ---- a/arch/um/include/shared/registers.h -+++ b/arch/um/include/shared/registers.h -@@ -16,8 +16,8 @@ extern int restore_fp_registers(int pid, unsigned long *fp_regs); - extern int save_fpx_registers(int pid, unsigned long *fp_regs); - extern int restore_fpx_registers(int pid, unsigned long *fp_regs); - extern int save_registers(int pid, struct uml_pt_regs *regs); --extern int restore_registers(int pid, struct uml_pt_regs *regs); --extern int init_registers(int pid); -+extern int restore_pid_registers(int pid, struct uml_pt_regs *regs); -+extern int init_pid_registers(int pid); - extern void get_safe_registers(unsigned long *regs, unsigned long *fp_regs); - extern unsigned long get_thread_reg(int reg, jmp_buf *buf); - extern int get_fp_registers(int pid, unsigned long *regs); -diff --git a/arch/um/os-Linux/registers.c b/arch/um/os-Linux/registers.c -index 2d9270508e156..b123955be7acc 100644 ---- a/arch/um/os-Linux/registers.c -+++ b/arch/um/os-Linux/registers.c -@@ -21,7 +21,7 @@ int save_registers(int pid, struct uml_pt_regs *regs) - return 0; - } - --int restore_registers(int pid, struct uml_pt_regs *regs) -+int restore_pid_registers(int pid, struct uml_pt_regs *regs) - { - int err; - -@@ -36,7 +36,7 @@ int restore_registers(int pid, struct uml_pt_regs *regs) - static unsigned long exec_regs[MAX_REG_NR]; - static unsigned long exec_fp_regs[FP_SIZE]; - --int init_registers(int pid) -+int init_pid_registers(int pid) - { - int err; - -diff --git a/arch/um/os-Linux/start_up.c b/arch/um/os-Linux/start_up.c -index f79dc338279e6..b28373a2b8d2d 100644 ---- a/arch/um/os-Linux/start_up.c -+++ b/arch/um/os-Linux/start_up.c -@@ -336,7 +336,7 @@ void __init os_early_checks(void) - check_tmpexec(); - - pid = start_ptraced_child(); -- if (init_registers(pid)) -+ if (init_pid_registers(pid)) - fatal("Failed to initialize default registers"); - stop_ptraced_child(pid, 1, 1); - } -diff --git a/arch/x86/include/asm/realmode.h b/arch/x86/include/asm/realmode.h -index 09ecc32f65248..52d7512ea91ab 100644 ---- a/arch/x86/include/asm/realmode.h -+++ b/arch/x86/include/asm/realmode.h -@@ -82,6 +82,7 @@ static inline void set_real_mode_mem(phys_addr_t mem) - } - - void reserve_real_mode(void); -+void load_trampoline_pgtable(void); - - #endif /* __ASSEMBLY__ */ - -diff --git a/arch/x86/kernel/cpu/mce/core.c b/arch/x86/kernel/cpu/mce/core.c -index c2a9762d278dd..8a2b8e7913149 100644 ---- a/arch/x86/kernel/cpu/mce/core.c -+++ b/arch/x86/kernel/cpu/mce/core.c -@@ -310,11 +310,17 @@ static void wait_for_panic(void) - panic("Panicing machine check CPU died"); - } - --static void mce_panic(const char *msg, struct mce *final, char *exp) -+static noinstr void mce_panic(const char *msg, struct mce *final, char *exp) - { -- int apei_err = 0; - struct llist_node *pending; - struct mce_evt_llist *l; -+ int apei_err = 0; -+ -+ /* -+ * Allow instrumentation around external facilities usage. Not that it -+ * matters a whole lot since the machine is going to panic anyway. -+ */ -+ instrumentation_begin(); - - if (!fake_panic) { - /* -@@ -329,7 +335,7 @@ static void mce_panic(const char *msg, struct mce *final, char *exp) - } else { - /* Don't log too much for fake panic */ - if (atomic_inc_return(&mce_fake_panicked) > 1) -- return; -+ goto out; - } - pending = mce_gen_pool_prepare_records(); - /* First print corrected ones that are still unlogged */ -@@ -367,6 +373,9 @@ static void mce_panic(const char *msg, struct mce *final, char *exp) - panic(msg); - } else - pr_emerg(HW_ERR "Fake kernel panic: %s\n", msg); -+ -+out: -+ instrumentation_end(); - } - - /* Support code for software error injection */ -@@ -691,7 +700,7 @@ static struct notifier_block mce_default_nb = { - /* - * Read ADDR and MISC registers. - */ --static void mce_read_aux(struct mce *m, int i) -+static noinstr void mce_read_aux(struct mce *m, int i) - { - if (m->status & MCI_STATUS_MISCV) - m->misc = mce_rdmsrl(msr_ops.misc(i)); -@@ -1071,10 +1080,13 @@ static int mce_start(int *no_way_out) - * Synchronize between CPUs after main scanning loop. - * This invokes the bulk of the Monarch processing. - */ --static int mce_end(int order) -+static noinstr int mce_end(int order) - { -- int ret = -1; - u64 timeout = (u64)mca_cfg.monarch_timeout * NSEC_PER_USEC; -+ int ret = -1; -+ -+ /* Allow instrumentation around external facilities. */ -+ instrumentation_begin(); - - if (!timeout) - goto reset; -@@ -1118,7 +1130,8 @@ static int mce_end(int order) - /* - * Don't reset anything. That's done by the Monarch. - */ -- return 0; -+ ret = 0; -+ goto out; - } - - /* -@@ -1133,6 +1146,10 @@ reset: - * Let others run again. - */ - atomic_set(&mce_executing, 0); -+ -+out: -+ instrumentation_end(); -+ - return ret; - } - -diff --git a/arch/x86/kernel/cpu/mce/inject.c b/arch/x86/kernel/cpu/mce/inject.c -index eb2d41c1816d6..e1fda5b19b6f6 100644 ---- a/arch/x86/kernel/cpu/mce/inject.c -+++ b/arch/x86/kernel/cpu/mce/inject.c -@@ -347,7 +347,7 @@ static ssize_t flags_write(struct file *filp, const char __user *ubuf, - char buf[MAX_FLAG_OPT_SIZE], *__buf; - int err; - -- if (cnt > MAX_FLAG_OPT_SIZE) -+ if (!cnt || cnt > MAX_FLAG_OPT_SIZE) - return -EINVAL; - - if (copy_from_user(&buf, ubuf, cnt)) -diff --git a/arch/x86/kernel/early-quirks.c b/arch/x86/kernel/early-quirks.c -index 6f6b1d04dadf9..50225bc0383b9 100644 ---- a/arch/x86/kernel/early-quirks.c -+++ b/arch/x86/kernel/early-quirks.c -@@ -515,6 +515,7 @@ static const struct intel_early_ops gen11_early_ops __initconst = { - .stolen_size = gen9_stolen_size, - }; - -+/* Intel integrated GPUs for which we need to reserve "stolen memory" */ - static const struct pci_device_id intel_early_ids[] __initconst = { - INTEL_I830_IDS(&i830_early_ops), - INTEL_I845G_IDS(&i845_early_ops), -@@ -587,6 +588,13 @@ static void __init intel_graphics_quirks(int num, int slot, int func) - u16 device; - int i; - -+ /* -+ * Reserve "stolen memory" for an integrated GPU. If we've already -+ * found one, there's nothing to do for other (discrete) GPUs. -+ */ -+ if (resource_size(&intel_graphics_stolen_res)) -+ return; -+ - device = read_pci_config_16(num, slot, func, PCI_DEVICE_ID); - - for (i = 0; i < ARRAY_SIZE(intel_early_ids); i++) { -@@ -699,7 +707,7 @@ static struct chipset early_qrk[] __initdata = { - { PCI_VENDOR_ID_INTEL, 0x3406, PCI_CLASS_BRIDGE_HOST, - PCI_BASE_CLASS_BRIDGE, 0, intel_remapping_check }, - { PCI_VENDOR_ID_INTEL, PCI_ANY_ID, PCI_CLASS_DISPLAY_VGA, PCI_ANY_ID, -- QFLAG_APPLY_ONCE, intel_graphics_quirks }, -+ 0, intel_graphics_quirks }, - /* - * HPET on the current version of the Baytrail platform has accuracy - * problems: it will halt in deep idle state - so we disable it. -diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c -index d65d1afb27161..fdef27a84d713 100644 ---- a/arch/x86/kernel/reboot.c -+++ b/arch/x86/kernel/reboot.c -@@ -113,17 +113,9 @@ void __noreturn machine_real_restart(unsigned int type) - spin_unlock(&rtc_lock); - - /* -- * Switch back to the initial page table. -+ * Switch to the trampoline page table. - */ --#ifdef CONFIG_X86_32 -- load_cr3(initial_page_table); --#else -- write_cr3(real_mode_header->trampoline_pgd); -- -- /* Exiting long mode will fail if CR4.PCIDE is set. */ -- if (boot_cpu_has(X86_FEATURE_PCID)) -- cr4_clear_bits(X86_CR4_PCIDE); --#endif -+ load_trampoline_pgtable(); - - /* Jump to the identity-mapped low memory code */ - #ifdef CONFIG_X86_32 -diff --git a/arch/x86/realmode/init.c b/arch/x86/realmode/init.c -index de371e52cfa85..fac50ebb122b5 100644 ---- a/arch/x86/realmode/init.c -+++ b/arch/x86/realmode/init.c -@@ -16,6 +16,32 @@ u32 *trampoline_cr4_features; - /* Hold the pgd entry used on booting additional CPUs */ - pgd_t trampoline_pgd_entry; - -+void load_trampoline_pgtable(void) -+{ -+#ifdef CONFIG_X86_32 -+ load_cr3(initial_page_table); -+#else -+ /* -+ * This function is called before exiting to real-mode and that will -+ * fail with CR4.PCIDE still set. -+ */ -+ if (boot_cpu_has(X86_FEATURE_PCID)) -+ cr4_clear_bits(X86_CR4_PCIDE); -+ -+ write_cr3(real_mode_header->trampoline_pgd); -+#endif -+ -+ /* -+ * The CR3 write above will not flush global TLB entries. -+ * Stale, global entries from previous page tables may still be -+ * present. Flush those stale entries. -+ * -+ * This ensures that memory accessed while running with -+ * trampoline_pgd is *actually* mapped into trampoline_pgd. -+ */ -+ __flush_tlb_all(); -+} -+ - void __init reserve_real_mode(void) - { - phys_addr_t mem; -diff --git a/arch/x86/um/syscalls_64.c b/arch/x86/um/syscalls_64.c -index 58f51667e2e4b..8249685b40960 100644 ---- a/arch/x86/um/syscalls_64.c -+++ b/arch/x86/um/syscalls_64.c -@@ -11,6 +11,7 @@ - #include - #include /* XXX This should get the constants from libc */ - #include -+#include - - long arch_prctl(struct task_struct *task, int option, - unsigned long __user *arg2) -@@ -35,7 +36,7 @@ long arch_prctl(struct task_struct *task, int option, - switch (option) { - case ARCH_SET_FS: - case ARCH_SET_GS: -- ret = restore_registers(pid, ¤t->thread.regs.regs); -+ ret = restore_pid_registers(pid, ¤t->thread.regs.regs); - if (ret) - return ret; - break; -diff --git a/drivers/acpi/acpica/exfield.c b/drivers/acpi/acpica/exfield.c -index d3d2dbfba680c..cd3debefe990d 100644 ---- a/drivers/acpi/acpica/exfield.c -+++ b/drivers/acpi/acpica/exfield.c -@@ -320,12 +320,7 @@ acpi_ex_write_data_to_field(union acpi_operand_object *source_desc, - obj_desc->field.base_byte_offset, - source_desc->buffer.pointer, data_length); - -- if ((obj_desc->field.region_obj->region.address == -- PCC_MASTER_SUBSPACE -- && MASTER_SUBSPACE_COMMAND(obj_desc->field. -- base_byte_offset)) -- || GENERIC_SUBSPACE_COMMAND(obj_desc->field. -- base_byte_offset)) { -+ if (MASTER_SUBSPACE_COMMAND(obj_desc->field.base_byte_offset)) { - - /* Perform the write */ - -diff --git a/drivers/acpi/acpica/exoparg1.c b/drivers/acpi/acpica/exoparg1.c -index 06e35ea098234..6d84618ba3871 100644 ---- a/drivers/acpi/acpica/exoparg1.c -+++ b/drivers/acpi/acpica/exoparg1.c -@@ -1007,7 +1007,8 @@ acpi_status acpi_ex_opcode_1A_0T_1R(struct acpi_walk_state *walk_state) - (walk_state, return_desc, - &temp_desc); - if (ACPI_FAILURE(status)) { -- goto cleanup; -+ return_ACPI_STATUS -+ (status); - } - - return_desc = temp_desc; -diff --git a/drivers/acpi/acpica/hwesleep.c b/drivers/acpi/acpica/hwesleep.c -index aa502ae3b6b31..de0a59878e52d 100644 ---- a/drivers/acpi/acpica/hwesleep.c -+++ b/drivers/acpi/acpica/hwesleep.c -@@ -104,7 +104,9 @@ acpi_status acpi_hw_extended_sleep(u8 sleep_state) - - /* Flush caches, as per ACPI specification */ - -- ACPI_FLUSH_CPU_CACHE(); -+ if (sleep_state < ACPI_STATE_S4) { -+ ACPI_FLUSH_CPU_CACHE(); -+ } - - status = acpi_os_enter_sleep(sleep_state, sleep_control, 0); - if (status == AE_CTRL_TERMINATE) { -diff --git a/drivers/acpi/acpica/hwsleep.c b/drivers/acpi/acpica/hwsleep.c -index 5f7d63badbe9d..321aaad97e2f7 100644 ---- a/drivers/acpi/acpica/hwsleep.c -+++ b/drivers/acpi/acpica/hwsleep.c -@@ -110,7 +110,9 @@ acpi_status acpi_hw_legacy_sleep(u8 sleep_state) - - /* Flush caches, as per ACPI specification */ - -- ACPI_FLUSH_CPU_CACHE(); -+ if (sleep_state < ACPI_STATE_S4) { -+ ACPI_FLUSH_CPU_CACHE(); -+ } - - status = acpi_os_enter_sleep(sleep_state, pm1a_control, pm1b_control); - if (status == AE_CTRL_TERMINATE) { -diff --git a/drivers/acpi/acpica/hwxfsleep.c b/drivers/acpi/acpica/hwxfsleep.c -index 79731efbe8fe2..4e3398819718d 100644 ---- a/drivers/acpi/acpica/hwxfsleep.c -+++ b/drivers/acpi/acpica/hwxfsleep.c -@@ -162,8 +162,6 @@ acpi_status acpi_enter_sleep_state_s4bios(void) - return_ACPI_STATUS(status); - } - -- ACPI_FLUSH_CPU_CACHE(); -- - status = acpi_hw_write_port(acpi_gbl_FADT.smi_command, - (u32)acpi_gbl_FADT.s4_bios_request, 8); - -diff --git a/drivers/acpi/acpica/utdelete.c b/drivers/acpi/acpica/utdelete.c -index 72d2c0b656339..cb1750e7a6281 100644 ---- a/drivers/acpi/acpica/utdelete.c -+++ b/drivers/acpi/acpica/utdelete.c -@@ -422,6 +422,7 @@ acpi_ut_update_ref_count(union acpi_operand_object *object, u32 action) - ACPI_WARNING((AE_INFO, - "Obj %p, Reference Count is already zero, cannot decrement\n", - object)); -+ return; - } - - ACPI_DEBUG_PRINT_RAW((ACPI_DB_ALLOCATIONS, -diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c -index 6e96ed68b3379..4e0aea5f008e3 100644 ---- a/drivers/acpi/battery.c -+++ b/drivers/acpi/battery.c -@@ -65,6 +65,7 @@ static int battery_bix_broken_package; - static int battery_notification_delay_ms; - static int battery_ac_is_broken; - static int battery_check_pmic = 1; -+static int battery_quirk_notcharging; - static unsigned int cache_time = 1000; - module_param(cache_time, uint, 0644); - MODULE_PARM_DESC(cache_time, "cache time in milliseconds"); -@@ -233,6 +234,8 @@ static int acpi_battery_get_property(struct power_supply *psy, - val->intval = POWER_SUPPLY_STATUS_CHARGING; - else if (acpi_battery_is_charged(battery)) - val->intval = POWER_SUPPLY_STATUS_FULL; -+ else if (battery_quirk_notcharging) -+ val->intval = POWER_SUPPLY_STATUS_NOT_CHARGING; - else - val->intval = POWER_SUPPLY_STATUS_UNKNOWN; - break; -@@ -1337,6 +1340,12 @@ battery_do_not_check_pmic_quirk(const struct dmi_system_id *d) - return 0; - } - -+static int __init battery_quirk_not_charging(const struct dmi_system_id *d) -+{ -+ battery_quirk_notcharging = 1; -+ return 0; -+} -+ - static const struct dmi_system_id bat_dmi_table[] __initconst = { - { - /* NEC LZ750/LS */ -@@ -1381,6 +1390,19 @@ static const struct dmi_system_id bat_dmi_table[] __initconst = { - DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "Lenovo MIIX 320-10ICR"), - }, - }, -+ { -+ /* -+ * On Lenovo ThinkPads the BIOS specification defines -+ * a state when the bits for charging and discharging -+ * are both set to 0. That state is "Not Charging". -+ */ -+ .callback = battery_quirk_not_charging, -+ .ident = "Lenovo ThinkPad", -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), -+ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad"), -+ }, -+ }, - {}, - }; - -diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c -index 258a8df235cfb..e5b92958c299e 100644 ---- a/drivers/acpi/ec.c -+++ b/drivers/acpi/ec.c -@@ -167,6 +167,7 @@ struct acpi_ec_query { - struct transaction transaction; - struct work_struct work; - struct acpi_ec_query_handler *handler; -+ struct acpi_ec *ec; - }; - - static int acpi_ec_query(struct acpi_ec *ec, u8 *data); -@@ -462,6 +463,7 @@ static void acpi_ec_submit_query(struct acpi_ec *ec) - ec_dbg_evt("Command(%s) submitted/blocked", - acpi_ec_cmd_string(ACPI_EC_COMMAND_QUERY)); - ec->nr_pending_queries++; -+ ec->events_in_progress++; - queue_work(ec_wq, &ec->work); - } - } -@@ -528,7 +530,7 @@ static void acpi_ec_enable_event(struct acpi_ec *ec) - #ifdef CONFIG_PM_SLEEP - static void __acpi_ec_flush_work(void) - { -- drain_workqueue(ec_wq); /* flush ec->work */ -+ flush_workqueue(ec_wq); /* flush ec->work */ - flush_workqueue(ec_query_wq); /* flush queries */ - } - -@@ -1119,7 +1121,7 @@ void acpi_ec_remove_query_handler(struct acpi_ec *ec, u8 query_bit) - } - EXPORT_SYMBOL_GPL(acpi_ec_remove_query_handler); - --static struct acpi_ec_query *acpi_ec_create_query(u8 *pval) -+static struct acpi_ec_query *acpi_ec_create_query(struct acpi_ec *ec, u8 *pval) - { - struct acpi_ec_query *q; - struct transaction *t; -@@ -1127,11 +1129,13 @@ static struct acpi_ec_query *acpi_ec_create_query(u8 *pval) - q = kzalloc(sizeof (struct acpi_ec_query), GFP_KERNEL); - if (!q) - return NULL; -+ - INIT_WORK(&q->work, acpi_ec_event_processor); - t = &q->transaction; - t->command = ACPI_EC_COMMAND_QUERY; - t->rdata = pval; - t->rlen = 1; -+ q->ec = ec; - return q; - } - -@@ -1148,13 +1152,21 @@ static void acpi_ec_event_processor(struct work_struct *work) - { - struct acpi_ec_query *q = container_of(work, struct acpi_ec_query, work); - struct acpi_ec_query_handler *handler = q->handler; -+ struct acpi_ec *ec = q->ec; - - ec_dbg_evt("Query(0x%02x) started", handler->query_bit); -+ - if (handler->func) - handler->func(handler->data); - else if (handler->handle) - acpi_evaluate_object(handler->handle, NULL, NULL, NULL); -+ - ec_dbg_evt("Query(0x%02x) stopped", handler->query_bit); -+ -+ spin_lock_irq(&ec->lock); -+ ec->queries_in_progress--; -+ spin_unlock_irq(&ec->lock); -+ - acpi_ec_delete_query(q); - } - -@@ -1164,7 +1176,7 @@ static int acpi_ec_query(struct acpi_ec *ec, u8 *data) - int result; - struct acpi_ec_query *q; - -- q = acpi_ec_create_query(&value); -+ q = acpi_ec_create_query(ec, &value); - if (!q) - return -ENOMEM; - -@@ -1186,19 +1198,20 @@ static int acpi_ec_query(struct acpi_ec *ec, u8 *data) - } - - /* -- * It is reported that _Qxx are evaluated in a parallel way on -- * Windows: -+ * It is reported that _Qxx are evaluated in a parallel way on Windows: - * https://bugzilla.kernel.org/show_bug.cgi?id=94411 - * -- * Put this log entry before schedule_work() in order to make -- * it appearing before any other log entries occurred during the -- * work queue execution. -+ * Put this log entry before queue_work() to make it appear in the log -+ * before any other messages emitted during workqueue handling. - */ - ec_dbg_evt("Query(0x%02x) scheduled", value); -- if (!queue_work(ec_query_wq, &q->work)) { -- ec_dbg_evt("Query(0x%02x) overlapped", value); -- result = -EBUSY; -- } -+ -+ spin_lock_irq(&ec->lock); -+ -+ ec->queries_in_progress++; -+ queue_work(ec_query_wq, &q->work); -+ -+ spin_unlock_irq(&ec->lock); - - err_exit: - if (result) -@@ -1256,6 +1269,10 @@ static void acpi_ec_event_handler(struct work_struct *work) - ec_dbg_evt("Event stopped"); - - acpi_ec_check_event(ec); -+ -+ spin_lock_irqsave(&ec->lock, flags); -+ ec->events_in_progress--; -+ spin_unlock_irqrestore(&ec->lock, flags); - } - - static u32 acpi_ec_gpe_handler(acpi_handle gpe_device, -@@ -1972,6 +1989,7 @@ void acpi_ec_set_gpe_wake_mask(u8 action) - - bool acpi_ec_dispatch_gpe(void) - { -+ bool work_in_progress; - u32 ret; - - if (!first_ec) -@@ -1992,8 +2010,19 @@ bool acpi_ec_dispatch_gpe(void) - if (ret == ACPI_INTERRUPT_HANDLED) - pm_pr_dbg("EC GPE dispatched\n"); - -- /* Flush the event and query workqueues. */ -- acpi_ec_flush_work(); -+ /* Drain EC work. */ -+ do { -+ acpi_ec_flush_work(); -+ -+ pm_pr_dbg("ACPI EC work flushed\n"); -+ -+ spin_lock_irq(&first_ec->lock); -+ -+ work_in_progress = first_ec->events_in_progress + -+ first_ec->queries_in_progress > 0; -+ -+ spin_unlock_irq(&first_ec->lock); -+ } while (work_in_progress && !pm_wakeup_pending()); - - return false; - } -diff --git a/drivers/acpi/internal.h b/drivers/acpi/internal.h -index 159c422601bc4..62b6b36f3a37c 100644 ---- a/drivers/acpi/internal.h -+++ b/drivers/acpi/internal.h -@@ -183,6 +183,8 @@ struct acpi_ec { - struct work_struct work; - unsigned long timestamp; - unsigned long nr_pending_queries; -+ unsigned int events_in_progress; -+ unsigned int queries_in_progress; - bool busy_polling; - unsigned int polling_guard; - }; -diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c -index 95d119ff76b65..5d4be80ee6cb4 100644 ---- a/drivers/acpi/scan.c -+++ b/drivers/acpi/scan.c -@@ -1577,6 +1577,7 @@ static bool acpi_device_enumeration_by_parent(struct acpi_device *device) - { - struct list_head resource_list; - bool is_serial_bus_slave = false; -+ static const struct acpi_device_id ignore_serial_bus_ids[] = { - /* - * These devices have multiple I2cSerialBus resources and an i2c-client - * must be instantiated for each, each with its own i2c_device_id. -@@ -1585,11 +1586,18 @@ static bool acpi_device_enumeration_by_parent(struct acpi_device *device) - * drivers/platform/x86/i2c-multi-instantiate.c driver, which knows - * which i2c_device_id to use for each resource. - */ -- static const struct acpi_device_id i2c_multi_instantiate_ids[] = { - {"BSG1160", }, - {"BSG2150", }, - {"INT33FE", }, - {"INT3515", }, -+ /* -+ * HIDs of device with an UartSerialBusV2 resource for which userspace -+ * expects a regular tty cdev to be created (instead of the in kernel -+ * serdev) and which have a kernel driver which expects a platform_dev -+ * such as the rfkill-gpio driver. -+ */ -+ {"BCM4752", }, -+ {"LNV4752", }, - {} - }; - -@@ -1603,8 +1611,7 @@ static bool acpi_device_enumeration_by_parent(struct acpi_device *device) - fwnode_property_present(&device->fwnode, "baud"))) - return true; - -- /* Instantiate a pdev for the i2c-multi-instantiate drv to bind to */ -- if (!acpi_match_device_ids(device, i2c_multi_instantiate_ids)) -+ if (!acpi_match_device_ids(device, ignore_serial_bus_ids)) - return false; - - INIT_LIST_HEAD(&resource_list); -diff --git a/drivers/android/binder.c b/drivers/android/binder.c -index 0512af0f04646..b9fb2a9269443 100644 ---- a/drivers/android/binder.c -+++ b/drivers/android/binder.c -@@ -2660,8 +2660,8 @@ static int binder_translate_fd_array(struct binder_fd_array_object *fda, - if (!ret) - ret = binder_translate_fd(fd, offset, t, thread, - in_reply_to); -- if (ret < 0) -- return ret; -+ if (ret) -+ return ret > 0 ? -EINVAL : ret; - } - return 0; - } -diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c -index ac97a1e2e5ddc..02af4f109e59f 100644 ---- a/drivers/block/floppy.c -+++ b/drivers/block/floppy.c -@@ -1003,7 +1003,7 @@ static DECLARE_DELAYED_WORK(fd_timer, fd_timer_workfn); - static void cancel_activity(void) - { - do_floppy = NULL; -- cancel_delayed_work_sync(&fd_timer); -+ cancel_delayed_work(&fd_timer); - cancel_work_sync(&floppy_work); - } - -@@ -3112,6 +3112,8 @@ static void raw_cmd_free(struct floppy_raw_cmd **ptr) - } - } - -+#define MAX_LEN (1UL << MAX_ORDER << PAGE_SHIFT) -+ - static int raw_cmd_copyin(int cmd, void __user *param, - struct floppy_raw_cmd **rcmd) - { -@@ -3149,7 +3151,7 @@ loop: - ptr->resultcode = 0; - - if (ptr->flags & (FD_RAW_READ | FD_RAW_WRITE)) { -- if (ptr->length <= 0) -+ if (ptr->length <= 0 || ptr->length >= MAX_LEN) - return -EINVAL; - ptr->kernel_data = (char *)fd_dma_mem_alloc(ptr->length); - fallback_on_nodma_alloc(&ptr->kernel_data, ptr->length); -diff --git a/drivers/bluetooth/btmtksdio.c b/drivers/bluetooth/btmtksdio.c -index 304178be1ef40..c2eb64bcd5d5d 100644 ---- a/drivers/bluetooth/btmtksdio.c -+++ b/drivers/bluetooth/btmtksdio.c -@@ -1041,6 +1041,8 @@ static int btmtksdio_runtime_suspend(struct device *dev) - if (!bdev) - return 0; - -+ sdio_set_host_pm_flags(func, MMC_PM_KEEP_POWER); -+ - sdio_claim_host(bdev->func); - - sdio_writel(bdev->func, C_FW_OWN_REQ_SET, MTK_REG_CHLPCR, &err); -diff --git a/drivers/bluetooth/hci_bcm.c b/drivers/bluetooth/hci_bcm.c -index 94ed734c1d7eb..c6bb380806f9b 100644 ---- a/drivers/bluetooth/hci_bcm.c -+++ b/drivers/bluetooth/hci_bcm.c -@@ -1127,7 +1127,12 @@ static int bcm_probe(struct platform_device *pdev) - return -ENOMEM; - - dev->dev = &pdev->dev; -- dev->irq = platform_get_irq(pdev, 0); -+ -+ ret = platform_get_irq(pdev, 0); -+ if (ret < 0) -+ return ret; -+ -+ dev->irq = ret; - - if (has_acpi_companion(&pdev->dev)) { - ret = bcm_acpi_probe(dev); -diff --git a/drivers/char/mwave/3780i.h b/drivers/char/mwave/3780i.h -index 9ccb6b270b071..95164246afd1a 100644 ---- a/drivers/char/mwave/3780i.h -+++ b/drivers/char/mwave/3780i.h -@@ -68,7 +68,7 @@ typedef struct { - unsigned char ClockControl:1; /* RW: Clock control: 0=normal, 1=stop 3780i clocks */ - unsigned char SoftReset:1; /* RW: Soft reset 0=normal, 1=soft reset active */ - unsigned char ConfigMode:1; /* RW: Configuration mode, 0=normal, 1=config mode */ -- unsigned char Reserved:5; /* 0: Reserved */ -+ unsigned short Reserved:13; /* 0: Reserved */ - } DSP_ISA_SLAVE_CONTROL; - - -diff --git a/drivers/char/random.c b/drivers/char/random.c -index 60b39af1279a4..19bfbaf135989 100644 ---- a/drivers/char/random.c -+++ b/drivers/char/random.c -@@ -975,12 +975,14 @@ static struct crng_state *select_crng(void) - - /* - * crng_fast_load() can be called by code in the interrupt service -- * path. So we can't afford to dilly-dally. -+ * path. So we can't afford to dilly-dally. Returns the number of -+ * bytes processed from cp. - */ --static int crng_fast_load(const char *cp, size_t len) -+static size_t crng_fast_load(const char *cp, size_t len) - { - unsigned long flags; - char *p; -+ size_t ret = 0; - - if (!spin_trylock_irqsave(&primary_crng.lock, flags)) - return 0; -@@ -991,7 +993,7 @@ static int crng_fast_load(const char *cp, size_t len) - p = (unsigned char *) &primary_crng.state[4]; - while (len > 0 && crng_init_cnt < CRNG_INIT_CNT_THRESH) { - p[crng_init_cnt % CHACHA_KEY_SIZE] ^= *cp; -- cp++; crng_init_cnt++; len--; -+ cp++; crng_init_cnt++; len--; ret++; - } - spin_unlock_irqrestore(&primary_crng.lock, flags); - if (crng_init_cnt >= CRNG_INIT_CNT_THRESH) { -@@ -1000,7 +1002,7 @@ static int crng_fast_load(const char *cp, size_t len) - wake_up_interruptible(&crng_init_wait); - pr_notice("random: fast init done\n"); - } -- return 1; -+ return ret; - } - - /* -@@ -1353,7 +1355,7 @@ void add_interrupt_randomness(int irq, int irq_flags) - if (unlikely(crng_init == 0)) { - if ((fast_pool->count >= 64) && - crng_fast_load((char *) fast_pool->pool, -- sizeof(fast_pool->pool))) { -+ sizeof(fast_pool->pool)) > 0) { - fast_pool->count = 0; - fast_pool->last = now; - } -@@ -2501,8 +2503,11 @@ void add_hwgenerator_randomness(const char *buffer, size_t count, - struct entropy_store *poolp = &input_pool; - - if (unlikely(crng_init == 0)) { -- crng_fast_load(buffer, count); -- return; -+ size_t ret = crng_fast_load(buffer, count); -+ count -= ret; -+ buffer += ret; -+ if (!count || crng_init == 0) -+ return; - } - - /* Suspend writing if we're above the trickle threshold. -diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c -index 2fe26ec03552b..70f7859942287 100644 ---- a/drivers/char/tpm/tpm_tis_core.c -+++ b/drivers/char/tpm/tpm_tis_core.c -@@ -877,7 +877,15 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq, - intmask |= TPM_INTF_CMD_READY_INT | TPM_INTF_LOCALITY_CHANGE_INT | - TPM_INTF_DATA_AVAIL_INT | TPM_INTF_STS_VALID_INT; - intmask &= ~TPM_GLOBAL_INT_ENABLE; -+ -+ rc = request_locality(chip, 0); -+ if (rc < 0) { -+ rc = -ENODEV; -+ goto out_err; -+ } -+ - tpm_tis_write32(priv, TPM_INT_ENABLE(priv->locality), intmask); -+ release_locality(chip, 0); - - rc = tpm_chip_start(chip); - if (rc) -diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c -index c5486537b9284..e637bd6b295bd 100644 ---- a/drivers/clk/bcm/clk-bcm2835.c -+++ b/drivers/clk/bcm/clk-bcm2835.c -@@ -932,8 +932,7 @@ static int bcm2835_clock_is_on(struct clk_hw *hw) - - static u32 bcm2835_clock_choose_div(struct clk_hw *hw, - unsigned long rate, -- unsigned long parent_rate, -- bool round_up) -+ unsigned long parent_rate) - { - struct bcm2835_clock *clock = bcm2835_clock_from_hw(hw); - const struct bcm2835_clock_data *data = clock->data; -@@ -945,10 +944,6 @@ static u32 bcm2835_clock_choose_div(struct clk_hw *hw, - - rem = do_div(temp, rate); - div = temp; -- -- /* Round up and mask off the unused bits */ -- if (round_up && ((div & unused_frac_mask) != 0 || rem != 0)) -- div += unused_frac_mask + 1; - div &= ~unused_frac_mask; - - /* different clamping limits apply for a mash clock */ -@@ -1079,7 +1074,7 @@ static int bcm2835_clock_set_rate(struct clk_hw *hw, - struct bcm2835_clock *clock = bcm2835_clock_from_hw(hw); - struct bcm2835_cprman *cprman = clock->cprman; - const struct bcm2835_clock_data *data = clock->data; -- u32 div = bcm2835_clock_choose_div(hw, rate, parent_rate, false); -+ u32 div = bcm2835_clock_choose_div(hw, rate, parent_rate); - u32 ctl; - - spin_lock(&cprman->regs_lock); -@@ -1130,7 +1125,7 @@ static unsigned long bcm2835_clock_choose_div_and_prate(struct clk_hw *hw, - - if (!(BIT(parent_idx) & data->set_rate_parent)) { - *prate = clk_hw_get_rate(parent); -- *div = bcm2835_clock_choose_div(hw, rate, *prate, true); -+ *div = bcm2835_clock_choose_div(hw, rate, *prate); - - *avgrate = bcm2835_clock_rate_from_divisor(clock, *prate, *div); - -@@ -1216,7 +1211,7 @@ static int bcm2835_clock_determine_rate(struct clk_hw *hw, - rate = bcm2835_clock_choose_div_and_prate(hw, i, req->rate, - &div, &prate, - &avgrate); -- if (rate > best_rate && rate <= req->rate) { -+ if (abs(req->rate - rate) < abs(req->rate - best_rate)) { - best_parent = parent; - best_prate = prate; - best_rate = rate; -diff --git a/drivers/clk/clk-si5341.c b/drivers/clk/clk-si5341.c -index 8f9f3d4a54fd2..20ed0955416a3 100644 ---- a/drivers/clk/clk-si5341.c -+++ b/drivers/clk/clk-si5341.c -@@ -1303,7 +1303,7 @@ static int si5341_probe(struct i2c_client *client, - clk_prepare(data->clk[i].hw.clk); - } - -- err = of_clk_add_hw_provider(client->dev.of_node, of_clk_si5341_get, -+ err = devm_of_clk_add_hw_provider(&client->dev, of_clk_si5341_get, - data); - if (err) { - dev_err(&client->dev, "unable to add clk provider\n"); -diff --git a/drivers/clk/clk-stm32f4.c b/drivers/clk/clk-stm32f4.c -index 5c75e3d906c20..682a18b392f08 100644 ---- a/drivers/clk/clk-stm32f4.c -+++ b/drivers/clk/clk-stm32f4.c -@@ -129,7 +129,6 @@ static const struct stm32f4_gate_data stm32f429_gates[] __initconst = { - { STM32F4_RCC_APB2ENR, 20, "spi5", "apb2_div" }, - { STM32F4_RCC_APB2ENR, 21, "spi6", "apb2_div" }, - { STM32F4_RCC_APB2ENR, 22, "sai1", "apb2_div" }, -- { STM32F4_RCC_APB2ENR, 26, "ltdc", "apb2_div" }, - }; - - static const struct stm32f4_gate_data stm32f469_gates[] __initconst = { -@@ -211,7 +210,6 @@ static const struct stm32f4_gate_data stm32f469_gates[] __initconst = { - { STM32F4_RCC_APB2ENR, 20, "spi5", "apb2_div" }, - { STM32F4_RCC_APB2ENR, 21, "spi6", "apb2_div" }, - { STM32F4_RCC_APB2ENR, 22, "sai1", "apb2_div" }, -- { STM32F4_RCC_APB2ENR, 26, "ltdc", "apb2_div" }, - }; - - static const struct stm32f4_gate_data stm32f746_gates[] __initconst = { -@@ -286,7 +284,6 @@ static const struct stm32f4_gate_data stm32f746_gates[] __initconst = { - { STM32F4_RCC_APB2ENR, 21, "spi6", "apb2_div" }, - { STM32F4_RCC_APB2ENR, 22, "sai1", "apb2_div" }, - { STM32F4_RCC_APB2ENR, 23, "sai2", "apb2_div" }, -- { STM32F4_RCC_APB2ENR, 26, "ltdc", "apb2_div" }, - }; - - static const struct stm32f4_gate_data stm32f769_gates[] __initconst = { -@@ -364,7 +361,6 @@ static const struct stm32f4_gate_data stm32f769_gates[] __initconst = { - { STM32F4_RCC_APB2ENR, 21, "spi6", "apb2_div" }, - { STM32F4_RCC_APB2ENR, 22, "sai1", "apb2_div" }, - { STM32F4_RCC_APB2ENR, 23, "sai2", "apb2_div" }, -- { STM32F4_RCC_APB2ENR, 26, "ltdc", "apb2_div" }, - { STM32F4_RCC_APB2ENR, 30, "mdio", "apb2_div" }, - }; - -diff --git a/drivers/clk/imx/clk-imx8mn.c b/drivers/clk/imx/clk-imx8mn.c -index 58b5acee38306..882b42efd2582 100644 ---- a/drivers/clk/imx/clk-imx8mn.c -+++ b/drivers/clk/imx/clk-imx8mn.c -@@ -358,9 +358,9 @@ static const char * const imx8mn_pdm_sels[] = {"osc_24m", "sys_pll2_100m", "audi - - static const char * const imx8mn_dram_core_sels[] = {"dram_pll_out", "dram_alt_root", }; - --static const char * const imx8mn_clko1_sels[] = {"osc_24m", "sys_pll1_800m", "osc_27m", -- "sys_pll1_200m", "audio_pll2_out", "vpu_pll", -- "sys_pll1_80m", }; -+static const char * const imx8mn_clko1_sels[] = {"osc_24m", "sys_pll1_800m", "dummy", -+ "sys_pll1_200m", "audio_pll2_out", "sys_pll2_500m", -+ "dummy", "sys_pll1_80m", }; - static const char * const imx8mn_clko2_sels[] = {"osc_24m", "sys_pll2_200m", "sys_pll1_400m", - "sys_pll2_166m", "sys_pll3_out", "audio_pll1_out", - "video_pll1_out", "osc_32k", }; -diff --git a/drivers/clk/meson/gxbb.c b/drivers/clk/meson/gxbb.c -index 1f9c056e684ce..e8e36ec70b27f 100644 ---- a/drivers/clk/meson/gxbb.c -+++ b/drivers/clk/meson/gxbb.c -@@ -712,6 +712,35 @@ static struct clk_regmap gxbb_mpll_prediv = { - }; - - static struct clk_regmap gxbb_mpll0_div = { -+ .data = &(struct meson_clk_mpll_data){ -+ .sdm = { -+ .reg_off = HHI_MPLL_CNTL7, -+ .shift = 0, -+ .width = 14, -+ }, -+ .sdm_en = { -+ .reg_off = HHI_MPLL_CNTL, -+ .shift = 25, -+ .width = 1, -+ }, -+ .n2 = { -+ .reg_off = HHI_MPLL_CNTL7, -+ .shift = 16, -+ .width = 9, -+ }, -+ .lock = &meson_clk_lock, -+ }, -+ .hw.init = &(struct clk_init_data){ -+ .name = "mpll0_div", -+ .ops = &meson_clk_mpll_ops, -+ .parent_hws = (const struct clk_hw *[]) { -+ &gxbb_mpll_prediv.hw -+ }, -+ .num_parents = 1, -+ }, -+}; -+ -+static struct clk_regmap gxl_mpll0_div = { - .data = &(struct meson_clk_mpll_data){ - .sdm = { - .reg_off = HHI_MPLL_CNTL7, -@@ -748,7 +777,16 @@ static struct clk_regmap gxbb_mpll0 = { - .hw.init = &(struct clk_init_data){ - .name = "mpll0", - .ops = &clk_regmap_gate_ops, -- .parent_hws = (const struct clk_hw *[]) { &gxbb_mpll0_div.hw }, -+ .parent_data = &(const struct clk_parent_data) { -+ /* -+ * Note: -+ * GXL and GXBB have different SDM_EN registers. We -+ * fallback to the global naming string mechanism so -+ * mpll0_div picks up the appropriate one. -+ */ -+ .name = "mpll0_div", -+ .index = -1, -+ }, - .num_parents = 1, - .flags = CLK_SET_RATE_PARENT, - }, -@@ -3036,7 +3074,7 @@ static struct clk_hw_onecell_data gxl_hw_onecell_data = { - [CLKID_VAPB_1] = &gxbb_vapb_1.hw, - [CLKID_VAPB_SEL] = &gxbb_vapb_sel.hw, - [CLKID_VAPB] = &gxbb_vapb.hw, -- [CLKID_MPLL0_DIV] = &gxbb_mpll0_div.hw, -+ [CLKID_MPLL0_DIV] = &gxl_mpll0_div.hw, - [CLKID_MPLL1_DIV] = &gxbb_mpll1_div.hw, - [CLKID_MPLL2_DIV] = &gxbb_mpll2_div.hw, - [CLKID_MPLL_PREDIV] = &gxbb_mpll_prediv.hw, -@@ -3430,7 +3468,7 @@ static struct clk_regmap *const gxl_clk_regmaps[] = { - &gxbb_mpll0, - &gxbb_mpll1, - &gxbb_mpll2, -- &gxbb_mpll0_div, -+ &gxl_mpll0_div, - &gxbb_mpll1_div, - &gxbb_mpll2_div, - &gxbb_cts_amclk_div, -diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c -index cb7949a2ac0ca..af9f348048629 100644 ---- a/drivers/cpufreq/cpufreq.c -+++ b/drivers/cpufreq/cpufreq.c -@@ -1393,7 +1393,7 @@ static int cpufreq_online(unsigned int cpu) - - ret = freq_qos_add_request(&policy->constraints, - policy->min_freq_req, FREQ_QOS_MIN, -- policy->min); -+ FREQ_QOS_MIN_DEFAULT_VALUE); - if (ret < 0) { - /* - * So we don't call freq_qos_remove_request() for an -@@ -1413,7 +1413,7 @@ static int cpufreq_online(unsigned int cpu) - - ret = freq_qos_add_request(&policy->constraints, - policy->max_freq_req, FREQ_QOS_MAX, -- policy->max); -+ FREQ_QOS_MAX_DEFAULT_VALUE); - if (ret < 0) { - policy->max_freq_req = NULL; - goto out_destroy_policy; -diff --git a/drivers/crypto/caam/caamalg_qi2.c b/drivers/crypto/caam/caamalg_qi2.c -index 6863d70976746..28692d068176f 100644 ---- a/drivers/crypto/caam/caamalg_qi2.c -+++ b/drivers/crypto/caam/caamalg_qi2.c -@@ -5421,7 +5421,7 @@ int dpaa2_caam_enqueue(struct device *dev, struct caam_request *req) - dpaa2_fd_set_len(&fd, dpaa2_fl_get_len(&req->fd_flt[1])); - dpaa2_fd_set_flc(&fd, req->flc_dma); - -- ppriv = this_cpu_ptr(priv->ppriv); -+ ppriv = raw_cpu_ptr(priv->ppriv); - for (i = 0; i < (priv->dpseci_attr.num_tx_queues << 1); i++) { - err = dpaa2_io_service_enqueue_fq(ppriv->dpio, ppriv->req_fqid, - &fd); -diff --git a/drivers/crypto/omap-aes.c b/drivers/crypto/omap-aes.c -index 72edb10181b86..41ffb088831de 100644 ---- a/drivers/crypto/omap-aes.c -+++ b/drivers/crypto/omap-aes.c -@@ -1318,7 +1318,7 @@ static int omap_aes_suspend(struct device *dev) - - static int omap_aes_resume(struct device *dev) - { -- pm_runtime_resume_and_get(dev); -+ pm_runtime_get_sync(dev); - return 0; - } - #endif -diff --git a/drivers/crypto/qce/sha.c b/drivers/crypto/qce/sha.c -index 0853e74583ade..29b0bad2507b1 100644 ---- a/drivers/crypto/qce/sha.c -+++ b/drivers/crypto/qce/sha.c -@@ -512,8 +512,8 @@ static int qce_ahash_register_one(const struct qce_ahash_def *def, - - ret = crypto_register_ahash(alg); - if (ret) { -- kfree(tmpl); - dev_err(qce->dev, "%s registration failed\n", base->cra_name); -+ kfree(tmpl); - return ret; - } - -diff --git a/drivers/crypto/stm32/stm32-crc32.c b/drivers/crypto/stm32/stm32-crc32.c -index e68b856d03b6e..fb640e0ea6140 100644 ---- a/drivers/crypto/stm32/stm32-crc32.c -+++ b/drivers/crypto/stm32/stm32-crc32.c -@@ -230,7 +230,7 @@ static struct shash_alg algs[] = { - .digestsize = CHKSUM_DIGEST_SIZE, - .base = { - .cra_name = "crc32", -- .cra_driver_name = DRIVER_NAME, -+ .cra_driver_name = "stm32-crc32-crc32", - .cra_priority = 200, - .cra_flags = CRYPTO_ALG_OPTIONAL_KEY, - .cra_blocksize = CHKSUM_BLOCK_SIZE, -@@ -252,7 +252,7 @@ static struct shash_alg algs[] = { - .digestsize = CHKSUM_DIGEST_SIZE, - .base = { - .cra_name = "crc32c", -- .cra_driver_name = DRIVER_NAME, -+ .cra_driver_name = "stm32-crc32-crc32c", - .cra_priority = 200, - .cra_flags = CRYPTO_ALG_OPTIONAL_KEY, - .cra_blocksize = CHKSUM_BLOCK_SIZE, -diff --git a/drivers/crypto/stm32/stm32-cryp.c b/drivers/crypto/stm32/stm32-cryp.c -index 9b3511236ba25..69c2468f1053d 100644 ---- a/drivers/crypto/stm32/stm32-cryp.c -+++ b/drivers/crypto/stm32/stm32-cryp.c -@@ -639,7 +639,7 @@ static void stm32_cryp_finish_req(struct stm32_cryp *cryp, int err) - /* Phase 4 : output tag */ - err = stm32_cryp_read_auth_tag(cryp); - -- if (!err && (!(is_gcm(cryp) || is_ccm(cryp)))) -+ if (!err && (!(is_gcm(cryp) || is_ccm(cryp) || is_ecb(cryp)))) - stm32_cryp_get_iv(cryp); - - if (cryp->sgs_copied) { -@@ -669,8 +669,6 @@ static void stm32_cryp_finish_req(struct stm32_cryp *cryp, int err) - else - crypto_finalize_ablkcipher_request(cryp->engine, cryp->req, - err); -- -- memset(cryp->ctx->key, 0, cryp->ctx->keylen); - } - - static int stm32_cryp_cpu_start(struct stm32_cryp *cryp) -@@ -2036,8 +2034,6 @@ err_engine1: - list_del(&cryp->list); - spin_unlock(&cryp_list.lock); - -- pm_runtime_disable(dev); -- pm_runtime_put_noidle(dev); - pm_runtime_disable(dev); - pm_runtime_put_noidle(dev); - -diff --git a/drivers/dma-buf/dma-fence-array.c b/drivers/dma-buf/dma-fence-array.c -index d3fbd950be944..3e07f961e2f3d 100644 ---- a/drivers/dma-buf/dma-fence-array.c -+++ b/drivers/dma-buf/dma-fence-array.c -@@ -104,7 +104,11 @@ static bool dma_fence_array_signaled(struct dma_fence *fence) - { - struct dma_fence_array *array = to_dma_fence_array(fence); - -- return atomic_read(&array->num_pending) <= 0; -+ if (atomic_read(&array->num_pending) > 0) -+ return false; -+ -+ dma_fence_array_clear_pending_error(array); -+ return true; - } - - static void dma_fence_array_release(struct dma_fence *fence) -diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c -index 6f1e97ba3e786..f63d141481a3f 100644 ---- a/drivers/dma/at_xdmac.c -+++ b/drivers/dma/at_xdmac.c -@@ -89,6 +89,7 @@ - #define AT_XDMAC_CNDC_NDE (0x1 << 0) /* Channel x Next Descriptor Enable */ - #define AT_XDMAC_CNDC_NDSUP (0x1 << 1) /* Channel x Next Descriptor Source Update */ - #define AT_XDMAC_CNDC_NDDUP (0x1 << 2) /* Channel x Next Descriptor Destination Update */ -+#define AT_XDMAC_CNDC_NDVIEW_MASK GENMASK(28, 27) - #define AT_XDMAC_CNDC_NDVIEW_NDV0 (0x0 << 3) /* Channel x Next Descriptor View 0 */ - #define AT_XDMAC_CNDC_NDVIEW_NDV1 (0x1 << 3) /* Channel x Next Descriptor View 1 */ - #define AT_XDMAC_CNDC_NDVIEW_NDV2 (0x2 << 3) /* Channel x Next Descriptor View 2 */ -@@ -220,15 +221,15 @@ struct at_xdmac { - - /* Linked List Descriptor */ - struct at_xdmac_lld { -- dma_addr_t mbr_nda; /* Next Descriptor Member */ -- u32 mbr_ubc; /* Microblock Control Member */ -- dma_addr_t mbr_sa; /* Source Address Member */ -- dma_addr_t mbr_da; /* Destination Address Member */ -- u32 mbr_cfg; /* Configuration Register */ -- u32 mbr_bc; /* Block Control Register */ -- u32 mbr_ds; /* Data Stride Register */ -- u32 mbr_sus; /* Source Microblock Stride Register */ -- u32 mbr_dus; /* Destination Microblock Stride Register */ -+ u32 mbr_nda; /* Next Descriptor Member */ -+ u32 mbr_ubc; /* Microblock Control Member */ -+ u32 mbr_sa; /* Source Address Member */ -+ u32 mbr_da; /* Destination Address Member */ -+ u32 mbr_cfg; /* Configuration Register */ -+ u32 mbr_bc; /* Block Control Register */ -+ u32 mbr_ds; /* Data Stride Register */ -+ u32 mbr_sus; /* Source Microblock Stride Register */ -+ u32 mbr_dus; /* Destination Microblock Stride Register */ - }; - - /* 64-bit alignment needed to update CNDA and CUBC registers in an atomic way. */ -@@ -338,9 +339,6 @@ static void at_xdmac_start_xfer(struct at_xdmac_chan *atchan, - - dev_vdbg(chan2dev(&atchan->chan), "%s: desc 0x%p\n", __func__, first); - -- if (at_xdmac_chan_is_enabled(atchan)) -- return; -- - /* Set transfer as active to not try to start it again. */ - first->active_xfer = true; - -@@ -356,7 +354,8 @@ static void at_xdmac_start_xfer(struct at_xdmac_chan *atchan, - */ - if (at_xdmac_chan_is_cyclic(atchan)) - reg = AT_XDMAC_CNDC_NDVIEW_NDV1; -- else if (first->lld.mbr_ubc & AT_XDMAC_MBR_UBC_NDV3) -+ else if ((first->lld.mbr_ubc & -+ AT_XDMAC_CNDC_NDVIEW_MASK) == AT_XDMAC_MBR_UBC_NDV3) - reg = AT_XDMAC_CNDC_NDVIEW_NDV3; - else - reg = AT_XDMAC_CNDC_NDVIEW_NDV2; -@@ -427,13 +426,12 @@ static dma_cookie_t at_xdmac_tx_submit(struct dma_async_tx_descriptor *tx) - spin_lock_irqsave(&atchan->lock, irqflags); - cookie = dma_cookie_assign(tx); - -+ list_add_tail(&desc->xfer_node, &atchan->xfers_list); -+ spin_unlock_irqrestore(&atchan->lock, irqflags); -+ - dev_vdbg(chan2dev(tx->chan), "%s: atchan 0x%p, add desc 0x%p to xfers_list\n", - __func__, atchan, desc); -- list_add_tail(&desc->xfer_node, &atchan->xfers_list); -- if (list_is_singular(&atchan->xfers_list)) -- at_xdmac_start_xfer(atchan, desc); - -- spin_unlock_irqrestore(&atchan->lock, irqflags); - return cookie; - } - -@@ -1568,14 +1566,17 @@ static void at_xdmac_handle_cyclic(struct at_xdmac_chan *atchan) - struct at_xdmac_desc *desc; - struct dma_async_tx_descriptor *txd; - -- if (!list_empty(&atchan->xfers_list)) { -- desc = list_first_entry(&atchan->xfers_list, -- struct at_xdmac_desc, xfer_node); -- txd = &desc->tx_dma_desc; -- -- if (txd->flags & DMA_PREP_INTERRUPT) -- dmaengine_desc_get_callback_invoke(txd, NULL); -+ spin_lock_irq(&atchan->lock); -+ if (list_empty(&atchan->xfers_list)) { -+ spin_unlock_irq(&atchan->lock); -+ return; - } -+ desc = list_first_entry(&atchan->xfers_list, struct at_xdmac_desc, -+ xfer_node); -+ spin_unlock_irq(&atchan->lock); -+ txd = &desc->tx_dma_desc; -+ if (txd->flags & DMA_PREP_INTERRUPT) -+ dmaengine_desc_get_callback_invoke(txd, NULL); - } - - static void at_xdmac_handle_error(struct at_xdmac_chan *atchan) -diff --git a/drivers/dma/mmp_pdma.c b/drivers/dma/mmp_pdma.c -index 7fe494fc50d4e..ec186cf8b8af1 100644 ---- a/drivers/dma/mmp_pdma.c -+++ b/drivers/dma/mmp_pdma.c -@@ -728,12 +728,6 @@ static int mmp_pdma_config_write(struct dma_chan *dchan, - - chan->dir = direction; - chan->dev_addr = addr; -- /* FIXME: drivers should be ported over to use the filter -- * function. Once that's done, the following two lines can -- * be removed. -- */ -- if (cfg->slave_id) -- chan->drcmr = cfg->slave_id; - - return 0; - } -diff --git a/drivers/dma/pxa_dma.c b/drivers/dma/pxa_dma.c -index 349fb312c8725..b4ef4f19f7dec 100644 ---- a/drivers/dma/pxa_dma.c -+++ b/drivers/dma/pxa_dma.c -@@ -911,13 +911,6 @@ static void pxad_get_config(struct pxad_chan *chan, - *dcmd |= PXA_DCMD_BURST16; - else if (maxburst == 32) - *dcmd |= PXA_DCMD_BURST32; -- -- /* FIXME: drivers should be ported over to use the filter -- * function. Once that's done, the following two lines can -- * be removed. -- */ -- if (chan->cfg.slave_id) -- chan->drcmr = chan->cfg.slave_id; - } - - static struct dma_async_tx_descriptor * -diff --git a/drivers/dma/stm32-mdma.c b/drivers/dma/stm32-mdma.c -index ee1cbf3be75d5..a05355d1292e8 100644 ---- a/drivers/dma/stm32-mdma.c -+++ b/drivers/dma/stm32-mdma.c -@@ -184,7 +184,7 @@ - #define STM32_MDMA_CTBR(x) (0x68 + 0x40 * (x)) - #define STM32_MDMA_CTBR_DBUS BIT(17) - #define STM32_MDMA_CTBR_SBUS BIT(16) --#define STM32_MDMA_CTBR_TSEL_MASK GENMASK(7, 0) -+#define STM32_MDMA_CTBR_TSEL_MASK GENMASK(5, 0) - #define STM32_MDMA_CTBR_TSEL(n) STM32_MDMA_SET(n, \ - STM32_MDMA_CTBR_TSEL_MASK) - -diff --git a/drivers/edac/synopsys_edac.c b/drivers/edac/synopsys_edac.c -index 6becf3363ad57..d23a0782fb49c 100644 ---- a/drivers/edac/synopsys_edac.c -+++ b/drivers/edac/synopsys_edac.c -@@ -1351,8 +1351,7 @@ static int mc_probe(struct platform_device *pdev) - } - } - -- if (of_device_is_compatible(pdev->dev.of_node, -- "xlnx,zynqmp-ddrc-2.40a")) -+ if (priv->p_data->quirks & DDR_ECC_INTR_SUPPORT) - setup_address_map(priv); - #endif - -diff --git a/drivers/firmware/google/Kconfig b/drivers/firmware/google/Kconfig -index a3a6ca659ffa3..2fba0aa7fc54d 100644 ---- a/drivers/firmware/google/Kconfig -+++ b/drivers/firmware/google/Kconfig -@@ -3,9 +3,9 @@ menuconfig GOOGLE_FIRMWARE - bool "Google Firmware Drivers" - default n - help -- These firmware drivers are used by Google's servers. They are -- only useful if you are working directly on one of their -- proprietary servers. If in doubt, say "N". -+ These firmware drivers are used by Google servers, -+ Chromebooks and other devices using coreboot firmware. -+ If in doubt, say "N". - - if GOOGLE_FIRMWARE - -diff --git a/drivers/gpio/gpio-aspeed.c b/drivers/gpio/gpio-aspeed.c -index 2820c59b5f071..22e0d6fcab1c4 100644 ---- a/drivers/gpio/gpio-aspeed.c -+++ b/drivers/gpio/gpio-aspeed.c -@@ -53,7 +53,7 @@ struct aspeed_gpio_config { - struct aspeed_gpio { - struct gpio_chip chip; - struct irq_chip irqc; -- spinlock_t lock; -+ raw_spinlock_t lock; - void __iomem *base; - int irq; - const struct aspeed_gpio_config *config; -@@ -413,14 +413,14 @@ static void aspeed_gpio_set(struct gpio_chip *gc, unsigned int offset, - unsigned long flags; - bool copro; - -- spin_lock_irqsave(&gpio->lock, flags); -+ raw_spin_lock_irqsave(&gpio->lock, flags); - copro = aspeed_gpio_copro_request(gpio, offset); - - __aspeed_gpio_set(gc, offset, val); - - if (copro) - aspeed_gpio_copro_release(gpio, offset); -- spin_unlock_irqrestore(&gpio->lock, flags); -+ raw_spin_unlock_irqrestore(&gpio->lock, flags); - } - - static int aspeed_gpio_dir_in(struct gpio_chip *gc, unsigned int offset) -@@ -435,7 +435,7 @@ static int aspeed_gpio_dir_in(struct gpio_chip *gc, unsigned int offset) - if (!have_input(gpio, offset)) - return -ENOTSUPP; - -- spin_lock_irqsave(&gpio->lock, flags); -+ raw_spin_lock_irqsave(&gpio->lock, flags); - - reg = ioread32(addr); - reg &= ~GPIO_BIT(offset); -@@ -445,7 +445,7 @@ static int aspeed_gpio_dir_in(struct gpio_chip *gc, unsigned int offset) - if (copro) - aspeed_gpio_copro_release(gpio, offset); - -- spin_unlock_irqrestore(&gpio->lock, flags); -+ raw_spin_unlock_irqrestore(&gpio->lock, flags); - - return 0; - } -@@ -463,7 +463,7 @@ static int aspeed_gpio_dir_out(struct gpio_chip *gc, - if (!have_output(gpio, offset)) - return -ENOTSUPP; - -- spin_lock_irqsave(&gpio->lock, flags); -+ raw_spin_lock_irqsave(&gpio->lock, flags); - - reg = ioread32(addr); - reg |= GPIO_BIT(offset); -@@ -474,7 +474,7 @@ static int aspeed_gpio_dir_out(struct gpio_chip *gc, - - if (copro) - aspeed_gpio_copro_release(gpio, offset); -- spin_unlock_irqrestore(&gpio->lock, flags); -+ raw_spin_unlock_irqrestore(&gpio->lock, flags); - - return 0; - } -@@ -492,11 +492,11 @@ static int aspeed_gpio_get_direction(struct gpio_chip *gc, unsigned int offset) - if (!have_output(gpio, offset)) - return 1; - -- spin_lock_irqsave(&gpio->lock, flags); -+ raw_spin_lock_irqsave(&gpio->lock, flags); - - val = ioread32(bank_reg(gpio, bank, reg_dir)) & GPIO_BIT(offset); - -- spin_unlock_irqrestore(&gpio->lock, flags); -+ raw_spin_unlock_irqrestore(&gpio->lock, flags); - - return !val; - -@@ -540,14 +540,14 @@ static void aspeed_gpio_irq_ack(struct irq_data *d) - - status_addr = bank_reg(gpio, bank, reg_irq_status); - -- spin_lock_irqsave(&gpio->lock, flags); -+ raw_spin_lock_irqsave(&gpio->lock, flags); - copro = aspeed_gpio_copro_request(gpio, offset); - - iowrite32(bit, status_addr); - - if (copro) - aspeed_gpio_copro_release(gpio, offset); -- spin_unlock_irqrestore(&gpio->lock, flags); -+ raw_spin_unlock_irqrestore(&gpio->lock, flags); - } - - static void aspeed_gpio_irq_set_mask(struct irq_data *d, bool set) -@@ -566,7 +566,7 @@ static void aspeed_gpio_irq_set_mask(struct irq_data *d, bool set) - - addr = bank_reg(gpio, bank, reg_irq_enable); - -- spin_lock_irqsave(&gpio->lock, flags); -+ raw_spin_lock_irqsave(&gpio->lock, flags); - copro = aspeed_gpio_copro_request(gpio, offset); - - reg = ioread32(addr); -@@ -578,7 +578,7 @@ static void aspeed_gpio_irq_set_mask(struct irq_data *d, bool set) - - if (copro) - aspeed_gpio_copro_release(gpio, offset); -- spin_unlock_irqrestore(&gpio->lock, flags); -+ raw_spin_unlock_irqrestore(&gpio->lock, flags); - } - - static void aspeed_gpio_irq_mask(struct irq_data *d) -@@ -630,7 +630,7 @@ static int aspeed_gpio_set_type(struct irq_data *d, unsigned int type) - return -EINVAL; - } - -- spin_lock_irqsave(&gpio->lock, flags); -+ raw_spin_lock_irqsave(&gpio->lock, flags); - copro = aspeed_gpio_copro_request(gpio, offset); - - addr = bank_reg(gpio, bank, reg_irq_type0); -@@ -650,7 +650,7 @@ static int aspeed_gpio_set_type(struct irq_data *d, unsigned int type) - - if (copro) - aspeed_gpio_copro_release(gpio, offset); -- spin_unlock_irqrestore(&gpio->lock, flags); -+ raw_spin_unlock_irqrestore(&gpio->lock, flags); - - irq_set_handler_locked(d, handler); - -@@ -720,7 +720,7 @@ static int aspeed_gpio_reset_tolerance(struct gpio_chip *chip, - - treg = bank_reg(gpio, to_bank(offset), reg_tolerance); - -- spin_lock_irqsave(&gpio->lock, flags); -+ raw_spin_lock_irqsave(&gpio->lock, flags); - copro = aspeed_gpio_copro_request(gpio, offset); - - val = readl(treg); -@@ -734,7 +734,7 @@ static int aspeed_gpio_reset_tolerance(struct gpio_chip *chip, - - if (copro) - aspeed_gpio_copro_release(gpio, offset); -- spin_unlock_irqrestore(&gpio->lock, flags); -+ raw_spin_unlock_irqrestore(&gpio->lock, flags); - - return 0; - } -@@ -860,7 +860,7 @@ static int enable_debounce(struct gpio_chip *chip, unsigned int offset, - return rc; - } - -- spin_lock_irqsave(&gpio->lock, flags); -+ raw_spin_lock_irqsave(&gpio->lock, flags); - - if (timer_allocation_registered(gpio, offset)) { - rc = unregister_allocated_timer(gpio, offset); -@@ -920,7 +920,7 @@ static int enable_debounce(struct gpio_chip *chip, unsigned int offset, - configure_timer(gpio, offset, i); - - out: -- spin_unlock_irqrestore(&gpio->lock, flags); -+ raw_spin_unlock_irqrestore(&gpio->lock, flags); - - return rc; - } -@@ -931,13 +931,13 @@ static int disable_debounce(struct gpio_chip *chip, unsigned int offset) - unsigned long flags; - int rc; - -- spin_lock_irqsave(&gpio->lock, flags); -+ raw_spin_lock_irqsave(&gpio->lock, flags); - - rc = unregister_allocated_timer(gpio, offset); - if (!rc) - configure_timer(gpio, offset, 0); - -- spin_unlock_irqrestore(&gpio->lock, flags); -+ raw_spin_unlock_irqrestore(&gpio->lock, flags); - - return rc; - } -@@ -1019,7 +1019,7 @@ int aspeed_gpio_copro_grab_gpio(struct gpio_desc *desc, - return -EINVAL; - bindex = offset >> 3; - -- spin_lock_irqsave(&gpio->lock, flags); -+ raw_spin_lock_irqsave(&gpio->lock, flags); - - /* Sanity check, this shouldn't happen */ - if (gpio->cf_copro_bankmap[bindex] == 0xff) { -@@ -1040,7 +1040,7 @@ int aspeed_gpio_copro_grab_gpio(struct gpio_desc *desc, - if (bit) - *bit = GPIO_OFFSET(offset); - bail: -- spin_unlock_irqrestore(&gpio->lock, flags); -+ raw_spin_unlock_irqrestore(&gpio->lock, flags); - return rc; - } - EXPORT_SYMBOL_GPL(aspeed_gpio_copro_grab_gpio); -@@ -1064,7 +1064,7 @@ int aspeed_gpio_copro_release_gpio(struct gpio_desc *desc) - return -EINVAL; - bindex = offset >> 3; - -- spin_lock_irqsave(&gpio->lock, flags); -+ raw_spin_lock_irqsave(&gpio->lock, flags); - - /* Sanity check, this shouldn't happen */ - if (gpio->cf_copro_bankmap[bindex] == 0) { -@@ -1078,7 +1078,7 @@ int aspeed_gpio_copro_release_gpio(struct gpio_desc *desc) - aspeed_gpio_change_cmd_source(gpio, bank, bindex, - GPIO_CMDSRC_ARM); - bail: -- spin_unlock_irqrestore(&gpio->lock, flags); -+ raw_spin_unlock_irqrestore(&gpio->lock, flags); - return rc; - } - EXPORT_SYMBOL_GPL(aspeed_gpio_copro_release_gpio); -@@ -1151,7 +1151,7 @@ static int __init aspeed_gpio_probe(struct platform_device *pdev) - if (IS_ERR(gpio->base)) - return PTR_ERR(gpio->base); - -- spin_lock_init(&gpio->lock); -+ raw_spin_lock_init(&gpio->lock); - - gpio_id = of_match_node(aspeed_gpio_of_table, pdev->dev.of_node); - if (!gpio_id) -diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c -index e3ddc99c105d4..13c6eee481da7 100644 ---- a/drivers/gpio/gpiolib-acpi.c -+++ b/drivers/gpio/gpiolib-acpi.c -@@ -953,10 +953,17 @@ int acpi_dev_gpio_irq_get(struct acpi_device *adev, int index) - irq_flags = acpi_dev_get_irq_type(info.triggering, - info.polarity); - -- /* Set type if specified and different than the current one */ -- if (irq_flags != IRQ_TYPE_NONE && -- irq_flags != irq_get_trigger_type(irq)) -- irq_set_irq_type(irq, irq_flags); -+ /* -+ * If the IRQ is not already in use then set type -+ * if specified and different than the current one. -+ */ -+ if (can_request_irq(irq, irq_flags)) { -+ if (irq_flags != IRQ_TYPE_NONE && -+ irq_flags != irq_get_trigger_type(irq)) -+ irq_set_irq_type(irq, irq_flags); -+ } else { -+ dev_dbg(&adev->dev, "IRQ %d already in use\n", irq); -+ } - - return irq; - } -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c -index 0d39e386f6e9c..0e1cacf731698 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c -@@ -389,6 +389,9 @@ amdgpu_connector_lcd_native_mode(struct drm_encoder *encoder) - native_mode->vdisplay != 0 && - native_mode->clock != 0) { - mode = drm_mode_duplicate(dev, native_mode); -+ if (!mode) -+ return NULL; -+ - mode->type = DRM_MODE_TYPE_PREFERRED | DRM_MODE_TYPE_DRIVER; - drm_mode_set_name(mode); - -@@ -403,6 +406,9 @@ amdgpu_connector_lcd_native_mode(struct drm_encoder *encoder) - * simpler. - */ - mode = drm_cvt_mode(dev, native_mode->hdisplay, native_mode->vdisplay, 60, true, false, false); -+ if (!mode) -+ return NULL; -+ - mode->type = DRM_MODE_TYPE_PREFERRED | DRM_MODE_TYPE_DRIVER; - DRM_DEBUG_KMS("Adding cvt approximation of native panel mode %s\n", mode->name); - } -diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c -index ea764dd9245db..2975331a7b867 100644 ---- a/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c -+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c -@@ -524,10 +524,10 @@ static void gmc_v8_0_mc_program(struct amdgpu_device *adev) - static int gmc_v8_0_mc_init(struct amdgpu_device *adev) - { - int r; -+ u32 tmp; - - adev->gmc.vram_width = amdgpu_atombios_get_vram_width(adev); - if (!adev->gmc.vram_width) { -- u32 tmp; - int chansize, numchan; - - /* Get VRAM informations */ -@@ -571,8 +571,15 @@ static int gmc_v8_0_mc_init(struct amdgpu_device *adev) - adev->gmc.vram_width = numchan * chansize; - } - /* size in MB on si */ -- adev->gmc.mc_vram_size = RREG32(mmCONFIG_MEMSIZE) * 1024ULL * 1024ULL; -- adev->gmc.real_vram_size = RREG32(mmCONFIG_MEMSIZE) * 1024ULL * 1024ULL; -+ tmp = RREG32(mmCONFIG_MEMSIZE); -+ /* some boards may have garbage in the upper 16 bits */ -+ if (tmp & 0xffff0000) { -+ DRM_INFO("Probable bad vram size: 0x%08x\n", tmp); -+ if (tmp & 0xffff) -+ tmp &= 0xffff; -+ } -+ adev->gmc.mc_vram_size = tmp * 1024ULL * 1024ULL; -+ adev->gmc.real_vram_size = adev->gmc.mc_vram_size; - - if (!(adev->flags & AMD_IS_APU)) { - r = amdgpu_device_resize_fb_bar(adev); -diff --git a/drivers/gpu/drm/bridge/analogix/analogix_dp_reg.c b/drivers/gpu/drm/bridge/analogix/analogix_dp_reg.c -index 914c569ab8c15..cab3f5c4e2fc8 100644 ---- a/drivers/gpu/drm/bridge/analogix/analogix_dp_reg.c -+++ b/drivers/gpu/drm/bridge/analogix/analogix_dp_reg.c -@@ -1086,11 +1086,21 @@ int analogix_dp_send_psr_spd(struct analogix_dp_device *dp, - if (!blocking) - return 0; - -+ /* -+ * db[1]!=0: entering PSR, wait for fully active remote frame buffer. -+ * db[1]==0: exiting PSR, wait for either -+ * (a) ACTIVE_RESYNC - the sink "must display the -+ * incoming active frames from the Source device with no visible -+ * glitches and/or artifacts", even though timings may still be -+ * re-synchronizing; or -+ * (b) INACTIVE - the transition is fully complete. -+ */ - ret = readx_poll_timeout(analogix_dp_get_psr_status, dp, psr_status, - psr_status >= 0 && - ((vsc->db[1] && psr_status == DP_PSR_SINK_ACTIVE_RFB) || -- (!vsc->db[1] && psr_status == DP_PSR_SINK_INACTIVE)), 1500, -- DP_TIMEOUT_PSR_LOOP_MS * 1000); -+ (!vsc->db[1] && (psr_status == DP_PSR_SINK_ACTIVE_RESYNC || -+ psr_status == DP_PSR_SINK_INACTIVE))), -+ 1500, DP_TIMEOUT_PSR_LOOP_MS * 1000); - if (ret) { - dev_warn(dp->dev, "Failed to apply PSR %d\n", ret); - return ret; -diff --git a/drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c b/drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c -index b050fd1f3d201..5302dd90a7a5f 100644 ---- a/drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c -+++ b/drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c -@@ -291,19 +291,10 @@ out: - mutex_unlock(&ge_b850v3_lvds_dev_mutex); - } - --static int stdp4028_ge_b850v3_fw_probe(struct i2c_client *stdp4028_i2c, -- const struct i2c_device_id *id) -+static int ge_b850v3_register(void) - { -+ struct i2c_client *stdp4028_i2c = ge_b850v3_lvds_ptr->stdp4028_i2c; - struct device *dev = &stdp4028_i2c->dev; -- int ret; -- -- ret = ge_b850v3_lvds_init(dev); -- -- if (ret) -- return ret; -- -- ge_b850v3_lvds_ptr->stdp4028_i2c = stdp4028_i2c; -- i2c_set_clientdata(stdp4028_i2c, ge_b850v3_lvds_ptr); - - /* drm bridge initialization */ - ge_b850v3_lvds_ptr->bridge.funcs = &ge_b850v3_lvds_funcs; -@@ -325,6 +316,27 @@ static int stdp4028_ge_b850v3_fw_probe(struct i2c_client *stdp4028_i2c, - "ge-b850v3-lvds-dp", ge_b850v3_lvds_ptr); - } - -+static int stdp4028_ge_b850v3_fw_probe(struct i2c_client *stdp4028_i2c, -+ const struct i2c_device_id *id) -+{ -+ struct device *dev = &stdp4028_i2c->dev; -+ int ret; -+ -+ ret = ge_b850v3_lvds_init(dev); -+ -+ if (ret) -+ return ret; -+ -+ ge_b850v3_lvds_ptr->stdp4028_i2c = stdp4028_i2c; -+ i2c_set_clientdata(stdp4028_i2c, ge_b850v3_lvds_ptr); -+ -+ /* Only register after both bridges are probed */ -+ if (!ge_b850v3_lvds_ptr->stdp2690_i2c) -+ return 0; -+ -+ return ge_b850v3_register(); -+} -+ - static int stdp4028_ge_b850v3_fw_remove(struct i2c_client *stdp4028_i2c) - { - ge_b850v3_lvds_remove(); -@@ -368,7 +380,11 @@ static int stdp2690_ge_b850v3_fw_probe(struct i2c_client *stdp2690_i2c, - ge_b850v3_lvds_ptr->stdp2690_i2c = stdp2690_i2c; - i2c_set_clientdata(stdp2690_i2c, ge_b850v3_lvds_ptr); - -- return 0; -+ /* Only register after both bridges are probed */ -+ if (!ge_b850v3_lvds_ptr->stdp4028_i2c) -+ return 0; -+ -+ return ge_b850v3_register(); - } - - static int stdp2690_ge_b850v3_fw_remove(struct i2c_client *stdp2690_i2c) -diff --git a/drivers/gpu/drm/bridge/ti-sn65dsi86.c b/drivers/gpu/drm/bridge/ti-sn65dsi86.c -index f1de4bb6558ca..dbb4a374cb646 100644 ---- a/drivers/gpu/drm/bridge/ti-sn65dsi86.c -+++ b/drivers/gpu/drm/bridge/ti-sn65dsi86.c -@@ -115,6 +115,7 @@ static const struct regmap_config ti_sn_bridge_regmap_config = { - .val_bits = 8, - .volatile_table = &ti_sn_bridge_volatile_table, - .cache_type = REGCACHE_NONE, -+ .max_register = 0xFF, - }; - - static void ti_sn_bridge_write_u16(struct ti_sn_bridge *pdata, -diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c -index a950d5db211c5..9d1bd8f491ad7 100644 ---- a/drivers/gpu/drm/drm_panel_orientation_quirks.c -+++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c -@@ -248,6 +248,12 @@ static const struct dmi_system_id orientation_data[] = { - DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "Lenovo ideapad D330-10IGM"), - }, - .driver_data = (void *)&lcd1200x1920_rightside_up, -+ }, { /* Lenovo Yoga Book X90F / X91F / X91L */ -+ .matches = { -+ /* Non exact match to match all versions */ -+ DMI_MATCH(DMI_PRODUCT_NAME, "Lenovo YB1-X9"), -+ }, -+ .driver_data = (void *)&lcd1200x1920_rightside_up, - }, { /* OneGX1 Pro */ - .matches = { - DMI_EXACT_MATCH(DMI_SYS_VENDOR, "SYSTEM_MANUFACTURER"), -diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c b/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c -index 7085b08b1db42..7d155938e2916 100644 ---- a/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c -+++ b/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c -@@ -471,6 +471,12 @@ int etnaviv_ioctl_gem_submit(struct drm_device *dev, void *data, - return -EINVAL; - } - -+ if (args->stream_size > SZ_64K || args->nr_relocs > SZ_64K || -+ args->nr_bos > SZ_64K || args->nr_pmrs > 128) { -+ DRM_ERROR("submit arguments out of size limits\n"); -+ return -EINVAL; -+ } -+ - /* - * Copy the command submission and bo array to kernel space in - * one go, and do this outside of any locks. -diff --git a/drivers/gpu/drm/lima/lima_device.c b/drivers/gpu/drm/lima/lima_device.c -index d86b8d81a483a..155971c57b2d5 100644 ---- a/drivers/gpu/drm/lima/lima_device.c -+++ b/drivers/gpu/drm/lima/lima_device.c -@@ -293,6 +293,7 @@ int lima_device_init(struct lima_device *ldev) - struct resource *res; - - dma_set_coherent_mask(ldev->dev, DMA_BIT_MASK(32)); -+ dma_set_max_seg_size(ldev->dev, UINT_MAX); - - err = lima_clk_init(ldev); - if (err) -diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c -index 58b0485dc3750..72f487692adbb 100644 ---- a/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c -+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c -@@ -88,8 +88,8 @@ static int _dpu_danger_signal_status(struct seq_file *s, - &status); - } else { - seq_puts(s, "\nSafe signal status:\n"); -- if (kms->hw_mdp->ops.get_danger_status) -- kms->hw_mdp->ops.get_danger_status(kms->hw_mdp, -+ if (kms->hw_mdp->ops.get_safe_status) -+ kms->hw_mdp->ops.get_safe_status(kms->hw_mdp, - &status); - } - pm_runtime_put_sync(&kms->pdev->dev); -diff --git a/drivers/gpu/drm/nouveau/dispnv04/disp.c b/drivers/gpu/drm/nouveau/dispnv04/disp.c -index dc64863b5fd88..f517b39aba56b 100644 ---- a/drivers/gpu/drm/nouveau/dispnv04/disp.c -+++ b/drivers/gpu/drm/nouveau/dispnv04/disp.c -@@ -179,7 +179,7 @@ nv04_display_destroy(struct drm_device *dev) - nvif_notify_fini(&disp->flip); - - nouveau_display(dev)->priv = NULL; -- kfree(disp); -+ vfree(disp); - - nvif_object_unmap(&drm->client.device.object); - } -@@ -197,7 +197,7 @@ nv04_display_create(struct drm_device *dev) - struct nv04_display *disp; - int i, ret; - -- disp = kzalloc(sizeof(*disp), GFP_KERNEL); -+ disp = vzalloc(sizeof(*disp)); - if (!disp) - return -ENOMEM; - -diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/base.c b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/base.c -index ea2e11771bca5..105b4be467a3e 100644 ---- a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/base.c -+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/base.c -@@ -88,20 +88,13 @@ nvkm_pmu_fini(struct nvkm_subdev *subdev, bool suspend) - return 0; - } - --static int -+static void - nvkm_pmu_reset(struct nvkm_pmu *pmu) - { - struct nvkm_device *device = pmu->subdev.device; - - if (!pmu->func->enabled(pmu)) -- return 0; -- -- /* Inhibit interrupts, and wait for idle. */ -- nvkm_wr32(device, 0x10a014, 0x0000ffff); -- nvkm_msec(device, 2000, -- if (!nvkm_rd32(device, 0x10a04c)) -- break; -- ); -+ return; - - /* Reset. */ - if (pmu->func->reset) -@@ -112,25 +105,37 @@ nvkm_pmu_reset(struct nvkm_pmu *pmu) - if (!(nvkm_rd32(device, 0x10a10c) & 0x00000006)) - break; - ); -- -- return 0; - } - - static int - nvkm_pmu_preinit(struct nvkm_subdev *subdev) - { - struct nvkm_pmu *pmu = nvkm_pmu(subdev); -- return nvkm_pmu_reset(pmu); -+ nvkm_pmu_reset(pmu); -+ return 0; - } - - static int - nvkm_pmu_init(struct nvkm_subdev *subdev) - { - struct nvkm_pmu *pmu = nvkm_pmu(subdev); -- int ret = nvkm_pmu_reset(pmu); -- if (ret == 0 && pmu->func->init) -- ret = pmu->func->init(pmu); -- return ret; -+ struct nvkm_device *device = pmu->subdev.device; -+ -+ if (!pmu->func->init) -+ return 0; -+ -+ if (pmu->func->enabled(pmu)) { -+ /* Inhibit interrupts, and wait for idle. */ -+ nvkm_wr32(device, 0x10a014, 0x0000ffff); -+ nvkm_msec(device, 2000, -+ if (!nvkm_rd32(device, 0x10a04c)) -+ break; -+ ); -+ -+ nvkm_pmu_reset(pmu); -+ } -+ -+ return pmu->func->init(pmu); - } - - static int -diff --git a/drivers/gpu/drm/panel/panel-innolux-p079zca.c b/drivers/gpu/drm/panel/panel-innolux-p079zca.c -index d92d1c98878c1..df90b66079816 100644 ---- a/drivers/gpu/drm/panel/panel-innolux-p079zca.c -+++ b/drivers/gpu/drm/panel/panel-innolux-p079zca.c -@@ -509,6 +509,7 @@ static void innolux_panel_del(struct innolux_panel *innolux) - static int innolux_panel_probe(struct mipi_dsi_device *dsi) - { - const struct panel_desc *desc; -+ struct innolux_panel *innolux; - int err; - - desc = of_device_get_match_data(&dsi->dev); -@@ -520,7 +521,14 @@ static int innolux_panel_probe(struct mipi_dsi_device *dsi) - if (err < 0) - return err; - -- return mipi_dsi_attach(dsi); -+ err = mipi_dsi_attach(dsi); -+ if (err < 0) { -+ innolux = mipi_dsi_get_drvdata(dsi); -+ innolux_panel_del(innolux); -+ return err; -+ } -+ -+ return 0; - } - - static int innolux_panel_remove(struct mipi_dsi_device *dsi) -diff --git a/drivers/gpu/drm/panel/panel-kingdisplay-kd097d04.c b/drivers/gpu/drm/panel/panel-kingdisplay-kd097d04.c -index 3ac04eb8d0fe5..1e7fecab72a9f 100644 ---- a/drivers/gpu/drm/panel/panel-kingdisplay-kd097d04.c -+++ b/drivers/gpu/drm/panel/panel-kingdisplay-kd097d04.c -@@ -424,7 +424,13 @@ static int kingdisplay_panel_probe(struct mipi_dsi_device *dsi) - if (err < 0) - return err; - -- return mipi_dsi_attach(dsi); -+ err = mipi_dsi_attach(dsi); -+ if (err < 0) { -+ kingdisplay_panel_del(kingdisplay); -+ return err; -+ } -+ -+ return 0; - } - - static int kingdisplay_panel_remove(struct mipi_dsi_device *dsi) -diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c -index 03d3550ecc7cb..51db8b4f6d551 100644 ---- a/drivers/gpu/drm/radeon/radeon_kms.c -+++ b/drivers/gpu/drm/radeon/radeon_kms.c -@@ -634,6 +634,8 @@ void radeon_driver_lastclose_kms(struct drm_device *dev) - int radeon_driver_open_kms(struct drm_device *dev, struct drm_file *file_priv) - { - struct radeon_device *rdev = dev->dev_private; -+ struct radeon_fpriv *fpriv; -+ struct radeon_vm *vm; - int r; - - file_priv->driver_priv = NULL; -@@ -646,48 +648,52 @@ int radeon_driver_open_kms(struct drm_device *dev, struct drm_file *file_priv) - - /* new gpu have virtual address space support */ - if (rdev->family >= CHIP_CAYMAN) { -- struct radeon_fpriv *fpriv; -- struct radeon_vm *vm; - - fpriv = kzalloc(sizeof(*fpriv), GFP_KERNEL); - if (unlikely(!fpriv)) { - r = -ENOMEM; -- goto out_suspend; -+ goto err_suspend; - } - - if (rdev->accel_working) { - vm = &fpriv->vm; - r = radeon_vm_init(rdev, vm); -- if (r) { -- kfree(fpriv); -- goto out_suspend; -- } -+ if (r) -+ goto err_fpriv; - - r = radeon_bo_reserve(rdev->ring_tmp_bo.bo, false); -- if (r) { -- radeon_vm_fini(rdev, vm); -- kfree(fpriv); -- goto out_suspend; -- } -+ if (r) -+ goto err_vm_fini; - - /* map the ib pool buffer read only into - * virtual address space */ - vm->ib_bo_va = radeon_vm_bo_add(rdev, vm, - rdev->ring_tmp_bo.bo); -+ if (!vm->ib_bo_va) { -+ r = -ENOMEM; -+ goto err_vm_fini; -+ } -+ - r = radeon_vm_bo_set_addr(rdev, vm->ib_bo_va, - RADEON_VA_IB_OFFSET, - RADEON_VM_PAGE_READABLE | - RADEON_VM_PAGE_SNOOPED); -- if (r) { -- radeon_vm_fini(rdev, vm); -- kfree(fpriv); -- goto out_suspend; -- } -+ if (r) -+ goto err_vm_fini; - } - file_priv->driver_priv = fpriv; - } - --out_suspend: -+ pm_runtime_mark_last_busy(dev->dev); -+ pm_runtime_put_autosuspend(dev->dev); -+ return 0; -+ -+err_vm_fini: -+ radeon_vm_fini(rdev, vm); -+err_fpriv: -+ kfree(fpriv); -+ -+err_suspend: - pm_runtime_mark_last_busy(dev->dev); - pm_runtime_put_autosuspend(dev->dev); - return r; -diff --git a/drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c b/drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c -index 8dc91c2d916a8..f7191ae2266fd 100644 ---- a/drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c -+++ b/drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c -@@ -231,6 +231,8 @@ struct dw_mipi_dsi_rockchip { - struct dw_mipi_dsi *dmd; - const struct rockchip_dw_dsi_chip_data *cdata; - struct dw_mipi_dsi_plat_data pdata; -+ -+ bool dsi_bound; - }; - - struct dphy_pll_parameter_map { -@@ -625,10 +627,6 @@ static void dw_mipi_dsi_encoder_enable(struct drm_encoder *encoder) - if (mux < 0) - return; - -- pm_runtime_get_sync(dsi->dev); -- if (dsi->slave) -- pm_runtime_get_sync(dsi->slave->dev); -- - /* - * For the RK3399, the clk of grf must be enabled before writing grf - * register. And for RK3288 or other soc, this grf_clk must be NULL, -@@ -647,20 +645,10 @@ static void dw_mipi_dsi_encoder_enable(struct drm_encoder *encoder) - clk_disable_unprepare(dsi->grf_clk); - } - --static void dw_mipi_dsi_encoder_disable(struct drm_encoder *encoder) --{ -- struct dw_mipi_dsi_rockchip *dsi = to_dsi(encoder); -- -- if (dsi->slave) -- pm_runtime_put(dsi->slave->dev); -- pm_runtime_put(dsi->dev); --} -- - static const struct drm_encoder_helper_funcs - dw_mipi_dsi_encoder_helper_funcs = { - .atomic_check = dw_mipi_dsi_encoder_atomic_check, - .enable = dw_mipi_dsi_encoder_enable, -- .disable = dw_mipi_dsi_encoder_disable, - }; - - static const struct drm_encoder_funcs dw_mipi_dsi_encoder_funcs = { -@@ -795,10 +783,14 @@ static int dw_mipi_dsi_rockchip_bind(struct device *dev, - put_device(second); - } - -+ pm_runtime_get_sync(dsi->dev); -+ if (dsi->slave) -+ pm_runtime_get_sync(dsi->slave->dev); -+ - ret = clk_prepare_enable(dsi->pllref_clk); - if (ret) { - DRM_DEV_ERROR(dev, "Failed to enable pllref_clk: %d\n", ret); -- return ret; -+ goto out_pm_runtime; - } - - /* -@@ -810,7 +802,7 @@ static int dw_mipi_dsi_rockchip_bind(struct device *dev, - ret = clk_prepare_enable(dsi->grf_clk); - if (ret) { - DRM_DEV_ERROR(dsi->dev, "Failed to enable grf_clk: %d\n", ret); -- return ret; -+ goto out_pm_runtime; - } - - dw_mipi_dsi_rockchip_config(dsi); -@@ -822,16 +814,25 @@ static int dw_mipi_dsi_rockchip_bind(struct device *dev, - ret = rockchip_dsi_drm_create_encoder(dsi, drm_dev); - if (ret) { - DRM_DEV_ERROR(dev, "Failed to create drm encoder\n"); -- return ret; -+ goto out_pm_runtime; - } - - ret = dw_mipi_dsi_bind(dsi->dmd, &dsi->encoder); - if (ret) { - DRM_DEV_ERROR(dev, "Failed to bind: %d\n", ret); -- return ret; -+ goto out_pm_runtime; - } - -+ dsi->dsi_bound = true; -+ - return 0; -+ -+out_pm_runtime: -+ pm_runtime_put(dsi->dev); -+ if (dsi->slave) -+ pm_runtime_put(dsi->slave->dev); -+ -+ return ret; - } - - static void dw_mipi_dsi_rockchip_unbind(struct device *dev, -@@ -843,9 +844,15 @@ static void dw_mipi_dsi_rockchip_unbind(struct device *dev, - if (dsi->is_slave) - return; - -+ dsi->dsi_bound = false; -+ - dw_mipi_dsi_unbind(dsi->dmd); - - clk_disable_unprepare(dsi->pllref_clk); -+ -+ pm_runtime_put(dsi->dev); -+ if (dsi->slave) -+ pm_runtime_put(dsi->slave->dev); - } - - static const struct component_ops dw_mipi_dsi_rockchip_ops = { -@@ -903,6 +910,36 @@ static const struct dw_mipi_dsi_host_ops dw_mipi_dsi_rockchip_host_ops = { - .detach = dw_mipi_dsi_rockchip_host_detach, - }; - -+static int __maybe_unused dw_mipi_dsi_rockchip_resume(struct device *dev) -+{ -+ struct dw_mipi_dsi_rockchip *dsi = dev_get_drvdata(dev); -+ int ret; -+ -+ /* -+ * Re-configure DSI state, if we were previously initialized. We need -+ * to do this before rockchip_drm_drv tries to re-enable() any panels. -+ */ -+ if (dsi->dsi_bound) { -+ ret = clk_prepare_enable(dsi->grf_clk); -+ if (ret) { -+ DRM_DEV_ERROR(dsi->dev, "Failed to enable grf_clk: %d\n", ret); -+ return ret; -+ } -+ -+ dw_mipi_dsi_rockchip_config(dsi); -+ if (dsi->slave) -+ dw_mipi_dsi_rockchip_config(dsi->slave); -+ -+ clk_disable_unprepare(dsi->grf_clk); -+ } -+ -+ return 0; -+} -+ -+static const struct dev_pm_ops dw_mipi_dsi_rockchip_pm_ops = { -+ SET_LATE_SYSTEM_SLEEP_PM_OPS(NULL, dw_mipi_dsi_rockchip_resume) -+}; -+ - static int dw_mipi_dsi_rockchip_probe(struct platform_device *pdev) - { - struct device *dev = &pdev->dev; -@@ -986,14 +1023,10 @@ static int dw_mipi_dsi_rockchip_probe(struct platform_device *pdev) - if (ret != -EPROBE_DEFER) - DRM_DEV_ERROR(dev, - "Failed to probe dw_mipi_dsi: %d\n", ret); -- goto err_clkdisable; -+ return ret; - } - - return 0; -- --err_clkdisable: -- clk_disable_unprepare(dsi->pllref_clk); -- return ret; - } - - static int dw_mipi_dsi_rockchip_remove(struct platform_device *pdev) -@@ -1088,6 +1121,7 @@ struct platform_driver dw_mipi_dsi_rockchip_driver = { - .remove = dw_mipi_dsi_rockchip_remove, - .driver = { - .of_match_table = dw_mipi_dsi_rockchip_dt_ids, -+ .pm = &dw_mipi_dsi_rockchip_pm_ops, - .name = "dw-mipi-dsi-rockchip", - }, - }; -diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c -index 07df64daf7dae..efce31d035ef5 100644 ---- a/drivers/hid/hid-apple.c -+++ b/drivers/hid/hid-apple.c -@@ -389,7 +389,7 @@ static int apple_input_configured(struct hid_device *hdev, - - if ((asc->quirks & APPLE_HAS_FN) && !asc->fn_found) { - hid_info(hdev, "Fn key not found (Apple Wireless Keyboard clone?), disabling Fn key handling\n"); -- asc->quirks = 0; -+ asc->quirks &= ~APPLE_HAS_FN; - } - - return 0; -diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c -index ea4c97f5b0736..749558aa27e78 100644 ---- a/drivers/hid/hid-input.c -+++ b/drivers/hid/hid-input.c -@@ -1288,6 +1288,12 @@ void hidinput_hid_event(struct hid_device *hid, struct hid_field *field, struct - - input = field->hidinput->input; - -+ if (usage->type == EV_ABS && -+ (((*quirks & HID_QUIRK_X_INVERT) && usage->code == ABS_X) || -+ ((*quirks & HID_QUIRK_Y_INVERT) && usage->code == ABS_Y))) { -+ value = field->logical_maximum - value; -+ } -+ - if (usage->hat_min < usage->hat_max || usage->hat_dir) { - int hat_dir = usage->hat_dir; - if (!hat_dir) -diff --git a/drivers/hid/hid-uclogic-params.c b/drivers/hid/hid-uclogic-params.c -index ed4ede52b017f..191aba9f6b497 100644 ---- a/drivers/hid/hid-uclogic-params.c -+++ b/drivers/hid/hid-uclogic-params.c -@@ -65,7 +65,7 @@ static int uclogic_params_get_str_desc(__u8 **pbuf, struct hid_device *hdev, - __u8 idx, size_t len) - { - int rc; -- struct usb_device *udev = hid_to_usb_dev(hdev); -+ struct usb_device *udev; - __u8 *buf = NULL; - - /* Check arguments */ -@@ -74,6 +74,8 @@ static int uclogic_params_get_str_desc(__u8 **pbuf, struct hid_device *hdev, - goto cleanup; - } - -+ udev = hid_to_usb_dev(hdev); -+ - buf = kmalloc(len, GFP_KERNEL); - if (buf == NULL) { - rc = -ENOMEM; -@@ -449,7 +451,7 @@ static int uclogic_params_frame_init_v1_buttonpad( - { - int rc; - bool found = false; -- struct usb_device *usb_dev = hid_to_usb_dev(hdev); -+ struct usb_device *usb_dev; - char *str_buf = NULL; - const size_t str_len = 16; - -@@ -459,6 +461,8 @@ static int uclogic_params_frame_init_v1_buttonpad( - goto cleanup; - } - -+ usb_dev = hid_to_usb_dev(hdev); -+ - /* - * Enable generic button mode - */ -@@ -705,9 +709,9 @@ static int uclogic_params_huion_init(struct uclogic_params *params, - struct hid_device *hdev) - { - int rc; -- struct usb_device *udev = hid_to_usb_dev(hdev); -- struct usb_interface *iface = to_usb_interface(hdev->dev.parent); -- __u8 bInterfaceNumber = iface->cur_altsetting->desc.bInterfaceNumber; -+ struct usb_device *udev; -+ struct usb_interface *iface; -+ __u8 bInterfaceNumber; - bool found; - /* The resulting parameters (noop) */ - struct uclogic_params p = {0, }; -@@ -721,6 +725,10 @@ static int uclogic_params_huion_init(struct uclogic_params *params, - goto cleanup; - } - -+ udev = hid_to_usb_dev(hdev); -+ iface = to_usb_interface(hdev->dev.parent); -+ bInterfaceNumber = iface->cur_altsetting->desc.bInterfaceNumber; -+ - /* If it's not a pen interface */ - if (bInterfaceNumber != 0) { - /* TODO: Consider marking the interface invalid */ -@@ -832,10 +840,10 @@ int uclogic_params_init(struct uclogic_params *params, - struct hid_device *hdev) - { - int rc; -- struct usb_device *udev = hid_to_usb_dev(hdev); -- __u8 bNumInterfaces = udev->config->desc.bNumInterfaces; -- struct usb_interface *iface = to_usb_interface(hdev->dev.parent); -- __u8 bInterfaceNumber = iface->cur_altsetting->desc.bInterfaceNumber; -+ struct usb_device *udev; -+ __u8 bNumInterfaces; -+ struct usb_interface *iface; -+ __u8 bInterfaceNumber; - bool found; - /* The resulting parameters (noop) */ - struct uclogic_params p = {0, }; -@@ -846,6 +854,11 @@ int uclogic_params_init(struct uclogic_params *params, - goto cleanup; - } - -+ udev = hid_to_usb_dev(hdev); -+ bNumInterfaces = udev->config->desc.bNumInterfaces; -+ iface = to_usb_interface(hdev->dev.parent); -+ bInterfaceNumber = iface->cur_altsetting->desc.bInterfaceNumber; -+ - /* - * Set replacement report descriptor if the original matches the - * specified size. Otherwise keep interface unchanged. -diff --git a/drivers/hid/uhid.c b/drivers/hid/uhid.c -index 8fe3efcb83271..fc06d8bb42e0f 100644 ---- a/drivers/hid/uhid.c -+++ b/drivers/hid/uhid.c -@@ -28,11 +28,22 @@ - - struct uhid_device { - struct mutex devlock; -+ -+ /* This flag tracks whether the HID device is usable for commands from -+ * userspace. The flag is already set before hid_add_device(), which -+ * runs in workqueue context, to allow hid_add_device() to communicate -+ * with userspace. -+ * However, if hid_add_device() fails, the flag is cleared without -+ * holding devlock. -+ * We guarantee that if @running changes from true to false while you're -+ * holding @devlock, it's still fine to access @hid. -+ */ - bool running; - - __u8 *rd_data; - uint rd_size; - -+ /* When this is NULL, userspace may use UHID_CREATE/UHID_CREATE2. */ - struct hid_device *hid; - struct uhid_event input_buf; - -@@ -63,9 +74,18 @@ static void uhid_device_add_worker(struct work_struct *work) - if (ret) { - hid_err(uhid->hid, "Cannot register HID device: error %d\n", ret); - -- hid_destroy_device(uhid->hid); -- uhid->hid = NULL; -+ /* We used to call hid_destroy_device() here, but that's really -+ * messy to get right because we have to coordinate with -+ * concurrent writes from userspace that might be in the middle -+ * of using uhid->hid. -+ * Just leave uhid->hid as-is for now, and clean it up when -+ * userspace tries to close or reinitialize the uhid instance. -+ * -+ * However, we do have to clear the ->running flag and do a -+ * wakeup to make sure userspace knows that the device is gone. -+ */ - uhid->running = false; -+ wake_up_interruptible(&uhid->report_wait); - } - } - -@@ -474,7 +494,7 @@ static int uhid_dev_create2(struct uhid_device *uhid, - void *rd_data; - int ret; - -- if (uhid->running) -+ if (uhid->hid) - return -EALREADY; - - rd_size = ev->u.create2.rd_size; -@@ -556,7 +576,7 @@ static int uhid_dev_create(struct uhid_device *uhid, - - static int uhid_dev_destroy(struct uhid_device *uhid) - { -- if (!uhid->running) -+ if (!uhid->hid) - return -EINVAL; - - uhid->running = false; -@@ -565,6 +585,7 @@ static int uhid_dev_destroy(struct uhid_device *uhid) - cancel_work_sync(&uhid->worker); - - hid_destroy_device(uhid->hid); -+ uhid->hid = NULL; - kfree(uhid->rd_data); - - return 0; -diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c -index e011839f19f89..de69ea5f5a4be 100644 ---- a/drivers/hid/wacom_wac.c -+++ b/drivers/hid/wacom_wac.c -@@ -2566,6 +2566,24 @@ static void wacom_wac_finger_slot(struct wacom_wac *wacom_wac, - } - } - -+static bool wacom_wac_slot_is_active(struct input_dev *dev, int key) -+{ -+ struct input_mt *mt = dev->mt; -+ struct input_mt_slot *s; -+ -+ if (!mt) -+ return false; -+ -+ for (s = mt->slots; s != mt->slots + mt->num_slots; s++) { -+ if (s->key == key && -+ input_mt_get_value(s, ABS_MT_TRACKING_ID) >= 0) { -+ return true; -+ } -+ } -+ -+ return false; -+} -+ - static void wacom_wac_finger_event(struct hid_device *hdev, - struct hid_field *field, struct hid_usage *usage, __s32 value) - { -@@ -2613,9 +2631,14 @@ static void wacom_wac_finger_event(struct hid_device *hdev, - } - - if (usage->usage_index + 1 == field->report_count) { -- if (equivalent_usage == wacom_wac->hid_data.last_slot_field && -- wacom_wac->hid_data.confidence) -- wacom_wac_finger_slot(wacom_wac, wacom_wac->touch_input); -+ if (equivalent_usage == wacom_wac->hid_data.last_slot_field) { -+ bool touch_removed = wacom_wac_slot_is_active(wacom_wac->touch_input, -+ wacom_wac->hid_data.id) && !wacom_wac->hid_data.tipswitch; -+ -+ if (wacom_wac->hid_data.confidence || touch_removed) { -+ wacom_wac_finger_slot(wacom_wac, wacom_wac->touch_input); -+ } -+ } - } - } - -@@ -2631,6 +2654,10 @@ static void wacom_wac_finger_pre_report(struct hid_device *hdev, - - hid_data->confidence = true; - -+ hid_data->cc_report = 0; -+ hid_data->cc_index = -1; -+ hid_data->cc_value_index = -1; -+ - for (i = 0; i < report->maxfield; i++) { - struct hid_field *field = report->field[i]; - int j; -@@ -2664,11 +2691,14 @@ static void wacom_wac_finger_pre_report(struct hid_device *hdev, - hid_data->cc_index >= 0) { - struct hid_field *field = report->field[hid_data->cc_index]; - int value = field->value[hid_data->cc_value_index]; -- if (value) -+ if (value) { - hid_data->num_expected = value; -+ hid_data->num_received = 0; -+ } - } - else { - hid_data->num_expected = wacom_wac->features.touch_max; -+ hid_data->num_received = 0; - } - } - -@@ -2692,6 +2722,7 @@ static void wacom_wac_finger_report(struct hid_device *hdev, - - input_sync(input); - wacom_wac->hid_data.num_received = 0; -+ wacom_wac->hid_data.num_expected = 0; - - /* keep touch state for pen event */ - wacom_wac->shared->touch_down = wacom_wac_finger_count_touches(wacom_wac); -diff --git a/drivers/hsi/hsi_core.c b/drivers/hsi/hsi_core.c -index a5f92e2889cb8..a330f58d45fc6 100644 ---- a/drivers/hsi/hsi_core.c -+++ b/drivers/hsi/hsi_core.c -@@ -102,6 +102,7 @@ struct hsi_client *hsi_new_client(struct hsi_port *port, - if (device_register(&cl->device) < 0) { - pr_err("hsi: failed to register client: %s\n", info->name); - put_device(&cl->device); -+ goto err; - } - - return cl; -diff --git a/drivers/i2c/busses/i2c-designware-pcidrv.c b/drivers/i2c/busses/i2c-designware-pcidrv.c -index 05b35ac33ce33..735326e5eb8cf 100644 ---- a/drivers/i2c/busses/i2c-designware-pcidrv.c -+++ b/drivers/i2c/busses/i2c-designware-pcidrv.c -@@ -37,10 +37,10 @@ enum dw_pci_ctl_id_t { - }; - - struct dw_scl_sda_cfg { -- u32 ss_hcnt; -- u32 fs_hcnt; -- u32 ss_lcnt; -- u32 fs_lcnt; -+ u16 ss_hcnt; -+ u16 fs_hcnt; -+ u16 ss_lcnt; -+ u16 fs_lcnt; - u32 sda_hold; - }; - -diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c -index a959062ded4f8..4e6d0b722ddcd 100644 ---- a/drivers/i2c/busses/i2c-i801.c -+++ b/drivers/i2c/busses/i2c-i801.c -@@ -785,6 +785,11 @@ static int i801_block_transaction(struct i801_priv *priv, - int result = 0; - unsigned char hostc; - -+ if (read_write == I2C_SMBUS_READ && command == I2C_SMBUS_BLOCK_DATA) -+ data->block[0] = I2C_SMBUS_BLOCK_MAX; -+ else if (data->block[0] < 1 || data->block[0] > I2C_SMBUS_BLOCK_MAX) -+ return -EPROTO; -+ - if (command == I2C_SMBUS_I2C_BLOCK_DATA) { - if (read_write == I2C_SMBUS_WRITE) { - /* set I2C_EN bit in configuration register */ -@@ -798,16 +803,6 @@ static int i801_block_transaction(struct i801_priv *priv, - } - } - -- if (read_write == I2C_SMBUS_WRITE -- || command == I2C_SMBUS_I2C_BLOCK_DATA) { -- if (data->block[0] < 1) -- data->block[0] = 1; -- if (data->block[0] > I2C_SMBUS_BLOCK_MAX) -- data->block[0] = I2C_SMBUS_BLOCK_MAX; -- } else { -- data->block[0] = 32; /* max for SMBus block reads */ -- } -- - /* Experience has shown that the block buffer can only be used for - SMBus (not I2C) block transactions, even though the datasheet - doesn't mention this limitation. */ -diff --git a/drivers/i2c/busses/i2c-mpc.c b/drivers/i2c/busses/i2c-mpc.c -index af349661fd769..8de8296d25831 100644 ---- a/drivers/i2c/busses/i2c-mpc.c -+++ b/drivers/i2c/busses/i2c-mpc.c -@@ -105,23 +105,30 @@ static irqreturn_t mpc_i2c_isr(int irq, void *dev_id) - /* Sometimes 9th clock pulse isn't generated, and slave doesn't release - * the bus, because it wants to send ACK. - * Following sequence of enabling/disabling and sending start/stop generates -- * the 9 pulses, so it's all OK. -+ * the 9 pulses, each with a START then ending with STOP, so it's all OK. - */ - static void mpc_i2c_fixup(struct mpc_i2c *i2c) - { - int k; -- u32 delay_val = 1000000 / i2c->real_clk + 1; -- -- if (delay_val < 2) -- delay_val = 2; -+ unsigned long flags; - - for (k = 9; k; k--) { - writeccr(i2c, 0); -- writeccr(i2c, CCR_MSTA | CCR_MTX | CCR_MEN); -+ writeb(0, i2c->base + MPC_I2C_SR); /* clear any status bits */ -+ writeccr(i2c, CCR_MEN | CCR_MSTA); /* START */ -+ readb(i2c->base + MPC_I2C_DR); /* init xfer */ -+ udelay(15); /* let it hit the bus */ -+ local_irq_save(flags); /* should not be delayed further */ -+ writeccr(i2c, CCR_MEN | CCR_MSTA | CCR_RSTA); /* delay SDA */ - readb(i2c->base + MPC_I2C_DR); -- writeccr(i2c, CCR_MEN); -- udelay(delay_val << 1); -+ if (k != 1) -+ udelay(5); -+ local_irq_restore(flags); - } -+ writeccr(i2c, CCR_MEN); /* Initiate STOP */ -+ readb(i2c->base + MPC_I2C_DR); -+ udelay(15); /* Let STOP propagate */ -+ writeccr(i2c, 0); - } - - static int i2c_wait(struct mpc_i2c *i2c, unsigned timeout, int writing) -diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c -index ec9e9598894f6..5e2b688e36fca 100644 ---- a/drivers/infiniband/core/cma.c -+++ b/drivers/infiniband/core/cma.c -@@ -820,6 +820,7 @@ static int cma_resolve_ib_dev(struct rdma_id_private *id_priv) - u16 pkey, index; - u8 p; - enum ib_port_state port_state; -+ int ret; - int i; - - cma_dev = NULL; -@@ -838,9 +839,14 @@ static int cma_resolve_ib_dev(struct rdma_id_private *id_priv) - - if (ib_get_cached_port_state(cur_dev->device, p, &port_state)) - continue; -- for (i = 0; !rdma_query_gid(cur_dev->device, -- p, i, &gid); -- i++) { -+ -+ for (i = 0; i < cur_dev->device->port_data[p].immutable.gid_tbl_len; -+ ++i) { -+ ret = rdma_query_gid(cur_dev->device, p, i, -+ &gid); -+ if (ret) -+ continue; -+ - if (!memcmp(&gid, dgid, sizeof(gid))) { - cma_dev = cur_dev; - sgid = gid; -diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c -index 256d379bba676..de66d7da1bf6e 100644 ---- a/drivers/infiniband/core/device.c -+++ b/drivers/infiniband/core/device.c -@@ -2438,7 +2438,8 @@ int ib_find_gid(struct ib_device *device, union ib_gid *gid, - ++i) { - ret = rdma_query_gid(device, port, i, &tmp_gid); - if (ret) -- return ret; -+ continue; -+ - if (!memcmp(&tmp_gid, gid, sizeof *gid)) { - *port_num = port; - if (index) -diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c -index 3ac08f47a8ce4..b3fbafbf66555 100644 ---- a/drivers/infiniband/hw/cxgb4/qp.c -+++ b/drivers/infiniband/hw/cxgb4/qp.c -@@ -2469,6 +2469,7 @@ int c4iw_ib_query_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr, - memset(attr, 0, sizeof(*attr)); - memset(init_attr, 0, sizeof(*init_attr)); - attr->qp_state = to_ib_qp_state(qhp->attr.state); -+ attr->cur_qp_state = to_ib_qp_state(qhp->attr.state); - init_attr->cap.max_send_wr = qhp->attr.sq_num_entries; - init_attr->cap.max_recv_wr = qhp->attr.rq_num_entries; - init_attr->cap.max_send_sge = qhp->attr.sq_max_sges; -diff --git a/drivers/infiniband/hw/hns/hns_roce_main.c b/drivers/infiniband/hw/hns/hns_roce_main.c -index f23a341400c06..70991649dc693 100644 ---- a/drivers/infiniband/hw/hns/hns_roce_main.c -+++ b/drivers/infiniband/hw/hns/hns_roce_main.c -@@ -279,6 +279,9 @@ static enum rdma_link_layer hns_roce_get_link_layer(struct ib_device *device, - static int hns_roce_query_pkey(struct ib_device *ib_dev, u8 port, u16 index, - u16 *pkey) - { -+ if (index > 0) -+ return -EINVAL; -+ - *pkey = PKEY_ID; - - return 0; -@@ -359,7 +362,7 @@ static int hns_roce_mmap(struct ib_ucontext *context, - return rdma_user_mmap_io(context, vma, - to_hr_ucontext(context)->uar.pfn, - PAGE_SIZE, -- pgprot_noncached(vma->vm_page_prot)); -+ pgprot_device(vma->vm_page_prot)); - - /* vm_pgoff: 1 -- TPTR */ - case 1: -diff --git a/drivers/infiniband/sw/rxe/rxe_opcode.c b/drivers/infiniband/sw/rxe/rxe_opcode.c -index 4cf11063e0b59..0f166d6d0ccb0 100644 ---- a/drivers/infiniband/sw/rxe/rxe_opcode.c -+++ b/drivers/infiniband/sw/rxe/rxe_opcode.c -@@ -137,7 +137,7 @@ struct rxe_opcode_info rxe_opcode[RXE_NUM_OPCODE] = { - } - }, - [IB_OPCODE_RC_SEND_MIDDLE] = { -- .name = "IB_OPCODE_RC_SEND_MIDDLE]", -+ .name = "IB_OPCODE_RC_SEND_MIDDLE", - .mask = RXE_PAYLOAD_MASK | RXE_REQ_MASK | RXE_SEND_MASK - | RXE_MIDDLE_MASK, - .length = RXE_BTH_BYTES, -diff --git a/drivers/iommu/io-pgtable-arm-v7s.c b/drivers/iommu/io-pgtable-arm-v7s.c -index 4cb394937700c..909be90d26662 100644 ---- a/drivers/iommu/io-pgtable-arm-v7s.c -+++ b/drivers/iommu/io-pgtable-arm-v7s.c -@@ -244,13 +244,17 @@ static void *__arm_v7s_alloc_table(int lvl, gfp_t gfp, - __GFP_ZERO | ARM_V7S_TABLE_GFP_DMA, get_order(size)); - else if (lvl == 2) - table = kmem_cache_zalloc(data->l2_tables, gfp); -+ -+ if (!table) -+ return NULL; -+ - phys = virt_to_phys(table); - if (phys != (arm_v7s_iopte)phys) { - /* Doesn't fit in PTE */ - dev_err(dev, "Page table does not fit in PTE: %pa", &phys); - goto out_free; - } -- if (table && !cfg->coherent_walk) { -+ if (!cfg->coherent_walk) { - dma = dma_map_single(dev, table, size, DMA_TO_DEVICE); - if (dma_mapping_error(dev, dma)) - goto out_free; -diff --git a/drivers/iommu/io-pgtable-arm.c b/drivers/iommu/io-pgtable-arm.c -index ca51036aa53c7..975237ca03267 100644 ---- a/drivers/iommu/io-pgtable-arm.c -+++ b/drivers/iommu/io-pgtable-arm.c -@@ -351,11 +351,12 @@ static int arm_lpae_init_pte(struct arm_lpae_io_pgtable *data, - static arm_lpae_iopte arm_lpae_install_table(arm_lpae_iopte *table, - arm_lpae_iopte *ptep, - arm_lpae_iopte curr, -- struct io_pgtable_cfg *cfg) -+ struct arm_lpae_io_pgtable *data) - { - arm_lpae_iopte old, new; -+ struct io_pgtable_cfg *cfg = &data->iop.cfg; - -- new = __pa(table) | ARM_LPAE_PTE_TYPE_TABLE; -+ new = paddr_to_iopte(__pa(table), data) | ARM_LPAE_PTE_TYPE_TABLE; - if (cfg->quirks & IO_PGTABLE_QUIRK_ARM_NS) - new |= ARM_LPAE_PTE_NSTABLE; - -@@ -406,7 +407,7 @@ static int __arm_lpae_map(struct arm_lpae_io_pgtable *data, unsigned long iova, - if (!cptep) - return -ENOMEM; - -- pte = arm_lpae_install_table(cptep, ptep, 0, cfg); -+ pte = arm_lpae_install_table(cptep, ptep, 0, data); - if (pte) - __arm_lpae_free_pages(cptep, tblsz, cfg); - } else if (!cfg->coherent_walk && !(pte & ARM_LPAE_PTE_SW_SYNC)) { -@@ -575,7 +576,7 @@ static size_t arm_lpae_split_blk_unmap(struct arm_lpae_io_pgtable *data, - __arm_lpae_init_pte(data, blk_paddr, pte, lvl, &tablep[i]); - } - -- pte = arm_lpae_install_table(tablep, ptep, blk_pte, cfg); -+ pte = arm_lpae_install_table(tablep, ptep, blk_pte, data); - if (pte != blk_pte) { - __arm_lpae_free_pages(tablep, tablesz, cfg); - /* -diff --git a/drivers/iommu/iova.c b/drivers/iommu/iova.c -index 612cbf668adf8..906582a21124d 100644 ---- a/drivers/iommu/iova.c -+++ b/drivers/iommu/iova.c -@@ -64,8 +64,7 @@ static void free_iova_flush_queue(struct iova_domain *iovad) - if (!has_iova_flush_queue(iovad)) - return; - -- if (timer_pending(&iovad->fq_timer)) -- del_timer(&iovad->fq_timer); -+ del_timer_sync(&iovad->fq_timer); - - fq_destroy_all_entries(iovad); - -diff --git a/drivers/md/persistent-data/dm-btree.c b/drivers/md/persistent-data/dm-btree.c -index 8aae0624a2971..6383afb88f319 100644 ---- a/drivers/md/persistent-data/dm-btree.c -+++ b/drivers/md/persistent-data/dm-btree.c -@@ -83,14 +83,16 @@ void inc_children(struct dm_transaction_manager *tm, struct btree_node *n, - } - - static int insert_at(size_t value_size, struct btree_node *node, unsigned index, -- uint64_t key, void *value) -- __dm_written_to_disk(value) -+ uint64_t key, void *value) -+ __dm_written_to_disk(value) - { - uint32_t nr_entries = le32_to_cpu(node->header.nr_entries); -+ uint32_t max_entries = le32_to_cpu(node->header.max_entries); - __le64 key_le = cpu_to_le64(key); - - if (index > nr_entries || -- index >= le32_to_cpu(node->header.max_entries)) { -+ index >= max_entries || -+ nr_entries >= max_entries) { - DMERR("too many entries in btree node for insert"); - __dm_unbless_for_disk(value); - return -ENOMEM; -diff --git a/drivers/md/persistent-data/dm-space-map-common.c b/drivers/md/persistent-data/dm-space-map-common.c -index a213bf11738fb..85853ab629717 100644 ---- a/drivers/md/persistent-data/dm-space-map-common.c -+++ b/drivers/md/persistent-data/dm-space-map-common.c -@@ -281,6 +281,11 @@ int sm_ll_lookup_bitmap(struct ll_disk *ll, dm_block_t b, uint32_t *result) - struct disk_index_entry ie_disk; - struct dm_block *blk; - -+ if (b >= ll->nr_blocks) { -+ DMERR_LIMIT("metadata block out of bounds"); -+ return -EINVAL; -+ } -+ - b = do_div(index, ll->entries_per_block); - r = ll->load_ie(ll, index, &ie_disk); - if (r < 0) -diff --git a/drivers/media/common/saa7146/saa7146_fops.c b/drivers/media/common/saa7146/saa7146_fops.c -index aabb830e74689..4b332ea986168 100644 ---- a/drivers/media/common/saa7146/saa7146_fops.c -+++ b/drivers/media/common/saa7146/saa7146_fops.c -@@ -525,7 +525,7 @@ int saa7146_vv_init(struct saa7146_dev* dev, struct saa7146_ext_vv *ext_vv) - ERR("out of memory. aborting.\n"); - kfree(vv); - v4l2_ctrl_handler_free(hdl); -- return -1; -+ return -ENOMEM; - } - - saa7146_video_uops.init(dev,vv); -diff --git a/drivers/media/common/videobuf2/videobuf2-dma-contig.c b/drivers/media/common/videobuf2/videobuf2-dma-contig.c -index 44cd0e530bbd3..093ebe6f279f7 100644 ---- a/drivers/media/common/videobuf2/videobuf2-dma-contig.c -+++ b/drivers/media/common/videobuf2/videobuf2-dma-contig.c -@@ -154,7 +154,7 @@ static void *vb2_dc_alloc(struct device *dev, unsigned long attrs, - buf->cookie = dma_alloc_attrs(dev, size, &buf->dma_addr, - GFP_KERNEL | gfp_flags, buf->attrs); - if (!buf->cookie) { -- dev_err(dev, "dma_alloc_coherent of size %ld failed\n", size); -+ dev_err(dev, "dma_alloc_coherent of size %lu failed\n", size); - kfree(buf); - return ERR_PTR(-ENOMEM); - } -@@ -200,9 +200,9 @@ static int vb2_dc_mmap(void *buf_priv, struct vm_area_struct *vma) - - vma->vm_ops->open(vma); - -- pr_debug("%s: mapped dma addr 0x%08lx at 0x%08lx, size %ld\n", -- __func__, (unsigned long)buf->dma_addr, vma->vm_start, -- buf->size); -+ pr_debug("%s: mapped dma addr 0x%08lx at 0x%08lx, size %lu\n", -+ __func__, (unsigned long)buf->dma_addr, vma->vm_start, -+ buf->size); - - return 0; - } -diff --git a/drivers/media/dvb-core/dmxdev.c b/drivers/media/dvb-core/dmxdev.c -index f14a872d12687..e58cb8434dafe 100644 ---- a/drivers/media/dvb-core/dmxdev.c -+++ b/drivers/media/dvb-core/dmxdev.c -@@ -1413,7 +1413,7 @@ static const struct dvb_device dvbdev_dvr = { - }; - int dvb_dmxdev_init(struct dmxdev *dmxdev, struct dvb_adapter *dvb_adapter) - { -- int i; -+ int i, ret; - - if (dmxdev->demux->open(dmxdev->demux) < 0) - return -EUSERS; -@@ -1432,14 +1432,26 @@ int dvb_dmxdev_init(struct dmxdev *dmxdev, struct dvb_adapter *dvb_adapter) - DMXDEV_STATE_FREE); - } - -- dvb_register_device(dvb_adapter, &dmxdev->dvbdev, &dvbdev_demux, dmxdev, -+ ret = dvb_register_device(dvb_adapter, &dmxdev->dvbdev, &dvbdev_demux, dmxdev, - DVB_DEVICE_DEMUX, dmxdev->filternum); -- dvb_register_device(dvb_adapter, &dmxdev->dvr_dvbdev, &dvbdev_dvr, -+ if (ret < 0) -+ goto err_register_dvbdev; -+ -+ ret = dvb_register_device(dvb_adapter, &dmxdev->dvr_dvbdev, &dvbdev_dvr, - dmxdev, DVB_DEVICE_DVR, dmxdev->filternum); -+ if (ret < 0) -+ goto err_register_dvr_dvbdev; - - dvb_ringbuffer_init(&dmxdev->dvr_buffer, NULL, 8192); - - return 0; -+ -+err_register_dvr_dvbdev: -+ dvb_unregister_device(dmxdev->dvbdev); -+err_register_dvbdev: -+ vfree(dmxdev->filter); -+ dmxdev->filter = NULL; -+ return ret; - } - - EXPORT_SYMBOL(dvb_dmxdev_init); -diff --git a/drivers/media/dvb-frontends/dib8000.c b/drivers/media/dvb-frontends/dib8000.c -index bb02354a48b81..d67f2dd997d06 100644 ---- a/drivers/media/dvb-frontends/dib8000.c -+++ b/drivers/media/dvb-frontends/dib8000.c -@@ -4473,8 +4473,10 @@ static struct dvb_frontend *dib8000_init(struct i2c_adapter *i2c_adap, u8 i2c_ad - - state->timf_default = cfg->pll->timf; - -- if (dib8000_identify(&state->i2c) == 0) -+ if (dib8000_identify(&state->i2c) == 0) { -+ kfree(fe); - goto error; -+ } - - dibx000_init_i2c_master(&state->i2c_master, DIB8000, state->i2c.adap, state->i2c.addr); - -diff --git a/drivers/media/pci/b2c2/flexcop-pci.c b/drivers/media/pci/b2c2/flexcop-pci.c -index a9d9520a94c6d..c9e6c7d663768 100644 ---- a/drivers/media/pci/b2c2/flexcop-pci.c -+++ b/drivers/media/pci/b2c2/flexcop-pci.c -@@ -185,6 +185,8 @@ static irqreturn_t flexcop_pci_isr(int irq, void *dev_id) - dma_addr_t cur_addr = - fc->read_ibi_reg(fc,dma1_008).dma_0x8.dma_cur_addr << 2; - u32 cur_pos = cur_addr - fc_pci->dma[0].dma_addr0; -+ if (cur_pos > fc_pci->dma[0].size * 2) -+ goto error; - - deb_irq("%u irq: %08x cur_addr: %llx: cur_pos: %08x, last_cur_pos: %08x ", - jiffies_to_usecs(jiffies - fc_pci->last_irq), -@@ -225,6 +227,7 @@ static irqreturn_t flexcop_pci_isr(int irq, void *dev_id) - ret = IRQ_NONE; - } - -+error: - spin_unlock_irqrestore(&fc_pci->irq_lock, flags); - return ret; - } -diff --git a/drivers/media/pci/saa7146/hexium_gemini.c b/drivers/media/pci/saa7146/hexium_gemini.c -index f962269306707..86d4e2abed82a 100644 ---- a/drivers/media/pci/saa7146/hexium_gemini.c -+++ b/drivers/media/pci/saa7146/hexium_gemini.c -@@ -284,7 +284,12 @@ static int hexium_attach(struct saa7146_dev *dev, struct saa7146_pci_extension_d - hexium_set_input(hexium, 0); - hexium->cur_input = 0; - -- saa7146_vv_init(dev, &vv_data); -+ ret = saa7146_vv_init(dev, &vv_data); -+ if (ret) { -+ i2c_del_adapter(&hexium->i2c_adapter); -+ kfree(hexium); -+ return ret; -+ } - - vv_data.vid_ops.vidioc_enum_input = vidioc_enum_input; - vv_data.vid_ops.vidioc_g_input = vidioc_g_input; -diff --git a/drivers/media/pci/saa7146/hexium_orion.c b/drivers/media/pci/saa7146/hexium_orion.c -index bf5e55348f159..31388597386aa 100644 ---- a/drivers/media/pci/saa7146/hexium_orion.c -+++ b/drivers/media/pci/saa7146/hexium_orion.c -@@ -355,10 +355,16 @@ static struct saa7146_ext_vv vv_data; - static int hexium_attach(struct saa7146_dev *dev, struct saa7146_pci_extension_data *info) - { - struct hexium *hexium = (struct hexium *) dev->ext_priv; -+ int ret; - - DEB_EE("\n"); - -- saa7146_vv_init(dev, &vv_data); -+ ret = saa7146_vv_init(dev, &vv_data); -+ if (ret) { -+ pr_err("Error in saa7146_vv_init()\n"); -+ return ret; -+ } -+ - vv_data.vid_ops.vidioc_enum_input = vidioc_enum_input; - vv_data.vid_ops.vidioc_g_input = vidioc_g_input; - vv_data.vid_ops.vidioc_s_input = vidioc_s_input; -diff --git a/drivers/media/pci/saa7146/mxb.c b/drivers/media/pci/saa7146/mxb.c -index 952ea250feda0..58fe4c1619eeb 100644 ---- a/drivers/media/pci/saa7146/mxb.c -+++ b/drivers/media/pci/saa7146/mxb.c -@@ -683,10 +683,16 @@ static struct saa7146_ext_vv vv_data; - static int mxb_attach(struct saa7146_dev *dev, struct saa7146_pci_extension_data *info) - { - struct mxb *mxb; -+ int ret; - - DEB_EE("dev:%p\n", dev); - -- saa7146_vv_init(dev, &vv_data); -+ ret = saa7146_vv_init(dev, &vv_data); -+ if (ret) { -+ ERR("Error in saa7146_vv_init()"); -+ return ret; -+ } -+ - if (mxb_probe(dev)) { - saa7146_vv_release(dev); - return -1; -diff --git a/drivers/media/platform/aspeed-video.c b/drivers/media/platform/aspeed-video.c -index 6dde49d9aa4c2..1e0867016bf37 100644 ---- a/drivers/media/platform/aspeed-video.c -+++ b/drivers/media/platform/aspeed-video.c -@@ -477,6 +477,10 @@ static void aspeed_video_enable_mode_detect(struct aspeed_video *video) - aspeed_video_update(video, VE_INTERRUPT_CTRL, 0, - VE_INTERRUPT_MODE_DETECT); - -+ /* Disable mode detect in order to re-trigger */ -+ aspeed_video_update(video, VE_SEQ_CTRL, -+ VE_SEQ_CTRL_TRIG_MODE_DET, 0); -+ - /* Trigger mode detect */ - aspeed_video_update(video, VE_SEQ_CTRL, 0, VE_SEQ_CTRL_TRIG_MODE_DET); - } -@@ -529,6 +533,8 @@ static void aspeed_video_irq_res_change(struct aspeed_video *video, ulong delay) - set_bit(VIDEO_RES_CHANGE, &video->flags); - clear_bit(VIDEO_FRAME_INPRG, &video->flags); - -+ video->v4l2_input_status = V4L2_IN_ST_NO_SIGNAL; -+ - aspeed_video_off(video); - aspeed_video_bufs_done(video, VB2_BUF_STATE_ERROR); - -@@ -764,10 +770,6 @@ static void aspeed_video_get_resolution(struct aspeed_video *video) - return; - } - -- /* Disable mode detect in order to re-trigger */ -- aspeed_video_update(video, VE_SEQ_CTRL, -- VE_SEQ_CTRL_TRIG_MODE_DET, 0); -- - aspeed_video_check_and_set_polarity(video); - - aspeed_video_enable_mode_detect(video); -@@ -1315,7 +1317,6 @@ static void aspeed_video_resolution_work(struct work_struct *work) - struct delayed_work *dwork = to_delayed_work(work); - struct aspeed_video *video = container_of(dwork, struct aspeed_video, - res_work); -- u32 input_status = video->v4l2_input_status; - - aspeed_video_on(video); - -@@ -1328,8 +1329,7 @@ static void aspeed_video_resolution_work(struct work_struct *work) - aspeed_video_get_resolution(video); - - if (video->detected_timings.width != video->active_timings.width || -- video->detected_timings.height != video->active_timings.height || -- input_status != video->v4l2_input_status) { -+ video->detected_timings.height != video->active_timings.height) { - static const struct v4l2_event ev = { - .type = V4L2_EVENT_SOURCE_CHANGE, - .u.src_change.changes = V4L2_EVENT_SRC_CH_RESOLUTION, -diff --git a/drivers/media/platform/coda/imx-vdoa.c b/drivers/media/platform/coda/imx-vdoa.c -index 8bc0d83718193..dd6e2e320264e 100644 ---- a/drivers/media/platform/coda/imx-vdoa.c -+++ b/drivers/media/platform/coda/imx-vdoa.c -@@ -287,7 +287,11 @@ static int vdoa_probe(struct platform_device *pdev) - struct resource *res; - int ret; - -- dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(32)); -+ ret = dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(32)); -+ if (ret) { -+ dev_err(&pdev->dev, "DMA enable failed\n"); -+ return ret; -+ } - - vdoa = devm_kzalloc(&pdev->dev, sizeof(*vdoa), GFP_KERNEL); - if (!vdoa) -diff --git a/drivers/media/platform/imx-pxp.c b/drivers/media/platform/imx-pxp.c -index 38d9423223025..3c36cefddec7c 100644 ---- a/drivers/media/platform/imx-pxp.c -+++ b/drivers/media/platform/imx-pxp.c -@@ -1664,6 +1664,8 @@ static int pxp_probe(struct platform_device *pdev) - if (irq < 0) - return irq; - -+ spin_lock_init(&dev->irqlock); -+ - ret = devm_request_threaded_irq(&pdev->dev, irq, NULL, pxp_irq_handler, - IRQF_ONESHOT, dev_name(&pdev->dev), dev); - if (ret < 0) { -@@ -1681,8 +1683,6 @@ static int pxp_probe(struct platform_device *pdev) - goto err_clk; - } - -- spin_lock_init(&dev->irqlock); -- - ret = v4l2_device_register(&pdev->dev, &dev->v4l2_dev); - if (ret) - goto err_clk; -diff --git a/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_drv.c b/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_drv.c -index 1d82aa2b6017c..dea0ee2cb7245 100644 ---- a/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_drv.c -+++ b/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_drv.c -@@ -209,11 +209,11 @@ static int fops_vcodec_release(struct file *file) - mtk_v4l2_debug(1, "[%d] encoder", ctx->id); - mutex_lock(&dev->dev_mutex); - -+ v4l2_m2m_ctx_release(ctx->m2m_ctx); - mtk_vcodec_enc_release(ctx); - v4l2_fh_del(&ctx->fh); - v4l2_fh_exit(&ctx->fh); - v4l2_ctrl_handler_free(&ctx->ctrl_hdl); -- v4l2_m2m_ctx_release(ctx->m2m_ctx); - - list_del_init(&ctx->list); - kfree(ctx); -diff --git a/drivers/media/platform/qcom/venus/core.c b/drivers/media/platform/qcom/venus/core.c -index bbc430a003443..7b52d3e5d3f89 100644 ---- a/drivers/media/platform/qcom/venus/core.c -+++ b/drivers/media/platform/qcom/venus/core.c -@@ -289,11 +289,11 @@ static int venus_probe(struct platform_device *pdev) - - ret = venus_firmware_init(core); - if (ret) -- goto err_runtime_disable; -+ goto err_of_depopulate; - - ret = venus_boot(core); - if (ret) -- goto err_runtime_disable; -+ goto err_firmware_deinit; - - ret = hfi_core_resume(core, true); - if (ret) -@@ -329,6 +329,10 @@ err_core_deinit: - hfi_core_deinit(core, false); - err_venus_shutdown: - venus_shutdown(core); -+err_firmware_deinit: -+ venus_firmware_deinit(core); -+err_of_depopulate: -+ of_platform_depopulate(dev); - err_runtime_disable: - pm_runtime_put_noidle(dev); - pm_runtime_set_suspended(dev); -diff --git a/drivers/media/platform/rcar-vin/rcar-csi2.c b/drivers/media/platform/rcar-vin/rcar-csi2.c -index e01f22bf826d4..db3d5d463f53e 100644 ---- a/drivers/media/platform/rcar-vin/rcar-csi2.c -+++ b/drivers/media/platform/rcar-vin/rcar-csi2.c -@@ -430,16 +430,23 @@ static int rcsi2_wait_phy_start(struct rcar_csi2 *priv) - static int rcsi2_set_phypll(struct rcar_csi2 *priv, unsigned int mbps) - { - const struct rcsi2_mbps_reg *hsfreq; -+ const struct rcsi2_mbps_reg *hsfreq_prev = NULL; - -- for (hsfreq = priv->info->hsfreqrange; hsfreq->mbps != 0; hsfreq++) -+ for (hsfreq = priv->info->hsfreqrange; hsfreq->mbps != 0; hsfreq++) { - if (hsfreq->mbps >= mbps) - break; -+ hsfreq_prev = hsfreq; -+ } - - if (!hsfreq->mbps) { - dev_err(priv->dev, "Unsupported PHY speed (%u Mbps)", mbps); - return -ERANGE; - } - -+ if (hsfreq_prev && -+ ((mbps - hsfreq_prev->mbps) <= (hsfreq->mbps - mbps))) -+ hsfreq = hsfreq_prev; -+ - rcsi2_write(priv, PHYPLL_REG, PHYPLL_HSFREQRANGE(hsfreq->reg)); - - return 0; -@@ -904,10 +911,17 @@ static int rcsi2_phtw_write_mbps(struct rcar_csi2 *priv, unsigned int mbps, - const struct rcsi2_mbps_reg *values, u16 code) - { - const struct rcsi2_mbps_reg *value; -+ const struct rcsi2_mbps_reg *prev_value = NULL; - -- for (value = values; value->mbps; value++) -+ for (value = values; value->mbps; value++) { - if (value->mbps >= mbps) - break; -+ prev_value = value; -+ } -+ -+ if (prev_value && -+ ((mbps - prev_value->mbps) <= (value->mbps - mbps))) -+ value = prev_value; - - if (!value->mbps) { - dev_err(priv->dev, "Unsupported PHY speed (%u Mbps)", mbps); -diff --git a/drivers/media/radio/si470x/radio-si470x-i2c.c b/drivers/media/radio/si470x/radio-si470x-i2c.c -index a972c0705ac79..76d39e2e87706 100644 ---- a/drivers/media/radio/si470x/radio-si470x-i2c.c -+++ b/drivers/media/radio/si470x/radio-si470x-i2c.c -@@ -368,7 +368,7 @@ static int si470x_i2c_probe(struct i2c_client *client) - if (radio->hdl.error) { - retval = radio->hdl.error; - dev_err(&client->dev, "couldn't register control\n"); -- goto err_dev; -+ goto err_all; - } - - /* video device initialization */ -@@ -463,7 +463,6 @@ static int si470x_i2c_probe(struct i2c_client *client) - return 0; - err_all: - v4l2_ctrl_handler_free(&radio->hdl); --err_dev: - v4l2_device_unregister(&radio->v4l2_dev); - err_initial: - return retval; -diff --git a/drivers/media/rc/igorplugusb.c b/drivers/media/rc/igorplugusb.c -index b981f7290c1b2..1e8276040ea5b 100644 ---- a/drivers/media/rc/igorplugusb.c -+++ b/drivers/media/rc/igorplugusb.c -@@ -64,9 +64,11 @@ static void igorplugusb_irdata(struct igorplugusb *ir, unsigned len) - if (start >= len) { - dev_err(ir->dev, "receive overflow invalid: %u", overflow); - } else { -- if (overflow > 0) -+ if (overflow > 0) { - dev_warn(ir->dev, "receive overflow, at least %u lost", - overflow); -+ ir_raw_event_reset(ir->rc); -+ } - - do { - rawir.duration = ir->buf_in[i] * 85333; -diff --git a/drivers/media/rc/mceusb.c b/drivers/media/rc/mceusb.c -index 31e56f4f34791..cfdd712e2adc3 100644 ---- a/drivers/media/rc/mceusb.c -+++ b/drivers/media/rc/mceusb.c -@@ -1430,7 +1430,7 @@ static void mceusb_gen1_init(struct mceusb_dev *ir) - */ - ret = usb_control_msg(ir->usbdev, usb_rcvctrlpipe(ir->usbdev, 0), - USB_REQ_SET_ADDRESS, USB_TYPE_VENDOR, 0, 0, -- data, USB_CTRL_MSG_SZ, HZ * 3); -+ data, USB_CTRL_MSG_SZ, 3000); - dev_dbg(dev, "set address - ret = %d", ret); - dev_dbg(dev, "set address - data[0] = %d, data[1] = %d", - data[0], data[1]); -@@ -1438,20 +1438,20 @@ static void mceusb_gen1_init(struct mceusb_dev *ir) - /* set feature: bit rate 38400 bps */ - ret = usb_control_msg(ir->usbdev, usb_sndctrlpipe(ir->usbdev, 0), - USB_REQ_SET_FEATURE, USB_TYPE_VENDOR, -- 0xc04e, 0x0000, NULL, 0, HZ * 3); -+ 0xc04e, 0x0000, NULL, 0, 3000); - - dev_dbg(dev, "set feature - ret = %d", ret); - - /* bRequest 4: set char length to 8 bits */ - ret = usb_control_msg(ir->usbdev, usb_sndctrlpipe(ir->usbdev, 0), - 4, USB_TYPE_VENDOR, -- 0x0808, 0x0000, NULL, 0, HZ * 3); -+ 0x0808, 0x0000, NULL, 0, 3000); - dev_dbg(dev, "set char length - retB = %d", ret); - - /* bRequest 2: set handshaking to use DTR/DSR */ - ret = usb_control_msg(ir->usbdev, usb_sndctrlpipe(ir->usbdev, 0), - 2, USB_TYPE_VENDOR, -- 0x0000, 0x0100, NULL, 0, HZ * 3); -+ 0x0000, 0x0100, NULL, 0, 3000); - dev_dbg(dev, "set handshake - retC = %d", ret); - - /* device resume */ -diff --git a/drivers/media/rc/redrat3.c b/drivers/media/rc/redrat3.c -index aad9526f3754d..c392276610478 100644 ---- a/drivers/media/rc/redrat3.c -+++ b/drivers/media/rc/redrat3.c -@@ -405,7 +405,7 @@ static int redrat3_send_cmd(int cmd, struct redrat3_dev *rr3) - udev = rr3->udev; - res = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0), cmd, - USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN, -- 0x0000, 0x0000, data, sizeof(u8), HZ * 10); -+ 0x0000, 0x0000, data, sizeof(u8), 10000); - - if (res < 0) { - dev_err(rr3->dev, "%s: Error sending rr3 cmd res %d, data %d", -@@ -481,7 +481,7 @@ static u32 redrat3_get_timeout(struct redrat3_dev *rr3) - pipe = usb_rcvctrlpipe(rr3->udev, 0); - ret = usb_control_msg(rr3->udev, pipe, RR3_GET_IR_PARAM, - USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN, -- RR3_IR_IO_SIG_TIMEOUT, 0, tmp, len, HZ * 5); -+ RR3_IR_IO_SIG_TIMEOUT, 0, tmp, len, 5000); - if (ret != len) - dev_warn(rr3->dev, "Failed to read timeout from hardware\n"); - else { -@@ -511,7 +511,7 @@ static int redrat3_set_timeout(struct rc_dev *rc_dev, unsigned int timeoutns) - ret = usb_control_msg(udev, usb_sndctrlpipe(udev, 0), RR3_SET_IR_PARAM, - USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT, - RR3_IR_IO_SIG_TIMEOUT, 0, timeout, sizeof(*timeout), -- HZ * 25); -+ 25000); - dev_dbg(dev, "set ir parm timeout %d ret 0x%02x\n", - be32_to_cpu(*timeout), ret); - -@@ -543,32 +543,32 @@ static void redrat3_reset(struct redrat3_dev *rr3) - *val = 0x01; - rc = usb_control_msg(udev, rxpipe, RR3_RESET, - USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN, -- RR3_CPUCS_REG_ADDR, 0, val, len, HZ * 25); -+ RR3_CPUCS_REG_ADDR, 0, val, len, 25000); - dev_dbg(dev, "reset returned 0x%02x\n", rc); - - *val = length_fuzz; - rc = usb_control_msg(udev, txpipe, RR3_SET_IR_PARAM, - USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT, -- RR3_IR_IO_LENGTH_FUZZ, 0, val, len, HZ * 25); -+ RR3_IR_IO_LENGTH_FUZZ, 0, val, len, 25000); - dev_dbg(dev, "set ir parm len fuzz %d rc 0x%02x\n", *val, rc); - - *val = (65536 - (minimum_pause * 2000)) / 256; - rc = usb_control_msg(udev, txpipe, RR3_SET_IR_PARAM, - USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT, -- RR3_IR_IO_MIN_PAUSE, 0, val, len, HZ * 25); -+ RR3_IR_IO_MIN_PAUSE, 0, val, len, 25000); - dev_dbg(dev, "set ir parm min pause %d rc 0x%02x\n", *val, rc); - - *val = periods_measure_carrier; - rc = usb_control_msg(udev, txpipe, RR3_SET_IR_PARAM, - USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT, -- RR3_IR_IO_PERIODS_MF, 0, val, len, HZ * 25); -+ RR3_IR_IO_PERIODS_MF, 0, val, len, 25000); - dev_dbg(dev, "set ir parm periods measure carrier %d rc 0x%02x", *val, - rc); - - *val = RR3_DRIVER_MAXLENS; - rc = usb_control_msg(udev, txpipe, RR3_SET_IR_PARAM, - USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT, -- RR3_IR_IO_MAX_LENGTHS, 0, val, len, HZ * 25); -+ RR3_IR_IO_MAX_LENGTHS, 0, val, len, 25000); - dev_dbg(dev, "set ir parm max lens %d rc 0x%02x\n", *val, rc); - - kfree(val); -@@ -586,7 +586,7 @@ static void redrat3_get_firmware_rev(struct redrat3_dev *rr3) - rc = usb_control_msg(rr3->udev, usb_rcvctrlpipe(rr3->udev, 0), - RR3_FW_VERSION, - USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN, -- 0, 0, buffer, RR3_FW_VERSION_LEN, HZ * 5); -+ 0, 0, buffer, RR3_FW_VERSION_LEN, 5000); - - if (rc >= 0) - dev_info(rr3->dev, "Firmware rev: %s", buffer); -@@ -826,14 +826,14 @@ static int redrat3_transmit_ir(struct rc_dev *rcdev, unsigned *txbuf, - - pipe = usb_sndbulkpipe(rr3->udev, rr3->ep_out->bEndpointAddress); - ret = usb_bulk_msg(rr3->udev, pipe, irdata, -- sendbuf_len, &ret_len, 10 * HZ); -+ sendbuf_len, &ret_len, 10000); - dev_dbg(dev, "sent %d bytes, (ret %d)\n", ret_len, ret); - - /* now tell the hardware to transmit what we sent it */ - pipe = usb_rcvctrlpipe(rr3->udev, 0); - ret = usb_control_msg(rr3->udev, pipe, RR3_TX_SEND_SIGNAL, - USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN, -- 0, 0, irdata, 2, HZ * 10); -+ 0, 0, irdata, 2, 10000); - - if (ret < 0) - dev_err(dev, "Error: control msg send failed, rc %d\n", ret); -diff --git a/drivers/media/tuners/msi001.c b/drivers/media/tuners/msi001.c -index 78e6fd600d8ef..44247049a3190 100644 ---- a/drivers/media/tuners/msi001.c -+++ b/drivers/media/tuners/msi001.c -@@ -442,6 +442,13 @@ static int msi001_probe(struct spi_device *spi) - V4L2_CID_RF_TUNER_BANDWIDTH_AUTO, 0, 1, 1, 1); - dev->bandwidth = v4l2_ctrl_new_std(&dev->hdl, &msi001_ctrl_ops, - V4L2_CID_RF_TUNER_BANDWIDTH, 200000, 8000000, 1, 200000); -+ if (dev->hdl.error) { -+ ret = dev->hdl.error; -+ dev_err(&spi->dev, "Could not initialize controls\n"); -+ /* control init failed, free handler */ -+ goto err_ctrl_handler_free; -+ } -+ - v4l2_ctrl_auto_cluster(2, &dev->bandwidth_auto, 0, false); - dev->lna_gain = v4l2_ctrl_new_std(&dev->hdl, &msi001_ctrl_ops, - V4L2_CID_RF_TUNER_LNA_GAIN, 0, 1, 1, 1); -diff --git a/drivers/media/tuners/si2157.c b/drivers/media/tuners/si2157.c -index a39e1966816bf..8db9f0eb98b52 100644 ---- a/drivers/media/tuners/si2157.c -+++ b/drivers/media/tuners/si2157.c -@@ -80,7 +80,7 @@ static int si2157_init(struct dvb_frontend *fe) - dev_dbg(&client->dev, "\n"); - - /* Try to get Xtal trim property, to verify tuner still running */ -- memcpy(cmd.args, "\x15\x00\x04\x02", 4); -+ memcpy(cmd.args, "\x15\x00\x02\x04", 4); - cmd.wlen = 4; - cmd.rlen = 4; - ret = si2157_cmd_execute(client, &cmd); -diff --git a/drivers/media/usb/b2c2/flexcop-usb.c b/drivers/media/usb/b2c2/flexcop-usb.c -index 198ddfb8d2b18..e51338d5eac0c 100644 ---- a/drivers/media/usb/b2c2/flexcop-usb.c -+++ b/drivers/media/usb/b2c2/flexcop-usb.c -@@ -87,7 +87,7 @@ static int flexcop_usb_readwrite_dw(struct flexcop_device *fc, u16 wRegOffsPCI, - 0, - fc_usb->data, - sizeof(u32), -- B2C2_WAIT_FOR_OPERATION_RDW * HZ); -+ B2C2_WAIT_FOR_OPERATION_RDW); - - if (ret != sizeof(u32)) { - err("error while %s dword from %d (%d).", read ? "reading" : -@@ -155,7 +155,7 @@ static int flexcop_usb_v8_memory_req(struct flexcop_usb *fc_usb, - wIndex, - fc_usb->data, - buflen, -- nWaitTime * HZ); -+ nWaitTime); - if (ret != buflen) - ret = -EIO; - -@@ -249,13 +249,13 @@ static int flexcop_usb_i2c_req(struct flexcop_i2c_adapter *i2c, - /* DKT 020208 - add this to support special case of DiSEqC */ - case USB_FUNC_I2C_CHECKWRITE: - pipe = B2C2_USB_CTRL_PIPE_OUT; -- nWaitTime = 2; -+ nWaitTime = 2000; - request_type |= USB_DIR_OUT; - break; - case USB_FUNC_I2C_READ: - case USB_FUNC_I2C_REPEATREAD: - pipe = B2C2_USB_CTRL_PIPE_IN; -- nWaitTime = 2; -+ nWaitTime = 2000; - request_type |= USB_DIR_IN; - break; - default: -@@ -282,7 +282,7 @@ static int flexcop_usb_i2c_req(struct flexcop_i2c_adapter *i2c, - wIndex, - fc_usb->data, - buflen, -- nWaitTime * HZ); -+ nWaitTime); - - if (ret != buflen) - ret = -EIO; -diff --git a/drivers/media/usb/b2c2/flexcop-usb.h b/drivers/media/usb/b2c2/flexcop-usb.h -index e86faa0e06ca6..3dfd25fa4750f 100644 ---- a/drivers/media/usb/b2c2/flexcop-usb.h -+++ b/drivers/media/usb/b2c2/flexcop-usb.h -@@ -91,13 +91,13 @@ typedef enum { - UTILITY_SRAM_TESTVERIFY = 0x16, - } flexcop_usb_utility_function_t; - --#define B2C2_WAIT_FOR_OPERATION_RW (1*HZ) --#define B2C2_WAIT_FOR_OPERATION_RDW (3*HZ) --#define B2C2_WAIT_FOR_OPERATION_WDW (1*HZ) -+#define B2C2_WAIT_FOR_OPERATION_RW 1000 -+#define B2C2_WAIT_FOR_OPERATION_RDW 3000 -+#define B2C2_WAIT_FOR_OPERATION_WDW 1000 - --#define B2C2_WAIT_FOR_OPERATION_V8READ (3*HZ) --#define B2C2_WAIT_FOR_OPERATION_V8WRITE (3*HZ) --#define B2C2_WAIT_FOR_OPERATION_V8FLASH (3*HZ) -+#define B2C2_WAIT_FOR_OPERATION_V8READ 3000 -+#define B2C2_WAIT_FOR_OPERATION_V8WRITE 3000 -+#define B2C2_WAIT_FOR_OPERATION_V8FLASH 3000 - - typedef enum { - V8_MEMORY_PAGE_DVB_CI = 0x20, -diff --git a/drivers/media/usb/cpia2/cpia2_usb.c b/drivers/media/usb/cpia2/cpia2_usb.c -index 76aac06f9fb8e..cba03b2864738 100644 ---- a/drivers/media/usb/cpia2/cpia2_usb.c -+++ b/drivers/media/usb/cpia2/cpia2_usb.c -@@ -550,7 +550,7 @@ static int write_packet(struct usb_device *udev, - 0, /* index */ - buf, /* buffer */ - size, -- HZ); -+ 1000); - - kfree(buf); - return ret; -@@ -582,7 +582,7 @@ static int read_packet(struct usb_device *udev, - 0, /* index */ - buf, /* buffer */ - size, -- HZ); -+ 1000); - - if (ret >= 0) - memcpy(registers, buf, size); -diff --git a/drivers/media/usb/dvb-usb/dib0700_core.c b/drivers/media/usb/dvb-usb/dib0700_core.c -index ef62dd6c5ae44..07d5e94578775 100644 ---- a/drivers/media/usb/dvb-usb/dib0700_core.c -+++ b/drivers/media/usb/dvb-usb/dib0700_core.c -@@ -616,8 +616,6 @@ int dib0700_streaming_ctrl(struct dvb_usb_adapter *adap, int onoff) - deb_info("the endpoint number (%i) is not correct, use the adapter id instead", adap->fe_adap[0].stream.props.endpoint); - if (onoff) - st->channel_state |= 1 << (adap->id); -- else -- st->channel_state |= 1 << ~(adap->id); - } else { - if (onoff) - st->channel_state |= 1 << (adap->fe_adap[0].stream.props.endpoint-2); -diff --git a/drivers/media/usb/dvb-usb/dw2102.c b/drivers/media/usb/dvb-usb/dw2102.c -index b960abd00d483..8493ebb377c4d 100644 ---- a/drivers/media/usb/dvb-usb/dw2102.c -+++ b/drivers/media/usb/dvb-usb/dw2102.c -@@ -2098,46 +2098,153 @@ static struct dvb_usb_device_properties s6x0_properties = { - } - }; - --static const struct dvb_usb_device_description d1100 = { -- "Prof 1100 USB ", -- {&dw2102_table[PROF_1100], NULL}, -- {NULL}, --}; -+static struct dvb_usb_device_properties p1100_properties = { -+ .caps = DVB_USB_IS_AN_I2C_ADAPTER, -+ .usb_ctrl = DEVICE_SPECIFIC, -+ .size_of_priv = sizeof(struct dw2102_state), -+ .firmware = P1100_FIRMWARE, -+ .no_reconnect = 1, - --static const struct dvb_usb_device_description d660 = { -- "TeVii S660 USB", -- {&dw2102_table[TEVII_S660], NULL}, -- {NULL}, --}; -+ .i2c_algo = &s6x0_i2c_algo, -+ .rc.core = { -+ .rc_interval = 150, -+ .rc_codes = RC_MAP_TBS_NEC, -+ .module_name = "dw2102", -+ .allowed_protos = RC_PROTO_BIT_NEC, -+ .rc_query = prof_rc_query, -+ }, - --static const struct dvb_usb_device_description d480_1 = { -- "TeVii S480.1 USB", -- {&dw2102_table[TEVII_S480_1], NULL}, -- {NULL}, -+ .generic_bulk_ctrl_endpoint = 0x81, -+ .num_adapters = 1, -+ .download_firmware = dw2102_load_firmware, -+ .read_mac_address = s6x0_read_mac_address, -+ .adapter = { -+ { -+ .num_frontends = 1, -+ .fe = {{ -+ .frontend_attach = stv0288_frontend_attach, -+ .stream = { -+ .type = USB_BULK, -+ .count = 8, -+ .endpoint = 0x82, -+ .u = { -+ .bulk = { -+ .buffersize = 4096, -+ } -+ } -+ }, -+ } }, -+ } -+ }, -+ .num_device_descs = 1, -+ .devices = { -+ {"Prof 1100 USB ", -+ {&dw2102_table[PROF_1100], NULL}, -+ {NULL}, -+ }, -+ } - }; - --static const struct dvb_usb_device_description d480_2 = { -- "TeVii S480.2 USB", -- {&dw2102_table[TEVII_S480_2], NULL}, -- {NULL}, --}; -+static struct dvb_usb_device_properties s660_properties = { -+ .caps = DVB_USB_IS_AN_I2C_ADAPTER, -+ .usb_ctrl = DEVICE_SPECIFIC, -+ .size_of_priv = sizeof(struct dw2102_state), -+ .firmware = S660_FIRMWARE, -+ .no_reconnect = 1, - --static const struct dvb_usb_device_description d7500 = { -- "Prof 7500 USB DVB-S2", -- {&dw2102_table[PROF_7500], NULL}, -- {NULL}, --}; -+ .i2c_algo = &s6x0_i2c_algo, -+ .rc.core = { -+ .rc_interval = 150, -+ .rc_codes = RC_MAP_TEVII_NEC, -+ .module_name = "dw2102", -+ .allowed_protos = RC_PROTO_BIT_NEC, -+ .rc_query = dw2102_rc_query, -+ }, - --static const struct dvb_usb_device_description d421 = { -- "TeVii S421 PCI", -- {&dw2102_table[TEVII_S421], NULL}, -- {NULL}, -+ .generic_bulk_ctrl_endpoint = 0x81, -+ .num_adapters = 1, -+ .download_firmware = dw2102_load_firmware, -+ .read_mac_address = s6x0_read_mac_address, -+ .adapter = { -+ { -+ .num_frontends = 1, -+ .fe = {{ -+ .frontend_attach = ds3000_frontend_attach, -+ .stream = { -+ .type = USB_BULK, -+ .count = 8, -+ .endpoint = 0x82, -+ .u = { -+ .bulk = { -+ .buffersize = 4096, -+ } -+ } -+ }, -+ } }, -+ } -+ }, -+ .num_device_descs = 3, -+ .devices = { -+ {"TeVii S660 USB", -+ {&dw2102_table[TEVII_S660], NULL}, -+ {NULL}, -+ }, -+ {"TeVii S480.1 USB", -+ {&dw2102_table[TEVII_S480_1], NULL}, -+ {NULL}, -+ }, -+ {"TeVii S480.2 USB", -+ {&dw2102_table[TEVII_S480_2], NULL}, -+ {NULL}, -+ }, -+ } - }; - --static const struct dvb_usb_device_description d632 = { -- "TeVii S632 USB", -- {&dw2102_table[TEVII_S632], NULL}, -- {NULL}, -+static struct dvb_usb_device_properties p7500_properties = { -+ .caps = DVB_USB_IS_AN_I2C_ADAPTER, -+ .usb_ctrl = DEVICE_SPECIFIC, -+ .size_of_priv = sizeof(struct dw2102_state), -+ .firmware = P7500_FIRMWARE, -+ .no_reconnect = 1, -+ -+ .i2c_algo = &s6x0_i2c_algo, -+ .rc.core = { -+ .rc_interval = 150, -+ .rc_codes = RC_MAP_TBS_NEC, -+ .module_name = "dw2102", -+ .allowed_protos = RC_PROTO_BIT_NEC, -+ .rc_query = prof_rc_query, -+ }, -+ -+ .generic_bulk_ctrl_endpoint = 0x81, -+ .num_adapters = 1, -+ .download_firmware = dw2102_load_firmware, -+ .read_mac_address = s6x0_read_mac_address, -+ .adapter = { -+ { -+ .num_frontends = 1, -+ .fe = {{ -+ .frontend_attach = prof_7500_frontend_attach, -+ .stream = { -+ .type = USB_BULK, -+ .count = 8, -+ .endpoint = 0x82, -+ .u = { -+ .bulk = { -+ .buffersize = 4096, -+ } -+ } -+ }, -+ } }, -+ } -+ }, -+ .num_device_descs = 1, -+ .devices = { -+ {"Prof 7500 USB DVB-S2", -+ {&dw2102_table[PROF_7500], NULL}, -+ {NULL}, -+ }, -+ } - }; - - static struct dvb_usb_device_properties su3000_properties = { -@@ -2209,6 +2316,59 @@ static struct dvb_usb_device_properties su3000_properties = { - } - }; - -+static struct dvb_usb_device_properties s421_properties = { -+ .caps = DVB_USB_IS_AN_I2C_ADAPTER, -+ .usb_ctrl = DEVICE_SPECIFIC, -+ .size_of_priv = sizeof(struct dw2102_state), -+ .power_ctrl = su3000_power_ctrl, -+ .num_adapters = 1, -+ .identify_state = su3000_identify_state, -+ .i2c_algo = &su3000_i2c_algo, -+ -+ .rc.core = { -+ .rc_interval = 150, -+ .rc_codes = RC_MAP_SU3000, -+ .module_name = "dw2102", -+ .allowed_protos = RC_PROTO_BIT_RC5, -+ .rc_query = su3000_rc_query, -+ }, -+ -+ .read_mac_address = su3000_read_mac_address, -+ -+ .generic_bulk_ctrl_endpoint = 0x01, -+ -+ .adapter = { -+ { -+ .num_frontends = 1, -+ .fe = {{ -+ .streaming_ctrl = su3000_streaming_ctrl, -+ .frontend_attach = m88rs2000_frontend_attach, -+ .stream = { -+ .type = USB_BULK, -+ .count = 8, -+ .endpoint = 0x82, -+ .u = { -+ .bulk = { -+ .buffersize = 4096, -+ } -+ } -+ } -+ } }, -+ } -+ }, -+ .num_device_descs = 2, -+ .devices = { -+ { "TeVii S421 PCI", -+ { &dw2102_table[TEVII_S421], NULL }, -+ { NULL }, -+ }, -+ { "TeVii S632 USB", -+ { &dw2102_table[TEVII_S632], NULL }, -+ { NULL }, -+ }, -+ } -+}; -+ - static struct dvb_usb_device_properties t220_properties = { - .caps = DVB_USB_IS_AN_I2C_ADAPTER, - .usb_ctrl = DEVICE_SPECIFIC, -@@ -2326,101 +2486,33 @@ static struct dvb_usb_device_properties tt_s2_4600_properties = { - static int dw2102_probe(struct usb_interface *intf, - const struct usb_device_id *id) - { -- int retval = -ENOMEM; -- struct dvb_usb_device_properties *p1100; -- struct dvb_usb_device_properties *s660; -- struct dvb_usb_device_properties *p7500; -- struct dvb_usb_device_properties *s421; -- -- p1100 = kmemdup(&s6x0_properties, -- sizeof(struct dvb_usb_device_properties), GFP_KERNEL); -- if (!p1100) -- goto err0; -- -- /* copy default structure */ -- /* fill only different fields */ -- p1100->firmware = P1100_FIRMWARE; -- p1100->devices[0] = d1100; -- p1100->rc.core.rc_query = prof_rc_query; -- p1100->rc.core.rc_codes = RC_MAP_TBS_NEC; -- p1100->adapter->fe[0].frontend_attach = stv0288_frontend_attach; -- -- s660 = kmemdup(&s6x0_properties, -- sizeof(struct dvb_usb_device_properties), GFP_KERNEL); -- if (!s660) -- goto err1; -- -- s660->firmware = S660_FIRMWARE; -- s660->num_device_descs = 3; -- s660->devices[0] = d660; -- s660->devices[1] = d480_1; -- s660->devices[2] = d480_2; -- s660->adapter->fe[0].frontend_attach = ds3000_frontend_attach; -- -- p7500 = kmemdup(&s6x0_properties, -- sizeof(struct dvb_usb_device_properties), GFP_KERNEL); -- if (!p7500) -- goto err2; -- -- p7500->firmware = P7500_FIRMWARE; -- p7500->devices[0] = d7500; -- p7500->rc.core.rc_query = prof_rc_query; -- p7500->rc.core.rc_codes = RC_MAP_TBS_NEC; -- p7500->adapter->fe[0].frontend_attach = prof_7500_frontend_attach; -- -- -- s421 = kmemdup(&su3000_properties, -- sizeof(struct dvb_usb_device_properties), GFP_KERNEL); -- if (!s421) -- goto err3; -- -- s421->num_device_descs = 2; -- s421->devices[0] = d421; -- s421->devices[1] = d632; -- s421->adapter->fe[0].frontend_attach = m88rs2000_frontend_attach; -- -- if (0 == dvb_usb_device_init(intf, &dw2102_properties, -- THIS_MODULE, NULL, adapter_nr) || -- 0 == dvb_usb_device_init(intf, &dw2104_properties, -- THIS_MODULE, NULL, adapter_nr) || -- 0 == dvb_usb_device_init(intf, &dw3101_properties, -- THIS_MODULE, NULL, adapter_nr) || -- 0 == dvb_usb_device_init(intf, &s6x0_properties, -- THIS_MODULE, NULL, adapter_nr) || -- 0 == dvb_usb_device_init(intf, p1100, -- THIS_MODULE, NULL, adapter_nr) || -- 0 == dvb_usb_device_init(intf, s660, -- THIS_MODULE, NULL, adapter_nr) || -- 0 == dvb_usb_device_init(intf, p7500, -- THIS_MODULE, NULL, adapter_nr) || -- 0 == dvb_usb_device_init(intf, s421, -- THIS_MODULE, NULL, adapter_nr) || -- 0 == dvb_usb_device_init(intf, &su3000_properties, -- THIS_MODULE, NULL, adapter_nr) || -- 0 == dvb_usb_device_init(intf, &t220_properties, -- THIS_MODULE, NULL, adapter_nr) || -- 0 == dvb_usb_device_init(intf, &tt_s2_4600_properties, -- THIS_MODULE, NULL, adapter_nr)) { -- -- /* clean up copied properties */ -- kfree(s421); -- kfree(p7500); -- kfree(s660); -- kfree(p1100); -+ if (!(dvb_usb_device_init(intf, &dw2102_properties, -+ THIS_MODULE, NULL, adapter_nr) && -+ dvb_usb_device_init(intf, &dw2104_properties, -+ THIS_MODULE, NULL, adapter_nr) && -+ dvb_usb_device_init(intf, &dw3101_properties, -+ THIS_MODULE, NULL, adapter_nr) && -+ dvb_usb_device_init(intf, &s6x0_properties, -+ THIS_MODULE, NULL, adapter_nr) && -+ dvb_usb_device_init(intf, &p1100_properties, -+ THIS_MODULE, NULL, adapter_nr) && -+ dvb_usb_device_init(intf, &s660_properties, -+ THIS_MODULE, NULL, adapter_nr) && -+ dvb_usb_device_init(intf, &p7500_properties, -+ THIS_MODULE, NULL, adapter_nr) && -+ dvb_usb_device_init(intf, &s421_properties, -+ THIS_MODULE, NULL, adapter_nr) && -+ dvb_usb_device_init(intf, &su3000_properties, -+ THIS_MODULE, NULL, adapter_nr) && -+ dvb_usb_device_init(intf, &t220_properties, -+ THIS_MODULE, NULL, adapter_nr) && -+ dvb_usb_device_init(intf, &tt_s2_4600_properties, -+ THIS_MODULE, NULL, adapter_nr))) { - - return 0; - } - -- retval = -ENODEV; -- kfree(s421); --err3: -- kfree(p7500); --err2: -- kfree(s660); --err1: -- kfree(p1100); --err0: -- return retval; -+ return -ENODEV; - } - - static void dw2102_disconnect(struct usb_interface *intf) -diff --git a/drivers/media/usb/dvb-usb/m920x.c b/drivers/media/usb/dvb-usb/m920x.c -index d866a1990a7d2..7282f60226558 100644 ---- a/drivers/media/usb/dvb-usb/m920x.c -+++ b/drivers/media/usb/dvb-usb/m920x.c -@@ -274,6 +274,13 @@ static int m920x_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], int nu - /* Should check for ack here, if we knew how. */ - } - if (msg[i].flags & I2C_M_RD) { -+ char *read = kmalloc(1, GFP_KERNEL); -+ if (!read) { -+ ret = -ENOMEM; -+ kfree(read); -+ goto unlock; -+ } -+ - for (j = 0; j < msg[i].len; j++) { - /* Last byte of transaction? - * Send STOP, otherwise send ACK. */ -@@ -281,9 +288,12 @@ static int m920x_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], int nu - - if ((ret = m920x_read(d->udev, M9206_I2C, 0x0, - 0x20 | stop, -- &msg[i].buf[j], 1)) != 0) -+ read, 1)) != 0) - goto unlock; -+ msg[i].buf[j] = read[0]; - } -+ -+ kfree(read); - } else { - for (j = 0; j < msg[i].len; j++) { - /* Last byte of transaction? Then send STOP. */ -diff --git a/drivers/media/usb/em28xx/em28xx-cards.c b/drivers/media/usb/em28xx/em28xx-cards.c -index 3e96b4b711d75..bfca9d0a1fe15 100644 ---- a/drivers/media/usb/em28xx/em28xx-cards.c -+++ b/drivers/media/usb/em28xx/em28xx-cards.c -@@ -3515,8 +3515,10 @@ static int em28xx_init_dev(struct em28xx *dev, struct usb_device *udev, - - if (dev->is_audio_only) { - retval = em28xx_audio_setup(dev); -- if (retval) -- return -ENODEV; -+ if (retval) { -+ retval = -ENODEV; -+ goto err_deinit_media; -+ } - em28xx_init_extension(dev); - - return 0; -@@ -3535,7 +3537,7 @@ static int em28xx_init_dev(struct em28xx *dev, struct usb_device *udev, - dev_err(&dev->intf->dev, - "%s: em28xx_i2c_register bus 0 - error [%d]!\n", - __func__, retval); -- return retval; -+ goto err_deinit_media; - } - - /* register i2c bus 1 */ -@@ -3551,9 +3553,7 @@ static int em28xx_init_dev(struct em28xx *dev, struct usb_device *udev, - "%s: em28xx_i2c_register bus 1 - error [%d]!\n", - __func__, retval); - -- em28xx_i2c_unregister(dev, 0); -- -- return retval; -+ goto err_unreg_i2c; - } - } - -@@ -3561,6 +3561,12 @@ static int em28xx_init_dev(struct em28xx *dev, struct usb_device *udev, - em28xx_card_setup(dev); - - return 0; -+ -+err_unreg_i2c: -+ em28xx_i2c_unregister(dev, 0); -+err_deinit_media: -+ em28xx_unregister_media_device(dev); -+ return retval; - } - - static int em28xx_duplicate_dev(struct em28xx *dev) -diff --git a/drivers/media/usb/em28xx/em28xx-core.c b/drivers/media/usb/em28xx/em28xx-core.c -index af9216278024f..308bc029099d9 100644 ---- a/drivers/media/usb/em28xx/em28xx-core.c -+++ b/drivers/media/usb/em28xx/em28xx-core.c -@@ -89,7 +89,7 @@ int em28xx_read_reg_req_len(struct em28xx *dev, u8 req, u16 reg, - mutex_lock(&dev->ctrl_urb_lock); - ret = usb_control_msg(udev, pipe, req, - USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE, -- 0x0000, reg, dev->urb_buf, len, HZ); -+ 0x0000, reg, dev->urb_buf, len, 1000); - if (ret < 0) { - em28xx_regdbg("(pipe 0x%08x): IN: %02x %02x %02x %02x %02x %02x %02x %02x failed with error %i\n", - pipe, -@@ -158,7 +158,7 @@ int em28xx_write_regs_req(struct em28xx *dev, u8 req, u16 reg, char *buf, - memcpy(dev->urb_buf, buf, len); - ret = usb_control_msg(udev, pipe, req, - USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE, -- 0x0000, reg, dev->urb_buf, len, HZ); -+ 0x0000, reg, dev->urb_buf, len, 1000); - mutex_unlock(&dev->ctrl_urb_lock); - - if (ret < 0) { -diff --git a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c -index 4c991eae53cdf..2f00679f65a0a 100644 ---- a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c -+++ b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c -@@ -1468,7 +1468,7 @@ static int pvr2_upload_firmware1(struct pvr2_hdw *hdw) - for (address = 0; address < fwsize; address += 0x800) { - memcpy(fw_ptr, fw_entry->data + address, 0x800); - ret += usb_control_msg(hdw->usb_dev, pipe, 0xa0, 0x40, address, -- 0, fw_ptr, 0x800, HZ); -+ 0, fw_ptr, 0x800, 1000); - } - - trace_firmware("Upload done, releasing device's CPU"); -@@ -1606,7 +1606,7 @@ int pvr2_upload_firmware2(struct pvr2_hdw *hdw) - ((u32 *)fw_ptr)[icnt] = swab32(((u32 *)fw_ptr)[icnt]); - - ret |= usb_bulk_msg(hdw->usb_dev, pipe, fw_ptr,bcnt, -- &actual_length, HZ); -+ &actual_length, 1000); - ret |= (actual_length != bcnt); - if (ret) break; - fw_done += bcnt; -@@ -3439,7 +3439,7 @@ void pvr2_hdw_cpufw_set_enabled(struct pvr2_hdw *hdw, - 0xa0,0xc0, - address,0, - hdw->fw_buffer+address, -- 0x800,HZ); -+ 0x800,1000); - if (ret < 0) break; - } - -@@ -3978,7 +3978,7 @@ void pvr2_hdw_cpureset_assert(struct pvr2_hdw *hdw,int val) - /* Write the CPUCS register on the 8051. The lsb of the register - is the reset bit; a 1 asserts reset while a 0 clears it. */ - pipe = usb_sndctrlpipe(hdw->usb_dev, 0); -- ret = usb_control_msg(hdw->usb_dev,pipe,0xa0,0x40,0xe600,0,da,1,HZ); -+ ret = usb_control_msg(hdw->usb_dev,pipe,0xa0,0x40,0xe600,0,da,1,1000); - if (ret < 0) { - pvr2_trace(PVR2_TRACE_ERROR_LEGS, - "cpureset_assert(%d) error=%d",val,ret); -diff --git a/drivers/media/usb/s2255/s2255drv.c b/drivers/media/usb/s2255/s2255drv.c -index 329ec80895927..7ed526306816a 100644 ---- a/drivers/media/usb/s2255/s2255drv.c -+++ b/drivers/media/usb/s2255/s2255drv.c -@@ -1884,7 +1884,7 @@ static long s2255_vendor_req(struct s2255_dev *dev, unsigned char Request, - USB_TYPE_VENDOR | USB_RECIP_DEVICE | - USB_DIR_IN, - Value, Index, buf, -- TransferBufferLength, HZ * 5); -+ TransferBufferLength, USB_CTRL_SET_TIMEOUT); - - if (r >= 0) - memcpy(TransferBuffer, buf, TransferBufferLength); -@@ -1893,7 +1893,7 @@ static long s2255_vendor_req(struct s2255_dev *dev, unsigned char Request, - r = usb_control_msg(dev->udev, usb_sndctrlpipe(dev->udev, 0), - Request, USB_TYPE_VENDOR | USB_RECIP_DEVICE, - Value, Index, buf, -- TransferBufferLength, HZ * 5); -+ TransferBufferLength, USB_CTRL_SET_TIMEOUT); - } - kfree(buf); - return r; -diff --git a/drivers/media/usb/stk1160/stk1160-core.c b/drivers/media/usb/stk1160/stk1160-core.c -index b4f8bc5db1389..4e1698f788187 100644 ---- a/drivers/media/usb/stk1160/stk1160-core.c -+++ b/drivers/media/usb/stk1160/stk1160-core.c -@@ -65,7 +65,7 @@ int stk1160_read_reg(struct stk1160 *dev, u16 reg, u8 *value) - return -ENOMEM; - ret = usb_control_msg(dev->udev, pipe, 0x00, - USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE, -- 0x00, reg, buf, sizeof(u8), HZ); -+ 0x00, reg, buf, sizeof(u8), 1000); - if (ret < 0) { - stk1160_err("read failed on reg 0x%x (%d)\n", - reg, ret); -@@ -85,7 +85,7 @@ int stk1160_write_reg(struct stk1160 *dev, u16 reg, u16 value) - - ret = usb_control_msg(dev->udev, pipe, 0x01, - USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE, -- value, reg, NULL, 0, HZ); -+ value, reg, NULL, 0, 1000); - if (ret < 0) { - stk1160_err("write failed on reg 0x%x (%d)\n", - reg, ret); -diff --git a/drivers/media/usb/uvc/uvcvideo.h b/drivers/media/usb/uvc/uvcvideo.h -index 24e3d8c647e77..5f137400bebd6 100644 ---- a/drivers/media/usb/uvc/uvcvideo.h -+++ b/drivers/media/usb/uvc/uvcvideo.h -@@ -179,7 +179,7 @@ - /* Maximum status buffer size in bytes of interrupt URB. */ - #define UVC_MAX_STATUS_SIZE 16 - --#define UVC_CTRL_CONTROL_TIMEOUT 500 -+#define UVC_CTRL_CONTROL_TIMEOUT 5000 - #define UVC_CTRL_STREAMING_TIMEOUT 5000 - - /* Maximum allowed number of control mappings per device */ -diff --git a/drivers/media/v4l2-core/v4l2-ioctl.c b/drivers/media/v4l2-core/v4l2-ioctl.c -index 98633fa5d46fd..3012e8ecffb94 100644 ---- a/drivers/media/v4l2-core/v4l2-ioctl.c -+++ b/drivers/media/v4l2-core/v4l2-ioctl.c -@@ -2046,6 +2046,7 @@ static int v4l_prepare_buf(const struct v4l2_ioctl_ops *ops, - static int v4l_g_parm(const struct v4l2_ioctl_ops *ops, - struct file *file, void *fh, void *arg) - { -+ struct video_device *vfd = video_devdata(file); - struct v4l2_streamparm *p = arg; - v4l2_std_id std; - int ret = check_fmt(file, p->type); -@@ -2057,7 +2058,8 @@ static int v4l_g_parm(const struct v4l2_ioctl_ops *ops, - if (p->type != V4L2_BUF_TYPE_VIDEO_CAPTURE && - p->type != V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE) - return -EINVAL; -- p->parm.capture.readbuffers = 2; -+ if (vfd->device_caps & V4L2_CAP_READWRITE) -+ p->parm.capture.readbuffers = 2; - ret = ops->vidioc_g_std(file, fh, &std); - if (ret == 0) - v4l2_video_std_frame_period(std, &p->parm.capture.timeperframe); -diff --git a/drivers/misc/lattice-ecp3-config.c b/drivers/misc/lattice-ecp3-config.c -index 884485c3f7232..3a0d2b052ed29 100644 ---- a/drivers/misc/lattice-ecp3-config.c -+++ b/drivers/misc/lattice-ecp3-config.c -@@ -77,12 +77,12 @@ static void firmware_load(const struct firmware *fw, void *context) - - if (fw == NULL) { - dev_err(&spi->dev, "Cannot load firmware, aborting\n"); -- return; -+ goto out; - } - - if (fw->size == 0) { - dev_err(&spi->dev, "Error: Firmware size is 0!\n"); -- return; -+ goto out; - } - - /* Fill dummy data (24 stuffing bits for commands) */ -@@ -104,7 +104,7 @@ static void firmware_load(const struct firmware *fw, void *context) - dev_err(&spi->dev, - "Error: No supported FPGA detected (JEDEC_ID=%08x)!\n", - jedec_id); -- return; -+ goto out; - } - - dev_info(&spi->dev, "FPGA %s detected\n", ecp3_dev[i].name); -@@ -117,7 +117,7 @@ static void firmware_load(const struct firmware *fw, void *context) - buffer = kzalloc(fw->size + 8, GFP_KERNEL); - if (!buffer) { - dev_err(&spi->dev, "Error: Can't allocate memory!\n"); -- return; -+ goto out; - } - - /* -@@ -156,7 +156,7 @@ static void firmware_load(const struct firmware *fw, void *context) - "Error: Timeout waiting for FPGA to clear (status=%08x)!\n", - status); - kfree(buffer); -- return; -+ goto out; - } - - dev_info(&spi->dev, "Configuring the FPGA...\n"); -@@ -182,7 +182,7 @@ static void firmware_load(const struct firmware *fw, void *context) - release_firmware(fw); - - kfree(buffer); -- -+out: - complete(&data->fw_loaded); - } - -diff --git a/drivers/misc/lkdtm/Makefile b/drivers/misc/lkdtm/Makefile -index 30c8ac24635d4..4405fb2bc7a00 100644 ---- a/drivers/misc/lkdtm/Makefile -+++ b/drivers/misc/lkdtm/Makefile -@@ -16,7 +16,7 @@ KCOV_INSTRUMENT_rodata.o := n - - OBJCOPYFLAGS := - OBJCOPYFLAGS_rodata_objcopy.o := \ -- --rename-section .noinstr.text=.rodata,alloc,readonly,load -+ --rename-section .noinstr.text=.rodata,alloc,readonly,load,contents - targets += rodata.o rodata_objcopy.o - $(obj)/rodata_objcopy.o: $(obj)/rodata.o FORCE - $(call if_changed,objcopy) -diff --git a/drivers/mmc/core/sdio.c b/drivers/mmc/core/sdio.c -index 0bf33786fc5c5..9e0791332ef38 100644 ---- a/drivers/mmc/core/sdio.c -+++ b/drivers/mmc/core/sdio.c -@@ -626,6 +626,8 @@ try_again: - if (host->ops->init_card) - host->ops->init_card(host, card); - -+ card->ocr = ocr_card; -+ - /* - * If the host and card support UHS-I mode request the card - * to switch to 1.8V signaling level. No 1.8v signalling if -@@ -738,7 +740,7 @@ try_again: - goto mismatch; - } - } -- card->ocr = ocr_card; -+ - mmc_fixup_device(card, sdio_fixup_methods); - - if (card->type == MMC_TYPE_SD_COMBO) { -diff --git a/drivers/mmc/host/meson-mx-sdio.c b/drivers/mmc/host/meson-mx-sdio.c -index 360d523132bd5..780552a86ec08 100644 ---- a/drivers/mmc/host/meson-mx-sdio.c -+++ b/drivers/mmc/host/meson-mx-sdio.c -@@ -665,6 +665,11 @@ static int meson_mx_mmc_probe(struct platform_device *pdev) - } - - irq = platform_get_irq(pdev, 0); -+ if (irq < 0) { -+ ret = irq; -+ goto error_free_mmc; -+ } -+ - ret = devm_request_threaded_irq(host->controller_dev, irq, - meson_mx_mmc_irq, - meson_mx_mmc_irq_thread, IRQF_ONESHOT, -diff --git a/drivers/mtd/nand/bbt.c b/drivers/mtd/nand/bbt.c -index 044adf9138546..64af6898131d6 100644 ---- a/drivers/mtd/nand/bbt.c -+++ b/drivers/mtd/nand/bbt.c -@@ -123,7 +123,7 @@ int nanddev_bbt_set_block_status(struct nand_device *nand, unsigned int entry, - unsigned int rbits = bits_per_block + offs - BITS_PER_LONG; - - pos[1] &= ~GENMASK(rbits - 1, 0); -- pos[1] |= val >> rbits; -+ pos[1] |= val >> (bits_per_block - rbits); - } - - return 0; -diff --git a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c -index 60f146920b9f4..515094e253dcd 100644 ---- a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c -+++ b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c -@@ -710,14 +710,32 @@ static void gpmi_nfc_compute_timings(struct gpmi_nand_data *this, - (use_half_period ? BM_GPMI_CTRL1_HALF_PERIOD : 0); - } - --static void gpmi_nfc_apply_timings(struct gpmi_nand_data *this) -+static int gpmi_nfc_apply_timings(struct gpmi_nand_data *this) - { - struct gpmi_nfc_hardware_timing *hw = &this->hw; - struct resources *r = &this->resources; - void __iomem *gpmi_regs = r->gpmi_regs; - unsigned int dll_wait_time_us; -+ int ret; -+ -+ /* Clock dividers do NOT guarantee a clean clock signal on its output -+ * during the change of the divide factor on i.MX6Q/UL/SX. On i.MX7/8, -+ * all clock dividers provide these guarantee. -+ */ -+ if (GPMI_IS_MX6Q(this) || GPMI_IS_MX6SX(this)) -+ clk_disable_unprepare(r->clock[0]); - -- clk_set_rate(r->clock[0], hw->clk_rate); -+ ret = clk_set_rate(r->clock[0], hw->clk_rate); -+ if (ret) { -+ dev_err(this->dev, "cannot set clock rate to %lu Hz: %d\n", hw->clk_rate, ret); -+ return ret; -+ } -+ -+ if (GPMI_IS_MX6Q(this) || GPMI_IS_MX6SX(this)) { -+ ret = clk_prepare_enable(r->clock[0]); -+ if (ret) -+ return ret; -+ } - - writel(hw->timing0, gpmi_regs + HW_GPMI_TIMING0); - writel(hw->timing1, gpmi_regs + HW_GPMI_TIMING1); -@@ -736,6 +754,8 @@ static void gpmi_nfc_apply_timings(struct gpmi_nand_data *this) - - /* Wait for the DLL to settle. */ - udelay(dll_wait_time_us); -+ -+ return 0; - } - - static int gpmi_setup_data_interface(struct nand_chip *chip, int chipnr, -@@ -1184,15 +1204,6 @@ static int gpmi_get_clks(struct gpmi_nand_data *this) - r->clock[i] = clk; - } - -- if (GPMI_IS_MX6(this)) -- /* -- * Set the default value for the gpmi clock. -- * -- * If you want to use the ONFI nand which is in the -- * Synchronous Mode, you should change the clock as you need. -- */ -- clk_set_rate(r->clock[0], 22000000); -- - return 0; - - err_clock: -@@ -2429,7 +2440,9 @@ static int gpmi_nfc_exec_op(struct nand_chip *chip, - */ - if (this->hw.must_apply_timings) { - this->hw.must_apply_timings = false; -- gpmi_nfc_apply_timings(this); -+ ret = gpmi_nfc_apply_timings(this); -+ if (ret) -+ return ret; - } - - dev_dbg(this->dev, "%s: %d instructions\n", __func__, op->ninstrs); -diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c -index a7eaf80f500c0..ff50ccc7dceb1 100644 ---- a/drivers/net/bonding/bond_main.c -+++ b/drivers/net/bonding/bond_main.c -@@ -792,9 +792,6 @@ static bool bond_should_notify_peers(struct bonding *bond) - slave = rcu_dereference(bond->curr_active_slave); - rcu_read_unlock(); - -- netdev_dbg(bond->dev, "bond_should_notify_peers: slave %s\n", -- slave ? slave->dev->name : "NULL"); -- - if (!slave || !bond->send_peer_notif || - bond->send_peer_notif % - max(1, bond->params.peer_notif_delay) != 0 || -@@ -802,6 +799,9 @@ static bool bond_should_notify_peers(struct bonding *bond) - test_bit(__LINK_STATE_LINKWATCH_PENDING, &slave->dev->state)) - return false; - -+ netdev_dbg(bond->dev, "bond_should_notify_peers: slave %s\n", -+ slave ? slave->dev->name : "NULL"); -+ - return true; - } - -diff --git a/drivers/net/can/softing/softing_cs.c b/drivers/net/can/softing/softing_cs.c -index 2e93ee7923739..e5c939b63fa65 100644 ---- a/drivers/net/can/softing/softing_cs.c -+++ b/drivers/net/can/softing/softing_cs.c -@@ -293,7 +293,7 @@ static int softingcs_probe(struct pcmcia_device *pcmcia) - return 0; - - platform_failed: -- kfree(dev); -+ platform_device_put(pdev); - mem_failed: - pcmcia_bad: - pcmcia_failed: -diff --git a/drivers/net/can/softing/softing_fw.c b/drivers/net/can/softing/softing_fw.c -index 8f44fdd8804bf..1c2afa17c26d1 100644 ---- a/drivers/net/can/softing/softing_fw.c -+++ b/drivers/net/can/softing/softing_fw.c -@@ -565,18 +565,19 @@ int softing_startstop(struct net_device *dev, int up) - if (ret < 0) - goto failed; - } -- /* enable_error_frame */ -- /* -+ -+ /* enable_error_frame -+ * - * Error reporting is switched off at the moment since - * the receiving of them is not yet 100% verified - * This should be enabled sooner or later -- * -- if (error_reporting) { -+ */ -+ if (0 && error_reporting) { - ret = softing_fct_cmd(card, 51, "enable_error_frame"); - if (ret < 0) - goto failed; - } -- */ -+ - /* initialize interface */ - iowrite16(1, &card->dpram[DPRAM_FCT_PARAM + 2]); - iowrite16(1, &card->dpram[DPRAM_FCT_PARAM + 4]); -diff --git a/drivers/net/can/xilinx_can.c b/drivers/net/can/xilinx_can.c -index 0de39ebb35662..008d3d492bd1c 100644 ---- a/drivers/net/can/xilinx_can.c -+++ b/drivers/net/can/xilinx_can.c -@@ -1753,7 +1753,12 @@ static int xcan_probe(struct platform_device *pdev) - spin_lock_init(&priv->tx_lock); - - /* Get IRQ for the device */ -- ndev->irq = platform_get_irq(pdev, 0); -+ ret = platform_get_irq(pdev, 0); -+ if (ret < 0) -+ goto err_free; -+ -+ ndev->irq = ret; -+ - ndev->flags |= IFF_ECHO; /* We support local echo */ - - platform_set_drvdata(pdev, ndev); -diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c -index c2a1fa75b2147..2affdddc12bf6 100644 ---- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c -+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c -@@ -3507,10 +3507,12 @@ static int bcmgenet_probe(struct platform_device *pdev) - - /* Request the WOL interrupt and advertise suspend if available */ - priv->wol_irq_disabled = true; -- err = devm_request_irq(&pdev->dev, priv->wol_irq, bcmgenet_wol_isr, 0, -- dev->name, priv); -- if (!err) -- device_set_wakeup_capable(&pdev->dev, 1); -+ if (priv->wol_irq > 0) { -+ err = devm_request_irq(&pdev->dev, priv->wol_irq, -+ bcmgenet_wol_isr, 0, dev->name, priv); -+ if (!err) -+ device_set_wakeup_capable(&pdev->dev, 1); -+ } - - /* Set the needed headroom to account for any possible - * features enabling/disabling at runtime -diff --git a/drivers/net/ethernet/chelsio/libcxgb/libcxgb_cm.c b/drivers/net/ethernet/chelsio/libcxgb/libcxgb_cm.c -index d04a6c1634452..da8d10475a08e 100644 ---- a/drivers/net/ethernet/chelsio/libcxgb/libcxgb_cm.c -+++ b/drivers/net/ethernet/chelsio/libcxgb/libcxgb_cm.c -@@ -32,6 +32,7 @@ - - #include - #include -+#include - #include - #include - -@@ -99,7 +100,7 @@ cxgb_find_route(struct cxgb4_lld_info *lldi, - - rt = ip_route_output_ports(&init_net, &fl4, NULL, peer_ip, local_ip, - peer_port, local_port, IPPROTO_TCP, -- tos, 0); -+ tos & ~INET_ECN_MASK, 0); - if (IS_ERR(rt)) - return NULL; - n = dst_neigh_lookup(&rt->dst, &peer_ip); -diff --git a/drivers/net/ethernet/cortina/gemini.c b/drivers/net/ethernet/cortina/gemini.c -index c9fb1ec625d8b..a8a8b77c1611e 100644 ---- a/drivers/net/ethernet/cortina/gemini.c -+++ b/drivers/net/ethernet/cortina/gemini.c -@@ -304,21 +304,21 @@ static void gmac_speed_set(struct net_device *netdev) - switch (phydev->speed) { - case 1000: - status.bits.speed = GMAC_SPEED_1000; -- if (phydev->interface == PHY_INTERFACE_MODE_RGMII) -+ if (phy_interface_mode_is_rgmii(phydev->interface)) - status.bits.mii_rmii = GMAC_PHY_RGMII_1000; - netdev_dbg(netdev, "connect %s to RGMII @ 1Gbit\n", - phydev_name(phydev)); - break; - case 100: - status.bits.speed = GMAC_SPEED_100; -- if (phydev->interface == PHY_INTERFACE_MODE_RGMII) -+ if (phy_interface_mode_is_rgmii(phydev->interface)) - status.bits.mii_rmii = GMAC_PHY_RGMII_100_10; - netdev_dbg(netdev, "connect %s to RGMII @ 100 Mbit\n", - phydev_name(phydev)); - break; - case 10: - status.bits.speed = GMAC_SPEED_10; -- if (phydev->interface == PHY_INTERFACE_MODE_RGMII) -+ if (phy_interface_mode_is_rgmii(phydev->interface)) - status.bits.mii_rmii = GMAC_PHY_RGMII_100_10; - netdev_dbg(netdev, "connect %s to RGMII @ 10 Mbit\n", - phydev_name(phydev)); -@@ -388,6 +388,9 @@ static int gmac_setup_phy(struct net_device *netdev) - status.bits.mii_rmii = GMAC_PHY_GMII; - break; - case PHY_INTERFACE_MODE_RGMII: -+ case PHY_INTERFACE_MODE_RGMII_ID: -+ case PHY_INTERFACE_MODE_RGMII_TXID: -+ case PHY_INTERFACE_MODE_RGMII_RXID: - netdev_dbg(netdev, - "RGMII: set GMAC0 and GMAC1 to MII/RGMII mode\n"); - status.bits.mii_rmii = GMAC_PHY_RGMII_100_10; -diff --git a/drivers/net/ethernet/freescale/fman/mac.c b/drivers/net/ethernet/freescale/fman/mac.c -index 7ab8095db1928..147126e79986c 100644 ---- a/drivers/net/ethernet/freescale/fman/mac.c -+++ b/drivers/net/ethernet/freescale/fman/mac.c -@@ -94,14 +94,17 @@ static void mac_exception(void *handle, enum fman_mac_exceptions ex) - __func__, ex); - } - --static void set_fman_mac_params(struct mac_device *mac_dev, -- struct fman_mac_params *params) -+static int set_fman_mac_params(struct mac_device *mac_dev, -+ struct fman_mac_params *params) - { - struct mac_priv_s *priv = mac_dev->priv; - - params->base_addr = (typeof(params->base_addr)) - devm_ioremap(priv->dev, mac_dev->res->start, - resource_size(mac_dev->res)); -+ if (!params->base_addr) -+ return -ENOMEM; -+ - memcpy(¶ms->addr, mac_dev->addr, sizeof(mac_dev->addr)); - params->max_speed = priv->max_speed; - params->phy_if = mac_dev->phy_if; -@@ -112,6 +115,8 @@ static void set_fman_mac_params(struct mac_device *mac_dev, - params->event_cb = mac_exception; - params->dev_id = mac_dev; - params->internal_phy_node = priv->internal_phy_node; -+ -+ return 0; - } - - static int tgec_initialization(struct mac_device *mac_dev) -@@ -123,7 +128,9 @@ static int tgec_initialization(struct mac_device *mac_dev) - - priv = mac_dev->priv; - -- set_fman_mac_params(mac_dev, ¶ms); -+ err = set_fman_mac_params(mac_dev, ¶ms); -+ if (err) -+ goto _return; - - mac_dev->fman_mac = tgec_config(¶ms); - if (!mac_dev->fman_mac) { -@@ -169,7 +176,9 @@ static int dtsec_initialization(struct mac_device *mac_dev) - - priv = mac_dev->priv; - -- set_fman_mac_params(mac_dev, ¶ms); -+ err = set_fman_mac_params(mac_dev, ¶ms); -+ if (err) -+ goto _return; - - mac_dev->fman_mac = dtsec_config(¶ms); - if (!mac_dev->fman_mac) { -@@ -218,7 +227,9 @@ static int memac_initialization(struct mac_device *mac_dev) - - priv = mac_dev->priv; - -- set_fman_mac_params(mac_dev, ¶ms); -+ err = set_fman_mac_params(mac_dev, ¶ms); -+ if (err) -+ goto _return; - - if (priv->max_speed == SPEED_10000) - params.phy_if = PHY_INTERFACE_MODE_XGMII; -diff --git a/drivers/net/ethernet/freescale/xgmac_mdio.c b/drivers/net/ethernet/freescale/xgmac_mdio.c -index c82c85ef5fb34..c37aea7ba8502 100644 ---- a/drivers/net/ethernet/freescale/xgmac_mdio.c -+++ b/drivers/net/ethernet/freescale/xgmac_mdio.c -@@ -301,9 +301,10 @@ err_ioremap: - static int xgmac_mdio_remove(struct platform_device *pdev) - { - struct mii_bus *bus = platform_get_drvdata(pdev); -+ struct mdio_fsl_priv *priv = bus->priv; - - mdiobus_unregister(bus); -- iounmap(bus->priv); -+ iounmap(priv->mdio_base); - mdiobus_free(bus); - - return 0; -diff --git a/drivers/net/ethernet/i825xx/sni_82596.c b/drivers/net/ethernet/i825xx/sni_82596.c -index 6436a98c5953f..90e237fdfbd0e 100644 ---- a/drivers/net/ethernet/i825xx/sni_82596.c -+++ b/drivers/net/ethernet/i825xx/sni_82596.c -@@ -123,9 +123,10 @@ static int sni_82596_probe(struct platform_device *dev) - netdevice->dev_addr[5] = readb(eth_addr + 0x06); - iounmap(eth_addr); - -- if (!netdevice->irq) { -+ if (netdevice->irq < 0) { - printk(KERN_ERR "%s: IRQ not found for i82596 at 0x%lx\n", - __FILE__, netdevice->base_addr); -+ retval = netdevice->irq; - goto probe_failed; - } - -diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c -index 48b395b9c15ad..3351d4f9363af 100644 ---- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c -+++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c -@@ -215,7 +215,7 @@ static void mtk_mac_config(struct phylink_config *config, unsigned int mode, - phylink_config); - struct mtk_eth *eth = mac->hw; - u32 mcr_cur, mcr_new, sid, i; -- int val, ge_mode, err; -+ int val, ge_mode, err = 0; - - /* MT76x8 has no hardware settings between for the MAC */ - if (!MTK_HAS_CAPS(eth->soc->caps, MTK_SOC_MT7628) && -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c -index bf091a6c0cd2d..1a7aa078f3510 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c -@@ -147,8 +147,12 @@ static void cmd_ent_put(struct mlx5_cmd_work_ent *ent) - if (!refcount_dec_and_test(&ent->refcnt)) - return; - -- if (ent->idx >= 0) -- cmd_free_index(ent->cmd, ent->idx); -+ if (ent->idx >= 0) { -+ struct mlx5_cmd *cmd = ent->cmd; -+ -+ cmd_free_index(cmd, ent->idx); -+ up(ent->page_queue ? &cmd->pages_sem : &cmd->sem); -+ } - - cmd_free_ent(ent); - } -@@ -883,25 +887,6 @@ static bool opcode_allowed(struct mlx5_cmd *cmd, u16 opcode) - return cmd->allowed_opcode == opcode; - } - --static int cmd_alloc_index_retry(struct mlx5_cmd *cmd) --{ -- unsigned long alloc_end = jiffies + msecs_to_jiffies(1000); -- int idx; -- --retry: -- idx = cmd_alloc_index(cmd); -- if (idx < 0 && time_before(jiffies, alloc_end)) { -- /* Index allocation can fail on heavy load of commands. This is a temporary -- * situation as the current command already holds the semaphore, meaning that -- * another command completion is being handled and it is expected to release -- * the entry index soon. -- */ -- cpu_relax(); -- goto retry; -- } -- return idx; --} -- - static void cmd_work_handler(struct work_struct *work) - { - struct mlx5_cmd_work_ent *ent = container_of(work, struct mlx5_cmd_work_ent, work); -@@ -919,7 +904,7 @@ static void cmd_work_handler(struct work_struct *work) - sem = ent->page_queue ? &cmd->pages_sem : &cmd->sem; - down(sem); - if (!ent->page_queue) { -- alloc_ret = cmd_alloc_index_retry(cmd); -+ alloc_ret = cmd_alloc_index(cmd); - if (alloc_ret < 0) { - mlx5_core_err(dev, "failed to allocate command entry\n"); - if (ent->callback) { -@@ -1577,8 +1562,6 @@ static void mlx5_cmd_comp_handler(struct mlx5_core_dev *dev, u64 vec, bool force - vector = vec & 0xffffffff; - for (i = 0; i < (1 << cmd->log_sz); i++) { - if (test_bit(i, &vector)) { -- struct semaphore *sem; -- - ent = cmd->ent_arr[i]; - - /* if we already completed the command, ignore it */ -@@ -1601,10 +1584,6 @@ static void mlx5_cmd_comp_handler(struct mlx5_core_dev *dev, u64 vec, bool force - dev->state == MLX5_DEVICE_STATE_INTERNAL_ERROR) - cmd_ent_put(ent); - -- if (ent->page_queue) -- sem = &cmd->pages_sem; -- else -- sem = &cmd->sem; - ent->ts2 = ktime_get_ns(); - memcpy(ent->out->first.data, ent->lay->out, sizeof(ent->lay->out)); - dump_command(dev, ent, 0); -@@ -1658,7 +1637,6 @@ static void mlx5_cmd_comp_handler(struct mlx5_core_dev *dev, u64 vec, bool force - */ - complete(&ent->done); - } -- up(sem); - } - } - } -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -index dea884c94568c..2465165cbea73 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -@@ -5053,9 +5053,13 @@ static void mlx5e_build_nic_netdev(struct net_device *netdev) - } - - if (mlx5_vxlan_allowed(mdev->vxlan) || mlx5_geneve_tx_allowed(mdev)) { -- netdev->hw_features |= NETIF_F_GSO_UDP_TUNNEL; -- netdev->hw_enc_features |= NETIF_F_GSO_UDP_TUNNEL; -- netdev->vlan_features |= NETIF_F_GSO_UDP_TUNNEL; -+ netdev->hw_features |= NETIF_F_GSO_UDP_TUNNEL | -+ NETIF_F_GSO_UDP_TUNNEL_CSUM; -+ netdev->hw_enc_features |= NETIF_F_GSO_UDP_TUNNEL | -+ NETIF_F_GSO_UDP_TUNNEL_CSUM; -+ netdev->gso_partial_features = NETIF_F_GSO_UDP_TUNNEL_CSUM; -+ netdev->vlan_features |= NETIF_F_GSO_UDP_TUNNEL | -+ NETIF_F_GSO_UDP_TUNNEL_CSUM; - } - - if (mlx5e_tunnel_proto_supported(mdev, IPPROTO_GRE)) { -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag_mp.c b/drivers/net/ethernet/mellanox/mlx5/core/lag_mp.c -index bdc7f915d80e3..101667c6b5843 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/lag_mp.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/lag_mp.c -@@ -265,10 +265,8 @@ static int mlx5_lag_fib_event(struct notifier_block *nb, - fen_info = container_of(info, struct fib_entry_notifier_info, - info); - fi = fen_info->fi; -- if (fi->nh) { -- NL_SET_ERR_MSG_MOD(info->extack, "IPv4 route with nexthop objects is not supported"); -- return notifier_from_errno(-EINVAL); -- } -+ if (fi->nh) -+ return NOTIFY_DONE; - fib_dev = fib_info_nh(fen_info->fi, 0)->fib_nh_dev; - if (fib_dev != ldev->pf[0].netdev && - fib_dev != ldev->pf[1].netdev) { -diff --git a/drivers/net/ethernet/mellanox/mlxsw/pci.c b/drivers/net/ethernet/mellanox/mlxsw/pci.c -index aa4fef7890841..ff331251a019a 100644 ---- a/drivers/net/ethernet/mellanox/mlxsw/pci.c -+++ b/drivers/net/ethernet/mellanox/mlxsw/pci.c -@@ -1876,6 +1876,7 @@ int mlxsw_pci_driver_register(struct pci_driver *pci_driver) - { - pci_driver->probe = mlxsw_pci_probe; - pci_driver->remove = mlxsw_pci_remove; -+ pci_driver->shutdown = mlxsw_pci_remove; - return pci_register_driver(pci_driver); - } - EXPORT_SYMBOL(mlxsw_pci_driver_register); -diff --git a/drivers/net/ethernet/rocker/rocker_ofdpa.c b/drivers/net/ethernet/rocker/rocker_ofdpa.c -index 7072b249c8bd6..8157666209798 100644 ---- a/drivers/net/ethernet/rocker/rocker_ofdpa.c -+++ b/drivers/net/ethernet/rocker/rocker_ofdpa.c -@@ -2795,7 +2795,8 @@ static void ofdpa_fib4_abort(struct rocker *rocker) - if (!ofdpa_port) - continue; - nh->fib_nh_flags &= ~RTNH_F_OFFLOAD; -- ofdpa_flow_tbl_del(ofdpa_port, OFDPA_OP_FLAG_REMOVE, -+ ofdpa_flow_tbl_del(ofdpa_port, -+ OFDPA_OP_FLAG_REMOVE | OFDPA_OP_FLAG_NOWAIT, - flow_entry); - } - spin_unlock_irqrestore(&ofdpa->flow_tbl_lock, flags); -diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c -index f98318d93ce72..0ef806ea18327 100644 ---- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c -+++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c -@@ -41,8 +41,9 @@ - #include "xilinx_axienet.h" - - /* Descriptors defines for Tx and Rx DMA */ --#define TX_BD_NUM_DEFAULT 64 -+#define TX_BD_NUM_DEFAULT 128 - #define RX_BD_NUM_DEFAULT 1024 -+#define TX_BD_NUM_MIN (MAX_SKB_FRAGS + 1) - #define TX_BD_NUM_MAX 4096 - #define RX_BD_NUM_MAX 4096 - -@@ -635,7 +636,7 @@ axienet_start_xmit(struct sk_buff *skb, struct net_device *ndev) - num_frag = skb_shinfo(skb)->nr_frags; - cur_p = &lp->tx_bd_v[lp->tx_bd_tail]; - -- if (axienet_check_tx_bd_space(lp, num_frag)) { -+ if (axienet_check_tx_bd_space(lp, num_frag + 1)) { - if (netif_queue_stopped(ndev)) - return NETDEV_TX_BUSY; - -@@ -645,7 +646,7 @@ axienet_start_xmit(struct sk_buff *skb, struct net_device *ndev) - smp_mb(); - - /* Space might have just been freed - check again */ -- if (axienet_check_tx_bd_space(lp, num_frag)) -+ if (axienet_check_tx_bd_space(lp, num_frag + 1)) - return NETDEV_TX_BUSY; - - netif_wake_queue(ndev); -@@ -1223,7 +1224,8 @@ static int axienet_ethtools_set_ringparam(struct net_device *ndev, - if (ering->rx_pending > RX_BD_NUM_MAX || - ering->rx_mini_pending || - ering->rx_jumbo_pending || -- ering->rx_pending > TX_BD_NUM_MAX) -+ ering->tx_pending < TX_BD_NUM_MIN || -+ ering->tx_pending > TX_BD_NUM_MAX) - return -EINVAL; - - if (netif_running(ndev)) -diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c -index 9dbe625ad4477..a69317e944229 100644 ---- a/drivers/net/phy/marvell.c -+++ b/drivers/net/phy/marvell.c -@@ -917,6 +917,12 @@ static int m88e1118_config_init(struct phy_device *phydev) - if (err < 0) - return err; - -+ if (phy_interface_is_rgmii(phydev)) { -+ err = m88e1121_config_aneg_rgmii_delays(phydev); -+ if (err < 0) -+ return err; -+ } -+ - /* Adjust LED Control */ - if (phydev->dev_flags & MARVELL_PHY_M1118_DNS323_LEDS) - err = phy_write(phydev, 0x10, 0x1100); -diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c -index bec73f0640d03..b0a439248ff69 100644 ---- a/drivers/net/phy/mdio_bus.c -+++ b/drivers/net/phy/mdio_bus.c -@@ -433,7 +433,7 @@ int __mdiobus_register(struct mii_bus *bus, struct module *owner) - mdiobus_setup_mdiodev_from_board_info(bus, mdiobus_create_device); - - bus->state = MDIOBUS_REGISTERED; -- pr_info("%s: probed\n", bus->name); -+ dev_dbg(&bus->dev, "probed\n"); - return 0; - - error: -diff --git a/drivers/net/phy/phy-core.c b/drivers/net/phy/phy-core.c -index 9412669b579c7..84064120918f0 100644 ---- a/drivers/net/phy/phy-core.c -+++ b/drivers/net/phy/phy-core.c -@@ -128,11 +128,11 @@ static const struct phy_setting settings[] = { - PHY_SETTING( 2500, FULL, 2500baseT_Full ), - PHY_SETTING( 2500, FULL, 2500baseX_Full ), - /* 1G */ -- PHY_SETTING( 1000, FULL, 1000baseKX_Full ), - PHY_SETTING( 1000, FULL, 1000baseT_Full ), - PHY_SETTING( 1000, HALF, 1000baseT_Half ), - PHY_SETTING( 1000, FULL, 1000baseT1_Full ), - PHY_SETTING( 1000, FULL, 1000baseX_Full ), -+ PHY_SETTING( 1000, FULL, 1000baseKX_Full ), - /* 100M */ - PHY_SETTING( 100, FULL, 100baseT_Full ), - PHY_SETTING( 100, FULL, 100baseT1_Full ), -diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c -index c6c41a7836c93..a085213dc2eaa 100644 ---- a/drivers/net/ppp/ppp_generic.c -+++ b/drivers/net/ppp/ppp_generic.c -@@ -69,6 +69,8 @@ - #define MPHDRLEN 6 /* multilink protocol header length */ - #define MPHDRLEN_SSN 4 /* ditto with short sequence numbers */ - -+#define PPP_PROTO_LEN 2 -+ - /* - * An instance of /dev/ppp can be associated with either a ppp - * interface unit or a ppp channel. In both cases, file->private_data -@@ -498,6 +500,9 @@ static ssize_t ppp_write(struct file *file, const char __user *buf, - - if (!pf) - return -ENXIO; -+ /* All PPP packets should start with the 2-byte protocol */ -+ if (count < PPP_PROTO_LEN) -+ return -EINVAL; - ret = -ENOMEM; - skb = alloc_skb(count + pf->hdrlen, GFP_KERNEL); - if (!skb) -@@ -1544,7 +1549,7 @@ ppp_send_frame(struct ppp *ppp, struct sk_buff *skb) - } - - ++ppp->stats64.tx_packets; -- ppp->stats64.tx_bytes += skb->len - 2; -+ ppp->stats64.tx_bytes += skb->len - PPP_PROTO_LEN; - - switch (proto) { - case PPP_IP: -diff --git a/drivers/net/usb/mcs7830.c b/drivers/net/usb/mcs7830.c -index 09bfa6a4dfbc1..7e40e2e2f3723 100644 ---- a/drivers/net/usb/mcs7830.c -+++ b/drivers/net/usb/mcs7830.c -@@ -108,8 +108,16 @@ static const char driver_name[] = "MOSCHIP usb-ethernet driver"; - - static int mcs7830_get_reg(struct usbnet *dev, u16 index, u16 size, void *data) - { -- return usbnet_read_cmd(dev, MCS7830_RD_BREQ, MCS7830_RD_BMREQ, -- 0x0000, index, data, size); -+ int ret; -+ -+ ret = usbnet_read_cmd(dev, MCS7830_RD_BREQ, MCS7830_RD_BMREQ, -+ 0x0000, index, data, size); -+ if (ret < 0) -+ return ret; -+ else if (ret < size) -+ return -ENODATA; -+ -+ return ret; - } - - static int mcs7830_set_reg(struct usbnet *dev, u16 index, u16 size, const void *data) -diff --git a/drivers/net/wireless/ath/ar5523/ar5523.c b/drivers/net/wireless/ath/ar5523/ar5523.c -index 4c57e79e5779a..58e189ec672f9 100644 ---- a/drivers/net/wireless/ath/ar5523/ar5523.c -+++ b/drivers/net/wireless/ath/ar5523/ar5523.c -@@ -153,6 +153,10 @@ static void ar5523_cmd_rx_cb(struct urb *urb) - ar5523_err(ar, "Invalid reply to WDCMSG_TARGET_START"); - return; - } -+ if (!cmd->odata) { -+ ar5523_err(ar, "Unexpected WDCMSG_TARGET_START reply"); -+ return; -+ } - memcpy(cmd->odata, hdr + 1, sizeof(u32)); - cmd->olen = sizeof(u32); - cmd->res = 0; -diff --git a/drivers/net/wireless/ath/ath10k/htt_tx.c b/drivers/net/wireless/ath/ath10k/htt_tx.c -index c38e1963ebc05..f73ed1044390c 100644 ---- a/drivers/net/wireless/ath/ath10k/htt_tx.c -+++ b/drivers/net/wireless/ath/ath10k/htt_tx.c -@@ -147,6 +147,9 @@ void ath10k_htt_tx_dec_pending(struct ath10k_htt *htt) - htt->num_pending_tx--; - if (htt->num_pending_tx == htt->max_num_pending_tx - 1) - ath10k_mac_tx_unlock(htt->ar, ATH10K_TX_PAUSE_Q_FULL); -+ -+ if (htt->num_pending_tx == 0) -+ wake_up(&htt->empty_tx_wq); - } - - int ath10k_htt_tx_inc_pending(struct ath10k_htt *htt) -diff --git a/drivers/net/wireless/ath/ath10k/txrx.c b/drivers/net/wireless/ath/ath10k/txrx.c -index f46b9083bbf10..2c254f43790d2 100644 ---- a/drivers/net/wireless/ath/ath10k/txrx.c -+++ b/drivers/net/wireless/ath/ath10k/txrx.c -@@ -80,8 +80,6 @@ int ath10k_txrx_tx_unref(struct ath10k_htt *htt, - - ath10k_htt_tx_free_msdu_id(htt, tx_done->msdu_id); - ath10k_htt_tx_dec_pending(htt); -- if (htt->num_pending_tx == 0) -- wake_up(&htt->empty_tx_wq); - spin_unlock_bh(&htt->tx_lock); - - rcu_read_lock(); -diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c -index 2ed98aaed6fb5..c8c7afe0e343e 100644 ---- a/drivers/net/wireless/ath/ath9k/hif_usb.c -+++ b/drivers/net/wireless/ath/ath9k/hif_usb.c -@@ -590,6 +590,13 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev, - return; - } - -+ if (pkt_len > 2 * MAX_RX_BUF_SIZE) { -+ dev_err(&hif_dev->udev->dev, -+ "ath9k_htc: invalid pkt_len (%x)\n", pkt_len); -+ RX_STAT_INC(skb_dropped); -+ return; -+ } -+ - pad_len = 4 - (pkt_len & 0x3); - if (pad_len == 4) - pad_len = 0; -diff --git a/drivers/net/wireless/ath/wcn36xx/dxe.c b/drivers/net/wireless/ath/wcn36xx/dxe.c -index 4da25e84793b7..c400261352bc8 100644 ---- a/drivers/net/wireless/ath/wcn36xx/dxe.c -+++ b/drivers/net/wireless/ath/wcn36xx/dxe.c -@@ -952,4 +952,9 @@ void wcn36xx_dxe_deinit(struct wcn36xx *wcn) - - wcn36xx_dxe_ch_free_skbs(wcn, &wcn->dxe_rx_l_ch); - wcn36xx_dxe_ch_free_skbs(wcn, &wcn->dxe_rx_h_ch); -+ -+ wcn36xx_dxe_deinit_descs(wcn->dev, &wcn->dxe_tx_l_ch); -+ wcn36xx_dxe_deinit_descs(wcn->dev, &wcn->dxe_tx_h_ch); -+ wcn36xx_dxe_deinit_descs(wcn->dev, &wcn->dxe_rx_l_ch); -+ wcn36xx_dxe_deinit_descs(wcn->dev, &wcn->dxe_rx_h_ch); - } -diff --git a/drivers/net/wireless/ath/wcn36xx/smd.c b/drivers/net/wireless/ath/wcn36xx/smd.c -index a7532028bf9db..74cf173c186ff 100644 ---- a/drivers/net/wireless/ath/wcn36xx/smd.c -+++ b/drivers/net/wireless/ath/wcn36xx/smd.c -@@ -2311,7 +2311,7 @@ static int wcn36xx_smd_missed_beacon_ind(struct wcn36xx *wcn, - wcn36xx_dbg(WCN36XX_DBG_HAL, "beacon missed bss_index %d\n", - tmp->bss_index); - vif = wcn36xx_priv_to_vif(tmp); -- ieee80211_connection_loss(vif); -+ ieee80211_beacon_loss(vif); - } - return 0; - } -@@ -2326,7 +2326,7 @@ static int wcn36xx_smd_missed_beacon_ind(struct wcn36xx *wcn, - wcn36xx_dbg(WCN36XX_DBG_HAL, "beacon missed bss_index %d\n", - rsp->bss_index); - vif = wcn36xx_priv_to_vif(tmp); -- ieee80211_connection_loss(vif); -+ ieee80211_beacon_loss(vif); - return 0; - } - } -diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c -index e68366f248fe3..83cb2ad03451b 100644 ---- a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c -+++ b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c -@@ -183,6 +183,9 @@ static void iwl_dealloc_ucode(struct iwl_drv *drv) - - for (i = 0; i < IWL_UCODE_TYPE_MAX; i++) - iwl_free_fw_img(drv, drv->fw.img + i); -+ -+ /* clear the data for the aborted load case */ -+ memset(&drv->fw, 0, sizeof(drv->fw)); - } - - static int iwl_alloc_fw_desc(struct iwl_drv *drv, struct fw_desc *desc, -@@ -1338,6 +1341,7 @@ static void iwl_req_fw_callback(const struct firmware *ucode_raw, void *context) - int i; - bool load_module = false; - bool usniffer_images = false; -+ bool failure = true; - - fw->ucode_capa.max_probe_length = IWL_DEFAULT_MAX_PROBE_LENGTH; - fw->ucode_capa.standard_phy_calibration_size = -@@ -1595,15 +1599,9 @@ static void iwl_req_fw_callback(const struct firmware *ucode_raw, void *context) - * else from proceeding if the module fails to load - * or hangs loading. - */ -- if (load_module) { -+ if (load_module) - request_module("%s", op->name); --#ifdef CONFIG_IWLWIFI_OPMODE_MODULAR -- if (err) -- IWL_ERR(drv, -- "failed to load module %s (error %d), is dynamic loading enabled?\n", -- op->name, err); --#endif -- } -+ failure = false; - goto free; - - try_again: -@@ -1619,6 +1617,9 @@ static void iwl_req_fw_callback(const struct firmware *ucode_raw, void *context) - complete(&drv->request_firmware_complete); - device_release_driver(drv->trans->dev); - free: -+ if (failure) -+ iwl_dealloc_ucode(drv); -+ - if (pieces) { - for (i = 0; i < ARRAY_SIZE(pieces->img); i++) - kfree(pieces->img[i].sec); -diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c -index c942255aa1dbc..29ad7804d77aa 100644 ---- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c -+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c -@@ -1696,6 +1696,7 @@ static void iwl_mvm_recalc_multicast(struct iwl_mvm *mvm) - struct iwl_mvm_mc_iter_data iter_data = { - .mvm = mvm, - }; -+ int ret; - - lockdep_assert_held(&mvm->mutex); - -@@ -1705,6 +1706,22 @@ static void iwl_mvm_recalc_multicast(struct iwl_mvm *mvm) - ieee80211_iterate_active_interfaces_atomic( - mvm->hw, IEEE80211_IFACE_ITER_NORMAL, - iwl_mvm_mc_iface_iterator, &iter_data); -+ -+ /* -+ * Send a (synchronous) ech command so that we wait for the -+ * multiple asynchronous MCAST_FILTER_CMD commands sent by -+ * the interface iterator. Otherwise, we might get here over -+ * and over again (by userspace just sending a lot of these) -+ * and the CPU can send them faster than the firmware can -+ * process them. -+ * Note that the CPU is still faster - but with this we'll -+ * actually send fewer commands overall because the CPU will -+ * not schedule the work in mac80211 as frequently if it's -+ * still running when rescheduled (possibly multiple times). -+ */ -+ ret = iwl_mvm_send_cmd_pdu(mvm, ECHO_CMD, 0, 0, NULL); -+ if (ret) -+ IWL_ERR(mvm, "Failed to synchronize multicast groups update\n"); - } - - static u64 iwl_mvm_prepare_multicast(struct ieee80211_hw *hw, -diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c -index a6e2a30eb3109..52c6edc621ced 100644 ---- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c -+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c -@@ -177,12 +177,39 @@ static int iwl_mvm_create_skb(struct iwl_mvm *mvm, struct sk_buff *skb, - struct iwl_rx_mpdu_desc *desc = (void *)pkt->data; - unsigned int headlen, fraglen, pad_len = 0; - unsigned int hdrlen = ieee80211_hdrlen(hdr->frame_control); -+ u8 mic_crc_len = u8_get_bits(desc->mac_flags1, -+ IWL_RX_MPDU_MFLG1_MIC_CRC_LEN_MASK) << 1; - - if (desc->mac_flags2 & IWL_RX_MPDU_MFLG2_PAD) { - len -= 2; - pad_len = 2; - } - -+ /* -+ * For non monitor interface strip the bytes the RADA might not have -+ * removed. As monitor interface cannot exist with other interfaces -+ * this removal is safe. -+ */ -+ if (mic_crc_len && !ieee80211_hw_check(mvm->hw, RX_INCLUDES_FCS)) { -+ u32 pkt_flags = le32_to_cpu(pkt->len_n_flags); -+ -+ /* -+ * If RADA was not enabled then decryption was not performed so -+ * the MIC cannot be removed. -+ */ -+ if (!(pkt_flags & FH_RSCSR_RADA_EN)) { -+ if (WARN_ON(crypt_len > mic_crc_len)) -+ return -EINVAL; -+ -+ mic_crc_len -= crypt_len; -+ } -+ -+ if (WARN_ON(mic_crc_len > len)) -+ return -EINVAL; -+ -+ len -= mic_crc_len; -+ } -+ - /* If frame is small enough to fit in skb->head, pull it completely. - * If not, only pull ieee80211_hdr (including crypto if present, and - * an additional 8 bytes for SNAP/ethertype, see below) so that -diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c -index 8aa567d7912c2..3a58267d3d710 100644 ---- a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c -+++ b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c -@@ -1700,7 +1700,7 @@ static int iwl_mvm_check_running_scans(struct iwl_mvm *mvm, int type) - return -EIO; - } - --#define SCAN_TIMEOUT 20000 -+#define SCAN_TIMEOUT 30000 - - void iwl_mvm_scan_timeout_wk(struct work_struct *work) - { -diff --git a/drivers/net/wireless/marvell/mwifiex/sta_event.c b/drivers/net/wireless/marvell/mwifiex/sta_event.c -index 5fdffb114913d..fd12093863801 100644 ---- a/drivers/net/wireless/marvell/mwifiex/sta_event.c -+++ b/drivers/net/wireless/marvell/mwifiex/sta_event.c -@@ -364,10 +364,12 @@ static void mwifiex_process_uap_tx_pause(struct mwifiex_private *priv, - sta_ptr = mwifiex_get_sta_entry(priv, tp->peermac); - if (sta_ptr && sta_ptr->tx_pause != tp->tx_pause) { - sta_ptr->tx_pause = tp->tx_pause; -+ spin_unlock_bh(&priv->sta_list_spinlock); - mwifiex_update_ralist_tx_pause(priv, tp->peermac, - tp->tx_pause); -+ } else { -+ spin_unlock_bh(&priv->sta_list_spinlock); - } -- spin_unlock_bh(&priv->sta_list_spinlock); - } - } - -@@ -399,11 +401,13 @@ static void mwifiex_process_sta_tx_pause(struct mwifiex_private *priv, - sta_ptr = mwifiex_get_sta_entry(priv, tp->peermac); - if (sta_ptr && sta_ptr->tx_pause != tp->tx_pause) { - sta_ptr->tx_pause = tp->tx_pause; -+ spin_unlock_bh(&priv->sta_list_spinlock); - mwifiex_update_ralist_tx_pause(priv, - tp->peermac, - tp->tx_pause); -+ } else { -+ spin_unlock_bh(&priv->sta_list_spinlock); - } -- spin_unlock_bh(&priv->sta_list_spinlock); - } - } - } -diff --git a/drivers/net/wireless/marvell/mwifiex/usb.c b/drivers/net/wireless/marvell/mwifiex/usb.c -index cb8a9ad40cfe9..39cf713d5054c 100644 ---- a/drivers/net/wireless/marvell/mwifiex/usb.c -+++ b/drivers/net/wireless/marvell/mwifiex/usb.c -@@ -130,7 +130,8 @@ static int mwifiex_usb_recv(struct mwifiex_adapter *adapter, - default: - mwifiex_dbg(adapter, ERROR, - "unknown recv_type %#x\n", recv_type); -- return -1; -+ ret = -1; -+ goto exit_restore_skb; - } - break; - case MWIFIEX_USB_EP_DATA: -diff --git a/drivers/net/wireless/rsi/rsi_91x_main.c b/drivers/net/wireless/rsi/rsi_91x_main.c -index 441fda71f6289..d92337169ee3a 100644 ---- a/drivers/net/wireless/rsi/rsi_91x_main.c -+++ b/drivers/net/wireless/rsi/rsi_91x_main.c -@@ -23,6 +23,7 @@ - #include "rsi_common.h" - #include "rsi_coex.h" - #include "rsi_hal.h" -+#include "rsi_usb.h" - - u32 rsi_zone_enabled = /* INFO_ZONE | - INIT_ZONE | -@@ -167,6 +168,9 @@ int rsi_read_pkt(struct rsi_common *common, u8 *rx_pkt, s32 rcv_pkt_len) - frame_desc = &rx_pkt[index]; - actual_length = *(u16 *)&frame_desc[0]; - offset = *(u16 *)&frame_desc[2]; -+ if (!rcv_pkt_len && offset > -+ RSI_MAX_RX_USB_PKT_SIZE - FRAME_DESC_SZ) -+ goto fail; - - queueno = rsi_get_queueno(frame_desc, offset); - length = rsi_get_length(frame_desc, offset); -diff --git a/drivers/net/wireless/rsi/rsi_91x_usb.c b/drivers/net/wireless/rsi/rsi_91x_usb.c -index 68ce3d2bc5357..94bf2a7ca635d 100644 ---- a/drivers/net/wireless/rsi/rsi_91x_usb.c -+++ b/drivers/net/wireless/rsi/rsi_91x_usb.c -@@ -261,8 +261,12 @@ static void rsi_rx_done_handler(struct urb *urb) - struct rsi_91x_usbdev *dev = (struct rsi_91x_usbdev *)rx_cb->data; - int status = -EINVAL; - -+ if (!rx_cb->rx_skb) -+ return; -+ - if (urb->status) { - dev_kfree_skb(rx_cb->rx_skb); -+ rx_cb->rx_skb = NULL; - return; - } - -@@ -286,8 +290,10 @@ out: - if (rsi_rx_urb_submit(dev->priv, rx_cb->ep_num, GFP_ATOMIC)) - rsi_dbg(ERR_ZONE, "%s: Failed in urb submission", __func__); - -- if (status) -+ if (status) { - dev_kfree_skb(rx_cb->rx_skb); -+ rx_cb->rx_skb = NULL; -+ } - } - - static void rsi_rx_urb_kill(struct rsi_hw *adapter, u8 ep_num) -@@ -314,7 +320,6 @@ static int rsi_rx_urb_submit(struct rsi_hw *adapter, u8 ep_num, gfp_t mem_flags) - struct sk_buff *skb; - u8 dword_align_bytes = 0; - --#define RSI_MAX_RX_USB_PKT_SIZE 3000 - skb = dev_alloc_skb(RSI_MAX_RX_USB_PKT_SIZE); - if (!skb) - return -ENOMEM; -diff --git a/drivers/net/wireless/rsi/rsi_usb.h b/drivers/net/wireless/rsi/rsi_usb.h -index 8702f434b5699..ad88f8c70a351 100644 ---- a/drivers/net/wireless/rsi/rsi_usb.h -+++ b/drivers/net/wireless/rsi/rsi_usb.h -@@ -44,6 +44,8 @@ - #define RSI_USB_BUF_SIZE 4096 - #define RSI_USB_CTRL_BUF_SIZE 0x04 - -+#define RSI_MAX_RX_USB_PKT_SIZE 3000 -+ - struct rx_usb_ctrl_block { - u8 *data; - struct urb *rx_urb; -diff --git a/drivers/of/base.c b/drivers/of/base.c -index 1d667eb730e19..b5c84607a74bf 100644 ---- a/drivers/of/base.c -+++ b/drivers/of/base.c -@@ -1366,9 +1366,14 @@ int of_phandle_iterator_next(struct of_phandle_iterator *it) - * property data length - */ - if (it->cur + count > it->list_end) { -- pr_err("%pOF: %s = %d found %d\n", -- it->parent, it->cells_name, -- count, it->cell_count); -+ if (it->cells_name) -+ pr_err("%pOF: %s = %d found %td\n", -+ it->parent, it->cells_name, -+ count, it->list_end - it->cur); -+ else -+ pr_err("%pOF: phandle %s needs %d, found %td\n", -+ it->parent, of_node_full_name(it->node), -+ count, it->list_end - it->cur); - goto err; - } - } -diff --git a/drivers/parisc/pdc_stable.c b/drivers/parisc/pdc_stable.c -index e090978518f1a..4760f82def6ec 100644 ---- a/drivers/parisc/pdc_stable.c -+++ b/drivers/parisc/pdc_stable.c -@@ -979,8 +979,10 @@ pdcs_register_pathentries(void) - entry->kobj.kset = paths_kset; - err = kobject_init_and_add(&entry->kobj, &ktype_pdcspath, NULL, - "%s", entry->name); -- if (err) -+ if (err) { -+ kobject_put(&entry->kobj); - return err; -+ } - - /* kobject is now registered */ - write_lock(&entry->rw_lock); -diff --git a/drivers/pci/controller/pci-aardvark.c b/drivers/pci/controller/pci-aardvark.c -index 9e208294946cd..d2f8cd3a9568b 100644 ---- a/drivers/pci/controller/pci-aardvark.c -+++ b/drivers/pci/controller/pci-aardvark.c -@@ -863,7 +863,6 @@ advk_pci_bridge_emul_pcie_conf_read(struct pci_bridge_emul *bridge, - return PCI_BRIDGE_EMUL_HANDLED; - } - -- case PCI_CAP_LIST_ID: - case PCI_EXP_DEVCAP: - case PCI_EXP_DEVCTL: - *value = advk_readl(pcie, PCIE_CORE_PCIEXP_CAP + reg); -@@ -944,6 +943,9 @@ static int advk_sw_pci_bridge_init(struct advk_pcie *pcie) - /* Support interrupt A for MSI feature */ - bridge->conf.intpin = PCIE_CORE_INT_A_ASSERT_ENABLE; - -+ /* Aardvark HW provides PCIe Capability structure in version 2 */ -+ bridge->pcie_conf.cap = cpu_to_le16(2); -+ - /* Indicates supports for Completion Retry Status */ - bridge->pcie_conf.rootcap = cpu_to_le16(PCI_EXP_RTCAP_CRSVIS); - -diff --git a/drivers/pci/controller/pci-mvebu.c b/drivers/pci/controller/pci-mvebu.c -index 5a2483e125a3f..09af97083ac09 100644 ---- a/drivers/pci/controller/pci-mvebu.c -+++ b/drivers/pci/controller/pci-mvebu.c -@@ -576,6 +576,8 @@ struct pci_bridge_emul_ops mvebu_pci_bridge_emul_ops = { - static void mvebu_pci_bridge_emul_init(struct mvebu_pcie_port *port) - { - struct pci_bridge_emul *bridge = &port->bridge; -+ u32 pcie_cap = mvebu_readl(port, PCIE_CAP_PCIEXP); -+ u8 pcie_cap_ver = ((pcie_cap >> 16) & PCI_EXP_FLAGS_VERS); - - bridge->conf.vendor = PCI_VENDOR_ID_MARVELL; - bridge->conf.device = mvebu_readl(port, PCIE_DEV_ID_OFF) >> 16; -@@ -588,6 +590,12 @@ static void mvebu_pci_bridge_emul_init(struct mvebu_pcie_port *port) - bridge->conf.iolimit = PCI_IO_RANGE_TYPE_32; - } - -+ /* -+ * Older mvebu hardware provides PCIe Capability structure only in -+ * version 1. New hardware provides it in version 2. -+ */ -+ bridge->pcie_conf.cap = cpu_to_le16(pcie_cap_ver); -+ - bridge->has_pcie = true; - bridge->data = port; - bridge->ops = &mvebu_pci_bridge_emul_ops; -diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c -index 7dc10c2b4785d..715c85d4e688d 100644 ---- a/drivers/pci/msi.c -+++ b/drivers/pci/msi.c -@@ -1294,19 +1294,24 @@ EXPORT_SYMBOL(pci_free_irq_vectors); - - /** - * pci_irq_vector - return Linux IRQ number of a device vector -- * @dev: PCI device to operate on -- * @nr: device-relative interrupt vector index (0-based). -+ * @dev: PCI device to operate on -+ * @nr: Interrupt vector index (0-based) -+ * -+ * @nr has the following meanings depending on the interrupt mode: -+ * MSI-X: The index in the MSI-X vector table -+ * MSI: The index of the enabled MSI vectors -+ * INTx: Must be 0 -+ * -+ * Return: The Linux interrupt number or -EINVAl if @nr is out of range. - */ - int pci_irq_vector(struct pci_dev *dev, unsigned int nr) - { - if (dev->msix_enabled) { - struct msi_desc *entry; -- int i = 0; - - for_each_pci_msi_entry(entry, dev) { -- if (i == nr) -+ if (entry->msi_attrib.entry_nr == nr) - return entry->irq; -- i++; - } - WARN_ON_ONCE(1); - return -EINVAL; -@@ -1330,17 +1335,22 @@ EXPORT_SYMBOL(pci_irq_vector); - * pci_irq_get_affinity - return the affinity of a particular MSI vector - * @dev: PCI device to operate on - * @nr: device-relative interrupt vector index (0-based). -+ * -+ * @nr has the following meanings depending on the interrupt mode: -+ * MSI-X: The index in the MSI-X vector table -+ * MSI: The index of the enabled MSI vectors -+ * INTx: Must be 0 -+ * -+ * Return: A cpumask pointer or NULL if @nr is out of range - */ - const struct cpumask *pci_irq_get_affinity(struct pci_dev *dev, int nr) - { - if (dev->msix_enabled) { - struct msi_desc *entry; -- int i = 0; - - for_each_pci_msi_entry(entry, dev) { -- if (i == nr) -+ if (entry->msi_attrib.entry_nr == nr) - return &entry->affinity->mask; -- i++; - } - WARN_ON_ONCE(1); - return NULL; -diff --git a/drivers/pci/pci-bridge-emul.c b/drivers/pci/pci-bridge-emul.c -index 3026346ccb18c..0ca3b5eef53a7 100644 ---- a/drivers/pci/pci-bridge-emul.c -+++ b/drivers/pci/pci-bridge-emul.c -@@ -287,11 +287,9 @@ int pci_bridge_emul_init(struct pci_bridge_emul *bridge, - - if (bridge->has_pcie) { - bridge->conf.capabilities_pointer = PCI_CAP_PCIE_START; -+ bridge->conf.status |= cpu_to_le16(PCI_STATUS_CAP_LIST); - bridge->pcie_conf.cap_id = PCI_CAP_ID_EXP; -- /* Set PCIe v2, root port, slot support */ -- bridge->pcie_conf.cap = -- cpu_to_le16(PCI_EXP_TYPE_ROOT_PORT << 4 | 2 | -- PCI_EXP_FLAGS_SLOT); -+ bridge->pcie_conf.cap |= cpu_to_le16(PCI_EXP_TYPE_ROOT_PORT << 4); - bridge->pcie_cap_regs_behavior = - kmemdup(pcie_cap_regs_behavior, - sizeof(pcie_cap_regs_behavior), -@@ -300,6 +298,27 @@ int pci_bridge_emul_init(struct pci_bridge_emul *bridge, - kfree(bridge->pci_regs_behavior); - return -ENOMEM; - } -+ /* These bits are applicable only for PCI and reserved on PCIe */ -+ bridge->pci_regs_behavior[PCI_CACHE_LINE_SIZE / 4].ro &= -+ ~GENMASK(15, 8); -+ bridge->pci_regs_behavior[PCI_COMMAND / 4].ro &= -+ ~((PCI_COMMAND_SPECIAL | PCI_COMMAND_INVALIDATE | -+ PCI_COMMAND_VGA_PALETTE | PCI_COMMAND_WAIT | -+ PCI_COMMAND_FAST_BACK) | -+ (PCI_STATUS_66MHZ | PCI_STATUS_FAST_BACK | -+ PCI_STATUS_DEVSEL_MASK) << 16); -+ bridge->pci_regs_behavior[PCI_PRIMARY_BUS / 4].ro &= -+ ~GENMASK(31, 24); -+ bridge->pci_regs_behavior[PCI_IO_BASE / 4].ro &= -+ ~((PCI_STATUS_66MHZ | PCI_STATUS_FAST_BACK | -+ PCI_STATUS_DEVSEL_MASK) << 16); -+ bridge->pci_regs_behavior[PCI_INTERRUPT_LINE / 4].rw &= -+ ~((PCI_BRIDGE_CTL_MASTER_ABORT | -+ BIT(8) | BIT(9) | BIT(11)) << 16); -+ bridge->pci_regs_behavior[PCI_INTERRUPT_LINE / 4].ro &= -+ ~((PCI_BRIDGE_CTL_FAST_BACK) << 16); -+ bridge->pci_regs_behavior[PCI_INTERRUPT_LINE / 4].w1c &= -+ ~(BIT(10) << 16); - } - - if (flags & PCI_BRIDGE_EMUL_NO_PREFETCHABLE_BAR) { -diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c -index cf3986d4413f7..2a4bc8df85639 100644 ---- a/drivers/pci/quirks.c -+++ b/drivers/pci/quirks.c -@@ -4134,6 +4134,9 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9120, - quirk_dma_func1_alias); - DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9123, - quirk_dma_func1_alias); -+/* https://bugzilla.kernel.org/show_bug.cgi?id=42679#c136 */ -+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9125, -+ quirk_dma_func1_alias); - DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9128, - quirk_dma_func1_alias); - /* https://bugzilla.kernel.org/show_bug.cgi?id=42679#c14 */ -diff --git a/drivers/pcmcia/cs.c b/drivers/pcmcia/cs.c -index e211e2619680c..f70197154a362 100644 ---- a/drivers/pcmcia/cs.c -+++ b/drivers/pcmcia/cs.c -@@ -666,18 +666,16 @@ static int pccardd(void *__skt) - if (events || sysfs_events) - continue; - -+ set_current_state(TASK_INTERRUPTIBLE); - if (kthread_should_stop()) - break; - -- set_current_state(TASK_INTERRUPTIBLE); -- - schedule(); - -- /* make sure we are running */ -- __set_current_state(TASK_RUNNING); -- - try_to_freeze(); - } -+ /* make sure we are running before we exit */ -+ __set_current_state(TASK_RUNNING); - - /* shut down socket, if a device is still present */ - if (skt->state & SOCKET_PRESENT) { -diff --git a/drivers/pcmcia/rsrc_nonstatic.c b/drivers/pcmcia/rsrc_nonstatic.c -index 9e6922c08ef62..3a512513cb32f 100644 ---- a/drivers/pcmcia/rsrc_nonstatic.c -+++ b/drivers/pcmcia/rsrc_nonstatic.c -@@ -690,6 +690,9 @@ static struct resource *__nonstatic_find_io_region(struct pcmcia_socket *s, - unsigned long min = base; - int ret; - -+ if (!res) -+ return NULL; -+ - data.mask = align - 1; - data.offset = base & data.mask; - data.map = &s_data->io_db; -@@ -809,6 +812,9 @@ static struct resource *nonstatic_find_mem_region(u_long base, u_long num, - unsigned long min, max; - int ret, i, j; - -+ if (!res) -+ return NULL; -+ - low = low || !(s->features & SS_CAP_PAGE_REGS); - - data.mask = align - 1; -diff --git a/drivers/phy/socionext/phy-uniphier-usb3ss.c b/drivers/phy/socionext/phy-uniphier-usb3ss.c -index a7577e316baf5..e63648b5c7547 100644 ---- a/drivers/phy/socionext/phy-uniphier-usb3ss.c -+++ b/drivers/phy/socionext/phy-uniphier-usb3ss.c -@@ -22,11 +22,13 @@ - #include - - #define SSPHY_TESTI 0x0 --#define SSPHY_TESTO 0x4 - #define TESTI_DAT_MASK GENMASK(13, 6) - #define TESTI_ADR_MASK GENMASK(5, 1) - #define TESTI_WR_EN BIT(0) - -+#define SSPHY_TESTO 0x4 -+#define TESTO_DAT_MASK GENMASK(7, 0) -+ - #define PHY_F(regno, msb, lsb) { (regno), (msb), (lsb) } - - #define CDR_CPD_TRIM PHY_F(7, 3, 0) /* RxPLL charge pump current */ -@@ -84,12 +86,12 @@ static void uniphier_u3ssphy_set_param(struct uniphier_u3ssphy_priv *priv, - val = FIELD_PREP(TESTI_DAT_MASK, 1); - val |= FIELD_PREP(TESTI_ADR_MASK, p->field.reg_no); - uniphier_u3ssphy_testio_write(priv, val); -- val = readl(priv->base + SSPHY_TESTO); -+ val = readl(priv->base + SSPHY_TESTO) & TESTO_DAT_MASK; - - /* update value */ -- val &= ~FIELD_PREP(TESTI_DAT_MASK, field_mask); -+ val &= ~field_mask; - data = field_mask & (p->value << p->field.lsb); -- val = FIELD_PREP(TESTI_DAT_MASK, data); -+ val = FIELD_PREP(TESTI_DAT_MASK, data | val); - val |= FIELD_PREP(TESTI_ADR_MASK, p->field.reg_no); - uniphier_u3ssphy_testio_write(priv, val); - uniphier_u3ssphy_testio_write(priv, val | TESTI_WR_EN); -diff --git a/drivers/power/supply/bq25890_charger.c b/drivers/power/supply/bq25890_charger.c -index 9d1ec8d677de6..5afe55119fe65 100644 ---- a/drivers/power/supply/bq25890_charger.c -+++ b/drivers/power/supply/bq25890_charger.c -@@ -531,12 +531,12 @@ static void bq25890_handle_state_change(struct bq25890_device *bq, - - if (!new_state->online) { /* power removed */ - /* disable ADC */ -- ret = bq25890_field_write(bq, F_CONV_START, 0); -+ ret = bq25890_field_write(bq, F_CONV_RATE, 0); - if (ret < 0) - goto error; - } else if (!old_state.online) { /* power inserted */ - /* enable ADC, to have control of charge current/voltage */ -- ret = bq25890_field_write(bq, F_CONV_START, 1); -+ ret = bq25890_field_write(bq, F_CONV_RATE, 1); - if (ret < 0) - goto error; - } -diff --git a/drivers/regulator/qcom_smd-regulator.c b/drivers/regulator/qcom_smd-regulator.c -index 3b0828c79e2b5..e6601c28ab431 100644 ---- a/drivers/regulator/qcom_smd-regulator.c -+++ b/drivers/regulator/qcom_smd-regulator.c -@@ -9,6 +9,7 @@ - #include - #include - #include -+#include - #include - - struct qcom_rpm_reg { -@@ -776,52 +777,91 @@ static const struct of_device_id rpm_of_match[] = { - }; - MODULE_DEVICE_TABLE(of, rpm_of_match); - --static int rpm_reg_probe(struct platform_device *pdev) -+/** -+ * rpm_regulator_init_vreg() - initialize all attributes of a qcom_smd-regulator -+ * @vreg: Pointer to the individual qcom_smd-regulator resource -+ * @dev: Pointer to the top level qcom_smd-regulator PMIC device -+ * @node: Pointer to the individual qcom_smd-regulator resource -+ * device node -+ * @rpm: Pointer to the rpm bus node -+ * @pmic_rpm_data: Pointer to a null-terminated array of qcom_smd-regulator -+ * resources defined for the top level PMIC device -+ * -+ * Return: 0 on success, errno on failure -+ */ -+static int rpm_regulator_init_vreg(struct qcom_rpm_reg *vreg, struct device *dev, -+ struct device_node *node, struct qcom_smd_rpm *rpm, -+ const struct rpm_regulator_data *pmic_rpm_data) - { -- const struct rpm_regulator_data *reg; -- const struct of_device_id *match; -- struct regulator_config config = { }; -+ struct regulator_config config = {}; -+ const struct rpm_regulator_data *rpm_data; - struct regulator_dev *rdev; -+ int ret; -+ -+ for (rpm_data = pmic_rpm_data; rpm_data->name; rpm_data++) -+ if (of_node_name_eq(node, rpm_data->name)) -+ break; -+ -+ if (!rpm_data->name) { -+ dev_err(dev, "Unknown regulator %pOFn\n", node); -+ return -EINVAL; -+ } -+ -+ vreg->dev = dev; -+ vreg->rpm = rpm; -+ vreg->type = rpm_data->type; -+ vreg->id = rpm_data->id; -+ -+ memcpy(&vreg->desc, rpm_data->desc, sizeof(vreg->desc)); -+ vreg->desc.name = rpm_data->name; -+ vreg->desc.supply_name = rpm_data->supply; -+ vreg->desc.owner = THIS_MODULE; -+ vreg->desc.type = REGULATOR_VOLTAGE; -+ vreg->desc.of_match = rpm_data->name; -+ -+ config.dev = dev; -+ config.of_node = node; -+ config.driver_data = vreg; -+ -+ rdev = devm_regulator_register(dev, &vreg->desc, &config); -+ if (IS_ERR(rdev)) { -+ ret = PTR_ERR(rdev); -+ dev_err(dev, "%pOFn: devm_regulator_register() failed, ret=%d\n", node, ret); -+ return ret; -+ } -+ -+ return 0; -+} -+ -+static int rpm_reg_probe(struct platform_device *pdev) -+{ -+ struct device *dev = &pdev->dev; -+ const struct rpm_regulator_data *vreg_data; -+ struct device_node *node; - struct qcom_rpm_reg *vreg; - struct qcom_smd_rpm *rpm; -+ int ret; - - rpm = dev_get_drvdata(pdev->dev.parent); - if (!rpm) { -- dev_err(&pdev->dev, "unable to retrieve handle to rpm\n"); -+ dev_err(&pdev->dev, "Unable to retrieve handle to rpm\n"); - return -ENODEV; - } - -- match = of_match_device(rpm_of_match, &pdev->dev); -- if (!match) { -- dev_err(&pdev->dev, "failed to match device\n"); -+ vreg_data = of_device_get_match_data(dev); -+ if (!vreg_data) - return -ENODEV; -- } - -- for (reg = match->data; reg->name; reg++) { -+ for_each_available_child_of_node(dev->of_node, node) { - vreg = devm_kzalloc(&pdev->dev, sizeof(*vreg), GFP_KERNEL); - if (!vreg) - return -ENOMEM; - -- vreg->dev = &pdev->dev; -- vreg->type = reg->type; -- vreg->id = reg->id; -- vreg->rpm = rpm; -- -- memcpy(&vreg->desc, reg->desc, sizeof(vreg->desc)); -- -- vreg->desc.id = -1; -- vreg->desc.owner = THIS_MODULE; -- vreg->desc.type = REGULATOR_VOLTAGE; -- vreg->desc.name = reg->name; -- vreg->desc.supply_name = reg->supply; -- vreg->desc.of_match = reg->name; -- -- config.dev = &pdev->dev; -- config.driver_data = vreg; -- rdev = devm_regulator_register(&pdev->dev, &vreg->desc, &config); -- if (IS_ERR(rdev)) { -- dev_err(&pdev->dev, "failed to register %s\n", reg->name); -- return PTR_ERR(rdev); -+ ret = rpm_regulator_init_vreg(vreg, dev, node, rpm, vreg_data); -+ -+ if (ret < 0) { -+ of_node_put(node); -+ return ret; - } - } - -diff --git a/drivers/rpmsg/rpmsg_core.c b/drivers/rpmsg/rpmsg_core.c -index e330ec4dfc337..c1d4990beab02 100644 ---- a/drivers/rpmsg/rpmsg_core.c -+++ b/drivers/rpmsg/rpmsg_core.c -@@ -473,13 +473,25 @@ static int rpmsg_dev_probe(struct device *dev) - err = rpdrv->probe(rpdev); - if (err) { - dev_err(dev, "%s: failed: %d\n", __func__, err); -- if (ept) -- rpmsg_destroy_ept(ept); -- goto out; -+ goto destroy_ept; - } - -- if (ept && rpdev->ops->announce_create) -+ if (ept && rpdev->ops->announce_create) { - err = rpdev->ops->announce_create(rpdev); -+ if (err) { -+ dev_err(dev, "failed to announce creation\n"); -+ goto remove_rpdev; -+ } -+ } -+ -+ return 0; -+ -+remove_rpdev: -+ if (rpdrv->remove) -+ rpdrv->remove(rpdev); -+destroy_ept: -+ if (ept) -+ rpmsg_destroy_ept(ept); - out: - return err; - } -diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c -index cb28bbdc9e17f..c0dc03ffa8173 100644 ---- a/drivers/rtc/rtc-cmos.c -+++ b/drivers/rtc/rtc-cmos.c -@@ -463,7 +463,10 @@ static int cmos_set_alarm(struct device *dev, struct rtc_wkalrm *t) - min = t->time.tm_min; - sec = t->time.tm_sec; - -+ spin_lock_irq(&rtc_lock); - rtc_control = CMOS_READ(RTC_CONTROL); -+ spin_unlock_irq(&rtc_lock); -+ - if (!(rtc_control & RTC_DM_BINARY) || RTC_ALWAYS_BCD) { - /* Writing 0xff means "don't care" or "match all". */ - mon = (mon <= 12) ? bin2bcd(mon) : 0xff; -diff --git a/drivers/rtc/rtc-pxa.c b/drivers/rtc/rtc-pxa.c -index d2f1d8f754bf3..cf8119b6d3204 100644 ---- a/drivers/rtc/rtc-pxa.c -+++ b/drivers/rtc/rtc-pxa.c -@@ -330,6 +330,10 @@ static int __init pxa_rtc_probe(struct platform_device *pdev) - if (sa1100_rtc->irq_alarm < 0) - return -ENXIO; - -+ sa1100_rtc->rtc = devm_rtc_allocate_device(&pdev->dev); -+ if (IS_ERR(sa1100_rtc->rtc)) -+ return PTR_ERR(sa1100_rtc->rtc); -+ - pxa_rtc->base = devm_ioremap(dev, pxa_rtc->ress->start, - resource_size(pxa_rtc->ress)); - if (!pxa_rtc->base) { -diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h -index 8943d42fc406e..0b69f4f713778 100644 ---- a/drivers/scsi/lpfc/lpfc.h -+++ b/drivers/scsi/lpfc/lpfc.h -@@ -735,7 +735,6 @@ struct lpfc_hba { - #define HBA_DEVLOSS_TMO 0x2000 /* HBA in devloss timeout */ - #define HBA_RRQ_ACTIVE 0x4000 /* process the rrq active list */ - #define HBA_IOQ_FLUSH 0x8000 /* FCP/NVME I/O queues being flushed */ --#define HBA_FW_DUMP_OP 0x10000 /* Skips fn reset before FW dump */ - #define HBA_RECOVERABLE_UE 0x20000 /* Firmware supports recoverable UE */ - #define HBA_FORCED_LINK_SPEED 0x40000 /* - * Firmware supports Forced Link Speed -@@ -744,6 +743,7 @@ struct lpfc_hba { - #define HBA_FLOGI_ISSUED 0x100000 /* FLOGI was issued */ - #define HBA_DEFER_FLOGI 0x800000 /* Defer FLOGI till read_sparm cmpl */ - -+ struct completion *fw_dump_cmpl; /* cmpl event tracker for fw_dump */ - uint32_t fcp_ring_in_use; /* When polling test if intr-hndlr active*/ - struct lpfc_dmabuf slim2p; - -diff --git a/drivers/scsi/lpfc/lpfc_attr.c b/drivers/scsi/lpfc/lpfc_attr.c -index f0ecfe565660a..1c541a600149b 100644 ---- a/drivers/scsi/lpfc/lpfc_attr.c -+++ b/drivers/scsi/lpfc/lpfc_attr.c -@@ -1537,25 +1537,25 @@ lpfc_sli4_pdev_reg_request(struct lpfc_hba *phba, uint32_t opcode) - before_fc_flag = phba->pport->fc_flag; - sriov_nr_virtfn = phba->cfg_sriov_nr_virtfn; - -- /* Disable SR-IOV virtual functions if enabled */ -- if (phba->cfg_sriov_nr_virtfn) { -- pci_disable_sriov(pdev); -- phba->cfg_sriov_nr_virtfn = 0; -- } -+ if (opcode == LPFC_FW_DUMP) { -+ init_completion(&online_compl); -+ phba->fw_dump_cmpl = &online_compl; -+ } else { -+ /* Disable SR-IOV virtual functions if enabled */ -+ if (phba->cfg_sriov_nr_virtfn) { -+ pci_disable_sriov(pdev); -+ phba->cfg_sriov_nr_virtfn = 0; -+ } - -- if (opcode == LPFC_FW_DUMP) -- phba->hba_flag |= HBA_FW_DUMP_OP; -+ status = lpfc_do_offline(phba, LPFC_EVT_OFFLINE); - -- status = lpfc_do_offline(phba, LPFC_EVT_OFFLINE); -+ if (status != 0) -+ return status; - -- if (status != 0) { -- phba->hba_flag &= ~HBA_FW_DUMP_OP; -- return status; -+ /* wait for the device to be quiesced before firmware reset */ -+ msleep(100); - } - -- /* wait for the device to be quiesced before firmware reset */ -- msleep(100); -- - reg_val = readl(phba->sli4_hba.conf_regs_memmap_p + - LPFC_CTL_PDEV_CTL_OFFSET); - -@@ -1584,24 +1584,42 @@ lpfc_sli4_pdev_reg_request(struct lpfc_hba *phba, uint32_t opcode) - lpfc_printf_log(phba, KERN_ERR, LOG_SLI, - "3153 Fail to perform the requested " - "access: x%x\n", reg_val); -+ if (phba->fw_dump_cmpl) -+ phba->fw_dump_cmpl = NULL; - return rc; - } - - /* keep the original port state */ -- if (before_fc_flag & FC_OFFLINE_MODE) -- goto out; -- -- init_completion(&online_compl); -- job_posted = lpfc_workq_post_event(phba, &status, &online_compl, -- LPFC_EVT_ONLINE); -- if (!job_posted) -+ if (before_fc_flag & FC_OFFLINE_MODE) { -+ if (phba->fw_dump_cmpl) -+ phba->fw_dump_cmpl = NULL; - goto out; -+ } - -- wait_for_completion(&online_compl); -+ /* Firmware dump will trigger an HA_ERATT event, and -+ * lpfc_handle_eratt_s4 routine already handles bringing the port back -+ * online. -+ */ -+ if (opcode == LPFC_FW_DUMP) { -+ wait_for_completion(phba->fw_dump_cmpl); -+ } else { -+ init_completion(&online_compl); -+ job_posted = lpfc_workq_post_event(phba, &status, &online_compl, -+ LPFC_EVT_ONLINE); -+ if (!job_posted) -+ goto out; - -+ wait_for_completion(&online_compl); -+ } - out: - /* in any case, restore the virtual functions enabled as before */ - if (sriov_nr_virtfn) { -+ /* If fw_dump was performed, first disable to clean up */ -+ if (opcode == LPFC_FW_DUMP) { -+ pci_disable_sriov(pdev); -+ phba->cfg_sriov_nr_virtfn = 0; -+ } -+ - sriov_err = - lpfc_sli_probe_sriov_nr_virtfn(phba, sriov_nr_virtfn); - if (!sriov_err) -diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c -index 0dc1d56ff4709..0abce779fbb13 100644 ---- a/drivers/scsi/lpfc/lpfc_hbadisc.c -+++ b/drivers/scsi/lpfc/lpfc_hbadisc.c -@@ -628,10 +628,16 @@ lpfc_work_done(struct lpfc_hba *phba) - if (phba->pci_dev_grp == LPFC_PCI_DEV_OC) - lpfc_sli4_post_async_mbox(phba); - -- if (ha_copy & HA_ERATT) -+ if (ha_copy & HA_ERATT) { - /* Handle the error attention event */ - lpfc_handle_eratt(phba); - -+ if (phba->fw_dump_cmpl) { -+ complete(phba->fw_dump_cmpl); -+ phba->fw_dump_cmpl = NULL; -+ } -+ } -+ - if (ha_copy & HA_MBATT) - lpfc_sli_handle_mb_event(phba); - -diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c -index 51bab0979527b..bd908dd273078 100644 ---- a/drivers/scsi/lpfc/lpfc_sli.c -+++ b/drivers/scsi/lpfc/lpfc_sli.c -@@ -4498,12 +4498,6 @@ lpfc_sli4_brdreset(struct lpfc_hba *phba) - phba->fcf.fcf_flag = 0; - spin_unlock_irq(&phba->hbalock); - -- /* SLI4 INTF 2: if FW dump is being taken skip INIT_PORT */ -- if (phba->hba_flag & HBA_FW_DUMP_OP) { -- phba->hba_flag &= ~HBA_FW_DUMP_OP; -- return rc; -- } -- - /* Now physically reset the device */ - lpfc_printf_log(phba, KERN_INFO, LOG_INIT, - "0389 Performing PCI function reset!\n"); -diff --git a/drivers/scsi/scsi_debugfs.c b/drivers/scsi/scsi_debugfs.c -index c19ea7ab54cbd..d9a18124cfc9d 100644 ---- a/drivers/scsi/scsi_debugfs.c -+++ b/drivers/scsi/scsi_debugfs.c -@@ -10,6 +10,7 @@ static const char *const scsi_cmd_flags[] = { - SCSI_CMD_FLAG_NAME(TAGGED), - SCSI_CMD_FLAG_NAME(UNCHECKED_ISA_DMA), - SCSI_CMD_FLAG_NAME(INITIALIZED), -+ SCSI_CMD_FLAG_NAME(LAST), - }; - #undef SCSI_CMD_FLAG_NAME - -diff --git a/drivers/scsi/sr.c b/drivers/scsi/sr.c -index 279dea628620d..310da62cda263 100644 ---- a/drivers/scsi/sr.c -+++ b/drivers/scsi/sr.c -@@ -887,7 +887,7 @@ static void get_capabilities(struct scsi_cd *cd) - - - /* allocate transfer buffer */ -- buffer = kmalloc(512, GFP_KERNEL | GFP_DMA); -+ buffer = kmalloc(512, GFP_KERNEL); - if (!buffer) { - sr_printk(KERN_ERR, cd, "out of memory.\n"); - return; -diff --git a/drivers/scsi/sr_vendor.c b/drivers/scsi/sr_vendor.c -index b9db2ec6d0361..996bccadd3866 100644 ---- a/drivers/scsi/sr_vendor.c -+++ b/drivers/scsi/sr_vendor.c -@@ -113,7 +113,7 @@ int sr_set_blocklength(Scsi_CD *cd, int blocklength) - if (cd->vendor == VENDOR_TOSHIBA) - density = (blocklength > 2048) ? 0x81 : 0x83; - -- buffer = kmalloc(512, GFP_KERNEL | GFP_DMA); -+ buffer = kmalloc(512, GFP_KERNEL); - if (!buffer) - return -ENOMEM; - -@@ -161,7 +161,7 @@ int sr_cd_check(struct cdrom_device_info *cdi) - if (cd->cdi.mask & CDC_MULTI_SESSION) - return 0; - -- buffer = kmalloc(512, GFP_KERNEL | GFP_DMA); -+ buffer = kmalloc(512, GFP_KERNEL); - if (!buffer) - return -ENOMEM; - -diff --git a/drivers/scsi/ufs/tc-dwc-g210-pci.c b/drivers/scsi/ufs/tc-dwc-g210-pci.c -index 67a6a61154b71..4e471484539d2 100644 ---- a/drivers/scsi/ufs/tc-dwc-g210-pci.c -+++ b/drivers/scsi/ufs/tc-dwc-g210-pci.c -@@ -135,7 +135,6 @@ tc_dwc_g210_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) - return err; - } - -- pci_set_drvdata(pdev, hba); - pm_runtime_put_noidle(&pdev->dev); - pm_runtime_allow(&pdev->dev); - -diff --git a/drivers/scsi/ufs/ufshcd-pltfrm.c b/drivers/scsi/ufs/ufshcd-pltfrm.c -index 8d40dc918f4e1..10eec501f6b39 100644 ---- a/drivers/scsi/ufs/ufshcd-pltfrm.c -+++ b/drivers/scsi/ufs/ufshcd-pltfrm.c -@@ -436,8 +436,6 @@ int ufshcd_pltfrm_init(struct platform_device *pdev, - goto dealloc_host; - } - -- platform_set_drvdata(pdev, hba); -- - pm_runtime_set_active(&pdev->dev); - pm_runtime_enable(&pdev->dev); - -diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c -index 29c7a76d2c658..ebf7ae1ef70d4 100644 ---- a/drivers/scsi/ufs/ufshcd.c -+++ b/drivers/scsi/ufs/ufshcd.c -@@ -8328,6 +8328,13 @@ int ufshcd_init(struct ufs_hba *hba, void __iomem *mmio_base, unsigned int irq) - struct Scsi_Host *host = hba->host; - struct device *dev = hba->dev; - -+ /* -+ * dev_set_drvdata() must be called before any callbacks are registered -+ * that use dev_get_drvdata() (frequency scaling, clock scaling, hwmon, -+ * sysfs). -+ */ -+ dev_set_drvdata(dev, hba); -+ - if (!mmio_base) { - dev_err(hba->dev, - "Invalid memory reference for mmio_base is NULL\n"); -diff --git a/drivers/soc/mediatek/mtk-scpsys.c b/drivers/soc/mediatek/mtk-scpsys.c -index 75f25f08245fd..71afa2a99b17f 100644 ---- a/drivers/soc/mediatek/mtk-scpsys.c -+++ b/drivers/soc/mediatek/mtk-scpsys.c -@@ -333,12 +333,17 @@ out: - return ret; - } - --static void init_clks(struct platform_device *pdev, struct clk **clk) -+static int init_clks(struct platform_device *pdev, struct clk **clk) - { - int i; - -- for (i = CLK_NONE + 1; i < CLK_MAX; i++) -+ for (i = CLK_NONE + 1; i < CLK_MAX; i++) { - clk[i] = devm_clk_get(&pdev->dev, clk_names[i]); -+ if (IS_ERR(clk[i])) -+ return PTR_ERR(clk[i]); -+ } -+ -+ return 0; - } - - static struct scp *init_scp(struct platform_device *pdev, -@@ -348,7 +353,7 @@ static struct scp *init_scp(struct platform_device *pdev, - { - struct genpd_onecell_data *pd_data; - struct resource *res; -- int i, j; -+ int i, j, ret; - struct scp *scp; - struct clk *clk[CLK_MAX]; - -@@ -403,7 +408,9 @@ static struct scp *init_scp(struct platform_device *pdev, - - pd_data->num_domains = num; - -- init_clks(pdev, clk); -+ ret = init_clks(pdev, clk); -+ if (ret) -+ return ERR_PTR(ret); - - for (i = 0; i < num; i++) { - struct scp_domain *scpd = &scp->domains[i]; -diff --git a/drivers/spi/spi-meson-spifc.c b/drivers/spi/spi-meson-spifc.c -index c7b0399802913..cae934464f3dd 100644 ---- a/drivers/spi/spi-meson-spifc.c -+++ b/drivers/spi/spi-meson-spifc.c -@@ -349,6 +349,7 @@ static int meson_spifc_probe(struct platform_device *pdev) - return 0; - out_clk: - clk_disable_unprepare(spifc->clk); -+ pm_runtime_disable(spifc->dev); - out_err: - spi_master_put(master); - return ret; -diff --git a/drivers/staging/greybus/audio_topology.c b/drivers/staging/greybus/audio_topology.c -index a8cfea957868a..3e2fbcd20598a 100644 ---- a/drivers/staging/greybus/audio_topology.c -+++ b/drivers/staging/greybus/audio_topology.c -@@ -145,6 +145,9 @@ static const char **gb_generate_enum_strings(struct gbaudio_module_info *gb, - - items = le32_to_cpu(gbenum->items); - strings = devm_kcalloc(gb->dev, items, sizeof(char *), GFP_KERNEL); -+ if (!strings) -+ return NULL; -+ - data = gbenum->names; - - for (i = 0; i < items; i++) { -@@ -662,6 +665,8 @@ static int gbaudio_tplg_create_enum_kctl(struct gbaudio_module_info *gb, - /* since count=1, and reg is dummy */ - gbe->max = le32_to_cpu(gb_enum->items); - gbe->texts = gb_generate_enum_strings(gb, gb_enum); -+ if (!gbe->texts) -+ return -ENOMEM; - - /* debug enum info */ - dev_dbg(gb->dev, "Max:%d, name_length:%d\n", gbe->max, -@@ -871,6 +876,8 @@ static int gbaudio_tplg_create_enum_ctl(struct gbaudio_module_info *gb, - /* since count=1, and reg is dummy */ - gbe->max = le32_to_cpu(gb_enum->items); - gbe->texts = gb_generate_enum_strings(gb, gb_enum); -+ if (!gbe->texts) -+ return -ENOMEM; - - /* debug enum info */ - dev_dbg(gb->dev, "Max:%d, name_length:%d\n", gbe->max, -@@ -1081,6 +1088,10 @@ static int gbaudio_tplg_create_widget(struct gbaudio_module_info *module, - csize += le16_to_cpu(gbenum->names_length); - control->texts = (const char * const *) - gb_generate_enum_strings(module, gbenum); -+ if (!control->texts) { -+ ret = -ENOMEM; -+ goto error; -+ } - control->items = le32_to_cpu(gbenum->items); - } else { - csize = sizeof(struct gb_audio_control); -@@ -1190,6 +1201,10 @@ static int gbaudio_tplg_process_kcontrols(struct gbaudio_module_info *module, - csize += le16_to_cpu(gbenum->names_length); - control->texts = (const char * const *) - gb_generate_enum_strings(module, gbenum); -+ if (!control->texts) { -+ ret = -ENOMEM; -+ goto error; -+ } - control->items = le32_to_cpu(gbenum->items); - } else { - csize = sizeof(struct gb_audio_control); -diff --git a/drivers/staging/media/hantro/hantro_drv.c b/drivers/staging/media/hantro/hantro_drv.c -index 32e5966ba5c5f..58cf44045b396 100644 ---- a/drivers/staging/media/hantro/hantro_drv.c -+++ b/drivers/staging/media/hantro/hantro_drv.c -@@ -823,7 +823,7 @@ static int hantro_probe(struct platform_device *pdev) - ret = clk_bulk_prepare(vpu->variant->num_clocks, vpu->clocks); - if (ret) { - dev_err(&pdev->dev, "Failed to prepare clocks\n"); -- return ret; -+ goto err_pm_disable; - } - - ret = v4l2_device_register(&pdev->dev, &vpu->v4l2_dev); -@@ -879,6 +879,7 @@ err_v4l2_unreg: - v4l2_device_unregister(&vpu->v4l2_dev); - err_clk_unprepare: - clk_bulk_unprepare(vpu->variant->num_clocks, vpu->clocks); -+err_pm_disable: - pm_runtime_dont_use_autosuspend(vpu->dev); - pm_runtime_disable(vpu->dev); - return ret; -diff --git a/drivers/staging/rtl8192e/rtllib.h b/drivers/staging/rtl8192e/rtllib.h -index 2eeb9a43734e3..49bf3ad31f912 100644 ---- a/drivers/staging/rtl8192e/rtllib.h -+++ b/drivers/staging/rtl8192e/rtllib.h -@@ -1982,7 +1982,7 @@ void rtllib_softmac_xmit(struct rtllib_txb *txb, struct rtllib_device *ieee); - void rtllib_stop_send_beacons(struct rtllib_device *ieee); - void notify_wx_assoc_event(struct rtllib_device *ieee); - void rtllib_start_ibss(struct rtllib_device *ieee); --void rtllib_softmac_init(struct rtllib_device *ieee); -+int rtllib_softmac_init(struct rtllib_device *ieee); - void rtllib_softmac_free(struct rtllib_device *ieee); - void rtllib_disassociate(struct rtllib_device *ieee); - void rtllib_stop_scan(struct rtllib_device *ieee); -diff --git a/drivers/staging/rtl8192e/rtllib_module.c b/drivers/staging/rtl8192e/rtllib_module.c -index 64d9feee1f392..f00ac94b2639b 100644 ---- a/drivers/staging/rtl8192e/rtllib_module.c -+++ b/drivers/staging/rtl8192e/rtllib_module.c -@@ -88,7 +88,7 @@ struct net_device *alloc_rtllib(int sizeof_priv) - err = rtllib_networks_allocate(ieee); - if (err) { - pr_err("Unable to allocate beacon storage: %d\n", err); -- goto failed; -+ goto free_netdev; - } - rtllib_networks_initialize(ieee); - -@@ -121,11 +121,13 @@ struct net_device *alloc_rtllib(int sizeof_priv) - ieee->hwsec_active = 0; - - memset(ieee->swcamtable, 0, sizeof(struct sw_cam_table) * 32); -- rtllib_softmac_init(ieee); -+ err = rtllib_softmac_init(ieee); -+ if (err) -+ goto free_crypt_info; - - ieee->pHTInfo = kzalloc(sizeof(struct rt_hi_throughput), GFP_KERNEL); - if (!ieee->pHTInfo) -- return NULL; -+ goto free_softmac; - - HTUpdateDefaultSetting(ieee); - HTInitializeHTInfo(ieee); -@@ -141,8 +143,14 @@ struct net_device *alloc_rtllib(int sizeof_priv) - - return dev; - -- failed: -+free_softmac: -+ rtllib_softmac_free(ieee); -+free_crypt_info: -+ lib80211_crypt_info_free(&ieee->crypt_info); -+ rtllib_networks_free(ieee); -+free_netdev: - free_netdev(dev); -+ - return NULL; - } - EXPORT_SYMBOL(alloc_rtllib); -diff --git a/drivers/staging/rtl8192e/rtllib_softmac.c b/drivers/staging/rtl8192e/rtllib_softmac.c -index f2f7529e7c80e..4ff8fd694c600 100644 ---- a/drivers/staging/rtl8192e/rtllib_softmac.c -+++ b/drivers/staging/rtl8192e/rtllib_softmac.c -@@ -2952,7 +2952,7 @@ void rtllib_start_protocol(struct rtllib_device *ieee) - } - } - --void rtllib_softmac_init(struct rtllib_device *ieee) -+int rtllib_softmac_init(struct rtllib_device *ieee) - { - int i; - -@@ -2963,7 +2963,8 @@ void rtllib_softmac_init(struct rtllib_device *ieee) - ieee->seq_ctrl[i] = 0; - ieee->dot11d_info = kzalloc(sizeof(struct rt_dot11d_info), GFP_ATOMIC); - if (!ieee->dot11d_info) -- netdev_err(ieee->dev, "Can't alloc memory for DOT11D\n"); -+ return -ENOMEM; -+ - ieee->LinkDetectInfo.SlotIndex = 0; - ieee->LinkDetectInfo.SlotNum = 2; - ieee->LinkDetectInfo.NumRecvBcnInPeriod = 0; -@@ -3031,6 +3032,7 @@ void rtllib_softmac_init(struct rtllib_device *ieee) - (void(*)(unsigned long)) rtllib_sta_ps, - (unsigned long)ieee); - -+ return 0; - } - - void rtllib_softmac_free(struct rtllib_device *ieee) -diff --git a/drivers/tee/tee_core.c b/drivers/tee/tee_core.c -index 0f16d9ffd8d12..85e0cef9e917e 100644 ---- a/drivers/tee/tee_core.c -+++ b/drivers/tee/tee_core.c -@@ -84,8 +84,10 @@ void teedev_ctx_put(struct tee_context *ctx) - - static void teedev_close_context(struct tee_context *ctx) - { -- tee_device_put(ctx->teedev); -+ struct tee_device *teedev = ctx->teedev; -+ - teedev_ctx_put(ctx); -+ tee_device_put(teedev); - } - - static int tee_open(struct inode *inode, struct file *filp) -diff --git a/drivers/tty/serial/amba-pl010.c b/drivers/tty/serial/amba-pl010.c -index 2c37d11726aba..13f882e5e7b76 100644 ---- a/drivers/tty/serial/amba-pl010.c -+++ b/drivers/tty/serial/amba-pl010.c -@@ -452,14 +452,11 @@ pl010_set_termios(struct uart_port *port, struct ktermios *termios, - if ((termios->c_cflag & CREAD) == 0) - uap->port.ignore_status_mask |= UART_DUMMY_RSR_RX; - -- /* first, disable everything */ - old_cr = readb(uap->port.membase + UART010_CR) & ~UART010_CR_MSIE; - - if (UART_ENABLE_MS(port, termios->c_cflag)) - old_cr |= UART010_CR_MSIE; - -- writel(0, uap->port.membase + UART010_CR); -- - /* Set baud rate */ - quot -= 1; - writel((quot & 0xf00) >> 8, uap->port.membase + UART010_LCRM); -diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c -index 6741d0f3daf94..0bd8c05d72d60 100644 ---- a/drivers/tty/serial/amba-pl011.c -+++ b/drivers/tty/serial/amba-pl011.c -@@ -2094,32 +2094,13 @@ static const char *pl011_type(struct uart_port *port) - return uap->port.type == PORT_AMBA ? uap->type : NULL; - } - --/* -- * Release the memory region(s) being used by 'port' -- */ --static void pl011_release_port(struct uart_port *port) --{ -- release_mem_region(port->mapbase, SZ_4K); --} -- --/* -- * Request the memory region(s) being used by 'port' -- */ --static int pl011_request_port(struct uart_port *port) --{ -- return request_mem_region(port->mapbase, SZ_4K, "uart-pl011") -- != NULL ? 0 : -EBUSY; --} -- - /* - * Configure/autoconfigure the port. - */ - static void pl011_config_port(struct uart_port *port, int flags) - { -- if (flags & UART_CONFIG_TYPE) { -+ if (flags & UART_CONFIG_TYPE) - port->type = PORT_AMBA; -- pl011_request_port(port); -- } - } - - /* -@@ -2134,6 +2115,8 @@ static int pl011_verify_port(struct uart_port *port, struct serial_struct *ser) - ret = -EINVAL; - if (ser->baud_base < 9600) - ret = -EINVAL; -+ if (port->mapbase != (unsigned long) ser->iomem_base) -+ ret = -EINVAL; - return ret; - } - -@@ -2151,8 +2134,6 @@ static const struct uart_ops amba_pl011_pops = { - .flush_buffer = pl011_dma_flush_buffer, - .set_termios = pl011_set_termios, - .type = pl011_type, -- .release_port = pl011_release_port, -- .request_port = pl011_request_port, - .config_port = pl011_config_port, - .verify_port = pl011_verify_port, - #ifdef CONFIG_CONSOLE_POLL -@@ -2182,8 +2163,6 @@ static const struct uart_ops sbsa_uart_pops = { - .shutdown = sbsa_uart_shutdown, - .set_termios = sbsa_uart_set_termios, - .type = pl011_type, -- .release_port = pl011_release_port, -- .request_port = pl011_request_port, - .config_port = pl011_config_port, - .verify_port = pl011_verify_port, - #ifdef CONFIG_CONSOLE_POLL -diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c -index 8a909d5561859..3b2c25bd2e06b 100644 ---- a/drivers/tty/serial/atmel_serial.c -+++ b/drivers/tty/serial/atmel_serial.c -@@ -1002,6 +1002,13 @@ static void atmel_tx_dma(struct uart_port *port) - desc->callback = atmel_complete_tx_dma; - desc->callback_param = atmel_port; - atmel_port->cookie_tx = dmaengine_submit(desc); -+ if (dma_submit_error(atmel_port->cookie_tx)) { -+ dev_err(port->dev, "dma_submit_error %d\n", -+ atmel_port->cookie_tx); -+ return; -+ } -+ -+ dma_async_issue_pending(chan); - } - - if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS) -@@ -1262,6 +1269,13 @@ static int atmel_prepare_rx_dma(struct uart_port *port) - desc->callback_param = port; - atmel_port->desc_rx = desc; - atmel_port->cookie_rx = dmaengine_submit(desc); -+ if (dma_submit_error(atmel_port->cookie_rx)) { -+ dev_err(port->dev, "dma_submit_error %d\n", -+ atmel_port->cookie_rx); -+ goto chan_err; -+ } -+ -+ dma_async_issue_pending(atmel_port->chan_rx); - - return 0; - -diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c -index aad640b9e3f4b..7cc7bd8aca0f5 100644 ---- a/drivers/tty/serial/serial_core.c -+++ b/drivers/tty/serial/serial_core.c -@@ -160,7 +160,7 @@ static void uart_port_dtr_rts(struct uart_port *uport, int raise) - int RTS_after_send = !!(uport->rs485.flags & SER_RS485_RTS_AFTER_SEND); - - if (raise) { -- if (rs485_on && !RTS_after_send) { -+ if (rs485_on && RTS_after_send) { - uart_set_mctrl(uport, TIOCM_DTR); - uart_clear_mctrl(uport, TIOCM_RTS); - } else { -@@ -169,7 +169,7 @@ static void uart_port_dtr_rts(struct uart_port *uport, int raise) - } else { - unsigned int clear = TIOCM_DTR; - -- clear |= (!rs485_on || !RTS_after_send) ? TIOCM_RTS : 0; -+ clear |= (!rs485_on || RTS_after_send) ? TIOCM_RTS : 0; - uart_clear_mctrl(uport, clear); - } - } -@@ -2395,7 +2395,8 @@ uart_configure_port(struct uart_driver *drv, struct uart_state *state, - * We probably don't need a spinlock around this, but - */ - spin_lock_irqsave(&port->lock, flags); -- port->ops->set_mctrl(port, port->mctrl & TIOCM_DTR); -+ port->mctrl &= TIOCM_DTR; -+ port->ops->set_mctrl(port, port->mctrl); - spin_unlock_irqrestore(&port->lock, flags); - - /* -diff --git a/drivers/tty/serial/uartlite.c b/drivers/tty/serial/uartlite.c -index 56066d93a65b8..9a4049c894f7a 100644 ---- a/drivers/tty/serial/uartlite.c -+++ b/drivers/tty/serial/uartlite.c -@@ -618,7 +618,7 @@ static struct uart_driver ulite_uart_driver = { - * - * Returns: 0 on success, <0 otherwise - */ --static int ulite_assign(struct device *dev, int id, u32 base, int irq, -+static int ulite_assign(struct device *dev, int id, phys_addr_t base, int irq, - struct uartlite_data *pdata) - { - struct uart_port *port; -diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c -index 69dd48f9507e5..4cf0dc7f330dd 100644 ---- a/drivers/usb/core/hub.c -+++ b/drivers/usb/core/hub.c -@@ -1108,7 +1108,10 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type) - } else { - hub_power_on(hub, true); - } -- } -+ /* Give some time on remote wakeup to let links to transit to U0 */ -+ } else if (hub_is_superspeed(hub->hdev)) -+ msleep(20); -+ - init2: - - /* -diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c -index 3f5c21f7f9905..2bea33b41553b 100644 ---- a/drivers/usb/gadget/function/f_fs.c -+++ b/drivers/usb/gadget/function/f_fs.c -@@ -614,7 +614,7 @@ static int ffs_ep0_open(struct inode *inode, struct file *file) - file->private_data = ffs; - ffs_data_opened(ffs); - -- return 0; -+ return stream_open(inode, file); - } - - static int ffs_ep0_release(struct inode *inode, struct file *file) -@@ -1156,7 +1156,7 @@ ffs_epfile_open(struct inode *inode, struct file *file) - file->private_data = epfile; - ffs_data_opened(epfile->ffs); - -- return 0; -+ return stream_open(inode, file); - } - - static int ffs_aio_cancel(struct kiocb *kiocb) -diff --git a/drivers/usb/host/uhci-platform.c b/drivers/usb/host/uhci-platform.c -index 70dbd95c3f063..be9e9db7cad10 100644 ---- a/drivers/usb/host/uhci-platform.c -+++ b/drivers/usb/host/uhci-platform.c -@@ -113,7 +113,8 @@ static int uhci_hcd_platform_probe(struct platform_device *pdev) - num_ports); - } - if (of_device_is_compatible(np, "aspeed,ast2400-uhci") || -- of_device_is_compatible(np, "aspeed,ast2500-uhci")) { -+ of_device_is_compatible(np, "aspeed,ast2500-uhci") || -+ of_device_is_compatible(np, "aspeed,ast2600-uhci")) { - uhci->is_aspeed = 1; - dev_info(&pdev->dev, - "Enabled Aspeed implementation workarounds\n"); -diff --git a/drivers/usb/misc/ftdi-elan.c b/drivers/usb/misc/ftdi-elan.c -index cdee3af33ad7b..684800c66bb4d 100644 ---- a/drivers/usb/misc/ftdi-elan.c -+++ b/drivers/usb/misc/ftdi-elan.c -@@ -202,6 +202,7 @@ static void ftdi_elan_delete(struct kref *kref) - mutex_unlock(&ftdi_module_lock); - kfree(ftdi->bulk_in_buffer); - ftdi->bulk_in_buffer = NULL; -+ kfree(ftdi); - } - - static void ftdi_elan_put_kref(struct usb_ftdi *ftdi) -diff --git a/drivers/w1/slaves/w1_ds28e04.c b/drivers/w1/slaves/w1_ds28e04.c -index 8a640f1590784..06a9966f8c933 100644 ---- a/drivers/w1/slaves/w1_ds28e04.c -+++ b/drivers/w1/slaves/w1_ds28e04.c -@@ -32,7 +32,7 @@ static int w1_strong_pullup = 1; - module_param_named(strong_pullup, w1_strong_pullup, int, 0); - - /* enable/disable CRC checking on DS28E04-100 memory accesses */ --static char w1_enable_crccheck = 1; -+static bool w1_enable_crccheck = true; - - #define W1_EEPROM_SIZE 512 - #define W1_PAGE_COUNT 16 -@@ -339,32 +339,18 @@ static BIN_ATTR_RW(pio, 1); - static ssize_t crccheck_show(struct device *dev, struct device_attribute *attr, - char *buf) - { -- if (put_user(w1_enable_crccheck + 0x30, buf)) -- return -EFAULT; -- -- return sizeof(w1_enable_crccheck); -+ return sysfs_emit(buf, "%d\n", w1_enable_crccheck); - } - - static ssize_t crccheck_store(struct device *dev, struct device_attribute *attr, - const char *buf, size_t count) - { -- char val; -- -- if (count != 1 || !buf) -- return -EINVAL; -+ int err = kstrtobool(buf, &w1_enable_crccheck); - -- if (get_user(val, buf)) -- return -EFAULT; -+ if (err) -+ return err; - -- /* convert to decimal */ -- val = val - 0x30; -- if (val != 0 && val != 1) -- return -EINVAL; -- -- /* set the new value */ -- w1_enable_crccheck = val; -- -- return sizeof(w1_enable_crccheck); -+ return count; - } - - static DEVICE_ATTR_RW(crccheck); -diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c -index 7f644a58db511..c701a19fac533 100644 ---- a/fs/btrfs/backref.c -+++ b/fs/btrfs/backref.c -@@ -1208,7 +1208,12 @@ again: - ret = btrfs_search_slot(trans, fs_info->extent_root, &key, path, 0, 0); - if (ret < 0) - goto out; -- BUG_ON(ret == 0); -+ if (ret == 0) { -+ /* This shouldn't happen, indicates a bug or fs corruption. */ -+ ASSERT(ret != 0); -+ ret = -EUCLEAN; -+ goto out; -+ } - - #ifdef CONFIG_BTRFS_FS_RUN_SANITY_TESTS - if (trans && likely(trans->type != __TRANS_DUMMY) && -@@ -1356,10 +1361,18 @@ again: - goto out; - if (!ret && extent_item_pos) { - /* -- * we've recorded that parent, so we must extend -- * its inode list here -+ * We've recorded that parent, so we must extend -+ * its inode list here. -+ * -+ * However if there was corruption we may not -+ * have found an eie, return an error in this -+ * case. - */ -- BUG_ON(!eie); -+ ASSERT(eie); -+ if (!eie) { -+ ret = -EUCLEAN; -+ goto out; -+ } - while (eie->next) - eie = eie->next; - eie->next = ref->inode_list; -diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c -index dac30b00d14b7..822c615840e84 100644 ---- a/fs/btrfs/ctree.c -+++ b/fs/btrfs/ctree.c -@@ -2658,12 +2658,9 @@ static struct extent_buffer *btrfs_search_slot_get_root(struct btrfs_root *root, - { - struct btrfs_fs_info *fs_info = root->fs_info; - struct extent_buffer *b; -- int root_lock; -+ int root_lock = 0; - int level = 0; - -- /* We try very hard to do read locks on the root */ -- root_lock = BTRFS_READ_LOCK; -- - if (p->search_commit_root) { - /* - * The commit roots are read only so we always do read locks, -@@ -2701,6 +2698,9 @@ static struct extent_buffer *btrfs_search_slot_get_root(struct btrfs_root *root, - goto out; - } - -+ /* We try very hard to do read locks on the root */ -+ root_lock = BTRFS_READ_LOCK; -+ - /* - * If the level is set to maximum, we can skip trying to get the read - * lock. -@@ -2727,6 +2727,17 @@ static struct extent_buffer *btrfs_search_slot_get_root(struct btrfs_root *root, - level = btrfs_header_level(b); - - out: -+ /* -+ * The root may have failed to write out at some point, and thus is no -+ * longer valid, return an error in this case. -+ */ -+ if (!extent_buffer_uptodate(b)) { -+ if (root_lock) -+ btrfs_tree_unlock_rw(b, root_lock); -+ free_extent_buffer(b); -+ return ERR_PTR(-EIO); -+ } -+ - p->nodes[level] = b; - if (!p->skip_locking) - p->locks[level] = root_lock; -diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c -index b859ed50cf46c..7755a0362a3ad 100644 ---- a/fs/btrfs/inode.c -+++ b/fs/btrfs/inode.c -@@ -10808,9 +10808,19 @@ static int btrfs_add_swap_extent(struct swap_info_struct *sis, - struct btrfs_swap_info *bsi) - { - unsigned long nr_pages; -+ unsigned long max_pages; - u64 first_ppage, first_ppage_reported, next_ppage; - int ret; - -+ /* -+ * Our swapfile may have had its size extended after the swap header was -+ * written. In that case activating the swapfile should not go beyond -+ * the max size set in the swap header. -+ */ -+ if (bsi->nr_pages >= sis->max) -+ return 0; -+ -+ max_pages = sis->max - bsi->nr_pages; - first_ppage = ALIGN(bsi->block_start, PAGE_SIZE) >> PAGE_SHIFT; - next_ppage = ALIGN_DOWN(bsi->block_start + bsi->block_len, - PAGE_SIZE) >> PAGE_SHIFT; -@@ -10818,6 +10828,7 @@ static int btrfs_add_swap_extent(struct swap_info_struct *sis, - if (first_ppage >= next_ppage) - return 0; - nr_pages = next_ppage - first_ppage; -+ nr_pages = min(nr_pages, max_pages); - - first_ppage_reported = first_ppage; - if (bsi->start == 0) -diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c -index bb034e19a2a8a..2ee61596164be 100644 ---- a/fs/btrfs/qgroup.c -+++ b/fs/btrfs/qgroup.c -@@ -890,6 +890,14 @@ int btrfs_quota_enable(struct btrfs_fs_info *fs_info) - int ret = 0; - int slot; - -+ /* -+ * We need to have subvol_sem write locked, to prevent races between -+ * concurrent tasks trying to enable quotas, because we will unlock -+ * and relock qgroup_ioctl_lock before setting fs_info->quota_root -+ * and before setting BTRFS_FS_QUOTA_ENABLED. -+ */ -+ lockdep_assert_held_write(&fs_info->subvol_sem); -+ - mutex_lock(&fs_info->qgroup_ioctl_lock); - if (fs_info->quota_root) - goto out; -@@ -1035,8 +1043,19 @@ out_add_root: - goto out_free_path; - } - -+ mutex_unlock(&fs_info->qgroup_ioctl_lock); -+ /* -+ * Commit the transaction while not holding qgroup_ioctl_lock, to avoid -+ * a deadlock with tasks concurrently doing other qgroup operations, such -+ * adding/removing qgroups or adding/deleting qgroup relations for example, -+ * because all qgroup operations first start or join a transaction and then -+ * lock the qgroup_ioctl_lock mutex. -+ * We are safe from a concurrent task trying to enable quotas, by calling -+ * this function, since we are serialized by fs_info->subvol_sem. -+ */ - ret = btrfs_commit_transaction(trans); - trans = NULL; -+ mutex_lock(&fs_info->qgroup_ioctl_lock); - if (ret) - goto out_free_path; - -diff --git a/fs/debugfs/file.c b/fs/debugfs/file.c -index a32c5c7dcfd89..da87615ad69a7 100644 ---- a/fs/debugfs/file.c -+++ b/fs/debugfs/file.c -@@ -146,7 +146,7 @@ static int debugfs_locked_down(struct inode *inode, - struct file *filp, - const struct file_operations *real_fops) - { -- if ((inode->i_mode & 07777) == 0444 && -+ if ((inode->i_mode & 07777 & ~0444) == 0 && - !(filp->f_mode & FMODE_WRITE) && - !real_fops->unlocked_ioctl && - !real_fops->compat_ioctl && -diff --git a/fs/dlm/lock.c b/fs/dlm/lock.c -index 18d81599522f3..53500b555bfa8 100644 ---- a/fs/dlm/lock.c -+++ b/fs/dlm/lock.c -@@ -3975,6 +3975,14 @@ static int validate_message(struct dlm_lkb *lkb, struct dlm_message *ms) - int from = ms->m_header.h_nodeid; - int error = 0; - -+ /* currently mixing of user/kernel locks are not supported */ -+ if (ms->m_flags & DLM_IFL_USER && ~lkb->lkb_flags & DLM_IFL_USER) { -+ log_error(lkb->lkb_resource->res_ls, -+ "got user dlm message for a kernel lock"); -+ error = -EINVAL; -+ goto out; -+ } -+ - switch (ms->m_type) { - case DLM_MSG_CONVERT: - case DLM_MSG_UNLOCK: -@@ -4003,6 +4011,7 @@ static int validate_message(struct dlm_lkb *lkb, struct dlm_message *ms) - error = -EINVAL; - } - -+out: - if (error) - log_error(lkb->lkb_resource->res_ls, - "ignore invalid message %d from %d %x %x %x %d", -diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c -index ba13fbb443d58..9fa20f9ba52b5 100644 ---- a/fs/ext4/ioctl.c -+++ b/fs/ext4/ioctl.c -@@ -1120,8 +1120,6 @@ resizefs_out: - sizeof(range))) - return -EFAULT; - -- range.minlen = max((unsigned int)range.minlen, -- q->limits.discard_granularity); - ret = ext4_trim_fs(sb, &range); - if (ret < 0) - return ret; -diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c -index b67ea979f0cf7..0307702d114db 100644 ---- a/fs/ext4/mballoc.c -+++ b/fs/ext4/mballoc.c -@@ -5270,6 +5270,7 @@ out: - */ - int ext4_trim_fs(struct super_block *sb, struct fstrim_range *range) - { -+ struct request_queue *q = bdev_get_queue(sb->s_bdev); - struct ext4_group_info *grp; - ext4_group_t group, first_group, last_group; - ext4_grpblk_t cnt = 0, first_cluster, last_cluster; -@@ -5288,6 +5289,13 @@ int ext4_trim_fs(struct super_block *sb, struct fstrim_range *range) - start >= max_blks || - range->len < sb->s_blocksize) - return -EINVAL; -+ /* No point to try to trim less than discard granularity */ -+ if (range->minlen < q->limits.discard_granularity) { -+ minlen = EXT4_NUM_B2C(EXT4_SB(sb), -+ q->limits.discard_granularity >> sb->s_blocksize_bits); -+ if (minlen > EXT4_CLUSTERS_PER_GROUP(sb)) -+ goto out; -+ } - if (end >= max_blks) - end = max_blks - 1; - if (end <= first_data_blk) -diff --git a/fs/ext4/migrate.c b/fs/ext4/migrate.c -index be4ee3dcc5cf5..c5b2ea1a93729 100644 ---- a/fs/ext4/migrate.c -+++ b/fs/ext4/migrate.c -@@ -455,12 +455,12 @@ int ext4_ext_migrate(struct inode *inode) - percpu_down_write(&sbi->s_writepages_rwsem); - - /* -- * Worst case we can touch the allocation bitmaps, a bgd -- * block, and a block to link in the orphan list. We do need -- * need to worry about credits for modifying the quota inode. -+ * Worst case we can touch the allocation bitmaps and a block -+ * group descriptor block. We do need need to worry about -+ * credits for modifying the quota inode. - */ - handle = ext4_journal_start(inode, EXT4_HT_MIGRATE, -- 4 + EXT4_MAXQUOTAS_TRANS_BLOCKS(inode->i_sb)); -+ 3 + EXT4_MAXQUOTAS_TRANS_BLOCKS(inode->i_sb)); - - if (IS_ERR(handle)) { - retval = PTR_ERR(handle); -@@ -477,6 +477,13 @@ int ext4_ext_migrate(struct inode *inode) - ext4_journal_stop(handle); - goto out_unlock; - } -+ /* -+ * Use the correct seed for checksum (i.e. the seed from 'inode'). This -+ * is so that the metadata blocks will have the correct checksum after -+ * the migration. -+ */ -+ ei = EXT4_I(inode); -+ EXT4_I(tmp_inode)->i_csum_seed = ei->i_csum_seed; - i_size_write(tmp_inode, i_size_read(inode)); - /* - * Set the i_nlink to zero so it will be deleted later -@@ -485,7 +492,6 @@ int ext4_ext_migrate(struct inode *inode) - clear_nlink(tmp_inode); - - ext4_ext_tree_init(handle, tmp_inode); -- ext4_orphan_add(handle, tmp_inode); - ext4_journal_stop(handle); - - /* -@@ -510,17 +516,10 @@ int ext4_ext_migrate(struct inode *inode) - - handle = ext4_journal_start(inode, EXT4_HT_MIGRATE, 1); - if (IS_ERR(handle)) { -- /* -- * It is impossible to update on-disk structures without -- * a handle, so just rollback in-core changes and live other -- * work to orphan_list_cleanup() -- */ -- ext4_orphan_del(NULL, tmp_inode); - retval = PTR_ERR(handle); - goto out_tmp_inode; - } - -- ei = EXT4_I(inode); - i_data = ei->i_data; - memset(&lb, 0, sizeof(lb)); - -diff --git a/fs/ext4/super.c b/fs/ext4/super.c -index f68dfef5939f4..5bc7fd0240a19 100644 ---- a/fs/ext4/super.c -+++ b/fs/ext4/super.c -@@ -5912,10 +5912,7 @@ static int ext4_quota_on(struct super_block *sb, int type, int format_id, - - lockdep_set_quota_inode(path->dentry->d_inode, I_DATA_SEM_QUOTA); - err = dquot_quota_on(sb, type, format_id, path); -- if (err) { -- lockdep_set_quota_inode(path->dentry->d_inode, -- I_DATA_SEM_NORMAL); -- } else { -+ if (!err) { - struct inode *inode = d_inode(path->dentry); - handle_t *handle; - -@@ -5935,7 +5932,12 @@ static int ext4_quota_on(struct super_block *sb, int type, int format_id, - ext4_journal_stop(handle); - unlock_inode: - inode_unlock(inode); -+ if (err) -+ dquot_quota_off(sb, type); - } -+ if (err) -+ lockdep_set_quota_inode(path->dentry->d_inode, -+ I_DATA_SEM_NORMAL); - return err; - } - -@@ -5998,8 +6000,19 @@ static int ext4_enable_quotas(struct super_block *sb) - "Failed to enable quota tracking " - "(type=%d, err=%d). Please run " - "e2fsck to fix.", type, err); -- for (type--; type >= 0; type--) -+ for (type--; type >= 0; type--) { -+ struct inode *inode; -+ -+ inode = sb_dqopt(sb)->files[type]; -+ if (inode) -+ inode = igrab(inode); - dquot_quota_off(sb, type); -+ if (inode) { -+ lockdep_set_quota_inode(inode, -+ I_DATA_SEM_NORMAL); -+ iput(inode); -+ } -+ } - - return err; - } -@@ -6101,7 +6114,7 @@ static ssize_t ext4_quota_write(struct super_block *sb, int type, - struct buffer_head *bh; - handle_t *handle = journal_current_handle(); - -- if (EXT4_SB(sb)->s_journal && !handle) { -+ if (!handle) { - ext4_msg(sb, KERN_WARNING, "Quota write (off=%llu, len=%llu)" - " cancelled because transaction is not started", - (unsigned long long)off, (unsigned long long)len); -diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h -index 031a17bf52a24..5645502c156df 100644 ---- a/fs/f2fs/f2fs.h -+++ b/fs/f2fs/f2fs.h -@@ -931,6 +931,7 @@ struct f2fs_sm_info { - unsigned int segment_count; /* total # of segments */ - unsigned int main_segments; /* # of segments in main area */ - unsigned int reserved_segments; /* # of reserved segments */ -+ unsigned int additional_reserved_segments;/* reserved segs for IO align feature */ - unsigned int ovp_segments; /* # of overprovision segments */ - - /* a threshold to reclaim prefree segments */ -@@ -1800,6 +1801,11 @@ static inline int inc_valid_block_count(struct f2fs_sb_info *sbi, - - if (!__allow_reserved_blocks(sbi, inode, true)) - avail_user_block_count -= F2FS_OPTION(sbi).root_reserved_blocks; -+ -+ if (F2FS_IO_ALIGNED(sbi)) -+ avail_user_block_count -= sbi->blocks_per_seg * -+ SM_I(sbi)->additional_reserved_segments; -+ - if (unlikely(is_sbi_flag_set(sbi, SBI_CP_DISABLED))) { - if (avail_user_block_count > sbi->unusable_block_count) - avail_user_block_count -= sbi->unusable_block_count; -@@ -2045,6 +2051,11 @@ static inline int inc_valid_node_count(struct f2fs_sb_info *sbi, - - if (!__allow_reserved_blocks(sbi, inode, false)) - valid_block_count += F2FS_OPTION(sbi).root_reserved_blocks; -+ -+ if (F2FS_IO_ALIGNED(sbi)) -+ valid_block_count += sbi->blocks_per_seg * -+ SM_I(sbi)->additional_reserved_segments; -+ - user_block_count = sbi->user_block_count; - if (unlikely(is_sbi_flag_set(sbi, SBI_CP_DISABLED))) - user_block_count -= sbi->unusable_block_count; -diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c -index 4b6c36208f552..16abb017e497f 100644 ---- a/fs/f2fs/gc.c -+++ b/fs/f2fs/gc.c -@@ -633,6 +633,9 @@ static bool is_alive(struct f2fs_sb_info *sbi, struct f2fs_summary *sum, - set_sbi_flag(sbi, SBI_NEED_FSCK); - } - -+ if (f2fs_check_nid_range(sbi, dni->ino)) -+ return false; -+ - *nofs = ofs_of_node(node_page); - source_blkaddr = datablock_addr(NULL, node_page, ofs_in_node); - f2fs_put_page(node_page, 1); -diff --git a/fs/f2fs/segment.h b/fs/f2fs/segment.h -index 2034b9a07d632..15b343f656093 100644 ---- a/fs/f2fs/segment.h -+++ b/fs/f2fs/segment.h -@@ -508,7 +508,8 @@ static inline unsigned int free_segments(struct f2fs_sb_info *sbi) - - static inline int reserved_segments(struct f2fs_sb_info *sbi) - { -- return SM_I(sbi)->reserved_segments; -+ return SM_I(sbi)->reserved_segments + -+ SM_I(sbi)->additional_reserved_segments; - } - - static inline unsigned int free_sections(struct f2fs_sb_info *sbi) -diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c -index 41bf656658ba8..a6c9c9fdf21d1 100644 ---- a/fs/f2fs/super.c -+++ b/fs/f2fs/super.c -@@ -277,6 +277,46 @@ static inline void limit_reserve_root(struct f2fs_sb_info *sbi) - F2FS_OPTION(sbi).s_resgid)); - } - -+static inline int adjust_reserved_segment(struct f2fs_sb_info *sbi) -+{ -+ unsigned int sec_blks = sbi->blocks_per_seg * sbi->segs_per_sec; -+ unsigned int avg_vblocks; -+ unsigned int wanted_reserved_segments; -+ block_t avail_user_block_count; -+ -+ if (!F2FS_IO_ALIGNED(sbi)) -+ return 0; -+ -+ /* average valid block count in section in worst case */ -+ avg_vblocks = sec_blks / F2FS_IO_SIZE(sbi); -+ -+ /* -+ * we need enough free space when migrating one section in worst case -+ */ -+ wanted_reserved_segments = (F2FS_IO_SIZE(sbi) / avg_vblocks) * -+ reserved_segments(sbi); -+ wanted_reserved_segments -= reserved_segments(sbi); -+ -+ avail_user_block_count = sbi->user_block_count - -+ sbi->current_reserved_blocks - -+ F2FS_OPTION(sbi).root_reserved_blocks; -+ -+ if (wanted_reserved_segments * sbi->blocks_per_seg > -+ avail_user_block_count) { -+ f2fs_err(sbi, "IO align feature can't grab additional reserved segment: %u, available segments: %u", -+ wanted_reserved_segments, -+ avail_user_block_count >> sbi->log_blocks_per_seg); -+ return -ENOSPC; -+ } -+ -+ SM_I(sbi)->additional_reserved_segments = wanted_reserved_segments; -+ -+ f2fs_info(sbi, "IO align feature needs additional reserved segment: %u", -+ wanted_reserved_segments); -+ -+ return 0; -+} -+ - static inline void adjust_unusable_cap_perc(struct f2fs_sb_info *sbi) - { - if (!F2FS_OPTION(sbi).unusable_cap_perc) -@@ -3450,6 +3490,10 @@ try_onemore: - goto free_nm; - } - -+ err = adjust_reserved_segment(sbi); -+ if (err) -+ goto free_nm; -+ - /* For write statistics */ - if (sb->s_bdev->bd_part) - sbi->sectors_written_start = -diff --git a/fs/f2fs/sysfs.c b/fs/f2fs/sysfs.c -index 3a5360e045cfd..84bb376650935 100644 ---- a/fs/f2fs/sysfs.c -+++ b/fs/f2fs/sysfs.c -@@ -262,7 +262,9 @@ out: - if (a->struct_type == RESERVED_BLOCKS) { - spin_lock(&sbi->stat_lock); - if (t > (unsigned long)(sbi->user_block_count - -- F2FS_OPTION(sbi).root_reserved_blocks)) { -+ F2FS_OPTION(sbi).root_reserved_blocks - -+ sbi->blocks_per_seg * -+ SM_I(sbi)->additional_reserved_segments)) { - spin_unlock(&sbi->stat_lock); - return -EINVAL; - } -diff --git a/fs/fuse/file.c b/fs/fuse/file.c -index 1de59998e0e75..5cf13196ce69e 100644 ---- a/fs/fuse/file.c -+++ b/fs/fuse/file.c -@@ -3188,7 +3188,7 @@ fuse_direct_IO(struct kiocb *iocb, struct iov_iter *iter) - - static int fuse_writeback_range(struct inode *inode, loff_t start, loff_t end) - { -- int err = filemap_write_and_wait_range(inode->i_mapping, start, -1); -+ int err = filemap_write_and_wait_range(inode->i_mapping, start, LLONG_MAX); - - if (!err) - fuse_sync_writes(inode); -diff --git a/fs/jffs2/file.c b/fs/jffs2/file.c -index f8fb89b10227c..34880a4c21732 100644 ---- a/fs/jffs2/file.c -+++ b/fs/jffs2/file.c -@@ -135,20 +135,15 @@ static int jffs2_write_begin(struct file *filp, struct address_space *mapping, - struct page *pg; - struct inode *inode = mapping->host; - struct jffs2_inode_info *f = JFFS2_INODE_INFO(inode); -+ struct jffs2_sb_info *c = JFFS2_SB_INFO(inode->i_sb); - pgoff_t index = pos >> PAGE_SHIFT; - uint32_t pageofs = index << PAGE_SHIFT; - int ret = 0; - -- pg = grab_cache_page_write_begin(mapping, index, flags); -- if (!pg) -- return -ENOMEM; -- *pagep = pg; -- - jffs2_dbg(1, "%s()\n", __func__); - - if (pageofs > inode->i_size) { - /* Make new hole frag from old EOF to new page */ -- struct jffs2_sb_info *c = JFFS2_SB_INFO(inode->i_sb); - struct jffs2_raw_inode ri; - struct jffs2_full_dnode *fn; - uint32_t alloc_len; -@@ -159,7 +154,7 @@ static int jffs2_write_begin(struct file *filp, struct address_space *mapping, - ret = jffs2_reserve_space(c, sizeof(ri), &alloc_len, - ALLOC_NORMAL, JFFS2_SUMMARY_INODE_SIZE); - if (ret) -- goto out_page; -+ goto out_err; - - mutex_lock(&f->sem); - memset(&ri, 0, sizeof(ri)); -@@ -189,7 +184,7 @@ static int jffs2_write_begin(struct file *filp, struct address_space *mapping, - ret = PTR_ERR(fn); - jffs2_complete_reservation(c); - mutex_unlock(&f->sem); -- goto out_page; -+ goto out_err; - } - ret = jffs2_add_full_dnode_to_inode(c, f, fn); - if (f->metadata) { -@@ -204,13 +199,26 @@ static int jffs2_write_begin(struct file *filp, struct address_space *mapping, - jffs2_free_full_dnode(fn); - jffs2_complete_reservation(c); - mutex_unlock(&f->sem); -- goto out_page; -+ goto out_err; - } - jffs2_complete_reservation(c); - inode->i_size = pageofs; - mutex_unlock(&f->sem); - } - -+ /* -+ * While getting a page and reading data in, lock c->alloc_sem until -+ * the page is Uptodate. Otherwise GC task may attempt to read the same -+ * page in read_cache_page(), which causes a deadlock. -+ */ -+ mutex_lock(&c->alloc_sem); -+ pg = grab_cache_page_write_begin(mapping, index, flags); -+ if (!pg) { -+ ret = -ENOMEM; -+ goto release_sem; -+ } -+ *pagep = pg; -+ - /* - * Read in the page if it wasn't already present. Cannot optimize away - * the whole page write case until jffs2_write_end can handle the -@@ -220,15 +228,17 @@ static int jffs2_write_begin(struct file *filp, struct address_space *mapping, - mutex_lock(&f->sem); - ret = jffs2_do_readpage_nolock(inode, pg); - mutex_unlock(&f->sem); -- if (ret) -- goto out_page; -+ if (ret) { -+ unlock_page(pg); -+ put_page(pg); -+ goto release_sem; -+ } - } - jffs2_dbg(1, "end write_begin(). pg->flags %lx\n", pg->flags); -- return ret; - --out_page: -- unlock_page(pg); -- put_page(pg); -+release_sem: -+ mutex_unlock(&c->alloc_sem); -+out_err: - return ret; - } - -diff --git a/fs/ubifs/super.c b/fs/ubifs/super.c -index 2cbc3c36f3a8c..b37c6b1e33253 100644 ---- a/fs/ubifs/super.c -+++ b/fs/ubifs/super.c -@@ -1835,7 +1835,6 @@ out: - kthread_stop(c->bgt); - c->bgt = NULL; - } -- free_wbufs(c); - kfree(c->write_reserve_buf); - c->write_reserve_buf = NULL; - vfree(c->ileb_buf); -diff --git a/include/acpi/actypes.h b/include/acpi/actypes.h -index 9373662cdb44f..ff5fecff51167 100644 ---- a/include/acpi/actypes.h -+++ b/include/acpi/actypes.h -@@ -536,8 +536,14 @@ typedef u64 acpi_integer; - * Can be used with access_width of struct acpi_generic_address and access_size of - * struct acpi_resource_generic_register. - */ --#define ACPI_ACCESS_BIT_WIDTH(size) (1 << ((size) + 2)) --#define ACPI_ACCESS_BYTE_WIDTH(size) (1 << ((size) - 1)) -+#define ACPI_ACCESS_BIT_SHIFT 2 -+#define ACPI_ACCESS_BYTE_SHIFT -1 -+#define ACPI_ACCESS_BIT_MAX (31 - ACPI_ACCESS_BIT_SHIFT) -+#define ACPI_ACCESS_BYTE_MAX (31 - ACPI_ACCESS_BYTE_SHIFT) -+#define ACPI_ACCESS_BIT_DEFAULT (8 - ACPI_ACCESS_BIT_SHIFT) -+#define ACPI_ACCESS_BYTE_DEFAULT (8 - ACPI_ACCESS_BYTE_SHIFT) -+#define ACPI_ACCESS_BIT_WIDTH(size) (1 << ((size) + ACPI_ACCESS_BIT_SHIFT)) -+#define ACPI_ACCESS_BYTE_WIDTH(size) (1 << ((size) + ACPI_ACCESS_BYTE_SHIFT)) - - /******************************************************************************* - * -diff --git a/include/linux/hid.h b/include/linux/hid.h -index ad46ed41e8836..d5f9bbf8afa51 100644 ---- a/include/linux/hid.h -+++ b/include/linux/hid.h -@@ -344,6 +344,8 @@ struct hid_item { - /* BIT(9) reserved for backward compatibility, was NO_INIT_INPUT_REPORTS */ - #define HID_QUIRK_ALWAYS_POLL BIT(10) - #define HID_QUIRK_INPUT_PER_APP BIT(11) -+#define HID_QUIRK_X_INVERT BIT(12) -+#define HID_QUIRK_Y_INVERT BIT(13) - #define HID_QUIRK_SKIP_OUTPUT_REPORTS BIT(16) - #define HID_QUIRK_SKIP_OUTPUT_REPORT_ID BIT(17) - #define HID_QUIRK_NO_OUTPUT_REPORTS_ON_INTR_EP BIT(18) -diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h -index a90aba3d6afb4..bc8a70a7c5a13 100644 ---- a/include/linux/mmzone.h -+++ b/include/linux/mmzone.h -@@ -929,6 +929,15 @@ static inline int is_highmem_idx(enum zone_type idx) - #endif - } - -+#ifdef CONFIG_ZONE_DMA -+bool has_managed_dma(void); -+#else -+static inline bool has_managed_dma(void) -+{ -+ return false; -+} -+#endif -+ - /** - * is_highmem - helper function to quickly check if a struct zone is a - * highmem zone or not. This is an attempt to keep references -diff --git a/include/net/inet_frag.h b/include/net/inet_frag.h -index bac79e817776c..4cbd413e71a3f 100644 ---- a/include/net/inet_frag.h -+++ b/include/net/inet_frag.h -@@ -116,8 +116,15 @@ int fqdir_init(struct fqdir **fqdirp, struct inet_frags *f, struct net *net); - - static inline void fqdir_pre_exit(struct fqdir *fqdir) - { -- fqdir->high_thresh = 0; /* prevent creation of new frags */ -- fqdir->dead = true; -+ /* Prevent creation of new frags. -+ * Pairs with READ_ONCE() in inet_frag_find(). -+ */ -+ WRITE_ONCE(fqdir->high_thresh, 0); -+ -+ /* Pairs with READ_ONCE() in inet_frag_kill(), ip_expire() -+ * and ip6frag_expire_frag_queue(). -+ */ -+ WRITE_ONCE(fqdir->dead, true); - } - void fqdir_exit(struct fqdir *fqdir); - -diff --git a/include/net/ipv6_frag.h b/include/net/ipv6_frag.h -index a21e8b1381a10..e47a946bb77c9 100644 ---- a/include/net/ipv6_frag.h -+++ b/include/net/ipv6_frag.h -@@ -67,7 +67,8 @@ ip6frag_expire_frag_queue(struct net *net, struct frag_queue *fq) - struct sk_buff *head; - - rcu_read_lock(); -- if (fq->q.fqdir->dead) -+ /* Paired with the WRITE_ONCE() in fqdir_pre_exit(). */ -+ if (READ_ONCE(fq->q.fqdir->dead)) - goto out_rcu_unlock; - spin_lock(&fq->q.lock); - -diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h -index 939fda8f97215..ae69059ba76d4 100644 ---- a/include/net/sch_generic.h -+++ b/include/net/sch_generic.h -@@ -1264,6 +1264,7 @@ struct psched_ratecfg { - u64 rate_bytes_ps; /* bytes per second */ - u32 mult; - u16 overhead; -+ u16 mpu; - u8 linklayer; - u8 shift; - }; -@@ -1273,6 +1274,9 @@ static inline u64 psched_l2t_ns(const struct psched_ratecfg *r, - { - len += r->overhead; - -+ if (len < r->mpu) -+ len = r->mpu; -+ - if (unlikely(r->linklayer == TC_LINKLAYER_ATM)) - return ((u64)(DIV_ROUND_UP(len,48)*53) * r->mult) >> r->shift; - -@@ -1295,6 +1299,7 @@ static inline void psched_ratecfg_getrate(struct tc_ratespec *res, - res->rate = min_t(u64, r->rate_bytes_ps, ~0U); - - res->overhead = r->overhead; -+ res->mpu = r->mpu; - res->linklayer = (r->linklayer & TC_LINKLAYER_MASK); - } - -diff --git a/kernel/audit.c b/kernel/audit.c -index d67fce9e3f8b8..146edff0c73ec 100644 ---- a/kernel/audit.c -+++ b/kernel/audit.c -@@ -1528,6 +1528,20 @@ static void audit_receive(struct sk_buff *skb) - nlh = nlmsg_next(nlh, &len); - } - audit_ctl_unlock(); -+ -+ /* can't block with the ctrl lock, so penalize the sender now */ -+ if (audit_backlog_limit && -+ (skb_queue_len(&audit_queue) > audit_backlog_limit)) { -+ DECLARE_WAITQUEUE(wait, current); -+ -+ /* wake kauditd to try and flush the queue */ -+ wake_up_interruptible(&kauditd_wait); -+ -+ add_wait_queue_exclusive(&audit_backlog_wait, &wait); -+ set_current_state(TASK_UNINTERRUPTIBLE); -+ schedule_timeout(audit_backlog_wait_time); -+ remove_wait_queue(&audit_backlog_wait, &wait); -+ } - } - - /* Run custom bind function on netlink socket group connect or bind requests. */ -@@ -1772,7 +1786,9 @@ struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask, - * task_tgid_vnr() since auditd_pid is set in audit_receive_msg() - * using a PID anchored in the caller's namespace - * 2. generator holding the audit_cmd_mutex - we don't want to block -- * while holding the mutex */ -+ * while holding the mutex, although we do penalize the sender -+ * later in audit_receive() when it is safe to block -+ */ - if (!(auditd_test_task(current) || audit_ctl_owner_current())) { - long stime = audit_backlog_wait_time; - -diff --git a/kernel/rcu/tree_exp.h b/kernel/rcu/tree_exp.h -index 4c4d7683a4e5b..173e3ce607900 100644 ---- a/kernel/rcu/tree_exp.h -+++ b/kernel/rcu/tree_exp.h -@@ -382,6 +382,7 @@ retry_ipi: - continue; - } - if (get_cpu() == cpu) { -+ mask_ofl_test |= mask; - put_cpu(); - continue; - } -diff --git a/kernel/sched/cputime.c b/kernel/sched/cputime.c -index 46ed4e1383e21..66188567778de 100644 ---- a/kernel/sched/cputime.c -+++ b/kernel/sched/cputime.c -@@ -147,10 +147,10 @@ void account_guest_time(struct task_struct *p, u64 cputime) - - /* Add guest time to cpustat. */ - if (task_nice(p) > 0) { -- cpustat[CPUTIME_NICE] += cputime; -+ task_group_account_field(p, CPUTIME_NICE, cputime); - cpustat[CPUTIME_GUEST_NICE] += cputime; - } else { -- cpustat[CPUTIME_USER] += cputime; -+ task_group_account_field(p, CPUTIME_USER, cputime); - cpustat[CPUTIME_GUEST] += cputime; - } - } -diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c -index 2dffb8762e16b..28c82dee13ea9 100644 ---- a/kernel/sched/rt.c -+++ b/kernel/sched/rt.c -@@ -52,11 +52,8 @@ void init_rt_bandwidth(struct rt_bandwidth *rt_b, u64 period, u64 runtime) - rt_b->rt_period_timer.function = sched_rt_period_timer; - } - --static void start_rt_bandwidth(struct rt_bandwidth *rt_b) -+static inline void do_start_rt_bandwidth(struct rt_bandwidth *rt_b) - { -- if (!rt_bandwidth_enabled() || rt_b->rt_runtime == RUNTIME_INF) -- return; -- - raw_spin_lock(&rt_b->rt_runtime_lock); - if (!rt_b->rt_period_active) { - rt_b->rt_period_active = 1; -@@ -75,6 +72,14 @@ static void start_rt_bandwidth(struct rt_bandwidth *rt_b) - raw_spin_unlock(&rt_b->rt_runtime_lock); - } - -+static void start_rt_bandwidth(struct rt_bandwidth *rt_b) -+{ -+ if (!rt_bandwidth_enabled() || rt_b->rt_runtime == RUNTIME_INF) -+ return; -+ -+ do_start_rt_bandwidth(rt_b); -+} -+ - void init_rt_rq(struct rt_rq *rt_rq) - { - struct rt_prio_array *array; -@@ -983,13 +988,17 @@ static void update_curr_rt(struct rq *rq) - - for_each_sched_rt_entity(rt_se) { - struct rt_rq *rt_rq = rt_rq_of_se(rt_se); -+ int exceeded; - - if (sched_rt_runtime(rt_rq) != RUNTIME_INF) { - raw_spin_lock(&rt_rq->rt_runtime_lock); - rt_rq->rt_time += delta_exec; -- if (sched_rt_runtime_exceeded(rt_rq)) -+ exceeded = sched_rt_runtime_exceeded(rt_rq); -+ if (exceeded) - resched_curr(rq); - raw_spin_unlock(&rt_rq->rt_runtime_lock); -+ if (exceeded) -+ do_start_rt_bandwidth(sched_rt_bandwidth(rt_rq)); - } - } - } -@@ -2659,8 +2668,12 @@ static int sched_rt_global_validate(void) - - static void sched_rt_do_global(void) - { -+ unsigned long flags; -+ -+ raw_spin_lock_irqsave(&def_rt_bandwidth.rt_runtime_lock, flags); - def_rt_bandwidth.rt_runtime = global_rt_runtime(); - def_rt_bandwidth.rt_period = ns_to_ktime(global_rt_period()); -+ raw_spin_unlock_irqrestore(&def_rt_bandwidth.rt_runtime_lock, flags); - } - - int sched_rt_handler(struct ctl_table *table, int write, -diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c -index 5de084dab4fa6..13ccf2f28987e 100644 ---- a/kernel/trace/trace_kprobe.c -+++ b/kernel/trace/trace_kprobe.c -@@ -999,15 +999,18 @@ static int probes_profile_seq_show(struct seq_file *m, void *v) - { - struct dyn_event *ev = v; - struct trace_kprobe *tk; -+ unsigned long nmissed; - - if (!is_trace_kprobe(ev)) - return 0; - - tk = to_trace_kprobe(ev); -+ nmissed = trace_kprobe_is_return(tk) ? -+ tk->rp.kp.nmissed + tk->rp.nmissed : tk->rp.kp.nmissed; - seq_printf(m, " %-44s %15lu %15lu\n", - trace_probe_name(&tk->tp), - trace_kprobe_nhit(tk), -- tk->rp.kp.nmissed); -+ nmissed); - - return 0; - } -diff --git a/lib/test_meminit.c b/lib/test_meminit.c -index 9742e5cb853aa..ab00c79423a5f 100644 ---- a/lib/test_meminit.c -+++ b/lib/test_meminit.c -@@ -319,6 +319,7 @@ static int __init do_kmem_cache_size_bulk(int size, int *total_failures) - if (num) - kmem_cache_free_bulk(c, num, objects); - } -+ kmem_cache_destroy(c); - *total_failures += fail; - return 1; - } -diff --git a/mm/page_alloc.c b/mm/page_alloc.c -index 283ac9d9f6dd0..c3835915d1157 100644 ---- a/mm/page_alloc.c -+++ b/mm/page_alloc.c -@@ -3767,7 +3767,9 @@ void warn_alloc(gfp_t gfp_mask, nodemask_t *nodemask, const char *fmt, ...) - va_list args; - static DEFINE_RATELIMIT_STATE(nopage_rs, 10*HZ, 1); - -- if ((gfp_mask & __GFP_NOWARN) || !__ratelimit(&nopage_rs)) -+ if ((gfp_mask & __GFP_NOWARN) || -+ !__ratelimit(&nopage_rs) || -+ ((gfp_mask & __GFP_DMA) && !has_managed_dma())) - return; - - va_start(args, fmt); -@@ -8694,3 +8696,18 @@ bool set_hwpoison_free_buddy_page(struct page *page) - return hwpoisoned; - } - #endif -+ -+#ifdef CONFIG_ZONE_DMA -+bool has_managed_dma(void) -+{ -+ struct pglist_data *pgdat; -+ -+ for_each_online_pgdat(pgdat) { -+ struct zone *zone = &pgdat->node_zones[ZONE_DMA]; -+ -+ if (managed_zone(zone)) -+ return true; -+ } -+ return false; -+} -+#endif /* CONFIG_ZONE_DMA */ -diff --git a/mm/shmem.c b/mm/shmem.c -index b119c44435bff..aae2f408f9053 100644 ---- a/mm/shmem.c -+++ b/mm/shmem.c -@@ -466,7 +466,7 @@ static unsigned long shmem_unused_huge_shrink(struct shmem_sb_info *sbinfo, - struct shmem_inode_info *info; - struct page *page; - unsigned long batch = sc ? sc->nr_to_scan : 128; -- int removed = 0, split = 0; -+ int split = 0; - - if (list_empty(&sbinfo->shrinklist)) - return SHRINK_STOP; -@@ -481,7 +481,6 @@ static unsigned long shmem_unused_huge_shrink(struct shmem_sb_info *sbinfo, - /* inode is about to be evicted */ - if (!inode) { - list_del_init(&info->shrinklist); -- removed++; - goto next; - } - -@@ -489,12 +488,12 @@ static unsigned long shmem_unused_huge_shrink(struct shmem_sb_info *sbinfo, - if (round_up(inode->i_size, PAGE_SIZE) == - round_up(inode->i_size, HPAGE_PMD_SIZE)) { - list_move(&info->shrinklist, &to_remove); -- removed++; - goto next; - } - - list_move(&info->shrinklist, &list); - next: -+ sbinfo->shrinklist_len--; - if (!--batch) - break; - } -@@ -514,7 +513,7 @@ next: - inode = &info->vfs_inode; - - if (nr_to_split && split >= nr_to_split) -- goto leave; -+ goto move_back; - - page = find_get_page(inode->i_mapping, - (inode->i_size & HPAGE_PMD_MASK) >> PAGE_SHIFT); -@@ -528,38 +527,44 @@ next: - } - - /* -- * Leave the inode on the list if we failed to lock -- * the page at this time. -+ * Move the inode on the list back to shrinklist if we failed -+ * to lock the page at this time. - * - * Waiting for the lock may lead to deadlock in the - * reclaim path. - */ - if (!trylock_page(page)) { - put_page(page); -- goto leave; -+ goto move_back; - } - - ret = split_huge_page(page); - unlock_page(page); - put_page(page); - -- /* If split failed leave the inode on the list */ -+ /* If split failed move the inode on the list back to shrinklist */ - if (ret) -- goto leave; -+ goto move_back; - - split++; - drop: - list_del_init(&info->shrinklist); -- removed++; --leave: -+ goto put; -+move_back: -+ /* -+ * Make sure the inode is either on the global list or deleted -+ * from any local list before iput() since it could be deleted -+ * in another thread once we put the inode (then the local list -+ * is corrupted). -+ */ -+ spin_lock(&sbinfo->shrinklist_lock); -+ list_move(&info->shrinklist, &sbinfo->shrinklist); -+ sbinfo->shrinklist_len++; -+ spin_unlock(&sbinfo->shrinklist_lock); -+put: - iput(inode); - } - -- spin_lock(&sbinfo->shrinklist_lock); -- list_splice_tail(&list, &sbinfo->shrinklist); -- sbinfo->shrinklist_len -= removed; -- spin_unlock(&sbinfo->shrinklist_lock); -- - return split; - } - -diff --git a/net/batman-adv/netlink.c b/net/batman-adv/netlink.c -index 7e052d6f759b6..e59c5aa27ee0b 100644 ---- a/net/batman-adv/netlink.c -+++ b/net/batman-adv/netlink.c -@@ -1351,21 +1351,21 @@ static const struct genl_ops batadv_netlink_ops[] = { - { - .cmd = BATADV_CMD_TP_METER, - .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, -- .flags = GENL_ADMIN_PERM, -+ .flags = GENL_UNS_ADMIN_PERM, - .doit = batadv_netlink_tp_meter_start, - .internal_flags = BATADV_FLAG_NEED_MESH, - }, - { - .cmd = BATADV_CMD_TP_METER_CANCEL, - .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, -- .flags = GENL_ADMIN_PERM, -+ .flags = GENL_UNS_ADMIN_PERM, - .doit = batadv_netlink_tp_meter_cancel, - .internal_flags = BATADV_FLAG_NEED_MESH, - }, - { - .cmd = BATADV_CMD_GET_ROUTING_ALGOS, - .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, -- .flags = GENL_ADMIN_PERM, -+ .flags = GENL_UNS_ADMIN_PERM, - .dumpit = batadv_algo_dump, - }, - { -@@ -1380,68 +1380,68 @@ static const struct genl_ops batadv_netlink_ops[] = { - { - .cmd = BATADV_CMD_GET_TRANSTABLE_LOCAL, - .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, -- .flags = GENL_ADMIN_PERM, -+ .flags = GENL_UNS_ADMIN_PERM, - .dumpit = batadv_tt_local_dump, - }, - { - .cmd = BATADV_CMD_GET_TRANSTABLE_GLOBAL, - .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, -- .flags = GENL_ADMIN_PERM, -+ .flags = GENL_UNS_ADMIN_PERM, - .dumpit = batadv_tt_global_dump, - }, - { - .cmd = BATADV_CMD_GET_ORIGINATORS, - .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, -- .flags = GENL_ADMIN_PERM, -+ .flags = GENL_UNS_ADMIN_PERM, - .dumpit = batadv_orig_dump, - }, - { - .cmd = BATADV_CMD_GET_NEIGHBORS, - .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, -- .flags = GENL_ADMIN_PERM, -+ .flags = GENL_UNS_ADMIN_PERM, - .dumpit = batadv_hardif_neigh_dump, - }, - { - .cmd = BATADV_CMD_GET_GATEWAYS, - .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, -- .flags = GENL_ADMIN_PERM, -+ .flags = GENL_UNS_ADMIN_PERM, - .dumpit = batadv_gw_dump, - }, - { - .cmd = BATADV_CMD_GET_BLA_CLAIM, - .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, -- .flags = GENL_ADMIN_PERM, -+ .flags = GENL_UNS_ADMIN_PERM, - .dumpit = batadv_bla_claim_dump, - }, - { - .cmd = BATADV_CMD_GET_BLA_BACKBONE, - .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, -- .flags = GENL_ADMIN_PERM, -+ .flags = GENL_UNS_ADMIN_PERM, - .dumpit = batadv_bla_backbone_dump, - }, - { - .cmd = BATADV_CMD_GET_DAT_CACHE, - .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, -- .flags = GENL_ADMIN_PERM, -+ .flags = GENL_UNS_ADMIN_PERM, - .dumpit = batadv_dat_cache_dump, - }, - { - .cmd = BATADV_CMD_GET_MCAST_FLAGS, - .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, -- .flags = GENL_ADMIN_PERM, -+ .flags = GENL_UNS_ADMIN_PERM, - .dumpit = batadv_mcast_flags_dump, - }, - { - .cmd = BATADV_CMD_SET_MESH, - .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, -- .flags = GENL_ADMIN_PERM, -+ .flags = GENL_UNS_ADMIN_PERM, - .doit = batadv_netlink_set_mesh, - .internal_flags = BATADV_FLAG_NEED_MESH, - }, - { - .cmd = BATADV_CMD_SET_HARDIF, - .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, -- .flags = GENL_ADMIN_PERM, -+ .flags = GENL_UNS_ADMIN_PERM, - .doit = batadv_netlink_set_hardif, - .internal_flags = BATADV_FLAG_NEED_MESH | - BATADV_FLAG_NEED_HARDIF, -@@ -1457,7 +1457,7 @@ static const struct genl_ops batadv_netlink_ops[] = { - { - .cmd = BATADV_CMD_SET_VLAN, - .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, -- .flags = GENL_ADMIN_PERM, -+ .flags = GENL_UNS_ADMIN_PERM, - .doit = batadv_netlink_set_vlan, - .internal_flags = BATADV_FLAG_NEED_MESH | - BATADV_FLAG_NEED_VLAN, -diff --git a/net/bluetooth/cmtp/core.c b/net/bluetooth/cmtp/core.c -index 0a2d78e811cf5..83eb84e8e688f 100644 ---- a/net/bluetooth/cmtp/core.c -+++ b/net/bluetooth/cmtp/core.c -@@ -501,9 +501,7 @@ static int __init cmtp_init(void) - { - BT_INFO("CMTP (CAPI Emulation) ver %s", VERSION); - -- cmtp_init_sockets(); -- -- return 0; -+ return cmtp_init_sockets(); - } - - static void __exit cmtp_exit(void) -diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c -index c50e3e8afbd34..2edaa601df13a 100644 ---- a/net/bluetooth/hci_core.c -+++ b/net/bluetooth/hci_core.c -@@ -3387,6 +3387,7 @@ int hci_register_dev(struct hci_dev *hdev) - return id; - - err_wqueue: -+ debugfs_remove_recursive(hdev->debugfs); - destroy_workqueue(hdev->workqueue); - destroy_workqueue(hdev->req_workqueue); - err: -diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c -index 31469ff084cd3..40f1593651e84 100644 ---- a/net/bluetooth/hci_event.c -+++ b/net/bluetooth/hci_event.c -@@ -5506,7 +5506,8 @@ static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb) - struct hci_ev_le_advertising_info *ev = ptr; - s8 rssi; - -- if (ev->length <= HCI_MAX_AD_LENGTH) { -+ if (ev->length <= HCI_MAX_AD_LENGTH && -+ ev->data + ev->length <= skb_tail_pointer(skb)) { - rssi = ev->data[ev->length]; - process_adv_report(hdev, ev->evt_type, &ev->bdaddr, - ev->bdaddr_type, NULL, 0, rssi, -@@ -5516,6 +5517,11 @@ static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb) - } - - ptr += sizeof(*ev) + ev->length + 1; -+ -+ if (ptr > (void *) skb_tail_pointer(skb) - sizeof(*ev)) { -+ bt_dev_err(hdev, "Malicious advertising data. Stopping processing"); -+ break; -+ } - } - - hci_dev_unlock(hdev); -diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c -index 2371b833b2bcd..480e4111b24c1 100644 ---- a/net/bridge/br_netfilter_hooks.c -+++ b/net/bridge/br_netfilter_hooks.c -@@ -743,6 +743,9 @@ static int br_nf_dev_queue_xmit(struct net *net, struct sock *sk, struct sk_buff - if (nf_bridge->frag_max_size && nf_bridge->frag_max_size < mtu) - mtu = nf_bridge->frag_max_size; - -+ nf_bridge_update_protocol(skb); -+ nf_bridge_push_encap_header(skb); -+ - if (skb_is_gso(skb) || skb->len + mtu_reserved <= mtu) { - nf_bridge_info_free(skb); - return br_dev_queue_push_xmit(net, sk, skb); -@@ -760,8 +763,6 @@ static int br_nf_dev_queue_xmit(struct net *net, struct sock *sk, struct sk_buff - - IPCB(skb)->frag_max_size = nf_bridge->frag_max_size; - -- nf_bridge_update_protocol(skb); -- - data = this_cpu_ptr(&brnf_frag_data_storage); - - if (skb_vlan_tag_present(skb)) { -@@ -789,8 +790,6 @@ static int br_nf_dev_queue_xmit(struct net *net, struct sock *sk, struct sk_buff - - IP6CB(skb)->frag_max_size = nf_bridge->frag_max_size; - -- nf_bridge_update_protocol(skb); -- - data = this_cpu_ptr(&brnf_frag_data_storage); - data->encap_size = nf_bridge_encap_header_len(skb); - data->size = ETH_HLEN + data->encap_size; -diff --git a/net/core/filter.c b/net/core/filter.c -index 5ebc973ed4c50..92ce4d46f02e4 100644 ---- a/net/core/filter.c -+++ b/net/core/filter.c -@@ -4248,12 +4248,14 @@ BPF_CALL_5(bpf_setsockopt, struct bpf_sock_ops_kern *, bpf_sock, - switch (optname) { - case SO_RCVBUF: - val = min_t(u32, val, sysctl_rmem_max); -+ val = min_t(int, val, INT_MAX / 2); - sk->sk_userlocks |= SOCK_RCVBUF_LOCK; - WRITE_ONCE(sk->sk_rcvbuf, - max_t(int, val * 2, SOCK_MIN_RCVBUF)); - break; - case SO_SNDBUF: - val = min_t(u32, val, sysctl_wmem_max); -+ val = min_t(int, val, INT_MAX / 2); - sk->sk_userlocks |= SOCK_SNDBUF_LOCK; - WRITE_ONCE(sk->sk_sndbuf, - max_t(int, val * 2, SOCK_MIN_SNDBUF)); -@@ -6910,9 +6912,9 @@ void bpf_warn_invalid_xdp_action(u32 act) - { - const u32 act_max = XDP_REDIRECT; - -- WARN_ONCE(1, "%s XDP return value %u, expect packet loss!\n", -- act > act_max ? "Illegal" : "Driver unsupported", -- act); -+ pr_warn_once("%s XDP return value %u, expect packet loss!\n", -+ act > act_max ? "Illegal" : "Driver unsupported", -+ act); - } - EXPORT_SYMBOL_GPL(bpf_warn_invalid_xdp_action); - -diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c -index 05b0c60bfba2b..bcad7028bbf45 100644 ---- a/net/core/net-sysfs.c -+++ b/net/core/net-sysfs.c -@@ -1661,6 +1661,9 @@ static void remove_queue_kobjects(struct net_device *dev) - - net_rx_queue_update_kobjects(dev, real_rx, 0); - netdev_queue_update_kobjects(dev, real_tx, 0); -+ -+ dev->real_num_rx_queues = 0; -+ dev->real_num_tx_queues = 0; - #ifdef CONFIG_SYSFS - kset_unregister(dev->queues_kset); - #endif -diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c -index cd1d40195e461..62a972f04cefb 100644 ---- a/net/core/net_namespace.c -+++ b/net/core/net_namespace.c -@@ -168,8 +168,10 @@ static void ops_exit_list(const struct pernet_operations *ops, - { - struct net *net; - if (ops->exit) { -- list_for_each_entry(net, net_exit_list, exit_list) -+ list_for_each_entry(net, net_exit_list, exit_list) { - ops->exit(net); -+ cond_resched(); -+ } - } - if (ops->exit_batch) - ops->exit_batch(net_exit_list); -diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c -index ce4b28f011485..692ba6d6180f8 100644 ---- a/net/ipv4/fib_semantics.c -+++ b/net/ipv4/fib_semantics.c -@@ -29,6 +29,7 @@ - #include - #include - #include -+#include - - #include - #include -@@ -318,11 +319,15 @@ static inline int nh_comp(struct fib_info *fi, struct fib_info *ofi) - - static inline unsigned int fib_devindex_hashfn(unsigned int val) - { -- unsigned int mask = DEVINDEX_HASHSIZE - 1; -+ return hash_32(val, DEVINDEX_HASHBITS); -+} -+ -+static struct hlist_head * -+fib_info_devhash_bucket(const struct net_device *dev) -+{ -+ u32 val = net_hash_mix(dev_net(dev)) ^ dev->ifindex; - -- return (val ^ -- (val >> DEVINDEX_HASHBITS) ^ -- (val >> (DEVINDEX_HASHBITS * 2))) & mask; -+ return &fib_info_devhash[fib_devindex_hashfn(val)]; - } - - static unsigned int fib_info_hashfn_1(int init_val, u8 protocol, u8 scope, -@@ -432,12 +437,11 @@ int ip_fib_check_default(__be32 gw, struct net_device *dev) - { - struct hlist_head *head; - struct fib_nh *nh; -- unsigned int hash; - - spin_lock(&fib_info_lock); - -- hash = fib_devindex_hashfn(dev->ifindex); -- head = &fib_info_devhash[hash]; -+ head = fib_info_devhash_bucket(dev); -+ - hlist_for_each_entry(nh, head, nh_hash) { - if (nh->fib_nh_dev == dev && - nh->fib_nh_gw4 == gw && -@@ -1594,12 +1598,10 @@ link_it: - } else { - change_nexthops(fi) { - struct hlist_head *head; -- unsigned int hash; - - if (!nexthop_nh->fib_nh_dev) - continue; -- hash = fib_devindex_hashfn(nexthop_nh->fib_nh_dev->ifindex); -- head = &fib_info_devhash[hash]; -+ head = fib_info_devhash_bucket(nexthop_nh->fib_nh_dev); - hlist_add_head(&nexthop_nh->nh_hash, head); - } endfor_nexthops(fi) - } -@@ -1940,8 +1942,7 @@ void fib_nhc_update_mtu(struct fib_nh_common *nhc, u32 new, u32 orig) - - void fib_sync_mtu(struct net_device *dev, u32 orig_mtu) - { -- unsigned int hash = fib_devindex_hashfn(dev->ifindex); -- struct hlist_head *head = &fib_info_devhash[hash]; -+ struct hlist_head *head = fib_info_devhash_bucket(dev); - struct fib_nh *nh; - - hlist_for_each_entry(nh, head, nh_hash) { -@@ -1960,12 +1961,11 @@ void fib_sync_mtu(struct net_device *dev, u32 orig_mtu) - */ - int fib_sync_down_dev(struct net_device *dev, unsigned long event, bool force) - { -- int ret = 0; -- int scope = RT_SCOPE_NOWHERE; -+ struct hlist_head *head = fib_info_devhash_bucket(dev); - struct fib_info *prev_fi = NULL; -- unsigned int hash = fib_devindex_hashfn(dev->ifindex); -- struct hlist_head *head = &fib_info_devhash[hash]; -+ int scope = RT_SCOPE_NOWHERE; - struct fib_nh *nh; -+ int ret = 0; - - if (force) - scope = -1; -@@ -2110,7 +2110,6 @@ out: - int fib_sync_up(struct net_device *dev, unsigned char nh_flags) - { - struct fib_info *prev_fi; -- unsigned int hash; - struct hlist_head *head; - struct fib_nh *nh; - int ret; -@@ -2126,8 +2125,7 @@ int fib_sync_up(struct net_device *dev, unsigned char nh_flags) - } - - prev_fi = NULL; -- hash = fib_devindex_hashfn(dev->ifindex); -- head = &fib_info_devhash[hash]; -+ head = fib_info_devhash_bucket(dev); - ret = 0; - - hlist_for_each_entry(nh, head, nh_hash) { -diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c -index 10d31733297d7..e0e8a65d561ec 100644 ---- a/net/ipv4/inet_fragment.c -+++ b/net/ipv4/inet_fragment.c -@@ -204,9 +204,9 @@ void inet_frag_kill(struct inet_frag_queue *fq) - /* The RCU read lock provides a memory barrier - * guaranteeing that if fqdir->dead is false then - * the hash table destruction will not start until -- * after we unlock. Paired with inet_frags_exit_net(). -+ * after we unlock. Paired with fqdir_pre_exit(). - */ -- if (!fqdir->dead) { -+ if (!READ_ONCE(fqdir->dead)) { - rhashtable_remove_fast(&fqdir->rhashtable, &fq->node, - fqdir->f->rhash_params); - refcount_dec(&fq->refcnt); -@@ -321,9 +321,11 @@ static struct inet_frag_queue *inet_frag_create(struct fqdir *fqdir, - /* TODO : call from rcu_read_lock() and no longer use refcount_inc_not_zero() */ - struct inet_frag_queue *inet_frag_find(struct fqdir *fqdir, void *key) - { -+ /* This pairs with WRITE_ONCE() in fqdir_pre_exit(). */ -+ long high_thresh = READ_ONCE(fqdir->high_thresh); - struct inet_frag_queue *fq = NULL, *prev; - -- if (!fqdir->high_thresh || frag_mem_limit(fqdir) > fqdir->high_thresh) -+ if (!high_thresh || frag_mem_limit(fqdir) > high_thresh) - return NULL; - - rcu_read_lock(); -diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c -index cfeb8890f94ee..fad803d2d711e 100644 ---- a/net/ipv4/ip_fragment.c -+++ b/net/ipv4/ip_fragment.c -@@ -144,7 +144,8 @@ static void ip_expire(struct timer_list *t) - - rcu_read_lock(); - -- if (qp->q.fqdir->dead) -+ /* Paired with WRITE_ONCE() in fqdir_pre_exit(). */ -+ if (READ_ONCE(qp->q.fqdir->dead)) - goto out_rcu_unlock; - - spin_lock(&qp->q.lock); -diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c -index c4989e5903e43..f67f1d27f5655 100644 ---- a/net/ipv4/ip_gre.c -+++ b/net/ipv4/ip_gre.c -@@ -577,8 +577,9 @@ static int gre_fill_metadata_dst(struct net_device *dev, struct sk_buff *skb) - - key = &info->key; - ip_tunnel_init_flow(&fl4, IPPROTO_GRE, key->u.ipv4.dst, key->u.ipv4.src, -- tunnel_id_to_key32(key->tun_id), key->tos, 0, -- skb->mark, skb_get_hash(skb)); -+ tunnel_id_to_key32(key->tun_id), -+ key->tos & ~INET_ECN_MASK, 0, skb->mark, -+ skb_get_hash(skb)); - rt = ip_route_output_key(dev_net(dev), &fl4); - if (IS_ERR(rt)) - return PTR_ERR(rt); -diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c -index 6bdb1ab8af617..63ebb87d85331 100644 ---- a/net/ipv4/netfilter/ipt_CLUSTERIP.c -+++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c -@@ -505,8 +505,11 @@ static int clusterip_tg_check(const struct xt_tgchk_param *par) - if (IS_ERR(config)) - return PTR_ERR(config); - } -- } else if (memcmp(&config->clustermac, &cipinfo->clustermac, ETH_ALEN)) -+ } else if (memcmp(&config->clustermac, &cipinfo->clustermac, ETH_ALEN)) { -+ clusterip_config_entry_put(config); -+ clusterip_config_put(config); - return -EINVAL; -+ } - - ret = nf_ct_netns_get(par->net, par->family); - if (ret < 0) { -diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c -index 0cb8056d98003..5dbc280d43856 100644 ---- a/net/ipv6/ip6_gre.c -+++ b/net/ipv6/ip6_gre.c -@@ -743,6 +743,7 @@ static netdev_tx_t __gre6_xmit(struct sk_buff *skb, - fl6->daddr = key->u.ipv6.dst; - fl6->flowlabel = key->label; - fl6->flowi6_uid = sock_net_uid(dev_net(dev), NULL); -+ fl6->fl6_gre_key = tunnel_id_to_key32(key->tun_id); - - dsfield = key->tos; - flags = key->tun_flags & -@@ -978,6 +979,7 @@ static netdev_tx_t ip6erspan_tunnel_xmit(struct sk_buff *skb, - fl6.daddr = key->u.ipv6.dst; - fl6.flowlabel = key->label; - fl6.flowi6_uid = sock_net_uid(dev_net(dev), NULL); -+ fl6.fl6_gre_key = tunnel_id_to_key32(key->tun_id); - - dsfield = key->tos; - if (!(tun_info->key.tun_flags & TUNNEL_ERSPAN_OPT)) -@@ -1085,6 +1087,7 @@ static void ip6gre_tnl_link_config_common(struct ip6_tnl *t) - fl6->flowi6_oif = p->link; - fl6->flowlabel = 0; - fl6->flowi6_proto = IPPROTO_GRE; -+ fl6->fl6_gre_key = t->parms.o_key; - - if (!(p->flags&IP6_TNL_F_USE_ORIG_TCLASS)) - fl6->flowlabel |= IPV6_TCLASS_MASK & p->flowinfo; -@@ -1530,7 +1533,7 @@ static void ip6gre_fb_tunnel_init(struct net_device *dev) - static struct inet6_protocol ip6gre_protocol __read_mostly = { - .handler = gre_rcv, - .err_handler = ip6gre_err, -- .flags = INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL, -+ .flags = INET6_PROTO_FINAL, - }; - - static void ip6gre_destroy_tunnels(struct net *net, struct list_head *head) -diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c -index 282bf336b15a4..464029892478f 100644 ---- a/net/mac80211/rx.c -+++ b/net/mac80211/rx.c -@@ -4693,7 +4693,7 @@ void ieee80211_rx_napi(struct ieee80211_hw *hw, struct ieee80211_sta *pubsta, - goto drop; - break; - case RX_ENC_VHT: -- if (WARN_ONCE(status->rate_idx > 9 || -+ if (WARN_ONCE(status->rate_idx > 11 || - !status->nss || - status->nss > 8, - "Rate marked as a VHT rate but data is invalid: MCS: %d, NSS: %d\n", -diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c -index a7e861eede2d9..bd2174699af97 100644 ---- a/net/nfc/llcp_sock.c -+++ b/net/nfc/llcp_sock.c -@@ -789,6 +789,11 @@ static int llcp_sock_sendmsg(struct socket *sock, struct msghdr *msg, - - lock_sock(sk); - -+ if (!llcp_sock->local) { -+ release_sock(sk); -+ return -ENODEV; -+ } -+ - if (sk->sk_type == SOCK_DGRAM) { - DECLARE_SOCKADDR(struct sockaddr_nfc_llcp *, addr, - msg->msg_name); -diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c -index d973f8a15e117..ae5847de94c88 100644 ---- a/net/sched/sch_generic.c -+++ b/net/sched/sch_generic.c -@@ -1396,6 +1396,7 @@ void psched_ratecfg_precompute(struct psched_ratecfg *r, - { - memset(r, 0, sizeof(*r)); - r->overhead = conf->overhead; -+ r->mpu = conf->mpu; - r->rate_bytes_ps = max_t(u64, conf->rate, rate64); - r->linklayer = (conf->linklayer & TC_LINKLAYER_MASK); - r->mult = 1; -diff --git a/net/unix/garbage.c b/net/unix/garbage.c -index 12e2ddaf887f2..d45d5366115a7 100644 ---- a/net/unix/garbage.c -+++ b/net/unix/garbage.c -@@ -192,8 +192,11 @@ void wait_for_unix_gc(void) - { - /* If number of inflight sockets is insane, - * force a garbage collect right now. -+ * Paired with the WRITE_ONCE() in unix_inflight(), -+ * unix_notinflight() and gc_in_progress(). - */ -- if (unix_tot_inflight > UNIX_INFLIGHT_TRIGGER_GC && !gc_in_progress) -+ if (READ_ONCE(unix_tot_inflight) > UNIX_INFLIGHT_TRIGGER_GC && -+ !READ_ONCE(gc_in_progress)) - unix_gc(); - wait_event(unix_gc_wait, gc_in_progress == false); - } -@@ -213,7 +216,9 @@ void unix_gc(void) - if (gc_in_progress) - goto out; - -- gc_in_progress = true; -+ /* Paired with READ_ONCE() in wait_for_unix_gc(). */ -+ WRITE_ONCE(gc_in_progress, true); -+ - /* First, select candidates for garbage collection. Only - * in-flight sockets are considered, and from those only ones - * which don't have any external reference. -@@ -299,7 +304,10 @@ void unix_gc(void) - - /* All candidates should have been detached by now. */ - BUG_ON(!list_empty(&gc_candidates)); -- gc_in_progress = false; -+ -+ /* Paired with READ_ONCE() in wait_for_unix_gc(). */ -+ WRITE_ONCE(gc_in_progress, false); -+ - wake_up(&unix_gc_wait); - - out: -diff --git a/net/unix/scm.c b/net/unix/scm.c -index 8c40f2b323924..ce700b22eccee 100644 ---- a/net/unix/scm.c -+++ b/net/unix/scm.c -@@ -59,7 +59,8 @@ void unix_inflight(struct user_struct *user, struct file *fp) - } else { - BUG_ON(list_empty(&u->link)); - } -- unix_tot_inflight++; -+ /* Paired with READ_ONCE() in wait_for_unix_gc() */ -+ WRITE_ONCE(unix_tot_inflight, unix_tot_inflight + 1); - } - user->unix_inflight++; - spin_unlock(&unix_gc_lock); -@@ -79,7 +80,8 @@ void unix_notinflight(struct user_struct *user, struct file *fp) - - if (atomic_long_dec_and_test(&u->inflight)) - list_del_init(&u->link); -- unix_tot_inflight--; -+ /* Paired with READ_ONCE() in wait_for_unix_gc() */ -+ WRITE_ONCE(unix_tot_inflight, unix_tot_inflight - 1); - } - user->unix_inflight--; - spin_unlock(&unix_gc_lock); -diff --git a/net/xfrm/xfrm_interface.c b/net/xfrm/xfrm_interface.c -index 74e90d78c3b46..08343201513a9 100644 ---- a/net/xfrm/xfrm_interface.c -+++ b/net/xfrm/xfrm_interface.c -@@ -659,11 +659,16 @@ static int xfrmi_newlink(struct net *src_net, struct net_device *dev, - struct netlink_ext_ack *extack) - { - struct net *net = dev_net(dev); -- struct xfrm_if_parms p; -+ struct xfrm_if_parms p = {}; - struct xfrm_if *xi; - int err; - - xfrmi_netlink_parms(data, &p); -+ if (!p.if_id) { -+ NL_SET_ERR_MSG(extack, "if_id must be non zero"); -+ return -EINVAL; -+ } -+ - xi = xfrmi_locate(net, &p); - if (xi) - return -EEXIST; -@@ -688,7 +693,12 @@ static int xfrmi_changelink(struct net_device *dev, struct nlattr *tb[], - { - struct xfrm_if *xi = netdev_priv(dev); - struct net *net = xi->net; -- struct xfrm_if_parms p; -+ struct xfrm_if_parms p = {}; -+ -+ if (!p.if_id) { -+ NL_SET_ERR_MSG(extack, "if_id must be non zero"); -+ return -EINVAL; -+ } - - xfrmi_netlink_parms(data, &p); - xi = xfrmi_locate(net, &p); -diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c -index 32c8163427970..404823c5eb7d5 100644 ---- a/net/xfrm/xfrm_policy.c -+++ b/net/xfrm/xfrm_policy.c -@@ -31,8 +31,10 @@ - #include - #include - #include -+#include - #include - #include -+#include - #if IS_ENABLED(CONFIG_IPV6_MIP6) - #include - #endif -@@ -3281,7 +3283,7 @@ decode_session4(struct sk_buff *skb, struct flowi *fl, bool reverse) - fl4->flowi4_proto = iph->protocol; - fl4->daddr = reverse ? iph->saddr : iph->daddr; - fl4->saddr = reverse ? iph->daddr : iph->saddr; -- fl4->flowi4_tos = iph->tos; -+ fl4->flowi4_tos = iph->tos & ~INET_ECN_MASK; - - if (!ip_is_fragment(iph)) { - switch (iph->protocol) { -@@ -3443,6 +3445,26 @@ decode_session6(struct sk_buff *skb, struct flowi *fl, bool reverse) - } - fl6->flowi6_proto = nexthdr; - return; -+ case IPPROTO_GRE: -+ if (!onlyproto && -+ (nh + offset + 12 < skb->data || -+ pskb_may_pull(skb, nh + offset + 12 - skb->data))) { -+ struct gre_base_hdr *gre_hdr; -+ __be32 *gre_key; -+ -+ nh = skb_network_header(skb); -+ gre_hdr = (struct gre_base_hdr *)(nh + offset); -+ gre_key = (__be32 *)(gre_hdr + 1); -+ -+ if (gre_hdr->flags & GRE_KEY) { -+ if (gre_hdr->flags & GRE_CSUM) -+ gre_key++; -+ fl6->fl6_gre_key = *gre_key; -+ } -+ } -+ fl6->flowi6_proto = nexthdr; -+ return; -+ - #if IS_ENABLED(CONFIG_IPV6_MIP6) - case IPPROTO_MH: - offset += ipv6_optlen(exthdr); -diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c -index 0cee2d3c6e452..42ff32700d68b 100644 ---- a/net/xfrm/xfrm_user.c -+++ b/net/xfrm/xfrm_user.c -@@ -621,8 +621,13 @@ static struct xfrm_state *xfrm_state_construct(struct net *net, - - xfrm_smark_init(attrs, &x->props.smark); - -- if (attrs[XFRMA_IF_ID]) -+ if (attrs[XFRMA_IF_ID]) { - x->if_id = nla_get_u32(attrs[XFRMA_IF_ID]); -+ if (!x->if_id) { -+ err = -EINVAL; -+ goto error; -+ } -+ } - - err = __xfrm_init_state(x, false, attrs[XFRMA_OFFLOAD_DEV]); - if (err) -@@ -1328,8 +1333,13 @@ static int xfrm_alloc_userspi(struct sk_buff *skb, struct nlmsghdr *nlh, - - mark = xfrm_mark_get(attrs, &m); - -- if (attrs[XFRMA_IF_ID]) -+ if (attrs[XFRMA_IF_ID]) { - if_id = nla_get_u32(attrs[XFRMA_IF_ID]); -+ if (!if_id) { -+ err = -EINVAL; -+ goto out_noput; -+ } -+ } - - if (p->info.seq) { - x = xfrm_find_acq_byseq(net, mark, p->info.seq); -@@ -1631,8 +1641,13 @@ static struct xfrm_policy *xfrm_policy_construct(struct net *net, struct xfrm_us - - xfrm_mark_get(attrs, &xp->mark); - -- if (attrs[XFRMA_IF_ID]) -+ if (attrs[XFRMA_IF_ID]) { - xp->if_id = nla_get_u32(attrs[XFRMA_IF_ID]); -+ if (!xp->if_id) { -+ err = -EINVAL; -+ goto error; -+ } -+ } - - return xp; - error: -@@ -2816,7 +2831,7 @@ static inline unsigned int xfrm_sa_len(struct xfrm_state *x) - if (x->props.extra_flags) - l += nla_total_size(sizeof(x->props.extra_flags)); - if (x->xso.dev) -- l += nla_total_size(sizeof(x->xso)); -+ l += nla_total_size(sizeof(struct xfrm_user_offload)); - if (x->props.smark.v | x->props.smark.m) { - l += nla_total_size(sizeof(x->props.smark.v)); - l += nla_total_size(sizeof(x->props.smark.m)); -diff --git a/scripts/dtc/dtx_diff b/scripts/dtc/dtx_diff -index 00fd4738a5877..ae6c766a56ccc 100755 ---- a/scripts/dtc/dtx_diff -+++ b/scripts/dtc/dtx_diff -@@ -56,12 +56,8 @@ Otherwise DTx is treated as a dts source file (aka .dts). - or '/include/' to be processed. - - If DTx_1 and DTx_2 are in different architectures, then this script -- may not work since \${ARCH} is part of the include path. Two possible -- workarounds: -- -- `basename $0` \\ -- <(ARCH=arch_of_dtx_1 `basename $0` DTx_1) \\ -- <(ARCH=arch_of_dtx_2 `basename $0` DTx_2) -+ may not work since \${ARCH} is part of the include path. The following -+ workaround can be used: - - `basename $0` ARCH=arch_of_dtx_1 DTx_1 >tmp_dtx_1.dts - `basename $0` ARCH=arch_of_dtx_2 DTx_2 >tmp_dtx_2.dts -diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c -index 91f2ba0b225b7..56418cf72069d 100644 ---- a/security/selinux/hooks.c -+++ b/security/selinux/hooks.c -@@ -995,18 +995,22 @@ out: - static int selinux_add_opt(int token, const char *s, void **mnt_opts) - { - struct selinux_mnt_opts *opts = *mnt_opts; -+ bool is_alloc_opts = false; - - if (token == Opt_seclabel) /* eaten and completely ignored */ - return 0; - -+ if (!s) -+ return -ENOMEM; -+ - if (!opts) { - opts = kzalloc(sizeof(struct selinux_mnt_opts), GFP_KERNEL); - if (!opts) - return -ENOMEM; - *mnt_opts = opts; -+ is_alloc_opts = true; - } -- if (!s) -- return -ENOMEM; -+ - switch (token) { - case Opt_context: - if (opts->context || opts->defcontext) -@@ -1031,6 +1035,10 @@ static int selinux_add_opt(int token, const char *s, void **mnt_opts) - } - return 0; - Einval: -+ if (is_alloc_opts) { -+ kfree(opts); -+ *mnt_opts = NULL; -+ } - pr_warn(SEL_MOUNT_FAIL_MSG); - return -EINVAL; - } -diff --git a/sound/core/jack.c b/sound/core/jack.c -index 8b209750c7a9c..b00ae6f39f054 100644 ---- a/sound/core/jack.c -+++ b/sound/core/jack.c -@@ -54,10 +54,13 @@ static int snd_jack_dev_free(struct snd_device *device) - struct snd_card *card = device->card; - struct snd_jack_kctl *jack_kctl, *tmp_jack_kctl; - -+ down_write(&card->controls_rwsem); - list_for_each_entry_safe(jack_kctl, tmp_jack_kctl, &jack->kctl_list, list) { - list_del_init(&jack_kctl->list); - snd_ctl_remove(card, jack_kctl->kctl); - } -+ up_write(&card->controls_rwsem); -+ - if (jack->private_free) - jack->private_free(jack); - -diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c -index 9e31f4bd43826..841c0a12cc929 100644 ---- a/sound/core/oss/pcm_oss.c -+++ b/sound/core/oss/pcm_oss.c -@@ -2055,7 +2055,7 @@ static int snd_pcm_oss_set_trigger(struct snd_pcm_oss_file *pcm_oss_file, int tr - int err, cmd; - - #ifdef OSS_DEBUG -- pcm_dbg(substream->pcm, "pcm_oss: trigger = 0x%x\n", trigger); -+ pr_debug("pcm_oss: trigger = 0x%x\n", trigger); - #endif - - psubstream = pcm_oss_file->streams[SNDRV_PCM_STREAM_PLAYBACK]; -diff --git a/sound/core/pcm.c b/sound/core/pcm.c -index 9a72d641743d9..f8ce961c28d6e 100644 ---- a/sound/core/pcm.c -+++ b/sound/core/pcm.c -@@ -810,7 +810,11 @@ EXPORT_SYMBOL(snd_pcm_new_internal); - static void free_chmap(struct snd_pcm_str *pstr) - { - if (pstr->chmap_kctl) { -- snd_ctl_remove(pstr->pcm->card, pstr->chmap_kctl); -+ struct snd_card *card = pstr->pcm->card; -+ -+ down_write(&card->controls_rwsem); -+ snd_ctl_remove(card, pstr->chmap_kctl); -+ up_write(&card->controls_rwsem); - pstr->chmap_kctl = NULL; - } - } -diff --git a/sound/core/seq/seq_queue.c b/sound/core/seq/seq_queue.c -index 71a6ea62c3be7..4ff0b927230c2 100644 ---- a/sound/core/seq/seq_queue.c -+++ b/sound/core/seq/seq_queue.c -@@ -234,12 +234,15 @@ struct snd_seq_queue *snd_seq_queue_find_name(char *name) - - /* -------------------------------------------------------- */ - -+#define MAX_CELL_PROCESSES_IN_QUEUE 1000 -+ - void snd_seq_check_queue(struct snd_seq_queue *q, int atomic, int hop) - { - unsigned long flags; - struct snd_seq_event_cell *cell; - snd_seq_tick_time_t cur_tick; - snd_seq_real_time_t cur_time; -+ int processed = 0; - - if (q == NULL) - return; -@@ -262,6 +265,8 @@ void snd_seq_check_queue(struct snd_seq_queue *q, int atomic, int hop) - if (!cell) - break; - snd_seq_dispatch_event(cell, atomic, hop); -+ if (++processed >= MAX_CELL_PROCESSES_IN_QUEUE) -+ goto out; /* the rest processed at the next batch */ - } - - /* Process time queue... */ -@@ -271,14 +276,19 @@ void snd_seq_check_queue(struct snd_seq_queue *q, int atomic, int hop) - if (!cell) - break; - snd_seq_dispatch_event(cell, atomic, hop); -+ if (++processed >= MAX_CELL_PROCESSES_IN_QUEUE) -+ goto out; /* the rest processed at the next batch */ - } - -+ out: - /* free lock */ - spin_lock_irqsave(&q->check_lock, flags); - if (q->check_again) { - q->check_again = 0; -- spin_unlock_irqrestore(&q->check_lock, flags); -- goto __again; -+ if (processed < MAX_CELL_PROCESSES_IN_QUEUE) { -+ spin_unlock_irqrestore(&q->check_lock, flags); -+ goto __again; -+ } - } - q->check_blocked = 0; - spin_unlock_irqrestore(&q->check_lock, flags); -diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c -index 326f95ce5ceb1..c8847de8388f0 100644 ---- a/sound/pci/hda/hda_codec.c -+++ b/sound/pci/hda/hda_codec.c -@@ -1721,8 +1721,11 @@ void snd_hda_ctls_clear(struct hda_codec *codec) - { - int i; - struct hda_nid_item *items = codec->mixers.list; -+ -+ down_write(&codec->card->controls_rwsem); - for (i = 0; i < codec->mixers.used; i++) - snd_ctl_remove(codec->card, items[i].kctl); -+ up_write(&codec->card->controls_rwsem); - snd_array_free(&codec->mixers); - snd_array_free(&codec->nids); - } -diff --git a/sound/soc/codecs/rt5663.c b/sound/soc/codecs/rt5663.c -index 2943692f66edd..3610be1590fcc 100644 ---- a/sound/soc/codecs/rt5663.c -+++ b/sound/soc/codecs/rt5663.c -@@ -3461,6 +3461,7 @@ static void rt5663_calibrate(struct rt5663_priv *rt5663) - static int rt5663_parse_dp(struct rt5663_priv *rt5663, struct device *dev) - { - int table_size; -+ int ret; - - device_property_read_u32(dev, "realtek,dc_offset_l_manual", - &rt5663->pdata.dc_offset_l_manual); -@@ -3477,9 +3478,11 @@ static int rt5663_parse_dp(struct rt5663_priv *rt5663, struct device *dev) - table_size = sizeof(struct impedance_mapping_table) * - rt5663->pdata.impedance_sensing_num; - rt5663->imp_table = devm_kzalloc(dev, table_size, GFP_KERNEL); -- device_property_read_u32_array(dev, -+ ret = device_property_read_u32_array(dev, - "realtek,impedance_sensing_table", - (u32 *)rt5663->imp_table, table_size); -+ if (ret) -+ return ret; - } - - return 0; -@@ -3504,8 +3507,11 @@ static int rt5663_i2c_probe(struct i2c_client *i2c, - - if (pdata) - rt5663->pdata = *pdata; -- else -- rt5663_parse_dp(rt5663, &i2c->dev); -+ else { -+ ret = rt5663_parse_dp(rt5663, &i2c->dev); -+ if (ret) -+ return ret; -+ } - - for (i = 0; i < ARRAY_SIZE(rt5663->supplies); i++) - rt5663->supplies[i].supply = rt5663_supply_names[i]; -diff --git a/sound/soc/mediatek/mt8173/mt8173-max98090.c b/sound/soc/mediatek/mt8173/mt8173-max98090.c -index 22c00600c999f..de1410c2c446f 100644 ---- a/sound/soc/mediatek/mt8173/mt8173-max98090.c -+++ b/sound/soc/mediatek/mt8173/mt8173-max98090.c -@@ -180,6 +180,9 @@ static int mt8173_max98090_dev_probe(struct platform_device *pdev) - if (ret) - dev_err(&pdev->dev, "%s snd_soc_register_card fail %d\n", - __func__, ret); -+ -+ of_node_put(codec_node); -+ of_node_put(platform_node); - return ret; - } - -diff --git a/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5514.c b/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5514.c -index 8717e87bfe264..6f8542329bab9 100644 ---- a/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5514.c -+++ b/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5514.c -@@ -218,6 +218,8 @@ static int mt8173_rt5650_rt5514_dev_probe(struct platform_device *pdev) - if (ret) - dev_err(&pdev->dev, "%s snd_soc_register_card fail %d\n", - __func__, ret); -+ -+ of_node_put(platform_node); - return ret; - } - -diff --git a/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5676.c b/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5676.c -index 9d4dd97211548..727ff0f7f20b1 100644 ---- a/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5676.c -+++ b/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5676.c -@@ -285,6 +285,8 @@ static int mt8173_rt5650_rt5676_dev_probe(struct platform_device *pdev) - if (ret) - dev_err(&pdev->dev, "%s snd_soc_register_card fail %d\n", - __func__, ret); -+ -+ of_node_put(platform_node); - return ret; - } - -diff --git a/sound/soc/mediatek/mt8173/mt8173-rt5650.c b/sound/soc/mediatek/mt8173/mt8173-rt5650.c -index ef6f236752867..21e7d4d3ded5a 100644 ---- a/sound/soc/mediatek/mt8173/mt8173-rt5650.c -+++ b/sound/soc/mediatek/mt8173/mt8173-rt5650.c -@@ -309,6 +309,8 @@ static int mt8173_rt5650_dev_probe(struct platform_device *pdev) - if (ret) - dev_err(&pdev->dev, "%s snd_soc_register_card fail %d\n", - __func__, ret); -+ -+ of_node_put(platform_node); - return ret; - } - -diff --git a/sound/soc/samsung/idma.c b/sound/soc/samsung/idma.c -index 65497cd477a50..47f6f5d70853d 100644 ---- a/sound/soc/samsung/idma.c -+++ b/sound/soc/samsung/idma.c -@@ -363,6 +363,8 @@ static int preallocate_idma_buffer(struct snd_pcm *pcm, int stream) - buf->addr = idma.lp_tx_addr; - buf->bytes = idma_hardware.buffer_bytes_max; - buf->area = (unsigned char * __force)ioremap(buf->addr, buf->bytes); -+ if (!buf->area) -+ return -ENOMEM; - - return 0; - } -diff --git a/sound/soc/uniphier/Kconfig b/sound/soc/uniphier/Kconfig -index aa3592ee1358b..ddfa6424c656b 100644 ---- a/sound/soc/uniphier/Kconfig -+++ b/sound/soc/uniphier/Kconfig -@@ -23,7 +23,6 @@ config SND_SOC_UNIPHIER_LD11 - tristate "UniPhier LD11/LD20 Device Driver" - depends on SND_SOC_UNIPHIER - select SND_SOC_UNIPHIER_AIO -- select SND_SOC_UNIPHIER_AIO_DMA - help - This adds ASoC driver for Socionext UniPhier LD11/LD20 - input and output that can be used with other codecs. -@@ -34,7 +33,6 @@ config SND_SOC_UNIPHIER_PXS2 - tristate "UniPhier PXs2 Device Driver" - depends on SND_SOC_UNIPHIER - select SND_SOC_UNIPHIER_AIO -- select SND_SOC_UNIPHIER_AIO_DMA - help - This adds ASoC driver for Socionext UniPhier PXs2 - input and output that can be used with other codecs. -diff --git a/tools/bpf/bpftool/Documentation/Makefile b/tools/bpf/bpftool/Documentation/Makefile -index 815ac9804aee9..f79bba931cbfb 100644 ---- a/tools/bpf/bpftool/Documentation/Makefile -+++ b/tools/bpf/bpftool/Documentation/Makefile -@@ -1,6 +1,5 @@ - # SPDX-License-Identifier: GPL-2.0-only - include ../../../scripts/Makefile.include --include ../../../scripts/utilities.mak - - INSTALL ?= install - RM ?= rm -f -diff --git a/tools/bpf/bpftool/Makefile b/tools/bpf/bpftool/Makefile -index 39bc6f0f4f0bb..10ecd9dfeaf34 100644 ---- a/tools/bpf/bpftool/Makefile -+++ b/tools/bpf/bpftool/Makefile -@@ -1,6 +1,5 @@ - # SPDX-License-Identifier: GPL-2.0-only - include ../../scripts/Makefile.include --include ../../scripts/utilities.mak - - ifeq ($(srctree),) - srctree := $(patsubst %/,%,$(dir $(CURDIR))) -diff --git a/tools/bpf/bpftool/main.c b/tools/bpf/bpftool/main.c -index 7d3cfb0ccbe61..4b03983acbefe 100644 ---- a/tools/bpf/bpftool/main.c -+++ b/tools/bpf/bpftool/main.c -@@ -362,6 +362,8 @@ int main(int argc, char **argv) - }; - int opt, ret; - -+ setlinebuf(stdout); -+ - last_do_help = do_help; - pretty_output = false; - json_output = false; -diff --git a/tools/include/nolibc/nolibc.h b/tools/include/nolibc/nolibc.h -index 2551e9b71167b..b8cecb66d28b7 100644 ---- a/tools/include/nolibc/nolibc.h -+++ b/tools/include/nolibc/nolibc.h -@@ -422,16 +422,22 @@ struct stat { - }) - - /* startup code */ -+/* -+ * x86-64 System V ABI mandates: -+ * 1) %rsp must be 16-byte aligned right before the function call. -+ * 2) The deepest stack frame should be zero (the %rbp). -+ * -+ */ - asm(".section .text\n" - ".global _start\n" - "_start:\n" - "pop %rdi\n" // argc (first arg, %rdi) - "mov %rsp, %rsi\n" // argv[] (second arg, %rsi) - "lea 8(%rsi,%rdi,8),%rdx\n" // then a NULL then envp (third arg, %rdx) -- "and $-16, %rsp\n" // x86 ABI : esp must be 16-byte aligned when -- "sub $8, %rsp\n" // entering the callee -+ "xor %ebp, %ebp\n" // zero the stack frame -+ "and $-16, %rsp\n" // x86 ABI : esp must be 16-byte aligned before call - "call main\n" // main() returns the status code, we'll exit with it. -- "movzb %al, %rdi\n" // retrieve exit code from 8 lower bits -+ "mov %eax, %edi\n" // retrieve exit code (32 bit) - "mov $60, %rax\n" // NR_exit == 60 - "syscall\n" // really exit - "hlt\n" // ensure it does not return -@@ -600,20 +606,28 @@ struct sys_stat_struct { - }) - - /* startup code */ -+/* -+ * i386 System V ABI mandates: -+ * 1) last pushed argument must be 16-byte aligned. -+ * 2) The deepest stack frame should be set to zero -+ * -+ */ - asm(".section .text\n" - ".global _start\n" - "_start:\n" - "pop %eax\n" // argc (first arg, %eax) - "mov %esp, %ebx\n" // argv[] (second arg, %ebx) - "lea 4(%ebx,%eax,4),%ecx\n" // then a NULL then envp (third arg, %ecx) -- "and $-16, %esp\n" // x86 ABI : esp must be 16-byte aligned when -+ "xor %ebp, %ebp\n" // zero the stack frame -+ "and $-16, %esp\n" // x86 ABI : esp must be 16-byte aligned before -+ "sub $4, %esp\n" // the call instruction (args are aligned) - "push %ecx\n" // push all registers on the stack so that we - "push %ebx\n" // support both regparm and plain stack modes - "push %eax\n" - "call main\n" // main() returns the status code in %eax -- "movzbl %al, %ebx\n" // retrieve exit code from lower 8 bits -- "movl $1, %eax\n" // NR_exit == 1 -- "int $0x80\n" // exit now -+ "mov %eax, %ebx\n" // retrieve exit code (32-bit int) -+ "movl $1, %eax\n" // NR_exit == 1 -+ "int $0x80\n" // exit now - "hlt\n" // ensure it does not - ""); - -@@ -797,7 +811,6 @@ asm(".section .text\n" - "and %r3, %r1, $-8\n" // AAPCS : sp must be 8-byte aligned in the - "mov %sp, %r3\n" // callee, an bl doesn't push (lr=pc) - "bl main\n" // main() returns the status code, we'll exit with it. -- "and %r0, %r0, $0xff\n" // limit exit code to 8 bits - "movs r7, $1\n" // NR_exit == 1 - "svc $0x00\n" - ""); -@@ -994,7 +1007,6 @@ asm(".section .text\n" - "add x2, x2, x1\n" // + argv - "and sp, x1, -16\n" // sp must be 16-byte aligned in the callee - "bl main\n" // main() returns the status code, we'll exit with it. -- "and x0, x0, 0xff\n" // limit exit code to 8 bits - "mov x8, 93\n" // NR_exit == 93 - "svc #0\n" - ""); -@@ -1199,7 +1211,7 @@ asm(".section .text\n" - "addiu $sp,$sp,-16\n" // the callee expects to save a0..a3 there! - "jal main\n" // main() returns the status code, we'll exit with it. - "nop\n" // delayed slot -- "and $a0, $v0, 0xff\n" // limit exit code to 8 bits -+ "move $a0, $v0\n" // retrieve 32-bit exit code from v0 - "li $v0, 4001\n" // NR_exit == 4001 - "syscall\n" - ".end __start\n" -@@ -1397,7 +1409,6 @@ asm(".section .text\n" - "add a2,a2,a1\n" // + argv - "andi sp,a1,-16\n" // sp must be 16-byte aligned - "call main\n" // main() returns the status code, we'll exit with it. -- "andi a0, a0, 0xff\n" // limit exit code to 8 bits - "li a7, 93\n" // NR_exit == 93 - "ecall\n" - ""); -diff --git a/tools/perf/util/debug.c b/tools/perf/util/debug.c -index e55114f0336f0..682146d043793 100644 ---- a/tools/perf/util/debug.c -+++ b/tools/perf/util/debug.c -@@ -143,7 +143,7 @@ static int trace_event_printer(enum binary_printer_ops op, - break; - case BINARY_PRINT_CHAR_DATA: - printed += color_fprintf(fp, color, "%c", -- isprint(ch) ? ch : '.'); -+ isprint(ch) && isascii(ch) ? ch : '.'); - break; - case BINARY_PRINT_CHAR_PAD: - printed += color_fprintf(fp, color, " "); diff --git a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.174-175.patch b/patch/kernel/archive/odroidxu4-5.4/patch-5.4.174-175.patch deleted file mode 100644 index acd7452d0..000000000 --- a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.174-175.patch +++ /dev/null @@ -1,891 +0,0 @@ -diff --git a/Makefile b/Makefile -index 3075f06f77131..2f6c51097d003 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 5 - PATCHLEVEL = 4 --SUBLEVEL = 174 -+SUBLEVEL = 175 - EXTRAVERSION = - NAME = Kleptomaniac Octopus - -diff --git a/arch/arm/boot/dts/bcm283x.dtsi b/arch/arm/boot/dts/bcm283x.dtsi -index 50c64146d4926..af81f386793ca 100644 ---- a/arch/arm/boot/dts/bcm283x.dtsi -+++ b/arch/arm/boot/dts/bcm283x.dtsi -@@ -183,6 +183,7 @@ - - interrupt-controller; - #interrupt-cells = <2>; -+ gpio-ranges = <&gpio 0 0 54>; - - /* Defines pin muxing groups according to - * BCM2835-ARM-Peripherals.pdf page 102. -diff --git a/drivers/gpu/drm/i915/gem/i915_gem_object_types.h b/drivers/gpu/drm/i915/gem/i915_gem_object_types.h -index 08b35587bc6dc..352c102f3459c 100644 ---- a/drivers/gpu/drm/i915/gem/i915_gem_object_types.h -+++ b/drivers/gpu/drm/i915/gem/i915_gem_object_types.h -@@ -118,6 +118,9 @@ struct drm_i915_gem_object { - - I915_SELFTEST_DECLARE(struct list_head st_link); - -+ unsigned long flags; -+#define I915_BO_WAS_BOUND_BIT 0 -+ - /* - * Is the object to be mapped as read-only to the GPU - * Only honoured if hardware has relevant pte bit -diff --git a/drivers/gpu/drm/i915/gem/i915_gem_pages.c b/drivers/gpu/drm/i915/gem/i915_gem_pages.c -index 18f0ce0135c17..aa63fa0ab575e 100644 ---- a/drivers/gpu/drm/i915/gem/i915_gem_pages.c -+++ b/drivers/gpu/drm/i915/gem/i915_gem_pages.c -@@ -8,6 +8,8 @@ - #include "i915_gem_object.h" - #include "i915_scatterlist.h" - -+#include "gt/intel_gt.h" -+ - void __i915_gem_object_set_pages(struct drm_i915_gem_object *obj, - struct sg_table *pages, - unsigned int sg_page_sizes) -@@ -176,6 +178,14 @@ __i915_gem_object_unset_pages(struct drm_i915_gem_object *obj) - __i915_gem_object_reset_page_iter(obj); - obj->mm.page_sizes.phys = obj->mm.page_sizes.sg = 0; - -+ if (test_and_clear_bit(I915_BO_WAS_BOUND_BIT, &obj->flags)) { -+ struct drm_i915_private *i915 = to_i915(obj->base.dev); -+ intel_wakeref_t wakeref; -+ -+ with_intel_runtime_pm_if_in_use(&i915->runtime_pm, wakeref) -+ intel_gt_invalidate_tlbs(&i915->gt); -+ } -+ - return pages; - } - -diff --git a/drivers/gpu/drm/i915/gt/intel_gt.c b/drivers/gpu/drm/i915/gt/intel_gt.c -index d48ec9a76ed16..c8c070375d298 100644 ---- a/drivers/gpu/drm/i915/gt/intel_gt.c -+++ b/drivers/gpu/drm/i915/gt/intel_gt.c -@@ -15,6 +15,8 @@ void intel_gt_init_early(struct intel_gt *gt, struct drm_i915_private *i915) - - spin_lock_init(>->irq_lock); - -+ mutex_init(>->tlb_invalidate_lock); -+ - INIT_LIST_HEAD(>->closed_vma); - spin_lock_init(>->closed_lock); - -@@ -266,3 +268,100 @@ void intel_gt_driver_late_release(struct intel_gt *gt) - intel_uc_driver_late_release(>->uc); - intel_gt_fini_reset(gt); - } -+ -+struct reg_and_bit { -+ i915_reg_t reg; -+ u32 bit; -+}; -+ -+static struct reg_and_bit -+get_reg_and_bit(const struct intel_engine_cs *engine, const bool gen8, -+ const i915_reg_t *regs, const unsigned int num) -+{ -+ const unsigned int class = engine->class; -+ struct reg_and_bit rb = { }; -+ -+ if (WARN_ON_ONCE(class >= num || !regs[class].reg)) -+ return rb; -+ -+ rb.reg = regs[class]; -+ if (gen8 && class == VIDEO_DECODE_CLASS) -+ rb.reg.reg += 4 * engine->instance; /* GEN8_M2TCR */ -+ else -+ rb.bit = engine->instance; -+ -+ rb.bit = BIT(rb.bit); -+ -+ return rb; -+} -+ -+void intel_gt_invalidate_tlbs(struct intel_gt *gt) -+{ -+ static const i915_reg_t gen8_regs[] = { -+ [RENDER_CLASS] = GEN8_RTCR, -+ [VIDEO_DECODE_CLASS] = GEN8_M1TCR, /* , GEN8_M2TCR */ -+ [VIDEO_ENHANCEMENT_CLASS] = GEN8_VTCR, -+ [COPY_ENGINE_CLASS] = GEN8_BTCR, -+ }; -+ static const i915_reg_t gen12_regs[] = { -+ [RENDER_CLASS] = GEN12_GFX_TLB_INV_CR, -+ [VIDEO_DECODE_CLASS] = GEN12_VD_TLB_INV_CR, -+ [VIDEO_ENHANCEMENT_CLASS] = GEN12_VE_TLB_INV_CR, -+ [COPY_ENGINE_CLASS] = GEN12_BLT_TLB_INV_CR, -+ }; -+ struct drm_i915_private *i915 = gt->i915; -+ struct intel_uncore *uncore = gt->uncore; -+ struct intel_engine_cs *engine; -+ enum intel_engine_id id; -+ const i915_reg_t *regs; -+ unsigned int num = 0; -+ -+ if (I915_SELFTEST_ONLY(gt->awake == -ENODEV)) -+ return; -+ -+ if (INTEL_GEN(i915) == 12) { -+ regs = gen12_regs; -+ num = ARRAY_SIZE(gen12_regs); -+ } else if (INTEL_GEN(i915) >= 8 && INTEL_GEN(i915) <= 11) { -+ regs = gen8_regs; -+ num = ARRAY_SIZE(gen8_regs); -+ } else if (INTEL_GEN(i915) < 8) { -+ return; -+ } -+ -+ if (WARN_ONCE(!num, "Platform does not implement TLB invalidation!")) -+ return; -+ -+ GEM_TRACE("\n"); -+ -+ assert_rpm_wakelock_held(&i915->runtime_pm); -+ -+ mutex_lock(>->tlb_invalidate_lock); -+ intel_uncore_forcewake_get(uncore, FORCEWAKE_ALL); -+ -+ for_each_engine(engine, gt, id) { -+ /* -+ * HW architecture suggest typical invalidation time at 40us, -+ * with pessimistic cases up to 100us and a recommendation to -+ * cap at 1ms. We go a bit higher just in case. -+ */ -+ const unsigned int timeout_us = 100; -+ const unsigned int timeout_ms = 4; -+ struct reg_and_bit rb; -+ -+ rb = get_reg_and_bit(engine, regs == gen8_regs, regs, num); -+ if (!i915_mmio_reg_offset(rb.reg)) -+ continue; -+ -+ intel_uncore_write_fw(uncore, rb.reg, rb.bit); -+ if (__intel_wait_for_register_fw(uncore, -+ rb.reg, rb.bit, 0, -+ timeout_us, timeout_ms, -+ NULL)) -+ DRM_ERROR_RATELIMITED("%s TLB invalidation did not complete in %ums!\n", -+ engine->name, timeout_ms); -+ } -+ -+ intel_uncore_forcewake_put(uncore, FORCEWAKE_ALL); -+ mutex_unlock(>->tlb_invalidate_lock); -+} -diff --git a/drivers/gpu/drm/i915/gt/intel_gt.h b/drivers/gpu/drm/i915/gt/intel_gt.h -index 4920cb351f109..4eab15bdcd97b 100644 ---- a/drivers/gpu/drm/i915/gt/intel_gt.h -+++ b/drivers/gpu/drm/i915/gt/intel_gt.h -@@ -57,4 +57,6 @@ static inline bool intel_gt_is_wedged(struct intel_gt *gt) - - void intel_gt_queue_hangcheck(struct intel_gt *gt); - -+void intel_gt_invalidate_tlbs(struct intel_gt *gt); -+ - #endif /* __INTEL_GT_H__ */ -diff --git a/drivers/gpu/drm/i915/gt/intel_gt_types.h b/drivers/gpu/drm/i915/gt/intel_gt_types.h -index dc295c196d11c..82a78719b32d5 100644 ---- a/drivers/gpu/drm/i915/gt/intel_gt_types.h -+++ b/drivers/gpu/drm/i915/gt/intel_gt_types.h -@@ -40,6 +40,8 @@ struct intel_gt { - - struct intel_uc uc; - -+ struct mutex tlb_invalidate_lock; -+ - struct intel_gt_timelines { - spinlock_t lock; /* protects active_list */ - struct list_head active_list; -diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h -index 7b6e68f082f8c..1386d0f5eac63 100644 ---- a/drivers/gpu/drm/i915/i915_reg.h -+++ b/drivers/gpu/drm/i915/i915_reg.h -@@ -2519,6 +2519,12 @@ static inline bool i915_mmio_reg_valid(i915_reg_t reg) - #define GAMT_CHKN_DISABLE_DYNAMIC_CREDIT_SHARING (1 << 28) - #define GAMT_CHKN_DISABLE_I2M_CYCLE_ON_WR_PORT (1 << 24) - -+#define GEN8_RTCR _MMIO(0x4260) -+#define GEN8_M1TCR _MMIO(0x4264) -+#define GEN8_M2TCR _MMIO(0x4268) -+#define GEN8_BTCR _MMIO(0x426c) -+#define GEN8_VTCR _MMIO(0x4270) -+ - #if 0 - #define PRB0_TAIL _MMIO(0x2030) - #define PRB0_HEAD _MMIO(0x2034) -@@ -2602,6 +2608,11 @@ static inline bool i915_mmio_reg_valid(i915_reg_t reg) - #define FAULT_VA_HIGH_BITS (0xf << 0) - #define FAULT_GTT_SEL (1 << 4) - -+#define GEN12_GFX_TLB_INV_CR _MMIO(0xced8) -+#define GEN12_VD_TLB_INV_CR _MMIO(0xcedc) -+#define GEN12_VE_TLB_INV_CR _MMIO(0xcee0) -+#define GEN12_BLT_TLB_INV_CR _MMIO(0xcee4) -+ - #define FPGA_DBG _MMIO(0x42300) - #define FPGA_DBG_RM_NOCLAIM (1 << 31) - -diff --git a/drivers/gpu/drm/i915/i915_vma.c b/drivers/gpu/drm/i915/i915_vma.c -index e0e677b2a3a94..c24f49ee10d73 100644 ---- a/drivers/gpu/drm/i915/i915_vma.c -+++ b/drivers/gpu/drm/i915/i915_vma.c -@@ -341,6 +341,10 @@ int i915_vma_bind(struct i915_vma *vma, enum i915_cache_level cache_level, - return ret; - - vma->flags |= bind_flags; -+ -+ if (vma->obj) -+ set_bit(I915_BO_WAS_BOUND_BIT, &vma->obj->flags); -+ - return 0; - } - -diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h -index 5eb73ded8e07a..765f7a62870db 100644 ---- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h -+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h -@@ -1002,15 +1002,14 @@ extern int vmw_execbuf_fence_commands(struct drm_file *file_priv, - struct vmw_private *dev_priv, - struct vmw_fence_obj **p_fence, - uint32_t *p_handle); --extern void vmw_execbuf_copy_fence_user(struct vmw_private *dev_priv, -+extern int vmw_execbuf_copy_fence_user(struct vmw_private *dev_priv, - struct vmw_fpriv *vmw_fp, - int ret, - struct drm_vmw_fence_rep __user - *user_fence_rep, - struct vmw_fence_obj *fence, - uint32_t fence_handle, -- int32_t out_fence_fd, -- struct sync_file *sync_file); -+ int32_t out_fence_fd); - bool vmw_cmd_describe(const void *buf, u32 *size, char const **cmd); - - /** -diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c -index ff86d49dc5e8a..e3d20048075bf 100644 ---- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c -+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c -@@ -3413,17 +3413,17 @@ int vmw_execbuf_fence_commands(struct drm_file *file_priv, - * Also if copying fails, user-space will be unable to signal the fence object - * so we wait for it immediately, and then unreference the user-space reference. - */ --void -+int - vmw_execbuf_copy_fence_user(struct vmw_private *dev_priv, - struct vmw_fpriv *vmw_fp, int ret, - struct drm_vmw_fence_rep __user *user_fence_rep, - struct vmw_fence_obj *fence, uint32_t fence_handle, -- int32_t out_fence_fd, struct sync_file *sync_file) -+ int32_t out_fence_fd) - { - struct drm_vmw_fence_rep fence_rep; - - if (user_fence_rep == NULL) -- return; -+ return 0; - - memset(&fence_rep, 0, sizeof(fence_rep)); - -@@ -3451,20 +3451,14 @@ vmw_execbuf_copy_fence_user(struct vmw_private *dev_priv, - * handle. - */ - if (unlikely(ret != 0) && (fence_rep.error == 0)) { -- if (sync_file) -- fput(sync_file->file); -- -- if (fence_rep.fd != -1) { -- put_unused_fd(fence_rep.fd); -- fence_rep.fd = -1; -- } -- - ttm_ref_object_base_unref(vmw_fp->tfile, fence_handle, - TTM_REF_USAGE); - VMW_DEBUG_USER("Fence copy error. Syncing.\n"); - (void) vmw_fence_obj_wait(fence, false, false, - VMW_FENCE_WAIT_TIMEOUT); - } -+ -+ return ret ? -EFAULT : 0; - } - - /** -@@ -3806,16 +3800,23 @@ int vmw_execbuf_process(struct drm_file *file_priv, - - (void) vmw_fence_obj_wait(fence, false, false, - VMW_FENCE_WAIT_TIMEOUT); -+ } -+ } -+ -+ ret = vmw_execbuf_copy_fence_user(dev_priv, vmw_fpriv(file_priv), ret, -+ user_fence_rep, fence, handle, out_fence_fd); -+ -+ if (sync_file) { -+ if (ret) { -+ /* usercopy of fence failed, put the file object */ -+ fput(sync_file->file); -+ put_unused_fd(out_fence_fd); - } else { - /* Link the fence with the FD created earlier */ - fd_install(out_fence_fd, sync_file->file); - } - } - -- vmw_execbuf_copy_fence_user(dev_priv, vmw_fpriv(file_priv), ret, -- user_fence_rep, fence, handle, out_fence_fd, -- sync_file); -- - /* Don't unreference when handing fence out */ - if (unlikely(out_fence != NULL)) { - *out_fence = fence; -@@ -3833,7 +3834,7 @@ int vmw_execbuf_process(struct drm_file *file_priv, - */ - vmw_validation_unref_lists(&val_ctx); - -- return 0; -+ return ret; - - out_unlock_binding: - mutex_unlock(&dev_priv->binding_mutex); -diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c -index 178a6cd1a06fe..874093a0b04f0 100644 ---- a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c -+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c -@@ -1171,7 +1171,7 @@ int vmw_fence_event_ioctl(struct drm_device *dev, void *data, - } - - vmw_execbuf_copy_fence_user(dev_priv, vmw_fp, 0, user_fence_rep, fence, -- handle, -1, NULL); -+ handle, -1); - vmw_fence_obj_unreference(&fence); - return 0; - out_no_create: -diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c -index 33b1519887474..0b800c3540492 100644 ---- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c -+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c -@@ -2570,7 +2570,7 @@ void vmw_kms_helper_validation_finish(struct vmw_private *dev_priv, - if (file_priv) - vmw_execbuf_copy_fence_user(dev_priv, vmw_fpriv(file_priv), - ret, user_fence_rep, fence, -- handle, -1, NULL); -+ handle, -1); - if (out_fence) - *out_fence = fence; - else -diff --git a/drivers/mmc/host/sdhci-esdhc-imx.c b/drivers/mmc/host/sdhci-esdhc-imx.c -index 2c01e2ebef7aa..d97c19ef75830 100644 ---- a/drivers/mmc/host/sdhci-esdhc-imx.c -+++ b/drivers/mmc/host/sdhci-esdhc-imx.c -@@ -218,8 +218,7 @@ static struct esdhc_soc_data usdhc_imx7ulp_data = { - static struct esdhc_soc_data usdhc_imx8qxp_data = { - .flags = ESDHC_FLAG_USDHC | ESDHC_FLAG_STD_TUNING - | ESDHC_FLAG_HAVE_CAP1 | ESDHC_FLAG_HS200 -- | ESDHC_FLAG_HS400 | ESDHC_FLAG_HS400_ES -- | ESDHC_FLAG_CQHCI, -+ | ESDHC_FLAG_HS400 | ESDHC_FLAG_HS400_ES, - }; - - struct pltfm_imx_data { -diff --git a/drivers/pinctrl/bcm/pinctrl-bcm2835.c b/drivers/pinctrl/bcm/pinctrl-bcm2835.c -index 0de1a3a96984c..fa742535f6791 100644 ---- a/drivers/pinctrl/bcm/pinctrl-bcm2835.c -+++ b/drivers/pinctrl/bcm/pinctrl-bcm2835.c -@@ -19,6 +19,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -37,12 +38,10 @@ - - #define MODULE_NAME "pinctrl-bcm2835" - #define BCM2835_NUM_GPIOS 54 -+#define BCM2711_NUM_GPIOS 58 - #define BCM2835_NUM_BANKS 2 - #define BCM2835_NUM_IRQS 3 - --#define BCM2835_PIN_BITMAP_SZ \ -- DIV_ROUND_UP(BCM2835_NUM_GPIOS, sizeof(unsigned long) * 8) -- - /* GPIO register offsets */ - #define GPFSEL0 0x0 /* Function Select */ - #define GPSET0 0x1c /* Pin Output Set */ -@@ -78,13 +77,15 @@ - struct bcm2835_pinctrl { - struct device *dev; - void __iomem *base; -+ int *wake_irq; - - /* note: locking assumes each bank will have its own unsigned long */ - unsigned long enabled_irq_map[BCM2835_NUM_BANKS]; -- unsigned int irq_type[BCM2835_NUM_GPIOS]; -+ unsigned int irq_type[BCM2711_NUM_GPIOS]; - - struct pinctrl_dev *pctl_dev; - struct gpio_chip gpio_chip; -+ struct pinctrl_desc pctl_desc; - struct pinctrl_gpio_range gpio_range; - - raw_spinlock_t irq_lock[BCM2835_NUM_BANKS]; -@@ -147,6 +148,10 @@ static struct pinctrl_pin_desc bcm2835_gpio_pins[] = { - BCM2835_GPIO_PIN(51), - BCM2835_GPIO_PIN(52), - BCM2835_GPIO_PIN(53), -+ BCM2835_GPIO_PIN(54), -+ BCM2835_GPIO_PIN(55), -+ BCM2835_GPIO_PIN(56), -+ BCM2835_GPIO_PIN(57), - }; - - /* one pin per group */ -@@ -205,6 +210,10 @@ static const char * const bcm2835_gpio_groups[] = { - "gpio51", - "gpio52", - "gpio53", -+ "gpio54", -+ "gpio55", -+ "gpio56", -+ "gpio57", - }; - - enum bcm2835_fsel { -@@ -355,6 +364,22 @@ static const struct gpio_chip bcm2835_gpio_chip = { - .can_sleep = false, - }; - -+static const struct gpio_chip bcm2711_gpio_chip = { -+ .label = "pinctrl-bcm2711", -+ .owner = THIS_MODULE, -+ .request = gpiochip_generic_request, -+ .free = gpiochip_generic_free, -+ .direction_input = bcm2835_gpio_direction_input, -+ .direction_output = bcm2835_gpio_direction_output, -+ .get_direction = bcm2835_gpio_get_direction, -+ .get = bcm2835_gpio_get, -+ .set = bcm2835_gpio_set, -+ .set_config = gpiochip_generic_config, -+ .base = -1, -+ .ngpio = BCM2711_NUM_GPIOS, -+ .can_sleep = false, -+}; -+ - static void bcm2835_gpio_irq_handle_bank(struct bcm2835_pinctrl *pc, - unsigned int bank, u32 mask) - { -@@ -401,7 +426,7 @@ static void bcm2835_gpio_irq_handler(struct irq_desc *desc) - bcm2835_gpio_irq_handle_bank(pc, 0, 0xf0000000); - bcm2835_gpio_irq_handle_bank(pc, 1, 0x00003fff); - break; -- case 2: /* IRQ2 covers GPIOs 46-53 */ -+ case 2: /* IRQ2 covers GPIOs 46-57 */ - bcm2835_gpio_irq_handle_bank(pc, 1, 0x003fc000); - break; - } -@@ -409,6 +434,11 @@ static void bcm2835_gpio_irq_handler(struct irq_desc *desc) - chained_irq_exit(host_chip, desc); - } - -+static irqreturn_t bcm2835_gpio_wake_irq_handler(int irq, void *dev_id) -+{ -+ return IRQ_HANDLED; -+} -+ - static inline void __bcm2835_gpio_irq_config(struct bcm2835_pinctrl *pc, - unsigned reg, unsigned offset, bool enable) - { -@@ -608,6 +638,34 @@ static void bcm2835_gpio_irq_ack(struct irq_data *data) - bcm2835_gpio_set_bit(pc, GPEDS0, gpio); - } - -+static int bcm2835_gpio_irq_set_wake(struct irq_data *data, unsigned int on) -+{ -+ struct gpio_chip *chip = irq_data_get_irq_chip_data(data); -+ struct bcm2835_pinctrl *pc = gpiochip_get_data(chip); -+ unsigned gpio = irqd_to_hwirq(data); -+ unsigned int irqgroup; -+ int ret = -EINVAL; -+ -+ if (!pc->wake_irq) -+ return ret; -+ -+ if (gpio <= 27) -+ irqgroup = 0; -+ else if (gpio >= 28 && gpio <= 45) -+ irqgroup = 1; -+ else if (gpio >= 46 && gpio <= 57) -+ irqgroup = 2; -+ else -+ return ret; -+ -+ if (on) -+ ret = enable_irq_wake(pc->wake_irq[irqgroup]); -+ else -+ ret = disable_irq_wake(pc->wake_irq[irqgroup]); -+ -+ return ret; -+} -+ - static struct irq_chip bcm2835_gpio_irq_chip = { - .name = MODULE_NAME, - .irq_enable = bcm2835_gpio_irq_enable, -@@ -616,11 +674,13 @@ static struct irq_chip bcm2835_gpio_irq_chip = { - .irq_ack = bcm2835_gpio_irq_ack, - .irq_mask = bcm2835_gpio_irq_disable, - .irq_unmask = bcm2835_gpio_irq_enable, -+ .irq_set_wake = bcm2835_gpio_irq_set_wake, -+ .flags = IRQCHIP_MASK_ON_SUSPEND, - }; - - static int bcm2835_pctl_get_groups_count(struct pinctrl_dev *pctldev) - { -- return ARRAY_SIZE(bcm2835_gpio_groups); -+ return BCM2835_NUM_GPIOS; - } - - static const char *bcm2835_pctl_get_group_name(struct pinctrl_dev *pctldev, -@@ -778,7 +838,7 @@ static int bcm2835_pctl_dt_node_to_map(struct pinctrl_dev *pctldev, - err = of_property_read_u32_index(np, "brcm,pins", i, &pin); - if (err) - goto out; -- if (pin >= ARRAY_SIZE(bcm2835_gpio_pins)) { -+ if (pin >= pc->pctl_desc.npins) { - dev_err(pc->dev, "%pOF: invalid brcm,pins value %d\n", - np, pin); - err = -EINVAL; -@@ -854,7 +914,7 @@ static int bcm2835_pmx_get_function_groups(struct pinctrl_dev *pctldev, - { - /* every pin can do every function */ - *groups = bcm2835_gpio_groups; -- *num_groups = ARRAY_SIZE(bcm2835_gpio_groups); -+ *num_groups = BCM2835_NUM_GPIOS; - - return 0; - } -@@ -1054,29 +1114,66 @@ static const struct pinconf_ops bcm2711_pinconf_ops = { - .pin_config_set = bcm2711_pinconf_set, - }; - --static struct pinctrl_desc bcm2835_pinctrl_desc = { -+static const struct pinctrl_desc bcm2835_pinctrl_desc = { - .name = MODULE_NAME, - .pins = bcm2835_gpio_pins, -- .npins = ARRAY_SIZE(bcm2835_gpio_pins), -+ .npins = BCM2835_NUM_GPIOS, - .pctlops = &bcm2835_pctl_ops, - .pmxops = &bcm2835_pmx_ops, - .confops = &bcm2835_pinconf_ops, - .owner = THIS_MODULE, - }; - --static struct pinctrl_gpio_range bcm2835_pinctrl_gpio_range = { -+static const struct pinctrl_desc bcm2711_pinctrl_desc = { -+ .name = "pinctrl-bcm2711", -+ .pins = bcm2835_gpio_pins, -+ .npins = BCM2711_NUM_GPIOS, -+ .pctlops = &bcm2835_pctl_ops, -+ .pmxops = &bcm2835_pmx_ops, -+ .confops = &bcm2711_pinconf_ops, -+ .owner = THIS_MODULE, -+}; -+ -+static const struct pinctrl_gpio_range bcm2835_pinctrl_gpio_range = { - .name = MODULE_NAME, - .npins = BCM2835_NUM_GPIOS, - }; - -+static const struct pinctrl_gpio_range bcm2711_pinctrl_gpio_range = { -+ .name = "pinctrl-bcm2711", -+ .npins = BCM2711_NUM_GPIOS, -+}; -+ -+struct bcm_plat_data { -+ const struct gpio_chip *gpio_chip; -+ const struct pinctrl_desc *pctl_desc; -+ const struct pinctrl_gpio_range *gpio_range; -+}; -+ -+static const struct bcm_plat_data bcm2835_plat_data = { -+ .gpio_chip = &bcm2835_gpio_chip, -+ .pctl_desc = &bcm2835_pinctrl_desc, -+ .gpio_range = &bcm2835_pinctrl_gpio_range, -+}; -+ -+static const struct bcm_plat_data bcm2711_plat_data = { -+ .gpio_chip = &bcm2711_gpio_chip, -+ .pctl_desc = &bcm2711_pinctrl_desc, -+ .gpio_range = &bcm2711_pinctrl_gpio_range, -+}; -+ - static const struct of_device_id bcm2835_pinctrl_match[] = { - { - .compatible = "brcm,bcm2835-gpio", -- .data = &bcm2835_pinconf_ops, -+ .data = &bcm2835_plat_data, - }, - { - .compatible = "brcm,bcm2711-gpio", -- .data = &bcm2711_pinconf_ops, -+ .data = &bcm2711_plat_data, -+ }, -+ { -+ .compatible = "brcm,bcm7211-gpio", -+ .data = &bcm2711_plat_data, - }, - {} - }; -@@ -1085,14 +1182,16 @@ static int bcm2835_pinctrl_probe(struct platform_device *pdev) - { - struct device *dev = &pdev->dev; - struct device_node *np = dev->of_node; -+ const struct bcm_plat_data *pdata; - struct bcm2835_pinctrl *pc; - struct gpio_irq_chip *girq; - struct resource iomem; - int err, i; - const struct of_device_id *match; -+ int is_7211 = 0; - -- BUILD_BUG_ON(ARRAY_SIZE(bcm2835_gpio_pins) != BCM2835_NUM_GPIOS); -- BUILD_BUG_ON(ARRAY_SIZE(bcm2835_gpio_groups) != BCM2835_NUM_GPIOS); -+ BUILD_BUG_ON(ARRAY_SIZE(bcm2835_gpio_pins) != BCM2711_NUM_GPIOS); -+ BUILD_BUG_ON(ARRAY_SIZE(bcm2835_gpio_groups) != BCM2711_NUM_GPIOS); - - pc = devm_kzalloc(dev, sizeof(*pc), GFP_KERNEL); - if (!pc) -@@ -1111,7 +1210,14 @@ static int bcm2835_pinctrl_probe(struct platform_device *pdev) - if (IS_ERR(pc->base)) - return PTR_ERR(pc->base); - -- pc->gpio_chip = bcm2835_gpio_chip; -+ match = of_match_node(bcm2835_pinctrl_match, pdev->dev.of_node); -+ if (!match) -+ return -EINVAL; -+ -+ pdata = match->data; -+ is_7211 = of_device_is_compatible(np, "brcm,bcm7211-gpio"); -+ -+ pc->gpio_chip = *pdata->gpio_chip; - pc->gpio_chip.parent = dev; - pc->gpio_chip.of_node = np; - -@@ -1135,6 +1241,18 @@ static int bcm2835_pinctrl_probe(struct platform_device *pdev) - raw_spin_lock_init(&pc->irq_lock[i]); - } - -+ pc->pctl_desc = *pdata->pctl_desc; -+ pc->pctl_dev = devm_pinctrl_register(dev, &pc->pctl_desc, pc); -+ if (IS_ERR(pc->pctl_dev)) { -+ gpiochip_remove(&pc->gpio_chip); -+ return PTR_ERR(pc->pctl_dev); -+ } -+ -+ pc->gpio_range = *pdata->gpio_range; -+ pc->gpio_range.base = pc->gpio_chip.base; -+ pc->gpio_range.gc = &pc->gpio_chip; -+ pinctrl_add_gpio_range(pc->pctl_dev, &pc->gpio_range); -+ - girq = &pc->gpio_chip.irq; - girq->chip = &bcm2835_gpio_irq_chip; - girq->parent_handler = bcm2835_gpio_irq_handler; -@@ -1142,8 +1260,19 @@ static int bcm2835_pinctrl_probe(struct platform_device *pdev) - girq->parents = devm_kcalloc(dev, BCM2835_NUM_IRQS, - sizeof(*girq->parents), - GFP_KERNEL); -- if (!girq->parents) -+ if (!girq->parents) { -+ pinctrl_remove_gpio_range(pc->pctl_dev, &pc->gpio_range); - return -ENOMEM; -+ } -+ -+ if (is_7211) { -+ pc->wake_irq = devm_kcalloc(dev, BCM2835_NUM_IRQS, -+ sizeof(*pc->wake_irq), -+ GFP_KERNEL); -+ if (!pc->wake_irq) -+ return -ENOMEM; -+ } -+ - /* - * Use the same handler for all groups: this is necessary - * since we use one gpiochip to cover all lines - the -@@ -1151,34 +1280,44 @@ static int bcm2835_pinctrl_probe(struct platform_device *pdev) - * bank that was firing the IRQ and look up the per-group - * and bank data. - */ -- for (i = 0; i < BCM2835_NUM_IRQS; i++) -+ for (i = 0; i < BCM2835_NUM_IRQS; i++) { -+ int len; -+ char *name; -+ - girq->parents[i] = irq_of_parse_and_map(np, i); -+ if (!is_7211) -+ continue; -+ -+ /* Skip over the all banks interrupts */ -+ pc->wake_irq[i] = irq_of_parse_and_map(np, i + -+ BCM2835_NUM_IRQS + 1); -+ -+ len = strlen(dev_name(pc->dev)) + 16; -+ name = devm_kzalloc(pc->dev, len, GFP_KERNEL); -+ if (!name) -+ return -ENOMEM; -+ -+ snprintf(name, len, "%s:bank%d", dev_name(pc->dev), i); -+ -+ /* These are optional interrupts */ -+ err = devm_request_irq(dev, pc->wake_irq[i], -+ bcm2835_gpio_wake_irq_handler, -+ IRQF_SHARED, name, pc); -+ if (err) -+ dev_warn(dev, "unable to request wake IRQ %d\n", -+ pc->wake_irq[i]); -+ } -+ - girq->default_type = IRQ_TYPE_NONE; - girq->handler = handle_level_irq; - - err = gpiochip_add_data(&pc->gpio_chip, pc); - if (err) { - dev_err(dev, "could not add GPIO chip\n"); -+ pinctrl_remove_gpio_range(pc->pctl_dev, &pc->gpio_range); - return err; - } - -- match = of_match_node(bcm2835_pinctrl_match, pdev->dev.of_node); -- if (match) { -- bcm2835_pinctrl_desc.confops = -- (const struct pinconf_ops *)match->data; -- } -- -- pc->pctl_dev = devm_pinctrl_register(dev, &bcm2835_pinctrl_desc, pc); -- if (IS_ERR(pc->pctl_dev)) { -- gpiochip_remove(&pc->gpio_chip); -- return PTR_ERR(pc->pctl_dev); -- } -- -- pc->gpio_range = bcm2835_pinctrl_gpio_range; -- pc->gpio_range.base = pc->gpio_chip.base; -- pc->gpio_range.gc = &pc->gpio_chip; -- pinctrl_add_gpio_range(pc->pctl_dev, &pc->gpio_range); -- - return 0; - } - -diff --git a/fs/select.c b/fs/select.c -index e51796063cb6e..7716d9d5be1e8 100644 ---- a/fs/select.c -+++ b/fs/select.c -@@ -458,9 +458,11 @@ get_max: - return max; - } - --#define POLLIN_SET (EPOLLRDNORM | EPOLLRDBAND | EPOLLIN | EPOLLHUP | EPOLLERR) --#define POLLOUT_SET (EPOLLWRBAND | EPOLLWRNORM | EPOLLOUT | EPOLLERR) --#define POLLEX_SET (EPOLLPRI) -+#define POLLIN_SET (EPOLLRDNORM | EPOLLRDBAND | EPOLLIN | EPOLLHUP | EPOLLERR |\ -+ EPOLLNVAL) -+#define POLLOUT_SET (EPOLLWRBAND | EPOLLWRNORM | EPOLLOUT | EPOLLERR |\ -+ EPOLLNVAL) -+#define POLLEX_SET (EPOLLPRI | EPOLLNVAL) - - static inline void wait_key_set(poll_table *wait, unsigned long in, - unsigned long out, unsigned long bit, -@@ -527,6 +529,7 @@ static int do_select(int n, fd_set_bits *fds, struct timespec64 *end_time) - break; - if (!(bit & all_bits)) - continue; -+ mask = EPOLLNVAL; - f = fdget(i); - if (f.file) { - wait_key_set(wait, in, out, bit, -@@ -534,34 +537,34 @@ static int do_select(int n, fd_set_bits *fds, struct timespec64 *end_time) - mask = vfs_poll(f.file, wait); - - fdput(f); -- if ((mask & POLLIN_SET) && (in & bit)) { -- res_in |= bit; -- retval++; -- wait->_qproc = NULL; -- } -- if ((mask & POLLOUT_SET) && (out & bit)) { -- res_out |= bit; -- retval++; -- wait->_qproc = NULL; -- } -- if ((mask & POLLEX_SET) && (ex & bit)) { -- res_ex |= bit; -- retval++; -- wait->_qproc = NULL; -- } -- /* got something, stop busy polling */ -- if (retval) { -- can_busy_loop = false; -- busy_flag = 0; -- -- /* -- * only remember a returned -- * POLL_BUSY_LOOP if we asked for it -- */ -- } else if (busy_flag & mask) -- can_busy_loop = true; -- - } -+ if ((mask & POLLIN_SET) && (in & bit)) { -+ res_in |= bit; -+ retval++; -+ wait->_qproc = NULL; -+ } -+ if ((mask & POLLOUT_SET) && (out & bit)) { -+ res_out |= bit; -+ retval++; -+ wait->_qproc = NULL; -+ } -+ if ((mask & POLLEX_SET) && (ex & bit)) { -+ res_ex |= bit; -+ retval++; -+ wait->_qproc = NULL; -+ } -+ /* got something, stop busy polling */ -+ if (retval) { -+ can_busy_loop = false; -+ busy_flag = 0; -+ -+ /* -+ * only remember a returned -+ * POLL_BUSY_LOOP if we asked for it -+ */ -+ } else if (busy_flag & mask) -+ can_busy_loop = true; -+ - } - if (res_in) - *rinp = res_in; -diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c -index 7777c35e0a171..5797cf2909b00 100644 ---- a/kernel/rcu/tree.c -+++ b/kernel/rcu/tree.c -@@ -1358,10 +1358,11 @@ static void __maybe_unused rcu_advance_cbs_nowake(struct rcu_node *rnp, - struct rcu_data *rdp) - { - rcu_lockdep_assert_cblist_protected(rdp); -- if (!rcu_seq_state(rcu_seq_current(&rnp->gp_seq)) || -- !raw_spin_trylock_rcu_node(rnp)) -+ if (!rcu_seq_state(rcu_seq_current(&rnp->gp_seq)) || !raw_spin_trylock_rcu_node(rnp)) - return; -- WARN_ON_ONCE(rcu_advance_cbs(rnp, rdp)); -+ // The grace period cannot end while we hold the rcu_node lock. -+ if (rcu_seq_state(rcu_seq_current(&rnp->gp_seq))) -+ WARN_ON_ONCE(rcu_advance_cbs(rnp, rdp)); - raw_spin_unlock_rcu_node(rnp); - } - diff --git a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.175-176.patch b/patch/kernel/archive/odroidxu4-5.4/patch-5.4.175-176.patch deleted file mode 100644 index 1128710cd..000000000 --- a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.175-176.patch +++ /dev/null @@ -1,2235 +0,0 @@ -diff --git a/Documentation/devicetree/bindings/net/can/tcan4x5x.txt b/Documentation/devicetree/bindings/net/can/tcan4x5x.txt -index 9cb3560756d00..53c26ffd020a3 100644 ---- a/Documentation/devicetree/bindings/net/can/tcan4x5x.txt -+++ b/Documentation/devicetree/bindings/net/can/tcan4x5x.txt -@@ -31,7 +31,7 @@ tcan4x5x: tcan4x5x@0 { - #address-cells = <1>; - #size-cells = <1>; - spi-max-frequency = <10000000>; -- bosch,mram-cfg = <0x0 0 0 32 0 0 1 1>; -+ bosch,mram-cfg = <0x0 0 0 16 0 0 1 1>; - interrupt-parent = <&gpio1>; - interrupts = <14 IRQ_TYPE_LEVEL_LOW>; - device-state-gpios = <&gpio3 21 GPIO_ACTIVE_HIGH>; -diff --git a/Makefile b/Makefile -index 2f6c51097d003..b23aa51ada93e 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 5 - PATCHLEVEL = 4 --SUBLEVEL = 175 -+SUBLEVEL = 176 - EXTRAVERSION = - NAME = Kleptomaniac Octopus - -diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c -index f61ef46ebff74..d07fbc21f14ce 100644 ---- a/arch/arm64/kernel/process.c -+++ b/arch/arm64/kernel/process.c -@@ -500,34 +500,26 @@ static void entry_task_switch(struct task_struct *next) - - /* - * ARM erratum 1418040 handling, affecting the 32bit view of CNTVCT. -- * Assuming the virtual counter is enabled at the beginning of times: -- * -- * - disable access when switching from a 64bit task to a 32bit task -- * - enable access when switching from a 32bit task to a 64bit task -+ * Ensure access is disabled when switching to a 32bit task, ensure -+ * access is enabled when switching to a 64bit task. - */ --static void erratum_1418040_thread_switch(struct task_struct *prev, -- struct task_struct *next) -+static void erratum_1418040_thread_switch(struct task_struct *next) - { -- bool prev32, next32; -- u64 val; -- -- if (!IS_ENABLED(CONFIG_ARM64_ERRATUM_1418040)) -- return; -- -- prev32 = is_compat_thread(task_thread_info(prev)); -- next32 = is_compat_thread(task_thread_info(next)); -- -- if (prev32 == next32 || !this_cpu_has_cap(ARM64_WORKAROUND_1418040)) -+ if (!IS_ENABLED(CONFIG_ARM64_ERRATUM_1418040) || -+ !this_cpu_has_cap(ARM64_WORKAROUND_1418040)) - return; - -- val = read_sysreg(cntkctl_el1); -- -- if (!next32) -- val |= ARCH_TIMER_USR_VCT_ACCESS_EN; -+ if (is_compat_thread(task_thread_info(next))) -+ sysreg_clear_set(cntkctl_el1, ARCH_TIMER_USR_VCT_ACCESS_EN, 0); - else -- val &= ~ARCH_TIMER_USR_VCT_ACCESS_EN; -+ sysreg_clear_set(cntkctl_el1, 0, ARCH_TIMER_USR_VCT_ACCESS_EN); -+} - -- write_sysreg(val, cntkctl_el1); -+static void erratum_1418040_new_exec(void) -+{ -+ preempt_disable(); -+ erratum_1418040_thread_switch(current); -+ preempt_enable(); - } - - /* -@@ -546,7 +538,7 @@ __notrace_funcgraph struct task_struct *__switch_to(struct task_struct *prev, - uao_thread_switch(next); - ptrauth_thread_switch(next); - ssbs_thread_switch(next); -- erratum_1418040_thread_switch(prev, next); -+ erratum_1418040_thread_switch(next); - - /* - * Complete any pending TLB or cache maintenance on this CPU in case -@@ -605,6 +597,7 @@ void arch_setup_new_exec(void) - current->mm->context.flags = is_compat_task() ? MMCF_AARCH32 : 0; - - ptrauth_thread_init_user(current); -+ erratum_1418040_new_exec(); - } - - #ifdef CONFIG_ARM64_TAGGED_ADDR_ABI -diff --git a/arch/powerpc/kernel/Makefile b/arch/powerpc/kernel/Makefile -index afbd47b0a75cc..5819a577d267a 100644 ---- a/arch/powerpc/kernel/Makefile -+++ b/arch/powerpc/kernel/Makefile -@@ -13,6 +13,7 @@ CFLAGS_prom_init.o += -fPIC - CFLAGS_btext.o += -fPIC - endif - -+CFLAGS_early_32.o += $(DISABLE_LATENT_ENTROPY_PLUGIN) - CFLAGS_cputable.o += $(DISABLE_LATENT_ENTROPY_PLUGIN) - CFLAGS_prom_init.o += $(DISABLE_LATENT_ENTROPY_PLUGIN) - CFLAGS_btext.o += $(DISABLE_LATENT_ENTROPY_PLUGIN) -diff --git a/arch/powerpc/lib/Makefile b/arch/powerpc/lib/Makefile -index b8de3be10eb47..8656b8d2ce555 100644 ---- a/arch/powerpc/lib/Makefile -+++ b/arch/powerpc/lib/Makefile -@@ -16,6 +16,9 @@ CFLAGS_code-patching.o += -DDISABLE_BRANCH_PROFILING - CFLAGS_feature-fixups.o += -DDISABLE_BRANCH_PROFILING - endif - -+CFLAGS_code-patching.o += $(DISABLE_LATENT_ENTROPY_PLUGIN) -+CFLAGS_feature-fixups.o += $(DISABLE_LATENT_ENTROPY_PLUGIN) -+ - obj-y += alloc.o code-patching.o feature-fixups.o pmem.o - - ifndef CONFIG_KASAN -diff --git a/arch/s390/hypfs/hypfs_vm.c b/arch/s390/hypfs/hypfs_vm.c -index e1fcc03159ef2..a927adccb4ba7 100644 ---- a/arch/s390/hypfs/hypfs_vm.c -+++ b/arch/s390/hypfs/hypfs_vm.c -@@ -20,6 +20,7 @@ - - static char local_guest[] = " "; - static char all_guests[] = "* "; -+static char *all_groups = all_guests; - static char *guest_query; - - struct diag2fc_data { -@@ -62,10 +63,11 @@ static int diag2fc(int size, char* query, void *addr) - - memcpy(parm_list.userid, query, NAME_LEN); - ASCEBC(parm_list.userid, NAME_LEN); -- parm_list.addr = (unsigned long) addr ; -+ memcpy(parm_list.aci_grp, all_groups, NAME_LEN); -+ ASCEBC(parm_list.aci_grp, NAME_LEN); -+ parm_list.addr = (unsigned long)addr; - parm_list.size = size; - parm_list.fmt = 0x02; -- memset(parm_list.aci_grp, 0x40, NAME_LEN); - rc = -1; - - diag_stat_inc(DIAG_STAT_X2FC); -diff --git a/block/bio.c b/block/bio.c -index cb38d6f3acceb..1c52d0196e15c 100644 ---- a/block/bio.c -+++ b/block/bio.c -@@ -569,7 +569,8 @@ void bio_truncate(struct bio *bio, unsigned new_size) - offset = new_size - done; - else - offset = 0; -- zero_user(bv.bv_page, offset, bv.bv_len - offset); -+ zero_user(bv.bv_page, bv.bv_offset + offset, -+ bv.bv_len - offset); - truncated = true; - } - done += bv.bv_len; -diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c b/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c -index 7d155938e2916..9baf5af919e1e 100644 ---- a/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c -+++ b/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c -@@ -471,8 +471,8 @@ int etnaviv_ioctl_gem_submit(struct drm_device *dev, void *data, - return -EINVAL; - } - -- if (args->stream_size > SZ_64K || args->nr_relocs > SZ_64K || -- args->nr_bos > SZ_64K || args->nr_pmrs > 128) { -+ if (args->stream_size > SZ_128K || args->nr_relocs > SZ_128K || -+ args->nr_bos > SZ_128K || args->nr_pmrs > 128) { - DRM_ERROR("submit arguments out of size limits\n"); - return -EINVAL; - } -diff --git a/drivers/gpu/drm/msm/dsi/dsi.c b/drivers/gpu/drm/msm/dsi/dsi.c -index a11b98e990019..16194971a99f9 100644 ---- a/drivers/gpu/drm/msm/dsi/dsi.c -+++ b/drivers/gpu/drm/msm/dsi/dsi.c -@@ -33,7 +33,12 @@ static int dsi_get_phy(struct msm_dsi *msm_dsi) - - of_node_put(phy_node); - -- if (!phy_pdev || !msm_dsi->phy) { -+ if (!phy_pdev) { -+ DRM_DEV_ERROR(&pdev->dev, "%s: phy driver is not ready\n", __func__); -+ return -EPROBE_DEFER; -+ } -+ if (!msm_dsi->phy) { -+ put_device(&phy_pdev->dev); - DRM_DEV_ERROR(&pdev->dev, "%s: phy driver is not ready\n", __func__); - return -EPROBE_DEFER; - } -diff --git a/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c b/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c -index 21519229fe73a..60d50643d0b5c 100644 ---- a/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c -+++ b/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c -@@ -665,12 +665,14 @@ void __exit msm_dsi_phy_driver_unregister(void) - int msm_dsi_phy_enable(struct msm_dsi_phy *phy, int src_pll_id, - struct msm_dsi_phy_clk_request *clk_req) - { -- struct device *dev = &phy->pdev->dev; -+ struct device *dev; - int ret; - - if (!phy || !phy->cfg->ops.enable) - return -EINVAL; - -+ dev = &phy->pdev->dev; -+ - ret = dsi_phy_enable_resource(phy); - if (ret) { - DRM_DEV_ERROR(dev, "%s: resource enable failed, %d\n", -diff --git a/drivers/gpu/drm/msm/hdmi/hdmi.c b/drivers/gpu/drm/msm/hdmi/hdmi.c -index 355afb936401a..1a7e77373407f 100644 ---- a/drivers/gpu/drm/msm/hdmi/hdmi.c -+++ b/drivers/gpu/drm/msm/hdmi/hdmi.c -@@ -97,10 +97,15 @@ static int msm_hdmi_get_phy(struct hdmi *hdmi) - - of_node_put(phy_node); - -- if (!phy_pdev || !hdmi->phy) { -+ if (!phy_pdev) { - DRM_DEV_ERROR(&pdev->dev, "phy driver is not ready\n"); - return -EPROBE_DEFER; - } -+ if (!hdmi->phy) { -+ DRM_DEV_ERROR(&pdev->dev, "phy driver is not ready\n"); -+ put_device(&phy_pdev->dev); -+ return -EPROBE_DEFER; -+ } - - hdmi->phy_dev = get_device(&phy_pdev->dev); - -diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c -index 7443df77cadb5..407b51cf67909 100644 ---- a/drivers/gpu/drm/msm/msm_drv.c -+++ b/drivers/gpu/drm/msm/msm_drv.c -@@ -337,7 +337,7 @@ static int msm_init_vram(struct drm_device *dev) - of_node_put(node); - if (ret) - return ret; -- size = r.end - r.start; -+ size = r.end - r.start + 1; - DRM_INFO("using VRAM carveout: %lx@%pa\n", size, &r.start); - - /* if we have no IOMMU, then we need to use carveout allocator. -diff --git a/drivers/hwmon/lm90.c b/drivers/hwmon/lm90.c -index 9abb4507f572b..b62763a85d6e4 100644 ---- a/drivers/hwmon/lm90.c -+++ b/drivers/hwmon/lm90.c -@@ -373,7 +373,7 @@ static const struct lm90_params lm90_params[] = { - .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT - | LM90_HAVE_BROKEN_ALERT | LM90_HAVE_CRIT, - .alert_alarms = 0x7c, -- .max_convrate = 8, -+ .max_convrate = 7, - }, - [lm86] = { - .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT -@@ -394,12 +394,13 @@ static const struct lm90_params lm90_params[] = { - .max_convrate = 9, - }, - [max6646] = { -- .flags = LM90_HAVE_CRIT, -+ .flags = LM90_HAVE_CRIT | LM90_HAVE_BROKEN_ALERT, - .alert_alarms = 0x7c, - .max_convrate = 6, - .reg_local_ext = MAX6657_REG_R_LOCAL_TEMPL, - }, - [max6654] = { -+ .flags = LM90_HAVE_BROKEN_ALERT, - .alert_alarms = 0x7c, - .max_convrate = 7, - .reg_local_ext = MAX6657_REG_R_LOCAL_TEMPL, -@@ -418,7 +419,7 @@ static const struct lm90_params lm90_params[] = { - }, - [max6680] = { - .flags = LM90_HAVE_OFFSET | LM90_HAVE_CRIT -- | LM90_HAVE_CRIT_ALRM_SWP, -+ | LM90_HAVE_CRIT_ALRM_SWP | LM90_HAVE_BROKEN_ALERT, - .alert_alarms = 0x7c, - .max_convrate = 7, - }, -diff --git a/drivers/mtd/nand/raw/mpc5121_nfc.c b/drivers/mtd/nand/raw/mpc5121_nfc.c -index 8b90def6686fb..a5eb0a1f559c7 100644 ---- a/drivers/mtd/nand/raw/mpc5121_nfc.c -+++ b/drivers/mtd/nand/raw/mpc5121_nfc.c -@@ -290,7 +290,6 @@ static int ads5121_chipselect_init(struct mtd_info *mtd) - /* Control chips select signal on ADS5121 board */ - static void ads5121_select_chip(struct nand_chip *nand, int chip) - { -- struct mtd_info *mtd = nand_to_mtd(nand); - struct mpc5121_nfc_prv *prv = nand_get_controller_data(nand); - u8 v; - -diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c -index ce6a4e1965e1d..403c1b9cf6ab8 100644 ---- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c -+++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c -@@ -1970,8 +1970,7 @@ static irqreturn_t hclgevf_misc_irq_handle(int irq, void *data) - break; - } - -- if (event_cause != HCLGEVF_VECTOR0_EVENT_OTHER) -- hclgevf_enable_vector(&hdev->misc_vector, true); -+ hclgevf_enable_vector(&hdev->misc_vector, true); - - return IRQ_HANDLED; - } -diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c -index 9adfc0a7ab823..26d49dcdbeb3e 100644 ---- a/drivers/net/ethernet/ibm/ibmvnic.c -+++ b/drivers/net/ethernet/ibm/ibmvnic.c -@@ -3258,11 +3258,25 @@ static void ibmvnic_send_req_caps(struct ibmvnic_adapter *adapter, int retry) - struct device *dev = &adapter->vdev->dev; - union ibmvnic_crq crq; - int max_entries; -+ int cap_reqs; -+ -+ /* We send out 6 or 7 REQUEST_CAPABILITY CRQs below (depending on -+ * the PROMISC flag). Initialize this count upfront. When the tasklet -+ * receives a response to all of these, it will send the next protocol -+ * message (QUERY_IP_OFFLOAD). -+ */ -+ if (!(adapter->netdev->flags & IFF_PROMISC) || -+ adapter->promisc_supported) -+ cap_reqs = 7; -+ else -+ cap_reqs = 6; - - if (!retry) { - /* Sub-CRQ entries are 32 byte long */ - int entries_page = 4 * PAGE_SIZE / (sizeof(u64) * 4); - -+ atomic_set(&adapter->running_cap_crqs, cap_reqs); -+ - if (adapter->min_tx_entries_per_subcrq > entries_page || - adapter->min_rx_add_entries_per_subcrq > entries_page) { - dev_err(dev, "Fatal, invalid entries per sub-crq\n"); -@@ -3323,44 +3337,45 @@ static void ibmvnic_send_req_caps(struct ibmvnic_adapter *adapter, int retry) - adapter->opt_rx_comp_queues; - - adapter->req_rx_add_queues = adapter->max_rx_add_queues; -+ } else { -+ atomic_add(cap_reqs, &adapter->running_cap_crqs); - } -- - memset(&crq, 0, sizeof(crq)); - crq.request_capability.first = IBMVNIC_CRQ_CMD; - crq.request_capability.cmd = REQUEST_CAPABILITY; - - crq.request_capability.capability = cpu_to_be16(REQ_TX_QUEUES); - crq.request_capability.number = cpu_to_be64(adapter->req_tx_queues); -- atomic_inc(&adapter->running_cap_crqs); -+ cap_reqs--; - ibmvnic_send_crq(adapter, &crq); - - crq.request_capability.capability = cpu_to_be16(REQ_RX_QUEUES); - crq.request_capability.number = cpu_to_be64(adapter->req_rx_queues); -- atomic_inc(&adapter->running_cap_crqs); -+ cap_reqs--; - ibmvnic_send_crq(adapter, &crq); - - crq.request_capability.capability = cpu_to_be16(REQ_RX_ADD_QUEUES); - crq.request_capability.number = cpu_to_be64(adapter->req_rx_add_queues); -- atomic_inc(&adapter->running_cap_crqs); -+ cap_reqs--; - ibmvnic_send_crq(adapter, &crq); - - crq.request_capability.capability = - cpu_to_be16(REQ_TX_ENTRIES_PER_SUBCRQ); - crq.request_capability.number = - cpu_to_be64(adapter->req_tx_entries_per_subcrq); -- atomic_inc(&adapter->running_cap_crqs); -+ cap_reqs--; - ibmvnic_send_crq(adapter, &crq); - - crq.request_capability.capability = - cpu_to_be16(REQ_RX_ADD_ENTRIES_PER_SUBCRQ); - crq.request_capability.number = - cpu_to_be64(adapter->req_rx_add_entries_per_subcrq); -- atomic_inc(&adapter->running_cap_crqs); -+ cap_reqs--; - ibmvnic_send_crq(adapter, &crq); - - crq.request_capability.capability = cpu_to_be16(REQ_MTU); - crq.request_capability.number = cpu_to_be64(adapter->req_mtu); -- atomic_inc(&adapter->running_cap_crqs); -+ cap_reqs--; - ibmvnic_send_crq(adapter, &crq); - - if (adapter->netdev->flags & IFF_PROMISC) { -@@ -3368,16 +3383,21 @@ static void ibmvnic_send_req_caps(struct ibmvnic_adapter *adapter, int retry) - crq.request_capability.capability = - cpu_to_be16(PROMISC_REQUESTED); - crq.request_capability.number = cpu_to_be64(1); -- atomic_inc(&adapter->running_cap_crqs); -+ cap_reqs--; - ibmvnic_send_crq(adapter, &crq); - } - } else { - crq.request_capability.capability = - cpu_to_be16(PROMISC_REQUESTED); - crq.request_capability.number = cpu_to_be64(0); -- atomic_inc(&adapter->running_cap_crqs); -+ cap_reqs--; - ibmvnic_send_crq(adapter, &crq); - } -+ -+ /* Keep at end to catch any discrepancy between expected and actual -+ * CRQs sent. -+ */ -+ WARN_ON(cap_reqs != 0); - } - - static int pending_scrq(struct ibmvnic_adapter *adapter, -@@ -3782,118 +3802,132 @@ static void send_map_query(struct ibmvnic_adapter *adapter) - static void send_cap_queries(struct ibmvnic_adapter *adapter) - { - union ibmvnic_crq crq; -+ int cap_reqs; -+ -+ /* We send out 25 QUERY_CAPABILITY CRQs below. Initialize this count -+ * upfront. When the tasklet receives a response to all of these, it -+ * can send out the next protocol messaage (REQUEST_CAPABILITY). -+ */ -+ cap_reqs = 25; -+ -+ atomic_set(&adapter->running_cap_crqs, cap_reqs); - -- atomic_set(&adapter->running_cap_crqs, 0); - memset(&crq, 0, sizeof(crq)); - crq.query_capability.first = IBMVNIC_CRQ_CMD; - crq.query_capability.cmd = QUERY_CAPABILITY; - - crq.query_capability.capability = cpu_to_be16(MIN_TX_QUEUES); -- atomic_inc(&adapter->running_cap_crqs); - ibmvnic_send_crq(adapter, &crq); -+ cap_reqs--; - - crq.query_capability.capability = cpu_to_be16(MIN_RX_QUEUES); -- atomic_inc(&adapter->running_cap_crqs); - ibmvnic_send_crq(adapter, &crq); -+ cap_reqs--; - - crq.query_capability.capability = cpu_to_be16(MIN_RX_ADD_QUEUES); -- atomic_inc(&adapter->running_cap_crqs); - ibmvnic_send_crq(adapter, &crq); -+ cap_reqs--; - - crq.query_capability.capability = cpu_to_be16(MAX_TX_QUEUES); -- atomic_inc(&adapter->running_cap_crqs); - ibmvnic_send_crq(adapter, &crq); -+ cap_reqs--; - - crq.query_capability.capability = cpu_to_be16(MAX_RX_QUEUES); -- atomic_inc(&adapter->running_cap_crqs); - ibmvnic_send_crq(adapter, &crq); -+ cap_reqs--; - - crq.query_capability.capability = cpu_to_be16(MAX_RX_ADD_QUEUES); -- atomic_inc(&adapter->running_cap_crqs); - ibmvnic_send_crq(adapter, &crq); -+ cap_reqs--; - - crq.query_capability.capability = - cpu_to_be16(MIN_TX_ENTRIES_PER_SUBCRQ); -- atomic_inc(&adapter->running_cap_crqs); - ibmvnic_send_crq(adapter, &crq); -+ cap_reqs--; - - crq.query_capability.capability = - cpu_to_be16(MIN_RX_ADD_ENTRIES_PER_SUBCRQ); -- atomic_inc(&adapter->running_cap_crqs); - ibmvnic_send_crq(adapter, &crq); -+ cap_reqs--; - - crq.query_capability.capability = - cpu_to_be16(MAX_TX_ENTRIES_PER_SUBCRQ); -- atomic_inc(&adapter->running_cap_crqs); - ibmvnic_send_crq(adapter, &crq); -+ cap_reqs--; - - crq.query_capability.capability = - cpu_to_be16(MAX_RX_ADD_ENTRIES_PER_SUBCRQ); -- atomic_inc(&adapter->running_cap_crqs); - ibmvnic_send_crq(adapter, &crq); -+ cap_reqs--; - - crq.query_capability.capability = cpu_to_be16(TCP_IP_OFFLOAD); -- atomic_inc(&adapter->running_cap_crqs); - ibmvnic_send_crq(adapter, &crq); -+ cap_reqs--; - - crq.query_capability.capability = cpu_to_be16(PROMISC_SUPPORTED); -- atomic_inc(&adapter->running_cap_crqs); - ibmvnic_send_crq(adapter, &crq); -+ cap_reqs--; - - crq.query_capability.capability = cpu_to_be16(MIN_MTU); -- atomic_inc(&adapter->running_cap_crqs); - ibmvnic_send_crq(adapter, &crq); -+ cap_reqs--; - - crq.query_capability.capability = cpu_to_be16(MAX_MTU); -- atomic_inc(&adapter->running_cap_crqs); - ibmvnic_send_crq(adapter, &crq); -+ cap_reqs--; - - crq.query_capability.capability = cpu_to_be16(MAX_MULTICAST_FILTERS); -- atomic_inc(&adapter->running_cap_crqs); - ibmvnic_send_crq(adapter, &crq); -+ cap_reqs--; - - crq.query_capability.capability = cpu_to_be16(VLAN_HEADER_INSERTION); -- atomic_inc(&adapter->running_cap_crqs); - ibmvnic_send_crq(adapter, &crq); -+ cap_reqs--; - - crq.query_capability.capability = cpu_to_be16(RX_VLAN_HEADER_INSERTION); -- atomic_inc(&adapter->running_cap_crqs); - ibmvnic_send_crq(adapter, &crq); -+ cap_reqs--; - - crq.query_capability.capability = cpu_to_be16(MAX_TX_SG_ENTRIES); -- atomic_inc(&adapter->running_cap_crqs); - ibmvnic_send_crq(adapter, &crq); -+ cap_reqs--; - - crq.query_capability.capability = cpu_to_be16(RX_SG_SUPPORTED); -- atomic_inc(&adapter->running_cap_crqs); - ibmvnic_send_crq(adapter, &crq); -+ cap_reqs--; - - crq.query_capability.capability = cpu_to_be16(OPT_TX_COMP_SUB_QUEUES); -- atomic_inc(&adapter->running_cap_crqs); - ibmvnic_send_crq(adapter, &crq); -+ cap_reqs--; - - crq.query_capability.capability = cpu_to_be16(OPT_RX_COMP_QUEUES); -- atomic_inc(&adapter->running_cap_crqs); - ibmvnic_send_crq(adapter, &crq); -+ cap_reqs--; - - crq.query_capability.capability = - cpu_to_be16(OPT_RX_BUFADD_Q_PER_RX_COMP_Q); -- atomic_inc(&adapter->running_cap_crqs); - ibmvnic_send_crq(adapter, &crq); -+ cap_reqs--; - - crq.query_capability.capability = - cpu_to_be16(OPT_TX_ENTRIES_PER_SUBCRQ); -- atomic_inc(&adapter->running_cap_crqs); - ibmvnic_send_crq(adapter, &crq); -+ cap_reqs--; - - crq.query_capability.capability = - cpu_to_be16(OPT_RXBA_ENTRIES_PER_SUBCRQ); -- atomic_inc(&adapter->running_cap_crqs); - ibmvnic_send_crq(adapter, &crq); -+ cap_reqs--; - - crq.query_capability.capability = cpu_to_be16(TX_RX_DESC_REQ); -- atomic_inc(&adapter->running_cap_crqs); -+ - ibmvnic_send_crq(adapter, &crq); -+ cap_reqs--; -+ -+ /* Keep at end to catch any discrepancy between expected and actual -+ * CRQs sent. -+ */ -+ WARN_ON(cap_reqs != 0); - } - - static void handle_vpd_size_rsp(union ibmvnic_crq *crq, -@@ -4160,6 +4194,8 @@ static void handle_request_cap_rsp(union ibmvnic_crq *crq, - char *name; - - atomic_dec(&adapter->running_cap_crqs); -+ netdev_dbg(adapter->netdev, "Outstanding request-caps: %d\n", -+ atomic_read(&adapter->running_cap_crqs)); - switch (be16_to_cpu(crq->request_capability_rsp.capability)) { - case REQ_TX_QUEUES: - req_value = &adapter->req_tx_queues; -@@ -4787,12 +4823,6 @@ static void ibmvnic_tasklet(void *data) - ibmvnic_handle_crq(crq, adapter); - crq->generic.first = 0; - } -- -- /* remain in tasklet until all -- * capabilities responses are received -- */ -- if (!adapter->wait_capability) -- done = true; - } - /* if capabilities CRQ's were sent in this tasklet, the following - * tasklet must wait until all responses are received -diff --git a/drivers/net/ethernet/intel/i40e/i40e.h b/drivers/net/ethernet/intel/i40e/i40e.h -index f8422dbfd54e6..4c8c31692e9e0 100644 ---- a/drivers/net/ethernet/intel/i40e/i40e.h -+++ b/drivers/net/ethernet/intel/i40e/i40e.h -@@ -182,7 +182,6 @@ enum i40e_interrupt_policy { - - struct i40e_lump_tracking { - u16 num_entries; -- u16 search_hint; - u16 list[0]; - #define I40E_PILE_VALID_BIT 0x8000 - #define I40E_IWARP_IRQ_PILE_ID (I40E_PILE_VALID_BIT - 2) -@@ -757,12 +756,12 @@ struct i40e_vsi { - struct rtnl_link_stats64 net_stats_offsets; - struct i40e_eth_stats eth_stats; - struct i40e_eth_stats eth_stats_offsets; -- u32 tx_restart; -- u32 tx_busy; -+ u64 tx_restart; -+ u64 tx_busy; - u64 tx_linearize; - u64 tx_force_wb; -- u32 rx_buf_failed; -- u32 rx_page_failed; -+ u64 rx_buf_failed; -+ u64 rx_page_failed; - - /* These are containers of ring pointers, allocated at run-time */ - struct i40e_ring **rx_rings; -diff --git a/drivers/net/ethernet/intel/i40e/i40e_debugfs.c b/drivers/net/ethernet/intel/i40e/i40e_debugfs.c -index 99ea543dd2453..276f04c0e51d6 100644 ---- a/drivers/net/ethernet/intel/i40e/i40e_debugfs.c -+++ b/drivers/net/ethernet/intel/i40e/i40e_debugfs.c -@@ -234,7 +234,7 @@ static void i40e_dbg_dump_vsi_seid(struct i40e_pf *pf, int seid) - (unsigned long int)vsi->net_stats_offsets.rx_compressed, - (unsigned long int)vsi->net_stats_offsets.tx_compressed); - dev_info(&pf->pdev->dev, -- " tx_restart = %d, tx_busy = %d, rx_buf_failed = %d, rx_page_failed = %d\n", -+ " tx_restart = %llu, tx_busy = %llu, rx_buf_failed = %llu, rx_page_failed = %llu\n", - vsi->tx_restart, vsi->tx_busy, - vsi->rx_buf_failed, vsi->rx_page_failed); - rcu_read_lock(); -diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c -index a2326683be170..a6ae4b7b11afd 100644 ---- a/drivers/net/ethernet/intel/i40e/i40e_main.c -+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c -@@ -204,10 +204,6 @@ int i40e_free_virt_mem_d(struct i40e_hw *hw, struct i40e_virt_mem *mem) - * @id: an owner id to stick on the items assigned - * - * Returns the base item index of the lump, or negative for error -- * -- * The search_hint trick and lack of advanced fit-finding only work -- * because we're highly likely to have all the same size lump requests. -- * Linear search time and any fragmentation should be minimal. - **/ - static int i40e_get_lump(struct i40e_pf *pf, struct i40e_lump_tracking *pile, - u16 needed, u16 id) -@@ -222,8 +218,21 @@ static int i40e_get_lump(struct i40e_pf *pf, struct i40e_lump_tracking *pile, - return -EINVAL; - } - -- /* start the linear search with an imperfect hint */ -- i = pile->search_hint; -+ /* Allocate last queue in the pile for FDIR VSI queue -+ * so it doesn't fragment the qp_pile -+ */ -+ if (pile == pf->qp_pile && pf->vsi[id]->type == I40E_VSI_FDIR) { -+ if (pile->list[pile->num_entries - 1] & I40E_PILE_VALID_BIT) { -+ dev_err(&pf->pdev->dev, -+ "Cannot allocate queue %d for I40E_VSI_FDIR\n", -+ pile->num_entries - 1); -+ return -ENOMEM; -+ } -+ pile->list[pile->num_entries - 1] = id | I40E_PILE_VALID_BIT; -+ return pile->num_entries - 1; -+ } -+ -+ i = 0; - while (i < pile->num_entries) { - /* skip already allocated entries */ - if (pile->list[i] & I40E_PILE_VALID_BIT) { -@@ -242,7 +251,6 @@ static int i40e_get_lump(struct i40e_pf *pf, struct i40e_lump_tracking *pile, - for (j = 0; j < needed; j++) - pile->list[i+j] = id | I40E_PILE_VALID_BIT; - ret = i; -- pile->search_hint = i + j; - break; - } - -@@ -265,7 +273,7 @@ static int i40e_put_lump(struct i40e_lump_tracking *pile, u16 index, u16 id) - { - int valid_id = (id | I40E_PILE_VALID_BIT); - int count = 0; -- int i; -+ u16 i; - - if (!pile || index >= pile->num_entries) - return -EINVAL; -@@ -277,8 +285,6 @@ static int i40e_put_lump(struct i40e_lump_tracking *pile, u16 index, u16 id) - count++; - } - -- if (count && index < pile->search_hint) -- pile->search_hint = index; - - return count; - } -@@ -798,9 +804,9 @@ static void i40e_update_vsi_stats(struct i40e_vsi *vsi) - struct rtnl_link_stats64 *ns; /* netdev stats */ - struct i40e_eth_stats *oes; - struct i40e_eth_stats *es; /* device's eth stats */ -- u32 tx_restart, tx_busy; -+ u64 tx_restart, tx_busy; - struct i40e_ring *p; -- u32 rx_page, rx_buf; -+ u64 rx_page, rx_buf; - u64 bytes, packets; - unsigned int start; - u64 tx_linearize; -@@ -10084,15 +10090,9 @@ static void i40e_rebuild(struct i40e_pf *pf, bool reinit, bool lock_acquired) - } - i40e_get_oem_version(&pf->hw); - -- if (test_bit(__I40E_EMP_RESET_INTR_RECEIVED, pf->state) && -- ((hw->aq.fw_maj_ver == 4 && hw->aq.fw_min_ver <= 33) || -- hw->aq.fw_maj_ver < 4) && hw->mac.type == I40E_MAC_XL710) { -- /* The following delay is necessary for 4.33 firmware and older -- * to recover after EMP reset. 200 ms should suffice but we -- * put here 300 ms to be sure that FW is ready to operate -- * after reset. -- */ -- mdelay(300); -+ if (test_and_clear_bit(__I40E_EMP_RESET_INTR_RECEIVED, pf->state)) { -+ /* The following delay is necessary for firmware update. */ -+ mdelay(1000); - } - - /* re-verify the eeprom if we just had an EMP reset */ -@@ -11388,7 +11388,6 @@ static int i40e_init_interrupt_scheme(struct i40e_pf *pf) - return -ENOMEM; - - pf->irq_pile->num_entries = vectors; -- pf->irq_pile->search_hint = 0; - - /* track first vector for misc interrupts, ignore return */ - (void)i40e_get_lump(pf, pf->irq_pile, 1, I40E_PILE_VALID_BIT - 1); -@@ -12139,7 +12138,6 @@ static int i40e_sw_init(struct i40e_pf *pf) - goto sw_init_done; - } - pf->qp_pile->num_entries = pf->hw.func_caps.num_tx_qp; -- pf->qp_pile->search_hint = 0; - - pf->tx_timeout_recovery_level = 1; - -diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c -index cd6f5bd982559..4962e6193eeca 100644 ---- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c -+++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c -@@ -2485,6 +2485,59 @@ error_param: - aq_ret); - } - -+/** -+ * i40e_check_enough_queue - find big enough queue number -+ * @vf: pointer to the VF info -+ * @needed: the number of items needed -+ * -+ * Returns the base item index of the queue, or negative for error -+ **/ -+static int i40e_check_enough_queue(struct i40e_vf *vf, u16 needed) -+{ -+ unsigned int i, cur_queues, more, pool_size; -+ struct i40e_lump_tracking *pile; -+ struct i40e_pf *pf = vf->pf; -+ struct i40e_vsi *vsi; -+ -+ vsi = pf->vsi[vf->lan_vsi_idx]; -+ cur_queues = vsi->alloc_queue_pairs; -+ -+ /* if current allocated queues are enough for need */ -+ if (cur_queues >= needed) -+ return vsi->base_queue; -+ -+ pile = pf->qp_pile; -+ if (cur_queues > 0) { -+ /* if the allocated queues are not zero -+ * just check if there are enough queues for more -+ * behind the allocated queues. -+ */ -+ more = needed - cur_queues; -+ for (i = vsi->base_queue + cur_queues; -+ i < pile->num_entries; i++) { -+ if (pile->list[i] & I40E_PILE_VALID_BIT) -+ break; -+ -+ if (more-- == 1) -+ /* there is enough */ -+ return vsi->base_queue; -+ } -+ } -+ -+ pool_size = 0; -+ for (i = 0; i < pile->num_entries; i++) { -+ if (pile->list[i] & I40E_PILE_VALID_BIT) { -+ pool_size = 0; -+ continue; -+ } -+ if (needed <= ++pool_size) -+ /* there is enough */ -+ return i; -+ } -+ -+ return -ENOMEM; -+} -+ - /** - * i40e_vc_request_queues_msg - * @vf: pointer to the VF info -@@ -2519,6 +2572,12 @@ static int i40e_vc_request_queues_msg(struct i40e_vf *vf, u8 *msg) - req_pairs - cur_pairs, - pf->queues_left); - vfres->num_queue_pairs = pf->queues_left + cur_pairs; -+ } else if (i40e_check_enough_queue(vf, req_pairs) < 0) { -+ dev_warn(&pf->pdev->dev, -+ "VF %d requested %d more queues, but there is not enough for it.\n", -+ vf->vf_id, -+ req_pairs - cur_pairs); -+ vfres->num_queue_pairs = cur_pairs; - } else { - /* successful request */ - vf->num_req_queues = req_pairs; -diff --git a/drivers/net/hamradio/yam.c b/drivers/net/hamradio/yam.c -index 5ab53e9942f30..5d30b3e1806ab 100644 ---- a/drivers/net/hamradio/yam.c -+++ b/drivers/net/hamradio/yam.c -@@ -951,9 +951,7 @@ static int yam_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd) - sizeof(struct yamdrv_ioctl_mcs)); - if (IS_ERR(ym)) - return PTR_ERR(ym); -- if (ym->cmd != SIOCYAMSMCS) -- return -EINVAL; -- if (ym->bitrate > YAM_MAXBITRATE) { -+ if (ym->cmd != SIOCYAMSMCS || ym->bitrate > YAM_MAXBITRATE) { - kfree(ym); - return -EINVAL; - } -diff --git a/drivers/net/phy/broadcom.c b/drivers/net/phy/broadcom.c -index 5e956089bf525..c23fec34b50e9 100644 ---- a/drivers/net/phy/broadcom.c -+++ b/drivers/net/phy/broadcom.c -@@ -646,6 +646,7 @@ static struct phy_driver broadcom_drivers[] = { - .phy_id_mask = 0xfffffff0, - .name = "Broadcom BCM54616S", - /* PHY_GBIT_FEATURES */ -+ .soft_reset = genphy_soft_reset, - .config_init = bcm54xx_config_init, - .config_aneg = bcm54616s_config_aneg, - .ack_interrupt = bcm_phy_ack_intr, -diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c -index 35ade5d21de51..78b918dcd5472 100644 ---- a/drivers/net/phy/phy_device.c -+++ b/drivers/net/phy/phy_device.c -@@ -1433,6 +1433,9 @@ void phy_detach(struct phy_device *phydev) - phy_driver_is_genphy_10g(phydev)) - device_release_driver(&phydev->mdio.dev); - -+ /* Assert the reset signal */ -+ phy_device_reset(phydev, 1); -+ - /* - * The phydev might go away on the put_device() below, so avoid - * a use-after-free bug by reading the underlying bus first. -@@ -1444,9 +1447,6 @@ void phy_detach(struct phy_device *phydev) - ndev_owner = dev->dev.parent->driver->owner; - if (ndev_owner != bus->owner) - module_put(bus->owner); -- -- /* Assert the reset signal */ -- phy_device_reset(phydev, 1); - } - EXPORT_SYMBOL(phy_detach); - -diff --git a/drivers/net/phy/phylink.c b/drivers/net/phy/phylink.c -index 7be43a1eaefda..5b2bf75269033 100644 ---- a/drivers/net/phy/phylink.c -+++ b/drivers/net/phy/phylink.c -@@ -582,6 +582,11 @@ static int phylink_register_sfp(struct phylink *pl, - return ret; - } - -+ if (!fwnode_device_is_available(ref.fwnode)) { -+ fwnode_handle_put(ref.fwnode); -+ return 0; -+ } -+ - pl->sfp_bus = sfp_register_upstream(ref.fwnode, pl, &sfp_phylink_ops); - if (!pl->sfp_bus) - return -ENOMEM; -diff --git a/drivers/rpmsg/rpmsg_char.c b/drivers/rpmsg/rpmsg_char.c -index c655074c07c2e..ac50ed7577651 100644 ---- a/drivers/rpmsg/rpmsg_char.c -+++ b/drivers/rpmsg/rpmsg_char.c -@@ -92,7 +92,7 @@ static int rpmsg_eptdev_destroy(struct device *dev, void *data) - /* wake up any blocked readers */ - wake_up_interruptible(&eptdev->readq); - -- device_del(&eptdev->dev); -+ cdev_device_del(&eptdev->cdev, &eptdev->dev); - put_device(&eptdev->dev); - - return 0; -@@ -336,7 +336,6 @@ static void rpmsg_eptdev_release_device(struct device *dev) - - ida_simple_remove(&rpmsg_ept_ida, dev->id); - ida_simple_remove(&rpmsg_minor_ida, MINOR(eptdev->dev.devt)); -- cdev_del(&eptdev->cdev); - kfree(eptdev); - } - -@@ -381,19 +380,13 @@ static int rpmsg_eptdev_create(struct rpmsg_ctrldev *ctrldev, - dev->id = ret; - dev_set_name(dev, "rpmsg%d", ret); - -- ret = cdev_add(&eptdev->cdev, dev->devt, 1); -+ ret = cdev_device_add(&eptdev->cdev, &eptdev->dev); - if (ret) - goto free_ept_ida; - - /* We can now rely on the release function for cleanup */ - dev->release = rpmsg_eptdev_release_device; - -- ret = device_add(dev); -- if (ret) { -- dev_err(dev, "device_add failed: %d\n", ret); -- put_device(dev); -- } -- - return ret; - - free_ept_ida: -@@ -462,7 +455,6 @@ static void rpmsg_ctrldev_release_device(struct device *dev) - - ida_simple_remove(&rpmsg_ctrl_ida, dev->id); - ida_simple_remove(&rpmsg_minor_ida, MINOR(dev->devt)); -- cdev_del(&ctrldev->cdev); - kfree(ctrldev); - } - -@@ -497,19 +489,13 @@ static int rpmsg_chrdev_probe(struct rpmsg_device *rpdev) - dev->id = ret; - dev_set_name(&ctrldev->dev, "rpmsg_ctrl%d", ret); - -- ret = cdev_add(&ctrldev->cdev, dev->devt, 1); -+ ret = cdev_device_add(&ctrldev->cdev, &ctrldev->dev); - if (ret) - goto free_ctrl_ida; - - /* We can now rely on the release function for cleanup */ - dev->release = rpmsg_ctrldev_release_device; - -- ret = device_add(dev); -- if (ret) { -- dev_err(&rpdev->dev, "device_add failed: %d\n", ret); -- put_device(dev); -- } -- - dev_set_drvdata(&rpdev->dev, ctrldev); - - return ret; -@@ -535,7 +521,7 @@ static void rpmsg_chrdev_remove(struct rpmsg_device *rpdev) - if (ret) - dev_warn(&rpdev->dev, "failed to nuke endpoints: %d\n", ret); - -- device_del(&ctrldev->dev); -+ cdev_device_del(&ctrldev->cdev, &ctrldev->dev); - put_device(&ctrldev->dev); - } - -diff --git a/drivers/s390/scsi/zfcp_fc.c b/drivers/s390/scsi/zfcp_fc.c -index b018b61bd168e..d4c2c44b863dd 100644 ---- a/drivers/s390/scsi/zfcp_fc.c -+++ b/drivers/s390/scsi/zfcp_fc.c -@@ -521,6 +521,8 @@ static void zfcp_fc_adisc_handler(void *data) - goto out; - } - -+ /* re-init to undo drop from zfcp_fc_adisc() */ -+ port->d_id = ntoh24(adisc_resp->adisc_port_id); - /* port is good, unblock rport without going through erp */ - zfcp_scsi_schedule_rport_register(port); - out: -@@ -534,6 +536,7 @@ static int zfcp_fc_adisc(struct zfcp_port *port) - struct zfcp_fc_req *fc_req; - struct zfcp_adapter *adapter = port->adapter; - struct Scsi_Host *shost = adapter->scsi_host; -+ u32 d_id; - int ret; - - fc_req = kmem_cache_zalloc(zfcp_fc_req_cache, GFP_ATOMIC); -@@ -558,7 +561,15 @@ static int zfcp_fc_adisc(struct zfcp_port *port) - fc_req->u.adisc.req.adisc_cmd = ELS_ADISC; - hton24(fc_req->u.adisc.req.adisc_port_id, fc_host_port_id(shost)); - -- ret = zfcp_fsf_send_els(adapter, port->d_id, &fc_req->ct_els, -+ d_id = port->d_id; /* remember as destination for send els below */ -+ /* -+ * Force fresh GID_PN lookup on next port recovery. -+ * Must happen after request setup and before sending request, -+ * to prevent race with port->d_id re-init in zfcp_fc_adisc_handler(). -+ */ -+ port->d_id = 0; -+ -+ ret = zfcp_fsf_send_els(adapter, d_id, &fc_req->ct_els, - ZFCP_FC_CTELS_TMO); - if (ret) - kmem_cache_free(zfcp_fc_req_cache, fc_req); -diff --git a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c -index b4bfab5edf8ff..e6c3e7c070aaf 100644 ---- a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c -+++ b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c -@@ -80,7 +80,7 @@ static int bnx2fc_bind_pcidev(struct bnx2fc_hba *hba); - static void bnx2fc_unbind_pcidev(struct bnx2fc_hba *hba); - static struct fc_lport *bnx2fc_if_create(struct bnx2fc_interface *interface, - struct device *parent, int npiv); --static void bnx2fc_destroy_work(struct work_struct *work); -+static void bnx2fc_port_destroy(struct fcoe_port *port); - - static struct bnx2fc_hba *bnx2fc_hba_lookup(struct net_device *phys_dev); - static struct bnx2fc_interface *bnx2fc_interface_lookup(struct net_device -@@ -902,9 +902,6 @@ static void bnx2fc_indicate_netevent(void *context, unsigned long event, - __bnx2fc_destroy(interface); - } - mutex_unlock(&bnx2fc_dev_lock); -- -- /* Ensure ALL destroy work has been completed before return */ -- flush_workqueue(bnx2fc_wq); - return; - - default: -@@ -1211,8 +1208,8 @@ static int bnx2fc_vport_destroy(struct fc_vport *vport) - mutex_unlock(&n_port->lp_mutex); - bnx2fc_free_vport(interface->hba, port->lport); - bnx2fc_port_shutdown(port->lport); -+ bnx2fc_port_destroy(port); - bnx2fc_interface_put(interface); -- queue_work(bnx2fc_wq, &port->destroy_work); - return 0; - } - -@@ -1521,7 +1518,6 @@ static struct fc_lport *bnx2fc_if_create(struct bnx2fc_interface *interface, - port->lport = lport; - port->priv = interface; - port->get_netdev = bnx2fc_netdev; -- INIT_WORK(&port->destroy_work, bnx2fc_destroy_work); - - /* Configure fcoe_port */ - rc = bnx2fc_lport_config(lport); -@@ -1649,8 +1645,8 @@ static void __bnx2fc_destroy(struct bnx2fc_interface *interface) - bnx2fc_interface_cleanup(interface); - bnx2fc_stop(interface); - list_del(&interface->list); -+ bnx2fc_port_destroy(port); - bnx2fc_interface_put(interface); -- queue_work(bnx2fc_wq, &port->destroy_work); - } - - /** -@@ -1691,15 +1687,12 @@ netdev_err: - return rc; - } - --static void bnx2fc_destroy_work(struct work_struct *work) -+static void bnx2fc_port_destroy(struct fcoe_port *port) - { -- struct fcoe_port *port; - struct fc_lport *lport; - -- port = container_of(work, struct fcoe_port, destroy_work); - lport = port->lport; -- -- BNX2FC_HBA_DBG(lport, "Entered bnx2fc_destroy_work\n"); -+ BNX2FC_HBA_DBG(lport, "Entered %s, destroying lport %p\n", __func__, lport); - - bnx2fc_if_destroy(lport); - } -@@ -2553,9 +2546,6 @@ static void bnx2fc_ulp_exit(struct cnic_dev *dev) - __bnx2fc_destroy(interface); - mutex_unlock(&bnx2fc_dev_lock); - -- /* Ensure ALL destroy work has been completed before return */ -- flush_workqueue(bnx2fc_wq); -- - bnx2fc_ulp_stop(hba); - /* unregister cnic device */ - if (test_and_clear_bit(BNX2FC_CNIC_REGISTERED, &hba->reg_with_cnic)) -diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c -index 38eb49ba361f0..3d3d616e58989 100644 ---- a/drivers/tty/n_gsm.c -+++ b/drivers/tty/n_gsm.c -@@ -313,6 +313,7 @@ static struct tty_driver *gsm_tty_driver; - #define GSM1_ESCAPE_BITS 0x20 - #define XON 0x11 - #define XOFF 0x13 -+#define ISO_IEC_646_MASK 0x7F - - static const struct tty_port_operations gsm_port_ops; - -@@ -531,7 +532,8 @@ static int gsm_stuff_frame(const u8 *input, u8 *output, int len) - int olen = 0; - while (len--) { - if (*input == GSM1_SOF || *input == GSM1_ESCAPE -- || *input == XON || *input == XOFF) { -+ || (*input & ISO_IEC_646_MASK) == XON -+ || (*input & ISO_IEC_646_MASK) == XOFF) { - *output++ = GSM1_ESCAPE; - *output++ = *input++ ^ GSM1_ESCAPE_BITS; - olen++; -diff --git a/drivers/tty/serial/8250/8250_of.c b/drivers/tty/serial/8250/8250_of.c -index 9ba31701a372e..a9b0a84b1e433 100644 ---- a/drivers/tty/serial/8250/8250_of.c -+++ b/drivers/tty/serial/8250/8250_of.c -@@ -105,8 +105,17 @@ static int of_platform_serial_setup(struct platform_device *ofdev, - port->mapsize = resource_size(&resource); - - /* Check for shifted address mapping */ -- if (of_property_read_u32(np, "reg-offset", &prop) == 0) -+ if (of_property_read_u32(np, "reg-offset", &prop) == 0) { -+ if (prop >= port->mapsize) { -+ dev_warn(&ofdev->dev, "reg-offset %u exceeds region size %pa\n", -+ prop, &port->mapsize); -+ ret = -EINVAL; -+ goto err_unprepare; -+ } -+ - port->mapbase += prop; -+ port->mapsize -= prop; -+ } - - port->iotype = UPIO_MEM; - if (of_property_read_u32(np, "reg-io-width", &prop) == 0) { -diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c -index c82c7181348de..fd443bc4c2983 100644 ---- a/drivers/tty/serial/8250/8250_pci.c -+++ b/drivers/tty/serial/8250/8250_pci.c -@@ -5130,8 +5130,30 @@ static const struct pci_device_id serial_pci_tbl[] = { - { PCI_VENDOR_ID_INTASHIELD, PCI_DEVICE_ID_INTASHIELD_IS400, - PCI_ANY_ID, PCI_ANY_ID, 0, 0, /* 135a.0dc0 */ - pbn_b2_4_115200 }, -+ /* Brainboxes Devices */ - /* -- * BrainBoxes UC-260 -+ * Brainboxes UC-101 -+ */ -+ { PCI_VENDOR_ID_INTASHIELD, 0x0BA1, -+ PCI_ANY_ID, PCI_ANY_ID, -+ 0, 0, -+ pbn_b2_2_115200 }, -+ /* -+ * Brainboxes UC-235/246 -+ */ -+ { PCI_VENDOR_ID_INTASHIELD, 0x0AA1, -+ PCI_ANY_ID, PCI_ANY_ID, -+ 0, 0, -+ pbn_b2_1_115200 }, -+ /* -+ * Brainboxes UC-257 -+ */ -+ { PCI_VENDOR_ID_INTASHIELD, 0x0861, -+ PCI_ANY_ID, PCI_ANY_ID, -+ 0, 0, -+ pbn_b2_2_115200 }, -+ /* -+ * Brainboxes UC-260/271/701/756 - */ - { PCI_VENDOR_ID_INTASHIELD, 0x0D21, - PCI_ANY_ID, PCI_ANY_ID, -@@ -5139,7 +5161,81 @@ static const struct pci_device_id serial_pci_tbl[] = { - pbn_b2_4_115200 }, - { PCI_VENDOR_ID_INTASHIELD, 0x0E34, - PCI_ANY_ID, PCI_ANY_ID, -- PCI_CLASS_COMMUNICATION_MULTISERIAL << 8, 0xffff00, -+ PCI_CLASS_COMMUNICATION_MULTISERIAL << 8, 0xffff00, -+ pbn_b2_4_115200 }, -+ /* -+ * Brainboxes UC-268 -+ */ -+ { PCI_VENDOR_ID_INTASHIELD, 0x0841, -+ PCI_ANY_ID, PCI_ANY_ID, -+ 0, 0, -+ pbn_b2_4_115200 }, -+ /* -+ * Brainboxes UC-275/279 -+ */ -+ { PCI_VENDOR_ID_INTASHIELD, 0x0881, -+ PCI_ANY_ID, PCI_ANY_ID, -+ 0, 0, -+ pbn_b2_8_115200 }, -+ /* -+ * Brainboxes UC-302 -+ */ -+ { PCI_VENDOR_ID_INTASHIELD, 0x08E1, -+ PCI_ANY_ID, PCI_ANY_ID, -+ 0, 0, -+ pbn_b2_2_115200 }, -+ /* -+ * Brainboxes UC-310 -+ */ -+ { PCI_VENDOR_ID_INTASHIELD, 0x08C1, -+ PCI_ANY_ID, PCI_ANY_ID, -+ 0, 0, -+ pbn_b2_2_115200 }, -+ /* -+ * Brainboxes UC-313 -+ */ -+ { PCI_VENDOR_ID_INTASHIELD, 0x08A3, -+ PCI_ANY_ID, PCI_ANY_ID, -+ 0, 0, -+ pbn_b2_2_115200 }, -+ /* -+ * Brainboxes UC-320/324 -+ */ -+ { PCI_VENDOR_ID_INTASHIELD, 0x0A61, -+ PCI_ANY_ID, PCI_ANY_ID, -+ 0, 0, -+ pbn_b2_1_115200 }, -+ /* -+ * Brainboxes UC-346 -+ */ -+ { PCI_VENDOR_ID_INTASHIELD, 0x0B02, -+ PCI_ANY_ID, PCI_ANY_ID, -+ 0, 0, -+ pbn_b2_4_115200 }, -+ /* -+ * Brainboxes UC-357 -+ */ -+ { PCI_VENDOR_ID_INTASHIELD, 0x0A81, -+ PCI_ANY_ID, PCI_ANY_ID, -+ 0, 0, -+ pbn_b2_2_115200 }, -+ { PCI_VENDOR_ID_INTASHIELD, 0x0A83, -+ PCI_ANY_ID, PCI_ANY_ID, -+ 0, 0, -+ pbn_b2_2_115200 }, -+ /* -+ * Brainboxes UC-368 -+ */ -+ { PCI_VENDOR_ID_INTASHIELD, 0x0C41, -+ PCI_ANY_ID, PCI_ANY_ID, -+ 0, 0, -+ pbn_b2_4_115200 }, -+ /* -+ * Brainboxes UC-420/431 -+ */ -+ { PCI_VENDOR_ID_INTASHIELD, 0x0921, -+ PCI_ANY_ID, PCI_ANY_ID, -+ 0, 0, - pbn_b2_4_115200 }, - /* - * Perle PCI-RAS cards -diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c -index 23b7bdae173c8..d517b911cd042 100644 ---- a/drivers/tty/serial/stm32-usart.c -+++ b/drivers/tty/serial/stm32-usart.c -@@ -536,7 +536,7 @@ static void stm32_start_tx(struct uart_port *port) - { - struct circ_buf *xmit = &port->state->xmit; - -- if (uart_circ_empty(xmit)) -+ if (uart_circ_empty(xmit) && !port->x_char) - return; - - stm32_transmit_chars(port); -diff --git a/drivers/usb/common/ulpi.c b/drivers/usb/common/ulpi.c -index 9a2ab6751a23c..5a4d08de546fe 100644 ---- a/drivers/usb/common/ulpi.c -+++ b/drivers/usb/common/ulpi.c -@@ -39,8 +39,11 @@ static int ulpi_match(struct device *dev, struct device_driver *driver) - struct ulpi *ulpi = to_ulpi_dev(dev); - const struct ulpi_device_id *id; - -- /* Some ULPI devices don't have a vendor id so rely on OF match */ -- if (ulpi->id.vendor == 0) -+ /* -+ * Some ULPI devices don't have a vendor id -+ * or provide an id_table so rely on OF match. -+ */ -+ if (ulpi->id.vendor == 0 || !drv->id_table) - return of_driver_match_device(dev, driver); - - for (id = drv->id_table; id->vendor; id++) -diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c -index fe9b392bffee3..39203f2ce6a19 100644 ---- a/drivers/usb/core/hcd.c -+++ b/drivers/usb/core/hcd.c -@@ -1567,6 +1567,13 @@ int usb_hcd_submit_urb (struct urb *urb, gfp_t mem_flags) - urb->hcpriv = NULL; - INIT_LIST_HEAD(&urb->urb_list); - atomic_dec(&urb->use_count); -+ /* -+ * Order the write of urb->use_count above before the read -+ * of urb->reject below. Pairs with the memory barriers in -+ * usb_kill_urb() and usb_poison_urb(). -+ */ -+ smp_mb__after_atomic(); -+ - atomic_dec(&urb->dev->urbnum); - if (atomic_read(&urb->reject)) - wake_up(&usb_kill_urb_queue); -@@ -1662,6 +1669,13 @@ static void __usb_hcd_giveback_urb(struct urb *urb) - - usb_anchor_resume_wakeups(anchor); - atomic_dec(&urb->use_count); -+ /* -+ * Order the write of urb->use_count above before the read -+ * of urb->reject below. Pairs with the memory barriers in -+ * usb_kill_urb() and usb_poison_urb(). -+ */ -+ smp_mb__after_atomic(); -+ - if (unlikely(atomic_read(&urb->reject))) - wake_up(&usb_kill_urb_queue); - usb_put_urb(urb); -diff --git a/drivers/usb/core/urb.c b/drivers/usb/core/urb.c -index 31ca5abb4c12a..0045bbc3627dd 100644 ---- a/drivers/usb/core/urb.c -+++ b/drivers/usb/core/urb.c -@@ -691,6 +691,12 @@ void usb_kill_urb(struct urb *urb) - if (!(urb && urb->dev && urb->ep)) - return; - atomic_inc(&urb->reject); -+ /* -+ * Order the write of urb->reject above before the read -+ * of urb->use_count below. Pairs with the barriers in -+ * __usb_hcd_giveback_urb() and usb_hcd_submit_urb(). -+ */ -+ smp_mb__after_atomic(); - - usb_hcd_unlink_urb(urb, -ENOENT); - wait_event(usb_kill_urb_queue, atomic_read(&urb->use_count) == 0); -@@ -732,6 +738,12 @@ void usb_poison_urb(struct urb *urb) - if (!urb) - return; - atomic_inc(&urb->reject); -+ /* -+ * Order the write of urb->reject above before the read -+ * of urb->use_count below. Pairs with the barriers in -+ * __usb_hcd_giveback_urb() and usb_hcd_submit_urb(). -+ */ -+ smp_mb__after_atomic(); - - if (!urb->dev || !urb->ep) - return; -diff --git a/drivers/usb/gadget/function/f_sourcesink.c b/drivers/usb/gadget/function/f_sourcesink.c -index 282737e4609ce..2c65a9bb3c81b 100644 ---- a/drivers/usb/gadget/function/f_sourcesink.c -+++ b/drivers/usb/gadget/function/f_sourcesink.c -@@ -583,6 +583,7 @@ static int source_sink_start_ep(struct f_sourcesink *ss, bool is_in, - - if (is_iso) { - switch (speed) { -+ case USB_SPEED_SUPER_PLUS: - case USB_SPEED_SUPER: - size = ss->isoc_maxpacket * - (ss->isoc_mult + 1) * -diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h -index 3ba4e060fd051..66e7f5d123c46 100644 ---- a/drivers/usb/storage/unusual_devs.h -+++ b/drivers/usb/storage/unusual_devs.h -@@ -2301,6 +2301,16 @@ UNUSUAL_DEV( 0x2027, 0xa001, 0x0000, 0x9999, - USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_euscsi_init, - US_FL_SCM_MULT_TARG ), - -+/* -+ * Reported by DocMAX -+ * and Thomas Weißschuh -+ */ -+UNUSUAL_DEV( 0x2109, 0x0715, 0x9999, 0x9999, -+ "VIA Labs, Inc.", -+ "VL817 SATA Bridge", -+ USB_SC_DEVICE, USB_PR_DEVICE, NULL, -+ US_FL_IGNORE_UAS), -+ - UNUSUAL_DEV( 0x2116, 0x0320, 0x0001, 0x0001, - "ST", - "2A", -diff --git a/drivers/usb/typec/tcpm/tcpm.c b/drivers/usb/typec/tcpm/tcpm.c -index 1316464cf2933..fb18264b702e6 100644 ---- a/drivers/usb/typec/tcpm/tcpm.c -+++ b/drivers/usb/typec/tcpm/tcpm.c -@@ -3903,7 +3903,8 @@ static void _tcpm_pd_vbus_off(struct tcpm_port *port) - case SNK_TRYWAIT_DEBOUNCE: - break; - case SNK_ATTACH_WAIT: -- tcpm_set_state(port, SNK_UNATTACHED, 0); -+ case SNK_DEBOUNCED: -+ /* Do nothing, as TCPM is still waiting for vbus to reaach VSAFE5V to connect */ - break; - - case SNK_NEGOTIATE_CAPABILITIES: -diff --git a/drivers/usb/typec/ucsi/ucsi_ccg.c b/drivers/usb/typec/ucsi/ucsi_ccg.c -index d772fce519057..0a38f98f78650 100644 ---- a/drivers/usb/typec/ucsi/ucsi_ccg.c -+++ b/drivers/usb/typec/ucsi/ucsi_ccg.c -@@ -304,7 +304,7 @@ static int ucsi_ccg_init(struct ucsi_ccg *uc) - if (status < 0) - return status; - -- if (!data) -+ if (!(data & DEV_INT)) - return 0; - - status = ccg_write(uc, CCGX_RAB_INTR_REG, &data, sizeof(data)); -diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c -index e9d3eb7f0e2b8..675112aa998f2 100644 ---- a/fs/btrfs/ioctl.c -+++ b/fs/btrfs/ioctl.c -@@ -3027,10 +3027,8 @@ static noinline int btrfs_ioctl_snap_destroy(struct file *file, - inode_lock(inode); - err = btrfs_delete_subvolume(dir, dentry); - inode_unlock(inode); -- if (!err) { -- fsnotify_rmdir(dir, dentry); -- d_delete(dentry); -- } -+ if (!err) -+ d_delete_notify(dir, dentry); - - out_dput: - dput(dentry); -diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c -index cb733652ecca6..2992cebb78661 100644 ---- a/fs/configfs/dir.c -+++ b/fs/configfs/dir.c -@@ -1805,8 +1805,8 @@ void configfs_unregister_group(struct config_group *group) - configfs_detach_group(&group->cg_item); - d_inode(dentry)->i_flags |= S_DEAD; - dont_mount(dentry); -+ d_drop(dentry); - fsnotify_rmdir(d_inode(parent), dentry); -- d_delete(dentry); - inode_unlock(d_inode(parent)); - - dput(dentry); -@@ -1947,10 +1947,10 @@ void configfs_unregister_subsystem(struct configfs_subsystem *subsys) - configfs_detach_group(&group->cg_item); - d_inode(dentry)->i_flags |= S_DEAD; - dont_mount(dentry); -- fsnotify_rmdir(d_inode(root), dentry); - inode_unlock(d_inode(dentry)); - -- d_delete(dentry); -+ d_drop(dentry); -+ fsnotify_rmdir(d_inode(root), dentry); - - inode_unlock(d_inode(root)); - -diff --git a/fs/devpts/inode.c b/fs/devpts/inode.c -index 42e5a766d33c7..4f25015aa5342 100644 ---- a/fs/devpts/inode.c -+++ b/fs/devpts/inode.c -@@ -621,8 +621,8 @@ void devpts_pty_kill(struct dentry *dentry) - - dentry->d_fsdata = NULL; - drop_nlink(dentry->d_inode); -- fsnotify_unlink(d_inode(dentry->d_parent), dentry); - d_drop(dentry); -+ fsnotify_unlink(d_inode(dentry->d_parent), dentry); - dput(dentry); /* d_alloc_name() in devpts_pty_new() */ - } - -diff --git a/fs/namei.c b/fs/namei.c -index 5b5759d708220..b952ecbd49c29 100644 ---- a/fs/namei.c -+++ b/fs/namei.c -@@ -3878,13 +3878,12 @@ int vfs_rmdir(struct inode *dir, struct dentry *dentry) - dentry->d_inode->i_flags |= S_DEAD; - dont_mount(dentry); - detach_mounts(dentry); -- fsnotify_rmdir(dir, dentry); - - out: - inode_unlock(dentry->d_inode); - dput(dentry); - if (!error) -- d_delete(dentry); -+ d_delete_notify(dir, dentry); - return error; - } - EXPORT_SYMBOL(vfs_rmdir); -@@ -3995,7 +3994,6 @@ int vfs_unlink(struct inode *dir, struct dentry *dentry, struct inode **delegate - if (!error) { - dont_mount(dentry); - detach_mounts(dentry); -- fsnotify_unlink(dir, dentry); - } - } - } -@@ -4003,9 +4001,11 @@ out: - inode_unlock(target); - - /* We don't d_delete() NFS sillyrenamed files--they still exist. */ -- if (!error && !(dentry->d_flags & DCACHE_NFSFS_RENAMED)) { -+ if (!error && dentry->d_flags & DCACHE_NFSFS_RENAMED) { -+ fsnotify_unlink(dir, dentry); -+ } else if (!error) { - fsnotify_link_count(target); -- d_delete(dentry); -+ d_delete_notify(dir, dentry); - } - - return error; -diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c -index e7c0790308fe0..f1c99fe486c4d 100644 ---- a/fs/nfs/dir.c -+++ b/fs/nfs/dir.c -@@ -1638,6 +1638,24 @@ out: - - no_open: - res = nfs_lookup(dir, dentry, lookup_flags); -+ if (!res) { -+ inode = d_inode(dentry); -+ if ((lookup_flags & LOOKUP_DIRECTORY) && inode && -+ !S_ISDIR(inode->i_mode)) -+ res = ERR_PTR(-ENOTDIR); -+ else if (inode && S_ISREG(inode->i_mode)) -+ res = ERR_PTR(-EOPENSTALE); -+ } else if (!IS_ERR(res)) { -+ inode = d_inode(res); -+ if ((lookup_flags & LOOKUP_DIRECTORY) && inode && -+ !S_ISDIR(inode->i_mode)) { -+ dput(res); -+ res = ERR_PTR(-ENOTDIR); -+ } else if (inode && S_ISREG(inode->i_mode)) { -+ dput(res); -+ res = ERR_PTR(-EOPENSTALE); -+ } -+ } - if (switched) { - d_lookup_done(dentry); - if (!res) -@@ -2035,6 +2053,8 @@ nfs_link(struct dentry *old_dentry, struct inode *dir, struct dentry *dentry) - - trace_nfs_link_enter(inode, dir, dentry); - d_drop(dentry); -+ if (S_ISREG(inode->i_mode)) -+ nfs_sync_inode(inode); - error = NFS_PROTO(dir)->link(inode, dir, &dentry->d_name); - if (error == 0) { - ihold(inode); -@@ -2123,6 +2143,8 @@ int nfs_rename(struct inode *old_dir, struct dentry *old_dentry, - } - } - -+ if (S_ISREG(old_inode->i_mode)) -+ nfs_sync_inode(old_inode); - task = nfs_async_rename(old_dir, new_dir, old_dentry, new_dentry, NULL); - if (IS_ERR(task)) { - error = PTR_ERR(task); -diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c -index f6328ae9b2da4..055cc0458f270 100644 ---- a/fs/nfsd/nfsctl.c -+++ b/fs/nfsd/nfsctl.c -@@ -1247,7 +1247,8 @@ static void nfsdfs_remove_file(struct inode *dir, struct dentry *dentry) - clear_ncl(d_inode(dentry)); - dget(dentry); - ret = simple_unlink(dir, dentry); -- d_delete(dentry); -+ d_drop(dentry); -+ fsnotify_unlink(dir, dentry); - dput(dentry); - WARN_ON_ONCE(ret); - } -@@ -1336,8 +1337,8 @@ void nfsd_client_rmdir(struct dentry *dentry) - dget(dentry); - ret = simple_rmdir(dir, dentry); - WARN_ON_ONCE(ret); -+ d_drop(dentry); - fsnotify_rmdir(dir, dentry); -- d_delete(dentry); - dput(dentry); - inode_unlock(dir); - } -diff --git a/fs/udf/inode.c b/fs/udf/inode.c -index 507f8f9103270..639aabf30eaf0 100644 ---- a/fs/udf/inode.c -+++ b/fs/udf/inode.c -@@ -258,10 +258,6 @@ int udf_expand_file_adinicb(struct inode *inode) - char *kaddr; - struct udf_inode_info *iinfo = UDF_I(inode); - int err; -- struct writeback_control udf_wbc = { -- .sync_mode = WB_SYNC_NONE, -- .nr_to_write = 1, -- }; - - WARN_ON_ONCE(!inode_is_locked(inode)); - if (!iinfo->i_lenAlloc) { -@@ -305,8 +301,10 @@ int udf_expand_file_adinicb(struct inode *inode) - iinfo->i_alloc_type = ICBTAG_FLAG_AD_LONG; - /* from now on we have normal address_space methods */ - inode->i_data.a_ops = &udf_aops; -+ set_page_dirty(page); -+ unlock_page(page); - up_write(&iinfo->i_data_sem); -- err = inode->i_data.a_ops->writepage(page, &udf_wbc); -+ err = filemap_fdatawrite(inode->i_mapping); - if (err) { - /* Restore everything back so that we don't lose data... */ - lock_page(page); -@@ -318,6 +316,7 @@ int udf_expand_file_adinicb(struct inode *inode) - unlock_page(page); - iinfo->i_alloc_type = ICBTAG_FLAG_AD_IN_ICB; - inode->i_data.a_ops = &udf_adinicb_aops; -+ iinfo->i_lenAlloc = inode->i_size; - up_write(&iinfo->i_data_sem); - } - put_page(page); -diff --git a/include/linux/fsnotify.h b/include/linux/fsnotify.h -index a2d5d175d3c15..e9d2024473b0f 100644 ---- a/include/linux/fsnotify.h -+++ b/include/linux/fsnotify.h -@@ -188,6 +188,42 @@ static inline void fsnotify_link(struct inode *dir, struct inode *inode, struct - fsnotify(dir, FS_CREATE, inode, FSNOTIFY_EVENT_INODE, &new_dentry->d_name, 0); - } - -+/* -+ * fsnotify_delete - @dentry was unlinked and unhashed -+ * -+ * Caller must make sure that dentry->d_name is stable. -+ * -+ * Note: unlike fsnotify_unlink(), we have to pass also the unlinked inode -+ * as this may be called after d_delete() and old_dentry may be negative. -+ */ -+static inline void fsnotify_delete(struct inode *dir, struct inode *inode, -+ struct dentry *dentry) -+{ -+ __u32 mask = FS_DELETE; -+ -+ if (S_ISDIR(inode->i_mode)) -+ mask |= FS_ISDIR; -+ -+ fsnotify(dir, mask, inode, FSNOTIFY_EVENT_INODE, &dentry->d_name, 0); -+} -+ -+/** -+ * d_delete_notify - delete a dentry and call fsnotify_delete() -+ * @dentry: The dentry to delete -+ * -+ * This helper is used to guaranty that the unlinked inode cannot be found -+ * by lookup of this name after fsnotify_delete() event has been delivered. -+ */ -+static inline void d_delete_notify(struct inode *dir, struct dentry *dentry) -+{ -+ struct inode *inode = d_inode(dentry); -+ -+ ihold(inode); -+ d_delete(dentry); -+ fsnotify_delete(dir, inode, dentry); -+ iput(inode); -+} -+ - /* - * fsnotify_unlink - 'name' was unlinked - * -@@ -195,10 +231,10 @@ static inline void fsnotify_link(struct inode *dir, struct inode *inode, struct - */ - static inline void fsnotify_unlink(struct inode *dir, struct dentry *dentry) - { -- /* Expected to be called before d_delete() */ -- WARN_ON_ONCE(d_is_negative(dentry)); -+ if (WARN_ON_ONCE(d_is_negative(dentry))) -+ return; - -- fsnotify_dirent(dir, dentry, FS_DELETE); -+ fsnotify_delete(dir, d_inode(dentry), dentry); - } - - /* -@@ -218,10 +254,10 @@ static inline void fsnotify_mkdir(struct inode *inode, struct dentry *dentry) - */ - static inline void fsnotify_rmdir(struct inode *dir, struct dentry *dentry) - { -- /* Expected to be called before d_delete() */ -- WARN_ON_ONCE(d_is_negative(dentry)); -+ if (WARN_ON_ONCE(d_is_negative(dentry))) -+ return; - -- fsnotify_dirent(dir, dentry, FS_DELETE | FS_ISDIR); -+ fsnotify_delete(dir, d_inode(dentry), dentry); - } - - /* -diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h -index 4860944e936db..288a586782563 100644 ---- a/include/linux/netdevice.h -+++ b/include/linux/netdevice.h -@@ -2397,6 +2397,7 @@ struct packet_type { - struct net_device *); - bool (*id_match)(struct packet_type *ptype, - struct sock *sk); -+ struct net *af_packet_net; - void *af_packet_priv; - struct list_head list; - }; -diff --git a/include/net/ip.h b/include/net/ip.h -index 52abfc00b5e3d..3f3ea86b2173c 100644 ---- a/include/net/ip.h -+++ b/include/net/ip.h -@@ -509,19 +509,18 @@ static inline void ip_select_ident_segs(struct net *net, struct sk_buff *skb, - { - struct iphdr *iph = ip_hdr(skb); - -+ /* We had many attacks based on IPID, use the private -+ * generator as much as we can. -+ */ -+ if (sk && inet_sk(sk)->inet_daddr) { -+ iph->id = htons(inet_sk(sk)->inet_id); -+ inet_sk(sk)->inet_id += segs; -+ return; -+ } - if ((iph->frag_off & htons(IP_DF)) && !skb->ignore_df) { -- /* This is only to work around buggy Windows95/2000 -- * VJ compression implementations. If the ID field -- * does not change, they drop every other packet in -- * a TCP stream using header compression. -- */ -- if (sk && inet_sk(sk)->inet_daddr) { -- iph->id = htons(inet_sk(sk)->inet_id); -- inet_sk(sk)->inet_id += segs; -- } else { -- iph->id = 0; -- } -+ iph->id = 0; - } else { -+ /* Unfortunately we need the big hammer to get a suitable IPID */ - __ip_select_ident(net, iph, segs); - } - } -diff --git a/include/net/ip6_fib.h b/include/net/ip6_fib.h -index 05ecaefeb6322..780754b9cbcd4 100644 ---- a/include/net/ip6_fib.h -+++ b/include/net/ip6_fib.h -@@ -247,7 +247,7 @@ static inline bool fib6_get_cookie_safe(const struct fib6_info *f6i, - fn = rcu_dereference(f6i->fib6_node); - - if (fn) { -- *cookie = fn->fn_sernum; -+ *cookie = READ_ONCE(fn->fn_sernum); - /* pairs with smp_wmb() in fib6_update_sernum_upto_root() */ - smp_rmb(); - status = true; -diff --git a/include/net/route.h b/include/net/route.h -index 6c516840380db..b85d1912d84fd 100644 ---- a/include/net/route.h -+++ b/include/net/route.h -@@ -359,7 +359,7 @@ static inline struct neighbour *ip_neigh_gw4(struct net_device *dev, - { - struct neighbour *neigh; - -- neigh = __ipv4_neigh_lookup_noref(dev, daddr); -+ neigh = __ipv4_neigh_lookup_noref(dev, (__force u32)daddr); - if (unlikely(!neigh)) - neigh = __neigh_create(&arp_tbl, &daddr, dev, false); - -diff --git a/kernel/power/wakelock.c b/kernel/power/wakelock.c -index 105df4dfc7839..52571dcad768b 100644 ---- a/kernel/power/wakelock.c -+++ b/kernel/power/wakelock.c -@@ -39,23 +39,20 @@ ssize_t pm_show_wakelocks(char *buf, bool show_active) - { - struct rb_node *node; - struct wakelock *wl; -- char *str = buf; -- char *end = buf + PAGE_SIZE; -+ int len = 0; - - mutex_lock(&wakelocks_lock); - - for (node = rb_first(&wakelocks_tree); node; node = rb_next(node)) { - wl = rb_entry(node, struct wakelock, node); - if (wl->ws->active == show_active) -- str += scnprintf(str, end - str, "%s ", wl->name); -+ len += sysfs_emit_at(buf, len, "%s ", wl->name); - } -- if (str > buf) -- str--; - -- str += scnprintf(str, end - str, "\n"); -+ len += sysfs_emit_at(buf, len, "\n"); - - mutex_unlock(&wakelocks_lock); -- return (str - buf); -+ return len; - } - - #if CONFIG_PM_WAKELOCKS_LIMIT > 0 -diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c -index 54f5b2f080f53..5a4dfb55ba16b 100644 ---- a/kernel/trace/trace.c -+++ b/kernel/trace/trace.c -@@ -6994,7 +6994,8 @@ static struct tracing_log_err *get_tracing_log_err(struct trace_array *tr) - err = kzalloc(sizeof(*err), GFP_KERNEL); - if (!err) - err = ERR_PTR(-ENOMEM); -- tr->n_err_log_entries++; -+ else -+ tr->n_err_log_entries++; - - return err; - } -diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c -index 8b33a3c872750..3cef24c6391a5 100644 ---- a/kernel/trace/trace_events_hist.c -+++ b/kernel/trace/trace_events_hist.c -@@ -4398,6 +4398,7 @@ static int trace_action_create(struct hist_trigger_data *hist_data, - - var_ref_idx = find_var_ref_idx(hist_data, var_ref); - if (WARN_ON(var_ref_idx < 0)) { -+ kfree(p); - ret = var_ref_idx; - goto err; - } -diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c -index 40f1593651e84..082a262ab49c3 100644 ---- a/net/bluetooth/hci_event.c -+++ b/net/bluetooth/hci_event.c -@@ -5506,6 +5506,11 @@ static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb) - struct hci_ev_le_advertising_info *ev = ptr; - s8 rssi; - -+ if (ptr > (void *)skb_tail_pointer(skb) - sizeof(*ev)) { -+ bt_dev_err(hdev, "Malicious advertising data."); -+ break; -+ } -+ - if (ev->length <= HCI_MAX_AD_LENGTH && - ev->data + ev->length <= skb_tail_pointer(skb)) { - rssi = ev->data[ev->length]; -@@ -5517,11 +5522,6 @@ static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb) - } - - ptr += sizeof(*ev) + ev->length + 1; -- -- if (ptr > (void *) skb_tail_pointer(skb) - sizeof(*ev)) { -- bt_dev_err(hdev, "Malicious advertising data. Stopping processing"); -- break; -- } - } - - hci_dev_unlock(hdev); -diff --git a/net/core/net-procfs.c b/net/core/net-procfs.c -index 36347933ec3af..61f5570645e38 100644 ---- a/net/core/net-procfs.c -+++ b/net/core/net-procfs.c -@@ -182,12 +182,23 @@ static const struct seq_operations softnet_seq_ops = { - .show = softnet_seq_show, - }; - --static void *ptype_get_idx(loff_t pos) -+static void *ptype_get_idx(struct seq_file *seq, loff_t pos) - { -+ struct list_head *ptype_list = NULL; - struct packet_type *pt = NULL; -+ struct net_device *dev; - loff_t i = 0; - int t; - -+ for_each_netdev_rcu(seq_file_net(seq), dev) { -+ ptype_list = &dev->ptype_all; -+ list_for_each_entry_rcu(pt, ptype_list, list) { -+ if (i == pos) -+ return pt; -+ ++i; -+ } -+ } -+ - list_for_each_entry_rcu(pt, &ptype_all, list) { - if (i == pos) - return pt; -@@ -208,22 +219,40 @@ static void *ptype_seq_start(struct seq_file *seq, loff_t *pos) - __acquires(RCU) - { - rcu_read_lock(); -- return *pos ? ptype_get_idx(*pos - 1) : SEQ_START_TOKEN; -+ return *pos ? ptype_get_idx(seq, *pos - 1) : SEQ_START_TOKEN; - } - - static void *ptype_seq_next(struct seq_file *seq, void *v, loff_t *pos) - { -+ struct net_device *dev; - struct packet_type *pt; - struct list_head *nxt; - int hash; - - ++*pos; - if (v == SEQ_START_TOKEN) -- return ptype_get_idx(0); -+ return ptype_get_idx(seq, 0); - - pt = v; - nxt = pt->list.next; -+ if (pt->dev) { -+ if (nxt != &pt->dev->ptype_all) -+ goto found; -+ -+ dev = pt->dev; -+ for_each_netdev_continue_rcu(seq_file_net(seq), dev) { -+ if (!list_empty(&dev->ptype_all)) { -+ nxt = dev->ptype_all.next; -+ goto found; -+ } -+ } -+ -+ nxt = ptype_all.next; -+ goto ptype_all; -+ } -+ - if (pt->type == htons(ETH_P_ALL)) { -+ptype_all: - if (nxt != &ptype_all) - goto found; - hash = 0; -@@ -252,7 +281,8 @@ static int ptype_seq_show(struct seq_file *seq, void *v) - - if (v == SEQ_START_TOKEN) - seq_puts(seq, "Type Device Function\n"); -- else if (pt->dev == NULL || dev_net(pt->dev) == seq_file_net(seq)) { -+ else if ((!pt->af_packet_net || net_eq(pt->af_packet_net, seq_file_net(seq))) && -+ (!pt->dev || net_eq(dev_net(pt->dev), seq_file_net(seq)))) { - if (pt->type == htons(ETH_P_ALL)) - seq_puts(seq, "ALL "); - else -diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c -index 0ec529d77a56e..418e939878004 100644 ---- a/net/ipv4/ip_output.c -+++ b/net/ipv4/ip_output.c -@@ -161,12 +161,19 @@ int ip_build_and_send_pkt(struct sk_buff *skb, const struct sock *sk, - iph->daddr = (opt && opt->opt.srr ? opt->opt.faddr : daddr); - iph->saddr = saddr; - iph->protocol = sk->sk_protocol; -- if (ip_dont_fragment(sk, &rt->dst)) { -+ /* Do not bother generating IPID for small packets (eg SYNACK) */ -+ if (skb->len <= IPV4_MIN_MTU || ip_dont_fragment(sk, &rt->dst)) { - iph->frag_off = htons(IP_DF); - iph->id = 0; - } else { - iph->frag_off = 0; -- __ip_select_ident(net, iph, 1); -+ /* TCP packets here are SYNACK with fat IPv4/TCP options. -+ * Avoid using the hashed IP ident generator. -+ */ -+ if (sk->sk_protocol == IPPROTO_TCP) -+ iph->id = (__force __be16)prandom_u32(); -+ else -+ __ip_select_ident(net, iph, 1); - } - - if (opt && opt->opt.optlen) { -diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c -index 1c3d5d3702a10..b0f51c7cc0d90 100644 ---- a/net/ipv4/ping.c -+++ b/net/ipv4/ping.c -@@ -220,7 +220,8 @@ static struct sock *ping_lookup(struct net *net, struct sk_buff *skb, u16 ident) - continue; - } - -- if (sk->sk_bound_dev_if && sk->sk_bound_dev_if != dif) -+ if (sk->sk_bound_dev_if && sk->sk_bound_dev_if != dif && -+ sk->sk_bound_dev_if != inet_sdif(skb)) - continue; - - sock_hold(sk); -diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c -index 3183413ebc6c2..ddc24e57dc555 100644 ---- a/net/ipv4/raw.c -+++ b/net/ipv4/raw.c -@@ -720,6 +720,7 @@ static int raw_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len) - int ret = -EINVAL; - int chk_addr_ret; - -+ lock_sock(sk); - if (sk->sk_state != TCP_CLOSE || addr_len < sizeof(struct sockaddr_in)) - goto out; - -@@ -739,7 +740,9 @@ static int raw_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len) - inet->inet_saddr = 0; /* Use device */ - sk_dst_reset(sk); - ret = 0; --out: return ret; -+out: -+ release_sock(sk); -+ return ret; - } - - /* -diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c -index 9a6f66e0e9a27..ef55489651f87 100644 ---- a/net/ipv6/ip6_fib.c -+++ b/net/ipv6/ip6_fib.c -@@ -110,7 +110,7 @@ void fib6_update_sernum(struct net *net, struct fib6_info *f6i) - fn = rcu_dereference_protected(f6i->fib6_node, - lockdep_is_held(&f6i->fib6_table->tb6_lock)); - if (fn) -- fn->fn_sernum = fib6_new_sernum(net); -+ WRITE_ONCE(fn->fn_sernum, fib6_new_sernum(net)); - } - - /* -@@ -535,12 +535,13 @@ static int fib6_dump_table(struct fib6_table *table, struct sk_buff *skb, - spin_unlock_bh(&table->tb6_lock); - if (res > 0) { - cb->args[4] = 1; -- cb->args[5] = w->root->fn_sernum; -+ cb->args[5] = READ_ONCE(w->root->fn_sernum); - } - } else { -- if (cb->args[5] != w->root->fn_sernum) { -+ int sernum = READ_ONCE(w->root->fn_sernum); -+ if (cb->args[5] != sernum) { - /* Begin at the root if the tree changed */ -- cb->args[5] = w->root->fn_sernum; -+ cb->args[5] = sernum; - w->state = FWS_INIT; - w->node = w->root; - w->skip = w->count; -@@ -1276,7 +1277,7 @@ static void __fib6_update_sernum_upto_root(struct fib6_info *rt, - /* paired with smp_rmb() in rt6_get_cookie_safe() */ - smp_wmb(); - while (fn) { -- fn->fn_sernum = sernum; -+ WRITE_ONCE(fn->fn_sernum, sernum); - fn = rcu_dereference_protected(fn->parent, - lockdep_is_held(&rt->fib6_table->tb6_lock)); - } -@@ -2068,8 +2069,8 @@ static int fib6_clean_node(struct fib6_walker *w) - }; - - if (c->sernum != FIB6_NO_SERNUM_CHANGE && -- w->node->fn_sernum != c->sernum) -- w->node->fn_sernum = c->sernum; -+ READ_ONCE(w->node->fn_sernum) != c->sernum) -+ WRITE_ONCE(w->node->fn_sernum, c->sernum); - - if (!c->func) { - WARN_ON_ONCE(c->sernum == FIB6_NO_SERNUM_CHANGE); -@@ -2433,7 +2434,7 @@ static void ipv6_route_seq_setup_walk(struct ipv6_route_iter *iter, - iter->w.state = FWS_INIT; - iter->w.node = iter->w.root; - iter->w.args = iter; -- iter->sernum = iter->w.root->fn_sernum; -+ iter->sernum = READ_ONCE(iter->w.root->fn_sernum); - INIT_LIST_HEAD(&iter->w.lh); - fib6_walker_link(net, &iter->w); - } -@@ -2461,8 +2462,10 @@ static struct fib6_table *ipv6_route_seq_next_table(struct fib6_table *tbl, - - static void ipv6_route_check_sernum(struct ipv6_route_iter *iter) - { -- if (iter->sernum != iter->w.root->fn_sernum) { -- iter->sernum = iter->w.root->fn_sernum; -+ int sernum = READ_ONCE(iter->w.root->fn_sernum); -+ -+ if (iter->sernum != sernum) { -+ iter->sernum = sernum; - iter->w.state = FWS_INIT; - iter->w.node = iter->w.root; - WARN_ON(iter->w.skip); -diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c -index fd0d1cee2d3f5..878a08c40fffd 100644 ---- a/net/ipv6/ip6_tunnel.c -+++ b/net/ipv6/ip6_tunnel.c -@@ -1000,14 +1000,14 @@ int ip6_tnl_xmit_ctl(struct ip6_tnl *t, - - if (unlikely(!ipv6_chk_addr_and_flags(net, laddr, ldev, false, - 0, IFA_F_TENTATIVE))) -- pr_warn("%s xmit: Local address not yet configured!\n", -- p->name); -+ pr_warn_ratelimited("%s xmit: Local address not yet configured!\n", -+ p->name); - else if (!(p->flags & IP6_TNL_F_ALLOW_LOCAL_REMOTE) && - !ipv6_addr_is_multicast(raddr) && - unlikely(ipv6_chk_addr_and_flags(net, raddr, ldev, - true, 0, IFA_F_TENTATIVE))) -- pr_warn("%s xmit: Routing loop! Remote address found on this node!\n", -- p->name); -+ pr_warn_ratelimited("%s xmit: Routing loop! Remote address found on this node!\n", -+ p->name); - else - ret = 1; - rcu_read_unlock(); -diff --git a/net/ipv6/route.c b/net/ipv6/route.c -index 5ef6e27e026e9..2a13394ab8541 100644 ---- a/net/ipv6/route.c -+++ b/net/ipv6/route.c -@@ -2697,7 +2697,7 @@ static void ip6_link_failure(struct sk_buff *skb) - if (from) { - fn = rcu_dereference(from->fib6_node); - if (fn && (rt->rt6i_flags & RTF_DEFAULT)) -- fn->fn_sernum = -1; -+ WRITE_ONCE(fn->fn_sernum, -1); - } - } - rcu_read_unlock(); -diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c -index 4bcc36e4b2ef0..d9b6f2001d006 100644 ---- a/net/netfilter/nf_conntrack_core.c -+++ b/net/netfilter/nf_conntrack_core.c -@@ -1709,15 +1709,17 @@ repeat: - pr_debug("nf_conntrack_in: Can't track with proto module\n"); - nf_conntrack_put(&ct->ct_general); - skb->_nfct = 0; -- NF_CT_STAT_INC_ATOMIC(state->net, invalid); -- if (ret == -NF_DROP) -- NF_CT_STAT_INC_ATOMIC(state->net, drop); - /* Special case: TCP tracker reports an attempt to reopen a - * closed/aborted connection. We have to go back and create a - * fresh conntrack. - */ - if (ret == -NF_REPEAT) - goto repeat; -+ -+ NF_CT_STAT_INC_ATOMIC(state->net, invalid); -+ if (ret == -NF_DROP) -+ NF_CT_STAT_INC_ATOMIC(state->net, drop); -+ - ret = -ret; - goto out; - } -diff --git a/net/netfilter/nft_payload.c b/net/netfilter/nft_payload.c -index 921f8f45b17f4..cf0512fc648e7 100644 ---- a/net/netfilter/nft_payload.c -+++ b/net/netfilter/nft_payload.c -@@ -420,6 +420,9 @@ static int nft_payload_l4csum_offset(const struct nft_pktinfo *pkt, - struct sk_buff *skb, - unsigned int *l4csum_offset) - { -+ if (pkt->xt.fragoff) -+ return -1; -+ - switch (pkt->tprot) { - case IPPROTO_TCP: - *l4csum_offset = offsetof(struct tcphdr, check); -diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c -index 6062bd5bf132b..839e1caa57a59 100644 ---- a/net/packet/af_packet.c -+++ b/net/packet/af_packet.c -@@ -1715,6 +1715,7 @@ static int fanout_add(struct sock *sk, u16 id, u16 type_flags) - match->prot_hook.dev = po->prot_hook.dev; - match->prot_hook.func = packet_rcv_fanout; - match->prot_hook.af_packet_priv = match; -+ match->prot_hook.af_packet_net = read_pnet(&match->net); - match->prot_hook.id_match = match_fanout_group; - list_add(&match->list, &fanout_list); - } -@@ -3294,6 +3295,7 @@ static int packet_create(struct net *net, struct socket *sock, int protocol, - po->prot_hook.func = packet_rcv_spkt; - - po->prot_hook.af_packet_priv = sk; -+ po->prot_hook.af_packet_net = sock_net(sk); - - if (proto) { - po->prot_hook.type = proto; -diff --git a/net/rxrpc/call_event.c b/net/rxrpc/call_event.c -index 9ff85ee8337cd..80e15310f1b29 100644 ---- a/net/rxrpc/call_event.c -+++ b/net/rxrpc/call_event.c -@@ -157,7 +157,7 @@ static void rxrpc_congestion_timeout(struct rxrpc_call *call) - static void rxrpc_resend(struct rxrpc_call *call, unsigned long now_j) - { - struct sk_buff *skb; -- unsigned long resend_at, rto_j; -+ unsigned long resend_at; - rxrpc_seq_t cursor, seq, top; - ktime_t now, max_age, oldest, ack_ts; - int ix; -@@ -165,10 +165,8 @@ static void rxrpc_resend(struct rxrpc_call *call, unsigned long now_j) - - _enter("{%d,%d}", call->tx_hard_ack, call->tx_top); - -- rto_j = call->peer->rto_j; -- - now = ktime_get_real(); -- max_age = ktime_sub(now, jiffies_to_usecs(rto_j)); -+ max_age = ktime_sub(now, jiffies_to_usecs(call->peer->rto_j)); - - spin_lock_bh(&call->lock); - -@@ -213,7 +211,7 @@ static void rxrpc_resend(struct rxrpc_call *call, unsigned long now_j) - } - - resend_at = nsecs_to_jiffies(ktime_to_ns(ktime_sub(now, oldest))); -- resend_at += jiffies + rto_j; -+ resend_at += jiffies + rxrpc_get_rto_backoff(call->peer, retrans); - WRITE_ONCE(call->resend_at, resend_at); - - if (unacked) -diff --git a/net/rxrpc/output.c b/net/rxrpc/output.c -index f8b632a5c6197..a4a6f8ee07201 100644 ---- a/net/rxrpc/output.c -+++ b/net/rxrpc/output.c -@@ -426,7 +426,7 @@ done: - if (call->peer->rtt_count > 1) { - unsigned long nowj = jiffies, ack_lost_at; - -- ack_lost_at = rxrpc_get_rto_backoff(call->peer, retrans); -+ ack_lost_at = rxrpc_get_rto_backoff(call->peer, false); - ack_lost_at += nowj; - WRITE_ONCE(call->ack_lost_at, ack_lost_at); - rxrpc_reduce_call_timer(call, ack_lost_at, nowj, -diff --git a/net/sunrpc/rpc_pipe.c b/net/sunrpc/rpc_pipe.c -index 37792675ed571..3b825942e2f67 100644 ---- a/net/sunrpc/rpc_pipe.c -+++ b/net/sunrpc/rpc_pipe.c -@@ -599,9 +599,9 @@ static int __rpc_rmdir(struct inode *dir, struct dentry *dentry) - - dget(dentry); - ret = simple_rmdir(dir, dentry); -+ d_drop(dentry); - if (!ret) - fsnotify_rmdir(dir, dentry); -- d_delete(dentry); - dput(dentry); - return ret; - } -@@ -612,9 +612,9 @@ static int __rpc_unlink(struct inode *dir, struct dentry *dentry) - - dget(dentry); - ret = simple_unlink(dir, dentry); -+ d_drop(dentry); - if (!ret) - fsnotify_unlink(dir, dentry); -- d_delete(dentry); - dput(dentry); - return ret; - } diff --git a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.176-177.patch b/patch/kernel/archive/odroidxu4-5.4/patch-5.4.176-177.patch deleted file mode 100644 index 6bd43941f..000000000 --- a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.176-177.patch +++ /dev/null @@ -1,468 +0,0 @@ -diff --git a/Documentation/accounting/psi.rst b/Documentation/accounting/psi.rst -index 621111ce57401..28c0461ba2e1b 100644 ---- a/Documentation/accounting/psi.rst -+++ b/Documentation/accounting/psi.rst -@@ -90,7 +90,8 @@ Triggers can be set on more than one psi metric and more than one trigger - for the same psi metric can be specified. However for each trigger a separate - file descriptor is required to be able to poll it separately from others, - therefore for each trigger a separate open() syscall should be made even --when opening the same psi interface file. -+when opening the same psi interface file. Write operations to a file descriptor -+with an already existing psi trigger will fail with EBUSY. - - Monitors activate only when system enters stall state for the monitored - psi metric and deactivates upon exit from the stall state. While system is -diff --git a/Makefile b/Makefile -index b23aa51ada93e..324939b64d7b7 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 5 - PATCHLEVEL = 4 --SUBLEVEL = 176 -+SUBLEVEL = 177 - EXTRAVERSION = - NAME = Kleptomaniac Octopus - -diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c -index da8c2c4aca7ef..0442d7e1cd20b 100644 ---- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c -+++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c -@@ -721,7 +721,9 @@ static void xgbe_stop_timers(struct xgbe_prv_data *pdata) - if (!channel->tx_ring) - break; - -+ /* Deactivate the Tx timer */ - del_timer_sync(&channel->tx_timer); -+ channel->tx_timer_active = 0; - } - } - -@@ -2765,6 +2767,14 @@ read_again: - buf2_len = xgbe_rx_buf2_len(rdata, packet, len); - len += buf2_len; - -+ if (buf2_len > rdata->rx.buf.dma_len) { -+ /* Hardware inconsistency within the descriptors -+ * that has resulted in a length underflow. -+ */ -+ error = 1; -+ goto skip_data; -+ } -+ - if (!skb) { - skb = xgbe_create_skb(pdata, napi, rdata, - buf1_len); -@@ -2794,8 +2804,10 @@ skip_data: - if (!last || context_next) - goto read_again; - -- if (!skb) -+ if (!skb || error) { -+ dev_kfree_skb(skb); - goto next_packet; -+ } - - /* Be sure we don't exceed the configured MTU */ - max_len = netdev->mtu + ETH_HLEN; -diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c -index 345576f1a7470..73ad78f47763c 100644 ---- a/drivers/net/usb/ipheth.c -+++ b/drivers/net/usb/ipheth.c -@@ -121,7 +121,7 @@ static int ipheth_alloc_urbs(struct ipheth_device *iphone) - if (tx_buf == NULL) - goto free_rx_urb; - -- rx_buf = usb_alloc_coherent(iphone->udev, IPHETH_BUF_SIZE, -+ rx_buf = usb_alloc_coherent(iphone->udev, IPHETH_BUF_SIZE + IPHETH_IP_ALIGN, - GFP_KERNEL, &rx_urb->transfer_dma); - if (rx_buf == NULL) - goto free_tx_buf; -@@ -146,7 +146,7 @@ error_nomem: - - static void ipheth_free_urbs(struct ipheth_device *iphone) - { -- usb_free_coherent(iphone->udev, IPHETH_BUF_SIZE, iphone->rx_buf, -+ usb_free_coherent(iphone->udev, IPHETH_BUF_SIZE + IPHETH_IP_ALIGN, iphone->rx_buf, - iphone->rx_urb->transfer_dma); - usb_free_coherent(iphone->udev, IPHETH_BUF_SIZE, iphone->tx_buf, - iphone->tx_urb->transfer_dma); -@@ -317,7 +317,7 @@ static int ipheth_rx_submit(struct ipheth_device *dev, gfp_t mem_flags) - - usb_fill_bulk_urb(dev->rx_urb, udev, - usb_rcvbulkpipe(udev, dev->bulk_in), -- dev->rx_buf, IPHETH_BUF_SIZE, -+ dev->rx_buf, IPHETH_BUF_SIZE + IPHETH_IP_ALIGN, - ipheth_rcvbulk_callback, - dev); - dev->rx_urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP; -diff --git a/drivers/pci/hotplug/pciehp_hpc.c b/drivers/pci/hotplug/pciehp_hpc.c -index 88b996764ff95..907b8be86ce04 100644 ---- a/drivers/pci/hotplug/pciehp_hpc.c -+++ b/drivers/pci/hotplug/pciehp_hpc.c -@@ -577,6 +577,8 @@ read_status: - */ - if (ctrl->power_fault_detected) - status &= ~PCI_EXP_SLTSTA_PFD; -+ else if (status & PCI_EXP_SLTSTA_PFD) -+ ctrl->power_fault_detected = true; - - events |= status; - if (!events) { -@@ -586,7 +588,7 @@ read_status: - } - - if (status) { -- pcie_capability_write_word(pdev, PCI_EXP_SLTSTA, events); -+ pcie_capability_write_word(pdev, PCI_EXP_SLTSTA, status); - - /* - * In MSI mode, all event bits must be zero before the port -@@ -660,8 +662,7 @@ static irqreturn_t pciehp_ist(int irq, void *dev_id) - } - - /* Check Power Fault Detected */ -- if ((events & PCI_EXP_SLTSTA_PFD) && !ctrl->power_fault_detected) { -- ctrl->power_fault_detected = 1; -+ if (events & PCI_EXP_SLTSTA_PFD) { - ctrl_err(ctrl, "Slot(%s): Power fault\n", slot_name(ctrl)); - pciehp_set_indicators(ctrl, PCI_EXP_SLTCTL_PWR_IND_OFF, - PCI_EXP_SLTCTL_ATTN_IND_ON); -diff --git a/include/linux/psi.h b/include/linux/psi.h -index 7b3de73212199..7712b58009276 100644 ---- a/include/linux/psi.h -+++ b/include/linux/psi.h -@@ -31,7 +31,7 @@ void cgroup_move_task(struct task_struct *p, struct css_set *to); - - struct psi_trigger *psi_trigger_create(struct psi_group *group, - char *buf, size_t nbytes, enum psi_res res); --void psi_trigger_replace(void **trigger_ptr, struct psi_trigger *t); -+void psi_trigger_destroy(struct psi_trigger *t); - - __poll_t psi_trigger_poll(void **trigger_ptr, struct file *file, - poll_table *wait); -diff --git a/include/linux/psi_types.h b/include/linux/psi_types.h -index 07aaf9b822416..0023052eab23f 100644 ---- a/include/linux/psi_types.h -+++ b/include/linux/psi_types.h -@@ -120,9 +120,6 @@ struct psi_trigger { - * events to one per window - */ - u64 last_event_time; -- -- /* Refcounting to prevent premature destruction */ -- struct kref refcount; - }; - - struct psi_group { -diff --git a/kernel/cgroup/cgroup-v1.c b/kernel/cgroup/cgroup-v1.c -index 2d0ef613ca070..5e465c4b1e64c 100644 ---- a/kernel/cgroup/cgroup-v1.c -+++ b/kernel/cgroup/cgroup-v1.c -@@ -549,6 +549,14 @@ static ssize_t cgroup_release_agent_write(struct kernfs_open_file *of, - - BUILD_BUG_ON(sizeof(cgrp->root->release_agent_path) < PATH_MAX); - -+ /* -+ * Release agent gets called with all capabilities, -+ * require capabilities to set release agent. -+ */ -+ if ((of->file->f_cred->user_ns != &init_user_ns) || -+ !capable(CAP_SYS_ADMIN)) -+ return -EPERM; -+ - cgrp = cgroup_kn_lock_live(of->kn, false); - if (!cgrp) - return -ENODEV; -@@ -961,6 +969,12 @@ int cgroup1_parse_param(struct fs_context *fc, struct fs_parameter *param) - /* Specifying two release agents is forbidden */ - if (ctx->release_agent) - return cg_invalf(fc, "cgroup1: release_agent respecified"); -+ /* -+ * Release agent gets called with all capabilities, -+ * require capabilities to set release agent. -+ */ -+ if ((fc->user_ns != &init_user_ns) || !capable(CAP_SYS_ADMIN)) -+ return cg_invalf(fc, "cgroup1: Setting release_agent not allowed"); - ctx->release_agent = param->string; - param->string = NULL; - break; -diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c -index 1904ffcee0f1e..ce1745ac7b8c0 100644 ---- a/kernel/cgroup/cgroup.c -+++ b/kernel/cgroup/cgroup.c -@@ -3659,6 +3659,12 @@ static ssize_t cgroup_pressure_write(struct kernfs_open_file *of, char *buf, - cgroup_get(cgrp); - cgroup_kn_unlock(of->kn); - -+ /* Allow only one trigger per file descriptor */ -+ if (of->priv) { -+ cgroup_put(cgrp); -+ return -EBUSY; -+ } -+ - psi = cgroup_ino(cgrp) == 1 ? &psi_system : &cgrp->psi; - new = psi_trigger_create(psi, buf, nbytes, res); - if (IS_ERR(new)) { -@@ -3666,8 +3672,7 @@ static ssize_t cgroup_pressure_write(struct kernfs_open_file *of, char *buf, - return PTR_ERR(new); - } - -- psi_trigger_replace(&of->priv, new); -- -+ smp_store_release(&of->priv, new); - cgroup_put(cgrp); - - return nbytes; -@@ -3702,7 +3707,7 @@ static __poll_t cgroup_pressure_poll(struct kernfs_open_file *of, - - static void cgroup_pressure_release(struct kernfs_open_file *of) - { -- psi_trigger_replace(&of->priv, NULL); -+ psi_trigger_destroy(of->priv); - } - #endif /* CONFIG_PSI */ - -diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c -index badfa8f153599..411be8b2e837e 100644 ---- a/kernel/cgroup/cpuset.c -+++ b/kernel/cgroup/cpuset.c -@@ -1558,8 +1558,7 @@ static int update_cpumask(struct cpuset *cs, struct cpuset *trialcs, - * Make sure that subparts_cpus is a subset of cpus_allowed. - */ - if (cs->nr_subparts_cpus) { -- cpumask_andnot(cs->subparts_cpus, cs->subparts_cpus, -- cs->cpus_allowed); -+ cpumask_and(cs->subparts_cpus, cs->subparts_cpus, cs->cpus_allowed); - cs->nr_subparts_cpus = cpumask_weight(cs->subparts_cpus); - } - spin_unlock_irq(&callback_lock); -diff --git a/kernel/sched/psi.c b/kernel/sched/psi.c -index 9154e745f0978..9dd83eb74a9da 100644 ---- a/kernel/sched/psi.c -+++ b/kernel/sched/psi.c -@@ -1046,7 +1046,6 @@ struct psi_trigger *psi_trigger_create(struct psi_group *group, - t->event = 0; - t->last_event_time = 0; - init_waitqueue_head(&t->event_wait); -- kref_init(&t->refcount); - - mutex_lock(&group->trigger_lock); - -@@ -1079,15 +1078,19 @@ struct psi_trigger *psi_trigger_create(struct psi_group *group, - return t; - } - --static void psi_trigger_destroy(struct kref *ref) -+void psi_trigger_destroy(struct psi_trigger *t) - { -- struct psi_trigger *t = container_of(ref, struct psi_trigger, refcount); -- struct psi_group *group = t->group; -+ struct psi_group *group; - struct kthread_worker *kworker_to_destroy = NULL; - -- if (static_branch_likely(&psi_disabled)) -+ /* -+ * We do not check psi_disabled since it might have been disabled after -+ * the trigger got created. -+ */ -+ if (!t) - return; - -+ group = t->group; - /* - * Wakeup waiters to stop polling. Can happen if cgroup is deleted - * from under a polling process. -@@ -1122,9 +1125,9 @@ static void psi_trigger_destroy(struct kref *ref) - mutex_unlock(&group->trigger_lock); - - /* -- * Wait for both *trigger_ptr from psi_trigger_replace and -- * poll_kworker RCUs to complete their read-side critical sections -- * before destroying the trigger and optionally the poll_kworker -+ * Wait for psi_schedule_poll_work RCU to complete its read-side -+ * critical section before destroying the trigger and optionally the -+ * poll_task. - */ - synchronize_rcu(); - /* -@@ -1146,18 +1149,6 @@ static void psi_trigger_destroy(struct kref *ref) - kfree(t); - } - --void psi_trigger_replace(void **trigger_ptr, struct psi_trigger *new) --{ -- struct psi_trigger *old = *trigger_ptr; -- -- if (static_branch_likely(&psi_disabled)) -- return; -- -- rcu_assign_pointer(*trigger_ptr, new); -- if (old) -- kref_put(&old->refcount, psi_trigger_destroy); --} -- - __poll_t psi_trigger_poll(void **trigger_ptr, - struct file *file, poll_table *wait) - { -@@ -1167,24 +1158,15 @@ __poll_t psi_trigger_poll(void **trigger_ptr, - if (static_branch_likely(&psi_disabled)) - return DEFAULT_POLLMASK | EPOLLERR | EPOLLPRI; - -- rcu_read_lock(); -- -- t = rcu_dereference(*(void __rcu __force **)trigger_ptr); -- if (!t) { -- rcu_read_unlock(); -+ t = smp_load_acquire(trigger_ptr); -+ if (!t) - return DEFAULT_POLLMASK | EPOLLERR | EPOLLPRI; -- } -- kref_get(&t->refcount); -- -- rcu_read_unlock(); - - poll_wait(file, &t->event_wait, wait); - - if (cmpxchg(&t->event, 1, 0) == 1) - ret |= EPOLLPRI; - -- kref_put(&t->refcount, psi_trigger_destroy); -- - return ret; - } - -@@ -1208,14 +1190,24 @@ static ssize_t psi_write(struct file *file, const char __user *user_buf, - - buf[buf_size - 1] = '\0'; - -- new = psi_trigger_create(&psi_system, buf, nbytes, res); -- if (IS_ERR(new)) -- return PTR_ERR(new); -- - seq = file->private_data; -+ - /* Take seq->lock to protect seq->private from concurrent writes */ - mutex_lock(&seq->lock); -- psi_trigger_replace(&seq->private, new); -+ -+ /* Allow only one trigger per file descriptor */ -+ if (seq->private) { -+ mutex_unlock(&seq->lock); -+ return -EBUSY; -+ } -+ -+ new = psi_trigger_create(&psi_system, buf, nbytes, res); -+ if (IS_ERR(new)) { -+ mutex_unlock(&seq->lock); -+ return PTR_ERR(new); -+ } -+ -+ smp_store_release(&seq->private, new); - mutex_unlock(&seq->lock); - - return nbytes; -@@ -1250,7 +1242,7 @@ static int psi_fop_release(struct inode *inode, struct file *file) - { - struct seq_file *seq = file->private_data; - -- psi_trigger_replace(&seq->private, NULL); -+ psi_trigger_destroy(seq->private); - return single_release(inode, file); - } - -diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c -index 55c0f32b9375b..dbc9b2f53649d 100644 ---- a/net/core/rtnetlink.c -+++ b/net/core/rtnetlink.c -@@ -3022,8 +3022,8 @@ static int __rtnl_newlink(struct sk_buff *skb, struct nlmsghdr *nlh, - struct nlattr *slave_attr[RTNL_SLAVE_MAX_TYPE + 1]; - unsigned char name_assign_type = NET_NAME_USER; - struct nlattr *linkinfo[IFLA_INFO_MAX + 1]; -- const struct rtnl_link_ops *m_ops = NULL; -- struct net_device *master_dev = NULL; -+ const struct rtnl_link_ops *m_ops; -+ struct net_device *master_dev; - struct net *net = sock_net(skb->sk); - const struct rtnl_link_ops *ops; - struct nlattr *tb[IFLA_MAX + 1]; -@@ -3063,6 +3063,8 @@ replay: - dev = NULL; - } - -+ master_dev = NULL; -+ m_ops = NULL; - if (dev) { - master_dev = netdev_master_upper_dev_get(dev); - if (master_dev) -diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c -index 839e1caa57a59..ed11013d4b953 100644 ---- a/net/packet/af_packet.c -+++ b/net/packet/af_packet.c -@@ -1729,7 +1729,10 @@ static int fanout_add(struct sock *sk, u16 id, u16 type_flags) - err = -ENOSPC; - if (refcount_read(&match->sk_ref) < PACKET_FANOUT_MAX) { - __dev_remove_pack(&po->prot_hook); -- po->fanout = match; -+ -+ /* Paired with packet_setsockopt(PACKET_FANOUT_DATA) */ -+ WRITE_ONCE(po->fanout, match); -+ - po->rollover = rollover; - rollover = NULL; - refcount_set(&match->sk_ref, refcount_read(&match->sk_ref) + 1); -@@ -3876,7 +3879,8 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv - } - case PACKET_FANOUT_DATA: - { -- if (!po->fanout) -+ /* Paired with the WRITE_ONCE() in fanout_add() */ -+ if (!READ_ONCE(po->fanout)) - return -EINVAL; - - return fanout_set_data(po, optval, optlen); -diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c -index a4c61205462ac..80205b138d113 100644 ---- a/net/sched/cls_api.c -+++ b/net/sched/cls_api.c -@@ -1928,9 +1928,9 @@ static int tc_new_tfilter(struct sk_buff *skb, struct nlmsghdr *n, - bool prio_allocate; - u32 parent; - u32 chain_index; -- struct Qdisc *q = NULL; -+ struct Qdisc *q; - struct tcf_chain_info chain_info; -- struct tcf_chain *chain = NULL; -+ struct tcf_chain *chain; - struct tcf_block *block; - struct tcf_proto *tp; - unsigned long cl; -@@ -1958,6 +1958,8 @@ replay: - tp = NULL; - cl = 0; - block = NULL; -+ q = NULL; -+ chain = NULL; - - if (prio == 0) { - /* If no priority is provided by the user, -@@ -2764,8 +2766,8 @@ static int tc_ctl_chain(struct sk_buff *skb, struct nlmsghdr *n, - struct tcmsg *t; - u32 parent; - u32 chain_index; -- struct Qdisc *q = NULL; -- struct tcf_chain *chain = NULL; -+ struct Qdisc *q; -+ struct tcf_chain *chain; - struct tcf_block *block; - unsigned long cl; - int err; -@@ -2775,6 +2777,7 @@ static int tc_ctl_chain(struct sk_buff *skb, struct nlmsghdr *n, - return -EPERM; - - replay: -+ q = NULL; - err = nlmsg_parse_deprecated(n, sizeof(*t), tca, TCA_MAX, - rtm_tca_policy, extack); - if (err < 0) diff --git a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.177-178.patch b/patch/kernel/archive/odroidxu4-5.4/patch-5.4.177-178.patch deleted file mode 100644 index 078c05231..000000000 --- a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.177-178.patch +++ /dev/null @@ -1,1218 +0,0 @@ -diff --git a/Makefile b/Makefile -index 324939b64d7b7..6d33284664fef 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 5 - PATCHLEVEL = 4 --SUBLEVEL = 177 -+SUBLEVEL = 178 - EXTRAVERSION = - NAME = Kleptomaniac Octopus - -diff --git a/block/bio-integrity.c b/block/bio-integrity.c -index c9dc2b17ce251..ec295be93ca0d 100644 ---- a/block/bio-integrity.c -+++ b/block/bio-integrity.c -@@ -380,7 +380,7 @@ void bio_integrity_advance(struct bio *bio, unsigned int bytes_done) - struct blk_integrity *bi = blk_get_integrity(bio->bi_disk); - unsigned bytes = bio_integrity_bytes(bi, bytes_done >> 9); - -- bip->bip_iter.bi_sector += bytes_done >> 9; -+ bip->bip_iter.bi_sector += bio_integrity_intervals(bi, bytes_done >> 9); - bvec_iter_advance(bip->bip_vec, &bip->bip_iter, bytes); - } - -diff --git a/drivers/edac/altera_edac.c b/drivers/edac/altera_edac.c -index 0be3d1b17f034..a09a5041e74c8 100644 ---- a/drivers/edac/altera_edac.c -+++ b/drivers/edac/altera_edac.c -@@ -349,7 +349,7 @@ static int altr_sdram_probe(struct platform_device *pdev) - if (irq < 0) { - edac_printk(KERN_ERR, EDAC_MC, - "No irq %d in DT\n", irq); -- return -ENODEV; -+ return irq; - } - - /* Arria10 has a 2nd IRQ */ -diff --git a/drivers/edac/xgene_edac.c b/drivers/edac/xgene_edac.c -index e4a1032ba0b58..cd9926e518967 100644 ---- a/drivers/edac/xgene_edac.c -+++ b/drivers/edac/xgene_edac.c -@@ -1922,7 +1922,7 @@ static int xgene_edac_probe(struct platform_device *pdev) - irq = platform_get_irq(pdev, i); - if (irq < 0) { - dev_err(&pdev->dev, "No IRQ resource\n"); -- rc = -EINVAL; -+ rc = irq; - goto out_err; - } - rc = devm_request_irq(&pdev->dev, irq, -diff --git a/drivers/gpu/drm/i915/display/intel_overlay.c b/drivers/gpu/drm/i915/display/intel_overlay.c -index 29edfc3437163..aeb7cb651fa4f 100644 ---- a/drivers/gpu/drm/i915/display/intel_overlay.c -+++ b/drivers/gpu/drm/i915/display/intel_overlay.c -@@ -913,6 +913,9 @@ static int check_overlay_dst(struct intel_overlay *overlay, - const struct intel_crtc_state *pipe_config = - overlay->crtc->config; - -+ if (rec->dst_height == 0 || rec->dst_width == 0) -+ return -EINVAL; -+ - if (rec->dst_x < pipe_config->pipe_src_w && - rec->dst_x + rec->dst_width <= pipe_config->pipe_src_w && - rec->dst_y < pipe_config->pipe_src_h && -diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/base.c b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/base.c -index f3c30b2a788e8..8bff14ae16b0e 100644 ---- a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/base.c -+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/base.c -@@ -38,7 +38,7 @@ nvbios_addr(struct nvkm_bios *bios, u32 *addr, u8 size) - *addr += bios->imaged_addr; - } - -- if (unlikely(*addr + size >= bios->size)) { -+ if (unlikely(*addr + size > bios->size)) { - nvkm_error(&bios->subdev, "OOB %d %08x %08x\n", size, p, *addr); - return false; - } -diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c -index 48864269f042a..baa129a6c9127 100644 ---- a/drivers/infiniband/hw/mlx4/main.c -+++ b/drivers/infiniband/hw/mlx4/main.c -@@ -3291,7 +3291,7 @@ static void mlx4_ib_event(struct mlx4_dev *dev, void *ibdev_ptr, - case MLX4_DEV_EVENT_PORT_MGMT_CHANGE: - ew = kmalloc(sizeof *ew, GFP_ATOMIC); - if (!ew) -- break; -+ return; - - INIT_WORK(&ew->work, handle_port_mgmt_change_event); - memcpy(&ew->ib_eqe, eqe, sizeof *eqe); -diff --git a/drivers/infiniband/sw/rdmavt/qp.c b/drivers/infiniband/sw/rdmavt/qp.c -index d14ad523f96c8..a5152f097cb7a 100644 ---- a/drivers/infiniband/sw/rdmavt/qp.c -+++ b/drivers/infiniband/sw/rdmavt/qp.c -@@ -3110,6 +3110,8 @@ do_write: - case IB_WR_ATOMIC_FETCH_AND_ADD: - if (unlikely(!(qp->qp_access_flags & IB_ACCESS_REMOTE_ATOMIC))) - goto inv_err; -+ if (unlikely(wqe->atomic_wr.remote_addr & (sizeof(u64) - 1))) -+ goto inv_err; - if (unlikely(!rvt_rkey_ok(qp, &qp->r_sge.sge, sizeof(u64), - wqe->atomic_wr.remote_addr, - wqe->atomic_wr.rkey, -diff --git a/drivers/infiniband/sw/siw/siw.h b/drivers/infiniband/sw/siw/siw.h -index 4d8bc995b4503..eaa9863dd1e00 100644 ---- a/drivers/infiniband/sw/siw/siw.h -+++ b/drivers/infiniband/sw/siw/siw.h -@@ -658,14 +658,9 @@ static inline struct siw_sqe *orq_get_current(struct siw_qp *qp) - return &qp->orq[qp->orq_get % qp->attrs.orq_size]; - } - --static inline struct siw_sqe *orq_get_tail(struct siw_qp *qp) --{ -- return &qp->orq[qp->orq_put % qp->attrs.orq_size]; --} -- - static inline struct siw_sqe *orq_get_free(struct siw_qp *qp) - { -- struct siw_sqe *orq_e = orq_get_tail(qp); -+ struct siw_sqe *orq_e = &qp->orq[qp->orq_put % qp->attrs.orq_size]; - - if (READ_ONCE(orq_e->flags) == 0) - return orq_e; -diff --git a/drivers/infiniband/sw/siw/siw_qp_rx.c b/drivers/infiniband/sw/siw/siw_qp_rx.c -index c7c38f7fd29d6..5f94c716301fa 100644 ---- a/drivers/infiniband/sw/siw/siw_qp_rx.c -+++ b/drivers/infiniband/sw/siw/siw_qp_rx.c -@@ -1153,11 +1153,12 @@ static int siw_check_tx_fence(struct siw_qp *qp) - - spin_lock_irqsave(&qp->orq_lock, flags); - -- rreq = orq_get_current(qp); -- - /* free current orq entry */ -+ rreq = orq_get_current(qp); - WRITE_ONCE(rreq->flags, 0); - -+ qp->orq_get++; -+ - if (qp->tx_ctx.orq_fence) { - if (unlikely(tx_waiting->wr_status != SIW_WR_QUEUED)) { - pr_warn("siw: [QP %u]: fence resume: bad status %d\n", -@@ -1165,10 +1166,12 @@ static int siw_check_tx_fence(struct siw_qp *qp) - rv = -EPROTO; - goto out; - } -- /* resume SQ processing */ -+ /* resume SQ processing, if possible */ - if (tx_waiting->sqe.opcode == SIW_OP_READ || - tx_waiting->sqe.opcode == SIW_OP_READ_LOCAL_INV) { -- rreq = orq_get_tail(qp); -+ -+ /* SQ processing was stopped because of a full ORQ */ -+ rreq = orq_get_free(qp); - if (unlikely(!rreq)) { - pr_warn("siw: [QP %u]: no ORQE\n", qp_id(qp)); - rv = -EPROTO; -@@ -1181,15 +1184,14 @@ static int siw_check_tx_fence(struct siw_qp *qp) - resume_tx = 1; - - } else if (siw_orq_empty(qp)) { -+ /* -+ * SQ processing was stopped by fenced work request. -+ * Resume since all previous Read's are now completed. -+ */ - qp->tx_ctx.orq_fence = 0; - resume_tx = 1; -- } else { -- pr_warn("siw: [QP %u]: fence resume: orq idx: %d:%d\n", -- qp_id(qp), qp->orq_get, qp->orq_put); -- rv = -EPROTO; - } - } -- qp->orq_get++; - out: - spin_unlock_irqrestore(&qp->orq_lock, flags); - -diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c -index 692401e941a77..7502fa84e2537 100644 ---- a/drivers/iommu/amd_iommu_init.c -+++ b/drivers/iommu/amd_iommu_init.c -@@ -21,6 +21,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -759,6 +760,7 @@ static int iommu_ga_log_enable(struct amd_iommu *iommu) - status = readl(iommu->mmio_base + MMIO_STATUS_OFFSET); - if (status & (MMIO_STATUS_GALOG_RUN_MASK)) - break; -+ udelay(10); - } - - if (i >= LOOP_TIMEOUT) -diff --git a/drivers/iommu/intel_irq_remapping.c b/drivers/iommu/intel_irq_remapping.c -index 5dcc81b1df623..f3b299b5c1c06 100644 ---- a/drivers/iommu/intel_irq_remapping.c -+++ b/drivers/iommu/intel_irq_remapping.c -@@ -570,9 +570,8 @@ static int intel_setup_irq_remapping(struct intel_iommu *iommu) - fn, &intel_ir_domain_ops, - iommu); - if (!iommu->ir_domain) { -- irq_domain_free_fwnode(fn); - pr_err("IR%d: failed to allocate irqdomain\n", iommu->seq_id); -- goto out_free_bitmap; -+ goto out_free_fwnode; - } - iommu->ir_msi_domain = - arch_create_remap_msi_irq_domain(iommu->ir_domain, -@@ -596,7 +595,7 @@ static int intel_setup_irq_remapping(struct intel_iommu *iommu) - - if (dmar_enable_qi(iommu)) { - pr_err("Failed to enable queued invalidation\n"); -- goto out_free_bitmap; -+ goto out_free_ir_domain; - } - } - -@@ -620,6 +619,14 @@ static int intel_setup_irq_remapping(struct intel_iommu *iommu) - - return 0; - -+out_free_ir_domain: -+ if (iommu->ir_msi_domain) -+ irq_domain_remove(iommu->ir_msi_domain); -+ iommu->ir_msi_domain = NULL; -+ irq_domain_remove(iommu->ir_domain); -+ iommu->ir_domain = NULL; -+out_free_fwnode: -+ irq_domain_free_fwnode(fn); - out_free_bitmap: - bitmap_free(bitmap); - out_free_pages: -diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac_dma.h b/drivers/net/ethernet/stmicro/stmmac/dwmac_dma.h -index 292b880f3f9fc..3587b2e7843ef 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/dwmac_dma.h -+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac_dma.h -@@ -128,6 +128,7 @@ - - #define NUM_DWMAC100_DMA_REGS 9 - #define NUM_DWMAC1000_DMA_REGS 23 -+#define NUM_DWMAC4_DMA_REGS 27 - - void dwmac_enable_dma_transmission(void __iomem *ioaddr); - void dwmac_enable_dma_irq(void __iomem *ioaddr, u32 chan); -diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c -index ce1346c14b05a..30b9393ae8f2f 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c -+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c -@@ -21,10 +21,18 @@ - #include "dwxgmac2.h" - - #define REG_SPACE_SIZE 0x1060 -+#define GMAC4_REG_SPACE_SIZE 0x116C - #define MAC100_ETHTOOL_NAME "st_mac100" - #define GMAC_ETHTOOL_NAME "st_gmac" - #define XGMAC_ETHTOOL_NAME "st_xgmac" - -+/* Same as DMA_CHAN_BASE_ADDR defined in dwmac4_dma.h -+ * -+ * It is here because dwmac_dma.h and dwmac4_dam.h can not be included at the -+ * same time due to the conflicting macro names. -+ */ -+#define GMAC4_DMA_CHAN_BASE_ADDR 0x00001100 -+ - #define ETHTOOL_DMA_OFFSET 55 - - struct stmmac_stats { -@@ -413,6 +421,8 @@ static int stmmac_ethtool_get_regs_len(struct net_device *dev) - - if (priv->plat->has_xgmac) - return XGMAC_REGSIZE * 4; -+ else if (priv->plat->has_gmac4) -+ return GMAC4_REG_SPACE_SIZE; - return REG_SPACE_SIZE; - } - -@@ -425,8 +435,13 @@ static void stmmac_ethtool_gregs(struct net_device *dev, - stmmac_dump_mac_regs(priv, priv->hw, reg_space); - stmmac_dump_dma_regs(priv, priv->ioaddr, reg_space); - -- if (!priv->plat->has_xgmac) { -- /* Copy DMA registers to where ethtool expects them */ -+ /* Copy DMA registers to where ethtool expects them */ -+ if (priv->plat->has_gmac4) { -+ /* GMAC4 dumps its DMA registers at its DMA_CHAN_BASE_ADDR */ -+ memcpy(®_space[ETHTOOL_DMA_OFFSET], -+ ®_space[GMAC4_DMA_CHAN_BASE_ADDR / 4], -+ NUM_DWMAC4_DMA_REGS * 4); -+ } else if (!priv->plat->has_xgmac) { - memcpy(®_space[ETHTOOL_DMA_OFFSET], - ®_space[DMA_BUS_MODE / 4], - NUM_DWMAC1000_DMA_REGS * 4); -diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c -index e5d9007c8090b..8c14c99663941 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c -+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c -@@ -149,15 +149,20 @@ static int adjust_systime(void __iomem *ioaddr, u32 sec, u32 nsec, - - static void get_systime(void __iomem *ioaddr, u64 *systime) - { -- u64 ns; -- -- /* Get the TSSS value */ -- ns = readl(ioaddr + PTP_STNSR); -- /* Get the TSS and convert sec time value to nanosecond */ -- ns += readl(ioaddr + PTP_STSR) * 1000000000ULL; -+ u64 ns, sec0, sec1; -+ -+ /* Get the TSS value */ -+ sec1 = readl_relaxed(ioaddr + PTP_STSR); -+ do { -+ sec0 = sec1; -+ /* Get the TSSS value */ -+ ns = readl_relaxed(ioaddr + PTP_STNSR); -+ /* Get the TSS value */ -+ sec1 = readl_relaxed(ioaddr + PTP_STSR); -+ } while (sec0 != sec1); - - if (systime) -- *systime = ns; -+ *systime = ns + (sec1 * 1000000000ULL); - } - - const struct stmmac_hwtimestamp stmmac_ptp = { -diff --git a/drivers/net/ieee802154/ca8210.c b/drivers/net/ieee802154/ca8210.c -index 25dbea302fb6d..7c131a423cafa 100644 ---- a/drivers/net/ieee802154/ca8210.c -+++ b/drivers/net/ieee802154/ca8210.c -@@ -1770,6 +1770,7 @@ static int ca8210_async_xmit_complete( - status - ); - if (status != MAC_TRANSACTION_OVERFLOW) { -+ dev_kfree_skb_any(priv->tx_skb); - ieee802154_wake_queue(priv->hw); - return 0; - } -diff --git a/drivers/net/ieee802154/mac802154_hwsim.c b/drivers/net/ieee802154/mac802154_hwsim.c -index 2a78084aeaedb..1d181eff0c299 100644 ---- a/drivers/net/ieee802154/mac802154_hwsim.c -+++ b/drivers/net/ieee802154/mac802154_hwsim.c -@@ -786,6 +786,7 @@ static int hwsim_add_one(struct genl_info *info, struct device *dev, - goto err_pib; - } - -+ pib->channel = 13; - rcu_assign_pointer(phy->pib, pib); - phy->idx = idx; - INIT_LIST_HEAD(&phy->edges); -diff --git a/drivers/net/ieee802154/mcr20a.c b/drivers/net/ieee802154/mcr20a.c -index 8dc04e2590b18..383231b854642 100644 ---- a/drivers/net/ieee802154/mcr20a.c -+++ b/drivers/net/ieee802154/mcr20a.c -@@ -976,8 +976,8 @@ static void mcr20a_hw_setup(struct mcr20a_local *lp) - dev_dbg(printdev(lp), "%s\n", __func__); - - phy->symbol_duration = 16; -- phy->lifs_period = 40; -- phy->sifs_period = 12; -+ phy->lifs_period = 40 * phy->symbol_duration; -+ phy->sifs_period = 12 * phy->symbol_duration; - - hw->flags = IEEE802154_HW_TX_OMIT_CKSUM | - IEEE802154_HW_AFILT | -diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c -index f233a6933a976..f729f55f6a174 100644 ---- a/drivers/net/macsec.c -+++ b/drivers/net/macsec.c -@@ -3247,6 +3247,15 @@ static int macsec_newlink(struct net *net, struct net_device *dev, - - macsec->real_dev = real_dev; - -+ /* send_sci must be set to true when transmit sci explicitly is set */ -+ if ((data && data[IFLA_MACSEC_SCI]) && -+ (data && data[IFLA_MACSEC_INC_SCI])) { -+ u8 send_sci = !!nla_get_u8(data[IFLA_MACSEC_INC_SCI]); -+ -+ if (!send_sci) -+ return -EINVAL; -+ } -+ - if (data && data[IFLA_MACSEC_ICV_LEN]) - icv_len = nla_get_u8(data[IFLA_MACSEC_ICV_LEN]); - mtu = real_dev->mtu - icv_len - macsec_extra_len(true); -diff --git a/drivers/pinctrl/bcm/pinctrl-bcm2835.c b/drivers/pinctrl/bcm/pinctrl-bcm2835.c -index fa742535f6791..e4da3217e9398 100644 ---- a/drivers/pinctrl/bcm/pinctrl-bcm2835.c -+++ b/drivers/pinctrl/bcm/pinctrl-bcm2835.c -@@ -1261,16 +1261,18 @@ static int bcm2835_pinctrl_probe(struct platform_device *pdev) - sizeof(*girq->parents), - GFP_KERNEL); - if (!girq->parents) { -- pinctrl_remove_gpio_range(pc->pctl_dev, &pc->gpio_range); -- return -ENOMEM; -+ err = -ENOMEM; -+ goto out_remove; - } - - if (is_7211) { - pc->wake_irq = devm_kcalloc(dev, BCM2835_NUM_IRQS, - sizeof(*pc->wake_irq), - GFP_KERNEL); -- if (!pc->wake_irq) -- return -ENOMEM; -+ if (!pc->wake_irq) { -+ err = -ENOMEM; -+ goto out_remove; -+ } - } - - /* -@@ -1294,8 +1296,10 @@ static int bcm2835_pinctrl_probe(struct platform_device *pdev) - - len = strlen(dev_name(pc->dev)) + 16; - name = devm_kzalloc(pc->dev, len, GFP_KERNEL); -- if (!name) -- return -ENOMEM; -+ if (!name) { -+ err = -ENOMEM; -+ goto out_remove; -+ } - - snprintf(name, len, "%s:bank%d", dev_name(pc->dev), i); - -@@ -1314,11 +1318,14 @@ static int bcm2835_pinctrl_probe(struct platform_device *pdev) - err = gpiochip_add_data(&pc->gpio_chip, pc); - if (err) { - dev_err(dev, "could not add GPIO chip\n"); -- pinctrl_remove_gpio_range(pc->pctl_dev, &pc->gpio_range); -- return err; -+ goto out_remove; - } - - return 0; -+ -+out_remove: -+ pinctrl_remove_gpio_range(pc->pctl_dev, &pc->gpio_range); -+ return err; - } - - static struct platform_driver bcm2835_pinctrl_driver = { -diff --git a/drivers/rtc/rtc-mc146818-lib.c b/drivers/rtc/rtc-mc146818-lib.c -index 2ecd8752b088b..5add637c9ad23 100644 ---- a/drivers/rtc/rtc-mc146818-lib.c -+++ b/drivers/rtc/rtc-mc146818-lib.c -@@ -83,7 +83,7 @@ unsigned int mc146818_get_time(struct rtc_time *time) - time->tm_year += real_year - 72; - #endif - -- if (century > 20) -+ if (century > 19) - time->tm_year += (century - 19) * 100; - - /* -diff --git a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c -index e6c3e7c070aaf..9ed109fb6b67b 100644 ---- a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c -+++ b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c -@@ -506,7 +506,8 @@ static int bnx2fc_l2_rcv_thread(void *arg) - - static void bnx2fc_recv_frame(struct sk_buff *skb) - { -- u32 fr_len; -+ u64 crc_err; -+ u32 fr_len, fr_crc; - struct fc_lport *lport; - struct fcoe_rcv_info *fr; - struct fc_stats *stats; -@@ -540,6 +541,11 @@ static void bnx2fc_recv_frame(struct sk_buff *skb) - skb_pull(skb, sizeof(struct fcoe_hdr)); - fr_len = skb->len - sizeof(struct fcoe_crc_eof); - -+ stats = per_cpu_ptr(lport->stats, get_cpu()); -+ stats->RxFrames++; -+ stats->RxWords += fr_len / FCOE_WORD_TO_BYTE; -+ put_cpu(); -+ - fp = (struct fc_frame *)skb; - fc_frame_init(fp); - fr_dev(fp) = lport; -@@ -622,16 +628,15 @@ static void bnx2fc_recv_frame(struct sk_buff *skb) - return; - } - -- stats = per_cpu_ptr(lport->stats, smp_processor_id()); -- stats->RxFrames++; -- stats->RxWords += fr_len / FCOE_WORD_TO_BYTE; -+ fr_crc = le32_to_cpu(fr_crc(fp)); - -- if (le32_to_cpu(fr_crc(fp)) != -- ~crc32(~0, skb->data, fr_len)) { -- if (stats->InvalidCRCCount < 5) -+ if (unlikely(fr_crc != ~crc32(~0, skb->data, fr_len))) { -+ stats = per_cpu_ptr(lport->stats, get_cpu()); -+ crc_err = (stats->InvalidCRCCount++); -+ put_cpu(); -+ if (crc_err < 5) - printk(KERN_WARNING PFX "dropping frame with " - "CRC error\n"); -- stats->InvalidCRCCount++; - kfree_skb(skb); - return; - } -diff --git a/drivers/soc/mediatek/mtk-scpsys.c b/drivers/soc/mediatek/mtk-scpsys.c -index 71afa2a99b17f..75f25f08245fd 100644 ---- a/drivers/soc/mediatek/mtk-scpsys.c -+++ b/drivers/soc/mediatek/mtk-scpsys.c -@@ -333,17 +333,12 @@ out: - return ret; - } - --static int init_clks(struct platform_device *pdev, struct clk **clk) -+static void init_clks(struct platform_device *pdev, struct clk **clk) - { - int i; - -- for (i = CLK_NONE + 1; i < CLK_MAX; i++) { -+ for (i = CLK_NONE + 1; i < CLK_MAX; i++) - clk[i] = devm_clk_get(&pdev->dev, clk_names[i]); -- if (IS_ERR(clk[i])) -- return PTR_ERR(clk[i]); -- } -- -- return 0; - } - - static struct scp *init_scp(struct platform_device *pdev, -@@ -353,7 +348,7 @@ static struct scp *init_scp(struct platform_device *pdev, - { - struct genpd_onecell_data *pd_data; - struct resource *res; -- int i, j, ret; -+ int i, j; - struct scp *scp; - struct clk *clk[CLK_MAX]; - -@@ -408,9 +403,7 @@ static struct scp *init_scp(struct platform_device *pdev, - - pd_data->num_domains = num; - -- ret = init_clks(pdev, clk); -- if (ret) -- return ERR_PTR(ret); -+ init_clks(pdev, clk); - - for (i = 0; i < num; i++) { - struct scp_domain *scpd = &scp->domains[i]; -diff --git a/drivers/spi/spi-bcm-qspi.c b/drivers/spi/spi-bcm-qspi.c -index 8a1176efa4c85..3755be04346a6 100644 ---- a/drivers/spi/spi-bcm-qspi.c -+++ b/drivers/spi/spi-bcm-qspi.c -@@ -509,7 +509,7 @@ static void bcm_qspi_chip_select(struct bcm_qspi *qspi, int cs) - u32 rd = 0; - u32 wr = 0; - -- if (qspi->base[CHIP_SELECT]) { -+ if (cs >= 0 && qspi->base[CHIP_SELECT]) { - rd = bcm_qspi_read(qspi, CHIP_SELECT, 0); - wr = (rd & ~0xff) | (1 << cs); - if (rd == wr) -diff --git a/drivers/spi/spi-meson-spicc.c b/drivers/spi/spi-meson-spicc.c -index 3c841ae0a3e91..c9c4c0f2e8b7a 100644 ---- a/drivers/spi/spi-meson-spicc.c -+++ b/drivers/spi/spi-meson-spicc.c -@@ -527,6 +527,11 @@ static int meson_spicc_probe(struct platform_device *pdev) - writel_relaxed(0, spicc->base + SPICC_INTREG); - - irq = platform_get_irq(pdev, 0); -+ if (irq < 0) { -+ ret = irq; -+ goto out_master; -+ } -+ - ret = devm_request_irq(&pdev->dev, irq, meson_spicc_irq, - 0, NULL, spicc); - if (ret) { -diff --git a/drivers/spi/spi-mt65xx.c b/drivers/spi/spi-mt65xx.c -index cafb773f78616..29d44f5d5212c 100644 ---- a/drivers/spi/spi-mt65xx.c -+++ b/drivers/spi/spi-mt65xx.c -@@ -533,7 +533,7 @@ static irqreturn_t mtk_spi_interrupt(int irq, void *dev_id) - else - mdata->state = MTK_SPI_IDLE; - -- if (!master->can_dma(master, master->cur_msg->spi, trans)) { -+ if (!master->can_dma(master, NULL, trans)) { - if (trans->rx_buf) { - cnt = mdata->xfer_len / 4; - ioread32_rep(mdata->base + SPI_RX_DATA_REG, -diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c -index 2ee61596164be..a5041bf0d5db1 100644 ---- a/fs/btrfs/qgroup.c -+++ b/fs/btrfs/qgroup.c -@@ -1105,9 +1105,24 @@ int btrfs_quota_disable(struct btrfs_fs_info *fs_info) - struct btrfs_trans_handle *trans = NULL; - int ret = 0; - -+ /* -+ * We need to have subvol_sem write locked, to prevent races between -+ * concurrent tasks trying to disable quotas, because we will unlock -+ * and relock qgroup_ioctl_lock across BTRFS_FS_QUOTA_ENABLED changes. -+ */ -+ lockdep_assert_held_write(&fs_info->subvol_sem); -+ - mutex_lock(&fs_info->qgroup_ioctl_lock); - if (!fs_info->quota_root) - goto out; -+ -+ /* -+ * Request qgroup rescan worker to complete and wait for it. This wait -+ * must be done before transaction start for quota disable since it may -+ * deadlock with transaction by the qgroup rescan worker. -+ */ -+ clear_bit(BTRFS_FS_QUOTA_ENABLED, &fs_info->flags); -+ btrfs_qgroup_wait_for_completion(fs_info, false); - mutex_unlock(&fs_info->qgroup_ioctl_lock); - - /* -@@ -1125,14 +1140,13 @@ int btrfs_quota_disable(struct btrfs_fs_info *fs_info) - if (IS_ERR(trans)) { - ret = PTR_ERR(trans); - trans = NULL; -+ set_bit(BTRFS_FS_QUOTA_ENABLED, &fs_info->flags); - goto out; - } - - if (!fs_info->quota_root) - goto out; - -- clear_bit(BTRFS_FS_QUOTA_ENABLED, &fs_info->flags); -- btrfs_qgroup_wait_for_completion(fs_info, false); - spin_lock(&fs_info->qgroup_lock); - quota_root = fs_info->quota_root; - fs_info->quota_root = NULL; -@@ -3304,6 +3318,9 @@ qgroup_rescan_init(struct btrfs_fs_info *fs_info, u64 progress_objectid, - btrfs_warn(fs_info, - "qgroup rescan init failed, qgroup is not enabled"); - ret = -EINVAL; -+ } else if (!test_bit(BTRFS_FS_QUOTA_ENABLED, &fs_info->flags)) { -+ /* Quota disable is in progress */ -+ ret = -EBUSY; - } - - if (ret) { -diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c -index cdb10e9fded65..8f665aa1d706e 100644 ---- a/fs/ext4/inline.c -+++ b/fs/ext4/inline.c -@@ -1120,7 +1120,15 @@ static void ext4_restore_inline_data(handle_t *handle, struct inode *inode, - struct ext4_iloc *iloc, - void *buf, int inline_size) - { -- ext4_create_inline_data(handle, inode, inline_size); -+ int ret; -+ -+ ret = ext4_create_inline_data(handle, inode, inline_size); -+ if (ret) { -+ ext4_msg(inode->i_sb, KERN_EMERG, -+ "error restoring inline_data for inode -- potential data loss! (inode %lu, error %d)", -+ inode->i_ino, ret); -+ return; -+ } - ext4_write_inline_data(inode, iloc, buf, 0, inline_size); - ext4_set_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA); - } -diff --git a/fs/fs_context.c b/fs/fs_context.c -index a2367c7aef5b3..e492a83fa100e 100644 ---- a/fs/fs_context.c -+++ b/fs/fs_context.c -@@ -258,7 +258,7 @@ static struct fs_context *alloc_fs_context(struct file_system_type *fs_type, - struct fs_context *fc; - int ret = -ENOMEM; - -- fc = kzalloc(sizeof(struct fs_context), GFP_KERNEL); -+ fc = kzalloc(sizeof(struct fs_context), GFP_KERNEL_ACCOUNT); - if (!fc) - return ERR_PTR(-ENOMEM); - -@@ -686,7 +686,7 @@ const struct fs_context_operations legacy_fs_context_ops = { - */ - static int legacy_init_fs_context(struct fs_context *fc) - { -- fc->fs_private = kzalloc(sizeof(struct legacy_fs_context), GFP_KERNEL); -+ fc->fs_private = kzalloc(sizeof(struct legacy_fs_context), GFP_KERNEL_ACCOUNT); - if (!fc->fs_private) - return -ENOMEM; - fc->ops = &legacy_fs_context_ops; -diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c -index a48fcd4180c74..62eb78ac7437f 100644 ---- a/fs/nfsd/nfs4state.c -+++ b/fs/nfsd/nfs4state.c -@@ -3941,8 +3941,10 @@ nfsd4_setclientid_confirm(struct svc_rqst *rqstp, - status = nfserr_clid_inuse; - if (client_has_state(old) - && !same_creds(&unconf->cl_cred, -- &old->cl_cred)) -+ &old->cl_cred)) { -+ old = NULL; - goto out; -+ } - status = mark_client_expired_locked(old); - if (status) { - old = NULL; -diff --git a/kernel/audit.c b/kernel/audit.c -index 146edff0c73ec..db8141866ceaa 100644 ---- a/kernel/audit.c -+++ b/kernel/audit.c -@@ -535,20 +535,22 @@ static void kauditd_printk_skb(struct sk_buff *skb) - /** - * kauditd_rehold_skb - Handle a audit record send failure in the hold queue - * @skb: audit record -+ * @error: error code (unused) - * - * Description: - * This should only be used by the kauditd_thread when it fails to flush the - * hold queue. - */ --static void kauditd_rehold_skb(struct sk_buff *skb) -+static void kauditd_rehold_skb(struct sk_buff *skb, __always_unused int error) - { -- /* put the record back in the queue at the same place */ -- skb_queue_head(&audit_hold_queue, skb); -+ /* put the record back in the queue */ -+ skb_queue_tail(&audit_hold_queue, skb); - } - - /** - * kauditd_hold_skb - Queue an audit record, waiting for auditd - * @skb: audit record -+ * @error: error code - * - * Description: - * Queue the audit record, waiting for an instance of auditd. When this -@@ -558,19 +560,31 @@ static void kauditd_rehold_skb(struct sk_buff *skb) - * and queue it, if we have room. If we want to hold on to the record, but we - * don't have room, record a record lost message. - */ --static void kauditd_hold_skb(struct sk_buff *skb) -+static void kauditd_hold_skb(struct sk_buff *skb, int error) - { - /* at this point it is uncertain if we will ever send this to auditd so - * try to send the message via printk before we go any further */ - kauditd_printk_skb(skb); - - /* can we just silently drop the message? */ -- if (!audit_default) { -- kfree_skb(skb); -- return; -+ if (!audit_default) -+ goto drop; -+ -+ /* the hold queue is only for when the daemon goes away completely, -+ * not -EAGAIN failures; if we are in a -EAGAIN state requeue the -+ * record on the retry queue unless it's full, in which case drop it -+ */ -+ if (error == -EAGAIN) { -+ if (!audit_backlog_limit || -+ skb_queue_len(&audit_retry_queue) < audit_backlog_limit) { -+ skb_queue_tail(&audit_retry_queue, skb); -+ return; -+ } -+ audit_log_lost("kauditd retry queue overflow"); -+ goto drop; - } - -- /* if we have room, queue the message */ -+ /* if we have room in the hold queue, queue the message */ - if (!audit_backlog_limit || - skb_queue_len(&audit_hold_queue) < audit_backlog_limit) { - skb_queue_tail(&audit_hold_queue, skb); -@@ -579,24 +593,32 @@ static void kauditd_hold_skb(struct sk_buff *skb) - - /* we have no other options - drop the message */ - audit_log_lost("kauditd hold queue overflow"); -+drop: - kfree_skb(skb); - } - - /** - * kauditd_retry_skb - Queue an audit record, attempt to send again to auditd - * @skb: audit record -+ * @error: error code (unused) - * - * Description: - * Not as serious as kauditd_hold_skb() as we still have a connected auditd, - * but for some reason we are having problems sending it audit records so - * queue the given record and attempt to resend. - */ --static void kauditd_retry_skb(struct sk_buff *skb) -+static void kauditd_retry_skb(struct sk_buff *skb, __always_unused int error) - { -- /* NOTE: because records should only live in the retry queue for a -- * short period of time, before either being sent or moved to the hold -- * queue, we don't currently enforce a limit on this queue */ -- skb_queue_tail(&audit_retry_queue, skb); -+ if (!audit_backlog_limit || -+ skb_queue_len(&audit_retry_queue) < audit_backlog_limit) { -+ skb_queue_tail(&audit_retry_queue, skb); -+ return; -+ } -+ -+ /* we have to drop the record, send it via printk as a last effort */ -+ kauditd_printk_skb(skb); -+ audit_log_lost("kauditd retry queue overflow"); -+ kfree_skb(skb); - } - - /** -@@ -634,7 +656,7 @@ static void auditd_reset(const struct auditd_connection *ac) - /* flush the retry queue to the hold queue, but don't touch the main - * queue since we need to process that normally for multicast */ - while ((skb = skb_dequeue(&audit_retry_queue))) -- kauditd_hold_skb(skb); -+ kauditd_hold_skb(skb, -ECONNREFUSED); - } - - /** -@@ -708,16 +730,18 @@ static int kauditd_send_queue(struct sock *sk, u32 portid, - struct sk_buff_head *queue, - unsigned int retry_limit, - void (*skb_hook)(struct sk_buff *skb), -- void (*err_hook)(struct sk_buff *skb)) -+ void (*err_hook)(struct sk_buff *skb, int error)) - { - int rc = 0; -- struct sk_buff *skb; -+ struct sk_buff *skb = NULL; -+ struct sk_buff *skb_tail; - unsigned int failed = 0; - - /* NOTE: kauditd_thread takes care of all our locking, we just use - * the netlink info passed to us (e.g. sk and portid) */ - -- while ((skb = skb_dequeue(queue))) { -+ skb_tail = skb_peek_tail(queue); -+ while ((skb != skb_tail) && (skb = skb_dequeue(queue))) { - /* call the skb_hook for each skb we touch */ - if (skb_hook) - (*skb_hook)(skb); -@@ -725,7 +749,7 @@ static int kauditd_send_queue(struct sock *sk, u32 portid, - /* can we send to anyone via unicast? */ - if (!sk) { - if (err_hook) -- (*err_hook)(skb); -+ (*err_hook)(skb, -ECONNREFUSED); - continue; - } - -@@ -739,7 +763,7 @@ retry: - rc == -ECONNREFUSED || rc == -EPERM) { - sk = NULL; - if (err_hook) -- (*err_hook)(skb); -+ (*err_hook)(skb, rc); - if (rc == -EAGAIN) - rc = 0; - /* continue to drain the queue */ -diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c -index 411be8b2e837e..ad9dffed8411d 100644 ---- a/kernel/cgroup/cpuset.c -+++ b/kernel/cgroup/cpuset.c -@@ -1473,10 +1473,15 @@ static void update_sibling_cpumasks(struct cpuset *parent, struct cpuset *cs, - struct cpuset *sibling; - struct cgroup_subsys_state *pos_css; - -+ percpu_rwsem_assert_held(&cpuset_rwsem); -+ - /* - * Check all its siblings and call update_cpumasks_hier() - * if their use_parent_ecpus flag is set in order for them - * to use the right effective_cpus value. -+ * -+ * The update_cpumasks_hier() function may sleep. So we have to -+ * release the RCU read lock before calling it. - */ - rcu_read_lock(); - cpuset_for_each_child(sibling, pos_css, parent) { -@@ -1484,8 +1489,13 @@ static void update_sibling_cpumasks(struct cpuset *parent, struct cpuset *cs, - continue; - if (!sibling->use_parent_ecpus) - continue; -+ if (!css_tryget_online(&sibling->css)) -+ continue; - -+ rcu_read_unlock(); - update_cpumasks_hier(sibling, tmp); -+ rcu_read_lock(); -+ css_put(&sibling->css); - } - rcu_read_unlock(); - } -diff --git a/mm/kmemleak.c b/mm/kmemleak.c -index 312942d784058..4a669c81f4e22 100644 ---- a/mm/kmemleak.c -+++ b/mm/kmemleak.c -@@ -1399,7 +1399,8 @@ static void kmemleak_scan(void) - { - unsigned long flags; - struct kmemleak_object *object; -- int i; -+ struct zone *zone; -+ int __maybe_unused i; - int new_leaks = 0; - - jiffies_last_scan = jiffies; -@@ -1439,9 +1440,9 @@ static void kmemleak_scan(void) - * Struct page scanning for each node. - */ - get_online_mems(); -- for_each_online_node(i) { -- unsigned long start_pfn = node_start_pfn(i); -- unsigned long end_pfn = node_end_pfn(i); -+ for_each_populated_zone(zone) { -+ unsigned long start_pfn = zone->zone_start_pfn; -+ unsigned long end_pfn = zone_end_pfn(zone); - unsigned long pfn; - - for (pfn = start_pfn; pfn < end_pfn; pfn++) { -@@ -1450,8 +1451,8 @@ static void kmemleak_scan(void) - if (!page) - continue; - -- /* only scan pages belonging to this node */ -- if (page_to_nid(page) != i) -+ /* only scan pages belonging to this zone */ -+ if (page_zone(page) != zone) - continue; - /* only scan if page is in use */ - if (page_count(page) == 0) -diff --git a/net/ieee802154/nl802154.c b/net/ieee802154/nl802154.c -index b2ba1d2556f14..e0df892b5c370 100644 ---- a/net/ieee802154/nl802154.c -+++ b/net/ieee802154/nl802154.c -@@ -1457,7 +1457,7 @@ static int nl802154_send_key(struct sk_buff *msg, u32 cmd, u32 portid, - - hdr = nl802154hdr_put(msg, portid, seq, flags, cmd); - if (!hdr) -- return -1; -+ return -ENOBUFS; - - if (nla_put_u32(msg, NL802154_ATTR_IFINDEX, dev->ifindex)) - goto nla_put_failure; -@@ -1650,7 +1650,7 @@ static int nl802154_send_device(struct sk_buff *msg, u32 cmd, u32 portid, - - hdr = nl802154hdr_put(msg, portid, seq, flags, cmd); - if (!hdr) -- return -1; -+ return -ENOBUFS; - - if (nla_put_u32(msg, NL802154_ATTR_IFINDEX, dev->ifindex)) - goto nla_put_failure; -@@ -1828,7 +1828,7 @@ static int nl802154_send_devkey(struct sk_buff *msg, u32 cmd, u32 portid, - - hdr = nl802154hdr_put(msg, portid, seq, flags, cmd); - if (!hdr) -- return -1; -+ return -ENOBUFS; - - if (nla_put_u32(msg, NL802154_ATTR_IFINDEX, dev->ifindex)) - goto nla_put_failure; -@@ -2004,7 +2004,7 @@ static int nl802154_send_seclevel(struct sk_buff *msg, u32 cmd, u32 portid, - - hdr = nl802154hdr_put(msg, portid, seq, flags, cmd); - if (!hdr) -- return -1; -+ return -ENOBUFS; - - if (nla_put_u32(msg, NL802154_ATTR_IFINDEX, dev->ifindex)) - goto nla_put_failure; -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index d06205626cd54..c03448ea8a203 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -2122,6 +2122,7 @@ static void alc1220_fixup_gb_x570(struct hda_codec *codec, - { - static const hda_nid_t conn1[] = { 0x0c }; - static const struct coef_fw gb_x570_coefs[] = { -+ WRITE_COEF(0x07, 0x03c0), - WRITE_COEF(0x1a, 0x01c1), - WRITE_COEF(0x1b, 0x0202), - WRITE_COEF(0x43, 0x3005), -@@ -2548,7 +2549,8 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = { - SND_PCI_QUIRK(0x1458, 0xa002, "Gigabyte EP45-DS3/Z87X-UD3H", ALC889_FIXUP_FRONT_HP_NO_PRESENCE), - SND_PCI_QUIRK(0x1458, 0xa0b8, "Gigabyte AZ370-Gaming", ALC1220_FIXUP_GB_DUAL_CODECS), - SND_PCI_QUIRK(0x1458, 0xa0cd, "Gigabyte X570 Aorus Master", ALC1220_FIXUP_GB_X570), -- SND_PCI_QUIRK(0x1458, 0xa0ce, "Gigabyte X570 Aorus Xtreme", ALC1220_FIXUP_CLEVO_P950), -+ SND_PCI_QUIRK(0x1458, 0xa0ce, "Gigabyte X570 Aorus Xtreme", ALC1220_FIXUP_GB_X570), -+ SND_PCI_QUIRK(0x1458, 0xa0d5, "Gigabyte X570S Aorus Master", ALC1220_FIXUP_GB_X570), - SND_PCI_QUIRK(0x1462, 0x11f7, "MSI-GE63", ALC1220_FIXUP_CLEVO_P950), - SND_PCI_QUIRK(0x1462, 0x1228, "MSI-GP63", ALC1220_FIXUP_CLEVO_P950), - SND_PCI_QUIRK(0x1462, 0x1229, "MSI-GP73", ALC1220_FIXUP_CLEVO_P950), -@@ -2623,6 +2625,7 @@ static const struct hda_model_fixup alc882_fixup_models[] = { - {.id = ALC882_FIXUP_NO_PRIMARY_HP, .name = "no-primary-hp"}, - {.id = ALC887_FIXUP_ASUS_BASS, .name = "asus-bass"}, - {.id = ALC1220_FIXUP_GB_DUAL_CODECS, .name = "dual-codecs"}, -+ {.id = ALC1220_FIXUP_GB_X570, .name = "gb-x570"}, - {.id = ALC1220_FIXUP_CLEVO_P950, .name = "clevo-p950"}, - {} - }; -@@ -8180,6 +8183,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x1043, 0x1e51, "ASUS Zephyrus M15", ALC294_FIXUP_ASUS_GU502_PINS), - SND_PCI_QUIRK(0x1043, 0x1e8e, "ASUS Zephyrus G15", ALC289_FIXUP_ASUS_GA401), - SND_PCI_QUIRK(0x1043, 0x1f11, "ASUS Zephyrus G14", ALC289_FIXUP_ASUS_GA401), -+ SND_PCI_QUIRK(0x1043, 0x16b2, "ASUS GU603", ALC289_FIXUP_ASUS_GA401), - SND_PCI_QUIRK(0x1043, 0x3030, "ASUS ZN270IE", ALC256_FIXUP_ASUS_AIO_GPIO2), - SND_PCI_QUIRK(0x1043, 0x831a, "ASUS P901", ALC269_FIXUP_STEREO_DMIC), - SND_PCI_QUIRK(0x1043, 0x834a, "ASUS S101", ALC269_FIXUP_STEREO_DMIC), -diff --git a/sound/soc/codecs/cpcap.c b/sound/soc/codecs/cpcap.c -index 1902689c5ea2c..acd88fe38cd4c 100644 ---- a/sound/soc/codecs/cpcap.c -+++ b/sound/soc/codecs/cpcap.c -@@ -1541,6 +1541,8 @@ static int cpcap_codec_probe(struct platform_device *pdev) - { - struct device_node *codec_node = - of_get_child_by_name(pdev->dev.parent->of_node, "audio-codec"); -+ if (!codec_node) -+ return -ENODEV; - - pdev->dev.of_node = codec_node; - -diff --git a/sound/soc/codecs/max9759.c b/sound/soc/codecs/max9759.c -index 00e9d4fd1651f..0c261335c8a16 100644 ---- a/sound/soc/codecs/max9759.c -+++ b/sound/soc/codecs/max9759.c -@@ -64,7 +64,8 @@ static int speaker_gain_control_put(struct snd_kcontrol *kcontrol, - struct snd_soc_component *c = snd_soc_kcontrol_component(kcontrol); - struct max9759 *priv = snd_soc_component_get_drvdata(c); - -- if (ucontrol->value.integer.value[0] > 3) -+ if (ucontrol->value.integer.value[0] < 0 || -+ ucontrol->value.integer.value[0] > 3) - return -EINVAL; - - priv->gain = ucontrol->value.integer.value[0]; -diff --git a/sound/soc/fsl/pcm030-audio-fabric.c b/sound/soc/fsl/pcm030-audio-fabric.c -index af3c3b90c0aca..83b4a22bf15ac 100644 ---- a/sound/soc/fsl/pcm030-audio-fabric.c -+++ b/sound/soc/fsl/pcm030-audio-fabric.c -@@ -93,16 +93,21 @@ static int pcm030_fabric_probe(struct platform_device *op) - dev_err(&op->dev, "platform_device_alloc() failed\n"); - - ret = platform_device_add(pdata->codec_device); -- if (ret) -+ if (ret) { - dev_err(&op->dev, "platform_device_add() failed: %d\n", ret); -+ platform_device_put(pdata->codec_device); -+ } - - ret = snd_soc_register_card(card); -- if (ret) -+ if (ret) { - dev_err(&op->dev, "snd_soc_register_card() failed: %d\n", ret); -+ platform_device_del(pdata->codec_device); -+ platform_device_put(pdata->codec_device); -+ } - - platform_set_drvdata(op, pdata); -- - return ret; -+ - } - - static int pcm030_fabric_remove(struct platform_device *op) -diff --git a/sound/soc/soc-ops.c b/sound/soc/soc-ops.c -index 95fc24580f85f..ef8fd331526b0 100644 ---- a/sound/soc/soc-ops.c -+++ b/sound/soc/soc-ops.c -@@ -322,13 +322,27 @@ int snd_soc_put_volsw(struct snd_kcontrol *kcontrol, - if (sign_bit) - mask = BIT(sign_bit + 1) - 1; - -- val = ((ucontrol->value.integer.value[0] + min) & mask); -+ val = ucontrol->value.integer.value[0]; -+ if (mc->platform_max && val > mc->platform_max) -+ return -EINVAL; -+ if (val > max - min) -+ return -EINVAL; -+ if (val < 0) -+ return -EINVAL; -+ val = (val + min) & mask; - if (invert) - val = max - val; - val_mask = mask << shift; - val = val << shift; - if (snd_soc_volsw_is_stereo(mc)) { -- val2 = ((ucontrol->value.integer.value[1] + min) & mask); -+ val2 = ucontrol->value.integer.value[1]; -+ if (mc->platform_max && val2 > mc->platform_max) -+ return -EINVAL; -+ if (val2 > max - min) -+ return -EINVAL; -+ if (val2 < 0) -+ return -EINVAL; -+ val2 = (val2 + min) & mask; - if (invert) - val2 = max - val2; - if (reg == reg2) { -@@ -422,8 +436,15 @@ int snd_soc_put_volsw_sx(struct snd_kcontrol *kcontrol, - int err = 0; - unsigned int val, val_mask, val2 = 0; - -+ val = ucontrol->value.integer.value[0]; -+ if (mc->platform_max && val > mc->platform_max) -+ return -EINVAL; -+ if (val > max - min) -+ return -EINVAL; -+ if (val < 0) -+ return -EINVAL; - val_mask = mask << shift; -- val = (ucontrol->value.integer.value[0] + min) & mask; -+ val = (val + min) & mask; - val = val << shift; - - err = snd_soc_component_update_bits(component, reg, val_mask, val); -@@ -889,6 +910,8 @@ int snd_soc_put_xr_sx(struct snd_kcontrol *kcontrol, - unsigned int i, regval, regmask; - int err; - -+ if (val < mc->min || val > mc->max) -+ return -EINVAL; - if (invert) - val = max - val; - val &= mask; -diff --git a/sound/soc/xilinx/xlnx_formatter_pcm.c b/sound/soc/xilinx/xlnx_formatter_pcm.c -index 1f15c11782ec4..4caee57114b88 100644 ---- a/sound/soc/xilinx/xlnx_formatter_pcm.c -+++ b/sound/soc/xilinx/xlnx_formatter_pcm.c -@@ -37,6 +37,7 @@ - #define XLNX_AUD_XFER_COUNT 0x28 - #define XLNX_AUD_CH_STS_START 0x2C - #define XLNX_BYTES_PER_CH 0x44 -+#define XLNX_AUD_ALIGN_BYTES 64 - - #define AUD_STS_IOC_IRQ_MASK BIT(31) - #define AUD_STS_CH_STS_MASK BIT(29) -@@ -370,12 +371,32 @@ static int xlnx_formatter_pcm_open(struct snd_pcm_substream *substream) - snd_soc_set_runtime_hwparams(substream, &xlnx_pcm_hardware); - runtime->private_data = stream_data; - -- /* Resize the period size divisible by 64 */ -+ /* Resize the period bytes as divisible by 64 */ - err = snd_pcm_hw_constraint_step(runtime, 0, -- SNDRV_PCM_HW_PARAM_PERIOD_BYTES, 64); -+ SNDRV_PCM_HW_PARAM_PERIOD_BYTES, -+ XLNX_AUD_ALIGN_BYTES); - if (err) { - dev_err(component->dev, -- "unable to set constraint on period bytes\n"); -+ "Unable to set constraint on period bytes\n"); -+ return err; -+ } -+ -+ /* Resize the buffer bytes as divisible by 64 */ -+ err = snd_pcm_hw_constraint_step(runtime, 0, -+ SNDRV_PCM_HW_PARAM_BUFFER_BYTES, -+ XLNX_AUD_ALIGN_BYTES); -+ if (err) { -+ dev_err(component->dev, -+ "Unable to set constraint on buffer bytes\n"); -+ return err; -+ } -+ -+ /* Set periods as integer multiple */ -+ err = snd_pcm_hw_constraint_integer(runtime, -+ SNDRV_PCM_HW_PARAM_PERIODS); -+ if (err < 0) { -+ dev_err(component->dev, -+ "Unable to set constraint on periods to be integer\n"); - return err; - } - -diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h -index 01dee2074ab36..c29ccdf9e8bca 100644 ---- a/sound/usb/quirks-table.h -+++ b/sound/usb/quirks-table.h -@@ -25,6 +25,16 @@ - .idProduct = prod, \ - .bInterfaceClass = USB_CLASS_VENDOR_SPEC - -+/* A standard entry matching with vid/pid and the audio class/subclass */ -+#define USB_AUDIO_DEVICE(vend, prod) \ -+ .match_flags = USB_DEVICE_ID_MATCH_DEVICE | \ -+ USB_DEVICE_ID_MATCH_INT_CLASS | \ -+ USB_DEVICE_ID_MATCH_INT_SUBCLASS, \ -+ .idVendor = vend, \ -+ .idProduct = prod, \ -+ .bInterfaceClass = USB_CLASS_AUDIO, \ -+ .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL -+ - /* HP Thunderbolt Dock Audio Headset */ - { - USB_DEVICE(0x03f0, 0x0269), -diff --git a/tools/testing/selftests/futex/Makefile b/tools/testing/selftests/futex/Makefile -index 12631f0076a10..11e157d7533b8 100644 ---- a/tools/testing/selftests/futex/Makefile -+++ b/tools/testing/selftests/futex/Makefile -@@ -11,7 +11,7 @@ all: - @for DIR in $(SUBDIRS); do \ - BUILD_TARGET=$(OUTPUT)/$$DIR; \ - mkdir $$BUILD_TARGET -p; \ -- make OUTPUT=$$BUILD_TARGET -C $$DIR $@;\ -+ $(MAKE) OUTPUT=$$BUILD_TARGET -C $$DIR $@;\ - if [ -e $$DIR/$(TEST_PROGS) ]; then \ - rsync -a $$DIR/$(TEST_PROGS) $$BUILD_TARGET/; \ - fi \ -@@ -32,6 +32,6 @@ override define CLEAN - @for DIR in $(SUBDIRS); do \ - BUILD_TARGET=$(OUTPUT)/$$DIR; \ - mkdir $$BUILD_TARGET -p; \ -- make OUTPUT=$$BUILD_TARGET -C $$DIR $@;\ -+ $(MAKE) OUTPUT=$$BUILD_TARGET -C $$DIR $@;\ - done - endef diff --git a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.178-179.patch b/patch/kernel/archive/odroidxu4-5.4/patch-5.4.178-179.patch deleted file mode 100644 index 78764c5d0..000000000 --- a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.178-179.patch +++ /dev/null @@ -1,79 +0,0 @@ -diff --git a/Makefile b/Makefile -index 6d33284664fef..5688e17a44363 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 5 - PATCHLEVEL = 4 --SUBLEVEL = 178 -+SUBLEVEL = 179 - EXTRAVERSION = - NAME = Kleptomaniac Octopus - -diff --git a/drivers/mmc/host/moxart-mmc.c b/drivers/mmc/host/moxart-mmc.c -index 5553a5643f405..5c81dc7371db7 100644 ---- a/drivers/mmc/host/moxart-mmc.c -+++ b/drivers/mmc/host/moxart-mmc.c -@@ -696,12 +696,12 @@ static int moxart_remove(struct platform_device *pdev) - if (!IS_ERR(host->dma_chan_rx)) - dma_release_channel(host->dma_chan_rx); - mmc_remove_host(mmc); -- mmc_free_host(mmc); - - writel(0, host->base + REG_INTERRUPT_MASK); - writel(0, host->base + REG_POWER_CONTROL); - writel(readl(host->base + REG_CLOCK_CONTROL) | CLK_OFF, - host->base + REG_CLOCK_CONTROL); -+ mmc_free_host(mmc); - } - return 0; - } -diff --git a/net/tipc/link.c b/net/tipc/link.c -index f25010261a9e0..8f2ee71c63c6d 100644 ---- a/net/tipc/link.c -+++ b/net/tipc/link.c -@@ -1953,15 +1953,18 @@ static int tipc_link_proto_rcv(struct tipc_link *l, struct sk_buff *skb, - u16 peers_tol = msg_link_tolerance(hdr); - u16 peers_prio = msg_linkprio(hdr); - u16 rcv_nxt = l->rcv_nxt; -- u16 dlen = msg_data_sz(hdr); -+ u32 dlen = msg_data_sz(hdr), glen = 0; - int mtyp = msg_type(hdr); - bool reply = msg_probe(hdr); -- u16 glen = 0; - void *data; - char *if_name; - int rc = 0; - - trace_tipc_proto_rcv(skb, false, l->name); -+ -+ if (dlen > U16_MAX) -+ goto exit; -+ - if (tipc_link_is_blocked(l) || !xmitq) - goto exit; - -@@ -2063,7 +2066,8 @@ static int tipc_link_proto_rcv(struct tipc_link *l, struct sk_buff *skb, - if (glen != tipc_gap_ack_blks_sz(ga->gack_cnt)) - ga = NULL; - } -- -+ if(glen > dlen) -+ break; - tipc_mon_rcv(l->net, data + glen, dlen - glen, l->addr, - &l->mon_state, l->bearer_id); - -diff --git a/net/tipc/monitor.c b/net/tipc/monitor.c -index 58708b4c7719f..e7155a7743001 100644 ---- a/net/tipc/monitor.c -+++ b/net/tipc/monitor.c -@@ -457,6 +457,8 @@ void tipc_mon_rcv(struct net *net, void *data, u16 dlen, u32 addr, - state->probing = false; - - /* Sanity check received domain record */ -+ if (new_member_cnt > MAX_MON_DOMAIN) -+ return; - if (dlen < dom_rec_len(arrv_dom, 0)) - return; - if (dlen != dom_rec_len(arrv_dom, new_member_cnt)) diff --git a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.179-180.patch b/patch/kernel/archive/odroidxu4-5.4/patch-5.4.179-180.patch deleted file mode 100644 index b597b2343..000000000 --- a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.179-180.patch +++ /dev/null @@ -1,2075 +0,0 @@ -diff --git a/Documentation/admin-guide/sysctl/kernel.rst b/Documentation/admin-guide/sysctl/kernel.rst -index 032c7cd3cede0..7b477fa19534d 100644 ---- a/Documentation/admin-guide/sysctl/kernel.rst -+++ b/Documentation/admin-guide/sysctl/kernel.rst -@@ -1125,6 +1125,27 @@ NMI switch that most IA32 servers have fires unknown NMI up, for - example. If a system hangs up, try pressing the NMI switch. - - -+unprivileged_bpf_disabled: -+========================== -+ -+Writing 1 to this entry will disable unprivileged calls to ``bpf()``; -+once disabled, calling ``bpf()`` without ``CAP_SYS_ADMIN`` will return -+``-EPERM``. Once set to 1, this can't be cleared from the running kernel -+anymore. -+ -+Writing 2 to this entry will also disable unprivileged calls to ``bpf()``, -+however, an admin can still change this setting later on, if needed, by -+writing 0 or 1 to this entry. -+ -+If ``BPF_UNPRIV_DEFAULT_OFF`` is enabled in the kernel config, then this -+entry will default to 2 instead of 0. -+ -+= ============================================================= -+0 Unprivileged calls to ``bpf()`` are enabled -+1 Unprivileged calls to ``bpf()`` are disabled without recovery -+2 Unprivileged calls to ``bpf()`` are disabled -+= ============================================================= -+ - watchdog: - ========= - -diff --git a/Makefile b/Makefile -index 5688e17a44363..6eb6645647147 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 5 - PATCHLEVEL = 4 --SUBLEVEL = 179 -+SUBLEVEL = 180 - EXTRAVERSION = - NAME = Kleptomaniac Octopus - -diff --git a/arch/arm/boot/dts/imx23-evk.dts b/arch/arm/boot/dts/imx23-evk.dts -index 0b2701ca29212..858b8057e8540 100644 ---- a/arch/arm/boot/dts/imx23-evk.dts -+++ b/arch/arm/boot/dts/imx23-evk.dts -@@ -79,7 +79,6 @@ - MX23_PAD_LCD_RESET__GPIO_1_18 - MX23_PAD_PWM3__GPIO_1_29 - MX23_PAD_PWM4__GPIO_1_30 -- MX23_PAD_SSP1_DETECT__SSP1_DETECT - >; - fsl,drive-strength = ; - fsl,voltage = ; -diff --git a/arch/arm/boot/dts/imx6qdl-udoo.dtsi b/arch/arm/boot/dts/imx6qdl-udoo.dtsi -index 16672cbada287..6c8da3f037335 100644 ---- a/arch/arm/boot/dts/imx6qdl-udoo.dtsi -+++ b/arch/arm/boot/dts/imx6qdl-udoo.dtsi -@@ -5,6 +5,8 @@ - * Author: Fabio Estevam - */ - -+#include -+ - / { - aliases { - backlight = &backlight; -@@ -218,6 +220,7 @@ - MX6QDL_PAD_SD3_DAT1__SD3_DATA1 0x17059 - MX6QDL_PAD_SD3_DAT2__SD3_DATA2 0x17059 - MX6QDL_PAD_SD3_DAT3__SD3_DATA3 0x17059 -+ MX6QDL_PAD_SD3_DAT5__GPIO7_IO00 0x1b0b0 - >; - }; - -@@ -290,7 +293,7 @@ - &usdhc3 { - pinctrl-names = "default"; - pinctrl-0 = <&pinctrl_usdhc3>; -- non-removable; -+ cd-gpios = <&gpio7 0 GPIO_ACTIVE_LOW>; - status = "okay"; - }; - -diff --git a/arch/arm/boot/dts/meson.dtsi b/arch/arm/boot/dts/meson.dtsi -index c4447f6c8b2cb..e141ce7484841 100644 ---- a/arch/arm/boot/dts/meson.dtsi -+++ b/arch/arm/boot/dts/meson.dtsi -@@ -49,14 +49,14 @@ - }; - - uart_A: serial@84c0 { -- compatible = "amlogic,meson6-uart", "amlogic,meson-uart"; -+ compatible = "amlogic,meson6-uart"; - reg = <0x84c0 0x18>; - interrupts = ; - status = "disabled"; - }; - - uart_B: serial@84dc { -- compatible = "amlogic,meson6-uart", "amlogic,meson-uart"; -+ compatible = "amlogic,meson6-uart"; - reg = <0x84dc 0x18>; - interrupts = ; - status = "disabled"; -@@ -94,7 +94,7 @@ - }; - - uart_C: serial@8700 { -- compatible = "amlogic,meson6-uart", "amlogic,meson-uart"; -+ compatible = "amlogic,meson6-uart"; - reg = <0x8700 0x18>; - interrupts = ; - status = "disabled"; -@@ -196,7 +196,7 @@ - }; - - uart_AO: serial@4c0 { -- compatible = "amlogic,meson6-uart", "amlogic,meson-ao-uart", "amlogic,meson-uart"; -+ compatible = "amlogic,meson6-uart", "amlogic,meson-ao-uart"; - reg = <0x4c0 0x18>; - interrupts = ; - status = "disabled"; -diff --git a/arch/arm/mach-socfpga/Kconfig b/arch/arm/mach-socfpga/Kconfig -index 22af5e308db6c..61b872792c4cb 100644 ---- a/arch/arm/mach-socfpga/Kconfig -+++ b/arch/arm/mach-socfpga/Kconfig -@@ -2,6 +2,7 @@ - menuconfig ARCH_SOCFPGA - bool "Altera SOCFPGA family" - depends on ARCH_MULTI_V7 -+ select ARCH_HAS_RESET_CONTROLLER - select ARCH_SUPPORTS_BIG_ENDIAN - select ARM_AMBA - select ARM_GIC -@@ -19,6 +20,7 @@ menuconfig ARCH_SOCFPGA - select PL310_ERRATA_727915 - select PL310_ERRATA_753970 if PL310 - select PL310_ERRATA_769419 -+ select RESET_CONTROLLER - - if ARCH_SOCFPGA - config SOCFPGA_SUSPEND -diff --git a/arch/riscv/Makefile b/arch/riscv/Makefile -index 1cbe0ad78b0f3..7b579a003e30a 100644 ---- a/arch/riscv/Makefile -+++ b/arch/riscv/Makefile -@@ -48,6 +48,12 @@ riscv-march-$(CONFIG_ARCH_RV32I) := rv32ima - riscv-march-$(CONFIG_ARCH_RV64I) := rv64ima - riscv-march-$(CONFIG_FPU) := $(riscv-march-y)fd - riscv-march-$(CONFIG_RISCV_ISA_C) := $(riscv-march-y)c -+ -+# Newer binutils versions default to ISA spec version 20191213 which moves some -+# instructions from the I extension to the Zicsr and Zifencei extensions. -+toolchain-need-zicsr-zifencei := $(call cc-option-yn, -march=$(riscv-march-y)_zicsr_zifencei) -+riscv-march-$(toolchain-need-zicsr-zifencei) := $(riscv-march-y)_zicsr_zifencei -+ - KBUILD_CFLAGS += -march=$(subst fd,,$(riscv-march-y)) - KBUILD_AFLAGS += -march=$(riscv-march-y) - -diff --git a/arch/x86/kvm/vmx/evmcs.h b/arch/x86/kvm/vmx/evmcs.h -index 07ebf6882a458..632bed227152e 100644 ---- a/arch/x86/kvm/vmx/evmcs.h -+++ b/arch/x86/kvm/vmx/evmcs.h -@@ -58,7 +58,9 @@ DECLARE_STATIC_KEY_FALSE(enable_evmcs); - SECONDARY_EXEC_SHADOW_VMCS | \ - SECONDARY_EXEC_TSC_SCALING | \ - SECONDARY_EXEC_PAUSE_LOOP_EXITING) --#define EVMCS1_UNSUPPORTED_VMEXIT_CTRL (VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL) -+#define EVMCS1_UNSUPPORTED_VMEXIT_CTRL \ -+ (VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL | \ -+ VM_EXIT_SAVE_VMX_PREEMPTION_TIMER) - #define EVMCS1_UNSUPPORTED_VMENTRY_CTRL (VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL) - #define EVMCS1_UNSUPPORTED_VMFUNC (VMX_VMFUNC_EPTP_SWITCHING) - -diff --git a/drivers/acpi/arm64/iort.c b/drivers/acpi/arm64/iort.c -index bc95a5eebd137..553c89b0bdcbb 100644 ---- a/drivers/acpi/arm64/iort.c -+++ b/drivers/acpi/arm64/iort.c -@@ -1373,9 +1373,17 @@ static void __init arm_smmu_v3_pmcg_init_resources(struct resource *res, - res[0].start = pmcg->page0_base_address; - res[0].end = pmcg->page0_base_address + SZ_4K - 1; - res[0].flags = IORESOURCE_MEM; -- res[1].start = pmcg->page1_base_address; -- res[1].end = pmcg->page1_base_address + SZ_4K - 1; -- res[1].flags = IORESOURCE_MEM; -+ /* -+ * The initial version in DEN0049C lacked a way to describe register -+ * page 1, which makes it broken for most PMCG implementations; in -+ * that case, just let the driver fail gracefully if it expects to -+ * find a second memory resource. -+ */ -+ if (node->revision > 0) { -+ res[1].start = pmcg->page1_base_address; -+ res[1].end = pmcg->page1_base_address + SZ_4K - 1; -+ res[1].flags = IORESOURCE_MEM; -+ } - - if (pmcg->overflow_gsiv) - acpi_iort_register_irq(pmcg->overflow_gsiv, "overflow", -diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c -index e5b92958c299e..ce9a570f217ad 100644 ---- a/drivers/acpi/ec.c -+++ b/drivers/acpi/ec.c -@@ -2002,6 +2002,16 @@ bool acpi_ec_dispatch_gpe(void) - if (acpi_any_gpe_status_set(first_ec->gpe)) - return true; - -+ /* -+ * Cancel the SCI wakeup and process all pending events in case there -+ * are any wakeup ones in there. -+ * -+ * Note that if any non-EC GPEs are active at this point, the SCI will -+ * retrigger after the rearming in acpi_s2idle_wake(), so no events -+ * should be missed by canceling the wakeup here. -+ */ -+ pm_system_cancel_wakeup(); -+ - /* - * Dispatch the EC GPE in-band, but do not report wakeup in any case - * to allow the caller to process events properly after that. -diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c -index d1b74179d2179..cd590b4793e09 100644 ---- a/drivers/acpi/sleep.c -+++ b/drivers/acpi/sleep.c -@@ -1003,19 +1003,13 @@ static bool acpi_s2idle_wake(void) - if (acpi_check_wakeup_handlers()) - return true; - -- /* Check non-EC GPE wakeups and dispatch the EC GPE. */ -+ /* -+ * Check non-EC GPE wakeups and if there are none, cancel the -+ * SCI-related wakeup and dispatch the EC GPE. -+ */ - if (acpi_ec_dispatch_gpe()) - return true; - -- /* -- * Cancel the SCI wakeup and process all pending events in case -- * there are any wakeup ones in there. -- * -- * Note that if any non-EC GPEs are active at this point, the -- * SCI will retrigger after the rearming below, so no events -- * should be missed by canceling the wakeup here. -- */ -- pm_system_cancel_wakeup(); - acpi_os_wait_events_complete(); - - /* -@@ -1027,6 +1021,7 @@ static bool acpi_s2idle_wake(void) - if (pm_wakeup_pending()) - return true; - -+ pm_wakeup_clear(acpi_sci_irq); - rearm_wake_irq(acpi_sci_irq); - } - -diff --git a/drivers/base/power/wakeup.c b/drivers/base/power/wakeup.c -index 92f0960e90145..49082c5570deb 100644 ---- a/drivers/base/power/wakeup.c -+++ b/drivers/base/power/wakeup.c -@@ -31,7 +31,8 @@ suspend_state_t pm_suspend_target_state; - bool events_check_enabled __read_mostly; - - /* First wakeup IRQ seen by the kernel in the last cycle. */ --unsigned int pm_wakeup_irq __read_mostly; -+static unsigned int wakeup_irq[2] __read_mostly; -+static DEFINE_RAW_SPINLOCK(wakeup_irq_lock); - - /* If greater than 0 and the system is suspending, terminate the suspend. */ - static atomic_t pm_abort_suspend __read_mostly; -@@ -884,19 +885,45 @@ void pm_system_cancel_wakeup(void) - atomic_dec_if_positive(&pm_abort_suspend); - } - --void pm_wakeup_clear(bool reset) -+void pm_wakeup_clear(unsigned int irq_number) - { -- pm_wakeup_irq = 0; -- if (reset) -+ raw_spin_lock_irq(&wakeup_irq_lock); -+ -+ if (irq_number && wakeup_irq[0] == irq_number) -+ wakeup_irq[0] = wakeup_irq[1]; -+ else -+ wakeup_irq[0] = 0; -+ -+ wakeup_irq[1] = 0; -+ -+ raw_spin_unlock_irq(&wakeup_irq_lock); -+ -+ if (!irq_number) - atomic_set(&pm_abort_suspend, 0); - } - - void pm_system_irq_wakeup(unsigned int irq_number) - { -- if (pm_wakeup_irq == 0) { -- pm_wakeup_irq = irq_number; -+ unsigned long flags; -+ -+ raw_spin_lock_irqsave(&wakeup_irq_lock, flags); -+ -+ if (wakeup_irq[0] == 0) -+ wakeup_irq[0] = irq_number; -+ else if (wakeup_irq[1] == 0) -+ wakeup_irq[1] = irq_number; -+ else -+ irq_number = 0; -+ -+ raw_spin_unlock_irqrestore(&wakeup_irq_lock, flags); -+ -+ if (irq_number) - pm_system_wakeup(); -- } -+} -+ -+unsigned int pm_wakeup_irq(void) -+{ -+ return wakeup_irq[0]; - } - - /** -diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c -index 9d1bd8f491ad7..448c2f2d803a6 100644 ---- a/drivers/gpu/drm/drm_panel_orientation_quirks.c -+++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c -@@ -115,6 +115,12 @@ static const struct drm_dmi_panel_orientation_data lcd1280x1920_rightside_up = { - .orientation = DRM_MODE_PANEL_ORIENTATION_RIGHT_UP, - }; - -+static const struct drm_dmi_panel_orientation_data lcd1600x2560_leftside_up = { -+ .width = 1600, -+ .height = 2560, -+ .orientation = DRM_MODE_PANEL_ORIENTATION_LEFT_UP, -+}; -+ - static const struct dmi_system_id orientation_data[] = { - { /* Acer One 10 (S1003) */ - .matches = { -@@ -261,6 +267,12 @@ static const struct dmi_system_id orientation_data[] = { - DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "Default string"), - }, - .driver_data = (void *)&onegx1_pro, -+ }, { /* OneXPlayer */ -+ .matches = { -+ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ONE-NETBOOK TECHNOLOGY CO., LTD."), -+ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "ONE XPLAYER"), -+ }, -+ .driver_data = (void *)&lcd1600x2560_leftside_up, - }, { /* Samsung GalaxyBook 10.6 */ - .matches = { - DMI_EXACT_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."), -diff --git a/drivers/hwmon/dell-smm-hwmon.c b/drivers/hwmon/dell-smm-hwmon.c -index 2eaed0008f376..785e7a07bb291 100644 ---- a/drivers/hwmon/dell-smm-hwmon.c -+++ b/drivers/hwmon/dell-smm-hwmon.c -@@ -301,7 +301,7 @@ static int i8k_get_fan_nominal_speed(int fan, int speed) - } - - /* -- * Set the fan speed (off, low, high). Returns the new fan status. -+ * Set the fan speed (off, low, high, ...). - */ - static int i8k_set_fan(int fan, int speed) - { -@@ -313,7 +313,7 @@ static int i8k_set_fan(int fan, int speed) - speed = (speed < 0) ? 0 : ((speed > i8k_fan_max) ? i8k_fan_max : speed); - regs.ebx = (fan & 0xff) | (speed << 8); - -- return i8k_smm(®s) ? : i8k_get_fan_status(fan); -+ return i8k_smm(®s); - } - - static int i8k_get_temp_type(int sensor) -@@ -427,7 +427,7 @@ static int - i8k_ioctl_unlocked(struct file *fp, unsigned int cmd, unsigned long arg) - { - int val = 0; -- int speed; -+ int speed, err; - unsigned char buff[16]; - int __user *argp = (int __user *)arg; - -@@ -488,7 +488,11 @@ i8k_ioctl_unlocked(struct file *fp, unsigned int cmd, unsigned long arg) - if (copy_from_user(&speed, argp + 1, sizeof(int))) - return -EFAULT; - -- val = i8k_set_fan(val, speed); -+ err = i8k_set_fan(val, speed); -+ if (err < 0) -+ return err; -+ -+ val = i8k_get_fan_status(val); - break; - - default: -diff --git a/drivers/misc/eeprom/ee1004.c b/drivers/misc/eeprom/ee1004.c -index b081c67416d77..6b313997085e0 100644 ---- a/drivers/misc/eeprom/ee1004.c -+++ b/drivers/misc/eeprom/ee1004.c -@@ -82,6 +82,9 @@ static ssize_t ee1004_eeprom_read(struct i2c_client *client, char *buf, - if (unlikely(offset + count > EE1004_PAGE_SIZE)) - count = EE1004_PAGE_SIZE - offset; - -+ if (count > I2C_SMBUS_BLOCK_MAX) -+ count = I2C_SMBUS_BLOCK_MAX; -+ - status = i2c_smbus_read_i2c_block_data_or_emulated(client, offset, - count, buf); - dev_dbg(&client->dev, "read %zu@%d --> %d\n", count, offset, status); -diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c -index f76c64084f4b2..fb5ddf3864fdd 100644 ---- a/drivers/misc/fastrpc.c -+++ b/drivers/misc/fastrpc.c -@@ -1245,7 +1245,14 @@ static int fastrpc_dmabuf_alloc(struct fastrpc_user *fl, char __user *argp) - } - - if (copy_to_user(argp, &bp, sizeof(bp))) { -- dma_buf_put(buf->dmabuf); -+ /* -+ * The usercopy failed, but we can't do much about it, as -+ * dma_buf_fd() already called fd_install() and made the -+ * file descriptor accessible for the current process. It -+ * might already be closed and dmabuf no longer valid when -+ * we reach this point. Therefore "leak" the fd and rely on -+ * the process exit path to do any required cleanup. -+ */ - return -EFAULT; - } - -diff --git a/drivers/mmc/host/sdhci-of-esdhc.c b/drivers/mmc/host/sdhci-of-esdhc.c -index 5922ae021d869..0ff339004d8a5 100644 ---- a/drivers/mmc/host/sdhci-of-esdhc.c -+++ b/drivers/mmc/host/sdhci-of-esdhc.c -@@ -519,12 +519,16 @@ static void esdhc_of_adma_workaround(struct sdhci_host *host, u32 intmask) - - static int esdhc_of_enable_dma(struct sdhci_host *host) - { -+ int ret; - u32 value; - struct device *dev = mmc_dev(host->mmc); - - if (of_device_is_compatible(dev->of_node, "fsl,ls1043a-esdhc") || -- of_device_is_compatible(dev->of_node, "fsl,ls1046a-esdhc")) -- dma_set_mask_and_coherent(dev, DMA_BIT_MASK(40)); -+ of_device_is_compatible(dev->of_node, "fsl,ls1046a-esdhc")) { -+ ret = dma_set_mask_and_coherent(dev, DMA_BIT_MASK(40)); -+ if (ret) -+ return ret; -+ } - - value = sdhci_readl(host, ESDHC_DMA_SYSCTL); - -diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c -index e3b25f3109367..ed170d803247a 100644 ---- a/drivers/net/bonding/bond_3ad.c -+++ b/drivers/net/bonding/bond_3ad.c -@@ -1013,8 +1013,8 @@ static void ad_mux_machine(struct port *port, bool *update_slave_arr) - if (port->aggregator && - port->aggregator->is_active && - !__port_is_enabled(port)) { -- - __enable_port(port); -+ *update_slave_arr = true; - } - } - break; -@@ -1770,6 +1770,7 @@ static void ad_agg_selection_logic(struct aggregator *agg, - port = port->next_port_in_aggregator) { - __enable_port(port); - } -+ *update_slave_arr = true; - } - } - -diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-pci.c b/drivers/net/ethernet/amd/xgbe/xgbe-pci.c -index 7b86240ecd5fe..c4f1fc97987ae 100644 ---- a/drivers/net/ethernet/amd/xgbe/xgbe-pci.c -+++ b/drivers/net/ethernet/amd/xgbe/xgbe-pci.c -@@ -418,6 +418,9 @@ static void xgbe_pci_remove(struct pci_dev *pdev) - - pci_free_irq_vectors(pdata->pcidev); - -+ /* Disable all interrupts in the hardware */ -+ XP_IOWRITE(pdata, XP_INT_EN, 0x0); -+ - xgbe_free_pdata(pdata); - } - -diff --git a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c -index be8e6d4e376ec..9bd02766a4bcc 100644 ---- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c -+++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c -@@ -1979,14 +1979,15 @@ static void ixgbevf_set_rx_buffer_len(struct ixgbevf_adapter *adapter, - if (adapter->flags & IXGBEVF_FLAGS_LEGACY_RX) - return; - -- set_ring_build_skb_enabled(rx_ring); -+ if (PAGE_SIZE < 8192) -+ if (max_frame > IXGBEVF_MAX_FRAME_BUILD_SKB) -+ set_ring_uses_large_buffer(rx_ring); - -- if (PAGE_SIZE < 8192) { -- if (max_frame <= IXGBEVF_MAX_FRAME_BUILD_SKB) -- return; -+ /* 82599 can't rely on RXDCTL.RLPML to restrict the size of the frame */ -+ if (adapter->hw.mac.type == ixgbe_mac_82599_vf && !ring_uses_large_buffer(rx_ring)) -+ return; - -- set_ring_uses_large_buffer(rx_ring); -- } -+ set_ring_build_skb_enabled(rx_ring); - } - - /** -diff --git a/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c b/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c -index 2600ce476d6b2..f8c8451919cb6 100644 ---- a/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c -+++ b/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c -@@ -677,6 +677,7 @@ nfp_tunnel_del_shared_mac(struct nfp_app *app, struct net_device *netdev, - struct nfp_flower_repr_priv *repr_priv; - struct nfp_tun_offloaded_mac *entry; - struct nfp_repr *repr; -+ u16 nfp_mac_idx; - int ida_idx; - - entry = nfp_tunnel_lookup_offloaded_macs(app, mac); -@@ -695,8 +696,6 @@ nfp_tunnel_del_shared_mac(struct nfp_app *app, struct net_device *netdev, - entry->bridge_count--; - - if (!entry->bridge_count && entry->ref_count) { -- u16 nfp_mac_idx; -- - nfp_mac_idx = entry->index & ~NFP_TUN_PRE_TUN_IDX_BIT; - if (__nfp_tunnel_offload_mac(app, mac, nfp_mac_idx, - false)) { -@@ -712,7 +711,6 @@ nfp_tunnel_del_shared_mac(struct nfp_app *app, struct net_device *netdev, - - /* If MAC is now used by 1 repr set the offloaded MAC index to port. */ - if (entry->ref_count == 1 && list_is_singular(&entry->repr_list)) { -- u16 nfp_mac_idx; - int port, err; - - repr_priv = list_first_entry(&entry->repr_list, -@@ -740,8 +738,14 @@ nfp_tunnel_del_shared_mac(struct nfp_app *app, struct net_device *netdev, - WARN_ON_ONCE(rhashtable_remove_fast(&priv->tun.offloaded_macs, - &entry->ht_node, - offloaded_macs_params)); -+ -+ if (nfp_flower_is_supported_bridge(netdev)) -+ nfp_mac_idx = entry->index & ~NFP_TUN_PRE_TUN_IDX_BIT; -+ else -+ nfp_mac_idx = entry->index; -+ - /* If MAC has global ID then extract and free the ida entry. */ -- if (nfp_tunnel_is_mac_idx_global(entry->index)) { -+ if (nfp_tunnel_is_mac_idx_global(nfp_mac_idx)) { - ida_idx = nfp_tunnel_get_ida_from_global_mac_idx(entry->index); - ida_simple_remove(&priv->tun.mac_off_ids, ida_idx); - } -diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c -index 2f6258ca95155..7c73d296b940d 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c -+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c -@@ -718,7 +718,7 @@ static int sun8i_dwmac_reset(struct stmmac_priv *priv) - - if (err) { - dev_err(priv->device, "EMAC reset timeout\n"); -- return -EFAULT; -+ return err; - } - return 0; - } -diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c -index a69317e944229..53420c5312667 100644 ---- a/drivers/net/phy/marvell.c -+++ b/drivers/net/phy/marvell.c -@@ -444,9 +444,9 @@ static int m88e1121_config_aneg_rgmii_delays(struct phy_device *phydev) - else - mscr = 0; - -- return phy_modify_paged(phydev, MII_MARVELL_MSCR_PAGE, -- MII_88E1121_PHY_MSCR_REG, -- MII_88E1121_PHY_MSCR_DELAY_MASK, mscr); -+ return phy_modify_paged_changed(phydev, MII_MARVELL_MSCR_PAGE, -+ MII_88E1121_PHY_MSCR_REG, -+ MII_88E1121_PHY_MSCR_DELAY_MASK, mscr); - } - - static int m88e1121_config_aneg(struct phy_device *phydev) -@@ -460,11 +460,13 @@ static int m88e1121_config_aneg(struct phy_device *phydev) - return err; - } - -+ changed = err; -+ - err = marvell_set_polarity(phydev, phydev->mdix_ctrl); - if (err < 0) - return err; - -- changed = err; -+ changed |= err; - - err = genphy_config_aneg(phydev); - if (err < 0) -@@ -886,16 +888,15 @@ static int m88e1118_config_aneg(struct phy_device *phydev) - { - int err; - -- err = genphy_soft_reset(phydev); -+ err = marvell_set_polarity(phydev, phydev->mdix_ctrl); - if (err < 0) - return err; - -- err = marvell_set_polarity(phydev, phydev->mdix_ctrl); -+ err = genphy_config_aneg(phydev); - if (err < 0) - return err; - -- err = genphy_config_aneg(phydev); -- return 0; -+ return genphy_soft_reset(phydev); - } - - static int m88e1118_config_init(struct phy_device *phydev) -diff --git a/drivers/net/phy/mdio-aspeed.c b/drivers/net/phy/mdio-aspeed.c -index 966c3b4ad59d1..e2273588c75b6 100644 ---- a/drivers/net/phy/mdio-aspeed.c -+++ b/drivers/net/phy/mdio-aspeed.c -@@ -148,6 +148,7 @@ static const struct of_device_id aspeed_mdio_of_match[] = { - { .compatible = "aspeed,ast2600-mdio", }, - { }, - }; -+MODULE_DEVICE_TABLE(of, aspeed_mdio_of_match); - - static struct platform_driver aspeed_mdio_driver = { - .driver = { -diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c -index ec4b148b1e6c3..a06c3924e0396 100644 ---- a/drivers/net/usb/ax88179_178a.c -+++ b/drivers/net/usb/ax88179_178a.c -@@ -1361,58 +1361,68 @@ static int ax88179_rx_fixup(struct usbnet *dev, struct sk_buff *skb) - u16 hdr_off; - u32 *pkt_hdr; - -- /* This check is no longer done by usbnet */ -- if (skb->len < dev->net->hard_header_len) -+ /* At the end of the SKB, there's a header telling us how many packets -+ * are bundled into this buffer and where we can find an array of -+ * per-packet metadata (which contains elements encoded into u16). -+ */ -+ if (skb->len < 4) - return 0; -- - skb_trim(skb, skb->len - 4); - rx_hdr = get_unaligned_le32(skb_tail_pointer(skb)); -- - pkt_cnt = (u16)rx_hdr; - hdr_off = (u16)(rx_hdr >> 16); -+ -+ if (pkt_cnt == 0) -+ return 0; -+ -+ /* Make sure that the bounds of the metadata array are inside the SKB -+ * (and in front of the counter at the end). -+ */ -+ if (pkt_cnt * 2 + hdr_off > skb->len) -+ return 0; - pkt_hdr = (u32 *)(skb->data + hdr_off); - -- while (pkt_cnt--) { -+ /* Packets must not overlap the metadata array */ -+ skb_trim(skb, hdr_off); -+ -+ for (; ; pkt_cnt--, pkt_hdr++) { - u16 pkt_len; - - le32_to_cpus(pkt_hdr); - pkt_len = (*pkt_hdr >> 16) & 0x1fff; - -- /* Check CRC or runt packet */ -- if ((*pkt_hdr & AX_RXHDR_CRC_ERR) || -- (*pkt_hdr & AX_RXHDR_DROP_ERR)) { -- skb_pull(skb, (pkt_len + 7) & 0xFFF8); -- pkt_hdr++; -- continue; -- } -- -- if (pkt_cnt == 0) { -- skb->len = pkt_len; -- /* Skip IP alignment pseudo header */ -- skb_pull(skb, 2); -- skb_set_tail_pointer(skb, skb->len); -- skb->truesize = pkt_len + sizeof(struct sk_buff); -- ax88179_rx_checksum(skb, pkt_hdr); -- return 1; -- } -+ if (pkt_len > skb->len) -+ return 0; - -- ax_skb = skb_clone(skb, GFP_ATOMIC); -- if (ax_skb) { -+ /* Check CRC or runt packet */ -+ if (((*pkt_hdr & (AX_RXHDR_CRC_ERR | AX_RXHDR_DROP_ERR)) == 0) && -+ pkt_len >= 2 + ETH_HLEN) { -+ bool last = (pkt_cnt == 0); -+ -+ if (last) { -+ ax_skb = skb; -+ } else { -+ ax_skb = skb_clone(skb, GFP_ATOMIC); -+ if (!ax_skb) -+ return 0; -+ } - ax_skb->len = pkt_len; - /* Skip IP alignment pseudo header */ - skb_pull(ax_skb, 2); - skb_set_tail_pointer(ax_skb, ax_skb->len); - ax_skb->truesize = pkt_len + sizeof(struct sk_buff); - ax88179_rx_checksum(ax_skb, pkt_hdr); -+ -+ if (last) -+ return 1; -+ - usbnet_skb_return(dev, ax_skb); -- } else { -- return 0; - } - -- skb_pull(skb, (pkt_len + 7) & 0xFFF8); -- pkt_hdr++; -+ /* Trim this packet away from the SKB */ -+ if (!skb_pull(skb, (pkt_len + 7) & 0xFFF8)) -+ return 0; - } -- return 1; - } - - static struct sk_buff * -diff --git a/drivers/net/veth.c b/drivers/net/veth.c -index 81a79e7132483..10a876f8831c7 100644 ---- a/drivers/net/veth.c -+++ b/drivers/net/veth.c -@@ -209,9 +209,10 @@ static void __veth_xdp_flush(struct veth_rq *rq) - { - /* Write ptr_ring before reading rx_notify_masked */ - smp_mb(); -- if (!rq->rx_notify_masked) { -- rq->rx_notify_masked = true; -- napi_schedule(&rq->xdp_napi); -+ if (!READ_ONCE(rq->rx_notify_masked) && -+ napi_schedule_prep(&rq->xdp_napi)) { -+ WRITE_ONCE(rq->rx_notify_masked, true); -+ __napi_schedule(&rq->xdp_napi); - } - } - -@@ -780,8 +781,10 @@ static int veth_poll(struct napi_struct *napi, int budget) - /* Write rx_notify_masked before reading ptr_ring */ - smp_store_mb(rq->rx_notify_masked, false); - if (unlikely(!__ptr_ring_empty(&rq->xdp_ring))) { -- rq->rx_notify_masked = true; -- napi_schedule(&rq->xdp_napi); -+ if (napi_schedule_prep(&rq->xdp_napi)) { -+ WRITE_ONCE(rq->rx_notify_masked, true); -+ __napi_schedule(&rq->xdp_napi); -+ } - } - } - -diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c -index 9f01af2f03e68..4d615337e6e22 100644 ---- a/drivers/nvme/host/multipath.c -+++ b/drivers/nvme/host/multipath.c -@@ -458,8 +458,14 @@ static int nvme_parse_ana_log(struct nvme_ctrl *ctrl, void *data, - - for (i = 0; i < le16_to_cpu(ctrl->ana_log_buf->ngrps); i++) { - struct nvme_ana_group_desc *desc = base + offset; -- u32 nr_nsids = le32_to_cpu(desc->nnsids); -- size_t nsid_buf_size = nr_nsids * sizeof(__le32); -+ u32 nr_nsids; -+ size_t nsid_buf_size; -+ -+ if (WARN_ON_ONCE(offset > ctrl->ana_log_size - sizeof(*desc))) -+ return -EINVAL; -+ -+ nr_nsids = le32_to_cpu(desc->nnsids); -+ nsid_buf_size = nr_nsids * sizeof(__le32); - - if (WARN_ON_ONCE(desc->grpid == 0)) - return -EINVAL; -@@ -479,8 +485,6 @@ static int nvme_parse_ana_log(struct nvme_ctrl *ctrl, void *data, - return error; - - offset += nsid_buf_size; -- if (WARN_ON_ONCE(offset > ctrl->ana_log_size - sizeof(*desc))) -- return -EINVAL; - } - - return 0; -diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c -index ff0d06e8ebb53..1eef7ed0c3026 100644 ---- a/drivers/nvme/host/tcp.c -+++ b/drivers/nvme/host/tcp.c -@@ -840,7 +840,15 @@ static inline void nvme_tcp_done_send_req(struct nvme_tcp_queue *queue) - - static void nvme_tcp_fail_request(struct nvme_tcp_request *req) - { -- nvme_tcp_end_request(blk_mq_rq_from_pdu(req), NVME_SC_HOST_PATH_ERROR); -+ if (nvme_tcp_async_req(req)) { -+ union nvme_result res = {}; -+ -+ nvme_complete_async_event(&req->queue->ctrl->ctrl, -+ cpu_to_le16(NVME_SC_HOST_PATH_ERROR), &res); -+ } else { -+ nvme_tcp_end_request(blk_mq_rq_from_pdu(req), -+ NVME_SC_HOST_PATH_ERROR); -+ } - } - - static int nvme_tcp_try_send_data(struct nvme_tcp_request *req) -diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h -index 0b69f4f713778..1bf7a4152b34b 100644 ---- a/drivers/scsi/lpfc/lpfc.h -+++ b/drivers/scsi/lpfc/lpfc.h -@@ -870,6 +870,16 @@ struct lpfc_hba { - uint32_t cfg_hostmem_hgp; - uint32_t cfg_log_verbose; - uint32_t cfg_enable_fc4_type; -+#define LPFC_ENABLE_FCP 1 -+#define LPFC_ENABLE_NVME 2 -+#define LPFC_ENABLE_BOTH 3 -+#if (IS_ENABLED(CONFIG_NVME_FC)) -+#define LPFC_MAX_ENBL_FC4_TYPE LPFC_ENABLE_BOTH -+#define LPFC_DEF_ENBL_FC4_TYPE LPFC_ENABLE_BOTH -+#else -+#define LPFC_MAX_ENBL_FC4_TYPE LPFC_ENABLE_FCP -+#define LPFC_DEF_ENBL_FC4_TYPE LPFC_ENABLE_FCP -+#endif - uint32_t cfg_aer_support; - uint32_t cfg_sriov_nr_virtfn; - uint32_t cfg_request_firmware_upgrade; -@@ -892,9 +902,6 @@ struct lpfc_hba { - uint32_t cfg_ras_fwlog_func; - uint32_t cfg_enable_bbcr; /* Enable BB Credit Recovery */ - uint32_t cfg_enable_dpp; /* Enable Direct Packet Push */ --#define LPFC_ENABLE_FCP 1 --#define LPFC_ENABLE_NVME 2 --#define LPFC_ENABLE_BOTH 3 - uint32_t cfg_enable_pbde; - struct nvmet_fc_target_port *targetport; - lpfc_vpd_t vpd; /* vital product data */ -diff --git a/drivers/scsi/lpfc/lpfc_attr.c b/drivers/scsi/lpfc/lpfc_attr.c -index 1c541a600149b..d034fe78bf93e 100644 ---- a/drivers/scsi/lpfc/lpfc_attr.c -+++ b/drivers/scsi/lpfc/lpfc_attr.c -@@ -3839,8 +3839,8 @@ LPFC_ATTR_R(nvmet_mrq_post, - * 3 - register both FCP and NVME - * Supported values are [1,3]. Default value is 3 - */ --LPFC_ATTR_R(enable_fc4_type, LPFC_ENABLE_BOTH, -- LPFC_ENABLE_FCP, LPFC_ENABLE_BOTH, -+LPFC_ATTR_R(enable_fc4_type, LPFC_DEF_ENBL_FC4_TYPE, -+ LPFC_ENABLE_FCP, LPFC_MAX_ENBL_FC4_TYPE, - "Enable FC4 Protocol support - FCP / NVME"); - - /* -diff --git a/drivers/scsi/myrs.c b/drivers/scsi/myrs.c -index cfc3f8b4174ab..2d3d14aa46b4b 100644 ---- a/drivers/scsi/myrs.c -+++ b/drivers/scsi/myrs.c -@@ -2272,7 +2272,8 @@ static void myrs_cleanup(struct myrs_hba *cs) - myrs_unmap(cs); - - if (cs->mmio_base) { -- cs->disable_intr(cs); -+ if (cs->disable_intr) -+ cs->disable_intr(cs); - iounmap(cs->mmio_base); - cs->mmio_base = NULL; - } -diff --git a/drivers/scsi/qedf/qedf_io.c b/drivers/scsi/qedf/qedf_io.c -index 4e8a284e606c0..d02d1ef0d0116 100644 ---- a/drivers/scsi/qedf/qedf_io.c -+++ b/drivers/scsi/qedf/qedf_io.c -@@ -2253,6 +2253,7 @@ int qedf_initiate_cleanup(struct qedf_ioreq *io_req, - io_req->tm_flags == FCP_TMF_TGT_RESET) { - clear_bit(QEDF_CMD_OUTSTANDING, &io_req->flags); - io_req->sc_cmd = NULL; -+ kref_put(&io_req->refcount, qedf_release_cmd); - complete(&io_req->tm_done); - } - -diff --git a/drivers/staging/fbtft/fbtft.h b/drivers/staging/fbtft/fbtft.h -index 9b6bdb62093d7..736cd4955b733 100644 ---- a/drivers/staging/fbtft/fbtft.h -+++ b/drivers/staging/fbtft/fbtft.h -@@ -332,7 +332,10 @@ static int __init fbtft_driver_module_init(void) \ - ret = spi_register_driver(&fbtft_driver_spi_driver); \ - if (ret < 0) \ - return ret; \ -- return platform_driver_register(&fbtft_driver_platform_driver); \ -+ ret = platform_driver_register(&fbtft_driver_platform_driver); \ -+ if (ret < 0) \ -+ spi_unregister_driver(&fbtft_driver_spi_driver); \ -+ return ret; \ - } \ - \ - static void __exit fbtft_driver_module_exit(void) \ -diff --git a/drivers/target/iscsi/iscsi_target_tpg.c b/drivers/target/iscsi/iscsi_target_tpg.c -index 8075f60fd02c3..2d5cf1714ae05 100644 ---- a/drivers/target/iscsi/iscsi_target_tpg.c -+++ b/drivers/target/iscsi/iscsi_target_tpg.c -@@ -443,6 +443,9 @@ static bool iscsit_tpg_check_network_portal( - break; - } - spin_unlock(&tpg->tpg_np_lock); -+ -+ if (match) -+ break; - } - spin_unlock(&tiqn->tiqn_tpg_lock); - -diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c -index f9c584244f72c..6a55f06c0af26 100644 ---- a/drivers/tty/n_tty.c -+++ b/drivers/tty/n_tty.c -@@ -1377,7 +1377,7 @@ handle_newline: - put_tty_queue(c, ldata); - smp_store_release(&ldata->canon_head, ldata->read_head); - kill_fasync(&tty->fasync, SIGIO, POLL_IN); -- wake_up_interruptible_poll(&tty->read_wait, EPOLLIN); -+ wake_up_interruptible_poll(&tty->read_wait, EPOLLIN | EPOLLRDNORM); - return 0; - } - } -@@ -1658,7 +1658,7 @@ static void __receive_buf(struct tty_struct *tty, const unsigned char *cp, - - if (read_cnt(ldata)) { - kill_fasync(&tty->fasync, SIGIO, POLL_IN); -- wake_up_interruptible_poll(&tty->read_wait, EPOLLIN); -+ wake_up_interruptible_poll(&tty->read_wait, EPOLLIN | EPOLLRDNORM); - } - } - -diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c -index 167c72726c5a0..312857168dad3 100644 ---- a/drivers/tty/vt/vt_ioctl.c -+++ b/drivers/tty/vt/vt_ioctl.c -@@ -691,6 +691,7 @@ int vt_ioctl(struct tty_struct *tty, - ret = -ENXIO; - else { - arg--; -+ arg = array_index_nospec(arg, MAX_NR_CONSOLES); - console_lock(); - ret = vc_allocate(arg); - console_unlock(); -@@ -715,9 +716,9 @@ int vt_ioctl(struct tty_struct *tty, - if (vsa.console == 0 || vsa.console > MAX_NR_CONSOLES) - ret = -ENXIO; - else { -- vsa.console = array_index_nospec(vsa.console, -- MAX_NR_CONSOLES + 1); - vsa.console--; -+ vsa.console = array_index_nospec(vsa.console, -+ MAX_NR_CONSOLES); - console_lock(); - ret = vc_allocate(vsa.console); - if (ret == 0) { -diff --git a/drivers/usb/common/ulpi.c b/drivers/usb/common/ulpi.c -index 5a4d08de546fe..c42c152bbc335 100644 ---- a/drivers/usb/common/ulpi.c -+++ b/drivers/usb/common/ulpi.c -@@ -132,6 +132,7 @@ static const struct attribute_group *ulpi_dev_attr_groups[] = { - - static void ulpi_dev_release(struct device *dev) - { -+ of_node_put(dev->of_node); - kfree(to_ulpi_dev(dev)); - } - -@@ -248,12 +249,16 @@ static int ulpi_register(struct device *dev, struct ulpi *ulpi) - return ret; - - ret = ulpi_read_id(ulpi); -- if (ret) -+ if (ret) { -+ of_node_put(ulpi->dev.of_node); - return ret; -+ } - - ret = device_register(&ulpi->dev); -- if (ret) -+ if (ret) { -+ put_device(&ulpi->dev); - return ret; -+ } - - dev_dbg(&ulpi->dev, "registered ULPI PHY: vendor %04x, product %04x\n", - ulpi->id.vendor, ulpi->id.product); -@@ -300,7 +305,6 @@ EXPORT_SYMBOL_GPL(ulpi_register_interface); - */ - void ulpi_unregister_interface(struct ulpi *ulpi) - { -- of_node_put(ulpi->dev.of_node); - device_unregister(&ulpi->dev); - } - EXPORT_SYMBOL_GPL(ulpi_unregister_interface); -diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c -index 249e8e6aa9282..379bbf27c7ce8 100644 ---- a/drivers/usb/dwc2/gadget.c -+++ b/drivers/usb/dwc2/gadget.c -@@ -4979,7 +4979,7 @@ int dwc2_hsotg_suspend(struct dwc2_hsotg *hsotg) - hsotg->gadget.speed = USB_SPEED_UNKNOWN; - spin_unlock_irqrestore(&hsotg->lock, flags); - -- for (ep = 0; ep < hsotg->num_of_eps; ep++) { -+ for (ep = 1; ep < hsotg->num_of_eps; ep++) { - if (hsotg->eps_in[ep]) - dwc2_hsotg_ep_disable_lock(&hsotg->eps_in[ep]->ep); - if (hsotg->eps_out[ep]) -diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c -index 39a9ad12cbbc8..2367bf5a13107 100644 ---- a/drivers/usb/dwc3/gadget.c -+++ b/drivers/usb/dwc3/gadget.c -@@ -1020,6 +1020,19 @@ static void __dwc3_prepare_one_trb(struct dwc3_ep *dep, struct dwc3_trb *trb, - if (usb_endpoint_xfer_bulk(dep->endpoint.desc) && dep->stream_capable) - trb->ctrl |= DWC3_TRB_CTRL_SID_SOFN(stream_id); - -+ /* -+ * As per data book 4.2.3.2TRB Control Bit Rules section -+ * -+ * The controller autonomously checks the HWO field of a TRB to determine if the -+ * entire TRB is valid. Therefore, software must ensure that the rest of the TRB -+ * is valid before setting the HWO field to '1'. In most systems, this means that -+ * software must update the fourth DWORD of a TRB last. -+ * -+ * However there is a possibility of CPU re-ordering here which can cause -+ * controller to observe the HWO bit set prematurely. -+ * Add a write memory barrier to prevent CPU re-ordering. -+ */ -+ wmb(); - trb->ctrl |= DWC3_TRB_CTRL_HWO; - - dwc3_ep_inc_enq(dep); -diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c -index c5acf5c39fb18..a3106b179562c 100644 ---- a/drivers/usb/gadget/composite.c -+++ b/drivers/usb/gadget/composite.c -@@ -1944,6 +1944,9 @@ unknown: - if (w_index != 0x5 || (w_value >> 8)) - break; - interface = w_value & 0xFF; -+ if (interface >= MAX_CONFIG_INTERFACES || -+ !os_desc_cfg->interface[interface]) -+ break; - buf[6] = w_index; - count = count_ext_prop(os_desc_cfg, - interface); -diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c -index 2bea33b41553b..5fd4fc49aef9f 100644 ---- a/drivers/usb/gadget/function/f_fs.c -+++ b/drivers/usb/gadget/function/f_fs.c -@@ -1729,16 +1729,24 @@ static void ffs_data_put(struct ffs_data *ffs) - - static void ffs_data_closed(struct ffs_data *ffs) - { -+ struct ffs_epfile *epfiles; -+ unsigned long flags; -+ - ENTER(); - - if (atomic_dec_and_test(&ffs->opened)) { - if (ffs->no_disconnect) { - ffs->state = FFS_DEACTIVATED; -- if (ffs->epfiles) { -- ffs_epfiles_destroy(ffs->epfiles, -- ffs->eps_count); -- ffs->epfiles = NULL; -- } -+ spin_lock_irqsave(&ffs->eps_lock, flags); -+ epfiles = ffs->epfiles; -+ ffs->epfiles = NULL; -+ spin_unlock_irqrestore(&ffs->eps_lock, -+ flags); -+ -+ if (epfiles) -+ ffs_epfiles_destroy(epfiles, -+ ffs->eps_count); -+ - if (ffs->setup_state == FFS_SETUP_PENDING) - __ffs_ep0_stall(ffs); - } else { -@@ -1785,14 +1793,27 @@ static struct ffs_data *ffs_data_new(const char *dev_name) - - static void ffs_data_clear(struct ffs_data *ffs) - { -+ struct ffs_epfile *epfiles; -+ unsigned long flags; -+ - ENTER(); - - ffs_closed(ffs); - - BUG_ON(ffs->gadget); - -- if (ffs->epfiles) { -- ffs_epfiles_destroy(ffs->epfiles, ffs->eps_count); -+ spin_lock_irqsave(&ffs->eps_lock, flags); -+ epfiles = ffs->epfiles; -+ ffs->epfiles = NULL; -+ spin_unlock_irqrestore(&ffs->eps_lock, flags); -+ -+ /* -+ * potential race possible between ffs_func_eps_disable -+ * & ffs_epfile_release therefore maintaining a local -+ * copy of epfile will save us from use-after-free. -+ */ -+ if (epfiles) { -+ ffs_epfiles_destroy(epfiles, ffs->eps_count); - ffs->epfiles = NULL; - } - -@@ -1940,12 +1961,15 @@ static void ffs_epfiles_destroy(struct ffs_epfile *epfiles, unsigned count) - - static void ffs_func_eps_disable(struct ffs_function *func) - { -- struct ffs_ep *ep = func->eps; -- struct ffs_epfile *epfile = func->ffs->epfiles; -- unsigned count = func->ffs->eps_count; -+ struct ffs_ep *ep; -+ struct ffs_epfile *epfile; -+ unsigned short count; - unsigned long flags; - - spin_lock_irqsave(&func->ffs->eps_lock, flags); -+ count = func->ffs->eps_count; -+ epfile = func->ffs->epfiles; -+ ep = func->eps; - while (count--) { - /* pending requests get nuked */ - if (likely(ep->ep)) -@@ -1963,14 +1987,18 @@ static void ffs_func_eps_disable(struct ffs_function *func) - - static int ffs_func_eps_enable(struct ffs_function *func) - { -- struct ffs_data *ffs = func->ffs; -- struct ffs_ep *ep = func->eps; -- struct ffs_epfile *epfile = ffs->epfiles; -- unsigned count = ffs->eps_count; -+ struct ffs_data *ffs; -+ struct ffs_ep *ep; -+ struct ffs_epfile *epfile; -+ unsigned short count; - unsigned long flags; - int ret = 0; - - spin_lock_irqsave(&func->ffs->eps_lock, flags); -+ ffs = func->ffs; -+ ep = func->eps; -+ epfile = ffs->epfiles; -+ count = ffs->eps_count; - while(count--) { - ep->ep->driver_data = ep; - -diff --git a/drivers/usb/gadget/function/f_uac2.c b/drivers/usb/gadget/function/f_uac2.c -index dd960cea642f3..11cc6056b5902 100644 ---- a/drivers/usb/gadget/function/f_uac2.c -+++ b/drivers/usb/gadget/function/f_uac2.c -@@ -176,7 +176,7 @@ static struct uac2_input_terminal_descriptor io_in_it_desc = { - - .bDescriptorSubtype = UAC_INPUT_TERMINAL, - /* .bTerminalID = DYNAMIC */ -- .wTerminalType = cpu_to_le16(UAC_INPUT_TERMINAL_UNDEFINED), -+ .wTerminalType = cpu_to_le16(UAC_INPUT_TERMINAL_MICROPHONE), - .bAssocTerminal = 0, - /* .bCSourceID = DYNAMIC */ - .iChannelNames = 0, -@@ -204,7 +204,7 @@ static struct uac2_output_terminal_descriptor io_out_ot_desc = { - - .bDescriptorSubtype = UAC_OUTPUT_TERMINAL, - /* .bTerminalID = DYNAMIC */ -- .wTerminalType = cpu_to_le16(UAC_OUTPUT_TERMINAL_UNDEFINED), -+ .wTerminalType = cpu_to_le16(UAC_OUTPUT_TERMINAL_SPEAKER), - .bAssocTerminal = 0, - /* .bSourceID = DYNAMIC */ - /* .bCSourceID = DYNAMIC */ -diff --git a/drivers/usb/gadget/function/rndis.c b/drivers/usb/gadget/function/rndis.c -index 04c142c130759..ab827c1badc50 100644 ---- a/drivers/usb/gadget/function/rndis.c -+++ b/drivers/usb/gadget/function/rndis.c -@@ -637,14 +637,17 @@ static int rndis_set_response(struct rndis_params *params, - rndis_set_cmplt_type *resp; - rndis_resp_t *r; - -+ BufLength = le32_to_cpu(buf->InformationBufferLength); -+ BufOffset = le32_to_cpu(buf->InformationBufferOffset); -+ if ((BufLength > RNDIS_MAX_TOTAL_SIZE) || -+ (BufOffset + 8 >= RNDIS_MAX_TOTAL_SIZE)) -+ return -EINVAL; -+ - r = rndis_add_response(params, sizeof(rndis_set_cmplt_type)); - if (!r) - return -ENOMEM; - resp = (rndis_set_cmplt_type *)r->buf; - -- BufLength = le32_to_cpu(buf->InformationBufferLength); -- BufOffset = le32_to_cpu(buf->InformationBufferOffset); -- - #ifdef VERBOSE_DEBUG - pr_debug("%s: Length: %d\n", __func__, BufLength); - pr_debug("%s: Offset: %d\n", __func__, BufOffset); -diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c -index b6653bc7acc26..0bbd180022aa7 100644 ---- a/drivers/usb/gadget/udc/renesas_usb3.c -+++ b/drivers/usb/gadget/udc/renesas_usb3.c -@@ -2363,6 +2363,8 @@ static void handle_ext_role_switch_states(struct device *dev, - switch (role) { - case USB_ROLE_NONE: - usb3->connection_state = USB_ROLE_NONE; -+ if (cur_role == USB_ROLE_HOST) -+ device_release_driver(host); - if (usb3->driver) - usb3_disconnect(usb3); - usb3_vbus_out(usb3, false); -diff --git a/drivers/usb/serial/ch341.c b/drivers/usb/serial/ch341.c -index a82ba9cc0c724..a5c10fe9f72a1 100644 ---- a/drivers/usb/serial/ch341.c -+++ b/drivers/usb/serial/ch341.c -@@ -84,6 +84,7 @@ static const struct usb_device_id id_table[] = { - { USB_DEVICE(0x1a86, 0x5523) }, - { USB_DEVICE(0x1a86, 0x7522) }, - { USB_DEVICE(0x1a86, 0x7523) }, -+ { USB_DEVICE(0x2184, 0x0057) }, - { USB_DEVICE(0x4348, 0x5523) }, - { USB_DEVICE(0x9986, 0x7523) }, - { }, -diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c -index 50f289b124d0d..dfa7c504befe8 100644 ---- a/drivers/usb/serial/cp210x.c -+++ b/drivers/usb/serial/cp210x.c -@@ -52,6 +52,7 @@ static int cp210x_port_remove(struct usb_serial_port *); - static void cp210x_dtr_rts(struct usb_serial_port *p, int on); - - static const struct usb_device_id id_table[] = { -+ { USB_DEVICE(0x0404, 0x034C) }, /* NCR Retail IO Box */ - { USB_DEVICE(0x045B, 0x0053) }, /* Renesas RX610 RX-Stick */ - { USB_DEVICE(0x0471, 0x066A) }, /* AKTAKOM ACE-1001 cable */ - { USB_DEVICE(0x0489, 0xE000) }, /* Pirelli Broadband S.p.A, DP-L10 SIP/GSM Mobile */ -@@ -69,6 +70,7 @@ static const struct usb_device_id id_table[] = { - { USB_DEVICE(0x0FCF, 0x1004) }, /* Dynastream ANT2USB */ - { USB_DEVICE(0x0FCF, 0x1006) }, /* Dynastream ANT development board */ - { USB_DEVICE(0x0FDE, 0xCA05) }, /* OWL Wireless Electricity Monitor CM-160 */ -+ { USB_DEVICE(0x106F, 0x0003) }, /* CPI / Money Controls Bulk Coin Recycler */ - { USB_DEVICE(0x10A6, 0xAA26) }, /* Knock-off DCU-11 cable */ - { USB_DEVICE(0x10AB, 0x10C5) }, /* Siemens MC60 Cable */ - { USB_DEVICE(0x10B5, 0xAC70) }, /* Nokia CA-42 USB */ -diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c -index 1ec623e46214b..48323165139ad 100644 ---- a/drivers/usb/serial/ftdi_sio.c -+++ b/drivers/usb/serial/ftdi_sio.c -@@ -969,6 +969,7 @@ static const struct usb_device_id id_table_combined[] = { - { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_VX_023_PID) }, - { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_VX_034_PID) }, - { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_101_PID) }, -+ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_159_PID) }, - { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_1_PID) }, - { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_2_PID) }, - { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_3_PID) }, -@@ -977,12 +978,14 @@ static const struct usb_device_id id_table_combined[] = { - { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_6_PID) }, - { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_7_PID) }, - { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_8_PID) }, -+ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_235_PID) }, - { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_257_PID) }, - { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_279_1_PID) }, - { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_279_2_PID) }, - { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_279_3_PID) }, - { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_279_4_PID) }, - { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_313_PID) }, -+ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_320_PID) }, - { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_324_PID) }, - { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_346_1_PID) }, - { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_346_2_PID) }, -diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h -index 755858ca20bac..d1a9564697a4b 100644 ---- a/drivers/usb/serial/ftdi_sio_ids.h -+++ b/drivers/usb/serial/ftdi_sio_ids.h -@@ -1506,6 +1506,9 @@ - #define BRAINBOXES_VX_023_PID 0x1003 /* VX-023 ExpressCard 1 Port RS422/485 */ - #define BRAINBOXES_VX_034_PID 0x1004 /* VX-034 ExpressCard 2 Port RS422/485 */ - #define BRAINBOXES_US_101_PID 0x1011 /* US-101 1xRS232 */ -+#define BRAINBOXES_US_159_PID 0x1021 /* US-159 1xRS232 */ -+#define BRAINBOXES_US_235_PID 0x1017 /* US-235 1xRS232 */ -+#define BRAINBOXES_US_320_PID 0x1019 /* US-320 1xRS422/485 */ - #define BRAINBOXES_US_324_PID 0x1013 /* US-324 1xRS422/485 1Mbaud */ - #define BRAINBOXES_US_606_1_PID 0x2001 /* US-606 6 Port RS232 Serial Port 1 and 2 */ - #define BRAINBOXES_US_606_2_PID 0x2002 /* US-606 6 Port RS232 Serial Port 3 and 4 */ -diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c -index 2397d83434931..81e7833910ca8 100644 ---- a/drivers/usb/serial/option.c -+++ b/drivers/usb/serial/option.c -@@ -1649,6 +1649,8 @@ static const struct usb_device_id option_ids[] = { - .driver_info = RSVD(2) }, - { USB_DEVICE_INTERFACE_CLASS(ZTE_VENDOR_ID, 0x1476, 0xff) }, /* GosunCn ZTE WeLink ME3630 (ECM/NCM mode) */ - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1481, 0xff, 0x00, 0x00) }, /* ZTE MF871A */ -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1485, 0xff, 0xff, 0xff), /* ZTE MF286D */ -+ .driver_info = RSVD(5) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1533, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1534, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1535, 0xff, 0xff, 0xff) }, -diff --git a/fs/nfs/callback.h b/fs/nfs/callback.h -index 8f34daf85f703..5d5227ce4d91e 100644 ---- a/fs/nfs/callback.h -+++ b/fs/nfs/callback.h -@@ -168,7 +168,7 @@ struct cb_devicenotifyitem { - }; - - struct cb_devicenotifyargs { -- int ndevs; -+ uint32_t ndevs; - struct cb_devicenotifyitem *devs; - }; - -diff --git a/fs/nfs/callback_proc.c b/fs/nfs/callback_proc.c -index fc775b0b5194f..b8a7b223b5b18 100644 ---- a/fs/nfs/callback_proc.c -+++ b/fs/nfs/callback_proc.c -@@ -364,7 +364,7 @@ __be32 nfs4_callback_devicenotify(void *argp, void *resp, - struct cb_process_state *cps) - { - struct cb_devicenotifyargs *args = argp; -- int i; -+ uint32_t i; - __be32 res = 0; - struct nfs_client *clp = cps->clp; - struct nfs_server *server = NULL; -diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c -index 73a5a5ea29766..90b5511c4c440 100644 ---- a/fs/nfs/callback_xdr.c -+++ b/fs/nfs/callback_xdr.c -@@ -258,11 +258,9 @@ __be32 decode_devicenotify_args(struct svc_rqst *rqstp, - void *argp) - { - struct cb_devicenotifyargs *args = argp; -+ uint32_t tmp, n, i; - __be32 *p; - __be32 status = 0; -- u32 tmp; -- int n, i; -- args->ndevs = 0; - - /* Num of device notifications */ - p = xdr_inline_decode(xdr, sizeof(uint32_t)); -@@ -271,7 +269,7 @@ __be32 decode_devicenotify_args(struct svc_rqst *rqstp, - goto out; - } - n = ntohl(*p++); -- if (n <= 0) -+ if (n == 0) - goto out; - if (n > ULONG_MAX / sizeof(*args->devs)) { - status = htonl(NFS4ERR_BADXDR); -@@ -330,19 +328,21 @@ __be32 decode_devicenotify_args(struct svc_rqst *rqstp, - dev->cbd_immediate = 0; - } - -- args->ndevs++; -- - dprintk("%s: type %d layout 0x%x immediate %d\n", - __func__, dev->cbd_notify_type, dev->cbd_layout_type, - dev->cbd_immediate); - } -+ args->ndevs = n; -+ dprintk("%s: ndevs %d\n", __func__, args->ndevs); -+ return 0; -+err: -+ kfree(args->devs); - out: -+ args->devs = NULL; -+ args->ndevs = 0; - dprintk("%s: status %d ndevs %d\n", - __func__, ntohl(status), args->ndevs); - return status; --err: -- kfree(args->devs); -- goto out; - } - - static __be32 decode_sessionid(struct xdr_stream *xdr, -diff --git a/fs/nfs/client.c b/fs/nfs/client.c -index af838d1ed281c..35abe63655a9d 100644 ---- a/fs/nfs/client.c -+++ b/fs/nfs/client.c -@@ -176,6 +176,7 @@ struct nfs_client *nfs_alloc_client(const struct nfs_client_initdata *cl_init) - INIT_LIST_HEAD(&clp->cl_superblocks); - clp->cl_rpcclient = ERR_PTR(-EINVAL); - -+ clp->cl_flags = cl_init->init_flags; - clp->cl_proto = cl_init->proto; - clp->cl_nconnect = cl_init->nconnect; - clp->cl_net = get_net(cl_init->net); -@@ -419,7 +420,6 @@ struct nfs_client *nfs_get_client(const struct nfs_client_initdata *cl_init) - list_add_tail(&new->cl_share_link, - &nn->nfs_client_list); - spin_unlock(&nn->nfs_client_lock); -- new->cl_flags = cl_init->init_flags; - return rpc_ops->init_client(new, cl_init); - } - -diff --git a/fs/nfs/nfs4_fs.h b/fs/nfs/nfs4_fs.h -index 5708b5a636f19..ebd77a301057e 100644 ---- a/fs/nfs/nfs4_fs.h -+++ b/fs/nfs/nfs4_fs.h -@@ -279,7 +279,8 @@ struct vfsmount *nfs4_submount(struct nfs_server *, struct dentry *, - struct nfs_fh *, struct nfs_fattr *); - int nfs4_replace_transport(struct nfs_server *server, - const struct nfs4_fs_locations *locations); -- -+size_t nfs_parse_server_name(char *string, size_t len, struct sockaddr *sa, -+ size_t salen, struct net *net); - /* nfs4proc.c */ - extern int nfs4_handle_exception(struct nfs_server *, int, struct nfs4_exception *); - extern int nfs4_async_handle_error(struct rpc_task *task, -diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c -index 8cace8350fa3d..3671a51fe5ebc 100644 ---- a/fs/nfs/nfs4client.c -+++ b/fs/nfs/nfs4client.c -@@ -1293,8 +1293,11 @@ int nfs4_update_server(struct nfs_server *server, const char *hostname, - } - nfs_put_client(clp); - -- if (server->nfs_client->cl_hostname == NULL) -+ if (server->nfs_client->cl_hostname == NULL) { - server->nfs_client->cl_hostname = kstrdup(hostname, GFP_KERNEL); -+ if (server->nfs_client->cl_hostname == NULL) -+ return -ENOMEM; -+ } - nfs_server_insert_lists(server); - - return nfs_probe_destination(server); -diff --git a/fs/nfs/nfs4namespace.c b/fs/nfs/nfs4namespace.c -index 2e460c33ae487..768258848a684 100644 ---- a/fs/nfs/nfs4namespace.c -+++ b/fs/nfs/nfs4namespace.c -@@ -121,8 +121,8 @@ static int nfs4_validate_fspath(struct dentry *dentry, - return 0; - } - --static size_t nfs_parse_server_name(char *string, size_t len, -- struct sockaddr *sa, size_t salen, struct net *net) -+size_t nfs_parse_server_name(char *string, size_t len, struct sockaddr *sa, -+ size_t salen, struct net *net) - { - ssize_t ret; - -diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c -index ea680f619438b..aa2caba38a014 100644 ---- a/fs/nfs/nfs4state.c -+++ b/fs/nfs/nfs4state.c -@@ -2070,6 +2070,9 @@ static int nfs4_try_migration(struct nfs_server *server, const struct cred *cred - } - - result = -NFS4ERR_NXIO; -+ if (!locations->nlocations) -+ goto out; -+ - if (!(locations->fattr.valid & NFS_ATTR_FATTR_V4_LOCATIONS)) { - dprintk("<-- %s: No fs_locations data, migration skipped\n", - __func__); -diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c -index 9a022a4fb9643..2b7741fe42ead 100644 ---- a/fs/nfs/nfs4xdr.c -+++ b/fs/nfs/nfs4xdr.c -@@ -3683,8 +3683,6 @@ static int decode_attr_fs_locations(struct xdr_stream *xdr, uint32_t *bitmap, st - if (unlikely(!p)) - goto out_eio; - n = be32_to_cpup(p); -- if (n <= 0) -- goto out_eio; - for (res->nlocations = 0; res->nlocations < n; res->nlocations++) { - u32 m; - struct nfs4_fs_location *loc; -@@ -4187,10 +4185,11 @@ static int decode_attr_security_label(struct xdr_stream *xdr, uint32_t *bitmap, - } else - printk(KERN_WARNING "%s: label too long (%u)!\n", - __func__, len); -+ if (label && label->label) -+ dprintk("%s: label=%.*s, len=%d, PI=%d, LFS=%d\n", -+ __func__, label->len, (char *)label->label, -+ label->len, label->pi, label->lfs); - } -- if (label && label->label) -- dprintk("%s: label=%s, len=%d, PI=%d, LFS=%d\n", __func__, -- (char *)label->label, label->len, label->pi, label->lfs); - return status; - } - -diff --git a/fs/nfsd/nfs3proc.c b/fs/nfsd/nfs3proc.c -index cea68d8411ac5..bb97c020c96b1 100644 ---- a/fs/nfsd/nfs3proc.c -+++ b/fs/nfsd/nfs3proc.c -@@ -195,6 +195,11 @@ nfsd3_proc_write(struct svc_rqst *rqstp) - (unsigned long long) argp->offset, - argp->stable? " stable" : ""); - -+ resp->status = nfserr_fbig; -+ if (argp->offset > (u64)OFFSET_MAX || -+ argp->offset + argp->len > (u64)OFFSET_MAX) -+ return rpc_success; -+ - fh_copy(&resp->fh, &argp->fh); - resp->committed = argp->stable; - nvecs = svc_fill_write_vector(rqstp, rqstp->rq_arg.pages, -diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c -index 4798667af647c..452ed633a2c76 100644 ---- a/fs/nfsd/nfs4proc.c -+++ b/fs/nfsd/nfs4proc.c -@@ -992,8 +992,9 @@ nfsd4_write(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, - unsigned long cnt; - int nvecs; - -- if (write->wr_offset >= OFFSET_MAX) -- return nfserr_inval; -+ if (write->wr_offset > (u64)OFFSET_MAX || -+ write->wr_offset + write->wr_buflen > (u64)OFFSET_MAX) -+ return nfserr_fbig; - - cnt = write->wr_buflen; - trace_nfsd_write_start(rqstp, &cstate->current_fh, -diff --git a/fs/nfsd/trace.h b/fs/nfsd/trace.h -index b073bdc2e6e89..127db5351d016 100644 ---- a/fs/nfsd/trace.h -+++ b/fs/nfsd/trace.h -@@ -53,14 +53,14 @@ TRACE_EVENT(nfsd_compound_status, - DECLARE_EVENT_CLASS(nfsd_io_class, - TP_PROTO(struct svc_rqst *rqstp, - struct svc_fh *fhp, -- loff_t offset, -- unsigned long len), -+ u64 offset, -+ u32 len), - TP_ARGS(rqstp, fhp, offset, len), - TP_STRUCT__entry( - __field(u32, xid) - __field(u32, fh_hash) -- __field(loff_t, offset) -- __field(unsigned long, len) -+ __field(u64, offset) -+ __field(u32, len) - ), - TP_fast_assign( - __entry->xid = be32_to_cpu(rqstp->rq_xid); -@@ -68,7 +68,7 @@ DECLARE_EVENT_CLASS(nfsd_io_class, - __entry->offset = offset; - __entry->len = len; - ), -- TP_printk("xid=0x%08x fh_hash=0x%08x offset=%lld len=%lu", -+ TP_printk("xid=0x%08x fh_hash=0x%08x offset=%llu len=%u", - __entry->xid, __entry->fh_hash, - __entry->offset, __entry->len) - ) -@@ -77,8 +77,8 @@ DECLARE_EVENT_CLASS(nfsd_io_class, - DEFINE_EVENT(nfsd_io_class, nfsd_##name, \ - TP_PROTO(struct svc_rqst *rqstp, \ - struct svc_fh *fhp, \ -- loff_t offset, \ -- unsigned long len), \ -+ u64 offset, \ -+ u32 len), \ - TP_ARGS(rqstp, fhp, offset, len)) - - DEFINE_NFSD_IO_EVENT(read_start); -diff --git a/include/linux/suspend.h b/include/linux/suspend.h -index cd97d2c8840cc..194e64cb25850 100644 ---- a/include/linux/suspend.h -+++ b/include/linux/suspend.h -@@ -428,15 +428,7 @@ struct platform_hibernation_ops { - - #ifdef CONFIG_HIBERNATION - /* kernel/power/snapshot.c */ --extern void __register_nosave_region(unsigned long b, unsigned long e, int km); --static inline void __init register_nosave_region(unsigned long b, unsigned long e) --{ -- __register_nosave_region(b, e, 0); --} --static inline void __init register_nosave_region_late(unsigned long b, unsigned long e) --{ -- __register_nosave_region(b, e, 1); --} -+extern void register_nosave_region(unsigned long b, unsigned long e); - extern int swsusp_page_is_forbidden(struct page *); - extern void swsusp_set_page_free(struct page *); - extern void swsusp_unset_page_free(struct page *); -@@ -453,7 +445,6 @@ extern struct pbe *restore_pblist; - int pfn_is_nosave(unsigned long pfn); - #else /* CONFIG_HIBERNATION */ - static inline void register_nosave_region(unsigned long b, unsigned long e) {} --static inline void register_nosave_region_late(unsigned long b, unsigned long e) {} - static inline int swsusp_page_is_forbidden(struct page *p) { return 0; } - static inline void swsusp_set_page_free(struct page *p) {} - static inline void swsusp_unset_page_free(struct page *p) {} -@@ -491,14 +482,14 @@ extern void ksys_sync_helper(void); - - /* drivers/base/power/wakeup.c */ - extern bool events_check_enabled; --extern unsigned int pm_wakeup_irq; - extern suspend_state_t pm_suspend_target_state; - - extern bool pm_wakeup_pending(void); - extern void pm_system_wakeup(void); - extern void pm_system_cancel_wakeup(void); --extern void pm_wakeup_clear(bool reset); -+extern void pm_wakeup_clear(unsigned int irq_number); - extern void pm_system_irq_wakeup(unsigned int irq_number); -+extern unsigned int pm_wakeup_irq(void); - extern bool pm_get_wakeup_count(unsigned int *count, bool block); - extern bool pm_save_wakeup_count(unsigned int count); - extern void pm_wakep_autosleep_enabled(bool set); -diff --git a/include/net/dst_metadata.h b/include/net/dst_metadata.h -index 14efa0ded75dd..adab27ba1ecbf 100644 ---- a/include/net/dst_metadata.h -+++ b/include/net/dst_metadata.h -@@ -123,8 +123,20 @@ static inline struct metadata_dst *tun_dst_unclone(struct sk_buff *skb) - - memcpy(&new_md->u.tun_info, &md_dst->u.tun_info, - sizeof(struct ip_tunnel_info) + md_size); -+#ifdef CONFIG_DST_CACHE -+ /* Unclone the dst cache if there is one */ -+ if (new_md->u.tun_info.dst_cache.cache) { -+ int ret; -+ -+ ret = dst_cache_init(&new_md->u.tun_info.dst_cache, GFP_ATOMIC); -+ if (ret) { -+ metadata_dst_free(new_md); -+ return ERR_PTR(ret); -+ } -+ } -+#endif -+ - skb_dst_drop(skb); -- dst_hold(&new_md->dst); - skb_dst_set(skb, &new_md->dst); - return new_md; - } -diff --git a/init/Kconfig b/init/Kconfig -index f23e90d9935f5..e6216dc2a1d1c 100644 ---- a/init/Kconfig -+++ b/init/Kconfig -@@ -1609,6 +1609,16 @@ config BPF_JIT_ALWAYS_ON - Enables BPF JIT and removes BPF interpreter to avoid - speculative execution of BPF instructions by the interpreter - -+config BPF_UNPRIV_DEFAULT_OFF -+ bool "Disable unprivileged BPF by default" -+ depends on BPF_SYSCALL -+ help -+ Disables unprivileged BPF by default by setting the corresponding -+ /proc/sys/kernel/unprivileged_bpf_disabled knob to 2. An admin can -+ still reenable it by setting it to 0 later on, or permanently -+ disable it by setting it to 1 (from which no other transition to -+ 0 is possible anymore). -+ - config USERFAULTFD - bool "Enable userfaultfd() system call" - depends on MMU -diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c -index bf03d04a9e2f8..9ebdcdaa5f162 100644 ---- a/kernel/bpf/syscall.c -+++ b/kernel/bpf/syscall.c -@@ -39,7 +39,8 @@ static DEFINE_SPINLOCK(prog_idr_lock); - static DEFINE_IDR(map_idr); - static DEFINE_SPINLOCK(map_idr_lock); - --int sysctl_unprivileged_bpf_disabled __read_mostly; -+int sysctl_unprivileged_bpf_disabled __read_mostly = -+ IS_BUILTIN(CONFIG_BPF_UNPRIV_DEFAULT_OFF) ? 2 : 0; - - static const struct bpf_map_ops * const bpf_map_types[] = { - #define BPF_PROG_TYPE(_id, _ops) -diff --git a/kernel/events/core.c b/kernel/events/core.c -index 7e124f9abb18b..f720a40ccaf5f 100644 ---- a/kernel/events/core.c -+++ b/kernel/events/core.c -@@ -799,7 +799,7 @@ static DEFINE_PER_CPU(struct list_head, cgrp_cpuctx_list); - */ - static void perf_cgroup_switch(struct task_struct *task, int mode) - { -- struct perf_cpu_context *cpuctx; -+ struct perf_cpu_context *cpuctx, *tmp; - struct list_head *list; - unsigned long flags; - -@@ -810,7 +810,7 @@ static void perf_cgroup_switch(struct task_struct *task, int mode) - local_irq_save(flags); - - list = this_cpu_ptr(&cgrp_cpuctx_list); -- list_for_each_entry(cpuctx, list, cgrp_cpuctx_entry) { -+ list_for_each_entry_safe(cpuctx, tmp, list, cgrp_cpuctx_entry) { - WARN_ON_ONCE(cpuctx->ctx.nr_cgroups == 0); - - perf_ctx_lock(cpuctx, cpuctx->task_ctx); -diff --git a/kernel/power/main.c b/kernel/power/main.c -index e26de7af520be..718884857830b 100644 ---- a/kernel/power/main.c -+++ b/kernel/power/main.c -@@ -472,7 +472,10 @@ static ssize_t pm_wakeup_irq_show(struct kobject *kobj, - struct kobj_attribute *attr, - char *buf) - { -- return pm_wakeup_irq ? sprintf(buf, "%u\n", pm_wakeup_irq) : -ENODATA; -+ if (!pm_wakeup_irq()) -+ return -ENODATA; -+ -+ return sprintf(buf, "%u\n", pm_wakeup_irq()); - } - - power_attr_ro(pm_wakeup_irq); -diff --git a/kernel/power/process.c b/kernel/power/process.c -index 4b6a54da7e65b..e9f4def4d2915 100644 ---- a/kernel/power/process.c -+++ b/kernel/power/process.c -@@ -134,7 +134,7 @@ int freeze_processes(void) - if (!pm_freezing) - atomic_inc(&system_freezing_cnt); - -- pm_wakeup_clear(true); -+ pm_wakeup_clear(0); - pr_info("Freezing user space processes ... "); - pm_freezing = true; - error = try_to_freeze_tasks(true); -diff --git a/kernel/power/snapshot.c b/kernel/power/snapshot.c -index d65f2d5ab6942..46455aa7951ec 100644 ---- a/kernel/power/snapshot.c -+++ b/kernel/power/snapshot.c -@@ -945,8 +945,7 @@ static void memory_bm_recycle(struct memory_bitmap *bm) - * Register a range of page frames the contents of which should not be saved - * during hibernation (to be used in the early initialization code). - */ --void __init __register_nosave_region(unsigned long start_pfn, -- unsigned long end_pfn, int use_kmalloc) -+void __init register_nosave_region(unsigned long start_pfn, unsigned long end_pfn) - { - struct nosave_region *region; - -@@ -962,18 +961,12 @@ void __init __register_nosave_region(unsigned long start_pfn, - goto Report; - } - } -- if (use_kmalloc) { -- /* During init, this shouldn't fail */ -- region = kmalloc(sizeof(struct nosave_region), GFP_KERNEL); -- BUG_ON(!region); -- } else { -- /* This allocation cannot fail */ -- region = memblock_alloc(sizeof(struct nosave_region), -- SMP_CACHE_BYTES); -- if (!region) -- panic("%s: Failed to allocate %zu bytes\n", __func__, -- sizeof(struct nosave_region)); -- } -+ /* This allocation cannot fail */ -+ region = memblock_alloc(sizeof(struct nosave_region), -+ SMP_CACHE_BYTES); -+ if (!region) -+ panic("%s: Failed to allocate %zu bytes\n", __func__, -+ sizeof(struct nosave_region)); - region->start_pfn = start_pfn; - region->end_pfn = end_pfn; - list_add_tail(®ion->list, &nosave_regions); -diff --git a/kernel/power/suspend.c b/kernel/power/suspend.c -index 27f149f5d4a9f..5dea2778a3dbb 100644 ---- a/kernel/power/suspend.c -+++ b/kernel/power/suspend.c -@@ -138,8 +138,6 @@ static void s2idle_loop(void) - break; - } - -- pm_wakeup_clear(false); -- - s2idle_enter(); - } - -diff --git a/kernel/seccomp.c b/kernel/seccomp.c -index 1d62fa2b6b918..b2e1981663b88 100644 ---- a/kernel/seccomp.c -+++ b/kernel/seccomp.c -@@ -28,6 +28,9 @@ - #include - #include - -+/* Not exposed in headers: strictly internal use only. */ -+#define SECCOMP_MODE_DEAD (SECCOMP_MODE_FILTER + 1) -+ - #ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER - #include - #endif -@@ -706,6 +709,7 @@ static void __secure_computing_strict(int this_syscall) - #ifdef SECCOMP_DEBUG - dump_stack(); - #endif -+ current->seccomp.mode = SECCOMP_MODE_DEAD; - seccomp_log(this_syscall, SIGKILL, SECCOMP_RET_KILL_THREAD, true); - do_exit(SIGKILL); - } -@@ -892,6 +896,7 @@ static int __seccomp_filter(int this_syscall, const struct seccomp_data *sd, - case SECCOMP_RET_KILL_THREAD: - case SECCOMP_RET_KILL_PROCESS: - default: -+ current->seccomp.mode = SECCOMP_MODE_DEAD; - seccomp_log(this_syscall, SIGSYS, action, true); - /* Dump core only if this is the last remaining thread. */ - if (action == SECCOMP_RET_KILL_PROCESS || -@@ -944,6 +949,11 @@ int __secure_computing(const struct seccomp_data *sd) - return 0; - case SECCOMP_MODE_FILTER: - return __seccomp_filter(this_syscall, sd, false); -+ /* Surviving SECCOMP_RET_KILL_* must be proactively impossible. */ -+ case SECCOMP_MODE_DEAD: -+ WARN_ON_ONCE(1); -+ do_exit(SIGKILL); -+ return -1; - default: - BUG(); - } -diff --git a/kernel/sysctl.c b/kernel/sysctl.c -index eae6a078619f9..8494d5a706bb5 100644 ---- a/kernel/sysctl.c -+++ b/kernel/sysctl.c -@@ -250,6 +250,28 @@ static int sysrq_sysctl_handler(struct ctl_table *table, int write, - - #endif - -+#ifdef CONFIG_BPF_SYSCALL -+static int bpf_unpriv_handler(struct ctl_table *table, int write, -+ void *buffer, size_t *lenp, loff_t *ppos) -+{ -+ int ret, unpriv_enable = *(int *)table->data; -+ bool locked_state = unpriv_enable == 1; -+ struct ctl_table tmp = *table; -+ -+ if (write && !capable(CAP_SYS_ADMIN)) -+ return -EPERM; -+ -+ tmp.data = &unpriv_enable; -+ ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos); -+ if (write && !ret) { -+ if (locked_state && unpriv_enable != 1) -+ return -EPERM; -+ *(int *)table->data = unpriv_enable; -+ } -+ return ret; -+} -+#endif -+ - static struct ctl_table kern_table[]; - static struct ctl_table vm_table[]; - static struct ctl_table fs_table[]; -@@ -1255,10 +1277,9 @@ static struct ctl_table kern_table[] = { - .data = &sysctl_unprivileged_bpf_disabled, - .maxlen = sizeof(sysctl_unprivileged_bpf_disabled), - .mode = 0644, -- /* only handle a transition from default "0" to "1" */ -- .proc_handler = proc_dointvec_minmax, -- .extra1 = SYSCTL_ONE, -- .extra2 = SYSCTL_ONE, -+ .proc_handler = bpf_unpriv_handler, -+ .extra1 = SYSCTL_ZERO, -+ .extra2 = &two, - }, - { - .procname = "bpf_stats_enabled", -diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c -index 0dd8984a261da..f085b1648e66c 100644 ---- a/net/bridge/br_device.c -+++ b/net/bridge/br_device.c -@@ -33,7 +33,6 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev) - struct pcpu_sw_netstats *brstats = this_cpu_ptr(br->stats); - const struct nf_br_ops *nf_ops; - const unsigned char *dest; -- struct ethhdr *eth; - u16 vid = 0; - - rcu_read_lock(); -@@ -53,15 +52,14 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev) - BR_INPUT_SKB_CB(skb)->frag_max_size = 0; - - skb_reset_mac_header(skb); -- eth = eth_hdr(skb); - skb_pull(skb, ETH_HLEN); - - if (!br_allowed_ingress(br, br_vlan_group_rcu(br), skb, &vid)) - goto out; - - if (IS_ENABLED(CONFIG_INET) && -- (eth->h_proto == htons(ETH_P_ARP) || -- eth->h_proto == htons(ETH_P_RARP)) && -+ (eth_hdr(skb)->h_proto == htons(ETH_P_ARP) || -+ eth_hdr(skb)->h_proto == htons(ETH_P_RARP)) && - br_opt_get(br, BROPT_NEIGH_SUPPRESS_ENABLED)) { - br_do_proxy_suppress_arp(skb, br, vid, NULL); - } else if (IS_ENABLED(CONFIG_IPV6) && -diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c -index d71935618871e..2da6896080363 100644 ---- a/net/ipv4/ipmr.c -+++ b/net/ipv4/ipmr.c -@@ -259,7 +259,9 @@ static int __net_init ipmr_rules_init(struct net *net) - return 0; - - err2: -+ rtnl_lock(); - ipmr_free_table(mrt); -+ rtnl_unlock(); - err1: - fib_rules_unregister(ops); - return err; -diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c -index dd41313d7fa50..aee1f6bc039ab 100644 ---- a/net/ipv6/ip6mr.c -+++ b/net/ipv6/ip6mr.c -@@ -246,7 +246,9 @@ static int __net_init ip6mr_rules_init(struct net *net) - return 0; - - err2: -+ rtnl_lock(); - ip6mr_free_table(mrt); -+ rtnl_unlock(); - err1: - fib_rules_unregister(ops); - return err; -diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c -index e70f990334083..6f36df85d23d8 100644 ---- a/net/sched/sch_api.c -+++ b/net/sched/sch_api.c -@@ -1195,7 +1195,7 @@ static struct Qdisc *qdisc_create(struct net_device *dev, - - err = -ENOENT; - if (!ops) { -- NL_SET_ERR_MSG(extack, "Specified qdisc not found"); -+ NL_SET_ERR_MSG(extack, "Specified qdisc kind is unknown"); - goto err_out; - } - -diff --git a/net/tipc/name_distr.c b/net/tipc/name_distr.c -index 836e629e8f4ab..661bc2551a0a2 100644 ---- a/net/tipc/name_distr.c -+++ b/net/tipc/name_distr.c -@@ -290,7 +290,7 @@ static bool tipc_update_nametbl(struct net *net, struct distr_item *i, - pr_warn_ratelimited("Failed to remove binding %u,%u from %x\n", - type, lower, node); - } else { -- pr_warn("Unrecognized name table message received\n"); -+ pr_warn_ratelimited("Unknown name table message received\n"); - } - return false; - } -diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c -index 68571c40d61f6..a3e6fccff7123 100644 ---- a/security/integrity/ima/ima_fs.c -+++ b/security/integrity/ima/ima_fs.c -@@ -494,12 +494,12 @@ int __init ima_fs_init(void) - - return 0; - out: -+ securityfs_remove(ima_policy); - securityfs_remove(violations); - securityfs_remove(runtime_measurements_count); - securityfs_remove(ascii_runtime_measurements); - securityfs_remove(binary_runtime_measurements); - securityfs_remove(ima_symlink); - securityfs_remove(ima_dir); -- securityfs_remove(ima_policy); - return -1; - } -diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c -index e725d41872713..a073e49d5cd7d 100644 ---- a/security/integrity/ima/ima_policy.c -+++ b/security/integrity/ima/ima_policy.c -@@ -1382,6 +1382,14 @@ int ima_policy_show(struct seq_file *m, void *v) - - rcu_read_lock(); - -+ /* Do not print rules with inactive LSM labels */ -+ for (i = 0; i < MAX_LSM_RULES; i++) { -+ if (entry->lsm[i].args_p && !entry->lsm[i].rule) { -+ rcu_read_unlock(); -+ return 0; -+ } -+ } -+ - if (entry->action & MEASURE) - seq_puts(m, pt(Opt_measure)); - if (entry->action & DONT_MEASURE) -diff --git a/security/integrity/ima/ima_template.c b/security/integrity/ima/ima_template.c -index 6aa6408603e33..2283051d063bc 100644 ---- a/security/integrity/ima/ima_template.c -+++ b/security/integrity/ima/ima_template.c -@@ -29,6 +29,7 @@ static struct ima_template_desc builtin_templates[] = { - - static LIST_HEAD(defined_templates); - static DEFINE_SPINLOCK(template_list); -+static int template_setup_done; - - static const struct ima_template_field supported_fields[] = { - {.field_id = "d", .field_init = ima_eventdigest_init, -@@ -82,10 +83,11 @@ static int __init ima_template_setup(char *str) - struct ima_template_desc *template_desc; - int template_len = strlen(str); - -- if (ima_template) -+ if (template_setup_done) - return 1; - -- ima_init_template_list(); -+ if (!ima_template) -+ ima_init_template_list(); - - /* - * Verify that a template with the supplied name exists. -@@ -109,6 +111,7 @@ static int __init ima_template_setup(char *str) - } - - ima_template = template_desc; -+ template_setup_done = 1; - return 1; - } - __setup("ima_template=", ima_template_setup); -@@ -117,7 +120,7 @@ static int __init ima_template_fmt_setup(char *str) - { - int num_templates = ARRAY_SIZE(builtin_templates); - -- if (ima_template) -+ if (template_setup_done) - return 1; - - if (template_desc_init_fields(str, NULL, NULL) < 0) { -@@ -128,6 +131,7 @@ static int __init ima_template_fmt_setup(char *str) - - builtin_templates[num_templates - 1].fmt = str; - ima_template = builtin_templates + num_templates - 1; -+ template_setup_done = 1; - - return 1; - } -diff --git a/security/integrity/integrity_audit.c b/security/integrity/integrity_audit.c -index 5109173839cc5..c7f0f82a9a110 100644 ---- a/security/integrity/integrity_audit.c -+++ b/security/integrity/integrity_audit.c -@@ -36,6 +36,8 @@ void integrity_audit_msg(int audit_msgno, struct inode *inode, - return; - - ab = audit_log_start(audit_context(), GFP_KERNEL, audit_msgno); -+ if (!ab) -+ return; - audit_log_format(ab, "pid=%d uid=%u auid=%u ses=%u", - task_pid_nr(current), - from_kuid(&init_user_ns, current_cred()->uid), -diff --git a/tools/perf/util/probe-event.c b/tools/perf/util/probe-event.c -index 6357ac508ad1e..67b7d2af1755d 100644 ---- a/tools/perf/util/probe-event.c -+++ b/tools/perf/util/probe-event.c -@@ -2954,6 +2954,9 @@ static int find_probe_trace_events_from_map(struct perf_probe_event *pev, - for (j = 0; j < num_matched_functions; j++) { - sym = syms[j]; - -+ if (sym->type != STT_FUNC) -+ continue; -+ - tev = (*tevs) + ret; - tp = &tev->point; - if (ret == num_matched_functions) { diff --git a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.180-181.patch b/patch/kernel/archive/odroidxu4-5.4/patch-5.4.180-181.patch deleted file mode 100644 index 9f5693ce1..000000000 --- a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.180-181.patch +++ /dev/null @@ -1,2733 +0,0 @@ -diff --git a/Makefile b/Makefile -index 6eb6645647147..afe2420bb3de0 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 5 - PATCHLEVEL = 4 --SUBLEVEL = 180 -+SUBLEVEL = 181 - EXTRAVERSION = - NAME = Kleptomaniac Octopus - -diff --git a/arch/arm/mach-omap2/display.c b/arch/arm/mach-omap2/display.c -index 46012ca812f48..1bd64f6ba8cfe 100644 ---- a/arch/arm/mach-omap2/display.c -+++ b/arch/arm/mach-omap2/display.c -@@ -263,9 +263,9 @@ static int __init omapdss_init_of(void) - } - - r = of_platform_populate(node, NULL, NULL, &pdev->dev); -+ put_device(&pdev->dev); - if (r) { - pr_err("Unable to populate DSS submodule devices\n"); -- put_device(&pdev->dev); - return r; - } - -diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c -index 6289b288d60a6..202b740adee0e 100644 ---- a/arch/arm/mach-omap2/omap_hwmod.c -+++ b/arch/arm/mach-omap2/omap_hwmod.c -@@ -782,8 +782,10 @@ static int __init _init_clkctrl_providers(void) - - for_each_matching_node(np, ti_clkctrl_match_table) { - ret = _setup_clkctrl_provider(np); -- if (ret) -+ if (ret) { -+ of_node_put(np); - break; -+ } - } - - return ret; -diff --git a/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi b/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi -index 9533c85fb0a30..d2d255a988a81 100644 ---- a/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi -+++ b/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi -@@ -76,6 +76,12 @@ - no-map; - }; - -+ /* 32 MiB reserved for ARM Trusted Firmware (BL32) */ -+ secmon_reserved_bl32: secmon@5300000 { -+ reg = <0x0 0x05300000 0x0 0x2000000>; -+ no-map; -+ }; -+ - linux,cma { - compatible = "shared-dma-pool"; - reusable; -diff --git a/arch/arm64/boot/dts/amlogic/meson-g12a-sei510.dts b/arch/arm64/boot/dts/amlogic/meson-g12a-sei510.dts -index b8d9e92197ac8..c76bf498ee388 100644 ---- a/arch/arm64/boot/dts/amlogic/meson-g12a-sei510.dts -+++ b/arch/arm64/boot/dts/amlogic/meson-g12a-sei510.dts -@@ -157,14 +157,6 @@ - regulator-always-on; - }; - -- reserved-memory { -- /* TEE Reserved Memory */ -- bl32_reserved: bl32@5000000 { -- reg = <0x0 0x05300000 0x0 0x2000000>; -- no-map; -- }; -- }; -- - sdio_pwrseq: sdio-pwrseq { - compatible = "mmc-pwrseq-simple"; - reset-gpios = <&gpio GPIOX_6 GPIO_ACTIVE_LOW>; -diff --git a/arch/arm64/boot/dts/amlogic/meson-gx.dtsi b/arch/arm64/boot/dts/amlogic/meson-gx.dtsi -index ce230d6ac35cd..ad7bc0eec6682 100644 ---- a/arch/arm64/boot/dts/amlogic/meson-gx.dtsi -+++ b/arch/arm64/boot/dts/amlogic/meson-gx.dtsi -@@ -41,6 +41,12 @@ - no-map; - }; - -+ /* 32 MiB reserved for ARM Trusted Firmware (BL32) */ -+ secmon_reserved_bl32: secmon@5300000 { -+ reg = <0x0 0x05300000 0x0 0x2000000>; -+ no-map; -+ }; -+ - linux,cma { - compatible = "shared-dma-pool"; - reusable; -diff --git a/arch/arm64/boot/dts/amlogic/meson-sm1-sei610.dts b/arch/arm64/boot/dts/amlogic/meson-sm1-sei610.dts -index 29ac78ddc057e..85fb59060cdff 100644 ---- a/arch/arm64/boot/dts/amlogic/meson-sm1-sei610.dts -+++ b/arch/arm64/boot/dts/amlogic/meson-sm1-sei610.dts -@@ -164,14 +164,6 @@ - regulator-always-on; - }; - -- reserved-memory { -- /* TEE Reserved Memory */ -- bl32_reserved: bl32@5000000 { -- reg = <0x0 0x05300000 0x0 0x2000000>; -- no-map; -- }; -- }; -- - sdio_pwrseq: sdio-pwrseq { - compatible = "mmc-pwrseq-simple"; - reset-gpios = <&gpio GPIOX_6 GPIO_ACTIVE_LOW>; -diff --git a/arch/arm64/kernel/ftrace.c b/arch/arm64/kernel/ftrace.c -index 06e56b4703153..822718eafdb44 100644 ---- a/arch/arm64/kernel/ftrace.c -+++ b/arch/arm64/kernel/ftrace.c -@@ -73,9 +73,21 @@ int ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr) - - if (offset < -SZ_128M || offset >= SZ_128M) { - #ifdef CONFIG_ARM64_MODULE_PLTS -- struct plt_entry trampoline, *dst; - struct module *mod; - -+ /* -+ * There is only one ftrace trampoline per module. For now, -+ * this is not a problem since on arm64, all dynamic ftrace -+ * invocations are routed via ftrace_caller(). This will need -+ * to be revisited if support for multiple ftrace entry points -+ * is added in the future, but for now, the pr_err() below -+ * deals with a theoretical issue only. -+ */ -+ if (addr != FTRACE_ADDR) { -+ pr_err("ftrace: far branches to multiple entry points unsupported inside a single module\n"); -+ return -EINVAL; -+ } -+ - /* - * On kernels that support module PLTs, the offset between the - * branch instruction and its target may legally exceed the -@@ -93,46 +105,7 @@ int ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr) - if (WARN_ON(!mod)) - return -EINVAL; - -- /* -- * There is only one ftrace trampoline per module. For now, -- * this is not a problem since on arm64, all dynamic ftrace -- * invocations are routed via ftrace_caller(). This will need -- * to be revisited if support for multiple ftrace entry points -- * is added in the future, but for now, the pr_err() below -- * deals with a theoretical issue only. -- * -- * Note that PLTs are place relative, and plt_entries_equal() -- * checks whether they point to the same target. Here, we need -- * to check if the actual opcodes are in fact identical, -- * regardless of the offset in memory so use memcmp() instead. -- */ -- dst = mod->arch.ftrace_trampoline; -- trampoline = get_plt_entry(addr, dst); -- if (memcmp(dst, &trampoline, sizeof(trampoline))) { -- if (plt_entry_is_initialized(dst)) { -- pr_err("ftrace: far branches to multiple entry points unsupported inside a single module\n"); -- return -EINVAL; -- } -- -- /* point the trampoline to our ftrace entry point */ -- module_disable_ro(mod); -- *dst = trampoline; -- module_enable_ro(mod, true); -- -- /* -- * Ensure updated trampoline is visible to instruction -- * fetch before we patch in the branch. Although the -- * architecture doesn't require an IPI in this case, -- * Neoverse-N1 erratum #1542419 does require one -- * if the TLB maintenance in module_enable_ro() is -- * skipped due to rodata_enabled. It doesn't seem worth -- * it to make it conditional given that this is -- * certainly not a fast-path. -- */ -- flush_icache_range((unsigned long)&dst[0], -- (unsigned long)&dst[1]); -- } -- addr = (unsigned long)dst; -+ addr = (unsigned long)mod->arch.ftrace_trampoline; - #else /* CONFIG_ARM64_MODULE_PLTS */ - return -EINVAL; - #endif /* CONFIG_ARM64_MODULE_PLTS */ -diff --git a/arch/arm64/kernel/module.c b/arch/arm64/kernel/module.c -index 03ff15bffbb6d..d0692ecb99bb0 100644 ---- a/arch/arm64/kernel/module.c -+++ b/arch/arm64/kernel/module.c -@@ -9,6 +9,7 @@ - - #include - #include -+#include - #include - #include - #include -@@ -470,22 +471,48 @@ overflow: - return -ENOEXEC; - } - --int module_finalize(const Elf_Ehdr *hdr, -- const Elf_Shdr *sechdrs, -- struct module *me) -+static const Elf_Shdr *find_section(const Elf_Ehdr *hdr, -+ const Elf_Shdr *sechdrs, -+ const char *name) - { - const Elf_Shdr *s, *se; - const char *secstrs = (void *)hdr + sechdrs[hdr->e_shstrndx].sh_offset; - - for (s = sechdrs, se = sechdrs + hdr->e_shnum; s < se; s++) { -- if (strcmp(".altinstructions", secstrs + s->sh_name) == 0) -- apply_alternatives_module((void *)s->sh_addr, s->sh_size); --#ifdef CONFIG_ARM64_MODULE_PLTS -- if (IS_ENABLED(CONFIG_DYNAMIC_FTRACE) && -- !strcmp(".text.ftrace_trampoline", secstrs + s->sh_name)) -- me->arch.ftrace_trampoline = (void *)s->sh_addr; --#endif -+ if (strcmp(name, secstrs + s->sh_name) == 0) -+ return s; - } - -+ return NULL; -+} -+ -+static int module_init_ftrace_plt(const Elf_Ehdr *hdr, -+ const Elf_Shdr *sechdrs, -+ struct module *mod) -+{ -+#if defined(CONFIG_ARM64_MODULE_PLTS) && defined(CONFIG_DYNAMIC_FTRACE) -+ const Elf_Shdr *s; -+ struct plt_entry *plt; -+ -+ s = find_section(hdr, sechdrs, ".text.ftrace_trampoline"); -+ if (!s) -+ return -ENOEXEC; -+ -+ plt = (void *)s->sh_addr; -+ *plt = get_plt_entry(FTRACE_ADDR, plt); -+ mod->arch.ftrace_trampoline = plt; -+#endif - return 0; - } -+ -+int module_finalize(const Elf_Ehdr *hdr, -+ const Elf_Shdr *sechdrs, -+ struct module *me) -+{ -+ const Elf_Shdr *s; -+ s = find_section(hdr, sechdrs, ".altinstructions"); -+ if (s) -+ apply_alternatives_module((void *)s->sh_addr, s->sh_size); -+ -+ return module_init_ftrace_plt(hdr, sechdrs, me); -+} -diff --git a/arch/parisc/Makefile b/arch/parisc/Makefile -index caa90ae0b4acc..04460c2d2f8c1 100644 ---- a/arch/parisc/Makefile -+++ b/arch/parisc/Makefile -@@ -65,7 +65,6 @@ KBUILD_CFLAGS += -DCC_USING_PATCHABLE_FUNCTION_ENTRY=1 \ - -DFTRACE_PATCHABLE_FUNCTION_SIZE=$(NOP_COUNT) - - CC_FLAGS_FTRACE := -fpatchable-function-entry=$(NOP_COUNT),$(shell echo $$(($(NOP_COUNT)-1))) --KBUILD_LDS_MODULE += $(srctree)/arch/parisc/kernel/module.lds - endif - - OBJCOPY_FLAGS =-O binary -R .note -R .comment -S -diff --git a/arch/parisc/kernel/module.c b/arch/parisc/kernel/module.c -index ac5f34993b53b..1c50093e2ebee 100644 ---- a/arch/parisc/kernel/module.c -+++ b/arch/parisc/kernel/module.c -@@ -43,6 +43,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -862,7 +863,7 @@ int module_finalize(const Elf_Ehdr *hdr, - const char *strtab = NULL; - const Elf_Shdr *s; - char *secstrings; -- int err, symindex = -1; -+ int symindex = -1; - Elf_Sym *newptr, *oldptr; - Elf_Shdr *symhdr = NULL; - #ifdef DEBUG -@@ -946,11 +947,13 @@ int module_finalize(const Elf_Ehdr *hdr, - /* patch .altinstructions */ - apply_alternatives(aseg, aseg + s->sh_size, me->name); - -+#ifdef CONFIG_DYNAMIC_FTRACE - /* For 32 bit kernels we're compiling modules with - * -ffunction-sections so we must relocate the addresses in the -- *__mcount_loc section. -+ * ftrace callsite section. - */ -- if (symindex != -1 && !strcmp(secname, "__mcount_loc")) { -+ if (symindex != -1 && !strcmp(secname, FTRACE_CALLSITE_SECTION)) { -+ int err; - if (s->sh_type == SHT_REL) - err = apply_relocate((Elf_Shdr *)sechdrs, - strtab, symindex, -@@ -962,6 +965,7 @@ int module_finalize(const Elf_Ehdr *hdr, - if (err) - return err; - } -+#endif - } - return 0; - } -diff --git a/arch/parisc/kernel/module.lds b/arch/parisc/kernel/module.lds -deleted file mode 100644 -index 1a9a92aca5c8a..0000000000000 ---- a/arch/parisc/kernel/module.lds -+++ /dev/null -@@ -1,7 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0 */ -- --SECTIONS { -- __mcount_loc : { -- *(__patchable_function_entries) -- } --} -diff --git a/arch/parisc/mm/init.c b/arch/parisc/mm/init.c -index d769d61cde7ca..15b7dae1808db 100644 ---- a/arch/parisc/mm/init.c -+++ b/arch/parisc/mm/init.c -@@ -347,9 +347,9 @@ static void __init setup_bootmem(void) - - static bool kernel_set_to_readonly; - --static void __init map_pages(unsigned long start_vaddr, -- unsigned long start_paddr, unsigned long size, -- pgprot_t pgprot, int force) -+static void __ref map_pages(unsigned long start_vaddr, -+ unsigned long start_paddr, unsigned long size, -+ pgprot_t pgprot, int force) - { - pgd_t *pg_dir; - pmd_t *pmd; -@@ -485,7 +485,7 @@ void __init set_kernel_text_rw(int enable_read_write) - flush_tlb_all(); - } - --void __ref free_initmem(void) -+void free_initmem(void) - { - unsigned long init_begin = (unsigned long)__init_begin; - unsigned long init_end = (unsigned long)__init_end; -@@ -499,7 +499,6 @@ void __ref free_initmem(void) - /* The init text pages are marked R-X. We have to - * flush the icache and mark them RW- - * -- * This is tricky, because map_pages is in the init section. - * Do a dummy remap of the data section first (the data - * section is already PAGE_KERNEL) to pull in the TLB entries - * for map_kernel */ -diff --git a/arch/powerpc/lib/sstep.c b/arch/powerpc/lib/sstep.c -index c077acb983a19..dc6728dacbc6b 100644 ---- a/arch/powerpc/lib/sstep.c -+++ b/arch/powerpc/lib/sstep.c -@@ -2787,12 +2787,14 @@ void emulate_update_regs(struct pt_regs *regs, struct instruction_op *op) - case BARRIER_EIEIO: - eieio(); - break; -+#ifdef CONFIG_PPC64 - case BARRIER_LWSYNC: - asm volatile("lwsync" : : : "memory"); - break; - case BARRIER_PTESYNC: - asm volatile("ptesync" : : : "memory"); - break; -+#endif - } - break; - -diff --git a/arch/x86/kvm/pmu.c b/arch/x86/kvm/pmu.c -index 46875bbd04198..e0e3776059af4 100644 ---- a/arch/x86/kvm/pmu.c -+++ b/arch/x86/kvm/pmu.c -@@ -191,7 +191,7 @@ void reprogram_gp_counter(struct kvm_pmc *pmc, u64 eventsel) - } - - if (type == PERF_TYPE_RAW) -- config = eventsel & X86_RAW_EVENT_MASK; -+ config = eventsel & AMD64_RAW_EVENT_MASK; - - pmc_reprogram_counter(pmc, type, config, - !(eventsel & ARCH_PERFMON_EVENTSEL_USR), -diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c -index 425444d080712..2f84509f28289 100644 ---- a/arch/x86/kvm/svm.c -+++ b/arch/x86/kvm/svm.c -@@ -4585,8 +4585,6 @@ static int avic_incomplete_ipi_interception(struct vcpu_svm *svm) - break; - } - case AVIC_IPI_FAILURE_INVALID_TARGET: -- WARN_ONCE(1, "Invalid IPI target: index=%u, vcpu=%d, icr=%#0x:%#0x\n", -- index, svm->vcpu.vcpu_id, icrh, icrl); - break; - case AVIC_IPI_FAILURE_INVALID_BACKING_PAGE: - WARN_ONCE(1, "Invalid backing page\n"); -diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c -index 73bffd7af15c1..1a0c581512f28 100644 ---- a/block/bfq-iosched.c -+++ b/block/bfq-iosched.c -@@ -6389,6 +6389,8 @@ static void bfq_exit_queue(struct elevator_queue *e) - spin_unlock_irq(&bfqd->lock); - #endif - -+ wbt_enable_default(bfqd->queue); -+ - kfree(bfqd); - } - -diff --git a/block/elevator.c b/block/elevator.c -index 076ba7308e65c..78805c74ea8a4 100644 ---- a/block/elevator.c -+++ b/block/elevator.c -@@ -522,8 +522,6 @@ void elv_unregister_queue(struct request_queue *q) - kobject_del(&e->kobj); - - e->registered = 0; -- /* Re-enable throttling in case elevator disabled it */ -- wbt_enable_default(q); - } - } - -diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c -index 92fb1f5b240e8..dca1590f295d0 100644 ---- a/drivers/ata/libata-core.c -+++ b/drivers/ata/libata-core.c -@@ -4595,6 +4595,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = { - - /* devices that don't properly handle TRIM commands */ - { "SuperSSpeed S238*", NULL, ATA_HORKAGE_NOTRIM, }, -+ { "M88V29*", NULL, ATA_HORKAGE_NOTRIM, }, - - /* - * As defined, the DRAT (Deterministic Read After Trim) and RZAT -diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c -index f63d141481a3f..9aae6b3da356b 100644 ---- a/drivers/dma/at_xdmac.c -+++ b/drivers/dma/at_xdmac.c -@@ -1726,11 +1726,13 @@ static irqreturn_t at_xdmac_interrupt(int irq, void *dev_id) - static void at_xdmac_issue_pending(struct dma_chan *chan) - { - struct at_xdmac_chan *atchan = to_at_xdmac_chan(chan); -+ unsigned long flags; - - dev_dbg(chan2dev(&atchan->chan), "%s\n", __func__); - -- if (!at_xdmac_chan_is_cyclic(atchan)) -- at_xdmac_advance_work(atchan); -+ spin_lock_irqsave(&atchan->lock, flags); -+ at_xdmac_advance_work(atchan); -+ spin_unlock_irqrestore(&atchan->lock, flags); - - return; - } -diff --git a/drivers/dma/sh/rcar-dmac.c b/drivers/dma/sh/rcar-dmac.c -index 89eb9ea258149..eba942441e382 100644 ---- a/drivers/dma/sh/rcar-dmac.c -+++ b/drivers/dma/sh/rcar-dmac.c -@@ -1825,7 +1825,9 @@ static int rcar_dmac_probe(struct platform_device *pdev) - platform_set_drvdata(pdev, dmac); - dmac->dev->dma_parms = &dmac->parms; - dma_set_max_seg_size(dmac->dev, RCAR_DMATCR_MASK); -- dma_set_mask_and_coherent(dmac->dev, DMA_BIT_MASK(40)); -+ ret = dma_set_mask_and_coherent(dmac->dev, DMA_BIT_MASK(40)); -+ if (ret) -+ return ret; - - ret = rcar_dmac_parse_of(&pdev->dev, dmac); - if (ret < 0) -diff --git a/drivers/edac/edac_mc.c b/drivers/edac/edac_mc.c -index e73ca303f1a7e..78e4a070896fc 100644 ---- a/drivers/edac/edac_mc.c -+++ b/drivers/edac/edac_mc.c -@@ -263,7 +263,7 @@ void *edac_align_ptr(void **p, unsigned int size, int n_elems) - else - return (char *)ptr; - -- r = (unsigned long)p % align; -+ r = (unsigned long)ptr % align; - - if (r == 0) - return (char *)ptr; -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c -index 58e14d3040f03..870dd78d5a21a 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c -@@ -1976,7 +1976,7 @@ int amdgpu_copy_buffer(struct amdgpu_ring *ring, uint64_t src_offset, - unsigned i; - int r; - -- if (direct_submit && !ring->sched.ready) { -+ if (!direct_submit && !ring->sched.ready) { - DRM_ERROR("Trying to move memory with ring turned off.\n"); - return -EINVAL; - } -diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c -index cc8f32a1b03c6..92ffed5c1d690 100644 ---- a/drivers/gpu/drm/radeon/atombios_encoders.c -+++ b/drivers/gpu/drm/radeon/atombios_encoders.c -@@ -197,7 +197,8 @@ void radeon_atom_backlight_init(struct radeon_encoder *radeon_encoder, - * so don't register a backlight device - */ - if ((rdev->pdev->subsystem_vendor == PCI_VENDOR_ID_APPLE) && -- (rdev->pdev->device == 0x6741)) -+ (rdev->pdev->device == 0x6741) && -+ !dmi_match(DMI_PRODUCT_NAME, "iMac12,1")) - return; - - if (!radeon_encoder->enc_priv) -diff --git a/drivers/gpu/drm/rockchip/dw_hdmi-rockchip.c b/drivers/gpu/drm/rockchip/dw_hdmi-rockchip.c -index 906891b03a38d..7805091bac32d 100644 ---- a/drivers/gpu/drm/rockchip/dw_hdmi-rockchip.c -+++ b/drivers/gpu/drm/rockchip/dw_hdmi-rockchip.c -@@ -528,13 +528,6 @@ static int dw_hdmi_rockchip_bind(struct device *dev, struct device *master, - return ret; - } - -- ret = clk_prepare_enable(hdmi->vpll_clk); -- if (ret) { -- DRM_DEV_ERROR(hdmi->dev, "Failed to enable HDMI vpll: %d\n", -- ret); -- return ret; -- } -- - hdmi->phy = devm_phy_optional_get(dev, "hdmi"); - if (IS_ERR(hdmi->phy)) { - ret = PTR_ERR(hdmi->phy); -@@ -543,6 +536,13 @@ static int dw_hdmi_rockchip_bind(struct device *dev, struct device *master, - return ret; - } - -+ ret = clk_prepare_enable(hdmi->vpll_clk); -+ if (ret) { -+ DRM_DEV_ERROR(hdmi->dev, "Failed to enable HDMI vpll: %d\n", -+ ret); -+ return ret; -+ } -+ - drm_encoder_helper_add(encoder, &dw_hdmi_rockchip_encoder_helper_funcs); - drm_encoder_init(drm, encoder, &dw_hdmi_rockchip_encoder_funcs, - DRM_MODE_ENCODER_TMDS, NULL); -diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h -index 26758ea844c92..c587a77d493c1 100644 ---- a/drivers/hid/hid-ids.h -+++ b/drivers/hid/hid-ids.h -@@ -1311,6 +1311,7 @@ - #define USB_VENDOR_ID_UGTIZER 0x2179 - #define USB_DEVICE_ID_UGTIZER_TABLET_GP0610 0x0053 - #define USB_DEVICE_ID_UGTIZER_TABLET_GT5040 0x0077 -+#define USB_DEVICE_ID_UGTIZER_TABLET_WP5540 0x0004 - - #define USB_VENDOR_ID_VIEWSONIC 0x0543 - #define USB_DEVICE_ID_VIEWSONIC_PD1011 0xe621 -diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c -index 8a0132c54c312..45eba224cdc77 100644 ---- a/drivers/hid/hid-quirks.c -+++ b/drivers/hid/hid-quirks.c -@@ -187,6 +187,7 @@ static const struct hid_device_id hid_quirks[] = { - { HID_USB_DEVICE(USB_VENDOR_ID_TURBOX, USB_DEVICE_ID_TURBOX_KEYBOARD), HID_QUIRK_NOGET }, - { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_KNA5), HID_QUIRK_MULTI_INPUT }, - { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_TWA60), HID_QUIRK_MULTI_INPUT }, -+ { HID_USB_DEVICE(USB_VENDOR_ID_UGTIZER, USB_DEVICE_ID_UGTIZER_TABLET_WP5540), HID_QUIRK_MULTI_INPUT }, - { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_MEDIA_TABLET_10_6_INCH), HID_QUIRK_MULTI_INPUT }, - { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_MEDIA_TABLET_14_1_INCH), HID_QUIRK_MULTI_INPUT }, - { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_SIRIUS_BATTERY_FREE_TABLET), HID_QUIRK_MULTI_INPUT }, -diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c -index 2d2568dac2a66..6b7ab8f234e87 100644 ---- a/drivers/hv/vmbus_drv.c -+++ b/drivers/hv/vmbus_drv.c -@@ -1787,8 +1787,10 @@ int vmbus_add_channel_kobj(struct hv_device *dev, struct vmbus_channel *channel) - kobj->kset = dev->channels_kset; - ret = kobject_init_and_add(kobj, &vmbus_chan_ktype, NULL, - "%u", relid); -- if (ret) -+ if (ret) { -+ kobject_put(kobj); - return ret; -+ } - - ret = sysfs_create_group(kobj, &vmbus_chan_group); - -@@ -1797,6 +1799,7 @@ int vmbus_add_channel_kobj(struct hv_device *dev, struct vmbus_channel *channel) - * The calling functions' error handling paths will cleanup the - * empty channel directory. - */ -+ kobject_put(kobj); - dev_err(device, "Unable to set up channel sysfs files\n"); - return ret; - } -diff --git a/drivers/i2c/busses/i2c-brcmstb.c b/drivers/i2c/busses/i2c-brcmstb.c -index 5e89cd6b690ce..36b8aceb972fc 100644 ---- a/drivers/i2c/busses/i2c-brcmstb.c -+++ b/drivers/i2c/busses/i2c-brcmstb.c -@@ -640,7 +640,7 @@ static int brcmstb_i2c_probe(struct platform_device *pdev) - - /* set the data in/out register size for compatible SoCs */ - if (of_device_is_compatible(dev->device->of_node, -- "brcmstb,brcmper-i2c")) -+ "brcm,brcmper-i2c")) - dev->data_regsz = sizeof(u8); - else - dev->data_regsz = sizeof(u32); -diff --git a/drivers/irqchip/irq-sifive-plic.c b/drivers/irqchip/irq-sifive-plic.c -index 7cd7b140dfe97..9dad45d928bfe 100644 ---- a/drivers/irqchip/irq-sifive-plic.c -+++ b/drivers/irqchip/irq-sifive-plic.c -@@ -313,3 +313,4 @@ out_iounmap: - - IRQCHIP_DECLARE(sifive_plic, "sifive,plic-1.0.0", plic_init); - IRQCHIP_DECLARE(riscv_plic0, "riscv,plic0", plic_init); /* for legacy systems */ -+IRQCHIP_DECLARE(thead_c900_plic, "thead,c900-plic", plic_init); /* for firmware driver */ -diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c -index e92f9373e2274..362ad361d5861 100644 ---- a/drivers/mmc/core/block.c -+++ b/drivers/mmc/core/block.c -@@ -1671,31 +1671,31 @@ static void mmc_blk_read_single(struct mmc_queue *mq, struct request *req) - struct mmc_card *card = mq->card; - struct mmc_host *host = card->host; - blk_status_t error = BLK_STS_OK; -- int retries = 0; - - do { - u32 status; - int err; -+ int retries = 0; - -- mmc_blk_rw_rq_prep(mqrq, card, 1, mq); -+ while (retries++ <= MMC_READ_SINGLE_RETRIES) { -+ mmc_blk_rw_rq_prep(mqrq, card, 1, mq); - -- mmc_wait_for_req(host, mrq); -+ mmc_wait_for_req(host, mrq); - -- err = mmc_send_status(card, &status); -- if (err) -- goto error_exit; -- -- if (!mmc_host_is_spi(host) && -- !mmc_blk_in_tran_state(status)) { -- err = mmc_blk_fix_state(card, req); -+ err = mmc_send_status(card, &status); - if (err) - goto error_exit; -- } - -- if (mrq->cmd->error && retries++ < MMC_READ_SINGLE_RETRIES) -- continue; -+ if (!mmc_host_is_spi(host) && -+ !mmc_blk_in_tran_state(status)) { -+ err = mmc_blk_fix_state(card, req); -+ if (err) -+ goto error_exit; -+ } - -- retries = 0; -+ if (!mrq->cmd->error) -+ break; -+ } - - if (mrq->cmd->error || - mrq->data->error || -diff --git a/drivers/mtd/nand/raw/brcmnand/brcmnand.c b/drivers/mtd/nand/raw/brcmnand/brcmnand.c -index 0f3c09fb9c34f..bd9f45edc9a34 100644 ---- a/drivers/mtd/nand/raw/brcmnand/brcmnand.c -+++ b/drivers/mtd/nand/raw/brcmnand/brcmnand.c -@@ -1756,7 +1756,7 @@ static int brcmnand_read_by_pio(struct mtd_info *mtd, struct nand_chip *chip, - mtd->oobsize / trans, - host->hwcfg.sector_size_1k); - -- if (!ret) { -+ if (ret != -EBADMSG) { - *err_addr = brcmnand_get_uncorrecc_addr(ctrl); - - if (*err_addr) -diff --git a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c -index 515094e253dcd..ab2f824abf549 100644 ---- a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c -+++ b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c -@@ -2442,7 +2442,7 @@ static int gpmi_nfc_exec_op(struct nand_chip *chip, - this->hw.must_apply_timings = false; - ret = gpmi_nfc_apply_timings(this); - if (ret) -- return ret; -+ goto out_pm; - } - - dev_dbg(this->dev, "%s: %d instructions\n", __func__, op->ninstrs); -@@ -2571,6 +2571,7 @@ unmap: - - this->bch = false; - -+out_pm: - pm_runtime_mark_last_busy(this->dev); - pm_runtime_put_autosuspend(this->dev); - -diff --git a/drivers/mtd/nand/raw/qcom_nandc.c b/drivers/mtd/nand/raw/qcom_nandc.c -index c10995ca624a6..5af3bef6c2303 100644 ---- a/drivers/mtd/nand/raw/qcom_nandc.c -+++ b/drivers/mtd/nand/raw/qcom_nandc.c -@@ -2,7 +2,6 @@ - /* - * Copyright (c) 2016, The Linux Foundation. All rights reserved. - */ -- - #include - #include - #include -@@ -2944,10 +2943,6 @@ static int qcom_nandc_probe(struct platform_device *pdev) - if (!nandc->base_dma) - return -ENXIO; - -- ret = qcom_nandc_alloc(nandc); -- if (ret) -- goto err_nandc_alloc; -- - ret = clk_prepare_enable(nandc->core_clk); - if (ret) - goto err_core_clk; -@@ -2956,6 +2951,10 @@ static int qcom_nandc_probe(struct platform_device *pdev) - if (ret) - goto err_aon_clk; - -+ ret = qcom_nandc_alloc(nandc); -+ if (ret) -+ goto err_nandc_alloc; -+ - ret = qcom_nandc_setup(nandc); - if (ret) - goto err_setup; -@@ -2967,15 +2966,14 @@ static int qcom_nandc_probe(struct platform_device *pdev) - return 0; - - err_setup: -+ qcom_nandc_unalloc(nandc); -+err_nandc_alloc: - clk_disable_unprepare(nandc->aon_clk); - err_aon_clk: - clk_disable_unprepare(nandc->core_clk); - err_core_clk: -- qcom_nandc_unalloc(nandc); --err_nandc_alloc: - dma_unmap_resource(dev, res->start, resource_size(res), - DMA_BIDIRECTIONAL, 0); -- - return ret; - } - -diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c -index ed170d803247a..41e58bd2e6069 100644 ---- a/drivers/net/bonding/bond_3ad.c -+++ b/drivers/net/bonding/bond_3ad.c -@@ -233,7 +233,7 @@ static inline int __check_agg_selection_timer(struct port *port) - if (bond == NULL) - return 0; - -- return BOND_AD_INFO(bond).agg_select_timer ? 1 : 0; -+ return atomic_read(&BOND_AD_INFO(bond).agg_select_timer) ? 1 : 0; - } - - /** -@@ -1985,7 +1985,7 @@ static void ad_marker_response_received(struct bond_marker *marker, - */ - void bond_3ad_initiate_agg_selection(struct bonding *bond, int timeout) - { -- BOND_AD_INFO(bond).agg_select_timer = timeout; -+ atomic_set(&BOND_AD_INFO(bond).agg_select_timer, timeout); - } - - /** -@@ -2268,6 +2268,28 @@ void bond_3ad_update_ad_actor_settings(struct bonding *bond) - spin_unlock_bh(&bond->mode_lock); - } - -+/** -+ * bond_agg_timer_advance - advance agg_select_timer -+ * @bond: bonding structure -+ * -+ * Return true when agg_select_timer reaches 0. -+ */ -+static bool bond_agg_timer_advance(struct bonding *bond) -+{ -+ int val, nval; -+ -+ while (1) { -+ val = atomic_read(&BOND_AD_INFO(bond).agg_select_timer); -+ if (!val) -+ return false; -+ nval = val - 1; -+ if (atomic_cmpxchg(&BOND_AD_INFO(bond).agg_select_timer, -+ val, nval) == val) -+ break; -+ } -+ return nval == 0; -+} -+ - /** - * bond_3ad_state_machine_handler - handle state machines timeout - * @bond: bonding struct to work on -@@ -2303,9 +2325,7 @@ void bond_3ad_state_machine_handler(struct work_struct *work) - if (!bond_has_slaves(bond)) - goto re_arm; - -- /* check if agg_select_timer timer after initialize is timed out */ -- if (BOND_AD_INFO(bond).agg_select_timer && -- !(--BOND_AD_INFO(bond).agg_select_timer)) { -+ if (bond_agg_timer_advance(bond)) { - slave = bond_first_slave_rcu(bond); - port = slave ? &(SLAVE_AD_INFO(slave)->port) : NULL; - -diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c -index ff50ccc7dceb1..d6ecd03b60452 100644 ---- a/drivers/net/bonding/bond_main.c -+++ b/drivers/net/bonding/bond_main.c -@@ -1979,10 +1979,9 @@ static int __bond_release_one(struct net_device *bond_dev, - bond_select_active_slave(bond); - } - -- if (!bond_has_slaves(bond)) { -- bond_set_carrier(bond); -+ bond_set_carrier(bond); -+ if (!bond_has_slaves(bond)) - eth_hw_addr_random(bond_dev); -- } - - unblock_netpoll_tx(); - synchronize_rcu(); -diff --git a/drivers/net/dsa/lan9303-core.c b/drivers/net/dsa/lan9303-core.c -index 19d1f1c51f97e..4b9d5b0ce416b 100644 ---- a/drivers/net/dsa/lan9303-core.c -+++ b/drivers/net/dsa/lan9303-core.c -@@ -1303,7 +1303,7 @@ static int lan9303_probe_reset_gpio(struct lan9303 *chip, - struct device_node *np) - { - chip->reset_gpio = devm_gpiod_get_optional(chip->dev, "reset", -- GPIOD_OUT_LOW); -+ GPIOD_OUT_HIGH); - if (IS_ERR(chip->reset_gpio)) - return PTR_ERR(chip->reset_gpio); - -diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c -index ebd0853a6f313..0dc52cf5367e7 100644 ---- a/drivers/net/ethernet/cadence/macb_main.c -+++ b/drivers/net/ethernet/cadence/macb_main.c -@@ -4284,7 +4284,7 @@ static int macb_probe(struct platform_device *pdev) - - #ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT - if (GEM_BFEXT(DAW64, gem_readl(bp, DCFG6))) { -- dma_set_mask(&pdev->dev, DMA_BIT_MASK(44)); -+ dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(44)); - bp->hw_dma_cap |= HW_DMA_CAP_64B; - } - #endif -diff --git a/drivers/net/ieee802154/at86rf230.c b/drivers/net/ieee802154/at86rf230.c -index 7d67f41387f55..4f5ef8a9a9a87 100644 ---- a/drivers/net/ieee802154/at86rf230.c -+++ b/drivers/net/ieee802154/at86rf230.c -@@ -100,6 +100,7 @@ struct at86rf230_local { - unsigned long cal_timeout; - bool is_tx; - bool is_tx_from_off; -+ bool was_tx; - u8 tx_retry; - struct sk_buff *tx_skb; - struct at86rf230_state_change tx; -@@ -343,7 +344,11 @@ at86rf230_async_error_recover_complete(void *context) - if (ctx->free) - kfree(ctx); - -- ieee802154_wake_queue(lp->hw); -+ if (lp->was_tx) { -+ lp->was_tx = 0; -+ dev_kfree_skb_any(lp->tx_skb); -+ ieee802154_wake_queue(lp->hw); -+ } - } - - static void -@@ -352,7 +357,11 @@ at86rf230_async_error_recover(void *context) - struct at86rf230_state_change *ctx = context; - struct at86rf230_local *lp = ctx->lp; - -- lp->is_tx = 0; -+ if (lp->is_tx) { -+ lp->was_tx = 1; -+ lp->is_tx = 0; -+ } -+ - at86rf230_async_state_change(lp, ctx, STATE_RX_AACK_ON, - at86rf230_async_error_recover_complete); - } -diff --git a/drivers/net/ieee802154/ca8210.c b/drivers/net/ieee802154/ca8210.c -index 7c131a423cafa..47959aadbc503 100644 ---- a/drivers/net/ieee802154/ca8210.c -+++ b/drivers/net/ieee802154/ca8210.c -@@ -2976,8 +2976,8 @@ static void ca8210_hw_setup(struct ieee802154_hw *ca8210_hw) - ca8210_hw->phy->cca.opt = NL802154_CCA_OPT_ENERGY_CARRIER_AND; - ca8210_hw->phy->cca_ed_level = -9800; - ca8210_hw->phy->symbol_duration = 16; -- ca8210_hw->phy->lifs_period = 40; -- ca8210_hw->phy->sifs_period = 12; -+ ca8210_hw->phy->lifs_period = 40 * ca8210_hw->phy->symbol_duration; -+ ca8210_hw->phy->sifs_period = 12 * ca8210_hw->phy->symbol_duration; - ca8210_hw->flags = - IEEE802154_HW_AFILT | - IEEE802154_HW_OMIT_CKSUM | -diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c -index 6508d70056b3a..566ea48fd6078 100644 ---- a/drivers/net/usb/qmi_wwan.c -+++ b/drivers/net/usb/qmi_wwan.c -@@ -1355,6 +1355,8 @@ static const struct usb_device_id products[] = { - {QMI_FIXED_INTF(0x413c, 0x81d7, 0)}, /* Dell Wireless 5821e */ - {QMI_FIXED_INTF(0x413c, 0x81d7, 1)}, /* Dell Wireless 5821e preproduction config */ - {QMI_FIXED_INTF(0x413c, 0x81e0, 0)}, /* Dell Wireless 5821e with eSIM support*/ -+ {QMI_FIXED_INTF(0x413c, 0x81e4, 0)}, /* Dell Wireless 5829e with eSIM support*/ -+ {QMI_FIXED_INTF(0x413c, 0x81e6, 0)}, /* Dell Wireless 5829e */ - {QMI_FIXED_INTF(0x03f0, 0x4e1d, 8)}, /* HP lt4111 LTE/EV-DO/HSPA+ Gobi 4G Module */ - {QMI_FIXED_INTF(0x03f0, 0x9d1d, 1)}, /* HP lt4120 Snapdragon X5 LTE */ - {QMI_FIXED_INTF(0x22de, 0x9061, 3)}, /* WeTelecom WPD-600N */ -diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c -index 83cb2ad03451b..1848b957dc5cd 100644 ---- a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c -+++ b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c -@@ -1616,6 +1616,8 @@ static void iwl_req_fw_callback(const struct firmware *ucode_raw, void *context) - out_unbind: - complete(&drv->request_firmware_complete); - device_release_driver(drv->trans->dev); -+ /* drv has just been freed by the release */ -+ failure = false; - free: - if (failure) - iwl_dealloc_ucode(drv); -diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c -index ee45e475405a1..fba6fff13349e 100644 ---- a/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c -+++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c -@@ -292,8 +292,7 @@ int iwl_trans_pcie_gen2_start_fw(struct iwl_trans *trans, - /* This may fail if AMT took ownership of the device */ - if (iwl_pcie_prepare_card_hw(trans)) { - IWL_WARN(trans, "Exit HW not ready\n"); -- ret = -EIO; -- goto out; -+ return -EIO; - } - - iwl_enable_rfkill_int(trans); -diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c -index 0581f082301e0..8915030030c4c 100644 ---- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c -+++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c -@@ -1335,8 +1335,7 @@ static int iwl_trans_pcie_start_fw(struct iwl_trans *trans, - /* This may fail if AMT took ownership of the device */ - if (iwl_pcie_prepare_card_hw(trans)) { - IWL_WARN(trans, "Exit HW not ready\n"); -- ret = -EIO; -- goto out; -+ return -EIO; - } - - iwl_enable_rfkill_int(trans); -diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c -index a5b5a2305791d..6a9a42809f972 100644 ---- a/drivers/nvme/host/core.c -+++ b/drivers/nvme/host/core.c -@@ -3896,7 +3896,14 @@ static void nvme_async_event_work(struct work_struct *work) - container_of(work, struct nvme_ctrl, async_event_work); - - nvme_aen_uevent(ctrl); -- ctrl->ops->submit_async_event(ctrl); -+ -+ /* -+ * The transport drivers must guarantee AER submission here is safe by -+ * flushing ctrl async_event_work after changing the controller state -+ * from LIVE and before freeing the admin queue. -+ */ -+ if (ctrl->state == NVME_CTRL_LIVE) -+ ctrl->ops->submit_async_event(ctrl); - } - - static bool nvme_ctrl_pp_status(struct nvme_ctrl *ctrl) -diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c -index 08a23bb4b8b57..4213c71b02a4b 100644 ---- a/drivers/nvme/host/rdma.c -+++ b/drivers/nvme/host/rdma.c -@@ -1110,6 +1110,7 @@ static void nvme_rdma_error_recovery_work(struct work_struct *work) - struct nvme_rdma_ctrl, err_work); - - nvme_stop_keep_alive(&ctrl->ctrl); -+ flush_work(&ctrl->ctrl.async_event_work); - nvme_rdma_teardown_io_queues(ctrl, false); - nvme_start_queues(&ctrl->ctrl); - nvme_rdma_teardown_admin_queue(ctrl, false); -diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c -index 1eef7ed0c3026..4378344f0e7ab 100644 ---- a/drivers/nvme/host/tcp.c -+++ b/drivers/nvme/host/tcp.c -@@ -1955,6 +1955,7 @@ static void nvme_tcp_error_recovery_work(struct work_struct *work) - struct nvme_ctrl *ctrl = &tcp_ctrl->ctrl; - - nvme_stop_keep_alive(ctrl); -+ flush_work(&ctrl->async_event_work); - nvme_tcp_teardown_io_queues(ctrl, false); - /* unquiesce to fail fast pending requests */ - nvme_start_queues(ctrl); -diff --git a/drivers/parisc/ccio-dma.c b/drivers/parisc/ccio-dma.c -index ad290f79983b9..5013568c571e5 100644 ---- a/drivers/parisc/ccio-dma.c -+++ b/drivers/parisc/ccio-dma.c -@@ -1003,7 +1003,7 @@ ccio_unmap_sg(struct device *dev, struct scatterlist *sglist, int nents, - ioc->usg_calls++; - #endif - -- while(sg_dma_len(sglist) && nents--) { -+ while (nents && sg_dma_len(sglist)) { - - #ifdef CCIO_COLLECT_STATS - ioc->usg_pages += sg_dma_len(sglist) >> PAGE_SHIFT; -@@ -1011,6 +1011,7 @@ ccio_unmap_sg(struct device *dev, struct scatterlist *sglist, int nents, - ccio_unmap_page(dev, sg_dma_address(sglist), - sg_dma_len(sglist), direction, 0); - ++sglist; -+ nents--; - } - - DBG_RUN_SG("%s() DONE (nents %d)\n", __func__, nents); -diff --git a/drivers/parisc/sba_iommu.c b/drivers/parisc/sba_iommu.c -index e410033b6df0c..822e5d19949e4 100644 ---- a/drivers/parisc/sba_iommu.c -+++ b/drivers/parisc/sba_iommu.c -@@ -1047,7 +1047,7 @@ sba_unmap_sg(struct device *dev, struct scatterlist *sglist, int nents, - spin_unlock_irqrestore(&ioc->res_lock, flags); - #endif - -- while (sg_dma_len(sglist) && nents--) { -+ while (nents && sg_dma_len(sglist)) { - - sba_unmap_page(dev, sg_dma_address(sglist), sg_dma_len(sglist), - direction, 0); -@@ -1056,6 +1056,7 @@ sba_unmap_sg(struct device *dev, struct scatterlist *sglist, int nents, - ioc->usingle_calls--; /* kluge since call is unmap_sg() */ - #endif - ++sglist; -+ nents--; - } - - DBG_RUN_SG("%s() DONE (nents %d)\n", __func__, nents); -diff --git a/drivers/platform/x86/intel_speed_select_if/isst_if_common.c b/drivers/platform/x86/intel_speed_select_if/isst_if_common.c -index 3de5a3c66529d..cf7b6dee82191 100644 ---- a/drivers/platform/x86/intel_speed_select_if/isst_if_common.c -+++ b/drivers/platform/x86/intel_speed_select_if/isst_if_common.c -@@ -529,7 +529,10 @@ static long isst_if_def_ioctl(struct file *file, unsigned int cmd, - return ret; - } - --static DEFINE_MUTEX(punit_misc_dev_lock); -+/* Lock to prevent module registration when already opened by user space */ -+static DEFINE_MUTEX(punit_misc_dev_open_lock); -+/* Lock to allow one share misc device for all ISST interace */ -+static DEFINE_MUTEX(punit_misc_dev_reg_lock); - static int misc_usage_count; - static int misc_device_ret; - static int misc_device_open; -@@ -539,7 +542,7 @@ static int isst_if_open(struct inode *inode, struct file *file) - int i, ret = 0; - - /* Fail open, if a module is going away */ -- mutex_lock(&punit_misc_dev_lock); -+ mutex_lock(&punit_misc_dev_open_lock); - for (i = 0; i < ISST_IF_DEV_MAX; ++i) { - struct isst_if_cmd_cb *cb = &punit_callbacks[i]; - -@@ -561,7 +564,7 @@ static int isst_if_open(struct inode *inode, struct file *file) - } else { - misc_device_open++; - } -- mutex_unlock(&punit_misc_dev_lock); -+ mutex_unlock(&punit_misc_dev_open_lock); - - return ret; - } -@@ -570,7 +573,7 @@ static int isst_if_relase(struct inode *inode, struct file *f) - { - int i; - -- mutex_lock(&punit_misc_dev_lock); -+ mutex_lock(&punit_misc_dev_open_lock); - misc_device_open--; - for (i = 0; i < ISST_IF_DEV_MAX; ++i) { - struct isst_if_cmd_cb *cb = &punit_callbacks[i]; -@@ -578,7 +581,7 @@ static int isst_if_relase(struct inode *inode, struct file *f) - if (cb->registered) - module_put(cb->owner); - } -- mutex_unlock(&punit_misc_dev_lock); -+ mutex_unlock(&punit_misc_dev_open_lock); - - return 0; - } -@@ -595,6 +598,43 @@ static struct miscdevice isst_if_char_driver = { - .fops = &isst_if_char_driver_ops, - }; - -+static int isst_misc_reg(void) -+{ -+ mutex_lock(&punit_misc_dev_reg_lock); -+ if (misc_device_ret) -+ goto unlock_exit; -+ -+ if (!misc_usage_count) { -+ misc_device_ret = isst_if_cpu_info_init(); -+ if (misc_device_ret) -+ goto unlock_exit; -+ -+ misc_device_ret = misc_register(&isst_if_char_driver); -+ if (misc_device_ret) { -+ isst_if_cpu_info_exit(); -+ goto unlock_exit; -+ } -+ } -+ misc_usage_count++; -+ -+unlock_exit: -+ mutex_unlock(&punit_misc_dev_reg_lock); -+ -+ return misc_device_ret; -+} -+ -+static void isst_misc_unreg(void) -+{ -+ mutex_lock(&punit_misc_dev_reg_lock); -+ if (misc_usage_count) -+ misc_usage_count--; -+ if (!misc_usage_count && !misc_device_ret) { -+ misc_deregister(&isst_if_char_driver); -+ isst_if_cpu_info_exit(); -+ } -+ mutex_unlock(&punit_misc_dev_reg_lock); -+} -+ - /** - * isst_if_cdev_register() - Register callback for IOCTL - * @device_type: The device type this callback handling. -@@ -612,38 +652,31 @@ static struct miscdevice isst_if_char_driver = { - */ - int isst_if_cdev_register(int device_type, struct isst_if_cmd_cb *cb) - { -- if (misc_device_ret) -- return misc_device_ret; -+ int ret; - - if (device_type >= ISST_IF_DEV_MAX) - return -EINVAL; - -- mutex_lock(&punit_misc_dev_lock); -+ mutex_lock(&punit_misc_dev_open_lock); -+ /* Device is already open, we don't want to add new callbacks */ - if (misc_device_open) { -- mutex_unlock(&punit_misc_dev_lock); -+ mutex_unlock(&punit_misc_dev_open_lock); - return -EAGAIN; - } -- if (!misc_usage_count) { -- int ret; -- -- misc_device_ret = misc_register(&isst_if_char_driver); -- if (misc_device_ret) -- goto unlock_exit; -- -- ret = isst_if_cpu_info_init(); -- if (ret) { -- misc_deregister(&isst_if_char_driver); -- misc_device_ret = ret; -- goto unlock_exit; -- } -- } - memcpy(&punit_callbacks[device_type], cb, sizeof(*cb)); - punit_callbacks[device_type].registered = 1; -- misc_usage_count++; --unlock_exit: -- mutex_unlock(&punit_misc_dev_lock); -+ mutex_unlock(&punit_misc_dev_open_lock); - -- return misc_device_ret; -+ ret = isst_misc_reg(); -+ if (ret) { -+ /* -+ * No need of mutex as the misc device register failed -+ * as no one can open device yet. Hence no contention. -+ */ -+ punit_callbacks[device_type].registered = 0; -+ return ret; -+ } -+ return 0; - } - EXPORT_SYMBOL_GPL(isst_if_cdev_register); - -@@ -658,16 +691,12 @@ EXPORT_SYMBOL_GPL(isst_if_cdev_register); - */ - void isst_if_cdev_unregister(int device_type) - { -- mutex_lock(&punit_misc_dev_lock); -- misc_usage_count--; -+ isst_misc_unreg(); -+ mutex_lock(&punit_misc_dev_open_lock); - punit_callbacks[device_type].registered = 0; - if (device_type == ISST_IF_DEV_MBOX) - isst_delete_hash(); -- if (!misc_usage_count && !misc_device_ret) { -- misc_deregister(&isst_if_char_driver); -- isst_if_cpu_info_exit(); -- } -- mutex_unlock(&punit_misc_dev_lock); -+ mutex_unlock(&punit_misc_dev_open_lock); - } - EXPORT_SYMBOL_GPL(isst_if_cdev_unregister); - -diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h -index 1bf7a4152b34b..088b764aefa43 100644 ---- a/drivers/scsi/lpfc/lpfc.h -+++ b/drivers/scsi/lpfc/lpfc.h -@@ -377,6 +377,7 @@ struct lpfc_vport { - #define FC_VPORT_LOGO_RCVD 0x200 /* LOGO received on vport */ - #define FC_RSCN_DISCOVERY 0x400 /* Auth all devices after RSCN */ - #define FC_LOGO_RCVD_DID_CHNG 0x800 /* FDISC on phys port detect DID chng*/ -+#define FC_PT2PT_NO_NVME 0x1000 /* Don't send NVME PRLI */ - #define FC_SCSI_SCAN_TMO 0x4000 /* scsi scan timer running */ - #define FC_ABORT_DISCOVERY 0x8000 /* we want to abort discovery */ - #define FC_NDISC_ACTIVE 0x10000 /* NPort discovery active */ -diff --git a/drivers/scsi/lpfc/lpfc_attr.c b/drivers/scsi/lpfc/lpfc_attr.c -index d034fe78bf93e..1e59c60a9dcc3 100644 ---- a/drivers/scsi/lpfc/lpfc_attr.c -+++ b/drivers/scsi/lpfc/lpfc_attr.c -@@ -1145,6 +1145,9 @@ lpfc_issue_lip(struct Scsi_Host *shost) - pmboxq->u.mb.mbxCommand = MBX_DOWN_LINK; - pmboxq->u.mb.mbxOwner = OWN_HOST; - -+ if ((vport->fc_flag & FC_PT2PT) && (vport->fc_flag & FC_PT2PT_NO_NVME)) -+ vport->fc_flag &= ~FC_PT2PT_NO_NVME; -+ - mbxstatus = lpfc_sli_issue_mbox_wait(phba, pmboxq, LPFC_MBOX_TMO * 2); - - if ((mbxstatus == MBX_SUCCESS) && -diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c -index 2040affa08874..9951d63a8b493 100644 ---- a/drivers/scsi/lpfc/lpfc_els.c -+++ b/drivers/scsi/lpfc/lpfc_els.c -@@ -1066,7 +1066,8 @@ stop_rr_fcf_flogi: - - /* FLOGI failed, so there is no fabric */ - spin_lock_irq(shost->host_lock); -- vport->fc_flag &= ~(FC_FABRIC | FC_PUBLIC_LOOP); -+ vport->fc_flag &= ~(FC_FABRIC | FC_PUBLIC_LOOP | -+ FC_PT2PT_NO_NVME); - spin_unlock_irq(shost->host_lock); - - /* If private loop, then allow max outstanding els to be -@@ -3740,6 +3741,23 @@ lpfc_els_retry(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, - /* Added for Vendor specifc support - * Just keep retrying for these Rsn / Exp codes - */ -+ if ((vport->fc_flag & FC_PT2PT) && -+ cmd == ELS_CMD_NVMEPRLI) { -+ switch (stat.un.b.lsRjtRsnCode) { -+ case LSRJT_UNABLE_TPC: -+ case LSRJT_INVALID_CMD: -+ case LSRJT_LOGICAL_ERR: -+ case LSRJT_CMD_UNSUPPORTED: -+ lpfc_printf_vlog(vport, KERN_WARNING, LOG_ELS, -+ "0168 NVME PRLI LS_RJT " -+ "reason %x port doesn't " -+ "support NVME, disabling NVME\n", -+ stat.un.b.lsRjtRsnCode); -+ retry = 0; -+ vport->fc_flag |= FC_PT2PT_NO_NVME; -+ goto out_retry; -+ } -+ } - switch (stat.un.b.lsRjtRsnCode) { - case LSRJT_UNABLE_TPC: - /* The driver has a VALID PLOGI but the rport has -diff --git a/drivers/scsi/lpfc/lpfc_nportdisc.c b/drivers/scsi/lpfc/lpfc_nportdisc.c -index fdd87508c804d..df2f7c3d7f845 100644 ---- a/drivers/scsi/lpfc/lpfc_nportdisc.c -+++ b/drivers/scsi/lpfc/lpfc_nportdisc.c -@@ -1987,8 +1987,9 @@ lpfc_cmpl_reglogin_reglogin_issue(struct lpfc_vport *vport, - * is configured try it. - */ - ndlp->nlp_fc4_type |= NLP_FC4_FCP; -- if ((vport->cfg_enable_fc4_type == LPFC_ENABLE_BOTH) || -- (vport->cfg_enable_fc4_type == LPFC_ENABLE_NVME)) { -+ if ((!(vport->fc_flag & FC_PT2PT_NO_NVME)) && -+ (vport->cfg_enable_fc4_type == LPFC_ENABLE_BOTH || -+ vport->cfg_enable_fc4_type == LPFC_ENABLE_NVME)) { - ndlp->nlp_fc4_type |= NLP_FC4_NVME; - /* We need to update the localport also */ - lpfc_nvme_update_localport(vport); -diff --git a/drivers/tty/serial/8250/8250_gsc.c b/drivers/tty/serial/8250/8250_gsc.c -index 0809ae2aa9b14..51cc985216ff3 100644 ---- a/drivers/tty/serial/8250/8250_gsc.c -+++ b/drivers/tty/serial/8250/8250_gsc.c -@@ -26,7 +26,7 @@ static int __init serial_init_chip(struct parisc_device *dev) - unsigned long address; - int err; - --#ifdef CONFIG_64BIT -+#if defined(CONFIG_64BIT) && defined(CONFIG_IOSAPIC) - if (!dev->irq && (dev->id.sversion == 0xad)) - dev->irq = iosapic_serial_irq(dev); - #endif -diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c -index fc688af57c231..e258fc484cea2 100644 ---- a/fs/btrfs/send.c -+++ b/fs/btrfs/send.c -@@ -5005,6 +5005,10 @@ static ssize_t fill_read_buf(struct send_ctx *sctx, u64 offset, u32 len) - lock_page(page); - if (!PageUptodate(page)) { - unlock_page(page); -+ btrfs_err(fs_info, -+ "send: IO error at offset %llu for inode %llu root %llu", -+ page_offset(page), sctx->cur_ino, -+ sctx->send_root->root_key.objectid); - put_page(page); - ret = -EIO; - break; -diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c -index ae73e67936832..f1bbce4350c47 100644 ---- a/fs/ext4/extents.c -+++ b/fs/ext4/extents.c -@@ -133,14 +133,25 @@ static int ext4_ext_truncate_extend_restart(handle_t *handle, - static int ext4_ext_get_access(handle_t *handle, struct inode *inode, - struct ext4_ext_path *path) - { -+ int err = 0; -+ - if (path->p_bh) { - /* path points to block */ - BUFFER_TRACE(path->p_bh, "get_write_access"); -- return ext4_journal_get_write_access(handle, path->p_bh); -+ err = ext4_journal_get_write_access(handle, path->p_bh); -+ -+ /* -+ * The extent buffer's verified bit will be set again in -+ * __ext4_ext_dirty(). We could leave an inconsistent -+ * buffer if the extents updating procudure break off du -+ * to some error happens, force to check it again. -+ */ -+ if (!err) -+ clear_buffer_verified(path->p_bh); - } - /* path points to leaf/index in inode body */ - /* we use in-core data, no need to protect them */ -- return 0; -+ return err; - } - - /* -@@ -160,6 +171,9 @@ int __ext4_ext_dirty(const char *where, unsigned int line, handle_t *handle, - /* path points to block */ - err = __ext4_handle_dirty_metadata(where, line, handle, - inode, path->p_bh); -+ /* Extents updating done, re-set verified flag */ -+ if (!err) -+ set_buffer_verified(path->p_bh); - } else { - /* path points to leaf/index in inode body */ - err = ext4_mark_inode_dirty(handle, inode); -@@ -390,9 +404,13 @@ static int ext4_valid_extent_idx(struct inode *inode, - - static int ext4_valid_extent_entries(struct inode *inode, - struct ext4_extent_header *eh, -+ ext4_lblk_t lblk, ext4_fsblk_t *pblk, - int depth) - { - unsigned short entries; -+ ext4_lblk_t lblock = 0; -+ ext4_lblk_t prev = 0; -+ - if (eh->eh_entries == 0) - return 1; - -@@ -403,32 +421,52 @@ static int ext4_valid_extent_entries(struct inode *inode, - struct ext4_extent *ext = EXT_FIRST_EXTENT(eh); - struct ext4_super_block *es = EXT4_SB(inode->i_sb)->s_es; - ext4_fsblk_t pblock = 0; -- ext4_lblk_t lblock = 0; -- ext4_lblk_t prev = 0; -- int len = 0; -+ -+ /* -+ * The logical block in the first entry should equal to -+ * the number in the index block. -+ */ -+ if (depth != ext_depth(inode) && -+ lblk != le32_to_cpu(ext->ee_block)) -+ return 0; - while (entries) { - if (!ext4_valid_extent(inode, ext)) - return 0; - - /* Check for overlapping extents */ - lblock = le32_to_cpu(ext->ee_block); -- len = ext4_ext_get_actual_len(ext); - if ((lblock <= prev) && prev) { - pblock = ext4_ext_pblock(ext); - es->s_last_error_block = cpu_to_le64(pblock); - return 0; - } -+ prev = lblock + ext4_ext_get_actual_len(ext) - 1; - ext++; - entries--; -- prev = lblock + len - 1; - } - } else { - struct ext4_extent_idx *ext_idx = EXT_FIRST_INDEX(eh); -+ -+ /* -+ * The logical block in the first entry should equal to -+ * the number in the parent index block. -+ */ -+ if (depth != ext_depth(inode) && -+ lblk != le32_to_cpu(ext_idx->ei_block)) -+ return 0; - while (entries) { - if (!ext4_valid_extent_idx(inode, ext_idx)) - return 0; -+ -+ /* Check for overlapping index extents */ -+ lblock = le32_to_cpu(ext_idx->ei_block); -+ if ((lblock <= prev) && prev) { -+ *pblk = ext4_idx_pblock(ext_idx); -+ return 0; -+ } - ext_idx++; - entries--; -+ prev = lblock; - } - } - return 1; -@@ -436,7 +474,7 @@ static int ext4_valid_extent_entries(struct inode *inode, - - static int __ext4_ext_check(const char *function, unsigned int line, - struct inode *inode, struct ext4_extent_header *eh, -- int depth, ext4_fsblk_t pblk) -+ int depth, ext4_fsblk_t pblk, ext4_lblk_t lblk) - { - const char *error_msg; - int max = 0, err = -EFSCORRUPTED; -@@ -462,7 +500,7 @@ static int __ext4_ext_check(const char *function, unsigned int line, - error_msg = "invalid eh_entries"; - goto corrupted; - } -- if (!ext4_valid_extent_entries(inode, eh, depth)) { -+ if (!ext4_valid_extent_entries(inode, eh, lblk, &pblk, depth)) { - error_msg = "invalid extent entries"; - goto corrupted; - } -@@ -491,7 +529,7 @@ corrupted: - } - - #define ext4_ext_check(inode, eh, depth, pblk) \ -- __ext4_ext_check(__func__, __LINE__, (inode), (eh), (depth), (pblk)) -+ __ext4_ext_check(__func__, __LINE__, (inode), (eh), (depth), (pblk), 0) - - int ext4_ext_check_inode(struct inode *inode) - { -@@ -524,12 +562,14 @@ static void ext4_cache_extents(struct inode *inode, - - static struct buffer_head * - __read_extent_tree_block(const char *function, unsigned int line, -- struct inode *inode, ext4_fsblk_t pblk, int depth, -- int flags) -+ struct inode *inode, struct ext4_extent_idx *idx, -+ int depth, int flags) - { - struct buffer_head *bh; - int err; -+ ext4_fsblk_t pblk; - -+ pblk = ext4_idx_pblock(idx); - bh = sb_getblk_gfp(inode->i_sb, pblk, __GFP_MOVABLE | GFP_NOFS); - if (unlikely(!bh)) - return ERR_PTR(-ENOMEM); -@@ -545,8 +585,8 @@ __read_extent_tree_block(const char *function, unsigned int line, - if (!ext4_has_feature_journal(inode->i_sb) || - (inode->i_ino != - le32_to_cpu(EXT4_SB(inode->i_sb)->s_es->s_journal_inum))) { -- err = __ext4_ext_check(function, line, inode, -- ext_block_hdr(bh), depth, pblk); -+ err = __ext4_ext_check(function, line, inode, ext_block_hdr(bh), -+ depth, pblk, le32_to_cpu(idx->ei_block)); - if (err) - goto errout; - } -@@ -565,8 +605,8 @@ errout: - - } - --#define read_extent_tree_block(inode, pblk, depth, flags) \ -- __read_extent_tree_block(__func__, __LINE__, (inode), (pblk), \ -+#define read_extent_tree_block(inode, idx, depth, flags) \ -+ __read_extent_tree_block(__func__, __LINE__, (inode), (idx), \ - (depth), (flags)) - - /* -@@ -613,8 +653,7 @@ int ext4_ext_precache(struct inode *inode) - i--; - continue; - } -- bh = read_extent_tree_block(inode, -- ext4_idx_pblock(path[i].p_idx++), -+ bh = read_extent_tree_block(inode, path[i].p_idx++, - depth - i - 1, - EXT4_EX_FORCE_CACHE); - if (IS_ERR(bh)) { -@@ -917,8 +956,7 @@ ext4_find_extent(struct inode *inode, ext4_lblk_t block, - path[ppos].p_depth = i; - path[ppos].p_ext = NULL; - -- bh = read_extent_tree_block(inode, path[ppos].p_block, --i, -- flags); -+ bh = read_extent_tree_block(inode, path[ppos].p_idx, --i, flags); - if (IS_ERR(bh)) { - ret = PTR_ERR(bh); - goto err; -@@ -1517,7 +1555,6 @@ static int ext4_ext_search_right(struct inode *inode, - struct ext4_extent_header *eh; - struct ext4_extent_idx *ix; - struct ext4_extent *ex; -- ext4_fsblk_t block; - int depth; /* Note, NOT eh_depth; depth from top of tree */ - int ee_len; - -@@ -1584,20 +1621,17 @@ got_index: - * follow it and find the closest allocated - * block to the right */ - ix++; -- block = ext4_idx_pblock(ix); - while (++depth < path->p_depth) { - /* subtract from p_depth to get proper eh_depth */ -- bh = read_extent_tree_block(inode, block, -- path->p_depth - depth, 0); -+ bh = read_extent_tree_block(inode, ix, path->p_depth - depth, 0); - if (IS_ERR(bh)) - return PTR_ERR(bh); - eh = ext_block_hdr(bh); - ix = EXT_FIRST_INDEX(eh); -- block = ext4_idx_pblock(ix); - put_bh(bh); - } - -- bh = read_extent_tree_block(inode, block, path->p_depth - depth, 0); -+ bh = read_extent_tree_block(inode, ix, path->p_depth - depth, 0); - if (IS_ERR(bh)) - return PTR_ERR(bh); - eh = ext_block_hdr(bh); -@@ -3119,9 +3153,9 @@ again: - ext_debug("move to level %d (block %llu)\n", - i + 1, ext4_idx_pblock(path[i].p_idx)); - memset(path + i + 1, 0, sizeof(*path)); -- bh = read_extent_tree_block(inode, -- ext4_idx_pblock(path[i].p_idx), depth - i - 1, -- EXT4_EX_NOCACHE); -+ bh = read_extent_tree_block(inode, path[i].p_idx, -+ depth - i - 1, -+ EXT4_EX_NOCACHE); - if (IS_ERR(bh)) { - /* should we reset i_size? */ - err = PTR_ERR(bh); -diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c -index f1c99fe486c4d..28ceee102d0b3 100644 ---- a/fs/nfs/dir.c -+++ b/fs/nfs/dir.c -@@ -1641,14 +1641,14 @@ no_open: - if (!res) { - inode = d_inode(dentry); - if ((lookup_flags & LOOKUP_DIRECTORY) && inode && -- !S_ISDIR(inode->i_mode)) -+ !(S_ISDIR(inode->i_mode) || S_ISLNK(inode->i_mode))) - res = ERR_PTR(-ENOTDIR); - else if (inode && S_ISREG(inode->i_mode)) - res = ERR_PTR(-EOPENSTALE); - } else if (!IS_ERR(res)) { - inode = d_inode(res); - if ((lookup_flags & LOOKUP_DIRECTORY) && inode && -- !S_ISDIR(inode->i_mode)) { -+ !(S_ISDIR(inode->i_mode) || S_ISLNK(inode->i_mode))) { - dput(res); - res = ERR_PTR(-ENOTDIR); - } else if (inode && S_ISREG(inode->i_mode)) { -diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c -index 209263c0c5377..3bddf5332b6d6 100644 ---- a/fs/nfs/inode.c -+++ b/fs/nfs/inode.c -@@ -791,12 +791,9 @@ int nfs_getattr(const struct path *path, struct kstat *stat, - goto out_no_update; - - /* Flush out writes to the server in order to update c/mtime. */ -- if ((request_mask & (STATX_CTIME|STATX_MTIME)) && -- S_ISREG(inode->i_mode)) { -- err = filemap_write_and_wait(inode->i_mapping); -- if (err) -- goto out; -- } -+ if ((request_mask & (STATX_CTIME | STATX_MTIME)) && -+ S_ISREG(inode->i_mode)) -+ filemap_write_and_wait(inode->i_mapping); - - /* - * We may force a getattr if the user cares about atime. -diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c -index 7abc3230c21a4..dc5f8654b277d 100644 ---- a/fs/quota/dquot.c -+++ b/fs/quota/dquot.c -@@ -693,9 +693,14 @@ int dquot_quota_sync(struct super_block *sb, int type) - /* This is not very clever (and fast) but currently I don't know about - * any other simple way of getting quota data to disk and we must get - * them there for userspace to be visible... */ -- if (sb->s_op->sync_fs) -- sb->s_op->sync_fs(sb, 1); -- sync_blockdev(sb->s_bdev); -+ if (sb->s_op->sync_fs) { -+ ret = sb->s_op->sync_fs(sb, 1); -+ if (ret) -+ return ret; -+ } -+ ret = sync_blockdev(sb->s_bdev); -+ if (ret) -+ return ret; - - /* - * Now when everything is written we can discard the pagecache so -diff --git a/fs/super.c b/fs/super.c -index b289356f302fc..e255c18fa2c88 100644 ---- a/fs/super.c -+++ b/fs/super.c -@@ -1691,11 +1691,9 @@ static void lockdep_sb_freeze_acquire(struct super_block *sb) - percpu_rwsem_acquire(sb->s_writers.rw_sem + level, 0, _THIS_IP_); - } - --static void sb_freeze_unlock(struct super_block *sb) -+static void sb_freeze_unlock(struct super_block *sb, int level) - { -- int level; -- -- for (level = SB_FREEZE_LEVELS - 1; level >= 0; level--) -+ for (level--; level >= 0; level--) - percpu_up_write(sb->s_writers.rw_sem + level); - } - -@@ -1766,7 +1764,14 @@ int freeze_super(struct super_block *sb) - sb_wait_write(sb, SB_FREEZE_PAGEFAULT); - - /* All writers are done so after syncing there won't be dirty data */ -- sync_filesystem(sb); -+ ret = sync_filesystem(sb); -+ if (ret) { -+ sb->s_writers.frozen = SB_UNFROZEN; -+ sb_freeze_unlock(sb, SB_FREEZE_PAGEFAULT); -+ wake_up(&sb->s_writers.wait_unfrozen); -+ deactivate_locked_super(sb); -+ return ret; -+ } - - /* Now wait for internal filesystem counter */ - sb->s_writers.frozen = SB_FREEZE_FS; -@@ -1778,7 +1783,7 @@ int freeze_super(struct super_block *sb) - printk(KERN_ERR - "VFS:Filesystem freeze failed\n"); - sb->s_writers.frozen = SB_UNFROZEN; -- sb_freeze_unlock(sb); -+ sb_freeze_unlock(sb, SB_FREEZE_FS); - wake_up(&sb->s_writers.wait_unfrozen); - deactivate_locked_super(sb); - return ret; -@@ -1829,7 +1834,7 @@ static int thaw_super_locked(struct super_block *sb) - } - - sb->s_writers.frozen = SB_UNFROZEN; -- sb_freeze_unlock(sb); -+ sb_freeze_unlock(sb, SB_FREEZE_FS); - out: - wake_up(&sb->s_writers.wait_unfrozen); - deactivate_locked_super(sb); -diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h -index 8a5ced9cf5273..77d4281815579 100644 ---- a/include/asm-generic/vmlinux.lds.h -+++ b/include/asm-generic/vmlinux.lds.h -@@ -110,17 +110,17 @@ - #endif - - #ifdef CONFIG_FTRACE_MCOUNT_RECORD --#ifdef CC_USING_PATCHABLE_FUNCTION_ENTRY --#define MCOUNT_REC() . = ALIGN(8); \ -- __start_mcount_loc = .; \ -- KEEP(*(__patchable_function_entries)) \ -- __stop_mcount_loc = .; --#else -+/* -+ * The ftrace call sites are logged to a section whose name depends on the -+ * compiler option used. A given kernel image will only use one, AKA -+ * FTRACE_CALLSITE_SECTION. We capture all of them here to avoid header -+ * dependencies for FTRACE_CALLSITE_SECTION's definition. -+ */ - #define MCOUNT_REC() . = ALIGN(8); \ - __start_mcount_loc = .; \ - KEEP(*(__mcount_loc)) \ -+ KEEP(*(__patchable_function_entries)) \ - __stop_mcount_loc = .; --#endif - #else - #define MCOUNT_REC() - #endif -diff --git a/include/linux/ftrace.h b/include/linux/ftrace.h -index 8a8cb3c401b26..9141f22632864 100644 ---- a/include/linux/ftrace.h -+++ b/include/linux/ftrace.h -@@ -499,7 +499,7 @@ static inline int ftrace_disable_ftrace_graph_caller(void) { return 0; } - /** - * ftrace_make_nop - convert code into nop - * @mod: module structure if called by module load initialization -- * @rec: the mcount call site record -+ * @rec: the call site record (e.g. mcount/fentry) - * @addr: the address that the call site should be calling - * - * This is a very sensitive operation and great care needs -@@ -520,9 +520,38 @@ static inline int ftrace_disable_ftrace_graph_caller(void) { return 0; } - extern int ftrace_make_nop(struct module *mod, - struct dyn_ftrace *rec, unsigned long addr); - -+ -+/** -+ * ftrace_init_nop - initialize a nop call site -+ * @mod: module structure if called by module load initialization -+ * @rec: the call site record (e.g. mcount/fentry) -+ * -+ * This is a very sensitive operation and great care needs -+ * to be taken by the arch. The operation should carefully -+ * read the location, check to see if what is read is indeed -+ * what we expect it to be, and then on success of the compare, -+ * it should write to the location. -+ * -+ * The code segment at @rec->ip should contain the contents created by -+ * the compiler -+ * -+ * Return must be: -+ * 0 on success -+ * -EFAULT on error reading the location -+ * -EINVAL on a failed compare of the contents -+ * -EPERM on error writing to the location -+ * Any other value will be considered a failure. -+ */ -+#ifndef ftrace_init_nop -+static inline int ftrace_init_nop(struct module *mod, struct dyn_ftrace *rec) -+{ -+ return ftrace_make_nop(mod, rec, MCOUNT_ADDR); -+} -+#endif -+ - /** - * ftrace_make_call - convert a nop call site into a call to addr -- * @rec: the mcount call site record -+ * @rec: the call site record (e.g. mcount/fentry) - * @addr: the address that the call site should call - * - * This is a very sensitive operation and great care needs -@@ -545,7 +574,7 @@ extern int ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr); - #ifdef CONFIG_DYNAMIC_FTRACE_WITH_REGS - /** - * ftrace_modify_call - convert from one addr to another (no nop) -- * @rec: the mcount call site record -+ * @rec: the call site record (e.g. mcount/fentry) - * @old_addr: the address expected to be currently called to - * @addr: the address to change to - * -@@ -709,6 +738,11 @@ static inline unsigned long get_lock_parent_ip(void) - - #ifdef CONFIG_FTRACE_MCOUNT_RECORD - extern void ftrace_init(void); -+#ifdef CC_USING_PATCHABLE_FUNCTION_ENTRY -+#define FTRACE_CALLSITE_SECTION "__patchable_function_entries" -+#else -+#define FTRACE_CALLSITE_SECTION "__mcount_loc" -+#endif - #else - static inline void ftrace_init(void) { } - #endif -diff --git a/include/linux/sched.h b/include/linux/sched.h -index afee5d5eb9458..b341471de9d60 100644 ---- a/include/linux/sched.h -+++ b/include/linux/sched.h -@@ -1454,7 +1454,6 @@ extern struct pid *cad_pid; - #define PF_MEMALLOC 0x00000800 /* Allocating memory */ - #define PF_NPROC_EXCEEDED 0x00001000 /* set_user() noticed that RLIMIT_NPROC was exceeded */ - #define PF_USED_MATH 0x00002000 /* If unset the fpu must be initialized before use */ --#define PF_USED_ASYNC 0x00004000 /* Used async_schedule*(), used by module init */ - #define PF_NOFREEZE 0x00008000 /* This thread should not be frozen */ - #define PF_FROZEN 0x00010000 /* Frozen for system suspend */ - #define PF_KSWAPD 0x00020000 /* I am kswapd */ -diff --git a/include/net/bond_3ad.h b/include/net/bond_3ad.h -index c8696a230b7d9..1a28f299a4c61 100644 ---- a/include/net/bond_3ad.h -+++ b/include/net/bond_3ad.h -@@ -262,7 +262,7 @@ struct ad_system { - struct ad_bond_info { - struct ad_system system; /* 802.3ad system structure */ - struct bond_3ad_stats stats; -- u32 agg_select_timer; /* Timer to select aggregator after all adapter's hand shakes */ -+ atomic_t agg_select_timer; /* Timer to select aggregator after all adapter's hand shakes */ - u16 aggregator_identifier; - }; - -diff --git a/kernel/async.c b/kernel/async.c -index 4f9c1d6140168..74660f611b97d 100644 ---- a/kernel/async.c -+++ b/kernel/async.c -@@ -205,9 +205,6 @@ async_cookie_t async_schedule_node_domain(async_func_t func, void *data, - atomic_inc(&entry_count); - spin_unlock_irqrestore(&async_lock, flags); - -- /* mark that this task has queued an async job, used by module init */ -- current->flags |= PF_USED_ASYNC; -- - /* schedule for execution */ - queue_work_node(node, system_unbound_wq, &entry->work); - -diff --git a/kernel/fork.c b/kernel/fork.c -index cf2cebd214b92..5b4a19682207a 100644 ---- a/kernel/fork.c -+++ b/kernel/fork.c -@@ -2182,10 +2182,6 @@ static __latent_entropy struct task_struct *copy_process( - goto bad_fork_cancel_cgroup; - } - -- /* past the last point of failure */ -- if (pidfile) -- fd_install(pidfd, pidfile); -- - init_task_pid_links(p); - if (likely(p->pid)) { - ptrace_init_task(p, (clone_flags & CLONE_PTRACE) || trace); -@@ -2234,6 +2230,9 @@ static __latent_entropy struct task_struct *copy_process( - syscall_tracepoint_update(p); - write_unlock_irq(&tasklist_lock); - -+ if (pidfile) -+ fd_install(pidfd, pidfile); -+ - proc_fork_connector(p); - cgroup_post_fork(p); - cgroup_threadgroup_change_end(current); -diff --git a/kernel/module.c b/kernel/module.c -index 59d487b8d8dad..7c724356aca31 100644 ---- a/kernel/module.c -+++ b/kernel/module.c -@@ -3377,7 +3377,7 @@ static int find_module_sections(struct module *mod, struct load_info *info) - #endif - #ifdef CONFIG_FTRACE_MCOUNT_RECORD - /* sechdrs[0].sh_size is always zero */ -- mod->ftrace_callsites = section_objs(info, "__mcount_loc", -+ mod->ftrace_callsites = section_objs(info, FTRACE_CALLSITE_SECTION, - sizeof(*mod->ftrace_callsites), - &mod->num_ftrace_callsites); - #endif -@@ -3711,12 +3711,6 @@ static noinline int do_init_module(struct module *mod) - } - freeinit->module_init = mod->init_layout.base; - -- /* -- * We want to find out whether @mod uses async during init. Clear -- * PF_USED_ASYNC. async_schedule*() will set it. -- */ -- current->flags &= ~PF_USED_ASYNC; -- - do_mod_ctors(mod); - /* Start the module */ - if (mod->init != NULL) -@@ -3742,22 +3736,13 @@ static noinline int do_init_module(struct module *mod) - - /* - * We need to finish all async code before the module init sequence -- * is done. This has potential to deadlock. For example, a newly -- * detected block device can trigger request_module() of the -- * default iosched from async probing task. Once userland helper -- * reaches here, async_synchronize_full() will wait on the async -- * task waiting on request_module() and deadlock. -- * -- * This deadlock is avoided by perfomring async_synchronize_full() -- * iff module init queued any async jobs. This isn't a full -- * solution as it will deadlock the same if module loading from -- * async jobs nests more than once; however, due to the various -- * constraints, this hack seems to be the best option for now. -- * Please refer to the following thread for details. -+ * is done. This has potential to deadlock if synchronous module -+ * loading is requested from async (which is not allowed!). - * -- * http://thread.gmane.org/gmane.linux.kernel/1420814 -+ * See commit 0fdff3ec6d87 ("async, kmod: warn on synchronous -+ * request_module() from async workers") for more details. - */ -- if (!mod->async_probe_requested && (current->flags & PF_USED_ASYNC)) -+ if (!mod->async_probe_requested) - async_synchronize_full(); - - ftrace_free_mem(mod, mod->init_layout.base, mod->init_layout.base + -diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c -index efc338969b98b..7719d444bda12 100644 ---- a/kernel/trace/ftrace.c -+++ b/kernel/trace/ftrace.c -@@ -2520,14 +2520,14 @@ struct dyn_ftrace *ftrace_rec_iter_record(struct ftrace_rec_iter *iter) - } - - static int --ftrace_code_disable(struct module *mod, struct dyn_ftrace *rec) -+ftrace_nop_initialize(struct module *mod, struct dyn_ftrace *rec) - { - int ret; - - if (unlikely(ftrace_disabled)) - return 0; - -- ret = ftrace_make_nop(mod, rec, MCOUNT_ADDR); -+ ret = ftrace_init_nop(mod, rec); - if (ret) { - ftrace_bug_type = FTRACE_BUG_INIT; - ftrace_bug(ret, rec); -@@ -2969,7 +2969,7 @@ static int ftrace_update_code(struct module *mod, struct ftrace_page *new_pgs) - * to the NOP instructions. - */ - if (!__is_defined(CC_USING_NOP_MCOUNT) && -- !ftrace_code_disable(mod, p)) -+ !ftrace_nop_initialize(mod, p)) - break; - - update_cnt++; -diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c -index 5a4dfb55ba16b..615259d8fa9ad 100644 ---- a/kernel/trace/trace.c -+++ b/kernel/trace/trace.c -@@ -236,6 +236,10 @@ __setup("trace_clock=", set_trace_boot_clock); - - static int __init set_tracepoint_printk(char *str) - { -+ /* Ignore the "tp_printk_stop_on_boot" param */ -+ if (*str == '_') -+ return 0; -+ - if ((strcmp(str, "=0") != 0 && strcmp(str, "=off") != 0)) - tracepoint_printk = 1; - return 1; -diff --git a/kernel/tsacct.c b/kernel/tsacct.c -index 7be3e7530841f..33a4093306f9c 100644 ---- a/kernel/tsacct.c -+++ b/kernel/tsacct.c -@@ -35,11 +35,10 @@ void bacct_add_tsk(struct user_namespace *user_ns, - /* Convert to seconds for btime */ - do_div(delta, USEC_PER_SEC); - stats->ac_btime = get_seconds() - delta; -- if (thread_group_leader(tsk)) { -+ if (tsk->flags & PF_EXITING) - stats->ac_exitcode = tsk->exit_code; -- if (tsk->flags & PF_FORKNOEXEC) -- stats->ac_flag |= AFORK; -- } -+ if (thread_group_leader(tsk) && (tsk->flags & PF_FORKNOEXEC)) -+ stats->ac_flag |= AFORK; - if (tsk->flags & PF_SUPERPRIV) - stats->ac_flag |= ASU; - if (tsk->flags & PF_DUMPCORE) -diff --git a/lib/iov_iter.c b/lib/iov_iter.c -index 957e3e58df652..9d3bda3d49fed 100644 ---- a/lib/iov_iter.c -+++ b/lib/iov_iter.c -@@ -398,6 +398,7 @@ static size_t copy_page_to_iter_pipe(struct page *page, size_t offset, size_t by - return 0; - pipe->nrbufs++; - buf->ops = &page_cache_pipe_buf_ops; -+ buf->flags = 0; - get_page(buf->page = page); - buf->offset = offset; - buf->len = bytes; -@@ -524,6 +525,7 @@ static size_t push_pipe(struct iov_iter *i, size_t size, - break; - pipe->nrbufs++; - pipe->bufs[idx].ops = &default_pipe_buf_ops; -+ pipe->bufs[idx].flags = 0; - pipe->bufs[idx].page = page; - pipe->bufs[idx].offset = 0; - if (left <= PAGE_SIZE) { -diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c -index 1f84d41e22c36..184af6da0defc 100644 ---- a/net/ax25/af_ax25.c -+++ b/net/ax25/af_ax25.c -@@ -77,6 +77,7 @@ static void ax25_kill_by_device(struct net_device *dev) - { - ax25_dev *ax25_dev; - ax25_cb *s; -+ struct sock *sk; - - if ((ax25_dev = ax25_dev_ax25dev(dev)) == NULL) - return; -@@ -85,13 +86,15 @@ static void ax25_kill_by_device(struct net_device *dev) - again: - ax25_for_each(s, &ax25_list) { - if (s->ax25_dev == ax25_dev) { -+ sk = s->sk; -+ sock_hold(sk); - spin_unlock_bh(&ax25_list_lock); -- lock_sock(s->sk); -+ lock_sock(sk); - s->ax25_dev = NULL; -- release_sock(s->sk); -+ release_sock(sk); - ax25_disconnect(s, ENETUNREACH); - spin_lock_bh(&ax25_list_lock); -- -+ sock_put(sk); - /* The entry could have been deleted from the - * list meanwhile and thus the next pointer is - * no longer valid. Play it safe and restart -diff --git a/net/core/drop_monitor.c b/net/core/drop_monitor.c -index af0130039f377..e8e8389ddc965 100644 ---- a/net/core/drop_monitor.c -+++ b/net/core/drop_monitor.c -@@ -277,13 +277,17 @@ static void trace_napi_poll_hit(void *ignore, struct napi_struct *napi, - - rcu_read_lock(); - list_for_each_entry_rcu(new_stat, &hw_stats_list, list) { -+ struct net_device *dev; -+ - /* - * only add a note to our monitor buffer if: - * 1) this is the dev we received on - * 2) its after the last_rx delta - * 3) our rx_dropped count has gone up - */ -- if ((new_stat->dev == napi->dev) && -+ /* Paired with WRITE_ONCE() in dropmon_net_event() */ -+ dev = READ_ONCE(new_stat->dev); -+ if ((dev == napi->dev) && - (time_after(jiffies, new_stat->last_rx + dm_hw_check_delta)) && - (napi->dev->stats.rx_dropped != new_stat->last_drop_val)) { - trace_drop_common(NULL, NULL); -@@ -1497,7 +1501,10 @@ static int dropmon_net_event(struct notifier_block *ev_block, - mutex_lock(&net_dm_mutex); - list_for_each_entry_safe(new_stat, tmp, &hw_stats_list, list) { - if (new_stat->dev == dev) { -- new_stat->dev = NULL; -+ -+ /* Paired with READ_ONCE() in trace_napi_poll_hit() */ -+ WRITE_ONCE(new_stat->dev, NULL); -+ - if (trace_state == TRACE_OFF) { - list_del_rcu(&new_stat->list); - kfree_rcu(new_stat, rcu); -diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c -index b0f51c7cc0d90..2a359d0dfe7e8 100644 ---- a/net/ipv4/ping.c -+++ b/net/ipv4/ping.c -@@ -172,16 +172,23 @@ static struct sock *ping_lookup(struct net *net, struct sk_buff *skb, u16 ident) - struct sock *sk = NULL; - struct inet_sock *isk; - struct hlist_nulls_node *hnode; -- int dif = skb->dev->ifindex; -+ int dif, sdif; - - if (skb->protocol == htons(ETH_P_IP)) { -+ dif = inet_iif(skb); -+ sdif = inet_sdif(skb); - pr_debug("try to find: num = %d, daddr = %pI4, dif = %d\n", - (int)ident, &ip_hdr(skb)->daddr, dif); - #if IS_ENABLED(CONFIG_IPV6) - } else if (skb->protocol == htons(ETH_P_IPV6)) { -+ dif = inet6_iif(skb); -+ sdif = inet6_sdif(skb); - pr_debug("try to find: num = %d, daddr = %pI6c, dif = %d\n", - (int)ident, &ipv6_hdr(skb)->daddr, dif); - #endif -+ } else { -+ pr_err("ping: protocol(%x) is not supported\n", ntohs(skb->protocol)); -+ return NULL; - } - - read_lock_bh(&ping_table.lock); -@@ -221,7 +228,7 @@ static struct sock *ping_lookup(struct net *net, struct sk_buff *skb, u16 ident) - } - - if (sk->sk_bound_dev_if && sk->sk_bound_dev_if != dif && -- sk->sk_bound_dev_if != inet_sdif(skb)) -+ sk->sk_bound_dev_if != sdif) - continue; - - sock_hold(sk); -diff --git a/net/netfilter/nf_conntrack_proto_sctp.c b/net/netfilter/nf_conntrack_proto_sctp.c -index 810cca24b3990..7626f3e1c70a7 100644 ---- a/net/netfilter/nf_conntrack_proto_sctp.c -+++ b/net/netfilter/nf_conntrack_proto_sctp.c -@@ -489,6 +489,15 @@ int nf_conntrack_sctp_packet(struct nf_conn *ct, - pr_debug("Setting vtag %x for dir %d\n", - ih->init_tag, !dir); - ct->proto.sctp.vtag[!dir] = ih->init_tag; -+ -+ /* don't renew timeout on init retransmit so -+ * port reuse by client or NAT middlebox cannot -+ * keep entry alive indefinitely (incl. nat info). -+ */ -+ if (new_state == SCTP_CONNTRACK_CLOSED && -+ old_state == SCTP_CONNTRACK_CLOSED && -+ nf_ct_is_confirmed(ct)) -+ ignore = true; - } - - ct->proto.sctp.state = new_state; -diff --git a/net/netfilter/nft_synproxy.c b/net/netfilter/nft_synproxy.c -index e2c1fc6088412..15abb0e496034 100644 ---- a/net/netfilter/nft_synproxy.c -+++ b/net/netfilter/nft_synproxy.c -@@ -191,8 +191,10 @@ static int nft_synproxy_do_init(const struct nft_ctx *ctx, - if (err) - goto nf_ct_failure; - err = nf_synproxy_ipv6_init(snet, ctx->net); -- if (err) -+ if (err) { -+ nf_synproxy_ipv4_fini(snet, ctx->net); - goto nf_ct_failure; -+ } - break; - } - -diff --git a/net/sched/act_api.c b/net/sched/act_api.c -index 75132d0ca8870..ab277ee950322 100644 ---- a/net/sched/act_api.c -+++ b/net/sched/act_api.c -@@ -652,15 +652,24 @@ int tcf_action_exec(struct sk_buff *skb, struct tc_action **actions, - restart_act_graph: - for (i = 0; i < nr_actions; i++) { - const struct tc_action *a = actions[i]; -+ int repeat_ttl; - - if (jmp_prgcnt > 0) { - jmp_prgcnt -= 1; - continue; - } -+ -+ repeat_ttl = 32; - repeat: - ret = a->ops->act(skb, a, res); -- if (ret == TC_ACT_REPEAT) -- goto repeat; /* we need a ttl - JHS */ -+ -+ if (unlikely(ret == TC_ACT_REPEAT)) { -+ if (--repeat_ttl != 0) -+ goto repeat; -+ /* suspicious opcode, stop pipeline */ -+ net_warn_ratelimited("TC_ACT_REPEAT abuse ?\n"); -+ return TC_ACT_OK; -+ } - - if (TC_ACT_EXT_CMP(ret, TC_ACT_JUMP)) { - jmp_prgcnt = ret & TCA_ACT_MAX_PRIO_MASK; -diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c -index bc8055f4571bc..d60d7caacbf5d 100644 ---- a/net/vmw_vsock/af_vsock.c -+++ b/net/vmw_vsock/af_vsock.c -@@ -1222,6 +1222,7 @@ static int vsock_stream_connect(struct socket *sock, struct sockaddr *addr, - sk->sk_state = sk->sk_state == TCP_ESTABLISHED ? TCP_CLOSING : TCP_CLOSE; - sock->state = SS_UNCONNECTED; - vsock_transport_cancel_pkt(vsk); -+ vsock_remove_connected(vsk); - goto out_wait; - } else if (timeout == 0) { - err = -ETIMEDOUT; -diff --git a/scripts/Makefile.extrawarn b/scripts/Makefile.extrawarn -index ca08f2fe7c344..854e2ba9daa29 100644 ---- a/scripts/Makefile.extrawarn -+++ b/scripts/Makefile.extrawarn -@@ -49,6 +49,7 @@ KBUILD_CFLAGS += -Wno-format - KBUILD_CFLAGS += -Wno-sign-compare - KBUILD_CFLAGS += -Wno-format-zero-length - KBUILD_CFLAGS += $(call cc-disable-warning, pointer-to-enum-cast) -+KBUILD_CFLAGS += $(call cc-disable-warning, unaligned-access) - endif - - endif -diff --git a/scripts/kconfig/confdata.c b/scripts/kconfig/confdata.c -index 17298239e3633..5c2493c8e9de8 100644 ---- a/scripts/kconfig/confdata.c -+++ b/scripts/kconfig/confdata.c -@@ -987,14 +987,19 @@ static int conf_write_dep(const char *name) - - static int conf_touch_deps(void) - { -- const char *name; -+ const char *name, *tmp; - struct symbol *sym; - int res, i; - -- strcpy(depfile_path, "include/config/"); -- depfile_prefix_len = strlen(depfile_path); -- - name = conf_get_autoconfig_name(); -+ tmp = strrchr(name, '/'); -+ depfile_prefix_len = tmp ? tmp - name + 1 : 0; -+ if (depfile_prefix_len + 1 > sizeof(depfile_path)) -+ return -1; -+ -+ strncpy(depfile_path, name, depfile_prefix_len); -+ depfile_path[depfile_prefix_len] = 0; -+ - conf_read_simple(name, S_DEF_AUTO); - sym_calc_value(modules_sym); - -diff --git a/scripts/kconfig/preprocess.c b/scripts/kconfig/preprocess.c -index 0590f86df6e40..748da578b418c 100644 ---- a/scripts/kconfig/preprocess.c -+++ b/scripts/kconfig/preprocess.c -@@ -141,7 +141,7 @@ static char *do_lineno(int argc, char *argv[]) - static char *do_shell(int argc, char *argv[]) - { - FILE *p; -- char buf[256]; -+ char buf[4096]; - char *cmd; - size_t nread; - int i; -diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c -index 95d472d433e70..b8fe0ec5d6247 100644 ---- a/sound/pci/hda/hda_intel.c -+++ b/sound/pci/hda/hda_intel.c -@@ -1608,6 +1608,7 @@ static struct snd_pci_quirk probe_mask_list[] = { - /* forced codec slots */ - SND_PCI_QUIRK(0x1043, 0x1262, "ASUS W5Fm", 0x103), - SND_PCI_QUIRK(0x1046, 0x1262, "ASUS W5F", 0x103), -+ SND_PCI_QUIRK(0x1558, 0x0351, "Schenker Dock 15", 0x105), - /* WinFast VP200 H (Teradici) user reported broken communication */ - SND_PCI_QUIRK(0x3a21, 0x040d, "WinFast VP200 H", 0x101), - {} -@@ -1793,8 +1794,6 @@ static int azx_create(struct snd_card *card, struct pci_dev *pci, - - assign_position_fix(chip, check_position_fix(chip, position_fix[dev])); - -- check_probe_mask(chip, dev); -- - if (single_cmd < 0) /* allow fallback to single_cmd at errors */ - chip->fallback_to_single_cmd = 1; - else /* explicitly set to single_cmd or not */ -@@ -1826,6 +1825,8 @@ static int azx_create(struct snd_card *card, struct pci_dev *pci, - chip->bus.needs_damn_long_delay = 1; - } - -+ check_probe_mask(chip, dev); -+ - err = snd_device_new(card, SNDRV_DEV_LOWLEVEL, chip, &ops); - if (err < 0) { - dev_err(card->dev, "Error creating device [card]!\n"); -diff --git a/sound/soc/soc-ops.c b/sound/soc/soc-ops.c -index ef8fd331526b0..f5dcd625e4355 100644 ---- a/sound/soc/soc-ops.c -+++ b/sound/soc/soc-ops.c -@@ -314,7 +314,7 @@ int snd_soc_put_volsw(struct snd_kcontrol *kcontrol, - unsigned int sign_bit = mc->sign_bit; - unsigned int mask = (1 << fls(max)) - 1; - unsigned int invert = mc->invert; -- int err; -+ int err, ret; - bool type_2r = false; - unsigned int val2 = 0; - unsigned int val, val_mask; -@@ -356,12 +356,18 @@ int snd_soc_put_volsw(struct snd_kcontrol *kcontrol, - err = snd_soc_component_update_bits(component, reg, val_mask, val); - if (err < 0) - return err; -+ ret = err; - -- if (type_2r) -+ if (type_2r) { - err = snd_soc_component_update_bits(component, reg2, val_mask, -- val2); -+ val2); -+ /* Don't discard any error code or drop change flag */ -+ if (ret == 0 || err < 0) { -+ ret = err; -+ } -+ } - -- return err; -+ return ret; - } - EXPORT_SYMBOL_GPL(snd_soc_put_volsw); - -@@ -517,7 +523,7 @@ int snd_soc_put_volsw_range(struct snd_kcontrol *kcontrol, - unsigned int mask = (1 << fls(max)) - 1; - unsigned int invert = mc->invert; - unsigned int val, val_mask; -- int ret; -+ int err, ret; - - if (invert) - val = (max - ucontrol->value.integer.value[0]) & mask; -@@ -526,9 +532,10 @@ int snd_soc_put_volsw_range(struct snd_kcontrol *kcontrol, - val_mask = mask << shift; - val = val << shift; - -- ret = snd_soc_component_update_bits(component, reg, val_mask, val); -- if (ret < 0) -- return ret; -+ err = snd_soc_component_update_bits(component, reg, val_mask, val); -+ if (err < 0) -+ return err; -+ ret = err; - - if (snd_soc_volsw_is_stereo(mc)) { - if (invert) -@@ -538,8 +545,12 @@ int snd_soc_put_volsw_range(struct snd_kcontrol *kcontrol, - val_mask = mask << shift; - val = val << shift; - -- ret = snd_soc_component_update_bits(component, rreg, val_mask, -+ err = snd_soc_component_update_bits(component, rreg, val_mask, - val); -+ /* Don't discard any error code or drop change flag */ -+ if (ret == 0 || err < 0) { -+ ret = err; -+ } - } - - return ret; -diff --git a/tools/lib/subcmd/subcmd-util.h b/tools/lib/subcmd/subcmd-util.h -index 794a375dad360..b2aec04fce8f6 100644 ---- a/tools/lib/subcmd/subcmd-util.h -+++ b/tools/lib/subcmd/subcmd-util.h -@@ -50,15 +50,8 @@ static NORETURN inline void die(const char *err, ...) - static inline void *xrealloc(void *ptr, size_t size) - { - void *ret = realloc(ptr, size); -- if (!ret && !size) -- ret = realloc(ptr, 1); -- if (!ret) { -- ret = realloc(ptr, size); -- if (!ret && !size) -- ret = realloc(ptr, 1); -- if (!ret) -- die("Out of memory, realloc failed"); -- } -+ if (!ret) -+ die("Out of memory, realloc failed"); - return ret; - } - -diff --git a/tools/testing/selftests/rtc/settings b/tools/testing/selftests/rtc/settings -index ba4d85f74cd6b..a953c96aa16e1 100644 ---- a/tools/testing/selftests/rtc/settings -+++ b/tools/testing/selftests/rtc/settings -@@ -1 +1 @@ --timeout=90 -+timeout=180 -diff --git a/tools/testing/selftests/zram/zram.sh b/tools/testing/selftests/zram/zram.sh -index 232e958ec4547..b0b91d9b0dc21 100755 ---- a/tools/testing/selftests/zram/zram.sh -+++ b/tools/testing/selftests/zram/zram.sh -@@ -2,9 +2,6 @@ - # SPDX-License-Identifier: GPL-2.0 - TCID="zram.sh" - --# Kselftest framework requirement - SKIP code is 4. --ksft_skip=4 -- - . ./zram_lib.sh - - run_zram () { -@@ -18,14 +15,4 @@ echo "" - - check_prereqs - --# check zram module exists --MODULE_PATH=/lib/modules/`uname -r`/kernel/drivers/block/zram/zram.ko --if [ -f $MODULE_PATH ]; then -- run_zram --elif [ -b /dev/zram0 ]; then -- run_zram --else -- echo "$TCID : No zram.ko module or /dev/zram0 device file not found" -- echo "$TCID : CONFIG_ZRAM is not set" -- exit $ksft_skip --fi -+run_zram -diff --git a/tools/testing/selftests/zram/zram01.sh b/tools/testing/selftests/zram/zram01.sh -index 114863d9fb876..8f4affe34f3e4 100755 ---- a/tools/testing/selftests/zram/zram01.sh -+++ b/tools/testing/selftests/zram/zram01.sh -@@ -33,9 +33,7 @@ zram_algs="lzo" - - zram_fill_fs() - { -- local mem_free0=$(free -m | awk 'NR==2 {print $4}') -- -- for i in $(seq 0 $(($dev_num - 1))); do -+ for i in $(seq $dev_start $dev_end); do - echo "fill zram$i..." - local b=0 - while [ true ]; do -@@ -45,29 +43,17 @@ zram_fill_fs() - b=$(($b + 1)) - done - echo "zram$i can be filled with '$b' KB" -- done - -- local mem_free1=$(free -m | awk 'NR==2 {print $4}') -- local used_mem=$(($mem_free0 - $mem_free1)) -+ local mem_used_total=`awk '{print $3}' "/sys/block/zram$i/mm_stat"` -+ local v=$((100 * 1024 * $b / $mem_used_total)) -+ if [ "$v" -lt 100 ]; then -+ echo "FAIL compression ratio: 0.$v:1" -+ ERR_CODE=-1 -+ return -+ fi - -- local total_size=0 -- for sm in $zram_sizes; do -- local s=$(echo $sm | sed 's/M//') -- total_size=$(($total_size + $s)) -+ echo "zram compression ratio: $(echo "scale=2; $v / 100 " | bc):1: OK" - done -- -- echo "zram used ${used_mem}M, zram disk sizes ${total_size}M" -- -- local v=$((100 * $total_size / $used_mem)) -- -- if [ "$v" -lt 100 ]; then -- echo "FAIL compression ratio: 0.$v:1" -- ERR_CODE=-1 -- zram_cleanup -- return -- fi -- -- echo "zram compression ratio: $(echo "scale=2; $v / 100 " | bc):1: OK" - } - - check_prereqs -@@ -81,7 +67,6 @@ zram_mount - - zram_fill_fs - zram_cleanup --zram_unload - - if [ $ERR_CODE -ne 0 ]; then - echo "$TCID : [FAIL]" -diff --git a/tools/testing/selftests/zram/zram02.sh b/tools/testing/selftests/zram/zram02.sh -index e83b404807c09..2418b0c4ed136 100755 ---- a/tools/testing/selftests/zram/zram02.sh -+++ b/tools/testing/selftests/zram/zram02.sh -@@ -36,7 +36,6 @@ zram_set_memlimit - zram_makeswap - zram_swapoff - zram_cleanup --zram_unload - - if [ $ERR_CODE -ne 0 ]; then - echo "$TCID : [FAIL]" -diff --git a/tools/testing/selftests/zram/zram_lib.sh b/tools/testing/selftests/zram/zram_lib.sh -index 6f872f266fd11..21ec1966de76c 100755 ---- a/tools/testing/selftests/zram/zram_lib.sh -+++ b/tools/testing/selftests/zram/zram_lib.sh -@@ -5,12 +5,17 @@ - # Author: Alexey Kodanev - # Modified: Naresh Kamboju - --MODULE=0 - dev_makeswap=-1 - dev_mounted=-1 -- -+dev_start=0 -+dev_end=-1 -+module_load=-1 -+sys_control=-1 - # Kselftest framework requirement - SKIP code is 4. - ksft_skip=4 -+kernel_version=`uname -r | cut -d'.' -f1,2` -+kernel_major=${kernel_version%.*} -+kernel_minor=${kernel_version#*.} - - trap INT - -@@ -25,68 +30,104 @@ check_prereqs() - fi - } - -+kernel_gte() -+{ -+ major=${1%.*} -+ minor=${1#*.} -+ -+ if [ $kernel_major -gt $major ]; then -+ return 0 -+ elif [[ $kernel_major -eq $major && $kernel_minor -ge $minor ]]; then -+ return 0 -+ fi -+ -+ return 1 -+} -+ - zram_cleanup() - { - echo "zram cleanup" - local i= -- for i in $(seq 0 $dev_makeswap); do -+ for i in $(seq $dev_start $dev_makeswap); do - swapoff /dev/zram$i - done - -- for i in $(seq 0 $dev_mounted); do -+ for i in $(seq $dev_start $dev_mounted); do - umount /dev/zram$i - done - -- for i in $(seq 0 $(($dev_num - 1))); do -+ for i in $(seq $dev_start $dev_end); do - echo 1 > /sys/block/zram${i}/reset - rm -rf zram$i - done - --} -+ if [ $sys_control -eq 1 ]; then -+ for i in $(seq $dev_start $dev_end); do -+ echo $i > /sys/class/zram-control/hot_remove -+ done -+ fi - --zram_unload() --{ -- if [ $MODULE -ne 0 ] ; then -- echo "zram rmmod zram" -+ if [ $module_load -eq 1 ]; then - rmmod zram > /dev/null 2>&1 - fi - } - - zram_load() - { -- # check zram module exists -- MODULE_PATH=/lib/modules/`uname -r`/kernel/drivers/block/zram/zram.ko -- if [ -f $MODULE_PATH ]; then -- MODULE=1 -- echo "create '$dev_num' zram device(s)" -- modprobe zram num_devices=$dev_num -- if [ $? -ne 0 ]; then -- echo "failed to insert zram module" -- exit 1 -- fi -- -- dev_num_created=$(ls /dev/zram* | wc -w) -+ echo "create '$dev_num' zram device(s)" -+ -+ # zram module loaded, new kernel -+ if [ -d "/sys/class/zram-control" ]; then -+ echo "zram modules already loaded, kernel supports" \ -+ "zram-control interface" -+ dev_start=$(ls /dev/zram* | wc -w) -+ dev_end=$(($dev_start + $dev_num - 1)) -+ sys_control=1 -+ -+ for i in $(seq $dev_start $dev_end); do -+ cat /sys/class/zram-control/hot_add > /dev/null -+ done -+ -+ echo "all zram devices (/dev/zram$dev_start~$dev_end" \ -+ "successfully created" -+ return 0 -+ fi - -- if [ "$dev_num_created" -ne "$dev_num" ]; then -- echo "unexpected num of devices: $dev_num_created" -- ERR_CODE=-1 -+ # detect old kernel or built-in -+ modprobe zram num_devices=$dev_num -+ if [ ! -d "/sys/class/zram-control" ]; then -+ if grep -q '^zram' /proc/modules; then -+ rmmod zram > /dev/null 2>&1 -+ if [ $? -ne 0 ]; then -+ echo "zram module is being used on old kernel" \ -+ "without zram-control interface" -+ exit $ksft_skip -+ fi - else -- echo "zram load module successful" -+ echo "test needs CONFIG_ZRAM=m on old kernel without" \ -+ "zram-control interface" -+ exit $ksft_skip - fi -- elif [ -b /dev/zram0 ]; then -- echo "/dev/zram0 device file found: OK" -- else -- echo "ERROR: No zram.ko module or no /dev/zram0 device found" -- echo "$TCID : CONFIG_ZRAM is not set" -- exit 1 -+ modprobe zram num_devices=$dev_num - fi -+ -+ module_load=1 -+ dev_end=$(($dev_num - 1)) -+ echo "all zram devices (/dev/zram0~$dev_end) successfully created" - } - - zram_max_streams() - { - echo "set max_comp_streams to zram device(s)" - -- local i=0 -+ kernel_gte 4.7 -+ if [ $? -eq 0 ]; then -+ echo "The device attribute max_comp_streams was"\ -+ "deprecated in 4.7" -+ return 0 -+ fi -+ -+ local i=$dev_start - for max_s in $zram_max_streams; do - local sys_path="/sys/block/zram${i}/max_comp_streams" - echo $max_s > $sys_path || \ -@@ -98,7 +139,7 @@ zram_max_streams() - echo "FAIL can't set max_streams '$max_s', get $max_stream" - - i=$(($i + 1)) -- echo "$sys_path = '$max_streams' ($i/$dev_num)" -+ echo "$sys_path = '$max_streams'" - done - - echo "zram max streams: OK" -@@ -108,15 +149,16 @@ zram_compress_alg() - { - echo "test that we can set compression algorithm" - -- local algs=$(cat /sys/block/zram0/comp_algorithm) -+ local i=$dev_start -+ local algs=$(cat /sys/block/zram${i}/comp_algorithm) - echo "supported algs: $algs" -- local i=0 -+ - for alg in $zram_algs; do - local sys_path="/sys/block/zram${i}/comp_algorithm" - echo "$alg" > $sys_path || \ - echo "FAIL can't set '$alg' to $sys_path" - i=$(($i + 1)) -- echo "$sys_path = '$alg' ($i/$dev_num)" -+ echo "$sys_path = '$alg'" - done - - echo "zram set compression algorithm: OK" -@@ -125,14 +167,14 @@ zram_compress_alg() - zram_set_disksizes() - { - echo "set disk size to zram device(s)" -- local i=0 -+ local i=$dev_start - for ds in $zram_sizes; do - local sys_path="/sys/block/zram${i}/disksize" - echo "$ds" > $sys_path || \ - echo "FAIL can't set '$ds' to $sys_path" - - i=$(($i + 1)) -- echo "$sys_path = '$ds' ($i/$dev_num)" -+ echo "$sys_path = '$ds'" - done - - echo "zram set disksizes: OK" -@@ -142,14 +184,14 @@ zram_set_memlimit() - { - echo "set memory limit to zram device(s)" - -- local i=0 -+ local i=$dev_start - for ds in $zram_mem_limits; do - local sys_path="/sys/block/zram${i}/mem_limit" - echo "$ds" > $sys_path || \ - echo "FAIL can't set '$ds' to $sys_path" - - i=$(($i + 1)) -- echo "$sys_path = '$ds' ($i/$dev_num)" -+ echo "$sys_path = '$ds'" - done - - echo "zram set memory limit: OK" -@@ -158,8 +200,8 @@ zram_set_memlimit() - zram_makeswap() - { - echo "make swap with zram device(s)" -- local i=0 -- for i in $(seq 0 $(($dev_num - 1))); do -+ local i=$dev_start -+ for i in $(seq $dev_start $dev_end); do - mkswap /dev/zram$i > err.log 2>&1 - if [ $? -ne 0 ]; then - cat err.log -@@ -182,7 +224,7 @@ zram_makeswap() - zram_swapoff() - { - local i= -- for i in $(seq 0 $dev_makeswap); do -+ for i in $(seq $dev_start $dev_end); do - swapoff /dev/zram$i > err.log 2>&1 - if [ $? -ne 0 ]; then - cat err.log -@@ -196,7 +238,7 @@ zram_swapoff() - - zram_makefs() - { -- local i=0 -+ local i=$dev_start - for fs in $zram_filesystems; do - # if requested fs not supported default it to ext2 - which mkfs.$fs > /dev/null 2>&1 || fs=ext2 -@@ -215,7 +257,7 @@ zram_makefs() - zram_mount() - { - local i=0 -- for i in $(seq 0 $(($dev_num - 1))); do -+ for i in $(seq $dev_start $dev_end); do - echo "mount /dev/zram$i" - mkdir zram$i - mount /dev/zram$i zram$i > /dev/null || \ diff --git a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.181-182.patch b/patch/kernel/archive/odroidxu4-5.4/patch-5.4.181-182.patch deleted file mode 100644 index 286bae77c..000000000 --- a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.181-182.patch +++ /dev/null @@ -1,2110 +0,0 @@ -diff --git a/Makefile b/Makefile -index afe2420bb3de0..8750309fc42ac 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 5 - PATCHLEVEL = 4 --SUBLEVEL = 181 -+SUBLEVEL = 182 - EXTRAVERSION = - NAME = Kleptomaniac Octopus - -diff --git a/arch/parisc/kernel/unaligned.c b/arch/parisc/kernel/unaligned.c -index 237d20dd5622d..286cec4d86d7b 100644 ---- a/arch/parisc/kernel/unaligned.c -+++ b/arch/parisc/kernel/unaligned.c -@@ -340,7 +340,7 @@ static int emulate_stw(struct pt_regs *regs, int frreg, int flop) - : "r" (val), "r" (regs->ior), "r" (regs->isr) - : "r19", "r20", "r21", "r22", "r1", FIXUP_BRANCH_CLOBBER ); - -- return 0; -+ return ret; - } - static int emulate_std(struct pt_regs *regs, int frreg, int flop) - { -@@ -397,7 +397,7 @@ static int emulate_std(struct pt_regs *regs, int frreg, int flop) - __asm__ __volatile__ ( - " mtsp %4, %%sr1\n" - " zdep %2, 29, 2, %%r19\n" --" dep %%r0, 31, 2, %2\n" -+" dep %%r0, 31, 2, %3\n" - " mtsar %%r19\n" - " zvdepi -2, 32, %%r19\n" - "1: ldw 0(%%sr1,%3),%%r20\n" -@@ -409,7 +409,7 @@ static int emulate_std(struct pt_regs *regs, int frreg, int flop) - " andcm %%r21, %%r19, %%r21\n" - " or %1, %%r20, %1\n" - " or %2, %%r21, %2\n" --"3: stw %1,0(%%sr1,%1)\n" -+"3: stw %1,0(%%sr1,%3)\n" - "4: stw %%r1,4(%%sr1,%3)\n" - "5: stw %2,8(%%sr1,%3)\n" - " copy %%r0, %0\n" -@@ -596,7 +596,6 @@ void handle_unaligned(struct pt_regs *regs) - ret = ERR_NOTHANDLED; /* "undefined", but lets kill them. */ - break; - } --#ifdef CONFIG_PA20 - switch (regs->iir & OPCODE2_MASK) - { - case OPCODE_FLDD_L: -@@ -607,22 +606,23 @@ void handle_unaligned(struct pt_regs *regs) - flop=1; - ret = emulate_std(regs, R2(regs->iir),1); - break; -+#ifdef CONFIG_PA20 - case OPCODE_LDD_L: - ret = emulate_ldd(regs, R2(regs->iir),0); - break; - case OPCODE_STD_L: - ret = emulate_std(regs, R2(regs->iir),0); - break; -- } - #endif -+ } - switch (regs->iir & OPCODE3_MASK) - { - case OPCODE_FLDW_L: - flop=1; -- ret = emulate_ldw(regs, R2(regs->iir),0); -+ ret = emulate_ldw(regs, R2(regs->iir), 1); - break; - case OPCODE_LDW_M: -- ret = emulate_ldw(regs, R2(regs->iir),1); -+ ret = emulate_ldw(regs, R2(regs->iir), 0); - break; - - case OPCODE_FSTW_L: -diff --git a/arch/x86/include/asm/fpu/internal.h b/arch/x86/include/asm/fpu/internal.h -index 03b3de491b5e6..5ed702e2c55f4 100644 ---- a/arch/x86/include/asm/fpu/internal.h -+++ b/arch/x86/include/asm/fpu/internal.h -@@ -560,9 +560,11 @@ static inline void __fpregs_load_activate(void) - * The FPU context is only stored/restored for a user task and - * PF_KTHREAD is used to distinguish between kernel and user threads. - */ --static inline void switch_fpu_prepare(struct fpu *old_fpu, int cpu) -+static inline void switch_fpu_prepare(struct task_struct *prev, int cpu) - { -- if (static_cpu_has(X86_FEATURE_FPU) && !(current->flags & PF_KTHREAD)) { -+ struct fpu *old_fpu = &prev->thread.fpu; -+ -+ if (static_cpu_has(X86_FEATURE_FPU) && !(prev->flags & PF_KTHREAD)) { - if (!copy_fpregs_to_fpstate(old_fpu)) - old_fpu->last_cpu = -1; - else -@@ -581,10 +583,11 @@ static inline void switch_fpu_prepare(struct fpu *old_fpu, int cpu) - * Load PKRU from the FPU context if available. Delay loading of the - * complete FPU state until the return to userland. - */ --static inline void switch_fpu_finish(struct fpu *new_fpu) -+static inline void switch_fpu_finish(struct task_struct *next) - { - u32 pkru_val = init_pkru_value; - struct pkru_state *pk; -+ struct fpu *next_fpu = &next->thread.fpu; - - if (!static_cpu_has(X86_FEATURE_FPU)) - return; -@@ -598,7 +601,7 @@ static inline void switch_fpu_finish(struct fpu *new_fpu) - * PKRU state is switched eagerly because it needs to be valid before we - * return to userland e.g. for a copy_to_user() operation. - */ -- if (!(current->flags & PF_KTHREAD)) { -+ if (!(next->flags & PF_KTHREAD)) { - /* - * If the PKRU bit in xsave.header.xfeatures is not set, - * then the PKRU component was in init state, which means -@@ -607,7 +610,7 @@ static inline void switch_fpu_finish(struct fpu *new_fpu) - * in memory is not valid. This means pkru_val has to be - * set to 0 and not to init_pkru_value. - */ -- pk = get_xsave_addr(&new_fpu->state.xsave, XFEATURE_PKRU); -+ pk = get_xsave_addr(&next_fpu->state.xsave, XFEATURE_PKRU); - pkru_val = pk ? pk->pkru : 0; - } - __write_pkru(pkru_val); -diff --git a/arch/x86/kernel/process_32.c b/arch/x86/kernel/process_32.c -index b8ceec4974fe3..352f876950ab3 100644 ---- a/arch/x86/kernel/process_32.c -+++ b/arch/x86/kernel/process_32.c -@@ -229,14 +229,12 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p) - { - struct thread_struct *prev = &prev_p->thread, - *next = &next_p->thread; -- struct fpu *prev_fpu = &prev->fpu; -- struct fpu *next_fpu = &next->fpu; - int cpu = smp_processor_id(); - - /* never put a printk in __switch_to... printk() calls wake_up*() indirectly */ - - if (!test_thread_flag(TIF_NEED_FPU_LOAD)) -- switch_fpu_prepare(prev_fpu, cpu); -+ switch_fpu_prepare(prev_p, cpu); - - /* - * Save away %gs. No need to save %fs, as it was saved on the -@@ -292,7 +290,7 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p) - - this_cpu_write(current_task, next_p); - -- switch_fpu_finish(next_fpu); -+ switch_fpu_finish(next_p); - - /* Load the Intel cache allocation PQR MSR. */ - resctrl_sched_in(); -diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c -index da3cc3a10d63f..633788362906a 100644 ---- a/arch/x86/kernel/process_64.c -+++ b/arch/x86/kernel/process_64.c -@@ -505,15 +505,13 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p) - { - struct thread_struct *prev = &prev_p->thread; - struct thread_struct *next = &next_p->thread; -- struct fpu *prev_fpu = &prev->fpu; -- struct fpu *next_fpu = &next->fpu; - int cpu = smp_processor_id(); - - WARN_ON_ONCE(IS_ENABLED(CONFIG_DEBUG_ENTRY) && - this_cpu_read(irq_count) != -1); - - if (!test_thread_flag(TIF_NEED_FPU_LOAD)) -- switch_fpu_prepare(prev_fpu, cpu); -+ switch_fpu_prepare(prev_p, cpu); - - /* We must save %fs and %gs before load_TLS() because - * %fs and %gs may be cleared by load_TLS(). -@@ -565,7 +563,7 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p) - this_cpu_write(current_task, next_p); - this_cpu_write(cpu_current_top_of_stack, task_top_of_stack(next_p)); - -- switch_fpu_finish(next_fpu); -+ switch_fpu_finish(next_p); - - /* Reload sp0. */ - update_task_stack(next_p); -diff --git a/drivers/ata/pata_hpt37x.c b/drivers/ata/pata_hpt37x.c -index fad6c6a873130..499a947d56ddb 100644 ---- a/drivers/ata/pata_hpt37x.c -+++ b/drivers/ata/pata_hpt37x.c -@@ -917,6 +917,20 @@ static int hpt37x_init_one(struct pci_dev *dev, const struct pci_device_id *id) - irqmask &= ~0x10; - pci_write_config_byte(dev, 0x5a, irqmask); - -+ /* -+ * HPT371 chips physically have only one channel, the secondary one, -+ * but the primary channel registers do exist! Go figure... -+ * So, we manually disable the non-existing channel here -+ * (if the BIOS hasn't done this already). -+ */ -+ if (dev->device == PCI_DEVICE_ID_TTI_HPT371) { -+ u8 mcr1; -+ -+ pci_read_config_byte(dev, 0x50, &mcr1); -+ mcr1 &= ~0x04; -+ pci_write_config_byte(dev, 0x50, mcr1); -+ } -+ - /* - * default to pci clock. make sure MA15/16 are set to output - * to prevent drives having problems with 40-pin cables. Needed -diff --git a/drivers/clk/ingenic/jz4725b-cgu.c b/drivers/clk/ingenic/jz4725b-cgu.c -index a3b4635f62784..97afabb7fe8e5 100644 ---- a/drivers/clk/ingenic/jz4725b-cgu.c -+++ b/drivers/clk/ingenic/jz4725b-cgu.c -@@ -135,11 +135,10 @@ static const struct ingenic_cgu_clk_info jz4725b_cgu_clocks[] = { - }, - - [JZ4725B_CLK_I2S] = { -- "i2s", CGU_CLK_MUX | CGU_CLK_DIV | CGU_CLK_GATE, -+ "i2s", CGU_CLK_MUX | CGU_CLK_DIV, - .parents = { JZ4725B_CLK_EXT, JZ4725B_CLK_PLL_HALF, -1, -1 }, - .mux = { CGU_REG_CPCCR, 31, 1 }, - .div = { CGU_REG_I2SCDR, 0, 1, 9, -1, -1, -1 }, -- .gate = { CGU_REG_CLKGR, 6 }, - }, - - [JZ4725B_CLK_SPI] = { -diff --git a/drivers/gpio/gpio-tegra186.c b/drivers/gpio/gpio-tegra186.c -index a9058fda187e3..a41e1ddf9e6fc 100644 ---- a/drivers/gpio/gpio-tegra186.c -+++ b/drivers/gpio/gpio-tegra186.c -@@ -234,9 +234,12 @@ static int tegra186_gpio_of_xlate(struct gpio_chip *chip, - return offset + pin; - } - -+#define to_tegra_gpio(x) container_of((x), struct tegra_gpio, gpio) -+ - static void tegra186_irq_ack(struct irq_data *data) - { -- struct tegra_gpio *gpio = irq_data_get_irq_chip_data(data); -+ struct gpio_chip *gc = irq_data_get_irq_chip_data(data); -+ struct tegra_gpio *gpio = to_tegra_gpio(gc); - void __iomem *base; - - base = tegra186_gpio_get_base(gpio, data->hwirq); -@@ -248,7 +251,8 @@ static void tegra186_irq_ack(struct irq_data *data) - - static void tegra186_irq_mask(struct irq_data *data) - { -- struct tegra_gpio *gpio = irq_data_get_irq_chip_data(data); -+ struct gpio_chip *gc = irq_data_get_irq_chip_data(data); -+ struct tegra_gpio *gpio = to_tegra_gpio(gc); - void __iomem *base; - u32 value; - -@@ -263,7 +267,8 @@ static void tegra186_irq_mask(struct irq_data *data) - - static void tegra186_irq_unmask(struct irq_data *data) - { -- struct tegra_gpio *gpio = irq_data_get_irq_chip_data(data); -+ struct gpio_chip *gc = irq_data_get_irq_chip_data(data); -+ struct tegra_gpio *gpio = to_tegra_gpio(gc); - void __iomem *base; - u32 value; - -@@ -278,7 +283,8 @@ static void tegra186_irq_unmask(struct irq_data *data) - - static int tegra186_irq_set_type(struct irq_data *data, unsigned int type) - { -- struct tegra_gpio *gpio = irq_data_get_irq_chip_data(data); -+ struct gpio_chip *gc = irq_data_get_irq_chip_data(data); -+ struct tegra_gpio *gpio = to_tegra_gpio(gc); - void __iomem *base; - u32 value; - -diff --git a/drivers/gpu/drm/amd/amdgpu/soc15.c b/drivers/gpu/drm/amd/amdgpu/soc15.c -index 6ff1d308623a7..b368496ed6858 100644 ---- a/drivers/gpu/drm/amd/amdgpu/soc15.c -+++ b/drivers/gpu/drm/amd/amdgpu/soc15.c -@@ -1143,8 +1143,11 @@ static int soc15_common_early_init(void *handle) - AMD_CG_SUPPORT_SDMA_MGCG | - AMD_CG_SUPPORT_SDMA_LS; - -+ /* -+ * MMHUB PG needs to be disabled for Picasso for -+ * stability reasons. -+ */ - adev->pg_flags = AMD_PG_SUPPORT_SDMA | -- AMD_PG_SUPPORT_MMHUB | - AMD_PG_SUPPORT_VCN; - } else { - adev->cg_flags = AMD_CG_SUPPORT_GFX_MGCG | -diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c -index 9b69e55ad7010..3f0a798906004 100644 ---- a/drivers/gpu/drm/drm_edid.c -+++ b/drivers/gpu/drm/drm_edid.c -@@ -4659,6 +4659,7 @@ u32 drm_add_display_info(struct drm_connector *connector, const struct edid *edi - if (!(edid->input & DRM_EDID_INPUT_DIGITAL)) - return quirks; - -+ info->color_formats |= DRM_COLOR_FORMAT_RGB444; - drm_parse_cea_ext(connector, edid); - - /* -@@ -4707,7 +4708,6 @@ u32 drm_add_display_info(struct drm_connector *connector, const struct edid *edi - DRM_DEBUG("%s: Assigning EDID-1.4 digital sink color depth as %d bpc.\n", - connector->name, info->bpc); - -- info->color_formats |= DRM_COLOR_FORMAT_RGB444; - if (edid->features & DRM_EDID_FEATURE_RGB_YCRCB444) - info->color_formats |= DRM_COLOR_FORMAT_YCRCB444; - if (edid->features & DRM_EDID_FEATURE_RGB_YCRCB422) -diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/base.c b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/base.c -index 105b4be467a3e..ea2e11771bca5 100644 ---- a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/base.c -+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/base.c -@@ -88,13 +88,20 @@ nvkm_pmu_fini(struct nvkm_subdev *subdev, bool suspend) - return 0; - } - --static void -+static int - nvkm_pmu_reset(struct nvkm_pmu *pmu) - { - struct nvkm_device *device = pmu->subdev.device; - - if (!pmu->func->enabled(pmu)) -- return; -+ return 0; -+ -+ /* Inhibit interrupts, and wait for idle. */ -+ nvkm_wr32(device, 0x10a014, 0x0000ffff); -+ nvkm_msec(device, 2000, -+ if (!nvkm_rd32(device, 0x10a04c)) -+ break; -+ ); - - /* Reset. */ - if (pmu->func->reset) -@@ -105,37 +112,25 @@ nvkm_pmu_reset(struct nvkm_pmu *pmu) - if (!(nvkm_rd32(device, 0x10a10c) & 0x00000006)) - break; - ); -+ -+ return 0; - } - - static int - nvkm_pmu_preinit(struct nvkm_subdev *subdev) - { - struct nvkm_pmu *pmu = nvkm_pmu(subdev); -- nvkm_pmu_reset(pmu); -- return 0; -+ return nvkm_pmu_reset(pmu); - } - - static int - nvkm_pmu_init(struct nvkm_subdev *subdev) - { - struct nvkm_pmu *pmu = nvkm_pmu(subdev); -- struct nvkm_device *device = pmu->subdev.device; -- -- if (!pmu->func->init) -- return 0; -- -- if (pmu->func->enabled(pmu)) { -- /* Inhibit interrupts, and wait for idle. */ -- nvkm_wr32(device, 0x10a014, 0x0000ffff); -- nvkm_msec(device, 2000, -- if (!nvkm_rd32(device, 0x10a04c)) -- break; -- ); -- -- nvkm_pmu_reset(pmu); -- } -- -- return pmu->func->init(pmu); -+ int ret = nvkm_pmu_reset(pmu); -+ if (ret == 0 && pmu->func->init) -+ ret = pmu->func->init(pmu); -+ return ret; - } - - static int -diff --git a/drivers/iio/accel/bmc150-accel-core.c b/drivers/iio/accel/bmc150-accel-core.c -index bcdf25f32e220..a05d55125d13a 100644 ---- a/drivers/iio/accel/bmc150-accel-core.c -+++ b/drivers/iio/accel/bmc150-accel-core.c -@@ -1649,11 +1649,14 @@ int bmc150_accel_core_probe(struct device *dev, struct regmap *regmap, int irq, - ret = iio_device_register(indio_dev); - if (ret < 0) { - dev_err(dev, "Unable to register iio device\n"); -- goto err_trigger_unregister; -+ goto err_pm_cleanup; - } - - return 0; - -+err_pm_cleanup: -+ pm_runtime_dont_use_autosuspend(dev); -+ pm_runtime_disable(dev); - err_trigger_unregister: - bmc150_accel_unregister_triggers(data, BMC150_ACCEL_TRIGGERS - 1); - err_buffer_cleanup: -diff --git a/drivers/iio/accel/kxcjk-1013.c b/drivers/iio/accel/kxcjk-1013.c -index 6ff6f625bbf69..bd762976a3815 100644 ---- a/drivers/iio/accel/kxcjk-1013.c -+++ b/drivers/iio/accel/kxcjk-1013.c -@@ -1409,11 +1409,14 @@ static int kxcjk1013_probe(struct i2c_client *client, - ret = iio_device_register(indio_dev); - if (ret < 0) { - dev_err(&client->dev, "unable to register iio device\n"); -- goto err_buffer_cleanup; -+ goto err_pm_cleanup; - } - - return 0; - -+err_pm_cleanup: -+ pm_runtime_dont_use_autosuspend(&client->dev); -+ pm_runtime_disable(&client->dev); - err_buffer_cleanup: - iio_triggered_buffer_cleanup(indio_dev); - err_trigger_unregister: -diff --git a/drivers/iio/accel/mma9551.c b/drivers/iio/accel/mma9551.c -index 99e4a21ca9421..8315c7ee66cf3 100644 ---- a/drivers/iio/accel/mma9551.c -+++ b/drivers/iio/accel/mma9551.c -@@ -496,11 +496,14 @@ static int mma9551_probe(struct i2c_client *client, - ret = iio_device_register(indio_dev); - if (ret < 0) { - dev_err(&client->dev, "unable to register iio device\n"); -- goto out_poweroff; -+ goto err_pm_cleanup; - } - - return 0; - -+err_pm_cleanup: -+ pm_runtime_dont_use_autosuspend(&client->dev); -+ pm_runtime_disable(&client->dev); - out_poweroff: - mma9551_set_device_state(client, false); - -diff --git a/drivers/iio/accel/mma9553.c b/drivers/iio/accel/mma9553.c -index 312070dcf035a..73e85196d0bd3 100644 ---- a/drivers/iio/accel/mma9553.c -+++ b/drivers/iio/accel/mma9553.c -@@ -1135,12 +1135,15 @@ static int mma9553_probe(struct i2c_client *client, - ret = iio_device_register(indio_dev); - if (ret < 0) { - dev_err(&client->dev, "unable to register iio device\n"); -- goto out_poweroff; -+ goto err_pm_cleanup; - } - - dev_dbg(&indio_dev->dev, "Registered device %s\n", name); - return 0; - -+err_pm_cleanup: -+ pm_runtime_dont_use_autosuspend(&client->dev); -+ pm_runtime_disable(&client->dev); - out_poweroff: - mma9551_set_device_state(client, false); - return ret; -diff --git a/drivers/iio/adc/ad7124.c b/drivers/iio/adc/ad7124.c -index fa808f9c0d9af..635cc1e7b1234 100644 ---- a/drivers/iio/adc/ad7124.c -+++ b/drivers/iio/adc/ad7124.c -@@ -63,7 +63,7 @@ - #define AD7124_CONFIG_REF_SEL(x) FIELD_PREP(AD7124_CONFIG_REF_SEL_MSK, x) - #define AD7124_CONFIG_PGA_MSK GENMASK(2, 0) - #define AD7124_CONFIG_PGA(x) FIELD_PREP(AD7124_CONFIG_PGA_MSK, x) --#define AD7124_CONFIG_IN_BUFF_MSK GENMASK(7, 6) -+#define AD7124_CONFIG_IN_BUFF_MSK GENMASK(6, 5) - #define AD7124_CONFIG_IN_BUFF(x) FIELD_PREP(AD7124_CONFIG_IN_BUFF_MSK, x) - - /* AD7124_FILTER_X */ -diff --git a/drivers/iio/adc/men_z188_adc.c b/drivers/iio/adc/men_z188_adc.c -index 3b2fbb7ce4310..26caee73b7641 100644 ---- a/drivers/iio/adc/men_z188_adc.c -+++ b/drivers/iio/adc/men_z188_adc.c -@@ -103,6 +103,7 @@ static int men_z188_probe(struct mcb_device *dev, - struct z188_adc *adc; - struct iio_dev *indio_dev; - struct resource *mem; -+ int ret; - - indio_dev = devm_iio_device_alloc(&dev->dev, sizeof(struct z188_adc)); - if (!indio_dev) -@@ -129,8 +130,14 @@ static int men_z188_probe(struct mcb_device *dev, - adc->mem = mem; - mcb_set_drvdata(dev, indio_dev); - -- return iio_device_register(indio_dev); -+ ret = iio_device_register(indio_dev); -+ if (ret) -+ goto err_unmap; -+ -+ return 0; - -+err_unmap: -+ iounmap(adc->base); - err: - mcb_release_mem(mem); - return -ENXIO; -diff --git a/drivers/iio/gyro/bmg160_core.c b/drivers/iio/gyro/bmg160_core.c -index 276bed47e8d66..bf1355360c518 100644 ---- a/drivers/iio/gyro/bmg160_core.c -+++ b/drivers/iio/gyro/bmg160_core.c -@@ -1173,11 +1173,14 @@ int bmg160_core_probe(struct device *dev, struct regmap *regmap, int irq, - ret = iio_device_register(indio_dev); - if (ret < 0) { - dev_err(dev, "unable to register iio device\n"); -- goto err_buffer_cleanup; -+ goto err_pm_cleanup; - } - - return 0; - -+err_pm_cleanup: -+ pm_runtime_dont_use_autosuspend(dev); -+ pm_runtime_disable(dev); - err_buffer_cleanup: - iio_triggered_buffer_cleanup(indio_dev); - err_trigger_unregister: -diff --git a/drivers/iio/imu/kmx61.c b/drivers/iio/imu/kmx61.c -index e67466100aff4..c7d19f9ca7652 100644 ---- a/drivers/iio/imu/kmx61.c -+++ b/drivers/iio/imu/kmx61.c -@@ -1393,7 +1393,7 @@ static int kmx61_probe(struct i2c_client *client, - ret = iio_device_register(data->acc_indio_dev); - if (ret < 0) { - dev_err(&client->dev, "Failed to register acc iio device\n"); -- goto err_buffer_cleanup_mag; -+ goto err_pm_cleanup; - } - - ret = iio_device_register(data->mag_indio_dev); -@@ -1406,6 +1406,9 @@ static int kmx61_probe(struct i2c_client *client, - - err_iio_unregister_acc: - iio_device_unregister(data->acc_indio_dev); -+err_pm_cleanup: -+ pm_runtime_dont_use_autosuspend(&client->dev); -+ pm_runtime_disable(&client->dev); - err_buffer_cleanup_mag: - if (client->irq > 0) - iio_triggered_buffer_cleanup(data->mag_indio_dev); -diff --git a/drivers/iio/magnetometer/bmc150_magn.c b/drivers/iio/magnetometer/bmc150_magn.c -index 087dc16c2185c..ef8f429cc96f0 100644 ---- a/drivers/iio/magnetometer/bmc150_magn.c -+++ b/drivers/iio/magnetometer/bmc150_magn.c -@@ -944,13 +944,14 @@ int bmc150_magn_probe(struct device *dev, struct regmap *regmap, - ret = iio_device_register(indio_dev); - if (ret < 0) { - dev_err(dev, "unable to register iio device\n"); -- goto err_disable_runtime_pm; -+ goto err_pm_cleanup; - } - - dev_dbg(dev, "Registered device %s\n", name); - return 0; - --err_disable_runtime_pm: -+err_pm_cleanup: -+ pm_runtime_dont_use_autosuspend(dev); - pm_runtime_disable(dev); - err_buffer_cleanup: - iio_triggered_buffer_cleanup(indio_dev); -diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c -index 8708ed5477e99..dac806b715afa 100644 ---- a/drivers/infiniband/ulp/srp/ib_srp.c -+++ b/drivers/infiniband/ulp/srp/ib_srp.c -@@ -4222,9 +4222,11 @@ static void srp_remove_one(struct ib_device *device, void *client_data) - spin_unlock(&host->target_lock); - - /* -- * Wait for tl_err and target port removal tasks. -+ * srp_queue_remove_work() queues a call to -+ * srp_remove_target(). The latter function cancels -+ * target->tl_err_work so waiting for the remove works to -+ * finish is sufficient. - */ -- flush_workqueue(system_long_wq); - flush_workqueue(srp_remove_wq); - - kfree(host); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c -index e3dc2cbdc9f6c..e92cc60eade3f 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c -@@ -1683,7 +1683,7 @@ static int mlx5e_get_module_eeprom(struct net_device *netdev, - if (size_read < 0) { - netdev_err(priv->netdev, "%s: mlx5_query_eeprom failed:0x%x\n", - __func__, size_read); -- return 0; -+ return size_read; - } - - i += size_read; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c -index 7cc80dc4e6d89..31c832e5256e8 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c -@@ -1977,10 +1977,6 @@ esw_check_vport_match_metadata_supported(const struct mlx5_eswitch *esw) - if (!MLX5_CAP_ESW_FLOWTABLE(esw->dev, flow_source)) - return false; - -- if (mlx5_core_is_ecpf_esw_manager(esw->dev) || -- mlx5_ecpf_vport_exists(esw->dev)) -- return false; -- - return true; - } - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c -index 5fe4e028567a9..5baf2c666d293 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c -@@ -1947,6 +1947,8 @@ void mlx5_del_flow_rules(struct mlx5_flow_handle *handle) - fte->node.del_hw_func = NULL; - up_write_ref_node(&fte->node, false); - tree_put_node(&fte->node, false); -+ } else { -+ up_write_ref_node(&fte->node, false); - } - kfree(handle); - } -diff --git a/drivers/net/ethernet/microchip/lan743x_main.c b/drivers/net/ethernet/microchip/lan743x_main.c -index 22beeb5be9c41..c69ffcfe61689 100644 ---- a/drivers/net/ethernet/microchip/lan743x_main.c -+++ b/drivers/net/ethernet/microchip/lan743x_main.c -@@ -916,8 +916,7 @@ static int lan743x_phy_reset(struct lan743x_adapter *adapter) - } - - static void lan743x_phy_update_flowcontrol(struct lan743x_adapter *adapter, -- u8 duplex, u16 local_adv, -- u16 remote_adv) -+ u16 local_adv, u16 remote_adv) - { - struct lan743x_phy *phy = &adapter->phy; - u8 cap; -@@ -944,22 +943,17 @@ static void lan743x_phy_link_status_change(struct net_device *netdev) - - phy_print_status(phydev); - if (phydev->state == PHY_RUNNING) { -- struct ethtool_link_ksettings ksettings; - int remote_advertisement = 0; - int local_advertisement = 0; - -- memset(&ksettings, 0, sizeof(ksettings)); -- phy_ethtool_get_link_ksettings(netdev, &ksettings); - local_advertisement = - linkmode_adv_to_mii_adv_t(phydev->advertising); - remote_advertisement = - linkmode_adv_to_mii_adv_t(phydev->lp_advertising); - -- lan743x_phy_update_flowcontrol(adapter, -- ksettings.base.duplex, -- local_advertisement, -+ lan743x_phy_update_flowcontrol(adapter, local_advertisement, - remote_advertisement); -- lan743x_ptp_update_latency(adapter, ksettings.base.speed); -+ lan743x_ptp_update_latency(adapter, phydev->speed); - } - } - -diff --git a/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c b/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c -index f8c8451919cb6..26772c3310f09 100644 ---- a/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c -+++ b/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c -@@ -588,8 +588,8 @@ nfp_tunnel_add_shared_mac(struct nfp_app *app, struct net_device *netdev, - int port, bool mod) - { - struct nfp_flower_priv *priv = app->priv; -- int ida_idx = NFP_MAX_MAC_INDEX, err; - struct nfp_tun_offloaded_mac *entry; -+ int ida_idx = -1, err; - u16 nfp_mac_idx = 0; - - entry = nfp_tunnel_lookup_offloaded_macs(app, netdev->dev_addr); -@@ -663,7 +663,7 @@ err_remove_hash: - err_free_entry: - kfree(entry); - err_free_ida: -- if (ida_idx != NFP_MAX_MAC_INDEX) -+ if (ida_idx != -1) - ida_simple_remove(&priv->tun.mac_off_ids, ida_idx); - - return err; -diff --git a/drivers/net/ethernet/xilinx/ll_temac_main.c b/drivers/net/ethernet/xilinx/ll_temac_main.c -index bddd64e918ce0..a109438f4a78e 100644 ---- a/drivers/net/ethernet/xilinx/ll_temac_main.c -+++ b/drivers/net/ethernet/xilinx/ll_temac_main.c -@@ -1345,6 +1345,8 @@ static int temac_probe(struct platform_device *pdev) - lp->indirect_lock = devm_kmalloc(&pdev->dev, - sizeof(*lp->indirect_lock), - GFP_KERNEL); -+ if (!lp->indirect_lock) -+ return -ENOMEM; - spin_lock_init(lp->indirect_lock); - } - -diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c -index 8325f6d65dccc..eee402a59f6da 100644 ---- a/drivers/net/usb/cdc_ether.c -+++ b/drivers/net/usb/cdc_ether.c -@@ -571,6 +571,11 @@ static const struct usb_device_id products[] = { - .bInterfaceSubClass = USB_CDC_SUBCLASS_ETHERNET, \ - .bInterfaceProtocol = USB_CDC_PROTO_NONE - -+#define ZAURUS_FAKE_INTERFACE \ -+ .bInterfaceClass = USB_CLASS_COMM, \ -+ .bInterfaceSubClass = USB_CDC_SUBCLASS_MDLM, \ -+ .bInterfaceProtocol = USB_CDC_PROTO_NONE -+ - /* SA-1100 based Sharp Zaurus ("collie"), or compatible; - * wire-incompatible with true CDC Ethernet implementations. - * (And, it seems, needlessly so...) -@@ -624,6 +629,13 @@ static const struct usb_device_id products[] = { - .idProduct = 0x9032, /* SL-6000 */ - ZAURUS_MASTER_INTERFACE, - .driver_info = 0, -+}, { -+ .match_flags = USB_DEVICE_ID_MATCH_INT_INFO -+ | USB_DEVICE_ID_MATCH_DEVICE, -+ .idVendor = 0x04DD, -+ .idProduct = 0x9032, /* SL-6000 */ -+ ZAURUS_FAKE_INTERFACE, -+ .driver_info = 0, - }, { - .match_flags = USB_DEVICE_ID_MATCH_INT_INFO - | USB_DEVICE_ID_MATCH_DEVICE, -diff --git a/drivers/net/usb/sr9700.c b/drivers/net/usb/sr9700.c -index e04c8054c2cf3..fce6713e970ba 100644 ---- a/drivers/net/usb/sr9700.c -+++ b/drivers/net/usb/sr9700.c -@@ -410,7 +410,7 @@ static int sr9700_rx_fixup(struct usbnet *dev, struct sk_buff *skb) - /* ignore the CRC length */ - len = (skb->data[1] | (skb->data[2] << 8)) - 4; - -- if (len > ETH_FRAME_LEN) -+ if (len > ETH_FRAME_LEN || len > skb->len) - return 0; - - /* the last packet of current skb */ -diff --git a/drivers/net/usb/zaurus.c b/drivers/net/usb/zaurus.c -index 8e717a0b559b3..7984f2157d222 100644 ---- a/drivers/net/usb/zaurus.c -+++ b/drivers/net/usb/zaurus.c -@@ -256,6 +256,11 @@ static const struct usb_device_id products [] = { - .bInterfaceSubClass = USB_CDC_SUBCLASS_ETHERNET, \ - .bInterfaceProtocol = USB_CDC_PROTO_NONE - -+#define ZAURUS_FAKE_INTERFACE \ -+ .bInterfaceClass = USB_CLASS_COMM, \ -+ .bInterfaceSubClass = USB_CDC_SUBCLASS_MDLM, \ -+ .bInterfaceProtocol = USB_CDC_PROTO_NONE -+ - /* SA-1100 based Sharp Zaurus ("collie"), or compatible. */ - { - .match_flags = USB_DEVICE_ID_MATCH_INT_INFO -@@ -313,6 +318,13 @@ static const struct usb_device_id products [] = { - .idProduct = 0x9032, /* SL-6000 */ - ZAURUS_MASTER_INTERFACE, - .driver_info = ZAURUS_PXA_INFO, -+}, { -+ .match_flags = USB_DEVICE_ID_MATCH_INT_INFO -+ | USB_DEVICE_ID_MATCH_DEVICE, -+ .idVendor = 0x04DD, -+ .idProduct = 0x9032, /* SL-6000 */ -+ ZAURUS_FAKE_INTERFACE, -+ .driver_info = (unsigned long)&bogus_mdlm_info, - }, { - .match_flags = USB_DEVICE_ID_MATCH_INT_INFO - | USB_DEVICE_ID_MATCH_DEVICE, -diff --git a/drivers/spi/spi-zynq-qspi.c b/drivers/spi/spi-zynq-qspi.c -index 1ced6eb8b3303..b3588240eb39b 100644 ---- a/drivers/spi/spi-zynq-qspi.c -+++ b/drivers/spi/spi-zynq-qspi.c -@@ -558,6 +558,9 @@ static int zynq_qspi_exec_mem_op(struct spi_mem *mem, - - if (op->dummy.nbytes) { - tmpbuf = kzalloc(op->dummy.nbytes, GFP_KERNEL); -+ if (!tmpbuf) -+ return -ENOMEM; -+ - memset(tmpbuf, 0xff, op->dummy.nbytes); - reinit_completion(&xqspi->data_completion); - xqspi->txbuf = tmpbuf; -diff --git a/drivers/tee/optee/core.c b/drivers/tee/optee/core.c -index 5eaef45799e61..344f48c909181 100644 ---- a/drivers/tee/optee/core.c -+++ b/drivers/tee/optee/core.c -@@ -552,6 +552,7 @@ static struct optee *optee_probe(struct device_node *np) - struct optee *optee = NULL; - void *memremaped_shm = NULL; - struct tee_device *teedev; -+ struct tee_context *ctx; - u32 sec_caps; - int rc; - -@@ -631,6 +632,12 @@ static struct optee *optee_probe(struct device_node *np) - optee_supp_init(&optee->supp); - optee->memremaped_shm = memremaped_shm; - optee->pool = pool; -+ ctx = teedev_open(optee->teedev); -+ if (IS_ERR(ctx)) { -+ rc = PTR_ERR(ctx); -+ goto err; -+ } -+ optee->ctx = ctx; - - /* - * Ensure that there are no pre-existing shm objects before enabling -@@ -667,6 +674,7 @@ err: - - static void optee_remove(struct optee *optee) - { -+ teedev_close_context(optee->ctx); - /* - * Ask OP-TEE to free all cached shared memory objects to decrease - * reference counters and also avoid wild pointers in secure world -diff --git a/drivers/tee/optee/optee_private.h b/drivers/tee/optee/optee_private.h -index 54c3fa01d0024..0250cfde6312d 100644 ---- a/drivers/tee/optee/optee_private.h -+++ b/drivers/tee/optee/optee_private.h -@@ -69,6 +69,7 @@ struct optee_supp { - * struct optee - main service struct - * @supp_teedev: supplicant device - * @teedev: client device -+ * @ctx: driver internal TEE context - * @invoke_fn: function to issue smc or hvc - * @call_queue: queue of threads waiting to call @invoke_fn - * @wait_queue: queue of threads from secure world waiting for a -@@ -83,6 +84,7 @@ struct optee { - struct tee_device *supp_teedev; - struct tee_device *teedev; - optee_invoke_fn *invoke_fn; -+ struct tee_context *ctx; - struct optee_call_queue call_queue; - struct optee_wait_queue wait_queue; - struct optee_supp supp; -diff --git a/drivers/tee/optee/rpc.c b/drivers/tee/optee/rpc.c -index aecf62016e7b8..be45ee6202991 100644 ---- a/drivers/tee/optee/rpc.c -+++ b/drivers/tee/optee/rpc.c -@@ -191,6 +191,7 @@ static struct tee_shm *cmd_alloc_suppl(struct tee_context *ctx, size_t sz) - } - - static void handle_rpc_func_cmd_shm_alloc(struct tee_context *ctx, -+ struct optee *optee, - struct optee_msg_arg *arg, - struct optee_call_ctx *call_ctx) - { -@@ -220,7 +221,8 @@ static void handle_rpc_func_cmd_shm_alloc(struct tee_context *ctx, - shm = cmd_alloc_suppl(ctx, sz); - break; - case OPTEE_MSG_RPC_SHM_TYPE_KERNEL: -- shm = tee_shm_alloc(ctx, sz, TEE_SHM_MAPPED | TEE_SHM_PRIV); -+ shm = tee_shm_alloc(optee->ctx, sz, -+ TEE_SHM_MAPPED | TEE_SHM_PRIV); - break; - default: - arg->ret = TEEC_ERROR_BAD_PARAMETERS; -@@ -377,7 +379,7 @@ static void handle_rpc_func_cmd(struct tee_context *ctx, struct optee *optee, - break; - case OPTEE_MSG_RPC_CMD_SHM_ALLOC: - free_pages_list(call_ctx); -- handle_rpc_func_cmd_shm_alloc(ctx, arg, call_ctx); -+ handle_rpc_func_cmd_shm_alloc(ctx, optee, arg, call_ctx); - break; - case OPTEE_MSG_RPC_CMD_SHM_FREE: - handle_rpc_func_cmd_shm_free(ctx, arg); -@@ -405,7 +407,7 @@ void optee_handle_rpc(struct tee_context *ctx, struct optee_rpc_param *param, - - switch (OPTEE_SMC_RETURN_GET_RPC_FUNC(param->a0)) { - case OPTEE_SMC_RPC_FUNC_ALLOC: -- shm = tee_shm_alloc(ctx, param->a1, -+ shm = tee_shm_alloc(optee->ctx, param->a1, - TEE_SHM_MAPPED | TEE_SHM_PRIV); - if (!IS_ERR(shm) && !tee_shm_get_pa(shm, 0, &pa)) { - reg_pair_from_64(¶m->a1, ¶m->a2, pa); -diff --git a/drivers/tee/tee_core.c b/drivers/tee/tee_core.c -index 85e0cef9e917e..a7ccd4d2bd106 100644 ---- a/drivers/tee/tee_core.c -+++ b/drivers/tee/tee_core.c -@@ -28,7 +28,7 @@ static DEFINE_SPINLOCK(driver_lock); - static struct class *tee_class; - static dev_t tee_devt; - --static struct tee_context *teedev_open(struct tee_device *teedev) -+struct tee_context *teedev_open(struct tee_device *teedev) - { - int rc; - struct tee_context *ctx; -@@ -56,6 +56,7 @@ err: - return ERR_PTR(rc); - - } -+EXPORT_SYMBOL_GPL(teedev_open); - - void teedev_ctx_get(struct tee_context *ctx) - { -@@ -82,13 +83,14 @@ void teedev_ctx_put(struct tee_context *ctx) - kref_put(&ctx->refcount, teedev_ctx_release); - } - --static void teedev_close_context(struct tee_context *ctx) -+void teedev_close_context(struct tee_context *ctx) - { - struct tee_device *teedev = ctx->teedev; - - teedev_ctx_put(ctx); - tee_device_put(teedev); - } -+EXPORT_SYMBOL_GPL(teedev_close_context); - - static int tee_open(struct inode *inode, struct file *filp) - { -diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c -index 3d3d616e58989..f4fe73ce57108 100644 ---- a/drivers/tty/n_gsm.c -+++ b/drivers/tty/n_gsm.c -@@ -428,7 +428,7 @@ static u8 gsm_encode_modem(const struct gsm_dlci *dlci) - modembits |= MDM_RTR; - if (dlci->modem_tx & TIOCM_RI) - modembits |= MDM_IC; -- if (dlci->modem_tx & TIOCM_CD) -+ if (dlci->modem_tx & TIOCM_CD || dlci->gsm->initiator) - modembits |= MDM_DV; - return modembits; - } -@@ -1490,7 +1490,7 @@ static void gsm_dlci_t1(struct timer_list *t) - dlci->mode = DLCI_MODE_ADM; - gsm_dlci_open(dlci); - } else { -- gsm_dlci_close(dlci); -+ gsm_dlci_begin_close(dlci); /* prevent half open link */ - } - - break; -@@ -1722,7 +1722,12 @@ static void gsm_dlci_release(struct gsm_dlci *dlci) - gsm_destroy_network(dlci); - mutex_unlock(&dlci->mutex); - -- tty_hangup(tty); -+ /* We cannot use tty_hangup() because in tty_kref_put() the tty -+ * driver assumes that the hangup queue is free and reuses it to -+ * queue release_one_tty() -> NULL pointer panic in -+ * process_one_work(). -+ */ -+ tty_vhangup(tty); - - tty_port_tty_set(&dlci->port, NULL); - tty_kref_put(tty); -diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c -index 5a7c152c9ee39..99964f96ff747 100644 ---- a/drivers/usb/dwc3/dwc3-pci.c -+++ b/drivers/usb/dwc3/dwc3-pci.c -@@ -81,8 +81,8 @@ static const struct acpi_gpio_mapping acpi_dwc3_byt_gpios[] = { - static struct gpiod_lookup_table platform_bytcr_gpios = { - .dev_id = "0000:00:16.0", - .table = { -- GPIO_LOOKUP("INT33FC:00", 54, "reset", GPIO_ACTIVE_HIGH), -- GPIO_LOOKUP("INT33FC:02", 14, "cs", GPIO_ACTIVE_HIGH), -+ GPIO_LOOKUP("INT33FC:00", 54, "cs", GPIO_ACTIVE_HIGH), -+ GPIO_LOOKUP("INT33FC:02", 14, "reset", GPIO_ACTIVE_HIGH), - {} - }, - }; -diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c -index 2367bf5a13107..a1d8cb69d229d 100644 ---- a/drivers/usb/dwc3/gadget.c -+++ b/drivers/usb/dwc3/gadget.c -@@ -3529,9 +3529,11 @@ static irqreturn_t dwc3_thread_interrupt(int irq, void *_evt) - unsigned long flags; - irqreturn_t ret = IRQ_NONE; - -+ local_bh_disable(); - spin_lock_irqsave(&dwc->lock, flags); - ret = dwc3_process_event_buf(evt); - spin_unlock_irqrestore(&dwc->lock, flags); -+ local_bh_enable(); - - return ret; - } -diff --git a/drivers/usb/gadget/function/rndis.c b/drivers/usb/gadget/function/rndis.c -index ab827c1badc50..970ed1514f0bc 100644 ---- a/drivers/usb/gadget/function/rndis.c -+++ b/drivers/usb/gadget/function/rndis.c -@@ -922,6 +922,7 @@ struct rndis_params *rndis_register(void (*resp_avail)(void *v), void *v) - params->resp_avail = resp_avail; - params->v = v; - INIT_LIST_HEAD(¶ms->resp_queue); -+ spin_lock_init(¶ms->resp_lock); - pr_debug("%s: configNr = %d\n", __func__, i); - - return params; -@@ -1015,12 +1016,14 @@ void rndis_free_response(struct rndis_params *params, u8 *buf) - { - rndis_resp_t *r, *n; - -+ spin_lock(¶ms->resp_lock); - list_for_each_entry_safe(r, n, ¶ms->resp_queue, list) { - if (r->buf == buf) { - list_del(&r->list); - kfree(r); - } - } -+ spin_unlock(¶ms->resp_lock); - } - EXPORT_SYMBOL_GPL(rndis_free_response); - -@@ -1030,14 +1033,17 @@ u8 *rndis_get_next_response(struct rndis_params *params, u32 *length) - - if (!length) return NULL; - -+ spin_lock(¶ms->resp_lock); - list_for_each_entry_safe(r, n, ¶ms->resp_queue, list) { - if (!r->send) { - r->send = 1; - *length = r->length; -+ spin_unlock(¶ms->resp_lock); - return r->buf; - } - } - -+ spin_unlock(¶ms->resp_lock); - return NULL; - } - EXPORT_SYMBOL_GPL(rndis_get_next_response); -@@ -1054,7 +1060,9 @@ static rndis_resp_t *rndis_add_response(struct rndis_params *params, u32 length) - r->length = length; - r->send = 0; - -+ spin_lock(¶ms->resp_lock); - list_add_tail(&r->list, ¶ms->resp_queue); -+ spin_unlock(¶ms->resp_lock); - return r; - } - -diff --git a/drivers/usb/gadget/function/rndis.h b/drivers/usb/gadget/function/rndis.h -index c7e3a70ce6c1f..c996ba28bcb77 100644 ---- a/drivers/usb/gadget/function/rndis.h -+++ b/drivers/usb/gadget/function/rndis.h -@@ -174,6 +174,7 @@ typedef struct rndis_params { - void (*resp_avail)(void *v); - void *v; - struct list_head resp_queue; -+ spinlock_t resp_lock; - } rndis_params; - - /* RNDIS Message parser and other useless functions */ -diff --git a/drivers/usb/gadget/udc/udc-xilinx.c b/drivers/usb/gadget/udc/udc-xilinx.c -index 29d8e5f8bb583..de22dd5436538 100644 ---- a/drivers/usb/gadget/udc/udc-xilinx.c -+++ b/drivers/usb/gadget/udc/udc-xilinx.c -@@ -1613,6 +1613,8 @@ static void xudc_getstatus(struct xusb_udc *udc) - break; - case USB_RECIP_ENDPOINT: - epnum = udc->setup.wIndex & USB_ENDPOINT_NUMBER_MASK; -+ if (epnum >= XUSB_MAX_ENDPOINTS) -+ goto stall; - target_ep = &udc->ep[epnum]; - epcfgreg = udc->read_fn(udc->addr + target_ep->offset); - halt = epcfgreg & XUSB_EP_CFG_STALL_MASK; -@@ -1680,6 +1682,10 @@ static void xudc_set_clear_feature(struct xusb_udc *udc) - case USB_RECIP_ENDPOINT: - if (!udc->setup.wValue) { - endpoint = udc->setup.wIndex & USB_ENDPOINT_NUMBER_MASK; -+ if (endpoint >= XUSB_MAX_ENDPOINTS) { -+ xudc_ep0_stall(udc); -+ return; -+ } - target_ep = &udc->ep[endpoint]; - outinbit = udc->setup.wIndex & USB_ENDPOINT_DIR_MASK; - outinbit = outinbit >> 7; -diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c -index 1c8070023161f..8f029d44e9c9e 100644 ---- a/drivers/usb/host/xhci.c -+++ b/drivers/usb/host/xhci.c -@@ -1091,6 +1091,7 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated) - int retval = 0; - bool comp_timer_running = false; - bool pending_portevent = false; -+ bool reinit_xhc = false; - - if (!hcd->state) - return 0; -@@ -1107,10 +1108,11 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated) - set_bit(HCD_FLAG_HW_ACCESSIBLE, &xhci->shared_hcd->flags); - - spin_lock_irq(&xhci->lock); -- if ((xhci->quirks & XHCI_RESET_ON_RESUME) || xhci->broken_suspend) -- hibernated = true; - -- if (!hibernated) { -+ if (hibernated || xhci->quirks & XHCI_RESET_ON_RESUME || xhci->broken_suspend) -+ reinit_xhc = true; -+ -+ if (!reinit_xhc) { - /* - * Some controllers might lose power during suspend, so wait - * for controller not ready bit to clear, just as in xHC init. -@@ -1143,12 +1145,17 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated) - spin_unlock_irq(&xhci->lock); - return -ETIMEDOUT; - } -- temp = readl(&xhci->op_regs->status); - } - -- /* If restore operation fails, re-initialize the HC during resume */ -- if ((temp & STS_SRE) || hibernated) { -+ temp = readl(&xhci->op_regs->status); - -+ /* re-initialize the HC on Restore Error, or Host Controller Error */ -+ if (temp & (STS_SRE | STS_HCE)) { -+ reinit_xhc = true; -+ xhci_warn(xhci, "xHC error in resume, USBSTS 0x%x, Reinit\n", temp); -+ } -+ -+ if (reinit_xhc) { - if ((xhci->quirks & XHCI_COMP_MODE_QUIRK) && - !(xhci_all_ports_seen_u0(xhci))) { - del_timer_sync(&xhci->comp_mode_recovery_timer); -@@ -1480,9 +1487,12 @@ static int xhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag - struct urb_priv *urb_priv; - int num_tds; - -- if (!urb || xhci_check_args(hcd, urb->dev, urb->ep, -- true, true, __func__) <= 0) -+ if (!urb) - return -EINVAL; -+ ret = xhci_check_args(hcd, urb->dev, urb->ep, -+ true, true, __func__); -+ if (ret <= 0) -+ return ret ? ret : -EINVAL; - - slot_id = urb->dev->slot_id; - ep_index = xhci_get_endpoint_index(&urb->ep->desc); -@@ -3282,7 +3292,7 @@ static int xhci_check_streams_endpoint(struct xhci_hcd *xhci, - return -EINVAL; - ret = xhci_check_args(xhci_to_hcd(xhci), udev, ep, 1, true, __func__); - if (ret <= 0) -- return -EINVAL; -+ return ret ? ret : -EINVAL; - if (usb_ss_max_streams(&ep->ss_ep_comp) == 0) { - xhci_warn(xhci, "WARN: SuperSpeed Endpoint Companion" - " descriptor for ep 0x%x does not support streams\n", -diff --git a/drivers/usb/serial/ch341.c b/drivers/usb/serial/ch341.c -index a5c10fe9f72a1..f06a09e59d8ba 100644 ---- a/drivers/usb/serial/ch341.c -+++ b/drivers/usb/serial/ch341.c -@@ -80,7 +80,6 @@ - #define CH341_LCR_CS5 0x00 - - static const struct usb_device_id id_table[] = { -- { USB_DEVICE(0x1a86, 0x5512) }, - { USB_DEVICE(0x1a86, 0x5523) }, - { USB_DEVICE(0x1a86, 0x7522) }, - { USB_DEVICE(0x1a86, 0x7523) }, -diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c -index 81e7833910ca8..839eac04b5e30 100644 ---- a/drivers/usb/serial/option.c -+++ b/drivers/usb/serial/option.c -@@ -198,6 +198,8 @@ static void option_instat_callback(struct urb *urb); - - #define DELL_PRODUCT_5821E 0x81d7 - #define DELL_PRODUCT_5821E_ESIM 0x81e0 -+#define DELL_PRODUCT_5829E_ESIM 0x81e4 -+#define DELL_PRODUCT_5829E 0x81e6 - - #define KYOCERA_VENDOR_ID 0x0c88 - #define KYOCERA_PRODUCT_KPC650 0x17da -@@ -1063,6 +1065,10 @@ static const struct usb_device_id option_ids[] = { - .driver_info = RSVD(0) | RSVD(1) | RSVD(6) }, - { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5821E_ESIM), - .driver_info = RSVD(0) | RSVD(1) | RSVD(6) }, -+ { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5829E), -+ .driver_info = RSVD(0) | RSVD(6) }, -+ { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5829E_ESIM), -+ .driver_info = RSVD(0) | RSVD(6) }, - { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_E100A) }, /* ADU-E100, ADU-310 */ - { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_500A) }, - { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_620UW) }, -@@ -1273,10 +1279,16 @@ static const struct usb_device_id option_ids[] = { - .driver_info = NCTRL(2) }, - { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x7011, 0xff), /* Telit LE910-S1 (ECM) */ - .driver_info = NCTRL(2) }, -+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x701a, 0xff), /* Telit LE910R1 (RNDIS) */ -+ .driver_info = NCTRL(2) }, -+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x701b, 0xff), /* Telit LE910R1 (ECM) */ -+ .driver_info = NCTRL(2) }, - { USB_DEVICE(TELIT_VENDOR_ID, 0x9010), /* Telit SBL FN980 flashing device */ - .driver_info = NCTRL(0) | ZLP }, - { USB_DEVICE(TELIT_VENDOR_ID, 0x9200), /* Telit LE910S1 flashing device */ - .driver_info = NCTRL(0) | ZLP }, -+ { USB_DEVICE(TELIT_VENDOR_ID, 0x9201), /* Telit LE910R1 flashing device */ -+ .driver_info = NCTRL(0) | ZLP }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */ - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0002, 0xff, 0xff, 0xff), - .driver_info = RSVD(1) }, -diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c -index 2bf7cb01da9a3..308df62655dd2 100644 ---- a/drivers/vhost/vsock.c -+++ b/drivers/vhost/vsock.c -@@ -570,16 +570,18 @@ err: - return ret; - } - --static int vhost_vsock_stop(struct vhost_vsock *vsock) -+static int vhost_vsock_stop(struct vhost_vsock *vsock, bool check_owner) - { - size_t i; -- int ret; -+ int ret = 0; - - mutex_lock(&vsock->dev.mutex); - -- ret = vhost_dev_check_owner(&vsock->dev); -- if (ret) -- goto err; -+ if (check_owner) { -+ ret = vhost_dev_check_owner(&vsock->dev); -+ if (ret) -+ goto err; -+ } - - for (i = 0; i < ARRAY_SIZE(vsock->vqs); i++) { - struct vhost_virtqueue *vq = &vsock->vqs[i]; -@@ -694,7 +696,12 @@ static int vhost_vsock_dev_release(struct inode *inode, struct file *file) - * inefficient. Room for improvement here. */ - vsock_for_each_connected_socket(vhost_vsock_reset_orphans); - -- vhost_vsock_stop(vsock); -+ /* Don't check the owner, because we are in the release path, so we -+ * need to stop the vsock device in any case. -+ * vhost_vsock_stop() can not fail in this case, so we don't need to -+ * check the return code. -+ */ -+ vhost_vsock_stop(vsock, false); - vhost_vsock_flush(vsock); - vhost_dev_stop(&vsock->dev); - -@@ -792,7 +799,7 @@ static long vhost_vsock_dev_ioctl(struct file *f, unsigned int ioctl, - if (start) - return vhost_vsock_start(vsock); - else -- return vhost_vsock_stop(vsock); -+ return vhost_vsock_stop(vsock, true); - case VHOST_GET_FEATURES: - features = VHOST_VSOCK_FEATURES; - if (copy_to_user(argp, &features, sizeof(features))) -diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c -index 2992cebb78661..d73d88d9c2598 100644 ---- a/fs/configfs/dir.c -+++ b/fs/configfs/dir.c -@@ -36,6 +36,14 @@ - */ - DEFINE_SPINLOCK(configfs_dirent_lock); - -+/* -+ * All of link_obj/unlink_obj/link_group/unlink_group require that -+ * subsys->su_mutex is held. -+ * But parent configfs_subsystem is NULL when config_item is root. -+ * Use this mutex when config_item is root. -+ */ -+static DEFINE_MUTEX(configfs_subsystem_mutex); -+ - static void configfs_d_iput(struct dentry * dentry, - struct inode * inode) - { -@@ -1884,7 +1892,9 @@ int configfs_register_subsystem(struct configfs_subsystem *subsys) - group->cg_item.ci_name = group->cg_item.ci_namebuf; - - sd = root->d_fsdata; -+ mutex_lock(&configfs_subsystem_mutex); - link_group(to_config_group(sd->s_element), group); -+ mutex_unlock(&configfs_subsystem_mutex); - - inode_lock_nested(d_inode(root), I_MUTEX_PARENT); - -@@ -1909,7 +1919,9 @@ int configfs_register_subsystem(struct configfs_subsystem *subsys) - inode_unlock(d_inode(root)); - - if (err) { -+ mutex_lock(&configfs_subsystem_mutex); - unlink_group(group); -+ mutex_unlock(&configfs_subsystem_mutex); - configfs_release_fs(); - } - put_fragment(frag); -@@ -1956,7 +1968,9 @@ void configfs_unregister_subsystem(struct configfs_subsystem *subsys) - - dput(dentry); - -+ mutex_lock(&configfs_subsystem_mutex); - unlink_group(group); -+ mutex_unlock(&configfs_subsystem_mutex); - configfs_release_fs(); - } - -diff --git a/fs/file.c b/fs/file.c -index 09cefc944f86d..51f53a7dc2218 100644 ---- a/fs/file.c -+++ b/fs/file.c -@@ -706,28 +706,69 @@ void do_close_on_exec(struct files_struct *files) - spin_unlock(&files->file_lock); - } - --static struct file *__fget(unsigned int fd, fmode_t mask, unsigned int refs) -+static inline struct file *__fget_files_rcu(struct files_struct *files, -+ unsigned int fd, fmode_t mask, unsigned int refs) - { -- struct files_struct *files = current->files; -- struct file *file; -+ for (;;) { -+ struct file *file; -+ struct fdtable *fdt = rcu_dereference_raw(files->fdt); -+ struct file __rcu **fdentry; - -- rcu_read_lock(); --loop: -- file = fcheck_files(files, fd); -- if (file) { -- /* File object ref couldn't be taken. -- * dup2() atomicity guarantee is the reason -- * we loop to catch the new file (or NULL pointer) -+ if (unlikely(fd >= fdt->max_fds)) -+ return NULL; -+ -+ fdentry = fdt->fd + array_index_nospec(fd, fdt->max_fds); -+ file = rcu_dereference_raw(*fdentry); -+ if (unlikely(!file)) -+ return NULL; -+ -+ if (unlikely(file->f_mode & mask)) -+ return NULL; -+ -+ /* -+ * Ok, we have a file pointer. However, because we do -+ * this all locklessly under RCU, we may be racing with -+ * that file being closed. -+ * -+ * Such a race can take two forms: -+ * -+ * (a) the file ref already went down to zero, -+ * and get_file_rcu_many() fails. Just try -+ * again: -+ */ -+ if (unlikely(!get_file_rcu_many(file, refs))) -+ continue; -+ -+ /* -+ * (b) the file table entry has changed under us. -+ * Note that we don't need to re-check the 'fdt->fd' -+ * pointer having changed, because it always goes -+ * hand-in-hand with 'fdt'. -+ * -+ * If so, we need to put our refs and try again. - */ -- if (file->f_mode & mask) -- file = NULL; -- else if (!get_file_rcu_many(file, refs)) -- goto loop; -- else if (__fcheck_files(files, fd) != file) { -+ if (unlikely(rcu_dereference_raw(files->fdt) != fdt) || -+ unlikely(rcu_dereference_raw(*fdentry) != file)) { - fput_many(file, refs); -- goto loop; -+ continue; - } -+ -+ /* -+ * Ok, we have a ref to the file, and checked that it -+ * still exists. -+ */ -+ return file; - } -+} -+ -+ -+static struct file *__fget(unsigned int fd, fmode_t mask, unsigned int refs) -+{ -+ struct files_struct *files = current->files; -+ struct file *file; -+ -+ rcu_read_lock(); -+ file = __fget_files_rcu(files, fd, mask, refs); - rcu_read_unlock(); - - return file; -diff --git a/fs/tracefs/inode.c b/fs/tracefs/inode.c -index 3fdbbc7a9848e..7878f145bf1bf 100644 ---- a/fs/tracefs/inode.c -+++ b/fs/tracefs/inode.c -@@ -262,7 +262,6 @@ static int tracefs_parse_options(char *data, struct tracefs_mount_opts *opts) - if (!gid_valid(gid)) - return -EINVAL; - opts->gid = gid; -- set_gid(tracefs_mount->mnt_root, gid); - break; - case Opt_mode: - if (match_octal(&args[0], &option)) -@@ -289,7 +288,9 @@ static int tracefs_apply_options(struct super_block *sb) - inode->i_mode |= opts->mode; - - inode->i_uid = opts->uid; -- inode->i_gid = opts->gid; -+ -+ /* Set all the group ids to the mount option */ -+ set_gid(sb->s_root, opts->gid); - - return 0; - } -diff --git a/include/linux/tee_drv.h b/include/linux/tee_drv.h -index e08ace76eba6a..8868337e9445b 100644 ---- a/include/linux/tee_drv.h -+++ b/include/linux/tee_drv.h -@@ -579,4 +579,18 @@ struct tee_client_driver { - #define to_tee_client_driver(d) \ - container_of(d, struct tee_client_driver, driver) - -+/** -+ * teedev_open() - Open a struct tee_device -+ * @teedev: Device to open -+ * -+ * @return a pointer to struct tee_context on success or an ERR_PTR on failure. -+ */ -+struct tee_context *teedev_open(struct tee_device *teedev); -+ -+/** -+ * teedev_close_context() - closes a struct tee_context -+ * @ctx: The struct tee_context to close -+ */ -+void teedev_close_context(struct tee_context *ctx); -+ - #endif /*__TEE_DRV_H*/ -diff --git a/include/net/checksum.h b/include/net/checksum.h -index 97bf4885a962f..e13d5ecf71cdb 100644 ---- a/include/net/checksum.h -+++ b/include/net/checksum.h -@@ -22,7 +22,7 @@ - #include - - #ifndef _HAVE_ARCH_COPY_AND_CSUM_FROM_USER --static inline -+static __always_inline - __wsum csum_and_copy_from_user (const void __user *src, void *dst, - int len, __wsum sum, int *err_ptr) - { -@@ -37,7 +37,7 @@ __wsum csum_and_copy_from_user (const void __user *src, void *dst, - #endif - - #ifndef HAVE_CSUM_COPY_USER --static __inline__ __wsum csum_and_copy_to_user -+static __always_inline __wsum csum_and_copy_to_user - (const void *src, void __user *dst, int len, __wsum sum, int *err_ptr) - { - sum = csum_partial(src, len, sum); -@@ -54,7 +54,7 @@ static __inline__ __wsum csum_and_copy_to_user - #endif - - #ifndef HAVE_ARCH_CSUM_ADD --static inline __wsum csum_add(__wsum csum, __wsum addend) -+static __always_inline __wsum csum_add(__wsum csum, __wsum addend) - { - u32 res = (__force u32)csum; - res += (__force u32)addend; -@@ -62,12 +62,12 @@ static inline __wsum csum_add(__wsum csum, __wsum addend) - } - #endif - --static inline __wsum csum_sub(__wsum csum, __wsum addend) -+static __always_inline __wsum csum_sub(__wsum csum, __wsum addend) - { - return csum_add(csum, ~addend); - } - --static inline __sum16 csum16_add(__sum16 csum, __be16 addend) -+static __always_inline __sum16 csum16_add(__sum16 csum, __be16 addend) - { - u16 res = (__force u16)csum; - -@@ -75,12 +75,12 @@ static inline __sum16 csum16_add(__sum16 csum, __be16 addend) - return (__force __sum16)(res + (res < (__force u16)addend)); - } - --static inline __sum16 csum16_sub(__sum16 csum, __be16 addend) -+static __always_inline __sum16 csum16_sub(__sum16 csum, __be16 addend) - { - return csum16_add(csum, ~addend); - } - --static inline __wsum -+static __always_inline __wsum - csum_block_add(__wsum csum, __wsum csum2, int offset) - { - u32 sum = (__force u32)csum2; -@@ -92,36 +92,37 @@ csum_block_add(__wsum csum, __wsum csum2, int offset) - return csum_add(csum, (__force __wsum)sum); - } - --static inline __wsum -+static __always_inline __wsum - csum_block_add_ext(__wsum csum, __wsum csum2, int offset, int len) - { - return csum_block_add(csum, csum2, offset); - } - --static inline __wsum -+static __always_inline __wsum - csum_block_sub(__wsum csum, __wsum csum2, int offset) - { - return csum_block_add(csum, ~csum2, offset); - } - --static inline __wsum csum_unfold(__sum16 n) -+static __always_inline __wsum csum_unfold(__sum16 n) - { - return (__force __wsum)n; - } - --static inline __wsum csum_partial_ext(const void *buff, int len, __wsum sum) -+static __always_inline -+__wsum csum_partial_ext(const void *buff, int len, __wsum sum) - { - return csum_partial(buff, len, sum); - } - - #define CSUM_MANGLED_0 ((__force __sum16)0xffff) - --static inline void csum_replace_by_diff(__sum16 *sum, __wsum diff) -+static __always_inline void csum_replace_by_diff(__sum16 *sum, __wsum diff) - { - *sum = csum_fold(csum_add(diff, ~csum_unfold(*sum))); - } - --static inline void csum_replace4(__sum16 *sum, __be32 from, __be32 to) -+static __always_inline void csum_replace4(__sum16 *sum, __be32 from, __be32 to) - { - __wsum tmp = csum_sub(~csum_unfold(*sum), (__force __wsum)from); - -@@ -134,11 +135,16 @@ static inline void csum_replace4(__sum16 *sum, __be32 from, __be32 to) - * m : old value of a 16bit field - * m' : new value of a 16bit field - */ --static inline void csum_replace2(__sum16 *sum, __be16 old, __be16 new) -+static __always_inline void csum_replace2(__sum16 *sum, __be16 old, __be16 new) - { - *sum = ~csum16_add(csum16_sub(~(*sum), old), new); - } - -+static inline void csum_replace(__wsum *csum, __wsum old, __wsum new) -+{ -+ *csum = csum_add(csum_sub(*csum, old), new); -+} -+ - struct sk_buff; - void inet_proto_csum_replace4(__sum16 *sum, struct sk_buff *skb, - __be32 from, __be32 to, bool pseudohdr); -@@ -148,16 +154,16 @@ void inet_proto_csum_replace16(__sum16 *sum, struct sk_buff *skb, - void inet_proto_csum_replace_by_diff(__sum16 *sum, struct sk_buff *skb, - __wsum diff, bool pseudohdr); - --static inline void inet_proto_csum_replace2(__sum16 *sum, struct sk_buff *skb, -- __be16 from, __be16 to, -- bool pseudohdr) -+static __always_inline -+void inet_proto_csum_replace2(__sum16 *sum, struct sk_buff *skb, -+ __be16 from, __be16 to, bool pseudohdr) - { - inet_proto_csum_replace4(sum, skb, (__force __be32)from, - (__force __be32)to, pseudohdr); - } - --static inline __wsum remcsum_adjust(void *ptr, __wsum csum, -- int start, int offset) -+static __always_inline __wsum remcsum_adjust(void *ptr, __wsum csum, -+ int start, int offset) - { - __sum16 *psum = (__sum16 *)(ptr + offset); - __wsum delta; -@@ -173,7 +179,7 @@ static inline __wsum remcsum_adjust(void *ptr, __wsum csum, - return delta; - } - --static inline void remcsum_unadjust(__sum16 *psum, __wsum delta) -+static __always_inline void remcsum_unadjust(__sum16 *psum, __wsum delta) - { - *psum = csum_fold(csum_sub(delta, (__force __wsum)*psum)); - } -diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h -index f694f08ad635b..886866bee8b27 100644 ---- a/include/net/netfilter/nf_tables.h -+++ b/include/net/netfilter/nf_tables.h -@@ -805,7 +805,7 @@ struct nft_expr_ops { - int (*offload)(struct nft_offload_ctx *ctx, - struct nft_flow_rule *flow, - const struct nft_expr *expr); -- u32 offload_flags; -+ bool (*offload_action)(const struct nft_expr *expr); - const struct nft_expr_type *type; - void *data; - }; -diff --git a/include/net/netfilter/nf_tables_offload.h b/include/net/netfilter/nf_tables_offload.h -index d0bb9e3bcec1c..a9989ca6e5af7 100644 ---- a/include/net/netfilter/nf_tables_offload.h -+++ b/include/net/netfilter/nf_tables_offload.h -@@ -60,8 +60,6 @@ struct nft_flow_rule { - struct flow_rule *rule; - }; - --#define NFT_OFFLOAD_F_ACTION (1 << 0) -- - void nft_flow_rule_set_addr_type(struct nft_flow_rule *flow, - enum flow_dissector_key_id addr_type); - -diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c -index ad9dffed8411d..3674798ade1fc 100644 ---- a/kernel/cgroup/cpuset.c -+++ b/kernel/cgroup/cpuset.c -@@ -2204,6 +2204,7 @@ static void cpuset_attach(struct cgroup_taskset *tset) - cgroup_taskset_first(tset, &css); - cs = css_cs(css); - -+ cpus_read_lock(); - percpu_down_write(&cpuset_rwsem); - - /* prepare for attach */ -@@ -2259,6 +2260,7 @@ static void cpuset_attach(struct cgroup_taskset *tset) - wake_up(&cpuset_attach_wq); - - percpu_up_write(&cpuset_rwsem); -+ cpus_read_unlock(); - } - - /* The various types of files and directories in a cpuset file system */ -diff --git a/kernel/trace/trace_events_trigger.c b/kernel/trace/trace_events_trigger.c -index e913d41a41949..3105dbf6c0e96 100644 ---- a/kernel/trace/trace_events_trigger.c -+++ b/kernel/trace/trace_events_trigger.c -@@ -940,6 +940,16 @@ static void - traceon_trigger(struct event_trigger_data *data, void *rec, - struct ring_buffer_event *event) - { -+ struct trace_event_file *file = data->private_data; -+ -+ if (file) { -+ if (tracer_tracing_is_on(file->tr)) -+ return; -+ -+ tracer_tracing_on(file->tr); -+ return; -+ } -+ - if (tracing_is_on()) - return; - -@@ -950,8 +960,15 @@ static void - traceon_count_trigger(struct event_trigger_data *data, void *rec, - struct ring_buffer_event *event) - { -- if (tracing_is_on()) -- return; -+ struct trace_event_file *file = data->private_data; -+ -+ if (file) { -+ if (tracer_tracing_is_on(file->tr)) -+ return; -+ } else { -+ if (tracing_is_on()) -+ return; -+ } - - if (!data->count) - return; -@@ -959,13 +976,26 @@ traceon_count_trigger(struct event_trigger_data *data, void *rec, - if (data->count != -1) - (data->count)--; - -- tracing_on(); -+ if (file) -+ tracer_tracing_on(file->tr); -+ else -+ tracing_on(); - } - - static void - traceoff_trigger(struct event_trigger_data *data, void *rec, - struct ring_buffer_event *event) - { -+ struct trace_event_file *file = data->private_data; -+ -+ if (file) { -+ if (!tracer_tracing_is_on(file->tr)) -+ return; -+ -+ tracer_tracing_off(file->tr); -+ return; -+ } -+ - if (!tracing_is_on()) - return; - -@@ -976,8 +1006,15 @@ static void - traceoff_count_trigger(struct event_trigger_data *data, void *rec, - struct ring_buffer_event *event) - { -- if (!tracing_is_on()) -- return; -+ struct trace_event_file *file = data->private_data; -+ -+ if (file) { -+ if (!tracer_tracing_is_on(file->tr)) -+ return; -+ } else { -+ if (!tracing_is_on()) -+ return; -+ } - - if (!data->count) - return; -@@ -985,7 +1022,10 @@ traceoff_count_trigger(struct event_trigger_data *data, void *rec, - if (data->count != -1) - (data->count)--; - -- tracing_off(); -+ if (file) -+ tracer_tracing_off(file->tr); -+ else -+ tracing_off(); - } - - static int -diff --git a/mm/memblock.c b/mm/memblock.c -index 38cef8b6df050..a75cc65f03307 100644 ---- a/mm/memblock.c -+++ b/mm/memblock.c -@@ -348,14 +348,20 @@ void __init memblock_discard(void) - addr = __pa(memblock.reserved.regions); - size = PAGE_ALIGN(sizeof(struct memblock_region) * - memblock.reserved.max); -- __memblock_free_late(addr, size); -+ if (memblock_reserved_in_slab) -+ kfree(memblock.reserved.regions); -+ else -+ __memblock_free_late(addr, size); - } - - if (memblock.memory.regions != memblock_memory_init_regions) { - addr = __pa(memblock.memory.regions); - size = PAGE_ALIGN(sizeof(struct memblock_region) * - memblock.memory.max); -- __memblock_free_late(addr, size); -+ if (memblock_memory_in_slab) -+ kfree(memblock.memory.regions); -+ else -+ __memblock_free_late(addr, size); - } - } - #endif -diff --git a/net/core/filter.c b/net/core/filter.c -index 92ce4d46f02e4..d39518f691b4b 100644 ---- a/net/core/filter.c -+++ b/net/core/filter.c -@@ -2516,6 +2516,9 @@ BPF_CALL_4(bpf_msg_pop_data, struct sk_msg *, msg, u32, start, - if (unlikely(flags)) - return -EINVAL; - -+ if (unlikely(len == 0)) -+ return 0; -+ - /* First find the starting scatterlist element */ - i = msg->sg.start; - do { -diff --git a/net/core/skbuff.c b/net/core/skbuff.c -index ac083685214e0..5bdb3cd20d619 100644 ---- a/net/core/skbuff.c -+++ b/net/core/skbuff.c -@@ -2139,7 +2139,7 @@ void *__pskb_pull_tail(struct sk_buff *skb, int delta) - /* Free pulled out fragments. */ - while ((list = skb_shinfo(skb)->frag_list) != insp) { - skb_shinfo(skb)->frag_list = list->next; -- kfree_skb(list); -+ consume_skb(list); - } - /* And insert new clone at head. */ - if (clone) { -@@ -5846,7 +5846,7 @@ static int pskb_carve_frag_list(struct sk_buff *skb, - /* Free pulled out fragments. */ - while ((list = shinfo->frag_list) != insp) { - shinfo->frag_list = list->next; -- kfree_skb(list); -+ consume_skb(list); - } - /* And insert new clone at head. */ - if (clone) { -diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c -index c800220c404d5..a7a6b1adb698b 100644 ---- a/net/ipv4/af_inet.c -+++ b/net/ipv4/af_inet.c -@@ -1344,8 +1344,11 @@ struct sk_buff *inet_gso_segment(struct sk_buff *skb, - } - - ops = rcu_dereference(inet_offloads[proto]); -- if (likely(ops && ops->callbacks.gso_segment)) -+ if (likely(ops && ops->callbacks.gso_segment)) { - segs = ops->callbacks.gso_segment(skb, features); -+ if (!segs) -+ skb->network_header = skb_mac_header(skb) + nhoff - skb->head; -+ } - - if (IS_ERR_OR_NULL(segs)) - goto out; -diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c -index 2a359d0dfe7e8..33e6392e8b820 100644 ---- a/net/ipv4/ping.c -+++ b/net/ipv4/ping.c -@@ -187,7 +187,6 @@ static struct sock *ping_lookup(struct net *net, struct sk_buff *skb, u16 ident) - (int)ident, &ipv6_hdr(skb)->daddr, dif); - #endif - } else { -- pr_err("ping: protocol(%x) is not supported\n", ntohs(skb->protocol)); - return NULL; - } - -diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c -index 7fbb44736a34b..b7b4ba68f3a20 100644 ---- a/net/ipv6/ip6_offload.c -+++ b/net/ipv6/ip6_offload.c -@@ -111,6 +111,8 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb, - if (likely(ops && ops->callbacks.gso_segment)) { - skb_reset_transport_header(skb); - segs = ops->callbacks.gso_segment(skb, features); -+ if (!segs) -+ skb->network_header = skb_mac_header(skb) + nhoff - skb->head; - } - - if (IS_ERR_OR_NULL(segs)) -diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c -index 373ea0e49f12d..545da270e8020 100644 ---- a/net/netfilter/nf_tables_api.c -+++ b/net/netfilter/nf_tables_api.c -@@ -5184,12 +5184,15 @@ static int nf_tables_updobj(const struct nft_ctx *ctx, - { - struct nft_object *newobj; - struct nft_trans *trans; -- int err; -+ int err = -ENOMEM; -+ -+ if (!try_module_get(type->owner)) -+ return -ENOENT; - - trans = nft_trans_alloc(ctx, NFT_MSG_NEWOBJ, - sizeof(struct nft_trans_obj)); - if (!trans) -- return -ENOMEM; -+ goto err_trans; - - newobj = nft_obj_init(ctx, type, attr); - if (IS_ERR(newobj)) { -@@ -5206,6 +5209,8 @@ static int nf_tables_updobj(const struct nft_ctx *ctx, - - err_free_trans: - kfree(trans); -+err_trans: -+ module_put(type->owner); - return err; - } - -@@ -6544,7 +6549,7 @@ static void nft_obj_commit_update(struct nft_trans *trans) - if (obj->ops->update) - obj->ops->update(obj, newobj); - -- kfree(newobj); -+ nft_obj_destroy(&trans->ctx, newobj); - } - - static void nft_commit_release(struct nft_trans *trans) -@@ -7109,7 +7114,7 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action) - break; - case NFT_MSG_NEWOBJ: - if (nft_trans_obj_update(trans)) { -- kfree(nft_trans_obj_newobj(trans)); -+ nft_obj_destroy(&trans->ctx, nft_trans_obj_newobj(trans)); - nft_trans_destroy(trans); - } else { - trans->ctx.table->use--; -diff --git a/net/netfilter/nf_tables_offload.c b/net/netfilter/nf_tables_offload.c -index 3aa4306ca39f6..2d3bc22c855c7 100644 ---- a/net/netfilter/nf_tables_offload.c -+++ b/net/netfilter/nf_tables_offload.c -@@ -55,7 +55,8 @@ struct nft_flow_rule *nft_flow_rule_create(struct net *net, - - expr = nft_expr_first(rule); - while (nft_expr_more(rule, expr)) { -- if (expr->ops->offload_flags & NFT_OFFLOAD_F_ACTION) -+ if (expr->ops->offload_action && -+ expr->ops->offload_action(expr)) - num_actions++; - - expr = nft_expr_next(expr); -diff --git a/net/netfilter/nft_dup_netdev.c b/net/netfilter/nft_dup_netdev.c -index c2e78c160fd7c..6007089e1c2f7 100644 ---- a/net/netfilter/nft_dup_netdev.c -+++ b/net/netfilter/nft_dup_netdev.c -@@ -67,6 +67,11 @@ static int nft_dup_netdev_offload(struct nft_offload_ctx *ctx, - return nft_fwd_dup_netdev_offload(ctx, flow, FLOW_ACTION_MIRRED, oif); - } - -+static bool nft_dup_netdev_offload_action(const struct nft_expr *expr) -+{ -+ return true; -+} -+ - static struct nft_expr_type nft_dup_netdev_type; - static const struct nft_expr_ops nft_dup_netdev_ops = { - .type = &nft_dup_netdev_type, -@@ -75,6 +80,7 @@ static const struct nft_expr_ops nft_dup_netdev_ops = { - .init = nft_dup_netdev_init, - .dump = nft_dup_netdev_dump, - .offload = nft_dup_netdev_offload, -+ .offload_action = nft_dup_netdev_offload_action, - }; - - static struct nft_expr_type nft_dup_netdev_type __read_mostly = { -diff --git a/net/netfilter/nft_fwd_netdev.c b/net/netfilter/nft_fwd_netdev.c -index b77985986b24e..3b0dcd170551b 100644 ---- a/net/netfilter/nft_fwd_netdev.c -+++ b/net/netfilter/nft_fwd_netdev.c -@@ -77,6 +77,11 @@ static int nft_fwd_netdev_offload(struct nft_offload_ctx *ctx, - return nft_fwd_dup_netdev_offload(ctx, flow, FLOW_ACTION_REDIRECT, oif); - } - -+static bool nft_fwd_netdev_offload_action(const struct nft_expr *expr) -+{ -+ return true; -+} -+ - struct nft_fwd_neigh { - enum nft_registers sreg_dev:8; - enum nft_registers sreg_addr:8; -@@ -219,6 +224,7 @@ static const struct nft_expr_ops nft_fwd_netdev_ops = { - .dump = nft_fwd_netdev_dump, - .validate = nft_fwd_validate, - .offload = nft_fwd_netdev_offload, -+ .offload_action = nft_fwd_netdev_offload_action, - }; - - static const struct nft_expr_ops * -diff --git a/net/netfilter/nft_immediate.c b/net/netfilter/nft_immediate.c -index c7f0ef73d9397..98a8149be094b 100644 ---- a/net/netfilter/nft_immediate.c -+++ b/net/netfilter/nft_immediate.c -@@ -163,6 +163,16 @@ static int nft_immediate_offload(struct nft_offload_ctx *ctx, - return 0; - } - -+static bool nft_immediate_offload_action(const struct nft_expr *expr) -+{ -+ const struct nft_immediate_expr *priv = nft_expr_priv(expr); -+ -+ if (priv->dreg == NFT_REG_VERDICT) -+ return true; -+ -+ return false; -+} -+ - static const struct nft_expr_ops nft_imm_ops = { - .type = &nft_imm_type, - .size = NFT_EXPR_SIZE(sizeof(struct nft_immediate_expr)), -@@ -173,7 +183,7 @@ static const struct nft_expr_ops nft_imm_ops = { - .dump = nft_immediate_dump, - .validate = nft_immediate_validate, - .offload = nft_immediate_offload, -- .offload_flags = NFT_OFFLOAD_F_ACTION, -+ .offload_action = nft_immediate_offload_action, - }; - - struct nft_expr_type nft_imm_type __read_mostly = { -diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c -index 5c68f9ea98810..2c0f8cbc5c43b 100644 ---- a/net/openvswitch/actions.c -+++ b/net/openvswitch/actions.c -@@ -427,12 +427,43 @@ static void set_ipv6_addr(struct sk_buff *skb, u8 l4_proto, - memcpy(addr, new_addr, sizeof(__be32[4])); - } - --static void set_ipv6_fl(struct ipv6hdr *nh, u32 fl, u32 mask) -+static void set_ipv6_dsfield(struct sk_buff *skb, struct ipv6hdr *nh, u8 ipv6_tclass, u8 mask) - { -+ u8 old_ipv6_tclass = ipv6_get_dsfield(nh); -+ -+ ipv6_tclass = OVS_MASKED(old_ipv6_tclass, ipv6_tclass, mask); -+ -+ if (skb->ip_summed == CHECKSUM_COMPLETE) -+ csum_replace(&skb->csum, (__force __wsum)(old_ipv6_tclass << 12), -+ (__force __wsum)(ipv6_tclass << 12)); -+ -+ ipv6_change_dsfield(nh, ~mask, ipv6_tclass); -+} -+ -+static void set_ipv6_fl(struct sk_buff *skb, struct ipv6hdr *nh, u32 fl, u32 mask) -+{ -+ u32 ofl; -+ -+ ofl = nh->flow_lbl[0] << 16 | nh->flow_lbl[1] << 8 | nh->flow_lbl[2]; -+ fl = OVS_MASKED(ofl, fl, mask); -+ - /* Bits 21-24 are always unmasked, so this retains their values. */ -- OVS_SET_MASKED(nh->flow_lbl[0], (u8)(fl >> 16), (u8)(mask >> 16)); -- OVS_SET_MASKED(nh->flow_lbl[1], (u8)(fl >> 8), (u8)(mask >> 8)); -- OVS_SET_MASKED(nh->flow_lbl[2], (u8)fl, (u8)mask); -+ nh->flow_lbl[0] = (u8)(fl >> 16); -+ nh->flow_lbl[1] = (u8)(fl >> 8); -+ nh->flow_lbl[2] = (u8)fl; -+ -+ if (skb->ip_summed == CHECKSUM_COMPLETE) -+ csum_replace(&skb->csum, (__force __wsum)htonl(ofl), (__force __wsum)htonl(fl)); -+} -+ -+static void set_ipv6_ttl(struct sk_buff *skb, struct ipv6hdr *nh, u8 new_ttl, u8 mask) -+{ -+ new_ttl = OVS_MASKED(nh->hop_limit, new_ttl, mask); -+ -+ if (skb->ip_summed == CHECKSUM_COMPLETE) -+ csum_replace(&skb->csum, (__force __wsum)(nh->hop_limit << 8), -+ (__force __wsum)(new_ttl << 8)); -+ nh->hop_limit = new_ttl; - } - - static void set_ip_ttl(struct sk_buff *skb, struct iphdr *nh, u8 new_ttl, -@@ -550,18 +581,17 @@ static int set_ipv6(struct sk_buff *skb, struct sw_flow_key *flow_key, - } - } - if (mask->ipv6_tclass) { -- ipv6_change_dsfield(nh, ~mask->ipv6_tclass, key->ipv6_tclass); -+ set_ipv6_dsfield(skb, nh, key->ipv6_tclass, mask->ipv6_tclass); - flow_key->ip.tos = ipv6_get_dsfield(nh); - } - if (mask->ipv6_label) { -- set_ipv6_fl(nh, ntohl(key->ipv6_label), -+ set_ipv6_fl(skb, nh, ntohl(key->ipv6_label), - ntohl(mask->ipv6_label)); - flow_key->ipv6.label = - *(__be32 *)nh & htonl(IPV6_FLOWINFO_FLOWLABEL); - } - if (mask->ipv6_hlimit) { -- OVS_SET_MASKED(nh->hop_limit, key->ipv6_hlimit, -- mask->ipv6_hlimit); -+ set_ipv6_ttl(skb, nh, key->ipv6_hlimit, mask->ipv6_hlimit); - flow_key->ip.ttl = nh->hop_limit; - } - return 0; -diff --git a/net/tipc/name_table.c b/net/tipc/name_table.c -index 66a65c2cdb23c..c52083522b28e 100644 ---- a/net/tipc/name_table.c -+++ b/net/tipc/name_table.c -@@ -812,7 +812,7 @@ static int __tipc_nl_add_nametable_publ(struct tipc_nl_msg *msg, - list_for_each_entry(p, &sr->all_publ, all_publ) - if (p->key == *last_key) - break; -- if (p->key != *last_key) -+ if (list_entry_is_head(p, &sr->all_publ, all_publ)) - return -EPIPE; - } else { - p = list_first_entry(&sr->all_publ, -diff --git a/net/tipc/socket.c b/net/tipc/socket.c -index fbbac9ba2862f..f4217673eee70 100644 ---- a/net/tipc/socket.c -+++ b/net/tipc/socket.c -@@ -3590,7 +3590,7 @@ static int __tipc_nl_list_sk_publ(struct sk_buff *skb, - if (p->key == *last_publ) - break; - } -- if (p->key != *last_publ) { -+ if (list_entry_is_head(p, &tsk->publications, binding_sock)) { - /* We never set seq or call nl_dump_check_consistent() - * this means that setting prev_seq here will cause the - * consistence check to fail in the netlink callback -diff --git a/tools/perf/util/data.c b/tools/perf/util/data.c -index a3f912615690f..3c874f52f1a25 100644 ---- a/tools/perf/util/data.c -+++ b/tools/perf/util/data.c -@@ -44,10 +44,6 @@ int perf_data__create_dir(struct perf_data *data, int nr) - if (!files) - return -ENOMEM; - -- data->dir.version = PERF_DIR_VERSION; -- data->dir.files = files; -- data->dir.nr = nr; -- - for (i = 0; i < nr; i++) { - struct perf_data_file *file = &files[i]; - -@@ -62,6 +58,9 @@ int perf_data__create_dir(struct perf_data *data, int nr) - file->fd = ret; - } - -+ data->dir.version = PERF_DIR_VERSION; -+ data->dir.files = files; -+ data->dir.nr = nr; - return 0; - - out_err: diff --git a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.182-183.patch b/patch/kernel/archive/odroidxu4-5.4/patch-5.4.182-183.patch deleted file mode 100644 index e90cad92e..000000000 --- a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.182-183.patch +++ /dev/null @@ -1,1981 +0,0 @@ -diff --git a/Makefile b/Makefile -index 8750309fc42ac..a94b5ea499e13 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 5 - PATCHLEVEL = 4 --SUBLEVEL = 182 -+SUBLEVEL = 183 - EXTRAVERSION = - NAME = Kleptomaniac Octopus - -diff --git a/arch/arm/kernel/kgdb.c b/arch/arm/kernel/kgdb.c -index 6a95b92966406..183a6f2f165ad 100644 ---- a/arch/arm/kernel/kgdb.c -+++ b/arch/arm/kernel/kgdb.c -@@ -154,22 +154,38 @@ static int kgdb_compiled_brk_fn(struct pt_regs *regs, unsigned int instr) - return 0; - } - --static struct undef_hook kgdb_brkpt_hook = { -+static struct undef_hook kgdb_brkpt_arm_hook = { - .instr_mask = 0xffffffff, - .instr_val = KGDB_BREAKINST, -- .cpsr_mask = MODE_MASK, -+ .cpsr_mask = PSR_T_BIT | MODE_MASK, - .cpsr_val = SVC_MODE, - .fn = kgdb_brk_fn - }; - --static struct undef_hook kgdb_compiled_brkpt_hook = { -+static struct undef_hook kgdb_brkpt_thumb_hook = { -+ .instr_mask = 0xffff, -+ .instr_val = KGDB_BREAKINST & 0xffff, -+ .cpsr_mask = PSR_T_BIT | MODE_MASK, -+ .cpsr_val = PSR_T_BIT | SVC_MODE, -+ .fn = kgdb_brk_fn -+}; -+ -+static struct undef_hook kgdb_compiled_brkpt_arm_hook = { - .instr_mask = 0xffffffff, - .instr_val = KGDB_COMPILED_BREAK, -- .cpsr_mask = MODE_MASK, -+ .cpsr_mask = PSR_T_BIT | MODE_MASK, - .cpsr_val = SVC_MODE, - .fn = kgdb_compiled_brk_fn - }; - -+static struct undef_hook kgdb_compiled_brkpt_thumb_hook = { -+ .instr_mask = 0xffff, -+ .instr_val = KGDB_COMPILED_BREAK & 0xffff, -+ .cpsr_mask = PSR_T_BIT | MODE_MASK, -+ .cpsr_val = PSR_T_BIT | SVC_MODE, -+ .fn = kgdb_compiled_brk_fn -+}; -+ - static int __kgdb_notify(struct die_args *args, unsigned long cmd) - { - struct pt_regs *regs = args->regs; -@@ -210,8 +226,10 @@ int kgdb_arch_init(void) - if (ret != 0) - return ret; - -- register_undef_hook(&kgdb_brkpt_hook); -- register_undef_hook(&kgdb_compiled_brkpt_hook); -+ register_undef_hook(&kgdb_brkpt_arm_hook); -+ register_undef_hook(&kgdb_brkpt_thumb_hook); -+ register_undef_hook(&kgdb_compiled_brkpt_arm_hook); -+ register_undef_hook(&kgdb_compiled_brkpt_thumb_hook); - - return 0; - } -@@ -224,8 +242,10 @@ int kgdb_arch_init(void) - */ - void kgdb_arch_exit(void) - { -- unregister_undef_hook(&kgdb_brkpt_hook); -- unregister_undef_hook(&kgdb_compiled_brkpt_hook); -+ unregister_undef_hook(&kgdb_brkpt_arm_hook); -+ unregister_undef_hook(&kgdb_brkpt_thumb_hook); -+ unregister_undef_hook(&kgdb_compiled_brkpt_arm_hook); -+ unregister_undef_hook(&kgdb_compiled_brkpt_thumb_hook); - unregister_die_notifier(&kgdb_notifier); - } - -diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c -index 538d5da741b09..6e7f841f67ff1 100644 ---- a/arch/arm/mm/mmu.c -+++ b/arch/arm/mm/mmu.c -@@ -229,12 +229,14 @@ early_param("ecc", early_ecc); - static int __init early_cachepolicy(char *p) - { - pr_warn("cachepolicy kernel parameter not supported without cp15\n"); -+ return 0; - } - early_param("cachepolicy", early_cachepolicy); - - static int __init noalign_setup(char *__unused) - { - pr_warn("noalign kernel parameter not supported without cp15\n"); -+ return 1; - } - __setup("noalign", noalign_setup); - -diff --git a/arch/arm64/boot/dts/rockchip/rk3399-gru.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-gru.dtsi -index dd5624975c9b4..b7e7bb3517c03 100644 ---- a/arch/arm64/boot/dts/rockchip/rk3399-gru.dtsi -+++ b/arch/arm64/boot/dts/rockchip/rk3399-gru.dtsi -@@ -281,7 +281,7 @@ - - sound: sound { - compatible = "rockchip,rk3399-gru-sound"; -- rockchip,cpu = <&i2s0 &i2s2>; -+ rockchip,cpu = <&i2s0 &spdif>; - }; - }; - -@@ -432,10 +432,6 @@ ap_i2c_audio: &i2c8 { - status = "okay"; - }; - --&i2s2 { -- status = "okay"; --}; -- - &io_domains { - status = "okay"; - -@@ -532,6 +528,17 @@ ap_i2c_audio: &i2c8 { - vqmmc-supply = <&ppvar_sd_card_io>; - }; - -+&spdif { -+ status = "okay"; -+ -+ /* -+ * SPDIF is routed internally to DP; we either don't use these pins, or -+ * mux them to something else. -+ */ -+ /delete-property/ pinctrl-0; -+ /delete-property/ pinctrl-names; -+}; -+ - &spi1 { - status = "okay"; - -diff --git a/arch/ia64/kernel/acpi.c b/arch/ia64/kernel/acpi.c -index 70d1587ddcd46..361b109933725 100644 ---- a/arch/ia64/kernel/acpi.c -+++ b/arch/ia64/kernel/acpi.c -@@ -448,7 +448,8 @@ void __init acpi_numa_fixup(void) - if (srat_num_cpus == 0) { - node_set_online(0); - node_cpuid[0].phys_id = hard_smp_processor_id(); -- return; -+ slit_distance(0, 0) = LOCAL_DISTANCE; -+ goto out; - } - - /* -@@ -491,7 +492,7 @@ void __init acpi_numa_fixup(void) - for (j = 0; j < MAX_NUMNODES; j++) - slit_distance(i, j) = i == j ? - LOCAL_DISTANCE : REMOTE_DISTANCE; -- return; -+ goto out; - } - - memset(numa_slit, -1, sizeof(numa_slit)); -@@ -516,6 +517,8 @@ void __init acpi_numa_fixup(void) - printk("\n"); - } - #endif -+out: -+ node_possible_map = node_online_map; - } - #endif /* CONFIG_ACPI_NUMA */ - -diff --git a/block/blk-flush.c b/block/blk-flush.c -index 5aa6fada22598..f66ff16855310 100644 ---- a/block/blk-flush.c -+++ b/block/blk-flush.c -@@ -222,8 +222,10 @@ static void flush_end_io(struct request *flush_rq, blk_status_t error) - return; - } - -- if (fq->rq_status != BLK_STS_OK) -+ if (fq->rq_status != BLK_STS_OK) { - error = fq->rq_status; -+ fq->rq_status = BLK_STS_OK; -+ } - - hctx = flush_rq->mq_hctx; - if (!q->elevator) { -diff --git a/drivers/ata/pata_hpt37x.c b/drivers/ata/pata_hpt37x.c -index 499a947d56ddb..fef46de2f6b23 100644 ---- a/drivers/ata/pata_hpt37x.c -+++ b/drivers/ata/pata_hpt37x.c -@@ -962,14 +962,14 @@ static int hpt37x_init_one(struct pci_dev *dev, const struct pci_device_id *id) - - if ((freq >> 12) != 0xABCDE) { - int i; -- u8 sr; -+ u16 sr; - u32 total = 0; - - pr_warn("BIOS has not set timing clocks\n"); - - /* This is the process the HPT371 BIOS is reported to use */ - for (i = 0; i < 128; i++) { -- pci_read_config_byte(dev, 0x78, &sr); -+ pci_read_config_word(dev, 0x78, &sr); - total += sr & 0x1FF; - udelay(15); - } -diff --git a/drivers/dma/sh/shdma-base.c b/drivers/dma/sh/shdma-base.c -index c51de498b5b4b..19eee3d0900b0 100644 ---- a/drivers/dma/sh/shdma-base.c -+++ b/drivers/dma/sh/shdma-base.c -@@ -115,8 +115,10 @@ static dma_cookie_t shdma_tx_submit(struct dma_async_tx_descriptor *tx) - ret = pm_runtime_get(schan->dev); - - spin_unlock_irq(&schan->chan_lock); -- if (ret < 0) -+ if (ret < 0) { - dev_err(schan->dev, "%s(): GET = %d\n", __func__, ret); -+ pm_runtime_put(schan->dev); -+ } - - pm_runtime_barrier(schan->dev); - -diff --git a/drivers/firmware/arm_scmi/driver.c b/drivers/firmware/arm_scmi/driver.c -index 4e43bdfa041f5..f0b055bc027c4 100644 ---- a/drivers/firmware/arm_scmi/driver.c -+++ b/drivers/firmware/arm_scmi/driver.c -@@ -983,7 +983,7 @@ static struct platform_driver scmi_driver = { - - module_platform_driver(scmi_driver); - --MODULE_ALIAS("platform: arm-scmi"); -+MODULE_ALIAS("platform:arm-scmi"); - MODULE_AUTHOR("Sudeep Holla "); - MODULE_DESCRIPTION("ARM SCMI protocol driver"); - MODULE_LICENSE("GPL v2"); -diff --git a/drivers/firmware/efi/vars.c b/drivers/firmware/efi/vars.c -index 436d1776bc7be..a32d15b2928f7 100644 ---- a/drivers/firmware/efi/vars.c -+++ b/drivers/firmware/efi/vars.c -@@ -750,6 +750,7 @@ int efivar_entry_set_safe(efi_char16_t *name, efi_guid_t vendor, u32 attributes, - { - const struct efivar_operations *ops; - efi_status_t status; -+ unsigned long varsize; - - if (!__efivars) - return -EINVAL; -@@ -772,15 +773,17 @@ int efivar_entry_set_safe(efi_char16_t *name, efi_guid_t vendor, u32 attributes, - return efivar_entry_set_nonblocking(name, vendor, attributes, - size, data); - -+ varsize = size + ucs2_strsize(name, 1024); - if (!block) { - if (down_trylock(&efivars_lock)) - return -EBUSY; -+ status = check_var_size_nonblocking(attributes, varsize); - } else { - if (down_interruptible(&efivars_lock)) - return -EINTR; -+ status = check_var_size(attributes, varsize); - } - -- status = check_var_size(attributes, size + ucs2_strsize(name, 1024)); - if (status != EFI_SUCCESS) { - up(&efivars_lock); - return -ENOSPC; -diff --git a/drivers/hid/hid-debug.c b/drivers/hid/hid-debug.c -index 01135713e8f9b..419d8dec7e498 100644 ---- a/drivers/hid/hid-debug.c -+++ b/drivers/hid/hid-debug.c -@@ -823,7 +823,9 @@ static const char *keys[KEY_MAX + 1] = { - [KEY_F22] = "F22", [KEY_F23] = "F23", - [KEY_F24] = "F24", [KEY_PLAYCD] = "PlayCD", - [KEY_PAUSECD] = "PauseCD", [KEY_PROG3] = "Prog3", -- [KEY_PROG4] = "Prog4", [KEY_SUSPEND] = "Suspend", -+ [KEY_PROG4] = "Prog4", -+ [KEY_ALL_APPLICATIONS] = "AllApplications", -+ [KEY_SUSPEND] = "Suspend", - [KEY_CLOSE] = "Close", [KEY_PLAY] = "Play", - [KEY_FASTFORWARD] = "FastForward", [KEY_BASSBOOST] = "BassBoost", - [KEY_PRINT] = "Print", [KEY_HP] = "HP", -@@ -930,6 +932,7 @@ static const char *keys[KEY_MAX + 1] = { - [KEY_SCREENSAVER] = "ScreenSaver", - [KEY_VOICECOMMAND] = "VoiceCommand", - [KEY_EMOJI_PICKER] = "EmojiPicker", -+ [KEY_DICTATE] = "Dictate", - [KEY_BRIGHTNESS_MIN] = "BrightnessMin", - [KEY_BRIGHTNESS_MAX] = "BrightnessMax", - [KEY_BRIGHTNESS_AUTO] = "BrightnessAuto", -diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c -index 749558aa27e78..d1ba6fafe960f 100644 ---- a/drivers/hid/hid-input.c -+++ b/drivers/hid/hid-input.c -@@ -956,6 +956,7 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel - case 0x0cd: map_key_clear(KEY_PLAYPAUSE); break; - case 0x0cf: map_key_clear(KEY_VOICECOMMAND); break; - -+ case 0x0d8: map_key_clear(KEY_DICTATE); break; - case 0x0d9: map_key_clear(KEY_EMOJI_PICKER); break; - - case 0x0e0: map_abs_clear(ABS_VOLUME); break; -@@ -1047,6 +1048,8 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel - - case 0x29d: map_key_clear(KEY_KBD_LAYOUT_NEXT); break; - -+ case 0x2a2: map_key_clear(KEY_ALL_APPLICATIONS); break; -+ - case 0x2c7: map_key_clear(KEY_KBDINPUTASSIST_PREV); break; - case 0x2c8: map_key_clear(KEY_KBDINPUTASSIST_NEXT); break; - case 0x2c9: map_key_clear(KEY_KBDINPUTASSIST_PREVGROUP); break; -diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig -index 2d08a8719506c..854f1b2658b82 100644 ---- a/drivers/i2c/busses/Kconfig -+++ b/drivers/i2c/busses/Kconfig -@@ -483,7 +483,7 @@ config I2C_BRCMSTB - - config I2C_CADENCE - tristate "Cadence I2C Controller" -- depends on ARCH_ZYNQ || ARM64 || XTENSA -+ depends on ARCH_ZYNQ || ARM64 || XTENSA || COMPILE_TEST - help - Say yes here to select Cadence I2C Host Controller. This controller is - e.g. used by Xilinx Zynq. -@@ -894,7 +894,7 @@ config I2C_QCOM_GENI - - config I2C_QUP - tristate "Qualcomm QUP based I2C controller" -- depends on ARCH_QCOM -+ depends on ARCH_QCOM || COMPILE_TEST - help - If you say yes to this option, support will be included for the - built-in I2C interface on the Qualcomm SoCs. -diff --git a/drivers/i2c/busses/i2c-bcm2835.c b/drivers/i2c/busses/i2c-bcm2835.c -index 5ab901ad615dd..c265fe4621621 100644 ---- a/drivers/i2c/busses/i2c-bcm2835.c -+++ b/drivers/i2c/busses/i2c-bcm2835.c -@@ -23,6 +23,11 @@ - #define BCM2835_I2C_FIFO 0x10 - #define BCM2835_I2C_DIV 0x14 - #define BCM2835_I2C_DEL 0x18 -+/* -+ * 16-bit field for the number of SCL cycles to wait after rising SCL -+ * before deciding the slave is not responding. 0 disables the -+ * timeout detection. -+ */ - #define BCM2835_I2C_CLKT 0x1c - - #define BCM2835_I2C_C_READ BIT(0) -@@ -479,6 +484,12 @@ static int bcm2835_i2c_probe(struct platform_device *pdev) - adap->dev.of_node = pdev->dev.of_node; - adap->quirks = of_device_get_match_data(&pdev->dev); - -+ /* -+ * Disable the hardware clock stretching timeout. SMBUS -+ * specifies a limit for how long the device can stretch the -+ * clock, but core I2C doesn't. -+ */ -+ bcm2835_i2c_writel(i2c_dev, BCM2835_I2C_CLKT, 0); - bcm2835_i2c_writel(i2c_dev, BCM2835_I2C_C, 0); - - ret = i2c_add_adapter(adap); -diff --git a/drivers/input/input.c b/drivers/input/input.c -index e2eb9b9b8363d..f7398b996bacf 100644 ---- a/drivers/input/input.c -+++ b/drivers/input/input.c -@@ -2181,6 +2181,12 @@ int input_register_device(struct input_dev *dev) - /* KEY_RESERVED is not supposed to be transmitted to userspace. */ - __clear_bit(KEY_RESERVED, dev->keybit); - -+ /* Buttonpads should not map BTN_RIGHT and/or BTN_MIDDLE. */ -+ if (test_bit(INPUT_PROP_BUTTONPAD, dev->propbit)) { -+ __clear_bit(BTN_RIGHT, dev->keybit); -+ __clear_bit(BTN_MIDDLE, dev->keybit); -+ } -+ - /* Make sure that bitmasks not mentioned in dev->evbit are clean. */ - input_cleanse_bitmasks(dev); - -diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c -index 196e8505dd8d7..aaef8847f8862 100644 ---- a/drivers/input/mouse/elan_i2c_core.c -+++ b/drivers/input/mouse/elan_i2c_core.c -@@ -139,55 +139,21 @@ static int elan_get_fwinfo(u16 ic_type, u16 *validpage_count, - return 0; - } - --static int elan_enable_power(struct elan_tp_data *data) -+static int elan_set_power(struct elan_tp_data *data, bool on) - { - int repeat = ETP_RETRY_COUNT; - int error; - -- error = regulator_enable(data->vcc); -- if (error) { -- dev_err(&data->client->dev, -- "failed to enable regulator: %d\n", error); -- return error; -- } -- - do { -- error = data->ops->power_control(data->client, true); -+ error = data->ops->power_control(data->client, on); - if (error >= 0) - return 0; - - msleep(30); - } while (--repeat > 0); - -- dev_err(&data->client->dev, "failed to enable power: %d\n", error); -- return error; --} -- --static int elan_disable_power(struct elan_tp_data *data) --{ -- int repeat = ETP_RETRY_COUNT; -- int error; -- -- do { -- error = data->ops->power_control(data->client, false); -- if (!error) { -- error = regulator_disable(data->vcc); -- if (error) { -- dev_err(&data->client->dev, -- "failed to disable regulator: %d\n", -- error); -- /* Attempt to power the chip back up */ -- data->ops->power_control(data->client, true); -- break; -- } -- -- return 0; -- } -- -- msleep(30); -- } while (--repeat > 0); -- -- dev_err(&data->client->dev, "failed to disable power: %d\n", error); -+ dev_err(&data->client->dev, "failed to set power %s: %d\n", -+ on ? "on" : "off", error); - return error; - } - -@@ -1316,9 +1282,19 @@ static int __maybe_unused elan_suspend(struct device *dev) - /* Enable wake from IRQ */ - data->irq_wake = (enable_irq_wake(client->irq) == 0); - } else { -- ret = elan_disable_power(data); -+ ret = elan_set_power(data, false); -+ if (ret) -+ goto err; -+ -+ ret = regulator_disable(data->vcc); -+ if (ret) { -+ dev_err(dev, "error %d disabling regulator\n", ret); -+ /* Attempt to power the chip back up */ -+ elan_set_power(data, true); -+ } - } - -+err: - mutex_unlock(&data->sysfs_mutex); - return ret; - } -@@ -1329,12 +1305,18 @@ static int __maybe_unused elan_resume(struct device *dev) - struct elan_tp_data *data = i2c_get_clientdata(client); - int error; - -- if (device_may_wakeup(dev) && data->irq_wake) { -+ if (!device_may_wakeup(dev)) { -+ error = regulator_enable(data->vcc); -+ if (error) { -+ dev_err(dev, "error %d enabling regulator\n", error); -+ goto err; -+ } -+ } else if (data->irq_wake) { - disable_irq_wake(client->irq); - data->irq_wake = false; - } - -- error = elan_enable_power(data); -+ error = elan_set_power(data, true); - if (error) { - dev_err(dev, "power up when resuming failed: %d\n", error); - goto err; -diff --git a/drivers/net/arcnet/com20020-pci.c b/drivers/net/arcnet/com20020-pci.c -index eb7f76753c9c0..9f44e2e458df1 100644 ---- a/drivers/net/arcnet/com20020-pci.c -+++ b/drivers/net/arcnet/com20020-pci.c -@@ -136,6 +136,9 @@ static int com20020pci_probe(struct pci_dev *pdev, - return -ENOMEM; - - ci = (struct com20020_pci_card_info *)id->driver_data; -+ if (!ci) -+ return -EINVAL; -+ - priv->ci = ci; - mm = &ci->misc_map; - -diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c -index 8b4c1bb77c334..76747d94c7602 100644 ---- a/drivers/net/can/usb/gs_usb.c -+++ b/drivers/net/can/usb/gs_usb.c -@@ -190,8 +190,8 @@ struct gs_can { - struct gs_usb { - struct gs_can *canch[GS_MAX_INTF]; - struct usb_anchor rx_submitted; -- atomic_t active_channels; - struct usb_device *udev; -+ u8 active_channels; - }; - - /* 'allocate' a tx context. -@@ -588,7 +588,7 @@ static int gs_can_open(struct net_device *netdev) - if (rc) - return rc; - -- if (atomic_add_return(1, &parent->active_channels) == 1) { -+ if (!parent->active_channels) { - for (i = 0; i < GS_MAX_RX_URBS; i++) { - struct urb *urb; - u8 *buf; -@@ -689,6 +689,7 @@ static int gs_can_open(struct net_device *netdev) - - dev->can.state = CAN_STATE_ERROR_ACTIVE; - -+ parent->active_channels++; - if (!(dev->can.ctrlmode & CAN_CTRLMODE_LISTENONLY)) - netif_start_queue(netdev); - -@@ -704,7 +705,8 @@ static int gs_can_close(struct net_device *netdev) - netif_stop_queue(netdev); - - /* Stop polling */ -- if (atomic_dec_and_test(&parent->active_channels)) -+ parent->active_channels--; -+ if (!parent->active_channels) - usb_kill_anchored_urbs(&parent->rx_submitted); - - /* Stop sending URBs */ -@@ -983,8 +985,6 @@ static int gs_usb_probe(struct usb_interface *intf, - - init_usb_anchor(&dev->rx_submitted); - -- atomic_set(&dev->active_channels, 0); -- - usb_set_intfdata(intf, dev); - dev->udev = interface_to_usbdev(intf); - -diff --git a/drivers/net/ethernet/chelsio/cxgb3/t3_hw.c b/drivers/net/ethernet/chelsio/cxgb3/t3_hw.c -index 0a9f2c5966242..d3e11fe1eabcc 100644 ---- a/drivers/net/ethernet/chelsio/cxgb3/t3_hw.c -+++ b/drivers/net/ethernet/chelsio/cxgb3/t3_hw.c -@@ -3677,6 +3677,8 @@ int t3_prep_adapter(struct adapter *adapter, const struct adapter_info *ai, - MAC_STATS_ACCUM_SECS : (MAC_STATS_ACCUM_SECS * 10); - adapter->params.pci.vpd_cap_addr = - pci_find_capability(adapter->pdev, PCI_CAP_ID_VPD); -+ if (!adapter->params.pci.vpd_cap_addr) -+ return -ENODEV; - ret = get_vpd_params(adapter, &adapter->params.vpd); - if (ret < 0) - return ret; -diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c -index 26d49dcdbeb3e..34bf6f4eef4ab 100644 ---- a/drivers/net/ethernet/ibm/ibmvnic.c -+++ b/drivers/net/ethernet/ibm/ibmvnic.c -@@ -2248,8 +2248,10 @@ static int ibmvnic_reset(struct ibmvnic_adapter *adapter, - * flush reset queue and process this reset - */ - if (adapter->force_reset_recovery && !list_empty(&adapter->rwi_list)) { -- list_for_each_safe(entry, tmp_entry, &adapter->rwi_list) -+ list_for_each_safe(entry, tmp_entry, &adapter->rwi_list) { - list_del(entry); -+ kfree(list_entry(entry, struct ibmvnic_rwi, list)); -+ } - } - rwi->reset_reason = reason; - list_add_tail(&rwi->list, &adapter->rwi_list); -diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c -index 309e953ed1e44..e8850ba5604c4 100644 ---- a/drivers/net/ethernet/intel/iavf/iavf_main.c -+++ b/drivers/net/ethernet/intel/iavf/iavf_main.c -@@ -3323,8 +3323,11 @@ static int iavf_change_mtu(struct net_device *netdev, int new_mtu) - iavf_notify_client_l2_params(&adapter->vsi); - adapter->flags |= IAVF_FLAG_SERVICE_CLIENT_REQUESTED; - } -- adapter->flags |= IAVF_FLAG_RESET_NEEDED; -- queue_work(iavf_wq, &adapter->reset_task); -+ -+ if (netif_running(netdev)) { -+ adapter->flags |= IAVF_FLAG_RESET_NEEDED; -+ queue_work(iavf_wq, &adapter->reset_task); -+ } - - return 0; - } -diff --git a/drivers/net/ethernet/intel/igc/igc_phy.c b/drivers/net/ethernet/intel/igc/igc_phy.c -index f4b05af0dd2f6..1a4947e6933c3 100644 ---- a/drivers/net/ethernet/intel/igc/igc_phy.c -+++ b/drivers/net/ethernet/intel/igc/igc_phy.c -@@ -734,8 +734,6 @@ s32 igc_write_phy_reg_gpy(struct igc_hw *hw, u32 offset, u16 data) - if (ret_val) - return ret_val; - ret_val = igc_write_phy_reg_mdic(hw, offset, data); -- if (ret_val) -- return ret_val; - hw->phy.ops.release(hw); - } else { - ret_val = igc_write_xmdio_reg(hw, (u16)offset, dev_addr, -@@ -767,8 +765,6 @@ s32 igc_read_phy_reg_gpy(struct igc_hw *hw, u32 offset, u16 *data) - if (ret_val) - return ret_val; - ret_val = igc_read_phy_reg_mdic(hw, offset, data); -- if (ret_val) -- return ret_val; - hw->phy.ops.release(hw); - } else { - ret_val = igc_read_xmdio_reg(hw, (u16)offset, dev_addr, -diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c -index b43be9f141053..921a2ddb497e1 100644 ---- a/drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c -+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c -@@ -583,12 +583,14 @@ static bool ixgbe_xmit_zc(struct ixgbe_ring *xdp_ring, unsigned int budget) - u32 cmd_type; - - while (budget-- > 0) { -- if (unlikely(!ixgbe_desc_unused(xdp_ring)) || -- !netif_carrier_ok(xdp_ring->netdev)) { -+ if (unlikely(!ixgbe_desc_unused(xdp_ring))) { - work_done = false; - break; - } - -+ if (!netif_carrier_ok(xdp_ring->netdev)) -+ break; -+ - if (!xsk_umem_consume_tx(xdp_ring->xsk_umem, &desc)) - break; - -diff --git a/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c b/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c -index 38767d7979147..431146b391d0c 100644 ---- a/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c -+++ b/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c -@@ -2277,18 +2277,18 @@ static int __init sxgbe_cmdline_opt(char *str) - char *opt; - - if (!str || !*str) -- return -EINVAL; -+ return 1; - while ((opt = strsep(&str, ",")) != NULL) { - if (!strncmp(opt, "eee_timer:", 10)) { - if (kstrtoint(opt + 10, 0, &eee_timer)) - goto err; - } - } -- return 0; -+ return 1; - - err: - pr_err("%s: ERROR broken module parameter conversion\n", __func__); -- return -EINVAL; -+ return 1; - } - - __setup("sxgbeeth=", sxgbe_cmdline_opt); -diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -index 94c652b9a0a8b..9cbc0179d24ec 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -@@ -4890,7 +4890,7 @@ static int __init stmmac_cmdline_opt(char *str) - char *opt; - - if (!str || !*str) -- return -EINVAL; -+ return 1; - while ((opt = strsep(&str, ",")) != NULL) { - if (!strncmp(opt, "debug:", 6)) { - if (kstrtoint(opt + 6, 0, &debug)) -@@ -4921,11 +4921,11 @@ static int __init stmmac_cmdline_opt(char *str) - goto err; - } - } -- return 0; -+ return 1; - - err: - pr_err("%s: ERROR broken module parameter conversion", __func__); -- return -EINVAL; -+ return 1; - } - - __setup("stmmaceth=", stmmac_cmdline_opt); -diff --git a/drivers/net/hamradio/mkiss.c b/drivers/net/hamradio/mkiss.c -index d2eb33f53993b..43aab2835f8ff 100644 ---- a/drivers/net/hamradio/mkiss.c -+++ b/drivers/net/hamradio/mkiss.c -@@ -31,6 +31,8 @@ - - #define AX_MTU 236 - -+/* some arch define END as assembly function ending, just undef it */ -+#undef END - /* SLIP/KISS protocol characters. */ - #define END 0300 /* indicates end of frame */ - #define ESC 0333 /* indicates byte stuffing */ -diff --git a/drivers/net/usb/cdc_mbim.c b/drivers/net/usb/cdc_mbim.c -index 77ac5a721e7b6..414341c9cf5ae 100644 ---- a/drivers/net/usb/cdc_mbim.c -+++ b/drivers/net/usb/cdc_mbim.c -@@ -658,6 +658,11 @@ static const struct usb_device_id mbim_devs[] = { - .driver_info = (unsigned long)&cdc_mbim_info_avoid_altsetting_toggle, - }, - -+ /* Telit FN990 */ -+ { USB_DEVICE_AND_INTERFACE_INFO(0x1bc7, 0x1071, USB_CLASS_COMM, USB_CDC_SUBCLASS_MBIM, USB_CDC_PROTO_NONE), -+ .driver_info = (unsigned long)&cdc_mbim_info_avoid_altsetting_toggle, -+ }, -+ - /* default entry */ - { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_MBIM, USB_CDC_PROTO_NONE), - .driver_info = (unsigned long)&cdc_mbim_info_zlp, -diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c -index 07b070b14d75d..6e1721d533846 100644 ---- a/drivers/net/wireless/mac80211_hwsim.c -+++ b/drivers/net/wireless/mac80211_hwsim.c -@@ -2062,6 +2062,15 @@ static void hw_scan_work(struct work_struct *work) - if (req->ie_len) - skb_put_data(probe, req->ie, req->ie_len); - -+ if (!ieee80211_tx_prepare_skb(hwsim->hw, -+ hwsim->hw_scan_vif, -+ probe, -+ hwsim->tmp_chan->band, -+ NULL)) { -+ kfree_skb(probe); -+ continue; -+ } -+ - local_bh_disable(); - mac80211_hwsim_tx_frame(hwsim->hw, probe, - hwsim->tmp_chan); -@@ -3316,6 +3325,10 @@ static int hwsim_tx_info_frame_received_nl(struct sk_buff *skb_2, - } - txi->flags |= IEEE80211_TX_STAT_ACK; - } -+ -+ if (hwsim_flags & HWSIM_TX_CTL_NO_ACK) -+ txi->flags |= IEEE80211_TX_STAT_NOACK_TRANSMITTED; -+ - ieee80211_tx_status_irqsafe(data2->hw, skb); - return 0; - out: -diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c -index d2b3381f71825..d45d83968e769 100644 ---- a/drivers/net/xen-netfront.c -+++ b/drivers/net/xen-netfront.c -@@ -761,6 +761,28 @@ static int xennet_close(struct net_device *dev) - return 0; - } - -+static void xennet_destroy_queues(struct netfront_info *info) -+{ -+ unsigned int i; -+ -+ for (i = 0; i < info->netdev->real_num_tx_queues; i++) { -+ struct netfront_queue *queue = &info->queues[i]; -+ -+ if (netif_running(info->netdev)) -+ napi_disable(&queue->napi); -+ netif_napi_del(&queue->napi); -+ } -+ -+ kfree(info->queues); -+ info->queues = NULL; -+} -+ -+static void xennet_uninit(struct net_device *dev) -+{ -+ struct netfront_info *np = netdev_priv(dev); -+ xennet_destroy_queues(np); -+} -+ - static void xennet_set_rx_rsp_cons(struct netfront_queue *queue, RING_IDX val) - { - unsigned long flags; -@@ -1373,6 +1395,7 @@ static void xennet_poll_controller(struct net_device *dev) - #endif - - static const struct net_device_ops xennet_netdev_ops = { -+ .ndo_uninit = xennet_uninit, - .ndo_open = xennet_open, - .ndo_stop = xennet_close, - .ndo_start_xmit = xennet_start_xmit, -@@ -1860,22 +1883,6 @@ error: - return err; - } - --static void xennet_destroy_queues(struct netfront_info *info) --{ -- unsigned int i; -- -- for (i = 0; i < info->netdev->real_num_tx_queues; i++) { -- struct netfront_queue *queue = &info->queues[i]; -- -- if (netif_running(info->netdev)) -- napi_disable(&queue->napi); -- netif_napi_del(&queue->napi); -- } -- -- kfree(info->queues); -- info->queues = NULL; --} -- - static int xennet_create_queues(struct netfront_info *info, - unsigned int *num_queues) - { -diff --git a/drivers/soc/fsl/qe/qe_io.c b/drivers/soc/fsl/qe/qe_io.c -index 3657e296a8a27..058c2fec9a4b4 100644 ---- a/drivers/soc/fsl/qe/qe_io.c -+++ b/drivers/soc/fsl/qe/qe_io.c -@@ -37,6 +37,8 @@ int par_io_init(struct device_node *np) - if (ret) - return ret; - par_io = ioremap(res.start, resource_size(&res)); -+ if (!par_io) -+ return -ENOMEM; - - num_ports = of_get_property(np, "num-ports", NULL); - if (num_ports) -diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c -index 5f1e15172403e..9cd80ad075bd2 100644 ---- a/drivers/usb/gadget/legacy/inode.c -+++ b/drivers/usb/gadget/legacy/inode.c -@@ -1829,8 +1829,9 @@ dev_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr) - spin_lock_irq (&dev->lock); - value = -EINVAL; - if (dev->buf) { -+ spin_unlock_irq(&dev->lock); - kfree(kbuf); -- goto fail; -+ return value; - } - dev->buf = kbuf; - -@@ -1877,8 +1878,8 @@ dev_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr) - - value = usb_gadget_probe_driver(&gadgetfs_driver); - if (value != 0) { -- kfree (dev->buf); -- dev->buf = NULL; -+ spin_lock_irq(&dev->lock); -+ goto fail; - } else { - /* at this point "good" hardware has for the first time - * let the USB the host see us. alternatively, if users -@@ -1895,6 +1896,9 @@ dev_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr) - return value; - - fail: -+ dev->config = NULL; -+ dev->hs_config = NULL; -+ dev->dev = NULL; - spin_unlock_irq (&dev->lock); - pr_debug ("%s: %s fail %zd, %p\n", shortname, __func__, value, dev); - kfree (dev->buf); -diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c -index a5041bf0d5db1..5a3006c75d63f 100644 ---- a/fs/btrfs/qgroup.c -+++ b/fs/btrfs/qgroup.c -@@ -1116,6 +1116,14 @@ int btrfs_quota_disable(struct btrfs_fs_info *fs_info) - if (!fs_info->quota_root) - goto out; - -+ /* -+ * Unlock the qgroup_ioctl_lock mutex before waiting for the rescan worker to -+ * complete. Otherwise we can deadlock because btrfs_remove_qgroup() needs -+ * to lock that mutex while holding a transaction handle and the rescan -+ * worker needs to commit a transaction. -+ */ -+ mutex_unlock(&fs_info->qgroup_ioctl_lock); -+ - /* - * Request qgroup rescan worker to complete and wait for it. This wait - * must be done before transaction start for quota disable since it may -@@ -1123,7 +1131,6 @@ int btrfs_quota_disable(struct btrfs_fs_info *fs_info) - */ - clear_bit(BTRFS_FS_QUOTA_ENABLED, &fs_info->flags); - btrfs_qgroup_wait_for_completion(fs_info, false); -- mutex_unlock(&fs_info->qgroup_ioctl_lock); - - /* - * 1 For the root item -diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c -index 7bc4477d7ee7d..9b703c0db9796 100644 ---- a/fs/btrfs/tree-log.c -+++ b/fs/btrfs/tree-log.c -@@ -1308,6 +1308,15 @@ again: - inode, name, namelen); - kfree(name); - iput(dir); -+ /* -+ * Whenever we need to check if a name exists or not, we -+ * check the subvolume tree. So after an unlink we must -+ * run delayed items, so that future checks for a name -+ * during log replay see that the name does not exists -+ * anymore. -+ */ -+ if (!ret) -+ ret = btrfs_run_delayed_items(trans); - if (ret) - goto out; - goto again; -@@ -1559,6 +1568,15 @@ static noinline int add_inode_ref(struct btrfs_trans_handle *trans, - */ - if (!ret && inode->i_nlink == 0) - inc_nlink(inode); -+ /* -+ * Whenever we need to check if a name exists or -+ * not, we check the subvolume tree. So after an -+ * unlink we must run delayed items, so that future -+ * checks for a name during log replay see that the -+ * name does not exists anymore. -+ */ -+ if (!ret) -+ ret = btrfs_run_delayed_items(trans); - } - if (ret < 0) - goto out; -@@ -4249,7 +4267,7 @@ static int log_one_extent(struct btrfs_trans_handle *trans, - - /* - * Log all prealloc extents beyond the inode's i_size to make sure we do not -- * lose them after doing a fast fsync and replaying the log. We scan the -+ * lose them after doing a full/fast fsync and replaying the log. We scan the - * subvolume's root instead of iterating the inode's extent map tree because - * otherwise we can log incorrect extent items based on extent map conversion. - * That can happen due to the fact that extent maps are merged when they -@@ -5042,6 +5060,7 @@ static int copy_inode_items_to_log(struct btrfs_trans_handle *trans, - struct btrfs_log_ctx *ctx, - bool *need_log_inode_item) - { -+ const u64 i_size = i_size_read(&inode->vfs_inode); - struct btrfs_root *root = inode->root; - int ins_start_slot = 0; - int ins_nr = 0; -@@ -5062,13 +5081,21 @@ again: - if (min_key->type > max_key->type) - break; - -- if (min_key->type == BTRFS_INODE_ITEM_KEY) -+ if (min_key->type == BTRFS_INODE_ITEM_KEY) { - *need_log_inode_item = false; -- -- if ((min_key->type == BTRFS_INODE_REF_KEY || -- min_key->type == BTRFS_INODE_EXTREF_KEY) && -- inode->generation == trans->transid && -- !recursive_logging) { -+ } else if (min_key->type == BTRFS_EXTENT_DATA_KEY && -+ min_key->offset >= i_size) { -+ /* -+ * Extents at and beyond eof are logged with -+ * btrfs_log_prealloc_extents(). -+ * Only regular files have BTRFS_EXTENT_DATA_KEY keys, -+ * and no keys greater than that, so bail out. -+ */ -+ break; -+ } else if ((min_key->type == BTRFS_INODE_REF_KEY || -+ min_key->type == BTRFS_INODE_EXTREF_KEY) && -+ inode->generation == trans->transid && -+ !recursive_logging) { - u64 other_ino = 0; - u64 other_parent = 0; - -@@ -5099,10 +5126,8 @@ again: - btrfs_release_path(path); - goto next_key; - } -- } -- -- /* Skip xattrs, we log them later with btrfs_log_all_xattrs() */ -- if (min_key->type == BTRFS_XATTR_ITEM_KEY) { -+ } else if (min_key->type == BTRFS_XATTR_ITEM_KEY) { -+ /* Skip xattrs, logged later with btrfs_log_all_xattrs() */ - if (ins_nr == 0) - goto next_slot; - ret = copy_items(trans, inode, dst_path, path, -@@ -5155,9 +5180,21 @@ next_key: - break; - } - } -- if (ins_nr) -+ if (ins_nr) { - ret = copy_items(trans, inode, dst_path, path, ins_start_slot, - ins_nr, inode_only, logged_isize); -+ if (ret) -+ return ret; -+ } -+ -+ if (inode_only == LOG_INODE_ALL && S_ISREG(inode->vfs_inode.i_mode)) { -+ /* -+ * Release the path because otherwise we might attempt to double -+ * lock the same leaf with btrfs_log_prealloc_extents() below. -+ */ -+ btrfs_release_path(path); -+ ret = btrfs_log_prealloc_extents(trans, inode, dst_path); -+ } - - return ret; - } -diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c -index 41b3c5fc958c7..f44b6f9d07776 100644 ---- a/fs/cifs/cifsfs.c -+++ b/fs/cifs/cifsfs.c -@@ -855,6 +855,7 @@ cifs_smb3_do_mount(struct file_system_type *fs_type, - - out_super: - deactivate_locked_super(sb); -+ return root; - out: - cifs_cleanup_volume_info(volume_info); - return root; -diff --git a/include/linux/topology.h b/include/linux/topology.h -index eb2fe6edd73c8..64e7ee0abe71c 100644 ---- a/include/linux/topology.h -+++ b/include/linux/topology.h -@@ -48,6 +48,7 @@ int arch_update_cpu_topology(void); - /* Conform to ACPI 2.0 SLIT distance definitions */ - #define LOCAL_DISTANCE 10 - #define REMOTE_DISTANCE 20 -+#define DISTANCE_BITS 8 - #ifndef node_distance - #define node_distance(from,to) ((from) == (to) ? LOCAL_DISTANCE : REMOTE_DISTANCE) - #endif -diff --git a/include/net/netfilter/nf_queue.h b/include/net/netfilter/nf_queue.h -index 47088083667b2..c204af20c27e4 100644 ---- a/include/net/netfilter/nf_queue.h -+++ b/include/net/netfilter/nf_queue.h -@@ -34,7 +34,7 @@ void nf_register_queue_handler(struct net *net, const struct nf_queue_handler *q - void nf_unregister_queue_handler(struct net *net); - void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict); - --void nf_queue_entry_get_refs(struct nf_queue_entry *entry); -+bool nf_queue_entry_get_refs(struct nf_queue_entry *entry); - void nf_queue_entry_release_refs(struct nf_queue_entry *entry); - - static inline void init_hashrandom(u32 *jhash_initval) -diff --git a/include/net/xfrm.h b/include/net/xfrm.h -index 8ce63850d6d01..614f19bbad74f 100644 ---- a/include/net/xfrm.h -+++ b/include/net/xfrm.h -@@ -1543,7 +1543,6 @@ void xfrm_sad_getinfo(struct net *net, struct xfrmk_sadinfo *si); - void xfrm_spd_getinfo(struct net *net, struct xfrmk_spdinfo *si); - u32 xfrm_replay_seqhi(struct xfrm_state *x, __be32 net_seq); - int xfrm_init_replay(struct xfrm_state *x); --u32 __xfrm_state_mtu(struct xfrm_state *x, int mtu); - u32 xfrm_state_mtu(struct xfrm_state *x, int mtu); - int __xfrm_init_state(struct xfrm_state *x, bool init_replay, bool offload); - int xfrm_init_state(struct xfrm_state *x); -diff --git a/include/uapi/linux/input-event-codes.h b/include/uapi/linux/input-event-codes.h -index 311a57f3e01a2..7f0ae1f411e3a 100644 ---- a/include/uapi/linux/input-event-codes.h -+++ b/include/uapi/linux/input-event-codes.h -@@ -278,7 +278,8 @@ - #define KEY_PAUSECD 201 - #define KEY_PROG3 202 - #define KEY_PROG4 203 --#define KEY_DASHBOARD 204 /* AL Dashboard */ -+#define KEY_ALL_APPLICATIONS 204 /* AC Desktop Show All Applications */ -+#define KEY_DASHBOARD KEY_ALL_APPLICATIONS - #define KEY_SUSPEND 205 - #define KEY_CLOSE 206 /* AC Close */ - #define KEY_PLAY 207 -@@ -608,6 +609,7 @@ - #define KEY_ASSISTANT 0x247 /* AL Context-aware desktop assistant */ - #define KEY_KBD_LAYOUT_NEXT 0x248 /* AC Next Keyboard Layout Select */ - #define KEY_EMOJI_PICKER 0x249 /* Show/hide emoji picker (HUTRR101) */ -+#define KEY_DICTATE 0x24a /* Start or Stop Voice Dictation Session (HUTRR99) */ - - #define KEY_BRIGHTNESS_MIN 0x250 /* Set Brightness to Minimum */ - #define KEY_BRIGHTNESS_MAX 0x251 /* Set Brightness to Maximum */ -diff --git a/include/uapi/linux/xfrm.h b/include/uapi/linux/xfrm.h -index ff7cfdc6cb44d..90a8f968af2f9 100644 ---- a/include/uapi/linux/xfrm.h -+++ b/include/uapi/linux/xfrm.h -@@ -504,6 +504,12 @@ struct xfrm_user_offload { - int ifindex; - __u8 flags; - }; -+/* This flag was exposed without any kernel code that supporting it. -+ * Unfortunately, strongswan has the code that uses sets this flag, -+ * which makes impossible to reuse this bit. -+ * -+ * So leave it here to make sure that it won't be reused by mistake. -+ */ - #define XFRM_OFFLOAD_IPV6 1 - #define XFRM_OFFLOAD_INBOUND 2 - -diff --git a/kernel/sched/topology.c b/kernel/sched/topology.c -index ffaa97a8d4051..e5ebaffc4fef5 100644 ---- a/kernel/sched/topology.c -+++ b/kernel/sched/topology.c -@@ -1552,66 +1552,58 @@ static void init_numa_topology_type(void) - } - } - -+ -+#define NR_DISTANCE_VALUES (1 << DISTANCE_BITS) -+ - void sched_init_numa(void) - { -- int next_distance, curr_distance = node_distance(0, 0); - struct sched_domain_topology_level *tl; -- int level = 0; -- int i, j, k; -- -- sched_domains_numa_distance = kzalloc(sizeof(int) * (nr_node_ids + 1), GFP_KERNEL); -- if (!sched_domains_numa_distance) -- return; -- -- /* Includes NUMA identity node at level 0. */ -- sched_domains_numa_distance[level++] = curr_distance; -- sched_domains_numa_levels = level; -+ unsigned long *distance_map; -+ int nr_levels = 0; -+ int i, j; - - /* - * O(nr_nodes^2) deduplicating selection sort -- in order to find the - * unique distances in the node_distance() table. -- * -- * Assumes node_distance(0,j) includes all distances in -- * node_distance(i,j) in order to avoid cubic time. - */ -- next_distance = curr_distance; -+ distance_map = bitmap_alloc(NR_DISTANCE_VALUES, GFP_KERNEL); -+ if (!distance_map) -+ return; -+ -+ bitmap_zero(distance_map, NR_DISTANCE_VALUES); - for (i = 0; i < nr_node_ids; i++) { - for (j = 0; j < nr_node_ids; j++) { -- for (k = 0; k < nr_node_ids; k++) { -- int distance = node_distance(i, k); -- -- if (distance > curr_distance && -- (distance < next_distance || -- next_distance == curr_distance)) -- next_distance = distance; -- -- /* -- * While not a strong assumption it would be nice to know -- * about cases where if node A is connected to B, B is not -- * equally connected to A. -- */ -- if (sched_debug() && node_distance(k, i) != distance) -- sched_numa_warn("Node-distance not symmetric"); -+ int distance = node_distance(i, j); - -- if (sched_debug() && i && !find_numa_distance(distance)) -- sched_numa_warn("Node-0 not representative"); -+ if (distance < LOCAL_DISTANCE || distance >= NR_DISTANCE_VALUES) { -+ sched_numa_warn("Invalid distance value range"); -+ return; - } -- if (next_distance != curr_distance) { -- sched_domains_numa_distance[level++] = next_distance; -- sched_domains_numa_levels = level; -- curr_distance = next_distance; -- } else break; -+ -+ bitmap_set(distance_map, distance, 1); - } -+ } -+ /* -+ * We can now figure out how many unique distance values there are and -+ * allocate memory accordingly. -+ */ -+ nr_levels = bitmap_weight(distance_map, NR_DISTANCE_VALUES); - -- /* -- * In case of sched_debug() we verify the above assumption. -- */ -- if (!sched_debug()) -- break; -+ sched_domains_numa_distance = kcalloc(nr_levels, sizeof(int), GFP_KERNEL); -+ if (!sched_domains_numa_distance) { -+ bitmap_free(distance_map); -+ return; -+ } -+ -+ for (i = 0, j = 0; i < nr_levels; i++, j++) { -+ j = find_next_bit(distance_map, NR_DISTANCE_VALUES, j); -+ sched_domains_numa_distance[i] = j; - } - -+ bitmap_free(distance_map); -+ - /* -- * 'level' contains the number of unique distances -+ * 'nr_levels' contains the number of unique distances - * - * The sched_domains_numa_distance[] array includes the actual distance - * numbers. -@@ -1620,15 +1612,15 @@ void sched_init_numa(void) - /* - * Here, we should temporarily reset sched_domains_numa_levels to 0. - * If it fails to allocate memory for array sched_domains_numa_masks[][], -- * the array will contain less then 'level' members. This could be -+ * the array will contain less then 'nr_levels' members. This could be - * dangerous when we use it to iterate array sched_domains_numa_masks[][] - * in other functions. - * -- * We reset it to 'level' at the end of this function. -+ * We reset it to 'nr_levels' at the end of this function. - */ - sched_domains_numa_levels = 0; - -- sched_domains_numa_masks = kzalloc(sizeof(void *) * level, GFP_KERNEL); -+ sched_domains_numa_masks = kzalloc(sizeof(void *) * nr_levels, GFP_KERNEL); - if (!sched_domains_numa_masks) - return; - -@@ -1636,7 +1628,7 @@ void sched_init_numa(void) - * Now for each level, construct a mask per node which contains all - * CPUs of nodes that are that many hops away from us. - */ -- for (i = 0; i < level; i++) { -+ for (i = 0; i < nr_levels; i++) { - sched_domains_numa_masks[i] = - kzalloc(nr_node_ids * sizeof(void *), GFP_KERNEL); - if (!sched_domains_numa_masks[i]) -@@ -1644,12 +1636,17 @@ void sched_init_numa(void) - - for (j = 0; j < nr_node_ids; j++) { - struct cpumask *mask = kzalloc(cpumask_size(), GFP_KERNEL); -+ int k; -+ - if (!mask) - return; - - sched_domains_numa_masks[i][j] = mask; - - for_each_node(k) { -+ if (sched_debug() && (node_distance(j, k) != node_distance(k, j))) -+ sched_numa_warn("Node-distance not symmetric"); -+ - if (node_distance(j, k) > sched_domains_numa_distance[i]) - continue; - -@@ -1661,7 +1658,7 @@ void sched_init_numa(void) - /* Compute default topology size */ - for (i = 0; sched_domain_topology[i].mask; i++); - -- tl = kzalloc((i + level + 1) * -+ tl = kzalloc((i + nr_levels + 1) * - sizeof(struct sched_domain_topology_level), GFP_KERNEL); - if (!tl) - return; -@@ -1684,7 +1681,7 @@ void sched_init_numa(void) - /* - * .. and append 'j' levels of NUMA goodness. - */ -- for (j = 1; j < level; i++, j++) { -+ for (j = 1; j < nr_levels; i++, j++) { - tl[i] = (struct sched_domain_topology_level){ - .mask = sd_numa_mask, - .sd_flags = cpu_numa_flags, -@@ -1696,8 +1693,8 @@ void sched_init_numa(void) - - sched_domain_topology = tl; - -- sched_domains_numa_levels = level; -- sched_max_numa_distance = sched_domains_numa_distance[level - 1]; -+ sched_domains_numa_levels = nr_levels; -+ sched_max_numa_distance = sched_domains_numa_distance[nr_levels - 1]; - - init_numa_topology_type(); - } -diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c -index 615259d8fa9ad..1a89b2bf626a5 100644 ---- a/kernel/trace/trace.c -+++ b/kernel/trace/trace.c -@@ -219,7 +219,7 @@ static char trace_boot_options_buf[MAX_TRACER_SIZE] __initdata; - static int __init set_trace_boot_options(char *str) - { - strlcpy(trace_boot_options_buf, str, MAX_TRACER_SIZE); -- return 0; -+ return 1; - } - __setup("trace_options=", set_trace_boot_options); - -@@ -230,7 +230,7 @@ static int __init set_trace_boot_clock(char *str) - { - strlcpy(trace_boot_clock_buf, str, MAX_TRACER_SIZE); - trace_boot_clock = trace_boot_clock_buf; -- return 0; -+ return 1; - } - __setup("trace_clock=", set_trace_boot_clock); - -diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c -index 3cef24c6391a5..413da11260f89 100644 ---- a/kernel/trace/trace_events_hist.c -+++ b/kernel/trace/trace_events_hist.c -@@ -2891,9 +2891,9 @@ parse_field(struct hist_trigger_data *hist_data, struct trace_event_file *file, - /* - * For backward compatibility, if field_name - * was "cpu", then we treat this the same as -- * common_cpu. -+ * common_cpu. This also works for "CPU". - */ -- if (strcmp(field_name, "cpu") == 0) { -+ if (field && field->filter_type == FILTER_CPU) { - *flags |= HIST_FIELD_FL_CPU; - } else { - hist_err(tr, HIST_ERR_FIELD_NOT_FOUND, -@@ -5247,7 +5247,7 @@ static int create_tracing_map_fields(struct hist_trigger_data *hist_data) - - if (hist_field->flags & HIST_FIELD_FL_STACKTRACE) - cmp_fn = tracing_map_cmp_none; -- else if (!field) -+ else if (!field || hist_field->flags & HIST_FIELD_FL_CPU) - cmp_fn = tracing_map_cmp_num(hist_field->size, - hist_field->is_signed); - else if (is_string_field(field)) -diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c -index 13ccf2f28987e..a422cf6a0358b 100644 ---- a/kernel/trace/trace_kprobe.c -+++ b/kernel/trace/trace_kprobe.c -@@ -430,7 +430,7 @@ static int disable_trace_kprobe(struct trace_event_call *call, - */ - trace_probe_remove_file(tp, file); - -- return 0; -+ return 1; - } - - #if defined(CONFIG_DYNAMIC_FTRACE) && \ -diff --git a/mm/memfd.c b/mm/memfd.c -index 2647c898990c8..fae4142f7d254 100644 ---- a/mm/memfd.c -+++ b/mm/memfd.c -@@ -31,20 +31,28 @@ - static void memfd_tag_pins(struct xa_state *xas) - { - struct page *page; -- unsigned int tagged = 0; -+ int latency = 0; -+ int cache_count; - - lru_add_drain(); - - xas_lock_irq(xas); - xas_for_each(xas, page, ULONG_MAX) { -- if (xa_is_value(page)) -- continue; -- page = find_subpage(page, xas->xa_index); -- if (page_count(page) - page_mapcount(page) > 1) -+ cache_count = 1; -+ if (!xa_is_value(page) && -+ PageTransHuge(page) && !PageHuge(page)) -+ cache_count = HPAGE_PMD_NR; -+ -+ if (!xa_is_value(page) && -+ page_count(page) - total_mapcount(page) != cache_count) - xas_set_mark(xas, MEMFD_TAG_PINNED); -+ if (cache_count != 1) -+ xas_set(xas, page->index + cache_count); - -- if (++tagged % XA_CHECK_SCHED) -+ latency += cache_count; -+ if (latency < XA_CHECK_SCHED) - continue; -+ latency = 0; - - xas_pause(xas); - xas_unlock_irq(xas); -@@ -73,7 +81,8 @@ static int memfd_wait_for_pins(struct address_space *mapping) - - error = 0; - for (scan = 0; scan <= LAST_SCAN; scan++) { -- unsigned int tagged = 0; -+ int latency = 0; -+ int cache_count; - - if (!xas_marked(&xas, MEMFD_TAG_PINNED)) - break; -@@ -87,10 +96,14 @@ static int memfd_wait_for_pins(struct address_space *mapping) - xas_lock_irq(&xas); - xas_for_each_marked(&xas, page, ULONG_MAX, MEMFD_TAG_PINNED) { - bool clear = true; -- if (xa_is_value(page)) -- continue; -- page = find_subpage(page, xas.xa_index); -- if (page_count(page) - page_mapcount(page) != 1) { -+ -+ cache_count = 1; -+ if (!xa_is_value(page) && -+ PageTransHuge(page) && !PageHuge(page)) -+ cache_count = HPAGE_PMD_NR; -+ -+ if (!xa_is_value(page) && cache_count != -+ page_count(page) - total_mapcount(page)) { - /* - * On the last scan, we clean up all those tags - * we inserted; but make a note that we still -@@ -103,8 +116,11 @@ static int memfd_wait_for_pins(struct address_space *mapping) - } - if (clear) - xas_clear_mark(&xas, MEMFD_TAG_PINNED); -- if (++tagged % XA_CHECK_SCHED) -+ -+ latency += cache_count; -+ if (latency < XA_CHECK_SCHED) - continue; -+ latency = 0; - - xas_pause(&xas); - xas_unlock_irq(&xas); -diff --git a/net/batman-adv/hard-interface.c b/net/batman-adv/hard-interface.c -index 18e644f3cb309..5f44c94ad707b 100644 ---- a/net/batman-adv/hard-interface.c -+++ b/net/batman-adv/hard-interface.c -@@ -151,22 +151,25 @@ static bool batadv_is_on_batman_iface(const struct net_device *net_dev) - struct net *net = dev_net(net_dev); - struct net_device *parent_dev; - struct net *parent_net; -+ int iflink; - bool ret; - - /* check if this is a batman-adv mesh interface */ - if (batadv_softif_is_valid(net_dev)) - return true; - -- /* no more parents..stop recursion */ -- if (dev_get_iflink(net_dev) == 0 || -- dev_get_iflink(net_dev) == net_dev->ifindex) -+ iflink = dev_get_iflink(net_dev); -+ if (iflink == 0) - return false; - - parent_net = batadv_getlink_net(net_dev, net); - -+ /* iflink to itself, most likely physical device */ -+ if (net == parent_net && iflink == net_dev->ifindex) -+ return false; -+ - /* recurse over the parent device */ -- parent_dev = __dev_get_by_index((struct net *)parent_net, -- dev_get_iflink(net_dev)); -+ parent_dev = __dev_get_by_index((struct net *)parent_net, iflink); - /* if we got a NULL parent_dev there is something broken.. */ - if (!parent_dev) { - pr_err("Cannot find parent device\n"); -@@ -216,14 +219,15 @@ static struct net_device *batadv_get_real_netdevice(struct net_device *netdev) - struct net_device *real_netdev = NULL; - struct net *real_net; - struct net *net; -- int ifindex; -+ int iflink; - - ASSERT_RTNL(); - - if (!netdev) - return NULL; - -- if (netdev->ifindex == dev_get_iflink(netdev)) { -+ iflink = dev_get_iflink(netdev); -+ if (iflink == 0) { - dev_hold(netdev); - return netdev; - } -@@ -233,9 +237,16 @@ static struct net_device *batadv_get_real_netdevice(struct net_device *netdev) - goto out; - - net = dev_net(hard_iface->soft_iface); -- ifindex = dev_get_iflink(netdev); - real_net = batadv_getlink_net(netdev, net); -- real_netdev = dev_get_by_index(real_net, ifindex); -+ -+ /* iflink to itself, most likely physical device */ -+ if (net == real_net && netdev->ifindex == iflink) { -+ real_netdev = netdev; -+ dev_hold(real_netdev); -+ goto out; -+ } -+ -+ real_netdev = dev_get_by_index(real_net, iflink); - - out: - if (hard_iface) -diff --git a/net/dcb/dcbnl.c b/net/dcb/dcbnl.c -index e9ecbb57df455..b53d5e1d026fe 100644 ---- a/net/dcb/dcbnl.c -+++ b/net/dcb/dcbnl.c -@@ -2063,10 +2063,54 @@ u8 dcb_ieee_getapp_default_prio_mask(const struct net_device *dev) - } - EXPORT_SYMBOL(dcb_ieee_getapp_default_prio_mask); - -+static void dcbnl_flush_dev(struct net_device *dev) -+{ -+ struct dcb_app_type *itr, *tmp; -+ -+ spin_lock_bh(&dcb_lock); -+ -+ list_for_each_entry_safe(itr, tmp, &dcb_app_list, list) { -+ if (itr->ifindex == dev->ifindex) { -+ list_del(&itr->list); -+ kfree(itr); -+ } -+ } -+ -+ spin_unlock_bh(&dcb_lock); -+} -+ -+static int dcbnl_netdevice_event(struct notifier_block *nb, -+ unsigned long event, void *ptr) -+{ -+ struct net_device *dev = netdev_notifier_info_to_dev(ptr); -+ -+ switch (event) { -+ case NETDEV_UNREGISTER: -+ if (!dev->dcbnl_ops) -+ return NOTIFY_DONE; -+ -+ dcbnl_flush_dev(dev); -+ -+ return NOTIFY_OK; -+ default: -+ return NOTIFY_DONE; -+ } -+} -+ -+static struct notifier_block dcbnl_nb __read_mostly = { -+ .notifier_call = dcbnl_netdevice_event, -+}; -+ - static int __init dcbnl_init(void) - { -+ int err; -+ - INIT_LIST_HEAD(&dcb_app_list); - -+ err = register_netdevice_notifier(&dcbnl_nb); -+ if (err) -+ return err; -+ - rtnl_register(PF_UNSPEC, RTM_GETDCB, dcb_doit, NULL, 0); - rtnl_register(PF_UNSPEC, RTM_SETDCB, dcb_doit, NULL, 0); - -diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c -index 86c836fa21459..00210e55b4cd1 100644 ---- a/net/ipv4/esp4.c -+++ b/net/ipv4/esp4.c -@@ -499,7 +499,7 @@ static int esp_output(struct xfrm_state *x, struct sk_buff *skb) - struct xfrm_dst *dst = (struct xfrm_dst *)skb_dst(skb); - u32 padto; - -- padto = min(x->tfcpad, __xfrm_state_mtu(x, dst->child_mtu_cached)); -+ padto = min(x->tfcpad, xfrm_state_mtu(x, dst->child_mtu_cached)); - if (skb->len < padto) - esp.tfclen = padto - skb->len; - } -diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c -index 12570a73def80..7a739f16d82b2 100644 ---- a/net/ipv6/esp6.c -+++ b/net/ipv6/esp6.c -@@ -440,7 +440,7 @@ static int esp6_output(struct xfrm_state *x, struct sk_buff *skb) - struct xfrm_dst *dst = (struct xfrm_dst *)skb_dst(skb); - u32 padto; - -- padto = min(x->tfcpad, __xfrm_state_mtu(x, dst->child_mtu_cached)); -+ padto = min(x->tfcpad, xfrm_state_mtu(x, dst->child_mtu_cached)); - if (skb->len < padto) - esp.tfclen = padto - skb->len; - } -diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c -index d847aa32628da..918a9520d1f17 100644 ---- a/net/ipv6/ip6_output.c -+++ b/net/ipv6/ip6_output.c -@@ -1361,8 +1361,6 @@ static int ip6_setup_cork(struct sock *sk, struct inet_cork_full *cork, - if (np->frag_size) - mtu = np->frag_size; - } -- if (mtu < IPV6_MIN_MTU) -- return -EINVAL; - cork->base.fragsize = mtu; - cork->base.gso_size = ipc6->gso_size; - cork->base.tx_flags = 0; -@@ -1424,8 +1422,6 @@ static int __ip6_append_data(struct sock *sk, - - fragheaderlen = sizeof(struct ipv6hdr) + rt->rt6i_nfheader_len + - (opt ? opt->opt_nflen : 0); -- maxfraglen = ((mtu - fragheaderlen) & ~7) + fragheaderlen - -- sizeof(struct frag_hdr); - - headersize = sizeof(struct ipv6hdr) + - (opt ? opt->opt_flen + opt->opt_nflen : 0) + -@@ -1433,6 +1429,13 @@ static int __ip6_append_data(struct sock *sk, - sizeof(struct frag_hdr) : 0) + - rt->rt6i_nfheader_len; - -+ if (mtu < fragheaderlen || -+ ((mtu - fragheaderlen) & ~7) + fragheaderlen < sizeof(struct frag_hdr)) -+ goto emsgsize; -+ -+ maxfraglen = ((mtu - fragheaderlen) & ~7) + fragheaderlen - -+ sizeof(struct frag_hdr); -+ - /* as per RFC 7112 section 5, the entire IPv6 Header Chain must fit - * the first fragment - */ -diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c -index 464029892478f..ab91683d94596 100644 ---- a/net/mac80211/rx.c -+++ b/net/mac80211/rx.c -@@ -2852,13 +2852,13 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx) - ether_addr_equal(sdata->vif.addr, hdr->addr3)) - return RX_CONTINUE; - -- ac = ieee80211_select_queue_80211(sdata, skb, hdr); -+ ac = ieee802_1d_to_ac[skb->priority]; - q = sdata->vif.hw_queue[ac]; - if (ieee80211_queue_stopped(&local->hw, q)) { - IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_congestion); - return RX_DROP_MONITOR; - } -- skb_set_queue_mapping(skb, q); -+ skb_set_queue_mapping(skb, ac); - - if (!--mesh_hdr->ttl) { - if (!is_multicast_ether_addr(hdr->addr1)) -diff --git a/net/netfilter/core.c b/net/netfilter/core.c -index 5d5bdf4500916..451b2df998ea7 100644 ---- a/net/netfilter/core.c -+++ b/net/netfilter/core.c -@@ -336,14 +336,15 @@ static int __nf_register_net_hook(struct net *net, int pf, - p = nf_entry_dereference(*pp); - new_hooks = nf_hook_entries_grow(p, reg); - -- if (!IS_ERR(new_hooks)) -+ if (!IS_ERR(new_hooks)) { -+ hooks_validate(new_hooks); - rcu_assign_pointer(*pp, new_hooks); -+ } - - mutex_unlock(&nf_hook_mutex); - if (IS_ERR(new_hooks)) - return PTR_ERR(new_hooks); - -- hooks_validate(new_hooks); - #ifdef CONFIG_NETFILTER_INGRESS - if (pf == NFPROTO_NETDEV && reg->hooknum == NF_NETDEV_INGRESS) - net_inc_ingress_queue(); -diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c -index f8f52ff99cfb0..643dbfe7c5815 100644 ---- a/net/netfilter/nf_queue.c -+++ b/net/netfilter/nf_queue.c -@@ -64,6 +64,15 @@ static void nf_queue_entry_release_br_nf_refs(struct sk_buff *skb) - #endif - } - -+static void nf_queue_sock_put(struct sock *sk) -+{ -+#ifdef CONFIG_INET -+ sock_gen_put(sk); -+#else -+ sock_put(sk); -+#endif -+} -+ - void nf_queue_entry_release_refs(struct nf_queue_entry *entry) - { - struct nf_hook_state *state = &entry->state; -@@ -74,7 +83,7 @@ void nf_queue_entry_release_refs(struct nf_queue_entry *entry) - if (state->out) - dev_put(state->out); - if (state->sk) -- sock_put(state->sk); -+ nf_queue_sock_put(state->sk); - - nf_queue_entry_release_br_nf_refs(entry->skb); - } -@@ -99,18 +108,20 @@ static void nf_queue_entry_get_br_nf_refs(struct sk_buff *skb) - } - - /* Bump dev refs so they don't vanish while packet is out */ --void nf_queue_entry_get_refs(struct nf_queue_entry *entry) -+bool nf_queue_entry_get_refs(struct nf_queue_entry *entry) - { - struct nf_hook_state *state = &entry->state; - -+ if (state->sk && !refcount_inc_not_zero(&state->sk->sk_refcnt)) -+ return false; -+ - if (state->in) - dev_hold(state->in); - if (state->out) - dev_hold(state->out); -- if (state->sk) -- sock_hold(state->sk); - - nf_queue_entry_get_br_nf_refs(entry->skb); -+ return true; - } - EXPORT_SYMBOL_GPL(nf_queue_entry_get_refs); - -@@ -201,7 +212,10 @@ static int __nf_queue(struct sk_buff *skb, const struct nf_hook_state *state, - .size = sizeof(*entry) + route_key_size, - }; - -- nf_queue_entry_get_refs(entry); -+ if (!nf_queue_entry_get_refs(entry)) { -+ kfree(entry); -+ return -ENOTCONN; -+ } - - switch (entry->state.pf) { - case AF_INET: -diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c -index ca21f8f4a47c1..7d3ab08a5a2d0 100644 ---- a/net/netfilter/nfnetlink_queue.c -+++ b/net/netfilter/nfnetlink_queue.c -@@ -712,9 +712,15 @@ static struct nf_queue_entry * - nf_queue_entry_dup(struct nf_queue_entry *e) - { - struct nf_queue_entry *entry = kmemdup(e, e->size, GFP_ATOMIC); -- if (entry) -- nf_queue_entry_get_refs(entry); -- return entry; -+ -+ if (!entry) -+ return NULL; -+ -+ if (nf_queue_entry_get_refs(entry)) -+ return entry; -+ -+ kfree(entry); -+ return NULL; - } - - #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER) -diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c -index aeea67f908415..12672019f76c5 100644 ---- a/net/smc/smc_core.c -+++ b/net/smc/smc_core.c -@@ -342,8 +342,8 @@ void smc_conn_free(struct smc_connection *conn) - } else { - smc_cdc_tx_dismiss_slots(conn); - } -- smc_lgr_unregister_conn(conn); - smc_buf_unuse(conn, lgr); /* allow buffer reuse */ -+ smc_lgr_unregister_conn(conn); - conn->lgr = NULL; - - if (!lgr->conns_num) -@@ -632,7 +632,8 @@ int smc_conn_create(struct smc_sock *smc, struct smc_init_info *ini) - !lgr->sync_err && - lgr->vlan_id == ini->vlan_id && - (role == SMC_CLNT || -- lgr->conns_num < SMC_RMBS_PER_LGR_MAX)) { -+ (lgr->conns_num < SMC_RMBS_PER_LGR_MAX && -+ !bitmap_full(lgr->rtokens_used_mask, SMC_RMBS_PER_LGR_MAX)))) { - /* link group found */ - ini->cln_first_contact = SMC_REUSE_CONTACT; - conn->lgr = lgr; -diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c -index 7633d6a74bc2b..f2bc465de2845 100644 ---- a/net/wireless/nl80211.c -+++ b/net/wireless/nl80211.c -@@ -12320,6 +12320,9 @@ static int handle_nan_filter(struct nlattr *attr_filter, - i = 0; - nla_for_each_nested(attr, attr_filter, rem) { - filter[i].filter = nla_memdup(attr, GFP_KERNEL); -+ if (!filter[i].filter) -+ goto err; -+ - filter[i].len = nla_len(attr); - i++; - } -@@ -12332,6 +12335,15 @@ static int handle_nan_filter(struct nlattr *attr_filter, - } - - return 0; -+ -+err: -+ i = 0; -+ nla_for_each_nested(attr, attr_filter, rem) { -+ kfree(filter[i].filter); -+ i++; -+ } -+ kfree(filter); -+ return -ENOMEM; - } - - static int nl80211_nan_add_func(struct sk_buff *skb, -diff --git a/net/xfrm/xfrm_device.c b/net/xfrm/xfrm_device.c -index bb2292b5260c2..d758e9ec3d008 100644 ---- a/net/xfrm/xfrm_device.c -+++ b/net/xfrm/xfrm_device.c -@@ -206,6 +206,9 @@ int xfrm_dev_state_add(struct net *net, struct xfrm_state *x, - if (x->encap || x->tfcpad) - return -EINVAL; - -+ if (xuo->flags & ~(XFRM_OFFLOAD_IPV6 | XFRM_OFFLOAD_INBOUND)) -+ return -EINVAL; -+ - dev = dev_get_by_index(net, xuo->ifindex); - if (!dev) { - if (!(xuo->flags & XFRM_OFFLOAD_INBOUND)) { -@@ -243,7 +246,8 @@ int xfrm_dev_state_add(struct net *net, struct xfrm_state *x, - - xso->dev = dev; - xso->num_exthdrs = 1; -- xso->flags = xuo->flags; -+ /* Don't forward bit that is not implemented */ -+ xso->flags = xuo->flags & ~XFRM_OFFLOAD_IPV6; - - err = dev->xfrmdev_ops->xdo_dev_state_add(x); - if (err) { -diff --git a/net/xfrm/xfrm_interface.c b/net/xfrm/xfrm_interface.c -index 08343201513a9..3932d3aaff270 100644 ---- a/net/xfrm/xfrm_interface.c -+++ b/net/xfrm/xfrm_interface.c -@@ -695,12 +695,12 @@ static int xfrmi_changelink(struct net_device *dev, struct nlattr *tb[], - struct net *net = xi->net; - struct xfrm_if_parms p = {}; - -+ xfrmi_netlink_parms(data, &p); - if (!p.if_id) { - NL_SET_ERR_MSG(extack, "if_id must be non zero"); - return -EINVAL; - } - -- xfrmi_netlink_parms(data, &p); - xi = xfrmi_locate(net, &p); - if (!xi) { - xi = netdev_priv(dev); -diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c -index c6b2c99b501b9..1423e2b7cb42a 100644 ---- a/net/xfrm/xfrm_state.c -+++ b/net/xfrm/xfrm_state.c -@@ -2440,7 +2440,7 @@ void xfrm_state_delete_tunnel(struct xfrm_state *x) - } - EXPORT_SYMBOL(xfrm_state_delete_tunnel); - --u32 __xfrm_state_mtu(struct xfrm_state *x, int mtu) -+u32 xfrm_state_mtu(struct xfrm_state *x, int mtu) - { - const struct xfrm_type *type = READ_ONCE(x->type); - struct crypto_aead *aead; -@@ -2471,17 +2471,7 @@ u32 __xfrm_state_mtu(struct xfrm_state *x, int mtu) - return ((mtu - x->props.header_len - crypto_aead_authsize(aead) - - net_adj) & ~(blksize - 1)) + net_adj - 2; - } --EXPORT_SYMBOL_GPL(__xfrm_state_mtu); -- --u32 xfrm_state_mtu(struct xfrm_state *x, int mtu) --{ -- mtu = __xfrm_state_mtu(x, mtu); -- -- if (x->props.family == AF_INET6 && mtu < IPV6_MIN_MTU) -- return IPV6_MIN_MTU; -- -- return mtu; --} -+EXPORT_SYMBOL_GPL(xfrm_state_mtu); - - int __xfrm_init_state(struct xfrm_state *x, bool init_replay, bool offload) - { -diff --git a/sound/soc/codecs/cs4265.c b/sound/soc/codecs/cs4265.c -index 2fb65f246b0cf..77af5b67b9bb4 100644 ---- a/sound/soc/codecs/cs4265.c -+++ b/sound/soc/codecs/cs4265.c -@@ -150,7 +150,6 @@ static const struct snd_kcontrol_new cs4265_snd_controls[] = { - SOC_SINGLE("E to F Buffer Disable Switch", CS4265_SPDIF_CTL1, - 6, 1, 0), - SOC_ENUM("C Data Access", cam_mode_enum), -- SOC_SINGLE("SPDIF Switch", CS4265_SPDIF_CTL2, 5, 1, 1), - SOC_SINGLE("Validity Bit Control Switch", CS4265_SPDIF_CTL2, - 3, 1, 0), - SOC_ENUM("SPDIF Mono/Stereo", spdif_mono_stereo_enum), -@@ -186,7 +185,7 @@ static const struct snd_soc_dapm_widget cs4265_dapm_widgets[] = { - - SND_SOC_DAPM_SWITCH("Loopback", SND_SOC_NOPM, 0, 0, - &loopback_ctl), -- SND_SOC_DAPM_SWITCH("SPDIF", SND_SOC_NOPM, 0, 0, -+ SND_SOC_DAPM_SWITCH("SPDIF", CS4265_SPDIF_CTL2, 5, 1, - &spdif_switch), - SND_SOC_DAPM_SWITCH("DAC", CS4265_PWRCTL, 1, 1, - &dac_switch), -diff --git a/sound/soc/codecs/rt5668.c b/sound/soc/codecs/rt5668.c -index 5716cede99cb4..acc2b34ca334a 100644 ---- a/sound/soc/codecs/rt5668.c -+++ b/sound/soc/codecs/rt5668.c -@@ -1022,11 +1022,13 @@ static void rt5668_jack_detect_handler(struct work_struct *work) - container_of(work, struct rt5668_priv, jack_detect_work.work); - int val, btn_type; - -- while (!rt5668->component) -- usleep_range(10000, 15000); -- -- while (!rt5668->component->card->instantiated) -- usleep_range(10000, 15000); -+ if (!rt5668->component || !rt5668->component->card || -+ !rt5668->component->card->instantiated) { -+ /* card not yet ready, try later */ -+ mod_delayed_work(system_power_efficient_wq, -+ &rt5668->jack_detect_work, msecs_to_jiffies(15)); -+ return; -+ } - - mutex_lock(&rt5668->calibrate_mutex); - -diff --git a/sound/soc/codecs/rt5682.c b/sound/soc/codecs/rt5682.c -index 05e883a65d7a7..a8cf4c7451304 100644 ---- a/sound/soc/codecs/rt5682.c -+++ b/sound/soc/codecs/rt5682.c -@@ -1052,11 +1052,13 @@ static void rt5682_jack_detect_handler(struct work_struct *work) - container_of(work, struct rt5682_priv, jack_detect_work.work); - int val, btn_type; - -- while (!rt5682->component) -- usleep_range(10000, 15000); -- -- while (!rt5682->component->card->instantiated) -- usleep_range(10000, 15000); -+ if (!rt5682->component || !rt5682->component->card || -+ !rt5682->component->card->instantiated) { -+ /* card not yet ready, try later */ -+ mod_delayed_work(system_power_efficient_wq, -+ &rt5682->jack_detect_work, msecs_to_jiffies(15)); -+ return; -+ } - - mutex_lock(&rt5682->calibrate_mutex); - -diff --git a/sound/soc/soc-ops.c b/sound/soc/soc-ops.c -index f5dcd625e4355..c88bc6bb41cfe 100644 ---- a/sound/soc/soc-ops.c -+++ b/sound/soc/soc-ops.c -@@ -323,7 +323,7 @@ int snd_soc_put_volsw(struct snd_kcontrol *kcontrol, - mask = BIT(sign_bit + 1) - 1; - - val = ucontrol->value.integer.value[0]; -- if (mc->platform_max && val > mc->platform_max) -+ if (mc->platform_max && ((int)val + min) > mc->platform_max) - return -EINVAL; - if (val > max - min) - return -EINVAL; -@@ -336,7 +336,7 @@ int snd_soc_put_volsw(struct snd_kcontrol *kcontrol, - val = val << shift; - if (snd_soc_volsw_is_stereo(mc)) { - val2 = ucontrol->value.integer.value[1]; -- if (mc->platform_max && val2 > mc->platform_max) -+ if (mc->platform_max && ((int)val2 + min) > mc->platform_max) - return -EINVAL; - if (val2 > max - min) - return -EINVAL; -diff --git a/sound/x86/intel_hdmi_audio.c b/sound/x86/intel_hdmi_audio.c -index 5fd4e32247a6d..a314f13e3292e 100644 ---- a/sound/x86/intel_hdmi_audio.c -+++ b/sound/x86/intel_hdmi_audio.c -@@ -1279,7 +1279,7 @@ static int had_pcm_mmap(struct snd_pcm_substream *substream, - { - vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot); - return remap_pfn_range(vma, vma->vm_start, -- substream->dma_buffer.addr >> PAGE_SHIFT, -+ substream->runtime->dma_addr >> PAGE_SHIFT, - vma->vm_end - vma->vm_start, vma->vm_page_prot); - } - diff --git a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.183-184.patch b/patch/kernel/archive/odroidxu4-5.4/patch-5.4.183-184.patch deleted file mode 100644 index d52850177..000000000 --- a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.183-184.patch +++ /dev/null @@ -1,2222 +0,0 @@ -diff --git a/Documentation/admin-guide/hw-vuln/spectre.rst b/Documentation/admin-guide/hw-vuln/spectre.rst -index 985181dba0bac..6bd97cd50d625 100644 ---- a/Documentation/admin-guide/hw-vuln/spectre.rst -+++ b/Documentation/admin-guide/hw-vuln/spectre.rst -@@ -60,8 +60,8 @@ privileged data touched during the speculative execution. - Spectre variant 1 attacks take advantage of speculative execution of - conditional branches, while Spectre variant 2 attacks use speculative - execution of indirect branches to leak privileged memory. --See :ref:`[1] ` :ref:`[5] ` :ref:`[7] ` --:ref:`[10] ` :ref:`[11] `. -+See :ref:`[1] ` :ref:`[5] ` :ref:`[6] ` -+:ref:`[7] ` :ref:`[10] ` :ref:`[11] `. - - Spectre variant 1 (Bounds Check Bypass) - --------------------------------------- -@@ -131,6 +131,19 @@ steer its indirect branch speculations to gadget code, and measure the - speculative execution's side effects left in level 1 cache to infer the - victim's data. - -+Yet another variant 2 attack vector is for the attacker to poison the -+Branch History Buffer (BHB) to speculatively steer an indirect branch -+to a specific Branch Target Buffer (BTB) entry, even if the entry isn't -+associated with the source address of the indirect branch. Specifically, -+the BHB might be shared across privilege levels even in the presence of -+Enhanced IBRS. -+ -+Currently the only known real-world BHB attack vector is via -+unprivileged eBPF. Therefore, it's highly recommended to not enable -+unprivileged eBPF, especially when eIBRS is used (without retpolines). -+For a full mitigation against BHB attacks, it's recommended to use -+retpolines (or eIBRS combined with retpolines). -+ - Attack scenarios - ---------------- - -@@ -364,13 +377,15 @@ The possible values in this file are: - - - Kernel status: - -- ==================================== ================================= -- 'Not affected' The processor is not vulnerable -- 'Vulnerable' Vulnerable, no mitigation -- 'Mitigation: Full generic retpoline' Software-focused mitigation -- 'Mitigation: Full AMD retpoline' AMD-specific software mitigation -- 'Mitigation: Enhanced IBRS' Hardware-focused mitigation -- ==================================== ================================= -+ ======================================== ================================= -+ 'Not affected' The processor is not vulnerable -+ 'Mitigation: None' Vulnerable, no mitigation -+ 'Mitigation: Retpolines' Use Retpoline thunks -+ 'Mitigation: LFENCE' Use LFENCE instructions -+ 'Mitigation: Enhanced IBRS' Hardware-focused mitigation -+ 'Mitigation: Enhanced IBRS + Retpolines' Hardware-focused + Retpolines -+ 'Mitigation: Enhanced IBRS + LFENCE' Hardware-focused + LFENCE -+ ======================================== ================================= - - - Firmware status: Show if Indirect Branch Restricted Speculation (IBRS) is - used to protect against Spectre variant 2 attacks when calling firmware (x86 only). -@@ -584,12 +599,13 @@ kernel command line. - - Specific mitigations can also be selected manually: - -- retpoline -- replace indirect branches -- retpoline,generic -- google's original retpoline -- retpoline,amd -- AMD-specific minimal thunk -+ retpoline auto pick between generic,lfence -+ retpoline,generic Retpolines -+ retpoline,lfence LFENCE; indirect branch -+ retpoline,amd alias for retpoline,lfence -+ eibrs enhanced IBRS -+ eibrs,retpoline enhanced IBRS + Retpolines -+ eibrs,lfence enhanced IBRS + LFENCE - - Not specifying this option is equivalent to - spectre_v2=auto. -@@ -730,7 +746,7 @@ AMD white papers: - - .. _spec_ref6: - --[6] `Software techniques for managing speculation on AMD processors `_. -+[6] `Software techniques for managing speculation on AMD processors `_. - - ARM white papers: - -diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt -index 165abcb656c5b..979423e1b639f 100644 ---- a/Documentation/admin-guide/kernel-parameters.txt -+++ b/Documentation/admin-guide/kernel-parameters.txt -@@ -4493,8 +4493,12 @@ - Specific mitigations can also be selected manually: - - retpoline - replace indirect branches -- retpoline,generic - google's original retpoline -- retpoline,amd - AMD-specific minimal thunk -+ retpoline,generic - Retpolines -+ retpoline,lfence - LFENCE; indirect branch -+ retpoline,amd - alias for retpoline,lfence -+ eibrs - enhanced IBRS -+ eibrs,retpoline - enhanced IBRS + Retpolines -+ eibrs,lfence - enhanced IBRS + LFENCE - - Not specifying this option is equivalent to - spectre_v2=auto. -diff --git a/Makefile b/Makefile -index a94b5ea499e13..e914e1a8a7d2c 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 5 - PATCHLEVEL = 4 --SUBLEVEL = 183 -+SUBLEVEL = 184 - EXTRAVERSION = - NAME = Kleptomaniac Octopus - -diff --git a/arch/arm/include/asm/assembler.h b/arch/arm/include/asm/assembler.h -index 3546d294d55fa..6b3e64e19fb6f 100644 ---- a/arch/arm/include/asm/assembler.h -+++ b/arch/arm/include/asm/assembler.h -@@ -107,6 +107,16 @@ - .endm - #endif - -+#if __LINUX_ARM_ARCH__ < 7 -+ .macro dsb, args -+ mcr p15, 0, r0, c7, c10, 4 -+ .endm -+ -+ .macro isb, args -+ mcr p15, 0, r0, c7, c5, 4 -+ .endm -+#endif -+ - .macro asm_trace_hardirqs_off, save=1 - #if defined(CONFIG_TRACE_IRQFLAGS) - .if \save -diff --git a/arch/arm/include/asm/spectre.h b/arch/arm/include/asm/spectre.h -new file mode 100644 -index 0000000000000..d1fa5607d3aa3 ---- /dev/null -+++ b/arch/arm/include/asm/spectre.h -@@ -0,0 +1,32 @@ -+/* SPDX-License-Identifier: GPL-2.0-only */ -+ -+#ifndef __ASM_SPECTRE_H -+#define __ASM_SPECTRE_H -+ -+enum { -+ SPECTRE_UNAFFECTED, -+ SPECTRE_MITIGATED, -+ SPECTRE_VULNERABLE, -+}; -+ -+enum { -+ __SPECTRE_V2_METHOD_BPIALL, -+ __SPECTRE_V2_METHOD_ICIALLU, -+ __SPECTRE_V2_METHOD_SMC, -+ __SPECTRE_V2_METHOD_HVC, -+ __SPECTRE_V2_METHOD_LOOP8, -+}; -+ -+enum { -+ SPECTRE_V2_METHOD_BPIALL = BIT(__SPECTRE_V2_METHOD_BPIALL), -+ SPECTRE_V2_METHOD_ICIALLU = BIT(__SPECTRE_V2_METHOD_ICIALLU), -+ SPECTRE_V2_METHOD_SMC = BIT(__SPECTRE_V2_METHOD_SMC), -+ SPECTRE_V2_METHOD_HVC = BIT(__SPECTRE_V2_METHOD_HVC), -+ SPECTRE_V2_METHOD_LOOP8 = BIT(__SPECTRE_V2_METHOD_LOOP8), -+}; -+ -+void spectre_v2_update_state(unsigned int state, unsigned int methods); -+ -+int spectre_bhb_update_vectors(unsigned int method); -+ -+#endif -diff --git a/arch/arm/kernel/Makefile b/arch/arm/kernel/Makefile -index 8b679e2ca3c3d..dc31426cae6d8 100644 ---- a/arch/arm/kernel/Makefile -+++ b/arch/arm/kernel/Makefile -@@ -106,4 +106,6 @@ endif - - obj-$(CONFIG_HAVE_ARM_SMCCC) += smccc-call.o - -+obj-$(CONFIG_GENERIC_CPU_VULNERABILITIES) += spectre.o -+ - extra-y := $(head-y) vmlinux.lds -diff --git a/arch/arm/kernel/entry-armv.S b/arch/arm/kernel/entry-armv.S -index 4937d514318ec..94d25425b7bce 100644 ---- a/arch/arm/kernel/entry-armv.S -+++ b/arch/arm/kernel/entry-armv.S -@@ -1005,12 +1005,11 @@ vector_\name: - sub lr, lr, #\correction - .endif - -- @ -- @ Save r0, lr_ (parent PC) and spsr_ -- @ (parent CPSR) -- @ -+ @ Save r0, lr_ (parent PC) - stmia sp, {r0, lr} @ save r0, lr -- mrs lr, spsr -+ -+ @ Save spsr_ (parent CPSR) -+2: mrs lr, spsr - str lr, [sp, #8] @ save spsr - - @ -@@ -1031,6 +1030,44 @@ vector_\name: - movs pc, lr @ branch to handler in SVC mode - ENDPROC(vector_\name) - -+#ifdef CONFIG_HARDEN_BRANCH_HISTORY -+ .subsection 1 -+ .align 5 -+vector_bhb_loop8_\name: -+ .if \correction -+ sub lr, lr, #\correction -+ .endif -+ -+ @ Save r0, lr_ (parent PC) -+ stmia sp, {r0, lr} -+ -+ @ bhb workaround -+ mov r0, #8 -+1: b . + 4 -+ subs r0, r0, #1 -+ bne 1b -+ dsb -+ isb -+ b 2b -+ENDPROC(vector_bhb_loop8_\name) -+ -+vector_bhb_bpiall_\name: -+ .if \correction -+ sub lr, lr, #\correction -+ .endif -+ -+ @ Save r0, lr_ (parent PC) -+ stmia sp, {r0, lr} -+ -+ @ bhb workaround -+ mcr p15, 0, r0, c7, c5, 6 @ BPIALL -+ @ isb not needed due to "movs pc, lr" in the vector stub -+ @ which gives a "context synchronisation". -+ b 2b -+ENDPROC(vector_bhb_bpiall_\name) -+ .previous -+#endif -+ - .align 2 - @ handler addresses follow this label - 1: -@@ -1039,6 +1076,10 @@ ENDPROC(vector_\name) - .section .stubs, "ax", %progbits - @ This must be the first word - .word vector_swi -+#ifdef CONFIG_HARDEN_BRANCH_HISTORY -+ .word vector_bhb_loop8_swi -+ .word vector_bhb_bpiall_swi -+#endif - - vector_rst: - ARM( swi SYS_ERROR0 ) -@@ -1153,8 +1194,10 @@ vector_addrexcptn: - * FIQ "NMI" handler - *----------------------------------------------------------------------------- - * Handle a FIQ using the SVC stack allowing FIQ act like NMI on x86 -- * systems. -+ * systems. This must be the last vector stub, so lets place it in its own -+ * subsection. - */ -+ .subsection 2 - vector_stub fiq, FIQ_MODE, 4 - - .long __fiq_usr @ 0 (USR_26 / USR_32) -@@ -1187,6 +1230,30 @@ vector_addrexcptn: - W(b) vector_irq - W(b) vector_fiq - -+#ifdef CONFIG_HARDEN_BRANCH_HISTORY -+ .section .vectors.bhb.loop8, "ax", %progbits -+.L__vectors_bhb_loop8_start: -+ W(b) vector_rst -+ W(b) vector_bhb_loop8_und -+ W(ldr) pc, .L__vectors_bhb_loop8_start + 0x1004 -+ W(b) vector_bhb_loop8_pabt -+ W(b) vector_bhb_loop8_dabt -+ W(b) vector_addrexcptn -+ W(b) vector_bhb_loop8_irq -+ W(b) vector_bhb_loop8_fiq -+ -+ .section .vectors.bhb.bpiall, "ax", %progbits -+.L__vectors_bhb_bpiall_start: -+ W(b) vector_rst -+ W(b) vector_bhb_bpiall_und -+ W(ldr) pc, .L__vectors_bhb_bpiall_start + 0x1008 -+ W(b) vector_bhb_bpiall_pabt -+ W(b) vector_bhb_bpiall_dabt -+ W(b) vector_addrexcptn -+ W(b) vector_bhb_bpiall_irq -+ W(b) vector_bhb_bpiall_fiq -+#endif -+ - .data - .align 2 - -diff --git a/arch/arm/kernel/entry-common.S b/arch/arm/kernel/entry-common.S -index 271cb8a1eba1e..bd619da73c84e 100644 ---- a/arch/arm/kernel/entry-common.S -+++ b/arch/arm/kernel/entry-common.S -@@ -162,6 +162,29 @@ ENDPROC(ret_from_fork) - *----------------------------------------------------------------------------- - */ - -+ .align 5 -+#ifdef CONFIG_HARDEN_BRANCH_HISTORY -+ENTRY(vector_bhb_loop8_swi) -+ sub sp, sp, #PT_REGS_SIZE -+ stmia sp, {r0 - r12} -+ mov r8, #8 -+1: b 2f -+2: subs r8, r8, #1 -+ bne 1b -+ dsb -+ isb -+ b 3f -+ENDPROC(vector_bhb_loop8_swi) -+ -+ .align 5 -+ENTRY(vector_bhb_bpiall_swi) -+ sub sp, sp, #PT_REGS_SIZE -+ stmia sp, {r0 - r12} -+ mcr p15, 0, r8, c7, c5, 6 @ BPIALL -+ isb -+ b 3f -+ENDPROC(vector_bhb_bpiall_swi) -+#endif - .align 5 - ENTRY(vector_swi) - #ifdef CONFIG_CPU_V7M -@@ -169,6 +192,7 @@ ENTRY(vector_swi) - #else - sub sp, sp, #PT_REGS_SIZE - stmia sp, {r0 - r12} @ Calling r0 - r12 -+3: - ARM( add r8, sp, #S_PC ) - ARM( stmdb r8, {sp, lr}^ ) @ Calling sp, lr - THUMB( mov r8, sp ) -diff --git a/arch/arm/kernel/spectre.c b/arch/arm/kernel/spectre.c -new file mode 100644 -index 0000000000000..0dcefc36fb7a0 ---- /dev/null -+++ b/arch/arm/kernel/spectre.c -@@ -0,0 +1,71 @@ -+// SPDX-License-Identifier: GPL-2.0-only -+#include -+#include -+#include -+ -+#include -+ -+static bool _unprivileged_ebpf_enabled(void) -+{ -+#ifdef CONFIG_BPF_SYSCALL -+ return !sysctl_unprivileged_bpf_disabled; -+#else -+ return false; -+#endif -+} -+ -+ssize_t cpu_show_spectre_v1(struct device *dev, struct device_attribute *attr, -+ char *buf) -+{ -+ return sprintf(buf, "Mitigation: __user pointer sanitization\n"); -+} -+ -+static unsigned int spectre_v2_state; -+static unsigned int spectre_v2_methods; -+ -+void spectre_v2_update_state(unsigned int state, unsigned int method) -+{ -+ if (state > spectre_v2_state) -+ spectre_v2_state = state; -+ spectre_v2_methods |= method; -+} -+ -+ssize_t cpu_show_spectre_v2(struct device *dev, struct device_attribute *attr, -+ char *buf) -+{ -+ const char *method; -+ -+ if (spectre_v2_state == SPECTRE_UNAFFECTED) -+ return sprintf(buf, "%s\n", "Not affected"); -+ -+ if (spectre_v2_state != SPECTRE_MITIGATED) -+ return sprintf(buf, "%s\n", "Vulnerable"); -+ -+ if (_unprivileged_ebpf_enabled()) -+ return sprintf(buf, "Vulnerable: Unprivileged eBPF enabled\n"); -+ -+ switch (spectre_v2_methods) { -+ case SPECTRE_V2_METHOD_BPIALL: -+ method = "Branch predictor hardening"; -+ break; -+ -+ case SPECTRE_V2_METHOD_ICIALLU: -+ method = "I-cache invalidation"; -+ break; -+ -+ case SPECTRE_V2_METHOD_SMC: -+ case SPECTRE_V2_METHOD_HVC: -+ method = "Firmware call"; -+ break; -+ -+ case SPECTRE_V2_METHOD_LOOP8: -+ method = "History overwrite"; -+ break; -+ -+ default: -+ method = "Multiple mitigations"; -+ break; -+ } -+ -+ return sprintf(buf, "Mitigation: %s\n", method); -+} -diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c -index 97a512551b217..207ef9a797bd4 100644 ---- a/arch/arm/kernel/traps.c -+++ b/arch/arm/kernel/traps.c -@@ -30,6 +30,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -799,10 +800,59 @@ static inline void __init kuser_init(void *vectors) - } - #endif - -+#ifndef CONFIG_CPU_V7M -+static void copy_from_lma(void *vma, void *lma_start, void *lma_end) -+{ -+ memcpy(vma, lma_start, lma_end - lma_start); -+} -+ -+static void flush_vectors(void *vma, size_t offset, size_t size) -+{ -+ unsigned long start = (unsigned long)vma + offset; -+ unsigned long end = start + size; -+ -+ flush_icache_range(start, end); -+} -+ -+#ifdef CONFIG_HARDEN_BRANCH_HISTORY -+int spectre_bhb_update_vectors(unsigned int method) -+{ -+ extern char __vectors_bhb_bpiall_start[], __vectors_bhb_bpiall_end[]; -+ extern char __vectors_bhb_loop8_start[], __vectors_bhb_loop8_end[]; -+ void *vec_start, *vec_end; -+ -+ if (system_state > SYSTEM_SCHEDULING) { -+ pr_err("CPU%u: Spectre BHB workaround too late - system vulnerable\n", -+ smp_processor_id()); -+ return SPECTRE_VULNERABLE; -+ } -+ -+ switch (method) { -+ case SPECTRE_V2_METHOD_LOOP8: -+ vec_start = __vectors_bhb_loop8_start; -+ vec_end = __vectors_bhb_loop8_end; -+ break; -+ -+ case SPECTRE_V2_METHOD_BPIALL: -+ vec_start = __vectors_bhb_bpiall_start; -+ vec_end = __vectors_bhb_bpiall_end; -+ break; -+ -+ default: -+ pr_err("CPU%u: unknown Spectre BHB state %d\n", -+ smp_processor_id(), method); -+ return SPECTRE_VULNERABLE; -+ } -+ -+ copy_from_lma(vectors_page, vec_start, vec_end); -+ flush_vectors(vectors_page, 0, vec_end - vec_start); -+ -+ return SPECTRE_MITIGATED; -+} -+#endif -+ - void __init early_trap_init(void *vectors_base) - { --#ifndef CONFIG_CPU_V7M -- unsigned long vectors = (unsigned long)vectors_base; - extern char __stubs_start[], __stubs_end[]; - extern char __vectors_start[], __vectors_end[]; - unsigned i; -@@ -823,17 +873,20 @@ void __init early_trap_init(void *vectors_base) - * into the vector page, mapped at 0xffff0000, and ensure these - * are visible to the instruction stream. - */ -- memcpy((void *)vectors, __vectors_start, __vectors_end - __vectors_start); -- memcpy((void *)vectors + 0x1000, __stubs_start, __stubs_end - __stubs_start); -+ copy_from_lma(vectors_base, __vectors_start, __vectors_end); -+ copy_from_lma(vectors_base + 0x1000, __stubs_start, __stubs_end); - - kuser_init(vectors_base); - -- flush_icache_range(vectors, vectors + PAGE_SIZE * 2); -+ flush_vectors(vectors_base, 0, PAGE_SIZE * 2); -+} - #else /* ifndef CONFIG_CPU_V7M */ -+void __init early_trap_init(void *vectors_base) -+{ - /* - * on V7-M there is no need to copy the vector table to a dedicated - * memory area. The address is configurable and so a table in the kernel - * image can be used. - */ --#endif - } -+#endif -diff --git a/arch/arm/kernel/vmlinux.lds.h b/arch/arm/kernel/vmlinux.lds.h -index 8247bc15addc4..78d156e4f0088 100644 ---- a/arch/arm/kernel/vmlinux.lds.h -+++ b/arch/arm/kernel/vmlinux.lds.h -@@ -25,6 +25,19 @@ - #define ARM_MMU_DISCARD(x) x - #endif - -+/* -+ * ld.lld does not support NOCROSSREFS: -+ * https://github.com/ClangBuiltLinux/linux/issues/1609 -+ */ -+#ifdef CONFIG_LD_IS_LLD -+#define NOCROSSREFS -+#endif -+ -+/* Set start/end symbol names to the LMA for the section */ -+#define ARM_LMA(sym, section) \ -+ sym##_start = LOADADDR(section); \ -+ sym##_end = LOADADDR(section) + SIZEOF(section) -+ - #define PROC_INFO \ - . = ALIGN(4); \ - __proc_info_begin = .; \ -@@ -100,19 +113,31 @@ - * only thing that matters is their relative offsets - */ - #define ARM_VECTORS \ -- __vectors_start = .; \ -- .vectors 0xffff0000 : AT(__vectors_start) { \ -- *(.vectors) \ -+ __vectors_lma = .; \ -+ OVERLAY 0xffff0000 : NOCROSSREFS AT(__vectors_lma) { \ -+ .vectors { \ -+ *(.vectors) \ -+ } \ -+ .vectors.bhb.loop8 { \ -+ *(.vectors.bhb.loop8) \ -+ } \ -+ .vectors.bhb.bpiall { \ -+ *(.vectors.bhb.bpiall) \ -+ } \ - } \ -- . = __vectors_start + SIZEOF(.vectors); \ -- __vectors_end = .; \ -+ ARM_LMA(__vectors, .vectors); \ -+ ARM_LMA(__vectors_bhb_loop8, .vectors.bhb.loop8); \ -+ ARM_LMA(__vectors_bhb_bpiall, .vectors.bhb.bpiall); \ -+ . = __vectors_lma + SIZEOF(.vectors) + \ -+ SIZEOF(.vectors.bhb.loop8) + \ -+ SIZEOF(.vectors.bhb.bpiall); \ - \ -- __stubs_start = .; \ -- .stubs ADDR(.vectors) + 0x1000 : AT(__stubs_start) { \ -+ __stubs_lma = .; \ -+ .stubs ADDR(.vectors) + 0x1000 : AT(__stubs_lma) { \ - *(.stubs) \ - } \ -- . = __stubs_start + SIZEOF(.stubs); \ -- __stubs_end = .; \ -+ ARM_LMA(__stubs, .stubs); \ -+ . = __stubs_lma + SIZEOF(.stubs); \ - \ - PROVIDE(vector_fiq_offset = vector_fiq - ADDR(.vectors)); - -diff --git a/arch/arm/mm/Kconfig b/arch/arm/mm/Kconfig -index 64cce0c8560ab..00ffee644372e 100644 ---- a/arch/arm/mm/Kconfig -+++ b/arch/arm/mm/Kconfig -@@ -833,6 +833,7 @@ config CPU_BPREDICT_DISABLE - - config CPU_SPECTRE - bool -+ select GENERIC_CPU_VULNERABILITIES - - config HARDEN_BRANCH_PREDICTOR - bool "Harden the branch predictor against aliasing attacks" if EXPERT -@@ -853,6 +854,16 @@ config HARDEN_BRANCH_PREDICTOR - - If unsure, say Y. - -+config HARDEN_BRANCH_HISTORY -+ bool "Harden Spectre style attacks against branch history" if EXPERT -+ depends on CPU_SPECTRE -+ default y -+ help -+ Speculation attacks against some high-performance processors can -+ make use of branch history to influence future speculation. When -+ taking an exception, a sequence of branches overwrites the branch -+ history, or branch history is invalidated. -+ - config TLS_REG_EMUL - bool - select NEED_KUSER_HELPERS -diff --git a/arch/arm/mm/proc-v7-bugs.c b/arch/arm/mm/proc-v7-bugs.c -index a6554fdb56c54..097ef85bb7f21 100644 ---- a/arch/arm/mm/proc-v7-bugs.c -+++ b/arch/arm/mm/proc-v7-bugs.c -@@ -7,8 +7,35 @@ - #include - #include - #include -+#include - #include - -+#ifdef CONFIG_ARM_PSCI -+static int __maybe_unused spectre_v2_get_cpu_fw_mitigation_state(void) -+{ -+ struct arm_smccc_res res; -+ -+ arm_smccc_1_1_invoke(ARM_SMCCC_ARCH_FEATURES_FUNC_ID, -+ ARM_SMCCC_ARCH_WORKAROUND_1, &res); -+ -+ switch ((int)res.a0) { -+ case SMCCC_RET_SUCCESS: -+ return SPECTRE_MITIGATED; -+ -+ case SMCCC_ARCH_WORKAROUND_RET_UNAFFECTED: -+ return SPECTRE_UNAFFECTED; -+ -+ default: -+ return SPECTRE_VULNERABLE; -+ } -+} -+#else -+static int __maybe_unused spectre_v2_get_cpu_fw_mitigation_state(void) -+{ -+ return SPECTRE_VULNERABLE; -+} -+#endif -+ - #ifdef CONFIG_HARDEN_BRANCH_PREDICTOR - DEFINE_PER_CPU(harden_branch_predictor_fn_t, harden_branch_predictor_fn); - -@@ -37,13 +64,61 @@ static void __maybe_unused call_hvc_arch_workaround_1(void) - arm_smccc_1_1_hvc(ARM_SMCCC_ARCH_WORKAROUND_1, NULL); - } - --static void cpu_v7_spectre_init(void) -+static unsigned int spectre_v2_install_workaround(unsigned int method) - { - const char *spectre_v2_method = NULL; - int cpu = smp_processor_id(); - - if (per_cpu(harden_branch_predictor_fn, cpu)) -- return; -+ return SPECTRE_MITIGATED; -+ -+ switch (method) { -+ case SPECTRE_V2_METHOD_BPIALL: -+ per_cpu(harden_branch_predictor_fn, cpu) = -+ harden_branch_predictor_bpiall; -+ spectre_v2_method = "BPIALL"; -+ break; -+ -+ case SPECTRE_V2_METHOD_ICIALLU: -+ per_cpu(harden_branch_predictor_fn, cpu) = -+ harden_branch_predictor_iciallu; -+ spectre_v2_method = "ICIALLU"; -+ break; -+ -+ case SPECTRE_V2_METHOD_HVC: -+ per_cpu(harden_branch_predictor_fn, cpu) = -+ call_hvc_arch_workaround_1; -+ cpu_do_switch_mm = cpu_v7_hvc_switch_mm; -+ spectre_v2_method = "hypervisor"; -+ break; -+ -+ case SPECTRE_V2_METHOD_SMC: -+ per_cpu(harden_branch_predictor_fn, cpu) = -+ call_smc_arch_workaround_1; -+ cpu_do_switch_mm = cpu_v7_smc_switch_mm; -+ spectre_v2_method = "firmware"; -+ break; -+ } -+ -+ if (spectre_v2_method) -+ pr_info("CPU%u: Spectre v2: using %s workaround\n", -+ smp_processor_id(), spectre_v2_method); -+ -+ return SPECTRE_MITIGATED; -+} -+#else -+static unsigned int spectre_v2_install_workaround(unsigned int method) -+{ -+ pr_info("CPU%u: Spectre V2: workarounds disabled by configuration\n", -+ smp_processor_id()); -+ -+ return SPECTRE_VULNERABLE; -+} -+#endif -+ -+static void cpu_v7_spectre_v2_init(void) -+{ -+ unsigned int state, method = 0; - - switch (read_cpuid_part()) { - case ARM_CPU_PART_CORTEX_A8: -@@ -52,32 +127,37 @@ static void cpu_v7_spectre_init(void) - case ARM_CPU_PART_CORTEX_A17: - case ARM_CPU_PART_CORTEX_A73: - case ARM_CPU_PART_CORTEX_A75: -- per_cpu(harden_branch_predictor_fn, cpu) = -- harden_branch_predictor_bpiall; -- spectre_v2_method = "BPIALL"; -+ state = SPECTRE_MITIGATED; -+ method = SPECTRE_V2_METHOD_BPIALL; - break; - - case ARM_CPU_PART_CORTEX_A15: - case ARM_CPU_PART_BRAHMA_B15: -- per_cpu(harden_branch_predictor_fn, cpu) = -- harden_branch_predictor_iciallu; -- spectre_v2_method = "ICIALLU"; -+ state = SPECTRE_MITIGATED; -+ method = SPECTRE_V2_METHOD_ICIALLU; - break; - --#ifdef CONFIG_ARM_PSCI - case ARM_CPU_PART_BRAHMA_B53: - /* Requires no workaround */ -+ state = SPECTRE_UNAFFECTED; - break; -+ - default: - /* Other ARM CPUs require no workaround */ -- if (read_cpuid_implementor() == ARM_CPU_IMP_ARM) -+ if (read_cpuid_implementor() == ARM_CPU_IMP_ARM) { -+ state = SPECTRE_UNAFFECTED; - break; -+ } - /* fallthrough */ -- /* Cortex A57/A72 require firmware workaround */ -+ /* Cortex A57/A72 require firmware workaround */ - case ARM_CPU_PART_CORTEX_A57: - case ARM_CPU_PART_CORTEX_A72: { - struct arm_smccc_res res; - -+ state = spectre_v2_get_cpu_fw_mitigation_state(); -+ if (state != SPECTRE_MITIGATED) -+ break; -+ - if (psci_ops.smccc_version == SMCCC_VERSION_1_0) - break; - -@@ -87,10 +167,7 @@ static void cpu_v7_spectre_init(void) - ARM_SMCCC_ARCH_WORKAROUND_1, &res); - if ((int)res.a0 != 0) - break; -- per_cpu(harden_branch_predictor_fn, cpu) = -- call_hvc_arch_workaround_1; -- cpu_do_switch_mm = cpu_v7_hvc_switch_mm; -- spectre_v2_method = "hypervisor"; -+ method = SPECTRE_V2_METHOD_HVC; - break; - - case PSCI_CONDUIT_SMC: -@@ -98,29 +175,97 @@ static void cpu_v7_spectre_init(void) - ARM_SMCCC_ARCH_WORKAROUND_1, &res); - if ((int)res.a0 != 0) - break; -- per_cpu(harden_branch_predictor_fn, cpu) = -- call_smc_arch_workaround_1; -- cpu_do_switch_mm = cpu_v7_smc_switch_mm; -- spectre_v2_method = "firmware"; -+ method = SPECTRE_V2_METHOD_SMC; - break; - - default: -+ state = SPECTRE_VULNERABLE; - break; - } - } --#endif - } - -- if (spectre_v2_method) -- pr_info("CPU%u: Spectre v2: using %s workaround\n", -- smp_processor_id(), spectre_v2_method); -+ if (state == SPECTRE_MITIGATED) -+ state = spectre_v2_install_workaround(method); -+ -+ spectre_v2_update_state(state, method); -+} -+ -+#ifdef CONFIG_HARDEN_BRANCH_HISTORY -+static int spectre_bhb_method; -+ -+static const char *spectre_bhb_method_name(int method) -+{ -+ switch (method) { -+ case SPECTRE_V2_METHOD_LOOP8: -+ return "loop"; -+ -+ case SPECTRE_V2_METHOD_BPIALL: -+ return "BPIALL"; -+ -+ default: -+ return "unknown"; -+ } -+} -+ -+static int spectre_bhb_install_workaround(int method) -+{ -+ if (spectre_bhb_method != method) { -+ if (spectre_bhb_method) { -+ pr_err("CPU%u: Spectre BHB: method disagreement, system vulnerable\n", -+ smp_processor_id()); -+ -+ return SPECTRE_VULNERABLE; -+ } -+ -+ if (spectre_bhb_update_vectors(method) == SPECTRE_VULNERABLE) -+ return SPECTRE_VULNERABLE; -+ -+ spectre_bhb_method = method; -+ } -+ -+ pr_info("CPU%u: Spectre BHB: using %s workaround\n", -+ smp_processor_id(), spectre_bhb_method_name(method)); -+ -+ return SPECTRE_MITIGATED; - } - #else --static void cpu_v7_spectre_init(void) -+static int spectre_bhb_install_workaround(int method) - { -+ return SPECTRE_VULNERABLE; - } - #endif - -+static void cpu_v7_spectre_bhb_init(void) -+{ -+ unsigned int state, method = 0; -+ -+ switch (read_cpuid_part()) { -+ case ARM_CPU_PART_CORTEX_A15: -+ case ARM_CPU_PART_BRAHMA_B15: -+ case ARM_CPU_PART_CORTEX_A57: -+ case ARM_CPU_PART_CORTEX_A72: -+ state = SPECTRE_MITIGATED; -+ method = SPECTRE_V2_METHOD_LOOP8; -+ break; -+ -+ case ARM_CPU_PART_CORTEX_A73: -+ case ARM_CPU_PART_CORTEX_A75: -+ state = SPECTRE_MITIGATED; -+ method = SPECTRE_V2_METHOD_BPIALL; -+ break; -+ -+ default: -+ state = SPECTRE_UNAFFECTED; -+ break; -+ } -+ -+ if (state == SPECTRE_MITIGATED) -+ state = spectre_bhb_install_workaround(method); -+ -+ spectre_v2_update_state(state, method); -+} -+ - static __maybe_unused bool cpu_v7_check_auxcr_set(bool *warned, - u32 mask, const char *msg) - { -@@ -149,16 +294,17 @@ static bool check_spectre_auxcr(bool *warned, u32 bit) - void cpu_v7_ca8_ibe(void) - { - if (check_spectre_auxcr(this_cpu_ptr(&spectre_warned), BIT(6))) -- cpu_v7_spectre_init(); -+ cpu_v7_spectre_v2_init(); - } - - void cpu_v7_ca15_ibe(void) - { - if (check_spectre_auxcr(this_cpu_ptr(&spectre_warned), BIT(0))) -- cpu_v7_spectre_init(); -+ cpu_v7_spectre_v2_init(); - } - - void cpu_v7_bugs_init(void) - { -- cpu_v7_spectre_init(); -+ cpu_v7_spectre_v2_init(); -+ cpu_v7_spectre_bhb_init(); - } -diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h -index d912457f56a79..f48905f796e9d 100644 ---- a/arch/x86/include/asm/cpufeatures.h -+++ b/arch/x86/include/asm/cpufeatures.h -@@ -202,7 +202,7 @@ - #define X86_FEATURE_SME ( 7*32+10) /* AMD Secure Memory Encryption */ - #define X86_FEATURE_PTI ( 7*32+11) /* Kernel Page Table Isolation enabled */ - #define X86_FEATURE_RETPOLINE ( 7*32+12) /* "" Generic Retpoline mitigation for Spectre variant 2 */ --#define X86_FEATURE_RETPOLINE_AMD ( 7*32+13) /* "" AMD Retpoline mitigation for Spectre variant 2 */ -+#define X86_FEATURE_RETPOLINE_LFENCE ( 7*32+13) /* "" Use LFENCE for Spectre variant 2 */ - #define X86_FEATURE_INTEL_PPIN ( 7*32+14) /* Intel Processor Inventory Number */ - #define X86_FEATURE_CDP_L2 ( 7*32+15) /* Code and Data Prioritization L2 */ - #define X86_FEATURE_MSR_SPEC_CTRL ( 7*32+16) /* "" MSR SPEC_CTRL is implemented */ -diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h -index b222a35959467..956df82bbc2bc 100644 ---- a/arch/x86/include/asm/nospec-branch.h -+++ b/arch/x86/include/asm/nospec-branch.h -@@ -115,7 +115,7 @@ - ANNOTATE_NOSPEC_ALTERNATIVE - ALTERNATIVE_2 __stringify(ANNOTATE_RETPOLINE_SAFE; jmp *\reg), \ - __stringify(RETPOLINE_JMP \reg), X86_FEATURE_RETPOLINE, \ -- __stringify(lfence; ANNOTATE_RETPOLINE_SAFE; jmp *\reg), X86_FEATURE_RETPOLINE_AMD -+ __stringify(lfence; ANNOTATE_RETPOLINE_SAFE; jmp *\reg), X86_FEATURE_RETPOLINE_LFENCE - #else - jmp *\reg - #endif -@@ -126,7 +126,7 @@ - ANNOTATE_NOSPEC_ALTERNATIVE - ALTERNATIVE_2 __stringify(ANNOTATE_RETPOLINE_SAFE; call *\reg), \ - __stringify(RETPOLINE_CALL \reg), X86_FEATURE_RETPOLINE,\ -- __stringify(lfence; ANNOTATE_RETPOLINE_SAFE; call *\reg), X86_FEATURE_RETPOLINE_AMD -+ __stringify(lfence; ANNOTATE_RETPOLINE_SAFE; call *\reg), X86_FEATURE_RETPOLINE_LFENCE - #else - call *\reg - #endif -@@ -171,7 +171,7 @@ - "lfence;\n" \ - ANNOTATE_RETPOLINE_SAFE \ - "call *%[thunk_target]\n", \ -- X86_FEATURE_RETPOLINE_AMD) -+ X86_FEATURE_RETPOLINE_LFENCE) - # define THUNK_TARGET(addr) [thunk_target] "r" (addr) - - #else /* CONFIG_X86_32 */ -@@ -201,7 +201,7 @@ - "lfence;\n" \ - ANNOTATE_RETPOLINE_SAFE \ - "call *%[thunk_target]\n", \ -- X86_FEATURE_RETPOLINE_AMD) -+ X86_FEATURE_RETPOLINE_LFENCE) - - # define THUNK_TARGET(addr) [thunk_target] "rm" (addr) - #endif -@@ -213,9 +213,11 @@ - /* The Spectre V2 mitigation variants */ - enum spectre_v2_mitigation { - SPECTRE_V2_NONE, -- SPECTRE_V2_RETPOLINE_GENERIC, -- SPECTRE_V2_RETPOLINE_AMD, -- SPECTRE_V2_IBRS_ENHANCED, -+ SPECTRE_V2_RETPOLINE, -+ SPECTRE_V2_LFENCE, -+ SPECTRE_V2_EIBRS, -+ SPECTRE_V2_EIBRS_RETPOLINE, -+ SPECTRE_V2_EIBRS_LFENCE, - }; - - /* The indirect branch speculation control variants */ -diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c -index fcc4238ee95f8..e817aaeef254c 100644 ---- a/arch/x86/kernel/cpu/bugs.c -+++ b/arch/x86/kernel/cpu/bugs.c -@@ -31,6 +31,7 @@ - #include - #include - #include -+#include - - #include "cpu.h" - -@@ -607,6 +608,32 @@ static inline const char *spectre_v2_module_string(void) - static inline const char *spectre_v2_module_string(void) { return ""; } - #endif - -+#define SPECTRE_V2_LFENCE_MSG "WARNING: LFENCE mitigation is not recommended for this CPU, data leaks possible!\n" -+#define SPECTRE_V2_EIBRS_EBPF_MSG "WARNING: Unprivileged eBPF is enabled with eIBRS on, data leaks possible via Spectre v2 BHB attacks!\n" -+#define SPECTRE_V2_EIBRS_LFENCE_EBPF_SMT_MSG "WARNING: Unprivileged eBPF is enabled with eIBRS+LFENCE mitigation and SMT, data leaks possible via Spectre v2 BHB attacks!\n" -+ -+#ifdef CONFIG_BPF_SYSCALL -+void unpriv_ebpf_notify(int new_state) -+{ -+ if (new_state) -+ return; -+ -+ /* Unprivileged eBPF is enabled */ -+ -+ switch (spectre_v2_enabled) { -+ case SPECTRE_V2_EIBRS: -+ pr_err(SPECTRE_V2_EIBRS_EBPF_MSG); -+ break; -+ case SPECTRE_V2_EIBRS_LFENCE: -+ if (sched_smt_active()) -+ pr_err(SPECTRE_V2_EIBRS_LFENCE_EBPF_SMT_MSG); -+ break; -+ default: -+ break; -+ } -+} -+#endif -+ - static inline bool match_option(const char *arg, int arglen, const char *opt) - { - int len = strlen(opt); -@@ -621,7 +648,10 @@ enum spectre_v2_mitigation_cmd { - SPECTRE_V2_CMD_FORCE, - SPECTRE_V2_CMD_RETPOLINE, - SPECTRE_V2_CMD_RETPOLINE_GENERIC, -- SPECTRE_V2_CMD_RETPOLINE_AMD, -+ SPECTRE_V2_CMD_RETPOLINE_LFENCE, -+ SPECTRE_V2_CMD_EIBRS, -+ SPECTRE_V2_CMD_EIBRS_RETPOLINE, -+ SPECTRE_V2_CMD_EIBRS_LFENCE, - }; - - enum spectre_v2_user_cmd { -@@ -694,6 +724,13 @@ spectre_v2_parse_user_cmdline(enum spectre_v2_mitigation_cmd v2_cmd) - return SPECTRE_V2_USER_CMD_AUTO; - } - -+static inline bool spectre_v2_in_eibrs_mode(enum spectre_v2_mitigation mode) -+{ -+ return (mode == SPECTRE_V2_EIBRS || -+ mode == SPECTRE_V2_EIBRS_RETPOLINE || -+ mode == SPECTRE_V2_EIBRS_LFENCE); -+} -+ - static void __init - spectre_v2_user_select_mitigation(enum spectre_v2_mitigation_cmd v2_cmd) - { -@@ -756,10 +793,12 @@ spectre_v2_user_select_mitigation(enum spectre_v2_mitigation_cmd v2_cmd) - } - - /* -- * If enhanced IBRS is enabled or SMT impossible, STIBP is not -+ * If no STIBP, enhanced IBRS is enabled or SMT impossible, STIBP is not - * required. - */ -- if (!smt_possible || spectre_v2_enabled == SPECTRE_V2_IBRS_ENHANCED) -+ if (!boot_cpu_has(X86_FEATURE_STIBP) || -+ !smt_possible || -+ spectre_v2_in_eibrs_mode(spectre_v2_enabled)) - return; - - /* -@@ -771,12 +810,6 @@ spectre_v2_user_select_mitigation(enum spectre_v2_mitigation_cmd v2_cmd) - boot_cpu_has(X86_FEATURE_AMD_STIBP_ALWAYS_ON)) - mode = SPECTRE_V2_USER_STRICT_PREFERRED; - -- /* -- * If STIBP is not available, clear the STIBP mode. -- */ -- if (!boot_cpu_has(X86_FEATURE_STIBP)) -- mode = SPECTRE_V2_USER_NONE; -- - spectre_v2_user_stibp = mode; - - set_mode: -@@ -785,9 +818,11 @@ set_mode: - - static const char * const spectre_v2_strings[] = { - [SPECTRE_V2_NONE] = "Vulnerable", -- [SPECTRE_V2_RETPOLINE_GENERIC] = "Mitigation: Full generic retpoline", -- [SPECTRE_V2_RETPOLINE_AMD] = "Mitigation: Full AMD retpoline", -- [SPECTRE_V2_IBRS_ENHANCED] = "Mitigation: Enhanced IBRS", -+ [SPECTRE_V2_RETPOLINE] = "Mitigation: Retpolines", -+ [SPECTRE_V2_LFENCE] = "Mitigation: LFENCE", -+ [SPECTRE_V2_EIBRS] = "Mitigation: Enhanced IBRS", -+ [SPECTRE_V2_EIBRS_LFENCE] = "Mitigation: Enhanced IBRS + LFENCE", -+ [SPECTRE_V2_EIBRS_RETPOLINE] = "Mitigation: Enhanced IBRS + Retpolines", - }; - - static const struct { -@@ -798,8 +833,12 @@ static const struct { - { "off", SPECTRE_V2_CMD_NONE, false }, - { "on", SPECTRE_V2_CMD_FORCE, true }, - { "retpoline", SPECTRE_V2_CMD_RETPOLINE, false }, -- { "retpoline,amd", SPECTRE_V2_CMD_RETPOLINE_AMD, false }, -+ { "retpoline,amd", SPECTRE_V2_CMD_RETPOLINE_LFENCE, false }, -+ { "retpoline,lfence", SPECTRE_V2_CMD_RETPOLINE_LFENCE, false }, - { "retpoline,generic", SPECTRE_V2_CMD_RETPOLINE_GENERIC, false }, -+ { "eibrs", SPECTRE_V2_CMD_EIBRS, false }, -+ { "eibrs,lfence", SPECTRE_V2_CMD_EIBRS_LFENCE, false }, -+ { "eibrs,retpoline", SPECTRE_V2_CMD_EIBRS_RETPOLINE, false }, - { "auto", SPECTRE_V2_CMD_AUTO, false }, - }; - -@@ -836,17 +875,30 @@ static enum spectre_v2_mitigation_cmd __init spectre_v2_parse_cmdline(void) - } - - if ((cmd == SPECTRE_V2_CMD_RETPOLINE || -- cmd == SPECTRE_V2_CMD_RETPOLINE_AMD || -- cmd == SPECTRE_V2_CMD_RETPOLINE_GENERIC) && -+ cmd == SPECTRE_V2_CMD_RETPOLINE_LFENCE || -+ cmd == SPECTRE_V2_CMD_RETPOLINE_GENERIC || -+ cmd == SPECTRE_V2_CMD_EIBRS_LFENCE || -+ cmd == SPECTRE_V2_CMD_EIBRS_RETPOLINE) && - !IS_ENABLED(CONFIG_RETPOLINE)) { -- pr_err("%s selected but not compiled in. Switching to AUTO select\n", mitigation_options[i].option); -+ pr_err("%s selected but not compiled in. Switching to AUTO select\n", -+ mitigation_options[i].option); -+ return SPECTRE_V2_CMD_AUTO; -+ } -+ -+ if ((cmd == SPECTRE_V2_CMD_EIBRS || -+ cmd == SPECTRE_V2_CMD_EIBRS_LFENCE || -+ cmd == SPECTRE_V2_CMD_EIBRS_RETPOLINE) && -+ !boot_cpu_has(X86_FEATURE_IBRS_ENHANCED)) { -+ pr_err("%s selected but CPU doesn't have eIBRS. Switching to AUTO select\n", -+ mitigation_options[i].option); - return SPECTRE_V2_CMD_AUTO; - } - -- if (cmd == SPECTRE_V2_CMD_RETPOLINE_AMD && -- boot_cpu_data.x86_vendor != X86_VENDOR_HYGON && -- boot_cpu_data.x86_vendor != X86_VENDOR_AMD) { -- pr_err("retpoline,amd selected but CPU is not AMD. Switching to AUTO select\n"); -+ if ((cmd == SPECTRE_V2_CMD_RETPOLINE_LFENCE || -+ cmd == SPECTRE_V2_CMD_EIBRS_LFENCE) && -+ !boot_cpu_has(X86_FEATURE_LFENCE_RDTSC)) { -+ pr_err("%s selected, but CPU doesn't have a serializing LFENCE. Switching to AUTO select\n", -+ mitigation_options[i].option); - return SPECTRE_V2_CMD_AUTO; - } - -@@ -855,6 +907,16 @@ static enum spectre_v2_mitigation_cmd __init spectre_v2_parse_cmdline(void) - return cmd; - } - -+static enum spectre_v2_mitigation __init spectre_v2_select_retpoline(void) -+{ -+ if (!IS_ENABLED(CONFIG_RETPOLINE)) { -+ pr_err("Kernel not compiled with retpoline; no mitigation available!"); -+ return SPECTRE_V2_NONE; -+ } -+ -+ return SPECTRE_V2_RETPOLINE; -+} -+ - static void __init spectre_v2_select_mitigation(void) - { - enum spectre_v2_mitigation_cmd cmd = spectre_v2_parse_cmdline(); -@@ -875,49 +937,64 @@ static void __init spectre_v2_select_mitigation(void) - case SPECTRE_V2_CMD_FORCE: - case SPECTRE_V2_CMD_AUTO: - if (boot_cpu_has(X86_FEATURE_IBRS_ENHANCED)) { -- mode = SPECTRE_V2_IBRS_ENHANCED; -- /* Force it so VMEXIT will restore correctly */ -- x86_spec_ctrl_base |= SPEC_CTRL_IBRS; -- wrmsrl(MSR_IA32_SPEC_CTRL, x86_spec_ctrl_base); -- goto specv2_set_mode; -+ mode = SPECTRE_V2_EIBRS; -+ break; - } -- if (IS_ENABLED(CONFIG_RETPOLINE)) -- goto retpoline_auto; -+ -+ mode = spectre_v2_select_retpoline(); - break; -- case SPECTRE_V2_CMD_RETPOLINE_AMD: -- if (IS_ENABLED(CONFIG_RETPOLINE)) -- goto retpoline_amd; -+ -+ case SPECTRE_V2_CMD_RETPOLINE_LFENCE: -+ pr_err(SPECTRE_V2_LFENCE_MSG); -+ mode = SPECTRE_V2_LFENCE; - break; -+ - case SPECTRE_V2_CMD_RETPOLINE_GENERIC: -- if (IS_ENABLED(CONFIG_RETPOLINE)) -- goto retpoline_generic; -+ mode = SPECTRE_V2_RETPOLINE; - break; -+ - case SPECTRE_V2_CMD_RETPOLINE: -- if (IS_ENABLED(CONFIG_RETPOLINE)) -- goto retpoline_auto; -+ mode = spectre_v2_select_retpoline(); -+ break; -+ -+ case SPECTRE_V2_CMD_EIBRS: -+ mode = SPECTRE_V2_EIBRS; -+ break; -+ -+ case SPECTRE_V2_CMD_EIBRS_LFENCE: -+ mode = SPECTRE_V2_EIBRS_LFENCE; -+ break; -+ -+ case SPECTRE_V2_CMD_EIBRS_RETPOLINE: -+ mode = SPECTRE_V2_EIBRS_RETPOLINE; - break; - } -- pr_err("Spectre mitigation: kernel not compiled with retpoline; no mitigation available!"); -- return; - --retpoline_auto: -- if (boot_cpu_data.x86_vendor == X86_VENDOR_AMD || -- boot_cpu_data.x86_vendor == X86_VENDOR_HYGON) { -- retpoline_amd: -- if (!boot_cpu_has(X86_FEATURE_LFENCE_RDTSC)) { -- pr_err("Spectre mitigation: LFENCE not serializing, switching to generic retpoline\n"); -- goto retpoline_generic; -- } -- mode = SPECTRE_V2_RETPOLINE_AMD; -- setup_force_cpu_cap(X86_FEATURE_RETPOLINE_AMD); -- setup_force_cpu_cap(X86_FEATURE_RETPOLINE); -- } else { -- retpoline_generic: -- mode = SPECTRE_V2_RETPOLINE_GENERIC; -+ if (mode == SPECTRE_V2_EIBRS && unprivileged_ebpf_enabled()) -+ pr_err(SPECTRE_V2_EIBRS_EBPF_MSG); -+ -+ if (spectre_v2_in_eibrs_mode(mode)) { -+ /* Force it so VMEXIT will restore correctly */ -+ x86_spec_ctrl_base |= SPEC_CTRL_IBRS; -+ wrmsrl(MSR_IA32_SPEC_CTRL, x86_spec_ctrl_base); -+ } -+ -+ switch (mode) { -+ case SPECTRE_V2_NONE: -+ case SPECTRE_V2_EIBRS: -+ break; -+ -+ case SPECTRE_V2_LFENCE: -+ case SPECTRE_V2_EIBRS_LFENCE: -+ setup_force_cpu_cap(X86_FEATURE_RETPOLINE_LFENCE); -+ fallthrough; -+ -+ case SPECTRE_V2_RETPOLINE: -+ case SPECTRE_V2_EIBRS_RETPOLINE: - setup_force_cpu_cap(X86_FEATURE_RETPOLINE); -+ break; - } - --specv2_set_mode: - spectre_v2_enabled = mode; - pr_info("%s\n", spectre_v2_strings[mode]); - -@@ -943,7 +1020,7 @@ specv2_set_mode: - * the CPU supports Enhanced IBRS, kernel might un-intentionally not - * enable IBRS around firmware calls. - */ -- if (boot_cpu_has(X86_FEATURE_IBRS) && mode != SPECTRE_V2_IBRS_ENHANCED) { -+ if (boot_cpu_has(X86_FEATURE_IBRS) && !spectre_v2_in_eibrs_mode(mode)) { - setup_force_cpu_cap(X86_FEATURE_USE_IBRS_FW); - pr_info("Enabling Restricted Speculation for firmware calls\n"); - } -@@ -1013,6 +1090,10 @@ void cpu_bugs_smt_update(void) - { - mutex_lock(&spec_ctrl_mutex); - -+ if (sched_smt_active() && unprivileged_ebpf_enabled() && -+ spectre_v2_enabled == SPECTRE_V2_EIBRS_LFENCE) -+ pr_warn_once(SPECTRE_V2_EIBRS_LFENCE_EBPF_SMT_MSG); -+ - switch (spectre_v2_user_stibp) { - case SPECTRE_V2_USER_NONE: - break; -@@ -1267,7 +1348,6 @@ static int ib_prctl_set(struct task_struct *task, unsigned long ctrl) - if (spectre_v2_user_ibpb == SPECTRE_V2_USER_NONE && - spectre_v2_user_stibp == SPECTRE_V2_USER_NONE) - return 0; -- - /* - * With strict mode for both IBPB and STIBP, the instruction - * code paths avoid checking this task flag and instead, -@@ -1614,7 +1694,7 @@ static ssize_t tsx_async_abort_show_state(char *buf) - - static char *stibp_state(void) - { -- if (spectre_v2_enabled == SPECTRE_V2_IBRS_ENHANCED) -+ if (spectre_v2_in_eibrs_mode(spectre_v2_enabled)) - return ""; - - switch (spectre_v2_user_stibp) { -@@ -1644,6 +1724,27 @@ static char *ibpb_state(void) - return ""; - } - -+static ssize_t spectre_v2_show_state(char *buf) -+{ -+ if (spectre_v2_enabled == SPECTRE_V2_LFENCE) -+ return sprintf(buf, "Vulnerable: LFENCE\n"); -+ -+ if (spectre_v2_enabled == SPECTRE_V2_EIBRS && unprivileged_ebpf_enabled()) -+ return sprintf(buf, "Vulnerable: eIBRS with unprivileged eBPF\n"); -+ -+ if (sched_smt_active() && unprivileged_ebpf_enabled() && -+ spectre_v2_enabled == SPECTRE_V2_EIBRS_LFENCE) -+ return sprintf(buf, "Vulnerable: eIBRS+LFENCE with unprivileged eBPF and SMT\n"); -+ -+ return sprintf(buf, "%s%s%s%s%s%s\n", -+ spectre_v2_strings[spectre_v2_enabled], -+ ibpb_state(), -+ boot_cpu_has(X86_FEATURE_USE_IBRS_FW) ? ", IBRS_FW" : "", -+ stibp_state(), -+ boot_cpu_has(X86_FEATURE_RSB_CTXSW) ? ", RSB filling" : "", -+ spectre_v2_module_string()); -+} -+ - static ssize_t srbds_show_state(char *buf) - { - return sprintf(buf, "%s\n", srbds_strings[srbds_mitigation]); -@@ -1669,12 +1770,7 @@ static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr - return sprintf(buf, "%s\n", spectre_v1_strings[spectre_v1_mitigation]); - - case X86_BUG_SPECTRE_V2: -- return sprintf(buf, "%s%s%s%s%s%s\n", spectre_v2_strings[spectre_v2_enabled], -- ibpb_state(), -- boot_cpu_has(X86_FEATURE_USE_IBRS_FW) ? ", IBRS_FW" : "", -- stibp_state(), -- boot_cpu_has(X86_FEATURE_RSB_CTXSW) ? ", RSB filling" : "", -- spectre_v2_module_string()); -+ return spectre_v2_show_state(buf); - - case X86_BUG_SPEC_STORE_BYPASS: - return sprintf(buf, "%s\n", ssb_strings[ssb_mode]); -diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c -index ce9a570f217ad..e5b92958c299e 100644 ---- a/drivers/acpi/ec.c -+++ b/drivers/acpi/ec.c -@@ -2002,16 +2002,6 @@ bool acpi_ec_dispatch_gpe(void) - if (acpi_any_gpe_status_set(first_ec->gpe)) - return true; - -- /* -- * Cancel the SCI wakeup and process all pending events in case there -- * are any wakeup ones in there. -- * -- * Note that if any non-EC GPEs are active at this point, the SCI will -- * retrigger after the rearming in acpi_s2idle_wake(), so no events -- * should be missed by canceling the wakeup here. -- */ -- pm_system_cancel_wakeup(); -- - /* - * Dispatch the EC GPE in-band, but do not report wakeup in any case - * to allow the caller to process events properly after that. -diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c -index cd590b4793e09..b0e23e3fe0d56 100644 ---- a/drivers/acpi/sleep.c -+++ b/drivers/acpi/sleep.c -@@ -1003,13 +1003,19 @@ static bool acpi_s2idle_wake(void) - if (acpi_check_wakeup_handlers()) - return true; - -- /* -- * Check non-EC GPE wakeups and if there are none, cancel the -- * SCI-related wakeup and dispatch the EC GPE. -- */ -+ /* Check non-EC GPE wakeups and dispatch the EC GPE. */ - if (acpi_ec_dispatch_gpe()) - return true; - -+ /* -+ * Cancel the SCI wakeup and process all pending events in case -+ * there are any wakeup ones in there. -+ * -+ * Note that if any non-EC GPEs are active at this point, the -+ * SCI will retrigger after the rearming below, so no events -+ * should be missed by canceling the wakeup here. -+ */ -+ pm_system_cancel_wakeup(); - acpi_os_wait_events_complete(); - - /* -diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c -index 774af5ce70dad..3731066f2c1ca 100644 ---- a/drivers/block/xen-blkfront.c -+++ b/drivers/block/xen-blkfront.c -@@ -1344,7 +1344,8 @@ free_shadow: - rinfo->ring_ref[i] = GRANT_INVALID_REF; - } - } -- free_pages((unsigned long)rinfo->ring.sring, get_order(info->nr_ring_pages * XEN_PAGE_SIZE)); -+ free_pages_exact(rinfo->ring.sring, -+ info->nr_ring_pages * XEN_PAGE_SIZE); - rinfo->ring.sring = NULL; - - if (rinfo->irq) -@@ -1428,9 +1429,15 @@ static int blkif_get_final_status(enum blk_req_status s1, - return BLKIF_RSP_OKAY; - } - --static bool blkif_completion(unsigned long *id, -- struct blkfront_ring_info *rinfo, -- struct blkif_response *bret) -+/* -+ * Return values: -+ * 1 response processed. -+ * 0 missing further responses. -+ * -1 error while processing. -+ */ -+static int blkif_completion(unsigned long *id, -+ struct blkfront_ring_info *rinfo, -+ struct blkif_response *bret) - { - int i = 0; - struct scatterlist *sg; -@@ -1453,7 +1460,7 @@ static bool blkif_completion(unsigned long *id, - - /* Wait the second response if not yet here. */ - if (s2->status < REQ_DONE) -- return false; -+ return 0; - - bret->status = blkif_get_final_status(s->status, - s2->status); -@@ -1504,42 +1511,43 @@ static bool blkif_completion(unsigned long *id, - } - /* Add the persistent grant into the list of free grants */ - for (i = 0; i < num_grant; i++) { -- if (gnttab_query_foreign_access(s->grants_used[i]->gref)) { -+ if (!gnttab_try_end_foreign_access(s->grants_used[i]->gref)) { - /* - * If the grant is still mapped by the backend (the - * backend has chosen to make this grant persistent) - * we add it at the head of the list, so it will be - * reused first. - */ -- if (!info->feature_persistent) -- pr_alert_ratelimited("backed has not unmapped grant: %u\n", -- s->grants_used[i]->gref); -+ if (!info->feature_persistent) { -+ pr_alert("backed has not unmapped grant: %u\n", -+ s->grants_used[i]->gref); -+ return -1; -+ } - list_add(&s->grants_used[i]->node, &rinfo->grants); - rinfo->persistent_gnts_c++; - } else { - /* -- * If the grant is not mapped by the backend we end the -- * foreign access and add it to the tail of the list, -- * so it will not be picked again unless we run out of -- * persistent grants. -+ * If the grant is not mapped by the backend we add it -+ * to the tail of the list, so it will not be picked -+ * again unless we run out of persistent grants. - */ -- gnttab_end_foreign_access(s->grants_used[i]->gref, 0, 0UL); - s->grants_used[i]->gref = GRANT_INVALID_REF; - list_add_tail(&s->grants_used[i]->node, &rinfo->grants); - } - } - if (s->req.operation == BLKIF_OP_INDIRECT) { - for (i = 0; i < INDIRECT_GREFS(num_grant); i++) { -- if (gnttab_query_foreign_access(s->indirect_grants[i]->gref)) { -- if (!info->feature_persistent) -- pr_alert_ratelimited("backed has not unmapped grant: %u\n", -- s->indirect_grants[i]->gref); -+ if (!gnttab_try_end_foreign_access(s->indirect_grants[i]->gref)) { -+ if (!info->feature_persistent) { -+ pr_alert("backed has not unmapped grant: %u\n", -+ s->indirect_grants[i]->gref); -+ return -1; -+ } - list_add(&s->indirect_grants[i]->node, &rinfo->grants); - rinfo->persistent_gnts_c++; - } else { - struct page *indirect_page; - -- gnttab_end_foreign_access(s->indirect_grants[i]->gref, 0, 0UL); - /* - * Add the used indirect page back to the list of - * available pages for indirect grefs. -@@ -1554,7 +1562,7 @@ static bool blkif_completion(unsigned long *id, - } - } - -- return true; -+ return 1; - } - - static irqreturn_t blkif_interrupt(int irq, void *dev_id) -@@ -1620,12 +1628,17 @@ static irqreturn_t blkif_interrupt(int irq, void *dev_id) - } - - if (bret.operation != BLKIF_OP_DISCARD) { -+ int ret; -+ - /* - * We may need to wait for an extra response if the - * I/O request is split in 2 - */ -- if (!blkif_completion(&id, rinfo, &bret)) -+ ret = blkif_completion(&id, rinfo, &bret); -+ if (!ret) - continue; -+ if (unlikely(ret < 0)) -+ goto err; - } - - if (add_id_to_freelist(rinfo, id)) { -@@ -1731,8 +1744,7 @@ static int setup_blkring(struct xenbus_device *dev, - for (i = 0; i < info->nr_ring_pages; i++) - rinfo->ring_ref[i] = GRANT_INVALID_REF; - -- sring = (struct blkif_sring *)__get_free_pages(GFP_NOIO | __GFP_HIGH, -- get_order(ring_size)); -+ sring = alloc_pages_exact(ring_size, GFP_NOIO); - if (!sring) { - xenbus_dev_fatal(dev, -ENOMEM, "allocating shared ring"); - return -ENOMEM; -@@ -1742,7 +1754,7 @@ static int setup_blkring(struct xenbus_device *dev, - - err = xenbus_grant_ring(dev, rinfo->ring.sring, info->nr_ring_pages, gref); - if (err < 0) { -- free_pages((unsigned long)sring, get_order(ring_size)); -+ free_pages_exact(sring, ring_size); - rinfo->ring.sring = NULL; - goto fail; - } -@@ -2720,11 +2732,10 @@ static void purge_persistent_grants(struct blkfront_info *info) - list_for_each_entry_safe(gnt_list_entry, tmp, &rinfo->grants, - node) { - if (gnt_list_entry->gref == GRANT_INVALID_REF || -- gnttab_query_foreign_access(gnt_list_entry->gref)) -+ !gnttab_try_end_foreign_access(gnt_list_entry->gref)) - continue; - - list_del(&gnt_list_entry->node); -- gnttab_end_foreign_access(gnt_list_entry->gref, 0, 0UL); - rinfo->persistent_gnts_c--; - gnt_list_entry->gref = GRANT_INVALID_REF; - list_add_tail(&gnt_list_entry->node, &rinfo->grants); -diff --git a/drivers/firmware/psci/psci.c b/drivers/firmware/psci/psci.c -index 84f4ff351c629..eb797081d1596 100644 ---- a/drivers/firmware/psci/psci.c -+++ b/drivers/firmware/psci/psci.c -@@ -57,6 +57,21 @@ struct psci_operations psci_ops = { - .smccc_version = SMCCC_VERSION_1_0, - }; - -+enum arm_smccc_conduit arm_smccc_1_1_get_conduit(void) -+{ -+ if (psci_ops.smccc_version < SMCCC_VERSION_1_1) -+ return SMCCC_CONDUIT_NONE; -+ -+ switch (psci_ops.conduit) { -+ case PSCI_CONDUIT_SMC: -+ return SMCCC_CONDUIT_SMC; -+ case PSCI_CONDUIT_HVC: -+ return SMCCC_CONDUIT_HVC; -+ default: -+ return SMCCC_CONDUIT_NONE; -+ } -+} -+ - typedef unsigned long (psci_fn)(unsigned long, unsigned long, - unsigned long, unsigned long); - static psci_fn *invoke_psci_fn; -diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c -index d45d83968e769..94dd6edd18006 100644 ---- a/drivers/net/xen-netfront.c -+++ b/drivers/net/xen-netfront.c -@@ -412,14 +412,12 @@ static bool xennet_tx_buf_gc(struct netfront_queue *queue) - queue->tx_link[id] = TX_LINK_NONE; - skb = queue->tx_skbs[id]; - queue->tx_skbs[id] = NULL; -- if (unlikely(gnttab_query_foreign_access( -- queue->grant_tx_ref[id]) != 0)) { -+ if (unlikely(!gnttab_end_foreign_access_ref( -+ queue->grant_tx_ref[id], GNTMAP_readonly))) { - dev_alert(dev, - "Grant still in use by backend domain\n"); - goto err; - } -- gnttab_end_foreign_access_ref( -- queue->grant_tx_ref[id], GNTMAP_readonly); - gnttab_release_grant_reference( - &queue->gref_tx_head, queue->grant_tx_ref[id]); - queue->grant_tx_ref[id] = GRANT_INVALID_REF; -@@ -861,7 +859,6 @@ static int xennet_get_responses(struct netfront_queue *queue, - int max = XEN_NETIF_NR_SLOTS_MIN + (rx->status <= RX_COPY_THRESHOLD); - int slots = 1; - int err = 0; -- unsigned long ret; - - if (rx->flags & XEN_NETRXF_extra_info) { - err = xennet_get_extras(queue, extras, rp); -@@ -892,8 +889,13 @@ static int xennet_get_responses(struct netfront_queue *queue, - goto next; - } - -- ret = gnttab_end_foreign_access_ref(ref, 0); -- BUG_ON(!ret); -+ if (!gnttab_end_foreign_access_ref(ref, 0)) { -+ dev_alert(dev, -+ "Grant still in use by backend domain\n"); -+ queue->info->broken = true; -+ dev_alert(dev, "Disabled for further use\n"); -+ return -EINVAL; -+ } - - gnttab_release_grant_reference(&queue->gref_rx_head, ref); - -@@ -1097,6 +1099,10 @@ static int xennet_poll(struct napi_struct *napi, int budget) - err = xennet_get_responses(queue, &rinfo, rp, &tmpq); - - if (unlikely(err)) { -+ if (queue->info->broken) { -+ spin_unlock(&queue->rx_lock); -+ return 0; -+ } - err: - while ((skb = __skb_dequeue(&tmpq))) - __skb_queue_tail(&errq, skb); -@@ -1675,7 +1681,7 @@ static int setup_netfront(struct xenbus_device *dev, - struct netfront_queue *queue, unsigned int feature_split_evtchn) - { - struct xen_netif_tx_sring *txs; -- struct xen_netif_rx_sring *rxs; -+ struct xen_netif_rx_sring *rxs = NULL; - grant_ref_t gref; - int err; - -@@ -1695,21 +1701,21 @@ static int setup_netfront(struct xenbus_device *dev, - - err = xenbus_grant_ring(dev, txs, 1, &gref); - if (err < 0) -- goto grant_tx_ring_fail; -+ goto fail; - queue->tx_ring_ref = gref; - - rxs = (struct xen_netif_rx_sring *)get_zeroed_page(GFP_NOIO | __GFP_HIGH); - if (!rxs) { - err = -ENOMEM; - xenbus_dev_fatal(dev, err, "allocating rx ring page"); -- goto alloc_rx_ring_fail; -+ goto fail; - } - SHARED_RING_INIT(rxs); - FRONT_RING_INIT(&queue->rx, rxs, XEN_PAGE_SIZE); - - err = xenbus_grant_ring(dev, rxs, 1, &gref); - if (err < 0) -- goto grant_rx_ring_fail; -+ goto fail; - queue->rx_ring_ref = gref; - - if (feature_split_evtchn) -@@ -1722,22 +1728,28 @@ static int setup_netfront(struct xenbus_device *dev, - err = setup_netfront_single(queue); - - if (err) -- goto alloc_evtchn_fail; -+ goto fail; - - return 0; - - /* If we fail to setup netfront, it is safe to just revoke access to - * granted pages because backend is not accessing it at this point. - */ --alloc_evtchn_fail: -- gnttab_end_foreign_access_ref(queue->rx_ring_ref, 0); --grant_rx_ring_fail: -- free_page((unsigned long)rxs); --alloc_rx_ring_fail: -- gnttab_end_foreign_access_ref(queue->tx_ring_ref, 0); --grant_tx_ring_fail: -- free_page((unsigned long)txs); --fail: -+ fail: -+ if (queue->rx_ring_ref != GRANT_INVALID_REF) { -+ gnttab_end_foreign_access(queue->rx_ring_ref, 0, -+ (unsigned long)rxs); -+ queue->rx_ring_ref = GRANT_INVALID_REF; -+ } else { -+ free_page((unsigned long)rxs); -+ } -+ if (queue->tx_ring_ref != GRANT_INVALID_REF) { -+ gnttab_end_foreign_access(queue->tx_ring_ref, 0, -+ (unsigned long)txs); -+ queue->tx_ring_ref = GRANT_INVALID_REF; -+ } else { -+ free_page((unsigned long)txs); -+ } - return err; - } - -diff --git a/drivers/scsi/xen-scsifront.c b/drivers/scsi/xen-scsifront.c -index f0068e96a177f..39e39869a1ad9 100644 ---- a/drivers/scsi/xen-scsifront.c -+++ b/drivers/scsi/xen-scsifront.c -@@ -233,12 +233,11 @@ static void scsifront_gnttab_done(struct vscsifrnt_info *info, - return; - - for (i = 0; i < shadow->nr_grants; i++) { -- if (unlikely(gnttab_query_foreign_access(shadow->gref[i]))) { -+ if (unlikely(!gnttab_try_end_foreign_access(shadow->gref[i]))) { - shost_printk(KERN_ALERT, info->host, KBUILD_MODNAME - "grant still in use by backend\n"); - BUG(); - } -- gnttab_end_foreign_access(shadow->gref[i], 0, 0UL); - } - - kfree(shadow->sg); -diff --git a/drivers/xen/gntalloc.c b/drivers/xen/gntalloc.c -index 3fa40c723e8e9..edb0acd0b8323 100644 ---- a/drivers/xen/gntalloc.c -+++ b/drivers/xen/gntalloc.c -@@ -169,20 +169,14 @@ undo: - __del_gref(gref); - } - -- /* It's possible for the target domain to map the just-allocated grant -- * references by blindly guessing their IDs; if this is done, then -- * __del_gref will leave them in the queue_gref list. They need to be -- * added to the global list so that we can free them when they are no -- * longer referenced. -- */ -- if (unlikely(!list_empty(&queue_gref))) -- list_splice_tail(&queue_gref, &gref_list); - mutex_unlock(&gref_mutex); - return rc; - } - - static void __del_gref(struct gntalloc_gref *gref) - { -+ unsigned long addr; -+ - if (gref->notify.flags & UNMAP_NOTIFY_CLEAR_BYTE) { - uint8_t *tmp = kmap(gref->page); - tmp[gref->notify.pgoff] = 0; -@@ -196,21 +190,16 @@ static void __del_gref(struct gntalloc_gref *gref) - gref->notify.flags = 0; - - if (gref->gref_id) { -- if (gnttab_query_foreign_access(gref->gref_id)) -- return; -- -- if (!gnttab_end_foreign_access_ref(gref->gref_id, 0)) -- return; -- -- gnttab_free_grant_reference(gref->gref_id); -+ if (gref->page) { -+ addr = (unsigned long)page_to_virt(gref->page); -+ gnttab_end_foreign_access(gref->gref_id, 0, addr); -+ } else -+ gnttab_free_grant_reference(gref->gref_id); - } - - gref_size--; - list_del(&gref->next_gref); - -- if (gref->page) -- __free_page(gref->page); -- - kfree(gref); - } - -diff --git a/drivers/xen/grant-table.c b/drivers/xen/grant-table.c -index 49b381e104efa..c75dc17d1a617 100644 ---- a/drivers/xen/grant-table.c -+++ b/drivers/xen/grant-table.c -@@ -135,12 +135,9 @@ struct gnttab_ops { - */ - unsigned long (*end_foreign_transfer_ref)(grant_ref_t ref); - /* -- * Query the status of a grant entry. Ref parameter is reference of -- * queried grant entry, return value is the status of queried entry. -- * Detailed status(writing/reading) can be gotten from the return value -- * by bit operations. -+ * Read the frame number related to a given grant reference. - */ -- int (*query_foreign_access)(grant_ref_t ref); -+ unsigned long (*read_frame)(grant_ref_t ref); - }; - - struct unmap_refs_callback_data { -@@ -285,22 +282,6 @@ int gnttab_grant_foreign_access(domid_t domid, unsigned long frame, - } - EXPORT_SYMBOL_GPL(gnttab_grant_foreign_access); - --static int gnttab_query_foreign_access_v1(grant_ref_t ref) --{ -- return gnttab_shared.v1[ref].flags & (GTF_reading|GTF_writing); --} -- --static int gnttab_query_foreign_access_v2(grant_ref_t ref) --{ -- return grstatus[ref] & (GTF_reading|GTF_writing); --} -- --int gnttab_query_foreign_access(grant_ref_t ref) --{ -- return gnttab_interface->query_foreign_access(ref); --} --EXPORT_SYMBOL_GPL(gnttab_query_foreign_access); -- - static int gnttab_end_foreign_access_ref_v1(grant_ref_t ref, int readonly) - { - u16 flags, nflags; -@@ -354,6 +335,16 @@ int gnttab_end_foreign_access_ref(grant_ref_t ref, int readonly) - } - EXPORT_SYMBOL_GPL(gnttab_end_foreign_access_ref); - -+static unsigned long gnttab_read_frame_v1(grant_ref_t ref) -+{ -+ return gnttab_shared.v1[ref].frame; -+} -+ -+static unsigned long gnttab_read_frame_v2(grant_ref_t ref) -+{ -+ return gnttab_shared.v2[ref].full_page.frame; -+} -+ - struct deferred_entry { - struct list_head list; - grant_ref_t ref; -@@ -383,12 +374,9 @@ static void gnttab_handle_deferred(struct timer_list *unused) - spin_unlock_irqrestore(&gnttab_list_lock, flags); - if (_gnttab_end_foreign_access_ref(entry->ref, entry->ro)) { - put_free_entry(entry->ref); -- if (entry->page) { -- pr_debug("freeing g.e. %#x (pfn %#lx)\n", -- entry->ref, page_to_pfn(entry->page)); -- put_page(entry->page); -- } else -- pr_info("freeing g.e. %#x\n", entry->ref); -+ pr_debug("freeing g.e. %#x (pfn %#lx)\n", -+ entry->ref, page_to_pfn(entry->page)); -+ put_page(entry->page); - kfree(entry); - entry = NULL; - } else { -@@ -413,9 +401,18 @@ static void gnttab_handle_deferred(struct timer_list *unused) - static void gnttab_add_deferred(grant_ref_t ref, bool readonly, - struct page *page) - { -- struct deferred_entry *entry = kmalloc(sizeof(*entry), GFP_ATOMIC); -+ struct deferred_entry *entry; -+ gfp_t gfp = (in_atomic() || irqs_disabled()) ? GFP_ATOMIC : GFP_KERNEL; - const char *what = KERN_WARNING "leaking"; - -+ entry = kmalloc(sizeof(*entry), gfp); -+ if (!page) { -+ unsigned long gfn = gnttab_interface->read_frame(ref); -+ -+ page = pfn_to_page(gfn_to_pfn(gfn)); -+ get_page(page); -+ } -+ - if (entry) { - unsigned long flags; - -@@ -436,11 +433,21 @@ static void gnttab_add_deferred(grant_ref_t ref, bool readonly, - what, ref, page ? page_to_pfn(page) : -1); - } - -+int gnttab_try_end_foreign_access(grant_ref_t ref) -+{ -+ int ret = _gnttab_end_foreign_access_ref(ref, 0); -+ -+ if (ret) -+ put_free_entry(ref); -+ -+ return ret; -+} -+EXPORT_SYMBOL_GPL(gnttab_try_end_foreign_access); -+ - void gnttab_end_foreign_access(grant_ref_t ref, int readonly, - unsigned long page) - { -- if (gnttab_end_foreign_access_ref(ref, readonly)) { -- put_free_entry(ref); -+ if (gnttab_try_end_foreign_access(ref)) { - if (page != 0) - put_page(virt_to_page(page)); - } else -@@ -1297,7 +1304,7 @@ static const struct gnttab_ops gnttab_v1_ops = { - .update_entry = gnttab_update_entry_v1, - .end_foreign_access_ref = gnttab_end_foreign_access_ref_v1, - .end_foreign_transfer_ref = gnttab_end_foreign_transfer_ref_v1, -- .query_foreign_access = gnttab_query_foreign_access_v1, -+ .read_frame = gnttab_read_frame_v1, - }; - - static const struct gnttab_ops gnttab_v2_ops = { -@@ -1309,7 +1316,7 @@ static const struct gnttab_ops gnttab_v2_ops = { - .update_entry = gnttab_update_entry_v2, - .end_foreign_access_ref = gnttab_end_foreign_access_ref_v2, - .end_foreign_transfer_ref = gnttab_end_foreign_transfer_ref_v2, -- .query_foreign_access = gnttab_query_foreign_access_v2, -+ .read_frame = gnttab_read_frame_v2, - }; - - static bool gnttab_need_v2(void) -diff --git a/drivers/xen/pvcalls-front.c b/drivers/xen/pvcalls-front.c -index 57592a6b5c9e3..91e52e05555eb 100644 ---- a/drivers/xen/pvcalls-front.c -+++ b/drivers/xen/pvcalls-front.c -@@ -337,8 +337,8 @@ static void free_active_ring(struct sock_mapping *map) - if (!map->active.ring) - return; - -- free_pages((unsigned long)map->active.data.in, -- map->active.ring->ring_order); -+ free_pages_exact(map->active.data.in, -+ PAGE_SIZE << map->active.ring->ring_order); - free_page((unsigned long)map->active.ring); - } - -@@ -352,8 +352,8 @@ static int alloc_active_ring(struct sock_mapping *map) - goto out; - - map->active.ring->ring_order = PVCALLS_RING_ORDER; -- bytes = (void *)__get_free_pages(GFP_KERNEL | __GFP_ZERO, -- PVCALLS_RING_ORDER); -+ bytes = alloc_pages_exact(PAGE_SIZE << PVCALLS_RING_ORDER, -+ GFP_KERNEL | __GFP_ZERO); - if (!bytes) - goto out; - -diff --git a/drivers/xen/xenbus/xenbus_client.c b/drivers/xen/xenbus/xenbus_client.c -index 81eddb8529ffc..8739dd0ee870d 100644 ---- a/drivers/xen/xenbus/xenbus_client.c -+++ b/drivers/xen/xenbus/xenbus_client.c -@@ -366,7 +366,14 @@ int xenbus_grant_ring(struct xenbus_device *dev, void *vaddr, - unsigned int nr_pages, grant_ref_t *grefs) - { - int err; -- int i, j; -+ unsigned int i; -+ grant_ref_t gref_head; -+ -+ err = gnttab_alloc_grant_references(nr_pages, &gref_head); -+ if (err) { -+ xenbus_dev_fatal(dev, err, "granting access to ring page"); -+ return err; -+ } - - for (i = 0; i < nr_pages; i++) { - unsigned long gfn; -@@ -376,23 +383,14 @@ int xenbus_grant_ring(struct xenbus_device *dev, void *vaddr, - else - gfn = virt_to_gfn(vaddr); - -- err = gnttab_grant_foreign_access(dev->otherend_id, gfn, 0); -- if (err < 0) { -- xenbus_dev_fatal(dev, err, -- "granting access to ring page"); -- goto fail; -- } -- grefs[i] = err; -+ grefs[i] = gnttab_claim_grant_reference(&gref_head); -+ gnttab_grant_foreign_access_ref(grefs[i], dev->otherend_id, -+ gfn, 0); - - vaddr = vaddr + XEN_PAGE_SIZE; - } - - return 0; -- --fail: -- for (j = 0; j < i; j++) -- gnttab_end_foreign_access_ref(grefs[j], 0); -- return err; - } - EXPORT_SYMBOL_GPL(xenbus_grant_ring); - -diff --git a/include/linux/arm-smccc.h b/include/linux/arm-smccc.h -index 157e4a6a83f6d..4e97ba64dbb42 100644 ---- a/include/linux/arm-smccc.h -+++ b/include/linux/arm-smccc.h -@@ -82,6 +82,22 @@ - - #include - #include -+ -+enum arm_smccc_conduit { -+ SMCCC_CONDUIT_NONE, -+ SMCCC_CONDUIT_SMC, -+ SMCCC_CONDUIT_HVC, -+}; -+ -+/** -+ * arm_smccc_1_1_get_conduit() -+ * -+ * Returns the conduit to be used for SMCCCv1.1 or later. -+ * -+ * When SMCCCv1.1 is not present, returns SMCCC_CONDUIT_NONE. -+ */ -+enum arm_smccc_conduit arm_smccc_1_1_get_conduit(void); -+ - /** - * struct arm_smccc_res - Result from SMC/HVC call - * @a0-a3 result values from registers 0 to 3 -@@ -304,5 +320,63 @@ asmlinkage void __arm_smccc_hvc(unsigned long a0, unsigned long a1, - #define SMCCC_RET_NOT_SUPPORTED -1 - #define SMCCC_RET_NOT_REQUIRED -2 - -+/* -+ * Like arm_smccc_1_1* but always returns SMCCC_RET_NOT_SUPPORTED. -+ * Used when the SMCCC conduit is not defined. The empty asm statement -+ * avoids compiler warnings about unused variables. -+ */ -+#define __fail_smccc_1_1(...) \ -+ do { \ -+ __declare_args(__count_args(__VA_ARGS__), __VA_ARGS__); \ -+ asm ("" __constraints(__count_args(__VA_ARGS__))); \ -+ if (___res) \ -+ ___res->a0 = SMCCC_RET_NOT_SUPPORTED; \ -+ } while (0) -+ -+/* -+ * arm_smccc_1_1_invoke() - make an SMCCC v1.1 compliant call -+ * -+ * This is a variadic macro taking one to eight source arguments, and -+ * an optional return structure. -+ * -+ * @a0-a7: arguments passed in registers 0 to 7 -+ * @res: result values from registers 0 to 3 -+ * -+ * This macro will make either an HVC call or an SMC call depending on the -+ * current SMCCC conduit. If no valid conduit is available then -1 -+ * (SMCCC_RET_NOT_SUPPORTED) is returned in @res.a0 (if supplied). -+ * -+ * The return value also provides the conduit that was used. -+ */ -+#define arm_smccc_1_1_invoke(...) ({ \ -+ int method = arm_smccc_1_1_get_conduit(); \ -+ switch (method) { \ -+ case SMCCC_CONDUIT_HVC: \ -+ arm_smccc_1_1_hvc(__VA_ARGS__); \ -+ break; \ -+ case SMCCC_CONDUIT_SMC: \ -+ arm_smccc_1_1_smc(__VA_ARGS__); \ -+ break; \ -+ default: \ -+ __fail_smccc_1_1(__VA_ARGS__); \ -+ method = SMCCC_CONDUIT_NONE; \ -+ break; \ -+ } \ -+ method; \ -+ }) -+ -+/* Paravirtualised time calls (defined by ARM DEN0057A) */ -+#define ARM_SMCCC_HV_PV_TIME_FEATURES \ -+ ARM_SMCCC_CALL_VAL(ARM_SMCCC_FAST_CALL, \ -+ ARM_SMCCC_SMC_64, \ -+ ARM_SMCCC_OWNER_STANDARD_HYP, \ -+ 0x20) -+ -+#define ARM_SMCCC_HV_PV_TIME_ST \ -+ ARM_SMCCC_CALL_VAL(ARM_SMCCC_FAST_CALL, \ -+ ARM_SMCCC_SMC_64, \ -+ ARM_SMCCC_OWNER_STANDARD_HYP, \ -+ 0x21) -+ - #endif /*__ASSEMBLY__*/ - #endif /*__LINUX_ARM_SMCCC_H*/ -diff --git a/include/linux/bpf.h b/include/linux/bpf.h -index 66590ae89c97c..a73ca7c9c7d0e 100644 ---- a/include/linux/bpf.h -+++ b/include/linux/bpf.h -@@ -751,6 +751,12 @@ int bpf_prog_test_run_skb(struct bpf_prog *prog, const union bpf_attr *kattr, - int bpf_prog_test_run_flow_dissector(struct bpf_prog *prog, - const union bpf_attr *kattr, - union bpf_attr __user *uattr); -+ -+static inline bool unprivileged_ebpf_enabled(void) -+{ -+ return !sysctl_unprivileged_bpf_disabled; -+} -+ - #else /* !CONFIG_BPF_SYSCALL */ - static inline struct bpf_prog *bpf_prog_get(u32 ufd) - { -@@ -881,6 +887,12 @@ static inline int bpf_prog_test_run_flow_dissector(struct bpf_prog *prog, - { - return -ENOTSUPP; - } -+ -+static inline bool unprivileged_ebpf_enabled(void) -+{ -+ return false; -+} -+ - #endif /* CONFIG_BPF_SYSCALL */ - - static inline struct bpf_prog *bpf_prog_get_type(u32 ufd, -diff --git a/include/xen/grant_table.h b/include/xen/grant_table.h -index a9978350b45b0..a58a89cc0e97d 100644 ---- a/include/xen/grant_table.h -+++ b/include/xen/grant_table.h -@@ -97,17 +97,32 @@ int gnttab_end_foreign_access_ref(grant_ref_t ref, int readonly); - * access has been ended, free the given page too. Access will be ended - * immediately iff the grant entry is not in use, otherwise it will happen - * some time later. page may be 0, in which case no freeing will occur. -+ * Note that the granted page might still be accessed (read or write) by the -+ * other side after gnttab_end_foreign_access() returns, so even if page was -+ * specified as 0 it is not allowed to just reuse the page for other -+ * purposes immediately. gnttab_end_foreign_access() will take an additional -+ * reference to the granted page in this case, which is dropped only after -+ * the grant is no longer in use. -+ * This requires that multi page allocations for areas subject to -+ * gnttab_end_foreign_access() are done via alloc_pages_exact() (and freeing -+ * via free_pages_exact()) in order to avoid high order pages. - */ - void gnttab_end_foreign_access(grant_ref_t ref, int readonly, - unsigned long page); - -+/* -+ * End access through the given grant reference, iff the grant entry is -+ * no longer in use. In case of success ending foreign access, the -+ * grant reference is deallocated. -+ * Return 1 if the grant entry was freed, 0 if it is still in use. -+ */ -+int gnttab_try_end_foreign_access(grant_ref_t ref); -+ - int gnttab_grant_foreign_transfer(domid_t domid, unsigned long pfn); - - unsigned long gnttab_end_foreign_transfer_ref(grant_ref_t ref); - unsigned long gnttab_end_foreign_transfer(grant_ref_t ref); - --int gnttab_query_foreign_access(grant_ref_t ref); -- - /* - * operations on reserved batches of grant references - */ -diff --git a/kernel/sysctl.c b/kernel/sysctl.c -index 8494d5a706bb5..0457d36540e38 100644 ---- a/kernel/sysctl.c -+++ b/kernel/sysctl.c -@@ -251,6 +251,11 @@ static int sysrq_sysctl_handler(struct ctl_table *table, int write, - #endif - - #ifdef CONFIG_BPF_SYSCALL -+ -+void __weak unpriv_ebpf_notify(int new_state) -+{ -+} -+ - static int bpf_unpriv_handler(struct ctl_table *table, int write, - void *buffer, size_t *lenp, loff_t *ppos) - { -@@ -268,6 +273,9 @@ static int bpf_unpriv_handler(struct ctl_table *table, int write, - return -EPERM; - *(int *)table->data = unpriv_enable; - } -+ -+ unpriv_ebpf_notify(unpriv_enable); -+ - return ret; - } - #endif -diff --git a/net/9p/trans_xen.c b/net/9p/trans_xen.c -index 44e6c74ed4288..2779ec1053a02 100644 ---- a/net/9p/trans_xen.c -+++ b/net/9p/trans_xen.c -@@ -301,9 +301,9 @@ static void xen_9pfs_front_free(struct xen_9pfs_front_priv *priv) - ref = priv->rings[i].intf->ref[j]; - gnttab_end_foreign_access(ref, 0, 0); - } -- free_pages((unsigned long)priv->rings[i].data.in, -- XEN_9PFS_RING_ORDER - -- (PAGE_SHIFT - XEN_PAGE_SHIFT)); -+ free_pages_exact(priv->rings[i].data.in, -+ 1UL << (XEN_9PFS_RING_ORDER + -+ XEN_PAGE_SHIFT)); - } - gnttab_end_foreign_access(priv->rings[i].ref, 0, 0); - free_page((unsigned long)priv->rings[i].intf); -@@ -341,8 +341,8 @@ static int xen_9pfs_front_alloc_dataring(struct xenbus_device *dev, - if (ret < 0) - goto out; - ring->ref = ret; -- bytes = (void *)__get_free_pages(GFP_KERNEL | __GFP_ZERO, -- XEN_9PFS_RING_ORDER - (PAGE_SHIFT - XEN_PAGE_SHIFT)); -+ bytes = alloc_pages_exact(1UL << (XEN_9PFS_RING_ORDER + XEN_PAGE_SHIFT), -+ GFP_KERNEL | __GFP_ZERO); - if (!bytes) { - ret = -ENOMEM; - goto out; -@@ -373,9 +373,7 @@ out: - if (bytes) { - for (i--; i >= 0; i--) - gnttab_end_foreign_access(ring->intf->ref[i], 0, 0); -- free_pages((unsigned long)bytes, -- XEN_9PFS_RING_ORDER - -- (PAGE_SHIFT - XEN_PAGE_SHIFT)); -+ free_pages_exact(bytes, 1UL << (XEN_9PFS_RING_ORDER + XEN_PAGE_SHIFT)); - } - gnttab_end_foreign_access(ring->ref, 0, 0); - free_page((unsigned long)ring->intf); -diff --git a/tools/arch/x86/include/asm/cpufeatures.h b/tools/arch/x86/include/asm/cpufeatures.h -index 0652d3eed9bda..4133c721af6ed 100644 ---- a/tools/arch/x86/include/asm/cpufeatures.h -+++ b/tools/arch/x86/include/asm/cpufeatures.h -@@ -202,7 +202,7 @@ - #define X86_FEATURE_SME ( 7*32+10) /* AMD Secure Memory Encryption */ - #define X86_FEATURE_PTI ( 7*32+11) /* Kernel Page Table Isolation enabled */ - #define X86_FEATURE_RETPOLINE ( 7*32+12) /* "" Generic Retpoline mitigation for Spectre variant 2 */ --#define X86_FEATURE_RETPOLINE_AMD ( 7*32+13) /* "" AMD Retpoline mitigation for Spectre variant 2 */ -+#define X86_FEATURE_RETPOLINE_LFENCE ( 7*32+13) /* "" Use LFENCEs for Spectre variant 2 */ - #define X86_FEATURE_INTEL_PPIN ( 7*32+14) /* Intel Processor Inventory Number */ - #define X86_FEATURE_CDP_L2 ( 7*32+15) /* Code and Data Prioritization L2 */ - #define X86_FEATURE_MSR_SPEC_CTRL ( 7*32+16) /* "" MSR SPEC_CTRL is implemented */ diff --git a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.184-185.patch b/patch/kernel/archive/odroidxu4-5.4/patch-5.4.184-185.patch deleted file mode 100644 index ee7901f9f..000000000 --- a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.184-185.patch +++ /dev/null @@ -1,1364 +0,0 @@ -diff --git a/Makefile b/Makefile -index e914e1a8a7d2c..bd3bdf86b992e 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 5 - PATCHLEVEL = 4 --SUBLEVEL = 184 -+SUBLEVEL = 185 - EXTRAVERSION = - NAME = Kleptomaniac Octopus - -diff --git a/arch/arm/boot/dts/aspeed-g6-pinctrl.dtsi b/arch/arm/boot/dts/aspeed-g6-pinctrl.dtsi -index 996e006e06c25..f310f4d3bcc7c 100644 ---- a/arch/arm/boot/dts/aspeed-g6-pinctrl.dtsi -+++ b/arch/arm/boot/dts/aspeed-g6-pinctrl.dtsi -@@ -118,7 +118,7 @@ - }; - - pinctrl_fwqspid_default: fwqspid_default { -- function = "FWQSPID"; -+ function = "FWSPID"; - groups = "FWQSPID"; - }; - -diff --git a/arch/arm/include/asm/spectre.h b/arch/arm/include/asm/spectre.h -index d1fa5607d3aa3..85f9e538fb325 100644 ---- a/arch/arm/include/asm/spectre.h -+++ b/arch/arm/include/asm/spectre.h -@@ -25,7 +25,13 @@ enum { - SPECTRE_V2_METHOD_LOOP8 = BIT(__SPECTRE_V2_METHOD_LOOP8), - }; - -+#ifdef CONFIG_GENERIC_CPU_VULNERABILITIES - void spectre_v2_update_state(unsigned int state, unsigned int methods); -+#else -+static inline void spectre_v2_update_state(unsigned int state, -+ unsigned int methods) -+{} -+#endif - - int spectre_bhb_update_vectors(unsigned int method); - -diff --git a/arch/arm/kernel/entry-armv.S b/arch/arm/kernel/entry-armv.S -index 94d25425b7bce..3d65fa56a0e5d 100644 ---- a/arch/arm/kernel/entry-armv.S -+++ b/arch/arm/kernel/entry-armv.S -@@ -1043,9 +1043,9 @@ vector_bhb_loop8_\name: - - @ bhb workaround - mov r0, #8 --1: b . + 4 -+3: b . + 4 - subs r0, r0, #1 -- bne 1b -+ bne 3b - dsb - isb - b 2b -diff --git a/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts b/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts -index 16e73597bb78c..2e8239d489f82 100644 ---- a/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts -+++ b/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts -@@ -18,6 +18,7 @@ - - aliases { - spi0 = &spi0; -+ ethernet0 = ð0; - ethernet1 = ð1; - }; - -@@ -137,7 +138,9 @@ - /* - * U-Boot port for Turris Mox has a bug which always expects that "ranges" DT property - * contains exactly 2 ranges with 3 (child) address cells, 2 (parent) address cells and -- * 2 size cells and also expects that the second range starts at 16 MB offset. If these -+ * 2 size cells and also expects that the second range starts at 16 MB offset. Also it -+ * expects that first range uses same address for PCI (child) and CPU (parent) cells (so -+ * no remapping) and that this address is the lowest from all specified ranges. If these - * conditions are not met then U-Boot crashes during loading kernel DTB file. PCIe address - * space is 128 MB long, so the best split between MEM and IO is to use fixed 16 MB window - * for IO and the rest 112 MB (64+32+16) for MEM, despite that maximal IO size is just 64 kB. -@@ -146,6 +149,9 @@ - * https://source.denx.de/u-boot/u-boot/-/commit/cb2ddb291ee6fcbddd6d8f4ff49089dfe580f5d7 - * https://source.denx.de/u-boot/u-boot/-/commit/c64ac3b3185aeb3846297ad7391fc6df8ecd73bf - * https://source.denx.de/u-boot/u-boot/-/commit/4a82fca8e330157081fc132a591ebd99ba02ee33 -+ * Bug related to requirement of same child and parent addresses for first range is fixed -+ * in U-Boot version 2022.04 by following commit: -+ * https://source.denx.de/u-boot/u-boot/-/commit/1fd54253bca7d43d046bba4853fe5fafd034bc17 - */ - #address-cells = <3>; - #size-cells = <2>; -diff --git a/arch/arm64/boot/dts/marvell/armada-37xx.dtsi b/arch/arm64/boot/dts/marvell/armada-37xx.dtsi -index 3d15e4ab3f53a..9405d9c619ca6 100644 ---- a/arch/arm64/boot/dts/marvell/armada-37xx.dtsi -+++ b/arch/arm64/boot/dts/marvell/armada-37xx.dtsi -@@ -495,7 +495,7 @@ - * (totaling 127 MiB) for MEM. - */ - ranges = <0x82000000 0 0xe8000000 0 0xe8000000 0 0x07f00000 /* Port 0 MEM */ -- 0x81000000 0 0xefff0000 0 0xefff0000 0 0x00010000>; /* Port 0 IO */ -+ 0x81000000 0 0x00000000 0 0xefff0000 0 0x00010000>; /* Port 0 IO */ - interrupt-map-mask = <0 0 0 7>; - interrupt-map = <0 0 0 1 &pcie_intc 0>, - <0 0 0 2 &pcie_intc 1>, -diff --git a/arch/riscv/kernel/module.c b/arch/riscv/kernel/module.c -index 6bf5b16743843..a963b761e1a39 100644 ---- a/arch/riscv/kernel/module.c -+++ b/arch/riscv/kernel/module.c -@@ -13,6 +13,19 @@ - #include - #include - -+/* -+ * The auipc+jalr instruction pair can reach any PC-relative offset -+ * in the range [-2^31 - 2^11, 2^31 - 2^11) -+ */ -+static bool riscv_insn_valid_32bit_offset(ptrdiff_t val) -+{ -+#ifdef CONFIG_32BIT -+ return true; -+#else -+ return (-(1L << 31) - (1L << 11)) <= val && val < ((1L << 31) - (1L << 11)); -+#endif -+} -+ - static int apply_r_riscv_32_rela(struct module *me, u32 *location, Elf_Addr v) - { - if (v != (u32)v) { -@@ -95,7 +108,7 @@ static int apply_r_riscv_pcrel_hi20_rela(struct module *me, u32 *location, - ptrdiff_t offset = (void *)v - (void *)location; - s32 hi20; - -- if (offset != (s32)offset) { -+ if (!riscv_insn_valid_32bit_offset(offset)) { - pr_err( - "%s: target %016llx can not be addressed by the 32-bit offset from PC = %p\n", - me->name, (long long)v, location); -@@ -197,10 +210,9 @@ static int apply_r_riscv_call_plt_rela(struct module *me, u32 *location, - Elf_Addr v) - { - ptrdiff_t offset = (void *)v - (void *)location; -- s32 fill_v = offset; - u32 hi20, lo12; - -- if (offset != fill_v) { -+ if (!riscv_insn_valid_32bit_offset(offset)) { - /* Only emit the plt entry if offset over 32-bit range */ - if (IS_ENABLED(CONFIG_MODULE_SECTIONS)) { - offset = module_emit_plt_entry(me, v); -@@ -224,10 +236,9 @@ static int apply_r_riscv_call_rela(struct module *me, u32 *location, - Elf_Addr v) - { - ptrdiff_t offset = (void *)v - (void *)location; -- s32 fill_v = offset; - u32 hi20, lo12; - -- if (offset != fill_v) { -+ if (!riscv_insn_valid_32bit_offset(offset)) { - pr_err( - "%s: target %016llx can not be addressed by the 32-bit offset from PC = %p\n", - me->name, (long long)v, location); -diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h -index f48905f796e9d..56eb9a6524e96 100644 ---- a/arch/x86/include/asm/cpufeatures.h -+++ b/arch/x86/include/asm/cpufeatures.h -@@ -96,6 +96,7 @@ - #define X86_FEATURE_SYSCALL32 ( 3*32+14) /* "" syscall in IA32 userspace */ - #define X86_FEATURE_SYSENTER32 ( 3*32+15) /* "" sysenter in IA32 userspace */ - #define X86_FEATURE_REP_GOOD ( 3*32+16) /* REP microcode works well */ -+#define X86_FEATURE_SME_COHERENT ( 3*32+17) /* "" AMD hardware-enforced cache coherency */ - #define X86_FEATURE_LFENCE_RDTSC ( 3*32+18) /* "" LFENCE synchronizes RDTSC */ - #define X86_FEATURE_ACC_POWER ( 3*32+19) /* AMD Accumulated Power Mechanism */ - #define X86_FEATURE_NOPL ( 3*32+20) /* The NOPL (0F 1F) instructions */ -@@ -107,6 +108,7 @@ - #define X86_FEATURE_EXTD_APICID ( 3*32+26) /* Extended APICID (8 bits) */ - #define X86_FEATURE_AMD_DCM ( 3*32+27) /* AMD multi-node processor */ - #define X86_FEATURE_APERFMPERF ( 3*32+28) /* P-State hardware coordination feedback capability (APERF/MPERF MSRs) */ -+/* free ( 3*32+29) */ - #define X86_FEATURE_NONSTOP_TSC_S3 ( 3*32+30) /* TSC doesn't stop in S3 state */ - #define X86_FEATURE_TSC_KNOWN_FREQ ( 3*32+31) /* TSC has known frequency */ - -diff --git a/arch/x86/kernel/cpu/scattered.c b/arch/x86/kernel/cpu/scattered.c -index adf9b71386eff..53004dbd55c47 100644 ---- a/arch/x86/kernel/cpu/scattered.c -+++ b/arch/x86/kernel/cpu/scattered.c -@@ -41,6 +41,7 @@ static const struct cpuid_bit cpuid_bits[] = { - { X86_FEATURE_MBA, CPUID_EBX, 6, 0x80000008, 0 }, - { X86_FEATURE_SME, CPUID_EAX, 0, 0x8000001f, 0 }, - { X86_FEATURE_SEV, CPUID_EAX, 1, 0x8000001f, 0 }, -+ { X86_FEATURE_SME_COHERENT, CPUID_EAX, 10, 0x8000001f, 0 }, - { 0, 0, 0, 0, 0 } - }; - -diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c -index 2f84509f28289..125970286f289 100644 ---- a/arch/x86/kvm/svm.c -+++ b/arch/x86/kvm/svm.c -@@ -1904,7 +1904,8 @@ static void sev_clflush_pages(struct page *pages[], unsigned long npages) - uint8_t *page_virtual; - unsigned long i; - -- if (npages == 0 || pages == NULL) -+ if (this_cpu_has(X86_FEATURE_SME_COHERENT) || npages == 0 || -+ pages == NULL) - return; - - for (i = 0; i < npages; i++) { -diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c -index 281e584cfe39e..d61313f5c5b98 100644 ---- a/arch/x86/mm/pageattr.c -+++ b/arch/x86/mm/pageattr.c -@@ -1967,7 +1967,7 @@ static int __set_memory_enc_dec(unsigned long addr, int numpages, bool enc) - /* - * Before changing the encryption attribute, we need to flush caches. - */ -- cpa_flush(&cpa, 1); -+ cpa_flush(&cpa, !this_cpu_has(X86_FEATURE_SME_COHERENT)); - - ret = __change_page_attr_set_clr(&cpa, 1); - -diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c -index 816eb2db73080..4b3645e648ee9 100644 ---- a/drivers/block/virtio_blk.c -+++ b/drivers/block/virtio_blk.c -@@ -980,9 +980,15 @@ static int virtblk_probe(struct virtio_device *vdev) - - virtio_cread(vdev, struct virtio_blk_config, max_discard_seg, - &v); -+ -+ /* -+ * max_discard_seg == 0 is out of spec but we always -+ * handled it. -+ */ -+ if (!v) -+ v = sg_elems - 2; - blk_queue_max_discard_segments(q, -- min_not_zero(v, -- MAX_DISCARD_SEGMENTS)); -+ min(v, MAX_DISCARD_SEGMENTS)); - - blk_queue_flag_set(QUEUE_FLAG_DISCARD, q); - } -diff --git a/drivers/clk/qcom/gdsc.c b/drivers/clk/qcom/gdsc.c -index a250f59708d85..888965bb93edf 100644 ---- a/drivers/clk/qcom/gdsc.c -+++ b/drivers/clk/qcom/gdsc.c -@@ -1,6 +1,6 @@ - // SPDX-License-Identifier: GPL-2.0-only - /* -- * Copyright (c) 2015, 2017-2018, The Linux Foundation. All rights reserved. -+ * Copyright (c) 2015, 2017-2018, 2022, The Linux Foundation. All rights reserved. - */ - - #include -@@ -31,9 +31,14 @@ - #define CFG_GDSCR_OFFSET 0x4 - - /* Wait 2^n CXO cycles between all states. Here, n=2 (4 cycles). */ --#define EN_REST_WAIT_VAL (0x2 << 20) --#define EN_FEW_WAIT_VAL (0x8 << 16) --#define CLK_DIS_WAIT_VAL (0x2 << 12) -+#define EN_REST_WAIT_VAL 0x2 -+#define EN_FEW_WAIT_VAL 0x8 -+#define CLK_DIS_WAIT_VAL 0x2 -+ -+/* Transition delay shifts */ -+#define EN_REST_WAIT_SHIFT 20 -+#define EN_FEW_WAIT_SHIFT 16 -+#define CLK_DIS_WAIT_SHIFT 12 - - #define RETAIN_MEM BIT(14) - #define RETAIN_PERIPH BIT(13) -@@ -308,7 +313,18 @@ static int gdsc_init(struct gdsc *sc) - */ - mask = HW_CONTROL_MASK | SW_OVERRIDE_MASK | - EN_REST_WAIT_MASK | EN_FEW_WAIT_MASK | CLK_DIS_WAIT_MASK; -- val = EN_REST_WAIT_VAL | EN_FEW_WAIT_VAL | CLK_DIS_WAIT_VAL; -+ -+ if (!sc->en_rest_wait_val) -+ sc->en_rest_wait_val = EN_REST_WAIT_VAL; -+ if (!sc->en_few_wait_val) -+ sc->en_few_wait_val = EN_FEW_WAIT_VAL; -+ if (!sc->clk_dis_wait_val) -+ sc->clk_dis_wait_val = CLK_DIS_WAIT_VAL; -+ -+ val = sc->en_rest_wait_val << EN_REST_WAIT_SHIFT | -+ sc->en_few_wait_val << EN_FEW_WAIT_SHIFT | -+ sc->clk_dis_wait_val << CLK_DIS_WAIT_SHIFT; -+ - ret = regmap_update_bits(sc->regmap, sc->gdscr, mask, val); - if (ret) - return ret; -diff --git a/drivers/clk/qcom/gdsc.h b/drivers/clk/qcom/gdsc.h -index 64cdc8cf0d4d2..907396ccb83fb 100644 ---- a/drivers/clk/qcom/gdsc.h -+++ b/drivers/clk/qcom/gdsc.h -@@ -1,6 +1,6 @@ - /* SPDX-License-Identifier: GPL-2.0-only */ - /* -- * Copyright (c) 2015, 2017-2018, The Linux Foundation. All rights reserved. -+ * Copyright (c) 2015, 2017-2018, 2022, The Linux Foundation. All rights reserved. - */ - - #ifndef __QCOM_GDSC_H__ -@@ -21,6 +21,9 @@ struct reset_controller_dev; - * @cxcs: offsets of branch registers to toggle mem/periph bits in - * @cxc_count: number of @cxcs - * @pwrsts: Possible powerdomain power states -+ * @en_rest_wait_val: transition delay value for receiving enr ack signal -+ * @en_few_wait_val: transition delay value for receiving enf ack signal -+ * @clk_dis_wait_val: transition delay value for halting clock - * @resets: ids of resets associated with this gdsc - * @reset_count: number of @resets - * @rcdev: reset controller -@@ -34,6 +37,9 @@ struct gdsc { - unsigned int clamp_io_ctrl; - unsigned int *cxcs; - unsigned int cxc_count; -+ unsigned int en_rest_wait_val; -+ unsigned int en_few_wait_val; -+ unsigned int clk_dis_wait_val; - const u8 pwrsts; - /* Powerdomain allowable state bitfields */ - #define PWRSTS_OFF BIT(0) -diff --git a/drivers/gpio/gpio-ts4900.c b/drivers/gpio/gpio-ts4900.c -index 1da8d05863295..410452306bf7b 100644 ---- a/drivers/gpio/gpio-ts4900.c -+++ b/drivers/gpio/gpio-ts4900.c -@@ -1,7 +1,7 @@ - /* - * Digital I/O driver for Technologic Systems I2C FPGA Core - * -- * Copyright (C) 2015 Technologic Systems -+ * Copyright (C) 2015, 2018 Technologic Systems - * Copyright (C) 2016 Savoir-Faire Linux - * - * This program is free software; you can redistribute it and/or -@@ -52,19 +52,33 @@ static int ts4900_gpio_direction_input(struct gpio_chip *chip, - { - struct ts4900_gpio_priv *priv = gpiochip_get_data(chip); - -- /* -- * This will clear the output enable bit, the other bits are -- * dontcare when this is cleared -+ /* Only clear the OE bit here, requires a RMW. Prevents potential issue -+ * with OE and data getting to the physical pin at different times. - */ -- return regmap_write(priv->regmap, offset, 0); -+ return regmap_update_bits(priv->regmap, offset, TS4900_GPIO_OE, 0); - } - - static int ts4900_gpio_direction_output(struct gpio_chip *chip, - unsigned int offset, int value) - { - struct ts4900_gpio_priv *priv = gpiochip_get_data(chip); -+ unsigned int reg; - int ret; - -+ /* If changing from an input to an output, we need to first set the -+ * proper data bit to what is requested and then set OE bit. This -+ * prevents a glitch that can occur on the IO line -+ */ -+ regmap_read(priv->regmap, offset, ®); -+ if (!(reg & TS4900_GPIO_OE)) { -+ if (value) -+ reg = TS4900_GPIO_OUT; -+ else -+ reg &= ~TS4900_GPIO_OUT; -+ -+ regmap_write(priv->regmap, offset, reg); -+ } -+ - if (value) - ret = regmap_write(priv->regmap, offset, TS4900_GPIO_OE | - TS4900_GPIO_OUT); -diff --git a/drivers/gpu/drm/sun4i/sun8i_mixer.h b/drivers/gpu/drm/sun4i/sun8i_mixer.h -index 345b28b0a80a1..dc4300a7b019b 100644 ---- a/drivers/gpu/drm/sun4i/sun8i_mixer.h -+++ b/drivers/gpu/drm/sun4i/sun8i_mixer.h -@@ -114,10 +114,10 @@ - /* format 13 is semi-planar YUV411 VUVU */ - #define SUN8I_MIXER_FBFMT_YUV411 14 - /* format 15 doesn't exist */ --/* format 16 is P010 YVU */ --#define SUN8I_MIXER_FBFMT_P010_YUV 17 --/* format 18 is P210 YVU */ --#define SUN8I_MIXER_FBFMT_P210_YUV 19 -+#define SUN8I_MIXER_FBFMT_P010_YUV 16 -+/* format 17 is P010 YVU */ -+#define SUN8I_MIXER_FBFMT_P210_YUV 18 -+/* format 19 is P210 YVU */ - /* format 20 is packed YVU444 10-bit */ - /* format 21 is packed YUV444 10-bit */ - -diff --git a/drivers/mmc/host/meson-gx-mmc.c b/drivers/mmc/host/meson-gx-mmc.c -index cdd57ce55b2fa..9044faf0050a1 100644 ---- a/drivers/mmc/host/meson-gx-mmc.c -+++ b/drivers/mmc/host/meson-gx-mmc.c -@@ -174,6 +174,8 @@ struct meson_host { - int irq; - - bool vqmmc_enabled; -+ bool needs_pre_post_req; -+ - }; - - #define CMD_CFG_LENGTH_MASK GENMASK(8, 0) -@@ -655,6 +657,8 @@ static void meson_mmc_request_done(struct mmc_host *mmc, - struct meson_host *host = mmc_priv(mmc); - - host->cmd = NULL; -+ if (host->needs_pre_post_req) -+ meson_mmc_post_req(mmc, mrq, 0); - mmc_request_done(host->mmc, mrq); - } - -@@ -872,7 +876,7 @@ static int meson_mmc_validate_dram_access(struct mmc_host *mmc, struct mmc_data - static void meson_mmc_request(struct mmc_host *mmc, struct mmc_request *mrq) - { - struct meson_host *host = mmc_priv(mmc); -- bool needs_pre_post_req = mrq->data && -+ host->needs_pre_post_req = mrq->data && - !(mrq->data->host_cookie & SD_EMMC_PRE_REQ_DONE); - - /* -@@ -888,22 +892,19 @@ static void meson_mmc_request(struct mmc_host *mmc, struct mmc_request *mrq) - } - } - -- if (needs_pre_post_req) { -+ if (host->needs_pre_post_req) { - meson_mmc_get_transfer_mode(mmc, mrq); - if (!meson_mmc_desc_chain_mode(mrq->data)) -- needs_pre_post_req = false; -+ host->needs_pre_post_req = false; - } - -- if (needs_pre_post_req) -+ if (host->needs_pre_post_req) - meson_mmc_pre_req(mmc, mrq); - - /* Stop execution */ - writel(0, host->regs + SD_EMMC_START); - - meson_mmc_start_cmd(mmc, mrq->sbc ?: mrq->cmd); -- -- if (needs_pre_post_req) -- meson_mmc_post_req(mmc, mrq, 0); - } - - static void meson_mmc_read_resp(struct mmc_host *mmc, struct mmc_command *cmd) -diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c b/drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c -index 164988f3b4fab..a2da09da4907b 100644 ---- a/drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c -+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c -@@ -41,6 +41,13 @@ - void bcmgenet_get_wol(struct net_device *dev, struct ethtool_wolinfo *wol) - { - struct bcmgenet_priv *priv = netdev_priv(dev); -+ struct device *kdev = &priv->pdev->dev; -+ -+ if (!device_can_wakeup(kdev)) { -+ wol->supported = 0; -+ wol->wolopts = 0; -+ return; -+ } - - wol->supported = WAKE_MAGIC | WAKE_MAGICSECURE; - wol->wolopts = priv->wolopts; -diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c -index 0dc52cf5367e7..480d2ca369e6b 100644 ---- a/drivers/net/ethernet/cadence/macb_main.c -+++ b/drivers/net/ethernet/cadence/macb_main.c -@@ -1283,7 +1283,14 @@ static int macb_poll(struct napi_struct *napi, int budget) - if (work_done < budget) { - napi_complete_done(napi, work_done); - -- /* Packets received while interrupts were disabled */ -+ /* RSR bits only seem to propagate to raise interrupts when -+ * interrupts are enabled at the time, so if bits are already -+ * set due to packets received while interrupts were disabled, -+ * they will not cause another interrupt to be generated when -+ * interrupts are re-enabled. -+ * Check for this case here. This has been seen to happen -+ * around 30% of the time under heavy network load. -+ */ - status = macb_readl(bp, RSR); - if (status) { - if (bp->caps & MACB_CAPS_ISR_CLEAR_ON_WRITE) -@@ -1291,6 +1298,22 @@ static int macb_poll(struct napi_struct *napi, int budget) - napi_reschedule(napi); - } else { - queue_writel(queue, IER, bp->rx_intr_mask); -+ -+ /* In rare cases, packets could have been received in -+ * the window between the check above and re-enabling -+ * interrupts. Therefore, a double-check is required -+ * to avoid losing a wakeup. This can potentially race -+ * with the interrupt handler doing the same actions -+ * if an interrupt is raised just after enabling them, -+ * but this should be harmless. -+ */ -+ status = macb_readl(bp, RSR); -+ if (unlikely(status)) { -+ queue_writel(queue, IDR, bp->rx_intr_mask); -+ if (bp->caps & MACB_CAPS_ISR_CLEAR_ON_WRITE) -+ queue_writel(queue, ISR, MACB_BIT(RCOMP)); -+ napi_schedule(napi); -+ } - } - } - -diff --git a/drivers/net/ethernet/freescale/gianfar_ethtool.c b/drivers/net/ethernet/freescale/gianfar_ethtool.c -index 3c8e4e2efc070..01a7255e86c92 100644 ---- a/drivers/net/ethernet/freescale/gianfar_ethtool.c -+++ b/drivers/net/ethernet/freescale/gianfar_ethtool.c -@@ -1489,6 +1489,7 @@ static int gfar_get_ts_info(struct net_device *dev, - ptp_node = of_find_compatible_node(NULL, NULL, "fsl,etsec-ptp"); - if (ptp_node) { - ptp_dev = of_find_device_by_node(ptp_node); -+ of_node_put(ptp_node); - if (ptp_dev) - ptp = platform_get_drvdata(ptp_dev); - } -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c -index 1a7aa078f3510..6c7b364d0bf03 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c -@@ -130,11 +130,8 @@ static int cmd_alloc_index(struct mlx5_cmd *cmd) - - static void cmd_free_index(struct mlx5_cmd *cmd, int idx) - { -- unsigned long flags; -- -- spin_lock_irqsave(&cmd->alloc_lock, flags); -+ lockdep_assert_held(&cmd->alloc_lock); - set_bit(idx, &cmd->bitmask); -- spin_unlock_irqrestore(&cmd->alloc_lock, flags); - } - - static void cmd_ent_get(struct mlx5_cmd_work_ent *ent) -@@ -144,17 +141,21 @@ static void cmd_ent_get(struct mlx5_cmd_work_ent *ent) - - static void cmd_ent_put(struct mlx5_cmd_work_ent *ent) - { -+ struct mlx5_cmd *cmd = ent->cmd; -+ unsigned long flags; -+ -+ spin_lock_irqsave(&cmd->alloc_lock, flags); - if (!refcount_dec_and_test(&ent->refcnt)) -- return; -+ goto out; - - if (ent->idx >= 0) { -- struct mlx5_cmd *cmd = ent->cmd; -- - cmd_free_index(cmd, ent->idx); - up(ent->page_queue ? &cmd->pages_sem : &cmd->sem); - } - - cmd_free_ent(ent); -+out: -+ spin_unlock_irqrestore(&cmd->alloc_lock, flags); - } - - static struct mlx5_cmd_layout *get_inst(struct mlx5_cmd *cmd, int idx) -diff --git a/drivers/net/ethernet/nxp/lpc_eth.c b/drivers/net/ethernet/nxp/lpc_eth.c -index 3b177421651f1..d2e220a94a57c 100644 ---- a/drivers/net/ethernet/nxp/lpc_eth.c -+++ b/drivers/net/ethernet/nxp/lpc_eth.c -@@ -1470,6 +1470,7 @@ static int lpc_eth_drv_resume(struct platform_device *pdev) - { - struct net_device *ndev = platform_get_drvdata(pdev); - struct netdata_local *pldat; -+ int ret; - - if (device_may_wakeup(&pdev->dev)) - disable_irq_wake(ndev->irq); -@@ -1479,7 +1480,9 @@ static int lpc_eth_drv_resume(struct platform_device *pdev) - pldat = netdev_priv(ndev); - - /* Enable interface clock */ -- clk_enable(pldat->clk); -+ ret = clk_enable(pldat->clk); -+ if (ret) -+ return ret; - - /* Reset and initialize */ - __lpc_eth_reset(pldat); -diff --git a/drivers/net/ethernet/qlogic/qed/qed_sriov.c b/drivers/net/ethernet/qlogic/qed/qed_sriov.c -index fb9c3ca5d36cc..5e8f8eb916e64 100644 ---- a/drivers/net/ethernet/qlogic/qed/qed_sriov.c -+++ b/drivers/net/ethernet/qlogic/qed/qed_sriov.c -@@ -3801,11 +3801,11 @@ bool qed_iov_mark_vf_flr(struct qed_hwfn *p_hwfn, u32 *p_disabled_vfs) - return found; - } - --static void qed_iov_get_link(struct qed_hwfn *p_hwfn, -- u16 vfid, -- struct qed_mcp_link_params *p_params, -- struct qed_mcp_link_state *p_link, -- struct qed_mcp_link_capabilities *p_caps) -+static int qed_iov_get_link(struct qed_hwfn *p_hwfn, -+ u16 vfid, -+ struct qed_mcp_link_params *p_params, -+ struct qed_mcp_link_state *p_link, -+ struct qed_mcp_link_capabilities *p_caps) - { - struct qed_vf_info *p_vf = qed_iov_get_vf_info(p_hwfn, - vfid, -@@ -3813,7 +3813,7 @@ static void qed_iov_get_link(struct qed_hwfn *p_hwfn, - struct qed_bulletin_content *p_bulletin; - - if (!p_vf) -- return; -+ return -EINVAL; - - p_bulletin = p_vf->bulletin.p_virt; - -@@ -3823,6 +3823,7 @@ static void qed_iov_get_link(struct qed_hwfn *p_hwfn, - __qed_vf_get_link_state(p_hwfn, p_link, p_bulletin); - if (p_caps) - __qed_vf_get_link_caps(p_hwfn, p_caps, p_bulletin); -+ return 0; - } - - static int -@@ -4684,6 +4685,7 @@ static int qed_get_vf_config(struct qed_dev *cdev, - struct qed_public_vf_info *vf_info; - struct qed_mcp_link_state link; - u32 tx_rate; -+ int ret; - - /* Sanitize request */ - if (IS_VF(cdev)) -@@ -4697,7 +4699,9 @@ static int qed_get_vf_config(struct qed_dev *cdev, - - vf_info = qed_iov_get_public_vf_info(hwfn, vf_id, true); - -- qed_iov_get_link(hwfn, vf_id, NULL, &link, NULL); -+ ret = qed_iov_get_link(hwfn, vf_id, NULL, &link, NULL); -+ if (ret) -+ return ret; - - /* Fill information about VF */ - ivi->vf = vf_id; -diff --git a/drivers/net/ethernet/qlogic/qed/qed_vf.c b/drivers/net/ethernet/qlogic/qed/qed_vf.c -index adc2c8f3d48ef..62e4511db8575 100644 ---- a/drivers/net/ethernet/qlogic/qed/qed_vf.c -+++ b/drivers/net/ethernet/qlogic/qed/qed_vf.c -@@ -539,6 +539,9 @@ int qed_vf_hw_prepare(struct qed_hwfn *p_hwfn) - p_iov->bulletin.size, - &p_iov->bulletin.phys, - GFP_KERNEL); -+ if (!p_iov->bulletin.p_virt) -+ goto free_pf2vf_reply; -+ - DP_VERBOSE(p_hwfn, QED_MSG_IOV, - "VF's bulletin Board [%p virt 0x%llx phys 0x%08x bytes]\n", - p_iov->bulletin.p_virt, -@@ -578,6 +581,10 @@ int qed_vf_hw_prepare(struct qed_hwfn *p_hwfn) - - return rc; - -+free_pf2vf_reply: -+ dma_free_coherent(&p_hwfn->cdev->pdev->dev, -+ sizeof(union pfvf_tlvs), -+ p_iov->pf2vf_reply, p_iov->pf2vf_reply_phys); - free_vf2pf_request: - dma_free_coherent(&p_hwfn->cdev->pdev->dev, - sizeof(union vfpf_tlvs), -diff --git a/drivers/net/ethernet/ti/cpts.c b/drivers/net/ethernet/ti/cpts.c -index 26cfe3f7ed8df..453ad1247288d 100644 ---- a/drivers/net/ethernet/ti/cpts.c -+++ b/drivers/net/ethernet/ti/cpts.c -@@ -454,7 +454,9 @@ int cpts_register(struct cpts *cpts) - for (i = 0; i < CPTS_MAX_EVENTS; i++) - list_add(&cpts->pool_data[i].list, &cpts->pool); - -- clk_enable(cpts->refclk); -+ err = clk_enable(cpts->refclk); -+ if (err) -+ return err; - - cpts_write32(cpts, CPTS_EN, control); - cpts_write32(cpts, TS_PEND_EN, int_enable); -diff --git a/drivers/net/ethernet/xilinx/xilinx_emaclite.c b/drivers/net/ethernet/xilinx/xilinx_emaclite.c -index 53dbf3e28f1ef..63a2d1bcccfbc 100644 ---- a/drivers/net/ethernet/xilinx/xilinx_emaclite.c -+++ b/drivers/net/ethernet/xilinx/xilinx_emaclite.c -@@ -1187,7 +1187,7 @@ static int xemaclite_of_probe(struct platform_device *ofdev) - if (rc) { - dev_err(dev, - "Cannot register network device, aborting\n"); -- goto error; -+ goto put_node; - } - - dev_info(dev, -@@ -1195,6 +1195,8 @@ static int xemaclite_of_probe(struct platform_device *ofdev) - (unsigned int __force)ndev->mem_start, lp->base_addr, ndev->irq); - return 0; - -+put_node: -+ of_node_put(lp->phy_node); - error: - free_netdev(ndev); - return rc; -diff --git a/drivers/net/phy/dp83822.c b/drivers/net/phy/dp83822.c -index 8a4b1d167ce2f..ae17d2f9d5347 100644 ---- a/drivers/net/phy/dp83822.c -+++ b/drivers/net/phy/dp83822.c -@@ -238,7 +238,7 @@ static int dp83822_config_intr(struct phy_device *phydev) - if (err < 0) - return err; - -- err = phy_write(phydev, MII_DP83822_MISR1, 0); -+ err = phy_write(phydev, MII_DP83822_MISR2, 0); - if (err < 0) - return err; - -diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c -index 416305e6d0932..44e353dd2ba19 100644 ---- a/drivers/net/xen-netback/xenbus.c -+++ b/drivers/net/xen-netback/xenbus.c -@@ -435,6 +435,7 @@ static void backend_disconnect(struct backend_info *be) - unsigned int queue_index; - - xen_unregister_watchers(vif); -+ xenbus_rm(XBT_NIL, be->dev->nodename, "hotplug-status"); - #ifdef CONFIG_DEBUG_FS - xenvif_debugfs_delif(vif); - #endif /* CONFIG_DEBUG_FS */ -@@ -979,15 +980,11 @@ static void connect(struct backend_info *be) - xenvif_carrier_on(be->vif); - - unregister_hotplug_status_watch(be); -- if (xenbus_exists(XBT_NIL, dev->nodename, "hotplug-status")) { -- err = xenbus_watch_pathfmt(dev, &be->hotplug_status_watch, -- NULL, hotplug_status_changed, -- "%s/%s", dev->nodename, -- "hotplug-status"); -- if (err) -- goto err; -+ err = xenbus_watch_pathfmt(dev, &be->hotplug_status_watch, NULL, -+ hotplug_status_changed, -+ "%s/%s", dev->nodename, "hotplug-status"); -+ if (!err) - be->have_hotplug_status_watch = 1; -- } - - netif_tx_wake_all_queues(be->vif->dev); - -diff --git a/drivers/nfc/port100.c b/drivers/nfc/port100.c -index 1caebefb25ff1..2ae1474faede9 100644 ---- a/drivers/nfc/port100.c -+++ b/drivers/nfc/port100.c -@@ -1609,7 +1609,9 @@ free_nfc_dev: - nfc_digital_free_device(dev->nfc_digital_dev); - - error: -+ usb_kill_urb(dev->in_urb); - usb_free_urb(dev->in_urb); -+ usb_kill_urb(dev->out_urb); - usb_free_urb(dev->out_urb); - usb_put_dev(dev->udev); - -diff --git a/drivers/staging/gdm724x/gdm_lte.c b/drivers/staging/gdm724x/gdm_lte.c -index 8093d06086388..4dba62aed10b8 100644 ---- a/drivers/staging/gdm724x/gdm_lte.c -+++ b/drivers/staging/gdm724x/gdm_lte.c -@@ -76,14 +76,15 @@ static void tx_complete(void *arg) - - static int gdm_lte_rx(struct sk_buff *skb, struct nic *nic, int nic_type) - { -- int ret; -+ int ret, len; - -+ len = skb->len + ETH_HLEN; - ret = netif_rx_ni(skb); - if (ret == NET_RX_DROP) { - nic->stats.rx_dropped++; - } else { - nic->stats.rx_packets++; -- nic->stats.rx_bytes += skb->len + ETH_HLEN; -+ nic->stats.rx_bytes += len; - } - - return 0; -diff --git a/drivers/virtio/virtio.c b/drivers/virtio/virtio.c -index 91627e7443260..cab97cda54304 100644 ---- a/drivers/virtio/virtio.c -+++ b/drivers/virtio/virtio.c -@@ -167,14 +167,12 @@ void virtio_add_status(struct virtio_device *dev, unsigned int status) - } - EXPORT_SYMBOL_GPL(virtio_add_status); - --int virtio_finalize_features(struct virtio_device *dev) -+/* Do some validation, then set FEATURES_OK */ -+static int virtio_features_ok(struct virtio_device *dev) - { -- int ret = dev->config->finalize_features(dev); - unsigned status; - - might_sleep(); -- if (ret) -- return ret; - - if (!virtio_has_feature(dev, VIRTIO_F_VERSION_1)) - return 0; -@@ -188,7 +186,6 @@ int virtio_finalize_features(struct virtio_device *dev) - } - return 0; - } --EXPORT_SYMBOL_GPL(virtio_finalize_features); - - static int virtio_dev_probe(struct device *_d) - { -@@ -225,17 +222,6 @@ static int virtio_dev_probe(struct device *_d) - driver_features_legacy = driver_features; - } - -- /* -- * Some devices detect legacy solely via F_VERSION_1. Write -- * F_VERSION_1 to force LE config space accesses before FEATURES_OK for -- * these when needed. -- */ -- if (drv->validate && !virtio_legacy_is_little_endian() -- && device_features & BIT_ULL(VIRTIO_F_VERSION_1)) { -- dev->features = BIT_ULL(VIRTIO_F_VERSION_1); -- dev->config->finalize_features(dev); -- } -- - if (device_features & (1ULL << VIRTIO_F_VERSION_1)) - dev->features = driver_features & device_features; - else -@@ -246,13 +232,26 @@ static int virtio_dev_probe(struct device *_d) - if (device_features & (1ULL << i)) - __virtio_set_bit(dev, i); - -+ err = dev->config->finalize_features(dev); -+ if (err) -+ goto err; -+ - if (drv->validate) { -+ u64 features = dev->features; -+ - err = drv->validate(dev); - if (err) - goto err; -+ -+ /* Did validation change any features? Then write them again. */ -+ if (features != dev->features) { -+ err = dev->config->finalize_features(dev); -+ if (err) -+ goto err; -+ } - } - -- err = virtio_finalize_features(dev); -+ err = virtio_features_ok(dev); - if (err) - goto err; - -@@ -417,7 +416,11 @@ int virtio_device_restore(struct virtio_device *dev) - /* We have a driver! */ - virtio_add_status(dev, VIRTIO_CONFIG_S_DRIVER); - -- ret = virtio_finalize_features(dev); -+ ret = dev->config->finalize_features(dev); -+ if (ret) -+ goto err; -+ -+ ret = virtio_features_ok(dev); - if (ret) - goto err; - -diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c -index ad1d4c8faf449..b7f20196439a2 100644 ---- a/fs/ext4/resize.c -+++ b/fs/ext4/resize.c -@@ -74,6 +74,11 @@ int ext4_resize_begin(struct super_block *sb) - return -EPERM; - } - -+ if (ext4_has_feature_sparse_super2(sb)) { -+ ext4_msg(sb, KERN_ERR, "Online resizing not supported with sparse_super2"); -+ return -EOPNOTSUPP; -+ } -+ - if (test_and_set_bit_lock(EXT4_FLAGS_RESIZING, - &EXT4_SB(sb)->s_ext4_flags)) - ret = -EBUSY; -diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c -index 64d6c8c9f1ff2..ac6a8da340139 100644 ---- a/fs/fuse/dev.c -+++ b/fs/fuse/dev.c -@@ -933,7 +933,17 @@ static int fuse_copy_page(struct fuse_copy_state *cs, struct page **pagep, - - while (count) { - if (cs->write && cs->pipebufs && page) { -- return fuse_ref_page(cs, page, offset, count); -+ /* -+ * Can't control lifetime of pipe buffers, so always -+ * copy user pages. -+ */ -+ if (cs->req->args->user_pages) { -+ err = fuse_copy_fill(cs); -+ if (err) -+ return err; -+ } else { -+ return fuse_ref_page(cs, page, offset, count); -+ } - } else if (!cs->len) { - if (cs->move_pages && page && - offset == 0 && count == PAGE_SIZE) { -diff --git a/fs/fuse/file.c b/fs/fuse/file.c -index 5cf13196ce69e..efb2a48712919 100644 ---- a/fs/fuse/file.c -+++ b/fs/fuse/file.c -@@ -1433,6 +1433,7 @@ static int fuse_get_user_pages(struct fuse_args_pages *ap, struct iov_iter *ii, - (PAGE_SIZE - ret) & (PAGE_SIZE - 1); - } - -+ ap->args.user_pages = true; - if (write) - ap->args.in_pages = 1; - else -diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h -index d878926485451..83c2855bc7406 100644 ---- a/fs/fuse/fuse_i.h -+++ b/fs/fuse/fuse_i.h -@@ -248,6 +248,7 @@ struct fuse_args { - bool nocreds:1; - bool in_pages:1; - bool out_pages:1; -+ bool user_pages:1; - bool out_argvar:1; - bool page_zeroing:1; - bool page_replace:1; -diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h -index 641a01bc5f6f7..031022e326356 100644 ---- a/include/linux/mlx5/mlx5_ifc.h -+++ b/include/linux/mlx5/mlx5_ifc.h -@@ -8975,8 +8975,8 @@ struct mlx5_ifc_bufferx_reg_bits { - u8 reserved_at_0[0x6]; - u8 lossy[0x1]; - u8 epsb[0x1]; -- u8 reserved_at_8[0xc]; -- u8 size[0xc]; -+ u8 reserved_at_8[0x8]; -+ u8 size[0x10]; - - u8 xoff_threshold[0x10]; - u8 xon_threshold[0x10]; -diff --git a/include/linux/virtio.h b/include/linux/virtio.h -index 7c075463c7f2b..b80376654a604 100644 ---- a/include/linux/virtio.h -+++ b/include/linux/virtio.h -@@ -135,7 +135,6 @@ void virtio_break_device(struct virtio_device *dev); - void virtio_config_changed(struct virtio_device *dev); - void virtio_config_disable(struct virtio_device *dev); - void virtio_config_enable(struct virtio_device *dev); --int virtio_finalize_features(struct virtio_device *dev); - #ifdef CONFIG_PM_SLEEP - int virtio_device_freeze(struct virtio_device *dev); - int virtio_device_restore(struct virtio_device *dev); -diff --git a/include/linux/virtio_config.h b/include/linux/virtio_config.h -index bb4cc49107503..ad4d4697a1673 100644 ---- a/include/linux/virtio_config.h -+++ b/include/linux/virtio_config.h -@@ -56,8 +56,9 @@ struct irq_affinity; - * Returns the first 64 feature bits (all we currently need). - * @finalize_features: confirm what device features we'll be using. - * vdev: the virtio_device -- * This gives the final feature bits for the device: it can change -+ * This sends the driver feature bits to the device: it can change - * the dev->feature bits if it wants. -+ * Note: despite the name this can be called any number of times. - * Returns 0 on success or error status - * @bus_name: return the bus name associated with the device (optional) - * vdev: the virtio_device -diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c -index 1a89b2bf626a5..56619766e9103 100644 ---- a/kernel/trace/trace.c -+++ b/kernel/trace/trace.c -@@ -1305,10 +1305,12 @@ static int __init set_buf_size(char *str) - if (!str) - return 0; - buf_size = memparse(str, &str); -- /* nr_entries can not be zero */ -- if (buf_size == 0) -- return 0; -- trace_buf_size = buf_size; -+ /* -+ * nr_entries can not be zero and the startup -+ * tests require some buffer space. Therefore -+ * ensure we have at least 4096 bytes of buffer. -+ */ -+ trace_buf_size = max(4096UL, buf_size); - return 1; - } - __setup("trace_buf_size=", set_buf_size); -diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c -index 184af6da0defc..093b73c454d28 100644 ---- a/net/ax25/af_ax25.c -+++ b/net/ax25/af_ax25.c -@@ -87,6 +87,13 @@ again: - ax25_for_each(s, &ax25_list) { - if (s->ax25_dev == ax25_dev) { - sk = s->sk; -+ if (!sk) { -+ spin_unlock_bh(&ax25_list_lock); -+ s->ax25_dev = NULL; -+ ax25_disconnect(s, ENETUNREACH); -+ spin_lock_bh(&ax25_list_lock); -+ goto again; -+ } - sock_hold(sk); - spin_unlock_bh(&ax25_list_lock); - lock_sock(sk); -diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c -index bcad7028bbf45..ad45f13a0370b 100644 ---- a/net/core/net-sysfs.c -+++ b/net/core/net-sysfs.c -@@ -212,7 +212,7 @@ static ssize_t speed_show(struct device *dev, - if (!rtnl_trylock()) - return restart_syscall(); - -- if (netif_running(netdev)) { -+ if (netif_running(netdev) && netif_device_present(netdev)) { - struct ethtool_link_ksettings cmd; - - if (!__ethtool_get_link_ksettings(netdev, &cmd)) -diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c -index d1f29a3eb70be..60d070b254846 100644 ---- a/net/ipv6/addrconf.c -+++ b/net/ipv6/addrconf.c -@@ -4924,6 +4924,7 @@ static int inet6_fill_ifaddr(struct sk_buff *skb, struct inet6_ifaddr *ifa, - nla_put_s32(skb, IFA_TARGET_NETNSID, args->netnsid)) - goto error; - -+ spin_lock_bh(&ifa->lock); - if (!((ifa->flags&IFA_F_PERMANENT) && - (ifa->prefered_lft == INFINITY_LIFE_TIME))) { - preferred = ifa->prefered_lft; -@@ -4945,6 +4946,7 @@ static int inet6_fill_ifaddr(struct sk_buff *skb, struct inet6_ifaddr *ifa, - preferred = INFINITY_LIFE_TIME; - valid = INFINITY_LIFE_TIME; - } -+ spin_unlock_bh(&ifa->lock); - - if (!ipv6_addr_any(&ifa->peer_addr)) { - if (nla_put_in6_addr(skb, IFA_LOCAL, &ifa->addr) < 0 || -diff --git a/net/sctp/diag.c b/net/sctp/diag.c -index 7921e77fa55a3..5a918e74bb82b 100644 ---- a/net/sctp/diag.c -+++ b/net/sctp/diag.c -@@ -61,10 +61,6 @@ static void inet_diag_msg_sctpasoc_fill(struct inet_diag_msg *r, - r->idiag_timer = SCTP_EVENT_TIMEOUT_T3_RTX; - r->idiag_retrans = asoc->rtx_data_chunks; - r->idiag_expires = jiffies_to_msecs(t3_rtx->expires - jiffies); -- } else { -- r->idiag_timer = 0; -- r->idiag_retrans = 0; -- r->idiag_expires = 0; - } - } - -@@ -144,13 +140,14 @@ static int inet_sctp_diag_fill(struct sock *sk, struct sctp_association *asoc, - r = nlmsg_data(nlh); - BUG_ON(!sk_fullsock(sk)); - -+ r->idiag_timer = 0; -+ r->idiag_retrans = 0; -+ r->idiag_expires = 0; - if (asoc) { - inet_diag_msg_sctpasoc_fill(r, sk, asoc); - } else { - inet_diag_msg_common_fill(r, sk); - r->idiag_state = sk->sk_state; -- r->idiag_timer = 0; -- r->idiag_retrans = 0; - } - - if (inet_diag_msg_attrs_fill(sk, skb, r, ext, user_ns, net_admin)) -diff --git a/tools/testing/selftests/bpf/prog_tests/timer_crash.c b/tools/testing/selftests/bpf/prog_tests/timer_crash.c -new file mode 100644 -index 0000000000000..f74b82305da8c ---- /dev/null -+++ b/tools/testing/selftests/bpf/prog_tests/timer_crash.c -@@ -0,0 +1,32 @@ -+// SPDX-License-Identifier: GPL-2.0 -+#include -+#include "timer_crash.skel.h" -+ -+enum { -+ MODE_ARRAY, -+ MODE_HASH, -+}; -+ -+static void test_timer_crash_mode(int mode) -+{ -+ struct timer_crash *skel; -+ -+ skel = timer_crash__open_and_load(); -+ if (!ASSERT_OK_PTR(skel, "timer_crash__open_and_load")) -+ return; -+ skel->bss->pid = getpid(); -+ skel->bss->crash_map = mode; -+ if (!ASSERT_OK(timer_crash__attach(skel), "timer_crash__attach")) -+ goto end; -+ usleep(1); -+end: -+ timer_crash__destroy(skel); -+} -+ -+void test_timer_crash(void) -+{ -+ if (test__start_subtest("array")) -+ test_timer_crash_mode(MODE_ARRAY); -+ if (test__start_subtest("hash")) -+ test_timer_crash_mode(MODE_HASH); -+} -diff --git a/tools/testing/selftests/bpf/progs/timer_crash.c b/tools/testing/selftests/bpf/progs/timer_crash.c -new file mode 100644 -index 0000000000000..f8f7944e70dae ---- /dev/null -+++ b/tools/testing/selftests/bpf/progs/timer_crash.c -@@ -0,0 +1,54 @@ -+// SPDX-License-Identifier: GPL-2.0 -+ -+#include -+#include -+#include -+ -+struct map_elem { -+ struct bpf_timer timer; -+ struct bpf_spin_lock lock; -+}; -+ -+struct { -+ __uint(type, BPF_MAP_TYPE_ARRAY); -+ __uint(max_entries, 1); -+ __type(key, int); -+ __type(value, struct map_elem); -+} amap SEC(".maps"); -+ -+struct { -+ __uint(type, BPF_MAP_TYPE_HASH); -+ __uint(max_entries, 1); -+ __type(key, int); -+ __type(value, struct map_elem); -+} hmap SEC(".maps"); -+ -+int pid = 0; -+int crash_map = 0; /* 0 for amap, 1 for hmap */ -+ -+SEC("fentry/do_nanosleep") -+int sys_enter(void *ctx) -+{ -+ struct map_elem *e, value = {}; -+ void *map = crash_map ? (void *)&hmap : (void *)&amap; -+ -+ if (bpf_get_current_task_btf()->tgid != pid) -+ return 0; -+ -+ *(void **)&value = (void *)0xdeadcaf3; -+ -+ bpf_map_update_elem(map, &(int){0}, &value, 0); -+ /* For array map, doing bpf_map_update_elem will do a -+ * check_and_free_timer_in_array, which will trigger the crash if timer -+ * pointer was overwritten, for hmap we need to use bpf_timer_cancel. -+ */ -+ if (crash_map == 1) { -+ e = bpf_map_lookup_elem(map, &(int){0}); -+ if (!e) -+ return 0; -+ bpf_timer_cancel(&e->timer); -+ } -+ return 0; -+} -+ -+char _license[] SEC("license") = "GPL"; -diff --git a/tools/testing/selftests/memfd/memfd_test.c b/tools/testing/selftests/memfd/memfd_test.c -index c67d32eeb668e..290cec2a6a338 100644 ---- a/tools/testing/selftests/memfd/memfd_test.c -+++ b/tools/testing/selftests/memfd/memfd_test.c -@@ -421,6 +421,7 @@ static void mfd_fail_write(int fd) - printf("mmap()+mprotect() didn't fail as expected\n"); - abort(); - } -+ munmap(p, mfd_def_size); - } - - /* verify PUNCH_HOLE fails */ -diff --git a/tools/testing/selftests/net/pmtu.sh b/tools/testing/selftests/net/pmtu.sh -index 3429767cadcdd..88be9083b923b 100755 ---- a/tools/testing/selftests/net/pmtu.sh -+++ b/tools/testing/selftests/net/pmtu.sh -@@ -579,7 +579,6 @@ setup_routing() { - setup() { - [ "$(id -u)" -ne 0 ] && echo " need to run as root" && return $ksft_skip - -- cleanup - for arg do - eval setup_${arg} || { echo " ${arg} not supported"; return 1; } - done -@@ -590,7 +589,7 @@ trace() { - - for arg do - [ "${ns_cmd}" = "" ] && ns_cmd="${arg}" && continue -- ${ns_cmd} tcpdump -s 0 -i "${arg}" -w "${name}_${arg}.pcap" 2> /dev/null & -+ ${ns_cmd} tcpdump --immediate-mode -s 0 -i "${arg}" -w "${name}_${arg}.pcap" 2> /dev/null & - tcpdump_pids="${tcpdump_pids} $!" - ns_cmd= - done -@@ -1182,6 +1181,10 @@ run_test() { - - unset IFS - -+ # Since cleanup() relies on variables modified by this subshell, it -+ # has to run in this context. -+ trap cleanup EXIT -+ - if [ "$VERBOSE" = "1" ]; then - printf "\n##########################################################################\n\n" - fi -diff --git a/tools/testing/selftests/vm/map_fixed_noreplace.c b/tools/testing/selftests/vm/map_fixed_noreplace.c -index d91bde5112686..eed44322d1a63 100644 ---- a/tools/testing/selftests/vm/map_fixed_noreplace.c -+++ b/tools/testing/selftests/vm/map_fixed_noreplace.c -@@ -17,9 +17,6 @@ - #define MAP_FIXED_NOREPLACE 0x100000 - #endif - --#define BASE_ADDRESS (256ul * 1024 * 1024) -- -- - static void dump_maps(void) - { - char cmd[32]; -@@ -28,18 +25,46 @@ static void dump_maps(void) - system(cmd); - } - -+static unsigned long find_base_addr(unsigned long size) -+{ -+ void *addr; -+ unsigned long flags; -+ -+ flags = MAP_PRIVATE | MAP_ANONYMOUS; -+ addr = mmap(NULL, size, PROT_NONE, flags, -1, 0); -+ if (addr == MAP_FAILED) { -+ printf("Error: couldn't map the space we need for the test\n"); -+ return 0; -+ } -+ -+ if (munmap(addr, size) != 0) { -+ printf("Error: couldn't map the space we need for the test\n"); -+ return 0; -+ } -+ return (unsigned long)addr; -+} -+ - int main(void) - { -+ unsigned long base_addr; - unsigned long flags, addr, size, page_size; - char *p; - - page_size = sysconf(_SC_PAGE_SIZE); - -+ //let's find a base addr that is free before we start the tests -+ size = 5 * page_size; -+ base_addr = find_base_addr(size); -+ if (!base_addr) { -+ printf("Error: couldn't map the space we need for the test\n"); -+ return 1; -+ } -+ - flags = MAP_PRIVATE | MAP_ANONYMOUS | MAP_FIXED_NOREPLACE; - - // Check we can map all the areas we need below - errno = 0; -- addr = BASE_ADDRESS; -+ addr = base_addr; - size = 5 * page_size; - p = mmap((void *)addr, size, PROT_NONE, flags, -1, 0); - -@@ -60,7 +85,7 @@ int main(void) - printf("unmap() successful\n"); - - errno = 0; -- addr = BASE_ADDRESS + page_size; -+ addr = base_addr + page_size; - size = 3 * page_size; - p = mmap((void *)addr, size, PROT_NONE, flags, -1, 0); - printf("mmap() @ 0x%lx-0x%lx p=%p result=%m\n", addr, addr + size, p); -@@ -80,7 +105,7 @@ int main(void) - * +4 | free | new - */ - errno = 0; -- addr = BASE_ADDRESS; -+ addr = base_addr; - size = 5 * page_size; - p = mmap((void *)addr, size, PROT_NONE, flags, -1, 0); - printf("mmap() @ 0x%lx-0x%lx p=%p result=%m\n", addr, addr + size, p); -@@ -101,7 +126,7 @@ int main(void) - * +4 | free | - */ - errno = 0; -- addr = BASE_ADDRESS + (2 * page_size); -+ addr = base_addr + (2 * page_size); - size = page_size; - p = mmap((void *)addr, size, PROT_NONE, flags, -1, 0); - printf("mmap() @ 0x%lx-0x%lx p=%p result=%m\n", addr, addr + size, p); -@@ -121,7 +146,7 @@ int main(void) - * +4 | free | new - */ - errno = 0; -- addr = BASE_ADDRESS + (3 * page_size); -+ addr = base_addr + (3 * page_size); - size = 2 * page_size; - p = mmap((void *)addr, size, PROT_NONE, flags, -1, 0); - printf("mmap() @ 0x%lx-0x%lx p=%p result=%m\n", addr, addr + size, p); -@@ -141,7 +166,7 @@ int main(void) - * +4 | free | - */ - errno = 0; -- addr = BASE_ADDRESS; -+ addr = base_addr; - size = 2 * page_size; - p = mmap((void *)addr, size, PROT_NONE, flags, -1, 0); - printf("mmap() @ 0x%lx-0x%lx p=%p result=%m\n", addr, addr + size, p); -@@ -161,7 +186,7 @@ int main(void) - * +4 | free | - */ - errno = 0; -- addr = BASE_ADDRESS; -+ addr = base_addr; - size = page_size; - p = mmap((void *)addr, size, PROT_NONE, flags, -1, 0); - printf("mmap() @ 0x%lx-0x%lx p=%p result=%m\n", addr, addr + size, p); -@@ -181,7 +206,7 @@ int main(void) - * +4 | free | new - */ - errno = 0; -- addr = BASE_ADDRESS + (4 * page_size); -+ addr = base_addr + (4 * page_size); - size = page_size; - p = mmap((void *)addr, size, PROT_NONE, flags, -1, 0); - printf("mmap() @ 0x%lx-0x%lx p=%p result=%m\n", addr, addr + size, p); -@@ -192,7 +217,7 @@ int main(void) - return 1; - } - -- addr = BASE_ADDRESS; -+ addr = base_addr; - size = 5 * page_size; - if (munmap((void *)addr, size) != 0) { - dump_maps(); diff --git a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.185-186.patch b/patch/kernel/archive/odroidxu4-5.4/patch-5.4.185-186.patch deleted file mode 100644 index ead390ff6..000000000 --- a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.185-186.patch +++ /dev/null @@ -1,2261 +0,0 @@ -diff --git a/Makefile b/Makefile -index bd3bdf86b992e..f9054b4e8a123 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 5 - PATCHLEVEL = 4 --SUBLEVEL = 185 -+SUBLEVEL = 186 - EXTRAVERSION = - NAME = Kleptomaniac Octopus - -diff --git a/arch/arm/boot/dts/rk322x.dtsi b/arch/arm/boot/dts/rk322x.dtsi -index 140e22d74dcfb..d393bb481e747 100644 ---- a/arch/arm/boot/dts/rk322x.dtsi -+++ b/arch/arm/boot/dts/rk322x.dtsi -@@ -635,8 +635,8 @@ - interrupts = ; - assigned-clocks = <&cru SCLK_HDMI_PHY>; - assigned-clock-parents = <&hdmi_phy>; -- clocks = <&cru SCLK_HDMI_HDCP>, <&cru PCLK_HDMI_CTRL>, <&cru SCLK_HDMI_CEC>; -- clock-names = "isfr", "iahb", "cec"; -+ clocks = <&cru PCLK_HDMI_CTRL>, <&cru SCLK_HDMI_HDCP>, <&cru SCLK_HDMI_CEC>; -+ clock-names = "iahb", "isfr", "cec"; - pinctrl-names = "default"; - pinctrl-0 = <&hdmii2c_xfer &hdmi_hpd &hdmi_cec>; - resets = <&cru SRST_HDMI_P>; -diff --git a/arch/arm/boot/dts/rk3288.dtsi b/arch/arm/boot/dts/rk3288.dtsi -index 658ceb96d8bd1..7dcafd0833ba8 100644 ---- a/arch/arm/boot/dts/rk3288.dtsi -+++ b/arch/arm/boot/dts/rk3288.dtsi -@@ -975,7 +975,7 @@ - status = "disabled"; - }; - -- crypto: cypto-controller@ff8a0000 { -+ crypto: crypto@ff8a0000 { - compatible = "rockchip,rk3288-crypto"; - reg = <0x0 0xff8a0000 0x0 0x4000>; - interrupts = ; -diff --git a/arch/arm/include/asm/kvm_host.h b/arch/arm/include/asm/kvm_host.h -index 32564b017ba06..d8ac89879327d 100644 ---- a/arch/arm/include/asm/kvm_host.h -+++ b/arch/arm/include/asm/kvm_host.h -@@ -15,6 +15,7 @@ - #include - #include - #include -+#include - #include - - #define __KVM_HAVE_ARCH_INTC_INITIALIZED -@@ -424,4 +425,10 @@ static inline bool kvm_arm_vcpu_is_finalized(struct kvm_vcpu *vcpu) - - #define kvm_arm_vcpu_loaded(vcpu) (false) - -+static inline int kvm_arm_get_spectre_bhb_state(void) -+{ -+ /* 32bit guests don't need firmware for this */ -+ return SPECTRE_VULNERABLE; /* aka SMCCC_RET_NOT_SUPPORTED */ -+} -+ - #endif /* __ARM_KVM_HOST_H__ */ -diff --git a/arch/arm/include/uapi/asm/kvm.h b/arch/arm/include/uapi/asm/kvm.h -index 2769360f195ca..89b8e70068a13 100644 ---- a/arch/arm/include/uapi/asm/kvm.h -+++ b/arch/arm/include/uapi/asm/kvm.h -@@ -227,6 +227,12 @@ struct kvm_vcpu_events { - #define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_NOT_REQUIRED 3 - #define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_ENABLED (1U << 4) - -+#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_3 KVM_REG_ARM_FW_REG(3) -+ /* Higher values mean better protection. */ -+#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_3_NOT_AVAIL 0 -+#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_3_AVAIL 1 -+#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_3_NOT_REQUIRED 2 -+ - /* Device Control API: ARM VGIC */ - #define KVM_DEV_ARM_VGIC_GRP_ADDR 0 - #define KVM_DEV_ARM_VGIC_GRP_DIST_REGS 1 -diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig -index 9c8ea59398658..a1a828ca188cf 100644 ---- a/arch/arm64/Kconfig -+++ b/arch/arm64/Kconfig -@@ -1139,6 +1139,15 @@ config ARM64_SSBD - - If unsure, say Y. - -+config MITIGATE_SPECTRE_BRANCH_HISTORY -+ bool "Mitigate Spectre style attacks against branch history" if EXPERT -+ default y -+ help -+ Speculation attacks against some high-performance processors can -+ make use of branch history to influence future speculation. -+ When taking an exception from user-space, a sequence of branches -+ or a firmware call overwrites the branch history. -+ - config RODATA_FULL_DEFAULT_ENABLED - bool "Apply r/o permissions of VM areas also to their linear aliases" - default y -diff --git a/arch/arm64/boot/dts/intel/socfpga_agilex.dtsi b/arch/arm64/boot/dts/intel/socfpga_agilex.dtsi -index d911d38877e52..19f17bb29e4bd 100644 ---- a/arch/arm64/boot/dts/intel/socfpga_agilex.dtsi -+++ b/arch/arm64/boot/dts/intel/socfpga_agilex.dtsi -@@ -369,7 +369,7 @@ - }; - - usb0: usb@ffb00000 { -- compatible = "snps,dwc2"; -+ compatible = "intel,socfpga-agilex-hsotg", "snps,dwc2"; - reg = <0xffb00000 0x40000>; - interrupts = <0 93 4>; - phys = <&usbphy0>; -@@ -381,7 +381,7 @@ - }; - - usb1: usb@ffb40000 { -- compatible = "snps,dwc2"; -+ compatible = "intel,socfpga-agilex-hsotg", "snps,dwc2"; - reg = <0xffb40000 0x40000>; - interrupts = <0 94 4>; - phys = <&usbphy0>; -diff --git a/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi -index 45b86933c6ea0..390b86ec65389 100644 ---- a/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi -+++ b/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi -@@ -467,6 +467,12 @@ - }; - - &sdhci { -+ /* -+ * Signal integrity isn't great at 200MHz but 100MHz has proven stable -+ * enough. -+ */ -+ max-frequency = <100000000>; -+ - bus-width = <8>; - mmc-hs400-1_8v; - mmc-hs400-enhanced-strobe; -diff --git a/arch/arm64/boot/dts/rockchip/rk3399.dtsi b/arch/arm64/boot/dts/rockchip/rk3399.dtsi -index 750dad0d17400..95942d917de53 100644 ---- a/arch/arm64/boot/dts/rockchip/rk3399.dtsi -+++ b/arch/arm64/boot/dts/rockchip/rk3399.dtsi -@@ -1746,10 +1746,10 @@ - interrupts = ; - clocks = <&cru PCLK_HDMI_CTRL>, - <&cru SCLK_HDMI_SFR>, -- <&cru PLL_VPLL>, -+ <&cru SCLK_HDMI_CEC>, - <&cru PCLK_VIO_GRF>, -- <&cru SCLK_HDMI_CEC>; -- clock-names = "iahb", "isfr", "vpll", "grf", "cec"; -+ <&cru PLL_VPLL>; -+ clock-names = "iahb", "isfr", "cec", "grf", "vpll"; - power-domains = <&power RK3399_PD_HDCP>; - reg-io-width = <4>; - rockchip,grf = <&grf>; -diff --git a/arch/arm64/include/asm/assembler.h b/arch/arm64/include/asm/assembler.h -index 4a4258f17c868..01112f9767bc3 100644 ---- a/arch/arm64/include/asm/assembler.h -+++ b/arch/arm64/include/asm/assembler.h -@@ -110,6 +110,13 @@ - hint #20 - .endm - -+/* -+ * Clear Branch History instruction -+ */ -+ .macro clearbhb -+ hint #22 -+ .endm -+ - /* - * Speculation barrier - */ -@@ -757,4 +764,30 @@ USER(\label, ic ivau, \tmp2) // invalidate I line PoU - .Lyield_out_\@ : - .endm - -+ .macro __mitigate_spectre_bhb_loop tmp -+#ifdef CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY -+alternative_cb spectre_bhb_patch_loop_iter -+ mov \tmp, #32 // Patched to correct the immediate -+alternative_cb_end -+.Lspectre_bhb_loop\@: -+ b . + 4 -+ subs \tmp, \tmp, #1 -+ b.ne .Lspectre_bhb_loop\@ -+ sb -+#endif /* CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY */ -+ .endm -+ -+ /* Save/restores x0-x3 to the stack */ -+ .macro __mitigate_spectre_bhb_fw -+#ifdef CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY -+ stp x0, x1, [sp, #-16]! -+ stp x2, x3, [sp, #-16]! -+ mov w0, #ARM_SMCCC_ARCH_WORKAROUND_3 -+alternative_cb arm64_update_smccc_conduit -+ nop // Patched to SMC/HVC #0 -+alternative_cb_end -+ ldp x2, x3, [sp], #16 -+ ldp x0, x1, [sp], #16 -+#endif /* CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY */ -+ .endm - #endif /* __ASM_ASSEMBLER_H */ -diff --git a/arch/arm64/include/asm/cpu.h b/arch/arm64/include/asm/cpu.h -index d72d995b7e258..85cc06380e93e 100644 ---- a/arch/arm64/include/asm/cpu.h -+++ b/arch/arm64/include/asm/cpu.h -@@ -25,6 +25,7 @@ struct cpuinfo_arm64 { - u64 reg_id_aa64dfr1; - u64 reg_id_aa64isar0; - u64 reg_id_aa64isar1; -+ u64 reg_id_aa64isar2; - u64 reg_id_aa64mmfr0; - u64 reg_id_aa64mmfr1; - u64 reg_id_aa64mmfr2; -diff --git a/arch/arm64/include/asm/cpucaps.h b/arch/arm64/include/asm/cpucaps.h -index 1dc3c762fdcb9..4ffa86149d28d 100644 ---- a/arch/arm64/include/asm/cpucaps.h -+++ b/arch/arm64/include/asm/cpucaps.h -@@ -55,7 +55,8 @@ - #define ARM64_WORKAROUND_CAVIUM_TX2_219_TVM 45 - #define ARM64_WORKAROUND_CAVIUM_TX2_219_PRFM 46 - #define ARM64_WORKAROUND_1542419 47 -+#define ARM64_SPECTRE_BHB 48 - --#define ARM64_NCAPS 48 -+#define ARM64_NCAPS 49 - - #endif /* __ASM_CPUCAPS_H */ -diff --git a/arch/arm64/include/asm/cpufeature.h b/arch/arm64/include/asm/cpufeature.h -index ccae05da98a7f..f63438474dd54 100644 ---- a/arch/arm64/include/asm/cpufeature.h -+++ b/arch/arm64/include/asm/cpufeature.h -@@ -508,6 +508,34 @@ static inline bool cpu_supports_mixed_endian_el0(void) - return id_aa64mmfr0_mixed_endian_el0(read_cpuid(ID_AA64MMFR0_EL1)); - } - -+static inline bool supports_csv2p3(int scope) -+{ -+ u64 pfr0; -+ u8 csv2_val; -+ -+ if (scope == SCOPE_LOCAL_CPU) -+ pfr0 = read_sysreg_s(SYS_ID_AA64PFR0_EL1); -+ else -+ pfr0 = read_sanitised_ftr_reg(SYS_ID_AA64PFR0_EL1); -+ -+ csv2_val = cpuid_feature_extract_unsigned_field(pfr0, -+ ID_AA64PFR0_CSV2_SHIFT); -+ return csv2_val == 3; -+} -+ -+static inline bool supports_clearbhb(int scope) -+{ -+ u64 isar2; -+ -+ if (scope == SCOPE_LOCAL_CPU) -+ isar2 = read_sysreg_s(SYS_ID_AA64ISAR2_EL1); -+ else -+ isar2 = read_sanitised_ftr_reg(SYS_ID_AA64ISAR2_EL1); -+ -+ return cpuid_feature_extract_unsigned_field(isar2, -+ ID_AA64ISAR2_CLEARBHB_SHIFT); -+} -+ - static inline bool system_supports_32bit_el0(void) - { - return cpus_have_const_cap(ARM64_HAS_32BIT_EL0); -@@ -639,6 +667,18 @@ static inline int arm64_get_ssbd_state(void) - - void arm64_set_ssbd_mitigation(bool state); - -+/* Watch out, ordering is important here. */ -+enum mitigation_state { -+ SPECTRE_UNAFFECTED, -+ SPECTRE_MITIGATED, -+ SPECTRE_VULNERABLE, -+}; -+ -+enum mitigation_state arm64_get_spectre_bhb_state(void); -+bool is_spectre_bhb_affected(const struct arm64_cpu_capabilities *entry, int scope); -+u8 spectre_bhb_loop_affected(int scope); -+void spectre_bhb_enable_mitigation(const struct arm64_cpu_capabilities *__unused); -+ - extern int do_emulate_mrs(struct pt_regs *regs, u32 sys_reg, u32 rt); - - static inline u32 id_aa64mmfr0_parange_to_phys_shift(int parange) -diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h -index aca07c2f6e6e3..f0165df489a38 100644 ---- a/arch/arm64/include/asm/cputype.h -+++ b/arch/arm64/include/asm/cputype.h -@@ -71,6 +71,14 @@ - #define ARM_CPU_PART_CORTEX_A55 0xD05 - #define ARM_CPU_PART_CORTEX_A76 0xD0B - #define ARM_CPU_PART_NEOVERSE_N1 0xD0C -+#define ARM_CPU_PART_CORTEX_A77 0xD0D -+#define ARM_CPU_PART_NEOVERSE_V1 0xD40 -+#define ARM_CPU_PART_CORTEX_A78 0xD41 -+#define ARM_CPU_PART_CORTEX_X1 0xD44 -+#define ARM_CPU_PART_CORTEX_A710 0xD47 -+#define ARM_CPU_PART_CORTEX_X2 0xD48 -+#define ARM_CPU_PART_NEOVERSE_N2 0xD49 -+#define ARM_CPU_PART_CORTEX_A78C 0xD4B - - #define APM_CPU_PART_POTENZA 0x000 - -@@ -102,6 +110,14 @@ - #define MIDR_CORTEX_A55 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A55) - #define MIDR_CORTEX_A76 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A76) - #define MIDR_NEOVERSE_N1 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_N1) -+#define MIDR_CORTEX_A77 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A77) -+#define MIDR_NEOVERSE_V1 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V1) -+#define MIDR_CORTEX_A78 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A78) -+#define MIDR_CORTEX_X1 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X1) -+#define MIDR_CORTEX_A710 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A710) -+#define MIDR_CORTEX_X2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X2) -+#define MIDR_NEOVERSE_N2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_N2) -+#define MIDR_CORTEX_A78C MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A78C) - #define MIDR_THUNDERX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX) - #define MIDR_THUNDERX_81XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_81XX) - #define MIDR_THUNDERX_83XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_83XX) -diff --git a/arch/arm64/include/asm/fixmap.h b/arch/arm64/include/asm/fixmap.h -index f987b8a8f325e..928a96b9b1617 100644 ---- a/arch/arm64/include/asm/fixmap.h -+++ b/arch/arm64/include/asm/fixmap.h -@@ -63,9 +63,11 @@ enum fixed_addresses { - #endif /* CONFIG_ACPI_APEI_GHES */ - - #ifdef CONFIG_UNMAP_KERNEL_AT_EL0 -+ FIX_ENTRY_TRAMP_TEXT3, -+ FIX_ENTRY_TRAMP_TEXT2, -+ FIX_ENTRY_TRAMP_TEXT1, - FIX_ENTRY_TRAMP_DATA, -- FIX_ENTRY_TRAMP_TEXT, --#define TRAMP_VALIAS (__fix_to_virt(FIX_ENTRY_TRAMP_TEXT)) -+#define TRAMP_VALIAS (__fix_to_virt(FIX_ENTRY_TRAMP_TEXT1)) - #endif /* CONFIG_UNMAP_KERNEL_AT_EL0 */ - __end_of_permanent_fixed_addresses, - -diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h -index 697702a1a1ff1..e6efdbe88c0a9 100644 ---- a/arch/arm64/include/asm/kvm_host.h -+++ b/arch/arm64/include/asm/kvm_host.h -@@ -684,4 +684,9 @@ bool kvm_arm_vcpu_is_finalized(struct kvm_vcpu *vcpu); - - #define kvm_arm_vcpu_loaded(vcpu) ((vcpu)->arch.sysregs_loaded_on_cpu) - -+static inline enum mitigation_state kvm_arm_get_spectre_bhb_state(void) -+{ -+ return arm64_get_spectre_bhb_state(); -+} -+ - #endif /* __ARM64_KVM_HOST_H__ */ -diff --git a/arch/arm64/include/asm/kvm_mmu.h b/arch/arm64/include/asm/kvm_mmu.h -index befe37d4bc0e5..78d110667c0c7 100644 ---- a/arch/arm64/include/asm/kvm_mmu.h -+++ b/arch/arm64/include/asm/kvm_mmu.h -@@ -478,7 +478,8 @@ static inline void *kvm_get_hyp_vector(void) - void *vect = kern_hyp_va(kvm_ksym_ref(__kvm_hyp_vector)); - int slot = -1; - -- if (cpus_have_const_cap(ARM64_HARDEN_BRANCH_PREDICTOR) && data->fn) { -+ if ((cpus_have_const_cap(ARM64_HARDEN_BRANCH_PREDICTOR) || -+ cpus_have_const_cap(ARM64_SPECTRE_BHB)) && data->template_start) { - vect = kern_hyp_va(kvm_ksym_ref(__bp_harden_hyp_vecs_start)); - slot = data->hyp_vectors_slot; - } -@@ -507,7 +508,8 @@ static inline int kvm_map_vectors(void) - * !HBP + HEL2 -> allocate one vector slot and use exec mapping - * HBP + HEL2 -> use hardened vertors and use exec mapping - */ -- if (cpus_have_const_cap(ARM64_HARDEN_BRANCH_PREDICTOR)) { -+ if (cpus_have_const_cap(ARM64_HARDEN_BRANCH_PREDICTOR) || -+ cpus_have_const_cap(ARM64_SPECTRE_BHB)) { - __kvm_bp_vect_base = kvm_ksym_ref(__bp_harden_hyp_vecs_start); - __kvm_bp_vect_base = kern_hyp_va(__kvm_bp_vect_base); - } -diff --git a/arch/arm64/include/asm/mmu.h b/arch/arm64/include/asm/mmu.h -index f217e32929193..1b9e49fb0e1b7 100644 ---- a/arch/arm64/include/asm/mmu.h -+++ b/arch/arm64/include/asm/mmu.h -@@ -29,7 +29,7 @@ typedef struct { - */ - #define ASID(mm) ((mm)->context.id.counter & 0xffff) - --static inline bool arm64_kernel_unmapped_at_el0(void) -+static __always_inline bool arm64_kernel_unmapped_at_el0(void) - { - return IS_ENABLED(CONFIG_UNMAP_KERNEL_AT_EL0) && - cpus_have_const_cap(ARM64_UNMAP_KERNEL_AT_EL0); -@@ -82,6 +82,12 @@ typedef void (*bp_hardening_cb_t)(void); - struct bp_hardening_data { - int hyp_vectors_slot; - bp_hardening_cb_t fn; -+ -+ /* -+ * template_start is only used by the BHB mitigation to identify the -+ * hyp_vectors_slot sequence. -+ */ -+ const char *template_start; - }; - - #if (defined(CONFIG_HARDEN_BRANCH_PREDICTOR) || \ -diff --git a/arch/arm64/include/asm/sections.h b/arch/arm64/include/asm/sections.h -index 25a73aab438f9..a75f2882cc7cb 100644 ---- a/arch/arm64/include/asm/sections.h -+++ b/arch/arm64/include/asm/sections.h -@@ -20,4 +20,9 @@ extern char __irqentry_text_start[], __irqentry_text_end[]; - extern char __mmuoff_data_start[], __mmuoff_data_end[]; - extern char __entry_tramp_text_start[], __entry_tramp_text_end[]; - -+static inline size_t entry_tramp_text_size(void) -+{ -+ return __entry_tramp_text_end - __entry_tramp_text_start; -+} -+ - #endif /* __ASM_SECTIONS_H */ -diff --git a/arch/arm64/include/asm/sysreg.h b/arch/arm64/include/asm/sysreg.h -index 9b68f1b3915ec..5b3bdad66b27e 100644 ---- a/arch/arm64/include/asm/sysreg.h -+++ b/arch/arm64/include/asm/sysreg.h -@@ -165,6 +165,7 @@ - - #define SYS_ID_AA64ISAR0_EL1 sys_reg(3, 0, 0, 6, 0) - #define SYS_ID_AA64ISAR1_EL1 sys_reg(3, 0, 0, 6, 1) -+#define SYS_ID_AA64ISAR2_EL1 sys_reg(3, 0, 0, 6, 2) - - #define SYS_ID_AA64MMFR0_EL1 sys_reg(3, 0, 0, 7, 0) - #define SYS_ID_AA64MMFR1_EL1 sys_reg(3, 0, 0, 7, 1) -@@ -575,6 +576,21 @@ - #define ID_AA64ISAR1_GPI_NI 0x0 - #define ID_AA64ISAR1_GPI_IMP_DEF 0x1 - -+/* id_aa64isar2 */ -+#define ID_AA64ISAR2_CLEARBHB_SHIFT 28 -+#define ID_AA64ISAR2_RPRES_SHIFT 4 -+#define ID_AA64ISAR2_WFXT_SHIFT 0 -+ -+#define ID_AA64ISAR2_RPRES_8BIT 0x0 -+#define ID_AA64ISAR2_RPRES_12BIT 0x1 -+/* -+ * Value 0x1 has been removed from the architecture, and is -+ * reserved, but has not yet been removed from the ARM ARM -+ * as of ARM DDI 0487G.b. -+ */ -+#define ID_AA64ISAR2_WFXT_NI 0x0 -+#define ID_AA64ISAR2_WFXT_SUPPORTED 0x2 -+ - /* id_aa64pfr0 */ - #define ID_AA64PFR0_CSV3_SHIFT 60 - #define ID_AA64PFR0_CSV2_SHIFT 56 -@@ -646,6 +662,7 @@ - #endif - - /* id_aa64mmfr1 */ -+#define ID_AA64MMFR1_ECBHB_SHIFT 60 - #define ID_AA64MMFR1_PAN_SHIFT 20 - #define ID_AA64MMFR1_LOR_SHIFT 16 - #define ID_AA64MMFR1_HPD_SHIFT 12 -diff --git a/arch/arm64/include/asm/vectors.h b/arch/arm64/include/asm/vectors.h -new file mode 100644 -index 0000000000000..f64613a96d530 ---- /dev/null -+++ b/arch/arm64/include/asm/vectors.h -@@ -0,0 +1,73 @@ -+/* SPDX-License-Identifier: GPL-2.0-only */ -+/* -+ * Copyright (C) 2022 ARM Ltd. -+ */ -+#ifndef __ASM_VECTORS_H -+#define __ASM_VECTORS_H -+ -+#include -+#include -+ -+#include -+ -+extern char vectors[]; -+extern char tramp_vectors[]; -+extern char __bp_harden_el1_vectors[]; -+ -+/* -+ * Note: the order of this enum corresponds to two arrays in entry.S: -+ * tramp_vecs and __bp_harden_el1_vectors. By default the canonical -+ * 'full fat' vectors are used directly. -+ */ -+enum arm64_bp_harden_el1_vectors { -+#ifdef CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY -+ /* -+ * Perform the BHB loop mitigation, before branching to the canonical -+ * vectors. -+ */ -+ EL1_VECTOR_BHB_LOOP, -+ -+ /* -+ * Make the SMC call for firmware mitigation, before branching to the -+ * canonical vectors. -+ */ -+ EL1_VECTOR_BHB_FW, -+ -+ /* -+ * Use the ClearBHB instruction, before branching to the canonical -+ * vectors. -+ */ -+ EL1_VECTOR_BHB_CLEAR_INSN, -+#endif /* CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY */ -+ -+ /* -+ * Remap the kernel before branching to the canonical vectors. -+ */ -+ EL1_VECTOR_KPTI, -+}; -+ -+#ifndef CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY -+#define EL1_VECTOR_BHB_LOOP -1 -+#define EL1_VECTOR_BHB_FW -1 -+#define EL1_VECTOR_BHB_CLEAR_INSN -1 -+#endif /* !CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY */ -+ -+/* The vectors to use on return from EL0. e.g. to remap the kernel */ -+DECLARE_PER_CPU_READ_MOSTLY(const char *, this_cpu_vector); -+ -+#ifndef CONFIG_UNMAP_KERNEL_AT_EL0 -+#define TRAMP_VALIAS 0 -+#endif -+ -+static inline const char * -+arm64_get_bp_hardening_vector(enum arm64_bp_harden_el1_vectors slot) -+{ -+ if (arm64_kernel_unmapped_at_el0()) -+ return (char *)TRAMP_VALIAS + SZ_2K * slot; -+ -+ WARN_ON_ONCE(slot == EL1_VECTOR_KPTI); -+ -+ return __bp_harden_el1_vectors + SZ_2K * slot; -+} -+ -+#endif /* __ASM_VECTORS_H */ -diff --git a/arch/arm64/include/uapi/asm/kvm.h b/arch/arm64/include/uapi/asm/kvm.h -index 67c21f9bdbad2..08440ce57a1c2 100644 ---- a/arch/arm64/include/uapi/asm/kvm.h -+++ b/arch/arm64/include/uapi/asm/kvm.h -@@ -240,6 +240,11 @@ struct kvm_vcpu_events { - #define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_NOT_REQUIRED 3 - #define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_ENABLED (1U << 4) - -+#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_3 KVM_REG_ARM_FW_REG(3) -+#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_3_NOT_AVAIL 0 -+#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_3_AVAIL 1 -+#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_3_NOT_REQUIRED 2 -+ - /* SVE registers */ - #define KVM_REG_ARM64_SVE (0x15 << KVM_REG_ARM_COPROC_SHIFT) - -diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c -index 1e16c4e00e771..33b33416fea42 100644 ---- a/arch/arm64/kernel/cpu_errata.c -+++ b/arch/arm64/kernel/cpu_errata.c -@@ -13,6 +13,7 @@ - #include - #include - #include -+#include - - static bool __maybe_unused - is_affected_midr_range(const struct arm64_cpu_capabilities *entry, int scope) -@@ -116,6 +117,16 @@ DEFINE_PER_CPU_READ_MOSTLY(struct bp_hardening_data, bp_hardening_data); - #ifdef CONFIG_KVM_INDIRECT_VECTORS - extern char __smccc_workaround_1_smc_start[]; - extern char __smccc_workaround_1_smc_end[]; -+extern char __smccc_workaround_3_smc_start[]; -+extern char __smccc_workaround_3_smc_end[]; -+extern char __spectre_bhb_loop_k8_start[]; -+extern char __spectre_bhb_loop_k8_end[]; -+extern char __spectre_bhb_loop_k24_start[]; -+extern char __spectre_bhb_loop_k24_end[]; -+extern char __spectre_bhb_loop_k32_start[]; -+extern char __spectre_bhb_loop_k32_end[]; -+extern char __spectre_bhb_clearbhb_start[]; -+extern char __spectre_bhb_clearbhb_end[]; - - static void __copy_hyp_vect_bpi(int slot, const char *hyp_vecs_start, - const char *hyp_vecs_end) -@@ -129,11 +140,11 @@ static void __copy_hyp_vect_bpi(int slot, const char *hyp_vecs_start, - __flush_icache_range((uintptr_t)dst, (uintptr_t)dst + SZ_2K); - } - -+static DEFINE_RAW_SPINLOCK(bp_lock); - static void install_bp_hardening_cb(bp_hardening_cb_t fn, - const char *hyp_vecs_start, - const char *hyp_vecs_end) - { -- static DEFINE_RAW_SPINLOCK(bp_lock); - int cpu, slot = -1; - - /* -@@ -161,6 +172,7 @@ static void install_bp_hardening_cb(bp_hardening_cb_t fn, - - __this_cpu_write(bp_hardening_data.hyp_vectors_slot, slot); - __this_cpu_write(bp_hardening_data.fn, fn); -+ __this_cpu_write(bp_hardening_data.template_start, hyp_vecs_start); - raw_spin_unlock(&bp_lock); - } - #else -@@ -927,6 +939,13 @@ const struct arm64_cpu_capabilities arm64_errata[] = { - .cpu_enable = cpu_enable_ssbd_mitigation, - .midr_range_list = arm64_ssb_cpus, - }, -+ { -+ .desc = "Spectre-BHB", -+ .capability = ARM64_SPECTRE_BHB, -+ .type = ARM64_CPUCAP_LOCAL_CPU_ERRATUM, -+ .matches = is_spectre_bhb_affected, -+ .cpu_enable = spectre_bhb_enable_mitigation, -+ }, - #ifdef CONFIG_ARM64_ERRATUM_1418040 - { - .desc = "ARM erratum 1418040", -@@ -989,15 +1008,41 @@ ssize_t cpu_show_spectre_v1(struct device *dev, struct device_attribute *attr, - return sprintf(buf, "Mitigation: __user pointer sanitization\n"); - } - -+static const char *get_bhb_affected_string(enum mitigation_state bhb_state) -+{ -+ switch (bhb_state) { -+ case SPECTRE_UNAFFECTED: -+ return ""; -+ default: -+ case SPECTRE_VULNERABLE: -+ return ", but not BHB"; -+ case SPECTRE_MITIGATED: -+ return ", BHB"; -+ } -+} -+ - ssize_t cpu_show_spectre_v2(struct device *dev, struct device_attribute *attr, - char *buf) - { -+ enum mitigation_state bhb_state = arm64_get_spectre_bhb_state(); -+ const char *bhb_str = get_bhb_affected_string(bhb_state); -+ const char *v2_str = "Branch predictor hardening"; -+ - switch (get_spectre_v2_workaround_state()) { - case ARM64_BP_HARDEN_NOT_REQUIRED: -- return sprintf(buf, "Not affected\n"); -- case ARM64_BP_HARDEN_WA_NEEDED: -- return sprintf(buf, "Mitigation: Branch predictor hardening\n"); -- case ARM64_BP_HARDEN_UNKNOWN: -+ if (bhb_state == SPECTRE_UNAFFECTED) -+ return sprintf(buf, "Not affected\n"); -+ -+ /* -+ * Platforms affected by Spectre-BHB can't report -+ * "Not affected" for Spectre-v2. -+ */ -+ v2_str = "CSV2"; -+ fallthrough; -+ case ARM64_BP_HARDEN_WA_NEEDED: -+ return sprintf(buf, "Mitigation: %s%s\n", v2_str, bhb_str); -+ case ARM64_BP_HARDEN_UNKNOWN: -+ fallthrough; - default: - return sprintf(buf, "Vulnerable\n"); - } -@@ -1019,3 +1064,333 @@ ssize_t cpu_show_spec_store_bypass(struct device *dev, - - return sprintf(buf, "Vulnerable\n"); - } -+ -+/* -+ * We try to ensure that the mitigation state can never change as the result of -+ * onlining a late CPU. -+ */ -+static void update_mitigation_state(enum mitigation_state *oldp, -+ enum mitigation_state new) -+{ -+ enum mitigation_state state; -+ -+ do { -+ state = READ_ONCE(*oldp); -+ if (new <= state) -+ break; -+ } while (cmpxchg_relaxed(oldp, state, new) != state); -+} -+ -+/* -+ * Spectre BHB. -+ * -+ * A CPU is either: -+ * - Mitigated by a branchy loop a CPU specific number of times, and listed -+ * in our "loop mitigated list". -+ * - Mitigated in software by the firmware Spectre v2 call. -+ * - Has the ClearBHB instruction to perform the mitigation. -+ * - Has the 'Exception Clears Branch History Buffer' (ECBHB) feature, so no -+ * software mitigation in the vectors is needed. -+ * - Has CSV2.3, so is unaffected. -+ */ -+static enum mitigation_state spectre_bhb_state; -+ -+enum mitigation_state arm64_get_spectre_bhb_state(void) -+{ -+ return spectre_bhb_state; -+} -+ -+/* -+ * This must be called with SCOPE_LOCAL_CPU for each type of CPU, before any -+ * SCOPE_SYSTEM call will give the right answer. -+ */ -+u8 spectre_bhb_loop_affected(int scope) -+{ -+ u8 k = 0; -+ static u8 max_bhb_k; -+ -+ if (scope == SCOPE_LOCAL_CPU) { -+ static const struct midr_range spectre_bhb_k32_list[] = { -+ MIDR_ALL_VERSIONS(MIDR_CORTEX_A78), -+ MIDR_ALL_VERSIONS(MIDR_CORTEX_A78C), -+ MIDR_ALL_VERSIONS(MIDR_CORTEX_X1), -+ MIDR_ALL_VERSIONS(MIDR_CORTEX_A710), -+ MIDR_ALL_VERSIONS(MIDR_CORTEX_X2), -+ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N2), -+ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V1), -+ {}, -+ }; -+ static const struct midr_range spectre_bhb_k24_list[] = { -+ MIDR_ALL_VERSIONS(MIDR_CORTEX_A76), -+ MIDR_ALL_VERSIONS(MIDR_CORTEX_A77), -+ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N1), -+ {}, -+ }; -+ static const struct midr_range spectre_bhb_k8_list[] = { -+ MIDR_ALL_VERSIONS(MIDR_CORTEX_A72), -+ MIDR_ALL_VERSIONS(MIDR_CORTEX_A57), -+ {}, -+ }; -+ -+ if (is_midr_in_range_list(read_cpuid_id(), spectre_bhb_k32_list)) -+ k = 32; -+ else if (is_midr_in_range_list(read_cpuid_id(), spectre_bhb_k24_list)) -+ k = 24; -+ else if (is_midr_in_range_list(read_cpuid_id(), spectre_bhb_k8_list)) -+ k = 8; -+ -+ max_bhb_k = max(max_bhb_k, k); -+ } else { -+ k = max_bhb_k; -+ } -+ -+ return k; -+} -+ -+static enum mitigation_state spectre_bhb_get_cpu_fw_mitigation_state(void) -+{ -+ int ret; -+ struct arm_smccc_res res; -+ -+ if (psci_ops.smccc_version == SMCCC_VERSION_1_0) -+ return SPECTRE_VULNERABLE; -+ -+ switch (psci_ops.conduit) { -+ case PSCI_CONDUIT_HVC: -+ arm_smccc_1_1_hvc(ARM_SMCCC_ARCH_FEATURES_FUNC_ID, -+ ARM_SMCCC_ARCH_WORKAROUND_3, &res); -+ break; -+ -+ case PSCI_CONDUIT_SMC: -+ arm_smccc_1_1_smc(ARM_SMCCC_ARCH_FEATURES_FUNC_ID, -+ ARM_SMCCC_ARCH_WORKAROUND_3, &res); -+ break; -+ -+ default: -+ return SPECTRE_VULNERABLE; -+ } -+ -+ ret = res.a0; -+ switch (ret) { -+ case SMCCC_RET_SUCCESS: -+ return SPECTRE_MITIGATED; -+ case SMCCC_ARCH_WORKAROUND_RET_UNAFFECTED: -+ return SPECTRE_UNAFFECTED; -+ default: -+ fallthrough; -+ case SMCCC_RET_NOT_SUPPORTED: -+ return SPECTRE_VULNERABLE; -+ } -+} -+ -+static bool is_spectre_bhb_fw_affected(int scope) -+{ -+ static bool system_affected; -+ enum mitigation_state fw_state; -+ bool has_smccc = (psci_ops.smccc_version >= SMCCC_VERSION_1_1); -+ static const struct midr_range spectre_bhb_firmware_mitigated_list[] = { -+ MIDR_ALL_VERSIONS(MIDR_CORTEX_A73), -+ MIDR_ALL_VERSIONS(MIDR_CORTEX_A75), -+ {}, -+ }; -+ bool cpu_in_list = is_midr_in_range_list(read_cpuid_id(), -+ spectre_bhb_firmware_mitigated_list); -+ -+ if (scope != SCOPE_LOCAL_CPU) -+ return system_affected; -+ -+ fw_state = spectre_bhb_get_cpu_fw_mitigation_state(); -+ if (cpu_in_list || (has_smccc && fw_state == SPECTRE_MITIGATED)) { -+ system_affected = true; -+ return true; -+ } -+ -+ return false; -+} -+ -+static bool supports_ecbhb(int scope) -+{ -+ u64 mmfr1; -+ -+ if (scope == SCOPE_LOCAL_CPU) -+ mmfr1 = read_sysreg_s(SYS_ID_AA64MMFR1_EL1); -+ else -+ mmfr1 = read_sanitised_ftr_reg(SYS_ID_AA64MMFR1_EL1); -+ -+ return cpuid_feature_extract_unsigned_field(mmfr1, -+ ID_AA64MMFR1_ECBHB_SHIFT); -+} -+ -+bool is_spectre_bhb_affected(const struct arm64_cpu_capabilities *entry, -+ int scope) -+{ -+ WARN_ON(scope != SCOPE_LOCAL_CPU || preemptible()); -+ -+ if (supports_csv2p3(scope)) -+ return false; -+ -+ if (supports_clearbhb(scope)) -+ return true; -+ -+ if (spectre_bhb_loop_affected(scope)) -+ return true; -+ -+ if (is_spectre_bhb_fw_affected(scope)) -+ return true; -+ -+ return false; -+} -+ -+static void this_cpu_set_vectors(enum arm64_bp_harden_el1_vectors slot) -+{ -+ const char *v = arm64_get_bp_hardening_vector(slot); -+ -+ if (slot < 0) -+ return; -+ -+ __this_cpu_write(this_cpu_vector, v); -+ -+ /* -+ * When KPTI is in use, the vectors are switched when exiting to -+ * user-space. -+ */ -+ if (arm64_kernel_unmapped_at_el0()) -+ return; -+ -+ write_sysreg(v, vbar_el1); -+ isb(); -+} -+ -+#ifdef CONFIG_KVM_INDIRECT_VECTORS -+static const char *kvm_bhb_get_vecs_end(const char *start) -+{ -+ if (start == __smccc_workaround_3_smc_start) -+ return __smccc_workaround_3_smc_end; -+ else if (start == __spectre_bhb_loop_k8_start) -+ return __spectre_bhb_loop_k8_end; -+ else if (start == __spectre_bhb_loop_k24_start) -+ return __spectre_bhb_loop_k24_end; -+ else if (start == __spectre_bhb_loop_k32_start) -+ return __spectre_bhb_loop_k32_end; -+ else if (start == __spectre_bhb_clearbhb_start) -+ return __spectre_bhb_clearbhb_end; -+ -+ return NULL; -+} -+ -+static void kvm_setup_bhb_slot(const char *hyp_vecs_start) -+{ -+ int cpu, slot = -1; -+ const char *hyp_vecs_end; -+ -+ if (!IS_ENABLED(CONFIG_KVM) || !is_hyp_mode_available()) -+ return; -+ -+ hyp_vecs_end = kvm_bhb_get_vecs_end(hyp_vecs_start); -+ if (WARN_ON_ONCE(!hyp_vecs_start || !hyp_vecs_end)) -+ return; -+ -+ raw_spin_lock(&bp_lock); -+ for_each_possible_cpu(cpu) { -+ if (per_cpu(bp_hardening_data.template_start, cpu) == hyp_vecs_start) { -+ slot = per_cpu(bp_hardening_data.hyp_vectors_slot, cpu); -+ break; -+ } -+ } -+ -+ if (slot == -1) { -+ slot = atomic_inc_return(&arm64_el2_vector_last_slot); -+ BUG_ON(slot >= BP_HARDEN_EL2_SLOTS); -+ __copy_hyp_vect_bpi(slot, hyp_vecs_start, hyp_vecs_end); -+ } -+ -+ __this_cpu_write(bp_hardening_data.hyp_vectors_slot, slot); -+ __this_cpu_write(bp_hardening_data.template_start, hyp_vecs_start); -+ raw_spin_unlock(&bp_lock); -+} -+#else -+#define __smccc_workaround_3_smc_start NULL -+#define __spectre_bhb_loop_k8_start NULL -+#define __spectre_bhb_loop_k24_start NULL -+#define __spectre_bhb_loop_k32_start NULL -+#define __spectre_bhb_clearbhb_start NULL -+ -+static void kvm_setup_bhb_slot(const char *hyp_vecs_start) { } -+#endif -+ -+void spectre_bhb_enable_mitigation(const struct arm64_cpu_capabilities *entry) -+{ -+ enum mitigation_state fw_state, state = SPECTRE_VULNERABLE; -+ -+ if (!is_spectre_bhb_affected(entry, SCOPE_LOCAL_CPU)) -+ return; -+ -+ if (get_spectre_v2_workaround_state() == ARM64_BP_HARDEN_UNKNOWN) { -+ /* No point mitigating Spectre-BHB alone. */ -+ } else if (!IS_ENABLED(CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY)) { -+ pr_info_once("spectre-bhb mitigation disabled by compile time option\n"); -+ } else if (cpu_mitigations_off()) { -+ pr_info_once("spectre-bhb mitigation disabled by command line option\n"); -+ } else if (supports_ecbhb(SCOPE_LOCAL_CPU)) { -+ state = SPECTRE_MITIGATED; -+ } else if (supports_clearbhb(SCOPE_LOCAL_CPU)) { -+ kvm_setup_bhb_slot(__spectre_bhb_clearbhb_start); -+ this_cpu_set_vectors(EL1_VECTOR_BHB_CLEAR_INSN); -+ -+ state = SPECTRE_MITIGATED; -+ } else if (spectre_bhb_loop_affected(SCOPE_LOCAL_CPU)) { -+ switch (spectre_bhb_loop_affected(SCOPE_SYSTEM)) { -+ case 8: -+ kvm_setup_bhb_slot(__spectre_bhb_loop_k8_start); -+ break; -+ case 24: -+ kvm_setup_bhb_slot(__spectre_bhb_loop_k24_start); -+ break; -+ case 32: -+ kvm_setup_bhb_slot(__spectre_bhb_loop_k32_start); -+ break; -+ default: -+ WARN_ON_ONCE(1); -+ } -+ this_cpu_set_vectors(EL1_VECTOR_BHB_LOOP); -+ -+ state = SPECTRE_MITIGATED; -+ } else if (is_spectre_bhb_fw_affected(SCOPE_LOCAL_CPU)) { -+ fw_state = spectre_bhb_get_cpu_fw_mitigation_state(); -+ if (fw_state == SPECTRE_MITIGATED) { -+ kvm_setup_bhb_slot(__smccc_workaround_3_smc_start); -+ this_cpu_set_vectors(EL1_VECTOR_BHB_FW); -+ -+ /* -+ * With WA3 in the vectors, the WA1 calls can be -+ * removed. -+ */ -+ __this_cpu_write(bp_hardening_data.fn, NULL); -+ -+ state = SPECTRE_MITIGATED; -+ } -+ } -+ -+ update_mitigation_state(&spectre_bhb_state, state); -+} -+ -+/* Patched to correct the immediate */ -+void noinstr spectre_bhb_patch_loop_iter(struct alt_instr *alt, -+ __le32 *origptr, __le32 *updptr, int nr_inst) -+{ -+ u8 rd; -+ u32 insn; -+ u16 loop_count = spectre_bhb_loop_affected(SCOPE_SYSTEM); -+ -+ BUG_ON(nr_inst != 1); /* MOV -> MOV */ -+ -+ if (!IS_ENABLED(CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY)) -+ return; -+ -+ insn = le32_to_cpu(*origptr); -+ rd = aarch64_insn_decode_register(AARCH64_INSN_REGTYPE_RD, insn); -+ insn = aarch64_insn_gen_movewide(rd, loop_count, 0, -+ AARCH64_INSN_VARIANT_64BIT, -+ AARCH64_INSN_MOVEWIDE_ZERO); -+ *updptr++ = cpu_to_le32(insn); -+} -diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c -index acdef8d76c64d..d07dadd6b8ff7 100644 ---- a/arch/arm64/kernel/cpufeature.c -+++ b/arch/arm64/kernel/cpufeature.c -@@ -10,11 +10,13 @@ - #include - #include - #include -+#include - #include - #include - #include - #include - #include -+ - #include - #include - #include -@@ -23,6 +25,7 @@ - #include - #include - #include -+#include - #include - - /* Kernel representation of AT_HWCAP and AT_HWCAP2 */ -@@ -45,6 +48,8 @@ static struct arm64_cpu_capabilities const __ro_after_init *cpu_hwcaps_ptrs[ARM6 - /* Need also bit for ARM64_CB_PATCH */ - DECLARE_BITMAP(boot_capabilities, ARM64_NPATCHABLE); - -+DEFINE_PER_CPU_READ_MOSTLY(const char *, this_cpu_vector) = vectors; -+ - /* - * Flag to indicate if we have computed the system wide - * capabilities based on the boot time active CPUs. This -@@ -150,6 +155,11 @@ static const struct arm64_ftr_bits ftr_id_aa64isar1[] = { - ARM64_FTR_END, - }; - -+static const struct arm64_ftr_bits ftr_id_aa64isar2[] = { -+ ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_HIGHER_SAFE, ID_AA64ISAR2_CLEARBHB_SHIFT, 4, 0), -+ ARM64_FTR_END, -+}; -+ - static const struct arm64_ftr_bits ftr_id_aa64pfr0[] = { - ARM64_FTR_BITS(FTR_HIDDEN, FTR_NONSTRICT, FTR_LOWER_SAFE, ID_AA64PFR0_CSV3_SHIFT, 4, 0), - ARM64_FTR_BITS(FTR_HIDDEN, FTR_NONSTRICT, FTR_LOWER_SAFE, ID_AA64PFR0_CSV2_SHIFT, 4, 0), -@@ -410,6 +420,7 @@ static const struct __ftr_reg_entry { - /* Op1 = 0, CRn = 0, CRm = 6 */ - ARM64_FTR_REG(SYS_ID_AA64ISAR0_EL1, ftr_id_aa64isar0), - ARM64_FTR_REG(SYS_ID_AA64ISAR1_EL1, ftr_id_aa64isar1), -+ ARM64_FTR_REG(SYS_ID_AA64ISAR2_EL1, ftr_id_aa64isar2), - - /* Op1 = 0, CRn = 0, CRm = 7 */ - ARM64_FTR_REG(SYS_ID_AA64MMFR0_EL1, ftr_id_aa64mmfr0), -@@ -581,6 +592,7 @@ void __init init_cpu_features(struct cpuinfo_arm64 *info) - init_cpu_ftr_reg(SYS_ID_AA64DFR1_EL1, info->reg_id_aa64dfr1); - init_cpu_ftr_reg(SYS_ID_AA64ISAR0_EL1, info->reg_id_aa64isar0); - init_cpu_ftr_reg(SYS_ID_AA64ISAR1_EL1, info->reg_id_aa64isar1); -+ init_cpu_ftr_reg(SYS_ID_AA64ISAR2_EL1, info->reg_id_aa64isar2); - init_cpu_ftr_reg(SYS_ID_AA64MMFR0_EL1, info->reg_id_aa64mmfr0); - init_cpu_ftr_reg(SYS_ID_AA64MMFR1_EL1, info->reg_id_aa64mmfr1); - init_cpu_ftr_reg(SYS_ID_AA64MMFR2_EL1, info->reg_id_aa64mmfr2); -@@ -704,6 +716,8 @@ void update_cpu_features(int cpu, - info->reg_id_aa64isar0, boot->reg_id_aa64isar0); - taint |= check_update_ftr_reg(SYS_ID_AA64ISAR1_EL1, cpu, - info->reg_id_aa64isar1, boot->reg_id_aa64isar1); -+ taint |= check_update_ftr_reg(SYS_ID_AA64ISAR2_EL1, cpu, -+ info->reg_id_aa64isar2, boot->reg_id_aa64isar2); - - /* - * Differing PARange support is fine as long as all peripherals and -@@ -838,6 +852,7 @@ static u64 __read_sysreg_by_encoding(u32 sys_id) - read_sysreg_case(SYS_ID_AA64MMFR2_EL1); - read_sysreg_case(SYS_ID_AA64ISAR0_EL1); - read_sysreg_case(SYS_ID_AA64ISAR1_EL1); -+ read_sysreg_case(SYS_ID_AA64ISAR2_EL1); - - read_sysreg_case(SYS_CNTFRQ_EL0); - read_sysreg_case(SYS_CTR_EL0); -@@ -1038,6 +1053,12 @@ kpti_install_ng_mappings(const struct arm64_cpu_capabilities *__unused) - static bool kpti_applied = false; - int cpu = smp_processor_id(); - -+ if (__this_cpu_read(this_cpu_vector) == vectors) { -+ const char *v = arm64_get_bp_hardening_vector(EL1_VECTOR_KPTI); -+ -+ __this_cpu_write(this_cpu_vector, v); -+ } -+ - /* - * We don't need to rewrite the page-tables if either we've done - * it already or we have KASLR enabled and therefore have not -diff --git a/arch/arm64/kernel/cpuinfo.c b/arch/arm64/kernel/cpuinfo.c -index 05933c065732b..90b35011a22f8 100644 ---- a/arch/arm64/kernel/cpuinfo.c -+++ b/arch/arm64/kernel/cpuinfo.c -@@ -344,6 +344,7 @@ static void __cpuinfo_store_cpu(struct cpuinfo_arm64 *info) - info->reg_id_aa64dfr1 = read_cpuid(ID_AA64DFR1_EL1); - info->reg_id_aa64isar0 = read_cpuid(ID_AA64ISAR0_EL1); - info->reg_id_aa64isar1 = read_cpuid(ID_AA64ISAR1_EL1); -+ info->reg_id_aa64isar2 = read_cpuid(ID_AA64ISAR2_EL1); - info->reg_id_aa64mmfr0 = read_cpuid(ID_AA64MMFR0_EL1); - info->reg_id_aa64mmfr1 = read_cpuid(ID_AA64MMFR1_EL1); - info->reg_id_aa64mmfr2 = read_cpuid(ID_AA64MMFR2_EL1); -diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S -index db137746c6fa3..8a4c108a0c0b6 100644 ---- a/arch/arm64/kernel/entry.S -+++ b/arch/arm64/kernel/entry.S -@@ -59,18 +59,21 @@ - - .macro kernel_ventry, el, label, regsize = 64 - .align 7 --#ifdef CONFIG_UNMAP_KERNEL_AT_EL0 --alternative_if ARM64_UNMAP_KERNEL_AT_EL0 -+.Lventry_start\@: - .if \el == 0 -+ /* -+ * This must be the first instruction of the EL0 vector entries. It is -+ * skipped by the trampoline vectors, to trigger the cleanup. -+ */ -+ b .Lskip_tramp_vectors_cleanup\@ - .if \regsize == 64 - mrs x30, tpidrro_el0 - msr tpidrro_el0, xzr - .else - mov x30, xzr - .endif -+.Lskip_tramp_vectors_cleanup\@: - .endif --alternative_else_nop_endif --#endif - - sub sp, sp, #S_FRAME_SIZE - #ifdef CONFIG_VMAP_STACK -@@ -116,11 +119,15 @@ alternative_else_nop_endif - mrs x0, tpidrro_el0 - #endif - b el\()\el\()_\label -+.org .Lventry_start\@ + 128 // Did we overflow the ventry slot? - .endm - -- .macro tramp_alias, dst, sym -+ .macro tramp_alias, dst, sym, tmp - mov_q \dst, TRAMP_VALIAS -- add \dst, \dst, #(\sym - .entry.tramp.text) -+ adr_l \tmp, \sym -+ add \dst, \dst, \tmp -+ adr_l \tmp, .entry.tramp.text -+ sub \dst, \dst, \tmp - .endm - - // This macro corrupts x0-x3. It is the caller's duty -@@ -361,21 +368,25 @@ alternative_else_nop_endif - ldp x24, x25, [sp, #16 * 12] - ldp x26, x27, [sp, #16 * 13] - ldp x28, x29, [sp, #16 * 14] -- ldr lr, [sp, #S_LR] -- add sp, sp, #S_FRAME_SIZE // restore sp - - .if \el == 0 --alternative_insn eret, nop, ARM64_UNMAP_KERNEL_AT_EL0 -+alternative_if_not ARM64_UNMAP_KERNEL_AT_EL0 -+ ldr lr, [sp, #S_LR] -+ add sp, sp, #S_FRAME_SIZE // restore sp -+ eret -+alternative_else_nop_endif - #ifdef CONFIG_UNMAP_KERNEL_AT_EL0 - bne 5f -- msr far_el1, x30 -- tramp_alias x30, tramp_exit_native -+ msr far_el1, x29 -+ tramp_alias x30, tramp_exit_native, x29 - br x30 - 5: -- tramp_alias x30, tramp_exit_compat -+ tramp_alias x30, tramp_exit_compat, x29 - br x30 - #endif - .else -+ ldr lr, [sp, #S_LR] -+ add sp, sp, #S_FRAME_SIZE // restore sp - eret - .endif - sb -@@ -1012,12 +1023,6 @@ ENDPROC(el0_svc) - - .popsection // .entry.text - --#ifdef CONFIG_UNMAP_KERNEL_AT_EL0 --/* -- * Exception vectors trampoline. -- */ -- .pushsection ".entry.tramp.text", "ax" -- - // Move from tramp_pg_dir to swapper_pg_dir - .macro tramp_map_kernel, tmp - mrs \tmp, ttbr1_el1 -@@ -1051,12 +1056,47 @@ alternative_else_nop_endif - */ - .endm - -- .macro tramp_ventry, regsize = 64 -+ .macro tramp_data_page dst -+ adr_l \dst, .entry.tramp.text -+ sub \dst, \dst, PAGE_SIZE -+ .endm -+ -+ .macro tramp_data_read_var dst, var -+#ifdef CONFIG_RANDOMIZE_BASE -+ tramp_data_page \dst -+ add \dst, \dst, #:lo12:__entry_tramp_data_\var -+ ldr \dst, [\dst] -+#else -+ ldr \dst, =\var -+#endif -+ .endm -+ -+#define BHB_MITIGATION_NONE 0 -+#define BHB_MITIGATION_LOOP 1 -+#define BHB_MITIGATION_FW 2 -+#define BHB_MITIGATION_INSN 3 -+ -+ .macro tramp_ventry, vector_start, regsize, kpti, bhb - .align 7 - 1: - .if \regsize == 64 - msr tpidrro_el0, x30 // Restored in kernel_ventry - .endif -+ -+ .if \bhb == BHB_MITIGATION_LOOP -+ /* -+ * This sequence must appear before the first indirect branch. i.e. the -+ * ret out of tramp_ventry. It appears here because x30 is free. -+ */ -+ __mitigate_spectre_bhb_loop x30 -+ .endif // \bhb == BHB_MITIGATION_LOOP -+ -+ .if \bhb == BHB_MITIGATION_INSN -+ clearbhb -+ isb -+ .endif // \bhb == BHB_MITIGATION_INSN -+ -+ .if \kpti == 1 - /* - * Defend against branch aliasing attacks by pushing a dummy - * entry onto the return stack and using a RET instruction to -@@ -1066,46 +1106,79 @@ alternative_else_nop_endif - b . - 2: - tramp_map_kernel x30 --#ifdef CONFIG_RANDOMIZE_BASE -- adr x30, tramp_vectors + PAGE_SIZE - alternative_insn isb, nop, ARM64_WORKAROUND_QCOM_FALKOR_E1003 -- ldr x30, [x30] --#else -- ldr x30, =vectors --#endif -+ tramp_data_read_var x30, vectors - alternative_if_not ARM64_WORKAROUND_CAVIUM_TX2_219_PRFM -- prfm plil1strm, [x30, #(1b - tramp_vectors)] -+ prfm plil1strm, [x30, #(1b - \vector_start)] - alternative_else_nop_endif -+ - msr vbar_el1, x30 -- add x30, x30, #(1b - tramp_vectors) - isb -+ .else -+ ldr x30, =vectors -+ .endif // \kpti == 1 -+ -+ .if \bhb == BHB_MITIGATION_FW -+ /* -+ * The firmware sequence must appear before the first indirect branch. -+ * i.e. the ret out of tramp_ventry. But it also needs the stack to be -+ * mapped to save/restore the registers the SMC clobbers. -+ */ -+ __mitigate_spectre_bhb_fw -+ .endif // \bhb == BHB_MITIGATION_FW -+ -+ add x30, x30, #(1b - \vector_start + 4) - ret -+.org 1b + 128 // Did we overflow the ventry slot? - .endm - - .macro tramp_exit, regsize = 64 -- adr x30, tramp_vectors -+ tramp_data_read_var x30, this_cpu_vector -+alternative_if_not ARM64_HAS_VIRT_HOST_EXTN -+ mrs x29, tpidr_el1 -+alternative_else -+ mrs x29, tpidr_el2 -+alternative_endif -+ ldr x30, [x30, x29] -+ - msr vbar_el1, x30 -- tramp_unmap_kernel x30 -+ ldr lr, [sp, #S_LR] -+ tramp_unmap_kernel x29 - .if \regsize == 64 -- mrs x30, far_el1 -+ mrs x29, far_el1 - .endif -+ add sp, sp, #S_FRAME_SIZE // restore sp - eret - sb - .endm - -- .align 11 --ENTRY(tramp_vectors) -+ .macro generate_tramp_vector, kpti, bhb -+.Lvector_start\@: - .space 0x400 - -- tramp_ventry -- tramp_ventry -- tramp_ventry -- tramp_ventry -+ .rept 4 -+ tramp_ventry .Lvector_start\@, 64, \kpti, \bhb -+ .endr -+ .rept 4 -+ tramp_ventry .Lvector_start\@, 32, \kpti, \bhb -+ .endr -+ .endm - -- tramp_ventry 32 -- tramp_ventry 32 -- tramp_ventry 32 -- tramp_ventry 32 -+#ifdef CONFIG_UNMAP_KERNEL_AT_EL0 -+/* -+ * Exception vectors trampoline. -+ * The order must match __bp_harden_el1_vectors and the -+ * arm64_bp_harden_el1_vectors enum. -+ */ -+ .pushsection ".entry.tramp.text", "ax" -+ .align 11 -+ENTRY(tramp_vectors) -+#ifdef CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY -+ generate_tramp_vector kpti=1, bhb=BHB_MITIGATION_LOOP -+ generate_tramp_vector kpti=1, bhb=BHB_MITIGATION_FW -+ generate_tramp_vector kpti=1, bhb=BHB_MITIGATION_INSN -+#endif /* CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY */ -+ generate_tramp_vector kpti=1, bhb=BHB_MITIGATION_NONE - END(tramp_vectors) - - ENTRY(tramp_exit_native) -@@ -1123,11 +1196,55 @@ END(tramp_exit_compat) - .align PAGE_SHIFT - .globl __entry_tramp_data_start - __entry_tramp_data_start: -+__entry_tramp_data_vectors: - .quad vectors -+#ifdef CONFIG_ARM_SDE_INTERFACE -+__entry_tramp_data___sdei_asm_handler: -+ .quad __sdei_asm_handler -+#endif /* CONFIG_ARM_SDE_INTERFACE */ -+__entry_tramp_data_this_cpu_vector: -+ .quad this_cpu_vector - .popsection // .rodata - #endif /* CONFIG_RANDOMIZE_BASE */ - #endif /* CONFIG_UNMAP_KERNEL_AT_EL0 */ - -+/* -+ * Exception vectors for spectre mitigations on entry from EL1 when -+ * kpti is not in use. -+ */ -+ .macro generate_el1_vector, bhb -+.Lvector_start\@: -+ kernel_ventry 1, sync_invalid // Synchronous EL1t -+ kernel_ventry 1, irq_invalid // IRQ EL1t -+ kernel_ventry 1, fiq_invalid // FIQ EL1t -+ kernel_ventry 1, error_invalid // Error EL1t -+ -+ kernel_ventry 1, sync // Synchronous EL1h -+ kernel_ventry 1, irq // IRQ EL1h -+ kernel_ventry 1, fiq_invalid // FIQ EL1h -+ kernel_ventry 1, error // Error EL1h -+ -+ .rept 4 -+ tramp_ventry .Lvector_start\@, 64, 0, \bhb -+ .endr -+ .rept 4 -+ tramp_ventry .Lvector_start\@, 32, 0, \bhb -+ .endr -+ .endm -+ -+/* The order must match tramp_vecs and the arm64_bp_harden_el1_vectors enum. */ -+ .pushsection ".entry.text", "ax" -+ .align 11 -+SYM_CODE_START(__bp_harden_el1_vectors) -+#ifdef CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY -+ generate_el1_vector bhb=BHB_MITIGATION_LOOP -+ generate_el1_vector bhb=BHB_MITIGATION_FW -+ generate_el1_vector bhb=BHB_MITIGATION_INSN -+#endif /* CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY */ -+SYM_CODE_END(__bp_harden_el1_vectors) -+ .popsection -+ -+ - /* - * Register switch for AArch64. The callee-saved registers need to be saved - * and restored. On entry: -@@ -1214,13 +1331,7 @@ ENTRY(__sdei_asm_entry_trampoline) - */ - 1: str x4, [x1, #(SDEI_EVENT_INTREGS + S_ORIG_ADDR_LIMIT)] - --#ifdef CONFIG_RANDOMIZE_BASE -- adr x4, tramp_vectors + PAGE_SIZE -- add x4, x4, #:lo12:__sdei_asm_trampoline_next_handler -- ldr x4, [x4] --#else -- ldr x4, =__sdei_asm_handler --#endif -+ tramp_data_read_var x4, __sdei_asm_handler - br x4 - ENDPROC(__sdei_asm_entry_trampoline) - NOKPROBE(__sdei_asm_entry_trampoline) -@@ -1243,12 +1354,6 @@ ENDPROC(__sdei_asm_exit_trampoline) - NOKPROBE(__sdei_asm_exit_trampoline) - .ltorg - .popsection // .entry.tramp.text --#ifdef CONFIG_RANDOMIZE_BASE --.pushsection ".rodata", "a" --__sdei_asm_trampoline_next_handler: -- .quad __sdei_asm_handler --.popsection // .rodata --#endif /* CONFIG_RANDOMIZE_BASE */ - #endif /* CONFIG_UNMAP_KERNEL_AT_EL0 */ - - /* -@@ -1344,7 +1449,7 @@ alternative_if_not ARM64_UNMAP_KERNEL_AT_EL0 - alternative_else_nop_endif - - #ifdef CONFIG_UNMAP_KERNEL_AT_EL0 -- tramp_alias dst=x5, sym=__sdei_asm_exit_trampoline -+ tramp_alias dst=x5, sym=__sdei_asm_exit_trampoline, tmp=x3 - br x5 - #endif - ENDPROC(__sdei_asm_handler) -diff --git a/arch/arm64/kernel/vmlinux.lds.S b/arch/arm64/kernel/vmlinux.lds.S -index 1f82cf631c3c4..fbab044b3a39a 100644 ---- a/arch/arm64/kernel/vmlinux.lds.S -+++ b/arch/arm64/kernel/vmlinux.lds.S -@@ -276,7 +276,7 @@ ASSERT(__hibernate_exit_text_end - (__hibernate_exit_text_start & ~(SZ_4K - 1)) - <= SZ_4K, "Hibernate exit text too big or misaligned") - #endif - #ifdef CONFIG_UNMAP_KERNEL_AT_EL0 --ASSERT((__entry_tramp_text_end - __entry_tramp_text_start) == PAGE_SIZE, -+ASSERT((__entry_tramp_text_end - __entry_tramp_text_start) <= 3*PAGE_SIZE, - "Entry trampoline text too big") - #endif - /* -diff --git a/arch/arm64/kvm/hyp/hyp-entry.S b/arch/arm64/kvm/hyp/hyp-entry.S -index f36aad0f207bb..99b8ecaae8109 100644 ---- a/arch/arm64/kvm/hyp/hyp-entry.S -+++ b/arch/arm64/kvm/hyp/hyp-entry.S -@@ -113,6 +113,10 @@ el1_hvc_guest: - /* ARM_SMCCC_ARCH_WORKAROUND_2 handling */ - eor w1, w1, #(ARM_SMCCC_ARCH_WORKAROUND_1 ^ \ - ARM_SMCCC_ARCH_WORKAROUND_2) -+ cbz w1, wa_epilogue -+ -+ eor w1, w1, #(ARM_SMCCC_ARCH_WORKAROUND_2 ^ \ -+ ARM_SMCCC_ARCH_WORKAROUND_3) - cbnz w1, el1_trap - - #ifdef CONFIG_ARM64_SSBD -@@ -347,4 +351,64 @@ ENTRY(__smccc_workaround_1_smc_start) - ldp x0, x1, [sp, #(8 * 2)] - add sp, sp, #(8 * 4) - ENTRY(__smccc_workaround_1_smc_end) -+ -+ENTRY(__smccc_workaround_3_smc_start) -+ esb -+ sub sp, sp, #(8 * 4) -+ stp x2, x3, [sp, #(8 * 0)] -+ stp x0, x1, [sp, #(8 * 2)] -+ mov w0, #ARM_SMCCC_ARCH_WORKAROUND_3 -+ smc #0 -+ ldp x2, x3, [sp, #(8 * 0)] -+ ldp x0, x1, [sp, #(8 * 2)] -+ add sp, sp, #(8 * 4) -+ENTRY(__smccc_workaround_3_smc_end) -+ -+ENTRY(__spectre_bhb_loop_k8_start) -+ esb -+ sub sp, sp, #(8 * 2) -+ stp x0, x1, [sp, #(8 * 0)] -+ mov x0, #8 -+2: b . + 4 -+ subs x0, x0, #1 -+ b.ne 2b -+ dsb nsh -+ isb -+ ldp x0, x1, [sp, #(8 * 0)] -+ add sp, sp, #(8 * 2) -+ENTRY(__spectre_bhb_loop_k8_end) -+ -+ENTRY(__spectre_bhb_loop_k24_start) -+ esb -+ sub sp, sp, #(8 * 2) -+ stp x0, x1, [sp, #(8 * 0)] -+ mov x0, #24 -+2: b . + 4 -+ subs x0, x0, #1 -+ b.ne 2b -+ dsb nsh -+ isb -+ ldp x0, x1, [sp, #(8 * 0)] -+ add sp, sp, #(8 * 2) -+ENTRY(__spectre_bhb_loop_k24_end) -+ -+ENTRY(__spectre_bhb_loop_k32_start) -+ esb -+ sub sp, sp, #(8 * 2) -+ stp x0, x1, [sp, #(8 * 0)] -+ mov x0, #32 -+2: b . + 4 -+ subs x0, x0, #1 -+ b.ne 2b -+ dsb nsh -+ isb -+ ldp x0, x1, [sp, #(8 * 0)] -+ add sp, sp, #(8 * 2) -+ENTRY(__spectre_bhb_loop_k32_end) -+ -+ENTRY(__spectre_bhb_clearbhb_start) -+ esb -+ clearbhb -+ isb -+ENTRY(__spectre_bhb_clearbhb_end) - #endif -diff --git a/arch/arm64/kvm/hyp/switch.c b/arch/arm64/kvm/hyp/switch.c -index 14607fac7ca38..768983bd23261 100644 ---- a/arch/arm64/kvm/hyp/switch.c -+++ b/arch/arm64/kvm/hyp/switch.c -@@ -25,6 +25,7 @@ - #include - #include - #include -+#include - - extern struct exception_table_entry __start___kvm_ex_table; - extern struct exception_table_entry __stop___kvm_ex_table; -@@ -152,7 +153,7 @@ static void __hyp_text __activate_traps(struct kvm_vcpu *vcpu) - - static void deactivate_traps_vhe(void) - { -- extern char vectors[]; /* kernel exception vectors */ -+ const char *host_vectors = vectors; - write_sysreg(HCR_HOST_VHE_FLAGS, hcr_el2); - - /* -@@ -163,7 +164,10 @@ static void deactivate_traps_vhe(void) - asm(ALTERNATIVE("nop", "isb", ARM64_WORKAROUND_1165522)); - - write_sysreg(CPACR_EL1_DEFAULT, cpacr_el1); -- write_sysreg(vectors, vbar_el1); -+ -+ if (!arm64_kernel_unmapped_at_el0()) -+ host_vectors = __this_cpu_read(this_cpu_vector); -+ write_sysreg(host_vectors, vbar_el1); - } - NOKPROBE_SYMBOL(deactivate_traps_vhe); - -diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c -index da649e90240c8..a25f737dfa0bb 100644 ---- a/arch/arm64/kvm/sys_regs.c -+++ b/arch/arm64/kvm/sys_regs.c -@@ -1454,7 +1454,7 @@ static const struct sys_reg_desc sys_reg_descs[] = { - /* CRm=6 */ - ID_SANITISED(ID_AA64ISAR0_EL1), - ID_SANITISED(ID_AA64ISAR1_EL1), -- ID_UNALLOCATED(6,2), -+ ID_SANITISED(ID_AA64ISAR2_EL1), - ID_UNALLOCATED(6,3), - ID_UNALLOCATED(6,4), - ID_UNALLOCATED(6,5), -diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c -index 99bc0289ab2b6..5cf575f23af28 100644 ---- a/arch/arm64/mm/mmu.c -+++ b/arch/arm64/mm/mmu.c -@@ -583,6 +583,8 @@ early_param("rodata", parse_rodata); - #ifdef CONFIG_UNMAP_KERNEL_AT_EL0 - static int __init map_entry_trampoline(void) - { -+ int i; -+ - pgprot_t prot = rodata_enabled ? PAGE_KERNEL_ROX : PAGE_KERNEL_EXEC; - phys_addr_t pa_start = __pa_symbol(__entry_tramp_text_start); - -@@ -591,11 +593,15 @@ static int __init map_entry_trampoline(void) - - /* Map only the text into the trampoline page table */ - memset(tramp_pg_dir, 0, PGD_SIZE); -- __create_pgd_mapping(tramp_pg_dir, pa_start, TRAMP_VALIAS, PAGE_SIZE, -- prot, __pgd_pgtable_alloc, 0); -+ __create_pgd_mapping(tramp_pg_dir, pa_start, TRAMP_VALIAS, -+ entry_tramp_text_size(), prot, -+ __pgd_pgtable_alloc, NO_BLOCK_MAPPINGS); - - /* Map both the text and data into the kernel page table */ -- __set_fixmap(FIX_ENTRY_TRAMP_TEXT, pa_start, prot); -+ for (i = 0; i < DIV_ROUND_UP(entry_tramp_text_size(), PAGE_SIZE); i++) -+ __set_fixmap(FIX_ENTRY_TRAMP_TEXT1 - i, -+ pa_start + i * PAGE_SIZE, prot); -+ - if (IS_ENABLED(CONFIG_RANDOMIZE_BASE)) { - extern char __entry_tramp_data_start[]; - -diff --git a/arch/mips/kernel/smp.c b/arch/mips/kernel/smp.c -index f510c00bda882..c563b03bdccc1 100644 ---- a/arch/mips/kernel/smp.c -+++ b/arch/mips/kernel/smp.c -@@ -361,6 +361,9 @@ asmlinkage void start_secondary(void) - cpu = smp_processor_id(); - cpu_data[cpu].udelay_val = loops_per_jiffy; - -+ set_cpu_sibling_map(cpu); -+ set_cpu_core_map(cpu); -+ - cpumask_set_cpu(cpu, &cpu_coherent_mask); - notify_cpu_starting(cpu); - -@@ -372,9 +375,6 @@ asmlinkage void start_secondary(void) - /* The CPU is running and counters synchronised, now mark it online */ - set_cpu_online(cpu, true); - -- set_cpu_sibling_map(cpu); -- set_cpu_core_map(cpu); -- - calculate_cpu_foreign_map(); - - /* -diff --git a/drivers/atm/firestream.c b/drivers/atm/firestream.c -index 5acb459856752..8995c39330fac 100644 ---- a/drivers/atm/firestream.c -+++ b/drivers/atm/firestream.c -@@ -1677,6 +1677,8 @@ static int fs_init(struct fs_dev *dev) - dev->hw_base = pci_resource_start(pci_dev, 0); - - dev->base = ioremap(dev->hw_base, 0x1000); -+ if (!dev->base) -+ return 1; - - reset_chip (dev); - -diff --git a/drivers/gpu/drm/drm_connector.c b/drivers/gpu/drm/drm_connector.c -index 2337b3827e6a4..11a81e8ba9639 100644 ---- a/drivers/gpu/drm/drm_connector.c -+++ b/drivers/gpu/drm/drm_connector.c -@@ -1984,6 +1984,9 @@ EXPORT_SYMBOL(drm_connector_attach_max_bpc_property); - void drm_connector_set_vrr_capable_property( - struct drm_connector *connector, bool capable) - { -+ if (!connector->vrr_capable_property) -+ return; -+ - drm_object_property_set_value(&connector->base, - connector->vrr_capable_property, - capable); -diff --git a/drivers/net/can/rcar/rcar_canfd.c b/drivers/net/can/rcar/rcar_canfd.c -index edaa1ca972c15..d4e9815ca26ff 100644 ---- a/drivers/net/can/rcar/rcar_canfd.c -+++ b/drivers/net/can/rcar/rcar_canfd.c -@@ -1598,15 +1598,15 @@ static int rcar_canfd_channel_probe(struct rcar_canfd_global *gpriv, u32 ch, - - netif_napi_add(ndev, &priv->napi, rcar_canfd_rx_poll, - RCANFD_NAPI_WEIGHT); -+ spin_lock_init(&priv->tx_lock); -+ devm_can_led_init(ndev); -+ gpriv->ch[priv->channel] = priv; - err = register_candev(ndev); - if (err) { - dev_err(&pdev->dev, - "register_candev() failed, error %d\n", err); - goto fail_candev; - } -- spin_lock_init(&priv->tx_lock); -- devm_can_led_init(ndev); -- gpriv->ch[priv->channel] = priv; - dev_info(&pdev->dev, "device registered (channel %u)\n", priv->channel); - return 0; - -diff --git a/drivers/net/ethernet/sfc/mcdi.c b/drivers/net/ethernet/sfc/mcdi.c -index 2713300343c7f..ec551def58359 100644 ---- a/drivers/net/ethernet/sfc/mcdi.c -+++ b/drivers/net/ethernet/sfc/mcdi.c -@@ -163,9 +163,9 @@ static void efx_mcdi_send_request(struct efx_nic *efx, unsigned cmd, - /* Serialise with efx_mcdi_ev_cpl() and efx_mcdi_ev_death() */ - spin_lock_bh(&mcdi->iface_lock); - ++mcdi->seqno; -+ seqno = mcdi->seqno & SEQ_MASK; - spin_unlock_bh(&mcdi->iface_lock); - -- seqno = mcdi->seqno & SEQ_MASK; - xflags = 0; - if (mcdi->mode == MCDI_MODE_EVENTS) - xflags |= MCDI_HEADER_XFLAGS_EVREQ; -diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c -index 022f2faccab41..4a433e34ee7a1 100644 ---- a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c -+++ b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c -@@ -519,8 +519,7 @@ static struct ieee80211_sband_iftype_data iwl_he_capa[] = { - .has_he = true, - .he_cap_elem = { - .mac_cap_info[0] = -- IEEE80211_HE_MAC_CAP0_HTC_HE | -- IEEE80211_HE_MAC_CAP0_TWT_REQ, -+ IEEE80211_HE_MAC_CAP0_HTC_HE, - .mac_cap_info[1] = - IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US | - IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8, -diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c -index 29ad7804d77aa..3c523774ef0e6 100644 ---- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c -+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c -@@ -343,7 +343,6 @@ const static u8 he_if_types_ext_capa_sta[] = { - [0] = WLAN_EXT_CAPA1_EXT_CHANNEL_SWITCHING, - [2] = WLAN_EXT_CAPA3_MULTI_BSSID_SUPPORT, - [7] = WLAN_EXT_CAPA8_OPMODE_NOTIF, -- [9] = WLAN_EXT_CAPA10_TWT_REQUESTER_SUPPORT, - }; - - const static struct wiphy_iftype_ext_capab he_iftypes_ext_capa[] = { -diff --git a/include/linux/arm-smccc.h b/include/linux/arm-smccc.h -index 4e97ba64dbb42..3e6ef64e74d3d 100644 ---- a/include/linux/arm-smccc.h -+++ b/include/linux/arm-smccc.h -@@ -76,6 +76,11 @@ - ARM_SMCCC_SMC_32, \ - 0, 0x7fff) - -+#define ARM_SMCCC_ARCH_WORKAROUND_3 \ -+ ARM_SMCCC_CALL_VAL(ARM_SMCCC_FAST_CALL, \ -+ ARM_SMCCC_SMC_32, \ -+ 0, 0x3fff) -+ - #define SMCCC_ARCH_WORKAROUND_RET_UNAFFECTED 1 - - #ifndef __ASSEMBLY__ -diff --git a/include/net/xfrm.h b/include/net/xfrm.h -index 614f19bbad74f..96faf09186945 100644 ---- a/include/net/xfrm.h -+++ b/include/net/xfrm.h -@@ -1663,14 +1663,15 @@ int km_migrate(const struct xfrm_selector *sel, u8 dir, u8 type, - const struct xfrm_migrate *m, int num_bundles, - const struct xfrm_kmaddress *k, - const struct xfrm_encap_tmpl *encap); --struct xfrm_state *xfrm_migrate_state_find(struct xfrm_migrate *m, struct net *net); -+struct xfrm_state *xfrm_migrate_state_find(struct xfrm_migrate *m, struct net *net, -+ u32 if_id); - struct xfrm_state *xfrm_state_migrate(struct xfrm_state *x, - struct xfrm_migrate *m, - struct xfrm_encap_tmpl *encap); - int xfrm_migrate(const struct xfrm_selector *sel, u8 dir, u8 type, - struct xfrm_migrate *m, int num_bundles, - struct xfrm_kmaddress *k, struct net *net, -- struct xfrm_encap_tmpl *encap); -+ struct xfrm_encap_tmpl *encap, u32 if_id); - #endif - - int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport); -diff --git a/lib/Kconfig b/lib/Kconfig -index 3321d04dfa5a5..fa129b5c4320d 100644 ---- a/lib/Kconfig -+++ b/lib/Kconfig -@@ -42,7 +42,6 @@ config BITREVERSE - config HAVE_ARCH_BITREVERSE - bool - default n -- depends on BITREVERSE - help - This option enables the use of hardware bit-reversal instructions on - architectures which support such operations. -diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c -index 9f53d25e047e3..4815cf72569e0 100644 ---- a/net/ipv4/tcp.c -+++ b/net/ipv4/tcp.c -@@ -1652,11 +1652,13 @@ int tcp_read_sock(struct sock *sk, read_descriptor_t *desc, - if (!copied) - copied = used; - break; -- } else if (used <= len) { -- seq += used; -- copied += used; -- offset += used; - } -+ if (WARN_ON_ONCE(used > len)) -+ used = len; -+ seq += used; -+ copied += used; -+ offset += used; -+ - /* If recv_actor drops the lock (e.g. TCP splice - * receive) the skb pointer might be invalid when - * getting here: tcp_collapse might have deleted it -diff --git a/net/key/af_key.c b/net/key/af_key.c -index 907d04a474597..406e13478b01b 100644 ---- a/net/key/af_key.c -+++ b/net/key/af_key.c -@@ -2627,7 +2627,7 @@ static int pfkey_migrate(struct sock *sk, struct sk_buff *skb, - } - - return xfrm_migrate(&sel, dir, XFRM_POLICY_TYPE_MAIN, m, i, -- kma ? &k : NULL, net, NULL); -+ kma ? &k : NULL, net, NULL, 0); - - out: - return err; -diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c -index f140c2b94b2c6..f30cdd7f3a73a 100644 ---- a/net/mac80211/agg-tx.c -+++ b/net/mac80211/agg-tx.c -@@ -9,7 +9,7 @@ - * Copyright 2007, Michael Wu - * Copyright 2007-2010, Intel Corporation - * Copyright(c) 2015-2017 Intel Deutschland GmbH -- * Copyright (C) 2018 - 2021 Intel Corporation -+ * Copyright (C) 2018 - 2022 Intel Corporation - */ - - #include -@@ -615,6 +615,14 @@ int ieee80211_start_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid, - return -EINVAL; - } - -+ if (test_sta_flag(sta, WLAN_STA_MFP) && -+ !test_sta_flag(sta, WLAN_STA_AUTHORIZED)) { -+ ht_dbg(sdata, -+ "MFP STA not authorized - deny BA session request %pM tid %d\n", -+ sta->sta.addr, tid); -+ return -EINVAL; -+ } -+ - /* - * 802.11n-2009 11.5.1.1: If the initiating STA is an HT STA, is a - * member of an IBSS, and has no other existing Block Ack agreement -diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c -index 7c6dcbc8e98ba..1d2f633c6c7c3 100644 ---- a/net/sctp/sm_statefuns.c -+++ b/net/sctp/sm_statefuns.c -@@ -149,6 +149,12 @@ static enum sctp_disposition __sctp_sf_do_9_1_abort( - void *arg, - struct sctp_cmd_seq *commands); - -+static enum sctp_disposition -+__sctp_sf_do_9_2_reshutack(struct net *net, const struct sctp_endpoint *ep, -+ const struct sctp_association *asoc, -+ const union sctp_subtype type, void *arg, -+ struct sctp_cmd_seq *commands); -+ - /* Small helper function that checks if the chunk length - * is of the appropriate length. The 'required_length' argument - * is set to be the size of a specific chunk we are testing. -@@ -330,6 +336,14 @@ enum sctp_disposition sctp_sf_do_5_1B_init(struct net *net, - if (!chunk->singleton) - return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); - -+ /* Make sure that the INIT chunk has a valid length. -+ * Normally, this would cause an ABORT with a Protocol Violation -+ * error, but since we don't have an association, we'll -+ * just discard the packet. -+ */ -+ if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_init_chunk))) -+ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); -+ - /* If the packet is an OOTB packet which is temporarily on the - * control endpoint, respond with an ABORT. - */ -@@ -344,14 +358,6 @@ enum sctp_disposition sctp_sf_do_5_1B_init(struct net *net, - if (chunk->sctp_hdr->vtag != 0) - return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands); - -- /* Make sure that the INIT chunk has a valid length. -- * Normally, this would cause an ABORT with a Protocol Violation -- * error, but since we don't have an association, we'll -- * just discard the packet. -- */ -- if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_init_chunk))) -- return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); -- - /* If the INIT is coming toward a closing socket, we'll send back - * and ABORT. Essentially, this catches the race of INIT being - * backloged to the socket at the same time as the user isses close(). -@@ -1484,19 +1490,16 @@ static enum sctp_disposition sctp_sf_do_unexpected_init( - if (!chunk->singleton) - return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); - -+ /* Make sure that the INIT chunk has a valid length. */ -+ if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_init_chunk))) -+ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); -+ - /* 3.1 A packet containing an INIT chunk MUST have a zero Verification - * Tag. - */ - if (chunk->sctp_hdr->vtag != 0) - return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands); - -- /* Make sure that the INIT chunk has a valid length. -- * In this case, we generate a protocol violation since we have -- * an association established. -- */ -- if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_init_chunk))) -- return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, -- commands); - /* Grab the INIT header. */ - chunk->subh.init_hdr = (struct sctp_inithdr *)chunk->skb->data; - -@@ -1814,9 +1817,9 @@ static enum sctp_disposition sctp_sf_do_dupcook_a( - * its peer. - */ - if (sctp_state(asoc, SHUTDOWN_ACK_SENT)) { -- disposition = sctp_sf_do_9_2_reshutack(net, ep, asoc, -- SCTP_ST_CHUNK(chunk->chunk_hdr->type), -- chunk, commands); -+ disposition = __sctp_sf_do_9_2_reshutack(net, ep, asoc, -+ SCTP_ST_CHUNK(chunk->chunk_hdr->type), -+ chunk, commands); - if (SCTP_DISPOSITION_NOMEM == disposition) - goto nomem; - -@@ -2915,13 +2918,11 @@ enum sctp_disposition sctp_sf_do_9_2_shut_ctsn( - * that belong to this association, it should discard the INIT chunk and - * retransmit the SHUTDOWN ACK chunk. - */ --enum sctp_disposition sctp_sf_do_9_2_reshutack( -- struct net *net, -- const struct sctp_endpoint *ep, -- const struct sctp_association *asoc, -- const union sctp_subtype type, -- void *arg, -- struct sctp_cmd_seq *commands) -+static enum sctp_disposition -+__sctp_sf_do_9_2_reshutack(struct net *net, const struct sctp_endpoint *ep, -+ const struct sctp_association *asoc, -+ const union sctp_subtype type, void *arg, -+ struct sctp_cmd_seq *commands) - { - struct sctp_chunk *chunk = arg; - struct sctp_chunk *reply; -@@ -2955,6 +2956,26 @@ nomem: - return SCTP_DISPOSITION_NOMEM; - } - -+enum sctp_disposition -+sctp_sf_do_9_2_reshutack(struct net *net, const struct sctp_endpoint *ep, -+ const struct sctp_association *asoc, -+ const union sctp_subtype type, void *arg, -+ struct sctp_cmd_seq *commands) -+{ -+ struct sctp_chunk *chunk = arg; -+ -+ if (!chunk->singleton) -+ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); -+ -+ if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_init_chunk))) -+ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); -+ -+ if (chunk->sctp_hdr->vtag != 0) -+ return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands); -+ -+ return __sctp_sf_do_9_2_reshutack(net, ep, asoc, type, arg, commands); -+} -+ - /* - * sctp_sf_do_ecn_cwr - * -diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c -index f2bc465de2845..d3e2b97d5d051 100644 ---- a/net/wireless/nl80211.c -+++ b/net/wireless/nl80211.c -@@ -16314,7 +16314,8 @@ void cfg80211_ch_switch_notify(struct net_device *dev, - wdev->chandef = *chandef; - wdev->preset_chandef = *chandef; - -- if (wdev->iftype == NL80211_IFTYPE_STATION && -+ if ((wdev->iftype == NL80211_IFTYPE_STATION || -+ wdev->iftype == NL80211_IFTYPE_P2P_CLIENT) && - !WARN_ON(!wdev->current_bss)) - cfg80211_update_assoc_bss_entry(wdev, chandef->chan); - -diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c -index 404823c5eb7d5..3ecb77c58c44e 100644 ---- a/net/xfrm/xfrm_policy.c -+++ b/net/xfrm/xfrm_policy.c -@@ -4271,7 +4271,7 @@ static bool xfrm_migrate_selector_match(const struct xfrm_selector *sel_cmp, - } - - static struct xfrm_policy *xfrm_migrate_policy_find(const struct xfrm_selector *sel, -- u8 dir, u8 type, struct net *net) -+ u8 dir, u8 type, struct net *net, u32 if_id) - { - struct xfrm_policy *pol, *ret = NULL; - struct hlist_head *chain; -@@ -4280,7 +4280,8 @@ static struct xfrm_policy *xfrm_migrate_policy_find(const struct xfrm_selector * - spin_lock_bh(&net->xfrm.xfrm_policy_lock); - chain = policy_hash_direct(net, &sel->daddr, &sel->saddr, sel->family, dir); - hlist_for_each_entry(pol, chain, bydst) { -- if (xfrm_migrate_selector_match(sel, &pol->selector) && -+ if ((if_id == 0 || pol->if_id == if_id) && -+ xfrm_migrate_selector_match(sel, &pol->selector) && - pol->type == type) { - ret = pol; - priority = ret->priority; -@@ -4292,7 +4293,8 @@ static struct xfrm_policy *xfrm_migrate_policy_find(const struct xfrm_selector * - if ((pol->priority >= priority) && ret) - break; - -- if (xfrm_migrate_selector_match(sel, &pol->selector) && -+ if ((if_id == 0 || pol->if_id == if_id) && -+ xfrm_migrate_selector_match(sel, &pol->selector) && - pol->type == type) { - ret = pol; - break; -@@ -4408,7 +4410,7 @@ static int xfrm_migrate_check(const struct xfrm_migrate *m, int num_migrate) - int xfrm_migrate(const struct xfrm_selector *sel, u8 dir, u8 type, - struct xfrm_migrate *m, int num_migrate, - struct xfrm_kmaddress *k, struct net *net, -- struct xfrm_encap_tmpl *encap) -+ struct xfrm_encap_tmpl *encap, u32 if_id) - { - int i, err, nx_cur = 0, nx_new = 0; - struct xfrm_policy *pol = NULL; -@@ -4427,14 +4429,14 @@ int xfrm_migrate(const struct xfrm_selector *sel, u8 dir, u8 type, - } - - /* Stage 1 - find policy */ -- if ((pol = xfrm_migrate_policy_find(sel, dir, type, net)) == NULL) { -+ if ((pol = xfrm_migrate_policy_find(sel, dir, type, net, if_id)) == NULL) { - err = -ENOENT; - goto out; - } - - /* Stage 2 - find and update state(s) */ - for (i = 0, mp = m; i < num_migrate; i++, mp++) { -- if ((x = xfrm_migrate_state_find(mp, net))) { -+ if ((x = xfrm_migrate_state_find(mp, net, if_id))) { - x_cur[nx_cur] = x; - nx_cur++; - xc = xfrm_state_migrate(x, mp, encap); -diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c -index 1423e2b7cb42a..268bba29bb603 100644 ---- a/net/xfrm/xfrm_state.c -+++ b/net/xfrm/xfrm_state.c -@@ -1539,9 +1539,6 @@ static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig, - memcpy(&x->mark, &orig->mark, sizeof(x->mark)); - memcpy(&x->props.smark, &orig->props.smark, sizeof(x->props.smark)); - -- if (xfrm_init_state(x) < 0) -- goto error; -- - x->props.flags = orig->props.flags; - x->props.extra_flags = orig->props.extra_flags; - -@@ -1563,7 +1560,8 @@ out: - return NULL; - } - --struct xfrm_state *xfrm_migrate_state_find(struct xfrm_migrate *m, struct net *net) -+struct xfrm_state *xfrm_migrate_state_find(struct xfrm_migrate *m, struct net *net, -+ u32 if_id) - { - unsigned int h; - struct xfrm_state *x = NULL; -@@ -1579,6 +1577,8 @@ struct xfrm_state *xfrm_migrate_state_find(struct xfrm_migrate *m, struct net *n - continue; - if (m->reqid && x->props.reqid != m->reqid) - continue; -+ if (if_id != 0 && x->if_id != if_id) -+ continue; - if (!xfrm_addr_equal(&x->id.daddr, &m->old_daddr, - m->old_family) || - !xfrm_addr_equal(&x->props.saddr, &m->old_saddr, -@@ -1594,6 +1594,8 @@ struct xfrm_state *xfrm_migrate_state_find(struct xfrm_migrate *m, struct net *n - if (x->props.mode != m->mode || - x->id.proto != m->proto) - continue; -+ if (if_id != 0 && x->if_id != if_id) -+ continue; - if (!xfrm_addr_equal(&x->id.daddr, &m->old_daddr, - m->old_family) || - !xfrm_addr_equal(&x->props.saddr, &m->old_saddr, -@@ -1620,6 +1622,11 @@ struct xfrm_state *xfrm_state_migrate(struct xfrm_state *x, - if (!xc) - return NULL; - -+ xc->props.family = m->new_family; -+ -+ if (xfrm_init_state(xc) < 0) -+ goto error; -+ - memcpy(&xc->id.daddr, &m->new_daddr, sizeof(xc->id.daddr)); - memcpy(&xc->props.saddr, &m->new_saddr, sizeof(xc->props.saddr)); - -diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c -index 42ff32700d68b..bd44a800e7db7 100644 ---- a/net/xfrm/xfrm_user.c -+++ b/net/xfrm/xfrm_user.c -@@ -621,13 +621,8 @@ static struct xfrm_state *xfrm_state_construct(struct net *net, - - xfrm_smark_init(attrs, &x->props.smark); - -- if (attrs[XFRMA_IF_ID]) { -+ if (attrs[XFRMA_IF_ID]) - x->if_id = nla_get_u32(attrs[XFRMA_IF_ID]); -- if (!x->if_id) { -- err = -EINVAL; -- goto error; -- } -- } - - err = __xfrm_init_state(x, false, attrs[XFRMA_OFFLOAD_DEV]); - if (err) -@@ -1333,13 +1328,8 @@ static int xfrm_alloc_userspi(struct sk_buff *skb, struct nlmsghdr *nlh, - - mark = xfrm_mark_get(attrs, &m); - -- if (attrs[XFRMA_IF_ID]) { -+ if (attrs[XFRMA_IF_ID]) - if_id = nla_get_u32(attrs[XFRMA_IF_ID]); -- if (!if_id) { -- err = -EINVAL; -- goto out_noput; -- } -- } - - if (p->info.seq) { - x = xfrm_find_acq_byseq(net, mark, p->info.seq); -@@ -1641,13 +1631,8 @@ static struct xfrm_policy *xfrm_policy_construct(struct net *net, struct xfrm_us - - xfrm_mark_get(attrs, &xp->mark); - -- if (attrs[XFRMA_IF_ID]) { -+ if (attrs[XFRMA_IF_ID]) - xp->if_id = nla_get_u32(attrs[XFRMA_IF_ID]); -- if (!xp->if_id) { -- err = -EINVAL; -- goto error; -- } -- } - - return xp; - error: -@@ -2389,6 +2374,7 @@ static int xfrm_do_migrate(struct sk_buff *skb, struct nlmsghdr *nlh, - int n = 0; - struct net *net = sock_net(skb->sk); - struct xfrm_encap_tmpl *encap = NULL; -+ u32 if_id = 0; - - if (attrs[XFRMA_MIGRATE] == NULL) - return -EINVAL; -@@ -2413,7 +2399,10 @@ static int xfrm_do_migrate(struct sk_buff *skb, struct nlmsghdr *nlh, - return 0; - } - -- err = xfrm_migrate(&pi->sel, pi->dir, type, m, n, kmp, net, encap); -+ if (attrs[XFRMA_IF_ID]) -+ if_id = nla_get_u32(attrs[XFRMA_IF_ID]); -+ -+ err = xfrm_migrate(&pi->sel, pi->dir, type, m, n, kmp, net, encap, if_id); - - kfree(encap); - -diff --git a/tools/testing/selftests/vm/userfaultfd.c b/tools/testing/selftests/vm/userfaultfd.c -index 9ba7feffe344b..9814a0a15ba78 100644 ---- a/tools/testing/selftests/vm/userfaultfd.c -+++ b/tools/testing/selftests/vm/userfaultfd.c -@@ -46,6 +46,7 @@ - #include - #include - #include -+#include - #include - #include - #include -diff --git a/virt/kvm/arm/psci.c b/virt/kvm/arm/psci.c -index 48fde38d64c37..2f5dc7fb437bd 100644 ---- a/virt/kvm/arm/psci.c -+++ b/virt/kvm/arm/psci.c -@@ -426,6 +426,18 @@ int kvm_hvc_call_handler(struct kvm_vcpu *vcpu) - break; - } - break; -+ case ARM_SMCCC_ARCH_WORKAROUND_3: -+ switch (kvm_arm_get_spectre_bhb_state()) { -+ case SPECTRE_VULNERABLE: -+ break; -+ case SPECTRE_MITIGATED: -+ val = SMCCC_RET_SUCCESS; -+ break; -+ case SPECTRE_UNAFFECTED: -+ val = SMCCC_ARCH_WORKAROUND_RET_UNAFFECTED; -+ break; -+ } -+ break; - } - break; - default: -@@ -438,7 +450,7 @@ int kvm_hvc_call_handler(struct kvm_vcpu *vcpu) - - int kvm_arm_get_fw_num_regs(struct kvm_vcpu *vcpu) - { -- return 3; /* PSCI version and two workaround registers */ -+ return 4; /* PSCI version and three workaround registers */ - } - - int kvm_arm_copy_fw_reg_indices(struct kvm_vcpu *vcpu, u64 __user *uindices) -@@ -452,6 +464,9 @@ int kvm_arm_copy_fw_reg_indices(struct kvm_vcpu *vcpu, u64 __user *uindices) - if (put_user(KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2, uindices++)) - return -EFAULT; - -+ if (put_user(KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_3, uindices++)) -+ return -EFAULT; -+ - return 0; - } - -@@ -486,9 +501,20 @@ static int get_kernel_wa_level(u64 regid) - return KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_NOT_REQUIRED; - case KVM_SSBD_UNKNOWN: - default: -- return KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_UNKNOWN; -+ break; - } -- } -+ return KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_UNKNOWN; -+ case KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_3: -+ switch (kvm_arm_get_spectre_bhb_state()) { -+ case SPECTRE_VULNERABLE: -+ return KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_3_NOT_AVAIL; -+ case SPECTRE_MITIGATED: -+ return KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_3_AVAIL; -+ case SPECTRE_UNAFFECTED: -+ return KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_3_NOT_REQUIRED; -+ } -+ return KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_3_NOT_AVAIL; -+ } - - return -EINVAL; - } -@@ -503,6 +529,7 @@ int kvm_arm_get_fw_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg) - val = kvm_psci_version(vcpu, vcpu->kvm); - break; - case KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1: -+ case KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_3: - val = get_kernel_wa_level(reg->id) & KVM_REG_FEATURE_LEVEL_MASK; - break; - case KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2: -@@ -555,6 +582,7 @@ int kvm_arm_set_fw_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg) - } - - case KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1: -+ case KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_3: - if (val & ~KVM_REG_FEATURE_LEVEL_MASK) - return -EINVAL; - diff --git a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.186-187.patch b/patch/kernel/archive/odroidxu4-5.4/patch-5.4.186-187.patch deleted file mode 100644 index fdb460d40..000000000 --- a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.186-187.patch +++ /dev/null @@ -1,511 +0,0 @@ -diff --git a/Makefile b/Makefile -index f9054b4e8a123..d07421bc5c2fb 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 5 - PATCHLEVEL = 4 --SUBLEVEL = 186 -+SUBLEVEL = 187 - EXTRAVERSION = - NAME = Kleptomaniac Octopus - -diff --git a/arch/arm64/include/asm/vectors.h b/arch/arm64/include/asm/vectors.h -index f64613a96d530..bc9a2145f4194 100644 ---- a/arch/arm64/include/asm/vectors.h -+++ b/arch/arm64/include/asm/vectors.h -@@ -56,14 +56,14 @@ enum arm64_bp_harden_el1_vectors { - DECLARE_PER_CPU_READ_MOSTLY(const char *, this_cpu_vector); - - #ifndef CONFIG_UNMAP_KERNEL_AT_EL0 --#define TRAMP_VALIAS 0 -+#define TRAMP_VALIAS 0ul - #endif - - static inline const char * - arm64_get_bp_hardening_vector(enum arm64_bp_harden_el1_vectors slot) - { - if (arm64_kernel_unmapped_at_el0()) -- return (char *)TRAMP_VALIAS + SZ_2K * slot; -+ return (char *)(TRAMP_VALIAS + SZ_2K * slot); - - WARN_ON_ONCE(slot == EL1_VECTOR_KPTI); - -diff --git a/drivers/atm/eni.c b/drivers/atm/eni.c -index de52428b8833d..4816db0553ef8 100644 ---- a/drivers/atm/eni.c -+++ b/drivers/atm/eni.c -@@ -1116,6 +1116,8 @@ DPRINTK("iovcnt = %d\n",skb_shinfo(skb)->nr_frags); - } - paddr = dma_map_single(&eni_dev->pci_dev->dev,skb->data,skb->len, - DMA_TO_DEVICE); -+ if (dma_mapping_error(&eni_dev->pci_dev->dev, paddr)) -+ return enq_next; - ENI_PRV_PADDR(skb) = paddr; - /* prepare DMA queue entries */ - j = 0; -diff --git a/drivers/crypto/qcom-rng.c b/drivers/crypto/qcom-rng.c -index 4730f84b646de..3a633a0c40fdf 100644 ---- a/drivers/crypto/qcom-rng.c -+++ b/drivers/crypto/qcom-rng.c -@@ -7,6 +7,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -42,16 +43,19 @@ static int qcom_rng_read(struct qcom_rng *rng, u8 *data, unsigned int max) - { - unsigned int currsize = 0; - u32 val; -+ int ret; - - /* read random data from hardware */ - do { -- val = readl_relaxed(rng->base + PRNG_STATUS); -- if (!(val & PRNG_STATUS_DATA_AVAIL)) -- break; -+ ret = readl_poll_timeout(rng->base + PRNG_STATUS, val, -+ val & PRNG_STATUS_DATA_AVAIL, -+ 200, 10000); -+ if (ret) -+ return ret; - - val = readl_relaxed(rng->base + PRNG_DATA_OUT); - if (!val) -- break; -+ return -EINVAL; - - if ((max - currsize) >= WORD_SZ) { - memcpy(data, &val, WORD_SZ); -@@ -60,11 +64,10 @@ static int qcom_rng_read(struct qcom_rng *rng, u8 *data, unsigned int max) - } else { - /* copy only remaining bytes */ - memcpy(data, &val, max - currsize); -- break; - } - } while (currsize < max); - -- return currsize; -+ return 0; - } - - static int qcom_rng_generate(struct crypto_rng *tfm, -@@ -86,7 +89,7 @@ static int qcom_rng_generate(struct crypto_rng *tfm, - mutex_unlock(&rng->lock); - clk_disable_unprepare(rng->clk); - -- return 0; -+ return ret; - } - - static int qcom_rng_seed(struct crypto_rng *tfm, const u8 *seed, -diff --git a/drivers/firmware/efi/apple-properties.c b/drivers/firmware/efi/apple-properties.c -index 0e206c9e0d7ae..7ad2d85d7270b 100644 ---- a/drivers/firmware/efi/apple-properties.c -+++ b/drivers/firmware/efi/apple-properties.c -@@ -23,7 +23,7 @@ static bool dump_properties __initdata; - static int __init dump_properties_enable(char *arg) - { - dump_properties = true; -- return 0; -+ return 1; - } - - __setup("dump_apple_properties", dump_properties_enable); -diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c -index 415d7b3a59f82..8fd74a7501d40 100644 ---- a/drivers/firmware/efi/efi.c -+++ b/drivers/firmware/efi/efi.c -@@ -231,7 +231,7 @@ static int __init efivar_ssdt_setup(char *str) - memcpy(efivar_ssdt, str, strlen(str)); - else - pr_warn("efivar_ssdt: name too long: %s\n", str); -- return 0; -+ return 1; - } - __setup("efivar_ssdt=", efivar_ssdt_setup); - -diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c -index f0ea782df836d..312a3c4e23318 100644 ---- a/drivers/gpu/drm/panel/panel-simple.c -+++ b/drivers/gpu/drm/panel/panel-simple.c -@@ -1619,7 +1619,7 @@ static const struct display_timing innolux_g070y2_l01_timing = { - static const struct panel_desc innolux_g070y2_l01 = { - .timings = &innolux_g070y2_l01_timing, - .num_timings = 1, -- .bpc = 6, -+ .bpc = 8, - .size = { - .width = 152, - .height = 91, -diff --git a/drivers/input/tablet/aiptek.c b/drivers/input/tablet/aiptek.c -index 06d0ffef4a171..acaf8c045f19a 100644 ---- a/drivers/input/tablet/aiptek.c -+++ b/drivers/input/tablet/aiptek.c -@@ -1801,15 +1801,13 @@ aiptek_probe(struct usb_interface *intf, const struct usb_device_id *id) - input_set_abs_params(inputdev, ABS_TILT_Y, AIPTEK_TILT_MIN, AIPTEK_TILT_MAX, 0, 0); - input_set_abs_params(inputdev, ABS_WHEEL, AIPTEK_WHEEL_MIN, AIPTEK_WHEEL_MAX - 1, 0, 0); - -- /* Verify that a device really has an endpoint */ -- if (intf->cur_altsetting->desc.bNumEndpoints < 1) { -+ err = usb_find_common_endpoints(intf->cur_altsetting, -+ NULL, NULL, &endpoint, NULL); -+ if (err) { - dev_err(&intf->dev, -- "interface has %d endpoints, but must have minimum 1\n", -- intf->cur_altsetting->desc.bNumEndpoints); -- err = -EINVAL; -+ "interface has no int in endpoints, but must have minimum 1\n"); - goto fail3; - } -- endpoint = &intf->cur_altsetting->endpoint[0].desc; - - /* Go set up our URB, which is called when the tablet receives - * input. -diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c -index 362b7ca6f3b2a..57e92c5bfcc92 100644 ---- a/drivers/net/hyperv/netvsc_drv.c -+++ b/drivers/net/hyperv/netvsc_drv.c -@@ -1445,6 +1445,9 @@ static void netvsc_get_ethtool_stats(struct net_device *dev, - pcpu_sum = kvmalloc_array(num_possible_cpus(), - sizeof(struct netvsc_ethtool_pcpu_stats), - GFP_KERNEL); -+ if (!pcpu_sum) -+ return; -+ - netvsc_get_pcpu_stats(dev, pcpu_sum); - for_each_present_cpu(cpu) { - struct netvsc_ethtool_pcpu_stats *this_sum = &pcpu_sum[cpu]; -diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c -index 53420c5312667..49801c2eb6271 100644 ---- a/drivers/net/phy/marvell.c -+++ b/drivers/net/phy/marvell.c -@@ -1408,8 +1408,8 @@ static int marvell_suspend(struct phy_device *phydev) - int err; - - /* Suspend the fiber mode first */ -- if (!linkmode_test_bit(ETHTOOL_LINK_MODE_FIBRE_BIT, -- phydev->supported)) { -+ if (linkmode_test_bit(ETHTOOL_LINK_MODE_FIBRE_BIT, -+ phydev->supported)) { - err = marvell_set_page(phydev, MII_MARVELL_FIBER_PAGE); - if (err < 0) - goto error; -@@ -1443,8 +1443,8 @@ static int marvell_resume(struct phy_device *phydev) - int err; - - /* Resume the fiber mode first */ -- if (!linkmode_test_bit(ETHTOOL_LINK_MODE_FIBRE_BIT, -- phydev->supported)) { -+ if (linkmode_test_bit(ETHTOOL_LINK_MODE_FIBRE_BIT, -+ phydev->supported)) { - err = marvell_set_page(phydev, MII_MARVELL_FIBER_PAGE); - if (err < 0) - goto error; -diff --git a/drivers/usb/class/usbtmc.c b/drivers/usb/class/usbtmc.c -index 3922a6f8c50a6..77b1802f829b3 100644 ---- a/drivers/usb/class/usbtmc.c -+++ b/drivers/usb/class/usbtmc.c -@@ -1889,6 +1889,7 @@ static int usbtmc_ioctl_request(struct usbtmc_device_data *data, - struct usbtmc_ctrlrequest request; - u8 *buffer = NULL; - int rv; -+ unsigned int is_in, pipe; - unsigned long res; - - res = copy_from_user(&request, arg, sizeof(struct usbtmc_ctrlrequest)); -@@ -1898,12 +1899,14 @@ static int usbtmc_ioctl_request(struct usbtmc_device_data *data, - if (request.req.wLength > USBTMC_BUFSIZE) - return -EMSGSIZE; - -+ is_in = request.req.bRequestType & USB_DIR_IN; -+ - if (request.req.wLength) { - buffer = kmalloc(request.req.wLength, GFP_KERNEL); - if (!buffer) - return -ENOMEM; - -- if ((request.req.bRequestType & USB_DIR_IN) == 0) { -+ if (!is_in) { - /* Send control data to device */ - res = copy_from_user(buffer, request.data, - request.req.wLength); -@@ -1914,8 +1917,12 @@ static int usbtmc_ioctl_request(struct usbtmc_device_data *data, - } - } - -+ if (is_in) -+ pipe = usb_rcvctrlpipe(data->usb_dev, 0); -+ else -+ pipe = usb_sndctrlpipe(data->usb_dev, 0); - rv = usb_control_msg(data->usb_dev, -- usb_rcvctrlpipe(data->usb_dev, 0), -+ pipe, - request.req.bRequest, - request.req.bRequestType, - request.req.wValue, -@@ -1927,7 +1934,7 @@ static int usbtmc_ioctl_request(struct usbtmc_device_data *data, - goto exit; - } - -- if (rv && (request.req.bRequestType & USB_DIR_IN)) { -+ if (rv && is_in) { - /* Read control data from device */ - res = copy_to_user(request.data, buffer, rv); - if (res) -diff --git a/drivers/usb/gadget/function/rndis.c b/drivers/usb/gadget/function/rndis.c -index 970ed1514f0bc..fa0c173a0d26f 100644 ---- a/drivers/usb/gadget/function/rndis.c -+++ b/drivers/usb/gadget/function/rndis.c -@@ -640,6 +640,7 @@ static int rndis_set_response(struct rndis_params *params, - BufLength = le32_to_cpu(buf->InformationBufferLength); - BufOffset = le32_to_cpu(buf->InformationBufferOffset); - if ((BufLength > RNDIS_MAX_TOTAL_SIZE) || -+ (BufOffset > RNDIS_MAX_TOTAL_SIZE) || - (BufOffset + 8 >= RNDIS_MAX_TOTAL_SIZE)) - return -EINVAL; - -diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c -index e41f67cd3d469..f9d2737aabe82 100644 ---- a/drivers/usb/gadget/udc/core.c -+++ b/drivers/usb/gadget/udc/core.c -@@ -1303,7 +1303,6 @@ static void usb_gadget_remove_driver(struct usb_udc *udc) - usb_gadget_udc_stop(udc); - - udc->driver = NULL; -- udc->dev.driver = NULL; - udc->gadget->dev.driver = NULL; - } - -@@ -1352,7 +1351,6 @@ static int udc_bind_to_driver(struct usb_udc *udc, struct usb_gadget_driver *dri - driver->function); - - udc->driver = driver; -- udc->dev.driver = &driver->driver; - udc->gadget->dev.driver = &driver->driver; - - usb_gadget_udc_set_speed(udc, driver->max_speed); -@@ -1374,7 +1372,6 @@ err1: - dev_err(&udc->dev, "failed to start %s: %d\n", - udc->driver->function, ret); - udc->driver = NULL; -- udc->dev.driver = NULL; - udc->gadget->dev.driver = NULL; - return ret; - } -diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c -index eaec97892dce8..c1cf67b24c19b 100644 ---- a/fs/ocfs2/super.c -+++ b/fs/ocfs2/super.c -@@ -1100,17 +1100,6 @@ static int ocfs2_fill_super(struct super_block *sb, void *data, int silent) - goto read_super_error; - } - -- root = d_make_root(inode); -- if (!root) { -- status = -ENOMEM; -- mlog_errno(status); -- goto read_super_error; -- } -- -- sb->s_root = root; -- -- ocfs2_complete_mount_recovery(osb); -- - osb->osb_dev_kset = kset_create_and_add(sb->s_id, NULL, - &ocfs2_kset->kobj); - if (!osb->osb_dev_kset) { -@@ -1128,6 +1117,17 @@ static int ocfs2_fill_super(struct super_block *sb, void *data, int silent) - goto read_super_error; - } - -+ root = d_make_root(inode); -+ if (!root) { -+ status = -ENOMEM; -+ mlog_errno(status); -+ goto read_super_error; -+ } -+ -+ sb->s_root = root; -+ -+ ocfs2_complete_mount_recovery(osb); -+ - if (ocfs2_mount_local(osb)) - snprintf(nodestr, sizeof(nodestr), "local"); - else -diff --git a/include/linux/if_arp.h b/include/linux/if_arp.h -index bf5c5f32c65e4..e147ea6794670 100644 ---- a/include/linux/if_arp.h -+++ b/include/linux/if_arp.h -@@ -51,6 +51,7 @@ static inline bool dev_is_mac_header_xmit(const struct net_device *dev) - case ARPHRD_VOID: - case ARPHRD_NONE: - case ARPHRD_RAWIP: -+ case ARPHRD_PIMREG: - return false; - default: - return true; -diff --git a/net/dsa/dsa2.c b/net/dsa/dsa2.c -index 70e6fc2edd304..1f27641f9cc07 100644 ---- a/net/dsa/dsa2.c -+++ b/net/dsa/dsa2.c -@@ -669,6 +669,7 @@ static int dsa_port_parse_of(struct dsa_port *dp, struct device_node *dn) - struct net_device *master; - - master = of_find_net_device_by_node(ethernet); -+ of_node_put(ethernet); - if (!master) - return -EPROBE_DEFER; - -diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c -index ed11013d4b953..70c102359bfef 100644 ---- a/net/packet/af_packet.c -+++ b/net/packet/af_packet.c -@@ -2257,8 +2257,11 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, - copy_skb = skb_get(skb); - skb_head = skb->data; - } -- if (copy_skb) -+ if (copy_skb) { -+ memset(&PACKET_SKB_CB(copy_skb)->sa.ll, 0, -+ sizeof(PACKET_SKB_CB(copy_skb)->sa.ll)); - skb_set_owner_r(copy_skb, sk); -+ } - } - snaplen = po->rx_ring.frame_size - macoff; - if ((int)snaplen < 0) { -@@ -3405,6 +3408,8 @@ static int packet_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, - sock_recv_ts_and_drops(msg, sk, skb); - - if (msg->msg_name) { -+ const size_t max_len = min(sizeof(skb->cb), -+ sizeof(struct sockaddr_storage)); - int copy_len; - - /* If the address length field is there to be filled -@@ -3427,6 +3432,10 @@ static int packet_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, - msg->msg_namelen = sizeof(struct sockaddr_ll); - } - } -+ if (WARN_ON_ONCE(copy_len > max_len)) { -+ copy_len = max_len; -+ msg->msg_namelen = copy_len; -+ } - memcpy(msg->msg_name, &PACKET_SKB_CB(skb)->sa, copy_len); - } - -diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c -index 901ad7f6f4dcc..ea2c7beff4868 100644 ---- a/tools/perf/util/symbol.c -+++ b/tools/perf/util/symbol.c -@@ -231,7 +231,7 @@ void symbols__fixup_end(struct rb_root_cached *symbols) - prev = curr; - curr = rb_entry(nd, struct symbol, rb_node); - -- if (prev->end == prev->start && prev->end != curr->start) -+ if (prev->end == prev->start || prev->end != curr->start) - arch__symbols__fixup_end(prev, curr); - } - -diff --git a/tools/testing/selftests/bpf/prog_tests/timer_crash.c b/tools/testing/selftests/bpf/prog_tests/timer_crash.c -deleted file mode 100644 -index f74b82305da8c..0000000000000 ---- a/tools/testing/selftests/bpf/prog_tests/timer_crash.c -+++ /dev/null -@@ -1,32 +0,0 @@ --// SPDX-License-Identifier: GPL-2.0 --#include --#include "timer_crash.skel.h" -- --enum { -- MODE_ARRAY, -- MODE_HASH, --}; -- --static void test_timer_crash_mode(int mode) --{ -- struct timer_crash *skel; -- -- skel = timer_crash__open_and_load(); -- if (!ASSERT_OK_PTR(skel, "timer_crash__open_and_load")) -- return; -- skel->bss->pid = getpid(); -- skel->bss->crash_map = mode; -- if (!ASSERT_OK(timer_crash__attach(skel), "timer_crash__attach")) -- goto end; -- usleep(1); --end: -- timer_crash__destroy(skel); --} -- --void test_timer_crash(void) --{ -- if (test__start_subtest("array")) -- test_timer_crash_mode(MODE_ARRAY); -- if (test__start_subtest("hash")) -- test_timer_crash_mode(MODE_HASH); --} -diff --git a/tools/testing/selftests/bpf/progs/timer_crash.c b/tools/testing/selftests/bpf/progs/timer_crash.c -deleted file mode 100644 -index f8f7944e70dae..0000000000000 ---- a/tools/testing/selftests/bpf/progs/timer_crash.c -+++ /dev/null -@@ -1,54 +0,0 @@ --// SPDX-License-Identifier: GPL-2.0 -- --#include --#include --#include -- --struct map_elem { -- struct bpf_timer timer; -- struct bpf_spin_lock lock; --}; -- --struct { -- __uint(type, BPF_MAP_TYPE_ARRAY); -- __uint(max_entries, 1); -- __type(key, int); -- __type(value, struct map_elem); --} amap SEC(".maps"); -- --struct { -- __uint(type, BPF_MAP_TYPE_HASH); -- __uint(max_entries, 1); -- __type(key, int); -- __type(value, struct map_elem); --} hmap SEC(".maps"); -- --int pid = 0; --int crash_map = 0; /* 0 for amap, 1 for hmap */ -- --SEC("fentry/do_nanosleep") --int sys_enter(void *ctx) --{ -- struct map_elem *e, value = {}; -- void *map = crash_map ? (void *)&hmap : (void *)&amap; -- -- if (bpf_get_current_task_btf()->tgid != pid) -- return 0; -- -- *(void **)&value = (void *)0xdeadcaf3; -- -- bpf_map_update_elem(map, &(int){0}, &value, 0); -- /* For array map, doing bpf_map_update_elem will do a -- * check_and_free_timer_in_array, which will trigger the crash if timer -- * pointer was overwritten, for hmap we need to use bpf_timer_cancel. -- */ -- if (crash_map == 1) { -- e = bpf_map_lookup_elem(map, &(int){0}); -- if (!e) -- return 0; -- bpf_timer_cancel(&e->timer); -- } -- return 0; --} -- --char _license[] SEC("license") = "GPL"; diff --git a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.187-188.patch b/patch/kernel/archive/odroidxu4-5.4/patch-5.4.187-188.patch deleted file mode 100644 index 43de30711..000000000 --- a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.187-188.patch +++ /dev/null @@ -1,1264 +0,0 @@ -diff --git a/Makefile b/Makefile -index d07421bc5c2fb..8684857148066 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 5 - PATCHLEVEL = 4 --SUBLEVEL = 187 -+SUBLEVEL = 188 - EXTRAVERSION = - NAME = Kleptomaniac Octopus - -diff --git a/arch/nds32/include/asm/uaccess.h b/arch/nds32/include/asm/uaccess.h -index 8916ad9f9f139..e205b1db8c807 100644 ---- a/arch/nds32/include/asm/uaccess.h -+++ b/arch/nds32/include/asm/uaccess.h -@@ -71,9 +71,7 @@ static inline void set_fs(mm_segment_t fs) - * versions are void (ie, don't return a value as such). - */ - --#define get_user __get_user \ -- --#define __get_user(x, ptr) \ -+#define get_user(x, ptr) \ - ({ \ - long __gu_err = 0; \ - __get_user_check((x), (ptr), __gu_err); \ -@@ -86,6 +84,14 @@ static inline void set_fs(mm_segment_t fs) - (void)0; \ - }) - -+#define __get_user(x, ptr) \ -+({ \ -+ long __gu_err = 0; \ -+ const __typeof__(*(ptr)) __user *__p = (ptr); \ -+ __get_user_err((x), __p, (__gu_err)); \ -+ __gu_err; \ -+}) -+ - #define __get_user_check(x, ptr, err) \ - ({ \ - const __typeof__(*(ptr)) __user *__p = (ptr); \ -@@ -166,12 +172,18 @@ do { \ - : "r"(addr), "i"(-EFAULT) \ - : "cc") - --#define put_user __put_user \ -+#define put_user(x, ptr) \ -+({ \ -+ long __pu_err = 0; \ -+ __put_user_check((x), (ptr), __pu_err); \ -+ __pu_err; \ -+}) - - #define __put_user(x, ptr) \ - ({ \ - long __pu_err = 0; \ -- __put_user_err((x), (ptr), __pu_err); \ -+ __typeof__(*(ptr)) __user *__p = (ptr); \ -+ __put_user_err((x), __p, __pu_err); \ - __pu_err; \ - }) - -diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c -index 4137a7342d687..7b75658b7e9ac 100644 ---- a/arch/x86/kernel/acpi/boot.c -+++ b/arch/x86/kernel/acpi/boot.c -@@ -1339,6 +1339,17 @@ static int __init disable_acpi_pci(const struct dmi_system_id *d) - return 0; - } - -+static int __init disable_acpi_xsdt(const struct dmi_system_id *d) -+{ -+ if (!acpi_force) { -+ pr_notice("%s detected: force use of acpi=rsdt\n", d->ident); -+ acpi_gbl_do_not_use_xsdt = TRUE; -+ } else { -+ pr_notice("Warning: DMI blacklist says broken, but acpi XSDT forced\n"); -+ } -+ return 0; -+} -+ - static int __init dmi_disable_acpi(const struct dmi_system_id *d) - { - if (!acpi_force) { -@@ -1463,6 +1474,19 @@ static const struct dmi_system_id acpi_dmi_table[] __initconst = { - DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate 360"), - }, - }, -+ /* -+ * Boxes that need ACPI XSDT use disabled due to corrupted tables -+ */ -+ { -+ .callback = disable_acpi_xsdt, -+ .ident = "Advantech DAC-BJ01", -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "NEC"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "Bearlake CRB Board"), -+ DMI_MATCH(DMI_BIOS_VERSION, "V1.12"), -+ DMI_MATCH(DMI_BIOS_DATE, "02/01/2011"), -+ }, -+ }, - {} - }; - -diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c -index 4e0aea5f008e3..974c2df13da1d 100644 ---- a/drivers/acpi/battery.c -+++ b/drivers/acpi/battery.c -@@ -77,6 +77,10 @@ extern void *acpi_unlock_battery_dir(struct proc_dir_entry *acpi_battery_dir); - - static const struct acpi_device_id battery_device_ids[] = { - {"PNP0C0A", 0}, -+ -+ /* Microsoft Surface Go 3 */ -+ {"MSHW0146", 0}, -+ - {"", 0}, - }; - -@@ -1403,6 +1407,14 @@ static const struct dmi_system_id bat_dmi_table[] __initconst = { - DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad"), - }, - }, -+ { -+ /* Microsoft Surface Go 3 */ -+ .callback = battery_notification_delay_quirk, -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "Microsoft Corporation"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "Surface Go 3"), -+ }, -+ }, - {}, - }; - -diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c -index e7978d983b263..de4142723ff48 100644 ---- a/drivers/acpi/video_detect.c -+++ b/drivers/acpi/video_detect.c -@@ -372,6 +372,81 @@ static const struct dmi_system_id video_detect_dmi_table[] = { - DMI_MATCH(DMI_BOARD_NAME, "BA51_MV"), - }, - }, -+ /* -+ * Clevo NL5xRU and NL5xNU/TUXEDO Aura 15 Gen1 and Gen2 have both a -+ * working native and video interface. However the default detection -+ * mechanism first registers the video interface before unregistering -+ * it again and switching to the native interface during boot. This -+ * results in a dangling SBIOS request for backlight change for some -+ * reason, causing the backlight to switch to ~2% once per boot on the -+ * first power cord connect or disconnect event. Setting the native -+ * interface explicitly circumvents this buggy behaviour, by avoiding -+ * the unregistering process. -+ */ -+ { -+ .callback = video_detect_force_native, -+ .ident = "Clevo NL5xRU", -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "TUXEDO"), -+ DMI_MATCH(DMI_BOARD_NAME, "NL5xRU"), -+ }, -+ }, -+ { -+ .callback = video_detect_force_native, -+ .ident = "Clevo NL5xRU", -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "SchenkerTechnologiesGmbH"), -+ DMI_MATCH(DMI_BOARD_NAME, "NL5xRU"), -+ }, -+ }, -+ { -+ .callback = video_detect_force_native, -+ .ident = "Clevo NL5xRU", -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "Notebook"), -+ DMI_MATCH(DMI_BOARD_NAME, "NL5xRU"), -+ }, -+ }, -+ { -+ .callback = video_detect_force_native, -+ .ident = "Clevo NL5xRU", -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "TUXEDO"), -+ DMI_MATCH(DMI_BOARD_NAME, "AURA1501"), -+ }, -+ }, -+ { -+ .callback = video_detect_force_native, -+ .ident = "Clevo NL5xRU", -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "TUXEDO"), -+ DMI_MATCH(DMI_BOARD_NAME, "EDUBOOK1502"), -+ }, -+ }, -+ { -+ .callback = video_detect_force_native, -+ .ident = "Clevo NL5xNU", -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "TUXEDO"), -+ DMI_MATCH(DMI_BOARD_NAME, "NL5xNU"), -+ }, -+ }, -+ { -+ .callback = video_detect_force_native, -+ .ident = "Clevo NL5xNU", -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "SchenkerTechnologiesGmbH"), -+ DMI_MATCH(DMI_BOARD_NAME, "NL5xNU"), -+ }, -+ }, -+ { -+ .callback = video_detect_force_native, -+ .ident = "Clevo NL5xNU", -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "Notebook"), -+ DMI_MATCH(DMI_BOARD_NAME, "NL5xNU"), -+ }, -+ }, - - /* - * Desktops which falsely report a backlight and which our heuristics -diff --git a/drivers/char/tpm/tpm-dev-common.c b/drivers/char/tpm/tpm-dev-common.c -index 1784530b8387b..b99e1941c52c9 100644 ---- a/drivers/char/tpm/tpm-dev-common.c -+++ b/drivers/char/tpm/tpm-dev-common.c -@@ -70,7 +70,13 @@ static void tpm_dev_async_work(struct work_struct *work) - ret = tpm_dev_transmit(priv->chip, priv->space, priv->data_buffer, - sizeof(priv->data_buffer)); - tpm_put_ops(priv->chip); -- if (ret > 0) { -+ -+ /* -+ * If ret is > 0 then tpm_dev_transmit returned the size of the -+ * response. If ret is < 0 then tpm_dev_transmit failed and -+ * returned an error code. -+ */ -+ if (ret != 0) { - priv->response_length = ret; - mod_timer(&priv->user_read_timer, jiffies + (120 * HZ)); - } -diff --git a/drivers/char/tpm/tpm2-space.c b/drivers/char/tpm/tpm2-space.c -index 97e916856cf3e..d2225020e4d2c 100644 ---- a/drivers/char/tpm/tpm2-space.c -+++ b/drivers/char/tpm/tpm2-space.c -@@ -58,12 +58,12 @@ int tpm2_init_space(struct tpm_space *space, unsigned int buf_size) - - void tpm2_del_space(struct tpm_chip *chip, struct tpm_space *space) - { -- mutex_lock(&chip->tpm_mutex); -- if (!tpm_chip_start(chip)) { -+ -+ if (tpm_try_get_ops(chip) == 0) { - tpm2_flush_sessions(chip, space); -- tpm_chip_stop(chip); -+ tpm_put_ops(chip); - } -- mutex_unlock(&chip->tpm_mutex); -+ - kfree(space->context_buf); - kfree(space->session_buf); - } -diff --git a/drivers/crypto/qat/qat_common/qat_crypto.c b/drivers/crypto/qat/qat_common/qat_crypto.c -index 3852d31ce0a4b..37a9f969c59cd 100644 ---- a/drivers/crypto/qat/qat_common/qat_crypto.c -+++ b/drivers/crypto/qat/qat_common/qat_crypto.c -@@ -170,6 +170,14 @@ int qat_crypto_dev_config(struct adf_accel_dev *accel_dev) - goto err; - if (adf_cfg_section_add(accel_dev, "Accelerator0")) - goto err; -+ -+ /* Temporarily set the number of crypto instances to zero to avoid -+ * registering the crypto algorithms. -+ * This will be removed when the algorithms will support the -+ * CRYPTO_TFM_REQ_MAY_BACKLOG flag -+ */ -+ instances = 0; -+ - for (i = 0; i < instances; i++) { - val = i; - snprintf(key, sizeof(key), ADF_CY "%d" ADF_RING_BANK_NUM, i); -diff --git a/drivers/net/ethernet/apm/xgene/xgene_enet_main.c b/drivers/net/ethernet/apm/xgene/xgene_enet_main.c -index cc8031ae9aa3f..ce4e617a6ec49 100644 ---- a/drivers/net/ethernet/apm/xgene/xgene_enet_main.c -+++ b/drivers/net/ethernet/apm/xgene/xgene_enet_main.c -@@ -696,6 +696,12 @@ static int xgene_enet_rx_frame(struct xgene_enet_desc_ring *rx_ring, - buf_pool->rx_skb[skb_index] = NULL; - - datalen = xgene_enet_get_data_len(le64_to_cpu(raw_desc->m1)); -+ -+ /* strip off CRC as HW isn't doing this */ -+ nv = GET_VAL(NV, le64_to_cpu(raw_desc->m0)); -+ if (!nv) -+ datalen -= 4; -+ - skb_put(skb, datalen); - prefetch(skb->data - NET_IP_ALIGN); - skb->protocol = eth_type_trans(skb, ndev); -@@ -717,12 +723,8 @@ static int xgene_enet_rx_frame(struct xgene_enet_desc_ring *rx_ring, - } - } - -- nv = GET_VAL(NV, le64_to_cpu(raw_desc->m0)); -- if (!nv) { -- /* strip off CRC as HW isn't doing this */ -- datalen -= 4; -+ if (!nv) - goto skip_jumbo; -- } - - slots = page_pool->slots - 1; - head = page_pool->head; -diff --git a/drivers/nfc/st21nfca/se.c b/drivers/nfc/st21nfca/se.c -index 6586378cacb05..a7ab6dab0f32d 100644 ---- a/drivers/nfc/st21nfca/se.c -+++ b/drivers/nfc/st21nfca/se.c -@@ -321,6 +321,11 @@ int st21nfca_connectivity_event_received(struct nfc_hci_dev *hdev, u8 host, - return -ENOMEM; - - transaction->aid_len = skb->data[1]; -+ -+ /* Checking if the length of the AID is valid */ -+ if (transaction->aid_len > sizeof(transaction->aid)) -+ return -EINVAL; -+ - memcpy(transaction->aid, &skb->data[2], - transaction->aid_len); - -@@ -330,6 +335,11 @@ int st21nfca_connectivity_event_received(struct nfc_hci_dev *hdev, u8 host, - return -EPROTO; - - transaction->params_len = skb->data[transaction->aid_len + 3]; -+ -+ /* Total size is allocated (skb->len - 2) minus fixed array members */ -+ if (transaction->params_len > ((skb->len - 2) - sizeof(struct nfc_evt_transaction))) -+ return -EINVAL; -+ - memcpy(transaction->params, skb->data + - transaction->aid_len + 4, transaction->params_len); - -diff --git a/drivers/staging/fbtft/fb_st7789v.c b/drivers/staging/fbtft/fb_st7789v.c -index 3c3f387936e80..30086ae03605f 100644 ---- a/drivers/staging/fbtft/fb_st7789v.c -+++ b/drivers/staging/fbtft/fb_st7789v.c -@@ -76,6 +76,8 @@ enum st7789v_command { - */ - static int init_display(struct fbtft_par *par) - { -+ par->fbtftops.reset(par); -+ - /* turn off sleep mode */ - write_reg(par, MIPI_DCS_EXIT_SLEEP_MODE); - mdelay(120); -diff --git a/drivers/thermal/intel/int340x_thermal/int3400_thermal.c b/drivers/thermal/intel/int340x_thermal/int3400_thermal.c -index 3517883b5cdb9..a31163547fbaa 100644 ---- a/drivers/thermal/intel/int340x_thermal/int3400_thermal.c -+++ b/drivers/thermal/intel/int340x_thermal/int3400_thermal.c -@@ -216,6 +216,10 @@ static void int3400_notify(acpi_handle handle, - thermal_prop[4] = NULL; - kobject_uevent_env(&priv->thermal->device.kobj, KOBJ_CHANGE, - thermal_prop); -+ kfree(thermal_prop[0]); -+ kfree(thermal_prop[1]); -+ kfree(thermal_prop[2]); -+ kfree(thermal_prop[3]); - break; - default: - /* Ignore unknown notification codes sent to INT3400 device */ -diff --git a/fs/nfsd/filecache.c b/fs/nfsd/filecache.c -index 662937472e9bd..79ad6b2c96082 100644 ---- a/fs/nfsd/filecache.c -+++ b/fs/nfsd/filecache.c -@@ -44,6 +44,17 @@ struct nfsd_fcache_bucket { - - static DEFINE_PER_CPU(unsigned long, nfsd_file_cache_hits); - -+struct nfsd_fcache_disposal { -+ struct list_head list; -+ struct work_struct work; -+ struct net *net; -+ spinlock_t lock; -+ struct list_head freeme; -+ struct rcu_head rcu; -+}; -+ -+struct workqueue_struct *nfsd_filecache_wq __read_mostly; -+ - static struct kmem_cache *nfsd_file_slab; - static struct kmem_cache *nfsd_file_mark_slab; - static struct nfsd_fcache_bucket *nfsd_file_hashtbl; -@@ -52,32 +63,21 @@ static long nfsd_file_lru_flags; - static struct fsnotify_group *nfsd_file_fsnotify_group; - static atomic_long_t nfsd_filecache_count; - static struct delayed_work nfsd_filecache_laundrette; -+static DEFINE_SPINLOCK(laundrette_lock); -+static LIST_HEAD(laundrettes); - --enum nfsd_file_laundrette_ctl { -- NFSD_FILE_LAUNDRETTE_NOFLUSH = 0, -- NFSD_FILE_LAUNDRETTE_MAY_FLUSH --}; -+static void nfsd_file_gc(void); - - static void --nfsd_file_schedule_laundrette(enum nfsd_file_laundrette_ctl ctl) -+nfsd_file_schedule_laundrette(void) - { - long count = atomic_long_read(&nfsd_filecache_count); - - if (count == 0 || test_bit(NFSD_FILE_SHUTDOWN, &nfsd_file_lru_flags)) - return; - -- /* Be more aggressive about scanning if over the threshold */ -- if (count > NFSD_FILE_LRU_THRESHOLD) -- mod_delayed_work(system_wq, &nfsd_filecache_laundrette, 0); -- else -- schedule_delayed_work(&nfsd_filecache_laundrette, NFSD_LAUNDRETTE_DELAY); -- -- if (ctl == NFSD_FILE_LAUNDRETTE_NOFLUSH) -- return; -- -- /* ...and don't delay flushing if we're out of control */ -- if (count >= NFSD_FILE_LRU_LIMIT) -- flush_delayed_work(&nfsd_filecache_laundrette); -+ queue_delayed_work(system_wq, &nfsd_filecache_laundrette, -+ NFSD_LAUNDRETTE_DELAY); - } - - static void -@@ -260,8 +260,6 @@ nfsd_file_do_unhash(struct nfsd_file *nf) - nfsd_reset_boot_verifier(net_generic(nf->nf_net, nfsd_net_id)); - --nfsd_file_hashtbl[nf->nf_hashval].nfb_count; - hlist_del_rcu(&nf->nf_node); -- if (!list_empty(&nf->nf_lru)) -- list_lru_del(&nfsd_file_lru, &nf->nf_lru); - atomic_long_dec(&nfsd_filecache_count); - } - -@@ -270,6 +268,8 @@ nfsd_file_unhash(struct nfsd_file *nf) - { - if (test_and_clear_bit(NFSD_FILE_HASHED, &nf->nf_flags)) { - nfsd_file_do_unhash(nf); -+ if (!list_empty(&nf->nf_lru)) -+ list_lru_del(&nfsd_file_lru, &nf->nf_lru); - return true; - } - return false; -@@ -316,7 +316,9 @@ nfsd_file_put(struct nfsd_file *nf) - - set_bit(NFSD_FILE_REFERENCED, &nf->nf_flags); - if (nfsd_file_put_noref(nf) == 1 && is_hashed && unused) -- nfsd_file_schedule_laundrette(NFSD_FILE_LAUNDRETTE_MAY_FLUSH); -+ nfsd_file_schedule_laundrette(); -+ if (atomic_long_read(&nfsd_filecache_count) >= NFSD_FILE_LRU_LIMIT) -+ nfsd_file_gc(); - } - - struct nfsd_file * -@@ -357,6 +359,58 @@ nfsd_file_dispose_list_sync(struct list_head *dispose) - flush_delayed_fput(); - } - -+static void -+nfsd_file_list_remove_disposal(struct list_head *dst, -+ struct nfsd_fcache_disposal *l) -+{ -+ spin_lock(&l->lock); -+ list_splice_init(&l->freeme, dst); -+ spin_unlock(&l->lock); -+} -+ -+static void -+nfsd_file_list_add_disposal(struct list_head *files, struct net *net) -+{ -+ struct nfsd_fcache_disposal *l; -+ -+ rcu_read_lock(); -+ list_for_each_entry_rcu(l, &laundrettes, list) { -+ if (l->net == net) { -+ spin_lock(&l->lock); -+ list_splice_tail_init(files, &l->freeme); -+ spin_unlock(&l->lock); -+ queue_work(nfsd_filecache_wq, &l->work); -+ break; -+ } -+ } -+ rcu_read_unlock(); -+} -+ -+static void -+nfsd_file_list_add_pernet(struct list_head *dst, struct list_head *src, -+ struct net *net) -+{ -+ struct nfsd_file *nf, *tmp; -+ -+ list_for_each_entry_safe(nf, tmp, src, nf_lru) { -+ if (nf->nf_net == net) -+ list_move_tail(&nf->nf_lru, dst); -+ } -+} -+ -+static void -+nfsd_file_dispose_list_delayed(struct list_head *dispose) -+{ -+ LIST_HEAD(list); -+ struct nfsd_file *nf; -+ -+ while(!list_empty(dispose)) { -+ nf = list_first_entry(dispose, struct nfsd_file, nf_lru); -+ nfsd_file_list_add_pernet(&list, dispose, nf->nf_net); -+ nfsd_file_list_add_disposal(&list, nf->nf_net); -+ } -+} -+ - /* - * Note this can deadlock with nfsd_file_cache_purge. - */ -@@ -403,18 +457,40 @@ out_skip: - return LRU_SKIP; - } - --static void --nfsd_file_lru_dispose(struct list_head *head) -+static unsigned long -+nfsd_file_lru_walk_list(struct shrink_control *sc) - { -- while(!list_empty(head)) { -- struct nfsd_file *nf = list_first_entry(head, -- struct nfsd_file, nf_lru); -- list_del_init(&nf->nf_lru); -+ LIST_HEAD(head); -+ struct nfsd_file *nf; -+ unsigned long ret; -+ -+ if (sc) -+ ret = list_lru_shrink_walk(&nfsd_file_lru, sc, -+ nfsd_file_lru_cb, &head); -+ else -+ ret = list_lru_walk(&nfsd_file_lru, -+ nfsd_file_lru_cb, -+ &head, LONG_MAX); -+ list_for_each_entry(nf, &head, nf_lru) { - spin_lock(&nfsd_file_hashtbl[nf->nf_hashval].nfb_lock); - nfsd_file_do_unhash(nf); - spin_unlock(&nfsd_file_hashtbl[nf->nf_hashval].nfb_lock); -- nfsd_file_put_noref(nf); - } -+ nfsd_file_dispose_list_delayed(&head); -+ return ret; -+} -+ -+static void -+nfsd_file_gc(void) -+{ -+ nfsd_file_lru_walk_list(NULL); -+} -+ -+static void -+nfsd_file_gc_worker(struct work_struct *work) -+{ -+ nfsd_file_gc(); -+ nfsd_file_schedule_laundrette(); - } - - static unsigned long -@@ -426,12 +502,7 @@ nfsd_file_lru_count(struct shrinker *s, struct shrink_control *sc) - static unsigned long - nfsd_file_lru_scan(struct shrinker *s, struct shrink_control *sc) - { -- LIST_HEAD(head); -- unsigned long ret; -- -- ret = list_lru_shrink_walk(&nfsd_file_lru, sc, nfsd_file_lru_cb, &head); -- nfsd_file_lru_dispose(&head); -- return ret; -+ return nfsd_file_lru_walk_list(sc); - } - - static struct shrinker nfsd_file_shrinker = { -@@ -493,7 +564,7 @@ nfsd_file_close_inode(struct inode *inode) - - __nfsd_file_close_inode(inode, hashval, &dispose); - trace_nfsd_file_close_inode(inode, hashval, !list_empty(&dispose)); -- nfsd_file_dispose_list(&dispose); -+ nfsd_file_dispose_list_delayed(&dispose); - } - - /** -@@ -509,16 +580,11 @@ static void - nfsd_file_delayed_close(struct work_struct *work) - { - LIST_HEAD(head); -+ struct nfsd_fcache_disposal *l = container_of(work, -+ struct nfsd_fcache_disposal, work); - -- list_lru_walk(&nfsd_file_lru, nfsd_file_lru_cb, &head, LONG_MAX); -- -- if (test_and_clear_bit(NFSD_FILE_LRU_RESCAN, &nfsd_file_lru_flags)) -- nfsd_file_schedule_laundrette(NFSD_FILE_LAUNDRETTE_NOFLUSH); -- -- if (!list_empty(&head)) { -- nfsd_file_lru_dispose(&head); -- flush_delayed_fput(); -- } -+ nfsd_file_list_remove_disposal(&head, l); -+ nfsd_file_dispose_list(&head); - } - - static int -@@ -579,6 +645,10 @@ nfsd_file_cache_init(void) - if (nfsd_file_hashtbl) - return 0; - -+ nfsd_filecache_wq = alloc_workqueue("nfsd_filecache", 0, 0); -+ if (!nfsd_filecache_wq) -+ goto out; -+ - nfsd_file_hashtbl = kcalloc(NFSD_FILE_HASH_SIZE, - sizeof(*nfsd_file_hashtbl), GFP_KERNEL); - if (!nfsd_file_hashtbl) { -@@ -632,7 +702,7 @@ nfsd_file_cache_init(void) - spin_lock_init(&nfsd_file_hashtbl[i].nfb_lock); - } - -- INIT_DELAYED_WORK(&nfsd_filecache_laundrette, nfsd_file_delayed_close); -+ INIT_DELAYED_WORK(&nfsd_filecache_laundrette, nfsd_file_gc_worker); - out: - return ret; - out_notifier: -@@ -648,6 +718,8 @@ out_err: - nfsd_file_mark_slab = NULL; - kfree(nfsd_file_hashtbl); - nfsd_file_hashtbl = NULL; -+ destroy_workqueue(nfsd_filecache_wq); -+ nfsd_filecache_wq = NULL; - goto out; - } - -@@ -686,6 +758,88 @@ nfsd_file_cache_purge(struct net *net) - } - } - -+static struct nfsd_fcache_disposal * -+nfsd_alloc_fcache_disposal(struct net *net) -+{ -+ struct nfsd_fcache_disposal *l; -+ -+ l = kmalloc(sizeof(*l), GFP_KERNEL); -+ if (!l) -+ return NULL; -+ INIT_WORK(&l->work, nfsd_file_delayed_close); -+ l->net = net; -+ spin_lock_init(&l->lock); -+ INIT_LIST_HEAD(&l->freeme); -+ return l; -+} -+ -+static void -+nfsd_free_fcache_disposal(struct nfsd_fcache_disposal *l) -+{ -+ rcu_assign_pointer(l->net, NULL); -+ cancel_work_sync(&l->work); -+ nfsd_file_dispose_list(&l->freeme); -+ kfree_rcu(l, rcu); -+} -+ -+static void -+nfsd_add_fcache_disposal(struct nfsd_fcache_disposal *l) -+{ -+ spin_lock(&laundrette_lock); -+ list_add_tail_rcu(&l->list, &laundrettes); -+ spin_unlock(&laundrette_lock); -+} -+ -+static void -+nfsd_del_fcache_disposal(struct nfsd_fcache_disposal *l) -+{ -+ spin_lock(&laundrette_lock); -+ list_del_rcu(&l->list); -+ spin_unlock(&laundrette_lock); -+} -+ -+static int -+nfsd_alloc_fcache_disposal_net(struct net *net) -+{ -+ struct nfsd_fcache_disposal *l; -+ -+ l = nfsd_alloc_fcache_disposal(net); -+ if (!l) -+ return -ENOMEM; -+ nfsd_add_fcache_disposal(l); -+ return 0; -+} -+ -+static void -+nfsd_free_fcache_disposal_net(struct net *net) -+{ -+ struct nfsd_fcache_disposal *l; -+ -+ rcu_read_lock(); -+ list_for_each_entry_rcu(l, &laundrettes, list) { -+ if (l->net != net) -+ continue; -+ nfsd_del_fcache_disposal(l); -+ rcu_read_unlock(); -+ nfsd_free_fcache_disposal(l); -+ return; -+ } -+ rcu_read_unlock(); -+} -+ -+int -+nfsd_file_cache_start_net(struct net *net) -+{ -+ return nfsd_alloc_fcache_disposal_net(net); -+} -+ -+void -+nfsd_file_cache_shutdown_net(struct net *net) -+{ -+ nfsd_file_cache_purge(net); -+ nfsd_free_fcache_disposal_net(net); -+} -+ - void - nfsd_file_cache_shutdown(void) - { -@@ -712,6 +866,8 @@ nfsd_file_cache_shutdown(void) - nfsd_file_mark_slab = NULL; - kfree(nfsd_file_hashtbl); - nfsd_file_hashtbl = NULL; -+ destroy_workqueue(nfsd_filecache_wq); -+ nfsd_filecache_wq = NULL; - } - - static bool -@@ -881,7 +1037,8 @@ open_file: - nfsd_file_hashtbl[hashval].nfb_maxcount = max(nfsd_file_hashtbl[hashval].nfb_maxcount, - nfsd_file_hashtbl[hashval].nfb_count); - spin_unlock(&nfsd_file_hashtbl[hashval].nfb_lock); -- atomic_long_inc(&nfsd_filecache_count); -+ if (atomic_long_inc_return(&nfsd_filecache_count) >= NFSD_FILE_LRU_THRESHOLD) -+ nfsd_file_gc(); - - nf->nf_mark = nfsd_file_mark_find_or_create(nf); - if (nf->nf_mark) -diff --git a/fs/nfsd/filecache.h b/fs/nfsd/filecache.h -index 851d9abf54c25..79a7d6808d979 100644 ---- a/fs/nfsd/filecache.h -+++ b/fs/nfsd/filecache.h -@@ -51,6 +51,8 @@ struct nfsd_file { - int nfsd_file_cache_init(void); - void nfsd_file_cache_purge(struct net *); - void nfsd_file_cache_shutdown(void); -+int nfsd_file_cache_start_net(struct net *net); -+void nfsd_file_cache_shutdown_net(struct net *net); - void nfsd_file_put(struct nfsd_file *nf); - struct nfsd_file *nfsd_file_get(struct nfsd_file *nf); - void nfsd_file_close_inode_sync(struct inode *inode); -diff --git a/fs/nfsd/nfssvc.c b/fs/nfsd/nfssvc.c -index 155a4e43b24ee..d63cdda1782d4 100644 ---- a/fs/nfsd/nfssvc.c -+++ b/fs/nfsd/nfssvc.c -@@ -394,13 +394,18 @@ static int nfsd_startup_net(int nrservs, struct net *net, const struct cred *cre - nn->lockd_up = 1; - } - -- ret = nfs4_state_start_net(net); -+ ret = nfsd_file_cache_start_net(net); - if (ret) - goto out_lockd; -+ ret = nfs4_state_start_net(net); -+ if (ret) -+ goto out_filecache; - - nn->nfsd_net_up = true; - return 0; - -+out_filecache: -+ nfsd_file_cache_shutdown_net(net); - out_lockd: - if (nn->lockd_up) { - lockd_down(net); -@@ -415,7 +420,7 @@ static void nfsd_shutdown_net(struct net *net) - { - struct nfsd_net *nn = net_generic(net, nfsd_net_id); - -- nfsd_file_cache_purge(net); -+ nfsd_file_cache_shutdown_net(net); - nfs4_state_shutdown_net(net); - if (nn->lockd_up) { - lockd_down(net); -diff --git a/include/net/esp.h b/include/net/esp.h -index 117652eb6ea32..465e38890ee98 100644 ---- a/include/net/esp.h -+++ b/include/net/esp.h -@@ -4,6 +4,8 @@ - - #include - -+#define ESP_SKB_FRAG_MAXSIZE (PAGE_SIZE << SKB_FRAG_PAGE_ORDER) -+ - struct ip_esp_hdr; - - static inline struct ip_esp_hdr *ip_esp_hdr(const struct sk_buff *skb) -diff --git a/include/net/sock.h b/include/net/sock.h -index 079b5f6f13d81..7f213cfcb3cc6 100644 ---- a/include/net/sock.h -+++ b/include/net/sock.h -@@ -2583,6 +2583,9 @@ extern int sysctl_optmem_max; - extern __u32 sysctl_wmem_default; - extern __u32 sysctl_rmem_default; - -+ -+/* On 32bit arches, an skb frag is limited to 2^15 */ -+#define SKB_FRAG_PAGE_ORDER get_order(32768) - DECLARE_STATIC_KEY_FALSE(net_high_order_alloc_disable_key); - - static inline int sk_get_wmem0(const struct sock *sk, const struct proto *proto) -diff --git a/kernel/rcu/tree_plugin.h b/kernel/rcu/tree_plugin.h -index a71a4a272515d..2c127d438fe0a 100644 ---- a/kernel/rcu/tree_plugin.h -+++ b/kernel/rcu/tree_plugin.h -@@ -523,16 +523,17 @@ rcu_preempt_deferred_qs_irqrestore(struct task_struct *t, unsigned long flags) - raw_spin_unlock_irqrestore_rcu_node(rnp, flags); - } - -- /* Unboost if we were boosted. */ -- if (IS_ENABLED(CONFIG_RCU_BOOST) && drop_boost_mutex) -- rt_mutex_futex_unlock(&rnp->boost_mtx); -- - /* - * If this was the last task on the expedited lists, - * then we need to report up the rcu_node hierarchy. - */ - if (!empty_exp && empty_exp_now) - rcu_report_exp_rnp(rnp, true); -+ -+ /* Unboost if we were boosted. */ -+ if (IS_ENABLED(CONFIG_RCU_BOOST) && drop_boost_mutex) -+ rt_mutex_futex_unlock(&rnp->boost_mtx); -+ - } else { - local_irq_restore(flags); - } -diff --git a/net/core/sock.c b/net/core/sock.c -index 57b7a10703c36..c84f68bff7f58 100644 ---- a/net/core/sock.c -+++ b/net/core/sock.c -@@ -2355,8 +2355,6 @@ static void sk_leave_memory_pressure(struct sock *sk) - } - } - --/* On 32bit arches, an skb frag is limited to 2^15 */ --#define SKB_FRAG_PAGE_ORDER get_order(32768) - DEFINE_STATIC_KEY_FALSE(net_high_order_alloc_disable_key); - - /** -diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c -index 00210e55b4cd1..ef20f550d2f81 100644 ---- a/net/ipv4/esp4.c -+++ b/net/ipv4/esp4.c -@@ -277,6 +277,7 @@ int esp_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info * - struct page *page; - struct sk_buff *trailer; - int tailen = esp->tailen; -+ unsigned int allocsz; - - /* this is non-NULL only with UDP Encapsulation */ - if (x->encap) { -@@ -286,6 +287,10 @@ int esp_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info * - return err; - } - -+ allocsz = ALIGN(skb->data_len + tailen, L1_CACHE_BYTES); -+ if (allocsz > ESP_SKB_FRAG_MAXSIZE) -+ goto cow; -+ - if (!skb_cloned(skb)) { - if (tailen <= skb_tailroom(skb)) { - nfrags = 1; -diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c -index 7a739f16d82b2..79f117e33b80e 100644 ---- a/net/ipv6/esp6.c -+++ b/net/ipv6/esp6.c -@@ -230,6 +230,11 @@ int esp6_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info - struct page *page; - struct sk_buff *trailer; - int tailen = esp->tailen; -+ unsigned int allocsz; -+ -+ allocsz = ALIGN(skb->data_len + tailen, L1_CACHE_BYTES); -+ if (allocsz > ESP_SKB_FRAG_MAXSIZE) -+ goto cow; - - if (!skb_cloned(skb)) { - if (tailen <= skb_tailroom(skb)) { -diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c -index 918a9520d1f17..3606796009572 100644 ---- a/net/ipv6/ip6_output.c -+++ b/net/ipv6/ip6_output.c -@@ -1429,8 +1429,8 @@ static int __ip6_append_data(struct sock *sk, - sizeof(struct frag_hdr) : 0) + - rt->rt6i_nfheader_len; - -- if (mtu < fragheaderlen || -- ((mtu - fragheaderlen) & ~7) + fragheaderlen < sizeof(struct frag_hdr)) -+ if (mtu <= fragheaderlen || -+ ((mtu - fragheaderlen) & ~7) + fragheaderlen <= sizeof(struct frag_hdr)) - goto emsgsize; - - maxfraglen = ((mtu - fragheaderlen) & ~7) + fragheaderlen - -diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c -index 0b3adf7594ffe..3b1ea89a340e3 100644 ---- a/net/llc/af_llc.c -+++ b/net/llc/af_llc.c -@@ -276,6 +276,7 @@ static int llc_ui_autobind(struct socket *sock, struct sockaddr_llc *addr) - { - struct sock *sk = sock->sk; - struct llc_sock *llc = llc_sk(sk); -+ struct net_device *dev = NULL; - struct llc_sap *sap; - int rc = -EINVAL; - -@@ -287,14 +288,14 @@ static int llc_ui_autobind(struct socket *sock, struct sockaddr_llc *addr) - goto out; - rc = -ENODEV; - if (sk->sk_bound_dev_if) { -- llc->dev = dev_get_by_index(&init_net, sk->sk_bound_dev_if); -- if (llc->dev && addr->sllc_arphrd != llc->dev->type) { -- dev_put(llc->dev); -- llc->dev = NULL; -+ dev = dev_get_by_index(&init_net, sk->sk_bound_dev_if); -+ if (dev && addr->sllc_arphrd != dev->type) { -+ dev_put(dev); -+ dev = NULL; - } - } else -- llc->dev = dev_getfirstbyhwtype(&init_net, addr->sllc_arphrd); -- if (!llc->dev) -+ dev = dev_getfirstbyhwtype(&init_net, addr->sllc_arphrd); -+ if (!dev) - goto out; - rc = -EUSERS; - llc->laddr.lsap = llc_ui_autoport(); -@@ -304,6 +305,11 @@ static int llc_ui_autobind(struct socket *sock, struct sockaddr_llc *addr) - sap = llc_sap_open(llc->laddr.lsap, NULL); - if (!sap) - goto out; -+ -+ /* Note: We do not expect errors from this point. */ -+ llc->dev = dev; -+ dev = NULL; -+ - memcpy(llc->laddr.mac, llc->dev->dev_addr, IFHWADDRLEN); - memcpy(&llc->addr, addr, sizeof(llc->addr)); - /* assign new connection to its SAP */ -@@ -311,6 +317,7 @@ static int llc_ui_autobind(struct socket *sock, struct sockaddr_llc *addr) - sock_reset_flag(sk, SOCK_ZAPPED); - rc = 0; - out: -+ dev_put(dev); - return rc; - } - -@@ -333,6 +340,7 @@ static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen) - struct sockaddr_llc *addr = (struct sockaddr_llc *)uaddr; - struct sock *sk = sock->sk; - struct llc_sock *llc = llc_sk(sk); -+ struct net_device *dev = NULL; - struct llc_sap *sap; - int rc = -EINVAL; - -@@ -348,25 +356,26 @@ static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen) - rc = -ENODEV; - rcu_read_lock(); - if (sk->sk_bound_dev_if) { -- llc->dev = dev_get_by_index_rcu(&init_net, sk->sk_bound_dev_if); -- if (llc->dev) { -+ dev = dev_get_by_index_rcu(&init_net, sk->sk_bound_dev_if); -+ if (dev) { - if (is_zero_ether_addr(addr->sllc_mac)) -- memcpy(addr->sllc_mac, llc->dev->dev_addr, -+ memcpy(addr->sllc_mac, dev->dev_addr, - IFHWADDRLEN); -- if (addr->sllc_arphrd != llc->dev->type || -+ if (addr->sllc_arphrd != dev->type || - !ether_addr_equal(addr->sllc_mac, -- llc->dev->dev_addr)) { -+ dev->dev_addr)) { - rc = -EINVAL; -- llc->dev = NULL; -+ dev = NULL; - } - } -- } else -- llc->dev = dev_getbyhwaddr_rcu(&init_net, addr->sllc_arphrd, -+ } else { -+ dev = dev_getbyhwaddr_rcu(&init_net, addr->sllc_arphrd, - addr->sllc_mac); -- if (llc->dev) -- dev_hold(llc->dev); -+ } -+ if (dev) -+ dev_hold(dev); - rcu_read_unlock(); -- if (!llc->dev) -+ if (!dev) - goto out; - if (!addr->sllc_sap) { - rc = -EUSERS; -@@ -399,6 +408,11 @@ static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen) - goto out_put; - } - } -+ -+ /* Note: We do not expect errors from this point. */ -+ llc->dev = dev; -+ dev = NULL; -+ - llc->laddr.lsap = addr->sllc_sap; - memcpy(llc->laddr.mac, addr->sllc_mac, IFHWADDRLEN); - memcpy(&llc->addr, addr, sizeof(llc->addr)); -@@ -409,6 +423,7 @@ static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen) - out_put: - llc_sap_put(sap); - out: -+ dev_put(dev); - release_sock(sk); - return rc; - } -diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c -index 1b50bbf030ed8..16f37fd0ac0e5 100644 ---- a/net/mac80211/cfg.c -+++ b/net/mac80211/cfg.c -@@ -1949,13 +1949,11 @@ static int copy_mesh_setup(struct ieee80211_if_mesh *ifmsh, - const struct mesh_setup *setup) - { - u8 *new_ie; -- const u8 *old_ie; - struct ieee80211_sub_if_data *sdata = container_of(ifmsh, - struct ieee80211_sub_if_data, u.mesh); - - /* allocate information elements */ - new_ie = NULL; -- old_ie = ifmsh->ie; - - if (setup->ie_len) { - new_ie = kmemdup(setup->ie, setup->ie_len, -@@ -1965,7 +1963,6 @@ static int copy_mesh_setup(struct ieee80211_if_mesh *ifmsh, - } - ifmsh->ie_len = setup->ie_len; - ifmsh->ie = new_ie; -- kfree(old_ie); - - /* now copy the rest of the setup parameters */ - ifmsh->mesh_id_len = setup->mesh_id_len; -diff --git a/net/netfilter/nf_tables_core.c b/net/netfilter/nf_tables_core.c -index 96c74c4c71762..ceb0ef437e23e 100644 ---- a/net/netfilter/nf_tables_core.c -+++ b/net/netfilter/nf_tables_core.c -@@ -153,7 +153,7 @@ nft_do_chain(struct nft_pktinfo *pkt, void *priv) - struct nft_rule *const *rules; - const struct nft_rule *rule; - const struct nft_expr *expr, *last; -- struct nft_regs regs; -+ struct nft_regs regs = {}; - unsigned int stackptr = 0; - struct nft_jumpstack jumpstack[NFT_JUMP_STACK_SIZE]; - bool genbit = READ_ONCE(net->nft.gencursor); -diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c -index 841c0a12cc929..ad4e0af2d0d03 100644 ---- a/sound/core/oss/pcm_oss.c -+++ b/sound/core/oss/pcm_oss.c -@@ -774,6 +774,11 @@ static int snd_pcm_oss_period_size(struct snd_pcm_substream *substream, - - if (oss_period_size < 16) - return -EINVAL; -+ -+ /* don't allocate too large period; 1MB period must be enough */ -+ if (oss_period_size > 1024 * 1024) -+ return -ENOMEM; -+ - runtime->oss.period_bytes = oss_period_size; - runtime->oss.period_frames = 1; - runtime->oss.periods = oss_periods; -@@ -1045,10 +1050,9 @@ static int snd_pcm_oss_change_params_locked(struct snd_pcm_substream *substream) - goto failure; - } - #endif -- oss_period_size *= oss_frame_size; -- -- oss_buffer_size = oss_period_size * runtime->oss.periods; -- if (oss_buffer_size < 0) { -+ oss_period_size = array_size(oss_period_size, oss_frame_size); -+ oss_buffer_size = array_size(oss_period_size, runtime->oss.periods); -+ if (oss_buffer_size <= 0) { - err = -EINVAL; - goto failure; - } -diff --git a/sound/core/oss/pcm_plugin.c b/sound/core/oss/pcm_plugin.c -index da400da1fafe6..8b7bbabeea24b 100644 ---- a/sound/core/oss/pcm_plugin.c -+++ b/sound/core/oss/pcm_plugin.c -@@ -61,7 +61,10 @@ static int snd_pcm_plugin_alloc(struct snd_pcm_plugin *plugin, snd_pcm_uframes_t - } - if ((width = snd_pcm_format_physical_width(format->format)) < 0) - return width; -- size = frames * format->channels * width; -+ size = array3_size(frames, format->channels, width); -+ /* check for too large period size once again */ -+ if (size > 1024 * 1024) -+ return -ENOMEM; - if (snd_BUG_ON(size % 8)) - return -ENXIO; - size /= 8; -diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c -index 0c5b7a54ca81c..dbe9a65cc1d45 100644 ---- a/sound/core/pcm_native.c -+++ b/sound/core/pcm_native.c -@@ -1656,21 +1656,25 @@ static int snd_pcm_do_reset(struct snd_pcm_substream *substream, int state) - int err = substream->ops->ioctl(substream, SNDRV_PCM_IOCTL1_RESET, NULL); - if (err < 0) - return err; -+ snd_pcm_stream_lock_irq(substream); - runtime->hw_ptr_base = 0; - runtime->hw_ptr_interrupt = runtime->status->hw_ptr - - runtime->status->hw_ptr % runtime->period_size; - runtime->silence_start = runtime->status->hw_ptr; - runtime->silence_filled = 0; -+ snd_pcm_stream_unlock_irq(substream); - return 0; - } - - static void snd_pcm_post_reset(struct snd_pcm_substream *substream, int state) - { - struct snd_pcm_runtime *runtime = substream->runtime; -+ snd_pcm_stream_lock_irq(substream); - runtime->control->appl_ptr = runtime->status->hw_ptr; - if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK && - runtime->silence_size > 0) - snd_pcm_playback_silence(substream, ULONG_MAX); -+ snd_pcm_stream_unlock_irq(substream); - } - - static const struct action_ops snd_pcm_action_reset = { -diff --git a/sound/pci/ac97/ac97_codec.c b/sound/pci/ac97/ac97_codec.c -index 66f6c3bf08e31..6fb192a94762f 100644 ---- a/sound/pci/ac97/ac97_codec.c -+++ b/sound/pci/ac97/ac97_codec.c -@@ -938,8 +938,8 @@ static int snd_ac97_ad18xx_pcm_get_volume(struct snd_kcontrol *kcontrol, struct - int codec = kcontrol->private_value & 3; - - mutex_lock(&ac97->page_mutex); -- ucontrol->value.integer.value[0] = 31 - ((ac97->spec.ad18xx.pcmreg[codec] >> 0) & 31); -- ucontrol->value.integer.value[1] = 31 - ((ac97->spec.ad18xx.pcmreg[codec] >> 8) & 31); -+ ucontrol->value.integer.value[0] = 31 - ((ac97->spec.ad18xx.pcmreg[codec] >> 8) & 31); -+ ucontrol->value.integer.value[1] = 31 - ((ac97->spec.ad18xx.pcmreg[codec] >> 0) & 31); - mutex_unlock(&ac97->page_mutex); - return 0; - } -diff --git a/sound/pci/cmipci.c b/sound/pci/cmipci.c -index df720881eb991..db9d89ba36587 100644 ---- a/sound/pci/cmipci.c -+++ b/sound/pci/cmipci.c -@@ -302,7 +302,6 @@ MODULE_PARM_DESC(joystick_port, "Joystick port address."); - #define CM_MICGAINZ 0x01 /* mic boost */ - #define CM_MICGAINZ_SHIFT 0 - --#define CM_REG_MIXER3 0x24 - #define CM_REG_AUX_VOL 0x26 - #define CM_VAUXL_MASK 0xf0 - #define CM_VAUXR_MASK 0x0f -@@ -3310,7 +3309,7 @@ static void snd_cmipci_remove(struct pci_dev *pci) - */ - static unsigned char saved_regs[] = { - CM_REG_FUNCTRL1, CM_REG_CHFORMAT, CM_REG_LEGACY_CTRL, CM_REG_MISC_CTRL, -- CM_REG_MIXER0, CM_REG_MIXER1, CM_REG_MIXER2, CM_REG_MIXER3, CM_REG_PLL, -+ CM_REG_MIXER0, CM_REG_MIXER1, CM_REG_MIXER2, CM_REG_AUX_VOL, CM_REG_PLL, - CM_REG_CH0_FRAME1, CM_REG_CH0_FRAME2, - CM_REG_CH1_FRAME1, CM_REG_CH1_FRAME2, CM_REG_EXT_MISC, - CM_REG_INT_STATUS, CM_REG_INT_HLDCLR, CM_REG_FUNCTRL0, -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index c03448ea8a203..d201043d661c1 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -8183,6 +8183,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x1043, 0x1e51, "ASUS Zephyrus M15", ALC294_FIXUP_ASUS_GU502_PINS), - SND_PCI_QUIRK(0x1043, 0x1e8e, "ASUS Zephyrus G15", ALC289_FIXUP_ASUS_GA401), - SND_PCI_QUIRK(0x1043, 0x1f11, "ASUS Zephyrus G14", ALC289_FIXUP_ASUS_GA401), -+ SND_PCI_QUIRK(0x1043, 0x1d42, "ASUS Zephyrus G14 2022", ALC289_FIXUP_ASUS_GA401), - SND_PCI_QUIRK(0x1043, 0x16b2, "ASUS GU603", ALC289_FIXUP_ASUS_GA401), - SND_PCI_QUIRK(0x1043, 0x3030, "ASUS ZN270IE", ALC256_FIXUP_ASUS_AIO_GPIO2), - SND_PCI_QUIRK(0x1043, 0x831a, "ASUS P901", ALC269_FIXUP_STEREO_DMIC), -@@ -10201,6 +10202,7 @@ static const struct snd_pci_quirk alc662_fixup_tbl[] = { - SND_PCI_QUIRK(0x1028, 0x069f, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE), - SND_PCI_QUIRK(0x103c, 0x1632, "HP RP5800", ALC662_FIXUP_HP_RP5800), - SND_PCI_QUIRK(0x103c, 0x873e, "HP", ALC671_FIXUP_HP_HEADSET_MIC2), -+ SND_PCI_QUIRK(0x103c, 0x885f, "HP 288 Pro G8", ALC671_FIXUP_HP_HEADSET_MIC2), - SND_PCI_QUIRK(0x1043, 0x1080, "Asus UX501VW", ALC668_FIXUP_HEADSET_MODE), - SND_PCI_QUIRK(0x1043, 0x11cd, "Asus N550", ALC662_FIXUP_ASUS_Nx50), - SND_PCI_QUIRK(0x1043, 0x129d, "Asus N750", ALC662_FIXUP_ASUS_Nx50), -diff --git a/sound/soc/sti/uniperif_player.c b/sound/soc/sti/uniperif_player.c -index 2ed92c990b97c..dd9013c476649 100644 ---- a/sound/soc/sti/uniperif_player.c -+++ b/sound/soc/sti/uniperif_player.c -@@ -91,7 +91,7 @@ static irqreturn_t uni_player_irq_handler(int irq, void *dev_id) - SET_UNIPERIF_ITM_BCLR_FIFO_ERROR(player); - - /* Stop the player */ -- snd_pcm_stop_xrun(player->substream); -+ snd_pcm_stop(player->substream, SNDRV_PCM_STATE_XRUN); - } - - ret = IRQ_HANDLED; -@@ -105,7 +105,7 @@ static irqreturn_t uni_player_irq_handler(int irq, void *dev_id) - SET_UNIPERIF_ITM_BCLR_DMA_ERROR(player); - - /* Stop the player */ -- snd_pcm_stop_xrun(player->substream); -+ snd_pcm_stop(player->substream, SNDRV_PCM_STATE_XRUN); - - ret = IRQ_HANDLED; - } -@@ -138,7 +138,7 @@ static irqreturn_t uni_player_irq_handler(int irq, void *dev_id) - dev_err(player->dev, "Underflow recovery failed\n"); - - /* Stop the player */ -- snd_pcm_stop_xrun(player->substream); -+ snd_pcm_stop(player->substream, SNDRV_PCM_STATE_XRUN); - - ret = IRQ_HANDLED; - } -diff --git a/sound/soc/sti/uniperif_reader.c b/sound/soc/sti/uniperif_reader.c -index 136059331211d..065c5f0d1f5f0 100644 ---- a/sound/soc/sti/uniperif_reader.c -+++ b/sound/soc/sti/uniperif_reader.c -@@ -65,7 +65,7 @@ static irqreturn_t uni_reader_irq_handler(int irq, void *dev_id) - if (unlikely(status & UNIPERIF_ITS_FIFO_ERROR_MASK(reader))) { - dev_err(reader->dev, "FIFO error detected\n"); - -- snd_pcm_stop_xrun(reader->substream); -+ snd_pcm_stop(reader->substream, SNDRV_PCM_STATE_XRUN); - - ret = IRQ_HANDLED; - } -diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c -index d926869c031b1..1f7c80541d03b 100644 ---- a/sound/usb/mixer_quirks.c -+++ b/sound/usb/mixer_quirks.c -@@ -2370,9 +2370,10 @@ void snd_usb_mixer_fu_apply_quirk(struct usb_mixer_interface *mixer, - if (unitid == 7 && cval->control == UAC_FU_VOLUME) - snd_dragonfly_quirk_db_scale(mixer, cval, kctl); - break; -- /* lowest playback value is muted on C-Media devices */ -- case USB_ID(0x0d8c, 0x000c): -- case USB_ID(0x0d8c, 0x0014): -+ /* lowest playback value is muted on some devices */ -+ case USB_ID(0x0d8c, 0x000c): /* C-Media */ -+ case USB_ID(0x0d8c, 0x0014): /* C-Media */ -+ case USB_ID(0x19f7, 0x0003): /* RODE NT-USB */ - if (strstr(kctl->id.name, "Playback")) - cval->min_mute = 1; - break; diff --git a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.188-189.patch b/patch/kernel/archive/odroidxu4-5.4/patch-5.4.188-189.patch deleted file mode 100644 index fb36f2cec..000000000 --- a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.188-189.patch +++ /dev/null @@ -1,14679 +0,0 @@ -diff --git a/Documentation/DMA-attributes.txt b/Documentation/DMA-attributes.txt -index 8f8d97f65d737..7193505a98cab 100644 ---- a/Documentation/DMA-attributes.txt -+++ b/Documentation/DMA-attributes.txt -@@ -156,3 +156,13 @@ accesses to DMA buffers in both privileged "supervisor" and unprivileged - subsystem that the buffer is fully accessible at the elevated privilege - level (and ideally inaccessible or at least read-only at the - lesser-privileged levels). -+ -+DMA_ATTR_PRIVILEGED -+------------------- -+ -+Some advanced peripherals such as remote processors and GPUs perform -+accesses to DMA buffers in both privileged "supervisor" and unprivileged -+"user" modes. This attribute is used to indicate to the DMA-mapping -+subsystem that the buffer is fully accessible at the elevated privilege -+level (and ideally inaccessible or at least read-only at the -+lesser-privileged levels). -diff --git a/Documentation/devicetree/bindings/mtd/nand-controller.yaml b/Documentation/devicetree/bindings/mtd/nand-controller.yaml -index d261b7096c696..2767f182fd3c5 100644 ---- a/Documentation/devicetree/bindings/mtd/nand-controller.yaml -+++ b/Documentation/devicetree/bindings/mtd/nand-controller.yaml -@@ -44,7 +44,7 @@ patternProperties: - properties: - reg: - description: -- Contains the native Ready/Busy IDs. -+ Contains the chip-select IDs. - - nand-ecc-mode: - allOf: -@@ -139,6 +139,6 @@ examples: - nand-ecc-mode = "soft"; - nand-ecc-algo = "bch"; - -- /* controller specific properties */ -+ /* NAND chip specific properties */ - }; - }; -diff --git a/Documentation/devicetree/bindings/spi/spi-mxic.txt b/Documentation/devicetree/bindings/spi/spi-mxic.txt -index 529f2dab2648a..7bcbb229b78bb 100644 ---- a/Documentation/devicetree/bindings/spi/spi-mxic.txt -+++ b/Documentation/devicetree/bindings/spi/spi-mxic.txt -@@ -8,11 +8,13 @@ Required properties: - - reg: should contain 2 entries, one for the registers and one for the direct - mapping area - - reg-names: should contain "regs" and "dirmap" --- interrupts: interrupt line connected to the SPI controller - - clock-names: should contain "ps_clk", "send_clk" and "send_dly_clk" - - clocks: should contain 3 entries for the "ps_clk", "send_clk" and - "send_dly_clk" clocks - -+Optional properties: -+- interrupts: interrupt line connected to the SPI controller -+ - Example: - - spi@43c30000 { -diff --git a/Documentation/process/stable-kernel-rules.rst b/Documentation/process/stable-kernel-rules.rst -index 06f743b612c48..bb53707f72cc5 100644 ---- a/Documentation/process/stable-kernel-rules.rst -+++ b/Documentation/process/stable-kernel-rules.rst -@@ -174,7 +174,16 @@ Trees - - The finalized and tagged releases of all stable kernels can be found - in separate branches per version at: - -- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git -+ https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git -+ -+ - The release candidate of all stable kernel versions can be found at: -+ -+ https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git/ -+ -+ .. warning:: -+ The -stable-rc tree is a snapshot in time of the stable-queue tree and -+ will change frequently, hence will be rebased often. It should only be -+ used for testing purposes (e.g. to be consumed by CI systems). - - - Review committee -diff --git a/Documentation/sound/hd-audio/models.rst b/Documentation/sound/hd-audio/models.rst -index 0ea967d345838..4c91abad7b35c 100644 ---- a/Documentation/sound/hd-audio/models.rst -+++ b/Documentation/sound/hd-audio/models.rst -@@ -261,6 +261,10 @@ alc-sense-combo - huawei-mbx-stereo - Enable initialization verbs for Huawei MBX stereo speakers; - might be risky, try this at your own risk -+alc298-samsung-headphone -+ Samsung laptops with ALC298 -+alc256-samsung-headphone -+ Samsung laptops with ALC256 - - ALC66x/67x/892 - ============== -diff --git a/Makefile b/Makefile -index 8684857148066..cbb71900d3dcf 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 5 - PATCHLEVEL = 4 --SUBLEVEL = 188 -+SUBLEVEL = 189 - EXTRAVERSION = - NAME = Kleptomaniac Octopus - -diff --git a/arch/arm/boot/dts/bcm2837.dtsi b/arch/arm/boot/dts/bcm2837.dtsi -index beb6c502dadc7..bcad098a7fccb 100644 ---- a/arch/arm/boot/dts/bcm2837.dtsi -+++ b/arch/arm/boot/dts/bcm2837.dtsi -@@ -38,12 +38,26 @@ - #size-cells = <0>; - enable-method = "brcm,bcm2836-smp"; // for ARM 32-bit - -+ /* Source for d/i-cache-line-size and d/i-cache-sets -+ * https://developer.arm.com/documentation/ddi0500/e/level-1-memory-system -+ * /about-the-l1-memory-system?lang=en -+ * -+ * Source for d/i-cache-size -+ * https://magpi.raspberrypi.com/articles/raspberry-pi-3-specs-benchmarks -+ */ - cpu0: cpu@0 { - device_type = "cpu"; - compatible = "arm,cortex-a53"; - reg = <0>; - enable-method = "spin-table"; - cpu-release-addr = <0x0 0x000000d8>; -+ d-cache-size = <0x8000>; -+ d-cache-line-size = <64>; -+ d-cache-sets = <128>; // 32KiB(size)/64(line-size)=512ways/4-way set -+ i-cache-size = <0x8000>; -+ i-cache-line-size = <64>; -+ i-cache-sets = <256>; // 32KiB(size)/64(line-size)=512ways/2-way set -+ next-level-cache = <&l2>; - }; - - cpu1: cpu@1 { -@@ -52,6 +66,13 @@ - reg = <1>; - enable-method = "spin-table"; - cpu-release-addr = <0x0 0x000000e0>; -+ d-cache-size = <0x8000>; -+ d-cache-line-size = <64>; -+ d-cache-sets = <128>; // 32KiB(size)/64(line-size)=512ways/4-way set -+ i-cache-size = <0x8000>; -+ i-cache-line-size = <64>; -+ i-cache-sets = <256>; // 32KiB(size)/64(line-size)=512ways/2-way set -+ next-level-cache = <&l2>; - }; - - cpu2: cpu@2 { -@@ -60,6 +81,13 @@ - reg = <2>; - enable-method = "spin-table"; - cpu-release-addr = <0x0 0x000000e8>; -+ d-cache-size = <0x8000>; -+ d-cache-line-size = <64>; -+ d-cache-sets = <128>; // 32KiB(size)/64(line-size)=512ways/4-way set -+ i-cache-size = <0x8000>; -+ i-cache-line-size = <64>; -+ i-cache-sets = <256>; // 32KiB(size)/64(line-size)=512ways/2-way set -+ next-level-cache = <&l2>; - }; - - cpu3: cpu@3 { -@@ -68,6 +96,27 @@ - reg = <3>; - enable-method = "spin-table"; - cpu-release-addr = <0x0 0x000000f0>; -+ d-cache-size = <0x8000>; -+ d-cache-line-size = <64>; -+ d-cache-sets = <128>; // 32KiB(size)/64(line-size)=512ways/4-way set -+ i-cache-size = <0x8000>; -+ i-cache-line-size = <64>; -+ i-cache-sets = <256>; // 32KiB(size)/64(line-size)=512ways/2-way set -+ next-level-cache = <&l2>; -+ }; -+ -+ /* Source for cache-line-size + cache-sets -+ * https://developer.arm.com/documentation/ddi0500 -+ * /e/level-2-memory-system/about-the-l2-memory-system?lang=en -+ * Source for cache-size -+ * https://datasheets.raspberrypi.com/cm/cm1-and-cm3-datasheet.pdf -+ */ -+ l2: l2-cache0 { -+ compatible = "cache"; -+ cache-size = <0x80000>; -+ cache-line-size = <64>; -+ cache-sets = <512>; // 512KiB(size)/64(line-size)=8192ways/16-way set -+ cache-level = <2>; - }; - }; - }; -diff --git a/arch/arm/boot/dts/exynos5250-pinctrl.dtsi b/arch/arm/boot/dts/exynos5250-pinctrl.dtsi -index d31a68672bfac..d7d756614edd1 100644 ---- a/arch/arm/boot/dts/exynos5250-pinctrl.dtsi -+++ b/arch/arm/boot/dts/exynos5250-pinctrl.dtsi -@@ -260,7 +260,7 @@ - }; - - uart3_data: uart3-data { -- samsung,pins = "gpa1-4", "gpa1-4"; -+ samsung,pins = "gpa1-4", "gpa1-5"; - samsung,pin-function = ; - samsung,pin-pud = ; - samsung,pin-drv = ; -diff --git a/arch/arm/boot/dts/exynos5250-smdk5250.dts b/arch/arm/boot/dts/exynos5250-smdk5250.dts -index 70a2b6e2ad3fa..fa5dd992e3273 100644 ---- a/arch/arm/boot/dts/exynos5250-smdk5250.dts -+++ b/arch/arm/boot/dts/exynos5250-smdk5250.dts -@@ -117,6 +117,9 @@ - status = "okay"; - ddc = <&i2c_2>; - hpd-gpios = <&gpx3 7 GPIO_ACTIVE_HIGH>; -+ vdd-supply = <&ldo8_reg>; -+ vdd_osc-supply = <&ldo10_reg>; -+ vdd_pll-supply = <&ldo8_reg>; - }; - - &i2c_0 { -diff --git a/arch/arm/boot/dts/exynos5420-smdk5420.dts b/arch/arm/boot/dts/exynos5420-smdk5420.dts -index 8240e51869729..fb92d87d8dedc 100644 ---- a/arch/arm/boot/dts/exynos5420-smdk5420.dts -+++ b/arch/arm/boot/dts/exynos5420-smdk5420.dts -@@ -132,6 +132,9 @@ - hpd-gpios = <&gpx3 7 GPIO_ACTIVE_HIGH>; - pinctrl-names = "default"; - pinctrl-0 = <&hdmi_hpd_irq>; -+ vdd-supply = <&ldo6_reg>; -+ vdd_osc-supply = <&ldo7_reg>; -+ vdd_pll-supply = <&ldo6_reg>; - }; - - &hsi2c_4 { -diff --git a/arch/arm/boot/dts/imx53-m53menlo.dts b/arch/arm/boot/dts/imx53-m53menlo.dts -index 03c43c1912a7e..d002c8f738b53 100644 ---- a/arch/arm/boot/dts/imx53-m53menlo.dts -+++ b/arch/arm/boot/dts/imx53-m53menlo.dts -@@ -53,6 +53,31 @@ - }; - }; - -+ lvds-decoder { -+ compatible = "ti,ds90cf364a", "lvds-decoder"; -+ -+ ports { -+ #address-cells = <1>; -+ #size-cells = <0>; -+ -+ port@0 { -+ reg = <0>; -+ -+ lvds_decoder_in: endpoint { -+ remote-endpoint = <&lvds0_out>; -+ }; -+ }; -+ -+ port@1 { -+ reg = <1>; -+ -+ lvds_decoder_out: endpoint { -+ remote-endpoint = <&panel_in>; -+ }; -+ }; -+ }; -+ }; -+ - panel { - compatible = "edt,etm0700g0dh6"; - pinctrl-0 = <&pinctrl_display_gpio>; -@@ -61,7 +86,7 @@ - - port { - panel_in: endpoint { -- remote-endpoint = <&lvds0_out>; -+ remote-endpoint = <&lvds_decoder_out>; - }; - }; - }; -@@ -450,7 +475,7 @@ - reg = <2>; - - lvds0_out: endpoint { -- remote-endpoint = <&panel_in>; -+ remote-endpoint = <&lvds_decoder_in>; - }; - }; - }; -diff --git a/arch/arm/boot/dts/qcom-ipq4019.dtsi b/arch/arm/boot/dts/qcom-ipq4019.dtsi -index 56f51599852d0..338256c59ca5a 100644 ---- a/arch/arm/boot/dts/qcom-ipq4019.dtsi -+++ b/arch/arm/boot/dts/qcom-ipq4019.dtsi -@@ -141,7 +141,8 @@ - clocks { - sleep_clk: sleep_clk { - compatible = "fixed-clock"; -- clock-frequency = <32768>; -+ clock-frequency = <32000>; -+ clock-output-names = "gcc_sleep_clk_src"; - #clock-cells = <0>; - }; - -diff --git a/arch/arm/boot/dts/qcom-msm8960.dtsi b/arch/arm/boot/dts/qcom-msm8960.dtsi -index f2aeaccdc1ad6..15ff0e8fd0d30 100644 ---- a/arch/arm/boot/dts/qcom-msm8960.dtsi -+++ b/arch/arm/boot/dts/qcom-msm8960.dtsi -@@ -145,7 +145,9 @@ - reg = <0x108000 0x1000>; - qcom,ipc = <&l2cc 0x8 2>; - -- interrupts = <0 19 0>, <0 21 0>, <0 22 0>; -+ interrupts = , -+ , -+ ; - interrupt-names = "ack", "err", "wakeup"; - - regulators { -@@ -191,7 +193,7 @@ - compatible = "qcom,msm-uartdm-v1.3", "qcom,msm-uartdm"; - reg = <0x16440000 0x1000>, - <0x16400000 0x1000>; -- interrupts = <0 154 0x0>; -+ interrupts = ; - clocks = <&gcc GSBI5_UART_CLK>, <&gcc GSBI5_H_CLK>; - clock-names = "core", "iface"; - status = "disabled"; -@@ -317,7 +319,7 @@ - #address-cells = <1>; - #size-cells = <0>; - reg = <0x16080000 0x1000>; -- interrupts = <0 147 0>; -+ interrupts = ; - spi-max-frequency = <24000000>; - cs-gpios = <&msmgpio 8 0>; - -diff --git a/arch/arm/boot/dts/sama5d2.dtsi b/arch/arm/boot/dts/sama5d2.dtsi -index b05bab57f90a3..09816a2ee3670 100644 ---- a/arch/arm/boot/dts/sama5d2.dtsi -+++ b/arch/arm/boot/dts/sama5d2.dtsi -@@ -526,7 +526,7 @@ - pmecc: ecc-engine@f8014070 { - compatible = "atmel,sama5d2-pmecc"; - reg = <0xf8014070 0x490>, -- <0xf8014500 0x100>; -+ <0xf8014500 0x200>; - }; - }; - -diff --git a/arch/arm/boot/dts/spear1340.dtsi b/arch/arm/boot/dts/spear1340.dtsi -index 1a8f5e8b10e3a..66cd473ecb617 100644 ---- a/arch/arm/boot/dts/spear1340.dtsi -+++ b/arch/arm/boot/dts/spear1340.dtsi -@@ -136,9 +136,9 @@ - reg = <0xb4100000 0x1000>; - interrupts = <0 105 0x4>; - status = "disabled"; -- dmas = <&dwdma0 12 0 1>, -- <&dwdma0 13 1 0>; -- dma-names = "tx", "rx"; -+ dmas = <&dwdma0 13 0 1>, -+ <&dwdma0 12 1 0>; -+ dma-names = "rx", "tx"; - }; - - thermal@e07008c4 { -diff --git a/arch/arm/boot/dts/spear13xx.dtsi b/arch/arm/boot/dts/spear13xx.dtsi -index f187da4485f46..78672db9068be 100644 ---- a/arch/arm/boot/dts/spear13xx.dtsi -+++ b/arch/arm/boot/dts/spear13xx.dtsi -@@ -284,9 +284,9 @@ - #size-cells = <0>; - interrupts = <0 31 0x4>; - status = "disabled"; -- dmas = <&dwdma0 4 0 0>, -- <&dwdma0 5 0 0>; -- dma-names = "tx", "rx"; -+ dmas = <&dwdma0 5 0 0>, -+ <&dwdma0 4 0 0>; -+ dma-names = "rx", "tx"; - }; - - rtc@e0580000 { -diff --git a/arch/arm/boot/dts/tegra20-tamonten.dtsi b/arch/arm/boot/dts/tegra20-tamonten.dtsi -index 394a6b4dc69d5..69cb65d86c467 100644 ---- a/arch/arm/boot/dts/tegra20-tamonten.dtsi -+++ b/arch/arm/boot/dts/tegra20-tamonten.dtsi -@@ -183,8 +183,8 @@ - }; - conf_ata { - nvidia,pins = "ata", "atb", "atc", "atd", "ate", -- "cdev1", "cdev2", "dap1", "dtb", "gma", -- "gmb", "gmc", "gmd", "gme", "gpu7", -+ "cdev1", "cdev2", "dap1", "dtb", "dtf", -+ "gma", "gmb", "gmc", "gmd", "gme", "gpu7", - "gpv", "i2cp", "irrx", "irtx", "pta", - "rm", "slxa", "slxk", "spia", "spib", - "uac"; -@@ -203,7 +203,7 @@ - }; - conf_crtp { - nvidia,pins = "crtp", "dap2", "dap3", "dap4", -- "dtc", "dte", "dtf", "gpu", "sdio1", -+ "dtc", "dte", "gpu", "sdio1", - "slxc", "slxd", "spdi", "spdo", "spig", - "uda"; - nvidia,pull = ; -diff --git a/arch/arm/mach-iop32x/include/mach/entry-macro.S b/arch/arm/mach-iop32x/include/mach/entry-macro.S -index 8e6766d4621eb..341e5d9a6616d 100644 ---- a/arch/arm/mach-iop32x/include/mach/entry-macro.S -+++ b/arch/arm/mach-iop32x/include/mach/entry-macro.S -@@ -20,7 +20,7 @@ - mrc p6, 0, \irqstat, c8, c0, 0 @ Read IINTSRC - cmp \irqstat, #0 - clzne \irqnr, \irqstat -- rsbne \irqnr, \irqnr, #31 -+ rsbne \irqnr, \irqnr, #32 - .endm - - .macro arch_ret_to_user, tmp1, tmp2 -diff --git a/arch/arm/mach-iop32x/include/mach/irqs.h b/arch/arm/mach-iop32x/include/mach/irqs.h -index c4e78df428e86..e09ae5f48aec5 100644 ---- a/arch/arm/mach-iop32x/include/mach/irqs.h -+++ b/arch/arm/mach-iop32x/include/mach/irqs.h -@@ -9,6 +9,6 @@ - #ifndef __IRQS_H - #define __IRQS_H - --#define NR_IRQS 32 -+#define NR_IRQS 33 - - #endif -diff --git a/arch/arm/mach-iop32x/irq.c b/arch/arm/mach-iop32x/irq.c -index 2d48bf1398c10..d1e8824cbd824 100644 ---- a/arch/arm/mach-iop32x/irq.c -+++ b/arch/arm/mach-iop32x/irq.c -@@ -32,14 +32,14 @@ static void intstr_write(u32 val) - static void - iop32x_irq_mask(struct irq_data *d) - { -- iop32x_mask &= ~(1 << d->irq); -+ iop32x_mask &= ~(1 << (d->irq - 1)); - intctl_write(iop32x_mask); - } - - static void - iop32x_irq_unmask(struct irq_data *d) - { -- iop32x_mask |= 1 << d->irq; -+ iop32x_mask |= 1 << (d->irq - 1); - intctl_write(iop32x_mask); - } - -@@ -65,7 +65,7 @@ void __init iop32x_init_irq(void) - machine_is_em7210()) - *IOP3XX_PCIIRSR = 0x0f; - -- for (i = 0; i < NR_IRQS; i++) { -+ for (i = 1; i < NR_IRQS; i++) { - irq_set_chip_and_handler(i, &ext_chip, handle_level_irq); - irq_clear_status_flags(i, IRQ_NOREQUEST | IRQ_NOPROBE); - } -diff --git a/arch/arm/mach-iop32x/irqs.h b/arch/arm/mach-iop32x/irqs.h -index 69858e4e905d1..e1dfc8b4e7d7e 100644 ---- a/arch/arm/mach-iop32x/irqs.h -+++ b/arch/arm/mach-iop32x/irqs.h -@@ -7,36 +7,40 @@ - #ifndef __IOP32X_IRQS_H - #define __IOP32X_IRQS_H - -+/* Interrupts in Linux start at 1, hardware starts at 0 */ -+ -+#define IOP_IRQ(x) ((x) + 1) -+ - /* - * IOP80321 chipset interrupts - */ --#define IRQ_IOP32X_DMA0_EOT 0 --#define IRQ_IOP32X_DMA0_EOC 1 --#define IRQ_IOP32X_DMA1_EOT 2 --#define IRQ_IOP32X_DMA1_EOC 3 --#define IRQ_IOP32X_AA_EOT 6 --#define IRQ_IOP32X_AA_EOC 7 --#define IRQ_IOP32X_CORE_PMON 8 --#define IRQ_IOP32X_TIMER0 9 --#define IRQ_IOP32X_TIMER1 10 --#define IRQ_IOP32X_I2C_0 11 --#define IRQ_IOP32X_I2C_1 12 --#define IRQ_IOP32X_MESSAGING 13 --#define IRQ_IOP32X_ATU_BIST 14 --#define IRQ_IOP32X_PERFMON 15 --#define IRQ_IOP32X_CORE_PMU 16 --#define IRQ_IOP32X_BIU_ERR 17 --#define IRQ_IOP32X_ATU_ERR 18 --#define IRQ_IOP32X_MCU_ERR 19 --#define IRQ_IOP32X_DMA0_ERR 20 --#define IRQ_IOP32X_DMA1_ERR 21 --#define IRQ_IOP32X_AA_ERR 23 --#define IRQ_IOP32X_MSG_ERR 24 --#define IRQ_IOP32X_SSP 25 --#define IRQ_IOP32X_XINT0 27 --#define IRQ_IOP32X_XINT1 28 --#define IRQ_IOP32X_XINT2 29 --#define IRQ_IOP32X_XINT3 30 --#define IRQ_IOP32X_HPI 31 -+#define IRQ_IOP32X_DMA0_EOT IOP_IRQ(0) -+#define IRQ_IOP32X_DMA0_EOC IOP_IRQ(1) -+#define IRQ_IOP32X_DMA1_EOT IOP_IRQ(2) -+#define IRQ_IOP32X_DMA1_EOC IOP_IRQ(3) -+#define IRQ_IOP32X_AA_EOT IOP_IRQ(6) -+#define IRQ_IOP32X_AA_EOC IOP_IRQ(7) -+#define IRQ_IOP32X_CORE_PMON IOP_IRQ(8) -+#define IRQ_IOP32X_TIMER0 IOP_IRQ(9) -+#define IRQ_IOP32X_TIMER1 IOP_IRQ(10) -+#define IRQ_IOP32X_I2C_0 IOP_IRQ(11) -+#define IRQ_IOP32X_I2C_1 IOP_IRQ(12) -+#define IRQ_IOP32X_MESSAGING IOP_IRQ(13) -+#define IRQ_IOP32X_ATU_BIST IOP_IRQ(14) -+#define IRQ_IOP32X_PERFMON IOP_IRQ(15) -+#define IRQ_IOP32X_CORE_PMU IOP_IRQ(16) -+#define IRQ_IOP32X_BIU_ERR IOP_IRQ(17) -+#define IRQ_IOP32X_ATU_ERR IOP_IRQ(18) -+#define IRQ_IOP32X_MCU_ERR IOP_IRQ(19) -+#define IRQ_IOP32X_DMA0_ERR IOP_IRQ(20) -+#define IRQ_IOP32X_DMA1_ERR IOP_IRQ(21) -+#define IRQ_IOP32X_AA_ERR IOP_IRQ(23) -+#define IRQ_IOP32X_MSG_ERR IOP_IRQ(24) -+#define IRQ_IOP32X_SSP IOP_IRQ(25) -+#define IRQ_IOP32X_XINT0 IOP_IRQ(27) -+#define IRQ_IOP32X_XINT1 IOP_IRQ(28) -+#define IRQ_IOP32X_XINT2 IOP_IRQ(29) -+#define IRQ_IOP32X_XINT3 IOP_IRQ(30) -+#define IRQ_IOP32X_HPI IOP_IRQ(31) - - #endif -diff --git a/arch/arm/mach-mmp/sram.c b/arch/arm/mach-mmp/sram.c -index 6794e2db1ad5f..ecc46c31004f6 100644 ---- a/arch/arm/mach-mmp/sram.c -+++ b/arch/arm/mach-mmp/sram.c -@@ -72,6 +72,8 @@ static int sram_probe(struct platform_device *pdev) - if (!info) - return -ENOMEM; - -+ platform_set_drvdata(pdev, info); -+ - res = platform_get_resource(pdev, IORESOURCE_MEM, 0); - if (res == NULL) { - dev_err(&pdev->dev, "no memory resource defined\n"); -@@ -107,8 +109,6 @@ static int sram_probe(struct platform_device *pdev) - list_add(&info->node, &sram_bank_list); - mutex_unlock(&sram_lock); - -- platform_set_drvdata(pdev, info); -- - dev_info(&pdev->dev, "initialized\n"); - return 0; - -@@ -127,17 +127,19 @@ static int sram_remove(struct platform_device *pdev) - struct sram_bank_info *info; - - info = platform_get_drvdata(pdev); -- if (info == NULL) -- return -ENODEV; - -- mutex_lock(&sram_lock); -- list_del(&info->node); -- mutex_unlock(&sram_lock); -+ if (info->sram_size) { -+ mutex_lock(&sram_lock); -+ list_del(&info->node); -+ mutex_unlock(&sram_lock); -+ -+ gen_pool_destroy(info->gpool); -+ iounmap(info->sram_virt); -+ kfree(info->pool_name); -+ } - -- gen_pool_destroy(info->gpool); -- iounmap(info->sram_virt); -- kfree(info->pool_name); - kfree(info); -+ - return 0; - } - -diff --git a/arch/arm/mach-s3c24xx/mach-jive.c b/arch/arm/mach-s3c24xx/mach-jive.c -index 885e8f12e4b91..eedc9f8ed2109 100644 ---- a/arch/arm/mach-s3c24xx/mach-jive.c -+++ b/arch/arm/mach-s3c24xx/mach-jive.c -@@ -237,11 +237,11 @@ static int __init jive_mtdset(char *options) - unsigned long set; - - if (options == NULL || options[0] == '\0') -- return 0; -+ return 1; - - if (kstrtoul(options, 10, &set)) { - printk(KERN_ERR "failed to parse mtdset=%s\n", options); -- return 0; -+ return 1; - } - - switch (set) { -@@ -256,7 +256,7 @@ static int __init jive_mtdset(char *options) - "using default.", set); - } - -- return 0; -+ return 1; - } - - /* parse the mtdset= option given to the kernel command line */ -diff --git a/arch/arm64/boot/dts/broadcom/northstar2/ns2-svk.dts b/arch/arm64/boot/dts/broadcom/northstar2/ns2-svk.dts -index ec19fbf928a14..12a4b1c03390c 100644 ---- a/arch/arm64/boot/dts/broadcom/northstar2/ns2-svk.dts -+++ b/arch/arm64/boot/dts/broadcom/northstar2/ns2-svk.dts -@@ -111,8 +111,8 @@ - compatible = "silabs,si3226x"; - reg = <0>; - spi-max-frequency = <5000000>; -- spi-cpha = <1>; -- spi-cpol = <1>; -+ spi-cpha; -+ spi-cpol; - pl022,hierarchy = <0>; - pl022,interface = <0>; - pl022,slave-tx-disable = <0>; -@@ -135,8 +135,8 @@ - at25,byte-len = <0x8000>; - at25,addr-mode = <2>; - at25,page-size = <64>; -- spi-cpha = <1>; -- spi-cpol = <1>; -+ spi-cpha; -+ spi-cpol; - pl022,hierarchy = <0>; - pl022,interface = <0>; - pl022,slave-tx-disable = <0>; -diff --git a/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi b/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi -index 39802066232e1..edc1a8a4c4bc0 100644 ---- a/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi -+++ b/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi -@@ -687,7 +687,7 @@ - }; - }; - -- sata: ahci@663f2000 { -+ sata: sata@663f2000 { - compatible = "brcm,iproc-ahci", "generic-ahci"; - reg = <0x663f2000 0x1000>; - dma-coherent; -diff --git a/arch/arm64/boot/dts/qcom/sm8150.dtsi b/arch/arm64/boot/dts/qcom/sm8150.dtsi -index 9573da378826b..1954cef8c6f0b 100644 ---- a/arch/arm64/boot/dts/qcom/sm8150.dtsi -+++ b/arch/arm64/boot/dts/qcom/sm8150.dtsi -@@ -459,9 +459,9 @@ - qcom,tcs-offset = <0xd00>; - qcom,drv-id = <2>; - qcom,tcs-config = , -- , -- , -- ; -+ , -+ , -+ ; - - rpmhcc: clock-controller { - compatible = "qcom,sm8150-rpmh-clk"; -diff --git a/arch/arm64/boot/dts/rockchip/rk3399-firefly.dts b/arch/arm64/boot/dts/rockchip/rk3399-firefly.dts -index 76f5db696009b..5b7e8fbf1ffec 100644 ---- a/arch/arm64/boot/dts/rockchip/rk3399-firefly.dts -+++ b/arch/arm64/boot/dts/rockchip/rk3399-firefly.dts -@@ -666,8 +666,8 @@ - sd-uhs-sdr104; - - /* Power supply */ -- vqmmc-supply = &vcc1v8_s3; /* IO line */ -- vmmc-supply = &vcc_sdio; /* card's power */ -+ vqmmc-supply = <&vcc1v8_s3>; /* IO line */ -+ vmmc-supply = <&vcc_sdio>; /* card's power */ - - #address-cells = <1>; - #size-cells = <0>; -diff --git a/arch/arm64/include/asm/kvm_mmu.h b/arch/arm64/include/asm/kvm_mmu.h -index 78d110667c0c7..ffe0aad96b17b 100644 ---- a/arch/arm64/include/asm/kvm_mmu.h -+++ b/arch/arm64/include/asm/kvm_mmu.h -@@ -479,7 +479,8 @@ static inline void *kvm_get_hyp_vector(void) - int slot = -1; - - if ((cpus_have_const_cap(ARM64_HARDEN_BRANCH_PREDICTOR) || -- cpus_have_const_cap(ARM64_SPECTRE_BHB)) && data->template_start) { -+ cpus_have_const_cap(ARM64_SPECTRE_BHB)) && -+ data && data->template_start) { - vect = kern_hyp_va(kvm_ksym_ref(__bp_harden_hyp_vecs_start)); - slot = data->hyp_vectors_slot; - } -diff --git a/arch/arm64/kernel/cpuidle.c b/arch/arm64/kernel/cpuidle.c -index e4d6af2fdec71..5397f0d9e5bbb 100644 ---- a/arch/arm64/kernel/cpuidle.c -+++ b/arch/arm64/kernel/cpuidle.c -@@ -53,6 +53,9 @@ static int psci_acpi_cpu_init_idle(unsigned int cpu) - struct acpi_lpi_state *lpi; - struct acpi_processor *pr = per_cpu(processors, cpu); - -+ if (unlikely(!pr || !pr->flags.has_lpi)) -+ return -EINVAL; -+ - /* - * If the PSCI cpu_suspend function hook has not been initialized - * idle states must not be enabled, so bail out -@@ -60,9 +63,6 @@ static int psci_acpi_cpu_init_idle(unsigned int cpu) - if (!psci_ops.cpu_suspend) - return -EOPNOTSUPP; - -- if (unlikely(!pr || !pr->flags.has_lpi)) -- return -EINVAL; -- - count = pr->power.count - 1; - if (count <= 0) - return -ENODEV; -diff --git a/arch/arm64/kernel/insn.c b/arch/arm64/kernel/insn.c -index 53bcf5386907f..a02c294a47530 100644 ---- a/arch/arm64/kernel/insn.c -+++ b/arch/arm64/kernel/insn.c -@@ -207,8 +207,8 @@ static int __kprobes aarch64_insn_patch_text_cb(void *arg) - int i, ret = 0; - struct aarch64_insn_patch *pp = arg; - -- /* The first CPU becomes master */ -- if (atomic_inc_return(&pp->cpu_count) == 1) { -+ /* The last CPU becomes master */ -+ if (atomic_inc_return(&pp->cpu_count) == num_online_cpus()) { - for (i = 0; ret == 0 && i < pp->insn_cnt; i++) - ret = aarch64_insn_patch_text_nosync(pp->text_addrs[i], - pp->new_insns[i]); -diff --git a/arch/arm64/kernel/module.lds b/arch/arm64/kernel/module.lds -index 09a0eef71d12b..9371abe2f4c2d 100644 ---- a/arch/arm64/kernel/module.lds -+++ b/arch/arm64/kernel/module.lds -@@ -1,5 +1,5 @@ - SECTIONS { -- .plt 0 (NOLOAD) : { BYTE(0) } -- .init.plt 0 (NOLOAD) : { BYTE(0) } -- .text.ftrace_trampoline 0 (NOLOAD) : { BYTE(0) } -+ .plt 0 : { BYTE(0) } -+ .init.plt 0 : { BYTE(0) } -+ .text.ftrace_trampoline 0 : { BYTE(0) } - } -diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c -index a343677837c77..17a8d1484f9b9 100644 ---- a/arch/arm64/net/bpf_jit_comp.c -+++ b/arch/arm64/net/bpf_jit_comp.c -@@ -909,15 +909,18 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) - goto out_off; - } - -- /* 1. Initial fake pass to compute ctx->idx. */ -- -- /* Fake pass to fill in ctx->offset. */ -- if (build_body(&ctx, extra_pass)) { -+ /* -+ * 1. Initial fake pass to compute ctx->idx and ctx->offset. -+ * -+ * BPF line info needs ctx->offset[i] to be the offset of -+ * instruction[i] in jited image, so build prologue first. -+ */ -+ if (build_prologue(&ctx, was_classic)) { - prog = orig_prog; - goto out_off; - } - -- if (build_prologue(&ctx, was_classic)) { -+ if (build_body(&ctx, extra_pass)) { - prog = orig_prog; - goto out_off; - } -@@ -983,6 +986,11 @@ skip_init_ctx: - prog->jited_len = image_size; - - if (!prog->is_func || extra_pass) { -+ int i; -+ -+ /* offset[prog->len] is the size of program */ -+ for (i = 0; i <= prog->len; i++) -+ ctx.offset[i] *= AARCH64_INSN_SIZE; - bpf_prog_fill_jited_linfo(prog, ctx.offset + 1); - out_off: - kfree(ctx.offset); -diff --git a/arch/microblaze/include/asm/uaccess.h b/arch/microblaze/include/asm/uaccess.h -index a1f206b90753a..c8cd66c8d2577 100644 ---- a/arch/microblaze/include/asm/uaccess.h -+++ b/arch/microblaze/include/asm/uaccess.h -@@ -171,27 +171,27 @@ extern long __user_bad(void); - - #define __get_user(x, ptr) \ - ({ \ -- unsigned long __gu_val = 0; \ - long __gu_err; \ - switch (sizeof(*(ptr))) { \ - case 1: \ -- __get_user_asm("lbu", (ptr), __gu_val, __gu_err); \ -+ __get_user_asm("lbu", (ptr), x, __gu_err); \ - break; \ - case 2: \ -- __get_user_asm("lhu", (ptr), __gu_val, __gu_err); \ -+ __get_user_asm("lhu", (ptr), x, __gu_err); \ - break; \ - case 4: \ -- __get_user_asm("lw", (ptr), __gu_val, __gu_err); \ -+ __get_user_asm("lw", (ptr), x, __gu_err); \ - break; \ -- case 8: \ -- __gu_err = __copy_from_user(&__gu_val, ptr, 8); \ -- if (__gu_err) \ -- __gu_err = -EFAULT; \ -+ case 8: { \ -+ __u64 __x = 0; \ -+ __gu_err = raw_copy_from_user(&__x, ptr, 8) ? \ -+ -EFAULT : 0; \ -+ (x) = (typeof(x))(typeof((x) - (x)))__x; \ - break; \ -+ } \ - default: \ - /* __gu_val = 0; __gu_err = -EINVAL;*/ __gu_err = __user_bad();\ - } \ -- x = (__force __typeof__(*(ptr))) __gu_val; \ - __gu_err; \ - }) - -diff --git a/arch/mips/dec/int-handler.S b/arch/mips/dec/int-handler.S -index a25ef822e7250..5ed38e6180190 100644 ---- a/arch/mips/dec/int-handler.S -+++ b/arch/mips/dec/int-handler.S -@@ -131,7 +131,7 @@ - */ - mfc0 t0,CP0_CAUSE # get pending interrupts - mfc0 t1,CP0_STATUS --#ifdef CONFIG_32BIT -+#if defined(CONFIG_32BIT) && defined(CONFIG_MIPS_FP_SUPPORT) - lw t2,cpu_fpu_mask - #endif - andi t0,ST0_IM # CAUSE.CE may be non-zero! -@@ -139,7 +139,7 @@ - - beqz t0,spurious - --#ifdef CONFIG_32BIT -+#if defined(CONFIG_32BIT) && defined(CONFIG_MIPS_FP_SUPPORT) - and t2,t0 - bnez t2,fpu # handle FPU immediately - #endif -@@ -280,7 +280,7 @@ handle_it: - j dec_irq_dispatch - nop - --#ifdef CONFIG_32BIT -+#if defined(CONFIG_32BIT) && defined(CONFIG_MIPS_FP_SUPPORT) - fpu: - lw t0,fpu_kstat_irq - nop -diff --git a/arch/mips/dec/prom/Makefile b/arch/mips/dec/prom/Makefile -index d95016016b42b..2bad87551203b 100644 ---- a/arch/mips/dec/prom/Makefile -+++ b/arch/mips/dec/prom/Makefile -@@ -6,4 +6,4 @@ - - lib-y += init.o memory.o cmdline.o identify.o console.o - --lib-$(CONFIG_32BIT) += locore.o -+lib-$(CONFIG_CPU_R3000) += locore.o -diff --git a/arch/mips/dec/setup.c b/arch/mips/dec/setup.c -index 1fc8dffa8d1d0..649b50ae5b1e3 100644 ---- a/arch/mips/dec/setup.c -+++ b/arch/mips/dec/setup.c -@@ -766,7 +766,8 @@ void __init arch_init_irq(void) - dec_interrupt[DEC_IRQ_HALT] = -1; - - /* Register board interrupts: FPU and cascade. */ -- if (dec_interrupt[DEC_IRQ_FPU] >= 0 && cpu_has_fpu) { -+ if (IS_ENABLED(CONFIG_MIPS_FP_SUPPORT) && -+ dec_interrupt[DEC_IRQ_FPU] >= 0 && cpu_has_fpu) { - struct irq_desc *desc_fpu; - int irq_fpu; - -diff --git a/arch/mips/include/asm/dec/prom.h b/arch/mips/include/asm/dec/prom.h -index 62c7dfb90e06c..1e1247add1cf8 100644 ---- a/arch/mips/include/asm/dec/prom.h -+++ b/arch/mips/include/asm/dec/prom.h -@@ -43,16 +43,11 @@ - */ - #define REX_PROM_MAGIC 0x30464354 - --#ifdef CONFIG_64BIT -- --#define prom_is_rex(magic) 1 /* KN04 and KN05 are REX PROMs. */ -- --#else /* !CONFIG_64BIT */ -- --#define prom_is_rex(magic) ((magic) == REX_PROM_MAGIC) -- --#endif /* !CONFIG_64BIT */ -- -+/* KN04 and KN05 are REX PROMs, so only do the check for R3k systems. */ -+static inline bool prom_is_rex(u32 magic) -+{ -+ return !IS_ENABLED(CONFIG_CPU_R3000) || magic == REX_PROM_MAGIC; -+} - - /* - * 3MIN/MAXINE PROM entry points for DS5000/1xx's, DS5000/xx's and -diff --git a/arch/mips/include/asm/setup.h b/arch/mips/include/asm/setup.h -index bb36a400203df..8c56b862fd9c2 100644 ---- a/arch/mips/include/asm/setup.h -+++ b/arch/mips/include/asm/setup.h -@@ -16,7 +16,7 @@ static inline void setup_8250_early_printk_port(unsigned long base, - unsigned int reg_shift, unsigned int timeout) {} - #endif - --extern void set_handler(unsigned long offset, void *addr, unsigned long len); -+void set_handler(unsigned long offset, const void *addr, unsigned long len); - extern void set_uncached_handler(unsigned long offset, void *addr, unsigned long len); - - typedef void (*vi_handler_t)(void); -diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c -index 8282d0feb0b21..749089c25d5e6 100644 ---- a/arch/mips/kernel/traps.c -+++ b/arch/mips/kernel/traps.c -@@ -2020,19 +2020,19 @@ static void *set_vi_srs_handler(int n, vi_handler_t addr, int srs) - * If no shadow set is selected then use the default handler - * that does normal register saving and standard interrupt exit - */ -- extern char except_vec_vi, except_vec_vi_lui; -- extern char except_vec_vi_ori, except_vec_vi_end; -- extern char rollback_except_vec_vi; -- char *vec_start = using_rollback_handler() ? -- &rollback_except_vec_vi : &except_vec_vi; -+ extern const u8 except_vec_vi[], except_vec_vi_lui[]; -+ extern const u8 except_vec_vi_ori[], except_vec_vi_end[]; -+ extern const u8 rollback_except_vec_vi[]; -+ const u8 *vec_start = using_rollback_handler() ? -+ rollback_except_vec_vi : except_vec_vi; - #if defined(CONFIG_CPU_MICROMIPS) || defined(CONFIG_CPU_BIG_ENDIAN) -- const int lui_offset = &except_vec_vi_lui - vec_start + 2; -- const int ori_offset = &except_vec_vi_ori - vec_start + 2; -+ const int lui_offset = except_vec_vi_lui - vec_start + 2; -+ const int ori_offset = except_vec_vi_ori - vec_start + 2; - #else -- const int lui_offset = &except_vec_vi_lui - vec_start; -- const int ori_offset = &except_vec_vi_ori - vec_start; -+ const int lui_offset = except_vec_vi_lui - vec_start; -+ const int ori_offset = except_vec_vi_ori - vec_start; - #endif -- const int handler_len = &except_vec_vi_end - vec_start; -+ const int handler_len = except_vec_vi_end - vec_start; - - if (handler_len > VECTORSPACING) { - /* -@@ -2240,7 +2240,7 @@ void per_cpu_trap_init(bool is_boot_cpu) - } - - /* Install CPU exception handler */ --void set_handler(unsigned long offset, void *addr, unsigned long size) -+void set_handler(unsigned long offset, const void *addr, unsigned long size) - { - #ifdef CONFIG_CPU_MICROMIPS - memcpy((void *)(ebase + offset), ((unsigned char *)addr - 1), size); -diff --git a/arch/mips/ralink/ill_acc.c b/arch/mips/ralink/ill_acc.c -index 0ddeb31afa93a..45ca2b84f0962 100644 ---- a/arch/mips/ralink/ill_acc.c -+++ b/arch/mips/ralink/ill_acc.c -@@ -61,6 +61,7 @@ static int __init ill_acc_of_setup(void) - pdev = of_find_device_by_node(np); - if (!pdev) { - pr_err("%pOFn: failed to lookup pdev\n", np); -+ of_node_put(np); - return -EINVAL; - } - -diff --git a/arch/mips/rb532/devices.c b/arch/mips/rb532/devices.c -index c9ecf17f86605..74808619fefeb 100644 ---- a/arch/mips/rb532/devices.c -+++ b/arch/mips/rb532/devices.c -@@ -310,11 +310,9 @@ static int __init plat_setup_devices(void) - static int __init setup_kmac(char *s) - { - printk(KERN_INFO "korina mac = %s\n", s); -- if (!mac_pton(s, korina_dev0_data.mac)) { -+ if (!mac_pton(s, korina_dev0_data.mac)) - printk(KERN_ERR "Invalid mac\n"); -- return -EINVAL; -- } -- return 0; -+ return 1; - } - - __setup("kmac=", setup_kmac); -diff --git a/arch/nios2/include/asm/uaccess.h b/arch/nios2/include/asm/uaccess.h -index e83f831a76f93..6be5e913c42e4 100644 ---- a/arch/nios2/include/asm/uaccess.h -+++ b/arch/nios2/include/asm/uaccess.h -@@ -89,6 +89,7 @@ extern __must_check long strnlen_user(const char __user *s, long n); - /* Optimized macros */ - #define __get_user_asm(val, insn, addr, err) \ - { \ -+ unsigned long __gu_val; \ - __asm__ __volatile__( \ - " movi %0, %3\n" \ - "1: " insn " %1, 0(%2)\n" \ -@@ -97,14 +98,20 @@ extern __must_check long strnlen_user(const char __user *s, long n); - " .section __ex_table,\"a\"\n" \ - " .word 1b, 2b\n" \ - " .previous" \ -- : "=&r" (err), "=r" (val) \ -+ : "=&r" (err), "=r" (__gu_val) \ - : "r" (addr), "i" (-EFAULT)); \ -+ val = (__force __typeof__(*(addr)))__gu_val; \ - } - --#define __get_user_unknown(val, size, ptr, err) do { \ -+extern void __get_user_unknown(void); -+ -+#define __get_user_8(val, ptr, err) do { \ -+ u64 __val = 0; \ - err = 0; \ -- if (__copy_from_user(&(val), ptr, size)) { \ -+ if (raw_copy_from_user(&(__val), ptr, sizeof(val))) { \ - err = -EFAULT; \ -+ } else { \ -+ val = (typeof(val))(typeof((val) - (val)))__val; \ - } \ - } while (0) - -@@ -120,8 +127,11 @@ do { \ - case 4: \ - __get_user_asm(val, "ldw", ptr, err); \ - break; \ -+ case 8: \ -+ __get_user_8(val, ptr, err); \ -+ break; \ - default: \ -- __get_user_unknown(val, size, ptr, err); \ -+ __get_user_unknown(); \ - break; \ - } \ - } while (0) -@@ -130,9 +140,7 @@ do { \ - ({ \ - long __gu_err = -EFAULT; \ - const __typeof__(*(ptr)) __user *__gu_ptr = (ptr); \ -- unsigned long __gu_val = 0; \ -- __get_user_common(__gu_val, sizeof(*(ptr)), __gu_ptr, __gu_err);\ -- (x) = (__force __typeof__(x))__gu_val; \ -+ __get_user_common(x, sizeof(*(ptr)), __gu_ptr, __gu_err); \ - __gu_err; \ - }) - -@@ -140,11 +148,9 @@ do { \ - ({ \ - long __gu_err = -EFAULT; \ - const __typeof__(*(ptr)) __user *__gu_ptr = (ptr); \ -- unsigned long __gu_val = 0; \ - if (access_ok( __gu_ptr, sizeof(*__gu_ptr))) \ -- __get_user_common(__gu_val, sizeof(*__gu_ptr), \ -+ __get_user_common(x, sizeof(*__gu_ptr), \ - __gu_ptr, __gu_err); \ -- (x) = (__force __typeof__(x))__gu_val; \ - __gu_err; \ - }) - -diff --git a/arch/parisc/kernel/patch.c b/arch/parisc/kernel/patch.c -index 80a0ab372802d..e59574f65e641 100644 ---- a/arch/parisc/kernel/patch.c -+++ b/arch/parisc/kernel/patch.c -@@ -40,10 +40,7 @@ static void __kprobes *patch_map(void *addr, int fixmap, unsigned long *flags, - - *need_unmap = 1; - set_fixmap(fixmap, page_to_phys(page)); -- if (flags) -- raw_spin_lock_irqsave(&patch_lock, *flags); -- else -- __acquire(&patch_lock); -+ raw_spin_lock_irqsave(&patch_lock, *flags); - - return (void *) (__fix_to_virt(fixmap) + (uintaddr & ~PAGE_MASK)); - } -@@ -52,10 +49,7 @@ static void __kprobes patch_unmap(int fixmap, unsigned long *flags) - { - clear_fixmap(fixmap); - -- if (flags) -- raw_spin_unlock_irqrestore(&patch_lock, *flags); -- else -- __release(&patch_lock); -+ raw_spin_unlock_irqrestore(&patch_lock, *flags); - } - - void __kprobes __patch_text_multiple(void *addr, u32 *insn, unsigned int len) -@@ -67,8 +61,9 @@ void __kprobes __patch_text_multiple(void *addr, u32 *insn, unsigned int len) - int mapped; - - /* Make sure we don't have any aliases in cache */ -- flush_kernel_vmap_range(addr, len); -- flush_icache_range(start, end); -+ flush_kernel_dcache_range_asm(start, end); -+ flush_kernel_icache_range_asm(start, end); -+ flush_tlb_kernel_range(start, end); - - p = fixmap = patch_map(addr, FIX_TEXT_POKE0, &flags, &mapped); - -@@ -81,8 +76,10 @@ void __kprobes __patch_text_multiple(void *addr, u32 *insn, unsigned int len) - * We're crossing a page boundary, so - * need to remap - */ -- flush_kernel_vmap_range((void *)fixmap, -- (p-fixmap) * sizeof(*p)); -+ flush_kernel_dcache_range_asm((unsigned long)fixmap, -+ (unsigned long)p); -+ flush_tlb_kernel_range((unsigned long)fixmap, -+ (unsigned long)p); - if (mapped) - patch_unmap(FIX_TEXT_POKE0, &flags); - p = fixmap = patch_map(addr, FIX_TEXT_POKE0, &flags, -@@ -90,10 +87,10 @@ void __kprobes __patch_text_multiple(void *addr, u32 *insn, unsigned int len) - } - } - -- flush_kernel_vmap_range((void *)fixmap, (p-fixmap) * sizeof(*p)); -+ flush_kernel_dcache_range_asm((unsigned long)fixmap, (unsigned long)p); -+ flush_tlb_kernel_range((unsigned long)fixmap, (unsigned long)p); - if (mapped) - patch_unmap(FIX_TEXT_POKE0, &flags); -- flush_icache_range(start, end); - } - - void __kprobes __patch_text(void *addr, u32 insn) -diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile -index 9f73fb6b1cc91..b9d2fcf030d0d 100644 ---- a/arch/powerpc/Makefile -+++ b/arch/powerpc/Makefile -@@ -174,7 +174,7 @@ else - CFLAGS-$(CONFIG_GENERIC_CPU) += $(call cc-option,-mtune=power7,$(call cc-option,-mtune=power5)) - CFLAGS-$(CONFIG_GENERIC_CPU) += $(call cc-option,-mcpu=power5,-mcpu=power4) - endif --else -+else ifdef CONFIG_PPC_BOOK3E_64 - CFLAGS-$(CONFIG_GENERIC_CPU) += -mcpu=powerpc64 - endif - -diff --git a/arch/powerpc/boot/dts/fsl/t104xrdb.dtsi b/arch/powerpc/boot/dts/fsl/t104xrdb.dtsi -index 099a598c74c00..bfe1ed5be3374 100644 ---- a/arch/powerpc/boot/dts/fsl/t104xrdb.dtsi -+++ b/arch/powerpc/boot/dts/fsl/t104xrdb.dtsi -@@ -139,12 +139,12 @@ - fman@400000 { - ethernet@e6000 { - phy-handle = <&phy_rgmii_0>; -- phy-connection-type = "rgmii"; -+ phy-connection-type = "rgmii-id"; - }; - - ethernet@e8000 { - phy-handle = <&phy_rgmii_1>; -- phy-connection-type = "rgmii"; -+ phy-connection-type = "rgmii-id"; - }; - - mdio0: mdio@fc000 { -diff --git a/arch/powerpc/include/asm/io.h b/arch/powerpc/include/asm/io.h -index a63ec938636de..daba2d2a02a0b 100644 ---- a/arch/powerpc/include/asm/io.h -+++ b/arch/powerpc/include/asm/io.h -@@ -345,25 +345,37 @@ static inline void __raw_writeq_be(unsigned long v, volatile void __iomem *addr) - */ - static inline void __raw_rm_writeb(u8 val, volatile void __iomem *paddr) - { -- __asm__ __volatile__("stbcix %0,0,%1" -+ __asm__ __volatile__(".machine push; \ -+ .machine power6; \ -+ stbcix %0,0,%1; \ -+ .machine pop;" - : : "r" (val), "r" (paddr) : "memory"); - } - - static inline void __raw_rm_writew(u16 val, volatile void __iomem *paddr) - { -- __asm__ __volatile__("sthcix %0,0,%1" -+ __asm__ __volatile__(".machine push; \ -+ .machine power6; \ -+ sthcix %0,0,%1; \ -+ .machine pop;" - : : "r" (val), "r" (paddr) : "memory"); - } - - static inline void __raw_rm_writel(u32 val, volatile void __iomem *paddr) - { -- __asm__ __volatile__("stwcix %0,0,%1" -+ __asm__ __volatile__(".machine push; \ -+ .machine power6; \ -+ stwcix %0,0,%1; \ -+ .machine pop;" - : : "r" (val), "r" (paddr) : "memory"); - } - - static inline void __raw_rm_writeq(u64 val, volatile void __iomem *paddr) - { -- __asm__ __volatile__("stdcix %0,0,%1" -+ __asm__ __volatile__(".machine push; \ -+ .machine power6; \ -+ stdcix %0,0,%1; \ -+ .machine pop;" - : : "r" (val), "r" (paddr) : "memory"); - } - -@@ -375,7 +387,10 @@ static inline void __raw_rm_writeq_be(u64 val, volatile void __iomem *paddr) - static inline u8 __raw_rm_readb(volatile void __iomem *paddr) - { - u8 ret; -- __asm__ __volatile__("lbzcix %0,0, %1" -+ __asm__ __volatile__(".machine push; \ -+ .machine power6; \ -+ lbzcix %0,0, %1; \ -+ .machine pop;" - : "=r" (ret) : "r" (paddr) : "memory"); - return ret; - } -@@ -383,7 +398,10 @@ static inline u8 __raw_rm_readb(volatile void __iomem *paddr) - static inline u16 __raw_rm_readw(volatile void __iomem *paddr) - { - u16 ret; -- __asm__ __volatile__("lhzcix %0,0, %1" -+ __asm__ __volatile__(".machine push; \ -+ .machine power6; \ -+ lhzcix %0,0, %1; \ -+ .machine pop;" - : "=r" (ret) : "r" (paddr) : "memory"); - return ret; - } -@@ -391,7 +409,10 @@ static inline u16 __raw_rm_readw(volatile void __iomem *paddr) - static inline u32 __raw_rm_readl(volatile void __iomem *paddr) - { - u32 ret; -- __asm__ __volatile__("lwzcix %0,0, %1" -+ __asm__ __volatile__(".machine push; \ -+ .machine power6; \ -+ lwzcix %0,0, %1; \ -+ .machine pop;" - : "=r" (ret) : "r" (paddr) : "memory"); - return ret; - } -@@ -399,7 +420,10 @@ static inline u32 __raw_rm_readl(volatile void __iomem *paddr) - static inline u64 __raw_rm_readq(volatile void __iomem *paddr) - { - u64 ret; -- __asm__ __volatile__("ldcix %0,0, %1" -+ __asm__ __volatile__(".machine push; \ -+ .machine power6; \ -+ ldcix %0,0, %1; \ -+ .machine pop;" - : "=r" (ret) : "r" (paddr) : "memory"); - return ret; - } -diff --git a/arch/powerpc/include/asm/uaccess.h b/arch/powerpc/include/asm/uaccess.h -index cafad1960e766..a14a32f6c3ccd 100644 ---- a/arch/powerpc/include/asm/uaccess.h -+++ b/arch/powerpc/include/asm/uaccess.h -@@ -191,8 +191,11 @@ extern long __get_user_bad(void); - */ - #define __get_user_atomic_128_aligned(kaddr, uaddr, err) \ - __asm__ __volatile__( \ -+ ".machine push\n" \ -+ ".machine altivec\n" \ - "1: lvx 0,0,%1 # get user\n" \ - " stvx 0,0,%2 # put kernel\n" \ -+ ".machine pop\n" \ - "2:\n" \ - ".section .fixup,\"ax\"\n" \ - "3: li %0,%3\n" \ -diff --git a/arch/powerpc/kernel/kvm.c b/arch/powerpc/kernel/kvm.c -index 617eba82531cb..d89cf802d9aa7 100644 ---- a/arch/powerpc/kernel/kvm.c -+++ b/arch/powerpc/kernel/kvm.c -@@ -669,7 +669,7 @@ static void __init kvm_use_magic_page(void) - on_each_cpu(kvm_map_magic_page, &features, 1); - - /* Quick self-test to see if the mapping works */ -- if (!fault_in_pages_readable((const char *)KVM_MAGIC_PAGE, sizeof(u32))) { -+ if (fault_in_pages_readable((const char *)KVM_MAGIC_PAGE, sizeof(u32))) { - kvm_patching_worked = false; - return; - } -diff --git a/arch/powerpc/kernel/machine_kexec.c b/arch/powerpc/kernel/machine_kexec.c -index 7a1c11a7cba5a..716f8bb17461c 100644 ---- a/arch/powerpc/kernel/machine_kexec.c -+++ b/arch/powerpc/kernel/machine_kexec.c -@@ -146,11 +146,18 @@ void __init reserve_crashkernel(void) - if (!crashk_res.start) { - #ifdef CONFIG_PPC64 - /* -- * On 64bit we split the RMO in half but cap it at half of -- * a small SLB (128MB) since the crash kernel needs to place -- * itself and some stacks to be in the first segment. -+ * On the LPAR platform place the crash kernel to mid of -+ * RMA size (512MB or more) to ensure the crash kernel -+ * gets enough space to place itself and some stack to be -+ * in the first segment. At the same time normal kernel -+ * also get enough space to allocate memory for essential -+ * system resource in the first segment. Keep the crash -+ * kernel starts at 128MB offset on other platforms. - */ -- crashk_res.start = min(0x8000000ULL, (ppc64_rma_size / 2)); -+ if (firmware_has_feature(FW_FEATURE_LPAR)) -+ crashk_res.start = ppc64_rma_size / 2; -+ else -+ crashk_res.start = min(0x8000000ULL, (ppc64_rma_size / 2)); - #else - crashk_res.start = KDUMP_KERNELBASE; - #endif -diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c -index c1e2e351ebff8..9392661ac8a87 100644 ---- a/arch/powerpc/kernel/rtas.c -+++ b/arch/powerpc/kernel/rtas.c -@@ -1244,6 +1244,12 @@ int __init early_init_dt_scan_rtas(unsigned long node, - entryp = of_get_flat_dt_prop(node, "linux,rtas-entry", NULL); - sizep = of_get_flat_dt_prop(node, "rtas-size", NULL); - -+#ifdef CONFIG_PPC64 -+ /* need this feature to decide the crashkernel offset */ -+ if (of_get_flat_dt_prop(node, "ibm,hypertas-functions", NULL)) -+ powerpc_firmware_features |= FW_FEATURE_LPAR; -+#endif -+ - if (basep && entryp && sizep) { - rtas.base = *basep; - rtas.entry = *entryp; -diff --git a/arch/powerpc/kvm/powerpc.c b/arch/powerpc/kvm/powerpc.c -index 8dd4d2b83677b..eb8c72846b7fc 100644 ---- a/arch/powerpc/kvm/powerpc.c -+++ b/arch/powerpc/kvm/powerpc.c -@@ -1495,7 +1495,7 @@ int kvmppc_handle_vmx_load(struct kvm_run *run, struct kvm_vcpu *vcpu, - { - enum emulation_result emulated = EMULATE_DONE; - -- if (vcpu->arch.mmio_vsx_copy_nums > 2) -+ if (vcpu->arch.mmio_vmx_copy_nums > 2) - return EMULATE_FAIL; - - while (vcpu->arch.mmio_vmx_copy_nums) { -@@ -1592,7 +1592,7 @@ int kvmppc_handle_vmx_store(struct kvm_run *run, struct kvm_vcpu *vcpu, - unsigned int index = rs & KVM_MMIO_REG_MASK; - enum emulation_result emulated = EMULATE_DONE; - -- if (vcpu->arch.mmio_vsx_copy_nums > 2) -+ if (vcpu->arch.mmio_vmx_copy_nums > 2) - return EMULATE_FAIL; - - vcpu->arch.io_gpr = rs; -diff --git a/arch/powerpc/lib/sstep.c b/arch/powerpc/lib/sstep.c -index dc6728dacbc6b..27650cd5857f9 100644 ---- a/arch/powerpc/lib/sstep.c -+++ b/arch/powerpc/lib/sstep.c -@@ -906,7 +906,10 @@ NOKPROBE_SYMBOL(emulate_dcbz); - - #define __put_user_asmx(x, addr, err, op, cr) \ - __asm__ __volatile__( \ -+ ".machine push\n" \ -+ ".machine power8\n" \ - "1: " op " %2,0,%3\n" \ -+ ".machine pop\n" \ - " mfcr %1\n" \ - "2:\n" \ - ".section .fixup,\"ax\"\n" \ -@@ -919,7 +922,10 @@ NOKPROBE_SYMBOL(emulate_dcbz); - - #define __get_user_asmx(x, addr, err, op) \ - __asm__ __volatile__( \ -+ ".machine push\n" \ -+ ".machine power8\n" \ - "1: "op" %1,0,%2\n" \ -+ ".machine pop\n" \ - "2:\n" \ - ".section .fixup,\"ax\"\n" \ - "3: li %0,%3\n" \ -@@ -2912,7 +2918,7 @@ int emulate_loadstore(struct pt_regs *regs, struct instruction_op *op) - __put_user_asmx(op->val, ea, err, "stbcx.", cr); - break; - case 2: -- __put_user_asmx(op->val, ea, err, "stbcx.", cr); -+ __put_user_asmx(op->val, ea, err, "sthcx.", cr); - break; - #endif - case 4: -diff --git a/arch/powerpc/mm/kasan/kasan_init_32.c b/arch/powerpc/mm/kasan/kasan_init_32.c -index 1cfe57b51d7e3..3f78007a72822 100644 ---- a/arch/powerpc/mm/kasan/kasan_init_32.c -+++ b/arch/powerpc/mm/kasan/kasan_init_32.c -@@ -121,7 +121,7 @@ static void __init kasan_remap_early_shadow_ro(void) - pmd_t *pmd = pmd_offset(pud_offset(pgd_offset_k(k_cur), k_cur), k_cur); - pte_t *ptep = pte_offset_kernel(pmd, k_cur); - -- if ((pte_val(*ptep) & PTE_RPN_MASK) != pa) -+ if (pte_page(*ptep) != virt_to_page(lm_alias(kasan_early_shadow_page))) - continue; - - __set_pte_at(&init_mm, k_cur, ptep, pfn_pte(PHYS_PFN(pa), prot), 0); -diff --git a/arch/powerpc/perf/imc-pmu.c b/arch/powerpc/perf/imc-pmu.c -index eb82dda884e51..d76e800a1f337 100644 ---- a/arch/powerpc/perf/imc-pmu.c -+++ b/arch/powerpc/perf/imc-pmu.c -@@ -1441,7 +1441,11 @@ static int trace_imc_event_init(struct perf_event *event) - event->hw.idx = -1; - target = event->hw.target; - -- event->pmu->task_ctx_nr = perf_hw_context; -+ /* -+ * There can only be a single PMU for perf_hw_context events which is assigned to -+ * core PMU. Hence use "perf_sw_context" for trace_imc. -+ */ -+ event->pmu->task_ctx_nr = perf_sw_context; - event->destroy = reset_global_refc; - return 0; - } -diff --git a/arch/powerpc/platforms/8xx/pic.c b/arch/powerpc/platforms/8xx/pic.c -index e9617d35fd1f6..209b12323aa4c 100644 ---- a/arch/powerpc/platforms/8xx/pic.c -+++ b/arch/powerpc/platforms/8xx/pic.c -@@ -153,6 +153,7 @@ int mpc8xx_pic_init(void) - if (mpc8xx_pic_host == NULL) { - printk(KERN_ERR "MPC8xx PIC: failed to allocate irq host!\n"); - ret = -ENOMEM; -+ goto out; - } - - ret = 0; -diff --git a/arch/powerpc/platforms/powernv/rng.c b/arch/powerpc/platforms/powernv/rng.c -index 8035caf6e297d..1c31863a9be6c 100644 ---- a/arch/powerpc/platforms/powernv/rng.c -+++ b/arch/powerpc/platforms/powernv/rng.c -@@ -43,7 +43,11 @@ static unsigned long rng_whiten(struct powernv_rng *rng, unsigned long val) - unsigned long parity; - - /* Calculate the parity of the value */ -- asm ("popcntd %0,%1" : "=r" (parity) : "r" (val)); -+ asm (".machine push; \ -+ .machine power7; \ -+ popcntd %0,%1; \ -+ .machine pop;" -+ : "=r" (parity) : "r" (val)); - - /* xor our value with the previous mask */ - val ^= rng->mask; -diff --git a/arch/powerpc/sysdev/fsl_gtm.c b/arch/powerpc/sysdev/fsl_gtm.c -index 8963eaffb1b7b..39186ad6b3c3a 100644 ---- a/arch/powerpc/sysdev/fsl_gtm.c -+++ b/arch/powerpc/sysdev/fsl_gtm.c -@@ -86,7 +86,7 @@ static LIST_HEAD(gtms); - */ - struct gtm_timer *gtm_get_timer16(void) - { -- struct gtm *gtm = NULL; -+ struct gtm *gtm; - int i; - - list_for_each_entry(gtm, >ms, list_node) { -@@ -103,7 +103,7 @@ struct gtm_timer *gtm_get_timer16(void) - spin_unlock_irq(>m->lock); - } - -- if (gtm) -+ if (!list_empty(>ms)) - return ERR_PTR(-EBUSY); - return ERR_PTR(-ENODEV); - } -diff --git a/arch/riscv/kernel/module.lds b/arch/riscv/kernel/module.lds -index 295ecfb341a29..18ec719899e28 100644 ---- a/arch/riscv/kernel/module.lds -+++ b/arch/riscv/kernel/module.lds -@@ -2,7 +2,7 @@ - /* Copyright (C) 2017 Andes Technology Corporation */ - - SECTIONS { -- .plt (NOLOAD) : { BYTE(0) } -- .got (NOLOAD) : { BYTE(0) } -- .got.plt (NOLOAD) : { BYTE(0) } -+ .plt : { BYTE(0) } -+ .got : { BYTE(0) } -+ .got.plt : { BYTE(0) } - } -diff --git a/arch/riscv/kernel/perf_callchain.c b/arch/riscv/kernel/perf_callchain.c -index 22a93009362d7..1de5991916eb9 100644 ---- a/arch/riscv/kernel/perf_callchain.c -+++ b/arch/riscv/kernel/perf_callchain.c -@@ -77,7 +77,7 @@ void perf_callchain_user(struct perf_callchain_entry_ctx *entry, - - bool fill_callchain(unsigned long pc, void *entry) - { -- return perf_callchain_store(entry, pc); -+ return perf_callchain_store(entry, pc) == 0; - } - - void notrace walk_stackframe(struct task_struct *task, -diff --git a/arch/um/drivers/mconsole_kern.c b/arch/um/drivers/mconsole_kern.c -index 0117489e9b30a..750acc1344328 100644 ---- a/arch/um/drivers/mconsole_kern.c -+++ b/arch/um/drivers/mconsole_kern.c -@@ -217,7 +217,7 @@ void mconsole_go(struct mc_request *req) - - void mconsole_stop(struct mc_request *req) - { -- deactivate_fd(req->originating_fd, MCONSOLE_IRQ); -+ block_signals(); - os_set_fd_block(req->originating_fd, 1); - mconsole_reply(req, "stopped", 0, 0); - for (;;) { -@@ -240,6 +240,7 @@ void mconsole_stop(struct mc_request *req) - } - os_set_fd_block(req->originating_fd, 0); - mconsole_reply(req, "", 0, 0); -+ unblock_signals(); - } - - static DEFINE_SPINLOCK(mc_devices_lock); -diff --git a/arch/x86/events/intel/pt.c b/arch/x86/events/intel/pt.c -index da289a44d5116..f4d2322f4c629 100644 ---- a/arch/x86/events/intel/pt.c -+++ b/arch/x86/events/intel/pt.c -@@ -460,7 +460,7 @@ static u64 pt_config_filters(struct perf_event *event) - pt->filters.filter[range].msr_b = filter->msr_b; - } - -- rtit_ctl |= filter->config << pt_address_ranges[range].reg_off; -+ rtit_ctl |= (u64)filter->config << pt_address_ranges[range].reg_off; - } - - return rtit_ctl; -diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c -index 6ff2c7cac4c46..408b51aba2930 100644 ---- a/arch/x86/kernel/kvm.c -+++ b/arch/x86/kernel/kvm.c -@@ -487,7 +487,7 @@ static void __send_ipi_mask(const struct cpumask *mask, int vector) - } else if (apic_id < min && max - apic_id < KVM_IPI_CLUSTER_SIZE) { - ipi_bitmap <<= min - apic_id; - min = apic_id; -- } else if (apic_id < min + KVM_IPI_CLUSTER_SIZE) { -+ } else if (apic_id > min && apic_id < min + KVM_IPI_CLUSTER_SIZE) { - max = apic_id < max ? max : apic_id; - } else { - ret = kvm_hypercall4(KVM_HC_SEND_IPI, (unsigned long)ipi_bitmap, -diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c -index 60c8dcb907a50..ea48a2fb1677d 100644 ---- a/arch/x86/kvm/emulate.c -+++ b/arch/x86/kvm/emulate.c -@@ -1714,11 +1714,6 @@ static int __load_segment_descriptor(struct x86_emulate_ctxt *ctxt, - goto exception; - } - -- if (!seg_desc.p) { -- err_vec = (seg == VCPU_SREG_SS) ? SS_VECTOR : NP_VECTOR; -- goto exception; -- } -- - dpl = seg_desc.dpl; - - switch (seg) { -@@ -1758,6 +1753,10 @@ static int __load_segment_descriptor(struct x86_emulate_ctxt *ctxt, - case VCPU_SREG_TR: - if (seg_desc.s || (seg_desc.type != 1 && seg_desc.type != 9)) - goto exception; -+ if (!seg_desc.p) { -+ err_vec = NP_VECTOR; -+ goto exception; -+ } - old_desc = seg_desc; - seg_desc.type |= 2; /* busy */ - ret = ctxt->ops->cmpxchg_emulated(ctxt, desc_addr, &old_desc, &seg_desc, -@@ -1782,6 +1781,11 @@ static int __load_segment_descriptor(struct x86_emulate_ctxt *ctxt, - break; - } - -+ if (!seg_desc.p) { -+ err_vec = (seg == VCPU_SREG_SS) ? SS_VECTOR : NP_VECTOR; -+ goto exception; -+ } -+ - if (seg_desc.s) { - /* mark segment as accessed */ - if (!(seg_desc.type & 1)) { -diff --git a/arch/x86/kvm/hyperv.c b/arch/x86/kvm/hyperv.c -index be92e8dccda3d..ca66459a2e895 100644 ---- a/arch/x86/kvm/hyperv.c -+++ b/arch/x86/kvm/hyperv.c -@@ -205,7 +205,7 @@ static int synic_set_msr(struct kvm_vcpu_hv_synic *synic, - struct kvm_vcpu *vcpu = synic_to_vcpu(synic); - int ret; - -- if (!synic->active && !host) -+ if (!synic->active && (!host || data)) - return 1; - - trace_kvm_hv_synic_set_msr(vcpu->vcpu_id, msr, data, host); -@@ -251,6 +251,9 @@ static int synic_set_msr(struct kvm_vcpu_hv_synic *synic, - case HV_X64_MSR_EOM: { - int i; - -+ if (!synic->active) -+ break; -+ - for (i = 0; i < ARRAY_SIZE(synic->sint); i++) - kvm_hv_notify_acked_sint(vcpu, i); - break; -@@ -514,6 +517,11 @@ static int stimer_set_config(struct kvm_vcpu_hv_stimer *stimer, u64 config, - { - union hv_stimer_config new_config = {.as_uint64 = config}, - old_config = {.as_uint64 = stimer->config.as_uint64}; -+ struct kvm_vcpu *vcpu = stimer_to_vcpu(stimer); -+ struct kvm_vcpu_hv_synic *synic = vcpu_to_synic(vcpu); -+ -+ if (!synic->active && (!host || config)) -+ return 1; - - trace_kvm_hv_stimer_set_config(stimer_to_vcpu(stimer)->vcpu_id, - stimer->index, config, host); -@@ -533,6 +541,12 @@ static int stimer_set_config(struct kvm_vcpu_hv_stimer *stimer, u64 config, - static int stimer_set_count(struct kvm_vcpu_hv_stimer *stimer, u64 count, - bool host) - { -+ struct kvm_vcpu *vcpu = stimer_to_vcpu(stimer); -+ struct kvm_vcpu_hv_synic *synic = vcpu_to_synic(vcpu); -+ -+ if (!synic->active && (!host || count)) -+ return 1; -+ - trace_kvm_hv_stimer_set_count(stimer_to_vcpu(stimer)->vcpu_id, - stimer->index, count, host); - -diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c -index eea2d6f10f59a..afe3b8e615146 100644 ---- a/arch/x86/kvm/lapic.c -+++ b/arch/x86/kvm/lapic.c -@@ -2099,10 +2099,7 @@ void kvm_set_lapic_tscdeadline_msr(struct kvm_vcpu *vcpu, u64 data) - - void kvm_lapic_set_tpr(struct kvm_vcpu *vcpu, unsigned long cr8) - { -- struct kvm_lapic *apic = vcpu->arch.apic; -- -- apic_set_tpr(apic, ((cr8 & 0x0f) << 4) -- | (kvm_lapic_get_reg(apic, APIC_TASKPRI) & 4)); -+ apic_set_tpr(vcpu->arch.apic, (cr8 & 0x0f) << 4); - } - - u64 kvm_lapic_get_cr8(struct kvm_vcpu *vcpu) -diff --git a/arch/x86/kvm/paging_tmpl.h b/arch/x86/kvm/paging_tmpl.h -index d4a8ad6c6a4bb..1a1d2b5e7b357 100644 ---- a/arch/x86/kvm/paging_tmpl.h -+++ b/arch/x86/kvm/paging_tmpl.h -@@ -34,9 +34,8 @@ - #define PT_HAVE_ACCESSED_DIRTY(mmu) true - #ifdef CONFIG_X86_64 - #define PT_MAX_FULL_LEVELS PT64_ROOT_MAX_LEVEL -- #define CMPXCHG cmpxchg -+ #define CMPXCHG "cmpxchgq" - #else -- #define CMPXCHG cmpxchg64 - #define PT_MAX_FULL_LEVELS 2 - #endif - #elif PTTYPE == 32 -@@ -52,7 +51,7 @@ - #define PT_GUEST_DIRTY_SHIFT PT_DIRTY_SHIFT - #define PT_GUEST_ACCESSED_SHIFT PT_ACCESSED_SHIFT - #define PT_HAVE_ACCESSED_DIRTY(mmu) true -- #define CMPXCHG cmpxchg -+ #define CMPXCHG "cmpxchgl" - #elif PTTYPE == PTTYPE_EPT - #define pt_element_t u64 - #define guest_walker guest_walkerEPT -@@ -65,8 +64,10 @@ - #define PT_GUEST_DIRTY_SHIFT 9 - #define PT_GUEST_ACCESSED_SHIFT 8 - #define PT_HAVE_ACCESSED_DIRTY(mmu) ((mmu)->ept_ad) -- #define CMPXCHG cmpxchg64 - #define PT_MAX_FULL_LEVELS 4 -+ #ifdef CONFIG_X86_64 -+ #define CMPXCHG "cmpxchgq" -+ #endif - #else - #error Invalid PTTYPE value - #endif -@@ -132,43 +133,39 @@ static int FNAME(cmpxchg_gpte)(struct kvm_vcpu *vcpu, struct kvm_mmu *mmu, - pt_element_t __user *ptep_user, unsigned index, - pt_element_t orig_pte, pt_element_t new_pte) - { -- int npages; -- pt_element_t ret; -- pt_element_t *table; -- struct page *page; -- -- npages = get_user_pages_fast((unsigned long)ptep_user, 1, FOLL_WRITE, &page); -- if (likely(npages == 1)) { -- table = kmap_atomic(page); -- ret = CMPXCHG(&table[index], orig_pte, new_pte); -- kunmap_atomic(table); -- -- kvm_release_page_dirty(page); -- } else { -- struct vm_area_struct *vma; -- unsigned long vaddr = (unsigned long)ptep_user & PAGE_MASK; -- unsigned long pfn; -- unsigned long paddr; -- -- down_read(¤t->mm->mmap_sem); -- vma = find_vma_intersection(current->mm, vaddr, vaddr + PAGE_SIZE); -- if (!vma || !(vma->vm_flags & VM_PFNMAP)) { -- up_read(¤t->mm->mmap_sem); -- return -EFAULT; -- } -- pfn = ((vaddr - vma->vm_start) >> PAGE_SHIFT) + vma->vm_pgoff; -- paddr = pfn << PAGE_SHIFT; -- table = memremap(paddr, PAGE_SIZE, MEMREMAP_WB); -- if (!table) { -- up_read(¤t->mm->mmap_sem); -- return -EFAULT; -- } -- ret = CMPXCHG(&table[index], orig_pte, new_pte); -- memunmap(table); -- up_read(¤t->mm->mmap_sem); -- } -+ int r = -EFAULT; -+ -+ if (!user_access_begin(ptep_user, sizeof(pt_element_t))) -+ return -EFAULT; -+ -+#ifdef CMPXCHG -+ asm volatile("1:" LOCK_PREFIX CMPXCHG " %[new], %[ptr]\n" -+ "mov $0, %[r]\n" -+ "setnz %b[r]\n" -+ "2:" -+ _ASM_EXTABLE_UA(1b, 2b) -+ : [ptr] "+m" (*ptep_user), -+ [old] "+a" (orig_pte), -+ [r] "+q" (r) -+ : [new] "r" (new_pte) -+ : "memory"); -+#else -+ asm volatile("1:" LOCK_PREFIX "cmpxchg8b %[ptr]\n" -+ "movl $0, %[r]\n" -+ "jz 2f\n" -+ "incl %[r]\n" -+ "2:" -+ _ASM_EXTABLE_UA(1b, 2b) -+ : [ptr] "+m" (*ptep_user), -+ [old] "+A" (orig_pte), -+ [r] "+rm" (r) -+ : [new_lo] "b" ((u32)new_pte), -+ [new_hi] "c" ((u32)(new_pte >> 32)) -+ : "memory"); -+#endif - -- return (ret != orig_pte); -+ user_access_end(); -+ return r; - } - - static bool FNAME(prefetch_invalid_gpte)(struct kvm_vcpu *vcpu, -diff --git a/arch/x86/kvm/pmu_amd.c b/arch/x86/kvm/pmu_amd.c -index d9990951fd0ac..6bc656abbe66d 100644 ---- a/arch/x86/kvm/pmu_amd.c -+++ b/arch/x86/kvm/pmu_amd.c -@@ -245,12 +245,10 @@ static int amd_pmu_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) - /* MSR_EVNTSELn */ - pmc = get_gp_pmc_amd(pmu, msr, PMU_TYPE_EVNTSEL); - if (pmc) { -- if (data == pmc->eventsel) -- return 0; -- if (!(data & pmu->reserved_bits)) { -+ data &= ~pmu->reserved_bits; -+ if (data != pmc->eventsel) - reprogram_gp_counter(pmc, data); -- return 0; -- } -+ return 0; - } - - return 1; -diff --git a/arch/x86/power/cpu.c b/arch/x86/power/cpu.c -index 915bb16397632..1bff0f68f0273 100644 ---- a/arch/x86/power/cpu.c -+++ b/arch/x86/power/cpu.c -@@ -40,7 +40,8 @@ static void msr_save_context(struct saved_context *ctxt) - struct saved_msr *end = msr + ctxt->saved_msrs.num; - - while (msr < end) { -- msr->valid = !rdmsrl_safe(msr->info.msr_no, &msr->info.reg.q); -+ if (msr->valid) -+ rdmsrl(msr->info.msr_no, msr->info.reg.q); - msr++; - } - } -@@ -421,8 +422,10 @@ static int msr_build_context(const u32 *msr_id, const int num) - } - - for (i = saved_msrs->num, j = 0; i < total_num; i++, j++) { -+ u64 dummy; -+ - msr_array[i].info.msr_no = msr_id[j]; -- msr_array[i].valid = false; -+ msr_array[i].valid = !rdmsrl_safe(msr_id[j], &dummy); - msr_array[i].info.reg.q = 0; - } - saved_msrs->num = total_num; -@@ -509,10 +512,24 @@ static int pm_cpu_check(const struct x86_cpu_id *c) - return ret; - } - -+static void pm_save_spec_msr(void) -+{ -+ u32 spec_msr_id[] = { -+ MSR_IA32_SPEC_CTRL, -+ MSR_IA32_TSX_CTRL, -+ MSR_TSX_FORCE_ABORT, -+ MSR_IA32_MCU_OPT_CTRL, -+ MSR_AMD64_LS_CFG, -+ }; -+ -+ msr_build_context(spec_msr_id, ARRAY_SIZE(spec_msr_id)); -+} -+ - static int pm_check_save_msr(void) - { - dmi_check_system(msr_save_dmi_table); - pm_cpu_check(msr_save_cpu_table); -+ pm_save_spec_msr(); - - return 0; - } -diff --git a/arch/x86/xen/pmu.c b/arch/x86/xen/pmu.c -index e13b0b49fcdfc..d7249f4c90f1b 100644 ---- a/arch/x86/xen/pmu.c -+++ b/arch/x86/xen/pmu.c -@@ -512,10 +512,7 @@ irqreturn_t xen_pmu_irq_handler(int irq, void *dev_id) - return ret; - } - --bool is_xen_pmu(int cpu) --{ -- return (get_xenpmu_data() != NULL); --} -+bool is_xen_pmu; - - void xen_pmu_init(int cpu) - { -@@ -526,7 +523,7 @@ void xen_pmu_init(int cpu) - - BUILD_BUG_ON(sizeof(struct xen_pmu_data) > PAGE_SIZE); - -- if (xen_hvm_domain()) -+ if (xen_hvm_domain() || (cpu != 0 && !is_xen_pmu)) - return; - - xenpmu_data = (struct xen_pmu_data *)get_zeroed_page(GFP_KERNEL); -@@ -547,7 +544,8 @@ void xen_pmu_init(int cpu) - per_cpu(xenpmu_shared, cpu).xenpmu_data = xenpmu_data; - per_cpu(xenpmu_shared, cpu).flags = 0; - -- if (cpu == 0) { -+ if (!is_xen_pmu) { -+ is_xen_pmu = true; - perf_register_guest_info_callbacks(&xen_guest_cbs); - xen_pmu_arch_init(); - } -diff --git a/arch/x86/xen/pmu.h b/arch/x86/xen/pmu.h -index 0e83a160589bc..65c58894fc79f 100644 ---- a/arch/x86/xen/pmu.h -+++ b/arch/x86/xen/pmu.h -@@ -4,6 +4,8 @@ - - #include - -+extern bool is_xen_pmu; -+ - irqreturn_t xen_pmu_irq_handler(int irq, void *dev_id); - #ifdef CONFIG_XEN_HAVE_VPMU - void xen_pmu_init(int cpu); -@@ -12,7 +14,6 @@ void xen_pmu_finish(int cpu); - static inline void xen_pmu_init(int cpu) {} - static inline void xen_pmu_finish(int cpu) {} - #endif --bool is_xen_pmu(int cpu); - bool pmu_msr_read(unsigned int msr, uint64_t *val, int *err); - bool pmu_msr_write(unsigned int msr, uint32_t low, uint32_t high, int *err); - int pmu_apic_update(uint32_t reg); -diff --git a/arch/x86/xen/smp_hvm.c b/arch/x86/xen/smp_hvm.c -index f8d39440b2923..e5bd9eb421915 100644 ---- a/arch/x86/xen/smp_hvm.c -+++ b/arch/x86/xen/smp_hvm.c -@@ -18,6 +18,12 @@ static void __init xen_hvm_smp_prepare_boot_cpu(void) - */ - xen_vcpu_setup(0); - -+ /* -+ * Called again in case the kernel boots on vcpu >= MAX_VIRT_CPUS. -+ * Refer to comments in xen_hvm_init_time_ops(). -+ */ -+ xen_hvm_init_time_ops(); -+ - /* - * The alternative logic (which patches the unlock/lock) runs before - * the smp bootup up code is activated. Hence we need to set this up -diff --git a/arch/x86/xen/smp_pv.c b/arch/x86/xen/smp_pv.c -index 0cebe5db691d9..64e6ec2c32a76 100644 ---- a/arch/x86/xen/smp_pv.c -+++ b/arch/x86/xen/smp_pv.c -@@ -129,7 +129,7 @@ int xen_smp_intr_init_pv(unsigned int cpu) - per_cpu(xen_irq_work, cpu).irq = rc; - per_cpu(xen_irq_work, cpu).name = callfunc_name; - -- if (is_xen_pmu(cpu)) { -+ if (is_xen_pmu) { - pmu_name = kasprintf(GFP_KERNEL, "pmu%d", cpu); - rc = bind_virq_to_irqhandler(VIRQ_XENPMU, cpu, - xen_pmu_irq_handler, -diff --git a/arch/x86/xen/time.c b/arch/x86/xen/time.c -index befbdd8b17f01..4ec6c80f76872 100644 ---- a/arch/x86/xen/time.c -+++ b/arch/x86/xen/time.c -@@ -547,6 +547,11 @@ static void xen_hvm_setup_cpu_clockevents(void) - - void __init xen_hvm_init_time_ops(void) - { -+ static bool hvm_time_initialized; -+ -+ if (hvm_time_initialized) -+ return; -+ - /* - * vector callback is needed otherwise we cannot receive interrupts - * on cpu > 0 and at this point we don't know how many cpus are -@@ -556,7 +561,22 @@ void __init xen_hvm_init_time_ops(void) - return; - - if (!xen_feature(XENFEAT_hvm_safe_pvclock)) { -- pr_info("Xen doesn't support pvclock on HVM, disable pv timer"); -+ pr_info_once("Xen doesn't support pvclock on HVM, disable pv timer"); -+ return; -+ } -+ -+ /* -+ * Only MAX_VIRT_CPUS 'vcpu_info' are embedded inside 'shared_info'. -+ * The __this_cpu_read(xen_vcpu) is still NULL when Xen HVM guest -+ * boots on vcpu >= MAX_VIRT_CPUS (e.g., kexec), To access -+ * __this_cpu_read(xen_vcpu) via xen_clocksource_read() will panic. -+ * -+ * The xen_hvm_init_time_ops() should be called again later after -+ * __this_cpu_read(xen_vcpu) is available. -+ */ -+ if (!__this_cpu_read(xen_vcpu)) { -+ pr_info("Delay xen_init_time_common() as kernel is running on vcpu=%d\n", -+ xen_vcpu_nr(0)); - return; - } - -@@ -568,6 +588,8 @@ void __init xen_hvm_init_time_ops(void) - x86_platform.calibrate_tsc = xen_tsc_khz; - x86_platform.get_wallclock = xen_get_wallclock; - x86_platform.set_wallclock = xen_set_wallclock; -+ -+ hvm_time_initialized = true; - } - #endif - -diff --git a/arch/xtensa/boot/dts/xtfpga-flash-128m.dtsi b/arch/xtensa/boot/dts/xtfpga-flash-128m.dtsi -index 9bf8bad1dd18a..c33932568aa73 100644 ---- a/arch/xtensa/boot/dts/xtfpga-flash-128m.dtsi -+++ b/arch/xtensa/boot/dts/xtfpga-flash-128m.dtsi -@@ -8,19 +8,19 @@ - reg = <0x00000000 0x08000000>; - bank-width = <2>; - device-width = <2>; -- partition@0x0 { -+ partition@0 { - label = "data"; - reg = <0x00000000 0x06000000>; - }; -- partition@0x6000000 { -+ partition@6000000 { - label = "boot loader area"; - reg = <0x06000000 0x00800000>; - }; -- partition@0x6800000 { -+ partition@6800000 { - label = "kernel image"; - reg = <0x06800000 0x017e0000>; - }; -- partition@0x7fe0000 { -+ partition@7fe0000 { - label = "boot environment"; - reg = <0x07fe0000 0x00020000>; - }; -diff --git a/arch/xtensa/boot/dts/xtfpga-flash-16m.dtsi b/arch/xtensa/boot/dts/xtfpga-flash-16m.dtsi -index 40c2f81f7cb66..7bde2ab2d6fb5 100644 ---- a/arch/xtensa/boot/dts/xtfpga-flash-16m.dtsi -+++ b/arch/xtensa/boot/dts/xtfpga-flash-16m.dtsi -@@ -8,19 +8,19 @@ - reg = <0x08000000 0x01000000>; - bank-width = <2>; - device-width = <2>; -- partition@0x0 { -+ partition@0 { - label = "boot loader area"; - reg = <0x00000000 0x00400000>; - }; -- partition@0x400000 { -+ partition@400000 { - label = "kernel image"; - reg = <0x00400000 0x00600000>; - }; -- partition@0xa00000 { -+ partition@a00000 { - label = "data"; - reg = <0x00a00000 0x005e0000>; - }; -- partition@0xfe0000 { -+ partition@fe0000 { - label = "boot environment"; - reg = <0x00fe0000 0x00020000>; - }; -diff --git a/arch/xtensa/boot/dts/xtfpga-flash-4m.dtsi b/arch/xtensa/boot/dts/xtfpga-flash-4m.dtsi -index fb8d3a9f33c23..0655b868749a4 100644 ---- a/arch/xtensa/boot/dts/xtfpga-flash-4m.dtsi -+++ b/arch/xtensa/boot/dts/xtfpga-flash-4m.dtsi -@@ -8,11 +8,11 @@ - reg = <0x08000000 0x00400000>; - bank-width = <2>; - device-width = <2>; -- partition@0x0 { -+ partition@0 { - label = "boot loader area"; - reg = <0x00000000 0x003f0000>; - }; -- partition@0x3f0000 { -+ partition@3f0000 { - label = "boot environment"; - reg = <0x003f0000 0x00010000>; - }; -diff --git a/arch/xtensa/include/asm/processor.h b/arch/xtensa/include/asm/processor.h -index 7495520d7a3e9..fd1161de45356 100644 ---- a/arch/xtensa/include/asm/processor.h -+++ b/arch/xtensa/include/asm/processor.h -@@ -225,8 +225,8 @@ extern unsigned long get_wchan(struct task_struct *p); - - #define xtensa_set_sr(x, sr) \ - ({ \ -- unsigned int v = (unsigned int)(x); \ -- __asm__ __volatile__ ("wsr %0, "__stringify(sr) :: "a"(v)); \ -+ __asm__ __volatile__ ("wsr %0, "__stringify(sr) :: \ -+ "a"((unsigned int)(x))); \ - }) - - #define xtensa_get_sr(sr) \ -diff --git a/arch/xtensa/kernel/jump_label.c b/arch/xtensa/kernel/jump_label.c -index 61cf6497a646b..0dde21e0d3de4 100644 ---- a/arch/xtensa/kernel/jump_label.c -+++ b/arch/xtensa/kernel/jump_label.c -@@ -61,7 +61,7 @@ static void patch_text(unsigned long addr, const void *data, size_t sz) - .data = data, - }; - stop_machine_cpuslocked(patch_text_stop_machine, -- &patch, NULL); -+ &patch, cpu_online_mask); - } else { - unsigned long flags; - -diff --git a/block/bfq-cgroup.c b/block/bfq-cgroup.c -index 342a1cfa48c57..c17eb794f0aef 100644 ---- a/block/bfq-cgroup.c -+++ b/block/bfq-cgroup.c -@@ -625,6 +625,12 @@ void bfq_bfqq_move(struct bfq_data *bfqd, struct bfq_queue *bfqq, - { - struct bfq_entity *entity = &bfqq->entity; - -+ /* -+ * oom_bfqq is not allowed to move, oom_bfqq will hold ref to root_group -+ * until elevator exit. -+ */ -+ if (bfqq == &bfqd->oom_bfqq) -+ return; - /* - * Get extra reference to prevent bfqq from being freed in - * next possible expire or deactivate. -diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c -index 1a0c581512f28..1d443d17cf7c5 100644 ---- a/block/bfq-iosched.c -+++ b/block/bfq-iosched.c -@@ -2523,6 +2523,15 @@ bfq_setup_merge(struct bfq_queue *bfqq, struct bfq_queue *new_bfqq) - * are likely to increase the throughput. - */ - bfqq->new_bfqq = new_bfqq; -+ /* -+ * The above assignment schedules the following redirections: -+ * each time some I/O for bfqq arrives, the process that -+ * generated that I/O is disassociated from bfqq and -+ * associated with new_bfqq. Here we increases new_bfqq->ref -+ * in advance, adding the number of processes that are -+ * expected to be associated with new_bfqq as they happen to -+ * issue I/O. -+ */ - new_bfqq->ref += process_refs; - return new_bfqq; - } -@@ -2582,6 +2591,10 @@ bfq_setup_cooperator(struct bfq_data *bfqd, struct bfq_queue *bfqq, - { - struct bfq_queue *in_service_bfqq, *new_bfqq; - -+ /* if a merge has already been setup, then proceed with that first */ -+ if (bfqq->new_bfqq) -+ return bfqq->new_bfqq; -+ - /* - * Do not perform queue merging if the device is non - * rotational and performs internal queueing. In fact, such a -@@ -2636,9 +2649,6 @@ bfq_setup_cooperator(struct bfq_data *bfqd, struct bfq_queue *bfqq, - if (bfq_too_late_for_merging(bfqq)) - return NULL; - -- if (bfqq->new_bfqq) -- return bfqq->new_bfqq; -- - if (!io_struct || unlikely(bfqq == &bfqd->oom_bfqq)) - return NULL; - -@@ -4793,7 +4803,7 @@ static struct request *bfq_dispatch_request(struct blk_mq_hw_ctx *hctx) - struct bfq_data *bfqd = hctx->queue->elevator->elevator_data; - struct request *rq; - struct bfq_queue *in_serv_queue; -- bool waiting_rq, idle_timer_disabled; -+ bool waiting_rq, idle_timer_disabled = false; - - spin_lock_irq(&bfqd->lock); - -@@ -4801,14 +4811,15 @@ static struct request *bfq_dispatch_request(struct blk_mq_hw_ctx *hctx) - waiting_rq = in_serv_queue && bfq_bfqq_wait_request(in_serv_queue); - - rq = __bfq_dispatch_request(hctx); -- -- idle_timer_disabled = -- waiting_rq && !bfq_bfqq_wait_request(in_serv_queue); -+ if (in_serv_queue == bfqd->in_service_queue) { -+ idle_timer_disabled = -+ waiting_rq && !bfq_bfqq_wait_request(in_serv_queue); -+ } - - spin_unlock_irq(&bfqd->lock); -- -- bfq_update_dispatch_stats(hctx->queue, rq, in_serv_queue, -- idle_timer_disabled); -+ bfq_update_dispatch_stats(hctx->queue, rq, -+ idle_timer_disabled ? in_serv_queue : NULL, -+ idle_timer_disabled); - - return rq; - } -diff --git a/block/blk-merge.c b/block/blk-merge.c -index 4b022f0c49d20..a62692d135660 100644 ---- a/block/blk-merge.c -+++ b/block/blk-merge.c -@@ -7,6 +7,7 @@ - #include - #include - #include -+#include - - #include - -@@ -571,6 +572,9 @@ static inline unsigned int blk_rq_get_max_segments(struct request *rq) - static inline int ll_new_hw_segment(struct request *req, struct bio *bio, - unsigned int nr_phys_segs) - { -+ if (!blk_cgroup_mergeable(req, bio)) -+ goto no_merge; -+ - if (blk_integrity_merge_bio(req->q, req, bio) == false) - goto no_merge; - -@@ -662,6 +666,9 @@ static int ll_merge_requests_fn(struct request_queue *q, struct request *req, - if (total_phys_segments > blk_rq_get_max_segments(req)) - return 0; - -+ if (!blk_cgroup_mergeable(req, next->bio)) -+ return 0; -+ - if (blk_integrity_merge_rq(q, req, next) == false) - return 0; - -@@ -885,6 +892,10 @@ bool blk_rq_merge_ok(struct request *rq, struct bio *bio) - if (rq->rq_disk != bio->bi_disk) - return false; - -+ /* don't merge across cgroup boundaries */ -+ if (!blk_cgroup_mergeable(rq, bio)) -+ return false; -+ - /* only merge integrity protected bio into ditto rq */ - if (blk_integrity_merge_bio(rq->q, rq, bio) == false) - return false; -diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c -index bf33570da5ac7..3fb37135264b2 100644 ---- a/block/blk-sysfs.c -+++ b/block/blk-sysfs.c -@@ -1060,15 +1060,17 @@ void blk_unregister_queue(struct gendisk *disk) - */ - if (queue_is_mq(q)) - blk_mq_unregister_dev(disk_to_dev(disk), q); -- -- kobject_uevent(&q->kobj, KOBJ_REMOVE); -- kobject_del(&q->kobj); - blk_trace_remove_sysfs(disk_to_dev(disk)); - - mutex_lock(&q->sysfs_lock); - if (q->elevator) - elv_unregister_queue(q); - mutex_unlock(&q->sysfs_lock); -+ -+ /* Now that we've deleted all child objects, we can delete the queue. */ -+ kobject_uevent(&q->kobj, KOBJ_REMOVE); -+ kobject_del(&q->kobj); -+ - mutex_unlock(&q->sysfs_dir_lock); - - kobject_put(&disk_to_dev(disk)->kobj); -diff --git a/crypto/authenc.c b/crypto/authenc.c -index 3f0ed94025820..321da90389957 100644 ---- a/crypto/authenc.c -+++ b/crypto/authenc.c -@@ -263,7 +263,7 @@ static int crypto_authenc_decrypt_tail(struct aead_request *req, - dst = scatterwalk_ffwd(areq_ctx->dst, req->dst, req->assoclen); - - skcipher_request_set_tfm(skreq, ctx->enc); -- skcipher_request_set_callback(skreq, aead_request_flags(req), -+ skcipher_request_set_callback(skreq, flags, - req->base.complete, req->base.data); - skcipher_request_set_crypt(skreq, src, dst, - req->cryptlen - authsize, req->iv); -diff --git a/crypto/rsa-pkcs1pad.c b/crypto/rsa-pkcs1pad.c -index 0aa489711ec49..9cbafaf6dd851 100644 ---- a/crypto/rsa-pkcs1pad.c -+++ b/crypto/rsa-pkcs1pad.c -@@ -475,6 +475,8 @@ static int pkcs1pad_verify_complete(struct akcipher_request *req, int err) - pos++; - - if (digest_info) { -+ if (digest_info->size > dst_len - pos) -+ goto done; - if (crypto_memneq(out_buf + pos, digest_info->data, - digest_info->size)) - goto done; -@@ -494,7 +496,7 @@ static int pkcs1pad_verify_complete(struct akcipher_request *req, int err) - sg_nents_for_len(req->src, - req->src_len + req->dst_len), - req_ctx->out_buf + ctx->key_size, -- req->dst_len, ctx->key_size); -+ req->dst_len, req->src_len); - /* Do the actual verification step. */ - if (memcmp(req_ctx->out_buf + ctx->key_size, out_buf + pos, - req->dst_len) != 0) -@@ -537,7 +539,7 @@ static int pkcs1pad_verify(struct akcipher_request *req) - - if (WARN_ON(req->dst) || - WARN_ON(!req->dst_len) || -- !ctx->key_size || req->src_len < ctx->key_size) -+ !ctx->key_size || req->src_len != ctx->key_size) - return -EINVAL; - - req_ctx->out_buf = kmalloc(ctx->key_size + req->dst_len, GFP_KERNEL); -diff --git a/drivers/acpi/acpica/nswalk.c b/drivers/acpi/acpica/nswalk.c -index ceea6af79d121..bf4eb642f4232 100644 ---- a/drivers/acpi/acpica/nswalk.c -+++ b/drivers/acpi/acpica/nswalk.c -@@ -169,6 +169,9 @@ acpi_ns_walk_namespace(acpi_object_type type, - - if (start_node == ACPI_ROOT_OBJECT) { - start_node = acpi_gbl_root_node; -+ if (!start_node) { -+ return_ACPI_STATUS(AE_NO_NAMESPACE); -+ } - } - - /* Null child means "get first node" */ -diff --git a/drivers/acpi/apei/bert.c b/drivers/acpi/apei/bert.c -index 1155fb9dcc3ad..76b7539a37a93 100644 ---- a/drivers/acpi/apei/bert.c -+++ b/drivers/acpi/apei/bert.c -@@ -29,6 +29,7 @@ - - #undef pr_fmt - #define pr_fmt(fmt) "BERT: " fmt -+#define ACPI_BERT_PRINT_MAX_LEN 1024 - - static int bert_disable; - -@@ -58,8 +59,11 @@ static void __init bert_print_all(struct acpi_bert_region *region, - } - - pr_info_once("Error records from previous boot:\n"); -- -- cper_estatus_print(KERN_INFO HW_ERR, estatus); -+ if (region_len < ACPI_BERT_PRINT_MAX_LEN) -+ cper_estatus_print(KERN_INFO HW_ERR, estatus); -+ else -+ pr_info_once("Max print length exceeded, table data is available at:\n" -+ "/sys/firmware/acpi/tables/data/BERT"); - - /* - * Because the boot error source is "one-time polled" type, -@@ -77,7 +81,7 @@ static int __init setup_bert_disable(char *str) - { - bert_disable = 1; - -- return 0; -+ return 1; - } - __setup("bert_disable", setup_bert_disable); - -diff --git a/drivers/acpi/apei/erst.c b/drivers/acpi/apei/erst.c -index 2015a0967cbbf..5ee3cb7fcd906 100644 ---- a/drivers/acpi/apei/erst.c -+++ b/drivers/acpi/apei/erst.c -@@ -891,7 +891,7 @@ EXPORT_SYMBOL_GPL(erst_clear); - static int __init setup_erst_disable(char *str) - { - erst_disable = 1; -- return 0; -+ return 1; - } - - __setup("erst_disable", setup_erst_disable); -diff --git a/drivers/acpi/apei/hest.c b/drivers/acpi/apei/hest.c -index 267bdbf6a7bf0..add6416e78f23 100644 ---- a/drivers/acpi/apei/hest.c -+++ b/drivers/acpi/apei/hest.c -@@ -219,7 +219,7 @@ err: - static int __init setup_hest_disable(char *str) - { - hest_disable = HEST_DISABLED; -- return 0; -+ return 1; - } - - __setup("hest_disable", setup_hest_disable); -diff --git a/drivers/acpi/cppc_acpi.c b/drivers/acpi/cppc_acpi.c -index 2826bd45c61a1..0521b1d4c2fd0 100644 ---- a/drivers/acpi/cppc_acpi.c -+++ b/drivers/acpi/cppc_acpi.c -@@ -738,6 +738,11 @@ int acpi_cppc_processor_probe(struct acpi_processor *pr) - cpc_obj = &out_obj->package.elements[0]; - if (cpc_obj->type == ACPI_TYPE_INTEGER) { - num_ent = cpc_obj->integer.value; -+ if (num_ent <= 1) { -+ pr_debug("Unexpected _CPC NumEntries value (%d) for CPU:%d\n", -+ num_ent, pr->id); -+ goto out_free; -+ } - } else { - pr_debug("Unexpected entry type(%d) for NumEntries\n", - cpc_obj->type); -diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c -index 53ae679c00f01..0ea5e677f00ee 100644 ---- a/drivers/acpi/processor_idle.c -+++ b/drivers/acpi/processor_idle.c -@@ -1201,6 +1201,11 @@ static int flatten_lpi_states(struct acpi_processor *pr, - return 0; - } - -+int __weak acpi_processor_ffh_lpi_probe(unsigned int cpu) -+{ -+ return -EOPNOTSUPP; -+} -+ - static int acpi_processor_get_lpi_info(struct acpi_processor *pr) - { - int ret, i; -@@ -1209,6 +1214,11 @@ static int acpi_processor_get_lpi_info(struct acpi_processor *pr) - struct acpi_device *d = NULL; - struct acpi_lpi_states_array info[2], *tmp, *prev, *curr; - -+ /* make sure our architecture has support */ -+ ret = acpi_processor_ffh_lpi_probe(pr->id); -+ if (ret == -EOPNOTSUPP) -+ return ret; -+ - if (!osc_pc_lpi_support_confirmed) - return -EOPNOTSUPP; - -@@ -1260,11 +1270,6 @@ static int acpi_processor_get_lpi_info(struct acpi_processor *pr) - return 0; - } - --int __weak acpi_processor_ffh_lpi_probe(unsigned int cpu) --{ -- return -ENODEV; --} -- - int __weak acpi_processor_ffh_lpi_enter(struct acpi_lpi_state *lpi) - { - return -ENODEV; -diff --git a/drivers/acpi/property.c b/drivers/acpi/property.c -index a08e3eb2a6f9f..a4b7cdd0c8446 100644 ---- a/drivers/acpi/property.c -+++ b/drivers/acpi/property.c -@@ -692,7 +692,7 @@ int __acpi_node_get_property_reference(const struct fwnode_handle *fwnode, - */ - if (obj->type == ACPI_TYPE_LOCAL_REFERENCE) { - if (index) -- return -EINVAL; -+ return -ENOENT; - - ret = acpi_bus_get_device(obj->reference.handle, &device); - if (ret) -diff --git a/drivers/ata/sata_dwc_460ex.c b/drivers/ata/sata_dwc_460ex.c -index 982fe91125322..464260f668708 100644 ---- a/drivers/ata/sata_dwc_460ex.c -+++ b/drivers/ata/sata_dwc_460ex.c -@@ -145,7 +145,11 @@ struct sata_dwc_device { - #endif - }; - --#define SATA_DWC_QCMD_MAX 32 -+/* -+ * Allow one extra special slot for commands and DMA management -+ * to account for libata internal commands. -+ */ -+#define SATA_DWC_QCMD_MAX (ATA_MAX_QUEUE + 1) - - struct sata_dwc_device_port { - struct sata_dwc_device *hsdev; -diff --git a/drivers/base/dd.c b/drivers/base/dd.c -index cf7e5b4afc1be..26cd4ce3ac75f 100644 ---- a/drivers/base/dd.c -+++ b/drivers/base/dd.c -@@ -747,7 +747,7 @@ static int __init save_async_options(char *buf) - "Too long list of driver names for 'driver_async_probe'!\n"); - - strlcpy(async_probe_drv_names, buf, ASYNC_DRV_NAMES_MAX_LEN); -- return 0; -+ return 1; - } - __setup("driver_async_probe=", save_async_options); - -diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c -index 23af545120534..ae382c4018fd8 100644 ---- a/drivers/base/power/main.c -+++ b/drivers/base/power/main.c -@@ -2121,7 +2121,9 @@ static bool pm_ops_is_empty(const struct dev_pm_ops *ops) - - void device_pm_check_callbacks(struct device *dev) - { -- spin_lock_irq(&dev->power.lock); -+ unsigned long flags; -+ -+ spin_lock_irqsave(&dev->power.lock, flags); - dev->power.no_pm_callbacks = - (!dev->bus || (pm_ops_is_empty(dev->bus->pm) && - !dev->bus->suspend && !dev->bus->resume)) && -@@ -2130,7 +2132,7 @@ void device_pm_check_callbacks(struct device *dev) - (!dev->pm_domain || pm_ops_is_empty(&dev->pm_domain->ops)) && - (!dev->driver || (pm_ops_is_empty(dev->driver->pm) && - !dev->driver->suspend && !dev->driver->resume)); -- spin_unlock_irq(&dev->power.lock); -+ spin_unlock_irqrestore(&dev->power.lock, flags); - } - - bool dev_pm_smart_suspend_and_suspended(struct device *dev) -diff --git a/drivers/block/drbd/drbd_int.h b/drivers/block/drbd/drbd_int.h -index ddbf56014c51a..6da7f5749a7c4 100644 ---- a/drivers/block/drbd/drbd_int.h -+++ b/drivers/block/drbd/drbd_int.h -@@ -1673,22 +1673,22 @@ struct sib_info { - }; - void drbd_bcast_event(struct drbd_device *device, const struct sib_info *sib); - --extern void notify_resource_state(struct sk_buff *, -+extern int notify_resource_state(struct sk_buff *, - unsigned int, - struct drbd_resource *, - struct resource_info *, - enum drbd_notification_type); --extern void notify_device_state(struct sk_buff *, -+extern int notify_device_state(struct sk_buff *, - unsigned int, - struct drbd_device *, - struct device_info *, - enum drbd_notification_type); --extern void notify_connection_state(struct sk_buff *, -+extern int notify_connection_state(struct sk_buff *, - unsigned int, - struct drbd_connection *, - struct connection_info *, - enum drbd_notification_type); --extern void notify_peer_device_state(struct sk_buff *, -+extern int notify_peer_device_state(struct sk_buff *, - unsigned int, - struct drbd_peer_device *, - struct peer_device_info *, -diff --git a/drivers/block/drbd/drbd_nl.c b/drivers/block/drbd/drbd_nl.c -index 5d52a2d321559..bfb00d3b091f1 100644 ---- a/drivers/block/drbd/drbd_nl.c -+++ b/drivers/block/drbd/drbd_nl.c -@@ -4630,7 +4630,7 @@ static int nla_put_notification_header(struct sk_buff *msg, - return drbd_notification_header_to_skb(msg, &nh, true); - } - --void notify_resource_state(struct sk_buff *skb, -+int notify_resource_state(struct sk_buff *skb, - unsigned int seq, - struct drbd_resource *resource, - struct resource_info *resource_info, -@@ -4672,16 +4672,17 @@ void notify_resource_state(struct sk_buff *skb, - if (err && err != -ESRCH) - goto failed; - } -- return; -+ return 0; - - nla_put_failure: - nlmsg_free(skb); - failed: - drbd_err(resource, "Error %d while broadcasting event. Event seq:%u\n", - err, seq); -+ return err; - } - --void notify_device_state(struct sk_buff *skb, -+int notify_device_state(struct sk_buff *skb, - unsigned int seq, - struct drbd_device *device, - struct device_info *device_info, -@@ -4721,16 +4722,17 @@ void notify_device_state(struct sk_buff *skb, - if (err && err != -ESRCH) - goto failed; - } -- return; -+ return 0; - - nla_put_failure: - nlmsg_free(skb); - failed: - drbd_err(device, "Error %d while broadcasting event. Event seq:%u\n", - err, seq); -+ return err; - } - --void notify_connection_state(struct sk_buff *skb, -+int notify_connection_state(struct sk_buff *skb, - unsigned int seq, - struct drbd_connection *connection, - struct connection_info *connection_info, -@@ -4770,16 +4772,17 @@ void notify_connection_state(struct sk_buff *skb, - if (err && err != -ESRCH) - goto failed; - } -- return; -+ return 0; - - nla_put_failure: - nlmsg_free(skb); - failed: - drbd_err(connection, "Error %d while broadcasting event. Event seq:%u\n", - err, seq); -+ return err; - } - --void notify_peer_device_state(struct sk_buff *skb, -+int notify_peer_device_state(struct sk_buff *skb, - unsigned int seq, - struct drbd_peer_device *peer_device, - struct peer_device_info *peer_device_info, -@@ -4820,13 +4823,14 @@ void notify_peer_device_state(struct sk_buff *skb, - if (err && err != -ESRCH) - goto failed; - } -- return; -+ return 0; - - nla_put_failure: - nlmsg_free(skb); - failed: - drbd_err(peer_device, "Error %d while broadcasting event. Event seq:%u\n", - err, seq); -+ return err; - } - - void notify_helper(enum drbd_notification_type type, -@@ -4877,7 +4881,7 @@ fail: - err, seq); - } - --static void notify_initial_state_done(struct sk_buff *skb, unsigned int seq) -+static int notify_initial_state_done(struct sk_buff *skb, unsigned int seq) - { - struct drbd_genlmsghdr *dh; - int err; -@@ -4891,11 +4895,12 @@ static void notify_initial_state_done(struct sk_buff *skb, unsigned int seq) - if (nla_put_notification_header(skb, NOTIFY_EXISTS)) - goto nla_put_failure; - genlmsg_end(skb, dh); -- return; -+ return 0; - - nla_put_failure: - nlmsg_free(skb); - pr_err("Error %d sending event. Event seq:%u\n", err, seq); -+ return err; - } - - static void free_state_changes(struct list_head *list) -@@ -4922,6 +4927,7 @@ static int get_initial_state(struct sk_buff *skb, struct netlink_callback *cb) - unsigned int seq = cb->args[2]; - unsigned int n; - enum drbd_notification_type flags = 0; -+ int err = 0; - - /* There is no need for taking notification_mutex here: it doesn't - matter if the initial state events mix with later state chage -@@ -4930,32 +4936,32 @@ static int get_initial_state(struct sk_buff *skb, struct netlink_callback *cb) - - cb->args[5]--; - if (cb->args[5] == 1) { -- notify_initial_state_done(skb, seq); -+ err = notify_initial_state_done(skb, seq); - goto out; - } - n = cb->args[4]++; - if (cb->args[4] < cb->args[3]) - flags |= NOTIFY_CONTINUES; - if (n < 1) { -- notify_resource_state_change(skb, seq, state_change->resource, -+ err = notify_resource_state_change(skb, seq, state_change->resource, - NOTIFY_EXISTS | flags); - goto next; - } - n--; - if (n < state_change->n_connections) { -- notify_connection_state_change(skb, seq, &state_change->connections[n], -+ err = notify_connection_state_change(skb, seq, &state_change->connections[n], - NOTIFY_EXISTS | flags); - goto next; - } - n -= state_change->n_connections; - if (n < state_change->n_devices) { -- notify_device_state_change(skb, seq, &state_change->devices[n], -+ err = notify_device_state_change(skb, seq, &state_change->devices[n], - NOTIFY_EXISTS | flags); - goto next; - } - n -= state_change->n_devices; - if (n < state_change->n_devices * state_change->n_connections) { -- notify_peer_device_state_change(skb, seq, &state_change->peer_devices[n], -+ err = notify_peer_device_state_change(skb, seq, &state_change->peer_devices[n], - NOTIFY_EXISTS | flags); - goto next; - } -@@ -4970,7 +4976,10 @@ next: - cb->args[4] = 0; - } - out: -- return skb->len; -+ if (err) -+ return err; -+ else -+ return skb->len; - } - - int drbd_adm_get_initial_state(struct sk_buff *skb, struct netlink_callback *cb) -diff --git a/drivers/block/drbd/drbd_req.c b/drivers/block/drbd/drbd_req.c -index f86cea4c0f8df..5e92632881d81 100644 ---- a/drivers/block/drbd/drbd_req.c -+++ b/drivers/block/drbd/drbd_req.c -@@ -195,7 +195,8 @@ void start_new_tl_epoch(struct drbd_connection *connection) - void complete_master_bio(struct drbd_device *device, - struct bio_and_error *m) - { -- m->bio->bi_status = errno_to_blk_status(m->error); -+ if (unlikely(m->error)) -+ m->bio->bi_status = errno_to_blk_status(m->error); - bio_endio(m->bio); - dec_ap_bio(device); - } -diff --git a/drivers/block/drbd/drbd_state.c b/drivers/block/drbd/drbd_state.c -index eeaa3b49b2649..4dad4dd0ceb66 100644 ---- a/drivers/block/drbd/drbd_state.c -+++ b/drivers/block/drbd/drbd_state.c -@@ -1537,7 +1537,7 @@ int drbd_bitmap_io_from_worker(struct drbd_device *device, - return rv; - } - --void notify_resource_state_change(struct sk_buff *skb, -+int notify_resource_state_change(struct sk_buff *skb, - unsigned int seq, - struct drbd_resource_state_change *resource_state_change, - enum drbd_notification_type type) -@@ -1550,10 +1550,10 @@ void notify_resource_state_change(struct sk_buff *skb, - .res_susp_fen = resource_state_change->susp_fen[NEW], - }; - -- notify_resource_state(skb, seq, resource, &resource_info, type); -+ return notify_resource_state(skb, seq, resource, &resource_info, type); - } - --void notify_connection_state_change(struct sk_buff *skb, -+int notify_connection_state_change(struct sk_buff *skb, - unsigned int seq, - struct drbd_connection_state_change *connection_state_change, - enum drbd_notification_type type) -@@ -1564,10 +1564,10 @@ void notify_connection_state_change(struct sk_buff *skb, - .conn_role = connection_state_change->peer_role[NEW], - }; - -- notify_connection_state(skb, seq, connection, &connection_info, type); -+ return notify_connection_state(skb, seq, connection, &connection_info, type); - } - --void notify_device_state_change(struct sk_buff *skb, -+int notify_device_state_change(struct sk_buff *skb, - unsigned int seq, - struct drbd_device_state_change *device_state_change, - enum drbd_notification_type type) -@@ -1577,10 +1577,10 @@ void notify_device_state_change(struct sk_buff *skb, - .dev_disk_state = device_state_change->disk_state[NEW], - }; - -- notify_device_state(skb, seq, device, &device_info, type); -+ return notify_device_state(skb, seq, device, &device_info, type); - } - --void notify_peer_device_state_change(struct sk_buff *skb, -+int notify_peer_device_state_change(struct sk_buff *skb, - unsigned int seq, - struct drbd_peer_device_state_change *p, - enum drbd_notification_type type) -@@ -1594,7 +1594,7 @@ void notify_peer_device_state_change(struct sk_buff *skb, - .peer_resync_susp_dependency = p->resync_susp_dependency[NEW], - }; - -- notify_peer_device_state(skb, seq, peer_device, &peer_device_info, type); -+ return notify_peer_device_state(skb, seq, peer_device, &peer_device_info, type); - } - - static void broadcast_state_change(struct drbd_state_change *state_change) -@@ -1602,7 +1602,7 @@ static void broadcast_state_change(struct drbd_state_change *state_change) - struct drbd_resource_state_change *resource_state_change = &state_change->resource[0]; - bool resource_state_has_changed; - unsigned int n_device, n_connection, n_peer_device, n_peer_devices; -- void (*last_func)(struct sk_buff *, unsigned int, void *, -+ int (*last_func)(struct sk_buff *, unsigned int, void *, - enum drbd_notification_type) = NULL; - void *uninitialized_var(last_arg); - -diff --git a/drivers/block/drbd/drbd_state_change.h b/drivers/block/drbd/drbd_state_change.h -index ba80f612d6abb..d5b0479bc9a66 100644 ---- a/drivers/block/drbd/drbd_state_change.h -+++ b/drivers/block/drbd/drbd_state_change.h -@@ -44,19 +44,19 @@ extern struct drbd_state_change *remember_old_state(struct drbd_resource *, gfp_ - extern void copy_old_to_new_state_change(struct drbd_state_change *); - extern void forget_state_change(struct drbd_state_change *); - --extern void notify_resource_state_change(struct sk_buff *, -+extern int notify_resource_state_change(struct sk_buff *, - unsigned int, - struct drbd_resource_state_change *, - enum drbd_notification_type type); --extern void notify_connection_state_change(struct sk_buff *, -+extern int notify_connection_state_change(struct sk_buff *, - unsigned int, - struct drbd_connection_state_change *, - enum drbd_notification_type type); --extern void notify_device_state_change(struct sk_buff *, -+extern int notify_device_state_change(struct sk_buff *, - unsigned int, - struct drbd_device_state_change *, - enum drbd_notification_type type); --extern void notify_peer_device_state_change(struct sk_buff *, -+extern int notify_peer_device_state_change(struct sk_buff *, - unsigned int, - struct drbd_peer_device_state_change *, - enum drbd_notification_type type); -diff --git a/drivers/block/loop.c b/drivers/block/loop.c -index ffbe792410d1c..6b3e27b8cd245 100644 ---- a/drivers/block/loop.c -+++ b/drivers/block/loop.c -@@ -794,33 +794,33 @@ static ssize_t loop_attr_backing_file_show(struct loop_device *lo, char *buf) - - static ssize_t loop_attr_offset_show(struct loop_device *lo, char *buf) - { -- return sprintf(buf, "%llu\n", (unsigned long long)lo->lo_offset); -+ return sysfs_emit(buf, "%llu\n", (unsigned long long)lo->lo_offset); - } - - static ssize_t loop_attr_sizelimit_show(struct loop_device *lo, char *buf) - { -- return sprintf(buf, "%llu\n", (unsigned long long)lo->lo_sizelimit); -+ return sysfs_emit(buf, "%llu\n", (unsigned long long)lo->lo_sizelimit); - } - - static ssize_t loop_attr_autoclear_show(struct loop_device *lo, char *buf) - { - int autoclear = (lo->lo_flags & LO_FLAGS_AUTOCLEAR); - -- return sprintf(buf, "%s\n", autoclear ? "1" : "0"); -+ return sysfs_emit(buf, "%s\n", autoclear ? "1" : "0"); - } - - static ssize_t loop_attr_partscan_show(struct loop_device *lo, char *buf) - { - int partscan = (lo->lo_flags & LO_FLAGS_PARTSCAN); - -- return sprintf(buf, "%s\n", partscan ? "1" : "0"); -+ return sysfs_emit(buf, "%s\n", partscan ? "1" : "0"); - } - - static ssize_t loop_attr_dio_show(struct loop_device *lo, char *buf) - { - int dio = (lo->lo_flags & LO_FLAGS_DIRECT_IO); - -- return sprintf(buf, "%s\n", dio ? "1" : "0"); -+ return sysfs_emit(buf, "%s\n", dio ? "1" : "0"); - } - - LOOP_ATTR_RO(backing_file); -diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c -index 4b3645e648ee9..2a5cd502feae7 100644 ---- a/drivers/block/virtio_blk.c -+++ b/drivers/block/virtio_blk.c -@@ -936,9 +936,17 @@ static int virtblk_probe(struct virtio_device *vdev) - err = virtio_cread_feature(vdev, VIRTIO_BLK_F_BLK_SIZE, - struct virtio_blk_config, blk_size, - &blk_size); -- if (!err) -+ if (!err) { -+ err = blk_validate_block_size(blk_size); -+ if (err) { -+ dev_err(&vdev->dev, -+ "virtio_blk: invalid block size: 0x%x\n", -+ blk_size); -+ goto out_free_tags; -+ } -+ - blk_queue_logical_block_size(q, blk_size); -- else -+ } else - blk_size = queue_logical_block_size(q); - - /* Use topology information if available */ -diff --git a/drivers/bluetooth/btmtksdio.c b/drivers/bluetooth/btmtksdio.c -index c2eb64bcd5d5d..0e7f44461946e 100644 ---- a/drivers/bluetooth/btmtksdio.c -+++ b/drivers/bluetooth/btmtksdio.c -@@ -980,6 +980,8 @@ static int btmtksdio_probe(struct sdio_func *func, - hdev->manufacturer = 70; - set_bit(HCI_QUIRK_NON_PERSISTENT_SETUP, &hdev->quirks); - -+ sdio_set_drvdata(func, bdev); -+ - err = hci_register_dev(hdev); - if (err < 0) { - dev_err(&func->dev, "Can't register HCI device\n"); -@@ -987,8 +989,6 @@ static int btmtksdio_probe(struct sdio_func *func, - return err; - } - -- sdio_set_drvdata(func, bdev); -- - /* pm_runtime_enable would be done after the firmware is being - * downloaded because the core layer probably already enables - * runtime PM for this func such as the case host->caps & -diff --git a/drivers/bluetooth/hci_serdev.c b/drivers/bluetooth/hci_serdev.c -index 1b4ad231e6ed3..fd081bdd2dd8a 100644 ---- a/drivers/bluetooth/hci_serdev.c -+++ b/drivers/bluetooth/hci_serdev.c -@@ -279,6 +279,8 @@ int hci_uart_register_device(struct hci_uart *hu, - if (err) - return err; - -+ percpu_init_rwsem(&hu->proto_lock); -+ - err = p->open(hu); - if (err) - goto err_open; -@@ -301,7 +303,6 @@ int hci_uart_register_device(struct hci_uart *hu, - - INIT_WORK(&hu->init_ready, hci_uart_init_work); - INIT_WORK(&hu->write_work, hci_uart_write_work); -- percpu_init_rwsem(&hu->proto_lock); - - /* Only when vendor specific setup callback is provided, consider - * the manufacturer information valid. This avoids filling in the -diff --git a/drivers/char/hw_random/atmel-rng.c b/drivers/char/hw_random/atmel-rng.c -index e55705745d5e4..f4c94f8acfe0d 100644 ---- a/drivers/char/hw_random/atmel-rng.c -+++ b/drivers/char/hw_random/atmel-rng.c -@@ -96,6 +96,7 @@ static int atmel_trng_probe(struct platform_device *pdev) - - err_register: - clk_disable_unprepare(trng->clk); -+ atmel_trng_disable(trng); - return ret; - } - -diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c -index 1838039b03333..17fbd7f7a2954 100644 ---- a/drivers/char/tpm/tpm-chip.c -+++ b/drivers/char/tpm/tpm-chip.c -@@ -274,14 +274,6 @@ static void tpm_dev_release(struct device *dev) - kfree(chip); - } - --static void tpm_devs_release(struct device *dev) --{ -- struct tpm_chip *chip = container_of(dev, struct tpm_chip, devs); -- -- /* release the master device reference */ -- put_device(&chip->dev); --} -- - /** - * tpm_class_shutdown() - prepare the TPM device for loss of power. - * @dev: device to which the chip is associated. -@@ -344,7 +336,6 @@ struct tpm_chip *tpm_chip_alloc(struct device *pdev, - chip->dev_num = rc; - - device_initialize(&chip->dev); -- device_initialize(&chip->devs); - - chip->dev.class = tpm_class; - chip->dev.class->shutdown_pre = tpm_class_shutdown; -@@ -352,29 +343,12 @@ struct tpm_chip *tpm_chip_alloc(struct device *pdev, - chip->dev.parent = pdev; - chip->dev.groups = chip->groups; - -- chip->devs.parent = pdev; -- chip->devs.class = tpmrm_class; -- chip->devs.release = tpm_devs_release; -- /* get extra reference on main device to hold on -- * behalf of devs. This holds the chip structure -- * while cdevs is in use. The corresponding put -- * is in the tpm_devs_release (TPM2 only) -- */ -- if (chip->flags & TPM_CHIP_FLAG_TPM2) -- get_device(&chip->dev); -- - if (chip->dev_num == 0) - chip->dev.devt = MKDEV(MISC_MAJOR, TPM_MINOR); - else - chip->dev.devt = MKDEV(MAJOR(tpm_devt), chip->dev_num); - -- chip->devs.devt = -- MKDEV(MAJOR(tpm_devt), chip->dev_num + TPM_NUM_DEVICES); -- - rc = dev_set_name(&chip->dev, "tpm%d", chip->dev_num); -- if (rc) -- goto out; -- rc = dev_set_name(&chip->devs, "tpmrm%d", chip->dev_num); - if (rc) - goto out; - -@@ -382,9 +356,7 @@ struct tpm_chip *tpm_chip_alloc(struct device *pdev, - chip->flags |= TPM_CHIP_FLAG_VIRTUAL; - - cdev_init(&chip->cdev, &tpm_fops); -- cdev_init(&chip->cdevs, &tpmrm_fops); - chip->cdev.owner = THIS_MODULE; -- chip->cdevs.owner = THIS_MODULE; - - rc = tpm2_init_space(&chip->work_space, TPM2_SPACE_BUFFER_SIZE); - if (rc) { -@@ -396,7 +368,6 @@ struct tpm_chip *tpm_chip_alloc(struct device *pdev, - return chip; - - out: -- put_device(&chip->devs); - put_device(&chip->dev); - return ERR_PTR(rc); - } -@@ -445,14 +416,9 @@ static int tpm_add_char_device(struct tpm_chip *chip) - } - - if (chip->flags & TPM_CHIP_FLAG_TPM2) { -- rc = cdev_device_add(&chip->cdevs, &chip->devs); -- if (rc) { -- dev_err(&chip->devs, -- "unable to cdev_device_add() %s, major %d, minor %d, err=%d\n", -- dev_name(&chip->devs), MAJOR(chip->devs.devt), -- MINOR(chip->devs.devt), rc); -- return rc; -- } -+ rc = tpm_devs_add(chip); -+ if (rc) -+ goto err_del_cdev; - } - - /* Make the chip available. */ -@@ -460,6 +426,10 @@ static int tpm_add_char_device(struct tpm_chip *chip) - idr_replace(&dev_nums_idr, chip, chip->dev_num); - mutex_unlock(&idr_lock); - -+ return 0; -+ -+err_del_cdev: -+ cdev_device_del(&chip->cdev, &chip->dev); - return rc; - } - -@@ -641,7 +611,7 @@ void tpm_chip_unregister(struct tpm_chip *chip) - hwrng_unregister(&chip->hwrng); - tpm_bios_log_teardown(chip); - if (chip->flags & TPM_CHIP_FLAG_TPM2) -- cdev_device_del(&chip->cdevs, &chip->devs); -+ tpm_devs_remove(chip); - tpm_del_char_device(chip); - } - EXPORT_SYMBOL_GPL(tpm_chip_unregister); -diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h -index 37f010421a369..58312062d435c 100644 ---- a/drivers/char/tpm/tpm.h -+++ b/drivers/char/tpm/tpm.h -@@ -466,6 +466,8 @@ int tpm2_prepare_space(struct tpm_chip *chip, struct tpm_space *space, u8 *cmd, - size_t cmdsiz); - int tpm2_commit_space(struct tpm_chip *chip, struct tpm_space *space, void *buf, - size_t *bufsiz); -+int tpm_devs_add(struct tpm_chip *chip); -+void tpm_devs_remove(struct tpm_chip *chip); - - void tpm_bios_log_setup(struct tpm_chip *chip); - void tpm_bios_log_teardown(struct tpm_chip *chip); -diff --git a/drivers/char/tpm/tpm2-space.c b/drivers/char/tpm/tpm2-space.c -index d2225020e4d2c..ffb35f0154c16 100644 ---- a/drivers/char/tpm/tpm2-space.c -+++ b/drivers/char/tpm/tpm2-space.c -@@ -574,3 +574,68 @@ out: - dev_err(&chip->dev, "%s: error %d\n", __func__, rc); - return rc; - } -+ -+/* -+ * Put the reference to the main device. -+ */ -+static void tpm_devs_release(struct device *dev) -+{ -+ struct tpm_chip *chip = container_of(dev, struct tpm_chip, devs); -+ -+ /* release the master device reference */ -+ put_device(&chip->dev); -+} -+ -+/* -+ * Remove the device file for exposed TPM spaces and release the device -+ * reference. This may also release the reference to the master device. -+ */ -+void tpm_devs_remove(struct tpm_chip *chip) -+{ -+ cdev_device_del(&chip->cdevs, &chip->devs); -+ put_device(&chip->devs); -+} -+ -+/* -+ * Add a device file to expose TPM spaces. Also take a reference to the -+ * main device. -+ */ -+int tpm_devs_add(struct tpm_chip *chip) -+{ -+ int rc; -+ -+ device_initialize(&chip->devs); -+ chip->devs.parent = chip->dev.parent; -+ chip->devs.class = tpmrm_class; -+ -+ /* -+ * Get extra reference on main device to hold on behalf of devs. -+ * This holds the chip structure while cdevs is in use. The -+ * corresponding put is in the tpm_devs_release. -+ */ -+ get_device(&chip->dev); -+ chip->devs.release = tpm_devs_release; -+ chip->devs.devt = MKDEV(MAJOR(tpm_devt), chip->dev_num + TPM_NUM_DEVICES); -+ cdev_init(&chip->cdevs, &tpmrm_fops); -+ chip->cdevs.owner = THIS_MODULE; -+ -+ rc = dev_set_name(&chip->devs, "tpmrm%d", chip->dev_num); -+ if (rc) -+ goto err_put_devs; -+ -+ rc = cdev_device_add(&chip->cdevs, &chip->devs); -+ if (rc) { -+ dev_err(&chip->devs, -+ "unable to cdev_device_add() %s, major %d, minor %d, err=%d\n", -+ dev_name(&chip->devs), MAJOR(chip->devs.devt), -+ MINOR(chip->devs.devt), rc); -+ goto err_put_devs; -+ } -+ -+ return 0; -+ -+err_put_devs: -+ put_device(&chip->devs); -+ -+ return rc; -+} -diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c -index b453029487a12..c736adef9d3c8 100644 ---- a/drivers/char/virtio_console.c -+++ b/drivers/char/virtio_console.c -@@ -1961,6 +1961,13 @@ static void virtcons_remove(struct virtio_device *vdev) - list_del(&portdev->list); - spin_unlock_irq(&pdrvdata_lock); - -+ /* Device is going away, exit any polling for buffers */ -+ virtio_break_device(vdev); -+ if (use_multiport(portdev)) -+ flush_work(&portdev->control_work); -+ else -+ flush_work(&portdev->config_work); -+ - /* Disable interrupts for vqs */ - vdev->config->reset(vdev); - /* Finish up work that's lined up */ -@@ -2234,7 +2241,7 @@ static struct virtio_driver virtio_rproc_serial = { - .remove = virtcons_remove, - }; - --static int __init init(void) -+static int __init virtio_console_init(void) - { - int err; - -@@ -2271,7 +2278,7 @@ free: - return err; - } - --static void __exit fini(void) -+static void __exit virtio_console_fini(void) - { - reclaim_dma_bufs(); - -@@ -2281,8 +2288,8 @@ static void __exit fini(void) - class_destroy(pdrvdata.class); - debugfs_remove_recursive(pdrvdata.debugfs_dir); - } --module_init(init); --module_exit(fini); -+module_init(virtio_console_init); -+module_exit(virtio_console_fini); - - MODULE_DESCRIPTION("Virtio console driver"); - MODULE_LICENSE("GPL"); -diff --git a/drivers/clk/actions/owl-s700.c b/drivers/clk/actions/owl-s700.c -index a2f34d13fb543..6ea7da1d6d755 100644 ---- a/drivers/clk/actions/owl-s700.c -+++ b/drivers/clk/actions/owl-s700.c -@@ -162,6 +162,7 @@ static struct clk_div_table hdmia_div_table[] = { - - static struct clk_div_table rmii_div_table[] = { - {0, 4}, {1, 10}, -+ {0, 0} - }; - - /* divider clocks */ -diff --git a/drivers/clk/actions/owl-s900.c b/drivers/clk/actions/owl-s900.c -index 790890978424a..5144ada2c7e1a 100644 ---- a/drivers/clk/actions/owl-s900.c -+++ b/drivers/clk/actions/owl-s900.c -@@ -140,7 +140,7 @@ static struct clk_div_table rmii_ref_div_table[] = { - - static struct clk_div_table usb3_mac_div_table[] = { - { 1, 2 }, { 2, 3 }, { 3, 4 }, -- { 0, 8 }, -+ { 0, 0 } - }; - - static struct clk_div_table i2s_div_table[] = { -diff --git a/drivers/clk/clk-clps711x.c b/drivers/clk/clk-clps711x.c -index a2c6486ef1708..f8417ee2961aa 100644 ---- a/drivers/clk/clk-clps711x.c -+++ b/drivers/clk/clk-clps711x.c -@@ -28,11 +28,13 @@ static const struct clk_div_table spi_div_table[] = { - { .val = 1, .div = 8, }, - { .val = 2, .div = 2, }, - { .val = 3, .div = 1, }, -+ { /* sentinel */ } - }; - - static const struct clk_div_table timer_div_table[] = { - { .val = 0, .div = 256, }, - { .val = 1, .div = 1, }, -+ { /* sentinel */ } - }; - - struct clps711x_clk { -diff --git a/drivers/clk/clk-si5341.c b/drivers/clk/clk-si5341.c -index 20ed0955416a3..07ef9995b3cb1 100644 ---- a/drivers/clk/clk-si5341.c -+++ b/drivers/clk/clk-si5341.c -@@ -638,6 +638,15 @@ static unsigned long si5341_output_clk_recalc_rate(struct clk_hw *hw, - u32 r_divider; - u8 r[3]; - -+ err = regmap_read(output->data->regmap, -+ SI5341_OUT_CONFIG(output), &val); -+ if (err < 0) -+ return err; -+ -+ /* If SI5341_OUT_CFG_RDIV_FORCE2 is set, r_divider is 2 */ -+ if (val & SI5341_OUT_CFG_RDIV_FORCE2) -+ return parent_rate / 2; -+ - err = regmap_bulk_read(output->data->regmap, - SI5341_OUT_R_REG(output), r, 3); - if (err < 0) -@@ -654,13 +663,6 @@ static unsigned long si5341_output_clk_recalc_rate(struct clk_hw *hw, - r_divider += 1; - r_divider <<= 1; - -- err = regmap_read(output->data->regmap, -- SI5341_OUT_CONFIG(output), &val); -- if (err < 0) -- return err; -- -- if (val & SI5341_OUT_CFG_RDIV_FORCE2) -- r_divider = 2; - - return parent_rate / r_divider; - } -diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c -index e4e1b4e94a67b..13332f89e034b 100644 ---- a/drivers/clk/clk.c -+++ b/drivers/clk/clk.c -@@ -637,6 +637,24 @@ static void clk_core_get_boundaries(struct clk_core *core, - *max_rate = min(*max_rate, clk_user->max_rate); - } - -+static bool clk_core_check_boundaries(struct clk_core *core, -+ unsigned long min_rate, -+ unsigned long max_rate) -+{ -+ struct clk *user; -+ -+ lockdep_assert_held(&prepare_lock); -+ -+ if (min_rate > core->max_rate || max_rate < core->min_rate) -+ return false; -+ -+ hlist_for_each_entry(user, &core->clks, clks_node) -+ if (min_rate > user->max_rate || max_rate < user->min_rate) -+ return false; -+ -+ return true; -+} -+ - void clk_hw_set_rate_range(struct clk_hw *hw, unsigned long min_rate, - unsigned long max_rate) - { -@@ -2306,6 +2324,11 @@ int clk_set_rate_range(struct clk *clk, unsigned long min, unsigned long max) - clk->min_rate = min; - clk->max_rate = max; - -+ if (!clk_core_check_boundaries(clk->core, min, max)) { -+ ret = -EINVAL; -+ goto out; -+ } -+ - rate = clk_core_get_rate_nolock(clk->core); - if (rate < min || rate > max) { - /* -@@ -2334,6 +2357,7 @@ int clk_set_rate_range(struct clk *clk, unsigned long min, unsigned long max) - } - } - -+out: - if (clk->exclusive_count) - clk_core_rate_protect(clk->core); - -@@ -3278,6 +3302,19 @@ static void clk_core_reparent_orphans_nolock(void) - __clk_set_parent_after(orphan, parent, NULL); - __clk_recalc_accuracies(orphan); - __clk_recalc_rates(orphan, 0); -+ -+ /* -+ * __clk_init_parent() will set the initial req_rate to -+ * 0 if the clock doesn't have clk_ops::recalc_rate and -+ * is an orphan when it's registered. -+ * -+ * 'req_rate' is used by clk_set_rate_range() and -+ * clk_put() to trigger a clk_set_rate() call whenever -+ * the boundaries are modified. Let's make sure -+ * 'req_rate' is set to something non-zero so that -+ * clk_set_rate_range() doesn't drop the frequency. -+ */ -+ orphan->req_rate = orphan->rate; - } - } - } -diff --git a/drivers/clk/imx/clk-imx7d.c b/drivers/clk/imx/clk-imx7d.c -index fbea774ef6877..58577548fe212 100644 ---- a/drivers/clk/imx/clk-imx7d.c -+++ b/drivers/clk/imx/clk-imx7d.c -@@ -859,7 +859,6 @@ static void __init imx7d_clocks_init(struct device_node *ccm_node) - hws[IMX7D_WDOG4_ROOT_CLK] = imx_clk_hw_gate4("wdog4_root_clk", "wdog_post_div", base + 0x49f0, 0); - hws[IMX7D_KPP_ROOT_CLK] = imx_clk_hw_gate4("kpp_root_clk", "ipg_root_clk", base + 0x4aa0, 0); - hws[IMX7D_CSI_MCLK_ROOT_CLK] = imx_clk_hw_gate4("csi_mclk_root_clk", "csi_mclk_post_div", base + 0x4490, 0); -- hws[IMX7D_AUDIO_MCLK_ROOT_CLK] = imx_clk_hw_gate4("audio_mclk_root_clk", "audio_mclk_post_div", base + 0x4790, 0); - hws[IMX7D_WRCLK_ROOT_CLK] = imx_clk_hw_gate4("wrclk_root_clk", "wrclk_post_div", base + 0x47a0, 0); - hws[IMX7D_USB_CTRL_CLK] = imx_clk_hw_gate4("usb_ctrl_clk", "ahb_root_clk", base + 0x4680, 0); - hws[IMX7D_USB_PHY1_CLK] = imx_clk_hw_gate4("usb_phy1_clk", "pll_usb1_main_clk", base + 0x46a0, 0); -diff --git a/drivers/clk/loongson1/clk-loongson1c.c b/drivers/clk/loongson1/clk-loongson1c.c -index 703f87622cf5f..1ebf740380efb 100644 ---- a/drivers/clk/loongson1/clk-loongson1c.c -+++ b/drivers/clk/loongson1/clk-loongson1c.c -@@ -37,6 +37,7 @@ static const struct clk_div_table ahb_div_table[] = { - [1] = { .val = 1, .div = 4 }, - [2] = { .val = 2, .div = 3 }, - [3] = { .val = 3, .div = 3 }, -+ [4] = { /* sentinel */ } - }; - - void __init ls1x_clk_init(void) -diff --git a/drivers/clk/qcom/clk-rcg2.c b/drivers/clk/qcom/clk-rcg2.c -index a88101480e337..89c1adeb84d44 100644 ---- a/drivers/clk/qcom/clk-rcg2.c -+++ b/drivers/clk/qcom/clk-rcg2.c -@@ -263,7 +263,7 @@ static int clk_rcg2_determine_floor_rate(struct clk_hw *hw, - - static int __clk_rcg2_configure(struct clk_rcg2 *rcg, const struct freq_tbl *f) - { -- u32 cfg, mask; -+ u32 cfg, mask, d_val, not2d_val, n_minus_m; - struct clk_hw *hw = &rcg->clkr.hw; - int ret, index = qcom_find_src_index(hw, rcg->parent_map, f->src); - -@@ -282,8 +282,17 @@ static int __clk_rcg2_configure(struct clk_rcg2 *rcg, const struct freq_tbl *f) - if (ret) - return ret; - -+ /* Calculate 2d value */ -+ d_val = f->n; -+ -+ n_minus_m = f->n - f->m; -+ n_minus_m *= 2; -+ -+ d_val = clamp_t(u32, d_val, f->m, n_minus_m); -+ not2d_val = ~d_val & mask; -+ - ret = regmap_update_bits(rcg->clkr.regmap, -- RCG_D_OFFSET(rcg), mask, ~f->n); -+ RCG_D_OFFSET(rcg), mask, not2d_val); - if (ret) - return ret; - } -@@ -638,6 +647,7 @@ static const struct frac_entry frac_table_pixel[] = { - { 2, 9 }, - { 4, 9 }, - { 1, 1 }, -+ { 2, 3 }, - { } - }; - -diff --git a/drivers/clk/qcom/gcc-ipq8074.c b/drivers/clk/qcom/gcc-ipq8074.c -index e01f5f591d1e2..de48ba7eba3a1 100644 ---- a/drivers/clk/qcom/gcc-ipq8074.c -+++ b/drivers/clk/qcom/gcc-ipq8074.c -@@ -1074,7 +1074,7 @@ static struct clk_rcg2 sdcc1_apps_clk_src = { - .name = "sdcc1_apps_clk_src", - .parent_names = gcc_xo_gpll0_gpll2_gpll0_out_main_div2, - .num_parents = 4, -- .ops = &clk_rcg2_ops, -+ .ops = &clk_rcg2_floor_ops, - }, - }; - -diff --git a/drivers/clk/qcom/gcc-msm8994.c b/drivers/clk/qcom/gcc-msm8994.c -index b7fc8c7ba1957..14f0d5d840802 100644 ---- a/drivers/clk/qcom/gcc-msm8994.c -+++ b/drivers/clk/qcom/gcc-msm8994.c -@@ -107,6 +107,7 @@ static struct clk_alpha_pll gpll4_early = { - - static struct clk_alpha_pll_postdiv gpll4 = { - .offset = 0x1dc0, -+ .width = 4, - .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT], - .clkr.hw.init = &(struct clk_init_data) - { -diff --git a/drivers/clk/tegra/clk-emc.c b/drivers/clk/tegra/clk-emc.c -index ea39caf3d7622..0c1b83bedb73d 100644 ---- a/drivers/clk/tegra/clk-emc.c -+++ b/drivers/clk/tegra/clk-emc.c -@@ -191,6 +191,7 @@ static struct tegra_emc *emc_ensure_emc_driver(struct tegra_clk_emc *tegra) - - tegra->emc = platform_get_drvdata(pdev); - if (!tegra->emc) { -+ put_device(&pdev->dev); - pr_err("%s: cannot find EMC driver\n", __func__); - return NULL; - } -diff --git a/drivers/clk/uniphier/clk-uniphier-fixed-rate.c b/drivers/clk/uniphier/clk-uniphier-fixed-rate.c -index 5319cd3804801..3bc55ab75314b 100644 ---- a/drivers/clk/uniphier/clk-uniphier-fixed-rate.c -+++ b/drivers/clk/uniphier/clk-uniphier-fixed-rate.c -@@ -24,6 +24,7 @@ struct clk_hw *uniphier_clk_register_fixed_rate(struct device *dev, - - init.name = name; - init.ops = &clk_fixed_rate_ops; -+ init.flags = 0; - init.parent_names = NULL; - init.num_parents = 0; - -diff --git a/drivers/clocksource/acpi_pm.c b/drivers/clocksource/acpi_pm.c -index eb596ff9e7bb3..279ddff81ab49 100644 ---- a/drivers/clocksource/acpi_pm.c -+++ b/drivers/clocksource/acpi_pm.c -@@ -229,8 +229,10 @@ static int __init parse_pmtmr(char *arg) - int ret; - - ret = kstrtouint(arg, 16, &base); -- if (ret) -- return ret; -+ if (ret) { -+ pr_warn("PMTMR: invalid 'pmtmr=' value: '%s'\n", arg); -+ return 1; -+ } - - pr_info("PMTMR IOPort override: 0x%04x -> 0x%04x\n", pmtmr_ioport, - base); -diff --git a/drivers/clocksource/timer-of.c b/drivers/clocksource/timer-of.c -index a3c73e972fce1..bf2a6f64ba0c5 100644 ---- a/drivers/clocksource/timer-of.c -+++ b/drivers/clocksource/timer-of.c -@@ -157,9 +157,9 @@ static __init int timer_of_base_init(struct device_node *np, - of_base->base = of_base->name ? - of_io_request_and_map(np, of_base->index, of_base->name) : - of_iomap(np, of_base->index); -- if (IS_ERR(of_base->base)) { -- pr_err("Failed to iomap (%s)\n", of_base->name); -- return PTR_ERR(of_base->base); -+ if (IS_ERR_OR_NULL(of_base->base)) { -+ pr_err("Failed to iomap (%s:%s)\n", np->name, of_base->name); -+ return of_base->base ? PTR_ERR(of_base->base) : -ENOMEM; - } - - return 0; -diff --git a/drivers/crypto/ccp/ccp-dmaengine.c b/drivers/crypto/ccp/ccp-dmaengine.c -index 0770a83bf1a57..b3eea329f840f 100644 ---- a/drivers/crypto/ccp/ccp-dmaengine.c -+++ b/drivers/crypto/ccp/ccp-dmaengine.c -@@ -633,6 +633,20 @@ static int ccp_terminate_all(struct dma_chan *dma_chan) - return 0; - } - -+static void ccp_dma_release(struct ccp_device *ccp) -+{ -+ struct ccp_dma_chan *chan; -+ struct dma_chan *dma_chan; -+ unsigned int i; -+ -+ for (i = 0; i < ccp->cmd_q_count; i++) { -+ chan = ccp->ccp_dma_chan + i; -+ dma_chan = &chan->dma_chan; -+ tasklet_kill(&chan->cleanup_tasklet); -+ list_del_rcu(&dma_chan->device_node); -+ } -+} -+ - int ccp_dmaengine_register(struct ccp_device *ccp) - { - struct ccp_dma_chan *chan; -@@ -737,6 +751,7 @@ int ccp_dmaengine_register(struct ccp_device *ccp) - return 0; - - err_reg: -+ ccp_dma_release(ccp); - kmem_cache_destroy(ccp->dma_desc_cache); - - err_cache: -@@ -753,6 +768,7 @@ void ccp_dmaengine_unregister(struct ccp_device *ccp) - return; - - dma_async_device_unregister(dma_dev); -+ ccp_dma_release(ccp); - - kmem_cache_destroy(ccp->dma_desc_cache); - kmem_cache_destroy(ccp->dma_cmd_cache); -diff --git a/drivers/crypto/ccree/cc_buffer_mgr.c b/drivers/crypto/ccree/cc_buffer_mgr.c -index 954f14bddf1d7..dce30ae2b7040 100644 ---- a/drivers/crypto/ccree/cc_buffer_mgr.c -+++ b/drivers/crypto/ccree/cc_buffer_mgr.c -@@ -295,6 +295,13 @@ static int cc_map_sg(struct device *dev, struct scatterlist *sg, - { - int ret = 0; - -+ if (!nbytes) { -+ *mapped_nents = 0; -+ *lbytes = 0; -+ *nents = 0; -+ return 0; -+ } -+ - *nents = cc_get_sgl_nents(dev, sg, nbytes, lbytes); - if (*nents > max_sg_nents) { - *nents = 0; -diff --git a/drivers/crypto/mxs-dcp.c b/drivers/crypto/mxs-dcp.c -index 5471110792071..9443f31acd27b 100644 ---- a/drivers/crypto/mxs-dcp.c -+++ b/drivers/crypto/mxs-dcp.c -@@ -329,7 +329,7 @@ static int mxs_dcp_aes_block_crypt(struct crypto_async_request *arq) - memset(key + AES_KEYSIZE_128, 0, AES_KEYSIZE_128); - } - -- for_each_sg(req->src, src, sg_nents(src), i) { -+ for_each_sg(req->src, src, sg_nents(req->src), i) { - src_buf = sg_virt(src); - len = sg_dma_len(src); - tlen += len; -diff --git a/drivers/crypto/vmx/Kconfig b/drivers/crypto/vmx/Kconfig -index c85fab7ef0bdd..b2c28b87f14b3 100644 ---- a/drivers/crypto/vmx/Kconfig -+++ b/drivers/crypto/vmx/Kconfig -@@ -2,7 +2,11 @@ - config CRYPTO_DEV_VMX_ENCRYPT - tristate "Encryption acceleration support on P8 CPU" - depends on CRYPTO_DEV_VMX -+ select CRYPTO_AES -+ select CRYPTO_CBC -+ select CRYPTO_CTR - select CRYPTO_GHASH -+ select CRYPTO_XTS - default m - help - Support for VMX cryptographic acceleration instructions on Power8 CPU. -diff --git a/drivers/dax/super.c b/drivers/dax/super.c -index 8074e5de815b9..5005b92b197d7 100644 ---- a/drivers/dax/super.c -+++ b/drivers/dax/super.c -@@ -691,6 +691,7 @@ static int dax_fs_init(void) - static void dax_fs_exit(void) - { - kern_unmount(dax_mnt); -+ rcu_barrier(); - kmem_cache_destroy(dax_cache); - } - -diff --git a/drivers/dma-buf/udmabuf.c b/drivers/dma-buf/udmabuf.c -index 9635897458a09..e553c6a937f69 100644 ---- a/drivers/dma-buf/udmabuf.c -+++ b/drivers/dma-buf/udmabuf.c -@@ -145,6 +145,10 @@ static long udmabuf_create(const struct udmabuf_create_list *head, - if (ubuf->pagecount > pglimit) - goto err; - } -+ -+ if (!ubuf->pagecount) -+ goto err; -+ - ubuf->pages = kmalloc_array(ubuf->pagecount, sizeof(*ubuf->pages), - GFP_KERNEL); - if (!ubuf->pages) { -diff --git a/drivers/dma/sh/shdma-base.c b/drivers/dma/sh/shdma-base.c -index 19eee3d0900b0..c51de498b5b4b 100644 ---- a/drivers/dma/sh/shdma-base.c -+++ b/drivers/dma/sh/shdma-base.c -@@ -115,10 +115,8 @@ static dma_cookie_t shdma_tx_submit(struct dma_async_tx_descriptor *tx) - ret = pm_runtime_get(schan->dev); - - spin_unlock_irq(&schan->chan_lock); -- if (ret < 0) { -+ if (ret < 0) - dev_err(schan->dev, "%s(): GET = %d\n", __func__, ret); -- pm_runtime_put(schan->dev); -- } - - pm_runtime_barrier(schan->dev); - -diff --git a/drivers/firmware/google/Kconfig b/drivers/firmware/google/Kconfig -index 2fba0aa7fc54d..20dfe39a0537a 100644 ---- a/drivers/firmware/google/Kconfig -+++ b/drivers/firmware/google/Kconfig -@@ -21,7 +21,7 @@ config GOOGLE_SMI - - config GOOGLE_COREBOOT_TABLE - tristate "Coreboot Table Access" -- depends on ACPI || OF -+ depends on HAS_IOMEM && (ACPI || OF) - help - This option enables the coreboot_table module, which provides other - firmware modules access to the coreboot table. The coreboot table -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v10.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v10.c -index ce30d4e8bf25f..f7c4337c1ffe6 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v10.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v10.c -@@ -165,7 +165,7 @@ static const struct kfd2kgd_calls kfd2kgd = { - .get_tile_config = amdgpu_amdkfd_get_tile_config, - }; - --struct kfd2kgd_calls *amdgpu_amdkfd_gfx_10_0_get_functions() -+struct kfd2kgd_calls *amdgpu_amdkfd_gfx_10_0_get_functions(void) - { - return (struct kfd2kgd_calls *)&kfd2kgd; - } -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c -index 82823d9a8ba88..fddeea2b17e50 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c -@@ -1542,6 +1542,7 @@ int amdgpu_cs_fence_to_handle_ioctl(struct drm_device *dev, void *data, - return 0; - - default: -+ dma_fence_put(fence); - return -EINVAL; - } - } -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c -index f9bef3154b998..2659202f2026b 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c -@@ -263,7 +263,7 @@ static int amdgpu_gfx_kiq_acquire(struct amdgpu_device *adev, - * adev->gfx.mec.num_pipe_per_mec - * adev->gfx.mec.num_queue_per_pipe; - -- while (queue_bit-- >= 0) { -+ while (--queue_bit >= 0) { - if (test_bit(queue_bit, adev->gfx.mec.queue_bitmap)) - continue; - -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c -index 532d1842f6a30..4cc0dd494a42b 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c -@@ -1305,7 +1305,8 @@ void amdgpu_bo_release_notify(struct ttm_buffer_object *bo) - !(abo->flags & AMDGPU_GEM_CREATE_VRAM_WIPE_ON_RELEASE)) - return; - -- dma_resv_lock(bo->base.resv, NULL); -+ if (WARN_ON_ONCE(!dma_resv_trylock(bo->base.resv))) -+ return; - - r = amdgpu_fill_buffer(abo, AMDGPU_POISON, bo->base.resv, &fence); - if (!WARN_ON(r)) { -diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_crat.c b/drivers/gpu/drm/amd/amdkfd/kfd_crat.c -index 66387caf966e2..3685e89415d5c 100644 ---- a/drivers/gpu/drm/amd/amdkfd/kfd_crat.c -+++ b/drivers/gpu/drm/amd/amdkfd/kfd_crat.c -@@ -758,7 +758,7 @@ int kfd_create_crat_image_acpi(void **crat_image, size_t *size) - /* Fetch the CRAT table from ACPI */ - status = acpi_get_table(CRAT_SIGNATURE, 0, &crat_table); - if (status == AE_NOT_FOUND) { -- pr_warn("CRAT table not found\n"); -+ pr_info("CRAT table not found\n"); - return -ENODATA; - } else if (ACPI_FAILURE(status)) { - const char *err = acpi_format_exception(status); -diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_module.c b/drivers/gpu/drm/amd/amdkfd/kfd_module.c -index 986ff52d5750c..f4b7f7e6c40e4 100644 ---- a/drivers/gpu/drm/amd/amdkfd/kfd_module.c -+++ b/drivers/gpu/drm/amd/amdkfd/kfd_module.c -@@ -82,7 +82,7 @@ static void kfd_exit(void) - kfd_chardev_exit(); - } - --int kgd2kfd_init() -+int kgd2kfd_init(void) - { - return kfd_init(); - } -diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -index 8e4d863c7570b..c5231c50c4126 100644 ---- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -@@ -5013,6 +5013,9 @@ static void amdgpu_dm_connector_add_common_modes(struct drm_encoder *encoder, - mode = amdgpu_dm_create_common_mode(encoder, - common_modes[i].name, common_modes[i].w, - common_modes[i].h); -+ if (!mode) -+ continue; -+ - drm_mode_probed_add(connector, mode); - amdgpu_dm_connector->num_modes++; - } -@@ -7265,10 +7268,13 @@ cleanup: - static int add_affected_mst_dsc_crtcs(struct drm_atomic_state *state, struct drm_crtc *crtc) - { - struct drm_connector *connector; -- struct drm_connector_state *conn_state; -+ struct drm_connector_state *conn_state, *old_conn_state; - struct amdgpu_dm_connector *aconnector = NULL; - int i; -- for_each_new_connector_in_state(state, connector, conn_state, i) { -+ for_each_oldnew_connector_in_state(state, connector, old_conn_state, conn_state, i) { -+ if (!conn_state->crtc) -+ conn_state = old_conn_state; -+ - if (conn_state->crtc != crtc) - continue; - -diff --git a/drivers/gpu/drm/amd/display/dc/irq/dcn21/irq_service_dcn21.c b/drivers/gpu/drm/amd/display/dc/irq/dcn21/irq_service_dcn21.c -index 623455cd75203..d6f988403941b 100644 ---- a/drivers/gpu/drm/amd/display/dc/irq/dcn21/irq_service_dcn21.c -+++ b/drivers/gpu/drm/amd/display/dc/irq/dcn21/irq_service_dcn21.c -@@ -227,14 +227,6 @@ static const struct irq_source_info_funcs vupdate_no_lock_irq_info_funcs = { - .funcs = &pflip_irq_info_funcs\ - } - --#define vupdate_int_entry(reg_num)\ -- [DC_IRQ_SOURCE_VUPDATE1 + reg_num] = {\ -- IRQ_REG_ENTRY(OTG, reg_num,\ -- OTG_GLOBAL_SYNC_STATUS, VUPDATE_INT_EN,\ -- OTG_GLOBAL_SYNC_STATUS, VUPDATE_EVENT_CLEAR),\ -- .funcs = &vblank_irq_info_funcs\ -- } -- - /* vupdate_no_lock_int_entry maps to DC_IRQ_SOURCE_VUPDATEx, to match semantic - * of DCE's DC_IRQ_SOURCE_VUPDATEx. - */ -@@ -348,12 +340,6 @@ irq_source_info_dcn21[DAL_IRQ_SOURCES_NUMBER] = { - dc_underflow_int_entry(6), - [DC_IRQ_SOURCE_DMCU_SCP] = dummy_irq_entry(), - [DC_IRQ_SOURCE_VBIOS_SW] = dummy_irq_entry(), -- vupdate_int_entry(0), -- vupdate_int_entry(1), -- vupdate_int_entry(2), -- vupdate_int_entry(3), -- vupdate_int_entry(4), -- vupdate_int_entry(5), - vupdate_no_lock_int_entry(0), - vupdate_no_lock_int_entry(1), - vupdate_no_lock_int_entry(2), -diff --git a/drivers/gpu/drm/bridge/cdns-dsi.c b/drivers/gpu/drm/bridge/cdns-dsi.c -index 0cb9dd6986ec3..9c3f9110895e8 100644 ---- a/drivers/gpu/drm/bridge/cdns-dsi.c -+++ b/drivers/gpu/drm/bridge/cdns-dsi.c -@@ -1284,6 +1284,7 @@ static const struct of_device_id cdns_dsi_of_match[] = { - { .compatible = "cdns,dsi" }, - { }, - }; -+MODULE_DEVICE_TABLE(of, cdns_dsi_of_match); - - static struct platform_driver cdns_dsi_platform_driver = { - .probe = cdns_dsi_drm_probe, -diff --git a/drivers/gpu/drm/bridge/sil-sii8620.c b/drivers/gpu/drm/bridge/sil-sii8620.c -index 04431dbac4a4f..fb0b64c965b74 100644 ---- a/drivers/gpu/drm/bridge/sil-sii8620.c -+++ b/drivers/gpu/drm/bridge/sil-sii8620.c -@@ -2118,7 +2118,7 @@ static void sii8620_init_rcp_input_dev(struct sii8620 *ctx) - if (ret) { - dev_err(ctx->dev, "Failed to register RC device\n"); - ctx->error = ret; -- rc_free_device(ctx->rc_dev); -+ rc_free_device(rc_dev); - return; - } - ctx->rc_dev = rc_dev; -diff --git a/drivers/gpu/drm/bridge/synopsys/dw-mipi-dsi.c b/drivers/gpu/drm/bridge/synopsys/dw-mipi-dsi.c -index 77384c49fb8dd..2fc27931d3b56 100644 ---- a/drivers/gpu/drm/bridge/synopsys/dw-mipi-dsi.c -+++ b/drivers/gpu/drm/bridge/synopsys/dw-mipi-dsi.c -@@ -1057,6 +1057,7 @@ __dw_mipi_dsi_probe(struct platform_device *pdev, - ret = mipi_dsi_host_register(&dsi->dsi_host); - if (ret) { - dev_err(dev, "Failed to register MIPI host: %d\n", ret); -+ pm_runtime_disable(dev); - dw_mipi_dsi_debugfs_remove(dsi); - return ERR_PTR(ret); - } -diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c -index 3f0a798906004..aeeab1b57aad3 100644 ---- a/drivers/gpu/drm/drm_edid.c -+++ b/drivers/gpu/drm/drm_edid.c -@@ -4380,7 +4380,8 @@ bool drm_detect_monitor_audio(struct edid *edid) - if (!edid_ext) - goto end; - -- has_audio = ((edid_ext[3] & EDID_BASIC_AUDIO) != 0); -+ has_audio = (edid_ext[0] == CEA_EXT && -+ (edid_ext[3] & EDID_BASIC_AUDIO) != 0); - - if (has_audio) { - DRM_DEBUG_KMS("Monitor has basic audio support\n"); -@@ -4533,16 +4534,8 @@ static void drm_parse_hdmi_deep_color_info(struct drm_connector *connector, - connector->name, dc_bpc); - info->bpc = dc_bpc; - -- /* -- * Deep color support mandates RGB444 support for all video -- * modes and forbids YCRCB422 support for all video modes per -- * HDMI 1.3 spec. -- */ -- info->color_formats = DRM_COLOR_FORMAT_RGB444; -- - /* YCRCB444 is optional according to spec. */ - if (hdmi[6] & DRM_EDID_HDMI_DC_Y444) { -- info->color_formats |= DRM_COLOR_FORMAT_YCRCB444; - DRM_DEBUG("%s: HDMI sink does YCRCB444 in deep color.\n", - connector->name); - } -diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c -index 448c2f2d803a6..f5ab891731d0b 100644 ---- a/drivers/gpu/drm/drm_panel_orientation_quirks.c -+++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c -@@ -166,6 +166,12 @@ static const struct dmi_system_id orientation_data[] = { - DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "MicroPC"), - }, - .driver_data = (void *)&lcd720x1280_rightside_up, -+ }, { /* GPD Win Max */ -+ .matches = { -+ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "GPD"), -+ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "G1619-01"), -+ }, -+ .driver_data = (void *)&lcd800x1280_rightside_up, - }, { /* - * GPD Pocket, note that the the DMI data is less generic then - * it seems, devices with a board-vendor of "AMI Corporation" -diff --git a/drivers/gpu/drm/imx/parallel-display.c b/drivers/gpu/drm/imx/parallel-display.c -index be55548f352af..e24272428744c 100644 ---- a/drivers/gpu/drm/imx/parallel-display.c -+++ b/drivers/gpu/drm/imx/parallel-display.c -@@ -68,8 +68,10 @@ static int imx_pd_connector_get_modes(struct drm_connector *connector) - ret = of_get_drm_display_mode(np, &imxpd->mode, - &imxpd->bus_flags, - OF_USE_NATIVE_MODE); -- if (ret) -+ if (ret) { -+ drm_mode_destroy(connector->dev, mode); - return ret; -+ } - - drm_mode_copy(mode, &imxpd->mode); - mode->type |= DRM_MODE_TYPE_DRIVER | DRM_MODE_TYPE_PREFERRED, -diff --git a/drivers/gpu/drm/tegra/dsi.c b/drivers/gpu/drm/tegra/dsi.c -index a5d47e301c5f7..13413d2b26028 100644 ---- a/drivers/gpu/drm/tegra/dsi.c -+++ b/drivers/gpu/drm/tegra/dsi.c -@@ -1455,8 +1455,10 @@ static int tegra_dsi_ganged_probe(struct tegra_dsi *dsi) - dsi->slave = platform_get_drvdata(gangster); - of_node_put(np); - -- if (!dsi->slave) -+ if (!dsi->slave) { -+ put_device(&gangster->dev); - return -EPROBE_DEFER; -+ } - - dsi->slave->master = dsi; - } -diff --git a/drivers/greybus/svc.c b/drivers/greybus/svc.c -index ce7740ef449ba..51d0875a34800 100644 ---- a/drivers/greybus/svc.c -+++ b/drivers/greybus/svc.c -@@ -866,8 +866,14 @@ static int gb_svc_hello(struct gb_operation *op) - - gb_svc_debugfs_init(svc); - -- return gb_svc_queue_deferred_request(op); -+ ret = gb_svc_queue_deferred_request(op); -+ if (ret) -+ goto err_remove_debugfs; -+ -+ return 0; - -+err_remove_debugfs: -+ gb_svc_debugfs_exit(svc); - err_unregister_device: - gb_svc_watchdog_destroy(svc); - device_del(&svc->dev); -diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c -index 4267e2f2e70f4..a663cbb7b6832 100644 ---- a/drivers/hid/hid-logitech-dj.c -+++ b/drivers/hid/hid-logitech-dj.c -@@ -1000,6 +1000,7 @@ static void logi_hidpp_recv_queue_notif(struct hid_device *hdev, - workitem.reports_supported |= STD_KEYBOARD; - break; - case 0x0f: -+ case 0x11: - device_type = "eQUAD Lightspeed 1.2"; - logi_hidpp_dev_conn_notif_equad(hdev, hidpp_report, &workitem); - workitem.reports_supported |= STD_KEYBOARD; -diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c -index ac076ac73de5d..1547b0ec6a113 100644 ---- a/drivers/hid/i2c-hid/i2c-hid-core.c -+++ b/drivers/hid/i2c-hid/i2c-hid-core.c -@@ -622,6 +622,17 @@ static int i2c_hid_get_raw_report(struct hid_device *hid, - if (report_type == HID_OUTPUT_REPORT) - return -EINVAL; - -+ /* -+ * In case of unnumbered reports the response from the device will -+ * not have the report ID that the upper layers expect, so we need -+ * to stash it the buffer ourselves and adjust the data size. -+ */ -+ if (!report_number) { -+ buf[0] = 0; -+ buf++; -+ count--; -+ } -+ - /* +2 bytes to include the size of the reply in the query buffer */ - ask_count = min(count + 2, (size_t)ihid->bufsize); - -@@ -643,6 +654,9 @@ static int i2c_hid_get_raw_report(struct hid_device *hid, - count = min(count, ret_count - 2); - memcpy(buf, ihid->rawbuf + 2, count); - -+ if (!report_number) -+ count++; -+ - return count; - } - -@@ -659,17 +673,19 @@ static int i2c_hid_output_raw_report(struct hid_device *hid, __u8 *buf, - - mutex_lock(&ihid->reset_lock); - -- if (report_id) { -- buf++; -- count--; -- } -- -+ /* -+ * Note that both numbered and unnumbered reports passed here -+ * are supposed to have report ID stored in the 1st byte of the -+ * buffer, so we strip it off unconditionally before passing payload -+ * to i2c_hid_set_or_send_report which takes care of encoding -+ * everything properly. -+ */ - ret = i2c_hid_set_or_send_report(client, - report_type == HID_FEATURE_REPORT ? 0x03 : 0x02, -- report_id, buf, count, use_data); -+ report_id, buf + 1, count - 1, use_data); - -- if (report_id && ret >= 0) -- ret++; /* add report_id to the number of transfered bytes */ -+ if (ret >= 0) -+ ret++; /* add report_id to the number of transferred bytes */ - - mutex_unlock(&ihid->reset_lock); - -diff --git a/drivers/hid/intel-ish-hid/ishtp-fw-loader.c b/drivers/hid/intel-ish-hid/ishtp-fw-loader.c -index 6cf59fd26ad78..b6d6d119035ca 100644 ---- a/drivers/hid/intel-ish-hid/ishtp-fw-loader.c -+++ b/drivers/hid/intel-ish-hid/ishtp-fw-loader.c -@@ -656,21 +656,12 @@ static int ish_fw_xfer_direct_dma(struct ishtp_cl_data *client_data, - */ - payload_max_size &= ~(L1_CACHE_BYTES - 1); - -- dma_buf = kmalloc(payload_max_size, GFP_KERNEL | GFP_DMA32); -+ dma_buf = dma_alloc_coherent(devc, payload_max_size, &dma_buf_phy, GFP_KERNEL); - if (!dma_buf) { - client_data->flag_retry = true; - return -ENOMEM; - } - -- dma_buf_phy = dma_map_single(devc, dma_buf, payload_max_size, -- DMA_TO_DEVICE); -- if (dma_mapping_error(devc, dma_buf_phy)) { -- dev_err(cl_data_to_dev(client_data), "DMA map failed\n"); -- client_data->flag_retry = true; -- rv = -ENOMEM; -- goto end_err_dma_buf_release; -- } -- - ldr_xfer_dma_frag.fragment.hdr.command = LOADER_CMD_XFER_FRAGMENT; - ldr_xfer_dma_frag.fragment.xfer_mode = LOADER_XFER_MODE_DIRECT_DMA; - ldr_xfer_dma_frag.ddr_phys_addr = (u64)dma_buf_phy; -@@ -690,14 +681,7 @@ static int ish_fw_xfer_direct_dma(struct ishtp_cl_data *client_data, - ldr_xfer_dma_frag.fragment.size = fragment_size; - memcpy(dma_buf, &fw->data[fragment_offset], fragment_size); - -- dma_sync_single_for_device(devc, dma_buf_phy, -- payload_max_size, -- DMA_TO_DEVICE); -- -- /* -- * Flush cache here because the dma_sync_single_for_device() -- * does not do for x86. -- */ -+ /* Flush cache to be sure the data is in main memory. */ - clflush_cache_range(dma_buf, payload_max_size); - - dev_dbg(cl_data_to_dev(client_data), -@@ -720,15 +704,8 @@ static int ish_fw_xfer_direct_dma(struct ishtp_cl_data *client_data, - fragment_offset += fragment_size; - } - -- dma_unmap_single(devc, dma_buf_phy, payload_max_size, DMA_TO_DEVICE); -- kfree(dma_buf); -- return 0; -- - end_err_resp_buf_release: -- /* Free ISH buffer if not done already, in error case */ -- dma_unmap_single(devc, dma_buf_phy, payload_max_size, DMA_TO_DEVICE); --end_err_dma_buf_release: -- kfree(dma_buf); -+ dma_free_coherent(devc, payload_max_size, dma_buf, dma_buf_phy); - return rv; - } - -diff --git a/drivers/hv/hv_balloon.c b/drivers/hv/hv_balloon.c -index bd4e72f6dfd49..44d6de6fc03da 100644 ---- a/drivers/hv/hv_balloon.c -+++ b/drivers/hv/hv_balloon.c -@@ -1550,7 +1550,7 @@ static void balloon_onchannelcallback(void *context) - break; - - default: -- pr_warn("Unhandled message: type: %d\n", dm_hdr->type); -+ pr_warn_ratelimited("Unhandled message: type: %d\n", dm_hdr->type); - - } - } -diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c -index 6b7ab8f234e87..943654ded73d0 100644 ---- a/drivers/hv/vmbus_drv.c -+++ b/drivers/hv/vmbus_drv.c -@@ -2493,10 +2493,15 @@ static void __exit vmbus_exit(void) - if (ms_hyperv.misc_features & HV_FEATURE_GUEST_CRASH_MSR_AVAILABLE) { - kmsg_dump_unregister(&hv_kmsg_dumper); - unregister_die_notifier(&hyperv_die_block); -- atomic_notifier_chain_unregister(&panic_notifier_list, -- &hyperv_panic_block); - } - -+ /* -+ * The panic notifier is always registered, hence we should -+ * also unconditionally unregister it here as well. -+ */ -+ atomic_notifier_chain_unregister(&panic_notifier_list, -+ &hyperv_panic_block); -+ - free_page((unsigned long)hv_panic_page); - unregister_sysctl_table(hv_ctl_table_hdr); - hv_ctl_table_hdr = NULL; -diff --git a/drivers/hwmon/pmbus/pmbus.h b/drivers/hwmon/pmbus/pmbus.h -index d198af3a92b6f..9731f1f830b16 100644 ---- a/drivers/hwmon/pmbus/pmbus.h -+++ b/drivers/hwmon/pmbus/pmbus.h -@@ -292,6 +292,7 @@ enum pmbus_fan_mode { percent = 0, rpm }; - /* - * STATUS_VOUT, STATUS_INPUT - */ -+#define PB_VOLTAGE_VIN_OFF BIT(3) - #define PB_VOLTAGE_UV_FAULT BIT(4) - #define PB_VOLTAGE_UV_WARNING BIT(5) - #define PB_VOLTAGE_OV_WARNING BIT(6) -diff --git a/drivers/hwmon/pmbus/pmbus_core.c b/drivers/hwmon/pmbus/pmbus_core.c -index 8470097907bc2..beb443d020c20 100644 ---- a/drivers/hwmon/pmbus/pmbus_core.c -+++ b/drivers/hwmon/pmbus/pmbus_core.c -@@ -1324,7 +1324,7 @@ static const struct pmbus_limit_attr vin_limit_attrs[] = { - .reg = PMBUS_VIN_UV_FAULT_LIMIT, - .attr = "lcrit", - .alarm = "lcrit_alarm", -- .sbit = PB_VOLTAGE_UV_FAULT, -+ .sbit = PB_VOLTAGE_UV_FAULT | PB_VOLTAGE_VIN_OFF, - }, { - .reg = PMBUS_VIN_OV_WARN_LIMIT, - .attr = "max", -@@ -2174,10 +2174,14 @@ static int pmbus_regulator_is_enabled(struct regulator_dev *rdev) - { - struct device *dev = rdev_get_dev(rdev); - struct i2c_client *client = to_i2c_client(dev->parent); -+ struct pmbus_data *data = i2c_get_clientdata(client); - u8 page = rdev_get_id(rdev); - int ret; - -+ mutex_lock(&data->update_lock); - ret = pmbus_read_byte_data(client, page, PMBUS_OPERATION); -+ mutex_unlock(&data->update_lock); -+ - if (ret < 0) - return ret; - -@@ -2188,11 +2192,17 @@ static int _pmbus_regulator_on_off(struct regulator_dev *rdev, bool enable) - { - struct device *dev = rdev_get_dev(rdev); - struct i2c_client *client = to_i2c_client(dev->parent); -+ struct pmbus_data *data = i2c_get_clientdata(client); - u8 page = rdev_get_id(rdev); -+ int ret; - -- return pmbus_update_byte_data(client, page, PMBUS_OPERATION, -- PB_OPERATION_CONTROL_ON, -- enable ? PB_OPERATION_CONTROL_ON : 0); -+ mutex_lock(&data->update_lock); -+ ret = pmbus_update_byte_data(client, page, PMBUS_OPERATION, -+ PB_OPERATION_CONTROL_ON, -+ enable ? PB_OPERATION_CONTROL_ON : 0); -+ mutex_unlock(&data->update_lock); -+ -+ return ret; - } - - static int pmbus_regulator_enable(struct regulator_dev *rdev) -diff --git a/drivers/hwmon/sch56xx-common.c b/drivers/hwmon/sch56xx-common.c -index 6c84780e358e8..066b12990fbfb 100644 ---- a/drivers/hwmon/sch56xx-common.c -+++ b/drivers/hwmon/sch56xx-common.c -@@ -424,7 +424,7 @@ struct sch56xx_watchdog_data *sch56xx_watchdog_register(struct device *parent, - if (nowayout) - set_bit(WDOG_NO_WAY_OUT, &data->wddev.status); - if (output_enable & SCH56XX_WDOG_OUTPUT_ENABLE) -- set_bit(WDOG_ACTIVE, &data->wddev.status); -+ set_bit(WDOG_HW_RUNNING, &data->wddev.status); - - /* Since the watchdog uses a downcounter there is no register to read - the BIOS set timeout from (if any was set at all) -> -diff --git a/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c b/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c -index ee44640edeb52..4c9e2fc533529 100644 ---- a/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c -+++ b/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c -@@ -364,8 +364,12 @@ static ssize_t mode_store(struct device *dev, - mode = ETM_MODE_QELEM(config->mode); - /* start by clearing QE bits */ - config->cfg &= ~(BIT(13) | BIT(14)); -- /* if supported, Q elements with instruction counts are enabled */ -- if ((mode & BIT(0)) && (drvdata->q_support & BIT(0))) -+ /* -+ * if supported, Q elements with instruction counts are enabled. -+ * Always set the low bit for any requested mode. Valid combos are -+ * 0b00, 0b01 and 0b11. -+ */ -+ if (mode && drvdata->q_support) - config->cfg |= BIT(13); - /* - * if supported, Q elements with and without instruction -diff --git a/drivers/i2c/busses/i2c-xiic.c b/drivers/i2c/busses/i2c-xiic.c -index 37b3b9307d076..a48bee59dcdec 100644 ---- a/drivers/i2c/busses/i2c-xiic.c -+++ b/drivers/i2c/busses/i2c-xiic.c -@@ -715,7 +715,6 @@ static const struct i2c_adapter_quirks xiic_quirks = { - - static const struct i2c_adapter xiic_adapter = { - .owner = THIS_MODULE, -- .name = DRIVER_NAME, - .class = I2C_CLASS_DEPRECATED, - .algo = &xiic_algorithm, - .quirks = &xiic_quirks, -@@ -752,6 +751,8 @@ static int xiic_i2c_probe(struct platform_device *pdev) - i2c_set_adapdata(&i2c->adap, i2c); - i2c->adap.dev.parent = &pdev->dev; - i2c->adap.dev.of_node = pdev->dev.of_node; -+ snprintf(i2c->adap.name, sizeof(i2c->adap.name), -+ DRIVER_NAME " %s", pdev->name); - - mutex_init(&i2c->lock); - init_waitqueue_head(&i2c->wait); -diff --git a/drivers/i2c/muxes/i2c-demux-pinctrl.c b/drivers/i2c/muxes/i2c-demux-pinctrl.c -index 5365199a31f41..f7a7405d4350a 100644 ---- a/drivers/i2c/muxes/i2c-demux-pinctrl.c -+++ b/drivers/i2c/muxes/i2c-demux-pinctrl.c -@@ -261,7 +261,7 @@ static int i2c_demux_pinctrl_probe(struct platform_device *pdev) - - err = device_create_file(&pdev->dev, &dev_attr_available_masters); - if (err) -- goto err_rollback; -+ goto err_rollback_activation; - - err = device_create_file(&pdev->dev, &dev_attr_current_master); - if (err) -@@ -271,8 +271,9 @@ static int i2c_demux_pinctrl_probe(struct platform_device *pdev) - - err_rollback_available: - device_remove_file(&pdev->dev, &dev_attr_available_masters); --err_rollback: -+err_rollback_activation: - i2c_demux_deactivate_master(priv); -+err_rollback: - for (j = 0; j < i; j++) { - of_node_put(priv->chan[j].parent_np); - of_changeset_destroy(&priv->chan[j].chgset); -diff --git a/drivers/iio/adc/twl6030-gpadc.c b/drivers/iio/adc/twl6030-gpadc.c -index f24148bd15de4..fb77c3ff5a3e4 100644 ---- a/drivers/iio/adc/twl6030-gpadc.c -+++ b/drivers/iio/adc/twl6030-gpadc.c -@@ -911,6 +911,8 @@ static int twl6030_gpadc_probe(struct platform_device *pdev) - ret = devm_request_threaded_irq(dev, irq, NULL, - twl6030_gpadc_irq_handler, - IRQF_ONESHOT, "twl6030_gpadc", indio_dev); -+ if (ret) -+ return ret; - - ret = twl6030_gpadc_enable_irq(TWL6030_GPADC_RT_SW1_EOC_MASK); - if (ret < 0) { -diff --git a/drivers/iio/afe/iio-rescale.c b/drivers/iio/afe/iio-rescale.c -index e9ceee66d1e7c..d9c41db8155f9 100644 ---- a/drivers/iio/afe/iio-rescale.c -+++ b/drivers/iio/afe/iio-rescale.c -@@ -38,7 +38,7 @@ static int rescale_read_raw(struct iio_dev *indio_dev, - int *val, int *val2, long mask) - { - struct rescale *rescale = iio_priv(indio_dev); -- unsigned long long tmp; -+ s64 tmp; - int ret; - - switch (mask) { -@@ -59,10 +59,10 @@ static int rescale_read_raw(struct iio_dev *indio_dev, - *val2 = rescale->denominator; - return IIO_VAL_FRACTIONAL; - case IIO_VAL_FRACTIONAL_LOG2: -- tmp = *val * 1000000000LL; -- do_div(tmp, rescale->denominator); -+ tmp = (s64)*val * 1000000000LL; -+ tmp = div_s64(tmp, rescale->denominator); - tmp *= rescale->numerator; -- do_div(tmp, 1000000000LL); -+ tmp = div_s64(tmp, 1000000000LL); - *val = tmp; - return ret; - default: -diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c -index 5a8351c9a4265..ca0fe902a7db4 100644 ---- a/drivers/iio/inkern.c -+++ b/drivers/iio/inkern.c -@@ -588,28 +588,50 @@ EXPORT_SYMBOL_GPL(iio_read_channel_average_raw); - static int iio_convert_raw_to_processed_unlocked(struct iio_channel *chan, - int raw, int *processed, unsigned int scale) - { -- int scale_type, scale_val, scale_val2, offset; -+ int scale_type, scale_val, scale_val2; -+ int offset_type, offset_val, offset_val2; - s64 raw64 = raw; -- int ret; - -- ret = iio_channel_read(chan, &offset, NULL, IIO_CHAN_INFO_OFFSET); -- if (ret >= 0) -- raw64 += offset; -+ offset_type = iio_channel_read(chan, &offset_val, &offset_val2, -+ IIO_CHAN_INFO_OFFSET); -+ if (offset_type >= 0) { -+ switch (offset_type) { -+ case IIO_VAL_INT: -+ break; -+ case IIO_VAL_INT_PLUS_MICRO: -+ case IIO_VAL_INT_PLUS_NANO: -+ /* -+ * Both IIO_VAL_INT_PLUS_MICRO and IIO_VAL_INT_PLUS_NANO -+ * implicitely truncate the offset to it's integer form. -+ */ -+ break; -+ case IIO_VAL_FRACTIONAL: -+ offset_val /= offset_val2; -+ break; -+ case IIO_VAL_FRACTIONAL_LOG2: -+ offset_val >>= offset_val2; -+ break; -+ default: -+ return -EINVAL; -+ } -+ -+ raw64 += offset_val; -+ } - - scale_type = iio_channel_read(chan, &scale_val, &scale_val2, - IIO_CHAN_INFO_SCALE); - if (scale_type < 0) { - /* -- * Just pass raw values as processed if no scaling is -- * available. -+ * If no channel scaling is available apply consumer scale to -+ * raw value and return. - */ -- *processed = raw; -+ *processed = raw * scale; - return 0; - } - - switch (scale_type) { - case IIO_VAL_INT: -- *processed = raw64 * scale_val; -+ *processed = raw64 * scale_val * scale; - break; - case IIO_VAL_INT_PLUS_MICRO: - if (scale_val2 < 0) -diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c -index 5e2b688e36fca..de7df5ab06f3b 100644 ---- a/drivers/infiniband/core/cma.c -+++ b/drivers/infiniband/core/cma.c -@@ -2559,7 +2559,7 @@ int rdma_set_ack_timeout(struct rdma_cm_id *id, u8 timeout) - { - struct rdma_id_private *id_priv; - -- if (id->qp_type != IB_QPT_RC) -+ if (id->qp_type != IB_QPT_RC && id->qp_type != IB_QPT_XRC_INI) - return -EINVAL; - - id_priv = container_of(id, struct rdma_id_private, id); -diff --git a/drivers/infiniband/hw/mlx5/devx.c b/drivers/infiniband/hw/mlx5/devx.c -index 664e0f374ac00..747f42855b7bd 100644 ---- a/drivers/infiniband/hw/mlx5/devx.c -+++ b/drivers/infiniband/hw/mlx5/devx.c -@@ -1844,8 +1844,10 @@ subscribe_event_xa_alloc(struct mlx5_devx_event_table *devx_event_table, - key_level2, - obj_event, - GFP_KERNEL); -- if (err) -+ if (err) { -+ kfree(obj_event); - return err; -+ } - INIT_LIST_HEAD(&obj_event->obj_sub_list); - } - -diff --git a/drivers/infiniband/sw/rdmavt/qp.c b/drivers/infiniband/sw/rdmavt/qp.c -index a5152f097cb7a..48e8612c1bc8d 100644 ---- a/drivers/infiniband/sw/rdmavt/qp.c -+++ b/drivers/infiniband/sw/rdmavt/qp.c -@@ -3227,7 +3227,11 @@ serr_no_r_lock: - spin_lock_irqsave(&sqp->s_lock, flags); - rvt_send_complete(sqp, wqe, send_status); - if (sqp->ibqp.qp_type == IB_QPT_RC) { -- int lastwqe = rvt_error_qp(sqp, IB_WC_WR_FLUSH_ERR); -+ int lastwqe; -+ -+ spin_lock(&sqp->r_lock); -+ lastwqe = rvt_error_qp(sqp, IB_WC_WR_FLUSH_ERR); -+ spin_unlock(&sqp->r_lock); - - sqp->s_flags &= ~RVT_S_BUSY; - spin_unlock_irqrestore(&sqp->s_lock, flags); -diff --git a/drivers/input/input.c b/drivers/input/input.c -index f7398b996bacf..e2eb9b9b8363d 100644 ---- a/drivers/input/input.c -+++ b/drivers/input/input.c -@@ -2181,12 +2181,6 @@ int input_register_device(struct input_dev *dev) - /* KEY_RESERVED is not supposed to be transmitted to userspace. */ - __clear_bit(KEY_RESERVED, dev->keybit); - -- /* Buttonpads should not map BTN_RIGHT and/or BTN_MIDDLE. */ -- if (test_bit(INPUT_PROP_BUTTONPAD, dev->propbit)) { -- __clear_bit(BTN_RIGHT, dev->keybit); -- __clear_bit(BTN_MIDDLE, dev->keybit); -- } -- - /* Make sure that bitmasks not mentioned in dev->evbit are clean. */ - input_cleanse_bitmasks(dev); - -diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c -index ef6af714a7e64..02c2fb551f381 100644 ---- a/drivers/iommu/arm-smmu-v3.c -+++ b/drivers/iommu/arm-smmu-v3.c -@@ -1708,6 +1708,7 @@ static irqreturn_t arm_smmu_evtq_thread(int irq, void *dev) - dev_info(smmu->dev, "\t0x%016llx\n", - (unsigned long long)evt[i]); - -+ cond_resched(); - } - - /* -diff --git a/drivers/iommu/iova.c b/drivers/iommu/iova.c -index 906582a21124d..628a586be6959 100644 ---- a/drivers/iommu/iova.c -+++ b/drivers/iommu/iova.c -@@ -138,10 +138,11 @@ __cached_rbnode_delete_update(struct iova_domain *iovad, struct iova *free) - cached_iova = rb_entry(iovad->cached32_node, struct iova, node); - if (free == cached_iova || - (free->pfn_hi < iovad->dma_32bit_pfn && -- free->pfn_lo >= cached_iova->pfn_lo)) { -+ free->pfn_lo >= cached_iova->pfn_lo)) - iovad->cached32_node = rb_next(&free->node); -+ -+ if (free->pfn_lo < iovad->dma_32bit_pfn) - iovad->max32_alloc_size = iovad->dma_32bit_pfn; -- } - - cached_iova = rb_entry(iovad->cached_node, struct iova, node); - if (free->pfn_lo >= cached_iova->pfn_lo) -diff --git a/drivers/iommu/ipmmu-vmsa.c b/drivers/iommu/ipmmu-vmsa.c -index 2639fc7181171..584eefab1dbcd 100644 ---- a/drivers/iommu/ipmmu-vmsa.c -+++ b/drivers/iommu/ipmmu-vmsa.c -@@ -1061,7 +1061,9 @@ static int ipmmu_probe(struct platform_device *pdev) - bitmap_zero(mmu->ctx, IPMMU_CTX_MAX); - mmu->features = of_device_get_match_data(&pdev->dev); - memset(mmu->utlb_ctx, IPMMU_CTX_INVALID, mmu->features->num_utlbs); -- dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(40)); -+ ret = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(40)); -+ if (ret) -+ return ret; - - /* Map I/O memory and request IRQ. */ - res = platform_get_resource(pdev, IORESOURCE_MEM, 0); -diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c -index 9d0b42cb9903e..f589ca2480a1d 100644 ---- a/drivers/irqchip/irq-gic-v3.c -+++ b/drivers/irqchip/irq-gic-v3.c -@@ -162,11 +162,11 @@ static inline void __iomem *gic_dist_base(struct irq_data *d) - } - } - --static void gic_do_wait_for_rwp(void __iomem *base) -+static void gic_do_wait_for_rwp(void __iomem *base, u32 bit) - { - u32 count = 1000000; /* 1s! */ - -- while (readl_relaxed(base + GICD_CTLR) & GICD_CTLR_RWP) { -+ while (readl_relaxed(base + GICD_CTLR) & bit) { - count--; - if (!count) { - pr_err_ratelimited("RWP timeout, gone fishing\n"); -@@ -180,13 +180,13 @@ static void gic_do_wait_for_rwp(void __iomem *base) - /* Wait for completion of a distributor change */ - static void gic_dist_wait_for_rwp(void) - { -- gic_do_wait_for_rwp(gic_data.dist_base); -+ gic_do_wait_for_rwp(gic_data.dist_base, GICD_CTLR_RWP); - } - - /* Wait for completion of a redistributor change */ - static void gic_redist_wait_for_rwp(void) - { -- gic_do_wait_for_rwp(gic_data_rdist_rd_base()); -+ gic_do_wait_for_rwp(gic_data_rdist_rd_base(), GICR_CTLR_RWP); - } - - #ifdef CONFIG_ARM64 -diff --git a/drivers/irqchip/irq-nvic.c b/drivers/irqchip/irq-nvic.c -index 160b39b5cd108..128a26d219e2c 100644 ---- a/drivers/irqchip/irq-nvic.c -+++ b/drivers/irqchip/irq-nvic.c -@@ -105,6 +105,7 @@ static int __init nvic_of_init(struct device_node *node, - - if (!nvic_irq_domain) { - pr_warn("Failed to allocate irq domain\n"); -+ iounmap(nvic_base); - return -ENOMEM; - } - -@@ -114,6 +115,7 @@ static int __init nvic_of_init(struct device_node *node, - if (ret) { - pr_warn("Failed to allocate irq chips\n"); - irq_domain_remove(nvic_irq_domain); -+ iounmap(nvic_base); - return ret; - } - -diff --git a/drivers/irqchip/qcom-pdc.c b/drivers/irqchip/qcom-pdc.c -index faa7d61b9d6c4..239a889df6080 100644 ---- a/drivers/irqchip/qcom-pdc.c -+++ b/drivers/irqchip/qcom-pdc.c -@@ -50,17 +50,18 @@ static u32 pdc_reg_read(int reg, u32 i) - static void pdc_enable_intr(struct irq_data *d, bool on) - { - int pin_out = d->hwirq; -+ unsigned long flags; - u32 index, mask; - u32 enable; - - index = pin_out / 32; - mask = pin_out % 32; - -- raw_spin_lock(&pdc_lock); -+ raw_spin_lock_irqsave(&pdc_lock, flags); - enable = pdc_reg_read(IRQ_ENABLE_BANK, index); - enable = on ? ENABLE_INTR(enable, mask) : CLEAR_INTR(enable, mask); - pdc_reg_write(IRQ_ENABLE_BANK, index, enable); -- raw_spin_unlock(&pdc_lock); -+ raw_spin_unlock_irqrestore(&pdc_lock, flags); - } - - static void qcom_pdc_gic_mask(struct irq_data *d) -diff --git a/drivers/mailbox/tegra-hsp.c b/drivers/mailbox/tegra-hsp.c -index 834b35dc3b137..e9b392dc09bc2 100644 ---- a/drivers/mailbox/tegra-hsp.c -+++ b/drivers/mailbox/tegra-hsp.c -@@ -403,6 +403,11 @@ static int tegra_hsp_mailbox_flush(struct mbox_chan *chan, - value = tegra_hsp_channel_readl(ch, HSP_SM_SHRD_MBOX); - if ((value & HSP_SM_SHRD_MBOX_FULL) == 0) { - mbox_chan_txdone(chan, 0); -+ -+ /* Wait until channel is empty */ -+ if (chan->active_req != NULL) -+ continue; -+ - return 0; - } - -diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c -index 571c04e70343a..3ed8ca47bc6e6 100644 ---- a/drivers/md/dm-crypt.c -+++ b/drivers/md/dm-crypt.c -@@ -2010,7 +2010,7 @@ static int crypt_set_keyring_key(struct crypt_config *cc, const char *key_string - - static int get_key_size(char **key_string) - { -- return (*key_string[0] == ':') ? -EINVAL : strlen(*key_string) >> 1; -+ return (*key_string[0] == ':') ? -EINVAL : (int)(strlen(*key_string) >> 1); - } - - #endif -diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c -index 3f15d8dc2b71f..7a73f2fa0ad72 100644 ---- a/drivers/md/dm-ioctl.c -+++ b/drivers/md/dm-ioctl.c -@@ -17,6 +17,7 @@ - #include - #include - #include -+#include - - #include - -@@ -1696,6 +1697,7 @@ static ioctl_fn lookup_ioctl(unsigned int cmd, int *ioctl_flags) - if (unlikely(cmd >= ARRAY_SIZE(_ioctls))) - return NULL; - -+ cmd = array_index_nospec(cmd, ARRAY_SIZE(_ioctls)); - *ioctl_flags = _ioctls[cmd].flags; - return _ioctls[cmd].fn; - } -diff --git a/drivers/media/i2c/adv7511-v4l2.c b/drivers/media/i2c/adv7511-v4l2.c -index 809fa44ed9880..86267e01c2511 100644 ---- a/drivers/media/i2c/adv7511-v4l2.c -+++ b/drivers/media/i2c/adv7511-v4l2.c -@@ -555,7 +555,7 @@ static void log_infoframe(struct v4l2_subdev *sd, const struct adv7511_cfg_read_ - buffer[3] = 0; - buffer[3] = hdmi_infoframe_checksum(buffer, len + 4); - -- if (hdmi_infoframe_unpack(&frame, buffer, sizeof(buffer)) < 0) { -+ if (hdmi_infoframe_unpack(&frame, buffer, len + 4) < 0) { - v4l2_err(sd, "%s: unpack of %s infoframe failed\n", __func__, cri->desc); - return; - } -diff --git a/drivers/media/i2c/adv7604.c b/drivers/media/i2c/adv7604.c -index b887299ac195f..1cee69919e1b9 100644 ---- a/drivers/media/i2c/adv7604.c -+++ b/drivers/media/i2c/adv7604.c -@@ -2444,7 +2444,7 @@ static int adv76xx_read_infoframe(struct v4l2_subdev *sd, int index, - buffer[i + 3] = infoframe_read(sd, - adv76xx_cri[index].payload_addr + i); - -- if (hdmi_infoframe_unpack(frame, buffer, sizeof(buffer)) < 0) { -+ if (hdmi_infoframe_unpack(frame, buffer, len + 3) < 0) { - v4l2_err(sd, "%s: unpack of %s infoframe failed\n", __func__, - adv76xx_cri[index].desc); - return -ENOENT; -diff --git a/drivers/media/i2c/adv7842.c b/drivers/media/i2c/adv7842.c -index 02cbab826d0b6..a581e822ce6f5 100644 ---- a/drivers/media/i2c/adv7842.c -+++ b/drivers/media/i2c/adv7842.c -@@ -2574,7 +2574,7 @@ static void log_infoframe(struct v4l2_subdev *sd, struct adv7842_cfg_read_infofr - for (i = 0; i < len; i++) - buffer[i + 3] = infoframe_read(sd, cri->payload_addr + i); - -- if (hdmi_infoframe_unpack(&frame, buffer, sizeof(buffer)) < 0) { -+ if (hdmi_infoframe_unpack(&frame, buffer, len + 3) < 0) { - v4l2_err(sd, "%s: unpack of %s infoframe failed\n", __func__, cri->desc); - return; - } -diff --git a/drivers/media/pci/bt8xx/bttv-driver.c b/drivers/media/pci/bt8xx/bttv-driver.c -index 570530d976d21..6441e7d63d971 100644 ---- a/drivers/media/pci/bt8xx/bttv-driver.c -+++ b/drivers/media/pci/bt8xx/bttv-driver.c -@@ -3898,7 +3898,7 @@ static int bttv_register_video(struct bttv *btv) - - /* video */ - vdev_init(btv, &btv->video_dev, &bttv_video_template, "video"); -- btv->video_dev.device_caps = V4L2_CAP_VIDEO_CAPTURE | V4L2_CAP_TUNER | -+ btv->video_dev.device_caps = V4L2_CAP_VIDEO_CAPTURE | - V4L2_CAP_READWRITE | V4L2_CAP_STREAMING; - if (btv->tuner_type != TUNER_ABSENT) - btv->video_dev.device_caps |= V4L2_CAP_TUNER; -@@ -3919,7 +3919,7 @@ static int bttv_register_video(struct bttv *btv) - /* vbi */ - vdev_init(btv, &btv->vbi_dev, &bttv_video_template, "vbi"); - btv->vbi_dev.device_caps = V4L2_CAP_VBI_CAPTURE | V4L2_CAP_READWRITE | -- V4L2_CAP_STREAMING | V4L2_CAP_TUNER; -+ V4L2_CAP_STREAMING; - if (btv->tuner_type != TUNER_ABSENT) - btv->vbi_dev.device_caps |= V4L2_CAP_TUNER; - -diff --git a/drivers/media/pci/cx88/cx88-mpeg.c b/drivers/media/pci/cx88/cx88-mpeg.c -index a57c991b165b1..10d2971ef0624 100644 ---- a/drivers/media/pci/cx88/cx88-mpeg.c -+++ b/drivers/media/pci/cx88/cx88-mpeg.c -@@ -162,6 +162,9 @@ int cx8802_start_dma(struct cx8802_dev *dev, - cx_write(MO_TS_GPCNTRL, GP_COUNT_CONTROL_RESET); - q->count = 0; - -+ /* clear interrupt status register */ -+ cx_write(MO_TS_INTSTAT, 0x1f1111); -+ - /* enable irqs */ - dprintk(1, "setting the interrupt mask\n"); - cx_set(MO_PCI_INTMSK, core->pci_irqmask | PCI_INT_TSINT); -diff --git a/drivers/media/pci/ivtv/ivtv-driver.h b/drivers/media/pci/ivtv/ivtv-driver.h -index cafba6b1055df..90f38552bd362 100644 ---- a/drivers/media/pci/ivtv/ivtv-driver.h -+++ b/drivers/media/pci/ivtv/ivtv-driver.h -@@ -333,7 +333,6 @@ struct ivtv_stream { - struct ivtv *itv; /* for ease of use */ - const char *name; /* name of the stream */ - int type; /* stream type */ -- u32 caps; /* V4L2 capabilities */ - - struct v4l2_fh *fh; /* pointer to the streaming filehandle */ - spinlock_t qlock; /* locks access to the queues */ -diff --git a/drivers/media/pci/ivtv/ivtv-ioctl.c b/drivers/media/pci/ivtv/ivtv-ioctl.c -index 137853944e461..396cc931f41a2 100644 ---- a/drivers/media/pci/ivtv/ivtv-ioctl.c -+++ b/drivers/media/pci/ivtv/ivtv-ioctl.c -@@ -443,7 +443,7 @@ static int ivtv_g_fmt_vid_out_overlay(struct file *file, void *fh, struct v4l2_f - struct ivtv_stream *s = &itv->streams[fh2id(fh)->type]; - struct v4l2_window *winfmt = &fmt->fmt.win; - -- if (!(s->caps & V4L2_CAP_VIDEO_OUTPUT_OVERLAY)) -+ if (!(s->vdev.device_caps & V4L2_CAP_VIDEO_OUTPUT_OVERLAY)) - return -EINVAL; - if (!itv->osd_video_pbase) - return -EINVAL; -@@ -554,7 +554,7 @@ static int ivtv_try_fmt_vid_out_overlay(struct file *file, void *fh, struct v4l2 - u32 chromakey = fmt->fmt.win.chromakey; - u8 global_alpha = fmt->fmt.win.global_alpha; - -- if (!(s->caps & V4L2_CAP_VIDEO_OUTPUT_OVERLAY)) -+ if (!(s->vdev.device_caps & V4L2_CAP_VIDEO_OUTPUT_OVERLAY)) - return -EINVAL; - if (!itv->osd_video_pbase) - return -EINVAL; -@@ -1386,7 +1386,7 @@ static int ivtv_g_fbuf(struct file *file, void *fh, struct v4l2_framebuffer *fb) - 0, - }; - -- if (!(s->caps & V4L2_CAP_VIDEO_OUTPUT_OVERLAY)) -+ if (!(s->vdev.device_caps & V4L2_CAP_VIDEO_OUTPUT_OVERLAY)) - return -ENOTTY; - if (!itv->osd_video_pbase) - return -ENOTTY; -@@ -1453,7 +1453,7 @@ static int ivtv_s_fbuf(struct file *file, void *fh, const struct v4l2_framebuffe - struct ivtv_stream *s = &itv->streams[fh2id(fh)->type]; - struct yuv_playback_info *yi = &itv->yuv_info; - -- if (!(s->caps & V4L2_CAP_VIDEO_OUTPUT_OVERLAY)) -+ if (!(s->vdev.device_caps & V4L2_CAP_VIDEO_OUTPUT_OVERLAY)) - return -ENOTTY; - if (!itv->osd_video_pbase) - return -ENOTTY; -@@ -1473,7 +1473,7 @@ static int ivtv_overlay(struct file *file, void *fh, unsigned int on) - struct ivtv *itv = id->itv; - struct ivtv_stream *s = &itv->streams[fh2id(fh)->type]; - -- if (!(s->caps & V4L2_CAP_VIDEO_OUTPUT_OVERLAY)) -+ if (!(s->vdev.device_caps & V4L2_CAP_VIDEO_OUTPUT_OVERLAY)) - return -ENOTTY; - if (!itv->osd_video_pbase) - return -ENOTTY; -diff --git a/drivers/media/pci/ivtv/ivtv-streams.c b/drivers/media/pci/ivtv/ivtv-streams.c -index f7de9118f609d..200d2100dbffd 100644 ---- a/drivers/media/pci/ivtv/ivtv-streams.c -+++ b/drivers/media/pci/ivtv/ivtv-streams.c -@@ -176,7 +176,7 @@ static void ivtv_stream_init(struct ivtv *itv, int type) - s->itv = itv; - s->type = type; - s->name = ivtv_stream_info[type].name; -- s->caps = ivtv_stream_info[type].v4l2_caps; -+ s->vdev.device_caps = ivtv_stream_info[type].v4l2_caps; - - if (ivtv_stream_info[type].pio) - s->dma = PCI_DMA_NONE; -@@ -299,12 +299,9 @@ static int ivtv_reg_dev(struct ivtv *itv, int type) - if (s_mpg->vdev.v4l2_dev) - num = s_mpg->vdev.num + ivtv_stream_info[type].num_offset; - } -- s->vdev.device_caps = s->caps; -- if (itv->osd_video_pbase) { -- itv->streams[IVTV_DEC_STREAM_TYPE_YUV].vdev.device_caps |= -- V4L2_CAP_VIDEO_OUTPUT_OVERLAY; -- itv->streams[IVTV_DEC_STREAM_TYPE_MPG].vdev.device_caps |= -- V4L2_CAP_VIDEO_OUTPUT_OVERLAY; -+ if (itv->osd_video_pbase && (type == IVTV_DEC_STREAM_TYPE_YUV || -+ type == IVTV_DEC_STREAM_TYPE_MPG)) { -+ s->vdev.device_caps |= V4L2_CAP_VIDEO_OUTPUT_OVERLAY; - itv->v4l2_cap |= V4L2_CAP_VIDEO_OUTPUT_OVERLAY; - } - video_set_drvdata(&s->vdev, s); -diff --git a/drivers/media/platform/aspeed-video.c b/drivers/media/platform/aspeed-video.c -index 1e0867016bf37..c87eddb1c93f7 100644 ---- a/drivers/media/platform/aspeed-video.c -+++ b/drivers/media/platform/aspeed-video.c -@@ -151,7 +151,7 @@ - #define VE_SRC_TB_EDGE_DET_BOT GENMASK(28, VE_SRC_TB_EDGE_DET_BOT_SHF) - - #define VE_MODE_DETECT_STATUS 0x098 --#define VE_MODE_DETECT_H_PIXELS GENMASK(11, 0) -+#define VE_MODE_DETECT_H_PERIOD GENMASK(11, 0) - #define VE_MODE_DETECT_V_LINES_SHF 16 - #define VE_MODE_DETECT_V_LINES GENMASK(27, VE_MODE_DETECT_V_LINES_SHF) - #define VE_MODE_DETECT_STATUS_VSYNC BIT(28) -@@ -162,6 +162,8 @@ - #define VE_SYNC_STATUS_VSYNC_SHF 16 - #define VE_SYNC_STATUS_VSYNC GENMASK(27, VE_SYNC_STATUS_VSYNC_SHF) - -+#define VE_H_TOTAL_PIXELS 0x0A0 -+ - #define VE_INTERRUPT_CTRL 0x304 - #define VE_INTERRUPT_STATUS 0x308 - #define VE_INTERRUPT_MODE_DETECT_WD BIT(0) -@@ -743,6 +745,7 @@ static void aspeed_video_get_resolution(struct aspeed_video *video) - u32 src_lr_edge; - u32 src_tb_edge; - u32 sync; -+ u32 htotal; - struct v4l2_bt_timings *det = &video->detected_timings; - - det->width = MIN_WIDTH; -@@ -787,6 +790,7 @@ static void aspeed_video_get_resolution(struct aspeed_video *video) - src_tb_edge = aspeed_video_read(video, VE_SRC_TB_EDGE_DET); - mds = aspeed_video_read(video, VE_MODE_DETECT_STATUS); - sync = aspeed_video_read(video, VE_SYNC_STATUS); -+ htotal = aspeed_video_read(video, VE_H_TOTAL_PIXELS); - - video->frame_bottom = (src_tb_edge & VE_SRC_TB_EDGE_DET_BOT) >> - VE_SRC_TB_EDGE_DET_BOT_SHF; -@@ -803,8 +807,7 @@ static void aspeed_video_get_resolution(struct aspeed_video *video) - VE_SRC_LR_EDGE_DET_RT_SHF; - video->frame_left = src_lr_edge & VE_SRC_LR_EDGE_DET_LEFT; - det->hfrontporch = video->frame_left; -- det->hbackporch = (mds & VE_MODE_DETECT_H_PIXELS) - -- video->frame_right; -+ det->hbackporch = htotal - video->frame_right; - det->hsync = sync & VE_SYNC_STATUS_HSYNC; - if (video->frame_left > video->frame_right) - continue; -diff --git a/drivers/media/platform/coda/coda-common.c b/drivers/media/platform/coda/coda-common.c -index 834f11fe9dc29..0adc54832657b 100644 ---- a/drivers/media/platform/coda/coda-common.c -+++ b/drivers/media/platform/coda/coda-common.c -@@ -372,6 +372,7 @@ static struct vdoa_data *coda_get_vdoa_data(void) - if (!vdoa_data) - vdoa_data = ERR_PTR(-EPROBE_DEFER); - -+ put_device(&vdoa_pdev->dev); - out: - of_node_put(vdoa_node); - -diff --git a/drivers/media/platform/davinci/vpif.c b/drivers/media/platform/davinci/vpif.c -index df66461f5d4f1..e7e8eba048acf 100644 ---- a/drivers/media/platform/davinci/vpif.c -+++ b/drivers/media/platform/davinci/vpif.c -@@ -496,6 +496,7 @@ static int vpif_probe(struct platform_device *pdev) - - static int vpif_remove(struct platform_device *pdev) - { -+ pm_runtime_put(&pdev->dev); - pm_runtime_disable(&pdev->dev); - return 0; - } -diff --git a/drivers/media/usb/em28xx/em28xx-cards.c b/drivers/media/usb/em28xx/em28xx-cards.c -index bfca9d0a1fe15..5ae13ee9272d5 100644 ---- a/drivers/media/usb/em28xx/em28xx-cards.c -+++ b/drivers/media/usb/em28xx/em28xx-cards.c -@@ -3821,6 +3821,8 @@ static int em28xx_usb_probe(struct usb_interface *intf, - goto err_free; - } - -+ kref_init(&dev->ref); -+ - dev->devno = nr; - dev->model = id->driver_info; - dev->alt = -1; -@@ -3921,6 +3923,8 @@ static int em28xx_usb_probe(struct usb_interface *intf, - } - - if (dev->board.has_dual_ts && em28xx_duplicate_dev(dev) == 0) { -+ kref_init(&dev->dev_next->ref); -+ - dev->dev_next->ts = SECONDARY_TS; - dev->dev_next->alt = -1; - dev->dev_next->is_audio_only = has_vendor_audio && -@@ -3975,12 +3979,8 @@ static int em28xx_usb_probe(struct usb_interface *intf, - em28xx_write_reg(dev, 0x0b, 0x82); - mdelay(100); - } -- -- kref_init(&dev->dev_next->ref); - } - -- kref_init(&dev->ref); -- - request_modules(dev); - - /* -@@ -4035,11 +4035,8 @@ static void em28xx_usb_disconnect(struct usb_interface *intf) - - em28xx_close_extension(dev); - -- if (dev->dev_next) { -- em28xx_close_extension(dev->dev_next); -+ if (dev->dev_next) - em28xx_release_resources(dev->dev_next); -- } -- - em28xx_release_resources(dev); - - if (dev->dev_next) { -diff --git a/drivers/media/usb/go7007/s2250-board.c b/drivers/media/usb/go7007/s2250-board.c -index 49e75a1a1f3f8..af3b18c6d9e17 100644 ---- a/drivers/media/usb/go7007/s2250-board.c -+++ b/drivers/media/usb/go7007/s2250-board.c -@@ -504,6 +504,7 @@ static int s2250_probe(struct i2c_client *client, - u8 *data; - struct go7007 *go = i2c_get_adapdata(adapter); - struct go7007_usb *usb = go->hpi_context; -+ int err = -EIO; - - audio = i2c_new_dummy_device(adapter, TLV320_ADDRESS >> 1); - if (IS_ERR(audio)) -@@ -532,11 +533,8 @@ static int s2250_probe(struct i2c_client *client, - V4L2_CID_HUE, -512, 511, 1, 0); - sd->ctrl_handler = &state->hdl; - if (state->hdl.error) { -- int err = state->hdl.error; -- -- v4l2_ctrl_handler_free(&state->hdl); -- kfree(state); -- return err; -+ err = state->hdl.error; -+ goto fail; - } - - state->std = V4L2_STD_NTSC; -@@ -600,7 +598,7 @@ fail: - i2c_unregister_device(audio); - v4l2_ctrl_handler_free(&state->hdl); - kfree(state); -- return -EIO; -+ return err; - } - - static int s2250_remove(struct i2c_client *client) -diff --git a/drivers/media/usb/hdpvr/hdpvr-video.c b/drivers/media/usb/hdpvr/hdpvr-video.c -index bad71d863d395..7849f1fbbcc4d 100644 ---- a/drivers/media/usb/hdpvr/hdpvr-video.c -+++ b/drivers/media/usb/hdpvr/hdpvr-video.c -@@ -308,7 +308,6 @@ static int hdpvr_start_streaming(struct hdpvr_device *dev) - - dev->status = STATUS_STREAMING; - -- INIT_WORK(&dev->worker, hdpvr_transmit_buffers); - schedule_work(&dev->worker); - - v4l2_dbg(MSG_BUFFER, hdpvr_debug, &dev->v4l2_dev, -@@ -1165,6 +1164,9 @@ int hdpvr_register_videodev(struct hdpvr_device *dev, struct device *parent, - bool ac3 = dev->flags & HDPVR_FLAG_AC3_CAP; - int res; - -+ // initialize dev->worker -+ INIT_WORK(&dev->worker, hdpvr_transmit_buffers); -+ - dev->cur_std = V4L2_STD_525_60; - dev->width = 720; - dev->height = 480; -diff --git a/drivers/media/usb/stk1160/stk1160-core.c b/drivers/media/usb/stk1160/stk1160-core.c -index 4e1698f788187..ce717502ea4c3 100644 ---- a/drivers/media/usb/stk1160/stk1160-core.c -+++ b/drivers/media/usb/stk1160/stk1160-core.c -@@ -403,7 +403,7 @@ static void stk1160_disconnect(struct usb_interface *interface) - /* Here is the only place where isoc get released */ - stk1160_uninit_isoc(dev); - -- stk1160_clear_queue(dev); -+ stk1160_clear_queue(dev, VB2_BUF_STATE_ERROR); - - video_unregister_device(&dev->vdev); - v4l2_device_disconnect(&dev->v4l2_dev); -diff --git a/drivers/media/usb/stk1160/stk1160-v4l.c b/drivers/media/usb/stk1160/stk1160-v4l.c -index bcd14c66e8dfa..a307807571ab9 100644 ---- a/drivers/media/usb/stk1160/stk1160-v4l.c -+++ b/drivers/media/usb/stk1160/stk1160-v4l.c -@@ -258,7 +258,7 @@ out_uninit: - stk1160_uninit_isoc(dev); - out_stop_hw: - usb_set_interface(dev->udev, 0, 0); -- stk1160_clear_queue(dev); -+ stk1160_clear_queue(dev, VB2_BUF_STATE_QUEUED); - - mutex_unlock(&dev->v4l_lock); - -@@ -306,7 +306,7 @@ static int stk1160_stop_streaming(struct stk1160 *dev) - - stk1160_stop_hw(dev); - -- stk1160_clear_queue(dev); -+ stk1160_clear_queue(dev, VB2_BUF_STATE_ERROR); - - stk1160_dbg("streaming stopped\n"); - -@@ -745,7 +745,7 @@ static const struct video_device v4l_template = { - /********************************************************************/ - - /* Must be called with both v4l_lock and vb_queue_lock hold */ --void stk1160_clear_queue(struct stk1160 *dev) -+void stk1160_clear_queue(struct stk1160 *dev, enum vb2_buffer_state vb2_state) - { - struct stk1160_buffer *buf; - unsigned long flags; -@@ -756,7 +756,7 @@ void stk1160_clear_queue(struct stk1160 *dev) - buf = list_first_entry(&dev->avail_bufs, - struct stk1160_buffer, list); - list_del(&buf->list); -- vb2_buffer_done(&buf->vb.vb2_buf, VB2_BUF_STATE_ERROR); -+ vb2_buffer_done(&buf->vb.vb2_buf, vb2_state); - stk1160_dbg("buffer [%p/%d] aborted\n", - buf, buf->vb.vb2_buf.index); - } -@@ -766,7 +766,7 @@ void stk1160_clear_queue(struct stk1160 *dev) - buf = dev->isoc_ctl.buf; - dev->isoc_ctl.buf = NULL; - -- vb2_buffer_done(&buf->vb.vb2_buf, VB2_BUF_STATE_ERROR); -+ vb2_buffer_done(&buf->vb.vb2_buf, vb2_state); - stk1160_dbg("buffer [%p/%d] aborted\n", - buf, buf->vb.vb2_buf.index); - } -diff --git a/drivers/media/usb/stk1160/stk1160.h b/drivers/media/usb/stk1160/stk1160.h -index a31ea1c80f255..a70963ce87533 100644 ---- a/drivers/media/usb/stk1160/stk1160.h -+++ b/drivers/media/usb/stk1160/stk1160.h -@@ -166,7 +166,7 @@ struct regval { - int stk1160_vb2_setup(struct stk1160 *dev); - int stk1160_video_register(struct stk1160 *dev); - void stk1160_video_unregister(struct stk1160 *dev); --void stk1160_clear_queue(struct stk1160 *dev); -+void stk1160_clear_queue(struct stk1160 *dev, enum vb2_buffer_state vb2_state); - - /* Provided by stk1160-video.c */ - int stk1160_alloc_isoc(struct stk1160 *dev); -diff --git a/drivers/memory/emif.c b/drivers/memory/emif.c -index af296b6fcbbdc..9c4c668f9a88a 100644 ---- a/drivers/memory/emif.c -+++ b/drivers/memory/emif.c -@@ -1423,7 +1423,7 @@ static struct emif_data *__init_or_module get_device_details( - temp = devm_kzalloc(dev, sizeof(*pd), GFP_KERNEL); - dev_info = devm_kzalloc(dev, sizeof(*dev_info), GFP_KERNEL); - -- if (!emif || !pd || !dev_info) { -+ if (!emif || !temp || !dev_info) { - dev_err(dev, "%s:%d: allocation error\n", __func__, __LINE__); - goto error; - } -@@ -1515,7 +1515,7 @@ static int __init_or_module emif_probe(struct platform_device *pdev) - { - struct emif_data *emif; - struct resource *res; -- int irq; -+ int irq, ret; - - if (pdev->dev.of_node) - emif = of_get_memory_device_details(pdev->dev.of_node, &pdev->dev); -@@ -1549,7 +1549,9 @@ static int __init_or_module emif_probe(struct platform_device *pdev) - emif_onetime_settings(emif); - emif_debugfs_init(emif); - disable_and_clear_all_interrupts(emif); -- setup_interrupts(emif, irq); -+ ret = setup_interrupts(emif, irq); -+ if (ret) -+ goto error; - - /* One-time actions taken on probing the first device */ - if (!emif1) { -diff --git a/drivers/mfd/asic3.c b/drivers/mfd/asic3.c -index a6bd2134cea2a..14e4bbe6a9da3 100644 ---- a/drivers/mfd/asic3.c -+++ b/drivers/mfd/asic3.c -@@ -914,14 +914,14 @@ static int __init asic3_mfd_probe(struct platform_device *pdev, - ret = mfd_add_devices(&pdev->dev, pdev->id, - &asic3_cell_ds1wm, 1, mem, asic->irq_base, NULL); - if (ret < 0) -- goto out; -+ goto out_unmap; - } - - if (mem_sdio && (irq >= 0)) { - ret = mfd_add_devices(&pdev->dev, pdev->id, - &asic3_cell_mmc, 1, mem_sdio, irq, NULL); - if (ret < 0) -- goto out; -+ goto out_unmap; - } - - ret = 0; -@@ -935,8 +935,12 @@ static int __init asic3_mfd_probe(struct platform_device *pdev, - ret = mfd_add_devices(&pdev->dev, 0, - asic3_cell_leds, ASIC3_NUM_LEDS, NULL, 0, NULL); - } -+ return ret; - -- out: -+out_unmap: -+ if (asic->tmio_cnf) -+ iounmap(asic->tmio_cnf); -+out: - return ret; - } - -diff --git a/drivers/mfd/mc13xxx-core.c b/drivers/mfd/mc13xxx-core.c -index 1abe7432aad82..e281a9202f110 100644 ---- a/drivers/mfd/mc13xxx-core.c -+++ b/drivers/mfd/mc13xxx-core.c -@@ -323,8 +323,10 @@ int mc13xxx_adc_do_conversion(struct mc13xxx *mc13xxx, unsigned int mode, - adc1 |= MC13783_ADC1_ATOX; - - dev_dbg(mc13xxx->dev, "%s: request irq\n", __func__); -- mc13xxx_irq_request(mc13xxx, MC13XXX_IRQ_ADCDONE, -+ ret = mc13xxx_irq_request(mc13xxx, MC13XXX_IRQ_ADCDONE, - mc13xxx_handler_adcdone, __func__, &adcdone_data); -+ if (ret) -+ goto out; - - mc13xxx_reg_write(mc13xxx, MC13XXX_ADC0, adc0); - mc13xxx_reg_write(mc13xxx, MC13XXX_ADC1, adc1); -diff --git a/drivers/misc/cardreader/alcor_pci.c b/drivers/misc/cardreader/alcor_pci.c -index 1fadb95b85b09..ba5d5c102b3cc 100644 ---- a/drivers/misc/cardreader/alcor_pci.c -+++ b/drivers/misc/cardreader/alcor_pci.c -@@ -260,7 +260,7 @@ static int alcor_pci_probe(struct pci_dev *pdev, - if (!priv) - return -ENOMEM; - -- ret = ida_simple_get(&alcor_pci_idr, 0, 0, GFP_KERNEL); -+ ret = ida_alloc(&alcor_pci_idr, GFP_KERNEL); - if (ret < 0) - return ret; - priv->id = ret; -@@ -274,7 +274,8 @@ static int alcor_pci_probe(struct pci_dev *pdev, - ret = pci_request_regions(pdev, DRV_NAME_ALCOR_PCI); - if (ret) { - dev_err(&pdev->dev, "Cannot request region\n"); -- return -ENOMEM; -+ ret = -ENOMEM; -+ goto error_free_ida; - } - - if (!(pci_resource_flags(pdev, bar) & IORESOURCE_MEM)) { -@@ -318,6 +319,8 @@ static int alcor_pci_probe(struct pci_dev *pdev, - - error_release_regions: - pci_release_regions(pdev); -+error_free_ida: -+ ida_free(&alcor_pci_idr, priv->id); - return ret; - } - -@@ -331,7 +334,7 @@ static void alcor_pci_remove(struct pci_dev *pdev) - - mfd_remove_devices(&pdev->dev); - -- ida_simple_remove(&alcor_pci_idr, priv->id); -+ ida_free(&alcor_pci_idr, priv->id); - - pci_release_regions(pdev); - pci_set_drvdata(pdev, NULL); -diff --git a/drivers/misc/kgdbts.c b/drivers/misc/kgdbts.c -index 8d18f19c99c4b..2f88581057335 100644 ---- a/drivers/misc/kgdbts.c -+++ b/drivers/misc/kgdbts.c -@@ -1060,10 +1060,10 @@ static int kgdbts_option_setup(char *opt) - { - if (strlen(opt) >= MAX_CONFIG_LEN) { - printk(KERN_ERR "kgdbts: config string too long\n"); -- return -ENOSPC; -+ return 1; - } - strcpy(config, opt); -- return 0; -+ return 1; - } - - __setup("kgdbts=", kgdbts_option_setup); -diff --git a/drivers/mmc/core/host.c b/drivers/mmc/core/host.c -index e955f1ef25643..32801639e0be5 100644 ---- a/drivers/mmc/core/host.c -+++ b/drivers/mmc/core/host.c -@@ -497,6 +497,16 @@ struct mmc_host *mmc_alloc_host(int extra, struct device *dev) - - EXPORT_SYMBOL(mmc_alloc_host); - -+static int mmc_validate_host_caps(struct mmc_host *host) -+{ -+ if (host->caps & MMC_CAP_SDIO_IRQ && !host->ops->enable_sdio_irq) { -+ dev_warn(host->parent, "missing ->enable_sdio_irq() ops\n"); -+ return -EINVAL; -+ } -+ -+ return 0; -+} -+ - /** - * mmc_add_host - initialise host hardware - * @host: mmc host -@@ -509,8 +519,9 @@ int mmc_add_host(struct mmc_host *host) - { - int err; - -- WARN_ON((host->caps & MMC_CAP_SDIO_IRQ) && -- !host->ops->enable_sdio_irq); -+ err = mmc_validate_host_caps(host); -+ if (err) -+ return err; - - err = device_add(&host->class_dev); - if (err) -diff --git a/drivers/mmc/host/davinci_mmc.c b/drivers/mmc/host/davinci_mmc.c -index ebfaeb33bc8c0..ade7c022a33c0 100644 ---- a/drivers/mmc/host/davinci_mmc.c -+++ b/drivers/mmc/host/davinci_mmc.c -@@ -1376,8 +1376,12 @@ static int davinci_mmcsd_suspend(struct device *dev) - static int davinci_mmcsd_resume(struct device *dev) - { - struct mmc_davinci_host *host = dev_get_drvdata(dev); -+ int ret; -+ -+ ret = clk_enable(host->clk); -+ if (ret) -+ return ret; - -- clk_enable(host->clk); - mmc_davinci_reset_ctrl(host, 0); - - return 0; -diff --git a/drivers/mmc/host/mmci_stm32_sdmmc.c b/drivers/mmc/host/mmci_stm32_sdmmc.c -index 0953bd8a4f79d..3bb59d670220f 100644 ---- a/drivers/mmc/host/mmci_stm32_sdmmc.c -+++ b/drivers/mmc/host/mmci_stm32_sdmmc.c -@@ -36,8 +36,8 @@ int sdmmc_idma_validate_data(struct mmci_host *host, - * excepted the last element which has no constraint on idmasize - */ - for_each_sg(data->sg, sg, data->sg_len - 1, i) { -- if (!IS_ALIGNED(sg_dma_address(data->sg), sizeof(u32)) || -- !IS_ALIGNED(sg_dma_len(data->sg), SDMMC_IDMA_BURST)) { -+ if (!IS_ALIGNED(sg->offset, sizeof(u32)) || -+ !IS_ALIGNED(sg->length, SDMMC_IDMA_BURST)) { - dev_err(mmc_dev(host->mmc), - "unaligned scatterlist: ofst:%x length:%d\n", - data->sg->offset, data->sg->length); -@@ -45,7 +45,7 @@ int sdmmc_idma_validate_data(struct mmci_host *host, - } - } - -- if (!IS_ALIGNED(sg_dma_address(data->sg), sizeof(u32))) { -+ if (!IS_ALIGNED(sg->offset, sizeof(u32))) { - dev_err(mmc_dev(host->mmc), - "unaligned last scatterlist: ofst:%x length:%d\n", - data->sg->offset, data->sg->length); -diff --git a/drivers/mmc/host/renesas_sdhi_core.c b/drivers/mmc/host/renesas_sdhi_core.c -index 689eb119d44fc..23fd93407eced 100644 ---- a/drivers/mmc/host/renesas_sdhi_core.c -+++ b/drivers/mmc/host/renesas_sdhi_core.c -@@ -349,10 +349,10 @@ static void renesas_sdhi_hs400_complete(struct tmio_mmc_host *host) - SH_MOBILE_SDHI_SCC_TMPPORT2_HS400OSEL) | - sd_scc_read32(host, priv, SH_MOBILE_SDHI_SCC_TMPPORT2)); - -- /* Set the sampling clock selection range of HS400 mode */ - sd_scc_write32(host, priv, SH_MOBILE_SDHI_SCC_DTCNTL, - SH_MOBILE_SDHI_SCC_DTCNTL_TAPEN | -- 0x4 << SH_MOBILE_SDHI_SCC_DTCNTL_TAPNUM_SHIFT); -+ sd_scc_read32(host, priv, -+ SH_MOBILE_SDHI_SCC_DTCNTL)); - - - if (host->pdata->flags & TMIO_MMC_HAVE_4TAP_HS400) -diff --git a/drivers/mmc/host/sdhci-xenon.c b/drivers/mmc/host/sdhci-xenon.c -index 5f57e78e5f13f..6f6fb4c4448f0 100644 ---- a/drivers/mmc/host/sdhci-xenon.c -+++ b/drivers/mmc/host/sdhci-xenon.c -@@ -240,16 +240,6 @@ static void xenon_voltage_switch(struct sdhci_host *host) - { - /* Wait for 5ms after set 1.8V signal enable bit */ - usleep_range(5000, 5500); -- -- /* -- * For some reason the controller's Host Control2 register reports -- * the bit representing 1.8V signaling as 0 when read after it was -- * written as 1. Subsequent read reports 1. -- * -- * Since this may cause some issues, do an empty read of the Host -- * Control2 register here to circumvent this. -- */ -- sdhci_readw(host, SDHCI_HOST_CONTROL2); - } - - static const struct sdhci_ops sdhci_xenon_ops = { -diff --git a/drivers/mtd/nand/onenand/generic.c b/drivers/mtd/nand/onenand/generic.c -index 8b6f4da5d7201..a4b8b65fe15f5 100644 ---- a/drivers/mtd/nand/onenand/generic.c -+++ b/drivers/mtd/nand/onenand/generic.c -@@ -53,7 +53,12 @@ static int generic_onenand_probe(struct platform_device *pdev) - } - - info->onenand.mmcontrol = pdata ? pdata->mmcontrol : NULL; -- info->onenand.irq = platform_get_irq(pdev, 0); -+ -+ err = platform_get_irq(pdev, 0); -+ if (err < 0) -+ goto out_iounmap; -+ -+ info->onenand.irq = err; - - info->mtd.dev.parent = &pdev->dev; - info->mtd.priv = &info->onenand; -diff --git a/drivers/mtd/nand/raw/atmel/nand-controller.c b/drivers/mtd/nand/raw/atmel/nand-controller.c -index 23d11e8b56441..17c751f359d3d 100644 ---- a/drivers/mtd/nand/raw/atmel/nand-controller.c -+++ b/drivers/mtd/nand/raw/atmel/nand-controller.c -@@ -2004,13 +2004,15 @@ static int atmel_nand_controller_init(struct atmel_nand_controller *nc, - nc->mck = of_clk_get(dev->parent->of_node, 0); - if (IS_ERR(nc->mck)) { - dev_err(dev, "Failed to retrieve MCK clk\n"); -- return PTR_ERR(nc->mck); -+ ret = PTR_ERR(nc->mck); -+ goto out_release_dma; - } - - np = of_parse_phandle(dev->parent->of_node, "atmel,smc", 0); - if (!np) { - dev_err(dev, "Missing or invalid atmel,smc property\n"); -- return -EINVAL; -+ ret = -EINVAL; -+ goto out_release_dma; - } - - nc->smc = syscon_node_to_regmap(np); -@@ -2018,10 +2020,16 @@ static int atmel_nand_controller_init(struct atmel_nand_controller *nc, - if (IS_ERR(nc->smc)) { - ret = PTR_ERR(nc->smc); - dev_err(dev, "Could not get SMC regmap (err = %d)\n", ret); -- return ret; -+ goto out_release_dma; - } - - return 0; -+ -+out_release_dma: -+ if (nc->dmac) -+ dma_release_channel(nc->dmac); -+ -+ return ret; - } - - static int -diff --git a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c -index ab2f824abf549..02218c3b548f9 100644 ---- a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c -+++ b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c -@@ -645,6 +645,7 @@ static void gpmi_nfc_compute_timings(struct gpmi_nand_data *this, - const struct nand_sdr_timings *sdr) - { - struct gpmi_nfc_hardware_timing *hw = &this->hw; -+ struct resources *r = &this->resources; - unsigned int dll_threshold_ps = this->devdata->max_chain_delay; - unsigned int period_ps, reference_period_ps; - unsigned int data_setup_cycles, data_hold_cycles, addr_setup_cycles; -@@ -668,6 +669,8 @@ static void gpmi_nfc_compute_timings(struct gpmi_nand_data *this, - wrn_dly_sel = BV_GPMI_CTRL1_WRN_DLY_SEL_NO_DELAY; - } - -+ hw->clk_rate = clk_round_rate(r->clock[0], hw->clk_rate); -+ - /* SDR core timings are given in picoseconds */ - period_ps = div_u64((u64)NSEC_PER_SEC * 1000, hw->clk_rate); - -diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c -index d636bbe214cb9..df521ff0b3280 100644 ---- a/drivers/mtd/ubi/build.c -+++ b/drivers/mtd/ubi/build.c -@@ -350,9 +350,6 @@ static ssize_t dev_attribute_show(struct device *dev, - * we still can use 'ubi->ubi_num'. - */ - ubi = container_of(dev, struct ubi_device, dev); -- ubi = ubi_get_device(ubi->ubi_num); -- if (!ubi) -- return -ENODEV; - - if (attr == &dev_eraseblock_size) - ret = sprintf(buf, "%d\n", ubi->leb_size); -@@ -381,7 +378,6 @@ static ssize_t dev_attribute_show(struct device *dev, - else - ret = -EINVAL; - -- ubi_put_device(ubi); - return ret; - } - -@@ -956,9 +952,6 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num, - goto out_detach; - } - -- /* Make device "available" before it becomes accessible via sysfs */ -- ubi_devices[ubi_num] = ubi; -- - err = uif_init(ubi); - if (err) - goto out_detach; -@@ -1003,6 +996,7 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num, - wake_up_process(ubi->bgt_thread); - spin_unlock(&ubi->wl_lock); - -+ ubi_devices[ubi_num] = ubi; - ubi_notify_all(ubi, UBI_VOLUME_ADDED, NULL); - return ubi_num; - -@@ -1011,7 +1005,6 @@ out_debugfs: - out_uif: - uif_close(ubi); - out_detach: -- ubi_devices[ubi_num] = NULL; - ubi_wl_close(ubi); - ubi_free_internal_volumes(ubi); - vfree(ubi->vtbl); -diff --git a/drivers/mtd/ubi/fastmap.c b/drivers/mtd/ubi/fastmap.c -index 53f448e7433a9..6e95c4b1473e6 100644 ---- a/drivers/mtd/ubi/fastmap.c -+++ b/drivers/mtd/ubi/fastmap.c -@@ -468,7 +468,9 @@ static int scan_pool(struct ubi_device *ubi, struct ubi_attach_info *ai, - if (err == UBI_IO_FF_BITFLIPS) - scrub = 1; - -- add_aeb(ai, free, pnum, ec, scrub); -+ ret = add_aeb(ai, free, pnum, ec, scrub); -+ if (ret) -+ goto out; - continue; - } else if (err == 0 || err == UBI_IO_BITFLIPS) { - dbg_bld("Found non empty PEB:%i in pool", pnum); -@@ -638,8 +640,10 @@ static int ubi_attach_fastmap(struct ubi_device *ubi, - if (fm_pos >= fm_size) - goto fail_bad; - -- add_aeb(ai, &ai->free, be32_to_cpu(fmec->pnum), -- be32_to_cpu(fmec->ec), 0); -+ ret = add_aeb(ai, &ai->free, be32_to_cpu(fmec->pnum), -+ be32_to_cpu(fmec->ec), 0); -+ if (ret) -+ goto fail; - } - - /* read EC values from used list */ -@@ -649,8 +653,10 @@ static int ubi_attach_fastmap(struct ubi_device *ubi, - if (fm_pos >= fm_size) - goto fail_bad; - -- add_aeb(ai, &used, be32_to_cpu(fmec->pnum), -- be32_to_cpu(fmec->ec), 0); -+ ret = add_aeb(ai, &used, be32_to_cpu(fmec->pnum), -+ be32_to_cpu(fmec->ec), 0); -+ if (ret) -+ goto fail; - } - - /* read EC values from scrub list */ -@@ -660,8 +666,10 @@ static int ubi_attach_fastmap(struct ubi_device *ubi, - if (fm_pos >= fm_size) - goto fail_bad; - -- add_aeb(ai, &used, be32_to_cpu(fmec->pnum), -- be32_to_cpu(fmec->ec), 1); -+ ret = add_aeb(ai, &used, be32_to_cpu(fmec->pnum), -+ be32_to_cpu(fmec->ec), 1); -+ if (ret) -+ goto fail; - } - - /* read EC values from erase list */ -@@ -671,8 +679,10 @@ static int ubi_attach_fastmap(struct ubi_device *ubi, - if (fm_pos >= fm_size) - goto fail_bad; - -- add_aeb(ai, &ai->erase, be32_to_cpu(fmec->pnum), -- be32_to_cpu(fmec->ec), 1); -+ ret = add_aeb(ai, &ai->erase, be32_to_cpu(fmec->pnum), -+ be32_to_cpu(fmec->ec), 1); -+ if (ret) -+ goto fail; - } - - ai->mean_ec = div_u64(ai->ec_sum, ai->ec_count); -diff --git a/drivers/mtd/ubi/vmt.c b/drivers/mtd/ubi/vmt.c -index 139ee132bfbcf..1bc7b3a056046 100644 ---- a/drivers/mtd/ubi/vmt.c -+++ b/drivers/mtd/ubi/vmt.c -@@ -56,16 +56,11 @@ static ssize_t vol_attribute_show(struct device *dev, - { - int ret; - struct ubi_volume *vol = container_of(dev, struct ubi_volume, dev); -- struct ubi_device *ubi; -- -- ubi = ubi_get_device(vol->ubi->ubi_num); -- if (!ubi) -- return -ENODEV; -+ struct ubi_device *ubi = vol->ubi; - - spin_lock(&ubi->volumes_lock); - if (!ubi->volumes[vol->vol_id]) { - spin_unlock(&ubi->volumes_lock); -- ubi_put_device(ubi); - return -ENODEV; - } - /* Take a reference to prevent volume removal */ -@@ -103,7 +98,6 @@ static ssize_t vol_attribute_show(struct device *dev, - vol->ref_count -= 1; - ubi_assert(vol->ref_count >= 0); - spin_unlock(&ubi->volumes_lock); -- ubi_put_device(ubi); - return ret; - } - -diff --git a/drivers/net/can/usb/ems_usb.c b/drivers/net/can/usb/ems_usb.c -index 249d2fba28c7f..6458da9c13b95 100644 ---- a/drivers/net/can/usb/ems_usb.c -+++ b/drivers/net/can/usb/ems_usb.c -@@ -823,7 +823,6 @@ static netdev_tx_t ems_usb_start_xmit(struct sk_buff *skb, struct net_device *ne - - usb_unanchor_urb(urb); - usb_free_coherent(dev->udev, size, buf, urb->transfer_dma); -- dev_kfree_skb(skb); - - atomic_dec(&dev->active_tx_urbs); - -diff --git a/drivers/net/can/usb/mcba_usb.c b/drivers/net/can/usb/mcba_usb.c -index 41eee6f0491c6..957e51a77d4d1 100644 ---- a/drivers/net/can/usb/mcba_usb.c -+++ b/drivers/net/can/usb/mcba_usb.c -@@ -33,10 +33,6 @@ - #define MCBA_USB_RX_BUFF_SIZE 64 - #define MCBA_USB_TX_BUFF_SIZE (sizeof(struct mcba_usb_msg)) - --/* MCBA endpoint numbers */ --#define MCBA_USB_EP_IN 1 --#define MCBA_USB_EP_OUT 1 -- - /* Microchip command id */ - #define MBCA_CMD_RECEIVE_MESSAGE 0xE3 - #define MBCA_CMD_I_AM_ALIVE_FROM_CAN 0xF5 -@@ -84,6 +80,8 @@ struct mcba_priv { - atomic_t free_ctx_cnt; - void *rxbuf[MCBA_MAX_RX_URBS]; - dma_addr_t rxbuf_dma[MCBA_MAX_RX_URBS]; -+ int rx_pipe; -+ int tx_pipe; - }; - - /* CAN frame */ -@@ -272,10 +270,8 @@ static netdev_tx_t mcba_usb_xmit(struct mcba_priv *priv, - - memcpy(buf, usb_msg, MCBA_USB_TX_BUFF_SIZE); - -- usb_fill_bulk_urb(urb, priv->udev, -- usb_sndbulkpipe(priv->udev, MCBA_USB_EP_OUT), buf, -- MCBA_USB_TX_BUFF_SIZE, mcba_usb_write_bulk_callback, -- ctx); -+ usb_fill_bulk_urb(urb, priv->udev, priv->tx_pipe, buf, MCBA_USB_TX_BUFF_SIZE, -+ mcba_usb_write_bulk_callback, ctx); - - urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP; - usb_anchor_urb(urb, &priv->tx_submitted); -@@ -368,7 +364,6 @@ static netdev_tx_t mcba_usb_start_xmit(struct sk_buff *skb, - xmit_failed: - can_free_echo_skb(priv->netdev, ctx->ndx); - mcba_usb_free_ctx(ctx); -- dev_kfree_skb(skb); - stats->tx_dropped++; - - return NETDEV_TX_OK; -@@ -611,7 +606,7 @@ static void mcba_usb_read_bulk_callback(struct urb *urb) - resubmit_urb: - - usb_fill_bulk_urb(urb, priv->udev, -- usb_rcvbulkpipe(priv->udev, MCBA_USB_EP_OUT), -+ priv->rx_pipe, - urb->transfer_buffer, MCBA_USB_RX_BUFF_SIZE, - mcba_usb_read_bulk_callback, priv); - -@@ -656,7 +651,7 @@ static int mcba_usb_start(struct mcba_priv *priv) - urb->transfer_dma = buf_dma; - - usb_fill_bulk_urb(urb, priv->udev, -- usb_rcvbulkpipe(priv->udev, MCBA_USB_EP_IN), -+ priv->rx_pipe, - buf, MCBA_USB_RX_BUFF_SIZE, - mcba_usb_read_bulk_callback, priv); - urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP; -@@ -810,6 +805,13 @@ static int mcba_usb_probe(struct usb_interface *intf, - struct mcba_priv *priv; - int err = -ENOMEM; - struct usb_device *usbdev = interface_to_usbdev(intf); -+ struct usb_endpoint_descriptor *in, *out; -+ -+ err = usb_find_common_endpoints(intf->cur_altsetting, &in, &out, NULL, NULL); -+ if (err) { -+ dev_err(&intf->dev, "Can't find endpoints\n"); -+ return err; -+ } - - netdev = alloc_candev(sizeof(struct mcba_priv), MCBA_MAX_TX_URBS); - if (!netdev) { -@@ -855,6 +857,9 @@ static int mcba_usb_probe(struct usb_interface *intf, - goto cleanup_free_candev; - } - -+ priv->rx_pipe = usb_rcvbulkpipe(priv->udev, in->bEndpointAddress); -+ priv->tx_pipe = usb_sndbulkpipe(priv->udev, out->bEndpointAddress); -+ - devm_can_led_init(netdev); - - /* Start USB dev only if we have successfully registered CAN device */ -diff --git a/drivers/net/can/vxcan.c b/drivers/net/can/vxcan.c -index 7000c6cd1e48b..282c53ef76d23 100644 ---- a/drivers/net/can/vxcan.c -+++ b/drivers/net/can/vxcan.c -@@ -148,7 +148,7 @@ static void vxcan_setup(struct net_device *dev) - dev->hard_header_len = 0; - dev->addr_len = 0; - dev->tx_queue_len = 0; -- dev->flags = (IFF_NOARP|IFF_ECHO); -+ dev->flags = IFF_NOARP; - dev->netdev_ops = &vxcan_netdev_ops; - dev->needs_free_netdev = true; - -diff --git a/drivers/net/dsa/bcm_sf2_cfp.c b/drivers/net/dsa/bcm_sf2_cfp.c -index e15d18bb981e9..5cc31118b97e9 100644 ---- a/drivers/net/dsa/bcm_sf2_cfp.c -+++ b/drivers/net/dsa/bcm_sf2_cfp.c -@@ -542,14 +542,14 @@ static void bcm_sf2_cfp_slice_ipv6(struct bcm_sf2_priv *priv, - static struct cfp_rule *bcm_sf2_cfp_rule_find(struct bcm_sf2_priv *priv, - int port, u32 location) - { -- struct cfp_rule *rule = NULL; -+ struct cfp_rule *rule; - - list_for_each_entry(rule, &priv->cfp.rules_list, next) { - if (rule->port == port && rule->fs.location == location) -- break; -+ return rule; - } - -- return rule; -+ return NULL; - } - - static int bcm_sf2_cfp_rule_cmp(struct bcm_sf2_priv *priv, int port, -diff --git a/drivers/net/dsa/microchip/ksz8795_spi.c b/drivers/net/dsa/microchip/ksz8795_spi.c -index 8b00f8e6c02f4..5639c5c59e255 100644 ---- a/drivers/net/dsa/microchip/ksz8795_spi.c -+++ b/drivers/net/dsa/microchip/ksz8795_spi.c -@@ -86,12 +86,23 @@ static const struct of_device_id ksz8795_dt_ids[] = { - }; - MODULE_DEVICE_TABLE(of, ksz8795_dt_ids); - -+static const struct spi_device_id ksz8795_spi_ids[] = { -+ { "ksz8765" }, -+ { "ksz8794" }, -+ { "ksz8795" }, -+ { "ksz8863" }, -+ { "ksz8873" }, -+ { }, -+}; -+MODULE_DEVICE_TABLE(spi, ksz8795_spi_ids); -+ - static struct spi_driver ksz8795_spi_driver = { - .driver = { - .name = "ksz8795-switch", - .owner = THIS_MODULE, - .of_match_table = of_match_ptr(ksz8795_dt_ids), - }, -+ .id_table = ksz8795_spi_ids, - .probe = ksz8795_spi_probe, - .remove = ksz8795_spi_remove, - .shutdown = ksz8795_spi_shutdown, -diff --git a/drivers/net/dsa/microchip/ksz9477_spi.c b/drivers/net/dsa/microchip/ksz9477_spi.c -index 1142768969c20..9bda83d063e8e 100644 ---- a/drivers/net/dsa/microchip/ksz9477_spi.c -+++ b/drivers/net/dsa/microchip/ksz9477_spi.c -@@ -88,12 +88,24 @@ static const struct of_device_id ksz9477_dt_ids[] = { - }; - MODULE_DEVICE_TABLE(of, ksz9477_dt_ids); - -+static const struct spi_device_id ksz9477_spi_ids[] = { -+ { "ksz9477" }, -+ { "ksz9897" }, -+ { "ksz9893" }, -+ { "ksz9563" }, -+ { "ksz8563" }, -+ { "ksz9567" }, -+ { }, -+}; -+MODULE_DEVICE_TABLE(spi, ksz9477_spi_ids); -+ - static struct spi_driver ksz9477_spi_driver = { - .driver = { - .name = "ksz9477-switch", - .owner = THIS_MODULE, - .of_match_table = of_match_ptr(ksz9477_dt_ids), - }, -+ .id_table = ksz9477_spi_ids, - .probe = ksz9477_spi_probe, - .remove = ksz9477_spi_remove, - .shutdown = ksz9477_spi_shutdown, -diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c -index 40b105daaf9e7..87d28ef82559e 100644 ---- a/drivers/net/dsa/mv88e6xxx/chip.c -+++ b/drivers/net/dsa/mv88e6xxx/chip.c -@@ -3062,6 +3062,7 @@ static const struct mv88e6xxx_ops mv88e6097_ops = { - .port_set_duplex = mv88e6xxx_port_set_duplex, - .port_set_speed = mv88e6185_port_set_speed, - .port_tag_remap = mv88e6095_port_tag_remap, -+ .port_set_policy = mv88e6352_port_set_policy, - .port_set_frame_mode = mv88e6351_port_set_frame_mode, - .port_set_egress_floods = mv88e6352_port_set_egress_floods, - .port_set_ether_type = mv88e6351_port_set_ether_type, -diff --git a/drivers/net/ethernet/8390/mcf8390.c b/drivers/net/ethernet/8390/mcf8390.c -index 4ad8031ab6695..065fdbe66c425 100644 ---- a/drivers/net/ethernet/8390/mcf8390.c -+++ b/drivers/net/ethernet/8390/mcf8390.c -@@ -406,12 +406,12 @@ static int mcf8390_init(struct net_device *dev) - static int mcf8390_probe(struct platform_device *pdev) - { - struct net_device *dev; -- struct resource *mem, *irq; -+ struct resource *mem; - resource_size_t msize; -- int ret; -+ int ret, irq; - -- irq = platform_get_resource(pdev, IORESOURCE_IRQ, 0); -- if (irq == NULL) { -+ irq = platform_get_irq(pdev, 0); -+ if (irq < 0) { - dev_err(&pdev->dev, "no IRQ specified?\n"); - return -ENXIO; - } -@@ -434,7 +434,7 @@ static int mcf8390_probe(struct platform_device *pdev) - SET_NETDEV_DEV(dev, &pdev->dev); - platform_set_drvdata(pdev, dev); - -- dev->irq = irq->start; -+ dev->irq = irq; - dev->base_addr = mem->start; - - ret = mcf8390_init(dev); -diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h -index 8ba369c0100b4..9e8a0c772ca93 100644 ---- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h -+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h -@@ -559,7 +559,8 @@ struct nqe_cn { - #define BNXT_MAX_MTU 9500 - #define BNXT_MAX_PAGE_MODE_MTU \ - ((unsigned int)PAGE_SIZE - VLAN_ETH_HLEN - NET_IP_ALIGN - \ -- XDP_PACKET_HEADROOM) -+ XDP_PACKET_HEADROOM - \ -+ SKB_DATA_ALIGN((unsigned int)sizeof(struct skb_shared_info))) - - #define BNXT_MIN_PKT_SIZE 52 - -diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c -index 97aff84fd1d17..d74c6a34b936a 100644 ---- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c -+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c -@@ -1673,9 +1673,7 @@ static int bnxt_set_pauseparam(struct net_device *dev, - } - - link_info->autoneg |= BNXT_AUTONEG_FLOW_CTRL; -- if (bp->hwrm_spec_code >= 0x10201) -- link_info->req_flow_ctrl = -- PORT_PHY_CFG_REQ_AUTO_PAUSE_AUTONEG_PAUSE; -+ link_info->req_flow_ctrl = 0; - } else { - /* when transition from auto pause to force pause, - * force a link change -diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-ptp.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-ptp.c -index 6437fe6b9abf0..a6b8f573ab5b5 100644 ---- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-ptp.c -+++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-ptp.c -@@ -148,7 +148,7 @@ static int dpaa2_ptp_probe(struct fsl_mc_device *mc_dev) - base = of_iomap(node, 0); - if (!base) { - err = -ENOMEM; -- goto err_close; -+ goto err_put; - } - - err = fsl_mc_allocate_irqs(mc_dev); -@@ -191,6 +191,8 @@ err_free_mc_irq: - fsl_mc_free_irqs(mc_dev); - err_unmap: - iounmap(base); -+err_put: -+ of_node_put(node); - err_close: - dprtc_close(mc_dev->mc_io, 0, mc_dev->mc_handle); - err_free_mcp: -diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c -index 8ecfabaefa85b..d58abdfdb9b7b 100644 ---- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c -+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c -@@ -8344,11 +8344,11 @@ int hclge_set_vlan_filter(struct hnae3_handle *handle, __be16 proto, - } - - if (!ret) { -- if (is_kill) -- hclge_rm_vport_vlan_table(vport, vlan_id, false); -- else -+ if (!is_kill) - hclge_add_vport_vlan_table(vport, vlan_id, - writen_to_tbl); -+ else if (is_kill && vlan_id != 0) -+ hclge_rm_vport_vlan_table(vport, vlan_id, false); - } else if (is_kill) { - /* when remove hw vlan filter failed, record the vlan id, - * and try to remove it from hw later, to be consistence -diff --git a/drivers/net/ethernet/intel/i40e/i40e_xsk.c b/drivers/net/ethernet/intel/i40e/i40e_xsk.c -index a9ad788c4913d..fd2da58c71401 100644 ---- a/drivers/net/ethernet/intel/i40e/i40e_xsk.c -+++ b/drivers/net/ethernet/intel/i40e/i40e_xsk.c -@@ -505,13 +505,11 @@ static struct sk_buff *i40e_construct_skb_zc(struct i40e_ring *rx_ring, - struct sk_buff *skb; - - /* allocate a skb to store the frags */ -- skb = __napi_alloc_skb(&rx_ring->q_vector->napi, -- xdp->data_end - xdp->data_hard_start, -+ skb = __napi_alloc_skb(&rx_ring->q_vector->napi, datasize, - GFP_ATOMIC | __GFP_NOWARN); - if (unlikely(!skb)) - return NULL; - -- skb_reserve(skb, xdp->data - xdp->data_hard_start); - memcpy(__skb_put(skb, datasize), xdp->data, datasize); - if (metasize) - skb_metadata_set(skb, metasize); -diff --git a/drivers/net/ethernet/qlogic/qed/qed_sriov.c b/drivers/net/ethernet/qlogic/qed/qed_sriov.c -index 5e8f8eb916e64..20f840ea05030 100644 ---- a/drivers/net/ethernet/qlogic/qed/qed_sriov.c -+++ b/drivers/net/ethernet/qlogic/qed/qed_sriov.c -@@ -3003,12 +3003,16 @@ static int qed_iov_pre_update_vport(struct qed_hwfn *hwfn, - u8 mask = QED_ACCEPT_UCAST_UNMATCHED | QED_ACCEPT_MCAST_UNMATCHED; - struct qed_filter_accept_flags *flags = ¶ms->accept_flags; - struct qed_public_vf_info *vf_info; -+ u16 tlv_mask; -+ -+ tlv_mask = BIT(QED_IOV_VP_UPDATE_ACCEPT_PARAM) | -+ BIT(QED_IOV_VP_UPDATE_ACCEPT_ANY_VLAN); - - /* Untrusted VFs can't even be trusted to know that fact. - * Simply indicate everything is configured fine, and trace - * configuration 'behind their back'. - */ -- if (!(*tlvs & BIT(QED_IOV_VP_UPDATE_ACCEPT_PARAM))) -+ if (!(*tlvs & tlv_mask)) - return 0; - - vf_info = qed_iov_get_public_vf_info(hwfn, vfid, true); -@@ -3025,6 +3029,13 @@ static int qed_iov_pre_update_vport(struct qed_hwfn *hwfn, - flags->tx_accept_filter &= ~mask; - } - -+ if (params->update_accept_any_vlan_flg) { -+ vf_info->accept_any_vlan = params->accept_any_vlan; -+ -+ if (vf_info->forced_vlan && !vf_info->is_trusted_configured) -+ params->accept_any_vlan = false; -+ } -+ - return 0; - } - -@@ -4717,6 +4728,7 @@ static int qed_get_vf_config(struct qed_dev *cdev, - tx_rate = vf_info->tx_rate; - ivi->max_tx_rate = tx_rate ? tx_rate : link.speed; - ivi->min_tx_rate = qed_iov_get_vf_min_rate(hwfn, vf_id); -+ ivi->trusted = vf_info->is_trusted_request; - - return 0; - } -@@ -5147,6 +5159,12 @@ static void qed_iov_handle_trust_change(struct qed_hwfn *hwfn) - - params.update_ctl_frame_check = 1; - params.mac_chk_en = !vf_info->is_trusted_configured; -+ params.update_accept_any_vlan_flg = 0; -+ -+ if (vf_info->accept_any_vlan && vf_info->forced_vlan) { -+ params.update_accept_any_vlan_flg = 1; -+ params.accept_any_vlan = vf_info->accept_any_vlan; -+ } - - if (vf_info->rx_accept_mode & mask) { - flags->update_rx_mode_config = 1; -@@ -5162,13 +5180,20 @@ static void qed_iov_handle_trust_change(struct qed_hwfn *hwfn) - if (!vf_info->is_trusted_configured) { - flags->rx_accept_filter &= ~mask; - flags->tx_accept_filter &= ~mask; -+ params.accept_any_vlan = false; - } - - if (flags->update_rx_mode_config || - flags->update_tx_mode_config || -- params.update_ctl_frame_check) -+ params.update_ctl_frame_check || -+ params.update_accept_any_vlan_flg) { -+ DP_VERBOSE(hwfn, QED_MSG_IOV, -+ "vport update config for %s VF[abs 0x%x rel 0x%x]\n", -+ vf_info->is_trusted_configured ? "trusted" : "untrusted", -+ vf->abs_vf_id, vf->relative_vf_id); - qed_sp_vport_update(hwfn, ¶ms, - QED_SPQ_MODE_EBLOCK, NULL); -+ } - } - } - -diff --git a/drivers/net/ethernet/qlogic/qed/qed_sriov.h b/drivers/net/ethernet/qlogic/qed/qed_sriov.h -index 9a8fd79611f24..853be06bccdf6 100644 ---- a/drivers/net/ethernet/qlogic/qed/qed_sriov.h -+++ b/drivers/net/ethernet/qlogic/qed/qed_sriov.h -@@ -88,6 +88,7 @@ struct qed_public_vf_info { - bool is_trusted_request; - u8 rx_accept_mode; - u8 tx_accept_mode; -+ bool accept_any_vlan; - }; - - struct qed_iov_vf_init_params { -diff --git a/drivers/net/ethernet/qlogic/qede/qede_fp.c b/drivers/net/ethernet/qlogic/qede/qede_fp.c -index b81579afa361d..f16032635ba73 100644 ---- a/drivers/net/ethernet/qlogic/qede/qede_fp.c -+++ b/drivers/net/ethernet/qlogic/qede/qede_fp.c -@@ -723,6 +723,9 @@ qede_build_skb(struct qede_rx_queue *rxq, - buf = page_address(bd->data) + bd->page_offset; - skb = build_skb(buf, rxq->rx_buf_seg_size); - -+ if (unlikely(!skb)) -+ return NULL; -+ - skb_reserve(skb, pad); - skb_put(skb, len); - -diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.h -index f4aa6331b367b..0a9d24e86715d 100644 ---- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.h -+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.h -@@ -52,7 +52,7 @@ static inline int qlcnic_dcb_get_hw_capability(struct qlcnic_dcb *dcb) - if (dcb && dcb->ops->get_hw_capability) - return dcb->ops->get_hw_capability(dcb); - -- return 0; -+ return -EOPNOTSUPP; - } - - static inline void qlcnic_dcb_free(struct qlcnic_dcb *dcb) -@@ -66,7 +66,7 @@ static inline int qlcnic_dcb_attach(struct qlcnic_dcb *dcb) - if (dcb && dcb->ops->attach) - return dcb->ops->attach(dcb); - -- return 0; -+ return -EOPNOTSUPP; - } - - static inline int -@@ -75,7 +75,7 @@ qlcnic_dcb_query_hw_capability(struct qlcnic_dcb *dcb, char *buf) - if (dcb && dcb->ops->query_hw_capability) - return dcb->ops->query_hw_capability(dcb, buf); - -- return 0; -+ return -EOPNOTSUPP; - } - - static inline void qlcnic_dcb_get_info(struct qlcnic_dcb *dcb) -@@ -90,7 +90,7 @@ qlcnic_dcb_query_cee_param(struct qlcnic_dcb *dcb, char *buf, u8 type) - if (dcb && dcb->ops->query_cee_param) - return dcb->ops->query_cee_param(dcb, buf, type); - -- return 0; -+ return -EOPNOTSUPP; - } - - static inline int qlcnic_dcb_get_cee_cfg(struct qlcnic_dcb *dcb) -@@ -98,7 +98,7 @@ static inline int qlcnic_dcb_get_cee_cfg(struct qlcnic_dcb *dcb) - if (dcb && dcb->ops->get_cee_cfg) - return dcb->ops->get_cee_cfg(dcb); - -- return 0; -+ return -EOPNOTSUPP; - } - - static inline void qlcnic_dcb_aen_handler(struct qlcnic_dcb *dcb, void *msg) -diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c -index a46fea472bc46..70cbf48c2c038 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c -+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c -@@ -428,8 +428,7 @@ stmmac_probe_config_dt(struct platform_device *pdev, const char **mac) - plat->phylink_node = np; - - /* Get max speed of operation from device tree */ -- if (of_property_read_u32(np, "max-speed", &plat->max_speed)) -- plat->max_speed = -1; -+ of_property_read_u32(np, "max-speed", &plat->max_speed); - - plat->bus_id = of_alias_get_id(np, "ethernet"); - if (plat->bus_id < 0) -diff --git a/drivers/net/ethernet/sun/sunhme.c b/drivers/net/ethernet/sun/sunhme.c -index d007dfeba5c35..3133f903279ce 100644 ---- a/drivers/net/ethernet/sun/sunhme.c -+++ b/drivers/net/ethernet/sun/sunhme.c -@@ -3164,7 +3164,7 @@ static int happy_meal_pci_probe(struct pci_dev *pdev, - if (err) { - printk(KERN_ERR "happymeal(PCI): Cannot register net device, " - "aborting.\n"); -- goto err_out_iounmap; -+ goto err_out_free_coherent; - } - - pci_set_drvdata(pdev, hp); -@@ -3197,6 +3197,10 @@ static int happy_meal_pci_probe(struct pci_dev *pdev, - - return 0; - -+err_out_free_coherent: -+ dma_free_coherent(hp->dma_dev, PAGE_SIZE, -+ hp->happy_block, hp->hblock_dvma); -+ - err_out_iounmap: - iounmap(hp->gregs); - -diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c -index bd0beb16d68a9..02d6f3ad9aca8 100644 ---- a/drivers/net/hamradio/6pack.c -+++ b/drivers/net/hamradio/6pack.c -@@ -674,14 +674,14 @@ static void sixpack_close(struct tty_struct *tty) - */ - netif_stop_queue(sp->dev); - -+ unregister_netdev(sp->dev); -+ - del_timer_sync(&sp->tx_t); - del_timer_sync(&sp->resync_t); - - /* Free all 6pack frame buffers. */ - kfree(sp->rbuff); - kfree(sp->xbuff); -- -- unregister_netdev(sp->dev); - } - - /* Perform I/O control on an active 6pack channel. */ -diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c -index 694e2f5dbbe59..39801c31e5071 100644 ---- a/drivers/net/macvtap.c -+++ b/drivers/net/macvtap.c -@@ -133,11 +133,17 @@ static void macvtap_setup(struct net_device *dev) - dev->tx_queue_len = TUN_READQ_SIZE; - } - -+static struct net *macvtap_link_net(const struct net_device *dev) -+{ -+ return dev_net(macvlan_dev_real_dev(dev)); -+} -+ - static struct rtnl_link_ops macvtap_link_ops __read_mostly = { - .kind = "macvtap", - .setup = macvtap_setup, - .newlink = macvtap_newlink, - .dellink = macvtap_dellink, -+ .get_link_net = macvtap_link_net, - .priv_size = sizeof(struct macvtap_dev), - }; - -diff --git a/drivers/net/phy/broadcom.c b/drivers/net/phy/broadcom.c -index c23fec34b50e9..7be75a611e9e8 100644 ---- a/drivers/net/phy/broadcom.c -+++ b/drivers/net/phy/broadcom.c -@@ -11,6 +11,7 @@ - */ - - #include "bcm-phy-lib.h" -+#include - #include - #include - #include -@@ -479,6 +480,26 @@ static int brcm_fet_config_init(struct phy_device *phydev) - if (err < 0) - return err; - -+ /* The datasheet indicates the PHY needs up to 1us to complete a reset, -+ * build some slack here. -+ */ -+ usleep_range(1000, 2000); -+ -+ /* The PHY requires 65 MDC clock cycles to complete a write operation -+ * and turnaround the line properly. -+ * -+ * We ignore -EIO here as the MDIO controller (e.g.: mdio-bcm-unimac) -+ * may flag the lack of turn-around as a read failure. This is -+ * particularly true with this combination since the MDIO controller -+ * only used 64 MDC cycles. This is not a critical failure in this -+ * specific case and it has no functional impact otherwise, so we let -+ * that one go through. If there is a genuine bus error, the next read -+ * of MII_BRCM_FET_INTREG will error out. -+ */ -+ err = phy_read(phydev, MII_BMCR); -+ if (err < 0 && err != -EIO) -+ return err; -+ - reg = phy_read(phydev, MII_BRCM_FET_INTREG); - if (reg < 0) - return reg; -diff --git a/drivers/net/tap.c b/drivers/net/tap.c -index f285422a80717..f870d08bb1f86 100644 ---- a/drivers/net/tap.c -+++ b/drivers/net/tap.c -@@ -1214,7 +1214,8 @@ static int tap_sendmsg(struct socket *sock, struct msghdr *m, - struct xdp_buff *xdp; - int i; - -- if (ctl && (ctl->type == TUN_MSG_PTR)) { -+ if (m->msg_controllen == sizeof(struct tun_msg_ctl) && -+ ctl && ctl->type == TUN_MSG_PTR) { - for (i = 0; i < ctl->num; i++) { - xdp = &((struct xdp_buff *)ctl->ptr)[i]; - tap_get_user_xdp(q, xdp); -diff --git a/drivers/net/tun.c b/drivers/net/tun.c -index 10211ea605140..d9993884a97d9 100644 ---- a/drivers/net/tun.c -+++ b/drivers/net/tun.c -@@ -2561,7 +2561,8 @@ static int tun_sendmsg(struct socket *sock, struct msghdr *m, size_t total_len) - if (!tun) - return -EBADFD; - -- if (ctl && (ctl->type == TUN_MSG_PTR)) { -+ if (m->msg_controllen == sizeof(struct tun_msg_ctl) && -+ ctl && ctl->type == TUN_MSG_PTR) { - struct tun_page tpage; - int n = ctl->num; - int flush = 0; -diff --git a/drivers/net/wireless/ath/ath10k/wow.c b/drivers/net/wireless/ath/ath10k/wow.c -index 8c26adddd034e..b4f54ca127561 100644 ---- a/drivers/net/wireless/ath/ath10k/wow.c -+++ b/drivers/net/wireless/ath/ath10k/wow.c -@@ -337,14 +337,15 @@ static int ath10k_vif_wow_set_wakeups(struct ath10k_vif *arvif, - if (patterns[i].mask[j / 8] & BIT(j % 8)) - bitmask[j] = 0xff; - old_pattern.mask = bitmask; -- new_pattern = old_pattern; - - if (ar->wmi.rx_decap_mode == ATH10K_HW_TXRX_NATIVE_WIFI) { -- if (patterns[i].pkt_offset < ETH_HLEN) -+ if (patterns[i].pkt_offset < ETH_HLEN) { - ath10k_wow_convert_8023_to_80211(&new_pattern, - &old_pattern); -- else -+ } else { -+ new_pattern = old_pattern; - new_pattern.pkt_offset += WOW_HDR_LEN - ETH_HLEN; -+ } - } - - if (WARN_ON(new_pattern.pattern_len > WOW_MAX_PATTERN_SIZE)) -diff --git a/drivers/net/wireless/ath/ath5k/eeprom.c b/drivers/net/wireless/ath/ath5k/eeprom.c -index 94d34ee02265d..01163b3339451 100644 ---- a/drivers/net/wireless/ath/ath5k/eeprom.c -+++ b/drivers/net/wireless/ath/ath5k/eeprom.c -@@ -746,6 +746,9 @@ ath5k_eeprom_convert_pcal_info_5111(struct ath5k_hw *ah, int mode, - } - } - -+ if (idx == AR5K_EEPROM_N_PD_CURVES) -+ goto err_out; -+ - ee->ee_pd_gains[mode] = 1; - - pd = &chinfo[pier].pd_curves[idx]; -diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c -index 510e61e97dbcb..994ec48b2f669 100644 ---- a/drivers/net/wireless/ath/ath9k/htc_hst.c -+++ b/drivers/net/wireless/ath/ath9k/htc_hst.c -@@ -30,6 +30,7 @@ static int htc_issue_send(struct htc_target *target, struct sk_buff* skb, - hdr->endpoint_id = epid; - hdr->flags = flags; - hdr->payload_len = cpu_to_be16(len); -+ memset(hdr->control, 0, sizeof(hdr->control)); - - status = target->hif->send(target->hif_dev, endpoint->ul_pipeid, skb); - -@@ -272,6 +273,10 @@ int htc_connect_service(struct htc_target *target, - conn_msg->dl_pipeid = endpoint->dl_pipeid; - conn_msg->ul_pipeid = endpoint->ul_pipeid; - -+ /* To prevent infoleak */ -+ conn_msg->svc_meta_len = 0; -+ conn_msg->pad = 0; -+ - ret = htc_issue_send(target, skb, skb->len, 0, ENDPOINT0); - if (ret) - goto err; -diff --git a/drivers/net/wireless/ath/carl9170/main.c b/drivers/net/wireless/ath/carl9170/main.c -index 21ca62b06214a..8d708e7588bcb 100644 ---- a/drivers/net/wireless/ath/carl9170/main.c -+++ b/drivers/net/wireless/ath/carl9170/main.c -@@ -1917,7 +1917,7 @@ static int carl9170_parse_eeprom(struct ar9170 *ar) - WARN_ON(!(tx_streams >= 1 && tx_streams <= - IEEE80211_HT_MCS_TX_MAX_STREAMS)); - -- tx_params = (tx_streams - 1) << -+ tx_params |= (tx_streams - 1) << - IEEE80211_HT_MCS_TX_MAX_STREAMS_SHIFT; - - carl9170_band_2GHz.ht_cap.mcs.tx_params |= tx_params; -diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c -index 3aed4c4b887aa..544ad80629a99 100644 ---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c -+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c -@@ -207,6 +207,8 @@ static int brcmf_init_nvram_parser(struct nvram_parser *nvp, - size = BRCMF_FW_MAX_NVRAM_SIZE; - else - size = data_len; -+ /* Add space for properties we may add */ -+ size += strlen(BRCMF_FW_DEFAULT_BOARDREV) + 1; - /* Alloc for extra 0 byte + roundup by 4 + length field */ - size += 1 + 3 + sizeof(u32); - nvp->nvram = kzalloc(size, GFP_KERNEL); -diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c -index e6001f0a81a3a..b5d2e5b9f67cc 100644 ---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c -+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c -@@ -12,6 +12,7 @@ - #include - #include - #include -+#include - #include - - #include -@@ -444,47 +445,6 @@ brcmf_pcie_write_ram32(struct brcmf_pciedev_info *devinfo, u32 mem_offset, - } - - --static void --brcmf_pcie_copy_mem_todev(struct brcmf_pciedev_info *devinfo, u32 mem_offset, -- void *srcaddr, u32 len) --{ -- void __iomem *address = devinfo->tcm + mem_offset; -- __le32 *src32; -- __le16 *src16; -- u8 *src8; -- -- if (((ulong)address & 4) || ((ulong)srcaddr & 4) || (len & 4)) { -- if (((ulong)address & 2) || ((ulong)srcaddr & 2) || (len & 2)) { -- src8 = (u8 *)srcaddr; -- while (len) { -- iowrite8(*src8, address); -- address++; -- src8++; -- len--; -- } -- } else { -- len = len / 2; -- src16 = (__le16 *)srcaddr; -- while (len) { -- iowrite16(le16_to_cpu(*src16), address); -- address += 2; -- src16++; -- len--; -- } -- } -- } else { -- len = len / 4; -- src32 = (__le32 *)srcaddr; -- while (len) { -- iowrite32(le32_to_cpu(*src32), address); -- address += 4; -- src32++; -- len--; -- } -- } --} -- -- - static void - brcmf_pcie_copy_dev_tomem(struct brcmf_pciedev_info *devinfo, u32 mem_offset, - void *dstaddr, u32 len) -@@ -1346,6 +1306,18 @@ static void brcmf_pcie_down(struct device *dev) - { - } - -+static int brcmf_pcie_preinit(struct device *dev) -+{ -+ struct brcmf_bus *bus_if = dev_get_drvdata(dev); -+ struct brcmf_pciedev *buspub = bus_if->bus_priv.pcie; -+ -+ brcmf_dbg(PCIE, "Enter\n"); -+ -+ brcmf_pcie_intr_enable(buspub->devinfo); -+ brcmf_pcie_hostready(buspub->devinfo); -+ -+ return 0; -+} - - static int brcmf_pcie_tx(struct device *dev, struct sk_buff *skb) - { -@@ -1454,6 +1426,7 @@ static int brcmf_pcie_reset(struct device *dev) - } - - static const struct brcmf_bus_ops brcmf_pcie_bus_ops = { -+ .preinit = brcmf_pcie_preinit, - .txdata = brcmf_pcie_tx, - .stop = brcmf_pcie_down, - .txctl = brcmf_pcie_tx_ctlpkt, -@@ -1561,8 +1534,8 @@ static int brcmf_pcie_download_fw_nvram(struct brcmf_pciedev_info *devinfo, - return err; - - brcmf_dbg(PCIE, "Download FW %s\n", devinfo->fw_name); -- brcmf_pcie_copy_mem_todev(devinfo, devinfo->ci->rambase, -- (void *)fw->data, fw->size); -+ memcpy_toio(devinfo->tcm + devinfo->ci->rambase, -+ (void *)fw->data, fw->size); - - resetintr = get_unaligned_le32(fw->data); - release_firmware(fw); -@@ -1576,7 +1549,7 @@ static int brcmf_pcie_download_fw_nvram(struct brcmf_pciedev_info *devinfo, - brcmf_dbg(PCIE, "Download NVRAM %s\n", devinfo->nvram_name); - address = devinfo->ci->rambase + devinfo->ci->ramsize - - nvram_len; -- brcmf_pcie_copy_mem_todev(devinfo, address, nvram, nvram_len); -+ memcpy_toio(devinfo->tcm + address, nvram, nvram_len); - brcmf_fw_nvram_free(nvram); - } else { - brcmf_dbg(PCIE, "No matching NVRAM file found %s\n", -@@ -1775,6 +1748,8 @@ static void brcmf_pcie_setup(struct device *dev, int ret, - ret = brcmf_chip_get_raminfo(devinfo->ci); - if (ret) { - brcmf_err(bus, "Failed to get RAM info\n"); -+ release_firmware(fw); -+ brcmf_fw_nvram_free(nvram); - goto fail; - } - -@@ -1824,9 +1799,6 @@ static void brcmf_pcie_setup(struct device *dev, int ret, - - init_waitqueue_head(&devinfo->mbdata_resp_wait); - -- brcmf_pcie_intr_enable(devinfo); -- brcmf_pcie_hostready(devinfo); -- - ret = brcmf_attach(&devinfo->pdev->dev); - if (ret) - goto fail; -diff --git a/drivers/net/wireless/intel/iwlwifi/dvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/dvm/mac80211.c -index 6512d25e35630..f3bb1f91b5878 100644 ---- a/drivers/net/wireless/intel/iwlwifi/dvm/mac80211.c -+++ b/drivers/net/wireless/intel/iwlwifi/dvm/mac80211.c -@@ -303,7 +303,7 @@ static int iwlagn_mac_start(struct ieee80211_hw *hw) - - priv->is_open = 1; - IWL_DEBUG_MAC80211(priv, "leave\n"); -- return 0; -+ return ret; - } - - static void iwlagn_mac_stop(struct ieee80211_hw *hw) -diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c -index 7272d8522a9e9..c5b08a68f6fa1 100644 ---- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c -+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c -@@ -1417,8 +1417,10 @@ int iwl_mvm_up(struct iwl_mvm *mvm) - while (!sband && i < NUM_NL80211_BANDS) - sband = mvm->hw->wiphy->bands[i++]; - -- if (WARN_ON_ONCE(!sband)) -+ if (WARN_ON_ONCE(!sband)) { -+ ret = -ENODEV; - goto error; -+ } - - chan = &sband->channels[0]; - -diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/main.c b/drivers/net/wireless/mediatek/mt76/mt7603/main.c -index 0a5695c3d9241..625492284389c 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt7603/main.c -+++ b/drivers/net/wireless/mediatek/mt76/mt7603/main.c -@@ -605,6 +605,9 @@ mt7603_sta_rate_tbl_update(struct ieee80211_hw *hw, struct ieee80211_vif *vif, - struct ieee80211_sta_rates *sta_rates = rcu_dereference(sta->rates); - int i; - -+ if (!sta_rates) -+ return; -+ - spin_lock_bh(&dev->mt76.lock); - for (i = 0; i < ARRAY_SIZE(msta->rates); i++) { - msta->rates[i].idx = sta_rates->rate[i].idx; -diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/main.c b/drivers/net/wireless/mediatek/mt76/mt7615/main.c -index 38183aef0eb92..5ad8b0afa41f0 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt7615/main.c -+++ b/drivers/net/wireless/mediatek/mt76/mt7615/main.c -@@ -385,6 +385,9 @@ static void mt7615_sta_rate_tbl_update(struct ieee80211_hw *hw, - struct ieee80211_sta_rates *sta_rates = rcu_dereference(sta->rates); - int i; - -+ if (!sta_rates) -+ return; -+ - spin_lock_bh(&dev->mt76.lock); - for (i = 0; i < ARRAY_SIZE(msta->rates); i++) { - msta->rates[i].idx = sta_rates->rate[i].idx; -diff --git a/drivers/net/wireless/ray_cs.c b/drivers/net/wireless/ray_cs.c -index cf372684b6812..3836d6ac53049 100644 ---- a/drivers/net/wireless/ray_cs.c -+++ b/drivers/net/wireless/ray_cs.c -@@ -382,6 +382,8 @@ static int ray_config(struct pcmcia_device *link) - goto failed; - local->sram = ioremap(link->resource[2]->start, - resource_size(link->resource[2])); -+ if (!local->sram) -+ goto failed; - - /*** Set up 16k window for shared memory (receive buffer) ***************/ - link->resource[3]->flags |= -@@ -396,6 +398,8 @@ static int ray_config(struct pcmcia_device *link) - goto failed; - local->rmem = ioremap(link->resource[3]->start, - resource_size(link->resource[3])); -+ if (!local->rmem) -+ goto failed; - - /*** Set up window for attribute memory ***********************************/ - link->resource[4]->flags |= -@@ -410,6 +414,8 @@ static int ray_config(struct pcmcia_device *link) - goto failed; - local->amem = ioremap(link->resource[4]->start, - resource_size(link->resource[4])); -+ if (!local->amem) -+ goto failed; - - dev_dbg(&link->dev, "ray_config sram=%p\n", local->sram); - dev_dbg(&link->dev, "ray_config rmem=%p\n", local->rmem); -diff --git a/drivers/parisc/dino.c b/drivers/parisc/dino.c -index 544287e9f449b..f4de8be05c614 100644 ---- a/drivers/parisc/dino.c -+++ b/drivers/parisc/dino.c -@@ -142,9 +142,8 @@ struct dino_device - { - struct pci_hba_data hba; /* 'C' inheritance - must be first */ - spinlock_t dinosaur_pen; -- unsigned long txn_addr; /* EIR addr to generate interrupt */ -- u32 txn_data; /* EIR data assign to each dino */ - u32 imr; /* IRQ's which are enabled */ -+ struct gsc_irq gsc_irq; - int global_irq[DINO_LOCAL_IRQS]; /* map IMR bit to global irq */ - #ifdef DINO_DEBUG - unsigned int dino_irr0; /* save most recent IRQ line stat */ -@@ -339,14 +338,43 @@ static void dino_unmask_irq(struct irq_data *d) - if (tmp & DINO_MASK_IRQ(local_irq)) { - DBG(KERN_WARNING "%s(): IRQ asserted! (ILR 0x%x)\n", - __func__, tmp); -- gsc_writel(dino_dev->txn_data, dino_dev->txn_addr); -+ gsc_writel(dino_dev->gsc_irq.txn_data, dino_dev->gsc_irq.txn_addr); - } - } - -+#ifdef CONFIG_SMP -+static int dino_set_affinity_irq(struct irq_data *d, const struct cpumask *dest, -+ bool force) -+{ -+ struct dino_device *dino_dev = irq_data_get_irq_chip_data(d); -+ struct cpumask tmask; -+ int cpu_irq; -+ u32 eim; -+ -+ if (!cpumask_and(&tmask, dest, cpu_online_mask)) -+ return -EINVAL; -+ -+ cpu_irq = cpu_check_affinity(d, &tmask); -+ if (cpu_irq < 0) -+ return cpu_irq; -+ -+ dino_dev->gsc_irq.txn_addr = txn_affinity_addr(d->irq, cpu_irq); -+ eim = ((u32) dino_dev->gsc_irq.txn_addr) | dino_dev->gsc_irq.txn_data; -+ __raw_writel(eim, dino_dev->hba.base_addr+DINO_IAR0); -+ -+ irq_data_update_effective_affinity(d, &tmask); -+ -+ return IRQ_SET_MASK_OK; -+} -+#endif -+ - static struct irq_chip dino_interrupt_type = { - .name = "GSC-PCI", - .irq_unmask = dino_unmask_irq, - .irq_mask = dino_mask_irq, -+#ifdef CONFIG_SMP -+ .irq_set_affinity = dino_set_affinity_irq, -+#endif - }; - - -@@ -806,7 +834,6 @@ static int __init dino_common_init(struct parisc_device *dev, - { - int status; - u32 eim; -- struct gsc_irq gsc_irq; - struct resource *res; - - pcibios_register_hba(&dino_dev->hba); -@@ -821,10 +848,8 @@ static int __init dino_common_init(struct parisc_device *dev, - ** still only has 11 IRQ input lines - just map some of them - ** to a different processor. - */ -- dev->irq = gsc_alloc_irq(&gsc_irq); -- dino_dev->txn_addr = gsc_irq.txn_addr; -- dino_dev->txn_data = gsc_irq.txn_data; -- eim = ((u32) gsc_irq.txn_addr) | gsc_irq.txn_data; -+ dev->irq = gsc_alloc_irq(&dino_dev->gsc_irq); -+ eim = ((u32) dino_dev->gsc_irq.txn_addr) | dino_dev->gsc_irq.txn_data; - - /* - ** Dino needs a PA "IRQ" to get a processor's attention. -diff --git a/drivers/parisc/gsc.c b/drivers/parisc/gsc.c -index ed9371acf37eb..ec175ae998733 100644 ---- a/drivers/parisc/gsc.c -+++ b/drivers/parisc/gsc.c -@@ -135,10 +135,41 @@ static void gsc_asic_unmask_irq(struct irq_data *d) - */ - } - -+#ifdef CONFIG_SMP -+static int gsc_set_affinity_irq(struct irq_data *d, const struct cpumask *dest, -+ bool force) -+{ -+ struct gsc_asic *gsc_dev = irq_data_get_irq_chip_data(d); -+ struct cpumask tmask; -+ int cpu_irq; -+ -+ if (!cpumask_and(&tmask, dest, cpu_online_mask)) -+ return -EINVAL; -+ -+ cpu_irq = cpu_check_affinity(d, &tmask); -+ if (cpu_irq < 0) -+ return cpu_irq; -+ -+ gsc_dev->gsc_irq.txn_addr = txn_affinity_addr(d->irq, cpu_irq); -+ gsc_dev->eim = ((u32) gsc_dev->gsc_irq.txn_addr) | gsc_dev->gsc_irq.txn_data; -+ -+ /* switch IRQ's for devices below LASI/WAX to other CPU */ -+ gsc_writel(gsc_dev->eim, gsc_dev->hpa + OFFSET_IAR); -+ -+ irq_data_update_effective_affinity(d, &tmask); -+ -+ return IRQ_SET_MASK_OK; -+} -+#endif -+ -+ - static struct irq_chip gsc_asic_interrupt_type = { - .name = "GSC-ASIC", - .irq_unmask = gsc_asic_unmask_irq, - .irq_mask = gsc_asic_mask_irq, -+#ifdef CONFIG_SMP -+ .irq_set_affinity = gsc_set_affinity_irq, -+#endif - }; - - int gsc_assign_irq(struct irq_chip *type, void *data) -diff --git a/drivers/parisc/gsc.h b/drivers/parisc/gsc.h -index 86abad3fa2150..73cbd0bb1975a 100644 ---- a/drivers/parisc/gsc.h -+++ b/drivers/parisc/gsc.h -@@ -31,6 +31,7 @@ struct gsc_asic { - int version; - int type; - int eim; -+ struct gsc_irq gsc_irq; - int global_irq[32]; - }; - -diff --git a/drivers/parisc/lasi.c b/drivers/parisc/lasi.c -index 4e4fd12c2112e..6ef621adb63a8 100644 ---- a/drivers/parisc/lasi.c -+++ b/drivers/parisc/lasi.c -@@ -163,7 +163,6 @@ static int __init lasi_init_chip(struct parisc_device *dev) - { - extern void (*chassis_power_off)(void); - struct gsc_asic *lasi; -- struct gsc_irq gsc_irq; - int ret; - - lasi = kzalloc(sizeof(*lasi), GFP_KERNEL); -@@ -185,7 +184,7 @@ static int __init lasi_init_chip(struct parisc_device *dev) - lasi_init_irq(lasi); - - /* the IRQ lasi should use */ -- dev->irq = gsc_alloc_irq(&gsc_irq); -+ dev->irq = gsc_alloc_irq(&lasi->gsc_irq); - if (dev->irq < 0) { - printk(KERN_ERR "%s(): cannot get GSC irq\n", - __func__); -@@ -193,9 +192,9 @@ static int __init lasi_init_chip(struct parisc_device *dev) - return -EBUSY; - } - -- lasi->eim = ((u32) gsc_irq.txn_addr) | gsc_irq.txn_data; -+ lasi->eim = ((u32) lasi->gsc_irq.txn_addr) | lasi->gsc_irq.txn_data; - -- ret = request_irq(gsc_irq.irq, gsc_asic_intr, 0, "lasi", lasi); -+ ret = request_irq(lasi->gsc_irq.irq, gsc_asic_intr, 0, "lasi", lasi); - if (ret < 0) { - kfree(lasi); - return ret; -diff --git a/drivers/parisc/wax.c b/drivers/parisc/wax.c -index 5b6df15162354..73a2b01f8d9ca 100644 ---- a/drivers/parisc/wax.c -+++ b/drivers/parisc/wax.c -@@ -68,7 +68,6 @@ static int __init wax_init_chip(struct parisc_device *dev) - { - struct gsc_asic *wax; - struct parisc_device *parent; -- struct gsc_irq gsc_irq; - int ret; - - wax = kzalloc(sizeof(*wax), GFP_KERNEL); -@@ -85,7 +84,7 @@ static int __init wax_init_chip(struct parisc_device *dev) - wax_init_irq(wax); - - /* the IRQ wax should use */ -- dev->irq = gsc_claim_irq(&gsc_irq, WAX_GSC_IRQ); -+ dev->irq = gsc_claim_irq(&wax->gsc_irq, WAX_GSC_IRQ); - if (dev->irq < 0) { - printk(KERN_ERR "%s(): cannot get GSC irq\n", - __func__); -@@ -93,9 +92,9 @@ static int __init wax_init_chip(struct parisc_device *dev) - return -EBUSY; - } - -- wax->eim = ((u32) gsc_irq.txn_addr) | gsc_irq.txn_data; -+ wax->eim = ((u32) wax->gsc_irq.txn_addr) | wax->gsc_irq.txn_data; - -- ret = request_irq(gsc_irq.irq, gsc_asic_intr, 0, "wax", wax); -+ ret = request_irq(wax->gsc_irq.irq, gsc_asic_intr, 0, "wax", wax); - if (ret < 0) { - kfree(wax); - return ret; -diff --git a/drivers/pci/access.c b/drivers/pci/access.c -index 0914ddeae17f4..c909c66a63e2d 100644 ---- a/drivers/pci/access.c -+++ b/drivers/pci/access.c -@@ -160,9 +160,12 @@ int pci_generic_config_write32(struct pci_bus *bus, unsigned int devfn, - * write happen to have any RW1C (write-one-to-clear) bits set, we - * just inadvertently cleared something we shouldn't have. - */ -- dev_warn_ratelimited(&bus->dev, "%d-byte config write to %04x:%02x:%02x.%d offset %#x may corrupt adjacent RW1C bits\n", -- size, pci_domain_nr(bus), bus->number, -- PCI_SLOT(devfn), PCI_FUNC(devfn), where); -+ if (!bus->unsafe_warn) { -+ dev_warn(&bus->dev, "%d-byte config write to %04x:%02x:%02x.%d offset %#x may corrupt adjacent RW1C bits\n", -+ size, pci_domain_nr(bus), bus->number, -+ PCI_SLOT(devfn), PCI_FUNC(devfn), where); -+ bus->unsafe_warn = 1; -+ } - - mask = ~(((1 << (size * 8)) - 1) << ((where & 0x3) * 8)); - tmp = readl(addr) & mask; -diff --git a/drivers/pci/controller/pci-aardvark.c b/drivers/pci/controller/pci-aardvark.c -index d2f8cd3a9568b..721d2652319ce 100644 ---- a/drivers/pci/controller/pci-aardvark.c -+++ b/drivers/pci/controller/pci-aardvark.c -@@ -835,7 +835,9 @@ advk_pci_bridge_emul_pcie_conf_read(struct pci_bridge_emul *bridge, - case PCI_EXP_RTSTA: { - u32 isr0 = advk_readl(pcie, PCIE_ISR0_REG); - u32 msglog = advk_readl(pcie, PCIE_MSG_LOG_REG); -- *value = (isr0 & PCIE_MSG_PM_PME_MASK) << 16 | (msglog >> 16); -+ *value = msglog >> 16; -+ if (isr0 & PCIE_MSG_PM_PME_MASK) -+ *value |= PCI_EXP_RTSTA_PME; - return PCI_BRIDGE_EMUL_HANDLED; - } - -@@ -1168,7 +1170,7 @@ static void advk_msi_irq_compose_msi_msg(struct irq_data *data, - - msg->address_lo = lower_32_bits(msi_msg); - msg->address_hi = upper_32_bits(msi_msg); -- msg->data = data->irq; -+ msg->data = data->hwirq; - } - - static int advk_msi_set_affinity(struct irq_data *irq_data, -@@ -1185,15 +1187,11 @@ static int advk_msi_irq_domain_alloc(struct irq_domain *domain, - int hwirq, i; - - mutex_lock(&pcie->msi_used_lock); -- hwirq = bitmap_find_next_zero_area(pcie->msi_used, MSI_IRQ_NUM, -- 0, nr_irqs, 0); -- if (hwirq >= MSI_IRQ_NUM) { -- mutex_unlock(&pcie->msi_used_lock); -- return -ENOSPC; -- } -- -- bitmap_set(pcie->msi_used, hwirq, nr_irqs); -+ hwirq = bitmap_find_free_region(pcie->msi_used, MSI_IRQ_NUM, -+ order_base_2(nr_irqs)); - mutex_unlock(&pcie->msi_used_lock); -+ if (hwirq < 0) -+ return -ENOSPC; - - for (i = 0; i < nr_irqs; i++) - irq_domain_set_info(domain, virq + i, hwirq + i, -@@ -1211,7 +1209,7 @@ static void advk_msi_irq_domain_free(struct irq_domain *domain, - struct advk_pcie *pcie = domain->host_data; - - mutex_lock(&pcie->msi_used_lock); -- bitmap_clear(pcie->msi_used, d->hwirq, nr_irqs); -+ bitmap_release_region(pcie->msi_used, d->hwirq, order_base_2(nr_irqs)); - mutex_unlock(&pcie->msi_used_lock); - } - -diff --git a/drivers/pci/hotplug/pciehp_hpc.c b/drivers/pci/hotplug/pciehp_hpc.c -index 907b8be86ce04..13f3bc239c660 100644 ---- a/drivers/pci/hotplug/pciehp_hpc.c -+++ b/drivers/pci/hotplug/pciehp_hpc.c -@@ -79,6 +79,8 @@ static int pcie_poll_cmd(struct controller *ctrl, int timeout) - if (slot_status & PCI_EXP_SLTSTA_CC) { - pcie_capability_write_word(pdev, PCI_EXP_SLTSTA, - PCI_EXP_SLTSTA_CC); -+ ctrl->cmd_busy = 0; -+ smp_mb(); - return 1; - } - if (timeout < 0) -@@ -957,6 +959,8 @@ static void quirk_cmd_compl(struct pci_dev *pdev) - } - DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, PCI_ANY_ID, - PCI_CLASS_BRIDGE_PCI, 8, quirk_cmd_compl); -+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_QCOM, 0x0110, -+ PCI_CLASS_BRIDGE_PCI, 8, quirk_cmd_compl); - DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_QCOM, 0x0400, - PCI_CLASS_BRIDGE_PCI, 8, quirk_cmd_compl); - DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_QCOM, 0x0401, -diff --git a/drivers/perf/qcom_l2_pmu.c b/drivers/perf/qcom_l2_pmu.c -index 4da37f650f983..7018eb21d1892 100644 ---- a/drivers/perf/qcom_l2_pmu.c -+++ b/drivers/perf/qcom_l2_pmu.c -@@ -781,7 +781,7 @@ static struct cluster_pmu *l2_cache_associate_cpu_with_cluster( - { - u64 mpidr; - int cpu_cluster_id; -- struct cluster_pmu *cluster = NULL; -+ struct cluster_pmu *cluster; - - /* - * This assumes that the cluster_id is in MPIDR[aff1] for -@@ -803,10 +803,10 @@ static struct cluster_pmu *l2_cache_associate_cpu_with_cluster( - cluster->cluster_id); - cpumask_set_cpu(cpu, &cluster->cluster_cpus); - *per_cpu_ptr(l2cache_pmu->pmu_cluster, cpu) = cluster; -- break; -+ return cluster; - } - -- return cluster; -+ return NULL; - } - - static int l2cache_pmu_online_cpu(unsigned int cpu, struct hlist_node *node) -diff --git a/drivers/phy/phy-core-mipi-dphy.c b/drivers/phy/phy-core-mipi-dphy.c -index 14e0551cd3190..0aa740b73d0db 100644 ---- a/drivers/phy/phy-core-mipi-dphy.c -+++ b/drivers/phy/phy-core-mipi-dphy.c -@@ -66,10 +66,10 @@ int phy_mipi_dphy_get_default_config(unsigned long pixel_clock, - cfg->hs_trail = max(4 * 8 * ui, 60000 + 4 * 4 * ui); - - cfg->init = 100; -- cfg->lpx = 60000; -+ cfg->lpx = 50000; - cfg->ta_get = 5 * cfg->lpx; - cfg->ta_go = 4 * cfg->lpx; -- cfg->ta_sure = 2 * cfg->lpx; -+ cfg->ta_sure = cfg->lpx; - cfg->wakeup = 1000; - - cfg->hs_clk_rate = hs_clk_rate; -diff --git a/drivers/pinctrl/mediatek/pinctrl-mtk-common.c b/drivers/pinctrl/mediatek/pinctrl-mtk-common.c -index 53f52b9a0acdc..c2df70712ca22 100644 ---- a/drivers/pinctrl/mediatek/pinctrl-mtk-common.c -+++ b/drivers/pinctrl/mediatek/pinctrl-mtk-common.c -@@ -1038,6 +1038,7 @@ int mtk_pctrl_init(struct platform_device *pdev, - node = of_parse_phandle(np, "mediatek,pctl-regmap", 0); - if (node) { - pctl->regmap1 = syscon_node_to_regmap(node); -+ of_node_put(node); - if (IS_ERR(pctl->regmap1)) - return PTR_ERR(pctl->regmap1); - } else if (regmap) { -@@ -1051,6 +1052,7 @@ int mtk_pctrl_init(struct platform_device *pdev, - node = of_parse_phandle(np, "mediatek,pctl-regmap", 1); - if (node) { - pctl->regmap2 = syscon_node_to_regmap(node); -+ of_node_put(node); - if (IS_ERR(pctl->regmap2)) - return PTR_ERR(pctl->regmap2); - } -diff --git a/drivers/pinctrl/mediatek/pinctrl-paris.c b/drivers/pinctrl/mediatek/pinctrl-paris.c -index 923264d0e9ef2..31449514a8c0c 100644 ---- a/drivers/pinctrl/mediatek/pinctrl-paris.c -+++ b/drivers/pinctrl/mediatek/pinctrl-paris.c -@@ -198,8 +198,7 @@ static int mtk_pinconf_get(struct pinctrl_dev *pctldev, - } - - static int mtk_pinconf_set(struct pinctrl_dev *pctldev, unsigned int pin, -- enum pin_config_param param, -- enum pin_config_param arg) -+ enum pin_config_param param, u32 arg) - { - struct mtk_pinctrl *hw = pinctrl_dev_get_drvdata(pctldev); - const struct mtk_pin_desc *desc; -@@ -647,10 +646,10 @@ static int mtk_pconf_group_get(struct pinctrl_dev *pctldev, unsigned group, - unsigned long *config) - { - struct mtk_pinctrl *hw = pinctrl_dev_get_drvdata(pctldev); -+ struct mtk_pinctrl_group *grp = &hw->groups[group]; - -- *config = hw->groups[group].config; -- -- return 0; -+ /* One pin per group only */ -+ return mtk_pinconf_get(pctldev, grp->pin, config); - } - - static int mtk_pconf_group_set(struct pinctrl_dev *pctldev, unsigned group, -@@ -666,8 +665,6 @@ static int mtk_pconf_group_set(struct pinctrl_dev *pctldev, unsigned group, - pinconf_to_config_argument(configs[i])); - if (ret < 0) - return ret; -- -- grp->config = configs[i]; - } - - return 0; -diff --git a/drivers/pinctrl/nomadik/pinctrl-nomadik.c b/drivers/pinctrl/nomadik/pinctrl-nomadik.c -index 2a8190b11d104..9f00adfefba8e 100644 ---- a/drivers/pinctrl/nomadik/pinctrl-nomadik.c -+++ b/drivers/pinctrl/nomadik/pinctrl-nomadik.c -@@ -1923,8 +1923,10 @@ static int nmk_pinctrl_probe(struct platform_device *pdev) - } - - prcm_np = of_parse_phandle(np, "prcm", 0); -- if (prcm_np) -+ if (prcm_np) { - npct->prcm_base = of_iomap(prcm_np, 0); -+ of_node_put(prcm_np); -+ } - if (!npct->prcm_base) { - if (version == PINCTRL_NMK_STN8815) { - dev_info(&pdev->dev, -diff --git a/drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c b/drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c -index 17f909d8b63a9..2dccd24c65557 100644 ---- a/drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c -+++ b/drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c -@@ -78,7 +78,6 @@ struct npcm7xx_gpio { - struct gpio_chip gc; - int irqbase; - int irq; -- void *priv; - struct irq_chip irq_chip; - u32 pinctrl_id; - int (*direction_input)(struct gpio_chip *chip, unsigned offset); -@@ -226,7 +225,7 @@ static void npcmgpio_irq_handler(struct irq_desc *desc) - chained_irq_enter(chip, desc); - sts = ioread32(bank->base + NPCM7XX_GP_N_EVST); - en = ioread32(bank->base + NPCM7XX_GP_N_EVEN); -- dev_dbg(chip->parent_device, "==> got irq sts %.8x %.8x\n", sts, -+ dev_dbg(bank->gc.parent, "==> got irq sts %.8x %.8x\n", sts, - en); - - sts &= en; -@@ -241,33 +240,33 @@ static int npcmgpio_set_irq_type(struct irq_data *d, unsigned int type) - gpiochip_get_data(irq_data_get_irq_chip_data(d)); - unsigned int gpio = BIT(d->hwirq); - -- dev_dbg(d->chip->parent_device, "setirqtype: %u.%u = %u\n", gpio, -+ dev_dbg(bank->gc.parent, "setirqtype: %u.%u = %u\n", gpio, - d->irq, type); - switch (type) { - case IRQ_TYPE_EDGE_RISING: -- dev_dbg(d->chip->parent_device, "edge.rising\n"); -+ dev_dbg(bank->gc.parent, "edge.rising\n"); - npcm_gpio_clr(&bank->gc, bank->base + NPCM7XX_GP_N_EVBE, gpio); - npcm_gpio_clr(&bank->gc, bank->base + NPCM7XX_GP_N_POL, gpio); - break; - case IRQ_TYPE_EDGE_FALLING: -- dev_dbg(d->chip->parent_device, "edge.falling\n"); -+ dev_dbg(bank->gc.parent, "edge.falling\n"); - npcm_gpio_clr(&bank->gc, bank->base + NPCM7XX_GP_N_EVBE, gpio); - npcm_gpio_set(&bank->gc, bank->base + NPCM7XX_GP_N_POL, gpio); - break; - case IRQ_TYPE_EDGE_BOTH: -- dev_dbg(d->chip->parent_device, "edge.both\n"); -+ dev_dbg(bank->gc.parent, "edge.both\n"); - npcm_gpio_set(&bank->gc, bank->base + NPCM7XX_GP_N_EVBE, gpio); - break; - case IRQ_TYPE_LEVEL_LOW: -- dev_dbg(d->chip->parent_device, "level.low\n"); -+ dev_dbg(bank->gc.parent, "level.low\n"); - npcm_gpio_set(&bank->gc, bank->base + NPCM7XX_GP_N_POL, gpio); - break; - case IRQ_TYPE_LEVEL_HIGH: -- dev_dbg(d->chip->parent_device, "level.high\n"); -+ dev_dbg(bank->gc.parent, "level.high\n"); - npcm_gpio_clr(&bank->gc, bank->base + NPCM7XX_GP_N_POL, gpio); - break; - default: -- dev_dbg(d->chip->parent_device, "invalid irq type\n"); -+ dev_dbg(bank->gc.parent, "invalid irq type\n"); - return -EINVAL; - } - -@@ -289,7 +288,7 @@ static void npcmgpio_irq_ack(struct irq_data *d) - gpiochip_get_data(irq_data_get_irq_chip_data(d)); - unsigned int gpio = d->hwirq; - -- dev_dbg(d->chip->parent_device, "irq_ack: %u.%u\n", gpio, d->irq); -+ dev_dbg(bank->gc.parent, "irq_ack: %u.%u\n", gpio, d->irq); - iowrite32(BIT(gpio), bank->base + NPCM7XX_GP_N_EVST); - } - -@@ -301,7 +300,7 @@ static void npcmgpio_irq_mask(struct irq_data *d) - unsigned int gpio = d->hwirq; - - /* Clear events */ -- dev_dbg(d->chip->parent_device, "irq_mask: %u.%u\n", gpio, d->irq); -+ dev_dbg(bank->gc.parent, "irq_mask: %u.%u\n", gpio, d->irq); - iowrite32(BIT(gpio), bank->base + NPCM7XX_GP_N_EVENC); - } - -@@ -313,7 +312,7 @@ static void npcmgpio_irq_unmask(struct irq_data *d) - unsigned int gpio = d->hwirq; - - /* Enable events */ -- dev_dbg(d->chip->parent_device, "irq_unmask: %u.%u\n", gpio, d->irq); -+ dev_dbg(bank->gc.parent, "irq_unmask: %u.%u\n", gpio, d->irq); - iowrite32(BIT(gpio), bank->base + NPCM7XX_GP_N_EVENS); - } - -@@ -323,7 +322,7 @@ static unsigned int npcmgpio_irq_startup(struct irq_data *d) - unsigned int gpio = d->hwirq; - - /* active-high, input, clear interrupt, enable interrupt */ -- dev_dbg(d->chip->parent_device, "startup: %u.%u\n", gpio, d->irq); -+ dev_dbg(gc->parent, "startup: %u.%u\n", gpio, d->irq); - npcmgpio_direction_input(gc, gpio); - npcmgpio_irq_ack(d); - npcmgpio_irq_unmask(d); -@@ -905,7 +904,7 @@ static struct npcm7xx_func npcm7xx_funcs[] = { - #define DRIVE_STRENGTH_HI_SHIFT 12 - #define DRIVE_STRENGTH_MASK 0x0000FF00 - --#define DS(lo, hi) (((lo) << DRIVE_STRENGTH_LO_SHIFT) | \ -+#define DSTR(lo, hi) (((lo) << DRIVE_STRENGTH_LO_SHIFT) | \ - ((hi) << DRIVE_STRENGTH_HI_SHIFT)) - #define DSLO(x) (((x) >> DRIVE_STRENGTH_LO_SHIFT) & 0xF) - #define DSHI(x) (((x) >> DRIVE_STRENGTH_HI_SHIFT) & 0xF) -@@ -925,31 +924,31 @@ struct npcm7xx_pincfg { - static const struct npcm7xx_pincfg pincfg[] = { - /* PIN FUNCTION 1 FUNCTION 2 FUNCTION 3 FLAGS */ - NPCM7XX_PINCFG(0, iox1, MFSEL1, 30, none, NONE, 0, none, NONE, 0, 0), -- NPCM7XX_PINCFG(1, iox1, MFSEL1, 30, none, NONE, 0, none, NONE, 0, DS(8, 12)), -- NPCM7XX_PINCFG(2, iox1, MFSEL1, 30, none, NONE, 0, none, NONE, 0, DS(8, 12)), -+ NPCM7XX_PINCFG(1, iox1, MFSEL1, 30, none, NONE, 0, none, NONE, 0, DSTR(8, 12)), -+ NPCM7XX_PINCFG(2, iox1, MFSEL1, 30, none, NONE, 0, none, NONE, 0, DSTR(8, 12)), - NPCM7XX_PINCFG(3, iox1, MFSEL1, 30, none, NONE, 0, none, NONE, 0, 0), - NPCM7XX_PINCFG(4, iox2, MFSEL3, 14, smb1d, I2CSEGSEL, 7, none, NONE, 0, SLEW), - NPCM7XX_PINCFG(5, iox2, MFSEL3, 14, smb1d, I2CSEGSEL, 7, none, NONE, 0, SLEW), - NPCM7XX_PINCFG(6, iox2, MFSEL3, 14, smb2d, I2CSEGSEL, 10, none, NONE, 0, SLEW), - NPCM7XX_PINCFG(7, iox2, MFSEL3, 14, smb2d, I2CSEGSEL, 10, none, NONE, 0, SLEW), -- NPCM7XX_PINCFG(8, lkgpo1, FLOCKR1, 4, none, NONE, 0, none, NONE, 0, DS(8, 12)), -- NPCM7XX_PINCFG(9, lkgpo2, FLOCKR1, 8, none, NONE, 0, none, NONE, 0, DS(8, 12)), -- NPCM7XX_PINCFG(10, ioxh, MFSEL3, 18, none, NONE, 0, none, NONE, 0, DS(8, 12)), -- NPCM7XX_PINCFG(11, ioxh, MFSEL3, 18, none, NONE, 0, none, NONE, 0, DS(8, 12)), -+ NPCM7XX_PINCFG(8, lkgpo1, FLOCKR1, 4, none, NONE, 0, none, NONE, 0, DSTR(8, 12)), -+ NPCM7XX_PINCFG(9, lkgpo2, FLOCKR1, 8, none, NONE, 0, none, NONE, 0, DSTR(8, 12)), -+ NPCM7XX_PINCFG(10, ioxh, MFSEL3, 18, none, NONE, 0, none, NONE, 0, DSTR(8, 12)), -+ NPCM7XX_PINCFG(11, ioxh, MFSEL3, 18, none, NONE, 0, none, NONE, 0, DSTR(8, 12)), - NPCM7XX_PINCFG(12, gspi, MFSEL1, 24, smb5b, I2CSEGSEL, 19, none, NONE, 0, SLEW), - NPCM7XX_PINCFG(13, gspi, MFSEL1, 24, smb5b, I2CSEGSEL, 19, none, NONE, 0, SLEW), - NPCM7XX_PINCFG(14, gspi, MFSEL1, 24, smb5c, I2CSEGSEL, 20, none, NONE, 0, SLEW), - NPCM7XX_PINCFG(15, gspi, MFSEL1, 24, smb5c, I2CSEGSEL, 20, none, NONE, 0, SLEW), -- NPCM7XX_PINCFG(16, lkgpo0, FLOCKR1, 0, none, NONE, 0, none, NONE, 0, DS(8, 12)), -- NPCM7XX_PINCFG(17, pspi2, MFSEL3, 13, smb4den, I2CSEGSEL, 23, none, NONE, 0, DS(8, 12)), -- NPCM7XX_PINCFG(18, pspi2, MFSEL3, 13, smb4b, I2CSEGSEL, 14, none, NONE, 0, DS(8, 12)), -- NPCM7XX_PINCFG(19, pspi2, MFSEL3, 13, smb4b, I2CSEGSEL, 14, none, NONE, 0, DS(8, 12)), -+ NPCM7XX_PINCFG(16, lkgpo0, FLOCKR1, 0, none, NONE, 0, none, NONE, 0, DSTR(8, 12)), -+ NPCM7XX_PINCFG(17, pspi2, MFSEL3, 13, smb4den, I2CSEGSEL, 23, none, NONE, 0, DSTR(8, 12)), -+ NPCM7XX_PINCFG(18, pspi2, MFSEL3, 13, smb4b, I2CSEGSEL, 14, none, NONE, 0, DSTR(8, 12)), -+ NPCM7XX_PINCFG(19, pspi2, MFSEL3, 13, smb4b, I2CSEGSEL, 14, none, NONE, 0, DSTR(8, 12)), - NPCM7XX_PINCFG(20, smb4c, I2CSEGSEL, 15, smb15, MFSEL3, 8, none, NONE, 0, 0), - NPCM7XX_PINCFG(21, smb4c, I2CSEGSEL, 15, smb15, MFSEL3, 8, none, NONE, 0, 0), - NPCM7XX_PINCFG(22, smb4d, I2CSEGSEL, 16, smb14, MFSEL3, 7, none, NONE, 0, 0), - NPCM7XX_PINCFG(23, smb4d, I2CSEGSEL, 16, smb14, MFSEL3, 7, none, NONE, 0, 0), -- NPCM7XX_PINCFG(24, ioxh, MFSEL3, 18, none, NONE, 0, none, NONE, 0, DS(8, 12)), -- NPCM7XX_PINCFG(25, ioxh, MFSEL3, 18, none, NONE, 0, none, NONE, 0, DS(8, 12)), -+ NPCM7XX_PINCFG(24, ioxh, MFSEL3, 18, none, NONE, 0, none, NONE, 0, DSTR(8, 12)), -+ NPCM7XX_PINCFG(25, ioxh, MFSEL3, 18, none, NONE, 0, none, NONE, 0, DSTR(8, 12)), - NPCM7XX_PINCFG(26, smb5, MFSEL1, 2, none, NONE, 0, none, NONE, 0, 0), - NPCM7XX_PINCFG(27, smb5, MFSEL1, 2, none, NONE, 0, none, NONE, 0, 0), - NPCM7XX_PINCFG(28, smb4, MFSEL1, 1, none, NONE, 0, none, NONE, 0, 0), -@@ -965,12 +964,12 @@ static const struct npcm7xx_pincfg pincfg[] = { - NPCM7XX_PINCFG(39, smb3b, I2CSEGSEL, 11, none, NONE, 0, none, NONE, 0, SLEW), - NPCM7XX_PINCFG(40, smb3b, I2CSEGSEL, 11, none, NONE, 0, none, NONE, 0, SLEW), - NPCM7XX_PINCFG(41, bmcuart0a, MFSEL1, 9, none, NONE, 0, none, NONE, 0, 0), -- NPCM7XX_PINCFG(42, bmcuart0a, MFSEL1, 9, none, NONE, 0, none, NONE, 0, DS(2, 4) | GPO), -+ NPCM7XX_PINCFG(42, bmcuart0a, MFSEL1, 9, none, NONE, 0, none, NONE, 0, DSTR(2, 4) | GPO), - NPCM7XX_PINCFG(43, uart1, MFSEL1, 10, jtag2, MFSEL4, 0, bmcuart1, MFSEL3, 24, 0), - NPCM7XX_PINCFG(44, uart1, MFSEL1, 10, jtag2, MFSEL4, 0, bmcuart1, MFSEL3, 24, 0), - NPCM7XX_PINCFG(45, uart1, MFSEL1, 10, jtag2, MFSEL4, 0, none, NONE, 0, 0), -- NPCM7XX_PINCFG(46, uart1, MFSEL1, 10, jtag2, MFSEL4, 0, none, NONE, 0, DS(2, 8)), -- NPCM7XX_PINCFG(47, uart1, MFSEL1, 10, jtag2, MFSEL4, 0, none, NONE, 0, DS(2, 8)), -+ NPCM7XX_PINCFG(46, uart1, MFSEL1, 10, jtag2, MFSEL4, 0, none, NONE, 0, DSTR(2, 8)), -+ NPCM7XX_PINCFG(47, uart1, MFSEL1, 10, jtag2, MFSEL4, 0, none, NONE, 0, DSTR(2, 8)), - NPCM7XX_PINCFG(48, uart2, MFSEL1, 11, bmcuart0b, MFSEL4, 1, none, NONE, 0, GPO), - NPCM7XX_PINCFG(49, uart2, MFSEL1, 11, bmcuart0b, MFSEL4, 1, none, NONE, 0, 0), - NPCM7XX_PINCFG(50, uart2, MFSEL1, 11, none, NONE, 0, none, NONE, 0, 0), -@@ -980,8 +979,8 @@ static const struct npcm7xx_pincfg pincfg[] = { - NPCM7XX_PINCFG(54, uart2, MFSEL1, 11, none, NONE, 0, none, NONE, 0, 0), - NPCM7XX_PINCFG(55, uart2, MFSEL1, 11, none, NONE, 0, none, NONE, 0, 0), - NPCM7XX_PINCFG(56, r1err, MFSEL1, 12, none, NONE, 0, none, NONE, 0, 0), -- NPCM7XX_PINCFG(57, r1md, MFSEL1, 13, none, NONE, 0, none, NONE, 0, DS(2, 4)), -- NPCM7XX_PINCFG(58, r1md, MFSEL1, 13, none, NONE, 0, none, NONE, 0, DS(2, 4)), -+ NPCM7XX_PINCFG(57, r1md, MFSEL1, 13, none, NONE, 0, none, NONE, 0, DSTR(2, 4)), -+ NPCM7XX_PINCFG(58, r1md, MFSEL1, 13, none, NONE, 0, none, NONE, 0, DSTR(2, 4)), - NPCM7XX_PINCFG(59, smb3d, I2CSEGSEL, 13, none, NONE, 0, none, NONE, 0, 0), - NPCM7XX_PINCFG(60, smb3d, I2CSEGSEL, 13, none, NONE, 0, none, NONE, 0, 0), - NPCM7XX_PINCFG(61, uart1, MFSEL1, 10, none, NONE, 0, none, NONE, 0, GPO), -@@ -1004,19 +1003,19 @@ static const struct npcm7xx_pincfg pincfg[] = { - NPCM7XX_PINCFG(77, fanin13, MFSEL2, 13, none, NONE, 0, none, NONE, 0, 0), - NPCM7XX_PINCFG(78, fanin14, MFSEL2, 14, none, NONE, 0, none, NONE, 0, 0), - NPCM7XX_PINCFG(79, fanin15, MFSEL2, 15, none, NONE, 0, none, NONE, 0, 0), -- NPCM7XX_PINCFG(80, pwm0, MFSEL2, 16, none, NONE, 0, none, NONE, 0, DS(4, 8)), -- NPCM7XX_PINCFG(81, pwm1, MFSEL2, 17, none, NONE, 0, none, NONE, 0, DS(4, 8)), -- NPCM7XX_PINCFG(82, pwm2, MFSEL2, 18, none, NONE, 0, none, NONE, 0, DS(4, 8)), -- NPCM7XX_PINCFG(83, pwm3, MFSEL2, 19, none, NONE, 0, none, NONE, 0, DS(4, 8)), -- NPCM7XX_PINCFG(84, r2, MFSEL1, 14, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), -- NPCM7XX_PINCFG(85, r2, MFSEL1, 14, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), -- NPCM7XX_PINCFG(86, r2, MFSEL1, 14, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), -+ NPCM7XX_PINCFG(80, pwm0, MFSEL2, 16, none, NONE, 0, none, NONE, 0, DSTR(4, 8)), -+ NPCM7XX_PINCFG(81, pwm1, MFSEL2, 17, none, NONE, 0, none, NONE, 0, DSTR(4, 8)), -+ NPCM7XX_PINCFG(82, pwm2, MFSEL2, 18, none, NONE, 0, none, NONE, 0, DSTR(4, 8)), -+ NPCM7XX_PINCFG(83, pwm3, MFSEL2, 19, none, NONE, 0, none, NONE, 0, DSTR(4, 8)), -+ NPCM7XX_PINCFG(84, r2, MFSEL1, 14, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), -+ NPCM7XX_PINCFG(85, r2, MFSEL1, 14, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), -+ NPCM7XX_PINCFG(86, r2, MFSEL1, 14, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), - NPCM7XX_PINCFG(87, r2, MFSEL1, 14, none, NONE, 0, none, NONE, 0, 0), - NPCM7XX_PINCFG(88, r2, MFSEL1, 14, none, NONE, 0, none, NONE, 0, 0), - NPCM7XX_PINCFG(89, r2, MFSEL1, 14, none, NONE, 0, none, NONE, 0, 0), - NPCM7XX_PINCFG(90, r2err, MFSEL1, 15, none, NONE, 0, none, NONE, 0, 0), -- NPCM7XX_PINCFG(91, r2md, MFSEL1, 16, none, NONE, 0, none, NONE, 0, DS(2, 4)), -- NPCM7XX_PINCFG(92, r2md, MFSEL1, 16, none, NONE, 0, none, NONE, 0, DS(2, 4)), -+ NPCM7XX_PINCFG(91, r2md, MFSEL1, 16, none, NONE, 0, none, NONE, 0, DSTR(2, 4)), -+ NPCM7XX_PINCFG(92, r2md, MFSEL1, 16, none, NONE, 0, none, NONE, 0, DSTR(2, 4)), - NPCM7XX_PINCFG(93, ga20kbc, MFSEL1, 17, smb5d, I2CSEGSEL, 21, none, NONE, 0, 0), - NPCM7XX_PINCFG(94, ga20kbc, MFSEL1, 17, smb5d, I2CSEGSEL, 21, none, NONE, 0, 0), - NPCM7XX_PINCFG(95, lpc, NONE, 0, espi, MFSEL4, 8, gpio, MFSEL1, 26, 0), -@@ -1062,34 +1061,34 @@ static const struct npcm7xx_pincfg pincfg[] = { - NPCM7XX_PINCFG(133, smb10, MFSEL4, 13, none, NONE, 0, none, NONE, 0, 0), - NPCM7XX_PINCFG(134, smb11, MFSEL4, 14, none, NONE, 0, none, NONE, 0, 0), - NPCM7XX_PINCFG(135, smb11, MFSEL4, 14, none, NONE, 0, none, NONE, 0, 0), -- NPCM7XX_PINCFG(136, sd1, MFSEL3, 12, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), -- NPCM7XX_PINCFG(137, sd1, MFSEL3, 12, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), -- NPCM7XX_PINCFG(138, sd1, MFSEL3, 12, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), -- NPCM7XX_PINCFG(139, sd1, MFSEL3, 12, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), -- NPCM7XX_PINCFG(140, sd1, MFSEL3, 12, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), -+ NPCM7XX_PINCFG(136, sd1, MFSEL3, 12, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), -+ NPCM7XX_PINCFG(137, sd1, MFSEL3, 12, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), -+ NPCM7XX_PINCFG(138, sd1, MFSEL3, 12, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), -+ NPCM7XX_PINCFG(139, sd1, MFSEL3, 12, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), -+ NPCM7XX_PINCFG(140, sd1, MFSEL3, 12, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), - NPCM7XX_PINCFG(141, sd1, MFSEL3, 12, none, NONE, 0, none, NONE, 0, 0), -- NPCM7XX_PINCFG(142, sd1, MFSEL3, 12, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), -+ NPCM7XX_PINCFG(142, sd1, MFSEL3, 12, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), - NPCM7XX_PINCFG(143, sd1, MFSEL3, 12, sd1pwr, MFSEL4, 5, none, NONE, 0, 0), -- NPCM7XX_PINCFG(144, pwm4, MFSEL2, 20, none, NONE, 0, none, NONE, 0, DS(4, 8)), -- NPCM7XX_PINCFG(145, pwm5, MFSEL2, 21, none, NONE, 0, none, NONE, 0, DS(4, 8)), -- NPCM7XX_PINCFG(146, pwm6, MFSEL2, 22, none, NONE, 0, none, NONE, 0, DS(4, 8)), -- NPCM7XX_PINCFG(147, pwm7, MFSEL2, 23, none, NONE, 0, none, NONE, 0, DS(4, 8)), -- NPCM7XX_PINCFG(148, mmc8, MFSEL3, 11, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), -- NPCM7XX_PINCFG(149, mmc8, MFSEL3, 11, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), -- NPCM7XX_PINCFG(150, mmc8, MFSEL3, 11, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), -- NPCM7XX_PINCFG(151, mmc8, MFSEL3, 11, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), -- NPCM7XX_PINCFG(152, mmc, MFSEL3, 10, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), -+ NPCM7XX_PINCFG(144, pwm4, MFSEL2, 20, none, NONE, 0, none, NONE, 0, DSTR(4, 8)), -+ NPCM7XX_PINCFG(145, pwm5, MFSEL2, 21, none, NONE, 0, none, NONE, 0, DSTR(4, 8)), -+ NPCM7XX_PINCFG(146, pwm6, MFSEL2, 22, none, NONE, 0, none, NONE, 0, DSTR(4, 8)), -+ NPCM7XX_PINCFG(147, pwm7, MFSEL2, 23, none, NONE, 0, none, NONE, 0, DSTR(4, 8)), -+ NPCM7XX_PINCFG(148, mmc8, MFSEL3, 11, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), -+ NPCM7XX_PINCFG(149, mmc8, MFSEL3, 11, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), -+ NPCM7XX_PINCFG(150, mmc8, MFSEL3, 11, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), -+ NPCM7XX_PINCFG(151, mmc8, MFSEL3, 11, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), -+ NPCM7XX_PINCFG(152, mmc, MFSEL3, 10, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), - NPCM7XX_PINCFG(153, mmcwp, FLOCKR1, 24, none, NONE, 0, none, NONE, 0, 0), /* Z1/A1 */ -- NPCM7XX_PINCFG(154, mmc, MFSEL3, 10, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), -+ NPCM7XX_PINCFG(154, mmc, MFSEL3, 10, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), - NPCM7XX_PINCFG(155, mmccd, MFSEL3, 25, mmcrst, MFSEL4, 6, none, NONE, 0, 0), /* Z1/A1 */ -- NPCM7XX_PINCFG(156, mmc, MFSEL3, 10, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), -- NPCM7XX_PINCFG(157, mmc, MFSEL3, 10, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), -- NPCM7XX_PINCFG(158, mmc, MFSEL3, 10, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), -- NPCM7XX_PINCFG(159, mmc, MFSEL3, 10, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), -- -- NPCM7XX_PINCFG(160, clkout, MFSEL1, 21, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), -- NPCM7XX_PINCFG(161, lpc, NONE, 0, espi, MFSEL4, 8, gpio, MFSEL1, 26, DS(8, 12)), -- NPCM7XX_PINCFG(162, serirq, NONE, 0, gpio, MFSEL1, 31, none, NONE, 0, DS(8, 12)), -+ NPCM7XX_PINCFG(156, mmc, MFSEL3, 10, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), -+ NPCM7XX_PINCFG(157, mmc, MFSEL3, 10, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), -+ NPCM7XX_PINCFG(158, mmc, MFSEL3, 10, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), -+ NPCM7XX_PINCFG(159, mmc, MFSEL3, 10, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), -+ -+ NPCM7XX_PINCFG(160, clkout, MFSEL1, 21, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), -+ NPCM7XX_PINCFG(161, lpc, NONE, 0, espi, MFSEL4, 8, gpio, MFSEL1, 26, DSTR(8, 12)), -+ NPCM7XX_PINCFG(162, serirq, NONE, 0, gpio, MFSEL1, 31, none, NONE, 0, DSTR(8, 12)), - NPCM7XX_PINCFG(163, lpc, NONE, 0, espi, MFSEL4, 8, gpio, MFSEL1, 26, 0), - NPCM7XX_PINCFG(164, lpc, NONE, 0, espi, MFSEL4, 8, gpio, MFSEL1, 26, SLEWLPC), - NPCM7XX_PINCFG(165, lpc, NONE, 0, espi, MFSEL4, 8, gpio, MFSEL1, 26, SLEWLPC), -@@ -1102,25 +1101,25 @@ static const struct npcm7xx_pincfg pincfg[] = { - NPCM7XX_PINCFG(172, smb6, MFSEL3, 1, none, NONE, 0, none, NONE, 0, 0), - NPCM7XX_PINCFG(173, smb7, MFSEL3, 2, none, NONE, 0, none, NONE, 0, 0), - NPCM7XX_PINCFG(174, smb7, MFSEL3, 2, none, NONE, 0, none, NONE, 0, 0), -- NPCM7XX_PINCFG(175, pspi1, MFSEL3, 4, faninx, MFSEL3, 3, none, NONE, 0, DS(8, 12)), -- NPCM7XX_PINCFG(176, pspi1, MFSEL3, 4, faninx, MFSEL3, 3, none, NONE, 0, DS(8, 12)), -- NPCM7XX_PINCFG(177, pspi1, MFSEL3, 4, faninx, MFSEL3, 3, none, NONE, 0, DS(8, 12)), -- NPCM7XX_PINCFG(178, r1, MFSEL3, 9, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), -- NPCM7XX_PINCFG(179, r1, MFSEL3, 9, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), -- NPCM7XX_PINCFG(180, r1, MFSEL3, 9, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), -+ NPCM7XX_PINCFG(175, pspi1, MFSEL3, 4, faninx, MFSEL3, 3, none, NONE, 0, DSTR(8, 12)), -+ NPCM7XX_PINCFG(176, pspi1, MFSEL3, 4, faninx, MFSEL3, 3, none, NONE, 0, DSTR(8, 12)), -+ NPCM7XX_PINCFG(177, pspi1, MFSEL3, 4, faninx, MFSEL3, 3, none, NONE, 0, DSTR(8, 12)), -+ NPCM7XX_PINCFG(178, r1, MFSEL3, 9, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), -+ NPCM7XX_PINCFG(179, r1, MFSEL3, 9, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), -+ NPCM7XX_PINCFG(180, r1, MFSEL3, 9, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), - NPCM7XX_PINCFG(181, r1, MFSEL3, 9, none, NONE, 0, none, NONE, 0, 0), - NPCM7XX_PINCFG(182, r1, MFSEL3, 9, none, NONE, 0, none, NONE, 0, 0), -- NPCM7XX_PINCFG(183, spi3, MFSEL4, 16, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), -- NPCM7XX_PINCFG(184, spi3, MFSEL4, 16, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW | GPO), -- NPCM7XX_PINCFG(185, spi3, MFSEL4, 16, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW | GPO), -- NPCM7XX_PINCFG(186, spi3, MFSEL4, 16, none, NONE, 0, none, NONE, 0, DS(8, 12)), -- NPCM7XX_PINCFG(187, spi3cs1, MFSEL4, 17, none, NONE, 0, none, NONE, 0, DS(8, 12)), -- NPCM7XX_PINCFG(188, spi3quad, MFSEL4, 20, spi3cs2, MFSEL4, 18, none, NONE, 0, DS(8, 12) | SLEW), -- NPCM7XX_PINCFG(189, spi3quad, MFSEL4, 20, spi3cs3, MFSEL4, 19, none, NONE, 0, DS(8, 12) | SLEW), -- NPCM7XX_PINCFG(190, gpio, FLOCKR1, 20, nprd_smi, NONE, 0, none, NONE, 0, DS(2, 4)), -- NPCM7XX_PINCFG(191, none, NONE, 0, none, NONE, 0, none, NONE, 0, DS(8, 12)), /* XX */ -- -- NPCM7XX_PINCFG(192, none, NONE, 0, none, NONE, 0, none, NONE, 0, DS(8, 12)), /* XX */ -+ NPCM7XX_PINCFG(183, spi3, MFSEL4, 16, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), -+ NPCM7XX_PINCFG(184, spi3, MFSEL4, 16, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW | GPO), -+ NPCM7XX_PINCFG(185, spi3, MFSEL4, 16, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW | GPO), -+ NPCM7XX_PINCFG(186, spi3, MFSEL4, 16, none, NONE, 0, none, NONE, 0, DSTR(8, 12)), -+ NPCM7XX_PINCFG(187, spi3cs1, MFSEL4, 17, none, NONE, 0, none, NONE, 0, DSTR(8, 12)), -+ NPCM7XX_PINCFG(188, spi3quad, MFSEL4, 20, spi3cs2, MFSEL4, 18, none, NONE, 0, DSTR(8, 12) | SLEW), -+ NPCM7XX_PINCFG(189, spi3quad, MFSEL4, 20, spi3cs3, MFSEL4, 19, none, NONE, 0, DSTR(8, 12) | SLEW), -+ NPCM7XX_PINCFG(190, gpio, FLOCKR1, 20, nprd_smi, NONE, 0, none, NONE, 0, DSTR(2, 4)), -+ NPCM7XX_PINCFG(191, none, NONE, 0, none, NONE, 0, none, NONE, 0, DSTR(8, 12)), /* XX */ -+ -+ NPCM7XX_PINCFG(192, none, NONE, 0, none, NONE, 0, none, NONE, 0, DSTR(8, 12)), /* XX */ - NPCM7XX_PINCFG(193, r1, MFSEL3, 9, none, NONE, 0, none, NONE, 0, 0), - NPCM7XX_PINCFG(194, smb0b, I2CSEGSEL, 0, none, NONE, 0, none, NONE, 0, 0), - NPCM7XX_PINCFG(195, smb0b, I2CSEGSEL, 0, none, NONE, 0, none, NONE, 0, 0), -@@ -1131,11 +1130,11 @@ static const struct npcm7xx_pincfg pincfg[] = { - NPCM7XX_PINCFG(200, r2, MFSEL1, 14, none, NONE, 0, none, NONE, 0, 0), - NPCM7XX_PINCFG(201, r1, MFSEL3, 9, none, NONE, 0, none, NONE, 0, 0), - NPCM7XX_PINCFG(202, smb0c, I2CSEGSEL, 1, none, NONE, 0, none, NONE, 0, 0), -- NPCM7XX_PINCFG(203, faninx, MFSEL3, 3, none, NONE, 0, none, NONE, 0, DS(8, 12)), -+ NPCM7XX_PINCFG(203, faninx, MFSEL3, 3, none, NONE, 0, none, NONE, 0, DSTR(8, 12)), - NPCM7XX_PINCFG(204, ddc, NONE, 0, gpio, MFSEL3, 22, none, NONE, 0, SLEW), - NPCM7XX_PINCFG(205, ddc, NONE, 0, gpio, MFSEL3, 22, none, NONE, 0, SLEW), -- NPCM7XX_PINCFG(206, ddc, NONE, 0, gpio, MFSEL3, 22, none, NONE, 0, DS(4, 8)), -- NPCM7XX_PINCFG(207, ddc, NONE, 0, gpio, MFSEL3, 22, none, NONE, 0, DS(4, 8)), -+ NPCM7XX_PINCFG(206, ddc, NONE, 0, gpio, MFSEL3, 22, none, NONE, 0, DSTR(4, 8)), -+ NPCM7XX_PINCFG(207, ddc, NONE, 0, gpio, MFSEL3, 22, none, NONE, 0, DSTR(4, 8)), - NPCM7XX_PINCFG(208, rg2, MFSEL4, 24, ddr, MFSEL3, 26, none, NONE, 0, 0), - NPCM7XX_PINCFG(209, rg2, MFSEL4, 24, ddr, MFSEL3, 26, none, NONE, 0, 0), - NPCM7XX_PINCFG(210, rg2, MFSEL4, 24, ddr, MFSEL3, 26, none, NONE, 0, 0), -@@ -1147,20 +1146,20 @@ static const struct npcm7xx_pincfg pincfg[] = { - NPCM7XX_PINCFG(216, rg2mdio, MFSEL4, 23, ddr, MFSEL3, 26, none, NONE, 0, 0), - NPCM7XX_PINCFG(217, rg2mdio, MFSEL4, 23, ddr, MFSEL3, 26, none, NONE, 0, 0), - NPCM7XX_PINCFG(218, wdog1, MFSEL3, 19, none, NONE, 0, none, NONE, 0, 0), -- NPCM7XX_PINCFG(219, wdog2, MFSEL3, 20, none, NONE, 0, none, NONE, 0, DS(4, 8)), -+ NPCM7XX_PINCFG(219, wdog2, MFSEL3, 20, none, NONE, 0, none, NONE, 0, DSTR(4, 8)), - NPCM7XX_PINCFG(220, smb12, MFSEL3, 5, none, NONE, 0, none, NONE, 0, 0), - NPCM7XX_PINCFG(221, smb12, MFSEL3, 5, none, NONE, 0, none, NONE, 0, 0), - NPCM7XX_PINCFG(222, smb13, MFSEL3, 6, none, NONE, 0, none, NONE, 0, 0), - NPCM7XX_PINCFG(223, smb13, MFSEL3, 6, none, NONE, 0, none, NONE, 0, 0), - - NPCM7XX_PINCFG(224, spix, MFSEL4, 27, none, NONE, 0, none, NONE, 0, SLEW), -- NPCM7XX_PINCFG(225, spix, MFSEL4, 27, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW | GPO), -- NPCM7XX_PINCFG(226, spix, MFSEL4, 27, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW | GPO), -- NPCM7XX_PINCFG(227, spix, MFSEL4, 27, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), -- NPCM7XX_PINCFG(228, spixcs1, MFSEL4, 28, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), -- NPCM7XX_PINCFG(229, spix, MFSEL4, 27, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), -- NPCM7XX_PINCFG(230, spix, MFSEL4, 27, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), -- NPCM7XX_PINCFG(231, clkreq, MFSEL4, 9, none, NONE, 0, none, NONE, 0, DS(8, 12)), -+ NPCM7XX_PINCFG(225, spix, MFSEL4, 27, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW | GPO), -+ NPCM7XX_PINCFG(226, spix, MFSEL4, 27, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW | GPO), -+ NPCM7XX_PINCFG(227, spix, MFSEL4, 27, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), -+ NPCM7XX_PINCFG(228, spixcs1, MFSEL4, 28, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), -+ NPCM7XX_PINCFG(229, spix, MFSEL4, 27, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), -+ NPCM7XX_PINCFG(230, spix, MFSEL4, 27, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), -+ NPCM7XX_PINCFG(231, clkreq, MFSEL4, 9, none, NONE, 0, none, NONE, 0, DSTR(8, 12)), - NPCM7XX_PINCFG(253, none, NONE, 0, none, NONE, 0, none, NONE, 0, GPI), /* SDHC1 power */ - NPCM7XX_PINCFG(254, none, NONE, 0, none, NONE, 0, none, NONE, 0, GPI), /* SDHC2 power */ - NPCM7XX_PINCFG(255, none, NONE, 0, none, NONE, 0, none, NONE, 0, GPI), /* DACOSEL */ -@@ -1561,7 +1560,7 @@ static int npcm7xx_get_groups_count(struct pinctrl_dev *pctldev) - { - struct npcm7xx_pinctrl *npcm = pinctrl_dev_get_drvdata(pctldev); - -- dev_dbg(npcm->dev, "group size: %d\n", ARRAY_SIZE(npcm7xx_groups)); -+ dev_dbg(npcm->dev, "group size: %zu\n", ARRAY_SIZE(npcm7xx_groups)); - return ARRAY_SIZE(npcm7xx_groups); - } - -diff --git a/drivers/pinctrl/pinconf-generic.c b/drivers/pinctrl/pinconf-generic.c -index 9eb86309c70bf..355bc4c748e26 100644 ---- a/drivers/pinctrl/pinconf-generic.c -+++ b/drivers/pinctrl/pinconf-generic.c -@@ -30,10 +30,10 @@ static const struct pin_config_item conf_items[] = { - PCONFDUMP(PIN_CONFIG_BIAS_BUS_HOLD, "input bias bus hold", NULL, false), - PCONFDUMP(PIN_CONFIG_BIAS_DISABLE, "input bias disabled", NULL, false), - PCONFDUMP(PIN_CONFIG_BIAS_HIGH_IMPEDANCE, "input bias high impedance", NULL, false), -- PCONFDUMP(PIN_CONFIG_BIAS_PULL_DOWN, "input bias pull down", NULL, false), -+ PCONFDUMP(PIN_CONFIG_BIAS_PULL_DOWN, "input bias pull down", "ohms", true), - PCONFDUMP(PIN_CONFIG_BIAS_PULL_PIN_DEFAULT, -- "input bias pull to pin specific state", NULL, false), -- PCONFDUMP(PIN_CONFIG_BIAS_PULL_UP, "input bias pull up", NULL, false), -+ "input bias pull to pin specific state", "ohms", true), -+ PCONFDUMP(PIN_CONFIG_BIAS_PULL_UP, "input bias pull up", "ohms", true), - PCONFDUMP(PIN_CONFIG_DRIVE_OPEN_DRAIN, "output drive open drain", NULL, false), - PCONFDUMP(PIN_CONFIG_DRIVE_OPEN_SOURCE, "output drive open source", NULL, false), - PCONFDUMP(PIN_CONFIG_DRIVE_PUSH_PULL, "output drive push pull", NULL, false), -diff --git a/drivers/pinctrl/pinctrl-rockchip.c b/drivers/pinctrl/pinctrl-rockchip.c -index 59fe3204e965d..4b972be3487f9 100644 ---- a/drivers/pinctrl/pinctrl-rockchip.c -+++ b/drivers/pinctrl/pinctrl-rockchip.c -@@ -3433,6 +3433,7 @@ static int rockchip_pinctrl_probe(struct platform_device *pdev) - node = of_parse_phandle(np, "rockchip,grf", 0); - if (node) { - info->regmap_base = syscon_node_to_regmap(node); -+ of_node_put(node); - if (IS_ERR(info->regmap_base)) - return PTR_ERR(info->regmap_base); - } else { -@@ -3469,6 +3470,7 @@ static int rockchip_pinctrl_probe(struct platform_device *pdev) - node = of_parse_phandle(np, "rockchip,pmu", 0); - if (node) { - info->regmap_pmu = syscon_node_to_regmap(node); -+ of_node_put(node); - if (IS_ERR(info->regmap_pmu)) - return PTR_ERR(info->regmap_pmu); - } -diff --git a/drivers/pinctrl/samsung/pinctrl-samsung.c b/drivers/pinctrl/samsung/pinctrl-samsung.c -index 601fffeba39fe..131fa7958f754 100644 ---- a/drivers/pinctrl/samsung/pinctrl-samsung.c -+++ b/drivers/pinctrl/samsung/pinctrl-samsung.c -@@ -1002,6 +1002,16 @@ samsung_pinctrl_get_soc_data_for_of_alias(struct platform_device *pdev) - return &(of_data->ctrl[id]); - } - -+static void samsung_banks_of_node_put(struct samsung_pinctrl_drv_data *d) -+{ -+ struct samsung_pin_bank *bank; -+ unsigned int i; -+ -+ bank = d->pin_banks; -+ for (i = 0; i < d->nr_banks; ++i, ++bank) -+ of_node_put(bank->of_node); -+} -+ - /* retrieve the soc specific data */ - static const struct samsung_pin_ctrl * - samsung_pinctrl_get_soc_data(struct samsung_pinctrl_drv_data *d, -@@ -1116,19 +1126,19 @@ static int samsung_pinctrl_probe(struct platform_device *pdev) - if (ctrl->retention_data) { - drvdata->retention_ctrl = ctrl->retention_data->init(drvdata, - ctrl->retention_data); -- if (IS_ERR(drvdata->retention_ctrl)) -- return PTR_ERR(drvdata->retention_ctrl); -+ if (IS_ERR(drvdata->retention_ctrl)) { -+ ret = PTR_ERR(drvdata->retention_ctrl); -+ goto err_put_banks; -+ } - } - - ret = samsung_pinctrl_register(pdev, drvdata); - if (ret) -- return ret; -+ goto err_put_banks; - - ret = samsung_gpiolib_register(pdev, drvdata); -- if (ret) { -- samsung_pinctrl_unregister(pdev, drvdata); -- return ret; -- } -+ if (ret) -+ goto err_unregister; - - if (ctrl->eint_gpio_init) - ctrl->eint_gpio_init(drvdata); -@@ -1138,6 +1148,12 @@ static int samsung_pinctrl_probe(struct platform_device *pdev) - platform_set_drvdata(pdev, drvdata); - - return 0; -+ -+err_unregister: -+ samsung_pinctrl_unregister(pdev, drvdata); -+err_put_banks: -+ samsung_banks_of_node_put(drvdata); -+ return ret; - } - - /** -diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a77470.c b/drivers/pinctrl/sh-pfc/pfc-r8a77470.c -index b3b116da1bb0d..14005725a726b 100644 ---- a/drivers/pinctrl/sh-pfc/pfc-r8a77470.c -+++ b/drivers/pinctrl/sh-pfc/pfc-r8a77470.c -@@ -2121,7 +2121,7 @@ static const unsigned int vin0_clk_mux[] = { - VI0_CLK_MARK, - }; - /* - VIN1 ------------------------------------------------------------------- */ --static const union vin_data vin1_data_pins = { -+static const union vin_data12 vin1_data_pins = { - .data12 = { - RCAR_GP_PIN(3, 1), RCAR_GP_PIN(3, 2), - RCAR_GP_PIN(3, 3), RCAR_GP_PIN(3, 4), -@@ -2131,7 +2131,7 @@ static const union vin_data vin1_data_pins = { - RCAR_GP_PIN(3, 15), RCAR_GP_PIN(3, 16), - }, - }; --static const union vin_data vin1_data_mux = { -+static const union vin_data12 vin1_data_mux = { - .data12 = { - VI1_DATA0_MARK, VI1_DATA1_MARK, - VI1_DATA2_MARK, VI1_DATA3_MARK, -diff --git a/drivers/power/reset/gemini-poweroff.c b/drivers/power/reset/gemini-poweroff.c -index 90e35c07240ae..b7f7a8225f22e 100644 ---- a/drivers/power/reset/gemini-poweroff.c -+++ b/drivers/power/reset/gemini-poweroff.c -@@ -107,8 +107,8 @@ static int gemini_poweroff_probe(struct platform_device *pdev) - return PTR_ERR(gpw->base); - - irq = platform_get_irq(pdev, 0); -- if (!irq) -- return -EINVAL; -+ if (irq < 0) -+ return irq; - - gpw->dev = dev; - -diff --git a/drivers/power/supply/ab8500_fg.c b/drivers/power/supply/ab8500_fg.c -index 69452fc085b99..4c229e6fb750a 100644 ---- a/drivers/power/supply/ab8500_fg.c -+++ b/drivers/power/supply/ab8500_fg.c -@@ -2541,8 +2541,10 @@ static int ab8500_fg_sysfs_init(struct ab8500_fg *di) - ret = kobject_init_and_add(&di->fg_kobject, - &ab8500_fg_ktype, - NULL, "battery"); -- if (ret < 0) -+ if (ret < 0) { -+ kobject_put(&di->fg_kobject); - dev_err(di->dev, "failed to create sysfs entry\n"); -+ } - - return ret; - } -diff --git a/drivers/power/supply/axp20x_battery.c b/drivers/power/supply/axp20x_battery.c -index e84b6e4da14a8..9fda98b950bab 100644 ---- a/drivers/power/supply/axp20x_battery.c -+++ b/drivers/power/supply/axp20x_battery.c -@@ -185,7 +185,6 @@ static int axp20x_battery_get_prop(struct power_supply *psy, - union power_supply_propval *val) - { - struct axp20x_batt_ps *axp20x_batt = power_supply_get_drvdata(psy); -- struct iio_channel *chan; - int ret = 0, reg, val1; - - switch (psp) { -@@ -265,12 +264,12 @@ static int axp20x_battery_get_prop(struct power_supply *psy, - if (ret) - return ret; - -- if (reg & AXP20X_PWR_STATUS_BAT_CHARGING) -- chan = axp20x_batt->batt_chrg_i; -- else -- chan = axp20x_batt->batt_dischrg_i; -- -- ret = iio_read_channel_processed(chan, &val->intval); -+ if (reg & AXP20X_PWR_STATUS_BAT_CHARGING) { -+ ret = iio_read_channel_processed(axp20x_batt->batt_chrg_i, &val->intval); -+ } else { -+ ret = iio_read_channel_processed(axp20x_batt->batt_dischrg_i, &val1); -+ val->intval = -val1; -+ } - if (ret) - return ret; - -diff --git a/drivers/power/supply/axp288_charger.c b/drivers/power/supply/axp288_charger.c -index 7d09e49f04d3b..2ee6bb7c08045 100644 ---- a/drivers/power/supply/axp288_charger.c -+++ b/drivers/power/supply/axp288_charger.c -@@ -41,11 +41,11 @@ - #define VBUS_ISPOUT_CUR_LIM_1500MA 0x1 /* 1500mA */ - #define VBUS_ISPOUT_CUR_LIM_2000MA 0x2 /* 2000mA */ - #define VBUS_ISPOUT_CUR_NO_LIM 0x3 /* 2500mA */ --#define VBUS_ISPOUT_VHOLD_SET_MASK 0x31 -+#define VBUS_ISPOUT_VHOLD_SET_MASK 0x38 - #define VBUS_ISPOUT_VHOLD_SET_BIT_POS 0x3 - #define VBUS_ISPOUT_VHOLD_SET_OFFSET 4000 /* 4000mV */ - #define VBUS_ISPOUT_VHOLD_SET_LSB_RES 100 /* 100mV */ --#define VBUS_ISPOUT_VHOLD_SET_4300MV 0x3 /* 4300mV */ -+#define VBUS_ISPOUT_VHOLD_SET_4400MV 0x4 /* 4400mV */ - #define VBUS_ISPOUT_VBUS_PATH_DIS BIT(7) - - #define CHRG_CCCV_CC_MASK 0xf /* 4 bits */ -@@ -744,6 +744,16 @@ static int charger_init_hw_regs(struct axp288_chrg_info *info) - ret = axp288_charger_vbus_path_select(info, true); - if (ret < 0) - return ret; -+ } else { -+ /* Set Vhold to the factory default / recommended 4.4V */ -+ val = VBUS_ISPOUT_VHOLD_SET_4400MV << VBUS_ISPOUT_VHOLD_SET_BIT_POS; -+ ret = regmap_update_bits(info->regmap, AXP20X_VBUS_IPSOUT_MGMT, -+ VBUS_ISPOUT_VHOLD_SET_MASK, val); -+ if (ret < 0) { -+ dev_err(&info->pdev->dev, "register(%x) write error(%d)\n", -+ AXP20X_VBUS_IPSOUT_MGMT, ret); -+ return ret; -+ } - } - - /* Read current charge voltage and current limit */ -diff --git a/drivers/power/supply/bq24190_charger.c b/drivers/power/supply/bq24190_charger.c -index 1ae5d6d42c9e3..64d87dccea82c 100644 ---- a/drivers/power/supply/bq24190_charger.c -+++ b/drivers/power/supply/bq24190_charger.c -@@ -41,6 +41,7 @@ - #define BQ24190_REG_POC_CHG_CONFIG_DISABLE 0x0 - #define BQ24190_REG_POC_CHG_CONFIG_CHARGE 0x1 - #define BQ24190_REG_POC_CHG_CONFIG_OTG 0x2 -+#define BQ24190_REG_POC_CHG_CONFIG_OTG_ALT 0x3 - #define BQ24190_REG_POC_SYS_MIN_MASK (BIT(3) | BIT(2) | BIT(1)) - #define BQ24190_REG_POC_SYS_MIN_SHIFT 1 - #define BQ24190_REG_POC_SYS_MIN_MIN 3000 -@@ -550,7 +551,11 @@ static int bq24190_vbus_is_enabled(struct regulator_dev *dev) - pm_runtime_mark_last_busy(bdi->dev); - pm_runtime_put_autosuspend(bdi->dev); - -- return ret ? ret : val == BQ24190_REG_POC_CHG_CONFIG_OTG; -+ if (ret) -+ return ret; -+ -+ return (val == BQ24190_REG_POC_CHG_CONFIG_OTG || -+ val == BQ24190_REG_POC_CHG_CONFIG_OTG_ALT); - } - - static const struct regulator_ops bq24190_vbus_ops = { -diff --git a/drivers/power/supply/wm8350_power.c b/drivers/power/supply/wm8350_power.c -index 26923af574f43..4fe9ea9721b39 100644 ---- a/drivers/power/supply/wm8350_power.c -+++ b/drivers/power/supply/wm8350_power.c -@@ -408,44 +408,112 @@ static const struct power_supply_desc wm8350_usb_desc = { - * Initialisation - *********************************************************************/ - --static void wm8350_init_charger(struct wm8350 *wm8350) -+static int wm8350_init_charger(struct wm8350 *wm8350) - { -+ int ret; -+ - /* register our interest in charger events */ -- wm8350_register_irq(wm8350, WM8350_IRQ_CHG_BAT_HOT, -+ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CHG_BAT_HOT, - wm8350_charger_handler, 0, "Battery hot", wm8350); -- wm8350_register_irq(wm8350, WM8350_IRQ_CHG_BAT_COLD, -+ if (ret) -+ goto err; -+ -+ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CHG_BAT_COLD, - wm8350_charger_handler, 0, "Battery cold", wm8350); -- wm8350_register_irq(wm8350, WM8350_IRQ_CHG_BAT_FAIL, -+ if (ret) -+ goto free_chg_bat_hot; -+ -+ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CHG_BAT_FAIL, - wm8350_charger_handler, 0, "Battery fail", wm8350); -- wm8350_register_irq(wm8350, WM8350_IRQ_CHG_TO, -+ if (ret) -+ goto free_chg_bat_cold; -+ -+ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CHG_TO, - wm8350_charger_handler, 0, - "Charger timeout", wm8350); -- wm8350_register_irq(wm8350, WM8350_IRQ_CHG_END, -+ if (ret) -+ goto free_chg_bat_fail; -+ -+ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CHG_END, - wm8350_charger_handler, 0, - "Charge end", wm8350); -- wm8350_register_irq(wm8350, WM8350_IRQ_CHG_START, -+ if (ret) -+ goto free_chg_to; -+ -+ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CHG_START, - wm8350_charger_handler, 0, - "Charge start", wm8350); -- wm8350_register_irq(wm8350, WM8350_IRQ_CHG_FAST_RDY, -+ if (ret) -+ goto free_chg_end; -+ -+ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CHG_FAST_RDY, - wm8350_charger_handler, 0, - "Fast charge ready", wm8350); -- wm8350_register_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_3P9, -+ if (ret) -+ goto free_chg_start; -+ -+ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_3P9, - wm8350_charger_handler, 0, - "Battery <3.9V", wm8350); -- wm8350_register_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_3P1, -+ if (ret) -+ goto free_chg_fast_rdy; -+ -+ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_3P1, - wm8350_charger_handler, 0, - "Battery <3.1V", wm8350); -- wm8350_register_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_2P85, -+ if (ret) -+ goto free_chg_vbatt_lt_3p9; -+ -+ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_2P85, - wm8350_charger_handler, 0, - "Battery <2.85V", wm8350); -+ if (ret) -+ goto free_chg_vbatt_lt_3p1; - - /* and supply change events */ -- wm8350_register_irq(wm8350, WM8350_IRQ_EXT_USB_FB, -+ ret = wm8350_register_irq(wm8350, WM8350_IRQ_EXT_USB_FB, - wm8350_charger_handler, 0, "USB", wm8350); -- wm8350_register_irq(wm8350, WM8350_IRQ_EXT_WALL_FB, -+ if (ret) -+ goto free_chg_vbatt_lt_2p85; -+ -+ ret = wm8350_register_irq(wm8350, WM8350_IRQ_EXT_WALL_FB, - wm8350_charger_handler, 0, "Wall", wm8350); -- wm8350_register_irq(wm8350, WM8350_IRQ_EXT_BAT_FB, -+ if (ret) -+ goto free_ext_usb_fb; -+ -+ ret = wm8350_register_irq(wm8350, WM8350_IRQ_EXT_BAT_FB, - wm8350_charger_handler, 0, "Battery", wm8350); -+ if (ret) -+ goto free_ext_wall_fb; -+ -+ return 0; -+ -+free_ext_wall_fb: -+ wm8350_free_irq(wm8350, WM8350_IRQ_EXT_WALL_FB, wm8350); -+free_ext_usb_fb: -+ wm8350_free_irq(wm8350, WM8350_IRQ_EXT_USB_FB, wm8350); -+free_chg_vbatt_lt_2p85: -+ wm8350_free_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_2P85, wm8350); -+free_chg_vbatt_lt_3p1: -+ wm8350_free_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_3P1, wm8350); -+free_chg_vbatt_lt_3p9: -+ wm8350_free_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_3P9, wm8350); -+free_chg_fast_rdy: -+ wm8350_free_irq(wm8350, WM8350_IRQ_CHG_FAST_RDY, wm8350); -+free_chg_start: -+ wm8350_free_irq(wm8350, WM8350_IRQ_CHG_START, wm8350); -+free_chg_end: -+ wm8350_free_irq(wm8350, WM8350_IRQ_CHG_END, wm8350); -+free_chg_to: -+ wm8350_free_irq(wm8350, WM8350_IRQ_CHG_TO, wm8350); -+free_chg_bat_fail: -+ wm8350_free_irq(wm8350, WM8350_IRQ_CHG_BAT_FAIL, wm8350); -+free_chg_bat_cold: -+ wm8350_free_irq(wm8350, WM8350_IRQ_CHG_BAT_COLD, wm8350); -+free_chg_bat_hot: -+ wm8350_free_irq(wm8350, WM8350_IRQ_CHG_BAT_HOT, wm8350); -+err: -+ return ret; - } - - static void free_charger_irq(struct wm8350 *wm8350) -@@ -456,6 +524,7 @@ static void free_charger_irq(struct wm8350 *wm8350) - wm8350_free_irq(wm8350, WM8350_IRQ_CHG_TO, wm8350); - wm8350_free_irq(wm8350, WM8350_IRQ_CHG_END, wm8350); - wm8350_free_irq(wm8350, WM8350_IRQ_CHG_START, wm8350); -+ wm8350_free_irq(wm8350, WM8350_IRQ_CHG_FAST_RDY, wm8350); - wm8350_free_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_3P9, wm8350); - wm8350_free_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_3P1, wm8350); - wm8350_free_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_2P85, wm8350); -diff --git a/drivers/ptp/ptp_sysfs.c b/drivers/ptp/ptp_sysfs.c -index be076a91e20e6..8cd59e8481631 100644 ---- a/drivers/ptp/ptp_sysfs.c -+++ b/drivers/ptp/ptp_sysfs.c -@@ -13,7 +13,7 @@ static ssize_t clock_name_show(struct device *dev, - struct device_attribute *attr, char *page) - { - struct ptp_clock *ptp = dev_get_drvdata(dev); -- return snprintf(page, PAGE_SIZE-1, "%s\n", ptp->info->name); -+ return sysfs_emit(page, "%s\n", ptp->info->name); - } - static DEVICE_ATTR_RO(clock_name); - -@@ -227,7 +227,7 @@ static ssize_t ptp_pin_show(struct device *dev, struct device_attribute *attr, - - mutex_unlock(&ptp->pincfg_mux); - -- return snprintf(page, PAGE_SIZE, "%u %u\n", func, chan); -+ return sysfs_emit(page, "%u %u\n", func, chan); - } - - static ssize_t ptp_pin_store(struct device *dev, struct device_attribute *attr, -diff --git a/drivers/pwm/pwm-lpc18xx-sct.c b/drivers/pwm/pwm-lpc18xx-sct.c -index 5ff11145c1a30..9b15b6a79082a 100644 ---- a/drivers/pwm/pwm-lpc18xx-sct.c -+++ b/drivers/pwm/pwm-lpc18xx-sct.c -@@ -400,12 +400,6 @@ static int lpc18xx_pwm_probe(struct platform_device *pdev) - lpc18xx_pwm_writel(lpc18xx_pwm, LPC18XX_PWM_LIMIT, - BIT(lpc18xx_pwm->period_event)); - -- ret = pwmchip_add(&lpc18xx_pwm->chip); -- if (ret < 0) { -- dev_err(&pdev->dev, "pwmchip_add failed: %d\n", ret); -- goto disable_pwmclk; -- } -- - for (i = 0; i < lpc18xx_pwm->chip.npwm; i++) { - struct lpc18xx_pwm_data *data; - -@@ -415,14 +409,12 @@ static int lpc18xx_pwm_probe(struct platform_device *pdev) - GFP_KERNEL); - if (!data) { - ret = -ENOMEM; -- goto remove_pwmchip; -+ goto disable_pwmclk; - } - - pwm_set_chip_data(pwm, data); - } - -- platform_set_drvdata(pdev, lpc18xx_pwm); -- - val = lpc18xx_pwm_readl(lpc18xx_pwm, LPC18XX_PWM_CTRL); - val &= ~LPC18XX_PWM_BIDIR; - val &= ~LPC18XX_PWM_CTRL_HALT; -@@ -430,10 +422,16 @@ static int lpc18xx_pwm_probe(struct platform_device *pdev) - val |= LPC18XX_PWM_PRE(0); - lpc18xx_pwm_writel(lpc18xx_pwm, LPC18XX_PWM_CTRL, val); - -+ ret = pwmchip_add(&lpc18xx_pwm->chip); -+ if (ret < 0) { -+ dev_err(&pdev->dev, "pwmchip_add failed: %d\n", ret); -+ goto disable_pwmclk; -+ } -+ -+ platform_set_drvdata(pdev, lpc18xx_pwm); -+ - return 0; - --remove_pwmchip: -- pwmchip_remove(&lpc18xx_pwm->chip); - disable_pwmclk: - clk_disable_unprepare(lpc18xx_pwm->pwm_clk); - return ret; -diff --git a/drivers/regulator/qcom_smd-regulator.c b/drivers/regulator/qcom_smd-regulator.c -index e6601c28ab431..a4c82f5e2dae7 100644 ---- a/drivers/regulator/qcom_smd-regulator.c -+++ b/drivers/regulator/qcom_smd-regulator.c -@@ -854,8 +854,10 @@ static int rpm_reg_probe(struct platform_device *pdev) - - for_each_available_child_of_node(dev->of_node, node) { - vreg = devm_kzalloc(&pdev->dev, sizeof(*vreg), GFP_KERNEL); -- if (!vreg) -+ if (!vreg) { -+ of_node_put(node); - return -ENOMEM; -+ } - - ret = rpm_regulator_init_vreg(vreg, dev, node, rpm, vreg_data); - -diff --git a/drivers/remoteproc/qcom_q6v5_adsp.c b/drivers/remoteproc/qcom_q6v5_adsp.c -index 24e8b7e271773..6b131a490ebf8 100644 ---- a/drivers/remoteproc/qcom_q6v5_adsp.c -+++ b/drivers/remoteproc/qcom_q6v5_adsp.c -@@ -389,6 +389,7 @@ static int adsp_alloc_memory_region(struct qcom_adsp *adsp) - } - - ret = of_address_to_resource(node, 0, &r); -+ of_node_put(node); - if (ret) - return ret; - -diff --git a/drivers/remoteproc/qcom_wcnss.c b/drivers/remoteproc/qcom_wcnss.c -index dc135754bb9c5..c72f1b3b60858 100644 ---- a/drivers/remoteproc/qcom_wcnss.c -+++ b/drivers/remoteproc/qcom_wcnss.c -@@ -440,6 +440,7 @@ static int wcnss_alloc_memory_region(struct qcom_wcnss *wcnss) - } - - ret = of_address_to_resource(node, 0, &r); -+ of_node_put(node); - if (ret) - return ret; - -diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c -index 5c1378d2fab3d..ba345a379e262 100644 ---- a/drivers/rtc/interface.c -+++ b/drivers/rtc/interface.c -@@ -793,9 +793,13 @@ static int rtc_timer_enqueue(struct rtc_device *rtc, struct rtc_timer *timer) - struct timerqueue_node *next = timerqueue_getnext(&rtc->timerqueue); - struct rtc_time tm; - ktime_t now; -+ int err; -+ -+ err = __rtc_read_time(rtc, &tm); -+ if (err) -+ return err; - - timer->enabled = 1; -- __rtc_read_time(rtc, &tm); - now = rtc_tm_to_ktime(tm); - - /* Skip over expired timers */ -@@ -809,7 +813,6 @@ static int rtc_timer_enqueue(struct rtc_device *rtc, struct rtc_timer *timer) - trace_rtc_timer_enqueue(timer); - if (!next || ktime_before(timer->node.expires, next->expires)) { - struct rtc_wkalrm alarm; -- int err; - - alarm.time = rtc_ktime_to_tm(timer->node.expires); - alarm.enabled = 1; -diff --git a/drivers/rtc/rtc-wm8350.c b/drivers/rtc/rtc-wm8350.c -index 2018614f258f6..6eaa9321c0741 100644 ---- a/drivers/rtc/rtc-wm8350.c -+++ b/drivers/rtc/rtc-wm8350.c -@@ -432,14 +432,21 @@ static int wm8350_rtc_probe(struct platform_device *pdev) - return ret; - } - -- wm8350_register_irq(wm8350, WM8350_IRQ_RTC_SEC, -+ ret = wm8350_register_irq(wm8350, WM8350_IRQ_RTC_SEC, - wm8350_rtc_update_handler, 0, - "RTC Seconds", wm8350); -+ if (ret) -+ return ret; -+ - wm8350_mask_irq(wm8350, WM8350_IRQ_RTC_SEC); - -- wm8350_register_irq(wm8350, WM8350_IRQ_RTC_ALM, -+ ret = wm8350_register_irq(wm8350, WM8350_IRQ_RTC_ALM, - wm8350_rtc_alarm_handler, 0, - "RTC Alarm", wm8350); -+ if (ret) { -+ wm8350_free_irq(wm8350, WM8350_IRQ_RTC_SEC, wm8350); -+ return ret; -+ } - - return 0; - } -diff --git a/drivers/scsi/aha152x.c b/drivers/scsi/aha152x.c -index eb466c2e1839e..fdd9f1a5100c7 100644 ---- a/drivers/scsi/aha152x.c -+++ b/drivers/scsi/aha152x.c -@@ -3368,13 +3368,11 @@ static int __init aha152x_setup(char *str) - setup[setup_count].synchronous = ints[0] >= 6 ? ints[6] : 1; - setup[setup_count].delay = ints[0] >= 7 ? ints[7] : DELAY_DEFAULT; - setup[setup_count].ext_trans = ints[0] >= 8 ? ints[8] : 0; -- if (ints[0] > 8) { /*}*/ -+ if (ints[0] > 8) - printk(KERN_NOTICE "aha152x: usage: aha152x=[,[," - "[,[,[,[,[,]]]]]]]\n"); -- } else { -+ else - setup_count++; -- return 0; -- } - - return 1; - } -diff --git a/drivers/scsi/bfa/bfad_attr.c b/drivers/scsi/bfa/bfad_attr.c -index fbfce02e5b935..c285f401ff7b5 100644 ---- a/drivers/scsi/bfa/bfad_attr.c -+++ b/drivers/scsi/bfa/bfad_attr.c -@@ -711,7 +711,7 @@ bfad_im_serial_num_show(struct device *dev, struct device_attribute *attr, - char serial_num[BFA_ADAPTER_SERIAL_NUM_LEN]; - - bfa_get_adapter_serial_num(&bfad->bfa, serial_num); -- return snprintf(buf, PAGE_SIZE, "%s\n", serial_num); -+ return sysfs_emit(buf, "%s\n", serial_num); - } - - static ssize_t -@@ -725,7 +725,7 @@ bfad_im_model_show(struct device *dev, struct device_attribute *attr, - char model[BFA_ADAPTER_MODEL_NAME_LEN]; - - bfa_get_adapter_model(&bfad->bfa, model); -- return snprintf(buf, PAGE_SIZE, "%s\n", model); -+ return sysfs_emit(buf, "%s\n", model); - } - - static ssize_t -@@ -805,7 +805,7 @@ bfad_im_model_desc_show(struct device *dev, struct device_attribute *attr, - snprintf(model_descr, BFA_ADAPTER_MODEL_DESCR_LEN, - "Invalid Model"); - -- return snprintf(buf, PAGE_SIZE, "%s\n", model_descr); -+ return sysfs_emit(buf, "%s\n", model_descr); - } - - static ssize_t -@@ -819,7 +819,7 @@ bfad_im_node_name_show(struct device *dev, struct device_attribute *attr, - u64 nwwn; - - nwwn = bfa_fcs_lport_get_nwwn(port->fcs_port); -- return snprintf(buf, PAGE_SIZE, "0x%llx\n", cpu_to_be64(nwwn)); -+ return sysfs_emit(buf, "0x%llx\n", cpu_to_be64(nwwn)); - } - - static ssize_t -@@ -836,7 +836,7 @@ bfad_im_symbolic_name_show(struct device *dev, struct device_attribute *attr, - bfa_fcs_lport_get_attr(&bfad->bfa_fcs.fabric.bport, &port_attr); - strlcpy(symname, port_attr.port_cfg.sym_name.symname, - BFA_SYMNAME_MAXLEN); -- return snprintf(buf, PAGE_SIZE, "%s\n", symname); -+ return sysfs_emit(buf, "%s\n", symname); - } - - static ssize_t -@@ -850,14 +850,14 @@ bfad_im_hw_version_show(struct device *dev, struct device_attribute *attr, - char hw_ver[BFA_VERSION_LEN]; - - bfa_get_pci_chip_rev(&bfad->bfa, hw_ver); -- return snprintf(buf, PAGE_SIZE, "%s\n", hw_ver); -+ return sysfs_emit(buf, "%s\n", hw_ver); - } - - static ssize_t - bfad_im_drv_version_show(struct device *dev, struct device_attribute *attr, - char *buf) - { -- return snprintf(buf, PAGE_SIZE, "%s\n", BFAD_DRIVER_VERSION); -+ return sysfs_emit(buf, "%s\n", BFAD_DRIVER_VERSION); - } - - static ssize_t -@@ -871,7 +871,7 @@ bfad_im_optionrom_version_show(struct device *dev, - char optrom_ver[BFA_VERSION_LEN]; - - bfa_get_adapter_optrom_ver(&bfad->bfa, optrom_ver); -- return snprintf(buf, PAGE_SIZE, "%s\n", optrom_ver); -+ return sysfs_emit(buf, "%s\n", optrom_ver); - } - - static ssize_t -@@ -885,7 +885,7 @@ bfad_im_fw_version_show(struct device *dev, struct device_attribute *attr, - char fw_ver[BFA_VERSION_LEN]; - - bfa_get_adapter_fw_ver(&bfad->bfa, fw_ver); -- return snprintf(buf, PAGE_SIZE, "%s\n", fw_ver); -+ return sysfs_emit(buf, "%s\n", fw_ver); - } - - static ssize_t -@@ -897,7 +897,7 @@ bfad_im_num_of_ports_show(struct device *dev, struct device_attribute *attr, - (struct bfad_im_port_s *) shost->hostdata[0]; - struct bfad_s *bfad = im_port->bfad; - -- return snprintf(buf, PAGE_SIZE, "%d\n", -+ return sysfs_emit(buf, "%d\n", - bfa_get_nports(&bfad->bfa)); - } - -@@ -905,7 +905,7 @@ static ssize_t - bfad_im_drv_name_show(struct device *dev, struct device_attribute *attr, - char *buf) - { -- return snprintf(buf, PAGE_SIZE, "%s\n", BFAD_DRIVER_NAME); -+ return sysfs_emit(buf, "%s\n", BFAD_DRIVER_NAME); - } - - static ssize_t -@@ -924,14 +924,14 @@ bfad_im_num_of_discovered_ports_show(struct device *dev, - rports = kcalloc(nrports, sizeof(struct bfa_rport_qualifier_s), - GFP_ATOMIC); - if (rports == NULL) -- return snprintf(buf, PAGE_SIZE, "Failed\n"); -+ return sysfs_emit(buf, "Failed\n"); - - spin_lock_irqsave(&bfad->bfad_lock, flags); - bfa_fcs_lport_get_rport_quals(port->fcs_port, rports, &nrports); - spin_unlock_irqrestore(&bfad->bfad_lock, flags); - kfree(rports); - -- return snprintf(buf, PAGE_SIZE, "%d\n", nrports); -+ return sysfs_emit(buf, "%d\n", nrports); - } - - static DEVICE_ATTR(serial_number, S_IRUGO, -diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c -index 13f314fa757e8..a86aae52d94f4 100644 ---- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c -+++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c -@@ -504,7 +504,7 @@ MODULE_PARM_DESC(intr_conv, "interrupt converge enable (0-1)"); - - /* permit overriding the host protection capabilities mask (EEDP/T10 PI) */ - static int prot_mask; --module_param(prot_mask, int, 0); -+module_param(prot_mask, int, 0444); - MODULE_PARM_DESC(prot_mask, " host protection capabilities mask, def=0x0 "); - - static bool auto_affine_msi_experimental; -diff --git a/drivers/scsi/libfc/fc_exch.c b/drivers/scsi/libfc/fc_exch.c -index e5b18e5d46dac..6e2a36eeb12a7 100644 ---- a/drivers/scsi/libfc/fc_exch.c -+++ b/drivers/scsi/libfc/fc_exch.c -@@ -1697,6 +1697,7 @@ static void fc_exch_abts_resp(struct fc_exch *ep, struct fc_frame *fp) - if (cancel_delayed_work_sync(&ep->timeout_work)) { - FC_EXCH_DBG(ep, "Exchange timer canceled due to ABTS response\n"); - fc_exch_release(ep); /* release from pending timer hold */ -+ return; - } - - spin_lock_bh(&ep->ex_lock); -diff --git a/drivers/scsi/libsas/sas_ata.c b/drivers/scsi/libsas/sas_ata.c -index 5d28bb7f2ca40..5c801705c4700 100644 ---- a/drivers/scsi/libsas/sas_ata.c -+++ b/drivers/scsi/libsas/sas_ata.c -@@ -201,7 +201,7 @@ static unsigned int sas_ata_qc_issue(struct ata_queued_cmd *qc) - task->total_xfer_len = qc->nbytes; - task->num_scatter = qc->n_elem; - task->data_dir = qc->dma_dir; -- } else if (qc->tf.protocol == ATA_PROT_NODATA) { -+ } else if (!ata_is_data(qc->tf.protocol)) { - task->data_dir = DMA_NONE; - } else { - for_each_sg(qc->sg, sg, qc->n_elem, si) -diff --git a/drivers/scsi/mvsas/mv_init.c b/drivers/scsi/mvsas/mv_init.c -index 52405ce58ade8..c16d7fb0fdcbb 100644 ---- a/drivers/scsi/mvsas/mv_init.c -+++ b/drivers/scsi/mvsas/mv_init.c -@@ -697,7 +697,7 @@ static ssize_t - mvs_show_driver_version(struct device *cdev, - struct device_attribute *attr, char *buffer) - { -- return snprintf(buffer, PAGE_SIZE, "%s\n", DRV_VERSION); -+ return sysfs_emit(buffer, "%s\n", DRV_VERSION); - } - - static DEVICE_ATTR(driver_version, -@@ -749,7 +749,7 @@ mvs_store_interrupt_coalescing(struct device *cdev, - static ssize_t mvs_show_interrupt_coalescing(struct device *cdev, - struct device_attribute *attr, char *buffer) - { -- return snprintf(buffer, PAGE_SIZE, "%d\n", interrupt_coalescing); -+ return sysfs_emit(buffer, "%d\n", interrupt_coalescing); - } - - static DEVICE_ATTR(interrupt_coalescing, -diff --git a/drivers/scsi/pm8001/pm8001_hwi.c b/drivers/scsi/pm8001/pm8001_hwi.c -index 68a8217032d0f..fec653b54307a 100644 ---- a/drivers/scsi/pm8001/pm8001_hwi.c -+++ b/drivers/scsi/pm8001/pm8001_hwi.c -@@ -1750,6 +1750,7 @@ static void pm8001_send_abort_all(struct pm8001_hba_info *pm8001_ha, - ccb->device = pm8001_ha_dev; - ccb->ccb_tag = ccb_tag; - ccb->task = task; -+ ccb->n_elem = 0; - - circularQ = &pm8001_ha->inbnd_q_tbl[0]; - -@@ -1812,6 +1813,7 @@ static void pm8001_send_read_log(struct pm8001_hba_info *pm8001_ha, - ccb->device = pm8001_ha_dev; - ccb->ccb_tag = ccb_tag; - ccb->task = task; -+ ccb->n_elem = 0; - pm8001_ha_dev->id |= NCQ_READ_LOG_FLAG; - pm8001_ha_dev->id |= NCQ_2ND_RLE_FLAG; - -@@ -1828,7 +1830,7 @@ static void pm8001_send_read_log(struct pm8001_hba_info *pm8001_ha, - - sata_cmd.tag = cpu_to_le32(ccb_tag); - sata_cmd.device_id = cpu_to_le32(pm8001_ha_dev->device_id); -- sata_cmd.ncqtag_atap_dir_m |= ((0x1 << 7) | (0x5 << 9)); -+ sata_cmd.ncqtag_atap_dir_m = cpu_to_le32((0x1 << 7) | (0x5 << 9)); - memcpy(&sata_cmd.sata_fis, &fis, sizeof(struct host_to_dev_fis)); - - res = pm8001_mpi_build_cmd(pm8001_ha, circularQ, opc, &sata_cmd, 0); -@@ -3773,12 +3775,11 @@ int pm8001_mpi_task_abort_resp(struct pm8001_hba_info *pm8001_ha, void *piomb) - mb(); - - if (pm8001_dev->id & NCQ_ABORT_ALL_FLAG) { -- pm8001_tag_free(pm8001_ha, tag); - sas_free_task(t); -- /* clear the flag */ -- pm8001_dev->id &= 0xBFFFFFFF; -- } else -+ pm8001_dev->id &= ~NCQ_ABORT_ALL_FLAG; -+ } else { - t->task_done(t); -+ } - - return 0; - } -@@ -4727,7 +4728,7 @@ int pm8001_chip_ssp_tm_req(struct pm8001_hba_info *pm8001_ha, - memcpy(sspTMCmd.lun, task->ssp_task.LUN, 8); - sspTMCmd.tag = cpu_to_le32(ccb->ccb_tag); - if (pm8001_ha->chip_id != chip_8001) -- sspTMCmd.ds_ads_m = 0x08; -+ sspTMCmd.ds_ads_m = cpu_to_le32(0x08); - circularQ = &pm8001_ha->inbnd_q_tbl[0]; - ret = pm8001_mpi_build_cmd(pm8001_ha, circularQ, opc, &sspTMCmd, 0); - return ret; -diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c -index 161bf4760eac7..ce67965a504fa 100644 ---- a/drivers/scsi/pm8001/pm80xx_hwi.c -+++ b/drivers/scsi/pm8001/pm80xx_hwi.c -@@ -881,9 +881,11 @@ pm80xx_set_thermal_config(struct pm8001_hba_info *pm8001_ha) - else - page_code = THERMAL_PAGE_CODE_8H; - -- payload.cfg_pg[0] = (THERMAL_LOG_ENABLE << 9) | -- (THERMAL_ENABLE << 8) | page_code; -- payload.cfg_pg[1] = (LTEMPHIL << 24) | (RTEMPHIL << 8); -+ payload.cfg_pg[0] = -+ cpu_to_le32((THERMAL_LOG_ENABLE << 9) | -+ (THERMAL_ENABLE << 8) | page_code); -+ payload.cfg_pg[1] = -+ cpu_to_le32((LTEMPHIL << 24) | (RTEMPHIL << 8)); - - rc = pm8001_mpi_build_cmd(pm8001_ha, circularQ, opc, &payload, 0); - if (rc) -@@ -1435,6 +1437,7 @@ static void pm80xx_send_abort_all(struct pm8001_hba_info *pm8001_ha, - ccb->device = pm8001_ha_dev; - ccb->ccb_tag = ccb_tag; - ccb->task = task; -+ ccb->n_elem = 0; - - circularQ = &pm8001_ha->inbnd_q_tbl[0]; - -@@ -1516,7 +1519,7 @@ static void pm80xx_send_read_log(struct pm8001_hba_info *pm8001_ha, - - sata_cmd.tag = cpu_to_le32(ccb_tag); - sata_cmd.device_id = cpu_to_le32(pm8001_ha_dev->device_id); -- sata_cmd.ncqtag_atap_dir_m_dad |= ((0x1 << 7) | (0x5 << 9)); -+ sata_cmd.ncqtag_atap_dir_m_dad = cpu_to_le32(((0x1 << 7) | (0x5 << 9))); - memcpy(&sata_cmd.sata_fis, &fis, sizeof(struct host_to_dev_fis)); - - res = pm8001_mpi_build_cmd(pm8001_ha, circularQ, opc, &sata_cmd, 0); -diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c -index 8f85ca0112961..59f5dc9876cc5 100644 ---- a/drivers/scsi/qla2xxx/qla_attr.c -+++ b/drivers/scsi/qla2xxx/qla_attr.c -@@ -527,7 +527,7 @@ qla2x00_sysfs_read_vpd(struct file *filp, struct kobject *kobj, - if (!capable(CAP_SYS_ADMIN)) - return -EINVAL; - -- if (IS_NOCACHE_VPD_TYPE(ha)) -+ if (!IS_NOCACHE_VPD_TYPE(ha)) - goto skip; - - faddr = ha->flt_region_vpd << 2; -@@ -710,7 +710,7 @@ qla2x00_sysfs_write_reset(struct file *filp, struct kobject *kobj, - ql_log(ql_log_info, vha, 0x706f, - "Issuing MPI reset.\n"); - -- if (IS_QLA83XX(ha) || IS_QLA27XX(ha) || IS_QLA28XX(ha)) { -+ if (IS_QLA83XX(ha)) { - uint32_t idc_control; - - qla83xx_idc_lock(vha, 0); -@@ -1020,9 +1020,6 @@ qla2x00_free_sysfs_attr(scsi_qla_host_t *vha, bool stop_beacon) - continue; - if (iter->type == 3 && !(IS_CNA_CAPABLE(ha))) - continue; -- if (iter->type == 0x27 && -- (!IS_QLA27XX(ha) || !IS_QLA28XX(ha))) -- continue; - - sysfs_remove_bin_file(&host->shost_gendev.kobj, - iter->attr); -diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h -index 7c22f8eea3ead..caf28c5281aa5 100644 ---- a/drivers/scsi/qla2xxx/qla_def.h -+++ b/drivers/scsi/qla2xxx/qla_def.h -@@ -2725,7 +2725,11 @@ struct ct_fdmiv2_hba_attributes { - #define FDMI_PORT_SPEED_8GB 0x10 - #define FDMI_PORT_SPEED_16GB 0x20 - #define FDMI_PORT_SPEED_32GB 0x40 --#define FDMI_PORT_SPEED_64GB 0x80 -+#define FDMI_PORT_SPEED_20GB 0x80 -+#define FDMI_PORT_SPEED_40GB 0x100 -+#define FDMI_PORT_SPEED_128GB 0x200 -+#define FDMI_PORT_SPEED_64GB 0x400 -+#define FDMI_PORT_SPEED_256GB 0x800 - #define FDMI_PORT_SPEED_UNKNOWN 0x8000 - - #define FC_CLASS_2 0x04 -@@ -4866,4 +4870,8 @@ struct sff_8247_a0 { - #include "qla_gbl.h" - #include "qla_dbg.h" - #include "qla_inline.h" -+ -+#define IS_SESSION_DELETED(_fcport) (_fcport->disc_state == DSC_DELETE_PEND || \ -+ _fcport->disc_state == DSC_DELETED) -+ - #endif -diff --git a/drivers/scsi/qla2xxx/qla_gs.c b/drivers/scsi/qla2xxx/qla_gs.c -index d9b5ea77fde99..e9f03370afba3 100644 ---- a/drivers/scsi/qla2xxx/qla_gs.c -+++ b/drivers/scsi/qla2xxx/qla_gs.c -@@ -675,8 +675,7 @@ qla2x00_rff_id(scsi_qla_host_t *vha, u8 type) - return (QLA_SUCCESS); - } - -- return qla_async_rffid(vha, &vha->d_id, qlt_rff_id(vha), -- FC4_TYPE_FCP_SCSI); -+ return qla_async_rffid(vha, &vha->d_id, qlt_rff_id(vha), type); - } - - static int qla_async_rffid(scsi_qla_host_t *vha, port_id_t *d_id, -@@ -726,7 +725,7 @@ static int qla_async_rffid(scsi_qla_host_t *vha, port_id_t *d_id, - /* Prepare CT arguments -- port_id, FC-4 feature, FC-4 type */ - ct_req->req.rff_id.port_id = port_id_to_be_id(*d_id); - ct_req->req.rff_id.fc4_feature = fc4feature; -- ct_req->req.rff_id.fc4_type = fc4type; /* SCSI - FCP */ -+ ct_req->req.rff_id.fc4_type = fc4type; /* SCSI-FCP or FC-NVMe */ - - sp->u.iocb_cmd.u.ctarg.req_size = RFF_ID_REQ_SIZE; - sp->u.iocb_cmd.u.ctarg.rsp_size = RFF_ID_RSP_SIZE; -diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c -index 37c1f27a76cf6..a6e24cef89a0b 100644 ---- a/drivers/scsi/qla2xxx/qla_init.c -+++ b/drivers/scsi/qla2xxx/qla_init.c -@@ -572,6 +572,14 @@ qla2x00_async_adisc(struct scsi_qla_host *vha, fc_port_t *fcport, - struct srb_iocb *lio; - int rval = QLA_FUNCTION_FAILED; - -+ if (IS_SESSION_DELETED(fcport)) { -+ ql_log(ql_log_warn, vha, 0xffff, -+ "%s: %8phC is being delete - not sending command.\n", -+ __func__, fcport->port_name); -+ fcport->flags &= ~FCF_ASYNC_ACTIVE; -+ return rval; -+ } -+ - if (!vha->flags.online || (fcport->flags & FCF_ASYNC_SENT)) - return rval; - -@@ -955,6 +963,9 @@ static void qla24xx_handle_gnl_done_event(scsi_qla_host_t *vha, - set_bit(RELOGIN_NEEDED, &vha->dpc_flags); - } - break; -+ case ISP_CFG_NL: -+ qla24xx_fcport_handle_login(vha, fcport); -+ break; - default: - break; - } -@@ -1311,14 +1322,21 @@ int qla24xx_async_gpdb(struct scsi_qla_host *vha, fc_port_t *fcport, u8 opt) - struct port_database_24xx *pd; - struct qla_hw_data *ha = vha->hw; - -- if (!vha->flags.online || (fcport->flags & FCF_ASYNC_SENT) || -- fcport->loop_id == FC_NO_LOOP_ID) { -+ if (IS_SESSION_DELETED(fcport)) { - ql_log(ql_log_warn, vha, 0xffff, -- "%s: %8phC - not sending command.\n", -- __func__, fcport->port_name); -+ "%s: %8phC is being delete - not sending command.\n", -+ __func__, fcport->port_name); -+ fcport->flags &= ~FCF_ASYNC_ACTIVE; - return rval; - } - -+ if (!vha->flags.online || fcport->flags & FCF_ASYNC_SENT) { -+ ql_log(ql_log_warn, vha, 0xffff, -+ "%s: %8phC online %d flags %x - not sending command.\n", -+ __func__, fcport->port_name, vha->flags.online, fcport->flags); -+ goto done; -+ } -+ - sp = qla2x00_get_sp(vha, fcport, GFP_KERNEL); - if (!sp) - goto done; -@@ -1477,6 +1495,11 @@ static void qla_chk_n2n_b4_login(struct scsi_qla_host *vha, fc_port_t *fcport) - u8 login = 0; - int rc; - -+ ql_dbg(ql_dbg_disc, vha, 0x307b, -+ "%s %8phC DS %d LS %d lid %d retries=%d\n", -+ __func__, fcport->port_name, fcport->disc_state, -+ fcport->fw_login_state, fcport->loop_id, fcport->login_retry); -+ - if (qla_tgt_mode_enabled(vha)) - return; - -@@ -1534,7 +1557,8 @@ int qla24xx_fcport_handle_login(struct scsi_qla_host *vha, fc_port_t *fcport) - fcport->conflict, fcport->last_rscn_gen, fcport->rscn_gen, - fcport->login_gen, fcport->loop_id, fcport->scan_state); - -- if (fcport->scan_state != QLA_FCPORT_FOUND) -+ if (fcport->scan_state != QLA_FCPORT_FOUND || -+ fcport->disc_state == DSC_DELETE_PEND) - return 0; - - if ((fcport->loop_id != FC_NO_LOOP_ID) && -@@ -1555,7 +1579,7 @@ int qla24xx_fcport_handle_login(struct scsi_qla_host *vha, fc_port_t *fcport) - if (vha->host->active_mode == MODE_TARGET) - return 0; - -- if (fcport->flags & FCF_ASYNC_SENT) { -+ if (fcport->flags & (FCF_ASYNC_SENT | FCF_ASYNC_ACTIVE)) { - set_bit(RELOGIN_NEEDED, &vha->dpc_flags); - return 0; - } -@@ -3223,6 +3247,14 @@ qla2x00_alloc_fw_dump(scsi_qla_host_t *vha) - struct rsp_que *rsp = ha->rsp_q_map[0]; - struct qla2xxx_fw_dump *fw_dump; - -+ if (ha->fw_dump) { -+ ql_dbg(ql_dbg_init, vha, 0x00bd, -+ "Firmware dump already allocated.\n"); -+ return; -+ } -+ -+ ha->fw_dumped = 0; -+ ha->fw_dump_cap_flags = 0; - dump_size = fixed_size = mem_size = eft_size = fce_size = mq_size = 0; - req_q_size = rsp_q_size = 0; - -@@ -3233,7 +3265,7 @@ qla2x00_alloc_fw_dump(scsi_qla_host_t *vha) - mem_size = (ha->fw_memory_size - 0x11000 + 1) * - sizeof(uint16_t); - } else if (IS_FWI2_CAPABLE(ha)) { -- if (IS_QLA83XX(ha) || IS_QLA27XX(ha) || IS_QLA28XX(ha)) -+ if (IS_QLA83XX(ha)) - fixed_size = offsetof(struct qla83xx_fw_dump, ext_mem); - else if (IS_QLA81XX(ha)) - fixed_size = offsetof(struct qla81xx_fw_dump, ext_mem); -@@ -3245,8 +3277,7 @@ qla2x00_alloc_fw_dump(scsi_qla_host_t *vha) - mem_size = (ha->fw_memory_size - 0x100000 + 1) * - sizeof(uint32_t); - if (ha->mqenable) { -- if (!IS_QLA83XX(ha) && !IS_QLA27XX(ha) && -- !IS_QLA28XX(ha)) -+ if (!IS_QLA83XX(ha)) - mq_size = sizeof(struct qla2xxx_mq_chain); - /* - * Allocate maximum buffer size for all queues - Q0. -@@ -3743,8 +3774,7 @@ enable_82xx_npiv: - ha->fw_major_version, ha->fw_minor_version, - ha->fw_subminor_version); - -- if (IS_QLA83XX(ha) || IS_QLA27XX(ha) || -- IS_QLA28XX(ha)) { -+ if (IS_QLA83XX(ha)) { - ha->flags.fac_supported = 0; - rval = QLA_SUCCESS; - } -@@ -5217,6 +5247,13 @@ skip_login: - memcpy(fcport->node_name, new_fcport->node_name, - WWN_SIZE); - fcport->scan_state = QLA_FCPORT_FOUND; -+ if (fcport->login_retry == 0) { -+ fcport->login_retry = vha->hw->login_retry_count; -+ ql_dbg(ql_dbg_disc, vha, 0x2135, -+ "Port login retry %8phN, lid 0x%04x retry cnt=%d.\n", -+ fcport->port_name, fcport->loop_id, -+ fcport->login_retry); -+ } - found++; - break; - } -@@ -5351,6 +5388,8 @@ qla2x00_reg_remote_port(scsi_qla_host_t *vha, fc_port_t *fcport) - if (atomic_read(&fcport->state) == FCS_ONLINE) - return; - -+ qla2x00_set_fcport_state(fcport, FCS_ONLINE); -+ - rport_ids.node_name = wwn_to_u64(fcport->node_name); - rport_ids.port_name = wwn_to_u64(fcport->port_name); - rport_ids.port_id = fcport->d_id.b.domain << 16 | -@@ -5446,6 +5485,7 @@ qla2x00_update_fcport(scsi_qla_host_t *vha, fc_port_t *fcport) - qla2x00_reg_remote_port(vha, fcport); - break; - case MODE_TARGET: -+ qla2x00_set_fcport_state(fcport, FCS_ONLINE); - if (!vha->vha_tgt.qla_tgt->tgt_stop && - !vha->vha_tgt.qla_tgt->tgt_stopped) - qlt_fc_port_added(vha, fcport); -@@ -5460,8 +5500,6 @@ qla2x00_update_fcport(scsi_qla_host_t *vha, fc_port_t *fcport) - break; - } - -- qla2x00_set_fcport_state(fcport, FCS_ONLINE); -- - if (IS_IIDMA_CAPABLE(vha->hw) && vha->hw->flags.gpsc_supported) { - if (fcport->id_changed) { - fcport->id_changed = 0; -@@ -9001,7 +9039,7 @@ struct qla_qpair *qla2xxx_create_qpair(struct scsi_qla_host *vha, int qos, - qpair->rsp->req = qpair->req; - qpair->rsp->qpair = qpair; - /* init qpair to this cpu. Will adjust at run time. */ -- qla_cpu_update(qpair, smp_processor_id()); -+ qla_cpu_update(qpair, raw_smp_processor_id()); - - if (IS_T10_PI_CAPABLE(ha) && ql2xenabledif) { - if (ha->fw_attributes & BIT_4) -diff --git a/drivers/scsi/qla2xxx/qla_iocb.c b/drivers/scsi/qla2xxx/qla_iocb.c -index 936103604d02d..103288b0377e0 100644 ---- a/drivers/scsi/qla2xxx/qla_iocb.c -+++ b/drivers/scsi/qla2xxx/qla_iocb.c -@@ -2859,6 +2859,7 @@ static void qla2x00_els_dcmd2_sp_done(srb_t *sp, int res) - set_bit(ISP_ABORT_NEEDED, - &vha->dpc_flags); - qla2xxx_wake_dpc(vha); -+ break; - } - /* fall through */ - default: -@@ -2868,9 +2869,7 @@ static void qla2x00_els_dcmd2_sp_done(srb_t *sp, int res) - fw_status[0], fw_status[1], fw_status[2]); - - fcport->flags &= ~FCF_ASYNC_SENT; -- qla2x00_set_fcport_disc_state(fcport, -- DSC_LOGIN_FAILED); -- set_bit(RELOGIN_NEEDED, &vha->dpc_flags); -+ qlt_schedule_sess_for_deletion(fcport); - break; - } - break; -@@ -2882,8 +2881,7 @@ static void qla2x00_els_dcmd2_sp_done(srb_t *sp, int res) - fw_status[0], fw_status[1], fw_status[2]); - - sp->fcport->flags &= ~FCF_ASYNC_SENT; -- qla2x00_set_fcport_disc_state(fcport, DSC_LOGIN_FAILED); -- set_bit(RELOGIN_NEEDED, &vha->dpc_flags); -+ qlt_schedule_sess_for_deletion(fcport); - break; - } - -diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c -index 3e9c5768815e5..d7cf7f9570874 100644 ---- a/drivers/scsi/qla2xxx/qla_isr.c -+++ b/drivers/scsi/qla2xxx/qla_isr.c -@@ -1839,6 +1839,7 @@ qla24xx_tm_iocb_entry(scsi_qla_host_t *vha, struct req_que *req, void *tsk) - iocb->u.tmf.data = QLA_FUNCTION_FAILED; - } else if ((le16_to_cpu(sts->scsi_status) & - SS_RESPONSE_INFO_LEN_VALID)) { -+ host_to_fcp_swap(sts->data, sizeof(sts->data)); - if (le32_to_cpu(sts->rsp_data_len) < 4) { - ql_log(ql_log_warn, fcport->vha, 0x503b, - "Async-%s error - hdl=%x not enough response(%d).\n", -diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c -index 098388a12febc..29f2730fbf66a 100644 ---- a/drivers/scsi/qla2xxx/qla_mbx.c -+++ b/drivers/scsi/qla2xxx/qla_mbx.c -@@ -10,6 +10,12 @@ - #include - #include - -+#ifdef CONFIG_PPC -+#define IS_PPCARCH true -+#else -+#define IS_PPCARCH false -+#endif -+ - static struct mb_cmd_name { - uint16_t cmd; - const char *str; -@@ -731,6 +737,9 @@ qla2x00_execute_fw(scsi_qla_host_t *vha, uint32_t risc_addr) - vha->min_supported_speed = - nv->min_supported_speed; - } -+ -+ if (IS_PPCARCH) -+ mcp->mb[11] |= BIT_4; - } - - if (ha->flags.exlogins_enabled) -@@ -2897,8 +2906,7 @@ qla2x00_get_resource_cnts(scsi_qla_host_t *vha) - ha->orig_fw_iocb_count = mcp->mb[10]; - if (ha->flags.npiv_supported) - ha->max_npiv_vports = mcp->mb[11]; -- if (IS_QLA81XX(ha) || IS_QLA83XX(ha) || IS_QLA27XX(ha) || -- IS_QLA28XX(ha)) -+ if (IS_QLA81XX(ha) || IS_QLA83XX(ha)) - ha->fw_max_fcf_count = mcp->mb[12]; - } - -@@ -5391,7 +5399,7 @@ qla2x00_get_data_rate(scsi_qla_host_t *vha) - mcp->out_mb = MBX_1|MBX_0; - mcp->in_mb = MBX_2|MBX_1|MBX_0; - if (IS_QLA83XX(ha) || IS_QLA27XX(ha) || IS_QLA28XX(ha)) -- mcp->in_mb |= MBX_3; -+ mcp->in_mb |= MBX_4|MBX_3; - mcp->tov = MBX_TOV_SECONDS; - mcp->flags = 0; - rval = qla2x00_mailbox_command(vha, mcp); -diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c -index 97453c12b7358..a15af048cd820 100644 ---- a/drivers/scsi/qla2xxx/qla_nvme.c -+++ b/drivers/scsi/qla2xxx/qla_nvme.c -@@ -36,6 +36,11 @@ int qla_nvme_register_remote(struct scsi_qla_host *vha, struct fc_port *fcport) - (fcport->nvme_flag & NVME_FLAG_REGISTERED)) - return 0; - -+ if (atomic_read(&fcport->state) == FCS_ONLINE) -+ return 0; -+ -+ qla2x00_set_fcport_state(fcport, FCS_ONLINE); -+ - fcport->nvme_flag &= ~NVME_FLAG_RESETTING; - - memset(&req, 0, sizeof(struct nvme_fc_port_info)); -@@ -152,6 +157,18 @@ out: - qla2xxx_rel_qpair_sp(sp->qpair, sp); - } - -+static void qla_nvme_ls_unmap(struct srb *sp, struct nvmefc_ls_req *fd) -+{ -+ if (sp->flags & SRB_DMA_VALID) { -+ struct srb_iocb *nvme = &sp->u.iocb_cmd; -+ struct qla_hw_data *ha = sp->fcport->vha->hw; -+ -+ dma_unmap_single(&ha->pdev->dev, nvme->u.nvme.cmd_dma, -+ fd->rqstlen, DMA_TO_DEVICE); -+ sp->flags &= ~SRB_DMA_VALID; -+ } -+} -+ - static void qla_nvme_release_ls_cmd_kref(struct kref *kref) - { - struct srb *sp = container_of(kref, struct srb, cmd_kref); -@@ -168,6 +185,8 @@ static void qla_nvme_release_ls_cmd_kref(struct kref *kref) - spin_unlock_irqrestore(&priv->cmd_lock, flags); - - fd = priv->fd; -+ -+ qla_nvme_ls_unmap(sp, fd); - fd->done(fd, priv->comp_status); - out: - qla2x00_rel_sp(sp); -@@ -314,6 +333,8 @@ static int qla_nvme_ls_req(struct nvme_fc_local_port *lport, - dma_sync_single_for_device(&ha->pdev->dev, nvme->u.nvme.cmd_dma, - fd->rqstlen, DMA_TO_DEVICE); - -+ sp->flags |= SRB_DMA_VALID; -+ - rval = qla2x00_start_sp(sp); - if (rval != QLA_SUCCESS) { - ql_log(ql_log_warn, vha, 0x700e, -@@ -321,6 +342,7 @@ static int qla_nvme_ls_req(struct nvme_fc_local_port *lport, - wake_up(&sp->nvme_ls_waitq); - sp->priv = NULL; - priv->sp = NULL; -+ qla_nvme_ls_unmap(sp, fd); - qla2x00_rel_sp(sp); - return rval; - } -diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c -index c1d4c964b0dd4..a5dbaa3491f82 100644 ---- a/drivers/scsi/qla2xxx/qla_os.c -+++ b/drivers/scsi/qla2xxx/qla_os.c -@@ -3627,8 +3627,7 @@ qla2x00_unmap_iobases(struct qla_hw_data *ha) - if (ha->mqiobase) - iounmap(ha->mqiobase); - -- if ((IS_QLA83XX(ha) || IS_QLA27XX(ha) || IS_QLA28XX(ha)) && -- ha->msixbase) -+ if (ha->msixbase) - iounmap(ha->msixbase); - } - } -@@ -5348,6 +5347,11 @@ void qla2x00_relogin(struct scsi_qla_host *vha) - memset(&ea, 0, sizeof(ea)); - ea.fcport = fcport; - qla24xx_handle_relogin_event(vha, &ea); -+ } else if (vha->hw->current_topology == -+ ISP_CFG_NL && -+ IS_QLA2XXX_MIDTYPE(vha->hw)) { -+ (void)qla24xx_fcport_handle_login(vha, -+ fcport); - } else if (vha->hw->current_topology == - ISP_CFG_NL) { - fcport->login_retry--; -diff --git a/drivers/scsi/qla2xxx/qla_sup.c b/drivers/scsi/qla2xxx/qla_sup.c -index bbe90354f49b0..d306f3ca0f3bf 100644 ---- a/drivers/scsi/qla2xxx/qla_sup.c -+++ b/drivers/scsi/qla2xxx/qla_sup.c -@@ -843,7 +843,7 @@ qla2xxx_get_flt_info(scsi_qla_host_t *vha, uint32_t flt_addr) - ha->flt_region_nvram = start; - break; - case FLT_REG_IMG_PRI_27XX: -- if (IS_QLA27XX(ha) && !IS_QLA28XX(ha)) -+ if (IS_QLA27XX(ha) || IS_QLA28XX(ha)) - ha->flt_region_img_status_pri = start; - break; - case FLT_REG_IMG_SEC_27XX: -@@ -1355,7 +1355,7 @@ next: - flash_data_addr(ha, faddr), cpu_to_le32(*dwptr)); - if (ret) { - ql_dbg(ql_dbg_user, vha, 0x7006, -- "Failed slopw write %x (%x)\n", faddr, *dwptr); -+ "Failed slow write %x (%x)\n", faddr, *dwptr); - break; - } - } -diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c -index 0111c543f0e64..df598c377161d 100644 ---- a/drivers/scsi/qla2xxx/qla_target.c -+++ b/drivers/scsi/qla2xxx/qla_target.c -@@ -3251,6 +3251,7 @@ int qlt_xmit_response(struct qla_tgt_cmd *cmd, int xmit_type, - "RESET-RSP online/active/old-count/new-count = %d/%d/%d/%d.\n", - vha->flags.online, qla2x00_reset_active(vha), - cmd->reset_count, qpair->chip_reset); -+ res = 0; - goto out_unmap_unlock; - } - -@@ -7083,8 +7084,7 @@ qlt_probe_one_stage1(struct scsi_qla_host *base_vha, struct qla_hw_data *ha) - if (!QLA_TGT_MODE_ENABLED()) - return; - -- if ((ql2xenablemsix == 0) || IS_QLA83XX(ha) || IS_QLA27XX(ha) || -- IS_QLA28XX(ha)) { -+ if (ha->mqenable || IS_QLA83XX(ha) || IS_QLA27XX(ha) || IS_QLA28XX(ha)) { - ISP_ATIO_Q_IN(base_vha) = &ha->mqiobase->isp25mq.atio_q_in; - ISP_ATIO_Q_OUT(base_vha) = &ha->mqiobase->isp25mq.atio_q_out; - } else { -diff --git a/drivers/scsi/zorro7xx.c b/drivers/scsi/zorro7xx.c -index 27b9e2baab1a6..7acf9193a9e80 100644 ---- a/drivers/scsi/zorro7xx.c -+++ b/drivers/scsi/zorro7xx.c -@@ -159,6 +159,8 @@ static void zorro7xx_remove_one(struct zorro_dev *z) - scsi_remove_host(host); - - NCR_700_release(host); -+ if (host->base > 0x01000000) -+ iounmap(hostdata->base); - kfree(hostdata); - free_irq(host->irq, host); - zorro_release_device(z); -diff --git a/drivers/soc/qcom/qcom_aoss.c b/drivers/soc/qcom/qcom_aoss.c -index 45c5aa712edac..f16d6ec780644 100644 ---- a/drivers/soc/qcom/qcom_aoss.c -+++ b/drivers/soc/qcom/qcom_aoss.c -@@ -544,7 +544,7 @@ static int qmp_probe(struct platform_device *pdev) - } - - irq = platform_get_irq(pdev, 0); -- ret = devm_request_irq(&pdev->dev, irq, qmp_intr, IRQF_ONESHOT, -+ ret = devm_request_irq(&pdev->dev, irq, qmp_intr, 0, - "aoss-qmp", qmp); - if (ret < 0) { - dev_err(&pdev->dev, "failed to request interrupt\n"); -diff --git a/drivers/soc/qcom/rpmpd.c b/drivers/soc/qcom/rpmpd.c -index 3c1a55cf25d62..4715acfecff49 100644 ---- a/drivers/soc/qcom/rpmpd.c -+++ b/drivers/soc/qcom/rpmpd.c -@@ -362,6 +362,9 @@ static int rpmpd_probe(struct platform_device *pdev) - - data->domains = devm_kcalloc(&pdev->dev, num, sizeof(*data->domains), - GFP_KERNEL); -+ if (!data->domains) -+ return -ENOMEM; -+ - data->num_domains = num; - - for (i = 0; i < num; i++) { -diff --git a/drivers/soc/ti/wkup_m3_ipc.c b/drivers/soc/ti/wkup_m3_ipc.c -index e9ece45d7a333..ef3f95fefab58 100644 ---- a/drivers/soc/ti/wkup_m3_ipc.c -+++ b/drivers/soc/ti/wkup_m3_ipc.c -@@ -447,9 +447,9 @@ static int wkup_m3_ipc_probe(struct platform_device *pdev) - } - - irq = platform_get_irq(pdev, 0); -- if (!irq) { -+ if (irq < 0) { - dev_err(&pdev->dev, "no irq resource\n"); -- return -ENXIO; -+ return irq; - } - - ret = devm_request_irq(dev, irq, wkup_m3_txev_handler, -diff --git a/drivers/spi/spi-bcm-qspi.c b/drivers/spi/spi-bcm-qspi.c -index 3755be04346a6..d933a6eda5fdc 100644 ---- a/drivers/spi/spi-bcm-qspi.c -+++ b/drivers/spi/spi-bcm-qspi.c -@@ -960,7 +960,7 @@ static int bcm_qspi_exec_mem_op(struct spi_mem *mem, - addr = op->addr.val; - len = op->data.nbytes; - -- if (bcm_qspi_bspi_ver_three(qspi) == true) { -+ if (has_bspi(qspi) && bcm_qspi_bspi_ver_three(qspi) == true) { - /* - * The address coming into this function is a raw flash offset. - * But for BSPI <= V3, we need to convert it to a remapped BSPI -@@ -979,7 +979,7 @@ static int bcm_qspi_exec_mem_op(struct spi_mem *mem, - len < 4) - mspi_read = true; - -- if (mspi_read) -+ if (!has_bspi(qspi) || mspi_read) - return bcm_qspi_mspi_exec_mem_op(spi, op); - - ret = bcm_qspi_bspi_set_mode(qspi, op, 0); -diff --git a/drivers/spi/spi-mxic.c b/drivers/spi/spi-mxic.c -index eba706d5671e2..d0b5db88cd164 100644 ---- a/drivers/spi/spi-mxic.c -+++ b/drivers/spi/spi-mxic.c -@@ -304,25 +304,21 @@ static int mxic_spi_data_xfer(struct mxic_spi *mxic, const void *txbuf, - - writel(data, mxic->regs + TXD(nbytes % 4)); - -+ ret = readl_poll_timeout(mxic->regs + INT_STS, sts, -+ sts & INT_TX_EMPTY, 0, USEC_PER_SEC); -+ if (ret) -+ return ret; -+ -+ ret = readl_poll_timeout(mxic->regs + INT_STS, sts, -+ sts & INT_RX_NOT_EMPTY, 0, -+ USEC_PER_SEC); -+ if (ret) -+ return ret; -+ -+ data = readl(mxic->regs + RXD); - if (rxbuf) { -- ret = readl_poll_timeout(mxic->regs + INT_STS, sts, -- sts & INT_TX_EMPTY, 0, -- USEC_PER_SEC); -- if (ret) -- return ret; -- -- ret = readl_poll_timeout(mxic->regs + INT_STS, sts, -- sts & INT_RX_NOT_EMPTY, 0, -- USEC_PER_SEC); -- if (ret) -- return ret; -- -- data = readl(mxic->regs + RXD); - data >>= (8 * (4 - nbytes)); - memcpy(rxbuf + pos, &data, nbytes); -- WARN_ON(readl(mxic->regs + INT_STS) & INT_RX_NOT_EMPTY); -- } else { -- readl(mxic->regs + RXD); - } - WARN_ON(readl(mxic->regs + INT_STS) & INT_RX_NOT_EMPTY); - -diff --git a/drivers/spi/spi-pxa2xx-pci.c b/drivers/spi/spi-pxa2xx-pci.c -index aafac128bb5f1..4eb979a096c78 100644 ---- a/drivers/spi/spi-pxa2xx-pci.c -+++ b/drivers/spi/spi-pxa2xx-pci.c -@@ -74,14 +74,23 @@ static bool lpss_dma_filter(struct dma_chan *chan, void *param) - return true; - } - -+static void lpss_dma_put_device(void *dma_dev) -+{ -+ pci_dev_put(dma_dev); -+} -+ - static int lpss_spi_setup(struct pci_dev *dev, struct pxa_spi_info *c) - { - struct pci_dev *dma_dev; -+ int ret; - - c->num_chipselect = 1; - c->max_clk_rate = 50000000; - - dma_dev = pci_get_slot(dev->bus, PCI_DEVFN(PCI_SLOT(dev->devfn), 0)); -+ ret = devm_add_action_or_reset(&dev->dev, lpss_dma_put_device, dma_dev); -+ if (ret) -+ return ret; - - if (c->tx_param) { - struct dw_dma_slave *slave = c->tx_param; -@@ -105,8 +114,9 @@ static int lpss_spi_setup(struct pci_dev *dev, struct pxa_spi_info *c) - - static int mrfld_spi_setup(struct pci_dev *dev, struct pxa_spi_info *c) - { -- struct pci_dev *dma_dev = pci_get_slot(dev->bus, PCI_DEVFN(21, 0)); - struct dw_dma_slave *tx, *rx; -+ struct pci_dev *dma_dev; -+ int ret; - - switch (PCI_FUNC(dev->devfn)) { - case 0: -@@ -131,6 +141,11 @@ static int mrfld_spi_setup(struct pci_dev *dev, struct pxa_spi_info *c) - return -ENODEV; - } - -+ dma_dev = pci_get_slot(dev->bus, PCI_DEVFN(21, 0)); -+ ret = devm_add_action_or_reset(&dev->dev, lpss_dma_put_device, dma_dev); -+ if (ret) -+ return ret; -+ - tx = c->tx_param; - tx->dma_dev = &dma_dev->dev; - -diff --git a/drivers/spi/spi-tegra114.c b/drivers/spi/spi-tegra114.c -index 594905bf89aa8..3f7a64b2a5d06 100644 ---- a/drivers/spi/spi-tegra114.c -+++ b/drivers/spi/spi-tegra114.c -@@ -1352,6 +1352,10 @@ static int tegra_spi_probe(struct platform_device *pdev) - tspi->phys = r->start; - - spi_irq = platform_get_irq(pdev, 0); -+ if (spi_irq < 0) { -+ ret = spi_irq; -+ goto exit_free_master; -+ } - tspi->irq = spi_irq; - - tspi->clk = devm_clk_get(&pdev->dev, "spi"); -diff --git a/drivers/spi/spi-tegra20-slink.c b/drivers/spi/spi-tegra20-slink.c -index 9b59539c87359..e6b12f78c8f01 100644 ---- a/drivers/spi/spi-tegra20-slink.c -+++ b/drivers/spi/spi-tegra20-slink.c -@@ -1011,14 +1011,8 @@ static int tegra_slink_probe(struct platform_device *pdev) - struct resource *r; - int ret, spi_irq; - const struct tegra_slink_chip_data *cdata = NULL; -- const struct of_device_id *match; - -- match = of_match_device(tegra_slink_of_match, &pdev->dev); -- if (!match) { -- dev_err(&pdev->dev, "Error: No device match found\n"); -- return -ENODEV; -- } -- cdata = match->data; -+ cdata = of_device_get_match_data(&pdev->dev); - - master = spi_alloc_master(&pdev->dev, sizeof(*tspi)); - if (!master) { -diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c -index ac05c9c864884..b18ae50db1f52 100644 ---- a/drivers/spi/spi.c -+++ b/drivers/spi/spi.c -@@ -844,10 +844,10 @@ int spi_map_buf(struct spi_controller *ctlr, struct device *dev, - int i, ret; - - if (vmalloced_buf || kmap_buf) { -- desc_len = min_t(int, max_seg_size, PAGE_SIZE); -+ desc_len = min_t(unsigned long, max_seg_size, PAGE_SIZE); - sgs = DIV_ROUND_UP(len + offset_in_page(buf), desc_len); - } else if (virt_addr_valid(buf)) { -- desc_len = min_t(int, max_seg_size, ctlr->max_dma_len); -+ desc_len = min_t(size_t, max_seg_size, ctlr->max_dma_len); - sgs = DIV_ROUND_UP(len, desc_len); - } else { - return -EINVAL; -diff --git a/drivers/staging/iio/adc/ad7280a.c b/drivers/staging/iio/adc/ad7280a.c -index 19a5f244dcae2..d8886c5c0d1f2 100644 ---- a/drivers/staging/iio/adc/ad7280a.c -+++ b/drivers/staging/iio/adc/ad7280a.c -@@ -107,9 +107,9 @@ - static unsigned int ad7280a_devaddr(unsigned int addr) - { - return ((addr & 0x1) << 4) | -- ((addr & 0x2) << 3) | -+ ((addr & 0x2) << 2) | - (addr & 0x4) | -- ((addr & 0x8) >> 3) | -+ ((addr & 0x8) >> 2) | - ((addr & 0x10) >> 4); - } - -diff --git a/drivers/staging/media/hantro/hantro_h1_jpeg_enc.c b/drivers/staging/media/hantro/hantro_h1_jpeg_enc.c -index 8b76f1f13b062..e81a354b88720 100644 ---- a/drivers/staging/media/hantro/hantro_h1_jpeg_enc.c -+++ b/drivers/staging/media/hantro/hantro_h1_jpeg_enc.c -@@ -23,7 +23,7 @@ static void hantro_h1_set_src_img_ctrl(struct hantro_dev *vpu, - - reg = H1_REG_IN_IMG_CTRL_ROW_LEN(pix_fmt->width) - | H1_REG_IN_IMG_CTRL_OVRFLR_D4(0) -- | H1_REG_IN_IMG_CTRL_OVRFLB_D4(0) -+ | H1_REG_IN_IMG_CTRL_OVRFLB(0) - | H1_REG_IN_IMG_CTRL_FMT(ctx->vpu_src_fmt->enc_fmt); - vepu_write_relaxed(vpu, reg, H1_REG_IN_IMG_CTRL); - } -diff --git a/drivers/staging/media/hantro/hantro_h1_regs.h b/drivers/staging/media/hantro/hantro_h1_regs.h -index d6e9825bb5c7b..30e7e7b920b55 100644 ---- a/drivers/staging/media/hantro/hantro_h1_regs.h -+++ b/drivers/staging/media/hantro/hantro_h1_regs.h -@@ -47,7 +47,7 @@ - #define H1_REG_IN_IMG_CTRL 0x03c - #define H1_REG_IN_IMG_CTRL_ROW_LEN(x) ((x) << 12) - #define H1_REG_IN_IMG_CTRL_OVRFLR_D4(x) ((x) << 10) --#define H1_REG_IN_IMG_CTRL_OVRFLB_D4(x) ((x) << 6) -+#define H1_REG_IN_IMG_CTRL_OVRFLB(x) ((x) << 6) - #define H1_REG_IN_IMG_CTRL_FMT(x) ((x) << 2) - #define H1_REG_ENC_CTRL0 0x040 - #define H1_REG_ENC_CTRL0_INIT_QP(x) ((x) << 26) -diff --git a/drivers/staging/mt7621-dts/gbpc1.dts b/drivers/staging/mt7621-dts/gbpc1.dts -index 1fb560ff059c8..1713283e60d4e 100644 ---- a/drivers/staging/mt7621-dts/gbpc1.dts -+++ b/drivers/staging/mt7621-dts/gbpc1.dts -@@ -11,7 +11,8 @@ - - memory@0 { - device_type = "memory"; -- reg = <0x0 0x1c000000>, <0x20000000 0x4000000>; -+ reg = <0x00000000 0x1c000000>, -+ <0x20000000 0x04000000>; - }; - - chosen { -@@ -37,24 +38,16 @@ - gpio-leds { - compatible = "gpio-leds"; - -- system { -- label = "gb-pc1:green:system"; -+ power { -+ label = "green:power"; - gpios = <&gpio 6 GPIO_ACTIVE_LOW>; -+ linux,default-trigger = "default-on"; - }; - -- status { -- label = "gb-pc1:green:status"; -+ system { -+ label = "green:system"; - gpios = <&gpio 8 GPIO_ACTIVE_LOW>; -- }; -- -- lan1 { -- label = "gb-pc1:green:lan1"; -- gpios = <&gpio 24 GPIO_ACTIVE_LOW>; -- }; -- -- lan2 { -- label = "gb-pc1:green:lan2"; -- gpios = <&gpio 25 GPIO_ACTIVE_LOW>; -+ linux,default-trigger = "disk-activity"; - }; - }; - }; -@@ -94,9 +87,8 @@ - - partition@50000 { - label = "firmware"; -- reg = <0x50000 0x1FB0000>; -+ reg = <0x50000 0x1fb0000>; - }; -- - }; - }; - -@@ -118,9 +110,12 @@ - }; - - &pinctrl { -- state_default: pinctrl0 { -- default_gpio: gpio { -- groups = "wdt", "rgmii2", "uart3"; -+ pinctrl-names = "default"; -+ pinctrl-0 = <&state_default>; -+ -+ state_default: state-default { -+ gpio-pinmux { -+ groups = "rgmii2", "uart3", "wdt"; - function = "gpio"; - }; - }; -@@ -129,12 +124,13 @@ - &switch0 { - ports { - port@0 { -+ status = "okay"; - label = "ethblack"; -- status = "ok"; - }; -+ - port@4 { -+ status = "okay"; - label = "ethblue"; -- status = "ok"; - }; - }; - }; -diff --git a/drivers/thermal/intel/int340x_thermal/int3400_thermal.c b/drivers/thermal/intel/int340x_thermal/int3400_thermal.c -index a31163547fbaa..3a1a28a79d463 100644 ---- a/drivers/thermal/intel/int340x_thermal/int3400_thermal.c -+++ b/drivers/thermal/intel/int340x_thermal/int3400_thermal.c -@@ -49,7 +49,7 @@ struct int3400_thermal_priv { - struct art *arts; - int trt_count; - struct trt *trts; -- u8 uuid_bitmap; -+ u32 uuid_bitmap; - int rel_misc_dev_res; - int current_uuid_index; - }; -diff --git a/drivers/tty/hvc/hvc_iucv.c b/drivers/tty/hvc/hvc_iucv.c -index 2af1e5751bd63..796fbff623f6e 100644 ---- a/drivers/tty/hvc/hvc_iucv.c -+++ b/drivers/tty/hvc/hvc_iucv.c -@@ -1470,7 +1470,9 @@ out_error: - */ - static int __init hvc_iucv_config(char *val) - { -- return kstrtoul(val, 10, &hvc_iucv_devices); -+ if (kstrtoul(val, 10, &hvc_iucv_devices)) -+ pr_warn("hvc_iucv= invalid parameter value '%s'\n", val); -+ return 1; - } - - -diff --git a/drivers/tty/mxser.c b/drivers/tty/mxser.c -index 9d00ff5ef9611..085dc8dd1327b 100644 ---- a/drivers/tty/mxser.c -+++ b/drivers/tty/mxser.c -@@ -861,6 +861,7 @@ static int mxser_activate(struct tty_port *port, struct tty_struct *tty) - struct mxser_port *info = container_of(port, struct mxser_port, port); - unsigned long page; - unsigned long flags; -+ int ret; - - page = __get_free_page(GFP_KERNEL); - if (!page) -@@ -870,9 +871,9 @@ static int mxser_activate(struct tty_port *port, struct tty_struct *tty) - - if (!info->ioaddr || !info->type) { - set_bit(TTY_IO_ERROR, &tty->flags); -- free_page(page); - spin_unlock_irqrestore(&info->slock, flags); -- return 0; -+ ret = 0; -+ goto err_free_xmit; - } - info->port.xmit_buf = (unsigned char *) page; - -@@ -898,8 +899,10 @@ static int mxser_activate(struct tty_port *port, struct tty_struct *tty) - if (capable(CAP_SYS_ADMIN)) { - set_bit(TTY_IO_ERROR, &tty->flags); - return 0; -- } else -- return -ENODEV; -+ } -+ -+ ret = -ENODEV; -+ goto err_free_xmit; - } - - /* -@@ -944,6 +947,10 @@ static int mxser_activate(struct tty_port *port, struct tty_struct *tty) - spin_unlock_irqrestore(&info->slock, flags); - - return 0; -+err_free_xmit: -+ free_page(page); -+ info->port.xmit_buf = NULL; -+ return ret; - } - - /* -diff --git a/drivers/tty/serial/8250/8250_mid.c b/drivers/tty/serial/8250/8250_mid.c -index efa0515139f8e..e6c1791609ddf 100644 ---- a/drivers/tty/serial/8250/8250_mid.c -+++ b/drivers/tty/serial/8250/8250_mid.c -@@ -73,6 +73,11 @@ static int pnw_setup(struct mid8250 *mid, struct uart_port *p) - return 0; - } - -+static void pnw_exit(struct mid8250 *mid) -+{ -+ pci_dev_put(mid->dma_dev); -+} -+ - static int tng_handle_irq(struct uart_port *p) - { - struct mid8250 *mid = p->private_data; -@@ -124,6 +129,11 @@ static int tng_setup(struct mid8250 *mid, struct uart_port *p) - return 0; - } - -+static void tng_exit(struct mid8250 *mid) -+{ -+ pci_dev_put(mid->dma_dev); -+} -+ - static int dnv_handle_irq(struct uart_port *p) - { - struct mid8250 *mid = p->private_data; -@@ -330,9 +340,9 @@ static int mid8250_probe(struct pci_dev *pdev, const struct pci_device_id *id) - - pci_set_drvdata(pdev, mid); - return 0; -+ - err: -- if (mid->board->exit) -- mid->board->exit(mid); -+ mid->board->exit(mid); - return ret; - } - -@@ -342,8 +352,7 @@ static void mid8250_remove(struct pci_dev *pdev) - - serial8250_unregister_port(mid->line); - -- if (mid->board->exit) -- mid->board->exit(mid); -+ mid->board->exit(mid); - } - - static const struct mid8250_board pnw_board = { -@@ -351,6 +360,7 @@ static const struct mid8250_board pnw_board = { - .freq = 50000000, - .base_baud = 115200, - .setup = pnw_setup, -+ .exit = pnw_exit, - }; - - static const struct mid8250_board tng_board = { -@@ -358,6 +368,7 @@ static const struct mid8250_board tng_board = { - .freq = 38400000, - .base_baud = 1843200, - .setup = tng_setup, -+ .exit = tng_exit, - }; - - static const struct mid8250_board dnv_board = { -diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c -index 777ef1a9591c0..87567515591e1 100644 ---- a/drivers/tty/serial/8250/8250_port.c -+++ b/drivers/tty/serial/8250/8250_port.c -@@ -1545,6 +1545,18 @@ static inline void start_tx_rs485(struct uart_port *port) - if (!(up->port.rs485.flags & SER_RS485_RX_DURING_TX)) - serial8250_stop_rx(&up->port); - -+ /* -+ * While serial8250_em485_handle_stop_tx() is a noop if -+ * em485->active_timer != &em485->stop_tx_timer, it might happen that -+ * the timer is still armed and triggers only after the current bunch of -+ * chars is send and em485->active_timer == &em485->stop_tx_timer again. -+ * So cancel the timer. There is still a theoretical race condition if -+ * the timer is already running and only comes around to check for -+ * em485->active_timer when &em485->stop_tx_timer is armed again. -+ */ -+ if (em485->active_timer == &em485->stop_tx_timer) -+ hrtimer_try_to_cancel(&em485->stop_tx_timer); -+ - em485->active_timer = NULL; - - mcr = serial8250_in_MCR(up); -diff --git a/drivers/tty/serial/kgdboc.c b/drivers/tty/serial/kgdboc.c -index f5608ad68ae1a..6d4792ec9e5fa 100644 ---- a/drivers/tty/serial/kgdboc.c -+++ b/drivers/tty/serial/kgdboc.c -@@ -391,16 +391,16 @@ static int kgdboc_option_setup(char *opt) - { - if (!opt) { - pr_err("config string not provided\n"); -- return -EINVAL; -+ return 1; - } - - if (strlen(opt) >= MAX_CONFIG_LEN) { - pr_err("config string too long\n"); -- return -ENOSPC; -+ return 1; - } - strcpy(config, opt); - -- return 0; -+ return 1; - } - - __setup("kgdboc=", kgdboc_option_setup); -diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c -index c7683beb3412a..6040d5a6139ab 100644 ---- a/drivers/tty/serial/samsung.c -+++ b/drivers/tty/serial/samsung.c -@@ -761,11 +761,8 @@ static irqreturn_t s3c24xx_serial_tx_chars(int irq, void *id) - goto out; - } - -- if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS) { -- spin_unlock(&port->lock); -+ if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS) - uart_write_wakeup(port); -- spin_lock(&port->lock); -- } - - if (uart_circ_empty(xmit)) - s3c24xx_serial_stop_tx(port); -diff --git a/drivers/usb/dwc3/dwc3-omap.c b/drivers/usb/dwc3/dwc3-omap.c -index e8acad49a53a8..81ee1cd794f7d 100644 ---- a/drivers/usb/dwc3/dwc3-omap.c -+++ b/drivers/usb/dwc3/dwc3-omap.c -@@ -242,7 +242,7 @@ static void dwc3_omap_set_mailbox(struct dwc3_omap *omap, - break; - - case OMAP_DWC3_ID_FLOAT: -- if (omap->vbus_reg) -+ if (omap->vbus_reg && regulator_is_enabled(omap->vbus_reg)) - regulator_disable(omap->vbus_reg); - val = dwc3_omap_read_utmi_ctrl(omap); - val |= USBOTGSS_UTMI_OTG_CTRL_IDDIG; -diff --git a/drivers/usb/host/ehci-pci.c b/drivers/usb/host/ehci-pci.c -index 774ccaa5aceea..1962140a59f20 100644 ---- a/drivers/usb/host/ehci-pci.c -+++ b/drivers/usb/host/ehci-pci.c -@@ -21,6 +21,9 @@ static const char hcd_name[] = "ehci-pci"; - /* defined here to avoid adding to pci_ids.h for single instance use */ - #define PCI_DEVICE_ID_INTEL_CE4100_USB 0x2e70 - -+#define PCI_VENDOR_ID_ASPEED 0x1a03 -+#define PCI_DEVICE_ID_ASPEED_EHCI 0x2603 -+ - /*-------------------------------------------------------------------------*/ - #define PCI_DEVICE_ID_INTEL_QUARK_X1000_SOC 0x0939 - static inline bool is_intel_quark_x1000(struct pci_dev *pdev) -@@ -223,6 +226,12 @@ static int ehci_pci_setup(struct usb_hcd *hcd) - ehci->has_synopsys_hc_bug = 1; - } - break; -+ case PCI_VENDOR_ID_ASPEED: -+ if (pdev->device == PCI_DEVICE_ID_ASPEED_EHCI) { -+ ehci_info(ehci, "applying Aspeed HC workaround\n"); -+ ehci->is_aspeed = 1; -+ } -+ break; - } - - /* optional debug port, normally in the first BAR */ -diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c -index 48832f7f2fc3c..db65e1ad00deb 100644 ---- a/drivers/usb/host/xhci-hub.c -+++ b/drivers/usb/host/xhci-hub.c -@@ -674,7 +674,7 @@ static int xhci_exit_test_mode(struct xhci_hcd *xhci) - } - pm_runtime_allow(xhci_to_hcd(xhci)->self.controller); - xhci->test_mode = 0; -- return xhci_reset(xhci); -+ return xhci_reset(xhci, XHCI_RESET_SHORT_USEC); - } - - void xhci_set_link_state(struct xhci_hcd *xhci, struct xhci_port *port, -@@ -1000,6 +1000,9 @@ static void xhci_get_usb2_port_status(struct xhci_port *port, u32 *status, - if (link_state == XDEV_U2) - *status |= USB_PORT_STAT_L1; - if (link_state == XDEV_U0) { -+ if (bus_state->resume_done[portnum]) -+ usb_hcd_end_port_resume(&port->rhub->hcd->self, -+ portnum); - bus_state->resume_done[portnum] = 0; - clear_bit(portnum, &bus_state->resuming_ports); - if (bus_state->suspended_ports & (1 << portnum)) { -diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c -index 160caef09c5ea..ef23a69c6553a 100644 ---- a/drivers/usb/host/xhci-mem.c -+++ b/drivers/usb/host/xhci-mem.c -@@ -2583,7 +2583,7 @@ int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags) - - fail: - xhci_halt(xhci); -- xhci_reset(xhci); -+ xhci_reset(xhci, XHCI_RESET_SHORT_USEC); - xhci_mem_cleanup(xhci); - return -ENOMEM; - } -diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c -index 8f029d44e9c9e..476dc6abd5a21 100644 ---- a/drivers/usb/host/xhci.c -+++ b/drivers/usb/host/xhci.c -@@ -66,7 +66,7 @@ static bool td_on_ring(struct xhci_td *td, struct xhci_ring *ring) - * handshake done). There are two failure modes: "usec" have passed (major - * hardware flakeout), or the register reads as all-ones (hardware removed). - */ --int xhci_handshake(void __iomem *ptr, u32 mask, u32 done, int usec) -+int xhci_handshake(void __iomem *ptr, u32 mask, u32 done, u64 timeout_us) - { - u32 result; - int ret; -@@ -74,7 +74,7 @@ int xhci_handshake(void __iomem *ptr, u32 mask, u32 done, int usec) - ret = readl_poll_timeout_atomic(ptr, result, - (result & mask) == done || - result == U32_MAX, -- 1, usec); -+ 1, timeout_us); - if (result == U32_MAX) /* card removed */ - return -ENODEV; - -@@ -163,7 +163,7 @@ int xhci_start(struct xhci_hcd *xhci) - * Transactions will be terminated immediately, and operational registers - * will be set to their defaults. - */ --int xhci_reset(struct xhci_hcd *xhci) -+int xhci_reset(struct xhci_hcd *xhci, u64 timeout_us) - { - u32 command; - u32 state; -@@ -196,8 +196,7 @@ int xhci_reset(struct xhci_hcd *xhci) - if (xhci->quirks & XHCI_INTEL_HOST) - udelay(1000); - -- ret = xhci_handshake(&xhci->op_regs->command, -- CMD_RESET, 0, 10 * 1000 * 1000); -+ ret = xhci_handshake(&xhci->op_regs->command, CMD_RESET, 0, timeout_us); - if (ret) - return ret; - -@@ -210,8 +209,7 @@ int xhci_reset(struct xhci_hcd *xhci) - * xHCI cannot write to any doorbells or operational registers other - * than status until the "Controller Not Ready" flag is cleared. - */ -- ret = xhci_handshake(&xhci->op_regs->status, -- STS_CNR, 0, 10 * 1000 * 1000); -+ ret = xhci_handshake(&xhci->op_regs->status, STS_CNR, 0, timeout_us); - - xhci->usb2_rhub.bus_state.port_c_suspend = 0; - xhci->usb2_rhub.bus_state.suspended_ports = 0; -@@ -732,7 +730,7 @@ static void xhci_stop(struct usb_hcd *hcd) - xhci->xhc_state |= XHCI_STATE_HALTED; - xhci->cmd_ring_state = CMD_RING_STATE_STOPPED; - xhci_halt(xhci); -- xhci_reset(xhci); -+ xhci_reset(xhci, XHCI_RESET_SHORT_USEC); - spin_unlock_irq(&xhci->lock); - - xhci_cleanup_msix(xhci); -@@ -785,7 +783,7 @@ void xhci_shutdown(struct usb_hcd *hcd) - xhci_halt(xhci); - /* Workaround for spurious wakeups at shutdown with HSW */ - if (xhci->quirks & XHCI_SPURIOUS_WAKEUP) -- xhci_reset(xhci); -+ xhci_reset(xhci, XHCI_RESET_SHORT_USEC); - spin_unlock_irq(&xhci->lock); - - xhci_cleanup_msix(xhci); -@@ -1170,7 +1168,7 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated) - xhci_dbg(xhci, "Stop HCD\n"); - xhci_halt(xhci); - xhci_zero_64b_regs(xhci); -- retval = xhci_reset(xhci); -+ retval = xhci_reset(xhci, XHCI_RESET_LONG_USEC); - spin_unlock_irq(&xhci->lock); - if (retval) - return retval; -@@ -5272,7 +5270,7 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks) - - xhci_dbg(xhci, "Resetting HCD\n"); - /* Reset the internal HC memory state and registers. */ -- retval = xhci_reset(xhci); -+ retval = xhci_reset(xhci, XHCI_RESET_LONG_USEC); - if (retval) - return retval; - xhci_dbg(xhci, "Reset complete\n"); -diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h -index 02df309e44093..4b05d767e08f7 100644 ---- a/drivers/usb/host/xhci.h -+++ b/drivers/usb/host/xhci.h -@@ -229,6 +229,9 @@ struct xhci_op_regs { - #define CMD_ETE (1 << 14) - /* bits 15:31 are reserved (and should be preserved on writes). */ - -+#define XHCI_RESET_LONG_USEC (10 * 1000 * 1000) -+#define XHCI_RESET_SHORT_USEC (250 * 1000) -+ - /* IMAN - Interrupt Management Register */ - #define IMAN_IE (1 << 1) - #define IMAN_IP (1 << 0) -@@ -2061,11 +2064,11 @@ void xhci_free_container_ctx(struct xhci_hcd *xhci, - - /* xHCI host controller glue */ - typedef void (*xhci_get_quirks_t)(struct device *, struct xhci_hcd *); --int xhci_handshake(void __iomem *ptr, u32 mask, u32 done, int usec); -+int xhci_handshake(void __iomem *ptr, u32 mask, u32 done, u64 timeout_us); - void xhci_quiesce(struct xhci_hcd *xhci); - int xhci_halt(struct xhci_hcd *xhci); - int xhci_start(struct xhci_hcd *xhci); --int xhci_reset(struct xhci_hcd *xhci); -+int xhci_reset(struct xhci_hcd *xhci, u64 timeout_us); - int xhci_run(struct usb_hcd *hcd); - int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks); - void xhci_shutdown(struct usb_hcd *hcd); -@@ -2449,6 +2452,8 @@ static inline const char *xhci_decode_ctrl_ctx(unsigned long drop, - unsigned int bit; - int ret = 0; - -+ str[0] = '\0'; -+ - if (drop) { - ret = sprintf(str, "Drop:"); - for_each_set_bit(bit, &drop, 32) -diff --git a/drivers/usb/serial/Kconfig b/drivers/usb/serial/Kconfig -index 67279c6bce338..31ad8682ad9b8 100644 ---- a/drivers/usb/serial/Kconfig -+++ b/drivers/usb/serial/Kconfig -@@ -66,6 +66,7 @@ config USB_SERIAL_SIMPLE - - Libtransistor USB console - - a number of Motorola phones - - Motorola Tetra devices -+ - Nokia mobile phones - - Novatel Wireless GPS receivers - - Siemens USB/MPI adapter. - - ViVOtech ViVOpay USB device. -diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c -index 9600cee957697..2a91219dee7e6 100644 ---- a/drivers/usb/serial/pl2303.c -+++ b/drivers/usb/serial/pl2303.c -@@ -110,6 +110,7 @@ static const struct usb_device_id id_table[] = { - { USB_DEVICE(ADLINK_VENDOR_ID, ADLINK_ND6530GC_PRODUCT_ID) }, - { USB_DEVICE(SMART_VENDOR_ID, SMART_PRODUCT_ID) }, - { USB_DEVICE(AT_VENDOR_ID, AT_VTKIT3_PRODUCT_ID) }, -+ { USB_DEVICE(IBM_VENDOR_ID, IBM_PRODUCT_ID) }, - { } /* Terminating entry */ - }; - -diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h -index 3e5442573fe4e..15f746e977a71 100644 ---- a/drivers/usb/serial/pl2303.h -+++ b/drivers/usb/serial/pl2303.h -@@ -29,6 +29,9 @@ - #define ATEN_PRODUCT_UC232B 0x2022 - #define ATEN_PRODUCT_ID2 0x2118 - -+#define IBM_VENDOR_ID 0x04b3 -+#define IBM_PRODUCT_ID 0x4016 -+ - #define IODATA_VENDOR_ID 0x04bb - #define IODATA_PRODUCT_ID 0x0a03 - #define IODATA_PRODUCT_ID_RSAQ5 0x0a0e -diff --git a/drivers/usb/serial/usb-serial-simple.c b/drivers/usb/serial/usb-serial-simple.c -index bd23a7cb1be2b..4c6747889a194 100644 ---- a/drivers/usb/serial/usb-serial-simple.c -+++ b/drivers/usb/serial/usb-serial-simple.c -@@ -91,6 +91,11 @@ DEVICE(moto_modem, MOTO_IDS); - { USB_DEVICE(0x0cad, 0x9016) } /* TPG2200 */ - DEVICE(motorola_tetra, MOTOROLA_TETRA_IDS); - -+/* Nokia mobile phone driver */ -+#define NOKIA_IDS() \ -+ { USB_DEVICE(0x0421, 0x069a) } /* Nokia 130 (RM-1035) */ -+DEVICE(nokia, NOKIA_IDS); -+ - /* Novatel Wireless GPS driver */ - #define NOVATEL_IDS() \ - { USB_DEVICE(0x09d7, 0x0100) } /* NovAtel FlexPack GPS */ -@@ -123,6 +128,7 @@ static struct usb_serial_driver * const serial_drivers[] = { - &vivopay_device, - &moto_modem_device, - &motorola_tetra_device, -+ &nokia_device, - &novatel_gps_device, - &hp4x_device, - &suunto_device, -@@ -140,6 +146,7 @@ static const struct usb_device_id id_table[] = { - VIVOPAY_IDS(), - MOTO_IDS(), - MOTOROLA_TETRA_IDS(), -+ NOKIA_IDS(), - NOVATEL_IDS(), - HP4X_IDS(), - SUUNTO_IDS(), -diff --git a/drivers/usb/storage/ene_ub6250.c b/drivers/usb/storage/ene_ub6250.c -index 8b1b730654218..9c984f3c7248a 100644 ---- a/drivers/usb/storage/ene_ub6250.c -+++ b/drivers/usb/storage/ene_ub6250.c -@@ -237,36 +237,33 @@ static struct us_unusual_dev ene_ub6250_unusual_dev_list[] = { - #define memstick_logaddr(logadr1, logadr0) ((((u16)(logadr1)) << 8) | (logadr0)) - - --struct SD_STATUS { -- u8 Insert:1; -- u8 Ready:1; -- u8 MediaChange:1; -- u8 IsMMC:1; -- u8 HiCapacity:1; -- u8 HiSpeed:1; -- u8 WtP:1; -- u8 Reserved:1; --}; -- --struct MS_STATUS { -- u8 Insert:1; -- u8 Ready:1; -- u8 MediaChange:1; -- u8 IsMSPro:1; -- u8 IsMSPHG:1; -- u8 Reserved1:1; -- u8 WtP:1; -- u8 Reserved2:1; --}; -- --struct SM_STATUS { -- u8 Insert:1; -- u8 Ready:1; -- u8 MediaChange:1; -- u8 Reserved:3; -- u8 WtP:1; -- u8 IsMS:1; --}; -+/* SD_STATUS bits */ -+#define SD_Insert BIT(0) -+#define SD_Ready BIT(1) -+#define SD_MediaChange BIT(2) -+#define SD_IsMMC BIT(3) -+#define SD_HiCapacity BIT(4) -+#define SD_HiSpeed BIT(5) -+#define SD_WtP BIT(6) -+ /* Bit 7 reserved */ -+ -+/* MS_STATUS bits */ -+#define MS_Insert BIT(0) -+#define MS_Ready BIT(1) -+#define MS_MediaChange BIT(2) -+#define MS_IsMSPro BIT(3) -+#define MS_IsMSPHG BIT(4) -+ /* Bit 5 reserved */ -+#define MS_WtP BIT(6) -+ /* Bit 7 reserved */ -+ -+/* SM_STATUS bits */ -+#define SM_Insert BIT(0) -+#define SM_Ready BIT(1) -+#define SM_MediaChange BIT(2) -+ /* Bits 3-5 reserved */ -+#define SM_WtP BIT(6) -+#define SM_IsMS BIT(7) - - struct ms_bootblock_cis { - u8 bCistplDEVICE[6]; /* 0 */ -@@ -437,9 +434,9 @@ struct ene_ub6250_info { - u8 *bbuf; - - /* for 6250 code */ -- struct SD_STATUS SD_Status; -- struct MS_STATUS MS_Status; -- struct SM_STATUS SM_Status; -+ u8 SD_Status; -+ u8 MS_Status; -+ u8 SM_Status; - - /* ----- SD Control Data ---------------- */ - /*SD_REGISTER SD_Regs; */ -@@ -602,7 +599,7 @@ static int sd_scsi_test_unit_ready(struct us_data *us, struct scsi_cmnd *srb) - { - struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra; - -- if (info->SD_Status.Insert && info->SD_Status.Ready) -+ if ((info->SD_Status & SD_Insert) && (info->SD_Status & SD_Ready)) - return USB_STOR_TRANSPORT_GOOD; - else { - ene_sd_init(us); -@@ -622,7 +619,7 @@ static int sd_scsi_mode_sense(struct us_data *us, struct scsi_cmnd *srb) - 0x0b, 0x00, 0x80, 0x08, 0x00, 0x00, - 0x71, 0xc0, 0x00, 0x00, 0x02, 0x00 }; - -- if (info->SD_Status.WtP) -+ if (info->SD_Status & SD_WtP) - usb_stor_set_xfer_buf(mediaWP, 12, srb); - else - usb_stor_set_xfer_buf(mediaNoWP, 12, srb); -@@ -641,9 +638,9 @@ static int sd_scsi_read_capacity(struct us_data *us, struct scsi_cmnd *srb) - struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra; - - usb_stor_dbg(us, "sd_scsi_read_capacity\n"); -- if (info->SD_Status.HiCapacity) { -+ if (info->SD_Status & SD_HiCapacity) { - bl_len = 0x200; -- if (info->SD_Status.IsMMC) -+ if (info->SD_Status & SD_IsMMC) - bl_num = info->HC_C_SIZE-1; - else - bl_num = (info->HC_C_SIZE + 1) * 1024 - 1; -@@ -693,7 +690,7 @@ static int sd_scsi_read(struct us_data *us, struct scsi_cmnd *srb) - return USB_STOR_TRANSPORT_ERROR; - } - -- if (info->SD_Status.HiCapacity) -+ if (info->SD_Status & SD_HiCapacity) - bnByte = bn; - - /* set up the command wrapper */ -@@ -733,7 +730,7 @@ static int sd_scsi_write(struct us_data *us, struct scsi_cmnd *srb) - return USB_STOR_TRANSPORT_ERROR; - } - -- if (info->SD_Status.HiCapacity) -+ if (info->SD_Status & SD_HiCapacity) - bnByte = bn; - - /* set up the command wrapper */ -@@ -1455,7 +1452,7 @@ static int ms_scsi_test_unit_ready(struct us_data *us, struct scsi_cmnd *srb) - struct ene_ub6250_info *info = (struct ene_ub6250_info *)(us->extra); - - /* pr_info("MS_SCSI_Test_Unit_Ready\n"); */ -- if (info->MS_Status.Insert && info->MS_Status.Ready) { -+ if ((info->MS_Status & MS_Insert) && (info->MS_Status & MS_Ready)) { - return USB_STOR_TRANSPORT_GOOD; - } else { - ene_ms_init(us); -@@ -1475,7 +1472,7 @@ static int ms_scsi_mode_sense(struct us_data *us, struct scsi_cmnd *srb) - 0x0b, 0x00, 0x80, 0x08, 0x00, 0x00, - 0x71, 0xc0, 0x00, 0x00, 0x02, 0x00 }; - -- if (info->MS_Status.WtP) -+ if (info->MS_Status & MS_WtP) - usb_stor_set_xfer_buf(mediaWP, 12, srb); - else - usb_stor_set_xfer_buf(mediaNoWP, 12, srb); -@@ -1494,7 +1491,7 @@ static int ms_scsi_read_capacity(struct us_data *us, struct scsi_cmnd *srb) - - usb_stor_dbg(us, "ms_scsi_read_capacity\n"); - bl_len = 0x200; -- if (info->MS_Status.IsMSPro) -+ if (info->MS_Status & MS_IsMSPro) - bl_num = info->MSP_TotalBlock - 1; - else - bl_num = info->MS_Lib.NumberOfLogBlock * info->MS_Lib.blockSize * 2 - 1; -@@ -1649,7 +1646,7 @@ static int ms_scsi_read(struct us_data *us, struct scsi_cmnd *srb) - if (bn > info->bl_num) - return USB_STOR_TRANSPORT_ERROR; - -- if (info->MS_Status.IsMSPro) { -+ if (info->MS_Status & MS_IsMSPro) { - result = ene_load_bincode(us, MSP_RW_PATTERN); - if (result != USB_STOR_XFER_GOOD) { - usb_stor_dbg(us, "Load MPS RW pattern Fail !!\n"); -@@ -1750,7 +1747,7 @@ static int ms_scsi_write(struct us_data *us, struct scsi_cmnd *srb) - if (bn > info->bl_num) - return USB_STOR_TRANSPORT_ERROR; - -- if (info->MS_Status.IsMSPro) { -+ if (info->MS_Status & MS_IsMSPro) { - result = ene_load_bincode(us, MSP_RW_PATTERN); - if (result != USB_STOR_XFER_GOOD) { - pr_info("Load MSP RW pattern Fail !!\n"); -@@ -1858,12 +1855,12 @@ static int ene_get_card_status(struct us_data *us, u8 *buf) - - tmpreg = (u16) reg4b; - reg4b = *(u32 *)(&buf[0x14]); -- if (info->SD_Status.HiCapacity && !info->SD_Status.IsMMC) -+ if ((info->SD_Status & SD_HiCapacity) && !(info->SD_Status & SD_IsMMC)) - info->HC_C_SIZE = (reg4b >> 8) & 0x3fffff; - - info->SD_C_SIZE = ((tmpreg & 0x03) << 10) | (u16)(reg4b >> 22); - info->SD_C_SIZE_MULT = (u8)(reg4b >> 7) & 0x07; -- if (info->SD_Status.HiCapacity && info->SD_Status.IsMMC) -+ if ((info->SD_Status & SD_HiCapacity) && (info->SD_Status & SD_IsMMC)) - info->HC_C_SIZE = *(u32 *)(&buf[0x100]); - - if (info->SD_READ_BL_LEN > SD_BLOCK_LEN) { -@@ -2075,6 +2072,7 @@ static int ene_ms_init(struct us_data *us) - u16 MSP_BlockSize, MSP_UserAreaBlocks; - struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra; - u8 *bbuf = info->bbuf; -+ unsigned int s; - - printk(KERN_INFO "transport --- ENE_MSInit\n"); - -@@ -2099,15 +2097,16 @@ static int ene_ms_init(struct us_data *us) - return USB_STOR_TRANSPORT_ERROR; - } - /* the same part to test ENE */ -- info->MS_Status = *(struct MS_STATUS *) bbuf; -- -- if (info->MS_Status.Insert && info->MS_Status.Ready) { -- printk(KERN_INFO "Insert = %x\n", info->MS_Status.Insert); -- printk(KERN_INFO "Ready = %x\n", info->MS_Status.Ready); -- printk(KERN_INFO "IsMSPro = %x\n", info->MS_Status.IsMSPro); -- printk(KERN_INFO "IsMSPHG = %x\n", info->MS_Status.IsMSPHG); -- printk(KERN_INFO "WtP= %x\n", info->MS_Status.WtP); -- if (info->MS_Status.IsMSPro) { -+ info->MS_Status = bbuf[0]; -+ -+ s = info->MS_Status; -+ if ((s & MS_Insert) && (s & MS_Ready)) { -+ printk(KERN_INFO "Insert = %x\n", !!(s & MS_Insert)); -+ printk(KERN_INFO "Ready = %x\n", !!(s & MS_Ready)); -+ printk(KERN_INFO "IsMSPro = %x\n", !!(s & MS_IsMSPro)); -+ printk(KERN_INFO "IsMSPHG = %x\n", !!(s & MS_IsMSPHG)); -+ printk(KERN_INFO "WtP= %x\n", !!(s & MS_WtP)); -+ if (s & MS_IsMSPro) { - MSP_BlockSize = (bbuf[6] << 8) | bbuf[7]; - MSP_UserAreaBlocks = (bbuf[10] << 8) | bbuf[11]; - info->MSP_TotalBlock = MSP_BlockSize * MSP_UserAreaBlocks; -@@ -2168,17 +2167,17 @@ static int ene_sd_init(struct us_data *us) - return USB_STOR_TRANSPORT_ERROR; - } - -- info->SD_Status = *(struct SD_STATUS *) bbuf; -- if (info->SD_Status.Insert && info->SD_Status.Ready) { -- struct SD_STATUS *s = &info->SD_Status; -+ info->SD_Status = bbuf[0]; -+ if ((info->SD_Status & SD_Insert) && (info->SD_Status & SD_Ready)) { -+ unsigned int s = info->SD_Status; - - ene_get_card_status(us, bbuf); -- usb_stor_dbg(us, "Insert = %x\n", s->Insert); -- usb_stor_dbg(us, "Ready = %x\n", s->Ready); -- usb_stor_dbg(us, "IsMMC = %x\n", s->IsMMC); -- usb_stor_dbg(us, "HiCapacity = %x\n", s->HiCapacity); -- usb_stor_dbg(us, "HiSpeed = %x\n", s->HiSpeed); -- usb_stor_dbg(us, "WtP = %x\n", s->WtP); -+ usb_stor_dbg(us, "Insert = %x\n", !!(s & SD_Insert)); -+ usb_stor_dbg(us, "Ready = %x\n", !!(s & SD_Ready)); -+ usb_stor_dbg(us, "IsMMC = %x\n", !!(s & SD_IsMMC)); -+ usb_stor_dbg(us, "HiCapacity = %x\n", !!(s & SD_HiCapacity)); -+ usb_stor_dbg(us, "HiSpeed = %x\n", !!(s & SD_HiSpeed)); -+ usb_stor_dbg(us, "WtP = %x\n", !!(s & SD_WtP)); - } else { - usb_stor_dbg(us, "SD Card Not Ready --- %x\n", bbuf[0]); - return USB_STOR_TRANSPORT_ERROR; -@@ -2200,14 +2199,14 @@ static int ene_init(struct us_data *us) - - misc_reg03 = bbuf[0]; - if (misc_reg03 & 0x01) { -- if (!info->SD_Status.Ready) { -+ if (!(info->SD_Status & SD_Ready)) { - result = ene_sd_init(us); - if (result != USB_STOR_XFER_GOOD) - return USB_STOR_TRANSPORT_ERROR; - } - } - if (misc_reg03 & 0x02) { -- if (!info->MS_Status.Ready) { -+ if (!(info->MS_Status & MS_Ready)) { - result = ene_ms_init(us); - if (result != USB_STOR_XFER_GOOD) - return USB_STOR_TRANSPORT_ERROR; -@@ -2306,14 +2305,14 @@ static int ene_transport(struct scsi_cmnd *srb, struct us_data *us) - - /*US_DEBUG(usb_stor_show_command(us, srb)); */ - scsi_set_resid(srb, 0); -- if (unlikely(!(info->SD_Status.Ready || info->MS_Status.Ready))) -+ if (unlikely(!(info->SD_Status & SD_Ready) || (info->MS_Status & MS_Ready))) - result = ene_init(us); - if (result == USB_STOR_XFER_GOOD) { - result = USB_STOR_TRANSPORT_ERROR; -- if (info->SD_Status.Ready) -+ if (info->SD_Status & SD_Ready) - result = sd_scsi_irp(us, srb); - -- if (info->MS_Status.Ready) -+ if (info->MS_Status & MS_Ready) - result = ms_scsi_irp(us, srb); - } - return result; -@@ -2377,7 +2376,6 @@ static int ene_ub6250_probe(struct usb_interface *intf, - - static int ene_ub6250_resume(struct usb_interface *iface) - { -- u8 tmp = 0; - struct us_data *us = usb_get_intfdata(iface); - struct ene_ub6250_info *info = (struct ene_ub6250_info *)(us->extra); - -@@ -2389,17 +2387,16 @@ static int ene_ub6250_resume(struct usb_interface *iface) - mutex_unlock(&us->dev_mutex); - - info->Power_IsResum = true; -- /*info->SD_Status.Ready = 0; */ -- info->SD_Status = *(struct SD_STATUS *)&tmp; -- info->MS_Status = *(struct MS_STATUS *)&tmp; -- info->SM_Status = *(struct SM_STATUS *)&tmp; -+ /* info->SD_Status &= ~SD_Ready; */ -+ info->SD_Status = 0; -+ info->MS_Status = 0; -+ info->SM_Status = 0; - - return 0; - } - - static int ene_ub6250_reset_resume(struct usb_interface *iface) - { -- u8 tmp = 0; - struct us_data *us = usb_get_intfdata(iface); - struct ene_ub6250_info *info = (struct ene_ub6250_info *)(us->extra); - -@@ -2411,10 +2408,10 @@ static int ene_ub6250_reset_resume(struct usb_interface *iface) - * the device - */ - info->Power_IsResum = true; -- /*info->SD_Status.Ready = 0; */ -- info->SD_Status = *(struct SD_STATUS *)&tmp; -- info->MS_Status = *(struct MS_STATUS *)&tmp; -- info->SM_Status = *(struct SM_STATUS *)&tmp; -+ /* info->SD_Status &= ~SD_Ready; */ -+ info->SD_Status = 0; -+ info->MS_Status = 0; -+ info->SM_Status = 0; - - return 0; - } -diff --git a/drivers/usb/storage/realtek_cr.c b/drivers/usb/storage/realtek_cr.c -index 3789698d9d3c6..0c423916d7bfa 100644 ---- a/drivers/usb/storage/realtek_cr.c -+++ b/drivers/usb/storage/realtek_cr.c -@@ -365,7 +365,7 @@ static int rts51x_read_mem(struct us_data *us, u16 addr, u8 *data, u16 len) - - buf = kmalloc(len, GFP_NOIO); - if (buf == NULL) -- return USB_STOR_TRANSPORT_ERROR; -+ return -ENOMEM; - - usb_stor_dbg(us, "addr = 0x%x, len = %d\n", addr, len); - -diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c -index cec9173aac6f5..1058aba8d5734 100644 ---- a/drivers/vhost/net.c -+++ b/drivers/vhost/net.c -@@ -472,6 +472,7 @@ static void vhost_tx_batch(struct vhost_net *net, - goto signal_used; - - msghdr->msg_control = &ctl; -+ msghdr->msg_controllen = sizeof(ctl); - err = sock->ops->sendmsg(sock, msghdr, 0); - if (unlikely(err < 0)) { - vq_err(&nvq->vq, "Fail to batch sending packets\n"); -diff --git a/drivers/video/fbdev/atafb.c b/drivers/video/fbdev/atafb.c -index 51f5d1c56fd9c..c1ee817d7dcc5 100644 ---- a/drivers/video/fbdev/atafb.c -+++ b/drivers/video/fbdev/atafb.c -@@ -1692,9 +1692,9 @@ static int falcon_setcolreg(unsigned int regno, unsigned int red, - ((blue & 0xfc00) >> 8)); - if (regno < 16) { - shifter_tt.color_reg[regno] = -- (((red & 0xe000) >> 13) | ((red & 0x1000) >> 12) << 8) | -- (((green & 0xe000) >> 13) | ((green & 0x1000) >> 12) << 4) | -- ((blue & 0xe000) >> 13) | ((blue & 0x1000) >> 12); -+ ((((red & 0xe000) >> 13) | ((red & 0x1000) >> 12)) << 8) | -+ ((((green & 0xe000) >> 13) | ((green & 0x1000) >> 12)) << 4) | -+ ((blue & 0xe000) >> 13) | ((blue & 0x1000) >> 12); - ((u32 *)info->pseudo_palette)[regno] = ((red & 0xf800) | - ((green & 0xfc00) >> 5) | - ((blue & 0xf800) >> 11)); -@@ -1980,9 +1980,9 @@ static int stste_setcolreg(unsigned int regno, unsigned int red, - green >>= 12; - if (ATARIHW_PRESENT(EXTD_SHIFTER)) - shifter_tt.color_reg[regno] = -- (((red & 0xe) >> 1) | ((red & 1) << 3) << 8) | -- (((green & 0xe) >> 1) | ((green & 1) << 3) << 4) | -- ((blue & 0xe) >> 1) | ((blue & 1) << 3); -+ ((((red & 0xe) >> 1) | ((red & 1) << 3)) << 8) | -+ ((((green & 0xe) >> 1) | ((green & 1) << 3)) << 4) | -+ ((blue & 0xe) >> 1) | ((blue & 1) << 3); - else - shifter_tt.color_reg[regno] = - ((red & 0xe) << 7) | -diff --git a/drivers/video/fbdev/atmel_lcdfb.c b/drivers/video/fbdev/atmel_lcdfb.c -index cf2bfff2efbf1..b91919861075b 100644 ---- a/drivers/video/fbdev/atmel_lcdfb.c -+++ b/drivers/video/fbdev/atmel_lcdfb.c -@@ -1062,15 +1062,16 @@ static int __init atmel_lcdfb_probe(struct platform_device *pdev) - - INIT_LIST_HEAD(&info->modelist); - -- if (pdev->dev.of_node) { -- ret = atmel_lcdfb_of_init(sinfo); -- if (ret) -- goto free_info; -- } else { -+ if (!pdev->dev.of_node) { - dev_err(dev, "cannot get default configuration\n"); - goto free_info; - } - -+ ret = atmel_lcdfb_of_init(sinfo); -+ if (ret) -+ goto free_info; -+ -+ ret = -ENODEV; - if (!sinfo->config) - goto free_info; - -diff --git a/drivers/video/fbdev/cirrusfb.c b/drivers/video/fbdev/cirrusfb.c -index e4ce5667b1251..1b0a58f96af25 100644 ---- a/drivers/video/fbdev/cirrusfb.c -+++ b/drivers/video/fbdev/cirrusfb.c -@@ -470,7 +470,7 @@ static int cirrusfb_check_mclk(struct fb_info *info, long freq) - return 0; - } - --static int cirrusfb_check_pixclock(const struct fb_var_screeninfo *var, -+static int cirrusfb_check_pixclock(struct fb_var_screeninfo *var, - struct fb_info *info) - { - long freq; -@@ -479,9 +479,7 @@ static int cirrusfb_check_pixclock(const struct fb_var_screeninfo *var, - unsigned maxclockidx = var->bits_per_pixel >> 3; - - /* convert from ps to kHz */ -- freq = PICOS2KHZ(var->pixclock); -- -- dev_dbg(info->device, "desired pixclock: %ld kHz\n", freq); -+ freq = PICOS2KHZ(var->pixclock ? : 1); - - maxclock = cirrusfb_board_info[cinfo->btype].maxclock[maxclockidx]; - cinfo->multiplexing = 0; -@@ -489,11 +487,13 @@ static int cirrusfb_check_pixclock(const struct fb_var_screeninfo *var, - /* If the frequency is greater than we can support, we might be able - * to use multiplexing for the video mode */ - if (freq > maxclock) { -- dev_err(info->device, -- "Frequency greater than maxclock (%ld kHz)\n", -- maxclock); -- return -EINVAL; -+ var->pixclock = KHZ2PICOS(maxclock); -+ -+ while ((freq = PICOS2KHZ(var->pixclock)) > maxclock) -+ var->pixclock++; - } -+ dev_dbg(info->device, "desired pixclock: %ld kHz\n", freq); -+ - /* - * Additional constraint: 8bpp uses DAC clock doubling to allow maximum - * pixel clock -diff --git a/drivers/video/fbdev/core/fbcvt.c b/drivers/video/fbdev/core/fbcvt.c -index 55d2bd0ce5c02..64843464c6613 100644 ---- a/drivers/video/fbdev/core/fbcvt.c -+++ b/drivers/video/fbdev/core/fbcvt.c -@@ -214,9 +214,11 @@ static u32 fb_cvt_aspect_ratio(struct fb_cvt_data *cvt) - static void fb_cvt_print_name(struct fb_cvt_data *cvt) - { - u32 pixcount, pixcount_mod; -- int cnt = 255, offset = 0, read = 0; -- u8 *buf = kzalloc(256, GFP_KERNEL); -+ int size = 256; -+ int off = 0; -+ u8 *buf; - -+ buf = kzalloc(size, GFP_KERNEL); - if (!buf) - return; - -@@ -224,43 +226,30 @@ static void fb_cvt_print_name(struct fb_cvt_data *cvt) - pixcount_mod = (cvt->xres * (cvt->yres/cvt->interlace)) % 1000000; - pixcount_mod /= 1000; - -- read = snprintf(buf+offset, cnt, "fbcvt: %dx%d@%d: CVT Name - ", -- cvt->xres, cvt->yres, cvt->refresh); -- offset += read; -- cnt -= read; -+ off += scnprintf(buf + off, size - off, "fbcvt: %dx%d@%d: CVT Name - ", -+ cvt->xres, cvt->yres, cvt->refresh); - -- if (cvt->status) -- snprintf(buf+offset, cnt, "Not a CVT standard - %d.%03d Mega " -- "Pixel Image\n", pixcount, pixcount_mod); -- else { -- if (pixcount) { -- read = snprintf(buf+offset, cnt, "%d", pixcount); -- cnt -= read; -- offset += read; -- } -+ if (cvt->status) { -+ off += scnprintf(buf + off, size - off, -+ "Not a CVT standard - %d.%03d Mega Pixel Image\n", -+ pixcount, pixcount_mod); -+ } else { -+ if (pixcount) -+ off += scnprintf(buf + off, size - off, "%d", pixcount); - -- read = snprintf(buf+offset, cnt, ".%03dM", pixcount_mod); -- cnt -= read; -- offset += read; -+ off += scnprintf(buf + off, size - off, ".%03dM", pixcount_mod); - - if (cvt->aspect_ratio == 0) -- read = snprintf(buf+offset, cnt, "3"); -+ off += scnprintf(buf + off, size - off, "3"); - else if (cvt->aspect_ratio == 3) -- read = snprintf(buf+offset, cnt, "4"); -+ off += scnprintf(buf + off, size - off, "4"); - else if (cvt->aspect_ratio == 1 || cvt->aspect_ratio == 4) -- read = snprintf(buf+offset, cnt, "9"); -+ off += scnprintf(buf + off, size - off, "9"); - else if (cvt->aspect_ratio == 2) -- read = snprintf(buf+offset, cnt, "A"); -- else -- read = 0; -- cnt -= read; -- offset += read; -- -- if (cvt->flags & FB_CVT_FLAG_REDUCED_BLANK) { -- read = snprintf(buf+offset, cnt, "-R"); -- cnt -= read; -- offset += read; -- } -+ off += scnprintf(buf + off, size - off, "A"); -+ -+ if (cvt->flags & FB_CVT_FLAG_REDUCED_BLANK) -+ off += scnprintf(buf + off, size - off, "-R"); - } - - printk(KERN_INFO "%s\n", buf); -diff --git a/drivers/video/fbdev/nvidia/nv_i2c.c b/drivers/video/fbdev/nvidia/nv_i2c.c -index d7994a1732459..0b48965a6420c 100644 ---- a/drivers/video/fbdev/nvidia/nv_i2c.c -+++ b/drivers/video/fbdev/nvidia/nv_i2c.c -@@ -86,7 +86,7 @@ static int nvidia_setup_i2c_bus(struct nvidia_i2c_chan *chan, const char *name, - { - int rc; - -- strcpy(chan->adapter.name, name); -+ strscpy(chan->adapter.name, name, sizeof(chan->adapter.name)); - chan->adapter.owner = THIS_MODULE; - chan->adapter.class = i2c_class; - chan->adapter.algo_data = &chan->algo; -diff --git a/drivers/video/fbdev/omap2/omapfb/displays/connector-dvi.c b/drivers/video/fbdev/omap2/omapfb/displays/connector-dvi.c -index b4a1aefff7661..777f6d66c28c3 100644 ---- a/drivers/video/fbdev/omap2/omapfb/displays/connector-dvi.c -+++ b/drivers/video/fbdev/omap2/omapfb/displays/connector-dvi.c -@@ -251,6 +251,7 @@ static int dvic_probe_of(struct platform_device *pdev) - adapter_node = of_parse_phandle(node, "ddc-i2c-bus", 0); - if (adapter_node) { - adapter = of_get_i2c_adapter_by_node(adapter_node); -+ of_node_put(adapter_node); - if (adapter == NULL) { - dev_err(&pdev->dev, "failed to parse ddc-i2c-bus\n"); - omap_dss_put_device(ddata->in); -diff --git a/drivers/video/fbdev/omap2/omapfb/displays/panel-dsi-cm.c b/drivers/video/fbdev/omap2/omapfb/displays/panel-dsi-cm.c -index 4b0793abdd84b..a2c7c5cb15234 100644 ---- a/drivers/video/fbdev/omap2/omapfb/displays/panel-dsi-cm.c -+++ b/drivers/video/fbdev/omap2/omapfb/displays/panel-dsi-cm.c -@@ -409,7 +409,7 @@ static ssize_t dsicm_num_errors_show(struct device *dev, - if (r) - return r; - -- return snprintf(buf, PAGE_SIZE, "%d\n", errors); -+ return sysfs_emit(buf, "%d\n", errors); - } - - static ssize_t dsicm_hw_revision_show(struct device *dev, -@@ -439,7 +439,7 @@ static ssize_t dsicm_hw_revision_show(struct device *dev, - if (r) - return r; - -- return snprintf(buf, PAGE_SIZE, "%02x.%02x.%02x\n", id1, id2, id3); -+ return sysfs_emit(buf, "%02x.%02x.%02x\n", id1, id2, id3); - } - - static ssize_t dsicm_store_ulps(struct device *dev, -@@ -487,7 +487,7 @@ static ssize_t dsicm_show_ulps(struct device *dev, - t = ddata->ulps_enabled; - mutex_unlock(&ddata->lock); - -- return snprintf(buf, PAGE_SIZE, "%u\n", t); -+ return sysfs_emit(buf, "%u\n", t); - } - - static ssize_t dsicm_store_ulps_timeout(struct device *dev, -@@ -532,7 +532,7 @@ static ssize_t dsicm_show_ulps_timeout(struct device *dev, - t = ddata->ulps_timeout; - mutex_unlock(&ddata->lock); - -- return snprintf(buf, PAGE_SIZE, "%u\n", t); -+ return sysfs_emit(buf, "%u\n", t); - } - - static DEVICE_ATTR(num_dsi_errors, S_IRUGO, dsicm_num_errors_show, NULL); -diff --git a/drivers/video/fbdev/omap2/omapfb/displays/panel-sony-acx565akm.c b/drivers/video/fbdev/omap2/omapfb/displays/panel-sony-acx565akm.c -index 1293515e4b169..0cbc5b9183f89 100644 ---- a/drivers/video/fbdev/omap2/omapfb/displays/panel-sony-acx565akm.c -+++ b/drivers/video/fbdev/omap2/omapfb/displays/panel-sony-acx565akm.c -@@ -476,7 +476,7 @@ static ssize_t show_cabc_available_modes(struct device *dev, - int i; - - if (!ddata->has_cabc) -- return snprintf(buf, PAGE_SIZE, "%s\n", cabc_modes[0]); -+ return sysfs_emit(buf, "%s\n", cabc_modes[0]); - - for (i = 0, len = 0; - len < PAGE_SIZE && i < ARRAY_SIZE(cabc_modes); i++) -diff --git a/drivers/video/fbdev/omap2/omapfb/displays/panel-tpo-td043mtea1.c b/drivers/video/fbdev/omap2/omapfb/displays/panel-tpo-td043mtea1.c -index bb85b21f07248..9f6ef9e04d9ce 100644 ---- a/drivers/video/fbdev/omap2/omapfb/displays/panel-tpo-td043mtea1.c -+++ b/drivers/video/fbdev/omap2/omapfb/displays/panel-tpo-td043mtea1.c -@@ -169,7 +169,7 @@ static ssize_t tpo_td043_vmirror_show(struct device *dev, - { - struct panel_drv_data *ddata = dev_get_drvdata(dev); - -- return snprintf(buf, PAGE_SIZE, "%d\n", ddata->vmirror); -+ return sysfs_emit(buf, "%d\n", ddata->vmirror); - } - - static ssize_t tpo_td043_vmirror_store(struct device *dev, -@@ -199,7 +199,7 @@ static ssize_t tpo_td043_mode_show(struct device *dev, - { - struct panel_drv_data *ddata = dev_get_drvdata(dev); - -- return snprintf(buf, PAGE_SIZE, "%d\n", ddata->mode); -+ return sysfs_emit(buf, "%d\n", ddata->mode); - } - - static ssize_t tpo_td043_mode_store(struct device *dev, -diff --git a/drivers/video/fbdev/sm712fb.c b/drivers/video/fbdev/sm712fb.c -index 2466814145779..83d05600360dd 100644 ---- a/drivers/video/fbdev/sm712fb.c -+++ b/drivers/video/fbdev/sm712fb.c -@@ -1047,7 +1047,7 @@ static ssize_t smtcfb_read(struct fb_info *info, char __user *buf, - if (count + p > total_size) - count = total_size - p; - -- buffer = kmalloc((count > PAGE_SIZE) ? PAGE_SIZE : count, GFP_KERNEL); -+ buffer = kmalloc(PAGE_SIZE, GFP_KERNEL); - if (!buffer) - return -ENOMEM; - -@@ -1059,25 +1059,14 @@ static ssize_t smtcfb_read(struct fb_info *info, char __user *buf, - while (count) { - c = (count > PAGE_SIZE) ? PAGE_SIZE : count; - dst = buffer; -- for (i = c >> 2; i--;) { -- *dst = fb_readl(src++); -- *dst = big_swap(*dst); -+ for (i = (c + 3) >> 2; i--;) { -+ u32 val; -+ -+ val = fb_readl(src); -+ *dst = big_swap(val); -+ src++; - dst++; - } -- if (c & 3) { -- u8 *dst8 = (u8 *)dst; -- u8 __iomem *src8 = (u8 __iomem *)src; -- -- for (i = c & 3; i--;) { -- if (i & 1) { -- *dst8++ = fb_readb(++src8); -- } else { -- *dst8++ = fb_readb(--src8); -- src8 += 2; -- } -- } -- src = (u32 __iomem *)src8; -- } - - if (copy_to_user(buf, buffer, c)) { - err = -EFAULT; -@@ -1130,7 +1119,7 @@ static ssize_t smtcfb_write(struct fb_info *info, const char __user *buf, - count = total_size - p; - } - -- buffer = kmalloc((count > PAGE_SIZE) ? PAGE_SIZE : count, GFP_KERNEL); -+ buffer = kmalloc(PAGE_SIZE, GFP_KERNEL); - if (!buffer) - return -ENOMEM; - -@@ -1148,24 +1137,11 @@ static ssize_t smtcfb_write(struct fb_info *info, const char __user *buf, - break; - } - -- for (i = c >> 2; i--;) { -- fb_writel(big_swap(*src), dst++); -+ for (i = (c + 3) >> 2; i--;) { -+ fb_writel(big_swap(*src), dst); -+ dst++; - src++; - } -- if (c & 3) { -- u8 *src8 = (u8 *)src; -- u8 __iomem *dst8 = (u8 __iomem *)dst; -- -- for (i = c & 3; i--;) { -- if (i & 1) { -- fb_writeb(*src8++, ++dst8); -- } else { -- fb_writeb(*src8++, --dst8); -- dst8 += 2; -- } -- } -- dst = (u32 __iomem *)dst8; -- } - - *ppos += c; - buf += c; -diff --git a/drivers/video/fbdev/smscufx.c b/drivers/video/fbdev/smscufx.c -index 0e0f5bbfc5efc..ad60f739c6a19 100644 ---- a/drivers/video/fbdev/smscufx.c -+++ b/drivers/video/fbdev/smscufx.c -@@ -1657,6 +1657,7 @@ static int ufx_usb_probe(struct usb_interface *interface, - info->par = dev; - info->pseudo_palette = dev->pseudo_palette; - info->fbops = &ufx_ops; -+ INIT_LIST_HEAD(&info->modelist); - - retval = fb_alloc_cmap(&info->cmap, 256, 0); - if (retval < 0) { -@@ -1667,8 +1668,6 @@ static int ufx_usb_probe(struct usb_interface *interface, - INIT_DELAYED_WORK(&dev->free_framebuffer_work, - ufx_free_framebuffer_work); - -- INIT_LIST_HEAD(&info->modelist); -- - retval = ufx_reg_read(dev, 0x3000, &id_rev); - check_warn_goto_error(retval, "error %d reading 0x3000 register from device", retval); - dev_dbg(dev->gdev, "ID_REV register value 0x%08x", id_rev); -diff --git a/drivers/video/fbdev/udlfb.c b/drivers/video/fbdev/udlfb.c -index ecbfbbf1c1a79..e269b1391e146 100644 ---- a/drivers/video/fbdev/udlfb.c -+++ b/drivers/video/fbdev/udlfb.c -@@ -1427,7 +1427,7 @@ static ssize_t metrics_bytes_rendered_show(struct device *fbdev, - struct device_attribute *a, char *buf) { - struct fb_info *fb_info = dev_get_drvdata(fbdev); - struct dlfb_data *dlfb = fb_info->par; -- return snprintf(buf, PAGE_SIZE, "%u\n", -+ return sysfs_emit(buf, "%u\n", - atomic_read(&dlfb->bytes_rendered)); - } - -@@ -1435,7 +1435,7 @@ static ssize_t metrics_bytes_identical_show(struct device *fbdev, - struct device_attribute *a, char *buf) { - struct fb_info *fb_info = dev_get_drvdata(fbdev); - struct dlfb_data *dlfb = fb_info->par; -- return snprintf(buf, PAGE_SIZE, "%u\n", -+ return sysfs_emit(buf, "%u\n", - atomic_read(&dlfb->bytes_identical)); - } - -@@ -1443,7 +1443,7 @@ static ssize_t metrics_bytes_sent_show(struct device *fbdev, - struct device_attribute *a, char *buf) { - struct fb_info *fb_info = dev_get_drvdata(fbdev); - struct dlfb_data *dlfb = fb_info->par; -- return snprintf(buf, PAGE_SIZE, "%u\n", -+ return sysfs_emit(buf, "%u\n", - atomic_read(&dlfb->bytes_sent)); - } - -@@ -1451,7 +1451,7 @@ static ssize_t metrics_cpu_kcycles_used_show(struct device *fbdev, - struct device_attribute *a, char *buf) { - struct fb_info *fb_info = dev_get_drvdata(fbdev); - struct dlfb_data *dlfb = fb_info->par; -- return snprintf(buf, PAGE_SIZE, "%u\n", -+ return sysfs_emit(buf, "%u\n", - atomic_read(&dlfb->cpu_kcycles_used)); - } - -diff --git a/drivers/video/fbdev/w100fb.c b/drivers/video/fbdev/w100fb.c -index e30f9427b3355..52ec80bbfe5ea 100644 ---- a/drivers/video/fbdev/w100fb.c -+++ b/drivers/video/fbdev/w100fb.c -@@ -770,12 +770,18 @@ out: - fb_dealloc_cmap(&info->cmap); - kfree(info->pseudo_palette); - } -- if (remapped_fbuf != NULL) -+ if (remapped_fbuf != NULL) { - iounmap(remapped_fbuf); -- if (remapped_regs != NULL) -+ remapped_fbuf = NULL; -+ } -+ if (remapped_regs != NULL) { - iounmap(remapped_regs); -- if (remapped_base != NULL) -+ remapped_regs = NULL; -+ } -+ if (remapped_base != NULL) { - iounmap(remapped_base); -+ remapped_base = NULL; -+ } - if (info) - framebuffer_release(info); - return err; -@@ -795,8 +801,11 @@ static int w100fb_remove(struct platform_device *pdev) - fb_dealloc_cmap(&info->cmap); - - iounmap(remapped_base); -+ remapped_base = NULL; - iounmap(remapped_regs); -+ remapped_regs = NULL; - iounmap(remapped_fbuf); -+ remapped_fbuf = NULL; - - framebuffer_release(info); - -diff --git a/drivers/w1/slaves/w1_therm.c b/drivers/w1/slaves/w1_therm.c -index e028e00927991..cf1e01f0dede3 100644 ---- a/drivers/w1/slaves/w1_therm.c -+++ b/drivers/w1/slaves/w1_therm.c -@@ -679,16 +679,20 @@ static ssize_t w1_seq_show(struct device *device, - if (sl->reg_num.id == reg_num->id) - seq = i; - -+ if (w1_reset_bus(sl->master)) -+ goto error; -+ -+ /* Put the device into chain DONE state */ -+ w1_write_8(sl->master, W1_MATCH_ROM); -+ w1_write_block(sl->master, (u8 *)&rn, 8); - w1_write_8(sl->master, W1_42_CHAIN); - w1_write_8(sl->master, W1_42_CHAIN_DONE); - w1_write_8(sl->master, W1_42_CHAIN_DONE_INV); -- w1_read_block(sl->master, &ack, sizeof(ack)); - - /* check for acknowledgment */ - ack = w1_read_8(sl->master); - if (ack != W1_42_SUCCESS_CONFIRM_BYTE) - goto error; -- - } - - /* Exit from CHAIN state */ -diff --git a/fs/btrfs/extent_io.h b/fs/btrfs/extent_io.h -index fcf1807cc8dd7..c8def2bdf2474 100644 ---- a/fs/btrfs/extent_io.h -+++ b/fs/btrfs/extent_io.h -@@ -202,7 +202,7 @@ struct extent_buffer { - */ - struct extent_changeset { - /* How many bytes are set/cleared in this operation */ -- unsigned int bytes_changed; -+ u64 bytes_changed; - - /* Changed ranges */ - struct ulist range_changed; -diff --git a/fs/ext2/super.c b/fs/ext2/super.c -index 065cd2d1bdc68..db403c01d4d5c 100644 ---- a/fs/ext2/super.c -+++ b/fs/ext2/super.c -@@ -770,8 +770,12 @@ static loff_t ext2_max_size(int bits) - res += 1LL << (bits-2); - res += 1LL << (2*(bits-2)); - res += 1LL << (3*(bits-2)); -+ /* Compute how many metadata blocks are needed */ -+ meta_blocks = 1; -+ meta_blocks += 1 + ppb; -+ meta_blocks += 1 + ppb + ppb * ppb; - /* Does block tree limit file size? */ -- if (res < upper_limit) -+ if (res + meta_blocks <= upper_limit) - goto check_lfs; - - res = upper_limit; -diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c -index dcbd8ac8d4711..0d62f05f89256 100644 ---- a/fs/ext4/inode.c -+++ b/fs/ext4/inode.c -@@ -2161,6 +2161,15 @@ static int ext4_writepage(struct page *page, - else - len = PAGE_SIZE; - -+ /* Should never happen but for bugs in other kernel subsystems */ -+ if (!page_has_buffers(page)) { -+ ext4_warning_inode(inode, -+ "page %lu does not have buffers attached", page->index); -+ ClearPageDirty(page); -+ unlock_page(page); -+ return 0; -+ } -+ - page_bufs = page_buffers(page); - /* - * We cannot do block allocation or other extent handling in this -@@ -2710,6 +2719,22 @@ static int mpage_prepare_extent_to_map(struct mpage_da_data *mpd) - wait_on_page_writeback(page); - BUG_ON(PageWriteback(page)); - -+ /* -+ * Should never happen but for buggy code in -+ * other subsystems that call -+ * set_page_dirty() without properly warning -+ * the file system first. See [1] for more -+ * information. -+ * -+ * [1] https://lore.kernel.org/linux-mm/20180103100430.GE4911@quack2.suse.cz -+ */ -+ if (!page_has_buffers(page)) { -+ ext4_warning_inode(mpd->inode, "page %lu does not have buffers attached", page->index); -+ ClearPageDirty(page); -+ unlock_page(page); -+ continue; -+ } -+ - if (mpd->map.m_len == 0) - mpd->first_page = page->index; - mpd->next_page = page->index + 1; -diff --git a/fs/f2fs/checkpoint.c b/fs/f2fs/checkpoint.c -index 03dce3980d90a..54f0d2c4c7d87 100644 ---- a/fs/f2fs/checkpoint.c -+++ b/fs/f2fs/checkpoint.c -@@ -848,6 +848,7 @@ static struct page *validate_checkpoint(struct f2fs_sb_info *sbi, - struct page *cp_page_1 = NULL, *cp_page_2 = NULL; - struct f2fs_checkpoint *cp_block = NULL; - unsigned long long cur_version = 0, pre_version = 0; -+ unsigned int cp_blocks; - int err; - - err = get_checkpoint_version(sbi, cp_addr, &cp_block, -@@ -855,15 +856,16 @@ static struct page *validate_checkpoint(struct f2fs_sb_info *sbi, - if (err) - return NULL; - -- if (le32_to_cpu(cp_block->cp_pack_total_block_count) > -- sbi->blocks_per_seg) { -+ cp_blocks = le32_to_cpu(cp_block->cp_pack_total_block_count); -+ -+ if (cp_blocks > sbi->blocks_per_seg || cp_blocks <= F2FS_CP_PACKS) { - f2fs_warn(sbi, "invalid cp_pack_total_block_count:%u", - le32_to_cpu(cp_block->cp_pack_total_block_count)); - goto invalid_cp; - } - pre_version = *version; - -- cp_addr += le32_to_cpu(cp_block->cp_pack_total_block_count) - 1; -+ cp_addr += cp_blocks - 1; - err = get_checkpoint_version(sbi, cp_addr, &cp_block, - &cp_page_2, version); - if (err) -diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c -index 1679f9c0b63b3..773028921c481 100644 ---- a/fs/f2fs/data.c -+++ b/fs/f2fs/data.c -@@ -2467,8 +2467,12 @@ static int __f2fs_write_data_pages(struct address_space *mapping, - /* to avoid spliting IOs due to mixed WB_SYNC_ALL and WB_SYNC_NONE */ - if (wbc->sync_mode == WB_SYNC_ALL) - atomic_inc(&sbi->wb_sync_req[DATA]); -- else if (atomic_read(&sbi->wb_sync_req[DATA])) -+ else if (atomic_read(&sbi->wb_sync_req[DATA])) { -+ /* to avoid potential deadlock */ -+ if (current->plug) -+ blk_finish_plug(current->plug); - goto skip_write; -+ } - - if (__should_serialize_io(inode, wbc)) { - mutex_lock(&sbi->writepages); -diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c -index 16abb017e497f..68d5c73c5ed1f 100644 ---- a/fs/f2fs/gc.c -+++ b/fs/f2fs/gc.c -@@ -633,8 +633,10 @@ static bool is_alive(struct f2fs_sb_info *sbi, struct f2fs_summary *sum, - set_sbi_flag(sbi, SBI_NEED_FSCK); - } - -- if (f2fs_check_nid_range(sbi, dni->ino)) -+ if (f2fs_check_nid_range(sbi, dni->ino)) { -+ f2fs_put_page(node_page, 1); - return false; -+ } - - *nofs = ofs_of_node(node_page); - source_blkaddr = datablock_addr(NULL, node_page, ofs_in_node); -diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c -index 2383d52b1f424..264c19e177797 100644 ---- a/fs/f2fs/inode.c -+++ b/fs/f2fs/inode.c -@@ -777,6 +777,7 @@ void f2fs_handle_failed_inode(struct inode *inode) - err = f2fs_get_node_info(sbi, inode->i_ino, &ni); - if (err) { - set_sbi_flag(sbi, SBI_NEED_FSCK); -+ set_inode_flag(inode, FI_FREE_NID); - f2fs_warn(sbi, "May loss orphan inode, run fsck to fix."); - goto out; - } -diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c -index 0cd1d51dde06d..3dc7cc3d6ac69 100644 ---- a/fs/f2fs/node.c -+++ b/fs/f2fs/node.c -@@ -1995,8 +1995,12 @@ static int f2fs_write_node_pages(struct address_space *mapping, - - if (wbc->sync_mode == WB_SYNC_ALL) - atomic_inc(&sbi->wb_sync_req[NODE]); -- else if (atomic_read(&sbi->wb_sync_req[NODE])) -+ else if (atomic_read(&sbi->wb_sync_req[NODE])) { -+ /* to avoid potential deadlock */ -+ if (current->plug) -+ blk_finish_plug(current->plug); - goto skip_write; -+ } - - trace_f2fs_writepages(mapping->host, wbc, NODE); - -diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c -index a6c9c9fdf21d1..6bd8a944902ef 100644 ---- a/fs/f2fs/super.c -+++ b/fs/f2fs/super.c -@@ -2066,7 +2066,7 @@ int f2fs_quota_sync(struct super_block *sb, int type) - struct f2fs_sb_info *sbi = F2FS_SB(sb); - struct quota_info *dqopt = sb_dqopt(sb); - int cnt; -- int ret; -+ int ret = 0; - - /* - * Now when everything is written we can discard the pagecache so -@@ -2077,8 +2077,8 @@ int f2fs_quota_sync(struct super_block *sb, int type) - if (type != -1 && cnt != type) - continue; - -- if (!sb_has_quota_active(sb, type)) -- return 0; -+ if (!sb_has_quota_active(sb, cnt)) -+ continue; - - inode_lock(dqopt->files[cnt]); - -diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c -index c056ed5c6df30..d7ec0ac87fc03 100644 ---- a/fs/gfs2/rgrp.c -+++ b/fs/gfs2/rgrp.c -@@ -1429,7 +1429,8 @@ int gfs2_fitrim(struct file *filp, void __user *argp) - - start = r.start >> bs_shift; - end = start + (r.len >> bs_shift); -- minlen = max_t(u64, r.minlen, -+ minlen = max_t(u64, r.minlen, sdp->sd_sb.sb_bsize); -+ minlen = max_t(u64, minlen, - q->limits.discard_granularity) >> bs_shift; - - if (end <= start || minlen > sdp->sd_max_rg_data) -diff --git a/fs/io_uring.c b/fs/io_uring.c -index 478df7e10767a..e73969fa96bcb 100644 ---- a/fs/io_uring.c -+++ b/fs/io_uring.c -@@ -438,6 +438,22 @@ static struct io_ring_ctx *io_ring_ctx_alloc(struct io_uring_params *p) - return ctx; - } - -+static void io_req_put_fs(struct io_kiocb *req) -+{ -+ struct fs_struct *fs = req->fs; -+ -+ if (!fs) -+ return; -+ -+ spin_lock(&req->fs->lock); -+ if (--fs->users) -+ fs = NULL; -+ spin_unlock(&req->fs->lock); -+ if (fs) -+ free_fs_struct(fs); -+ req->fs = NULL; -+} -+ - static inline bool __io_sequence_defer(struct io_ring_ctx *ctx, - struct io_kiocb *req) - { -@@ -695,6 +711,7 @@ static void io_free_req_many(struct io_ring_ctx *ctx, void **reqs, int *nr) - - static void __io_free_req(struct io_kiocb *req) - { -+ io_req_put_fs(req); - if (req->file && !(req->flags & REQ_F_FIXED_FILE)) - fput(req->file); - percpu_ref_put(&req->ctx->refs); -@@ -1701,16 +1718,7 @@ static int io_send_recvmsg(struct io_kiocb *req, const struct io_uring_sqe *sqe, - ret = -EINTR; - } - -- if (req->fs) { -- struct fs_struct *fs = req->fs; -- -- spin_lock(&req->fs->lock); -- if (--fs->users) -- fs = NULL; -- spin_unlock(&req->fs->lock); -- if (fs) -- free_fs_struct(fs); -- } -+ io_req_put_fs(req); - io_cqring_add_event(req->ctx, sqe->user_data, ret); - io_put_req(req); - return 0; -diff --git a/fs/jffs2/build.c b/fs/jffs2/build.c -index b288c8ae1236b..837cd55fd4c5e 100644 ---- a/fs/jffs2/build.c -+++ b/fs/jffs2/build.c -@@ -415,13 +415,15 @@ int jffs2_do_mount_fs(struct jffs2_sb_info *c) - jffs2_free_ino_caches(c); - jffs2_free_raw_node_refs(c); - ret = -EIO; -- goto out_free; -+ goto out_sum_exit; - } - - jffs2_calc_trigger_levels(c); - - return 0; - -+ out_sum_exit: -+ jffs2_sum_exit(c); - out_free: - kvfree(c->blocks); - -diff --git a/fs/jffs2/fs.c b/fs/jffs2/fs.c -index ab8cdd9e93259..ad1eba809e7e1 100644 ---- a/fs/jffs2/fs.c -+++ b/fs/jffs2/fs.c -@@ -602,8 +602,8 @@ out_root: - jffs2_free_ino_caches(c); - jffs2_free_raw_node_refs(c); - kvfree(c->blocks); -- out_inohash: - jffs2_clear_xattr_subsystem(c); -+ out_inohash: - kfree(c->inocache_list); - out_wbuf: - jffs2_flash_cleanup(c); -diff --git a/fs/jffs2/scan.c b/fs/jffs2/scan.c -index 0b1a7f68b7122..f73904c08b39c 100644 ---- a/fs/jffs2/scan.c -+++ b/fs/jffs2/scan.c -@@ -136,7 +136,7 @@ int jffs2_scan_medium(struct jffs2_sb_info *c) - if (!s) { - JFFS2_WARNING("Can't allocate memory for summary\n"); - ret = -ENOMEM; -- goto out; -+ goto out_buf; - } - } - -@@ -274,13 +274,15 @@ int jffs2_scan_medium(struct jffs2_sb_info *c) - } - ret = 0; - out: -+ jffs2_sum_reset_collected(s); -+ kfree(s); -+ out_buf: - if (buf_size) - kfree(flashbuf); - #ifndef __ECOS - else - mtd_unpoint(c->mtd, 0, c->mtd->size); - #endif -- kfree(s); - return ret; - } - -diff --git a/fs/jfs/inode.c b/fs/jfs/inode.c -index d862cfc3d3a83..62c4a5450cda2 100644 ---- a/fs/jfs/inode.c -+++ b/fs/jfs/inode.c -@@ -146,12 +146,13 @@ void jfs_evict_inode(struct inode *inode) - dquot_initialize(inode); - - if (JFS_IP(inode)->fileset == FILESYSTEM_I) { -+ struct inode *ipimap = JFS_SBI(inode->i_sb)->ipimap; - truncate_inode_pages_final(&inode->i_data); - - if (test_cflag(COMMIT_Freewmap, inode)) - jfs_free_zero_link(inode); - -- if (JFS_SBI(inode->i_sb)->ipimap) -+ if (ipimap && JFS_IP(ipimap)->i_imap) - diFree(inode); - - /* -diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c -index 6fe82ce8663ef..79f3440e204b6 100644 ---- a/fs/jfs/jfs_dmap.c -+++ b/fs/jfs/jfs_dmap.c -@@ -148,6 +148,7 @@ static const s8 budtab[256] = { - * 0 - success - * -ENOMEM - insufficient memory - * -EIO - i/o error -+ * -EINVAL - wrong bmap data - */ - int dbMount(struct inode *ipbmap) - { -@@ -179,6 +180,12 @@ int dbMount(struct inode *ipbmap) - bmp->db_nfree = le64_to_cpu(dbmp_le->dn_nfree); - bmp->db_l2nbperpage = le32_to_cpu(dbmp_le->dn_l2nbperpage); - bmp->db_numag = le32_to_cpu(dbmp_le->dn_numag); -+ if (!bmp->db_numag) { -+ release_metapage(mp); -+ kfree(bmp); -+ return -EINVAL; -+ } -+ - bmp->db_maxlevel = le32_to_cpu(dbmp_le->dn_maxlevel); - bmp->db_maxag = le32_to_cpu(dbmp_le->dn_maxag); - bmp->db_agpref = le32_to_cpu(dbmp_le->dn_agpref); -diff --git a/fs/minix/inode.c b/fs/minix/inode.c -index 7b09a9158e401..3fffc709afd43 100644 ---- a/fs/minix/inode.c -+++ b/fs/minix/inode.c -@@ -447,7 +447,8 @@ static const struct address_space_operations minix_aops = { - .writepage = minix_writepage, - .write_begin = minix_write_begin, - .write_end = generic_write_end, -- .bmap = minix_bmap -+ .bmap = minix_bmap, -+ .direct_IO = noop_direct_IO - }; - - static const struct inode_operations minix_symlink_inode_operations = { -diff --git a/fs/nfs/callback_proc.c b/fs/nfs/callback_proc.c -index b8a7b223b5b18..31922657e836e 100644 ---- a/fs/nfs/callback_proc.c -+++ b/fs/nfs/callback_proc.c -@@ -364,12 +364,11 @@ __be32 nfs4_callback_devicenotify(void *argp, void *resp, - struct cb_process_state *cps) - { - struct cb_devicenotifyargs *args = argp; -+ const struct pnfs_layoutdriver_type *ld = NULL; - uint32_t i; - __be32 res = 0; -- struct nfs_client *clp = cps->clp; -- struct nfs_server *server = NULL; - -- if (!clp) { -+ if (!cps->clp) { - res = cpu_to_be32(NFS4ERR_OP_NOT_IN_SESSION); - goto out; - } -@@ -377,23 +376,15 @@ __be32 nfs4_callback_devicenotify(void *argp, void *resp, - for (i = 0; i < args->ndevs; i++) { - struct cb_devicenotifyitem *dev = &args->devs[i]; - -- if (!server || -- server->pnfs_curr_ld->id != dev->cbd_layout_type) { -- rcu_read_lock(); -- list_for_each_entry_rcu(server, &clp->cl_superblocks, client_link) -- if (server->pnfs_curr_ld && -- server->pnfs_curr_ld->id == dev->cbd_layout_type) { -- rcu_read_unlock(); -- goto found; -- } -- rcu_read_unlock(); -- continue; -+ if (!ld || ld->id != dev->cbd_layout_type) { -+ pnfs_put_layoutdriver(ld); -+ ld = pnfs_find_layoutdriver(dev->cbd_layout_type); -+ if (!ld) -+ continue; - } -- -- found: -- nfs4_delete_deviceid(server->pnfs_curr_ld, clp, &dev->cbd_dev_id); -+ nfs4_delete_deviceid(ld, cps->clp, &dev->cbd_dev_id); - } -- -+ pnfs_put_layoutdriver(ld); - out: - kfree(args->devs); - return res; -diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c -index 90b5511c4c440..04d27f0ed39ac 100644 ---- a/fs/nfs/callback_xdr.c -+++ b/fs/nfs/callback_xdr.c -@@ -271,10 +271,6 @@ __be32 decode_devicenotify_args(struct svc_rqst *rqstp, - n = ntohl(*p++); - if (n == 0) - goto out; -- if (n > ULONG_MAX / sizeof(*args->devs)) { -- status = htonl(NFS4ERR_BADXDR); -- goto out; -- } - - args->devs = kmalloc_array(n, sizeof(*args->devs), GFP_KERNEL); - if (!args->devs) { -diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c -index 6b0bf4ebd8124..0682037f972be 100644 ---- a/fs/nfs/direct.c -+++ b/fs/nfs/direct.c -@@ -272,8 +272,8 @@ ssize_t nfs_direct_IO(struct kiocb *iocb, struct iov_iter *iter) - VM_BUG_ON(iov_iter_count(iter) != PAGE_SIZE); - - if (iov_iter_rw(iter) == READ) -- return nfs_file_direct_read(iocb, iter); -- return nfs_file_direct_write(iocb, iter); -+ return nfs_file_direct_read(iocb, iter, true); -+ return nfs_file_direct_write(iocb, iter, true); - } - - static void nfs_direct_release_pages(struct page **pages, unsigned int npages) -@@ -524,6 +524,7 @@ static ssize_t nfs_direct_read_schedule_iovec(struct nfs_direct_req *dreq, - * nfs_file_direct_read - file direct read operation for NFS files - * @iocb: target I/O control block - * @iter: vector of user buffers into which to read data -+ * @swap: flag indicating this is swap IO, not O_DIRECT IO - * - * We use this function for direct reads instead of calling - * generic_file_aio_read() in order to avoid gfar's check to see if -@@ -539,7 +540,8 @@ static ssize_t nfs_direct_read_schedule_iovec(struct nfs_direct_req *dreq, - * client must read the updated atime from the server back into its - * cache. - */ --ssize_t nfs_file_direct_read(struct kiocb *iocb, struct iov_iter *iter) -+ssize_t nfs_file_direct_read(struct kiocb *iocb, struct iov_iter *iter, -+ bool swap) - { - struct file *file = iocb->ki_filp; - struct address_space *mapping = file->f_mapping; -@@ -581,12 +583,14 @@ ssize_t nfs_file_direct_read(struct kiocb *iocb, struct iov_iter *iter) - if (iter_is_iovec(iter)) - dreq->flags = NFS_ODIRECT_SHOULD_DIRTY; - -- nfs_start_io_direct(inode); -+ if (!swap) -+ nfs_start_io_direct(inode); - - NFS_I(inode)->read_io += count; - requested = nfs_direct_read_schedule_iovec(dreq, iter, iocb->ki_pos); - -- nfs_end_io_direct(inode); -+ if (!swap) -+ nfs_end_io_direct(inode); - - if (requested > 0) { - result = nfs_direct_wait(dreq); -@@ -851,7 +855,7 @@ static const struct nfs_pgio_completion_ops nfs_direct_write_completion_ops = { - */ - static ssize_t nfs_direct_write_schedule_iovec(struct nfs_direct_req *dreq, - struct iov_iter *iter, -- loff_t pos) -+ loff_t pos, int ioflags) - { - struct nfs_pageio_descriptor desc; - struct inode *inode = dreq->inode; -@@ -859,7 +863,7 @@ static ssize_t nfs_direct_write_schedule_iovec(struct nfs_direct_req *dreq, - size_t requested_bytes = 0; - size_t wsize = max_t(size_t, NFS_SERVER(inode)->wsize, PAGE_SIZE); - -- nfs_pageio_init_write(&desc, inode, FLUSH_COND_STABLE, false, -+ nfs_pageio_init_write(&desc, inode, ioflags, false, - &nfs_direct_write_completion_ops); - desc.pg_dreq = dreq; - get_dreq(dreq); -@@ -937,6 +941,7 @@ static ssize_t nfs_direct_write_schedule_iovec(struct nfs_direct_req *dreq, - * nfs_file_direct_write - file direct write operation for NFS files - * @iocb: target I/O control block - * @iter: vector of user buffers from which to write data -+ * @swap: flag indicating this is swap IO, not O_DIRECT IO - * - * We use this function for direct writes instead of calling - * generic_file_aio_write() in order to avoid taking the inode -@@ -953,7 +958,8 @@ static ssize_t nfs_direct_write_schedule_iovec(struct nfs_direct_req *dreq, - * Note that O_APPEND is not supported for NFS direct writes, as there - * is no atomic O_APPEND write facility in the NFS protocol. - */ --ssize_t nfs_file_direct_write(struct kiocb *iocb, struct iov_iter *iter) -+ssize_t nfs_file_direct_write(struct kiocb *iocb, struct iov_iter *iter, -+ bool swap) - { - ssize_t result = -EINVAL, requested; - size_t count; -@@ -967,7 +973,11 @@ ssize_t nfs_file_direct_write(struct kiocb *iocb, struct iov_iter *iter) - dfprintk(FILE, "NFS: direct write(%pD2, %zd@%Ld)\n", - file, iov_iter_count(iter), (long long) iocb->ki_pos); - -- result = generic_write_checks(iocb, iter); -+ if (swap) -+ /* bypass generic checks */ -+ result = iov_iter_count(iter); -+ else -+ result = generic_write_checks(iocb, iter); - if (result <= 0) - return result; - count = result; -@@ -997,16 +1007,22 @@ ssize_t nfs_file_direct_write(struct kiocb *iocb, struct iov_iter *iter) - if (!is_sync_kiocb(iocb)) - dreq->iocb = iocb; - -- nfs_start_io_direct(inode); -+ if (swap) { -+ requested = nfs_direct_write_schedule_iovec(dreq, iter, pos, -+ FLUSH_STABLE); -+ } else { -+ nfs_start_io_direct(inode); - -- requested = nfs_direct_write_schedule_iovec(dreq, iter, pos); -+ requested = nfs_direct_write_schedule_iovec(dreq, iter, pos, -+ FLUSH_COND_STABLE); - -- if (mapping->nrpages) { -- invalidate_inode_pages2_range(mapping, -- pos >> PAGE_SHIFT, end); -- } -+ if (mapping->nrpages) { -+ invalidate_inode_pages2_range(mapping, -+ pos >> PAGE_SHIFT, end); -+ } - -- nfs_end_io_direct(inode); -+ nfs_end_io_direct(inode); -+ } - - if (requested > 0) { - result = nfs_direct_wait(dreq); -diff --git a/fs/nfs/file.c b/fs/nfs/file.c -index 387a2cfa7e172..73415970af381 100644 ---- a/fs/nfs/file.c -+++ b/fs/nfs/file.c -@@ -161,7 +161,7 @@ nfs_file_read(struct kiocb *iocb, struct iov_iter *to) - ssize_t result; - - if (iocb->ki_flags & IOCB_DIRECT) -- return nfs_file_direct_read(iocb, to); -+ return nfs_file_direct_read(iocb, to, false); - - dprintk("NFS: read(%pD2, %zu@%lu)\n", - iocb->ki_filp, -@@ -609,7 +609,7 @@ ssize_t nfs_file_write(struct kiocb *iocb, struct iov_iter *from) - return result; - - if (iocb->ki_flags & IOCB_DIRECT) -- return nfs_file_direct_write(iocb, from); -+ return nfs_file_direct_write(iocb, from, false); - - dprintk("NFS: write(%pD2, %zu@%Ld)\n", - file, iov_iter_count(from), (long long) iocb->ki_pos); -diff --git a/fs/nfs/nfs2xdr.c b/fs/nfs/nfs2xdr.c -index 887f9136a9db3..af557dc2cfe1d 100644 ---- a/fs/nfs/nfs2xdr.c -+++ b/fs/nfs/nfs2xdr.c -@@ -953,7 +953,7 @@ int nfs2_decode_dirent(struct xdr_stream *xdr, struct nfs_entry *entry, - - error = decode_filename_inline(xdr, &entry->name, &entry->len); - if (unlikely(error)) -- return error; -+ return -EAGAIN; - - /* - * The type (size and byte order) of nfscookie isn't defined in -diff --git a/fs/nfs/nfs3xdr.c b/fs/nfs/nfs3xdr.c -index 23d75cddbb2ee..84369d51353a5 100644 ---- a/fs/nfs/nfs3xdr.c -+++ b/fs/nfs/nfs3xdr.c -@@ -1968,7 +1968,6 @@ int nfs3_decode_dirent(struct xdr_stream *xdr, struct nfs_entry *entry, - bool plus) - { - struct user_namespace *userns = rpc_userns(entry->server->client); -- struct nfs_entry old = *entry; - __be32 *p; - int error; - u64 new_cookie; -@@ -1988,15 +1987,15 @@ int nfs3_decode_dirent(struct xdr_stream *xdr, struct nfs_entry *entry, - - error = decode_fileid3(xdr, &entry->ino); - if (unlikely(error)) -- return error; -+ return -EAGAIN; - - error = decode_inline_filename3(xdr, &entry->name, &entry->len); - if (unlikely(error)) -- return error; -+ return -EAGAIN; - - error = decode_cookie3(xdr, &new_cookie); - if (unlikely(error)) -- return error; -+ return -EAGAIN; - - entry->d_type = DT_UNKNOWN; - -@@ -2004,7 +2003,7 @@ int nfs3_decode_dirent(struct xdr_stream *xdr, struct nfs_entry *entry, - entry->fattr->valid = 0; - error = decode_post_op_attr(xdr, entry->fattr, userns); - if (unlikely(error)) -- return error; -+ return -EAGAIN; - if (entry->fattr->valid & NFS_ATTR_FATTR_V3) - entry->d_type = nfs_umode_to_dtype(entry->fattr->mode); - -@@ -2019,11 +2018,8 @@ int nfs3_decode_dirent(struct xdr_stream *xdr, struct nfs_entry *entry, - return -EAGAIN; - if (*p != xdr_zero) { - error = decode_nfs_fh3(xdr, entry->fh); -- if (unlikely(error)) { -- if (error == -E2BIG) -- goto out_truncated; -- return error; -- } -+ if (unlikely(error)) -+ return -EAGAIN; - } else - zero_nfs_fh3(entry->fh); - } -@@ -2032,11 +2028,6 @@ int nfs3_decode_dirent(struct xdr_stream *xdr, struct nfs_entry *entry, - entry->cookie = new_cookie; - - return 0; -- --out_truncated: -- dprintk("NFS: directory entry contains invalid file handle\n"); -- *entry = old; -- return -EAGAIN; - } - - /* -diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c -index fb3d1532f11dd..76baf7b441f3c 100644 ---- a/fs/nfs/nfs4proc.c -+++ b/fs/nfs/nfs4proc.c -@@ -7918,6 +7918,7 @@ nfs4_bind_one_conn_to_session_done(struct rpc_task *task, void *calldata) - case -NFS4ERR_DEADSESSION: - nfs4_schedule_session_recovery(clp->cl_session, - task->tk_status); -+ return; - } - if (args->dir == NFS4_CDFC4_FORE_OR_BOTH && - res->dir != NFS4_CDFS4_BOTH) { -diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c -index aa2caba38a014..1d2b81a233bbb 100644 ---- a/fs/nfs/nfs4state.c -+++ b/fs/nfs/nfs4state.c -@@ -49,6 +49,7 @@ - #include - #include - #include -+#include - - #include - -@@ -2504,9 +2505,17 @@ static int nfs4_bind_conn_to_session(struct nfs_client *clp) - - static void nfs4_state_manager(struct nfs_client *clp) - { -+ unsigned int memflags; - int status = 0; - const char *section = "", *section_sep = ""; - -+ /* -+ * State recovery can deadlock if the direct reclaim code tries -+ * start NFS writeback. So ensure memory allocations are all -+ * GFP_NOFS. -+ */ -+ memflags = memalloc_nofs_save(); -+ - /* Ensure exclusive access to NFSv4 state */ - do { - clear_bit(NFS4CLNT_RUN_MANAGER, &clp->cl_state); -@@ -2600,6 +2609,7 @@ static void nfs4_state_manager(struct nfs_client *clp) - clear_bit(NFS4CLNT_RECLAIM_NOGRACE, &clp->cl_state); - } - -+ memalloc_nofs_restore(memflags); - nfs4_end_drain_session(clp); - nfs4_clear_state_manager_bit(clp); - -@@ -2616,6 +2626,7 @@ static void nfs4_state_manager(struct nfs_client *clp) - return; - if (test_and_set_bit(NFS4CLNT_MANAGER_RUNNING, &clp->cl_state) != 0) - return; -+ memflags = memalloc_nofs_save(); - } while (refcount_read(&clp->cl_count) > 1 && !signalled()); - goto out_drain; - -@@ -2627,6 +2638,7 @@ out_error: - clp->cl_hostname, -status); - ssleep(1); - out_drain: -+ memalloc_nofs_restore(memflags); - nfs4_end_drain_session(clp); - nfs4_clear_state_manager_bit(clp); - } -diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c -index 1b512df1003f9..0471b6e0da16f 100644 ---- a/fs/nfs/pnfs.c -+++ b/fs/nfs/pnfs.c -@@ -92,6 +92,17 @@ find_pnfs_driver(u32 id) - return local; - } - -+const struct pnfs_layoutdriver_type *pnfs_find_layoutdriver(u32 id) -+{ -+ return find_pnfs_driver(id); -+} -+ -+void pnfs_put_layoutdriver(const struct pnfs_layoutdriver_type *ld) -+{ -+ if (ld) -+ module_put(ld->owner); -+} -+ - void - unset_pnfs_layoutdriver(struct nfs_server *nfss) - { -diff --git a/fs/nfs/pnfs.h b/fs/nfs/pnfs.h -index 3d55edd6b25ad..68339680bb7d1 100644 ---- a/fs/nfs/pnfs.h -+++ b/fs/nfs/pnfs.h -@@ -226,6 +226,8 @@ struct pnfs_devicelist { - - extern int pnfs_register_layoutdriver(struct pnfs_layoutdriver_type *); - extern void pnfs_unregister_layoutdriver(struct pnfs_layoutdriver_type *); -+extern const struct pnfs_layoutdriver_type *pnfs_find_layoutdriver(u32 id); -+extern void pnfs_put_layoutdriver(const struct pnfs_layoutdriver_type *ld); - - /* nfs4proc.c */ - extern size_t max_response_pages(struct nfs_server *server); -diff --git a/fs/nfsd/nfsproc.c b/fs/nfsd/nfsproc.c -index 754c763374dd5..4aca93e11af77 100644 ---- a/fs/nfsd/nfsproc.c -+++ b/fs/nfsd/nfsproc.c -@@ -230,7 +230,7 @@ nfsd_proc_write(struct svc_rqst *rqstp) - unsigned long cnt = argp->len; - unsigned int nvecs; - -- dprintk("nfsd: WRITE %s %d bytes at %d\n", -+ dprintk("nfsd: WRITE %s %u bytes at %d\n", - SVCFH_fmt(&argp->fh), - argp->len, argp->offset); - -diff --git a/fs/nfsd/xdr.h b/fs/nfsd/xdr.h -index ea7cca3a64b76..6251d8754c82b 100644 ---- a/fs/nfsd/xdr.h -+++ b/fs/nfsd/xdr.h -@@ -33,7 +33,7 @@ struct nfsd_readargs { - struct nfsd_writeargs { - svc_fh fh; - __u32 offset; -- int len; -+ __u32 len; - struct kvec first; - }; - -diff --git a/fs/ntfs/inode.c b/fs/ntfs/inode.c -index ea18e4a2a691d..cf222c9225d6d 100644 ---- a/fs/ntfs/inode.c -+++ b/fs/ntfs/inode.c -@@ -1881,6 +1881,10 @@ int ntfs_read_inode_mount(struct inode *vi) - } - /* Now allocate memory for the attribute list. */ - ni->attr_list_size = (u32)ntfs_attr_size(a); -+ if (!ni->attr_list_size) { -+ ntfs_error(sb, "Attr_list_size is zero"); -+ goto put_err_out; -+ } - ni->attr_list = ntfs_malloc_nofs(ni->attr_list_size); - if (!ni->attr_list) { - ntfs_error(sb, "Not enough memory to allocate buffer " -diff --git a/fs/ubifs/dir.c b/fs/ubifs/dir.c -index eeb93f009b282..83a173feb6989 100644 ---- a/fs/ubifs/dir.c -+++ b/fs/ubifs/dir.c -@@ -361,15 +361,18 @@ static int do_tmpfile(struct inode *dir, struct dentry *dentry, - { - struct inode *inode; - struct ubifs_info *c = dir->i_sb->s_fs_info; -- struct ubifs_budget_req req = { .new_ino = 1, .new_dent = 1}; -+ struct ubifs_budget_req req = { .new_ino = 1, .new_dent = 1, -+ .dirtied_ino = 1}; - struct ubifs_budget_req ino_req = { .dirtied_ino = 1 }; - struct ubifs_inode *ui, *dir_ui = ubifs_inode(dir); - int err, instantiated = 0; - struct fscrypt_name nm; - - /* -- * Budget request settings: new dirty inode, new direntry, -- * budget for dirtied inode will be released via writeback. -+ * Budget request settings: new inode, new direntry, changing the -+ * parent directory inode. -+ * Allocate budget separately for new dirtied inode, the budget will -+ * be released via writeback. - */ - - dbg_gen("dent '%pd', mode %#hx in dir ino %lu", -@@ -439,6 +442,8 @@ out_inode: - make_bad_inode(inode); - if (!instantiated) - iput(inode); -+ else if (whiteout) -+ iput(*whiteout); - out_budg: - ubifs_release_budget(c, &req); - if (!instantiated) -@@ -955,7 +960,8 @@ static int ubifs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode) - struct ubifs_inode *dir_ui = ubifs_inode(dir); - struct ubifs_info *c = dir->i_sb->s_fs_info; - int err, sz_change; -- struct ubifs_budget_req req = { .new_ino = 1, .new_dent = 1 }; -+ struct ubifs_budget_req req = { .new_ino = 1, .new_dent = 1, -+ .dirtied_ino = 1}; - struct fscrypt_name nm; - - /* -@@ -1330,6 +1336,7 @@ static int do_rename(struct inode *old_dir, struct dentry *old_dentry, - - if (flags & RENAME_WHITEOUT) { - union ubifs_dev_desc *dev = NULL; -+ struct ubifs_budget_req wht_req; - - dev = kmalloc(sizeof(union ubifs_dev_desc), GFP_NOFS); - if (!dev) { -@@ -1351,6 +1358,23 @@ static int do_rename(struct inode *old_dir, struct dentry *old_dentry, - whiteout_ui->data = dev; - whiteout_ui->data_len = ubifs_encode_dev(dev, MKDEV(0, 0)); - ubifs_assert(c, !whiteout_ui->dirty); -+ -+ memset(&wht_req, 0, sizeof(struct ubifs_budget_req)); -+ wht_req.dirtied_ino = 1; -+ wht_req.dirtied_ino_d = ALIGN(whiteout_ui->data_len, 8); -+ /* -+ * To avoid deadlock between space budget (holds ui_mutex and -+ * waits wb work) and writeback work(waits ui_mutex), do space -+ * budget before ubifs inodes locked. -+ */ -+ err = ubifs_budget_space(c, &wht_req); -+ if (err) { -+ iput(whiteout); -+ goto out_release; -+ } -+ -+ /* Add the old_dentry size to the old_dir size. */ -+ old_sz -= CALC_DENT_SIZE(fname_len(&old_nm)); - } - - lock_4_inodes(old_dir, new_dir, new_inode, whiteout); -@@ -1425,18 +1449,6 @@ static int do_rename(struct inode *old_dir, struct dentry *old_dentry, - } - - if (whiteout) { -- struct ubifs_budget_req wht_req = { .dirtied_ino = 1, -- .dirtied_ino_d = \ -- ALIGN(ubifs_inode(whiteout)->data_len, 8) }; -- -- err = ubifs_budget_space(c, &wht_req); -- if (err) { -- kfree(whiteout_ui->data); -- whiteout_ui->data_len = 0; -- iput(whiteout); -- goto out_release; -- } -- - inc_nlink(whiteout); - mark_inode_dirty(whiteout); - -diff --git a/fs/ubifs/io.c b/fs/ubifs/io.c -index eae9cf5a57b05..89b671ad0f9aa 100644 ---- a/fs/ubifs/io.c -+++ b/fs/ubifs/io.c -@@ -846,16 +846,42 @@ int ubifs_wbuf_write_nolock(struct ubifs_wbuf *wbuf, void *buf, int len) - */ - n = aligned_len >> c->max_write_shift; - if (n) { -- n <<= c->max_write_shift; -+ int m = n - 1; -+ - dbg_io("write %d bytes to LEB %d:%d", n, wbuf->lnum, - wbuf->offs); -- err = ubifs_leb_write(c, wbuf->lnum, buf + written, -- wbuf->offs, n); -+ -+ if (m) { -+ /* '(n-1)<max_write_shift < len' is always true. */ -+ m <<= c->max_write_shift; -+ err = ubifs_leb_write(c, wbuf->lnum, buf + written, -+ wbuf->offs, m); -+ if (err) -+ goto out; -+ wbuf->offs += m; -+ aligned_len -= m; -+ len -= m; -+ written += m; -+ } -+ -+ /* -+ * The non-written len of buf may be less than 'n' because -+ * parameter 'len' is not 8 bytes aligned, so here we read -+ * min(len, n) bytes from buf. -+ */ -+ n = 1 << c->max_write_shift; -+ memcpy(wbuf->buf, buf + written, min(len, n)); -+ if (n > len) { -+ ubifs_assert(c, n - len < 8); -+ ubifs_pad(c, wbuf->buf + len, n - len); -+ } -+ -+ err = ubifs_leb_write(c, wbuf->lnum, wbuf->buf, wbuf->offs, n); - if (err) - goto out; - wbuf->offs += n; - aligned_len -= n; -- len -= n; -+ len -= min(len, n); - written += n; - } - -diff --git a/fs/ubifs/ioctl.c b/fs/ubifs/ioctl.c -index eeb1be2598881..2923d5a6a7c0b 100644 ---- a/fs/ubifs/ioctl.c -+++ b/fs/ubifs/ioctl.c -@@ -101,7 +101,7 @@ static int setflags(struct inode *inode, int flags) - struct ubifs_inode *ui = ubifs_inode(inode); - struct ubifs_info *c = inode->i_sb->s_fs_info; - struct ubifs_budget_req req = { .dirtied_ino = 1, -- .dirtied_ino_d = ui->data_len }; -+ .dirtied_ino_d = ALIGN(ui->data_len, 8) }; - - err = ubifs_budget_space(c, &req); - if (err) -diff --git a/include/linux/blk-cgroup.h b/include/linux/blk-cgroup.h -index bed9e43f94260..46139c0f510fa 100644 ---- a/include/linux/blk-cgroup.h -+++ b/include/linux/blk-cgroup.h -@@ -22,6 +22,7 @@ - #include - #include - #include -+#include - - /* percpu_counter batch for blkg_[rw]stats, per-cpu drift doesn't matter */ - #define BLKG_STAT_CPU_BATCH (INT_MAX / 2) -@@ -768,6 +769,21 @@ static inline void blkcg_use_delay(struct blkcg_gq *blkg) - atomic_inc(&blkg->blkcg->css.cgroup->congestion_count); - } - -+/** -+ * blk_cgroup_mergeable - Determine whether to allow or disallow merges -+ * @rq: request to merge into -+ * @bio: bio to merge -+ * -+ * @bio and @rq should belong to the same cgroup and their issue_as_root should -+ * match. The latter is necessary as we don't want to throttle e.g. a metadata -+ * update because it happens to be next to a regular IO. -+ */ -+static inline bool blk_cgroup_mergeable(struct request *rq, struct bio *bio) -+{ -+ return rq->bio->bi_blkg == bio->bi_blkg && -+ bio_issue_as_root_blkg(rq->bio) == bio_issue_as_root_blkg(bio); -+} -+ - static inline int blkcg_unuse_delay(struct blkcg_gq *blkg) - { - int old = atomic_read(&blkg->use_delay); -@@ -868,6 +884,7 @@ static inline bool blkcg_punt_bio_submit(struct bio *bio) { return false; } - static inline void blkcg_bio_issue_init(struct bio *bio) { } - static inline bool blkcg_bio_issue_check(struct request_queue *q, - struct bio *bio) { return true; } -+static inline bool blk_cgroup_mergeable(struct request *rq, struct bio *bio) { return true; } - - #define blk_queue_for_each_rl(rl, q) \ - for ((rl) = &(q)->root_rl; (rl); (rl) = NULL) -diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h -index d5338b9ee5502..8cc766743270f 100644 ---- a/include/linux/blkdev.h -+++ b/include/linux/blkdev.h -@@ -59,6 +59,14 @@ struct blk_stat_callback; - */ - #define BLKCG_MAX_POLS 5 - -+static inline int blk_validate_block_size(unsigned int bsize) -+{ -+ if (bsize < 512 || bsize > PAGE_SIZE || !is_power_of_2(bsize)) -+ return -EINVAL; -+ -+ return 0; -+} -+ - typedef void (rq_end_io_fn)(struct request *, blk_status_t); - - /* -diff --git a/include/linux/dma-mapping.h b/include/linux/dma-mapping.h -index 4d450672b7d66..da90f20e11c1c 100644 ---- a/include/linux/dma-mapping.h -+++ b/include/linux/dma-mapping.h -@@ -70,6 +70,14 @@ - */ - #define DMA_ATTR_PRIVILEGED (1UL << 9) - -+/* -+ * This is a hint to the DMA-mapping subsystem that the device is expected -+ * to overwrite the entire mapped size, thus the caller does not require any -+ * of the previous buffer contents to be preserved. This allows -+ * bounce-buffering implementations to optimise DMA_FROM_DEVICE transfers. -+ */ -+#define DMA_ATTR_OVERWRITE (1UL << 10) -+ - /* - * A dma_addr_t can hold any valid DMA or bus address for the platform. - * It can be given to a device to use as a DMA source or target. A CPU cannot -diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h -index bbe297bbbca52..d5c507311efb1 100644 ---- a/include/linux/ipv6.h -+++ b/include/linux/ipv6.h -@@ -50,7 +50,7 @@ struct ipv6_devconf { - __s32 use_optimistic; - #endif - #ifdef CONFIG_IPV6_MROUTE -- __s32 mc_forwarding; -+ atomic_t mc_forwarding; - #endif - __s32 disable_ipv6; - __s32 drop_unicast_in_l2_multicast; -diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h -index bc8a70a7c5a13..e4f9df955040f 100644 ---- a/include/linux/mmzone.h -+++ b/include/linux/mmzone.h -@@ -1250,13 +1250,16 @@ static inline unsigned long *section_to_usemap(struct mem_section *ms) - - static inline struct mem_section *__nr_to_section(unsigned long nr) - { -+ unsigned long root = SECTION_NR_TO_ROOT(nr); -+ -+ if (unlikely(root >= NR_SECTION_ROOTS)) -+ return NULL; -+ - #ifdef CONFIG_SPARSEMEM_EXTREME -- if (!mem_section) -+ if (!mem_section || !mem_section[root]) - return NULL; - #endif -- if (!mem_section[SECTION_NR_TO_ROOT(nr)]) -- return NULL; -- return &mem_section[SECTION_NR_TO_ROOT(nr)][nr & SECTION_ROOT_MASK]; -+ return &mem_section[root][nr & SECTION_ROOT_MASK]; - } - extern unsigned long __section_nr(struct mem_section *ms); - extern size_t mem_section_usage_size(void); -diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h -index 288a586782563..c70b79dba1dc1 100644 ---- a/include/linux/netdevice.h -+++ b/include/linux/netdevice.h -@@ -3777,7 +3777,8 @@ void netdev_run_todo(void); - */ - static inline void dev_put(struct net_device *dev) - { -- this_cpu_dec(*dev->pcpu_refcnt); -+ if (dev) -+ this_cpu_dec(*dev->pcpu_refcnt); - } - - /** -@@ -3788,7 +3789,8 @@ static inline void dev_put(struct net_device *dev) - */ - static inline void dev_hold(struct net_device *dev) - { -- this_cpu_inc(*dev->pcpu_refcnt); -+ if (dev) -+ this_cpu_inc(*dev->pcpu_refcnt); - } - - /* Carrier loss detection, dial on demand. The functions netif_carrier_on -diff --git a/include/linux/nfs_fs.h b/include/linux/nfs_fs.h -index 978ef674f0388..49cf5c855cbe5 100644 ---- a/include/linux/nfs_fs.h -+++ b/include/linux/nfs_fs.h -@@ -480,10 +480,10 @@ static inline const struct cred *nfs_file_cred(struct file *file) - * linux/fs/nfs/direct.c - */ - extern ssize_t nfs_direct_IO(struct kiocb *, struct iov_iter *); --extern ssize_t nfs_file_direct_read(struct kiocb *iocb, -- struct iov_iter *iter); --extern ssize_t nfs_file_direct_write(struct kiocb *iocb, -- struct iov_iter *iter); -+ssize_t nfs_file_direct_read(struct kiocb *iocb, -+ struct iov_iter *iter, bool swap); -+ssize_t nfs_file_direct_write(struct kiocb *iocb, -+ struct iov_iter *iter, bool swap); - - /* - * linux/fs/nfs/dir.c -diff --git a/include/linux/pci.h b/include/linux/pci.h -index bc35b15efadd0..fc343d123127b 100644 ---- a/include/linux/pci.h -+++ b/include/linux/pci.h -@@ -604,6 +604,7 @@ struct pci_bus { - struct bin_attribute *legacy_io; /* Legacy I/O for this bus */ - struct bin_attribute *legacy_mem; /* Legacy mem */ - unsigned int is_added:1; -+ unsigned int unsafe_warn:1; /* warned about RW1C config write */ - }; - - #define to_pci_bus(n) container_of(n, struct pci_bus, dev) -diff --git a/include/linux/sunrpc/xdr.h b/include/linux/sunrpc/xdr.h -index a8d68c5a4ca61..fb0a6d6c91e48 100644 ---- a/include/linux/sunrpc/xdr.h -+++ b/include/linux/sunrpc/xdr.h -@@ -536,6 +536,8 @@ xdr_stream_decode_uint32_array(struct xdr_stream *xdr, - - if (unlikely(xdr_stream_decode_u32(xdr, &len) < 0)) - return -EBADMSG; -+ if (len > SIZE_MAX / sizeof(*p)) -+ return -EBADMSG; - p = xdr_inline_decode(xdr, len * sizeof(*p)); - if (unlikely(!p)) - return -EBADMSG; -diff --git a/include/net/arp.h b/include/net/arp.h -index 4950191f6b2bf..4a23a97195f33 100644 ---- a/include/net/arp.h -+++ b/include/net/arp.h -@@ -71,6 +71,7 @@ void arp_send(int type, int ptype, __be32 dest_ip, - const unsigned char *src_hw, const unsigned char *th); - int arp_mc_map(__be32 addr, u8 *haddr, struct net_device *dev, int dir); - void arp_ifdown(struct net_device *dev); -+int arp_invalidate(struct net_device *dev, __be32 ip, bool force); - - struct sk_buff *arp_create(int type, int ptype, __be32 dest_ip, - struct net_device *dev, __be32 src_ip, -diff --git a/include/net/udp.h b/include/net/udp.h -index d9d39cc20a847..9787a42f7ed3e 100644 ---- a/include/net/udp.h -+++ b/include/net/udp.h -@@ -459,6 +459,7 @@ void udp_init(void); - - DECLARE_STATIC_KEY_FALSE(udp_encap_needed_key); - void udp_encap_enable(void); -+void udp_encap_disable(void); - #if IS_ENABLED(CONFIG_IPV6) - DECLARE_STATIC_KEY_FALSE(udpv6_encap_needed_key); - void udpv6_encap_enable(void); -diff --git a/include/net/udp_tunnel.h b/include/net/udp_tunnel.h -index 4b1f95e083070..27bf9f4dd1d45 100644 ---- a/include/net/udp_tunnel.h -+++ b/include/net/udp_tunnel.h -@@ -178,9 +178,8 @@ static inline void udp_tunnel_encap_enable(struct socket *sock) - #if IS_ENABLED(CONFIG_IPV6) - if (sock->sk->sk_family == PF_INET6) - ipv6_stub->udpv6_encap_enable(); -- else - #endif -- udp_encap_enable(); -+ udp_encap_enable(); - } - - #endif -diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h -index 63038eb23560b..cb0631098f918 100644 ---- a/include/uapi/linux/bpf.h -+++ b/include/uapi/linux/bpf.h -@@ -1294,8 +1294,8 @@ union bpf_attr { - * Return - * The return value depends on the result of the test, and can be: - * -- * * 0, if current task belongs to the cgroup2. -- * * 1, if current task does not belong to the cgroup2. -+ * * 1, if current task belongs to the cgroup2. -+ * * 0, if current task does not belong to the cgroup2. - * * A negative error code, if an error occurred. - * - * int bpf_skb_change_tail(struct sk_buff *skb, u32 len, u64 flags) -@@ -3068,7 +3068,8 @@ struct bpf_sock { - __u32 src_ip4; - __u32 src_ip6[4]; - __u32 src_port; /* host byte order */ -- __u32 dst_port; /* network byte order */ -+ __be16 dst_port; /* network byte order */ -+ __u16 :16; /* zero padding */ - __u32 dst_ip4; - __u32 dst_ip6[4]; - __u32 state; -diff --git a/init/main.c b/init/main.c -index e6a1fb14f3085..d292daabd9a22 100644 ---- a/init/main.c -+++ b/init/main.c -@@ -831,7 +831,7 @@ static int __init initcall_blacklist(char *str) - } - } while (str_entry); - -- return 0; -+ return 1; - } - - static bool __init_or_module initcall_blacklisted(initcall_t fn) -@@ -1072,7 +1072,9 @@ static noinline void __init kernel_init_freeable(void); - bool rodata_enabled __ro_after_init = true; - static int __init set_debug_rodata(char *str) - { -- return strtobool(str, &rodata_enabled); -+ if (strtobool(str, &rodata_enabled)) -+ pr_warn("Invalid option string for rodata: '%s'\n", str); -+ return 1; - } - __setup("rodata=", set_debug_rodata); - #endif -diff --git a/kernel/audit.h b/kernel/audit.h -index ddc22878433d0..fed8e93ce1699 100644 ---- a/kernel/audit.h -+++ b/kernel/audit.h -@@ -191,6 +191,10 @@ struct audit_context { - struct { - char *name; - } module; -+ struct { -+ struct audit_ntp_data ntp_data; -+ struct timespec64 tk_injoffset; -+ } time; - }; - int fds[2]; - struct audit_proctitle proctitle; -diff --git a/kernel/auditsc.c b/kernel/auditsc.c -index d33c5dccde1c7..e8e90c0c49367 100644 ---- a/kernel/auditsc.c -+++ b/kernel/auditsc.c -@@ -1185,6 +1185,53 @@ static void audit_log_fcaps(struct audit_buffer *ab, struct audit_names *name) - from_kuid(&init_user_ns, name->fcap.rootid)); - } - -+static void audit_log_time(struct audit_context *context, struct audit_buffer **ab) -+{ -+ const struct audit_ntp_data *ntp = &context->time.ntp_data; -+ const struct timespec64 *tk = &context->time.tk_injoffset; -+ static const char * const ntp_name[] = { -+ "offset", -+ "freq", -+ "status", -+ "tai", -+ "tick", -+ "adjust", -+ }; -+ int type; -+ -+ if (context->type == AUDIT_TIME_ADJNTPVAL) { -+ for (type = 0; type < AUDIT_NTP_NVALS; type++) { -+ if (ntp->vals[type].newval != ntp->vals[type].oldval) { -+ if (!*ab) { -+ *ab = audit_log_start(context, -+ GFP_KERNEL, -+ AUDIT_TIME_ADJNTPVAL); -+ if (!*ab) -+ return; -+ } -+ audit_log_format(*ab, "op=%s old=%lli new=%lli", -+ ntp_name[type], -+ ntp->vals[type].oldval, -+ ntp->vals[type].newval); -+ audit_log_end(*ab); -+ *ab = NULL; -+ } -+ } -+ } -+ if (tk->tv_sec != 0 || tk->tv_nsec != 0) { -+ if (!*ab) { -+ *ab = audit_log_start(context, GFP_KERNEL, -+ AUDIT_TIME_INJOFFSET); -+ if (!*ab) -+ return; -+ } -+ audit_log_format(*ab, "sec=%lli nsec=%li", -+ (long long)tk->tv_sec, tk->tv_nsec); -+ audit_log_end(*ab); -+ *ab = NULL; -+ } -+} -+ - static void show_special(struct audit_context *context, int *call_panic) - { - struct audit_buffer *ab; -@@ -1290,6 +1337,11 @@ static void show_special(struct audit_context *context, int *call_panic) - audit_log_format(ab, "(null)"); - - break; -+ case AUDIT_TIME_ADJNTPVAL: -+ case AUDIT_TIME_INJOFFSET: -+ /* this call deviates from the rest, eating the buffer */ -+ audit_log_time(context, &ab); -+ break; - } - audit_log_end(ab); - } -@@ -2518,31 +2570,26 @@ void __audit_fanotify(unsigned int response) - - void __audit_tk_injoffset(struct timespec64 offset) - { -- audit_log(audit_context(), GFP_KERNEL, AUDIT_TIME_INJOFFSET, -- "sec=%lli nsec=%li", -- (long long)offset.tv_sec, offset.tv_nsec); --} -- --static void audit_log_ntp_val(const struct audit_ntp_data *ad, -- const char *op, enum audit_ntp_type type) --{ -- const struct audit_ntp_val *val = &ad->vals[type]; -- -- if (val->newval == val->oldval) -- return; -+ struct audit_context *context = audit_context(); - -- audit_log(audit_context(), GFP_KERNEL, AUDIT_TIME_ADJNTPVAL, -- "op=%s old=%lli new=%lli", op, val->oldval, val->newval); -+ /* only set type if not already set by NTP */ -+ if (!context->type) -+ context->type = AUDIT_TIME_INJOFFSET; -+ memcpy(&context->time.tk_injoffset, &offset, sizeof(offset)); - } - - void __audit_ntp_log(const struct audit_ntp_data *ad) - { -- audit_log_ntp_val(ad, "offset", AUDIT_NTP_OFFSET); -- audit_log_ntp_val(ad, "freq", AUDIT_NTP_FREQ); -- audit_log_ntp_val(ad, "status", AUDIT_NTP_STATUS); -- audit_log_ntp_val(ad, "tai", AUDIT_NTP_TAI); -- audit_log_ntp_val(ad, "tick", AUDIT_NTP_TICK); -- audit_log_ntp_val(ad, "adjust", AUDIT_NTP_ADJUST); -+ struct audit_context *context = audit_context(); -+ int type; -+ -+ for (type = 0; type < AUDIT_NTP_NVALS; type++) -+ if (ad->vals[type].newval != ad->vals[type].oldval) { -+ /* unconditionally set type, overwriting TK */ -+ context->type = AUDIT_TIME_ADJNTPVAL; -+ memcpy(&context->time.ntp_data, ad, sizeof(*ad)); -+ break; -+ } - } - - static void audit_log_task(struct audit_buffer *ab) -diff --git a/kernel/cgroup/cgroup-internal.h b/kernel/cgroup/cgroup-internal.h -index 809e34a3c0172..236f290224aae 100644 ---- a/kernel/cgroup/cgroup-internal.h -+++ b/kernel/cgroup/cgroup-internal.h -@@ -65,6 +65,25 @@ static inline struct cgroup_fs_context *cgroup_fc2context(struct fs_context *fc) - return container_of(kfc, struct cgroup_fs_context, kfc); - } - -+struct cgroup_pidlist; -+ -+struct cgroup_file_ctx { -+ struct cgroup_namespace *ns; -+ -+ struct { -+ void *trigger; -+ } psi; -+ -+ struct { -+ bool started; -+ struct css_task_iter iter; -+ } procs; -+ -+ struct { -+ struct cgroup_pidlist *pidlist; -+ } procs1; -+}; -+ - /* - * A cgroup can be associated with multiple css_sets as different tasks may - * belong to different cgroups on different hierarchies. In the other -diff --git a/kernel/cgroup/cgroup-v1.c b/kernel/cgroup/cgroup-v1.c -index 5e465c4b1e64c..117d70098cd49 100644 ---- a/kernel/cgroup/cgroup-v1.c -+++ b/kernel/cgroup/cgroup-v1.c -@@ -398,6 +398,7 @@ static void *cgroup_pidlist_start(struct seq_file *s, loff_t *pos) - * next pid to display, if any - */ - struct kernfs_open_file *of = s->private; -+ struct cgroup_file_ctx *ctx = of->priv; - struct cgroup *cgrp = seq_css(s)->cgroup; - struct cgroup_pidlist *l; - enum cgroup_filetype type = seq_cft(s)->private; -@@ -407,25 +408,24 @@ static void *cgroup_pidlist_start(struct seq_file *s, loff_t *pos) - mutex_lock(&cgrp->pidlist_mutex); - - /* -- * !NULL @of->priv indicates that this isn't the first start() -- * after open. If the matching pidlist is around, we can use that. -- * Look for it. Note that @of->priv can't be used directly. It -- * could already have been destroyed. -+ * !NULL @ctx->procs1.pidlist indicates that this isn't the first -+ * start() after open. If the matching pidlist is around, we can use -+ * that. Look for it. Note that @ctx->procs1.pidlist can't be used -+ * directly. It could already have been destroyed. - */ -- if (of->priv) -- of->priv = cgroup_pidlist_find(cgrp, type); -+ if (ctx->procs1.pidlist) -+ ctx->procs1.pidlist = cgroup_pidlist_find(cgrp, type); - - /* - * Either this is the first start() after open or the matching - * pidlist has been destroyed inbetween. Create a new one. - */ -- if (!of->priv) { -- ret = pidlist_array_load(cgrp, type, -- (struct cgroup_pidlist **)&of->priv); -+ if (!ctx->procs1.pidlist) { -+ ret = pidlist_array_load(cgrp, type, &ctx->procs1.pidlist); - if (ret) - return ERR_PTR(ret); - } -- l = of->priv; -+ l = ctx->procs1.pidlist; - - if (pid) { - int end = l->length; -@@ -453,7 +453,8 @@ static void *cgroup_pidlist_start(struct seq_file *s, loff_t *pos) - static void cgroup_pidlist_stop(struct seq_file *s, void *v) - { - struct kernfs_open_file *of = s->private; -- struct cgroup_pidlist *l = of->priv; -+ struct cgroup_file_ctx *ctx = of->priv; -+ struct cgroup_pidlist *l = ctx->procs1.pidlist; - - if (l) - mod_delayed_work(cgroup_pidlist_destroy_wq, &l->destroy_dwork, -@@ -464,7 +465,8 @@ static void cgroup_pidlist_stop(struct seq_file *s, void *v) - static void *cgroup_pidlist_next(struct seq_file *s, void *v, loff_t *pos) - { - struct kernfs_open_file *of = s->private; -- struct cgroup_pidlist *l = of->priv; -+ struct cgroup_file_ctx *ctx = of->priv; -+ struct cgroup_pidlist *l = ctx->procs1.pidlist; - pid_t *p = v; - pid_t *end = l->list + l->length; - /* -@@ -507,10 +509,11 @@ static ssize_t __cgroup1_procs_write(struct kernfs_open_file *of, - goto out_unlock; - - /* -- * Even if we're attaching all tasks in the thread group, we only -- * need to check permissions on one of them. -+ * Even if we're attaching all tasks in the thread group, we only need -+ * to check permissions on one of them. Check permissions using the -+ * credentials from file open to protect against inherited fd attacks. - */ -- cred = current_cred(); -+ cred = of->file->f_cred; - tcred = get_task_cred(task); - if (!uid_eq(cred->euid, GLOBAL_ROOT_UID) && - !uid_eq(cred->euid, tcred->uid) && -diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c -index ce1745ac7b8c0..177d57ce90164 100644 ---- a/kernel/cgroup/cgroup.c -+++ b/kernel/cgroup/cgroup.c -@@ -3648,6 +3648,7 @@ static int cgroup_cpu_pressure_show(struct seq_file *seq, void *v) - static ssize_t cgroup_pressure_write(struct kernfs_open_file *of, char *buf, - size_t nbytes, enum psi_res res) - { -+ struct cgroup_file_ctx *ctx = of->priv; - struct psi_trigger *new; - struct cgroup *cgrp; - struct psi_group *psi; -@@ -3660,7 +3661,7 @@ static ssize_t cgroup_pressure_write(struct kernfs_open_file *of, char *buf, - cgroup_kn_unlock(of->kn); - - /* Allow only one trigger per file descriptor */ -- if (of->priv) { -+ if (ctx->psi.trigger) { - cgroup_put(cgrp); - return -EBUSY; - } -@@ -3672,7 +3673,7 @@ static ssize_t cgroup_pressure_write(struct kernfs_open_file *of, char *buf, - return PTR_ERR(new); - } - -- smp_store_release(&of->priv, new); -+ smp_store_release(&ctx->psi.trigger, new); - cgroup_put(cgrp); - - return nbytes; -@@ -3702,12 +3703,15 @@ static ssize_t cgroup_cpu_pressure_write(struct kernfs_open_file *of, - static __poll_t cgroup_pressure_poll(struct kernfs_open_file *of, - poll_table *pt) - { -- return psi_trigger_poll(&of->priv, of->file, pt); -+ struct cgroup_file_ctx *ctx = of->priv; -+ return psi_trigger_poll(&ctx->psi.trigger, of->file, pt); - } - - static void cgroup_pressure_release(struct kernfs_open_file *of) - { -- psi_trigger_destroy(of->priv); -+ struct cgroup_file_ctx *ctx = of->priv; -+ -+ psi_trigger_destroy(ctx->psi.trigger); - } - #endif /* CONFIG_PSI */ - -@@ -3748,24 +3752,43 @@ static ssize_t cgroup_freeze_write(struct kernfs_open_file *of, - static int cgroup_file_open(struct kernfs_open_file *of) - { - struct cftype *cft = of->kn->priv; -+ struct cgroup_file_ctx *ctx; -+ int ret; - -- if (cft->open) -- return cft->open(of); -- return 0; -+ ctx = kzalloc(sizeof(*ctx), GFP_KERNEL); -+ if (!ctx) -+ return -ENOMEM; -+ -+ ctx->ns = current->nsproxy->cgroup_ns; -+ get_cgroup_ns(ctx->ns); -+ of->priv = ctx; -+ -+ if (!cft->open) -+ return 0; -+ -+ ret = cft->open(of); -+ if (ret) { -+ put_cgroup_ns(ctx->ns); -+ kfree(ctx); -+ } -+ return ret; - } - - static void cgroup_file_release(struct kernfs_open_file *of) - { - struct cftype *cft = of->kn->priv; -+ struct cgroup_file_ctx *ctx = of->priv; - - if (cft->release) - cft->release(of); -+ put_cgroup_ns(ctx->ns); -+ kfree(ctx); - } - - static ssize_t cgroup_file_write(struct kernfs_open_file *of, char *buf, - size_t nbytes, loff_t off) - { -- struct cgroup_namespace *ns = current->nsproxy->cgroup_ns; -+ struct cgroup_file_ctx *ctx = of->priv; - struct cgroup *cgrp = of->kn->parent->priv; - struct cftype *cft = of->kn->priv; - struct cgroup_subsys_state *css; -@@ -3779,7 +3802,7 @@ static ssize_t cgroup_file_write(struct kernfs_open_file *of, char *buf, - */ - if ((cgrp->root->flags & CGRP_ROOT_NS_DELEGATE) && - !(cft->flags & CFTYPE_NS_DELEGATABLE) && -- ns != &init_cgroup_ns && ns->root_cset->dfl_cgrp == cgrp) -+ ctx->ns != &init_cgroup_ns && ctx->ns->root_cset->dfl_cgrp == cgrp) - return -EPERM; - - if (cft->write) -@@ -4687,21 +4710,21 @@ void css_task_iter_end(struct css_task_iter *it) - - static void cgroup_procs_release(struct kernfs_open_file *of) - { -- if (of->priv) { -- css_task_iter_end(of->priv); -- kfree(of->priv); -- } -+ struct cgroup_file_ctx *ctx = of->priv; -+ -+ if (ctx->procs.started) -+ css_task_iter_end(&ctx->procs.iter); - } - - static void *cgroup_procs_next(struct seq_file *s, void *v, loff_t *pos) - { - struct kernfs_open_file *of = s->private; -- struct css_task_iter *it = of->priv; -+ struct cgroup_file_ctx *ctx = of->priv; - - if (pos) - (*pos)++; - -- return css_task_iter_next(it); -+ return css_task_iter_next(&ctx->procs.iter); - } - - static void *__cgroup_procs_start(struct seq_file *s, loff_t *pos, -@@ -4709,21 +4732,18 @@ static void *__cgroup_procs_start(struct seq_file *s, loff_t *pos, - { - struct kernfs_open_file *of = s->private; - struct cgroup *cgrp = seq_css(s)->cgroup; -- struct css_task_iter *it = of->priv; -+ struct cgroup_file_ctx *ctx = of->priv; -+ struct css_task_iter *it = &ctx->procs.iter; - - /* - * When a seq_file is seeked, it's always traversed sequentially - * from position 0, so we can simply keep iterating on !0 *pos. - */ -- if (!it) { -+ if (!ctx->procs.started) { - if (WARN_ON_ONCE((*pos))) - return ERR_PTR(-EINVAL); -- -- it = kzalloc(sizeof(*it), GFP_KERNEL); -- if (!it) -- return ERR_PTR(-ENOMEM); -- of->priv = it; - css_task_iter_start(&cgrp->self, iter_flags, it); -+ ctx->procs.started = true; - } else if (!(*pos)) { - css_task_iter_end(it); - css_task_iter_start(&cgrp->self, iter_flags, it); -@@ -4758,9 +4778,9 @@ static int cgroup_procs_show(struct seq_file *s, void *v) - - static int cgroup_procs_write_permission(struct cgroup *src_cgrp, - struct cgroup *dst_cgrp, -- struct super_block *sb) -+ struct super_block *sb, -+ struct cgroup_namespace *ns) - { -- struct cgroup_namespace *ns = current->nsproxy->cgroup_ns; - struct cgroup *com_cgrp = src_cgrp; - struct inode *inode; - int ret; -@@ -4796,8 +4816,10 @@ static int cgroup_procs_write_permission(struct cgroup *src_cgrp, - static ssize_t cgroup_procs_write(struct kernfs_open_file *of, - char *buf, size_t nbytes, loff_t off) - { -+ struct cgroup_file_ctx *ctx = of->priv; - struct cgroup *src_cgrp, *dst_cgrp; - struct task_struct *task; -+ const struct cred *saved_cred; - ssize_t ret; - - dst_cgrp = cgroup_kn_lock_live(of->kn, false); -@@ -4814,8 +4836,16 @@ static ssize_t cgroup_procs_write(struct kernfs_open_file *of, - src_cgrp = task_cgroup_from_root(task, &cgrp_dfl_root); - spin_unlock_irq(&css_set_lock); - -+ /* -+ * Process and thread migrations follow same delegation rule. Check -+ * permissions using the credentials from file open to protect against -+ * inherited fd attacks. -+ */ -+ saved_cred = override_creds(of->file->f_cred); - ret = cgroup_procs_write_permission(src_cgrp, dst_cgrp, -- of->file->f_path.dentry->d_sb); -+ of->file->f_path.dentry->d_sb, -+ ctx->ns); -+ revert_creds(saved_cred); - if (ret) - goto out_finish; - -@@ -4837,8 +4867,10 @@ static void *cgroup_threads_start(struct seq_file *s, loff_t *pos) - static ssize_t cgroup_threads_write(struct kernfs_open_file *of, - char *buf, size_t nbytes, loff_t off) - { -+ struct cgroup_file_ctx *ctx = of->priv; - struct cgroup *src_cgrp, *dst_cgrp; - struct task_struct *task; -+ const struct cred *saved_cred; - ssize_t ret; - - buf = strstrip(buf); -@@ -4857,9 +4889,16 @@ static ssize_t cgroup_threads_write(struct kernfs_open_file *of, - src_cgrp = task_cgroup_from_root(task, &cgrp_dfl_root); - spin_unlock_irq(&css_set_lock); - -- /* thread migrations follow the cgroup.procs delegation rule */ -+ /* -+ * Process and thread migrations follow same delegation rule. Check -+ * permissions using the credentials from file open to protect against -+ * inherited fd attacks. -+ */ -+ saved_cred = override_creds(of->file->f_cred); - ret = cgroup_procs_write_permission(src_cgrp, dst_cgrp, -- of->file->f_path.dentry->d_sb); -+ of->file->f_path.dentry->d_sb, -+ ctx->ns); -+ revert_creds(saved_cred); - if (ret) - goto out_finish; - -diff --git a/kernel/dma/debug.c b/kernel/dma/debug.c -index b28665f4d8c7a..4dc3bbfd3e3f3 100644 ---- a/kernel/dma/debug.c -+++ b/kernel/dma/debug.c -@@ -980,7 +980,7 @@ static __init int dma_debug_cmdline(char *str) - global_disable = true; - } - -- return 0; -+ return 1; - } - - static __init int dma_debug_entries_cmdline(char *str) -@@ -989,7 +989,7 @@ static __init int dma_debug_entries_cmdline(char *str) - return -EINVAL; - if (!get_option(&str, &nr_prealloc_entries)) - nr_prealloc_entries = PREALLOC_DMA_DEBUG_ENTRIES; -- return 0; -+ return 1; - } - - __setup("dma_debug=", dma_debug_cmdline); -diff --git a/kernel/dma/swiotlb.c b/kernel/dma/swiotlb.c -index f99b79d7e1235..f17b771856d1c 100644 ---- a/kernel/dma/swiotlb.c -+++ b/kernel/dma/swiotlb.c -@@ -572,7 +572,8 @@ found: - for (i = 0; i < nslots; i++) - io_tlb_orig_addr[index+i] = orig_addr + (i << IO_TLB_SHIFT); - if (!(attrs & DMA_ATTR_SKIP_CPU_SYNC) && -- (dir == DMA_TO_DEVICE || dir == DMA_BIDIRECTIONAL)) -+ (!(attrs & DMA_ATTR_OVERWRITE) || dir == DMA_TO_DEVICE || -+ dir == DMA_BIDIRECTIONAL)) - swiotlb_bounce(orig_addr, tlb_addr, mapping_size, DMA_TO_DEVICE); - - return tlb_addr; -diff --git a/kernel/events/core.c b/kernel/events/core.c -index f720a40ccaf5f..52f4a9e467040 100644 ---- a/kernel/events/core.c -+++ b/kernel/events/core.c -@@ -9490,8 +9490,11 @@ perf_event_parse_addr_filter(struct perf_event *event, char *fstr, - } - - /* ready to consume more filters */ -+ kfree(filename); -+ filename = NULL; - state = IF_STATE_ACTION; - filter = NULL; -+ kernel = 0; - } - } - -diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c -index 6cafb2e910a11..406b4cbbec5e7 100644 ---- a/kernel/power/hibernate.c -+++ b/kernel/power/hibernate.c -@@ -1216,7 +1216,7 @@ static int __init resumedelay_setup(char *str) - int rc = kstrtouint(str, 0, &resume_delay); - - if (rc) -- return rc; -+ pr_warn("resumedelay: bad option string '%s'\n", str); - return 1; - } - -diff --git a/kernel/power/suspend_test.c b/kernel/power/suspend_test.c -index 60564b58de077..bfd2a96c695ca 100644 ---- a/kernel/power/suspend_test.c -+++ b/kernel/power/suspend_test.c -@@ -157,22 +157,22 @@ static int __init setup_test_suspend(char *value) - value++; - suspend_type = strsep(&value, ","); - if (!suspend_type) -- return 0; -+ return 1; - - repeat = strsep(&value, ","); - if (repeat) { - if (kstrtou32(repeat, 0, &test_repeat_count_max)) -- return 0; -+ return 1; - } - - for (i = PM_SUSPEND_MIN; i < PM_SUSPEND_MAX; i++) - if (!strcmp(pm_labels[i], suspend_type)) { - test_state_label = pm_labels[i]; -- return 0; -+ return 1; - } - - printk(warn_bad_state, suspend_type); -- return 0; -+ return 1; - } - __setup("test_suspend", setup_test_suspend); - -diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c -index 23e26a203a9e9..bb2198b40756d 100644 ---- a/kernel/printk/printk.c -+++ b/kernel/printk/printk.c -@@ -146,8 +146,10 @@ static int __control_devkmsg(char *str) - - static int __init control_devkmsg(char *str) - { -- if (__control_devkmsg(str) < 0) -+ if (__control_devkmsg(str) < 0) { -+ pr_warn("printk.devkmsg: bad option string '%s'\n", str); - return 1; -+ } - - /* - * Set sysctl string accordingly: -@@ -166,7 +168,7 @@ static int __init control_devkmsg(char *str) - */ - devkmsg_log |= DEVKMSG_LOG_MASK_LOCK; - -- return 0; -+ return 1; - } - __setup("printk.devkmsg=", control_devkmsg); - -diff --git a/kernel/ptrace.c b/kernel/ptrace.c -index eb4d04cb3aaf5..d99f73f83bf5f 100644 ---- a/kernel/ptrace.c -+++ b/kernel/ptrace.c -@@ -370,6 +370,26 @@ bool ptrace_may_access(struct task_struct *task, unsigned int mode) - return !err; - } - -+static int check_ptrace_options(unsigned long data) -+{ -+ if (data & ~(unsigned long)PTRACE_O_MASK) -+ return -EINVAL; -+ -+ if (unlikely(data & PTRACE_O_SUSPEND_SECCOMP)) { -+ if (!IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) || -+ !IS_ENABLED(CONFIG_SECCOMP)) -+ return -EINVAL; -+ -+ if (!capable(CAP_SYS_ADMIN)) -+ return -EPERM; -+ -+ if (seccomp_mode(¤t->seccomp) != SECCOMP_MODE_DISABLED || -+ current->ptrace & PT_SUSPEND_SECCOMP) -+ return -EPERM; -+ } -+ return 0; -+} -+ - static int ptrace_attach(struct task_struct *task, long request, - unsigned long addr, - unsigned long flags) -@@ -381,8 +401,16 @@ static int ptrace_attach(struct task_struct *task, long request, - if (seize) { - if (addr != 0) - goto out; -+ /* -+ * This duplicates the check in check_ptrace_options() because -+ * ptrace_attach() and ptrace_setoptions() have historically -+ * used different error codes for unknown ptrace options. -+ */ - if (flags & ~(unsigned long)PTRACE_O_MASK) - goto out; -+ retval = check_ptrace_options(flags); -+ if (retval) -+ return retval; - flags = PT_PTRACED | PT_SEIZED | (flags << PT_OPT_FLAG_SHIFT); - } else { - flags = PT_PTRACED; -@@ -655,22 +683,11 @@ int ptrace_writedata(struct task_struct *tsk, char __user *src, unsigned long ds - static int ptrace_setoptions(struct task_struct *child, unsigned long data) - { - unsigned flags; -+ int ret; - -- if (data & ~(unsigned long)PTRACE_O_MASK) -- return -EINVAL; -- -- if (unlikely(data & PTRACE_O_SUSPEND_SECCOMP)) { -- if (!IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) || -- !IS_ENABLED(CONFIG_SECCOMP)) -- return -EINVAL; -- -- if (!capable(CAP_SYS_ADMIN)) -- return -EPERM; -- -- if (seccomp_mode(¤t->seccomp) != SECCOMP_MODE_DISABLED || -- current->ptrace & PT_SUSPEND_SECCOMP) -- return -EPERM; -- } -+ ret = check_ptrace_options(data); -+ if (ret) -+ return ret; - - /* Avoid intermediate state when all opts are cleared */ - flags = child->ptrace; -diff --git a/kernel/sched/debug.c b/kernel/sched/debug.c -index faada713cfae8..d5f7fc7099bc4 100644 ---- a/kernel/sched/debug.c -+++ b/kernel/sched/debug.c -@@ -847,25 +847,15 @@ void print_numa_stats(struct seq_file *m, int node, unsigned long tsf, - static void sched_show_numa(struct task_struct *p, struct seq_file *m) - { - #ifdef CONFIG_NUMA_BALANCING -- struct mempolicy *pol; -- - if (p->mm) - P(mm->numa_scan_seq); - -- task_lock(p); -- pol = p->mempolicy; -- if (pol && !(pol->flags & MPOL_F_MORON)) -- pol = NULL; -- mpol_get(pol); -- task_unlock(p); -- - P(numa_pages_migrated); - P(numa_preferred_nid); - P(total_numa_faults); - SEQ_printf(m, "current_node=%d, numa_group_id=%d\n", - task_node(p), task_numa_group_id(p)); - show_numa_stats(p, m); -- mpol_put(pol); - #endif - } - -diff --git a/lib/lz4/lz4_decompress.c b/lib/lz4/lz4_decompress.c -index 4d0b59fa5550f..46f24b7a32217 100644 ---- a/lib/lz4/lz4_decompress.c -+++ b/lib/lz4/lz4_decompress.c -@@ -268,8 +268,12 @@ static FORCE_INLINE int LZ4_decompress_generic( - ip += length; - op += length; - -- /* Necessarily EOF, due to parsing restrictions */ -- if (!partialDecoding || (cpy == oend)) -+ /* Necessarily EOF when !partialDecoding. -+ * When partialDecoding, it is EOF if we've either -+ * filled the output buffer or -+ * can't proceed with reading an offset for following match. -+ */ -+ if (!partialDecoding || (cpy == oend) || (ip >= (iend - 2))) - break; - } else { - /* may overwrite up to WILDCOPYLENGTH beyond cpy */ -diff --git a/lib/raid6/test/Makefile b/lib/raid6/test/Makefile -index b9e6c3648be1a..98b9fd0354dd1 100644 ---- a/lib/raid6/test/Makefile -+++ b/lib/raid6/test/Makefile -@@ -4,6 +4,8 @@ - # from userspace. - # - -+pound := \# -+ - CC = gcc - OPTFLAGS = -O2 # Adjust as desired - CFLAGS = -I.. -I ../../../include -g $(OPTFLAGS) -@@ -47,7 +49,7 @@ else ifeq ($(HAS_NEON),yes) - OBJS += neon.o neon1.o neon2.o neon4.o neon8.o recov_neon.o recov_neon_inner.o - CFLAGS += -DCONFIG_KERNEL_MODE_NEON=1 - else -- HAS_ALTIVEC := $(shell printf '\#include \nvector int a;\n' |\ -+ HAS_ALTIVEC := $(shell printf '$(pound)include \nvector int a;\n' |\ - gcc -c -x c - >/dev/null && rm ./-.o && echo yes) - ifeq ($(HAS_ALTIVEC),yes) - CFLAGS += -I../../../arch/powerpc/include -diff --git a/lib/raid6/test/test.c b/lib/raid6/test/test.c -index a3cf071941ab4..841a55242abaa 100644 ---- a/lib/raid6/test/test.c -+++ b/lib/raid6/test/test.c -@@ -19,7 +19,6 @@ - #define NDISKS 16 /* Including P and Q */ - - const char raid6_empty_zero_page[PAGE_SIZE] __attribute__((aligned(PAGE_SIZE))); --struct raid6_calls raid6_call; - - char *dataptrs[NDISKS]; - char data[NDISKS][PAGE_SIZE] __attribute__((aligned(PAGE_SIZE))); -diff --git a/lib/test_kmod.c b/lib/test_kmod.c -index 87a0cc750ea23..6813b183aa348 100644 ---- a/lib/test_kmod.c -+++ b/lib/test_kmod.c -@@ -1155,6 +1155,7 @@ static struct kmod_test_device *register_test_dev_kmod(void) - if (ret) { - pr_err("could not register misc device: %d\n", ret); - free_test_dev_kmod(test_dev); -+ test_dev = NULL; - goto out; - } - -diff --git a/lib/test_xarray.c b/lib/test_xarray.c -index 8262c3f05a5d3..aefa377c9c26a 100644 ---- a/lib/test_xarray.c -+++ b/lib/test_xarray.c -@@ -1438,6 +1438,25 @@ unlock: - XA_BUG_ON(xa, !xa_empty(xa)); - } - -+static noinline void check_create_range_5(struct xarray *xa, -+ unsigned long index, unsigned int order) -+{ -+ XA_STATE_ORDER(xas, xa, index, order); -+ unsigned int i; -+ -+ xa_store_order(xa, index, order, xa_mk_index(index), GFP_KERNEL); -+ -+ for (i = 0; i < order + 10; i++) { -+ do { -+ xas_lock(&xas); -+ xas_create_range(&xas); -+ xas_unlock(&xas); -+ } while (xas_nomem(&xas, GFP_KERNEL)); -+ } -+ -+ xa_destroy(xa); -+} -+ - static noinline void check_create_range(struct xarray *xa) - { - unsigned int order; -@@ -1465,6 +1484,9 @@ static noinline void check_create_range(struct xarray *xa) - check_create_range_4(xa, (3U << order) + 1, order); - check_create_range_4(xa, (3U << order) - 1, order); - check_create_range_4(xa, (1U << 24) + 1, order); -+ -+ check_create_range_5(xa, 0, order); -+ check_create_range_5(xa, (1U << order), order); - } - - check_create_range_3(); -diff --git a/lib/xarray.c b/lib/xarray.c -index 7d22b30591275..61464c52c20e6 100644 ---- a/lib/xarray.c -+++ b/lib/xarray.c -@@ -722,6 +722,8 @@ void xas_create_range(struct xa_state *xas) - - for (;;) { - struct xa_node *node = xas->xa_node; -+ if (node->shift >= shift) -+ break; - xas->xa_node = xa_parent_locked(xas->xa, node); - xas->xa_offset = node->offset - 1; - if (node->offset != 0) -@@ -1078,6 +1080,7 @@ void xas_split(struct xa_state *xas, void *entry, unsigned int order) - xa_mk_node(child)); - if (xa_is_value(curr)) - values--; -+ xas_update(xas, child); - } else { - unsigned int canon = offset - xas->xa_sibs; - -@@ -1092,6 +1095,7 @@ void xas_split(struct xa_state *xas, void *entry, unsigned int order) - } while (offset-- > xas->xa_offset); - - node->nr_values += values; -+ xas_update(xas, node); - } - EXPORT_SYMBOL_GPL(xas_split); - #endif -diff --git a/mm/kmemleak.c b/mm/kmemleak.c -index 4a669c81f4e22..d8cde7292bf92 100644 ---- a/mm/kmemleak.c -+++ b/mm/kmemleak.c -@@ -787,6 +787,8 @@ static void add_scan_area(unsigned long ptr, size_t size, gfp_t gfp) - unsigned long flags; - struct kmemleak_object *object; - struct kmemleak_scan_area *area = NULL; -+ unsigned long untagged_ptr; -+ unsigned long untagged_objp; - - object = find_and_get_object(ptr, 1); - if (!object) { -@@ -795,6 +797,9 @@ static void add_scan_area(unsigned long ptr, size_t size, gfp_t gfp) - return; - } - -+ untagged_ptr = (unsigned long)kasan_reset_tag((void *)ptr); -+ untagged_objp = (unsigned long)kasan_reset_tag((void *)object->pointer); -+ - if (scan_area_cache) - area = kmem_cache_alloc(scan_area_cache, gfp_kmemleak_mask(gfp)); - -@@ -806,8 +811,8 @@ static void add_scan_area(unsigned long ptr, size_t size, gfp_t gfp) - goto out_unlock; - } - if (size == SIZE_MAX) { -- size = object->pointer + object->size - ptr; -- } else if (ptr + size > object->pointer + object->size) { -+ size = untagged_objp + object->size - untagged_ptr; -+ } else if (untagged_ptr + size > untagged_objp + object->size) { - kmemleak_warn("Scan area larger than object 0x%08lx\n", ptr); - dump_object_info(object); - kmem_cache_free(scan_area_cache, area); -diff --git a/mm/memcontrol.c b/mm/memcontrol.c -index 6d7fe3589e4a0..8fc6635454987 100644 ---- a/mm/memcontrol.c -+++ b/mm/memcontrol.c -@@ -6973,7 +6973,7 @@ static int __init cgroup_memory(char *s) - if (!strcmp(token, "nokmem")) - cgroup_memory_nokmem = true; - } -- return 0; -+ return 1; - } - __setup("cgroup.memory=", cgroup_memory); - -diff --git a/mm/memory.c b/mm/memory.c -index 4bb7c6a364c81..8a72fd3e73bf1 100644 ---- a/mm/memory.c -+++ b/mm/memory.c -@@ -1013,6 +1013,17 @@ int copy_page_range(struct mm_struct *dst_mm, struct mm_struct *src_mm, - return ret; - } - -+/* Whether we should zap all COWed (private) pages too */ -+static inline bool should_zap_cows(struct zap_details *details) -+{ -+ /* By default, zap all pages */ -+ if (!details) -+ return true; -+ -+ /* Or, we zap COWed pages only if the caller wants to */ -+ return !details->check_mapping; -+} -+ - static unsigned long zap_pte_range(struct mmu_gather *tlb, - struct vm_area_struct *vma, pmd_t *pmd, - unsigned long addr, unsigned long end, -@@ -1104,16 +1115,18 @@ again: - continue; - } - -- /* If details->check_mapping, we leave swap entries. */ -- if (unlikely(details)) -- continue; -- -- if (!non_swap_entry(entry)) -+ if (!non_swap_entry(entry)) { -+ /* Genuine swap entry, hence a private anon page */ -+ if (!should_zap_cows(details)) -+ continue; - rss[MM_SWAPENTS]--; -- else if (is_migration_entry(entry)) { -+ } else if (is_migration_entry(entry)) { - struct page *page; - - page = migration_entry_to_page(entry); -+ if (details && details->check_mapping && -+ details->check_mapping != page_rmapping(page)) -+ continue; - rss[mm_counter(page)]--; - } - if (unlikely(!free_swap_and_cache(entry))) -@@ -3245,11 +3258,20 @@ static vm_fault_t __do_fault(struct vm_fault *vmf) - return ret; - - if (unlikely(PageHWPoison(vmf->page))) { -- if (ret & VM_FAULT_LOCKED) -- unlock_page(vmf->page); -- put_page(vmf->page); -+ struct page *page = vmf->page; -+ vm_fault_t poisonret = VM_FAULT_HWPOISON; -+ if (ret & VM_FAULT_LOCKED) { -+ if (page_mapped(page)) -+ unmap_mapping_pages(page_mapping(page), -+ page->index, 1, false); -+ /* Retry if a clean page was removed from the cache. */ -+ if (invalidate_inode_page(page)) -+ poisonret = VM_FAULT_NOPAGE; -+ unlock_page(page); -+ } -+ put_page(page); - vmf->page = NULL; -- return VM_FAULT_HWPOISON; -+ return poisonret; - } - - if (unlikely(!(ret & VM_FAULT_LOCKED))) -diff --git a/mm/mempolicy.c b/mm/mempolicy.c -index 2c4082f71d258..d79ab5116a7be 100644 ---- a/mm/mempolicy.c -+++ b/mm/mempolicy.c -@@ -731,7 +731,6 @@ static int vma_replace_policy(struct vm_area_struct *vma, - static int mbind_range(struct mm_struct *mm, unsigned long start, - unsigned long end, struct mempolicy *new_pol) - { -- struct vm_area_struct *next; - struct vm_area_struct *prev; - struct vm_area_struct *vma; - int err = 0; -@@ -747,8 +746,7 @@ static int mbind_range(struct mm_struct *mm, unsigned long start, - if (start > vma->vm_start) - prev = vma; - -- for (; vma && vma->vm_start < end; prev = vma, vma = next) { -- next = vma->vm_next; -+ for (; vma && vma->vm_start < end; prev = vma, vma = vma->vm_next) { - vmstart = max(start, vma->vm_start); - vmend = min(end, vma->vm_end); - -@@ -762,10 +760,6 @@ static int mbind_range(struct mm_struct *mm, unsigned long start, - new_pol, vma->vm_userfaultfd_ctx); - if (prev) { - vma = prev; -- next = vma->vm_next; -- if (mpol_equal(vma_policy(vma), new_pol)) -- continue; -- /* vma_merge() joined vma && vma->next, case 8 */ - goto replace; - } - if (vma->vm_start != vmstart) { -@@ -2565,6 +2559,7 @@ alloc_new: - mpol_new = kmem_cache_alloc(policy_cache, GFP_KERNEL); - if (!mpol_new) - goto err_out; -+ atomic_set(&mpol_new->refcnt, 1); - goto restart; - } - -diff --git a/mm/mmap.c b/mm/mmap.c -index ba78f1f1b1bd1..58cfd5b1e0b16 100644 ---- a/mm/mmap.c -+++ b/mm/mmap.c -@@ -2515,7 +2515,7 @@ static int __init cmdline_parse_stack_guard_gap(char *p) - if (!*endptr) - stack_guard_gap = val << PAGE_SHIFT; - -- return 0; -+ return 1; - } - __setup("stack_guard_gap=", cmdline_parse_stack_guard_gap); - -diff --git a/mm/mremap.c b/mm/mremap.c -index 8005d0b2b8438..8ce1b7632fbb8 100644 ---- a/mm/mremap.c -+++ b/mm/mremap.c -@@ -246,6 +246,9 @@ unsigned long move_page_tables(struct vm_area_struct *vma, - struct mmu_notifier_range range; - pmd_t *old_pmd, *new_pmd; - -+ if (!len) -+ return 0; -+ - old_end = old_addr + len; - flush_cache_range(vma, old_addr, old_end); - -diff --git a/mm/page_alloc.c b/mm/page_alloc.c -index c3835915d1157..5038611563dfb 100644 ---- a/mm/page_alloc.c -+++ b/mm/page_alloc.c -@@ -7326,10 +7326,17 @@ restart: - - out2: - /* Align start of ZONE_MOVABLE on all nids to MAX_ORDER_NR_PAGES */ -- for (nid = 0; nid < MAX_NUMNODES; nid++) -+ for (nid = 0; nid < MAX_NUMNODES; nid++) { -+ unsigned long start_pfn, end_pfn; -+ - zone_movable_pfn[nid] = - roundup(zone_movable_pfn[nid], MAX_ORDER_NR_PAGES); - -+ get_pfn_range_for_nid(nid, &start_pfn, &end_pfn); -+ if (zone_movable_pfn[nid] >= end_pfn) -+ zone_movable_pfn[nid] = 0; -+ } -+ - out: - /* restore the node_state */ - node_states[N_MEMORY] = saved_node_state; -diff --git a/mm/rmap.c b/mm/rmap.c -index 45f2106852e84..6d80e92688fe7 100644 ---- a/mm/rmap.c -+++ b/mm/rmap.c -@@ -1602,7 +1602,30 @@ static bool try_to_unmap_one(struct page *page, struct vm_area_struct *vma, - - /* MADV_FREE page check */ - if (!PageSwapBacked(page)) { -- if (!PageDirty(page)) { -+ int ref_count, map_count; -+ -+ /* -+ * Synchronize with gup_pte_range(): -+ * - clear PTE; barrier; read refcount -+ * - inc refcount; barrier; read PTE -+ */ -+ smp_mb(); -+ -+ ref_count = page_ref_count(page); -+ map_count = page_mapcount(page); -+ -+ /* -+ * Order reads for page refcount and dirty flag -+ * (see comments in __remove_mapping()). -+ */ -+ smp_rmb(); -+ -+ /* -+ * The only page refs must be one from isolation -+ * plus the rmap(s) (dropped by discard:). -+ */ -+ if (ref_count == 1 + map_count && -+ !PageDirty(page)) { - /* Invalidate as we cleared the pte */ - mmu_notifier_invalidate_range(mm, - address, address + PAGE_SIZE); -diff --git a/mm/usercopy.c b/mm/usercopy.c -index 660717a1ea5cd..f70455bad7f32 100644 ---- a/mm/usercopy.c -+++ b/mm/usercopy.c -@@ -294,7 +294,10 @@ static bool enable_checks __initdata = true; - - static int __init parse_hardened_usercopy(char *str) - { -- return strtobool(str, &enable_checks); -+ if (strtobool(str, &enable_checks)) -+ pr_warn("Invalid option string for hardened_usercopy: '%s'\n", -+ str); -+ return 1; - } - - __setup("hardened_usercopy=", parse_hardened_usercopy); -diff --git a/net/batman-adv/multicast.c b/net/batman-adv/multicast.c -index 09d81f9c2a649..6f0a9f4392333 100644 ---- a/net/batman-adv/multicast.c -+++ b/net/batman-adv/multicast.c -@@ -136,7 +136,7 @@ static u8 batadv_mcast_mla_rtr_flags_softif_get_ipv6(struct net_device *dev) - { - struct inet6_dev *in6_dev = __in6_dev_get(dev); - -- if (in6_dev && in6_dev->cnf.mc_forwarding) -+ if (in6_dev && atomic_read(&in6_dev->cnf.mc_forwarding)) - return BATADV_NO_FLAGS; - else - return BATADV_MCAST_WANT_NO_RTR6; -diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c -index 082a262ab49c3..ff6625493c9f8 100644 ---- a/net/bluetooth/hci_event.c -+++ b/net/bluetooth/hci_event.c -@@ -4911,8 +4911,9 @@ static void hci_disconn_phylink_complete_evt(struct hci_dev *hdev, - hci_dev_lock(hdev); - - hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle); -- if (hcon) { -+ if (hcon && hcon->type == AMP_LINK) { - hcon->state = BT_CLOSED; -+ hci_disconn_cfm(hcon, ev->reason); - hci_conn_del(hcon); - } - -diff --git a/net/core/filter.c b/net/core/filter.c -index d39518f691b4b..e16b2b5cda981 100644 ---- a/net/core/filter.c -+++ b/net/core/filter.c -@@ -5824,24 +5824,33 @@ BPF_CALL_5(bpf_tcp_check_syncookie, struct sock *, sk, void *, iph, u32, iph_len - if (!th->ack || th->rst || th->syn) - return -ENOENT; - -+ if (unlikely(iph_len < sizeof(struct iphdr))) -+ return -EINVAL; -+ - if (tcp_synq_no_recent_overflow(sk)) - return -ENOENT; - - cookie = ntohl(th->ack_seq) - 1; - -- switch (sk->sk_family) { -- case AF_INET: -- if (unlikely(iph_len < sizeof(struct iphdr))) -+ /* Both struct iphdr and struct ipv6hdr have the version field at the -+ * same offset so we can cast to the shorter header (struct iphdr). -+ */ -+ switch (((struct iphdr *)iph)->version) { -+ case 4: -+ if (sk->sk_family == AF_INET6 && ipv6_only_sock(sk)) - return -EINVAL; - - ret = __cookie_v4_check((struct iphdr *)iph, th, cookie); - break; - - #if IS_BUILTIN(CONFIG_IPV6) -- case AF_INET6: -+ case 6: - if (unlikely(iph_len < sizeof(struct ipv6hdr))) - return -EINVAL; - -+ if (sk->sk_family != AF_INET6) -+ return -EINVAL; -+ - ret = __cookie_v6_check((struct ipv6hdr *)iph, th, cookie); - break; - #endif /* CONFIG_IPV6 */ -@@ -6708,6 +6717,7 @@ bool bpf_sock_is_valid_access(int off, int size, enum bpf_access_type type, - struct bpf_insn_access_aux *info) - { - const int size_default = sizeof(__u32); -+ int field_size; - - if (off < 0 || off >= sizeof(struct bpf_sock)) - return false; -@@ -6719,7 +6729,6 @@ bool bpf_sock_is_valid_access(int off, int size, enum bpf_access_type type, - case offsetof(struct bpf_sock, family): - case offsetof(struct bpf_sock, type): - case offsetof(struct bpf_sock, protocol): -- case offsetof(struct bpf_sock, dst_port): - case offsetof(struct bpf_sock, src_port): - case bpf_ctx_range(struct bpf_sock, src_ip4): - case bpf_ctx_range_till(struct bpf_sock, src_ip6[0], src_ip6[3]): -@@ -6727,6 +6736,14 @@ bool bpf_sock_is_valid_access(int off, int size, enum bpf_access_type type, - case bpf_ctx_range_till(struct bpf_sock, dst_ip6[0], dst_ip6[3]): - bpf_ctx_record_field_size(info, size_default); - return bpf_ctx_narrow_access_ok(off, size, size_default); -+ case bpf_ctx_range(struct bpf_sock, dst_port): -+ field_size = size == size_default ? -+ size_default : sizeof_field(struct bpf_sock, dst_port); -+ bpf_ctx_record_field_size(info, field_size); -+ return bpf_ctx_narrow_access_ok(off, size, field_size); -+ case offsetofend(struct bpf_sock, dst_port) ... -+ offsetof(struct bpf_sock, dst_ip4) - 1: -+ return false; - } - - return size == size_default; -diff --git a/net/core/skmsg.c b/net/core/skmsg.c -index 17cc1edd149cb..a606ad8e8be25 100644 ---- a/net/core/skmsg.c -+++ b/net/core/skmsg.c -@@ -27,6 +27,7 @@ int sk_msg_alloc(struct sock *sk, struct sk_msg *msg, int len, - int elem_first_coalesce) - { - struct page_frag *pfrag = sk_page_frag(sk); -+ u32 osize = msg->sg.size; - int ret = 0; - - len -= msg->sg.size; -@@ -35,13 +36,17 @@ int sk_msg_alloc(struct sock *sk, struct sk_msg *msg, int len, - u32 orig_offset; - int use, i; - -- if (!sk_page_frag_refill(sk, pfrag)) -- return -ENOMEM; -+ if (!sk_page_frag_refill(sk, pfrag)) { -+ ret = -ENOMEM; -+ goto msg_trim; -+ } - - orig_offset = pfrag->offset; - use = min_t(int, len, pfrag->size - orig_offset); -- if (!sk_wmem_schedule(sk, use)) -- return -ENOMEM; -+ if (!sk_wmem_schedule(sk, use)) { -+ ret = -ENOMEM; -+ goto msg_trim; -+ } - - i = msg->sg.end; - sk_msg_iter_var_prev(i); -@@ -71,6 +76,10 @@ int sk_msg_alloc(struct sock *sk, struct sk_msg *msg, int len, - } - - return ret; -+ -+msg_trim: -+ sk_msg_trim(sk, msg, osize); -+ return ret; - } - EXPORT_SYMBOL_GPL(sk_msg_alloc); - -diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c -index 7b951992c372b..b8fe943ae89d0 100644 ---- a/net/ipv4/arp.c -+++ b/net/ipv4/arp.c -@@ -1116,13 +1116,18 @@ static int arp_req_get(struct arpreq *r, struct net_device *dev) - return err; - } - --static int arp_invalidate(struct net_device *dev, __be32 ip) -+int arp_invalidate(struct net_device *dev, __be32 ip, bool force) - { - struct neighbour *neigh = neigh_lookup(&arp_tbl, &ip, dev); - int err = -ENXIO; - struct neigh_table *tbl = &arp_tbl; - - if (neigh) { -+ if ((neigh->nud_state & NUD_VALID) && !force) { -+ neigh_release(neigh); -+ return 0; -+ } -+ - if (neigh->nud_state & ~NUD_NOARP) - err = neigh_update(neigh, NULL, NUD_FAILED, - NEIGH_UPDATE_F_OVERRIDE| -@@ -1169,7 +1174,7 @@ static int arp_req_delete(struct net *net, struct arpreq *r, - if (!dev) - return -EINVAL; - } -- return arp_invalidate(dev, ip); -+ return arp_invalidate(dev, ip, true); - } - - /* -diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c -index a95102fe66371..ef3e7a3e3a29e 100644 ---- a/net/ipv4/fib_frontend.c -+++ b/net/ipv4/fib_frontend.c -@@ -1122,9 +1122,11 @@ void fib_add_ifaddr(struct in_ifaddr *ifa) - return; - - /* Add broadcast address, if it is explicitly assigned. */ -- if (ifa->ifa_broadcast && ifa->ifa_broadcast != htonl(0xFFFFFFFF)) -+ if (ifa->ifa_broadcast && ifa->ifa_broadcast != htonl(0xFFFFFFFF)) { - fib_magic(RTM_NEWROUTE, RTN_BROADCAST, ifa->ifa_broadcast, 32, - prim, 0); -+ arp_invalidate(dev, ifa->ifa_broadcast, false); -+ } - - if (!ipv4_is_zeronet(prefix) && !(ifa->ifa_flags & IFA_F_SECONDARY) && - (prefix != addr || ifa->ifa_prefixlen < 32)) { -@@ -1140,6 +1142,7 @@ void fib_add_ifaddr(struct in_ifaddr *ifa) - prim, 0); - fib_magic(RTM_NEWROUTE, RTN_BROADCAST, prefix | ~mask, - 32, prim, 0); -+ arp_invalidate(dev, prefix | ~mask, false); - } - } - } -diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c -index 692ba6d6180f8..f99ad4a98907d 100644 ---- a/net/ipv4/fib_semantics.c -+++ b/net/ipv4/fib_semantics.c -@@ -876,8 +876,13 @@ int fib_nh_match(struct fib_config *cfg, struct fib_info *fi, - } - - if (cfg->fc_oif || cfg->fc_gw_family) { -- struct fib_nh *nh = fib_info_nh(fi, 0); -+ struct fib_nh *nh; -+ -+ /* cannot match on nexthop object attributes */ -+ if (fi->nh) -+ return 1; - -+ nh = fib_info_nh(fi, 0); - if (cfg->fc_encap) { - if (fib_encap_match(cfg->fc_encap_type, cfg->fc_encap, - nh, cfg, extack)) -diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c -index 7df7ec74807ac..bcc13368c8363 100644 ---- a/net/ipv4/tcp_bpf.c -+++ b/net/ipv4/tcp_bpf.c -@@ -296,10 +296,9 @@ int tcp_bpf_sendmsg_redir(struct sock *sk, struct sk_msg *msg, - struct sk_psock *psock = sk_psock_get(sk); - int ret; - -- if (unlikely(!psock)) { -- sk_msg_free(sk, msg); -- return 0; -- } -+ if (unlikely(!psock)) -+ return -EPIPE; -+ - ret = ingress ? bpf_tcp_ingress(sk, psock, msg, bytes, flags) : - tcp_bpf_push_locked(sk, msg, bytes, flags, false); - sk_psock_put(sk, psock); -@@ -367,7 +366,7 @@ more_data: - cork = true; - psock->cork = NULL; - } -- sk_msg_return(sk, msg, tosend); -+ sk_msg_return(sk, msg, msg->sg.size); - release_sock(sk); - - ret = tcp_bpf_sendmsg_redir(sk_redir, msg, tosend, flags); -@@ -407,8 +406,11 @@ more_data: - } - if (msg && - msg->sg.data[msg->sg.start].page_link && -- msg->sg.data[msg->sg.start].length) -+ msg->sg.data[msg->sg.start].length) { -+ if (eval == __SK_REDIRECT) -+ sk_mem_charge(sk, msg->sg.size); - goto more_data; -+ } - } - return ret; - } -diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c -index 638d7b49ad716..139e962d1aef3 100644 ---- a/net/ipv4/tcp_output.c -+++ b/net/ipv4/tcp_output.c -@@ -3492,6 +3492,7 @@ static void tcp_connect_queue_skb(struct sock *sk, struct sk_buff *skb) - */ - static int tcp_send_syn_data(struct sock *sk, struct sk_buff *syn) - { -+ struct inet_connection_sock *icsk = inet_csk(sk); - struct tcp_sock *tp = tcp_sk(sk); - struct tcp_fastopen_request *fo = tp->fastopen_req; - int space, err = 0; -@@ -3506,8 +3507,10 @@ static int tcp_send_syn_data(struct sock *sk, struct sk_buff *syn) - * private TCP options. The cost is reduced data space in SYN :( - */ - tp->rx_opt.mss_clamp = tcp_mss_clamp(tp, tp->rx_opt.mss_clamp); -+ /* Sync mss_cache after updating the mss_clamp */ -+ tcp_sync_mss(sk, icsk->icsk_pmtu_cookie); - -- space = __tcp_mtu_to_mss(sk, inet_csk(sk)->icsk_pmtu_cookie) - -+ space = __tcp_mtu_to_mss(sk, icsk->icsk_pmtu_cookie) - - MAX_TCP_OPTION_SPACE; - - space = min_t(size_t, space, fo->size); -diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c -index 3cdf011a8dd8d..83fd4fa40d5e6 100644 ---- a/net/ipv4/udp.c -+++ b/net/ipv4/udp.c -@@ -544,6 +544,12 @@ void udp_encap_enable(void) - } - EXPORT_SYMBOL(udp_encap_enable); - -+void udp_encap_disable(void) -+{ -+ static_branch_dec(&udp_encap_needed_key); -+} -+EXPORT_SYMBOL(udp_encap_disable); -+ - /* Handler for tunnels with arbitrary destination ports: no socket lookup, go - * through error handlers in encapsulations looking for a match. - */ -diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c -index 60d070b254846..69aef71f32ea7 100644 ---- a/net/ipv6/addrconf.c -+++ b/net/ipv6/addrconf.c -@@ -542,7 +542,7 @@ static int inet6_netconf_fill_devconf(struct sk_buff *skb, int ifindex, - #ifdef CONFIG_IPV6_MROUTE - if ((all || type == NETCONFA_MC_FORWARDING) && - nla_put_s32(skb, NETCONFA_MC_FORWARDING, -- devconf->mc_forwarding) < 0) -+ atomic_read(&devconf->mc_forwarding)) < 0) - goto nla_put_failure; - #endif - if ((all || type == NETCONFA_PROXY_NEIGH) && -@@ -5460,7 +5460,7 @@ static inline void ipv6_store_devconf(struct ipv6_devconf *cnf, - array[DEVCONF_USE_OPTIMISTIC] = cnf->use_optimistic; - #endif - #ifdef CONFIG_IPV6_MROUTE -- array[DEVCONF_MC_FORWARDING] = cnf->mc_forwarding; -+ array[DEVCONF_MC_FORWARDING] = atomic_read(&cnf->mc_forwarding); - #endif - array[DEVCONF_DISABLE_IPV6] = cnf->disable_ipv6; - array[DEVCONF_ACCEPT_DAD] = cnf->accept_dad; -diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c -index 7e5df23cbe7bf..e6c4966aa956c 100644 ---- a/net/ipv6/ip6_input.c -+++ b/net/ipv6/ip6_input.c -@@ -485,7 +485,7 @@ int ip6_mc_input(struct sk_buff *skb) - /* - * IPv6 multicast router mode is now supported ;) - */ -- if (dev_net(skb->dev)->ipv6.devconf_all->mc_forwarding && -+ if (atomic_read(&dev_net(skb->dev)->ipv6.devconf_all->mc_forwarding) && - !(ipv6_addr_type(&hdr->daddr) & - (IPV6_ADDR_LOOPBACK|IPV6_ADDR_LINKLOCAL)) && - likely(!(IP6CB(skb)->flags & IP6SKB_FORWARDED))) { -diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c -index aee1f6bc039ab..6248e00c2bf72 100644 ---- a/net/ipv6/ip6mr.c -+++ b/net/ipv6/ip6mr.c -@@ -736,7 +736,7 @@ static int mif6_delete(struct mr_table *mrt, int vifi, int notify, - - in6_dev = __in6_dev_get(dev); - if (in6_dev) { -- in6_dev->cnf.mc_forwarding--; -+ atomic_dec(&in6_dev->cnf.mc_forwarding); - inet6_netconf_notify_devconf(dev_net(dev), RTM_NEWNETCONF, - NETCONFA_MC_FORWARDING, - dev->ifindex, &in6_dev->cnf); -@@ -904,7 +904,7 @@ static int mif6_add(struct net *net, struct mr_table *mrt, - - in6_dev = __in6_dev_get(dev); - if (in6_dev) { -- in6_dev->cnf.mc_forwarding++; -+ atomic_inc(&in6_dev->cnf.mc_forwarding); - inet6_netconf_notify_devconf(dev_net(dev), RTM_NEWNETCONF, - NETCONFA_MC_FORWARDING, - dev->ifindex, &in6_dev->cnf); -@@ -1553,7 +1553,7 @@ static int ip6mr_sk_init(struct mr_table *mrt, struct sock *sk) - } else { - rcu_assign_pointer(mrt->mroute_sk, sk); - sock_set_flag(sk, SOCK_RCU_FREE); -- net->ipv6.devconf_all->mc_forwarding++; -+ atomic_inc(&net->ipv6.devconf_all->mc_forwarding); - } - write_unlock_bh(&mrt_lock); - -@@ -1586,7 +1586,7 @@ int ip6mr_sk_done(struct sock *sk) - * so the RCU grace period before sk freeing - * is guaranteed by sk_destruct() - */ -- net->ipv6.devconf_all->mc_forwarding--; -+ atomic_dec(&net->ipv6.devconf_all->mc_forwarding); - write_unlock_bh(&mrt_lock); - inet6_netconf_notify_devconf(net, RTM_NEWNETCONF, - NETCONFA_MC_FORWARDING, -diff --git a/net/ipv6/route.c b/net/ipv6/route.c -index 2a13394ab8541..619d9dffa9e44 100644 ---- a/net/ipv6/route.c -+++ b/net/ipv6/route.c -@@ -4403,7 +4403,7 @@ static int ip6_pkt_drop(struct sk_buff *skb, u8 code, int ipstats_mib_noroutes) - struct inet6_dev *idev; - int type; - -- if (netif_is_l3_master(skb->dev) && -+ if (netif_is_l3_master(skb->dev) || - dst->dev == net->loopback_dev) - idev = __in6_dev_get_safely(dev_get_by_index_rcu(net, IP6CB(skb)->iif)); - else -diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c -index a71bfa5b02770..040869f45682d 100644 ---- a/net/ipv6/udp.c -+++ b/net/ipv6/udp.c -@@ -1553,8 +1553,10 @@ void udpv6_destroy_sock(struct sock *sk) - if (encap_destroy) - encap_destroy(sk); - } -- if (up->encap_enabled) -+ if (up->encap_enabled) { - static_branch_dec(&udpv6_encap_needed_key); -+ udp_encap_disable(); -+ } - } - - inet6_destroy_sock(sk); -diff --git a/net/ipv6/xfrm6_output.c b/net/ipv6/xfrm6_output.c -index 6b0ed6c593e2b..a6f13fab963f7 100644 ---- a/net/ipv6/xfrm6_output.c -+++ b/net/ipv6/xfrm6_output.c -@@ -140,6 +140,19 @@ static int __xfrm6_output_finish(struct net *net, struct sock *sk, struct sk_buf - return __xfrm6_output_state_finish(x, sk, skb); - } - -+static int xfrm6_noneed_fragment(struct sk_buff *skb) -+{ -+ struct frag_hdr *fh; -+ u8 prevhdr = ipv6_hdr(skb)->nexthdr; -+ -+ if (prevhdr != NEXTHDR_FRAGMENT) -+ return 0; -+ fh = (struct frag_hdr *)(skb->data + sizeof(struct ipv6hdr)); -+ if (fh->nexthdr == NEXTHDR_ESP || fh->nexthdr == NEXTHDR_AUTH) -+ return 1; -+ return 0; -+} -+ - static int __xfrm6_output(struct net *net, struct sock *sk, struct sk_buff *skb) - { - struct dst_entry *dst = skb_dst(skb); -@@ -168,6 +181,9 @@ static int __xfrm6_output(struct net *net, struct sock *sk, struct sk_buff *skb) - xfrm6_local_rxpmtu(skb, mtu); - kfree_skb(skb); - return -EMSGSIZE; -+ } else if (toobig && xfrm6_noneed_fragment(skb)) { -+ skb->ignore_df = 1; -+ goto skip_frag; - } else if (!skb->ignore_df && toobig && skb->sk) { - xfrm_local_error(skb, mtu); - kfree_skb(skb); -diff --git a/net/key/af_key.c b/net/key/af_key.c -index 406e13478b01b..2ac9560020f91 100644 ---- a/net/key/af_key.c -+++ b/net/key/af_key.c -@@ -1703,7 +1703,7 @@ static int pfkey_register(struct sock *sk, struct sk_buff *skb, const struct sad - - xfrm_probe_algs(); - -- supp_skb = compose_sadb_supported(hdr, GFP_KERNEL); -+ supp_skb = compose_sadb_supported(hdr, GFP_KERNEL | __GFP_ZERO); - if (!supp_skb) { - if (hdr->sadb_msg_satype != SADB_SATYPE_UNSPEC) - pfk->registered &= ~(1<sadb_msg_satype); -diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c -index 848b137151c26..b8cc3339a2495 100644 ---- a/net/netfilter/nf_conntrack_proto_tcp.c -+++ b/net/netfilter/nf_conntrack_proto_tcp.c -@@ -354,8 +354,8 @@ static void tcp_options(const struct sk_buff *skb, - length, buff); - BUG_ON(ptr == NULL); - -- state->td_scale = -- state->flags = 0; -+ state->td_scale = 0; -+ state->flags &= IP_CT_TCP_FLAG_BE_LIBERAL; - - while (length > 0) { - int opcode=*ptr++; -@@ -840,6 +840,16 @@ static bool nf_conntrack_tcp_established(const struct nf_conn *ct) - test_bit(IPS_ASSURED_BIT, &ct->status); - } - -+static void nf_ct_tcp_state_reset(struct ip_ct_tcp_state *state) -+{ -+ state->td_end = 0; -+ state->td_maxend = 0; -+ state->td_maxwin = 0; -+ state->td_maxack = 0; -+ state->td_scale = 0; -+ state->flags &= IP_CT_TCP_FLAG_BE_LIBERAL; -+} -+ - /* Returns verdict for packet, or -1 for invalid. */ - int nf_conntrack_tcp_packet(struct nf_conn *ct, - struct sk_buff *skb, -@@ -946,8 +956,7 @@ int nf_conntrack_tcp_packet(struct nf_conn *ct, - ct->proto.tcp.last_flags &= ~IP_CT_EXP_CHALLENGE_ACK; - ct->proto.tcp.seen[ct->proto.tcp.last_dir].flags = - ct->proto.tcp.last_flags; -- memset(&ct->proto.tcp.seen[dir], 0, -- sizeof(struct ip_ct_tcp_state)); -+ nf_ct_tcp_state_reset(&ct->proto.tcp.seen[dir]); - break; - } - ct->proto.tcp.last_index = index; -diff --git a/net/netlabel/netlabel_kapi.c b/net/netlabel/netlabel_kapi.c -index 5e1239cef0005..91b35b7c80d82 100644 ---- a/net/netlabel/netlabel_kapi.c -+++ b/net/netlabel/netlabel_kapi.c -@@ -885,6 +885,8 @@ int netlbl_bitmap_walk(const unsigned char *bitmap, u32 bitmap_len, - unsigned char bitmask; - unsigned char byte; - -+ if (offset >= bitmap_len) -+ return -1; - byte_offset = offset / 8; - byte = bitmap[byte_offset]; - bit_spot = offset; -diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c -index 891e029ad0f89..fb28969899af0 100644 ---- a/net/netlink/af_netlink.c -+++ b/net/netlink/af_netlink.c -@@ -148,6 +148,8 @@ static const struct rhashtable_params netlink_rhashtable_params; - - static inline u32 netlink_group_mask(u32 group) - { -+ if (group > 32) -+ return 0; - return group ? 1 << (group - 1) : 0; - } - -diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c -index 2c0f8cbc5c43b..ae40593daf214 100644 ---- a/net/openvswitch/actions.c -+++ b/net/openvswitch/actions.c -@@ -1037,7 +1037,7 @@ static int clone(struct datapath *dp, struct sk_buff *skb, - int rem = nla_len(attr); - bool dont_clone_flow_key; - -- /* The first action is always 'OVS_CLONE_ATTR_ARG'. */ -+ /* The first action is always 'OVS_CLONE_ATTR_EXEC'. */ - clone_arg = nla_data(attr); - dont_clone_flow_key = nla_get_u32(clone_arg); - actions = nla_next(clone_arg, &rem); -diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c -index b6f98eba71f1b..816036b9c223a 100644 ---- a/net/openvswitch/conntrack.c -+++ b/net/openvswitch/conntrack.c -@@ -730,6 +730,57 @@ static bool skb_nfct_cached(struct net *net, - } - - #if IS_ENABLED(CONFIG_NF_NAT) -+static void ovs_nat_update_key(struct sw_flow_key *key, -+ const struct sk_buff *skb, -+ enum nf_nat_manip_type maniptype) -+{ -+ if (maniptype == NF_NAT_MANIP_SRC) { -+ __be16 src; -+ -+ key->ct_state |= OVS_CS_F_SRC_NAT; -+ if (key->eth.type == htons(ETH_P_IP)) -+ key->ipv4.addr.src = ip_hdr(skb)->saddr; -+ else if (key->eth.type == htons(ETH_P_IPV6)) -+ memcpy(&key->ipv6.addr.src, &ipv6_hdr(skb)->saddr, -+ sizeof(key->ipv6.addr.src)); -+ else -+ return; -+ -+ if (key->ip.proto == IPPROTO_UDP) -+ src = udp_hdr(skb)->source; -+ else if (key->ip.proto == IPPROTO_TCP) -+ src = tcp_hdr(skb)->source; -+ else if (key->ip.proto == IPPROTO_SCTP) -+ src = sctp_hdr(skb)->source; -+ else -+ return; -+ -+ key->tp.src = src; -+ } else { -+ __be16 dst; -+ -+ key->ct_state |= OVS_CS_F_DST_NAT; -+ if (key->eth.type == htons(ETH_P_IP)) -+ key->ipv4.addr.dst = ip_hdr(skb)->daddr; -+ else if (key->eth.type == htons(ETH_P_IPV6)) -+ memcpy(&key->ipv6.addr.dst, &ipv6_hdr(skb)->daddr, -+ sizeof(key->ipv6.addr.dst)); -+ else -+ return; -+ -+ if (key->ip.proto == IPPROTO_UDP) -+ dst = udp_hdr(skb)->dest; -+ else if (key->ip.proto == IPPROTO_TCP) -+ dst = tcp_hdr(skb)->dest; -+ else if (key->ip.proto == IPPROTO_SCTP) -+ dst = sctp_hdr(skb)->dest; -+ else -+ return; -+ -+ key->tp.dst = dst; -+ } -+} -+ - /* Modelled after nf_nat_ipv[46]_fn(). - * range is only used for new, uninitialized NAT state. - * Returns either NF_ACCEPT or NF_DROP. -@@ -737,7 +788,7 @@ static bool skb_nfct_cached(struct net *net, - static int ovs_ct_nat_execute(struct sk_buff *skb, struct nf_conn *ct, - enum ip_conntrack_info ctinfo, - const struct nf_nat_range2 *range, -- enum nf_nat_manip_type maniptype) -+ enum nf_nat_manip_type maniptype, struct sw_flow_key *key) - { - int hooknum, nh_off, err = NF_ACCEPT; - -@@ -810,58 +861,11 @@ push: - skb_push(skb, nh_off); - skb_postpush_rcsum(skb, skb->data, nh_off); - -- return err; --} -- --static void ovs_nat_update_key(struct sw_flow_key *key, -- const struct sk_buff *skb, -- enum nf_nat_manip_type maniptype) --{ -- if (maniptype == NF_NAT_MANIP_SRC) { -- __be16 src; -- -- key->ct_state |= OVS_CS_F_SRC_NAT; -- if (key->eth.type == htons(ETH_P_IP)) -- key->ipv4.addr.src = ip_hdr(skb)->saddr; -- else if (key->eth.type == htons(ETH_P_IPV6)) -- memcpy(&key->ipv6.addr.src, &ipv6_hdr(skb)->saddr, -- sizeof(key->ipv6.addr.src)); -- else -- return; -- -- if (key->ip.proto == IPPROTO_UDP) -- src = udp_hdr(skb)->source; -- else if (key->ip.proto == IPPROTO_TCP) -- src = tcp_hdr(skb)->source; -- else if (key->ip.proto == IPPROTO_SCTP) -- src = sctp_hdr(skb)->source; -- else -- return; -- -- key->tp.src = src; -- } else { -- __be16 dst; -- -- key->ct_state |= OVS_CS_F_DST_NAT; -- if (key->eth.type == htons(ETH_P_IP)) -- key->ipv4.addr.dst = ip_hdr(skb)->daddr; -- else if (key->eth.type == htons(ETH_P_IPV6)) -- memcpy(&key->ipv6.addr.dst, &ipv6_hdr(skb)->daddr, -- sizeof(key->ipv6.addr.dst)); -- else -- return; -- -- if (key->ip.proto == IPPROTO_UDP) -- dst = udp_hdr(skb)->dest; -- else if (key->ip.proto == IPPROTO_TCP) -- dst = tcp_hdr(skb)->dest; -- else if (key->ip.proto == IPPROTO_SCTP) -- dst = sctp_hdr(skb)->dest; -- else -- return; -+ /* Update the flow key if NAT successful. */ -+ if (err == NF_ACCEPT) -+ ovs_nat_update_key(key, skb, maniptype); - -- key->tp.dst = dst; -- } -+ return err; - } - - /* Returns NF_DROP if the packet should be dropped, NF_ACCEPT otherwise. */ -@@ -903,7 +907,7 @@ static int ovs_ct_nat(struct net *net, struct sw_flow_key *key, - } else { - return NF_ACCEPT; /* Connection is not NATed. */ - } -- err = ovs_ct_nat_execute(skb, ct, ctinfo, &info->range, maniptype); -+ err = ovs_ct_nat_execute(skb, ct, ctinfo, &info->range, maniptype, key); - - if (err == NF_ACCEPT && ct->status & IPS_DST_NAT) { - if (ct->status & IPS_SRC_NAT) { -@@ -913,17 +917,13 @@ static int ovs_ct_nat(struct net *net, struct sw_flow_key *key, - maniptype = NF_NAT_MANIP_SRC; - - err = ovs_ct_nat_execute(skb, ct, ctinfo, &info->range, -- maniptype); -+ maniptype, key); - } else if (CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL) { - err = ovs_ct_nat_execute(skb, ct, ctinfo, NULL, -- NF_NAT_MANIP_SRC); -+ NF_NAT_MANIP_SRC, key); - } - } - -- /* Mark NAT done if successful and update the flow key. */ -- if (err == NF_ACCEPT) -- ovs_nat_update_key(key, skb, maniptype); -- - return err; - } - #else /* !CONFIG_NF_NAT */ -diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c -index d7559c64795dc..d3f068ad154cb 100644 ---- a/net/openvswitch/flow_netlink.c -+++ b/net/openvswitch/flow_netlink.c -@@ -2179,8 +2179,8 @@ static int __ovs_nla_put_key(const struct sw_flow_key *swkey, - icmpv6_key->icmpv6_type = ntohs(output->tp.src); - icmpv6_key->icmpv6_code = ntohs(output->tp.dst); - -- if (icmpv6_key->icmpv6_type == NDISC_NEIGHBOUR_SOLICITATION || -- icmpv6_key->icmpv6_type == NDISC_NEIGHBOUR_ADVERTISEMENT) { -+ if (swkey->tp.src == htons(NDISC_NEIGHBOUR_SOLICITATION) || -+ swkey->tp.src == htons(NDISC_NEIGHBOUR_ADVERTISEMENT)) { - struct ovs_key_nd *nd_key; - - nla = nla_reserve(skb, OVS_KEY_ATTR_ND, sizeof(*nd_key)); -@@ -3284,7 +3284,9 @@ static int clone_action_to_attr(const struct nlattr *attr, - if (!start) - return -EMSGSIZE; - -- err = ovs_nla_put_actions(nla_data(attr), rem, skb); -+ /* Skipping the OVS_CLONE_ATTR_EXEC that is always the first attribute. */ -+ attr = nla_next(nla_data(attr), &rem); -+ err = ovs_nla_put_actions(attr, rem, skb); - - if (err) - nla_nest_cancel(skb, start); -diff --git a/net/rxrpc/net_ns.c b/net/rxrpc/net_ns.c -index b312aab80fed6..9a76b74af37bc 100644 ---- a/net/rxrpc/net_ns.c -+++ b/net/rxrpc/net_ns.c -@@ -116,8 +116,8 @@ static __net_exit void rxrpc_exit_net(struct net *net) - struct rxrpc_net *rxnet = rxrpc_net(net); - - rxnet->live = false; -- del_timer_sync(&rxnet->peer_keepalive_timer); - cancel_work_sync(&rxnet->peer_keepalive_work); -+ del_timer_sync(&rxnet->peer_keepalive_timer); - rxrpc_destroy_all_calls(rxnet); - rxrpc_destroy_all_connections(rxnet); - rxrpc_destroy_all_peers(rxnet); -diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c -index 12672019f76c5..66cdfd5725acf 100644 ---- a/net/smc/smc_core.c -+++ b/net/smc/smc_core.c -@@ -734,7 +734,7 @@ static struct smc_buf_desc *smc_buf_get_slot(int compressed_bufsize, - */ - static inline int smc_rmb_wnd_update_limit(int rmbe_size) - { -- return min_t(int, rmbe_size / 10, SOCK_MIN_SNDBUF / 2); -+ return max_t(int, rmbe_size / 10, SOCK_MIN_SNDBUF / 2); - } - - static struct smc_buf_desc *smcr_new_buf_create(struct smc_link_group *lgr, -diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c -index b6039642df67e..08e1ccc01e983 100644 ---- a/net/sunrpc/clnt.c -+++ b/net/sunrpc/clnt.c -@@ -2223,6 +2223,7 @@ call_transmit_status(struct rpc_task *task) - * socket just returned a connection error, - * then hold onto the transport lock. - */ -+ case -ENOMEM: - case -ENOBUFS: - rpc_delay(task, HZ>>2); - /* fall through */ -@@ -2308,6 +2309,7 @@ call_bc_transmit_status(struct rpc_task *task) - case -ENOTCONN: - case -EPIPE: - break; -+ case -ENOMEM: - case -ENOBUFS: - rpc_delay(task, HZ>>2); - /* fall through */ -@@ -2392,6 +2394,11 @@ call_status(struct rpc_task *task) - case -EPIPE: - case -EAGAIN: - break; -+ case -ENFILE: -+ case -ENOBUFS: -+ case -ENOMEM: -+ rpc_delay(task, HZ>>2); -+ break; - case -EIO: - /* shutdown or soft timeout */ - goto out_exit; -diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c -index 8fc4a6b3422f4..32ffa801a5b97 100644 ---- a/net/sunrpc/sched.c -+++ b/net/sunrpc/sched.c -@@ -1039,8 +1039,10 @@ int rpc_malloc(struct rpc_task *task) - struct rpc_buffer *buf; - gfp_t gfp = GFP_NOFS; - -+ if (RPC_IS_ASYNC(task)) -+ gfp = GFP_NOWAIT | __GFP_NOWARN; - if (RPC_IS_SWAPPER(task)) -- gfp = __GFP_MEMALLOC | GFP_NOWAIT | __GFP_NOWARN; -+ gfp |= __GFP_MEMALLOC; - - size += sizeof(struct rpc_buffer); - if (size <= RPC_BUFFER_MAXSIZE) -diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c -index 93b6afd28405e..8ac579778e487 100644 ---- a/net/sunrpc/xprt.c -+++ b/net/sunrpc/xprt.c -@@ -2006,7 +2006,14 @@ static void xprt_destroy(struct rpc_xprt *xprt) - */ - wait_on_bit_lock(&xprt->state, XPRT_LOCKED, TASK_UNINTERRUPTIBLE); - -+ /* -+ * xprt_schedule_autodisconnect() can run after XPRT_LOCKED -+ * is cleared. We use ->transport_lock to ensure the mod_timer() -+ * can only run *before* del_time_sync(), never after. -+ */ -+ spin_lock(&xprt->transport_lock); - del_timer_sync(&xprt->timer); -+ spin_unlock(&xprt->transport_lock); - - /* - * Destroy sockets etc from the system workqueue so they can -diff --git a/net/sunrpc/xprtrdma/transport.c b/net/sunrpc/xprtrdma/transport.c -index 2f21e3c52bfc1..866bcd99bdc0e 100644 ---- a/net/sunrpc/xprtrdma/transport.c -+++ b/net/sunrpc/xprtrdma/transport.c -@@ -626,8 +626,10 @@ xprt_rdma_allocate(struct rpc_task *task) - gfp_t flags; - - flags = RPCRDMA_DEF_GFP; -+ if (RPC_IS_ASYNC(task)) -+ flags = GFP_NOWAIT | __GFP_NOWARN; - if (RPC_IS_SWAPPER(task)) -- flags = __GFP_MEMALLOC | GFP_NOWAIT | __GFP_NOWARN; -+ flags |= __GFP_MEMALLOC; - - if (!rpcrdma_check_regbuf(r_xprt, req->rl_sendbuf, rqst->rq_callsize, - flags)) -diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c -index 8ffc54b6661f8..480e879e74ae5 100644 ---- a/net/sunrpc/xprtsock.c -+++ b/net/sunrpc/xprtsock.c -@@ -872,12 +872,12 @@ out: - /** - * xs_nospace - handle transmit was incomplete - * @req: pointer to RPC request -+ * @transport: pointer to struct sock_xprt - * - */ --static int xs_nospace(struct rpc_rqst *req) -+static int xs_nospace(struct rpc_rqst *req, struct sock_xprt *transport) - { -- struct rpc_xprt *xprt = req->rq_xprt; -- struct sock_xprt *transport = container_of(xprt, struct sock_xprt, xprt); -+ struct rpc_xprt *xprt = &transport->xprt; - struct sock *sk = transport->inet; - int ret = -EAGAIN; - -@@ -891,25 +891,49 @@ static int xs_nospace(struct rpc_rqst *req) - - /* Don't race with disconnect */ - if (xprt_connected(xprt)) { -+ struct socket_wq *wq; -+ -+ rcu_read_lock(); -+ wq = rcu_dereference(sk->sk_wq); -+ set_bit(SOCKWQ_ASYNC_NOSPACE, &wq->flags); -+ rcu_read_unlock(); -+ - /* wait for more buffer space */ -+ set_bit(SOCK_NOSPACE, &sk->sk_socket->flags); - sk->sk_write_pending++; - xprt_wait_for_buffer_space(xprt); - } else - ret = -ENOTCONN; - - spin_unlock(&xprt->transport_lock); -+ return ret; -+} - -- /* Race breaker in case memory is freed before above code is called */ -- if (ret == -EAGAIN) { -- struct socket_wq *wq; -+static int xs_sock_nospace(struct rpc_rqst *req) -+{ -+ struct sock_xprt *transport = -+ container_of(req->rq_xprt, struct sock_xprt, xprt); -+ struct sock *sk = transport->inet; -+ int ret = -EAGAIN; - -- rcu_read_lock(); -- wq = rcu_dereference(sk->sk_wq); -- set_bit(SOCKWQ_ASYNC_NOSPACE, &wq->flags); -- rcu_read_unlock(); -+ lock_sock(sk); -+ if (!sock_writeable(sk)) -+ ret = xs_nospace(req, transport); -+ release_sock(sk); -+ return ret; -+} - -- sk->sk_write_space(sk); -- } -+static int xs_stream_nospace(struct rpc_rqst *req) -+{ -+ struct sock_xprt *transport = -+ container_of(req->rq_xprt, struct sock_xprt, xprt); -+ struct sock *sk = transport->inet; -+ int ret = -EAGAIN; -+ -+ lock_sock(sk); -+ if (!sk_stream_memory_free(sk)) -+ ret = xs_nospace(req, transport); -+ release_sock(sk); - return ret; - } - -@@ -996,7 +1020,7 @@ static int xs_local_send_request(struct rpc_rqst *req) - case -ENOBUFS: - break; - case -EAGAIN: -- status = xs_nospace(req); -+ status = xs_stream_nospace(req); - break; - default: - dprintk("RPC: sendmsg returned unrecognized error %d\n", -@@ -1068,7 +1092,7 @@ process_status: - /* Should we call xs_close() here? */ - break; - case -EAGAIN: -- status = xs_nospace(req); -+ status = xs_sock_nospace(req); - break; - case -ENETUNREACH: - case -ENOBUFS: -@@ -1181,7 +1205,7 @@ static int xs_tcp_send_request(struct rpc_rqst *req) - /* Should we call xs_close() here? */ - break; - case -EAGAIN: -- status = xs_nospace(req); -+ status = xs_stream_nospace(req); - break; - case -ECONNRESET: - case -ECONNREFUSED: -diff --git a/net/tipc/socket.c b/net/tipc/socket.c -index f4217673eee70..d543c4556df20 100644 ---- a/net/tipc/socket.c -+++ b/net/tipc/socket.c -@@ -2698,7 +2698,8 @@ static void tipc_sk_retry_connect(struct sock *sk, struct sk_buff_head *list) - - /* Try again later if dest link is congested */ - if (tsk->cong_link_cnt) { -- sk_reset_timer(sk, &sk->sk_timer, msecs_to_jiffies(100)); -+ sk_reset_timer(sk, &sk->sk_timer, -+ jiffies + msecs_to_jiffies(100)); - return; - } - /* Prepare SYN for retransmit */ -diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c -index 1436a36c1934a..af3be9a29d6db 100644 ---- a/net/tls/tls_sw.c -+++ b/net/tls/tls_sw.c -@@ -1479,7 +1479,7 @@ static int decrypt_internal(struct sock *sk, struct sk_buff *skb, - } - if (prot->version == TLS_1_3_VERSION) - memcpy(iv + iv_offset, tls_ctx->rx.iv, -- crypto_aead_ivsize(ctx->aead_recv)); -+ prot->iv_size + prot->salt_size); - else - memcpy(iv + iv_offset, tls_ctx->rx.iv, prot->salt_size); - -diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c -index d8d603aa48875..c94aa587e0c92 100644 ---- a/net/x25/af_x25.c -+++ b/net/x25/af_x25.c -@@ -1767,10 +1767,15 @@ void x25_kill_by_neigh(struct x25_neigh *nb) - - write_lock_bh(&x25_list_lock); - -- sk_for_each(s, &x25_list) -- if (x25_sk(s)->neighbour == nb) -+ sk_for_each(s, &x25_list) { -+ if (x25_sk(s)->neighbour == nb) { -+ write_unlock_bh(&x25_list_lock); -+ lock_sock(s); - x25_disconnect(s, ENETUNREACH, 0, 0); -- -+ release_sock(s); -+ write_lock_bh(&x25_list_lock); -+ } -+ } - write_unlock_bh(&x25_list_lock); - - /* Remove any related forwards */ -diff --git a/net/xfrm/xfrm_interface.c b/net/xfrm/xfrm_interface.c -index 3932d3aaff270..4cfa79e04e3d1 100644 ---- a/net/xfrm/xfrm_interface.c -+++ b/net/xfrm/xfrm_interface.c -@@ -300,7 +300,10 @@ xfrmi_xmit2(struct sk_buff *skb, struct net_device *dev, struct flowi *fl) - if (mtu < IPV6_MIN_MTU) - mtu = IPV6_MIN_MTU; - -- icmpv6_ndo_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu); -+ if (skb->len > 1280) -+ icmpv6_ndo_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu); -+ else -+ goto xmit; - } else { - if (!(ip_hdr(skb)->frag_off & htons(IP_DF))) - goto xmit; -diff --git a/scripts/gcc-plugins/stackleak_plugin.c b/scripts/gcc-plugins/stackleak_plugin.c -index dbd37460c573e..f46abb315010d 100644 ---- a/scripts/gcc-plugins/stackleak_plugin.c -+++ b/scripts/gcc-plugins/stackleak_plugin.c -@@ -262,6 +262,23 @@ static unsigned int stackleak_cleanup_execute(void) - return 0; - } - -+/* -+ * STRING_CST may or may not be NUL terminated: -+ * https://gcc.gnu.org/onlinedocs/gccint/Constant-expressions.html -+ */ -+static inline bool string_equal(tree node, const char *string, int length) -+{ -+ if (TREE_STRING_LENGTH(node) < length) -+ return false; -+ if (TREE_STRING_LENGTH(node) > length + 1) -+ return false; -+ if (TREE_STRING_LENGTH(node) == length + 1 && -+ TREE_STRING_POINTER(node)[length] != '\0') -+ return false; -+ return !memcmp(TREE_STRING_POINTER(node), string, length); -+} -+#define STRING_EQUAL(node, str) string_equal(node, str, strlen(str)) -+ - static bool stackleak_gate(void) - { - tree section; -@@ -271,13 +288,13 @@ static bool stackleak_gate(void) - if (section && TREE_VALUE(section)) { - section = TREE_VALUE(TREE_VALUE(section)); - -- if (!strncmp(TREE_STRING_POINTER(section), ".init.text", 10)) -+ if (STRING_EQUAL(section, ".init.text")) - return false; -- if (!strncmp(TREE_STRING_POINTER(section), ".devinit.text", 13)) -+ if (STRING_EQUAL(section, ".devinit.text")) - return false; -- if (!strncmp(TREE_STRING_POINTER(section), ".cpuinit.text", 13)) -+ if (STRING_EQUAL(section, ".cpuinit.text")) - return false; -- if (!strncmp(TREE_STRING_POINTER(section), ".meminit.text", 13)) -+ if (STRING_EQUAL(section, ".meminit.text")) - return false; - } - -diff --git a/security/keys/keyctl_pkey.c b/security/keys/keyctl_pkey.c -index 931d8dfb4a7f4..63e5c646f7620 100644 ---- a/security/keys/keyctl_pkey.c -+++ b/security/keys/keyctl_pkey.c -@@ -135,15 +135,23 @@ static int keyctl_pkey_params_get_2(const struct keyctl_pkey_params __user *_par - - switch (op) { - case KEYCTL_PKEY_ENCRYPT: -+ if (uparams.in_len > info.max_dec_size || -+ uparams.out_len > info.max_enc_size) -+ return -EINVAL; -+ break; - case KEYCTL_PKEY_DECRYPT: - if (uparams.in_len > info.max_enc_size || - uparams.out_len > info.max_dec_size) - return -EINVAL; - break; - case KEYCTL_PKEY_SIGN: -+ if (uparams.in_len > info.max_data_size || -+ uparams.out_len > info.max_sig_size) -+ return -EINVAL; -+ break; - case KEYCTL_PKEY_VERIFY: -- if (uparams.in_len > info.max_sig_size || -- uparams.out_len > info.max_data_size) -+ if (uparams.in_len > info.max_data_size || -+ uparams.in2_len > info.max_sig_size) - return -EINVAL; - break; - default: -@@ -151,7 +159,7 @@ static int keyctl_pkey_params_get_2(const struct keyctl_pkey_params __user *_par - } - - params->in_len = uparams.in_len; -- params->out_len = uparams.out_len; -+ params->out_len = uparams.out_len; /* Note: same as in2_len */ - return 0; - } - -diff --git a/security/security.c b/security/security.c -index c34ec4c7d98cc..f633717311a34 100644 ---- a/security/security.c -+++ b/security/security.c -@@ -802,9 +802,22 @@ int security_fs_context_dup(struct fs_context *fc, struct fs_context *src_fc) - return call_int_hook(fs_context_dup, 0, fc, src_fc); - } - --int security_fs_context_parse_param(struct fs_context *fc, struct fs_parameter *param) -+int security_fs_context_parse_param(struct fs_context *fc, -+ struct fs_parameter *param) - { -- return call_int_hook(fs_context_parse_param, -ENOPARAM, fc, param); -+ struct security_hook_list *hp; -+ int trc; -+ int rc = -ENOPARAM; -+ -+ hlist_for_each_entry(hp, &security_hook_heads.fs_context_parse_param, -+ list) { -+ trc = hp->hook.fs_context_parse_param(fc, param); -+ if (trc == 0) -+ rc = 0; -+ else if (trc != -ENOPARAM) -+ return trc; -+ } -+ return rc; - } - - int security_sb_alloc(struct super_block *sb) -diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c -index 56418cf72069d..d9f15c84aab7d 100644 ---- a/security/selinux/hooks.c -+++ b/security/selinux/hooks.c -@@ -2855,10 +2855,9 @@ static int selinux_fs_context_parse_param(struct fs_context *fc, - return opt; - - rc = selinux_add_opt(opt, param->string, &fc->security); -- if (!rc) { -+ if (!rc) - param->string = NULL; -- rc = 1; -- } -+ - return rc; - } - -diff --git a/security/selinux/xfrm.c b/security/selinux/xfrm.c -index 7314196185d15..00e95f8bd7c73 100644 ---- a/security/selinux/xfrm.c -+++ b/security/selinux/xfrm.c -@@ -346,7 +346,7 @@ int selinux_xfrm_state_alloc_acquire(struct xfrm_state *x, - int rc; - struct xfrm_sec_ctx *ctx; - char *ctx_str = NULL; -- int str_len; -+ u32 str_len; - - if (!polsec) - return 0; -diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c -index 12c0fa85d9f82..0253cd2e2358a 100644 ---- a/security/smack/smack_lsm.c -+++ b/security/smack/smack_lsm.c -@@ -2501,7 +2501,7 @@ static int smk_ipv6_check(struct smack_known *subject, - #ifdef CONFIG_AUDIT - smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net); - ad.a.u.net->family = PF_INET6; -- ad.a.u.net->dport = ntohs(address->sin6_port); -+ ad.a.u.net->dport = address->sin6_port; - if (act == SMK_RECEIVING) - ad.a.u.net->v6info.saddr = address->sin6_addr; - else -diff --git a/security/tomoyo/load_policy.c b/security/tomoyo/load_policy.c -index 3445ae6fd4794..363b65be87ab7 100644 ---- a/security/tomoyo/load_policy.c -+++ b/security/tomoyo/load_policy.c -@@ -24,7 +24,7 @@ static const char *tomoyo_loader; - static int __init tomoyo_loader_setup(char *str) - { - tomoyo_loader = str; -- return 0; -+ return 1; - } - - __setup("TOMOYO_loader=", tomoyo_loader_setup); -@@ -64,7 +64,7 @@ static const char *tomoyo_trigger; - static int __init tomoyo_trigger_setup(char *str) - { - tomoyo_trigger = str; -- return 0; -+ return 1; - } - - __setup("TOMOYO_trigger=", tomoyo_trigger_setup); -diff --git a/sound/firewire/fcp.c b/sound/firewire/fcp.c -index bbfbebf4affbc..df44dd5dc4b22 100644 ---- a/sound/firewire/fcp.c -+++ b/sound/firewire/fcp.c -@@ -240,9 +240,7 @@ int fcp_avc_transaction(struct fw_unit *unit, - t.response_match_bytes = response_match_bytes; - t.state = STATE_PENDING; - init_waitqueue_head(&t.wait); -- -- if (*(const u8 *)command == 0x00 || *(const u8 *)command == 0x03) -- t.deferrable = true; -+ t.deferrable = (*(const u8 *)command == 0x00 || *(const u8 *)command == 0x03); - - spin_lock_irq(&transactions_lock); - list_add_tail(&t.list, &transactions); -diff --git a/sound/isa/cs423x/cs4236.c b/sound/isa/cs423x/cs4236.c -index fa3c39cff5f85..9ee3a312c6793 100644 ---- a/sound/isa/cs423x/cs4236.c -+++ b/sound/isa/cs423x/cs4236.c -@@ -544,7 +544,7 @@ static int snd_cs423x_pnpbios_detect(struct pnp_dev *pdev, - static int dev; - int err; - struct snd_card *card; -- struct pnp_dev *cdev; -+ struct pnp_dev *cdev, *iter; - char cid[PNP_ID_LEN]; - - if (pnp_device_is_isapnp(pdev)) -@@ -560,9 +560,11 @@ static int snd_cs423x_pnpbios_detect(struct pnp_dev *pdev, - strcpy(cid, pdev->id[0].id); - cid[5] = '1'; - cdev = NULL; -- list_for_each_entry(cdev, &(pdev->protocol->devices), protocol_list) { -- if (!strcmp(cdev->id[0].id, cid)) -+ list_for_each_entry(iter, &(pdev->protocol->devices), protocol_list) { -+ if (!strcmp(iter->id[0].id, cid)) { -+ cdev = iter; - break; -+ } - } - err = snd_cs423x_card_new(&pdev->dev, dev, &card); - if (err < 0) -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index d201043d661c1..05ca4196cb0fd 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -3557,8 +3557,8 @@ static void alc256_shutup(struct hda_codec *codec) - /* If disable 3k pulldown control for alc257, the Mic detection will not work correctly - * when booting with headset plugged. So skip setting it for the codec alc257 - */ -- if (spec->codec_variant != ALC269_TYPE_ALC257 && -- spec->codec_variant != ALC269_TYPE_ALC256) -+ if (codec->core.vendor_id != 0x10ec0236 && -+ codec->core.vendor_id != 0x10ec0257) - alc_update_coef_idx(codec, 0x46, 0, 3 << 12); - - if (!spec->no_shutup_pins) -@@ -6456,6 +6456,7 @@ enum { - ALC285_FIXUP_HP_MUTE_LED, - ALC236_FIXUP_HP_MUTE_LED, - ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET, -+ ALC256_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET, - ALC295_FIXUP_ASUS_MIC_NO_PRESENCE, - ALC269VC_FIXUP_ACER_VCOPPERBOX_PINS, - ALC269VC_FIXUP_ACER_HEADSET_MIC, -@@ -7740,6 +7741,14 @@ static const struct hda_fixup alc269_fixups[] = { - { } - }, - }, -+ [ALC256_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET] = { -+ .type = HDA_FIXUP_VERBS, -+ .v.verbs = (const struct hda_verb[]) { -+ { 0x20, AC_VERB_SET_COEF_INDEX, 0x08}, -+ { 0x20, AC_VERB_SET_PROC_COEF, 0x2fcf}, -+ { } -+ }, -+ }, - [ALC295_FIXUP_ASUS_MIC_NO_PRESENCE] = { - .type = HDA_FIXUP_PINS, - .v.pins = (const struct hda_pintbl[]) { -@@ -8217,6 +8226,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x144d, 0xc740, "Samsung Ativ book 8 (NP870Z5G)", ALC269_FIXUP_ATIV_BOOK_8), - SND_PCI_QUIRK(0x144d, 0xc812, "Samsung Notebook Pen S (NT950SBE-X58)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET), - SND_PCI_QUIRK(0x144d, 0xc830, "Samsung Galaxy Book Ion (NT950XCJ-X716A)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET), -+ SND_PCI_QUIRK(0x144d, 0xc832, "Samsung Galaxy Book Flex Alpha (NP730QCJ)", ALC256_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET), - SND_PCI_QUIRK(0x1458, 0xfa53, "Gigabyte BXBT-2807", ALC283_FIXUP_HEADSET_MIC), - SND_PCI_QUIRK(0x1462, 0xb120, "MSI Cubi MS-B120", ALC283_FIXUP_HEADSET_MIC), - SND_PCI_QUIRK(0x1462, 0xb171, "Cubi N 8GL (MS-B171)", ALC283_FIXUP_HEADSET_MIC), -@@ -8540,6 +8550,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = { - {.id = ALC298_FIXUP_HUAWEI_MBX_STEREO, .name = "huawei-mbx-stereo"}, - {.id = ALC256_FIXUP_MEDION_HEADSET_NO_PRESENCE, .name = "alc256-medion-headset"}, - {.id = ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET, .name = "alc298-samsung-headphone"}, -+ {.id = ALC256_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET, .name = "alc256-samsung-headphone"}, - {.id = ALC255_FIXUP_XIAOMI_HEADSET_MIC, .name = "alc255-xiaomi-headset"}, - {.id = ALC274_FIXUP_HP_MIC, .name = "alc274-hp-mic-detect"}, - {.id = ALC295_FIXUP_HP_OMEN, .name = "alc295-hp-omen"}, -diff --git a/sound/soc/atmel/atmel_ssc_dai.c b/sound/soc/atmel/atmel_ssc_dai.c -index ca603397651c0..1e0973322cd00 100644 ---- a/sound/soc/atmel/atmel_ssc_dai.c -+++ b/sound/soc/atmel/atmel_ssc_dai.c -@@ -280,7 +280,10 @@ static int atmel_ssc_startup(struct snd_pcm_substream *substream, - - /* Enable PMC peripheral clock for this SSC */ - pr_debug("atmel_ssc_dai: Starting clock\n"); -- clk_enable(ssc_p->ssc->clk); -+ ret = clk_enable(ssc_p->ssc->clk); -+ if (ret) -+ return ret; -+ - ssc_p->mck_rate = clk_get_rate(ssc_p->ssc->clk); - - /* Reset the SSC unless initialized to keep it in a clean state */ -diff --git a/sound/soc/atmel/sam9g20_wm8731.c b/sound/soc/atmel/sam9g20_wm8731.c -index b1bef2bf142dc..05277a88e20d8 100644 ---- a/sound/soc/atmel/sam9g20_wm8731.c -+++ b/sound/soc/atmel/sam9g20_wm8731.c -@@ -214,6 +214,7 @@ static int at91sam9g20ek_audio_probe(struct platform_device *pdev) - cpu_np = of_parse_phandle(np, "atmel,ssc-controller", 0); - if (!cpu_np) { - dev_err(&pdev->dev, "dai and pcm info missing\n"); -+ of_node_put(codec_np); - return -EINVAL; - } - at91sam9g20ek_dai.cpus->of_node = cpu_np; -diff --git a/sound/soc/codecs/Kconfig b/sound/soc/codecs/Kconfig -index 229cc89f8c5a5..466dc67799f4c 100644 ---- a/sound/soc/codecs/Kconfig -+++ b/sound/soc/codecs/Kconfig -@@ -586,21 +586,26 @@ config SND_SOC_CS4349 - - config SND_SOC_CS47L15 - tristate -+ depends on MFD_CS47L15 - - config SND_SOC_CS47L24 - tristate - - config SND_SOC_CS47L35 - tristate -+ depends on MFD_CS47L35 - - config SND_SOC_CS47L85 - tristate -+ depends on MFD_CS47L85 - - config SND_SOC_CS47L90 - tristate -+ depends on MFD_CS47L90 - - config SND_SOC_CS47L92 - tristate -+ depends on MFD_CS47L92 - - # Cirrus Logic Quad-Channel ADC - config SND_SOC_CS53L30 -diff --git a/sound/soc/codecs/msm8916-wcd-analog.c b/sound/soc/codecs/msm8916-wcd-analog.c -index 337bddb7c2a49..5a8eedea6be03 100644 ---- a/sound/soc/codecs/msm8916-wcd-analog.c -+++ b/sound/soc/codecs/msm8916-wcd-analog.c -@@ -1195,8 +1195,10 @@ static int pm8916_wcd_analog_spmi_probe(struct platform_device *pdev) - } - - irq = platform_get_irq_byname(pdev, "mbhc_switch_int"); -- if (irq < 0) -- return irq; -+ if (irq < 0) { -+ ret = irq; -+ goto err_disable_clk; -+ } - - ret = devm_request_threaded_irq(dev, irq, NULL, - pm8916_mbhc_switch_irq_handler, -@@ -1208,8 +1210,10 @@ static int pm8916_wcd_analog_spmi_probe(struct platform_device *pdev) - - if (priv->mbhc_btn_enabled) { - irq = platform_get_irq_byname(pdev, "mbhc_but_press_det"); -- if (irq < 0) -- return irq; -+ if (irq < 0) { -+ ret = irq; -+ goto err_disable_clk; -+ } - - ret = devm_request_threaded_irq(dev, irq, NULL, - mbhc_btn_press_irq_handler, -@@ -1220,8 +1224,10 @@ static int pm8916_wcd_analog_spmi_probe(struct platform_device *pdev) - dev_err(dev, "cannot request mbhc button press irq\n"); - - irq = platform_get_irq_byname(pdev, "mbhc_but_rel_det"); -- if (irq < 0) -- return irq; -+ if (irq < 0) { -+ ret = irq; -+ goto err_disable_clk; -+ } - - ret = devm_request_threaded_irq(dev, irq, NULL, - mbhc_btn_release_irq_handler, -@@ -1238,6 +1244,10 @@ static int pm8916_wcd_analog_spmi_probe(struct platform_device *pdev) - return devm_snd_soc_register_component(dev, &pm8916_wcd_analog, - pm8916_wcd_analog_dai, - ARRAY_SIZE(pm8916_wcd_analog_dai)); -+ -+err_disable_clk: -+ clk_disable_unprepare(priv->mclk); -+ return ret; - } - - static int pm8916_wcd_analog_spmi_remove(struct platform_device *pdev) -diff --git a/sound/soc/codecs/msm8916-wcd-digital.c b/sound/soc/codecs/msm8916-wcd-digital.c -index 09fccacadd6b1..d5269ab5f91c5 100644 ---- a/sound/soc/codecs/msm8916-wcd-digital.c -+++ b/sound/soc/codecs/msm8916-wcd-digital.c -@@ -1201,7 +1201,7 @@ static int msm8916_wcd_digital_probe(struct platform_device *pdev) - ret = clk_prepare_enable(priv->mclk); - if (ret < 0) { - dev_err(dev, "failed to enable mclk %d\n", ret); -- return ret; -+ goto err_clk; - } - - dev_set_drvdata(dev, priv); -@@ -1209,6 +1209,9 @@ static int msm8916_wcd_digital_probe(struct platform_device *pdev) - return devm_snd_soc_register_component(dev, &msm8916_wcd_digital, - msm8916_wcd_digital_dai, - ARRAY_SIZE(msm8916_wcd_digital_dai)); -+err_clk: -+ clk_disable_unprepare(priv->ahbclk); -+ return ret; - } - - static int msm8916_wcd_digital_remove(struct platform_device *pdev) -diff --git a/sound/soc/codecs/mt6358.c b/sound/soc/codecs/mt6358.c -index bb737fd678cc6..494ba0eeb4336 100644 ---- a/sound/soc/codecs/mt6358.c -+++ b/sound/soc/codecs/mt6358.c -@@ -103,6 +103,7 @@ int mt6358_set_mtkaif_protocol(struct snd_soc_component *cmpnt, - priv->mtkaif_protocol = mtkaif_protocol; - return 0; - } -+EXPORT_SYMBOL_GPL(mt6358_set_mtkaif_protocol); - - static void playback_gpio_set(struct mt6358_priv *priv) - { -@@ -269,6 +270,7 @@ int mt6358_mtkaif_calibration_enable(struct snd_soc_component *cmpnt) - 1 << RG_AUD_PAD_TOP_DAT_MISO_LOOPBACK_SFT); - return 0; - } -+EXPORT_SYMBOL_GPL(mt6358_mtkaif_calibration_enable); - - int mt6358_mtkaif_calibration_disable(struct snd_soc_component *cmpnt) - { -@@ -292,6 +294,7 @@ int mt6358_mtkaif_calibration_disable(struct snd_soc_component *cmpnt) - capture_gpio_reset(priv); - return 0; - } -+EXPORT_SYMBOL_GPL(mt6358_mtkaif_calibration_disable); - - int mt6358_set_mtkaif_calibration_phase(struct snd_soc_component *cmpnt, - int phase_1, int phase_2) -@@ -306,6 +309,7 @@ int mt6358_set_mtkaif_calibration_phase(struct snd_soc_component *cmpnt, - phase_2 << RG_AUD_PAD_TOP_PHASE_MODE2_SFT); - return 0; - } -+EXPORT_SYMBOL_GPL(mt6358_set_mtkaif_calibration_phase); - - /* dl pga gain */ - enum { -diff --git a/sound/soc/codecs/rt5663.c b/sound/soc/codecs/rt5663.c -index 3610be1590fcc..19e2f622718d6 100644 ---- a/sound/soc/codecs/rt5663.c -+++ b/sound/soc/codecs/rt5663.c -@@ -3478,6 +3478,8 @@ static int rt5663_parse_dp(struct rt5663_priv *rt5663, struct device *dev) - table_size = sizeof(struct impedance_mapping_table) * - rt5663->pdata.impedance_sensing_num; - rt5663->imp_table = devm_kzalloc(dev, table_size, GFP_KERNEL); -+ if (!rt5663->imp_table) -+ return -ENOMEM; - ret = device_property_read_u32_array(dev, - "realtek,impedance_sensing_table", - (u32 *)rt5663->imp_table, table_size); -diff --git a/sound/soc/codecs/wm8350.c b/sound/soc/codecs/wm8350.c -index fe99584c917f8..9cd91bb0a9022 100644 ---- a/sound/soc/codecs/wm8350.c -+++ b/sound/soc/codecs/wm8350.c -@@ -1535,18 +1535,38 @@ static int wm8350_component_probe(struct snd_soc_component *component) - wm8350_clear_bits(wm8350, WM8350_JACK_DETECT, - WM8350_JDL_ENA | WM8350_JDR_ENA); - -- wm8350_register_irq(wm8350, WM8350_IRQ_CODEC_JCK_DET_L, -+ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CODEC_JCK_DET_L, - wm8350_hpl_jack_handler, 0, "Left jack detect", - priv); -- wm8350_register_irq(wm8350, WM8350_IRQ_CODEC_JCK_DET_R, -+ if (ret != 0) -+ goto err; -+ -+ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CODEC_JCK_DET_R, - wm8350_hpr_jack_handler, 0, "Right jack detect", - priv); -- wm8350_register_irq(wm8350, WM8350_IRQ_CODEC_MICSCD, -+ if (ret != 0) -+ goto free_jck_det_l; -+ -+ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CODEC_MICSCD, - wm8350_mic_handler, 0, "Microphone short", priv); -- wm8350_register_irq(wm8350, WM8350_IRQ_CODEC_MICD, -+ if (ret != 0) -+ goto free_jck_det_r; -+ -+ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CODEC_MICD, - wm8350_mic_handler, 0, "Microphone detect", priv); -+ if (ret != 0) -+ goto free_micscd; - - return 0; -+ -+free_micscd: -+ wm8350_free_irq(wm8350, WM8350_IRQ_CODEC_MICSCD, priv); -+free_jck_det_r: -+ wm8350_free_irq(wm8350, WM8350_IRQ_CODEC_JCK_DET_R, priv); -+free_jck_det_l: -+ wm8350_free_irq(wm8350, WM8350_IRQ_CODEC_JCK_DET_L, priv); -+err: -+ return ret; - } - - static void wm8350_component_remove(struct snd_soc_component *component) -diff --git a/sound/soc/fsl/imx-es8328.c b/sound/soc/fsl/imx-es8328.c -index fad1eb6253d53..9e602c3456196 100644 ---- a/sound/soc/fsl/imx-es8328.c -+++ b/sound/soc/fsl/imx-es8328.c -@@ -87,6 +87,7 @@ static int imx_es8328_probe(struct platform_device *pdev) - if (int_port > MUX_PORT_MAX || int_port == 0) { - dev_err(dev, "mux-int-port: hardware only has %d mux ports\n", - MUX_PORT_MAX); -+ ret = -EINVAL; - goto fail; - } - -diff --git a/sound/soc/mxs/mxs-saif.c b/sound/soc/mxs/mxs-saif.c -index 1e38ce8583262..cb1b525cbe9de 100644 ---- a/sound/soc/mxs/mxs-saif.c -+++ b/sound/soc/mxs/mxs-saif.c -@@ -455,7 +455,10 @@ static int mxs_saif_hw_params(struct snd_pcm_substream *substream, - * basic clock which should be fast enough for the internal - * logic. - */ -- clk_enable(saif->clk); -+ ret = clk_enable(saif->clk); -+ if (ret) -+ return ret; -+ - ret = clk_set_rate(saif->clk, 24000000); - clk_disable(saif->clk); - if (ret) -diff --git a/sound/soc/mxs/mxs-sgtl5000.c b/sound/soc/mxs/mxs-sgtl5000.c -index 9841e1da97826..8282fe6d00dd4 100644 ---- a/sound/soc/mxs/mxs-sgtl5000.c -+++ b/sound/soc/mxs/mxs-sgtl5000.c -@@ -118,6 +118,9 @@ static int mxs_sgtl5000_probe(struct platform_device *pdev) - codec_np = of_parse_phandle(np, "audio-codec", 0); - if (!saif_np[0] || !saif_np[1] || !codec_np) { - dev_err(&pdev->dev, "phandle missing or invalid\n"); -+ of_node_put(codec_np); -+ of_node_put(saif_np[0]); -+ of_node_put(saif_np[1]); - return -EINVAL; - } - -diff --git a/sound/soc/sh/fsi.c b/sound/soc/sh/fsi.c -index 3447dbdba1f17..6ac7df30a2890 100644 ---- a/sound/soc/sh/fsi.c -+++ b/sound/soc/sh/fsi.c -@@ -816,14 +816,27 @@ static int fsi_clk_enable(struct device *dev, - return ret; - } - -- clk_enable(clock->xck); -- clk_enable(clock->ick); -- clk_enable(clock->div); -+ ret = clk_enable(clock->xck); -+ if (ret) -+ goto err; -+ ret = clk_enable(clock->ick); -+ if (ret) -+ goto disable_xck; -+ ret = clk_enable(clock->div); -+ if (ret) -+ goto disable_ick; - - clock->count++; - } - - return ret; -+ -+disable_ick: -+ clk_disable(clock->ick); -+disable_xck: -+ clk_disable(clock->xck); -+err: -+ return ret; - } - - static int fsi_clk_disable(struct device *dev, -diff --git a/sound/soc/soc-compress.c b/sound/soc/soc-compress.c -index 9e54d8ae6d2cf..da6e40aef7b6e 100644 ---- a/sound/soc/soc-compress.c -+++ b/sound/soc/soc-compress.c -@@ -871,6 +871,11 @@ int snd_soc_new_compress(struct snd_soc_pcm_runtime *rtd, int num) - return -EINVAL; - } - -+ if (!codec_dai) { -+ dev_err(rtd->card->dev, "Missing codec\n"); -+ return -EINVAL; -+ } -+ - /* check client and interface hw capabilities */ - if (snd_soc_dai_stream_valid(codec_dai, SNDRV_PCM_STREAM_PLAYBACK) && - snd_soc_dai_stream_valid(cpu_dai, SNDRV_PCM_STREAM_PLAYBACK)) -diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c -index c0e03cc8ea822..093ab32ea2c3a 100644 ---- a/sound/soc/soc-core.c -+++ b/sound/soc/soc-core.c -@@ -3362,7 +3362,7 @@ int snd_soc_get_dai_name(struct of_phandle_args *args, - for_each_component(pos) { - component_of_node = soc_component_to_node(pos); - -- if (component_of_node != args->np) -+ if (component_of_node != args->np || !pos->num_dai) - continue; - - ret = snd_soc_component_of_xlate_dai_name(pos, args, dai_name); -diff --git a/sound/soc/soc-generic-dmaengine-pcm.c b/sound/soc/soc-generic-dmaengine-pcm.c -index 5552c66ca6422..ca4b17bd95d14 100644 ---- a/sound/soc/soc-generic-dmaengine-pcm.c -+++ b/sound/soc/soc-generic-dmaengine-pcm.c -@@ -91,10 +91,10 @@ static int dmaengine_pcm_hw_params(struct snd_pcm_substream *substream, - - memset(&slave_config, 0, sizeof(slave_config)); - -- if (!pcm->config) -- prepare_slave_config = snd_dmaengine_pcm_prepare_slave_config; -- else -+ if (pcm->config && pcm->config->prepare_slave_config) - prepare_slave_config = pcm->config->prepare_slave_config; -+ else -+ prepare_slave_config = snd_dmaengine_pcm_prepare_slave_config; - - if (prepare_slave_config) { - ret = prepare_slave_config(substream, params, &slave_config); -diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c -index 21f859e56b700..870b002293535 100644 ---- a/sound/soc/soc-topology.c -+++ b/sound/soc/soc-topology.c -@@ -587,7 +587,8 @@ static int soc_tplg_kcontrol_bind_io(struct snd_soc_tplg_ctl_hdr *hdr, - - if (le32_to_cpu(hdr->ops.info) == SND_SOC_TPLG_CTL_BYTES - && k->iface & SNDRV_CTL_ELEM_IFACE_MIXER -- && k->access & SNDRV_CTL_ELEM_ACCESS_TLV_READWRITE -+ && (k->access & SNDRV_CTL_ELEM_ACCESS_TLV_READ -+ || k->access & SNDRV_CTL_ELEM_ACCESS_TLV_WRITE) - && k->access & SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK) { - struct soc_bytes_ext *sbe; - struct snd_soc_tplg_bytes_control *be; -diff --git a/sound/soc/sof/intel/hda-loader.c b/sound/soc/sof/intel/hda-loader.c -index 356bb134ae93a..7573f3f9f0f21 100644 ---- a/sound/soc/sof/intel/hda-loader.c -+++ b/sound/soc/sof/intel/hda-loader.c -@@ -50,7 +50,7 @@ static int cl_stream_prepare(struct snd_sof_dev *sdev, unsigned int format, - ret = snd_dma_alloc_pages(SNDRV_DMA_TYPE_DEV_SG, &pci->dev, size, dmab); - if (ret < 0) { - dev_err(sdev->dev, "error: memory alloc failed: %x\n", ret); -- goto error; -+ goto out_put; - } - - hstream->period_bytes = 0;/* initialize period_bytes */ -@@ -60,16 +60,17 @@ static int cl_stream_prepare(struct snd_sof_dev *sdev, unsigned int format, - ret = hda_dsp_stream_hw_params(sdev, dsp_stream, dmab, NULL); - if (ret < 0) { - dev_err(sdev->dev, "error: hdac prepare failed: %x\n", ret); -- goto error; -+ goto out_free; - } - - hda_dsp_stream_spib_config(sdev, dsp_stream, HDA_DSP_SPIB_ENABLE, size); - - return hstream->stream_tag; - --error: -- hda_dsp_stream_put(sdev, direction, hstream->stream_tag); -+out_free: - snd_dma_free_pages(dmab); -+out_put: -+ hda_dsp_stream_put(sdev, direction, hstream->stream_tag); - return ret; - } - -diff --git a/sound/soc/ti/davinci-i2s.c b/sound/soc/ti/davinci-i2s.c -index d89b5c928c4d7..b2b2dcdb05d4c 100644 ---- a/sound/soc/ti/davinci-i2s.c -+++ b/sound/soc/ti/davinci-i2s.c -@@ -708,7 +708,9 @@ static int davinci_i2s_probe(struct platform_device *pdev) - dev->clk = clk_get(&pdev->dev, NULL); - if (IS_ERR(dev->clk)) - return -ENODEV; -- clk_enable(dev->clk); -+ ret = clk_enable(dev->clk); -+ if (ret) -+ goto err_put_clk; - - dev->dev = &pdev->dev; - dev_set_drvdata(&pdev->dev, dev); -@@ -730,6 +732,7 @@ err_unregister_component: - snd_soc_unregister_component(&pdev->dev); - err_release_clk: - clk_disable(dev->clk); -+err_put_clk: - clk_put(dev->clk); - return ret; - } -diff --git a/sound/spi/at73c213.c b/sound/spi/at73c213.c -index 4de1ba9a418d9..6e5d315bab59b 100644 ---- a/sound/spi/at73c213.c -+++ b/sound/spi/at73c213.c -@@ -218,7 +218,9 @@ static int snd_at73c213_pcm_open(struct snd_pcm_substream *substream) - runtime->hw = snd_at73c213_playback_hw; - chip->substream = substream; - -- clk_enable(chip->ssc->clk); -+ err = clk_enable(chip->ssc->clk); -+ if (err) -+ return err; - - return 0; - } -@@ -784,7 +786,9 @@ static int snd_at73c213_chip_init(struct snd_at73c213 *chip) - goto out; - - /* Enable DAC master clock. */ -- clk_enable(chip->board->dac_clk); -+ retval = clk_enable(chip->board->dac_clk); -+ if (retval) -+ goto out; - - /* Initialize at73c213 on SPI bus. */ - retval = snd_at73c213_write_reg(chip, DAC_RST, 0x04); -@@ -897,7 +901,9 @@ static int snd_at73c213_dev_init(struct snd_card *card, - chip->card = card; - chip->irq = -1; - -- clk_enable(chip->ssc->clk); -+ retval = clk_enable(chip->ssc->clk); -+ if (retval) -+ return retval; - - retval = request_irq(irq, snd_at73c213_interrupt, 0, "at73c213", chip); - if (retval) { -@@ -1016,7 +1022,9 @@ static int snd_at73c213_remove(struct spi_device *spi) - int retval; - - /* Stop playback. */ -- clk_enable(chip->ssc->clk); -+ retval = clk_enable(chip->ssc->clk); -+ if (retval) -+ goto out; - ssc_writel(chip->ssc->regs, CR, SSC_BIT(CR_TXDIS)); - clk_disable(chip->ssc->clk); - -@@ -1096,9 +1104,16 @@ static int snd_at73c213_resume(struct device *dev) - { - struct snd_card *card = dev_get_drvdata(dev); - struct snd_at73c213 *chip = card->private_data; -+ int retval; - -- clk_enable(chip->board->dac_clk); -- clk_enable(chip->ssc->clk); -+ retval = clk_enable(chip->board->dac_clk); -+ if (retval) -+ return retval; -+ retval = clk_enable(chip->ssc->clk); -+ if (retval) { -+ clk_disable(chip->board->dac_clk); -+ return retval; -+ } - ssc_writel(chip->ssc->regs, CR, SSC_BIT(CR_TXEN)); - - return 0; -diff --git a/tools/build/feature/Makefile b/tools/build/feature/Makefile -index 2a261b909dd8d..88392219d425e 100644 ---- a/tools/build/feature/Makefile -+++ b/tools/build/feature/Makefile -@@ -204,9 +204,16 @@ strip-libs = $(filter-out -l%,$(1)) - PERL_EMBED_LDOPTS = $(shell perl -MExtUtils::Embed -e ldopts 2>/dev/null) - PERL_EMBED_LDFLAGS = $(call strip-libs,$(PERL_EMBED_LDOPTS)) - PERL_EMBED_LIBADD = $(call grep-libs,$(PERL_EMBED_LDOPTS)) --PERL_EMBED_CCOPTS = `perl -MExtUtils::Embed -e ccopts 2>/dev/null` -+PERL_EMBED_CCOPTS = $(shell perl -MExtUtils::Embed -e ccopts 2>/dev/null) - FLAGS_PERL_EMBED=$(PERL_EMBED_CCOPTS) $(PERL_EMBED_LDOPTS) - -+ifeq ($(CC_NO_CLANG), 0) -+ PERL_EMBED_LDOPTS := $(filter-out -specs=%,$(PERL_EMBED_LDOPTS)) -+ PERL_EMBED_CCOPTS := $(filter-out -flto=auto -ffat-lto-objects, $(PERL_EMBED_CCOPTS)) -+ PERL_EMBED_CCOPTS := $(filter-out -specs=%,$(PERL_EMBED_CCOPTS)) -+ FLAGS_PERL_EMBED += -Wno-compound-token-split-by-macro -+endif -+ - $(OUTPUT)test-libperl.bin: - $(BUILD) $(FLAGS_PERL_EMBED) - -diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h -index 63038eb23560b..0bfad86ec960a 100644 ---- a/tools/include/uapi/linux/bpf.h -+++ b/tools/include/uapi/linux/bpf.h -@@ -1294,8 +1294,8 @@ union bpf_attr { - * Return - * The return value depends on the result of the test, and can be: - * -- * * 0, if current task belongs to the cgroup2. -- * * 1, if current task does not belong to the cgroup2. -+ * * 1, if current task belongs to the cgroup2. -+ * * 0, if current task does not belong to the cgroup2. - * * A negative error code, if an error occurred. - * - * int bpf_skb_change_tail(struct sk_buff *skb, u32 len, u64 flags) -diff --git a/tools/lib/bpf/btf_dump.c b/tools/lib/bpf/btf_dump.c -index b2fc452504501..a1176a9e8430a 100644 ---- a/tools/lib/bpf/btf_dump.c -+++ b/tools/lib/bpf/btf_dump.c -@@ -1366,6 +1366,11 @@ static const char *btf_dump_resolve_name(struct btf_dump *d, __u32 id, - if (s->name_resolved) - return *cached_name ? *cached_name : orig_name; - -+ if (btf_is_fwd(t) || (btf_is_enum(t) && btf_vlen(t) == 0)) { -+ s->name_resolved = 1; -+ return orig_name; -+ } -+ - dup_cnt = btf_dump_name_dups(d, name_map, orig_name); - if (dup_cnt > 1) { - const size_t max_len = 256; -diff --git a/tools/perf/Makefile.config b/tools/perf/Makefile.config -index 7578af2504549..b94d9afad3f79 100644 ---- a/tools/perf/Makefile.config -+++ b/tools/perf/Makefile.config -@@ -706,6 +706,9 @@ else - LDFLAGS += $(PERL_EMBED_LDFLAGS) - EXTLIBS += $(PERL_EMBED_LIBADD) - CFLAGS += -DHAVE_LIBPERL_SUPPORT -+ ifeq ($(CC_NO_CLANG), 0) -+ CFLAGS += -Wno-compound-token-split-by-macro -+ endif - $(call detected,CONFIG_LIBPERL) - endif - endif -diff --git a/tools/perf/perf.c b/tools/perf/perf.c -index 27f94b0bb8747..505e2a2f1872b 100644 ---- a/tools/perf/perf.c -+++ b/tools/perf/perf.c -@@ -433,7 +433,7 @@ void pthread__unblock_sigwinch(void) - static int libperf_print(enum libperf_print_level level, - const char *fmt, va_list ap) - { -- return eprintf(level, verbose, fmt, ap); -+ return veprintf(level, verbose, fmt, ap); - } - - int main(int argc, const char **argv) -diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c -index 8ff2c98e90322..01e15b445cb58 100644 ---- a/tools/perf/util/session.c -+++ b/tools/perf/util/session.c -@@ -1960,6 +1960,7 @@ prefetch_event(char *buf, u64 head, size_t mmap_size, - bool needs_swap, union perf_event *error) - { - union perf_event *event; -+ u16 event_size; - - /* - * Ensure we have enough space remaining to read -@@ -1972,15 +1973,23 @@ prefetch_event(char *buf, u64 head, size_t mmap_size, - if (needs_swap) - perf_event_header__bswap(&event->header); - -- if (head + event->header.size <= mmap_size) -+ event_size = event->header.size; -+ if (head + event_size <= mmap_size) - return event; - - /* We're not fetching the event so swap back again */ - if (needs_swap) - perf_event_header__bswap(&event->header); - -- pr_debug("%s: head=%#" PRIx64 " event->header_size=%#x, mmap_size=%#zx:" -- " fuzzed or compressed perf.data?\n",__func__, head, event->header.size, mmap_size); -+ /* Check if the event fits into the next mmapped buf. */ -+ if (event_size <= mmap_size - head % page_size) { -+ /* Remap buf and fetch again. */ -+ return NULL; -+ } -+ -+ /* Invalid input. Event size should never exceed mmap_size. */ -+ pr_debug("%s: head=%#" PRIx64 " event->header.size=%#x, mmap_size=%#zx:" -+ " fuzzed or compressed perf.data?\n", __func__, head, event_size, mmap_size); - - return error; - } -diff --git a/tools/testing/selftests/bpf/test_lirc_mode2.sh b/tools/testing/selftests/bpf/test_lirc_mode2.sh -index ec4e15948e406..5252b91f48a18 100755 ---- a/tools/testing/selftests/bpf/test_lirc_mode2.sh -+++ b/tools/testing/selftests/bpf/test_lirc_mode2.sh -@@ -3,6 +3,7 @@ - - # Kselftest framework requirement - SKIP code is 4. - ksft_skip=4 -+ret=$ksft_skip - - msg="skip all tests:" - if [ $UID != 0 ]; then -@@ -25,7 +26,7 @@ do - fi - done - --if [ -n $LIRCDEV ]; -+if [ -n "$LIRCDEV" ]; - then - TYPE=lirc_mode2 - ./test_lirc_mode2_user $LIRCDEV $INPUTDEV -@@ -36,3 +37,5 @@ then - echo -e ${GREEN}"PASS: $TYPE"${NC} - fi - fi -+ -+exit $ret -diff --git a/tools/testing/selftests/bpf/test_lwt_ip_encap.sh b/tools/testing/selftests/bpf/test_lwt_ip_encap.sh -index b497bb85b667f..6c69c42b1d607 100755 ---- a/tools/testing/selftests/bpf/test_lwt_ip_encap.sh -+++ b/tools/testing/selftests/bpf/test_lwt_ip_encap.sh -@@ -120,6 +120,14 @@ setup() - ip netns exec ${NS2} sysctl -wq net.ipv4.conf.default.rp_filter=0 - ip netns exec ${NS3} sysctl -wq net.ipv4.conf.default.rp_filter=0 - -+ # disable IPv6 DAD because it sometimes takes too long and fails tests -+ ip netns exec ${NS1} sysctl -wq net.ipv6.conf.all.accept_dad=0 -+ ip netns exec ${NS2} sysctl -wq net.ipv6.conf.all.accept_dad=0 -+ ip netns exec ${NS3} sysctl -wq net.ipv6.conf.all.accept_dad=0 -+ ip netns exec ${NS1} sysctl -wq net.ipv6.conf.default.accept_dad=0 -+ ip netns exec ${NS2} sysctl -wq net.ipv6.conf.default.accept_dad=0 -+ ip netns exec ${NS3} sysctl -wq net.ipv6.conf.default.accept_dad=0 -+ - ip link add veth1 type veth peer name veth2 - ip link add veth3 type veth peer name veth4 - ip link add veth5 type veth peer name veth6 -@@ -289,7 +297,7 @@ test_ping() - ip netns exec ${NS1} ping -c 1 -W 1 -I veth1 ${IPv4_DST} 2>&1 > /dev/null - RET=$? - elif [ "${PROTO}" == "IPv6" ] ; then -- ip netns exec ${NS1} ping6 -c 1 -W 6 -I veth1 ${IPv6_DST} 2>&1 > /dev/null -+ ip netns exec ${NS1} ping6 -c 1 -W 1 -I veth1 ${IPv6_DST} 2>&1 > /dev/null - RET=$? - else - echo " test_ping: unknown PROTO: ${PROTO}" -diff --git a/tools/testing/selftests/cgroup/cgroup_util.c b/tools/testing/selftests/cgroup/cgroup_util.c -index 5e939ff1e3f95..819f3480a6f71 100644 ---- a/tools/testing/selftests/cgroup/cgroup_util.c -+++ b/tools/testing/selftests/cgroup/cgroup_util.c -@@ -202,7 +202,7 @@ int cg_find_unified_root(char *root, size_t len) - - int cg_create(const char *cgroup) - { -- return mkdir(cgroup, 0644); -+ return mkdir(cgroup, 0755); - } - - int cg_wait_for_proc_count(const char *cgroup, int count) -diff --git a/tools/testing/selftests/cgroup/test_core.c b/tools/testing/selftests/cgroup/test_core.c -index 79053a4f47838..599234c5e496c 100644 ---- a/tools/testing/selftests/cgroup/test_core.c -+++ b/tools/testing/selftests/cgroup/test_core.c -@@ -1,8 +1,13 @@ - /* SPDX-License-Identifier: GPL-2.0 */ - -+#define _GNU_SOURCE - #include -+#include - #include -+#include - #include -+#include -+#include - #include - #include - -@@ -354,6 +359,166 @@ cleanup: - return ret; - } - -+/* -+ * cgroup migration permission check should be performed based on the -+ * credentials at the time of open instead of write. -+ */ -+static int test_cgcore_lesser_euid_open(const char *root) -+{ -+ const uid_t test_euid = 65534; /* usually nobody, any !root is fine */ -+ int ret = KSFT_FAIL; -+ char *cg_test_a = NULL, *cg_test_b = NULL; -+ char *cg_test_a_procs = NULL, *cg_test_b_procs = NULL; -+ int cg_test_b_procs_fd = -1; -+ uid_t saved_uid; -+ -+ cg_test_a = cg_name(root, "cg_test_a"); -+ cg_test_b = cg_name(root, "cg_test_b"); -+ -+ if (!cg_test_a || !cg_test_b) -+ goto cleanup; -+ -+ cg_test_a_procs = cg_name(cg_test_a, "cgroup.procs"); -+ cg_test_b_procs = cg_name(cg_test_b, "cgroup.procs"); -+ -+ if (!cg_test_a_procs || !cg_test_b_procs) -+ goto cleanup; -+ -+ if (cg_create(cg_test_a) || cg_create(cg_test_b)) -+ goto cleanup; -+ -+ if (cg_enter_current(cg_test_a)) -+ goto cleanup; -+ -+ if (chown(cg_test_a_procs, test_euid, -1) || -+ chown(cg_test_b_procs, test_euid, -1)) -+ goto cleanup; -+ -+ saved_uid = geteuid(); -+ if (seteuid(test_euid)) -+ goto cleanup; -+ -+ cg_test_b_procs_fd = open(cg_test_b_procs, O_RDWR); -+ -+ if (seteuid(saved_uid)) -+ goto cleanup; -+ -+ if (cg_test_b_procs_fd < 0) -+ goto cleanup; -+ -+ if (write(cg_test_b_procs_fd, "0", 1) >= 0 || errno != EACCES) -+ goto cleanup; -+ -+ ret = KSFT_PASS; -+ -+cleanup: -+ cg_enter_current(root); -+ if (cg_test_b_procs_fd >= 0) -+ close(cg_test_b_procs_fd); -+ if (cg_test_b) -+ cg_destroy(cg_test_b); -+ if (cg_test_a) -+ cg_destroy(cg_test_a); -+ free(cg_test_b_procs); -+ free(cg_test_a_procs); -+ free(cg_test_b); -+ free(cg_test_a); -+ return ret; -+} -+ -+struct lesser_ns_open_thread_arg { -+ const char *path; -+ int fd; -+ int err; -+}; -+ -+static int lesser_ns_open_thread_fn(void *arg) -+{ -+ struct lesser_ns_open_thread_arg *targ = arg; -+ -+ targ->fd = open(targ->path, O_RDWR); -+ targ->err = errno; -+ return 0; -+} -+ -+/* -+ * cgroup migration permission check should be performed based on the cgroup -+ * namespace at the time of open instead of write. -+ */ -+static int test_cgcore_lesser_ns_open(const char *root) -+{ -+ static char stack[65536]; -+ const uid_t test_euid = 65534; /* usually nobody, any !root is fine */ -+ int ret = KSFT_FAIL; -+ char *cg_test_a = NULL, *cg_test_b = NULL; -+ char *cg_test_a_procs = NULL, *cg_test_b_procs = NULL; -+ int cg_test_b_procs_fd = -1; -+ struct lesser_ns_open_thread_arg targ = { .fd = -1 }; -+ pid_t pid; -+ int status; -+ -+ cg_test_a = cg_name(root, "cg_test_a"); -+ cg_test_b = cg_name(root, "cg_test_b"); -+ -+ if (!cg_test_a || !cg_test_b) -+ goto cleanup; -+ -+ cg_test_a_procs = cg_name(cg_test_a, "cgroup.procs"); -+ cg_test_b_procs = cg_name(cg_test_b, "cgroup.procs"); -+ -+ if (!cg_test_a_procs || !cg_test_b_procs) -+ goto cleanup; -+ -+ if (cg_create(cg_test_a) || cg_create(cg_test_b)) -+ goto cleanup; -+ -+ if (cg_enter_current(cg_test_b)) -+ goto cleanup; -+ -+ if (chown(cg_test_a_procs, test_euid, -1) || -+ chown(cg_test_b_procs, test_euid, -1)) -+ goto cleanup; -+ -+ targ.path = cg_test_b_procs; -+ pid = clone(lesser_ns_open_thread_fn, stack + sizeof(stack), -+ CLONE_NEWCGROUP | CLONE_FILES | CLONE_VM | SIGCHLD, -+ &targ); -+ if (pid < 0) -+ goto cleanup; -+ -+ if (waitpid(pid, &status, 0) < 0) -+ goto cleanup; -+ -+ if (!WIFEXITED(status)) -+ goto cleanup; -+ -+ cg_test_b_procs_fd = targ.fd; -+ if (cg_test_b_procs_fd < 0) -+ goto cleanup; -+ -+ if (cg_enter_current(cg_test_a)) -+ goto cleanup; -+ -+ if ((status = write(cg_test_b_procs_fd, "0", 1)) >= 0 || errno != ENOENT) -+ goto cleanup; -+ -+ ret = KSFT_PASS; -+ -+cleanup: -+ cg_enter_current(root); -+ if (cg_test_b_procs_fd >= 0) -+ close(cg_test_b_procs_fd); -+ if (cg_test_b) -+ cg_destroy(cg_test_b); -+ if (cg_test_a) -+ cg_destroy(cg_test_a); -+ free(cg_test_b_procs); -+ free(cg_test_a_procs); -+ free(cg_test_b); -+ free(cg_test_a); -+ return ret; -+} -+ - #define T(x) { x, #x } - struct corecg_test { - int (*fn)(const char *root); -@@ -366,6 +531,8 @@ struct corecg_test { - T(test_cgcore_parent_becomes_threaded), - T(test_cgcore_invalid_domain), - T(test_cgcore_populated), -+ T(test_cgcore_lesser_euid_open), -+ T(test_cgcore_lesser_ns_open), - }; - #undef T - -diff --git a/tools/testing/selftests/net/test_vxlan_under_vrf.sh b/tools/testing/selftests/net/test_vxlan_under_vrf.sh -index 09f9ed92cbe4c..a44b9aca74272 100755 ---- a/tools/testing/selftests/net/test_vxlan_under_vrf.sh -+++ b/tools/testing/selftests/net/test_vxlan_under_vrf.sh -@@ -118,11 +118,11 @@ echo "[ OK ]" - - # Move the underlay to a non-default VRF - ip -netns hv-1 link set veth0 vrf vrf-underlay --ip -netns hv-1 link set veth0 down --ip -netns hv-1 link set veth0 up -+ip -netns hv-1 link set vxlan0 down -+ip -netns hv-1 link set vxlan0 up - ip -netns hv-2 link set veth0 vrf vrf-underlay --ip -netns hv-2 link set veth0 down --ip -netns hv-2 link set veth0 up -+ip -netns hv-2 link set vxlan0 down -+ip -netns hv-2 link set vxlan0 up - - echo -n "Check VM connectivity through VXLAN (underlay in a VRF) " - ip netns exec vm-1 ping -c 1 -W 1 10.0.0.2 &> /dev/null || (echo "[FAIL]"; false) -diff --git a/tools/testing/selftests/x86/check_cc.sh b/tools/testing/selftests/x86/check_cc.sh -index 3e2089c8cf549..8c669c0d662ee 100755 ---- a/tools/testing/selftests/x86/check_cc.sh -+++ b/tools/testing/selftests/x86/check_cc.sh -@@ -7,7 +7,7 @@ CC="$1" - TESTPROG="$2" - shift 2 - --if "$CC" -o /dev/null "$TESTPROG" -O0 "$@" 2>/dev/null; then -+if [ -n "$CC" ] && $CC -o /dev/null "$TESTPROG" -O0 "$@" 2>/dev/null; then - echo 1 - else - echo 0 -diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c -index f31976010622f..287444e52ccf8 100644 ---- a/virt/kvm/kvm_main.c -+++ b/virt/kvm/kvm_main.c -@@ -115,6 +115,8 @@ EXPORT_SYMBOL_GPL(kvm_debugfs_dir); - static int kvm_debugfs_num_entries; - static const struct file_operations *stat_fops_per_vm[]; - -+static struct file_operations kvm_chardev_ops; -+ - static long kvm_vcpu_ioctl(struct file *file, unsigned int ioctl, - unsigned long arg); - #ifdef CONFIG_KVM_COMPAT -@@ -766,6 +768,16 @@ static struct kvm *kvm_create_vm(unsigned long type) - - preempt_notifier_inc(); - -+ /* -+ * When the fd passed to this ioctl() is opened it pins the module, -+ * but try_module_get() also prevents getting a reference if the module -+ * is in MODULE_STATE_GOING (e.g. if someone ran "rmmod --wait"). -+ */ -+ if (!try_module_get(kvm_chardev_ops.owner)) { -+ r = -ENODEV; -+ goto out_err; -+ } -+ - return kvm; - - out_err: -@@ -844,6 +856,7 @@ static void kvm_destroy_vm(struct kvm *kvm) - preempt_notifier_dec(); - hardware_disable_all(); - mmdrop(mm); -+ module_put(kvm_chardev_ops.owner); - } - - void kvm_get_kvm(struct kvm *kvm) diff --git a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.189-190.patch b/patch/kernel/archive/odroidxu4-5.4/patch-5.4.189-190.patch deleted file mode 100644 index 81f2d3b04..000000000 --- a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.189-190.patch +++ /dev/null @@ -1,1735 +0,0 @@ -diff --git a/Makefile b/Makefile -index cbb71900d3dcf..fd239ec16278b 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 5 - PATCHLEVEL = 4 --SUBLEVEL = 189 -+SUBLEVEL = 190 - EXTRAVERSION = - NAME = Kleptomaniac Octopus - -diff --git a/arch/arm/mach-davinci/board-da850-evm.c b/arch/arm/mach-davinci/board-da850-evm.c -index 5b3549f1236c5..b2ede9bf82dff 100644 ---- a/arch/arm/mach-davinci/board-da850-evm.c -+++ b/arch/arm/mach-davinci/board-da850-evm.c -@@ -1101,11 +1101,13 @@ static int __init da850_evm_config_emac(void) - int ret; - u32 val; - struct davinci_soc_info *soc_info = &davinci_soc_info; -- u8 rmii_en = soc_info->emac_pdata->rmii_en; -+ u8 rmii_en; - - if (!machine_is_davinci_da850_evm()) - return 0; - -+ rmii_en = soc_info->emac_pdata->rmii_en; -+ - cfg_chip3_base = DA8XX_SYSCFG0_VIRT(DA8XX_CFGCHIP3_REG); - - val = __raw_readl(cfg_chip3_base); -diff --git a/arch/arm64/kernel/alternative.c b/arch/arm64/kernel/alternative.c -index 73039949b5ce2..5f8e4c2df53cc 100644 ---- a/arch/arm64/kernel/alternative.c -+++ b/arch/arm64/kernel/alternative.c -@@ -41,7 +41,7 @@ bool alternative_is_applied(u16 cpufeature) - /* - * Check if the target PC is within an alternative block. - */ --static bool branch_insn_requires_update(struct alt_instr *alt, unsigned long pc) -+static __always_inline bool branch_insn_requires_update(struct alt_instr *alt, unsigned long pc) - { - unsigned long replptr = (unsigned long)ALT_REPL_PTR(alt); - return !(pc >= replptr && pc <= (replptr + alt->alt_len)); -@@ -49,7 +49,7 @@ static bool branch_insn_requires_update(struct alt_instr *alt, unsigned long pc) - - #define align_down(x, a) ((unsigned long)(x) & ~(((unsigned long)(a)) - 1)) - --static u32 get_alt_insn(struct alt_instr *alt, __le32 *insnptr, __le32 *altinsnptr) -+static __always_inline u32 get_alt_insn(struct alt_instr *alt, __le32 *insnptr, __le32 *altinsnptr) - { - u32 insn; - -@@ -94,7 +94,7 @@ static u32 get_alt_insn(struct alt_instr *alt, __le32 *insnptr, __le32 *altinsnp - return insn; - } - --static void patch_alternative(struct alt_instr *alt, -+static noinstr void patch_alternative(struct alt_instr *alt, - __le32 *origptr, __le32 *updptr, int nr_inst) - { - __le32 *replptr; -diff --git a/arch/powerpc/include/asm/page.h b/arch/powerpc/include/asm/page.h -index 6ba5adb96a3be..0d8f9246ce153 100644 ---- a/arch/powerpc/include/asm/page.h -+++ b/arch/powerpc/include/asm/page.h -@@ -132,7 +132,11 @@ static inline bool pfn_valid(unsigned long pfn) - #define virt_to_page(kaddr) pfn_to_page(virt_to_pfn(kaddr)) - #define pfn_to_kaddr(pfn) __va((pfn) << PAGE_SHIFT) - --#define virt_addr_valid(kaddr) pfn_valid(virt_to_pfn(kaddr)) -+#define virt_addr_valid(vaddr) ({ \ -+ unsigned long _addr = (unsigned long)vaddr; \ -+ _addr >= PAGE_OFFSET && _addr < (unsigned long)high_memory && \ -+ pfn_valid(virt_to_pfn(_addr)); \ -+}) - - /* - * On Book-E parts we need __va to parse the device tree and we can't -diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c -index dca1590f295d0..af8a1bac93458 100644 ---- a/drivers/ata/libata-core.c -+++ b/drivers/ata/libata-core.c -@@ -4580,6 +4580,9 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = { - ATA_HORKAGE_ZERO_AFTER_TRIM, }, - { "Crucial_CT*MX100*", "MU01", ATA_HORKAGE_NO_NCQ_TRIM | - ATA_HORKAGE_ZERO_AFTER_TRIM, }, -+ { "Samsung SSD 840 EVO*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | -+ ATA_HORKAGE_NO_DMA_LOG | -+ ATA_HORKAGE_ZERO_AFTER_TRIM, }, - { "Samsung SSD 840*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | - ATA_HORKAGE_ZERO_AFTER_TRIM, }, - { "Samsung SSD 850*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | -diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c -index 13c6eee481da7..d71c7b9b96650 100644 ---- a/drivers/gpio/gpiolib-acpi.c -+++ b/drivers/gpio/gpiolib-acpi.c -@@ -275,8 +275,8 @@ static acpi_status acpi_gpiochip_alloc_event(struct acpi_resource *ares, - pin = agpio->pin_table[0]; - - if (pin <= 255) { -- char ev_name[5]; -- sprintf(ev_name, "_%c%02hhX", -+ char ev_name[8]; -+ sprintf(ev_name, "_%c%02X", - agpio->triggering == ACPI_EDGE_SENSITIVE ? 'E' : 'L', - pin); - if (ACPI_SUCCESS(acpi_get_handle(handle, ev_name, &evt_handle))) -diff --git a/drivers/gpu/drm/amd/amdgpu/ObjectID.h b/drivers/gpu/drm/amd/amdgpu/ObjectID.h -index 5b393622f5920..a0f0a17e224fe 100644 ---- a/drivers/gpu/drm/amd/amdgpu/ObjectID.h -+++ b/drivers/gpu/drm/amd/amdgpu/ObjectID.h -@@ -119,6 +119,7 @@ - #define CONNECTOR_OBJECT_ID_eDP 0x14 - #define CONNECTOR_OBJECT_ID_MXM 0x15 - #define CONNECTOR_OBJECT_ID_LVDS_eDP 0x16 -+#define CONNECTOR_OBJECT_ID_USBC 0x17 - - /* deleted */ - -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c -index e8e1720104160..ffd7547135225 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c -@@ -633,7 +633,7 @@ MODULE_PARM_DESC(sched_policy, - * Maximum number of processes that HWS can schedule concurrently. The maximum is the - * number of VMIDs assigned to the HWS, which is also the default. - */ --int hws_max_conc_proc = 8; -+int hws_max_conc_proc = -1; - module_param(hws_max_conc_proc, int, 0444); - MODULE_PARM_DESC(hws_max_conc_proc, - "Max # processes HWS can execute concurrently when sched_policy=0 (0 = no concurrency, #VMIDs for KFD = Maximum(default))"); -diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device.c b/drivers/gpu/drm/amd/amdkfd/kfd_device.c -index ad9483b9eea32..60ee1a8321129 100644 ---- a/drivers/gpu/drm/amd/amdkfd/kfd_device.c -+++ b/drivers/gpu/drm/amd/amdkfd/kfd_device.c -@@ -609,15 +609,10 @@ bool kgd2kfd_device_init(struct kfd_dev *kfd, - - kfd->vm_info.first_vmid_kfd + 1; - - /* Verify module parameters regarding mapped process number*/ -- if ((hws_max_conc_proc < 0) -- || (hws_max_conc_proc > kfd->vm_info.vmid_num_kfd)) { -- dev_err(kfd_device, -- "hws_max_conc_proc %d must be between 0 and %d, use %d instead\n", -- hws_max_conc_proc, kfd->vm_info.vmid_num_kfd, -- kfd->vm_info.vmid_num_kfd); -+ if (hws_max_conc_proc >= 0) -+ kfd->max_proc_per_quantum = min((u32)hws_max_conc_proc, kfd->vm_info.vmid_num_kfd); -+ else - kfd->max_proc_per_quantum = kfd->vm_info.vmid_num_kfd; -- } else -- kfd->max_proc_per_quantum = hws_max_conc_proc; - - /* Allocate global GWS that is shared by all KFD processes */ - if (hws_gws_support && amdgpu_amdkfd_alloc_gws(kfd->kgd, -diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_events.c b/drivers/gpu/drm/amd/amdkfd/kfd_events.c -index d674d4b3340fa..adbb2fec2e0f2 100644 ---- a/drivers/gpu/drm/amd/amdkfd/kfd_events.c -+++ b/drivers/gpu/drm/amd/amdkfd/kfd_events.c -@@ -532,6 +532,8 @@ static struct kfd_event_waiter *alloc_event_waiters(uint32_t num_events) - event_waiters = kmalloc_array(num_events, - sizeof(struct kfd_event_waiter), - GFP_KERNEL); -+ if (!event_waiters) -+ return NULL; - - for (i = 0; (event_waiters) && (i < num_events) ; i++) { - init_wait(&event_waiters[i].wait); -diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -index c5231c50c4126..de33864af70b8 100644 ---- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -@@ -1210,7 +1210,8 @@ static int dm_resume(void *handle) - * this is the case when traversing through already created - * MST connectors, should be skipped - */ -- if (aconnector->mst_port) -+ if (aconnector->dc_link && -+ aconnector->dc_link->type == dc_connection_mst_branch) - continue; - - mutex_lock(&aconnector->hpd_lock); -diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c -index 95a5310e9e661..de246e183d6ba 100644 ---- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c -+++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c -@@ -1546,8 +1546,8 @@ bool dc_is_stream_unchanged( - if (old_stream->ignore_msa_timing_param != stream->ignore_msa_timing_param) - return false; - -- // Only Have Audio left to check whether it is same or not. This is a corner case for Tiled sinks -- if (old_stream->audio_info.mode_count != stream->audio_info.mode_count) -+ /*compare audio info*/ -+ if (memcmp(&old_stream->audio_info, &stream->audio_info, sizeof(stream->audio_info)) != 0) - return false; - - return true; -diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c -index bc5ebea1abede..fa3acf60e7bd2 100644 ---- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c -+++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c -@@ -2202,14 +2202,18 @@ static void dcn10_update_mpcc(struct dc *dc, struct pipe_ctx *pipe_ctx) - &blnd_cfg.black_color); - } - -- if (per_pixel_alpha) -- blnd_cfg.alpha_mode = MPCC_ALPHA_BLEND_MODE_PER_PIXEL_ALPHA; -- else -- blnd_cfg.alpha_mode = MPCC_ALPHA_BLEND_MODE_GLOBAL_ALPHA; -- - blnd_cfg.overlap_only = false; - blnd_cfg.global_gain = 0xff; - -+ if (per_pixel_alpha && pipe_ctx->plane_state->global_alpha) { -+ blnd_cfg.alpha_mode = MPCC_ALPHA_BLEND_MODE_PER_PIXEL_ALPHA_COMBINED_GLOBAL_GAIN; -+ blnd_cfg.global_gain = pipe_ctx->plane_state->global_alpha_value; -+ } else if (per_pixel_alpha) { -+ blnd_cfg.alpha_mode = MPCC_ALPHA_BLEND_MODE_PER_PIXEL_ALPHA; -+ } else { -+ blnd_cfg.alpha_mode = MPCC_ALPHA_BLEND_MODE_GLOBAL_ALPHA; -+ } -+ - if (pipe_ctx->plane_state->global_alpha) - blnd_cfg.global_alpha = pipe_ctx->plane_state->global_alpha_value; - else -diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c -index 03a2e1d7f0673..f7965a5d24442 100644 ---- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c -+++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c -@@ -1740,14 +1740,18 @@ static void dcn20_update_mpcc(struct dc *dc, struct pipe_ctx *pipe_ctx) - pipe_ctx, &blnd_cfg.black_color); - } - -- if (per_pixel_alpha) -- blnd_cfg.alpha_mode = MPCC_ALPHA_BLEND_MODE_PER_PIXEL_ALPHA; -- else -- blnd_cfg.alpha_mode = MPCC_ALPHA_BLEND_MODE_GLOBAL_ALPHA; -- - blnd_cfg.overlap_only = false; - blnd_cfg.global_gain = 0xff; - -+ if (per_pixel_alpha && pipe_ctx->plane_state->global_alpha) { -+ blnd_cfg.alpha_mode = MPCC_ALPHA_BLEND_MODE_PER_PIXEL_ALPHA_COMBINED_GLOBAL_GAIN; -+ blnd_cfg.global_gain = pipe_ctx->plane_state->global_alpha_value; -+ } else if (per_pixel_alpha) { -+ blnd_cfg.alpha_mode = MPCC_ALPHA_BLEND_MODE_PER_PIXEL_ALPHA; -+ } else { -+ blnd_cfg.alpha_mode = MPCC_ALPHA_BLEND_MODE_GLOBAL_ALPHA; -+ } -+ - if (pipe_ctx->plane_state->global_alpha) - blnd_cfg.global_alpha = pipe_ctx->plane_state->global_alpha_value; - else -diff --git a/drivers/gpu/drm/amd/display/modules/info_packet/info_packet.c b/drivers/gpu/drm/amd/display/modules/info_packet/info_packet.c -index d885d642ed7fc..537736713598b 100644 ---- a/drivers/gpu/drm/amd/display/modules/info_packet/info_packet.c -+++ b/drivers/gpu/drm/amd/display/modules/info_packet/info_packet.c -@@ -85,7 +85,8 @@ - //PB7 = MD0 - #define MASK_VTEM_MD0__VRR_EN 0x01 - #define MASK_VTEM_MD0__M_CONST 0x02 --#define MASK_VTEM_MD0__RESERVED2 0x0C -+#define MASK_VTEM_MD0__QMS_EN 0x04 -+#define MASK_VTEM_MD0__RESERVED2 0x08 - #define MASK_VTEM_MD0__FVA_FACTOR_M1 0xF0 - - //MD1 -@@ -94,7 +95,7 @@ - //MD2 - #define MASK_VTEM_MD2__BASE_REFRESH_RATE_98 0x03 - #define MASK_VTEM_MD2__RB 0x04 --#define MASK_VTEM_MD2__RESERVED3 0xF8 -+#define MASK_VTEM_MD2__NEXT_TFR 0xF8 - - //MD3 - #define MASK_VTEM_MD3__BASE_REFRESH_RATE_07 0xFF -diff --git a/drivers/gpu/drm/msm/dsi/dsi_manager.c b/drivers/gpu/drm/msm/dsi/dsi_manager.c -index 73127948f54d9..f3ff2cdc288ba 100644 ---- a/drivers/gpu/drm/msm/dsi/dsi_manager.c -+++ b/drivers/gpu/drm/msm/dsi/dsi_manager.c -@@ -625,7 +625,7 @@ struct drm_connector *msm_dsi_manager_connector_init(u8 id) - return connector; - - fail: -- connector->funcs->destroy(msm_dsi->connector); -+ connector->funcs->destroy(connector); - return ERR_PTR(ret); - } - -diff --git a/drivers/gpu/ipu-v3/ipu-di.c b/drivers/gpu/ipu-v3/ipu-di.c -index b4a31d506fccf..74eca68891add 100644 ---- a/drivers/gpu/ipu-v3/ipu-di.c -+++ b/drivers/gpu/ipu-v3/ipu-di.c -@@ -451,8 +451,9 @@ static void ipu_di_config_clock(struct ipu_di *di, - - error = rate / (sig->mode.pixelclock / 1000); - -- dev_dbg(di->ipu->dev, " IPU clock can give %lu with divider %u, error %d.%u%%\n", -- rate, div, (signed)(error - 1000) / 10, error % 10); -+ dev_dbg(di->ipu->dev, " IPU clock can give %lu with divider %u, error %c%d.%d%%\n", -+ rate, div, error < 1000 ? '-' : '+', -+ abs(error - 1000) / 10, abs(error - 1000) % 10); - - /* Allow a 1% error */ - if (error < 1010 && error >= 990) { -diff --git a/drivers/hv/ring_buffer.c b/drivers/hv/ring_buffer.c -index 9a03b163cbbda..59f1e64908b1d 100644 ---- a/drivers/hv/ring_buffer.c -+++ b/drivers/hv/ring_buffer.c -@@ -378,7 +378,16 @@ int hv_ringbuffer_read(struct vmbus_channel *channel, - static u32 hv_pkt_iter_avail(const struct hv_ring_buffer_info *rbi) - { - u32 priv_read_loc = rbi->priv_read_index; -- u32 write_loc = READ_ONCE(rbi->ring_buffer->write_index); -+ u32 write_loc; -+ -+ /* -+ * The Hyper-V host writes the packet data, then uses -+ * store_release() to update the write_index. Use load_acquire() -+ * here to prevent loads of the packet data from being re-ordered -+ * before the read of the write_index and potentially getting -+ * stale data. -+ */ -+ write_loc = virt_load_acquire(&rbi->ring_buffer->write_index); - - if (write_loc >= priv_read_loc) - return write_loc - priv_read_loc; -diff --git a/drivers/i2c/busses/i2c-pasemi.c b/drivers/i2c/busses/i2c-pasemi.c -index 20f2772c0e79b..2c909522f0f38 100644 ---- a/drivers/i2c/busses/i2c-pasemi.c -+++ b/drivers/i2c/busses/i2c-pasemi.c -@@ -137,6 +137,12 @@ static int pasemi_i2c_xfer_msg(struct i2c_adapter *adapter, - - TXFIFO_WR(smbus, msg->buf[msg->len-1] | - (stop ? MTXFIFO_STOP : 0)); -+ -+ if (stop) { -+ err = pasemi_smb_waitready(smbus); -+ if (err) -+ goto reset_out; -+ } - } - - return 0; -diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c -index 9f4d657dd36c8..28a9eeae83b66 100644 ---- a/drivers/md/dm-integrity.c -+++ b/drivers/md/dm-integrity.c -@@ -4054,6 +4054,7 @@ try_smaller_buffer: - } - - if (ic->internal_hash) { -+ size_t recalc_tags_size; - ic->recalc_wq = alloc_workqueue("dm-integrity-recalc", WQ_MEM_RECLAIM, 1); - if (!ic->recalc_wq ) { - ti->error = "Cannot allocate workqueue"; -@@ -4067,8 +4068,10 @@ try_smaller_buffer: - r = -ENOMEM; - goto bad; - } -- ic->recalc_tags = kvmalloc_array(RECALC_SECTORS >> ic->sb->log2_sectors_per_block, -- ic->tag_size, GFP_KERNEL); -+ recalc_tags_size = (RECALC_SECTORS >> ic->sb->log2_sectors_per_block) * ic->tag_size; -+ if (crypto_shash_digestsize(ic->internal_hash) > ic->tag_size) -+ recalc_tags_size += crypto_shash_digestsize(ic->internal_hash) - ic->tag_size; -+ ic->recalc_tags = kvmalloc(recalc_tags_size, GFP_KERNEL); - if (!ic->recalc_tags) { - ti->error = "Cannot allocate tags for recalculating"; - r = -ENOMEM; -diff --git a/drivers/memory/atmel-ebi.c b/drivers/memory/atmel-ebi.c -index 89646896a1833..6f9cf6270a437 100644 ---- a/drivers/memory/atmel-ebi.c -+++ b/drivers/memory/atmel-ebi.c -@@ -545,20 +545,27 @@ static int atmel_ebi_probe(struct platform_device *pdev) - smc_np = of_parse_phandle(dev->of_node, "atmel,smc", 0); - - ebi->smc.regmap = syscon_node_to_regmap(smc_np); -- if (IS_ERR(ebi->smc.regmap)) -- return PTR_ERR(ebi->smc.regmap); -+ if (IS_ERR(ebi->smc.regmap)) { -+ ret = PTR_ERR(ebi->smc.regmap); -+ goto put_node; -+ } - - ebi->smc.layout = atmel_hsmc_get_reg_layout(smc_np); -- if (IS_ERR(ebi->smc.layout)) -- return PTR_ERR(ebi->smc.layout); -+ if (IS_ERR(ebi->smc.layout)) { -+ ret = PTR_ERR(ebi->smc.layout); -+ goto put_node; -+ } - - ebi->smc.clk = of_clk_get(smc_np, 0); - if (IS_ERR(ebi->smc.clk)) { -- if (PTR_ERR(ebi->smc.clk) != -ENOENT) -- return PTR_ERR(ebi->smc.clk); -+ if (PTR_ERR(ebi->smc.clk) != -ENOENT) { -+ ret = PTR_ERR(ebi->smc.clk); -+ goto put_node; -+ } - - ebi->smc.clk = NULL; - } -+ of_node_put(smc_np); - ret = clk_prepare_enable(ebi->smc.clk); - if (ret) - return ret; -@@ -609,6 +616,10 @@ static int atmel_ebi_probe(struct platform_device *pdev) - } - - return of_platform_populate(np, NULL, NULL, dev); -+ -+put_node: -+ of_node_put(smc_np); -+ return ret; - } - - static __maybe_unused int atmel_ebi_resume(struct device *dev) -diff --git a/drivers/net/ethernet/mellanox/mlxsw/i2c.c b/drivers/net/ethernet/mellanox/mlxsw/i2c.c -index 95f408d0e103c..7cc4c30af1a71 100644 ---- a/drivers/net/ethernet/mellanox/mlxsw/i2c.c -+++ b/drivers/net/ethernet/mellanox/mlxsw/i2c.c -@@ -649,6 +649,7 @@ static int mlxsw_i2c_probe(struct i2c_client *client, - return 0; - - errout: -+ mutex_destroy(&mlxsw_i2c->cmd.lock); - i2c_set_clientdata(client, NULL); - - return err; -diff --git a/drivers/net/ethernet/micrel/Kconfig b/drivers/net/ethernet/micrel/Kconfig -index b9c4d48e28e42..120ed4633a096 100644 ---- a/drivers/net/ethernet/micrel/Kconfig -+++ b/drivers/net/ethernet/micrel/Kconfig -@@ -37,6 +37,7 @@ config KS8851 - config KS8851_MLL - tristate "Micrel KS8851 MLL" - depends on HAS_IOMEM -+ depends on PTP_1588_CLOCK_OPTIONAL - select MII - ---help--- - This platform driver is for Micrel KS8851 Address/data bus -diff --git a/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.c b/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.c -index cd478d2cd871a..00f6d347eaf75 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.c -+++ b/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.c -@@ -57,10 +57,6 @@ - #define TSE_PCS_USE_SGMII_ENA BIT(0) - #define TSE_PCS_IF_USE_SGMII 0x03 - --#define SGMII_ADAPTER_CTRL_REG 0x00 --#define SGMII_ADAPTER_DISABLE 0x0001 --#define SGMII_ADAPTER_ENABLE 0x0000 -- - #define AUTONEGO_LINK_TIMER 20 - - static int tse_pcs_reset(void __iomem *base, struct tse_pcs *pcs) -@@ -202,12 +198,8 @@ void tse_pcs_fix_mac_speed(struct tse_pcs *pcs, struct phy_device *phy_dev, - unsigned int speed) - { - void __iomem *tse_pcs_base = pcs->tse_pcs_base; -- void __iomem *sgmii_adapter_base = pcs->sgmii_adapter_base; - u32 val; - -- writew(SGMII_ADAPTER_ENABLE, -- sgmii_adapter_base + SGMII_ADAPTER_CTRL_REG); -- - pcs->autoneg = phy_dev->autoneg; - - if (phy_dev->autoneg == AUTONEG_ENABLE) { -diff --git a/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.h b/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.h -index 442812c0a4bdc..694ac25ef426b 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.h -+++ b/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.h -@@ -10,6 +10,10 @@ - #include - #include - -+#define SGMII_ADAPTER_CTRL_REG 0x00 -+#define SGMII_ADAPTER_ENABLE 0x0000 -+#define SGMII_ADAPTER_DISABLE 0x0001 -+ - struct tse_pcs { - struct device *dev; - void __iomem *tse_pcs_base; -diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c -index 70d41783329dd..72e47621d27c7 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c -+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c -@@ -18,9 +18,6 @@ - - #include "altr_tse_pcs.h" - --#define SGMII_ADAPTER_CTRL_REG 0x00 --#define SGMII_ADAPTER_DISABLE 0x0001 -- - #define SYSMGR_EMACGRP_CTRL_PHYSEL_ENUM_GMII_MII 0x0 - #define SYSMGR_EMACGRP_CTRL_PHYSEL_ENUM_RGMII 0x1 - #define SYSMGR_EMACGRP_CTRL_PHYSEL_ENUM_RMII 0x2 -@@ -62,16 +59,14 @@ static void socfpga_dwmac_fix_mac_speed(void *priv, unsigned int speed) - { - struct socfpga_dwmac *dwmac = (struct socfpga_dwmac *)priv; - void __iomem *splitter_base = dwmac->splitter_base; -- void __iomem *tse_pcs_base = dwmac->pcs.tse_pcs_base; - void __iomem *sgmii_adapter_base = dwmac->pcs.sgmii_adapter_base; - struct device *dev = dwmac->dev; - struct net_device *ndev = dev_get_drvdata(dev); - struct phy_device *phy_dev = ndev->phydev; - u32 val; - -- if ((tse_pcs_base) && (sgmii_adapter_base)) -- writew(SGMII_ADAPTER_DISABLE, -- sgmii_adapter_base + SGMII_ADAPTER_CTRL_REG); -+ writew(SGMII_ADAPTER_DISABLE, -+ sgmii_adapter_base + SGMII_ADAPTER_CTRL_REG); - - if (splitter_base) { - val = readl(splitter_base + EMAC_SPLITTER_CTRL_REG); -@@ -93,7 +88,9 @@ static void socfpga_dwmac_fix_mac_speed(void *priv, unsigned int speed) - writel(val, splitter_base + EMAC_SPLITTER_CTRL_REG); - } - -- if (tse_pcs_base && sgmii_adapter_base) -+ writew(SGMII_ADAPTER_ENABLE, -+ sgmii_adapter_base + SGMII_ADAPTER_CTRL_REG); -+ if (phy_dev) - tse_pcs_fix_mac_speed(&dwmac->pcs, phy_dev, speed); - } - -diff --git a/drivers/net/slip/slip.c b/drivers/net/slip/slip.c -index 8e56a41dd7585..096617982998f 100644 ---- a/drivers/net/slip/slip.c -+++ b/drivers/net/slip/slip.c -@@ -471,7 +471,7 @@ static void sl_tx_timeout(struct net_device *dev) - spin_lock(&sl->lock); - - if (netif_queue_stopped(dev)) { -- if (!netif_running(dev)) -+ if (!netif_running(dev) || !sl->tty) - goto out; - - /* May be we must check transmitter timeout here ? -diff --git a/drivers/net/usb/aqc111.c b/drivers/net/usb/aqc111.c -index 7e44110746dd0..68912e266826b 100644 ---- a/drivers/net/usb/aqc111.c -+++ b/drivers/net/usb/aqc111.c -@@ -1102,10 +1102,15 @@ static int aqc111_rx_fixup(struct usbnet *dev, struct sk_buff *skb) - if (start_of_descs != desc_offset) - goto err; - -- /* self check desc_offset from header*/ -- if (desc_offset >= skb_len) -+ /* self check desc_offset from header and make sure that the -+ * bounds of the metadata array are inside the SKB -+ */ -+ if (pkt_count * 2 + desc_offset >= skb_len) - goto err; - -+ /* Packets must not overlap the metadata array */ -+ skb_trim(skb, desc_offset); -+ - if (pkt_count == 0) - goto err; - -diff --git a/drivers/net/veth.c b/drivers/net/veth.c -index 10a876f8831c7..683425e3a353c 100644 ---- a/drivers/net/veth.c -+++ b/drivers/net/veth.c -@@ -245,7 +245,7 @@ static netdev_tx_t veth_xmit(struct sk_buff *skb, struct net_device *dev) - - rcu_read_lock(); - rcv = rcu_dereference(priv->peer); -- if (unlikely(!rcv)) { -+ if (unlikely(!rcv) || !pskb_may_pull(skb, ETH_HLEN)) { - kfree_skb(skb); - goto drop; - } -diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c -index ec13bd8d5487d..eb5751a45f266 100644 ---- a/drivers/net/wireless/ath/ath9k/main.c -+++ b/drivers/net/wireless/ath/ath9k/main.c -@@ -836,7 +836,7 @@ static bool ath9k_txq_list_has_key(struct list_head *txq_list, u32 keyix) - continue; - - txinfo = IEEE80211_SKB_CB(bf->bf_mpdu); -- fi = (struct ath_frame_info *)&txinfo->rate_driver_data[0]; -+ fi = (struct ath_frame_info *)&txinfo->status.status_driver_data[0]; - if (fi->keyix == keyix) - return true; - } -diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c -index 14e6871a14054..fdb2152345eba 100644 ---- a/drivers/net/wireless/ath/ath9k/xmit.c -+++ b/drivers/net/wireless/ath/ath9k/xmit.c -@@ -141,8 +141,8 @@ static struct ath_frame_info *get_frame_info(struct sk_buff *skb) - { - struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb); - BUILD_BUG_ON(sizeof(struct ath_frame_info) > -- sizeof(tx_info->rate_driver_data)); -- return (struct ath_frame_info *) &tx_info->rate_driver_data[0]; -+ sizeof(tx_info->status.status_driver_data)); -+ return (struct ath_frame_info *) &tx_info->status.status_driver_data[0]; - } - - static void ath_send_bar(struct ath_atx_tid *tid, u16 seqno) -@@ -2498,6 +2498,16 @@ skip_tx_complete: - spin_unlock_irqrestore(&sc->tx.txbuflock, flags); - } - -+static void ath_clear_tx_status(struct ieee80211_tx_info *tx_info) -+{ -+ void *ptr = &tx_info->status; -+ -+ memset(ptr + sizeof(tx_info->status.rates), 0, -+ sizeof(tx_info->status) - -+ sizeof(tx_info->status.rates) - -+ sizeof(tx_info->status.status_driver_data)); -+} -+ - static void ath_tx_rc_status(struct ath_softc *sc, struct ath_buf *bf, - struct ath_tx_status *ts, int nframes, int nbad, - int txok) -@@ -2509,6 +2519,8 @@ static void ath_tx_rc_status(struct ath_softc *sc, struct ath_buf *bf, - struct ath_hw *ah = sc->sc_ah; - u8 i, tx_rateindex; - -+ ath_clear_tx_status(tx_info); -+ - if (txok) - tx_info->status.ack_signal = ts->ts_rssi; - -@@ -2523,6 +2535,13 @@ static void ath_tx_rc_status(struct ath_softc *sc, struct ath_buf *bf, - tx_info->status.ampdu_len = nframes; - tx_info->status.ampdu_ack_len = nframes - nbad; - -+ tx_info->status.rates[tx_rateindex].count = ts->ts_longretry + 1; -+ -+ for (i = tx_rateindex + 1; i < hw->max_rates; i++) { -+ tx_info->status.rates[i].count = 0; -+ tx_info->status.rates[i].idx = -1; -+ } -+ - if ((ts->ts_status & ATH9K_TXERR_FILT) == 0 && - (tx_info->flags & IEEE80211_TX_CTL_NO_ACK) == 0) { - /* -@@ -2544,16 +2563,6 @@ static void ath_tx_rc_status(struct ath_softc *sc, struct ath_buf *bf, - tx_info->status.rates[tx_rateindex].count = - hw->max_rate_tries; - } -- -- for (i = tx_rateindex + 1; i < hw->max_rates; i++) { -- tx_info->status.rates[i].count = 0; -- tx_info->status.rates[i].idx = -1; -- } -- -- tx_info->status.rates[tx_rateindex].count = ts->ts_longretry + 1; -- -- /* we report airtime in ath_tx_count_airtime(), don't report twice */ -- tx_info->status.tx_time = 0; - } - - static void ath_tx_processq(struct ath_softc *sc, struct ath_txq *txq) -diff --git a/drivers/perf/fsl_imx8_ddr_perf.c b/drivers/perf/fsl_imx8_ddr_perf.c -index 726ed8f59868c..912a220a9db92 100644 ---- a/drivers/perf/fsl_imx8_ddr_perf.c -+++ b/drivers/perf/fsl_imx8_ddr_perf.c -@@ -29,7 +29,7 @@ - #define CNTL_OVER_MASK 0xFFFFFFFE - - #define CNTL_CSV_SHIFT 24 --#define CNTL_CSV_MASK (0xFF << CNTL_CSV_SHIFT) -+#define CNTL_CSV_MASK (0xFFU << CNTL_CSV_SHIFT) - - #define EVENT_CYCLES_ID 0 - #define EVENT_CYCLES_COUNTER 0 -diff --git a/drivers/regulator/wm8994-regulator.c b/drivers/regulator/wm8994-regulator.c -index cadea0344486f..40befdd9dfa92 100644 ---- a/drivers/regulator/wm8994-regulator.c -+++ b/drivers/regulator/wm8994-regulator.c -@@ -71,6 +71,35 @@ static const struct regulator_ops wm8994_ldo2_ops = { - }; - - static const struct regulator_desc wm8994_ldo_desc[] = { -+ { -+ .name = "LDO1", -+ .id = 1, -+ .type = REGULATOR_VOLTAGE, -+ .n_voltages = WM8994_LDO1_MAX_SELECTOR + 1, -+ .vsel_reg = WM8994_LDO_1, -+ .vsel_mask = WM8994_LDO1_VSEL_MASK, -+ .ops = &wm8994_ldo1_ops, -+ .min_uV = 2400000, -+ .uV_step = 100000, -+ .enable_time = 3000, -+ .off_on_delay = 36000, -+ .owner = THIS_MODULE, -+ }, -+ { -+ .name = "LDO2", -+ .id = 2, -+ .type = REGULATOR_VOLTAGE, -+ .n_voltages = WM8994_LDO2_MAX_SELECTOR + 1, -+ .vsel_reg = WM8994_LDO_2, -+ .vsel_mask = WM8994_LDO2_VSEL_MASK, -+ .ops = &wm8994_ldo2_ops, -+ .enable_time = 3000, -+ .off_on_delay = 36000, -+ .owner = THIS_MODULE, -+ }, -+}; -+ -+static const struct regulator_desc wm8958_ldo_desc[] = { - { - .name = "LDO1", - .id = 1, -@@ -172,9 +201,16 @@ static int wm8994_ldo_probe(struct platform_device *pdev) - * regulator core and we need not worry about it on the - * error path. - */ -- ldo->regulator = devm_regulator_register(&pdev->dev, -- &wm8994_ldo_desc[id], -- &config); -+ if (ldo->wm8994->type == WM8994) { -+ ldo->regulator = devm_regulator_register(&pdev->dev, -+ &wm8994_ldo_desc[id], -+ &config); -+ } else { -+ ldo->regulator = devm_regulator_register(&pdev->dev, -+ &wm8958_ldo_desc[id], -+ &config); -+ } -+ - if (IS_ERR(ldo->regulator)) { - ret = PTR_ERR(ldo->regulator); - dev_err(wm8994->dev, "Failed to register LDO%d: %d\n", -diff --git a/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c b/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c -index a929fe76102b0..d5b2917aea44f 100644 ---- a/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c -+++ b/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c -@@ -35,7 +35,7 @@ - - #define IBMVSCSIS_VERSION "v0.2" - --#define INITIAL_SRP_LIMIT 800 -+#define INITIAL_SRP_LIMIT 1024 - #define DEFAULT_MAX_SECTORS 256 - #define MAX_TXU 1024 * 1024 - -diff --git a/drivers/scsi/megaraid/megaraid_sas.h b/drivers/scsi/megaraid/megaraid_sas.h -index 3d43ac9772f7e..aa62cc8ffd0af 100644 ---- a/drivers/scsi/megaraid/megaraid_sas.h -+++ b/drivers/scsi/megaraid/megaraid_sas.h -@@ -2551,6 +2551,9 @@ struct megasas_instance_template { - #define MEGASAS_IS_LOGICAL(sdev) \ - ((sdev->channel < MEGASAS_MAX_PD_CHANNELS) ? 0 : 1) - -+#define MEGASAS_IS_LUN_VALID(sdev) \ -+ (((sdev)->lun == 0) ? 1 : 0) -+ - #define MEGASAS_DEV_INDEX(scp) \ - (((scp->device->channel % 2) * MEGASAS_MAX_DEV_PER_CHANNEL) + \ - scp->device->id) -diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c -index 6700d43b12ff5..a261ce511e9ed 100644 ---- a/drivers/scsi/megaraid/megaraid_sas_base.c -+++ b/drivers/scsi/megaraid/megaraid_sas_base.c -@@ -2102,6 +2102,9 @@ static int megasas_slave_alloc(struct scsi_device *sdev) - goto scan_target; - } - return -ENXIO; -+ } else if (!MEGASAS_IS_LUN_VALID(sdev)) { -+ sdev_printk(KERN_INFO, sdev, "%s: invalid LUN\n", __func__); -+ return -ENXIO; - } - - scan_target: -@@ -2132,6 +2135,10 @@ static void megasas_slave_destroy(struct scsi_device *sdev) - instance = megasas_lookup_instance(sdev->host->host_no); - - if (MEGASAS_IS_LOGICAL(sdev)) { -+ if (!MEGASAS_IS_LUN_VALID(sdev)) { -+ sdev_printk(KERN_INFO, sdev, "%s: invalid LUN\n", __func__); -+ return; -+ } - ld_tgt_id = MEGASAS_TARGET_ID(sdev); - instance->ld_tgtid_status[ld_tgt_id] = LD_TARGET_ID_DELETED; - if (megasas_dbg_lvl & LD_PD_DEBUG) -diff --git a/drivers/scsi/mvsas/mv_init.c b/drivers/scsi/mvsas/mv_init.c -index c16d7fb0fdcbb..0c5e2c6105867 100644 ---- a/drivers/scsi/mvsas/mv_init.c -+++ b/drivers/scsi/mvsas/mv_init.c -@@ -646,6 +646,7 @@ static struct pci_device_id mvs_pci_table[] = { - { PCI_VDEVICE(ARECA, PCI_DEVICE_ID_ARECA_1300), chip_1300 }, - { PCI_VDEVICE(ARECA, PCI_DEVICE_ID_ARECA_1320), chip_1320 }, - { PCI_VDEVICE(ADAPTEC2, 0x0450), chip_6440 }, -+ { PCI_VDEVICE(TTI, 0x2640), chip_6440 }, - { PCI_VDEVICE(TTI, 0x2710), chip_9480 }, - { PCI_VDEVICE(TTI, 0x2720), chip_9480 }, - { PCI_VDEVICE(TTI, 0x2721), chip_9480 }, -diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c -index 71144e33272a3..077c56cbed4e1 100644 ---- a/drivers/target/target_core_user.c -+++ b/drivers/target/target_core_user.c -@@ -1488,6 +1488,7 @@ static struct page *tcmu_try_get_block_page(struct tcmu_dev *udev, uint32_t dbi) - mutex_lock(&udev->cmdr_lock); - page = tcmu_get_block_page(udev, dbi); - if (likely(page)) { -+ get_page(page); - mutex_unlock(&udev->cmdr_lock); - return page; - } -@@ -1526,6 +1527,7 @@ static vm_fault_t tcmu_vma_fault(struct vm_fault *vmf) - /* For the vmalloc()ed cmd area pages */ - addr = (void *)(unsigned long)info->mem[mi].addr + offset; - page = vmalloc_to_page(addr); -+ get_page(page); - } else { - uint32_t dbi; - -@@ -1536,7 +1538,6 @@ static vm_fault_t tcmu_vma_fault(struct vm_fault *vmf) - return VM_FAULT_SIGBUS; - } - -- get_page(page); - vmf->page = page; - return 0; - } -diff --git a/fs/btrfs/block-group.c b/fs/btrfs/block-group.c -index e98d6ea35ea80..bcf19dfb0af35 100644 ---- a/fs/btrfs/block-group.c -+++ b/fs/btrfs/block-group.c -@@ -2388,7 +2388,6 @@ int btrfs_start_dirty_block_groups(struct btrfs_trans_handle *trans) - struct btrfs_path *path = NULL; - LIST_HEAD(dirty); - struct list_head *io = &cur_trans->io_bgs; -- int num_started = 0; - int loops = 0; - - spin_lock(&cur_trans->dirty_bgs_lock); -@@ -2455,7 +2454,6 @@ again: - cache->io_ctl.inode = NULL; - ret = btrfs_write_out_cache(trans, cache, path); - if (ret == 0 && cache->io_ctl.inode) { -- num_started++; - should_put = 0; - - /* -@@ -2556,7 +2554,6 @@ int btrfs_write_dirty_block_groups(struct btrfs_trans_handle *trans) - int should_put; - struct btrfs_path *path; - struct list_head *io = &cur_trans->io_bgs; -- int num_started = 0; - - path = btrfs_alloc_path(); - if (!path) -@@ -2614,7 +2611,6 @@ int btrfs_write_dirty_block_groups(struct btrfs_trans_handle *trans) - cache->io_ctl.inode = NULL; - ret = btrfs_write_out_cache(trans, cache, path); - if (ret == 0 && cache->io_ctl.inode) { -- num_started++; - should_put = 0; - list_add_tail(&cache->io_list, io); - } else { -diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c -index 344d18de1f08c..8898682c91038 100644 ---- a/fs/btrfs/volumes.c -+++ b/fs/btrfs/volumes.c -@@ -4320,10 +4320,12 @@ static int balance_kthread(void *data) - struct btrfs_fs_info *fs_info = data; - int ret = 0; - -+ sb_start_write(fs_info->sb); - mutex_lock(&fs_info->balance_mutex); - if (fs_info->balance_ctl) - ret = btrfs_balance(fs_info, fs_info->balance_ctl, NULL); - mutex_unlock(&fs_info->balance_mutex); -+ sb_end_write(fs_info->sb); - - return ret; - } -diff --git a/fs/cifs/link.c b/fs/cifs/link.c -index b736acd3917bb..a24bcbbb50337 100644 ---- a/fs/cifs/link.c -+++ b/fs/cifs/link.c -@@ -97,6 +97,9 @@ parse_mf_symlink(const u8 *buf, unsigned int buf_len, unsigned int *_link_len, - if (rc != 1) - return -EINVAL; - -+ if (link_len > CIFS_MF_SYMLINK_LINK_MAXLEN) -+ return -EINVAL; -+ - rc = symlink_hash(link_len, link_str, md5_hash); - if (rc) { - cifs_dbg(FYI, "%s: MD5 hash failure: %d\n", __func__, rc); -diff --git a/include/asm-generic/tlb.h b/include/asm-generic/tlb.h -index 46294ef620ff9..268674c1d5685 100644 ---- a/include/asm-generic/tlb.h -+++ b/include/asm-generic/tlb.h -@@ -547,10 +547,14 @@ static inline void tlb_flush_p4d_range(struct mmu_gather *tlb, - #define tlb_remove_huge_tlb_entry(h, tlb, ptep, address) \ - do { \ - unsigned long _sz = huge_page_size(h); \ -- if (_sz == PMD_SIZE) \ -- tlb_flush_pmd_range(tlb, address, _sz); \ -- else if (_sz == PUD_SIZE) \ -+ if (_sz >= P4D_SIZE) \ -+ tlb_flush_p4d_range(tlb, address, _sz); \ -+ else if (_sz >= PUD_SIZE) \ - tlb_flush_pud_range(tlb, address, _sz); \ -+ else if (_sz >= PMD_SIZE) \ -+ tlb_flush_pmd_range(tlb, address, _sz); \ -+ else \ -+ tlb_flush_pte_range(tlb, address, _sz); \ - __tlb_remove_tlb_entry(tlb, ptep, address); \ - } while (0) - -diff --git a/include/net/ax25.h b/include/net/ax25.h -index 8b7eb46ad72d8..aadff553e4b73 100644 ---- a/include/net/ax25.h -+++ b/include/net/ax25.h -@@ -236,6 +236,7 @@ typedef struct ax25_dev { - #if defined(CONFIG_AX25_DAMA_SLAVE) || defined(CONFIG_AX25_DAMA_MASTER) - ax25_dama_info dama; - #endif -+ refcount_t refcount; - } ax25_dev; - - typedef struct ax25_cb { -@@ -290,6 +291,17 @@ static __inline__ void ax25_cb_put(ax25_cb *ax25) - } - } - -+static inline void ax25_dev_hold(ax25_dev *ax25_dev) -+{ -+ refcount_inc(&ax25_dev->refcount); -+} -+ -+static inline void ax25_dev_put(ax25_dev *ax25_dev) -+{ -+ if (refcount_dec_and_test(&ax25_dev->refcount)) { -+ kfree(ax25_dev); -+ } -+} - static inline __be16 ax25_type_trans(struct sk_buff *skb, struct net_device *dev) - { - skb->dev = dev; -diff --git a/include/net/flow_dissector.h b/include/net/flow_dissector.h -index 78f6437cbc3a8..02171416c68eb 100644 ---- a/include/net/flow_dissector.h -+++ b/include/net/flow_dissector.h -@@ -51,6 +51,8 @@ struct flow_dissector_key_vlan { - vlan_dei:1, - vlan_priority:3; - __be16 vlan_tpid; -+ __be16 vlan_eth_type; -+ u16 padding; - }; - - struct flow_dissector_key_mpls { -diff --git a/kernel/dma/direct.c b/kernel/dma/direct.c -index 0a093a675b632..f04cfc2e9e01a 100644 ---- a/kernel/dma/direct.c -+++ b/kernel/dma/direct.c -@@ -306,7 +306,8 @@ void dma_direct_unmap_page(struct device *dev, dma_addr_t addr, - dma_direct_sync_single_for_cpu(dev, addr, size, dir); - - if (unlikely(is_swiotlb_buffer(phys))) -- swiotlb_tbl_unmap_single(dev, phys, size, size, dir, attrs); -+ swiotlb_tbl_unmap_single(dev, phys, size, size, dir, -+ attrs | DMA_ATTR_SKIP_CPU_SYNC); - } - EXPORT_SYMBOL(dma_direct_unmap_page); - -diff --git a/kernel/irq/affinity.c b/kernel/irq/affinity.c -index 4d89ad4fae3bb..5fb78addff51b 100644 ---- a/kernel/irq/affinity.c -+++ b/kernel/irq/affinity.c -@@ -269,8 +269,9 @@ static int __irq_build_affinity_masks(unsigned int startvec, - */ - if (numvecs <= nodes) { - for_each_node_mask(n, nodemsk) { -- cpumask_or(&masks[curvec].mask, &masks[curvec].mask, -- node_to_cpumask[n]); -+ /* Ensure that only CPUs which are in both masks are set */ -+ cpumask_and(nmsk, cpu_mask, node_to_cpumask[n]); -+ cpumask_or(&masks[curvec].mask, &masks[curvec].mask, nmsk); - if (++curvec == last_affv) - curvec = firstvec; - } -diff --git a/kernel/smp.c b/kernel/smp.c -index 3a390932f8b25..be65b76cb8036 100644 ---- a/kernel/smp.c -+++ b/kernel/smp.c -@@ -222,7 +222,7 @@ static void flush_smp_call_function_queue(bool warn_cpu_offline) - - /* There shouldn't be any pending callbacks on an offline CPU. */ - if (unlikely(warn_cpu_offline && !cpu_online(smp_processor_id()) && -- !warned && !llist_empty(head))) { -+ !warned && entry != NULL)) { - warned = true; - WARN(1, "IPI on offline CPU %d\n", smp_processor_id()); - -diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c -index 4419486d7413c..5eb04bb598026 100644 ---- a/kernel/time/tick-sched.c -+++ b/kernel/time/tick-sched.c -@@ -131,7 +131,7 @@ static void tick_sched_do_timer(struct tick_sched *ts, ktime_t now) - */ - if (unlikely(tick_do_timer_cpu == TICK_DO_TIMER_NONE)) { - #ifdef CONFIG_NO_HZ_FULL -- WARN_ON(tick_nohz_full_running); -+ WARN_ON_ONCE(tick_nohz_full_running); - #endif - tick_do_timer_cpu = cpu; - } -diff --git a/mm/kmemleak.c b/mm/kmemleak.c -index d8cde7292bf92..3761c79137b17 100644 ---- a/mm/kmemleak.c -+++ b/mm/kmemleak.c -@@ -1123,7 +1123,7 @@ EXPORT_SYMBOL(kmemleak_no_scan); - void __ref kmemleak_alloc_phys(phys_addr_t phys, size_t size, int min_count, - gfp_t gfp) - { -- if (!IS_ENABLED(CONFIG_HIGHMEM) || PHYS_PFN(phys) < max_low_pfn) -+ if (PHYS_PFN(phys) >= min_low_pfn && PHYS_PFN(phys) < max_low_pfn) - kmemleak_alloc(__va(phys), size, min_count, gfp); - } - EXPORT_SYMBOL(kmemleak_alloc_phys); -@@ -1137,7 +1137,7 @@ EXPORT_SYMBOL(kmemleak_alloc_phys); - */ - void __ref kmemleak_free_part_phys(phys_addr_t phys, size_t size) - { -- if (!IS_ENABLED(CONFIG_HIGHMEM) || PHYS_PFN(phys) < max_low_pfn) -+ if (PHYS_PFN(phys) >= min_low_pfn && PHYS_PFN(phys) < max_low_pfn) - kmemleak_free_part(__va(phys), size); - } - EXPORT_SYMBOL(kmemleak_free_part_phys); -@@ -1149,7 +1149,7 @@ EXPORT_SYMBOL(kmemleak_free_part_phys); - */ - void __ref kmemleak_not_leak_phys(phys_addr_t phys) - { -- if (!IS_ENABLED(CONFIG_HIGHMEM) || PHYS_PFN(phys) < max_low_pfn) -+ if (PHYS_PFN(phys) >= min_low_pfn && PHYS_PFN(phys) < max_low_pfn) - kmemleak_not_leak(__va(phys)); - } - EXPORT_SYMBOL(kmemleak_not_leak_phys); -@@ -1161,7 +1161,7 @@ EXPORT_SYMBOL(kmemleak_not_leak_phys); - */ - void __ref kmemleak_ignore_phys(phys_addr_t phys) - { -- if (!IS_ENABLED(CONFIG_HIGHMEM) || PHYS_PFN(phys) < max_low_pfn) -+ if (PHYS_PFN(phys) >= min_low_pfn && PHYS_PFN(phys) < max_low_pfn) - kmemleak_ignore(__va(phys)); - } - EXPORT_SYMBOL(kmemleak_ignore_phys); -diff --git a/mm/page_alloc.c b/mm/page_alloc.c -index 5038611563dfb..7048ea59d58bd 100644 ---- a/mm/page_alloc.c -+++ b/mm/page_alloc.c -@@ -5481,7 +5481,7 @@ static int build_zonerefs_node(pg_data_t *pgdat, struct zoneref *zonerefs) - do { - zone_type--; - zone = pgdat->node_zones + zone_type; -- if (managed_zone(zone)) { -+ if (populated_zone(zone)) { - zoneref_set_zone(zone, &zonerefs[nr_zones++]); - check_highest_zone(zone_type); - } -diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c -index 093b73c454d28..aff991ca0e4a4 100644 ---- a/net/ax25/af_ax25.c -+++ b/net/ax25/af_ax25.c -@@ -89,17 +89,21 @@ again: - sk = s->sk; - if (!sk) { - spin_unlock_bh(&ax25_list_lock); -- s->ax25_dev = NULL; - ax25_disconnect(s, ENETUNREACH); -+ s->ax25_dev = NULL; - spin_lock_bh(&ax25_list_lock); - goto again; - } - sock_hold(sk); - spin_unlock_bh(&ax25_list_lock); - lock_sock(sk); -+ ax25_disconnect(s, ENETUNREACH); - s->ax25_dev = NULL; -+ if (sk->sk_socket) { -+ dev_put(ax25_dev->dev); -+ ax25_dev_put(ax25_dev); -+ } - release_sock(sk); -- ax25_disconnect(s, ENETUNREACH); - spin_lock_bh(&ax25_list_lock); - sock_put(sk); - /* The entry could have been deleted from the -@@ -365,21 +369,25 @@ static int ax25_ctl_ioctl(const unsigned int cmd, void __user *arg) - if (copy_from_user(&ax25_ctl, arg, sizeof(ax25_ctl))) - return -EFAULT; - -- if ((ax25_dev = ax25_addr_ax25dev(&ax25_ctl.port_addr)) == NULL) -- return -ENODEV; -- - if (ax25_ctl.digi_count > AX25_MAX_DIGIS) - return -EINVAL; - - if (ax25_ctl.arg > ULONG_MAX / HZ && ax25_ctl.cmd != AX25_KILL) - return -EINVAL; - -+ ax25_dev = ax25_addr_ax25dev(&ax25_ctl.port_addr); -+ if (!ax25_dev) -+ return -ENODEV; -+ - digi.ndigi = ax25_ctl.digi_count; - for (k = 0; k < digi.ndigi; k++) - digi.calls[k] = ax25_ctl.digi_addr[k]; - -- if ((ax25 = ax25_find_cb(&ax25_ctl.source_addr, &ax25_ctl.dest_addr, &digi, ax25_dev->dev)) == NULL) -+ ax25 = ax25_find_cb(&ax25_ctl.source_addr, &ax25_ctl.dest_addr, &digi, ax25_dev->dev); -+ if (!ax25) { -+ ax25_dev_put(ax25_dev); - return -ENOTCONN; -+ } - - switch (ax25_ctl.cmd) { - case AX25_KILL: -@@ -446,6 +454,7 @@ static int ax25_ctl_ioctl(const unsigned int cmd, void __user *arg) - } - - out_put: -+ ax25_dev_put(ax25_dev); - ax25_cb_put(ax25); - return ret; - -@@ -971,14 +980,16 @@ static int ax25_release(struct socket *sock) - { - struct sock *sk = sock->sk; - ax25_cb *ax25; -+ ax25_dev *ax25_dev; - - if (sk == NULL) - return 0; - - sock_hold(sk); -- sock_orphan(sk); - lock_sock(sk); -+ sock_orphan(sk); - ax25 = sk_to_ax25(sk); -+ ax25_dev = ax25->ax25_dev; - - if (sk->sk_type == SOCK_SEQPACKET) { - switch (ax25->state) { -@@ -1040,6 +1051,15 @@ static int ax25_release(struct socket *sock) - sk->sk_state_change(sk); - ax25_destroy_socket(ax25); - } -+ if (ax25_dev) { -+ del_timer_sync(&ax25->timer); -+ del_timer_sync(&ax25->t1timer); -+ del_timer_sync(&ax25->t2timer); -+ del_timer_sync(&ax25->t3timer); -+ del_timer_sync(&ax25->idletimer); -+ dev_put(ax25_dev->dev); -+ ax25_dev_put(ax25_dev); -+ } - - sock->sk = NULL; - release_sock(sk); -@@ -1116,8 +1136,10 @@ static int ax25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) - } - } - -- if (ax25_dev != NULL) -+ if (ax25_dev) { - ax25_fillin_cb(ax25, ax25_dev); -+ dev_hold(ax25_dev->dev); -+ } - - done: - ax25_cb_add(ax25); -diff --git a/net/ax25/ax25_dev.c b/net/ax25/ax25_dev.c -index 4ac2e0847652a..d2e0cc67d91a7 100644 ---- a/net/ax25/ax25_dev.c -+++ b/net/ax25/ax25_dev.c -@@ -37,6 +37,7 @@ ax25_dev *ax25_addr_ax25dev(ax25_address *addr) - for (ax25_dev = ax25_dev_list; ax25_dev != NULL; ax25_dev = ax25_dev->next) - if (ax25cmp(addr, (ax25_address *)ax25_dev->dev->dev_addr) == 0) { - res = ax25_dev; -+ ax25_dev_hold(ax25_dev); - } - spin_unlock_bh(&ax25_dev_lock); - -@@ -56,6 +57,7 @@ void ax25_dev_device_up(struct net_device *dev) - return; - } - -+ refcount_set(&ax25_dev->refcount, 1); - dev->ax25_ptr = ax25_dev; - ax25_dev->dev = dev; - dev_hold(dev); -@@ -84,6 +86,7 @@ void ax25_dev_device_up(struct net_device *dev) - ax25_dev->next = ax25_dev_list; - ax25_dev_list = ax25_dev; - spin_unlock_bh(&ax25_dev_lock); -+ ax25_dev_hold(ax25_dev); - - ax25_register_dev_sysctl(ax25_dev); - } -@@ -113,9 +116,10 @@ void ax25_dev_device_down(struct net_device *dev) - if ((s = ax25_dev_list) == ax25_dev) { - ax25_dev_list = s->next; - spin_unlock_bh(&ax25_dev_lock); -+ ax25_dev_put(ax25_dev); - dev->ax25_ptr = NULL; - dev_put(dev); -- kfree(ax25_dev); -+ ax25_dev_put(ax25_dev); - return; - } - -@@ -123,9 +127,10 @@ void ax25_dev_device_down(struct net_device *dev) - if (s->next == ax25_dev) { - s->next = ax25_dev->next; - spin_unlock_bh(&ax25_dev_lock); -+ ax25_dev_put(ax25_dev); - dev->ax25_ptr = NULL; - dev_put(dev); -- kfree(ax25_dev); -+ ax25_dev_put(ax25_dev); - return; - } - -@@ -133,6 +138,7 @@ void ax25_dev_device_down(struct net_device *dev) - } - spin_unlock_bh(&ax25_dev_lock); - dev->ax25_ptr = NULL; -+ ax25_dev_put(ax25_dev); - } - - int ax25_fwd_ioctl(unsigned int cmd, struct ax25_fwd_struct *fwd) -@@ -144,20 +150,32 @@ int ax25_fwd_ioctl(unsigned int cmd, struct ax25_fwd_struct *fwd) - - switch (cmd) { - case SIOCAX25ADDFWD: -- if ((fwd_dev = ax25_addr_ax25dev(&fwd->port_to)) == NULL) -+ fwd_dev = ax25_addr_ax25dev(&fwd->port_to); -+ if (!fwd_dev) { -+ ax25_dev_put(ax25_dev); - return -EINVAL; -- if (ax25_dev->forward != NULL) -+ } -+ if (ax25_dev->forward) { -+ ax25_dev_put(fwd_dev); -+ ax25_dev_put(ax25_dev); - return -EINVAL; -+ } - ax25_dev->forward = fwd_dev->dev; -+ ax25_dev_put(fwd_dev); -+ ax25_dev_put(ax25_dev); - break; - - case SIOCAX25DELFWD: -- if (ax25_dev->forward == NULL) -+ if (!ax25_dev->forward) { -+ ax25_dev_put(ax25_dev); - return -EINVAL; -+ } - ax25_dev->forward = NULL; -+ ax25_dev_put(ax25_dev); - break; - - default: -+ ax25_dev_put(ax25_dev); - return -EINVAL; - } - -diff --git a/net/ax25/ax25_route.c b/net/ax25/ax25_route.c -index b40e0bce67ead..dc2168d2a32a9 100644 ---- a/net/ax25/ax25_route.c -+++ b/net/ax25/ax25_route.c -@@ -75,11 +75,13 @@ static int __must_check ax25_rt_add(struct ax25_routes_struct *route) - ax25_dev *ax25_dev; - int i; - -- if ((ax25_dev = ax25_addr_ax25dev(&route->port_addr)) == NULL) -- return -EINVAL; - if (route->digi_count > AX25_MAX_DIGIS) - return -EINVAL; - -+ ax25_dev = ax25_addr_ax25dev(&route->port_addr); -+ if (!ax25_dev) -+ return -EINVAL; -+ - write_lock_bh(&ax25_route_lock); - - ax25_rt = ax25_route_list; -@@ -91,6 +93,7 @@ static int __must_check ax25_rt_add(struct ax25_routes_struct *route) - if (route->digi_count != 0) { - if ((ax25_rt->digipeat = kmalloc(sizeof(ax25_digi), GFP_ATOMIC)) == NULL) { - write_unlock_bh(&ax25_route_lock); -+ ax25_dev_put(ax25_dev); - return -ENOMEM; - } - ax25_rt->digipeat->lastrepeat = -1; -@@ -101,6 +104,7 @@ static int __must_check ax25_rt_add(struct ax25_routes_struct *route) - } - } - write_unlock_bh(&ax25_route_lock); -+ ax25_dev_put(ax25_dev); - return 0; - } - ax25_rt = ax25_rt->next; -@@ -108,6 +112,7 @@ static int __must_check ax25_rt_add(struct ax25_routes_struct *route) - - if ((ax25_rt = kmalloc(sizeof(ax25_route), GFP_ATOMIC)) == NULL) { - write_unlock_bh(&ax25_route_lock); -+ ax25_dev_put(ax25_dev); - return -ENOMEM; - } - -@@ -120,6 +125,7 @@ static int __must_check ax25_rt_add(struct ax25_routes_struct *route) - if ((ax25_rt->digipeat = kmalloc(sizeof(ax25_digi), GFP_ATOMIC)) == NULL) { - write_unlock_bh(&ax25_route_lock); - kfree(ax25_rt); -+ ax25_dev_put(ax25_dev); - return -ENOMEM; - } - ax25_rt->digipeat->lastrepeat = -1; -@@ -132,6 +138,7 @@ static int __must_check ax25_rt_add(struct ax25_routes_struct *route) - ax25_rt->next = ax25_route_list; - ax25_route_list = ax25_rt; - write_unlock_bh(&ax25_route_lock); -+ ax25_dev_put(ax25_dev); - - return 0; - } -@@ -173,6 +180,7 @@ static int ax25_rt_del(struct ax25_routes_struct *route) - } - } - write_unlock_bh(&ax25_route_lock); -+ ax25_dev_put(ax25_dev); - - return 0; - } -@@ -215,6 +223,7 @@ static int ax25_rt_opt(struct ax25_route_opt_struct *rt_option) - - out: - write_unlock_bh(&ax25_route_lock); -+ ax25_dev_put(ax25_dev); - return err; - } - -diff --git a/net/ax25/ax25_subr.c b/net/ax25/ax25_subr.c -index 15ab812c4fe4b..3a476e4f6cd0b 100644 ---- a/net/ax25/ax25_subr.c -+++ b/net/ax25/ax25_subr.c -@@ -261,12 +261,20 @@ void ax25_disconnect(ax25_cb *ax25, int reason) - { - ax25_clear_queues(ax25); - -- if (!ax25->sk || !sock_flag(ax25->sk, SOCK_DESTROY)) -- ax25_stop_heartbeat(ax25); -- ax25_stop_t1timer(ax25); -- ax25_stop_t2timer(ax25); -- ax25_stop_t3timer(ax25); -- ax25_stop_idletimer(ax25); -+ if (reason == ENETUNREACH) { -+ del_timer_sync(&ax25->timer); -+ del_timer_sync(&ax25->t1timer); -+ del_timer_sync(&ax25->t2timer); -+ del_timer_sync(&ax25->t3timer); -+ del_timer_sync(&ax25->idletimer); -+ } else { -+ if (!ax25->sk || !sock_flag(ax25->sk, SOCK_DESTROY)) -+ ax25_stop_heartbeat(ax25); -+ ax25_stop_t1timer(ax25); -+ ax25_stop_t2timer(ax25); -+ ax25_stop_t3timer(ax25); -+ ax25_stop_idletimer(ax25); -+ } - - ax25->state = AX25_STATE_0; - -diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c -index b740a74f06f22..4dac27c986231 100644 ---- a/net/core/flow_dissector.c -+++ b/net/core/flow_dissector.c -@@ -1149,6 +1149,7 @@ proto_again: - VLAN_PRIO_MASK) >> VLAN_PRIO_SHIFT; - } - key_vlan->vlan_tpid = saved_vlan_tpid; -+ key_vlan->vlan_eth_type = proto; - } - - fdret = FLOW_DISSECT_RET_PROTO_AGAIN; -diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c -index 3606796009572..5585e3a94f3ca 100644 ---- a/net/ipv6/ip6_output.c -+++ b/net/ipv6/ip6_output.c -@@ -506,7 +506,7 @@ int ip6_forward(struct sk_buff *skb) - goto drop; - - if (!net->ipv6.devconf_all->disable_policy && -- !idev->cnf.disable_policy && -+ (!idev || !idev->cnf.disable_policy) && - !xfrm6_policy_check(NULL, XFRM_POLICY_FWD, skb)) { - __IP6_INC_STATS(net, idev, IPSTATS_MIB_INDISCARDS); - goto drop; -diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c -index b8ecb002e6238..b2e922fcc70da 100644 ---- a/net/nfc/nci/core.c -+++ b/net/nfc/nci/core.c -@@ -548,6 +548,10 @@ static int nci_close_device(struct nci_dev *ndev) - mutex_lock(&ndev->req_lock); - - if (!test_and_clear_bit(NCI_UP, &ndev->flags)) { -+ /* Need to flush the cmd wq in case -+ * there is a queued/running cmd_work -+ */ -+ flush_workqueue(ndev->cmd_wq); - del_timer_sync(&ndev->cmd_timer); - del_timer_sync(&ndev->data_timer); - mutex_unlock(&ndev->req_lock); -diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c -index 80205b138d113..919c7fa5f02d6 100644 ---- a/net/sched/cls_api.c -+++ b/net/sched/cls_api.c -@@ -1639,10 +1639,10 @@ static int tcf_chain_tp_insert(struct tcf_chain *chain, - if (chain->flushing) - return -EAGAIN; - -+ RCU_INIT_POINTER(tp->next, tcf_chain_tp_prev(chain, chain_info)); - if (*chain_info->pprev == chain->filter_chain) - tcf_chain0_head_change(chain, tp); - tcf_proto_get(tp); -- RCU_INIT_POINTER(tp->next, tcf_chain_tp_prev(chain, chain_info)); - rcu_assign_pointer(*chain_info->pprev, tp); - - return 0; -diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c -index 26979b4853bdb..007fbc1993522 100644 ---- a/net/sched/cls_flower.c -+++ b/net/sched/cls_flower.c -@@ -784,6 +784,7 @@ static int fl_set_key_mpls(struct nlattr **tb, - static void fl_set_key_vlan(struct nlattr **tb, - __be16 ethertype, - int vlan_id_key, int vlan_prio_key, -+ int vlan_next_eth_type_key, - struct flow_dissector_key_vlan *key_val, - struct flow_dissector_key_vlan *key_mask) - { -@@ -802,6 +803,11 @@ static void fl_set_key_vlan(struct nlattr **tb, - } - key_val->vlan_tpid = ethertype; - key_mask->vlan_tpid = cpu_to_be16(~0); -+ if (tb[vlan_next_eth_type_key]) { -+ key_val->vlan_eth_type = -+ nla_get_be16(tb[vlan_next_eth_type_key]); -+ key_mask->vlan_eth_type = cpu_to_be16(~0); -+ } - } - - static void fl_set_key_flag(u32 flower_key, u32 flower_mask, -@@ -1076,8 +1082,9 @@ static int fl_set_key(struct net *net, struct nlattr **tb, - - if (eth_type_vlan(ethertype)) { - fl_set_key_vlan(tb, ethertype, TCA_FLOWER_KEY_VLAN_ID, -- TCA_FLOWER_KEY_VLAN_PRIO, &key->vlan, -- &mask->vlan); -+ TCA_FLOWER_KEY_VLAN_PRIO, -+ TCA_FLOWER_KEY_VLAN_ETH_TYPE, -+ &key->vlan, &mask->vlan); - - if (tb[TCA_FLOWER_KEY_VLAN_ETH_TYPE]) { - ethertype = nla_get_be16(tb[TCA_FLOWER_KEY_VLAN_ETH_TYPE]); -@@ -1085,6 +1092,7 @@ static int fl_set_key(struct net *net, struct nlattr **tb, - fl_set_key_vlan(tb, ethertype, - TCA_FLOWER_KEY_CVLAN_ID, - TCA_FLOWER_KEY_CVLAN_PRIO, -+ TCA_FLOWER_KEY_CVLAN_ETH_TYPE, - &key->cvlan, &mask->cvlan); - fl_set_key_val(tb, &key->basic.n_proto, - TCA_FLOWER_KEY_CVLAN_ETH_TYPE, -@@ -2272,13 +2280,13 @@ static int fl_dump_key(struct sk_buff *skb, struct net *net, - goto nla_put_failure; - - if (mask->basic.n_proto) { -- if (mask->cvlan.vlan_tpid) { -+ if (mask->cvlan.vlan_eth_type) { - if (nla_put_be16(skb, TCA_FLOWER_KEY_CVLAN_ETH_TYPE, - key->basic.n_proto)) - goto nla_put_failure; -- } else if (mask->vlan.vlan_tpid) { -+ } else if (mask->vlan.vlan_eth_type) { - if (nla_put_be16(skb, TCA_FLOWER_KEY_VLAN_ETH_TYPE, -- key->basic.n_proto)) -+ key->vlan.vlan_eth_type)) - goto nla_put_failure; - } - } -diff --git a/net/sched/sch_taprio.c b/net/sched/sch_taprio.c -index b268e61304515..4c26f7fb32b34 100644 ---- a/net/sched/sch_taprio.c -+++ b/net/sched/sch_taprio.c -@@ -427,7 +427,8 @@ static int taprio_enqueue(struct sk_buff *skb, struct Qdisc *sch, - if (unlikely(!child)) - return qdisc_drop(skb, sch, to_free); - -- if (skb->sk && sock_flag(skb->sk, SOCK_TXTIME)) { -+ /* sk_flags are only safe to use on full sockets. */ -+ if (skb->sk && sk_fullsock(skb->sk) && sock_flag(skb->sk, SOCK_TXTIME)) { - if (!is_valid_interval(skb, sch)) - return qdisc_drop(skb, sch, to_free); - } else if (TXTIME_ASSIST_IS_ENABLED(q->flags)) { -diff --git a/net/sctp/socket.c b/net/sctp/socket.c -index 565aa77fe5cbe..c76b40322ac7d 100644 ---- a/net/sctp/socket.c -+++ b/net/sctp/socket.c -@@ -5682,7 +5682,7 @@ int sctp_do_peeloff(struct sock *sk, sctp_assoc_t id, struct socket **sockp) - * Set the daddr and initialize id to something more random and also - * copy over any ip options. - */ -- sp->pf->to_sk_daddr(&asoc->peer.primary_addr, sk); -+ sp->pf->to_sk_daddr(&asoc->peer.primary_addr, sock->sk); - sp->pf->copy_ip_options(sk, sock->sk); - - /* Populate the fields of the newsk from the oldsk and migrate the -diff --git a/net/smc/smc_pnet.c b/net/smc/smc_pnet.c -index 571e6d84da3ba..660608202f284 100644 ---- a/net/smc/smc_pnet.c -+++ b/net/smc/smc_pnet.c -@@ -295,8 +295,9 @@ static struct smc_ib_device *smc_pnet_find_ib(char *ib_name) - list_for_each_entry(ibdev, &smc_ib_devices.list, list) { - if (!strncmp(ibdev->ibdev->name, ib_name, - sizeof(ibdev->ibdev->name)) || -- !strncmp(dev_name(ibdev->ibdev->dev.parent), ib_name, -- IB_DEVICE_NAME_MAX - 1)) { -+ (ibdev->ibdev->dev.parent && -+ !strncmp(dev_name(ibdev->ibdev->dev.parent), ib_name, -+ IB_DEVICE_NAME_MAX - 1))) { - goto out; - } - } -diff --git a/net/wireless/scan.c b/net/wireless/scan.c -index 6cefaad3b7f84..6bb9437af28bf 100644 ---- a/net/wireless/scan.c -+++ b/net/wireless/scan.c -@@ -1457,11 +1457,13 @@ cfg80211_inform_single_bss_data(struct wiphy *wiphy, - /* this is a nontransmitting bss, we need to add it to - * transmitting bss' list if it is not there - */ -+ spin_lock_bh(&rdev->bss_lock); - if (cfg80211_add_nontrans_list(non_tx_data->tx_bss, - &res->pub)) { - if (__cfg80211_unlink_bss(rdev, res)) - rdev->bss_generation++; - } -+ spin_unlock_bh(&rdev->bss_lock); - } - - trace_cfg80211_return_bss(&res->pub); -diff --git a/scripts/gcc-plugins/latent_entropy_plugin.c b/scripts/gcc-plugins/latent_entropy_plugin.c -index cbe1d6c4b1a51..c84bef1d28955 100644 ---- a/scripts/gcc-plugins/latent_entropy_plugin.c -+++ b/scripts/gcc-plugins/latent_entropy_plugin.c -@@ -86,25 +86,31 @@ static struct plugin_info latent_entropy_plugin_info = { - .help = "disable\tturn off latent entropy instrumentation\n", - }; - --static unsigned HOST_WIDE_INT seed; --/* -- * get_random_seed() (this is a GCC function) generates the seed. -- * This is a simple random generator without any cryptographic security because -- * the entropy doesn't come from here. -- */ -+static unsigned HOST_WIDE_INT deterministic_seed; -+static unsigned HOST_WIDE_INT rnd_buf[32]; -+static size_t rnd_idx = ARRAY_SIZE(rnd_buf); -+static int urandom_fd = -1; -+ - static unsigned HOST_WIDE_INT get_random_const(void) - { -- unsigned int i; -- unsigned HOST_WIDE_INT ret = 0; -- -- for (i = 0; i < 8 * sizeof(ret); i++) { -- ret = (ret << 1) | (seed & 1); -- seed >>= 1; -- if (ret & 1) -- seed ^= 0xD800000000000000ULL; -+ if (deterministic_seed) { -+ unsigned HOST_WIDE_INT w = deterministic_seed; -+ w ^= w << 13; -+ w ^= w >> 7; -+ w ^= w << 17; -+ deterministic_seed = w; -+ return deterministic_seed; - } - -- return ret; -+ if (urandom_fd < 0) { -+ urandom_fd = open("/dev/urandom", O_RDONLY); -+ gcc_assert(urandom_fd >= 0); -+ } -+ if (rnd_idx >= ARRAY_SIZE(rnd_buf)) { -+ gcc_assert(read(urandom_fd, rnd_buf, sizeof(rnd_buf)) == sizeof(rnd_buf)); -+ rnd_idx = 0; -+ } -+ return rnd_buf[rnd_idx++]; - } - - static tree tree_get_random_const(tree type) -@@ -549,8 +555,6 @@ static void latent_entropy_start_unit(void *gcc_data __unused, - tree type, id; - int quals; - -- seed = get_random_seed(false); -- - if (in_lto_p) - return; - -@@ -585,6 +589,12 @@ __visible int plugin_init(struct plugin_name_args *plugin_info, - const struct plugin_argument * const argv = plugin_info->argv; - int i; - -+ /* -+ * Call get_random_seed() with noinit=true, so that this returns -+ * 0 in the case where no seed has been passed via -frandom-seed. -+ */ -+ deterministic_seed = get_random_seed(true); -+ - static const struct ggc_root_tab gt_ggc_r_gt_latent_entropy[] = { - { - .base = &latent_entropy_decl, -diff --git a/sound/core/pcm_misc.c b/sound/core/pcm_misc.c -index c4eb561d20086..0956be39b0355 100644 ---- a/sound/core/pcm_misc.c -+++ b/sound/core/pcm_misc.c -@@ -423,7 +423,7 @@ int snd_pcm_format_set_silence(snd_pcm_format_t format, void *data, unsigned int - return 0; - width = pcm_formats[(INT)format].phys; /* physical width */ - pat = pcm_formats[(INT)format].silence; -- if (! width) -+ if (!width || !pat) - return -EINVAL; - /* signed or 1 byte data */ - if (pcm_formats[(INT)format].signd == 1 || width <= 8) { -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index 05ca4196cb0fd..851ea79da31cd 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -2568,6 +2568,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = { - SND_PCI_QUIRK(0x1558, 0x65e1, "Clevo PB51[ED][DF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS), - SND_PCI_QUIRK(0x1558, 0x65e5, "Clevo PC50D[PRS](?:-D|-G)?", ALC1220_FIXUP_CLEVO_PB51ED_PINS), - SND_PCI_QUIRK(0x1558, 0x65f1, "Clevo PC50HS", ALC1220_FIXUP_CLEVO_PB51ED_PINS), -+ SND_PCI_QUIRK(0x1558, 0x65f5, "Clevo PD50PN[NRT]", ALC1220_FIXUP_CLEVO_PB51ED_PINS), - SND_PCI_QUIRK(0x1558, 0x67d1, "Clevo PB71[ER][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS), - SND_PCI_QUIRK(0x1558, 0x67e1, "Clevo PB71[DE][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS), - SND_PCI_QUIRK(0x1558, 0x67e5, "Clevo PC70D[PRS](?:-D|-G)?", ALC1220_FIXUP_CLEVO_PB51ED_PINS), -diff --git a/tools/testing/selftests/mqueue/mq_perf_tests.c b/tools/testing/selftests/mqueue/mq_perf_tests.c -index b019e0b8221c7..84fda3b490735 100644 ---- a/tools/testing/selftests/mqueue/mq_perf_tests.c -+++ b/tools/testing/selftests/mqueue/mq_perf_tests.c -@@ -180,6 +180,9 @@ void shutdown(int exit_val, char *err_cause, int line_no) - if (in_shutdown++) - return; - -+ /* Free the cpu_set allocated using CPU_ALLOC in main function */ -+ CPU_FREE(cpu_set); -+ - for (i = 0; i < num_cpus_to_pin; i++) - if (cpu_threads[i]) { - pthread_kill(cpu_threads[i], SIGUSR1); -@@ -551,6 +554,12 @@ int main(int argc, char *argv[]) - perror("sysconf(_SC_NPROCESSORS_ONLN)"); - exit(1); - } -+ -+ if (getuid() != 0) -+ ksft_exit_skip("Not running as root, but almost all tests " -+ "require root in order to modify\nsystem settings. " -+ "Exiting.\n"); -+ - cpus_online = min(MAX_CPUS, sysconf(_SC_NPROCESSORS_ONLN)); - cpu_set = CPU_ALLOC(cpus_online); - if (cpu_set == NULL) { -@@ -589,7 +598,7 @@ int main(int argc, char *argv[]) - cpu_set)) { - fprintf(stderr, "Any given CPU may " - "only be given once.\n"); -- exit(1); -+ goto err_code; - } else - CPU_SET_S(cpus_to_pin[cpu], - cpu_set_size, cpu_set); -@@ -607,7 +616,7 @@ int main(int argc, char *argv[]) - queue_path = malloc(strlen(option) + 2); - if (!queue_path) { - perror("malloc()"); -- exit(1); -+ goto err_code; - } - queue_path[0] = '/'; - queue_path[1] = 0; -@@ -622,17 +631,12 @@ int main(int argc, char *argv[]) - fprintf(stderr, "Must pass at least one CPU to continuous " - "mode.\n"); - poptPrintUsage(popt_context, stderr, 0); -- exit(1); -+ goto err_code; - } else if (!continuous_mode) { - num_cpus_to_pin = 1; - cpus_to_pin[0] = cpus_online - 1; - } - -- if (getuid() != 0) -- ksft_exit_skip("Not running as root, but almost all tests " -- "require root in order to modify\nsystem settings. " -- "Exiting.\n"); -- - max_msgs = fopen(MAX_MSGS, "r+"); - max_msgsize = fopen(MAX_MSGSIZE, "r+"); - if (!max_msgs) -@@ -740,4 +744,9 @@ int main(int argc, char *argv[]) - sleep(1); - } - shutdown(0, "", 0); -+ -+err_code: -+ CPU_FREE(cpu_set); -+ exit(1); -+ - } diff --git a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.190-191.patch b/patch/kernel/archive/odroidxu4-5.4/patch-5.4.190-191.patch deleted file mode 100644 index 4b8385424..000000000 --- a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.190-191.patch +++ /dev/null @@ -1,2098 +0,0 @@ -diff --git a/Documentation/filesystems/ext4/attributes.rst b/Documentation/filesystems/ext4/attributes.rst -index 54386a010a8d7..871d2da7a0a91 100644 ---- a/Documentation/filesystems/ext4/attributes.rst -+++ b/Documentation/filesystems/ext4/attributes.rst -@@ -76,7 +76,7 @@ The beginning of an extended attribute block is in - - Checksum of the extended attribute block. - * - 0x14 - - \_\_u32 -- - h\_reserved[2] -+ - h\_reserved[3] - - Zero. - - The checksum is calculated against the FS UUID, the 64-bit block number -diff --git a/Makefile b/Makefile -index fd239ec16278b..365b487e50d7f 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 5 - PATCHLEVEL = 4 --SUBLEVEL = 190 -+SUBLEVEL = 191 - EXTRAVERSION = - NAME = Kleptomaniac Octopus - -diff --git a/arch/arc/kernel/entry.S b/arch/arc/kernel/entry.S -index cef1d3f2656f6..beb39930eedbe 100644 ---- a/arch/arc/kernel/entry.S -+++ b/arch/arc/kernel/entry.S -@@ -199,6 +199,7 @@ tracesys_exit: - st r0, [sp, PT_r0] ; sys call return value in pt_regs - - ;POST Sys Call Ptrace Hook -+ mov r0, sp ; pt_regs needed - bl @syscall_trace_exit - b ret_from_exception ; NOT ret_from_system_call at is saves r0 which - ; we'd done before calling post hook above -diff --git a/arch/arm/mach-vexpress/spc.c b/arch/arm/mach-vexpress/spc.c -index 1da11bdb1dfbd..1c6500c4e6a17 100644 ---- a/arch/arm/mach-vexpress/spc.c -+++ b/arch/arm/mach-vexpress/spc.c -@@ -580,7 +580,7 @@ static int __init ve_spc_clk_init(void) - } - - cluster = topology_physical_package_id(cpu_dev->id); -- if (init_opp_table[cluster]) -+ if (cluster < 0 || init_opp_table[cluster]) - continue; - - if (ve_init_opp_table(cpu_dev)) -diff --git a/arch/powerpc/kvm/book3s_64_vio.c b/arch/powerpc/kvm/book3s_64_vio.c -index 03b947429e4de..4518a0f2d6c69 100644 ---- a/arch/powerpc/kvm/book3s_64_vio.c -+++ b/arch/powerpc/kvm/book3s_64_vio.c -@@ -420,13 +420,19 @@ static void kvmppc_tce_put(struct kvmppc_spapr_tce_table *stt, - tbl[idx % TCES_PER_PAGE] = tce; - } - --static void kvmppc_clear_tce(struct mm_struct *mm, struct iommu_table *tbl, -- unsigned long entry) -+static void kvmppc_clear_tce(struct mm_struct *mm, struct kvmppc_spapr_tce_table *stt, -+ struct iommu_table *tbl, unsigned long entry) - { -- unsigned long hpa = 0; -- enum dma_data_direction dir = DMA_NONE; -+ unsigned long i; -+ unsigned long subpages = 1ULL << (stt->page_shift - tbl->it_page_shift); -+ unsigned long io_entry = entry << (stt->page_shift - tbl->it_page_shift); -+ -+ for (i = 0; i < subpages; ++i) { -+ unsigned long hpa = 0; -+ enum dma_data_direction dir = DMA_NONE; - -- iommu_tce_xchg_no_kill(mm, tbl, entry, &hpa, &dir); -+ iommu_tce_xchg_no_kill(mm, tbl, io_entry + i, &hpa, &dir); -+ } - } - - static long kvmppc_tce_iommu_mapped_dec(struct kvm *kvm, -@@ -485,6 +491,8 @@ static long kvmppc_tce_iommu_unmap(struct kvm *kvm, - break; - } - -+ iommu_tce_kill(tbl, io_entry, subpages); -+ - return ret; - } - -@@ -544,6 +552,8 @@ static long kvmppc_tce_iommu_map(struct kvm *kvm, - break; - } - -+ iommu_tce_kill(tbl, io_entry, subpages); -+ - return ret; - } - -@@ -590,10 +600,9 @@ long kvmppc_h_put_tce(struct kvm_vcpu *vcpu, unsigned long liobn, - ret = kvmppc_tce_iommu_map(vcpu->kvm, stt, stit->tbl, - entry, ua, dir); - -- iommu_tce_kill(stit->tbl, entry, 1); - - if (ret != H_SUCCESS) { -- kvmppc_clear_tce(vcpu->kvm->mm, stit->tbl, entry); -+ kvmppc_clear_tce(vcpu->kvm->mm, stt, stit->tbl, entry); - goto unlock_exit; - } - } -@@ -669,13 +678,13 @@ long kvmppc_h_put_tce_indirect(struct kvm_vcpu *vcpu, - */ - if (get_user(tce, tces + i)) { - ret = H_TOO_HARD; -- goto invalidate_exit; -+ goto unlock_exit; - } - tce = be64_to_cpu(tce); - - if (kvmppc_tce_to_ua(vcpu->kvm, tce, &ua)) { - ret = H_PARAMETER; -- goto invalidate_exit; -+ goto unlock_exit; - } - - list_for_each_entry_lockless(stit, &stt->iommu_tables, next) { -@@ -684,19 +693,15 @@ long kvmppc_h_put_tce_indirect(struct kvm_vcpu *vcpu, - iommu_tce_direction(tce)); - - if (ret != H_SUCCESS) { -- kvmppc_clear_tce(vcpu->kvm->mm, stit->tbl, -- entry); -- goto invalidate_exit; -+ kvmppc_clear_tce(vcpu->kvm->mm, stt, stit->tbl, -+ entry + i); -+ goto unlock_exit; - } - } - - kvmppc_tce_put(stt, entry + i, tce); - } - --invalidate_exit: -- list_for_each_entry_lockless(stit, &stt->iommu_tables, next) -- iommu_tce_kill(stit->tbl, entry, npages); -- - unlock_exit: - srcu_read_unlock(&vcpu->kvm->srcu, idx); - -@@ -735,20 +740,16 @@ long kvmppc_h_stuff_tce(struct kvm_vcpu *vcpu, - continue; - - if (ret == H_TOO_HARD) -- goto invalidate_exit; -+ return ret; - - WARN_ON_ONCE(1); -- kvmppc_clear_tce(vcpu->kvm->mm, stit->tbl, entry); -+ kvmppc_clear_tce(vcpu->kvm->mm, stt, stit->tbl, entry + i); - } - } - - for (i = 0; i < npages; ++i, ioba += (1ULL << stt->page_shift)) - kvmppc_tce_put(stt, ioba >> stt->page_shift, tce_value); - --invalidate_exit: -- list_for_each_entry_lockless(stit, &stt->iommu_tables, next) -- iommu_tce_kill(stit->tbl, ioba >> stt->page_shift, npages); -- - return ret; - } - EXPORT_SYMBOL_GPL(kvmppc_h_stuff_tce); -diff --git a/arch/powerpc/kvm/book3s_64_vio_hv.c b/arch/powerpc/kvm/book3s_64_vio_hv.c -index 35fd67b4ceb41..abb49d8633298 100644 ---- a/arch/powerpc/kvm/book3s_64_vio_hv.c -+++ b/arch/powerpc/kvm/book3s_64_vio_hv.c -@@ -251,13 +251,19 @@ extern void iommu_tce_kill_rm(struct iommu_table *tbl, - tbl->it_ops->tce_kill(tbl, entry, pages, true); - } - --static void kvmppc_rm_clear_tce(struct kvm *kvm, struct iommu_table *tbl, -- unsigned long entry) -+static void kvmppc_rm_clear_tce(struct kvm *kvm, struct kvmppc_spapr_tce_table *stt, -+ struct iommu_table *tbl, unsigned long entry) - { -- unsigned long hpa = 0; -- enum dma_data_direction dir = DMA_NONE; -+ unsigned long i; -+ unsigned long subpages = 1ULL << (stt->page_shift - tbl->it_page_shift); -+ unsigned long io_entry = entry << (stt->page_shift - tbl->it_page_shift); -+ -+ for (i = 0; i < subpages; ++i) { -+ unsigned long hpa = 0; -+ enum dma_data_direction dir = DMA_NONE; - -- iommu_tce_xchg_no_kill_rm(kvm->mm, tbl, entry, &hpa, &dir); -+ iommu_tce_xchg_no_kill_rm(kvm->mm, tbl, io_entry + i, &hpa, &dir); -+ } - } - - static long kvmppc_rm_tce_iommu_mapped_dec(struct kvm *kvm, -@@ -320,6 +326,8 @@ static long kvmppc_rm_tce_iommu_unmap(struct kvm *kvm, - break; - } - -+ iommu_tce_kill_rm(tbl, io_entry, subpages); -+ - return ret; - } - -@@ -383,6 +391,8 @@ static long kvmppc_rm_tce_iommu_map(struct kvm *kvm, - break; - } - -+ iommu_tce_kill_rm(tbl, io_entry, subpages); -+ - return ret; - } - -@@ -428,10 +438,8 @@ long kvmppc_rm_h_put_tce(struct kvm_vcpu *vcpu, unsigned long liobn, - ret = kvmppc_rm_tce_iommu_map(vcpu->kvm, stt, - stit->tbl, entry, ua, dir); - -- iommu_tce_kill_rm(stit->tbl, entry, 1); -- - if (ret != H_SUCCESS) { -- kvmppc_rm_clear_tce(vcpu->kvm, stit->tbl, entry); -+ kvmppc_rm_clear_tce(vcpu->kvm, stt, stit->tbl, entry); - return ret; - } - } -@@ -571,7 +579,7 @@ long kvmppc_rm_h_put_tce_indirect(struct kvm_vcpu *vcpu, - ua = 0; - if (kvmppc_rm_tce_to_ua(vcpu->kvm, tce, &ua, NULL)) { - ret = H_PARAMETER; -- goto invalidate_exit; -+ goto unlock_exit; - } - - list_for_each_entry_lockless(stit, &stt->iommu_tables, next) { -@@ -580,19 +588,15 @@ long kvmppc_rm_h_put_tce_indirect(struct kvm_vcpu *vcpu, - iommu_tce_direction(tce)); - - if (ret != H_SUCCESS) { -- kvmppc_rm_clear_tce(vcpu->kvm, stit->tbl, -- entry); -- goto invalidate_exit; -+ kvmppc_rm_clear_tce(vcpu->kvm, stt, stit->tbl, -+ entry + i); -+ goto unlock_exit; - } - } - - kvmppc_rm_tce_put(stt, entry + i, tce); - } - --invalidate_exit: -- list_for_each_entry_lockless(stit, &stt->iommu_tables, next) -- iommu_tce_kill_rm(stit->tbl, entry, npages); -- - unlock_exit: - if (rmap) - unlock_rmap(rmap); -@@ -635,20 +639,16 @@ long kvmppc_rm_h_stuff_tce(struct kvm_vcpu *vcpu, - continue; - - if (ret == H_TOO_HARD) -- goto invalidate_exit; -+ return ret; - - WARN_ON_ONCE_RM(1); -- kvmppc_rm_clear_tce(vcpu->kvm, stit->tbl, entry); -+ kvmppc_rm_clear_tce(vcpu->kvm, stt, stit->tbl, entry + i); - } - } - - for (i = 0; i < npages; ++i, ioba += (1ULL << stt->page_shift)) - kvmppc_rm_tce_put(stt, ioba >> stt->page_shift, tce_value); - --invalidate_exit: -- list_for_each_entry_lockless(stit, &stt->iommu_tables, next) -- iommu_tce_kill_rm(stit->tbl, ioba >> stt->page_shift, npages); -- - return ret; - } - -diff --git a/arch/powerpc/perf/power9-pmu.c b/arch/powerpc/perf/power9-pmu.c -index 08c3ef7961982..1225f53609a44 100644 ---- a/arch/powerpc/perf/power9-pmu.c -+++ b/arch/powerpc/perf/power9-pmu.c -@@ -131,11 +131,11 @@ int p9_dd22_bl_ev[] = { - - /* Table of alternatives, sorted by column 0 */ - static const unsigned int power9_event_alternatives[][MAX_ALT] = { -- { PM_INST_DISP, PM_INST_DISP_ALT }, -- { PM_RUN_CYC_ALT, PM_RUN_CYC }, -- { PM_RUN_INST_CMPL_ALT, PM_RUN_INST_CMPL }, -- { PM_LD_MISS_L1, PM_LD_MISS_L1_ALT }, - { PM_BR_2PATH, PM_BR_2PATH_ALT }, -+ { PM_INST_DISP, PM_INST_DISP_ALT }, -+ { PM_RUN_CYC_ALT, PM_RUN_CYC }, -+ { PM_LD_MISS_L1, PM_LD_MISS_L1_ALT }, -+ { PM_RUN_INST_CMPL_ALT, PM_RUN_INST_CMPL }, - }; - - static int power9_get_alternatives(u64 event, unsigned int flags, u64 alt[]) -diff --git a/arch/x86/include/asm/compat.h b/arch/x86/include/asm/compat.h -index 22c4dfe659923..b4dd6ab0fdfce 100644 ---- a/arch/x86/include/asm/compat.h -+++ b/arch/x86/include/asm/compat.h -@@ -31,15 +31,13 @@ typedef s64 __attribute__((aligned(4))) compat_s64; - typedef u64 __attribute__((aligned(4))) compat_u64; - - struct compat_stat { -- compat_dev_t st_dev; -- u16 __pad1; -+ u32 st_dev; - compat_ino_t st_ino; - compat_mode_t st_mode; - compat_nlink_t st_nlink; - __compat_uid_t st_uid; - __compat_gid_t st_gid; -- compat_dev_t st_rdev; -- u16 __pad2; -+ u32 st_rdev; - u32 st_size; - u32 st_blksize; - u32 st_blocks; -diff --git a/arch/xtensa/kernel/coprocessor.S b/arch/xtensa/kernel/coprocessor.S -index d956f87fcb095..6a6cc8dae5653 100644 ---- a/arch/xtensa/kernel/coprocessor.S -+++ b/arch/xtensa/kernel/coprocessor.S -@@ -37,7 +37,7 @@ - .if XTENSA_HAVE_COPROCESSOR(x); \ - .align 4; \ - .Lsave_cp_regs_cp##x: \ -- xchal_cp##x##_store a2 a4 a5 a6 a7; \ -+ xchal_cp##x##_store a2 a3 a4 a5 a6; \ - jx a0; \ - .endif - -@@ -54,7 +54,7 @@ - .if XTENSA_HAVE_COPROCESSOR(x); \ - .align 4; \ - .Lload_cp_regs_cp##x: \ -- xchal_cp##x##_load a2 a4 a5 a6 a7; \ -+ xchal_cp##x##_load a2 a3 a4 a5 a6; \ - jx a0; \ - .endif - -diff --git a/arch/xtensa/kernel/jump_label.c b/arch/xtensa/kernel/jump_label.c -index 0dde21e0d3de4..ad1841cecdfb7 100644 ---- a/arch/xtensa/kernel/jump_label.c -+++ b/arch/xtensa/kernel/jump_label.c -@@ -40,7 +40,7 @@ static int patch_text_stop_machine(void *data) - { - struct patch *patch = data; - -- if (atomic_inc_return(&patch->cpu_count) == 1) { -+ if (atomic_inc_return(&patch->cpu_count) == num_online_cpus()) { - local_patch_text(patch->addr, patch->data, patch->sz); - atomic_inc(&patch->cpu_count); - } else { -diff --git a/block/compat_ioctl.c b/block/compat_ioctl.c -index 7f053468b50d7..d490ac220ba86 100644 ---- a/block/compat_ioctl.c -+++ b/block/compat_ioctl.c -@@ -393,7 +393,7 @@ long compat_blkdev_ioctl(struct file *file, unsigned cmd, unsigned long arg) - return 0; - case BLKGETSIZE: - size = i_size_read(bdev->bd_inode); -- if ((size >> 9) > ~0UL) -+ if ((size >> 9) > ~(compat_ulong_t)0) - return -EFBIG; - return compat_put_ulong(arg, size >> 9); - -diff --git a/drivers/ata/pata_marvell.c b/drivers/ata/pata_marvell.c -index b066809ba9a11..c56f4043b0cc0 100644 ---- a/drivers/ata/pata_marvell.c -+++ b/drivers/ata/pata_marvell.c -@@ -83,6 +83,8 @@ static int marvell_cable_detect(struct ata_port *ap) - switch(ap->port_no) - { - case 0: -+ if (!ap->ioaddr.bmdma_addr) -+ return ATA_CBL_PATA_UNK; - if (ioread8(ap->ioaddr.bmdma_addr + 1) & 1) - return ATA_CBL_PATA40; - return ATA_CBL_PATA80; -diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c -index 9aae6b3da356b..6473a4a81d58b 100644 ---- a/drivers/dma/at_xdmac.c -+++ b/drivers/dma/at_xdmac.c -@@ -1390,7 +1390,7 @@ at_xdmac_tx_status(struct dma_chan *chan, dma_cookie_t cookie, - { - struct at_xdmac_chan *atchan = to_at_xdmac_chan(chan); - struct at_xdmac *atxdmac = to_at_xdmac(atchan->chan.device); -- struct at_xdmac_desc *desc, *_desc; -+ struct at_xdmac_desc *desc, *_desc, *iter; - struct list_head *descs_list; - enum dma_status ret; - int residue, retry; -@@ -1505,11 +1505,13 @@ at_xdmac_tx_status(struct dma_chan *chan, dma_cookie_t cookie, - * microblock. - */ - descs_list = &desc->descs_list; -- list_for_each_entry_safe(desc, _desc, descs_list, desc_node) { -- dwidth = at_xdmac_get_dwidth(desc->lld.mbr_cfg); -- residue -= (desc->lld.mbr_ubc & 0xffffff) << dwidth; -- if ((desc->lld.mbr_nda & 0xfffffffc) == cur_nda) -+ list_for_each_entry_safe(iter, _desc, descs_list, desc_node) { -+ dwidth = at_xdmac_get_dwidth(iter->lld.mbr_cfg); -+ residue -= (iter->lld.mbr_ubc & 0xffffff) << dwidth; -+ if ((iter->lld.mbr_nda & 0xfffffffc) == cur_nda) { -+ desc = iter; - break; -+ } - } - residue += cur_ubc << dwidth; - -diff --git a/drivers/dma/imx-sdma.c b/drivers/dma/imx-sdma.c -index cc70da05db4b5..801bef83df2a5 100644 ---- a/drivers/dma/imx-sdma.c -+++ b/drivers/dma/imx-sdma.c -@@ -1784,7 +1784,7 @@ static int sdma_event_remap(struct sdma_engine *sdma) - u32 reg, val, shift, num_map, i; - int ret = 0; - -- if (IS_ERR(np) || IS_ERR(gpr_np)) -+ if (IS_ERR(np) || !gpr_np) - goto out; - - event_remap = of_find_property(np, propname, NULL); -@@ -1832,7 +1832,7 @@ static int sdma_event_remap(struct sdma_engine *sdma) - } - - out: -- if (!IS_ERR(gpr_np)) -+ if (gpr_np) - of_node_put(gpr_np); - - return ret; -diff --git a/drivers/dma/mediatek/mtk-uart-apdma.c b/drivers/dma/mediatek/mtk-uart-apdma.c -index 9c0ea13ca7883..7718d09e3d29f 100644 ---- a/drivers/dma/mediatek/mtk-uart-apdma.c -+++ b/drivers/dma/mediatek/mtk-uart-apdma.c -@@ -274,7 +274,7 @@ static int mtk_uart_apdma_alloc_chan_resources(struct dma_chan *chan) - unsigned int status; - int ret; - -- ret = pm_runtime_get_sync(mtkd->ddev.dev); -+ ret = pm_runtime_resume_and_get(mtkd->ddev.dev); - if (ret < 0) { - pm_runtime_put_noidle(chan->device->dev); - return ret; -@@ -288,18 +288,21 @@ static int mtk_uart_apdma_alloc_chan_resources(struct dma_chan *chan) - ret = readx_poll_timeout(readl, c->base + VFF_EN, - status, !status, 10, 100); - if (ret) -- return ret; -+ goto err_pm; - - ret = request_irq(c->irq, mtk_uart_apdma_irq_handler, - IRQF_TRIGGER_NONE, KBUILD_MODNAME, chan); - if (ret < 0) { - dev_err(chan->device->dev, "Can't request dma IRQ\n"); -- return -EINVAL; -+ ret = -EINVAL; -+ goto err_pm; - } - - if (mtkd->support_33bits) - mtk_uart_apdma_write(c, VFF_4G_SUPPORT, VFF_4G_SUPPORT_CLR_B); - -+err_pm: -+ pm_runtime_put_noidle(mtkd->ddev.dev); - return ret; - } - -diff --git a/drivers/edac/synopsys_edac.c b/drivers/edac/synopsys_edac.c -index d23a0782fb49c..4d2387f8e511b 100644 ---- a/drivers/edac/synopsys_edac.c -+++ b/drivers/edac/synopsys_edac.c -@@ -163,6 +163,11 @@ - #define ECC_STAT_CECNT_SHIFT 8 - #define ECC_STAT_BITNUM_MASK 0x7F - -+/* ECC error count register definitions */ -+#define ECC_ERRCNT_UECNT_MASK 0xFFFF0000 -+#define ECC_ERRCNT_UECNT_SHIFT 16 -+#define ECC_ERRCNT_CECNT_MASK 0xFFFF -+ - /* DDR QOS Interrupt register definitions */ - #define DDR_QOS_IRQ_STAT_OFST 0x20200 - #define DDR_QOSUE_MASK 0x4 -@@ -418,15 +423,16 @@ static int zynqmp_get_error_info(struct synps_edac_priv *priv) - base = priv->baseaddr; - p = &priv->stat; - -+ regval = readl(base + ECC_ERRCNT_OFST); -+ p->ce_cnt = regval & ECC_ERRCNT_CECNT_MASK; -+ p->ue_cnt = (regval & ECC_ERRCNT_UECNT_MASK) >> ECC_ERRCNT_UECNT_SHIFT; -+ if (!p->ce_cnt) -+ goto ue_err; -+ - regval = readl(base + ECC_STAT_OFST); - if (!regval) - return 1; - -- p->ce_cnt = (regval & ECC_STAT_CECNT_MASK) >> ECC_STAT_CECNT_SHIFT; -- p->ue_cnt = (regval & ECC_STAT_UECNT_MASK) >> ECC_STAT_UECNT_SHIFT; -- if (!p->ce_cnt) -- goto ue_err; -- - p->ceinfo.bitpos = (regval & ECC_STAT_BITNUM_MASK); - - regval = readl(base + ECC_CEADDR0_OFST); -diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c -index 83423092de2ff..da07993339702 100644 ---- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c -+++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c -@@ -179,7 +179,10 @@ static void mdp5_plane_reset(struct drm_plane *plane) - drm_framebuffer_put(plane->state->fb); - - kfree(to_mdp5_plane_state(plane->state)); -+ plane->state = NULL; - mdp5_state = kzalloc(sizeof(*mdp5_state), GFP_KERNEL); -+ if (!mdp5_state) -+ return; - - /* assign default blend parameters */ - mdp5_state->alpha = 255; -diff --git a/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c b/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c -index bdb4d59c81277..a621dd28ff70d 100644 ---- a/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c -+++ b/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c -@@ -232,7 +232,7 @@ static void rpi_touchscreen_i2c_write(struct rpi_touchscreen *ts, - - ret = i2c_smbus_write_byte_data(ts->i2c, reg, val); - if (ret) -- dev_err(&ts->dsi->dev, "I2C write failed: %d\n", ret); -+ dev_err(&ts->i2c->dev, "I2C write failed: %d\n", ret); - } - - static int rpi_touchscreen_write(struct rpi_touchscreen *ts, u16 reg, u32 val) -@@ -268,7 +268,7 @@ static int rpi_touchscreen_noop(struct drm_panel *panel) - return 0; - } - --static int rpi_touchscreen_enable(struct drm_panel *panel) -+static int rpi_touchscreen_prepare(struct drm_panel *panel) - { - struct rpi_touchscreen *ts = panel_to_ts(panel); - int i; -@@ -298,6 +298,13 @@ static int rpi_touchscreen_enable(struct drm_panel *panel) - rpi_touchscreen_write(ts, DSI_STARTDSI, 0x01); - msleep(100); - -+ return 0; -+} -+ -+static int rpi_touchscreen_enable(struct drm_panel *panel) -+{ -+ struct rpi_touchscreen *ts = panel_to_ts(panel); -+ - /* Turn on the backlight. */ - rpi_touchscreen_i2c_write(ts, REG_PWM, 255); - -@@ -352,7 +359,7 @@ static int rpi_touchscreen_get_modes(struct drm_panel *panel) - static const struct drm_panel_funcs rpi_touchscreen_funcs = { - .disable = rpi_touchscreen_disable, - .unprepare = rpi_touchscreen_noop, -- .prepare = rpi_touchscreen_noop, -+ .prepare = rpi_touchscreen_prepare, - .enable = rpi_touchscreen_enable, - .get_modes = rpi_touchscreen_get_modes, - }; -diff --git a/drivers/gpu/drm/vc4/vc4_dsi.c b/drivers/gpu/drm/vc4/vc4_dsi.c -index c78fa8144776e..0983949cc8c98 100644 ---- a/drivers/gpu/drm/vc4/vc4_dsi.c -+++ b/drivers/gpu/drm/vc4/vc4_dsi.c -@@ -831,7 +831,7 @@ static void vc4_dsi_encoder_enable(struct drm_encoder *encoder) - unsigned long phy_clock; - int ret; - -- ret = pm_runtime_get_sync(dev); -+ ret = pm_runtime_resume_and_get(dev); - if (ret) { - DRM_ERROR("Failed to runtime PM enable on DSI%d\n", dsi->port); - return; -diff --git a/drivers/net/can/usb/usb_8dev.c b/drivers/net/can/usb/usb_8dev.c -index c43e98bb6e2d7..b514b2eaa3180 100644 ---- a/drivers/net/can/usb/usb_8dev.c -+++ b/drivers/net/can/usb/usb_8dev.c -@@ -670,9 +670,20 @@ static netdev_tx_t usb_8dev_start_xmit(struct sk_buff *skb, - atomic_inc(&priv->active_tx_urbs); - - err = usb_submit_urb(urb, GFP_ATOMIC); -- if (unlikely(err)) -- goto failed; -- else if (atomic_read(&priv->active_tx_urbs) >= MAX_TX_URBS) -+ if (unlikely(err)) { -+ can_free_echo_skb(netdev, context->echo_index); -+ -+ usb_unanchor_urb(urb); -+ usb_free_coherent(priv->udev, size, buf, urb->transfer_dma); -+ -+ atomic_dec(&priv->active_tx_urbs); -+ -+ if (err == -ENODEV) -+ netif_device_detach(netdev); -+ else -+ netdev_warn(netdev, "failed tx_urb %d\n", err); -+ stats->tx_dropped++; -+ } else if (atomic_read(&priv->active_tx_urbs) >= MAX_TX_URBS) - /* Slow down tx path */ - netif_stop_queue(netdev); - -@@ -691,19 +702,6 @@ nofreecontext: - - return NETDEV_TX_BUSY; - --failed: -- can_free_echo_skb(netdev, context->echo_index); -- -- usb_unanchor_urb(urb); -- usb_free_coherent(priv->udev, size, buf, urb->transfer_dma); -- -- atomic_dec(&priv->active_tx_urbs); -- -- if (err == -ENODEV) -- netif_device_detach(netdev); -- else -- netdev_warn(netdev, "failed tx_urb %d\n", err); -- - nomembuf: - usb_free_urb(urb); - -diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c -index 480d2ca369e6b..002a374f197bd 100644 ---- a/drivers/net/ethernet/cadence/macb_main.c -+++ b/drivers/net/ethernet/cadence/macb_main.c -@@ -1378,6 +1378,7 @@ static void macb_tx_restart(struct macb_queue *queue) - unsigned int head = queue->tx_head; - unsigned int tail = queue->tx_tail; - struct macb *bp = queue->bp; -+ unsigned int head_idx, tbqp; - - if (bp->caps & MACB_CAPS_ISR_CLEAR_ON_WRITE) - queue_writel(queue, ISR, MACB_BIT(TXUBR)); -@@ -1385,6 +1386,13 @@ static void macb_tx_restart(struct macb_queue *queue) - if (head == tail) - return; - -+ tbqp = queue_readl(queue, TBQP) / macb_dma_desc_get_size(bp); -+ tbqp = macb_adj_dma_desc_idx(bp, macb_tx_ring_wrap(bp, tbqp)); -+ head_idx = macb_adj_dma_desc_idx(bp, macb_tx_ring_wrap(bp, head)); -+ -+ if (tbqp == head_idx) -+ return; -+ - macb_writel(bp, NCR, macb_readl(bp, NCR) | MACB_BIT(TSTART)); - } - -diff --git a/drivers/net/ethernet/freescale/dpaa/dpaa_ethtool.c b/drivers/net/ethernet/freescale/dpaa/dpaa_ethtool.c -index 7ce2e99b594d6..0a186d16e73f7 100644 ---- a/drivers/net/ethernet/freescale/dpaa/dpaa_ethtool.c -+++ b/drivers/net/ethernet/freescale/dpaa/dpaa_ethtool.c -@@ -506,11 +506,15 @@ static int dpaa_get_ts_info(struct net_device *net_dev, - info->phc_index = -1; - - fman_node = of_get_parent(mac_node); -- if (fman_node) -+ if (fman_node) { - ptp_node = of_parse_phandle(fman_node, "ptimer-handle", 0); -+ of_node_put(fman_node); -+ } - -- if (ptp_node) -+ if (ptp_node) { - ptp_dev = of_find_device_by_node(ptp_node); -+ of_node_put(ptp_node); -+ } - - if (ptp_dev) - ptp = platform_get_drvdata(ptp_dev); -diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c -index 58ff747a42ae6..1241b4734896f 100644 ---- a/drivers/net/ethernet/intel/e1000e/ich8lan.c -+++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c -@@ -995,8 +995,8 @@ static s32 e1000_platform_pm_pch_lpt(struct e1000_hw *hw, bool link) - { - u32 reg = link << (E1000_LTRV_REQ_SHIFT + E1000_LTRV_NOSNOOP_SHIFT) | - link << E1000_LTRV_REQ_SHIFT | E1000_LTRV_SEND; -- u16 max_ltr_enc_d = 0; /* maximum LTR decoded by platform */ -- u16 lat_enc_d = 0; /* latency decoded */ -+ u32 max_ltr_enc_d = 0; /* maximum LTR decoded by platform */ -+ u32 lat_enc_d = 0; /* latency decoded */ - u16 lat_enc = 0; /* latency encoded */ - - if (link) { -diff --git a/drivers/net/ethernet/intel/igc/igc_i225.c b/drivers/net/ethernet/intel/igc/igc_i225.c -index ed5d09c11c389..79252ca9e2133 100644 ---- a/drivers/net/ethernet/intel/igc/igc_i225.c -+++ b/drivers/net/ethernet/intel/igc/igc_i225.c -@@ -156,8 +156,15 @@ void igc_release_swfw_sync_i225(struct igc_hw *hw, u16 mask) - { - u32 swfw_sync; - -- while (igc_get_hw_semaphore_i225(hw)) -- ; /* Empty */ -+ /* Releasing the resource requires first getting the HW semaphore. -+ * If we fail to get the semaphore, there is nothing we can do, -+ * except log an error and quit. We are not allowed to hang here -+ * indefinitely, as it may cause denial of service or system crash. -+ */ -+ if (igc_get_hw_semaphore_i225(hw)) { -+ hw_dbg("Failed to release SW_FW_SYNC.\n"); -+ return; -+ } - - swfw_sync = rd32(IGC_SW_FW_SYNC); - swfw_sync &= ~mask; -diff --git a/drivers/net/ethernet/intel/igc/igc_phy.c b/drivers/net/ethernet/intel/igc/igc_phy.c -index 1a4947e6933c3..6156c76d765ff 100644 ---- a/drivers/net/ethernet/intel/igc/igc_phy.c -+++ b/drivers/net/ethernet/intel/igc/igc_phy.c -@@ -569,7 +569,7 @@ static s32 igc_read_phy_reg_mdic(struct igc_hw *hw, u32 offset, u16 *data) - * the lower time out - */ - for (i = 0; i < IGC_GEN_POLL_TIMEOUT; i++) { -- usleep_range(500, 1000); -+ udelay(50); - mdic = rd32(IGC_MDIC); - if (mdic & IGC_MDIC_READY) - break; -@@ -626,7 +626,7 @@ static s32 igc_write_phy_reg_mdic(struct igc_hw *hw, u32 offset, u16 data) - * the lower time out - */ - for (i = 0; i < IGC_GEN_POLL_TIMEOUT; i++) { -- usleep_range(500, 1000); -+ udelay(50); - mdic = rd32(IGC_MDIC); - if (mdic & IGC_MDIC_READY) - break; -diff --git a/drivers/net/ethernet/micrel/Kconfig b/drivers/net/ethernet/micrel/Kconfig -index 120ed4633a096..b9c4d48e28e42 100644 ---- a/drivers/net/ethernet/micrel/Kconfig -+++ b/drivers/net/ethernet/micrel/Kconfig -@@ -37,7 +37,6 @@ config KS8851 - config KS8851_MLL - tristate "Micrel KS8851 MLL" - depends on HAS_IOMEM -- depends on PTP_1588_CLOCK_OPTIONAL - select MII - ---help--- - This platform driver is for Micrel KS8851 Address/data bus -diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c -index c5991e31c557e..f4869b1836f30 100644 ---- a/drivers/net/vxlan.c -+++ b/drivers/net/vxlan.c -@@ -679,11 +679,11 @@ static int vxlan_fdb_append(struct vxlan_fdb *f, - - rd = kmalloc(sizeof(*rd), GFP_ATOMIC); - if (rd == NULL) -- return -ENOBUFS; -+ return -ENOMEM; - - if (dst_cache_init(&rd->dst_cache, GFP_ATOMIC)) { - kfree(rd); -- return -ENOBUFS; -+ return -ENOMEM; - } - - rd->remote_ip = *ip; -diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c -index ef5521b9b3577..ddc999670484f 100644 ---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c -+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c -@@ -550,7 +550,7 @@ enum brcmf_sdio_frmtype { - BRCMF_SDIO_FT_SUB, - }; - --#define SDIOD_DRVSTR_KEY(chip, pmu) (((chip) << 16) | (pmu)) -+#define SDIOD_DRVSTR_KEY(chip, pmu) (((unsigned int)(chip) << 16) | (pmu)) - - /* SDIO Pad drive strength to select value mappings */ - struct sdiod_drive_str { -diff --git a/drivers/net/wireless/mediatek/mt76/mt76x2/pci.c b/drivers/net/wireless/mediatek/mt76/mt76x2/pci.c -index cf611d1b817c0..e6d7646a0d9ca 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt76x2/pci.c -+++ b/drivers/net/wireless/mediatek/mt76/mt76x2/pci.c -@@ -76,7 +76,7 @@ mt76pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) - mt76_rmw_field(dev, 0x15a10, 0x1f << 16, 0x9); - - /* RG_SSUSB_G1_CDR_BIC_LTR = 0xf */ -- mt76_rmw_field(dev, 0x15a0c, 0xf << 28, 0xf); -+ mt76_rmw_field(dev, 0x15a0c, 0xfU << 28, 0xf); - - /* RG_SSUSB_CDR_BR_PE1D = 0x3 */ - mt76_rmw_field(dev, 0x15c58, 0x3 << 6, 0x3); -diff --git a/drivers/perf/arm_pmu.c b/drivers/perf/arm_pmu.c -index df352b334ea77..b377872a8f9d6 100644 ---- a/drivers/perf/arm_pmu.c -+++ b/drivers/perf/arm_pmu.c -@@ -322,6 +322,9 @@ validate_group(struct perf_event *event) - if (!validate_event(event->pmu, &fake_pmu, leader)) - return -EINVAL; - -+ if (event == leader) -+ return 0; -+ - for_each_sibling_event(sibling, leader) { - if (!validate_event(event->pmu, &fake_pmu, sibling)) - return -EINVAL; -@@ -411,12 +414,7 @@ __hw_perf_event_init(struct perf_event *event) - local64_set(&hwc->period_left, hwc->sample_period); - } - -- if (event->group_leader != event) { -- if (validate_group(event) != 0) -- return -EINVAL; -- } -- -- return 0; -+ return validate_group(event); - } - - static int armpmu_event_init(struct perf_event *event) -diff --git a/drivers/platform/x86/samsung-laptop.c b/drivers/platform/x86/samsung-laptop.c -index 9b6a93ff41ffb..91e468fcaf7cc 100644 ---- a/drivers/platform/x86/samsung-laptop.c -+++ b/drivers/platform/x86/samsung-laptop.c -@@ -1121,8 +1121,6 @@ static void kbd_led_set(struct led_classdev *led_cdev, - - if (value > samsung->kbd_led.max_brightness) - value = samsung->kbd_led.max_brightness; -- else if (value < 0) -- value = 0; - - samsung->kbd_led_wk = value; - queue_work(samsung->led_workqueue, &samsung->kbd_led_work); -diff --git a/drivers/reset/tegra/reset-bpmp.c b/drivers/reset/tegra/reset-bpmp.c -index 24d3395964cc4..4c5bba52b1059 100644 ---- a/drivers/reset/tegra/reset-bpmp.c -+++ b/drivers/reset/tegra/reset-bpmp.c -@@ -20,6 +20,7 @@ static int tegra_bpmp_reset_common(struct reset_controller_dev *rstc, - struct tegra_bpmp *bpmp = to_tegra_bpmp(rstc); - struct mrq_reset_request request; - struct tegra_bpmp_message msg; -+ int err; - - memset(&request, 0, sizeof(request)); - request.cmd = command; -@@ -30,7 +31,13 @@ static int tegra_bpmp_reset_common(struct reset_controller_dev *rstc, - msg.tx.data = &request; - msg.tx.size = sizeof(request); - -- return tegra_bpmp_transfer(bpmp, &msg); -+ err = tegra_bpmp_transfer(bpmp, &msg); -+ if (err) -+ return err; -+ if (msg.rx.ret) -+ return -EINVAL; -+ -+ return 0; - } - - static int tegra_bpmp_reset_module(struct reset_controller_dev *rstc, -diff --git a/drivers/scsi/qedi/qedi_iscsi.c b/drivers/scsi/qedi/qedi_iscsi.c -index 755f66b1ff9c7..f05fb4ddeaff0 100644 ---- a/drivers/scsi/qedi/qedi_iscsi.c -+++ b/drivers/scsi/qedi/qedi_iscsi.c -@@ -797,6 +797,37 @@ static int qedi_task_xmit(struct iscsi_task *task) - return qedi_iscsi_send_ioreq(task); - } - -+static void qedi_offload_work(struct work_struct *work) -+{ -+ struct qedi_endpoint *qedi_ep = -+ container_of(work, struct qedi_endpoint, offload_work); -+ struct qedi_ctx *qedi; -+ int wait_delay = 5 * HZ; -+ int ret; -+ -+ qedi = qedi_ep->qedi; -+ -+ ret = qedi_iscsi_offload_conn(qedi_ep); -+ if (ret) { -+ QEDI_ERR(&qedi->dbg_ctx, -+ "offload error: iscsi_cid=%u, qedi_ep=%p, ret=%d\n", -+ qedi_ep->iscsi_cid, qedi_ep, ret); -+ qedi_ep->state = EP_STATE_OFLDCONN_FAILED; -+ return; -+ } -+ -+ ret = wait_event_interruptible_timeout(qedi_ep->tcp_ofld_wait, -+ (qedi_ep->state == -+ EP_STATE_OFLDCONN_COMPL), -+ wait_delay); -+ if (ret <= 0 || qedi_ep->state != EP_STATE_OFLDCONN_COMPL) { -+ qedi_ep->state = EP_STATE_OFLDCONN_FAILED; -+ QEDI_ERR(&qedi->dbg_ctx, -+ "Offload conn TIMEOUT iscsi_cid=%u, qedi_ep=%p\n", -+ qedi_ep->iscsi_cid, qedi_ep); -+ } -+} -+ - static struct iscsi_endpoint * - qedi_ep_connect(struct Scsi_Host *shost, struct sockaddr *dst_addr, - int non_blocking) -@@ -840,6 +871,7 @@ qedi_ep_connect(struct Scsi_Host *shost, struct sockaddr *dst_addr, - } - qedi_ep = ep->dd_data; - memset(qedi_ep, 0, sizeof(struct qedi_endpoint)); -+ INIT_WORK(&qedi_ep->offload_work, qedi_offload_work); - qedi_ep->state = EP_STATE_IDLE; - qedi_ep->iscsi_cid = (u32)-1; - qedi_ep->qedi = qedi; -@@ -996,12 +1028,11 @@ static void qedi_ep_disconnect(struct iscsi_endpoint *ep) - qedi_ep = ep->dd_data; - qedi = qedi_ep->qedi; - -+ flush_work(&qedi_ep->offload_work); -+ - if (qedi_ep->state == EP_STATE_OFLDCONN_START) - goto ep_exit_recover; - -- if (qedi_ep->state != EP_STATE_OFLDCONN_NONE) -- flush_work(&qedi_ep->offload_work); -- - if (qedi_ep->conn) { - qedi_conn = qedi_ep->conn; - conn = qedi_conn->cls_conn->dd_data; -@@ -1161,37 +1192,6 @@ static int qedi_data_avail(struct qedi_ctx *qedi, u16 vlanid) - return rc; - } - --static void qedi_offload_work(struct work_struct *work) --{ -- struct qedi_endpoint *qedi_ep = -- container_of(work, struct qedi_endpoint, offload_work); -- struct qedi_ctx *qedi; -- int wait_delay = 5 * HZ; -- int ret; -- -- qedi = qedi_ep->qedi; -- -- ret = qedi_iscsi_offload_conn(qedi_ep); -- if (ret) { -- QEDI_ERR(&qedi->dbg_ctx, -- "offload error: iscsi_cid=%u, qedi_ep=%p, ret=%d\n", -- qedi_ep->iscsi_cid, qedi_ep, ret); -- qedi_ep->state = EP_STATE_OFLDCONN_FAILED; -- return; -- } -- -- ret = wait_event_interruptible_timeout(qedi_ep->tcp_ofld_wait, -- (qedi_ep->state == -- EP_STATE_OFLDCONN_COMPL), -- wait_delay); -- if ((ret <= 0) || (qedi_ep->state != EP_STATE_OFLDCONN_COMPL)) { -- qedi_ep->state = EP_STATE_OFLDCONN_FAILED; -- QEDI_ERR(&qedi->dbg_ctx, -- "Offload conn TIMEOUT iscsi_cid=%u, qedi_ep=%p\n", -- qedi_ep->iscsi_cid, qedi_ep); -- } --} -- - static int qedi_set_path(struct Scsi_Host *shost, struct iscsi_path *path_data) - { - struct qedi_ctx *qedi; -@@ -1307,7 +1307,6 @@ static int qedi_set_path(struct Scsi_Host *shost, struct iscsi_path *path_data) - qedi_ep->dst_addr, qedi_ep->dst_port); - } - -- INIT_WORK(&qedi_ep->offload_work, qedi_offload_work); - queue_work(qedi->offload_thread, &qedi_ep->offload_work); - - ret = 0; -diff --git a/drivers/spi/atmel-quadspi.c b/drivers/spi/atmel-quadspi.c -index 5fd929e023e18..b4d85fd62ce91 100644 ---- a/drivers/spi/atmel-quadspi.c -+++ b/drivers/spi/atmel-quadspi.c -@@ -202,6 +202,9 @@ static int atmel_qspi_find_mode(const struct spi_mem_op *op) - static bool atmel_qspi_supports_op(struct spi_mem *mem, - const struct spi_mem_op *op) - { -+ if (!spi_mem_default_supports_op(mem, op)) -+ return false; -+ - if (atmel_qspi_find_mode(op) < 0) - return false; - -diff --git a/drivers/staging/android/ion/ion.c b/drivers/staging/android/ion/ion.c -index e6b1ca141b930..88888cc5d1932 100644 ---- a/drivers/staging/android/ion/ion.c -+++ b/drivers/staging/android/ion/ion.c -@@ -114,6 +114,9 @@ static void *ion_buffer_kmap_get(struct ion_buffer *buffer) - void *vaddr; - - if (buffer->kmap_cnt) { -+ if (buffer->kmap_cnt == INT_MAX) -+ return ERR_PTR(-EOVERFLOW); -+ - buffer->kmap_cnt++; - return buffer->vaddr; - } -diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c -index f44b6f9d07776..79a18692b84c5 100644 ---- a/fs/cifs/cifsfs.c -+++ b/fs/cifs/cifsfs.c -@@ -889,7 +889,7 @@ cifs_loose_read_iter(struct kiocb *iocb, struct iov_iter *iter) - ssize_t rc; - struct inode *inode = file_inode(iocb->ki_filp); - -- if (iocb->ki_filp->f_flags & O_DIRECT) -+ if (iocb->ki_flags & IOCB_DIRECT) - return cifs_user_readv(iocb, iter); - - rc = cifs_revalidate_mapping(inode); -diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h -index ae2cb15d95407..e932e84823714 100644 ---- a/fs/ext4/ext4.h -+++ b/fs/ext4/ext4.h -@@ -1966,6 +1966,10 @@ static inline int ext4_forced_shutdown(struct ext4_sb_info *sbi) - * Structure of a directory entry - */ - #define EXT4_NAME_LEN 255 -+/* -+ * Base length of the ext4 directory entry excluding the name length -+ */ -+#define EXT4_BASE_DIR_LEN (sizeof(struct ext4_dir_entry_2) - EXT4_NAME_LEN) - - struct ext4_dir_entry { - __le32 inode; /* Inode number */ -diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c -index 0d62f05f89256..00686fbe3c27d 100644 ---- a/fs/ext4/inode.c -+++ b/fs/ext4/inode.c -@@ -4311,7 +4311,8 @@ int ext4_punch_hole(struct inode *inode, loff_t offset, loff_t length) - struct super_block *sb = inode->i_sb; - ext4_lblk_t first_block, stop_block; - struct address_space *mapping = inode->i_mapping; -- loff_t first_block_offset, last_block_offset; -+ loff_t first_block_offset, last_block_offset, max_length; -+ struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb); - handle_t *handle; - unsigned int credits; - int ret = 0; -@@ -4357,6 +4358,14 @@ int ext4_punch_hole(struct inode *inode, loff_t offset, loff_t length) - offset; - } - -+ /* -+ * For punch hole the length + offset needs to be within one block -+ * before last range. Adjust the length if it goes beyond that limit. -+ */ -+ max_length = sbi->s_bitmap_maxbytes - inode->i_sb->s_blocksize; -+ if (offset + length > max_length) -+ length = max_length - offset; -+ - if (offset & (sb->s_blocksize - 1) || - (offset + length) & (sb->s_blocksize - 1)) { - /* -diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c -index 9905720df9248..f10307215d583 100644 ---- a/fs/ext4/namei.c -+++ b/fs/ext4/namei.c -@@ -1385,10 +1385,10 @@ int ext4_search_dir(struct buffer_head *bh, char *search_buf, int buf_size, - - de = (struct ext4_dir_entry_2 *)search_buf; - dlimit = search_buf + buf_size; -- while ((char *) de < dlimit) { -+ while ((char *) de < dlimit - EXT4_BASE_DIR_LEN) { - /* this code is executed quadratically often */ - /* do minimal checking `by hand' */ -- if ((char *) de + de->name_len <= dlimit && -+ if (de->name + de->name_len <= dlimit && - ext4_match(dir, fname, de)) { - /* found a match - just to be sure, do - * a full check */ -diff --git a/fs/ext4/page-io.c b/fs/ext4/page-io.c -index 2cc9f2168b9e4..b66b335a0ca6f 100644 ---- a/fs/ext4/page-io.c -+++ b/fs/ext4/page-io.c -@@ -100,8 +100,10 @@ static void ext4_finish_bio(struct bio *bio) - continue; - } - clear_buffer_async_write(bh); -- if (bio->bi_status) -+ if (bio->bi_status) { -+ set_buffer_write_io_error(bh); - buffer_io_error(bh); -+ } - } while ((bh = bh->b_this_page) != head); - bit_spin_unlock(BH_Uptodate_Lock, &head->b_state); - local_irq_restore(flags); -diff --git a/fs/ext4/super.c b/fs/ext4/super.c -index 5bc7fd0240a19..c13879bd21683 100644 ---- a/fs/ext4/super.c -+++ b/fs/ext4/super.c -@@ -3485,9 +3485,11 @@ static int count_overhead(struct super_block *sb, ext4_group_t grp, - ext4_fsblk_t first_block, last_block, b; - ext4_group_t i, ngroups = ext4_get_groups_count(sb); - int s, j, count = 0; -+ int has_super = ext4_bg_has_super(sb, grp); - - if (!ext4_has_feature_bigalloc(sb)) -- return (ext4_bg_has_super(sb, grp) + ext4_bg_num_gdb(sb, grp) + -+ return (has_super + ext4_bg_num_gdb(sb, grp) + -+ (has_super ? le16_to_cpu(sbi->s_es->s_reserved_gdt_blocks) : 0) + - sbi->s_itb_per_group + 2); - - first_block = le32_to_cpu(sbi->s_es->s_first_data_block) + -@@ -4512,9 +4514,18 @@ no_journal: - * Get the # of file system overhead blocks from the - * superblock if present. - */ -- if (es->s_overhead_clusters) -- sbi->s_overhead = le32_to_cpu(es->s_overhead_clusters); -- else { -+ sbi->s_overhead = le32_to_cpu(es->s_overhead_clusters); -+ /* ignore the precalculated value if it is ridiculous */ -+ if (sbi->s_overhead > ext4_blocks_count(es)) -+ sbi->s_overhead = 0; -+ /* -+ * If the bigalloc feature is not enabled recalculating the -+ * overhead doesn't take long, so we might as well just redo -+ * it to make sure we are using the correct value. -+ */ -+ if (!ext4_has_feature_bigalloc(sb)) -+ sbi->s_overhead = 0; -+ if (sbi->s_overhead == 0) { - err = ext4_calculate_overhead(sb); - if (err) - goto failed_mount_wq; -diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c -index d7ec0ac87fc03..8153a3eac540a 100644 ---- a/fs/gfs2/rgrp.c -+++ b/fs/gfs2/rgrp.c -@@ -925,15 +925,15 @@ static int read_rindex_entry(struct gfs2_inode *ip) - rgd->rd_bitbytes = be32_to_cpu(buf.ri_bitbytes); - spin_lock_init(&rgd->rd_rsspin); - -- error = compute_bitstructs(rgd); -- if (error) -- goto fail; -- - error = gfs2_glock_get(sdp, rgd->rd_addr, - &gfs2_rgrp_glops, CREATE, &rgd->rd_gl); - if (error) - goto fail; - -+ error = compute_bitstructs(rgd); -+ if (error) -+ goto fail_glock; -+ - rgd->rd_rgl = (struct gfs2_rgrp_lvb *)rgd->rd_gl->gl_lksb.sb_lvbptr; - rgd->rd_flags &= ~(GFS2_RDF_UPTODATE | GFS2_RDF_PREFERRED); - if (rgd->rd_data > sdp->sd_max_rg_data) -@@ -950,6 +950,7 @@ static int read_rindex_entry(struct gfs2_inode *ip) - } - - error = 0; /* someone else read in the rgrp; free it and ignore it */ -+fail_glock: - gfs2_glock_put(rgd->rd_gl); - - fail: -diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c -index 88146008b3e36..d45ceb2e21492 100644 ---- a/fs/jbd2/commit.c -+++ b/fs/jbd2/commit.c -@@ -451,7 +451,6 @@ void jbd2_journal_commit_transaction(journal_t *journal) - } - spin_unlock(&commit_transaction->t_handle_lock); - commit_transaction->t_state = T_SWITCH; -- write_unlock(&journal->j_state_lock); - - J_ASSERT (atomic_read(&commit_transaction->t_outstanding_credits) <= - journal->j_max_transaction_buffers); -@@ -471,6 +470,8 @@ void jbd2_journal_commit_transaction(journal_t *journal) - * has reserved. This is consistent with the existing behaviour - * that multiple jbd2_journal_get_write_access() calls to the same - * buffer are perfectly permissible. -+ * We use journal->j_state_lock here to serialize processing of -+ * t_reserved_list with eviction of buffers from journal_unmap_buffer(). - */ - while (commit_transaction->t_reserved_list) { - jh = commit_transaction->t_reserved_list; -@@ -490,6 +491,7 @@ void jbd2_journal_commit_transaction(journal_t *journal) - jbd2_journal_refile_buffer(journal, jh); - } - -+ write_unlock(&journal->j_state_lock); - /* - * Now try to drop any written-back buffers from the journal's - * checkpoint lists. We do this *before* commit because it potentially -diff --git a/fs/stat.c b/fs/stat.c -index c38e4c2e1221c..268c9eb896564 100644 ---- a/fs/stat.c -+++ b/fs/stat.c -@@ -290,9 +290,6 @@ SYSCALL_DEFINE2(fstat, unsigned int, fd, struct __old_kernel_stat __user *, stat - # define choose_32_64(a,b) b - #endif - --#define valid_dev(x) choose_32_64(old_valid_dev(x),true) --#define encode_dev(x) choose_32_64(old_encode_dev,new_encode_dev)(x) -- - #ifndef INIT_STRUCT_STAT_PADDING - # define INIT_STRUCT_STAT_PADDING(st) memset(&st, 0, sizeof(st)) - #endif -@@ -301,7 +298,9 @@ static int cp_new_stat(struct kstat *stat, struct stat __user *statbuf) - { - struct stat tmp; - -- if (!valid_dev(stat->dev) || !valid_dev(stat->rdev)) -+ if (sizeof(tmp.st_dev) < 4 && !old_valid_dev(stat->dev)) -+ return -EOVERFLOW; -+ if (sizeof(tmp.st_rdev) < 4 && !old_valid_dev(stat->rdev)) - return -EOVERFLOW; - #if BITS_PER_LONG == 32 - if (stat->size > MAX_NON_LFS) -@@ -309,7 +308,7 @@ static int cp_new_stat(struct kstat *stat, struct stat __user *statbuf) - #endif - - INIT_STRUCT_STAT_PADDING(tmp); -- tmp.st_dev = encode_dev(stat->dev); -+ tmp.st_dev = new_encode_dev(stat->dev); - tmp.st_ino = stat->ino; - if (sizeof(tmp.st_ino) < sizeof(stat->ino) && tmp.st_ino != stat->ino) - return -EOVERFLOW; -@@ -319,7 +318,7 @@ static int cp_new_stat(struct kstat *stat, struct stat __user *statbuf) - return -EOVERFLOW; - SET_UID(tmp.st_uid, from_kuid_munged(current_user_ns(), stat->uid)); - SET_GID(tmp.st_gid, from_kgid_munged(current_user_ns(), stat->gid)); -- tmp.st_rdev = encode_dev(stat->rdev); -+ tmp.st_rdev = new_encode_dev(stat->rdev); - tmp.st_size = stat->size; - tmp.st_atime = stat->atime.tv_sec; - tmp.st_mtime = stat->mtime.tv_sec; -@@ -593,11 +592,13 @@ static int cp_compat_stat(struct kstat *stat, struct compat_stat __user *ubuf) - { - struct compat_stat tmp; - -- if (!old_valid_dev(stat->dev) || !old_valid_dev(stat->rdev)) -+ if (sizeof(tmp.st_dev) < 4 && !old_valid_dev(stat->dev)) -+ return -EOVERFLOW; -+ if (sizeof(tmp.st_rdev) < 4 && !old_valid_dev(stat->rdev)) - return -EOVERFLOW; - - memset(&tmp, 0, sizeof(tmp)); -- tmp.st_dev = old_encode_dev(stat->dev); -+ tmp.st_dev = new_encode_dev(stat->dev); - tmp.st_ino = stat->ino; - if (sizeof(tmp.st_ino) < sizeof(stat->ino) && tmp.st_ino != stat->ino) - return -EOVERFLOW; -@@ -607,7 +608,7 @@ static int cp_compat_stat(struct kstat *stat, struct compat_stat __user *ubuf) - return -EOVERFLOW; - SET_UID(tmp.st_uid, from_kuid_munged(current_user_ns(), stat->uid)); - SET_GID(tmp.st_gid, from_kgid_munged(current_user_ns(), stat->gid)); -- tmp.st_rdev = old_encode_dev(stat->rdev); -+ tmp.st_rdev = new_encode_dev(stat->rdev); - if ((u64) stat->size > MAX_NON_LFS) - return -EOVERFLOW; - tmp.st_size = stat->size; -diff --git a/include/linux/etherdevice.h b/include/linux/etherdevice.h -index f6564b572d779..0f1e95240c0c0 100644 ---- a/include/linux/etherdevice.h -+++ b/include/linux/etherdevice.h -@@ -127,7 +127,7 @@ static inline bool is_multicast_ether_addr(const u8 *addr) - #endif - } - --static inline bool is_multicast_ether_addr_64bits(const u8 addr[6+2]) -+static inline bool is_multicast_ether_addr_64bits(const u8 *addr) - { - #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) && BITS_PER_LONG == 64 - #ifdef __BIG_ENDIAN -@@ -341,8 +341,7 @@ static inline bool ether_addr_equal(const u8 *addr1, const u8 *addr2) - * Please note that alignment of addr1 & addr2 are only guaranteed to be 16 bits. - */ - --static inline bool ether_addr_equal_64bits(const u8 addr1[6+2], -- const u8 addr2[6+2]) -+static inline bool ether_addr_equal_64bits(const u8 *addr1, const u8 *addr2) - { - #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) && BITS_PER_LONG == 64 - u64 fold = (*(const u64 *)addr1) ^ (*(const u64 *)addr2); -diff --git a/include/linux/sched.h b/include/linux/sched.h -index b341471de9d60..171cb7475b450 100644 ---- a/include/linux/sched.h -+++ b/include/linux/sched.h -@@ -1247,6 +1247,7 @@ struct task_struct { - int pagefault_disabled; - #ifdef CONFIG_MMU - struct task_struct *oom_reaper_list; -+ struct timer_list oom_reaper_timer; - #endif - #ifdef CONFIG_VMAP_STACK - struct vm_struct *stack_vm_area; -diff --git a/include/net/inet_hashtables.h b/include/net/inet_hashtables.h -index 59802eb8d2cc1..a1869a6789448 100644 ---- a/include/net/inet_hashtables.h -+++ b/include/net/inet_hashtables.h -@@ -247,8 +247,9 @@ void inet_hashinfo2_init(struct inet_hashinfo *h, const char *name, - unsigned long high_limit); - int inet_hashinfo2_init_mod(struct inet_hashinfo *h); - --bool inet_ehash_insert(struct sock *sk, struct sock *osk); --bool inet_ehash_nolisten(struct sock *sk, struct sock *osk); -+bool inet_ehash_insert(struct sock *sk, struct sock *osk, bool *found_dup_sk); -+bool inet_ehash_nolisten(struct sock *sk, struct sock *osk, -+ bool *found_dup_sk); - int __inet_hash(struct sock *sk, struct sock *osk); - int inet_hash(struct sock *sk); - void inet_unhash(struct sock *sk); -diff --git a/kernel/trace/trace_events_trigger.c b/kernel/trace/trace_events_trigger.c -index 3105dbf6c0e96..82580f7ffad95 100644 ---- a/kernel/trace/trace_events_trigger.c -+++ b/kernel/trace/trace_events_trigger.c -@@ -1219,7 +1219,14 @@ static void - stacktrace_trigger(struct event_trigger_data *data, void *rec, - struct ring_buffer_event *event) - { -- trace_dump_stack(STACK_SKIP); -+ struct trace_event_file *file = data->private_data; -+ unsigned long flags; -+ -+ if (file) { -+ local_save_flags(flags); -+ __trace_stack(file->tr, flags, STACK_SKIP, preempt_count()); -+ } else -+ trace_dump_stack(STACK_SKIP); - } - - static void -diff --git a/mm/oom_kill.c b/mm/oom_kill.c -index dcbb9a28706fc..ee927ffeb718d 100644 ---- a/mm/oom_kill.c -+++ b/mm/oom_kill.c -@@ -631,7 +631,7 @@ done: - */ - set_bit(MMF_OOM_SKIP, &mm->flags); - -- /* Drop a reference taken by wake_oom_reaper */ -+ /* Drop a reference taken by queue_oom_reaper */ - put_task_struct(tsk); - } - -@@ -641,12 +641,12 @@ static int oom_reaper(void *unused) - struct task_struct *tsk = NULL; - - wait_event_freezable(oom_reaper_wait, oom_reaper_list != NULL); -- spin_lock(&oom_reaper_lock); -+ spin_lock_irq(&oom_reaper_lock); - if (oom_reaper_list != NULL) { - tsk = oom_reaper_list; - oom_reaper_list = tsk->oom_reaper_list; - } -- spin_unlock(&oom_reaper_lock); -+ spin_unlock_irq(&oom_reaper_lock); - - if (tsk) - oom_reap_task(tsk); -@@ -655,22 +655,48 @@ static int oom_reaper(void *unused) - return 0; - } - --static void wake_oom_reaper(struct task_struct *tsk) -+static void wake_oom_reaper(struct timer_list *timer) - { -- /* mm is already queued? */ -- if (test_and_set_bit(MMF_OOM_REAP_QUEUED, &tsk->signal->oom_mm->flags)) -- return; -+ struct task_struct *tsk = container_of(timer, struct task_struct, -+ oom_reaper_timer); -+ struct mm_struct *mm = tsk->signal->oom_mm; -+ unsigned long flags; - -- get_task_struct(tsk); -+ /* The victim managed to terminate on its own - see exit_mmap */ -+ if (test_bit(MMF_OOM_SKIP, &mm->flags)) { -+ put_task_struct(tsk); -+ return; -+ } - -- spin_lock(&oom_reaper_lock); -+ spin_lock_irqsave(&oom_reaper_lock, flags); - tsk->oom_reaper_list = oom_reaper_list; - oom_reaper_list = tsk; -- spin_unlock(&oom_reaper_lock); -+ spin_unlock_irqrestore(&oom_reaper_lock, flags); - trace_wake_reaper(tsk->pid); - wake_up(&oom_reaper_wait); - } - -+/* -+ * Give the OOM victim time to exit naturally before invoking the oom_reaping. -+ * The timers timeout is arbitrary... the longer it is, the longer the worst -+ * case scenario for the OOM can take. If it is too small, the oom_reaper can -+ * get in the way and release resources needed by the process exit path. -+ * e.g. The futex robust list can sit in Anon|Private memory that gets reaped -+ * before the exit path is able to wake the futex waiters. -+ */ -+#define OOM_REAPER_DELAY (2*HZ) -+static void queue_oom_reaper(struct task_struct *tsk) -+{ -+ /* mm is already queued? */ -+ if (test_and_set_bit(MMF_OOM_REAP_QUEUED, &tsk->signal->oom_mm->flags)) -+ return; -+ -+ get_task_struct(tsk); -+ timer_setup(&tsk->oom_reaper_timer, wake_oom_reaper, 0); -+ tsk->oom_reaper_timer.expires = jiffies + OOM_REAPER_DELAY; -+ add_timer(&tsk->oom_reaper_timer); -+} -+ - static int __init oom_init(void) - { - oom_reaper_th = kthread_run(oom_reaper, NULL, "oom_reaper"); -@@ -678,7 +704,7 @@ static int __init oom_init(void) - } - subsys_initcall(oom_init) - #else --static inline void wake_oom_reaper(struct task_struct *tsk) -+static inline void queue_oom_reaper(struct task_struct *tsk) - { - } - #endif /* CONFIG_MMU */ -@@ -927,7 +953,7 @@ static void __oom_kill_process(struct task_struct *victim, const char *message) - rcu_read_unlock(); - - if (can_oom_reap) -- wake_oom_reaper(victim); -+ queue_oom_reaper(victim); - - mmdrop(mm); - put_task_struct(victim); -@@ -963,7 +989,7 @@ static void oom_kill_process(struct oom_control *oc, const char *message) - task_lock(victim); - if (task_will_free_mem(victim)) { - mark_oom_victim(victim); -- wake_oom_reaper(victim); -+ queue_oom_reaper(victim); - task_unlock(victim); - put_task_struct(victim); - return; -@@ -1061,7 +1087,7 @@ bool out_of_memory(struct oom_control *oc) - */ - if (task_will_free_mem(current)) { - mark_oom_victim(current); -- wake_oom_reaper(current); -+ queue_oom_reaper(current); - return true; - } - -diff --git a/mm/page_alloc.c b/mm/page_alloc.c -index 7048ea59d58bd..f08ce248af2a9 100644 ---- a/mm/page_alloc.c -+++ b/mm/page_alloc.c -@@ -7588,7 +7588,7 @@ void __init mem_init_print_info(const char *str) - */ - #define adj_init_size(start, end, size, pos, adj) \ - do { \ -- if (start <= pos && pos < end && size > adj) \ -+ if (&start[0] <= &pos[0] && &pos[0] < &end[0] && size > adj) \ - size -= adj; \ - } while (0) - -diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c -index d19557c6d04b5..7cf903f9e29a9 100644 ---- a/net/dccp/ipv4.c -+++ b/net/dccp/ipv4.c -@@ -427,7 +427,7 @@ struct sock *dccp_v4_request_recv_sock(const struct sock *sk, - - if (__inet_inherit_port(sk, newsk) < 0) - goto put_and_exit; -- *own_req = inet_ehash_nolisten(newsk, req_to_sk(req_unhash)); -+ *own_req = inet_ehash_nolisten(newsk, req_to_sk(req_unhash), NULL); - if (*own_req) - ireq->ireq_opt = NULL; - else -diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c -index 9f73ccf46c9b1..7c24927e9c2c2 100644 ---- a/net/dccp/ipv6.c -+++ b/net/dccp/ipv6.c -@@ -538,7 +538,7 @@ static struct sock *dccp_v6_request_recv_sock(const struct sock *sk, - dccp_done(newsk); - goto out; - } -- *own_req = inet_ehash_nolisten(newsk, req_to_sk(req_unhash)); -+ *own_req = inet_ehash_nolisten(newsk, req_to_sk(req_unhash), NULL); - /* Clone pktoptions received with SYN, if we own the req */ - if (*own_req && ireq->pktopts) { - newnp->pktoptions = skb_clone(ireq->pktopts, GFP_ATOMIC); -diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c -index 85a88425edc48..6cbf0db57ad06 100644 ---- a/net/ipv4/inet_connection_sock.c -+++ b/net/ipv4/inet_connection_sock.c -@@ -791,7 +791,7 @@ static void reqsk_queue_hash_req(struct request_sock *req, - timer_setup(&req->rsk_timer, reqsk_timer_handler, TIMER_PINNED); - mod_timer(&req->rsk_timer, jiffies + timeout); - -- inet_ehash_insert(req_to_sk(req), NULL); -+ inet_ehash_insert(req_to_sk(req), NULL, NULL); - /* before letting lookups find us, make sure all req fields - * are committed to memory and refcnt initialized. - */ -diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c -index 72fdf1fcbcaa9..cbbeb0eea0c35 100644 ---- a/net/ipv4/inet_hashtables.c -+++ b/net/ipv4/inet_hashtables.c -@@ -20,6 +20,9 @@ - #include - #include - #include -+#if IS_ENABLED(CONFIG_IPV6) -+#include -+#endif - #include - #include - #include -@@ -470,10 +473,52 @@ static u32 inet_sk_port_offset(const struct sock *sk) - inet->inet_dport); - } - --/* insert a socket into ehash, and eventually remove another one -- * (The another one can be a SYN_RECV or TIMEWAIT -+/* Searches for an exsiting socket in the ehash bucket list. -+ * Returns true if found, false otherwise. - */ --bool inet_ehash_insert(struct sock *sk, struct sock *osk) -+static bool inet_ehash_lookup_by_sk(struct sock *sk, -+ struct hlist_nulls_head *list) -+{ -+ const __portpair ports = INET_COMBINED_PORTS(sk->sk_dport, sk->sk_num); -+ const int sdif = sk->sk_bound_dev_if; -+ const int dif = sk->sk_bound_dev_if; -+ const struct hlist_nulls_node *node; -+ struct net *net = sock_net(sk); -+ struct sock *esk; -+ -+ INET_ADDR_COOKIE(acookie, sk->sk_daddr, sk->sk_rcv_saddr); -+ -+ sk_nulls_for_each_rcu(esk, node, list) { -+ if (esk->sk_hash != sk->sk_hash) -+ continue; -+ if (sk->sk_family == AF_INET) { -+ if (unlikely(INET_MATCH(esk, net, acookie, -+ sk->sk_daddr, -+ sk->sk_rcv_saddr, -+ ports, dif, sdif))) { -+ return true; -+ } -+ } -+#if IS_ENABLED(CONFIG_IPV6) -+ else if (sk->sk_family == AF_INET6) { -+ if (unlikely(INET6_MATCH(esk, net, -+ &sk->sk_v6_daddr, -+ &sk->sk_v6_rcv_saddr, -+ ports, dif, sdif))) { -+ return true; -+ } -+ } -+#endif -+ } -+ return false; -+} -+ -+/* Insert a socket into ehash, and eventually remove another one -+ * (The another one can be a SYN_RECV or TIMEWAIT) -+ * If an existing socket already exists, socket sk is not inserted, -+ * and sets found_dup_sk parameter to true. -+ */ -+bool inet_ehash_insert(struct sock *sk, struct sock *osk, bool *found_dup_sk) - { - struct inet_hashinfo *hashinfo = sk->sk_prot->h.hashinfo; - struct hlist_nulls_head *list; -@@ -492,16 +537,23 @@ bool inet_ehash_insert(struct sock *sk, struct sock *osk) - if (osk) { - WARN_ON_ONCE(sk->sk_hash != osk->sk_hash); - ret = sk_nulls_del_node_init_rcu(osk); -+ } else if (found_dup_sk) { -+ *found_dup_sk = inet_ehash_lookup_by_sk(sk, list); -+ if (*found_dup_sk) -+ ret = false; - } -+ - if (ret) - __sk_nulls_add_node_rcu(sk, list); -+ - spin_unlock(lock); -+ - return ret; - } - --bool inet_ehash_nolisten(struct sock *sk, struct sock *osk) -+bool inet_ehash_nolisten(struct sock *sk, struct sock *osk, bool *found_dup_sk) - { -- bool ok = inet_ehash_insert(sk, osk); -+ bool ok = inet_ehash_insert(sk, osk, found_dup_sk); - - if (ok) { - sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1); -@@ -545,7 +597,7 @@ int __inet_hash(struct sock *sk, struct sock *osk) - int err = 0; - - if (sk->sk_state != TCP_LISTEN) { -- inet_ehash_nolisten(sk, osk); -+ inet_ehash_nolisten(sk, osk, NULL); - return 0; - } - WARN_ON(!sk_unhashed(sk)); -@@ -641,7 +693,7 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row, - tb = inet_csk(sk)->icsk_bind_hash; - spin_lock_bh(&head->lock); - if (sk_head(&tb->owners) == sk && !sk->sk_bind_node.next) { -- inet_ehash_nolisten(sk, NULL); -+ inet_ehash_nolisten(sk, NULL, NULL); - spin_unlock_bh(&head->lock); - return 0; - } -@@ -720,7 +772,7 @@ ok: - inet_bind_hash(sk, tb, port); - if (sk_unhashed(sk)) { - inet_sk(sk)->inet_sport = htons(port); -- inet_ehash_nolisten(sk, (struct sock *)tw); -+ inet_ehash_nolisten(sk, (struct sock *)tw, NULL); - } - if (tw) - inet_twsk_bind_unhash(tw, hinfo); -diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c -index 2ce85e52aea7c..426d70d45eda4 100644 ---- a/net/ipv4/tcp_ipv4.c -+++ b/net/ipv4/tcp_ipv4.c -@@ -1426,6 +1426,7 @@ struct sock *tcp_v4_syn_recv_sock(const struct sock *sk, struct sk_buff *skb, - bool *own_req) - { - struct inet_request_sock *ireq; -+ bool found_dup_sk = false; - struct inet_sock *newinet; - struct tcp_sock *newtp; - struct sock *newsk; -@@ -1496,12 +1497,22 @@ struct sock *tcp_v4_syn_recv_sock(const struct sock *sk, struct sk_buff *skb, - - if (__inet_inherit_port(sk, newsk) < 0) - goto put_and_exit; -- *own_req = inet_ehash_nolisten(newsk, req_to_sk(req_unhash)); -+ *own_req = inet_ehash_nolisten(newsk, req_to_sk(req_unhash), -+ &found_dup_sk); - if (likely(*own_req)) { - tcp_move_syn(newtp, req); - ireq->ireq_opt = NULL; - } else { - newinet->inet_opt = NULL; -+ -+ if (!req_unhash && found_dup_sk) { -+ /* This code path should only be executed in the -+ * syncookie case only -+ */ -+ bh_unlock_sock(newsk); -+ sock_put(newsk); -+ newsk = NULL; -+ } - } - return newsk; - -diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c -index 3903cc0ab1883..51c900e9bfe20 100644 ---- a/net/ipv6/tcp_ipv6.c -+++ b/net/ipv6/tcp_ipv6.c -@@ -1142,6 +1142,7 @@ static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff * - const struct ipv6_pinfo *np = tcp_inet6_sk(sk); - struct ipv6_txoptions *opt; - struct inet_sock *newinet; -+ bool found_dup_sk = false; - struct tcp_sock *newtp; - struct sock *newsk; - #ifdef CONFIG_TCP_MD5SIG -@@ -1308,7 +1309,8 @@ static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff * - tcp_done(newsk); - goto out; - } -- *own_req = inet_ehash_nolisten(newsk, req_to_sk(req_unhash)); -+ *own_req = inet_ehash_nolisten(newsk, req_to_sk(req_unhash), -+ &found_dup_sk); - if (*own_req) { - tcp_move_syn(newtp, req); - -@@ -1323,6 +1325,15 @@ static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff * - skb_set_owner_r(newnp->pktoptions, newsk); - } - } -+ } else { -+ if (!req_unhash && found_dup_sk) { -+ /* This code path should only be executed in the -+ * syncookie case only -+ */ -+ bh_unlock_sock(newsk); -+ sock_put(newsk); -+ newsk = NULL; -+ } - } - - return newsk; -diff --git a/net/l3mdev/l3mdev.c b/net/l3mdev/l3mdev.c -index f35899d45a9af..ff4352f6d168a 100644 ---- a/net/l3mdev/l3mdev.c -+++ b/net/l3mdev/l3mdev.c -@@ -54,7 +54,7 @@ int l3mdev_master_upper_ifindex_by_index_rcu(struct net *net, int ifindex) - - dev = dev_get_by_index_rcu(net, ifindex); - while (dev && !netif_is_l3_master(dev)) -- dev = netdev_master_upper_dev_get(dev); -+ dev = netdev_master_upper_dev_get_rcu(dev); - - return dev ? dev->ifindex : 0; - } -diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c -index fb28969899af0..8aefc52542a00 100644 ---- a/net/netlink/af_netlink.c -+++ b/net/netlink/af_netlink.c -@@ -2253,6 +2253,13 @@ static int netlink_dump(struct sock *sk) - * single netdev. The outcome is MSG_TRUNC error. - */ - skb_reserve(skb, skb_tailroom(skb) - alloc_size); -+ -+ /* Make sure malicious BPF programs can not read unitialized memory -+ * from skb->head -> skb->data -+ */ -+ skb_reset_network_header(skb); -+ skb_reset_mac_header(skb); -+ - netlink_skb_set_owner_r(skb, sk); - - if (nlk->dump_done_errno > 0) { -diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c -index d3f068ad154cb..8461de79f67b4 100644 ---- a/net/openvswitch/flow_netlink.c -+++ b/net/openvswitch/flow_netlink.c -@@ -2329,7 +2329,7 @@ static struct nlattr *reserve_sfa_size(struct sw_flow_actions **sfa, - new_acts_size = max(next_offset + req_size, ksize(*sfa) * 2); - - if (new_acts_size > MAX_ACTIONS_BUFSIZE) { -- if ((MAX_ACTIONS_BUFSIZE - next_offset) < req_size) { -+ if ((next_offset + req_size) > MAX_ACTIONS_BUFSIZE) { - OVS_NLERR(log, "Flow action size exceeds max %u", - MAX_ACTIONS_BUFSIZE); - return ERR_PTR(-EMSGSIZE); -diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c -index 70c102359bfef..a2696acbcd9d2 100644 ---- a/net/packet/af_packet.c -+++ b/net/packet/af_packet.c -@@ -2791,8 +2791,9 @@ tpacket_error: - - status = TP_STATUS_SEND_REQUEST; - err = po->xmit(skb); -- if (unlikely(err > 0)) { -- err = net_xmit_errno(err); -+ if (unlikely(err != 0)) { -+ if (err > 0) -+ err = net_xmit_errno(err); - if (err && __packet_get_status(po, ph) == - TP_STATUS_AVAILABLE) { - /* skb was destructed already */ -@@ -2993,8 +2994,12 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len) - skb->no_fcs = 1; - - err = po->xmit(skb); -- if (err > 0 && (err = net_xmit_errno(err)) != 0) -- goto out_unlock; -+ if (unlikely(err != 0)) { -+ if (err > 0) -+ err = net_xmit_errno(err); -+ if (err) -+ goto out_unlock; -+ } - - dev_put(dev); - -diff --git a/net/rxrpc/net_ns.c b/net/rxrpc/net_ns.c -index 9a76b74af37bc..91a503871116b 100644 ---- a/net/rxrpc/net_ns.c -+++ b/net/rxrpc/net_ns.c -@@ -116,7 +116,9 @@ static __net_exit void rxrpc_exit_net(struct net *net) - struct rxrpc_net *rxnet = rxrpc_net(net); - - rxnet->live = false; -+ del_timer_sync(&rxnet->peer_keepalive_timer); - cancel_work_sync(&rxnet->peer_keepalive_work); -+ /* Remove the timer again as the worker may have restarted it. */ - del_timer_sync(&rxnet->peer_keepalive_timer); - rxrpc_destroy_all_calls(rxnet); - rxrpc_destroy_all_connections(rxnet); -diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c -index e15ff335953de..ed8d26e6468ca 100644 ---- a/net/sched/cls_u32.c -+++ b/net/sched/cls_u32.c -@@ -386,14 +386,19 @@ static int u32_init(struct tcf_proto *tp) - return 0; - } - --static int u32_destroy_key(struct tc_u_knode *n, bool free_pf) -+static void __u32_destroy_key(struct tc_u_knode *n) - { - struct tc_u_hnode *ht = rtnl_dereference(n->ht_down); - - tcf_exts_destroy(&n->exts); -- tcf_exts_put_net(&n->exts); - if (ht && --ht->refcnt == 0) - kfree(ht); -+ kfree(n); -+} -+ -+static void u32_destroy_key(struct tc_u_knode *n, bool free_pf) -+{ -+ tcf_exts_put_net(&n->exts); - #ifdef CONFIG_CLS_U32_PERF - if (free_pf) - free_percpu(n->pf); -@@ -402,8 +407,7 @@ static int u32_destroy_key(struct tc_u_knode *n, bool free_pf) - if (free_pf) - free_percpu(n->pcpu_success); - #endif -- kfree(n); -- return 0; -+ __u32_destroy_key(n); - } - - /* u32_delete_key_rcu should be called when free'ing a copied -@@ -812,10 +816,6 @@ static struct tc_u_knode *u32_init_knode(struct net *net, struct tcf_proto *tp, - new->flags = n->flags; - RCU_INIT_POINTER(new->ht_down, ht); - -- /* bump reference count as long as we hold pointer to structure */ -- if (ht) -- ht->refcnt++; -- - #ifdef CONFIG_CLS_U32_PERF - /* Statistics may be incremented by readers during update - * so we must keep them in tact. When the node is later destroyed -@@ -837,6 +837,10 @@ static struct tc_u_knode *u32_init_knode(struct net *net, struct tcf_proto *tp, - return NULL; - } - -+ /* bump reference count as long as we hold pointer to structure */ -+ if (ht) -+ ht->refcnt++; -+ - return new; - } - -@@ -903,13 +907,13 @@ static int u32_change(struct net *net, struct sk_buff *in_skb, - tca[TCA_RATE], ovr, extack); - - if (err) { -- u32_destroy_key(new, false); -+ __u32_destroy_key(new); - return err; - } - - err = u32_replace_hw_knode(tp, new, flags, extack); - if (err) { -- u32_destroy_key(new, false); -+ __u32_destroy_key(new); - return err; - } - -diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c -index 06684ac346abd..5221092cc66d4 100644 ---- a/net/smc/af_smc.c -+++ b/net/smc/af_smc.c -@@ -1698,8 +1698,10 @@ static int smc_shutdown(struct socket *sock, int how) - if (smc->use_fallback) { - rc = kernel_sock_shutdown(smc->clcsock, how); - sk->sk_shutdown = smc->clcsock->sk->sk_shutdown; -- if (sk->sk_shutdown == SHUTDOWN_MASK) -+ if (sk->sk_shutdown == SHUTDOWN_MASK) { - sk->sk_state = SMC_CLOSED; -+ sock_put(sk); -+ } - goto out; - } - switch (how) { -diff --git a/sound/soc/atmel/sam9g20_wm8731.c b/sound/soc/atmel/sam9g20_wm8731.c -index 05277a88e20d8..d1579896f3a11 100644 ---- a/sound/soc/atmel/sam9g20_wm8731.c -+++ b/sound/soc/atmel/sam9g20_wm8731.c -@@ -46,35 +46,6 @@ - */ - #undef ENABLE_MIC_INPUT - --static struct clk *mclk; -- --static int at91sam9g20ek_set_bias_level(struct snd_soc_card *card, -- struct snd_soc_dapm_context *dapm, -- enum snd_soc_bias_level level) --{ -- static int mclk_on; -- int ret = 0; -- -- switch (level) { -- case SND_SOC_BIAS_ON: -- case SND_SOC_BIAS_PREPARE: -- if (!mclk_on) -- ret = clk_enable(mclk); -- if (ret == 0) -- mclk_on = 1; -- break; -- -- case SND_SOC_BIAS_OFF: -- case SND_SOC_BIAS_STANDBY: -- if (mclk_on) -- clk_disable(mclk); -- mclk_on = 0; -- break; -- } -- -- return ret; --} -- - static const struct snd_soc_dapm_widget at91sam9g20ek_dapm_widgets[] = { - SND_SOC_DAPM_MIC("Int Mic", NULL), - SND_SOC_DAPM_SPK("Ext Spk", NULL), -@@ -135,7 +106,6 @@ static struct snd_soc_card snd_soc_at91sam9g20ek = { - .owner = THIS_MODULE, - .dai_link = &at91sam9g20ek_dai, - .num_links = 1, -- .set_bias_level = at91sam9g20ek_set_bias_level, - - .dapm_widgets = at91sam9g20ek_dapm_widgets, - .num_dapm_widgets = ARRAY_SIZE(at91sam9g20ek_dapm_widgets), -@@ -148,7 +118,6 @@ static int at91sam9g20ek_audio_probe(struct platform_device *pdev) - { - struct device_node *np = pdev->dev.of_node; - struct device_node *codec_np, *cpu_np; -- struct clk *pllb; - struct snd_soc_card *card = &snd_soc_at91sam9g20ek; - int ret; - -@@ -162,31 +131,6 @@ static int at91sam9g20ek_audio_probe(struct platform_device *pdev) - return -EINVAL; - } - -- /* -- * Codec MCLK is supplied by PCK0 - set it up. -- */ -- mclk = clk_get(NULL, "pck0"); -- if (IS_ERR(mclk)) { -- dev_err(&pdev->dev, "Failed to get MCLK\n"); -- ret = PTR_ERR(mclk); -- goto err; -- } -- -- pllb = clk_get(NULL, "pllb"); -- if (IS_ERR(pllb)) { -- dev_err(&pdev->dev, "Failed to get PLLB\n"); -- ret = PTR_ERR(pllb); -- goto err_mclk; -- } -- ret = clk_set_parent(mclk, pllb); -- clk_put(pllb); -- if (ret != 0) { -- dev_err(&pdev->dev, "Failed to set MCLK parent\n"); -- goto err_mclk; -- } -- -- clk_set_rate(mclk, MCLK_RATE); -- - card->dev = &pdev->dev; - - /* Parse device node info */ -@@ -230,9 +174,6 @@ static int at91sam9g20ek_audio_probe(struct platform_device *pdev) - - return ret; - --err_mclk: -- clk_put(mclk); -- mclk = NULL; - err: - atmel_ssc_put_audio(0); - return ret; -@@ -242,8 +183,6 @@ static int at91sam9g20ek_audio_remove(struct platform_device *pdev) - { - struct snd_soc_card *card = platform_get_drvdata(pdev); - -- clk_disable(mclk); -- mclk = NULL; - snd_soc_unregister_card(card); - atmel_ssc_put_audio(0); - -diff --git a/sound/soc/codecs/msm8916-wcd-digital.c b/sound/soc/codecs/msm8916-wcd-digital.c -index d5269ab5f91c5..e4cde214b7b2d 100644 ---- a/sound/soc/codecs/msm8916-wcd-digital.c -+++ b/sound/soc/codecs/msm8916-wcd-digital.c -@@ -1206,9 +1206,16 @@ static int msm8916_wcd_digital_probe(struct platform_device *pdev) - - dev_set_drvdata(dev, priv); - -- return devm_snd_soc_register_component(dev, &msm8916_wcd_digital, -+ ret = devm_snd_soc_register_component(dev, &msm8916_wcd_digital, - msm8916_wcd_digital_dai, - ARRAY_SIZE(msm8916_wcd_digital_dai)); -+ if (ret) -+ goto err_mclk; -+ -+ return 0; -+ -+err_mclk: -+ clk_disable_unprepare(priv->mclk); - err_clk: - clk_disable_unprepare(priv->ahbclk); - return ret; -diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c -index 5876be5dd9bae..1c09dfb0c0f09 100644 ---- a/sound/soc/soc-dapm.c -+++ b/sound/soc/soc-dapm.c -@@ -1676,8 +1676,7 @@ static void dapm_seq_run(struct snd_soc_card *card, - switch (w->id) { - case snd_soc_dapm_pre: - if (!w->event) -- list_for_each_entry_safe_continue(w, n, list, -- power_list); -+ continue; - - if (event == SND_SOC_DAPM_STREAM_START) - ret = w->event(w, -@@ -1689,8 +1688,7 @@ static void dapm_seq_run(struct snd_soc_card *card, - - case snd_soc_dapm_post: - if (!w->event) -- list_for_each_entry_safe_continue(w, n, list, -- power_list); -+ continue; - - if (event == SND_SOC_DAPM_STREAM_START) - ret = w->event(w, -diff --git a/sound/usb/midi.c b/sound/usb/midi.c -index 33e9a7f6246f7..ce501200e592f 100644 ---- a/sound/usb/midi.c -+++ b/sound/usb/midi.c -@@ -1210,6 +1210,7 @@ static void snd_usbmidi_output_drain(struct snd_rawmidi_substream *substream) - } while (drain_urbs && timeout); - finish_wait(&ep->drain_wait, &wait); - } -+ port->active = 0; - spin_unlock_irq(&ep->buffer_lock); - } - -diff --git a/sound/usb/usbaudio.h b/sound/usb/usbaudio.h -index ff97fdcf63bd5..b1959e04cbb14 100644 ---- a/sound/usb/usbaudio.h -+++ b/sound/usb/usbaudio.h -@@ -8,7 +8,7 @@ - */ - - /* handling of USB vendor/product ID pairs as 32-bit numbers */ --#define USB_ID(vendor, product) (((vendor) << 16) | (product)) -+#define USB_ID(vendor, product) (((unsigned int)(vendor) << 16) | (product)) - #define USB_ID_VENDOR(id) ((id) >> 16) - #define USB_ID_PRODUCT(id) ((u16)(id)) - -diff --git a/tools/testing/selftests/drivers/net/mlxsw/vxlan_flooding.sh b/tools/testing/selftests/drivers/net/mlxsw/vxlan_flooding.sh -index fedcb7b35af9f..af5ea50ed5c0e 100755 ---- a/tools/testing/selftests/drivers/net/mlxsw/vxlan_flooding.sh -+++ b/tools/testing/selftests/drivers/net/mlxsw/vxlan_flooding.sh -@@ -172,6 +172,17 @@ flooding_filters_add() - local lsb - local i - -+ # Prevent unwanted packets from entering the bridge and interfering -+ # with the test. -+ tc qdisc add dev br0 clsact -+ tc filter add dev br0 egress protocol all pref 1 handle 1 \ -+ matchall skip_hw action drop -+ tc qdisc add dev $h1 clsact -+ tc filter add dev $h1 egress protocol all pref 1 handle 1 \ -+ flower skip_hw dst_mac de:ad:be:ef:13:37 action pass -+ tc filter add dev $h1 egress protocol all pref 2 handle 2 \ -+ matchall skip_hw action drop -+ - tc qdisc add dev $rp2 clsact - - for i in $(eval echo {1..$num_remotes}); do -@@ -194,6 +205,12 @@ flooding_filters_del() - done - - tc qdisc del dev $rp2 clsact -+ -+ tc filter del dev $h1 egress protocol all pref 2 handle 2 matchall -+ tc filter del dev $h1 egress protocol all pref 1 handle 1 flower -+ tc qdisc del dev $h1 clsact -+ tc filter del dev br0 egress protocol all pref 1 handle 1 matchall -+ tc qdisc del dev br0 clsact - } - - flooding_check_packets() diff --git a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.191-192.patch b/patch/kernel/archive/odroidxu4-5.4/patch-5.4.191-192.patch deleted file mode 100644 index deeec3389..000000000 --- a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.191-192.patch +++ /dev/null @@ -1,2396 +0,0 @@ -diff --git a/Makefile b/Makefile -index 365b487e50d7f..968470cf368ee 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 5 - PATCHLEVEL = 4 --SUBLEVEL = 191 -+SUBLEVEL = 192 - EXTRAVERSION = - NAME = Kleptomaniac Octopus - -diff --git a/arch/arm/boot/dts/am3517-evm.dts b/arch/arm/boot/dts/am3517-evm.dts -index a1fd3e63e86ec..3db30ce134b95 100644 ---- a/arch/arm/boot/dts/am3517-evm.dts -+++ b/arch/arm/boot/dts/am3517-evm.dts -@@ -160,6 +160,8 @@ - - /* HS USB Host PHY on PORT 1 */ - hsusb1_phy: hsusb1_phy { -+ pinctrl-names = "default"; -+ pinctrl-0 = <&hsusb1_rst_pins>; - compatible = "usb-nop-xceiv"; - reset-gpios = <&gpio2 25 GPIO_ACTIVE_LOW>; /* gpio_57 */ - #phy-cells = <0>; -@@ -167,7 +169,9 @@ - }; - - &davinci_emac { -- status = "okay"; -+ pinctrl-names = "default"; -+ pinctrl-0 = <ðernet_pins>; -+ status = "okay"; - }; - - &davinci_mdio { -@@ -192,6 +196,8 @@ - }; - - &i2c2 { -+ pinctrl-names = "default"; -+ pinctrl-0 = <&i2c2_pins>; - clock-frequency = <400000>; - /* User DIP swithes [1:8] / User LEDS [1:2] */ - tca6416: gpio@21 { -@@ -204,6 +210,8 @@ - }; - - &i2c3 { -+ pinctrl-names = "default"; -+ pinctrl-0 = <&i2c3_pins>; - clock-frequency = <400000>; - }; - -@@ -222,6 +230,8 @@ - }; - - &usbhshost { -+ pinctrl-names = "default"; -+ pinctrl-0 = <&hsusb1_pins>; - port1-mode = "ehci-phy"; - }; - -@@ -230,8 +240,35 @@ - }; - - &omap3_pmx_core { -- pinctrl-names = "default"; -- pinctrl-0 = <&hsusb1_rst_pins>; -+ -+ ethernet_pins: pinmux_ethernet_pins { -+ pinctrl-single,pins = < -+ OMAP3_CORE1_IOPAD(0x21fe, PIN_INPUT | MUX_MODE0) /* rmii_mdio_data */ -+ OMAP3_CORE1_IOPAD(0x2200, MUX_MODE0) /* rmii_mdio_clk */ -+ OMAP3_CORE1_IOPAD(0x2202, PIN_INPUT_PULLDOWN | MUX_MODE0) /* rmii_rxd0 */ -+ OMAP3_CORE1_IOPAD(0x2204, PIN_INPUT_PULLDOWN | MUX_MODE0) /* rmii_rxd1 */ -+ OMAP3_CORE1_IOPAD(0x2206, PIN_INPUT_PULLDOWN | MUX_MODE0) /* rmii_crs_dv */ -+ OMAP3_CORE1_IOPAD(0x2208, PIN_OUTPUT_PULLDOWN | MUX_MODE0) /* rmii_rxer */ -+ OMAP3_CORE1_IOPAD(0x220a, PIN_OUTPUT_PULLDOWN | MUX_MODE0) /* rmii_txd0 */ -+ OMAP3_CORE1_IOPAD(0x220c, PIN_OUTPUT_PULLDOWN | MUX_MODE0) /* rmii_txd1 */ -+ OMAP3_CORE1_IOPAD(0x220e, PIN_OUTPUT_PULLDOWN |MUX_MODE0) /* rmii_txen */ -+ OMAP3_CORE1_IOPAD(0x2210, PIN_INPUT_PULLDOWN | MUX_MODE0) /* rmii_50mhz_clk */ -+ >; -+ }; -+ -+ i2c2_pins: pinmux_i2c2_pins { -+ pinctrl-single,pins = < -+ OMAP3_CORE1_IOPAD(0x21be, PIN_INPUT_PULLUP | MUX_MODE0) /* i2c2_scl */ -+ OMAP3_CORE1_IOPAD(0x21c0, PIN_INPUT_PULLUP | MUX_MODE0) /* i2c2_sda */ -+ >; -+ }; -+ -+ i2c3_pins: pinmux_i2c3_pins { -+ pinctrl-single,pins = < -+ OMAP3_CORE1_IOPAD(0x21c2, PIN_INPUT_PULLUP | MUX_MODE0) /* i2c3_scl */ -+ OMAP3_CORE1_IOPAD(0x21c4, PIN_INPUT_PULLUP | MUX_MODE0) /* i2c3_sda */ -+ >; -+ }; - - leds_pins: pinmux_leds_pins { - pinctrl-single,pins = < -@@ -299,8 +336,6 @@ - }; - - &omap3_pmx_core2 { -- pinctrl-names = "default"; -- pinctrl-0 = <&hsusb1_pins>; - - hsusb1_pins: pinmux_hsusb1_pins { - pinctrl-single,pins = < -diff --git a/arch/arm/boot/dts/am3517-som.dtsi b/arch/arm/boot/dts/am3517-som.dtsi -index 8b669e2eafec4..f7b680f6c48ad 100644 ---- a/arch/arm/boot/dts/am3517-som.dtsi -+++ b/arch/arm/boot/dts/am3517-som.dtsi -@@ -69,6 +69,8 @@ - }; - - &i2c1 { -+ pinctrl-names = "default"; -+ pinctrl-0 = <&i2c1_pins>; - clock-frequency = <400000>; - - s35390a: s35390a@30 { -@@ -179,6 +181,13 @@ - - &omap3_pmx_core { - -+ i2c1_pins: pinmux_i2c1_pins { -+ pinctrl-single,pins = < -+ OMAP3_CORE1_IOPAD(0x21ba, PIN_INPUT_PULLUP | MUX_MODE0) /* i2c1_scl */ -+ OMAP3_CORE1_IOPAD(0x21bc, PIN_INPUT_PULLUP | MUX_MODE0) /* i2c1_sda */ -+ >; -+ }; -+ - wl12xx_buffer_pins: pinmux_wl12xx_buffer_pins { - pinctrl-single,pins = < - OMAP3_CORE1_IOPAD(0x2156, PIN_OUTPUT | MUX_MODE4) /* mmc1_dat7.gpio_129 */ -diff --git a/arch/arm/boot/dts/at91sam9g20ek_common.dtsi b/arch/arm/boot/dts/at91sam9g20ek_common.dtsi -index bda22700110cd..287566e09a673 100644 ---- a/arch/arm/boot/dts/at91sam9g20ek_common.dtsi -+++ b/arch/arm/boot/dts/at91sam9g20ek_common.dtsi -@@ -217,6 +217,12 @@ - wm8731: wm8731@1b { - compatible = "wm8731"; - reg = <0x1b>; -+ -+ /* PCK0 at 12MHz */ -+ clocks = <&pmc PMC_TYPE_SYSTEM 8>; -+ clock-names = "mclk"; -+ assigned-clocks = <&pmc PMC_TYPE_SYSTEM 8>; -+ assigned-clock-rates = <12000000>; - }; - }; - -diff --git a/arch/arm/boot/dts/imx6qdl-apalis.dtsi b/arch/arm/boot/dts/imx6qdl-apalis.dtsi -index 7c4ad541c3f5e..b165bd6ea53b6 100644 ---- a/arch/arm/boot/dts/imx6qdl-apalis.dtsi -+++ b/arch/arm/boot/dts/imx6qdl-apalis.dtsi -@@ -314,6 +314,8 @@ - codec: sgtl5000@a { - compatible = "fsl,sgtl5000"; - reg = <0x0a>; -+ pinctrl-names = "default"; -+ pinctrl-0 = <&pinctrl_sgtl5000>; - clocks = <&clks IMX6QDL_CLK_CKO>; - VDDA-supply = <®_module_3v3_audio>; - VDDIO-supply = <®_module_3v3>; -@@ -543,8 +545,6 @@ - MX6QDL_PAD_DISP0_DAT21__AUD4_TXD 0x130b0 - MX6QDL_PAD_DISP0_DAT22__AUD4_TXFS 0x130b0 - MX6QDL_PAD_DISP0_DAT23__AUD4_RXD 0x130b0 -- /* SGTL5000 sys_mclk */ -- MX6QDL_PAD_GPIO_5__CCM_CLKO1 0x130b0 - >; - }; - -@@ -810,6 +810,12 @@ - >; - }; - -+ pinctrl_sgtl5000: sgtl5000grp { -+ fsl,pins = < -+ MX6QDL_PAD_GPIO_5__CCM_CLKO1 0x130b0 -+ >; -+ }; -+ - pinctrl_spdif: spdifgrp { - fsl,pins = < - MX6QDL_PAD_GPIO_16__SPDIF_IN 0x1b0b0 -diff --git a/arch/arm/boot/dts/imx6ull-colibri.dtsi b/arch/arm/boot/dts/imx6ull-colibri.dtsi -index d56728f03c35f..c83323b9ea53c 100644 ---- a/arch/arm/boot/dts/imx6ull-colibri.dtsi -+++ b/arch/arm/boot/dts/imx6ull-colibri.dtsi -@@ -37,7 +37,7 @@ - - reg_sd1_vmmc: regulator-sd1-vmmc { - compatible = "regulator-gpio"; -- gpio = <&gpio5 9 GPIO_ACTIVE_HIGH>; -+ gpios = <&gpio5 9 GPIO_ACTIVE_HIGH>; - pinctrl-names = "default"; - pinctrl-0 = <&pinctrl_snvs_reg_sd>; - regulator-always-on; -diff --git a/arch/arm/boot/dts/logicpd-som-lv-35xx-devkit.dts b/arch/arm/boot/dts/logicpd-som-lv-35xx-devkit.dts -index f7a841a288654..270e4986b6e64 100644 ---- a/arch/arm/boot/dts/logicpd-som-lv-35xx-devkit.dts -+++ b/arch/arm/boot/dts/logicpd-som-lv-35xx-devkit.dts -@@ -11,3 +11,18 @@ - model = "LogicPD Zoom OMAP35xx SOM-LV Development Kit"; - compatible = "logicpd,dm3730-som-lv-devkit", "ti,omap3"; - }; -+ -+&omap3_pmx_core2 { -+ pinctrl-names = "default"; -+ pinctrl-0 = <&hsusb2_2_pins>; -+ hsusb2_2_pins: pinmux_hsusb2_2_pins { -+ pinctrl-single,pins = < -+ OMAP3430_CORE2_IOPAD(0x25f0, PIN_OUTPUT | MUX_MODE3) /* etk_d10.hsusb2_clk */ -+ OMAP3430_CORE2_IOPAD(0x25f2, PIN_OUTPUT | MUX_MODE3) /* etk_d11.hsusb2_stp */ -+ OMAP3430_CORE2_IOPAD(0x25f4, PIN_INPUT_PULLDOWN | MUX_MODE3) /* etk_d12.hsusb2_dir */ -+ OMAP3430_CORE2_IOPAD(0x25f6, PIN_INPUT_PULLDOWN | MUX_MODE3) /* etk_d13.hsusb2_nxt */ -+ OMAP3430_CORE2_IOPAD(0x25f8, PIN_INPUT_PULLDOWN | MUX_MODE3) /* etk_d14.hsusb2_data0 */ -+ OMAP3430_CORE2_IOPAD(0x25fa, PIN_INPUT_PULLDOWN | MUX_MODE3) /* etk_d15.hsusb2_data1 */ -+ >; -+ }; -+}; -diff --git a/arch/arm/boot/dts/logicpd-som-lv-37xx-devkit.dts b/arch/arm/boot/dts/logicpd-som-lv-37xx-devkit.dts -index a604d92221a4f..c757f0d7781c1 100644 ---- a/arch/arm/boot/dts/logicpd-som-lv-37xx-devkit.dts -+++ b/arch/arm/boot/dts/logicpd-som-lv-37xx-devkit.dts -@@ -11,3 +11,18 @@ - model = "LogicPD Zoom DM3730 SOM-LV Development Kit"; - compatible = "logicpd,dm3730-som-lv-devkit", "ti,omap3630", "ti,omap3"; - }; -+ -+&omap3_pmx_core2 { -+ pinctrl-names = "default"; -+ pinctrl-0 = <&hsusb2_2_pins>; -+ hsusb2_2_pins: pinmux_hsusb2_2_pins { -+ pinctrl-single,pins = < -+ OMAP3630_CORE2_IOPAD(0x25f0, PIN_OUTPUT | MUX_MODE3) /* etk_d10.hsusb2_clk */ -+ OMAP3630_CORE2_IOPAD(0x25f2, PIN_OUTPUT | MUX_MODE3) /* etk_d11.hsusb2_stp */ -+ OMAP3630_CORE2_IOPAD(0x25f4, PIN_INPUT_PULLDOWN | MUX_MODE3) /* etk_d12.hsusb2_dir */ -+ OMAP3630_CORE2_IOPAD(0x25f6, PIN_INPUT_PULLDOWN | MUX_MODE3) /* etk_d13.hsusb2_nxt */ -+ OMAP3630_CORE2_IOPAD(0x25f8, PIN_INPUT_PULLDOWN | MUX_MODE3) /* etk_d14.hsusb2_data0 */ -+ OMAP3630_CORE2_IOPAD(0x25fa, PIN_INPUT_PULLDOWN | MUX_MODE3) /* etk_d15.hsusb2_data1 */ -+ >; -+ }; -+}; -diff --git a/arch/arm/boot/dts/logicpd-som-lv.dtsi b/arch/arm/boot/dts/logicpd-som-lv.dtsi -index b56524cc7fe27..55b619c99e24d 100644 ---- a/arch/arm/boot/dts/logicpd-som-lv.dtsi -+++ b/arch/arm/boot/dts/logicpd-som-lv.dtsi -@@ -265,21 +265,6 @@ - }; - }; - --&omap3_pmx_core2 { -- pinctrl-names = "default"; -- pinctrl-0 = <&hsusb2_2_pins>; -- hsusb2_2_pins: pinmux_hsusb2_2_pins { -- pinctrl-single,pins = < -- OMAP3630_CORE2_IOPAD(0x25f0, PIN_OUTPUT | MUX_MODE3) /* etk_d10.hsusb2_clk */ -- OMAP3630_CORE2_IOPAD(0x25f2, PIN_OUTPUT | MUX_MODE3) /* etk_d11.hsusb2_stp */ -- OMAP3630_CORE2_IOPAD(0x25f4, PIN_INPUT_PULLDOWN | MUX_MODE3) /* etk_d12.hsusb2_dir */ -- OMAP3630_CORE2_IOPAD(0x25f6, PIN_INPUT_PULLDOWN | MUX_MODE3) /* etk_d13.hsusb2_nxt */ -- OMAP3630_CORE2_IOPAD(0x25f8, PIN_INPUT_PULLDOWN | MUX_MODE3) /* etk_d14.hsusb2_data0 */ -- OMAP3630_CORE2_IOPAD(0x25fa, PIN_INPUT_PULLDOWN | MUX_MODE3) /* etk_d15.hsusb2_data1 */ -- >; -- }; --}; -- - &uart2 { - interrupts-extended = <&intc 73 &omap3_pmx_core OMAP3_UART2_RX>; - pinctrl-names = "default"; -diff --git a/arch/arm/boot/dts/omap3-gta04.dtsi b/arch/arm/boot/dts/omap3-gta04.dtsi -index 186b2af7743e3..089e9f1f442b5 100644 ---- a/arch/arm/boot/dts/omap3-gta04.dtsi -+++ b/arch/arm/boot/dts/omap3-gta04.dtsi -@@ -31,6 +31,8 @@ - aliases { - display0 = &lcd; - display1 = &tv0; -+ /delete-property/ mmc2; -+ /delete-property/ mmc3; - }; - - ldo_3v3: fixedregulator { -diff --git a/arch/arm/mach-omap2/omap4-common.c b/arch/arm/mach-omap2/omap4-common.c -index 5c3845730dbf5..0b80f8bcd3047 100644 ---- a/arch/arm/mach-omap2/omap4-common.c -+++ b/arch/arm/mach-omap2/omap4-common.c -@@ -314,10 +314,12 @@ void __init omap_gic_of_init(void) - - np = of_find_compatible_node(NULL, NULL, "arm,cortex-a9-gic"); - gic_dist_base_addr = of_iomap(np, 0); -+ of_node_put(np); - WARN_ON(!gic_dist_base_addr); - - np = of_find_compatible_node(NULL, NULL, "arm,cortex-a9-twd-timer"); - twd_base = of_iomap(np, 0); -+ of_node_put(np); - WARN_ON(!twd_base); - - skip_errata_init: -diff --git a/arch/arm64/boot/dts/amlogic/meson-g12b-a311d.dtsi b/arch/arm64/boot/dts/amlogic/meson-g12b-a311d.dtsi -index d61f43052a344..8e9ad1e51d665 100644 ---- a/arch/arm64/boot/dts/amlogic/meson-g12b-a311d.dtsi -+++ b/arch/arm64/boot/dts/amlogic/meson-g12b-a311d.dtsi -@@ -11,26 +11,6 @@ - compatible = "operating-points-v2"; - opp-shared; - -- opp-100000000 { -- opp-hz = /bits/ 64 <100000000>; -- opp-microvolt = <731000>; -- }; -- -- opp-250000000 { -- opp-hz = /bits/ 64 <250000000>; -- opp-microvolt = <731000>; -- }; -- -- opp-500000000 { -- opp-hz = /bits/ 64 <500000000>; -- opp-microvolt = <731000>; -- }; -- -- opp-667000000 { -- opp-hz = /bits/ 64 <667000000>; -- opp-microvolt = <731000>; -- }; -- - opp-1000000000 { - opp-hz = /bits/ 64 <1000000000>; - opp-microvolt = <761000>; -@@ -71,26 +51,6 @@ - compatible = "operating-points-v2"; - opp-shared; - -- opp-100000000 { -- opp-hz = /bits/ 64 <100000000>; -- opp-microvolt = <731000>; -- }; -- -- opp-250000000 { -- opp-hz = /bits/ 64 <250000000>; -- opp-microvolt = <731000>; -- }; -- -- opp-500000000 { -- opp-hz = /bits/ 64 <500000000>; -- opp-microvolt = <731000>; -- }; -- -- opp-667000000 { -- opp-hz = /bits/ 64 <667000000>; -- opp-microvolt = <731000>; -- }; -- - opp-1000000000 { - opp-hz = /bits/ 64 <1000000000>; - opp-microvolt = <731000>; -diff --git a/arch/arm64/boot/dts/amlogic/meson-g12b-s922x.dtsi b/arch/arm64/boot/dts/amlogic/meson-g12b-s922x.dtsi -index 046cc332d07f9..f2543da63c39d 100644 ---- a/arch/arm64/boot/dts/amlogic/meson-g12b-s922x.dtsi -+++ b/arch/arm64/boot/dts/amlogic/meson-g12b-s922x.dtsi -@@ -11,26 +11,6 @@ - compatible = "operating-points-v2"; - opp-shared; - -- opp-100000000 { -- opp-hz = /bits/ 64 <100000000>; -- opp-microvolt = <731000>; -- }; -- -- opp-250000000 { -- opp-hz = /bits/ 64 <250000000>; -- opp-microvolt = <731000>; -- }; -- -- opp-500000000 { -- opp-hz = /bits/ 64 <500000000>; -- opp-microvolt = <731000>; -- }; -- -- opp-667000000 { -- opp-hz = /bits/ 64 <667000000>; -- opp-microvolt = <731000>; -- }; -- - opp-1000000000 { - opp-hz = /bits/ 64 <1000000000>; - opp-microvolt = <731000>; -@@ -71,26 +51,6 @@ - compatible = "operating-points-v2"; - opp-shared; - -- opp-100000000 { -- opp-hz = /bits/ 64 <100000000>; -- opp-microvolt = <751000>; -- }; -- -- opp-250000000 { -- opp-hz = /bits/ 64 <250000000>; -- opp-microvolt = <751000>; -- }; -- -- opp-500000000 { -- opp-hz = /bits/ 64 <500000000>; -- opp-microvolt = <751000>; -- }; -- -- opp-667000000 { -- opp-hz = /bits/ 64 <667000000>; -- opp-microvolt = <751000>; -- }; -- - opp-1000000000 { - opp-hz = /bits/ 64 <1000000000>; - opp-microvolt = <771000>; -diff --git a/arch/arm64/boot/dts/amlogic/meson-sm1.dtsi b/arch/arm64/boot/dts/amlogic/meson-sm1.dtsi -index 8ba3555ca3693..dd62a608c805a 100644 ---- a/arch/arm64/boot/dts/amlogic/meson-sm1.dtsi -+++ b/arch/arm64/boot/dts/amlogic/meson-sm1.dtsi -@@ -55,26 +55,6 @@ - compatible = "operating-points-v2"; - opp-shared; - -- opp-100000000 { -- opp-hz = /bits/ 64 <100000000>; -- opp-microvolt = <730000>; -- }; -- -- opp-250000000 { -- opp-hz = /bits/ 64 <250000000>; -- opp-microvolt = <730000>; -- }; -- -- opp-500000000 { -- opp-hz = /bits/ 64 <500000000>; -- opp-microvolt = <730000>; -- }; -- -- opp-667000000 { -- opp-hz = /bits/ 64 <666666666>; -- opp-microvolt = <750000>; -- }; -- - opp-1000000000 { - opp-hz = /bits/ 64 <1000000000>; - opp-microvolt = <770000>; -diff --git a/arch/arm64/boot/dts/freescale/imx8mn-ddr4-evk.dts b/arch/arm64/boot/dts/freescale/imx8mn-ddr4-evk.dts -index 9ad1d43b8ce75..4fa39654b695d 100644 ---- a/arch/arm64/boot/dts/freescale/imx8mn-ddr4-evk.dts -+++ b/arch/arm64/boot/dts/freescale/imx8mn-ddr4-evk.dts -@@ -213,6 +213,10 @@ - interrupts = <3 GPIO_ACTIVE_LOW>; - rohm,reset-snvs-powered; - -+ #clock-cells = <0>; -+ clocks = <&osc_32k 0>; -+ clock-output-names = "clk-32k-out"; -+ - regulators { - buck1_reg: BUCK1 { - regulator-name = "BUCK1"; -diff --git a/arch/x86/include/asm/microcode.h b/arch/x86/include/asm/microcode.h -index 2b7cc5397f80d..91a06cef50c1b 100644 ---- a/arch/x86/include/asm/microcode.h -+++ b/arch/x86/include/asm/microcode.h -@@ -133,11 +133,13 @@ extern void load_ucode_ap(void); - void reload_early_microcode(void); - extern bool get_builtin_firmware(struct cpio_data *cd, const char *name); - extern bool initrd_gone; -+void microcode_bsp_resume(void); - #else - static inline int __init microcode_init(void) { return 0; }; - static inline void __init load_ucode_bsp(void) { } - static inline void load_ucode_ap(void) { } - static inline void reload_early_microcode(void) { } -+static inline void microcode_bsp_resume(void) { } - static inline bool - get_builtin_firmware(struct cpio_data *cd, const char *name) { return false; } - #endif -diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c -index 4a4198b806b4e..c95a27513a30c 100644 ---- a/arch/x86/kernel/cpu/microcode/core.c -+++ b/arch/x86/kernel/cpu/microcode/core.c -@@ -772,9 +772,9 @@ static struct subsys_interface mc_cpu_interface = { - }; - - /** -- * mc_bp_resume - Update boot CPU microcode during resume. -+ * microcode_bsp_resume - Update boot CPU microcode during resume. - */ --static void mc_bp_resume(void) -+void microcode_bsp_resume(void) - { - int cpu = smp_processor_id(); - struct ucode_cpu_info *uci = ucode_cpu_info + cpu; -@@ -786,7 +786,7 @@ static void mc_bp_resume(void) - } - - static struct syscore_ops mc_syscore_ops = { -- .resume = mc_bp_resume, -+ .resume = microcode_bsp_resume, - }; - - static int mc_cpu_starting(unsigned int cpu) -diff --git a/arch/x86/lib/usercopy_64.c b/arch/x86/lib/usercopy_64.c -index 1847e993ac63a..f3f7f4cb15a6b 100644 ---- a/arch/x86/lib/usercopy_64.c -+++ b/arch/x86/lib/usercopy_64.c -@@ -142,7 +142,7 @@ void __memcpy_flushcache(void *_dst, const void *_src, size_t size) - - /* cache copy and flush to align dest */ - if (!IS_ALIGNED(dest, 8)) { -- unsigned len = min_t(unsigned, size, ALIGN(dest, 8) - dest); -+ size_t len = min_t(size_t, size, ALIGN(dest, 8) - dest); - - memcpy((void *) dest, (void *) source, len); - clean_cache_range((void *) dest, len); -diff --git a/arch/x86/power/cpu.c b/arch/x86/power/cpu.c -index 1bff0f68f0273..20dd7023132fb 100644 ---- a/arch/x86/power/cpu.c -+++ b/arch/x86/power/cpu.c -@@ -25,6 +25,7 @@ - #include - #include - #include -+#include - - #ifdef CONFIG_X86_32 - __visible unsigned long saved_context_ebx; -@@ -263,6 +264,13 @@ static void notrace __restore_processor_state(struct saved_context *ctxt) - x86_platform.restore_sched_clock_state(); - mtrr_bp_restore(); - perf_restore_debug_store(); -+ -+ microcode_bsp_resume(); -+ -+ /* -+ * This needs to happen after the microcode has been updated upon resume -+ * because some of the MSRs are "emulated" in microcode. -+ */ - msr_restore_context(ctxt); - } - -diff --git a/drivers/base/arch_topology.c b/drivers/base/arch_topology.c -index d5f64018044b0..503404f3280e3 100644 ---- a/drivers/base/arch_topology.c -+++ b/drivers/base/arch_topology.c -@@ -457,7 +457,7 @@ void update_siblings_masks(unsigned int cpuid) - for_each_online_cpu(cpu) { - cpu_topo = &cpu_topology[cpu]; - -- if (cpuid_topo->llc_id == cpu_topo->llc_id) { -+ if (cpu_topo->llc_id != -1 && cpuid_topo->llc_id == cpu_topo->llc_id) { - cpumask_set_cpu(cpu, &cpuid_topo->llc_sibling); - cpumask_set_cpu(cpuid, &cpu_topo->llc_sibling); - } -diff --git a/drivers/block/Kconfig b/drivers/block/Kconfig -index 9f6782329a237..8a08cbb958d12 100644 ---- a/drivers/block/Kconfig -+++ b/drivers/block/Kconfig -@@ -39,6 +39,22 @@ config BLK_DEV_FD - To compile this driver as a module, choose M here: the - module will be called floppy. - -+config BLK_DEV_FD_RAWCMD -+ bool "Support for raw floppy disk commands (DEPRECATED)" -+ depends on BLK_DEV_FD -+ help -+ If you want to use actual physical floppies and expect to do -+ special low-level hardware accesses to them (access and use -+ non-standard formats, for example), then enable this. -+ -+ Note that the code enabled by this option is rarely used and -+ might be unstable or insecure, and distros should not enable it. -+ -+ Note: FDRAWCMD is deprecated and will be removed from the kernel -+ in the near future. -+ -+ If unsure, say N. -+ - config AMIGA_FLOPPY - tristate "Amiga floppy support" - depends on AMIGA -diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c -index 02af4f109e59f..f24e3791e8400 100644 ---- a/drivers/block/floppy.c -+++ b/drivers/block/floppy.c -@@ -3012,6 +3012,8 @@ static const char *drive_name(int type, int drive) - return "(null)"; - } - -+#ifdef CONFIG_BLK_DEV_FD_RAWCMD -+ - /* raw commands */ - static void raw_cmd_done(int flag) - { -@@ -3223,6 +3225,35 @@ static int raw_cmd_ioctl(int cmd, void __user *param) - return ret; - } - -+static int floppy_raw_cmd_ioctl(int type, int drive, int cmd, -+ void __user *param) -+{ -+ int ret; -+ -+ pr_warn_once("Note: FDRAWCMD is deprecated and will be removed from the kernel in the near future.\n"); -+ -+ if (type) -+ return -EINVAL; -+ if (lock_fdc(drive)) -+ return -EINTR; -+ set_floppy(drive); -+ ret = raw_cmd_ioctl(cmd, param); -+ if (ret == -EINTR) -+ return -EINTR; -+ process_fd_request(); -+ return ret; -+} -+ -+#else /* CONFIG_BLK_DEV_FD_RAWCMD */ -+ -+static int floppy_raw_cmd_ioctl(int type, int drive, int cmd, -+ void __user *param) -+{ -+ return -EOPNOTSUPP; -+} -+ -+#endif -+ - static int invalidate_drive(struct block_device *bdev) - { - /* invalidate the buffer track to force a reread */ -@@ -3410,7 +3441,6 @@ static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int - { - int drive = (long)bdev->bd_disk->private_data; - int type = ITYPE(UDRS->fd_device); -- int i; - int ret; - int size; - union inparam { -@@ -3561,16 +3591,7 @@ static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int - outparam = UDRWE; - break; - case FDRAWCMD: -- if (type) -- return -EINVAL; -- if (lock_fdc(drive)) -- return -EINTR; -- set_floppy(drive); -- i = raw_cmd_ioctl(cmd, (void __user *)param); -- if (i == -EINTR) -- return -EINTR; -- process_fd_request(); -- return i; -+ return floppy_raw_cmd_ioctl(type, drive, cmd, (void __user *)param); - case FDTWADDLE: - if (lock_fdc(drive)) - return -EINTR; -diff --git a/drivers/bus/sunxi-rsb.c b/drivers/bus/sunxi-rsb.c -index 1bb00a959c67f..9b1a5e62417cb 100644 ---- a/drivers/bus/sunxi-rsb.c -+++ b/drivers/bus/sunxi-rsb.c -@@ -224,6 +224,8 @@ static struct sunxi_rsb_device *sunxi_rsb_device_create(struct sunxi_rsb *rsb, - - dev_dbg(&rdev->dev, "device %s registered\n", dev_name(&rdev->dev)); - -+ return rdev; -+ - err_device_add: - put_device(&rdev->dev); - -diff --git a/drivers/clk/sunxi/clk-sun9i-mmc.c b/drivers/clk/sunxi/clk-sun9i-mmc.c -index 542b31d6e96dd..636bcf2439ef2 100644 ---- a/drivers/clk/sunxi/clk-sun9i-mmc.c -+++ b/drivers/clk/sunxi/clk-sun9i-mmc.c -@@ -109,6 +109,8 @@ static int sun9i_a80_mmc_config_clk_probe(struct platform_device *pdev) - spin_lock_init(&data->lock); - - r = platform_get_resource(pdev, IORESOURCE_MEM, 0); -+ if (!r) -+ return -EINVAL; - /* one clock/reset pair per word */ - count = DIV_ROUND_UP((resource_size(r)), SUN9I_MMC_WIDTH); - data->membase = devm_ioremap_resource(&pdev->dev, r); -diff --git a/drivers/cpufreq/sun50i-cpufreq-nvmem.c b/drivers/cpufreq/sun50i-cpufreq-nvmem.c -index 2deed8d8773fa..75e1bf3a08f7c 100644 ---- a/drivers/cpufreq/sun50i-cpufreq-nvmem.c -+++ b/drivers/cpufreq/sun50i-cpufreq-nvmem.c -@@ -98,8 +98,10 @@ static int sun50i_cpufreq_nvmem_probe(struct platform_device *pdev) - return -ENOMEM; - - ret = sun50i_cpufreq_get_efuse(&speed); -- if (ret) -+ if (ret) { -+ kfree(opp_tables); - return ret; -+ } - - snprintf(name, MAX_NAME_LEN, "speed%d", speed); - -diff --git a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c -index 11a4c4029a902..acc2c307c871b 100644 ---- a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c -+++ b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c -@@ -1140,6 +1140,7 @@ static struct clock_source *dcn21_clock_source_create( - return &clk_src->base; - } - -+ kfree(clk_src); - BREAK_TO_DEBUGGER(); - return NULL; - } -diff --git a/drivers/iio/dac/ad5446.c b/drivers/iio/dac/ad5446.c -index 1f55cd8abb558..5fbda0431d6ab 100644 ---- a/drivers/iio/dac/ad5446.c -+++ b/drivers/iio/dac/ad5446.c -@@ -170,7 +170,7 @@ static int ad5446_read_raw(struct iio_dev *indio_dev, - - switch (m) { - case IIO_CHAN_INFO_RAW: -- *val = st->cached_val; -+ *val = st->cached_val >> chan->scan_type.shift; - return IIO_VAL_INT; - case IIO_CHAN_INFO_SCALE: - *val = st->vref_mv; -diff --git a/drivers/iio/dac/ad5592r-base.c b/drivers/iio/dac/ad5592r-base.c -index 424922cad1e39..87a51a85a642d 100644 ---- a/drivers/iio/dac/ad5592r-base.c -+++ b/drivers/iio/dac/ad5592r-base.c -@@ -530,7 +530,7 @@ static int ad5592r_alloc_channels(struct ad5592r_state *st) - if (!ret) - st->channel_modes[reg] = tmp; - -- fwnode_property_read_u32(child, "adi,off-state", &tmp); -+ ret = fwnode_property_read_u32(child, "adi,off-state", &tmp); - if (!ret) - st->channel_offstate[reg] = tmp; - } -diff --git a/drivers/iio/magnetometer/ak8975.c b/drivers/iio/magnetometer/ak8975.c -index 82af903a765b2..c54eed3f4edce 100644 ---- a/drivers/iio/magnetometer/ak8975.c -+++ b/drivers/iio/magnetometer/ak8975.c -@@ -391,6 +391,7 @@ static int ak8975_power_on(const struct ak8975_data *data) - if (ret) { - dev_warn(&data->client->dev, - "Failed to enable specified Vid supply\n"); -+ regulator_disable(data->vdd); - return ret; - } - /* -diff --git a/drivers/lightnvm/Kconfig b/drivers/lightnvm/Kconfig -index 4c2ce210c1237..95b09148167e8 100644 ---- a/drivers/lightnvm/Kconfig -+++ b/drivers/lightnvm/Kconfig -@@ -5,7 +5,7 @@ - - menuconfig NVM - bool "Open-Channel SSD target support" -- depends on BLOCK -+ depends on BLOCK && BROKEN - help - Say Y here to get to enable Open-channel SSDs. - -diff --git a/drivers/mtd/nand/raw/mtk_ecc.c b/drivers/mtd/nand/raw/mtk_ecc.c -index 74595b644b7cd..57fa7807cd7d3 100644 ---- a/drivers/mtd/nand/raw/mtk_ecc.c -+++ b/drivers/mtd/nand/raw/mtk_ecc.c -@@ -43,6 +43,7 @@ - - struct mtk_ecc_caps { - u32 err_mask; -+ u32 err_shift; - const u8 *ecc_strength; - const u32 *ecc_regs; - u8 num_ecc_strength; -@@ -76,7 +77,7 @@ static const u8 ecc_strength_mt2712[] = { - }; - - static const u8 ecc_strength_mt7622[] = { -- 4, 6, 8, 10, 12, 14, 16 -+ 4, 6, 8, 10, 12 - }; - - enum mtk_ecc_regs { -@@ -221,7 +222,7 @@ void mtk_ecc_get_stats(struct mtk_ecc *ecc, struct mtk_ecc_stats *stats, - for (i = 0; i < sectors; i++) { - offset = (i >> 2) << 2; - err = readl(ecc->regs + ECC_DECENUM0 + offset); -- err = err >> ((i % 4) * 8); -+ err = err >> ((i % 4) * ecc->caps->err_shift); - err &= ecc->caps->err_mask; - if (err == ecc->caps->err_mask) { - /* uncorrectable errors */ -@@ -449,6 +450,7 @@ EXPORT_SYMBOL(mtk_ecc_get_parity_bits); - - static const struct mtk_ecc_caps mtk_ecc_caps_mt2701 = { - .err_mask = 0x3f, -+ .err_shift = 8, - .ecc_strength = ecc_strength_mt2701, - .ecc_regs = mt2701_ecc_regs, - .num_ecc_strength = 20, -@@ -459,6 +461,7 @@ static const struct mtk_ecc_caps mtk_ecc_caps_mt2701 = { - - static const struct mtk_ecc_caps mtk_ecc_caps_mt2712 = { - .err_mask = 0x7f, -+ .err_shift = 8, - .ecc_strength = ecc_strength_mt2712, - .ecc_regs = mt2712_ecc_regs, - .num_ecc_strength = 23, -@@ -468,10 +471,11 @@ static const struct mtk_ecc_caps mtk_ecc_caps_mt2712 = { - }; - - static const struct mtk_ecc_caps mtk_ecc_caps_mt7622 = { -- .err_mask = 0x3f, -+ .err_mask = 0x1f, -+ .err_shift = 5, - .ecc_strength = ecc_strength_mt7622, - .ecc_regs = mt7622_ecc_regs, -- .num_ecc_strength = 7, -+ .num_ecc_strength = 5, - .ecc_mode_shift = 4, - .parity_bits = 13, - .pg_irq_sel = 0, -diff --git a/drivers/mtd/nand/raw/sh_flctl.c b/drivers/mtd/nand/raw/sh_flctl.c -index e509c93737c4f..f0e2f2d652829 100644 ---- a/drivers/mtd/nand/raw/sh_flctl.c -+++ b/drivers/mtd/nand/raw/sh_flctl.c -@@ -384,7 +384,8 @@ static int flctl_dma_fifo0_transfer(struct sh_flctl *flctl, unsigned long *buf, - dma_addr_t dma_addr; - dma_cookie_t cookie; - uint32_t reg; -- int ret; -+ int ret = 0; -+ unsigned long time_left; - - if (dir == DMA_FROM_DEVICE) { - chan = flctl->chan_fifo0_rx; -@@ -425,13 +426,14 @@ static int flctl_dma_fifo0_transfer(struct sh_flctl *flctl, unsigned long *buf, - goto out; - } - -- ret = -+ time_left = - wait_for_completion_timeout(&flctl->dma_complete, - msecs_to_jiffies(3000)); - -- if (ret <= 0) { -+ if (time_left == 0) { - dmaengine_terminate_all(chan); - dev_err(&flctl->pdev->dev, "wait_for_completion_timeout\n"); -+ ret = -ETIMEDOUT; - } - - out: -@@ -441,7 +443,7 @@ out: - - dma_unmap_single(chan->device->dev, dma_addr, len, dir); - -- /* ret > 0 is success */ -+ /* ret == 0 is success */ - return ret; - } - -@@ -465,7 +467,7 @@ static void read_fiforeg(struct sh_flctl *flctl, int rlen, int offset) - - /* initiate DMA transfer */ - if (flctl->chan_fifo0_rx && rlen >= 32 && -- flctl_dma_fifo0_transfer(flctl, buf, rlen, DMA_FROM_DEVICE) > 0) -+ !flctl_dma_fifo0_transfer(flctl, buf, rlen, DMA_FROM_DEVICE)) - goto convert; /* DMA success */ - - /* do polling transfer */ -@@ -524,7 +526,7 @@ static void write_ec_fiforeg(struct sh_flctl *flctl, int rlen, - - /* initiate DMA transfer */ - if (flctl->chan_fifo0_tx && rlen >= 32 && -- flctl_dma_fifo0_transfer(flctl, buf, rlen, DMA_TO_DEVICE) > 0) -+ !flctl_dma_fifo0_transfer(flctl, buf, rlen, DMA_TO_DEVICE)) - return; /* DMA success */ - - /* do polling transfer */ -diff --git a/drivers/net/dsa/lantiq_gswip.c b/drivers/net/dsa/lantiq_gswip.c -index 60e36f46f8abe..0c191d395f8f3 100644 ---- a/drivers/net/dsa/lantiq_gswip.c -+++ b/drivers/net/dsa/lantiq_gswip.c -@@ -1607,9 +1607,6 @@ static void gswip_phylink_mac_config(struct dsa_switch *ds, int port, - break; - case PHY_INTERFACE_MODE_RMII: - miicfg |= GSWIP_MII_CFG_MODE_RMIIM; -- -- /* Configure the RMII clock as output: */ -- miicfg |= GSWIP_MII_CFG_RMII_CLK; - break; - case PHY_INTERFACE_MODE_RGMII: - case PHY_INTERFACE_MODE_RGMII_ID: -diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c -index cff64e43bdd80..b5f58c62e7d20 100644 ---- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c -+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c -@@ -14267,10 +14267,6 @@ static int bnx2x_eeh_nic_unload(struct bnx2x *bp) - - /* Stop Tx */ - bnx2x_tx_disable(bp); -- /* Delete all NAPI objects */ -- bnx2x_del_all_napi(bp); -- if (CNIC_LOADED(bp)) -- bnx2x_del_all_napi_cnic(bp); - netdev_reset_tc(bp->dev); - - del_timer_sync(&bp->timer); -@@ -14375,6 +14371,11 @@ static pci_ers_result_t bnx2x_io_slot_reset(struct pci_dev *pdev) - bnx2x_drain_tx_queues(bp); - bnx2x_send_unload_req(bp, UNLOAD_RECOVERY); - bnx2x_netif_stop(bp, 1); -+ bnx2x_del_all_napi(bp); -+ -+ if (CNIC_LOADED(bp)) -+ bnx2x_del_all_napi_cnic(bp); -+ - bnx2x_free_irq(bp); - - /* Report UNLOAD_DONE to MCP */ -diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c -index 2affdddc12bf6..e03e2bfcc6a10 100644 ---- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c -+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c -@@ -1547,6 +1547,11 @@ static struct sk_buff *bcmgenet_put_tx_csum(struct net_device *dev, - return skb; - } - -+static void bcmgenet_hide_tsb(struct sk_buff *skb) -+{ -+ __skb_pull(skb, sizeof(struct status_64)); -+} -+ - static netdev_tx_t bcmgenet_xmit(struct sk_buff *skb, struct net_device *dev) - { - struct bcmgenet_priv *priv = netdev_priv(dev); -@@ -1655,6 +1660,8 @@ static netdev_tx_t bcmgenet_xmit(struct sk_buff *skb, struct net_device *dev) - } - - GENET_CB(skb)->last_cb = tx_cb_ptr; -+ -+ bcmgenet_hide_tsb(skb); - skb_tx_timestamp(skb); - - /* Decrement total BD count and advance our write pointer */ -diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c -index 23a706a1765a7..410a9bf7bf0ab 100644 ---- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c -+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c -@@ -64,6 +64,13 @@ static int hclge_send_mbx_msg(struct hclge_vport *vport, u8 *msg, u16 msg_len, - enum hclge_cmd_status status; - struct hclge_desc desc; - -+ if (msg_len > HCLGE_MBX_MAX_MSG_SIZE) { -+ dev_err(&hdev->pdev->dev, -+ "msg data length(=%u) exceeds maximum(=%u)\n", -+ msg_len, HCLGE_MBX_MAX_MSG_SIZE); -+ return -EMSGSIZE; -+ } -+ - resp_pf_to_vf = (struct hclge_mbx_pf_to_vf_cmd *)desc.data; - - hclge_cmd_setup_basic_desc(&desc, HCLGEVF_OPC_MBX_PF_TO_VF, false); -diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c -index b14b164c9601f..5799b434165e0 100644 ---- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c -+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c -@@ -903,7 +903,8 @@ int ixgbe_ipsec_vf_add_sa(struct ixgbe_adapter *adapter, u32 *msgbuf, u32 vf) - /* Tx IPsec offload doesn't seem to work on this - * device, so block these requests for now. - */ -- if (!(sam->flags & XFRM_OFFLOAD_INBOUND)) { -+ sam->flags = sam->flags & ~XFRM_OFFLOAD_IPV6; -+ if (sam->flags != XFRM_OFFLOAD_INBOUND) { - err = -EOPNOTSUPP; - goto err_out; - } -diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c -index 72e47621d27c7..934c34e98d55f 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c -+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c -@@ -65,8 +65,9 @@ static void socfpga_dwmac_fix_mac_speed(void *priv, unsigned int speed) - struct phy_device *phy_dev = ndev->phydev; - u32 val; - -- writew(SGMII_ADAPTER_DISABLE, -- sgmii_adapter_base + SGMII_ADAPTER_CTRL_REG); -+ if (sgmii_adapter_base) -+ writew(SGMII_ADAPTER_DISABLE, -+ sgmii_adapter_base + SGMII_ADAPTER_CTRL_REG); - - if (splitter_base) { - val = readl(splitter_base + EMAC_SPLITTER_CTRL_REG); -@@ -88,10 +89,11 @@ static void socfpga_dwmac_fix_mac_speed(void *priv, unsigned int speed) - writel(val, splitter_base + EMAC_SPLITTER_CTRL_REG); - } - -- writew(SGMII_ADAPTER_ENABLE, -- sgmii_adapter_base + SGMII_ADAPTER_CTRL_REG); -- if (phy_dev) -+ if (phy_dev && sgmii_adapter_base) { -+ writew(SGMII_ADAPTER_ENABLE, -+ sgmii_adapter_base + SGMII_ADAPTER_CTRL_REG); - tse_pcs_fix_mac_speed(&dwmac->pcs, phy_dev, speed); -+ } - } - - static int socfpga_dwmac_parse_data(struct socfpga_dwmac *dwmac, struct device *dev) -diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c -index 02d6f3ad9aca8..83dc1c2c3b84b 100644 ---- a/drivers/net/hamradio/6pack.c -+++ b/drivers/net/hamradio/6pack.c -@@ -311,7 +311,6 @@ static void sp_setup(struct net_device *dev) - { - /* Finish setting up the DEVICE info. */ - dev->netdev_ops = &sp_netdev_ops; -- dev->needs_free_netdev = true; - dev->mtu = SIXP_MTU; - dev->hard_header_len = AX25_MAX_HEADER_LEN; - dev->header_ops = &ax25_header_ops; -@@ -679,9 +678,11 @@ static void sixpack_close(struct tty_struct *tty) - del_timer_sync(&sp->tx_t); - del_timer_sync(&sp->resync_t); - -- /* Free all 6pack frame buffers. */ -+ /* Free all 6pack frame buffers after unreg. */ - kfree(sp->rbuff); - kfree(sp->xbuff); -+ -+ free_netdev(sp->dev); - } - - /* Perform I/O control on an active 6pack channel. */ -diff --git a/drivers/net/hippi/rrunner.c b/drivers/net/hippi/rrunner.c -index a4b3fce69ecd9..6016e182f0089 100644 ---- a/drivers/net/hippi/rrunner.c -+++ b/drivers/net/hippi/rrunner.c -@@ -1346,7 +1346,9 @@ static int rr_close(struct net_device *dev) - - rrpriv->fw_running = 0; - -+ spin_unlock_irqrestore(&rrpriv->lock, flags); - del_timer_sync(&rrpriv->timer); -+ spin_lock_irqsave(&rrpriv->lock, flags); - - writel(0, ®s->TxPi); - writel(0, ®s->IpRxPi); -diff --git a/drivers/phy/motorola/phy-mapphone-mdm6600.c b/drivers/phy/motorola/phy-mapphone-mdm6600.c -index 94a34cf75eb39..39d13f7e4cf33 100644 ---- a/drivers/phy/motorola/phy-mapphone-mdm6600.c -+++ b/drivers/phy/motorola/phy-mapphone-mdm6600.c -@@ -628,7 +628,8 @@ idle: - cleanup: - if (error < 0) - phy_mdm6600_device_power_off(ddata); -- -+ pm_runtime_disable(ddata->dev); -+ pm_runtime_dont_use_autosuspend(ddata->dev); - return error; - } - -diff --git a/drivers/phy/samsung/phy-exynos5250-sata.c b/drivers/phy/samsung/phy-exynos5250-sata.c -index 4dd7324d91b26..ea46576404b8e 100644 ---- a/drivers/phy/samsung/phy-exynos5250-sata.c -+++ b/drivers/phy/samsung/phy-exynos5250-sata.c -@@ -190,6 +190,7 @@ static int exynos_sata_phy_probe(struct platform_device *pdev) - return -EINVAL; - - sata_phy->client = of_find_i2c_device_by_node(node); -+ of_node_put(node); - if (!sata_phy->client) - return -EPROBE_DEFER; - -@@ -198,20 +199,21 @@ static int exynos_sata_phy_probe(struct platform_device *pdev) - sata_phy->phyclk = devm_clk_get(dev, "sata_phyctrl"); - if (IS_ERR(sata_phy->phyclk)) { - dev_err(dev, "failed to get clk for PHY\n"); -- return PTR_ERR(sata_phy->phyclk); -+ ret = PTR_ERR(sata_phy->phyclk); -+ goto put_dev; - } - - ret = clk_prepare_enable(sata_phy->phyclk); - if (ret < 0) { - dev_err(dev, "failed to enable source clk\n"); -- return ret; -+ goto put_dev; - } - - sata_phy->phy = devm_phy_create(dev, NULL, &exynos_sata_phy_ops); - if (IS_ERR(sata_phy->phy)) { -- clk_disable_unprepare(sata_phy->phyclk); - dev_err(dev, "failed to create PHY\n"); -- return PTR_ERR(sata_phy->phy); -+ ret = PTR_ERR(sata_phy->phy); -+ goto clk_disable; - } - - phy_set_drvdata(sata_phy->phy, sata_phy); -@@ -219,11 +221,18 @@ static int exynos_sata_phy_probe(struct platform_device *pdev) - phy_provider = devm_of_phy_provider_register(dev, - of_phy_simple_xlate); - if (IS_ERR(phy_provider)) { -- clk_disable_unprepare(sata_phy->phyclk); -- return PTR_ERR(phy_provider); -+ ret = PTR_ERR(phy_provider); -+ goto clk_disable; - } - - return 0; -+ -+clk_disable: -+ clk_disable_unprepare(sata_phy->phyclk); -+put_dev: -+ put_device(&sata_phy->client->dev); -+ -+ return ret; - } - - static const struct of_device_id exynos_sata_phy_of_match[] = { -diff --git a/drivers/phy/ti/phy-am654-serdes.c b/drivers/phy/ti/phy-am654-serdes.c -index 6ef12017ff4e8..96e3426f9293b 100644 ---- a/drivers/phy/ti/phy-am654-serdes.c -+++ b/drivers/phy/ti/phy-am654-serdes.c -@@ -641,7 +641,7 @@ static int serdes_am654_probe(struct platform_device *pdev) - - clk_err: - of_clk_del_provider(node); -- -+ pm_runtime_disable(dev); - return ret; - } - -diff --git a/drivers/phy/ti/phy-omap-usb2.c b/drivers/phy/ti/phy-omap-usb2.c -index 3d74629d7423c..471fe2e80f4ea 100644 ---- a/drivers/phy/ti/phy-omap-usb2.c -+++ b/drivers/phy/ti/phy-omap-usb2.c -@@ -157,7 +157,7 @@ static int omap_usb2_enable_clocks(struct omap_usb *phy) - return 0; - - err1: -- clk_disable(phy->wkupclk); -+ clk_disable_unprepare(phy->wkupclk); - - err0: - return ret; -diff --git a/drivers/pinctrl/pinctrl-pistachio.c b/drivers/pinctrl/pinctrl-pistachio.c -index 379e9a6a6d894..5f381e4c75779 100644 ---- a/drivers/pinctrl/pinctrl-pistachio.c -+++ b/drivers/pinctrl/pinctrl-pistachio.c -@@ -1370,10 +1370,10 @@ static int pistachio_gpio_register(struct pistachio_pinctrl *pctl) - } - - irq = irq_of_parse_and_map(child, 0); -- if (irq < 0) { -- dev_err(pctl->dev, "No IRQ for bank %u: %d\n", i, irq); -+ if (!irq) { -+ dev_err(pctl->dev, "No IRQ for bank %u\n", i); - of_node_put(child); -- ret = irq; -+ ret = -EINVAL; - goto err; - } - -diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c -index f4fe73ce57108..c38f06139ccfa 100644 ---- a/drivers/tty/n_gsm.c -+++ b/drivers/tty/n_gsm.c -@@ -72,6 +72,8 @@ module_param(debug, int, 0600); - */ - #define MAX_MRU 1500 - #define MAX_MTU 1500 -+/* SOF, ADDR, CTRL, LEN1, LEN2, ..., FCS, EOF */ -+#define PROT_OVERHEAD 7 - #define GSM_NET_TX_TIMEOUT (HZ*10) - - /** -@@ -823,7 +825,7 @@ static int gsm_dlci_data_output(struct gsm_mux *gsm, struct gsm_dlci *dlci) - break; - case 2: /* Unstructed with modem bits. - Always one byte as we never send inline break data */ -- *dp++ = gsm_encode_modem(dlci); -+ *dp++ = (gsm_encode_modem(dlci) << 1) | EA; - break; - } - WARN_ON(kfifo_out_locked(dlci->fifo, dp , len, &dlci->lock) != len); -@@ -1300,11 +1302,12 @@ static void gsm_control_response(struct gsm_mux *gsm, unsigned int command, - - static void gsm_control_transmit(struct gsm_mux *gsm, struct gsm_control *ctrl) - { -- struct gsm_msg *msg = gsm_data_alloc(gsm, 0, ctrl->len + 1, gsm->ftype); -+ struct gsm_msg *msg = gsm_data_alloc(gsm, 0, ctrl->len + 2, gsm->ftype); - if (msg == NULL) - return; -- msg->data[0] = (ctrl->cmd << 1) | 2 | EA; /* command */ -- memcpy(msg->data + 1, ctrl->data, ctrl->len); -+ msg->data[0] = (ctrl->cmd << 1) | CR | EA; /* command */ -+ msg->data[1] = (ctrl->len << 1) | EA; -+ memcpy(msg->data + 2, ctrl->data, ctrl->len); - gsm_data_queue(gsm->dlci[0], msg); - } - -@@ -1327,7 +1330,6 @@ static void gsm_control_retransmit(struct timer_list *t) - spin_lock_irqsave(&gsm->control_lock, flags); - ctrl = gsm->pending_cmd; - if (ctrl) { -- gsm->cretries--; - if (gsm->cretries == 0) { - gsm->pending_cmd = NULL; - ctrl->error = -ETIMEDOUT; -@@ -1336,6 +1338,7 @@ static void gsm_control_retransmit(struct timer_list *t) - wake_up(&gsm->event); - return; - } -+ gsm->cretries--; - gsm_control_transmit(gsm, ctrl); - mod_timer(&gsm->t2_timer, jiffies + gsm->t2 * HZ / 100); - } -@@ -1376,7 +1379,7 @@ retry: - - /* If DLCI0 is in ADM mode skip retries, it won't respond */ - if (gsm->dlci[0]->mode == DLCI_MODE_ADM) -- gsm->cretries = 1; -+ gsm->cretries = 0; - else - gsm->cretries = gsm->n2; - -@@ -1810,7 +1813,6 @@ static void gsm_queue(struct gsm_mux *gsm) - gsm_response(gsm, address, UA); - gsm_dlci_close(dlci); - break; -- case UA: - case UA|PF: - if (cr == 0 || dlci == NULL) - break; -@@ -1961,7 +1963,8 @@ static void gsm1_receive(struct gsm_mux *gsm, unsigned char c) - } - /* Any partial frame was a runt so go back to start */ - if (gsm->state != GSM_START) { -- gsm->malformed++; -+ if (gsm->state != GSM_SEARCH) -+ gsm->malformed++; - gsm->state = GSM_START; - } - /* A SOF in GSM_START means we are still reading idling or -@@ -2098,6 +2101,7 @@ static void gsm_cleanup_mux(struct gsm_mux *gsm) - gsm_dlci_release(gsm->dlci[i]); - mutex_unlock(&gsm->mutex); - /* Now wipe the queues */ -+ tty_ldisc_flush(gsm->tty); - list_for_each_entry_safe(txq, ntxq, &gsm->tx_list, list) - kfree(txq); - INIT_LIST_HEAD(&gsm->tx_list); -@@ -2208,7 +2212,7 @@ static struct gsm_mux *gsm_alloc_mux(void) - kfree(gsm); - return NULL; - } -- gsm->txframe = kmalloc(2 * MAX_MRU + 2, GFP_KERNEL); -+ gsm->txframe = kmalloc(2 * (MAX_MTU + PROT_OVERHEAD - 1), GFP_KERNEL); - if (gsm->txframe == NULL) { - kfree(gsm->buf); - kfree(gsm); -@@ -2264,7 +2268,7 @@ static int gsm_config(struct gsm_mux *gsm, struct gsm_config *c) - /* Check the MRU/MTU range looks sane */ - if (c->mru > MAX_MRU || c->mtu > MAX_MTU || c->mru < 8 || c->mtu < 8) - return -EINVAL; -- if (c->n2 < 3) -+ if (c->n2 > 255) - return -EINVAL; - if (c->encapsulation > 1) /* Basic, advanced, no I */ - return -EINVAL; -@@ -2879,19 +2883,17 @@ static struct tty_ldisc_ops tty_ldisc_packet = { - - static int gsmtty_modem_update(struct gsm_dlci *dlci, u8 brk) - { -- u8 modembits[5]; -+ u8 modembits[3]; - struct gsm_control *ctrl; - int len = 2; - -- if (brk) -+ modembits[0] = (dlci->addr << 2) | 2 | EA; /* DLCI, Valid, EA */ -+ modembits[1] = (gsm_encode_modem(dlci) << 1) | EA; -+ if (brk) { -+ modembits[2] = (brk << 4) | 2 | EA; /* Length, Break, EA */ - len++; -- -- modembits[0] = len << 1 | EA; /* Data bytes */ -- modembits[1] = dlci->addr << 2 | 3; /* DLCI, EA, 1 */ -- modembits[2] = gsm_encode_modem(dlci) << 1 | EA; -- if (brk) -- modembits[3] = brk << 4 | 2 | EA; /* Valid, EA */ -- ctrl = gsm_control_send(dlci->gsm, CMD_MSC, modembits, len + 1); -+ } -+ ctrl = gsm_control_send(dlci->gsm, CMD_MSC, modembits, len); - if (ctrl == NULL) - return -ENOMEM; - return gsm_control_wait(dlci->gsm, ctrl); -diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c -index fd443bc4c2983..92e2ee2785239 100644 ---- a/drivers/tty/serial/8250/8250_pci.c -+++ b/drivers/tty/serial/8250/8250_pci.c -@@ -2907,7 +2907,7 @@ enum pci_board_num_t { - pbn_panacom2, - pbn_panacom4, - pbn_plx_romulus, -- pbn_endrun_2_4000000, -+ pbn_endrun_2_3906250, - pbn_oxsemi, - pbn_oxsemi_1_4000000, - pbn_oxsemi_2_4000000, -@@ -3434,10 +3434,10 @@ static struct pciserial_board pci_boards[] = { - * signal now many ports are available - * 2 port 952 Uart support - */ -- [pbn_endrun_2_4000000] = { -+ [pbn_endrun_2_3906250] = { - .flags = FL_BASE0, - .num_ports = 2, -- .base_baud = 4000000, -+ .base_baud = 3906250, - .uart_offset = 0x200, - .first_offset = 0x1000, - }, -@@ -4345,7 +4345,7 @@ static const struct pci_device_id serial_pci_tbl[] = { - */ - { PCI_VENDOR_ID_ENDRUN, PCI_DEVICE_ID_ENDRUN_1588, - PCI_ANY_ID, PCI_ANY_ID, 0, 0, -- pbn_endrun_2_4000000 }, -+ pbn_endrun_2_3906250 }, - /* - * Quatech cards. These actually have configurable clocks but for - * now we just use the default. -diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c -index 87567515591e1..c1891c55897ad 100644 ---- a/drivers/tty/serial/8250/8250_port.c -+++ b/drivers/tty/serial/8250/8250_port.c -@@ -3184,7 +3184,7 @@ static void serial8250_console_restore(struct uart_8250_port *up) - - serial8250_set_divisor(port, baud, quot, frac); - serial_port_out(port, UART_LCR, up->lcr); -- serial8250_out_MCR(up, UART_MCR_DTR | UART_MCR_RTS); -+ serial8250_out_MCR(up, up->mcr | UART_MCR_DTR | UART_MCR_RTS); - } - - /* -diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c -index e5ed4ab2b08df..8b41a783b37ee 100644 ---- a/drivers/tty/serial/imx.c -+++ b/drivers/tty/serial/imx.c -@@ -1401,7 +1401,7 @@ static int imx_uart_startup(struct uart_port *port) - imx_uart_writel(sport, ucr1, UCR1); - - ucr4 = imx_uart_readl(sport, UCR4) & ~UCR4_OREN; -- if (!sport->dma_is_enabled) -+ if (!dma_is_inited) - ucr4 |= UCR4_OREN; - imx_uart_writel(sport, ucr4, UCR4); - -diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c -index a118c44c70e1e..d5f233fa6f3b4 100644 ---- a/drivers/usb/core/quirks.c -+++ b/drivers/usb/core/quirks.c -@@ -404,6 +404,9 @@ static const struct usb_device_id usb_quirk_list[] = { - { USB_DEVICE(0x0b05, 0x17e0), .driver_info = - USB_QUIRK_IGNORE_REMOTE_WAKEUP }, - -+ /* Realtek Semiconductor Corp. Mass Storage Device (Multicard Reader)*/ -+ { USB_DEVICE(0x0bda, 0x0151), .driver_info = USB_QUIRK_CONFIG_INTF_STRINGS }, -+ - /* Realtek hub in Dell WD19 (Type-C) */ - { USB_DEVICE(0x0bda, 0x0487), .driver_info = USB_QUIRK_NO_LPM }, - { USB_DEVICE(0x0bda, 0x5487), .driver_info = USB_QUIRK_RESET_RESUME }, -@@ -508,6 +511,9 @@ static const struct usb_device_id usb_quirk_list[] = { - /* DJI CineSSD */ - { USB_DEVICE(0x2ca3, 0x0031), .driver_info = USB_QUIRK_NO_LPM }, - -+ /* VCOM device */ -+ { USB_DEVICE(0x4296, 0x7570), .driver_info = USB_QUIRK_CONFIG_INTF_STRINGS }, -+ - /* INTEL VALUE SSD */ - { USB_DEVICE(0x8086, 0xf1a5), .driver_info = USB_QUIRK_RESET_RESUME }, - -diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c -index 2c68ec60d39a3..8cc81f193e9c1 100644 ---- a/drivers/usb/dwc3/core.c -+++ b/drivers/usb/dwc3/core.c -@@ -1229,10 +1229,10 @@ static void dwc3_get_properties(struct dwc3 *dwc) - u8 lpm_nyet_threshold; - u8 tx_de_emphasis; - u8 hird_threshold; -- u8 rx_thr_num_pkt_prd; -- u8 rx_max_burst_prd; -- u8 tx_thr_num_pkt_prd; -- u8 tx_max_burst_prd; -+ u8 rx_thr_num_pkt_prd = 0; -+ u8 rx_max_burst_prd = 0; -+ u8 tx_thr_num_pkt_prd = 0; -+ u8 tx_max_burst_prd = 0; - - /* default to highest possible threshold */ - lpm_nyet_threshold = 0xf; -diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c -index a1d8cb69d229d..18a53a3dfac6c 100644 ---- a/drivers/usb/dwc3/gadget.c -+++ b/drivers/usb/dwc3/gadget.c -@@ -2728,6 +2728,7 @@ static int dwc3_gadget_ep_cleanup_completed_request(struct dwc3_ep *dep, - const struct dwc3_event_depevt *event, - struct dwc3_request *req, int status) - { -+ int request_status; - int ret; - - if (req->request.num_mapped_sgs) -@@ -2757,7 +2758,35 @@ static int dwc3_gadget_ep_cleanup_completed_request(struct dwc3_ep *dep, - req->needs_extra_trb = false; - } - -- dwc3_gadget_giveback(dep, req, status); -+ /* -+ * The event status only reflects the status of the TRB with IOC set. -+ * For the requests that don't set interrupt on completion, the driver -+ * needs to check and return the status of the completed TRBs associated -+ * with the request. Use the status of the last TRB of the request. -+ */ -+ if (req->request.no_interrupt) { -+ struct dwc3_trb *trb; -+ -+ trb = dwc3_ep_prev_trb(dep, dep->trb_dequeue); -+ switch (DWC3_TRB_SIZE_TRBSTS(trb->size)) { -+ case DWC3_TRBSTS_MISSED_ISOC: -+ /* Isoc endpoint only */ -+ request_status = -EXDEV; -+ break; -+ case DWC3_TRB_STS_XFER_IN_PROG: -+ /* Applicable when End Transfer with ForceRM=0 */ -+ case DWC3_TRBSTS_SETUP_PENDING: -+ /* Control endpoint only */ -+ case DWC3_TRBSTS_OK: -+ default: -+ request_status = 0; -+ break; -+ } -+ } else { -+ request_status = status; -+ } -+ -+ dwc3_gadget_giveback(dep, req, request_status); - - out: - return ret; -diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c -index 3d4710cc34bc1..2350e97a1662c 100644 ---- a/drivers/usb/gadget/configfs.c -+++ b/drivers/usb/gadget/configfs.c -@@ -1412,6 +1412,8 @@ static void configfs_composite_unbind(struct usb_gadget *gadget) - usb_ep_autoconfig_reset(cdev->gadget); - spin_lock_irqsave(&gi->spinlock, flags); - cdev->gadget = NULL; -+ cdev->deactivations = 0; -+ gadget->deactivated = false; - set_gadget_data(gadget, NULL); - spin_unlock_irqrestore(&gi->spinlock, flags); - } -diff --git a/drivers/usb/gadget/function/uvc_queue.c b/drivers/usb/gadget/function/uvc_queue.c -index 61e2c94cc0b0c..cab1e30462c24 100644 ---- a/drivers/usb/gadget/function/uvc_queue.c -+++ b/drivers/usb/gadget/function/uvc_queue.c -@@ -242,6 +242,8 @@ void uvcg_queue_cancel(struct uvc_video_queue *queue, int disconnect) - buf->state = UVC_BUF_STATE_ERROR; - vb2_buffer_done(&buf->buf.vb2_buf, VB2_BUF_STATE_ERROR); - } -+ queue->buf_used = 0; -+ - /* This must be protected by the irqlock spinlock to avoid race - * conditions between uvc_queue_buffer and the disconnection event that - * could result in an interruptible wait in uvc_dequeue_buffer. Do not -diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c -index db65e1ad00deb..dd46c15c4853f 100644 ---- a/drivers/usb/host/xhci-hub.c -+++ b/drivers/usb/host/xhci-hub.c -@@ -1343,7 +1343,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, - } - spin_unlock_irqrestore(&xhci->lock, flags); - if (!wait_for_completion_timeout(&bus_state->u3exit_done[wIndex], -- msecs_to_jiffies(100))) -+ msecs_to_jiffies(500))) - xhci_dbg(xhci, "missing U0 port change event for port %d\n", - wIndex); - spin_lock_irqsave(&xhci->lock, flags); -diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c -index 7fa27b4037560..6cedae902adf9 100644 ---- a/drivers/usb/host/xhci-ring.c -+++ b/drivers/usb/host/xhci-ring.c -@@ -2932,6 +2932,8 @@ irqreturn_t xhci_irq(struct usb_hcd *hcd) - if (event_loop++ < TRBS_PER_SEGMENT / 2) - continue; - xhci_update_erst_dequeue(xhci, event_ring_deq); -+ event_ring_deq = xhci->event_ring->dequeue; -+ - event_loop = 0; - } - -diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c -index 476dc6abd5a21..2f59d447411b5 100644 ---- a/drivers/usb/host/xhci.c -+++ b/drivers/usb/host/xhci.c -@@ -779,6 +779,17 @@ void xhci_shutdown(struct usb_hcd *hcd) - if (xhci->quirks & XHCI_SPURIOUS_REBOOT) - usb_disable_xhci_ports(to_pci_dev(hcd->self.sysdev)); - -+ /* Don't poll the roothubs after shutdown. */ -+ xhci_dbg(xhci, "%s: stopping usb%d port polling.\n", -+ __func__, hcd->self.busnum); -+ clear_bit(HCD_FLAG_POLL_RH, &hcd->flags); -+ del_timer_sync(&hcd->rh_timer); -+ -+ if (xhci->shared_hcd) { -+ clear_bit(HCD_FLAG_POLL_RH, &xhci->shared_hcd->flags); -+ del_timer_sync(&xhci->shared_hcd->rh_timer); -+ } -+ - spin_lock_irq(&xhci->lock); - xhci_halt(xhci); - /* Workaround for spurious wakeups at shutdown with HSW */ -diff --git a/drivers/usb/misc/uss720.c b/drivers/usb/misc/uss720.c -index 748139d262633..0be8efcda15d5 100644 ---- a/drivers/usb/misc/uss720.c -+++ b/drivers/usb/misc/uss720.c -@@ -71,6 +71,7 @@ static void destroy_priv(struct kref *kref) - - dev_dbg(&priv->usbdev->dev, "destroying priv datastructure\n"); - usb_put_dev(priv->usbdev); -+ priv->usbdev = NULL; - kfree(priv); - } - -@@ -736,7 +737,6 @@ static int uss720_probe(struct usb_interface *intf, - parport_announce_port(pp); - - usb_set_intfdata(intf, pp); -- usb_put_dev(usbdev); - return 0; - - probe_abort: -@@ -754,7 +754,6 @@ static void uss720_disconnect(struct usb_interface *intf) - usb_set_intfdata(intf, NULL); - if (pp) { - priv = pp->private_data; -- priv->usbdev = NULL; - priv->pp = NULL; - dev_dbg(&intf->dev, "parport_remove_port\n"); - parport_remove_port(pp); -diff --git a/drivers/usb/mtu3/mtu3_dr.c b/drivers/usb/mtu3/mtu3_dr.c -index 08e18448e8b82..db30365345e0f 100644 ---- a/drivers/usb/mtu3/mtu3_dr.c -+++ b/drivers/usb/mtu3/mtu3_dr.c -@@ -41,10 +41,8 @@ static char *mailbox_state_string(enum mtu3_vbus_id_state state) - - static void toggle_opstate(struct ssusb_mtk *ssusb) - { -- if (!ssusb->otg_switch.is_u3_drd) { -- mtu3_setbits(ssusb->mac_base, U3D_DEVICE_CONTROL, DC_SESSION); -- mtu3_setbits(ssusb->mac_base, U3D_POWER_MANAGEMENT, SOFT_CONN); -- } -+ mtu3_setbits(ssusb->mac_base, U3D_DEVICE_CONTROL, DC_SESSION); -+ mtu3_setbits(ssusb->mac_base, U3D_POWER_MANAGEMENT, SOFT_CONN); - } - - /* only port0 supports dual-role mode */ -diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c -index dfa7c504befe8..d5a1832aa48eb 100644 ---- a/drivers/usb/serial/cp210x.c -+++ b/drivers/usb/serial/cp210x.c -@@ -195,6 +195,8 @@ static const struct usb_device_id id_table[] = { - { USB_DEVICE(0x16DC, 0x0015) }, /* W-IE-NE-R Plein & Baus GmbH CML Control, Monitoring and Data Logger */ - { USB_DEVICE(0x17A8, 0x0001) }, /* Kamstrup Optical Eye/3-wire */ - { USB_DEVICE(0x17A8, 0x0005) }, /* Kamstrup M-Bus Master MultiPort 250D */ -+ { USB_DEVICE(0x17A8, 0x0101) }, /* Kamstrup 868 MHz wM-Bus C-Mode Meter Reader (Int Ant) */ -+ { USB_DEVICE(0x17A8, 0x0102) }, /* Kamstrup 868 MHz wM-Bus C-Mode Meter Reader (Ext Ant) */ - { USB_DEVICE(0x17F4, 0xAAAA) }, /* Wavesense Jazz blood glucose meter */ - { USB_DEVICE(0x1843, 0x0200) }, /* Vaisala USB Instrument Cable */ - { USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */ -diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c -index 839eac04b5e30..fa978412601aa 100644 ---- a/drivers/usb/serial/option.c -+++ b/drivers/usb/serial/option.c -@@ -432,6 +432,8 @@ static void option_instat_callback(struct urb *urb); - #define CINTERION_PRODUCT_CLS8 0x00b0 - #define CINTERION_PRODUCT_MV31_MBIM 0x00b3 - #define CINTERION_PRODUCT_MV31_RMNET 0x00b7 -+#define CINTERION_PRODUCT_MV32_WA 0x00f1 -+#define CINTERION_PRODUCT_MV32_WB 0x00f2 - - /* Olivetti products */ - #define OLIVETTI_VENDOR_ID 0x0b3c -@@ -1217,6 +1219,10 @@ static const struct usb_device_id option_ids[] = { - .driver_info = NCTRL(0) | RSVD(1) }, - { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1056, 0xff), /* Telit FD980 */ - .driver_info = NCTRL(2) | RSVD(3) }, -+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1057, 0xff), /* Telit FN980 */ -+ .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, -+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1058, 0xff), /* Telit FN980 (PCIe) */ -+ .driver_info = NCTRL(0) | RSVD(1) }, - { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1060, 0xff), /* Telit LN920 (rmnet) */ - .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, - { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1061, 0xff), /* Telit LN920 (MBIM) */ -@@ -1233,6 +1239,8 @@ static const struct usb_device_id option_ids[] = { - .driver_info = NCTRL(2) | RSVD(3) }, - { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1073, 0xff), /* Telit FN990 (ECM) */ - .driver_info = NCTRL(0) | RSVD(1) }, -+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1075, 0xff), /* Telit FN990 (PCIe) */ -+ .driver_info = RSVD(0) }, - { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910), - .driver_info = NCTRL(0) | RSVD(1) | RSVD(3) }, - { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM), -@@ -1969,6 +1977,10 @@ static const struct usb_device_id option_ids[] = { - .driver_info = RSVD(3)}, - { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV31_RMNET, 0xff), - .driver_info = RSVD(0)}, -+ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV32_WA, 0xff), -+ .driver_info = RSVD(3)}, -+ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV32_WB, 0xff), -+ .driver_info = RSVD(3)}, - { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100), - .driver_info = RSVD(4) }, - { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD120), -diff --git a/drivers/usb/serial/whiteheat.c b/drivers/usb/serial/whiteheat.c -index ca3bd58f2025a..5576cfa50bc80 100644 ---- a/drivers/usb/serial/whiteheat.c -+++ b/drivers/usb/serial/whiteheat.c -@@ -599,9 +599,8 @@ static int firm_send_command(struct usb_serial_port *port, __u8 command, - switch (command) { - case WHITEHEAT_GET_DTR_RTS: - info = usb_get_serial_port_data(port); -- memcpy(&info->mcr, command_info->result_buffer, -- sizeof(struct whiteheat_dr_info)); -- break; -+ info->mcr = command_info->result_buffer[0]; -+ break; - } - } - exit: -diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c -index f3934f2d3c443..0268e654cae68 100644 ---- a/drivers/usb/typec/ucsi/ucsi.c -+++ b/drivers/usb/typec/ucsi/ucsi.c -@@ -748,14 +748,18 @@ ucsi_dr_swap(const struct typec_capability *cap, enum typec_data_role role) - if (ret < 0) - goto out_unlock; - -+ mutex_unlock(&con->lock); -+ - if (!wait_for_completion_timeout(&con->complete, -- msecs_to_jiffies(UCSI_SWAP_TIMEOUT_MS))) -- ret = -ETIMEDOUT; -+ msecs_to_jiffies(UCSI_SWAP_TIMEOUT_MS))) -+ return -ETIMEDOUT; -+ -+ return 0; - - out_unlock: - mutex_unlock(&con->lock); - -- return ret < 0 ? ret : 0; -+ return ret; - } - - static int -@@ -780,11 +784,13 @@ ucsi_pr_swap(const struct typec_capability *cap, enum typec_role role) - if (ret < 0) - goto out_unlock; - -+ mutex_unlock(&con->lock); -+ - if (!wait_for_completion_timeout(&con->complete, -- msecs_to_jiffies(UCSI_SWAP_TIMEOUT_MS))) { -- ret = -ETIMEDOUT; -- goto out_unlock; -- } -+ msecs_to_jiffies(UCSI_SWAP_TIMEOUT_MS))) -+ return -ETIMEDOUT; -+ -+ mutex_lock(&con->lock); - - /* Something has gone wrong while swapping the role */ - if (con->status.pwr_op_mode != UCSI_CONSTAT_PWR_OPMODE_PD) { -diff --git a/drivers/video/fbdev/udlfb.c b/drivers/video/fbdev/udlfb.c -index e269b1391e146..8e8af408998ea 100644 ---- a/drivers/video/fbdev/udlfb.c -+++ b/drivers/video/fbdev/udlfb.c -@@ -1650,8 +1650,9 @@ static int dlfb_usb_probe(struct usb_interface *intf, - const struct device_attribute *attr; - struct dlfb_data *dlfb; - struct fb_info *info; -- int retval = -ENOMEM; -+ int retval; - struct usb_device *usbdev = interface_to_usbdev(intf); -+ struct usb_endpoint_descriptor *out; - - /* usb initialization */ - dlfb = kzalloc(sizeof(*dlfb), GFP_KERNEL); -@@ -1665,6 +1666,12 @@ static int dlfb_usb_probe(struct usb_interface *intf, - dlfb->udev = usb_get_dev(usbdev); - usb_set_intfdata(intf, dlfb); - -+ retval = usb_find_common_endpoints(intf->cur_altsetting, NULL, &out, NULL, NULL); -+ if (retval) { -+ dev_err(&intf->dev, "Device should have at lease 1 bulk endpoint!\n"); -+ goto error; -+ } -+ - dev_dbg(&intf->dev, "console enable=%d\n", console); - dev_dbg(&intf->dev, "fb_defio enable=%d\n", fb_defio); - dev_dbg(&intf->dev, "shadow enable=%d\n", shadow); -@@ -1674,6 +1681,7 @@ static int dlfb_usb_probe(struct usb_interface *intf, - if (!dlfb_parse_vendor_descriptor(dlfb, intf)) { - dev_err(&intf->dev, - "firmware not recognized, incompatible device?\n"); -+ retval = -ENODEV; - goto error; - } - -@@ -1687,8 +1695,10 @@ static int dlfb_usb_probe(struct usb_interface *intf, - - /* allocates framebuffer driver structure, not framebuffer memory */ - info = framebuffer_alloc(0, &dlfb->udev->dev); -- if (!info) -+ if (!info) { -+ retval = -ENOMEM; - goto error; -+ } - - dlfb->info = info; - info->par = dlfb; -diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c -index defee1d208d22..7985fe25850b7 100644 ---- a/fs/cifs/smb2ops.c -+++ b/fs/cifs/smb2ops.c -@@ -1643,9 +1643,17 @@ smb2_copychunk_range(const unsigned int xid, - int chunks_copied = 0; - bool chunk_sizes_updated = false; - ssize_t bytes_written, total_bytes_written = 0; -+ struct inode *inode; - - pcchunk = kmalloc(sizeof(struct copychunk_ioctl), GFP_KERNEL); - -+ /* -+ * We need to flush all unwritten data before we can send the -+ * copychunk ioctl to the server. -+ */ -+ inode = d_inode(trgtfile->dentry); -+ filemap_write_and_wait(inode->i_mapping); -+ - if (pcchunk == NULL) - return -ENOMEM; - -diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c -index 358398b1fe0c9..7d039ba5ae28b 100644 ---- a/fs/hugetlbfs/inode.c -+++ b/fs/hugetlbfs/inode.c -@@ -38,6 +38,7 @@ - #include - - #include -+#include - - static const struct super_operations hugetlbfs_ops; - static const struct address_space_operations hugetlbfs_aops; -@@ -200,6 +201,54 @@ out: - */ - - #ifndef HAVE_ARCH_HUGETLB_UNMAPPED_AREA -+static unsigned long -+hugetlb_get_unmapped_area_bottomup(struct file *file, unsigned long addr, -+ unsigned long len, unsigned long pgoff, unsigned long flags) -+{ -+ struct hstate *h = hstate_file(file); -+ struct vm_unmapped_area_info info; -+ -+ info.flags = 0; -+ info.length = len; -+ info.low_limit = current->mm->mmap_base; -+ info.high_limit = arch_get_mmap_end(addr); -+ info.align_mask = PAGE_MASK & ~huge_page_mask(h); -+ info.align_offset = 0; -+ return vm_unmapped_area(&info); -+} -+ -+static unsigned long -+hugetlb_get_unmapped_area_topdown(struct file *file, unsigned long addr, -+ unsigned long len, unsigned long pgoff, unsigned long flags) -+{ -+ struct hstate *h = hstate_file(file); -+ struct vm_unmapped_area_info info; -+ -+ info.flags = VM_UNMAPPED_AREA_TOPDOWN; -+ info.length = len; -+ info.low_limit = max(PAGE_SIZE, mmap_min_addr); -+ info.high_limit = arch_get_mmap_base(addr, current->mm->mmap_base); -+ info.align_mask = PAGE_MASK & ~huge_page_mask(h); -+ info.align_offset = 0; -+ addr = vm_unmapped_area(&info); -+ -+ /* -+ * A failed mmap() very likely causes application failure, -+ * so fall back to the bottom-up function here. This scenario -+ * can happen with large stack limits and large mmap() -+ * allocations. -+ */ -+ if (unlikely(offset_in_page(addr))) { -+ VM_BUG_ON(addr != -ENOMEM); -+ info.flags = 0; -+ info.low_limit = current->mm->mmap_base; -+ info.high_limit = arch_get_mmap_end(addr); -+ addr = vm_unmapped_area(&info); -+ } -+ -+ return addr; -+} -+ - static unsigned long - hugetlb_get_unmapped_area(struct file *file, unsigned long addr, - unsigned long len, unsigned long pgoff, unsigned long flags) -@@ -207,7 +256,7 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr, - struct mm_struct *mm = current->mm; - struct vm_area_struct *vma; - struct hstate *h = hstate_file(file); -- struct vm_unmapped_area_info info; -+ const unsigned long mmap_end = arch_get_mmap_end(addr); - - if (len & ~huge_page_mask(h)) - return -EINVAL; -@@ -223,18 +272,21 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr, - if (addr) { - addr = ALIGN(addr, huge_page_size(h)); - vma = find_vma(mm, addr); -- if (TASK_SIZE - len >= addr && -+ if (mmap_end - len >= addr && - (!vma || addr + len <= vm_start_gap(vma))) - return addr; - } - -- info.flags = 0; -- info.length = len; -- info.low_limit = TASK_UNMAPPED_BASE; -- info.high_limit = TASK_SIZE; -- info.align_mask = PAGE_MASK & ~huge_page_mask(h); -- info.align_offset = 0; -- return vm_unmapped_area(&info); -+ /* -+ * Use mm->get_unmapped_area value as a hint to use topdown routine. -+ * If architectures have special needs, they should define their own -+ * version of hugetlb_get_unmapped_area. -+ */ -+ if (mm->get_unmapped_area == arch_get_unmapped_area_topdown) -+ return hugetlb_get_unmapped_area_topdown(file, addr, len, -+ pgoff, flags); -+ return hugetlb_get_unmapped_area_bottomup(file, addr, len, -+ pgoff, flags); - } - #endif - -diff --git a/include/linux/kernel.h b/include/linux/kernel.h -index d83d403dac2ea..77c86a2236daf 100644 ---- a/include/linux/kernel.h -+++ b/include/linux/kernel.h -@@ -627,7 +627,7 @@ static inline char *hex_byte_pack_upper(char *buf, u8 byte) - return buf; - } - --extern int hex_to_bin(char ch); -+extern int hex_to_bin(unsigned char ch); - extern int __must_check hex2bin(u8 *dst, const char *src, size_t count); - extern char *bin2hex(char *dst, const void *src, size_t count); - -diff --git a/include/linux/sched/mm.h b/include/linux/sched/mm.h -index 3a1d899019af0..ab0da04ac9ee7 100644 ---- a/include/linux/sched/mm.h -+++ b/include/linux/sched/mm.h -@@ -133,6 +133,14 @@ static inline void mm_update_next_owner(struct mm_struct *mm) - #endif /* CONFIG_MEMCG */ - - #ifdef CONFIG_MMU -+#ifndef arch_get_mmap_end -+#define arch_get_mmap_end(addr) (TASK_SIZE) -+#endif -+ -+#ifndef arch_get_mmap_base -+#define arch_get_mmap_base(addr, base) (base) -+#endif -+ - extern void arch_pick_mmap_layout(struct mm_struct *mm, - struct rlimit *rlim_stack); - extern unsigned long -diff --git a/include/net/tcp.h b/include/net/tcp.h -index b914959cd2c67..9237362e56065 100644 ---- a/include/net/tcp.h -+++ b/include/net/tcp.h -@@ -603,6 +603,7 @@ void tcp_synack_rtt_meas(struct sock *sk, struct request_sock *req); - void tcp_reset(struct sock *sk); - void tcp_skb_mark_lost_uncond_verify(struct tcp_sock *tp, struct sk_buff *skb); - void tcp_fin(struct sock *sk); -+void tcp_check_space(struct sock *sk); - - /* tcp_timer.c */ - void tcp_init_xmit_timers(struct sock *); -@@ -1030,6 +1031,7 @@ struct rate_sample { - int losses; /* number of packets marked lost upon ACK */ - u32 acked_sacked; /* number of packets newly (S)ACKed upon ACK */ - u32 prior_in_flight; /* in flight before this ACK */ -+ u32 last_end_seq; /* end_seq of most recently ACKed packet */ - bool is_app_limited; /* is sample from packet with bubble in pipe? */ - bool is_retrans; /* is sample from retransmission? */ - bool is_ack_delayed; /* is this (likely) a delayed ACK? */ -@@ -1139,6 +1141,11 @@ void tcp_rate_gen(struct sock *sk, u32 delivered, u32 lost, - bool is_sack_reneg, struct rate_sample *rs); - void tcp_rate_check_app_limited(struct sock *sk); - -+static inline bool tcp_skb_sent_after(u64 t1, u64 t2, u32 seq1, u32 seq2) -+{ -+ return t1 > t2 || (t1 == t2 && after(seq1, seq2)); -+} -+ - /* These functions determine how the current flow behaves in respect of SACK - * handling. SACK is negotiated with the peer, and therefore it can vary - * between different flows. -diff --git a/lib/hexdump.c b/lib/hexdump.c -index 147133f8eb2fc..c0a08ddcf94e2 100644 ---- a/lib/hexdump.c -+++ b/lib/hexdump.c -@@ -21,15 +21,33 @@ EXPORT_SYMBOL(hex_asc_upper); - * - * hex_to_bin() converts one hex digit to its actual value or -1 in case of bad - * input. -+ * -+ * This function is used to load cryptographic keys, so it is coded in such a -+ * way that there are no conditions or memory accesses that depend on data. -+ * -+ * Explanation of the logic: -+ * (ch - '9' - 1) is negative if ch <= '9' -+ * ('0' - 1 - ch) is negative if ch >= '0' -+ * we "and" these two values, so the result is negative if ch is in the range -+ * '0' ... '9' -+ * we are only interested in the sign, so we do a shift ">> 8"; note that right -+ * shift of a negative value is implementation-defined, so we cast the -+ * value to (unsigned) before the shift --- we have 0xffffff if ch is in -+ * the range '0' ... '9', 0 otherwise -+ * we "and" this value with (ch - '0' + 1) --- we have a value 1 ... 10 if ch is -+ * in the range '0' ... '9', 0 otherwise -+ * we add this value to -1 --- we have a value 0 ... 9 if ch is in the range '0' -+ * ... '9', -1 otherwise -+ * the next line is similar to the previous one, but we need to decode both -+ * uppercase and lowercase letters, so we use (ch & 0xdf), which converts -+ * lowercase to uppercase - */ --int hex_to_bin(char ch) -+int hex_to_bin(unsigned char ch) - { -- if ((ch >= '0') && (ch <= '9')) -- return ch - '0'; -- ch = tolower(ch); -- if ((ch >= 'a') && (ch <= 'f')) -- return ch - 'a' + 10; -- return -1; -+ unsigned char cu = ch & 0xdf; -+ return -1 + -+ ((ch - '0' + 1) & (unsigned)((ch - '9' - 1) & ('0' - 1 - ch)) >> 8) + -+ ((cu - 'A' + 11) & (unsigned)((cu - 'F' - 1) & ('A' - 1 - cu)) >> 8); - } - EXPORT_SYMBOL(hex_to_bin); - -@@ -44,10 +62,13 @@ EXPORT_SYMBOL(hex_to_bin); - int hex2bin(u8 *dst, const char *src, size_t count) - { - while (count--) { -- int hi = hex_to_bin(*src++); -- int lo = hex_to_bin(*src++); -+ int hi, lo; - -- if ((hi < 0) || (lo < 0)) -+ hi = hex_to_bin(*src++); -+ if (unlikely(hi < 0)) -+ return -EINVAL; -+ lo = hex_to_bin(*src++); -+ if (unlikely(lo < 0)) - return -EINVAL; - - *dst++ = (hi << 4) | lo; -diff --git a/mm/mmap.c b/mm/mmap.c -index 58cfd5b1e0b16..88e6863677768 100644 ---- a/mm/mmap.c -+++ b/mm/mmap.c -@@ -2077,14 +2077,6 @@ found_highest: - } - - --#ifndef arch_get_mmap_end --#define arch_get_mmap_end(addr) (TASK_SIZE) --#endif -- --#ifndef arch_get_mmap_base --#define arch_get_mmap_base(addr, base) (base) --#endif -- - /* Get an address range which is currently unmapped. - * For shmat() with addr=0. - * -diff --git a/net/core/lwt_bpf.c b/net/core/lwt_bpf.c -index a5502c5aa44e7..bf270b6a99b4f 100644 ---- a/net/core/lwt_bpf.c -+++ b/net/core/lwt_bpf.c -@@ -158,10 +158,8 @@ static int bpf_output(struct net *net, struct sock *sk, struct sk_buff *skb) - return dst->lwtstate->orig_output(net, sk, skb); - } - --static int xmit_check_hhlen(struct sk_buff *skb) -+static int xmit_check_hhlen(struct sk_buff *skb, int hh_len) - { -- int hh_len = skb_dst(skb)->dev->hard_header_len; -- - if (skb_headroom(skb) < hh_len) { - int nhead = HH_DATA_ALIGN(hh_len - skb_headroom(skb)); - -@@ -273,6 +271,7 @@ static int bpf_xmit(struct sk_buff *skb) - - bpf = bpf_lwt_lwtunnel(dst->lwtstate); - if (bpf->xmit.prog) { -+ int hh_len = dst->dev->hard_header_len; - __be16 proto = skb->protocol; - int ret; - -@@ -290,7 +289,7 @@ static int bpf_xmit(struct sk_buff *skb) - /* If the header was expanded, headroom might be too - * small for L2 header to come, expand as needed. - */ -- ret = xmit_check_hhlen(skb); -+ ret = xmit_check_hhlen(skb, hh_len); - if (unlikely(ret)) - return ret; - -diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c -index f67f1d27f5655..5b38d03f6d79a 100644 ---- a/net/ipv4/ip_gre.c -+++ b/net/ipv4/ip_gre.c -@@ -432,14 +432,12 @@ static void __gre_xmit(struct sk_buff *skb, struct net_device *dev, - __be16 proto) - { - struct ip_tunnel *tunnel = netdev_priv(dev); -- -- if (tunnel->parms.o_flags & TUNNEL_SEQ) -- tunnel->o_seqno++; -+ __be16 flags = tunnel->parms.o_flags; - - /* Push GRE header. */ - gre_build_header(skb, tunnel->tun_hlen, -- tunnel->parms.o_flags, proto, tunnel->parms.o_key, -- htonl(tunnel->o_seqno)); -+ flags, proto, tunnel->parms.o_key, -+ (flags & TUNNEL_SEQ) ? htonl(tunnel->o_seqno++) : 0); - - ip_tunnel_xmit(skb, dev, tnl_params, tnl_params->protocol); - } -diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c -index c0fcfa2964686..b0e6fc2c5e108 100644 ---- a/net/ipv4/tcp_input.c -+++ b/net/ipv4/tcp_input.c -@@ -3717,7 +3717,8 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag) - tcp_process_tlp_ack(sk, ack, flag); - - if (tcp_ack_is_dubious(sk, flag)) { -- if (!(flag & (FLAG_SND_UNA_ADVANCED | FLAG_NOT_DUP))) { -+ if (!(flag & (FLAG_SND_UNA_ADVANCED | -+ FLAG_NOT_DUP | FLAG_DSACKING_ACK))) { - num_dupack = 1; - /* Consider if pure acks were aggregated in tcp_add_backlog() */ - if (!(flag & FLAG_DATA)) -@@ -5230,7 +5231,17 @@ static void tcp_new_space(struct sock *sk) - sk->sk_write_space(sk); - } - --static void tcp_check_space(struct sock *sk) -+/* Caller made space either from: -+ * 1) Freeing skbs in rtx queues (after tp->snd_una has advanced) -+ * 2) Sent skbs from output queue (and thus advancing tp->snd_nxt) -+ * -+ * We might be able to generate EPOLLOUT to the application if: -+ * 1) Space consumed in output/rtx queues is below sk->sk_sndbuf/2 -+ * 2) notsent amount (tp->write_seq - tp->snd_nxt) became -+ * small enough that tcp_stream_memory_free() decides it -+ * is time to generate EPOLLOUT. -+ */ -+void tcp_check_space(struct sock *sk) - { - if (sock_flag(sk, SOCK_QUEUE_SHRUNK)) { - sock_reset_flag(sk, SOCK_QUEUE_SHRUNK); -diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c -index 194743bd3fc10..9b038cb0a43d2 100644 ---- a/net/ipv4/tcp_minisocks.c -+++ b/net/ipv4/tcp_minisocks.c -@@ -538,7 +538,7 @@ struct sock *tcp_create_openreq_child(const struct sock *sk, - newtp->tsoffset = treq->ts_off; - #ifdef CONFIG_TCP_MD5SIG - newtp->md5sig_info = NULL; /*XXX*/ -- if (newtp->af_specific->md5_lookup(sk, newsk)) -+ if (treq->af_specific->req_md5_lookup(sk, req_to_sk(req))) - newtp->tcp_header_len += TCPOLEN_MD5SIG_ALIGNED; - #endif - if (skb->len >= TCP_MSS_DEFAULT + newtp->tcp_header_len) -diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c -index 139e962d1aef3..67493ec6318ad 100644 ---- a/net/ipv4/tcp_output.c -+++ b/net/ipv4/tcp_output.c -@@ -81,6 +81,7 @@ static void tcp_event_new_data_sent(struct sock *sk, struct sk_buff *skb) - - NET_ADD_STATS(sock_net(sk), LINUX_MIB_TCPORIGDATASENT, - tcp_skb_pcount(skb)); -+ tcp_check_space(sk); - } - - /* SND.NXT, if window was not shrunk or the amount of shrunk was less than one -diff --git a/net/ipv4/tcp_rate.c b/net/ipv4/tcp_rate.c -index 0de6935659635..6ab197928abbc 100644 ---- a/net/ipv4/tcp_rate.c -+++ b/net/ipv4/tcp_rate.c -@@ -73,26 +73,31 @@ void tcp_rate_skb_sent(struct sock *sk, struct sk_buff *skb) - * - * If an ACK (s)acks multiple skbs (e.g., stretched-acks), this function is - * called multiple times. We favor the information from the most recently -- * sent skb, i.e., the skb with the highest prior_delivered count. -+ * sent skb, i.e., the skb with the most recently sent time and the highest -+ * sequence. - */ - void tcp_rate_skb_delivered(struct sock *sk, struct sk_buff *skb, - struct rate_sample *rs) - { - struct tcp_sock *tp = tcp_sk(sk); - struct tcp_skb_cb *scb = TCP_SKB_CB(skb); -+ u64 tx_tstamp; - - if (!scb->tx.delivered_mstamp) - return; - -+ tx_tstamp = tcp_skb_timestamp_us(skb); - if (!rs->prior_delivered || -- after(scb->tx.delivered, rs->prior_delivered)) { -+ tcp_skb_sent_after(tx_tstamp, tp->first_tx_mstamp, -+ scb->end_seq, rs->last_end_seq)) { - rs->prior_delivered = scb->tx.delivered; - rs->prior_mstamp = scb->tx.delivered_mstamp; - rs->is_app_limited = scb->tx.is_app_limited; - rs->is_retrans = scb->sacked & TCPCB_RETRANS; -+ rs->last_end_seq = scb->end_seq; - - /* Record send time of most recently ACKed packet: */ -- tp->first_tx_mstamp = tcp_skb_timestamp_us(skb); -+ tp->first_tx_mstamp = tx_tstamp; - /* Find the duration of the "send phase" of this window: */ - rs->interval_us = tcp_stamp_us_delta(tp->first_tx_mstamp, - scb->tx.first_tx_mstamp); -diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c -index 5dbc280d43856..e550db28aabb5 100644 ---- a/net/ipv6/ip6_gre.c -+++ b/net/ipv6/ip6_gre.c -@@ -730,6 +730,7 @@ static netdev_tx_t __gre6_xmit(struct sk_buff *skb, - struct ip_tunnel_info *tun_info; - const struct ip_tunnel_key *key; - __be16 flags; -+ int tun_hlen; - - tun_info = skb_tunnel_info(skb); - if (unlikely(!tun_info || -@@ -748,9 +749,9 @@ static netdev_tx_t __gre6_xmit(struct sk_buff *skb, - dsfield = key->tos; - flags = key->tun_flags & - (TUNNEL_CSUM | TUNNEL_KEY | TUNNEL_SEQ); -- tunnel->tun_hlen = gre_calc_hlen(flags); -+ tun_hlen = gre_calc_hlen(flags); - -- gre_build_header(skb, tunnel->tun_hlen, -+ gre_build_header(skb, tun_hlen, - flags, protocol, - tunnel_id_to_key32(tun_info->key.tun_id), - (flags & TUNNEL_SEQ) ? htonl(tunnel->o_seqno++) -diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c -index d1524ca4b90ef..a189079a6ea50 100644 ---- a/net/netfilter/ipvs/ip_vs_conn.c -+++ b/net/netfilter/ipvs/ip_vs_conn.c -@@ -1421,7 +1421,7 @@ int __init ip_vs_conn_init(void) - pr_info("Connection hash table configured " - "(size=%d, memory=%ldKbytes)\n", - ip_vs_conn_tab_size, -- (long)(ip_vs_conn_tab_size*sizeof(struct list_head))/1024); -+ (long)(ip_vs_conn_tab_size*sizeof(*ip_vs_conn_tab))/1024); - IP_VS_DBG(0, "Each connection entry needs %zd bytes at least\n", - sizeof(struct ip_vs_conn)); - -diff --git a/net/netfilter/nft_socket.c b/net/netfilter/nft_socket.c -index 637ce3e8c575c..4026ec38526f6 100644 ---- a/net/netfilter/nft_socket.c -+++ b/net/netfilter/nft_socket.c -@@ -14,6 +14,32 @@ struct nft_socket { - }; - }; - -+static struct sock *nft_socket_do_lookup(const struct nft_pktinfo *pkt) -+{ -+ const struct net_device *indev = nft_in(pkt); -+ const struct sk_buff *skb = pkt->skb; -+ struct sock *sk = NULL; -+ -+ if (!indev) -+ return NULL; -+ -+ switch (nft_pf(pkt)) { -+ case NFPROTO_IPV4: -+ sk = nf_sk_lookup_slow_v4(nft_net(pkt), skb, indev); -+ break; -+#if IS_ENABLED(CONFIG_NF_TABLES_IPV6) -+ case NFPROTO_IPV6: -+ sk = nf_sk_lookup_slow_v6(nft_net(pkt), skb, indev); -+ break; -+#endif -+ default: -+ WARN_ON_ONCE(1); -+ break; -+ } -+ -+ return sk; -+} -+ - static void nft_socket_eval(const struct nft_expr *expr, - struct nft_regs *regs, - const struct nft_pktinfo *pkt) -@@ -27,20 +53,7 @@ static void nft_socket_eval(const struct nft_expr *expr, - sk = NULL; - - if (!sk) -- switch(nft_pf(pkt)) { -- case NFPROTO_IPV4: -- sk = nf_sk_lookup_slow_v4(nft_net(pkt), skb, nft_in(pkt)); -- break; --#if IS_ENABLED(CONFIG_NF_TABLES_IPV6) -- case NFPROTO_IPV6: -- sk = nf_sk_lookup_slow_v6(nft_net(pkt), skb, nft_in(pkt)); -- break; --#endif -- default: -- WARN_ON_ONCE(1); -- regs->verdict.code = NFT_BREAK; -- return; -- } -+ sk = nft_socket_do_lookup(pkt); - - if (!sk) { - regs->verdict.code = NFT_BREAK; -@@ -123,6 +136,16 @@ static int nft_socket_dump(struct sk_buff *skb, - return 0; - } - -+static int nft_socket_validate(const struct nft_ctx *ctx, -+ const struct nft_expr *expr, -+ const struct nft_data **data) -+{ -+ return nft_chain_validate_hooks(ctx->chain, -+ (1 << NF_INET_PRE_ROUTING) | -+ (1 << NF_INET_LOCAL_IN) | -+ (1 << NF_INET_LOCAL_OUT)); -+} -+ - static struct nft_expr_type nft_socket_type; - static const struct nft_expr_ops nft_socket_ops = { - .type = &nft_socket_type, -@@ -130,6 +153,7 @@ static const struct nft_expr_ops nft_socket_ops = { - .eval = nft_socket_eval, - .init = nft_socket_init, - .dump = nft_socket_dump, -+ .validate = nft_socket_validate, - }; - - static struct nft_expr_type nft_socket_type __read_mostly = { -diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c -index 0d225f891b61b..8d32229199b96 100644 ---- a/net/sctp/sm_sideeffect.c -+++ b/net/sctp/sm_sideeffect.c -@@ -458,6 +458,10 @@ void sctp_generate_reconf_event(struct timer_list *t) - goto out_unlock; - } - -+ /* This happens when the response arrives after the timer is triggered. */ -+ if (!asoc->strreset_chunk) -+ goto out_unlock; -+ - error = sctp_do_sm(net, SCTP_EVENT_T_TIMEOUT, - SCTP_ST_TIMEOUT(SCTP_EVENT_TIMEOUT_RECONF), - asoc->state, asoc->ep, asoc, -diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c -index 5221092cc66d4..a5a8cca46bd5f 100644 ---- a/net/smc/af_smc.c -+++ b/net/smc/af_smc.c -@@ -816,6 +816,8 @@ static void smc_connect_work(struct work_struct *work) - smc->sk.sk_state = SMC_CLOSED; - if (rc == -EPIPE || rc == -EAGAIN) - smc->sk.sk_err = EPIPE; -+ else if (rc == -ECONNREFUSED) -+ smc->sk.sk_err = ECONNREFUSED; - else if (signal_pending(current)) - smc->sk.sk_err = -sock_intr_errno(timeo); - sock_put(&smc->sk); /* passive closing */ -diff --git a/net/tls/tls_device.c b/net/tls/tls_device.c -index 0f034c3bc37d7..abb93f7343c53 100644 ---- a/net/tls/tls_device.c -+++ b/net/tls/tls_device.c -@@ -470,11 +470,13 @@ handle_error: - copy = min_t(size_t, size, (pfrag->size - pfrag->offset)); - copy = min_t(size_t, copy, (max_open_record_len - record->len)); - -- rc = tls_device_copy_data(page_address(pfrag->page) + -- pfrag->offset, copy, msg_iter); -- if (rc) -- goto handle_error; -- tls_append_frag(record, pfrag, copy); -+ if (copy) { -+ rc = tls_device_copy_data(page_address(pfrag->page) + -+ pfrag->offset, copy, msg_iter); -+ if (rc) -+ goto handle_error; -+ tls_append_frag(record, pfrag, copy); -+ } - - size -= copy; - if (!size) { -diff --git a/sound/soc/codecs/wm8731.c b/sound/soc/codecs/wm8731.c -index 6fd1bef848ed9..fa55d79b39b60 100644 ---- a/sound/soc/codecs/wm8731.c -+++ b/sound/soc/codecs/wm8731.c -@@ -601,7 +601,7 @@ static int wm8731_hw_init(struct device *dev, struct wm8731_priv *wm8731) - ret = wm8731_reset(wm8731->regmap); - if (ret < 0) { - dev_err(dev, "Failed to issue reset: %d\n", ret); -- goto err_regulator_enable; -+ goto err; - } - - /* Clear POWEROFF, keep everything else disabled */ -@@ -618,10 +618,7 @@ static int wm8731_hw_init(struct device *dev, struct wm8731_priv *wm8731) - - regcache_mark_dirty(wm8731->regmap); - --err_regulator_enable: -- /* Regulators will be enabled by bias management */ -- regulator_bulk_disable(ARRAY_SIZE(wm8731->supplies), wm8731->supplies); -- -+err: - return ret; - } - -@@ -765,21 +762,27 @@ static int wm8731_i2c_probe(struct i2c_client *i2c, - ret = PTR_ERR(wm8731->regmap); - dev_err(&i2c->dev, "Failed to allocate register map: %d\n", - ret); -- return ret; -+ goto err_regulator_enable; - } - - ret = wm8731_hw_init(&i2c->dev, wm8731); - if (ret != 0) -- return ret; -+ goto err_regulator_enable; - - ret = devm_snd_soc_register_component(&i2c->dev, - &soc_component_dev_wm8731, &wm8731_dai, 1); - if (ret != 0) { - dev_err(&i2c->dev, "Failed to register CODEC: %d\n", ret); -- return ret; -+ goto err_regulator_enable; - } - - return 0; -+ -+err_regulator_enable: -+ /* Regulators will be enabled by bias management */ -+ regulator_bulk_disable(ARRAY_SIZE(wm8731->supplies), wm8731->supplies); -+ -+ return ret; - } - - static int wm8731_i2c_remove(struct i2c_client *client) diff --git a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.192-193.patch b/patch/kernel/archive/odroidxu4-5.4/patch-5.4.192-193.patch deleted file mode 100644 index a3b2b9855..000000000 --- a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.192-193.patch +++ /dev/null @@ -1,2007 +0,0 @@ -diff --git a/Makefile b/Makefile -index 968470cf368ee..888d896058553 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 5 - PATCHLEVEL = 4 --SUBLEVEL = 192 -+SUBLEVEL = 193 - EXTRAVERSION = - NAME = Kleptomaniac Octopus - -diff --git a/arch/mips/include/asm/timex.h b/arch/mips/include/asm/timex.h -index b05bb70a2e46f..8026baf46e729 100644 ---- a/arch/mips/include/asm/timex.h -+++ b/arch/mips/include/asm/timex.h -@@ -40,9 +40,9 @@ - typedef unsigned int cycles_t; - - /* -- * On R4000/R4400 before version 5.0 an erratum exists such that if the -- * cycle counter is read in the exact moment that it is matching the -- * compare register, no interrupt will be generated. -+ * On R4000/R4400 an erratum exists such that if the cycle counter is -+ * read in the exact moment that it is matching the compare register, -+ * no interrupt will be generated. - * - * There is a suggested workaround and also the erratum can't strike if - * the compare interrupt isn't being used as the clock source device. -@@ -63,7 +63,7 @@ static inline int can_use_mips_counter(unsigned int prid) - if (!__builtin_constant_p(cpu_has_counter)) - asm volatile("" : "=m" (cpu_data[0].options)); - if (likely(cpu_has_counter && -- prid >= (PRID_IMP_R4000 | PRID_REV_ENCODE_44(5, 0)))) -+ prid > (PRID_IMP_R4000 | PRID_REV_ENCODE_44(15, 15)))) - return 1; - else - return 0; -diff --git a/arch/mips/kernel/time.c b/arch/mips/kernel/time.c -index caa01457dce60..ed339d7979f3f 100644 ---- a/arch/mips/kernel/time.c -+++ b/arch/mips/kernel/time.c -@@ -141,15 +141,10 @@ static __init int cpu_has_mfc0_count_bug(void) - case CPU_R4400MC: - /* - * The published errata for the R4400 up to 3.0 say the CPU -- * has the mfc0 from count bug. -+ * has the mfc0 from count bug. This seems the last version -+ * produced. - */ -- if ((current_cpu_data.processor_id & 0xff) <= 0x30) -- return 1; -- -- /* -- * we assume newer revisions are ok -- */ -- return 0; -+ return 1; - } - - return 0; -diff --git a/arch/parisc/kernel/processor.c b/arch/parisc/kernel/processor.c -index 13f771f74ee3b..b0045889864c2 100644 ---- a/arch/parisc/kernel/processor.c -+++ b/arch/parisc/kernel/processor.c -@@ -419,8 +419,7 @@ show_cpuinfo (struct seq_file *m, void *v) - } - seq_printf(m, " (0x%02lx)\n", boot_cpu_data.pdc.capabilities); - -- seq_printf(m, "model\t\t: %s\n" -- "model name\t: %s\n", -+ seq_printf(m, "model\t\t: %s - %s\n", - boot_cpu_data.pdc.sys_model_name, - cpuinfo->dev ? - cpuinfo->dev->name : "Unknown"); -diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c -index 408b51aba2930..f582dda8dd34f 100644 ---- a/arch/x86/kernel/kvm.c -+++ b/arch/x86/kernel/kvm.c -@@ -59,6 +59,7 @@ static DEFINE_PER_CPU_DECRYPTED(struct kvm_vcpu_pv_apf_data, apf_reason) __align - DEFINE_PER_CPU_DECRYPTED(struct kvm_steal_time, steal_time) __aligned(64) __visible; - static int has_steal_clock = 0; - -+static int has_guest_poll = 0; - /* - * No need for any "IO delay" on KVM - */ -@@ -584,14 +585,26 @@ static int kvm_cpu_down_prepare(unsigned int cpu) - - static int kvm_suspend(void) - { -+ u64 val = 0; -+ - kvm_guest_cpu_offline(false); - -+#ifdef CONFIG_ARCH_CPUIDLE_HALTPOLL -+ if (kvm_para_has_feature(KVM_FEATURE_POLL_CONTROL)) -+ rdmsrl(MSR_KVM_POLL_CONTROL, val); -+ has_guest_poll = !(val & 1); -+#endif - return 0; - } - - static void kvm_resume(void) - { - kvm_cpu_online(raw_smp_processor_id()); -+ -+#ifdef CONFIG_ARCH_CPUIDLE_HALTPOLL -+ if (kvm_para_has_feature(KVM_FEATURE_POLL_CONTROL) && has_guest_poll) -+ wrmsrl(MSR_KVM_POLL_CONTROL, 0); -+#endif - } - - static struct syscore_ops kvm_syscore_ops = { -diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c -index 6a8db8eb0e943..62c7f771a7cf8 100644 ---- a/arch/x86/kvm/cpuid.c -+++ b/arch/x86/kvm/cpuid.c -@@ -592,6 +592,11 @@ static inline int __do_cpuid_func(struct kvm_cpuid_entry2 *entry, u32 function, - union cpuid10_eax eax; - union cpuid10_edx edx; - -+ if (!static_cpu_has(X86_FEATURE_ARCH_PERFMON)) { -+ entry->eax = entry->ebx = entry->ecx = entry->edx = 0; -+ break; -+ } -+ - perf_get_x86_pmu_capability(&cap); - - /* -diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c -index afe3b8e615146..3696b4de9d99d 100644 ---- a/arch/x86/kvm/lapic.c -+++ b/arch/x86/kvm/lapic.c -@@ -118,7 +118,8 @@ static inline u32 kvm_x2apic_id(struct kvm_lapic *apic) - - bool kvm_can_post_timer_interrupt(struct kvm_vcpu *vcpu) - { -- return pi_inject_timer && kvm_vcpu_apicv_active(vcpu); -+ return pi_inject_timer && kvm_vcpu_apicv_active(vcpu) && -+ (kvm_mwait_in_guest(vcpu->kvm) || kvm_hlt_in_guest(vcpu->kvm)); - } - EXPORT_SYMBOL_GPL(kvm_can_post_timer_interrupt); - -diff --git a/block/bio.c b/block/bio.c -index 1c52d0196e15c..40004a3631a80 100644 ---- a/block/bio.c -+++ b/block/bio.c -@@ -1627,7 +1627,7 @@ struct bio *bio_copy_kern(struct request_queue *q, void *data, unsigned int len, - if (bytes > len) - bytes = len; - -- page = alloc_page(q->bounce_gfp | gfp_mask); -+ page = alloc_page(q->bounce_gfp | __GFP_ZERO | gfp_mask); - if (!page) - goto cleanup; - -diff --git a/drivers/acpi/acpica/nsaccess.c b/drivers/acpi/acpica/nsaccess.c -index 3f045b5953b2e..a0c1a665dfc12 100644 ---- a/drivers/acpi/acpica/nsaccess.c -+++ b/drivers/acpi/acpica/nsaccess.c -@@ -99,13 +99,12 @@ acpi_status acpi_ns_root_initialize(void) - * just create and link the new node(s) here. - */ - new_node = -- ACPI_ALLOCATE_ZEROED(sizeof(struct acpi_namespace_node)); -+ acpi_ns_create_node(*ACPI_CAST_PTR(u32, init_val->name)); - if (!new_node) { - status = AE_NO_MEMORY; - goto unlock_and_exit; - } - -- ACPI_COPY_NAMESEG(new_node->name.ascii, init_val->name); - new_node->descriptor_type = ACPI_DESC_TYPE_NAMED; - new_node->type = init_val->type; - -diff --git a/drivers/firewire/core-card.c b/drivers/firewire/core-card.c -index 54be88167c60b..f3b3953cac834 100644 ---- a/drivers/firewire/core-card.c -+++ b/drivers/firewire/core-card.c -@@ -668,6 +668,7 @@ EXPORT_SYMBOL_GPL(fw_card_release); - void fw_core_remove_card(struct fw_card *card) - { - struct fw_card_driver dummy_driver = dummy_driver_template; -+ unsigned long flags; - - card->driver->update_phy_reg(card, 4, - PHY_LINK_ACTIVE | PHY_CONTENDER, 0); -@@ -682,7 +683,9 @@ void fw_core_remove_card(struct fw_card *card) - dummy_driver.stop_iso = card->driver->stop_iso; - card->driver = &dummy_driver; - -+ spin_lock_irqsave(&card->lock, flags); - fw_destroy_nodes(card); -+ spin_unlock_irqrestore(&card->lock, flags); - - /* Wait for all users, especially device workqueue jobs, to finish. */ - fw_card_put(card); -diff --git a/drivers/firewire/core-cdev.c b/drivers/firewire/core-cdev.c -index 1da7ba18d3993..3a43e5d6ed3b2 100644 ---- a/drivers/firewire/core-cdev.c -+++ b/drivers/firewire/core-cdev.c -@@ -1482,6 +1482,7 @@ static void outbound_phy_packet_callback(struct fw_packet *packet, - { - struct outbound_phy_packet_event *e = - container_of(packet, struct outbound_phy_packet_event, p); -+ struct client *e_client; - - switch (status) { - /* expected: */ -@@ -1498,9 +1499,10 @@ static void outbound_phy_packet_callback(struct fw_packet *packet, - } - e->phy_packet.data[0] = packet->timestamp; - -+ e_client = e->client; - queue_event(e->client, &e->event, &e->phy_packet, - sizeof(e->phy_packet) + e->phy_packet.length, NULL, 0); -- client_put(e->client); -+ client_put(e_client); - } - - static int ioctl_send_phy_packet(struct client *client, union ioctl_arg *arg) -diff --git a/drivers/firewire/core-topology.c b/drivers/firewire/core-topology.c -index 94a13fca82673..5999dce11fc88 100644 ---- a/drivers/firewire/core-topology.c -+++ b/drivers/firewire/core-topology.c -@@ -374,16 +374,13 @@ static void report_found_node(struct fw_card *card, - card->bm_retries = 0; - } - -+/* Must be called with card->lock held */ - void fw_destroy_nodes(struct fw_card *card) - { -- unsigned long flags; -- -- spin_lock_irqsave(&card->lock, flags); - card->color++; - if (card->local_node != NULL) - for_each_fw_node(card, card->local_node, report_lost_node); - card->local_node = NULL; -- spin_unlock_irqrestore(&card->lock, flags); - } - - static void move_tree(struct fw_node *node0, struct fw_node *node1, int port) -@@ -509,6 +506,8 @@ void fw_core_handle_bus_reset(struct fw_card *card, int node_id, int generation, - struct fw_node *local_node; - unsigned long flags; - -+ spin_lock_irqsave(&card->lock, flags); -+ - /* - * If the selfID buffer is not the immediate successor of the - * previously processed one, we cannot reliably compare the -@@ -520,8 +519,6 @@ void fw_core_handle_bus_reset(struct fw_card *card, int node_id, int generation, - card->bm_retries = 0; - } - -- spin_lock_irqsave(&card->lock, flags); -- - card->broadcast_channel_allocated = card->broadcast_channel_auto_allocated; - card->node_id = node_id; - /* -diff --git a/drivers/firewire/core-transaction.c b/drivers/firewire/core-transaction.c -index 404a035f104d0..78574789a1872 100644 ---- a/drivers/firewire/core-transaction.c -+++ b/drivers/firewire/core-transaction.c -@@ -73,24 +73,25 @@ static int try_cancel_split_timeout(struct fw_transaction *t) - static int close_transaction(struct fw_transaction *transaction, - struct fw_card *card, int rcode) - { -- struct fw_transaction *t; -+ struct fw_transaction *t = NULL, *iter; - unsigned long flags; - - spin_lock_irqsave(&card->lock, flags); -- list_for_each_entry(t, &card->transaction_list, link) { -- if (t == transaction) { -- if (!try_cancel_split_timeout(t)) { -+ list_for_each_entry(iter, &card->transaction_list, link) { -+ if (iter == transaction) { -+ if (!try_cancel_split_timeout(iter)) { - spin_unlock_irqrestore(&card->lock, flags); - goto timed_out; - } -- list_del_init(&t->link); -- card->tlabel_mask &= ~(1ULL << t->tlabel); -+ list_del_init(&iter->link); -+ card->tlabel_mask &= ~(1ULL << iter->tlabel); -+ t = iter; - break; - } - } - spin_unlock_irqrestore(&card->lock, flags); - -- if (&t->link != &card->transaction_list) { -+ if (t) { - t->callback(card, rcode, NULL, 0, t->callback_data); - return 0; - } -@@ -935,7 +936,7 @@ EXPORT_SYMBOL(fw_core_handle_request); - - void fw_core_handle_response(struct fw_card *card, struct fw_packet *p) - { -- struct fw_transaction *t; -+ struct fw_transaction *t = NULL, *iter; - unsigned long flags; - u32 *data; - size_t data_length; -@@ -947,20 +948,21 @@ void fw_core_handle_response(struct fw_card *card, struct fw_packet *p) - rcode = HEADER_GET_RCODE(p->header[1]); - - spin_lock_irqsave(&card->lock, flags); -- list_for_each_entry(t, &card->transaction_list, link) { -- if (t->node_id == source && t->tlabel == tlabel) { -- if (!try_cancel_split_timeout(t)) { -+ list_for_each_entry(iter, &card->transaction_list, link) { -+ if (iter->node_id == source && iter->tlabel == tlabel) { -+ if (!try_cancel_split_timeout(iter)) { - spin_unlock_irqrestore(&card->lock, flags); - goto timed_out; - } -- list_del_init(&t->link); -- card->tlabel_mask &= ~(1ULL << t->tlabel); -+ list_del_init(&iter->link); -+ card->tlabel_mask &= ~(1ULL << iter->tlabel); -+ t = iter; - break; - } - } - spin_unlock_irqrestore(&card->lock, flags); - -- if (&t->link == &card->transaction_list) { -+ if (!t) { - timed_out: - fw_notice(card, "unsolicited response (source %x, tlabel %x)\n", - source, tlabel); -diff --git a/drivers/firewire/sbp2.c b/drivers/firewire/sbp2.c -index 4d5054211550b..2ceed9287435f 100644 ---- a/drivers/firewire/sbp2.c -+++ b/drivers/firewire/sbp2.c -@@ -408,7 +408,7 @@ static void sbp2_status_write(struct fw_card *card, struct fw_request *request, - void *payload, size_t length, void *callback_data) - { - struct sbp2_logical_unit *lu = callback_data; -- struct sbp2_orb *orb; -+ struct sbp2_orb *orb = NULL, *iter; - struct sbp2_status status; - unsigned long flags; - -@@ -433,17 +433,18 @@ static void sbp2_status_write(struct fw_card *card, struct fw_request *request, - - /* Lookup the orb corresponding to this status write. */ - spin_lock_irqsave(&lu->tgt->lock, flags); -- list_for_each_entry(orb, &lu->orb_list, link) { -+ list_for_each_entry(iter, &lu->orb_list, link) { - if (STATUS_GET_ORB_HIGH(status) == 0 && -- STATUS_GET_ORB_LOW(status) == orb->request_bus) { -- orb->rcode = RCODE_COMPLETE; -- list_del(&orb->link); -+ STATUS_GET_ORB_LOW(status) == iter->request_bus) { -+ iter->rcode = RCODE_COMPLETE; -+ list_del(&iter->link); -+ orb = iter; - break; - } - } - spin_unlock_irqrestore(&lu->tgt->lock, flags); - -- if (&orb->link != &lu->orb_list) { -+ if (orb) { - orb->callback(orb, &status); - kref_put(&orb->kref, free_orb); /* orb callback reference */ - } else { -diff --git a/drivers/gpio/gpiolib-of.c b/drivers/gpio/gpiolib-of.c -index 3ece59185d372..b1dcd2dd52e6b 100644 ---- a/drivers/gpio/gpiolib-of.c -+++ b/drivers/gpio/gpiolib-of.c -@@ -783,7 +783,7 @@ static void of_gpiochip_init_valid_mask(struct gpio_chip *chip) - i, &start); - of_property_read_u32_index(np, "gpio-reserved-ranges", - i + 1, &count); -- if (start >= chip->ngpio || start + count >= chip->ngpio) -+ if (start >= chip->ngpio || start + count > chip->ngpio) - continue; - - bitmap_clear(chip->valid_mask, start, count); -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c -index 25af45adc03e7..49b52ac3e4731 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c -@@ -951,11 +951,15 @@ int amdgpu_amdkfd_gpuvm_acquire_process_vm(struct kgd_dev *kgd, - struct dma_fence **ef) - { - struct amdgpu_device *adev = get_amdgpu_device(kgd); -- struct drm_file *drm_priv = filp->private_data; -- struct amdgpu_fpriv *drv_priv = drm_priv->driver_priv; -- struct amdgpu_vm *avm = &drv_priv->vm; -+ struct amdgpu_fpriv *drv_priv; -+ struct amdgpu_vm *avm; - int ret; - -+ ret = amdgpu_file_to_fpriv(filp, &drv_priv); -+ if (ret) -+ return ret; -+ avm = &drv_priv->vm; -+ - /* Already a compute VM? */ - if (avm->process_info) - return -EINVAL; -diff --git a/drivers/hwmon/adt7470.c b/drivers/hwmon/adt7470.c -index a30f34cf512c2..95e06886991dc 100644 ---- a/drivers/hwmon/adt7470.c -+++ b/drivers/hwmon/adt7470.c -@@ -20,6 +20,7 @@ - #include - #include - #include -+#include - - /* Addresses to scan */ - static const unsigned short normal_i2c[] = { 0x2C, 0x2E, 0x2F, I2C_CLIENT_END }; -@@ -260,11 +261,10 @@ static int adt7470_update_thread(void *p) - adt7470_read_temperatures(client, data); - mutex_unlock(&data->lock); - -- set_current_state(TASK_INTERRUPTIBLE); - if (kthread_should_stop()) - break; - -- schedule_timeout(msecs_to_jiffies(data->auto_update_interval)); -+ schedule_timeout_interruptible(msecs_to_jiffies(data->auto_update_interval)); - } - - return 0; -diff --git a/drivers/infiniband/sw/siw/siw_cm.c b/drivers/infiniband/sw/siw/siw_cm.c -index e3bac1a877bb7..3aed597103d3d 100644 ---- a/drivers/infiniband/sw/siw/siw_cm.c -+++ b/drivers/infiniband/sw/siw/siw_cm.c -@@ -976,14 +976,15 @@ static void siw_accept_newconn(struct siw_cep *cep) - - siw_cep_set_inuse(new_cep); - rv = siw_proc_mpareq(new_cep); -- siw_cep_set_free(new_cep); -- - if (rv != -EAGAIN) { - siw_cep_put(cep); - new_cep->listen_cep = NULL; -- if (rv) -+ if (rv) { -+ siw_cep_set_free(new_cep); - goto error; -+ } - } -+ siw_cep_set_free(new_cep); - } - return; - -diff --git a/drivers/md/dm.c b/drivers/md/dm.c -index 530c0fe142291..37b8bb4d80f0f 100644 ---- a/drivers/md/dm.c -+++ b/drivers/md/dm.c -@@ -676,19 +676,20 @@ static void start_io_acct(struct dm_io *io) - false, 0, &io->stats_aux); - } - --static void end_io_acct(struct dm_io *io) -+static void end_io_acct(struct mapped_device *md, struct bio *bio, -+ unsigned long start_time, struct dm_stats_aux *stats_aux) - { -- struct mapped_device *md = io->md; -- struct bio *bio = io->orig_bio; -- unsigned long duration = jiffies - io->start_time; -- -- generic_end_io_acct(md->queue, bio_op(bio), &dm_disk(md)->part0, -- io->start_time); -+ unsigned long duration = jiffies - start_time; - - if (unlikely(dm_stats_used(&md->stats))) - dm_stats_account_io(&md->stats, bio_data_dir(bio), - bio->bi_iter.bi_sector, bio_sectors(bio), -- true, duration, &io->stats_aux); -+ true, duration, stats_aux); -+ -+ smp_wmb(); -+ -+ generic_end_io_acct(md->queue, bio_op(bio), &dm_disk(md)->part0, -+ start_time); - - /* nudge anyone waiting on suspend queue */ - if (unlikely(wq_has_sleeper(&md->wait))) -@@ -909,6 +910,8 @@ static void dec_pending(struct dm_io *io, blk_status_t error) - blk_status_t io_error; - struct bio *bio; - struct mapped_device *md = io->md; -+ unsigned long start_time = 0; -+ struct dm_stats_aux stats_aux; - - /* Push-back supersedes any I/O errors */ - if (unlikely(error)) { -@@ -935,8 +938,10 @@ static void dec_pending(struct dm_io *io, blk_status_t error) - - io_error = io->status; - bio = io->orig_bio; -- end_io_acct(io); -+ start_time = io->start_time; -+ stats_aux = io->stats_aux; - free_io(md, io); -+ end_io_acct(md, bio, start_time, &stats_aux); - - if (io_error == BLK_STS_DM_REQUEUE) - return; -@@ -2491,6 +2496,8 @@ static int dm_wait_for_completion(struct mapped_device *md, long task_state) - } - finish_wait(&md->wait, &wait); - -+ smp_rmb(); -+ - return r; - } - -diff --git a/drivers/mmc/host/rtsx_pci_sdmmc.c b/drivers/mmc/host/rtsx_pci_sdmmc.c -index 9ff718b61c72e..e5ae3346b05a9 100644 ---- a/drivers/mmc/host/rtsx_pci_sdmmc.c -+++ b/drivers/mmc/host/rtsx_pci_sdmmc.c -@@ -37,10 +37,7 @@ struct realtek_pci_sdmmc { - bool double_clk; - bool eject; - bool initial_mode; -- int power_state; --#define SDMMC_POWER_ON 1 --#define SDMMC_POWER_OFF 0 -- -+ int prev_power_state; - int sg_count; - s32 cookie; - int cookie_sg_count; -@@ -902,14 +899,21 @@ static int sd_set_bus_width(struct realtek_pci_sdmmc *host, - return err; - } - --static int sd_power_on(struct realtek_pci_sdmmc *host) -+static int sd_power_on(struct realtek_pci_sdmmc *host, unsigned char power_mode) - { - struct rtsx_pcr *pcr = host->pcr; - int err; - -- if (host->power_state == SDMMC_POWER_ON) -+ if (host->prev_power_state == MMC_POWER_ON) - return 0; - -+ if (host->prev_power_state == MMC_POWER_UP) { -+ rtsx_pci_write_register(pcr, SD_BUS_STAT, SD_CLK_TOGGLE_EN, 0); -+ goto finish; -+ } -+ -+ msleep(100); -+ - rtsx_pci_init_cmd(pcr); - rtsx_pci_add_cmd(pcr, WRITE_REG_CMD, CARD_SELECT, 0x07, SD_MOD_SEL); - rtsx_pci_add_cmd(pcr, WRITE_REG_CMD, CARD_SHARE_MODE, -@@ -928,11 +932,17 @@ static int sd_power_on(struct realtek_pci_sdmmc *host) - if (err < 0) - return err; - -+ mdelay(1); -+ - err = rtsx_pci_write_register(pcr, CARD_OE, SD_OUTPUT_EN, SD_OUTPUT_EN); - if (err < 0) - return err; - -- host->power_state = SDMMC_POWER_ON; -+ /* send at least 74 clocks */ -+ rtsx_pci_write_register(pcr, SD_BUS_STAT, SD_CLK_TOGGLE_EN, SD_CLK_TOGGLE_EN); -+ -+finish: -+ host->prev_power_state = power_mode; - return 0; - } - -@@ -941,7 +951,7 @@ static int sd_power_off(struct realtek_pci_sdmmc *host) - struct rtsx_pcr *pcr = host->pcr; - int err; - -- host->power_state = SDMMC_POWER_OFF; -+ host->prev_power_state = MMC_POWER_OFF; - - rtsx_pci_init_cmd(pcr); - -@@ -967,7 +977,7 @@ static int sd_set_power_mode(struct realtek_pci_sdmmc *host, - if (power_mode == MMC_POWER_OFF) - err = sd_power_off(host); - else -- err = sd_power_on(host); -+ err = sd_power_on(host, power_mode); - - return err; - } -@@ -1402,10 +1412,11 @@ static int rtsx_pci_sdmmc_drv_probe(struct platform_device *pdev) - - host = mmc_priv(mmc); - host->pcr = pcr; -+ mmc->ios.power_delay_ms = 5; - host->mmc = mmc; - host->pdev = pdev; - host->cookie = -1; -- host->power_state = SDMMC_POWER_OFF; -+ host->prev_power_state = MMC_POWER_OFF; - INIT_WORK(&host->work, sd_request); - platform_set_drvdata(pdev, host); - pcr->slots[RTSX_SD_CARD].p_dev = pdev; -diff --git a/drivers/net/can/grcan.c b/drivers/net/can/grcan.c -index b8f1f2b69dd3e..3496dfa1b5217 100644 ---- a/drivers/net/can/grcan.c -+++ b/drivers/net/can/grcan.c -@@ -248,6 +248,7 @@ struct grcan_device_config { - struct grcan_priv { - struct can_priv can; /* must be the first member */ - struct net_device *dev; -+ struct device *ofdev_dev; - struct napi_struct napi; - - struct grcan_registers __iomem *regs; /* ioremap'ed registers */ -@@ -924,7 +925,7 @@ static void grcan_free_dma_buffers(struct net_device *dev) - struct grcan_priv *priv = netdev_priv(dev); - struct grcan_dma *dma = &priv->dma; - -- dma_free_coherent(&dev->dev, dma->base_size, dma->base_buf, -+ dma_free_coherent(priv->ofdev_dev, dma->base_size, dma->base_buf, - dma->base_handle); - memset(dma, 0, sizeof(*dma)); - } -@@ -949,7 +950,7 @@ static int grcan_allocate_dma_buffers(struct net_device *dev, - - /* Extra GRCAN_BUFFER_ALIGNMENT to allow for alignment */ - dma->base_size = lsize + ssize + GRCAN_BUFFER_ALIGNMENT; -- dma->base_buf = dma_alloc_coherent(&dev->dev, -+ dma->base_buf = dma_alloc_coherent(priv->ofdev_dev, - dma->base_size, - &dma->base_handle, - GFP_KERNEL); -@@ -1113,8 +1114,10 @@ static int grcan_close(struct net_device *dev) - - priv->closing = true; - if (priv->need_txbug_workaround) { -+ spin_unlock_irqrestore(&priv->lock, flags); - del_timer_sync(&priv->hang_timer); - del_timer_sync(&priv->rr_timer); -+ spin_lock_irqsave(&priv->lock, flags); - } - netif_stop_queue(dev); - grcan_stop_hardware(dev); -@@ -1600,6 +1603,7 @@ static int grcan_setup_netdev(struct platform_device *ofdev, - memcpy(&priv->config, &grcan_module_config, - sizeof(struct grcan_device_config)); - priv->dev = dev; -+ priv->ofdev_dev = &ofdev->dev; - priv->regs = base; - priv->can.bittiming_const = &grcan_bittiming_const; - priv->can.do_set_bittiming = grcan_set_bittiming; -diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c -index 7f590a9e3af79..5a7d5e7f3b238 100644 ---- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c -+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c -@@ -9791,7 +9791,7 @@ static bool bnxt_rfs_capable(struct bnxt *bp) - - if (bp->flags & BNXT_FLAG_CHIP_P5) - return bnxt_rfs_supported(bp); -- if (!(bp->flags & BNXT_FLAG_MSIX_CAP) || !bnxt_can_reserve_rings(bp)) -+ if (!(bp->flags & BNXT_FLAG_MSIX_CAP) || !bnxt_can_reserve_rings(bp) || !bp->rx_nr_rings) - return false; - - vnics = 1 + bp->rx_nr_rings; -@@ -11725,10 +11725,9 @@ static int bnxt_init_dflt_ring_mode(struct bnxt *bp) - goto init_dflt_ring_err; - - bp->tx_nr_rings_per_tc = bp->tx_nr_rings; -- if (bnxt_rfs_supported(bp) && bnxt_rfs_capable(bp)) { -- bp->flags |= BNXT_FLAG_RFS; -- bp->dev->features |= NETIF_F_NTUPLE; -- } -+ -+ bnxt_set_dflt_rfs(bp); -+ - init_dflt_ring_err: - bnxt_ulp_irq_restart(bp, rc); - return rc; -diff --git a/drivers/net/ethernet/mediatek/mtk_sgmii.c b/drivers/net/ethernet/mediatek/mtk_sgmii.c -index 4db27dfc7ec1f..6702d77030885 100644 ---- a/drivers/net/ethernet/mediatek/mtk_sgmii.c -+++ b/drivers/net/ethernet/mediatek/mtk_sgmii.c -@@ -26,6 +26,7 @@ int mtk_sgmii_init(struct mtk_sgmii *ss, struct device_node *r, u32 ana_rgc3) - break; - - ss->regmap[i] = syscon_node_to_regmap(np); -+ of_node_put(np); - if (IS_ERR(ss->regmap[i])) - return PTR_ERR(ss->regmap[i]); - } -diff --git a/drivers/net/ethernet/smsc/smsc911x.c b/drivers/net/ethernet/smsc/smsc911x.c -index c7bdada4d1b97..7767d0ae9ebc1 100644 ---- a/drivers/net/ethernet/smsc/smsc911x.c -+++ b/drivers/net/ethernet/smsc/smsc911x.c -@@ -2433,7 +2433,7 @@ static int smsc911x_drv_probe(struct platform_device *pdev) - if (irq == -EPROBE_DEFER) { - retval = -EPROBE_DEFER; - goto out_0; -- } else if (irq <= 0) { -+ } else if (irq < 0) { - pr_warn("Could not allocate irq resource\n"); - retval = -ENODEV; - goto out_0; -diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c -index 7c73d296b940d..497ce6e6b16ff 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c -+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c -@@ -879,6 +879,7 @@ static int sun8i_dwmac_register_mdio_mux(struct stmmac_priv *priv) - - ret = mdio_mux_init(priv->device, mdio_mux, mdio_mux_syscon_switch_fn, - &gmac->mux_handle, priv, priv->mii); -+ of_node_put(mdio_mux); - return ret; - } - -diff --git a/drivers/net/ethernet/xilinx/xilinx_emaclite.c b/drivers/net/ethernet/xilinx/xilinx_emaclite.c -index 63a2d1bcccfbc..bec09008997de 100644 ---- a/drivers/net/ethernet/xilinx/xilinx_emaclite.c -+++ b/drivers/net/ethernet/xilinx/xilinx_emaclite.c -@@ -820,10 +820,10 @@ static int xemaclite_mdio_write(struct mii_bus *bus, int phy_id, int reg, - static int xemaclite_mdio_setup(struct net_local *lp, struct device *dev) - { - struct mii_bus *bus; -- int rc; - struct resource res; - struct device_node *np = of_get_parent(lp->phy_node); - struct device_node *npp; -+ int rc, ret; - - /* Don't register the MDIO bus if the phy_node or its parent node - * can't be found. -@@ -833,8 +833,14 @@ static int xemaclite_mdio_setup(struct net_local *lp, struct device *dev) - return -ENODEV; - } - npp = of_get_parent(np); -- -- of_address_to_resource(npp, 0, &res); -+ ret = of_address_to_resource(npp, 0, &res); -+ of_node_put(npp); -+ if (ret) { -+ dev_err(dev, "%s resource error!\n", -+ dev->of_node->full_name); -+ of_node_put(np); -+ return ret; -+ } - if (lp->ndev->mem_start != res.start) { - struct phy_device *phydev; - phydev = of_phy_find_device(lp->phy_node); -@@ -843,6 +849,7 @@ static int xemaclite_mdio_setup(struct net_local *lp, struct device *dev) - "MDIO of the phy is not registered yet\n"); - else - put_device(&phydev->mdio.dev); -+ of_node_put(np); - return 0; - } - -@@ -855,6 +862,7 @@ static int xemaclite_mdio_setup(struct net_local *lp, struct device *dev) - bus = mdiobus_alloc(); - if (!bus) { - dev_err(dev, "Failed to allocate mdiobus\n"); -+ of_node_put(np); - return -ENOMEM; - } - -@@ -867,6 +875,7 @@ static int xemaclite_mdio_setup(struct net_local *lp, struct device *dev) - bus->parent = dev; - - rc = of_mdiobus_register(bus, np); -+ of_node_put(np); - if (rc) { - dev_err(dev, "Failed to register mdio bus.\n"); - goto err_register; -diff --git a/drivers/nfc/nfcmrvl/main.c b/drivers/nfc/nfcmrvl/main.c -index 529be35ac1782..54d228acc0f5d 100644 ---- a/drivers/nfc/nfcmrvl/main.c -+++ b/drivers/nfc/nfcmrvl/main.c -@@ -194,6 +194,7 @@ void nfcmrvl_nci_unregister_dev(struct nfcmrvl_private *priv) - { - struct nci_dev *ndev = priv->ndev; - -+ nci_unregister_device(ndev); - if (priv->ndev->nfc_dev->fw_download_in_progress) - nfcmrvl_fw_dnld_abort(priv); - -@@ -202,7 +203,6 @@ void nfcmrvl_nci_unregister_dev(struct nfcmrvl_private *priv) - if (gpio_is_valid(priv->config.reset_n_io)) - gpio_free(priv->config.reset_n_io); - -- nci_unregister_device(ndev); - nci_free_device(ndev); - kfree(priv); - } -diff --git a/drivers/pci/controller/pci-aardvark.c b/drivers/pci/controller/pci-aardvark.c -index 721d2652319ce..7219ca39aa909 100644 ---- a/drivers/pci/controller/pci-aardvark.c -+++ b/drivers/pci/controller/pci-aardvark.c -@@ -108,6 +108,7 @@ - #define PCIE_MSI_ADDR_HIGH_REG (CONTROL_BASE_ADDR + 0x54) - #define PCIE_MSI_STATUS_REG (CONTROL_BASE_ADDR + 0x58) - #define PCIE_MSI_MASK_REG (CONTROL_BASE_ADDR + 0x5C) -+#define PCIE_MSI_ALL_MASK GENMASK(31, 0) - #define PCIE_MSI_PAYLOAD_REG (CONTROL_BASE_ADDR + 0x9C) - #define PCIE_MSI_DATA_MASK GENMASK(15, 0) - -@@ -561,6 +562,7 @@ static void advk_pcie_setup_hw(struct advk_pcie *pcie) - advk_writel(pcie, reg, PCIE_CORE_CTRL2_REG); - - /* Clear all interrupts */ -+ advk_writel(pcie, PCIE_MSI_ALL_MASK, PCIE_MSI_STATUS_REG); - advk_writel(pcie, PCIE_ISR0_ALL_MASK, PCIE_ISR0_REG); - advk_writel(pcie, PCIE_ISR1_ALL_MASK, PCIE_ISR1_REG); - advk_writel(pcie, PCIE_IRQ_ALL_MASK, HOST_CTRL_INT_STATUS_REG); -@@ -573,7 +575,7 @@ static void advk_pcie_setup_hw(struct advk_pcie *pcie) - advk_writel(pcie, PCIE_ISR1_ALL_MASK, PCIE_ISR1_MASK_REG); - - /* Unmask all MSIs */ -- advk_writel(pcie, 0, PCIE_MSI_MASK_REG); -+ advk_writel(pcie, ~(u32)PCIE_MSI_ALL_MASK, PCIE_MSI_MASK_REG); - - /* Enable summary interrupt for GIC SPI source */ - reg = PCIE_IRQ_ALL_MASK & (~PCIE_IRQ_ENABLE_INTS_MASK); -@@ -1370,23 +1372,19 @@ static void advk_pcie_remove_irq_domain(struct advk_pcie *pcie) - static void advk_pcie_handle_msi(struct advk_pcie *pcie) - { - u32 msi_val, msi_mask, msi_status, msi_idx; -- u16 msi_data; -+ int virq; - - msi_mask = advk_readl(pcie, PCIE_MSI_MASK_REG); - msi_val = advk_readl(pcie, PCIE_MSI_STATUS_REG); -- msi_status = msi_val & ~msi_mask; -+ msi_status = msi_val & ((~msi_mask) & PCIE_MSI_ALL_MASK); - - for (msi_idx = 0; msi_idx < MSI_IRQ_NUM; msi_idx++) { - if (!(BIT(msi_idx) & msi_status)) - continue; - -- /* -- * msi_idx contains bits [4:0] of the msi_data and msi_data -- * contains 16bit MSI interrupt number -- */ - advk_writel(pcie, BIT(msi_idx), PCIE_MSI_STATUS_REG); -- msi_data = advk_readl(pcie, PCIE_MSI_PAYLOAD_REG) & PCIE_MSI_DATA_MASK; -- generic_handle_irq(msi_data); -+ virq = irq_find_mapping(pcie->msi_inner_domain, msi_idx); -+ generic_handle_irq(virq); - } - - advk_writel(pcie, PCIE_ISR0_MSI_INT_PENDING, -diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c -index b577c8f7e3462..e0570cd0e520c 100644 ---- a/drivers/s390/block/dasd.c -+++ b/drivers/s390/block/dasd.c -@@ -1462,6 +1462,13 @@ int dasd_start_IO(struct dasd_ccw_req *cqr) - if (!cqr->lpm) - cqr->lpm = dasd_path_get_opm(device); - } -+ /* -+ * remember the amount of formatted tracks to prevent double format on -+ * ESE devices -+ */ -+ if (cqr->block) -+ cqr->trkcount = atomic_read(&cqr->block->trkcount); -+ - if (cqr->cpmode == 1) { - rc = ccw_device_tm_start(device->cdev, cqr->cpaddr, - (long) cqr, cqr->lpm); -@@ -1680,6 +1687,7 @@ void dasd_int_handler(struct ccw_device *cdev, unsigned long intparm, - unsigned long now; - int nrf_suppressed = 0; - int fp_suppressed = 0; -+ struct request *req; - u8 *sense = NULL; - int expires; - -@@ -1780,7 +1788,12 @@ void dasd_int_handler(struct ccw_device *cdev, unsigned long intparm, - } - - if (dasd_ese_needs_format(cqr->block, irb)) { -- if (rq_data_dir((struct request *)cqr->callback_data) == READ) { -+ req = dasd_get_callback_data(cqr); -+ if (!req) { -+ cqr->status = DASD_CQR_ERROR; -+ return; -+ } -+ if (rq_data_dir(req) == READ) { - device->discipline->ese_read(cqr, irb); - cqr->status = DASD_CQR_SUCCESS; - cqr->stopclk = now; -@@ -2799,8 +2812,7 @@ static void __dasd_cleanup_cqr(struct dasd_ccw_req *cqr) - * complete a request partially. - */ - if (proc_bytes) { -- blk_update_request(req, BLK_STS_OK, -- blk_rq_bytes(req) - proc_bytes); -+ blk_update_request(req, BLK_STS_OK, proc_bytes); - blk_mq_requeue_request(req, true); - } else { - blk_mq_complete_request(req); -diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c -index ad44d22e88591..7749deb614d75 100644 ---- a/drivers/s390/block/dasd_eckd.c -+++ b/drivers/s390/block/dasd_eckd.c -@@ -3026,13 +3026,24 @@ static int dasd_eckd_format_device(struct dasd_device *base, - } - - static bool test_and_set_format_track(struct dasd_format_entry *to_format, -- struct dasd_block *block) -+ struct dasd_ccw_req *cqr) - { -+ struct dasd_block *block = cqr->block; - struct dasd_format_entry *format; - unsigned long flags; - bool rc = false; - - spin_lock_irqsave(&block->format_lock, flags); -+ if (cqr->trkcount != atomic_read(&block->trkcount)) { -+ /* -+ * The number of formatted tracks has changed after request -+ * start and we can not tell if the current track was involved. -+ * To avoid data corruption treat it as if the current track is -+ * involved -+ */ -+ rc = true; -+ goto out; -+ } - list_for_each_entry(format, &block->format_list, list) { - if (format->track == to_format->track) { - rc = true; -@@ -3052,6 +3063,7 @@ static void clear_format_track(struct dasd_format_entry *format, - unsigned long flags; - - spin_lock_irqsave(&block->format_lock, flags); -+ atomic_inc(&block->trkcount); - list_del_init(&format->list); - spin_unlock_irqrestore(&block->format_lock, flags); - } -@@ -3088,7 +3100,7 @@ dasd_eckd_ese_format(struct dasd_device *startdev, struct dasd_ccw_req *cqr, - sector_t curr_trk; - int rc; - -- req = cqr->callback_data; -+ req = dasd_get_callback_data(cqr); - block = cqr->block; - base = block->base; - private = base->private; -@@ -3113,8 +3125,11 @@ dasd_eckd_ese_format(struct dasd_device *startdev, struct dasd_ccw_req *cqr, - } - format->track = curr_trk; - /* test if track is already in formatting by another thread */ -- if (test_and_set_format_track(format, block)) -+ if (test_and_set_format_track(format, cqr)) { -+ /* this is no real error so do not count down retries */ -+ cqr->retries++; - return ERR_PTR(-EEXIST); -+ } - - fdata.start_unit = curr_trk; - fdata.stop_unit = curr_trk; -@@ -3213,12 +3228,11 @@ static int dasd_eckd_ese_read(struct dasd_ccw_req *cqr, struct irb *irb) - cqr->proc_bytes = blk_count * blksize; - return 0; - } -- if (dst && !skip_block) { -- dst += off; -+ if (dst && !skip_block) - memset(dst, 0, blksize); -- } else { -+ else - skip_block--; -- } -+ dst += blksize; - blk_count++; - } - } -diff --git a/drivers/s390/block/dasd_int.h b/drivers/s390/block/dasd_int.h -index fa552f9f16667..9d9685c25253d 100644 ---- a/drivers/s390/block/dasd_int.h -+++ b/drivers/s390/block/dasd_int.h -@@ -188,6 +188,7 @@ struct dasd_ccw_req { - void (*callback)(struct dasd_ccw_req *, void *data); - void *callback_data; - unsigned int proc_bytes; /* bytes for partial completion */ -+ unsigned int trkcount; /* count formatted tracks */ - }; - - /* -@@ -575,6 +576,7 @@ struct dasd_block { - - struct list_head format_list; - spinlock_t format_lock; -+ atomic_t trkcount; - }; - - struct dasd_attention_data { -@@ -723,6 +725,18 @@ dasd_check_blocksize(int bsize) - return 0; - } - -+/* -+ * return the callback data of the original request in case there are -+ * ERP requests build on top of it -+ */ -+static inline void *dasd_get_callback_data(struct dasd_ccw_req *cqr) -+{ -+ while (cqr->refers) -+ cqr = cqr->refers; -+ -+ return cqr->callback_data; -+} -+ - /* externals in dasd.c */ - #define DASD_PROFILE_OFF 0 - #define DASD_PROFILE_ON 1 -diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c -index 9b703c0db9796..b7bfecfc2ea33 100644 ---- a/fs/btrfs/tree-log.c -+++ b/fs/btrfs/tree-log.c -@@ -5294,6 +5294,18 @@ static int btrfs_log_inode(struct btrfs_trans_handle *trans, - mutex_lock(&inode->log_mutex); - } - -+ /* -+ * For symlinks, we must always log their content, which is stored in an -+ * inline extent, otherwise we could end up with an empty symlink after -+ * log replay, which is invalid on linux (symlink(2) returns -ENOENT if -+ * one attempts to create an empty symlink). -+ * We don't need to worry about flushing delalloc, because when we create -+ * the inline extent when the symlink is created (we never have delalloc -+ * for symlinks). -+ */ -+ if (S_ISLNK(inode->vfs_inode.i_mode)) -+ inode_only = LOG_INODE_ALL; -+ - /* - * a brute force approach to making sure we get the most uptodate - * copies of everything. -@@ -5707,7 +5719,7 @@ process_leaf: - } - - ctx->log_new_dentries = false; -- if (type == BTRFS_FT_DIR || type == BTRFS_FT_SYMLINK) -+ if (type == BTRFS_FT_DIR) - log_mode = LOG_INODE_ALL; - ret = btrfs_log_inode(trans, root, BTRFS_I(di_inode), - log_mode, 0, LLONG_MAX, ctx); -diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c -index 76baf7b441f3c..cf3b00751ff65 100644 ---- a/fs/nfs/nfs4proc.c -+++ b/fs/nfs/nfs4proc.c -@@ -359,6 +359,14 @@ static void nfs4_setup_readdir(u64 cookie, __be32 *verifier, struct dentry *dent - kunmap_atomic(start); - } - -+static void nfs4_fattr_set_prechange(struct nfs_fattr *fattr, u64 version) -+{ -+ if (!(fattr->valid & NFS_ATTR_FATTR_PRECHANGE)) { -+ fattr->pre_change_attr = version; -+ fattr->valid |= NFS_ATTR_FATTR_PRECHANGE; -+ } -+} -+ - static void nfs4_test_and_free_stateid(struct nfs_server *server, - nfs4_stateid *stateid, - const struct cred *cred) -@@ -6307,7 +6315,9 @@ static void nfs4_delegreturn_release(void *calldata) - pnfs_roc_release(&data->lr.arg, &data->lr.res, - data->res.lr_ret); - if (inode) { -- nfs_post_op_update_inode_force_wcc(inode, &data->fattr); -+ nfs4_fattr_set_prechange(&data->fattr, -+ inode_peek_iversion_raw(inode)); -+ nfs_refresh_inode(inode, &data->fattr); - nfs_iput_and_deactive(inode); - } - kfree(calldata); -diff --git a/include/net/tcp.h b/include/net/tcp.h -index 9237362e56065..65be8bd1f0f4a 100644 ---- a/include/net/tcp.h -+++ b/include/net/tcp.h -@@ -2015,6 +2015,11 @@ struct tcp_request_sock_ops { - enum tcp_synack_type synack_type); - }; - -+extern const struct tcp_request_sock_ops tcp_request_sock_ipv4_ops; -+#if IS_ENABLED(CONFIG_IPV6) -+extern const struct tcp_request_sock_ops tcp_request_sock_ipv6_ops; -+#endif -+ - #ifdef CONFIG_SYN_COOKIES - static inline __u32 cookie_init_sequence(const struct tcp_request_sock_ops *ops, - const struct sock *sk, struct sk_buff *skb, -diff --git a/include/sound/pcm.h b/include/sound/pcm.h -index bbe6eb1ff5d22..f0045f842a604 100644 ---- a/include/sound/pcm.h -+++ b/include/sound/pcm.h -@@ -395,6 +395,8 @@ struct snd_pcm_runtime { - wait_queue_head_t sleep; /* poll sleep */ - wait_queue_head_t tsleep; /* transfer sleep */ - struct fasync_struct *fasync; -+ struct mutex buffer_mutex; /* protect for buffer changes */ -+ atomic_t buffer_accessing; /* >0: in r/w operation, <0: blocked */ - - /* -- private section -- */ - void *private_data; -diff --git a/kernel/irq/internals.h b/kernel/irq/internals.h -index c9d8eb7f5c029..ba4d742c1c655 100644 ---- a/kernel/irq/internals.h -+++ b/kernel/irq/internals.h -@@ -29,12 +29,14 @@ extern struct irqaction chained_action; - * IRQTF_WARNED - warning "IRQ_WAKE_THREAD w/o thread_fn" has been printed - * IRQTF_AFFINITY - irq thread is requested to adjust affinity - * IRQTF_FORCED_THREAD - irq action is force threaded -+ * IRQTF_READY - signals that irq thread is ready - */ - enum { - IRQTF_RUNTHREAD, - IRQTF_WARNED, - IRQTF_AFFINITY, - IRQTF_FORCED_THREAD, -+ IRQTF_READY, - }; - - /* -diff --git a/kernel/irq/irqdesc.c b/kernel/irq/irqdesc.c -index 9be995fc3c5a1..172b5e6bc4c2f 100644 ---- a/kernel/irq/irqdesc.c -+++ b/kernel/irq/irqdesc.c -@@ -405,6 +405,7 @@ static struct irq_desc *alloc_desc(int irq, int node, unsigned int flags, - lockdep_set_class(&desc->lock, &irq_desc_lock_class); - mutex_init(&desc->request_mutex); - init_rcu_head(&desc->rcu); -+ init_waitqueue_head(&desc->wait_for_threads); - - desc_set_defaults(irq, desc, node, affinity, owner); - irqd_set(&desc->irq_data, flags); -@@ -573,6 +574,7 @@ int __init early_irq_init(void) - raw_spin_lock_init(&desc[i].lock); - lockdep_set_class(&desc[i].lock, &irq_desc_lock_class); - mutex_init(&desc[i].request_mutex); -+ init_waitqueue_head(&desc[i].wait_for_threads); - desc_set_defaults(i, &desc[i], node, NULL, NULL); - } - return arch_early_irq_init(); -diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c -index 918fe05933862..79214f9836243 100644 ---- a/kernel/irq/manage.c -+++ b/kernel/irq/manage.c -@@ -1102,6 +1102,31 @@ static void irq_wake_secondary(struct irq_desc *desc, struct irqaction *action) - raw_spin_unlock_irq(&desc->lock); - } - -+/* -+ * Internal function to notify that a interrupt thread is ready. -+ */ -+static void irq_thread_set_ready(struct irq_desc *desc, -+ struct irqaction *action) -+{ -+ set_bit(IRQTF_READY, &action->thread_flags); -+ wake_up(&desc->wait_for_threads); -+} -+ -+/* -+ * Internal function to wake up a interrupt thread and wait until it is -+ * ready. -+ */ -+static void wake_up_and_wait_for_irq_thread_ready(struct irq_desc *desc, -+ struct irqaction *action) -+{ -+ if (!action || !action->thread) -+ return; -+ -+ wake_up_process(action->thread); -+ wait_event(desc->wait_for_threads, -+ test_bit(IRQTF_READY, &action->thread_flags)); -+} -+ - /* - * Interrupt handler thread - */ -@@ -1113,6 +1138,8 @@ static int irq_thread(void *data) - irqreturn_t (*handler_fn)(struct irq_desc *desc, - struct irqaction *action); - -+ irq_thread_set_ready(desc, action); -+ - if (force_irqthreads && test_bit(IRQTF_FORCED_THREAD, - &action->thread_flags)) - handler_fn = irq_forced_thread_fn; -@@ -1541,8 +1568,6 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new) - } - - if (!shared) { -- init_waitqueue_head(&desc->wait_for_threads); -- - /* Setup the type (level, edge polarity) if configured: */ - if (new->flags & IRQF_TRIGGER_MASK) { - ret = __irq_set_trigger(desc, -@@ -1632,14 +1657,8 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new) - - irq_setup_timings(desc, new); - -- /* -- * Strictly no need to wake it up, but hung_task complains -- * when no hard interrupt wakes the thread up. -- */ -- if (new->thread) -- wake_up_process(new->thread); -- if (new->secondary) -- wake_up_process(new->secondary->thread); -+ wake_up_and_wait_for_irq_thread_ready(desc, new); -+ wake_up_and_wait_for_irq_thread_ready(desc, new->secondary); - - register_irq_proc(irq, desc); - new->dir = NULL; -diff --git a/mm/page_io.c b/mm/page_io.c -index bcf27d0572534..f0e3f2be7b44c 100644 ---- a/mm/page_io.c -+++ b/mm/page_io.c -@@ -69,54 +69,6 @@ void end_swap_bio_write(struct bio *bio) - bio_put(bio); - } - --static void swap_slot_free_notify(struct page *page) --{ -- struct swap_info_struct *sis; -- struct gendisk *disk; -- swp_entry_t entry; -- -- /* -- * There is no guarantee that the page is in swap cache - the software -- * suspend code (at least) uses end_swap_bio_read() against a non- -- * swapcache page. So we must check PG_swapcache before proceeding with -- * this optimization. -- */ -- if (unlikely(!PageSwapCache(page))) -- return; -- -- sis = page_swap_info(page); -- if (!(sis->flags & SWP_BLKDEV)) -- return; -- -- /* -- * The swap subsystem performs lazy swap slot freeing, -- * expecting that the page will be swapped out again. -- * So we can avoid an unnecessary write if the page -- * isn't redirtied. -- * This is good for real swap storage because we can -- * reduce unnecessary I/O and enhance wear-leveling -- * if an SSD is used as the as swap device. -- * But if in-memory swap device (eg zram) is used, -- * this causes a duplicated copy between uncompressed -- * data in VM-owned memory and compressed data in -- * zram-owned memory. So let's free zram-owned memory -- * and make the VM-owned decompressed page *dirty*, -- * so the page should be swapped out somewhere again if -- * we again wish to reclaim it. -- */ -- disk = sis->bdev->bd_disk; -- entry.val = page_private(page); -- if (disk->fops->swap_slot_free_notify && __swap_count(entry) == 1) { -- unsigned long offset; -- -- offset = swp_offset(entry); -- -- SetPageDirty(page); -- disk->fops->swap_slot_free_notify(sis->bdev, -- offset); -- } --} -- - static void end_swap_bio_read(struct bio *bio) - { - struct page *page = bio_first_page_all(bio); -@@ -132,7 +84,6 @@ static void end_swap_bio_read(struct bio *bio) - } - - SetPageUptodate(page); -- swap_slot_free_notify(page); - out: - unlock_page(page); - WRITE_ONCE(bio->bi_private, NULL); -@@ -371,11 +322,6 @@ int swap_readpage(struct page *page, bool synchronous) - - ret = bdev_read_page(sis->bdev, swap_page_sector(page), page); - if (!ret) { -- if (trylock_page(page)) { -- swap_slot_free_notify(page); -- unlock_page(page); -- } -- - count_vm_event(PSWPIN); - return 0; - } -diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c -index b1ecc91955172..cac2fdd08df05 100644 ---- a/net/ipv4/igmp.c -+++ b/net/ipv4/igmp.c -@@ -2403,9 +2403,10 @@ int ip_mc_source(int add, int omode, struct sock *sk, struct - newpsl->sl_addr[i] = psl->sl_addr[i]; - /* decrease mem now to avoid the memleak warning */ - atomic_sub(IP_SFLSIZE(psl->sl_max), &sk->sk_omem_alloc); -- kfree_rcu(psl, rcu); - } - rcu_assign_pointer(pmc->sflist, newpsl); -+ if (psl) -+ kfree_rcu(psl, rcu); - psl = newpsl; - } - rv = 1; /* > 0 for insert logic below if sl_count is 0 */ -@@ -2503,11 +2504,13 @@ int ip_mc_msfilter(struct sock *sk, struct ip_msfilter *msf, int ifindex) - psl->sl_count, psl->sl_addr, 0); - /* decrease mem now to avoid the memleak warning */ - atomic_sub(IP_SFLSIZE(psl->sl_max), &sk->sk_omem_alloc); -- kfree_rcu(psl, rcu); -- } else -+ } else { - (void) ip_mc_del_src(in_dev, &msf->imsf_multiaddr, pmc->sfmode, - 0, NULL, 0); -+ } - rcu_assign_pointer(pmc->sflist, newpsl); -+ if (psl) -+ kfree_rcu(psl, rcu); - pmc->sfmode = msf->imsf_fmode; - err = 0; - done: -diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c -index 2b45d14555926..6811174ad5189 100644 ---- a/net/ipv4/syncookies.c -+++ b/net/ipv4/syncookies.c -@@ -332,6 +332,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb) - - ireq = inet_rsk(req); - treq = tcp_rsk(req); -+ treq->af_specific = &tcp_request_sock_ipv4_ops; - treq->rcv_isn = ntohl(th->seq) - 1; - treq->snt_isn = cookie; - treq->ts_off = 0; -diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c -index 426d70d45eda4..72fe93ace7d73 100644 ---- a/net/ipv4/tcp_ipv4.c -+++ b/net/ipv4/tcp_ipv4.c -@@ -1383,7 +1383,7 @@ struct request_sock_ops tcp_request_sock_ops __read_mostly = { - .syn_ack_timeout = tcp_syn_ack_timeout, - }; - --static const struct tcp_request_sock_ops tcp_request_sock_ipv4_ops = { -+const struct tcp_request_sock_ops tcp_request_sock_ipv4_ops = { - .mss_clamp = TCP_MSS_DEFAULT, - #ifdef CONFIG_TCP_MD5SIG - .req_md5_lookup = tcp_v4_md5_lookup, -diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c -index 69aef71f32ea7..92b32d131e1c3 100644 ---- a/net/ipv6/addrconf.c -+++ b/net/ipv6/addrconf.c -@@ -3715,6 +3715,7 @@ static int addrconf_ifdown(struct net_device *dev, int how) - struct inet6_dev *idev; - struct inet6_ifaddr *ifa, *tmp; - bool keep_addr = false; -+ bool was_ready; - int state, i; - - ASSERT_RTNL(); -@@ -3780,7 +3781,10 @@ restart: - - addrconf_del_rs_timer(idev); - -- /* Step 2: clear flags for stateless addrconf */ -+ /* Step 2: clear flags for stateless addrconf, repeated down -+ * detection -+ */ -+ was_ready = idev->if_flags & IF_READY; - if (!how) - idev->if_flags &= ~(IF_RS_SENT|IF_RA_RCVD|IF_READY); - -@@ -3854,7 +3858,7 @@ restart: - if (how) { - ipv6_ac_destroy_dev(idev); - ipv6_mc_destroy_dev(idev); -- } else { -+ } else if (was_ready) { - ipv6_mc_down(idev); - } - -diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c -index ec155844012b2..37ab254f7b92d 100644 ---- a/net/ipv6/syncookies.c -+++ b/net/ipv6/syncookies.c -@@ -176,6 +176,7 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb) - - ireq = inet_rsk(req); - treq = tcp_rsk(req); -+ treq->af_specific = &tcp_request_sock_ipv6_ops; - treq->tfo_listener = false; - - if (security_inet_conn_request(sk, skb, req)) -diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c -index 51c900e9bfe20..063898cae3e5c 100644 ---- a/net/ipv6/tcp_ipv6.c -+++ b/net/ipv6/tcp_ipv6.c -@@ -800,7 +800,7 @@ struct request_sock_ops tcp6_request_sock_ops __read_mostly = { - .syn_ack_timeout = tcp_syn_ack_timeout, - }; - --static const struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = { -+const struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = { - .mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - - sizeof(struct ipv6hdr), - #ifdef CONFIG_TCP_MD5SIG -diff --git a/net/nfc/core.c b/net/nfc/core.c -index e752692d36802..63701a980ee12 100644 ---- a/net/nfc/core.c -+++ b/net/nfc/core.c -@@ -38,7 +38,7 @@ int nfc_fw_download(struct nfc_dev *dev, const char *firmware_name) - - device_lock(&dev->dev); - -- if (!device_is_registered(&dev->dev)) { -+ if (dev->shutting_down) { - rc = -ENODEV; - goto error; - } -@@ -94,7 +94,7 @@ int nfc_dev_up(struct nfc_dev *dev) - - device_lock(&dev->dev); - -- if (!device_is_registered(&dev->dev)) { -+ if (dev->shutting_down) { - rc = -ENODEV; - goto error; - } -@@ -142,7 +142,7 @@ int nfc_dev_down(struct nfc_dev *dev) - - device_lock(&dev->dev); - -- if (!device_is_registered(&dev->dev)) { -+ if (dev->shutting_down) { - rc = -ENODEV; - goto error; - } -@@ -206,7 +206,7 @@ int nfc_start_poll(struct nfc_dev *dev, u32 im_protocols, u32 tm_protocols) - - device_lock(&dev->dev); - -- if (!device_is_registered(&dev->dev)) { -+ if (dev->shutting_down) { - rc = -ENODEV; - goto error; - } -@@ -245,7 +245,7 @@ int nfc_stop_poll(struct nfc_dev *dev) - - device_lock(&dev->dev); - -- if (!device_is_registered(&dev->dev)) { -+ if (dev->shutting_down) { - rc = -ENODEV; - goto error; - } -@@ -290,7 +290,7 @@ int nfc_dep_link_up(struct nfc_dev *dev, int target_index, u8 comm_mode) - - device_lock(&dev->dev); - -- if (!device_is_registered(&dev->dev)) { -+ if (dev->shutting_down) { - rc = -ENODEV; - goto error; - } -@@ -334,7 +334,7 @@ int nfc_dep_link_down(struct nfc_dev *dev) - - device_lock(&dev->dev); - -- if (!device_is_registered(&dev->dev)) { -+ if (dev->shutting_down) { - rc = -ENODEV; - goto error; - } -@@ -400,7 +400,7 @@ int nfc_activate_target(struct nfc_dev *dev, u32 target_idx, u32 protocol) - - device_lock(&dev->dev); - -- if (!device_is_registered(&dev->dev)) { -+ if (dev->shutting_down) { - rc = -ENODEV; - goto error; - } -@@ -446,7 +446,7 @@ int nfc_deactivate_target(struct nfc_dev *dev, u32 target_idx, u8 mode) - - device_lock(&dev->dev); - -- if (!device_is_registered(&dev->dev)) { -+ if (dev->shutting_down) { - rc = -ENODEV; - goto error; - } -@@ -493,7 +493,7 @@ int nfc_data_exchange(struct nfc_dev *dev, u32 target_idx, struct sk_buff *skb, - - device_lock(&dev->dev); - -- if (!device_is_registered(&dev->dev)) { -+ if (dev->shutting_down) { - rc = -ENODEV; - kfree_skb(skb); - goto error; -@@ -550,7 +550,7 @@ int nfc_enable_se(struct nfc_dev *dev, u32 se_idx) - - device_lock(&dev->dev); - -- if (!device_is_registered(&dev->dev)) { -+ if (dev->shutting_down) { - rc = -ENODEV; - goto error; - } -@@ -599,7 +599,7 @@ int nfc_disable_se(struct nfc_dev *dev, u32 se_idx) - - device_lock(&dev->dev); - -- if (!device_is_registered(&dev->dev)) { -+ if (dev->shutting_down) { - rc = -ENODEV; - goto error; - } -@@ -1127,6 +1127,7 @@ int nfc_register_device(struct nfc_dev *dev) - dev->rfkill = NULL; - } - } -+ dev->shutting_down = false; - device_unlock(&dev->dev); - - rc = nfc_genl_device_added(dev); -@@ -1159,12 +1160,10 @@ void nfc_unregister_device(struct nfc_dev *dev) - rfkill_unregister(dev->rfkill); - rfkill_destroy(dev->rfkill); - } -+ dev->shutting_down = true; - device_unlock(&dev->dev); - - if (dev->ops->check_presence) { -- device_lock(&dev->dev); -- dev->shutting_down = true; -- device_unlock(&dev->dev); - del_timer_sync(&dev->check_pres_timer); - cancel_work_sync(&dev->check_pres_work); - } -diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c -index 4d90cbdc083b5..9e94f732e717c 100644 ---- a/net/nfc/netlink.c -+++ b/net/nfc/netlink.c -@@ -1252,7 +1252,7 @@ int nfc_genl_fw_download_done(struct nfc_dev *dev, const char *firmware_name, - struct sk_buff *msg; - void *hdr; - -- msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); -+ msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC); - if (!msg) - return -ENOMEM; - -@@ -1268,7 +1268,7 @@ int nfc_genl_fw_download_done(struct nfc_dev *dev, const char *firmware_name, - - genlmsg_end(msg, hdr); - -- genlmsg_multicast(&nfc_genl_family, msg, 0, 0, GFP_KERNEL); -+ genlmsg_multicast(&nfc_genl_family, msg, 0, 0, GFP_ATOMIC); - - return 0; - -diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c -index 480e879e74ae5..43bc02dea80c8 100644 ---- a/net/sunrpc/xprtsock.c -+++ b/net/sunrpc/xprtsock.c -@@ -2963,9 +2963,6 @@ static struct rpc_xprt *xs_setup_local(struct xprt_create *args) - } - xprt_set_bound(xprt); - xs_format_peer_addresses(xprt, "local", RPCBIND_NETID_LOCAL); -- ret = ERR_PTR(xs_local_setup_socket(transport)); -- if (ret) -- goto out_err; - break; - default: - ret = ERR_PTR(-EAFNOSUPPORT); -diff --git a/sound/core/pcm.c b/sound/core/pcm.c -index f8ce961c28d6e..3561cdceaadc2 100644 ---- a/sound/core/pcm.c -+++ b/sound/core/pcm.c -@@ -969,6 +969,8 @@ int snd_pcm_attach_substream(struct snd_pcm *pcm, int stream, - init_waitqueue_head(&runtime->tsleep); - - runtime->status->state = SNDRV_PCM_STATE_OPEN; -+ mutex_init(&runtime->buffer_mutex); -+ atomic_set(&runtime->buffer_accessing, 0); - - substream->runtime = runtime; - substream->private_data = pcm->private_data; -@@ -1000,6 +1002,7 @@ void snd_pcm_detach_substream(struct snd_pcm_substream *substream) - substream->runtime = NULL; - if (substream->timer) - spin_unlock_irq(&substream->timer->lock); -+ mutex_destroy(&runtime->buffer_mutex); - kfree(runtime); - put_pid(substream->pid); - substream->pid = NULL; -diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c -index fd300c3adddec..1bce55533519d 100644 ---- a/sound/core/pcm_lib.c -+++ b/sound/core/pcm_lib.c -@@ -2211,10 +2211,15 @@ snd_pcm_sframes_t __snd_pcm_lib_xfer(struct snd_pcm_substream *substream, - err = -EINVAL; - goto _end_unlock; - } -+ if (!atomic_inc_unless_negative(&runtime->buffer_accessing)) { -+ err = -EBUSY; -+ goto _end_unlock; -+ } - snd_pcm_stream_unlock_irq(substream); - err = writer(substream, appl_ofs, data, offset, frames, - transfer); - snd_pcm_stream_lock_irq(substream); -+ atomic_dec(&runtime->buffer_accessing); - if (err < 0) - goto _end_unlock; - err = pcm_accessible_state(runtime); -diff --git a/sound/core/pcm_memory.c b/sound/core/pcm_memory.c -index 7600dcdf5fd4d..9aea1d6fb0547 100644 ---- a/sound/core/pcm_memory.c -+++ b/sound/core/pcm_memory.c -@@ -133,19 +133,20 @@ static void snd_pcm_lib_preallocate_proc_write(struct snd_info_entry *entry, - size_t size; - struct snd_dma_buffer new_dmab; - -+ mutex_lock(&substream->pcm->open_mutex); - if (substream->runtime) { - buffer->error = -EBUSY; -- return; -+ goto unlock; - } - if (!snd_info_get_line(buffer, line, sizeof(line))) { - snd_info_get_str(str, line, sizeof(str)); - size = simple_strtoul(str, NULL, 10) * 1024; - if ((size != 0 && size < 8192) || size > substream->dma_max) { - buffer->error = -EINVAL; -- return; -+ goto unlock; - } - if (substream->dma_buffer.bytes == size) -- return; -+ goto unlock; - memset(&new_dmab, 0, sizeof(new_dmab)); - new_dmab.dev = substream->dma_buffer.dev; - if (size > 0) { -@@ -153,7 +154,7 @@ static void snd_pcm_lib_preallocate_proc_write(struct snd_info_entry *entry, - substream->dma_buffer.dev.dev, - size, &new_dmab) < 0) { - buffer->error = -ENOMEM; -- return; -+ goto unlock; - } - substream->buffer_bytes_max = size; - } else { -@@ -165,6 +166,8 @@ static void snd_pcm_lib_preallocate_proc_write(struct snd_info_entry *entry, - } else { - buffer->error = -EINVAL; - } -+ unlock: -+ mutex_unlock(&substream->pcm->open_mutex); - } - - static inline void preallocate_info_init(struct snd_pcm_substream *substream) -diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c -index dbe9a65cc1d45..57a4991fa0f36 100644 ---- a/sound/core/pcm_native.c -+++ b/sound/core/pcm_native.c -@@ -630,6 +630,30 @@ static int snd_pcm_hw_params_choose(struct snd_pcm_substream *pcm, - return 0; - } - -+/* acquire buffer_mutex; if it's in r/w operation, return -EBUSY, otherwise -+ * block the further r/w operations -+ */ -+static int snd_pcm_buffer_access_lock(struct snd_pcm_runtime *runtime) -+{ -+ if (!atomic_dec_unless_positive(&runtime->buffer_accessing)) -+ return -EBUSY; -+ mutex_lock(&runtime->buffer_mutex); -+ return 0; /* keep buffer_mutex, unlocked by below */ -+} -+ -+/* release buffer_mutex and clear r/w access flag */ -+static void snd_pcm_buffer_access_unlock(struct snd_pcm_runtime *runtime) -+{ -+ mutex_unlock(&runtime->buffer_mutex); -+ atomic_inc(&runtime->buffer_accessing); -+} -+ -+#if IS_ENABLED(CONFIG_SND_PCM_OSS) -+#define is_oss_stream(substream) ((substream)->oss.oss) -+#else -+#define is_oss_stream(substream) false -+#endif -+ - static int snd_pcm_hw_params(struct snd_pcm_substream *substream, - struct snd_pcm_hw_params *params) - { -@@ -641,22 +665,25 @@ static int snd_pcm_hw_params(struct snd_pcm_substream *substream, - if (PCM_RUNTIME_CHECK(substream)) - return -ENXIO; - runtime = substream->runtime; -+ err = snd_pcm_buffer_access_lock(runtime); -+ if (err < 0) -+ return err; - snd_pcm_stream_lock_irq(substream); - switch (runtime->status->state) { - case SNDRV_PCM_STATE_OPEN: - case SNDRV_PCM_STATE_SETUP: - case SNDRV_PCM_STATE_PREPARED: -+ if (!is_oss_stream(substream) && -+ atomic_read(&substream->mmap_count)) -+ err = -EBADFD; - break; - default: -- snd_pcm_stream_unlock_irq(substream); -- return -EBADFD; -+ err = -EBADFD; -+ break; - } - snd_pcm_stream_unlock_irq(substream); --#if IS_ENABLED(CONFIG_SND_PCM_OSS) -- if (!substream->oss.oss) --#endif -- if (atomic_read(&substream->mmap_count)) -- return -EBADFD; -+ if (err) -+ goto unlock; - - params->rmask = ~0U; - err = snd_pcm_hw_refine(substream, params); -@@ -733,14 +760,19 @@ static int snd_pcm_hw_params(struct snd_pcm_substream *substream, - if ((usecs = period_to_usecs(runtime)) >= 0) - pm_qos_add_request(&substream->latency_pm_qos_req, - PM_QOS_CPU_DMA_LATENCY, usecs); -- return 0; -+ err = 0; - _error: -- /* hardware might be unusable from this time, -- so we force application to retry to set -- the correct hardware parameter settings */ -- snd_pcm_set_state(substream, SNDRV_PCM_STATE_OPEN); -- if (substream->ops->hw_free != NULL) -- substream->ops->hw_free(substream); -+ if (err) { -+ /* hardware might be unusable from this time, -+ * so we force application to retry to set -+ * the correct hardware parameter settings -+ */ -+ snd_pcm_set_state(substream, SNDRV_PCM_STATE_OPEN); -+ if (substream->ops->hw_free != NULL) -+ substream->ops->hw_free(substream); -+ } -+ unlock: -+ snd_pcm_buffer_access_unlock(runtime); - return err; - } - -@@ -773,22 +805,29 @@ static int snd_pcm_hw_free(struct snd_pcm_substream *substream) - if (PCM_RUNTIME_CHECK(substream)) - return -ENXIO; - runtime = substream->runtime; -+ result = snd_pcm_buffer_access_lock(runtime); -+ if (result < 0) -+ return result; - snd_pcm_stream_lock_irq(substream); - switch (runtime->status->state) { - case SNDRV_PCM_STATE_SETUP: - case SNDRV_PCM_STATE_PREPARED: -+ if (atomic_read(&substream->mmap_count)) -+ result = -EBADFD; - break; - default: -- snd_pcm_stream_unlock_irq(substream); -- return -EBADFD; -+ result = -EBADFD; -+ break; - } - snd_pcm_stream_unlock_irq(substream); -- if (atomic_read(&substream->mmap_count)) -- return -EBADFD; -+ if (result) -+ goto unlock; - if (substream->ops->hw_free) - result = substream->ops->hw_free(substream); - snd_pcm_set_state(substream, SNDRV_PCM_STATE_OPEN); - pm_qos_remove_request(&substream->latency_pm_qos_req); -+ unlock: -+ snd_pcm_buffer_access_unlock(runtime); - return result; - } - -@@ -1025,15 +1064,17 @@ struct action_ops { - */ - static int snd_pcm_action_group(const struct action_ops *ops, - struct snd_pcm_substream *substream, -- int state, int do_lock) -+ int state, int stream_lock) - { - struct snd_pcm_substream *s = NULL; - struct snd_pcm_substream *s1; - int res = 0, depth = 1; - - snd_pcm_group_for_each_entry(s, substream) { -- if (do_lock && s != substream) { -- if (s->pcm->nonatomic) -+ if (s != substream) { -+ if (!stream_lock) -+ mutex_lock_nested(&s->runtime->buffer_mutex, depth); -+ else if (s->pcm->nonatomic) - mutex_lock_nested(&s->self_group.mutex, depth); - else - spin_lock_nested(&s->self_group.lock, depth); -@@ -1061,18 +1102,18 @@ static int snd_pcm_action_group(const struct action_ops *ops, - ops->post_action(s, state); - } - _unlock: -- if (do_lock) { -- /* unlock streams */ -- snd_pcm_group_for_each_entry(s1, substream) { -- if (s1 != substream) { -- if (s1->pcm->nonatomic) -- mutex_unlock(&s1->self_group.mutex); -- else -- spin_unlock(&s1->self_group.lock); -- } -- if (s1 == s) /* end */ -- break; -+ /* unlock streams */ -+ snd_pcm_group_for_each_entry(s1, substream) { -+ if (s1 != substream) { -+ if (!stream_lock) -+ mutex_unlock(&s1->runtime->buffer_mutex); -+ else if (s1->pcm->nonatomic) -+ mutex_unlock(&s1->self_group.mutex); -+ else -+ spin_unlock(&s1->self_group.lock); - } -+ if (s1 == s) /* end */ -+ break; - } - return res; - } -@@ -1202,10 +1243,15 @@ static int snd_pcm_action_nonatomic(const struct action_ops *ops, - - /* Guarantee the group members won't change during non-atomic action */ - down_read(&snd_pcm_link_rwsem); -+ res = snd_pcm_buffer_access_lock(substream->runtime); -+ if (res < 0) -+ goto unlock; - if (snd_pcm_stream_linked(substream)) - res = snd_pcm_action_group(ops, substream, state, 0); - else - res = snd_pcm_action_single(ops, substream, state); -+ snd_pcm_buffer_access_unlock(substream->runtime); -+ unlock: - up_read(&snd_pcm_link_rwsem); - return res; - } -diff --git a/sound/firewire/fireworks/fireworks_hwdep.c b/sound/firewire/fireworks/fireworks_hwdep.c -index e93eb4616c5f4..c739173c668f3 100644 ---- a/sound/firewire/fireworks/fireworks_hwdep.c -+++ b/sound/firewire/fireworks/fireworks_hwdep.c -@@ -34,6 +34,7 @@ hwdep_read_resp_buf(struct snd_efw *efw, char __user *buf, long remained, - type = SNDRV_FIREWIRE_EVENT_EFW_RESPONSE; - if (copy_to_user(buf, &type, sizeof(type))) - return -EFAULT; -+ count += sizeof(type); - remained -= sizeof(type); - buf += sizeof(type); - -diff --git a/sound/soc/codecs/da7219.c b/sound/soc/codecs/da7219.c -index f83a6eaba12cb..ef8bd9e046374 100644 ---- a/sound/soc/codecs/da7219.c -+++ b/sound/soc/codecs/da7219.c -@@ -446,7 +446,7 @@ static int da7219_tonegen_freq_put(struct snd_kcontrol *kcontrol, - struct soc_mixer_control *mixer_ctrl = - (struct soc_mixer_control *) kcontrol->private_value; - unsigned int reg = mixer_ctrl->reg; -- __le16 val; -+ __le16 val_new, val_old; - int ret; - - /* -@@ -454,13 +454,19 @@ static int da7219_tonegen_freq_put(struct snd_kcontrol *kcontrol, - * Therefore we need to convert to little endian here to align with - * HW registers. - */ -- val = cpu_to_le16(ucontrol->value.integer.value[0]); -+ val_new = cpu_to_le16(ucontrol->value.integer.value[0]); - - mutex_lock(&da7219->ctrl_lock); -- ret = regmap_raw_write(da7219->regmap, reg, &val, sizeof(val)); -+ ret = regmap_raw_read(da7219->regmap, reg, &val_old, sizeof(val_old)); -+ if (ret == 0 && (val_old != val_new)) -+ ret = regmap_raw_write(da7219->regmap, reg, -+ &val_new, sizeof(val_new)); - mutex_unlock(&da7219->ctrl_lock); - -- return ret; -+ if (ret < 0) -+ return ret; -+ -+ return val_old != val_new; - } - - -diff --git a/sound/soc/codecs/wm8958-dsp2.c b/sound/soc/codecs/wm8958-dsp2.c -index 04f23477039a5..c677c068b05ec 100644 ---- a/sound/soc/codecs/wm8958-dsp2.c -+++ b/sound/soc/codecs/wm8958-dsp2.c -@@ -534,7 +534,7 @@ static int wm8958_mbc_put(struct snd_kcontrol *kcontrol, - - wm8958_dsp_apply(component, mbc, wm8994->mbc_ena[mbc]); - -- return 0; -+ return 1; - } - - #define WM8958_MBC_SWITCH(xname, xval) {\ -@@ -660,7 +660,7 @@ static int wm8958_vss_put(struct snd_kcontrol *kcontrol, - - wm8958_dsp_apply(component, vss, wm8994->vss_ena[vss]); - -- return 0; -+ return 1; - } - - -@@ -734,7 +734,7 @@ static int wm8958_hpf_put(struct snd_kcontrol *kcontrol, - - wm8958_dsp_apply(component, hpf % 3, ucontrol->value.integer.value[0]); - -- return 0; -+ return 1; - } - - #define WM8958_HPF_SWITCH(xname, xval) {\ -@@ -828,7 +828,7 @@ static int wm8958_enh_eq_put(struct snd_kcontrol *kcontrol, - - wm8958_dsp_apply(component, eq, ucontrol->value.integer.value[0]); - -- return 0; -+ return 1; - } - - #define WM8958_ENH_EQ_SWITCH(xname, xval) {\ -diff --git a/sound/soc/meson/g12a-tohdmitx.c b/sound/soc/meson/g12a-tohdmitx.c -index 9cfbd343a00c8..cbe47e0cae426 100644 ---- a/sound/soc/meson/g12a-tohdmitx.c -+++ b/sound/soc/meson/g12a-tohdmitx.c -@@ -127,7 +127,7 @@ static int g12a_tohdmitx_i2s_mux_put_enum(struct snd_kcontrol *kcontrol, - - snd_soc_dapm_mux_update_power(dapm, kcontrol, mux, e, NULL); - -- return 0; -+ return 1; - } - - static const struct snd_kcontrol_new g12a_tohdmitx_i2s_mux = -diff --git a/sound/soc/soc-generic-dmaengine-pcm.c b/sound/soc/soc-generic-dmaengine-pcm.c -index ca4b17bd95d14..5552c66ca6422 100644 ---- a/sound/soc/soc-generic-dmaengine-pcm.c -+++ b/sound/soc/soc-generic-dmaengine-pcm.c -@@ -91,10 +91,10 @@ static int dmaengine_pcm_hw_params(struct snd_pcm_substream *substream, - - memset(&slave_config, 0, sizeof(slave_config)); - -- if (pcm->config && pcm->config->prepare_slave_config) -- prepare_slave_config = pcm->config->prepare_slave_config; -- else -+ if (!pcm->config) - prepare_slave_config = snd_dmaengine_pcm_prepare_slave_config; -+ else -+ prepare_slave_config = pcm->config->prepare_slave_config; - - if (prepare_slave_config) { - ret = prepare_slave_config(substream, params, &slave_config); -diff --git a/tools/testing/selftests/net/forwarding/mirror_gre_bridge_1q.sh b/tools/testing/selftests/net/forwarding/mirror_gre_bridge_1q.sh -index a3402cd8d5b68..9ff22f28032dd 100755 ---- a/tools/testing/selftests/net/forwarding/mirror_gre_bridge_1q.sh -+++ b/tools/testing/selftests/net/forwarding/mirror_gre_bridge_1q.sh -@@ -61,9 +61,12 @@ setup_prepare() - - vrf_prepare - mirror_gre_topo_create -+ # Avoid changing br1's PVID while it is operational as a L3 interface. -+ ip link set dev br1 down - - ip link set dev $swp3 master br1 - bridge vlan add dev br1 vid 555 pvid untagged self -+ ip link set dev br1 up - ip address add dev br1 192.0.2.129/28 - ip address add dev br1 2001:db8:2::1/64 - diff --git a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.193-194.patch b/patch/kernel/archive/odroidxu4-5.4/patch-5.4.193-194.patch deleted file mode 100644 index 2e2384967..000000000 --- a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.193-194.patch +++ /dev/null @@ -1,1095 +0,0 @@ -diff --git a/Documentation/vm/memory-model.rst b/Documentation/vm/memory-model.rst -index 58a12376b7df7..94db75ba7fbe2 100644 ---- a/Documentation/vm/memory-model.rst -+++ b/Documentation/vm/memory-model.rst -@@ -52,8 +52,7 @@ wrapper :c:func:`free_area_init`. Yet, the mappings array is not - usable until the call to :c:func:`memblock_free_all` that hands all - the memory to the page allocator. - --If an architecture enables `CONFIG_ARCH_HAS_HOLES_MEMORYMODEL` option, --it may free parts of the `mem_map` array that do not cover the -+An architecture may free parts of the `mem_map` array that do not cover the - actual physical pages. In such case, the architecture specific - :c:func:`pfn_valid` implementation should take the holes in the - `mem_map` into account. -diff --git a/Makefile b/Makefile -index 888d896058553..044a85fea9216 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 5 - PATCHLEVEL = 4 --SUBLEVEL = 193 -+SUBLEVEL = 194 - EXTRAVERSION = - NAME = Kleptomaniac Octopus - -diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig -index 4b36bbcf5a5b4..a1622b9290fd5 100644 ---- a/arch/arm/Kconfig -+++ b/arch/arm/Kconfig -@@ -26,7 +26,7 @@ config ARM - select ARCH_HAS_TICK_BROADCAST if GENERIC_CLOCKEVENTS_BROADCAST - select ARCH_HAVE_CUSTOM_GPIO_H - select ARCH_HAS_GCOV_PROFILE_ALL -- select ARCH_KEEP_MEMBLOCK if HAVE_ARCH_PFN_VALID || KEXEC -+ select ARCH_KEEP_MEMBLOCK - select ARCH_MIGHT_HAVE_PC_PARPORT - select ARCH_NO_SG_CHAIN if !ARM_HAS_SG_CHAIN - select ARCH_OPTIONAL_KERNEL_RWX if ARCH_HAS_STRICT_KERNEL_RWX -@@ -521,7 +521,6 @@ config ARCH_S3C24XX - config ARCH_OMAP1 - bool "TI OMAP1" - depends on MMU -- select ARCH_HAS_HOLES_MEMORYMODEL - select ARCH_OMAP - select CLKDEV_LOOKUP - select CLKSRC_MMIO -@@ -1518,9 +1517,6 @@ config OABI_COMPAT - UNPREDICTABLE (in fact it can be predicted that it won't work - at all). If in doubt say N. - --config ARCH_HAS_HOLES_MEMORYMODEL -- bool -- - config ARCH_SPARSEMEM_ENABLE - bool - -@@ -1528,7 +1524,7 @@ config ARCH_SPARSEMEM_DEFAULT - def_bool ARCH_SPARSEMEM_ENABLE - - config HAVE_ARCH_PFN_VALID -- def_bool ARCH_HAS_HOLES_MEMORYMODEL || !SPARSEMEM -+ def_bool y - - config HIGHMEM - bool "High Memory Support" -diff --git a/arch/arm/mach-bcm/Kconfig b/arch/arm/mach-bcm/Kconfig -index 5e5f1fabc3d40..634d1bc3c0114 100644 ---- a/arch/arm/mach-bcm/Kconfig -+++ b/arch/arm/mach-bcm/Kconfig -@@ -214,7 +214,6 @@ config ARCH_BRCMSTB - select HAVE_ARM_ARCH_TIMER - select BRCMSTB_L2_IRQ - select BCM7120_L2_IRQ -- select ARCH_HAS_HOLES_MEMORYMODEL - select ZONE_DMA if ARM_LPAE - select SOC_BRCMSTB - select SOC_BUS -diff --git a/arch/arm/mach-davinci/Kconfig b/arch/arm/mach-davinci/Kconfig -index 02b180ad72454..4d3b7d0418c40 100644 ---- a/arch/arm/mach-davinci/Kconfig -+++ b/arch/arm/mach-davinci/Kconfig -@@ -5,7 +5,6 @@ menuconfig ARCH_DAVINCI - depends on ARCH_MULTI_V5 - select DAVINCI_TIMER - select ZONE_DMA -- select ARCH_HAS_HOLES_MEMORYMODEL - select PM_GENERIC_DOMAINS if PM - select PM_GENERIC_DOMAINS_OF if PM && OF - select REGMAP_MMIO -diff --git a/arch/arm/mach-exynos/Kconfig b/arch/arm/mach-exynos/Kconfig -index 9dab1f50a02f8..fc01137628e4b 100644 ---- a/arch/arm/mach-exynos/Kconfig -+++ b/arch/arm/mach-exynos/Kconfig -@@ -8,7 +8,6 @@ - menuconfig ARCH_EXYNOS - bool "Samsung EXYNOS" - depends on ARCH_MULTI_V7 -- select ARCH_HAS_HOLES_MEMORYMODEL - select ARCH_SUPPORTS_BIG_ENDIAN - select ARM_AMBA - select ARM_GIC -diff --git a/arch/arm/mach-highbank/Kconfig b/arch/arm/mach-highbank/Kconfig -index 1bc68913d62c1..9de38ce8124f2 100644 ---- a/arch/arm/mach-highbank/Kconfig -+++ b/arch/arm/mach-highbank/Kconfig -@@ -2,7 +2,6 @@ - config ARCH_HIGHBANK - bool "Calxeda ECX-1000/2000 (Highbank/Midway)" - depends on ARCH_MULTI_V7 -- select ARCH_HAS_HOLES_MEMORYMODEL - select ARCH_SUPPORTS_BIG_ENDIAN - select ARM_AMBA - select ARM_ERRATA_764369 if SMP -diff --git a/arch/arm/mach-omap2/Kconfig b/arch/arm/mach-omap2/Kconfig -index fdb6743760a2e..0211f4aa8cc75 100644 ---- a/arch/arm/mach-omap2/Kconfig -+++ b/arch/arm/mach-omap2/Kconfig -@@ -94,7 +94,7 @@ config SOC_DRA7XX - config ARCH_OMAP2PLUS - bool - select ARCH_HAS_BANDGAP -- select ARCH_HAS_HOLES_MEMORYMODEL -+ select ARCH_HAS_RESET_CONTROLLER - select ARCH_OMAP - select CLKSRC_MMIO - select GENERIC_IRQ_CHIP -diff --git a/arch/arm/mach-s5pv210/Kconfig b/arch/arm/mach-s5pv210/Kconfig -index 03984a7918791..69ff1bb89f38f 100644 ---- a/arch/arm/mach-s5pv210/Kconfig -+++ b/arch/arm/mach-s5pv210/Kconfig -@@ -8,7 +8,6 @@ - config ARCH_S5PV210 - bool "Samsung S5PV210/S5PC110" - depends on ARCH_MULTI_V7 -- select ARCH_HAS_HOLES_MEMORYMODEL - select ARM_VIC - select CLKSRC_SAMSUNG_PWM - select COMMON_CLK_SAMSUNG -diff --git a/arch/arm/mach-tango/Kconfig b/arch/arm/mach-tango/Kconfig -index 25b2fd4348617..a9eeda36aeb15 100644 ---- a/arch/arm/mach-tango/Kconfig -+++ b/arch/arm/mach-tango/Kconfig -@@ -3,7 +3,6 @@ config ARCH_TANGO - bool "Sigma Designs Tango4 (SMP87xx)" - depends on ARCH_MULTI_V7 - # Cortex-A9 MPCore r3p0, PL310 r3p2 -- select ARCH_HAS_HOLES_MEMORYMODEL - select ARM_ERRATA_754322 - select ARM_ERRATA_764369 if SMP - select ARM_ERRATA_775420 -diff --git a/arch/mips/bmips/setup.c b/arch/mips/bmips/setup.c -index 2f81a94c71a60..7aee9ff19c1a6 100644 ---- a/arch/mips/bmips/setup.c -+++ b/arch/mips/bmips/setup.c -@@ -167,7 +167,7 @@ void __init plat_mem_setup(void) - dtb = phys_to_virt(fw_arg2); - else if (fw_passed_dtb) /* UHI interface or appended dtb */ - dtb = (void *)fw_passed_dtb; -- else if (__dtb_start != __dtb_end) -+ else if (&__dtb_start != &__dtb_end) - dtb = (void *)__dtb_start; - else - panic("no dtb found"); -diff --git a/arch/mips/lantiq/prom.c b/arch/mips/lantiq/prom.c -index 51a218f04fe0d..3f568f5aae2d1 100644 ---- a/arch/mips/lantiq/prom.c -+++ b/arch/mips/lantiq/prom.c -@@ -79,7 +79,7 @@ void __init plat_mem_setup(void) - - if (fw_passed_dtb) /* UHI interface */ - dtb = (void *)fw_passed_dtb; -- else if (__dtb_start != __dtb_end) -+ else if (&__dtb_start != &__dtb_end) - dtb = (void *)__dtb_start; - else - panic("no dtb found"); -diff --git a/arch/mips/pic32/pic32mzda/init.c b/arch/mips/pic32/pic32mzda/init.c -index 50f376f058f43..f232c77ff5265 100644 ---- a/arch/mips/pic32/pic32mzda/init.c -+++ b/arch/mips/pic32/pic32mzda/init.c -@@ -28,7 +28,7 @@ static ulong get_fdtaddr(void) - if (fw_passed_dtb && !fw_arg2 && !fw_arg3) - return (ulong)fw_passed_dtb; - -- if (__dtb_start < __dtb_end) -+ if (&__dtb_start < &__dtb_end) - ftaddr = (ulong)__dtb_start; - - return ftaddr; -diff --git a/arch/mips/ralink/of.c b/arch/mips/ralink/of.c -index 4e38a905ab386..e2c71c6c667da 100644 ---- a/arch/mips/ralink/of.c -+++ b/arch/mips/ralink/of.c -@@ -77,7 +77,7 @@ void __init plat_mem_setup(void) - */ - if (fw_passed_dtb) - dtb = (void *)fw_passed_dtb; -- else if (__dtb_start != __dtb_end) -+ else if (&__dtb_start != &__dtb_end) - dtb = (void *)__dtb_start; - - __dt_setup_arch(dtb); -diff --git a/arch/x86/include/asm/asm.h b/arch/x86/include/asm/asm.h -index 3ff577c0b1024..1b563f9167eae 100644 ---- a/arch/x86/include/asm/asm.h -+++ b/arch/x86/include/asm/asm.h -@@ -7,9 +7,11 @@ - # define __ASM_FORM_RAW(x) x - # define __ASM_FORM_COMMA(x) x, - #else --# define __ASM_FORM(x) " " #x " " --# define __ASM_FORM_RAW(x) #x --# define __ASM_FORM_COMMA(x) " " #x "," -+#include -+ -+# define __ASM_FORM(x) " " __stringify(x) " " -+# define __ASM_FORM_RAW(x) __stringify(x) -+# define __ASM_FORM_COMMA(x) " " __stringify(x) "," - #endif - - #ifndef __x86_64__ -diff --git a/arch/x86/include/asm/emulate_prefix.h b/arch/x86/include/asm/emulate_prefix.h -new file mode 100644 -index 0000000000000..70f5b98a52869 ---- /dev/null -+++ b/arch/x86/include/asm/emulate_prefix.h -@@ -0,0 +1,14 @@ -+/* SPDX-License-Identifier: GPL-2.0 */ -+#ifndef _ASM_X86_EMULATE_PREFIX_H -+#define _ASM_X86_EMULATE_PREFIX_H -+ -+/* -+ * Virt escape sequences to trigger instruction emulation; -+ * ideally these would decode to 'whole' instruction and not destroy -+ * the instruction stream; sadly this is not true for the 'kvm' one :/ -+ */ -+ -+#define __XEN_EMULATE_PREFIX 0x0f,0x0b,0x78,0x65,0x6e /* ud2 ; .ascii "xen" */ -+#define __KVM_EMULATE_PREFIX 0x0f,0x0b,0x6b,0x76,0x6d /* ud2 ; .ascii "kvm" */ -+ -+#endif -diff --git a/arch/x86/include/asm/insn.h b/arch/x86/include/asm/insn.h -index a51ffeea6d879..a8c3d284fa46c 100644 ---- a/arch/x86/include/asm/insn.h -+++ b/arch/x86/include/asm/insn.h -@@ -45,6 +45,7 @@ struct insn { - struct insn_field immediate2; /* for 64bit imm or seg16 */ - }; - -+ int emulate_prefix_size; - insn_attr_t attr; - unsigned char opnd_bytes; - unsigned char addr_bytes; -@@ -128,6 +129,11 @@ static inline int insn_is_evex(struct insn *insn) - return (insn->vex_prefix.nbytes == 4); - } - -+static inline int insn_has_emulate_prefix(struct insn *insn) -+{ -+ return !!insn->emulate_prefix_size; -+} -+ - /* Ensure this instruction is decoded completely */ - static inline int insn_complete(struct insn *insn) - { -diff --git a/arch/x86/include/asm/xen/interface.h b/arch/x86/include/asm/xen/interface.h -index 62ca03ef5c657..9139b3e863161 100644 ---- a/arch/x86/include/asm/xen/interface.h -+++ b/arch/x86/include/asm/xen/interface.h -@@ -379,12 +379,9 @@ struct xen_pmu_arch { - * Prefix forces emulation of some non-trapping instructions. - * Currently only CPUID. - */ --#ifdef __ASSEMBLY__ --#define XEN_EMULATE_PREFIX .byte 0x0f,0x0b,0x78,0x65,0x6e ; --#define XEN_CPUID XEN_EMULATE_PREFIX cpuid --#else --#define XEN_EMULATE_PREFIX ".byte 0x0f,0x0b,0x78,0x65,0x6e ; " --#define XEN_CPUID XEN_EMULATE_PREFIX "cpuid" --#endif -+#include -+ -+#define XEN_EMULATE_PREFIX __ASM_FORM(.byte __XEN_EMULATE_PREFIX ;) -+#define XEN_CPUID XEN_EMULATE_PREFIX __ASM_FORM(cpuid) - - #endif /* _ASM_X86_XEN_INTERFACE_H */ -diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c -index c205d77d57da3..3700dc94847c6 100644 ---- a/arch/x86/kernel/kprobes/core.c -+++ b/arch/x86/kernel/kprobes/core.c -@@ -358,6 +358,10 @@ int __copy_instruction(u8 *dest, u8 *src, u8 *real, struct insn *insn) - kernel_insn_init(insn, dest, MAX_INSN_SIZE); - insn_get_length(insn); - -+ /* We can not probe force emulate prefixed instruction */ -+ if (insn_has_emulate_prefix(insn)) -+ return 0; -+ - /* Another subsystem puts a breakpoint, failed to recover */ - if (insn->opcode.bytes[0] == BREAKPOINT_INSTRUCTION) - return 0; -diff --git a/arch/x86/kvm/pmu.c b/arch/x86/kvm/pmu.c -index e0e3776059af4..32561431acde0 100644 ---- a/arch/x86/kvm/pmu.c -+++ b/arch/x86/kvm/pmu.c -@@ -143,7 +143,6 @@ static void pmc_reprogram_counter(struct kvm_pmc *pmc, u32 type, - void reprogram_gp_counter(struct kvm_pmc *pmc, u64 eventsel) - { - unsigned config, type = PERF_TYPE_RAW; -- u8 event_select, unit_mask; - struct kvm *kvm = pmc->vcpu->kvm; - struct kvm_pmu_event_filter *filter; - int i; -@@ -175,17 +174,12 @@ void reprogram_gp_counter(struct kvm_pmc *pmc, u64 eventsel) - if (!allow_event) - return; - -- event_select = eventsel & ARCH_PERFMON_EVENTSEL_EVENT; -- unit_mask = (eventsel & ARCH_PERFMON_EVENTSEL_UMASK) >> 8; -- - if (!(eventsel & (ARCH_PERFMON_EVENTSEL_EDGE | - ARCH_PERFMON_EVENTSEL_INV | - ARCH_PERFMON_EVENTSEL_CMASK | - HSW_IN_TX | - HSW_IN_TX_CHECKPOINTED))) { -- config = kvm_x86_ops->pmu_ops->find_arch_event(pmc_to_pmu(pmc), -- event_select, -- unit_mask); -+ config = kvm_x86_ops->pmu_ops->pmc_perf_hw_id(pmc); - if (config != PERF_COUNT_HW_MAX) - type = PERF_TYPE_HARDWARE; - } -diff --git a/arch/x86/kvm/pmu.h b/arch/x86/kvm/pmu.h -index 3fc98afd72a82..b63859e340e4e 100644 ---- a/arch/x86/kvm/pmu.h -+++ b/arch/x86/kvm/pmu.h -@@ -22,8 +22,7 @@ struct kvm_event_hw_type_mapping { - }; - - struct kvm_pmu_ops { -- unsigned (*find_arch_event)(struct kvm_pmu *pmu, u8 event_select, -- u8 unit_mask); -+ unsigned int (*pmc_perf_hw_id)(struct kvm_pmc *pmc); - unsigned (*find_fixed_event)(int idx); - bool (*pmc_is_enabled)(struct kvm_pmc *pmc); - struct kvm_pmc *(*pmc_idx_to_pmc)(struct kvm_pmu *pmu, int pmc_idx); -diff --git a/arch/x86/kvm/pmu_amd.c b/arch/x86/kvm/pmu_amd.c -index 6bc656abbe66d..799b9a3144e3b 100644 ---- a/arch/x86/kvm/pmu_amd.c -+++ b/arch/x86/kvm/pmu_amd.c -@@ -44,6 +44,22 @@ static struct kvm_event_hw_type_mapping amd_event_mapping[] = { - [7] = { 0xd1, 0x00, PERF_COUNT_HW_STALLED_CYCLES_BACKEND }, - }; - -+/* duplicated from amd_f17h_perfmon_event_map. */ -+static struct kvm_event_hw_type_mapping amd_f17h_event_mapping[] = { -+ [0] = { 0x76, 0x00, PERF_COUNT_HW_CPU_CYCLES }, -+ [1] = { 0xc0, 0x00, PERF_COUNT_HW_INSTRUCTIONS }, -+ [2] = { 0x60, 0xff, PERF_COUNT_HW_CACHE_REFERENCES }, -+ [3] = { 0x64, 0x09, PERF_COUNT_HW_CACHE_MISSES }, -+ [4] = { 0xc2, 0x00, PERF_COUNT_HW_BRANCH_INSTRUCTIONS }, -+ [5] = { 0xc3, 0x00, PERF_COUNT_HW_BRANCH_MISSES }, -+ [6] = { 0x87, 0x02, PERF_COUNT_HW_STALLED_CYCLES_FRONTEND }, -+ [7] = { 0x87, 0x01, PERF_COUNT_HW_STALLED_CYCLES_BACKEND }, -+}; -+ -+/* amd_pmc_perf_hw_id depends on these being the same size */ -+static_assert(ARRAY_SIZE(amd_event_mapping) == -+ ARRAY_SIZE(amd_f17h_event_mapping)); -+ - static unsigned int get_msr_base(struct kvm_pmu *pmu, enum pmu_type type) - { - struct kvm_vcpu *vcpu = pmu_to_vcpu(pmu); -@@ -126,21 +142,27 @@ static inline struct kvm_pmc *get_gp_pmc_amd(struct kvm_pmu *pmu, u32 msr, - return &pmu->gp_counters[msr_to_index(msr)]; - } - --static unsigned amd_find_arch_event(struct kvm_pmu *pmu, -- u8 event_select, -- u8 unit_mask) -+static unsigned int amd_pmc_perf_hw_id(struct kvm_pmc *pmc) - { -+ struct kvm_event_hw_type_mapping *event_mapping; -+ u8 event_select = pmc->eventsel & ARCH_PERFMON_EVENTSEL_EVENT; -+ u8 unit_mask = (pmc->eventsel & ARCH_PERFMON_EVENTSEL_UMASK) >> 8; - int i; - -+ if (guest_cpuid_family(pmc->vcpu) >= 0x17) -+ event_mapping = amd_f17h_event_mapping; -+ else -+ event_mapping = amd_event_mapping; -+ - for (i = 0; i < ARRAY_SIZE(amd_event_mapping); i++) -- if (amd_event_mapping[i].eventsel == event_select -- && amd_event_mapping[i].unit_mask == unit_mask) -+ if (event_mapping[i].eventsel == event_select -+ && event_mapping[i].unit_mask == unit_mask) - break; - - if (i == ARRAY_SIZE(amd_event_mapping)) - return PERF_COUNT_HW_MAX; - -- return amd_event_mapping[i].event_type; -+ return event_mapping[i].event_type; - } - - /* return PERF_COUNT_HW_MAX as AMD doesn't have fixed events */ -@@ -300,7 +322,7 @@ static void amd_pmu_reset(struct kvm_vcpu *vcpu) - } - - struct kvm_pmu_ops amd_pmu_ops = { -- .find_arch_event = amd_find_arch_event, -+ .pmc_perf_hw_id = amd_pmc_perf_hw_id, - .find_fixed_event = amd_find_fixed_event, - .pmc_is_enabled = amd_pmc_is_enabled, - .pmc_idx_to_pmc = amd_pmc_idx_to_pmc, -diff --git a/arch/x86/kvm/vmx/pmu_intel.c b/arch/x86/kvm/vmx/pmu_intel.c -index 181e352d38de4..395566018ba95 100644 ---- a/arch/x86/kvm/vmx/pmu_intel.c -+++ b/arch/x86/kvm/vmx/pmu_intel.c -@@ -64,10 +64,11 @@ static void global_ctrl_changed(struct kvm_pmu *pmu, u64 data) - reprogram_counter(pmu, bit); - } - --static unsigned intel_find_arch_event(struct kvm_pmu *pmu, -- u8 event_select, -- u8 unit_mask) -+static unsigned int intel_pmc_perf_hw_id(struct kvm_pmc *pmc) - { -+ struct kvm_pmu *pmu = pmc_to_pmu(pmc); -+ u8 event_select = pmc->eventsel & ARCH_PERFMON_EVENTSEL_EVENT; -+ u8 unit_mask = (pmc->eventsel & ARCH_PERFMON_EVENTSEL_UMASK) >> 8; - int i; - - for (i = 0; i < ARRAY_SIZE(intel_arch_events); i++) -@@ -374,7 +375,7 @@ static void intel_pmu_reset(struct kvm_vcpu *vcpu) - } - - struct kvm_pmu_ops intel_pmu_ops = { -- .find_arch_event = intel_find_arch_event, -+ .pmc_perf_hw_id = intel_pmc_perf_hw_id, - .find_fixed_event = intel_find_fixed_event, - .pmc_is_enabled = intel_pmc_is_enabled, - .pmc_idx_to_pmc = intel_pmc_idx_to_pmc, -diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c -index 1f7dfa5aa42da..6dd77e426889b 100644 ---- a/arch/x86/kvm/x86.c -+++ b/arch/x86/kvm/x86.c -@@ -68,6 +68,7 @@ - #include - #include - #include -+#include - #include - - #define CREATE_TRACE_POINTS -@@ -5583,6 +5584,7 @@ EXPORT_SYMBOL_GPL(kvm_write_guest_virt_system); - - int handle_ud(struct kvm_vcpu *vcpu) - { -+ static const char kvm_emulate_prefix[] = { __KVM_EMULATE_PREFIX }; - int emul_type = EMULTYPE_TRAP_UD; - char sig[5]; /* ud2; .ascii "kvm" */ - struct x86_exception e; -@@ -5590,7 +5592,7 @@ int handle_ud(struct kvm_vcpu *vcpu) - if (force_emulation_prefix && - kvm_read_guest_virt(vcpu, kvm_get_linear_rip(vcpu), - sig, sizeof(sig), &e) == 0 && -- memcmp(sig, "\xf\xbkvm", sizeof(sig)) == 0) { -+ memcmp(sig, kvm_emulate_prefix, sizeof(sig)) == 0) { - kvm_rip_write(vcpu, kvm_rip_read(vcpu) + sizeof(sig)); - emul_type = EMULTYPE_TRAP_UD_FORCED; - } -diff --git a/arch/x86/lib/insn.c b/arch/x86/lib/insn.c -index 0b5862ba6a75e..404279563891a 100644 ---- a/arch/x86/lib/insn.c -+++ b/arch/x86/lib/insn.c -@@ -13,6 +13,8 @@ - #include - #include - -+#include -+ - /* Verify next sizeof(t) bytes can be on the same instruction */ - #define validate_next(t, insn, n) \ - ((insn)->next_byte + sizeof(t) + n <= (insn)->end_kaddr) -@@ -58,6 +60,36 @@ void insn_init(struct insn *insn, const void *kaddr, int buf_len, int x86_64) - insn->addr_bytes = 4; - } - -+static const insn_byte_t xen_prefix[] = { __XEN_EMULATE_PREFIX }; -+static const insn_byte_t kvm_prefix[] = { __KVM_EMULATE_PREFIX }; -+ -+static int __insn_get_emulate_prefix(struct insn *insn, -+ const insn_byte_t *prefix, size_t len) -+{ -+ size_t i; -+ -+ for (i = 0; i < len; i++) { -+ if (peek_nbyte_next(insn_byte_t, insn, i) != prefix[i]) -+ goto err_out; -+ } -+ -+ insn->emulate_prefix_size = len; -+ insn->next_byte += len; -+ -+ return 1; -+ -+err_out: -+ return 0; -+} -+ -+static void insn_get_emulate_prefix(struct insn *insn) -+{ -+ if (__insn_get_emulate_prefix(insn, xen_prefix, sizeof(xen_prefix))) -+ return; -+ -+ __insn_get_emulate_prefix(insn, kvm_prefix, sizeof(kvm_prefix)); -+} -+ - /** - * insn_get_prefixes - scan x86 instruction prefix bytes - * @insn: &struct insn containing instruction -@@ -76,6 +108,8 @@ void insn_get_prefixes(struct insn *insn) - if (prefixes->got) - return; - -+ insn_get_emulate_prefix(insn); -+ - nb = 0; - lb = 0; - b = peek_next(insn_byte_t, insn); -diff --git a/drivers/block/drbd/drbd_nl.c b/drivers/block/drbd/drbd_nl.c -index bfb00d3b091f1..52dd517ff5419 100644 ---- a/drivers/block/drbd/drbd_nl.c -+++ b/drivers/block/drbd/drbd_nl.c -@@ -791,9 +791,11 @@ int drbd_adm_set_role(struct sk_buff *skb, struct genl_info *info) - mutex_lock(&adm_ctx.resource->adm_mutex); - - if (info->genlhdr->cmd == DRBD_ADM_PRIMARY) -- retcode = drbd_set_role(adm_ctx.device, R_PRIMARY, parms.assume_uptodate); -+ retcode = (enum drbd_ret_code)drbd_set_role(adm_ctx.device, -+ R_PRIMARY, parms.assume_uptodate); - else -- retcode = drbd_set_role(adm_ctx.device, R_SECONDARY, 0); -+ retcode = (enum drbd_ret_code)drbd_set_role(adm_ctx.device, -+ R_SECONDARY, 0); - - mutex_unlock(&adm_ctx.resource->adm_mutex); - genl_lock(); -@@ -1971,7 +1973,7 @@ int drbd_adm_attach(struct sk_buff *skb, struct genl_info *info) - drbd_flush_workqueue(&connection->sender_work); - - rv = _drbd_request_state(device, NS(disk, D_ATTACHING), CS_VERBOSE); -- retcode = rv; /* FIXME: Type mismatch. */ -+ retcode = (enum drbd_ret_code)rv; - drbd_resume_io(device); - if (rv < SS_SUCCESS) - goto fail; -@@ -2696,7 +2698,8 @@ int drbd_adm_connect(struct sk_buff *skb, struct genl_info *info) - } - rcu_read_unlock(); - -- retcode = conn_request_state(connection, NS(conn, C_UNCONNECTED), CS_VERBOSE); -+ retcode = (enum drbd_ret_code)conn_request_state(connection, -+ NS(conn, C_UNCONNECTED), CS_VERBOSE); - - conn_reconfig_done(connection); - mutex_unlock(&adm_ctx.resource->adm_mutex); -@@ -2809,7 +2812,7 @@ int drbd_adm_disconnect(struct sk_buff *skb, struct genl_info *info) - mutex_lock(&adm_ctx.resource->adm_mutex); - rv = conn_try_disconnect(connection, parms.force_disconnect); - if (rv < SS_SUCCESS) -- retcode = rv; /* FIXME: Type mismatch. */ -+ retcode = (enum drbd_ret_code)rv; - else - retcode = NO_ERROR; - mutex_unlock(&adm_ctx.resource->adm_mutex); -diff --git a/drivers/gpu/drm/amd/display/dc/gpio/gpio_service.c b/drivers/gpu/drm/amd/display/dc/gpio/gpio_service.c -index d03165e71dc65..0be817f8cae6b 100644 ---- a/drivers/gpu/drm/amd/display/dc/gpio/gpio_service.c -+++ b/drivers/gpu/drm/amd/display/dc/gpio/gpio_service.c -@@ -53,8 +53,8 @@ - */ - - struct gpio_service *dal_gpio_service_create( -- enum dce_version dce_version_major, -- enum dce_version dce_version_minor, -+ enum dce_version dce_version, -+ enum dce_environment dce_environment, - struct dc_context *ctx) - { - struct gpio_service *service; -@@ -67,14 +67,14 @@ struct gpio_service *dal_gpio_service_create( - return NULL; - } - -- if (!dal_hw_translate_init(&service->translate, dce_version_major, -- dce_version_minor)) { -+ if (!dal_hw_translate_init(&service->translate, dce_version, -+ dce_environment)) { - BREAK_TO_DEBUGGER(); - goto failure_1; - } - -- if (!dal_hw_factory_init(&service->factory, dce_version_major, -- dce_version_minor)) { -+ if (!dal_hw_factory_init(&service->factory, dce_version, -+ dce_environment)) { - BREAK_TO_DEBUGGER(); - goto failure_1; - } -diff --git a/drivers/gpu/drm/amd/display/include/gpio_service_interface.h b/drivers/gpu/drm/amd/display/include/gpio_service_interface.h -index 9c55d247227ea..7e3240e73c1fc 100644 ---- a/drivers/gpu/drm/amd/display/include/gpio_service_interface.h -+++ b/drivers/gpu/drm/amd/display/include/gpio_service_interface.h -@@ -42,8 +42,8 @@ void dal_gpio_destroy( - struct gpio **ptr); - - struct gpio_service *dal_gpio_service_create( -- enum dce_version dce_version_major, -- enum dce_version dce_version_minor, -+ enum dce_version dce_version, -+ enum dce_environment dce_environment, - struct dc_context *ctx); - - struct gpio *dal_gpio_service_create_irq( -diff --git a/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c -index 198a91c765314..5c21c06189c1d 100644 ---- a/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c -+++ b/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c -@@ -1452,7 +1452,7 @@ static int eb_relocate_vma(struct i915_execbuffer *eb, struct i915_vma *vma) - - urelocs = u64_to_user_ptr(entry->relocs_ptr); - remain = entry->relocation_count; -- if (unlikely(remain > N_RELOC(ULONG_MAX))) -+ if (unlikely((unsigned long)remain > N_RELOC(ULONG_MAX))) - return -EINVAL; - - /* -diff --git a/drivers/net/can/grcan.c b/drivers/net/can/grcan.c -index 3496dfa1b5217..e613cd5707e27 100644 ---- a/drivers/net/can/grcan.c -+++ b/drivers/net/can/grcan.c -@@ -241,7 +241,7 @@ struct grcan_device_config { - .rxsize = GRCAN_DEFAULT_BUFFER_SIZE, \ - } - --#define GRCAN_TXBUG_SAFE_GRLIB_VERSION 0x4100 -+#define GRCAN_TXBUG_SAFE_GRLIB_VERSION 4100 - #define GRLIB_VERSION_MASK 0xffff - - /* GRCAN private data structure */ -@@ -1137,7 +1137,7 @@ static int grcan_close(struct net_device *dev) - return 0; - } - --static int grcan_transmit_catch_up(struct net_device *dev, int budget) -+static void grcan_transmit_catch_up(struct net_device *dev) - { - struct grcan_priv *priv = netdev_priv(dev); - unsigned long flags; -@@ -1145,7 +1145,7 @@ static int grcan_transmit_catch_up(struct net_device *dev, int budget) - - spin_lock_irqsave(&priv->lock, flags); - -- work_done = catch_up_echo_skb(dev, budget, true); -+ work_done = catch_up_echo_skb(dev, -1, true); - if (work_done) { - if (!priv->resetting && !priv->closing && - !(priv->can.ctrlmode & CAN_CTRLMODE_LISTENONLY)) -@@ -1159,8 +1159,6 @@ static int grcan_transmit_catch_up(struct net_device *dev, int budget) - } - - spin_unlock_irqrestore(&priv->lock, flags); -- -- return work_done; - } - - static int grcan_receive(struct net_device *dev, int budget) -@@ -1242,19 +1240,13 @@ static int grcan_poll(struct napi_struct *napi, int budget) - struct net_device *dev = priv->dev; - struct grcan_registers __iomem *regs = priv->regs; - unsigned long flags; -- int tx_work_done, rx_work_done; -- int rx_budget = budget / 2; -- int tx_budget = budget - rx_budget; -+ int work_done; - -- /* Half of the budget for receiveing messages */ -- rx_work_done = grcan_receive(dev, rx_budget); -+ work_done = grcan_receive(dev, budget); - -- /* Half of the budget for transmitting messages as that can trigger echo -- * frames being received -- */ -- tx_work_done = grcan_transmit_catch_up(dev, tx_budget); -+ grcan_transmit_catch_up(dev); - -- if (rx_work_done < rx_budget && tx_work_done < tx_budget) { -+ if (work_done < budget) { - napi_complete(napi); - - /* Guarantee no interference with a running reset that otherwise -@@ -1271,7 +1263,7 @@ static int grcan_poll(struct napi_struct *napi, int budget) - spin_unlock_irqrestore(&priv->lock, flags); - } - -- return rx_work_done + tx_work_done; -+ return work_done; - } - - /* Work tx bug by waiting while for the risky situation to clear. If that fails, -@@ -1656,6 +1648,7 @@ exit_free_candev: - static int grcan_probe(struct platform_device *ofdev) - { - struct device_node *np = ofdev->dev.of_node; -+ struct device_node *sysid_parent; - struct resource *res; - u32 sysid, ambafreq; - int irq, err; -@@ -1665,10 +1658,15 @@ static int grcan_probe(struct platform_device *ofdev) - /* Compare GRLIB version number with the first that does not - * have the tx bug (see start_xmit) - */ -- err = of_property_read_u32(np, "systemid", &sysid); -- if (!err && ((sysid & GRLIB_VERSION_MASK) -- >= GRCAN_TXBUG_SAFE_GRLIB_VERSION)) -- txbug = false; -+ sysid_parent = of_find_node_by_path("/ambapp0"); -+ if (sysid_parent) { -+ of_node_get(sysid_parent); -+ err = of_property_read_u32(sysid_parent, "systemid", &sysid); -+ if (!err && ((sysid & GRLIB_VERSION_MASK) >= -+ GRCAN_TXBUG_SAFE_GRLIB_VERSION)) -+ txbug = false; -+ of_node_put(sysid_parent); -+ } - - err = of_property_read_u32(np, "freq", &ambafreq); - if (err) { -diff --git a/drivers/net/ethernet/netronome/nfp/nfp_asm.c b/drivers/net/ethernet/netronome/nfp/nfp_asm.c -index b04b83687fe21..488615434e4ae 100644 ---- a/drivers/net/ethernet/netronome/nfp/nfp_asm.c -+++ b/drivers/net/ethernet/netronome/nfp/nfp_asm.c -@@ -196,7 +196,7 @@ int swreg_to_unrestricted(swreg dst, swreg lreg, swreg rreg, - } - - reg->dst_lmextn = swreg_lmextn(dst); -- reg->src_lmextn = swreg_lmextn(lreg) | swreg_lmextn(rreg); -+ reg->src_lmextn = swreg_lmextn(lreg) || swreg_lmextn(rreg); - - return 0; - } -@@ -277,7 +277,7 @@ int swreg_to_restricted(swreg dst, swreg lreg, swreg rreg, - } - - reg->dst_lmextn = swreg_lmextn(dst); -- reg->src_lmextn = swreg_lmextn(lreg) | swreg_lmextn(rreg); -+ reg->src_lmextn = swreg_lmextn(lreg) || swreg_lmextn(rreg); - - return 0; - } -diff --git a/fs/proc/kcore.c b/fs/proc/kcore.c -index e2ed8e08cc7ad..d1cabccc02b7a 100644 ---- a/fs/proc/kcore.c -+++ b/fs/proc/kcore.c -@@ -193,8 +193,6 @@ kclist_add_private(unsigned long pfn, unsigned long nr_pages, void *arg) - return 1; - - p = pfn_to_page(pfn); -- if (!memmap_valid_within(pfn, p, page_zone(p))) -- return 1; - - ent = kmalloc(sizeof(*ent), GFP_KERNEL); - if (!ent) -diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h -index e4f9df955040f..b138ddad619e8 100644 ---- a/include/linux/mmzone.h -+++ b/include/linux/mmzone.h -@@ -1438,37 +1438,6 @@ void memory_present(int nid, unsigned long start, unsigned long end); - #define pfn_valid_within(pfn) (1) - #endif - --#ifdef CONFIG_ARCH_HAS_HOLES_MEMORYMODEL --/* -- * pfn_valid() is meant to be able to tell if a given PFN has valid memmap -- * associated with it or not. This means that a struct page exists for this -- * pfn. The caller cannot assume the page is fully initialized in general. -- * Hotplugable pages might not have been onlined yet. pfn_to_online_page() -- * will ensure the struct page is fully online and initialized. Special pages -- * (e.g. ZONE_DEVICE) are never onlined and should be treated accordingly. -- * -- * In FLATMEM, it is expected that holes always have valid memmap as long as -- * there is valid PFNs either side of the hole. In SPARSEMEM, it is assumed -- * that a valid section has a memmap for the entire section. -- * -- * However, an ARM, and maybe other embedded architectures in the future -- * free memmap backing holes to save memory on the assumption the memmap is -- * never used. The page_zone linkages are then broken even though pfn_valid() -- * returns true. A walker of the full memmap must then do this additional -- * check to ensure the memmap they are looking at is sane by making sure -- * the zone and PFN linkages are still valid. This is expensive, but walkers -- * of the full memmap are extremely rare. -- */ --bool memmap_valid_within(unsigned long pfn, -- struct page *page, struct zone *zone); --#else --static inline bool memmap_valid_within(unsigned long pfn, -- struct page *page, struct zone *zone) --{ -- return true; --} --#endif /* CONFIG_ARCH_HAS_HOLES_MEMORYMODEL */ -- - #endif /* !__GENERATING_BOUNDS.H */ - #endif /* !__ASSEMBLY__ */ - #endif /* _LINUX_MMZONE_H */ -diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h -index 14d00cc10e22e..ecad25900ad78 100644 ---- a/include/net/bluetooth/hci_core.h -+++ b/include/net/bluetooth/hci_core.h -@@ -34,6 +34,9 @@ - /* HCI priority */ - #define HCI_PRIO_MAX 7 - -+/* HCI maximum id value */ -+#define HCI_MAX_ID 10000 -+ - /* HCI Core structures */ - struct inquiry_data { - bdaddr_t bdaddr; -diff --git a/mm/memory.c b/mm/memory.c -index 8a72fd3e73bf1..d416e329442dc 100644 ---- a/mm/memory.c -+++ b/mm/memory.c -@@ -4801,6 +4801,8 @@ long copy_huge_page_from_user(struct page *dst_page, - if (rc) - break; - -+ flush_dcache_page(subpage); -+ - cond_resched(); - } - return ret_val; -diff --git a/mm/migrate.c b/mm/migrate.c -index 5092ef2aa8a1f..6948d6ec0fd03 100644 ---- a/mm/migrate.c -+++ b/mm/migrate.c -@@ -994,9 +994,12 @@ static int move_to_new_page(struct page *newpage, struct page *page, - if (!PageMappingFlags(page)) - page->mapping = NULL; - -- if (likely(!is_zone_device_page(newpage))) -- flush_dcache_page(newpage); -+ if (likely(!is_zone_device_page(newpage))) { -+ int i, nr = compound_nr(newpage); - -+ for (i = 0; i < nr; i++) -+ flush_dcache_page(newpage + i); -+ } - } - out: - return rc; -diff --git a/mm/mmzone.c b/mm/mmzone.c -index 4686fdc23bb96..f337831affc2d 100644 ---- a/mm/mmzone.c -+++ b/mm/mmzone.c -@@ -72,20 +72,6 @@ struct zoneref *__next_zones_zonelist(struct zoneref *z, - return z; - } - --#ifdef CONFIG_ARCH_HAS_HOLES_MEMORYMODEL --bool memmap_valid_within(unsigned long pfn, -- struct page *page, struct zone *zone) --{ -- if (page_to_pfn(page) != pfn) -- return false; -- -- if (page_zone(page) != zone) -- return false; -- -- return true; --} --#endif /* CONFIG_ARCH_HAS_HOLES_MEMORYMODEL */ -- - void lruvec_init(struct lruvec *lruvec) - { - enum lru_list lru; -diff --git a/mm/userfaultfd.c b/mm/userfaultfd.c -index 640ff2bd9a693..6fa66e2111ea7 100644 ---- a/mm/userfaultfd.c -+++ b/mm/userfaultfd.c -@@ -53,6 +53,8 @@ static int mcopy_atomic_pte(struct mm_struct *dst_mm, - /* don't free the page */ - goto out; - } -+ -+ flush_dcache_page(page); - } else { - page = *pagep; - *pagep = NULL; -@@ -572,6 +574,7 @@ retry: - err = -EFAULT; - goto out; - } -+ flush_dcache_page(page); - goto retry; - } else - BUG_ON(page); -diff --git a/mm/vmstat.c b/mm/vmstat.c -index a8222041bd44d..240fe2153ca9e 100644 ---- a/mm/vmstat.c -+++ b/mm/vmstat.c -@@ -1444,10 +1444,6 @@ static void pagetypeinfo_showblockcount_print(struct seq_file *m, - if (!page) - continue; - -- /* Watch for unexpected holes punched in the memmap */ -- if (!memmap_valid_within(pfn, page, zone)) -- continue; -- - if (page_zone(page) != zone) - continue; - -diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c -index 2edaa601df13a..2ebb6480b6ecb 100644 ---- a/net/bluetooth/hci_core.c -+++ b/net/bluetooth/hci_core.c -@@ -3304,10 +3304,10 @@ int hci_register_dev(struct hci_dev *hdev) - */ - switch (hdev->dev_type) { - case HCI_PRIMARY: -- id = ida_simple_get(&hci_index_ida, 0, 0, GFP_KERNEL); -+ id = ida_simple_get(&hci_index_ida, 0, HCI_MAX_ID, GFP_KERNEL); - break; - case HCI_AMP: -- id = ida_simple_get(&hci_index_ida, 1, 0, GFP_KERNEL); -+ id = ida_simple_get(&hci_index_ida, 1, HCI_MAX_ID, GFP_KERNEL); - break; - default: - return -EINVAL; -@@ -3316,7 +3316,7 @@ int hci_register_dev(struct hci_dev *hdev) - if (id < 0) - return id; - -- sprintf(hdev->name, "hci%d", id); -+ snprintf(hdev->name, sizeof(hdev->name), "hci%d", id); - hdev->id = id; - - BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus); -diff --git a/tools/arch/x86/include/asm/emulate_prefix.h b/tools/arch/x86/include/asm/emulate_prefix.h -new file mode 100644 -index 0000000000000..70f5b98a52869 ---- /dev/null -+++ b/tools/arch/x86/include/asm/emulate_prefix.h -@@ -0,0 +1,14 @@ -+/* SPDX-License-Identifier: GPL-2.0 */ -+#ifndef _ASM_X86_EMULATE_PREFIX_H -+#define _ASM_X86_EMULATE_PREFIX_H -+ -+/* -+ * Virt escape sequences to trigger instruction emulation; -+ * ideally these would decode to 'whole' instruction and not destroy -+ * the instruction stream; sadly this is not true for the 'kvm' one :/ -+ */ -+ -+#define __XEN_EMULATE_PREFIX 0x0f,0x0b,0x78,0x65,0x6e /* ud2 ; .ascii "xen" */ -+#define __KVM_EMULATE_PREFIX 0x0f,0x0b,0x6b,0x76,0x6d /* ud2 ; .ascii "kvm" */ -+ -+#endif -diff --git a/tools/arch/x86/include/asm/insn.h b/tools/arch/x86/include/asm/insn.h -index d7f0ae8f3c442..52c6262e6bfd1 100644 ---- a/tools/arch/x86/include/asm/insn.h -+++ b/tools/arch/x86/include/asm/insn.h -@@ -45,6 +45,7 @@ struct insn { - struct insn_field immediate2; /* for 64bit imm or seg16 */ - }; - -+ int emulate_prefix_size; - insn_attr_t attr; - unsigned char opnd_bytes; - unsigned char addr_bytes; -@@ -128,6 +129,11 @@ static inline int insn_is_evex(struct insn *insn) - return (insn->vex_prefix.nbytes == 4); - } - -+static inline int insn_has_emulate_prefix(struct insn *insn) -+{ -+ return !!insn->emulate_prefix_size; -+} -+ - /* Ensure this instruction is decoded completely */ - static inline int insn_complete(struct insn *insn) - { -diff --git a/tools/arch/x86/lib/insn.c b/tools/arch/x86/lib/insn.c -index 79e048f1d9028..0151dfc6da616 100644 ---- a/tools/arch/x86/lib/insn.c -+++ b/tools/arch/x86/lib/insn.c -@@ -13,6 +13,8 @@ - #include "../include/asm/inat.h" - #include "../include/asm/insn.h" - -+#include "../include/asm/emulate_prefix.h" -+ - /* Verify next sizeof(t) bytes can be on the same instruction */ - #define validate_next(t, insn, n) \ - ((insn)->next_byte + sizeof(t) + n <= (insn)->end_kaddr) -@@ -58,6 +60,36 @@ void insn_init(struct insn *insn, const void *kaddr, int buf_len, int x86_64) - insn->addr_bytes = 4; - } - -+static const insn_byte_t xen_prefix[] = { __XEN_EMULATE_PREFIX }; -+static const insn_byte_t kvm_prefix[] = { __KVM_EMULATE_PREFIX }; -+ -+static int __insn_get_emulate_prefix(struct insn *insn, -+ const insn_byte_t *prefix, size_t len) -+{ -+ size_t i; -+ -+ for (i = 0; i < len; i++) { -+ if (peek_nbyte_next(insn_byte_t, insn, i) != prefix[i]) -+ goto err_out; -+ } -+ -+ insn->emulate_prefix_size = len; -+ insn->next_byte += len; -+ -+ return 1; -+ -+err_out: -+ return 0; -+} -+ -+static void insn_get_emulate_prefix(struct insn *insn) -+{ -+ if (__insn_get_emulate_prefix(insn, xen_prefix, sizeof(xen_prefix))) -+ return; -+ -+ __insn_get_emulate_prefix(insn, kvm_prefix, sizeof(kvm_prefix)); -+} -+ - /** - * insn_get_prefixes - scan x86 instruction prefix bytes - * @insn: &struct insn containing instruction -@@ -76,6 +108,8 @@ void insn_get_prefixes(struct insn *insn) - if (prefixes->got) - return; - -+ insn_get_emulate_prefix(insn); -+ - nb = 0; - lb = 0; - b = peek_next(insn_byte_t, insn); -diff --git a/tools/objtool/sync-check.sh b/tools/objtool/sync-check.sh -index c3ae1e8ae1194..2a1261bfbb625 100755 ---- a/tools/objtool/sync-check.sh -+++ b/tools/objtool/sync-check.sh -@@ -4,6 +4,7 @@ - FILES=' - arch/x86/include/asm/inat_types.h - arch/x86/include/asm/orc_types.h -+arch/x86/include/asm/emulate_prefix.h - arch/x86/lib/x86-opcode-map.txt - arch/x86/tools/gen-insn-attr-x86.awk - ' -@@ -46,4 +47,4 @@ done - check arch/x86/include/asm/inat.h '-I "^#include [\"<]\(asm/\)*inat_types.h[\">]"' - check arch/x86/include/asm/insn.h '-I "^#include [\"<]\(asm/\)*inat.h[\">]"' - check arch/x86/lib/inat.c '-I "^#include [\"<]\(../include/\)*asm/insn.h[\">]"' --check arch/x86/lib/insn.c '-I "^#include [\"<]\(../include/\)*asm/in\(at\|sn\).h[\">]"' -+check arch/x86/lib/insn.c '-I "^#include [\"<]\(../include/\)*asm/in\(at\|sn\).h[\">]" -I "^#include [\"<]\(../include/\)*asm/emulate_prefix.h[\">]"' -diff --git a/tools/perf/check-headers.sh b/tools/perf/check-headers.sh -index cea13cb987d00..499235a411628 100755 ---- a/tools/perf/check-headers.sh -+++ b/tools/perf/check-headers.sh -@@ -28,6 +28,7 @@ arch/x86/include/asm/disabled-features.h - arch/x86/include/asm/required-features.h - arch/x86/include/asm/cpufeatures.h - arch/x86/include/asm/inat_types.h -+arch/x86/include/asm/emulate_prefix.h - arch/x86/include/uapi/asm/prctl.h - arch/x86/lib/x86-opcode-map.txt - arch/x86/tools/gen-insn-attr-x86.awk -@@ -116,7 +117,7 @@ check lib/ctype.c '-I "^EXPORT_SYMBOL" -I "^#include " -B - check arch/x86/include/asm/inat.h '-I "^#include [\"<]\(asm/\)*inat_types.h[\">]"' - check arch/x86/include/asm/insn.h '-I "^#include [\"<]\(asm/\)*inat.h[\">]"' - check arch/x86/lib/inat.c '-I "^#include [\"<]\(../include/\)*asm/insn.h[\">]"' --check arch/x86/lib/insn.c '-I "^#include [\"<]\(../include/\)*asm/in\(at\|sn\).h[\">]"' -+check arch/x86/lib/insn.c '-I "^#include [\"<]\(../include/\)*asm/in\(at\|sn\).h[\">]" -I "^#include [\"<]\(../include/\)*asm/emulate_prefix.h[\">]"' - - # diff non-symmetric files - check_2 tools/perf/arch/x86/entry/syscalls/syscall_64.tbl arch/x86/entry/syscalls/syscall_64.tbl diff --git a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.194-195.patch b/patch/kernel/archive/odroidxu4-5.4/patch-5.4.194-195.patch deleted file mode 100644 index ace0e612d..000000000 --- a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.194-195.patch +++ /dev/null @@ -1,1162 +0,0 @@ -diff --git a/Makefile b/Makefile -index 044a85fea9216..4297d0107bd6c 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 5 - PATCHLEVEL = 4 --SUBLEVEL = 194 -+SUBLEVEL = 195 - EXTRAVERSION = - NAME = Kleptomaniac Octopus - -diff --git a/arch/arm/include/asm/io.h b/arch/arm/include/asm/io.h -index 7a0596fcb2e77..3cc0f6d508836 100644 ---- a/arch/arm/include/asm/io.h -+++ b/arch/arm/include/asm/io.h -@@ -457,6 +457,9 @@ extern void pci_iounmap(struct pci_dev *dev, void __iomem *addr); - extern int valid_phys_addr_range(phys_addr_t addr, size_t size); - extern int valid_mmap_phys_addr_range(unsigned long pfn, size_t size); - extern int devmem_is_allowed(unsigned long pfn); -+extern bool arch_memremap_can_ram_remap(resource_size_t offset, size_t size, -+ unsigned long flags); -+#define arch_memremap_can_ram_remap arch_memremap_can_ram_remap - #endif - - /* -diff --git a/arch/arm/mm/ioremap.c b/arch/arm/mm/ioremap.c -index 513c26b46db35..841b66515b379 100644 ---- a/arch/arm/mm/ioremap.c -+++ b/arch/arm/mm/ioremap.c -@@ -500,3 +500,11 @@ void __init early_ioremap_init(void) - { - early_ioremap_setup(); - } -+ -+bool arch_memremap_can_ram_remap(resource_size_t offset, size_t size, -+ unsigned long flags) -+{ -+ unsigned long pfn = PHYS_PFN(offset); -+ -+ return memblock_is_map_memory(pfn); -+} -diff --git a/arch/arm64/include/asm/io.h b/arch/arm64/include/asm/io.h -index 323cb306bd288..8ac55ff3094ae 100644 ---- a/arch/arm64/include/asm/io.h -+++ b/arch/arm64/include/asm/io.h -@@ -204,4 +204,8 @@ extern int valid_mmap_phys_addr_range(unsigned long pfn, size_t size); - - extern int devmem_is_allowed(unsigned long pfn); - -+extern bool arch_memremap_can_ram_remap(resource_size_t offset, size_t size, -+ unsigned long flags); -+#define arch_memremap_can_ram_remap arch_memremap_can_ram_remap -+ - #endif /* __ASM_IO_H */ -diff --git a/arch/arm64/mm/ioremap.c b/arch/arm64/mm/ioremap.c -index 9be71bee902ca..8dac7fcfb4bdc 100644 ---- a/arch/arm64/mm/ioremap.c -+++ b/arch/arm64/mm/ioremap.c -@@ -13,6 +13,7 @@ - #include - #include - #include -+#include - - #include - #include -@@ -100,3 +101,11 @@ void __init early_ioremap_init(void) - { - early_ioremap_setup(); - } -+ -+bool arch_memremap_can_ram_remap(resource_size_t offset, size_t size, -+ unsigned long flags) -+{ -+ unsigned long pfn = PHYS_PFN(offset); -+ -+ return memblock_is_map_memory(pfn); -+} -diff --git a/arch/mips/jz4740/setup.c b/arch/mips/jz4740/setup.c -index dc8ee21e0948e..45e327960a465 100644 ---- a/arch/mips/jz4740/setup.c -+++ b/arch/mips/jz4740/setup.c -@@ -61,7 +61,7 @@ void __init plat_mem_setup(void) - - jz4740_reset_init(); - -- if (__dtb_start != __dtb_end) -+ if (&__dtb_start != &__dtb_end) - dtb = __dtb_start; - else - dtb = (void *)fw_passed_dtb; -diff --git a/arch/s390/Makefile b/arch/s390/Makefile -index 2faaf456956a6..71e3d7c0b8709 100644 ---- a/arch/s390/Makefile -+++ b/arch/s390/Makefile -@@ -31,6 +31,16 @@ KBUILD_CFLAGS_DECOMPRESSOR += $(call cc-option,-ffreestanding) - KBUILD_CFLAGS_DECOMPRESSOR += $(call cc-disable-warning, address-of-packed-member) - KBUILD_CFLAGS_DECOMPRESSOR += $(if $(CONFIG_DEBUG_INFO),-g) - KBUILD_CFLAGS_DECOMPRESSOR += $(if $(CONFIG_DEBUG_INFO_DWARF4), $(call cc-option, -gdwarf-4,)) -+ -+ifdef CONFIG_CC_IS_GCC -+ ifeq ($(call cc-ifversion, -ge, 1200, y), y) -+ ifeq ($(call cc-ifversion, -lt, 1300, y), y) -+ KBUILD_CFLAGS += $(call cc-disable-warning, array-bounds) -+ KBUILD_CFLAGS_DECOMPRESSOR += $(call cc-disable-warning, array-bounds) -+ endif -+ endif -+endif -+ - UTS_MACHINE := s390x - STACK_SIZE := $(if $(CONFIG_KASAN),65536,16384) - CHECKFLAGS += -D__s390__ -D__s390x__ -diff --git a/drivers/gpu/drm/nouveau/nouveau_backlight.c b/drivers/gpu/drm/nouveau/nouveau_backlight.c -index c7a94c94dbf37..f2f3280c3a50e 100644 ---- a/drivers/gpu/drm/nouveau/nouveau_backlight.c -+++ b/drivers/gpu/drm/nouveau/nouveau_backlight.c -@@ -51,8 +51,9 @@ static bool - nouveau_get_backlight_name(char backlight_name[BL_NAME_SIZE], - struct nouveau_backlight *bl) - { -- const int nb = ida_simple_get(&bl_ida, 0, 0, GFP_KERNEL); -- if (nb < 0 || nb >= 100) -+ const int nb = ida_alloc_max(&bl_ida, 99, GFP_KERNEL); -+ -+ if (nb < 0) - return false; - if (nb > 0) - snprintf(backlight_name, BL_NAME_SIZE, "nv_backlight%d", nb); -@@ -280,7 +281,7 @@ nouveau_backlight_init(struct drm_connector *connector) - nv_encoder, ops, &props); - if (IS_ERR(bl->dev)) { - if (bl->id >= 0) -- ida_simple_remove(&bl_ida, bl->id); -+ ida_free(&bl_ida, bl->id); - ret = PTR_ERR(bl->dev); - goto fail_alloc; - } -@@ -306,7 +307,7 @@ nouveau_backlight_fini(struct drm_connector *connector) - return; - - if (bl->id >= 0) -- ida_simple_remove(&bl_ida, bl->id); -+ ida_free(&bl_ida, bl->id); - - backlight_device_unregister(bl->dev); - nv_conn->backlight = NULL; -diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/device/tegra.c b/drivers/gpu/drm/nouveau/nvkm/engine/device/tegra.c -index 0e372a190d3f1..9b6972c953584 100644 ---- a/drivers/gpu/drm/nouveau/nvkm/engine/device/tegra.c -+++ b/drivers/gpu/drm/nouveau/nvkm/engine/device/tegra.c -@@ -123,7 +123,7 @@ nvkm_device_tegra_probe_iommu(struct nvkm_device_tegra *tdev) - - mutex_init(&tdev->iommu.mutex); - -- if (iommu_present(&platform_bus_type)) { -+ if (device_iommu_mapped(dev)) { - tdev->iommu.domain = iommu_domain_alloc(&platform_bus_type); - if (!tdev->iommu.domain) - goto error; -diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c -index ea29953e0b081..8e7b05484ba85 100644 ---- a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c -+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c -@@ -498,7 +498,7 @@ static int vmw_fb_kms_detach(struct vmw_fb_par *par, - - static int vmw_fb_kms_framebuffer(struct fb_info *info) - { -- struct drm_mode_fb_cmd2 mode_cmd; -+ struct drm_mode_fb_cmd2 mode_cmd = {0}; - struct vmw_fb_par *par = info->par; - struct fb_var_screeninfo *var = &info->var; - struct drm_framebuffer *cur_fb; -diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig -index 049563d503b68..4ea742ada36de 100644 ---- a/drivers/hwmon/Kconfig -+++ b/drivers/hwmon/Kconfig -@@ -802,7 +802,7 @@ config SENSORS_LTC4261 - - config SENSORS_LTQ_CPUTEMP - bool "Lantiq cpu temperature sensor driver" -- depends on LANTIQ -+ depends on SOC_XWAY - help - If you say yes here you get support for the temperature - sensor inside your CPU. -diff --git a/drivers/hwmon/f71882fg.c b/drivers/hwmon/f71882fg.c -index d09deb409de7a..3336ff9e306b2 100644 ---- a/drivers/hwmon/f71882fg.c -+++ b/drivers/hwmon/f71882fg.c -@@ -1577,8 +1577,9 @@ static ssize_t show_temp(struct device *dev, struct device_attribute *devattr, - temp *= 125; - if (sign) - temp -= 128000; -- } else -- temp = data->temp[nr] * 1000; -+ } else { -+ temp = ((s8)data->temp[nr]) * 1000; -+ } - - return sprintf(buf, "%d\n", temp); - } -diff --git a/drivers/hwmon/tmp401.c b/drivers/hwmon/tmp401.c -index fa361d9949db7..debcece02dd33 100644 ---- a/drivers/hwmon/tmp401.c -+++ b/drivers/hwmon/tmp401.c -@@ -731,10 +731,21 @@ static int tmp401_probe(struct i2c_client *client, - return 0; - } - -+static const struct of_device_id __maybe_unused tmp4xx_of_match[] = { -+ { .compatible = "ti,tmp401", }, -+ { .compatible = "ti,tmp411", }, -+ { .compatible = "ti,tmp431", }, -+ { .compatible = "ti,tmp432", }, -+ { .compatible = "ti,tmp435", }, -+ { }, -+}; -+MODULE_DEVICE_TABLE(of, tmp4xx_of_match); -+ - static struct i2c_driver tmp401_driver = { - .class = I2C_CLASS_HWMON, - .driver = { - .name = "tmp401", -+ .of_match_table = of_match_ptr(tmp4xx_of_match), - }, - .probe = tmp401_probe, - .id_table = tmp401_id, -diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c -index a6ae4b7b11afd..7f4aa22397867 100644 ---- a/drivers/net/ethernet/intel/i40e/i40e_main.c -+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c -@@ -7120,42 +7120,43 @@ static void i40e_free_macvlan_channels(struct i40e_vsi *vsi) - static int i40e_fwd_ring_up(struct i40e_vsi *vsi, struct net_device *vdev, - struct i40e_fwd_adapter *fwd) - { -+ struct i40e_channel *ch = NULL, *ch_tmp, *iter; - int ret = 0, num_tc = 1, i, aq_err; -- struct i40e_channel *ch, *ch_tmp; - struct i40e_pf *pf = vsi->back; - struct i40e_hw *hw = &pf->hw; - -- if (list_empty(&vsi->macvlan_list)) -- return -EINVAL; -- - /* Go through the list and find an available channel */ -- list_for_each_entry_safe(ch, ch_tmp, &vsi->macvlan_list, list) { -- if (!i40e_is_channel_macvlan(ch)) { -- ch->fwd = fwd; -+ list_for_each_entry_safe(iter, ch_tmp, &vsi->macvlan_list, list) { -+ if (!i40e_is_channel_macvlan(iter)) { -+ iter->fwd = fwd; - /* record configuration for macvlan interface in vdev */ - for (i = 0; i < num_tc; i++) - netdev_bind_sb_channel_queue(vsi->netdev, vdev, - i, -- ch->num_queue_pairs, -- ch->base_queue); -- for (i = 0; i < ch->num_queue_pairs; i++) { -+ iter->num_queue_pairs, -+ iter->base_queue); -+ for (i = 0; i < iter->num_queue_pairs; i++) { - struct i40e_ring *tx_ring, *rx_ring; - u16 pf_q; - -- pf_q = ch->base_queue + i; -+ pf_q = iter->base_queue + i; - - /* Get to TX ring ptr */ - tx_ring = vsi->tx_rings[pf_q]; -- tx_ring->ch = ch; -+ tx_ring->ch = iter; - - /* Get the RX ring ptr */ - rx_ring = vsi->rx_rings[pf_q]; -- rx_ring->ch = ch; -+ rx_ring->ch = iter; - } -+ ch = iter; - break; - } - } - -+ if (!ch) -+ return -EINVAL; -+ - /* Guarantee all rings are updated before we update the - * MAC address filter. - */ -diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c -index 0ec13f520e907..936e64dd81b5f 100644 ---- a/drivers/net/ethernet/sfc/ef10.c -+++ b/drivers/net/ethernet/sfc/ef10.c -@@ -6160,6 +6160,11 @@ static int efx_ef10_mtd_probe(struct efx_nic *efx) - n_parts++; - } - -+ if (!n_parts) { -+ kfree(parts); -+ return 0; -+ } -+ - rc = efx_mtd_add(efx, &parts[0].common, n_parts, sizeof(*parts)); - fail: - if (rc) -diff --git a/drivers/net/ethernet/xilinx/xilinx_emaclite.c b/drivers/net/ethernet/xilinx/xilinx_emaclite.c -index bec09008997de..6e5ea68b6a7e6 100644 ---- a/drivers/net/ethernet/xilinx/xilinx_emaclite.c -+++ b/drivers/net/ethernet/xilinx/xilinx_emaclite.c -@@ -932,8 +932,6 @@ static int xemaclite_open(struct net_device *dev) - xemaclite_disable_interrupts(lp); - - if (lp->phy_node) { -- u32 bmcr; -- - lp->phy_dev = of_phy_connect(lp->ndev, lp->phy_node, - xemaclite_adjust_link, 0, - PHY_INTERFACE_MODE_MII); -@@ -944,19 +942,6 @@ static int xemaclite_open(struct net_device *dev) - - /* EmacLite doesn't support giga-bit speeds */ - phy_set_max_speed(lp->phy_dev, SPEED_100); -- -- /* Don't advertise 1000BASE-T Full/Half duplex speeds */ -- phy_write(lp->phy_dev, MII_CTRL1000, 0); -- -- /* Advertise only 10 and 100mbps full/half duplex speeds */ -- phy_write(lp->phy_dev, MII_ADVERTISE, ADVERTISE_ALL | -- ADVERTISE_CSMA); -- -- /* Restart auto negotiation */ -- bmcr = phy_read(lp->phy_dev, MII_BMCR); -- bmcr |= (BMCR_ANENABLE | BMCR_ANRESTART); -- phy_write(lp->phy_dev, MII_BMCR, bmcr); -- - phy_start(lp->phy_dev); - } - -diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c -index 6c52ff8c0d2eb..9e8cf64f04420 100644 ---- a/drivers/net/phy/phy.c -+++ b/drivers/net/phy/phy.c -@@ -116,10 +116,15 @@ EXPORT_SYMBOL(phy_print_status); - */ - static int phy_clear_interrupt(struct phy_device *phydev) - { -- if (phydev->drv->ack_interrupt) -- return phydev->drv->ack_interrupt(phydev); -+ int ret = 0; - -- return 0; -+ if (phydev->drv->ack_interrupt) { -+ mutex_lock(&phydev->lock); -+ ret = phydev->drv->ack_interrupt(phydev); -+ mutex_unlock(&phydev->lock); -+ } -+ -+ return ret; - } - - /** -@@ -760,6 +765,36 @@ static int phy_disable_interrupts(struct phy_device *phydev) - return phy_clear_interrupt(phydev); - } - -+/** -+ * phy_did_interrupt - Checks if the PHY generated an interrupt -+ * @phydev: target phy_device struct -+ */ -+static int phy_did_interrupt(struct phy_device *phydev) -+{ -+ int ret; -+ -+ mutex_lock(&phydev->lock); -+ ret = phydev->drv->did_interrupt(phydev); -+ mutex_unlock(&phydev->lock); -+ -+ return ret; -+} -+ -+/** -+ * phy_handle_interrupt - PHY specific interrupt handler -+ * @phydev: target phy_device struct -+ */ -+static int phy_handle_interrupt(struct phy_device *phydev) -+{ -+ int ret; -+ -+ mutex_lock(&phydev->lock); -+ ret = phydev->drv->handle_interrupt(phydev); -+ mutex_unlock(&phydev->lock); -+ -+ return ret; -+} -+ - /** - * phy_interrupt - PHY interrupt handler - * @irq: interrupt line -@@ -771,11 +806,11 @@ static irqreturn_t phy_interrupt(int irq, void *phy_dat) - { - struct phy_device *phydev = phy_dat; - -- if (phydev->drv->did_interrupt && !phydev->drv->did_interrupt(phydev)) -+ if (phydev->drv->did_interrupt && !phy_did_interrupt(phydev)) - return IRQ_NONE; - - if (phydev->drv->handle_interrupt) { -- if (phydev->drv->handle_interrupt(phydev)) -+ if (phy_handle_interrupt(phydev)) - goto phy_err; - } else { - /* reschedule state queue work to run as soon as possible */ -diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c -index 6e1721d533846..ffe27104f654b 100644 ---- a/drivers/net/wireless/mac80211_hwsim.c -+++ b/drivers/net/wireless/mac80211_hwsim.c -@@ -2062,11 +2062,13 @@ static void hw_scan_work(struct work_struct *work) - if (req->ie_len) - skb_put_data(probe, req->ie, req->ie_len); - -+ rcu_read_lock(); - if (!ieee80211_tx_prepare_skb(hwsim->hw, - hwsim->hw_scan_vif, - probe, - hwsim->tmp_chan->band, - NULL)) { -+ rcu_read_unlock(); - kfree_skb(probe); - continue; - } -@@ -2074,6 +2076,7 @@ static void hw_scan_work(struct work_struct *work) - local_bh_disable(); - mac80211_hwsim_tx_frame(hwsim->hw, probe, - hwsim->tmp_chan); -+ rcu_read_unlock(); - local_bh_enable(); - } - } -diff --git a/drivers/s390/net/ctcm_mpc.c b/drivers/s390/net/ctcm_mpc.c -index ab316baa82843..d766002bc5bee 100644 ---- a/drivers/s390/net/ctcm_mpc.c -+++ b/drivers/s390/net/ctcm_mpc.c -@@ -626,8 +626,6 @@ static void mpc_rcvd_sweep_resp(struct mpcg_info *mpcginfo) - ctcm_clear_busy_do(dev); - } - -- kfree(mpcginfo); -- - return; - - } -@@ -1206,10 +1204,10 @@ static void ctcmpc_unpack_skb(struct channel *ch, struct sk_buff *pskb) - CTCM_FUNTAIL, dev->name); - priv->stats.rx_dropped++; - /* mpcginfo only used for non-data transfers */ -- kfree(mpcginfo); - if (do_debug_data) - ctcmpc_dump_skb(pskb, -8); - } -+ kfree(mpcginfo); - } - done: - -@@ -1991,7 +1989,6 @@ static void mpc_action_rcvd_xid0(fsm_instance *fsm, int event, void *arg) - } - break; - } -- kfree(mpcginfo); - - CTCM_PR_DEBUG("ctcmpc:%s() %s xid2:%i xid7:%i xidt_p2:%i \n", - __func__, ch->id, grp->outstanding_xid2, -@@ -2052,7 +2049,6 @@ static void mpc_action_rcvd_xid7(fsm_instance *fsm, int event, void *arg) - mpc_validate_xid(mpcginfo); - break; - } -- kfree(mpcginfo); - return; - } - -diff --git a/drivers/s390/net/ctcm_sysfs.c b/drivers/s390/net/ctcm_sysfs.c -index ded1930a00b2d..e3813a7aa5e68 100644 ---- a/drivers/s390/net/ctcm_sysfs.c -+++ b/drivers/s390/net/ctcm_sysfs.c -@@ -39,11 +39,12 @@ static ssize_t ctcm_buffer_write(struct device *dev, - struct ctcm_priv *priv = dev_get_drvdata(dev); - int rc; - -- ndev = priv->channel[CTCM_READ]->netdev; -- if (!(priv && priv->channel[CTCM_READ] && ndev)) { -+ if (!(priv && priv->channel[CTCM_READ] && -+ priv->channel[CTCM_READ]->netdev)) { - CTCM_DBF_TEXT(SETUP, CTC_DBF_ERROR, "bfnondev"); - return -ENODEV; - } -+ ndev = priv->channel[CTCM_READ]->netdev; - - rc = kstrtouint(buf, 0, &bs1); - if (rc) -diff --git a/drivers/s390/net/lcs.c b/drivers/s390/net/lcs.c -index 8f08b0a2917c6..4eec7bfb5de93 100644 ---- a/drivers/s390/net/lcs.c -+++ b/drivers/s390/net/lcs.c -@@ -1735,10 +1735,11 @@ lcs_get_control(struct lcs_card *card, struct lcs_cmd *cmd) - lcs_schedule_recovery(card); - break; - case LCS_CMD_STOPLAN: -- pr_warn("Stoplan for %s initiated by LGW\n", -- card->dev->name); -- if (card->dev) -+ if (card->dev) { -+ pr_warn("Stoplan for %s initiated by LGW\n", -+ card->dev->name); - netif_carrier_off(card->dev); -+ } - break; - default: - LCS_DBF_TEXT(5, trace, "noLGWcmd"); -diff --git a/drivers/slimbus/qcom-ctrl.c b/drivers/slimbus/qcom-ctrl.c -index a444badd8df5a..0a6f7eeb7755b 100644 ---- a/drivers/slimbus/qcom-ctrl.c -+++ b/drivers/slimbus/qcom-ctrl.c -@@ -515,9 +515,9 @@ static int qcom_slim_probe(struct platform_device *pdev) - } - - ctrl->irq = platform_get_irq(pdev, 0); -- if (!ctrl->irq) { -+ if (ctrl->irq < 0) { - dev_err(&pdev->dev, "no slimbus IRQ\n"); -- return -ENODEV; -+ return ctrl->irq; - } - - sctrl = &ctrl->ctrl; -diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c -index c38f06139ccfa..907a4d0784ac0 100644 ---- a/drivers/tty/n_gsm.c -+++ b/drivers/tty/n_gsm.c -@@ -2259,6 +2259,7 @@ static void gsm_copy_config_values(struct gsm_mux *gsm, - - static int gsm_config(struct gsm_mux *gsm, struct gsm_config *c) - { -+ int ret = 0; - int need_close = 0; - int need_restart = 0; - -@@ -2334,10 +2335,13 @@ static int gsm_config(struct gsm_mux *gsm, struct gsm_config *c) - * FIXME: We need to separate activation/deactivation from adding - * and removing from the mux array - */ -- if (need_restart) -- gsm_activate_mux(gsm); -- if (gsm->initiator && need_close) -- gsm_dlci_begin_open(gsm->dlci[0]); -+ if (gsm->dead) { -+ ret = gsm_activate_mux(gsm); -+ if (ret) -+ return ret; -+ if (gsm->initiator) -+ gsm_dlci_begin_open(gsm->dlci[0]); -+ } - return 0; - } - -diff --git a/drivers/tty/serial/8250/8250_mtk.c b/drivers/tty/serial/8250/8250_mtk.c -index 98e68f25a5f34..a79ab53f8e87d 100644 ---- a/drivers/tty/serial/8250/8250_mtk.c -+++ b/drivers/tty/serial/8250/8250_mtk.c -@@ -36,6 +36,7 @@ - #define MTK_UART_IER_RTSI 0x40 /* Enable RTS Modem status interrupt */ - #define MTK_UART_IER_CTSI 0x80 /* Enable CTS Modem status interrupt */ - -+#define MTK_UART_EFR 38 /* I/O: Extended Features Register */ - #define MTK_UART_EFR_EN 0x10 /* Enable enhancement feature */ - #define MTK_UART_EFR_RTS 0x40 /* Enable hardware rx flow control */ - #define MTK_UART_EFR_CTS 0x80 /* Enable hardware tx flow control */ -@@ -52,6 +53,9 @@ - #define MTK_UART_TX_TRIGGER 1 - #define MTK_UART_RX_TRIGGER MTK_UART_RX_SIZE - -+#define MTK_UART_XON1 40 /* I/O: Xon character 1 */ -+#define MTK_UART_XOFF1 42 /* I/O: Xoff character 1 */ -+ - #ifdef CONFIG_SERIAL_8250_DMA - enum dma_rx_status { - DMA_RX_START = 0, -@@ -168,7 +172,7 @@ static void mtk8250_dma_enable(struct uart_8250_port *up) - MTK_UART_DMA_EN_RX | MTK_UART_DMA_EN_TX); - - serial_out(up, UART_LCR, UART_LCR_CONF_MODE_B); -- serial_out(up, UART_EFR, UART_EFR_ECB); -+ serial_out(up, MTK_UART_EFR, UART_EFR_ECB); - serial_out(up, UART_LCR, lcr); - - if (dmaengine_slave_config(dma->rxchan, &dma->rxconf) != 0) -@@ -231,7 +235,7 @@ static void mtk8250_set_flow_ctrl(struct uart_8250_port *up, int mode) - int lcr = serial_in(up, UART_LCR); - - serial_out(up, UART_LCR, UART_LCR_CONF_MODE_B); -- serial_out(up, UART_EFR, UART_EFR_ECB); -+ serial_out(up, MTK_UART_EFR, UART_EFR_ECB); - serial_out(up, UART_LCR, lcr); - lcr = serial_in(up, UART_LCR); - -@@ -240,7 +244,7 @@ static void mtk8250_set_flow_ctrl(struct uart_8250_port *up, int mode) - serial_out(up, MTK_UART_ESCAPE_DAT, MTK_UART_ESCAPE_CHAR); - serial_out(up, MTK_UART_ESCAPE_EN, 0x00); - serial_out(up, UART_LCR, UART_LCR_CONF_MODE_B); -- serial_out(up, UART_EFR, serial_in(up, UART_EFR) & -+ serial_out(up, MTK_UART_EFR, serial_in(up, MTK_UART_EFR) & - (~(MTK_UART_EFR_HW_FC | MTK_UART_EFR_SW_FC_MASK))); - serial_out(up, UART_LCR, lcr); - mtk8250_disable_intrs(up, MTK_UART_IER_XOFFI | -@@ -254,8 +258,8 @@ static void mtk8250_set_flow_ctrl(struct uart_8250_port *up, int mode) - serial_out(up, UART_LCR, UART_LCR_CONF_MODE_B); - - /*enable hw flow control*/ -- serial_out(up, UART_EFR, MTK_UART_EFR_HW_FC | -- (serial_in(up, UART_EFR) & -+ serial_out(up, MTK_UART_EFR, MTK_UART_EFR_HW_FC | -+ (serial_in(up, MTK_UART_EFR) & - (~(MTK_UART_EFR_HW_FC | MTK_UART_EFR_SW_FC_MASK)))); - - serial_out(up, UART_LCR, lcr); -@@ -269,12 +273,12 @@ static void mtk8250_set_flow_ctrl(struct uart_8250_port *up, int mode) - serial_out(up, UART_LCR, UART_LCR_CONF_MODE_B); - - /*enable sw flow control */ -- serial_out(up, UART_EFR, MTK_UART_EFR_XON1_XOFF1 | -- (serial_in(up, UART_EFR) & -+ serial_out(up, MTK_UART_EFR, MTK_UART_EFR_XON1_XOFF1 | -+ (serial_in(up, MTK_UART_EFR) & - (~(MTK_UART_EFR_HW_FC | MTK_UART_EFR_SW_FC_MASK)))); - -- serial_out(up, UART_XON1, START_CHAR(port->state->port.tty)); -- serial_out(up, UART_XOFF1, STOP_CHAR(port->state->port.tty)); -+ serial_out(up, MTK_UART_XON1, START_CHAR(port->state->port.tty)); -+ serial_out(up, MTK_UART_XOFF1, STOP_CHAR(port->state->port.tty)); - serial_out(up, UART_LCR, lcr); - mtk8250_disable_intrs(up, MTK_UART_IER_CTSI|MTK_UART_IER_RTSI); - mtk8250_enable_intrs(up, MTK_UART_IER_XOFFI); -diff --git a/drivers/tty/serial/digicolor-usart.c b/drivers/tty/serial/digicolor-usart.c -index 13ac36e2da4f0..4446c13629b1c 100644 ---- a/drivers/tty/serial/digicolor-usart.c -+++ b/drivers/tty/serial/digicolor-usart.c -@@ -472,10 +472,10 @@ static int digicolor_uart_probe(struct platform_device *pdev) - return PTR_ERR(uart_clk); - - res = platform_get_resource(pdev, IORESOURCE_MEM, 0); -- dp->port.mapbase = res->start; - dp->port.membase = devm_ioremap_resource(&pdev->dev, res); - if (IS_ERR(dp->port.membase)) - return PTR_ERR(dp->port.membase); -+ dp->port.mapbase = res->start; - - irq = platform_get_irq(pdev, 0); - if (irq < 0) -diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c -index de7bb8e6a1efc..98022584f7092 100644 ---- a/drivers/usb/class/cdc-wdm.c -+++ b/drivers/usb/class/cdc-wdm.c -@@ -755,6 +755,7 @@ static int wdm_release(struct inode *inode, struct file *file) - poison_urbs(desc); - spin_lock_irq(&desc->iuspin); - desc->resp_count = 0; -+ clear_bit(WDM_RESPONDING, &desc->flags); - spin_unlock_irq(&desc->iuspin); - desc->manage_power(desc->intf, 0); - unpoison_urbs(desc); -diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c -index fa978412601aa..1ba4a72047dcb 100644 ---- a/drivers/usb/serial/option.c -+++ b/drivers/usb/serial/option.c -@@ -2123,10 +2123,14 @@ static const struct usb_device_id option_ids[] = { - .driver_info = RSVD(3) }, - { USB_DEVICE(0x1508, 0x1001), /* Fibocom NL668 (IOT version) */ - .driver_info = RSVD(4) | RSVD(5) | RSVD(6) }, -+ { USB_DEVICE(0x1782, 0x4d10) }, /* Fibocom L610 (AT mode) */ -+ { USB_DEVICE_INTERFACE_CLASS(0x1782, 0x4d11, 0xff) }, /* Fibocom L610 (ECM/RNDIS mode) */ - { USB_DEVICE(0x2cb7, 0x0104), /* Fibocom NL678 series */ - .driver_info = RSVD(4) | RSVD(5) }, - { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0105, 0xff), /* Fibocom NL678 series */ - .driver_info = RSVD(6) }, -+ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0106, 0xff) }, /* Fibocom MA510 (ECM mode w/ diag intf.) */ -+ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x010a, 0xff) }, /* Fibocom MA510 (ECM mode) */ - { USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x010b, 0xff, 0xff, 0x30) }, /* Fibocom FG150 Diag */ - { USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x010b, 0xff, 0, 0) }, /* Fibocom FG150 AT */ - { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a0, 0xff) }, /* Fibocom NL668-AM/NL652-EU (laptop MBIM) */ -diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c -index 2a91219dee7e6..386894fe59eef 100644 ---- a/drivers/usb/serial/pl2303.c -+++ b/drivers/usb/serial/pl2303.c -@@ -100,6 +100,7 @@ static const struct usb_device_id id_table[] = { - { USB_DEVICE(HP_VENDOR_ID, HP_LCM220_PRODUCT_ID) }, - { USB_DEVICE(HP_VENDOR_ID, HP_LCM960_PRODUCT_ID) }, - { USB_DEVICE(HP_VENDOR_ID, HP_LM920_PRODUCT_ID) }, -+ { USB_DEVICE(HP_VENDOR_ID, HP_LM930_PRODUCT_ID) }, - { USB_DEVICE(HP_VENDOR_ID, HP_LM940_PRODUCT_ID) }, - { USB_DEVICE(HP_VENDOR_ID, HP_TD620_PRODUCT_ID) }, - { USB_DEVICE(CRESSI_VENDOR_ID, CRESSI_EDY_PRODUCT_ID) }, -diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h -index 15f746e977a71..873e50088a36e 100644 ---- a/drivers/usb/serial/pl2303.h -+++ b/drivers/usb/serial/pl2303.h -@@ -129,6 +129,7 @@ - #define HP_TD620_PRODUCT_ID 0x0956 - #define HP_LD960_PRODUCT_ID 0x0b39 - #define HP_LD381_PRODUCT_ID 0x0f7f -+#define HP_LM930_PRODUCT_ID 0x0f9b - #define HP_LCM220_PRODUCT_ID 0x3139 - #define HP_LCM960_PRODUCT_ID 0x3239 - #define HP_LD220_PRODUCT_ID 0x3524 -diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c -index b1b9923162a04..3f437f07356b4 100644 ---- a/drivers/usb/serial/qcserial.c -+++ b/drivers/usb/serial/qcserial.c -@@ -166,6 +166,8 @@ static const struct usb_device_id id_table[] = { - {DEVICE_SWI(0x1199, 0x9090)}, /* Sierra Wireless EM7565 QDL */ - {DEVICE_SWI(0x1199, 0x9091)}, /* Sierra Wireless EM7565 */ - {DEVICE_SWI(0x1199, 0x90d2)}, /* Sierra Wireless EM9191 QDL */ -+ {DEVICE_SWI(0x1199, 0xc080)}, /* Sierra Wireless EM7590 QDL */ -+ {DEVICE_SWI(0x1199, 0xc081)}, /* Sierra Wireless EM7590 */ - {DEVICE_SWI(0x413c, 0x81a2)}, /* Dell Wireless 5806 Gobi(TM) 4G LTE Mobile Broadband Card */ - {DEVICE_SWI(0x413c, 0x81a3)}, /* Dell Wireless 5570 HSPA+ (42Mbps) Mobile Broadband Card */ - {DEVICE_SWI(0x413c, 0x81a4)}, /* Dell Wireless 5570e HSPA+ (42Mbps) Mobile Broadband Card */ -diff --git a/drivers/usb/typec/tcpm/tcpci.c b/drivers/usb/typec/tcpm/tcpci.c -index 59e304a341f8a..6caed68ce1be7 100644 ---- a/drivers/usb/typec/tcpm/tcpci.c -+++ b/drivers/usb/typec/tcpm/tcpci.c -@@ -611,7 +611,7 @@ static int tcpci_remove(struct i2c_client *client) - /* Disable chip interrupts before unregistering port */ - err = tcpci_write16(chip->tcpci, TCPC_ALERT_MASK, 0); - if (err < 0) -- return err; -+ dev_warn(&client->dev, "Failed to disable irqs (%pe)\n", ERR_PTR(err)); - - tcpci_unregister_port(chip->tcpci); - -diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c -index dec5285a02e9d..77a497a4b2368 100644 ---- a/fs/gfs2/bmap.c -+++ b/fs/gfs2/bmap.c -@@ -1233,13 +1233,12 @@ static int gfs2_iomap_end(struct inode *inode, loff_t pos, loff_t length, - - if (length != written && (iomap->flags & IOMAP_F_NEW)) { - /* Deallocate blocks that were just allocated. */ -- loff_t blockmask = i_blocksize(inode) - 1; -- loff_t end = (pos + length) & ~blockmask; -+ loff_t hstart = round_up(pos + written, i_blocksize(inode)); -+ loff_t hend = iomap->offset + iomap->length; - -- pos = (pos + written + blockmask) & ~blockmask; -- if (pos < end) { -- truncate_pagecache_range(inode, pos, end - 1); -- punch_hole(ip, pos, end - pos); -+ if (hstart < hend) { -+ truncate_pagecache_range(inode, hstart, hend - 1); -+ punch_hole(ip, hstart, hend - hstart); - } - } - -diff --git a/include/linux/netdev_features.h b/include/linux/netdev_features.h -index 640e7279f1617..75be8886783e1 100644 ---- a/include/linux/netdev_features.h -+++ b/include/linux/netdev_features.h -@@ -151,7 +151,7 @@ enum { - #define NETIF_F_HW_TLS_TX __NETIF_F(HW_TLS_TX) - #define NETIF_F_HW_TLS_RX __NETIF_F(HW_TLS_RX) - --/* Finds the next feature with the highest number of the range of start till 0. -+/* Finds the next feature with the highest number of the range of start-1 till 0. - */ - static inline int find_next_netdev_feature(u64 feature, unsigned long start) - { -@@ -170,7 +170,7 @@ static inline int find_next_netdev_feature(u64 feature, unsigned long start) - for ((bit) = find_next_netdev_feature((mask_addr), \ - NETDEV_FEATURE_COUNT); \ - (bit) >= 0; \ -- (bit) = find_next_netdev_feature((mask_addr), (bit) - 1)) -+ (bit) = find_next_netdev_feature((mask_addr), (bit))) - - /* Features valid for ethtool to change */ - /* = all defined minus driver/device-class-related */ -diff --git a/include/net/tc_act/tc_pedit.h b/include/net/tc_act/tc_pedit.h -index 748cf87a4d7ea..3e02709a1df65 100644 ---- a/include/net/tc_act/tc_pedit.h -+++ b/include/net/tc_act/tc_pedit.h -@@ -14,6 +14,7 @@ struct tcf_pedit { - struct tc_action common; - unsigned char tcfp_nkeys; - unsigned char tcfp_flags; -+ u32 tcfp_off_max_hint; - struct tc_pedit_key *tcfp_keys; - struct tcf_pedit_key_ex *tcfp_keys_ex; - }; -diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c -index 3674798ade1fc..b02eca235ba3f 100644 ---- a/kernel/cgroup/cpuset.c -+++ b/kernel/cgroup/cpuset.c -@@ -3289,8 +3289,11 @@ static struct notifier_block cpuset_track_online_nodes_nb = { - */ - void __init cpuset_init_smp(void) - { -- cpumask_copy(top_cpuset.cpus_allowed, cpu_active_mask); -- top_cpuset.mems_allowed = node_states[N_MEMORY]; -+ /* -+ * cpus_allowd/mems_allowed set to v2 values in the initial -+ * cpuset_bind() call will be reset to v1 values in another -+ * cpuset_bind() call when v1 cpuset is mounted. -+ */ - top_cpuset.old_mems_allowed = top_cpuset.mems_allowed; - - cpumask_copy(top_cpuset.effective_cpus, cpu_active_mask); -diff --git a/lib/dim/net_dim.c b/lib/dim/net_dim.c -index a4db51c212663..dae3b51ac3d9b 100644 ---- a/lib/dim/net_dim.c -+++ b/lib/dim/net_dim.c -@@ -12,41 +12,41 @@ - * Each profile size must be of NET_DIM_PARAMS_NUM_PROFILES - */ - #define NET_DIM_PARAMS_NUM_PROFILES 5 --#define NET_DIM_DEFAULT_RX_CQ_MODERATION_PKTS_FROM_EQE 256 --#define NET_DIM_DEFAULT_TX_CQ_MODERATION_PKTS_FROM_EQE 128 -+#define NET_DIM_DEFAULT_RX_CQ_PKTS_FROM_EQE 256 -+#define NET_DIM_DEFAULT_TX_CQ_PKTS_FROM_EQE 128 - #define NET_DIM_DEF_PROFILE_CQE 1 - #define NET_DIM_DEF_PROFILE_EQE 1 - - #define NET_DIM_RX_EQE_PROFILES { \ -- {1, NET_DIM_DEFAULT_RX_CQ_MODERATION_PKTS_FROM_EQE}, \ -- {8, NET_DIM_DEFAULT_RX_CQ_MODERATION_PKTS_FROM_EQE}, \ -- {64, NET_DIM_DEFAULT_RX_CQ_MODERATION_PKTS_FROM_EQE}, \ -- {128, NET_DIM_DEFAULT_RX_CQ_MODERATION_PKTS_FROM_EQE}, \ -- {256, NET_DIM_DEFAULT_RX_CQ_MODERATION_PKTS_FROM_EQE}, \ -+ {.usec = 1, .pkts = NET_DIM_DEFAULT_RX_CQ_PKTS_FROM_EQE,}, \ -+ {.usec = 8, .pkts = NET_DIM_DEFAULT_RX_CQ_PKTS_FROM_EQE,}, \ -+ {.usec = 64, .pkts = NET_DIM_DEFAULT_RX_CQ_PKTS_FROM_EQE,}, \ -+ {.usec = 128, .pkts = NET_DIM_DEFAULT_RX_CQ_PKTS_FROM_EQE,}, \ -+ {.usec = 256, .pkts = NET_DIM_DEFAULT_RX_CQ_PKTS_FROM_EQE,} \ - } - - #define NET_DIM_RX_CQE_PROFILES { \ -- {2, 256}, \ -- {8, 128}, \ -- {16, 64}, \ -- {32, 64}, \ -- {64, 64} \ -+ {.usec = 2, .pkts = 256,}, \ -+ {.usec = 8, .pkts = 128,}, \ -+ {.usec = 16, .pkts = 64,}, \ -+ {.usec = 32, .pkts = 64,}, \ -+ {.usec = 64, .pkts = 64,} \ - } - - #define NET_DIM_TX_EQE_PROFILES { \ -- {1, NET_DIM_DEFAULT_TX_CQ_MODERATION_PKTS_FROM_EQE}, \ -- {8, NET_DIM_DEFAULT_TX_CQ_MODERATION_PKTS_FROM_EQE}, \ -- {32, NET_DIM_DEFAULT_TX_CQ_MODERATION_PKTS_FROM_EQE}, \ -- {64, NET_DIM_DEFAULT_TX_CQ_MODERATION_PKTS_FROM_EQE}, \ -- {128, NET_DIM_DEFAULT_TX_CQ_MODERATION_PKTS_FROM_EQE} \ -+ {.usec = 1, .pkts = NET_DIM_DEFAULT_TX_CQ_PKTS_FROM_EQE,}, \ -+ {.usec = 8, .pkts = NET_DIM_DEFAULT_TX_CQ_PKTS_FROM_EQE,}, \ -+ {.usec = 32, .pkts = NET_DIM_DEFAULT_TX_CQ_PKTS_FROM_EQE,}, \ -+ {.usec = 64, .pkts = NET_DIM_DEFAULT_TX_CQ_PKTS_FROM_EQE,}, \ -+ {.usec = 128, .pkts = NET_DIM_DEFAULT_TX_CQ_PKTS_FROM_EQE,} \ - } - - #define NET_DIM_TX_CQE_PROFILES { \ -- {5, 128}, \ -- {8, 64}, \ -- {16, 32}, \ -- {32, 32}, \ -- {64, 32} \ -+ {.usec = 5, .pkts = 128,}, \ -+ {.usec = 8, .pkts = 64,}, \ -+ {.usec = 16, .pkts = 32,}, \ -+ {.usec = 32, .pkts = 32,}, \ -+ {.usec = 64, .pkts = 32,} \ - } - - static const struct dim_cq_moder -diff --git a/net/batman-adv/fragmentation.c b/net/batman-adv/fragmentation.c -index 0da90e73c79bf..f33a7f7a1249a 100644 ---- a/net/batman-adv/fragmentation.c -+++ b/net/batman-adv/fragmentation.c -@@ -478,6 +478,17 @@ int batadv_frag_send_packet(struct sk_buff *skb, - goto free_skb; - } - -+ /* GRO might have added fragments to the fragment list instead of -+ * frags[]. But this is not handled by skb_split and must be -+ * linearized to avoid incorrect length information after all -+ * batman-adv fragments were created and submitted to the -+ * hard-interface -+ */ -+ if (skb_has_frag_list(skb) && __skb_linearize(skb)) { -+ ret = -ENOMEM; -+ goto free_skb; -+ } -+ - /* Create one header to be copied to all fragments */ - frag_header.packet_type = BATADV_UNICAST_FRAG; - frag_header.version = BATADV_COMPAT_VERSION; -diff --git a/net/core/secure_seq.c b/net/core/secure_seq.c -index 7b6b1d2c3d109..2f9796a1a63ff 100644 ---- a/net/core/secure_seq.c -+++ b/net/core/secure_seq.c -@@ -23,6 +23,8 @@ - static siphash_key_t net_secret __read_mostly; - static siphash_key_t ts_secret __read_mostly; - -+#define EPHEMERAL_PORT_SHUFFLE_PERIOD (10 * HZ) -+ - static __always_inline void net_secret_init(void) - { - net_get_random_once(&net_secret, sizeof(net_secret)); -@@ -101,11 +103,13 @@ u32 secure_ipv6_port_ephemeral(const __be32 *saddr, const __be32 *daddr, - const struct { - struct in6_addr saddr; - struct in6_addr daddr; -+ unsigned int timeseed; - __be16 dport; - } __aligned(SIPHASH_ALIGNMENT) combined = { - .saddr = *(struct in6_addr *)saddr, - .daddr = *(struct in6_addr *)daddr, -- .dport = dport -+ .timeseed = jiffies / EPHEMERAL_PORT_SHUFFLE_PERIOD, -+ .dport = dport, - }; - net_secret_init(); - return siphash(&combined, offsetofend(typeof(combined), dport), -@@ -146,8 +150,10 @@ EXPORT_SYMBOL_GPL(secure_tcp_seq); - u32 secure_ipv4_port_ephemeral(__be32 saddr, __be32 daddr, __be16 dport) - { - net_secret_init(); -- return siphash_3u32((__force u32)saddr, (__force u32)daddr, -- (__force u16)dport, &net_secret); -+ return siphash_4u32((__force u32)saddr, (__force u32)daddr, -+ (__force u16)dport, -+ jiffies / EPHEMERAL_PORT_SHUFFLE_PERIOD, -+ &net_secret); - } - EXPORT_SYMBOL_GPL(secure_ipv4_port_ephemeral); - #endif -diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c -index 33e6392e8b820..3ff65c9ab8ee6 100644 ---- a/net/ipv4/ping.c -+++ b/net/ipv4/ping.c -@@ -304,6 +304,7 @@ static int ping_check_bind_addr(struct sock *sk, struct inet_sock *isk, - struct net *net = sock_net(sk); - if (sk->sk_family == AF_INET) { - struct sockaddr_in *addr = (struct sockaddr_in *) uaddr; -+ u32 tb_id = RT_TABLE_LOCAL; - int chk_addr_ret; - - if (addr_len < sizeof(*addr)) -@@ -317,7 +318,8 @@ static int ping_check_bind_addr(struct sock *sk, struct inet_sock *isk, - pr_debug("ping_check_bind_addr(sk=%p,addr=%pI4,port=%d)\n", - sk, &addr->sin_addr.s_addr, ntohs(addr->sin_port)); - -- chk_addr_ret = inet_addr_type(net, addr->sin_addr.s_addr); -+ tb_id = l3mdev_fib_table_by_index(net, sk->sk_bound_dev_if) ? : tb_id; -+ chk_addr_ret = inet_addr_type_table(net, addr->sin_addr.s_addr, tb_id); - - if (addr->sin_addr.s_addr == htonl(INADDR_ANY)) - chk_addr_ret = RTN_LOCAL; -@@ -358,6 +360,14 @@ static int ping_check_bind_addr(struct sock *sk, struct inet_sock *isk, - return -ENODEV; - } - } -+ -+ if (!dev && sk->sk_bound_dev_if) { -+ dev = dev_get_by_index_rcu(net, sk->sk_bound_dev_if); -+ if (!dev) { -+ rcu_read_unlock(); -+ return -ENODEV; -+ } -+ } - has_addr = pingv6_ops.ipv6_chk_addr(net, &addr->sin6_addr, dev, - scoped); - rcu_read_unlock(); -diff --git a/net/ipv4/route.c b/net/ipv4/route.c -index d1feec97fa062..9280e50871596 100644 ---- a/net/ipv4/route.c -+++ b/net/ipv4/route.c -@@ -1775,6 +1775,7 @@ static int ip_route_input_mc(struct sk_buff *skb, __be32 daddr, __be32 saddr, - #endif - RT_CACHE_STAT_INC(in_slow_mc); - -+ skb_dst_drop(skb); - skb_dst_set(skb, &rth->dst); - return 0; - } -diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c -index ad00f31e20023..5415e566e09d8 100644 ---- a/net/mac80211/mlme.c -+++ b/net/mac80211/mlme.c -@@ -3406,6 +3406,12 @@ static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata, - cbss->transmitted_bss->bssid); - bss_conf->bssid_indicator = cbss->max_bssid_indicator; - bss_conf->bssid_index = cbss->bssid_index; -+ } else { -+ bss_conf->nontransmitted = false; -+ memset(bss_conf->transmitter_bssid, 0, -+ sizeof(bss_conf->transmitter_bssid)); -+ bss_conf->bssid_indicator = 0; -+ bss_conf->bssid_index = 0; - } - - /* -diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c -index 8aefc52542a00..86b70385dce3b 100644 ---- a/net/netlink/af_netlink.c -+++ b/net/netlink/af_netlink.c -@@ -1987,7 +1987,6 @@ static int netlink_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, - copied = len; - } - -- skb_reset_transport_header(data_skb); - err = skb_copy_datagram_msg(data_skb, 0, msg, copied); - - if (msg->msg_name) { -diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c -index ff4f2437b5925..305cb190e9979 100644 ---- a/net/sched/act_pedit.c -+++ b/net/sched/act_pedit.c -@@ -148,7 +148,7 @@ static int tcf_pedit_init(struct net *net, struct nlattr *nla, - struct nlattr *pattr; - struct tcf_pedit *p; - int ret = 0, err; -- int ksize; -+ int i, ksize; - u32 index; - - if (!nla) { -@@ -227,6 +227,18 @@ static int tcf_pedit_init(struct net *net, struct nlattr *nla, - p->tcfp_nkeys = parm->nkeys; - } - memcpy(p->tcfp_keys, parm->keys, ksize); -+ p->tcfp_off_max_hint = 0; -+ for (i = 0; i < p->tcfp_nkeys; ++i) { -+ u32 cur = p->tcfp_keys[i].off; -+ -+ /* The AT option can read a single byte, we can bound the actual -+ * value with uchar max. -+ */ -+ cur += (0xff & p->tcfp_keys[i].offmask) >> p->tcfp_keys[i].shift; -+ -+ /* Each key touches 4 bytes starting from the computed offset */ -+ p->tcfp_off_max_hint = max(p->tcfp_off_max_hint, cur + 4); -+ } - - p->tcfp_flags = parm->flags; - goto_ch = tcf_action_set_ctrlact(*a, parm->action, goto_ch); -@@ -307,13 +319,18 @@ static int tcf_pedit_act(struct sk_buff *skb, const struct tc_action *a, - struct tcf_result *res) - { - struct tcf_pedit *p = to_pedit(a); -+ u32 max_offset; - int i; - -- if (skb_unclone(skb, GFP_ATOMIC)) -- return p->tcf_action; -- - spin_lock(&p->tcf_lock); - -+ max_offset = (skb_transport_header_was_set(skb) ? -+ skb_transport_offset(skb) : -+ skb_network_offset(skb)) + -+ p->tcfp_off_max_hint; -+ if (skb_ensure_writable(skb, min(skb->len, max_offset))) -+ goto unlock; -+ - tcf_lastuse_update(&p->tcf_tm); - - if (p->tcfp_nkeys > 0) { -@@ -402,6 +419,7 @@ bad: - p->tcf_qstats.overlimits++; - done: - bstats_update(&p->tcf_bstats, skb); -+unlock: - spin_unlock(&p->tcf_lock); - return p->tcf_action; - } -diff --git a/net/smc/smc_rx.c b/net/smc/smc_rx.c -index 97e8369002d71..9e89bd1f706b5 100644 ---- a/net/smc/smc_rx.c -+++ b/net/smc/smc_rx.c -@@ -348,12 +348,12 @@ int smc_rx_recvmsg(struct smc_sock *smc, struct msghdr *msg, - } - break; - } -+ if (!timeo) -+ return -EAGAIN; - if (signal_pending(current)) { - read_done = sock_intr_errno(timeo); - break; - } -- if (!timeo) -- return -EAGAIN; - } - - if (!smc_rx_data_available(conn)) { -diff --git a/sound/soc/codecs/max98090.c b/sound/soc/codecs/max98090.c -index 6b9d326e11b07..ce9f99dd3e87d 100644 ---- a/sound/soc/codecs/max98090.c -+++ b/sound/soc/codecs/max98090.c -@@ -413,6 +413,9 @@ static int max98090_put_enab_tlv(struct snd_kcontrol *kcontrol, - - val = (val >> mc->shift) & mask; - -+ if (sel < 0 || sel > mc->max) -+ return -EINVAL; -+ - *select = sel; - - /* Setting a volume is only valid if it is already On */ -@@ -427,7 +430,7 @@ static int max98090_put_enab_tlv(struct snd_kcontrol *kcontrol, - mask << mc->shift, - sel << mc->shift); - -- return 0; -+ return *select != val; - } - - static const char *max98090_perf_pwr_text[] = -diff --git a/sound/soc/soc-ops.c b/sound/soc/soc-ops.c -index c88bc6bb41cfe..7a37312c8e0c2 100644 ---- a/sound/soc/soc-ops.c -+++ b/sound/soc/soc-ops.c -@@ -523,7 +523,15 @@ int snd_soc_put_volsw_range(struct snd_kcontrol *kcontrol, - unsigned int mask = (1 << fls(max)) - 1; - unsigned int invert = mc->invert; - unsigned int val, val_mask; -- int err, ret; -+ int err, ret, tmp; -+ -+ tmp = ucontrol->value.integer.value[0]; -+ if (tmp < 0) -+ return -EINVAL; -+ if (mc->platform_max && tmp > mc->platform_max) -+ return -EINVAL; -+ if (tmp > mc->max - mc->min + 1) -+ return -EINVAL; - - if (invert) - val = (max - ucontrol->value.integer.value[0]) & mask; -@@ -538,6 +546,14 @@ int snd_soc_put_volsw_range(struct snd_kcontrol *kcontrol, - ret = err; - - if (snd_soc_volsw_is_stereo(mc)) { -+ tmp = ucontrol->value.integer.value[1]; -+ if (tmp < 0) -+ return -EINVAL; -+ if (mc->platform_max && tmp > mc->platform_max) -+ return -EINVAL; -+ if (tmp > mc->max - mc->min + 1) -+ return -EINVAL; -+ - if (invert) - val = (max - ucontrol->value.integer.value[1]) & mask; - else diff --git a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.195-196.patch b/patch/kernel/archive/odroidxu4-5.4/patch-5.4.195-196.patch deleted file mode 100644 index 8fdc02f26..000000000 --- a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.195-196.patch +++ /dev/null @@ -1,2732 +0,0 @@ -diff --git a/Documentation/DMA-attributes.txt b/Documentation/DMA-attributes.txt -index 7193505a98cab..8f8d97f65d737 100644 ---- a/Documentation/DMA-attributes.txt -+++ b/Documentation/DMA-attributes.txt -@@ -156,13 +156,3 @@ accesses to DMA buffers in both privileged "supervisor" and unprivileged - subsystem that the buffer is fully accessible at the elevated privilege - level (and ideally inaccessible or at least read-only at the - lesser-privileged levels). -- --DMA_ATTR_PRIVILEGED --------------------- -- --Some advanced peripherals such as remote processors and GPUs perform --accesses to DMA buffers in both privileged "supervisor" and unprivileged --"user" modes. This attribute is used to indicate to the DMA-mapping --subsystem that the buffer is fully accessible at the elevated privilege --level (and ideally inaccessible or at least read-only at the --lesser-privileged levels). -diff --git a/Makefile b/Makefile -index 4297d0107bd6c..c064ed925552d 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 5 - PATCHLEVEL = 4 --SUBLEVEL = 195 -+SUBLEVEL = 196 - EXTRAVERSION = - NAME = Kleptomaniac Octopus - -diff --git a/arch/arm/boot/dts/aspeed-g6-pinctrl.dtsi b/arch/arm/boot/dts/aspeed-g6-pinctrl.dtsi -index f310f4d3bcc7c..ac723fe898c76 100644 ---- a/arch/arm/boot/dts/aspeed-g6-pinctrl.dtsi -+++ b/arch/arm/boot/dts/aspeed-g6-pinctrl.dtsi -@@ -117,11 +117,6 @@ - groups = "FWSPID"; - }; - -- pinctrl_fwqspid_default: fwqspid_default { -- function = "FWSPID"; -- groups = "FWQSPID"; -- }; -- - pinctrl_fwspiwp_default: fwspiwp_default { - function = "FWSPIWP"; - groups = "FWSPIWP"; -@@ -653,12 +648,12 @@ - }; - - pinctrl_qspi1_default: qspi1_default { -- function = "QSPI1"; -+ function = "SPI1"; - groups = "QSPI1"; - }; - - pinctrl_qspi2_default: qspi2_default { -- function = "QSPI2"; -+ function = "SPI2"; - groups = "QSPI2"; - }; - -diff --git a/arch/arm/boot/dts/imx7-colibri.dtsi b/arch/arm/boot/dts/imx7-colibri.dtsi -index 8bba03de51ad4..1e61e38621066 100644 ---- a/arch/arm/boot/dts/imx7-colibri.dtsi -+++ b/arch/arm/boot/dts/imx7-colibri.dtsi -@@ -77,7 +77,7 @@ - - dailink_master: simple-audio-card,codec { - sound-dai = <&codec>; -- clocks = <&clks IMX7D_AUDIO_MCLK_ROOT_CLK>; -+ clocks = <&clks IMX7D_AUDIO_MCLK_ROOT_DIV>; - }; - }; - }; -@@ -152,7 +152,7 @@ - compatible = "fsl,sgtl5000"; - #sound-dai-cells = <0>; - reg = <0x0a>; -- clocks = <&clks IMX7D_AUDIO_MCLK_ROOT_CLK>; -+ clocks = <&clks IMX7D_AUDIO_MCLK_ROOT_DIV>; - pinctrl-names = "default"; - pinctrl-0 = <&pinctrl_sai1_mclk>; - VDDA-supply = <®_module_3v3_avdd>; -diff --git a/arch/arm/boot/dts/imx7-mba7.dtsi b/arch/arm/boot/dts/imx7-mba7.dtsi -index 50abf18ad30b2..887497e3bb4b8 100644 ---- a/arch/arm/boot/dts/imx7-mba7.dtsi -+++ b/arch/arm/boot/dts/imx7-mba7.dtsi -@@ -250,7 +250,7 @@ - tlv320aic32x4: audio-codec@18 { - compatible = "ti,tlv320aic32x4"; - reg = <0x18>; -- clocks = <&clks IMX7D_AUDIO_MCLK_ROOT_CLK>; -+ clocks = <&clks IMX7D_AUDIO_MCLK_ROOT_DIV>; - clock-names = "mclk"; - ldoin-supply = <®_audio_3v3>; - iov-supply = <®_audio_3v3>; -diff --git a/arch/arm/boot/dts/imx7d-nitrogen7.dts b/arch/arm/boot/dts/imx7d-nitrogen7.dts -index 6b4acea1ef795..ecfa179ccab1c 100644 ---- a/arch/arm/boot/dts/imx7d-nitrogen7.dts -+++ b/arch/arm/boot/dts/imx7d-nitrogen7.dts -@@ -284,7 +284,7 @@ - codec: wm8960@1a { - compatible = "wlf,wm8960"; - reg = <0x1a>; -- clocks = <&clks IMX7D_AUDIO_MCLK_ROOT_CLK>; -+ clocks = <&clks IMX7D_AUDIO_MCLK_ROOT_DIV>; - clock-names = "mclk"; - wlf,shared-lrclk; - }; -diff --git a/arch/arm/boot/dts/imx7d-pico-hobbit.dts b/arch/arm/boot/dts/imx7d-pico-hobbit.dts -index 7b2198a9372c6..d917dc4f2f227 100644 ---- a/arch/arm/boot/dts/imx7d-pico-hobbit.dts -+++ b/arch/arm/boot/dts/imx7d-pico-hobbit.dts -@@ -31,7 +31,7 @@ - - dailink_master: simple-audio-card,codec { - sound-dai = <&sgtl5000>; -- clocks = <&clks IMX7D_AUDIO_MCLK_ROOT_CLK>; -+ clocks = <&clks IMX7D_AUDIO_MCLK_ROOT_DIV>; - }; - }; - }; -@@ -41,7 +41,7 @@ - #sound-dai-cells = <0>; - reg = <0x0a>; - compatible = "fsl,sgtl5000"; -- clocks = <&clks IMX7D_AUDIO_MCLK_ROOT_CLK>; -+ clocks = <&clks IMX7D_AUDIO_MCLK_ROOT_DIV>; - VDDA-supply = <®_2p5v>; - VDDIO-supply = <®_vref_1v8>; - }; -diff --git a/arch/arm/boot/dts/imx7d-pico-pi.dts b/arch/arm/boot/dts/imx7d-pico-pi.dts -index 70bea95c06d83..f263e391e24cb 100644 ---- a/arch/arm/boot/dts/imx7d-pico-pi.dts -+++ b/arch/arm/boot/dts/imx7d-pico-pi.dts -@@ -31,7 +31,7 @@ - - dailink_master: simple-audio-card,codec { - sound-dai = <&sgtl5000>; -- clocks = <&clks IMX7D_AUDIO_MCLK_ROOT_CLK>; -+ clocks = <&clks IMX7D_AUDIO_MCLK_ROOT_DIV>; - }; - }; - }; -@@ -41,7 +41,7 @@ - #sound-dai-cells = <0>; - reg = <0x0a>; - compatible = "fsl,sgtl5000"; -- clocks = <&clks IMX7D_AUDIO_MCLK_ROOT_CLK>; -+ clocks = <&clks IMX7D_AUDIO_MCLK_ROOT_DIV>; - VDDA-supply = <®_2p5v>; - VDDIO-supply = <®_vref_1v8>; - }; -diff --git a/arch/arm/boot/dts/imx7d-sdb.dts b/arch/arm/boot/dts/imx7d-sdb.dts -index 869efbc4af42c..a97cda17e484e 100644 ---- a/arch/arm/boot/dts/imx7d-sdb.dts -+++ b/arch/arm/boot/dts/imx7d-sdb.dts -@@ -356,7 +356,7 @@ - codec: wm8960@1a { - compatible = "wlf,wm8960"; - reg = <0x1a>; -- clocks = <&clks IMX7D_AUDIO_MCLK_ROOT_CLK>; -+ clocks = <&clks IMX7D_AUDIO_MCLK_ROOT_DIV>; - clock-names = "mclk"; - wlf,shared-lrclk; - }; -diff --git a/arch/arm/boot/dts/imx7s-warp.dts b/arch/arm/boot/dts/imx7s-warp.dts -index d6b4888fa686b..e035dd5bf4f62 100644 ---- a/arch/arm/boot/dts/imx7s-warp.dts -+++ b/arch/arm/boot/dts/imx7s-warp.dts -@@ -75,7 +75,7 @@ - - dailink_master: simple-audio-card,codec { - sound-dai = <&codec>; -- clocks = <&clks IMX7D_AUDIO_MCLK_ROOT_CLK>; -+ clocks = <&clks IMX7D_AUDIO_MCLK_ROOT_DIV>; - }; - }; - }; -@@ -232,7 +232,7 @@ - #sound-dai-cells = <0>; - reg = <0x0a>; - compatible = "fsl,sgtl5000"; -- clocks = <&clks IMX7D_AUDIO_MCLK_ROOT_CLK>; -+ clocks = <&clks IMX7D_AUDIO_MCLK_ROOT_DIV>; - pinctrl-names = "default"; - pinctrl-0 = <&pinctrl_sai1_mclk>; - VDDA-supply = <&vgen4_reg>; -diff --git a/arch/arm/kernel/entry-armv.S b/arch/arm/kernel/entry-armv.S -index 3d65fa56a0e5d..8e8efe28d7995 100644 ---- a/arch/arm/kernel/entry-armv.S -+++ b/arch/arm/kernel/entry-armv.S -@@ -1043,7 +1043,7 @@ vector_bhb_loop8_\name: - - @ bhb workaround - mov r0, #8 --3: b . + 4 -+3: W(b) . + 4 - subs r0, r0, #1 - bne 3b - dsb -diff --git a/arch/arm/kernel/stacktrace.c b/arch/arm/kernel/stacktrace.c -index db798eac74315..8247749998259 100644 ---- a/arch/arm/kernel/stacktrace.c -+++ b/arch/arm/kernel/stacktrace.c -@@ -53,17 +53,17 @@ int notrace unwind_frame(struct stackframe *frame) - return -EINVAL; - - frame->sp = frame->fp; -- frame->fp = *(unsigned long *)(fp); -- frame->pc = *(unsigned long *)(fp + 4); -+ frame->fp = READ_ONCE_NOCHECK(*(unsigned long *)(fp)); -+ frame->pc = READ_ONCE_NOCHECK(*(unsigned long *)(fp + 4)); - #else - /* check current frame pointer is within bounds */ - if (fp < low + 12 || fp > high - 4) - return -EINVAL; - - /* restore the registers from the stack frame */ -- frame->fp = *(unsigned long *)(fp - 12); -- frame->sp = *(unsigned long *)(fp - 8); -- frame->pc = *(unsigned long *)(fp - 4); -+ frame->fp = READ_ONCE_NOCHECK(*(unsigned long *)(fp - 12)); -+ frame->sp = READ_ONCE_NOCHECK(*(unsigned long *)(fp - 8)); -+ frame->pc = READ_ONCE_NOCHECK(*(unsigned long *)(fp - 4)); - #endif - - return 0; -diff --git a/arch/arm/mm/proc-v7-bugs.c b/arch/arm/mm/proc-v7-bugs.c -index 097ef85bb7f21..bcb9181601d9b 100644 ---- a/arch/arm/mm/proc-v7-bugs.c -+++ b/arch/arm/mm/proc-v7-bugs.c -@@ -301,6 +301,7 @@ void cpu_v7_ca15_ibe(void) - { - if (check_spectre_auxcr(this_cpu_ptr(&spectre_warned), BIT(0))) - cpu_v7_spectre_v2_init(); -+ cpu_v7_spectre_bhb_init(); - } - - void cpu_v7_bugs_init(void) -diff --git a/arch/mips/lantiq/falcon/sysctrl.c b/arch/mips/lantiq/falcon/sysctrl.c -index 037b08f3257e0..a2837a54d9726 100644 ---- a/arch/mips/lantiq/falcon/sysctrl.c -+++ b/arch/mips/lantiq/falcon/sysctrl.c -@@ -167,6 +167,8 @@ static inline void clkdev_add_sys(const char *dev, unsigned int module, - { - struct clk *clk = kzalloc(sizeof(struct clk), GFP_KERNEL); - -+ if (!clk) -+ return; - clk->cl.dev_id = dev; - clk->cl.con_id = NULL; - clk->cl.clk = clk; -diff --git a/arch/mips/lantiq/xway/gptu.c b/arch/mips/lantiq/xway/gptu.c -index 3d5683e75cf1e..200fe9ff641d6 100644 ---- a/arch/mips/lantiq/xway/gptu.c -+++ b/arch/mips/lantiq/xway/gptu.c -@@ -122,6 +122,8 @@ static inline void clkdev_add_gptu(struct device *dev, const char *con, - { - struct clk *clk = kzalloc(sizeof(struct clk), GFP_KERNEL); - -+ if (!clk) -+ return; - clk->cl.dev_id = dev_name(dev); - clk->cl.con_id = con; - clk->cl.clk = clk; -diff --git a/arch/mips/lantiq/xway/sysctrl.c b/arch/mips/lantiq/xway/sysctrl.c -index 2ee68d6e8bb99..6c2d9779ac727 100644 ---- a/arch/mips/lantiq/xway/sysctrl.c -+++ b/arch/mips/lantiq/xway/sysctrl.c -@@ -311,6 +311,8 @@ static void clkdev_add_pmu(const char *dev, const char *con, bool deactivate, - { - struct clk *clk = kzalloc(sizeof(struct clk), GFP_KERNEL); - -+ if (!clk) -+ return; - clk->cl.dev_id = dev; - clk->cl.con_id = con; - clk->cl.clk = clk; -@@ -334,6 +336,8 @@ static void clkdev_add_cgu(const char *dev, const char *con, - { - struct clk *clk = kzalloc(sizeof(struct clk), GFP_KERNEL); - -+ if (!clk) -+ return; - clk->cl.dev_id = dev; - clk->cl.con_id = con; - clk->cl.clk = clk; -@@ -352,24 +356,28 @@ static void clkdev_add_pci(void) - struct clk *clk_ext = kzalloc(sizeof(struct clk), GFP_KERNEL); - - /* main pci clock */ -- clk->cl.dev_id = "17000000.pci"; -- clk->cl.con_id = NULL; -- clk->cl.clk = clk; -- clk->rate = CLOCK_33M; -- clk->rates = valid_pci_rates; -- clk->enable = pci_enable; -- clk->disable = pmu_disable; -- clk->module = 0; -- clk->bits = PMU_PCI; -- clkdev_add(&clk->cl); -+ if (clk) { -+ clk->cl.dev_id = "17000000.pci"; -+ clk->cl.con_id = NULL; -+ clk->cl.clk = clk; -+ clk->rate = CLOCK_33M; -+ clk->rates = valid_pci_rates; -+ clk->enable = pci_enable; -+ clk->disable = pmu_disable; -+ clk->module = 0; -+ clk->bits = PMU_PCI; -+ clkdev_add(&clk->cl); -+ } - - /* use internal/external bus clock */ -- clk_ext->cl.dev_id = "17000000.pci"; -- clk_ext->cl.con_id = "external"; -- clk_ext->cl.clk = clk_ext; -- clk_ext->enable = pci_ext_enable; -- clk_ext->disable = pci_ext_disable; -- clkdev_add(&clk_ext->cl); -+ if (clk_ext) { -+ clk_ext->cl.dev_id = "17000000.pci"; -+ clk_ext->cl.con_id = "external"; -+ clk_ext->cl.clk = clk_ext; -+ clk_ext->enable = pci_ext_enable; -+ clk_ext->disable = pci_ext_disable; -+ clkdev_add(&clk_ext->cl); -+ } - } - - /* xway socs can generate clocks on gpio pins */ -@@ -389,9 +397,15 @@ static void clkdev_add_clkout(void) - char *name; - - name = kzalloc(sizeof("clkout0"), GFP_KERNEL); -+ if (!name) -+ continue; - sprintf(name, "clkout%d", i); - - clk = kzalloc(sizeof(struct clk), GFP_KERNEL); -+ if (!clk) { -+ kfree(name); -+ continue; -+ } - clk->cl.dev_id = "1f103000.cgu"; - clk->cl.con_id = name; - clk->cl.clk = clk; -diff --git a/arch/x86/crypto/chacha-avx512vl-x86_64.S b/arch/x86/crypto/chacha-avx512vl-x86_64.S -index 848f9c75fd4f5..596f91e3a774e 100644 ---- a/arch/x86/crypto/chacha-avx512vl-x86_64.S -+++ b/arch/x86/crypto/chacha-avx512vl-x86_64.S -@@ -172,7 +172,7 @@ ENTRY(chacha_2block_xor_avx512vl) - # xor remaining bytes from partial register into output - mov %rcx,%rax - and $0xf,%rcx -- jz .Ldone8 -+ jz .Ldone2 - mov %rax,%r9 - and $~0xf,%r9 - -@@ -438,7 +438,7 @@ ENTRY(chacha_4block_xor_avx512vl) - # xor remaining bytes from partial register into output - mov %rcx,%rax - and $0xf,%rcx -- jz .Ldone8 -+ jz .Ldone4 - mov %rax,%r9 - and $~0xf,%r9 - -diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c -index d3877dd713aef..015da62e4ad75 100644 ---- a/arch/x86/kvm/mmu.c -+++ b/arch/x86/kvm/mmu.c -@@ -5821,6 +5821,7 @@ static void kvm_zap_obsolete_pages(struct kvm *kvm) - { - struct kvm_mmu_page *sp, *node; - int nr_zapped, batch = 0; -+ bool unstable; - - restart: - list_for_each_entry_safe_reverse(sp, node, -@@ -5853,11 +5854,12 @@ restart: - goto restart; - } - -- if (__kvm_mmu_prepare_zap_page(kvm, sp, -- &kvm->arch.zapped_obsolete_pages, &nr_zapped)) { -- batch += nr_zapped; -+ unstable = __kvm_mmu_prepare_zap_page(kvm, sp, -+ &kvm->arch.zapped_obsolete_pages, &nr_zapped); -+ batch += nr_zapped; -+ -+ if (unstable) - goto restart; -- } - } - - /* -diff --git a/arch/x86/um/shared/sysdep/syscalls_64.h b/arch/x86/um/shared/sysdep/syscalls_64.h -index 8a7d5e1da98e5..1e6875b4ffd83 100644 ---- a/arch/x86/um/shared/sysdep/syscalls_64.h -+++ b/arch/x86/um/shared/sysdep/syscalls_64.h -@@ -10,13 +10,12 @@ - #include - #include - --typedef long syscall_handler_t(void); -+typedef long syscall_handler_t(long, long, long, long, long, long); - - extern syscall_handler_t *sys_call_table[]; - - #define EXECUTE_SYSCALL(syscall, regs) \ -- (((long (*)(long, long, long, long, long, long)) \ -- (*sys_call_table[syscall]))(UPT_SYSCALL_ARG1(®s->regs), \ -+ (((*sys_call_table[syscall]))(UPT_SYSCALL_ARG1(®s->regs), \ - UPT_SYSCALL_ARG2(®s->regs), \ - UPT_SYSCALL_ARG3(®s->regs), \ - UPT_SYSCALL_ARG4(®s->regs), \ -diff --git a/arch/x86/xen/smp_pv.c b/arch/x86/xen/smp_pv.c -index 64e6ec2c32a76..9d9777ded5f7b 100644 ---- a/arch/x86/xen/smp_pv.c -+++ b/arch/x86/xen/smp_pv.c -@@ -53,6 +53,7 @@ static DEFINE_PER_CPU(struct xen_common_irq, xen_irq_work) = { .irq = -1 }; - static DEFINE_PER_CPU(struct xen_common_irq, xen_pmu_irq) = { .irq = -1 }; - - static irqreturn_t xen_irq_work_interrupt(int irq, void *dev_id); -+void asm_cpu_bringup_and_idle(void); - - static void cpu_bringup(void) - { -@@ -310,7 +311,7 @@ cpu_initialize_context(unsigned int cpu, struct task_struct *idle) - * pointing just below where pt_regs would be if it were a normal - * kernel entry. - */ -- ctxt->user_regs.eip = (unsigned long)cpu_bringup_and_idle; -+ ctxt->user_regs.eip = (unsigned long)asm_cpu_bringup_and_idle; - ctxt->flags = VGCF_IN_KERNEL; - ctxt->user_regs.eflags = 0x1000; /* IOPL_RING1 */ - ctxt->user_regs.ds = __USER_DS; -diff --git a/arch/x86/xen/xen-head.S b/arch/x86/xen/xen-head.S -index c1d8b90aa4e2d..142da85474801 100644 ---- a/arch/x86/xen/xen-head.S -+++ b/arch/x86/xen/xen-head.S -@@ -35,7 +35,11 @@ ENTRY(startup_xen) - rep __ASM_SIZE(stos) - - mov %_ASM_SI, xen_start_info -- mov $init_thread_union+THREAD_SIZE, %_ASM_SP -+#ifdef CONFIG_X86_64 -+ mov initial_stack(%rip), %rsp -+#else -+ mov initial_stack, %esp -+#endif - - #ifdef CONFIG_X86_64 - /* Set up %gs. -@@ -51,9 +55,19 @@ ENTRY(startup_xen) - wrmsr - #endif - -- jmp xen_start_kernel -+ call xen_start_kernel - END(startup_xen) - __FINIT -+ -+#ifdef CONFIG_XEN_PV_SMP -+.pushsection .text -+SYM_CODE_START(asm_cpu_bringup_and_idle) -+ UNWIND_HINT_EMPTY -+ -+ call cpu_bringup_and_idle -+SYM_CODE_END(asm_cpu_bringup_and_idle) -+.popsection -+#endif - #endif - - .pushsection .text -diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c -index 1d443d17cf7c5..d46806182b051 100644 ---- a/block/bfq-iosched.c -+++ b/block/bfq-iosched.c -@@ -2251,6 +2251,9 @@ static int bfq_request_merge(struct request_queue *q, struct request **req, - __rq = bfq_find_rq_fmerge(bfqd, bio, q); - if (__rq && elv_bio_merge_ok(__rq, bio)) { - *req = __rq; -+ -+ if (blk_discard_mergable(__rq)) -+ return ELEVATOR_DISCARD_MERGE; - return ELEVATOR_FRONT_MERGE; - } - -diff --git a/block/blk-merge.c b/block/blk-merge.c -index a62692d135660..5219064cd72bb 100644 ---- a/block/blk-merge.c -+++ b/block/blk-merge.c -@@ -721,21 +721,6 @@ static void blk_account_io_merge(struct request *req) - part_stat_unlock(); - } - } --/* -- * Two cases of handling DISCARD merge: -- * If max_discard_segments > 1, the driver takes every bio -- * as a range and send them to controller together. The ranges -- * needn't to be contiguous. -- * Otherwise, the bios/requests will be handled as same as -- * others which should be contiguous. -- */ --static inline bool blk_discard_mergable(struct request *req) --{ -- if (req_op(req) == REQ_OP_DISCARD && -- queue_max_discard_segments(req->q) > 1) -- return true; -- return false; --} - - static enum elv_merge blk_try_req_merge(struct request *req, - struct request *next) -diff --git a/block/elevator.c b/block/elevator.c -index 78805c74ea8a4..3ba826230c578 100644 ---- a/block/elevator.c -+++ b/block/elevator.c -@@ -337,6 +337,9 @@ enum elv_merge elv_merge(struct request_queue *q, struct request **req, - __rq = elv_rqhash_find(q, bio->bi_iter.bi_sector); - if (__rq && elv_bio_merge_ok(__rq, bio)) { - *req = __rq; -+ -+ if (blk_discard_mergable(__rq)) -+ return ELEVATOR_DISCARD_MERGE; - return ELEVATOR_BACK_MERGE; - } - -diff --git a/block/mq-deadline.c b/block/mq-deadline.c -index 19c6922e85f1b..6d6dda5cfffa3 100644 ---- a/block/mq-deadline.c -+++ b/block/mq-deadline.c -@@ -452,6 +452,8 @@ static int dd_request_merge(struct request_queue *q, struct request **rq, - - if (elv_bio_merge_ok(__rq, bio)) { - *rq = __rq; -+ if (blk_discard_mergable(__rq)) -+ return ELEVATOR_DISCARD_MERGE; - return ELEVATOR_FRONT_MERGE; - } - } -diff --git a/drivers/base/firmware_loader/main.c b/drivers/base/firmware_loader/main.c -index 4f6b76bd957ef..12ab50d295484 100644 ---- a/drivers/base/firmware_loader/main.c -+++ b/drivers/base/firmware_loader/main.c -@@ -761,6 +761,8 @@ _request_firmware(const struct firmware **firmware_p, const char *name, - enum fw_opt opt_flags) - { - struct firmware *fw = NULL; -+ struct cred *kern_cred = NULL; -+ const struct cred *old_cred; - int ret; - - if (!firmware_p) -@@ -776,6 +778,18 @@ _request_firmware(const struct firmware **firmware_p, const char *name, - if (ret <= 0) /* error or already assigned */ - goto out; - -+ /* -+ * We are about to try to access the firmware file. Because we may have been -+ * called by a driver when serving an unrelated request from userland, we use -+ * the kernel credentials to read the file. -+ */ -+ kern_cred = prepare_kernel_cred(NULL); -+ if (!kern_cred) { -+ ret = -ENOMEM; -+ goto out; -+ } -+ old_cred = override_creds(kern_cred); -+ - ret = fw_get_filesystem_firmware(device, fw->priv, "", NULL); - #ifdef CONFIG_FW_LOADER_COMPRESS - if (ret == -ENOENT) -@@ -792,6 +806,9 @@ _request_firmware(const struct firmware **firmware_p, const char *name, - } else - ret = assign_fw(fw, device, opt_flags); - -+ revert_creds(old_cred); -+ put_cred(kern_cred); -+ - out: - if (ret < 0) { - fw_abort_batch_reqs(fw); -diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c -index a18155cdce416..ba10fa24fa1f1 100644 ---- a/drivers/block/drbd/drbd_main.c -+++ b/drivers/block/drbd/drbd_main.c -@@ -183,7 +183,7 @@ void tl_release(struct drbd_connection *connection, unsigned int barrier_nr, - unsigned int set_size) - { - struct drbd_request *r; -- struct drbd_request *req = NULL; -+ struct drbd_request *req = NULL, *tmp = NULL; - int expect_epoch = 0; - int expect_size = 0; - -@@ -237,8 +237,11 @@ void tl_release(struct drbd_connection *connection, unsigned int barrier_nr, - * to catch requests being barrier-acked "unexpectedly". - * It usually should find the same req again, or some READ preceding it. */ - list_for_each_entry(req, &connection->transfer_log, tl_requests) -- if (req->epoch == expect_epoch) -+ if (req->epoch == expect_epoch) { -+ tmp = req; - break; -+ } -+ req = list_prepare_entry(tmp, &connection->transfer_log, tl_requests); - list_for_each_entry_safe_from(req, r, &connection->transfer_log, tl_requests) { - if (req->epoch != expect_epoch) - break; -diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c -index f24e3791e8400..e133ff5fa5961 100644 ---- a/drivers/block/floppy.c -+++ b/drivers/block/floppy.c -@@ -521,8 +521,8 @@ static unsigned long fdc_busy; - static DECLARE_WAIT_QUEUE_HEAD(fdc_wait); - static DECLARE_WAIT_QUEUE_HEAD(command_done); - --/* Errors during formatting are counted here. */ --static int format_errors; -+/* errors encountered on the current (or last) request */ -+static int floppy_errors; - - /* Format request descriptor. */ - static struct format_descr format_req; -@@ -542,7 +542,6 @@ static struct format_descr format_req; - static char *floppy_track_buffer; - static int max_buffer_sectors; - --static int *errors; - typedef void (*done_f)(int); - static const struct cont_t { - void (*interrupt)(void); -@@ -1435,7 +1434,7 @@ static int interpret_errors(void) - if (DP->flags & FTD_MSG) - DPRINT("Over/Underrun - retrying\n"); - bad = 0; -- } else if (*errors >= DP->max_errors.reporting) { -+ } else if (floppy_errors >= DP->max_errors.reporting) { - print_errors(); - } - if (ST2 & ST2_WC || ST2 & ST2_BC) -@@ -2055,7 +2054,7 @@ static void bad_flp_intr(void) - if (!next_valid_format()) - return; - } -- err_count = ++(*errors); -+ err_count = ++floppy_errors; - INFBOUND(DRWE->badness, err_count); - if (err_count > DP->max_errors.abort) - cont->done(0); -@@ -2200,9 +2199,8 @@ static int do_format(int drive, struct format_descr *tmp_format_req) - return -EINVAL; - } - format_req = *tmp_format_req; -- format_errors = 0; - cont = &format_cont; -- errors = &format_errors; -+ floppy_errors = 0; - ret = wait_til_done(redo_format, true); - if (ret == -EINTR) - return -EINTR; -@@ -2677,7 +2675,7 @@ static int make_raw_rw_request(void) - */ - if (!direct || - (indirect * 2 > direct * 3 && -- *errors < DP->max_errors.read_track && -+ floppy_errors < DP->max_errors.read_track && - ((!probing || - (DP->read_track & (1 << DRS->probed_format)))))) { - max_size = blk_rq_sectors(current_req); -@@ -2801,10 +2799,11 @@ static int set_next_request(void) - current_req = list_first_entry_or_null(&floppy_reqs, struct request, - queuelist); - if (current_req) { -- current_req->error_count = 0; -+ floppy_errors = 0; - list_del_init(¤t_req->queuelist); -+ return 1; - } -- return current_req != NULL; -+ return 0; - } - - static void redo_fd_request(void) -@@ -2860,7 +2859,6 @@ do_request: - _floppy = floppy_type + DP->autodetect[DRS->probed_format]; - } else - probing = 0; -- errors = &(current_req->error_count); - tmp = make_raw_rw_request(); - if (tmp < 2) { - request_done(tmp); -diff --git a/drivers/clk/at91/clk-generated.c b/drivers/clk/at91/clk-generated.c -index d7fe1303f79dc..0e7ec5075689a 100644 ---- a/drivers/clk/at91/clk-generated.c -+++ b/drivers/clk/at91/clk-generated.c -@@ -105,6 +105,10 @@ static void clk_generated_best_diff(struct clk_rate_request *req, - tmp_rate = parent_rate; - else - tmp_rate = parent_rate / div; -+ -+ if (tmp_rate < req->min_rate || tmp_rate > req->max_rate) -+ return; -+ - tmp_diff = abs(req->rate - tmp_rate); - - if (*best_diff < 0 || *best_diff >= tmp_diff) { -diff --git a/drivers/crypto/qcom-rng.c b/drivers/crypto/qcom-rng.c -index 3a633a0c40fdf..6cc4fd005fe07 100644 ---- a/drivers/crypto/qcom-rng.c -+++ b/drivers/crypto/qcom-rng.c -@@ -64,6 +64,7 @@ static int qcom_rng_read(struct qcom_rng *rng, u8 *data, unsigned int max) - } else { - /* copy only remaining bytes */ - memcpy(data, &val, max - currsize); -+ break; - } - } while (currsize < max); - -diff --git a/drivers/crypto/stm32/stm32-crc32.c b/drivers/crypto/stm32/stm32-crc32.c -index fb640e0ea6140..2ecc970f5cae5 100644 ---- a/drivers/crypto/stm32/stm32-crc32.c -+++ b/drivers/crypto/stm32/stm32-crc32.c -@@ -332,8 +332,10 @@ static int stm32_crc_remove(struct platform_device *pdev) - struct stm32_crc *crc = platform_get_drvdata(pdev); - int ret = pm_runtime_get_sync(crc->dev); - -- if (ret < 0) -+ if (ret < 0) { -+ pm_runtime_put_noidle(crc->dev); - return ret; -+ } - - spin_lock(&crc_list.lock); - list_del(&crc->list); -diff --git a/drivers/gpio/gpio-mvebu.c b/drivers/gpio/gpio-mvebu.c -index 89a053b1d2799..b5ae28fce9a89 100644 ---- a/drivers/gpio/gpio-mvebu.c -+++ b/drivers/gpio/gpio-mvebu.c -@@ -697,6 +697,9 @@ static int mvebu_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm, - unsigned long flags; - unsigned int on, off; - -+ if (state->polarity != PWM_POLARITY_NORMAL) -+ return -EINVAL; -+ - val = (unsigned long long) mvpwm->clk_rate * state->duty_cycle; - do_div(val, NSEC_PER_SEC); - if (val > UINT_MAX) -diff --git a/drivers/gpio/gpio-vf610.c b/drivers/gpio/gpio-vf610.c -index 58776f2d69ff8..1ae612c796eef 100644 ---- a/drivers/gpio/gpio-vf610.c -+++ b/drivers/gpio/gpio-vf610.c -@@ -125,9 +125,13 @@ static int vf610_gpio_direction_output(struct gpio_chip *chip, unsigned gpio, - { - struct vf610_gpio_port *port = gpiochip_get_data(chip); - unsigned long mask = BIT(gpio); -+ u32 val; - -- if (port->sdata && port->sdata->have_paddr) -- vf610_gpio_writel(mask, port->gpio_base + GPIO_PDDR); -+ if (port->sdata && port->sdata->have_paddr) { -+ val = vf610_gpio_readl(port->gpio_base + GPIO_PDDR); -+ val |= mask; -+ vf610_gpio_writel(val, port->gpio_base + GPIO_PDDR); -+ } - - vf610_gpio_set(chip, gpio, value); - -diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c -index 2de1eebe591f9..1ff13af133243 100644 ---- a/drivers/gpu/drm/drm_dp_mst_topology.c -+++ b/drivers/gpu/drm/drm_dp_mst_topology.c -@@ -3657,6 +3657,7 @@ static void fetch_monitor_name(struct drm_dp_mst_topology_mgr *mgr, - - mst_edid = drm_dp_mst_get_edid(port->connector, mgr, port); - drm_edid_get_monitor_name(mst_edid, name, namelen); -+ kfree(mst_edid); - } - - /** -diff --git a/drivers/i2c/busses/i2c-mt7621.c b/drivers/i2c/busses/i2c-mt7621.c -index 62df8379bc895..65e72101b393b 100644 ---- a/drivers/i2c/busses/i2c-mt7621.c -+++ b/drivers/i2c/busses/i2c-mt7621.c -@@ -304,7 +304,8 @@ static int mtk_i2c_probe(struct platform_device *pdev) - - if (i2c->bus_freq == 0) { - dev_warn(i2c->dev, "clock-frequency 0 not supported\n"); -- return -EINVAL; -+ ret = -EINVAL; -+ goto err_disable_clk; - } - - adap = &i2c->adap; -@@ -322,10 +323,15 @@ static int mtk_i2c_probe(struct platform_device *pdev) - - ret = i2c_add_adapter(adap); - if (ret < 0) -- return ret; -+ goto err_disable_clk; - - dev_info(&pdev->dev, "clock %u kHz\n", i2c->bus_freq / 1000); - -+ return 0; -+ -+err_disable_clk: -+ clk_disable_unprepare(i2c->clk); -+ - return ret; - } - -diff --git a/drivers/input/input.c b/drivers/input/input.c -index e2eb9b9b8363d..0e16a9980c6a1 100644 ---- a/drivers/input/input.c -+++ b/drivers/input/input.c -@@ -47,6 +47,17 @@ static DEFINE_MUTEX(input_mutex); - - static const struct input_value input_value_sync = { EV_SYN, SYN_REPORT, 1 }; - -+static const unsigned int input_max_code[EV_CNT] = { -+ [EV_KEY] = KEY_MAX, -+ [EV_REL] = REL_MAX, -+ [EV_ABS] = ABS_MAX, -+ [EV_MSC] = MSC_MAX, -+ [EV_SW] = SW_MAX, -+ [EV_LED] = LED_MAX, -+ [EV_SND] = SND_MAX, -+ [EV_FF] = FF_MAX, -+}; -+ - static inline int is_event_supported(unsigned int code, - unsigned long *bm, unsigned int max) - { -@@ -1978,6 +1989,14 @@ EXPORT_SYMBOL(input_get_timestamp); - */ - void input_set_capability(struct input_dev *dev, unsigned int type, unsigned int code) - { -+ if (type < EV_CNT && input_max_code[type] && -+ code > input_max_code[type]) { -+ pr_err("%s: invalid code %u for type %u\n", __func__, code, -+ type); -+ dump_stack(); -+ return; -+ } -+ - switch (type) { - case EV_KEY: - __set_bit(code, dev->keybit); -diff --git a/drivers/input/touchscreen/ili210x.c b/drivers/input/touchscreen/ili210x.c -index 22839dde1d09f..bc6f6a2ac4b9d 100644 ---- a/drivers/input/touchscreen/ili210x.c -+++ b/drivers/input/touchscreen/ili210x.c -@@ -290,9 +290,9 @@ static int ili210x_i2c_probe(struct i2c_client *client, - if (error) - return error; - -- usleep_range(50, 100); -+ usleep_range(12000, 15000); - gpiod_set_value_cansleep(reset_gpio, 0); -- msleep(100); -+ msleep(160); - } - - priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL); -diff --git a/drivers/input/touchscreen/stmfts.c b/drivers/input/touchscreen/stmfts.c -index cd8805d71d977..be1dd504d5b1d 100644 ---- a/drivers/input/touchscreen/stmfts.c -+++ b/drivers/input/touchscreen/stmfts.c -@@ -339,11 +339,11 @@ static int stmfts_input_open(struct input_dev *dev) - - err = pm_runtime_get_sync(&sdata->client->dev); - if (err < 0) -- return err; -+ goto out; - - err = i2c_smbus_write_byte(sdata->client, STMFTS_MS_MT_SENSE_ON); - if (err) -- return err; -+ goto out; - - mutex_lock(&sdata->mutex); - sdata->running = true; -@@ -366,7 +366,9 @@ static int stmfts_input_open(struct input_dev *dev) - "failed to enable touchkey\n"); - } - -- return 0; -+out: -+ pm_runtime_put_noidle(&sdata->client->dev); -+ return err; - } - - static void stmfts_input_close(struct input_dev *dev) -diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c -index 362ad361d5861..709f117fd5772 100644 ---- a/drivers/mmc/core/block.c -+++ b/drivers/mmc/core/block.c -@@ -1126,7 +1126,7 @@ static void mmc_blk_issue_discard_rq(struct mmc_queue *mq, struct request *req) - card->erase_arg == MMC_TRIM_ARG ? - INAND_CMD38_ARG_TRIM : - INAND_CMD38_ARG_ERASE, -- 0); -+ card->ext_csd.generic_cmd6_time); - } - if (!err) - err = mmc_erase(card, from, nr, card->erase_arg); -@@ -1168,7 +1168,7 @@ retry: - arg == MMC_SECURE_TRIM1_ARG ? - INAND_CMD38_ARG_SECTRIM1 : - INAND_CMD38_ARG_SECERASE, -- 0); -+ card->ext_csd.generic_cmd6_time); - if (err) - goto out_retry; - } -@@ -1186,7 +1186,7 @@ retry: - err = mmc_switch(card, EXT_CSD_CMD_SET_NORMAL, - INAND_CMD38_ARG_EXT_CSD, - INAND_CMD38_ARG_SECTRIM2, -- 0); -+ card->ext_csd.generic_cmd6_time); - if (err) - goto out_retry; - } -diff --git a/drivers/mmc/core/mmc_ops.c b/drivers/mmc/core/mmc_ops.c -index 09311c2bd8588..d495ba2f368cb 100644 ---- a/drivers/mmc/core/mmc_ops.c -+++ b/drivers/mmc/core/mmc_ops.c -@@ -19,7 +19,9 @@ - #include "host.h" - #include "mmc_ops.h" - --#define MMC_OPS_TIMEOUT_MS (10 * 60 * 1000) /* 10 minute timeout */ -+#define MMC_OPS_TIMEOUT_MS (10 * 60 * 1000) /* 10min*/ -+#define MMC_BKOPS_TIMEOUT_MS (120 * 1000) /* 120s */ -+#define MMC_CACHE_FLUSH_TIMEOUT_MS (30 * 1000) /* 30s */ - - static const u8 tuning_blk_pattern_4bit[] = { - 0xff, 0x0f, 0xff, 0x00, 0xff, 0xcc, 0xc3, 0xcc, -@@ -458,10 +460,6 @@ static int mmc_poll_for_busy(struct mmc_card *card, unsigned int timeout_ms, - bool expired = false; - bool busy = false; - -- /* We have an unspecified cmd timeout, use the fallback value. */ -- if (!timeout_ms) -- timeout_ms = MMC_OPS_TIMEOUT_MS; -- - /* - * In cases when not allowed to poll by using CMD13 or because we aren't - * capable of polling by using ->card_busy(), then rely on waiting the -@@ -534,6 +532,12 @@ int __mmc_switch(struct mmc_card *card, u8 set, u8 index, u8 value, - - mmc_retune_hold(host); - -+ if (!timeout_ms) { -+ pr_warn("%s: unspecified timeout for CMD6 - use generic\n", -+ mmc_hostname(host)); -+ timeout_ms = card->ext_csd.generic_cmd6_time; -+ } -+ - /* - * If the cmd timeout and the max_busy_timeout of the host are both - * specified, let's validate them. A failure means we need to prevent -@@ -542,7 +546,7 @@ int __mmc_switch(struct mmc_card *card, u8 set, u8 index, u8 value, - * which also means they are on their own when it comes to deal with the - * busy timeout. - */ -- if (!(host->caps & MMC_CAP_NEED_RSP_BUSY) && timeout_ms && -+ if (!(host->caps & MMC_CAP_NEED_RSP_BUSY) && - host->max_busy_timeout && (timeout_ms > host->max_busy_timeout)) - use_r1b_resp = false; - -@@ -554,10 +558,6 @@ int __mmc_switch(struct mmc_card *card, u8 set, u8 index, u8 value, - cmd.flags = MMC_CMD_AC; - if (use_r1b_resp) { - cmd.flags |= MMC_RSP_SPI_R1B | MMC_RSP_R1B; -- /* -- * A busy_timeout of zero means the host can decide to use -- * whatever value it finds suitable. -- */ - cmd.busy_timeout = timeout_ms; - } else { - cmd.flags |= MMC_RSP_SPI_R1 | MMC_RSP_R1; -@@ -943,7 +943,7 @@ void mmc_run_bkops(struct mmc_card *card) - * urgent levels by using an asynchronous background task, when idle. - */ - err = mmc_switch(card, EXT_CSD_CMD_SET_NORMAL, -- EXT_CSD_BKOPS_START, 1, MMC_OPS_TIMEOUT_MS); -+ EXT_CSD_BKOPS_START, 1, MMC_BKOPS_TIMEOUT_MS); - if (err) - pr_warn("%s: Error %d starting bkops\n", - mmc_hostname(card->host), err); -@@ -961,7 +961,8 @@ int mmc_flush_cache(struct mmc_card *card) - - if (mmc_cache_enabled(card->host)) { - err = mmc_switch(card, EXT_CSD_CMD_SET_NORMAL, -- EXT_CSD_FLUSH_CACHE, 1, 0); -+ EXT_CSD_FLUSH_CACHE, 1, -+ MMC_CACHE_FLUSH_TIMEOUT_MS); - if (err) - pr_err("%s: cache flush error %d\n", - mmc_hostname(card->host), err); -diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c -index 2ad3fa6316ce3..cb5954eeb4090 100644 ---- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c -+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c -@@ -674,6 +674,13 @@ static int hw_atl_b0_hw_ring_tx_head_update(struct aq_hw_s *self, - err = -ENXIO; - goto err_exit; - } -+ -+ /* Validate that the new hw_head_ is reasonable. */ -+ if (hw_head_ >= ring->size) { -+ err = -ENXIO; -+ goto err_exit; -+ } -+ - ring->hw_head = hw_head_; - err = aq_hw_err_from_flags(self); - -diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c -index 002a374f197bd..78219a9943a73 100644 ---- a/drivers/net/ethernet/cadence/macb_main.c -+++ b/drivers/net/ethernet/cadence/macb_main.c -@@ -927,7 +927,6 @@ static void gem_rx_refill(struct macb_queue *queue) - /* Make hw descriptor updates visible to CPU */ - rmb(); - -- queue->rx_prepared_head++; - desc = macb_rx_desc(queue, entry); - - if (!queue->rx_skbuff[entry]) { -@@ -966,6 +965,7 @@ static void gem_rx_refill(struct macb_queue *queue) - dma_wmb(); - desc->addr &= ~MACB_BIT(RX_USED); - } -+ queue->rx_prepared_head++; - } - - /* Make descriptor updates visible to hardware */ -diff --git a/drivers/net/ethernet/dec/tulip/tulip_core.c b/drivers/net/ethernet/dec/tulip/tulip_core.c -index 3e3e08698876b..fea4223ad6f15 100644 ---- a/drivers/net/ethernet/dec/tulip/tulip_core.c -+++ b/drivers/net/ethernet/dec/tulip/tulip_core.c -@@ -1410,8 +1410,10 @@ static int tulip_init_one(struct pci_dev *pdev, const struct pci_device_id *ent) - - /* alloc_etherdev ensures aligned and zeroed private structures */ - dev = alloc_etherdev (sizeof (*tp)); -- if (!dev) -+ if (!dev) { -+ pci_disable_device(pdev); - return -ENOMEM; -+ } - - SET_NETDEV_DEV(dev, &pdev->dev); - if (pci_resource_len (pdev, 0) < tulip_tbl[chip_idx].io_size) { -@@ -1788,6 +1790,7 @@ err_out_free_res: - - err_out_free_netdev: - free_netdev (dev); -+ pci_disable_device(pdev); - return -ENODEV; - } - -diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c -index 3eea68f3a5262..88750a96cb3f2 100644 ---- a/drivers/net/ethernet/intel/ice/ice_main.c -+++ b/drivers/net/ethernet/intel/ice/ice_main.c -@@ -3561,9 +3561,10 @@ static int ice_up_complete(struct ice_vsi *vsi) - netif_carrier_on(vsi->netdev); - } - -- /* clear this now, and the first stats read will be used as baseline */ -- vsi->stat_offsets_loaded = false; -- -+ /* Perform an initial read of the statistics registers now to -+ * set the baseline so counters are ready when interface is up -+ */ -+ ice_update_eth_stats(vsi); - ice_service_task_schedule(pf); - - return 0; -diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c -index 3df25b231ab5c..26c8d09ad4ddb 100644 ---- a/drivers/net/ethernet/intel/igb/igb_main.c -+++ b/drivers/net/ethernet/intel/igb/igb_main.c -@@ -5318,7 +5318,8 @@ static void igb_watchdog_task(struct work_struct *work) - break; - } - -- if (adapter->link_speed != SPEED_1000) -+ if (adapter->link_speed != SPEED_1000 || -+ !hw->phy.ops.read_reg) - goto no_wait; - - /* wait for Remote receiver status OK */ -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -index 2465165cbea73..73291051808f9 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -@@ -3980,6 +3980,13 @@ static netdev_features_t mlx5e_fix_features(struct net_device *netdev, - } - } - -+ if (params->xdp_prog) { -+ if (features & NETIF_F_LRO) { -+ netdev_warn(netdev, "LRO is incompatible with XDP\n"); -+ features &= ~NETIF_F_LRO; -+ } -+ } -+ - if (MLX5E_GET_PFLAG(params, MLX5E_PFLAG_RX_CQE_COMPRESS)) { - features &= ~NETIF_F_RXHASH; - if (netdev->features & NETIF_F_RXHASH) -diff --git a/drivers/net/ethernet/qlogic/qla3xxx.c b/drivers/net/ethernet/qlogic/qla3xxx.c -index da2862d596813..5e81cd317a32f 100644 ---- a/drivers/net/ethernet/qlogic/qla3xxx.c -+++ b/drivers/net/ethernet/qlogic/qla3xxx.c -@@ -3629,7 +3629,8 @@ static void ql_reset_work(struct work_struct *work) - qdev->mem_map_registers; - unsigned long hw_flags; - -- if (test_bit((QL_RESET_PER_SCSI | QL_RESET_START), &qdev->flags)) { -+ if (test_bit(QL_RESET_PER_SCSI, &qdev->flags) || -+ test_bit(QL_RESET_START, &qdev->flags)) { - clear_bit(QL_LINK_MASTER, &qdev->flags); - - /* -diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -index 9cbc0179d24ec..9931724c4727d 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -@@ -4531,7 +4531,7 @@ int stmmac_dvr_probe(struct device *device, - dev_info(priv->device, "TSO feature enabled\n"); - } - -- if (priv->dma_cap.sphen) { -+ if (priv->dma_cap.sphen && !priv->plat->sph_disable) { - ndev->hw_features |= NETIF_F_GRO; - priv->sph = true; - dev_info(priv->device, "SPH feature enabled\n"); -diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c -index 292045f4581f7..0edcf3f704b74 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c -+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c -@@ -119,6 +119,7 @@ static int intel_mgbe_common_data(struct pci_dev *pdev, - plat->has_gmac4 = 1; - plat->force_sf_dma_mode = 0; - plat->tso_en = 1; -+ plat->sph_disable = 1; - - plat->rx_sched_algorithm = MTL_RX_ALGORITHM_SP; - -@@ -481,7 +482,7 @@ static int stmmac_pci_probe(struct pci_dev *pdev, - return -ENOMEM; - - /* Enable pci device */ -- ret = pci_enable_device(pdev); -+ ret = pcim_enable_device(pdev); - if (ret) { - dev_err(&pdev->dev, "%s: ERROR: failed to enable device\n", - __func__); -@@ -538,8 +539,6 @@ static void stmmac_pci_remove(struct pci_dev *pdev) - pcim_iounmap_regions(pdev, BIT(i)); - break; - } -- -- pci_disable_device(pdev); - } - - static int __maybe_unused stmmac_pci_suspend(struct device *dev) -diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c -index cf090f88dac03..609f65530b9b0 100644 ---- a/drivers/net/vmxnet3/vmxnet3_drv.c -+++ b/drivers/net/vmxnet3/vmxnet3_drv.c -@@ -595,6 +595,7 @@ vmxnet3_rq_alloc_rx_buf(struct vmxnet3_rx_queue *rq, u32 ring_idx, - if (dma_mapping_error(&adapter->pdev->dev, - rbi->dma_addr)) { - dev_kfree_skb_any(rbi->skb); -+ rbi->skb = NULL; - rq->stats.rx_buf_alloc_failure++; - break; - } -@@ -619,6 +620,7 @@ vmxnet3_rq_alloc_rx_buf(struct vmxnet3_rx_queue *rq, u32 ring_idx, - if (dma_mapping_error(&adapter->pdev->dev, - rbi->dma_addr)) { - put_page(rbi->page); -+ rbi->page = NULL; - rq->stats.rx_buf_alloc_failure++; - break; - } -@@ -1584,6 +1586,10 @@ vmxnet3_rq_cleanup(struct vmxnet3_rx_queue *rq, - u32 i, ring_idx; - struct Vmxnet3_RxDesc *rxd; - -+ /* ring has already been cleaned up */ -+ if (!rq->rx_ring[0].base) -+ return; -+ - for (ring_idx = 0; ring_idx < 2; ring_idx++) { - for (i = 0; i < rq->rx_ring[ring_idx].size; i++) { - #ifdef __BIG_ENDIAN_BITFIELD -diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c -index 6a9a42809f972..79e22618817de 100644 ---- a/drivers/nvme/host/core.c -+++ b/drivers/nvme/host/core.c -@@ -4047,6 +4047,7 @@ void nvme_start_ctrl(struct nvme_ctrl *ctrl) - if (ctrl->queue_count > 1) { - nvme_queue_scan(ctrl); - nvme_start_queues(ctrl); -+ nvme_mpath_update(ctrl); - } - ctrl->created = true; - } -diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c -index 4d615337e6e22..811f7b96b5517 100644 ---- a/drivers/nvme/host/multipath.c -+++ b/drivers/nvme/host/multipath.c -@@ -501,8 +501,17 @@ static void nvme_update_ns_ana_state(struct nvme_ana_group_desc *desc, - ns->ana_grpid = le32_to_cpu(desc->grpid); - ns->ana_state = desc->state; - clear_bit(NVME_NS_ANA_PENDING, &ns->flags); -- -- if (nvme_state_is_live(ns->ana_state)) -+ /* -+ * nvme_mpath_set_live() will trigger I/O to the multipath path device -+ * and in turn to this path device. However we cannot accept this I/O -+ * if the controller is not live. This may deadlock if called from -+ * nvme_mpath_init_identify() and the ctrl will never complete -+ * initialization, preventing I/O from completing. For this case we -+ * will reprocess the ANA log page in nvme_mpath_update() once the -+ * controller is ready. -+ */ -+ if (nvme_state_is_live(ns->ana_state) && -+ ns->ctrl->state == NVME_CTRL_LIVE) - nvme_mpath_set_live(ns); - } - -@@ -586,6 +595,18 @@ static void nvme_ana_work(struct work_struct *work) - nvme_read_ana_log(ctrl); - } - -+void nvme_mpath_update(struct nvme_ctrl *ctrl) -+{ -+ u32 nr_change_groups = 0; -+ -+ if (!ctrl->ana_log_buf) -+ return; -+ -+ mutex_lock(&ctrl->ana_lock); -+ nvme_parse_ana_log(ctrl, &nr_change_groups, nvme_update_ana_state); -+ mutex_unlock(&ctrl->ana_lock); -+} -+ - static void nvme_anatt_timeout(struct timer_list *t) - { - struct nvme_ctrl *ctrl = from_timer(ctrl, t, anatt_timer); -diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h -index 2df90d4355b9a..1d1431dd4f9e3 100644 ---- a/drivers/nvme/host/nvme.h -+++ b/drivers/nvme/host/nvme.h -@@ -551,6 +551,7 @@ void nvme_mpath_add_disk(struct nvme_ns *ns, struct nvme_id_ns *id); - void nvme_mpath_remove_disk(struct nvme_ns_head *head); - int nvme_mpath_init_identify(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id); - void nvme_mpath_init_ctrl(struct nvme_ctrl *ctrl); -+void nvme_mpath_update(struct nvme_ctrl *ctrl); - void nvme_mpath_uninit(struct nvme_ctrl *ctrl); - void nvme_mpath_stop(struct nvme_ctrl *ctrl); - bool nvme_mpath_clear_current_path(struct nvme_ns *ns); -@@ -648,6 +649,9 @@ static inline int nvme_mpath_init_identify(struct nvme_ctrl *ctrl, - "Please enable CONFIG_NVME_MULTIPATH for full support of multi-port devices.\n"); - return 0; - } -+static inline void nvme_mpath_update(struct nvme_ctrl *ctrl) -+{ -+} - static inline void nvme_mpath_uninit(struct nvme_ctrl *ctrl) - { - } -diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c -index b9550cd4280ca..d539eb379743e 100644 ---- a/drivers/pci/pci.c -+++ b/drivers/pci/pci.c -@@ -2613,6 +2613,16 @@ static const struct dmi_system_id bridge_d3_blacklist[] = { - DMI_MATCH(DMI_BOARD_VENDOR, "Gigabyte Technology Co., Ltd."), - DMI_MATCH(DMI_BOARD_NAME, "X299 DESIGNARE EX-CF"), - }, -+ /* -+ * Downstream device is not accessible after putting a root port -+ * into D3cold and back into D0 on Elo i2. -+ */ -+ .ident = "Elo i2", -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "Elo Touch Solutions"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "Elo i2"), -+ DMI_MATCH(DMI_PRODUCT_VERSION, "RevB"), -+ }, - }, - #endif - { } -diff --git a/drivers/platform/chrome/cros_ec_debugfs.c b/drivers/platform/chrome/cros_ec_debugfs.c -index 6ae484989d1f5..c4b57e1df192a 100644 ---- a/drivers/platform/chrome/cros_ec_debugfs.c -+++ b/drivers/platform/chrome/cros_ec_debugfs.c -@@ -26,6 +26,9 @@ - - #define CIRC_ADD(idx, size, value) (((idx) + (value)) & ((size) - 1)) - -+/* waitqueue for log readers */ -+static DECLARE_WAIT_QUEUE_HEAD(cros_ec_debugfs_log_wq); -+ - /** - * struct cros_ec_debugfs - EC debugging information. - * -@@ -34,7 +37,6 @@ - * @log_buffer: circular buffer for console log information - * @read_msg: preallocated EC command and buffer to read console log - * @log_mutex: mutex to protect circular buffer -- * @log_wq: waitqueue for log readers - * @log_poll_work: recurring task to poll EC for new console log data - * @panicinfo_blob: panicinfo debugfs blob - */ -@@ -45,7 +47,6 @@ struct cros_ec_debugfs { - struct circ_buf log_buffer; - struct cros_ec_command *read_msg; - struct mutex log_mutex; -- wait_queue_head_t log_wq; - struct delayed_work log_poll_work; - /* EC panicinfo */ - struct debugfs_blob_wrapper panicinfo_blob; -@@ -108,7 +109,7 @@ static void cros_ec_console_log_work(struct work_struct *__work) - buf_space--; - } - -- wake_up(&debug_info->log_wq); -+ wake_up(&cros_ec_debugfs_log_wq); - } - - mutex_unlock(&debug_info->log_mutex); -@@ -142,7 +143,7 @@ static ssize_t cros_ec_console_log_read(struct file *file, char __user *buf, - - mutex_unlock(&debug_info->log_mutex); - -- ret = wait_event_interruptible(debug_info->log_wq, -+ ret = wait_event_interruptible(cros_ec_debugfs_log_wq, - CIRC_CNT(cb->head, cb->tail, LOG_SIZE)); - if (ret < 0) - return ret; -@@ -174,7 +175,7 @@ static __poll_t cros_ec_console_log_poll(struct file *file, - struct cros_ec_debugfs *debug_info = file->private_data; - __poll_t mask = 0; - -- poll_wait(file, &debug_info->log_wq, wait); -+ poll_wait(file, &cros_ec_debugfs_log_wq, wait); - - mutex_lock(&debug_info->log_mutex); - if (CIRC_CNT(debug_info->log_buffer.head, -@@ -359,7 +360,6 @@ static int cros_ec_create_console_log(struct cros_ec_debugfs *debug_info) - debug_info->log_buffer.tail = 0; - - mutex_init(&debug_info->log_mutex); -- init_waitqueue_head(&debug_info->log_wq); - - debugfs_create_file("console_log", S_IFREG | 0444, debug_info->dir, - debug_info, &cros_ec_console_log_fops); -diff --git a/drivers/rtc/class.c b/drivers/rtc/class.c -index 9458e6d6686ac..8b434213bc7ad 100644 ---- a/drivers/rtc/class.c -+++ b/drivers/rtc/class.c -@@ -26,6 +26,15 @@ struct class *rtc_class; - static void rtc_device_release(struct device *dev) - { - struct rtc_device *rtc = to_rtc_device(dev); -+ struct timerqueue_head *head = &rtc->timerqueue; -+ struct timerqueue_node *node; -+ -+ mutex_lock(&rtc->ops_lock); -+ while ((node = timerqueue_getnext(head))) -+ timerqueue_del(head, node); -+ mutex_unlock(&rtc->ops_lock); -+ -+ cancel_work_sync(&rtc->irqwork); - - ida_simple_remove(&rtc_ida, rtc->id); - kfree(rtc); -diff --git a/drivers/rtc/rtc-mc146818-lib.c b/drivers/rtc/rtc-mc146818-lib.c -index 5add637c9ad23..b036ff33fbe61 100644 ---- a/drivers/rtc/rtc-mc146818-lib.c -+++ b/drivers/rtc/rtc-mc146818-lib.c -@@ -99,6 +99,17 @@ unsigned int mc146818_get_time(struct rtc_time *time) - } - EXPORT_SYMBOL_GPL(mc146818_get_time); - -+/* AMD systems don't allow access to AltCentury with DV1 */ -+static bool apply_amd_register_a_behavior(void) -+{ -+#ifdef CONFIG_X86 -+ if (boot_cpu_data.x86_vendor == X86_VENDOR_AMD || -+ boot_cpu_data.x86_vendor == X86_VENDOR_HYGON) -+ return true; -+#endif -+ return false; -+} -+ - /* Set the current date and time in the real time clock. */ - int mc146818_set_time(struct rtc_time *time) - { -@@ -172,7 +183,10 @@ int mc146818_set_time(struct rtc_time *time) - save_control = CMOS_READ(RTC_CONTROL); - CMOS_WRITE((save_control|RTC_SET), RTC_CONTROL); - save_freq_select = CMOS_READ(RTC_FREQ_SELECT); -- CMOS_WRITE((save_freq_select|RTC_DIV_RESET2), RTC_FREQ_SELECT); -+ if (apply_amd_register_a_behavior()) -+ CMOS_WRITE((save_freq_select & ~RTC_AMD_BANK_SELECT), RTC_FREQ_SELECT); -+ else -+ CMOS_WRITE((save_freq_select|RTC_DIV_RESET2), RTC_FREQ_SELECT); - - #ifdef CONFIG_MACH_DECSTATION - CMOS_WRITE(real_yrs, RTC_DEC_YEAR); -diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c -index df598c377161d..cb97565b6a333 100644 ---- a/drivers/scsi/qla2xxx/qla_target.c -+++ b/drivers/scsi/qla2xxx/qla_target.c -@@ -3768,6 +3768,9 @@ int qlt_abort_cmd(struct qla_tgt_cmd *cmd) - - spin_lock_irqsave(&cmd->cmd_lock, flags); - if (cmd->aborted) { -+ if (cmd->sg_mapped) -+ qlt_unmap_sg(vha, cmd); -+ - spin_unlock_irqrestore(&cmd->cmd_lock, flags); - /* - * It's normal to see 2 calls in this path: -diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c -index 1058aba8d5734..3e0267ead718d 100644 ---- a/drivers/vhost/net.c -+++ b/drivers/vhost/net.c -@@ -1446,13 +1446,9 @@ err: - return ERR_PTR(r); - } - --static struct ptr_ring *get_tap_ptr_ring(int fd) -+static struct ptr_ring *get_tap_ptr_ring(struct file *file) - { - struct ptr_ring *ring; -- struct file *file = fget(fd); -- -- if (!file) -- return NULL; - ring = tun_get_tx_ring(file); - if (!IS_ERR(ring)) - goto out; -@@ -1461,7 +1457,6 @@ static struct ptr_ring *get_tap_ptr_ring(int fd) - goto out; - ring = NULL; - out: -- fput(file); - return ring; - } - -@@ -1548,8 +1543,12 @@ static long vhost_net_set_backend(struct vhost_net *n, unsigned index, int fd) - r = vhost_net_enable_vq(n, vq); - if (r) - goto err_used; -- if (index == VHOST_NET_VQ_RX) -- nvq->rx_ring = get_tap_ptr_ring(fd); -+ if (index == VHOST_NET_VQ_RX) { -+ if (sock) -+ nvq->rx_ring = get_tap_ptr_ring(sock->file); -+ else -+ nvq->rx_ring = NULL; -+ } - - oldubufs = nvq->ubufs; - nvq->ubufs = ubufs; -diff --git a/fs/afs/inode.c b/fs/afs/inode.c -index 4f58b28a1edd2..90eac3ec01cbc 100644 ---- a/fs/afs/inode.c -+++ b/fs/afs/inode.c -@@ -734,10 +734,22 @@ int afs_getattr(const struct path *path, struct kstat *stat, - { - struct inode *inode = d_inode(path->dentry); - struct afs_vnode *vnode = AFS_FS_I(inode); -- int seq = 0; -+ struct key *key; -+ int ret, seq = 0; - - _enter("{ ino=%lu v=%u }", inode->i_ino, inode->i_generation); - -+ if (!(query_flags & AT_STATX_DONT_SYNC) && -+ !test_bit(AFS_VNODE_CB_PROMISED, &vnode->flags)) { -+ key = afs_request_key(vnode->volume->cell); -+ if (IS_ERR(key)) -+ return PTR_ERR(key); -+ ret = afs_validate(vnode, key); -+ key_put(key); -+ if (ret < 0) -+ return ret; -+ } -+ - do { - read_seqbegin_or_lock(&vnode->cb_lock, &seq); - generic_fillattr(inode, stat); -diff --git a/fs/file_table.c b/fs/file_table.c -index 30d55c9a1744a..70e8fb68a1717 100644 ---- a/fs/file_table.c -+++ b/fs/file_table.c -@@ -375,6 +375,7 @@ void __fput_sync(struct file *file) - } - - EXPORT_SYMBOL(fput); -+EXPORT_SYMBOL(__fput_sync); - - void __init files_init(void) - { -diff --git a/fs/nilfs2/btnode.c b/fs/nilfs2/btnode.c -index 4391fd3abd8f8..e00e184b12615 100644 ---- a/fs/nilfs2/btnode.c -+++ b/fs/nilfs2/btnode.c -@@ -20,6 +20,23 @@ - #include "page.h" - #include "btnode.h" - -+ -+/** -+ * nilfs_init_btnc_inode - initialize B-tree node cache inode -+ * @btnc_inode: inode to be initialized -+ * -+ * nilfs_init_btnc_inode() sets up an inode for B-tree node cache. -+ */ -+void nilfs_init_btnc_inode(struct inode *btnc_inode) -+{ -+ struct nilfs_inode_info *ii = NILFS_I(btnc_inode); -+ -+ btnc_inode->i_mode = S_IFREG; -+ ii->i_flags = 0; -+ memset(&ii->i_bmap_data, 0, sizeof(struct nilfs_bmap)); -+ mapping_set_gfp_mask(btnc_inode->i_mapping, GFP_NOFS); -+} -+ - void nilfs_btnode_cache_clear(struct address_space *btnc) - { - invalidate_mapping_pages(btnc, 0, -1); -@@ -29,7 +46,7 @@ void nilfs_btnode_cache_clear(struct address_space *btnc) - struct buffer_head * - nilfs_btnode_create_block(struct address_space *btnc, __u64 blocknr) - { -- struct inode *inode = NILFS_BTNC_I(btnc); -+ struct inode *inode = btnc->host; - struct buffer_head *bh; - - bh = nilfs_grab_buffer(inode, btnc, blocknr, BIT(BH_NILFS_Node)); -@@ -57,7 +74,7 @@ int nilfs_btnode_submit_block(struct address_space *btnc, __u64 blocknr, - struct buffer_head **pbh, sector_t *submit_ptr) - { - struct buffer_head *bh; -- struct inode *inode = NILFS_BTNC_I(btnc); -+ struct inode *inode = btnc->host; - struct page *page; - int err; - -@@ -157,7 +174,7 @@ int nilfs_btnode_prepare_change_key(struct address_space *btnc, - struct nilfs_btnode_chkey_ctxt *ctxt) - { - struct buffer_head *obh, *nbh; -- struct inode *inode = NILFS_BTNC_I(btnc); -+ struct inode *inode = btnc->host; - __u64 oldkey = ctxt->oldkey, newkey = ctxt->newkey; - int err; - -diff --git a/fs/nilfs2/btnode.h b/fs/nilfs2/btnode.h -index 0f88dbc9bcb3e..05ab64d354dc9 100644 ---- a/fs/nilfs2/btnode.h -+++ b/fs/nilfs2/btnode.h -@@ -30,6 +30,7 @@ struct nilfs_btnode_chkey_ctxt { - struct buffer_head *newbh; - }; - -+void nilfs_init_btnc_inode(struct inode *btnc_inode); - void nilfs_btnode_cache_clear(struct address_space *); - struct buffer_head *nilfs_btnode_create_block(struct address_space *btnc, - __u64 blocknr); -diff --git a/fs/nilfs2/btree.c b/fs/nilfs2/btree.c -index 23e043eca237b..919d1238ce45f 100644 ---- a/fs/nilfs2/btree.c -+++ b/fs/nilfs2/btree.c -@@ -58,7 +58,8 @@ static void nilfs_btree_free_path(struct nilfs_btree_path *path) - static int nilfs_btree_get_new_block(const struct nilfs_bmap *btree, - __u64 ptr, struct buffer_head **bhp) - { -- struct address_space *btnc = &NILFS_BMAP_I(btree)->i_btnode_cache; -+ struct inode *btnc_inode = NILFS_BMAP_I(btree)->i_assoc_inode; -+ struct address_space *btnc = btnc_inode->i_mapping; - struct buffer_head *bh; - - bh = nilfs_btnode_create_block(btnc, ptr); -@@ -470,7 +471,8 @@ static int __nilfs_btree_get_block(const struct nilfs_bmap *btree, __u64 ptr, - struct buffer_head **bhp, - const struct nilfs_btree_readahead_info *ra) - { -- struct address_space *btnc = &NILFS_BMAP_I(btree)->i_btnode_cache; -+ struct inode *btnc_inode = NILFS_BMAP_I(btree)->i_assoc_inode; -+ struct address_space *btnc = btnc_inode->i_mapping; - struct buffer_head *bh, *ra_bh; - sector_t submit_ptr = 0; - int ret; -@@ -1742,6 +1744,10 @@ nilfs_btree_prepare_convert_and_insert(struct nilfs_bmap *btree, __u64 key, - dat = nilfs_bmap_get_dat(btree); - } - -+ ret = nilfs_attach_btree_node_cache(&NILFS_BMAP_I(btree)->vfs_inode); -+ if (ret < 0) -+ return ret; -+ - ret = nilfs_bmap_prepare_alloc_ptr(btree, dreq, dat); - if (ret < 0) - return ret; -@@ -1914,7 +1920,7 @@ static int nilfs_btree_prepare_update_v(struct nilfs_bmap *btree, - path[level].bp_ctxt.newkey = path[level].bp_newreq.bpr_ptr; - path[level].bp_ctxt.bh = path[level].bp_bh; - ret = nilfs_btnode_prepare_change_key( -- &NILFS_BMAP_I(btree)->i_btnode_cache, -+ NILFS_BMAP_I(btree)->i_assoc_inode->i_mapping, - &path[level].bp_ctxt); - if (ret < 0) { - nilfs_dat_abort_update(dat, -@@ -1940,7 +1946,7 @@ static void nilfs_btree_commit_update_v(struct nilfs_bmap *btree, - - if (buffer_nilfs_node(path[level].bp_bh)) { - nilfs_btnode_commit_change_key( -- &NILFS_BMAP_I(btree)->i_btnode_cache, -+ NILFS_BMAP_I(btree)->i_assoc_inode->i_mapping, - &path[level].bp_ctxt); - path[level].bp_bh = path[level].bp_ctxt.bh; - } -@@ -1959,7 +1965,7 @@ static void nilfs_btree_abort_update_v(struct nilfs_bmap *btree, - &path[level].bp_newreq.bpr_req); - if (buffer_nilfs_node(path[level].bp_bh)) - nilfs_btnode_abort_change_key( -- &NILFS_BMAP_I(btree)->i_btnode_cache, -+ NILFS_BMAP_I(btree)->i_assoc_inode->i_mapping, - &path[level].bp_ctxt); - } - -@@ -2135,7 +2141,8 @@ static void nilfs_btree_add_dirty_buffer(struct nilfs_bmap *btree, - static void nilfs_btree_lookup_dirty_buffers(struct nilfs_bmap *btree, - struct list_head *listp) - { -- struct address_space *btcache = &NILFS_BMAP_I(btree)->i_btnode_cache; -+ struct inode *btnc_inode = NILFS_BMAP_I(btree)->i_assoc_inode; -+ struct address_space *btcache = btnc_inode->i_mapping; - struct list_head lists[NILFS_BTREE_LEVEL_MAX]; - struct pagevec pvec; - struct buffer_head *bh, *head; -@@ -2189,12 +2196,12 @@ static int nilfs_btree_assign_p(struct nilfs_bmap *btree, - path[level].bp_ctxt.newkey = blocknr; - path[level].bp_ctxt.bh = *bh; - ret = nilfs_btnode_prepare_change_key( -- &NILFS_BMAP_I(btree)->i_btnode_cache, -+ NILFS_BMAP_I(btree)->i_assoc_inode->i_mapping, - &path[level].bp_ctxt); - if (ret < 0) - return ret; - nilfs_btnode_commit_change_key( -- &NILFS_BMAP_I(btree)->i_btnode_cache, -+ NILFS_BMAP_I(btree)->i_assoc_inode->i_mapping, - &path[level].bp_ctxt); - *bh = path[level].bp_ctxt.bh; - } -@@ -2399,6 +2406,10 @@ int nilfs_btree_init(struct nilfs_bmap *bmap) - - if (nilfs_btree_root_broken(nilfs_btree_get_root(bmap), bmap->b_inode)) - ret = -EIO; -+ else -+ ret = nilfs_attach_btree_node_cache( -+ &NILFS_BMAP_I(bmap)->vfs_inode); -+ - return ret; - } - -diff --git a/fs/nilfs2/dat.c b/fs/nilfs2/dat.c -index 6f4066636be9a..a3523a243e113 100644 ---- a/fs/nilfs2/dat.c -+++ b/fs/nilfs2/dat.c -@@ -497,7 +497,9 @@ int nilfs_dat_read(struct super_block *sb, size_t entry_size, - di = NILFS_DAT_I(dat); - lockdep_set_class(&di->mi.mi_sem, &dat_lock_key); - nilfs_palloc_setup_cache(dat, &di->palloc_cache); -- nilfs_mdt_setup_shadow_map(dat, &di->shadow); -+ err = nilfs_mdt_setup_shadow_map(dat, &di->shadow); -+ if (err) -+ goto failed; - - err = nilfs_read_inode_common(dat, raw_inode); - if (err) -diff --git a/fs/nilfs2/gcinode.c b/fs/nilfs2/gcinode.c -index aa3c328ee189c..114774ac2185a 100644 ---- a/fs/nilfs2/gcinode.c -+++ b/fs/nilfs2/gcinode.c -@@ -126,9 +126,10 @@ int nilfs_gccache_submit_read_data(struct inode *inode, sector_t blkoff, - int nilfs_gccache_submit_read_node(struct inode *inode, sector_t pbn, - __u64 vbn, struct buffer_head **out_bh) - { -+ struct inode *btnc_inode = NILFS_I(inode)->i_assoc_inode; - int ret; - -- ret = nilfs_btnode_submit_block(&NILFS_I(inode)->i_btnode_cache, -+ ret = nilfs_btnode_submit_block(btnc_inode->i_mapping, - vbn ? : pbn, pbn, REQ_OP_READ, 0, - out_bh, &pbn); - if (ret == -EEXIST) /* internal code (cache hit) */ -@@ -170,7 +171,7 @@ int nilfs_init_gcinode(struct inode *inode) - ii->i_flags = 0; - nilfs_bmap_init_gc(ii->i_bmap); - -- return 0; -+ return nilfs_attach_btree_node_cache(inode); - } - - /** -@@ -185,7 +186,7 @@ void nilfs_remove_all_gcinodes(struct the_nilfs *nilfs) - ii = list_first_entry(head, struct nilfs_inode_info, i_dirty); - list_del_init(&ii->i_dirty); - truncate_inode_pages(&ii->vfs_inode.i_data, 0); -- nilfs_btnode_cache_clear(&ii->i_btnode_cache); -+ nilfs_btnode_cache_clear(ii->i_assoc_inode->i_mapping); - iput(&ii->vfs_inode); - } - } -diff --git a/fs/nilfs2/inode.c b/fs/nilfs2/inode.c -index 671085512e0fd..35b0bfe9324f2 100644 ---- a/fs/nilfs2/inode.c -+++ b/fs/nilfs2/inode.c -@@ -28,12 +28,16 @@ - * @cno: checkpoint number - * @root: pointer on NILFS root object (mounted checkpoint) - * @for_gc: inode for GC flag -+ * @for_btnc: inode for B-tree node cache flag -+ * @for_shadow: inode for shadowed page cache flag - */ - struct nilfs_iget_args { - u64 ino; - __u64 cno; - struct nilfs_root *root; -- int for_gc; -+ bool for_gc; -+ bool for_btnc; -+ bool for_shadow; - }; - - static int nilfs_iget_test(struct inode *inode, void *opaque); -@@ -322,7 +326,8 @@ static int nilfs_insert_inode_locked(struct inode *inode, - unsigned long ino) - { - struct nilfs_iget_args args = { -- .ino = ino, .root = root, .cno = 0, .for_gc = 0 -+ .ino = ino, .root = root, .cno = 0, .for_gc = false, -+ .for_btnc = false, .for_shadow = false - }; - - return insert_inode_locked4(inode, ino, nilfs_iget_test, &args); -@@ -534,6 +539,19 @@ static int nilfs_iget_test(struct inode *inode, void *opaque) - return 0; - - ii = NILFS_I(inode); -+ if (test_bit(NILFS_I_BTNC, &ii->i_state)) { -+ if (!args->for_btnc) -+ return 0; -+ } else if (args->for_btnc) { -+ return 0; -+ } -+ if (test_bit(NILFS_I_SHADOW, &ii->i_state)) { -+ if (!args->for_shadow) -+ return 0; -+ } else if (args->for_shadow) { -+ return 0; -+ } -+ - if (!test_bit(NILFS_I_GCINODE, &ii->i_state)) - return !args->for_gc; - -@@ -545,15 +563,17 @@ static int nilfs_iget_set(struct inode *inode, void *opaque) - struct nilfs_iget_args *args = opaque; - - inode->i_ino = args->ino; -- if (args->for_gc) { -+ NILFS_I(inode)->i_cno = args->cno; -+ NILFS_I(inode)->i_root = args->root; -+ if (args->root && args->ino == NILFS_ROOT_INO) -+ nilfs_get_root(args->root); -+ -+ if (args->for_gc) - NILFS_I(inode)->i_state = BIT(NILFS_I_GCINODE); -- NILFS_I(inode)->i_cno = args->cno; -- NILFS_I(inode)->i_root = NULL; -- } else { -- if (args->root && args->ino == NILFS_ROOT_INO) -- nilfs_get_root(args->root); -- NILFS_I(inode)->i_root = args->root; -- } -+ if (args->for_btnc) -+ NILFS_I(inode)->i_state |= BIT(NILFS_I_BTNC); -+ if (args->for_shadow) -+ NILFS_I(inode)->i_state |= BIT(NILFS_I_SHADOW); - return 0; - } - -@@ -561,7 +581,8 @@ struct inode *nilfs_ilookup(struct super_block *sb, struct nilfs_root *root, - unsigned long ino) - { - struct nilfs_iget_args args = { -- .ino = ino, .root = root, .cno = 0, .for_gc = 0 -+ .ino = ino, .root = root, .cno = 0, .for_gc = false, -+ .for_btnc = false, .for_shadow = false - }; - - return ilookup5(sb, ino, nilfs_iget_test, &args); -@@ -571,7 +592,8 @@ struct inode *nilfs_iget_locked(struct super_block *sb, struct nilfs_root *root, - unsigned long ino) - { - struct nilfs_iget_args args = { -- .ino = ino, .root = root, .cno = 0, .for_gc = 0 -+ .ino = ino, .root = root, .cno = 0, .for_gc = false, -+ .for_btnc = false, .for_shadow = false - }; - - return iget5_locked(sb, ino, nilfs_iget_test, nilfs_iget_set, &args); -@@ -602,7 +624,8 @@ struct inode *nilfs_iget_for_gc(struct super_block *sb, unsigned long ino, - __u64 cno) - { - struct nilfs_iget_args args = { -- .ino = ino, .root = NULL, .cno = cno, .for_gc = 1 -+ .ino = ino, .root = NULL, .cno = cno, .for_gc = true, -+ .for_btnc = false, .for_shadow = false - }; - struct inode *inode; - int err; -@@ -622,6 +645,113 @@ struct inode *nilfs_iget_for_gc(struct super_block *sb, unsigned long ino, - return inode; - } - -+/** -+ * nilfs_attach_btree_node_cache - attach a B-tree node cache to the inode -+ * @inode: inode object -+ * -+ * nilfs_attach_btree_node_cache() attaches a B-tree node cache to @inode, -+ * or does nothing if the inode already has it. This function allocates -+ * an additional inode to maintain page cache of B-tree nodes one-on-one. -+ * -+ * Return Value: On success, 0 is returned. On errors, one of the following -+ * negative error code is returned. -+ * -+ * %-ENOMEM - Insufficient memory available. -+ */ -+int nilfs_attach_btree_node_cache(struct inode *inode) -+{ -+ struct nilfs_inode_info *ii = NILFS_I(inode); -+ struct inode *btnc_inode; -+ struct nilfs_iget_args args; -+ -+ if (ii->i_assoc_inode) -+ return 0; -+ -+ args.ino = inode->i_ino; -+ args.root = ii->i_root; -+ args.cno = ii->i_cno; -+ args.for_gc = test_bit(NILFS_I_GCINODE, &ii->i_state) != 0; -+ args.for_btnc = true; -+ args.for_shadow = test_bit(NILFS_I_SHADOW, &ii->i_state) != 0; -+ -+ btnc_inode = iget5_locked(inode->i_sb, inode->i_ino, nilfs_iget_test, -+ nilfs_iget_set, &args); -+ if (unlikely(!btnc_inode)) -+ return -ENOMEM; -+ if (btnc_inode->i_state & I_NEW) { -+ nilfs_init_btnc_inode(btnc_inode); -+ unlock_new_inode(btnc_inode); -+ } -+ NILFS_I(btnc_inode)->i_assoc_inode = inode; -+ NILFS_I(btnc_inode)->i_bmap = ii->i_bmap; -+ ii->i_assoc_inode = btnc_inode; -+ -+ return 0; -+} -+ -+/** -+ * nilfs_detach_btree_node_cache - detach the B-tree node cache from the inode -+ * @inode: inode object -+ * -+ * nilfs_detach_btree_node_cache() detaches the B-tree node cache and its -+ * holder inode bound to @inode, or does nothing if @inode doesn't have it. -+ */ -+void nilfs_detach_btree_node_cache(struct inode *inode) -+{ -+ struct nilfs_inode_info *ii = NILFS_I(inode); -+ struct inode *btnc_inode = ii->i_assoc_inode; -+ -+ if (btnc_inode) { -+ NILFS_I(btnc_inode)->i_assoc_inode = NULL; -+ ii->i_assoc_inode = NULL; -+ iput(btnc_inode); -+ } -+} -+ -+/** -+ * nilfs_iget_for_shadow - obtain inode for shadow mapping -+ * @inode: inode object that uses shadow mapping -+ * -+ * nilfs_iget_for_shadow() allocates a pair of inodes that holds page -+ * caches for shadow mapping. The page cache for data pages is set up -+ * in one inode and the one for b-tree node pages is set up in the -+ * other inode, which is attached to the former inode. -+ * -+ * Return Value: On success, a pointer to the inode for data pages is -+ * returned. On errors, one of the following negative error code is returned -+ * in a pointer type. -+ * -+ * %-ENOMEM - Insufficient memory available. -+ */ -+struct inode *nilfs_iget_for_shadow(struct inode *inode) -+{ -+ struct nilfs_iget_args args = { -+ .ino = inode->i_ino, .root = NULL, .cno = 0, .for_gc = false, -+ .for_btnc = false, .for_shadow = true -+ }; -+ struct inode *s_inode; -+ int err; -+ -+ s_inode = iget5_locked(inode->i_sb, inode->i_ino, nilfs_iget_test, -+ nilfs_iget_set, &args); -+ if (unlikely(!s_inode)) -+ return ERR_PTR(-ENOMEM); -+ if (!(s_inode->i_state & I_NEW)) -+ return inode; -+ -+ NILFS_I(s_inode)->i_flags = 0; -+ memset(NILFS_I(s_inode)->i_bmap, 0, sizeof(struct nilfs_bmap)); -+ mapping_set_gfp_mask(s_inode->i_mapping, GFP_NOFS); -+ -+ err = nilfs_attach_btree_node_cache(s_inode); -+ if (unlikely(err)) { -+ iget_failed(s_inode); -+ return ERR_PTR(err); -+ } -+ unlock_new_inode(s_inode); -+ return s_inode; -+} -+ - void nilfs_write_inode_common(struct inode *inode, - struct nilfs_inode *raw_inode, int has_bmap) - { -@@ -770,7 +900,8 @@ static void nilfs_clear_inode(struct inode *inode) - if (test_bit(NILFS_I_BMAP, &ii->i_state)) - nilfs_bmap_clear(ii->i_bmap); - -- nilfs_btnode_cache_clear(&ii->i_btnode_cache); -+ if (!test_bit(NILFS_I_BTNC, &ii->i_state)) -+ nilfs_detach_btree_node_cache(inode); - - if (ii->i_root && inode->i_ino == NILFS_ROOT_INO) - nilfs_put_root(ii->i_root); -diff --git a/fs/nilfs2/mdt.c b/fs/nilfs2/mdt.c -index 700870a92bc4a..7c9055d767d16 100644 ---- a/fs/nilfs2/mdt.c -+++ b/fs/nilfs2/mdt.c -@@ -469,9 +469,18 @@ int nilfs_mdt_init(struct inode *inode, gfp_t gfp_mask, size_t objsz) - void nilfs_mdt_clear(struct inode *inode) - { - struct nilfs_mdt_info *mdi = NILFS_MDT(inode); -+ struct nilfs_shadow_map *shadow = mdi->mi_shadow; - - if (mdi->mi_palloc_cache) - nilfs_palloc_destroy_cache(inode); -+ -+ if (shadow) { -+ struct inode *s_inode = shadow->inode; -+ -+ shadow->inode = NULL; -+ iput(s_inode); -+ mdi->mi_shadow = NULL; -+ } - } - - /** -@@ -505,12 +514,15 @@ int nilfs_mdt_setup_shadow_map(struct inode *inode, - struct nilfs_shadow_map *shadow) - { - struct nilfs_mdt_info *mi = NILFS_MDT(inode); -+ struct inode *s_inode; - - INIT_LIST_HEAD(&shadow->frozen_buffers); -- address_space_init_once(&shadow->frozen_data); -- nilfs_mapping_init(&shadow->frozen_data, inode); -- address_space_init_once(&shadow->frozen_btnodes); -- nilfs_mapping_init(&shadow->frozen_btnodes, inode); -+ -+ s_inode = nilfs_iget_for_shadow(inode); -+ if (IS_ERR(s_inode)) -+ return PTR_ERR(s_inode); -+ -+ shadow->inode = s_inode; - mi->mi_shadow = shadow; - return 0; - } -@@ -524,14 +536,15 @@ int nilfs_mdt_save_to_shadow_map(struct inode *inode) - struct nilfs_mdt_info *mi = NILFS_MDT(inode); - struct nilfs_inode_info *ii = NILFS_I(inode); - struct nilfs_shadow_map *shadow = mi->mi_shadow; -+ struct inode *s_inode = shadow->inode; - int ret; - -- ret = nilfs_copy_dirty_pages(&shadow->frozen_data, inode->i_mapping); -+ ret = nilfs_copy_dirty_pages(s_inode->i_mapping, inode->i_mapping); - if (ret) - goto out; - -- ret = nilfs_copy_dirty_pages(&shadow->frozen_btnodes, -- &ii->i_btnode_cache); -+ ret = nilfs_copy_dirty_pages(NILFS_I(s_inode)->i_assoc_inode->i_mapping, -+ ii->i_assoc_inode->i_mapping); - if (ret) - goto out; - -@@ -547,7 +560,7 @@ int nilfs_mdt_freeze_buffer(struct inode *inode, struct buffer_head *bh) - struct page *page; - int blkbits = inode->i_blkbits; - -- page = grab_cache_page(&shadow->frozen_data, bh->b_page->index); -+ page = grab_cache_page(shadow->inode->i_mapping, bh->b_page->index); - if (!page) - return -ENOMEM; - -@@ -579,7 +592,7 @@ nilfs_mdt_get_frozen_buffer(struct inode *inode, struct buffer_head *bh) - struct page *page; - int n; - -- page = find_lock_page(&shadow->frozen_data, bh->b_page->index); -+ page = find_lock_page(shadow->inode->i_mapping, bh->b_page->index); - if (page) { - if (page_has_buffers(page)) { - n = bh_offset(bh) >> inode->i_blkbits; -@@ -620,10 +633,11 @@ void nilfs_mdt_restore_from_shadow_map(struct inode *inode) - nilfs_palloc_clear_cache(inode); - - nilfs_clear_dirty_pages(inode->i_mapping, true); -- nilfs_copy_back_pages(inode->i_mapping, &shadow->frozen_data); -+ nilfs_copy_back_pages(inode->i_mapping, shadow->inode->i_mapping); - -- nilfs_clear_dirty_pages(&ii->i_btnode_cache, true); -- nilfs_copy_back_pages(&ii->i_btnode_cache, &shadow->frozen_btnodes); -+ nilfs_clear_dirty_pages(ii->i_assoc_inode->i_mapping, true); -+ nilfs_copy_back_pages(ii->i_assoc_inode->i_mapping, -+ NILFS_I(shadow->inode)->i_assoc_inode->i_mapping); - - nilfs_bmap_restore(ii->i_bmap, &shadow->bmap_store); - -@@ -638,10 +652,11 @@ void nilfs_mdt_clear_shadow_map(struct inode *inode) - { - struct nilfs_mdt_info *mi = NILFS_MDT(inode); - struct nilfs_shadow_map *shadow = mi->mi_shadow; -+ struct inode *shadow_btnc_inode = NILFS_I(shadow->inode)->i_assoc_inode; - - down_write(&mi->mi_sem); - nilfs_release_frozen_buffers(shadow); -- truncate_inode_pages(&shadow->frozen_data, 0); -- truncate_inode_pages(&shadow->frozen_btnodes, 0); -+ truncate_inode_pages(shadow->inode->i_mapping, 0); -+ truncate_inode_pages(shadow_btnc_inode->i_mapping, 0); - up_write(&mi->mi_sem); - } -diff --git a/fs/nilfs2/mdt.h b/fs/nilfs2/mdt.h -index e77aea4bb921c..9d8ac0d27c16e 100644 ---- a/fs/nilfs2/mdt.h -+++ b/fs/nilfs2/mdt.h -@@ -18,14 +18,12 @@ - /** - * struct nilfs_shadow_map - shadow mapping of meta data file - * @bmap_store: shadow copy of bmap state -- * @frozen_data: shadowed dirty data pages -- * @frozen_btnodes: shadowed dirty b-tree nodes' pages -+ * @inode: holder of page caches used in shadow mapping - * @frozen_buffers: list of frozen buffers - */ - struct nilfs_shadow_map { - struct nilfs_bmap_store bmap_store; -- struct address_space frozen_data; -- struct address_space frozen_btnodes; -+ struct inode *inode; - struct list_head frozen_buffers; - }; - -diff --git a/fs/nilfs2/nilfs.h b/fs/nilfs2/nilfs.h -index 42395ba52da62..4895d978369a1 100644 ---- a/fs/nilfs2/nilfs.h -+++ b/fs/nilfs2/nilfs.h -@@ -28,7 +28,7 @@ - * @i_xattr: - * @i_dir_start_lookup: page index of last successful search - * @i_cno: checkpoint number for GC inode -- * @i_btnode_cache: cached pages of b-tree nodes -+ * @i_assoc_inode: associated inode (B-tree node cache holder or back pointer) - * @i_dirty: list for connecting dirty files - * @xattr_sem: semaphore for extended attributes processing - * @i_bh: buffer contains disk inode -@@ -43,7 +43,7 @@ struct nilfs_inode_info { - __u64 i_xattr; /* sector_t ??? */ - __u32 i_dir_start_lookup; - __u64 i_cno; /* check point number for GC inode */ -- struct address_space i_btnode_cache; -+ struct inode *i_assoc_inode; - struct list_head i_dirty; /* List for connecting dirty files */ - - #ifdef CONFIG_NILFS_XATTR -@@ -75,13 +75,6 @@ NILFS_BMAP_I(const struct nilfs_bmap *bmap) - return container_of(bmap, struct nilfs_inode_info, i_bmap_data); - } - --static inline struct inode *NILFS_BTNC_I(struct address_space *btnc) --{ -- struct nilfs_inode_info *ii = -- container_of(btnc, struct nilfs_inode_info, i_btnode_cache); -- return &ii->vfs_inode; --} -- - /* - * Dynamic state flags of NILFS on-memory inode (i_state) - */ -@@ -98,6 +91,8 @@ enum { - NILFS_I_INODE_SYNC, /* dsync is not allowed for inode */ - NILFS_I_BMAP, /* has bmap and btnode_cache */ - NILFS_I_GCINODE, /* inode for GC, on memory only */ -+ NILFS_I_BTNC, /* inode for btree node cache */ -+ NILFS_I_SHADOW, /* inode for shadowed page cache */ - }; - - /* -@@ -264,6 +259,9 @@ struct inode *nilfs_iget(struct super_block *sb, struct nilfs_root *root, - unsigned long ino); - extern struct inode *nilfs_iget_for_gc(struct super_block *sb, - unsigned long ino, __u64 cno); -+int nilfs_attach_btree_node_cache(struct inode *inode); -+void nilfs_detach_btree_node_cache(struct inode *inode); -+struct inode *nilfs_iget_for_shadow(struct inode *inode); - extern void nilfs_update_inode(struct inode *, struct buffer_head *, int); - extern void nilfs_truncate(struct inode *); - extern void nilfs_evict_inode(struct inode *); -diff --git a/fs/nilfs2/page.c b/fs/nilfs2/page.c -index d7fc8d369d89e..98d21ad9a073f 100644 ---- a/fs/nilfs2/page.c -+++ b/fs/nilfs2/page.c -@@ -450,10 +450,9 @@ void nilfs_mapping_init(struct address_space *mapping, struct inode *inode) - /* - * NILFS2 needs clear_page_dirty() in the following two cases: - * -- * 1) For B-tree node pages and data pages of the dat/gcdat, NILFS2 clears -- * page dirty flags when it copies back pages from the shadow cache -- * (gcdat->{i_mapping,i_btnode_cache}) to its original cache -- * (dat->{i_mapping,i_btnode_cache}). -+ * 1) For B-tree node pages and data pages of DAT file, NILFS2 clears dirty -+ * flag of pages when it copies back pages from shadow cache to the -+ * original cache. - * - * 2) Some B-tree operations like insertion or deletion may dispose buffers - * in dirty state, and this needs to cancel the dirty state of their pages. -diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c -index 91b58c897f92d..eb3ac76190887 100644 ---- a/fs/nilfs2/segment.c -+++ b/fs/nilfs2/segment.c -@@ -738,15 +738,18 @@ static void nilfs_lookup_dirty_node_buffers(struct inode *inode, - struct list_head *listp) - { - struct nilfs_inode_info *ii = NILFS_I(inode); -- struct address_space *mapping = &ii->i_btnode_cache; -+ struct inode *btnc_inode = ii->i_assoc_inode; - struct pagevec pvec; - struct buffer_head *bh, *head; - unsigned int i; - pgoff_t index = 0; - -+ if (!btnc_inode) -+ return; -+ - pagevec_init(&pvec); - -- while (pagevec_lookup_tag(&pvec, mapping, &index, -+ while (pagevec_lookup_tag(&pvec, btnc_inode->i_mapping, &index, - PAGECACHE_TAG_DIRTY)) { - for (i = 0; i < pagevec_count(&pvec); i++) { - bh = head = page_buffers(pvec.pages[i]); -@@ -2410,7 +2413,7 @@ nilfs_remove_written_gcinodes(struct the_nilfs *nilfs, struct list_head *head) - continue; - list_del_init(&ii->i_dirty); - truncate_inode_pages(&ii->vfs_inode.i_data, 0); -- nilfs_btnode_cache_clear(&ii->i_btnode_cache); -+ nilfs_btnode_cache_clear(ii->i_assoc_inode->i_mapping); - iput(&ii->vfs_inode); - } - } -diff --git a/fs/nilfs2/super.c b/fs/nilfs2/super.c -index 5729ee86da9ae..b5bc9f0c6a406 100644 ---- a/fs/nilfs2/super.c -+++ b/fs/nilfs2/super.c -@@ -151,7 +151,8 @@ struct inode *nilfs_alloc_inode(struct super_block *sb) - ii->i_bh = NULL; - ii->i_state = 0; - ii->i_cno = 0; -- nilfs_mapping_init(&ii->i_btnode_cache, &ii->vfs_inode); -+ ii->i_assoc_inode = NULL; -+ ii->i_bmap = &ii->i_bmap_data; - return &ii->vfs_inode; - } - -@@ -1375,8 +1376,6 @@ static void nilfs_inode_init_once(void *obj) - #ifdef CONFIG_NILFS_XATTR - init_rwsem(&ii->xattr_sem); - #endif -- address_space_init_once(&ii->i_btnode_cache); -- ii->i_bmap = &ii->i_bmap_data; - inode_init_once(&ii->vfs_inode); - } - -diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h -index 8cc766743270f..308c2d8cdca19 100644 ---- a/include/linux/blkdev.h -+++ b/include/linux/blkdev.h -@@ -1409,6 +1409,22 @@ static inline int queue_limit_discard_alignment(struct queue_limits *lim, sector - return offset << SECTOR_SHIFT; - } - -+/* -+ * Two cases of handling DISCARD merge: -+ * If max_discard_segments > 1, the driver takes every bio -+ * as a range and send them to controller together. The ranges -+ * needn't to be contiguous. -+ * Otherwise, the bios/requests will be handled as same as -+ * others which should be contiguous. -+ */ -+static inline bool blk_discard_mergable(struct request *req) -+{ -+ if (req_op(req) == REQ_OP_DISCARD && -+ queue_max_discard_segments(req->q) > 1) -+ return true; -+ return false; -+} -+ - static inline int bdev_discard_alignment(struct block_device *bdev) - { - struct request_queue *q = bdev_get_queue(bdev); -diff --git a/include/linux/dma-mapping.h b/include/linux/dma-mapping.h -index da90f20e11c1c..4d450672b7d66 100644 ---- a/include/linux/dma-mapping.h -+++ b/include/linux/dma-mapping.h -@@ -70,14 +70,6 @@ - */ - #define DMA_ATTR_PRIVILEGED (1UL << 9) - --/* -- * This is a hint to the DMA-mapping subsystem that the device is expected -- * to overwrite the entire mapped size, thus the caller does not require any -- * of the previous buffer contents to be preserved. This allows -- * bounce-buffering implementations to optimise DMA_FROM_DEVICE transfers. -- */ --#define DMA_ATTR_OVERWRITE (1UL << 10) -- - /* - * A dma_addr_t can hold any valid DMA or bus address for the platform. - * It can be given to a device to use as a DMA source or target. A CPU cannot -diff --git a/include/linux/mc146818rtc.h b/include/linux/mc146818rtc.h -index 0661af17a7584..1e02058113944 100644 ---- a/include/linux/mc146818rtc.h -+++ b/include/linux/mc146818rtc.h -@@ -86,6 +86,8 @@ struct cmos_rtc_board_info { - /* 2 values for divider stage reset, others for "testing purposes only" */ - # define RTC_DIV_RESET1 0x60 - # define RTC_DIV_RESET2 0x70 -+ /* In AMD BKDG bit 5 and 6 are reserved, bit 4 is for select dv0 bank */ -+# define RTC_AMD_BANK_SELECT 0x10 - /* Periodic intr. / Square wave rate select. 0=none, 1=32.8kHz,... 15=2Hz */ - # define RTC_RATE_SELECT 0x0F - -diff --git a/include/linux/stmmac.h b/include/linux/stmmac.h -index dc60d03c4b606..0b35747c9837a 100644 ---- a/include/linux/stmmac.h -+++ b/include/linux/stmmac.h -@@ -179,5 +179,6 @@ struct plat_stmmacenet_data { - int mac_port_sel_speed; - bool en_tx_lpi_clockgating; - int has_xgmac; -+ bool sph_disable; - }; - #endif -diff --git a/include/linux/sunrpc/xprtsock.h b/include/linux/sunrpc/xprtsock.h -index a940de03808dd..46deca97e806d 100644 ---- a/include/linux/sunrpc/xprtsock.h -+++ b/include/linux/sunrpc/xprtsock.h -@@ -90,6 +90,7 @@ struct sock_xprt { - #define XPRT_SOCK_WAKE_WRITE (5) - #define XPRT_SOCK_WAKE_PENDING (6) - #define XPRT_SOCK_WAKE_DISCONNECT (7) -+#define XPRT_SOCK_CONNECT_SENT (8) - - #endif /* __KERNEL__ */ - -diff --git a/include/uapi/linux/dma-buf.h b/include/uapi/linux/dma-buf.h -index 7f30393b92c3b..f76d11725c6c6 100644 ---- a/include/uapi/linux/dma-buf.h -+++ b/include/uapi/linux/dma-buf.h -@@ -44,7 +44,7 @@ struct dma_buf_sync { - * between them in actual uapi, they're just different numbers. - */ - #define DMA_BUF_SET_NAME _IOW(DMA_BUF_BASE, 1, const char *) --#define DMA_BUF_SET_NAME_A _IOW(DMA_BUF_BASE, 1, u32) --#define DMA_BUF_SET_NAME_B _IOW(DMA_BUF_BASE, 1, u64) -+#define DMA_BUF_SET_NAME_A _IOW(DMA_BUF_BASE, 1, __u32) -+#define DMA_BUF_SET_NAME_B _IOW(DMA_BUF_BASE, 1, __u64) - - #endif -diff --git a/kernel/dma/swiotlb.c b/kernel/dma/swiotlb.c -index f17b771856d1c..913cb71198af4 100644 ---- a/kernel/dma/swiotlb.c -+++ b/kernel/dma/swiotlb.c -@@ -571,11 +571,14 @@ found: - */ - for (i = 0; i < nslots; i++) - io_tlb_orig_addr[index+i] = orig_addr + (i << IO_TLB_SHIFT); -- if (!(attrs & DMA_ATTR_SKIP_CPU_SYNC) && -- (!(attrs & DMA_ATTR_OVERWRITE) || dir == DMA_TO_DEVICE || -- dir == DMA_BIDIRECTIONAL)) -- swiotlb_bounce(orig_addr, tlb_addr, mapping_size, DMA_TO_DEVICE); -- -+ /* -+ * When dir == DMA_FROM_DEVICE we could omit the copy from the orig -+ * to the tlb buffer, if we knew for sure the device will -+ * overwirte the entire current content. But we don't. Thus -+ * unconditional bounce may prevent leaking swiotlb content (i.e. -+ * kernel memory) to user-space. -+ */ -+ swiotlb_bounce(orig_addr, tlb_addr, mapping_size, DMA_TO_DEVICE); - return tlb_addr; - } - -diff --git a/kernel/events/core.c b/kernel/events/core.c -index 52f4a9e467040..8336dcb2bd432 100644 ---- a/kernel/events/core.c -+++ b/kernel/events/core.c -@@ -11114,6 +11114,9 @@ SYSCALL_DEFINE5(perf_event_open, - * Do not allow to attach to a group in a different task - * or CPU context. If we're moving SW events, we'll fix - * this up later, so allow that. -+ * -+ * Racy, not holding group_leader->ctx->mutex, see comment with -+ * perf_event_ctx_lock(). - */ - if (!move_group && group_leader->ctx != ctx) - goto err_context; -@@ -11181,6 +11184,7 @@ SYSCALL_DEFINE5(perf_event_open, - } else { - perf_event_ctx_unlock(group_leader, gctx); - move_group = 0; -+ goto not_move_group; - } - } - -@@ -11197,7 +11201,17 @@ SYSCALL_DEFINE5(perf_event_open, - } - } else { - mutex_lock(&ctx->mutex); -+ -+ /* -+ * Now that we hold ctx->lock, (re)validate group_leader->ctx == ctx, -+ * see the group_leader && !move_group test earlier. -+ */ -+ if (group_leader && group_leader->ctx != ctx) { -+ err = -EINVAL; -+ goto err_locked; -+ } - } -+not_move_group: - - if (ctx->task == TASK_TOMBSTONE) { - err = -ESRCH; -diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c -index 09b1dd8cd8536..464f6a619444d 100644 ---- a/net/bridge/br_input.c -+++ b/net/bridge/br_input.c -@@ -42,6 +42,13 @@ static int br_pass_frame_up(struct sk_buff *skb) - u64_stats_update_end(&brstats->syncp); - - vg = br_vlan_group_rcu(br); -+ -+ /* Reset the offload_fwd_mark because there could be a stacked -+ * bridge above, and it should not think this bridge it doing -+ * that bridge's work forwarding out its ports. -+ */ -+ br_switchdev_frame_unmark(skb); -+ - /* Bridge is just like any other port. Make sure the - * packet is allowed except in promisc modue when someone - * may be running packet capture. -diff --git a/net/key/af_key.c b/net/key/af_key.c -index 2ac9560020f91..f67d3ba72c496 100644 ---- a/net/key/af_key.c -+++ b/net/key/af_key.c -@@ -2830,8 +2830,10 @@ static int pfkey_process(struct sock *sk, struct sk_buff *skb, const struct sadb - void *ext_hdrs[SADB_EXT_MAX]; - int err; - -- pfkey_broadcast(skb_clone(skb, GFP_KERNEL), GFP_KERNEL, -- BROADCAST_PROMISC_ONLY, NULL, sock_net(sk)); -+ err = pfkey_broadcast(skb_clone(skb, GFP_KERNEL), GFP_KERNEL, -+ BROADCAST_PROMISC_ONLY, NULL, sock_net(sk)); -+ if (err) -+ return err; - - memset(ext_hdrs, 0, sizeof(ext_hdrs)); - err = parse_exthdrs(skb, hdr, ext_hdrs); -diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c -index ab91683d94596..99d5f8b58e92e 100644 ---- a/net/mac80211/rx.c -+++ b/net/mac80211/rx.c -@@ -1400,8 +1400,7 @@ static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx, - goto dont_reorder; - - /* not part of a BA session */ -- if (ack_policy != IEEE80211_QOS_CTL_ACK_POLICY_BLOCKACK && -- ack_policy != IEEE80211_QOS_CTL_ACK_POLICY_NORMAL) -+ if (ack_policy == IEEE80211_QOS_CTL_ACK_POLICY_NOACK) - goto dont_reorder; - - /* new, potentially un-ordered, ampdu frame - process it */ -diff --git a/net/nfc/nci/data.c b/net/nfc/nci/data.c -index ce3382be937ff..b002e18f38c81 100644 ---- a/net/nfc/nci/data.c -+++ b/net/nfc/nci/data.c -@@ -118,7 +118,7 @@ static int nci_queue_tx_data_frags(struct nci_dev *ndev, - - skb_frag = nci_skb_alloc(ndev, - (NCI_DATA_HDR_SIZE + frag_len), -- GFP_KERNEL); -+ GFP_ATOMIC); - if (skb_frag == NULL) { - rc = -ENOMEM; - goto free_exit; -diff --git a/net/nfc/nci/hci.c b/net/nfc/nci/hci.c -index 04e55ccb33836..4fe336ff2bfa1 100644 ---- a/net/nfc/nci/hci.c -+++ b/net/nfc/nci/hci.c -@@ -153,7 +153,7 @@ static int nci_hci_send_data(struct nci_dev *ndev, u8 pipe, - - i = 0; - skb = nci_skb_alloc(ndev, conn_info->max_pkt_payload_len + -- NCI_DATA_HDR_SIZE, GFP_KERNEL); -+ NCI_DATA_HDR_SIZE, GFP_ATOMIC); - if (!skb) - return -ENOMEM; - -@@ -186,7 +186,7 @@ static int nci_hci_send_data(struct nci_dev *ndev, u8 pipe, - if (i < data_len) { - skb = nci_skb_alloc(ndev, - conn_info->max_pkt_payload_len + -- NCI_DATA_HDR_SIZE, GFP_KERNEL); -+ NCI_DATA_HDR_SIZE, GFP_ATOMIC); - if (!skb) - return -ENOMEM; - -diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c -index 305cb190e9979..f095a0fb75c6d 100644 ---- a/net/sched/act_pedit.c -+++ b/net/sched/act_pedit.c -@@ -231,6 +231,10 @@ static int tcf_pedit_init(struct net *net, struct nlattr *nla, - for (i = 0; i < p->tcfp_nkeys; ++i) { - u32 cur = p->tcfp_keys[i].off; - -+ /* sanitize the shift value for any later use */ -+ p->tcfp_keys[i].shift = min_t(size_t, BITS_PER_TYPE(int) - 1, -+ p->tcfp_keys[i].shift); -+ - /* The AT option can read a single byte, we can bound the actual - * value with uchar max. - */ -diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c -index 8ac579778e487..94ae95c57f78a 100644 ---- a/net/sunrpc/xprt.c -+++ b/net/sunrpc/xprt.c -@@ -717,21 +717,30 @@ void xprt_disconnect_done(struct rpc_xprt *xprt) - EXPORT_SYMBOL_GPL(xprt_disconnect_done); - - /** -- * xprt_force_disconnect - force a transport to disconnect -+ * xprt_schedule_autoclose_locked - Try to schedule an autoclose RPC call - * @xprt: transport to disconnect -- * - */ --void xprt_force_disconnect(struct rpc_xprt *xprt) -+static void xprt_schedule_autoclose_locked(struct rpc_xprt *xprt) - { -- /* Don't race with the test_bit() in xprt_clear_locked() */ -- spin_lock(&xprt->transport_lock); -- set_bit(XPRT_CLOSE_WAIT, &xprt->state); -- /* Try to schedule an autoclose RPC call */ -+ if (test_and_set_bit(XPRT_CLOSE_WAIT, &xprt->state)) -+ return; - if (test_and_set_bit(XPRT_LOCKED, &xprt->state) == 0) - queue_work(xprtiod_workqueue, &xprt->task_cleanup); - else if (xprt->snd_task && !test_bit(XPRT_SND_IS_COOKIE, &xprt->state)) - rpc_wake_up_queued_task_set_status(&xprt->pending, - xprt->snd_task, -ENOTCONN); -+} -+ -+/** -+ * xprt_force_disconnect - force a transport to disconnect -+ * @xprt: transport to disconnect -+ * -+ */ -+void xprt_force_disconnect(struct rpc_xprt *xprt) -+{ -+ /* Don't race with the test_bit() in xprt_clear_locked() */ -+ spin_lock(&xprt->transport_lock); -+ xprt_schedule_autoclose_locked(xprt); - spin_unlock(&xprt->transport_lock); - } - EXPORT_SYMBOL_GPL(xprt_force_disconnect); -@@ -771,11 +780,7 @@ void xprt_conditional_disconnect(struct rpc_xprt *xprt, unsigned int cookie) - goto out; - if (test_bit(XPRT_CLOSING, &xprt->state)) - goto out; -- set_bit(XPRT_CLOSE_WAIT, &xprt->state); -- /* Try to schedule an autoclose RPC call */ -- if (test_and_set_bit(XPRT_LOCKED, &xprt->state) == 0) -- queue_work(xprtiod_workqueue, &xprt->task_cleanup); -- xprt_wake_pending_tasks(xprt, -EAGAIN); -+ xprt_schedule_autoclose_locked(xprt); - out: - spin_unlock(&xprt->transport_lock); - } -@@ -863,10 +868,7 @@ void xprt_connect(struct rpc_task *task) - if (!xprt_lock_write(xprt, task)) - return; - -- if (test_and_clear_bit(XPRT_CLOSE_WAIT, &xprt->state)) -- xprt->ops->close(xprt); -- -- if (!xprt_connected(xprt)) { -+ if (!xprt_connected(xprt) && !test_bit(XPRT_CLOSE_WAIT, &xprt->state)) { - task->tk_rqstp->rq_connect_cookie = xprt->connect_cookie; - rpc_sleep_on_timeout(&xprt->pending, task, NULL, - xprt_request_timeout(task->tk_rqstp)); -diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c -index 43bc02dea80c8..81f0e03b71b6d 100644 ---- a/net/sunrpc/xprtsock.c -+++ b/net/sunrpc/xprtsock.c -@@ -989,7 +989,7 @@ static int xs_local_send_request(struct rpc_rqst *req) - - /* Close the stream if the previous transmission was incomplete */ - if (xs_send_request_was_aborted(transport, req)) { -- xs_close(xprt); -+ xprt_force_disconnect(xprt); - return -ENOTCONN; - } - -@@ -1027,7 +1027,7 @@ static int xs_local_send_request(struct rpc_rqst *req) - -status); - /* fall through */ - case -EPIPE: -- xs_close(xprt); -+ xprt_force_disconnect(xprt); - status = -ENOTCONN; - } - -@@ -1303,6 +1303,16 @@ static void xs_reset_transport(struct sock_xprt *transport) - - if (sk == NULL) - return; -+ /* -+ * Make sure we're calling this in a context from which it is safe -+ * to call __fput_sync(). In practice that means rpciod and the -+ * system workqueue. -+ */ -+ if (!(current->flags & PF_WQ_WORKER)) { -+ WARN_ON_ONCE(1); -+ set_bit(XPRT_CLOSE_WAIT, &xprt->state); -+ return; -+ } - - if (atomic_read(&transport->xprt.swapper)) - sk_clear_memalloc(sk); -@@ -1326,7 +1336,7 @@ static void xs_reset_transport(struct sock_xprt *transport) - mutex_unlock(&transport->recv_mutex); - - trace_rpc_socket_close(xprt, sock); -- fput(filp); -+ __fput_sync(filp); - - xprt_disconnect_done(xprt); - } -@@ -2384,10 +2394,14 @@ static void xs_tcp_setup_socket(struct work_struct *work) - struct rpc_xprt *xprt = &transport->xprt; - int status = -EIO; - -- if (!sock) { -- sock = xs_create_sock(xprt, transport, -- xs_addr(xprt)->sa_family, SOCK_STREAM, -- IPPROTO_TCP, true); -+ if (xprt_connected(xprt)) -+ goto out; -+ if (test_and_clear_bit(XPRT_SOCK_CONNECT_SENT, -+ &transport->sock_state) || -+ !sock) { -+ xs_reset_transport(transport); -+ sock = xs_create_sock(xprt, transport, xs_addr(xprt)->sa_family, -+ SOCK_STREAM, IPPROTO_TCP, true); - if (IS_ERR(sock)) { - status = PTR_ERR(sock); - goto out; -@@ -2418,6 +2432,8 @@ static void xs_tcp_setup_socket(struct work_struct *work) - break; - case 0: - case -EINPROGRESS: -+ set_bit(XPRT_SOCK_CONNECT_SENT, &transport->sock_state); -+ fallthrough; - case -EALREADY: - xprt_unlock_connect(xprt, transport); - return; -@@ -2471,11 +2487,7 @@ static void xs_connect(struct rpc_xprt *xprt, struct rpc_task *task) - - if (transport->sock != NULL) { - dprintk("RPC: xs_connect delayed xprt %p for %lu " -- "seconds\n", -- xprt, xprt->reestablish_timeout / HZ); -- -- /* Start by resetting any existing state */ -- xs_reset_transport(transport); -+ "seconds\n", xprt, xprt->reestablish_timeout / HZ); - - delay = xprt_reconnect_delay(xprt); - xprt_reconnect_backoff(xprt, XS_TCP_INIT_REEST_TO); -diff --git a/sound/isa/wavefront/wavefront_synth.c b/sound/isa/wavefront/wavefront_synth.c -index d6420d224d097..09b368761cc00 100644 ---- a/sound/isa/wavefront/wavefront_synth.c -+++ b/sound/isa/wavefront/wavefront_synth.c -@@ -1088,7 +1088,8 @@ wavefront_send_sample (snd_wavefront_t *dev, - - if (dataptr < data_end) { - -- __get_user (sample_short, dataptr); -+ if (get_user(sample_short, dataptr)) -+ return -EFAULT; - dataptr += skip; - - if (data_is_unsigned) { /* GUS ? */ -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index 851ea79da31cd..78b5a0f22a415 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -10233,6 +10233,7 @@ static const struct snd_pci_quirk alc662_fixup_tbl[] = { - SND_PCI_QUIRK(0x144d, 0xc051, "Samsung R720", ALC662_FIXUP_IDEAPAD), - SND_PCI_QUIRK(0x14cd, 0x5003, "USI", ALC662_FIXUP_USI_HEADSET_MODE), - SND_PCI_QUIRK(0x17aa, 0x1036, "Lenovo P520", ALC662_FIXUP_LENOVO_MULTI_CODECS), -+ SND_PCI_QUIRK(0x17aa, 0x1057, "Lenovo P360", ALC897_FIXUP_HEADSET_MIC_PIN), - SND_PCI_QUIRK(0x17aa, 0x32ca, "Lenovo ThinkCentre M80", ALC897_FIXUP_HEADSET_MIC_PIN), - SND_PCI_QUIRK(0x17aa, 0x32cb, "Lenovo ThinkCentre M70", ALC897_FIXUP_HEADSET_MIC_PIN), - SND_PCI_QUIRK(0x17aa, 0x32cf, "Lenovo ThinkCentre M950", ALC897_FIXUP_HEADSET_MIC_PIN), -diff --git a/tools/objtool/check.c b/tools/objtool/check.c -index 06aaf04e629c2..bae6b261481db 100644 ---- a/tools/objtool/check.c -+++ b/tools/objtool/check.c -@@ -144,6 +144,7 @@ static bool __dead_end_function(struct objtool_file *file, struct symbol *func, - "usercopy_abort", - "machine_real_restart", - "rewind_stack_do_exit", -+ "cpu_bringup_and_idle", - }; - - if (!func) -diff --git a/tools/perf/bench/numa.c b/tools/perf/bench/numa.c -index 5797253b97005..69d62e57a0c36 100644 ---- a/tools/perf/bench/numa.c -+++ b/tools/perf/bench/numa.c -@@ -1630,7 +1630,7 @@ static int __bench_numa(const char *name) - "GB/sec,", "total-speed", "GB/sec total speed"); - - if (g->p.show_details >= 2) { -- char tname[14 + 2 * 10 + 1]; -+ char tname[14 + 2 * 11 + 1]; - struct thread_data *td; - for (p = 0; p < g->p.nr_proc; p++) { - for (t = 0; t < g->p.nr_threads; t++) { -diff --git a/tools/testing/selftests/net/fcnal-test.sh b/tools/testing/selftests/net/fcnal-test.sh -index 157822331954d..d2ac09b35dcf5 100755 ---- a/tools/testing/selftests/net/fcnal-test.sh -+++ b/tools/testing/selftests/net/fcnal-test.sh -@@ -757,10 +757,16 @@ ipv4_ping() - setup - set_sysctl net.ipv4.raw_l3mdev_accept=1 2>/dev/null - ipv4_ping_novrf -+ setup -+ set_sysctl net.ipv4.ping_group_range='0 2147483647' 2>/dev/null -+ ipv4_ping_novrf - - log_subsection "With VRF" - setup "yes" - ipv4_ping_vrf -+ setup "yes" -+ set_sysctl net.ipv4.ping_group_range='0 2147483647' 2>/dev/null -+ ipv4_ping_vrf - } - - ################################################################################ -@@ -2005,10 +2011,16 @@ ipv6_ping() - log_subsection "No VRF" - setup - ipv6_ping_novrf -+ setup -+ set_sysctl net.ipv4.ping_group_range='0 2147483647' 2>/dev/null -+ ipv6_ping_novrf - - log_subsection "With VRF" - setup "yes" - ipv6_ping_vrf -+ setup "yes" -+ set_sysctl net.ipv4.ping_group_range='0 2147483647' 2>/dev/null -+ ipv6_ping_vrf - } - - ################################################################################ diff --git a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.210-211.patch b/patch/kernel/archive/odroidxu4-5.4/patch-5.4.210-211.patch new file mode 100644 index 000000000..20bbb103f --- /dev/null +++ b/patch/kernel/archive/odroidxu4-5.4/patch-5.4.210-211.patch @@ -0,0 +1,10220 @@ +diff --git a/Documentation/admin-guide/pm/cpuidle.rst b/Documentation/admin-guide/pm/cpuidle.rst +index e70b365dbc603..80cf2ef2a5062 100644 +--- a/Documentation/admin-guide/pm/cpuidle.rst ++++ b/Documentation/admin-guide/pm/cpuidle.rst +@@ -676,8 +676,8 @@ the ``menu`` governor to be used on the systems that use the ``ladder`` governor + by default this way, for example. + + The other kernel command line parameters controlling CPU idle time management +-described below are only relevant for the *x86* architecture and some of +-them affect Intel processors only. ++described below are only relevant for the *x86* architecture and references ++to ``intel_idle`` affect Intel processors only. + + The *x86* architecture support code recognizes three kernel command line + options related to CPU idle time management: ``idle=poll``, ``idle=halt``, +@@ -699,10 +699,13 @@ idle, so it very well may hurt single-thread computations performance as well as + energy-efficiency. Thus using it for performance reasons may not be a good idea + at all.] + +-The ``idle=nomwait`` option disables the ``intel_idle`` driver and causes +-``acpi_idle`` to be used (as long as all of the information needed by it is +-there in the system's ACPI tables), but it is not allowed to use the +-``MWAIT`` instruction of the CPUs to ask the hardware to enter idle states. ++The ``idle=nomwait`` option prevents the use of ``MWAIT`` instruction of ++the CPU to enter idle states. When this option is used, the ``acpi_idle`` ++driver will use the ``HLT`` instruction instead of ``MWAIT``. On systems ++running Intel processors, this option disables the ``intel_idle`` driver ++and forces the use of the ``acpi_idle`` driver instead. Note that in either ++case, ``acpi_idle`` driver will function only if all the information needed ++by it is in the system's ACPI tables. + + In addition to the architecture-level kernel command line options affecting CPU + idle time management, there are parameters affecting individual ``CPUIdle`` +diff --git a/Documentation/atomic_bitops.txt b/Documentation/atomic_bitops.txt +index 093cdaefdb373..d8b101c97031b 100644 +--- a/Documentation/atomic_bitops.txt ++++ b/Documentation/atomic_bitops.txt +@@ -59,7 +59,7 @@ Like with atomic_t, the rule of thumb is: + - RMW operations that have a return value are fully ordered. + + - RMW operations that are conditional are unordered on FAILURE, +- otherwise the above rules apply. In the case of test_and_{}_bit() operations, ++ otherwise the above rules apply. In the case of test_and_set_bit_lock(), + if the bit in memory is unchanged by the operation then it is deemed to have + failed. + +diff --git a/Documentation/devicetree/bindings/arm/qcom.yaml b/Documentation/devicetree/bindings/arm/qcom.yaml +index e39d8f02e33c1..3de6182cde973 100644 +--- a/Documentation/devicetree/bindings/arm/qcom.yaml ++++ b/Documentation/devicetree/bindings/arm/qcom.yaml +@@ -112,8 +112,8 @@ properties: + - const: qcom,msm8974 + + - items: +- - const: qcom,msm8916-mtp/1 + - const: qcom,msm8916-mtp ++ - const: qcom,msm8916-mtp/1 + - const: qcom,msm8916 + + - items: +diff --git a/Documentation/firmware-guide/acpi/apei/einj.rst b/Documentation/firmware-guide/acpi/apei/einj.rst +index e588bccf51583..344284236a810 100644 +--- a/Documentation/firmware-guide/acpi/apei/einj.rst ++++ b/Documentation/firmware-guide/acpi/apei/einj.rst +@@ -168,7 +168,7 @@ An error injection example:: + 0x00000008 Memory Correctable + 0x00000010 Memory Uncorrectable non-fatal + # echo 0x12345000 > param1 # Set memory address for injection +- # echo $((-1 << 12)) > param2 # Mask 0xfffffffffffff000 - anywhere in this page ++ # echo 0xfffffffffffff000 > param2 # Mask - anywhere in this page + # echo 0x8 > error_type # Choose correctable memory error + # echo 1 > error_inject # Inject now + +diff --git a/Makefile b/Makefile +index 74abb7e389f33..e54b9a1659b4f 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 5 + PATCHLEVEL = 4 +-SUBLEVEL = 210 ++SUBLEVEL = 211 + EXTRAVERSION = + NAME = Kleptomaniac Octopus + +@@ -932,6 +932,9 @@ KBUILD_CFLAGS += $(KCFLAGS) + KBUILD_LDFLAGS_MODULE += --build-id + LDFLAGS_vmlinux += --build-id + ++KBUILD_LDFLAGS += -z noexecstack ++KBUILD_LDFLAGS += $(call ld-option,--no-warn-rwx-segments) ++ + ifeq ($(CONFIG_STRIP_ASM_SYMS),y) + LDFLAGS_vmlinux += $(call ld-option, -X,) + endif +diff --git a/arch/arm/boot/dts/aspeed-ast2500-evb.dts b/arch/arm/boot/dts/aspeed-ast2500-evb.dts +index c9d88c90135e6..9db4d42d0deb3 100644 +--- a/arch/arm/boot/dts/aspeed-ast2500-evb.dts ++++ b/arch/arm/boot/dts/aspeed-ast2500-evb.dts +@@ -5,7 +5,7 @@ + + / { + model = "AST2500 EVB"; +- compatible = "aspeed,ast2500"; ++ compatible = "aspeed,ast2500-evb", "aspeed,ast2500"; + + aliases { + serial4 = &uart5; +diff --git a/arch/arm/boot/dts/aspeed-ast2600-evb.dts b/arch/arm/boot/dts/aspeed-ast2600-evb.dts +index 9870553919b7c..f00b19ad4fa62 100644 +--- a/arch/arm/boot/dts/aspeed-ast2600-evb.dts ++++ b/arch/arm/boot/dts/aspeed-ast2600-evb.dts +@@ -7,7 +7,7 @@ + + / { + model = "AST2600 EVB"; +- compatible = "aspeed,ast2600"; ++ compatible = "aspeed,ast2600-evb-a1", "aspeed,ast2600"; + + aliases { + serial4 = &uart5; +diff --git a/arch/arm/boot/dts/imx6ul.dtsi b/arch/arm/boot/dts/imx6ul.dtsi +index f008036e92948..ae0722b93b9d7 100644 +--- a/arch/arm/boot/dts/imx6ul.dtsi ++++ b/arch/arm/boot/dts/imx6ul.dtsi +@@ -62,20 +62,18 @@ + clock-frequency = <696000000>; + clock-latency = <61036>; /* two CLK32 periods */ + #cooling-cells = <2>; +- operating-points = < ++ operating-points = + /* kHz uV */ +- 696000 1275000 +- 528000 1175000 +- 396000 1025000 +- 198000 950000 +- >; +- fsl,soc-operating-points = < ++ <696000 1275000>, ++ <528000 1175000>, ++ <396000 1025000>, ++ <198000 950000>; ++ fsl,soc-operating-points = + /* KHz uV */ +- 696000 1275000 +- 528000 1175000 +- 396000 1175000 +- 198000 1175000 +- >; ++ <696000 1275000>, ++ <528000 1175000>, ++ <396000 1175000>, ++ <198000 1175000>; + clocks = <&clks IMX6UL_CLK_ARM>, + <&clks IMX6UL_CLK_PLL2_BUS>, + <&clks IMX6UL_CLK_PLL2_PFD2>, +@@ -157,6 +155,9 @@ + ocram: sram@900000 { + compatible = "mmio-sram"; + reg = <0x00900000 0x20000>; ++ ranges = <0 0x00900000 0x20000>; ++ #address-cells = <1>; ++ #size-cells = <1>; + }; + + intc: interrupt-controller@a01000 { +@@ -966,7 +967,7 @@ + }; + + csi: csi@21c4000 { +- compatible = "fsl,imx6ul-csi", "fsl,imx7-csi"; ++ compatible = "fsl,imx6ul-csi"; + reg = <0x021c4000 0x4000>; + interrupts = ; + clocks = <&clks IMX6UL_CLK_CSI>; +@@ -975,7 +976,7 @@ + }; + + lcdif: lcdif@21c8000 { +- compatible = "fsl,imx6ul-lcdif", "fsl,imx28-lcdif"; ++ compatible = "fsl,imx6ul-lcdif", "fsl,imx6sx-lcdif"; + reg = <0x021c8000 0x4000>; + interrupts = ; + clocks = <&clks IMX6UL_CLK_LCDIF_PIX>, +@@ -996,7 +997,7 @@ + qspi: spi@21e0000 { + #address-cells = <1>; + #size-cells = <0>; +- compatible = "fsl,imx6ul-qspi", "fsl,imx6sx-qspi"; ++ compatible = "fsl,imx6ul-qspi"; + reg = <0x021e0000 0x4000>, <0x60000000 0x10000000>; + reg-names = "QuadSPI", "QuadSPI-memory"; + interrupts = ; +diff --git a/arch/arm/boot/dts/qcom-mdm9615.dtsi b/arch/arm/boot/dts/qcom-mdm9615.dtsi +index 356e9535f7a68..ffb4dcdb62d2b 100644 +--- a/arch/arm/boot/dts/qcom-mdm9615.dtsi ++++ b/arch/arm/boot/dts/qcom-mdm9615.dtsi +@@ -323,6 +323,7 @@ + + pmicgpio: gpio@150 { + compatible = "qcom,pm8018-gpio", "qcom,ssbi-gpio"; ++ reg = <0x150>; + interrupt-controller; + #interrupt-cells = <2>; + gpio-controller; +diff --git a/arch/arm/boot/dts/qcom-pm8841.dtsi b/arch/arm/boot/dts/qcom-pm8841.dtsi +index 2fd59c440903d..c73e5b149ac5e 100644 +--- a/arch/arm/boot/dts/qcom-pm8841.dtsi ++++ b/arch/arm/boot/dts/qcom-pm8841.dtsi +@@ -25,6 +25,7 @@ + compatible = "qcom,spmi-temp-alarm"; + reg = <0x2400>; + interrupts = <4 0x24 0 IRQ_TYPE_EDGE_RISING>; ++ #thermal-sensor-cells = <0>; + }; + }; + +diff --git a/arch/arm/boot/dts/uniphier-pxs2.dtsi b/arch/arm/boot/dts/uniphier-pxs2.dtsi +index 60a588ce45e10..049ca941b4790 100644 +--- a/arch/arm/boot/dts/uniphier-pxs2.dtsi ++++ b/arch/arm/boot/dts/uniphier-pxs2.dtsi +@@ -585,8 +585,8 @@ + compatible = "socionext,uniphier-dwc3", "snps,dwc3"; + status = "disabled"; + reg = <0x65a00000 0xcd00>; +- interrupt-names = "host", "peripheral"; +- interrupts = <0 134 4>, <0 135 4>; ++ interrupt-names = "dwc_usb3"; ++ interrupts = <0 134 4>; + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_usb0>, <&pinctrl_usb2>; + clock-names = "ref", "bus_early", "suspend"; +@@ -681,8 +681,8 @@ + compatible = "socionext,uniphier-dwc3", "snps,dwc3"; + status = "disabled"; + reg = <0x65c00000 0xcd00>; +- interrupt-names = "host", "peripheral"; +- interrupts = <0 137 4>, <0 138 4>; ++ interrupt-names = "dwc_usb3"; ++ interrupts = <0 137 4>; + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_usb1>, <&pinctrl_usb3>; + clock-names = "ref", "bus_early", "suspend"; +diff --git a/arch/arm/lib/findbit.S b/arch/arm/lib/findbit.S +index b5e8b9ae4c7d4..7fd3600db8efd 100644 +--- a/arch/arm/lib/findbit.S ++++ b/arch/arm/lib/findbit.S +@@ -40,8 +40,8 @@ ENDPROC(_find_first_zero_bit_le) + * Prototype: int find_next_zero_bit(void *addr, unsigned int maxbit, int offset) + */ + ENTRY(_find_next_zero_bit_le) +- teq r1, #0 +- beq 3b ++ cmp r2, r1 ++ bhs 3b + ands ip, r2, #7 + beq 1b @ If new byte, goto old routine + ARM( ldrb r3, [r0, r2, lsr #3] ) +@@ -81,8 +81,8 @@ ENDPROC(_find_first_bit_le) + * Prototype: int find_next_zero_bit(void *addr, unsigned int maxbit, int offset) + */ + ENTRY(_find_next_bit_le) +- teq r1, #0 +- beq 3b ++ cmp r2, r1 ++ bhs 3b + ands ip, r2, #7 + beq 1b @ If new byte, goto old routine + ARM( ldrb r3, [r0, r2, lsr #3] ) +@@ -115,8 +115,8 @@ ENTRY(_find_first_zero_bit_be) + ENDPROC(_find_first_zero_bit_be) + + ENTRY(_find_next_zero_bit_be) +- teq r1, #0 +- beq 3b ++ cmp r2, r1 ++ bhs 3b + ands ip, r2, #7 + beq 1b @ If new byte, goto old routine + eor r3, r2, #0x18 @ big endian byte ordering +@@ -149,8 +149,8 @@ ENTRY(_find_first_bit_be) + ENDPROC(_find_first_bit_be) + + ENTRY(_find_next_bit_be) +- teq r1, #0 +- beq 3b ++ cmp r2, r1 ++ bhs 3b + ands ip, r2, #7 + beq 1b @ If new byte, goto old routine + eor r3, r2, #0x18 @ big endian byte ordering +diff --git a/arch/arm/mach-bcm/bcm_kona_smc.c b/arch/arm/mach-bcm/bcm_kona_smc.c +index 541e850a736c9..9175c130967ed 100644 +--- a/arch/arm/mach-bcm/bcm_kona_smc.c ++++ b/arch/arm/mach-bcm/bcm_kona_smc.c +@@ -54,6 +54,7 @@ int __init bcm_kona_smc_init(void) + return -ENODEV; + + prop_val = of_get_address(node, 0, &prop_size, NULL); ++ of_node_put(node); + if (!prop_val) + return -EINVAL; + +diff --git a/arch/arm/mach-omap2/display.c b/arch/arm/mach-omap2/display.c +index 1bd64f6ba8cfe..1de25166414e8 100644 +--- a/arch/arm/mach-omap2/display.c ++++ b/arch/arm/mach-omap2/display.c +@@ -211,6 +211,7 @@ static int __init omapdss_init_fbdev(void) + node = of_find_node_by_name(NULL, "omap4_padconf_global"); + if (node) + omap4_dsi_mux_syscon = syscon_node_to_regmap(node); ++ of_node_put(node); + + return 0; + } +@@ -259,11 +260,13 @@ static int __init omapdss_init_of(void) + + if (!pdev) { + pr_err("Unable to find DSS platform device\n"); ++ of_node_put(node); + return -ENODEV; + } + + r = of_platform_populate(node, NULL, NULL, &pdev->dev); + put_device(&pdev->dev); ++ of_node_put(node); + if (r) { + pr_err("Unable to populate DSS submodule devices\n"); + return r; +diff --git a/arch/arm/mach-omap2/prm3xxx.c b/arch/arm/mach-omap2/prm3xxx.c +index 1b442b1285693..63e73e9b82bc6 100644 +--- a/arch/arm/mach-omap2/prm3xxx.c ++++ b/arch/arm/mach-omap2/prm3xxx.c +@@ -708,6 +708,7 @@ static int omap3xxx_prm_late_init(void) + } + + irq_num = of_irq_get(np, 0); ++ of_node_put(np); + if (irq_num == -EPROBE_DEFER) + return irq_num; + +diff --git a/arch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c b/arch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c +index 09ef73b99dd86..ba44cec5e59ac 100644 +--- a/arch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c ++++ b/arch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c +@@ -125,6 +125,7 @@ remove: + + list_for_each_entry_safe(pos, tmp, &quirk_list, list) { + list_del(&pos->list); ++ of_node_put(pos->np); + kfree(pos); + } + +@@ -174,11 +175,12 @@ static int __init rcar_gen2_regulator_quirk(void) + memcpy(&quirk->i2c_msg, id->data, sizeof(quirk->i2c_msg)); + + quirk->id = id; +- quirk->np = np; ++ quirk->np = of_node_get(np); + quirk->i2c_msg.addr = addr; + + ret = of_irq_parse_one(np, 0, argsa); + if (ret) { /* Skip invalid entry and continue */ ++ of_node_put(np); + kfree(quirk); + continue; + } +@@ -225,6 +227,7 @@ err_free: + err_mem: + list_for_each_entry_safe(pos, tmp, &quirk_list, list) { + list_del(&pos->list); ++ of_node_put(pos->np); + kfree(pos); + } + +diff --git a/arch/arm/mach-zynq/common.c b/arch/arm/mach-zynq/common.c +index 3a4248fd79628..25530ddae1fa1 100644 +--- a/arch/arm/mach-zynq/common.c ++++ b/arch/arm/mach-zynq/common.c +@@ -77,6 +77,7 @@ static int __init zynq_get_revision(void) + } + + zynq_devcfg_base = of_iomap(np, 0); ++ of_node_put(np); + if (!zynq_devcfg_base) { + pr_err("%s: Unable to map I/O memory\n", __func__); + return -1; +diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-orangepi-win.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-orangepi-win.dts +index a0db02504b69e..963a7c505e30f 100644 +--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-orangepi-win.dts ++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-orangepi-win.dts +@@ -78,7 +78,7 @@ + leds { + compatible = "gpio-leds"; + +- status { ++ led-0 { + label = "orangepi:green:status"; + gpios = <&pio 7 11 GPIO_ACTIVE_HIGH>; /* PH11 */ + }; +diff --git a/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts b/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts +index 83e10591e0e5d..81215cc3759a8 100644 +--- a/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts ++++ b/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts +@@ -49,7 +49,7 @@ + wps { + label = "wps"; + linux,code = ; +- gpios = <&pio 102 GPIO_ACTIVE_HIGH>; ++ gpios = <&pio 102 GPIO_ACTIVE_LOW>; + }; + }; + +diff --git a/arch/arm64/boot/dts/qcom/ipq8074.dtsi b/arch/arm64/boot/dts/qcom/ipq8074.dtsi +index 7822592664ffb..1e9fa049c5502 100644 +--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi ++++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi +@@ -253,7 +253,7 @@ + status = "disabled"; + }; + +- qpic_nand: nand@79b0000 { ++ qpic_nand: nand-controller@79b0000 { + compatible = "qcom,ipq8074-nand"; + reg = <0x79b0000 0x10000>; + #address-cells = <1>; +diff --git a/arch/arm64/boot/dts/socionext/uniphier-pxs3.dtsi b/arch/arm64/boot/dts/socionext/uniphier-pxs3.dtsi +index 6537c69de3dd3..b793a43e06124 100644 +--- a/arch/arm64/boot/dts/socionext/uniphier-pxs3.dtsi ++++ b/arch/arm64/boot/dts/socionext/uniphier-pxs3.dtsi +@@ -544,8 +544,8 @@ + compatible = "socionext,uniphier-dwc3", "snps,dwc3"; + status = "disabled"; + reg = <0x65a00000 0xcd00>; +- interrupt-names = "host", "peripheral"; +- interrupts = <0 134 4>, <0 135 4>; ++ interrupt-names = "dwc_usb3"; ++ interrupts = <0 134 4>; + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_usb0>, <&pinctrl_usb2>; + clock-names = "ref", "bus_early", "suspend"; +@@ -646,8 +646,8 @@ + compatible = "socionext,uniphier-dwc3", "snps,dwc3"; + status = "disabled"; + reg = <0x65c00000 0xcd00>; +- interrupt-names = "host", "peripheral"; +- interrupts = <0 137 4>, <0 138 4>; ++ interrupt-names = "dwc_usb3"; ++ interrupts = <0 137 4>; + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_usb1>, <&pinctrl_usb3>; + clock-names = "ref", "bus_early", "suspend"; +diff --git a/arch/arm64/crypto/Kconfig b/arch/arm64/crypto/Kconfig +index 4922c4451e7c3..99cddf1145c2f 100644 +--- a/arch/arm64/crypto/Kconfig ++++ b/arch/arm64/crypto/Kconfig +@@ -59,6 +59,7 @@ config CRYPTO_GHASH_ARM64_CE + select CRYPTO_HASH + select CRYPTO_GF128MUL + select CRYPTO_LIB_AES ++ select CRYPTO_AEAD + + config CRYPTO_CRCT10DIF_ARM64_CE + tristate "CRCT10DIF digest algorithm using PMULL instructions" +diff --git a/arch/arm64/include/asm/processor.h b/arch/arm64/include/asm/processor.h +index 5623685c7d138..65834b84f0e16 100644 +--- a/arch/arm64/include/asm/processor.h ++++ b/arch/arm64/include/asm/processor.h +@@ -184,8 +184,9 @@ void tls_preserve_current_state(void); + + static inline void start_thread_common(struct pt_regs *regs, unsigned long pc) + { ++ s32 previous_syscall = regs->syscallno; + memset(regs, 0, sizeof(*regs)); +- forget_syscall(regs); ++ regs->syscallno = previous_syscall; + regs->pc = pc; + + if (system_uses_irq_prio_masking()) +diff --git a/arch/arm64/kernel/armv8_deprecated.c b/arch/arm64/kernel/armv8_deprecated.c +index bcb14d11232f9..fbf66e0973aab 100644 +--- a/arch/arm64/kernel/armv8_deprecated.c ++++ b/arch/arm64/kernel/armv8_deprecated.c +@@ -59,6 +59,7 @@ struct insn_emulation { + static LIST_HEAD(insn_emulation); + static int nr_insn_emulated __initdata; + static DEFINE_RAW_SPINLOCK(insn_emulation_lock); ++static DEFINE_MUTEX(insn_emulation_mutex); + + static void register_emulation_hooks(struct insn_emulation_ops *ops) + { +@@ -207,10 +208,10 @@ static int emulation_proc_handler(struct ctl_table *table, int write, + loff_t *ppos) + { + int ret = 0; +- struct insn_emulation *insn = (struct insn_emulation *) table->data; ++ struct insn_emulation *insn = container_of(table->data, struct insn_emulation, current_mode); + enum insn_emulation_mode prev_mode = insn->current_mode; + +- table->data = &insn->current_mode; ++ mutex_lock(&insn_emulation_mutex); + ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos); + + if (ret || !write || prev_mode == insn->current_mode) +@@ -223,7 +224,7 @@ static int emulation_proc_handler(struct ctl_table *table, int write, + update_insn_emulation_mode(insn, INSN_UNDEF); + } + ret: +- table->data = insn; ++ mutex_unlock(&insn_emulation_mutex); + return ret; + } + +@@ -247,7 +248,7 @@ static void __init register_insn_emulation_sysctl(void) + sysctl->maxlen = sizeof(int); + + sysctl->procname = insn->ops->name; +- sysctl->data = insn; ++ sysctl->data = &insn->current_mode; + sysctl->extra1 = &insn->min; + sysctl->extra2 = &insn->max; + sysctl->proc_handler = emulation_proc_handler; +diff --git a/arch/ia64/include/asm/processor.h b/arch/ia64/include/asm/processor.h +index 95a2ec37400fb..0025f890b5a38 100644 +--- a/arch/ia64/include/asm/processor.h ++++ b/arch/ia64/include/asm/processor.h +@@ -552,7 +552,7 @@ ia64_get_irr(unsigned int vector) + { + unsigned int reg = vector / 64; + unsigned int bit = vector % 64; +- u64 irr; ++ unsigned long irr; + + switch (reg) { + case 0: irr = ia64_getreg(_IA64_REG_CR_IRR0); break; +diff --git a/arch/mips/cavium-octeon/octeon-platform.c b/arch/mips/cavium-octeon/octeon-platform.c +index c214fe4e678bb..04bc347147270 100644 +--- a/arch/mips/cavium-octeon/octeon-platform.c ++++ b/arch/mips/cavium-octeon/octeon-platform.c +@@ -86,11 +86,12 @@ static void octeon2_usb_clocks_start(struct device *dev) + "refclk-frequency", &clock_rate); + if (i) { + dev_err(dev, "No UCTL \"refclk-frequency\"\n"); ++ of_node_put(uctl_node); + goto exit; + } + i = of_property_read_string(uctl_node, + "refclk-type", &clock_type); +- ++ of_node_put(uctl_node); + if (!i && strcmp("crystal", clock_type) == 0) + is_crystal_clock = true; + } +diff --git a/arch/mips/kernel/proc.c b/arch/mips/kernel/proc.c +index f8d36710cd581..d408b3a5bfd57 100644 +--- a/arch/mips/kernel/proc.c ++++ b/arch/mips/kernel/proc.c +@@ -168,7 +168,7 @@ static void *c_start(struct seq_file *m, loff_t *pos) + { + unsigned long i = *pos; + +- return i < NR_CPUS ? (void *) (i + 1) : NULL; ++ return i < nr_cpu_ids ? (void *) (i + 1) : NULL; + } + + static void *c_next(struct seq_file *m, void *v, loff_t *pos) +diff --git a/arch/mips/mm/tlbex.c b/arch/mips/mm/tlbex.c +index 547d813ead488..061dc5c97d5ad 100644 +--- a/arch/mips/mm/tlbex.c ++++ b/arch/mips/mm/tlbex.c +@@ -629,7 +629,7 @@ static __maybe_unused void build_convert_pte_to_entrylo(u32 **p, + return; + } + +- if (cpu_has_rixi && !!_PAGE_NO_EXEC) { ++ if (cpu_has_rixi && _PAGE_NO_EXEC != 0) { + if (fill_includes_sw_bits) { + UASM_i_ROTR(p, reg, reg, ilog2(_PAGE_GLOBAL)); + } else { +@@ -2568,7 +2568,7 @@ static void check_pabits(void) + unsigned long entry; + unsigned pabits, fillbits; + +- if (!cpu_has_rixi || !_PAGE_NO_EXEC) { ++ if (!cpu_has_rixi || _PAGE_NO_EXEC == 0) { + /* + * We'll only be making use of the fact that we can rotate bits + * into the fill if the CPU supports RIXI, so don't bother +diff --git a/arch/nios2/include/asm/entry.h b/arch/nios2/include/asm/entry.h +index cf37f55efbc22..bafb7b2ca59fc 100644 +--- a/arch/nios2/include/asm/entry.h ++++ b/arch/nios2/include/asm/entry.h +@@ -50,7 +50,8 @@ + stw r13, PT_R13(sp) + stw r14, PT_R14(sp) + stw r15, PT_R15(sp) +- stw r2, PT_ORIG_R2(sp) ++ movi r24, -1 ++ stw r24, PT_ORIG_R2(sp) + stw r7, PT_ORIG_R7(sp) + + stw ra, PT_RA(sp) +diff --git a/arch/nios2/include/asm/ptrace.h b/arch/nios2/include/asm/ptrace.h +index 6424621448728..9da34c3022a27 100644 +--- a/arch/nios2/include/asm/ptrace.h ++++ b/arch/nios2/include/asm/ptrace.h +@@ -74,6 +74,8 @@ extern void show_regs(struct pt_regs *); + ((struct pt_regs *)((unsigned long)current_thread_info() + THREAD_SIZE)\ + - 1) + ++#define force_successful_syscall_return() (current_pt_regs()->orig_r2 = -1) ++ + int do_syscall_trace_enter(void); + void do_syscall_trace_exit(void); + #endif /* __ASSEMBLY__ */ +diff --git a/arch/nios2/kernel/entry.S b/arch/nios2/kernel/entry.S +index 1e515ccd698e3..af556588248e7 100644 +--- a/arch/nios2/kernel/entry.S ++++ b/arch/nios2/kernel/entry.S +@@ -185,6 +185,7 @@ ENTRY(handle_system_call) + ldw r5, PT_R5(sp) + + local_restart: ++ stw r2, PT_ORIG_R2(sp) + /* Check that the requested system call is within limits */ + movui r1, __NR_syscalls + bgeu r2, r1, ret_invsyscall +@@ -192,7 +193,6 @@ local_restart: + movhi r11, %hiadj(sys_call_table) + add r1, r1, r11 + ldw r1, %lo(sys_call_table)(r1) +- beq r1, r0, ret_invsyscall + + /* Check if we are being traced */ + GET_THREAD_INFO r11 +@@ -213,6 +213,9 @@ local_restart: + translate_rc_and_ret: + movi r1, 0 + bge r2, zero, 3f ++ ldw r1, PT_ORIG_R2(sp) ++ addi r1, r1, 1 ++ beq r1, zero, 3f + sub r2, zero, r2 + movi r1, 1 + 3: +@@ -255,9 +258,9 @@ traced_system_call: + ldw r6, PT_R6(sp) + ldw r7, PT_R7(sp) + +- /* Fetch the syscall function, we don't need to check the boundaries +- * since this is already done. +- */ ++ /* Fetch the syscall function. */ ++ movui r1, __NR_syscalls ++ bgeu r2, r1, traced_invsyscall + slli r1, r2, 2 + movhi r11,%hiadj(sys_call_table) + add r1, r1, r11 +@@ -276,6 +279,9 @@ traced_system_call: + translate_rc_and_ret2: + movi r1, 0 + bge r2, zero, 4f ++ ldw r1, PT_ORIG_R2(sp) ++ addi r1, r1, 1 ++ beq r1, zero, 4f + sub r2, zero, r2 + movi r1, 1 + 4: +@@ -287,6 +293,11 @@ end_translate_rc_and_ret2: + RESTORE_SWITCH_STACK + br ret_from_exception + ++ /* If the syscall number was invalid return ENOSYS */ ++traced_invsyscall: ++ movi r2, -ENOSYS ++ br translate_rc_and_ret2 ++ + Luser_return: + GET_THREAD_INFO r11 /* get thread_info pointer */ + ldw r10, TI_FLAGS(r11) /* get thread_info->flags */ +@@ -336,9 +347,6 @@ external_interrupt: + /* skip if no interrupt is pending */ + beq r12, r0, ret_from_interrupt + +- movi r24, -1 +- stw r24, PT_ORIG_R2(sp) +- + /* + * Process an external hardware interrupt. + */ +diff --git a/arch/nios2/kernel/signal.c b/arch/nios2/kernel/signal.c +index a42dd09c65783..bfb20821a8f49 100644 +--- a/arch/nios2/kernel/signal.c ++++ b/arch/nios2/kernel/signal.c +@@ -240,7 +240,7 @@ static int do_signal(struct pt_regs *regs) + /* + * If we were from a system call, check for system call restarting... + */ +- if (regs->orig_r2 >= 0) { ++ if (regs->orig_r2 >= 0 && regs->r1) { + continue_addr = regs->ea; + restart_addr = continue_addr - 4; + retval = regs->r2; +@@ -261,6 +261,7 @@ static int do_signal(struct pt_regs *regs) + regs->ea = restart_addr; + break; + } ++ regs->orig_r2 = -1; + } + + if (get_signal(&ksig)) { +diff --git a/arch/nios2/kernel/syscall_table.c b/arch/nios2/kernel/syscall_table.c +index 6176d63023c1d..c2875a6dd5a4a 100644 +--- a/arch/nios2/kernel/syscall_table.c ++++ b/arch/nios2/kernel/syscall_table.c +@@ -13,5 +13,6 @@ + #define __SYSCALL(nr, call) [nr] = (call), + + void *sys_call_table[__NR_syscalls] = { ++ [0 ... __NR_syscalls-1] = sys_ni_syscall, + #include + }; +diff --git a/arch/parisc/kernel/drivers.c b/arch/parisc/kernel/drivers.c +index a5f3e50fe9761..516f3891e793f 100644 +--- a/arch/parisc/kernel/drivers.c ++++ b/arch/parisc/kernel/drivers.c +@@ -520,7 +520,6 @@ alloc_pa_dev(unsigned long hpa, struct hardware_path *mod_path) + dev->id.hversion_rev = iodc_data[1] & 0x0f; + dev->id.sversion = ((iodc_data[4] & 0x0f) << 16) | + (iodc_data[5] << 8) | iodc_data[6]; +- dev->hpa.name = parisc_pathname(dev); + dev->hpa.start = hpa; + /* This is awkward. The STI spec says that gfx devices may occupy + * 32MB or 64MB. Unfortunately, we don't know how to tell whether +@@ -534,10 +533,10 @@ alloc_pa_dev(unsigned long hpa, struct hardware_path *mod_path) + dev->hpa.end = hpa + 0xfff; + } + dev->hpa.flags = IORESOURCE_MEM; +- name = parisc_hardware_description(&dev->id); +- if (name) { +- strlcpy(dev->name, name, sizeof(dev->name)); +- } ++ dev->hpa.name = dev->name; ++ name = parisc_hardware_description(&dev->id) ? : "unknown"; ++ snprintf(dev->name, sizeof(dev->name), "%s [%s]", ++ name, parisc_pathname(dev)); + + /* Silently fail things like mouse ports which are subsumed within + * the keyboard controller +diff --git a/arch/parisc/kernel/syscalls/syscall.tbl b/arch/parisc/kernel/syscalls/syscall.tbl +index 285ff516150cf..51f15a414e29a 100644 +--- a/arch/parisc/kernel/syscalls/syscall.tbl ++++ b/arch/parisc/kernel/syscalls/syscall.tbl +@@ -413,7 +413,7 @@ + 412 32 utimensat_time64 sys_utimensat sys_utimensat + 413 32 pselect6_time64 sys_pselect6 compat_sys_pselect6_time64 + 414 32 ppoll_time64 sys_ppoll compat_sys_ppoll_time64 +-416 32 io_pgetevents_time64 sys_io_pgetevents sys_io_pgetevents ++416 32 io_pgetevents_time64 sys_io_pgetevents compat_sys_io_pgetevents_time64 + 417 32 recvmmsg_time64 sys_recvmmsg compat_sys_recvmmsg_time64 + 418 32 mq_timedsend_time64 sys_mq_timedsend sys_mq_timedsend + 419 32 mq_timedreceive_time64 sys_mq_timedreceive sys_mq_timedreceive +diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile +index b9d2fcf030d0d..eedd114a017c7 100644 +--- a/arch/powerpc/Makefile ++++ b/arch/powerpc/Makefile +@@ -17,23 +17,6 @@ HAS_BIARCH := $(call cc-option-yn, -m32) + # Set default 32 bits cross compilers for vdso and boot wrapper + CROSS32_COMPILE ?= + +-ifeq ($(HAS_BIARCH),y) +-ifeq ($(CROSS32_COMPILE),) +-ifdef CONFIG_PPC32 +-# These options will be overridden by any -mcpu option that the CPU +-# or platform code sets later on the command line, but they are needed +-# to set a sane 32-bit cpu target for the 64-bit cross compiler which +-# may default to the wrong ISA. +-KBUILD_CFLAGS += -mcpu=powerpc +-KBUILD_AFLAGS += -mcpu=powerpc +-endif +-endif +-endif +- +-ifdef CONFIG_PPC_BOOK3S_32 +-KBUILD_CFLAGS += -mcpu=powerpc +-endif +- + # If we're on a ppc/ppc64/ppc64le machine use that defconfig, otherwise just use + # ppc64_defconfig because we have nothing better to go on. + uname := $(shell uname -m) +@@ -192,6 +175,7 @@ endif + endif + + CFLAGS-$(CONFIG_TARGET_CPU_BOOL) += $(call cc-option,-mcpu=$(CONFIG_TARGET_CPU)) ++AFLAGS-$(CONFIG_TARGET_CPU_BOOL) += $(call cc-option,-mcpu=$(CONFIG_TARGET_CPU)) + + # Altivec option not allowed with e500mc64 in GCC. + ifdef CONFIG_ALTIVEC +@@ -202,14 +186,6 @@ endif + CFLAGS-$(CONFIG_E5500_CPU) += $(E5500_CPU) + CFLAGS-$(CONFIG_E6500_CPU) += $(call cc-option,-mcpu=e6500,$(E5500_CPU)) + +-ifdef CONFIG_PPC32 +-ifdef CONFIG_PPC_E500MC +-CFLAGS-y += $(call cc-option,-mcpu=e500mc,-mcpu=powerpc) +-else +-CFLAGS-$(CONFIG_E500) += $(call cc-option,-mcpu=8540 -msoft-float,-mcpu=powerpc) +-endif +-endif +- + asinstr := $(call as-instr,lis 9$(comma)foo@high,-DHAVE_AS_ATHIGH=1) + + KBUILD_CPPFLAGS += -I $(srctree)/arch/$(ARCH) $(asinstr) +diff --git a/arch/powerpc/kernel/pci-common.c b/arch/powerpc/kernel/pci-common.c +index a2c258a8d7367..b9cb9fa9207a6 100644 +--- a/arch/powerpc/kernel/pci-common.c ++++ b/arch/powerpc/kernel/pci-common.c +@@ -66,23 +66,35 @@ void set_pci_dma_ops(const struct dma_map_ops *dma_ops) + pci_dma_ops = dma_ops; + } + +-/* +- * This function should run under locking protection, specifically +- * hose_spinlock. +- */ + static int get_phb_number(struct device_node *dn) + { + int ret, phb_id = -1; +- u32 prop_32; + u64 prop; + + /* + * Try fixed PHB numbering first, by checking archs and reading +- * the respective device-tree properties. Firstly, try powernv by +- * reading "ibm,opal-phbid", only present in OPAL environment. ++ * the respective device-tree properties. Firstly, try reading ++ * standard "linux,pci-domain", then try reading "ibm,opal-phbid" ++ * (only present in powernv OPAL environment), then try device-tree ++ * alias and as the last try to use lower bits of "reg" property. + */ +- ret = of_property_read_u64(dn, "ibm,opal-phbid", &prop); ++ ret = of_get_pci_domain_nr(dn); ++ if (ret >= 0) { ++ prop = ret; ++ ret = 0; ++ } ++ if (ret) ++ ret = of_property_read_u64(dn, "ibm,opal-phbid", &prop); ++ + if (ret) { ++ ret = of_alias_get_id(dn, "pci"); ++ if (ret >= 0) { ++ prop = ret; ++ ret = 0; ++ } ++ } ++ if (ret) { ++ u32 prop_32; + ret = of_property_read_u32_index(dn, "reg", 1, &prop_32); + prop = prop_32; + } +@@ -90,18 +102,20 @@ static int get_phb_number(struct device_node *dn) + if (!ret) + phb_id = (int)(prop & (MAX_PHBS - 1)); + ++ spin_lock(&hose_spinlock); ++ + /* We need to be sure to not use the same PHB number twice. */ + if ((phb_id >= 0) && !test_and_set_bit(phb_id, phb_bitmap)) +- return phb_id; ++ goto out_unlock; + +- /* +- * If not pseries nor powernv, or if fixed PHB numbering tried to add +- * the same PHB number twice, then fallback to dynamic PHB numbering. +- */ ++ /* If everything fails then fallback to dynamic PHB numbering. */ + phb_id = find_first_zero_bit(phb_bitmap, MAX_PHBS); + BUG_ON(phb_id >= MAX_PHBS); + set_bit(phb_id, phb_bitmap); + ++out_unlock: ++ spin_unlock(&hose_spinlock); ++ + return phb_id; + } + +@@ -112,10 +126,13 @@ struct pci_controller *pcibios_alloc_controller(struct device_node *dev) + phb = zalloc_maybe_bootmem(sizeof(struct pci_controller), GFP_KERNEL); + if (phb == NULL) + return NULL; +- spin_lock(&hose_spinlock); ++ + phb->global_number = get_phb_number(dev); ++ ++ spin_lock(&hose_spinlock); + list_add_tail(&phb->list_node, &hose_list); + spin_unlock(&hose_spinlock); ++ + phb->dn = dev; + phb->is_dynamic = slab_is_available(); + #ifdef CONFIG_PPC64 +diff --git a/arch/powerpc/kernel/prom.c b/arch/powerpc/kernel/prom.c +index 537142b877b88..d1ba175013430 100644 +--- a/arch/powerpc/kernel/prom.c ++++ b/arch/powerpc/kernel/prom.c +@@ -740,6 +740,13 @@ void __init early_init_devtree(void *params) + of_scan_flat_dt(early_init_dt_scan_root, NULL); + of_scan_flat_dt(early_init_dt_scan_memory_ppc, NULL); + ++ /* ++ * As generic code authors expect to be able to use static keys ++ * in early_param() handlers, we initialize the static keys just ++ * before parsing early params (it's fine to call jump_label_init() ++ * more than once). ++ */ ++ jump_label_init(); + parse_early_param(); + + /* make sure we've parsed cmdline for mem= before this */ +diff --git a/arch/powerpc/mm/ptdump/shared.c b/arch/powerpc/mm/ptdump/shared.c +index 784f8df17f732..f10f2158c8afb 100644 +--- a/arch/powerpc/mm/ptdump/shared.c ++++ b/arch/powerpc/mm/ptdump/shared.c +@@ -17,9 +17,9 @@ static const struct flag_info flag_array[] = { + .clear = " ", + }, { + .mask = _PAGE_RW, +- .val = _PAGE_RW, +- .set = "rw", +- .clear = "r ", ++ .val = 0, ++ .set = "r ", ++ .clear = "rw", + }, { + .mask = _PAGE_EXEC, + .val = _PAGE_EXEC, +diff --git a/arch/powerpc/platforms/Kconfig.cputype b/arch/powerpc/platforms/Kconfig.cputype +index f0330ce498d1e..325dc8b534228 100644 +--- a/arch/powerpc/platforms/Kconfig.cputype ++++ b/arch/powerpc/platforms/Kconfig.cputype +@@ -118,9 +118,9 @@ config GENERIC_CPU + depends on PPC64 && CPU_LITTLE_ENDIAN + select ARCH_HAS_FAST_MULTIPLIER + +-config GENERIC_CPU ++config POWERPC_CPU + bool "Generic 32 bits powerpc" +- depends on PPC32 && !PPC_8xx ++ depends on PPC32 && !PPC_8xx && !PPC_85xx + + config CELL_CPU + bool "Cell Broadband Engine" +@@ -151,11 +151,11 @@ config POWER9_CPU + + config E5500_CPU + bool "Freescale e5500" +- depends on E500 ++ depends on PPC64 && E500 + + config E6500_CPU + bool "Freescale e6500" +- depends on E500 ++ depends on PPC64 && E500 + + config 860_CPU + bool "8xx family" +@@ -174,11 +174,23 @@ config G4_CPU + depends on PPC_BOOK3S_32 + select ALTIVEC + ++config E500_CPU ++ bool "e500 (8540)" ++ depends on PPC_85xx && !PPC_E500MC ++ ++config E500MC_CPU ++ bool "e500mc" ++ depends on PPC_85xx && PPC_E500MC ++ ++config TOOLCHAIN_DEFAULT_CPU ++ bool "Rely on the toolchain's implicit default CPU" ++ depends on PPC32 ++ + endchoice + + config TARGET_CPU_BOOL + bool +- default !GENERIC_CPU ++ default !GENERIC_CPU && !TOOLCHAIN_DEFAULT_CPU + + config TARGET_CPU + string +@@ -193,6 +205,9 @@ config TARGET_CPU + default "e300c2" if E300C2_CPU + default "e300c3" if E300C3_CPU + default "G4" if G4_CPU ++ default "8540" if E500_CPU ++ default "e500mc" if E500MC_CPU ++ default "powerpc" if POWERPC_CPU + + config PPC_BOOK3S + def_bool y +diff --git a/arch/powerpc/platforms/cell/axon_msi.c b/arch/powerpc/platforms/cell/axon_msi.c +index 57c4e0e86c884..ba33140e671da 100644 +--- a/arch/powerpc/platforms/cell/axon_msi.c ++++ b/arch/powerpc/platforms/cell/axon_msi.c +@@ -226,6 +226,7 @@ static int setup_msi_msg_address(struct pci_dev *dev, struct msi_msg *msg) + if (!prop) { + dev_dbg(&dev->dev, + "axon_msi: no msi-address-(32|64) properties found\n"); ++ of_node_put(dn); + return -ENOENT; + } + +diff --git a/arch/powerpc/platforms/cell/spufs/inode.c b/arch/powerpc/platforms/cell/spufs/inode.c +index 2dd452a047cd6..99e688498a9cb 100644 +--- a/arch/powerpc/platforms/cell/spufs/inode.c ++++ b/arch/powerpc/platforms/cell/spufs/inode.c +@@ -671,6 +671,7 @@ spufs_init_isolated_loader(void) + return; + + loader = of_get_property(dn, "loader", &size); ++ of_node_put(dn); + if (!loader) + return; + +diff --git a/arch/powerpc/platforms/powernv/rng.c b/arch/powerpc/platforms/powernv/rng.c +index 7186e17cfd3dc..ace6497017830 100644 +--- a/arch/powerpc/platforms/powernv/rng.c ++++ b/arch/powerpc/platforms/powernv/rng.c +@@ -63,6 +63,8 @@ int powernv_get_random_real_mode(unsigned long *v) + struct powernv_rng *rng; + + rng = raw_cpu_read(powernv_rng); ++ if (!rng) ++ return 0; + + *v = rng_whiten(rng, __raw_rm_readq(rng->regs_real)); + +diff --git a/arch/powerpc/sysdev/fsl_pci.c b/arch/powerpc/sysdev/fsl_pci.c +index ff0e2b156cb5f..6adf2fdec799e 100644 +--- a/arch/powerpc/sysdev/fsl_pci.c ++++ b/arch/powerpc/sysdev/fsl_pci.c +@@ -520,6 +520,7 @@ int fsl_add_bridge(struct platform_device *pdev, int is_primary) + struct resource rsrc; + const int *bus_range; + u8 hdr_type, progif; ++ u32 class_code; + struct device_node *dev; + struct ccsr_pci __iomem *pci; + u16 temp; +@@ -593,6 +594,13 @@ int fsl_add_bridge(struct platform_device *pdev, int is_primary) + PPC_INDIRECT_TYPE_SURPRESS_PRIMARY_BUS; + if (fsl_pcie_check_link(hose)) + hose->indirect_type |= PPC_INDIRECT_TYPE_NO_PCIE_LINK; ++ /* Fix Class Code to PCI_CLASS_BRIDGE_PCI_NORMAL for pre-3.0 controller */ ++ if (in_be32(&pci->block_rev1) < PCIE_IP_REV_3_0) { ++ early_read_config_dword(hose, 0, 0, PCIE_FSL_CSR_CLASSCODE, &class_code); ++ class_code &= 0xff; ++ class_code |= PCI_CLASS_BRIDGE_PCI_NORMAL << 8; ++ early_write_config_dword(hose, 0, 0, PCIE_FSL_CSR_CLASSCODE, class_code); ++ } + } else { + /* + * Set PBFR(PCI Bus Function Register)[10] = 1 to +diff --git a/arch/powerpc/sysdev/fsl_pci.h b/arch/powerpc/sysdev/fsl_pci.h +index 1d7a412056959..5ffaa60f1fa09 100644 +--- a/arch/powerpc/sysdev/fsl_pci.h ++++ b/arch/powerpc/sysdev/fsl_pci.h +@@ -18,6 +18,7 @@ struct platform_device; + + #define PCIE_LTSSM 0x0404 /* PCIE Link Training and Status */ + #define PCIE_LTSSM_L0 0x16 /* L0 state */ ++#define PCIE_FSL_CSR_CLASSCODE 0x474 /* FSL GPEX CSR */ + #define PCIE_IP_REV_2_2 0x02080202 /* PCIE IP block version Rev2.2 */ + #define PCIE_IP_REV_3_0 0x02080300 /* PCIE IP block version Rev3.0 */ + #define PIWAR_EN 0x80000000 /* Enable */ +diff --git a/arch/powerpc/sysdev/xive/spapr.c b/arch/powerpc/sysdev/xive/spapr.c +index 3f15615712b5b..b21d71badaec9 100644 +--- a/arch/powerpc/sysdev/xive/spapr.c ++++ b/arch/powerpc/sysdev/xive/spapr.c +@@ -683,6 +683,7 @@ static bool xive_get_max_prio(u8 *max_prio) + } + + reg = of_get_property(rootdn, "ibm,plat-res-int-priorities", &len); ++ of_node_put(rootdn); + if (!reg) { + pr_err("Failed to read 'ibm,plat-res-int-priorities' property\n"); + return false; +diff --git a/arch/riscv/kernel/sys_riscv.c b/arch/riscv/kernel/sys_riscv.c +index 12f8a7fce78b1..8a7880b9c433e 100644 +--- a/arch/riscv/kernel/sys_riscv.c ++++ b/arch/riscv/kernel/sys_riscv.c +@@ -18,9 +18,8 @@ static long riscv_sys_mmap(unsigned long addr, unsigned long len, + if (unlikely(offset & (~PAGE_MASK >> page_shift_offset))) + return -EINVAL; + +- if ((prot & PROT_WRITE) && (prot & PROT_EXEC)) +- if (unlikely(!(prot & PROT_READ))) +- return -EINVAL; ++ if (unlikely((prot & PROT_WRITE) && !(prot & PROT_READ))) ++ return -EINVAL; + + return ksys_mmap_pgoff(addr, len, prot, flags, fd, + offset >> (PAGE_SHIFT - page_shift_offset)); +diff --git a/arch/riscv/kernel/traps.c b/arch/riscv/kernel/traps.c +index 473de3ae8bb75..ae462037910be 100644 +--- a/arch/riscv/kernel/traps.c ++++ b/arch/riscv/kernel/traps.c +@@ -15,6 +15,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -43,6 +44,9 @@ void die(struct pt_regs *regs, const char *str) + + ret = notify_die(DIE_OOPS, str, regs, 0, regs->scause, SIGSEGV); + ++ if (regs && kexec_should_crash(current)) ++ crash_kexec(regs); ++ + bust_spinlocks(0); + add_taint(TAINT_DIE, LOCKDEP_NOW_UNRELIABLE); + spin_unlock_irq(&die_lock); +diff --git a/arch/s390/kernel/machine_kexec_file.c b/arch/s390/kernel/machine_kexec_file.c +index 76cd09879eaf4..53da174754d97 100644 +--- a/arch/s390/kernel/machine_kexec_file.c ++++ b/arch/s390/kernel/machine_kexec_file.c +@@ -29,6 +29,7 @@ int s390_verify_sig(const char *kernel, unsigned long kernel_len) + const unsigned long marker_len = sizeof(MODULE_SIG_STRING) - 1; + struct module_signature *ms; + unsigned long sig_len; ++ int ret; + + /* Skip signature verification when not secure IPLed. */ + if (!ipl_secure_flag) +@@ -63,11 +64,18 @@ int s390_verify_sig(const char *kernel, unsigned long kernel_len) + return -EBADMSG; + } + +- return verify_pkcs7_signature(kernel, kernel_len, +- kernel + kernel_len, sig_len, +- VERIFY_USE_PLATFORM_KEYRING, +- VERIFYING_MODULE_SIGNATURE, +- NULL, NULL); ++ ret = verify_pkcs7_signature(kernel, kernel_len, ++ kernel + kernel_len, sig_len, ++ VERIFY_USE_SECONDARY_KEYRING, ++ VERIFYING_MODULE_SIGNATURE, ++ NULL, NULL); ++ if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) ++ ret = verify_pkcs7_signature(kernel, kernel_len, ++ kernel + kernel_len, sig_len, ++ VERIFY_USE_PLATFORM_KEYRING, ++ VERIFYING_MODULE_SIGNATURE, ++ NULL, NULL); ++ return ret; + } + #endif /* CONFIG_KEXEC_SIG */ + +diff --git a/arch/um/os-Linux/skas/process.c b/arch/um/os-Linux/skas/process.c +index 4fb877b99dded..0571cc0a30fcc 100644 +--- a/arch/um/os-Linux/skas/process.c ++++ b/arch/um/os-Linux/skas/process.c +@@ -5,6 +5,7 @@ + */ + + #include ++#include + #include + #include + #include +@@ -641,10 +642,24 @@ void halt_skas(void) + UML_LONGJMP(&initial_jmpbuf, INIT_JMP_HALT); + } + ++static bool noreboot; ++ ++static int __init noreboot_cmd_param(char *str, int *add) ++{ ++ noreboot = true; ++ return 0; ++} ++ ++__uml_setup("noreboot", noreboot_cmd_param, ++"noreboot\n" ++" Rather than rebooting, exit always, akin to QEMU's -no-reboot option.\n" ++" This is useful if you're using CONFIG_PANIC_TIMEOUT in order to catch\n" ++" crashes in CI\n"); ++ + void reboot_skas(void) + { + block_signals_trace(); +- UML_LONGJMP(&initial_jmpbuf, INIT_JMP_REBOOT); ++ UML_LONGJMP(&initial_jmpbuf, noreboot ? INIT_JMP_HALT : INIT_JMP_REBOOT); + } + + void __switch_mm(struct mm_id *mm_idp) +diff --git a/arch/x86/boot/Makefile b/arch/x86/boot/Makefile +index 6539c50fb9aae..82500962f1b3d 100644 +--- a/arch/x86/boot/Makefile ++++ b/arch/x86/boot/Makefile +@@ -100,7 +100,7 @@ $(obj)/zoffset.h: $(obj)/compressed/vmlinux FORCE + AFLAGS_header.o += -I$(objtree)/$(obj) + $(obj)/header.o: $(obj)/zoffset.h + +-LDFLAGS_setup.elf := -m elf_i386 -T ++LDFLAGS_setup.elf := -m elf_i386 -z noexecstack -T + $(obj)/setup.elf: $(src)/setup.ld $(SETUP_OBJS) FORCE + $(call if_changed,ld) + +diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile +index 292b5bc6e3a30..edfb1a7185109 100644 +--- a/arch/x86/boot/compressed/Makefile ++++ b/arch/x86/boot/compressed/Makefile +@@ -57,6 +57,10 @@ else + KBUILD_LDFLAGS += $(shell $(LD) --help 2>&1 | grep -q "\-z noreloc-overflow" \ + && echo "-z noreloc-overflow -pie --no-dynamic-linker") + endif ++ ++KBUILD_LDFLAGS += -z noexecstack ++KBUILD_LDFLAGS += $(call ld-option,--no-warn-rwx-segments) ++ + LDFLAGS_vmlinux := -T + + hostprogs-y := mkpiggy +diff --git a/arch/x86/entry/vdso/Makefile b/arch/x86/entry/vdso/Makefile +index 0f2154106d016..5aae81f40bc3a 100644 +--- a/arch/x86/entry/vdso/Makefile ++++ b/arch/x86/entry/vdso/Makefile +@@ -178,7 +178,7 @@ quiet_cmd_vdso = VDSO $@ + sh $(srctree)/$(src)/checkundef.sh '$(NM)' '$@' + + VDSO_LDFLAGS = -shared --hash-style=both --build-id \ +- $(call ld-option, --eh-frame-hdr) -Bsymbolic ++ $(call ld-option, --eh-frame-hdr) -Bsymbolic -z noexecstack + GCOV_PROFILE := n + + quiet_cmd_vdso_and_check = VDSO $@ +diff --git a/arch/x86/kernel/pmem.c b/arch/x86/kernel/pmem.c +index 6b07faaa15798..23154d24b1173 100644 +--- a/arch/x86/kernel/pmem.c ++++ b/arch/x86/kernel/pmem.c +@@ -27,6 +27,11 @@ static __init int register_e820_pmem(void) + * simply here to trigger the module to load on demand. + */ + pdev = platform_device_alloc("e820_pmem", -1); +- return platform_device_add(pdev); ++ ++ rc = platform_device_add(pdev); ++ if (rc) ++ platform_device_put(pdev); ++ ++ return rc; + } + device_initcall(register_e820_pmem); +diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c +index 571e38c9ee1d3..068715a52ac10 100644 +--- a/arch/x86/kernel/process.c ++++ b/arch/x86/kernel/process.c +@@ -659,6 +659,10 @@ static void amd_e400_idle(void) + */ + static int prefer_mwait_c1_over_halt(const struct cpuinfo_x86 *c) + { ++ /* User has disallowed the use of MWAIT. Fallback to HALT */ ++ if (boot_option_idle_override == IDLE_NOMWAIT) ++ return 0; ++ + if (c->x86_vendor != X86_VENDOR_INTEL) + return 0; + +@@ -769,9 +773,8 @@ static int __init idle_setup(char *str) + } else if (!strcmp(str, "nomwait")) { + /* + * If the boot option of "idle=nomwait" is added, +- * it means that mwait will be disabled for CPU C2/C3 +- * states. In such case it won't touch the variable +- * of boot_option_idle_override. ++ * it means that mwait will be disabled for CPU C1/C2/C3 ++ * states. + */ + boot_option_idle_override = IDLE_NOMWAIT; + } else +diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c +index ea48a2fb1677d..fcb59dc54bf56 100644 +--- a/arch/x86/kvm/emulate.c ++++ b/arch/x86/kvm/emulate.c +@@ -1753,16 +1753,6 @@ static int __load_segment_descriptor(struct x86_emulate_ctxt *ctxt, + case VCPU_SREG_TR: + if (seg_desc.s || (seg_desc.type != 1 && seg_desc.type != 9)) + goto exception; +- if (!seg_desc.p) { +- err_vec = NP_VECTOR; +- goto exception; +- } +- old_desc = seg_desc; +- seg_desc.type |= 2; /* busy */ +- ret = ctxt->ops->cmpxchg_emulated(ctxt, desc_addr, &old_desc, &seg_desc, +- sizeof(seg_desc), &ctxt->exception); +- if (ret != X86EMUL_CONTINUE) +- return ret; + break; + case VCPU_SREG_LDTR: + if (seg_desc.s || seg_desc.type != 2) +@@ -1800,8 +1790,17 @@ static int __load_segment_descriptor(struct x86_emulate_ctxt *ctxt, + if (ret != X86EMUL_CONTINUE) + return ret; + if (emul_is_noncanonical_address(get_desc_base(&seg_desc) | +- ((u64)base3 << 32), ctxt)) +- return emulate_gp(ctxt, 0); ++ ((u64)base3 << 32), ctxt)) ++ return emulate_gp(ctxt, err_code); ++ } ++ ++ if (seg == VCPU_SREG_TR) { ++ old_desc = seg_desc; ++ seg_desc.type |= 2; /* busy */ ++ ret = ctxt->ops->cmpxchg_emulated(ctxt, desc_addr, &old_desc, &seg_desc, ++ sizeof(seg_desc), &ctxt->exception); ++ if (ret != X86EMUL_CONTINUE) ++ return ret; + } + load: + ctxt->ops->set_segment(ctxt, selector, &seg_desc, base3, seg); +diff --git a/arch/x86/kvm/hyperv.c b/arch/x86/kvm/hyperv.c +index ca66459a2e895..f9603df799bf1 100644 +--- a/arch/x86/kvm/hyperv.c ++++ b/arch/x86/kvm/hyperv.c +@@ -309,6 +309,9 @@ static int synic_set_irq(struct kvm_vcpu_hv_synic *synic, u32 sint) + struct kvm_lapic_irq irq; + int ret, vector; + ++ if (KVM_BUG_ON(!lapic_in_kernel(vcpu), vcpu->kvm)) ++ return -EINVAL; ++ + if (sint >= ARRAY_SIZE(synic->sint)) + return -EINVAL; + +diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c +index 3696b4de9d99d..23480d8e4ef17 100644 +--- a/arch/x86/kvm/lapic.c ++++ b/arch/x86/kvm/lapic.c +@@ -955,6 +955,10 @@ bool kvm_irq_delivery_to_apic_fast(struct kvm *kvm, struct kvm_lapic *src, + *r = -1; + + if (irq->shorthand == APIC_DEST_SELF) { ++ if (KVM_BUG_ON(!src, kvm)) { ++ *r = 0; ++ return true; ++ } + *r = kvm_apic_set_irq(src->vcpu, irq, dest_map); + return true; + } +diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c +index 125970286f289..1efcc7d4bc88e 100644 +--- a/arch/x86/kvm/svm.c ++++ b/arch/x86/kvm/svm.c +@@ -5137,8 +5137,6 @@ static void svm_set_irq(struct kvm_vcpu *vcpu) + { + struct vcpu_svm *svm = to_svm(vcpu); + +- BUG_ON(!(gif_set(svm))); +- + trace_kvm_inj_virq(vcpu->arch.interrupt.nr); + ++vcpu->stat.irq_injections; + +diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c +index 9f61ae64b7277..34ee4835b0177 100644 +--- a/arch/x86/kvm/vmx/nested.c ++++ b/arch/x86/kvm/vmx/nested.c +@@ -1060,7 +1060,7 @@ static int vmx_restore_vmx_basic(struct vcpu_vmx *vmx, u64 data) + BIT_ULL(49) | BIT_ULL(54) | BIT_ULL(55) | + /* reserved */ + BIT_ULL(31) | GENMASK_ULL(47, 45) | GENMASK_ULL(63, 56); +- u64 vmx_basic = vmx->nested.msrs.basic; ++ u64 vmx_basic = vmcs_config.nested.basic; + + if (!is_bitwise_subset(vmx_basic, data, feature_and_reserved)) + return -EINVAL; +@@ -1083,36 +1083,42 @@ static int vmx_restore_vmx_basic(struct vcpu_vmx *vmx, u64 data) + return 0; + } + +-static int +-vmx_restore_control_msr(struct vcpu_vmx *vmx, u32 msr_index, u64 data) ++static void vmx_get_control_msr(struct nested_vmx_msrs *msrs, u32 msr_index, ++ u32 **low, u32 **high) + { +- u64 supported; +- u32 *lowp, *highp; +- + switch (msr_index) { + case MSR_IA32_VMX_TRUE_PINBASED_CTLS: +- lowp = &vmx->nested.msrs.pinbased_ctls_low; +- highp = &vmx->nested.msrs.pinbased_ctls_high; ++ *low = &msrs->pinbased_ctls_low; ++ *high = &msrs->pinbased_ctls_high; + break; + case MSR_IA32_VMX_TRUE_PROCBASED_CTLS: +- lowp = &vmx->nested.msrs.procbased_ctls_low; +- highp = &vmx->nested.msrs.procbased_ctls_high; ++ *low = &msrs->procbased_ctls_low; ++ *high = &msrs->procbased_ctls_high; + break; + case MSR_IA32_VMX_TRUE_EXIT_CTLS: +- lowp = &vmx->nested.msrs.exit_ctls_low; +- highp = &vmx->nested.msrs.exit_ctls_high; ++ *low = &msrs->exit_ctls_low; ++ *high = &msrs->exit_ctls_high; + break; + case MSR_IA32_VMX_TRUE_ENTRY_CTLS: +- lowp = &vmx->nested.msrs.entry_ctls_low; +- highp = &vmx->nested.msrs.entry_ctls_high; ++ *low = &msrs->entry_ctls_low; ++ *high = &msrs->entry_ctls_high; + break; + case MSR_IA32_VMX_PROCBASED_CTLS2: +- lowp = &vmx->nested.msrs.secondary_ctls_low; +- highp = &vmx->nested.msrs.secondary_ctls_high; ++ *low = &msrs->secondary_ctls_low; ++ *high = &msrs->secondary_ctls_high; + break; + default: + BUG(); + } ++} ++ ++static int ++vmx_restore_control_msr(struct vcpu_vmx *vmx, u32 msr_index, u64 data) ++{ ++ u32 *lowp, *highp; ++ u64 supported; ++ ++ vmx_get_control_msr(&vmcs_config.nested, msr_index, &lowp, &highp); + + supported = vmx_control_msr(*lowp, *highp); + +@@ -1124,6 +1130,7 @@ vmx_restore_control_msr(struct vcpu_vmx *vmx, u32 msr_index, u64 data) + if (!is_bitwise_subset(supported, data, GENMASK_ULL(63, 32))) + return -EINVAL; + ++ vmx_get_control_msr(&vmx->nested.msrs, msr_index, &lowp, &highp); + *lowp = data; + *highp = data >> 32; + return 0; +@@ -1137,10 +1144,8 @@ static int vmx_restore_vmx_misc(struct vcpu_vmx *vmx, u64 data) + BIT_ULL(28) | BIT_ULL(29) | BIT_ULL(30) | + /* reserved */ + GENMASK_ULL(13, 9) | BIT_ULL(31); +- u64 vmx_misc; +- +- vmx_misc = vmx_control_msr(vmx->nested.msrs.misc_low, +- vmx->nested.msrs.misc_high); ++ u64 vmx_misc = vmx_control_msr(vmcs_config.nested.misc_low, ++ vmcs_config.nested.misc_high); + + if (!is_bitwise_subset(vmx_misc, data, feature_and_reserved_bits)) + return -EINVAL; +@@ -1168,10 +1173,8 @@ static int vmx_restore_vmx_misc(struct vcpu_vmx *vmx, u64 data) + + static int vmx_restore_vmx_ept_vpid_cap(struct vcpu_vmx *vmx, u64 data) + { +- u64 vmx_ept_vpid_cap; +- +- vmx_ept_vpid_cap = vmx_control_msr(vmx->nested.msrs.ept_caps, +- vmx->nested.msrs.vpid_caps); ++ u64 vmx_ept_vpid_cap = vmx_control_msr(vmcs_config.nested.ept_caps, ++ vmcs_config.nested.vpid_caps); + + /* Every bit is either reserved or a feature bit. */ + if (!is_bitwise_subset(vmx_ept_vpid_cap, data, -1ULL)) +@@ -1182,20 +1185,21 @@ static int vmx_restore_vmx_ept_vpid_cap(struct vcpu_vmx *vmx, u64 data) + return 0; + } + +-static int vmx_restore_fixed0_msr(struct vcpu_vmx *vmx, u32 msr_index, u64 data) ++static u64 *vmx_get_fixed0_msr(struct nested_vmx_msrs *msrs, u32 msr_index) + { +- u64 *msr; +- + switch (msr_index) { + case MSR_IA32_VMX_CR0_FIXED0: +- msr = &vmx->nested.msrs.cr0_fixed0; +- break; ++ return &msrs->cr0_fixed0; + case MSR_IA32_VMX_CR4_FIXED0: +- msr = &vmx->nested.msrs.cr4_fixed0; +- break; ++ return &msrs->cr4_fixed0; + default: + BUG(); + } ++} ++ ++static int vmx_restore_fixed0_msr(struct vcpu_vmx *vmx, u32 msr_index, u64 data) ++{ ++ const u64 *msr = vmx_get_fixed0_msr(&vmcs_config.nested, msr_index); + + /* + * 1 bits (which indicates bits which "must-be-1" during VMX operation) +@@ -1204,7 +1208,7 @@ static int vmx_restore_fixed0_msr(struct vcpu_vmx *vmx, u32 msr_index, u64 data) + if (!is_bitwise_subset(data, *msr, -1ULL)) + return -EINVAL; + +- *msr = data; ++ *vmx_get_fixed0_msr(&vmx->nested.msrs, msr_index) = data; + return 0; + } + +@@ -1265,7 +1269,7 @@ int vmx_set_vmx_msr(struct kvm_vcpu *vcpu, u32 msr_index, u64 data) + vmx->nested.msrs.vmcs_enum = data; + return 0; + case MSR_IA32_VMX_VMFUNC: +- if (data & ~vmx->nested.msrs.vmfunc_controls) ++ if (data & ~vmcs_config.nested.vmfunc_controls) + return -EINVAL; + vmx->nested.msrs.vmfunc_controls = data; + return 0; +@@ -3065,10 +3069,12 @@ enum nvmx_vmentry_status nested_vmx_enter_non_root_mode(struct kvm_vcpu *vcpu, + if (likely(!evaluate_pending_interrupts) && kvm_vcpu_apicv_active(vcpu)) + evaluate_pending_interrupts |= vmx_has_apicv_interrupt(vcpu); + +- if (!(vmcs12->vm_entry_controls & VM_ENTRY_LOAD_DEBUG_CONTROLS)) ++ if (!vmx->nested.nested_run_pending || ++ !(vmcs12->vm_entry_controls & VM_ENTRY_LOAD_DEBUG_CONTROLS)) + vmx->nested.vmcs01_debugctl = vmcs_read64(GUEST_IA32_DEBUGCTL); + if (kvm_mpx_supported() && +- !(vmcs12->vm_entry_controls & VM_ENTRY_LOAD_BNDCFGS)) ++ (!vmx->nested.nested_run_pending || ++ !(vmcs12->vm_entry_controls & VM_ENTRY_LOAD_BNDCFGS))) + vmx->nested.vmcs01_guest_bndcfgs = vmcs_read64(GUEST_BNDCFGS); + + /* +diff --git a/arch/x86/mm/numa.c b/arch/x86/mm/numa.c +index 4123100e0eafe..67c617c4a7f20 100644 +--- a/arch/x86/mm/numa.c ++++ b/arch/x86/mm/numa.c +@@ -822,7 +822,7 @@ void debug_cpumask_set_cpu(int cpu, int node, bool enable) + return; + } + mask = node_to_cpumask_map[node]; +- if (!mask) { ++ if (!cpumask_available(mask)) { + pr_err("node_to_cpumask_map[%i] NULL\n", node); + dump_stack(); + return; +@@ -868,7 +868,7 @@ const struct cpumask *cpumask_of_node(int node) + dump_stack(); + return cpu_none_mask; + } +- if (node_to_cpumask_map[node] == NULL) { ++ if (!cpumask_available(node_to_cpumask_map[node])) { + printk(KERN_WARNING + "cpumask_of_node(%d): no node_to_cpumask_map!\n", + node); +diff --git a/arch/x86/platform/olpc/olpc-xo1-sci.c b/arch/x86/platform/olpc/olpc-xo1-sci.c +index 99a28ce2244c7..90735895aa443 100644 +--- a/arch/x86/platform/olpc/olpc-xo1-sci.c ++++ b/arch/x86/platform/olpc/olpc-xo1-sci.c +@@ -81,7 +81,7 @@ static void send_ebook_state(void) + return; + } + +- if (!!test_bit(SW_TABLET_MODE, ebook_switch_idev->sw) == state) ++ if (test_bit(SW_TABLET_MODE, ebook_switch_idev->sw) == !!state) + return; /* Nothing new to report. */ + + input_report_switch(ebook_switch_idev, SW_TABLET_MODE, state); +diff --git a/block/blk-mq-debugfs.c b/block/blk-mq-debugfs.c +index 121f4c1e0697b..772a6c6b16342 100644 +--- a/block/blk-mq-debugfs.c ++++ b/block/blk-mq-debugfs.c +@@ -883,6 +883,9 @@ void blk_mq_debugfs_register_hctx(struct request_queue *q, + char name[20]; + int i; + ++ if (!q->debugfs_dir) ++ return; ++ + snprintf(name, sizeof(name), "hctx%u", hctx->queue_num); + hctx->debugfs_dir = debugfs_create_dir(name, q->debugfs_dir); + +diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c +index 751ed38f2a10e..b939a6736d0ba 100644 +--- a/drivers/acpi/acpi_lpss.c ++++ b/drivers/acpi/acpi_lpss.c +@@ -401,6 +401,9 @@ static int register_device_clock(struct acpi_device *adev, + if (!lpss_clk_dev) + lpt_register_clock_device(); + ++ if (IS_ERR(lpss_clk_dev)) ++ return PTR_ERR(lpss_clk_dev); ++ + clk_data = platform_get_drvdata(lpss_clk_dev); + if (!clk_data) + return -ENODEV; +diff --git a/drivers/acpi/cppc_acpi.c b/drivers/acpi/cppc_acpi.c +index 0521b1d4c2fd0..d24cbba14e919 100644 +--- a/drivers/acpi/cppc_acpi.c ++++ b/drivers/acpi/cppc_acpi.c +@@ -626,33 +626,6 @@ int pcc_data_alloc(int pcc_ss_id) + return 0; + } + +-/* Check if CPPC revision + num_ent combination is supported */ +-static bool is_cppc_supported(int revision, int num_ent) +-{ +- int expected_num_ent; +- +- switch (revision) { +- case CPPC_V2_REV: +- expected_num_ent = CPPC_V2_NUM_ENT; +- break; +- case CPPC_V3_REV: +- expected_num_ent = CPPC_V3_NUM_ENT; +- break; +- default: +- pr_debug("Firmware exports unsupported CPPC revision: %d\n", +- revision); +- return false; +- } +- +- if (expected_num_ent != num_ent) { +- pr_debug("Firmware exports %d entries. Expected: %d for CPPC rev:%d\n", +- num_ent, expected_num_ent, revision); +- return false; +- } +- +- return true; +-} +- + /* + * An example CPC table looks like the following. + * +@@ -748,7 +721,6 @@ int acpi_cppc_processor_probe(struct acpi_processor *pr) + cpc_obj->type); + goto out_free; + } +- cpc_ptr->num_entries = num_ent; + + /* Second entry should be revision. */ + cpc_obj = &out_obj->package.elements[1]; +@@ -759,10 +731,32 @@ int acpi_cppc_processor_probe(struct acpi_processor *pr) + cpc_obj->type); + goto out_free; + } +- cpc_ptr->version = cpc_rev; + +- if (!is_cppc_supported(cpc_rev, num_ent)) ++ if (cpc_rev < CPPC_V2_REV) { ++ pr_debug("Unsupported _CPC Revision (%d) for CPU:%d\n", cpc_rev, ++ pr->id); + goto out_free; ++ } ++ ++ /* ++ * Disregard _CPC if the number of entries in the return pachage is not ++ * as expected, but support future revisions being proper supersets of ++ * the v3 and only causing more entries to be returned by _CPC. ++ */ ++ if ((cpc_rev == CPPC_V2_REV && num_ent != CPPC_V2_NUM_ENT) || ++ (cpc_rev == CPPC_V3_REV && num_ent != CPPC_V3_NUM_ENT) || ++ (cpc_rev > CPPC_V3_REV && num_ent <= CPPC_V3_NUM_ENT)) { ++ pr_debug("Unexpected number of _CPC return package entries (%d) for CPU:%d\n", ++ num_ent, pr->id); ++ goto out_free; ++ } ++ if (cpc_rev > CPPC_V3_REV) { ++ num_ent = CPPC_V3_NUM_ENT; ++ cpc_rev = CPPC_V3_REV; ++ } ++ ++ cpc_ptr->num_entries = num_ent; ++ cpc_ptr->version = cpc_rev; + + /* Iterate through remaining entries in _CPC */ + for (i = 2; i < num_ent; i++) { +diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c +index e5b92958c299e..defc5796b5084 100644 +--- a/drivers/acpi/ec.c ++++ b/drivers/acpi/ec.c +@@ -2118,13 +2118,6 @@ static const struct dmi_system_id acpi_ec_no_wakeup[] = { + DMI_MATCH(DMI_PRODUCT_FAMILY, "Thinkpad X1 Carbon 6th"), + }, + }, +- { +- .ident = "ThinkPad X1 Carbon 6th", +- .matches = { +- DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), +- DMI_MATCH(DMI_PRODUCT_FAMILY, "ThinkPad X1 Carbon 6th"), +- }, +- }, + { + .ident = "ThinkPad X1 Yoga 3rd", + .matches = { +diff --git a/drivers/acpi/pci_mcfg.c b/drivers/acpi/pci_mcfg.c +index 47e43c9498257..ed2f880b63b5f 100644 +--- a/drivers/acpi/pci_mcfg.c ++++ b/drivers/acpi/pci_mcfg.c +@@ -41,6 +41,8 @@ struct mcfg_fixup { + static struct mcfg_fixup mcfg_quirks[] = { + /* { OEM_ID, OEM_TABLE_ID, REV, SEGMENT, BUS_RANGE, ops, cfgres }, */ + ++#ifdef CONFIG_ARM64 ++ + #define AL_ECAM(table_id, rev, seg, ops) \ + { "AMAZON", table_id, rev, seg, MCFG_BUS_ANY, ops } + +@@ -162,6 +164,7 @@ static struct mcfg_fixup mcfg_quirks[] = { + ALTRA_ECAM_QUIRK(1, 13), + ALTRA_ECAM_QUIRK(1, 14), + ALTRA_ECAM_QUIRK(1, 15), ++#endif /* ARM64 */ + }; + + static char mcfg_oem_id[ACPI_OEM_ID_SIZE]; +diff --git a/drivers/acpi/property.c b/drivers/acpi/property.c +index 1b0aeb8320448..479856ceda9fb 100644 +--- a/drivers/acpi/property.c ++++ b/drivers/acpi/property.c +@@ -152,10 +152,10 @@ static bool acpi_nondev_subnode_ok(acpi_handle scope, + return acpi_nondev_subnode_data_ok(handle, link, list, parent); + } + +-static int acpi_add_nondev_subnodes(acpi_handle scope, +- const union acpi_object *links, +- struct list_head *list, +- struct fwnode_handle *parent) ++static bool acpi_add_nondev_subnodes(acpi_handle scope, ++ const union acpi_object *links, ++ struct list_head *list, ++ struct fwnode_handle *parent) + { + bool ret = false; + int i; +diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c +index 34966128293b1..b9d203569ac1d 100644 +--- a/drivers/acpi/sleep.c ++++ b/drivers/acpi/sleep.c +@@ -361,6 +361,14 @@ static const struct dmi_system_id acpisleep_dmi_table[] __initconst = { + DMI_MATCH(DMI_PRODUCT_NAME, "80E3"), + }, + }, ++ { ++ .callback = init_nvs_save_s3, ++ .ident = "Lenovo G40-45", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "80E1"), ++ }, ++ }, + /* + * ThinkPad X1 Tablet(2016) cannot do suspend-to-idle using + * the Low Power S0 Idle firmware interface (see +diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c +index c6a21a784ec65..5c91183b5b736 100644 +--- a/drivers/ata/libata-eh.c ++++ b/drivers/ata/libata-eh.c +@@ -2329,6 +2329,7 @@ const char *ata_get_cmd_descript(u8 command) + { ATA_CMD_WRITE_QUEUED_FUA_EXT, "WRITE DMA QUEUED FUA EXT" }, + { ATA_CMD_FPDMA_READ, "READ FPDMA QUEUED" }, + { ATA_CMD_FPDMA_WRITE, "WRITE FPDMA QUEUED" }, ++ { ATA_CMD_NCQ_NON_DATA, "NCQ NON-DATA" }, + { ATA_CMD_FPDMA_SEND, "SEND FPDMA QUEUED" }, + { ATA_CMD_FPDMA_RECV, "RECEIVE FPDMA QUEUED" }, + { ATA_CMD_PIO_READ, "READ SECTOR(S)" }, +diff --git a/drivers/atm/idt77252.c b/drivers/atm/idt77252.c +index 363073e7b6538..a95a9448984fe 100644 +--- a/drivers/atm/idt77252.c ++++ b/drivers/atm/idt77252.c +@@ -3766,6 +3766,7 @@ static void __exit idt77252_exit(void) + card = idt77252_chain; + dev = card->atmdev; + idt77252_chain = card->next; ++ del_timer_sync(&card->tst_timer); + + if (dev->phy->stop) + dev->phy->stop(dev); +diff --git a/drivers/base/dd.c b/drivers/base/dd.c +index 6f85280fef8d3..4e45c87ed1778 100644 +--- a/drivers/base/dd.c ++++ b/drivers/base/dd.c +@@ -1037,6 +1037,7 @@ static void __driver_attach_async_helper(void *_dev, async_cookie_t cookie) + static int __driver_attach(struct device *dev, void *data) + { + struct device_driver *drv = data; ++ bool async = false; + int ret; + + /* +@@ -1074,9 +1075,11 @@ static int __driver_attach(struct device *dev, void *data) + if (!dev->driver) { + get_device(dev); + dev->p->async_driver = drv; +- async_schedule_dev(__driver_attach_async_helper, dev); ++ async = true; + } + device_unlock(dev); ++ if (async) ++ async_schedule_dev(__driver_attach_async_helper, dev); + return 0; + } + +diff --git a/drivers/block/null_blk_main.c b/drivers/block/null_blk_main.c +index 13eae973eaea4..6cbdd8a691d2b 100644 +--- a/drivers/block/null_blk_main.c ++++ b/drivers/block/null_blk_main.c +@@ -1711,8 +1711,13 @@ static int null_add_dev(struct nullb_device *dev) + blk_queue_flag_clear(QUEUE_FLAG_ADD_RANDOM, nullb->q); + + mutex_lock(&lock); +- nullb->index = ida_simple_get(&nullb_indexes, 0, 0, GFP_KERNEL); +- dev->index = nullb->index; ++ rv = ida_simple_get(&nullb_indexes, 0, 0, GFP_KERNEL); ++ if (rv < 0) { ++ mutex_unlock(&lock); ++ goto out_cleanup_zone; ++ } ++ nullb->index = rv; ++ dev->index = rv; + mutex_unlock(&lock); + + blk_queue_logical_block_size(nullb->q, dev->blocksize); +@@ -1724,13 +1729,16 @@ static int null_add_dev(struct nullb_device *dev) + + rv = null_gendisk_register(nullb); + if (rv) +- goto out_cleanup_zone; ++ goto out_ida_free; + + mutex_lock(&lock); + list_add_tail(&nullb->list, &nullb_list); + mutex_unlock(&lock); + + return 0; ++ ++out_ida_free: ++ ida_free(&nullb_indexes, nullb->index); + out_cleanup_zone: + if (dev->zoned) + null_zone_exit(dev); +diff --git a/drivers/bluetooth/hci_intel.c b/drivers/bluetooth/hci_intel.c +index 31f25153087d7..02c96c603768a 100644 +--- a/drivers/bluetooth/hci_intel.c ++++ b/drivers/bluetooth/hci_intel.c +@@ -1230,7 +1230,11 @@ static struct platform_driver intel_driver = { + + int __init intel_init(void) + { +- platform_driver_register(&intel_driver); ++ int err; ++ ++ err = platform_driver_register(&intel_driver); ++ if (err) ++ return err; + + return hci_uart_register_proto(&intel_proto); + } +diff --git a/drivers/bus/hisi_lpc.c b/drivers/bus/hisi_lpc.c +index 2e9252d37a18f..0922cbe8900b4 100644 +--- a/drivers/bus/hisi_lpc.c ++++ b/drivers/bus/hisi_lpc.c +@@ -504,13 +504,13 @@ static int hisi_lpc_acpi_probe(struct device *hostdev) + { + struct acpi_device *adev = ACPI_COMPANION(hostdev); + struct acpi_device *child; ++ struct platform_device *pdev; + int ret; + + /* Only consider the children of the host */ + list_for_each_entry(child, &adev->children, node) { + const char *hid = acpi_device_hid(child); + const struct hisi_lpc_acpi_cell *cell; +- struct platform_device *pdev; + const struct resource *res; + bool found = false; + int num_res; +@@ -572,22 +572,24 @@ static int hisi_lpc_acpi_probe(struct device *hostdev) + + ret = platform_device_add_resources(pdev, res, num_res); + if (ret) +- goto fail; ++ goto fail_put_device; + + ret = platform_device_add_data(pdev, cell->pdata, + cell->pdata_size); + if (ret) +- goto fail; ++ goto fail_put_device; + + ret = platform_device_add(pdev); + if (ret) +- goto fail; ++ goto fail_put_device; + + acpi_device_set_enumerated(child); + } + + return 0; + ++fail_put_device: ++ platform_device_put(pdev); + fail: + hisi_lpc_acpi_remove(hostdev); + return ret; +diff --git a/drivers/clk/mediatek/reset.c b/drivers/clk/mediatek/reset.c +index cb939c071b0cc..89916acf0bc32 100644 +--- a/drivers/clk/mediatek/reset.c ++++ b/drivers/clk/mediatek/reset.c +@@ -25,7 +25,7 @@ static int mtk_reset_assert_set_clr(struct reset_controller_dev *rcdev, + struct mtk_reset *data = container_of(rcdev, struct mtk_reset, rcdev); + unsigned int reg = data->regofs + ((id / 32) << 4); + +- return regmap_write(data->regmap, reg, 1); ++ return regmap_write(data->regmap, reg, BIT(id % 32)); + } + + static int mtk_reset_deassert_set_clr(struct reset_controller_dev *rcdev, +@@ -34,7 +34,7 @@ static int mtk_reset_deassert_set_clr(struct reset_controller_dev *rcdev, + struct mtk_reset *data = container_of(rcdev, struct mtk_reset, rcdev); + unsigned int reg = data->regofs + ((id / 32) << 4) + 0x4; + +- return regmap_write(data->regmap, reg, 1); ++ return regmap_write(data->regmap, reg, BIT(id % 32)); + } + + static int mtk_reset_assert(struct reset_controller_dev *rcdev, +diff --git a/drivers/clk/qcom/camcc-sdm845.c b/drivers/clk/qcom/camcc-sdm845.c +index 1b2cefef7431d..a8a2cfa83290a 100644 +--- a/drivers/clk/qcom/camcc-sdm845.c ++++ b/drivers/clk/qcom/camcc-sdm845.c +@@ -1521,6 +1521,8 @@ static struct clk_branch cam_cc_sys_tmr_clk = { + }, + }; + ++static struct gdsc titan_top_gdsc; ++ + static struct gdsc bps_gdsc = { + .gdscr = 0x6004, + .pd = { +@@ -1554,6 +1556,7 @@ static struct gdsc ife_0_gdsc = { + .name = "ife_0_gdsc", + }, + .flags = POLL_CFG_GDSCR, ++ .parent = &titan_top_gdsc.pd, + .pwrsts = PWRSTS_OFF_ON, + }; + +@@ -1563,6 +1566,7 @@ static struct gdsc ife_1_gdsc = { + .name = "ife_1_gdsc", + }, + .flags = POLL_CFG_GDSCR, ++ .parent = &titan_top_gdsc.pd, + .pwrsts = PWRSTS_OFF_ON, + }; + +diff --git a/drivers/clk/qcom/clk-krait.c b/drivers/clk/qcom/clk-krait.c +index 59f1af415b580..90046428693c2 100644 +--- a/drivers/clk/qcom/clk-krait.c ++++ b/drivers/clk/qcom/clk-krait.c +@@ -32,11 +32,16 @@ static void __krait_mux_set_sel(struct krait_mux_clk *mux, int sel) + regval |= (sel & mux->mask) << (mux->shift + LPL_SHIFT); + } + krait_set_l2_indirect_reg(mux->offset, regval); +- spin_unlock_irqrestore(&krait_clock_reg_lock, flags); + + /* Wait for switch to complete. */ + mb(); + udelay(1); ++ ++ /* ++ * Unlock now to make sure the mux register is not ++ * modified while switching to the new parent. ++ */ ++ spin_unlock_irqrestore(&krait_clock_reg_lock, flags); + } + + static int krait_mux_set_parent(struct clk_hw *hw, u8 index) +diff --git a/drivers/clk/qcom/gcc-ipq8074.c b/drivers/clk/qcom/gcc-ipq8074.c +index de48ba7eba3a1..e9835db941d88 100644 +--- a/drivers/clk/qcom/gcc-ipq8074.c ++++ b/drivers/clk/qcom/gcc-ipq8074.c +@@ -667,6 +667,7 @@ static struct clk_branch gcc_sleep_clk_src = { + }, + .num_parents = 1, + .ops = &clk_branch2_ops, ++ .flags = CLK_IS_CRITICAL, + }, + }, + }; +@@ -1788,8 +1789,10 @@ static struct clk_regmap_div nss_port4_tx_div_clk_src = { + static const struct freq_tbl ftbl_nss_port5_rx_clk_src[] = { + F(19200000, P_XO, 1, 0, 0), + F(25000000, P_UNIPHY1_RX, 12.5, 0, 0), ++ F(25000000, P_UNIPHY0_RX, 5, 0, 0), + F(78125000, P_UNIPHY1_RX, 4, 0, 0), + F(125000000, P_UNIPHY1_RX, 2.5, 0, 0), ++ F(125000000, P_UNIPHY0_RX, 1, 0, 0), + F(156250000, P_UNIPHY1_RX, 2, 0, 0), + F(312500000, P_UNIPHY1_RX, 1, 0, 0), + { } +@@ -1828,8 +1831,10 @@ static struct clk_regmap_div nss_port5_rx_div_clk_src = { + static const struct freq_tbl ftbl_nss_port5_tx_clk_src[] = { + F(19200000, P_XO, 1, 0, 0), + F(25000000, P_UNIPHY1_TX, 12.5, 0, 0), ++ F(25000000, P_UNIPHY0_TX, 5, 0, 0), + F(78125000, P_UNIPHY1_TX, 4, 0, 0), + F(125000000, P_UNIPHY1_TX, 2.5, 0, 0), ++ F(125000000, P_UNIPHY0_TX, 1, 0, 0), + F(156250000, P_UNIPHY1_TX, 2, 0, 0), + F(312500000, P_UNIPHY1_TX, 1, 0, 0), + { } +@@ -1867,8 +1872,10 @@ static struct clk_regmap_div nss_port5_tx_div_clk_src = { + + static const struct freq_tbl ftbl_nss_port6_rx_clk_src[] = { + F(19200000, P_XO, 1, 0, 0), ++ F(25000000, P_UNIPHY2_RX, 5, 0, 0), + F(25000000, P_UNIPHY2_RX, 12.5, 0, 0), + F(78125000, P_UNIPHY2_RX, 4, 0, 0), ++ F(125000000, P_UNIPHY2_RX, 1, 0, 0), + F(125000000, P_UNIPHY2_RX, 2.5, 0, 0), + F(156250000, P_UNIPHY2_RX, 2, 0, 0), + F(312500000, P_UNIPHY2_RX, 1, 0, 0), +@@ -1907,8 +1914,10 @@ static struct clk_regmap_div nss_port6_rx_div_clk_src = { + + static const struct freq_tbl ftbl_nss_port6_tx_clk_src[] = { + F(19200000, P_XO, 1, 0, 0), ++ F(25000000, P_UNIPHY2_TX, 5, 0, 0), + F(25000000, P_UNIPHY2_TX, 12.5, 0, 0), + F(78125000, P_UNIPHY2_TX, 4, 0, 0), ++ F(125000000, P_UNIPHY2_TX, 1, 0, 0), + F(125000000, P_UNIPHY2_TX, 2.5, 0, 0), + F(156250000, P_UNIPHY2_TX, 2, 0, 0), + F(312500000, P_UNIPHY2_TX, 1, 0, 0), +@@ -3346,6 +3355,7 @@ static struct clk_branch gcc_nssnoc_ubi1_ahb_clk = { + + static struct clk_branch gcc_ubi0_ahb_clk = { + .halt_reg = 0x6820c, ++ .halt_check = BRANCH_HALT_DELAY, + .clkr = { + .enable_reg = 0x6820c, + .enable_mask = BIT(0), +@@ -3363,6 +3373,7 @@ static struct clk_branch gcc_ubi0_ahb_clk = { + + static struct clk_branch gcc_ubi0_axi_clk = { + .halt_reg = 0x68200, ++ .halt_check = BRANCH_HALT_DELAY, + .clkr = { + .enable_reg = 0x68200, + .enable_mask = BIT(0), +@@ -3380,6 +3391,7 @@ static struct clk_branch gcc_ubi0_axi_clk = { + + static struct clk_branch gcc_ubi0_nc_axi_clk = { + .halt_reg = 0x68204, ++ .halt_check = BRANCH_HALT_DELAY, + .clkr = { + .enable_reg = 0x68204, + .enable_mask = BIT(0), +@@ -3397,6 +3409,7 @@ static struct clk_branch gcc_ubi0_nc_axi_clk = { + + static struct clk_branch gcc_ubi0_core_clk = { + .halt_reg = 0x68210, ++ .halt_check = BRANCH_HALT_DELAY, + .clkr = { + .enable_reg = 0x68210, + .enable_mask = BIT(0), +@@ -3414,6 +3427,7 @@ static struct clk_branch gcc_ubi0_core_clk = { + + static struct clk_branch gcc_ubi0_mpt_clk = { + .halt_reg = 0x68208, ++ .halt_check = BRANCH_HALT_DELAY, + .clkr = { + .enable_reg = 0x68208, + .enable_mask = BIT(0), +@@ -3431,6 +3445,7 @@ static struct clk_branch gcc_ubi0_mpt_clk = { + + static struct clk_branch gcc_ubi1_ahb_clk = { + .halt_reg = 0x6822c, ++ .halt_check = BRANCH_HALT_DELAY, + .clkr = { + .enable_reg = 0x6822c, + .enable_mask = BIT(0), +@@ -3448,6 +3463,7 @@ static struct clk_branch gcc_ubi1_ahb_clk = { + + static struct clk_branch gcc_ubi1_axi_clk = { + .halt_reg = 0x68220, ++ .halt_check = BRANCH_HALT_DELAY, + .clkr = { + .enable_reg = 0x68220, + .enable_mask = BIT(0), +@@ -3465,6 +3481,7 @@ static struct clk_branch gcc_ubi1_axi_clk = { + + static struct clk_branch gcc_ubi1_nc_axi_clk = { + .halt_reg = 0x68224, ++ .halt_check = BRANCH_HALT_DELAY, + .clkr = { + .enable_reg = 0x68224, + .enable_mask = BIT(0), +@@ -3482,6 +3499,7 @@ static struct clk_branch gcc_ubi1_nc_axi_clk = { + + static struct clk_branch gcc_ubi1_core_clk = { + .halt_reg = 0x68230, ++ .halt_check = BRANCH_HALT_DELAY, + .clkr = { + .enable_reg = 0x68230, + .enable_mask = BIT(0), +@@ -3499,6 +3517,7 @@ static struct clk_branch gcc_ubi1_core_clk = { + + static struct clk_branch gcc_ubi1_mpt_clk = { + .halt_reg = 0x68228, ++ .halt_check = BRANCH_HALT_DELAY, + .clkr = { + .enable_reg = 0x68228, + .enable_mask = BIT(0), +diff --git a/drivers/clk/renesas/r9a06g032-clocks.c b/drivers/clk/renesas/r9a06g032-clocks.c +index f2dc625b745da..80df4eb041cc2 100644 +--- a/drivers/clk/renesas/r9a06g032-clocks.c ++++ b/drivers/clk/renesas/r9a06g032-clocks.c +@@ -286,8 +286,8 @@ static const struct r9a06g032_clkdesc r9a06g032_clocks[] = { + .name = "uart_group_012", + .type = K_BITSEL, + .source = 1 + R9A06G032_DIV_UART, +- /* R9A06G032_SYSCTRL_REG_PWRCTRL_PG1_PR2 */ +- .dual.sel = ((0xec / 4) << 5) | 24, ++ /* R9A06G032_SYSCTRL_REG_PWRCTRL_PG0_0 */ ++ .dual.sel = ((0x34 / 4) << 5) | 30, + .dual.group = 0, + }, + { +@@ -295,8 +295,8 @@ static const struct r9a06g032_clkdesc r9a06g032_clocks[] = { + .name = "uart_group_34567", + .type = K_BITSEL, + .source = 1 + R9A06G032_DIV_P2_PG, +- /* R9A06G032_SYSCTRL_REG_PWRCTRL_PG0_0 */ +- .dual.sel = ((0x34 / 4) << 5) | 30, ++ /* R9A06G032_SYSCTRL_REG_PWRCTRL_PG1_PR2 */ ++ .dual.sel = ((0xec / 4) << 5) | 24, + .dual.group = 1, + }, + D_UGATE(CLK_UART0, "clk_uart0", UART_GROUP_012, 0, 0, 0x1b2, 0x1b3, 0x1b4, 0x1b5), +diff --git a/drivers/clk/rockchip/clk-rk3188.c b/drivers/clk/rockchip/clk-rk3188.c +index 77aebfb1d6d5b..730020fcc7fed 100644 +--- a/drivers/clk/rockchip/clk-rk3188.c ++++ b/drivers/clk/rockchip/clk-rk3188.c +@@ -751,6 +751,7 @@ static const char *const rk3188_critical_clocks[] __initconst = { + "pclk_peri", + "hclk_cpubus", + "hclk_vio_bus", ++ "sclk_mac_lbtest", + }; + + static struct rockchip_clk_provider *__init rk3188_common_clk_init(struct device_node *np) +diff --git a/drivers/crypto/hisilicon/sec/sec_algs.c b/drivers/crypto/hisilicon/sec/sec_algs.c +index 4ad4ffd90ceec..2402941a7f2fd 100644 +--- a/drivers/crypto/hisilicon/sec/sec_algs.c ++++ b/drivers/crypto/hisilicon/sec/sec_algs.c +@@ -449,7 +449,7 @@ static void sec_skcipher_alg_callback(struct sec_bd_info *sec_resp, + */ + } + +- mutex_lock(&ctx->queue->queuelock); ++ spin_lock_bh(&ctx->queue->queuelock); + /* Put the IV in place for chained cases */ + switch (ctx->cipher_alg) { + case SEC_C_AES_CBC_128: +@@ -509,7 +509,7 @@ static void sec_skcipher_alg_callback(struct sec_bd_info *sec_resp, + list_del(&backlog_req->backlog_head); + } + } +- mutex_unlock(&ctx->queue->queuelock); ++ spin_unlock_bh(&ctx->queue->queuelock); + + mutex_lock(&sec_req->lock); + list_del(&sec_req_el->head); +@@ -798,7 +798,7 @@ static int sec_alg_skcipher_crypto(struct skcipher_request *skreq, + */ + + /* Grab a big lock for a long time to avoid concurrency issues */ +- mutex_lock(&queue->queuelock); ++ spin_lock_bh(&queue->queuelock); + + /* + * Can go on to queue if we have space in either: +@@ -814,15 +814,15 @@ static int sec_alg_skcipher_crypto(struct skcipher_request *skreq, + ret = -EBUSY; + if ((skreq->base.flags & CRYPTO_TFM_REQ_MAY_BACKLOG)) { + list_add_tail(&sec_req->backlog_head, &ctx->backlog); +- mutex_unlock(&queue->queuelock); ++ spin_unlock_bh(&queue->queuelock); + goto out; + } + +- mutex_unlock(&queue->queuelock); ++ spin_unlock_bh(&queue->queuelock); + goto err_free_elements; + } + ret = sec_send_request(sec_req, queue); +- mutex_unlock(&queue->queuelock); ++ spin_unlock_bh(&queue->queuelock); + if (ret) + goto err_free_elements; + +@@ -881,7 +881,7 @@ static int sec_alg_skcipher_init(struct crypto_skcipher *tfm) + if (IS_ERR(ctx->queue)) + return PTR_ERR(ctx->queue); + +- mutex_init(&ctx->queue->queuelock); ++ spin_lock_init(&ctx->queue->queuelock); + ctx->queue->havesoftqueue = false; + + return 0; +diff --git a/drivers/crypto/hisilicon/sec/sec_drv.h b/drivers/crypto/hisilicon/sec/sec_drv.h +index 4d9063a8b10b1..0bf4d7c3856ca 100644 +--- a/drivers/crypto/hisilicon/sec/sec_drv.h ++++ b/drivers/crypto/hisilicon/sec/sec_drv.h +@@ -347,7 +347,7 @@ struct sec_queue { + DECLARE_BITMAP(unprocessed, SEC_QUEUE_LEN); + DECLARE_KFIFO_PTR(softqueue, typeof(struct sec_request_el *)); + bool havesoftqueue; +- struct mutex queuelock; ++ spinlock_t queuelock; + void *shadow[SEC_QUEUE_LEN]; + }; + +diff --git a/drivers/crypto/inside-secure/safexcel.c b/drivers/crypto/inside-secure/safexcel.c +index 4d9d97c59ee36..9534f52210af0 100644 +--- a/drivers/crypto/inside-secure/safexcel.c ++++ b/drivers/crypto/inside-secure/safexcel.c +@@ -1658,6 +1658,8 @@ static const struct of_device_id safexcel_of_match_table[] = { + {}, + }; + ++MODULE_DEVICE_TABLE(of, safexcel_of_match_table); ++ + static struct platform_driver crypto_safexcel = { + .probe = safexcel_probe, + .remove = safexcel_remove, +diff --git a/drivers/dma/sprd-dma.c b/drivers/dma/sprd-dma.c +index b966115bfad1d..4f0c501063210 100644 +--- a/drivers/dma/sprd-dma.c ++++ b/drivers/dma/sprd-dma.c +@@ -1201,11 +1201,8 @@ static int sprd_dma_remove(struct platform_device *pdev) + { + struct sprd_dma_dev *sdev = platform_get_drvdata(pdev); + struct sprd_dma_chn *c, *cn; +- int ret; + +- ret = pm_runtime_get_sync(&pdev->dev); +- if (ret < 0) +- return ret; ++ pm_runtime_get_sync(&pdev->dev); + + /* explicitly free the irq */ + if (sdev->irq > 0) +diff --git a/drivers/firmware/arm_scpi.c b/drivers/firmware/arm_scpi.c +index e2995ec144010..72634e9d81169 100644 +--- a/drivers/firmware/arm_scpi.c ++++ b/drivers/firmware/arm_scpi.c +@@ -815,7 +815,7 @@ static int scpi_init_versions(struct scpi_drvinfo *info) + info->firmware_version = le32_to_cpu(caps.platform_version); + } + /* Ignore error if not implemented */ +- if (scpi_info->is_legacy && ret == -EOPNOTSUPP) ++ if (info->is_legacy && ret == -EOPNOTSUPP) + return 0; + + return ret; +@@ -905,13 +905,14 @@ static int scpi_probe(struct platform_device *pdev) + struct resource res; + struct device *dev = &pdev->dev; + struct device_node *np = dev->of_node; ++ struct scpi_drvinfo *scpi_drvinfo; + +- scpi_info = devm_kzalloc(dev, sizeof(*scpi_info), GFP_KERNEL); +- if (!scpi_info) ++ scpi_drvinfo = devm_kzalloc(dev, sizeof(*scpi_drvinfo), GFP_KERNEL); ++ if (!scpi_drvinfo) + return -ENOMEM; + + if (of_match_device(legacy_scpi_of_match, &pdev->dev)) +- scpi_info->is_legacy = true; ++ scpi_drvinfo->is_legacy = true; + + count = of_count_phandle_with_args(np, "mboxes", "#mbox-cells"); + if (count < 0) { +@@ -919,19 +920,19 @@ static int scpi_probe(struct platform_device *pdev) + return -ENODEV; + } + +- scpi_info->channels = devm_kcalloc(dev, count, sizeof(struct scpi_chan), +- GFP_KERNEL); +- if (!scpi_info->channels) ++ scpi_drvinfo->channels = ++ devm_kcalloc(dev, count, sizeof(struct scpi_chan), GFP_KERNEL); ++ if (!scpi_drvinfo->channels) + return -ENOMEM; + +- ret = devm_add_action(dev, scpi_free_channels, scpi_info); ++ ret = devm_add_action(dev, scpi_free_channels, scpi_drvinfo); + if (ret) + return ret; + +- for (; scpi_info->num_chans < count; scpi_info->num_chans++) { ++ for (; scpi_drvinfo->num_chans < count; scpi_drvinfo->num_chans++) { + resource_size_t size; +- int idx = scpi_info->num_chans; +- struct scpi_chan *pchan = scpi_info->channels + idx; ++ int idx = scpi_drvinfo->num_chans; ++ struct scpi_chan *pchan = scpi_drvinfo->channels + idx; + struct mbox_client *cl = &pchan->cl; + struct device_node *shmem = of_parse_phandle(np, "shmem", idx); + +@@ -975,45 +976,53 @@ static int scpi_probe(struct platform_device *pdev) + return ret; + } + +- scpi_info->commands = scpi_std_commands; ++ scpi_drvinfo->commands = scpi_std_commands; + +- platform_set_drvdata(pdev, scpi_info); ++ platform_set_drvdata(pdev, scpi_drvinfo); + +- if (scpi_info->is_legacy) { ++ if (scpi_drvinfo->is_legacy) { + /* Replace with legacy variants */ + scpi_ops.clk_set_val = legacy_scpi_clk_set_val; +- scpi_info->commands = scpi_legacy_commands; ++ scpi_drvinfo->commands = scpi_legacy_commands; + + /* Fill priority bitmap */ + for (idx = 0; idx < ARRAY_SIZE(legacy_hpriority_cmds); idx++) + set_bit(legacy_hpriority_cmds[idx], +- scpi_info->cmd_priority); ++ scpi_drvinfo->cmd_priority); + } + +- ret = scpi_init_versions(scpi_info); ++ scpi_info = scpi_drvinfo; ++ ++ ret = scpi_init_versions(scpi_drvinfo); + if (ret) { + dev_err(dev, "incorrect or no SCP firmware found\n"); ++ scpi_info = NULL; + return ret; + } + +- if (scpi_info->is_legacy && !scpi_info->protocol_version && +- !scpi_info->firmware_version) ++ if (scpi_drvinfo->is_legacy && !scpi_drvinfo->protocol_version && ++ !scpi_drvinfo->firmware_version) + dev_info(dev, "SCP Protocol legacy pre-1.0 firmware\n"); + else + dev_info(dev, "SCP Protocol %lu.%lu Firmware %lu.%lu.%lu version\n", + FIELD_GET(PROTO_REV_MAJOR_MASK, +- scpi_info->protocol_version), ++ scpi_drvinfo->protocol_version), + FIELD_GET(PROTO_REV_MINOR_MASK, +- scpi_info->protocol_version), ++ scpi_drvinfo->protocol_version), + FIELD_GET(FW_REV_MAJOR_MASK, +- scpi_info->firmware_version), ++ scpi_drvinfo->firmware_version), + FIELD_GET(FW_REV_MINOR_MASK, +- scpi_info->firmware_version), ++ scpi_drvinfo->firmware_version), + FIELD_GET(FW_REV_PATCH_MASK, +- scpi_info->firmware_version)); +- scpi_info->scpi_ops = &scpi_ops; ++ scpi_drvinfo->firmware_version)); ++ ++ scpi_drvinfo->scpi_ops = &scpi_ops; + +- return devm_of_platform_populate(dev); ++ ret = devm_of_platform_populate(dev); ++ if (ret) ++ scpi_info = NULL; ++ ++ return ret; + } + + static const struct of_device_id scpi_of_match[] = { +diff --git a/drivers/fpga/altera-pr-ip-core.c b/drivers/fpga/altera-pr-ip-core.c +index 2cf25fd5e8979..75b4b3ec933a5 100644 +--- a/drivers/fpga/altera-pr-ip-core.c ++++ b/drivers/fpga/altera-pr-ip-core.c +@@ -108,7 +108,7 @@ static int alt_pr_fpga_write(struct fpga_manager *mgr, const char *buf, + u32 *buffer_32 = (u32 *)buf; + size_t i = 0; + +- if (count <= 0) ++ if (!count) + return -EINVAL; + + /* Write out the complete 32-bit chunks */ +diff --git a/drivers/gpio/gpiolib-of.c b/drivers/gpio/gpiolib-of.c +index b1dcd2dd52e6b..73807c897391c 100644 +--- a/drivers/gpio/gpiolib-of.c ++++ b/drivers/gpio/gpiolib-of.c +@@ -734,7 +734,8 @@ int of_mm_gpiochip_add_data(struct device_node *np, + if (mm_gc->save_regs) + mm_gc->save_regs(mm_gc); + +- mm_gc->gc.of_node = np; ++ of_node_put(mm_gc->gc.of_node); ++ mm_gc->gc.of_node = of_node_get(np); + + ret = gpiochip_add_data(gc, data); + if (ret) +@@ -742,6 +743,7 @@ int of_mm_gpiochip_add_data(struct device_node *np, + + return 0; + err2: ++ of_node_put(np); + iounmap(mm_gc->regs); + err1: + kfree(gc->label); +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c +index 4cc0dd494a42b..fc508927c6f60 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c +@@ -892,6 +892,10 @@ int amdgpu_bo_pin_restricted(struct amdgpu_bo *bo, u32 domain, + if (WARN_ON_ONCE(min_offset > max_offset)) + return -EINVAL; + ++ /* Check domain to be pinned to against preferred domains */ ++ if (bo->preferred_domains & domain) ++ domain = bo->preferred_domains & domain; ++ + /* A shared bo cannot be migrated to VRAM */ + if (bo->prime_shared_count) { + if (domain & AMDGPU_GEM_DOMAIN_GTT) +diff --git a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c +index e7bf32f234d71..62ef603627b77 100644 +--- a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c ++++ b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c +@@ -985,6 +985,10 @@ static int adv7511_init_cec_regmap(struct adv7511 *adv) + ADV7511_CEC_I2C_ADDR_DEFAULT); + if (IS_ERR(adv->i2c_cec)) + return PTR_ERR(adv->i2c_cec); ++ ++ regmap_write(adv->regmap, ADV7511_REG_CEC_I2C_ADDR, ++ adv->i2c_cec->addr << 1); ++ + i2c_set_clientdata(adv->i2c_cec, adv); + + adv->regmap_cec = devm_regmap_init_i2c(adv->i2c_cec, +@@ -1189,9 +1193,6 @@ static int adv7511_probe(struct i2c_client *i2c, const struct i2c_device_id *id) + if (ret) + goto err_i2c_unregister_packet; + +- regmap_write(adv7511->regmap, ADV7511_REG_CEC_I2C_ADDR, +- adv7511->i2c_cec->addr << 1); +- + INIT_WORK(&adv7511->hpd_work, adv7511_hpd_work); + + if (i2c->irq) { +@@ -1301,10 +1302,21 @@ static struct i2c_driver adv7511_driver = { + + static int __init adv7511_init(void) + { +- if (IS_ENABLED(CONFIG_DRM_MIPI_DSI)) +- mipi_dsi_driver_register(&adv7533_dsi_driver); ++ int ret; + +- return i2c_add_driver(&adv7511_driver); ++ if (IS_ENABLED(CONFIG_DRM_MIPI_DSI)) { ++ ret = mipi_dsi_driver_register(&adv7533_dsi_driver); ++ if (ret) ++ return ret; ++ } ++ ++ ret = i2c_add_driver(&adv7511_driver); ++ if (ret) { ++ if (IS_ENABLED(CONFIG_DRM_MIPI_DSI)) ++ mipi_dsi_driver_unregister(&adv7533_dsi_driver); ++ } ++ ++ return ret; + } + module_init(adv7511_init); + +diff --git a/drivers/gpu/drm/bridge/sil-sii8620.c b/drivers/gpu/drm/bridge/sil-sii8620.c +index fb0b64c965b74..970bc00d2aaf6 100644 +--- a/drivers/gpu/drm/bridge/sil-sii8620.c ++++ b/drivers/gpu/drm/bridge/sil-sii8620.c +@@ -604,7 +604,7 @@ static void *sii8620_burst_get_tx_buf(struct sii8620 *ctx, int len) + u8 *buf = &ctx->burst.tx_buf[ctx->burst.tx_count]; + int size = len + 2; + +- if (ctx->burst.tx_count + size > ARRAY_SIZE(ctx->burst.tx_buf)) { ++ if (ctx->burst.tx_count + size >= ARRAY_SIZE(ctx->burst.tx_buf)) { + dev_err(ctx->dev, "TX-BLK buffer exhausted\n"); + ctx->error = -EINVAL; + return NULL; +@@ -621,7 +621,7 @@ static u8 *sii8620_burst_get_rx_buf(struct sii8620 *ctx, int len) + u8 *buf = &ctx->burst.rx_buf[ctx->burst.rx_count]; + int size = len + 1; + +- if (ctx->burst.tx_count + size > ARRAY_SIZE(ctx->burst.tx_buf)) { ++ if (ctx->burst.rx_count + size >= ARRAY_SIZE(ctx->burst.rx_buf)) { + dev_err(ctx->dev, "RX-BLK buffer exhausted\n"); + ctx->error = -EINVAL; + return NULL; +diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c +index 1fdc85a71cec4..25a2d80287d67 100644 +--- a/drivers/gpu/drm/drm_gem.c ++++ b/drivers/gpu/drm/drm_gem.c +@@ -1292,7 +1292,7 @@ retry: + ret = dma_resv_lock_slow_interruptible(obj->resv, + acquire_ctx); + if (ret) { +- ww_acquire_done(acquire_ctx); ++ ww_acquire_fini(acquire_ctx); + return ret; + } + } +@@ -1317,7 +1317,7 @@ retry: + goto retry; + } + +- ww_acquire_done(acquire_ctx); ++ ww_acquire_fini(acquire_ctx); + return ret; + } + } +diff --git a/drivers/gpu/drm/drm_mipi_dbi.c b/drivers/gpu/drm/drm_mipi_dbi.c +index 4042f5b397657..2a7ef1051b397 100644 +--- a/drivers/gpu/drm/drm_mipi_dbi.c ++++ b/drivers/gpu/drm/drm_mipi_dbi.c +@@ -1156,6 +1156,13 @@ int mipi_dbi_spi_transfer(struct spi_device *spi, u32 speed_hz, + size_t chunk; + int ret; + ++ /* In __spi_validate, there's a validation that no partial transfers ++ * are accepted (xfer->len % w_size must be zero). ++ * Here we align max_chunk to multiple of 2 (16bits), ++ * to prevent transfers from being rejected. ++ */ ++ max_chunk = ALIGN_DOWN(max_chunk, 2); ++ + spi_message_init_with_transfers(&m, &tr, 1); + + while (len) { +diff --git a/drivers/gpu/drm/exynos/exynos7_drm_decon.c b/drivers/gpu/drm/exynos/exynos7_drm_decon.c +index 6fd40410dfd2e..afca5fc460200 100644 +--- a/drivers/gpu/drm/exynos/exynos7_drm_decon.c ++++ b/drivers/gpu/drm/exynos/exynos7_drm_decon.c +@@ -800,31 +800,40 @@ static int exynos7_decon_resume(struct device *dev) + if (ret < 0) { + DRM_DEV_ERROR(dev, "Failed to prepare_enable the pclk [%d]\n", + ret); +- return ret; ++ goto err_pclk_enable; + } + + ret = clk_prepare_enable(ctx->aclk); + if (ret < 0) { + DRM_DEV_ERROR(dev, "Failed to prepare_enable the aclk [%d]\n", + ret); +- return ret; ++ goto err_aclk_enable; + } + + ret = clk_prepare_enable(ctx->eclk); + if (ret < 0) { + DRM_DEV_ERROR(dev, "Failed to prepare_enable the eclk [%d]\n", + ret); +- return ret; ++ goto err_eclk_enable; + } + + ret = clk_prepare_enable(ctx->vclk); + if (ret < 0) { + DRM_DEV_ERROR(dev, "Failed to prepare_enable the vclk [%d]\n", + ret); +- return ret; ++ goto err_vclk_enable; + } + + return 0; ++ ++err_vclk_enable: ++ clk_disable_unprepare(ctx->eclk); ++err_eclk_enable: ++ clk_disable_unprepare(ctx->aclk); ++err_aclk_enable: ++ clk_disable_unprepare(ctx->pclk); ++err_pclk_enable: ++ return ret; + } + #endif + +diff --git a/drivers/gpu/drm/mcde/mcde_dsi.c b/drivers/gpu/drm/mcde/mcde_dsi.c +index 8c8c92fc82e97..a580b9cadb0cf 100644 +--- a/drivers/gpu/drm/mcde/mcde_dsi.c ++++ b/drivers/gpu/drm/mcde/mcde_dsi.c +@@ -942,6 +942,7 @@ static int mcde_dsi_bind(struct device *dev, struct device *master, + bridge = of_drm_find_bridge(child); + if (!bridge) { + dev_err(dev, "failed to find bridge\n"); ++ of_node_put(child); + return -EINVAL; + } + } +diff --git a/drivers/gpu/drm/mediatek/mtk_dpi.c b/drivers/gpu/drm/mediatek/mtk_dpi.c +index 48de07e9059e2..4a64d8aed9da9 100644 +--- a/drivers/gpu/drm/mediatek/mtk_dpi.c ++++ b/drivers/gpu/drm/mediatek/mtk_dpi.c +@@ -50,13 +50,7 @@ enum mtk_dpi_out_channel_swap { + }; + + enum mtk_dpi_out_color_format { +- MTK_DPI_COLOR_FORMAT_RGB, +- MTK_DPI_COLOR_FORMAT_RGB_FULL, +- MTK_DPI_COLOR_FORMAT_YCBCR_444, +- MTK_DPI_COLOR_FORMAT_YCBCR_422, +- MTK_DPI_COLOR_FORMAT_XV_YCC, +- MTK_DPI_COLOR_FORMAT_YCBCR_444_FULL, +- MTK_DPI_COLOR_FORMAT_YCBCR_422_FULL ++ MTK_DPI_COLOR_FORMAT_RGB + }; + + struct mtk_dpi { +@@ -355,24 +349,11 @@ static void mtk_dpi_config_disable_edge(struct mtk_dpi *dpi) + static void mtk_dpi_config_color_format(struct mtk_dpi *dpi, + enum mtk_dpi_out_color_format format) + { +- if ((format == MTK_DPI_COLOR_FORMAT_YCBCR_444) || +- (format == MTK_DPI_COLOR_FORMAT_YCBCR_444_FULL)) { +- mtk_dpi_config_yuv422_enable(dpi, false); +- mtk_dpi_config_csc_enable(dpi, true); +- mtk_dpi_config_swap_input(dpi, false); +- mtk_dpi_config_channel_swap(dpi, MTK_DPI_OUT_CHANNEL_SWAP_BGR); +- } else if ((format == MTK_DPI_COLOR_FORMAT_YCBCR_422) || +- (format == MTK_DPI_COLOR_FORMAT_YCBCR_422_FULL)) { +- mtk_dpi_config_yuv422_enable(dpi, true); +- mtk_dpi_config_csc_enable(dpi, true); +- mtk_dpi_config_swap_input(dpi, true); +- mtk_dpi_config_channel_swap(dpi, MTK_DPI_OUT_CHANNEL_SWAP_RGB); +- } else { +- mtk_dpi_config_yuv422_enable(dpi, false); +- mtk_dpi_config_csc_enable(dpi, false); +- mtk_dpi_config_swap_input(dpi, false); +- mtk_dpi_config_channel_swap(dpi, MTK_DPI_OUT_CHANNEL_SWAP_RGB); +- } ++ /* only support RGB888 */ ++ mtk_dpi_config_yuv422_enable(dpi, false); ++ mtk_dpi_config_csc_enable(dpi, false); ++ mtk_dpi_config_swap_input(dpi, false); ++ mtk_dpi_config_channel_swap(dpi, MTK_DPI_OUT_CHANNEL_SWAP_RGB); + } + + static void mtk_dpi_power_off(struct mtk_dpi *dpi) +@@ -413,7 +394,6 @@ static int mtk_dpi_power_on(struct mtk_dpi *dpi) + if (dpi->pinctrl && dpi->pins_dpi) + pinctrl_select_state(dpi->pinctrl, dpi->pins_dpi); + +- mtk_dpi_enable(dpi); + return 0; + + err_pixel: +@@ -557,6 +537,7 @@ static void mtk_dpi_encoder_enable(struct drm_encoder *encoder) + + mtk_dpi_power_on(dpi); + mtk_dpi_set_display_mode(dpi, &dpi->mode); ++ mtk_dpi_enable(dpi); + } + + static int mtk_dpi_atomic_check(struct drm_encoder *encoder, +diff --git a/drivers/gpu/drm/mediatek/mtk_dsi.c b/drivers/gpu/drm/mediatek/mtk_dsi.c +index 224afb666881c..e82705a33acfd 100644 +--- a/drivers/gpu/drm/mediatek/mtk_dsi.c ++++ b/drivers/gpu/drm/mediatek/mtk_dsi.c +@@ -645,6 +645,8 @@ static void mtk_dsi_poweroff(struct mtk_dsi *dsi) + mtk_dsi_reset_engine(dsi); + mtk_dsi_lane0_ulp_mode_enter(dsi); + mtk_dsi_clk_ulp_mode_enter(dsi); ++ /* set the lane number as 0 to pull down mipi */ ++ writel(0, dsi->regs + DSI_TXRX_CTRL); + + mtk_dsi_disable(dsi); + +diff --git a/drivers/gpu/drm/meson/meson_drv.c b/drivers/gpu/drm/meson/meson_drv.c +index 61a6536e7e61a..9a39afc3939bc 100644 +--- a/drivers/gpu/drm/meson/meson_drv.c ++++ b/drivers/gpu/drm/meson/meson_drv.c +@@ -124,8 +124,11 @@ static bool meson_vpu_has_available_connectors(struct device *dev) + for_each_endpoint_of_node(dev->of_node, ep) { + /* If the endpoint node exists, consider it enabled */ + remote = of_graph_get_remote_port(ep); +- if (remote) ++ if (remote) { ++ of_node_put(remote); ++ of_node_put(ep); + return true; ++ } + } + + return false; +diff --git a/drivers/gpu/drm/meson/meson_viu.c b/drivers/gpu/drm/meson/meson_viu.c +index 33698814c022f..9991f0a43b1ab 100644 +--- a/drivers/gpu/drm/meson/meson_viu.c ++++ b/drivers/gpu/drm/meson/meson_viu.c +@@ -400,17 +400,17 @@ void meson_viu_init(struct meson_drm *priv) + priv->io_base + _REG(VD2_IF0_LUMA_FIFO_SIZE)); + + if (meson_vpu_is_compatible(priv, VPU_COMPATIBLE_G12A)) { +- writel_relaxed(VIU_OSD_BLEND_REORDER(0, 1) | +- VIU_OSD_BLEND_REORDER(1, 0) | +- VIU_OSD_BLEND_REORDER(2, 0) | +- VIU_OSD_BLEND_REORDER(3, 0) | +- VIU_OSD_BLEND_DIN_EN(1) | +- VIU_OSD_BLEND1_DIN3_BYPASS_TO_DOUT1 | +- VIU_OSD_BLEND1_DOUT_BYPASS_TO_BLEND2 | +- VIU_OSD_BLEND_DIN0_BYPASS_TO_DOUT0 | +- VIU_OSD_BLEND_BLEN2_PREMULT_EN(1) | +- VIU_OSD_BLEND_HOLD_LINES(4), +- priv->io_base + _REG(VIU_OSD_BLEND_CTRL)); ++ u32 val = (u32)VIU_OSD_BLEND_REORDER(0, 1) | ++ (u32)VIU_OSD_BLEND_REORDER(1, 0) | ++ (u32)VIU_OSD_BLEND_REORDER(2, 0) | ++ (u32)VIU_OSD_BLEND_REORDER(3, 0) | ++ (u32)VIU_OSD_BLEND_DIN_EN(1) | ++ (u32)VIU_OSD_BLEND1_DIN3_BYPASS_TO_DOUT1 | ++ (u32)VIU_OSD_BLEND1_DOUT_BYPASS_TO_BLEND2 | ++ (u32)VIU_OSD_BLEND_DIN0_BYPASS_TO_DOUT0 | ++ (u32)VIU_OSD_BLEND_BLEN2_PREMULT_EN(1) | ++ (u32)VIU_OSD_BLEND_HOLD_LINES(4); ++ writel_relaxed(val, priv->io_base + _REG(VIU_OSD_BLEND_CTRL)); + + writel_relaxed(OSD_BLEND_PATH_SEL_ENABLE, + priv->io_base + _REG(OSD1_BLEND_SRC_CTRL)); +diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c +index a4f5cb90f3e80..e4b8a789835a4 100644 +--- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c ++++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c +@@ -123,12 +123,13 @@ int mdp5_pipe_release(struct drm_atomic_state *s, struct mdp5_hw_pipe *hwpipe) + { + struct msm_drm_private *priv = s->dev->dev_private; + struct mdp5_kms *mdp5_kms = to_mdp5_kms(to_mdp_kms(priv->kms)); +- struct mdp5_global_state *state = mdp5_get_global_state(s); ++ struct mdp5_global_state *state; + struct mdp5_hw_pipe_state *new_state; + + if (!hwpipe) + return 0; + ++ state = mdp5_get_global_state(s); + if (IS_ERR(state)) + return PTR_ERR(state); + +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/base.c b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/base.c +index 8bff14ae16b0e..f0368d9a0154d 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/base.c ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/base.c +@@ -33,7 +33,7 @@ nvbios_addr(struct nvkm_bios *bios, u32 *addr, u8 size) + { + u32 p = *addr; + +- if (*addr > bios->image0_size && bios->imaged_addr) { ++ if (*addr >= bios->image0_size && bios->imaged_addr) { + *addr -= bios->image0_size; + *addr += bios->imaged_addr; + } +diff --git a/drivers/gpu/drm/radeon/ni_dpm.c b/drivers/gpu/drm/radeon/ni_dpm.c +index bd2e577c701f2..288ec3039bc2c 100644 +--- a/drivers/gpu/drm/radeon/ni_dpm.c ++++ b/drivers/gpu/drm/radeon/ni_dpm.c +@@ -2740,10 +2740,10 @@ static int ni_set_mc_special_registers(struct radeon_device *rdev, + table->mc_reg_table_entry[k].mc_data[j] |= 0x100; + } + j++; +- if (j > SMC_NISLANDS_MC_REGISTER_ARRAY_SIZE) +- return -EINVAL; + break; + case MC_SEQ_RESERVE_M >> 2: ++ if (j >= SMC_NISLANDS_MC_REGISTER_ARRAY_SIZE) ++ return -EINVAL; + temp_reg = RREG32(MC_PMG_CMD_MRS1); + table->mc_reg_address[j].s1 = MC_PMG_CMD_MRS1 >> 2; + table->mc_reg_address[j].s0 = MC_SEQ_PMG_CMD_MRS1_LP >> 2; +@@ -2752,8 +2752,6 @@ static int ni_set_mc_special_registers(struct radeon_device *rdev, + (temp_reg & 0xffff0000) | + (table->mc_reg_table_entry[k].mc_data[i] & 0x0000ffff); + j++; +- if (j > SMC_NISLANDS_MC_REGISTER_ARRAY_SIZE) +- return -EINVAL; + break; + default: + break; +diff --git a/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c b/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c +index ce98c08aa8b44..48281e29b5d45 100644 +--- a/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c ++++ b/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c +@@ -401,7 +401,15 @@ static int rockchip_dp_probe(struct platform_device *pdev) + if (IS_ERR(dp->adp)) + return PTR_ERR(dp->adp); + +- return component_add(dev, &rockchip_dp_component_ops); ++ ret = component_add(dev, &rockchip_dp_component_ops); ++ if (ret) ++ goto err_dp_remove; ++ ++ return 0; ++ ++err_dp_remove: ++ analogix_dp_remove(dp->adp); ++ return ret; + } + + static int rockchip_dp_remove(struct platform_device *pdev) +diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c +index 2e4e1933a43c1..57e0396662c34 100644 +--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c ++++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c +@@ -1288,6 +1288,9 @@ static struct drm_crtc_state *vop_crtc_duplicate_state(struct drm_crtc *crtc) + { + struct rockchip_crtc_state *rockchip_state; + ++ if (WARN_ON(!crtc->state)) ++ return NULL; ++ + rockchip_state = kzalloc(sizeof(*rockchip_state), GFP_KERNEL); + if (!rockchip_state) + return NULL; +diff --git a/drivers/gpu/drm/vc4/vc4_dsi.c b/drivers/gpu/drm/vc4/vc4_dsi.c +index 0983949cc8c98..e249ab378700e 100644 +--- a/drivers/gpu/drm/vc4/vc4_dsi.c ++++ b/drivers/gpu/drm/vc4/vc4_dsi.c +@@ -791,11 +791,9 @@ static bool vc4_dsi_encoder_mode_fixup(struct drm_encoder *encoder, + /* Find what divider gets us a faster clock than the requested + * pixel clock. + */ +- for (divider = 1; divider < 8; divider++) { +- if (parent_rate / divider < pll_clock) { +- divider--; ++ for (divider = 1; divider < 255; divider++) { ++ if (parent_rate / (divider + 1) < pll_clock) + break; +- } + } + + /* Now that we've picked a PLL divider, calculate back to its +diff --git a/drivers/gpu/drm/vc4/vc4_plane.c b/drivers/gpu/drm/vc4/vc4_plane.c +index 363f456ea7134..cdcd19698b3c5 100644 +--- a/drivers/gpu/drm/vc4/vc4_plane.c ++++ b/drivers/gpu/drm/vc4/vc4_plane.c +@@ -288,16 +288,16 @@ static int vc4_plane_margins_adj(struct drm_plane_state *pstate) + adjhdisplay, + crtc_state->mode.hdisplay); + vc4_pstate->crtc_x += left; +- if (vc4_pstate->crtc_x > crtc_state->mode.hdisplay - left) +- vc4_pstate->crtc_x = crtc_state->mode.hdisplay - left; ++ if (vc4_pstate->crtc_x > crtc_state->mode.hdisplay - right) ++ vc4_pstate->crtc_x = crtc_state->mode.hdisplay - right; + + adjvdisplay = crtc_state->mode.vdisplay - (top + bottom); + vc4_pstate->crtc_y = DIV_ROUND_CLOSEST(vc4_pstate->crtc_y * + adjvdisplay, + crtc_state->mode.vdisplay); + vc4_pstate->crtc_y += top; +- if (vc4_pstate->crtc_y > crtc_state->mode.vdisplay - top) +- vc4_pstate->crtc_y = crtc_state->mode.vdisplay - top; ++ if (vc4_pstate->crtc_y > crtc_state->mode.vdisplay - bottom) ++ vc4_pstate->crtc_y = crtc_state->mode.vdisplay - bottom; + + vc4_pstate->crtc_w = DIV_ROUND_CLOSEST(vc4_pstate->crtc_w * + adjhdisplay, +@@ -317,7 +317,6 @@ static int vc4_plane_setup_clipping_and_scaling(struct drm_plane_state *state) + struct vc4_plane_state *vc4_state = to_vc4_plane_state(state); + struct drm_framebuffer *fb = state->fb; + struct drm_gem_cma_object *bo = drm_fb_cma_get_gem_obj(fb, 0); +- u32 subpixel_src_mask = (1 << 16) - 1; + int num_planes = fb->format->num_planes; + struct drm_crtc_state *crtc_state; + u32 h_subsample = fb->format->hsub; +@@ -339,18 +338,15 @@ static int vc4_plane_setup_clipping_and_scaling(struct drm_plane_state *state) + for (i = 0; i < num_planes; i++) + vc4_state->offsets[i] = bo->paddr + fb->offsets[i]; + +- /* We don't support subpixel source positioning for scaling. */ +- if ((state->src.x1 & subpixel_src_mask) || +- (state->src.x2 & subpixel_src_mask) || +- (state->src.y1 & subpixel_src_mask) || +- (state->src.y2 & subpixel_src_mask)) { +- return -EINVAL; +- } +- +- vc4_state->src_x = state->src.x1 >> 16; +- vc4_state->src_y = state->src.y1 >> 16; +- vc4_state->src_w[0] = (state->src.x2 - state->src.x1) >> 16; +- vc4_state->src_h[0] = (state->src.y2 - state->src.y1) >> 16; ++ /* ++ * We don't support subpixel source positioning for scaling, ++ * but fractional coordinates can be generated by clipping ++ * so just round for now ++ */ ++ vc4_state->src_x = DIV_ROUND_CLOSEST(state->src.x1, 1 << 16); ++ vc4_state->src_y = DIV_ROUND_CLOSEST(state->src.y1, 1 << 16); ++ vc4_state->src_w[0] = DIV_ROUND_CLOSEST(state->src.x2, 1 << 16) - vc4_state->src_x; ++ vc4_state->src_h[0] = DIV_ROUND_CLOSEST(state->src.y2, 1 << 16) - vc4_state->src_y; + + vc4_state->crtc_x = state->dst.x1; + vc4_state->crtc_y = state->dst.y1; +diff --git a/drivers/hid/hid-alps.c b/drivers/hid/hid-alps.c +index 2477b2a3f7c3a..464a48906d01f 100644 +--- a/drivers/hid/hid-alps.c ++++ b/drivers/hid/hid-alps.c +@@ -831,6 +831,8 @@ static const struct hid_device_id alps_id[] = { + USB_VENDOR_ID_ALPS_JP, HID_DEVICE_ID_ALPS_U1_DUAL) }, + { HID_DEVICE(HID_BUS_ANY, HID_GROUP_ANY, + USB_VENDOR_ID_ALPS_JP, HID_DEVICE_ID_ALPS_U1) }, ++ { HID_DEVICE(HID_BUS_ANY, HID_GROUP_ANY, ++ USB_VENDOR_ID_ALPS_JP, HID_DEVICE_ID_ALPS_U1_UNICORN_LEGACY) }, + { HID_DEVICE(HID_BUS_ANY, HID_GROUP_ANY, + USB_VENDOR_ID_ALPS_JP, HID_DEVICE_ID_ALPS_T4_BTNLESS) }, + { } +diff --git a/drivers/hid/hid-cp2112.c b/drivers/hid/hid-cp2112.c +index db1b55df0d131..340408f8c8ab2 100644 +--- a/drivers/hid/hid-cp2112.c ++++ b/drivers/hid/hid-cp2112.c +@@ -787,6 +787,11 @@ static int cp2112_xfer(struct i2c_adapter *adap, u16 addr, + data->word = le16_to_cpup((__le16 *)buf); + break; + case I2C_SMBUS_I2C_BLOCK_DATA: ++ if (read_length > I2C_SMBUS_BLOCK_MAX) { ++ ret = -EINVAL; ++ goto power_normal; ++ } ++ + memcpy(data->block + 1, buf, read_length); + break; + case I2C_SMBUS_BLOCK_DATA: +diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c +index 329bb1a46f90e..4dbf69078387f 100644 +--- a/drivers/hid/wacom_sys.c ++++ b/drivers/hid/wacom_sys.c +@@ -2124,7 +2124,7 @@ static int wacom_register_inputs(struct wacom *wacom) + + error = wacom_setup_pad_input_capabilities(pad_input_dev, wacom_wac); + if (error) { +- /* no pad in use on this interface */ ++ /* no pad events using this interface */ + input_free_device(pad_input_dev); + wacom_wac->pad_input = NULL; + pad_input_dev = NULL; +diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c +index de69ea5f5a4be..c3dff7501af28 100644 +--- a/drivers/hid/wacom_wac.c ++++ b/drivers/hid/wacom_wac.c +@@ -638,9 +638,26 @@ static int wacom_intuos_id_mangle(int tool_id) + return (tool_id & ~0xFFF) << 4 | (tool_id & 0xFFF); + } + ++static bool wacom_is_art_pen(int tool_id) ++{ ++ bool is_art_pen = false; ++ ++ switch (tool_id) { ++ case 0x885: /* Intuos3 Marker Pen */ ++ case 0x804: /* Intuos4/5 13HD/24HD Marker Pen */ ++ case 0x10804: /* Intuos4/5 13HD/24HD Art Pen */ ++ is_art_pen = true; ++ break; ++ } ++ return is_art_pen; ++} ++ + static int wacom_intuos_get_tool_type(int tool_id) + { +- int tool_type; ++ int tool_type = BTN_TOOL_PEN; ++ ++ if (wacom_is_art_pen(tool_id)) ++ return tool_type; + + switch (tool_id) { + case 0x812: /* Inking pen */ +@@ -655,12 +672,9 @@ static int wacom_intuos_get_tool_type(int tool_id) + case 0x852: + case 0x823: /* Intuos3 Grip Pen */ + case 0x813: /* Intuos3 Classic Pen */ +- case 0x885: /* Intuos3 Marker Pen */ + case 0x802: /* Intuos4/5 13HD/24HD General Pen */ +- case 0x804: /* Intuos4/5 13HD/24HD Marker Pen */ + case 0x8e2: /* IntuosHT2 pen */ + case 0x022: +- case 0x10804: /* Intuos4/5 13HD/24HD Art Pen */ + case 0x10842: /* MobileStudio Pro Pro Pen slim */ + case 0x14802: /* Intuos4/5 13HD/24HD Classic Pen */ + case 0x16802: /* Cintiq 13HD Pro Pen */ +@@ -718,10 +732,6 @@ static int wacom_intuos_get_tool_type(int tool_id) + case 0x10902: /* Intuos4/5 13HD/24HD Airbrush */ + tool_type = BTN_TOOL_AIRBRUSH; + break; +- +- default: /* Unknown tool */ +- tool_type = BTN_TOOL_PEN; +- break; + } + return tool_type; + } +@@ -2006,7 +2016,6 @@ static void wacom_wac_pad_usage_mapping(struct hid_device *hdev, + wacom_wac->has_mute_touch_switch = true; + usage->type = EV_SW; + usage->code = SW_MUTE_DEVICE; +- features->device_type |= WACOM_DEVICETYPE_PAD; + break; + case WACOM_HID_WD_TOUCHSTRIP: + wacom_map_usage(input, usage, field, EV_ABS, ABS_RX, 0); +@@ -2086,6 +2095,30 @@ static void wacom_wac_pad_event(struct hid_device *hdev, struct hid_field *field + wacom_wac->hid_data.inrange_state |= value; + } + ++ /* Process touch switch state first since it is reported through touch interface, ++ * which is indepentent of pad interface. In the case when there are no other pad ++ * events, the pad interface will not even be created. ++ */ ++ if ((equivalent_usage == WACOM_HID_WD_MUTE_DEVICE) || ++ (equivalent_usage == WACOM_HID_WD_TOUCHONOFF)) { ++ if (wacom_wac->shared->touch_input) { ++ bool *is_touch_on = &wacom_wac->shared->is_touch_on; ++ ++ if (equivalent_usage == WACOM_HID_WD_MUTE_DEVICE && value) ++ *is_touch_on = !(*is_touch_on); ++ else if (equivalent_usage == WACOM_HID_WD_TOUCHONOFF) ++ *is_touch_on = value; ++ ++ input_report_switch(wacom_wac->shared->touch_input, ++ SW_MUTE_DEVICE, !(*is_touch_on)); ++ input_sync(wacom_wac->shared->touch_input); ++ } ++ return; ++ } ++ ++ if (!input) ++ return; ++ + switch (equivalent_usage) { + case WACOM_HID_WD_TOUCHRING: + /* +@@ -2121,22 +2154,6 @@ static void wacom_wac_pad_event(struct hid_device *hdev, struct hid_field *field + input_event(input, usage->type, usage->code, 0); + break; + +- case WACOM_HID_WD_MUTE_DEVICE: +- case WACOM_HID_WD_TOUCHONOFF: +- if (wacom_wac->shared->touch_input) { +- bool *is_touch_on = &wacom_wac->shared->is_touch_on; +- +- if (equivalent_usage == WACOM_HID_WD_MUTE_DEVICE && value) +- *is_touch_on = !(*is_touch_on); +- else if (equivalent_usage == WACOM_HID_WD_TOUCHONOFF) +- *is_touch_on = value; +- +- input_report_switch(wacom_wac->shared->touch_input, +- SW_MUTE_DEVICE, !(*is_touch_on)); +- input_sync(wacom_wac->shared->touch_input); +- } +- break; +- + case WACOM_HID_WD_MODE_CHANGE: + if (wacom_wac->is_direct_mode != value) { + wacom_wac->is_direct_mode = value; +@@ -2312,6 +2329,9 @@ static void wacom_wac_pen_event(struct hid_device *hdev, struct hid_field *field + } + return; + case HID_DG_TWIST: ++ /* don't modify the value if the pen doesn't support the feature */ ++ if (!wacom_is_art_pen(wacom_wac->id[0])) return; ++ + /* + * Userspace expects pen twist to have its zero point when + * the buttons/finger is on the tablet's left. HID values +@@ -2763,7 +2783,7 @@ void wacom_wac_event(struct hid_device *hdev, struct hid_field *field, + /* usage tests must precede field tests */ + if (WACOM_BATTERY_USAGE(usage)) + wacom_wac_battery_event(hdev, field, usage, value); +- else if (WACOM_PAD_FIELD(field) && wacom->wacom_wac.pad_input) ++ else if (WACOM_PAD_FIELD(field)) + wacom_wac_pad_event(hdev, field, usage, value); + else if (WACOM_PEN_FIELD(field) && wacom->wacom_wac.pen_input) + wacom_wac_pen_event(hdev, field, usage, value); +diff --git a/drivers/hwtracing/coresight/coresight.c b/drivers/hwtracing/coresight/coresight.c +index 0bbce0d291582..7d64d77d5b7a4 100644 +--- a/drivers/hwtracing/coresight/coresight.c ++++ b/drivers/hwtracing/coresight/coresight.c +@@ -1073,6 +1073,7 @@ static int coresight_remove_match(struct device *dev, void *data) + * platform data. + */ + fwnode_handle_put(conn->child_fwnode); ++ conn->child_fwnode = NULL; + /* No need to continue */ + break; + } +diff --git a/drivers/hwtracing/intel_th/msu-sink.c b/drivers/hwtracing/intel_th/msu-sink.c +index 2c7f5116be126..891b28ea25fe6 100644 +--- a/drivers/hwtracing/intel_th/msu-sink.c ++++ b/drivers/hwtracing/intel_th/msu-sink.c +@@ -71,6 +71,9 @@ static int msu_sink_alloc_window(void *data, struct sg_table **sgt, size_t size) + block = dma_alloc_coherent(priv->dev->parent->parent, + PAGE_SIZE, &sg_dma_address(sg_ptr), + GFP_KERNEL); ++ if (!block) ++ return -ENOMEM; ++ + sg_set_buf(sg_ptr, block, PAGE_SIZE); + } + +diff --git a/drivers/hwtracing/intel_th/msu.c b/drivers/hwtracing/intel_th/msu.c +index 3cd2489d398c5..640b0aae7eb48 100644 +--- a/drivers/hwtracing/intel_th/msu.c ++++ b/drivers/hwtracing/intel_th/msu.c +@@ -1050,6 +1050,16 @@ msc_buffer_set_uc(struct msc_window *win, unsigned int nr_segs) {} + static inline void msc_buffer_set_wb(struct msc_window *win) {} + #endif /* CONFIG_X86 */ + ++static struct page *msc_sg_page(struct scatterlist *sg) ++{ ++ void *addr = sg_virt(sg); ++ ++ if (is_vmalloc_addr(addr)) ++ return vmalloc_to_page(addr); ++ ++ return sg_page(sg); ++} ++ + /** + * msc_buffer_win_alloc() - alloc a window for a multiblock mode + * @msc: MSC device +@@ -1122,7 +1132,7 @@ static void __msc_buffer_win_free(struct msc *msc, struct msc_window *win) + int i; + + for_each_sg(win->sgt->sgl, sg, win->nr_segs, i) { +- struct page *page = sg_page(sg); ++ struct page *page = msc_sg_page(sg); + + page->mapping = NULL; + dma_free_coherent(msc_dev(win->msc)->parent->parent, PAGE_SIZE, +@@ -1384,7 +1394,7 @@ found: + pgoff -= win->pgoff; + + for_each_sg(win->sgt->sgl, sg, win->nr_segs, blk) { +- struct page *page = sg_page(sg); ++ struct page *page = msc_sg_page(sg); + size_t pgsz = PFN_DOWN(sg->length); + + if (pgoff < pgsz) +diff --git a/drivers/hwtracing/intel_th/pci.c b/drivers/hwtracing/intel_th/pci.c +index a723c8c330876..6fcc20e0bc7b9 100644 +--- a/drivers/hwtracing/intel_th/pci.c ++++ b/drivers/hwtracing/intel_th/pci.c +@@ -100,8 +100,10 @@ static int intel_th_pci_probe(struct pci_dev *pdev, + } + + th = intel_th_alloc(&pdev->dev, drvdata, resource, r); +- if (IS_ERR(th)) +- return PTR_ERR(th); ++ if (IS_ERR(th)) { ++ err = PTR_ERR(th); ++ goto err_free_irq; ++ } + + th->activate = intel_th_pci_activate; + th->deactivate = intel_th_pci_deactivate; +@@ -109,6 +111,10 @@ static int intel_th_pci_probe(struct pci_dev *pdev, + pci_set_master(pdev); + + return 0; ++ ++err_free_irq: ++ pci_free_irq_vectors(pdev); ++ return err; + } + + static void intel_th_pci_remove(struct pci_dev *pdev) +@@ -273,6 +279,21 @@ static const struct pci_device_id intel_th_pci_id_table[] = { + PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x54a6), + .driver_data = (kernel_ulong_t)&intel_th_2x, + }, ++ { ++ /* Raptor Lake-S CPU */ ++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xa76f), ++ .driver_data = (kernel_ulong_t)&intel_th_2x, ++ }, ++ { ++ /* Meteor Lake-P */ ++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x7e24), ++ .driver_data = (kernel_ulong_t)&intel_th_2x, ++ }, ++ { ++ /* Raptor Lake-S */ ++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x7a26), ++ .driver_data = (kernel_ulong_t)&intel_th_2x, ++ }, + { + /* Rocket Lake CPU */ + PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x4c19), +diff --git a/drivers/i2c/busses/i2c-cadence.c b/drivers/i2c/busses/i2c-cadence.c +index 8750e444f4492..72699fdd5d113 100644 +--- a/drivers/i2c/busses/i2c-cadence.c ++++ b/drivers/i2c/busses/i2c-cadence.c +@@ -348,8 +348,13 @@ static void cdns_i2c_mrecv(struct cdns_i2c *id) + ctrl_reg = cdns_i2c_readreg(CDNS_I2C_CR_OFFSET); + ctrl_reg |= CDNS_I2C_CR_RW | CDNS_I2C_CR_CLR_FIFO; + ++ /* ++ * Receive up to I2C_SMBUS_BLOCK_MAX data bytes, plus one message length ++ * byte, plus one checksum byte if PEC is enabled. p_msg->len will be 2 if ++ * PEC is enabled, otherwise 1. ++ */ + if (id->p_msg->flags & I2C_M_RECV_LEN) +- id->recv_count = I2C_SMBUS_BLOCK_MAX + 1; ++ id->recv_count = I2C_SMBUS_BLOCK_MAX + id->p_msg->len; + + id->curr_recv_count = id->recv_count; + +@@ -535,6 +540,9 @@ static int cdns_i2c_process_msg(struct cdns_i2c *id, struct i2c_msg *msg, + if (id->err_status & CDNS_I2C_IXR_ARB_LOST) + return -EAGAIN; + ++ if (msg->flags & I2C_M_RECV_LEN) ++ msg->len += min_t(unsigned int, msg->buf[0], I2C_SMBUS_BLOCK_MAX); ++ + return 0; + } + +diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c +index 1b93fae58ec75..964e8a29b27b4 100644 +--- a/drivers/i2c/i2c-core-base.c ++++ b/drivers/i2c/i2c-core-base.c +@@ -2358,8 +2358,9 @@ void i2c_put_adapter(struct i2c_adapter *adap) + if (!adap) + return; + +- put_device(&adap->dev); + module_put(adap->owner); ++ /* Should be last, otherwise we risk use-after-free with 'adap' */ ++ put_device(&adap->dev); + } + EXPORT_SYMBOL(i2c_put_adapter); + +diff --git a/drivers/i2c/muxes/i2c-mux-gpmux.c b/drivers/i2c/muxes/i2c-mux-gpmux.c +index f830535cff122..480ec74e6134d 100644 +--- a/drivers/i2c/muxes/i2c-mux-gpmux.c ++++ b/drivers/i2c/muxes/i2c-mux-gpmux.c +@@ -138,6 +138,7 @@ static int i2c_mux_probe(struct platform_device *pdev) + return 0; + + err_children: ++ of_node_put(child); + i2c_mux_del_adapters(muxc); + err_parent: + i2c_put_adapter(parent); +diff --git a/drivers/iio/light/isl29028.c b/drivers/iio/light/isl29028.c +index 4d220c835c758..14e150c52dfae 100644 +--- a/drivers/iio/light/isl29028.c ++++ b/drivers/iio/light/isl29028.c +@@ -628,7 +628,7 @@ static int isl29028_probe(struct i2c_client *client, + ISL29028_POWER_OFF_DELAY_MS); + pm_runtime_use_autosuspend(&client->dev); + +- ret = devm_iio_device_register(indio_dev->dev.parent, indio_dev); ++ ret = iio_device_register(indio_dev); + if (ret < 0) { + dev_err(&client->dev, + "%s(): iio registration failed with error %d\n", +diff --git a/drivers/infiniband/hw/hfi1/file_ops.c b/drivers/infiniband/hw/hfi1/file_ops.c +index 8c7ba7bad42b9..efd977f70f9ea 100644 +--- a/drivers/infiniband/hw/hfi1/file_ops.c ++++ b/drivers/infiniband/hw/hfi1/file_ops.c +@@ -1224,8 +1224,10 @@ static int setup_base_ctxt(struct hfi1_filedata *fd, + goto done; + + ret = init_user_ctxt(fd, uctxt); +- if (ret) ++ if (ret) { ++ hfi1_free_ctxt_rcv_groups(uctxt); + goto done; ++ } + + user_init(uctxt); + +diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +index d01e3222c00cf..28bbc4708fd48 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c ++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +@@ -5216,8 +5216,8 @@ static irqreturn_t hns_roce_v2_msix_interrupt_abn(int irq, void *dev_id) + + dev_err(dev, "AEQ overflow!\n"); + +- int_st |= 1 << HNS_ROCE_V2_VF_INT_ST_AEQ_OVERFLOW_S; +- roce_write(hr_dev, ROCEE_VF_ABN_INT_ST_REG, int_st); ++ roce_write(hr_dev, ROCEE_VF_ABN_INT_ST_REG, ++ 1 << HNS_ROCE_V2_VF_INT_ST_AEQ_OVERFLOW_S); + + /* Set reset level for reset_event() */ + if (ops->set_default_reset_request) +diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c b/drivers/infiniband/sw/rxe/rxe_qp.c +index 53166b9ae67e5..57f111fe54430 100644 +--- a/drivers/infiniband/sw/rxe/rxe_qp.c ++++ b/drivers/infiniband/sw/rxe/rxe_qp.c +@@ -211,6 +211,14 @@ static void rxe_qp_init_misc(struct rxe_dev *rxe, struct rxe_qp *qp, + spin_lock_init(&qp->grp_lock); + spin_lock_init(&qp->state_lock); + ++ spin_lock_init(&qp->req.task.state_lock); ++ spin_lock_init(&qp->resp.task.state_lock); ++ spin_lock_init(&qp->comp.task.state_lock); ++ ++ spin_lock_init(&qp->sq.sq_lock); ++ spin_lock_init(&qp->rq.producer_lock); ++ spin_lock_init(&qp->rq.consumer_lock); ++ + atomic_set(&qp->ssn, 0); + atomic_set(&qp->skb_out, 0); + } +@@ -268,7 +276,6 @@ static int rxe_qp_init_req(struct rxe_dev *rxe, struct rxe_qp *qp, + qp->req.opcode = -1; + qp->comp.opcode = -1; + +- spin_lock_init(&qp->sq.sq_lock); + skb_queue_head_init(&qp->req_pkts); + + rxe_init_task(rxe, &qp->req.task, qp, +@@ -318,9 +325,6 @@ static int rxe_qp_init_resp(struct rxe_dev *rxe, struct rxe_qp *qp, + } + } + +- spin_lock_init(&qp->rq.producer_lock); +- spin_lock_init(&qp->rq.consumer_lock); +- + skb_queue_head_init(&qp->resp_pkts); + + rxe_init_task(rxe, &qp->resp.task, qp, +diff --git a/drivers/infiniband/sw/siw/siw_cm.c b/drivers/infiniband/sw/siw/siw_cm.c +index 3aed597103d3d..69fcf21eaf528 100644 +--- a/drivers/infiniband/sw/siw/siw_cm.c ++++ b/drivers/infiniband/sw/siw/siw_cm.c +@@ -725,11 +725,11 @@ static int siw_proc_mpareply(struct siw_cep *cep) + enum mpa_v2_ctrl mpa_p2p_mode = MPA_V2_RDMA_NO_RTR; + + rv = siw_recv_mpa_rr(cep); +- if (rv != -EAGAIN) +- siw_cancel_mpatimer(cep); + if (rv) + goto out_err; + ++ siw_cancel_mpatimer(cep); ++ + rep = &cep->mpa.hdr; + + if (__mpa_rr_revision(rep->params.bits) > MPA_REVISION_2) { +@@ -895,7 +895,8 @@ static int siw_proc_mpareply(struct siw_cep *cep) + } + + out_err: +- siw_cm_upcall(cep, IW_CM_EVENT_CONNECT_REPLY, -EINVAL); ++ if (rv != -EAGAIN) ++ siw_cm_upcall(cep, IW_CM_EVENT_CONNECT_REPLY, -EINVAL); + + return rv; + } +diff --git a/drivers/iommu/dmar.c b/drivers/iommu/dmar.c +index 9f7c1e29e86a3..9f881fc102f73 100644 +--- a/drivers/iommu/dmar.c ++++ b/drivers/iommu/dmar.c +@@ -475,7 +475,7 @@ static int dmar_parse_one_rhsa(struct acpi_dmar_header *header, void *arg) + if (drhd->reg_base_addr == rhsa->base_address) { + int node = acpi_map_pxm_to_node(rhsa->proximity_domain); + +- if (!node_online(node)) ++ if (node != NUMA_NO_NODE && !node_online(node)) + node = NUMA_NO_NODE; + drhd->iommu->node = node; + return 0; +diff --git a/drivers/iommu/exynos-iommu.c b/drivers/iommu/exynos-iommu.c +index 55ed857f804f7..31a9b9885653f 100644 +--- a/drivers/iommu/exynos-iommu.c ++++ b/drivers/iommu/exynos-iommu.c +@@ -635,7 +635,7 @@ static int exynos_sysmmu_probe(struct platform_device *pdev) + + ret = iommu_device_register(&data->iommu); + if (ret) +- return ret; ++ goto err_iommu_register; + + platform_set_drvdata(pdev, data); + +@@ -662,6 +662,10 @@ static int exynos_sysmmu_probe(struct platform_device *pdev) + pm_runtime_enable(dev); + + return 0; ++ ++err_iommu_register: ++ iommu_device_sysfs_remove(&data->iommu); ++ return ret; + } + + static int __maybe_unused exynos_sysmmu_suspend(struct device *dev) +diff --git a/drivers/iommu/qcom_iommu.c b/drivers/iommu/qcom_iommu.c +index 280de92b332ed..b6e546b62a7cb 100644 +--- a/drivers/iommu/qcom_iommu.c ++++ b/drivers/iommu/qcom_iommu.c +@@ -785,9 +785,12 @@ static bool qcom_iommu_has_secure_context(struct qcom_iommu_dev *qcom_iommu) + { + struct device_node *child; + +- for_each_child_of_node(qcom_iommu->dev->of_node, child) +- if (of_device_is_compatible(child, "qcom,msm-iommu-v1-sec")) ++ for_each_child_of_node(qcom_iommu->dev->of_node, child) { ++ if (of_device_is_compatible(child, "qcom,msm-iommu-v1-sec")) { ++ of_node_put(child); + return true; ++ } ++ } + + return false; + } +diff --git a/drivers/irqchip/irq-tegra.c b/drivers/irqchip/irq-tegra.c +index e1f771c72fc4c..ad3e2c1b3c87b 100644 +--- a/drivers/irqchip/irq-tegra.c ++++ b/drivers/irqchip/irq-tegra.c +@@ -148,10 +148,10 @@ static int tegra_ictlr_suspend(void) + lic->cop_iep[i] = readl_relaxed(ictlr + ICTLR_COP_IEP_CLASS); + + /* Disable COP interrupts */ +- writel_relaxed(~0ul, ictlr + ICTLR_COP_IER_CLR); ++ writel_relaxed(GENMASK(31, 0), ictlr + ICTLR_COP_IER_CLR); + + /* Disable CPU interrupts */ +- writel_relaxed(~0ul, ictlr + ICTLR_CPU_IER_CLR); ++ writel_relaxed(GENMASK(31, 0), ictlr + ICTLR_CPU_IER_CLR); + + /* Enable the wakeup sources of ictlr */ + writel_relaxed(lic->ictlr_wake_mask[i], ictlr + ICTLR_CPU_IER_SET); +@@ -172,12 +172,12 @@ static void tegra_ictlr_resume(void) + + writel_relaxed(lic->cpu_iep[i], + ictlr + ICTLR_CPU_IEP_CLASS); +- writel_relaxed(~0ul, ictlr + ICTLR_CPU_IER_CLR); ++ writel_relaxed(GENMASK(31, 0), ictlr + ICTLR_CPU_IER_CLR); + writel_relaxed(lic->cpu_ier[i], + ictlr + ICTLR_CPU_IER_SET); + writel_relaxed(lic->cop_iep[i], + ictlr + ICTLR_COP_IEP_CLASS); +- writel_relaxed(~0ul, ictlr + ICTLR_COP_IER_CLR); ++ writel_relaxed(GENMASK(31, 0), ictlr + ICTLR_COP_IER_CLR); + writel_relaxed(lic->cop_ier[i], + ictlr + ICTLR_COP_IER_SET); + } +@@ -312,7 +312,7 @@ static int __init tegra_ictlr_init(struct device_node *node, + lic->base[i] = base; + + /* Disable all interrupts */ +- writel_relaxed(~0UL, base + ICTLR_CPU_IER_CLR); ++ writel_relaxed(GENMASK(31, 0), base + ICTLR_CPU_IER_CLR); + /* All interrupts target IRQ */ + writel_relaxed(0, base + ICTLR_CPU_IEP_CLASS); + +diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c +index 42151c9fc6e56..882e83d51ef43 100644 +--- a/drivers/md/dm-raid.c ++++ b/drivers/md/dm-raid.c +@@ -3528,7 +3528,7 @@ static void raid_status(struct dm_target *ti, status_type_t type, + { + struct raid_set *rs = ti->private; + struct mddev *mddev = &rs->md; +- struct r5conf *conf = mddev->private; ++ struct r5conf *conf = rs_is_raid456(rs) ? mddev->private : NULL; + int i, max_nr_stripes = conf ? conf->max_nr_stripes : 0; + unsigned long recovery; + unsigned int raid_param_cnt = 1; /* at least 1 for chunksize */ +@@ -3808,7 +3808,7 @@ static void attempt_restore_of_faulty_devices(struct raid_set *rs) + + memset(cleared_failed_devices, 0, sizeof(cleared_failed_devices)); + +- for (i = 0; i < mddev->raid_disks; i++) { ++ for (i = 0; i < rs->raid_disks; i++) { + r = &rs->dev[i].rdev; + /* HM FIXME: enhance journal device recovery processing */ + if (test_bit(Journal, &r->flags)) +diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c +index a5ed59eafdc51..784468f3cb747 100644 +--- a/drivers/md/dm-thin-metadata.c ++++ b/drivers/md/dm-thin-metadata.c +@@ -2060,10 +2060,13 @@ int dm_pool_register_metadata_threshold(struct dm_pool_metadata *pmd, + dm_sm_threshold_fn fn, + void *context) + { +- int r; ++ int r = -EINVAL; + + pmd_write_lock_in_core(pmd); +- r = dm_sm_register_threshold_callback(pmd->metadata_sm, threshold, fn, context); ++ if (!pmd->fail_io) { ++ r = dm_sm_register_threshold_callback(pmd->metadata_sm, ++ threshold, fn, context); ++ } + pmd_write_unlock(pmd); + + return r; +diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c +index 1b2c98b43519f..bf0b67e72254c 100644 +--- a/drivers/md/dm-thin.c ++++ b/drivers/md/dm-thin.c +@@ -3425,8 +3425,10 @@ static int pool_ctr(struct dm_target *ti, unsigned argc, char **argv) + calc_metadata_threshold(pt), + metadata_low_callback, + pool); +- if (r) ++ if (r) { ++ ti->error = "Error registering metadata threshold"; + goto out_flags_changed; ++ } + + pt->callbacks.congested_fn = pool_is_congested; + dm_table_add_target_callbacks(ti->table, &pt->callbacks); +diff --git a/drivers/md/dm-writecache.c b/drivers/md/dm-writecache.c +index ec10fda3f24f4..961498d8f4062 100644 +--- a/drivers/md/dm-writecache.c ++++ b/drivers/md/dm-writecache.c +@@ -20,7 +20,7 @@ + + #define HIGH_WATERMARK 50 + #define LOW_WATERMARK 45 +-#define MAX_WRITEBACK_JOBS 0 ++#define MAX_WRITEBACK_JOBS min(0x10000000 / PAGE_SIZE, totalram_pages() / 16) + #define ENDIO_LATENCY 16 + #define WRITEBACK_LATENCY 64 + #define AUTOCOMMIT_BLOCKS_SSD 65536 +diff --git a/drivers/md/dm.c b/drivers/md/dm.c +index 77e28f77c59f4..d4cebb38709bd 100644 +--- a/drivers/md/dm.c ++++ b/drivers/md/dm.c +@@ -3080,6 +3080,11 @@ static int dm_call_pr(struct block_device *bdev, iterate_devices_callout_fn fn, + goto out; + ti = dm_table_get_target(table, 0); + ++ if (dm_suspended_md(md)) { ++ ret = -EAGAIN; ++ goto out; ++ } ++ + ret = -EINVAL; + if (!ti->type->iterate_devices) + goto out; +diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c +index deddabfb07d79..9fcc141e1ad64 100644 +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -1826,9 +1826,12 @@ static int raid10_remove_disk(struct mddev *mddev, struct md_rdev *rdev) + int err = 0; + int number = rdev->raid_disk; + struct md_rdev **rdevp; +- struct raid10_info *p = conf->mirrors + number; ++ struct raid10_info *p; + + print_conf(conf); ++ if (unlikely(number >= mddev->raid_disks)) ++ return 0; ++ p = conf->mirrors + number; + if (rdev == p->rdev) + rdevp = &p->rdev; + else if (rdev == p->replacement) +diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c +index 474cf6abefea5..fe99e8cdc026f 100644 +--- a/drivers/md/raid5.c ++++ b/drivers/md/raid5.c +@@ -2666,10 +2666,10 @@ static void raid5_end_write_request(struct bio *bi) + if (!test_and_clear_bit(R5_DOUBLE_LOCKED, &sh->dev[i].flags)) + clear_bit(R5_LOCKED, &sh->dev[i].flags); + set_bit(STRIPE_HANDLE, &sh->state); +- raid5_release_stripe(sh); + + if (sh->batch_head && sh != sh->batch_head) + raid5_release_stripe(sh->batch_head); ++ raid5_release_stripe(sh); + } + + static void raid5_error(struct mddev *mddev, struct md_rdev *rdev) +diff --git a/drivers/media/pci/tw686x/tw686x-core.c b/drivers/media/pci/tw686x/tw686x-core.c +index 74ae4f0dcee76..8a25a0dac4aeb 100644 +--- a/drivers/media/pci/tw686x/tw686x-core.c ++++ b/drivers/media/pci/tw686x/tw686x-core.c +@@ -315,13 +315,6 @@ static int tw686x_probe(struct pci_dev *pci_dev, + + spin_lock_init(&dev->lock); + +- err = request_irq(pci_dev->irq, tw686x_irq, IRQF_SHARED, +- dev->name, dev); +- if (err < 0) { +- dev_err(&pci_dev->dev, "unable to request interrupt\n"); +- goto iounmap; +- } +- + timer_setup(&dev->dma_delay_timer, tw686x_dma_delay, 0); + + /* +@@ -333,18 +326,23 @@ static int tw686x_probe(struct pci_dev *pci_dev, + err = tw686x_video_init(dev); + if (err) { + dev_err(&pci_dev->dev, "can't register video\n"); +- goto free_irq; ++ goto iounmap; + } + + err = tw686x_audio_init(dev); + if (err) + dev_warn(&pci_dev->dev, "can't register audio\n"); + ++ err = request_irq(pci_dev->irq, tw686x_irq, IRQF_SHARED, ++ dev->name, dev); ++ if (err < 0) { ++ dev_err(&pci_dev->dev, "unable to request interrupt\n"); ++ goto iounmap; ++ } ++ + pci_set_drvdata(pci_dev, dev); + return 0; + +-free_irq: +- free_irq(pci_dev->irq, dev); + iounmap: + pci_iounmap(pci_dev, dev->mmio); + free_region: +diff --git a/drivers/media/platform/mtk-mdp/mtk_mdp_ipi.h b/drivers/media/platform/mtk-mdp/mtk_mdp_ipi.h +index 2cb8cecb30771..b810c96695c83 100644 +--- a/drivers/media/platform/mtk-mdp/mtk_mdp_ipi.h ++++ b/drivers/media/platform/mtk-mdp/mtk_mdp_ipi.h +@@ -40,12 +40,14 @@ struct mdp_ipi_init { + * @ipi_id : IPI_MDP + * @ap_inst : AP mtk_mdp_vpu address + * @vpu_inst_addr : VPU MDP instance address ++ * @padding : Alignment padding + */ + struct mdp_ipi_comm { + uint32_t msg_id; + uint32_t ipi_id; + uint64_t ap_inst; + uint32_t vpu_inst_addr; ++ uint32_t padding; + }; + + /** +diff --git a/drivers/media/usb/hdpvr/hdpvr-video.c b/drivers/media/usb/hdpvr/hdpvr-video.c +index 7849f1fbbcc4d..4f1505b94338e 100644 +--- a/drivers/media/usb/hdpvr/hdpvr-video.c ++++ b/drivers/media/usb/hdpvr/hdpvr-video.c +@@ -409,7 +409,7 @@ static ssize_t hdpvr_read(struct file *file, char __user *buffer, size_t count, + struct hdpvr_device *dev = video_drvdata(file); + struct hdpvr_buffer *buf = NULL; + struct urb *urb; +- unsigned int ret = 0; ++ int ret = 0; + int rem, cnt; + + if (*pos) +diff --git a/drivers/memstick/core/ms_block.c b/drivers/memstick/core/ms_block.c +index 55907e4c36b18..6014fcb49d7ec 100644 +--- a/drivers/memstick/core/ms_block.c ++++ b/drivers/memstick/core/ms_block.c +@@ -1335,17 +1335,17 @@ static int msb_ftl_initialize(struct msb_data *msb) + msb->zone_count = msb->block_count / MS_BLOCKS_IN_ZONE; + msb->logical_block_count = msb->zone_count * 496 - 2; + +- msb->used_blocks_bitmap = kzalloc(msb->block_count / 8, GFP_KERNEL); +- msb->erased_blocks_bitmap = kzalloc(msb->block_count / 8, GFP_KERNEL); ++ msb->used_blocks_bitmap = bitmap_zalloc(msb->block_count, GFP_KERNEL); ++ msb->erased_blocks_bitmap = bitmap_zalloc(msb->block_count, GFP_KERNEL); + msb->lba_to_pba_table = + kmalloc_array(msb->logical_block_count, sizeof(u16), + GFP_KERNEL); + + if (!msb->used_blocks_bitmap || !msb->lba_to_pba_table || + !msb->erased_blocks_bitmap) { +- kfree(msb->used_blocks_bitmap); ++ bitmap_free(msb->used_blocks_bitmap); ++ bitmap_free(msb->erased_blocks_bitmap); + kfree(msb->lba_to_pba_table); +- kfree(msb->erased_blocks_bitmap); + return -ENOMEM; + } + +@@ -1953,7 +1953,8 @@ static int msb_bd_open(struct block_device *bdev, fmode_t mode) + static void msb_data_clear(struct msb_data *msb) + { + kfree(msb->boot_page); +- kfree(msb->used_blocks_bitmap); ++ bitmap_free(msb->used_blocks_bitmap); ++ bitmap_free(msb->erased_blocks_bitmap); + kfree(msb->lba_to_pba_table); + kfree(msb->cache); + msb->card = NULL; +diff --git a/drivers/mfd/max77620.c b/drivers/mfd/max77620.c +index a851ff473a446..2bf5bcbc88524 100644 +--- a/drivers/mfd/max77620.c ++++ b/drivers/mfd/max77620.c +@@ -418,9 +418,11 @@ static int max77620_initialise_fps(struct max77620_chip *chip) + ret = max77620_config_fps(chip, fps_child); + if (ret < 0) { + of_node_put(fps_child); ++ of_node_put(fps_np); + return ret; + } + } ++ of_node_put(fps_np); + + config = chip->enable_global_lpm ? MAX77620_ONOFFCNFG2_SLP_LPM_MSK : 0; + ret = regmap_update_bits(chip->rmap, MAX77620_REG_ONOFFCNFG2, +diff --git a/drivers/mfd/t7l66xb.c b/drivers/mfd/t7l66xb.c +index 70da0c4ae457e..58811c5ab564f 100644 +--- a/drivers/mfd/t7l66xb.c ++++ b/drivers/mfd/t7l66xb.c +@@ -405,11 +405,8 @@ err_noirq: + + static int t7l66xb_remove(struct platform_device *dev) + { +- struct t7l66xb_platform_data *pdata = dev_get_platdata(&dev->dev); + struct t7l66xb *t7l66xb = platform_get_drvdata(dev); +- int ret; + +- ret = pdata->disable(dev); + clk_disable_unprepare(t7l66xb->clk48m); + clk_put(t7l66xb->clk48m); + clk_disable_unprepare(t7l66xb->clk32k); +@@ -420,8 +417,7 @@ static int t7l66xb_remove(struct platform_device *dev) + mfd_remove_devices(&dev->dev); + kfree(t7l66xb); + +- return ret; +- ++ return 0; + } + + static struct platform_driver t7l66xb_platform_driver = { +diff --git a/drivers/misc/cardreader/rtsx_pcr.c b/drivers/misc/cardreader/rtsx_pcr.c +index 4c707d8dc3eb3..5807aefd4c886 100644 +--- a/drivers/misc/cardreader/rtsx_pcr.c ++++ b/drivers/misc/cardreader/rtsx_pcr.c +@@ -1485,7 +1485,7 @@ static int rtsx_pci_probe(struct pci_dev *pcidev, + pcr->remap_addr = ioremap_nocache(base, len); + if (!pcr->remap_addr) { + ret = -ENOMEM; +- goto free_handle; ++ goto free_idr; + } + + pcr->rtsx_resv_buf = dma_alloc_coherent(&(pcidev->dev), +@@ -1547,6 +1547,10 @@ disable_msi: + pcr->rtsx_resv_buf, pcr->rtsx_resv_buf_addr); + unmap: + iounmap(pcr->remap_addr); ++free_idr: ++ spin_lock(&rtsx_pci_lock); ++ idr_remove(&rtsx_pci_idr, pcr->id); ++ spin_unlock(&rtsx_pci_lock); + free_handle: + kfree(handle); + free_pcr: +diff --git a/drivers/misc/cxl/irq.c b/drivers/misc/cxl/irq.c +index 4cb829d5d873c..2e4dcfebf19af 100644 +--- a/drivers/misc/cxl/irq.c ++++ b/drivers/misc/cxl/irq.c +@@ -349,6 +349,7 @@ int afu_allocate_irqs(struct cxl_context *ctx, u32 count) + + out: + cxl_ops->release_irq_ranges(&ctx->irqs, ctx->afu->adapter); ++ bitmap_free(ctx->irq_bitmap); + afu_irq_name_free(ctx); + return -ENOMEM; + } +diff --git a/drivers/mmc/host/cavium-octeon.c b/drivers/mmc/host/cavium-octeon.c +index 22aded1065ae8..2245452a44c86 100644 +--- a/drivers/mmc/host/cavium-octeon.c ++++ b/drivers/mmc/host/cavium-octeon.c +@@ -288,6 +288,7 @@ static int octeon_mmc_probe(struct platform_device *pdev) + if (ret) { + dev_err(&pdev->dev, "Error populating slots\n"); + octeon_mmc_set_shared_power(host, 0); ++ of_node_put(cn); + goto error; + } + i++; +diff --git a/drivers/mmc/host/cavium-thunderx.c b/drivers/mmc/host/cavium-thunderx.c +index eee08d81b2421..f79806e31e7ea 100644 +--- a/drivers/mmc/host/cavium-thunderx.c ++++ b/drivers/mmc/host/cavium-thunderx.c +@@ -138,8 +138,10 @@ static int thunder_mmc_probe(struct pci_dev *pdev, + continue; + + ret = cvm_mmc_of_slot_probe(&host->slot_pdev[i]->dev, host); +- if (ret) ++ if (ret) { ++ of_node_put(child_node); + goto error; ++ } + } + i++; + } +diff --git a/drivers/mmc/host/pxamci.c b/drivers/mmc/host/pxamci.c +index 953e7457137a2..99f3958a037ce 100644 +--- a/drivers/mmc/host/pxamci.c ++++ b/drivers/mmc/host/pxamci.c +@@ -648,7 +648,7 @@ static int pxamci_probe(struct platform_device *pdev) + + ret = pxamci_of_init(pdev, mmc); + if (ret) +- return ret; ++ goto out; + + host = mmc_priv(mmc); + host->mmc = mmc; +@@ -672,7 +672,7 @@ static int pxamci_probe(struct platform_device *pdev) + + ret = pxamci_init_ocr(host); + if (ret < 0) +- return ret; ++ goto out; + + mmc->caps = 0; + host->cmdat = 0; +diff --git a/drivers/mmc/host/sdhci-of-at91.c b/drivers/mmc/host/sdhci-of-at91.c +index 881f8138e7de3..03698d78a4027 100644 +--- a/drivers/mmc/host/sdhci-of-at91.c ++++ b/drivers/mmc/host/sdhci-of-at91.c +@@ -109,8 +109,13 @@ static void sdhci_at91_set_power(struct sdhci_host *host, unsigned char mode, + static void sdhci_at91_set_uhs_signaling(struct sdhci_host *host, + unsigned int timing) + { +- if (timing == MMC_TIMING_MMC_DDR52) +- sdhci_writeb(host, SDMMC_MC1R_DDR, SDMMC_MC1R); ++ u8 mc1r; ++ ++ if (timing == MMC_TIMING_MMC_DDR52) { ++ mc1r = sdhci_readb(host, SDMMC_MC1R); ++ mc1r |= SDMMC_MC1R_DDR; ++ sdhci_writeb(host, mc1r, SDMMC_MC1R); ++ } + sdhci_set_uhs_signaling(host, timing); + } + +diff --git a/drivers/mmc/host/sdhci-of-esdhc.c b/drivers/mmc/host/sdhci-of-esdhc.c +index 0ff339004d8a5..69c133e7ced05 100644 +--- a/drivers/mmc/host/sdhci-of-esdhc.c ++++ b/drivers/mmc/host/sdhci-of-esdhc.c +@@ -844,6 +844,7 @@ static int esdhc_signal_voltage_switch(struct mmc_host *mmc, + scfg_node = of_find_matching_node(NULL, scfg_device_ids); + if (scfg_node) + scfg_base = of_iomap(scfg_node, 0); ++ of_node_put(scfg_node); + if (scfg_base) { + sdhciovselcr = SDHCIOVSELCR_TGLEN | + SDHCIOVSELCR_VSELVAL; +diff --git a/drivers/mtd/devices/st_spi_fsm.c b/drivers/mtd/devices/st_spi_fsm.c +index f4d1667daaf99..41b5a236276b4 100644 +--- a/drivers/mtd/devices/st_spi_fsm.c ++++ b/drivers/mtd/devices/st_spi_fsm.c +@@ -2116,10 +2116,12 @@ static int stfsm_probe(struct platform_device *pdev) + (long long)fsm->mtd.size, (long long)(fsm->mtd.size >> 20), + fsm->mtd.erasesize, (fsm->mtd.erasesize >> 10)); + +- return mtd_device_register(&fsm->mtd, NULL, 0); +- ++ ret = mtd_device_register(&fsm->mtd, NULL, 0); ++ if (ret) { + err_clk_unprepare: +- clk_disable_unprepare(fsm->clk); ++ clk_disable_unprepare(fsm->clk); ++ } ++ + return ret; + } + +diff --git a/drivers/mtd/maps/physmap-versatile.c b/drivers/mtd/maps/physmap-versatile.c +index ad7cd9cfaee04..a1b8b7b25f88b 100644 +--- a/drivers/mtd/maps/physmap-versatile.c ++++ b/drivers/mtd/maps/physmap-versatile.c +@@ -93,6 +93,7 @@ static int ap_flash_init(struct platform_device *pdev) + return -ENODEV; + } + ebi_base = of_iomap(ebi, 0); ++ of_node_put(ebi); + if (!ebi_base) + return -ENODEV; + +@@ -207,6 +208,7 @@ int of_flash_probe_versatile(struct platform_device *pdev, + + versatile_flashprot = (enum versatile_flashprot)devid->data; + rmap = syscon_node_to_regmap(sysnp); ++ of_node_put(sysnp); + if (IS_ERR(rmap)) + return PTR_ERR(rmap); + +diff --git a/drivers/mtd/nand/raw/meson_nand.c b/drivers/mtd/nand/raw/meson_nand.c +index ab7ab6a279aac..28dc26e1a20af 100644 +--- a/drivers/mtd/nand/raw/meson_nand.c ++++ b/drivers/mtd/nand/raw/meson_nand.c +@@ -1304,7 +1304,6 @@ static int meson_nfc_nand_chip_cleanup(struct meson_nfc *nfc) + if (ret) + return ret; + +- meson_nfc_free_buffer(&meson_chip->nand); + nand_cleanup(&meson_chip->nand); + list_del(&meson_chip->node); + } +diff --git a/drivers/mtd/parsers/redboot.c b/drivers/mtd/parsers/redboot.c +index 3ccd6363ee8cb..4f3bcc59a6385 100644 +--- a/drivers/mtd/parsers/redboot.c ++++ b/drivers/mtd/parsers/redboot.c +@@ -58,6 +58,7 @@ static void parse_redboot_of(struct mtd_info *master) + return; + + ret = of_property_read_u32(npart, "fis-index-block", &dirblock); ++ of_node_put(npart); + if (ret) + return; + +diff --git a/drivers/mtd/sm_ftl.c b/drivers/mtd/sm_ftl.c +index 4744bf94ad9a9..d4e72fd5e5b3a 100644 +--- a/drivers/mtd/sm_ftl.c ++++ b/drivers/mtd/sm_ftl.c +@@ -1097,9 +1097,9 @@ static void sm_release(struct mtd_blktrans_dev *dev) + { + struct sm_ftl *ftl = dev->priv; + +- mutex_lock(&ftl->mutex); + del_timer_sync(&ftl->timer); + cancel_work_sync(&ftl->flush_work); ++ mutex_lock(&ftl->mutex); + sm_cache_flush(ftl); + mutex_unlock(&ftl->mutex); + } +diff --git a/drivers/net/can/pch_can.c b/drivers/net/can/pch_can.c +index e90651f7b2eaf..586bda050d284 100644 +--- a/drivers/net/can/pch_can.c ++++ b/drivers/net/can/pch_can.c +@@ -489,6 +489,7 @@ static void pch_can_error(struct net_device *ndev, u32 status) + if (!skb) + return; + ++ errc = ioread32(&priv->regs->errc); + if (status & PCH_BUS_OFF) { + pch_can_set_tx_all(priv, 0); + pch_can_set_rx_all(priv, 0); +@@ -496,9 +497,11 @@ static void pch_can_error(struct net_device *ndev, u32 status) + cf->can_id |= CAN_ERR_BUSOFF; + priv->can.can_stats.bus_off++; + can_bus_off(ndev); ++ } else { ++ cf->data[6] = errc & PCH_TEC; ++ cf->data[7] = (errc & PCH_REC) >> 8; + } + +- errc = ioread32(&priv->regs->errc); + /* Warning interrupt. */ + if (status & PCH_EWARN) { + state = CAN_STATE_ERROR_WARNING; +@@ -556,9 +559,6 @@ static void pch_can_error(struct net_device *ndev, u32 status) + break; + } + +- cf->data[6] = errc & PCH_TEC; +- cf->data[7] = (errc & PCH_REC) >> 8; +- + priv->can.state = state; + netif_receive_skb(skb); + +diff --git a/drivers/net/can/rcar/rcar_can.c b/drivers/net/can/rcar/rcar_can.c +index ac52288fa3bfe..b99b1b235348c 100644 +--- a/drivers/net/can/rcar/rcar_can.c ++++ b/drivers/net/can/rcar/rcar_can.c +@@ -235,11 +235,8 @@ static void rcar_can_error(struct net_device *ndev) + if (eifr & (RCAR_CAN_EIFR_EWIF | RCAR_CAN_EIFR_EPIF)) { + txerr = readb(&priv->regs->tecr); + rxerr = readb(&priv->regs->recr); +- if (skb) { ++ if (skb) + cf->can_id |= CAN_ERR_CRTL; +- cf->data[6] = txerr; +- cf->data[7] = rxerr; +- } + } + if (eifr & RCAR_CAN_EIFR_BEIF) { + int rx_errors = 0, tx_errors = 0; +@@ -339,6 +336,9 @@ static void rcar_can_error(struct net_device *ndev) + can_bus_off(ndev); + if (skb) + cf->can_id |= CAN_ERR_BUSOFF; ++ } else if (skb) { ++ cf->data[6] = txerr; ++ cf->data[7] = rxerr; + } + if (eifr & RCAR_CAN_EIFR_ORIF) { + netdev_dbg(priv->ndev, "Receive overrun error interrupt\n"); +diff --git a/drivers/net/can/sja1000/sja1000.c b/drivers/net/can/sja1000/sja1000.c +index 9f107798f904b..e7327ceabb76e 100644 +--- a/drivers/net/can/sja1000/sja1000.c ++++ b/drivers/net/can/sja1000/sja1000.c +@@ -405,9 +405,6 @@ static int sja1000_err(struct net_device *dev, uint8_t isrc, uint8_t status) + txerr = priv->read_reg(priv, SJA1000_TXERR); + rxerr = priv->read_reg(priv, SJA1000_RXERR); + +- cf->data[6] = txerr; +- cf->data[7] = rxerr; +- + if (isrc & IRQ_DOI) { + /* data overrun interrupt */ + netdev_dbg(dev, "data overrun interrupt\n"); +@@ -429,6 +426,10 @@ static int sja1000_err(struct net_device *dev, uint8_t isrc, uint8_t status) + else + state = CAN_STATE_ERROR_ACTIVE; + } ++ if (state != CAN_STATE_BUS_OFF) { ++ cf->data[6] = txerr; ++ cf->data[7] = rxerr; ++ } + if (isrc & IRQ_BEI) { + /* bus error interrupt */ + priv->can.can_stats.bus_error++; +diff --git a/drivers/net/can/spi/hi311x.c b/drivers/net/can/spi/hi311x.c +index 7d2315c8cacb1..28273e84171a2 100644 +--- a/drivers/net/can/spi/hi311x.c ++++ b/drivers/net/can/spi/hi311x.c +@@ -670,8 +670,6 @@ static irqreturn_t hi3110_can_ist(int irq, void *dev_id) + + txerr = hi3110_read(spi, HI3110_READ_TEC); + rxerr = hi3110_read(spi, HI3110_READ_REC); +- cf->data[6] = txerr; +- cf->data[7] = rxerr; + tx_state = txerr >= rxerr ? new_state : 0; + rx_state = txerr <= rxerr ? new_state : 0; + can_change_state(net, cf, tx_state, rx_state); +@@ -684,6 +682,9 @@ static irqreturn_t hi3110_can_ist(int irq, void *dev_id) + hi3110_hw_sleep(spi); + break; + } ++ } else { ++ cf->data[6] = txerr; ++ cf->data[7] = rxerr; + } + } + +diff --git a/drivers/net/can/spi/mcp251x.c b/drivers/net/can/spi/mcp251x.c +index bb20a9b75cc66..32bd593a39f13 100644 +--- a/drivers/net/can/spi/mcp251x.c ++++ b/drivers/net/can/spi/mcp251x.c +@@ -756,9 +756,6 @@ static irqreturn_t mcp251x_can_ist(int irq, void *dev_id) + + mcp251x_read_2regs(spi, CANINTF, &intf, &eflag); + +- /* mask out flags we don't care about */ +- intf &= CANINTF_RX | CANINTF_TX | CANINTF_ERR; +- + /* receive buffer 0 */ + if (intf & CANINTF_RX0IF) { + mcp251x_hw_rx(spi, 0); +@@ -768,6 +765,18 @@ static irqreturn_t mcp251x_can_ist(int irq, void *dev_id) + if (mcp251x_is_2510(spi)) + mcp251x_write_bits(spi, CANINTF, + CANINTF_RX0IF, 0x00); ++ ++ /* check if buffer 1 is already known to be full, no need to re-read */ ++ if (!(intf & CANINTF_RX1IF)) { ++ u8 intf1, eflag1; ++ ++ /* intf needs to be read again to avoid a race condition */ ++ mcp251x_read_2regs(spi, CANINTF, &intf1, &eflag1); ++ ++ /* combine flags from both operations for error handling */ ++ intf |= intf1; ++ eflag |= eflag1; ++ } + } + + /* receive buffer 1 */ +@@ -778,6 +787,9 @@ static irqreturn_t mcp251x_can_ist(int irq, void *dev_id) + clear_intf |= CANINTF_RX1IF; + } + ++ /* mask out flags we don't care about */ ++ intf &= CANINTF_RX | CANINTF_TX | CANINTF_ERR; ++ + /* any error or tx interrupt we need to clear? */ + if (intf & (CANINTF_ERR | CANINTF_TX)) + clear_intf |= intf & (CANINTF_ERR | CANINTF_TX); +diff --git a/drivers/net/can/sun4i_can.c b/drivers/net/can/sun4i_can.c +index f4cd881964042..c519b6f63b33a 100644 +--- a/drivers/net/can/sun4i_can.c ++++ b/drivers/net/can/sun4i_can.c +@@ -525,11 +525,6 @@ static int sun4i_can_err(struct net_device *dev, u8 isrc, u8 status) + rxerr = (errc >> 16) & 0xFF; + txerr = errc & 0xFF; + +- if (skb) { +- cf->data[6] = txerr; +- cf->data[7] = rxerr; +- } +- + if (isrc & SUN4I_INT_DATA_OR) { + /* data overrun interrupt */ + netdev_dbg(dev, "data overrun interrupt\n"); +@@ -560,6 +555,10 @@ static int sun4i_can_err(struct net_device *dev, u8 isrc, u8 status) + else + state = CAN_STATE_ERROR_ACTIVE; + } ++ if (skb && state != CAN_STATE_BUS_OFF) { ++ cf->data[6] = txerr; ++ cf->data[7] = rxerr; ++ } + if (isrc & SUN4I_INT_BUS_ERR) { + /* bus error interrupt */ + netdev_dbg(dev, "bus error interrupt\n"); +diff --git a/drivers/net/can/usb/ems_usb.c b/drivers/net/can/usb/ems_usb.c +index 6458da9c13b95..ff05b5230f0b8 100644 +--- a/drivers/net/can/usb/ems_usb.c ++++ b/drivers/net/can/usb/ems_usb.c +@@ -194,7 +194,7 @@ struct __packed ems_cpc_msg { + __le32 ts_sec; /* timestamp in seconds */ + __le32 ts_nsec; /* timestamp in nano seconds */ + +- union { ++ union __packed { + u8 generic[64]; + struct cpc_can_msg can_msg; + struct cpc_can_params can_params; +diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c +index a7c408acb0c09..01d4a731b579c 100644 +--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c ++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c +@@ -890,8 +890,10 @@ static void kvaser_usb_hydra_update_state(struct kvaser_usb_net_priv *priv, + new_state < CAN_STATE_BUS_OFF) + priv->can.can_stats.restarts++; + +- cf->data[6] = bec->txerr; +- cf->data[7] = bec->rxerr; ++ if (new_state != CAN_STATE_BUS_OFF) { ++ cf->data[6] = bec->txerr; ++ cf->data[7] = bec->rxerr; ++ } + + stats = &netdev->stats; + stats->rx_packets++; +@@ -1045,8 +1047,10 @@ kvaser_usb_hydra_error_frame(struct kvaser_usb_net_priv *priv, + shhwtstamps->hwtstamp = hwtstamp; + + cf->can_id |= CAN_ERR_BUSERROR; +- cf->data[6] = bec.txerr; +- cf->data[7] = bec.rxerr; ++ if (new_state != CAN_STATE_BUS_OFF) { ++ cf->data[6] = bec.txerr; ++ cf->data[7] = bec.rxerr; ++ } + + stats->rx_packets++; + stats->rx_bytes += cf->can_dlc; +diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c +index 0e0403dd05500..5e281249ad5fe 100644 +--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c ++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c +@@ -857,8 +857,10 @@ static void kvaser_usb_leaf_rx_error(const struct kvaser_usb *dev, + break; + } + +- cf->data[6] = es->txerr; +- cf->data[7] = es->rxerr; ++ if (new_state != CAN_STATE_BUS_OFF) { ++ cf->data[6] = es->txerr; ++ cf->data[7] = es->rxerr; ++ } + + stats->rx_packets++; + stats->rx_bytes += cf->can_dlc; +diff --git a/drivers/net/can/usb/usb_8dev.c b/drivers/net/can/usb/usb_8dev.c +index b514b2eaa3180..89a94c16fc080 100644 +--- a/drivers/net/can/usb/usb_8dev.c ++++ b/drivers/net/can/usb/usb_8dev.c +@@ -442,9 +442,10 @@ static void usb_8dev_rx_err_msg(struct usb_8dev_priv *priv, + + if (rx_errors) + stats->rx_errors++; +- +- cf->data[6] = txerr; +- cf->data[7] = rxerr; ++ if (priv->can.state != CAN_STATE_BUS_OFF) { ++ cf->data[6] = txerr; ++ cf->data[7] = rxerr; ++ } + + priv->bec.txerr = txerr; + priv->bec.rxerr = rxerr; +diff --git a/drivers/net/dsa/microchip/ksz9477.c b/drivers/net/dsa/microchip/ksz9477.c +index 0370e71ed6e0d..c66e78b2870d7 100644 +--- a/drivers/net/dsa/microchip/ksz9477.c ++++ b/drivers/net/dsa/microchip/ksz9477.c +@@ -766,6 +766,9 @@ static int ksz9477_port_fdb_dump(struct dsa_switch *ds, int port, + goto exit; + } + ++ if (!(ksz_data & ALU_VALID)) ++ continue; ++ + /* read ALU table */ + ksz9477_read_table(dev, alu_table); + +diff --git a/drivers/net/dsa/mv88e6060.c b/drivers/net/dsa/mv88e6060.c +index 2a2489b5196d7..51ef8f262ca95 100644 +--- a/drivers/net/dsa/mv88e6060.c ++++ b/drivers/net/dsa/mv88e6060.c +@@ -117,6 +117,9 @@ static int mv88e6060_setup_port(struct mv88e6060_priv *priv, int p) + int addr = REG_PORT(p); + int ret; + ++ if (dsa_is_unused_port(priv->ds, p)) ++ return 0; ++ + /* Do not force flow control, disable Ingress and Egress + * Header tagging, disable VLAN tunneling, and set the port + * state to Forwarding. Additionally, if this is the CPU +diff --git a/drivers/net/ethernet/broadcom/bgmac.c b/drivers/net/ethernet/broadcom/bgmac.c +index 148734b166f04..979af8e878e3a 100644 +--- a/drivers/net/ethernet/broadcom/bgmac.c ++++ b/drivers/net/ethernet/broadcom/bgmac.c +@@ -189,8 +189,8 @@ static netdev_tx_t bgmac_dma_tx_add(struct bgmac *bgmac, + } + + slot->skb = skb; +- ring->end += nr_frags + 1; + netdev_sent_queue(net_dev, skb->len); ++ ring->end += nr_frags + 1; + + wmb(); + +diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c +index 34540e604f748..ad0d070f7f172 100644 +--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c ++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c +@@ -971,8 +971,8 @@ static int add_bufs(struct dpaa2_eth_priv *priv, + buf_array[i] = addr; + + /* tracing point */ +- trace_dpaa2_eth_buf_seed(priv->net_dev, +- page, DPAA2_ETH_RX_BUF_RAW_SIZE, ++ trace_dpaa2_eth_buf_seed(priv->net_dev, page_address(page), ++ DPAA2_ETH_RX_BUF_RAW_SIZE, + addr, priv->rx_buf_size, + bpid); + } +diff --git a/drivers/net/ethernet/freescale/fec_ptp.c b/drivers/net/ethernet/freescale/fec_ptp.c +index 3b54a37e780eb..6fd0c73b327e2 100644 +--- a/drivers/net/ethernet/freescale/fec_ptp.c ++++ b/drivers/net/ethernet/freescale/fec_ptp.c +@@ -141,11 +141,7 @@ static int fec_ptp_enable_pps(struct fec_enet_private *fep, uint enable) + * NSEC_PER_SEC - ts.tv_nsec. Add the remaining nanoseconds + * to current timer would be next second. + */ +- tempval = readl(fep->hwp + FEC_ATIME_CTRL); +- tempval |= FEC_T_CTRL_CAPTURE; +- writel(tempval, fep->hwp + FEC_ATIME_CTRL); +- +- tempval = readl(fep->hwp + FEC_ATIME); ++ tempval = fep->cc.read(&fep->cc); + /* Convert the ptp local counter to 1588 timestamp */ + ns = timecounter_cyc2time(&fep->tc, tempval); + ts = ns_to_timespec64(ns); +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index 637f6ed78b489..2d01eaeb703af 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -409,7 +409,9 @@ static void i40e_tx_timeout(struct net_device *netdev) + set_bit(__I40E_GLOBAL_RESET_REQUESTED, pf->state); + break; + default: +- netdev_err(netdev, "tx_timeout recovery unsuccessful\n"); ++ netdev_err(netdev, "tx_timeout recovery unsuccessful, device is in non-recoverable state.\n"); ++ set_bit(__I40E_DOWN_REQUESTED, pf->state); ++ set_bit(__I40E_VSI_DOWN_REQUESTED, vsi->state); + break; + } + +diff --git a/drivers/net/ethernet/intel/iavf/iavf.h b/drivers/net/ethernet/intel/iavf/iavf.h +index 81ca6472937d2..85275b6ede4d3 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf.h ++++ b/drivers/net/ethernet/intel/iavf/iavf.h +@@ -86,6 +86,7 @@ struct iavf_vsi { + #define IAVF_HKEY_ARRAY_SIZE ((IAVF_VFQF_HKEY_MAX_INDEX + 1) * 4) + #define IAVF_HLUT_ARRAY_SIZE ((IAVF_VFQF_HLUT_MAX_INDEX + 1) * 4) + #define IAVF_MBPS_DIVISOR 125000 /* divisor to convert to Mbps */ ++#define IAVF_MBPS_QUANTA 50 + + #define IAVF_VIRTCHNL_VF_RESOURCE_SIZE (sizeof(struct virtchnl_vf_resource) + \ + (IAVF_MAX_VF_VSI * \ +diff --git a/drivers/net/ethernet/intel/iavf/iavf_adminq.c b/drivers/net/ethernet/intel/iavf/iavf_adminq.c +index 9fa3fa99b4c20..897b349cdaf1c 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_adminq.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_adminq.c +@@ -324,6 +324,7 @@ static enum iavf_status iavf_config_arq_regs(struct iavf_hw *hw) + static enum iavf_status iavf_init_asq(struct iavf_hw *hw) + { + enum iavf_status ret_code = 0; ++ int i; + + if (hw->aq.asq.count > 0) { + /* queue already initialized */ +@@ -354,12 +355,17 @@ static enum iavf_status iavf_init_asq(struct iavf_hw *hw) + /* initialize base registers */ + ret_code = iavf_config_asq_regs(hw); + if (ret_code) +- goto init_adminq_free_rings; ++ goto init_free_asq_bufs; + + /* success! */ + hw->aq.asq.count = hw->aq.num_asq_entries; + goto init_adminq_exit; + ++init_free_asq_bufs: ++ for (i = 0; i < hw->aq.num_asq_entries; i++) ++ iavf_free_dma_mem(hw, &hw->aq.asq.r.asq_bi[i]); ++ iavf_free_virt_mem(hw, &hw->aq.asq.dma_head); ++ + init_adminq_free_rings: + iavf_free_adminq_asq(hw); + +@@ -383,6 +389,7 @@ init_adminq_exit: + static enum iavf_status iavf_init_arq(struct iavf_hw *hw) + { + enum iavf_status ret_code = 0; ++ int i; + + if (hw->aq.arq.count > 0) { + /* queue already initialized */ +@@ -413,12 +420,16 @@ static enum iavf_status iavf_init_arq(struct iavf_hw *hw) + /* initialize base registers */ + ret_code = iavf_config_arq_regs(hw); + if (ret_code) +- goto init_adminq_free_rings; ++ goto init_free_arq_bufs; + + /* success! */ + hw->aq.arq.count = hw->aq.num_arq_entries; + goto init_adminq_exit; + ++init_free_arq_bufs: ++ for (i = 0; i < hw->aq.num_arq_entries; i++) ++ iavf_free_dma_mem(hw, &hw->aq.arq.r.arq_bi[i]); ++ iavf_free_virt_mem(hw, &hw->aq.arq.dma_head); + init_adminq_free_rings: + iavf_free_adminq_arq(hw); + +diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c +index e8850ba5604c4..4c41bb47fc1a6 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_main.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_main.c +@@ -2581,6 +2581,7 @@ static int iavf_validate_ch_config(struct iavf_adapter *adapter, + struct tc_mqprio_qopt_offload *mqprio_qopt) + { + u64 total_max_rate = 0; ++ u32 tx_rate_rem = 0; + int i, num_qps = 0; + u64 tx_rate = 0; + int ret = 0; +@@ -2595,12 +2596,32 @@ static int iavf_validate_ch_config(struct iavf_adapter *adapter, + return -EINVAL; + if (mqprio_qopt->min_rate[i]) { + dev_err(&adapter->pdev->dev, +- "Invalid min tx rate (greater than 0) specified\n"); ++ "Invalid min tx rate (greater than 0) specified for TC%d\n", ++ i); + return -EINVAL; + } +- /*convert to Mbps */ ++ ++ /* convert to Mbps */ + tx_rate = div_u64(mqprio_qopt->max_rate[i], + IAVF_MBPS_DIVISOR); ++ ++ if (mqprio_qopt->max_rate[i] && ++ tx_rate < IAVF_MBPS_QUANTA) { ++ dev_err(&adapter->pdev->dev, ++ "Invalid max tx rate for TC%d, minimum %dMbps\n", ++ i, IAVF_MBPS_QUANTA); ++ return -EINVAL; ++ } ++ ++ (void)div_u64_rem(tx_rate, IAVF_MBPS_QUANTA, &tx_rate_rem); ++ ++ if (tx_rate_rem != 0) { ++ dev_err(&adapter->pdev->dev, ++ "Invalid max tx rate for TC%d, not divisible by %d\n", ++ i, IAVF_MBPS_QUANTA); ++ return -EINVAL; ++ } ++ + total_max_rate += tx_rate; + num_qps += mqprio_qopt->qopt.count[i]; + } +diff --git a/drivers/net/ethernet/intel/ice/ice_switch.c b/drivers/net/ethernet/intel/ice/ice_switch.c +index 7ff2e07f6d38a..0c71995e1a70b 100644 +--- a/drivers/net/ethernet/intel/ice/ice_switch.c ++++ b/drivers/net/ethernet/intel/ice/ice_switch.c +@@ -2627,7 +2627,7 @@ ice_set_vlan_vsi_promisc(struct ice_hw *hw, u16 vsi_handle, u8 promisc_mask, + else + status = ice_set_vsi_promisc(hw, vsi_handle, + promisc_mask, vlan_id); +- if (status) ++ if (status && status != -EEXIST) + break; + } + +diff --git a/drivers/net/ethernet/intel/igb/igb.h b/drivers/net/ethernet/intel/igb/igb.h +index ca54e268d157b..33cbe4f70d590 100644 +--- a/drivers/net/ethernet/intel/igb/igb.h ++++ b/drivers/net/ethernet/intel/igb/igb.h +@@ -594,6 +594,8 @@ struct igb_adapter { + struct igb_mac_addr *mac_table; + struct vf_mac_filter vf_macs; + struct vf_mac_filter *vf_mac_list; ++ /* lock for VF resources */ ++ spinlock_t vfs_lock; + }; + + /* flags controlling PTP/1588 function */ +diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c +index 8734dfd001bbd..f718eadd87744 100644 +--- a/drivers/net/ethernet/intel/igb/igb_main.c ++++ b/drivers/net/ethernet/intel/igb/igb_main.c +@@ -3491,6 +3491,7 @@ static int igb_disable_sriov(struct pci_dev *pdev) + struct net_device *netdev = pci_get_drvdata(pdev); + struct igb_adapter *adapter = netdev_priv(netdev); + struct e1000_hw *hw = &adapter->hw; ++ unsigned long flags; + + /* reclaim resources allocated to VFs */ + if (adapter->vf_data) { +@@ -3503,12 +3504,13 @@ static int igb_disable_sriov(struct pci_dev *pdev) + pci_disable_sriov(pdev); + msleep(500); + } +- ++ spin_lock_irqsave(&adapter->vfs_lock, flags); + kfree(adapter->vf_mac_list); + adapter->vf_mac_list = NULL; + kfree(adapter->vf_data); + adapter->vf_data = NULL; + adapter->vfs_allocated_count = 0; ++ spin_unlock_irqrestore(&adapter->vfs_lock, flags); + wr32(E1000_IOVCTL, E1000_IOVCTL_REUSE_VFQ); + wrfl(); + msleep(100); +@@ -3668,7 +3670,9 @@ static void igb_remove(struct pci_dev *pdev) + igb_release_hw_control(adapter); + + #ifdef CONFIG_PCI_IOV ++ rtnl_lock(); + igb_disable_sriov(pdev); ++ rtnl_unlock(); + #endif + + unregister_netdev(netdev); +@@ -3829,6 +3833,9 @@ static int igb_sw_init(struct igb_adapter *adapter) + + spin_lock_init(&adapter->nfc_lock); + spin_lock_init(&adapter->stats64_lock); ++ ++ /* init spinlock to avoid concurrency of VF resources */ ++ spin_lock_init(&adapter->vfs_lock); + #ifdef CONFIG_PCI_IOV + switch (hw->mac.type) { + case e1000_82576: +@@ -7569,8 +7576,10 @@ unlock: + static void igb_msg_task(struct igb_adapter *adapter) + { + struct e1000_hw *hw = &adapter->hw; ++ unsigned long flags; + u32 vf; + ++ spin_lock_irqsave(&adapter->vfs_lock, flags); + for (vf = 0; vf < adapter->vfs_allocated_count; vf++) { + /* process any reset requests */ + if (!igb_check_for_rst(hw, vf)) +@@ -7584,6 +7593,7 @@ static void igb_msg_task(struct igb_adapter *adapter) + if (!igb_check_for_ack(hw, vf)) + igb_rcv_ack_from_vf(adapter, vf); + } ++ spin_unlock_irqrestore(&adapter->vfs_lock, flags); + } + + /** +diff --git a/drivers/net/ethernet/intel/igc/igc_base.c b/drivers/net/ethernet/intel/igc/igc_base.c +index db289bcce21d3..d66429eb14a59 100644 +--- a/drivers/net/ethernet/intel/igc/igc_base.c ++++ b/drivers/net/ethernet/intel/igc/igc_base.c +@@ -187,15 +187,7 @@ static s32 igc_init_phy_params_base(struct igc_hw *hw) + + igc_check_for_copper_link(hw); + +- /* Verify phy id and set remaining function pointers */ +- switch (phy->id) { +- case I225_I_PHY_ID: +- phy->type = igc_phy_i225; +- break; +- default: +- ret_val = -IGC_ERR_PHY; +- goto out; +- } ++ phy->type = igc_phy_i225; + + out: + return ret_val; +diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c +index 9ba05d9aa8e08..b8297a63a7fd2 100644 +--- a/drivers/net/ethernet/intel/igc/igc_main.c ++++ b/drivers/net/ethernet/intel/igc/igc_main.c +@@ -2884,8 +2884,7 @@ bool igc_has_link(struct igc_adapter *adapter) + break; + } + +- if (hw->mac.type == igc_i225 && +- hw->phy.id == I225_I_PHY_ID) { ++ if (hw->mac.type == igc_i225) { + if (!netif_carrier_ok(adapter->netdev)) { + adapter->flags &= ~IGC_FLAG_NEED_LINK_UPDATE; + } else if (!(adapter->flags & IGC_FLAG_NEED_LINK_UPDATE)) { +diff --git a/drivers/net/ethernet/intel/igc/igc_phy.c b/drivers/net/ethernet/intel/igc/igc_phy.c +index 6156c76d765ff..1be112ce6774b 100644 +--- a/drivers/net/ethernet/intel/igc/igc_phy.c ++++ b/drivers/net/ethernet/intel/igc/igc_phy.c +@@ -235,8 +235,7 @@ static s32 igc_phy_setup_autoneg(struct igc_hw *hw) + return ret_val; + } + +- if ((phy->autoneg_mask & ADVERTISE_2500_FULL) && +- hw->phy.id == I225_I_PHY_ID) { ++ if (phy->autoneg_mask & ADVERTISE_2500_FULL) { + /* Read the MULTI GBT AN Control Register - reg 7.32 */ + ret_val = phy->ops.read_reg(hw, (STANDARD_AN_REG_MASK << + MMD_DEVADDR_SHIFT) | +@@ -376,8 +375,7 @@ static s32 igc_phy_setup_autoneg(struct igc_hw *hw) + ret_val = phy->ops.write_reg(hw, PHY_1000T_CTRL, + mii_1000t_ctrl_reg); + +- if ((phy->autoneg_mask & ADVERTISE_2500_FULL) && +- hw->phy.id == I225_I_PHY_ID) ++ if (phy->autoneg_mask & ADVERTISE_2500_FULL) + ret_val = phy->ops.write_reg(hw, + (STANDARD_AN_REG_MASK << + MMD_DEVADDR_SHIFT) | +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h +index b5c8afe8cd10d..3209decdcff02 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h +@@ -101,7 +101,7 @@ struct page_pool; + #define MLX5E_LOG_ALIGNED_MPWQE_PPW (ilog2(MLX5E_REQUIRED_WQE_MTTS)) + #define MLX5E_REQUIRED_MTTS(wqes) (wqes * MLX5E_REQUIRED_WQE_MTTS) + #define MLX5E_MAX_RQ_NUM_MTTS \ +- ((1 << 16) * 2) /* So that MLX5_MTT_OCTW(num_mtts) fits into u16 */ ++ (ALIGN_DOWN(U16_MAX, 4) * 2) /* So that MLX5_MTT_OCTW(num_mtts) fits into u16 */ + #define MLX5E_ORDER2_MAX_PACKET_MTU (order_base_2(10 * 1024)) + #define MLX5E_PARAMS_MAXIMUM_LOG_RQ_SIZE_MPW \ + (ilog2(MLX5E_MAX_RQ_NUM_MTTS / MLX5E_REQUIRED_WQE_MTTS)) +diff --git a/drivers/net/ethernet/moxa/moxart_ether.c b/drivers/net/ethernet/moxa/moxart_ether.c +index 13714827f4525..383d72415c659 100644 +--- a/drivers/net/ethernet/moxa/moxart_ether.c ++++ b/drivers/net/ethernet/moxa/moxart_ether.c +@@ -77,7 +77,7 @@ static void moxart_mac_free_memory(struct net_device *ndev) + int i; + + for (i = 0; i < RX_DESC_NUM; i++) +- dma_unmap_single(&ndev->dev, priv->rx_mapping[i], ++ dma_unmap_single(&priv->pdev->dev, priv->rx_mapping[i], + priv->rx_buf_size, DMA_FROM_DEVICE); + + if (priv->tx_desc_base) +@@ -147,11 +147,11 @@ static void moxart_mac_setup_desc_ring(struct net_device *ndev) + desc + RX_REG_OFFSET_DESC1); + + priv->rx_buf[i] = priv->rx_buf_base + priv->rx_buf_size * i; +- priv->rx_mapping[i] = dma_map_single(&ndev->dev, ++ priv->rx_mapping[i] = dma_map_single(&priv->pdev->dev, + priv->rx_buf[i], + priv->rx_buf_size, + DMA_FROM_DEVICE); +- if (dma_mapping_error(&ndev->dev, priv->rx_mapping[i])) ++ if (dma_mapping_error(&priv->pdev->dev, priv->rx_mapping[i])) + netdev_err(ndev, "DMA mapping error\n"); + + moxart_desc_write(priv->rx_mapping[i], +@@ -240,7 +240,7 @@ static int moxart_rx_poll(struct napi_struct *napi, int budget) + if (len > RX_BUF_SIZE) + len = RX_BUF_SIZE; + +- dma_sync_single_for_cpu(&ndev->dev, ++ dma_sync_single_for_cpu(&priv->pdev->dev, + priv->rx_mapping[rx_head], + priv->rx_buf_size, DMA_FROM_DEVICE); + skb = netdev_alloc_skb_ip_align(ndev, len); +@@ -294,7 +294,7 @@ static void moxart_tx_finished(struct net_device *ndev) + unsigned int tx_tail = priv->tx_tail; + + while (tx_tail != tx_head) { +- dma_unmap_single(&ndev->dev, priv->tx_mapping[tx_tail], ++ dma_unmap_single(&priv->pdev->dev, priv->tx_mapping[tx_tail], + priv->tx_len[tx_tail], DMA_TO_DEVICE); + + ndev->stats.tx_packets++; +@@ -357,9 +357,9 @@ static int moxart_mac_start_xmit(struct sk_buff *skb, struct net_device *ndev) + + len = skb->len > TX_BUF_SIZE ? TX_BUF_SIZE : skb->len; + +- priv->tx_mapping[tx_head] = dma_map_single(&ndev->dev, skb->data, ++ priv->tx_mapping[tx_head] = dma_map_single(&priv->pdev->dev, skb->data, + len, DMA_TO_DEVICE); +- if (dma_mapping_error(&ndev->dev, priv->tx_mapping[tx_head])) { ++ if (dma_mapping_error(&priv->pdev->dev, priv->tx_mapping[tx_head])) { + netdev_err(ndev, "DMA mapping error\n"); + goto out_unlock; + } +@@ -378,7 +378,7 @@ static int moxart_mac_start_xmit(struct sk_buff *skb, struct net_device *ndev) + len = ETH_ZLEN; + } + +- dma_sync_single_for_device(&ndev->dev, priv->tx_mapping[tx_head], ++ dma_sync_single_for_device(&priv->pdev->dev, priv->tx_mapping[tx_head], + priv->tx_buf_size, DMA_TO_DEVICE); + + txdes1 = TX_DESC1_LTS | TX_DESC1_FTS | (len & TX_DESC1_BUF_SIZE_MASK); +@@ -498,7 +498,7 @@ static int moxart_mac_probe(struct platform_device *pdev) + priv->tx_buf_size = TX_BUF_SIZE; + priv->rx_buf_size = RX_BUF_SIZE; + +- priv->tx_desc_base = dma_alloc_coherent(&pdev->dev, TX_REG_DESC_SIZE * ++ priv->tx_desc_base = dma_alloc_coherent(p_dev, TX_REG_DESC_SIZE * + TX_DESC_NUM, &priv->tx_base, + GFP_DMA | GFP_KERNEL); + if (!priv->tx_desc_base) { +@@ -506,7 +506,7 @@ static int moxart_mac_probe(struct platform_device *pdev) + goto init_fail; + } + +- priv->rx_desc_base = dma_alloc_coherent(&pdev->dev, RX_REG_DESC_SIZE * ++ priv->rx_desc_base = dma_alloc_coherent(p_dev, RX_REG_DESC_SIZE * + RX_DESC_NUM, &priv->rx_base, + GFP_DMA | GFP_KERNEL); + if (!priv->rx_desc_base) { +diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c +index 10857914c552b..46d6988829ff1 100644 +--- a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c ++++ b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c +@@ -1127,6 +1127,8 @@ nfp_port_get_module_info(struct net_device *netdev, + u8 data; + + port = nfp_port_from_netdev(netdev); ++ /* update port state to get latest interface */ ++ set_bit(NFP_PORT_CHANGED, &port->flags); + eth_port = nfp_port_get_eth_port(port); + if (!eth_port) + return -EOPNOTSUPP; +diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c +index 84f5717c01e2a..5636673b84e7d 100644 +--- a/drivers/net/geneve.c ++++ b/drivers/net/geneve.c +@@ -851,8 +851,7 @@ static struct dst_entry *geneve_get_v6_dst(struct sk_buff *skb, + use_cache = false; + } + +- fl6->flowlabel = ip6_make_flowinfo(RT_TOS(prio), +- info->key.label); ++ fl6->flowlabel = ip6_make_flowinfo(prio, info->key.label); + dst_cache = (struct dst_cache *)&info->dst_cache; + if (use_cache) { + dst = dst_cache_get_ip6(dst_cache, &fl6->saddr); +diff --git a/drivers/net/netdevsim/bpf.c b/drivers/net/netdevsim/bpf.c +index e0a4acc6144bf..8e47755cc1595 100644 +--- a/drivers/net/netdevsim/bpf.c ++++ b/drivers/net/netdevsim/bpf.c +@@ -347,10 +347,12 @@ nsim_map_alloc_elem(struct bpf_offloaded_map *offmap, unsigned int idx) + { + struct nsim_bpf_bound_map *nmap = offmap->dev_priv; + +- nmap->entry[idx].key = kmalloc(offmap->map.key_size, GFP_USER); ++ nmap->entry[idx].key = kmalloc(offmap->map.key_size, ++ GFP_KERNEL_ACCOUNT | __GFP_NOWARN); + if (!nmap->entry[idx].key) + return -ENOMEM; +- nmap->entry[idx].value = kmalloc(offmap->map.value_size, GFP_USER); ++ nmap->entry[idx].value = kmalloc(offmap->map.value_size, ++ GFP_KERNEL_ACCOUNT | __GFP_NOWARN); + if (!nmap->entry[idx].value) { + kfree(nmap->entry[idx].key); + nmap->entry[idx].key = NULL; +@@ -492,7 +494,7 @@ nsim_bpf_map_alloc(struct netdevsim *ns, struct bpf_offloaded_map *offmap) + if (offmap->map.map_flags) + return -EINVAL; + +- nmap = kzalloc(sizeof(*nmap), GFP_USER); ++ nmap = kzalloc(sizeof(*nmap), GFP_KERNEL_ACCOUNT); + if (!nmap) + return -ENOMEM; + +diff --git a/drivers/net/plip/plip.c b/drivers/net/plip/plip.c +index e89cdebae6f13..e8b7d596d7492 100644 +--- a/drivers/net/plip/plip.c ++++ b/drivers/net/plip/plip.c +@@ -1103,7 +1103,7 @@ plip_open(struct net_device *dev) + /* Any address will do - we take the first. We already + have the first two bytes filled with 0xfc, from + plip_init_dev(). */ +- const struct in_ifaddr *ifa = rcu_dereference(in_dev->ifa_list); ++ const struct in_ifaddr *ifa = rtnl_dereference(in_dev->ifa_list); + if (ifa != NULL) { + memcpy(dev->dev_addr+2, &ifa->ifa_local, 4); + } +diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c +index 5ee3e457a79c7..ea9c8361bf464 100644 +--- a/drivers/net/usb/ax88179_178a.c ++++ b/drivers/net/usb/ax88179_178a.c +@@ -1690,7 +1690,7 @@ static const struct driver_info ax88179_info = { + .link_reset = ax88179_link_reset, + .reset = ax88179_reset, + .stop = ax88179_stop, +- .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP, ++ .flags = FLAG_ETHER | FLAG_FRAMING_AX, + .rx_fixup = ax88179_rx_fixup, + .tx_fixup = ax88179_tx_fixup, + }; +@@ -1703,7 +1703,7 @@ static const struct driver_info ax88178a_info = { + .link_reset = ax88179_link_reset, + .reset = ax88179_reset, + .stop = ax88179_stop, +- .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP, ++ .flags = FLAG_ETHER | FLAG_FRAMING_AX, + .rx_fixup = ax88179_rx_fixup, + .tx_fixup = ax88179_tx_fixup, + }; +@@ -1716,7 +1716,7 @@ static const struct driver_info cypress_GX3_info = { + .link_reset = ax88179_link_reset, + .reset = ax88179_reset, + .stop = ax88179_stop, +- .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP, ++ .flags = FLAG_ETHER | FLAG_FRAMING_AX, + .rx_fixup = ax88179_rx_fixup, + .tx_fixup = ax88179_tx_fixup, + }; +@@ -1729,7 +1729,7 @@ static const struct driver_info dlink_dub1312_info = { + .link_reset = ax88179_link_reset, + .reset = ax88179_reset, + .stop = ax88179_stop, +- .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP, ++ .flags = FLAG_ETHER | FLAG_FRAMING_AX, + .rx_fixup = ax88179_rx_fixup, + .tx_fixup = ax88179_tx_fixup, + }; +@@ -1742,7 +1742,7 @@ static const struct driver_info sitecom_info = { + .link_reset = ax88179_link_reset, + .reset = ax88179_reset, + .stop = ax88179_stop, +- .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP, ++ .flags = FLAG_ETHER | FLAG_FRAMING_AX, + .rx_fixup = ax88179_rx_fixup, + .tx_fixup = ax88179_tx_fixup, + }; +@@ -1755,7 +1755,7 @@ static const struct driver_info samsung_info = { + .link_reset = ax88179_link_reset, + .reset = ax88179_reset, + .stop = ax88179_stop, +- .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP, ++ .flags = FLAG_ETHER | FLAG_FRAMING_AX, + .rx_fixup = ax88179_rx_fixup, + .tx_fixup = ax88179_tx_fixup, + }; +@@ -1768,7 +1768,7 @@ static const struct driver_info lenovo_info = { + .link_reset = ax88179_link_reset, + .reset = ax88179_reset, + .stop = ax88179_stop, +- .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP, ++ .flags = FLAG_ETHER | FLAG_FRAMING_AX, + .rx_fixup = ax88179_rx_fixup, + .tx_fixup = ax88179_tx_fixup, + }; +@@ -1781,7 +1781,7 @@ static const struct driver_info belkin_info = { + .link_reset = ax88179_link_reset, + .reset = ax88179_reset, + .stop = ax88179_stop, +- .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP, ++ .flags = FLAG_ETHER | FLAG_FRAMING_AX, + .rx_fixup = ax88179_rx_fixup, + .tx_fixup = ax88179_tx_fixup, + }; +diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c +index 6598a4cba158a..7a8324d2a9686 100644 +--- a/drivers/net/usb/usbnet.c ++++ b/drivers/net/usb/usbnet.c +@@ -833,13 +833,11 @@ int usbnet_stop (struct net_device *net) + + mpn = !test_and_clear_bit(EVENT_NO_RUNTIME_PM, &dev->flags); + +- /* deferred work (task, timer, softirq) must also stop. +- * can't flush_scheduled_work() until we drop rtnl (later), +- * else workers could deadlock; so make workers a NOP. +- */ ++ /* deferred work (timer, softirq, task) must also stop */ + dev->flags = 0; + del_timer_sync (&dev->delay); + tasklet_kill (&dev->bh); ++ cancel_work_sync(&dev->kevent); + if (!pm) + usb_autopm_put_interface(dev->intf); + +@@ -1603,8 +1601,6 @@ void usbnet_disconnect (struct usb_interface *intf) + net = dev->net; + unregister_netdev (net); + +- cancel_work_sync(&dev->kevent); +- + usb_scuttle_anchored_urbs(&dev->deferred); + + if (dev->driver_info->unbind) +diff --git a/drivers/net/wireless/ath/ath10k/snoc.c b/drivers/net/wireless/ath/ath10k/snoc.c +index d4589b2ab3b6d..b6762fe2efe26 100644 +--- a/drivers/net/wireless/ath/ath10k/snoc.c ++++ b/drivers/net/wireless/ath/ath10k/snoc.c +@@ -1192,13 +1192,12 @@ static void ath10k_snoc_init_napi(struct ath10k *ar) + static int ath10k_snoc_request_irq(struct ath10k *ar) + { + struct ath10k_snoc *ar_snoc = ath10k_snoc_priv(ar); +- int irqflags = IRQF_TRIGGER_RISING; + int ret, id; + + for (id = 0; id < CE_COUNT_MAX; id++) { + ret = request_irq(ar_snoc->ce_irqs[id].irq_line, +- ath10k_snoc_per_engine_handler, +- irqflags, ce_name[id], ar); ++ ath10k_snoc_per_engine_handler, 0, ++ ce_name[id], ar); + if (ret) { + ath10k_err(ar, + "failed to register IRQ handler for CE %d: %d", +diff --git a/drivers/net/wireless/ath/ath9k/htc.h b/drivers/net/wireless/ath/ath9k/htc.h +index 9f64e32381f94..81107100e3682 100644 +--- a/drivers/net/wireless/ath/ath9k/htc.h ++++ b/drivers/net/wireless/ath/ath9k/htc.h +@@ -325,11 +325,11 @@ static inline struct ath9k_htc_tx_ctl *HTC_SKB_CB(struct sk_buff *skb) + } + + #ifdef CONFIG_ATH9K_HTC_DEBUGFS +- +-#define TX_STAT_INC(c) (hif_dev->htc_handle->drv_priv->debug.tx_stats.c++) +-#define TX_STAT_ADD(c, a) (hif_dev->htc_handle->drv_priv->debug.tx_stats.c += a) +-#define RX_STAT_INC(c) (hif_dev->htc_handle->drv_priv->debug.skbrx_stats.c++) +-#define RX_STAT_ADD(c, a) (hif_dev->htc_handle->drv_priv->debug.skbrx_stats.c += a) ++#define __STAT_SAFE(expr) (hif_dev->htc_handle->drv_priv ? (expr) : 0) ++#define TX_STAT_INC(c) __STAT_SAFE(hif_dev->htc_handle->drv_priv->debug.tx_stats.c++) ++#define TX_STAT_ADD(c, a) __STAT_SAFE(hif_dev->htc_handle->drv_priv->debug.tx_stats.c += a) ++#define RX_STAT_INC(c) __STAT_SAFE(hif_dev->htc_handle->drv_priv->debug.skbrx_stats.c++) ++#define RX_STAT_ADD(c, a) __STAT_SAFE(hif_dev->htc_handle->drv_priv->debug.skbrx_stats.c += a) + #define CAB_STAT_INC priv->debug.tx_stats.cab_queued++ + + #define TX_QSTAT_INC(q) (priv->debug.tx_stats.queue_stats[q]++) +diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c +index 11054c17a9b54..eaaafa64a3eef 100644 +--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c ++++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c +@@ -944,7 +944,6 @@ int ath9k_htc_probe_device(struct htc_target *htc_handle, struct device *dev, + priv->hw = hw; + priv->htc = htc_handle; + priv->dev = dev; +- htc_handle->drv_priv = priv; + SET_IEEE80211_DEV(hw, priv->dev); + + ret = ath9k_htc_wait_for_target(priv); +@@ -965,6 +964,8 @@ int ath9k_htc_probe_device(struct htc_target *htc_handle, struct device *dev, + if (ret) + goto err_init; + ++ htc_handle->drv_priv = priv; ++ + return 0; + + err_init: +diff --git a/drivers/net/wireless/ath/wil6210/debugfs.c b/drivers/net/wireless/ath/wil6210/debugfs.c +index 304b4d4e506a2..1e38fdf92d1db 100644 +--- a/drivers/net/wireless/ath/wil6210/debugfs.c ++++ b/drivers/net/wireless/ath/wil6210/debugfs.c +@@ -1021,20 +1021,14 @@ static ssize_t wil_write_file_wmi(struct file *file, const char __user *buf, + void *cmd; + int cmdlen = len - sizeof(struct wmi_cmd_hdr); + u16 cmdid; +- int rc, rc1; ++ int rc1; + +- if (cmdlen < 0) ++ if (cmdlen < 0 || *ppos != 0) + return -EINVAL; + +- wmi = kmalloc(len, GFP_KERNEL); +- if (!wmi) +- return -ENOMEM; +- +- rc = simple_write_to_buffer(wmi, len, ppos, buf, len); +- if (rc < 0) { +- kfree(wmi); +- return rc; +- } ++ wmi = memdup_user(buf, len); ++ if (IS_ERR(wmi)) ++ return PTR_ERR(wmi); + + cmd = (cmdlen > 0) ? &wmi[1] : NULL; + cmdid = le16_to_cpu(wmi->command_id); +@@ -1044,7 +1038,7 @@ static ssize_t wil_write_file_wmi(struct file *file, const char __user *buf, + + wil_info(wil, "0x%04x[%d] -> %d\n", cmdid, cmdlen, rc1); + +- return rc; ++ return len; + } + + static const struct file_operations fops_wmi = { +diff --git a/drivers/net/wireless/intel/iwlegacy/4965-rs.c b/drivers/net/wireless/intel/iwlegacy/4965-rs.c +index 0a02d8aca3206..ce891ac32388f 100644 +--- a/drivers/net/wireless/intel/iwlegacy/4965-rs.c ++++ b/drivers/net/wireless/intel/iwlegacy/4965-rs.c +@@ -2403,7 +2403,7 @@ il4965_rs_fill_link_cmd(struct il_priv *il, struct il_lq_sta *lq_sta, + /* Repeat initial/next rate. + * For legacy IL_NUMBER_TRY == 1, this loop will not execute. + * For HT IL_HT_NUMBER_TRY == 3, this executes twice. */ +- while (repeat_rate > 0 && idx < LINK_QUAL_MAX_RETRY_NUM) { ++ while (repeat_rate > 0) { + if (is_legacy(tbl_type.lq_type)) { + if (ant_toggle_cnt < NUM_TRY_BEFORE_ANT_TOGGLE) + ant_toggle_cnt++; +@@ -2422,6 +2422,8 @@ il4965_rs_fill_link_cmd(struct il_priv *il, struct il_lq_sta *lq_sta, + cpu_to_le32(new_rate); + repeat_rate--; + idx++; ++ if (idx >= LINK_QUAL_MAX_RETRY_NUM) ++ goto out; + } + + il4965_rs_get_tbl_info_from_mcs(new_rate, lq_sta->band, +@@ -2466,6 +2468,7 @@ il4965_rs_fill_link_cmd(struct il_priv *il, struct il_lq_sta *lq_sta, + repeat_rate--; + } + ++out: + lq_cmd->agg_params.agg_frame_cnt_limit = LINK_QUAL_AGG_FRAME_LIMIT_DEF; + lq_cmd->agg_params.agg_dis_start_th = LINK_QUAL_AGG_DISABLE_START_DEF; + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c +index 5df4bbb6c6de3..a3255100e3fee 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c +@@ -1810,6 +1810,7 @@ static void iwl_mvm_disable_sta_queues(struct iwl_mvm *mvm, + iwl_mvm_txq_from_mac80211(sta->txq[i]); + + mvmtxq->txq_id = IWL_MVM_INVALID_QUEUE; ++ list_del_init(&mvmtxq->list); + } + } + +diff --git a/drivers/net/wireless/intersil/p54/main.c b/drivers/net/wireless/intersil/p54/main.c +index a3ca6620dc0c6..8fa3ec71603e3 100644 +--- a/drivers/net/wireless/intersil/p54/main.c ++++ b/drivers/net/wireless/intersil/p54/main.c +@@ -682,7 +682,7 @@ static void p54_flush(struct ieee80211_hw *dev, struct ieee80211_vif *vif, + * queues have already been stopped and no new frames can sneak + * up from behind. + */ +- while ((total = p54_flush_count(priv) && i--)) { ++ while ((total = p54_flush_count(priv)) && i--) { + /* waste time */ + msleep(20); + } +diff --git a/drivers/net/wireless/intersil/p54/p54spi.c b/drivers/net/wireless/intersil/p54/p54spi.c +index ab0fe85658518..cdb57819684ae 100644 +--- a/drivers/net/wireless/intersil/p54/p54spi.c ++++ b/drivers/net/wireless/intersil/p54/p54spi.c +@@ -164,7 +164,7 @@ static int p54spi_request_firmware(struct ieee80211_hw *dev) + + ret = p54_parse_firmware(dev, priv->firmware); + if (ret) { +- release_firmware(priv->firmware); ++ /* the firmware is released by the caller */ + return ret; + } + +@@ -659,6 +659,7 @@ static int p54spi_probe(struct spi_device *spi) + return 0; + + err_free_common: ++ release_firmware(priv->firmware); + free_irq(gpio_to_irq(p54spi_gpio_irq), spi); + err_free_gpio_irq: + gpio_free(p54spi_gpio_irq); +diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c +index ffe27104f654b..6b0ad6b4dd4b1 100644 +--- a/drivers/net/wireless/mac80211_hwsim.c ++++ b/drivers/net/wireless/mac80211_hwsim.c +@@ -527,7 +527,7 @@ struct mac80211_hwsim_data { + bool ps_poll_pending; + struct dentry *debugfs; + +- uintptr_t pending_cookie; ++ atomic_t pending_cookie; + struct sk_buff_head pending; /* packets pending */ + /* + * Only radios in the same group can communicate together (the +@@ -1113,8 +1113,7 @@ static void mac80211_hwsim_tx_frame_nl(struct ieee80211_hw *hw, + goto nla_put_failure; + + /* We create a cookie to identify this skb */ +- data->pending_cookie++; +- cookie = data->pending_cookie; ++ cookie = atomic_inc_return(&data->pending_cookie); + info->rate_driver_data[0] = (void *)cookie; + if (nla_put_u64_64bit(skb, HWSIM_ATTR_COOKIE, cookie, HWSIM_ATTR_PAD)) + goto nla_put_failure; +@@ -3260,6 +3259,7 @@ static int hwsim_tx_info_frame_received_nl(struct sk_buff *skb_2, + const u8 *src; + unsigned int hwsim_flags; + int i; ++ unsigned long flags; + bool found = false; + + if (!info->attrs[HWSIM_ATTR_ADDR_TRANSMITTER] || +@@ -3284,18 +3284,20 @@ static int hwsim_tx_info_frame_received_nl(struct sk_buff *skb_2, + goto out; + + /* look for the skb matching the cookie passed back from user */ ++ spin_lock_irqsave(&data2->pending.lock, flags); + skb_queue_walk_safe(&data2->pending, skb, tmp) { +- u64 skb_cookie; ++ uintptr_t skb_cookie; + + txi = IEEE80211_SKB_CB(skb); +- skb_cookie = (u64)(uintptr_t)txi->rate_driver_data[0]; ++ skb_cookie = (uintptr_t)txi->rate_driver_data[0]; + + if (skb_cookie == ret_skb_cookie) { +- skb_unlink(skb, &data2->pending); ++ __skb_unlink(skb, &data2->pending); + found = true; + break; + } + } ++ spin_unlock_irqrestore(&data2->pending.lock, flags); + + /* not found */ + if (!found) +diff --git a/drivers/net/wireless/marvell/libertas/if_usb.c b/drivers/net/wireless/marvell/libertas/if_usb.c +index 5d6dc1dd050d4..32fdc4150b605 100644 +--- a/drivers/net/wireless/marvell/libertas/if_usb.c ++++ b/drivers/net/wireless/marvell/libertas/if_usb.c +@@ -287,6 +287,7 @@ static int if_usb_probe(struct usb_interface *intf, + return 0; + + err_get_fw: ++ usb_put_dev(udev); + lbs_remove_card(priv); + err_add_card: + if_usb_reset_device(cardp); +diff --git a/drivers/net/wireless/mediatek/mt76/mac80211.c b/drivers/net/wireless/mediatek/mt76/mac80211.c +index 8bd191347b9fb..179337eb39ba3 100644 +--- a/drivers/net/wireless/mediatek/mt76/mac80211.c ++++ b/drivers/net/wireless/mediatek/mt76/mac80211.c +@@ -103,6 +103,7 @@ static int mt76_led_init(struct mt76_dev *dev) + if (!of_property_read_u32(np, "led-sources", &led_pin)) + dev->led_pin = led_pin; + dev->led_al = of_property_read_bool(np, "led-active-low"); ++ of_node_put(np); + } + + return led_classdev_register(dev->dev, &dev->led_cdev); +diff --git a/drivers/net/wireless/realtek/rtlwifi/debug.c b/drivers/net/wireless/realtek/rtlwifi/debug.c +index 55db71c766fe3..ec0da33da4f89 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/debug.c ++++ b/drivers/net/wireless/realtek/rtlwifi/debug.c +@@ -349,8 +349,8 @@ static ssize_t rtl_debugfs_set_write_h2c(struct file *filp, + + tmp_len = (count > sizeof(tmp) - 1 ? sizeof(tmp) - 1 : count); + +- if (!buffer || copy_from_user(tmp, buffer, tmp_len)) +- return count; ++ if (copy_from_user(tmp, buffer, tmp_len)) ++ return -EFAULT; + + tmp[tmp_len] = '\0'; + +@@ -360,8 +360,8 @@ static ssize_t rtl_debugfs_set_write_h2c(struct file *filp, + &h2c_data[4], &h2c_data[5], + &h2c_data[6], &h2c_data[7]); + +- if (h2c_len <= 0) +- return count; ++ if (h2c_len == 0) ++ return -EINVAL; + + for (i = 0; i < h2c_len; i++) + h2c_data_packed[i] = (u8)h2c_data[i]; +diff --git a/drivers/ntb/test/ntb_tool.c b/drivers/ntb/test/ntb_tool.c +index 311d6ab8d0160..6301aa413c3b8 100644 +--- a/drivers/ntb/test/ntb_tool.c ++++ b/drivers/ntb/test/ntb_tool.c +@@ -367,14 +367,16 @@ static ssize_t tool_fn_write(struct tool_ctx *tc, + u64 bits; + int n; + ++ if (*offp) ++ return 0; ++ + buf = kmalloc(size + 1, GFP_KERNEL); + if (!buf) + return -ENOMEM; + +- ret = simple_write_to_buffer(buf, size, offp, ubuf, size); +- if (ret < 0) { ++ if (copy_from_user(buf, ubuf, size)) { + kfree(buf); +- return ret; ++ return -EFAULT; + } + + buf[size] = 0; +diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c +index 4341c72446628..e9512d077b8a8 100644 +--- a/drivers/nvme/target/tcp.c ++++ b/drivers/nvme/target/tcp.c +@@ -1762,7 +1762,8 @@ static int __init nvmet_tcp_init(void) + { + int ret; + +- nvmet_tcp_wq = alloc_workqueue("nvmet_tcp_wq", WQ_HIGHPRI, 0); ++ nvmet_tcp_wq = alloc_workqueue("nvmet_tcp_wq", ++ WQ_MEM_RECLAIM | WQ_HIGHPRI, 0); + if (!nvmet_tcp_wq) + return -ENOMEM; + +diff --git a/drivers/opp/core.c b/drivers/opp/core.c +index 088c93dc0085c..08f5d1c3d6651 100644 +--- a/drivers/opp/core.c ++++ b/drivers/opp/core.c +@@ -1881,8 +1881,8 @@ struct opp_table *dev_pm_opp_attach_genpd(struct device *dev, + } + + virt_dev = dev_pm_domain_attach_by_name(dev, *name); +- if (IS_ERR(virt_dev)) { +- ret = PTR_ERR(virt_dev); ++ if (IS_ERR_OR_NULL(virt_dev)) { ++ ret = PTR_ERR(virt_dev) ? : -ENODEV; + dev_err(dev, "Couldn't attach to pm_domain: %d\n", ret); + goto err; + } +diff --git a/drivers/pci/controller/dwc/pcie-tegra194.c b/drivers/pci/controller/dwc/pcie-tegra194.c +index c06b05ab9f787..120d64c1a27fd 100644 +--- a/drivers/pci/controller/dwc/pcie-tegra194.c ++++ b/drivers/pci/controller/dwc/pcie-tegra194.c +@@ -345,15 +345,14 @@ static irqreturn_t tegra_pcie_rp_irq_handler(struct tegra_pcie_dw *pcie) + { + struct dw_pcie *pci = &pcie->pci; + struct pcie_port *pp = &pci->pp; +- u32 val, tmp; ++ u32 val, status_l0, status_l1; + u16 val_w; + +- val = appl_readl(pcie, APPL_INTR_STATUS_L0); +- if (val & APPL_INTR_STATUS_L0_LINK_STATE_INT) { +- val = appl_readl(pcie, APPL_INTR_STATUS_L1_0_0); +- if (val & APPL_INTR_STATUS_L1_0_0_LINK_REQ_RST_NOT_CHGED) { +- appl_writel(pcie, val, APPL_INTR_STATUS_L1_0_0); +- ++ status_l0 = appl_readl(pcie, APPL_INTR_STATUS_L0); ++ if (status_l0 & APPL_INTR_STATUS_L0_LINK_STATE_INT) { ++ status_l1 = appl_readl(pcie, APPL_INTR_STATUS_L1_0_0); ++ appl_writel(pcie, status_l1, APPL_INTR_STATUS_L1_0_0); ++ if (status_l1 & APPL_INTR_STATUS_L1_0_0_LINK_REQ_RST_NOT_CHGED) { + /* SBR & Surprise Link Down WAR */ + val = appl_readl(pcie, APPL_CAR_RESET_OVRD); + val &= ~APPL_CAR_RESET_OVRD_CYA_OVERRIDE_CORE_RST_N; +@@ -369,15 +368,15 @@ static irqreturn_t tegra_pcie_rp_irq_handler(struct tegra_pcie_dw *pcie) + } + } + +- if (val & APPL_INTR_STATUS_L0_INT_INT) { +- val = appl_readl(pcie, APPL_INTR_STATUS_L1_8_0); +- if (val & APPL_INTR_STATUS_L1_8_0_AUTO_BW_INT_STS) { ++ if (status_l0 & APPL_INTR_STATUS_L0_INT_INT) { ++ status_l1 = appl_readl(pcie, APPL_INTR_STATUS_L1_8_0); ++ if (status_l1 & APPL_INTR_STATUS_L1_8_0_AUTO_BW_INT_STS) { + appl_writel(pcie, + APPL_INTR_STATUS_L1_8_0_AUTO_BW_INT_STS, + APPL_INTR_STATUS_L1_8_0); + apply_bad_link_workaround(pp); + } +- if (val & APPL_INTR_STATUS_L1_8_0_BW_MGT_INT_STS) { ++ if (status_l1 & APPL_INTR_STATUS_L1_8_0_BW_MGT_INT_STS) { + appl_writel(pcie, + APPL_INTR_STATUS_L1_8_0_BW_MGT_INT_STS, + APPL_INTR_STATUS_L1_8_0); +@@ -389,25 +388,24 @@ static irqreturn_t tegra_pcie_rp_irq_handler(struct tegra_pcie_dw *pcie) + } + } + +- val = appl_readl(pcie, APPL_INTR_STATUS_L0); +- if (val & APPL_INTR_STATUS_L0_CDM_REG_CHK_INT) { +- val = appl_readl(pcie, APPL_INTR_STATUS_L1_18); +- tmp = dw_pcie_readl_dbi(pci, PCIE_PL_CHK_REG_CONTROL_STATUS); +- if (val & APPL_INTR_STATUS_L1_18_CDM_REG_CHK_CMPLT) { ++ if (status_l0 & APPL_INTR_STATUS_L0_CDM_REG_CHK_INT) { ++ status_l1 = appl_readl(pcie, APPL_INTR_STATUS_L1_18); ++ val = dw_pcie_readl_dbi(pci, PCIE_PL_CHK_REG_CONTROL_STATUS); ++ if (status_l1 & APPL_INTR_STATUS_L1_18_CDM_REG_CHK_CMPLT) { + dev_info(pci->dev, "CDM check complete\n"); +- tmp |= PCIE_PL_CHK_REG_CHK_REG_COMPLETE; ++ val |= PCIE_PL_CHK_REG_CHK_REG_COMPLETE; + } +- if (val & APPL_INTR_STATUS_L1_18_CDM_REG_CHK_CMP_ERR) { ++ if (status_l1 & APPL_INTR_STATUS_L1_18_CDM_REG_CHK_CMP_ERR) { + dev_err(pci->dev, "CDM comparison mismatch\n"); +- tmp |= PCIE_PL_CHK_REG_CHK_REG_COMPARISON_ERROR; ++ val |= PCIE_PL_CHK_REG_CHK_REG_COMPARISON_ERROR; + } +- if (val & APPL_INTR_STATUS_L1_18_CDM_REG_CHK_LOGIC_ERR) { ++ if (status_l1 & APPL_INTR_STATUS_L1_18_CDM_REG_CHK_LOGIC_ERR) { + dev_err(pci->dev, "CDM Logic error\n"); +- tmp |= PCIE_PL_CHK_REG_CHK_REG_LOGIC_ERROR; ++ val |= PCIE_PL_CHK_REG_CHK_REG_LOGIC_ERROR; + } +- dw_pcie_writel_dbi(pci, PCIE_PL_CHK_REG_CONTROL_STATUS, tmp); +- tmp = dw_pcie_readl_dbi(pci, PCIE_PL_CHK_REG_ERR_ADDR); +- dev_err(pci->dev, "CDM Error Address Offset = 0x%08X\n", tmp); ++ dw_pcie_writel_dbi(pci, PCIE_PL_CHK_REG_CONTROL_STATUS, val); ++ val = dw_pcie_readl_dbi(pci, PCIE_PL_CHK_REG_ERR_ADDR); ++ dev_err(pci->dev, "CDM Error Address Offset = 0x%08X\n", val); + } + + return IRQ_HANDLED; +@@ -856,7 +854,7 @@ static int tegra_pcie_dw_host_init(struct pcie_port *pp) + offset = dw_pcie_find_ext_capability(pci, PCI_EXT_CAP_ID_DLF); + val = dw_pcie_readl_dbi(pci, offset + PCI_DLF_CAP); + val &= ~PCI_DLF_EXCHANGE_ENABLE; +- dw_pcie_writel_dbi(pci, offset, val); ++ dw_pcie_writel_dbi(pci, offset + PCI_DLF_CAP, val); + + tegra_pcie_prepare_host(pp); + +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index 2a4bc8df85639..8b98b7f3eb246 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -4943,6 +4943,9 @@ static const struct pci_dev_acs_enabled { + { PCI_VENDOR_ID_AMPERE, 0xE00C, pci_quirk_xgene_acs }, + /* Broadcom multi-function device */ + { PCI_VENDOR_ID_BROADCOM, 0x16D7, pci_quirk_mf_endpoint_acs }, ++ { PCI_VENDOR_ID_BROADCOM, 0x1750, pci_quirk_mf_endpoint_acs }, ++ { PCI_VENDOR_ID_BROADCOM, 0x1751, pci_quirk_mf_endpoint_acs }, ++ { PCI_VENDOR_ID_BROADCOM, 0x1752, pci_quirk_mf_endpoint_acs }, + { PCI_VENDOR_ID_BROADCOM, 0xD714, pci_quirk_brcm_acs }, + /* Amazon Annapurna Labs */ + { PCI_VENDOR_ID_AMAZON_ANNAPURNA_LABS, 0x0031, pci_quirk_al_acs }, +diff --git a/drivers/pinctrl/nomadik/pinctrl-nomadik.c b/drivers/pinctrl/nomadik/pinctrl-nomadik.c +index 9f00adfefba8e..5d7e368a1e7e8 100644 +--- a/drivers/pinctrl/nomadik/pinctrl-nomadik.c ++++ b/drivers/pinctrl/nomadik/pinctrl-nomadik.c +@@ -1461,8 +1461,10 @@ static int nmk_pinctrl_dt_subnode_to_map(struct pinctrl_dev *pctldev, + + has_config = nmk_pinctrl_dt_get_config(np, &configs); + np_config = of_parse_phandle(np, "ste,config", 0); +- if (np_config) ++ if (np_config) { + has_config |= nmk_pinctrl_dt_get_config(np_config, &configs); ++ of_node_put(np_config); ++ } + if (has_config) { + const char *gpio_name; + const char *pin; +diff --git a/drivers/pinctrl/qcom/pinctrl-msm8916.c b/drivers/pinctrl/qcom/pinctrl-msm8916.c +index 396db12ae9048..bf68913ba8212 100644 +--- a/drivers/pinctrl/qcom/pinctrl-msm8916.c ++++ b/drivers/pinctrl/qcom/pinctrl-msm8916.c +@@ -844,8 +844,8 @@ static const struct msm_pingroup msm8916_groups[] = { + PINGROUP(28, pwr_modem_enabled_a, NA, NA, NA, NA, NA, qdss_tracedata_b, NA, atest_combodac), + PINGROUP(29, cci_i2c, NA, NA, NA, NA, NA, qdss_tracedata_b, NA, atest_combodac), + PINGROUP(30, cci_i2c, NA, NA, NA, NA, NA, NA, NA, qdss_tracedata_b), +- PINGROUP(31, cci_timer0, NA, NA, NA, NA, NA, NA, NA, NA), +- PINGROUP(32, cci_timer1, NA, NA, NA, NA, NA, NA, NA, NA), ++ PINGROUP(31, cci_timer0, flash_strobe, NA, NA, NA, NA, NA, NA, NA), ++ PINGROUP(32, cci_timer1, flash_strobe, NA, NA, NA, NA, NA, NA, NA), + PINGROUP(33, cci_async, NA, NA, NA, NA, NA, NA, NA, qdss_tracedata_b), + PINGROUP(34, pwr_nav_enabled_a, NA, NA, NA, NA, NA, NA, NA, qdss_tracedata_b), + PINGROUP(35, pwr_crypto_enabled_a, NA, NA, NA, NA, NA, NA, NA, qdss_tracedata_b), +diff --git a/drivers/pinctrl/sunxi/pinctrl-sun50i-h6-r.c b/drivers/pinctrl/sunxi/pinctrl-sun50i-h6-r.c +index 4557e18d59899..12c40f9c1a247 100644 +--- a/drivers/pinctrl/sunxi/pinctrl-sun50i-h6-r.c ++++ b/drivers/pinctrl/sunxi/pinctrl-sun50i-h6-r.c +@@ -105,6 +105,7 @@ static const struct sunxi_pinctrl_desc sun50i_h6_r_pinctrl_data = { + .npins = ARRAY_SIZE(sun50i_h6_r_pins), + .pin_base = PL_BASE, + .irq_banks = 2, ++ .io_bias_cfg_variant = BIAS_VOLTAGE_PIO_POW_MODE_SEL, + }; + + static int sun50i_h6_r_pinctrl_probe(struct platform_device *pdev) +diff --git a/drivers/pinctrl/sunxi/pinctrl-sunxi.c b/drivers/pinctrl/sunxi/pinctrl-sunxi.c +index c4052eab6bfcc..8c41f8b818b27 100644 +--- a/drivers/pinctrl/sunxi/pinctrl-sunxi.c ++++ b/drivers/pinctrl/sunxi/pinctrl-sunxi.c +@@ -616,7 +616,7 @@ static int sunxi_pinctrl_set_io_bias_cfg(struct sunxi_pinctrl *pctl, + unsigned pin, + struct regulator *supply) + { +- unsigned short bank = pin / PINS_PER_BANK; ++ unsigned short bank; + unsigned long flags; + u32 val, reg; + int uV; +@@ -632,6 +632,9 @@ static int sunxi_pinctrl_set_io_bias_cfg(struct sunxi_pinctrl *pctl, + if (uV == 0) + return 0; + ++ pin -= pctl->desc->pin_base; ++ bank = pin / PINS_PER_BANK; ++ + switch (pctl->desc->io_bias_cfg_variant) { + case BIAS_VOLTAGE_GRP_CONFIG: + /* +@@ -649,8 +652,6 @@ static int sunxi_pinctrl_set_io_bias_cfg(struct sunxi_pinctrl *pctl, + else + val = 0xD; /* 3.3V */ + +- pin -= pctl->desc->pin_base; +- + reg = readl(pctl->membase + sunxi_grp_config_reg(pin)); + reg &= ~IO_BIAS_MASK; + writel(reg | val, pctl->membase + sunxi_grp_config_reg(pin)); +diff --git a/drivers/platform/olpc/olpc-ec.c b/drivers/platform/olpc/olpc-ec.c +index 2db7113383fdc..89d9fca02fe9d 100644 +--- a/drivers/platform/olpc/olpc-ec.c ++++ b/drivers/platform/olpc/olpc-ec.c +@@ -265,7 +265,7 @@ static ssize_t ec_dbgfs_cmd_write(struct file *file, const char __user *buf, + int i, m; + unsigned char ec_cmd[EC_MAX_CMD_ARGS]; + unsigned int ec_cmd_int[EC_MAX_CMD_ARGS]; +- char cmdbuf[64]; ++ char cmdbuf[64] = ""; + int ec_cmd_bytes; + + mutex_lock(&ec_dbgfs_lock); +diff --git a/drivers/regulator/of_regulator.c b/drivers/regulator/of_regulator.c +index 87637eb6bcbcb..7a0a235e44658 100644 +--- a/drivers/regulator/of_regulator.c ++++ b/drivers/regulator/of_regulator.c +@@ -206,8 +206,12 @@ static int of_get_regulation_constraints(struct device *dev, + } + + suspend_np = of_get_child_by_name(np, regulator_states[i]); +- if (!suspend_np || !suspend_state) ++ if (!suspend_np) + continue; ++ if (!suspend_state) { ++ of_node_put(suspend_np); ++ continue; ++ } + + if (!of_property_read_u32(suspend_np, "regulator-mode", + &pval)) { +diff --git a/drivers/remoteproc/qcom_wcnss.c b/drivers/remoteproc/qcom_wcnss.c +index c72f1b3b60858..18431ac098224 100644 +--- a/drivers/remoteproc/qcom_wcnss.c ++++ b/drivers/remoteproc/qcom_wcnss.c +@@ -407,6 +407,7 @@ static int wcnss_request_irq(struct qcom_wcnss *wcnss, + irq_handler_t thread_fn) + { + int ret; ++ int irq_number; + + ret = platform_get_irq_byname(pdev, name); + if (ret < 0 && optional) { +@@ -417,14 +418,19 @@ static int wcnss_request_irq(struct qcom_wcnss *wcnss, + return ret; + } + ++ irq_number = ret; ++ + ret = devm_request_threaded_irq(&pdev->dev, ret, + NULL, thread_fn, + IRQF_TRIGGER_RISING | IRQF_ONESHOT, + "wcnss", wcnss); +- if (ret) ++ if (ret) { + dev_err(&pdev->dev, "request %s IRQ failed\n", name); ++ return ret; ++ } + +- return ret; ++ /* Return the IRQ number if the IRQ was successfully acquired */ ++ return irq_number; + } + + static int wcnss_alloc_memory_region(struct qcom_wcnss *wcnss) +diff --git a/drivers/rpmsg/qcom_smd.c b/drivers/rpmsg/qcom_smd.c +index a4db9f6100d2f..0b1e853d8c91a 100644 +--- a/drivers/rpmsg/qcom_smd.c ++++ b/drivers/rpmsg/qcom_smd.c +@@ -1364,6 +1364,7 @@ static int qcom_smd_parse_edge(struct device *dev, + } + + edge->ipc_regmap = syscon_node_to_regmap(syscon_np); ++ of_node_put(syscon_np); + if (IS_ERR(edge->ipc_regmap)) { + ret = PTR_ERR(edge->ipc_regmap); + goto put_node; +diff --git a/drivers/s390/char/zcore.c b/drivers/s390/char/zcore.c +index 08f812475f5ed..c9d1725105096 100644 +--- a/drivers/s390/char/zcore.c ++++ b/drivers/s390/char/zcore.c +@@ -53,6 +53,7 @@ static struct dentry *zcore_reipl_file; + static struct dentry *zcore_hsa_file; + static struct ipl_parameter_block *zcore_ipl_block; + ++static DEFINE_MUTEX(hsa_buf_mutex); + static char hsa_buf[PAGE_SIZE] __aligned(PAGE_SIZE); + + /* +@@ -69,19 +70,24 @@ int memcpy_hsa_user(void __user *dest, unsigned long src, size_t count) + if (!hsa_available) + return -ENODATA; + ++ mutex_lock(&hsa_buf_mutex); + while (count) { + if (sclp_sdias_copy(hsa_buf, src / PAGE_SIZE + 2, 1)) { + TRACE("sclp_sdias_copy() failed\n"); ++ mutex_unlock(&hsa_buf_mutex); + return -EIO; + } + offset = src % PAGE_SIZE; + bytes = min(PAGE_SIZE - offset, count); +- if (copy_to_user(dest, hsa_buf + offset, bytes)) ++ if (copy_to_user(dest, hsa_buf + offset, bytes)) { ++ mutex_unlock(&hsa_buf_mutex); + return -EFAULT; ++ } + src += bytes; + dest += bytes; + count -= bytes; + } ++ mutex_unlock(&hsa_buf_mutex); + return 0; + } + +@@ -99,9 +105,11 @@ int memcpy_hsa_kernel(void *dest, unsigned long src, size_t count) + if (!hsa_available) + return -ENODATA; + ++ mutex_lock(&hsa_buf_mutex); + while (count) { + if (sclp_sdias_copy(hsa_buf, src / PAGE_SIZE + 2, 1)) { + TRACE("sclp_sdias_copy() failed\n"); ++ mutex_unlock(&hsa_buf_mutex); + return -EIO; + } + offset = src % PAGE_SIZE; +@@ -111,6 +119,7 @@ int memcpy_hsa_kernel(void *dest, unsigned long src, size_t count) + dest += bytes; + count -= bytes; + } ++ mutex_unlock(&hsa_buf_mutex); + return 0; + } + +diff --git a/drivers/s390/cio/vfio_ccw_drv.c b/drivers/s390/cio/vfio_ccw_drv.c +index fd590d1cffc1f..d42e5a3074375 100644 +--- a/drivers/s390/cio/vfio_ccw_drv.c ++++ b/drivers/s390/cio/vfio_ccw_drv.c +@@ -247,19 +247,11 @@ static int vfio_ccw_sch_event(struct subchannel *sch, int process) + if (work_pending(&sch->todo_work)) + goto out_unlock; + +- if (cio_update_schib(sch)) { +- vfio_ccw_fsm_event(private, VFIO_CCW_EVENT_NOT_OPER); +- rc = 0; +- goto out_unlock; +- } +- +- private = dev_get_drvdata(&sch->dev); +- if (private->state == VFIO_CCW_STATE_NOT_OPER) { +- private->state = private->mdev ? VFIO_CCW_STATE_IDLE : +- VFIO_CCW_STATE_STANDBY; +- } + rc = 0; + ++ if (cio_update_schib(sch)) ++ vfio_ccw_fsm_event(private, VFIO_CCW_EVENT_NOT_OPER); ++ + out_unlock: + spin_unlock_irqrestore(sch->lock, flags); + +diff --git a/drivers/s390/scsi/zfcp_fc.c b/drivers/s390/scsi/zfcp_fc.c +index d4c2c44b863dd..7285e6ca948ff 100644 +--- a/drivers/s390/scsi/zfcp_fc.c ++++ b/drivers/s390/scsi/zfcp_fc.c +@@ -145,27 +145,33 @@ void zfcp_fc_enqueue_event(struct zfcp_adapter *adapter, + + static int zfcp_fc_wka_port_get(struct zfcp_fc_wka_port *wka_port) + { ++ int ret = -EIO; ++ + if (mutex_lock_interruptible(&wka_port->mutex)) + return -ERESTARTSYS; + + if (wka_port->status == ZFCP_FC_WKA_PORT_OFFLINE || + wka_port->status == ZFCP_FC_WKA_PORT_CLOSING) { + wka_port->status = ZFCP_FC_WKA_PORT_OPENING; +- if (zfcp_fsf_open_wka_port(wka_port)) ++ if (zfcp_fsf_open_wka_port(wka_port)) { ++ /* could not even send request, nothing to wait for */ + wka_port->status = ZFCP_FC_WKA_PORT_OFFLINE; ++ goto out; ++ } + } + +- mutex_unlock(&wka_port->mutex); +- +- wait_event(wka_port->completion_wq, ++ wait_event(wka_port->opened, + wka_port->status == ZFCP_FC_WKA_PORT_ONLINE || + wka_port->status == ZFCP_FC_WKA_PORT_OFFLINE); + + if (wka_port->status == ZFCP_FC_WKA_PORT_ONLINE) { + atomic_inc(&wka_port->refcount); +- return 0; ++ ret = 0; ++ goto out; + } +- return -EIO; ++out: ++ mutex_unlock(&wka_port->mutex); ++ return ret; + } + + static void zfcp_fc_wka_port_offline(struct work_struct *work) +@@ -181,9 +187,12 @@ static void zfcp_fc_wka_port_offline(struct work_struct *work) + + wka_port->status = ZFCP_FC_WKA_PORT_CLOSING; + if (zfcp_fsf_close_wka_port(wka_port)) { ++ /* could not even send request, nothing to wait for */ + wka_port->status = ZFCP_FC_WKA_PORT_OFFLINE; +- wake_up(&wka_port->completion_wq); ++ goto out; + } ++ wait_event(wka_port->closed, ++ wka_port->status == ZFCP_FC_WKA_PORT_OFFLINE); + out: + mutex_unlock(&wka_port->mutex); + } +@@ -193,13 +202,15 @@ static void zfcp_fc_wka_port_put(struct zfcp_fc_wka_port *wka_port) + if (atomic_dec_return(&wka_port->refcount) != 0) + return; + /* wait 10 milliseconds, other reqs might pop in */ +- schedule_delayed_work(&wka_port->work, HZ / 100); ++ queue_delayed_work(wka_port->adapter->work_queue, &wka_port->work, ++ msecs_to_jiffies(10)); + } + + static void zfcp_fc_wka_port_init(struct zfcp_fc_wka_port *wka_port, u32 d_id, + struct zfcp_adapter *adapter) + { +- init_waitqueue_head(&wka_port->completion_wq); ++ init_waitqueue_head(&wka_port->opened); ++ init_waitqueue_head(&wka_port->closed); + + wka_port->adapter = adapter; + wka_port->d_id = d_id; +diff --git a/drivers/s390/scsi/zfcp_fc.h b/drivers/s390/scsi/zfcp_fc.h +index 6902ae1f8e4f0..25bebfaa8cbcd 100644 +--- a/drivers/s390/scsi/zfcp_fc.h ++++ b/drivers/s390/scsi/zfcp_fc.h +@@ -185,7 +185,8 @@ enum zfcp_fc_wka_status { + /** + * struct zfcp_fc_wka_port - representation of well-known-address (WKA) FC port + * @adapter: Pointer to adapter structure this WKA port belongs to +- * @completion_wq: Wait for completion of open/close command ++ * @opened: Wait for completion of open command ++ * @closed: Wait for completion of close command + * @status: Current status of WKA port + * @refcount: Reference count to keep port open as long as it is in use + * @d_id: FC destination id or well-known-address +@@ -195,7 +196,8 @@ enum zfcp_fc_wka_status { + */ + struct zfcp_fc_wka_port { + struct zfcp_adapter *adapter; +- wait_queue_head_t completion_wq; ++ wait_queue_head_t opened; ++ wait_queue_head_t closed; + enum zfcp_fc_wka_status status; + atomic_t refcount; + u32 d_id; +diff --git a/drivers/s390/scsi/zfcp_fsf.c b/drivers/s390/scsi/zfcp_fsf.c +index 5c652deb6fed4..67dac3931634e 100644 +--- a/drivers/s390/scsi/zfcp_fsf.c ++++ b/drivers/s390/scsi/zfcp_fsf.c +@@ -1625,7 +1625,7 @@ static void zfcp_fsf_open_wka_port_handler(struct zfcp_fsf_req *req) + wka_port->status = ZFCP_FC_WKA_PORT_ONLINE; + } + out: +- wake_up(&wka_port->completion_wq); ++ wake_up(&wka_port->opened); + } + + /** +@@ -1684,7 +1684,7 @@ static void zfcp_fsf_close_wka_port_handler(struct zfcp_fsf_req *req) + } + + wka_port->status = ZFCP_FC_WKA_PORT_OFFLINE; +- wake_up(&wka_port->completion_wq); ++ wake_up(&wka_port->closed); + } + + /** +diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c +index e15bb3dfe9956..69551132f304c 100644 +--- a/drivers/scsi/lpfc/lpfc_debugfs.c ++++ b/drivers/scsi/lpfc/lpfc_debugfs.c +@@ -2402,8 +2402,8 @@ lpfc_debugfs_multixripools_write(struct file *file, const char __user *buf, + struct lpfc_sli4_hdw_queue *qp; + struct lpfc_multixri_pool *multixri_pool; + +- if (nbytes > 64) +- nbytes = 64; ++ if (nbytes > sizeof(mybuf) - 1) ++ nbytes = sizeof(mybuf) - 1; + + /* Protect copy from user */ + if (!access_ok(buf, nbytes)) +@@ -2487,8 +2487,8 @@ lpfc_debugfs_nvmestat_write(struct file *file, const char __user *buf, + if (!phba->targetport) + return -ENXIO; + +- if (nbytes > 64) +- nbytes = 64; ++ if (nbytes > sizeof(mybuf) - 1) ++ nbytes = sizeof(mybuf) - 1; + + memset(mybuf, 0, sizeof(mybuf)); + +@@ -2629,8 +2629,8 @@ lpfc_debugfs_nvmektime_write(struct file *file, const char __user *buf, + char mybuf[64]; + char *pbuf; + +- if (nbytes > 64) +- nbytes = 64; ++ if (nbytes > sizeof(mybuf) - 1) ++ nbytes = sizeof(mybuf) - 1; + + memset(mybuf, 0, sizeof(mybuf)); + +@@ -2757,8 +2757,8 @@ lpfc_debugfs_nvmeio_trc_write(struct file *file, const char __user *buf, + char mybuf[64]; + char *pbuf; + +- if (nbytes > 63) +- nbytes = 63; ++ if (nbytes > sizeof(mybuf) - 1) ++ nbytes = sizeof(mybuf) - 1; + + memset(mybuf, 0, sizeof(mybuf)); + +@@ -2863,8 +2863,8 @@ lpfc_debugfs_cpucheck_write(struct file *file, const char __user *buf, + char *pbuf; + int i, j; + +- if (nbytes > 64) +- nbytes = 64; ++ if (nbytes > sizeof(mybuf) - 1) ++ nbytes = sizeof(mybuf) - 1; + + memset(mybuf, 0, sizeof(mybuf)); + +diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h +index caf28c5281aa5..a8272d4290754 100644 +--- a/drivers/scsi/qla2xxx/qla_def.h ++++ b/drivers/scsi/qla2xxx/qla_def.h +@@ -3899,8 +3899,8 @@ struct qla_hw_data { + #define IS_OEM_001(ha) ((ha)->device_type & DT_OEM_001) + #define HAS_EXTENDED_IDS(ha) ((ha)->device_type & DT_EXTENDED_IDS) + #define IS_CT6_SUPPORTED(ha) ((ha)->device_type & DT_CT6_SUPPORTED) +-#define IS_MQUE_CAPABLE(ha) ((ha)->mqenable || IS_QLA83XX(ha) || \ +- IS_QLA27XX(ha) || IS_QLA28XX(ha)) ++#define IS_MQUE_CAPABLE(ha) (IS_QLA83XX(ha) || IS_QLA27XX(ha) || \ ++ IS_QLA28XX(ha)) + #define IS_BIDI_CAPABLE(ha) \ + (IS_QLA25XX(ha) || IS_QLA2031(ha) || IS_QLA27XX(ha) || IS_QLA28XX(ha)) + /* Bit 21 of fw_attributes decides the MCTP capabilities */ +diff --git a/drivers/scsi/qla2xxx/qla_gbl.h b/drivers/scsi/qla2xxx/qla_gbl.h +index 1a98e37c9be22..6d78818d52696 100644 +--- a/drivers/scsi/qla2xxx/qla_gbl.h ++++ b/drivers/scsi/qla2xxx/qla_gbl.h +@@ -397,7 +397,8 @@ extern int + qla2x00_get_resource_cnts(scsi_qla_host_t *); + + extern int +-qla2x00_get_fcal_position_map(scsi_qla_host_t *ha, char *pos_map); ++qla2x00_get_fcal_position_map(scsi_qla_host_t *ha, char *pos_map, ++ u8 *num_entries); + + extern int + qla2x00_get_link_status(scsi_qla_host_t *, uint16_t, struct link_statistics *, +diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c +index a6e24cef89a0b..85f65a0ac1508 100644 +--- a/drivers/scsi/qla2xxx/qla_init.c ++++ b/drivers/scsi/qla2xxx/qla_init.c +@@ -5068,6 +5068,22 @@ qla2x00_configure_loop(scsi_qla_host_t *vha) + return (rval); + } + ++static void ++qla_reinitialize_link(scsi_qla_host_t *vha) ++{ ++ int rval; ++ ++ atomic_set(&vha->loop_state, LOOP_DOWN); ++ atomic_set(&vha->loop_down_timer, LOOP_DOWN_TIME); ++ rval = qla2x00_full_login_lip(vha); ++ if (rval == QLA_SUCCESS) { ++ ql_dbg(ql_dbg_disc, vha, 0xd050, "Link reinitialized\n"); ++ } else { ++ ql_dbg(ql_dbg_disc, vha, 0xd051, ++ "Link reinitialization failed (%d)\n", rval); ++ } ++} ++ + /* + * qla2x00_configure_local_loop + * Updates Fibre Channel Device Database with local loop devices. +@@ -5132,6 +5148,19 @@ skip_login: + spin_unlock_irqrestore(&vha->work_lock, flags); + + if (vha->scan.scan_retry < MAX_SCAN_RETRIES) { ++ u8 loop_map_entries = 0; ++ int rc; ++ ++ rc = qla2x00_get_fcal_position_map(vha, NULL, ++ &loop_map_entries); ++ if (rc == QLA_SUCCESS && loop_map_entries > 1) { ++ /* ++ * There are devices that are still not logged ++ * in. Reinitialize to give them a chance. ++ */ ++ qla_reinitialize_link(vha); ++ return QLA_FUNCTION_FAILED; ++ } + set_bit(LOCAL_LOOP_UPDATE, &vha->dpc_flags); + set_bit(LOOP_RESYNC_NEEDED, &vha->dpc_flags); + } +@@ -5388,8 +5417,6 @@ qla2x00_reg_remote_port(scsi_qla_host_t *vha, fc_port_t *fcport) + if (atomic_read(&fcport->state) == FCS_ONLINE) + return; + +- qla2x00_set_fcport_state(fcport, FCS_ONLINE); +- + rport_ids.node_name = wwn_to_u64(fcport->node_name); + rport_ids.port_name = wwn_to_u64(fcport->port_name); + rport_ids.port_id = fcport->d_id.b.domain << 16 | +@@ -5485,7 +5512,6 @@ qla2x00_update_fcport(scsi_qla_host_t *vha, fc_port_t *fcport) + qla2x00_reg_remote_port(vha, fcport); + break; + case MODE_TARGET: +- qla2x00_set_fcport_state(fcport, FCS_ONLINE); + if (!vha->vha_tgt.qla_tgt->tgt_stop && + !vha->vha_tgt.qla_tgt->tgt_stopped) + qlt_fc_port_added(vha, fcport); +@@ -5500,6 +5526,8 @@ qla2x00_update_fcport(scsi_qla_host_t *vha, fc_port_t *fcport) + break; + } + ++ qla2x00_set_fcport_state(fcport, FCS_ONLINE); ++ + if (IS_IIDMA_CAPABLE(vha->hw) && vha->hw->flags.gpsc_supported) { + if (fcport->id_changed) { + fcport->id_changed = 0; +diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c +index d7cf7f9570874..0892eb6bbfa33 100644 +--- a/drivers/scsi/qla2xxx/qla_isr.c ++++ b/drivers/scsi/qla2xxx/qla_isr.c +@@ -3568,16 +3568,12 @@ msix_register_fail: + } + + /* Enable MSI-X vector for response queue update for queue 0 */ +- if (IS_QLA83XX(ha) || IS_QLA27XX(ha) || IS_QLA28XX(ha)) { +- if (ha->msixbase && ha->mqiobase && +- (ha->max_rsp_queues > 1 || ha->max_req_queues > 1 || +- ql2xmqsupport)) +- ha->mqenable = 1; +- } else +- if (ha->mqiobase && +- (ha->max_rsp_queues > 1 || ha->max_req_queues > 1 || +- ql2xmqsupport)) +- ha->mqenable = 1; ++ if (IS_MQUE_CAPABLE(ha) && ++ (ha->msixbase && ha->mqiobase && ha->max_qpairs)) ++ ha->mqenable = 1; ++ else ++ ha->mqenable = 0; ++ + ql_dbg(ql_dbg_multiq, vha, 0xc005, + "mqiobase=%p, max_rsp_queues=%d, max_req_queues=%d.\n", + ha->mqiobase, ha->max_rsp_queues, ha->max_req_queues); +diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c +index 29f2730fbf66a..77abecf88aa29 100644 +--- a/drivers/scsi/qla2xxx/qla_mbx.c ++++ b/drivers/scsi/qla2xxx/qla_mbx.c +@@ -271,6 +271,12 @@ qla2x00_mailbox_command(scsi_qla_host_t *vha, mbx_cmd_t *mcp) + atomic_inc(&ha->num_pend_mbx_stage3); + if (!wait_for_completion_timeout(&ha->mbx_intr_comp, + mcp->tov * HZ)) { ++ ql_dbg(ql_dbg_mbx, vha, 0x117a, ++ "cmd=%x Timeout.\n", command); ++ spin_lock_irqsave(&ha->hardware_lock, flags); ++ clear_bit(MBX_INTR_WAIT, &ha->mbx_cmd_flags); ++ spin_unlock_irqrestore(&ha->hardware_lock, flags); ++ + if (chip_reset != ha->chip_reset) { + spin_lock_irqsave(&ha->hardware_lock, flags); + ha->flags.mbox_busy = 0; +@@ -281,12 +287,6 @@ qla2x00_mailbox_command(scsi_qla_host_t *vha, mbx_cmd_t *mcp) + rval = QLA_ABORTED; + goto premature_exit; + } +- ql_dbg(ql_dbg_mbx, vha, 0x117a, +- "cmd=%x Timeout.\n", command); +- spin_lock_irqsave(&ha->hardware_lock, flags); +- clear_bit(MBX_INTR_WAIT, &ha->mbx_cmd_flags); +- spin_unlock_irqrestore(&ha->hardware_lock, flags); +- + } else if (ha->flags.purge_mbox || + chip_reset != ha->chip_reset) { + spin_lock_irqsave(&ha->hardware_lock, flags); +@@ -2928,7 +2928,8 @@ qla2x00_get_resource_cnts(scsi_qla_host_t *vha) + * Kernel context. + */ + int +-qla2x00_get_fcal_position_map(scsi_qla_host_t *vha, char *pos_map) ++qla2x00_get_fcal_position_map(scsi_qla_host_t *vha, char *pos_map, ++ u8 *num_entries) + { + int rval; + mbx_cmd_t mc; +@@ -2968,6 +2969,8 @@ qla2x00_get_fcal_position_map(scsi_qla_host_t *vha, char *pos_map) + + if (pos_map) + memcpy(pos_map, pmap, FCAL_MAP_SIZE); ++ if (num_entries) ++ *num_entries = pmap[0]; + } + dma_pool_free(ha->s_dma_pool, pmap, pmap_dma); + +diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c +index a15af048cd820..f0de7089e9aec 100644 +--- a/drivers/scsi/qla2xxx/qla_nvme.c ++++ b/drivers/scsi/qla2xxx/qla_nvme.c +@@ -36,11 +36,6 @@ int qla_nvme_register_remote(struct scsi_qla_host *vha, struct fc_port *fcport) + (fcport->nvme_flag & NVME_FLAG_REGISTERED)) + return 0; + +- if (atomic_read(&fcport->state) == FCS_ONLINE) +- return 0; +- +- qla2x00_set_fcport_state(fcport, FCS_ONLINE); +- + fcport->nvme_flag &= ~NVME_FLAG_RESETTING; + + memset(&req, 0, sizeof(struct nvme_fc_port_info)); +diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c +index 9c6bf13daaee3..cc836610e21eb 100644 +--- a/drivers/scsi/sg.c ++++ b/drivers/scsi/sg.c +@@ -190,7 +190,7 @@ static void sg_link_reserve(Sg_fd * sfp, Sg_request * srp, int size); + static void sg_unlink_reserve(Sg_fd * sfp, Sg_request * srp); + static Sg_fd *sg_add_sfp(Sg_device * sdp); + static void sg_remove_sfp(struct kref *); +-static Sg_request *sg_get_rq_mark(Sg_fd * sfp, int pack_id); ++static Sg_request *sg_get_rq_mark(Sg_fd * sfp, int pack_id, bool *busy); + static Sg_request *sg_add_request(Sg_fd * sfp); + static int sg_remove_request(Sg_fd * sfp, Sg_request * srp); + static Sg_device *sg_get_dev(int dev); +@@ -412,6 +412,7 @@ sg_read(struct file *filp, char __user *buf, size_t count, loff_t * ppos) + Sg_fd *sfp; + Sg_request *srp; + int req_pack_id = -1; ++ bool busy; + sg_io_hdr_t *hp; + struct sg_header *old_hdr = NULL; + int retval = 0; +@@ -459,25 +460,19 @@ sg_read(struct file *filp, char __user *buf, size_t count, loff_t * ppos) + } else + req_pack_id = old_hdr->pack_id; + } +- srp = sg_get_rq_mark(sfp, req_pack_id); ++ srp = sg_get_rq_mark(sfp, req_pack_id, &busy); + if (!srp) { /* now wait on packet to arrive */ +- if (atomic_read(&sdp->detaching)) { +- retval = -ENODEV; +- goto free_old_hdr; +- } + if (filp->f_flags & O_NONBLOCK) { + retval = -EAGAIN; + goto free_old_hdr; + } + retval = wait_event_interruptible(sfp->read_wait, +- (atomic_read(&sdp->detaching) || +- (srp = sg_get_rq_mark(sfp, req_pack_id)))); +- if (atomic_read(&sdp->detaching)) { +- retval = -ENODEV; +- goto free_old_hdr; +- } +- if (retval) { +- /* -ERESTARTSYS as signal hit process */ ++ ((srp = sg_get_rq_mark(sfp, req_pack_id, &busy)) || ++ (!busy && atomic_read(&sdp->detaching)))); ++ if (!srp) { ++ /* signal or detaching */ ++ if (!retval) ++ retval = -ENODEV; + goto free_old_hdr; + } + } +@@ -928,9 +923,7 @@ sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg) + if (result < 0) + return result; + result = wait_event_interruptible(sfp->read_wait, +- (srp_done(sfp, srp) || atomic_read(&sdp->detaching))); +- if (atomic_read(&sdp->detaching)) +- return -ENODEV; ++ srp_done(sfp, srp)); + write_lock_irq(&sfp->rq_list_lock); + if (srp->done) { + srp->done = 2; +@@ -2074,19 +2067,28 @@ sg_unlink_reserve(Sg_fd * sfp, Sg_request * srp) + } + + static Sg_request * +-sg_get_rq_mark(Sg_fd * sfp, int pack_id) ++sg_get_rq_mark(Sg_fd * sfp, int pack_id, bool *busy) + { + Sg_request *resp; + unsigned long iflags; + ++ *busy = false; + write_lock_irqsave(&sfp->rq_list_lock, iflags); + list_for_each_entry(resp, &sfp->rq_list, entry) { +- /* look for requests that are ready + not SG_IO owned */ +- if ((1 == resp->done) && (!resp->sg_io_owned) && ++ /* look for requests that are not SG_IO owned */ ++ if ((!resp->sg_io_owned) && + ((-1 == pack_id) || (resp->header.pack_id == pack_id))) { +- resp->done = 2; /* guard against other readers */ +- write_unlock_irqrestore(&sfp->rq_list_lock, iflags); +- return resp; ++ switch (resp->done) { ++ case 0: /* request active */ ++ *busy = true; ++ break; ++ case 1: /* request done; response ready to return */ ++ resp->done = 2; /* guard against other readers */ ++ write_unlock_irqrestore(&sfp->rq_list_lock, iflags); ++ return resp; ++ case 2: /* response already being returned */ ++ break; ++ } + } + } + write_unlock_irqrestore(&sfp->rq_list_lock, iflags); +@@ -2140,6 +2142,15 @@ sg_remove_request(Sg_fd * sfp, Sg_request * srp) + res = 1; + } + write_unlock_irqrestore(&sfp->rq_list_lock, iflags); ++ ++ /* ++ * If the device is detaching, wakeup any readers in case we just ++ * removed the last response, which would leave nothing for them to ++ * return other than -ENODEV. ++ */ ++ if (unlikely(atomic_read(&sfp->parentdp->detaching))) ++ wake_up_interruptible_all(&sfp->read_wait); ++ + return res; + } + +diff --git a/drivers/scsi/smartpqi/smartpqi_init.c b/drivers/scsi/smartpqi/smartpqi_init.c +index 80ff00025c03d..540d6eb2cc489 100644 +--- a/drivers/scsi/smartpqi/smartpqi_init.c ++++ b/drivers/scsi/smartpqi/smartpqi_init.c +@@ -5018,10 +5018,10 @@ static int pqi_raid_submit_scsi_cmd_with_io_request( + } + + switch (scmd->sc_data_direction) { +- case DMA_TO_DEVICE: ++ case DMA_FROM_DEVICE: + request->data_direction = SOP_READ_FLAG; + break; +- case DMA_FROM_DEVICE: ++ case DMA_TO_DEVICE: + request->data_direction = SOP_WRITE_FLAG; + break; + case DMA_NONE: +diff --git a/drivers/soc/amlogic/meson-mx-socinfo.c b/drivers/soc/amlogic/meson-mx-socinfo.c +index 78f0f1aeca578..92125dd65f338 100644 +--- a/drivers/soc/amlogic/meson-mx-socinfo.c ++++ b/drivers/soc/amlogic/meson-mx-socinfo.c +@@ -126,6 +126,7 @@ static int __init meson_mx_socinfo_init(void) + np = of_find_matching_node(NULL, meson_mx_socinfo_analog_top_ids); + if (np) { + analog_top_regmap = syscon_node_to_regmap(np); ++ of_node_put(np); + if (IS_ERR(analog_top_regmap)) + return PTR_ERR(analog_top_regmap); + +diff --git a/drivers/soc/fsl/guts.c b/drivers/soc/fsl/guts.c +index 34810f9bb2ee7..2b7fb7a8805cd 100644 +--- a/drivers/soc/fsl/guts.c ++++ b/drivers/soc/fsl/guts.c +@@ -142,7 +142,7 @@ static int fsl_guts_probe(struct platform_device *pdev) + struct device *dev = &pdev->dev; + struct resource *res; + const struct fsl_soc_die_attr *soc_die; +- const char *machine; ++ const char *machine = NULL; + u32 svr; + + /* Initialize guts */ +diff --git a/drivers/soc/qcom/qcom_aoss.c b/drivers/soc/qcom/qcom_aoss.c +index f16d6ec780644..bca98df55bc63 100644 +--- a/drivers/soc/qcom/qcom_aoss.c ++++ b/drivers/soc/qcom/qcom_aoss.c +@@ -489,8 +489,10 @@ static int qmp_cooling_devices_register(struct qmp *qmp) + continue; + ret = qmp_cooling_device_add(qmp, &qmp->cooling_devs[count++], + child); +- if (ret) ++ if (ret) { ++ of_node_put(child); + goto unroll; ++ } + } + + if (!count) +diff --git a/drivers/soundwire/bus_type.c b/drivers/soundwire/bus_type.c +index 4a465f55039f4..2fe5a51918c8d 100644 +--- a/drivers/soundwire/bus_type.c ++++ b/drivers/soundwire/bus_type.c +@@ -155,12 +155,8 @@ int __sdw_register_driver(struct sdw_driver *drv, struct module *owner) + + drv->driver.owner = owner; + drv->driver.probe = sdw_drv_probe; +- +- if (drv->remove) +- drv->driver.remove = sdw_drv_remove; +- +- if (drv->shutdown) +- drv->driver.shutdown = sdw_drv_shutdown; ++ drv->driver.remove = sdw_drv_remove; ++ drv->driver.shutdown = sdw_drv_shutdown; + + return driver_register(&drv->driver); + } +diff --git a/drivers/spi/spi-rspi.c b/drivers/spi/spi-rspi.c +index 0524741d73b90..8ae2ac40b4b2e 100644 +--- a/drivers/spi/spi-rspi.c ++++ b/drivers/spi/spi-rspi.c +@@ -595,6 +595,10 @@ static int rspi_dma_transfer(struct rspi_data *rspi, struct sg_table *tx, + rspi->dma_callbacked, HZ); + if (ret > 0 && rspi->dma_callbacked) { + ret = 0; ++ if (tx) ++ dmaengine_synchronize(rspi->ctlr->dma_tx); ++ if (rx) ++ dmaengine_synchronize(rspi->ctlr->dma_rx); + } else { + if (!ret) { + dev_err(&rspi->ctlr->dev, "DMA timeout\n"); +diff --git a/drivers/spi/spi-synquacer.c b/drivers/spi/spi-synquacer.c +index 785e7c4451233..1e10af6e10a90 100644 +--- a/drivers/spi/spi-synquacer.c ++++ b/drivers/spi/spi-synquacer.c +@@ -784,6 +784,7 @@ static int __maybe_unused synquacer_spi_resume(struct device *dev) + + ret = synquacer_spi_enable(master); + if (ret) { ++ clk_disable_unprepare(sspi->clk); + dev_err(dev, "failed to enable spi (%d)\n", ret); + return ret; + } +diff --git a/drivers/staging/rtl8192u/r8192U.h b/drivers/staging/rtl8192u/r8192U.h +index ec33fb9122e96..57badc1e91e30 100644 +--- a/drivers/staging/rtl8192u/r8192U.h ++++ b/drivers/staging/rtl8192u/r8192U.h +@@ -1013,7 +1013,7 @@ typedef struct r8192_priv { + bool bis_any_nonbepkts; + bool bcurrent_turbo_EDCA; + bool bis_cur_rdlstate; +- struct timer_list fsync_timer; ++ struct delayed_work fsync_work; + bool bfsync_processing; /* 500ms Fsync timer is active or not */ + u32 rate_record; + u32 rateCountDiffRecord; +diff --git a/drivers/staging/rtl8192u/r8192U_dm.c b/drivers/staging/rtl8192u/r8192U_dm.c +index c23e43b095d9b..30b272da36f5e 100644 +--- a/drivers/staging/rtl8192u/r8192U_dm.c ++++ b/drivers/staging/rtl8192u/r8192U_dm.c +@@ -2585,19 +2585,20 @@ static void dm_init_fsync(struct net_device *dev) + priv->ieee80211->fsync_seconddiff_ratethreshold = 200; + priv->ieee80211->fsync_state = Default_Fsync; + priv->framesyncMonitor = 1; /* current default 0xc38 monitor on */ +- timer_setup(&priv->fsync_timer, dm_fsync_timer_callback, 0); ++ INIT_DELAYED_WORK(&priv->fsync_work, dm_fsync_work_callback); + } + + static void dm_deInit_fsync(struct net_device *dev) + { + struct r8192_priv *priv = ieee80211_priv(dev); + +- del_timer_sync(&priv->fsync_timer); ++ cancel_delayed_work_sync(&priv->fsync_work); + } + +-void dm_fsync_timer_callback(struct timer_list *t) ++void dm_fsync_work_callback(struct work_struct *work) + { +- struct r8192_priv *priv = from_timer(priv, t, fsync_timer); ++ struct r8192_priv *priv = ++ container_of(work, struct r8192_priv, fsync_work.work); + struct net_device *dev = priv->ieee80211->dev; + u32 rate_index, rate_count = 0, rate_count_diff = 0; + bool bSwitchFromCountDiff = false; +@@ -2664,17 +2665,16 @@ void dm_fsync_timer_callback(struct timer_list *t) + } + } + if (bDoubleTimeInterval) { +- if (timer_pending(&priv->fsync_timer)) +- del_timer_sync(&priv->fsync_timer); +- priv->fsync_timer.expires = jiffies + +- msecs_to_jiffies(priv->ieee80211->fsync_time_interval*priv->ieee80211->fsync_multiple_timeinterval); +- add_timer(&priv->fsync_timer); ++ cancel_delayed_work_sync(&priv->fsync_work); ++ schedule_delayed_work(&priv->fsync_work, ++ msecs_to_jiffies(priv ++ ->ieee80211->fsync_time_interval * ++ priv->ieee80211->fsync_multiple_timeinterval)); + } else { +- if (timer_pending(&priv->fsync_timer)) +- del_timer_sync(&priv->fsync_timer); +- priv->fsync_timer.expires = jiffies + +- msecs_to_jiffies(priv->ieee80211->fsync_time_interval); +- add_timer(&priv->fsync_timer); ++ cancel_delayed_work_sync(&priv->fsync_work); ++ schedule_delayed_work(&priv->fsync_work, ++ msecs_to_jiffies(priv ++ ->ieee80211->fsync_time_interval)); + } + } else { + /* Let Register return to default value; */ +@@ -2702,7 +2702,7 @@ static void dm_EndSWFsync(struct net_device *dev) + struct r8192_priv *priv = ieee80211_priv(dev); + + RT_TRACE(COMP_HALDM, "%s\n", __func__); +- del_timer_sync(&(priv->fsync_timer)); ++ cancel_delayed_work_sync(&priv->fsync_work); + + /* Let Register return to default value; */ + if (priv->bswitch_fsync) { +@@ -2744,11 +2744,9 @@ static void dm_StartSWFsync(struct net_device *dev) + if (priv->ieee80211->fsync_rate_bitmap & rateBitmap) + priv->rate_record += priv->stats.received_rate_histogram[1][rateIndex]; + } +- if (timer_pending(&priv->fsync_timer)) +- del_timer_sync(&priv->fsync_timer); +- priv->fsync_timer.expires = jiffies + +- msecs_to_jiffies(priv->ieee80211->fsync_time_interval); +- add_timer(&priv->fsync_timer); ++ cancel_delayed_work_sync(&priv->fsync_work); ++ schedule_delayed_work(&priv->fsync_work, ++ msecs_to_jiffies(priv->ieee80211->fsync_time_interval)); + + write_nic_dword(dev, rOFDM0_RxDetector2, 0x465c12cd); + +diff --git a/drivers/staging/rtl8192u/r8192U_dm.h b/drivers/staging/rtl8192u/r8192U_dm.h +index 0b2a1c688597c..2159018b4e38f 100644 +--- a/drivers/staging/rtl8192u/r8192U_dm.h ++++ b/drivers/staging/rtl8192u/r8192U_dm.h +@@ -166,7 +166,7 @@ void dm_force_tx_fw_info(struct net_device *dev, + void dm_init_edca_turbo(struct net_device *dev); + void dm_rf_operation_test_callback(unsigned long data); + void dm_rf_pathcheck_workitemcallback(struct work_struct *work); +-void dm_fsync_timer_callback(struct timer_list *t); ++void dm_fsync_work_callback(struct work_struct *work); + void dm_cck_txpower_adjust(struct net_device *dev, bool binch14); + void dm_shadow_init(struct net_device *dev); + void dm_initialize_txpower_tracking(struct net_device *dev); +diff --git a/drivers/tee/tee_core.c b/drivers/tee/tee_core.c +index a7ccd4d2bd106..2db144d2d26f3 100644 +--- a/drivers/tee/tee_core.c ++++ b/drivers/tee/tee_core.c +@@ -182,6 +182,9 @@ tee_ioctl_shm_register(struct tee_context *ctx, + if (data.flags) + return -EINVAL; + ++ if (!access_ok((void __user *)(unsigned long)data.addr, data.length)) ++ return -EFAULT; ++ + shm = tee_shm_register(ctx, data.addr, data.length, + TEE_SHM_DMA_BUF | TEE_SHM_USER_MAPPED); + if (IS_ERR(shm)) +diff --git a/drivers/thermal/thermal_sysfs.c b/drivers/thermal/thermal_sysfs.c +index 4dce4a8f71ed9..17b2361bc8f21 100644 +--- a/drivers/thermal/thermal_sysfs.c ++++ b/drivers/thermal/thermal_sysfs.c +@@ -909,12 +909,13 @@ static const struct attribute_group cooling_device_stats_attr_group = { + + static void cooling_device_stats_setup(struct thermal_cooling_device *cdev) + { ++ const struct attribute_group *stats_attr_group = NULL; + struct cooling_dev_stats *stats; + unsigned long states; + int var; + + if (cdev->ops->get_max_state(cdev, &states)) +- return; ++ goto out; + + states++; /* Total number of states is highest state + 1 */ + +@@ -924,7 +925,7 @@ static void cooling_device_stats_setup(struct thermal_cooling_device *cdev) + + stats = kzalloc(var, GFP_KERNEL); + if (!stats) +- return; ++ goto out; + + stats->time_in_state = (ktime_t *)(stats + 1); + stats->trans_table = (unsigned int *)(stats->time_in_state + states); +@@ -934,9 +935,12 @@ static void cooling_device_stats_setup(struct thermal_cooling_device *cdev) + + spin_lock_init(&stats->lock); + ++ stats_attr_group = &cooling_device_stats_attr_group; ++ ++out: + /* Fill the empty slot left in cooling_device_attr_groups */ + var = ARRAY_SIZE(cooling_device_attr_groups) - 2; +- cooling_device_attr_groups[var] = &cooling_device_stats_attr_group; ++ cooling_device_attr_groups[var] = stats_attr_group; + } + + static void cooling_device_stats_destroy(struct thermal_cooling_device *cdev) +diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c +index 907a4d0784ac0..22da644530548 100644 +--- a/drivers/tty/n_gsm.c ++++ b/drivers/tty/n_gsm.c +@@ -410,6 +410,27 @@ static int gsm_read_ea(unsigned int *val, u8 c) + return c & EA; + } + ++/** ++ * gsm_read_ea_val - read a value until EA ++ * @val: variable holding value ++ * @data: buffer of data ++ * @dlen: length of data ++ * ++ * Processes an EA value. Updates the passed variable and ++ * returns the processed data length. ++ */ ++static unsigned int gsm_read_ea_val(unsigned int *val, const u8 *data, int dlen) ++{ ++ unsigned int len = 0; ++ ++ for (; dlen > 0; dlen--) { ++ len++; ++ if (gsm_read_ea(val, *data++)) ++ break; ++ } ++ return len; ++} ++ + /** + * gsm_encode_modem - encode modem data bits + * @dlci: DLCI to encode from +@@ -657,6 +678,37 @@ static struct gsm_msg *gsm_data_alloc(struct gsm_mux *gsm, u8 addr, int len, + return m; + } + ++/** ++ * gsm_is_flow_ctrl_msg - checks if flow control message ++ * @msg: message to check ++ * ++ * Returns true if the given message is a flow control command of the ++ * control channel. False is returned in any other case. ++ */ ++static bool gsm_is_flow_ctrl_msg(struct gsm_msg *msg) ++{ ++ unsigned int cmd; ++ ++ if (msg->addr > 0) ++ return false; ++ ++ switch (msg->ctrl & ~PF) { ++ case UI: ++ case UIH: ++ cmd = 0; ++ if (gsm_read_ea_val(&cmd, msg->data + 2, msg->len - 2) < 1) ++ break; ++ switch (cmd & ~PF) { ++ case CMD_FCOFF: ++ case CMD_FCON: ++ return true; ++ } ++ break; ++ } ++ ++ return false; ++} ++ + /** + * gsm_data_kick - poke the queue + * @gsm: GSM Mux +@@ -675,7 +727,7 @@ static void gsm_data_kick(struct gsm_mux *gsm, struct gsm_dlci *dlci) + int len; + + list_for_each_entry_safe(msg, nmsg, &gsm->tx_list, list) { +- if (gsm->constipated && msg->addr) ++ if (gsm->constipated && !gsm_is_flow_ctrl_msg(msg)) + continue; + if (gsm->encoding != 0) { + gsm->txframe[0] = GSM1_SOF; +@@ -1330,7 +1382,7 @@ static void gsm_control_retransmit(struct timer_list *t) + spin_lock_irqsave(&gsm->control_lock, flags); + ctrl = gsm->pending_cmd; + if (ctrl) { +- if (gsm->cretries == 0) { ++ if (gsm->cretries == 0 || !gsm->dlci[0] || gsm->dlci[0]->dead) { + gsm->pending_cmd = NULL; + ctrl->error = -ETIMEDOUT; + ctrl->done = 1; +@@ -1482,8 +1534,8 @@ static void gsm_dlci_t1(struct timer_list *t) + + switch (dlci->state) { + case DLCI_OPENING: +- dlci->retries--; + if (dlci->retries) { ++ dlci->retries--; + gsm_command(dlci->gsm, dlci->addr, SABM|PF); + mod_timer(&dlci->t1, jiffies + gsm->t1 * HZ / 100); + } else if (!dlci->addr && gsm->control == (DM | PF)) { +@@ -1498,8 +1550,8 @@ static void gsm_dlci_t1(struct timer_list *t) + + break; + case DLCI_CLOSING: +- dlci->retries--; + if (dlci->retries) { ++ dlci->retries--; + gsm_command(dlci->gsm, dlci->addr, DISC|PF); + mod_timer(&dlci->t1, jiffies + gsm->t1 * HZ / 100); + } else +@@ -1842,7 +1894,7 @@ static void gsm_queue(struct gsm_mux *gsm) + goto invalid; + #endif + if (dlci == NULL || dlci->state != DLCI_OPEN) { +- gsm_command(gsm, address, DM|PF); ++ gsm_response(gsm, address, DM|PF); + return; + } + dlci->data(dlci, gsm->buf, gsm->len); +@@ -2599,11 +2651,24 @@ static ssize_t gsmld_read(struct tty_struct *tty, struct file *file, + static ssize_t gsmld_write(struct tty_struct *tty, struct file *file, + const unsigned char *buf, size_t nr) + { +- int space = tty_write_room(tty); ++ struct gsm_mux *gsm = tty->disc_data; ++ unsigned long flags; ++ int space; ++ int ret; ++ ++ if (!gsm) ++ return -ENODEV; ++ ++ ret = -ENOBUFS; ++ spin_lock_irqsave(&gsm->tx_lock, flags); ++ space = tty_write_room(tty); + if (space >= nr) +- return tty->ops->write(tty, buf, nr); +- set_bit(TTY_DO_WRITE_WAKEUP, &tty->flags); +- return -ENOBUFS; ++ ret = tty->ops->write(tty, buf, nr); ++ else ++ set_bit(TTY_DO_WRITE_WAKEUP, &tty->flags); ++ spin_unlock_irqrestore(&gsm->tx_lock, flags); ++ ++ return ret; + } + + /** +@@ -2628,12 +2693,15 @@ static __poll_t gsmld_poll(struct tty_struct *tty, struct file *file, + + poll_wait(file, &tty->read_wait, wait); + poll_wait(file, &tty->write_wait, wait); ++ ++ if (gsm->dead) ++ mask |= EPOLLHUP; + if (tty_hung_up_p(file)) + mask |= EPOLLHUP; ++ if (test_bit(TTY_OTHER_CLOSED, &tty->flags)) ++ mask |= EPOLLHUP; + if (!tty_is_writelocked(tty) && tty_write_room(tty) > 0) + mask |= EPOLLOUT | EPOLLWRNORM; +- if (gsm->dead) +- mask |= EPOLLHUP; + return mask; + } + +diff --git a/drivers/tty/serial/8250/8250_dw.c b/drivers/tty/serial/8250/8250_dw.c +index 381c5117aec1b..2d5a039229acf 100644 +--- a/drivers/tty/serial/8250/8250_dw.c ++++ b/drivers/tty/serial/8250/8250_dw.c +@@ -110,12 +110,15 @@ static void dw8250_check_lcr(struct uart_port *p, int value) + /* Returns once the transmitter is empty or we run out of retries */ + static void dw8250_tx_wait_empty(struct uart_port *p) + { ++ struct uart_8250_port *up = up_to_u8250p(p); + unsigned int tries = 20000; + unsigned int delay_threshold = tries - 1000; + unsigned int lsr; + + while (tries--) { + lsr = readb (p->membase + (UART_LSR << p->regshift)); ++ up->lsr_saved_flags |= lsr & LSR_SAVE_FLAGS; ++ + if (lsr & UART_LSR_TEMT) + break; + +diff --git a/drivers/tty/serial/mvebu-uart.c b/drivers/tty/serial/mvebu-uart.c +index 2ce0d05be3681..bc5f77ac538e2 100644 +--- a/drivers/tty/serial/mvebu-uart.c ++++ b/drivers/tty/serial/mvebu-uart.c +@@ -238,6 +238,7 @@ static void mvebu_uart_rx_chars(struct uart_port *port, unsigned int status) + struct tty_port *tport = &port->state->port; + unsigned char ch = 0; + char flag = 0; ++ int ret; + + do { + if (status & STAT_RX_RDY(port)) { +@@ -250,6 +251,16 @@ static void mvebu_uart_rx_chars(struct uart_port *port, unsigned int status) + port->icount.parity++; + } + ++ /* ++ * For UART2, error bits are not cleared on buffer read. ++ * This causes interrupt loop and system hang. ++ */ ++ if (IS_EXTENDED(port) && (status & STAT_BRK_ERR)) { ++ ret = readl(port->membase + UART_STAT); ++ ret |= STAT_BRK_ERR; ++ writel(ret, port->membase + UART_STAT); ++ } ++ + if (status & STAT_BRK_DET) { + port->icount.brk++; + status &= ~(STAT_FRM_ERR | STAT_PAR_ERR); +diff --git a/drivers/tty/serial/ucc_uart.c b/drivers/tty/serial/ucc_uart.c +index a0555ae2b1ef4..181d55e0c60fc 100644 +--- a/drivers/tty/serial/ucc_uart.c ++++ b/drivers/tty/serial/ucc_uart.c +@@ -1141,6 +1141,8 @@ static unsigned int soc_info(unsigned int *rev_h, unsigned int *rev_l) + /* No compatible property, so try the name. */ + soc_string = np->name; + ++ of_node_put(np); ++ + /* Extract the SOC number from the "PowerPC," string */ + if ((sscanf(soc_string, "PowerPC,%u", &soc) != 1) || !soc) + return 0; +diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c +index 9d9e056f94ac8..b4f97df8e0000 100644 +--- a/drivers/tty/vt/vt.c ++++ b/drivers/tty/vt/vt.c +@@ -351,7 +351,7 @@ static struct uni_screen *vc_uniscr_alloc(unsigned int cols, unsigned int rows) + /* allocate everything in one go */ + memsize = cols * rows * sizeof(char32_t); + memsize += rows * sizeof(char32_t *); +- p = vmalloc(memsize); ++ p = vzalloc(memsize); + if (!p) + return NULL; + +diff --git a/drivers/usb/cdns3/gadget.c b/drivers/usb/cdns3/gadget.c +index 296f2ee1b6803..a9399f2b39308 100644 +--- a/drivers/usb/cdns3/gadget.c ++++ b/drivers/usb/cdns3/gadget.c +@@ -549,9 +549,9 @@ static void cdns3_wa2_remove_old_request(struct cdns3_endpoint *priv_ep) + trace_cdns3_wa2(priv_ep, "removes eldest request"); + + kfree(priv_req->request.buf); ++ list_del_init(&priv_req->list); + cdns3_gadget_ep_free_request(&priv_ep->endpoint, + &priv_req->request); +- list_del_init(&priv_req->list); + --priv_ep->wa2_counter; + + if (!chain) +diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c +index fde211519a973..d58098c2af10b 100644 +--- a/drivers/usb/core/hcd.c ++++ b/drivers/usb/core/hcd.c +@@ -1688,7 +1688,6 @@ static void usb_giveback_urb_bh(unsigned long param) + + spin_lock_irq(&bh->lock); + bh->running = true; +- restart: + list_replace_init(&bh->head, &local_list); + spin_unlock_irq(&bh->lock); + +@@ -1702,10 +1701,17 @@ static void usb_giveback_urb_bh(unsigned long param) + bh->completing_ep = NULL; + } + +- /* check if there are new URBs to giveback */ ++ /* ++ * giveback new URBs next time to prevent this function ++ * from not exiting for a long time. ++ */ + spin_lock_irq(&bh->lock); +- if (!list_empty(&bh->head)) +- goto restart; ++ if (!list_empty(&bh->head)) { ++ if (bh->high_prio) ++ tasklet_hi_schedule(&bh->bh); ++ else ++ tasklet_schedule(&bh->bh); ++ } + bh->running = false; + spin_unlock_irq(&bh->lock); + } +@@ -1730,7 +1736,7 @@ static void usb_giveback_urb_bh(unsigned long param) + void usb_hcd_giveback_urb(struct usb_hcd *hcd, struct urb *urb, int status) + { + struct giveback_urb_bh *bh; +- bool running, high_prio_bh; ++ bool running; + + /* pass status to tasklet via unlinked */ + if (likely(!urb->unlinked)) +@@ -1741,13 +1747,10 @@ void usb_hcd_giveback_urb(struct usb_hcd *hcd, struct urb *urb, int status) + return; + } + +- if (usb_pipeisoc(urb->pipe) || usb_pipeint(urb->pipe)) { ++ if (usb_pipeisoc(urb->pipe) || usb_pipeint(urb->pipe)) + bh = &hcd->high_prio_bh; +- high_prio_bh = true; +- } else { ++ else + bh = &hcd->low_prio_bh; +- high_prio_bh = false; +- } + + spin_lock(&bh->lock); + list_add_tail(&urb->urb_list, &bh->head); +@@ -1756,7 +1759,7 @@ void usb_hcd_giveback_urb(struct usb_hcd *hcd, struct urb *urb, int status) + + if (running) + ; +- else if (high_prio_bh) ++ else if (bh->high_prio) + tasklet_hi_schedule(&bh->bh); + else + tasklet_schedule(&bh->bh); +@@ -2796,6 +2799,7 @@ int usb_add_hcd(struct usb_hcd *hcd, + + /* initialize tasklets */ + init_giveback_urb_bh(&hcd->high_prio_bh); ++ hcd->high_prio_bh.high_prio = true; + init_giveback_urb_bh(&hcd->low_prio_bh); + + /* enable irqs just before we start the controller, +diff --git a/drivers/usb/gadget/function/uvc_video.c b/drivers/usb/gadget/function/uvc_video.c +index 5c042f3807081..f9fad639a4891 100644 +--- a/drivers/usb/gadget/function/uvc_video.c ++++ b/drivers/usb/gadget/function/uvc_video.c +@@ -191,7 +191,7 @@ uvc_video_complete(struct usb_ep *ep, struct usb_request *req) + goto requeue; + + default: +- uvcg_info(&video->uvc->func, ++ uvcg_warn(&video->uvc->func, + "VS request completed with status %d.\n", + req->status); + uvcg_queue_cancel(queue, 0); +diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c +index 9cd80ad075bd2..97c73d610eeb4 100644 +--- a/drivers/usb/gadget/legacy/inode.c ++++ b/drivers/usb/gadget/legacy/inode.c +@@ -362,6 +362,7 @@ ep_io (struct ep_data *epdata, void *buf, unsigned len) + spin_unlock_irq (&epdata->dev->lock); + + DBG (epdata->dev, "endpoint gone\n"); ++ wait_for_completion(&done); + epdata->status = -ENODEV; + } + } +diff --git a/drivers/usb/gadget/udc/Kconfig b/drivers/usb/gadget/udc/Kconfig +index f985bb4a42db2..ccf2c736d4958 100644 +--- a/drivers/usb/gadget/udc/Kconfig ++++ b/drivers/usb/gadget/udc/Kconfig +@@ -311,7 +311,7 @@ source "drivers/usb/gadget/udc/bdc/Kconfig" + + config USB_AMD5536UDC + tristate "AMD5536 UDC" +- depends on USB_PCI ++ depends on USB_PCI && HAS_DMA + select USB_SNP_CORE + help + The AMD5536 UDC is part of the AMD Geode CS5536, an x86 southbridge. +diff --git a/drivers/usb/host/ehci-ppc-of.c b/drivers/usb/host/ehci-ppc-of.c +index 6bbaee74f7e7d..28a19693c19fe 100644 +--- a/drivers/usb/host/ehci-ppc-of.c ++++ b/drivers/usb/host/ehci-ppc-of.c +@@ -148,6 +148,7 @@ static int ehci_hcd_ppc_of_probe(struct platform_device *op) + } else { + ehci->has_amcc_usb23 = 1; + } ++ of_node_put(np); + } + + if (of_get_property(dn, "big-endian", NULL)) { +diff --git a/drivers/usb/host/ohci-nxp.c b/drivers/usb/host/ohci-nxp.c +index c561881d0e793..07cee8c7c25ed 100644 +--- a/drivers/usb/host/ohci-nxp.c ++++ b/drivers/usb/host/ohci-nxp.c +@@ -164,6 +164,7 @@ static int ohci_hcd_nxp_probe(struct platform_device *pdev) + } + + isp1301_i2c_client = isp1301_get_client(isp1301_node); ++ of_node_put(isp1301_node); + if (!isp1301_i2c_client) + return -EPROBE_DEFER; + +diff --git a/drivers/usb/host/ohci-ppc-of.c b/drivers/usb/host/ohci-ppc-of.c +index 45f7cceb6df31..98e46725999e9 100644 +--- a/drivers/usb/host/ohci-ppc-of.c ++++ b/drivers/usb/host/ohci-ppc-of.c +@@ -169,6 +169,7 @@ static int ohci_hcd_ppc_of_probe(struct platform_device *op) + release_mem_region(res.start, 0x4); + } else + pr_debug("%s: cannot get ehci offset from fdt\n", __FILE__); ++ of_node_put(np); + } + + irq_dispose_mapping(irq); +diff --git a/drivers/usb/host/xhci-tegra.c b/drivers/usb/host/xhci-tegra.c +index 6087b1fa530f8..d53bdb7d297f8 100644 +--- a/drivers/usb/host/xhci-tegra.c ++++ b/drivers/usb/host/xhci-tegra.c +@@ -933,15 +933,15 @@ static int tegra_xusb_powerdomain_init(struct device *dev, + int err; + + tegra->genpd_dev_host = dev_pm_domain_attach_by_name(dev, "xusb_host"); +- if (IS_ERR(tegra->genpd_dev_host)) { +- err = PTR_ERR(tegra->genpd_dev_host); ++ if (IS_ERR_OR_NULL(tegra->genpd_dev_host)) { ++ err = PTR_ERR(tegra->genpd_dev_host) ? : -ENODATA; + dev_err(dev, "failed to get host pm-domain: %d\n", err); + return err; + } + + tegra->genpd_dev_ss = dev_pm_domain_attach_by_name(dev, "xusb_ss"); +- if (IS_ERR(tegra->genpd_dev_ss)) { +- err = PTR_ERR(tegra->genpd_dev_ss); ++ if (IS_ERR_OR_NULL(tegra->genpd_dev_ss)) { ++ err = PTR_ERR(tegra->genpd_dev_ss) ? : -ENODATA; + dev_err(dev, "failed to get superspeed pm-domain: %d\n", err); + return err; + } +diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h +index a9031f4949842..5a6ad776858e3 100644 +--- a/drivers/usb/host/xhci.h ++++ b/drivers/usb/host/xhci.h +@@ -2376,7 +2376,7 @@ static inline const char *xhci_decode_trb(char *str, size_t size, + field3 & TRB_CYCLE ? 'C' : 'c'); + break; + case TRB_STOP_RING: +- sprintf(str, ++ snprintf(str, size, + "%s: slot %d sp %d ep %d flags %c", + xhci_trb_type_string(type), + TRB_TO_SLOT_ID(field3), +diff --git a/drivers/usb/renesas_usbhs/rza.c b/drivers/usb/renesas_usbhs/rza.c +index 24de64edb674b..2d77edefb4b30 100644 +--- a/drivers/usb/renesas_usbhs/rza.c ++++ b/drivers/usb/renesas_usbhs/rza.c +@@ -23,6 +23,10 @@ static int usbhs_rza1_hardware_init(struct platform_device *pdev) + extal_clk = of_find_node_by_name(NULL, "extal"); + of_property_read_u32(usb_x1_clk, "clock-frequency", &freq_usb); + of_property_read_u32(extal_clk, "clock-frequency", &freq_extal); ++ ++ of_node_put(usb_x1_clk); ++ of_node_put(extal_clk); ++ + if (freq_usb == 0) { + if (freq_extal == 12000000) { + /* Select 12MHz XTAL */ +diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c +index a43263a0edd88..891e52bc5002c 100644 +--- a/drivers/usb/serial/sierra.c ++++ b/drivers/usb/serial/sierra.c +@@ -757,7 +757,8 @@ static void sierra_close(struct usb_serial_port *port) + + /* + * Need to take susp_lock to make sure port is not already being +- * resumed, but no need to hold it due to initialized ++ * resumed, but no need to hold it due to the tty-port initialized ++ * flag. + */ + spin_lock_irq(&intfdata->susp_lock); + if (--intfdata->open_ports == 0) +diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c +index dc7a65b9ec982..2a2469b76cc54 100644 +--- a/drivers/usb/serial/usb-serial.c ++++ b/drivers/usb/serial/usb-serial.c +@@ -254,7 +254,7 @@ static int serial_open(struct tty_struct *tty, struct file *filp) + * + * Shut down a USB serial port. Serialized against activate by the + * tport mutex and kept to matching open/close pairs +- * of calls by the initialized flag. ++ * of calls by the tty-port initialized flag. + * + * Not called if tty is console. + */ +diff --git a/drivers/usb/serial/usb_wwan.c b/drivers/usb/serial/usb_wwan.c +index b2285d5a869de..628a75d1232ae 100644 +--- a/drivers/usb/serial/usb_wwan.c ++++ b/drivers/usb/serial/usb_wwan.c +@@ -435,7 +435,8 @@ void usb_wwan_close(struct usb_serial_port *port) + + /* + * Need to take susp_lock to make sure port is not already being +- * resumed, but no need to hold it due to initialized ++ * resumed, but no need to hold it due to the tty-port initialized ++ * flag. + */ + spin_lock_irq(&intfdata->susp_lock); + if (--intfdata->open_ports == 0) +diff --git a/drivers/vfio/vfio.c b/drivers/vfio/vfio.c +index 388597930b648..efd3782ead974 100644 +--- a/drivers/vfio/vfio.c ++++ b/drivers/vfio/vfio.c +@@ -1802,6 +1802,7 @@ struct vfio_info_cap_header *vfio_info_cap_add(struct vfio_info_cap *caps, + buf = krealloc(caps->buf, caps->size + size, GFP_KERNEL); + if (!buf) { + kfree(caps->buf); ++ caps->buf = NULL; + caps->size = 0; + return ERR_PTR(-ENOMEM); + } +diff --git a/drivers/video/fbdev/amba-clcd.c b/drivers/video/fbdev/amba-clcd.c +index 3b7a7c74bf0a5..09774ada36fb3 100644 +--- a/drivers/video/fbdev/amba-clcd.c ++++ b/drivers/video/fbdev/amba-clcd.c +@@ -714,16 +714,18 @@ static int clcdfb_of_init_display(struct clcd_fb *fb) + return -ENODEV; + + panel = of_graph_get_remote_port_parent(endpoint); +- if (!panel) +- return -ENODEV; ++ if (!panel) { ++ err = -ENODEV; ++ goto out_endpoint_put; ++ } + + err = clcdfb_of_get_backlight(panel, fb->panel); + if (err) +- return err; ++ goto out_panel_put; + + err = clcdfb_of_get_mode(&fb->dev->dev, panel, fb->panel); + if (err) +- return err; ++ goto out_panel_put; + + err = of_property_read_u32(fb->dev->dev.of_node, "max-memory-bandwidth", + &max_bandwidth); +@@ -752,11 +754,21 @@ static int clcdfb_of_init_display(struct clcd_fb *fb) + + if (of_property_read_u32_array(endpoint, + "arm,pl11x,tft-r0g0b0-pads", +- tft_r0b0g0, ARRAY_SIZE(tft_r0b0g0)) != 0) +- return -ENOENT; ++ tft_r0b0g0, ARRAY_SIZE(tft_r0b0g0)) != 0) { ++ err = -ENOENT; ++ goto out_panel_put; ++ } ++ ++ of_node_put(panel); ++ of_node_put(endpoint); + + return clcdfb_of_init_tft_panel(fb, tft_r0b0g0[0], + tft_r0b0g0[1], tft_r0b0g0[2]); ++out_panel_put: ++ of_node_put(panel); ++out_endpoint_put: ++ of_node_put(endpoint); ++ return err; + } + + static int clcdfb_of_vram_setup(struct clcd_fb *fb) +diff --git a/drivers/video/fbdev/arkfb.c b/drivers/video/fbdev/arkfb.c +index f940e8b66b858..6b1ad19b8db4c 100644 +--- a/drivers/video/fbdev/arkfb.c ++++ b/drivers/video/fbdev/arkfb.c +@@ -778,7 +778,12 @@ static int arkfb_set_par(struct fb_info *info) + return -EINVAL; + } + +- ark_set_pixclock(info, (hdiv * info->var.pixclock) / hmul); ++ value = (hdiv * info->var.pixclock) / hmul; ++ if (!value) { ++ fb_dbg(info, "invalid pixclock\n"); ++ value = 1; ++ } ++ ark_set_pixclock(info, value); + svga_set_timings(par->state.vgabase, &ark_timing_regs, &(info->var), hmul, hdiv, + (info->var.vmode & FB_VMODE_DOUBLE) ? 2 : 1, + (info->var.vmode & FB_VMODE_INTERLACED) ? 2 : 1, +@@ -789,6 +794,8 @@ static int arkfb_set_par(struct fb_info *info) + value = ((value * hmul / hdiv) / 8) - 5; + vga_wcrt(par->state.vgabase, 0x42, (value + 1) / 2); + ++ if (screen_size > info->screen_size) ++ screen_size = info->screen_size; + memset_io(info->screen_base, 0x00, screen_size); + /* Device and screen back on */ + svga_wcrt_mask(par->state.vgabase, 0x17, 0x80, 0x80); +diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c +index 8721b75131362..4a544e1e2038c 100644 +--- a/drivers/video/fbdev/core/fbcon.c ++++ b/drivers/video/fbdev/core/fbcon.c +@@ -123,8 +123,8 @@ static int logo_lines; + enums. */ + static int logo_shown = FBCON_LOGO_CANSHOW; + /* console mappings */ +-static int first_fb_vc; +-static int last_fb_vc = MAX_NR_CONSOLES - 1; ++static unsigned int first_fb_vc; ++static unsigned int last_fb_vc = MAX_NR_CONSOLES - 1; + static int fbcon_is_default = 1; + static int primary_device = -1; + static int fbcon_has_console_bind; +@@ -474,10 +474,12 @@ static int __init fb_console_setup(char *this_opt) + options += 3; + if (*options) + first_fb_vc = simple_strtoul(options, &options, 10) - 1; +- if (first_fb_vc < 0) ++ if (first_fb_vc >= MAX_NR_CONSOLES) + first_fb_vc = 0; + if (*options++ == '-') + last_fb_vc = simple_strtoul(options, &options, 10) - 1; ++ if (last_fb_vc < first_fb_vc || last_fb_vc >= MAX_NR_CONSOLES) ++ last_fb_vc = MAX_NR_CONSOLES - 1; + fbcon_is_default = 0; + continue; + } +diff --git a/drivers/video/fbdev/i740fb.c b/drivers/video/fbdev/i740fb.c +index 347cf8babc3e3..1434eb0220e78 100644 +--- a/drivers/video/fbdev/i740fb.c ++++ b/drivers/video/fbdev/i740fb.c +@@ -400,7 +400,7 @@ static int i740fb_decode_var(const struct fb_var_screeninfo *var, + u32 xres, right, hslen, left, xtotal; + u32 yres, lower, vslen, upper, ytotal; + u32 vxres, xoffset, vyres, yoffset; +- u32 bpp, base, dacspeed24, mem; ++ u32 bpp, base, dacspeed24, mem, freq; + u8 r7; + int i; + +@@ -643,7 +643,12 @@ static int i740fb_decode_var(const struct fb_var_screeninfo *var, + par->atc[VGA_ATC_OVERSCAN] = 0; + + /* Calculate VCLK that most closely matches the requested dot clock */ +- i740_calc_vclk((((u32)1e9) / var->pixclock) * (u32)(1e3), par); ++ freq = (((u32)1e9) / var->pixclock) * (u32)(1e3); ++ if (freq < I740_RFREQ_FIX) { ++ fb_dbg(info, "invalid pixclock\n"); ++ freq = I740_RFREQ_FIX; ++ } ++ i740_calc_vclk(freq, par); + + /* Since we program the clocks ourselves, always use VCLK2. */ + par->misc |= 0x0C; +diff --git a/drivers/video/fbdev/s3fb.c b/drivers/video/fbdev/s3fb.c +index be16c349c10f8..228e5ee7a5475 100644 +--- a/drivers/video/fbdev/s3fb.c ++++ b/drivers/video/fbdev/s3fb.c +@@ -902,6 +902,8 @@ static int s3fb_set_par(struct fb_info *info) + value = clamp((htotal + hsstart + 1) / 2 + 2, hsstart + 4, htotal + 1); + svga_wcrt_multi(par->state.vgabase, s3_dtpc_regs, value); + ++ if (screen_size > info->screen_size) ++ screen_size = info->screen_size; + memset_io(info->screen_base, 0x00, screen_size); + /* Device and screen back on */ + svga_wcrt_mask(par->state.vgabase, 0x17, 0x80, 0x80); +diff --git a/drivers/video/fbdev/sis/init.c b/drivers/video/fbdev/sis/init.c +index fde27feae5d0c..d6b2ce95a8594 100644 +--- a/drivers/video/fbdev/sis/init.c ++++ b/drivers/video/fbdev/sis/init.c +@@ -355,12 +355,12 @@ SiS_GetModeID(int VGAEngine, unsigned int VBFlags, int HDisplay, int VDisplay, + } + break; + case 400: +- if((!(VBFlags & CRT1_LCDA)) || ((LCDwidth >= 800) && (LCDwidth >= 600))) { ++ if((!(VBFlags & CRT1_LCDA)) || ((LCDwidth >= 800) && (LCDheight >= 600))) { + if(VDisplay == 300) ModeIndex = ModeIndex_400x300[Depth]; + } + break; + case 512: +- if((!(VBFlags & CRT1_LCDA)) || ((LCDwidth >= 1024) && (LCDwidth >= 768))) { ++ if((!(VBFlags & CRT1_LCDA)) || ((LCDwidth >= 1024) && (LCDheight >= 768))) { + if(VDisplay == 384) ModeIndex = ModeIndex_512x384[Depth]; + } + break; +diff --git a/drivers/video/fbdev/vt8623fb.c b/drivers/video/fbdev/vt8623fb.c +index c339a8fbad81f..61e2028924a6b 100644 +--- a/drivers/video/fbdev/vt8623fb.c ++++ b/drivers/video/fbdev/vt8623fb.c +@@ -504,6 +504,8 @@ static int vt8623fb_set_par(struct fb_info *info) + (info->var.vmode & FB_VMODE_DOUBLE) ? 2 : 1, 1, + 1, info->node); + ++ if (screen_size > info->screen_size) ++ screen_size = info->screen_size; + memset_io(info->screen_base, 0x00, screen_size); + + /* Device and screen back on */ +diff --git a/drivers/virt/vboxguest/vboxguest_linux.c b/drivers/virt/vboxguest/vboxguest_linux.c +index 32c2c52f7e84e..484c2f09f2ea7 100644 +--- a/drivers/virt/vboxguest/vboxguest_linux.c ++++ b/drivers/virt/vboxguest/vboxguest_linux.c +@@ -361,8 +361,8 @@ static int vbg_pci_probe(struct pci_dev *pci, const struct pci_device_id *id) + goto err_vbg_core_exit; + } + +- ret = devm_request_irq(dev, pci->irq, vbg_core_isr, IRQF_SHARED, +- DEVICE_NAME, gdev); ++ ret = request_irq(pci->irq, vbg_core_isr, IRQF_SHARED, DEVICE_NAME, ++ gdev); + if (ret) { + vbg_err("vboxguest: Error requesting irq: %d\n", ret); + goto err_vbg_core_exit; +@@ -372,7 +372,7 @@ static int vbg_pci_probe(struct pci_dev *pci, const struct pci_device_id *id) + if (ret) { + vbg_err("vboxguest: Error misc_register %s failed: %d\n", + DEVICE_NAME, ret); +- goto err_vbg_core_exit; ++ goto err_free_irq; + } + + ret = misc_register(&gdev->misc_device_user); +@@ -408,6 +408,8 @@ err_unregister_misc_device_user: + misc_deregister(&gdev->misc_device_user); + err_unregister_misc_device: + misc_deregister(&gdev->misc_device); ++err_free_irq: ++ free_irq(pci->irq, gdev); + err_vbg_core_exit: + vbg_core_exit(gdev); + err_disable_pcidev: +@@ -424,6 +426,7 @@ static void vbg_pci_remove(struct pci_dev *pci) + vbg_gdev = NULL; + mutex_unlock(&vbg_gdev_mutex); + ++ free_irq(pci->irq, gdev); + device_remove_file(gdev->dev, &dev_attr_host_features); + device_remove_file(gdev->dev, &dev_attr_host_version); + misc_deregister(&gdev->misc_device_user); +diff --git a/drivers/watchdog/armada_37xx_wdt.c b/drivers/watchdog/armada_37xx_wdt.c +index e5dcb26d85f0a..dcb3ffda3fad4 100644 +--- a/drivers/watchdog/armada_37xx_wdt.c ++++ b/drivers/watchdog/armada_37xx_wdt.c +@@ -274,6 +274,8 @@ static int armada_37xx_wdt_probe(struct platform_device *pdev) + if (!res) + return -ENODEV; + dev->reg = devm_ioremap(&pdev->dev, res->start, resource_size(res)); ++ if (!dev->reg) ++ return -ENOMEM; + + /* init clock */ + dev->clk = devm_clk_get(&pdev->dev, NULL); +diff --git a/drivers/xen/xenbus/xenbus_dev_frontend.c b/drivers/xen/xenbus/xenbus_dev_frontend.c +index 597af455a522b..0792fda49a15f 100644 +--- a/drivers/xen/xenbus/xenbus_dev_frontend.c ++++ b/drivers/xen/xenbus/xenbus_dev_frontend.c +@@ -128,7 +128,7 @@ static ssize_t xenbus_file_read(struct file *filp, + { + struct xenbus_file_priv *u = filp->private_data; + struct read_buffer *rb; +- unsigned i; ++ ssize_t i; + int ret; + + mutex_lock(&u->reply_mutex); +@@ -148,7 +148,7 @@ again: + rb = list_entry(u->read_buffers.next, struct read_buffer, list); + i = 0; + while (i < len) { +- unsigned sz = min((unsigned)len - i, rb->len - rb->cons); ++ size_t sz = min_t(size_t, len - i, rb->len - rb->cons); + + ret = copy_to_user(ubuf + i, &rb->msg[rb->cons], sz); + +diff --git a/fs/attr.c b/fs/attr.c +index b4bbdbd4c8ca0..848ffe6e3c24b 100644 +--- a/fs/attr.c ++++ b/fs/attr.c +@@ -134,6 +134,8 @@ EXPORT_SYMBOL(setattr_prepare); + */ + int inode_newsize_ok(const struct inode *inode, loff_t offset) + { ++ if (offset < 0) ++ return -EINVAL; + if (inode->i_size < offset) { + unsigned long limit; + +diff --git a/fs/btrfs/block-group.c b/fs/btrfs/block-group.c +index bcf19dfb0af35..278933cd3a092 100644 +--- a/fs/btrfs/block-group.c ++++ b/fs/btrfs/block-group.c +@@ -2938,6 +2938,7 @@ int btrfs_chunk_alloc(struct btrfs_trans_handle *trans, u64 flags, + * attempt. + */ + wait_for_alloc = true; ++ force = CHUNK_ALLOC_NO_FORCE; + spin_unlock(&space_info->lock); + mutex_lock(&fs_info->chunk_mutex); + mutex_unlock(&fs_info->chunk_mutex); +diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c +index a4b3e6f6bf021..b94d68035c5d9 100644 +--- a/fs/btrfs/disk-io.c ++++ b/fs/btrfs/disk-io.c +@@ -2970,6 +2970,20 @@ int open_ctree(struct super_block *sb, + err = -EINVAL; + goto fail_csum; + } ++ /* ++ * We have unsupported RO compat features, although RO mounted, we ++ * should not cause any metadata write, including log replay. ++ * Or we could screw up whatever the new feature requires. ++ */ ++ if (unlikely(features && btrfs_super_log_root(disk_super) && ++ !btrfs_test_opt(fs_info, NOLOGREPLAY))) { ++ btrfs_err(fs_info, ++"cannot replay dirty log with unsupported compat_ro features (0x%llx), try rescue=nologreplay", ++ features); ++ err = -EINVAL; ++ goto fail_alloc; ++ } ++ + + ret = btrfs_init_workqueues(fs_info, fs_devices); + if (ret) { +diff --git a/fs/btrfs/raid56.c b/fs/btrfs/raid56.c +index 7ac679ed2b6c6..226a17a335da3 100644 +--- a/fs/btrfs/raid56.c ++++ b/fs/btrfs/raid56.c +@@ -334,6 +334,9 @@ static void merge_rbio(struct btrfs_raid_bio *dest, + { + bio_list_merge(&dest->bio_list, &victim->bio_list); + dest->bio_list_bytes += victim->bio_list_bytes; ++ /* Also inherit the bitmaps from @victim. */ ++ bitmap_or(dest->dbitmap, victim->dbitmap, dest->dbitmap, ++ dest->stripe_npages); + dest->generic_bio_cnt += victim->generic_bio_cnt; + bio_list_init(&victim->bio_list); + } +@@ -878,6 +881,12 @@ static void rbio_orig_end_io(struct btrfs_raid_bio *rbio, blk_status_t err) + + if (rbio->generic_bio_cnt) + btrfs_bio_counter_sub(rbio->fs_info, rbio->generic_bio_cnt); ++ /* ++ * Clear the data bitmap, as the rbio may be cached for later usage. ++ * do this before before unlock_stripe() so there will be no new bio ++ * for this bio. ++ */ ++ bitmap_clear(rbio->dbitmap, 0, rbio->stripe_npages); + + /* + * At this moment, rbio->bio_list is empty, however since rbio does not +@@ -1212,6 +1221,9 @@ static noinline void finish_rmw(struct btrfs_raid_bio *rbio) + else + BUG(); + ++ /* We should have at least one data sector. */ ++ ASSERT(bitmap_weight(rbio->dbitmap, rbio->stripe_npages)); ++ + /* at this point we either have a full stripe, + * or we've read the full stripe from the drive. + * recalculate the parity and write the new results. +@@ -1285,6 +1297,11 @@ static noinline void finish_rmw(struct btrfs_raid_bio *rbio) + for (stripe = 0; stripe < rbio->real_stripes; stripe++) { + for (pagenr = 0; pagenr < rbio->stripe_npages; pagenr++) { + struct page *page; ++ ++ /* This vertical stripe has no data, skip it. */ ++ if (!test_bit(pagenr, rbio->dbitmap)) ++ continue; ++ + if (stripe < rbio->nr_data) { + page = page_in_rbio(rbio, stripe, pagenr, 1); + if (!page) +@@ -1309,6 +1326,11 @@ static noinline void finish_rmw(struct btrfs_raid_bio *rbio) + + for (pagenr = 0; pagenr < rbio->stripe_npages; pagenr++) { + struct page *page; ++ ++ /* This vertical stripe has no data, skip it. */ ++ if (!test_bit(pagenr, rbio->dbitmap)) ++ continue; ++ + if (stripe < rbio->nr_data) { + page = page_in_rbio(rbio, stripe, pagenr, 1); + if (!page) +@@ -1748,6 +1770,33 @@ static void btrfs_raid_unplug(struct blk_plug_cb *cb, bool from_schedule) + run_plug(plug); + } + ++/* Add the original bio into rbio->bio_list, and update rbio::dbitmap. */ ++static void rbio_add_bio(struct btrfs_raid_bio *rbio, struct bio *orig_bio) ++{ ++ const struct btrfs_fs_info *fs_info = rbio->fs_info; ++ const u64 orig_logical = orig_bio->bi_iter.bi_sector << SECTOR_SHIFT; ++ const u64 full_stripe_start = rbio->bbio->raid_map[0]; ++ const u32 orig_len = orig_bio->bi_iter.bi_size; ++ const u32 sectorsize = fs_info->sectorsize; ++ u64 cur_logical; ++ ++ ASSERT(orig_logical >= full_stripe_start && ++ orig_logical + orig_len <= full_stripe_start + ++ rbio->nr_data * rbio->stripe_len); ++ ++ bio_list_add(&rbio->bio_list, orig_bio); ++ rbio->bio_list_bytes += orig_bio->bi_iter.bi_size; ++ ++ /* Update the dbitmap. */ ++ for (cur_logical = orig_logical; cur_logical < orig_logical + orig_len; ++ cur_logical += sectorsize) { ++ int bit = ((u32)(cur_logical - full_stripe_start) >> ++ PAGE_SHIFT) % rbio->stripe_npages; ++ ++ set_bit(bit, rbio->dbitmap); ++ } ++} ++ + /* + * our main entry point for writes from the rest of the FS. + */ +@@ -1764,9 +1813,8 @@ int raid56_parity_write(struct btrfs_fs_info *fs_info, struct bio *bio, + btrfs_put_bbio(bbio); + return PTR_ERR(rbio); + } +- bio_list_add(&rbio->bio_list, bio); +- rbio->bio_list_bytes = bio->bi_iter.bi_size; + rbio->operation = BTRFS_RBIO_WRITE; ++ rbio_add_bio(rbio, bio); + + btrfs_bio_counter_inc_noblocked(fs_info); + rbio->generic_bio_cnt = 1; +@@ -2068,9 +2116,12 @@ static int __raid56_parity_recover(struct btrfs_raid_bio *rbio) + atomic_set(&rbio->error, 0); + + /* +- * read everything that hasn't failed. Thanks to the +- * stripe cache, it is possible that some or all of these +- * pages are going to be uptodate. ++ * Read everything that hasn't failed. However this time we will ++ * not trust any cached sector. ++ * As we may read out some stale data but higher layer is not reading ++ * that stale part. ++ * ++ * So here we always re-read everything in recovery path. + */ + for (stripe = 0; stripe < rbio->real_stripes; stripe++) { + if (rbio->faila == stripe || rbio->failb == stripe) { +@@ -2079,16 +2130,6 @@ static int __raid56_parity_recover(struct btrfs_raid_bio *rbio) + } + + for (pagenr = 0; pagenr < rbio->stripe_npages; pagenr++) { +- struct page *p; +- +- /* +- * the rmw code may have already read this +- * page in +- */ +- p = rbio_stripe_page(rbio, stripe, pagenr); +- if (PageUptodate(p)) +- continue; +- + ret = rbio_add_io_page(rbio, &bio_list, + rbio_stripe_page(rbio, stripe, pagenr), + stripe, pagenr, rbio->stripe_len); +@@ -2170,8 +2211,7 @@ int raid56_parity_recover(struct btrfs_fs_info *fs_info, struct bio *bio, + } + + rbio->operation = BTRFS_RBIO_READ_REBUILD; +- bio_list_add(&rbio->bio_list, bio); +- rbio->bio_list_bytes = bio->bi_iter.bi_size; ++ rbio_add_bio(rbio, bio); + + rbio->faila = find_logical_bio_stripe(rbio, bio); + if (rbio->faila == -1) { +diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c +index b7bfecfc2ea33..bebd74267bed6 100644 +--- a/fs/btrfs/tree-log.c ++++ b/fs/btrfs/tree-log.c +@@ -1100,7 +1100,9 @@ again: + extref = btrfs_lookup_inode_extref(NULL, root, path, name, namelen, + inode_objectid, parent_objectid, 0, + 0); +- if (!IS_ERR_OR_NULL(extref)) { ++ if (IS_ERR(extref)) { ++ return PTR_ERR(extref); ++ } else if (extref) { + u32 item_size; + u32 cur_offset = 0; + unsigned long base; +diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c +index 57164563eec69..6ae281cff0d50 100644 +--- a/fs/cifs/smb2ops.c ++++ b/fs/cifs/smb2ops.c +@@ -960,9 +960,7 @@ move_smb2_ea_to_cifs(char *dst, size_t dst_size, + size_t name_len, value_len, user_name_len; + + while (src_size > 0) { +- name = &src->ea_data[0]; + name_len = (size_t)src->ea_name_length; +- value = &src->ea_data[src->ea_name_length + 1]; + value_len = (size_t)le16_to_cpu(src->ea_value_length); + + if (name_len == 0) +@@ -974,6 +972,9 @@ move_smb2_ea_to_cifs(char *dst, size_t dst_size, + goto out; + } + ++ name = &src->ea_data[0]; ++ value = &src->ea_data[src->ea_name_length + 1]; ++ + if (ea_name) { + if (ea_name_len == name_len && + memcmp(ea_name, name, name_len) == 0) { +diff --git a/fs/erofs/decompressor.c b/fs/erofs/decompressor.c +index 23b74b8e8f96f..38eeec5e30327 100644 +--- a/fs/erofs/decompressor.c ++++ b/fs/erofs/decompressor.c +@@ -56,14 +56,18 @@ static int z_erofs_lz4_prepare_destpages(struct z_erofs_decompress_req *rq, + + if (page) { + __clear_bit(j, bounced); +- if (kaddr) { +- if (kaddr + PAGE_SIZE == page_address(page)) ++ if (!PageHighMem(page)) { ++ if (!i) { ++ kaddr = page_address(page); ++ continue; ++ } ++ if (kaddr && ++ kaddr + PAGE_SIZE == page_address(page)) { + kaddr += PAGE_SIZE; +- else +- kaddr = NULL; +- } else if (!i) { +- kaddr = page_address(page); ++ continue; ++ } + } ++ kaddr = NULL; + continue; + } + kaddr = NULL; +diff --git a/fs/eventpoll.c b/fs/eventpoll.c +index 339453ac834cc..7e11135bc915c 100644 +--- a/fs/eventpoll.c ++++ b/fs/eventpoll.c +@@ -1803,6 +1803,21 @@ static inline struct timespec64 ep_set_mstimeout(long ms) + return timespec64_add_safe(now, ts); + } + ++/* ++ * autoremove_wake_function, but remove even on failure to wake up, because we ++ * know that default_wake_function/ttwu will only fail if the thread is already ++ * woken, and in that case the ep_poll loop will remove the entry anyways, not ++ * try to reuse it. ++ */ ++static int ep_autoremove_wake_function(struct wait_queue_entry *wq_entry, ++ unsigned int mode, int sync, void *key) ++{ ++ int ret = default_wake_function(wq_entry, mode, sync, key); ++ ++ list_del_init(&wq_entry->entry); ++ return ret; ++} ++ + /** + * ep_poll - Retrieves ready events, and delivers them to the caller supplied + * event buffer. +@@ -1880,8 +1895,15 @@ fetch_events: + * normal wakeup path no need to call __remove_wait_queue() + * explicitly, thus ep->lock is not taken, which halts the + * event delivery. ++ * ++ * In fact, we now use an even more aggressive function that ++ * unconditionally removes, because we don't reuse the wait ++ * entry between loop iterations. This lets us also avoid the ++ * performance issue if a process is killed, causing all of its ++ * threads to wake up without being removed normally. + */ + init_wait(&wait); ++ wait.func = ep_autoremove_wake_function; + write_lock_irq(&ep->lock); + __add_wait_queue_exclusive(&ep->wq, &wait); + write_unlock_irq(&ep->lock); +diff --git a/fs/ext2/super.c b/fs/ext2/super.c +index db403c01d4d5c..644c83c115bc2 100644 +--- a/fs/ext2/super.c ++++ b/fs/ext2/super.c +@@ -1077,9 +1077,10 @@ static int ext2_fill_super(struct super_block *sb, void *data, int silent) + sbi->s_frags_per_group); + goto failed_mount; + } +- if (sbi->s_inodes_per_group > sb->s_blocksize * 8) { ++ if (sbi->s_inodes_per_group < sbi->s_inodes_per_block || ++ sbi->s_inodes_per_group > sb->s_blocksize * 8) { + ext2_msg(sb, KERN_ERR, +- "error: #inodes per group too big: %lu", ++ "error: invalid #inodes per group: %lu", + sbi->s_inodes_per_group); + goto failed_mount; + } +@@ -1089,6 +1090,13 @@ static int ext2_fill_super(struct super_block *sb, void *data, int silent) + sbi->s_groups_count = ((le32_to_cpu(es->s_blocks_count) - + le32_to_cpu(es->s_first_data_block) - 1) + / EXT2_BLOCKS_PER_GROUP(sb)) + 1; ++ if ((u64)sbi->s_groups_count * sbi->s_inodes_per_group != ++ le32_to_cpu(es->s_inodes_count)) { ++ ext2_msg(sb, KERN_ERR, "error: invalid #inodes: %u vs computed %llu", ++ le32_to_cpu(es->s_inodes_count), ++ (u64)sbi->s_groups_count * sbi->s_inodes_per_group); ++ goto failed_mount; ++ } + db_count = (sbi->s_groups_count + EXT2_DESC_PER_BLOCK(sb) - 1) / + EXT2_DESC_PER_BLOCK(sb); + sbi->s_group_desc = kmalloc_array (db_count, +diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c +index 62384ae77a78f..5ef13ede04457 100644 +--- a/fs/ext4/inline.c ++++ b/fs/ext4/inline.c +@@ -34,6 +34,9 @@ static int get_max_inline_xattr_value_size(struct inode *inode, + struct ext4_inode *raw_inode; + int free, min_offs; + ++ if (!EXT4_INODE_HAS_XATTR_SPACE(inode)) ++ return 0; ++ + min_offs = EXT4_SB(inode->i_sb)->s_inode_size - + EXT4_GOOD_OLD_INODE_SIZE - + EXT4_I(inode)->i_extra_isize - +diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c +index d8fee911d4f4d..22feae1d5f777 100644 +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -1717,7 +1717,14 @@ static void mpage_release_unused_pages(struct mpage_da_data *mpd, + ext4_lblk_t start, last; + start = index << (PAGE_SHIFT - inode->i_blkbits); + last = end << (PAGE_SHIFT - inode->i_blkbits); ++ ++ /* ++ * avoid racing with extent status tree scans made by ++ * ext4_insert_delayed_block() ++ */ ++ down_write(&EXT4_I(inode)->i_data_sem); + ext4_es_remove_extent(inode, start, last - start + 1); ++ up_write(&EXT4_I(inode)->i_data_sem); + } + + pagevec_init(&pvec); +@@ -4834,8 +4841,7 @@ static inline int ext4_iget_extra_inode(struct inode *inode, + __le32 *magic = (void *)raw_inode + + EXT4_GOOD_OLD_INODE_SIZE + ei->i_extra_isize; + +- if (EXT4_GOOD_OLD_INODE_SIZE + ei->i_extra_isize + sizeof(__le32) <= +- EXT4_INODE_SIZE(inode->i_sb) && ++ if (EXT4_INODE_HAS_XATTR_SPACE(inode) && + *magic == cpu_to_le32(EXT4_XATTR_MAGIC)) { + ext4_set_inode_state(inode, EXT4_STATE_XATTR); + return ext4_find_inline_data_nolock(inode); +diff --git a/fs/ext4/migrate.c b/fs/ext4/migrate.c +index c5b2ea1a93729..1faa8e4ffb9df 100644 +--- a/fs/ext4/migrate.c ++++ b/fs/ext4/migrate.c +@@ -435,7 +435,7 @@ int ext4_ext_migrate(struct inode *inode) + struct inode *tmp_inode = NULL; + struct migrate_struct lb; + unsigned long max_entries; +- __u32 goal; ++ __u32 goal, tmp_csum_seed; + uid_t owner[2]; + + /* +@@ -483,6 +483,7 @@ int ext4_ext_migrate(struct inode *inode) + * the migration. + */ + ei = EXT4_I(inode); ++ tmp_csum_seed = EXT4_I(tmp_inode)->i_csum_seed; + EXT4_I(tmp_inode)->i_csum_seed = ei->i_csum_seed; + i_size_write(tmp_inode, i_size_read(inode)); + /* +@@ -593,6 +594,7 @@ err_out: + * the inode is not visible to user space. + */ + tmp_inode->i_blocks = 0; ++ EXT4_I(tmp_inode)->i_csum_seed = tmp_csum_seed; + + /* Reset the extent details */ + ext4_ext_tree_init(handle, tmp_inode); +diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c +index d151892db8b0c..aaf1ed8ba87c1 100644 +--- a/fs/ext4/namei.c ++++ b/fs/ext4/namei.c +@@ -54,6 +54,7 @@ static struct buffer_head *ext4_append(handle_t *handle, + struct inode *inode, + ext4_lblk_t *block) + { ++ struct ext4_map_blocks map; + struct buffer_head *bh; + int err; + +@@ -63,6 +64,21 @@ static struct buffer_head *ext4_append(handle_t *handle, + return ERR_PTR(-ENOSPC); + + *block = inode->i_size >> inode->i_sb->s_blocksize_bits; ++ map.m_lblk = *block; ++ map.m_len = 1; ++ ++ /* ++ * We're appending new directory block. Make sure the block is not ++ * allocated yet, otherwise we will end up corrupting the ++ * directory. ++ */ ++ err = ext4_map_blocks(NULL, inode, &map, 0); ++ if (err < 0) ++ return ERR_PTR(err); ++ if (err) { ++ EXT4_ERROR_INODE(inode, "Logical block already allocated"); ++ return ERR_PTR(-EFSCORRUPTED); ++ } + + bh = ext4_bread(handle, inode, *block, EXT4_GET_BLOCKS_CREATE); + if (IS_ERR(bh)) +@@ -2913,11 +2929,8 @@ bool ext4_empty_dir(struct inode *inode) + de = (struct ext4_dir_entry_2 *) (bh->b_data + + (offset & (sb->s_blocksize - 1))); + if (ext4_check_dir_entry(inode, NULL, de, bh, +- bh->b_data, bh->b_size, offset)) { +- offset = (offset | (sb->s_blocksize - 1)) + 1; +- continue; +- } +- if (le32_to_cpu(de->inode)) { ++ bh->b_data, bh->b_size, offset) || ++ le32_to_cpu(de->inode)) { + brelse(bh); + return false; + } +diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c +index 6410c1e098d36..f0fc7fc579e62 100644 +--- a/fs/ext4/resize.c ++++ b/fs/ext4/resize.c +@@ -1483,6 +1483,7 @@ static void ext4_update_super(struct super_block *sb, + * Update the fs overhead information + */ + ext4_calculate_overhead(sb); ++ es->s_overhead_clusters = cpu_to_le32(sbi->s_overhead); + + if (test_opt(sb, DEBUG)) + printk(KERN_DEBUG "EXT4-fs: added group %u:" +@@ -1978,6 +1979,16 @@ int ext4_resize_fs(struct super_block *sb, ext4_fsblk_t n_blocks_count) + } + brelse(bh); + ++ /* ++ * For bigalloc, trim the requested size to the nearest cluster ++ * boundary to avoid creating an unusable filesystem. We do this ++ * silently, instead of returning an error, to avoid breaking ++ * callers that blindly resize the filesystem to the full size of ++ * the underlying block device. ++ */ ++ if (ext4_has_feature_bigalloc(sb)) ++ n_blocks_count &= ~((1 << EXT4_CLUSTER_BITS(sb)) - 1); ++ + retry: + o_blocks_count = ext4_blocks_count(es); + +diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c +index 20e40cac819e4..4b0e2bc71d2cb 100644 +--- a/fs/ext4/xattr.c ++++ b/fs/ext4/xattr.c +@@ -2184,8 +2184,9 @@ int ext4_xattr_ibody_find(struct inode *inode, struct ext4_xattr_info *i, + struct ext4_inode *raw_inode; + int error; + +- if (EXT4_I(inode)->i_extra_isize == 0) ++ if (!EXT4_INODE_HAS_XATTR_SPACE(inode)) + return 0; ++ + raw_inode = ext4_raw_inode(&is->iloc); + header = IHDR(inode, raw_inode); + is->s.base = is->s.first = IFIRST(header); +@@ -2213,8 +2214,9 @@ int ext4_xattr_ibody_inline_set(handle_t *handle, struct inode *inode, + struct ext4_xattr_search *s = &is->s; + int error; + +- if (EXT4_I(inode)->i_extra_isize == 0) ++ if (!EXT4_INODE_HAS_XATTR_SPACE(inode)) + return -ENOSPC; ++ + error = ext4_xattr_set_entry(i, s, handle, inode, false /* is_block */); + if (error) + return error; +diff --git a/fs/ext4/xattr.h b/fs/ext4/xattr.h +index f39cad2abe2a8..990084e00374f 100644 +--- a/fs/ext4/xattr.h ++++ b/fs/ext4/xattr.h +@@ -95,6 +95,19 @@ struct ext4_xattr_entry { + + #define EXT4_ZERO_XATTR_VALUE ((void *)-1) + ++/* ++ * If we want to add an xattr to the inode, we should make sure that ++ * i_extra_isize is not 0 and that the inode size is not less than ++ * EXT4_GOOD_OLD_INODE_SIZE + extra_isize + pad. ++ * EXT4_GOOD_OLD_INODE_SIZE extra_isize header entry pad data ++ * |--------------------------|------------|------|---------|---|-------| ++ */ ++#define EXT4_INODE_HAS_XATTR_SPACE(inode) \ ++ ((EXT4_I(inode)->i_extra_isize != 0) && \ ++ (EXT4_GOOD_OLD_INODE_SIZE + EXT4_I(inode)->i_extra_isize + \ ++ sizeof(struct ext4_xattr_ibody_header) + EXT4_XATTR_PAD <= \ ++ EXT4_INODE_SIZE((inode)->i_sb))) ++ + struct ext4_xattr_info { + const char *name; + const void *value; +diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c +index 3dc7cc3d6ac69..b080d5c58f6cb 100644 +--- a/fs/f2fs/node.c ++++ b/fs/f2fs/node.c +@@ -1240,7 +1240,11 @@ struct page *f2fs_new_node_page(struct dnode_of_data *dn, unsigned int ofs) + dec_valid_node_count(sbi, dn->inode, !ofs); + goto fail; + } +- f2fs_bug_on(sbi, new_ni.blk_addr != NULL_ADDR); ++ if (unlikely(new_ni.blk_addr != NULL_ADDR)) { ++ err = -EFSCORRUPTED; ++ set_sbi_flag(sbi, SBI_NEED_FSCK); ++ goto fail; ++ } + #endif + new_ni.nid = dn->nid; + new_ni.ino = dn->inode->i_ino; +diff --git a/fs/fuse/control.c b/fs/fuse/control.c +index c23f6f243ad42..2742d74cedda8 100644 +--- a/fs/fuse/control.c ++++ b/fs/fuse/control.c +@@ -265,7 +265,7 @@ int fuse_ctl_add_conn(struct fuse_conn *fc) + struct dentry *parent; + char name[32]; + +- if (!fuse_control_sb) ++ if (!fuse_control_sb || fc->no_control) + return 0; + + parent = fuse_control_sb->s_root; +@@ -303,7 +303,7 @@ void fuse_ctl_remove_conn(struct fuse_conn *fc) + { + int i; + +- if (!fuse_control_sb) ++ if (!fuse_control_sb || fc->no_control) + return; + + for (i = fc->ctl_ndents - 1; i >= 0; i--) { +diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c +index aa1d5cf1bc3a4..f3d712decb57c 100644 +--- a/fs/fuse/inode.c ++++ b/fs/fuse/inode.c +@@ -162,6 +162,12 @@ void fuse_change_attributes_common(struct inode *inode, struct fuse_attr *attr, + inode->i_uid = make_kuid(fc->user_ns, attr->uid); + inode->i_gid = make_kgid(fc->user_ns, attr->gid); + inode->i_blocks = attr->blocks; ++ ++ /* Sanitize nsecs */ ++ attr->atimensec = min_t(u32, attr->atimensec, NSEC_PER_SEC - 1); ++ attr->mtimensec = min_t(u32, attr->mtimensec, NSEC_PER_SEC - 1); ++ attr->ctimensec = min_t(u32, attr->ctimensec, NSEC_PER_SEC - 1); ++ + inode->i_atime.tv_sec = attr->atime; + inode->i_atime.tv_nsec = attr->atimensec; + /* mtime from server may be stale due to local buffered write */ +diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c +index d45ceb2e21492..8d5aced7ed0c4 100644 +--- a/fs/jbd2/commit.c ++++ b/fs/jbd2/commit.c +@@ -514,13 +514,13 @@ void jbd2_journal_commit_transaction(journal_t *journal) + */ + jbd2_journal_switch_revoke_table(journal); + ++ write_lock(&journal->j_state_lock); + /* + * Reserved credits cannot be claimed anymore, free them + */ + atomic_sub(atomic_read(&journal->j_reserved_credits), + &commit_transaction->t_outstanding_credits); + +- write_lock(&journal->j_state_lock); + trace_jbd2_commit_flushing(journal, commit_transaction); + stats.run.rs_flushing = jiffies; + stats.run.rs_locked = jbd2_time_diff(stats.run.rs_locked, +diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c +index be05fb96757c3..e0bd731404150 100644 +--- a/fs/jbd2/transaction.c ++++ b/fs/jbd2/transaction.c +@@ -1375,8 +1375,6 @@ int jbd2_journal_dirty_metadata(handle_t *handle, struct buffer_head *bh) + struct journal_head *jh; + int ret = 0; + +- if (is_handle_aborted(handle)) +- return -EROFS; + if (!buffer_jbd(bh)) + return -EUCLEAN; + +@@ -1423,6 +1421,18 @@ int jbd2_journal_dirty_metadata(handle_t *handle, struct buffer_head *bh) + journal = transaction->t_journal; + jbd_lock_bh_state(bh); + ++ if (is_handle_aborted(handle)) { ++ /* ++ * Check journal aborting with @jh->b_state_lock locked, ++ * since 'jh->b_transaction' could be replaced with ++ * 'jh->b_next_transaction' during old transaction ++ * committing if journal aborted, which may fail ++ * assertion on 'jh->b_frozen_data == NULL'. ++ */ ++ ret = -EROFS; ++ goto out_unlock_bh; ++ } ++ + if (jh->b_modified == 0) { + /* + * This buffer's got modified and becoming part +diff --git a/fs/namei.c b/fs/namei.c +index b952ecbd49c29..22d13732e61d7 100644 +--- a/fs/namei.c ++++ b/fs/namei.c +@@ -3443,6 +3443,8 @@ struct dentry *vfs_tmpfile(struct dentry *dentry, umode_t mode, int open_flag) + child = d_alloc(dentry, &slash_name); + if (unlikely(!child)) + goto out_err; ++ if (!IS_POSIXACL(dir)) ++ mode &= ~current_umask(); + error = dir->i_op->tmpfile(dir, child, mode); + if (error) + goto out_err; +diff --git a/fs/nfs/nfs4idmap.c b/fs/nfs/nfs4idmap.c +index 1e7296395d71b..4e6dd267ac504 100644 +--- a/fs/nfs/nfs4idmap.c ++++ b/fs/nfs/nfs4idmap.c +@@ -560,22 +560,20 @@ nfs_idmap_prepare_pipe_upcall(struct idmap *idmap, + return true; + } + +-static void +-nfs_idmap_complete_pipe_upcall_locked(struct idmap *idmap, int ret) ++static void nfs_idmap_complete_pipe_upcall(struct idmap_legacy_upcalldata *data, ++ int ret) + { +- struct key *authkey = idmap->idmap_upcall_data->authkey; +- +- kfree(idmap->idmap_upcall_data); +- idmap->idmap_upcall_data = NULL; +- complete_request_key(authkey, ret); +- key_put(authkey); ++ complete_request_key(data->authkey, ret); ++ key_put(data->authkey); ++ kfree(data); + } + +-static void +-nfs_idmap_abort_pipe_upcall(struct idmap *idmap, int ret) ++static void nfs_idmap_abort_pipe_upcall(struct idmap *idmap, ++ struct idmap_legacy_upcalldata *data, ++ int ret) + { +- if (idmap->idmap_upcall_data != NULL) +- nfs_idmap_complete_pipe_upcall_locked(idmap, ret); ++ if (cmpxchg(&idmap->idmap_upcall_data, data, NULL) == data) ++ nfs_idmap_complete_pipe_upcall(data, ret); + } + + static int nfs_idmap_legacy_upcall(struct key *authkey, void *aux) +@@ -612,7 +610,7 @@ static int nfs_idmap_legacy_upcall(struct key *authkey, void *aux) + + ret = rpc_queue_upcall(idmap->idmap_pipe, msg); + if (ret < 0) +- nfs_idmap_abort_pipe_upcall(idmap, ret); ++ nfs_idmap_abort_pipe_upcall(idmap, data, ret); + + return ret; + out2: +@@ -668,6 +666,7 @@ idmap_pipe_downcall(struct file *filp, const char __user *src, size_t mlen) + struct request_key_auth *rka; + struct rpc_inode *rpci = RPC_I(file_inode(filp)); + struct idmap *idmap = (struct idmap *)rpci->private; ++ struct idmap_legacy_upcalldata *data; + struct key *authkey; + struct idmap_msg im; + size_t namelen_in; +@@ -677,10 +676,11 @@ idmap_pipe_downcall(struct file *filp, const char __user *src, size_t mlen) + * will have been woken up and someone else may now have used + * idmap_key_cons - so after this point we may no longer touch it. + */ +- if (idmap->idmap_upcall_data == NULL) ++ data = xchg(&idmap->idmap_upcall_data, NULL); ++ if (data == NULL) + goto out_noupcall; + +- authkey = idmap->idmap_upcall_data->authkey; ++ authkey = data->authkey; + rka = get_request_key_auth(authkey); + + if (mlen != sizeof(im)) { +@@ -702,18 +702,17 @@ idmap_pipe_downcall(struct file *filp, const char __user *src, size_t mlen) + if (namelen_in == 0 || namelen_in == IDMAP_NAMESZ) { + ret = -EINVAL; + goto out; +-} ++ } + +- ret = nfs_idmap_read_and_verify_message(&im, +- &idmap->idmap_upcall_data->idmap_msg, +- rka->target_key, authkey); ++ ret = nfs_idmap_read_and_verify_message(&im, &data->idmap_msg, ++ rka->target_key, authkey); + if (ret >= 0) { + key_set_timeout(rka->target_key, nfs_idmap_cache_timeout); + ret = mlen; + } + + out: +- nfs_idmap_complete_pipe_upcall_locked(idmap, ret); ++ nfs_idmap_complete_pipe_upcall(data, ret); + out_noupcall: + return ret; + } +@@ -727,7 +726,7 @@ idmap_pipe_destroy_msg(struct rpc_pipe_msg *msg) + struct idmap *idmap = data->idmap; + + if (msg->errno) +- nfs_idmap_abort_pipe_upcall(idmap, msg->errno); ++ nfs_idmap_abort_pipe_upcall(idmap, data, msg->errno); + } + + static void +@@ -735,8 +734,11 @@ idmap_release_pipe(struct inode *inode) + { + struct rpc_inode *rpci = RPC_I(inode); + struct idmap *idmap = (struct idmap *)rpci->private; ++ struct idmap_legacy_upcalldata *data; + +- nfs_idmap_abort_pipe_upcall(idmap, -EPIPE); ++ data = xchg(&idmap->idmap_upcall_data, NULL); ++ if (data) ++ nfs_idmap_complete_pipe_upcall(data, -EPIPE); + } + + int nfs_map_name_to_uid(const struct nfs_server *server, const char *name, size_t namelen, kuid_t *uid) +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index ba4a03a69fbf0..7c5dfed0437f7 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -779,10 +779,9 @@ static void nfs4_slot_sequence_record_sent(struct nfs4_slot *slot, + if ((s32)(seqnr - slot->seq_nr_highest_sent) > 0) + slot->seq_nr_highest_sent = seqnr; + } +-static void nfs4_slot_sequence_acked(struct nfs4_slot *slot, +- u32 seqnr) ++static void nfs4_slot_sequence_acked(struct nfs4_slot *slot, u32 seqnr) + { +- slot->seq_nr_highest_sent = seqnr; ++ nfs4_slot_sequence_record_sent(slot, seqnr); + slot->seq_nr_last_acked = seqnr; + } + +@@ -849,7 +848,6 @@ static int nfs41_sequence_process(struct rpc_task *task, + __func__, + slot->slot_nr, + slot->seq_nr); +- nfs4_slot_sequence_acked(slot, slot->seq_nr); + goto out_retry; + case -NFS4ERR_RETRY_UNCACHED_REP: + case -NFS4ERR_SEQ_FALSE_RETRY: +@@ -3041,12 +3039,13 @@ static int _nfs4_open_and_get_state(struct nfs4_opendata *opendata, + } + + out: +- if (opendata->lgp) { +- nfs4_lgopen_release(opendata->lgp); +- opendata->lgp = NULL; +- } +- if (!opendata->cancelled) ++ if (!opendata->cancelled) { ++ if (opendata->lgp) { ++ nfs4_lgopen_release(opendata->lgp); ++ opendata->lgp = NULL; ++ } + nfs4_sequence_free_slot(&opendata->o_res.seq_res); ++ } + return ret; + } + +@@ -8988,6 +8987,9 @@ static int nfs41_reclaim_complete_handle_errors(struct rpc_task *task, struct nf + rpc_delay(task, NFS4_POLL_RETRY_MAX); + /* fall through */ + case -NFS4ERR_RETRY_UNCACHED_REP: ++ case -EACCES: ++ dprintk("%s: failed to reclaim complete error %d for server %s, retrying\n", ++ __func__, task->tk_status, clp->cl_hostname); + return -EAGAIN; + case -NFS4ERR_BADSESSION: + case -NFS4ERR_DEADSESSION: +diff --git a/fs/overlayfs/export.c b/fs/overlayfs/export.c +index 19574ef174709..984df246962ec 100644 +--- a/fs/overlayfs/export.c ++++ b/fs/overlayfs/export.c +@@ -274,7 +274,7 @@ static int ovl_encode_fh(struct inode *inode, u32 *fid, int *max_len, + return FILEID_INVALID; + + dentry = d_find_any_alias(inode); +- if (WARN_ON(!dentry)) ++ if (!dentry) + return FILEID_INVALID; + + type = ovl_dentry_to_fh(dentry, fid, max_len); +diff --git a/fs/splice.c b/fs/splice.c +index e509239d7e06a..ae5623244d5e3 100644 +--- a/fs/splice.c ++++ b/fs/splice.c +@@ -895,17 +895,15 @@ ssize_t splice_direct_to_actor(struct file *in, struct splice_desc *sd, + { + struct pipe_inode_info *pipe; + long ret, bytes; +- umode_t i_mode; + size_t len; + int i, flags, more; + + /* +- * We require the input being a regular file, as we don't want to +- * randomly drop data for eg socket -> socket splicing. Use the +- * piped splicing for that! ++ * We require the input to be seekable, as we don't want to randomly ++ * drop data for eg socket -> socket splicing. Use the piped splicing ++ * for that! + */ +- i_mode = file_inode(in)->i_mode; +- if (unlikely(!S_ISREG(i_mode) && !S_ISBLK(i_mode))) ++ if (unlikely(!(in->f_mode & FMODE_LSEEK))) + return -EINVAL; + + /* +diff --git a/include/acpi/cppc_acpi.h b/include/acpi/cppc_acpi.h +index a6a9373ab8634..d9417abf4cd08 100644 +--- a/include/acpi/cppc_acpi.h ++++ b/include/acpi/cppc_acpi.h +@@ -16,7 +16,7 @@ + #include + #include + +-/* Support CPPCv2 and CPPCv3 */ ++/* CPPCv2 and CPPCv3 support */ + #define CPPC_V2_REV 2 + #define CPPC_V3_REV 3 + #define CPPC_V2_NUM_ENT 21 +diff --git a/include/asm-generic/bitops/atomic.h b/include/asm-generic/bitops/atomic.h +index 0e7316a86240b..21aa26e7c9882 100644 +--- a/include/asm-generic/bitops/atomic.h ++++ b/include/asm-generic/bitops/atomic.h +@@ -35,9 +35,6 @@ static inline int test_and_set_bit(unsigned int nr, volatile unsigned long *p) + unsigned long mask = BIT_MASK(nr); + + p += BIT_WORD(nr); +- if (READ_ONCE(*p) & mask) +- return 1; +- + old = atomic_long_fetch_or(mask, (atomic_long_t *)p); + return !!(old & mask); + } +@@ -48,9 +45,6 @@ static inline int test_and_clear_bit(unsigned int nr, volatile unsigned long *p) + unsigned long mask = BIT_MASK(nr); + + p += BIT_WORD(nr); +- if (!(READ_ONCE(*p) & mask)) +- return 0; +- + old = atomic_long_fetch_andnot(mask, (atomic_long_t *)p); + return !!(old & mask); + } +diff --git a/include/linux/buffer_head.h b/include/linux/buffer_head.h +index b56cc825f64d9..8fab480a8e4e4 100644 +--- a/include/linux/buffer_head.h ++++ b/include/linux/buffer_head.h +@@ -117,7 +117,6 @@ static __always_inline int test_clear_buffer_##name(struct buffer_head *bh) \ + * of the form "mark_buffer_foo()". These are higher-level functions which + * do something in addition to setting a b_state bit. + */ +-BUFFER_FNS(Uptodate, uptodate) + BUFFER_FNS(Dirty, dirty) + TAS_BUFFER_FNS(Dirty, dirty) + BUFFER_FNS(Lock, locked) +@@ -135,6 +134,30 @@ BUFFER_FNS(Meta, meta) + BUFFER_FNS(Prio, prio) + BUFFER_FNS(Defer_Completion, defer_completion) + ++static __always_inline void set_buffer_uptodate(struct buffer_head *bh) ++{ ++ /* ++ * make it consistent with folio_mark_uptodate ++ * pairs with smp_load_acquire in buffer_uptodate ++ */ ++ smp_mb__before_atomic(); ++ set_bit(BH_Uptodate, &bh->b_state); ++} ++ ++static __always_inline void clear_buffer_uptodate(struct buffer_head *bh) ++{ ++ clear_bit(BH_Uptodate, &bh->b_state); ++} ++ ++static __always_inline int buffer_uptodate(const struct buffer_head *bh) ++{ ++ /* ++ * make it consistent with folio_test_uptodate ++ * pairs with smp_mb__before_atomic in set_buffer_uptodate ++ */ ++ return (smp_load_acquire(&bh->b_state) & (1UL << BH_Uptodate)) != 0; ++} ++ + #define bh_offset(bh) ((unsigned long)(bh)->b_data & ~PAGE_MASK) + + /* If we *know* page->private refers to buffer_heads */ +diff --git a/include/linux/kfifo.h b/include/linux/kfifo.h +index fc4b0b10210f4..d3e0f9dc2587b 100644 +--- a/include/linux/kfifo.h ++++ b/include/linux/kfifo.h +@@ -615,7 +615,7 @@ __kfifo_uint_must_check_helper( \ + * writer, you don't need extra locking to use these macro. + */ + #define kfifo_to_user(fifo, to, len, copied) \ +-__kfifo_uint_must_check_helper( \ ++__kfifo_int_must_check_helper( \ + ({ \ + typeof((fifo) + 1) __tmp = (fifo); \ + void __user *__to = (to); \ +diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h +index 19e8344c51a8c..dd4cdad76b18e 100644 +--- a/include/linux/kvm_host.h ++++ b/include/linux/kvm_host.h +@@ -146,6 +146,7 @@ static inline bool is_error_page(struct page *page) + #define KVM_REQ_MMU_RELOAD (1 | KVM_REQUEST_WAIT | KVM_REQUEST_NO_WAKEUP) + #define KVM_REQ_PENDING_TIMER 2 + #define KVM_REQ_UNHALT 3 ++#define KVM_REQ_VM_BUGGED (4 | KVM_REQUEST_WAIT | KVM_REQUEST_NO_WAKEUP) + #define KVM_REQUEST_ARCH_BASE 8 + + #define KVM_ARCH_REQ_FLAGS(nr, flags) ({ \ +@@ -502,6 +503,7 @@ struct kvm { + struct srcu_struct srcu; + struct srcu_struct irq_srcu; + pid_t userspace_pid; ++ bool vm_bugged; + }; + + #define kvm_err(fmt, ...) \ +@@ -530,6 +532,31 @@ struct kvm { + #define vcpu_err(vcpu, fmt, ...) \ + kvm_err("vcpu%i " fmt, (vcpu)->vcpu_id, ## __VA_ARGS__) + ++bool kvm_make_all_cpus_request(struct kvm *kvm, unsigned int req); ++static inline void kvm_vm_bugged(struct kvm *kvm) ++{ ++ kvm->vm_bugged = true; ++ kvm_make_all_cpus_request(kvm, KVM_REQ_VM_BUGGED); ++} ++ ++#define KVM_BUG(cond, kvm, fmt...) \ ++({ \ ++ int __ret = (cond); \ ++ \ ++ if (WARN_ONCE(__ret && !(kvm)->vm_bugged, fmt)) \ ++ kvm_vm_bugged(kvm); \ ++ unlikely(__ret); \ ++}) ++ ++#define KVM_BUG_ON(cond, kvm) \ ++({ \ ++ int __ret = (cond); \ ++ \ ++ if (WARN_ON_ONCE(__ret && !(kvm)->vm_bugged)) \ ++ kvm_vm_bugged(kvm); \ ++ unlikely(__ret); \ ++}) ++ + static inline struct kvm_io_bus *kvm_get_bus(struct kvm *kvm, enum kvm_bus idx) + { + return srcu_dereference_check(kvm->buses[idx], &kvm->srcu, +@@ -790,7 +817,6 @@ void kvm_reload_remote_mmus(struct kvm *kvm); + + bool kvm_make_vcpus_request_mask(struct kvm *kvm, unsigned int req, + unsigned long *vcpu_bitmap, cpumask_var_t tmp); +-bool kvm_make_all_cpus_request(struct kvm *kvm, unsigned int req); + + long kvm_arch_dev_ioctl(struct file *filp, + unsigned int ioctl, unsigned long arg); +diff --git a/include/linux/mfd/t7l66xb.h b/include/linux/mfd/t7l66xb.h +index 69632c1b07bd8..ae3e7a5c5219b 100644 +--- a/include/linux/mfd/t7l66xb.h ++++ b/include/linux/mfd/t7l66xb.h +@@ -12,7 +12,6 @@ + + struct t7l66xb_platform_data { + int (*enable)(struct platform_device *dev); +- int (*disable)(struct platform_device *dev); + int (*suspend)(struct platform_device *dev); + int (*resume)(struct platform_device *dev); + +diff --git a/include/linux/nmi.h b/include/linux/nmi.h +index 9003e29cde461..e972d1ae1ee63 100644 +--- a/include/linux/nmi.h ++++ b/include/linux/nmi.h +@@ -122,6 +122,8 @@ int watchdog_nmi_probe(void); + int watchdog_nmi_enable(unsigned int cpu); + void watchdog_nmi_disable(unsigned int cpu); + ++void lockup_detector_reconfigure(void); ++ + /** + * touch_nmi_watchdog - restart NMI watchdog timeout. + * +diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h +index 42588645478d9..526d423740eb2 100644 +--- a/include/linux/pci_ids.h ++++ b/include/linux/pci_ids.h +@@ -59,6 +59,8 @@ + #define PCI_CLASS_BRIDGE_EISA 0x0602 + #define PCI_CLASS_BRIDGE_MC 0x0603 + #define PCI_CLASS_BRIDGE_PCI 0x0604 ++#define PCI_CLASS_BRIDGE_PCI_NORMAL 0x060400 ++#define PCI_CLASS_BRIDGE_PCI_SUBTRACTIVE 0x060401 + #define PCI_CLASS_BRIDGE_PCMCIA 0x0605 + #define PCI_CLASS_BRIDGE_NUBUS 0x0606 + #define PCI_CLASS_BRIDGE_CARDBUS 0x0607 +diff --git a/include/linux/tpm_eventlog.h b/include/linux/tpm_eventlog.h +index f3caeeb7a0d03..def3f6159a0ef 100644 +--- a/include/linux/tpm_eventlog.h ++++ b/include/linux/tpm_eventlog.h +@@ -157,7 +157,7 @@ struct tcg_algorithm_info { + * Return: size of the event on success, 0 on failure + */ + +-static inline int __calc_tpm2_event_size(struct tcg_pcr_event2_head *event, ++static __always_inline int __calc_tpm2_event_size(struct tcg_pcr_event2_head *event, + struct tcg_pcr_event *event_header, + bool do_mapping) + { +diff --git a/include/linux/usb/hcd.h b/include/linux/usb/hcd.h +index c0eb85b2981e0..a400e86f62181 100644 +--- a/include/linux/usb/hcd.h ++++ b/include/linux/usb/hcd.h +@@ -66,6 +66,7 @@ + + struct giveback_urb_bh { + bool running; ++ bool high_prio; + spinlock_t lock; + struct list_head head; + struct tasklet_struct bh; +diff --git a/include/linux/wait.h b/include/linux/wait.h +index 5903b1d17c924..7d04c1b588c73 100644 +--- a/include/linux/wait.h ++++ b/include/linux/wait.h +@@ -529,10 +529,11 @@ do { \ + \ + hrtimer_init_sleeper_on_stack(&__t, CLOCK_MONOTONIC, \ + HRTIMER_MODE_REL); \ +- if ((timeout) != KTIME_MAX) \ +- hrtimer_start_range_ns(&__t.timer, timeout, \ +- current->timer_slack_ns, \ +- HRTIMER_MODE_REL); \ ++ if ((timeout) != KTIME_MAX) { \ ++ hrtimer_set_expires_range_ns(&__t.timer, timeout, \ ++ current->timer_slack_ns); \ ++ hrtimer_sleeper_start_expires(&__t, HRTIMER_MODE_REL); \ ++ } \ + \ + __ret = ___wait_event(wq_head, condition, state, 0, 0, \ + if (!__t.task) { \ +diff --git a/include/sound/core.h b/include/sound/core.h +index ee238f100f73f..8a80121811d94 100644 +--- a/include/sound/core.h ++++ b/include/sound/core.h +@@ -440,4 +440,12 @@ snd_pci_quirk_lookup_id(u16 vendor, u16 device, + } + #endif + ++/* async signal helpers */ ++struct snd_fasync; ++ ++int snd_fasync_helper(int fd, struct file *file, int on, ++ struct snd_fasync **fasyncp); ++void snd_kill_fasync(struct snd_fasync *fasync, int signal, int poll); ++void snd_fasync_free(struct snd_fasync *fasync); ++ + #endif /* __SOUND_CORE_H */ +diff --git a/include/trace/events/spmi.h b/include/trace/events/spmi.h +index 8b60efe18ba68..a6819fd85cdf4 100644 +--- a/include/trace/events/spmi.h ++++ b/include/trace/events/spmi.h +@@ -21,15 +21,15 @@ TRACE_EVENT(spmi_write_begin, + __field ( u8, sid ) + __field ( u16, addr ) + __field ( u8, len ) +- __dynamic_array ( u8, buf, len + 1 ) ++ __dynamic_array ( u8, buf, len ) + ), + + TP_fast_assign( + __entry->opcode = opcode; + __entry->sid = sid; + __entry->addr = addr; +- __entry->len = len + 1; +- memcpy(__get_dynamic_array(buf), buf, len + 1); ++ __entry->len = len; ++ memcpy(__get_dynamic_array(buf), buf, len); + ), + + TP_printk("opc=%d sid=%02d addr=0x%04x len=%d buf=0x[%*phD]", +@@ -92,7 +92,7 @@ TRACE_EVENT(spmi_read_end, + __field ( u16, addr ) + __field ( int, ret ) + __field ( u8, len ) +- __dynamic_array ( u8, buf, len + 1 ) ++ __dynamic_array ( u8, buf, len ) + ), + + TP_fast_assign( +@@ -100,8 +100,8 @@ TRACE_EVENT(spmi_read_end, + __entry->sid = sid; + __entry->addr = addr; + __entry->ret = ret; +- __entry->len = len + 1; +- memcpy(__get_dynamic_array(buf), buf, len + 1); ++ __entry->len = len; ++ memcpy(__get_dynamic_array(buf), buf, len); + ), + + TP_printk("opc=%d sid=%02d addr=0x%04x ret=%d len=%02d buf=0x[%*phD]", +diff --git a/include/uapi/linux/can/error.h b/include/uapi/linux/can/error.h +index 34633283de641..a1000cb630632 100644 +--- a/include/uapi/linux/can/error.h ++++ b/include/uapi/linux/can/error.h +@@ -120,6 +120,9 @@ + #define CAN_ERR_TRX_CANL_SHORT_TO_GND 0x70 /* 0111 0000 */ + #define CAN_ERR_TRX_CANL_SHORT_TO_CANH 0x80 /* 1000 0000 */ + +-/* controller specific additional information / data[5..7] */ ++/* data[5] is reserved (do not use) */ ++ ++/* TX error counter / data[6] */ ++/* RX error counter / data[7] */ + + #endif /* _UAPI_CAN_ERROR_H */ +diff --git a/kernel/irq/chip.c b/kernel/irq/chip.c +index 856f0297dc738..521121c2666ce 100644 +--- a/kernel/irq/chip.c ++++ b/kernel/irq/chip.c +@@ -1484,7 +1484,8 @@ int irq_chip_request_resources_parent(struct irq_data *data) + if (data->chip->irq_request_resources) + return data->chip->irq_request_resources(data); + +- return -ENOSYS; ++ /* no error on missing optional irq_chip::irq_request_resources */ ++ return 0; + } + EXPORT_SYMBOL_GPL(irq_chip_request_resources_parent); + +diff --git a/kernel/kprobes.c b/kernel/kprobes.c +index c93340bae3ac2..671b51782182b 100644 +--- a/kernel/kprobes.c ++++ b/kernel/kprobes.c +@@ -1594,7 +1594,8 @@ static int check_kprobe_address_safe(struct kprobe *p, + preempt_disable(); + + /* Ensure it is not in reserved area nor out of text */ +- if (!kernel_text_address((unsigned long) p->addr) || ++ if (!(core_kernel_text((unsigned long) p->addr) || ++ is_module_text_address((unsigned long) p->addr)) || + within_kprobe_blacklist((unsigned long) p->addr) || + jump_label_text_reserved(p->addr, p->addr) || + find_bug((unsigned long)p->addr)) { +diff --git a/kernel/power/user.c b/kernel/power/user.c +index 77438954cc2b0..672d4e28fa8a9 100644 +--- a/kernel/power/user.c ++++ b/kernel/power/user.c +@@ -26,6 +26,7 @@ + + #include "power.h" + ++static bool need_wait; + + #define SNAPSHOT_MINOR 231 + +@@ -79,7 +80,7 @@ static int snapshot_open(struct inode *inode, struct file *filp) + * Resuming. We may need to wait for the image device to + * appear. + */ +- wait_for_device_probe(); ++ need_wait = true; + + data->swap = -1; + data->mode = O_WRONLY; +@@ -171,6 +172,11 @@ static ssize_t snapshot_write(struct file *filp, const char __user *buf, + ssize_t res; + loff_t pg_offp = *offp & ~PAGE_MASK; + ++ if (need_wait) { ++ wait_for_device_probe(); ++ need_wait = false; ++ } ++ + lock_system_sleep(); + + data = filp->private_data; +@@ -206,6 +212,11 @@ static long snapshot_ioctl(struct file *filp, unsigned int cmd, + loff_t size; + sector_t offset; + ++ if (need_wait) { ++ wait_for_device_probe(); ++ need_wait = false; ++ } ++ + if (_IOC_TYPE(cmd) != SNAPSHOT_IOC_MAGIC) + return -ENOTTY; + if (_IOC_NR(cmd) > SNAPSHOT_IOC_MAXNR) +diff --git a/kernel/profile.c b/kernel/profile.c +index e97e42aaf2023..b5ce18b6f1b9e 100644 +--- a/kernel/profile.c ++++ b/kernel/profile.c +@@ -109,6 +109,13 @@ int __ref profile_init(void) + + /* only text is profiled */ + prof_len = (_etext - _stext) >> prof_shift; ++ ++ if (!prof_len) { ++ pr_warn("profiling shift: %u too large\n", prof_shift); ++ prof_on = 0; ++ return -EINVAL; ++ } ++ + buffer_bytes = prof_len*sizeof(atomic_t); + + if (!alloc_cpumask_var(&prof_cpu_mask, GFP_KERNEL)) +diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c +index 28c82dee13ea9..c11d3d79d4c31 100644 +--- a/kernel/sched/rt.c ++++ b/kernel/sched/rt.c +@@ -437,7 +437,7 @@ static inline void rt_queue_push_tasks(struct rq *rq) + #endif /* CONFIG_SMP */ + + static void enqueue_top_rt_rq(struct rt_rq *rt_rq); +-static void dequeue_top_rt_rq(struct rt_rq *rt_rq); ++static void dequeue_top_rt_rq(struct rt_rq *rt_rq, unsigned int count); + + static inline int on_rt_rq(struct sched_rt_entity *rt_se) + { +@@ -519,7 +519,7 @@ static void sched_rt_rq_dequeue(struct rt_rq *rt_rq) + rt_se = rt_rq->tg->rt_se[cpu]; + + if (!rt_se) { +- dequeue_top_rt_rq(rt_rq); ++ dequeue_top_rt_rq(rt_rq, rt_rq->rt_nr_running); + /* Kick cpufreq (see the comment in kernel/sched/sched.h). */ + cpufreq_update_util(rq_of_rt_rq(rt_rq), 0); + } +@@ -605,7 +605,7 @@ static inline void sched_rt_rq_enqueue(struct rt_rq *rt_rq) + + static inline void sched_rt_rq_dequeue(struct rt_rq *rt_rq) + { +- dequeue_top_rt_rq(rt_rq); ++ dequeue_top_rt_rq(rt_rq, rt_rq->rt_nr_running); + } + + static inline int rt_rq_throttled(struct rt_rq *rt_rq) +@@ -1004,7 +1004,7 @@ static void update_curr_rt(struct rq *rq) + } + + static void +-dequeue_top_rt_rq(struct rt_rq *rt_rq) ++dequeue_top_rt_rq(struct rt_rq *rt_rq, unsigned int count) + { + struct rq *rq = rq_of_rt_rq(rt_rq); + +@@ -1015,7 +1015,7 @@ dequeue_top_rt_rq(struct rt_rq *rt_rq) + + BUG_ON(!rq->nr_running); + +- sub_nr_running(rq, rt_rq->rt_nr_running); ++ sub_nr_running(rq, count); + rt_rq->rt_queued = 0; + + } +@@ -1294,18 +1294,21 @@ static void __dequeue_rt_entity(struct sched_rt_entity *rt_se, unsigned int flag + static void dequeue_rt_stack(struct sched_rt_entity *rt_se, unsigned int flags) + { + struct sched_rt_entity *back = NULL; ++ unsigned int rt_nr_running; + + for_each_sched_rt_entity(rt_se) { + rt_se->back = back; + back = rt_se; + } + +- dequeue_top_rt_rq(rt_rq_of_se(back)); ++ rt_nr_running = rt_rq_of_se(back)->rt_nr_running; + + for (rt_se = back; rt_se; rt_se = rt_se->back) { + if (on_rt_rq(rt_se)) + __dequeue_rt_entity(rt_se, flags); + } ++ ++ dequeue_top_rt_rq(rt_rq_of_se(back), rt_nr_running); + } + + static void enqueue_rt_entity(struct sched_rt_entity *rt_se, unsigned int flags) +diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c +index e23c9e765a5ff..2bc278dd98546 100644 +--- a/kernel/time/timekeeping.c ++++ b/kernel/time/timekeeping.c +@@ -23,6 +23,7 @@ + #include + #include + #include ++#include + + #include "tick-internal.h" + #include "ntp_internal.h" +@@ -1256,8 +1257,10 @@ out: + /* signal hrtimers about time change */ + clock_was_set(); + +- if (!ret) ++ if (!ret) { + audit_tk_injoffset(ts_delta); ++ add_device_randomness(ts, sizeof(*ts)); ++ } + + return ret; + } +@@ -2336,6 +2339,7 @@ int do_adjtimex(struct __kernel_timex *txc) + ret = timekeeping_validate_timex(txc); + if (ret) + return ret; ++ add_device_randomness(txc, sizeof(*txc)); + + if (txc->modes & ADJ_SETOFFSET) { + struct timespec64 delta; +@@ -2353,6 +2357,7 @@ int do_adjtimex(struct __kernel_timex *txc) + audit_ntp_init(&ad); + + ktime_get_real_ts64(&ts); ++ add_device_randomness(&ts, sizeof(ts)); + + raw_spin_lock_irqsave(&timekeeper_lock, flags); + write_seqcount_begin(&tk_core.seq); +diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c +index 4acc77e049e5f..047a89b815a32 100644 +--- a/kernel/trace/trace_events.c ++++ b/kernel/trace/trace_events.c +@@ -166,6 +166,7 @@ static int trace_define_generic_fields(void) + + __generic_field(int, CPU, FILTER_CPU); + __generic_field(int, cpu, FILTER_CPU); ++ __generic_field(int, common_cpu, FILTER_CPU); + __generic_field(char *, COMM, FILTER_COMM); + __generic_field(char *, comm, FILTER_COMM); + +diff --git a/kernel/trace/trace_probe.c b/kernel/trace/trace_probe.c +index 23e85cb151346..476a685c6b6cf 100644 +--- a/kernel/trace/trace_probe.c ++++ b/kernel/trace/trace_probe.c +@@ -300,7 +300,7 @@ static int parse_probe_vars(char *arg, const struct fetch_type *t, + } + } else + goto inval_var; +- } else if (strcmp(arg, "comm") == 0) { ++ } else if (strcmp(arg, "comm") == 0 || strcmp(arg, "COMM") == 0) { + code->op = FETCH_OP_COMM; + #ifdef CONFIG_HAVE_FUNCTION_ARG_ACCESS_API + } else if (((flags & TPARG_FL_MASK) == +@@ -595,7 +595,8 @@ static int traceprobe_parse_probe_arg_body(char *arg, ssize_t *size, + * Since $comm and immediate string can not be dereferred, + * we can find those by strcmp. + */ +- if (strcmp(arg, "$comm") == 0 || strncmp(arg, "\\\"", 2) == 0) { ++ if (strcmp(arg, "$comm") == 0 || strcmp(arg, "$COMM") == 0 || ++ strncmp(arg, "\\\"", 2) == 0) { + /* The type of $comm must be "string", and not an array. */ + if (parg->count || (t && strcmp(t, "string"))) + return -EINVAL; +diff --git a/kernel/watchdog.c b/kernel/watchdog.c +index cbd3cf503c904..a3d0e928305c3 100644 +--- a/kernel/watchdog.c ++++ b/kernel/watchdog.c +@@ -568,7 +568,7 @@ int lockup_detector_offline_cpu(unsigned int cpu) + return 0; + } + +-static void lockup_detector_reconfigure(void) ++static void __lockup_detector_reconfigure(void) + { + cpus_read_lock(); + watchdog_nmi_stop(); +@@ -588,6 +588,13 @@ static void lockup_detector_reconfigure(void) + __lockup_detector_cleanup(); + } + ++void lockup_detector_reconfigure(void) ++{ ++ mutex_lock(&watchdog_mutex); ++ __lockup_detector_reconfigure(); ++ mutex_unlock(&watchdog_mutex); ++} ++ + /* + * Create the watchdog thread infrastructure and configure the detector(s). + * +@@ -608,13 +615,13 @@ static __init void lockup_detector_setup(void) + return; + + mutex_lock(&watchdog_mutex); +- lockup_detector_reconfigure(); ++ __lockup_detector_reconfigure(); + softlockup_initialized = true; + mutex_unlock(&watchdog_mutex); + } + + #else /* CONFIG_SOFTLOCKUP_DETECTOR */ +-static void lockup_detector_reconfigure(void) ++static void __lockup_detector_reconfigure(void) + { + cpus_read_lock(); + watchdog_nmi_stop(); +@@ -622,9 +629,13 @@ static void lockup_detector_reconfigure(void) + watchdog_nmi_start(); + cpus_read_unlock(); + } ++void lockup_detector_reconfigure(void) ++{ ++ __lockup_detector_reconfigure(); ++} + static inline void lockup_detector_setup(void) + { +- lockup_detector_reconfigure(); ++ __lockup_detector_reconfigure(); + } + #endif /* !CONFIG_SOFTLOCKUP_DETECTOR */ + +@@ -664,7 +675,7 @@ static void proc_watchdog_update(void) + { + /* Remove impossible cpus to keep sysctl output clean. */ + cpumask_and(&watchdog_cpumask, &watchdog_cpumask, cpu_possible_mask); +- lockup_detector_reconfigure(); ++ __lockup_detector_reconfigure(); + } + + /* +diff --git a/lib/list_debug.c b/lib/list_debug.c +index 5d5424b51b746..413daa72a3d83 100644 +--- a/lib/list_debug.c ++++ b/lib/list_debug.c +@@ -20,7 +20,11 @@ + bool __list_add_valid(struct list_head *new, struct list_head *prev, + struct list_head *next) + { +- if (CHECK_DATA_CORRUPTION(next->prev != prev, ++ if (CHECK_DATA_CORRUPTION(prev == NULL, ++ "list_add corruption. prev is NULL.\n") || ++ CHECK_DATA_CORRUPTION(next == NULL, ++ "list_add corruption. next is NULL.\n") || ++ CHECK_DATA_CORRUPTION(next->prev != prev, + "list_add corruption. next->prev should be prev (%px), but was %px. (next=%px).\n", + prev, next->prev, next) || + CHECK_DATA_CORRUPTION(prev->next != next, +@@ -42,7 +46,11 @@ bool __list_del_entry_valid(struct list_head *entry) + prev = entry->prev; + next = entry->next; + +- if (CHECK_DATA_CORRUPTION(next == LIST_POISON1, ++ if (CHECK_DATA_CORRUPTION(next == NULL, ++ "list_del corruption, %px->next is NULL\n", entry) || ++ CHECK_DATA_CORRUPTION(prev == NULL, ++ "list_del corruption, %px->prev is NULL\n", entry) || ++ CHECK_DATA_CORRUPTION(next == LIST_POISON1, + "list_del corruption, %px->next is LIST_POISON1 (%px)\n", + entry, LIST_POISON1) || + CHECK_DATA_CORRUPTION(prev == LIST_POISON2, +diff --git a/mm/mmap.c b/mm/mmap.c +index 88e6863677768..8873ef114d280 100644 +--- a/mm/mmap.c ++++ b/mm/mmap.c +@@ -1860,7 +1860,6 @@ unmap_and_free_vma: + + /* Undo any partial mapping done by a device driver. */ + unmap_region(mm, vma, prev, vma->vm_start, vma->vm_end); +- charged = 0; + if (vm_flags & VM_SHARED) + mapping_unmap_writable(file->f_mapping); + allow_write_and_free_vma: +diff --git a/mm/mremap.c b/mm/mremap.c +index 8ce1b7632fbb8..f6b8c009dd05e 100644 +--- a/mm/mremap.c ++++ b/mm/mremap.c +@@ -293,12 +293,10 @@ unsigned long move_page_tables(struct vm_area_struct *vma, + */ + bool moved; + +- if (need_rmap_locks) +- take_rmap_locks(vma); ++ take_rmap_locks(vma); + moved = move_normal_pmd(vma, old_addr, new_addr, + old_end, old_pmd, new_pmd); +- if (need_rmap_locks) +- drop_rmap_locks(vma); ++ drop_rmap_locks(vma); + if (moved) + continue; + #endif +diff --git a/net/9p/client.c b/net/9p/client.c +index b03fce66eb8de..9368a1c0196d1 100644 +--- a/net/9p/client.c ++++ b/net/9p/client.c +@@ -893,16 +893,13 @@ static struct p9_fid *p9_fid_create(struct p9_client *clnt) + struct p9_fid *fid; + + p9_debug(P9_DEBUG_FID, "clnt %p\n", clnt); +- fid = kmalloc(sizeof(struct p9_fid), GFP_KERNEL); ++ fid = kzalloc(sizeof(struct p9_fid), GFP_KERNEL); + if (!fid) + return NULL; + +- memset(&fid->qid, 0, sizeof(struct p9_qid)); + fid->mode = -1; + fid->uid = current_fsuid(); + fid->clnt = clnt; +- fid->rdir = NULL; +- fid->fid = 0; + + idr_preload(GFP_KERNEL); + spin_lock_irq(&clnt->lock); +diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c +index 286fca6a9ab2a..7aa64f300422e 100644 +--- a/net/bluetooth/l2cap_core.c ++++ b/net/bluetooth/l2cap_core.c +@@ -1813,11 +1813,11 @@ static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm, + bdaddr_t *dst, + u8 link_type) + { +- struct l2cap_chan *c, *c1 = NULL; ++ struct l2cap_chan *c, *tmp, *c1 = NULL; + + read_lock(&chan_list_lock); + +- list_for_each_entry(c, &chan_list, global_l) { ++ list_for_each_entry_safe(c, tmp, &chan_list, global_l) { + if (state && c->state != state) + continue; + +@@ -1836,11 +1836,10 @@ static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm, + dst_match = !bacmp(&c->dst, dst); + if (src_match && dst_match) { + c = l2cap_chan_hold_unless_zero(c); +- if (!c) +- continue; +- +- read_unlock(&chan_list_lock); +- return c; ++ if (c) { ++ read_unlock(&chan_list_lock); ++ return c; ++ } + } + + /* Closest match */ +diff --git a/net/can/j1939/socket.c b/net/can/j1939/socket.c +index 51bfb220fad85..8817a258e73b9 100644 +--- a/net/can/j1939/socket.c ++++ b/net/can/j1939/socket.c +@@ -178,7 +178,10 @@ activate_next: + if (!first) + return; + +- if (WARN_ON_ONCE(j1939_session_activate(first))) { ++ if (j1939_session_activate(first)) { ++ netdev_warn_once(first->priv->ndev, ++ "%s: 0x%p: Identical session is already activated.\n", ++ __func__, first); + first->err = -EBUSY; + goto activate_next; + } else { +diff --git a/net/can/j1939/transport.c b/net/can/j1939/transport.c +index 22f4b798d385b..6d31555e536e0 100644 +--- a/net/can/j1939/transport.c ++++ b/net/can/j1939/transport.c +@@ -260,6 +260,8 @@ static void __j1939_session_drop(struct j1939_session *session) + + static void j1939_session_destroy(struct j1939_session *session) + { ++ struct sk_buff *skb; ++ + if (session->err) + j1939_sk_errqueue(session, J1939_ERRQUEUE_ABORT); + else +@@ -270,7 +272,11 @@ static void j1939_session_destroy(struct j1939_session *session) + WARN_ON_ONCE(!list_empty(&session->sk_session_queue_entry)); + WARN_ON_ONCE(!list_empty(&session->active_session_list_entry)); + +- skb_queue_purge(&session->skb_queue); ++ while ((skb = skb_dequeue(&session->skb_queue)) != NULL) { ++ /* drop ref taken in j1939_session_skb_queue() */ ++ skb_unref(skb); ++ kfree_skb(skb); ++ } + __j1939_session_drop(session); + j1939_priv_put(session->priv); + kfree(session); +diff --git a/net/core/devlink.c b/net/core/devlink.c +index 0ac02cab3087b..2dd354d869cd7 100644 +--- a/net/core/devlink.c ++++ b/net/core/devlink.c +@@ -2953,7 +2953,7 @@ static int devlink_param_get(struct devlink *devlink, + const struct devlink_param *param, + struct devlink_param_gset_ctx *ctx) + { +- if (!param->get) ++ if (!param->get || devlink->reload_failed) + return -EOPNOTSUPP; + return param->get(devlink, param->id, ctx); + } +@@ -2962,7 +2962,7 @@ static int devlink_param_set(struct devlink *devlink, + const struct devlink_param *param, + struct devlink_param_gset_ctx *ctx) + { +- if (!param->set) ++ if (!param->set || devlink->reload_failed) + return -EOPNOTSUPP; + return param->set(devlink, param->id, ctx); + } +diff --git a/net/dccp/proto.c b/net/dccp/proto.c +index cb61a9d281f66..951cbdf05ffe9 100644 +--- a/net/dccp/proto.c ++++ b/net/dccp/proto.c +@@ -765,11 +765,6 @@ int dccp_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) + + lock_sock(sk); + +- if (dccp_qpolicy_full(sk)) { +- rc = -EAGAIN; +- goto out_release; +- } +- + timeo = sock_sndtimeo(sk, noblock); + + /* +@@ -788,6 +783,11 @@ int dccp_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) + if (skb == NULL) + goto out_release; + ++ if (dccp_qpolicy_full(sk)) { ++ rc = -EAGAIN; ++ goto out_discard; ++ } ++ + if (sk->sk_state == DCCP_CLOSED) { + rc = -ENOTCONN; + goto out_discard; +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c +index ef749a47768a5..c37028af0db04 100644 +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -2911,7 +2911,7 @@ int __tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb, int segs) + struct tcp_sock *tp = tcp_sk(sk); + unsigned int cur_mss; + int diff, len, err; +- ++ int avail_wnd; + + /* Inconclusive MTU probe */ + if (icsk->icsk_mtup.probe_size) +@@ -2941,17 +2941,25 @@ int __tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb, int segs) + return -EHOSTUNREACH; /* Routing failure or similar. */ + + cur_mss = tcp_current_mss(sk); ++ avail_wnd = tcp_wnd_end(tp) - TCP_SKB_CB(skb)->seq; + + /* If receiver has shrunk his window, and skb is out of + * new window, do not retransmit it. The exception is the + * case, when window is shrunk to zero. In this case +- * our retransmit serves as a zero window probe. ++ * our retransmit of one segment serves as a zero window probe. + */ +- if (!before(TCP_SKB_CB(skb)->seq, tcp_wnd_end(tp)) && +- TCP_SKB_CB(skb)->seq != tp->snd_una) +- return -EAGAIN; ++ if (avail_wnd <= 0) { ++ if (TCP_SKB_CB(skb)->seq != tp->snd_una) ++ return -EAGAIN; ++ avail_wnd = cur_mss; ++ } + + len = cur_mss * segs; ++ if (len > avail_wnd) { ++ len = rounddown(avail_wnd, cur_mss); ++ if (!len) ++ len = avail_wnd; ++ } + if (skb->len > len) { + if (tcp_fragment(sk, TCP_FRAG_IN_RTX_QUEUE, skb, len, + cur_mss, GFP_ATOMIC)) +@@ -2965,8 +2973,9 @@ int __tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb, int segs) + diff -= tcp_skb_pcount(skb); + if (diff) + tcp_adjust_pcount(sk, skb, diff); +- if (skb->len < cur_mss) +- tcp_retrans_try_collapse(sk, skb, cur_mss); ++ avail_wnd = min_t(int, avail_wnd, cur_mss); ++ if (skb->len < avail_wnd) ++ tcp_retrans_try_collapse(sk, skb, avail_wnd); + } + + /* RFC3168, section 6.1.1.1. ECN fallback */ +@@ -3134,11 +3143,12 @@ void tcp_xmit_retransmit_queue(struct sock *sk) + */ + void sk_forced_mem_schedule(struct sock *sk, int size) + { +- int amt; ++ int delta, amt; + +- if (size <= sk->sk_forward_alloc) ++ delta = size - sk->sk_forward_alloc; ++ if (delta <= 0) + return; +- amt = sk_mem_pages(size); ++ amt = sk_mem_pages(delta); + sk->sk_forward_alloc += amt * SK_MEM_QUANTUM; + sk_memory_allocated_add(sk, amt); + +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index 58a7d89719b1d..f9cecd30f1bad 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -113,6 +113,7 @@ static struct nft_trans *nft_trans_alloc_gfp(const struct nft_ctx *ctx, + if (trans == NULL) + return NULL; + ++ INIT_LIST_HEAD(&trans->list); + trans->msg_type = msg_type; + trans->ctx = *ctx; + +@@ -2713,6 +2714,7 @@ static int nft_table_validate(struct net *net, const struct nft_table *table) + } + + static struct nft_rule *nft_rule_lookup_byid(const struct net *net, ++ const struct nft_chain *chain, + const struct nlattr *nla); + + #define NFT_RULE_MAXEXPRS 128 +@@ -2786,7 +2788,7 @@ static int nf_tables_newrule(struct net *net, struct sock *nlsk, + return PTR_ERR(old_rule); + } + } else if (nla[NFTA_RULE_POSITION_ID]) { +- old_rule = nft_rule_lookup_byid(net, nla[NFTA_RULE_POSITION_ID]); ++ old_rule = nft_rule_lookup_byid(net, chain, nla[NFTA_RULE_POSITION_ID]); + if (IS_ERR(old_rule)) { + NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_POSITION_ID]); + return PTR_ERR(old_rule); +@@ -2921,6 +2923,7 @@ err1: + } + + static struct nft_rule *nft_rule_lookup_byid(const struct net *net, ++ const struct nft_chain *chain, + const struct nlattr *nla) + { + u32 id = ntohl(nla_get_be32(nla)); +@@ -2930,6 +2933,7 @@ static struct nft_rule *nft_rule_lookup_byid(const struct net *net, + struct nft_rule *rule = nft_trans_rule(trans); + + if (trans->msg_type == NFT_MSG_NEWRULE && ++ trans->ctx.chain == chain && + id == nft_trans_rule_id(trans)) + return rule; + } +@@ -2976,7 +2980,7 @@ static int nf_tables_delrule(struct net *net, struct sock *nlsk, + + err = nft_delrule(&ctx, rule); + } else if (nla[NFTA_RULE_ID]) { +- rule = nft_rule_lookup_byid(net, nla[NFTA_RULE_ID]); ++ rule = nft_rule_lookup_byid(net, chain, nla[NFTA_RULE_ID]); + if (IS_ERR(rule)) { + NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_ID]); + return PTR_ERR(rule); +@@ -3191,6 +3195,7 @@ static struct nft_set *nft_set_lookup_byhandle(const struct nft_table *table, + } + + static struct nft_set *nft_set_lookup_byid(const struct net *net, ++ const struct nft_table *table, + const struct nlattr *nla, u8 genmask) + { + struct nft_trans *trans; +@@ -3201,6 +3206,7 @@ static struct nft_set *nft_set_lookup_byid(const struct net *net, + struct nft_set *set = nft_trans_set(trans); + + if (id == nft_trans_set_id(trans) && ++ set->table == table && + nft_active_genmask(set, genmask)) + return set; + } +@@ -3221,7 +3227,7 @@ struct nft_set *nft_set_lookup_global(const struct net *net, + if (!nla_set_id) + return set; + +- set = nft_set_lookup_byid(net, nla_set_id, genmask); ++ set = nft_set_lookup_byid(net, table, nla_set_id, genmask); + } + return set; + } +@@ -3247,7 +3253,7 @@ cont: + list_for_each_entry(i, &ctx->table->sets, list) { + int tmp; + +- if (!nft_is_active_next(ctx->net, set)) ++ if (!nft_is_active_next(ctx->net, i)) + continue; + if (!sscanf(i->name, name, &tmp)) + continue; +diff --git a/net/rds/ib_recv.c b/net/rds/ib_recv.c +index a0f99bbf362ca..6dd3f45df9ca6 100644 +--- a/net/rds/ib_recv.c ++++ b/net/rds/ib_recv.c +@@ -363,6 +363,7 @@ static int acquire_refill(struct rds_connection *conn) + static void release_refill(struct rds_connection *conn) + { + clear_bit(RDS_RECV_REFILL, &conn->c_flags); ++ smp_mb__after_atomic(); + + /* We don't use wait_on_bit()/wake_up_bit() because our waking is in a + * hot path and finding waiters is very rare. We don't want to walk +diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c +index 6a0df7c8a939e..95dda29058a0e 100644 +--- a/net/rose/af_rose.c ++++ b/net/rose/af_rose.c +@@ -169,6 +169,7 @@ static void rose_kill_by_device(struct net_device *dev) + rose_disconnect(s, ENETUNREACH, ROSE_OUT_OF_ORDER, 0); + if (rose->neighbour) + rose->neighbour->use--; ++ dev_put(rose->device); + rose->device = NULL; + } + } +@@ -569,6 +570,8 @@ static struct sock *rose_make_new(struct sock *osk) + rose->idle = orose->idle; + rose->defer = orose->defer; + rose->device = orose->device; ++ if (rose->device) ++ dev_hold(rose->device); + rose->qbitincl = orose->qbitincl; + + return sk; +@@ -622,6 +625,7 @@ static int rose_release(struct socket *sock) + break; + } + ++ dev_put(rose->device); + sock->sk = NULL; + release_sock(sk); + sock_put(sk); +@@ -698,7 +702,6 @@ static int rose_connect(struct socket *sock, struct sockaddr *uaddr, int addr_le + struct rose_sock *rose = rose_sk(sk); + struct sockaddr_rose *addr = (struct sockaddr_rose *)uaddr; + unsigned char cause, diagnostic; +- struct net_device *dev; + ax25_uid_assoc *user; + int n, err = 0; + +@@ -755,9 +758,12 @@ static int rose_connect(struct socket *sock, struct sockaddr *uaddr, int addr_le + } + + if (sock_flag(sk, SOCK_ZAPPED)) { /* Must bind first - autobinding in this may or may not work */ ++ struct net_device *dev; ++ + sock_reset_flag(sk, SOCK_ZAPPED); + +- if ((dev = rose_dev_first()) == NULL) { ++ dev = rose_dev_first(); ++ if (!dev) { + err = -ENETUNREACH; + goto out_release; + } +@@ -765,6 +771,7 @@ static int rose_connect(struct socket *sock, struct sockaddr *uaddr, int addr_le + user = ax25_findbyuid(current_euid()); + if (!user) { + err = -EINVAL; ++ dev_put(dev); + goto out_release; + } + +diff --git a/net/rose/rose_route.c b/net/rose/rose_route.c +index 5f32113c9bbda..64d441d3b6533 100644 +--- a/net/rose/rose_route.c ++++ b/net/rose/rose_route.c +@@ -613,6 +613,8 @@ struct net_device *rose_dev_first(void) + if (first == NULL || strncmp(dev->name, first->name, 3) < 0) + first = dev; + } ++ if (first) ++ dev_hold(first); + rcu_read_unlock(); + + return first; +diff --git a/net/sched/cls_route.c b/net/sched/cls_route.c +index 5efa3e7ace152..b775e681cb56e 100644 +--- a/net/sched/cls_route.c ++++ b/net/sched/cls_route.c +@@ -424,6 +424,11 @@ static int route4_set_parms(struct net *net, struct tcf_proto *tp, + return -EINVAL; + } + ++ if (!nhandle) { ++ NL_SET_ERR_MSG(extack, "Replacing with handle of 0 is invalid"); ++ return -EINVAL; ++ } ++ + h1 = to_hash(nhandle); + b = rtnl_dereference(head->table[h1]); + if (!b) { +@@ -477,6 +482,11 @@ static int route4_change(struct net *net, struct sk_buff *in_skb, + int err; + bool new = true; + ++ if (!handle) { ++ NL_SET_ERR_MSG(extack, "Creating with handle of 0 is invalid"); ++ return -EINVAL; ++ } ++ + if (opt == NULL) + return handle ? -EINVAL : 0; + +@@ -526,7 +536,7 @@ static int route4_change(struct net *net, struct sk_buff *in_skb, + rcu_assign_pointer(f->next, f1); + rcu_assign_pointer(*fp, f); + +- if (fold && fold->handle && f->handle != fold->handle) { ++ if (fold) { + th = to_hash(fold->handle); + h = from_hash(fold->handle >> 16); + b = rtnl_dereference(head->table[th]); +diff --git a/net/sunrpc/auth.c b/net/sunrpc/auth.c +index cdb05b48de449..e8fa21ad06a07 100644 +--- a/net/sunrpc/auth.c ++++ b/net/sunrpc/auth.c +@@ -494,7 +494,7 @@ rpcauth_prune_expired(struct list_head *free, int nr_to_scan) + * Enforce a 60 second garbage collection moratorium + * Note that the cred_unused list must be time-ordered. + */ +- if (!time_in_range(cred->cr_expire, expired, jiffies)) ++ if (time_in_range(cred->cr_expire, expired, jiffies)) + continue; + if (!rpcauth_unhash_cred(cred)) + continue; +diff --git a/net/sunrpc/backchannel_rqst.c b/net/sunrpc/backchannel_rqst.c +index 195b40c5dae4b..266f3e5f55dec 100644 +--- a/net/sunrpc/backchannel_rqst.c ++++ b/net/sunrpc/backchannel_rqst.c +@@ -64,6 +64,17 @@ static void xprt_free_allocation(struct rpc_rqst *req) + kfree(req); + } + ++static void xprt_bc_reinit_xdr_buf(struct xdr_buf *buf) ++{ ++ buf->head[0].iov_len = PAGE_SIZE; ++ buf->tail[0].iov_len = 0; ++ buf->pages = NULL; ++ buf->page_len = 0; ++ buf->flags = 0; ++ buf->len = 0; ++ buf->buflen = PAGE_SIZE; ++} ++ + static int xprt_alloc_xdr_buf(struct xdr_buf *buf, gfp_t gfp_flags) + { + struct page *page; +@@ -292,6 +303,9 @@ void xprt_free_bc_rqst(struct rpc_rqst *req) + */ + spin_lock_bh(&xprt->bc_pa_lock); + if (xprt_need_to_requeue(xprt)) { ++ xprt_bc_reinit_xdr_buf(&req->rq_snd_buf); ++ xprt_bc_reinit_xdr_buf(&req->rq_rcv_buf); ++ req->rq_rcv_buf.len = PAGE_SIZE; + list_add_tail(&req->rq_bc_pa_list, &xprt->bc_pa_list); + xprt->bc_alloc_count++; + atomic_inc(&xprt->bc_slot_count); +diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c +index d60d7caacbf5d..28f6188458c42 100644 +--- a/net/vmw_vsock/af_vsock.c ++++ b/net/vmw_vsock/af_vsock.c +@@ -1110,6 +1110,7 @@ static void vsock_connect_timeout(struct work_struct *work) + if (sk->sk_state == TCP_SYN_SENT && + (sk->sk_shutdown != SHUTDOWN_MASK)) { + sk->sk_state = TCP_CLOSE; ++ sk->sk_socket->state = SS_UNCONNECTED; + sk->sk_err = ETIMEDOUT; + sk->sk_error_report(sk); + vsock_transport_cancel_pkt(vsk); +@@ -1207,7 +1208,14 @@ static int vsock_stream_connect(struct socket *sock, struct sockaddr *addr, + * timeout fires. + */ + sock_hold(sk); +- schedule_delayed_work(&vsk->connect_work, timeout); ++ ++ /* If the timeout function is already scheduled, ++ * reschedule it, then ungrab the socket refcount to ++ * keep it balanced. ++ */ ++ if (mod_delayed_work(system_wq, &vsk->connect_work, ++ timeout)) ++ sock_put(sk); + + /* Skip ahead to preserve error code set above. */ + goto out_wait; +diff --git a/scripts/Makefile.gcc-plugins b/scripts/Makefile.gcc-plugins +index 63d21489216b0..ba4e271702c6f 100644 +--- a/scripts/Makefile.gcc-plugins ++++ b/scripts/Makefile.gcc-plugins +@@ -6,7 +6,7 @@ gcc-plugin-$(CONFIG_GCC_PLUGIN_LATENT_ENTROPY) += latent_entropy_plugin.so + gcc-plugin-cflags-$(CONFIG_GCC_PLUGIN_LATENT_ENTROPY) \ + += -DLATENT_ENTROPY_PLUGIN + ifdef CONFIG_GCC_PLUGIN_LATENT_ENTROPY +- DISABLE_LATENT_ENTROPY_PLUGIN += -fplugin-arg-latent_entropy_plugin-disable ++ DISABLE_LATENT_ENTROPY_PLUGIN += -fplugin-arg-latent_entropy_plugin-disable -ULATENT_ENTROPY_PLUGIN + endif + export DISABLE_LATENT_ENTROPY_PLUGIN + +diff --git a/scripts/faddr2line b/scripts/faddr2line +index 94ed98dd899f3..57099687e5e1d 100755 +--- a/scripts/faddr2line ++++ b/scripts/faddr2line +@@ -112,7 +112,9 @@ __faddr2line() { + # section offsets. + local file_type=$(${READELF} --file-header $objfile | + ${AWK} '$1 == "Type:" { print $2; exit }') +- [[ $file_type = "EXEC" ]] && is_vmlinux=1 ++ if [[ $file_type = "EXEC" ]] || [[ $file_type == "DYN" ]]; then ++ is_vmlinux=1 ++ fi + + # Go through each of the object's symbols which match the func name. + # In rare cases there might be duplicates, in which case we print all +diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c +index 7a8813677950f..84daab8ae0621 100644 +--- a/security/apparmor/apparmorfs.c ++++ b/security/apparmor/apparmorfs.c +@@ -403,7 +403,7 @@ static struct aa_loaddata *aa_simple_write_to_buffer(const char __user *userbuf, + + data->size = copy_size; + if (copy_from_user(data->data, userbuf, copy_size)) { +- kvfree(data); ++ aa_put_loaddata(data); + return ERR_PTR(-EFAULT); + } + +diff --git a/security/apparmor/audit.c b/security/apparmor/audit.c +index 5977325038157..68e06d87908ec 100644 +--- a/security/apparmor/audit.c ++++ b/security/apparmor/audit.c +@@ -139,7 +139,7 @@ int aa_audit(int type, struct aa_profile *profile, struct common_audit_data *sa, + } + if (AUDIT_MODE(profile) == AUDIT_QUIET || + (type == AUDIT_APPARMOR_DENIED && +- AUDIT_MODE(profile) == AUDIT_QUIET)) ++ AUDIT_MODE(profile) == AUDIT_QUIET_DENIED)) + return aad(sa)->error; + + if (KILL_MODE(profile) && type == AUDIT_APPARMOR_DENIED) +diff --git a/security/apparmor/domain.c b/security/apparmor/domain.c +index 1a33f490e6670..2f61b4cc2fc0d 100644 +--- a/security/apparmor/domain.c ++++ b/security/apparmor/domain.c +@@ -460,7 +460,7 @@ restart: + * xattrs, or a longer match + */ + candidate = profile; +- candidate_len = profile->xmatch_len; ++ candidate_len = max(count, profile->xmatch_len); + candidate_xattrs = ret; + conflict = false; + } +diff --git a/security/apparmor/include/lib.h b/security/apparmor/include/lib.h +index 7d27db740bc2f..ac5054899f6f4 100644 +--- a/security/apparmor/include/lib.h ++++ b/security/apparmor/include/lib.h +@@ -22,6 +22,11 @@ + */ + + #define DEBUG_ON (aa_g_debug) ++/* ++ * split individual debug cases out in preparation for finer grained ++ * debug controls in the future. ++ */ ++#define AA_DEBUG_LABEL DEBUG_ON + #define dbg_printk(__fmt, __args...) pr_debug(__fmt, ##__args) + #define AA_DEBUG(fmt, args...) \ + do { \ +diff --git a/security/apparmor/include/policy.h b/security/apparmor/include/policy.h +index b5b4b8190e654..b5aa4231af682 100644 +--- a/security/apparmor/include/policy.h ++++ b/security/apparmor/include/policy.h +@@ -135,7 +135,7 @@ struct aa_profile { + + const char *attach; + struct aa_dfa *xmatch; +- int xmatch_len; ++ unsigned int xmatch_len; + enum audit_mode audit; + long mode; + u32 path_flags; +diff --git a/security/apparmor/label.c b/security/apparmor/label.c +index 747a734a08246..e2674e425ca7d 100644 +--- a/security/apparmor/label.c ++++ b/security/apparmor/label.c +@@ -1637,9 +1637,9 @@ int aa_label_snxprint(char *str, size_t size, struct aa_ns *ns, + AA_BUG(!str && size != 0); + AA_BUG(!label); + +- if (flags & FLAG_ABS_ROOT) { ++ if (AA_DEBUG_LABEL && (flags & FLAG_ABS_ROOT)) { + ns = root_ns; +- len = snprintf(str, size, "="); ++ len = snprintf(str, size, "_"); + update_for_len(total, len, size, str); + } else if (!ns) { + ns = labels_ns(label); +@@ -1750,7 +1750,7 @@ void aa_label_xaudit(struct audit_buffer *ab, struct aa_ns *ns, + if (!use_label_hname(ns, label, flags) || + display_mode(ns, label, flags)) { + len = aa_label_asxprint(&name, ns, label, flags, gfp); +- if (len == -1) { ++ if (len < 0) { + AA_DEBUG("label print error"); + return; + } +@@ -1778,7 +1778,7 @@ void aa_label_seq_xprint(struct seq_file *f, struct aa_ns *ns, + int len; + + len = aa_label_asxprint(&str, ns, label, flags, gfp); +- if (len == -1) { ++ if (len < 0) { + AA_DEBUG("label print error"); + return; + } +@@ -1801,7 +1801,7 @@ void aa_label_xprintk(struct aa_ns *ns, struct aa_label *label, int flags, + int len; + + len = aa_label_asxprint(&str, ns, label, flags, gfp); +- if (len == -1) { ++ if (len < 0) { + AA_DEBUG("label print error"); + return; + } +@@ -1901,7 +1901,8 @@ struct aa_label *aa_label_strn_parse(struct aa_label *base, const char *str, + AA_BUG(!str); + + str = skipn_spaces(str, n); +- if (str == NULL || (*str == '=' && base != &root_ns->unconfined->label)) ++ if (str == NULL || (AA_DEBUG_LABEL && *str == '_' && ++ base != &root_ns->unconfined->label)) + return ERR_PTR(-EINVAL); + + len = label_count_strn_entries(str, end - str); +diff --git a/security/apparmor/mount.c b/security/apparmor/mount.c +index 17081c8dbefac..4b433cf1526fc 100644 +--- a/security/apparmor/mount.c ++++ b/security/apparmor/mount.c +@@ -229,7 +229,8 @@ static const char * const mnt_info_table[] = { + "failed srcname match", + "failed type match", + "failed flags match", +- "failed data match" ++ "failed data match", ++ "failed perms check" + }; + + /* +@@ -284,8 +285,8 @@ static int do_match_mnt(struct aa_dfa *dfa, unsigned int start, + return 0; + } + +- /* failed at end of flags match */ +- return 4; ++ /* failed at perms check, don't confuse with flags match */ ++ return 6; + } + + +@@ -682,6 +683,7 @@ int aa_pivotroot(struct aa_label *label, const struct path *old_path, + aa_put_label(target); + goto out; + } ++ aa_put_label(target); + } else + /* already audited error */ + error = PTR_ERR(target); +diff --git a/security/selinux/ss/policydb.h b/security/selinux/ss/policydb.h +index 162d0e79b85b3..b18bc405f8203 100644 +--- a/security/selinux/ss/policydb.h ++++ b/security/selinux/ss/policydb.h +@@ -356,6 +356,8 @@ static inline int put_entry(const void *buf, size_t bytes, int num, struct polic + { + size_t len = bytes * num; + ++ if (len > fp->len) ++ return -EINVAL; + memcpy(fp->data, buf, len); + fp->data += len; + fp->len -= len; +diff --git a/sound/core/info.c b/sound/core/info.c +index f18f4ef6661e9..d670bd5dd7a97 100644 +--- a/sound/core/info.c ++++ b/sound/core/info.c +@@ -112,9 +112,9 @@ static loff_t snd_info_entry_llseek(struct file *file, loff_t offset, int orig) + entry = data->entry; + mutex_lock(&entry->access); + if (entry->c.ops->llseek) { +- offset = entry->c.ops->llseek(entry, +- data->file_private_data, +- file, offset, orig); ++ ret = entry->c.ops->llseek(entry, ++ data->file_private_data, ++ file, offset, orig); + goto out; + } + +diff --git a/sound/core/misc.c b/sound/core/misc.c +index 3579dd7a161f7..c3f3d94b51970 100644 +--- a/sound/core/misc.c ++++ b/sound/core/misc.c +@@ -10,6 +10,7 @@ + #include + #include + #include ++#include + #include + + #ifdef CONFIG_SND_DEBUG +@@ -145,3 +146,96 @@ snd_pci_quirk_lookup(struct pci_dev *pci, const struct snd_pci_quirk *list) + } + EXPORT_SYMBOL(snd_pci_quirk_lookup); + #endif ++ ++/* ++ * Deferred async signal helpers ++ * ++ * Below are a few helper functions to wrap the async signal handling ++ * in the deferred work. The main purpose is to avoid the messy deadlock ++ * around tasklist_lock and co at the kill_fasync() invocation. ++ * fasync_helper() and kill_fasync() are replaced with snd_fasync_helper() ++ * and snd_kill_fasync(), respectively. In addition, snd_fasync_free() has ++ * to be called at releasing the relevant file object. ++ */ ++struct snd_fasync { ++ struct fasync_struct *fasync; ++ int signal; ++ int poll; ++ int on; ++ struct list_head list; ++}; ++ ++static DEFINE_SPINLOCK(snd_fasync_lock); ++static LIST_HEAD(snd_fasync_list); ++ ++static void snd_fasync_work_fn(struct work_struct *work) ++{ ++ struct snd_fasync *fasync; ++ ++ spin_lock_irq(&snd_fasync_lock); ++ while (!list_empty(&snd_fasync_list)) { ++ fasync = list_first_entry(&snd_fasync_list, struct snd_fasync, list); ++ list_del_init(&fasync->list); ++ spin_unlock_irq(&snd_fasync_lock); ++ if (fasync->on) ++ kill_fasync(&fasync->fasync, fasync->signal, fasync->poll); ++ spin_lock_irq(&snd_fasync_lock); ++ } ++ spin_unlock_irq(&snd_fasync_lock); ++} ++ ++static DECLARE_WORK(snd_fasync_work, snd_fasync_work_fn); ++ ++int snd_fasync_helper(int fd, struct file *file, int on, ++ struct snd_fasync **fasyncp) ++{ ++ struct snd_fasync *fasync = NULL; ++ ++ if (on) { ++ fasync = kzalloc(sizeof(*fasync), GFP_KERNEL); ++ if (!fasync) ++ return -ENOMEM; ++ INIT_LIST_HEAD(&fasync->list); ++ } ++ ++ spin_lock_irq(&snd_fasync_lock); ++ if (*fasyncp) { ++ kfree(fasync); ++ fasync = *fasyncp; ++ } else { ++ if (!fasync) { ++ spin_unlock_irq(&snd_fasync_lock); ++ return 0; ++ } ++ *fasyncp = fasync; ++ } ++ fasync->on = on; ++ spin_unlock_irq(&snd_fasync_lock); ++ return fasync_helper(fd, file, on, &fasync->fasync); ++} ++EXPORT_SYMBOL_GPL(snd_fasync_helper); ++ ++void snd_kill_fasync(struct snd_fasync *fasync, int signal, int poll) ++{ ++ unsigned long flags; ++ ++ if (!fasync || !fasync->on) ++ return; ++ spin_lock_irqsave(&snd_fasync_lock, flags); ++ fasync->signal = signal; ++ fasync->poll = poll; ++ list_move(&fasync->list, &snd_fasync_list); ++ schedule_work(&snd_fasync_work); ++ spin_unlock_irqrestore(&snd_fasync_lock, flags); ++} ++EXPORT_SYMBOL_GPL(snd_kill_fasync); ++ ++void snd_fasync_free(struct snd_fasync *fasync) ++{ ++ if (!fasync) ++ return; ++ fasync->on = 0; ++ flush_work(&snd_fasync_work); ++ kfree(fasync); ++} ++EXPORT_SYMBOL_GPL(snd_fasync_free); +diff --git a/sound/core/timer.c b/sound/core/timer.c +index d684aa4150aad..420cc07a7f882 100644 +--- a/sound/core/timer.c ++++ b/sound/core/timer.c +@@ -61,7 +61,7 @@ struct snd_timer_user { + unsigned int filter; + struct timespec tstamp; /* trigger tstamp */ + wait_queue_head_t qchange_sleep; +- struct fasync_struct *fasync; ++ struct snd_fasync *fasync; + struct mutex ioctl_lock; + }; + +@@ -1317,7 +1317,7 @@ static void snd_timer_user_interrupt(struct snd_timer_instance *timeri, + } + __wake: + spin_unlock(&tu->qlock); +- kill_fasync(&tu->fasync, SIGIO, POLL_IN); ++ snd_kill_fasync(tu->fasync, SIGIO, POLL_IN); + wake_up(&tu->qchange_sleep); + } + +@@ -1354,7 +1354,7 @@ static void snd_timer_user_ccallback(struct snd_timer_instance *timeri, + spin_lock_irqsave(&tu->qlock, flags); + snd_timer_user_append_to_tqueue(tu, &r1); + spin_unlock_irqrestore(&tu->qlock, flags); +- kill_fasync(&tu->fasync, SIGIO, POLL_IN); ++ snd_kill_fasync(tu->fasync, SIGIO, POLL_IN); + wake_up(&tu->qchange_sleep); + } + +@@ -1421,7 +1421,7 @@ static void snd_timer_user_tinterrupt(struct snd_timer_instance *timeri, + spin_unlock(&tu->qlock); + if (append == 0) + return; +- kill_fasync(&tu->fasync, SIGIO, POLL_IN); ++ snd_kill_fasync(tu->fasync, SIGIO, POLL_IN); + wake_up(&tu->qchange_sleep); + } + +@@ -1487,6 +1487,7 @@ static int snd_timer_user_release(struct inode *inode, struct file *file) + if (tu->timeri) + snd_timer_close(tu->timeri); + mutex_unlock(&tu->ioctl_lock); ++ snd_fasync_free(tu->fasync); + kfree(tu->queue); + kfree(tu->tqueue); + kfree(tu); +@@ -2050,7 +2051,7 @@ static int snd_timer_user_fasync(int fd, struct file * file, int on) + struct snd_timer_user *tu; + + tu = file->private_data; +- return fasync_helper(fd, file, on, &tu->fasync); ++ return snd_fasync_helper(fd, file, on, &tu->fasync); + } + + static ssize_t snd_timer_user_read(struct file *file, char __user *buffer, +diff --git a/sound/pci/hda/patch_cirrus.c b/sound/pci/hda/patch_cirrus.c +index f46204ab0b903..c10a264e9567d 100644 +--- a/sound/pci/hda/patch_cirrus.c ++++ b/sound/pci/hda/patch_cirrus.c +@@ -396,6 +396,7 @@ static const struct snd_pci_quirk cs420x_fixup_tbl[] = { + + /* codec SSID */ + SND_PCI_QUIRK(0x106b, 0x0600, "iMac 14,1", CS420X_IMAC27_122), ++ SND_PCI_QUIRK(0x106b, 0x0900, "iMac 12,1", CS420X_IMAC27_122), + SND_PCI_QUIRK(0x106b, 0x1c00, "MacBookPro 8,1", CS420X_MBP81), + SND_PCI_QUIRK(0x106b, 0x2000, "iMac 12,2", CS420X_IMAC27_122), + SND_PCI_QUIRK(0x106b, 0x2800, "MacBookPro 10,1", CS420X_MBP101), +diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c +index d4bfb11493270..d181dc31cd8d6 100644 +--- a/sound/pci/hda/patch_conexant.c ++++ b/sound/pci/hda/patch_conexant.c +@@ -197,6 +197,7 @@ enum { + CXT_PINCFG_LEMOTE_A1205, + CXT_PINCFG_COMPAQ_CQ60, + CXT_FIXUP_STEREO_DMIC, ++ CXT_PINCFG_LENOVO_NOTEBOOK, + CXT_FIXUP_INC_MIC_BOOST, + CXT_FIXUP_HEADPHONE_MIC_PIN, + CXT_FIXUP_HEADPHONE_MIC, +@@ -737,6 +738,14 @@ static const struct hda_fixup cxt_fixups[] = { + .type = HDA_FIXUP_FUNC, + .v.func = cxt_fixup_stereo_dmic, + }, ++ [CXT_PINCFG_LENOVO_NOTEBOOK] = { ++ .type = HDA_FIXUP_PINS, ++ .v.pins = (const struct hda_pintbl[]) { ++ { 0x1a, 0x05d71030 }, ++ { } ++ }, ++ .chain_id = CXT_FIXUP_STEREO_DMIC, ++ }, + [CXT_FIXUP_INC_MIC_BOOST] = { + .type = HDA_FIXUP_FUNC, + .v.func = cxt5066_increase_mic_boost, +@@ -930,7 +939,7 @@ static const struct snd_pci_quirk cxt5066_fixups[] = { + SND_PCI_QUIRK(0x17aa, 0x3905, "Lenovo G50-30", CXT_FIXUP_STEREO_DMIC), + SND_PCI_QUIRK(0x17aa, 0x390b, "Lenovo G50-80", CXT_FIXUP_STEREO_DMIC), + SND_PCI_QUIRK(0x17aa, 0x3975, "Lenovo U300s", CXT_FIXUP_STEREO_DMIC), +- SND_PCI_QUIRK(0x17aa, 0x3977, "Lenovo IdeaPad U310", CXT_FIXUP_STEREO_DMIC), ++ SND_PCI_QUIRK(0x17aa, 0x3977, "Lenovo IdeaPad U310", CXT_PINCFG_LENOVO_NOTEBOOK), + SND_PCI_QUIRK(0x17aa, 0x3978, "Lenovo G50-70", CXT_FIXUP_STEREO_DMIC), + SND_PCI_QUIRK(0x17aa, 0x397b, "Lenovo S205", CXT_FIXUP_STEREO_DMIC), + SND_PCI_QUIRK_VENDOR(0x17aa, "Thinkpad", CXT_FIXUP_THINKPAD_ACPI), +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 145e494f776a3..d925ae7f1b027 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -6370,6 +6370,7 @@ enum { + ALC269_FIXUP_LIMIT_INT_MIC_BOOST, + ALC269VB_FIXUP_ASUS_ZENBOOK, + ALC269VB_FIXUP_ASUS_ZENBOOK_UX31A, ++ ALC269VB_FIXUP_ASUS_MIC_NO_PRESENCE, + ALC269_FIXUP_LIMIT_INT_MIC_BOOST_MUTE_LED, + ALC269VB_FIXUP_ORDISSIMO_EVE2, + ALC283_FIXUP_CHROME_BOOK, +@@ -6901,6 +6902,15 @@ static const struct hda_fixup alc269_fixups[] = { + .chained = true, + .chain_id = ALC269VB_FIXUP_ASUS_ZENBOOK, + }, ++ [ALC269VB_FIXUP_ASUS_MIC_NO_PRESENCE] = { ++ .type = HDA_FIXUP_PINS, ++ .v.pins = (const struct hda_pintbl[]) { ++ { 0x18, 0x01a110f0 }, /* use as headset mic */ ++ { } ++ }, ++ .chained = true, ++ .chain_id = ALC269_FIXUP_HEADSET_MIC ++ }, + [ALC269_FIXUP_LIMIT_INT_MIC_BOOST_MUTE_LED] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc269_fixup_limit_int_mic_boost, +@@ -8215,6 +8225,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1043, 0x12a0, "ASUS X441UV", ALC233_FIXUP_EAPD_COEF_AND_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1043, 0x12e0, "ASUS X541SA", ALC256_FIXUP_ASUS_MIC), + SND_PCI_QUIRK(0x1043, 0x12f0, "ASUS X541UV", ALC256_FIXUP_ASUS_MIC), ++ SND_PCI_QUIRK(0x1043, 0x1313, "Asus K42JZ", ALC269VB_FIXUP_ASUS_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1043, 0x13b0, "ASUS Z550SA", ALC256_FIXUP_ASUS_MIC), + SND_PCI_QUIRK(0x1043, 0x1427, "Asus Zenbook UX31E", ALC269VB_FIXUP_ASUS_ZENBOOK), + SND_PCI_QUIRK(0x1043, 0x1517, "Asus Zenbook UX31A", ALC269VB_FIXUP_ASUS_ZENBOOK_UX31A), +diff --git a/sound/soc/codecs/da7210.c b/sound/soc/codecs/da7210.c +index e172913d04a4a..efc5049c0796e 100644 +--- a/sound/soc/codecs/da7210.c ++++ b/sound/soc/codecs/da7210.c +@@ -1333,6 +1333,8 @@ static int __init da7210_modinit(void) + int ret = 0; + #if IS_ENABLED(CONFIG_I2C) + ret = i2c_add_driver(&da7210_i2c_driver); ++ if (ret) ++ return ret; + #endif + #if defined(CONFIG_SPI_MASTER) + ret = spi_register_driver(&da7210_spi_driver); +diff --git a/sound/soc/codecs/msm8916-wcd-digital.c b/sound/soc/codecs/msm8916-wcd-digital.c +index e4cde214b7b2d..6e5bce4f5eb2f 100644 +--- a/sound/soc/codecs/msm8916-wcd-digital.c ++++ b/sound/soc/codecs/msm8916-wcd-digital.c +@@ -328,8 +328,8 @@ static const struct snd_kcontrol_new rx1_mix2_inp1_mux = SOC_DAPM_ENUM( + static const struct snd_kcontrol_new rx2_mix2_inp1_mux = SOC_DAPM_ENUM( + "RX2 MIX2 INP1 Mux", rx2_mix2_inp1_chain_enum); + +-/* Digital Gain control -38.4 dB to +38.4 dB in 0.3 dB steps */ +-static const DECLARE_TLV_DB_SCALE(digital_gain, -3840, 30, 0); ++/* Digital Gain control -84 dB to +40 dB in 1 dB steps */ ++static const DECLARE_TLV_DB_SCALE(digital_gain, -8400, 100, -8400); + + /* Cutoff Freq for High Pass Filter at -3dB */ + static const char * const hpf_cutoff_text[] = { +@@ -510,15 +510,15 @@ static int wcd_iir_filter_info(struct snd_kcontrol *kcontrol, + + static const struct snd_kcontrol_new msm8916_wcd_digital_snd_controls[] = { + SOC_SINGLE_S8_TLV("RX1 Digital Volume", LPASS_CDC_RX1_VOL_CTL_B2_CTL, +- -128, 127, digital_gain), ++ -84, 40, digital_gain), + SOC_SINGLE_S8_TLV("RX2 Digital Volume", LPASS_CDC_RX2_VOL_CTL_B2_CTL, +- -128, 127, digital_gain), ++ -84, 40, digital_gain), + SOC_SINGLE_S8_TLV("RX3 Digital Volume", LPASS_CDC_RX3_VOL_CTL_B2_CTL, +- -128, 127, digital_gain), ++ -84, 40, digital_gain), + SOC_SINGLE_S8_TLV("TX1 Digital Volume", LPASS_CDC_TX1_VOL_CTL_GAIN, +- -128, 127, digital_gain), ++ -84, 40, digital_gain), + SOC_SINGLE_S8_TLV("TX2 Digital Volume", LPASS_CDC_TX2_VOL_CTL_GAIN, +- -128, 127, digital_gain), ++ -84, 40, digital_gain), + SOC_ENUM("TX1 HPF Cutoff", tx1_hpf_cutoff_enum), + SOC_ENUM("TX2 HPF Cutoff", tx2_hpf_cutoff_enum), + SOC_SINGLE("TX1 HPF Switch", LPASS_CDC_TX1_MUX_CTL, 3, 1, 0), +@@ -553,22 +553,22 @@ static const struct snd_kcontrol_new msm8916_wcd_digital_snd_controls[] = { + WCD_IIR_FILTER_CTL("IIR2 Band3", IIR2, BAND3), + WCD_IIR_FILTER_CTL("IIR2 Band4", IIR2, BAND4), + WCD_IIR_FILTER_CTL("IIR2 Band5", IIR2, BAND5), +- SOC_SINGLE_SX_TLV("IIR1 INP1 Volume", LPASS_CDC_IIR1_GAIN_B1_CTL, +- 0, -84, 40, digital_gain), +- SOC_SINGLE_SX_TLV("IIR1 INP2 Volume", LPASS_CDC_IIR1_GAIN_B2_CTL, +- 0, -84, 40, digital_gain), +- SOC_SINGLE_SX_TLV("IIR1 INP3 Volume", LPASS_CDC_IIR1_GAIN_B3_CTL, +- 0, -84, 40, digital_gain), +- SOC_SINGLE_SX_TLV("IIR1 INP4 Volume", LPASS_CDC_IIR1_GAIN_B4_CTL, +- 0, -84, 40, digital_gain), +- SOC_SINGLE_SX_TLV("IIR2 INP1 Volume", LPASS_CDC_IIR2_GAIN_B1_CTL, +- 0, -84, 40, digital_gain), +- SOC_SINGLE_SX_TLV("IIR2 INP2 Volume", LPASS_CDC_IIR2_GAIN_B2_CTL, +- 0, -84, 40, digital_gain), +- SOC_SINGLE_SX_TLV("IIR2 INP3 Volume", LPASS_CDC_IIR2_GAIN_B3_CTL, +- 0, -84, 40, digital_gain), +- SOC_SINGLE_SX_TLV("IIR2 INP4 Volume", LPASS_CDC_IIR2_GAIN_B4_CTL, +- 0, -84, 40, digital_gain), ++ SOC_SINGLE_S8_TLV("IIR1 INP1 Volume", LPASS_CDC_IIR1_GAIN_B1_CTL, ++ -84, 40, digital_gain), ++ SOC_SINGLE_S8_TLV("IIR1 INP2 Volume", LPASS_CDC_IIR1_GAIN_B2_CTL, ++ -84, 40, digital_gain), ++ SOC_SINGLE_S8_TLV("IIR1 INP3 Volume", LPASS_CDC_IIR1_GAIN_B3_CTL, ++ -84, 40, digital_gain), ++ SOC_SINGLE_S8_TLV("IIR1 INP4 Volume", LPASS_CDC_IIR1_GAIN_B4_CTL, ++ -84, 40, digital_gain), ++ SOC_SINGLE_S8_TLV("IIR2 INP1 Volume", LPASS_CDC_IIR2_GAIN_B1_CTL, ++ -84, 40, digital_gain), ++ SOC_SINGLE_S8_TLV("IIR2 INP2 Volume", LPASS_CDC_IIR2_GAIN_B2_CTL, ++ -84, 40, digital_gain), ++ SOC_SINGLE_S8_TLV("IIR2 INP3 Volume", LPASS_CDC_IIR2_GAIN_B3_CTL, ++ -84, 40, digital_gain), ++ SOC_SINGLE_S8_TLV("IIR2 INP4 Volume", LPASS_CDC_IIR2_GAIN_B4_CTL, ++ -84, 40, digital_gain), + + }; + +diff --git a/sound/soc/codecs/wcd9335.c b/sound/soc/codecs/wcd9335.c +index 016aff97e2fb2..c01c69613f63d 100644 +--- a/sound/soc/codecs/wcd9335.c ++++ b/sound/soc/codecs/wcd9335.c +@@ -2252,51 +2252,42 @@ static int wcd9335_rx_hph_mode_put(struct snd_kcontrol *kc, + + static const struct snd_kcontrol_new wcd9335_snd_controls[] = { + /* -84dB min - 40dB max */ +- SOC_SINGLE_SX_TLV("RX0 Digital Volume", WCD9335_CDC_RX0_RX_VOL_CTL, +- 0, -84, 40, digital_gain), +- SOC_SINGLE_SX_TLV("RX1 Digital Volume", WCD9335_CDC_RX1_RX_VOL_CTL, +- 0, -84, 40, digital_gain), +- SOC_SINGLE_SX_TLV("RX2 Digital Volume", WCD9335_CDC_RX2_RX_VOL_CTL, +- 0, -84, 40, digital_gain), +- SOC_SINGLE_SX_TLV("RX3 Digital Volume", WCD9335_CDC_RX3_RX_VOL_CTL, +- 0, -84, 40, digital_gain), +- SOC_SINGLE_SX_TLV("RX4 Digital Volume", WCD9335_CDC_RX4_RX_VOL_CTL, +- 0, -84, 40, digital_gain), +- SOC_SINGLE_SX_TLV("RX5 Digital Volume", WCD9335_CDC_RX5_RX_VOL_CTL, +- 0, -84, 40, digital_gain), +- SOC_SINGLE_SX_TLV("RX6 Digital Volume", WCD9335_CDC_RX6_RX_VOL_CTL, +- 0, -84, 40, digital_gain), +- SOC_SINGLE_SX_TLV("RX7 Digital Volume", WCD9335_CDC_RX7_RX_VOL_CTL, +- 0, -84, 40, digital_gain), +- SOC_SINGLE_SX_TLV("RX8 Digital Volume", WCD9335_CDC_RX8_RX_VOL_CTL, +- 0, -84, 40, digital_gain), +- SOC_SINGLE_SX_TLV("RX0 Mix Digital Volume", +- WCD9335_CDC_RX0_RX_VOL_MIX_CTL, +- 0, -84, 40, digital_gain), +- SOC_SINGLE_SX_TLV("RX1 Mix Digital Volume", +- WCD9335_CDC_RX1_RX_VOL_MIX_CTL, +- 0, -84, 40, digital_gain), +- SOC_SINGLE_SX_TLV("RX2 Mix Digital Volume", +- WCD9335_CDC_RX2_RX_VOL_MIX_CTL, +- 0, -84, 40, digital_gain), +- SOC_SINGLE_SX_TLV("RX3 Mix Digital Volume", +- WCD9335_CDC_RX3_RX_VOL_MIX_CTL, +- 0, -84, 40, digital_gain), +- SOC_SINGLE_SX_TLV("RX4 Mix Digital Volume", +- WCD9335_CDC_RX4_RX_VOL_MIX_CTL, +- 0, -84, 40, digital_gain), +- SOC_SINGLE_SX_TLV("RX5 Mix Digital Volume", +- WCD9335_CDC_RX5_RX_VOL_MIX_CTL, +- 0, -84, 40, digital_gain), +- SOC_SINGLE_SX_TLV("RX6 Mix Digital Volume", +- WCD9335_CDC_RX6_RX_VOL_MIX_CTL, +- 0, -84, 40, digital_gain), +- SOC_SINGLE_SX_TLV("RX7 Mix Digital Volume", +- WCD9335_CDC_RX7_RX_VOL_MIX_CTL, +- 0, -84, 40, digital_gain), +- SOC_SINGLE_SX_TLV("RX8 Mix Digital Volume", +- WCD9335_CDC_RX8_RX_VOL_MIX_CTL, +- 0, -84, 40, digital_gain), ++ SOC_SINGLE_S8_TLV("RX0 Digital Volume", WCD9335_CDC_RX0_RX_VOL_CTL, ++ -84, 40, digital_gain), ++ SOC_SINGLE_S8_TLV("RX1 Digital Volume", WCD9335_CDC_RX1_RX_VOL_CTL, ++ -84, 40, digital_gain), ++ SOC_SINGLE_S8_TLV("RX2 Digital Volume", WCD9335_CDC_RX2_RX_VOL_CTL, ++ -84, 40, digital_gain), ++ SOC_SINGLE_S8_TLV("RX3 Digital Volume", WCD9335_CDC_RX3_RX_VOL_CTL, ++ -84, 40, digital_gain), ++ SOC_SINGLE_S8_TLV("RX4 Digital Volume", WCD9335_CDC_RX4_RX_VOL_CTL, ++ -84, 40, digital_gain), ++ SOC_SINGLE_S8_TLV("RX5 Digital Volume", WCD9335_CDC_RX5_RX_VOL_CTL, ++ -84, 40, digital_gain), ++ SOC_SINGLE_S8_TLV("RX6 Digital Volume", WCD9335_CDC_RX6_RX_VOL_CTL, ++ -84, 40, digital_gain), ++ SOC_SINGLE_S8_TLV("RX7 Digital Volume", WCD9335_CDC_RX7_RX_VOL_CTL, ++ -84, 40, digital_gain), ++ SOC_SINGLE_S8_TLV("RX8 Digital Volume", WCD9335_CDC_RX8_RX_VOL_CTL, ++ -84, 40, digital_gain), ++ SOC_SINGLE_S8_TLV("RX0 Mix Digital Volume", WCD9335_CDC_RX0_RX_VOL_MIX_CTL, ++ -84, 40, digital_gain), ++ SOC_SINGLE_S8_TLV("RX1 Mix Digital Volume", WCD9335_CDC_RX1_RX_VOL_MIX_CTL, ++ -84, 40, digital_gain), ++ SOC_SINGLE_S8_TLV("RX2 Mix Digital Volume", WCD9335_CDC_RX2_RX_VOL_MIX_CTL, ++ -84, 40, digital_gain), ++ SOC_SINGLE_S8_TLV("RX3 Mix Digital Volume", WCD9335_CDC_RX3_RX_VOL_MIX_CTL, ++ -84, 40, digital_gain), ++ SOC_SINGLE_S8_TLV("RX4 Mix Digital Volume", WCD9335_CDC_RX4_RX_VOL_MIX_CTL, ++ -84, 40, digital_gain), ++ SOC_SINGLE_S8_TLV("RX5 Mix Digital Volume", WCD9335_CDC_RX5_RX_VOL_MIX_CTL, ++ -84, 40, digital_gain), ++ SOC_SINGLE_S8_TLV("RX6 Mix Digital Volume", WCD9335_CDC_RX6_RX_VOL_MIX_CTL, ++ -84, 40, digital_gain), ++ SOC_SINGLE_S8_TLV("RX7 Mix Digital Volume", WCD9335_CDC_RX7_RX_VOL_MIX_CTL, ++ -84, 40, digital_gain), ++ SOC_SINGLE_S8_TLV("RX8 Mix Digital Volume", WCD9335_CDC_RX8_RX_VOL_MIX_CTL, ++ -84, 40, digital_gain), + SOC_ENUM("RX INT0_1 HPF cut off", cf_int0_1_enum), + SOC_ENUM("RX INT0_2 HPF cut off", cf_int0_2_enum), + SOC_ENUM("RX INT1_1 HPF cut off", cf_int1_1_enum), +diff --git a/sound/soc/generic/audio-graph-card.c b/sound/soc/generic/audio-graph-card.c +index 1bc4981246899..96aa2c015572f 100644 +--- a/sound/soc/generic/audio-graph-card.c ++++ b/sound/soc/generic/audio-graph-card.c +@@ -149,8 +149,10 @@ static int asoc_simple_parse_dai(struct device_node *ep, + * if he unbinded CPU or Codec. + */ + ret = snd_soc_get_dai_name(&args, &dlc->dai_name); +- if (ret < 0) ++ if (ret < 0) { ++ of_node_put(node); + return ret; ++ } + + dlc->of_node = node; + +diff --git a/sound/soc/mediatek/mt6797/mt6797-mt6351.c b/sound/soc/mediatek/mt6797/mt6797-mt6351.c +index 496f32bcfb5e3..d2f6213a6bfcc 100644 +--- a/sound/soc/mediatek/mt6797/mt6797-mt6351.c ++++ b/sound/soc/mediatek/mt6797/mt6797-mt6351.c +@@ -217,7 +217,8 @@ static int mt6797_mt6351_dev_probe(struct platform_device *pdev) + if (!codec_node) { + dev_err(&pdev->dev, + "Property 'audio-codec' missing or invalid\n"); +- return -EINVAL; ++ ret = -EINVAL; ++ goto put_platform_node; + } + for_each_card_prelinks(card, i, dai_link) { + if (dai_link->codecs->name) +@@ -230,6 +231,9 @@ static int mt6797_mt6351_dev_probe(struct platform_device *pdev) + dev_err(&pdev->dev, "%s snd_soc_register_card fail %d\n", + __func__, ret); + ++ of_node_put(codec_node); ++put_platform_node: ++ of_node_put(platform_node); + return ret; + } + +diff --git a/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5676.c b/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5676.c +index 727ff0f7f20b1..8e1e60a9b45c4 100644 +--- a/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5676.c ++++ b/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5676.c +@@ -256,14 +256,16 @@ static int mt8173_rt5650_rt5676_dev_probe(struct platform_device *pdev) + if (!mt8173_rt5650_rt5676_dais[DAI_LINK_CODEC_I2S].codecs[0].of_node) { + dev_err(&pdev->dev, + "Property 'audio-codec' missing or invalid\n"); +- return -EINVAL; ++ ret = -EINVAL; ++ goto put_node; + } + mt8173_rt5650_rt5676_dais[DAI_LINK_CODEC_I2S].codecs[1].of_node = + of_parse_phandle(pdev->dev.of_node, "mediatek,audio-codec", 1); + if (!mt8173_rt5650_rt5676_dais[DAI_LINK_CODEC_I2S].codecs[1].of_node) { + dev_err(&pdev->dev, + "Property 'audio-codec' missing or invalid\n"); +- return -EINVAL; ++ ret = -EINVAL; ++ goto put_node; + } + mt8173_rt5650_rt5676_codec_conf[0].of_node = + mt8173_rt5650_rt5676_dais[DAI_LINK_CODEC_I2S].codecs[1].of_node; +@@ -276,7 +278,8 @@ static int mt8173_rt5650_rt5676_dev_probe(struct platform_device *pdev) + if (!mt8173_rt5650_rt5676_dais[DAI_LINK_HDMI_I2S].codecs->of_node) { + dev_err(&pdev->dev, + "Property 'audio-codec' missing or invalid\n"); +- return -EINVAL; ++ ret = -EINVAL; ++ goto put_node; + } + + card->dev = &pdev->dev; +@@ -286,6 +289,7 @@ static int mt8173_rt5650_rt5676_dev_probe(struct platform_device *pdev) + dev_err(&pdev->dev, "%s snd_soc_register_card fail %d\n", + __func__, ret); + ++put_node: + of_node_put(platform_node); + return ret; + } +diff --git a/sound/soc/mediatek/mt8173/mt8173-rt5650.c b/sound/soc/mediatek/mt8173/mt8173-rt5650.c +index 21e7d4d3ded5a..cdfc697ad94e2 100644 +--- a/sound/soc/mediatek/mt8173/mt8173-rt5650.c ++++ b/sound/soc/mediatek/mt8173/mt8173-rt5650.c +@@ -266,7 +266,8 @@ static int mt8173_rt5650_dev_probe(struct platform_device *pdev) + if (!mt8173_rt5650_dais[DAI_LINK_CODEC_I2S].codecs[0].of_node) { + dev_err(&pdev->dev, + "Property 'audio-codec' missing or invalid\n"); +- return -EINVAL; ++ ret = -EINVAL; ++ goto put_platform_node; + } + mt8173_rt5650_dais[DAI_LINK_CODEC_I2S].codecs[1].of_node = + mt8173_rt5650_dais[DAI_LINK_CODEC_I2S].codecs[0].of_node; +@@ -279,7 +280,7 @@ static int mt8173_rt5650_dev_probe(struct platform_device *pdev) + dev_err(&pdev->dev, + "%s codec_capture_dai name fail %d\n", + __func__, ret); +- return ret; ++ goto put_platform_node; + } + mt8173_rt5650_dais[DAI_LINK_CODEC_I2S].codecs[1].dai_name = + codec_capture_dai; +@@ -301,7 +302,8 @@ static int mt8173_rt5650_dev_probe(struct platform_device *pdev) + if (!mt8173_rt5650_dais[DAI_LINK_HDMI_I2S].codecs->of_node) { + dev_err(&pdev->dev, + "Property 'audio-codec' missing or invalid\n"); +- return -EINVAL; ++ ret = -EINVAL; ++ goto put_platform_node; + } + card->dev = &pdev->dev; + +@@ -310,6 +312,7 @@ static int mt8173_rt5650_dev_probe(struct platform_device *pdev) + dev_err(&pdev->dev, "%s snd_soc_register_card fail %d\n", + __func__, ret); + ++put_platform_node: + of_node_put(platform_node); + return ret; + } +diff --git a/sound/soc/qcom/qdsp6/q6adm.c b/sound/soc/qcom/qdsp6/q6adm.c +index da242515e1467..8e3539941fad1 100644 +--- a/sound/soc/qcom/qdsp6/q6adm.c ++++ b/sound/soc/qcom/qdsp6/q6adm.c +@@ -217,7 +217,7 @@ static struct q6copp *q6adm_alloc_copp(struct q6adm *adm, int port_idx) + idx = find_first_zero_bit(&adm->copp_bitmap[port_idx], + MAX_COPPS_PER_PORT); + +- if (idx > MAX_COPPS_PER_PORT) ++ if (idx >= MAX_COPPS_PER_PORT) + return ERR_PTR(-EBUSY); + + c = kzalloc(sizeof(*c), GFP_ATOMIC); +diff --git a/sound/usb/bcd2000/bcd2000.c b/sound/usb/bcd2000/bcd2000.c +index 6e3175826faf7..97afb37809703 100644 +--- a/sound/usb/bcd2000/bcd2000.c ++++ b/sound/usb/bcd2000/bcd2000.c +@@ -348,7 +348,8 @@ static int bcd2000_init_midi(struct bcd2000 *bcd2k) + static void bcd2000_free_usb_related_resources(struct bcd2000 *bcd2k, + struct usb_interface *interface) + { +- /* usb_kill_urb not necessary, urb is aborted automatically */ ++ usb_kill_urb(bcd2k->midi_out_urb); ++ usb_kill_urb(bcd2k->midi_in_urb); + + usb_free_urb(bcd2k->midi_out_urb); + usb_free_urb(bcd2k->midi_in_urb); +diff --git a/tools/build/feature/test-libcrypto.c b/tools/build/feature/test-libcrypto.c +index a98174e0569c8..bc34a5bbb5049 100644 +--- a/tools/build/feature/test-libcrypto.c ++++ b/tools/build/feature/test-libcrypto.c +@@ -1,16 +1,23 @@ + // SPDX-License-Identifier: GPL-2.0 ++#include + #include + #include + + int main(void) + { +- MD5_CTX context; ++ EVP_MD_CTX *mdctx; + unsigned char md[MD5_DIGEST_LENGTH + SHA_DIGEST_LENGTH]; + unsigned char dat[] = "12345"; ++ unsigned int digest_len; + +- MD5_Init(&context); +- MD5_Update(&context, &dat[0], sizeof(dat)); +- MD5_Final(&md[0], &context); ++ mdctx = EVP_MD_CTX_new(); ++ if (!mdctx) ++ return 0; ++ ++ EVP_DigestInit_ex(mdctx, EVP_md5(), NULL); ++ EVP_DigestUpdate(mdctx, &dat[0], sizeof(dat)); ++ EVP_DigestFinal_ex(mdctx, &md[0], &digest_len); ++ EVP_MD_CTX_free(mdctx); + + SHA1(&dat[0], sizeof(dat), &md[0]); + +diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c +index 2a1dbf52fc9a5..b8849812449c3 100644 +--- a/tools/lib/bpf/libbpf.c ++++ b/tools/lib/bpf/libbpf.c +@@ -1884,7 +1884,7 @@ static int bpf_map_find_btf_info(struct bpf_object *obj, struct bpf_map *map) + int bpf_map__reuse_fd(struct bpf_map *map, int fd) + { + struct bpf_map_info info = {}; +- __u32 len = sizeof(info); ++ __u32 len = sizeof(info), name_len; + int new_fd, err; + char *new_name; + +@@ -1892,7 +1892,12 @@ int bpf_map__reuse_fd(struct bpf_map *map, int fd) + if (err) + return err; + +- new_name = strdup(info.name); ++ name_len = strlen(info.name); ++ if (name_len == BPF_OBJ_NAME_LEN - 1 && strncmp(map->name, info.name, name_len) == 0) ++ new_name = strdup(map->name); ++ else ++ new_name = strdup(info.name); ++ + if (!new_name) + return -errno; + +diff --git a/tools/perf/util/genelf.c b/tools/perf/util/genelf.c +index f9f18b8b1df9a..17b74aba8b9a2 100644 +--- a/tools/perf/util/genelf.c ++++ b/tools/perf/util/genelf.c +@@ -35,7 +35,11 @@ + + #define BUILD_ID_URANDOM /* different uuid for each run */ + +-#ifdef HAVE_LIBCRYPTO ++// FIXME, remove this and fix the deprecation warnings before its removed and ++// We'll break for good here... ++#pragma GCC diagnostic ignored "-Wdeprecated-declarations" ++ ++#ifdef HAVE_LIBCRYPTO_SUPPORT + + #define BUILD_ID_MD5 + #undef BUILD_ID_SHA /* does not seem to work well when linked with Java */ +diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c +index 0b185b1090ff3..a04a7dfb8ec09 100644 +--- a/tools/perf/util/symbol-elf.c ++++ b/tools/perf/util/symbol-elf.c +@@ -1159,16 +1159,29 @@ int dso__load_sym(struct dso *dso, struct map *map, struct symsrc *syms_ss, + + if (elf_read_program_header(syms_ss->elf, + (u64)sym.st_value, &phdr)) { +- pr_warning("%s: failed to find program header for " ++ pr_debug4("%s: failed to find program header for " + "symbol: %s st_value: %#" PRIx64 "\n", + __func__, elf_name, (u64)sym.st_value); +- continue; ++ pr_debug4("%s: adjusting symbol: st_value: %#" PRIx64 " " ++ "sh_addr: %#" PRIx64 " sh_offset: %#" PRIx64 "\n", ++ __func__, (u64)sym.st_value, (u64)shdr.sh_addr, ++ (u64)shdr.sh_offset); ++ /* ++ * Fail to find program header, let's rollback ++ * to use shdr.sh_addr and shdr.sh_offset to ++ * calibrate symbol's file address, though this ++ * is not necessary for normal C ELF file, we ++ * still need to handle java JIT symbols in this ++ * case. ++ */ ++ sym.st_value -= shdr.sh_addr - shdr.sh_offset; ++ } else { ++ pr_debug4("%s: adjusting symbol: st_value: %#" PRIx64 " " ++ "p_vaddr: %#" PRIx64 " p_offset: %#" PRIx64 "\n", ++ __func__, (u64)sym.st_value, (u64)phdr.p_vaddr, ++ (u64)phdr.p_offset); ++ sym.st_value -= phdr.p_vaddr - phdr.p_offset; + } +- pr_debug4("%s: adjusting symbol: st_value: %#" PRIx64 " " +- "p_vaddr: %#" PRIx64 " p_offset: %#" PRIx64 "\n", +- __func__, (u64)sym.st_value, (u64)phdr.p_vaddr, +- (u64)phdr.p_offset); +- sym.st_value -= phdr.p_vaddr - phdr.p_offset; + } + + demangled = demangle_sym(dso, kmodule, elf_name); +diff --git a/tools/testing/selftests/bpf/test_btf.c b/tools/testing/selftests/bpf/test_btf.c +index 3d617e8060548..996eca57bc977 100644 +--- a/tools/testing/selftests/bpf/test_btf.c ++++ b/tools/testing/selftests/bpf/test_btf.c +@@ -4808,7 +4808,7 @@ static int do_test_pprint(int test_num) + ret = snprintf(pin_path, sizeof(pin_path), "%s/%s", + "/sys/fs/bpf", test->map_name); + +- if (CHECK(ret == sizeof(pin_path), "pin_path %s/%s is too long", ++ if (CHECK(ret >= sizeof(pin_path), "pin_path %s/%s is too long", + "/sys/fs/bpf", test->map_name)) { + err = -1; + goto done; +diff --git a/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_syntax_errors.tc b/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_syntax_errors.tc +index ef1e9bafb0984..728c2762ee581 100644 +--- a/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_syntax_errors.tc ++++ b/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_syntax_errors.tc +@@ -24,7 +24,6 @@ check_error 'p:^/bar vfs_read' # NO_GROUP_NAME + check_error 'p:^12345678901234567890123456789012345678901234567890123456789012345/bar vfs_read' # GROUP_TOO_LONG + + check_error 'p:^foo.1/bar vfs_read' # BAD_GROUP_NAME +-check_error 'p:foo/^ vfs_read' # NO_EVENT_NAME + check_error 'p:foo/^12345678901234567890123456789012345678901234567890123456789012345 vfs_read' # EVENT_TOO_LONG + check_error 'p:foo/^bar.1 vfs_read' # BAD_EVENT_NAME + +diff --git a/tools/testing/selftests/timers/clocksource-switch.c b/tools/testing/selftests/timers/clocksource-switch.c +index bfc974b4572d5..c18313a5f357b 100644 +--- a/tools/testing/selftests/timers/clocksource-switch.c ++++ b/tools/testing/selftests/timers/clocksource-switch.c +@@ -110,10 +110,10 @@ int run_tests(int secs) + + sprintf(buf, "./inconsistency-check -t %i", secs); + ret = system(buf); +- if (ret) +- return ret; ++ if (WIFEXITED(ret) && WEXITSTATUS(ret)) ++ return WEXITSTATUS(ret); + ret = system("./nanosleep"); +- return ret; ++ return WIFEXITED(ret) ? WEXITSTATUS(ret) : 0; + } + + +diff --git a/tools/testing/selftests/timers/valid-adjtimex.c b/tools/testing/selftests/timers/valid-adjtimex.c +index 5397de708d3c2..48b9a803235a8 100644 +--- a/tools/testing/selftests/timers/valid-adjtimex.c ++++ b/tools/testing/selftests/timers/valid-adjtimex.c +@@ -40,7 +40,7 @@ + #define ADJ_SETOFFSET 0x0100 + + #include +-static int clock_adjtime(clockid_t id, struct timex *tx) ++int clock_adjtime(clockid_t id, struct timex *tx) + { + return syscall(__NR_clock_adjtime, id, tx); + } +diff --git a/tools/thermal/tmon/sysfs.c b/tools/thermal/tmon/sysfs.c +index b00b1bfd9d8e7..cb1108bc92498 100644 +--- a/tools/thermal/tmon/sysfs.c ++++ b/tools/thermal/tmon/sysfs.c +@@ -13,6 +13,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -33,9 +34,9 @@ int sysfs_set_ulong(char *path, char *filename, unsigned long val) + { + FILE *fd; + int ret = -1; +- char filepath[256]; ++ char filepath[PATH_MAX + 2]; /* NUL and '/' */ + +- snprintf(filepath, 256, "%s/%s", path, filename); ++ snprintf(filepath, sizeof(filepath), "%s/%s", path, filename); + + fd = fopen(filepath, "w"); + if (!fd) { +@@ -57,9 +58,9 @@ static int sysfs_get_ulong(char *path, char *filename, unsigned long *p_ulong) + { + FILE *fd; + int ret = -1; +- char filepath[256]; ++ char filepath[PATH_MAX + 2]; /* NUL and '/' */ + +- snprintf(filepath, 256, "%s/%s", path, filename); ++ snprintf(filepath, sizeof(filepath), "%s/%s", path, filename); + + fd = fopen(filepath, "r"); + if (!fd) { +@@ -76,9 +77,9 @@ static int sysfs_get_string(char *path, char *filename, char *str) + { + FILE *fd; + int ret = -1; +- char filepath[256]; ++ char filepath[PATH_MAX + 2]; /* NUL and '/' */ + +- snprintf(filepath, 256, "%s/%s", path, filename); ++ snprintf(filepath, sizeof(filepath), "%s/%s", path, filename); + + fd = fopen(filepath, "r"); + if (!fd) { +@@ -199,8 +200,8 @@ static int find_tzone_cdev(struct dirent *nl, char *tz_name, + { + unsigned long trip_instance = 0; + char cdev_name_linked[256]; +- char cdev_name[256]; +- char cdev_trip_name[256]; ++ char cdev_name[PATH_MAX]; ++ char cdev_trip_name[PATH_MAX]; + int cdev_id; + + if (nl->d_type == DT_LNK) { +@@ -213,7 +214,8 @@ static int find_tzone_cdev(struct dirent *nl, char *tz_name, + return -EINVAL; + } + /* find the link to real cooling device record binding */ +- snprintf(cdev_name, 256, "%s/%s", tz_name, nl->d_name); ++ snprintf(cdev_name, sizeof(cdev_name) - 2, "%s/%s", ++ tz_name, nl->d_name); + memset(cdev_name_linked, 0, sizeof(cdev_name_linked)); + if (readlink(cdev_name, cdev_name_linked, + sizeof(cdev_name_linked) - 1) != -1) { +@@ -226,8 +228,8 @@ static int find_tzone_cdev(struct dirent *nl, char *tz_name, + /* find the trip point in which the cdev is binded to + * in this tzone + */ +- snprintf(cdev_trip_name, 256, "%s%s", nl->d_name, +- "_trip_point"); ++ snprintf(cdev_trip_name, sizeof(cdev_trip_name) - 1, ++ "%s%s", nl->d_name, "_trip_point"); + sysfs_get_ulong(tz_name, cdev_trip_name, + &trip_instance); + /* validate trip point range, e.g. trip could return -1 +diff --git a/tools/thermal/tmon/tmon.h b/tools/thermal/tmon/tmon.h +index c9066ec104ddd..44d16d778f044 100644 +--- a/tools/thermal/tmon/tmon.h ++++ b/tools/thermal/tmon/tmon.h +@@ -27,6 +27,9 @@ + #define NR_LINES_TZDATA 1 + #define TMON_LOG_FILE "/var/tmp/tmon.log" + ++#include ++#include ++ + extern unsigned long ticktime; + extern double time_elapsed; + extern unsigned long target_temp_user; +diff --git a/tools/vm/slabinfo.c b/tools/vm/slabinfo.c +index 68092d15e12b5..dda035c358c20 100644 +--- a/tools/vm/slabinfo.c ++++ b/tools/vm/slabinfo.c +@@ -125,7 +125,7 @@ static void usage(void) + "-n|--numa Show NUMA information\n" + "-N|--lines=K Show the first K slabs\n" + "-o|--ops Show kmem_cache_ops\n" +- "-P|--partial Sort by number of partial slabs\n" ++ "-P|--partial Sort by number of partial slabs\n" + "-r|--report Detailed report on single slabs\n" + "-s|--shrink Shrink slabs\n" + "-S|--Size Sort by size\n" +@@ -1045,15 +1045,27 @@ static void sort_slabs(void) + for (s2 = s1 + 1; s2 < slabinfo + slabs; s2++) { + int result; + +- if (sort_size) +- result = slab_size(s1) < slab_size(s2); +- else if (sort_active) +- result = slab_activity(s1) < slab_activity(s2); +- else if (sort_loss) +- result = slab_waste(s1) < slab_waste(s2); +- else if (sort_partial) +- result = s1->partial < s2->partial; +- else ++ if (sort_size) { ++ if (slab_size(s1) == slab_size(s2)) ++ result = strcasecmp(s1->name, s2->name); ++ else ++ result = slab_size(s1) < slab_size(s2); ++ } else if (sort_active) { ++ if (slab_activity(s1) == slab_activity(s2)) ++ result = strcasecmp(s1->name, s2->name); ++ else ++ result = slab_activity(s1) < slab_activity(s2); ++ } else if (sort_loss) { ++ if (slab_waste(s1) == slab_waste(s2)) ++ result = strcasecmp(s1->name, s2->name); ++ else ++ result = slab_waste(s1) < slab_waste(s2); ++ } else if (sort_partial) { ++ if (s1->partial == s2->partial) ++ result = strcasecmp(s1->name, s2->name); ++ else ++ result = s1->partial < s2->partial; ++ } else + result = strcasecmp(s1->name, s2->name); + + if (show_inverted) +diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c +index 4b445dddb7985..0008fc49528a4 100644 +--- a/virt/kvm/kvm_main.c ++++ b/virt/kvm/kvm_main.c +@@ -2937,7 +2937,7 @@ static long kvm_vcpu_ioctl(struct file *filp, + struct kvm_fpu *fpu = NULL; + struct kvm_sregs *kvm_sregs = NULL; + +- if (vcpu->kvm->mm != current->mm) ++ if (vcpu->kvm->mm != current->mm || vcpu->kvm->vm_bugged) + return -EIO; + + if (unlikely(_IOC_TYPE(ioctl) != KVMIO)) +@@ -3144,7 +3144,7 @@ static long kvm_vcpu_compat_ioctl(struct file *filp, + void __user *argp = compat_ptr(arg); + int r; + +- if (vcpu->kvm->mm != current->mm) ++ if (vcpu->kvm->mm != current->mm || vcpu->kvm->vm_bugged) + return -EIO; + + switch (ioctl) { +@@ -3209,7 +3209,7 @@ static long kvm_device_ioctl(struct file *filp, unsigned int ioctl, + { + struct kvm_device *dev = filp->private_data; + +- if (dev->kvm->mm != current->mm) ++ if (dev->kvm->mm != current->mm || dev->kvm->vm_bugged) + return -EIO; + + switch (ioctl) { +@@ -3413,7 +3413,7 @@ static long kvm_vm_ioctl(struct file *filp, + void __user *argp = (void __user *)arg; + int r; + +- if (kvm->mm != current->mm) ++ if (kvm->mm != current->mm || kvm->vm_bugged) + return -EIO; + switch (ioctl) { + case KVM_CREATE_VCPU: +@@ -3621,7 +3621,7 @@ static long kvm_vm_compat_ioctl(struct file *filp, + struct kvm *kvm = filp->private_data; + int r; + +- if (kvm->mm != current->mm) ++ if (kvm->mm != current->mm || kvm->vm_bugged) + return -EIO; + switch (ioctl) { + #ifdef CONFIG_KVM_GENERIC_DIRTYLOG_READ_PROTECT