From b7ef3ca1e04816d15f46117b4b39296bc9dcc316 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Igor=20Pe=C4=8Dovnik?= Date: Mon, 31 Aug 2020 21:54:19 +0200 Subject: [PATCH] Odroid XU4 (#2173) - legacy received upstream patches - current had broken headers installation + few missing patches - dev was bumped to 5.8.y --- config/kernel/linux-odroidxu4-current.config | 4 +- config/kernel/linux-odroidxu4-dev.config | 353 +- config/sources/families/odroidxu4.conf | 6 +- ...0001-Reverting-headers-install-patch.patch | 50 + .../odroidxu4-current/patch-5.4.58-59.patch | 9141 +++++++++++++++++ .../odroidxu4-current/patch-5.4.59-60.patch | 4875 +++++++++ .../odroidxu4-current/patch-5.4.60-61.patch | 3600 +++++++ ...s5-usbdrd-Calibrating-makes-sense-on.patch | 34 - ...support-for-8-trip-points-.patch.disabled} | 0 ...5422-enable-Exynos5422-TMU.patch.disabled} | 0 ...e-configuration-for-trip-p.patch.disabled} | 0 ...ew-sysfs-file-for-irq-mode.patch.disabled} | 0 .../wifi-4003-fix-sha256_state-clashes.patch | 372 + .../wifi-4004-fix-cfg80211-for-5.8.patch | 354 + .../odroidxu4-legacy/patch-4.14.191-192.patch | 1244 +++ .../odroidxu4-legacy/patch-4.14.192-193.patch | 488 + .../odroidxu4-legacy/patch-4.14.193-194.patch | 6900 +++++++++++++ .../odroidxu4-legacy/patch-4.14.194-195.patch | 1484 +++ 18 files changed, 28710 insertions(+), 195 deletions(-) create mode 100644 patch/kernel/odroidxu4-current/0001-Reverting-headers-install-patch.patch create mode 100644 patch/kernel/odroidxu4-current/patch-5.4.58-59.patch create mode 100644 patch/kernel/odroidxu4-current/patch-5.4.59-60.patch create mode 100644 patch/kernel/odroidxu4-current/patch-5.4.60-61.patch delete mode 100644 patch/kernel/odroidxu4-dev/0011-MEMEKA-phy-exynos5-usbdrd-Calibrating-makes-sense-on.patch rename patch/kernel/odroidxu4-dev/{0013-MEMEKA-thermal-exynos-add-support-for-8-trip-points-.patch => 0013-MEMEKA-thermal-exynos-add-support-for-8-trip-points-.patch.disabled} (100%) rename patch/kernel/odroidxu4-dev/{0014-MEMEKA-arm-dts-exynos5422-enable-Exynos5422-TMU.patch => 0014-MEMEKA-arm-dts-exynos5422-enable-Exynos5422-TMU.patch.disabled} (100%) rename patch/kernel/odroidxu4-dev/{0015-MEMEKA-thermal-add-irq-mode-configuration-for-trip-p.patch => 0015-MEMEKA-thermal-add-irq-mode-configuration-for-trip-p.patch.disabled} (100%) rename patch/kernel/odroidxu4-dev/{0016-MEMEKA-thermal-add-new-sysfs-file-for-irq-mode.patch => 0016-MEMEKA-thermal-add-new-sysfs-file-for-irq-mode.patch.disabled} (100%) create mode 100644 patch/kernel/odroidxu4-dev/wifi-4003-fix-sha256_state-clashes.patch create mode 100644 patch/kernel/odroidxu4-dev/wifi-4004-fix-cfg80211-for-5.8.patch create mode 100644 patch/kernel/odroidxu4-legacy/patch-4.14.191-192.patch create mode 100644 patch/kernel/odroidxu4-legacy/patch-4.14.192-193.patch create mode 100644 patch/kernel/odroidxu4-legacy/patch-4.14.193-194.patch create mode 100644 patch/kernel/odroidxu4-legacy/patch-4.14.194-195.patch diff --git a/config/kernel/linux-odroidxu4-current.config b/config/kernel/linux-odroidxu4-current.config index 319a339fa..f7f74be24 100644 --- a/config/kernel/linux-odroidxu4-current.config +++ b/config/kernel/linux-odroidxu4-current.config @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/arm 5.4.42 Kernel Configuration +# Linux/arm 5.4.61 Kernel Configuration # # @@ -1912,7 +1912,6 @@ CONFIG_SCSI_PROC_FS=y CONFIG_BLK_DEV_SD=m CONFIG_CHR_DEV_ST=m CONFIG_BLK_DEV_SR=m -# CONFIG_BLK_DEV_SR_VENDOR is not set CONFIG_CHR_DEV_SG=m CONFIG_CHR_DEV_SCH=m # CONFIG_SCSI_CONSTANTS is not set @@ -2362,6 +2361,7 @@ CONFIG_RTL8822BU=m CONFIG_RTL8188EU=m CONFIG_RTL8821CU=m CONFIG_88XXAU=m +CONFIG_RTL8192EU=m CONFIG_RTL8189FS=m CONFIG_RTL8189ES=m CONFIG_WLAN_VENDOR_ZYDAS=y diff --git a/config/kernel/linux-odroidxu4-dev.config b/config/kernel/linux-odroidxu4-dev.config index 5e7f77f93..3df5d2a6a 100644 --- a/config/kernel/linux-odroidxu4-dev.config +++ b/config/kernel/linux-odroidxu4-dev.config @@ -1,16 +1,14 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/arm 5.7.13 Kernel Configuration -# - -# -# Compiler: arm-none-linux-gnueabihf-gcc (GNU Toolchain for the A-profile Architecture 9.2-2019.12 (arm-9.10)) 9.2.1 20191025 +# Linux/arm 5.8.5 Kernel Configuration # +CONFIG_CC_VERSION_TEXT="arm-none-linux-gnueabihf-gcc (GNU Toolchain for the A-profile Architecture 9.2-2019.12 (arm-9.10)) 9.2.1 20191025" CONFIG_CC_IS_GCC=y CONFIG_GCC_VERSION=90201 CONFIG_LD_VERSION=233010000 CONFIG_CLANG_VERSION=0 CONFIG_CC_CAN_LINK=y +CONFIG_CC_CAN_LINK_STATIC=y CONFIG_CC_HAS_ASM_GOTO=y CONFIG_CC_HAS_ASM_INLINE=y CONFIG_IRQ_WORK=y @@ -34,12 +32,14 @@ CONFIG_KERNEL_GZIP=y # CONFIG_KERNEL_XZ is not set # CONFIG_KERNEL_LZO is not set # CONFIG_KERNEL_LZ4 is not set +CONFIG_DEFAULT_INIT="" CONFIG_DEFAULT_HOSTNAME="(none)" CONFIG_SWAP=y CONFIG_SYSVIPC=y CONFIG_SYSVIPC_SYSCTL=y CONFIG_POSIX_MQUEUE=y CONFIG_POSIX_MQUEUE_SYSCTL=y +# CONFIG_WATCH_QUEUE is not set CONFIG_CROSS_MEMORY_ATTACH=y # CONFIG_USELIB is not set CONFIG_AUDIT=y @@ -114,6 +114,7 @@ CONFIG_PREEMPT_RCU=y # CONFIG_RCU_EXPERT is not set CONFIG_SRCU=y CONFIG_TREE_SRCU=y +CONFIG_TASKS_RCU_GENERIC=y CONFIG_TASKS_RCU=y CONFIG_RCU_STALL_COMMON=y CONFIG_RCU_NEED_SEGCBLIST=y @@ -137,7 +138,6 @@ CONFIG_CGROUPS=y CONFIG_PAGE_COUNTER=y CONFIG_MEMCG=y CONFIG_MEMCG_SWAP=y -CONFIG_MEMCG_SWAP_ENABLED=y CONFIG_MEMCG_KMEM=y CONFIG_BLK_CGROUP=y CONFIG_CGROUP_WRITEBACK=y @@ -349,6 +349,7 @@ CONFIG_PLAT_SAMSUNG=y # CONFIG_ARCH_SIRF is not set # CONFIG_ARCH_QCOM is not set # CONFIG_ARCH_RDA is not set +# CONFIG_ARCH_REALTEK is not set # CONFIG_ARCH_REALVIEW is not set # CONFIG_ARCH_ROCKCHIP is not set # CONFIG_ARCH_S5PV210 is not set @@ -476,6 +477,9 @@ CONFIG_ARM_PATCH_IDIV=y CONFIG_AEABI=y # CONFIG_OABI_COMPAT is not set CONFIG_ARCH_HAS_HOLES_MEMORYMODEL=y +CONFIG_ARCH_SELECT_MEMORY_MODEL=y +CONFIG_ARCH_FLATMEM_ENABLE=y +CONFIG_ARCH_SPARSEMEM_ENABLE=y CONFIG_HAVE_ARCH_PFN_VALID=y CONFIG_HIGHMEM=y CONFIG_HIGHPTE=y @@ -543,7 +547,6 @@ CONFIG_CPU_FREQ_GOV_SCHEDUTIL=y # CONFIG_CPUFREQ_DT=y CONFIG_CPUFREQ_DT_PLATDEV=y -# CONFIG_QORIQ_CPUFREQ is not set # end of CPU Frequency scaling # @@ -611,8 +614,8 @@ CONFIG_ARCH_HIBERNATION_POSSIBLE=y # Firmware Drivers # # CONFIG_TRUSTED_FOUNDATIONS is not set -CONFIG_HAVE_ARM_SMCCC=y # CONFIG_GOOGLE_FIRMWARE is not set +CONFIG_HAVE_ARM_SMCCC=y # # Tegra firmware driver @@ -662,7 +665,6 @@ CONFIG_HAVE_ARCH_THREAD_STRUCT_WHITELIST=y CONFIG_ARCH_32BIT_OFF_T=y CONFIG_HAVE_REGS_AND_STACK_ACCESS_API=y CONFIG_HAVE_RSEQ=y -CONFIG_HAVE_CLK=y CONFIG_HAVE_HW_BREAKPOINT=y CONFIG_HAVE_PERF_REGS=y CONFIG_HAVE_PERF_USER_STACK_DUMP=y @@ -740,6 +742,7 @@ CONFIG_BLK_WBT_MQ=y CONFIG_BLK_DEBUG_FS=y CONFIG_BLK_DEBUG_FS_ZONED=y # CONFIG_BLK_SED_OPAL is not set +# CONFIG_BLK_INLINE_ENCRYPTION is not set # # Partition Types @@ -807,6 +810,9 @@ CONFIG_COREDUMP=y # # Memory Management options # +CONFIG_SELECT_MEMORY_MODEL=y +CONFIG_FLATMEM_MANUAL=y +# CONFIG_SPARSEMEM_MANUAL is not set CONFIG_FLATMEM=y CONFIG_FLAT_NODE_MEM_MAP=y CONFIG_ARCH_KEEP_MEMBLOCK=y @@ -829,7 +835,7 @@ CONFIG_CMA_AREAS=7 # CONFIG_ZPOOL is not set # CONFIG_ZBUD is not set CONFIG_ZSMALLOC=y -CONFIG_PGTABLE_MAPPING=y +# CONFIG_ZSMALLOC_PGTABLE_MAPPING is not set # CONFIG_ZSMALLOC_STAT is not set CONFIG_GENERIC_EARLY_IOREMAP=y # CONFIG_IDLE_PAGE_TRACKING is not set @@ -859,6 +865,8 @@ CONFIG_XFRM_INTERFACE=m CONFIG_XFRM_SUB_POLICY=y CONFIG_XFRM_MIGRATE=y CONFIG_XFRM_STATISTICS=y +CONFIG_XFRM_AH=m +CONFIG_XFRM_ESP=m CONFIG_XFRM_IPCOMP=m CONFIG_NET_KEY=y CONFIG_NET_KEY_MIGRATE=y @@ -930,6 +938,7 @@ CONFIG_IPV6_OPTIMISTIC_DAD=y CONFIG_INET6_AH=m CONFIG_INET6_ESP=m # CONFIG_INET6_ESP_OFFLOAD is not set +# CONFIG_INET6_ESPINTCP is not set CONFIG_INET6_IPCOMP=m CONFIG_IPV6_MIP6=m CONFIG_IPV6_ILA=m @@ -1347,6 +1356,7 @@ CONFIG_MRP=m CONFIG_BRIDGE=m CONFIG_BRIDGE_IGMP_SNOOPING=y CONFIG_BRIDGE_VLAN_FILTERING=y +# CONFIG_BRIDGE_MRP is not set CONFIG_HAVE_NET_DSA=y # CONFIG_NET_DSA is not set CONFIG_VLAN_8021Q=m @@ -1478,6 +1488,7 @@ CONFIG_NET_ACT_SKBMOD=m CONFIG_NET_ACT_IFE=m CONFIG_NET_ACT_TUNNEL_KEY=m CONFIG_NET_ACT_CT=m +CONFIG_NET_ACT_GATE=m CONFIG_NET_IFE_SKBMARK=m CONFIG_NET_IFE_SKBPRIO=m CONFIG_NET_IFE_SKBTCINDEX=m @@ -1511,6 +1522,9 @@ CONFIG_NET_NSH=m # CONFIG_HSR is not set # CONFIG_NET_SWITCHDEV is not set CONFIG_NET_L3_MASTER_DEV=y +CONFIG_QRTR=m +CONFIG_QRTR_TUN=m +CONFIG_QRTR_MHI=m # CONFIG_NET_NCSI is not set CONFIG_RPS=y CONFIG_RFS_ACCEL=y @@ -1597,7 +1611,9 @@ CONFIG_BT_HS=y CONFIG_BT_LE=y CONFIG_BT_6LOWPAN=m CONFIG_BT_LEDS=y +# CONFIG_BT_MSFTEXT is not set CONFIG_BT_DEBUGFS=y +# CONFIG_BT_FEATURE_DEBUG is not set # # Bluetooth device drivers @@ -1735,6 +1751,7 @@ CONFIG_REGMAP_I2C=y CONFIG_REGMAP_SPI=y CONFIG_REGMAP_MMIO=y CONFIG_REGMAP_IRQ=y +CONFIG_REGMAP_SCCB=m CONFIG_DMA_SHARED_BUFFER=y # CONFIG_DMA_FENCE_TRACE is not set CONFIG_GENERIC_ARCH_TOPOLOGY=y @@ -1910,6 +1927,7 @@ CONFIG_MD_FAULTY=m CONFIG_BCACHE=m # CONFIG_BCACHE_DEBUG is not set # CONFIG_BCACHE_CLOSURES_DEBUG is not set +# CONFIG_BCACHE_ASYNC_REGISTRAION is not set CONFIG_BLK_DEV_DM_BUILTIN=y CONFIG_BLK_DEV_DM=y # CONFIG_DM_DEBUG is not set @@ -1924,6 +1942,7 @@ CONFIG_DM_THIN_PROVISIONING=m CONFIG_DM_CACHE=m CONFIG_DM_CACHE_SMQ=m # CONFIG_DM_WRITECACHE is not set +CONFIG_DM_EBS=m CONFIG_DM_ERA=m CONFIG_DM_CLONE=m CONFIG_DM_MIRROR=m @@ -1933,6 +1952,7 @@ CONFIG_DM_ZERO=m CONFIG_DM_MULTIPATH=m CONFIG_DM_MULTIPATH_QL=m CONFIG_DM_MULTIPATH_ST=m +CONFIG_DM_MULTIPATH_HST=m CONFIG_DM_DELAY=m CONFIG_DM_DUST=m # CONFIG_DM_INIT is not set @@ -2073,7 +2093,6 @@ CONFIG_NET_VENDOR_STMICRO=y CONFIG_NET_VENDOR_SYNOPSYS=y # CONFIG_DWC_XLGMAC is not set CONFIG_NET_VENDOR_VIA=y -# CONFIG_VIA_RHINE is not set # CONFIG_VIA_VELOCITY is not set CONFIG_NET_VENDOR_WIZNET=y # CONFIG_WIZNET_W5100 is not set @@ -2090,6 +2109,7 @@ CONFIG_MDIO_BUS_MUX=m # CONFIG_MDIO_BUS_MUX_MMIOREG is not set CONFIG_MDIO_BUS_MUX_MULTIPLEXER=m # CONFIG_MDIO_HISI_FEMAC is not set +CONFIG_MDIO_IPQ4019=m CONFIG_MDIO_IPQ8064=m # CONFIG_MDIO_MSCC_MIIM is not set CONFIG_MDIO_MVUSB=m @@ -2107,7 +2127,9 @@ CONFIG_ADIN_PHY=m CONFIG_AX88796B_PHY=m # CONFIG_BCM7XXX_PHY is not set # CONFIG_BCM87XX_PHY is not set +CONFIG_BCM_NET_PHYLIB=m # CONFIG_BROADCOM_PHY is not set +CONFIG_BCM54140_PHY=m # CONFIG_BCM84881_PHY is not set # CONFIG_CICADA_PHY is not set # CONFIG_CORTINA_PHY is not set @@ -2279,6 +2301,8 @@ CONFIG_MT76x0_COMMON=m CONFIG_MT76x0U=m CONFIG_MT76x2_COMMON=m CONFIG_MT76x2U=m +CONFIG_MT7615_COMMON=m +CONFIG_MT7663U=m CONFIG_WLAN_VENDOR_RALINK=y CONFIG_RT2X00=m CONFIG_RT2500USB=m @@ -2323,6 +2347,7 @@ CONFIG_RTL8822BU=m CONFIG_RTL8188EU=m CONFIG_RTL8821CU=m CONFIG_88XXAU=m +CONFIG_RTL8192EU=m CONFIG_RTL8189FS=m CONFIG_RTL8189ES=m CONFIG_WLAN_VENDOR_ZYDAS=y @@ -2490,6 +2515,7 @@ CONFIG_TOUCHSCREEN_ATMEL_MXT=y # CONFIG_TOUCHSCREEN_BU21013 is not set CONFIG_TOUCHSCREEN_BU21029=m # CONFIG_TOUCHSCREEN_CHIPONE_ICN8318 is not set +CONFIG_TOUCHSCREEN_CY8CTMA140=m # CONFIG_TOUCHSCREEN_CY8CTMG110 is not set # CONFIG_TOUCHSCREEN_CYTTSP_CORE is not set # CONFIG_TOUCHSCREEN_CYTTSP4_CORE is not set @@ -2566,11 +2592,9 @@ CONFIG_INPUT_MISC=y # CONFIG_INPUT_ATMEL_CAPTOUCH is not set # CONFIG_INPUT_BMA150 is not set # CONFIG_INPUT_E3X0_BUTTON is not set -CONFIG_INPUT_MSM_VIBRATOR=m # CONFIG_INPUT_MAX77693_HAPTIC is not set # CONFIG_INPUT_MAX8997_HAPTIC is not set # CONFIG_INPUT_MMA8450 is not set -# CONFIG_INPUT_GP2A is not set # CONFIG_INPUT_GPIO_BEEPER is not set # CONFIG_INPUT_GPIO_DECODER is not set CONFIG_INPUT_GPIO_VIBRA=m @@ -2588,6 +2612,7 @@ CONFIG_INPUT_UINPUT=y # CONFIG_INPUT_GPIO_ROTARY_ENCODER is not set # CONFIG_INPUT_ADXL34X is not set # CONFIG_INPUT_IMS_PCU is not set +CONFIG_INPUT_IQS269A=m # CONFIG_INPUT_CMA3000 is not set # CONFIG_INPUT_DRV260X_HAPTICS is not set # CONFIG_INPUT_DRV2665_HAPTICS is not set @@ -2708,6 +2733,7 @@ CONFIG_HW_RANDOM=y # CONFIG_HW_RANDOM_TIMERIOMEM is not set CONFIG_HW_RANDOM_VIRTIO=m CONFIG_HW_RANDOM_EXYNOS=y +CONFIG_HW_RANDOM_CCTRNG=m CONFIG_DEVMEM=y # CONFIG_DEVKMEM is not set # CONFIG_RAW_DRIVER is not set @@ -2826,6 +2852,7 @@ CONFIG_SPI_MXIC=m # CONFIG_SPI_XCOMM is not set # CONFIG_SPI_XILINX is not set # CONFIG_SPI_ZYNQMP_GQSPI is not set +CONFIG_SPI_AMD=m # # SPI Multiplexer support @@ -2850,12 +2877,9 @@ CONFIG_SPI_SPIDEV=m # end of PTP clock support CONFIG_PINCTRL=y -CONFIG_GENERIC_PINCTRL_GROUPS=y CONFIG_PINMUX=y -CONFIG_GENERIC_PINMUX_FUNCTIONS=y CONFIG_PINCONF=y CONFIG_GENERIC_PINCONF=y -# CONFIG_PINCTRL_AMD is not set # CONFIG_PINCTRL_MCP23S08 is not set # CONFIG_PINCTRL_SINGLE is not set # CONFIG_PINCTRL_SX150X is not set @@ -2864,14 +2888,12 @@ CONFIG_PINCTRL_STMFX=m CONFIG_PINCTRL_SAMSUNG=y CONFIG_PINCTRL_EXYNOS=y CONFIG_PINCTRL_EXYNOS_ARM=y -CONFIG_PINCTRL_EQUILIBRIUM=m CONFIG_ARCH_HAVE_CUSTOM_GPIO_H=y CONFIG_GPIOLIB=y CONFIG_GPIOLIB_FASTPATH_LIMIT=512 CONFIG_OF_GPIO=y CONFIG_GPIOLIB_IRQCHIP=y CONFIG_GPIO_SYSFS=y -CONFIG_GPIO_GENERIC=m # # Memory mapped GPIO drivers @@ -2935,6 +2957,7 @@ CONFIG_GPIO_TQMX86=m # # end of USB GPIO expanders +CONFIG_GPIO_AGGREGATOR=m # CONFIG_GPIO_MOCKUP is not set CONFIG_W1=m @@ -2993,6 +3016,7 @@ CONFIG_POWER_SUPPLY_HWMON=y # CONFIG_GENERIC_ADC_BATTERY is not set # CONFIG_TEST_POWER is not set CONFIG_CHARGER_ADP5061=m +CONFIG_BATTERY_CW2015=m # CONFIG_BATTERY_DS2760 is not set # CONFIG_BATTERY_DS2780 is not set # CONFIG_BATTERY_DS2781 is not set @@ -3015,6 +3039,7 @@ CONFIG_CHARGER_LT3651=m # CONFIG_CHARGER_MAX77693 is not set # CONFIG_CHARGER_MAX8997 is not set # CONFIG_CHARGER_MAX8998 is not set +CONFIG_CHARGER_MP2629=m # CONFIG_CHARGER_BQ2415X is not set # CONFIG_CHARGER_BQ24190 is not set # CONFIG_CHARGER_BQ24257 is not set @@ -3027,6 +3052,7 @@ CONFIG_CHARGER_LT3651=m CONFIG_CHARGER_CROS_USBPD=m CONFIG_CHARGER_UCS1002=m CONFIG_CHARGER_BD70528=m +CONFIG_CHARGER_BD99954=m CONFIG_HWMON=y # CONFIG_HWMON_DEBUG_CHIP is not set @@ -3059,6 +3085,7 @@ CONFIG_SENSORS_AXI_FAN_CONTROL=m # CONFIG_SENSORS_F71805F is not set # CONFIG_SENSORS_F71882FG is not set # CONFIG_SENSORS_F75375S is not set +CONFIG_SENSORS_GSC=m # CONFIG_SENSORS_FTSTEUTATES is not set # CONFIG_SENSORS_GL518SM is not set # CONFIG_SENSORS_GL520SM is not set @@ -3187,7 +3214,6 @@ CONFIG_CPU_FREQ_THERMAL=y # CONFIG_DEVFREQ_THERMAL is not set CONFIG_THERMAL_EMULATION=y CONFIG_THERMAL_MMIO=m -# CONFIG_QORIQ_THERMAL is not set # # Samsung thermal drivers @@ -3223,6 +3249,7 @@ CONFIG_HAVE_S3C2410_WATCHDOG=y CONFIG_S3C2410_WATCHDOG=y # CONFIG_DW_WATCHDOG is not set # CONFIG_MAX63XX_WATCHDOG is not set +CONFIG_ARM_SMC_WATCHDOG=m # CONFIG_MEN_A21_WDT is not set # @@ -3260,8 +3287,10 @@ CONFIG_MFD_CROS_EC_DEV=y # CONFIG_MFD_DA9150 is not set # CONFIG_MFD_DLN2 is not set # CONFIG_MFD_EXYNOS_LPASS is not set +CONFIG_MFD_GATEWORKS_GSC=m # CONFIG_MFD_MC13XXX_SPI is not set # CONFIG_MFD_MC13XXX_I2C is not set +CONFIG_MFD_MP2629=m # CONFIG_MFD_HI6421_PMIC is not set # CONFIG_HTC_PASIC3 is not set # CONFIG_HTC_I2CPLD is not set @@ -3280,6 +3309,7 @@ CONFIG_MFD_MAX77693=y # CONFIG_MFD_MAX8925 is not set CONFIG_MFD_MAX8997=y CONFIG_MFD_MAX8998=y +CONFIG_MFD_MT6360=m # CONFIG_MFD_MT6397 is not set # CONFIG_MFD_MENF21BMC is not set # CONFIG_EZX_PCAP is not set @@ -3376,6 +3406,7 @@ CONFIG_REGULATOR_MAX8998=y CONFIG_REGULATOR_MAX77686=y CONFIG_REGULATOR_MAX77693=y CONFIG_REGULATOR_MAX77802=y +CONFIG_REGULATOR_MAX77826=m # CONFIG_REGULATOR_MCP16502 is not set CONFIG_REGULATOR_MP5416=m CONFIG_REGULATOR_MP8859=m @@ -3403,8 +3434,6 @@ CONFIG_REGULATOR_SY8824X=m # CONFIG_REGULATOR_TPS6524X is not set # CONFIG_REGULATOR_VCTRL is not set # CONFIG_REGULATOR_WM8994 is not set -CONFIG_CEC_CORE=y -CONFIG_CEC_NOTIFIER=y CONFIG_RC_CORE=y CONFIG_RC_MAP=y # CONFIG_LIRC is not set @@ -3436,44 +3465,75 @@ CONFIG_IR_GPIO_CIR=y # CONFIG_IR_SERIAL is not set # CONFIG_IR_SIR is not set # CONFIG_RC_XBOX_DVD is not set +CONFIG_CEC_CORE=y +CONFIG_CEC_NOTIFIER=y +# CONFIG_MEDIA_CEC_RC is not set +CONFIG_MEDIA_CEC_SUPPORT=y +CONFIG_CEC_CROS_EC=m +# CONFIG_CEC_GPIO is not set +CONFIG_CEC_SAMSUNG_S5P=m +# CONFIG_USB_PULSE8_CEC is not set +# CONFIG_USB_RAINSHADOW_CEC is not set CONFIG_MEDIA_SUPPORT=y +CONFIG_MEDIA_SUPPORT_FILTER=y +CONFIG_MEDIA_SUBDRV_AUTOSELECT=y # -# Multimedia core support +# Media device types # CONFIG_MEDIA_CAMERA_SUPPORT=y CONFIG_MEDIA_ANALOG_TV_SUPPORT=y CONFIG_MEDIA_DIGITAL_TV_SUPPORT=y CONFIG_MEDIA_RADIO_SUPPORT=y CONFIG_MEDIA_SDR_SUPPORT=y -CONFIG_MEDIA_CEC_SUPPORT=y -# CONFIG_MEDIA_CEC_RC is not set -CONFIG_MEDIA_CONTROLLER=y -CONFIG_MEDIA_CONTROLLER_DVB=y +# CONFIG_MEDIA_PLATFORM_SUPPORT is not set +# CONFIG_MEDIA_TEST_SUPPORT is not set +# end of Media device types + CONFIG_VIDEO_DEV=y -CONFIG_VIDEO_V4L2_SUBDEV_API=y +CONFIG_MEDIA_CONTROLLER=y +CONFIG_DVB_CORE=y + +# +# Video4Linux options +# CONFIG_VIDEO_V4L2=y CONFIG_VIDEO_V4L2_I2C=y +CONFIG_VIDEO_V4L2_SUBDEV_API=y # CONFIG_VIDEO_ADV_DEBUG is not set # CONFIG_VIDEO_FIXED_MINOR_RANGES is not set CONFIG_VIDEO_TUNER=m -CONFIG_V4L2_MEM2MEM_DEV=m # CONFIG_V4L2_FLASH_LED_CLASS is not set CONFIG_V4L2_FWNODE=m CONFIG_VIDEOBUF_GEN=m CONFIG_VIDEOBUF_VMALLOC=m -CONFIG_DVB_CORE=y +# end of Video4Linux options + +# +# Media controller options +# +CONFIG_MEDIA_CONTROLLER_DVB=y +# end of Media controller options + +# +# Digital TV options +# # CONFIG_DVB_MMAP is not set CONFIG_DVB_NET=y -CONFIG_TTPCI_EEPROM=m CONFIG_DVB_MAX_ADAPTERS=8 # CONFIG_DVB_DYNAMIC_MINORS is not set # CONFIG_DVB_DEMUX_SECTION_LOSS_LOG is not set # CONFIG_DVB_ULE_DEBUG is not set +# end of Digital TV options # # Media drivers # + +# +# Drivers filtered as selected at 'Filter media drivers' +# +CONFIG_TTPCI_EEPROM=m CONFIG_MEDIA_USB_SUPPORT=y # @@ -3634,50 +3694,6 @@ CONFIG_VIDEO_EM28XX_RC=m CONFIG_USB_AIRSPY=m CONFIG_USB_HACKRF=m CONFIG_USB_MSI2500=m - -# -# USB HDMI CEC adapters -# -# CONFIG_USB_PULSE8_CEC is not set -# CONFIG_USB_RAINSHADOW_CEC is not set -CONFIG_V4L_PLATFORM_DRIVERS=y -# CONFIG_VIDEO_CADENCE is not set -# CONFIG_VIDEO_ASPEED is not set -# CONFIG_VIDEO_MUX is not set -CONFIG_VIDEO_SAMSUNG_EXYNOS4_IS=m -CONFIG_VIDEO_EXYNOS4_IS_COMMON=m -CONFIG_VIDEO_S5P_FIMC=m -CONFIG_VIDEO_S5P_MIPI_CSIS=m -CONFIG_VIDEO_EXYNOS_FIMC_LITE=m -CONFIG_VIDEO_EXYNOS4_FIMC_IS=m -CONFIG_VIDEO_EXYNOS4_ISP_DMA_CAPTURE=y -# CONFIG_VIDEO_XILINX is not set -CONFIG_V4L_MEM2MEM_DRIVERS=y -# CONFIG_VIDEO_MEM2MEM_DEINTERLACE is not set -# CONFIG_VIDEO_SAMSUNG_S5P_G2D is not set -CONFIG_VIDEO_SAMSUNG_S5P_JPEG=m -CONFIG_VIDEO_SAMSUNG_S5P_MFC=m -CONFIG_VIDEO_SAMSUNG_EXYNOS_GSC=m -# CONFIG_VIDEO_SH_VEU is not set -CONFIG_V4L_TEST_DRIVERS=y -# CONFIG_VIDEO_VIMC is not set -CONFIG_VIDEO_VIVID=m -# CONFIG_VIDEO_VIVID_CEC is not set -CONFIG_VIDEO_VIVID_MAX_DEVS=64 -# CONFIG_VIDEO_VIM2M is not set -# CONFIG_VIDEO_VICODEC is not set -CONFIG_DVB_PLATFORM_DRIVERS=y -# CONFIG_DVB_C8SECTPFE is not set -CONFIG_CEC_PLATFORM_DRIVERS=y -# CONFIG_VIDEO_CROS_EC_CEC is not set -# CONFIG_CEC_GPIO is not set -CONFIG_VIDEO_SAMSUNG_S5P_CEC=m -# CONFIG_SDR_PLATFORM_DRIVERS is not set - -# -# Supported MMC/SDIO adapters -# -# CONFIG_SMS_SDIO_DRV is not set CONFIG_RADIO_ADAPTERS=y # CONFIG_RADIO_SI470X is not set # CONFIG_RADIO_SI4713 is not set @@ -3692,12 +3708,6 @@ CONFIG_RADIO_ADAPTERS=y # CONFIG_RADIO_SAA7706H is not set # CONFIG_RADIO_TEF6862 is not set # CONFIG_RADIO_WL1273 is not set - -# -# Texas Instruments WL128x FM driver (ST based) -# -# end of Texas Instruments WL128x FM driver (ST based) - CONFIG_MEDIA_COMMON_OPTIONS=y # @@ -3709,41 +3719,32 @@ CONFIG_CYPRESS_FIRMWARE=m CONFIG_VIDEOBUF2_CORE=m CONFIG_VIDEOBUF2_V4L2=m CONFIG_VIDEOBUF2_MEMOPS=m -CONFIG_VIDEOBUF2_DMA_CONTIG=m CONFIG_VIDEOBUF2_VMALLOC=m CONFIG_DVB_B2C2_FLEXCOP=m CONFIG_SMS_SIANO_MDTV=m CONFIG_SMS_SIANO_RC=y -CONFIG_VIDEO_V4L2_TPG=m +# end of Media drivers + +CONFIG_MEDIA_HIDE_ANCILLARY_SUBDRV=y # -# Media ancillary drivers (tuners, sensors, i2c, spi, frontends) +# Media ancillary drivers # -CONFIG_MEDIA_SUBDRV_AUTOSELECT=y -CONFIG_MEDIA_HIDE_ANCILLARY_SUBDRV=y CONFIG_MEDIA_ATTACH=y + +# +# IR I2C driver auto-selected by 'Autoselect ancillary drivers' +# CONFIG_VIDEO_IR_I2C=y # -# I2C drivers hidden by 'Autoselect ancillary drivers' -# - -# -# Audio decoders, processors and mixers +# audio, video and radio I2C drivers auto-selected by 'Autoselect ancillary drivers' # CONFIG_VIDEO_MSP3400=m CONFIG_VIDEO_CS53L32A=m CONFIG_VIDEO_UDA1342=m CONFIG_VIDEO_WM8775=m CONFIG_VIDEO_SONY_BTF_MPX=m - -# -# RDS decoders -# - -# -# Video decoders -# CONFIG_VIDEO_SAA711X=m CONFIG_VIDEO_TVP5150=m CONFIG_VIDEO_TW2804=m @@ -3755,43 +3756,82 @@ CONFIG_VIDEO_TW9906=m # CONFIG_VIDEO_CX25840=m -# -# Video encoders -# - # # Camera sensor devices # +CONFIG_VIDEO_APTINA_PLL=m +CONFIG_VIDEO_SMIAPP_PLL=m +CONFIG_VIDEO_HI556=m +CONFIG_VIDEO_IMX214=m +CONFIG_VIDEO_IMX219=m +CONFIG_VIDEO_IMX258=m +CONFIG_VIDEO_IMX274=m +CONFIG_VIDEO_IMX290=m +CONFIG_VIDEO_IMX319=m +CONFIG_VIDEO_IMX355=m CONFIG_VIDEO_OV2640=m +CONFIG_VIDEO_OV2659=m +CONFIG_VIDEO_OV2680=m +CONFIG_VIDEO_OV2685=m +CONFIG_VIDEO_OV2740=m +CONFIG_VIDEO_OV5640=m +CONFIG_VIDEO_OV5645=m +CONFIG_VIDEO_OV5647=m +CONFIG_VIDEO_OV6650=m +CONFIG_VIDEO_OV5670=m +CONFIG_VIDEO_OV5675=m +CONFIG_VIDEO_OV5695=m +CONFIG_VIDEO_OV7251=m +CONFIG_VIDEO_OV772X=m CONFIG_VIDEO_OV7640=m +CONFIG_VIDEO_OV7670=m +CONFIG_VIDEO_OV7740=m +CONFIG_VIDEO_OV8856=m +CONFIG_VIDEO_OV9640=m +CONFIG_VIDEO_OV9650=m +CONFIG_VIDEO_OV13858=m +CONFIG_VIDEO_VS6624=m +CONFIG_VIDEO_MT9M001=m +CONFIG_VIDEO_MT9M032=m +CONFIG_VIDEO_MT9M111=m +CONFIG_VIDEO_MT9P031=m +CONFIG_VIDEO_MT9T001=m +CONFIG_VIDEO_MT9T112=m CONFIG_VIDEO_MT9V011=m +CONFIG_VIDEO_MT9V032=m +CONFIG_VIDEO_MT9V111=m +CONFIG_VIDEO_SR030PC30=m +CONFIG_VIDEO_NOON010PC30=m +CONFIG_VIDEO_M5MOLS=m +CONFIG_VIDEO_RJ54N1=m +CONFIG_VIDEO_S5K6AA=m +CONFIG_VIDEO_S5K6A3=m +CONFIG_VIDEO_S5K4ECGX=m +CONFIG_VIDEO_S5K5BAF=m +CONFIG_VIDEO_SMIAPP=m +CONFIG_VIDEO_ET8EK8=m +CONFIG_VIDEO_S5C73M3=m +# end of Camera sensor devices # # Lens drivers # +CONFIG_VIDEO_AD5820=m +CONFIG_VIDEO_AK7375=m +CONFIG_VIDEO_DW9714=m +CONFIG_VIDEO_DW9807_VCM=m +# end of Lens drivers # # Flash devices # +CONFIG_VIDEO_ADP1653=m +CONFIG_VIDEO_LM3560=m +CONFIG_VIDEO_LM3646=m +# end of Flash devices # -# Video improvement chips -# - -# -# Audio/Video compression chips -# - -# -# SDR tuner chips -# - -# -# Miscellaneous helper chips -# - -# -# SPI drivers hidden by 'Autoselect ancillary drivers' +# SPI I2C drivers auto-selected by 'Autoselect ancillary drivers' # # @@ -3803,7 +3843,7 @@ CONFIG_VIDEO_MT9V011=m CONFIG_MEDIA_TUNER=y # -# Tuner drivers hidden by 'Autoselect ancillary drivers' +# Tuner drivers auto-selected by 'Autoselect ancillary drivers' # CONFIG_MEDIA_TUNER_SIMPLE=y CONFIG_MEDIA_TUNER_TDA18250=m @@ -3840,7 +3880,7 @@ CONFIG_MEDIA_TUNER_R820T=m CONFIG_MEDIA_TUNER_QM1D1C0042=m # -# DVB Frontend drivers hidden by 'Autoselect ancillary drivers' +# DVB Frontend drivers auto-selected by 'Autoselect ancillary drivers' # # @@ -3968,10 +4008,7 @@ CONFIG_DVB_AF9033=m # Common Interface (EN50221) controller drivers # CONFIG_DVB_SP2=m - -# -# Tools to develop new frontends -# +# end of Media ancillary drivers # # Graphics support @@ -4038,6 +4075,7 @@ CONFIG_DRM_EXYNOS_HDMI=y # CONFIG_DRM_EXYNOS_FIMC is not set # CONFIG_DRM_EXYNOS_ROTATOR is not set # CONFIG_DRM_EXYNOS_SCALER is not set +# CONFIG_DRM_EXYNOS_GSC is not set # CONFIG_DRM_UDL is not set # CONFIG_DRM_ARMADA is not set # CONFIG_DRM_RCAR_DW_HDMI is not set @@ -4053,6 +4091,7 @@ CONFIG_DRM_PANEL=y # Display Panels # # CONFIG_DRM_PANEL_ARM_VERSATILE is not set +CONFIG_DRM_PANEL_ASUS_Z00T_TM5P5_NT35596=m CONFIG_DRM_PANEL_BOE_HIMAX8279D=m CONFIG_DRM_PANEL_BOE_TV101WUM_NL6=m # CONFIG_DRM_PANEL_LVDS is not set @@ -4065,6 +4104,7 @@ CONFIG_DRM_PANEL_FEIXIN_K101_IM2BA02=m # CONFIG_DRM_PANEL_INNOLUX_P079ZCA is not set # CONFIG_DRM_PANEL_JDI_LT070ME05000 is not set # CONFIG_DRM_PANEL_KINGDISPLAY_KD097D04 is not set +CONFIG_DRM_PANEL_LEADTEK_LTK050H3146W=m CONFIG_DRM_PANEL_LEADTEK_LTK500HD1829=m CONFIG_DRM_PANEL_SAMSUNG_LD9040=y # CONFIG_DRM_PANEL_LG_LB035Q02 is not set @@ -4099,6 +4139,7 @@ CONFIG_DRM_PANEL_SONY_ACX424AKP=m # CONFIG_DRM_PANEL_TPO_TD043MTEA1 is not set # CONFIG_DRM_PANEL_TPO_TPG110 is not set # CONFIG_DRM_PANEL_TRULY_NT35597_WQXGA is not set +CONFIG_DRM_PANEL_VISIONOX_RM69299=m CONFIG_DRM_PANEL_XINPENG_XPP055C272=m # end of Display Panels @@ -4109,9 +4150,11 @@ CONFIG_DRM_PANEL_BRIDGE=y # Display Interface Bridges # # CONFIG_DRM_CDNS_DSI is not set +CONFIG_DRM_CHRONTEL_CH7033=m CONFIG_DRM_DISPLAY_CONNECTOR=m CONFIG_DRM_LVDS_CODEC=m # CONFIG_DRM_MEGACHIPS_STDPXXXX_GE_B850V3_FW is not set +CONFIG_DRM_NWL_MIPI_DSI=m CONFIG_DRM_NXP_PTN3460=y CONFIG_DRM_PARADE_PS8622=y CONFIG_DRM_PARADE_PS8640=m @@ -4413,6 +4456,7 @@ CONFIG_SND_SOC_MAX98357A=m CONFIG_SND_SOC_MAX9867=m # CONFIG_SND_SOC_MAX98927 is not set CONFIG_SND_SOC_MAX98373=m +CONFIG_SND_SOC_MAX98390=m # CONFIG_SND_SOC_MAX9860 is not set # CONFIG_SND_SOC_MSM8916_WCD_DIGITAL is not set # CONFIG_SND_SOC_PCM1681 is not set @@ -4486,6 +4530,7 @@ CONFIG_SND_SOC_WM8904=m # CONFIG_SND_SOC_WM8978 is not set # CONFIG_SND_SOC_WM8985 is not set CONFIG_SND_SOC_WM8994=m +CONFIG_SND_SOC_ZL38060=m # CONFIG_SND_SOC_ZX_AUD96P22 is not set # CONFIG_SND_SOC_MAX9759 is not set # CONFIG_SND_SOC_MT6351 is not set @@ -4668,6 +4713,7 @@ CONFIG_USB_AUTOSUSPEND_DELAY=2 # CONFIG_USB_C67X00_HCD is not set CONFIG_USB_XHCI_HCD=y # CONFIG_USB_XHCI_DBGCAP is not set +CONFIG_USB_XHCI_PCI_RENESAS=m CONFIG_USB_XHCI_PLATFORM=y CONFIG_USB_EHCI_HCD=y CONFIG_USB_EHCI_ROOT_HUB_TT=y @@ -4974,6 +5020,7 @@ CONFIG_LEDS_CLASS_FLASH=y # CONFIG_LEDS_AAT1290 is not set # CONFIG_LEDS_AN30259A is not set # CONFIG_LEDS_AS3645A is not set +CONFIG_LEDS_AW2013=m # CONFIG_LEDS_BCM6328 is not set # CONFIG_LEDS_BCM6358 is not set # CONFIG_LEDS_CR0014114 is not set @@ -5017,6 +5064,7 @@ CONFIG_LEDS_MAX8997=y # CONFIG_LEDS_USER is not set # CONFIG_LEDS_SPI_BYTE is not set # CONFIG_LEDS_TI_LMU_COMMON is not set +CONFIG_LEDS_SGM3140=m # # LED Triggers @@ -5217,7 +5265,6 @@ CONFIG_VDPA=m CONFIG_VDPA_SIM=m CONFIG_VHOST_IOTLB=m CONFIG_VHOST_RING=m -CONFIG_VHOST_DPN=y CONFIG_VHOST=m CONFIG_VHOST_MENU=y # CONFIG_VHOST_NET is not set @@ -5249,13 +5296,10 @@ CONFIG_CROS_EC_SYSFS=m # CONFIG_CROS_USBPD_LOGGER is not set CONFIG_CROS_USBPD_NOTIFY=m # CONFIG_MELLANOX_PLATFORM is not set +CONFIG_HAVE_CLK=y CONFIG_CLKDEV_LOOKUP=y CONFIG_HAVE_CLK_PREPARE=y CONFIG_COMMON_CLK=y - -# -# Common Clock Framework -# # CONFIG_CLK_HSDK is not set CONFIG_COMMON_CLK_MAX77686=y # CONFIG_COMMON_CLK_MAX9485 is not set @@ -5275,8 +5319,6 @@ CONFIG_COMMON_CLK_BD718XX=m # CONFIG_COMMON_CLK_FIXED_MMIO is not set CONFIG_COMMON_CLK_SAMSUNG=y CONFIG_EXYNOS_AUDSS_CLK_CON=y -# end of Common Clock Framework - # CONFIG_HWSPINLOCK is not set # @@ -5423,7 +5465,9 @@ CONFIG_EXYNOS_SROM=y CONFIG_IIO=y CONFIG_IIO_BUFFER=y CONFIG_IIO_BUFFER_CB=m -# CONFIG_IIO_BUFFER_HW_CONSUMER is not set +CONFIG_IIO_BUFFER_DMA=m +CONFIG_IIO_BUFFER_DMAENGINE=m +CONFIG_IIO_BUFFER_HW_CONSUMER=m CONFIG_IIO_KFIFO_BUF=y CONFIG_IIO_TRIGGERED_BUFFER=y # CONFIG_IIO_CONFIGFS is not set @@ -5491,6 +5535,8 @@ CONFIG_AD7292=m # CONFIG_AD7923 is not set # CONFIG_AD7949 is not set # CONFIG_AD799X is not set +CONFIG_AD9467=m +CONFIG_ADI_AXI_ADC=m # CONFIG_CC10001_ADC is not set # CONFIG_ENVELOPE_DETECTOR is not set CONFIG_EXYNOS_ADC=y @@ -5503,11 +5549,13 @@ CONFIG_LTC2496=m # CONFIG_MAX1027 is not set # CONFIG_MAX11100 is not set # CONFIG_MAX1118 is not set +CONFIG_MAX1241=m # CONFIG_MAX1363 is not set # CONFIG_MAX9611 is not set # CONFIG_MCP320X is not set # CONFIG_MCP3422 is not set # CONFIG_MCP3911 is not set +CONFIG_MP2629_ADC=m # CONFIG_NAU7802 is not set # CONFIG_SD_ADC_MODULATOR is not set # CONFIG_TI_ADC081C is not set @@ -5544,6 +5592,7 @@ CONFIG_HMC425=m # Chemical Sensors # # CONFIG_ATLAS_PH_SENSOR is not set +CONFIG_ATLAS_EZO_SENSOR=m CONFIG_BME680=m CONFIG_BME680_I2C=m CONFIG_BME680_SPI=m @@ -5679,6 +5728,7 @@ CONFIG_HID_SENSOR_HUMIDITY=m # # CONFIG_ADIS16400 is not set # CONFIG_ADIS16460 is not set +CONFIG_ADIS16475=m # CONFIG_ADIS16480 is not set # CONFIG_BMI160_I2C is not set # CONFIG_BMI160_SPI is not set @@ -5691,6 +5741,9 @@ CONFIG_FXOS8700_I2C=m # CONFIG_IIO_ST_LSM6DSX is not set # end of Inertial measurement units +CONFIG_IIO_ADIS_LIB=m +CONFIG_IIO_ADIS_LIB_BUFFER=y + # # Light sensors # @@ -5846,8 +5899,10 @@ CONFIG_ICP10100=m CONFIG_PING=m # CONFIG_RFD77402 is not set # CONFIG_SRF04 is not set +CONFIG_SX9310=m # CONFIG_SX9500 is not set # CONFIG_SRF08 is not set +CONFIG_VCNL3020=m # CONFIG_VL53L0X_I2C is not set # end of Proximity and distance sensors @@ -5878,6 +5933,7 @@ CONFIG_PWM=y CONFIG_PWM_SYSFS=y # CONFIG_PWM_CROS_EC is not set # CONFIG_PWM_FSL_FTM is not set +CONFIG_PWM_IQS620A=m # CONFIG_PWM_PCA9685 is not set CONFIG_PWM_SAMSUNG=y @@ -5899,9 +5955,11 @@ CONFIG_EXYNOS_IRQ_COMBINER=y # PHY Subsystem # CONFIG_GENERIC_PHY=y +CONFIG_GENERIC_PHY_MIPI_DPHY=y # CONFIG_BCM_KONA_USB2_PHY is not set CONFIG_PHY_CADENCE_TORRENT=m # CONFIG_PHY_CADENCE_DPHY is not set +CONFIG_PHY_CADENCE_SALVO=m # CONFIG_PHY_FSL_IMX8MQ_USB is not set # CONFIG_PHY_MIXEL_MIPI_DPHY is not set # CONFIG_PHY_PXA_28NM_HSIC is not set @@ -5918,7 +5976,6 @@ CONFIG_PHY_EXYNOS4X12_USB2=y CONFIG_PHY_EXYNOS5250_USB2=y CONFIG_PHY_EXYNOS5_USBDRD=y CONFIG_PHY_EXYNOS5250_SATA=y -CONFIG_PHY_INTEL_EMMC=m # end of PHY Subsystem # CONFIG_POWERCAP is not set @@ -6149,24 +6206,6 @@ CONFIG_UFS_FS=m CONFIG_UFS_FS_WRITE=y # CONFIG_UFS_DEBUG is not set # CONFIG_EROFS_FS is not set -CONFIG_AUFS_FS=m -CONFIG_AUFS_BRANCH_MAX_127=y -# CONFIG_AUFS_BRANCH_MAX_511 is not set -# CONFIG_AUFS_BRANCH_MAX_1023 is not set -# CONFIG_AUFS_BRANCH_MAX_32767 is not set -CONFIG_AUFS_SBILIST=y -# CONFIG_AUFS_HNOTIFY is not set -# CONFIG_AUFS_EXPORT is not set -# CONFIG_AUFS_XATTR is not set -# CONFIG_AUFS_FHSM is not set -# CONFIG_AUFS_RDU is not set -# CONFIG_AUFS_DIRREN is not set -# CONFIG_AUFS_SHWH is not set -# CONFIG_AUFS_BR_RAMFS is not set -# CONFIG_AUFS_BR_FUSE is not set -CONFIG_AUFS_BR_HFSPLUS=y -CONFIG_AUFS_BDEV_LOOP=y -# CONFIG_AUFS_DEBUG is not set CONFIG_NETWORK_FILESYSTEMS=y CONFIG_NFS_FS=y CONFIG_NFS_V2=y @@ -6284,7 +6323,6 @@ CONFIG_IO_WQ=y CONFIG_KEYS=y # CONFIG_KEYS_REQUEST_CACHE is not set # CONFIG_PERSISTENT_KEYRINGS is not set -# CONFIG_BIG_KEYS is not set # CONFIG_TRUSTED_KEYS is not set CONFIG_ENCRYPTED_KEYS=y # CONFIG_KEY_DH_OPERATIONS is not set @@ -6564,6 +6602,7 @@ CONFIG_BINARY_PRINTF=y # CONFIG_RAID6_PQ=m CONFIG_RAID6_PQ_BENCHMARK=y +CONFIG_LINEAR_RANGES=y # CONFIG_PACKING is not set CONFIG_BITREVERSE=y CONFIG_HAVE_ARCH_BITREVERSE=y @@ -6571,6 +6610,7 @@ CONFIG_GENERIC_STRNCPY_FROM_USER=y CONFIG_GENERIC_STRNLEN_USER=y CONFIG_GENERIC_NET_UTILS=y # CONFIG_CORDIC is not set +CONFIG_PRIME_NUMBERS=m CONFIG_RATIONAL=y CONFIG_GENERIC_PCI_IOMAP=y CONFIG_ARCH_USE_CMPXCHG_LOCKREF=y @@ -6693,6 +6733,7 @@ CONFIG_CONSOLE_LOGLEVEL_DEFAULT=7 CONFIG_CONSOLE_LOGLEVEL_QUIET=4 CONFIG_MESSAGE_LOGLEVEL_DEFAULT=4 # CONFIG_DYNAMIC_DEBUG is not set +# CONFIG_DYNAMIC_DEBUG_CORE is not set CONFIG_SYMBOLIC_ERRNAME=y CONFIG_DEBUG_BUGVERBOSE=y # end of printk and dmesg options @@ -6728,12 +6769,14 @@ CONFIG_HAVE_ARCH_KGDB=y # CONFIG_PAGE_EXTENSION is not set # CONFIG_PAGE_POISONING is not set # CONFIG_DEBUG_RODATA_TEST is not set +# CONFIG_DEBUG_WX is not set # CONFIG_SLUB_DEBUG_ON is not set # CONFIG_SLUB_STATS is not set CONFIG_HAVE_DEBUG_KMEMLEAK=y CONFIG_ARCH_HAS_DEBUG_VIRTUAL=y CONFIG_DEBUG_MEMORY_INIT=y CONFIG_CC_HAS_KASAN_GENERIC=y +CONFIG_CC_HAS_WORKING_NOSANITIZE_ADDRESS=y CONFIG_KASAN_STACK=1 # end of Memory Debugging @@ -6794,7 +6837,6 @@ CONFIG_FTRACE=y # CONFIG_BOOTTIME_TRACING is not set # CONFIG_FUNCTION_TRACER is not set # CONFIG_STACK_TRACER is not set -# CONFIG_PREEMPTIRQ_EVENTS is not set # CONFIG_IRQSOFF_TRACER is not set # CONFIG_PREEMPT_TRACER is not set # CONFIG_SCHED_TRACER is not set @@ -6810,6 +6852,7 @@ CONFIG_UPROBE_EVENTS=y CONFIG_BPF_EVENTS=y CONFIG_DYNAMIC_EVENTS=y CONFIG_PROBE_EVENTS=y +# CONFIG_SYNTH_EVENTS is not set # CONFIG_TRACE_EVENT_INJECT is not set # CONFIG_TRACEPOINT_BENCHMARK is not set # CONFIG_RING_BUFFER_BENCHMARK is not set @@ -6823,7 +6866,6 @@ CONFIG_ARCH_HAS_DEVMEM_IS_ALLOWED=y # # arm Debugging # -# CONFIG_DEBUG_WX is not set # CONFIG_UNWINDER_FRAME_POINTER is not set CONFIG_UNWINDER_ARM=y CONFIG_ARM_UNWIND=y @@ -6863,6 +6905,7 @@ CONFIG_TEST_STRSCPY=m # CONFIG_TEST_HASH is not set # CONFIG_TEST_IDA is not set # CONFIG_TEST_LKM is not set +CONFIG_TEST_BITOPS=m CONFIG_TEST_VMALLOC=m # CONFIG_TEST_USER_COPY is not set # CONFIG_TEST_BPF is not set diff --git a/config/sources/families/odroidxu4.conf b/config/sources/families/odroidxu4.conf index e8fed7c8b..03a334df1 100644 --- a/config/sources/families/odroidxu4.conf +++ b/config/sources/families/odroidxu4.conf @@ -18,15 +18,13 @@ case $BRANCH in current) KERNELSOURCE='https://github.com/hardkernel/linux' - # broken ATM - # KERNELBRANCH='branch:odroid-5.4.y' - KERNELBRANCH='commit:1296fc5b614328055be5a25e3a45139a728fc993' + KERNELBRANCH='branch:odroid-5.4.y' KERNELDIR='linux-odroidxu4' ;; dev) - KERNELBRANCH='branch:linux-5.7.y' + KERNELBRANCH='branch:linux-5.8.y' ;; diff --git a/patch/kernel/odroidxu4-current/0001-Reverting-headers-install-patch.patch b/patch/kernel/odroidxu4-current/0001-Reverting-headers-install-patch.patch new file mode 100644 index 000000000..a96950884 --- /dev/null +++ b/patch/kernel/odroidxu4-current/0001-Reverting-headers-install-patch.patch @@ -0,0 +1,50 @@ +From a31570ad60c63cda38d59849d7b27243268306fd Mon Sep 17 00:00:00 2001 +From: Igor Pecovnik +Date: Mon, 31 Aug 2020 20:26:18 +0200 +Subject: [PATCH] Reverting headers install patch + +Signed-off-by: Igor Pecovnik +--- + scripts/headers_install.sh | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +diff --git a/scripts/headers_install.sh b/scripts/headers_install.sh +index 94a833597..a07668a5c 100755 +--- a/scripts/headers_install.sh ++++ b/scripts/headers_install.sh +@@ -64,7 +64,7 @@ configs=$(sed -e ' + d + ' $OUTFILE) + +-# The entries in the following list do not result in an error. ++# The entries in the following list are not warned. + # Please do not add a new entry. This list is only for existing ones. + # The list will be reduced gradually, and deleted eventually. (hopefully) + # +@@ -98,19 +98,18 @@ include/uapi/linux/raw.h:CONFIG_MAX_RAW_DEVS + + for c in $configs + do +- leak_error=1 ++ warn=1 + + for ignore in $config_leak_ignores + do + if echo "$INFILE:$c" | grep -q "$ignore$"; then +- leak_error= ++ warn= + break + fi + done + +- if [ "$leak_error" = 1 ]; then +- echo "error: $INFILE: leak $c to user-space" >&2 +- exit 1 ++ if [ "$warn" = 1 ]; then ++ echo "warning: $INFILE: leak $c to user-space" >&2 + fi + done + +-- +Created with Armbian build tools https://github.com/armbian/build + diff --git a/patch/kernel/odroidxu4-current/patch-5.4.58-59.patch b/patch/kernel/odroidxu4-current/patch-5.4.58-59.patch new file mode 100644 index 000000000..eabc8b77f --- /dev/null +++ b/patch/kernel/odroidxu4-current/patch-5.4.58-59.patch @@ -0,0 +1,9141 @@ +diff --git a/Documentation/ABI/testing/sysfs-bus-iio b/Documentation/ABI/testing/sysfs-bus-iio +index 680451695422..c3767d4d01a6 100644 +--- a/Documentation/ABI/testing/sysfs-bus-iio ++++ b/Documentation/ABI/testing/sysfs-bus-iio +@@ -1566,7 +1566,8 @@ What: /sys/bus/iio/devices/iio:deviceX/in_concentrationX_voc_raw + KernelVersion: 4.3 + Contact: linux-iio@vger.kernel.org + Description: +- Raw (unscaled no offset etc.) percentage reading of a substance. ++ Raw (unscaled no offset etc.) reading of a substance. Units ++ after application of scale and offset are percents. + + What: /sys/bus/iio/devices/iio:deviceX/in_resistance_raw + What: /sys/bus/iio/devices/iio:deviceX/in_resistanceX_raw +diff --git a/Makefile b/Makefile +index 29948bc4a0d2..cc72b8472f24 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 5 + PATCHLEVEL = 4 +-SUBLEVEL = 58 ++SUBLEVEL = 59 + EXTRAVERSION = + NAME = Kleptomaniac Octopus + +diff --git a/arch/arm/boot/dts/r8a7793-gose.dts b/arch/arm/boot/dts/r8a7793-gose.dts +index 42f3313e6988..9f507393c375 100644 +--- a/arch/arm/boot/dts/r8a7793-gose.dts ++++ b/arch/arm/boot/dts/r8a7793-gose.dts +@@ -339,7 +339,7 @@ + reg = <0x20>; + remote = <&vin1>; + +- port { ++ ports { + #address-cells = <1>; + #size-cells = <0>; + +@@ -399,7 +399,7 @@ + interrupts = <2 IRQ_TYPE_LEVEL_LOW>; + default-input = <0>; + +- port { ++ ports { + #address-cells = <1>; + #size-cells = <0>; + +diff --git a/arch/arm/boot/dts/sunxi-bananapi-m2-plus-v1.2.dtsi b/arch/arm/boot/dts/sunxi-bananapi-m2-plus-v1.2.dtsi +index 22466afd38a3..235994a4a2eb 100644 +--- a/arch/arm/boot/dts/sunxi-bananapi-m2-plus-v1.2.dtsi ++++ b/arch/arm/boot/dts/sunxi-bananapi-m2-plus-v1.2.dtsi +@@ -16,15 +16,27 @@ + regulator-type = "voltage"; + regulator-boot-on; + regulator-always-on; +- regulator-min-microvolt = <1100000>; +- regulator-max-microvolt = <1300000>; ++ regulator-min-microvolt = <1108475>; ++ regulator-max-microvolt = <1308475>; + regulator-ramp-delay = <50>; /* 4ms */ + gpios = <&r_pio 0 1 GPIO_ACTIVE_HIGH>; /* PL1 */ + gpios-states = <0x1>; +- states = <1100000 0>, <1300000 1>; ++ states = <1108475 0>, <1308475 1>; + }; + }; + + &cpu0 { + cpu-supply = <®_vdd_cpux>; + }; ++ ++&cpu1 { ++ cpu-supply = <®_vdd_cpux>; ++}; ++ ++&cpu2 { ++ cpu-supply = <®_vdd_cpux>; ++}; ++ ++&cpu3 { ++ cpu-supply = <®_vdd_cpux>; ++}; +diff --git a/arch/arm/kernel/stacktrace.c b/arch/arm/kernel/stacktrace.c +index 71778bb0475b..a082f6e4f0f4 100644 +--- a/arch/arm/kernel/stacktrace.c ++++ b/arch/arm/kernel/stacktrace.c +@@ -22,6 +22,19 @@ + * A simple function epilogue looks like this: + * ldm sp, {fp, sp, pc} + * ++ * When compiled with clang, pc and sp are not pushed. A simple function ++ * prologue looks like this when built with clang: ++ * ++ * stmdb {..., fp, lr} ++ * add fp, sp, #x ++ * sub sp, sp, #y ++ * ++ * A simple function epilogue looks like this when built with clang: ++ * ++ * sub sp, fp, #x ++ * ldm {..., fp, pc} ++ * ++ * + * Note that with framepointer enabled, even the leaf functions have the same + * prologue and epilogue, therefore we can ignore the LR value in this case. + */ +@@ -34,6 +47,16 @@ int notrace unwind_frame(struct stackframe *frame) + low = frame->sp; + high = ALIGN(low, THREAD_SIZE); + ++#ifdef CONFIG_CC_IS_CLANG ++ /* check current frame pointer is within bounds */ ++ if (fp < low + 4 || fp > high - 4) ++ return -EINVAL; ++ ++ frame->sp = frame->fp; ++ frame->fp = *(unsigned long *)(fp); ++ frame->pc = frame->lr; ++ frame->lr = *(unsigned long *)(fp + 4); ++#else + /* check current frame pointer is within bounds */ + if (fp < low + 12 || fp > high - 4) + return -EINVAL; +@@ -42,6 +65,7 @@ int notrace unwind_frame(struct stackframe *frame) + frame->fp = *(unsigned long *)(fp - 12); + frame->sp = *(unsigned long *)(fp - 8); + frame->pc = *(unsigned long *)(fp - 4); ++#endif + + return 0; + } +diff --git a/arch/arm/mach-at91/pm.c b/arch/arm/mach-at91/pm.c +index 52665f30d236..6bc3000deb86 100644 +--- a/arch/arm/mach-at91/pm.c ++++ b/arch/arm/mach-at91/pm.c +@@ -592,13 +592,13 @@ static void __init at91_pm_sram_init(void) + sram_pool = gen_pool_get(&pdev->dev, NULL); + if (!sram_pool) { + pr_warn("%s: sram pool unavailable!\n", __func__); +- return; ++ goto out_put_device; + } + + sram_base = gen_pool_alloc(sram_pool, at91_pm_suspend_in_sram_sz); + if (!sram_base) { + pr_warn("%s: unable to alloc sram!\n", __func__); +- return; ++ goto out_put_device; + } + + sram_pbase = gen_pool_virt_to_phys(sram_pool, sram_base); +@@ -606,12 +606,17 @@ static void __init at91_pm_sram_init(void) + at91_pm_suspend_in_sram_sz, false); + if (!at91_suspend_sram_fn) { + pr_warn("SRAM: Could not map\n"); +- return; ++ goto out_put_device; + } + + /* Copy the pm suspend handler to SRAM */ + at91_suspend_sram_fn = fncpy(at91_suspend_sram_fn, + &at91_pm_suspend_in_sram, at91_pm_suspend_in_sram_sz); ++ return; ++ ++out_put_device: ++ put_device(&pdev->dev); ++ return; + } + + static bool __init at91_is_pm_mode_active(int pm_mode) +diff --git a/arch/arm/mach-exynos/mcpm-exynos.c b/arch/arm/mach-exynos/mcpm-exynos.c +index 9a681b421ae1..cd861c57d5ad 100644 +--- a/arch/arm/mach-exynos/mcpm-exynos.c ++++ b/arch/arm/mach-exynos/mcpm-exynos.c +@@ -26,6 +26,7 @@ + #define EXYNOS5420_USE_L2_COMMON_UP_STATE BIT(30) + + static void __iomem *ns_sram_base_addr __ro_after_init; ++static bool secure_firmware __ro_after_init; + + /* + * The common v7_exit_coherency_flush API could not be used because of the +@@ -58,15 +59,16 @@ static void __iomem *ns_sram_base_addr __ro_after_init; + static int exynos_cpu_powerup(unsigned int cpu, unsigned int cluster) + { + unsigned int cpunr = cpu + (cluster * EXYNOS5420_CPUS_PER_CLUSTER); ++ bool state; + + pr_debug("%s: cpu %u cluster %u\n", __func__, cpu, cluster); + if (cpu >= EXYNOS5420_CPUS_PER_CLUSTER || + cluster >= EXYNOS5420_NR_CLUSTERS) + return -EINVAL; + +- if (!exynos_cpu_power_state(cpunr)) { +- exynos_cpu_power_up(cpunr); +- ++ state = exynos_cpu_power_state(cpunr); ++ exynos_cpu_power_up(cpunr); ++ if (!state && secure_firmware) { + /* + * This assumes the cluster number of the big cores(Cortex A15) + * is 0 and the Little cores(Cortex A7) is 1. +@@ -258,6 +260,8 @@ static int __init exynos_mcpm_init(void) + return -ENOMEM; + } + ++ secure_firmware = exynos_secure_firmware_available(); ++ + /* + * To increase the stability of KFC reset we need to program + * the PMU SPARE3 register +diff --git a/arch/arm/mach-socfpga/pm.c b/arch/arm/mach-socfpga/pm.c +index 6ed887cf8dc9..365c0428b21b 100644 +--- a/arch/arm/mach-socfpga/pm.c ++++ b/arch/arm/mach-socfpga/pm.c +@@ -49,14 +49,14 @@ static int socfpga_setup_ocram_self_refresh(void) + if (!ocram_pool) { + pr_warn("%s: ocram pool unavailable!\n", __func__); + ret = -ENODEV; +- goto put_node; ++ goto put_device; + } + + ocram_base = gen_pool_alloc(ocram_pool, socfpga_sdram_self_refresh_sz); + if (!ocram_base) { + pr_warn("%s: unable to alloc ocram!\n", __func__); + ret = -ENOMEM; +- goto put_node; ++ goto put_device; + } + + ocram_pbase = gen_pool_virt_to_phys(ocram_pool, ocram_base); +@@ -67,7 +67,7 @@ static int socfpga_setup_ocram_self_refresh(void) + if (!suspend_ocram_base) { + pr_warn("%s: __arm_ioremap_exec failed!\n", __func__); + ret = -ENOMEM; +- goto put_node; ++ goto put_device; + } + + /* Copy the code that puts DDR in self refresh to ocram */ +@@ -81,6 +81,8 @@ static int socfpga_setup_ocram_self_refresh(void) + if (!socfpga_sdram_self_refresh_in_ocram) + ret = -EFAULT; + ++put_device: ++ put_device(&pdev->dev); + put_node: + of_node_put(np); + +diff --git a/arch/arm64/boot/dts/exynos/exynos7-espresso.dts b/arch/arm64/boot/dts/exynos/exynos7-espresso.dts +index 080e0f56e108..61ee7b6a3159 100644 +--- a/arch/arm64/boot/dts/exynos/exynos7-espresso.dts ++++ b/arch/arm64/boot/dts/exynos/exynos7-espresso.dts +@@ -157,6 +157,7 @@ + regulator-min-microvolt = <700000>; + regulator-max-microvolt = <1150000>; + regulator-enable-ramp-delay = <125>; ++ regulator-always-on; + }; + + ldo8_reg: LDO8 { +diff --git a/arch/arm64/boot/dts/hisilicon/hi3660-hikey960.dts b/arch/arm64/boot/dts/hisilicon/hi3660-hikey960.dts +index e035cf195b19..8c4bfbaf3a80 100644 +--- a/arch/arm64/boot/dts/hisilicon/hi3660-hikey960.dts ++++ b/arch/arm64/boot/dts/hisilicon/hi3660-hikey960.dts +@@ -530,6 +530,17 @@ + status = "ok"; + compatible = "adi,adv7533"; + reg = <0x39>; ++ adi,dsi-lanes = <4>; ++ ports { ++ #address-cells = <1>; ++ #size-cells = <0>; ++ port@0 { ++ reg = <0>; ++ }; ++ port@1 { ++ reg = <1>; ++ }; ++ }; + }; + }; + +diff --git a/arch/arm64/boot/dts/hisilicon/hi6220-hikey.dts b/arch/arm64/boot/dts/hisilicon/hi6220-hikey.dts +index c14205cd6bf5..3e47150c05ec 100644 +--- a/arch/arm64/boot/dts/hisilicon/hi6220-hikey.dts ++++ b/arch/arm64/boot/dts/hisilicon/hi6220-hikey.dts +@@ -516,7 +516,7 @@ + reg = <0x39>; + interrupt-parent = <&gpio1>; + interrupts = <1 2>; +- pd-gpio = <&gpio0 4 0>; ++ pd-gpios = <&gpio0 4 0>; + adi,dsi-lanes = <4>; + #sound-dai-cells = <0>; + +diff --git a/arch/arm64/boot/dts/qcom/msm8916-pins.dtsi b/arch/arm64/boot/dts/qcom/msm8916-pins.dtsi +index 242aaea68804..1235830ffd0b 100644 +--- a/arch/arm64/boot/dts/qcom/msm8916-pins.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8916-pins.dtsi +@@ -508,7 +508,7 @@ + pins = "gpio63", "gpio64", "gpio65", "gpio66", + "gpio67", "gpio68"; + drive-strength = <8>; +- bias-pull-none; ++ bias-disable; + }; + }; + cdc_pdm_lines_sus: pdm_lines_off { +@@ -537,7 +537,7 @@ + pins = "gpio113", "gpio114", "gpio115", + "gpio116"; + drive-strength = <8>; +- bias-pull-none; ++ bias-disable; + }; + }; + +@@ -565,7 +565,7 @@ + pinconf { + pins = "gpio110"; + drive-strength = <8>; +- bias-pull-none; ++ bias-disable; + }; + }; + +@@ -591,7 +591,7 @@ + pinconf { + pins = "gpio116"; + drive-strength = <8>; +- bias-pull-none; ++ bias-disable; + }; + }; + ext_mclk_tlmm_lines_sus: mclk_lines_off { +@@ -619,7 +619,7 @@ + pins = "gpio112", "gpio117", "gpio118", + "gpio119"; + drive-strength = <8>; +- bias-pull-none; ++ bias-disable; + }; + }; + ext_sec_tlmm_lines_sus: tlmm_lines_off { +diff --git a/arch/arm64/boot/dts/rockchip/rk3368-lion.dtsi b/arch/arm64/boot/dts/rockchip/rk3368-lion.dtsi +index e17311e09082..216aafd90e7f 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3368-lion.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3368-lion.dtsi +@@ -156,7 +156,7 @@ + pinctrl-0 = <&rgmii_pins>; + snps,reset-active-low; + snps,reset-delays-us = <0 10000 50000>; +- snps,reset-gpio = <&gpio3 RK_PB3 GPIO_ACTIVE_HIGH>; ++ snps,reset-gpio = <&gpio3 RK_PB3 GPIO_ACTIVE_LOW>; + tx_delay = <0x10>; + rx_delay = <0x10>; + status = "okay"; +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi +index 62ea288a1a70..45b86933c6ea 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi +@@ -101,7 +101,7 @@ + + vcc5v0_host: vcc5v0-host-regulator { + compatible = "regulator-fixed"; +- gpio = <&gpio4 RK_PA3 GPIO_ACTIVE_HIGH>; ++ gpio = <&gpio4 RK_PA3 GPIO_ACTIVE_LOW>; + enable-active-low; + pinctrl-names = "default"; + pinctrl-0 = <&vcc5v0_host_en>; +@@ -157,7 +157,7 @@ + phy-mode = "rgmii"; + pinctrl-names = "default"; + pinctrl-0 = <&rgmii_pins>; +- snps,reset-gpio = <&gpio3 RK_PC0 GPIO_ACTIVE_HIGH>; ++ snps,reset-gpio = <&gpio3 RK_PC0 GPIO_ACTIVE_LOW>; + snps,reset-active-low; + snps,reset-delays-us = <0 10000 50000>; + tx_delay = <0x10>; +diff --git a/arch/m68k/mac/iop.c b/arch/m68k/mac/iop.c +index 9bfa17015768..c432bfafe63e 100644 +--- a/arch/m68k/mac/iop.c ++++ b/arch/m68k/mac/iop.c +@@ -183,7 +183,7 @@ static __inline__ void iop_writeb(volatile struct mac_iop *iop, __u16 addr, __u8 + + static __inline__ void iop_stop(volatile struct mac_iop *iop) + { +- iop->status_ctrl &= ~IOP_RUN; ++ iop->status_ctrl = IOP_AUTOINC; + } + + static __inline__ void iop_start(volatile struct mac_iop *iop) +@@ -191,14 +191,9 @@ static __inline__ void iop_start(volatile struct mac_iop *iop) + iop->status_ctrl = IOP_RUN | IOP_AUTOINC; + } + +-static __inline__ void iop_bypass(volatile struct mac_iop *iop) +-{ +- iop->status_ctrl |= IOP_BYPASS; +-} +- + static __inline__ void iop_interrupt(volatile struct mac_iop *iop) + { +- iop->status_ctrl |= IOP_IRQ; ++ iop->status_ctrl = IOP_IRQ | IOP_RUN | IOP_AUTOINC; + } + + static int iop_alive(volatile struct mac_iop *iop) +@@ -244,7 +239,6 @@ void __init iop_preinit(void) + } else { + iop_base[IOP_NUM_SCC] = (struct mac_iop *) SCC_IOP_BASE_QUADRA; + } +- iop_base[IOP_NUM_SCC]->status_ctrl = 0x87; + iop_scc_present = 1; + } else { + iop_base[IOP_NUM_SCC] = NULL; +@@ -256,7 +250,7 @@ void __init iop_preinit(void) + } else { + iop_base[IOP_NUM_ISM] = (struct mac_iop *) ISM_IOP_BASE_QUADRA; + } +- iop_base[IOP_NUM_ISM]->status_ctrl = 0; ++ iop_stop(iop_base[IOP_NUM_ISM]); + iop_ism_present = 1; + } else { + iop_base[IOP_NUM_ISM] = NULL; +@@ -416,7 +410,8 @@ static void iop_handle_send(uint iop_num, uint chan) + msg->status = IOP_MSGSTATUS_UNUSED; + msg = msg->next; + iop_send_queue[iop_num][chan] = msg; +- if (msg) iop_do_send(msg); ++ if (msg && iop_readb(iop, IOP_ADDR_SEND_STATE + chan) == IOP_MSG_IDLE) ++ iop_do_send(msg); + } + + /* +@@ -490,16 +485,12 @@ int iop_send_message(uint iop_num, uint chan, void *privdata, + + if (!(q = iop_send_queue[iop_num][chan])) { + iop_send_queue[iop_num][chan] = msg; ++ iop_do_send(msg); + } else { + while (q->next) q = q->next; + q->next = msg; + } + +- if (iop_readb(iop_base[iop_num], +- IOP_ADDR_SEND_STATE + chan) == IOP_MSG_IDLE) { +- iop_do_send(msg); +- } +- + return 0; + } + +diff --git a/arch/mips/cavium-octeon/octeon-usb.c b/arch/mips/cavium-octeon/octeon-usb.c +index cc88a08bc1f7..4017398519cf 100644 +--- a/arch/mips/cavium-octeon/octeon-usb.c ++++ b/arch/mips/cavium-octeon/octeon-usb.c +@@ -518,6 +518,7 @@ static int __init dwc3_octeon_device_init(void) + + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); + if (res == NULL) { ++ put_device(&pdev->dev); + dev_err(&pdev->dev, "No memory resources\n"); + return -ENXIO; + } +@@ -529,8 +530,10 @@ static int __init dwc3_octeon_device_init(void) + * know the difference. + */ + base = devm_ioremap_resource(&pdev->dev, res); +- if (IS_ERR(base)) ++ if (IS_ERR(base)) { ++ put_device(&pdev->dev); + return PTR_ERR(base); ++ } + + mutex_lock(&dwc3_octeon_clocks_mutex); + dwc3_octeon_clocks_start(&pdev->dev, (u64)base); +diff --git a/arch/mips/pci/pci-xtalk-bridge.c b/arch/mips/pci/pci-xtalk-bridge.c +index 6ce76b18186e..c4b1c6cf2660 100644 +--- a/arch/mips/pci/pci-xtalk-bridge.c ++++ b/arch/mips/pci/pci-xtalk-bridge.c +@@ -539,6 +539,7 @@ err_free_resource: + pci_free_resource_list(&host->windows); + err_remove_domain: + irq_domain_remove(domain); ++ irq_domain_free_fwnode(fn); + return err; + } + +@@ -546,8 +547,10 @@ static int bridge_remove(struct platform_device *pdev) + { + struct pci_bus *bus = platform_get_drvdata(pdev); + struct bridge_controller *bc = BRIDGE_CONTROLLER(bus); ++ struct fwnode_handle *fn = bc->domain->fwnode; + + irq_domain_remove(bc->domain); ++ irq_domain_free_fwnode(fn); + pci_lock_rescan_remove(); + pci_stop_root_bus(bus); + pci_remove_root_bus(bus); +diff --git a/arch/parisc/include/asm/barrier.h b/arch/parisc/include/asm/barrier.h +index dbaaca84f27f..640d46edf32e 100644 +--- a/arch/parisc/include/asm/barrier.h ++++ b/arch/parisc/include/asm/barrier.h +@@ -26,6 +26,67 @@ + #define __smp_rmb() mb() + #define __smp_wmb() mb() + ++#define __smp_store_release(p, v) \ ++do { \ ++ typeof(p) __p = (p); \ ++ union { typeof(*p) __val; char __c[1]; } __u = \ ++ { .__val = (__force typeof(*p)) (v) }; \ ++ compiletime_assert_atomic_type(*p); \ ++ switch (sizeof(*p)) { \ ++ case 1: \ ++ asm volatile("stb,ma %0,0(%1)" \ ++ : : "r"(*(__u8 *)__u.__c), "r"(__p) \ ++ : "memory"); \ ++ break; \ ++ case 2: \ ++ asm volatile("sth,ma %0,0(%1)" \ ++ : : "r"(*(__u16 *)__u.__c), "r"(__p) \ ++ : "memory"); \ ++ break; \ ++ case 4: \ ++ asm volatile("stw,ma %0,0(%1)" \ ++ : : "r"(*(__u32 *)__u.__c), "r"(__p) \ ++ : "memory"); \ ++ break; \ ++ case 8: \ ++ if (IS_ENABLED(CONFIG_64BIT)) \ ++ asm volatile("std,ma %0,0(%1)" \ ++ : : "r"(*(__u64 *)__u.__c), "r"(__p) \ ++ : "memory"); \ ++ break; \ ++ } \ ++} while (0) ++ ++#define __smp_load_acquire(p) \ ++({ \ ++ union { typeof(*p) __val; char __c[1]; } __u; \ ++ typeof(p) __p = (p); \ ++ compiletime_assert_atomic_type(*p); \ ++ switch (sizeof(*p)) { \ ++ case 1: \ ++ asm volatile("ldb,ma 0(%1),%0" \ ++ : "=r"(*(__u8 *)__u.__c) : "r"(__p) \ ++ : "memory"); \ ++ break; \ ++ case 2: \ ++ asm volatile("ldh,ma 0(%1),%0" \ ++ : "=r"(*(__u16 *)__u.__c) : "r"(__p) \ ++ : "memory"); \ ++ break; \ ++ case 4: \ ++ asm volatile("ldw,ma 0(%1),%0" \ ++ : "=r"(*(__u32 *)__u.__c) : "r"(__p) \ ++ : "memory"); \ ++ break; \ ++ case 8: \ ++ if (IS_ENABLED(CONFIG_64BIT)) \ ++ asm volatile("ldd,ma 0(%1),%0" \ ++ : "=r"(*(__u64 *)__u.__c) : "r"(__p) \ ++ : "memory"); \ ++ break; \ ++ } \ ++ __u.__val; \ ++}) + #include + + #endif /* !__ASSEMBLY__ */ +diff --git a/arch/parisc/include/asm/spinlock.h b/arch/parisc/include/asm/spinlock.h +index 197d2247e4db..16aec9ba2580 100644 +--- a/arch/parisc/include/asm/spinlock.h ++++ b/arch/parisc/include/asm/spinlock.h +@@ -37,12 +37,8 @@ static inline void arch_spin_unlock(arch_spinlock_t *x) + volatile unsigned int *a; + + a = __ldcw_align(x); +-#ifdef CONFIG_SMP +- (void) __ldcw(a); +-#else +- mb(); +-#endif +- *a = 1; ++ /* Release with ordered store. */ ++ __asm__ __volatile__("stw,ma %0,0(%1)" : : "r"(1), "r"(a) : "memory"); + } + + static inline int arch_spin_trylock(arch_spinlock_t *x) +diff --git a/arch/parisc/kernel/entry.S b/arch/parisc/kernel/entry.S +index b96d74496977..873bf3434da9 100644 +--- a/arch/parisc/kernel/entry.S ++++ b/arch/parisc/kernel/entry.S +@@ -454,7 +454,6 @@ + nop + LDREG 0(\ptp),\pte + bb,<,n \pte,_PAGE_PRESENT_BIT,3f +- LDCW 0(\tmp),\tmp1 + b \fault + stw \spc,0(\tmp) + 99: ALTERNATIVE(98b, 99b, ALT_COND_NO_SMP, INSN_NOP) +@@ -464,23 +463,26 @@ + 3: + .endm + +- /* Release pa_tlb_lock lock without reloading lock address. */ +- .macro tlb_unlock0 spc,tmp,tmp1 ++ /* Release pa_tlb_lock lock without reloading lock address. ++ Note that the values in the register spc are limited to ++ NR_SPACE_IDS (262144). Thus, the stw instruction always ++ stores a nonzero value even when register spc is 64 bits. ++ We use an ordered store to ensure all prior accesses are ++ performed prior to releasing the lock. */ ++ .macro tlb_unlock0 spc,tmp + #ifdef CONFIG_SMP + 98: or,COND(=) %r0,\spc,%r0 +- LDCW 0(\tmp),\tmp1 +- or,COND(=) %r0,\spc,%r0 +- stw \spc,0(\tmp) ++ stw,ma \spc,0(\tmp) + 99: ALTERNATIVE(98b, 99b, ALT_COND_NO_SMP, INSN_NOP) + #endif + .endm + + /* Release pa_tlb_lock lock. */ +- .macro tlb_unlock1 spc,tmp,tmp1 ++ .macro tlb_unlock1 spc,tmp + #ifdef CONFIG_SMP + 98: load_pa_tlb_lock \tmp + 99: ALTERNATIVE(98b, 99b, ALT_COND_NO_SMP, INSN_NOP) +- tlb_unlock0 \spc,\tmp,\tmp1 ++ tlb_unlock0 \spc,\tmp + #endif + .endm + +@@ -1163,7 +1165,7 @@ dtlb_miss_20w: + + idtlbt pte,prot + +- tlb_unlock1 spc,t0,t1 ++ tlb_unlock1 spc,t0 + rfir + nop + +@@ -1189,7 +1191,7 @@ nadtlb_miss_20w: + + idtlbt pte,prot + +- tlb_unlock1 spc,t0,t1 ++ tlb_unlock1 spc,t0 + rfir + nop + +@@ -1223,7 +1225,7 @@ dtlb_miss_11: + + mtsp t1, %sr1 /* Restore sr1 */ + +- tlb_unlock1 spc,t0,t1 ++ tlb_unlock1 spc,t0 + rfir + nop + +@@ -1256,7 +1258,7 @@ nadtlb_miss_11: + + mtsp t1, %sr1 /* Restore sr1 */ + +- tlb_unlock1 spc,t0,t1 ++ tlb_unlock1 spc,t0 + rfir + nop + +@@ -1285,7 +1287,7 @@ dtlb_miss_20: + + idtlbt pte,prot + +- tlb_unlock1 spc,t0,t1 ++ tlb_unlock1 spc,t0 + rfir + nop + +@@ -1313,7 +1315,7 @@ nadtlb_miss_20: + + idtlbt pte,prot + +- tlb_unlock1 spc,t0,t1 ++ tlb_unlock1 spc,t0 + rfir + nop + +@@ -1420,7 +1422,7 @@ itlb_miss_20w: + + iitlbt pte,prot + +- tlb_unlock1 spc,t0,t1 ++ tlb_unlock1 spc,t0 + rfir + nop + +@@ -1444,7 +1446,7 @@ naitlb_miss_20w: + + iitlbt pte,prot + +- tlb_unlock1 spc,t0,t1 ++ tlb_unlock1 spc,t0 + rfir + nop + +@@ -1478,7 +1480,7 @@ itlb_miss_11: + + mtsp t1, %sr1 /* Restore sr1 */ + +- tlb_unlock1 spc,t0,t1 ++ tlb_unlock1 spc,t0 + rfir + nop + +@@ -1502,7 +1504,7 @@ naitlb_miss_11: + + mtsp t1, %sr1 /* Restore sr1 */ + +- tlb_unlock1 spc,t0,t1 ++ tlb_unlock1 spc,t0 + rfir + nop + +@@ -1532,7 +1534,7 @@ itlb_miss_20: + + iitlbt pte,prot + +- tlb_unlock1 spc,t0,t1 ++ tlb_unlock1 spc,t0 + rfir + nop + +@@ -1552,7 +1554,7 @@ naitlb_miss_20: + + iitlbt pte,prot + +- tlb_unlock1 spc,t0,t1 ++ tlb_unlock1 spc,t0 + rfir + nop + +@@ -1582,7 +1584,7 @@ dbit_trap_20w: + + idtlbt pte,prot + +- tlb_unlock0 spc,t0,t1 ++ tlb_unlock0 spc,t0 + rfir + nop + #else +@@ -1608,7 +1610,7 @@ dbit_trap_11: + + mtsp t1, %sr1 /* Restore sr1 */ + +- tlb_unlock0 spc,t0,t1 ++ tlb_unlock0 spc,t0 + rfir + nop + +@@ -1628,7 +1630,7 @@ dbit_trap_20: + + idtlbt pte,prot + +- tlb_unlock0 spc,t0,t1 ++ tlb_unlock0 spc,t0 + rfir + nop + #endif +diff --git a/arch/parisc/kernel/syscall.S b/arch/parisc/kernel/syscall.S +index 97ac707c6bff..a37814cb66c7 100644 +--- a/arch/parisc/kernel/syscall.S ++++ b/arch/parisc/kernel/syscall.S +@@ -640,11 +640,7 @@ cas_action: + sub,<> %r28, %r25, %r0 + 2: stw %r24, 0(%r26) + /* Free lock */ +-#ifdef CONFIG_SMP +-98: LDCW 0(%sr2,%r20), %r1 /* Barrier */ +-99: ALTERNATIVE(98b, 99b, ALT_COND_NO_SMP, INSN_NOP) +-#endif +- stw %r20, 0(%sr2,%r20) ++ stw,ma %r20, 0(%sr2,%r20) + #if ENABLE_LWS_DEBUG + /* Clear thread register indicator */ + stw %r0, 4(%sr2,%r20) +@@ -658,11 +654,7 @@ cas_action: + 3: + /* Error occurred on load or store */ + /* Free lock */ +-#ifdef CONFIG_SMP +-98: LDCW 0(%sr2,%r20), %r1 /* Barrier */ +-99: ALTERNATIVE(98b, 99b, ALT_COND_NO_SMP, INSN_NOP) +-#endif +- stw %r20, 0(%sr2,%r20) ++ stw,ma %r20, 0(%sr2,%r20) + #if ENABLE_LWS_DEBUG + stw %r0, 4(%sr2,%r20) + #endif +@@ -863,11 +855,7 @@ cas2_action: + + cas2_end: + /* Free lock */ +-#ifdef CONFIG_SMP +-98: LDCW 0(%sr2,%r20), %r1 /* Barrier */ +-99: ALTERNATIVE(98b, 99b, ALT_COND_NO_SMP, INSN_NOP) +-#endif +- stw %r20, 0(%sr2,%r20) ++ stw,ma %r20, 0(%sr2,%r20) + /* Enable interrupts */ + ssm PSW_SM_I, %r0 + /* Return to userspace, set no error */ +@@ -877,11 +865,7 @@ cas2_end: + 22: + /* Error occurred on load or store */ + /* Free lock */ +-#ifdef CONFIG_SMP +-98: LDCW 0(%sr2,%r20), %r1 /* Barrier */ +-99: ALTERNATIVE(98b, 99b, ALT_COND_NO_SMP, INSN_NOP) +-#endif +- stw %r20, 0(%sr2,%r20) ++ stw,ma %r20, 0(%sr2,%r20) + ssm PSW_SM_I, %r0 + ldo 1(%r0),%r28 + b lws_exit +diff --git a/arch/powerpc/boot/Makefile b/arch/powerpc/boot/Makefile +index dfbd7f22eef5..8c69bd07ada6 100644 +--- a/arch/powerpc/boot/Makefile ++++ b/arch/powerpc/boot/Makefile +@@ -119,7 +119,7 @@ src-wlib-y := string.S crt0.S stdio.c decompress.c main.c \ + elf_util.c $(zlib-y) devtree.c stdlib.c \ + oflib.c ofconsole.c cuboot.c + +-src-wlib-$(CONFIG_PPC_MPC52XX) += mpc52xx-psc.c ++src-wlib-$(CONFIG_PPC_MPC52xx) += mpc52xx-psc.c + src-wlib-$(CONFIG_PPC64_BOOT_WRAPPER) += opal-calls.S opal.c + ifndef CONFIG_PPC64_BOOT_WRAPPER + src-wlib-y += crtsavres.S +diff --git a/arch/powerpc/boot/serial.c b/arch/powerpc/boot/serial.c +index 9457863147f9..00179cd6bdd0 100644 +--- a/arch/powerpc/boot/serial.c ++++ b/arch/powerpc/boot/serial.c +@@ -128,7 +128,7 @@ int serial_console_init(void) + dt_is_compatible(devp, "fsl,cpm2-smc-uart")) + rc = cpm_console_init(devp, &serial_cd); + #endif +-#ifdef CONFIG_PPC_MPC52XX ++#ifdef CONFIG_PPC_MPC52xx + else if (dt_is_compatible(devp, "fsl,mpc5200-psc-uart")) + rc = mpc5200_psc_console_init(devp, &serial_cd); + #endif +diff --git a/arch/powerpc/include/asm/perf_event.h b/arch/powerpc/include/asm/perf_event.h +index 7426d7a90e1e..7aba3c7ea25c 100644 +--- a/arch/powerpc/include/asm/perf_event.h ++++ b/arch/powerpc/include/asm/perf_event.h +@@ -12,6 +12,8 @@ + + #ifdef CONFIG_PPC_PERF_CTRS + #include ++#else ++static inline bool is_sier_available(void) { return false; } + #endif + + #ifdef CONFIG_FSL_EMB_PERF_EVENT +diff --git a/arch/powerpc/include/asm/ptrace.h b/arch/powerpc/include/asm/ptrace.h +index ee3ada66deb5..c41220f4aad9 100644 +--- a/arch/powerpc/include/asm/ptrace.h ++++ b/arch/powerpc/include/asm/ptrace.h +@@ -203,7 +203,7 @@ do { \ + #endif /* __powerpc64__ */ + + #define arch_has_single_step() (1) +-#ifndef CONFIG_BOOK3S_601 ++#ifndef CONFIG_PPC_BOOK3S_601 + #define arch_has_block_step() (true) + #else + #define arch_has_block_step() (false) +diff --git a/arch/powerpc/include/asm/rtas.h b/arch/powerpc/include/asm/rtas.h +index 3c1887351c71..bd227e0eab07 100644 +--- a/arch/powerpc/include/asm/rtas.h ++++ b/arch/powerpc/include/asm/rtas.h +@@ -368,8 +368,6 @@ extern int rtas_set_indicator_fast(int indicator, int index, int new_value); + extern void rtas_progress(char *s, unsigned short hex); + extern int rtas_suspend_cpu(struct rtas_suspend_me_data *data); + extern int rtas_suspend_last_cpu(struct rtas_suspend_me_data *data); +-extern int rtas_online_cpus_mask(cpumask_var_t cpus); +-extern int rtas_offline_cpus_mask(cpumask_var_t cpus); + extern int rtas_ibm_suspend_me(u64 handle); + + struct rtc_time; +diff --git a/arch/powerpc/include/asm/timex.h b/arch/powerpc/include/asm/timex.h +index d2d2c4bd8435..6047402b0a4d 100644 +--- a/arch/powerpc/include/asm/timex.h ++++ b/arch/powerpc/include/asm/timex.h +@@ -17,7 +17,7 @@ typedef unsigned long cycles_t; + + static inline cycles_t get_cycles(void) + { +- if (IS_ENABLED(CONFIG_BOOK3S_601)) ++ if (IS_ENABLED(CONFIG_PPC_BOOK3S_601)) + return 0; + + return mftb(); +diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c +index c5fa251b8950..01210593d60c 100644 +--- a/arch/powerpc/kernel/rtas.c ++++ b/arch/powerpc/kernel/rtas.c +@@ -842,96 +842,6 @@ static void rtas_percpu_suspend_me(void *info) + __rtas_suspend_cpu((struct rtas_suspend_me_data *)info, 1); + } + +-enum rtas_cpu_state { +- DOWN, +- UP, +-}; +- +-#ifndef CONFIG_SMP +-static int rtas_cpu_state_change_mask(enum rtas_cpu_state state, +- cpumask_var_t cpus) +-{ +- if (!cpumask_empty(cpus)) { +- cpumask_clear(cpus); +- return -EINVAL; +- } else +- return 0; +-} +-#else +-/* On return cpumask will be altered to indicate CPUs changed. +- * CPUs with states changed will be set in the mask, +- * CPUs with status unchanged will be unset in the mask. */ +-static int rtas_cpu_state_change_mask(enum rtas_cpu_state state, +- cpumask_var_t cpus) +-{ +- int cpu; +- int cpuret = 0; +- int ret = 0; +- +- if (cpumask_empty(cpus)) +- return 0; +- +- for_each_cpu(cpu, cpus) { +- struct device *dev = get_cpu_device(cpu); +- +- switch (state) { +- case DOWN: +- cpuret = device_offline(dev); +- break; +- case UP: +- cpuret = device_online(dev); +- break; +- } +- if (cpuret < 0) { +- pr_debug("%s: cpu_%s for cpu#%d returned %d.\n", +- __func__, +- ((state == UP) ? "up" : "down"), +- cpu, cpuret); +- if (!ret) +- ret = cpuret; +- if (state == UP) { +- /* clear bits for unchanged cpus, return */ +- cpumask_shift_right(cpus, cpus, cpu); +- cpumask_shift_left(cpus, cpus, cpu); +- break; +- } else { +- /* clear bit for unchanged cpu, continue */ +- cpumask_clear_cpu(cpu, cpus); +- } +- } +- cond_resched(); +- } +- +- return ret; +-} +-#endif +- +-int rtas_online_cpus_mask(cpumask_var_t cpus) +-{ +- int ret; +- +- ret = rtas_cpu_state_change_mask(UP, cpus); +- +- if (ret) { +- cpumask_var_t tmp_mask; +- +- if (!alloc_cpumask_var(&tmp_mask, GFP_KERNEL)) +- return ret; +- +- /* Use tmp_mask to preserve cpus mask from first failure */ +- cpumask_copy(tmp_mask, cpus); +- rtas_offline_cpus_mask(tmp_mask); +- free_cpumask_var(tmp_mask); +- } +- +- return ret; +-} +- +-int rtas_offline_cpus_mask(cpumask_var_t cpus) +-{ +- return rtas_cpu_state_change_mask(DOWN, cpus); +-} +- + int rtas_ibm_suspend_me(u64 handle) + { + long state; +@@ -939,8 +849,6 @@ int rtas_ibm_suspend_me(u64 handle) + unsigned long retbuf[PLPAR_HCALL_BUFSIZE]; + struct rtas_suspend_me_data data; + DECLARE_COMPLETION_ONSTACK(done); +- cpumask_var_t offline_mask; +- int cpuret; + + if (!rtas_service_present("ibm,suspend-me")) + return -ENOSYS; +@@ -961,9 +869,6 @@ int rtas_ibm_suspend_me(u64 handle) + return -EIO; + } + +- if (!alloc_cpumask_var(&offline_mask, GFP_KERNEL)) +- return -ENOMEM; +- + atomic_set(&data.working, 0); + atomic_set(&data.done, 0); + atomic_set(&data.error, 0); +@@ -972,24 +877,8 @@ int rtas_ibm_suspend_me(u64 handle) + + lock_device_hotplug(); + +- /* All present CPUs must be online */ +- cpumask_andnot(offline_mask, cpu_present_mask, cpu_online_mask); +- cpuret = rtas_online_cpus_mask(offline_mask); +- if (cpuret) { +- pr_err("%s: Could not bring present CPUs online.\n", __func__); +- atomic_set(&data.error, cpuret); +- goto out; +- } +- + cpu_hotplug_disable(); + +- /* Check if we raced with a CPU-Offline Operation */ +- if (!cpumask_equal(cpu_present_mask, cpu_online_mask)) { +- pr_info("%s: Raced against a concurrent CPU-Offline\n", __func__); +- atomic_set(&data.error, -EAGAIN); +- goto out_hotplug_enable; +- } +- + /* Call function on all CPUs. One of us will make the + * rtas call + */ +@@ -1000,18 +889,11 @@ int rtas_ibm_suspend_me(u64 handle) + if (atomic_read(&data.error) != 0) + printk(KERN_ERR "Error doing global join\n"); + +-out_hotplug_enable: +- cpu_hotplug_enable(); + +- /* Take down CPUs not online prior to suspend */ +- cpuret = rtas_offline_cpus_mask(offline_mask); +- if (cpuret) +- pr_warn("%s: Could not restore CPUs to offline state.\n", +- __func__); ++ cpu_hotplug_enable(); + +-out: + unlock_device_hotplug(); +- free_cpumask_var(offline_mask); ++ + return atomic_read(&data.error); + } + #else /* CONFIG_PPC_PSERIES */ +diff --git a/arch/powerpc/kernel/vdso.c b/arch/powerpc/kernel/vdso.c +index eae9ddaecbcf..efb1ba40274a 100644 +--- a/arch/powerpc/kernel/vdso.c ++++ b/arch/powerpc/kernel/vdso.c +@@ -682,7 +682,7 @@ int vdso_getcpu_init(void) + node = cpu_to_node(cpu); + WARN_ON_ONCE(node > 0xffff); + +- val = (cpu & 0xfff) | ((node & 0xffff) << 16); ++ val = (cpu & 0xffff) | ((node & 0xffff) << 16); + mtspr(SPRN_SPRG_VDSO_WRITE, val); + get_paca()->sprg_vdso = val; + +diff --git a/arch/powerpc/mm/book3s64/pkeys.c b/arch/powerpc/mm/book3s64/pkeys.c +index 66f307e873dc..432fd9fa8c3f 100644 +--- a/arch/powerpc/mm/book3s64/pkeys.c ++++ b/arch/powerpc/mm/book3s64/pkeys.c +@@ -83,13 +83,17 @@ static int pkey_initialize(void) + scan_pkey_feature(); + + /* +- * Let's assume 32 pkeys on P8 bare metal, if its not defined by device +- * tree. We make this exception since skiboot forgot to expose this +- * property on power8. ++ * Let's assume 32 pkeys on P8/P9 bare metal, if its not defined by device ++ * tree. We make this exception since some version of skiboot forgot to ++ * expose this property on power8/9. + */ +- if (!pkeys_devtree_defined && !firmware_has_feature(FW_FEATURE_LPAR) && +- cpu_has_feature(CPU_FTRS_POWER8)) +- pkeys_total = 32; ++ if (!pkeys_devtree_defined && !firmware_has_feature(FW_FEATURE_LPAR)) { ++ unsigned long pvr = mfspr(SPRN_PVR); ++ ++ if (PVR_VER(pvr) == PVR_POWER8 || PVR_VER(pvr) == PVR_POWER8E || ++ PVR_VER(pvr) == PVR_POWER8NVL || PVR_VER(pvr) == PVR_POWER9) ++ pkeys_total = 32; ++ } + + /* + * Adjust the upper limit, based on the number of bits supported by +diff --git a/arch/powerpc/platforms/pseries/suspend.c b/arch/powerpc/platforms/pseries/suspend.c +index 0a24a5a185f0..f789693f61f4 100644 +--- a/arch/powerpc/platforms/pseries/suspend.c ++++ b/arch/powerpc/platforms/pseries/suspend.c +@@ -132,15 +132,11 @@ static ssize_t store_hibernate(struct device *dev, + struct device_attribute *attr, + const char *buf, size_t count) + { +- cpumask_var_t offline_mask; + int rc; + + if (!capable(CAP_SYS_ADMIN)) + return -EPERM; + +- if (!alloc_cpumask_var(&offline_mask, GFP_KERNEL)) +- return -ENOMEM; +- + stream_id = simple_strtoul(buf, NULL, 16); + + do { +@@ -150,32 +146,16 @@ static ssize_t store_hibernate(struct device *dev, + } while (rc == -EAGAIN); + + if (!rc) { +- /* All present CPUs must be online */ +- cpumask_andnot(offline_mask, cpu_present_mask, +- cpu_online_mask); +- rc = rtas_online_cpus_mask(offline_mask); +- if (rc) { +- pr_err("%s: Could not bring present CPUs online.\n", +- __func__); +- goto out; +- } +- + stop_topology_update(); + rc = pm_suspend(PM_SUSPEND_MEM); + start_topology_update(); +- +- /* Take down CPUs not online prior to suspend */ +- if (!rtas_offline_cpus_mask(offline_mask)) +- pr_warn("%s: Could not restore CPUs to offline " +- "state.\n", __func__); + } + + stream_id = 0; + + if (!rc) + rc = count; +-out: +- free_cpumask_var(offline_mask); ++ + return rc; + } + +diff --git a/arch/s390/mm/gmap.c b/arch/s390/mm/gmap.c +index 364e3a89c096..4fa7a562c6fc 100644 +--- a/arch/s390/mm/gmap.c ++++ b/arch/s390/mm/gmap.c +@@ -2485,23 +2485,36 @@ void gmap_sync_dirty_log_pmd(struct gmap *gmap, unsigned long bitmap[4], + } + EXPORT_SYMBOL_GPL(gmap_sync_dirty_log_pmd); + ++#ifdef CONFIG_TRANSPARENT_HUGEPAGE ++static int thp_split_walk_pmd_entry(pmd_t *pmd, unsigned long addr, ++ unsigned long end, struct mm_walk *walk) ++{ ++ struct vm_area_struct *vma = walk->vma; ++ ++ split_huge_pmd(vma, pmd, addr); ++ return 0; ++} ++ ++static const struct mm_walk_ops thp_split_walk_ops = { ++ .pmd_entry = thp_split_walk_pmd_entry, ++}; ++ + static inline void thp_split_mm(struct mm_struct *mm) + { +-#ifdef CONFIG_TRANSPARENT_HUGEPAGE + struct vm_area_struct *vma; +- unsigned long addr; + + for (vma = mm->mmap; vma != NULL; vma = vma->vm_next) { +- for (addr = vma->vm_start; +- addr < vma->vm_end; +- addr += PAGE_SIZE) +- follow_page(vma, addr, FOLL_SPLIT); + vma->vm_flags &= ~VM_HUGEPAGE; + vma->vm_flags |= VM_NOHUGEPAGE; ++ walk_page_vma(vma, &thp_split_walk_ops, NULL); + } + mm->def_flags |= VM_NOHUGEPAGE; +-#endif + } ++#else ++static inline void thp_split_mm(struct mm_struct *mm) ++{ ++} ++#endif /* CONFIG_TRANSPARENT_HUGEPAGE */ + + /* + * Remove all empty zero pages from the mapping for lazy refaulting +diff --git a/arch/x86/crypto/aes_ctrby8_avx-x86_64.S b/arch/x86/crypto/aes_ctrby8_avx-x86_64.S +index 5f6a5af9c489..77043a82da51 100644 +--- a/arch/x86/crypto/aes_ctrby8_avx-x86_64.S ++++ b/arch/x86/crypto/aes_ctrby8_avx-x86_64.S +@@ -127,10 +127,6 @@ ddq_add_8: + + /* generate a unique variable for ddq_add_x */ + +-.macro setddq n +- var_ddq_add = ddq_add_\n +-.endm +- + /* generate a unique variable for xmm register */ + .macro setxdata n + var_xdata = %xmm\n +@@ -140,9 +136,7 @@ ddq_add_8: + + .macro club name, id + .altmacro +- .if \name == DDQ_DATA +- setddq %\id +- .elseif \name == XDATA ++ .if \name == XDATA + setxdata %\id + .endif + .noaltmacro +@@ -165,9 +159,8 @@ ddq_add_8: + + .set i, 1 + .rept (by - 1) +- club DDQ_DATA, i + club XDATA, i +- vpaddq var_ddq_add(%rip), xcounter, var_xdata ++ vpaddq (ddq_add_1 + 16 * (i - 1))(%rip), xcounter, var_xdata + vptest ddq_low_msk(%rip), var_xdata + jnz 1f + vpaddq ddq_high_add_1(%rip), var_xdata, var_xdata +@@ -180,8 +173,7 @@ ddq_add_8: + vmovdqa 1*16(p_keys), xkeyA + + vpxor xkey0, xdata0, xdata0 +- club DDQ_DATA, by +- vpaddq var_ddq_add(%rip), xcounter, xcounter ++ vpaddq (ddq_add_1 + 16 * (by - 1))(%rip), xcounter, xcounter + vptest ddq_low_msk(%rip), xcounter + jnz 1f + vpaddq ddq_high_add_1(%rip), xcounter, xcounter +diff --git a/arch/x86/crypto/aesni-intel_asm.S b/arch/x86/crypto/aesni-intel_asm.S +index e40bdf024ba7..9afeb58c910e 100644 +--- a/arch/x86/crypto/aesni-intel_asm.S ++++ b/arch/x86/crypto/aesni-intel_asm.S +@@ -266,7 +266,7 @@ ALL_F: .octa 0xffffffffffffffffffffffffffffffff + PSHUFB_XMM %xmm2, %xmm0 + movdqu %xmm0, CurCount(%arg2) # ctx_data.current_counter = iv + +- PRECOMPUTE \SUBKEY, %xmm1, %xmm2, %xmm3, %xmm4, %xmm5, %xmm6, %xmm7, ++ PRECOMPUTE \SUBKEY, %xmm1, %xmm2, %xmm3, %xmm4, %xmm5, %xmm6, %xmm7 + movdqu HashKey(%arg2), %xmm13 + + CALC_AAD_HASH %xmm13, \AAD, \AADLEN, %xmm0, %xmm1, %xmm2, %xmm3, \ +@@ -978,7 +978,7 @@ _initial_blocks_done\@: + * arg1, %arg3, %arg4 are used as pointers only, not modified + * %r11 is the data offset value + */ +-.macro GHASH_4_ENCRYPT_4_PARALLEL_ENC TMP1 TMP2 TMP3 TMP4 TMP5 \ ++.macro GHASH_4_ENCRYPT_4_PARALLEL_enc TMP1 TMP2 TMP3 TMP4 TMP5 \ + TMP6 XMM0 XMM1 XMM2 XMM3 XMM4 XMM5 XMM6 XMM7 XMM8 operation + + movdqa \XMM1, \XMM5 +@@ -1186,7 +1186,7 @@ aes_loop_par_enc_done\@: + * arg1, %arg3, %arg4 are used as pointers only, not modified + * %r11 is the data offset value + */ +-.macro GHASH_4_ENCRYPT_4_PARALLEL_DEC TMP1 TMP2 TMP3 TMP4 TMP5 \ ++.macro GHASH_4_ENCRYPT_4_PARALLEL_dec TMP1 TMP2 TMP3 TMP4 TMP5 \ + TMP6 XMM0 XMM1 XMM2 XMM3 XMM4 XMM5 XMM6 XMM7 XMM8 operation + + movdqa \XMM1, \XMM5 +diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c +index 16699101fd2f..ea6d9da9b094 100644 +--- a/arch/x86/kernel/apic/io_apic.c ++++ b/arch/x86/kernel/apic/io_apic.c +@@ -2348,8 +2348,13 @@ static int mp_irqdomain_create(int ioapic) + + static void ioapic_destroy_irqdomain(int idx) + { ++ struct ioapic_domain_cfg *cfg = &ioapics[idx].irqdomain_cfg; ++ struct fwnode_handle *fn = ioapics[idx].irqdomain->fwnode; ++ + if (ioapics[idx].irqdomain) { + irq_domain_remove(ioapics[idx].irqdomain); ++ if (!cfg->dev) ++ irq_domain_free_fwnode(fn); + ioapics[idx].irqdomain = NULL; + } + } +diff --git a/arch/x86/kernel/cpu/mce/inject.c b/arch/x86/kernel/cpu/mce/inject.c +index 1f30117b24ba..eb2d41c1816d 100644 +--- a/arch/x86/kernel/cpu/mce/inject.c ++++ b/arch/x86/kernel/cpu/mce/inject.c +@@ -511,7 +511,7 @@ static void do_inject(void) + */ + if (inj_type == DFR_INT_INJ) { + i_mce.status |= MCI_STATUS_DEFERRED; +- i_mce.status |= (i_mce.status & ~MCI_STATUS_UC); ++ i_mce.status &= ~MCI_STATUS_UC; + } + + /* +diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c +index af64519b2695..da3cc3a10d63 100644 +--- a/arch/x86/kernel/process_64.c ++++ b/arch/x86/kernel/process_64.c +@@ -316,7 +316,7 @@ static unsigned long x86_fsgsbase_read_task(struct task_struct *task, + */ + mutex_lock(&task->mm->context.lock); + ldt = task->mm->context.ldt; +- if (unlikely(idx >= ldt->nr_entries)) ++ if (unlikely(!ldt || idx >= ldt->nr_entries)) + base = 0; + else + base = get_desc_base(ldt->entries + idx); +diff --git a/block/blk-iocost.c b/block/blk-iocost.c +index 4d2bda812d9b..dcc6685d5bec 100644 +--- a/block/blk-iocost.c ++++ b/block/blk-iocost.c +@@ -1377,7 +1377,7 @@ static void ioc_timer_fn(struct timer_list *timer) + * should have woken up in the last period and expire idle iocgs. + */ + list_for_each_entry_safe(iocg, tiocg, &ioc->active_iocgs, active_list) { +- if (!waitqueue_active(&iocg->waitq) && iocg->abs_vdebt && ++ if (!waitqueue_active(&iocg->waitq) && !iocg->abs_vdebt && + !iocg_is_idle(iocg)) + continue; + +diff --git a/drivers/acpi/acpica/exprep.c b/drivers/acpi/acpica/exprep.c +index 728d752f7adc..85f799c9c25c 100644 +--- a/drivers/acpi/acpica/exprep.c ++++ b/drivers/acpi/acpica/exprep.c +@@ -473,10 +473,6 @@ acpi_status acpi_ex_prep_field_value(struct acpi_create_field_info *info) + (u8)access_byte_width; + } + } +- /* An additional reference for the container */ +- +- acpi_ut_add_reference(obj_desc->field.region_obj); +- + ACPI_DEBUG_PRINT((ACPI_DB_BFIELD, + "RegionField: BitOff %X, Off %X, Gran %X, Region %p\n", + obj_desc->field.start_field_bit_offset, +diff --git a/drivers/acpi/acpica/utdelete.c b/drivers/acpi/acpica/utdelete.c +index c365faf4e6cd..4c0d4e434196 100644 +--- a/drivers/acpi/acpica/utdelete.c ++++ b/drivers/acpi/acpica/utdelete.c +@@ -568,11 +568,6 @@ acpi_ut_update_object_reference(union acpi_operand_object *object, u16 action) + next_object = object->buffer_field.buffer_obj; + break; + +- case ACPI_TYPE_LOCAL_REGION_FIELD: +- +- next_object = object->field.region_obj; +- break; +- + case ACPI_TYPE_LOCAL_BANK_FIELD: + + next_object = object->bank_field.bank_obj; +@@ -613,6 +608,7 @@ acpi_ut_update_object_reference(union acpi_operand_object *object, u16 action) + } + break; + ++ case ACPI_TYPE_LOCAL_REGION_FIELD: + case ACPI_TYPE_REGION: + default: + +diff --git a/drivers/block/loop.c b/drivers/block/loop.c +index 565e35e69f24..bddbbf5b3dda 100644 +--- a/drivers/block/loop.c ++++ b/drivers/block/loop.c +@@ -2325,6 +2325,8 @@ static void __exit loop_exit(void) + + range = max_loop ? max_loop << part_shift : 1UL << MINORBITS; + ++ mutex_lock(&loop_ctl_mutex); ++ + idr_for_each(&loop_index_idr, &loop_exit_cb, NULL); + idr_destroy(&loop_index_idr); + +@@ -2332,6 +2334,8 @@ static void __exit loop_exit(void) + unregister_blkdev(LOOP_MAJOR, "loop"); + + misc_deregister(&loop_misc); ++ ++ mutex_unlock(&loop_ctl_mutex); + } + + module_init(loop_init); +diff --git a/drivers/bluetooth/btmrvl_sdio.c b/drivers/bluetooth/btmrvl_sdio.c +index 0f3a020703ab..4c7978cb1786 100644 +--- a/drivers/bluetooth/btmrvl_sdio.c ++++ b/drivers/bluetooth/btmrvl_sdio.c +@@ -328,7 +328,7 @@ static const struct btmrvl_sdio_device btmrvl_sdio_sd8897 = { + + static const struct btmrvl_sdio_device btmrvl_sdio_sd8977 = { + .helper = NULL, +- .firmware = "mrvl/sd8977_uapsta.bin", ++ .firmware = "mrvl/sdsd8977_combo_v2.bin", + .reg = &btmrvl_reg_8977, + .support_pscan_win_report = true, + .sd_blksz_fw_dl = 256, +@@ -346,7 +346,7 @@ static const struct btmrvl_sdio_device btmrvl_sdio_sd8987 = { + + static const struct btmrvl_sdio_device btmrvl_sdio_sd8997 = { + .helper = NULL, +- .firmware = "mrvl/sd8997_uapsta.bin", ++ .firmware = "mrvl/sdsd8997_combo_v4.bin", + .reg = &btmrvl_reg_8997, + .support_pscan_win_report = true, + .sd_blksz_fw_dl = 256, +@@ -1831,6 +1831,6 @@ MODULE_FIRMWARE("mrvl/sd8787_uapsta.bin"); + MODULE_FIRMWARE("mrvl/sd8797_uapsta.bin"); + MODULE_FIRMWARE("mrvl/sd8887_uapsta.bin"); + MODULE_FIRMWARE("mrvl/sd8897_uapsta.bin"); +-MODULE_FIRMWARE("mrvl/sd8977_uapsta.bin"); ++MODULE_FIRMWARE("mrvl/sdsd8977_combo_v2.bin"); + MODULE_FIRMWARE("mrvl/sd8987_uapsta.bin"); +-MODULE_FIRMWARE("mrvl/sd8997_uapsta.bin"); ++MODULE_FIRMWARE("mrvl/sdsd8997_combo_v4.bin"); +diff --git a/drivers/bluetooth/btmtksdio.c b/drivers/bluetooth/btmtksdio.c +index 813338288453..b7de7cb8cca9 100644 +--- a/drivers/bluetooth/btmtksdio.c ++++ b/drivers/bluetooth/btmtksdio.c +@@ -684,7 +684,7 @@ static int mtk_setup_firmware(struct hci_dev *hdev, const char *fwname) + const u8 *fw_ptr; + size_t fw_size; + int err, dlen; +- u8 flag; ++ u8 flag, param; + + err = request_firmware(&fw, fwname, &hdev->dev); + if (err < 0) { +@@ -692,6 +692,20 @@ static int mtk_setup_firmware(struct hci_dev *hdev, const char *fwname) + return err; + } + ++ /* Power on data RAM the firmware relies on. */ ++ param = 1; ++ wmt_params.op = MTK_WMT_FUNC_CTRL; ++ wmt_params.flag = 3; ++ wmt_params.dlen = sizeof(param); ++ wmt_params.data = ¶m; ++ wmt_params.status = NULL; ++ ++ err = mtk_hci_wmt_sync(hdev, &wmt_params); ++ if (err < 0) { ++ bt_dev_err(hdev, "Failed to power on data RAM (%d)", err); ++ return err; ++ } ++ + fw_ptr = fw->data; + fw_size = fw->size; + +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index 9c3b063e1a1f..f3f0529564da 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -2792,7 +2792,7 @@ static int btusb_mtk_setup_firmware(struct hci_dev *hdev, const char *fwname) + const u8 *fw_ptr; + size_t fw_size; + int err, dlen; +- u8 flag; ++ u8 flag, param; + + err = request_firmware(&fw, fwname, &hdev->dev); + if (err < 0) { +@@ -2800,6 +2800,20 @@ static int btusb_mtk_setup_firmware(struct hci_dev *hdev, const char *fwname) + return err; + } + ++ /* Power on data RAM the firmware relies on. */ ++ param = 1; ++ wmt_params.op = BTMTK_WMT_FUNC_CTRL; ++ wmt_params.flag = 3; ++ wmt_params.dlen = sizeof(param); ++ wmt_params.data = ¶m; ++ wmt_params.status = NULL; ++ ++ err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params); ++ if (err < 0) { ++ bt_dev_err(hdev, "Failed to power on data RAM (%d)", err); ++ return err; ++ } ++ + fw_ptr = fw->data; + fw_size = fw->size; + +diff --git a/drivers/bluetooth/hci_h5.c b/drivers/bluetooth/hci_h5.c +index dacf297baf59..5df0651b6cd5 100644 +--- a/drivers/bluetooth/hci_h5.c ++++ b/drivers/bluetooth/hci_h5.c +@@ -790,7 +790,7 @@ static int h5_serdev_probe(struct serdev_device *serdev) + if (!h5) + return -ENOMEM; + +- set_bit(HCI_UART_RESET_ON_INIT, &h5->serdev_hu.flags); ++ set_bit(HCI_UART_RESET_ON_INIT, &h5->serdev_hu.hdev_flags); + + h5->hu = &h5->serdev_hu; + h5->serdev_hu.serdev = serdev; +diff --git a/drivers/bluetooth/hci_serdev.c b/drivers/bluetooth/hci_serdev.c +index 4652896d4990..ad2f26cb2622 100644 +--- a/drivers/bluetooth/hci_serdev.c ++++ b/drivers/bluetooth/hci_serdev.c +@@ -357,7 +357,8 @@ void hci_uart_unregister_device(struct hci_uart *hu) + struct hci_dev *hdev = hu->hdev; + + clear_bit(HCI_UART_PROTO_READY, &hu->flags); +- hci_unregister_dev(hdev); ++ if (test_bit(HCI_UART_REGISTERED, &hu->flags)) ++ hci_unregister_dev(hdev); + hci_free_dev(hdev); + + cancel_work_sync(&hu->write_work); +diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c +index f8bc052cd853..770a780dfa54 100644 +--- a/drivers/bus/ti-sysc.c ++++ b/drivers/bus/ti-sysc.c +@@ -1371,6 +1371,10 @@ static const struct sysc_revision_quirk sysc_revision_quirks[] = { + SYSC_QUIRK_SWSUP_SIDLE | SYSC_QUIRK_SWSUP_MSTANDBY), + SYSC_QUIRK("tptc", 0, 0, -ENODEV, -ENODEV, 0x40007c00, 0xffffffff, + SYSC_QUIRK_SWSUP_SIDLE | SYSC_QUIRK_SWSUP_MSTANDBY), ++ SYSC_QUIRK("usb_host_hs", 0, 0, 0x10, 0x14, 0x50700100, 0xffffffff, ++ SYSC_QUIRK_SWSUP_SIDLE | SYSC_QUIRK_SWSUP_MSTANDBY), ++ SYSC_QUIRK("usb_host_hs", 0, 0, 0x10, -ENODEV, 0x50700101, 0xffffffff, ++ SYSC_QUIRK_SWSUP_SIDLE | SYSC_QUIRK_SWSUP_MSTANDBY), + SYSC_QUIRK("usb_otg_hs", 0, 0x400, 0x404, 0x408, 0x00000050, + 0xffffffff, SYSC_QUIRK_SWSUP_SIDLE | SYSC_QUIRK_SWSUP_MSTANDBY), + SYSC_QUIRK("usb_otg_hs", 0, 0, 0x10, -ENODEV, 0x4ea2080d, 0xffffffff, +@@ -1440,8 +1444,6 @@ static const struct sysc_revision_quirk sysc_revision_quirks[] = { + SYSC_QUIRK("tpcc", 0, 0, -ENODEV, -ENODEV, 0x40014c00, 0xffffffff, 0), + SYSC_QUIRK("usbhstll", 0, 0, 0x10, 0x14, 0x00000004, 0xffffffff, 0), + SYSC_QUIRK("usbhstll", 0, 0, 0x10, 0x14, 0x00000008, 0xffffffff, 0), +- SYSC_QUIRK("usb_host_hs", 0, 0, 0x10, 0x14, 0x50700100, 0xffffffff, 0), +- SYSC_QUIRK("usb_host_hs", 0, 0, 0x10, -ENODEV, 0x50700101, 0xffffffff, 0), + SYSC_QUIRK("venc", 0x58003000, 0, -ENODEV, -ENODEV, 0x00000002, 0xffffffff, 0), + SYSC_QUIRK("vfpe", 0, 0, 0x104, -ENODEV, 0x4d001200, 0xffffffff, 0), + #endif +diff --git a/drivers/char/agp/intel-gtt.c b/drivers/char/agp/intel-gtt.c +index b161bdf60000..0941d38b2d32 100644 +--- a/drivers/char/agp/intel-gtt.c ++++ b/drivers/char/agp/intel-gtt.c +@@ -304,8 +304,10 @@ static int intel_gtt_setup_scratch_page(void) + if (intel_private.needs_dmar) { + dma_addr = pci_map_page(intel_private.pcidev, page, 0, + PAGE_SIZE, PCI_DMA_BIDIRECTIONAL); +- if (pci_dma_mapping_error(intel_private.pcidev, dma_addr)) ++ if (pci_dma_mapping_error(intel_private.pcidev, dma_addr)) { ++ __free_page(page); + return -EINVAL; ++ } + + intel_private.scratch_page_dma = dma_addr; + } else +diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c +index 58073836b555..1838039b0333 100644 +--- a/drivers/char/tpm/tpm-chip.c ++++ b/drivers/char/tpm/tpm-chip.c +@@ -386,13 +386,8 @@ struct tpm_chip *tpm_chip_alloc(struct device *pdev, + chip->cdev.owner = THIS_MODULE; + chip->cdevs.owner = THIS_MODULE; + +- chip->work_space.context_buf = kzalloc(PAGE_SIZE, GFP_KERNEL); +- if (!chip->work_space.context_buf) { +- rc = -ENOMEM; +- goto out; +- } +- chip->work_space.session_buf = kzalloc(PAGE_SIZE, GFP_KERNEL); +- if (!chip->work_space.session_buf) { ++ rc = tpm2_init_space(&chip->work_space, TPM2_SPACE_BUFFER_SIZE); ++ if (rc) { + rc = -ENOMEM; + goto out; + } +diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h +index 218cb496222a..37f010421a36 100644 +--- a/drivers/char/tpm/tpm.h ++++ b/drivers/char/tpm/tpm.h +@@ -177,6 +177,9 @@ struct tpm_header { + + #define TPM_TAG_RQU_COMMAND 193 + ++/* TPM2 specific constants. */ ++#define TPM2_SPACE_BUFFER_SIZE 16384 /* 16 kB */ ++ + struct stclear_flags_t { + __be16 tag; + u8 deactivated; +@@ -456,7 +459,7 @@ void tpm2_shutdown(struct tpm_chip *chip, u16 shutdown_type); + unsigned long tpm2_calc_ordinal_duration(struct tpm_chip *chip, u32 ordinal); + int tpm2_probe(struct tpm_chip *chip); + int tpm2_find_cc(struct tpm_chip *chip, u32 cc); +-int tpm2_init_space(struct tpm_space *space); ++int tpm2_init_space(struct tpm_space *space, unsigned int buf_size); + void tpm2_del_space(struct tpm_chip *chip, struct tpm_space *space); + void tpm2_flush_space(struct tpm_chip *chip); + int tpm2_prepare_space(struct tpm_chip *chip, struct tpm_space *space, u8 *cmd, +diff --git a/drivers/char/tpm/tpm2-space.c b/drivers/char/tpm/tpm2-space.c +index 982d341d8837..784b8b3cb903 100644 +--- a/drivers/char/tpm/tpm2-space.c ++++ b/drivers/char/tpm/tpm2-space.c +@@ -38,18 +38,21 @@ static void tpm2_flush_sessions(struct tpm_chip *chip, struct tpm_space *space) + } + } + +-int tpm2_init_space(struct tpm_space *space) ++int tpm2_init_space(struct tpm_space *space, unsigned int buf_size) + { +- space->context_buf = kzalloc(PAGE_SIZE, GFP_KERNEL); ++ space->context_buf = kzalloc(buf_size, GFP_KERNEL); + if (!space->context_buf) + return -ENOMEM; + +- space->session_buf = kzalloc(PAGE_SIZE, GFP_KERNEL); ++ space->session_buf = kzalloc(buf_size, GFP_KERNEL); + if (space->session_buf == NULL) { + kfree(space->context_buf); ++ /* Prevent caller getting a dangling pointer. */ ++ space->context_buf = NULL; + return -ENOMEM; + } + ++ space->buf_size = buf_size; + return 0; + } + +@@ -311,8 +314,10 @@ int tpm2_prepare_space(struct tpm_chip *chip, struct tpm_space *space, u8 *cmd, + sizeof(space->context_tbl)); + memcpy(&chip->work_space.session_tbl, &space->session_tbl, + sizeof(space->session_tbl)); +- memcpy(chip->work_space.context_buf, space->context_buf, PAGE_SIZE); +- memcpy(chip->work_space.session_buf, space->session_buf, PAGE_SIZE); ++ memcpy(chip->work_space.context_buf, space->context_buf, ++ space->buf_size); ++ memcpy(chip->work_space.session_buf, space->session_buf, ++ space->buf_size); + + rc = tpm2_load_space(chip); + if (rc) { +@@ -492,7 +497,7 @@ static int tpm2_save_space(struct tpm_chip *chip) + continue; + + rc = tpm2_save_context(chip, space->context_tbl[i], +- space->context_buf, PAGE_SIZE, ++ space->context_buf, space->buf_size, + &offset); + if (rc == -ENOENT) { + space->context_tbl[i] = 0; +@@ -509,9 +514,8 @@ static int tpm2_save_space(struct tpm_chip *chip) + continue; + + rc = tpm2_save_context(chip, space->session_tbl[i], +- space->session_buf, PAGE_SIZE, ++ space->session_buf, space->buf_size, + &offset); +- + if (rc == -ENOENT) { + /* handle error saving session, just forget it */ + space->session_tbl[i] = 0; +@@ -557,8 +561,10 @@ int tpm2_commit_space(struct tpm_chip *chip, struct tpm_space *space, + sizeof(space->context_tbl)); + memcpy(&space->session_tbl, &chip->work_space.session_tbl, + sizeof(space->session_tbl)); +- memcpy(space->context_buf, chip->work_space.context_buf, PAGE_SIZE); +- memcpy(space->session_buf, chip->work_space.session_buf, PAGE_SIZE); ++ memcpy(space->context_buf, chip->work_space.context_buf, ++ space->buf_size); ++ memcpy(space->session_buf, chip->work_space.session_buf, ++ space->buf_size); + + return 0; + out: +diff --git a/drivers/char/tpm/tpmrm-dev.c b/drivers/char/tpm/tpmrm-dev.c +index 7a0a7051a06f..eef0fb06ea83 100644 +--- a/drivers/char/tpm/tpmrm-dev.c ++++ b/drivers/char/tpm/tpmrm-dev.c +@@ -21,7 +21,7 @@ static int tpmrm_open(struct inode *inode, struct file *file) + if (priv == NULL) + return -ENOMEM; + +- rc = tpm2_init_space(&priv->space); ++ rc = tpm2_init_space(&priv->space, TPM2_SPACE_BUFFER_SIZE); + if (rc) { + kfree(priv); + return -ENOMEM; +diff --git a/drivers/clk/bcm/clk-bcm63xx-gate.c b/drivers/clk/bcm/clk-bcm63xx-gate.c +index 98e884957db8..911a29bd744e 100644 +--- a/drivers/clk/bcm/clk-bcm63xx-gate.c ++++ b/drivers/clk/bcm/clk-bcm63xx-gate.c +@@ -155,6 +155,7 @@ static int clk_bcm63xx_probe(struct platform_device *pdev) + + for (entry = table; entry->name; entry++) + maxbit = max_t(u8, maxbit, entry->bit); ++ maxbit++; + + hw = devm_kzalloc(&pdev->dev, struct_size(hw, data.hws, maxbit), + GFP_KERNEL); +diff --git a/drivers/clk/clk-scmi.c b/drivers/clk/clk-scmi.c +index 886f7c5df51a..e3cdb4a282fe 100644 +--- a/drivers/clk/clk-scmi.c ++++ b/drivers/clk/clk-scmi.c +@@ -103,6 +103,8 @@ static const struct clk_ops scmi_clk_ops = { + static int scmi_clk_ops_init(struct device *dev, struct scmi_clk *sclk) + { + int ret; ++ unsigned long min_rate, max_rate; ++ + struct clk_init_data init = { + .flags = CLK_GET_RATE_NOCACHE, + .num_parents = 0, +@@ -112,9 +114,23 @@ static int scmi_clk_ops_init(struct device *dev, struct scmi_clk *sclk) + + sclk->hw.init = &init; + ret = devm_clk_hw_register(dev, &sclk->hw); +- if (!ret) +- clk_hw_set_rate_range(&sclk->hw, sclk->info->range.min_rate, +- sclk->info->range.max_rate); ++ if (ret) ++ return ret; ++ ++ if (sclk->info->rate_discrete) { ++ int num_rates = sclk->info->list.num_rates; ++ ++ if (num_rates <= 0) ++ return -EINVAL; ++ ++ min_rate = sclk->info->list.rates[0]; ++ max_rate = sclk->info->list.rates[num_rates - 1]; ++ } else { ++ min_rate = sclk->info->range.min_rate; ++ max_rate = sclk->info->range.max_rate; ++ } ++ ++ clk_hw_set_rate_range(&sclk->hw, min_rate, max_rate); + return ret; + } + +diff --git a/drivers/clk/qcom/clk-rpmh.c b/drivers/clk/qcom/clk-rpmh.c +index 96a36f6ff667..d7586e26acd8 100644 +--- a/drivers/clk/qcom/clk-rpmh.c ++++ b/drivers/clk/qcom/clk-rpmh.c +@@ -143,12 +143,22 @@ static inline bool has_state_changed(struct clk_rpmh *c, u32 state) + != (c->aggr_state & BIT(state)); + } + ++static int clk_rpmh_send(struct clk_rpmh *c, enum rpmh_state state, ++ struct tcs_cmd *cmd, bool wait) ++{ ++ if (wait) ++ return rpmh_write(c->dev, state, cmd, 1); ++ ++ return rpmh_write_async(c->dev, state, cmd, 1); ++} ++ + static int clk_rpmh_send_aggregate_command(struct clk_rpmh *c) + { + struct tcs_cmd cmd = { 0 }; + u32 cmd_state, on_val; + enum rpmh_state state = RPMH_SLEEP_STATE; + int ret; ++ bool wait; + + cmd.addr = c->res_addr; + cmd_state = c->aggr_state; +@@ -159,7 +169,8 @@ static int clk_rpmh_send_aggregate_command(struct clk_rpmh *c) + if (cmd_state & BIT(state)) + cmd.data = on_val; + +- ret = rpmh_write_async(c->dev, state, &cmd, 1); ++ wait = cmd_state && state == RPMH_ACTIVE_ONLY_STATE; ++ ret = clk_rpmh_send(c, state, &cmd, wait); + if (ret) { + dev_err(c->dev, "set %s state of %s failed: (%d)\n", + !state ? "sleep" : +@@ -267,7 +278,7 @@ static int clk_rpmh_bcm_send_cmd(struct clk_rpmh *c, bool enable) + cmd.addr = c->res_addr; + cmd.data = BCM_TCS_CMD(1, enable, 0, cmd_state); + +- ret = rpmh_write_async(c->dev, RPMH_ACTIVE_ONLY_STATE, &cmd, 1); ++ ret = clk_rpmh_send(c, RPMH_ACTIVE_ONLY_STATE, &cmd, enable); + if (ret) { + dev_err(c->dev, "set active state of %s failed: (%d)\n", + c->res_name, ret); +diff --git a/drivers/cpufreq/Kconfig.arm b/drivers/cpufreq/Kconfig.arm +index a905796f7f85..25f11e9ec358 100644 +--- a/drivers/cpufreq/Kconfig.arm ++++ b/drivers/cpufreq/Kconfig.arm +@@ -41,6 +41,7 @@ config ARM_ARMADA_37XX_CPUFREQ + config ARM_ARMADA_8K_CPUFREQ + tristate "Armada 8K CPUFreq driver" + depends on ARCH_MVEBU && CPUFREQ_DT ++ select ARMADA_AP_CPU_CLK + help + This enables the CPUFreq driver support for Marvell + Armada8k SOCs. +diff --git a/drivers/cpufreq/armada-37xx-cpufreq.c b/drivers/cpufreq/armada-37xx-cpufreq.c +index aa0f06dec959..df1c941260d1 100644 +--- a/drivers/cpufreq/armada-37xx-cpufreq.c ++++ b/drivers/cpufreq/armada-37xx-cpufreq.c +@@ -456,6 +456,7 @@ static int __init armada37xx_cpufreq_driver_init(void) + /* Now that everything is setup, enable the DVFS at hardware level */ + armada37xx_cpufreq_enable_dvfs(nb_pm_base); + ++ memset(&pdata, 0, sizeof(pdata)); + pdata.suspend = armada37xx_cpufreq_suspend; + pdata.resume = armada37xx_cpufreq_resume; + +diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c +index fa988bd1e606..194a6587a1de 100644 +--- a/drivers/cpufreq/cpufreq.c ++++ b/drivers/cpufreq/cpufreq.c +@@ -616,6 +616,24 @@ static struct cpufreq_governor *find_governor(const char *str_governor) + return NULL; + } + ++static struct cpufreq_governor *get_governor(const char *str_governor) ++{ ++ struct cpufreq_governor *t; ++ ++ mutex_lock(&cpufreq_governor_mutex); ++ t = find_governor(str_governor); ++ if (!t) ++ goto unlock; ++ ++ if (!try_module_get(t->owner)) ++ t = NULL; ++ ++unlock: ++ mutex_unlock(&cpufreq_governor_mutex); ++ ++ return t; ++} ++ + static unsigned int cpufreq_parse_policy(char *str_governor) + { + if (!strncasecmp(str_governor, "performance", CPUFREQ_NAME_LEN)) +@@ -635,28 +653,14 @@ static struct cpufreq_governor *cpufreq_parse_governor(char *str_governor) + { + struct cpufreq_governor *t; + +- mutex_lock(&cpufreq_governor_mutex); ++ t = get_governor(str_governor); ++ if (t) ++ return t; + +- t = find_governor(str_governor); +- if (!t) { +- int ret; +- +- mutex_unlock(&cpufreq_governor_mutex); +- +- ret = request_module("cpufreq_%s", str_governor); +- if (ret) +- return NULL; +- +- mutex_lock(&cpufreq_governor_mutex); +- +- t = find_governor(str_governor); +- } +- if (t && !try_module_get(t->owner)) +- t = NULL; +- +- mutex_unlock(&cpufreq_governor_mutex); ++ if (request_module("cpufreq_%s", str_governor)) ++ return NULL; + +- return t; ++ return get_governor(str_governor); + } + + /** +@@ -810,12 +814,14 @@ static ssize_t show_scaling_available_governors(struct cpufreq_policy *policy, + goto out; + } + ++ mutex_lock(&cpufreq_governor_mutex); + for_each_governor(t) { + if (i >= (ssize_t) ((PAGE_SIZE / sizeof(char)) + - (CPUFREQ_NAME_LEN + 2))) +- goto out; ++ break; + i += scnprintf(&buf[i], CPUFREQ_NAME_PLEN, "%s ", t->name); + } ++ mutex_unlock(&cpufreq_governor_mutex); + out: + i += sprintf(&buf[i], "\n"); + return i; +@@ -1053,15 +1059,17 @@ static int cpufreq_init_policy(struct cpufreq_policy *policy) + struct cpufreq_governor *def_gov = cpufreq_default_governor(); + struct cpufreq_governor *gov = NULL; + unsigned int pol = CPUFREQ_POLICY_UNKNOWN; ++ int ret; + + if (has_target()) { + /* Update policy governor to the one used before hotplug. */ +- gov = find_governor(policy->last_governor); ++ gov = get_governor(policy->last_governor); + if (gov) { + pr_debug("Restoring governor %s for cpu %d\n", + policy->governor->name, policy->cpu); + } else if (def_gov) { + gov = def_gov; ++ __module_get(gov->owner); + } else { + return -ENODATA; + } +@@ -1084,7 +1092,11 @@ static int cpufreq_init_policy(struct cpufreq_policy *policy) + return -ENODATA; + } + +- return cpufreq_set_policy(policy, gov, pol); ++ ret = cpufreq_set_policy(policy, gov, pol); ++ if (gov) ++ module_put(gov->owner); ++ ++ return ret; + } + + static int cpufreq_add_policy_cpu(struct cpufreq_policy *policy, unsigned int cpu) +diff --git a/drivers/crypto/cavium/cpt/cptvf_algs.c b/drivers/crypto/cavium/cpt/cptvf_algs.c +index 596ce28b957d..2410b23aa609 100644 +--- a/drivers/crypto/cavium/cpt/cptvf_algs.c ++++ b/drivers/crypto/cavium/cpt/cptvf_algs.c +@@ -200,6 +200,7 @@ static inline int cvm_enc_dec(struct ablkcipher_request *req, u32 enc) + int status; + + memset(req_info, 0, sizeof(struct cpt_request_info)); ++ req_info->may_sleep = (req->base.flags & CRYPTO_TFM_REQ_MAY_SLEEP) != 0; + memset(fctx, 0, sizeof(struct fc_context)); + create_input_list(req, enc, enc_iv_len); + create_output_list(req, enc_iv_len); +diff --git a/drivers/crypto/cavium/cpt/cptvf_reqmanager.c b/drivers/crypto/cavium/cpt/cptvf_reqmanager.c +index 7a24019356b5..e343249c8d05 100644 +--- a/drivers/crypto/cavium/cpt/cptvf_reqmanager.c ++++ b/drivers/crypto/cavium/cpt/cptvf_reqmanager.c +@@ -133,7 +133,7 @@ static inline int setup_sgio_list(struct cpt_vf *cptvf, + + /* Setup gather (input) components */ + g_sz_bytes = ((req->incnt + 3) / 4) * sizeof(struct sglist_component); +- info->gather_components = kzalloc(g_sz_bytes, GFP_KERNEL); ++ info->gather_components = kzalloc(g_sz_bytes, req->may_sleep ? GFP_KERNEL : GFP_ATOMIC); + if (!info->gather_components) { + ret = -ENOMEM; + goto scatter_gather_clean; +@@ -150,7 +150,7 @@ static inline int setup_sgio_list(struct cpt_vf *cptvf, + + /* Setup scatter (output) components */ + s_sz_bytes = ((req->outcnt + 3) / 4) * sizeof(struct sglist_component); +- info->scatter_components = kzalloc(s_sz_bytes, GFP_KERNEL); ++ info->scatter_components = kzalloc(s_sz_bytes, req->may_sleep ? GFP_KERNEL : GFP_ATOMIC); + if (!info->scatter_components) { + ret = -ENOMEM; + goto scatter_gather_clean; +@@ -167,7 +167,7 @@ static inline int setup_sgio_list(struct cpt_vf *cptvf, + + /* Create and initialize DPTR */ + info->dlen = g_sz_bytes + s_sz_bytes + SG_LIST_HDR_SIZE; +- info->in_buffer = kzalloc(info->dlen, GFP_KERNEL); ++ info->in_buffer = kzalloc(info->dlen, req->may_sleep ? GFP_KERNEL : GFP_ATOMIC); + if (!info->in_buffer) { + ret = -ENOMEM; + goto scatter_gather_clean; +@@ -195,7 +195,7 @@ static inline int setup_sgio_list(struct cpt_vf *cptvf, + } + + /* Create and initialize RPTR */ +- info->out_buffer = kzalloc(COMPLETION_CODE_SIZE, GFP_KERNEL); ++ info->out_buffer = kzalloc(COMPLETION_CODE_SIZE, req->may_sleep ? GFP_KERNEL : GFP_ATOMIC); + if (!info->out_buffer) { + ret = -ENOMEM; + goto scatter_gather_clean; +@@ -421,7 +421,7 @@ int process_request(struct cpt_vf *cptvf, struct cpt_request_info *req) + struct cpt_vq_command vq_cmd; + union cpt_inst_s cptinst; + +- info = kzalloc(sizeof(*info), GFP_KERNEL); ++ info = kzalloc(sizeof(*info), req->may_sleep ? GFP_KERNEL : GFP_ATOMIC); + if (unlikely(!info)) { + dev_err(&pdev->dev, "Unable to allocate memory for info_buffer\n"); + return -ENOMEM; +@@ -443,7 +443,7 @@ int process_request(struct cpt_vf *cptvf, struct cpt_request_info *req) + * Get buffer for union cpt_res_s response + * structure and its physical address + */ +- info->completion_addr = kzalloc(sizeof(union cpt_res_s), GFP_KERNEL); ++ info->completion_addr = kzalloc(sizeof(union cpt_res_s), req->may_sleep ? GFP_KERNEL : GFP_ATOMIC); + if (unlikely(!info->completion_addr)) { + dev_err(&pdev->dev, "Unable to allocate memory for completion_addr\n"); + ret = -ENOMEM; +diff --git a/drivers/crypto/cavium/cpt/request_manager.h b/drivers/crypto/cavium/cpt/request_manager.h +index 3514b082eca7..1e8dd9ebcc17 100644 +--- a/drivers/crypto/cavium/cpt/request_manager.h ++++ b/drivers/crypto/cavium/cpt/request_manager.h +@@ -62,6 +62,8 @@ struct cpt_request_info { + union ctrl_info ctrl; /* User control information */ + struct cptvf_request req; /* Request Information (Core specific) */ + ++ bool may_sleep; ++ + struct buf_ptr in[MAX_BUF_CNT]; + struct buf_ptr out[MAX_BUF_CNT]; + +diff --git a/drivers/crypto/ccp/ccp-dev.h b/drivers/crypto/ccp/ccp-dev.h +index 3f68262d9ab4..87a34d91fdf7 100644 +--- a/drivers/crypto/ccp/ccp-dev.h ++++ b/drivers/crypto/ccp/ccp-dev.h +@@ -469,6 +469,7 @@ struct ccp_sg_workarea { + unsigned int sg_used; + + struct scatterlist *dma_sg; ++ struct scatterlist *dma_sg_head; + struct device *dma_dev; + unsigned int dma_count; + enum dma_data_direction dma_dir; +diff --git a/drivers/crypto/ccp/ccp-ops.c b/drivers/crypto/ccp/ccp-ops.c +index 422193690fd4..64112c736810 100644 +--- a/drivers/crypto/ccp/ccp-ops.c ++++ b/drivers/crypto/ccp/ccp-ops.c +@@ -63,7 +63,7 @@ static u32 ccp_gen_jobid(struct ccp_device *ccp) + static void ccp_sg_free(struct ccp_sg_workarea *wa) + { + if (wa->dma_count) +- dma_unmap_sg(wa->dma_dev, wa->dma_sg, wa->nents, wa->dma_dir); ++ dma_unmap_sg(wa->dma_dev, wa->dma_sg_head, wa->nents, wa->dma_dir); + + wa->dma_count = 0; + } +@@ -92,6 +92,7 @@ static int ccp_init_sg_workarea(struct ccp_sg_workarea *wa, struct device *dev, + return 0; + + wa->dma_sg = sg; ++ wa->dma_sg_head = sg; + wa->dma_dev = dev; + wa->dma_dir = dma_dir; + wa->dma_count = dma_map_sg(dev, sg, wa->nents, dma_dir); +@@ -104,14 +105,28 @@ static int ccp_init_sg_workarea(struct ccp_sg_workarea *wa, struct device *dev, + static void ccp_update_sg_workarea(struct ccp_sg_workarea *wa, unsigned int len) + { + unsigned int nbytes = min_t(u64, len, wa->bytes_left); ++ unsigned int sg_combined_len = 0; + + if (!wa->sg) + return; + + wa->sg_used += nbytes; + wa->bytes_left -= nbytes; +- if (wa->sg_used == wa->sg->length) { +- wa->sg = sg_next(wa->sg); ++ if (wa->sg_used == sg_dma_len(wa->dma_sg)) { ++ /* Advance to the next DMA scatterlist entry */ ++ wa->dma_sg = sg_next(wa->dma_sg); ++ ++ /* In the case that the DMA mapped scatterlist has entries ++ * that have been merged, the non-DMA mapped scatterlist ++ * must be advanced multiple times for each merged entry. ++ * This ensures that the current non-DMA mapped entry ++ * corresponds to the current DMA mapped entry. ++ */ ++ do { ++ sg_combined_len += wa->sg->length; ++ wa->sg = sg_next(wa->sg); ++ } while (wa->sg_used > sg_combined_len); ++ + wa->sg_used = 0; + } + } +@@ -299,7 +314,7 @@ static unsigned int ccp_queue_buf(struct ccp_data *data, unsigned int from) + /* Update the structures and generate the count */ + buf_count = 0; + while (sg_wa->bytes_left && (buf_count < dm_wa->length)) { +- nbytes = min(sg_wa->sg->length - sg_wa->sg_used, ++ nbytes = min(sg_dma_len(sg_wa->dma_sg) - sg_wa->sg_used, + dm_wa->length - buf_count); + nbytes = min_t(u64, sg_wa->bytes_left, nbytes); + +@@ -331,11 +346,11 @@ static void ccp_prepare_data(struct ccp_data *src, struct ccp_data *dst, + * and destination. The resulting len values will always be <= UINT_MAX + * because the dma length is an unsigned int. + */ +- sg_src_len = sg_dma_len(src->sg_wa.sg) - src->sg_wa.sg_used; ++ sg_src_len = sg_dma_len(src->sg_wa.dma_sg) - src->sg_wa.sg_used; + sg_src_len = min_t(u64, src->sg_wa.bytes_left, sg_src_len); + + if (dst) { +- sg_dst_len = sg_dma_len(dst->sg_wa.sg) - dst->sg_wa.sg_used; ++ sg_dst_len = sg_dma_len(dst->sg_wa.dma_sg) - dst->sg_wa.sg_used; + sg_dst_len = min_t(u64, src->sg_wa.bytes_left, sg_dst_len); + op_len = min(sg_src_len, sg_dst_len); + } else { +@@ -365,7 +380,7 @@ static void ccp_prepare_data(struct ccp_data *src, struct ccp_data *dst, + /* Enough data in the sg element, but we need to + * adjust for any previously copied data + */ +- op->src.u.dma.address = sg_dma_address(src->sg_wa.sg); ++ op->src.u.dma.address = sg_dma_address(src->sg_wa.dma_sg); + op->src.u.dma.offset = src->sg_wa.sg_used; + op->src.u.dma.length = op_len & ~(block_size - 1); + +@@ -386,7 +401,7 @@ static void ccp_prepare_data(struct ccp_data *src, struct ccp_data *dst, + /* Enough room in the sg element, but we need to + * adjust for any previously used area + */ +- op->dst.u.dma.address = sg_dma_address(dst->sg_wa.sg); ++ op->dst.u.dma.address = sg_dma_address(dst->sg_wa.dma_sg); + op->dst.u.dma.offset = dst->sg_wa.sg_used; + op->dst.u.dma.length = op->src.u.dma.length; + } +@@ -2028,7 +2043,7 @@ ccp_run_passthru_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd) + dst.sg_wa.sg_used = 0; + for (i = 1; i <= src.sg_wa.dma_count; i++) { + if (!dst.sg_wa.sg || +- (dst.sg_wa.sg->length < src.sg_wa.sg->length)) { ++ (sg_dma_len(dst.sg_wa.sg) < sg_dma_len(src.sg_wa.sg))) { + ret = -EINVAL; + goto e_dst; + } +@@ -2054,8 +2069,8 @@ ccp_run_passthru_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd) + goto e_dst; + } + +- dst.sg_wa.sg_used += src.sg_wa.sg->length; +- if (dst.sg_wa.sg_used == dst.sg_wa.sg->length) { ++ dst.sg_wa.sg_used += sg_dma_len(src.sg_wa.sg); ++ if (dst.sg_wa.sg_used == sg_dma_len(dst.sg_wa.sg)) { + dst.sg_wa.sg = sg_next(dst.sg_wa.sg); + dst.sg_wa.sg_used = 0; + } +diff --git a/drivers/crypto/ccree/cc_cipher.c b/drivers/crypto/ccree/cc_cipher.c +index cd9c60268bf8..9bf0cce578f0 100644 +--- a/drivers/crypto/ccree/cc_cipher.c ++++ b/drivers/crypto/ccree/cc_cipher.c +@@ -163,7 +163,6 @@ static int cc_cipher_init(struct crypto_tfm *tfm) + skcipher_alg.base); + struct device *dev = drvdata_to_dev(cc_alg->drvdata); + unsigned int max_key_buf_size = cc_alg->skcipher_alg.max_keysize; +- int rc = 0; + + dev_dbg(dev, "Initializing context @%p for %s\n", ctx_p, + crypto_tfm_alg_name(tfm)); +@@ -175,10 +174,19 @@ static int cc_cipher_init(struct crypto_tfm *tfm) + ctx_p->flow_mode = cc_alg->flow_mode; + ctx_p->drvdata = cc_alg->drvdata; + ++ if (ctx_p->cipher_mode == DRV_CIPHER_ESSIV) { ++ /* Alloc hash tfm for essiv */ ++ ctx_p->shash_tfm = crypto_alloc_shash("sha256-generic", 0, 0); ++ if (IS_ERR(ctx_p->shash_tfm)) { ++ dev_err(dev, "Error allocating hash tfm for ESSIV.\n"); ++ return PTR_ERR(ctx_p->shash_tfm); ++ } ++ } ++ + /* Allocate key buffer, cache line aligned */ + ctx_p->user.key = kmalloc(max_key_buf_size, GFP_KERNEL); + if (!ctx_p->user.key) +- return -ENOMEM; ++ goto free_shash; + + dev_dbg(dev, "Allocated key buffer in context. key=@%p\n", + ctx_p->user.key); +@@ -190,21 +198,19 @@ static int cc_cipher_init(struct crypto_tfm *tfm) + if (dma_mapping_error(dev, ctx_p->user.key_dma_addr)) { + dev_err(dev, "Mapping Key %u B at va=%pK for DMA failed\n", + max_key_buf_size, ctx_p->user.key); +- return -ENOMEM; ++ goto free_key; + } + dev_dbg(dev, "Mapped key %u B at va=%pK to dma=%pad\n", + max_key_buf_size, ctx_p->user.key, &ctx_p->user.key_dma_addr); + +- if (ctx_p->cipher_mode == DRV_CIPHER_ESSIV) { +- /* Alloc hash tfm for essiv */ +- ctx_p->shash_tfm = crypto_alloc_shash("sha256-generic", 0, 0); +- if (IS_ERR(ctx_p->shash_tfm)) { +- dev_err(dev, "Error allocating hash tfm for ESSIV.\n"); +- return PTR_ERR(ctx_p->shash_tfm); +- } +- } ++ return 0; + +- return rc; ++free_key: ++ kfree(ctx_p->user.key); ++free_shash: ++ crypto_free_shash(ctx_p->shash_tfm); ++ ++ return -ENOMEM; + } + + static void cc_cipher_exit(struct crypto_tfm *tfm) +diff --git a/drivers/crypto/hisilicon/sec/sec_algs.c b/drivers/crypto/hisilicon/sec/sec_algs.c +index c27e7160d2df..4ad4ffd90cee 100644 +--- a/drivers/crypto/hisilicon/sec/sec_algs.c ++++ b/drivers/crypto/hisilicon/sec/sec_algs.c +@@ -175,7 +175,8 @@ static int sec_alloc_and_fill_hw_sgl(struct sec_hw_sgl **sec_sgl, + dma_addr_t *psec_sgl, + struct scatterlist *sgl, + int count, +- struct sec_dev_info *info) ++ struct sec_dev_info *info, ++ gfp_t gfp) + { + struct sec_hw_sgl *sgl_current = NULL; + struct sec_hw_sgl *sgl_next; +@@ -190,7 +191,7 @@ static int sec_alloc_and_fill_hw_sgl(struct sec_hw_sgl **sec_sgl, + sge_index = i % SEC_MAX_SGE_NUM; + if (sge_index == 0) { + sgl_next = dma_pool_zalloc(info->hw_sgl_pool, +- GFP_KERNEL, &sgl_next_dma); ++ gfp, &sgl_next_dma); + if (!sgl_next) { + ret = -ENOMEM; + goto err_free_hw_sgls; +@@ -545,14 +546,14 @@ void sec_alg_callback(struct sec_bd_info *resp, void *shadow) + } + + static int sec_alg_alloc_and_calc_split_sizes(int length, size_t **split_sizes, +- int *steps) ++ int *steps, gfp_t gfp) + { + size_t *sizes; + int i; + + /* Split into suitable sized blocks */ + *steps = roundup(length, SEC_REQ_LIMIT) / SEC_REQ_LIMIT; +- sizes = kcalloc(*steps, sizeof(*sizes), GFP_KERNEL); ++ sizes = kcalloc(*steps, sizeof(*sizes), gfp); + if (!sizes) + return -ENOMEM; + +@@ -568,7 +569,7 @@ static int sec_map_and_split_sg(struct scatterlist *sgl, size_t *split_sizes, + int steps, struct scatterlist ***splits, + int **splits_nents, + int sgl_len_in, +- struct device *dev) ++ struct device *dev, gfp_t gfp) + { + int ret, count; + +@@ -576,12 +577,12 @@ static int sec_map_and_split_sg(struct scatterlist *sgl, size_t *split_sizes, + if (!count) + return -EINVAL; + +- *splits = kcalloc(steps, sizeof(struct scatterlist *), GFP_KERNEL); ++ *splits = kcalloc(steps, sizeof(struct scatterlist *), gfp); + if (!*splits) { + ret = -ENOMEM; + goto err_unmap_sg; + } +- *splits_nents = kcalloc(steps, sizeof(int), GFP_KERNEL); ++ *splits_nents = kcalloc(steps, sizeof(int), gfp); + if (!*splits_nents) { + ret = -ENOMEM; + goto err_free_splits; +@@ -589,7 +590,7 @@ static int sec_map_and_split_sg(struct scatterlist *sgl, size_t *split_sizes, + + /* output the scatter list before and after this */ + ret = sg_split(sgl, count, 0, steps, split_sizes, +- *splits, *splits_nents, GFP_KERNEL); ++ *splits, *splits_nents, gfp); + if (ret) { + ret = -ENOMEM; + goto err_free_splits_nents; +@@ -630,13 +631,13 @@ static struct sec_request_el + int el_size, bool different_dest, + struct scatterlist *sgl_in, int n_ents_in, + struct scatterlist *sgl_out, int n_ents_out, +- struct sec_dev_info *info) ++ struct sec_dev_info *info, gfp_t gfp) + { + struct sec_request_el *el; + struct sec_bd_info *req; + int ret; + +- el = kzalloc(sizeof(*el), GFP_KERNEL); ++ el = kzalloc(sizeof(*el), gfp); + if (!el) + return ERR_PTR(-ENOMEM); + el->el_length = el_size; +@@ -668,7 +669,7 @@ static struct sec_request_el + el->sgl_in = sgl_in; + + ret = sec_alloc_and_fill_hw_sgl(&el->in, &el->dma_in, el->sgl_in, +- n_ents_in, info); ++ n_ents_in, info, gfp); + if (ret) + goto err_free_el; + +@@ -679,7 +680,7 @@ static struct sec_request_el + el->sgl_out = sgl_out; + ret = sec_alloc_and_fill_hw_sgl(&el->out, &el->dma_out, + el->sgl_out, +- n_ents_out, info); ++ n_ents_out, info, gfp); + if (ret) + goto err_free_hw_sgl_in; + +@@ -720,6 +721,7 @@ static int sec_alg_skcipher_crypto(struct skcipher_request *skreq, + int *splits_out_nents = NULL; + struct sec_request_el *el, *temp; + bool split = skreq->src != skreq->dst; ++ gfp_t gfp = skreq->base.flags & CRYPTO_TFM_REQ_MAY_SLEEP ? GFP_KERNEL : GFP_ATOMIC; + + mutex_init(&sec_req->lock); + sec_req->req_base = &skreq->base; +@@ -728,13 +730,13 @@ static int sec_alg_skcipher_crypto(struct skcipher_request *skreq, + sec_req->len_in = sg_nents(skreq->src); + + ret = sec_alg_alloc_and_calc_split_sizes(skreq->cryptlen, &split_sizes, +- &steps); ++ &steps, gfp); + if (ret) + return ret; + sec_req->num_elements = steps; + ret = sec_map_and_split_sg(skreq->src, split_sizes, steps, &splits_in, + &splits_in_nents, sec_req->len_in, +- info->dev); ++ info->dev, gfp); + if (ret) + goto err_free_split_sizes; + +@@ -742,7 +744,7 @@ static int sec_alg_skcipher_crypto(struct skcipher_request *skreq, + sec_req->len_out = sg_nents(skreq->dst); + ret = sec_map_and_split_sg(skreq->dst, split_sizes, steps, + &splits_out, &splits_out_nents, +- sec_req->len_out, info->dev); ++ sec_req->len_out, info->dev, gfp); + if (ret) + goto err_unmap_in_sg; + } +@@ -775,7 +777,7 @@ static int sec_alg_skcipher_crypto(struct skcipher_request *skreq, + splits_in[i], splits_in_nents[i], + split ? splits_out[i] : NULL, + split ? splits_out_nents[i] : 0, +- info); ++ info, gfp); + if (IS_ERR(el)) { + ret = PTR_ERR(el); + goto err_free_elements; +diff --git a/drivers/crypto/qat/qat_common/qat_uclo.c b/drivers/crypto/qat/qat_common/qat_uclo.c +index 6bd8f6a2a24f..aeb03081415c 100644 +--- a/drivers/crypto/qat/qat_common/qat_uclo.c ++++ b/drivers/crypto/qat/qat_common/qat_uclo.c +@@ -332,13 +332,18 @@ static int qat_uclo_create_batch_init_list(struct icp_qat_fw_loader_handle + } + return 0; + out_err: ++ /* Do not free the list head unless we allocated it. */ ++ tail_old = tail_old->next; ++ if (flag) { ++ kfree(*init_tab_base); ++ *init_tab_base = NULL; ++ } ++ + while (tail_old) { + mem_init = tail_old->next; + kfree(tail_old); + tail_old = mem_init; + } +- if (flag) +- kfree(*init_tab_base); + return -ENOMEM; + } + +diff --git a/drivers/edac/edac_device_sysfs.c b/drivers/edac/edac_device_sysfs.c +index 0e7ea3591b78..5e7593753799 100644 +--- a/drivers/edac/edac_device_sysfs.c ++++ b/drivers/edac/edac_device_sysfs.c +@@ -275,6 +275,7 @@ int edac_device_register_sysfs_main_kobj(struct edac_device_ctl_info *edac_dev) + + /* Error exit stack */ + err_kobj_reg: ++ kobject_put(&edac_dev->kobj); + module_put(edac_dev->owner); + + err_out: +diff --git a/drivers/edac/edac_pci_sysfs.c b/drivers/edac/edac_pci_sysfs.c +index 72c9eb9fdffb..53042af7262e 100644 +--- a/drivers/edac/edac_pci_sysfs.c ++++ b/drivers/edac/edac_pci_sysfs.c +@@ -386,7 +386,7 @@ static int edac_pci_main_kobj_setup(void) + + /* Error unwind statck */ + kobject_init_and_add_fail: +- kfree(edac_pci_top_main_kobj); ++ kobject_put(edac_pci_top_main_kobj); + + kzalloc_fail: + module_put(THIS_MODULE); +diff --git a/drivers/firmware/arm_scmi/scmi_pm_domain.c b/drivers/firmware/arm_scmi/scmi_pm_domain.c +index 87f737e01473..041f8152272b 100644 +--- a/drivers/firmware/arm_scmi/scmi_pm_domain.c ++++ b/drivers/firmware/arm_scmi/scmi_pm_domain.c +@@ -85,7 +85,10 @@ static int scmi_pm_domain_probe(struct scmi_device *sdev) + for (i = 0; i < num_domains; i++, scmi_pd++) { + u32 state; + +- domains[i] = &scmi_pd->genpd; ++ if (handle->power_ops->state_get(handle, i, &state)) { ++ dev_warn(dev, "failed to get state for domain %d\n", i); ++ continue; ++ } + + scmi_pd->domain = i; + scmi_pd->handle = handle; +@@ -94,13 +97,10 @@ static int scmi_pm_domain_probe(struct scmi_device *sdev) + scmi_pd->genpd.power_off = scmi_pd_power_off; + scmi_pd->genpd.power_on = scmi_pd_power_on; + +- if (handle->power_ops->state_get(handle, i, &state)) { +- dev_warn(dev, "failed to get state for domain %d\n", i); +- continue; +- } +- + pm_genpd_init(&scmi_pd->genpd, NULL, + state == SCMI_POWER_STATE_GENERIC_OFF); ++ ++ domains[i] = &scmi_pd->genpd; + } + + scmi_pd_data->domains = domains; +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c +index 23085b352cf2..c212d5fc665c 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c +@@ -404,7 +404,9 @@ int amdgpu_fence_driver_start_ring(struct amdgpu_ring *ring, + ring->fence_drv.gpu_addr = adev->uvd.inst[ring->me].gpu_addr + index; + } + amdgpu_fence_write(ring, atomic_read(&ring->fence_drv.last_seq)); +- amdgpu_irq_get(adev, irq_src, irq_type); ++ ++ if (irq_src) ++ amdgpu_irq_get(adev, irq_src, irq_type); + + ring->fence_drv.irq_src = irq_src; + ring->fence_drv.irq_type = irq_type; +@@ -539,8 +541,9 @@ void amdgpu_fence_driver_fini(struct amdgpu_device *adev) + /* no need to trigger GPU reset as we are unloading */ + amdgpu_fence_driver_force_completion(ring); + } +- amdgpu_irq_put(adev, ring->fence_drv.irq_src, +- ring->fence_drv.irq_type); ++ if (ring->fence_drv.irq_src) ++ amdgpu_irq_put(adev, ring->fence_drv.irq_src, ++ ring->fence_drv.irq_type); + drm_sched_fini(&ring->sched); + del_timer_sync(&ring->fence_drv.fallback_timer); + for (j = 0; j <= ring->fence_drv.num_fences_mask; ++j) +@@ -576,8 +579,9 @@ void amdgpu_fence_driver_suspend(struct amdgpu_device *adev) + } + + /* disable the interrupt */ +- amdgpu_irq_put(adev, ring->fence_drv.irq_src, +- ring->fence_drv.irq_type); ++ if (ring->fence_drv.irq_src) ++ amdgpu_irq_put(adev, ring->fence_drv.irq_src, ++ ring->fence_drv.irq_type); + } + } + +@@ -603,8 +607,9 @@ void amdgpu_fence_driver_resume(struct amdgpu_device *adev) + continue; + + /* enable the interrupt */ +- amdgpu_irq_get(adev, ring->fence_drv.irq_src, +- ring->fence_drv.irq_type); ++ if (ring->fence_drv.irq_src) ++ amdgpu_irq_get(adev, ring->fence_drv.irq_src, ++ ring->fence_drv.irq_type); + } + } + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_pp_smu.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_pp_smu.c +index 785322cd4c6c..7241d4c20778 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_pp_smu.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_pp_smu.c +@@ -530,6 +530,8 @@ bool dm_pp_get_static_clocks( + &pp_clk_info); + else if (adev->smu.funcs) + ret = smu_get_current_clocks(&adev->smu, &pp_clk_info); ++ else ++ return false; + if (ret) + return false; + +diff --git a/drivers/gpu/drm/amd/powerplay/smu_v11_0.c b/drivers/gpu/drm/amd/powerplay/smu_v11_0.c +index 0922d9cd858a..c4d8c52c6b9c 100644 +--- a/drivers/gpu/drm/amd/powerplay/smu_v11_0.c ++++ b/drivers/gpu/drm/amd/powerplay/smu_v11_0.c +@@ -171,7 +171,8 @@ static int smu_v11_0_init_microcode(struct smu_context *smu) + chip_name = "navi12"; + break; + default: +- BUG(); ++ dev_err(adev->dev, "Unsupported ASIC type %d\n", adev->asic_type); ++ return -EINVAL; + } + + snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_smc.bin", chip_name); +diff --git a/drivers/gpu/drm/arm/malidp_planes.c b/drivers/gpu/drm/arm/malidp_planes.c +index 3c70a53813bf..0b2bb485d9be 100644 +--- a/drivers/gpu/drm/arm/malidp_planes.c ++++ b/drivers/gpu/drm/arm/malidp_planes.c +@@ -928,7 +928,7 @@ int malidp_de_planes_init(struct drm_device *drm) + const struct malidp_hw_regmap *map = &malidp->dev->hw->map; + struct malidp_plane *plane = NULL; + enum drm_plane_type plane_type; +- unsigned long crtcs = 1 << drm->mode_config.num_crtc; ++ unsigned long crtcs = BIT(drm->mode_config.num_crtc); + unsigned long flags = DRM_MODE_ROTATE_0 | DRM_MODE_ROTATE_90 | DRM_MODE_ROTATE_180 | + DRM_MODE_ROTATE_270 | DRM_MODE_REFLECT_X | DRM_MODE_REFLECT_Y; + unsigned int blend_caps = BIT(DRM_MODE_BLEND_PIXEL_NONE) | +diff --git a/drivers/gpu/drm/bridge/sil-sii8620.c b/drivers/gpu/drm/bridge/sil-sii8620.c +index bd3165ee5354..04431dbac4a4 100644 +--- a/drivers/gpu/drm/bridge/sil-sii8620.c ++++ b/drivers/gpu/drm/bridge/sil-sii8620.c +@@ -177,7 +177,7 @@ static void sii8620_read_buf(struct sii8620 *ctx, u16 addr, u8 *buf, int len) + + static u8 sii8620_readb(struct sii8620 *ctx, u16 addr) + { +- u8 ret; ++ u8 ret = 0; + + sii8620_read_buf(ctx, addr, &ret, 1); + return ret; +diff --git a/drivers/gpu/drm/bridge/ti-sn65dsi86.c b/drivers/gpu/drm/bridge/ti-sn65dsi86.c +index 0a580957c8cf..f1de4bb6558c 100644 +--- a/drivers/gpu/drm/bridge/ti-sn65dsi86.c ++++ b/drivers/gpu/drm/bridge/ti-sn65dsi86.c +@@ -647,6 +647,12 @@ static ssize_t ti_sn_aux_transfer(struct drm_dp_aux *aux, + buf[i]); + } + ++ /* Clear old status bits before start so we don't get confused */ ++ regmap_write(pdata->regmap, SN_AUX_CMD_STATUS_REG, ++ AUX_IRQ_STATUS_NAT_I2C_FAIL | ++ AUX_IRQ_STATUS_AUX_RPLY_TOUT | ++ AUX_IRQ_STATUS_AUX_SHORT); ++ + regmap_write(pdata->regmap, SN_AUX_CMD_REG, request_val | AUX_CMD_SEND); + + ret = regmap_read_poll_timeout(pdata->regmap, SN_AUX_CMD_REG, val, +diff --git a/drivers/gpu/drm/drm_debugfs.c b/drivers/gpu/drm/drm_debugfs.c +index eab0f2687cd6..00debd02c322 100644 +--- a/drivers/gpu/drm/drm_debugfs.c ++++ b/drivers/gpu/drm/drm_debugfs.c +@@ -337,13 +337,13 @@ static ssize_t connector_write(struct file *file, const char __user *ubuf, + + buf[len] = '\0'; + +- if (!strcmp(buf, "on")) ++ if (sysfs_streq(buf, "on")) + connector->force = DRM_FORCE_ON; +- else if (!strcmp(buf, "digital")) ++ else if (sysfs_streq(buf, "digital")) + connector->force = DRM_FORCE_ON_DIGITAL; +- else if (!strcmp(buf, "off")) ++ else if (sysfs_streq(buf, "off")) + connector->force = DRM_FORCE_OFF; +- else if (!strcmp(buf, "unspecified")) ++ else if (sysfs_streq(buf, "unspecified")) + connector->force = DRM_FORCE_UNSPECIFIED; + else + return -EINVAL; +diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c +index 46ad14470d06..1fdc85a71cec 100644 +--- a/drivers/gpu/drm/drm_gem.c ++++ b/drivers/gpu/drm/drm_gem.c +@@ -710,6 +710,8 @@ int drm_gem_objects_lookup(struct drm_file *filp, void __user *bo_handles, + if (!objs) + return -ENOMEM; + ++ *objs_out = objs; ++ + handles = kvmalloc_array(count, sizeof(u32), GFP_KERNEL); + if (!handles) { + ret = -ENOMEM; +@@ -723,8 +725,6 @@ int drm_gem_objects_lookup(struct drm_file *filp, void __user *bo_handles, + } + + ret = objects_lookup(filp, handles, count, objs); +- *objs_out = objs; +- + out: + kvfree(handles); + return ret; +diff --git a/drivers/gpu/drm/drm_mipi_dsi.c b/drivers/gpu/drm/drm_mipi_dsi.c +index bd2498bbd74a..b99f96dcc6f1 100644 +--- a/drivers/gpu/drm/drm_mipi_dsi.c ++++ b/drivers/gpu/drm/drm_mipi_dsi.c +@@ -1029,11 +1029,11 @@ EXPORT_SYMBOL(mipi_dsi_dcs_set_pixel_format); + */ + int mipi_dsi_dcs_set_tear_scanline(struct mipi_dsi_device *dsi, u16 scanline) + { +- u8 payload[3] = { MIPI_DCS_SET_TEAR_SCANLINE, scanline >> 8, +- scanline & 0xff }; ++ u8 payload[2] = { scanline >> 8, scanline & 0xff }; + ssize_t err; + +- err = mipi_dsi_generic_write(dsi, payload, sizeof(payload)); ++ err = mipi_dsi_dcs_write(dsi, MIPI_DCS_SET_TEAR_SCANLINE, payload, ++ sizeof(payload)); + if (err < 0) + return err; + +diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c +index d47d1a8e0219..85de8551ce86 100644 +--- a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c ++++ b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c +@@ -713,7 +713,7 @@ int etnaviv_gpu_init(struct etnaviv_gpu *gpu) + ret = pm_runtime_get_sync(gpu->dev); + if (ret < 0) { + dev_err(gpu->dev, "Failed to enable GPU power domain\n"); +- return ret; ++ goto pm_put; + } + + etnaviv_hw_identify(gpu); +@@ -802,6 +802,7 @@ int etnaviv_gpu_init(struct etnaviv_gpu *gpu) + + fail: + pm_runtime_mark_last_busy(gpu->dev); ++pm_put: + pm_runtime_put_autosuspend(gpu->dev); + + return ret; +@@ -842,7 +843,7 @@ int etnaviv_gpu_debugfs(struct etnaviv_gpu *gpu, struct seq_file *m) + + ret = pm_runtime_get_sync(gpu->dev); + if (ret < 0) +- return ret; ++ goto pm_put; + + dma_lo = gpu_read(gpu, VIVS_FE_DMA_LOW); + dma_hi = gpu_read(gpu, VIVS_FE_DMA_HIGH); +@@ -965,6 +966,7 @@ int etnaviv_gpu_debugfs(struct etnaviv_gpu *gpu, struct seq_file *m) + ret = 0; + + pm_runtime_mark_last_busy(gpu->dev); ++pm_put: + pm_runtime_put_autosuspend(gpu->dev); + + return ret; +@@ -978,7 +980,7 @@ void etnaviv_gpu_recover_hang(struct etnaviv_gpu *gpu) + dev_err(gpu->dev, "recover hung GPU!\n"); + + if (pm_runtime_get_sync(gpu->dev) < 0) +- return; ++ goto pm_put; + + mutex_lock(&gpu->lock); + +@@ -997,6 +999,7 @@ void etnaviv_gpu_recover_hang(struct etnaviv_gpu *gpu) + + mutex_unlock(&gpu->lock); + pm_runtime_mark_last_busy(gpu->dev); ++pm_put: + pm_runtime_put_autosuspend(gpu->dev); + } + +@@ -1269,8 +1272,10 @@ struct dma_fence *etnaviv_gpu_submit(struct etnaviv_gem_submit *submit) + + if (!submit->runtime_resumed) { + ret = pm_runtime_get_sync(gpu->dev); +- if (ret < 0) ++ if (ret < 0) { ++ pm_runtime_put_noidle(gpu->dev); + return NULL; ++ } + submit->runtime_resumed = true; + } + +@@ -1287,6 +1292,7 @@ struct dma_fence *etnaviv_gpu_submit(struct etnaviv_gem_submit *submit) + ret = event_alloc(gpu, nr_events, event); + if (ret) { + DRM_ERROR("no free events\n"); ++ pm_runtime_put_noidle(gpu->dev); + return NULL; + } + +@@ -1457,7 +1463,7 @@ static int etnaviv_gpu_clk_enable(struct etnaviv_gpu *gpu) + if (gpu->clk_bus) { + ret = clk_prepare_enable(gpu->clk_bus); + if (ret) +- return ret; ++ goto disable_clk_reg; + } + + if (gpu->clk_core) { +@@ -1480,6 +1486,9 @@ disable_clk_core: + disable_clk_bus: + if (gpu->clk_bus) + clk_disable_unprepare(gpu->clk_bus); ++disable_clk_reg: ++ if (gpu->clk_reg) ++ clk_disable_unprepare(gpu->clk_reg); + + return ret; + } +diff --git a/drivers/gpu/drm/imx/dw_hdmi-imx.c b/drivers/gpu/drm/imx/dw_hdmi-imx.c +index f22cfbf9353e..2e12a4a3bfa1 100644 +--- a/drivers/gpu/drm/imx/dw_hdmi-imx.c ++++ b/drivers/gpu/drm/imx/dw_hdmi-imx.c +@@ -212,9 +212,8 @@ static int dw_hdmi_imx_bind(struct device *dev, struct device *master, + if (!pdev->dev.of_node) + return -ENODEV; + +- hdmi = devm_kzalloc(&pdev->dev, sizeof(*hdmi), GFP_KERNEL); +- if (!hdmi) +- return -ENOMEM; ++ hdmi = dev_get_drvdata(dev); ++ memset(hdmi, 0, sizeof(*hdmi)); + + match = of_match_node(dw_hdmi_imx_dt_ids, pdev->dev.of_node); + plat_data = match->data; +@@ -239,8 +238,6 @@ static int dw_hdmi_imx_bind(struct device *dev, struct device *master, + drm_encoder_init(drm, encoder, &dw_hdmi_imx_encoder_funcs, + DRM_MODE_ENCODER_TMDS, NULL); + +- platform_set_drvdata(pdev, hdmi); +- + hdmi->hdmi = dw_hdmi_bind(pdev, encoder, plat_data); + + /* +@@ -270,6 +267,14 @@ static const struct component_ops dw_hdmi_imx_ops = { + + static int dw_hdmi_imx_probe(struct platform_device *pdev) + { ++ struct imx_hdmi *hdmi; ++ ++ hdmi = devm_kzalloc(&pdev->dev, sizeof(*hdmi), GFP_KERNEL); ++ if (!hdmi) ++ return -ENOMEM; ++ ++ platform_set_drvdata(pdev, hdmi); ++ + return component_add(&pdev->dev, &dw_hdmi_imx_ops); + } + +diff --git a/drivers/gpu/drm/imx/imx-drm-core.c b/drivers/gpu/drm/imx/imx-drm-core.c +index da87c70e413b..881c36d0f16b 100644 +--- a/drivers/gpu/drm/imx/imx-drm-core.c ++++ b/drivers/gpu/drm/imx/imx-drm-core.c +@@ -281,9 +281,10 @@ static void imx_drm_unbind(struct device *dev) + + drm_kms_helper_poll_fini(drm); + ++ component_unbind_all(drm->dev, drm); ++ + drm_mode_config_cleanup(drm); + +- component_unbind_all(drm->dev, drm); + dev_set_drvdata(dev, NULL); + + drm_dev_put(drm); +diff --git a/drivers/gpu/drm/imx/imx-ldb.c b/drivers/gpu/drm/imx/imx-ldb.c +index 695f307f36b2..9af5a08d5490 100644 +--- a/drivers/gpu/drm/imx/imx-ldb.c ++++ b/drivers/gpu/drm/imx/imx-ldb.c +@@ -593,9 +593,8 @@ static int imx_ldb_bind(struct device *dev, struct device *master, void *data) + int ret; + int i; + +- imx_ldb = devm_kzalloc(dev, sizeof(*imx_ldb), GFP_KERNEL); +- if (!imx_ldb) +- return -ENOMEM; ++ imx_ldb = dev_get_drvdata(dev); ++ memset(imx_ldb, 0, sizeof(*imx_ldb)); + + imx_ldb->regmap = syscon_regmap_lookup_by_phandle(np, "gpr"); + if (IS_ERR(imx_ldb->regmap)) { +@@ -703,8 +702,6 @@ static int imx_ldb_bind(struct device *dev, struct device *master, void *data) + } + } + +- dev_set_drvdata(dev, imx_ldb); +- + return 0; + + free_child: +@@ -736,6 +733,14 @@ static const struct component_ops imx_ldb_ops = { + + static int imx_ldb_probe(struct platform_device *pdev) + { ++ struct imx_ldb *imx_ldb; ++ ++ imx_ldb = devm_kzalloc(&pdev->dev, sizeof(*imx_ldb), GFP_KERNEL); ++ if (!imx_ldb) ++ return -ENOMEM; ++ ++ platform_set_drvdata(pdev, imx_ldb); ++ + return component_add(&pdev->dev, &imx_ldb_ops); + } + +diff --git a/drivers/gpu/drm/imx/imx-tve.c b/drivers/gpu/drm/imx/imx-tve.c +index 5bbfaa2cd0f4..f91c3eb7697b 100644 +--- a/drivers/gpu/drm/imx/imx-tve.c ++++ b/drivers/gpu/drm/imx/imx-tve.c +@@ -494,6 +494,13 @@ static int imx_tve_register(struct drm_device *drm, struct imx_tve *tve) + return 0; + } + ++static void imx_tve_disable_regulator(void *data) ++{ ++ struct imx_tve *tve = data; ++ ++ regulator_disable(tve->dac_reg); ++} ++ + static bool imx_tve_readable_reg(struct device *dev, unsigned int reg) + { + return (reg % 4 == 0) && (reg <= 0xdc); +@@ -546,9 +553,8 @@ static int imx_tve_bind(struct device *dev, struct device *master, void *data) + int irq; + int ret; + +- tve = devm_kzalloc(dev, sizeof(*tve), GFP_KERNEL); +- if (!tve) +- return -ENOMEM; ++ tve = dev_get_drvdata(dev); ++ memset(tve, 0, sizeof(*tve)); + + tve->dev = dev; + spin_lock_init(&tve->lock); +@@ -618,6 +624,9 @@ static int imx_tve_bind(struct device *dev, struct device *master, void *data) + ret = regulator_enable(tve->dac_reg); + if (ret) + return ret; ++ ret = devm_add_action_or_reset(dev, imx_tve_disable_regulator, tve); ++ if (ret) ++ return ret; + } + + tve->clk = devm_clk_get(dev, "tve"); +@@ -659,27 +668,23 @@ static int imx_tve_bind(struct device *dev, struct device *master, void *data) + if (ret) + return ret; + +- dev_set_drvdata(dev, tve); +- + return 0; + } + +-static void imx_tve_unbind(struct device *dev, struct device *master, +- void *data) +-{ +- struct imx_tve *tve = dev_get_drvdata(dev); +- +- if (!IS_ERR(tve->dac_reg)) +- regulator_disable(tve->dac_reg); +-} +- + static const struct component_ops imx_tve_ops = { + .bind = imx_tve_bind, +- .unbind = imx_tve_unbind, + }; + + static int imx_tve_probe(struct platform_device *pdev) + { ++ struct imx_tve *tve; ++ ++ tve = devm_kzalloc(&pdev->dev, sizeof(*tve), GFP_KERNEL); ++ if (!tve) ++ return -ENOMEM; ++ ++ platform_set_drvdata(pdev, tve); ++ + return component_add(&pdev->dev, &imx_tve_ops); + } + +diff --git a/drivers/gpu/drm/imx/ipuv3-crtc.c b/drivers/gpu/drm/imx/ipuv3-crtc.c +index 63c0284f8b3c..2256c9789fc2 100644 +--- a/drivers/gpu/drm/imx/ipuv3-crtc.c ++++ b/drivers/gpu/drm/imx/ipuv3-crtc.c +@@ -438,21 +438,13 @@ static int ipu_drm_bind(struct device *dev, struct device *master, void *data) + struct ipu_client_platformdata *pdata = dev->platform_data; + struct drm_device *drm = data; + struct ipu_crtc *ipu_crtc; +- int ret; + +- ipu_crtc = devm_kzalloc(dev, sizeof(*ipu_crtc), GFP_KERNEL); +- if (!ipu_crtc) +- return -ENOMEM; ++ ipu_crtc = dev_get_drvdata(dev); ++ memset(ipu_crtc, 0, sizeof(*ipu_crtc)); + + ipu_crtc->dev = dev; + +- ret = ipu_crtc_init(ipu_crtc, pdata, drm); +- if (ret) +- return ret; +- +- dev_set_drvdata(dev, ipu_crtc); +- +- return 0; ++ return ipu_crtc_init(ipu_crtc, pdata, drm); + } + + static void ipu_drm_unbind(struct device *dev, struct device *master, +@@ -474,6 +466,7 @@ static const struct component_ops ipu_crtc_ops = { + static int ipu_drm_probe(struct platform_device *pdev) + { + struct device *dev = &pdev->dev; ++ struct ipu_crtc *ipu_crtc; + int ret; + + if (!dev->platform_data) +@@ -483,6 +476,12 @@ static int ipu_drm_probe(struct platform_device *pdev) + if (ret) + return ret; + ++ ipu_crtc = devm_kzalloc(dev, sizeof(*ipu_crtc), GFP_KERNEL); ++ if (!ipu_crtc) ++ return -ENOMEM; ++ ++ dev_set_drvdata(dev, ipu_crtc); ++ + return component_add(dev, &ipu_crtc_ops); + } + +diff --git a/drivers/gpu/drm/imx/parallel-display.c b/drivers/gpu/drm/imx/parallel-display.c +index e7ce17503ae1..be55548f352a 100644 +--- a/drivers/gpu/drm/imx/parallel-display.c ++++ b/drivers/gpu/drm/imx/parallel-display.c +@@ -204,9 +204,8 @@ static int imx_pd_bind(struct device *dev, struct device *master, void *data) + u32 bus_format = 0; + const char *fmt; + +- imxpd = devm_kzalloc(dev, sizeof(*imxpd), GFP_KERNEL); +- if (!imxpd) +- return -ENOMEM; ++ imxpd = dev_get_drvdata(dev); ++ memset(imxpd, 0, sizeof(*imxpd)); + + edidp = of_get_property(np, "edid", &imxpd->edid_len); + if (edidp) +@@ -236,8 +235,6 @@ static int imx_pd_bind(struct device *dev, struct device *master, void *data) + if (ret) + return ret; + +- dev_set_drvdata(dev, imxpd); +- + return 0; + } + +@@ -259,6 +256,14 @@ static const struct component_ops imx_pd_ops = { + + static int imx_pd_probe(struct platform_device *pdev) + { ++ struct imx_parallel_display *imxpd; ++ ++ imxpd = devm_kzalloc(&pdev->dev, sizeof(*imxpd), GFP_KERNEL); ++ if (!imxpd) ++ return -ENOMEM; ++ ++ platform_set_drvdata(pdev, imxpd); ++ + return component_add(&pdev->dev, &imx_pd_ops); + } + +diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gmu.c b/drivers/gpu/drm/msm/adreno/a6xx_gmu.c +index e62b286947a7..9ea748667fab 100644 +--- a/drivers/gpu/drm/msm/adreno/a6xx_gmu.c ++++ b/drivers/gpu/drm/msm/adreno/a6xx_gmu.c +@@ -713,10 +713,19 @@ int a6xx_gmu_resume(struct a6xx_gpu *a6xx_gpu) + /* Turn on the resources */ + pm_runtime_get_sync(gmu->dev); + ++ /* ++ * "enable" the GX power domain which won't actually do anything but it ++ * will make sure that the refcounting is correct in case we need to ++ * bring down the GX after a GMU failure ++ */ ++ if (!IS_ERR_OR_NULL(gmu->gxpd)) ++ pm_runtime_get_sync(gmu->gxpd); ++ + /* Use a known rate to bring up the GMU */ + clk_set_rate(gmu->core_clk, 200000000); + ret = clk_bulk_prepare_enable(gmu->nr_clocks, gmu->clocks); + if (ret) { ++ pm_runtime_put(gmu->gxpd); + pm_runtime_put(gmu->dev); + return ret; + } +@@ -752,19 +761,12 @@ int a6xx_gmu_resume(struct a6xx_gpu *a6xx_gpu) + /* Set the GPU to the highest power frequency */ + __a6xx_gmu_set_freq(gmu, gmu->nr_gpu_freqs - 1); + +- /* +- * "enable" the GX power domain which won't actually do anything but it +- * will make sure that the refcounting is correct in case we need to +- * bring down the GX after a GMU failure +- */ +- if (!IS_ERR_OR_NULL(gmu->gxpd)) +- pm_runtime_get(gmu->gxpd); +- + out: + /* On failure, shut down the GMU to leave it in a good state */ + if (ret) { + disable_irq(gmu->gmu_irq); + a6xx_rpmh_stop(gmu); ++ pm_runtime_put(gmu->gxpd); + pm_runtime_put(gmu->dev); + } + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c +index ce59adff06aa..36c85c05b7cf 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c +@@ -381,7 +381,7 @@ static void dpu_crtc_frame_event_cb(void *data, u32 event) + spin_unlock_irqrestore(&dpu_crtc->spin_lock, flags); + + if (!fevent) { +- DRM_ERROR("crtc%d event %d overflow\n", crtc->base.id, event); ++ DRM_ERROR_RATELIMITED("crtc%d event %d overflow\n", crtc->base.id, event); + return; + } + +diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c +index 5a6a79fbc9d6..d92a0ffe2a76 100644 +--- a/drivers/gpu/drm/msm/msm_gem.c ++++ b/drivers/gpu/drm/msm/msm_gem.c +@@ -977,10 +977,8 @@ int msm_gem_new_handle(struct drm_device *dev, struct drm_file *file, + + static int msm_gem_new_impl(struct drm_device *dev, + uint32_t size, uint32_t flags, +- struct drm_gem_object **obj, +- bool struct_mutex_locked) ++ struct drm_gem_object **obj) + { +- struct msm_drm_private *priv = dev->dev_private; + struct msm_gem_object *msm_obj; + + switch (flags & MSM_BO_CACHE_MASK) { +@@ -1006,15 +1004,6 @@ static int msm_gem_new_impl(struct drm_device *dev, + INIT_LIST_HEAD(&msm_obj->submit_entry); + INIT_LIST_HEAD(&msm_obj->vmas); + +- if (struct_mutex_locked) { +- WARN_ON(!mutex_is_locked(&dev->struct_mutex)); +- list_add_tail(&msm_obj->mm_list, &priv->inactive_list); +- } else { +- mutex_lock(&dev->struct_mutex); +- list_add_tail(&msm_obj->mm_list, &priv->inactive_list); +- mutex_unlock(&dev->struct_mutex); +- } +- + *obj = &msm_obj->base; + + return 0; +@@ -1024,6 +1013,7 @@ static struct drm_gem_object *_msm_gem_new(struct drm_device *dev, + uint32_t size, uint32_t flags, bool struct_mutex_locked) + { + struct msm_drm_private *priv = dev->dev_private; ++ struct msm_gem_object *msm_obj; + struct drm_gem_object *obj = NULL; + bool use_vram = false; + int ret; +@@ -1044,14 +1034,15 @@ static struct drm_gem_object *_msm_gem_new(struct drm_device *dev, + if (size == 0) + return ERR_PTR(-EINVAL); + +- ret = msm_gem_new_impl(dev, size, flags, &obj, struct_mutex_locked); ++ ret = msm_gem_new_impl(dev, size, flags, &obj); + if (ret) + goto fail; + ++ msm_obj = to_msm_bo(obj); ++ + if (use_vram) { + struct msm_gem_vma *vma; + struct page **pages; +- struct msm_gem_object *msm_obj = to_msm_bo(obj); + + mutex_lock(&msm_obj->lock); + +@@ -1086,6 +1077,15 @@ static struct drm_gem_object *_msm_gem_new(struct drm_device *dev, + mapping_set_gfp_mask(obj->filp->f_mapping, GFP_HIGHUSER); + } + ++ if (struct_mutex_locked) { ++ WARN_ON(!mutex_is_locked(&dev->struct_mutex)); ++ list_add_tail(&msm_obj->mm_list, &priv->inactive_list); ++ } else { ++ mutex_lock(&dev->struct_mutex); ++ list_add_tail(&msm_obj->mm_list, &priv->inactive_list); ++ mutex_unlock(&dev->struct_mutex); ++ } ++ + return obj; + + fail: +@@ -1108,6 +1108,7 @@ struct drm_gem_object *msm_gem_new(struct drm_device *dev, + struct drm_gem_object *msm_gem_import(struct drm_device *dev, + struct dma_buf *dmabuf, struct sg_table *sgt) + { ++ struct msm_drm_private *priv = dev->dev_private; + struct msm_gem_object *msm_obj; + struct drm_gem_object *obj; + uint32_t size; +@@ -1121,7 +1122,7 @@ struct drm_gem_object *msm_gem_import(struct drm_device *dev, + + size = PAGE_ALIGN(dmabuf->size); + +- ret = msm_gem_new_impl(dev, size, MSM_BO_WC, &obj, false); ++ ret = msm_gem_new_impl(dev, size, MSM_BO_WC, &obj); + if (ret) + goto fail; + +@@ -1146,6 +1147,11 @@ struct drm_gem_object *msm_gem_import(struct drm_device *dev, + } + + mutex_unlock(&msm_obj->lock); ++ ++ mutex_lock(&dev->struct_mutex); ++ list_add_tail(&msm_obj->mm_list, &priv->inactive_list); ++ mutex_unlock(&dev->struct_mutex); ++ + return obj; + + fail: +diff --git a/drivers/gpu/drm/nouveau/dispnv50/head.c b/drivers/gpu/drm/nouveau/dispnv50/head.c +index c9692df2b76c..46578108a430 100644 +--- a/drivers/gpu/drm/nouveau/dispnv50/head.c ++++ b/drivers/gpu/drm/nouveau/dispnv50/head.c +@@ -83,18 +83,20 @@ nv50_head_atomic_check_dither(struct nv50_head_atom *armh, + { + u32 mode = 0x00; + +- if (asyc->dither.mode == DITHERING_MODE_AUTO) { +- if (asyh->base.depth > asyh->or.bpc * 3) +- mode = DITHERING_MODE_DYNAMIC2X2; +- } else { +- mode = asyc->dither.mode; +- } ++ if (asyc->dither.mode) { ++ if (asyc->dither.mode == DITHERING_MODE_AUTO) { ++ if (asyh->base.depth > asyh->or.bpc * 3) ++ mode = DITHERING_MODE_DYNAMIC2X2; ++ } else { ++ mode = asyc->dither.mode; ++ } + +- if (asyc->dither.depth == DITHERING_DEPTH_AUTO) { +- if (asyh->or.bpc >= 8) +- mode |= DITHERING_DEPTH_8BPC; +- } else { +- mode |= asyc->dither.depth; ++ if (asyc->dither.depth == DITHERING_DEPTH_AUTO) { ++ if (asyh->or.bpc >= 8) ++ mode |= DITHERING_DEPTH_8BPC; ++ } else { ++ mode |= asyc->dither.depth; ++ } + } + + asyh->dither.enable = mode; +diff --git a/drivers/gpu/drm/nouveau/nouveau_debugfs.c b/drivers/gpu/drm/nouveau/nouveau_debugfs.c +index 7dfbbbc1beea..5c314f135dd1 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_debugfs.c ++++ b/drivers/gpu/drm/nouveau/nouveau_debugfs.c +@@ -54,8 +54,10 @@ nouveau_debugfs_strap_peek(struct seq_file *m, void *data) + int ret; + + ret = pm_runtime_get_sync(drm->dev->dev); +- if (ret < 0 && ret != -EACCES) ++ if (ret < 0 && ret != -EACCES) { ++ pm_runtime_put_autosuspend(drm->dev->dev); + return ret; ++ } + + seq_printf(m, "0x%08x\n", + nvif_rd32(&drm->client.device.object, 0x101000)); +diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c +index b1beed40e746..5347e5bdee8c 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_drm.c ++++ b/drivers/gpu/drm/nouveau/nouveau_drm.c +@@ -1052,8 +1052,10 @@ nouveau_drm_open(struct drm_device *dev, struct drm_file *fpriv) + + /* need to bring up power immediately if opening device */ + ret = pm_runtime_get_sync(dev->dev); +- if (ret < 0 && ret != -EACCES) ++ if (ret < 0 && ret != -EACCES) { ++ pm_runtime_put_autosuspend(dev->dev); + return ret; ++ } + + get_task_comm(tmpname, current); + snprintf(name, sizeof(name), "%s[%d]", tmpname, pid_nr(fpriv->pid)); +@@ -1135,8 +1137,10 @@ nouveau_drm_ioctl(struct file *file, unsigned int cmd, unsigned long arg) + long ret; + + ret = pm_runtime_get_sync(dev->dev); +- if (ret < 0 && ret != -EACCES) ++ if (ret < 0 && ret != -EACCES) { ++ pm_runtime_put_autosuspend(dev->dev); + return ret; ++ } + + switch (_IOC_NR(cmd) - DRM_COMMAND_BASE) { + case DRM_NOUVEAU_NVIF: +diff --git a/drivers/gpu/drm/nouveau/nouveau_gem.c b/drivers/gpu/drm/nouveau/nouveau_gem.c +index 1324c19f4e5c..fbfe25422774 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_gem.c ++++ b/drivers/gpu/drm/nouveau/nouveau_gem.c +@@ -45,8 +45,10 @@ nouveau_gem_object_del(struct drm_gem_object *gem) + int ret; + + ret = pm_runtime_get_sync(dev); +- if (WARN_ON(ret < 0 && ret != -EACCES)) ++ if (WARN_ON(ret < 0 && ret != -EACCES)) { ++ pm_runtime_put_autosuspend(dev); + return; ++ } + + if (gem->import_attach) + drm_prime_gem_destroy(gem, nvbo->bo.sg); +diff --git a/drivers/gpu/drm/nouveau/nouveau_sgdma.c b/drivers/gpu/drm/nouveau/nouveau_sgdma.c +index feaac908efed..34403b810dba 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_sgdma.c ++++ b/drivers/gpu/drm/nouveau/nouveau_sgdma.c +@@ -96,12 +96,9 @@ nouveau_sgdma_create_ttm(struct ttm_buffer_object *bo, uint32_t page_flags) + else + nvbe->ttm.ttm.func = &nv50_sgdma_backend; + +- if (ttm_dma_tt_init(&nvbe->ttm, bo, page_flags)) +- /* +- * A failing ttm_dma_tt_init() will call ttm_tt_destroy() +- * and thus our nouveau_sgdma_destroy() hook, so we don't need +- * to free nvbe here. +- */ ++ if (ttm_dma_tt_init(&nvbe->ttm, bo, page_flags)) { ++ kfree(nvbe); + return NULL; ++ } + return &nvbe->ttm.ttm; + } +diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c +index 8abb31f83ffc..6d9656323a3f 100644 +--- a/drivers/gpu/drm/panel/panel-simple.c ++++ b/drivers/gpu/drm/panel/panel-simple.c +@@ -1935,7 +1935,7 @@ static const struct drm_display_mode lg_lb070wv8_mode = { + static const struct panel_desc lg_lb070wv8 = { + .modes = &lg_lb070wv8_mode, + .num_modes = 1, +- .bpc = 16, ++ .bpc = 8, + .size = { + .width = 151, + .height = 91, +diff --git a/drivers/gpu/drm/radeon/ci_dpm.c b/drivers/gpu/drm/radeon/ci_dpm.c +index f9685cce1652..1e62e7bbf1b1 100644 +--- a/drivers/gpu/drm/radeon/ci_dpm.c ++++ b/drivers/gpu/drm/radeon/ci_dpm.c +@@ -4366,7 +4366,7 @@ static int ci_set_mc_special_registers(struct radeon_device *rdev, + table->mc_reg_table_entry[k].mc_data[j] |= 0x100; + } + j++; +- if (j > SMU7_DISCRETE_MC_REGISTER_ARRAY_SIZE) ++ if (j >= SMU7_DISCRETE_MC_REGISTER_ARRAY_SIZE) + return -EINVAL; + + if (!pi->mem_gddr5) { +diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c +index 0826efd9b5f5..f9f74150d0d7 100644 +--- a/drivers/gpu/drm/radeon/radeon_display.c ++++ b/drivers/gpu/drm/radeon/radeon_display.c +@@ -631,8 +631,10 @@ radeon_crtc_set_config(struct drm_mode_set *set, + dev = set->crtc->dev; + + ret = pm_runtime_get_sync(dev->dev); +- if (ret < 0) ++ if (ret < 0) { ++ pm_runtime_put_autosuspend(dev->dev); + return ret; ++ } + + ret = drm_crtc_helper_set_config(set, ctx); + +diff --git a/drivers/gpu/drm/radeon/radeon_drv.c b/drivers/gpu/drm/radeon/radeon_drv.c +index 6128792ab883..c2573096d43c 100644 +--- a/drivers/gpu/drm/radeon/radeon_drv.c ++++ b/drivers/gpu/drm/radeon/radeon_drv.c +@@ -174,12 +174,7 @@ int radeon_no_wb; + int radeon_modeset = -1; + int radeon_dynclks = -1; + int radeon_r4xx_atom = 0; +-#ifdef __powerpc__ +-/* Default to PCI on PowerPC (fdo #95017) */ + int radeon_agpmode = -1; +-#else +-int radeon_agpmode = 0; +-#endif + int radeon_vram_limit = 0; + int radeon_gart_size = -1; /* auto */ + int radeon_benchmarking = 0; +@@ -555,8 +550,10 @@ long radeon_drm_ioctl(struct file *filp, + long ret; + dev = file_priv->minor->dev; + ret = pm_runtime_get_sync(dev->dev); +- if (ret < 0) ++ if (ret < 0) { ++ pm_runtime_put_autosuspend(dev->dev); + return ret; ++ } + + ret = drm_ioctl(filp, cmd, arg); + +diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c +index 2bb0187c5bc7..709c4ef5e7d5 100644 +--- a/drivers/gpu/drm/radeon/radeon_kms.c ++++ b/drivers/gpu/drm/radeon/radeon_kms.c +@@ -638,8 +638,10 @@ int radeon_driver_open_kms(struct drm_device *dev, struct drm_file *file_priv) + file_priv->driver_priv = NULL; + + r = pm_runtime_get_sync(dev->dev); +- if (r < 0) ++ if (r < 0) { ++ pm_runtime_put_autosuspend(dev->dev); + return r; ++ } + + /* new gpu have virtual address space support */ + if (rdev->family >= CHIP_CAYMAN) { +diff --git a/drivers/gpu/drm/stm/ltdc.c b/drivers/gpu/drm/stm/ltdc.c +index 3ab4fbf8eb0d..51571f7246ab 100644 +--- a/drivers/gpu/drm/stm/ltdc.c ++++ b/drivers/gpu/drm/stm/ltdc.c +@@ -424,9 +424,12 @@ static void ltdc_crtc_atomic_enable(struct drm_crtc *crtc, + struct drm_crtc_state *old_state) + { + struct ltdc_device *ldev = crtc_to_ltdc(crtc); ++ struct drm_device *ddev = crtc->dev; + + DRM_DEBUG_DRIVER("\n"); + ++ pm_runtime_get_sync(ddev->dev); ++ + /* Sets the background color value */ + reg_write(ldev->regs, LTDC_BCCR, BCCR_BCBLACK); + +diff --git a/drivers/gpu/drm/tilcdc/tilcdc_panel.c b/drivers/gpu/drm/tilcdc/tilcdc_panel.c +index 5584e656b857..8c4fd1aa4c2d 100644 +--- a/drivers/gpu/drm/tilcdc/tilcdc_panel.c ++++ b/drivers/gpu/drm/tilcdc/tilcdc_panel.c +@@ -143,12 +143,16 @@ static int panel_connector_get_modes(struct drm_connector *connector) + int i; + + for (i = 0; i < timings->num_timings; i++) { +- struct drm_display_mode *mode = drm_mode_create(dev); ++ struct drm_display_mode *mode; + struct videomode vm; + + if (videomode_from_timings(timings, &vm, i)) + break; + ++ mode = drm_mode_create(dev); ++ if (!mode) ++ break; ++ + drm_display_mode_from_videomode(&vm, mode); + + mode->type = DRM_MODE_TYPE_DRIVER; +diff --git a/drivers/gpu/drm/ttm/ttm_tt.c b/drivers/gpu/drm/ttm/ttm_tt.c +index e0e9b4f69db6..c770ec7e9e8b 100644 +--- a/drivers/gpu/drm/ttm/ttm_tt.c ++++ b/drivers/gpu/drm/ttm/ttm_tt.c +@@ -241,7 +241,6 @@ int ttm_tt_init(struct ttm_tt *ttm, struct ttm_buffer_object *bo, + ttm_tt_init_fields(ttm, bo, page_flags); + + if (ttm_tt_alloc_page_directory(ttm)) { +- ttm_tt_destroy(ttm); + pr_err("Failed allocating page table\n"); + return -ENOMEM; + } +@@ -265,7 +264,6 @@ int ttm_dma_tt_init(struct ttm_dma_tt *ttm_dma, struct ttm_buffer_object *bo, + + INIT_LIST_HEAD(&ttm_dma->pages_list); + if (ttm_dma_tt_alloc_page_directory(ttm_dma)) { +- ttm_tt_destroy(ttm); + pr_err("Failed allocating page table\n"); + return -ENOMEM; + } +@@ -287,7 +285,6 @@ int ttm_sg_tt_init(struct ttm_dma_tt *ttm_dma, struct ttm_buffer_object *bo, + else + ret = ttm_dma_tt_alloc_page_directory(ttm_dma); + if (ret) { +- ttm_tt_destroy(ttm); + pr_err("Failed allocating page table\n"); + return -ENOMEM; + } +diff --git a/drivers/gpu/host1x/debug.c b/drivers/gpu/host1x/debug.c +index c0392672a842..1b4997bda1c7 100644 +--- a/drivers/gpu/host1x/debug.c ++++ b/drivers/gpu/host1x/debug.c +@@ -16,6 +16,8 @@ + #include "debug.h" + #include "channel.h" + ++static DEFINE_MUTEX(debug_lock); ++ + unsigned int host1x_debug_trace_cmdbuf; + + static pid_t host1x_debug_force_timeout_pid; +@@ -52,12 +54,14 @@ static int show_channel(struct host1x_channel *ch, void *data, bool show_fifo) + struct output *o = data; + + mutex_lock(&ch->cdma.lock); ++ mutex_lock(&debug_lock); + + if (show_fifo) + host1x_hw_show_channel_fifo(m, ch, o); + + host1x_hw_show_channel_cdma(m, ch, o); + ++ mutex_unlock(&debug_lock); + mutex_unlock(&ch->cdma.lock); + + return 0; +diff --git a/drivers/gpu/ipu-v3/ipu-common.c b/drivers/gpu/ipu-v3/ipu-common.c +index ee2a025e54cf..b3dae9ec1a38 100644 +--- a/drivers/gpu/ipu-v3/ipu-common.c ++++ b/drivers/gpu/ipu-v3/ipu-common.c +@@ -124,6 +124,8 @@ enum ipu_color_space ipu_pixelformat_to_colorspace(u32 pixelformat) + case V4L2_PIX_FMT_RGBX32: + case V4L2_PIX_FMT_ARGB32: + case V4L2_PIX_FMT_XRGB32: ++ case V4L2_PIX_FMT_RGB32: ++ case V4L2_PIX_FMT_BGR32: + return IPUV3_COLORSPACE_RGB; + default: + return IPUV3_COLORSPACE_UNKNOWN; +diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c +index dea9cc65bf80..e8641ce677e4 100644 +--- a/drivers/hid/hid-input.c ++++ b/drivers/hid/hid-input.c +@@ -350,13 +350,13 @@ static int hidinput_query_battery_capacity(struct hid_device *dev) + u8 *buf; + int ret; + +- buf = kmalloc(2, GFP_KERNEL); ++ buf = kmalloc(4, GFP_KERNEL); + if (!buf) + return -ENOMEM; + +- ret = hid_hw_raw_request(dev, dev->battery_report_id, buf, 2, ++ ret = hid_hw_raw_request(dev, dev->battery_report_id, buf, 4, + dev->battery_report_type, HID_REQ_GET_REPORT); +- if (ret != 2) { ++ if (ret < 2) { + kfree(buf); + return -ENODATA; + } +diff --git a/drivers/hwtracing/coresight/coresight-tmc-etf.c b/drivers/hwtracing/coresight/coresight-tmc-etf.c +index 36cce2bfb744..6375504ba8b0 100644 +--- a/drivers/hwtracing/coresight/coresight-tmc-etf.c ++++ b/drivers/hwtracing/coresight/coresight-tmc-etf.c +@@ -639,15 +639,14 @@ int tmc_read_unprepare_etb(struct tmc_drvdata *drvdata) + + spin_lock_irqsave(&drvdata->spinlock, flags); + +- /* There is no point in reading a TMC in HW FIFO mode */ +- mode = readl_relaxed(drvdata->base + TMC_MODE); +- if (mode != TMC_MODE_CIRCULAR_BUFFER) { +- spin_unlock_irqrestore(&drvdata->spinlock, flags); +- return -EINVAL; +- } +- + /* Re-enable the TMC if need be */ + if (drvdata->mode == CS_MODE_SYSFS) { ++ /* There is no point in reading a TMC in HW FIFO mode */ ++ mode = readl_relaxed(drvdata->base + TMC_MODE); ++ if (mode != TMC_MODE_CIRCULAR_BUFFER) { ++ spin_unlock_irqrestore(&drvdata->spinlock, flags); ++ return -EINVAL; ++ } + /* + * The trace run will continue with the same allocated trace + * buffer. As such zero-out the buffer so that we don't end +diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c +index 10ae6c6eab0a..59dc9f3cfb37 100644 +--- a/drivers/infiniband/core/device.c ++++ b/drivers/infiniband/core/device.c +@@ -1330,6 +1330,10 @@ out: + return ret; + } + ++static void prevent_dealloc_device(struct ib_device *ib_dev) ++{ ++} ++ + /** + * ib_register_device - Register an IB device with IB core + * @device:Device to register +@@ -1397,11 +1401,11 @@ int ib_register_device(struct ib_device *device, const char *name) + * possibility for a parallel unregistration along with this + * error flow. Since we have a refcount here we know any + * parallel flow is stopped in disable_device and will see the +- * NULL pointers, causing the responsibility to ++ * special dealloc_driver pointer, causing the responsibility to + * ib_dealloc_device() to revert back to this thread. + */ + dealloc_fn = device->ops.dealloc_driver; +- device->ops.dealloc_driver = NULL; ++ device->ops.dealloc_driver = prevent_dealloc_device; + ib_device_put(device); + __ib_unregister_device(device); + device->ops.dealloc_driver = dealloc_fn; +@@ -1449,7 +1453,8 @@ static void __ib_unregister_device(struct ib_device *ib_dev) + * Drivers using the new flow may not call ib_dealloc_device except + * in error unwind prior to registration success. + */ +- if (ib_dev->ops.dealloc_driver) { ++ if (ib_dev->ops.dealloc_driver && ++ ib_dev->ops.dealloc_driver != prevent_dealloc_device) { + WARN_ON(kref_read(&ib_dev->dev.kobj.kref) <= 1); + ib_dealloc_device(ib_dev); + } +diff --git a/drivers/infiniband/core/nldev.c b/drivers/infiniband/core/nldev.c +index 244ebf285fc3..e4905d9fecb0 100644 +--- a/drivers/infiniband/core/nldev.c ++++ b/drivers/infiniband/core/nldev.c +@@ -702,9 +702,6 @@ static int fill_stat_counter_qps(struct sk_buff *msg, + continue; + + qp = container_of(res, struct ib_qp, res); +- if (qp->qp_type == IB_QPT_RAW_PACKET && !capable(CAP_NET_RAW)) +- continue; +- + if (!qp->counter || (qp->counter->id != counter->id)) + continue; + +diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c +index 6c4093d0a91d..d4815f29cfd2 100644 +--- a/drivers/infiniband/core/verbs.c ++++ b/drivers/infiniband/core/verbs.c +@@ -1648,7 +1648,7 @@ static int _ib_modify_qp(struct ib_qp *qp, struct ib_qp_attr *attr, + if (!(rdma_protocol_ib(qp->device, + attr->alt_ah_attr.port_num) && + rdma_protocol_ib(qp->device, port))) { +- ret = EINVAL; ++ ret = -EINVAL; + goto out; + } + } +diff --git a/drivers/infiniband/hw/qedr/qedr.h b/drivers/infiniband/hw/qedr/qedr.h +index 8e927f6c1520..ed56df319d2d 100644 +--- a/drivers/infiniband/hw/qedr/qedr.h ++++ b/drivers/infiniband/hw/qedr/qedr.h +@@ -349,10 +349,10 @@ struct qedr_srq_hwq_info { + u32 wqe_prod; + u32 sge_prod; + u32 wr_prod_cnt; +- u32 wr_cons_cnt; ++ atomic_t wr_cons_cnt; + u32 num_elems; + +- u32 *virt_prod_pair_addr; ++ struct rdma_srq_producers *virt_prod_pair_addr; + dma_addr_t phy_prod_pair_addr; + }; + +diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c +index 8b4240c1cc76..16a994fd7d0a 100644 +--- a/drivers/infiniband/hw/qedr/verbs.c ++++ b/drivers/infiniband/hw/qedr/verbs.c +@@ -3460,7 +3460,7 @@ static u32 qedr_srq_elem_left(struct qedr_srq_hwq_info *hw_srq) + * count and consumer count and subtract it from max + * work request supported so that we get elements left. + */ +- used = hw_srq->wr_prod_cnt - hw_srq->wr_cons_cnt; ++ used = hw_srq->wr_prod_cnt - (u32)atomic_read(&hw_srq->wr_cons_cnt); + + return hw_srq->max_wr - used; + } +@@ -3475,7 +3475,6 @@ int qedr_post_srq_recv(struct ib_srq *ibsrq, const struct ib_recv_wr *wr, + unsigned long flags; + int status = 0; + u32 num_sge; +- u32 offset; + + spin_lock_irqsave(&srq->lock, flags); + +@@ -3488,7 +3487,8 @@ int qedr_post_srq_recv(struct ib_srq *ibsrq, const struct ib_recv_wr *wr, + if (!qedr_srq_elem_left(hw_srq) || + wr->num_sge > srq->hw_srq.max_sges) { + DP_ERR(dev, "Can't post WR (%d,%d) || (%d > %d)\n", +- hw_srq->wr_prod_cnt, hw_srq->wr_cons_cnt, ++ hw_srq->wr_prod_cnt, ++ atomic_read(&hw_srq->wr_cons_cnt), + wr->num_sge, srq->hw_srq.max_sges); + status = -ENOMEM; + *bad_wr = wr; +@@ -3522,22 +3522,20 @@ int qedr_post_srq_recv(struct ib_srq *ibsrq, const struct ib_recv_wr *wr, + hw_srq->sge_prod++; + } + +- /* Flush WQE and SGE information before ++ /* Update WQE and SGE information before + * updating producer. + */ +- wmb(); ++ dma_wmb(); + + /* SRQ producer is 8 bytes. Need to update SGE producer index + * in first 4 bytes and need to update WQE producer in + * next 4 bytes. + */ +- *srq->hw_srq.virt_prod_pair_addr = hw_srq->sge_prod; +- offset = offsetof(struct rdma_srq_producers, wqe_prod); +- *((u8 *)srq->hw_srq.virt_prod_pair_addr + offset) = +- hw_srq->wqe_prod; ++ srq->hw_srq.virt_prod_pair_addr->sge_prod = hw_srq->sge_prod; ++ /* Make sure sge producer is updated first */ ++ dma_wmb(); ++ srq->hw_srq.virt_prod_pair_addr->wqe_prod = hw_srq->wqe_prod; + +- /* Flush producer after updating it. */ +- wmb(); + wr = wr->next; + } + +@@ -3956,7 +3954,7 @@ static int process_resp_one_srq(struct qedr_dev *dev, struct qedr_qp *qp, + } else { + __process_resp_one(dev, qp, cq, wc, resp, wr_id); + } +- srq->hw_srq.wr_cons_cnt++; ++ atomic_inc(&srq->hw_srq.wr_cons_cnt); + + return 1; + } +diff --git a/drivers/infiniband/sw/rxe/rxe_recv.c b/drivers/infiniband/sw/rxe/rxe_recv.c +index 831ad578a7b2..46e111c218fd 100644 +--- a/drivers/infiniband/sw/rxe/rxe_recv.c ++++ b/drivers/infiniband/sw/rxe/rxe_recv.c +@@ -330,10 +330,14 @@ err1: + + static int rxe_match_dgid(struct rxe_dev *rxe, struct sk_buff *skb) + { ++ struct rxe_pkt_info *pkt = SKB_TO_PKT(skb); + const struct ib_gid_attr *gid_attr; + union ib_gid dgid; + union ib_gid *pdgid; + ++ if (pkt->mask & RXE_LOOPBACK_MASK) ++ return 0; ++ + if (skb->protocol == htons(ETH_P_IP)) { + ipv6_addr_set_v4mapped(ip_hdr(skb)->daddr, + (struct in6_addr *)&dgid); +@@ -366,7 +370,7 @@ void rxe_rcv(struct sk_buff *skb) + if (unlikely(skb->len < pkt->offset + RXE_BTH_BYTES)) + goto drop; + +- if (unlikely(rxe_match_dgid(rxe, skb) < 0)) { ++ if (rxe_match_dgid(rxe, skb) < 0) { + pr_warn_ratelimited("failed matching dgid\n"); + goto drop; + } +diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.c b/drivers/infiniband/sw/rxe/rxe_verbs.c +index 623129f27f5a..71358b0b8910 100644 +--- a/drivers/infiniband/sw/rxe/rxe_verbs.c ++++ b/drivers/infiniband/sw/rxe/rxe_verbs.c +@@ -679,6 +679,7 @@ static int rxe_post_send_kernel(struct rxe_qp *qp, const struct ib_send_wr *wr, + unsigned int mask; + unsigned int length = 0; + int i; ++ struct ib_send_wr *next; + + while (wr) { + mask = wr_opcode_mask(wr->opcode, qp); +@@ -695,6 +696,8 @@ static int rxe_post_send_kernel(struct rxe_qp *qp, const struct ib_send_wr *wr, + break; + } + ++ next = wr->next; ++ + length = 0; + for (i = 0; i < wr->num_sge; i++) + length += wr->sg_list[i].length; +@@ -705,7 +708,7 @@ static int rxe_post_send_kernel(struct rxe_qp *qp, const struct ib_send_wr *wr, + *bad_wr = wr; + break; + } +- wr = wr->next; ++ wr = next; + } + + rxe_run_task(&qp->req.task, 1); +diff --git a/drivers/iommu/intel_irq_remapping.c b/drivers/iommu/intel_irq_remapping.c +index 982d796b686b..6bfb283e6f28 100644 +--- a/drivers/iommu/intel_irq_remapping.c ++++ b/drivers/iommu/intel_irq_remapping.c +@@ -628,13 +628,21 @@ out_free_table: + + static void intel_teardown_irq_remapping(struct intel_iommu *iommu) + { ++ struct fwnode_handle *fn; ++ + if (iommu && iommu->ir_table) { + if (iommu->ir_msi_domain) { ++ fn = iommu->ir_msi_domain->fwnode; ++ + irq_domain_remove(iommu->ir_msi_domain); ++ irq_domain_free_fwnode(fn); + iommu->ir_msi_domain = NULL; + } + if (iommu->ir_domain) { ++ fn = iommu->ir_domain->fwnode; ++ + irq_domain_remove(iommu->ir_domain); ++ irq_domain_free_fwnode(fn); + iommu->ir_domain = NULL; + } + free_pages((unsigned long)iommu->ir_table->base, +diff --git a/drivers/irqchip/irq-mtk-sysirq.c b/drivers/irqchip/irq-mtk-sysirq.c +index 73eae5966a40..6ff98b87e5c0 100644 +--- a/drivers/irqchip/irq-mtk-sysirq.c ++++ b/drivers/irqchip/irq-mtk-sysirq.c +@@ -15,7 +15,7 @@ + #include + + struct mtk_sysirq_chip_data { +- spinlock_t lock; ++ raw_spinlock_t lock; + u32 nr_intpol_bases; + void __iomem **intpol_bases; + u32 *intpol_words; +@@ -37,7 +37,7 @@ static int mtk_sysirq_set_type(struct irq_data *data, unsigned int type) + reg_index = chip_data->which_word[hwirq]; + offset = hwirq & 0x1f; + +- spin_lock_irqsave(&chip_data->lock, flags); ++ raw_spin_lock_irqsave(&chip_data->lock, flags); + value = readl_relaxed(base + reg_index * 4); + if (type == IRQ_TYPE_LEVEL_LOW || type == IRQ_TYPE_EDGE_FALLING) { + if (type == IRQ_TYPE_LEVEL_LOW) +@@ -53,7 +53,7 @@ static int mtk_sysirq_set_type(struct irq_data *data, unsigned int type) + + data = data->parent_data; + ret = data->chip->irq_set_type(data, type); +- spin_unlock_irqrestore(&chip_data->lock, flags); ++ raw_spin_unlock_irqrestore(&chip_data->lock, flags); + return ret; + } + +@@ -212,7 +212,7 @@ static int __init mtk_sysirq_of_init(struct device_node *node, + ret = -ENOMEM; + goto out_free_which_word; + } +- spin_lock_init(&chip_data->lock); ++ raw_spin_lock_init(&chip_data->lock); + + return 0; + +diff --git a/drivers/irqchip/irq-ti-sci-inta.c b/drivers/irqchip/irq-ti-sci-inta.c +index fa7488863bd0..0a35499c4672 100644 +--- a/drivers/irqchip/irq-ti-sci-inta.c ++++ b/drivers/irqchip/irq-ti-sci-inta.c +@@ -571,7 +571,7 @@ static int ti_sci_inta_irq_domain_probe(struct platform_device *pdev) + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); + inta->base = devm_ioremap_resource(dev, res); + if (IS_ERR(inta->base)) +- return -ENODEV; ++ return PTR_ERR(inta->base); + + domain = irq_domain_add_linear(dev_of_node(dev), + ti_sci_get_num_resources(inta->vint), +diff --git a/drivers/leds/led-class.c b/drivers/leds/led-class.c +index d3e83c33783e..0a4823d9797a 100644 +--- a/drivers/leds/led-class.c ++++ b/drivers/leds/led-class.c +@@ -172,6 +172,7 @@ void led_classdev_suspend(struct led_classdev *led_cdev) + { + led_cdev->flags |= LED_SUSPENDED; + led_set_brightness_nopm(led_cdev, 0); ++ flush_work(&led_cdev->set_brightness_work); + } + EXPORT_SYMBOL_GPL(led_classdev_suspend); + +diff --git a/drivers/leds/leds-lm355x.c b/drivers/leds/leds-lm355x.c +index a5abb499574b..129f475aebf2 100644 +--- a/drivers/leds/leds-lm355x.c ++++ b/drivers/leds/leds-lm355x.c +@@ -165,18 +165,19 @@ static int lm355x_chip_init(struct lm355x_chip_data *chip) + /* input and output pins configuration */ + switch (chip->type) { + case CHIP_LM3554: +- reg_val = pdata->pin_tx2 | pdata->ntc_pin; ++ reg_val = (u32)pdata->pin_tx2 | (u32)pdata->ntc_pin; + ret = regmap_update_bits(chip->regmap, 0xE0, 0x28, reg_val); + if (ret < 0) + goto out; +- reg_val = pdata->pass_mode; ++ reg_val = (u32)pdata->pass_mode; + ret = regmap_update_bits(chip->regmap, 0xA0, 0x04, reg_val); + if (ret < 0) + goto out; + break; + + case CHIP_LM3556: +- reg_val = pdata->pin_tx2 | pdata->ntc_pin | pdata->pass_mode; ++ reg_val = (u32)pdata->pin_tx2 | (u32)pdata->ntc_pin | ++ (u32)pdata->pass_mode; + ret = regmap_update_bits(chip->regmap, 0x0A, 0xC4, reg_val); + if (ret < 0) + goto out; +diff --git a/drivers/macintosh/via-macii.c b/drivers/macintosh/via-macii.c +index ac824d7b2dcf..6aa903529570 100644 +--- a/drivers/macintosh/via-macii.c ++++ b/drivers/macintosh/via-macii.c +@@ -270,15 +270,12 @@ static int macii_autopoll(int devs) + unsigned long flags; + int err = 0; + ++ local_irq_save(flags); ++ + /* bit 1 == device 1, and so on. */ + autopoll_devs = devs & 0xFFFE; + +- if (!autopoll_devs) +- return 0; +- +- local_irq_save(flags); +- +- if (current_req == NULL) { ++ if (autopoll_devs && !current_req) { + /* Send a Talk Reg 0. The controller will repeatedly transmit + * this as long as it is idle. + */ +diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c +index 68901745eb20..168d64707859 100644 +--- a/drivers/md/bcache/super.c ++++ b/drivers/md/bcache/super.c +@@ -2091,7 +2091,14 @@ found: + sysfs_create_link(&c->kobj, &ca->kobj, buf)) + goto err; + +- if (ca->sb.seq > c->sb.seq) { ++ /* ++ * A special case is both ca->sb.seq and c->sb.seq are 0, ++ * such condition happens on a new created cache device whose ++ * super block is never flushed yet. In this case c->sb.version ++ * and other members should be updated too, otherwise we will ++ * have a mistaken super block version in cache set. ++ */ ++ if (ca->sb.seq > c->sb.seq || c->sb.seq == 0) { + c->sb.version = ca->sb.version; + memcpy(c->sb.set_uuid, ca->sb.set_uuid, 16); + c->sb.flags = ca->sb.flags; +diff --git a/drivers/md/md-cluster.c b/drivers/md/md-cluster.c +index 813a99ffa86f..73fd50e77975 100644 +--- a/drivers/md/md-cluster.c ++++ b/drivers/md/md-cluster.c +@@ -1518,6 +1518,7 @@ static void unlock_all_bitmaps(struct mddev *mddev) + } + } + kfree(cinfo->other_bitmap_lockres); ++ cinfo->other_bitmap_lockres = NULL; + } + } + +diff --git a/drivers/md/md.c b/drivers/md/md.c +index 5a378a453a2d..acef01e519d0 100644 +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -376,17 +376,18 @@ static blk_qc_t md_make_request(struct request_queue *q, struct bio *bio) + struct mddev *mddev = q->queuedata; + unsigned int sectors; + +- if (unlikely(test_bit(MD_BROKEN, &mddev->flags)) && (rw == WRITE)) { ++ if (mddev == NULL || mddev->pers == NULL) { + bio_io_error(bio); + return BLK_QC_T_NONE; + } + +- blk_queue_split(q, &bio); +- +- if (mddev == NULL || mddev->pers == NULL) { ++ if (unlikely(test_bit(MD_BROKEN, &mddev->flags)) && (rw == WRITE)) { + bio_io_error(bio); + return BLK_QC_T_NONE; + } ++ ++ blk_queue_split(q, &bio); ++ + if (mddev->ro == 1 && unlikely(rw == WRITE)) { + if (bio_sectors(bio) != 0) + bio->bi_status = BLK_STS_IOERR; +diff --git a/drivers/media/firewire/firedtv-fw.c b/drivers/media/firewire/firedtv-fw.c +index 97144734eb05..3f1ca40b9b98 100644 +--- a/drivers/media/firewire/firedtv-fw.c ++++ b/drivers/media/firewire/firedtv-fw.c +@@ -272,6 +272,8 @@ static int node_probe(struct fw_unit *unit, const struct ieee1394_device_id *id) + + name_len = fw_csr_string(unit->directory, CSR_MODEL, + name, sizeof(name)); ++ if (name_len < 0) ++ return name_len; + for (i = ARRAY_SIZE(model_names); --i; ) + if (strlen(model_names[i]) <= name_len && + strncmp(name, model_names[i], name_len) == 0) +diff --git a/drivers/media/mc/mc-request.c b/drivers/media/mc/mc-request.c +index e3fca436c75b..c0782fd96c59 100644 +--- a/drivers/media/mc/mc-request.c ++++ b/drivers/media/mc/mc-request.c +@@ -296,9 +296,18 @@ int media_request_alloc(struct media_device *mdev, int *alloc_fd) + if (WARN_ON(!mdev->ops->req_alloc ^ !mdev->ops->req_free)) + return -ENOMEM; + ++ if (mdev->ops->req_alloc) ++ req = mdev->ops->req_alloc(mdev); ++ else ++ req = kzalloc(sizeof(*req), GFP_KERNEL); ++ if (!req) ++ return -ENOMEM; ++ + fd = get_unused_fd_flags(O_CLOEXEC); +- if (fd < 0) +- return fd; ++ if (fd < 0) { ++ ret = fd; ++ goto err_free_req; ++ } + + filp = anon_inode_getfile("request", &request_fops, NULL, O_CLOEXEC); + if (IS_ERR(filp)) { +@@ -306,15 +315,6 @@ int media_request_alloc(struct media_device *mdev, int *alloc_fd) + goto err_put_fd; + } + +- if (mdev->ops->req_alloc) +- req = mdev->ops->req_alloc(mdev); +- else +- req = kzalloc(sizeof(*req), GFP_KERNEL); +- if (!req) { +- ret = -ENOMEM; +- goto err_fput; +- } +- + filp->private_data = req; + req->mdev = mdev; + req->state = MEDIA_REQUEST_STATE_IDLE; +@@ -336,12 +336,15 @@ int media_request_alloc(struct media_device *mdev, int *alloc_fd) + + return 0; + +-err_fput: +- fput(filp); +- + err_put_fd: + put_unused_fd(fd); + ++err_free_req: ++ if (mdev->ops->req_free) ++ mdev->ops->req_free(req); ++ else ++ kfree(req); ++ + return ret; + } + +diff --git a/drivers/media/platform/cros-ec-cec/cros-ec-cec.c b/drivers/media/platform/cros-ec-cec/cros-ec-cec.c +index 4a3b3810fd89..31390ce2dbf2 100644 +--- a/drivers/media/platform/cros-ec-cec/cros-ec-cec.c ++++ b/drivers/media/platform/cros-ec-cec/cros-ec-cec.c +@@ -278,11 +278,7 @@ static int cros_ec_cec_probe(struct platform_device *pdev) + platform_set_drvdata(pdev, cros_ec_cec); + cros_ec_cec->cros_ec = cros_ec; + +- ret = device_init_wakeup(&pdev->dev, 1); +- if (ret) { +- dev_err(&pdev->dev, "failed to initialize wakeup\n"); +- return ret; +- } ++ device_init_wakeup(&pdev->dev, 1); + + cros_ec_cec->adap = cec_allocate_adapter(&cros_ec_cec_ops, cros_ec_cec, + DRV_NAME, +diff --git a/drivers/media/platform/exynos4-is/media-dev.c b/drivers/media/platform/exynos4-is/media-dev.c +index 9aaf3b8060d5..9c31d950cddf 100644 +--- a/drivers/media/platform/exynos4-is/media-dev.c ++++ b/drivers/media/platform/exynos4-is/media-dev.c +@@ -1270,6 +1270,9 @@ static int fimc_md_get_pinctrl(struct fimc_md *fmd) + + pctl->state_idle = pinctrl_lookup_state(pctl->pinctrl, + PINCTRL_STATE_IDLE); ++ if (IS_ERR(pctl->state_idle)) ++ return PTR_ERR(pctl->state_idle); ++ + return 0; + } + +diff --git a/drivers/media/platform/marvell-ccic/mcam-core.c b/drivers/media/platform/marvell-ccic/mcam-core.c +index 803baf97f06e..6de8b3d99fb9 100644 +--- a/drivers/media/platform/marvell-ccic/mcam-core.c ++++ b/drivers/media/platform/marvell-ccic/mcam-core.c +@@ -1940,6 +1940,7 @@ int mccic_register(struct mcam_camera *cam) + out: + v4l2_async_notifier_unregister(&cam->notifier); + v4l2_device_unregister(&cam->v4l2_dev); ++ v4l2_async_notifier_cleanup(&cam->notifier); + return ret; + } + EXPORT_SYMBOL_GPL(mccic_register); +@@ -1961,6 +1962,7 @@ void mccic_shutdown(struct mcam_camera *cam) + v4l2_ctrl_handler_free(&cam->ctrl_handler); + v4l2_async_notifier_unregister(&cam->notifier); + v4l2_device_unregister(&cam->v4l2_dev); ++ v4l2_async_notifier_cleanup(&cam->notifier); + } + EXPORT_SYMBOL_GPL(mccic_shutdown); + +diff --git a/drivers/media/platform/omap3isp/isppreview.c b/drivers/media/platform/omap3isp/isppreview.c +index 97d660606d98..b8c2b8bba826 100644 +--- a/drivers/media/platform/omap3isp/isppreview.c ++++ b/drivers/media/platform/omap3isp/isppreview.c +@@ -2287,7 +2287,7 @@ static int preview_init_entities(struct isp_prev_device *prev) + me->ops = &preview_media_ops; + ret = media_entity_pads_init(me, PREV_PADS_NUM, pads); + if (ret < 0) +- return ret; ++ goto error_handler_free; + + preview_init_formats(sd, NULL); + +@@ -2320,6 +2320,8 @@ error_video_out: + omap3isp_video_cleanup(&prev->video_in); + error_video_in: + media_entity_cleanup(&prev->subdev.entity); ++error_handler_free: ++ v4l2_ctrl_handler_free(&prev->ctrls); + return ret; + } + +diff --git a/drivers/media/usb/dvb-usb/Kconfig b/drivers/media/usb/dvb-usb/Kconfig +index 1a3e5f965ae4..2d7a5c1c84af 100644 +--- a/drivers/media/usb/dvb-usb/Kconfig ++++ b/drivers/media/usb/dvb-usb/Kconfig +@@ -150,6 +150,7 @@ config DVB_USB_CXUSB + config DVB_USB_CXUSB_ANALOG + bool "Analog support for the Conexant USB2.0 hybrid reference design" + depends on DVB_USB_CXUSB && VIDEO_V4L2 ++ depends on VIDEO_V4L2=y || VIDEO_V4L2=DVB_USB_CXUSB + select VIDEO_CX25840 + select VIDEOBUF2_VMALLOC + help +diff --git a/drivers/misc/cxl/sysfs.c b/drivers/misc/cxl/sysfs.c +index f0263d1a1fdf..d97a243ad30c 100644 +--- a/drivers/misc/cxl/sysfs.c ++++ b/drivers/misc/cxl/sysfs.c +@@ -624,7 +624,7 @@ static struct afu_config_record *cxl_sysfs_afu_new_cr(struct cxl_afu *afu, int c + rc = kobject_init_and_add(&cr->kobj, &afu_config_record_type, + &afu->dev.kobj, "cr%i", cr->cr); + if (rc) +- goto err; ++ goto err1; + + rc = sysfs_create_bin_file(&cr->kobj, &cr->config_attr); + if (rc) +diff --git a/drivers/mmc/host/sdhci-cadence.c b/drivers/mmc/host/sdhci-cadence.c +index 5f2e9696ee4d..0c2489446bd7 100644 +--- a/drivers/mmc/host/sdhci-cadence.c ++++ b/drivers/mmc/host/sdhci-cadence.c +@@ -194,57 +194,6 @@ static u32 sdhci_cdns_get_emmc_mode(struct sdhci_cdns_priv *priv) + return FIELD_GET(SDHCI_CDNS_HRS06_MODE, tmp); + } + +-static void sdhci_cdns_set_uhs_signaling(struct sdhci_host *host, +- unsigned int timing) +-{ +- struct sdhci_cdns_priv *priv = sdhci_cdns_priv(host); +- u32 mode; +- +- switch (timing) { +- case MMC_TIMING_MMC_HS: +- mode = SDHCI_CDNS_HRS06_MODE_MMC_SDR; +- break; +- case MMC_TIMING_MMC_DDR52: +- mode = SDHCI_CDNS_HRS06_MODE_MMC_DDR; +- break; +- case MMC_TIMING_MMC_HS200: +- mode = SDHCI_CDNS_HRS06_MODE_MMC_HS200; +- break; +- case MMC_TIMING_MMC_HS400: +- if (priv->enhanced_strobe) +- mode = SDHCI_CDNS_HRS06_MODE_MMC_HS400ES; +- else +- mode = SDHCI_CDNS_HRS06_MODE_MMC_HS400; +- break; +- default: +- mode = SDHCI_CDNS_HRS06_MODE_SD; +- break; +- } +- +- sdhci_cdns_set_emmc_mode(priv, mode); +- +- /* For SD, fall back to the default handler */ +- if (mode == SDHCI_CDNS_HRS06_MODE_SD) +- sdhci_set_uhs_signaling(host, timing); +-} +- +-static const struct sdhci_ops sdhci_cdns_ops = { +- .set_clock = sdhci_set_clock, +- .get_timeout_clock = sdhci_cdns_get_timeout_clock, +- .set_bus_width = sdhci_set_bus_width, +- .reset = sdhci_reset, +- .set_uhs_signaling = sdhci_cdns_set_uhs_signaling, +-}; +- +-static const struct sdhci_pltfm_data sdhci_cdns_uniphier_pltfm_data = { +- .ops = &sdhci_cdns_ops, +- .quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN, +-}; +- +-static const struct sdhci_pltfm_data sdhci_cdns_pltfm_data = { +- .ops = &sdhci_cdns_ops, +-}; +- + static int sdhci_cdns_set_tune_val(struct sdhci_host *host, unsigned int val) + { + struct sdhci_cdns_priv *priv = sdhci_cdns_priv(host); +@@ -278,23 +227,24 @@ static int sdhci_cdns_set_tune_val(struct sdhci_host *host, unsigned int val) + return 0; + } + +-static int sdhci_cdns_execute_tuning(struct mmc_host *mmc, u32 opcode) ++/* ++ * In SD mode, software must not use the hardware tuning and instead perform ++ * an almost identical procedure to eMMC. ++ */ ++static int sdhci_cdns_execute_tuning(struct sdhci_host *host, u32 opcode) + { +- struct sdhci_host *host = mmc_priv(mmc); + int cur_streak = 0; + int max_streak = 0; + int end_of_streak = 0; + int i; + + /* +- * This handler only implements the eMMC tuning that is specific to +- * this controller. Fall back to the standard method for SD timing. ++ * Do not execute tuning for UHS_SDR50 or UHS_DDR50. ++ * The delay is set by probe, based on the DT properties. + */ +- if (host->timing != MMC_TIMING_MMC_HS200) +- return sdhci_execute_tuning(mmc, opcode); +- +- if (WARN_ON(opcode != MMC_SEND_TUNING_BLOCK_HS200)) +- return -EINVAL; ++ if (host->timing != MMC_TIMING_MMC_HS200 && ++ host->timing != MMC_TIMING_UHS_SDR104) ++ return 0; + + for (i = 0; i < SDHCI_CDNS_MAX_TUNING_LOOP; i++) { + if (sdhci_cdns_set_tune_val(host, i) || +@@ -317,6 +267,58 @@ static int sdhci_cdns_execute_tuning(struct mmc_host *mmc, u32 opcode) + return sdhci_cdns_set_tune_val(host, end_of_streak - max_streak / 2); + } + ++static void sdhci_cdns_set_uhs_signaling(struct sdhci_host *host, ++ unsigned int timing) ++{ ++ struct sdhci_cdns_priv *priv = sdhci_cdns_priv(host); ++ u32 mode; ++ ++ switch (timing) { ++ case MMC_TIMING_MMC_HS: ++ mode = SDHCI_CDNS_HRS06_MODE_MMC_SDR; ++ break; ++ case MMC_TIMING_MMC_DDR52: ++ mode = SDHCI_CDNS_HRS06_MODE_MMC_DDR; ++ break; ++ case MMC_TIMING_MMC_HS200: ++ mode = SDHCI_CDNS_HRS06_MODE_MMC_HS200; ++ break; ++ case MMC_TIMING_MMC_HS400: ++ if (priv->enhanced_strobe) ++ mode = SDHCI_CDNS_HRS06_MODE_MMC_HS400ES; ++ else ++ mode = SDHCI_CDNS_HRS06_MODE_MMC_HS400; ++ break; ++ default: ++ mode = SDHCI_CDNS_HRS06_MODE_SD; ++ break; ++ } ++ ++ sdhci_cdns_set_emmc_mode(priv, mode); ++ ++ /* For SD, fall back to the default handler */ ++ if (mode == SDHCI_CDNS_HRS06_MODE_SD) ++ sdhci_set_uhs_signaling(host, timing); ++} ++ ++static const struct sdhci_ops sdhci_cdns_ops = { ++ .set_clock = sdhci_set_clock, ++ .get_timeout_clock = sdhci_cdns_get_timeout_clock, ++ .set_bus_width = sdhci_set_bus_width, ++ .reset = sdhci_reset, ++ .platform_execute_tuning = sdhci_cdns_execute_tuning, ++ .set_uhs_signaling = sdhci_cdns_set_uhs_signaling, ++}; ++ ++static const struct sdhci_pltfm_data sdhci_cdns_uniphier_pltfm_data = { ++ .ops = &sdhci_cdns_ops, ++ .quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN, ++}; ++ ++static const struct sdhci_pltfm_data sdhci_cdns_pltfm_data = { ++ .ops = &sdhci_cdns_ops, ++}; ++ + static void sdhci_cdns_hs400_enhanced_strobe(struct mmc_host *mmc, + struct mmc_ios *ios) + { +@@ -377,7 +379,6 @@ static int sdhci_cdns_probe(struct platform_device *pdev) + priv->hrs_addr = host->ioaddr; + priv->enhanced_strobe = false; + host->ioaddr += SDHCI_CDNS_SRS_BASE; +- host->mmc_host_ops.execute_tuning = sdhci_cdns_execute_tuning; + host->mmc_host_ops.hs400_enhanced_strobe = + sdhci_cdns_hs400_enhanced_strobe; + sdhci_enable_v4_mode(host); +diff --git a/drivers/mmc/host/sdhci-pci-o2micro.c b/drivers/mmc/host/sdhci-pci-o2micro.c +index fa8105087d68..41a2394313dd 100644 +--- a/drivers/mmc/host/sdhci-pci-o2micro.c ++++ b/drivers/mmc/host/sdhci-pci-o2micro.c +@@ -561,6 +561,12 @@ int sdhci_pci_o2_probe_slot(struct sdhci_pci_slot *slot) + slot->host->mmc_host_ops.get_cd = sdhci_o2_get_cd; + } + ++ if (chip->pdev->device == PCI_DEVICE_ID_O2_SEABIRD1) { ++ slot->host->mmc_host_ops.get_cd = sdhci_o2_get_cd; ++ host->mmc->caps2 |= MMC_CAP2_NO_SDIO; ++ host->quirks2 |= SDHCI_QUIRK2_PRESET_VALUE_BROKEN; ++ } ++ + host->mmc_host_ops.execute_tuning = sdhci_o2_execute_tuning; + + if (chip->pdev->device != PCI_DEVICE_ID_O2_FUJIN2) +diff --git a/drivers/mtd/nand/raw/qcom_nandc.c b/drivers/mtd/nand/raw/qcom_nandc.c +index 7bb9a7e8e1e7..c1c53b02b35f 100644 +--- a/drivers/mtd/nand/raw/qcom_nandc.c ++++ b/drivers/mtd/nand/raw/qcom_nandc.c +@@ -459,11 +459,13 @@ struct qcom_nand_host { + * among different NAND controllers. + * @ecc_modes - ecc mode for NAND + * @is_bam - whether NAND controller is using BAM ++ * @is_qpic - whether NAND CTRL is part of qpic IP + * @dev_cmd_reg_start - NAND_DEV_CMD_* registers starting offset + */ + struct qcom_nandc_props { + u32 ecc_modes; + bool is_bam; ++ bool is_qpic; + u32 dev_cmd_reg_start; + }; + +@@ -2751,7 +2753,8 @@ static int qcom_nandc_setup(struct qcom_nand_controller *nandc) + u32 nand_ctrl; + + /* kill onenand */ +- nandc_write(nandc, SFLASHC_BURST_CFG, 0); ++ if (!nandc->props->is_qpic) ++ nandc_write(nandc, SFLASHC_BURST_CFG, 0); + nandc_write(nandc, dev_cmd_reg_addr(nandc, NAND_DEV_CMD_VLD), + NAND_DEV_CMD_VLD_VAL); + +@@ -3007,12 +3010,14 @@ static const struct qcom_nandc_props ipq806x_nandc_props = { + static const struct qcom_nandc_props ipq4019_nandc_props = { + .ecc_modes = (ECC_BCH_4BIT | ECC_BCH_8BIT), + .is_bam = true, ++ .is_qpic = true, + .dev_cmd_reg_start = 0x0, + }; + + static const struct qcom_nandc_props ipq8074_nandc_props = { + .ecc_modes = (ECC_BCH_4BIT | ECC_BCH_8BIT), + .is_bam = true, ++ .is_qpic = true, + .dev_cmd_reg_start = 0x7000, + }; + +diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c +index 6787d560e9e3..92e4d140df6f 100644 +--- a/drivers/net/dsa/mv88e6xxx/chip.c ++++ b/drivers/net/dsa/mv88e6xxx/chip.c +@@ -3063,7 +3063,6 @@ static const struct mv88e6xxx_ops mv88e6097_ops = { + .port_set_frame_mode = mv88e6351_port_set_frame_mode, + .port_set_egress_floods = mv88e6352_port_set_egress_floods, + .port_set_ether_type = mv88e6351_port_set_ether_type, +- .port_set_jumbo_size = mv88e6165_port_set_jumbo_size, + .port_egress_rate_limiting = mv88e6095_port_egress_rate_limiting, + .port_pause_limit = mv88e6097_port_pause_limit, + .port_disable_learn_limit = mv88e6xxx_port_disable_learn_limit, +diff --git a/drivers/net/dsa/rtl8366.c b/drivers/net/dsa/rtl8366.c +index ac88caca5ad4..1368816abaed 100644 +--- a/drivers/net/dsa/rtl8366.c ++++ b/drivers/net/dsa/rtl8366.c +@@ -43,18 +43,26 @@ int rtl8366_set_vlan(struct realtek_smi *smi, int vid, u32 member, + int ret; + int i; + ++ dev_dbg(smi->dev, ++ "setting VLAN%d 4k members: 0x%02x, untagged: 0x%02x\n", ++ vid, member, untag); ++ + /* Update the 4K table */ + ret = smi->ops->get_vlan_4k(smi, vid, &vlan4k); + if (ret) + return ret; + +- vlan4k.member = member; +- vlan4k.untag = untag; ++ vlan4k.member |= member; ++ vlan4k.untag |= untag; + vlan4k.fid = fid; + ret = smi->ops->set_vlan_4k(smi, &vlan4k); + if (ret) + return ret; + ++ dev_dbg(smi->dev, ++ "resulting VLAN%d 4k members: 0x%02x, untagged: 0x%02x\n", ++ vid, vlan4k.member, vlan4k.untag); ++ + /* Try to find an existing MC entry for this VID */ + for (i = 0; i < smi->num_vlan_mc; i++) { + struct rtl8366_vlan_mc vlanmc; +@@ -65,11 +73,16 @@ int rtl8366_set_vlan(struct realtek_smi *smi, int vid, u32 member, + + if (vid == vlanmc.vid) { + /* update the MC entry */ +- vlanmc.member = member; +- vlanmc.untag = untag; ++ vlanmc.member |= member; ++ vlanmc.untag |= untag; + vlanmc.fid = fid; + + ret = smi->ops->set_vlan_mc(smi, i, &vlanmc); ++ ++ dev_dbg(smi->dev, ++ "resulting VLAN%d MC members: 0x%02x, untagged: 0x%02x\n", ++ vid, vlanmc.member, vlanmc.untag); ++ + break; + } + } +@@ -384,7 +397,7 @@ void rtl8366_vlan_add(struct dsa_switch *ds, int port, + if (dsa_is_dsa_port(ds, port) || dsa_is_cpu_port(ds, port)) + dev_err(smi->dev, "port is DSA or CPU port\n"); + +- for (vid = vlan->vid_begin; vid <= vlan->vid_end; ++vid) { ++ for (vid = vlan->vid_begin; vid <= vlan->vid_end; vid++) { + int pvid_val = 0; + + dev_info(smi->dev, "add VLAN %04x\n", vid); +@@ -407,13 +420,13 @@ void rtl8366_vlan_add(struct dsa_switch *ds, int port, + if (ret < 0) + return; + } +- } + +- ret = rtl8366_set_vlan(smi, port, member, untag, 0); +- if (ret) +- dev_err(smi->dev, +- "failed to set up VLAN %04x", +- vid); ++ ret = rtl8366_set_vlan(smi, vid, member, untag, 0); ++ if (ret) ++ dev_err(smi->dev, ++ "failed to set up VLAN %04x", ++ vid); ++ } + } + EXPORT_SYMBOL_GPL(rtl8366_vlan_add); + +diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c +index 359a4d387185..9a0db70c1143 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c ++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c +@@ -776,7 +776,7 @@ static int hw_atl_a0_hw_multicast_list_set(struct aq_hw_s *self, + int err = 0; + + if (count > (HW_ATL_A0_MAC_MAX - HW_ATL_A0_MAC_MIN)) { +- err = EBADRQC; ++ err = -EBADRQC; + goto err_exit; + } + for (self->aq_nic_cfg->mc_list_count = 0U; +diff --git a/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c b/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c +index 43d11c38b38a..4cddd628d41b 100644 +--- a/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c ++++ b/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c +@@ -1167,7 +1167,7 @@ static int cn23xx_get_pf_num(struct octeon_device *oct) + oct->pf_num = ((fdl_bit >> CN23XX_PCIE_SRIOV_FDL_BIT_POS) & + CN23XX_PCIE_SRIOV_FDL_MASK); + } else { +- ret = EINVAL; ++ ret = -EINVAL; + + /* Under some virtual environments, extended PCI regs are + * inaccessible, in which case the above read will have failed. +diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_main.c b/drivers/net/ethernet/cavium/thunder/nicvf_main.c +index f414f5651dbd..5c45c0c6dd23 100644 +--- a/drivers/net/ethernet/cavium/thunder/nicvf_main.c ++++ b/drivers/net/ethernet/cavium/thunder/nicvf_main.c +@@ -2185,6 +2185,9 @@ static int nicvf_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + nic->max_queues *= 2; + nic->ptp_clock = ptp_clock; + ++ /* Initialize mutex that serializes usage of VF's mailbox */ ++ mutex_init(&nic->rx_mode_mtx); ++ + /* MAP VF's configuration registers */ + nic->reg_base = pcim_iomap(pdev, PCI_CFG_REG_BAR_NUM, 0); + if (!nic->reg_base) { +@@ -2261,7 +2264,6 @@ static int nicvf_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + + INIT_WORK(&nic->rx_mode_work.work, nicvf_set_rx_mode_task); + spin_lock_init(&nic->rx_mode_wq_lock); +- mutex_init(&nic->rx_mode_mtx); + + err = register_netdev(netdev); + if (err) { +diff --git a/drivers/net/ethernet/freescale/fman/fman.c b/drivers/net/ethernet/freescale/fman/fman.c +index 4c2fa13a7dd7..c8e434c8ab98 100644 +--- a/drivers/net/ethernet/freescale/fman/fman.c ++++ b/drivers/net/ethernet/freescale/fman/fman.c +@@ -1396,8 +1396,7 @@ static void enable_time_stamp(struct fman *fman) + { + struct fman_fpm_regs __iomem *fpm_rg = fman->fpm_regs; + u16 fm_clk_freq = fman->state->fm_clk_freq; +- u32 tmp, intgr, ts_freq; +- u64 frac; ++ u32 tmp, intgr, ts_freq, frac; + + ts_freq = (u32)(1 << fman->state->count1_micro_bit); + /* configure timestamp so that bit 8 will count 1 microsecond +diff --git a/drivers/net/ethernet/freescale/fman/fman_dtsec.c b/drivers/net/ethernet/freescale/fman/fman_dtsec.c +index 1ca543ac8f2c..d2de9ea80c43 100644 +--- a/drivers/net/ethernet/freescale/fman/fman_dtsec.c ++++ b/drivers/net/ethernet/freescale/fman/fman_dtsec.c +@@ -1205,7 +1205,7 @@ int dtsec_del_hash_mac_address(struct fman_mac *dtsec, enet_addr_t *eth_addr) + list_for_each(pos, + &dtsec->multicast_addr_hash->lsts[bucket]) { + hash_entry = ETH_HASH_ENTRY_OBJ(pos); +- if (hash_entry->addr == addr) { ++ if (hash_entry && hash_entry->addr == addr) { + list_del_init(&hash_entry->node); + kfree(hash_entry); + break; +@@ -1218,7 +1218,7 @@ int dtsec_del_hash_mac_address(struct fman_mac *dtsec, enet_addr_t *eth_addr) + list_for_each(pos, + &dtsec->unicast_addr_hash->lsts[bucket]) { + hash_entry = ETH_HASH_ENTRY_OBJ(pos); +- if (hash_entry->addr == addr) { ++ if (hash_entry && hash_entry->addr == addr) { + list_del_init(&hash_entry->node); + kfree(hash_entry); + break; +diff --git a/drivers/net/ethernet/freescale/fman/fman_mac.h b/drivers/net/ethernet/freescale/fman/fman_mac.h +index dd6d0526f6c1..19f327efdaff 100644 +--- a/drivers/net/ethernet/freescale/fman/fman_mac.h ++++ b/drivers/net/ethernet/freescale/fman/fman_mac.h +@@ -252,7 +252,7 @@ static inline struct eth_hash_t *alloc_hash_table(u16 size) + struct eth_hash_t *hash; + + /* Allocate address hash table */ +- hash = kmalloc_array(size, sizeof(struct eth_hash_t *), GFP_KERNEL); ++ hash = kmalloc(sizeof(*hash), GFP_KERNEL); + if (!hash) + return NULL; + +diff --git a/drivers/net/ethernet/freescale/fman/fman_memac.c b/drivers/net/ethernet/freescale/fman/fman_memac.c +index e1901874c19f..9088b4f4b4b8 100644 +--- a/drivers/net/ethernet/freescale/fman/fman_memac.c ++++ b/drivers/net/ethernet/freescale/fman/fman_memac.c +@@ -856,7 +856,6 @@ int memac_set_tx_pause_frames(struct fman_mac *memac, u8 priority, + + tmp = ioread32be(®s->command_config); + tmp &= ~CMD_CFG_PFC_MODE; +- priority = 0; + + iowrite32be(tmp, ®s->command_config); + +@@ -986,7 +985,7 @@ int memac_del_hash_mac_address(struct fman_mac *memac, enet_addr_t *eth_addr) + + list_for_each(pos, &memac->multicast_addr_hash->lsts[hash]) { + hash_entry = ETH_HASH_ENTRY_OBJ(pos); +- if (hash_entry->addr == addr) { ++ if (hash_entry && hash_entry->addr == addr) { + list_del_init(&hash_entry->node); + kfree(hash_entry); + break; +diff --git a/drivers/net/ethernet/freescale/fman/fman_port.c b/drivers/net/ethernet/freescale/fman/fman_port.c +index ee82ee1384eb..47f6fee1f396 100644 +--- a/drivers/net/ethernet/freescale/fman/fman_port.c ++++ b/drivers/net/ethernet/freescale/fman/fman_port.c +@@ -1756,6 +1756,7 @@ static int fman_port_probe(struct platform_device *of_dev) + struct fman_port *port; + struct fman *fman; + struct device_node *fm_node, *port_node; ++ struct platform_device *fm_pdev; + struct resource res; + struct resource *dev_res; + u32 val; +@@ -1780,8 +1781,14 @@ static int fman_port_probe(struct platform_device *of_dev) + goto return_err; + } + +- fman = dev_get_drvdata(&of_find_device_by_node(fm_node)->dev); ++ fm_pdev = of_find_device_by_node(fm_node); + of_node_put(fm_node); ++ if (!fm_pdev) { ++ err = -EINVAL; ++ goto return_err; ++ } ++ ++ fman = dev_get_drvdata(&fm_pdev->dev); + if (!fman) { + err = -EINVAL; + goto return_err; +diff --git a/drivers/net/ethernet/freescale/fman/fman_tgec.c b/drivers/net/ethernet/freescale/fman/fman_tgec.c +index f75b9c11b2d2..ac5a281e0ec3 100644 +--- a/drivers/net/ethernet/freescale/fman/fman_tgec.c ++++ b/drivers/net/ethernet/freescale/fman/fman_tgec.c +@@ -630,7 +630,7 @@ int tgec_del_hash_mac_address(struct fman_mac *tgec, enet_addr_t *eth_addr) + + list_for_each(pos, &tgec->multicast_addr_hash->lsts[hash]) { + hash_entry = ETH_HASH_ENTRY_OBJ(pos); +- if (hash_entry->addr == addr) { ++ if (hash_entry && hash_entry->addr == addr) { + list_del_init(&hash_entry->node); + kfree(hash_entry); + break; +diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c +index bacc5fb7eba2..34124c213d27 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_main.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_main.c +@@ -1863,8 +1863,10 @@ static int iavf_init_get_resources(struct iavf_adapter *adapter) + + adapter->rss_key = kzalloc(adapter->rss_key_size, GFP_KERNEL); + adapter->rss_lut = kzalloc(adapter->rss_lut_size, GFP_KERNEL); +- if (!adapter->rss_key || !adapter->rss_lut) ++ if (!adapter->rss_key || !adapter->rss_lut) { ++ err = -ENOMEM; + goto err_mem; ++ } + if (RSS_AQ(adapter)) + adapter->aq_required |= IAVF_FLAG_AQ_CONFIGURE_RSS; + else +@@ -1946,7 +1948,10 @@ static void iavf_watchdog_task(struct work_struct *work) + iavf_send_api_ver(adapter); + } + } else { +- if (!iavf_process_aq_command(adapter) && ++ /* An error will be returned if no commands were ++ * processed; use this opportunity to update stats ++ */ ++ if (iavf_process_aq_command(adapter) && + adapter->state == __IAVF_RUNNING) + iavf_request_stats(adapter); + } +diff --git a/drivers/net/ethernet/intel/ice/ice_flex_pipe.c b/drivers/net/ethernet/intel/ice/ice_flex_pipe.c +index cbd53b586c36..6cfe8eb7f47d 100644 +--- a/drivers/net/ethernet/intel/ice/ice_flex_pipe.c ++++ b/drivers/net/ethernet/intel/ice/ice_flex_pipe.c +@@ -1535,10 +1535,12 @@ enum ice_status ice_init_hw_tbls(struct ice_hw *hw) + es->ref_count = devm_kcalloc(ice_hw_to_dev(hw), es->count, + sizeof(*es->ref_count), + GFP_KERNEL); ++ if (!es->ref_count) ++ goto err; + + es->written = devm_kcalloc(ice_hw_to_dev(hw), es->count, + sizeof(*es->written), GFP_KERNEL); +- if (!es->ref_count) ++ if (!es->written) + goto err; + } + return 0; +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c +index 86e6bbb57482..b66e5b6eecd9 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c +@@ -809,18 +809,15 @@ static int connect_fts_in_prio(struct mlx5_core_dev *dev, + { + struct mlx5_flow_root_namespace *root = find_root(&prio->node); + struct mlx5_flow_table *iter; +- int i = 0; + int err; + + fs_for_each_ft(iter, prio) { +- i++; + err = root->cmds->modify_flow_table(root, iter, ft); + if (err) { +- mlx5_core_warn(dev, "Failed to modify flow table %d\n", +- iter->id); ++ mlx5_core_err(dev, ++ "Failed to modify flow table id %d, type %d, err %d\n", ++ iter->id, iter->type, err); + /* The driver is out of sync with the FW */ +- if (i > 1) +- WARN_ON(true); + return err; + } + } +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/fs_dr.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/fs_dr.c +index 1e32e2443f73..348f02e336f6 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/fs_dr.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/fs_dr.c +@@ -247,29 +247,9 @@ static int mlx5_cmd_dr_create_fte(struct mlx5_flow_root_namespace *ns, + + /* The order of the actions are must to be keep, only the following + * order is supported by SW steering: +- * TX: push vlan -> modify header -> encap ++ * TX: modify header -> push vlan -> encap + * RX: decap -> pop vlan -> modify header + */ +- if (fte->action.action & MLX5_FLOW_CONTEXT_ACTION_VLAN_PUSH) { +- tmp_action = create_action_push_vlan(domain, &fte->action.vlan[0]); +- if (!tmp_action) { +- err = -ENOMEM; +- goto free_actions; +- } +- fs_dr_actions[fs_dr_num_actions++] = tmp_action; +- actions[num_actions++] = tmp_action; +- } +- +- if (fte->action.action & MLX5_FLOW_CONTEXT_ACTION_VLAN_PUSH_2) { +- tmp_action = create_action_push_vlan(domain, &fte->action.vlan[1]); +- if (!tmp_action) { +- err = -ENOMEM; +- goto free_actions; +- } +- fs_dr_actions[fs_dr_num_actions++] = tmp_action; +- actions[num_actions++] = tmp_action; +- } +- + if (fte->action.action & MLX5_FLOW_CONTEXT_ACTION_DECAP) { + enum mlx5dr_action_reformat_type decap_type = + DR_ACTION_REFORMAT_TYP_TNL_L2_TO_L2; +@@ -322,6 +302,26 @@ static int mlx5_cmd_dr_create_fte(struct mlx5_flow_root_namespace *ns, + actions[num_actions++] = + fte->action.modify_hdr->action.dr_action; + ++ if (fte->action.action & MLX5_FLOW_CONTEXT_ACTION_VLAN_PUSH) { ++ tmp_action = create_action_push_vlan(domain, &fte->action.vlan[0]); ++ if (!tmp_action) { ++ err = -ENOMEM; ++ goto free_actions; ++ } ++ fs_dr_actions[fs_dr_num_actions++] = tmp_action; ++ actions[num_actions++] = tmp_action; ++ } ++ ++ if (fte->action.action & MLX5_FLOW_CONTEXT_ACTION_VLAN_PUSH_2) { ++ tmp_action = create_action_push_vlan(domain, &fte->action.vlan[1]); ++ if (!tmp_action) { ++ err = -ENOMEM; ++ goto free_actions; ++ } ++ fs_dr_actions[fs_dr_num_actions++] = tmp_action; ++ actions[num_actions++] = tmp_action; ++ } ++ + if (delay_encap_set) + actions[num_actions++] = + fte->action.pkt_reformat->action.dr_action; +diff --git a/drivers/net/ethernet/pensando/ionic/ionic_lif.c b/drivers/net/ethernet/pensando/ionic/ionic_lif.c +index c00ec9a02097..e66002251596 100644 +--- a/drivers/net/ethernet/pensando/ionic/ionic_lif.c ++++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.c +@@ -666,7 +666,7 @@ static bool ionic_notifyq_service(struct ionic_cq *cq, + eid = le64_to_cpu(comp->event.eid); + + /* Have we run out of new completions to process? */ +- if (eid <= lif->last_eid) ++ if ((s64)(eid - lif->last_eid) <= 0) + return false; + + lif->last_eid = eid; +diff --git a/drivers/net/ethernet/toshiba/spider_net.c b/drivers/net/ethernet/toshiba/spider_net.c +index 538e70810d3d..a99c7c95de5c 100644 +--- a/drivers/net/ethernet/toshiba/spider_net.c ++++ b/drivers/net/ethernet/toshiba/spider_net.c +@@ -283,8 +283,8 @@ spider_net_free_chain(struct spider_net_card *card, + descr = descr->next; + } while (descr != chain->ring); + +- dma_free_coherent(&card->pdev->dev, chain->num_desc, +- chain->hwring, chain->dma_addr); ++ dma_free_coherent(&card->pdev->dev, chain->num_desc * sizeof(struct spider_net_hw_descr), ++ chain->hwring, chain->dma_addr); + } + + /** +diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c +index dba52a5c378a..110924d62744 100644 +--- a/drivers/net/phy/phy_device.c ++++ b/drivers/net/phy/phy_device.c +@@ -615,7 +615,9 @@ struct phy_device *phy_device_create(struct mii_bus *bus, int addr, u32 phy_id, + if (c45_ids) + dev->c45_ids = *c45_ids; + dev->irq = bus->irq[addr]; ++ + dev_set_name(&mdiodev->dev, PHY_ID_FMT, bus->id, addr); ++ device_initialize(&mdiodev->dev); + + dev->state = PHY_DOWN; + +@@ -649,10 +651,8 @@ struct phy_device *phy_device_create(struct mii_bus *bus, int addr, u32 phy_id, + ret = phy_request_driver_module(dev, phy_id); + } + +- if (!ret) { +- device_initialize(&mdiodev->dev); +- } else { +- kfree(dev); ++ if (ret) { ++ put_device(&mdiodev->dev); + dev = ERR_PTR(ret); + } + +diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c +index 216acf37ca7c..a06e6ab453f5 100644 +--- a/drivers/net/vmxnet3/vmxnet3_drv.c ++++ b/drivers/net/vmxnet3/vmxnet3_drv.c +@@ -861,7 +861,8 @@ vmxnet3_parse_hdr(struct sk_buff *skb, struct vmxnet3_tx_queue *tq, + + switch (protocol) { + case IPPROTO_TCP: +- ctx->l4_hdr_size = tcp_hdrlen(skb); ++ ctx->l4_hdr_size = skb->encapsulation ? inner_tcp_hdrlen(skb) : ++ tcp_hdrlen(skb); + break; + case IPPROTO_UDP: + ctx->l4_hdr_size = sizeof(struct udphdr); +diff --git a/drivers/net/wan/lapbether.c b/drivers/net/wan/lapbether.c +index 134e4dd916c1..996eb9c55b39 100644 +--- a/drivers/net/wan/lapbether.c ++++ b/drivers/net/wan/lapbether.c +@@ -157,6 +157,12 @@ static netdev_tx_t lapbeth_xmit(struct sk_buff *skb, + if (!netif_running(dev)) + goto drop; + ++ /* There should be a pseudo header of 1 byte added by upper layers. ++ * Check to make sure it is there before reading it. ++ */ ++ if (skb->len < 1) ++ goto drop; ++ + switch (skb->data[0]) { + case X25_IFACE_DATA: + break; +@@ -305,6 +311,7 @@ static void lapbeth_setup(struct net_device *dev) + dev->netdev_ops = &lapbeth_netdev_ops; + dev->needs_free_netdev = true; + dev->type = ARPHRD_X25; ++ dev->hard_header_len = 0; + dev->mtu = 1000; + dev->addr_len = 0; + } +@@ -331,7 +338,8 @@ static int lapbeth_new_device(struct net_device *dev) + * then this driver prepends a length field of 2 bytes, + * then the underlying Ethernet device prepends its own header. + */ +- ndev->hard_header_len = -1 + 3 + 2 + dev->hard_header_len; ++ ndev->needed_headroom = -1 + 3 + 2 + dev->hard_header_len ++ + dev->needed_headroom; + + lapbeth = netdev_priv(ndev); + lapbeth->axdev = ndev; +diff --git a/drivers/net/wireless/ath/ath10k/htt_tx.c b/drivers/net/wireless/ath/ath10k/htt_tx.c +index 735482877a1f..c38e1963ebc0 100644 +--- a/drivers/net/wireless/ath/ath10k/htt_tx.c ++++ b/drivers/net/wireless/ath/ath10k/htt_tx.c +@@ -1540,7 +1540,9 @@ static int ath10k_htt_tx_32(struct ath10k_htt *htt, + err_unmap_msdu: + dma_unmap_single(dev, skb_cb->paddr, msdu->len, DMA_TO_DEVICE); + err_free_msdu_id: ++ spin_lock_bh(&htt->tx_lock); + ath10k_htt_tx_free_msdu_id(htt, msdu_id); ++ spin_unlock_bh(&htt->tx_lock); + err: + return res; + } +@@ -1747,7 +1749,9 @@ static int ath10k_htt_tx_64(struct ath10k_htt *htt, + err_unmap_msdu: + dma_unmap_single(dev, skb_cb->paddr, msdu->len, DMA_TO_DEVICE); + err_free_msdu_id: ++ spin_lock_bh(&htt->tx_lock); + ath10k_htt_tx_free_msdu_id(htt, msdu_id); ++ spin_unlock_bh(&htt->tx_lock); + err: + return res; + } +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h +index 37c512036e0e..ce18433aaefb 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h +@@ -19,7 +19,7 @@ + #define BRCMF_ARP_OL_PEER_AUTO_REPLY 0x00000008 + + #define BRCMF_BSS_INFO_VERSION 109 /* curr ver of brcmf_bss_info_le struct */ +-#define BRCMF_BSS_RSSI_ON_CHANNEL 0x0002 ++#define BRCMF_BSS_RSSI_ON_CHANNEL 0x0004 + + #define BRCMF_STA_BRCM 0x00000001 /* Running a Broadcom driver */ + #define BRCMF_STA_WME 0x00000002 /* WMM association */ +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c +index 2bd892df83cc..eadc64454839 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c +@@ -643,6 +643,7 @@ static inline int brcmf_fws_hanger_poppkt(struct brcmf_fws_hanger *h, + static void brcmf_fws_psq_flush(struct brcmf_fws_info *fws, struct pktq *q, + int ifidx) + { ++ struct brcmf_fws_hanger_item *hi; + bool (*matchfn)(struct sk_buff *, void *) = NULL; + struct sk_buff *skb; + int prec; +@@ -654,6 +655,9 @@ static void brcmf_fws_psq_flush(struct brcmf_fws_info *fws, struct pktq *q, + skb = brcmu_pktq_pdeq_match(q, prec, matchfn, &ifidx); + while (skb) { + hslot = brcmf_skb_htod_tag_get_field(skb, HSLOT); ++ hi = &fws->hanger.items[hslot]; ++ WARN_ON(skb != hi->pkt); ++ hi->state = BRCMF_FWS_HANGER_ITEM_STATE_FREE; + brcmf_fws_hanger_poppkt(&fws->hanger, hslot, &skb, + true); + brcmu_pkt_buf_free_skb(skb); +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c +index d43247a95ce5..38e6809f16c7 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c +@@ -3685,7 +3685,11 @@ static void brcmf_sdio_bus_watchdog(struct brcmf_sdio *bus) + if (bus->idlecount > bus->idletime) { + brcmf_dbg(SDIO, "idle\n"); + sdio_claim_host(bus->sdiodev->func1); +- brcmf_sdio_wd_timer(bus, false); ++#ifdef DEBUG ++ if (!BRCMF_FWCON_ON() || ++ bus->console_interval == 0) ++#endif ++ brcmf_sdio_wd_timer(bus, false); + bus->idlecount = 0; + brcmf_sdio_bus_sleep(bus, true, false); + sdio_release_host(bus->sdiodev->func1); +diff --git a/drivers/net/wireless/intel/iwlegacy/common.c b/drivers/net/wireless/intel/iwlegacy/common.c +index 746749f37996..1107b96a8a88 100644 +--- a/drivers/net/wireless/intel/iwlegacy/common.c ++++ b/drivers/net/wireless/intel/iwlegacy/common.c +@@ -4286,8 +4286,8 @@ il_apm_init(struct il_priv *il) + * power savings, even without L1. + */ + if (il->cfg->set_l0s) { +- pcie_capability_read_word(il->pci_dev, PCI_EXP_LNKCTL, &lctl); +- if (lctl & PCI_EXP_LNKCTL_ASPM_L1) { ++ ret = pcie_capability_read_word(il->pci_dev, PCI_EXP_LNKCTL, &lctl); ++ if (!ret && (lctl & PCI_EXP_LNKCTL_ASPM_L1)) { + /* L1-ASPM enabled; disable(!) L0S */ + il_set_bit(il, CSR_GIO_REG, + CSR_GIO_REG_VAL_L0S_ENABLED); +diff --git a/drivers/net/wireless/marvell/mwifiex/sdio.h b/drivers/net/wireless/marvell/mwifiex/sdio.h +index f672bdf52cc1..2d9ec225aead 100644 +--- a/drivers/net/wireless/marvell/mwifiex/sdio.h ++++ b/drivers/net/wireless/marvell/mwifiex/sdio.h +@@ -36,9 +36,9 @@ + #define SD8897_DEFAULT_FW_NAME "mrvl/sd8897_uapsta.bin" + #define SD8887_DEFAULT_FW_NAME "mrvl/sd8887_uapsta.bin" + #define SD8801_DEFAULT_FW_NAME "mrvl/sd8801_uapsta.bin" +-#define SD8977_DEFAULT_FW_NAME "mrvl/sd8977_uapsta.bin" ++#define SD8977_DEFAULT_FW_NAME "mrvl/sdsd8977_combo_v2.bin" + #define SD8987_DEFAULT_FW_NAME "mrvl/sd8987_uapsta.bin" +-#define SD8997_DEFAULT_FW_NAME "mrvl/sd8997_uapsta.bin" ++#define SD8997_DEFAULT_FW_NAME "mrvl/sdsd8997_combo_v4.bin" + + #define BLOCK_MODE 1 + #define BYTE_MODE 0 +diff --git a/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c b/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c +index 20c206da0631..7ae2c34f65db 100644 +--- a/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c ++++ b/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c +@@ -580,6 +580,11 @@ static int mwifiex_ret_802_11_key_material_v1(struct mwifiex_private *priv, + { + struct host_cmd_ds_802_11_key_material *key = + &resp->params.key_material; ++ int len; ++ ++ len = le16_to_cpu(key->key_param_set.key_len); ++ if (len > sizeof(key->key_param_set.key)) ++ return -EINVAL; + + if (le16_to_cpu(key->action) == HostCmd_ACT_GEN_SET) { + if ((le16_to_cpu(key->key_param_set.key_info) & KEY_MCAST)) { +@@ -593,9 +598,8 @@ static int mwifiex_ret_802_11_key_material_v1(struct mwifiex_private *priv, + + memset(priv->aes_key.key_param_set.key, 0, + sizeof(key->key_param_set.key)); +- priv->aes_key.key_param_set.key_len = key->key_param_set.key_len; +- memcpy(priv->aes_key.key_param_set.key, key->key_param_set.key, +- le16_to_cpu(priv->aes_key.key_param_set.key_len)); ++ priv->aes_key.key_param_set.key_len = cpu_to_le16(len); ++ memcpy(priv->aes_key.key_param_set.key, key->key_param_set.key, len); + + return 0; + } +@@ -610,9 +614,14 @@ static int mwifiex_ret_802_11_key_material_v2(struct mwifiex_private *priv, + struct host_cmd_ds_command *resp) + { + struct host_cmd_ds_802_11_key_material_v2 *key_v2; +- __le16 len; ++ int len; + + key_v2 = &resp->params.key_material_v2; ++ ++ len = le16_to_cpu(key_v2->key_param_set.key_params.aes.key_len); ++ if (len > WLAN_KEY_LEN_CCMP) ++ return -EINVAL; ++ + if (le16_to_cpu(key_v2->action) == HostCmd_ACT_GEN_SET) { + if ((le16_to_cpu(key_v2->key_param_set.key_info) & KEY_MCAST)) { + mwifiex_dbg(priv->adapter, INFO, "info: key: GTK is set\n"); +@@ -628,10 +637,9 @@ static int mwifiex_ret_802_11_key_material_v2(struct mwifiex_private *priv, + memset(priv->aes_key_v2.key_param_set.key_params.aes.key, 0, + WLAN_KEY_LEN_CCMP); + priv->aes_key_v2.key_param_set.key_params.aes.key_len = +- key_v2->key_param_set.key_params.aes.key_len; +- len = priv->aes_key_v2.key_param_set.key_params.aes.key_len; ++ cpu_to_le16(len); + memcpy(priv->aes_key_v2.key_param_set.key_params.aes.key, +- key_v2->key_param_set.key_params.aes.key, le16_to_cpu(len)); ++ key_v2->key_param_set.key_params.aes.key, len); + + return 0; + } +diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c +index 842cd81704db..b6867d93c0e3 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c +@@ -119,8 +119,10 @@ mt7615_mcu_parse_response(struct mt7615_dev *dev, int cmd, + struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data; + int ret = 0; + +- if (seq != rxd->seq) +- return -EAGAIN; ++ if (seq != rxd->seq) { ++ ret = -EAGAIN; ++ goto out; ++ } + + switch (cmd) { + case -MCU_CMD_PATCH_SEM_CONTROL: +@@ -134,6 +136,7 @@ mt7615_mcu_parse_response(struct mt7615_dev *dev, int cmd, + default: + break; + } ++out: + dev_kfree_skb(skb); + + return ret; +diff --git a/drivers/net/wireless/realtek/rtw88/coex.c b/drivers/net/wireless/realtek/rtw88/coex.c +index 3e95ad198912..853ac1c2ed73 100644 +--- a/drivers/net/wireless/realtek/rtw88/coex.c ++++ b/drivers/net/wireless/realtek/rtw88/coex.c +@@ -1923,7 +1923,8 @@ static void rtw_coex_run_coex(struct rtw_dev *rtwdev, u8 reason) + if (coex_stat->wl_under_ips) + return; + +- if (coex->freeze && !coex_stat->bt_setup_link) ++ if (coex->freeze && coex_dm->reason == COEX_RSN_BTINFO && ++ !coex_stat->bt_setup_link) + return; + + coex_stat->cnt_wl[COEX_CNT_WL_COEXRUN]++; +diff --git a/drivers/net/wireless/realtek/rtw88/fw.c b/drivers/net/wireless/realtek/rtw88/fw.c +index 35dbdb3c4f1e..8efaee7571f3 100644 +--- a/drivers/net/wireless/realtek/rtw88/fw.c ++++ b/drivers/net/wireless/realtek/rtw88/fw.c +@@ -340,7 +340,7 @@ void rtw_fw_send_ra_info(struct rtw_dev *rtwdev, struct rtw_sta_info *si) + SET_RA_INFO_INIT_RA_LVL(h2c_pkt, si->init_ra_lv); + SET_RA_INFO_SGI_EN(h2c_pkt, si->sgi_enable); + SET_RA_INFO_BW_MODE(h2c_pkt, si->bw_mode); +- SET_RA_INFO_LDPC(h2c_pkt, si->ldpc_en); ++ SET_RA_INFO_LDPC(h2c_pkt, !!si->ldpc_en); + SET_RA_INFO_NO_UPDATE(h2c_pkt, no_update); + SET_RA_INFO_VHT_EN(h2c_pkt, si->vht_enable); + SET_RA_INFO_DIS_PT(h2c_pkt, disable_pt); +diff --git a/drivers/net/wireless/realtek/rtw88/main.c b/drivers/net/wireless/realtek/rtw88/main.c +index 88e2252bf8a2..15c7a6fc37b9 100644 +--- a/drivers/net/wireless/realtek/rtw88/main.c ++++ b/drivers/net/wireless/realtek/rtw88/main.c +@@ -553,8 +553,6 @@ void rtw_update_sta_info(struct rtw_dev *rtwdev, struct rtw_sta_info *si) + stbc_en = VHT_STBC_EN; + if (sta->vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC) + ldpc_en = VHT_LDPC_EN; +- if (sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80) +- is_support_sgi = true; + } else if (sta->ht_cap.ht_supported) { + ra_mask |= (sta->ht_cap.mcs.rx_mask[1] << 20) | + (sta->ht_cap.mcs.rx_mask[0] << 12); +@@ -562,9 +560,6 @@ void rtw_update_sta_info(struct rtw_dev *rtwdev, struct rtw_sta_info *si) + stbc_en = HT_STBC_EN; + if (sta->ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING) + ldpc_en = HT_LDPC_EN; +- if (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20 || +- sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40) +- is_support_sgi = true; + } + + if (efuse->hw_cap.nss == 1) +@@ -606,12 +601,18 @@ void rtw_update_sta_info(struct rtw_dev *rtwdev, struct rtw_sta_info *si) + switch (sta->bandwidth) { + case IEEE80211_STA_RX_BW_80: + bw_mode = RTW_CHANNEL_WIDTH_80; ++ is_support_sgi = sta->vht_cap.vht_supported && ++ (sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80); + break; + case IEEE80211_STA_RX_BW_40: + bw_mode = RTW_CHANNEL_WIDTH_40; ++ is_support_sgi = sta->ht_cap.ht_supported && ++ (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40); + break; + default: + bw_mode = RTW_CHANNEL_WIDTH_20; ++ is_support_sgi = sta->ht_cap.ht_supported && ++ (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20); + break; + } + +diff --git a/drivers/net/wireless/ti/wl1251/event.c b/drivers/net/wireless/ti/wl1251/event.c +index 850864dbafa1..e6d426edab56 100644 +--- a/drivers/net/wireless/ti/wl1251/event.c ++++ b/drivers/net/wireless/ti/wl1251/event.c +@@ -70,7 +70,7 @@ static int wl1251_event_ps_report(struct wl1251 *wl, + break; + } + +- return 0; ++ return ret; + } + + static void wl1251_event_mbox_dump(struct event_mailbox *mbox) +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index 071b63146d4b..ff5681da8780 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -1074,6 +1074,9 @@ static int nvme_identify_ns_descs(struct nvme_ctrl *ctrl, unsigned nsid, + int pos; + int len; + ++ if (ctrl->quirks & NVME_QUIRK_NO_NS_DESC_LIST) ++ return 0; ++ + c.identify.opcode = nvme_admin_identify; + c.identify.nsid = cpu_to_le32(nsid); + c.identify.cns = NVME_ID_CNS_NS_DESC_LIST; +@@ -1087,18 +1090,6 @@ static int nvme_identify_ns_descs(struct nvme_ctrl *ctrl, unsigned nsid, + if (status) { + dev_warn(ctrl->device, + "Identify Descriptors failed (%d)\n", status); +- /* +- * Don't treat non-retryable errors as fatal, as we potentially +- * already have a NGUID or EUI-64. If we failed with DNR set, +- * we want to silently ignore the error as we can still +- * identify the device, but if the status has DNR set, we want +- * to propagate the error back specifically for the disk +- * revalidation flow to make sure we don't abandon the +- * device just because of a temporal retry-able error (such +- * as path of transport errors). +- */ +- if (status > 0 && (status & NVME_SC_DNR)) +- status = 0; + goto free_data; + } + +diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c +index 5433aa2f7601..484aad0d0c9c 100644 +--- a/drivers/nvme/host/multipath.c ++++ b/drivers/nvme/host/multipath.c +@@ -249,6 +249,12 @@ static struct nvme_ns *nvme_round_robin_path(struct nvme_ns_head *head, + fallback = ns; + } + ++ /* No optimized path found, re-check the current path */ ++ if (!nvme_path_is_disabled(old) && ++ old->ana_state == NVME_ANA_OPTIMIZED) { ++ found = old; ++ goto out; ++ } + if (!fallback) + return NULL; + found = fallback; +@@ -269,10 +275,13 @@ inline struct nvme_ns *nvme_find_path(struct nvme_ns_head *head) + struct nvme_ns *ns; + + ns = srcu_dereference(head->current_path[node], &head->srcu); +- if (READ_ONCE(head->subsys->iopolicy) == NVME_IOPOLICY_RR && ns) +- ns = nvme_round_robin_path(head, node, ns); +- if (unlikely(!ns || !nvme_path_is_optimized(ns))) +- ns = __nvme_find_path(head, node); ++ if (unlikely(!ns)) ++ return __nvme_find_path(head, node); ++ ++ if (READ_ONCE(head->subsys->iopolicy) == NVME_IOPOLICY_RR) ++ return nvme_round_robin_path(head, node, ns); ++ if (unlikely(!nvme_path_is_optimized(ns))) ++ return __nvme_find_path(head, node); + return ns; + } + +diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h +index ed02260862cb..056953bd8bd8 100644 +--- a/drivers/nvme/host/nvme.h ++++ b/drivers/nvme/host/nvme.h +@@ -115,6 +115,13 @@ enum nvme_quirks { + * Prevent tag overlap between queues + */ + NVME_QUIRK_SHARED_TAGS = (1 << 13), ++ ++ /* ++ * The controller doesn't handle the Identify Namespace ++ * Identification Descriptor list subcommand despite claiming ++ * NVMe 1.3 compliance. ++ */ ++ NVME_QUIRK_NO_NS_DESC_LIST = (1 << 15), + }; + + /* +diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c +index ee7669f23cff..100da11ce98c 100644 +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -3117,6 +3117,8 @@ static const struct pci_device_id nvme_id_table[] = { + { PCI_VDEVICE(INTEL, 0x5845), /* Qemu emulated controller */ + .driver_data = NVME_QUIRK_IDENTIFY_CNS | + NVME_QUIRK_DISABLE_WRITE_ZEROES, }, ++ { PCI_DEVICE(0x126f, 0x2263), /* Silicon Motion unidentified */ ++ .driver_data = NVME_QUIRK_NO_NS_DESC_LIST, }, + { PCI_DEVICE(0x1bb1, 0x0100), /* Seagate Nytro Flash Storage */ + .driver_data = NVME_QUIRK_DELAY_BEFORE_CHK_RDY, }, + { PCI_DEVICE(0x1c58, 0x0003), /* HGST adapter */ +diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c +index cd0d49978190..d0336545e1fe 100644 +--- a/drivers/nvme/host/rdma.c ++++ b/drivers/nvme/host/rdma.c +@@ -890,15 +890,20 @@ static int nvme_rdma_configure_io_queues(struct nvme_rdma_ctrl *ctrl, bool new) + ret = PTR_ERR(ctrl->ctrl.connect_q); + goto out_free_tag_set; + } +- } else { +- blk_mq_update_nr_hw_queues(&ctrl->tag_set, +- ctrl->ctrl.queue_count - 1); + } + + ret = nvme_rdma_start_io_queues(ctrl); + if (ret) + goto out_cleanup_connect_q; + ++ if (!new) { ++ nvme_start_queues(&ctrl->ctrl); ++ nvme_wait_freeze(&ctrl->ctrl); ++ blk_mq_update_nr_hw_queues(ctrl->ctrl.tagset, ++ ctrl->ctrl.queue_count - 1); ++ nvme_unfreeze(&ctrl->ctrl); ++ } ++ + return 0; + + out_cleanup_connect_q: +@@ -931,6 +936,7 @@ static void nvme_rdma_teardown_io_queues(struct nvme_rdma_ctrl *ctrl, + bool remove) + { + if (ctrl->ctrl.queue_count > 1) { ++ nvme_start_freeze(&ctrl->ctrl); + nvme_stop_queues(&ctrl->ctrl); + nvme_rdma_stop_io_queues(ctrl); + if (ctrl->ctrl.tagset) { +diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c +index 53e113a18a54..0166ff0e4738 100644 +--- a/drivers/nvme/host/tcp.c ++++ b/drivers/nvme/host/tcp.c +@@ -1684,15 +1684,20 @@ static int nvme_tcp_configure_io_queues(struct nvme_ctrl *ctrl, bool new) + ret = PTR_ERR(ctrl->connect_q); + goto out_free_tag_set; + } +- } else { +- blk_mq_update_nr_hw_queues(ctrl->tagset, +- ctrl->queue_count - 1); + } + + ret = nvme_tcp_start_io_queues(ctrl); + if (ret) + goto out_cleanup_connect_q; + ++ if (!new) { ++ nvme_start_queues(ctrl); ++ nvme_wait_freeze(ctrl); ++ blk_mq_update_nr_hw_queues(ctrl->tagset, ++ ctrl->queue_count - 1); ++ nvme_unfreeze(ctrl); ++ } ++ + return 0; + + out_cleanup_connect_q: +@@ -1797,6 +1802,7 @@ static void nvme_tcp_teardown_io_queues(struct nvme_ctrl *ctrl, + { + if (ctrl->queue_count <= 1) + return; ++ nvme_start_freeze(ctrl); + nvme_stop_queues(ctrl); + nvme_tcp_stop_io_queues(ctrl); + if (ctrl->tagset) { +diff --git a/drivers/parisc/sba_iommu.c b/drivers/parisc/sba_iommu.c +index de8e4e347249..e410033b6df0 100644 +--- a/drivers/parisc/sba_iommu.c ++++ b/drivers/parisc/sba_iommu.c +@@ -1270,7 +1270,7 @@ sba_ioc_init_pluto(struct parisc_device *sba, struct ioc *ioc, int ioc_num) + ** (one that doesn't overlap memory or LMMIO space) in the + ** IBASE and IMASK registers. + */ +- ioc->ibase = READ_REG(ioc->ioc_hpa + IOC_IBASE); ++ ioc->ibase = READ_REG(ioc->ioc_hpa + IOC_IBASE) & ~0x1fffffULL; + iova_space_size = ~(READ_REG(ioc->ioc_hpa + IOC_IMASK) & 0xFFFFFFFFUL) + 1; + + if ((ioc->ibase < 0xfed00000UL) && ((ioc->ibase + iova_space_size) > 0xfee00000UL)) { +diff --git a/drivers/pci/access.c b/drivers/pci/access.c +index 2fccb5762c76..0914ddeae17f 100644 +--- a/drivers/pci/access.c ++++ b/drivers/pci/access.c +@@ -204,17 +204,13 @@ EXPORT_SYMBOL(pci_bus_set_ops); + static DECLARE_WAIT_QUEUE_HEAD(pci_cfg_wait); + + static noinline void pci_wait_cfg(struct pci_dev *dev) ++ __must_hold(&pci_lock) + { +- DECLARE_WAITQUEUE(wait, current); +- +- __add_wait_queue(&pci_cfg_wait, &wait); + do { +- set_current_state(TASK_UNINTERRUPTIBLE); + raw_spin_unlock_irq(&pci_lock); +- schedule(); ++ wait_event(pci_cfg_wait, !dev->block_cfg_access); + raw_spin_lock_irq(&pci_lock); + } while (dev->block_cfg_access); +- __remove_wait_queue(&pci_cfg_wait, &wait); + } + + /* Returns 0 on success, negative values indicate error. */ +diff --git a/drivers/pci/controller/pcie-cadence-host.c b/drivers/pci/controller/pcie-cadence-host.c +index 97e251090b4f..0dfc778f40a7 100644 +--- a/drivers/pci/controller/pcie-cadence-host.c ++++ b/drivers/pci/controller/pcie-cadence-host.c +@@ -102,6 +102,7 @@ static int cdns_pcie_host_init_root_port(struct cdns_pcie_rc *rc) + { + struct cdns_pcie *pcie = &rc->pcie; + u32 value, ctrl; ++ u32 id; + + /* + * Set the root complex BAR configuration register: +@@ -121,8 +122,12 @@ static int cdns_pcie_host_init_root_port(struct cdns_pcie_rc *rc) + cdns_pcie_writel(pcie, CDNS_PCIE_LM_RC_BAR_CFG, value); + + /* Set root port configuration space */ +- if (rc->vendor_id != 0xffff) +- cdns_pcie_rp_writew(pcie, PCI_VENDOR_ID, rc->vendor_id); ++ if (rc->vendor_id != 0xffff) { ++ id = CDNS_PCIE_LM_ID_VENDOR(rc->vendor_id) | ++ CDNS_PCIE_LM_ID_SUBSYS(rc->vendor_id); ++ cdns_pcie_writel(pcie, CDNS_PCIE_LM_ID, id); ++ } ++ + if (rc->device_id != 0xffff) + cdns_pcie_rp_writew(pcie, PCI_DEVICE_ID, rc->device_id); + +diff --git a/drivers/pci/controller/vmd.c b/drivers/pci/controller/vmd.c +index 7c24c0aedad4..9966dcf1d112 100644 +--- a/drivers/pci/controller/vmd.c ++++ b/drivers/pci/controller/vmd.c +@@ -694,6 +694,7 @@ static int vmd_enable_domain(struct vmd_dev *vmd, unsigned long features) + if (!vmd->bus) { + pci_free_resource_list(&resources); + irq_domain_remove(vmd->irq_domain); ++ irq_domain_free_fwnode(fn); + return -ENODEV; + } + +@@ -808,6 +809,7 @@ static void vmd_cleanup_srcu(struct vmd_dev *vmd) + static void vmd_remove(struct pci_dev *dev) + { + struct vmd_dev *vmd = pci_get_drvdata(dev); ++ struct fwnode_handle *fn = vmd->irq_domain->fwnode; + + sysfs_remove_link(&vmd->dev->dev.kobj, "domain"); + pci_stop_root_bus(vmd->bus); +@@ -816,6 +818,7 @@ static void vmd_remove(struct pci_dev *dev) + vmd_teardown_dma_ops(vmd); + vmd_detach_resources(vmd); + irq_domain_remove(vmd->irq_domain); ++ irq_domain_free_fwnode(fn); + } + + #ifdef CONFIG_PM_SLEEP +diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c +index 4a0ec34062d6..7624c71011c6 100644 +--- a/drivers/pci/pcie/aspm.c ++++ b/drivers/pci/pcie/aspm.c +@@ -1157,6 +1157,7 @@ static int pcie_aspm_get_policy(char *buffer, const struct kernel_param *kp) + cnt += sprintf(buffer + cnt, "[%s] ", policy_str[i]); + else + cnt += sprintf(buffer + cnt, "%s ", policy_str[i]); ++ cnt += sprintf(buffer + cnt, "\n"); + return cnt; + } + +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index 4ac4b28e0ebb..9bc0f321aaf0 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -4446,6 +4446,8 @@ static int pci_quirk_amd_sb_acs(struct pci_dev *dev, u16 acs_flags) + if (ACPI_FAILURE(status)) + return -ENODEV; + ++ acpi_put_table(header); ++ + /* Filter out flags not applicable to multifunction */ + acs_flags &= (PCI_ACS_RR | PCI_ACS_CR | PCI_ACS_EC | PCI_ACS_DT); + +diff --git a/drivers/phy/marvell/phy-armada38x-comphy.c b/drivers/phy/marvell/phy-armada38x-comphy.c +index 6960dfd8ad8c..0fe408964334 100644 +--- a/drivers/phy/marvell/phy-armada38x-comphy.c ++++ b/drivers/phy/marvell/phy-armada38x-comphy.c +@@ -41,6 +41,7 @@ struct a38x_comphy_lane { + + struct a38x_comphy { + void __iomem *base; ++ void __iomem *conf; + struct device *dev; + struct a38x_comphy_lane lane[MAX_A38X_COMPHY]; + }; +@@ -54,6 +55,21 @@ static const u8 gbe_mux[MAX_A38X_COMPHY][MAX_A38X_PORTS] = { + { 0, 0, 3 }, + }; + ++static void a38x_set_conf(struct a38x_comphy_lane *lane, bool enable) ++{ ++ struct a38x_comphy *priv = lane->priv; ++ u32 conf; ++ ++ if (priv->conf) { ++ conf = readl_relaxed(priv->conf); ++ if (enable) ++ conf |= BIT(lane->port); ++ else ++ conf &= ~BIT(lane->port); ++ writel(conf, priv->conf); ++ } ++} ++ + static void a38x_comphy_set_reg(struct a38x_comphy_lane *lane, + unsigned int offset, u32 mask, u32 value) + { +@@ -97,6 +113,7 @@ static int a38x_comphy_set_mode(struct phy *phy, enum phy_mode mode, int sub) + { + struct a38x_comphy_lane *lane = phy_get_drvdata(phy); + unsigned int gen; ++ int ret; + + if (mode != PHY_MODE_ETHERNET) + return -EINVAL; +@@ -115,13 +132,20 @@ static int a38x_comphy_set_mode(struct phy *phy, enum phy_mode mode, int sub) + return -EINVAL; + } + ++ a38x_set_conf(lane, false); ++ + a38x_comphy_set_speed(lane, gen, gen); + +- return a38x_comphy_poll(lane, COMPHY_STAT1, +- COMPHY_STAT1_PLL_RDY_TX | +- COMPHY_STAT1_PLL_RDY_RX, +- COMPHY_STAT1_PLL_RDY_TX | +- COMPHY_STAT1_PLL_RDY_RX); ++ ret = a38x_comphy_poll(lane, COMPHY_STAT1, ++ COMPHY_STAT1_PLL_RDY_TX | ++ COMPHY_STAT1_PLL_RDY_RX, ++ COMPHY_STAT1_PLL_RDY_TX | ++ COMPHY_STAT1_PLL_RDY_RX); ++ ++ if (ret == 0) ++ a38x_set_conf(lane, true); ++ ++ return ret; + } + + static const struct phy_ops a38x_comphy_ops = { +@@ -174,14 +198,21 @@ static int a38x_comphy_probe(struct platform_device *pdev) + if (!priv) + return -ENOMEM; + +- res = platform_get_resource(pdev, IORESOURCE_MEM, 0); +- base = devm_ioremap_resource(&pdev->dev, res); ++ base = devm_platform_ioremap_resource(pdev, 0); + if (IS_ERR(base)) + return PTR_ERR(base); + + priv->dev = &pdev->dev; + priv->base = base; + ++ /* Optional */ ++ res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "conf"); ++ if (res) { ++ priv->conf = devm_ioremap_resource(&pdev->dev, res); ++ if (IS_ERR(priv->conf)) ++ return PTR_ERR(priv->conf); ++ } ++ + for_each_available_child_of_node(pdev->dev.of_node, child) { + struct phy *phy; + int ret; +diff --git a/drivers/phy/renesas/phy-rcar-gen3-usb2.c b/drivers/phy/renesas/phy-rcar-gen3-usb2.c +index bfb22f868857..5087b7c44d55 100644 +--- a/drivers/phy/renesas/phy-rcar-gen3-usb2.c ++++ b/drivers/phy/renesas/phy-rcar-gen3-usb2.c +@@ -111,6 +111,7 @@ struct rcar_gen3_chan { + struct work_struct work; + struct mutex lock; /* protects rphys[...].powered */ + enum usb_dr_mode dr_mode; ++ int irq; + bool extcon_host; + bool is_otg_channel; + bool uses_otg_pins; +@@ -389,12 +390,38 @@ static void rcar_gen3_init_otg(struct rcar_gen3_chan *ch) + rcar_gen3_device_recognition(ch); + } + ++static irqreturn_t rcar_gen3_phy_usb2_irq(int irq, void *_ch) ++{ ++ struct rcar_gen3_chan *ch = _ch; ++ void __iomem *usb2_base = ch->base; ++ u32 status = readl(usb2_base + USB2_OBINTSTA); ++ irqreturn_t ret = IRQ_NONE; ++ ++ if (status & USB2_OBINT_BITS) { ++ dev_vdbg(ch->dev, "%s: %08x\n", __func__, status); ++ writel(USB2_OBINT_BITS, usb2_base + USB2_OBINTSTA); ++ rcar_gen3_device_recognition(ch); ++ ret = IRQ_HANDLED; ++ } ++ ++ return ret; ++} ++ + static int rcar_gen3_phy_usb2_init(struct phy *p) + { + struct rcar_gen3_phy *rphy = phy_get_drvdata(p); + struct rcar_gen3_chan *channel = rphy->ch; + void __iomem *usb2_base = channel->base; + u32 val; ++ int ret; ++ ++ if (!rcar_gen3_is_any_rphy_initialized(channel) && channel->irq >= 0) { ++ INIT_WORK(&channel->work, rcar_gen3_phy_usb2_work); ++ ret = request_irq(channel->irq, rcar_gen3_phy_usb2_irq, ++ IRQF_SHARED, dev_name(channel->dev), channel); ++ if (ret < 0) ++ dev_err(channel->dev, "No irq handler (%d)\n", channel->irq); ++ } + + /* Initialize USB2 part */ + val = readl(usb2_base + USB2_INT_ENABLE); +@@ -433,6 +460,9 @@ static int rcar_gen3_phy_usb2_exit(struct phy *p) + val &= ~USB2_INT_ENABLE_UCOM_INTEN; + writel(val, usb2_base + USB2_INT_ENABLE); + ++ if (channel->irq >= 0 && !rcar_gen3_is_any_rphy_initialized(channel)) ++ free_irq(channel->irq, channel); ++ + return 0; + } + +@@ -503,23 +533,6 @@ static const struct phy_ops rz_g1c_phy_usb2_ops = { + .owner = THIS_MODULE, + }; + +-static irqreturn_t rcar_gen3_phy_usb2_irq(int irq, void *_ch) +-{ +- struct rcar_gen3_chan *ch = _ch; +- void __iomem *usb2_base = ch->base; +- u32 status = readl(usb2_base + USB2_OBINTSTA); +- irqreturn_t ret = IRQ_NONE; +- +- if (status & USB2_OBINT_BITS) { +- dev_vdbg(ch->dev, "%s: %08x\n", __func__, status); +- writel(USB2_OBINT_BITS, usb2_base + USB2_OBINTSTA); +- rcar_gen3_device_recognition(ch); +- ret = IRQ_HANDLED; +- } +- +- return ret; +-} +- + static const struct of_device_id rcar_gen3_phy_usb2_match_table[] = { + { + .compatible = "renesas,usb2-phy-r8a77470", +@@ -598,7 +611,7 @@ static int rcar_gen3_phy_usb2_probe(struct platform_device *pdev) + struct phy_provider *provider; + struct resource *res; + const struct phy_ops *phy_usb2_ops; +- int irq, ret = 0, i; ++ int ret = 0, i; + + if (!dev->of_node) { + dev_err(dev, "This driver needs device tree\n"); +@@ -614,16 +627,8 @@ static int rcar_gen3_phy_usb2_probe(struct platform_device *pdev) + if (IS_ERR(channel->base)) + return PTR_ERR(channel->base); + +- /* call request_irq for OTG */ +- irq = platform_get_irq_optional(pdev, 0); +- if (irq >= 0) { +- INIT_WORK(&channel->work, rcar_gen3_phy_usb2_work); +- irq = devm_request_irq(dev, irq, rcar_gen3_phy_usb2_irq, +- IRQF_SHARED, dev_name(dev), channel); +- if (irq < 0) +- dev_err(dev, "No irq handler (%d)\n", irq); +- } +- ++ /* get irq number here and request_irq for OTG in phy_init */ ++ channel->irq = platform_get_irq_optional(pdev, 0); + channel->dr_mode = rcar_gen3_get_dr_mode(dev->of_node); + if (channel->dr_mode != USB_DR_MODE_UNKNOWN) { + int ret; +diff --git a/drivers/pinctrl/pinctrl-single.c b/drivers/pinctrl/pinctrl-single.c +index 1e0614daee9b..a9d511982780 100644 +--- a/drivers/pinctrl/pinctrl-single.c ++++ b/drivers/pinctrl/pinctrl-single.c +@@ -916,7 +916,7 @@ static int pcs_parse_pinconf(struct pcs_device *pcs, struct device_node *np, + + /* If pinconf isn't supported, don't parse properties in below. */ + if (!PCS_HAS_PINCONF) +- return 0; ++ return -ENOTSUPP; + + /* cacluate how much properties are supported in current node */ + for (i = 0; i < ARRAY_SIZE(prop2); i++) { +@@ -928,7 +928,7 @@ static int pcs_parse_pinconf(struct pcs_device *pcs, struct device_node *np, + nconfs++; + } + if (!nconfs) +- return 0; ++ return -ENOTSUPP; + + func->conf = devm_kcalloc(pcs->dev, + nconfs, sizeof(struct pcs_conf_vals), +@@ -1056,9 +1056,12 @@ static int pcs_parse_one_pinctrl_entry(struct pcs_device *pcs, + + if (PCS_HAS_PINCONF && function) { + res = pcs_parse_pinconf(pcs, np, function, map); +- if (res) ++ if (res == 0) ++ *num_maps = 2; ++ else if (res == -ENOTSUPP) ++ *num_maps = 1; ++ else + goto free_pingroups; +- *num_maps = 2; + } else { + *num_maps = 1; + } +diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c +index 0d42477946f3..59b78a181723 100644 +--- a/drivers/platform/x86/asus-nb-wmi.c ++++ b/drivers/platform/x86/asus-nb-wmi.c +@@ -110,6 +110,16 @@ static struct quirk_entry quirk_asus_forceals = { + .wmi_force_als_set = true, + }; + ++static struct quirk_entry quirk_asus_ga401i = { ++ .wmi_backlight_power = true, ++ .wmi_backlight_set_devstate = true, ++}; ++ ++static struct quirk_entry quirk_asus_ga502i = { ++ .wmi_backlight_power = true, ++ .wmi_backlight_set_devstate = true, ++}; ++ + static int dmi_matched(const struct dmi_system_id *dmi) + { + pr_info("Identified laptop model '%s'\n", dmi->ident); +@@ -411,6 +421,78 @@ static const struct dmi_system_id asus_quirks[] = { + }, + .driver_data = &quirk_asus_forceals, + }, ++ { ++ .callback = dmi_matched, ++ .ident = "ASUSTeK COMPUTER INC. GA401IH", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "GA401IH"), ++ }, ++ .driver_data = &quirk_asus_ga401i, ++ }, ++ { ++ .callback = dmi_matched, ++ .ident = "ASUSTeK COMPUTER INC. GA401II", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "GA401II"), ++ }, ++ .driver_data = &quirk_asus_ga401i, ++ }, ++ { ++ .callback = dmi_matched, ++ .ident = "ASUSTeK COMPUTER INC. GA401IU", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "GA401IU"), ++ }, ++ .driver_data = &quirk_asus_ga401i, ++ }, ++ { ++ .callback = dmi_matched, ++ .ident = "ASUSTeK COMPUTER INC. GA401IV", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "GA401IV"), ++ }, ++ .driver_data = &quirk_asus_ga401i, ++ }, ++ { ++ .callback = dmi_matched, ++ .ident = "ASUSTeK COMPUTER INC. GA401IVC", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "GA401IVC"), ++ }, ++ .driver_data = &quirk_asus_ga401i, ++ }, ++ { ++ .callback = dmi_matched, ++ .ident = "ASUSTeK COMPUTER INC. GA502II", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "GA502II"), ++ }, ++ .driver_data = &quirk_asus_ga502i, ++ }, ++ { ++ .callback = dmi_matched, ++ .ident = "ASUSTeK COMPUTER INC. GA502IU", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "GA502IU"), ++ }, ++ .driver_data = &quirk_asus_ga502i, ++ }, ++ { ++ .callback = dmi_matched, ++ .ident = "ASUSTeK COMPUTER INC. GA502IV", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "GA502IV"), ++ }, ++ .driver_data = &quirk_asus_ga502i, ++ }, + {}, + }; + +diff --git a/drivers/platform/x86/intel-hid.c b/drivers/platform/x86/intel-hid.c +index 7a506c1d0113..ad1399dcb21f 100644 +--- a/drivers/platform/x86/intel-hid.c ++++ b/drivers/platform/x86/intel-hid.c +@@ -570,7 +570,7 @@ check_acpi_dev(acpi_handle handle, u32 lvl, void *context, void **rv) + return AE_OK; + + if (acpi_match_device_ids(dev, ids) == 0) +- if (acpi_create_platform_device(dev, NULL)) ++ if (!IS_ERR_OR_NULL(acpi_create_platform_device(dev, NULL))) + dev_info(&dev->dev, + "intel-hid: created platform device\n"); + +diff --git a/drivers/platform/x86/intel-vbtn.c b/drivers/platform/x86/intel-vbtn.c +index cb2a80fdd8f4..3393ee95077f 100644 +--- a/drivers/platform/x86/intel-vbtn.c ++++ b/drivers/platform/x86/intel-vbtn.c +@@ -286,7 +286,7 @@ check_acpi_dev(acpi_handle handle, u32 lvl, void *context, void **rv) + return AE_OK; + + if (acpi_match_device_ids(dev, ids) == 0) +- if (acpi_create_platform_device(dev, NULL)) ++ if (!IS_ERR_OR_NULL(acpi_create_platform_device(dev, NULL))) + dev_info(&dev->dev, + "intel-vbtn: created platform device\n"); + +diff --git a/drivers/power/supply/88pm860x_battery.c b/drivers/power/supply/88pm860x_battery.c +index 5ca047b3f58f..23e7d6447ae9 100644 +--- a/drivers/power/supply/88pm860x_battery.c ++++ b/drivers/power/supply/88pm860x_battery.c +@@ -433,7 +433,7 @@ static void pm860x_init_battery(struct pm860x_battery_info *info) + int ret; + int data; + int bat_remove; +- int soc; ++ int soc = 0; + + /* measure enable on GPADC1 */ + data = MEAS1_GP1; +@@ -496,7 +496,9 @@ static void pm860x_init_battery(struct pm860x_battery_info *info) + } + mutex_unlock(&info->lock); + +- calc_soc(info, OCV_MODE_ACTIVE, &soc); ++ ret = calc_soc(info, OCV_MODE_ACTIVE, &soc); ++ if (ret < 0) ++ goto out; + + data = pm860x_reg_read(info->i2c, PM8607_POWER_UP_LOG); + bat_remove = data & BAT_WU_LOG; +diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c +index 0011bdc15afb..a17aebe0aa7a 100644 +--- a/drivers/regulator/core.c ++++ b/drivers/regulator/core.c +@@ -4994,7 +4994,6 @@ regulator_register(const struct regulator_desc *regulator_desc, + struct regulator_dev *rdev; + bool dangling_cfg_gpiod = false; + bool dangling_of_gpiod = false; +- bool reg_device_fail = false; + struct device *dev; + int ret, i; + +@@ -5123,10 +5122,12 @@ regulator_register(const struct regulator_desc *regulator_desc, + } + + /* register with sysfs */ ++ device_initialize(&rdev->dev); + rdev->dev.class = ®ulator_class; + rdev->dev.parent = dev; + dev_set_name(&rdev->dev, "regulator.%lu", + (unsigned long) atomic_inc_return(®ulator_no)); ++ dev_set_drvdata(&rdev->dev, rdev); + + /* set regulator constraints */ + if (init_data) +@@ -5177,12 +5178,9 @@ regulator_register(const struct regulator_desc *regulator_desc, + !rdev->desc->fixed_uV) + rdev->is_switch = true; + +- dev_set_drvdata(&rdev->dev, rdev); +- ret = device_register(&rdev->dev); +- if (ret != 0) { +- reg_device_fail = true; ++ ret = device_add(&rdev->dev); ++ if (ret != 0) + goto unset_supplies; +- } + + rdev_init_debugfs(rdev); + +@@ -5204,17 +5202,15 @@ unset_supplies: + mutex_unlock(®ulator_list_mutex); + wash: + kfree(rdev->coupling_desc.coupled_rdevs); +- kfree(rdev->constraints); + mutex_lock(®ulator_list_mutex); + regulator_ena_gpio_free(rdev); + mutex_unlock(®ulator_list_mutex); ++ put_device(&rdev->dev); ++ rdev = NULL; + clean: + if (dangling_of_gpiod) + gpiod_put(config->ena_gpiod); +- if (reg_device_fail) +- put_device(&rdev->dev); +- else +- kfree(rdev); ++ kfree(rdev); + kfree(config); + rinse: + if (dangling_cfg_gpiod) +diff --git a/drivers/s390/block/dasd_diag.c b/drivers/s390/block/dasd_diag.c +index 8d4971645cf1..f7ae03fd36cb 100644 +--- a/drivers/s390/block/dasd_diag.c ++++ b/drivers/s390/block/dasd_diag.c +@@ -319,7 +319,7 @@ dasd_diag_check_device(struct dasd_device *device) + struct dasd_diag_characteristics *rdc_data; + struct vtoc_cms_label *label; + struct dasd_block *block; +- struct dasd_diag_bio bio; ++ struct dasd_diag_bio *bio; + unsigned int sb, bsize; + blocknum_t end_block; + int rc; +@@ -395,29 +395,36 @@ dasd_diag_check_device(struct dasd_device *device) + rc = -ENOMEM; + goto out; + } ++ bio = kzalloc(sizeof(*bio), GFP_KERNEL); ++ if (bio == NULL) { ++ DBF_DEV_EVENT(DBF_WARNING, device, "%s", ++ "No memory to allocate initialization bio"); ++ rc = -ENOMEM; ++ goto out_label; ++ } + rc = 0; + end_block = 0; + /* try all sizes - needed for ECKD devices */ + for (bsize = 512; bsize <= PAGE_SIZE; bsize <<= 1) { + mdsk_init_io(device, bsize, 0, &end_block); +- memset(&bio, 0, sizeof (struct dasd_diag_bio)); +- bio.type = MDSK_READ_REQ; +- bio.block_number = private->pt_block + 1; +- bio.buffer = label; ++ memset(bio, 0, sizeof(*bio)); ++ bio->type = MDSK_READ_REQ; ++ bio->block_number = private->pt_block + 1; ++ bio->buffer = label; + memset(&private->iob, 0, sizeof (struct dasd_diag_rw_io)); + private->iob.dev_nr = rdc_data->dev_nr; + private->iob.key = 0; + private->iob.flags = 0; /* do synchronous io */ + private->iob.block_count = 1; + private->iob.interrupt_params = 0; +- private->iob.bio_list = &bio; ++ private->iob.bio_list = bio; + private->iob.flaga = DASD_DIAG_FLAGA_DEFAULT; + rc = dia250(&private->iob, RW_BIO); + if (rc == 3) { + pr_warn("%s: A 64-bit DIAG call failed\n", + dev_name(&device->cdev->dev)); + rc = -EOPNOTSUPP; +- goto out_label; ++ goto out_bio; + } + mdsk_term_io(device); + if (rc == 0) +@@ -427,7 +434,7 @@ dasd_diag_check_device(struct dasd_device *device) + pr_warn("%s: Accessing the DASD failed because of an incorrect format (rc=%d)\n", + dev_name(&device->cdev->dev), rc); + rc = -EIO; +- goto out_label; ++ goto out_bio; + } + /* check for label block */ + if (memcmp(label->label_id, DASD_DIAG_CMS1, +@@ -457,6 +464,8 @@ dasd_diag_check_device(struct dasd_device *device) + (rc == 4) ? ", read-only device" : ""); + rc = 0; + } ++out_bio: ++ kfree(bio); + out_label: + free_page((long) label); + out: +diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c +index 92bace3b28fd..4ce28aa490cd 100644 +--- a/drivers/s390/net/qeth_l2_main.c ++++ b/drivers/s390/net/qeth_l2_main.c +@@ -1199,6 +1199,10 @@ static void qeth_bridge_state_change(struct qeth_card *card, + int extrasize; + + QETH_CARD_TEXT(card, 2, "brstchng"); ++ if (qports->num_entries == 0) { ++ QETH_CARD_TEXT(card, 2, "BPempty"); ++ return; ++ } + if (qports->entry_length != sizeof(struct qeth_sbp_port_entry)) { + QETH_CARD_TEXT_(card, 2, "BPsz%04x", qports->entry_length); + return; +diff --git a/drivers/scsi/arm/cumana_2.c b/drivers/scsi/arm/cumana_2.c +index a1f3e9ee4e63..14e1d001253c 100644 +--- a/drivers/scsi/arm/cumana_2.c ++++ b/drivers/scsi/arm/cumana_2.c +@@ -450,7 +450,7 @@ static int cumanascsi2_probe(struct expansion_card *ec, + + if (info->info.scsi.dma != NO_DMA) + free_dma(info->info.scsi.dma); +- free_irq(ec->irq, host); ++ free_irq(ec->irq, info); + + out_release: + fas216_release(host); +diff --git a/drivers/scsi/arm/eesox.c b/drivers/scsi/arm/eesox.c +index 134f040d58e2..f441ec8eb93d 100644 +--- a/drivers/scsi/arm/eesox.c ++++ b/drivers/scsi/arm/eesox.c +@@ -571,7 +571,7 @@ static int eesoxscsi_probe(struct expansion_card *ec, const struct ecard_id *id) + + if (info->info.scsi.dma != NO_DMA) + free_dma(info->info.scsi.dma); +- free_irq(ec->irq, host); ++ free_irq(ec->irq, info); + + out_remove: + fas216_remove(host); +diff --git a/drivers/scsi/arm/powertec.c b/drivers/scsi/arm/powertec.c +index c795537a671c..2dc0df005cb3 100644 +--- a/drivers/scsi/arm/powertec.c ++++ b/drivers/scsi/arm/powertec.c +@@ -378,7 +378,7 @@ static int powertecscsi_probe(struct expansion_card *ec, + + if (info->info.scsi.dma != NO_DMA) + free_dma(info->info.scsi.dma); +- free_irq(ec->irq, host); ++ free_irq(ec->irq, info); + + out_release: + fas216_release(host); +diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c +index 0cbe6740e0c9..2c2966a297c7 100644 +--- a/drivers/scsi/megaraid/megaraid_sas_base.c ++++ b/drivers/scsi/megaraid/megaraid_sas_base.c +@@ -5586,9 +5586,13 @@ megasas_setup_irqs_msix(struct megasas_instance *instance, u8 is_probe) + &instance->irq_context[i])) { + dev_err(&instance->pdev->dev, + "Failed to register IRQ for vector %d.\n", i); +- for (j = 0; j < i; j++) ++ for (j = 0; j < i; j++) { ++ if (j < instance->low_latency_index_start) ++ irq_set_affinity_hint( ++ pci_irq_vector(pdev, j), NULL); + free_irq(pci_irq_vector(pdev, j), + &instance->irq_context[j]); ++ } + /* Retry irq register for IO_APIC*/ + instance->msix_vectors = 0; + instance->msix_load_balance = false; +@@ -5626,6 +5630,9 @@ megasas_destroy_irqs(struct megasas_instance *instance) { + + if (instance->msix_vectors) + for (i = 0; i < instance->msix_vectors; i++) { ++ if (i < instance->low_latency_index_start) ++ irq_set_affinity_hint( ++ pci_irq_vector(instance->pdev, i), NULL); + free_irq(pci_irq_vector(instance->pdev, i), + &instance->irq_context[i]); + } +diff --git a/drivers/scsi/mesh.c b/drivers/scsi/mesh.c +index 74fb50644678..4dd50db90677 100644 +--- a/drivers/scsi/mesh.c ++++ b/drivers/scsi/mesh.c +@@ -1045,6 +1045,8 @@ static void handle_error(struct mesh_state *ms) + while ((in_8(&mr->bus_status1) & BS1_RST) != 0) + udelay(1); + printk("done\n"); ++ if (ms->dma_started) ++ halt_dma(ms); + handle_reset(ms); + /* request_q is empty, no point in mesh_start() */ + return; +@@ -1357,7 +1359,8 @@ static void halt_dma(struct mesh_state *ms) + ms->conn_tgt, ms->data_ptr, scsi_bufflen(cmd), + ms->tgts[ms->conn_tgt].data_goes_out); + } +- scsi_dma_unmap(cmd); ++ if (cmd) ++ scsi_dma_unmap(cmd); + ms->dma_started = 0; + } + +@@ -1712,6 +1715,9 @@ static int mesh_host_reset(struct scsi_cmnd *cmd) + + spin_lock_irqsave(ms->host->host_lock, flags); + ++ if (ms->dma_started) ++ halt_dma(ms); ++ + /* Reset the controller & dbdma channel */ + out_le32(&md->control, (RUN|PAUSE|FLUSH|WAKE) << 16); /* stop dma */ + out_8(&mr->exception, 0xff); /* clear all exception bits */ +diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c +index 32965ec76965..44181a2cbf18 100644 +--- a/drivers/scsi/scsi_debug.c ++++ b/drivers/scsi/scsi_debug.c +@@ -5296,6 +5296,12 @@ static int __init scsi_debug_init(void) + pr_err("submit_queues must be 1 or more\n"); + return -EINVAL; + } ++ ++ if ((sdebug_max_queue > SDEBUG_CANQUEUE) || (sdebug_max_queue < 1)) { ++ pr_err("max_queue must be in range [1, %d]\n", SDEBUG_CANQUEUE); ++ return -EINVAL; ++ } ++ + sdebug_q_arr = kcalloc(submit_queues, sizeof(struct sdebug_queue), + GFP_KERNEL); + if (sdebug_q_arr == NULL) +diff --git a/drivers/soc/qcom/rpmh-rsc.c b/drivers/soc/qcom/rpmh-rsc.c +index 0ba1f465db12..8924fcd9f5f5 100644 +--- a/drivers/soc/qcom/rpmh-rsc.c ++++ b/drivers/soc/qcom/rpmh-rsc.c +@@ -715,6 +715,7 @@ static struct platform_driver rpmh_driver = { + .driver = { + .name = "rpmh", + .of_match_table = rpmh_drv_match, ++ .suppress_bind_attrs = true, + }, + }; + +diff --git a/drivers/spi/spi-lantiq-ssc.c b/drivers/spi/spi-lantiq-ssc.c +index 9dfe8b04e688..f9bc1705c0d4 100644 +--- a/drivers/spi/spi-lantiq-ssc.c ++++ b/drivers/spi/spi-lantiq-ssc.c +@@ -184,6 +184,7 @@ struct lantiq_ssc_spi { + unsigned int tx_fifo_size; + unsigned int rx_fifo_size; + unsigned int base_cs; ++ unsigned int fdx_tx_level; + }; + + static u32 lantiq_ssc_readl(const struct lantiq_ssc_spi *spi, u32 reg) +@@ -481,6 +482,7 @@ static void tx_fifo_write(struct lantiq_ssc_spi *spi) + u32 data; + unsigned int tx_free = tx_fifo_free(spi); + ++ spi->fdx_tx_level = 0; + while (spi->tx_todo && tx_free) { + switch (spi->bits_per_word) { + case 2 ... 8: +@@ -509,6 +511,7 @@ static void tx_fifo_write(struct lantiq_ssc_spi *spi) + + lantiq_ssc_writel(spi, data, LTQ_SPI_TB); + tx_free--; ++ spi->fdx_tx_level++; + } + } + +@@ -520,6 +523,13 @@ static void rx_fifo_read_full_duplex(struct lantiq_ssc_spi *spi) + u32 data; + unsigned int rx_fill = rx_fifo_level(spi); + ++ /* ++ * Wait until all expected data to be shifted in. ++ * Otherwise, rx overrun may occur. ++ */ ++ while (rx_fill != spi->fdx_tx_level) ++ rx_fill = rx_fifo_level(spi); ++ + while (rx_fill) { + data = lantiq_ssc_readl(spi, LTQ_SPI_RB); + +@@ -907,7 +917,7 @@ static int lantiq_ssc_probe(struct platform_device *pdev) + master->bits_per_word_mask = SPI_BPW_RANGE_MASK(2, 8) | + SPI_BPW_MASK(16) | SPI_BPW_MASK(32); + +- spi->wq = alloc_ordered_workqueue(dev_name(dev), 0); ++ spi->wq = alloc_ordered_workqueue(dev_name(dev), WQ_MEM_RECLAIM); + if (!spi->wq) { + err = -ENOMEM; + goto err_clk_put; +diff --git a/drivers/spi/spi-rockchip.c b/drivers/spi/spi-rockchip.c +index 2cc6d9951b52..008b64f4e031 100644 +--- a/drivers/spi/spi-rockchip.c ++++ b/drivers/spi/spi-rockchip.c +@@ -286,7 +286,7 @@ static void rockchip_spi_pio_writer(struct rockchip_spi *rs) + static void rockchip_spi_pio_reader(struct rockchip_spi *rs) + { + u32 words = readl_relaxed(rs->regs + ROCKCHIP_SPI_RXFLR); +- u32 rx_left = rs->rx_left - words; ++ u32 rx_left = (rs->rx_left > words) ? rs->rx_left - words : 0; + + /* the hardware doesn't allow us to change fifo threshold + * level while spi is enabled, so instead make sure to leave +diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c +index ac6bf1fbbfe6..be503a0e6ef7 100644 +--- a/drivers/spi/spidev.c ++++ b/drivers/spi/spidev.c +@@ -223,6 +223,11 @@ static int spidev_message(struct spidev_data *spidev, + for (n = n_xfers, k_tmp = k_xfers, u_tmp = u_xfers; + n; + n--, k_tmp++, u_tmp++) { ++ /* Ensure that also following allocations from rx_buf/tx_buf will meet ++ * DMA alignment requirements. ++ */ ++ unsigned int len_aligned = ALIGN(u_tmp->len, ARCH_KMALLOC_MINALIGN); ++ + k_tmp->len = u_tmp->len; + + total += k_tmp->len; +@@ -238,17 +243,17 @@ static int spidev_message(struct spidev_data *spidev, + + if (u_tmp->rx_buf) { + /* this transfer needs space in RX bounce buffer */ +- rx_total += k_tmp->len; ++ rx_total += len_aligned; + if (rx_total > bufsiz) { + status = -EMSGSIZE; + goto done; + } + k_tmp->rx_buf = rx_buf; +- rx_buf += k_tmp->len; ++ rx_buf += len_aligned; + } + if (u_tmp->tx_buf) { + /* this transfer needs space in TX bounce buffer */ +- tx_total += k_tmp->len; ++ tx_total += len_aligned; + if (tx_total > bufsiz) { + status = -EMSGSIZE; + goto done; +@@ -258,7 +263,7 @@ static int spidev_message(struct spidev_data *spidev, + (uintptr_t) u_tmp->tx_buf, + u_tmp->len)) + goto done; +- tx_buf += k_tmp->len; ++ tx_buf += len_aligned; + } + + k_tmp->cs_change = !!u_tmp->cs_change; +@@ -290,16 +295,16 @@ static int spidev_message(struct spidev_data *spidev, + goto done; + + /* copy any rx data out of bounce buffer */ +- rx_buf = spidev->rx_buffer; +- for (n = n_xfers, u_tmp = u_xfers; n; n--, u_tmp++) { ++ for (n = n_xfers, k_tmp = k_xfers, u_tmp = u_xfers; ++ n; ++ n--, k_tmp++, u_tmp++) { + if (u_tmp->rx_buf) { + if (copy_to_user((u8 __user *) +- (uintptr_t) u_tmp->rx_buf, rx_buf, ++ (uintptr_t) u_tmp->rx_buf, k_tmp->rx_buf, + u_tmp->len)) { + status = -EFAULT; + goto done; + } +- rx_buf += u_tmp->len; + } + } + status = total; +diff --git a/drivers/staging/rtl8192u/r8192U_core.c b/drivers/staging/rtl8192u/r8192U_core.c +index 511136dce3a4..ddc09616248a 100644 +--- a/drivers/staging/rtl8192u/r8192U_core.c ++++ b/drivers/staging/rtl8192u/r8192U_core.c +@@ -2401,7 +2401,7 @@ static int rtl8192_read_eeprom_info(struct net_device *dev) + ret = eprom_read(dev, (EEPROM_TX_PW_INDEX_CCK >> 1)); + if (ret < 0) + return ret; +- priv->EEPROMTxPowerLevelCCK = ((u16)ret & 0xff) >> 8; ++ priv->EEPROMTxPowerLevelCCK = ((u16)ret & 0xff00) >> 8; + } else + priv->EEPROMTxPowerLevelCCK = 0x10; + RT_TRACE(COMP_EPROM, "CCK Tx Power Levl: 0x%02x\n", priv->EEPROMTxPowerLevelCCK); +diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c +index af6bf0736b52..eb76cc2cbfd8 100644 +--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c ++++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c +@@ -3257,6 +3257,7 @@ failed_platform_init: + + static int vchiq_remove(struct platform_device *pdev) + { ++ platform_device_unregister(bcm2835_audio); + platform_device_unregister(bcm2835_camera); + vchiq_debugfs_deinit(); + device_destroy(vchiq_class, vchiq_devid); +diff --git a/drivers/thermal/ti-soc-thermal/ti-thermal-common.c b/drivers/thermal/ti-soc-thermal/ti-thermal-common.c +index 85776db4bf34..2ce4b19f312a 100644 +--- a/drivers/thermal/ti-soc-thermal/ti-thermal-common.c ++++ b/drivers/thermal/ti-soc-thermal/ti-thermal-common.c +@@ -169,7 +169,7 @@ int ti_thermal_expose_sensor(struct ti_bandgap *bgp, int id, + + data = ti_bandgap_get_sensor_data(bgp, id); + +- if (!IS_ERR_OR_NULL(data)) ++ if (IS_ERR_OR_NULL(data)) + data = ti_thermal_build_data(bgp, id); + + if (!data) +diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c +index e0b77674869c..c96c50faccf7 100644 +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -25,17 +25,23 @@ static unsigned int quirk_count; + + static char quirks_param[128]; + +-static int quirks_param_set(const char *val, const struct kernel_param *kp) ++static int quirks_param_set(const char *value, const struct kernel_param *kp) + { +- char *p, *field; ++ char *val, *p, *field; + u16 vid, pid; + u32 flags; + size_t i; + int err; + ++ val = kstrdup(value, GFP_KERNEL); ++ if (!val) ++ return -ENOMEM; ++ + err = param_set_copystring(val, kp); +- if (err) ++ if (err) { ++ kfree(val); + return err; ++ } + + mutex_lock(&quirk_mutex); + +@@ -60,10 +66,11 @@ static int quirks_param_set(const char *val, const struct kernel_param *kp) + if (!quirk_list) { + quirk_count = 0; + mutex_unlock(&quirk_mutex); ++ kfree(val); + return -ENOMEM; + } + +- for (i = 0, p = (char *)val; p && *p;) { ++ for (i = 0, p = val; p && *p;) { + /* Each entry consists of VID:PID:flags */ + field = strsep(&p, ":"); + if (!field) +@@ -144,6 +151,7 @@ static int quirks_param_set(const char *val, const struct kernel_param *kp) + + unlock: + mutex_unlock(&quirk_mutex); ++ kfree(val); + + return 0; + } +diff --git a/drivers/usb/dwc2/platform.c b/drivers/usb/dwc2/platform.c +index 4e14c4f7fed7..34bb6124f1e2 100644 +--- a/drivers/usb/dwc2/platform.c ++++ b/drivers/usb/dwc2/platform.c +@@ -514,6 +514,7 @@ static int dwc2_driver_probe(struct platform_device *dev) + if (hsotg->gadget_enabled) { + retval = usb_add_gadget_udc(hsotg->dev, &hsotg->gadget); + if (retval) { ++ hsotg->gadget.udc = NULL; + dwc2_hsotg_remove(hsotg); + goto error; + } +@@ -522,7 +523,8 @@ static int dwc2_driver_probe(struct platform_device *dev) + return 0; + + error: +- dwc2_lowlevel_hw_disable(hsotg); ++ if (hsotg->dr_mode != USB_DR_MODE_PERIPHERAL) ++ dwc2_lowlevel_hw_disable(hsotg); + return retval; + } + +diff --git a/drivers/usb/gadget/function/f_uac2.c b/drivers/usb/gadget/function/f_uac2.c +index db2d4980cb35..3633df6d7610 100644 +--- a/drivers/usb/gadget/function/f_uac2.c ++++ b/drivers/usb/gadget/function/f_uac2.c +@@ -215,10 +215,7 @@ static struct uac2_ac_header_descriptor ac_hdr_desc = { + .bDescriptorSubtype = UAC_MS_HEADER, + .bcdADC = cpu_to_le16(0x200), + .bCategory = UAC2_FUNCTION_IO_BOX, +- .wTotalLength = cpu_to_le16(sizeof in_clk_src_desc +- + sizeof out_clk_src_desc + sizeof usb_out_it_desc +- + sizeof io_in_it_desc + sizeof usb_in_ot_desc +- + sizeof io_out_ot_desc), ++ /* .wTotalLength = DYNAMIC */ + .bmControls = 0, + }; + +@@ -501,7 +498,7 @@ static void setup_descriptor(struct f_uac2_opts *opts) + as_in_hdr_desc.bTerminalLink = usb_in_ot_desc.bTerminalID; + + iad_desc.bInterfaceCount = 1; +- ac_hdr_desc.wTotalLength = 0; ++ ac_hdr_desc.wTotalLength = cpu_to_le16(sizeof(ac_hdr_desc)); + + if (EPIN_EN(opts)) { + u16 len = le16_to_cpu(ac_hdr_desc.wTotalLength); +diff --git a/drivers/usb/gadget/udc/bdc/bdc_core.c b/drivers/usb/gadget/udc/bdc/bdc_core.c +index cc4a16e253ac..3d33499db50b 100644 +--- a/drivers/usb/gadget/udc/bdc/bdc_core.c ++++ b/drivers/usb/gadget/udc/bdc/bdc_core.c +@@ -282,6 +282,7 @@ static void bdc_mem_init(struct bdc *bdc, bool reinit) + * in that case reinit is passed as 1 + */ + if (reinit) { ++ int i; + /* Enable interrupts */ + temp = bdc_readl(bdc->regs, BDC_BDCSC); + temp |= BDC_GIE; +@@ -291,6 +292,9 @@ static void bdc_mem_init(struct bdc *bdc, bool reinit) + /* Initialize SRR to 0 */ + memset(bdc->srr.sr_bds, 0, + NUM_SR_ENTRIES * sizeof(struct bdc_bd)); ++ /* clear ep flags to avoid post disconnect stops/deconfigs */ ++ for (i = 1; i < bdc->num_eps; ++i) ++ bdc->bdc_ep_array[i]->flags = 0; + } else { + /* One time initiaization only */ + /* Enable status report function pointers */ +@@ -601,9 +605,14 @@ static int bdc_remove(struct platform_device *pdev) + static int bdc_suspend(struct device *dev) + { + struct bdc *bdc = dev_get_drvdata(dev); ++ int ret; + +- clk_disable_unprepare(bdc->clk); +- return 0; ++ /* Halt the controller */ ++ ret = bdc_stop(bdc); ++ if (!ret) ++ clk_disable_unprepare(bdc->clk); ++ ++ return ret; + } + + static int bdc_resume(struct device *dev) +diff --git a/drivers/usb/gadget/udc/bdc/bdc_ep.c b/drivers/usb/gadget/udc/bdc/bdc_ep.c +index d49c6dc1082d..9ddc0b4e92c9 100644 +--- a/drivers/usb/gadget/udc/bdc/bdc_ep.c ++++ b/drivers/usb/gadget/udc/bdc/bdc_ep.c +@@ -615,7 +615,6 @@ int bdc_ep_enable(struct bdc_ep *ep) + } + bdc_dbg_bd_list(bdc, ep); + /* only for ep0: config ep is called for ep0 from connect event */ +- ep->flags |= BDC_EP_ENABLED; + if (ep->ep_num == 1) + return ret; + +@@ -759,10 +758,13 @@ static int ep_dequeue(struct bdc_ep *ep, struct bdc_req *req) + __func__, ep->name, start_bdi, end_bdi); + dev_dbg(bdc->dev, "ep_dequeue ep=%p ep->desc=%p\n", + ep, (void *)ep->usb_ep.desc); +- /* Stop the ep to see where the HW is ? */ +- ret = bdc_stop_ep(bdc, ep->ep_num); +- /* if there is an issue with stopping ep, then no need to go further */ +- if (ret) ++ /* if still connected, stop the ep to see where the HW is ? */ ++ if (!(bdc_readl(bdc->regs, BDC_USPC) & BDC_PST_MASK)) { ++ ret = bdc_stop_ep(bdc, ep->ep_num); ++ /* if there is an issue, then no need to go further */ ++ if (ret) ++ return 0; ++ } else + return 0; + + /* +@@ -1911,7 +1913,9 @@ static int bdc_gadget_ep_disable(struct usb_ep *_ep) + __func__, ep->name, ep->flags); + + if (!(ep->flags & BDC_EP_ENABLED)) { +- dev_warn(bdc->dev, "%s is already disabled\n", ep->name); ++ if (bdc->gadget.speed != USB_SPEED_UNKNOWN) ++ dev_warn(bdc->dev, "%s is already disabled\n", ++ ep->name); + return 0; + } + spin_lock_irqsave(&bdc->lock, flags); +diff --git a/drivers/usb/gadget/udc/net2280.c b/drivers/usb/gadget/udc/net2280.c +index 51efee21915f..7c616d7641c6 100644 +--- a/drivers/usb/gadget/udc/net2280.c ++++ b/drivers/usb/gadget/udc/net2280.c +@@ -3782,8 +3782,10 @@ static int net2280_probe(struct pci_dev *pdev, const struct pci_device_id *id) + return 0; + + done: +- if (dev) ++ if (dev) { + net2280_remove(pdev); ++ kfree(dev); ++ } + return retval; + } + +diff --git a/drivers/usb/mtu3/mtu3_core.c b/drivers/usb/mtu3/mtu3_core.c +index 9dd02160cca9..e3780d4d6514 100644 +--- a/drivers/usb/mtu3/mtu3_core.c ++++ b/drivers/usb/mtu3/mtu3_core.c +@@ -131,8 +131,12 @@ static void mtu3_device_disable(struct mtu3 *mtu) + mtu3_setbits(ibase, SSUSB_U2_CTRL(0), + SSUSB_U2_PORT_DIS | SSUSB_U2_PORT_PDN); + +- if (mtu->ssusb->dr_mode == USB_DR_MODE_OTG) ++ if (mtu->ssusb->dr_mode == USB_DR_MODE_OTG) { + mtu3_clrbits(ibase, SSUSB_U2_CTRL(0), SSUSB_U2_PORT_OTG_SEL); ++ if (mtu->is_u3_ip) ++ mtu3_clrbits(ibase, SSUSB_U3_CTRL(0), ++ SSUSB_U3_PORT_DUAL_MODE); ++ } + + mtu3_setbits(ibase, U3D_SSUSB_IP_PW_CTRL2, SSUSB_IP_DEV_PDN); + } +diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c +index f5143eedbc48..a90801ef0055 100644 +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -272,6 +272,8 @@ static struct usb_serial_driver cp210x_device = { + .break_ctl = cp210x_break_ctl, + .set_termios = cp210x_set_termios, + .tx_empty = cp210x_tx_empty, ++ .throttle = usb_serial_generic_throttle, ++ .unthrottle = usb_serial_generic_unthrottle, + .tiocmget = cp210x_tiocmget, + .tiocmset = cp210x_tiocmset, + .attach = cp210x_attach, +@@ -915,6 +917,7 @@ static void cp210x_get_termios_port(struct usb_serial_port *port, + u32 baud; + u16 bits; + u32 ctl_hs; ++ u32 flow_repl; + + cp210x_read_u32_reg(port, CP210X_GET_BAUDRATE, &baud); + +@@ -1015,6 +1018,22 @@ static void cp210x_get_termios_port(struct usb_serial_port *port, + ctl_hs = le32_to_cpu(flow_ctl.ulControlHandshake); + if (ctl_hs & CP210X_SERIAL_CTS_HANDSHAKE) { + dev_dbg(dev, "%s - flow control = CRTSCTS\n", __func__); ++ /* ++ * When the port is closed, the CP210x hardware disables ++ * auto-RTS and RTS is deasserted but it leaves auto-CTS when ++ * in hardware flow control mode. When re-opening the port, if ++ * auto-CTS is enabled on the cp210x, then auto-RTS must be ++ * re-enabled in the driver. ++ */ ++ flow_repl = le32_to_cpu(flow_ctl.ulFlowReplace); ++ flow_repl &= ~CP210X_SERIAL_RTS_MASK; ++ flow_repl |= CP210X_SERIAL_RTS_SHIFT(CP210X_SERIAL_RTS_FLOW_CTL); ++ flow_ctl.ulFlowReplace = cpu_to_le32(flow_repl); ++ cp210x_write_reg_block(port, ++ CP210X_SET_FLOW, ++ &flow_ctl, ++ sizeof(flow_ctl)); ++ + cflag |= CRTSCTS; + } else { + dev_dbg(dev, "%s - flow control = NONE\n", __func__); +diff --git a/drivers/usb/serial/iuu_phoenix.c b/drivers/usb/serial/iuu_phoenix.c +index b8dfeb4fb2ed..ffbb2a8901b2 100644 +--- a/drivers/usb/serial/iuu_phoenix.c ++++ b/drivers/usb/serial/iuu_phoenix.c +@@ -353,10 +353,11 @@ static void iuu_led_activity_on(struct urb *urb) + struct usb_serial_port *port = urb->context; + int result; + char *buf_ptr = port->write_urb->transfer_buffer; +- *buf_ptr++ = IUU_SET_LED; ++ + if (xmas) { +- get_random_bytes(buf_ptr, 6); +- *(buf_ptr+7) = 1; ++ buf_ptr[0] = IUU_SET_LED; ++ get_random_bytes(buf_ptr + 1, 6); ++ buf_ptr[7] = 1; + } else { + iuu_rgbf_fill_buffer(buf_ptr, 255, 255, 0, 0, 0, 0, 255); + } +@@ -374,13 +375,14 @@ static void iuu_led_activity_off(struct urb *urb) + struct usb_serial_port *port = urb->context; + int result; + char *buf_ptr = port->write_urb->transfer_buffer; ++ + if (xmas) { + iuu_rxcmd(urb); + return; +- } else { +- *buf_ptr++ = IUU_SET_LED; +- iuu_rgbf_fill_buffer(buf_ptr, 0, 0, 255, 255, 0, 0, 255); + } ++ ++ iuu_rgbf_fill_buffer(buf_ptr, 0, 0, 255, 255, 0, 0, 255); ++ + usb_fill_bulk_urb(port->write_urb, port->serial->dev, + usb_sndbulkpipe(port->serial->dev, + port->bulk_out_endpointAddress), +diff --git a/drivers/video/console/newport_con.c b/drivers/video/console/newport_con.c +index 00dddf6e08b0..2d2ee17052e8 100644 +--- a/drivers/video/console/newport_con.c ++++ b/drivers/video/console/newport_con.c +@@ -32,6 +32,8 @@ + #include + #include + ++#define NEWPORT_LEN 0x10000 ++ + #define FONT_DATA ((unsigned char *)font_vga_8x16.data) + + /* borrowed from fbcon.c */ +@@ -43,6 +45,7 @@ + static unsigned char *font_data[MAX_NR_CONSOLES]; + + static struct newport_regs *npregs; ++static unsigned long newport_addr; + + static int logo_active; + static int topscan; +@@ -702,7 +705,6 @@ const struct consw newport_con = { + static int newport_probe(struct gio_device *dev, + const struct gio_device_id *id) + { +- unsigned long newport_addr; + int err; + + if (!dev->resource.start) +@@ -712,7 +714,7 @@ static int newport_probe(struct gio_device *dev, + return -EBUSY; /* we only support one Newport as console */ + + newport_addr = dev->resource.start + 0xF0000; +- if (!request_mem_region(newport_addr, 0x10000, "Newport")) ++ if (!request_mem_region(newport_addr, NEWPORT_LEN, "Newport")) + return -ENODEV; + + npregs = (struct newport_regs *)/* ioremap cannot fail */ +@@ -720,6 +722,11 @@ static int newport_probe(struct gio_device *dev, + console_lock(); + err = do_take_over_console(&newport_con, 0, MAX_NR_CONSOLES - 1, 1); + console_unlock(); ++ ++ if (err) { ++ iounmap((void *)npregs); ++ release_mem_region(newport_addr, NEWPORT_LEN); ++ } + return err; + } + +@@ -727,6 +734,7 @@ static void newport_remove(struct gio_device *dev) + { + give_up_console(&newport_con); + iounmap((void *)npregs); ++ release_mem_region(newport_addr, NEWPORT_LEN); + } + + static struct gio_device_id newport_ids[] = { +diff --git a/drivers/video/fbdev/neofb.c b/drivers/video/fbdev/neofb.c +index b770946a0920..76464000933d 100644 +--- a/drivers/video/fbdev/neofb.c ++++ b/drivers/video/fbdev/neofb.c +@@ -1820,6 +1820,7 @@ static int neo_scan_monitor(struct fb_info *info) + #else + printk(KERN_ERR + "neofb: Only 640x480, 800x600/480 and 1024x768 panels are currently supported\n"); ++ kfree(info->monspecs.modedb); + return -1; + #endif + default: +diff --git a/drivers/video/fbdev/pxafb.c b/drivers/video/fbdev/pxafb.c +index f70c9f79622e..27635926cea3 100644 +--- a/drivers/video/fbdev/pxafb.c ++++ b/drivers/video/fbdev/pxafb.c +@@ -2425,8 +2425,8 @@ static int pxafb_remove(struct platform_device *dev) + + free_pages_exact(fbi->video_mem, fbi->video_mem_size); + +- dma_free_wc(&dev->dev, fbi->dma_buff_size, fbi->dma_buff, +- fbi->dma_buff_phys); ++ dma_free_coherent(&dev->dev, fbi->dma_buff_size, fbi->dma_buff, ++ fbi->dma_buff_phys); + + return 0; + } +diff --git a/drivers/video/fbdev/savage/savagefb_driver.c b/drivers/video/fbdev/savage/savagefb_driver.c +index 512789f5f884..d5d22d9c0f56 100644 +--- a/drivers/video/fbdev/savage/savagefb_driver.c ++++ b/drivers/video/fbdev/savage/savagefb_driver.c +@@ -2158,6 +2158,8 @@ static int savage_init_fb_info(struct fb_info *info, struct pci_dev *dev, + info->flags |= FBINFO_HWACCEL_COPYAREA | + FBINFO_HWACCEL_FILLRECT | + FBINFO_HWACCEL_IMAGEBLIT; ++ else ++ kfree(info->pixmap.addr); + } + #endif + return err; +diff --git a/drivers/video/fbdev/sm712fb.c b/drivers/video/fbdev/sm712fb.c +index 207d0add684b..246681414577 100644 +--- a/drivers/video/fbdev/sm712fb.c ++++ b/drivers/video/fbdev/sm712fb.c +@@ -1429,6 +1429,8 @@ static int smtc_map_smem(struct smtcfb_info *sfb, + static void smtc_unmap_smem(struct smtcfb_info *sfb) + { + if (sfb && sfb->fb->screen_base) { ++ if (sfb->chip_id == 0x720) ++ sfb->fb->screen_base -= 0x00200000; + iounmap(sfb->fb->screen_base); + sfb->fb->screen_base = NULL; + } +diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c +index bed90d612e48..ebb05517b6aa 100644 +--- a/drivers/xen/balloon.c ++++ b/drivers/xen/balloon.c +@@ -570,11 +570,13 @@ static int add_ballooned_pages(int nr_pages) + if (xen_hotplug_unpopulated) { + st = reserve_additional_memory(); + if (st != BP_ECANCELED) { ++ int rc; ++ + mutex_unlock(&balloon_mutex); +- wait_event(balloon_wq, ++ rc = wait_event_interruptible(balloon_wq, + !list_empty(&ballooned_pages)); + mutex_lock(&balloon_mutex); +- return 0; ++ return rc ? -ENOMEM : 0; + } + } + +@@ -632,6 +634,12 @@ int alloc_xenballooned_pages(int nr_pages, struct page **pages) + out_undo: + mutex_unlock(&balloon_mutex); + free_xenballooned_pages(pgno, pages); ++ /* ++ * NB: free_xenballooned_pages will only subtract pgno pages, but since ++ * target_unpopulated is incremented with nr_pages at the start we need ++ * to remove the remaining ones also, or accounting will be screwed. ++ */ ++ balloon_stats.target_unpopulated -= nr_pages - pgno; + return ret; + } + EXPORT_SYMBOL(alloc_xenballooned_pages); +diff --git a/drivers/xen/gntdev-dmabuf.c b/drivers/xen/gntdev-dmabuf.c +index 2c4f324f8626..da799929087d 100644 +--- a/drivers/xen/gntdev-dmabuf.c ++++ b/drivers/xen/gntdev-dmabuf.c +@@ -641,6 +641,14 @@ dmabuf_imp_to_refs(struct gntdev_dmabuf_priv *priv, struct device *dev, + goto fail_detach; + } + ++ /* Check that we have zero offset. */ ++ if (sgt->sgl->offset) { ++ ret = ERR_PTR(-EINVAL); ++ pr_debug("DMA buffer has %d bytes offset, user-space expects 0\n", ++ sgt->sgl->offset); ++ goto fail_unmap; ++ } ++ + /* Check number of pages that imported buffer has. */ + if (attach->dmabuf->size != gntdev_dmabuf->nr_pages << PAGE_SHIFT) { + ret = ERR_PTR(-EINVAL); +diff --git a/fs/9p/v9fs.c b/fs/9p/v9fs.c +index 15a99f9c7253..39def020a074 100644 +--- a/fs/9p/v9fs.c ++++ b/fs/9p/v9fs.c +@@ -500,10 +500,9 @@ void v9fs_session_close(struct v9fs_session_info *v9ses) + } + + #ifdef CONFIG_9P_FSCACHE +- if (v9ses->fscache) { ++ if (v9ses->fscache) + v9fs_cache_session_put_cookie(v9ses); +- kfree(v9ses->cachetag); +- } ++ kfree(v9ses->cachetag); + #endif + kfree(v9ses->uname); + kfree(v9ses->aname); +diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c +index 1a089a642422..99dcb3897659 100644 +--- a/fs/btrfs/extent_io.c ++++ b/fs/btrfs/extent_io.c +@@ -4481,6 +4481,8 @@ int try_release_extent_mapping(struct page *page, gfp_t mask) + + /* once for us */ + free_extent_map(em); ++ ++ cond_resched(); /* Allow large-extent preemption. */ + } + } + return try_release_extent_state(tree, page, mask); +diff --git a/fs/btrfs/space-info.c b/fs/btrfs/space-info.c +index 7889a59a57fa..6f484f0d347e 100644 +--- a/fs/btrfs/space-info.c ++++ b/fs/btrfs/space-info.c +@@ -304,8 +304,8 @@ again: + cache->key.objectid, cache->key.offset, + btrfs_block_group_used(&cache->item), cache->pinned, + cache->reserved, cache->ro ? "[readonly]" : ""); +- btrfs_dump_free_space(cache, bytes); + spin_unlock(&cache->lock); ++ btrfs_dump_free_space(cache, bytes); + } + if (++index < BTRFS_NR_RAID_TYPES) + goto again; +diff --git a/fs/dlm/lockspace.c b/fs/dlm/lockspace.c +index afb8340918b8..c689359ca532 100644 +--- a/fs/dlm/lockspace.c ++++ b/fs/dlm/lockspace.c +@@ -632,6 +632,9 @@ static int new_lockspace(const char *name, const char *cluster, + wait_event(ls->ls_recover_lock_wait, + test_bit(LSFL_RECOVER_LOCK, &ls->ls_flags)); + ++ /* let kobject handle freeing of ls if there's an error */ ++ do_unreg = 1; ++ + ls->ls_kobj.kset = dlm_kset; + error = kobject_init_and_add(&ls->ls_kobj, &dlm_ktype, NULL, + "%s", ls->ls_name); +@@ -639,9 +642,6 @@ static int new_lockspace(const char *name, const char *cluster, + goto out_recoverd; + kobject_uevent(&ls->ls_kobj, KOBJ_ADD); + +- /* let kobject handle freeing of ls if there's an error */ +- do_unreg = 1; +- + /* This uevent triggers dlm_controld in userspace to add us to the + group of nodes that are members of this lockspace (managed by the + cluster infrastructure.) Once it's done that, it tells us who the +diff --git a/fs/erofs/inode.c b/fs/erofs/inode.c +index 3350ab65d892..b36b414cd7a7 100644 +--- a/fs/erofs/inode.c ++++ b/fs/erofs/inode.c +@@ -8,31 +8,80 @@ + + #include + +-/* no locking */ +-static int erofs_read_inode(struct inode *inode, void *data) ++/* ++ * if inode is successfully read, return its inode page (or sometimes ++ * the inode payload page if it's an extended inode) in order to fill ++ * inline data if possible. ++ */ ++static struct page *erofs_read_inode(struct inode *inode, ++ unsigned int *ofs) + { ++ struct super_block *sb = inode->i_sb; ++ struct erofs_sb_info *sbi = EROFS_SB(sb); + struct erofs_inode *vi = EROFS_I(inode); +- struct erofs_inode_compact *dic = data; +- struct erofs_inode_extended *die; ++ const erofs_off_t inode_loc = iloc(sbi, vi->nid); ++ ++ erofs_blk_t blkaddr, nblks = 0; ++ struct page *page; ++ struct erofs_inode_compact *dic; ++ struct erofs_inode_extended *die, *copied = NULL; ++ unsigned int ifmt; ++ int err; + +- const unsigned int ifmt = le16_to_cpu(dic->i_format); +- struct erofs_sb_info *sbi = EROFS_SB(inode->i_sb); +- erofs_blk_t nblks = 0; ++ blkaddr = erofs_blknr(inode_loc); ++ *ofs = erofs_blkoff(inode_loc); + +- vi->datalayout = erofs_inode_datalayout(ifmt); ++ erofs_dbg("%s, reading inode nid %llu at %u of blkaddr %u", ++ __func__, vi->nid, *ofs, blkaddr); ++ ++ page = erofs_get_meta_page(sb, blkaddr); ++ if (IS_ERR(page)) { ++ erofs_err(sb, "failed to get inode (nid: %llu) page, err %ld", ++ vi->nid, PTR_ERR(page)); ++ return page; ++ } + ++ dic = page_address(page) + *ofs; ++ ifmt = le16_to_cpu(dic->i_format); ++ ++ vi->datalayout = erofs_inode_datalayout(ifmt); + if (vi->datalayout >= EROFS_INODE_DATALAYOUT_MAX) { + erofs_err(inode->i_sb, "unsupported datalayout %u of nid %llu", + vi->datalayout, vi->nid); +- DBG_BUGON(1); +- return -EOPNOTSUPP; ++ err = -EOPNOTSUPP; ++ goto err_out; + } + + switch (erofs_inode_version(ifmt)) { + case EROFS_INODE_LAYOUT_EXTENDED: +- die = data; +- + vi->inode_isize = sizeof(struct erofs_inode_extended); ++ /* check if the inode acrosses page boundary */ ++ if (*ofs + vi->inode_isize <= PAGE_SIZE) { ++ *ofs += vi->inode_isize; ++ die = (struct erofs_inode_extended *)dic; ++ } else { ++ const unsigned int gotten = PAGE_SIZE - *ofs; ++ ++ copied = kmalloc(vi->inode_isize, GFP_NOFS); ++ if (!copied) { ++ err = -ENOMEM; ++ goto err_out; ++ } ++ memcpy(copied, dic, gotten); ++ unlock_page(page); ++ put_page(page); ++ ++ page = erofs_get_meta_page(sb, blkaddr + 1); ++ if (IS_ERR(page)) { ++ erofs_err(sb, "failed to get inode payload page (nid: %llu), err %ld", ++ vi->nid, PTR_ERR(page)); ++ kfree(copied); ++ return page; ++ } ++ *ofs = vi->inode_isize - gotten; ++ memcpy((u8 *)copied + gotten, page_address(page), *ofs); ++ die = copied; ++ } + vi->xattr_isize = erofs_xattr_ibody_size(die->i_xattr_icount); + + inode->i_mode = le16_to_cpu(die->i_mode); +@@ -69,9 +118,12 @@ static int erofs_read_inode(struct inode *inode, void *data) + /* total blocks for compressed files */ + if (erofs_inode_is_data_compressed(vi->datalayout)) + nblks = le32_to_cpu(die->i_u.compressed_blocks); ++ ++ kfree(copied); + break; + case EROFS_INODE_LAYOUT_COMPACT: + vi->inode_isize = sizeof(struct erofs_inode_compact); ++ *ofs += vi->inode_isize; + vi->xattr_isize = erofs_xattr_ibody_size(dic->i_xattr_icount); + + inode->i_mode = le16_to_cpu(dic->i_mode); +@@ -111,8 +163,8 @@ static int erofs_read_inode(struct inode *inode, void *data) + erofs_err(inode->i_sb, + "unsupported on-disk inode version %u of nid %llu", + erofs_inode_version(ifmt), vi->nid); +- DBG_BUGON(1); +- return -EOPNOTSUPP; ++ err = -EOPNOTSUPP; ++ goto err_out; + } + + if (!nblks) +@@ -120,13 +172,18 @@ static int erofs_read_inode(struct inode *inode, void *data) + inode->i_blocks = roundup(inode->i_size, EROFS_BLKSIZ) >> 9; + else + inode->i_blocks = nblks << LOG_SECTORS_PER_BLOCK; +- return 0; ++ return page; + + bogusimode: + erofs_err(inode->i_sb, "bogus i_mode (%o) @ nid %llu", + inode->i_mode, vi->nid); ++ err = -EFSCORRUPTED; ++err_out: + DBG_BUGON(1); +- return -EFSCORRUPTED; ++ kfree(copied); ++ unlock_page(page); ++ put_page(page); ++ return ERR_PTR(err); + } + + static int erofs_fill_symlink(struct inode *inode, void *data, +@@ -146,7 +203,7 @@ static int erofs_fill_symlink(struct inode *inode, void *data, + if (!lnk) + return -ENOMEM; + +- m_pofs += vi->inode_isize + vi->xattr_isize; ++ m_pofs += vi->xattr_isize; + /* inline symlink data shouldn't cross page boundary as well */ + if (m_pofs + inode->i_size > PAGE_SIZE) { + kfree(lnk); +@@ -167,37 +224,17 @@ static int erofs_fill_symlink(struct inode *inode, void *data, + + static int erofs_fill_inode(struct inode *inode, int isdir) + { +- struct super_block *sb = inode->i_sb; + struct erofs_inode *vi = EROFS_I(inode); + struct page *page; +- void *data; +- int err; +- erofs_blk_t blkaddr; + unsigned int ofs; +- erofs_off_t inode_loc; ++ int err = 0; + + trace_erofs_fill_inode(inode, isdir); +- inode_loc = iloc(EROFS_SB(sb), vi->nid); +- blkaddr = erofs_blknr(inode_loc); +- ofs = erofs_blkoff(inode_loc); +- +- erofs_dbg("%s, reading inode nid %llu at %u of blkaddr %u", +- __func__, vi->nid, ofs, blkaddr); + +- page = erofs_get_meta_page(sb, blkaddr); +- +- if (IS_ERR(page)) { +- erofs_err(sb, "failed to get inode (nid: %llu) page, err %ld", +- vi->nid, PTR_ERR(page)); ++ /* read inode base data from disk */ ++ page = erofs_read_inode(inode, &ofs); ++ if (IS_ERR(page)) + return PTR_ERR(page); +- } +- +- DBG_BUGON(!PageUptodate(page)); +- data = page_address(page); +- +- err = erofs_read_inode(inode, data + ofs); +- if (err) +- goto out_unlock; + + /* setup the new inode */ + switch (inode->i_mode & S_IFMT) { +@@ -210,7 +247,7 @@ static int erofs_fill_inode(struct inode *inode, int isdir) + inode->i_fop = &erofs_dir_fops; + break; + case S_IFLNK: +- err = erofs_fill_symlink(inode, data, ofs); ++ err = erofs_fill_symlink(inode, page_address(page), ofs); + if (err) + goto out_unlock; + inode_nohighmem(inode); +diff --git a/fs/io_uring.c b/fs/io_uring.c +index be3d595a607f..fada14ee1cdc 100644 +--- a/fs/io_uring.c ++++ b/fs/io_uring.c +@@ -1433,8 +1433,10 @@ static int io_read(struct io_kiocb *req, const struct sqe_submit *s, + + if (file->f_op->read_iter) + ret2 = call_read_iter(file, kiocb, &iter); +- else ++ else if (req->file->f_op->read) + ret2 = loop_rw_iter(READ, file, kiocb, &iter); ++ else ++ ret2 = -EINVAL; + + /* + * In case of a short read, punt to async. This can happen +@@ -1524,8 +1526,10 @@ static int io_write(struct io_kiocb *req, const struct sqe_submit *s, + + if (file->f_op->write_iter) + ret2 = call_write_iter(file, kiocb, &iter); +- else ++ else if (req->file->f_op->write) + ret2 = loop_rw_iter(WRITE, file, kiocb, &iter); ++ else ++ ret2 = -EINVAL; + + if (!force_nonblock) + current->signal->rlim[RLIMIT_FSIZE].rlim_cur = RLIM_INFINITY; +@@ -2559,6 +2563,7 @@ static void io_submit_sqe(struct io_ring_ctx *ctx, struct sqe_submit *s, + goto err; + } + ++ memcpy(&req->submit, s, sizeof(*s)); + ret = io_req_set_file(ctx, s, state, req); + if (unlikely(ret)) { + err_req: +@@ -3390,6 +3395,9 @@ static unsigned long rings_size(unsigned sq_entries, unsigned cq_entries, + return SIZE_MAX; + #endif + ++ if (sq_offset) ++ *sq_offset = off; ++ + sq_array_size = array_size(sizeof(u32), sq_entries); + if (sq_array_size == SIZE_MAX) + return SIZE_MAX; +@@ -3397,9 +3405,6 @@ static unsigned long rings_size(unsigned sq_entries, unsigned cq_entries, + if (check_add_overflow(off, sq_array_size, &off)) + return SIZE_MAX; + +- if (sq_offset) +- *sq_offset = off; +- + return off; + } + +@@ -3856,6 +3861,10 @@ static int io_allocate_scq_urings(struct io_ring_ctx *ctx, + struct io_rings *rings; + size_t size, sq_array_offset; + ++ /* make sure these are sane, as we already accounted them */ ++ ctx->sq_entries = p->sq_entries; ++ ctx->cq_entries = p->cq_entries; ++ + size = rings_size(p->sq_entries, p->cq_entries, &sq_array_offset); + if (size == SIZE_MAX) + return -EOVERFLOW; +@@ -3872,8 +3881,6 @@ static int io_allocate_scq_urings(struct io_ring_ctx *ctx, + rings->cq_ring_entries = p->cq_entries; + ctx->sq_mask = rings->sq_ring_mask; + ctx->cq_mask = rings->cq_ring_mask; +- ctx->sq_entries = rings->sq_ring_entries; +- ctx->cq_entries = rings->cq_ring_entries; + + size = array_size(sizeof(struct io_uring_sqe), p->sq_entries); + if (size == SIZE_MAX) { +diff --git a/fs/kernfs/file.c b/fs/kernfs/file.c +index e8c792b49616..c35bbaa19486 100644 +--- a/fs/kernfs/file.c ++++ b/fs/kernfs/file.c +@@ -912,7 +912,7 @@ repeat: + } + + fsnotify(inode, FS_MODIFY, inode, FSNOTIFY_EVENT_INODE, +- &name, 0); ++ NULL, 0); + iput(inode); + } + +diff --git a/fs/minix/inode.c b/fs/minix/inode.c +index 7cb5fd38eb14..0dd929346f3f 100644 +--- a/fs/minix/inode.c ++++ b/fs/minix/inode.c +@@ -150,6 +150,23 @@ static int minix_remount (struct super_block * sb, int * flags, char * data) + return 0; + } + ++static bool minix_check_superblock(struct minix_sb_info *sbi) ++{ ++ if (sbi->s_imap_blocks == 0 || sbi->s_zmap_blocks == 0) ++ return false; ++ ++ /* ++ * s_max_size must not exceed the block mapping limitation. This check ++ * is only needed for V1 filesystems, since V2/V3 support an extra level ++ * of indirect blocks which places the limit well above U32_MAX. ++ */ ++ if (sbi->s_version == MINIX_V1 && ++ sbi->s_max_size > (7 + 512 + 512*512) * BLOCK_SIZE) ++ return false; ++ ++ return true; ++} ++ + static int minix_fill_super(struct super_block *s, void *data, int silent) + { + struct buffer_head *bh; +@@ -228,11 +245,12 @@ static int minix_fill_super(struct super_block *s, void *data, int silent) + } else + goto out_no_fs; + ++ if (!minix_check_superblock(sbi)) ++ goto out_illegal_sb; ++ + /* + * Allocate the buffer map to keep the superblock small. + */ +- if (sbi->s_imap_blocks == 0 || sbi->s_zmap_blocks == 0) +- goto out_illegal_sb; + i = (sbi->s_imap_blocks + sbi->s_zmap_blocks) * sizeof(bh); + map = kzalloc(i, GFP_KERNEL); + if (!map) +@@ -468,6 +486,13 @@ static struct inode *V1_minix_iget(struct inode *inode) + iget_failed(inode); + return ERR_PTR(-EIO); + } ++ if (raw_inode->i_nlinks == 0) { ++ printk("MINIX-fs: deleted inode referenced: %lu\n", ++ inode->i_ino); ++ brelse(bh); ++ iget_failed(inode); ++ return ERR_PTR(-ESTALE); ++ } + inode->i_mode = raw_inode->i_mode; + i_uid_write(inode, raw_inode->i_uid); + i_gid_write(inode, raw_inode->i_gid); +@@ -501,6 +526,13 @@ static struct inode *V2_minix_iget(struct inode *inode) + iget_failed(inode); + return ERR_PTR(-EIO); + } ++ if (raw_inode->i_nlinks == 0) { ++ printk("MINIX-fs: deleted inode referenced: %lu\n", ++ inode->i_ino); ++ brelse(bh); ++ iget_failed(inode); ++ return ERR_PTR(-ESTALE); ++ } + inode->i_mode = raw_inode->i_mode; + i_uid_write(inode, raw_inode->i_uid); + i_gid_write(inode, raw_inode->i_gid); +diff --git a/fs/minix/itree_common.c b/fs/minix/itree_common.c +index 043c3fdbc8e7..446148792f41 100644 +--- a/fs/minix/itree_common.c ++++ b/fs/minix/itree_common.c +@@ -75,6 +75,7 @@ static int alloc_branch(struct inode *inode, + int n = 0; + int i; + int parent = minix_new_block(inode); ++ int err = -ENOSPC; + + branch[0].key = cpu_to_block(parent); + if (parent) for (n = 1; n < num; n++) { +@@ -85,6 +86,11 @@ static int alloc_branch(struct inode *inode, + break; + branch[n].key = cpu_to_block(nr); + bh = sb_getblk(inode->i_sb, parent); ++ if (!bh) { ++ minix_free_block(inode, nr); ++ err = -ENOMEM; ++ break; ++ } + lock_buffer(bh); + memset(bh->b_data, 0, bh->b_size); + branch[n].bh = bh; +@@ -103,7 +109,7 @@ static int alloc_branch(struct inode *inode, + bforget(branch[i].bh); + for (i = 0; i < n; i++) + minix_free_block(inode, block_to_cpu(branch[i].key)); +- return -ENOSPC; ++ return err; + } + + static inline int splice_branch(struct inode *inode, +diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c +index 443639cbb0cf..9c2b07ce57b2 100644 +--- a/fs/nfs/pnfs.c ++++ b/fs/nfs/pnfs.c +@@ -1198,31 +1198,27 @@ out: + return status; + } + ++static bool ++pnfs_layout_segments_returnable(struct pnfs_layout_hdr *lo, ++ enum pnfs_iomode iomode, ++ u32 seq) ++{ ++ struct pnfs_layout_range recall_range = { ++ .length = NFS4_MAX_UINT64, ++ .iomode = iomode, ++ }; ++ return pnfs_mark_matching_lsegs_return(lo, &lo->plh_return_segs, ++ &recall_range, seq) != -EBUSY; ++} ++ + /* Return true if layoutreturn is needed */ + static bool + pnfs_layout_need_return(struct pnfs_layout_hdr *lo) + { +- struct pnfs_layout_segment *s; +- enum pnfs_iomode iomode; +- u32 seq; +- + if (!test_bit(NFS_LAYOUT_RETURN_REQUESTED, &lo->plh_flags)) + return false; +- +- seq = lo->plh_return_seq; +- iomode = lo->plh_return_iomode; +- +- /* Defer layoutreturn until all recalled lsegs are done */ +- list_for_each_entry(s, &lo->plh_segs, pls_list) { +- if (seq && pnfs_seqid_is_newer(s->pls_seq, seq)) +- continue; +- if (iomode != IOMODE_ANY && s->pls_range.iomode != iomode) +- continue; +- if (test_bit(NFS_LSEG_LAYOUTRETURN, &s->pls_flags)) +- return false; +- } +- +- return true; ++ return pnfs_layout_segments_returnable(lo, lo->plh_return_iomode, ++ lo->plh_return_seq); + } + + static void pnfs_layoutreturn_before_put_layout_hdr(struct pnfs_layout_hdr *lo) +@@ -2362,16 +2358,6 @@ out_forget: + return ERR_PTR(-EAGAIN); + } + +-static int +-mark_lseg_invalid_or_return(struct pnfs_layout_segment *lseg, +- struct list_head *tmp_list) +-{ +- if (!mark_lseg_invalid(lseg, tmp_list)) +- return 0; +- pnfs_cache_lseg_for_layoutreturn(lseg->pls_layout, lseg); +- return 1; +-} +- + /** + * pnfs_mark_matching_lsegs_return - Free or return matching layout segments + * @lo: pointer to layout header +@@ -2408,7 +2394,7 @@ pnfs_mark_matching_lsegs_return(struct pnfs_layout_hdr *lo, + lseg, lseg->pls_range.iomode, + lseg->pls_range.offset, + lseg->pls_range.length); +- if (mark_lseg_invalid_or_return(lseg, tmp_list)) ++ if (mark_lseg_invalid(lseg, tmp_list)) + continue; + remaining++; + set_bit(NFS_LSEG_LAYOUTRETURN, &lseg->pls_flags); +diff --git a/fs/ocfs2/dlmglue.c b/fs/ocfs2/dlmglue.c +index e2c34c704185..50a863fc1779 100644 +--- a/fs/ocfs2/dlmglue.c ++++ b/fs/ocfs2/dlmglue.c +@@ -2871,9 +2871,15 @@ int ocfs2_nfs_sync_lock(struct ocfs2_super *osb, int ex) + + status = ocfs2_cluster_lock(osb, lockres, ex ? LKM_EXMODE : LKM_PRMODE, + 0, 0); +- if (status < 0) ++ if (status < 0) { + mlog(ML_ERROR, "lock on nfs sync lock failed %d\n", status); + ++ if (ex) ++ up_write(&osb->nfs_sync_rwlock); ++ else ++ up_read(&osb->nfs_sync_rwlock); ++ } ++ + return status; + } + +diff --git a/fs/pstore/platform.c b/fs/pstore/platform.c +index cdf5b8ae2583..74a60bae2b23 100644 +--- a/fs/pstore/platform.c ++++ b/fs/pstore/platform.c +@@ -275,6 +275,9 @@ static int pstore_compress(const void *in, void *out, + { + int ret; + ++ if (!IS_ENABLED(CONFIG_PSTORE_COMPRESSION)) ++ return -EINVAL; ++ + ret = crypto_comp_compress(tfm, in, inlen, out, &outlen); + if (ret) { + pr_err("crypto_comp_compress failed, ret = %d!\n", ret); +@@ -661,7 +664,7 @@ static void decompress_record(struct pstore_record *record) + int unzipped_len; + char *unzipped, *workspace; + +- if (!record->compressed) ++ if (!IS_ENABLED(CONFIG_PSTORE_COMPRESSION) || !record->compressed) + return; + + /* Only PSTORE_TYPE_DMESG support compression. */ +diff --git a/fs/xfs/libxfs/xfs_trans_space.h b/fs/xfs/libxfs/xfs_trans_space.h +index 88221c7a04cc..c6df01a2a158 100644 +--- a/fs/xfs/libxfs/xfs_trans_space.h ++++ b/fs/xfs/libxfs/xfs_trans_space.h +@@ -57,7 +57,7 @@ + XFS_DAREMOVE_SPACE_RES(mp, XFS_DATA_FORK) + #define XFS_IALLOC_SPACE_RES(mp) \ + (M_IGEO(mp)->ialloc_blks + \ +- (xfs_sb_version_hasfinobt(&mp->m_sb) ? 2 : 1 * \ ++ ((xfs_sb_version_hasfinobt(&mp->m_sb) ? 2 : 1) * \ + (M_IGEO(mp)->inobt_maxlevels - 1))) + + /* +diff --git a/fs/xfs/scrub/bmap.c b/fs/xfs/scrub/bmap.c +index fa6ea6407992..392fb4df5c12 100644 +--- a/fs/xfs/scrub/bmap.c ++++ b/fs/xfs/scrub/bmap.c +@@ -45,9 +45,27 @@ xchk_setup_inode_bmap( + */ + if (S_ISREG(VFS_I(sc->ip)->i_mode) && + sc->sm->sm_type == XFS_SCRUB_TYPE_BMBTD) { ++ struct address_space *mapping = VFS_I(sc->ip)->i_mapping; ++ + inode_dio_wait(VFS_I(sc->ip)); +- error = filemap_write_and_wait(VFS_I(sc->ip)->i_mapping); +- if (error) ++ ++ /* ++ * Try to flush all incore state to disk before we examine the ++ * space mappings for the data fork. Leave accumulated errors ++ * in the mapping for the writer threads to consume. ++ * ++ * On ENOSPC or EIO writeback errors, we continue into the ++ * extent mapping checks because write failures do not ++ * necessarily imply anything about the correctness of the file ++ * metadata. The metadata and the file data could be on ++ * completely separate devices; a media failure might only ++ * affect a subset of the disk, etc. We can handle delalloc ++ * extents in the scrubber, so leaving them in memory is fine. ++ */ ++ error = filemap_fdatawrite(mapping); ++ if (!error) ++ error = filemap_fdatawait_keep_errors(mapping); ++ if (error && (error != -ENOSPC && error != -EIO)) + goto out; + } + +diff --git a/fs/xfs/xfs_reflink.c b/fs/xfs/xfs_reflink.c +index 6a4fd1738b08..904d8285c226 100644 +--- a/fs/xfs/xfs_reflink.c ++++ b/fs/xfs/xfs_reflink.c +@@ -1005,6 +1005,7 @@ xfs_reflink_remap_extent( + xfs_filblks_t rlen; + xfs_filblks_t unmap_len; + xfs_off_t newlen; ++ int64_t qres; + int error; + + unmap_len = irec->br_startoff + irec->br_blockcount - destoff; +@@ -1027,13 +1028,19 @@ xfs_reflink_remap_extent( + xfs_ilock(ip, XFS_ILOCK_EXCL); + xfs_trans_ijoin(tp, ip, 0); + +- /* If we're not just clearing space, then do we have enough quota? */ +- if (real_extent) { +- error = xfs_trans_reserve_quota_nblks(tp, ip, +- irec->br_blockcount, 0, XFS_QMOPT_RES_REGBLKS); +- if (error) +- goto out_cancel; +- } ++ /* ++ * Reserve quota for this operation. We don't know if the first unmap ++ * in the dest file will cause a bmap btree split, so we always reserve ++ * at least enough blocks for that split. If the extent being mapped ++ * in is written, we need to reserve quota for that too. ++ */ ++ qres = XFS_EXTENTADD_SPACE_RES(mp, XFS_DATA_FORK); ++ if (real_extent) ++ qres += irec->br_blockcount; ++ error = xfs_trans_reserve_quota_nblks(tp, ip, qres, 0, ++ XFS_QMOPT_RES_REGBLKS); ++ if (error) ++ goto out_cancel; + + trace_xfs_reflink_remap(ip, irec->br_startoff, + irec->br_blockcount, irec->br_startblock); +diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h +index d7616d08e863..f050039ca2c0 100644 +--- a/include/asm-generic/vmlinux.lds.h ++++ b/include/asm-generic/vmlinux.lds.h +@@ -340,6 +340,7 @@ + */ + #ifndef RO_AFTER_INIT_DATA + #define RO_AFTER_INIT_DATA \ ++ . = ALIGN(8); \ + __start_ro_after_init = .; \ + *(.data..ro_after_init) \ + JUMP_TABLE_DATA \ +diff --git a/include/linux/bitfield.h b/include/linux/bitfield.h +index 4bbb5f1c8b5b..4c0224ff0a14 100644 +--- a/include/linux/bitfield.h ++++ b/include/linux/bitfield.h +@@ -64,7 +64,7 @@ + */ + #define FIELD_FIT(_mask, _val) \ + ({ \ +- __BF_FIELD_CHECK(_mask, 0ULL, _val, "FIELD_FIT: "); \ ++ __BF_FIELD_CHECK(_mask, 0ULL, 0ULL, "FIELD_FIT: "); \ + !((((typeof(_mask))_val) << __bf_shf(_mask)) & ~(_mask)); \ + }) + +diff --git a/include/linux/tpm.h b/include/linux/tpm.h +index 53c0ea9ec9df..77fdc988c610 100644 +--- a/include/linux/tpm.h ++++ b/include/linux/tpm.h +@@ -93,6 +93,7 @@ struct tpm_space { + u8 *context_buf; + u32 session_tbl[3]; + u8 *session_buf; ++ u32 buf_size; + }; + + struct tpm_bios_log { +diff --git a/include/linux/tpm_eventlog.h b/include/linux/tpm_eventlog.h +index eccfd3a4e4c8..f3caeeb7a0d0 100644 +--- a/include/linux/tpm_eventlog.h ++++ b/include/linux/tpm_eventlog.h +@@ -211,9 +211,16 @@ static inline int __calc_tpm2_event_size(struct tcg_pcr_event2_head *event, + + efispecid = (struct tcg_efi_specid_event_head *)event_header->event; + +- /* Check if event is malformed. */ ++ /* ++ * Perform validation of the event in order to identify malformed ++ * events. This function may be asked to parse arbitrary byte sequences ++ * immediately following a valid event log. The caller expects this ++ * function to recognize that the byte sequence is not a valid event ++ * and to return an event size of 0. ++ */ + if (memcmp(efispecid->signature, TCG_SPECID_SIG, +- sizeof(TCG_SPECID_SIG)) || count > efispecid->num_algs) { ++ sizeof(TCG_SPECID_SIG)) || ++ !efispecid->num_algs || count != efispecid->num_algs) { + size = 0; + goto out; + } +diff --git a/include/linux/tracepoint.h b/include/linux/tracepoint.h +index 1fb11daa5c53..57ce5af258a3 100644 +--- a/include/linux/tracepoint.h ++++ b/include/linux/tracepoint.h +@@ -362,7 +362,7 @@ static inline struct tracepoint *tracepoint_ptr_deref(tracepoint_ptr_t *p) + static const char *___tp_str __tracepoint_string = str; \ + ___tp_str; \ + }) +-#define __tracepoint_string __attribute__((section("__tracepoint_str"))) ++#define __tracepoint_string __attribute__((section("__tracepoint_str"), used)) + #else + /* + * tracepoint_string() is used to save the string address for userspace +diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h +index 895546058a20..c71eb294da95 100644 +--- a/include/net/inet_connection_sock.h ++++ b/include/net/inet_connection_sock.h +@@ -309,6 +309,10 @@ int inet_csk_compat_getsockopt(struct sock *sk, int level, int optname, + int inet_csk_compat_setsockopt(struct sock *sk, int level, int optname, + char __user *optval, unsigned int optlen); + ++/* update the fast reuse flag when adding a socket */ ++void inet_csk_update_fastreuse(struct inet_bind_bucket *tb, ++ struct sock *sk); ++ + struct dst_entry *inet_csk_update_pmtu(struct sock *sk, u32 mtu); + + #define TCP_PINGPONG_THRESH 3 +diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h +index 078887c8c586..7c37e3c3b1c7 100644 +--- a/include/net/ip_vs.h ++++ b/include/net/ip_vs.h +@@ -1624,18 +1624,16 @@ static inline void ip_vs_conn_drop_conntrack(struct ip_vs_conn *cp) + } + #endif /* CONFIG_IP_VS_NFCT */ + +-/* Really using conntrack? */ +-static inline bool ip_vs_conn_uses_conntrack(struct ip_vs_conn *cp, +- struct sk_buff *skb) ++/* Using old conntrack that can not be redirected to another real server? */ ++static inline bool ip_vs_conn_uses_old_conntrack(struct ip_vs_conn *cp, ++ struct sk_buff *skb) + { + #ifdef CONFIG_IP_VS_NFCT + enum ip_conntrack_info ctinfo; + struct nf_conn *ct; + +- if (!(cp->flags & IP_VS_CONN_F_NFCT)) +- return false; + ct = nf_ct_get(skb, &ctinfo); +- if (ct) ++ if (ct && nf_ct_is_confirmed(ct)) + return true; + #endif + return false; +diff --git a/include/net/tcp.h b/include/net/tcp.h +index 7cf1b4972c66..377179283c46 100644 +--- a/include/net/tcp.h ++++ b/include/net/tcp.h +@@ -1650,6 +1650,8 @@ void tcp_fastopen_destroy_cipher(struct sock *sk); + void tcp_fastopen_ctx_destroy(struct net *net); + int tcp_fastopen_reset_cipher(struct net *net, struct sock *sk, + void *primary_key, void *backup_key); ++int tcp_fastopen_get_cipher(struct net *net, struct inet_connection_sock *icsk, ++ u64 *key); + void tcp_fastopen_add_skb(struct sock *sk, struct sk_buff *skb); + struct sock *tcp_try_fastopen(struct sock *sk, struct sk_buff *skb, + struct request_sock *req, +diff --git a/include/uapi/linux/seccomp.h b/include/uapi/linux/seccomp.h +index 90734aa5aa36..b5f901af79f0 100644 +--- a/include/uapi/linux/seccomp.h ++++ b/include/uapi/linux/seccomp.h +@@ -93,5 +93,6 @@ struct seccomp_notif_resp { + #define SECCOMP_IOCTL_NOTIF_RECV SECCOMP_IOWR(0, struct seccomp_notif) + #define SECCOMP_IOCTL_NOTIF_SEND SECCOMP_IOWR(1, \ + struct seccomp_notif_resp) +-#define SECCOMP_IOCTL_NOTIF_ID_VALID SECCOMP_IOR(2, __u64) ++#define SECCOMP_IOCTL_NOTIF_ID_VALID SECCOMP_IOW(2, __u64) ++ + #endif /* _UAPI_LINUX_SECCOMP_H */ +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index 38ae3cf9d173..b34b5c6e2524 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -1238,6 +1238,20 @@ static void uclamp_fork(struct task_struct *p) + } + } + ++static void __init init_uclamp_rq(struct rq *rq) ++{ ++ enum uclamp_id clamp_id; ++ struct uclamp_rq *uc_rq = rq->uclamp; ++ ++ for_each_clamp_id(clamp_id) { ++ uc_rq[clamp_id] = (struct uclamp_rq) { ++ .value = uclamp_none(clamp_id) ++ }; ++ } ++ ++ rq->uclamp_flags = 0; ++} ++ + static void __init init_uclamp(void) + { + struct uclamp_se uc_max = {}; +@@ -1246,11 +1260,8 @@ static void __init init_uclamp(void) + + mutex_init(&uclamp_mutex); + +- for_each_possible_cpu(cpu) { +- memset(&cpu_rq(cpu)->uclamp, 0, +- sizeof(struct uclamp_rq)*UCLAMP_CNT); +- cpu_rq(cpu)->uclamp_flags = 0; +- } ++ for_each_possible_cpu(cpu) ++ init_uclamp_rq(cpu_rq(cpu)); + + for_each_clamp_id(clamp_id) { + uclamp_se_set(&init_task.uclamp_req[clamp_id], +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index 9b16080093be..20bf1f66733a 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -9385,7 +9385,12 @@ static void kick_ilb(unsigned int flags) + { + int ilb_cpu; + +- nohz.next_balance++; ++ /* ++ * Increase nohz.next_balance only when if full ilb is triggered but ++ * not if we only update stats. ++ */ ++ if (flags & NOHZ_BALANCE_KICK) ++ nohz.next_balance = jiffies+1; + + ilb_cpu = find_new_ilb(); + +@@ -9703,6 +9708,14 @@ static bool _nohz_idle_balance(struct rq *this_rq, unsigned int flags, + } + } + ++ /* ++ * next_balance will be updated only when there is a need. ++ * When the CPU is attached to null domain for ex, it will not be ++ * updated. ++ */ ++ if (likely(update_next_balance)) ++ nohz.next_balance = next_balance; ++ + /* Newly idle CPU doesn't need an update */ + if (idle != CPU_NEWLY_IDLE) { + update_blocked_averages(this_cpu); +@@ -9723,14 +9736,6 @@ abort: + if (has_blocked_load) + WRITE_ONCE(nohz.has_blocked, 1); + +- /* +- * next_balance will be updated only when there is a need. +- * When the CPU is attached to null domain for ex, it will not be +- * updated. +- */ +- if (likely(update_next_balance)) +- nohz.next_balance = next_balance; +- + return ret; + } + +diff --git a/kernel/sched/topology.c b/kernel/sched/topology.c +index 1fa1e13a5944..ffaa97a8d405 100644 +--- a/kernel/sched/topology.c ++++ b/kernel/sched/topology.c +@@ -1333,7 +1333,7 @@ sd_init(struct sched_domain_topology_level *tl, + sd_flags = (*tl->sd_flags)(); + if (WARN_ONCE(sd_flags & ~TOPOLOGY_SD_FLAGS, + "wrong sd_flags in topology description\n")) +- sd_flags &= ~TOPOLOGY_SD_FLAGS; ++ sd_flags &= TOPOLOGY_SD_FLAGS; + + /* Apply detected topology flags */ + sd_flags |= dflags; +diff --git a/kernel/seccomp.c b/kernel/seccomp.c +index 2c697ce7be21..e0fd97235653 100644 +--- a/kernel/seccomp.c ++++ b/kernel/seccomp.c +@@ -42,6 +42,14 @@ + #include + #include + ++/* ++ * When SECCOMP_IOCTL_NOTIF_ID_VALID was first introduced, it had the ++ * wrong direction flag in the ioctl number. This is the broken one, ++ * which the kernel needs to keep supporting until all userspaces stop ++ * using the wrong command number. ++ */ ++#define SECCOMP_IOCTL_NOTIF_ID_VALID_WRONG_DIR SECCOMP_IOR(2, __u64) ++ + enum notify_state { + SECCOMP_NOTIFY_INIT, + SECCOMP_NOTIFY_SENT, +@@ -1168,6 +1176,7 @@ static long seccomp_notify_ioctl(struct file *file, unsigned int cmd, + return seccomp_notify_recv(filter, buf); + case SECCOMP_IOCTL_NOTIF_SEND: + return seccomp_notify_send(filter, buf); ++ case SECCOMP_IOCTL_NOTIF_ID_VALID_WRONG_DIR: + case SECCOMP_IOCTL_NOTIF_ID_VALID: + return seccomp_notify_id_valid(filter, buf); + default: +diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c +index eaee960153e1..a4c8f9d9522e 100644 +--- a/kernel/trace/blktrace.c ++++ b/kernel/trace/blktrace.c +@@ -521,10 +521,18 @@ static int do_blk_trace_setup(struct request_queue *q, char *name, dev_t dev, + if (!bt->msg_data) + goto err; + +- ret = -ENOENT; +- +- dir = debugfs_lookup(buts->name, blk_debugfs_root); +- if (!dir) ++#ifdef CONFIG_BLK_DEBUG_FS ++ /* ++ * When tracing whole make_request drivers (multiqueue) block devices, ++ * reuse the existing debugfs directory created by the block layer on ++ * init. For request-based block devices, all partitions block devices, ++ * and scsi-generic block devices we create a temporary new debugfs ++ * directory that will be removed once the trace ends. ++ */ ++ if (queue_is_mq(q) && bdev && bdev == bdev->bd_contains) ++ dir = q->debugfs_dir; ++ else ++#endif + bt->dir = dir = debugfs_create_dir(buts->name, blk_debugfs_root); + + bt->dev = dev; +@@ -565,8 +573,6 @@ static int do_blk_trace_setup(struct request_queue *q, char *name, dev_t dev, + + ret = 0; + err: +- if (dir && !bt->dir) +- dput(dir); + if (ret) + blk_trace_free(bt); + return ret; +diff --git a/lib/crc-t10dif.c b/lib/crc-t10dif.c +index 8cc01a603416..c9acf1c12cfc 100644 +--- a/lib/crc-t10dif.c ++++ b/lib/crc-t10dif.c +@@ -19,39 +19,46 @@ + static struct crypto_shash __rcu *crct10dif_tfm; + static struct static_key crct10dif_fallback __read_mostly; + static DEFINE_MUTEX(crc_t10dif_mutex); ++static struct work_struct crct10dif_rehash_work; + +-static int crc_t10dif_rehash(struct notifier_block *self, unsigned long val, void *data) ++static int crc_t10dif_notify(struct notifier_block *self, unsigned long val, void *data) + { + struct crypto_alg *alg = data; +- struct crypto_shash *new, *old; + + if (val != CRYPTO_MSG_ALG_LOADED || + static_key_false(&crct10dif_fallback) || + strncmp(alg->cra_name, CRC_T10DIF_STRING, strlen(CRC_T10DIF_STRING))) + return 0; + ++ schedule_work(&crct10dif_rehash_work); ++ return 0; ++} ++ ++static void crc_t10dif_rehash(struct work_struct *work) ++{ ++ struct crypto_shash *new, *old; ++ + mutex_lock(&crc_t10dif_mutex); + old = rcu_dereference_protected(crct10dif_tfm, + lockdep_is_held(&crc_t10dif_mutex)); + if (!old) { + mutex_unlock(&crc_t10dif_mutex); +- return 0; ++ return; + } + new = crypto_alloc_shash("crct10dif", 0, 0); + if (IS_ERR(new)) { + mutex_unlock(&crc_t10dif_mutex); +- return 0; ++ return; + } + rcu_assign_pointer(crct10dif_tfm, new); + mutex_unlock(&crc_t10dif_mutex); + + synchronize_rcu(); + crypto_free_shash(old); +- return 0; + } + + static struct notifier_block crc_t10dif_nb = { +- .notifier_call = crc_t10dif_rehash, ++ .notifier_call = crc_t10dif_notify, + }; + + __u16 crc_t10dif_update(__u16 crc, const unsigned char *buffer, size_t len) +@@ -86,19 +93,26 @@ EXPORT_SYMBOL(crc_t10dif); + + static int __init crc_t10dif_mod_init(void) + { ++ struct crypto_shash *tfm; ++ ++ INIT_WORK(&crct10dif_rehash_work, crc_t10dif_rehash); + crypto_register_notifier(&crc_t10dif_nb); +- crct10dif_tfm = crypto_alloc_shash("crct10dif", 0, 0); +- if (IS_ERR(crct10dif_tfm)) { ++ mutex_lock(&crc_t10dif_mutex); ++ tfm = crypto_alloc_shash("crct10dif", 0, 0); ++ if (IS_ERR(tfm)) { + static_key_slow_inc(&crct10dif_fallback); +- crct10dif_tfm = NULL; ++ tfm = NULL; + } ++ RCU_INIT_POINTER(crct10dif_tfm, tfm); ++ mutex_unlock(&crc_t10dif_mutex); + return 0; + } + + static void __exit crc_t10dif_mod_fini(void) + { + crypto_unregister_notifier(&crc_t10dif_nb); +- crypto_free_shash(crct10dif_tfm); ++ cancel_work_sync(&crct10dif_rehash_work); ++ crypto_free_shash(rcu_dereference_protected(crct10dif_tfm, 1)); + } + + module_init(crc_t10dif_mod_init); +@@ -106,11 +120,27 @@ module_exit(crc_t10dif_mod_fini); + + static int crc_t10dif_transform_show(char *buffer, const struct kernel_param *kp) + { ++ struct crypto_shash *tfm; ++ const char *name; ++ int len; ++ + if (static_key_false(&crct10dif_fallback)) + return sprintf(buffer, "fallback\n"); + +- return sprintf(buffer, "%s\n", +- crypto_tfm_alg_driver_name(crypto_shash_tfm(crct10dif_tfm))); ++ rcu_read_lock(); ++ tfm = rcu_dereference(crct10dif_tfm); ++ if (!tfm) { ++ len = sprintf(buffer, "init\n"); ++ goto unlock; ++ } ++ ++ name = crypto_tfm_alg_driver_name(crypto_shash_tfm(tfm)); ++ len = sprintf(buffer, "%s\n", name); ++ ++unlock: ++ rcu_read_unlock(); ++ ++ return len; + } + + module_param_call(transform, NULL, crc_t10dif_transform_show, NULL, 0644); +diff --git a/lib/dynamic_debug.c b/lib/dynamic_debug.c +index c60409138e13..ccf05719b1ad 100644 +--- a/lib/dynamic_debug.c ++++ b/lib/dynamic_debug.c +@@ -87,22 +87,22 @@ static struct { unsigned flag:8; char opt_char; } opt_array[] = { + { _DPRINTK_FLAGS_NONE, '_' }, + }; + ++struct flagsbuf { char buf[ARRAY_SIZE(opt_array)+1]; }; ++ + /* format a string into buf[] which describes the _ddebug's flags */ +-static char *ddebug_describe_flags(struct _ddebug *dp, char *buf, +- size_t maxlen) ++static char *ddebug_describe_flags(unsigned int flags, struct flagsbuf *fb) + { +- char *p = buf; ++ char *p = fb->buf; + int i; + +- BUG_ON(maxlen < 6); + for (i = 0; i < ARRAY_SIZE(opt_array); ++i) +- if (dp->flags & opt_array[i].flag) ++ if (flags & opt_array[i].flag) + *p++ = opt_array[i].opt_char; +- if (p == buf) ++ if (p == fb->buf) + *p++ = '_'; + *p = '\0'; + +- return buf; ++ return fb->buf; + } + + #define vpr_info(fmt, ...) \ +@@ -144,7 +144,7 @@ static int ddebug_change(const struct ddebug_query *query, + struct ddebug_table *dt; + unsigned int newflags; + unsigned int nfound = 0; +- char flagbuf[10]; ++ struct flagsbuf fbuf; + + /* search for matching ddebugs */ + mutex_lock(&ddebug_lock); +@@ -201,8 +201,7 @@ static int ddebug_change(const struct ddebug_query *query, + vpr_info("changed %s:%d [%s]%s =%s\n", + trim_prefix(dp->filename), dp->lineno, + dt->mod_name, dp->function, +- ddebug_describe_flags(dp, flagbuf, +- sizeof(flagbuf))); ++ ddebug_describe_flags(dp->flags, &fbuf)); + } + } + mutex_unlock(&ddebug_lock); +@@ -816,7 +815,7 @@ static int ddebug_proc_show(struct seq_file *m, void *p) + { + struct ddebug_iter *iter = m->private; + struct _ddebug *dp = p; +- char flagsbuf[10]; ++ struct flagsbuf flags; + + vpr_info("called m=%p p=%p\n", m, p); + +@@ -829,7 +828,7 @@ static int ddebug_proc_show(struct seq_file *m, void *p) + seq_printf(m, "%s:%u [%s]%s =%s \"", + trim_prefix(dp->filename), dp->lineno, + iter->table->mod_name, dp->function, +- ddebug_describe_flags(dp, flagsbuf, sizeof(flagsbuf))); ++ ddebug_describe_flags(dp->flags, &flags)); + seq_escape(m, dp->format, "\t\r\n\""); + seq_puts(m, "\"\n"); + +diff --git a/lib/kobject.c b/lib/kobject.c +index 83198cb37d8d..386873bdd51c 100644 +--- a/lib/kobject.c ++++ b/lib/kobject.c +@@ -599,14 +599,7 @@ out: + } + EXPORT_SYMBOL_GPL(kobject_move); + +-/** +- * kobject_del() - Unlink kobject from hierarchy. +- * @kobj: object. +- * +- * This is the function that should be called to delete an object +- * successfully added via kobject_add(). +- */ +-void kobject_del(struct kobject *kobj) ++static void __kobject_del(struct kobject *kobj) + { + struct kernfs_node *sd; + const struct kobj_type *ktype; +@@ -625,9 +618,23 @@ void kobject_del(struct kobject *kobj) + + kobj->state_in_sysfs = 0; + kobj_kset_leave(kobj); +- kobject_put(kobj->parent); + kobj->parent = NULL; + } ++ ++/** ++ * kobject_del() - Unlink kobject from hierarchy. ++ * @kobj: object. ++ * ++ * This is the function that should be called to delete an object ++ * successfully added via kobject_add(). ++ */ ++void kobject_del(struct kobject *kobj) ++{ ++ struct kobject *parent = kobj->parent; ++ ++ __kobject_del(kobj); ++ kobject_put(parent); ++} + EXPORT_SYMBOL(kobject_del); + + /** +@@ -663,6 +670,7 @@ EXPORT_SYMBOL(kobject_get_unless_zero); + */ + static void kobject_cleanup(struct kobject *kobj) + { ++ struct kobject *parent = kobj->parent; + struct kobj_type *t = get_ktype(kobj); + const char *name = kobj->name; + +@@ -684,7 +692,10 @@ static void kobject_cleanup(struct kobject *kobj) + if (kobj->state_in_sysfs) { + pr_debug("kobject: '%s' (%p): auto cleanup kobject_del\n", + kobject_name(kobj), kobj); +- kobject_del(kobj); ++ __kobject_del(kobj); ++ } else { ++ /* avoid dropping the parent reference unnecessarily */ ++ parent = NULL; + } + + if (t && t->release) { +@@ -698,6 +709,8 @@ static void kobject_cleanup(struct kobject *kobj) + pr_debug("kobject: '%s': free name\n", name); + kfree_const(name); + } ++ ++ kobject_put(parent); + } + + #ifdef CONFIG_DEBUG_KOBJECT_RELEASE +diff --git a/mm/mmap.c b/mm/mmap.c +index ea1ba2db4f4f..a3584a90c55c 100644 +--- a/mm/mmap.c ++++ b/mm/mmap.c +@@ -3172,6 +3172,7 @@ void exit_mmap(struct mm_struct *mm) + if (vma->vm_flags & VM_ACCOUNT) + nr_accounted += vma_pages(vma); + vma = remove_vma(vma); ++ cond_resched(); + } + vm_unacct_memory(nr_accounted); + } +diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c +index 4febc82a7c76..52fb6d6d6d58 100644 +--- a/net/bluetooth/6lowpan.c ++++ b/net/bluetooth/6lowpan.c +@@ -50,6 +50,7 @@ static bool enable_6lowpan; + /* We are listening incoming connections via this channel + */ + static struct l2cap_chan *listen_chan; ++static DEFINE_MUTEX(set_lock); + + struct lowpan_peer { + struct list_head list; +@@ -1070,12 +1071,14 @@ static void do_enable_set(struct work_struct *work) + + enable_6lowpan = set_enable->flag; + ++ mutex_lock(&set_lock); + if (listen_chan) { + l2cap_chan_close(listen_chan, 0); + l2cap_chan_put(listen_chan); + } + + listen_chan = bt_6lowpan_listen(); ++ mutex_unlock(&set_lock); + + kfree(set_enable); + } +@@ -1127,11 +1130,13 @@ static ssize_t lowpan_control_write(struct file *fp, + if (ret == -EINVAL) + return ret; + ++ mutex_lock(&set_lock); + if (listen_chan) { + l2cap_chan_close(listen_chan, 0); + l2cap_chan_put(listen_chan); + listen_chan = NULL; + } ++ mutex_unlock(&set_lock); + + if (conn) { + struct lowpan_peer *peer; +diff --git a/net/core/sock.c b/net/core/sock.c +index 33a232974374..991ab80234ce 100644 +--- a/net/core/sock.c ++++ b/net/core/sock.c +@@ -3337,6 +3337,16 @@ static void sock_inuse_add(struct net *net, int val) + } + #endif + ++static void tw_prot_cleanup(struct timewait_sock_ops *twsk_prot) ++{ ++ if (!twsk_prot) ++ return; ++ kfree(twsk_prot->twsk_slab_name); ++ twsk_prot->twsk_slab_name = NULL; ++ kmem_cache_destroy(twsk_prot->twsk_slab); ++ twsk_prot->twsk_slab = NULL; ++} ++ + static void req_prot_cleanup(struct request_sock_ops *rsk_prot) + { + if (!rsk_prot) +@@ -3407,7 +3417,7 @@ int proto_register(struct proto *prot, int alloc_slab) + prot->slab_flags, + NULL); + if (prot->twsk_prot->twsk_slab == NULL) +- goto out_free_timewait_sock_slab_name; ++ goto out_free_timewait_sock_slab; + } + } + +@@ -3415,15 +3425,15 @@ int proto_register(struct proto *prot, int alloc_slab) + ret = assign_proto_idx(prot); + if (ret) { + mutex_unlock(&proto_list_mutex); +- goto out_free_timewait_sock_slab_name; ++ goto out_free_timewait_sock_slab; + } + list_add(&prot->node, &proto_list); + mutex_unlock(&proto_list_mutex); + return ret; + +-out_free_timewait_sock_slab_name: ++out_free_timewait_sock_slab: + if (alloc_slab && prot->twsk_prot) +- kfree(prot->twsk_prot->twsk_slab_name); ++ tw_prot_cleanup(prot->twsk_prot); + out_free_request_sock_slab: + if (alloc_slab) { + req_prot_cleanup(prot->rsk_prot); +@@ -3447,12 +3457,7 @@ void proto_unregister(struct proto *prot) + prot->slab = NULL; + + req_prot_cleanup(prot->rsk_prot); +- +- if (prot->twsk_prot != NULL && prot->twsk_prot->twsk_slab != NULL) { +- kmem_cache_destroy(prot->twsk_prot->twsk_slab); +- kfree(prot->twsk_prot->twsk_slab_name); +- prot->twsk_prot->twsk_slab = NULL; +- } ++ tw_prot_cleanup(prot->twsk_prot); + } + EXPORT_SYMBOL(proto_unregister); + +diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c +index 5e486895d67c..9745c52f49ca 100644 +--- a/net/ipv4/inet_connection_sock.c ++++ b/net/ipv4/inet_connection_sock.c +@@ -284,6 +284,57 @@ static inline int sk_reuseport_match(struct inet_bind_bucket *tb, + ipv6_only_sock(sk), true, false); + } + ++void inet_csk_update_fastreuse(struct inet_bind_bucket *tb, ++ struct sock *sk) ++{ ++ kuid_t uid = sock_i_uid(sk); ++ bool reuse = sk->sk_reuse && sk->sk_state != TCP_LISTEN; ++ ++ if (hlist_empty(&tb->owners)) { ++ tb->fastreuse = reuse; ++ if (sk->sk_reuseport) { ++ tb->fastreuseport = FASTREUSEPORT_ANY; ++ tb->fastuid = uid; ++ tb->fast_rcv_saddr = sk->sk_rcv_saddr; ++ tb->fast_ipv6_only = ipv6_only_sock(sk); ++ tb->fast_sk_family = sk->sk_family; ++#if IS_ENABLED(CONFIG_IPV6) ++ tb->fast_v6_rcv_saddr = sk->sk_v6_rcv_saddr; ++#endif ++ } else { ++ tb->fastreuseport = 0; ++ } ++ } else { ++ if (!reuse) ++ tb->fastreuse = 0; ++ if (sk->sk_reuseport) { ++ /* We didn't match or we don't have fastreuseport set on ++ * the tb, but we have sk_reuseport set on this socket ++ * and we know that there are no bind conflicts with ++ * this socket in this tb, so reset our tb's reuseport ++ * settings so that any subsequent sockets that match ++ * our current socket will be put on the fast path. ++ * ++ * If we reset we need to set FASTREUSEPORT_STRICT so we ++ * do extra checking for all subsequent sk_reuseport ++ * socks. ++ */ ++ if (!sk_reuseport_match(tb, sk)) { ++ tb->fastreuseport = FASTREUSEPORT_STRICT; ++ tb->fastuid = uid; ++ tb->fast_rcv_saddr = sk->sk_rcv_saddr; ++ tb->fast_ipv6_only = ipv6_only_sock(sk); ++ tb->fast_sk_family = sk->sk_family; ++#if IS_ENABLED(CONFIG_IPV6) ++ tb->fast_v6_rcv_saddr = sk->sk_v6_rcv_saddr; ++#endif ++ } ++ } else { ++ tb->fastreuseport = 0; ++ } ++ } ++} ++ + /* Obtain a reference to a local port for the given sock, + * if snum is zero it means select any available local port. + * We try to allocate an odd port (and leave even ports for connect()) +@@ -296,7 +347,6 @@ int inet_csk_get_port(struct sock *sk, unsigned short snum) + struct inet_bind_hashbucket *head; + struct net *net = sock_net(sk); + struct inet_bind_bucket *tb = NULL; +- kuid_t uid = sock_i_uid(sk); + int l3mdev; + + l3mdev = inet_sk_bound_l3mdev(sk); +@@ -333,49 +383,8 @@ tb_found: + goto fail_unlock; + } + success: +- if (hlist_empty(&tb->owners)) { +- tb->fastreuse = reuse; +- if (sk->sk_reuseport) { +- tb->fastreuseport = FASTREUSEPORT_ANY; +- tb->fastuid = uid; +- tb->fast_rcv_saddr = sk->sk_rcv_saddr; +- tb->fast_ipv6_only = ipv6_only_sock(sk); +- tb->fast_sk_family = sk->sk_family; +-#if IS_ENABLED(CONFIG_IPV6) +- tb->fast_v6_rcv_saddr = sk->sk_v6_rcv_saddr; +-#endif +- } else { +- tb->fastreuseport = 0; +- } +- } else { +- if (!reuse) +- tb->fastreuse = 0; +- if (sk->sk_reuseport) { +- /* We didn't match or we don't have fastreuseport set on +- * the tb, but we have sk_reuseport set on this socket +- * and we know that there are no bind conflicts with +- * this socket in this tb, so reset our tb's reuseport +- * settings so that any subsequent sockets that match +- * our current socket will be put on the fast path. +- * +- * If we reset we need to set FASTREUSEPORT_STRICT so we +- * do extra checking for all subsequent sk_reuseport +- * socks. +- */ +- if (!sk_reuseport_match(tb, sk)) { +- tb->fastreuseport = FASTREUSEPORT_STRICT; +- tb->fastuid = uid; +- tb->fast_rcv_saddr = sk->sk_rcv_saddr; +- tb->fast_ipv6_only = ipv6_only_sock(sk); +- tb->fast_sk_family = sk->sk_family; +-#if IS_ENABLED(CONFIG_IPV6) +- tb->fast_v6_rcv_saddr = sk->sk_v6_rcv_saddr; +-#endif +- } +- } else { +- tb->fastreuseport = 0; +- } +- } ++ inet_csk_update_fastreuse(tb, sk); ++ + if (!inet_csk(sk)->icsk_bind_hash) + inet_bind_hash(sk, tb, port); + WARN_ON(inet_csk(sk)->icsk_bind_hash != tb); +diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c +index 2bbaaf0c7176..006a34b18537 100644 +--- a/net/ipv4/inet_hashtables.c ++++ b/net/ipv4/inet_hashtables.c +@@ -163,6 +163,7 @@ int __inet_inherit_port(const struct sock *sk, struct sock *child) + return -ENOMEM; + } + } ++ inet_csk_update_fastreuse(tb, child); + } + inet_bind_hash(child, tb, port); + spin_unlock(&head->lock); +diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c +index 0902cb32bbad..c83a5d05aeaa 100644 +--- a/net/ipv4/sysctl_net_ipv4.c ++++ b/net/ipv4/sysctl_net_ipv4.c +@@ -307,24 +307,16 @@ static int proc_tcp_fastopen_key(struct ctl_table *table, int write, + struct ctl_table tbl = { .maxlen = ((TCP_FASTOPEN_KEY_LENGTH * + 2 * TCP_FASTOPEN_KEY_MAX) + + (TCP_FASTOPEN_KEY_MAX * 5)) }; +- struct tcp_fastopen_context *ctx; +- u32 user_key[TCP_FASTOPEN_KEY_MAX * 4]; +- __le32 key[TCP_FASTOPEN_KEY_MAX * 4]; ++ u32 user_key[TCP_FASTOPEN_KEY_BUF_LENGTH / sizeof(u32)]; ++ __le32 key[TCP_FASTOPEN_KEY_BUF_LENGTH / sizeof(__le32)]; + char *backup_data; +- int ret, i = 0, off = 0, n_keys = 0; ++ int ret, i = 0, off = 0, n_keys; + + tbl.data = kmalloc(tbl.maxlen, GFP_KERNEL); + if (!tbl.data) + return -ENOMEM; + +- rcu_read_lock(); +- ctx = rcu_dereference(net->ipv4.tcp_fastopen_ctx); +- if (ctx) { +- n_keys = tcp_fastopen_context_len(ctx); +- memcpy(&key[0], &ctx->key[0], TCP_FASTOPEN_KEY_LENGTH * n_keys); +- } +- rcu_read_unlock(); +- ++ n_keys = tcp_fastopen_get_cipher(net, NULL, (u64 *)key); + if (!n_keys) { + memset(&key[0], 0, TCP_FASTOPEN_KEY_LENGTH); + n_keys = 1; +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index 840901154210..01ddfb4156e4 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -3527,22 +3527,14 @@ static int do_tcp_getsockopt(struct sock *sk, int level, + return 0; + + case TCP_FASTOPEN_KEY: { +- __u8 key[TCP_FASTOPEN_KEY_BUF_LENGTH]; +- struct tcp_fastopen_context *ctx; +- unsigned int key_len = 0; ++ u64 key[TCP_FASTOPEN_KEY_BUF_LENGTH / sizeof(u64)]; ++ unsigned int key_len; + + if (get_user(len, optlen)) + return -EFAULT; + +- rcu_read_lock(); +- ctx = rcu_dereference(icsk->icsk_accept_queue.fastopenq.ctx); +- if (ctx) { +- key_len = tcp_fastopen_context_len(ctx) * +- TCP_FASTOPEN_KEY_LENGTH; +- memcpy(&key[0], &ctx->key[0], key_len); +- } +- rcu_read_unlock(); +- ++ key_len = tcp_fastopen_get_cipher(net, icsk, key) * ++ TCP_FASTOPEN_KEY_LENGTH; + len = min_t(unsigned int, len, key_len); + if (put_user(len, optlen)) + return -EFAULT; +diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c +index a915ade0c818..a9971e41f31b 100644 +--- a/net/ipv4/tcp_fastopen.c ++++ b/net/ipv4/tcp_fastopen.c +@@ -108,6 +108,29 @@ out: + return err; + } + ++int tcp_fastopen_get_cipher(struct net *net, struct inet_connection_sock *icsk, ++ u64 *key) ++{ ++ struct tcp_fastopen_context *ctx; ++ int n_keys = 0, i; ++ ++ rcu_read_lock(); ++ if (icsk) ++ ctx = rcu_dereference(icsk->icsk_accept_queue.fastopenq.ctx); ++ else ++ ctx = rcu_dereference(net->ipv4.tcp_fastopen_ctx); ++ if (ctx) { ++ n_keys = tcp_fastopen_context_len(ctx); ++ for (i = 0; i < n_keys; i++) { ++ put_unaligned_le64(ctx->key[i].key[0], key + (i * 2)); ++ put_unaligned_le64(ctx->key[i].key[1], key + (i * 2) + 1); ++ } ++ } ++ rcu_read_unlock(); ++ ++ return n_keys; ++} ++ + static bool __tcp_fastopen_cookie_gen_cipher(struct request_sock *req, + struct sk_buff *syn, + const siphash_key_t *key, +diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c +index 8b80ab794a92..64a05906cc0e 100644 +--- a/net/netfilter/ipvs/ip_vs_core.c ++++ b/net/netfilter/ipvs/ip_vs_core.c +@@ -2061,14 +2061,14 @@ ip_vs_in(struct netns_ipvs *ipvs, unsigned int hooknum, struct sk_buff *skb, int + + conn_reuse_mode = sysctl_conn_reuse_mode(ipvs); + if (conn_reuse_mode && !iph.fragoffs && is_new_conn(skb, &iph) && cp) { +- bool uses_ct = false, resched = false; ++ bool old_ct = false, resched = false; + + if (unlikely(sysctl_expire_nodest_conn(ipvs)) && cp->dest && + unlikely(!atomic_read(&cp->dest->weight))) { + resched = true; +- uses_ct = ip_vs_conn_uses_conntrack(cp, skb); ++ old_ct = ip_vs_conn_uses_old_conntrack(cp, skb); + } else if (is_new_conn_expected(cp, conn_reuse_mode)) { +- uses_ct = ip_vs_conn_uses_conntrack(cp, skb); ++ old_ct = ip_vs_conn_uses_old_conntrack(cp, skb); + if (!atomic_read(&cp->n_control)) { + resched = true; + } else { +@@ -2076,15 +2076,17 @@ ip_vs_in(struct netns_ipvs *ipvs, unsigned int hooknum, struct sk_buff *skb, int + * that uses conntrack while it is still + * referenced by controlled connection(s). + */ +- resched = !uses_ct; ++ resched = !old_ct; + } + } + + if (resched) { ++ if (!old_ct) ++ cp->flags &= ~IP_VS_CONN_F_NFCT; + if (!atomic_read(&cp->n_control)) + ip_vs_conn_expire_now(cp); + __ip_vs_conn_put(cp); +- if (uses_ct) ++ if (old_ct) + return NF_DROP; + cp = NULL; + } +diff --git a/net/nfc/rawsock.c b/net/nfc/rawsock.c +index ba5ffd3badd3..b5c867fe3232 100644 +--- a/net/nfc/rawsock.c ++++ b/net/nfc/rawsock.c +@@ -332,10 +332,13 @@ static int rawsock_create(struct net *net, struct socket *sock, + if ((sock->type != SOCK_SEQPACKET) && (sock->type != SOCK_RAW)) + return -ESOCKTNOSUPPORT; + +- if (sock->type == SOCK_RAW) ++ if (sock->type == SOCK_RAW) { ++ if (!capable(CAP_NET_RAW)) ++ return -EPERM; + sock->ops = &rawsock_raw_ops; +- else ++ } else { + sock->ops = &rawsock_ops; ++ } + + sk = sk_alloc(net, PF_NFC, GFP_ATOMIC, nfc_proto->proto, kern); + if (!sk) +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index 1d63ab3a878a..7735340c892e 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -941,6 +941,7 @@ static int prb_queue_frozen(struct tpacket_kbdq_core *pkc) + } + + static void prb_clear_blk_fill_status(struct packet_ring_buffer *rb) ++ __releases(&pkc->blk_fill_in_prog_lock) + { + struct tpacket_kbdq_core *pkc = GET_PBDQC_FROM_RB(rb); + atomic_dec(&pkc->blk_fill_in_prog); +@@ -988,6 +989,7 @@ static void prb_fill_curr_block(char *curr, + struct tpacket_kbdq_core *pkc, + struct tpacket_block_desc *pbd, + unsigned int len) ++ __acquires(&pkc->blk_fill_in_prog_lock) + { + struct tpacket3_hdr *ppd; + +@@ -2285,8 +2287,11 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, + if (do_vnet && + virtio_net_hdr_from_skb(skb, h.raw + macoff - + sizeof(struct virtio_net_hdr), +- vio_le(), true, 0)) ++ vio_le(), true, 0)) { ++ if (po->tp_version == TPACKET_V3) ++ prb_clear_blk_fill_status(&po->rx_ring); + goto drop_n_account; ++ } + + if (po->tp_version <= TPACKET_V2) { + packet_increment_rx_head(po, &po->rx_ring); +@@ -2392,7 +2397,7 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, + __clear_bit(slot_id, po->rx_ring.rx_owner_map); + spin_unlock(&sk->sk_receive_queue.lock); + sk->sk_data_ready(sk); +- } else { ++ } else if (po->tp_version == TPACKET_V3) { + prb_clear_blk_fill_status(&po->rx_ring); + } + +diff --git a/net/socket.c b/net/socket.c +index 432800b39ddb..d1a0264401b7 100644 +--- a/net/socket.c ++++ b/net/socket.c +@@ -485,7 +485,7 @@ static struct socket *sockfd_lookup_light(int fd, int *err, int *fput_needed) + if (f.file) { + sock = sock_from_file(f.file, err); + if (likely(sock)) { +- *fput_needed = f.flags; ++ *fput_needed = f.flags & FDPUT_FPUT; + return sock; + } + fdput(f); +diff --git a/net/sunrpc/auth_gss/gss_krb5_wrap.c b/net/sunrpc/auth_gss/gss_krb5_wrap.c +index 683755d95075..78ad41656996 100644 +--- a/net/sunrpc/auth_gss/gss_krb5_wrap.c ++++ b/net/sunrpc/auth_gss/gss_krb5_wrap.c +@@ -584,7 +584,7 @@ gss_unwrap_kerberos_v2(struct krb5_ctx *kctx, int offset, int len, + buf->head[0].iov_len); + memmove(ptr, ptr + GSS_KRB5_TOK_HDR_LEN + headskip, movelen); + buf->head[0].iov_len -= GSS_KRB5_TOK_HDR_LEN + headskip; +- buf->len = len - GSS_KRB5_TOK_HDR_LEN + headskip; ++ buf->len = len - (GSS_KRB5_TOK_HDR_LEN + headskip); + + /* Trim off the trailing "extra count" and checksum blob */ + xdr_buf_trim(buf, ec + GSS_KRB5_TOK_HDR_LEN + tailskip); +diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c +index fd91274e834d..3645cd241d3e 100644 +--- a/net/sunrpc/auth_gss/svcauth_gss.c ++++ b/net/sunrpc/auth_gss/svcauth_gss.c +@@ -949,7 +949,6 @@ unwrap_priv_data(struct svc_rqst *rqstp, struct xdr_buf *buf, u32 seq, struct gs + + maj_stat = gss_unwrap(ctx, 0, priv_len, buf); + pad = priv_len - buf->len; +- buf->len -= pad; + /* The upper layers assume the buffer is aligned on 4-byte boundaries. + * In the krb5p case, at least, the data ends up offset, so we need to + * move it around. */ +diff --git a/net/sunrpc/xprtrdma/svc_rdma_rw.c b/net/sunrpc/xprtrdma/svc_rdma_rw.c +index 066af6b2eb01..0bb3f0dca80d 100644 +--- a/net/sunrpc/xprtrdma/svc_rdma_rw.c ++++ b/net/sunrpc/xprtrdma/svc_rdma_rw.c +@@ -677,7 +677,6 @@ static int svc_rdma_build_read_chunk(struct svc_rqst *rqstp, + struct svc_rdma_read_info *info, + __be32 *p) + { +- unsigned int i; + int ret; + + ret = -EINVAL; +@@ -700,12 +699,6 @@ static int svc_rdma_build_read_chunk(struct svc_rqst *rqstp, + info->ri_chunklen += rs_length; + } + +- /* Pages under I/O have been copied to head->rc_pages. +- * Prevent their premature release by svc_xprt_release() . +- */ +- for (i = 0; i < info->ri_readctxt->rc_page_count; i++) +- rqstp->rq_pages[i] = NULL; +- + return ret; + } + +@@ -800,6 +793,26 @@ out: + return ret; + } + ++/* Pages under I/O have been copied to head->rc_pages. Ensure they ++ * are not released by svc_xprt_release() until the I/O is complete. ++ * ++ * This has to be done after all Read WRs are constructed to properly ++ * handle a page that is part of I/O on behalf of two different RDMA ++ * segments. ++ * ++ * Do this only if I/O has been posted. Otherwise, we do indeed want ++ * svc_xprt_release() to clean things up properly. ++ */ ++static void svc_rdma_save_io_pages(struct svc_rqst *rqstp, ++ const unsigned int start, ++ const unsigned int num_pages) ++{ ++ unsigned int i; ++ ++ for (i = start; i < num_pages + start; i++) ++ rqstp->rq_pages[i] = NULL; ++} ++ + /** + * svc_rdma_recv_read_chunk - Pull a Read chunk from the client + * @rdma: controlling RDMA transport +@@ -853,6 +866,7 @@ int svc_rdma_recv_read_chunk(struct svcxprt_rdma *rdma, struct svc_rqst *rqstp, + ret = svc_rdma_post_chunk_ctxt(&info->ri_cc); + if (ret < 0) + goto out_err; ++ svc_rdma_save_io_pages(rqstp, 0, head->rc_page_count); + return 0; + + out_err: +diff --git a/net/tls/tls_device.c b/net/tls/tls_device.c +index 1adeb1c0473b..25fca390cdcf 100644 +--- a/net/tls/tls_device.c ++++ b/net/tls/tls_device.c +@@ -549,7 +549,7 @@ int tls_device_sendpage(struct sock *sk, struct page *page, + { + struct tls_context *tls_ctx = tls_get_ctx(sk); + struct iov_iter msg_iter; +- char *kaddr = kmap(page); ++ char *kaddr; + struct kvec iov; + int rc; + +@@ -564,6 +564,7 @@ int tls_device_sendpage(struct sock *sk, struct page *page, + goto out; + } + ++ kaddr = kmap(page); + iov.iov_base = kaddr + offset; + iov.iov_len = size; + iov_iter_kvec(&msg_iter, WRITE, &iov, 1, size); +diff --git a/samples/bpf/fds_example.c b/samples/bpf/fds_example.c +index 2d4b717726b6..34b3fca788e8 100644 +--- a/samples/bpf/fds_example.c ++++ b/samples/bpf/fds_example.c +@@ -30,6 +30,8 @@ + #define BPF_M_MAP 1 + #define BPF_M_PROG 2 + ++char bpf_log_buf[BPF_LOG_BUF_SIZE]; ++ + static void usage(void) + { + printf("Usage: fds_example [...]\n"); +@@ -57,7 +59,6 @@ static int bpf_prog_create(const char *object) + BPF_EXIT_INSN(), + }; + size_t insns_cnt = sizeof(insns) / sizeof(struct bpf_insn); +- char bpf_log_buf[BPF_LOG_BUF_SIZE]; + struct bpf_object *obj; + int prog_fd; + +diff --git a/scripts/recordmcount.c b/scripts/recordmcount.c +index 7225107a9aaf..e59022b3f125 100644 +--- a/scripts/recordmcount.c ++++ b/scripts/recordmcount.c +@@ -434,6 +434,11 @@ static int arm_is_fake_mcount(Elf32_Rel const *rp) + return 1; + } + ++static int arm64_is_fake_mcount(Elf64_Rel const *rp) ++{ ++ return ELF64_R_TYPE(w(rp->r_info)) != R_AARCH64_CALL26; ++} ++ + /* 64-bit EM_MIPS has weird ELF64_Rela.r_info. + * http://techpubs.sgi.com/library/manuals/4000/007-4658-001/pdf/007-4658-001.pdf + * We interpret Table 29 Relocation Operation (Elf64_Rel, Elf64_Rela) [p.40] +@@ -547,6 +552,7 @@ static int do_file(char const *const fname) + make_nop = make_nop_arm64; + rel_type_nop = R_AARCH64_NONE; + ideal_nop = ideal_nop4_arm64; ++ is_fake_mcount64 = arm64_is_fake_mcount; + break; + case EM_IA_64: reltype = R_IA64_IMM64; break; + case EM_MIPS: /* reltype: e_class */ break; +diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h +index be469fce19e1..8173982e00ab 100644 +--- a/security/integrity/ima/ima.h ++++ b/security/integrity/ima/ima.h +@@ -362,6 +362,7 @@ static inline void ima_free_modsig(struct modsig *modsig) + #ifdef CONFIG_IMA_LSM_RULES + + #define security_filter_rule_init security_audit_rule_init ++#define security_filter_rule_free security_audit_rule_free + #define security_filter_rule_match security_audit_rule_match + + #else +@@ -372,6 +373,10 @@ static inline int security_filter_rule_init(u32 field, u32 op, char *rulestr, + return -EINVAL; + } + ++static inline void security_filter_rule_free(void *lsmrule) ++{ ++} ++ + static inline int security_filter_rule_match(u32 secid, u32 field, u32 op, + void *lsmrule) + { +diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c +index 558a7607bf93..e725d4187271 100644 +--- a/security/integrity/ima/ima_policy.c ++++ b/security/integrity/ima/ima_policy.c +@@ -254,7 +254,7 @@ static void ima_lsm_free_rule(struct ima_rule_entry *entry) + int i; + + for (i = 0; i < MAX_LSM_RULES; i++) { +- kfree(entry->lsm[i].rule); ++ security_filter_rule_free(entry->lsm[i].rule); + kfree(entry->lsm[i].args_p); + } + kfree(entry); +diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c +index 840a192e9337..9c4308077574 100644 +--- a/security/smack/smackfs.c ++++ b/security/smack/smackfs.c +@@ -884,7 +884,7 @@ static ssize_t smk_set_cipso(struct file *file, const char __user *buf, + } + + ret = sscanf(rule, "%d", &maplevel); +- if (ret != 1 || maplevel > SMACK_CIPSO_MAXLEVEL) ++ if (ret != 1 || maplevel < 0 || maplevel > SMACK_CIPSO_MAXLEVEL) + goto out; + + rule += SMK_DIGITLEN; +@@ -905,6 +905,10 @@ static ssize_t smk_set_cipso(struct file *file, const char __user *buf, + + for (i = 0; i < catlen; i++) { + rule += SMK_DIGITLEN; ++ if (rule > data + count) { ++ rc = -EOVERFLOW; ++ goto out; ++ } + ret = sscanf(rule, "%u", &cat); + if (ret != 1 || cat > SMACK_CIPSO_MAXCATNUM) + goto out; +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index ea25b8d0350d..88629906f314 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -4391,6 +4391,7 @@ static void alc233_fixup_lenovo_line2_mic_hotkey(struct hda_codec *codec, + { + struct alc_spec *spec = codec->spec; + ++ spec->micmute_led_polarity = 1; + alc_fixup_hp_gpio_led(codec, action, 0, 0x04); + if (action == HDA_FIXUP_ACT_PRE_PROBE) { + spec->init_amp = ALC_INIT_DEFAULT; +diff --git a/sound/soc/fsl/fsl_sai.c b/sound/soc/fsl/fsl_sai.c +index 41b83ecaf008..914b75c23d1b 100644 +--- a/sound/soc/fsl/fsl_sai.c ++++ b/sound/soc/fsl/fsl_sai.c +@@ -680,10 +680,11 @@ static int fsl_sai_dai_probe(struct snd_soc_dai *cpu_dai) + regmap_write(sai->regmap, FSL_SAI_RCSR(ofs), 0); + + regmap_update_bits(sai->regmap, FSL_SAI_TCR1(ofs), +- FSL_SAI_CR1_RFW_MASK, ++ FSL_SAI_CR1_RFW_MASK(sai->soc_data->fifo_depth), + sai->soc_data->fifo_depth - FSL_SAI_MAXBURST_TX); + regmap_update_bits(sai->regmap, FSL_SAI_RCR1(ofs), +- FSL_SAI_CR1_RFW_MASK, FSL_SAI_MAXBURST_RX - 1); ++ FSL_SAI_CR1_RFW_MASK(sai->soc_data->fifo_depth), ++ FSL_SAI_MAXBURST_RX - 1); + + snd_soc_dai_init_dma_data(cpu_dai, &sai->dma_params_tx, + &sai->dma_params_rx); +diff --git a/sound/soc/fsl/fsl_sai.h b/sound/soc/fsl/fsl_sai.h +index 76b15deea80c..6aba7d28f5f3 100644 +--- a/sound/soc/fsl/fsl_sai.h ++++ b/sound/soc/fsl/fsl_sai.h +@@ -94,7 +94,7 @@ + #define FSL_SAI_CSR_FRDE BIT(0) + + /* SAI Transmit and Receive Configuration 1 Register */ +-#define FSL_SAI_CR1_RFW_MASK 0x1f ++#define FSL_SAI_CR1_RFW_MASK(x) ((x) - 1) + + /* SAI Transmit and Receive Configuration 2 Register */ + #define FSL_SAI_CR2_SYNC BIT(30) +diff --git a/sound/soc/intel/boards/bxt_rt298.c b/sound/soc/intel/boards/bxt_rt298.c +index adf416a49b48..60fb87495050 100644 +--- a/sound/soc/intel/boards/bxt_rt298.c ++++ b/sound/soc/intel/boards/bxt_rt298.c +@@ -556,6 +556,7 @@ static int bxt_card_late_probe(struct snd_soc_card *card) + /* broxton audio machine driver for SPT + RT298S */ + static struct snd_soc_card broxton_rt298 = { + .name = "broxton-rt298", ++ .owner = THIS_MODULE, + .dai_link = broxton_rt298_dais, + .num_links = ARRAY_SIZE(broxton_rt298_dais), + .controls = broxton_controls, +@@ -571,6 +572,7 @@ static struct snd_soc_card broxton_rt298 = { + + static struct snd_soc_card geminilake_rt298 = { + .name = "geminilake-rt298", ++ .owner = THIS_MODULE, + .dai_link = broxton_rt298_dais, + .num_links = ARRAY_SIZE(broxton_rt298_dais), + .controls = broxton_controls, +diff --git a/sound/soc/meson/axg-card.c b/sound/soc/meson/axg-card.c +index 1f698adde506..7126344017fa 100644 +--- a/sound/soc/meson/axg-card.c ++++ b/sound/soc/meson/axg-card.c +@@ -266,7 +266,7 @@ static int axg_card_add_tdm_loopback(struct snd_soc_card *card, + + lb = &card->dai_link[*index + 1]; + +- lb->name = kasprintf(GFP_KERNEL, "%s-lb", pad->name); ++ lb->name = devm_kasprintf(card->dev, GFP_KERNEL, "%s-lb", pad->name); + if (!lb->name) + return -ENOMEM; + +diff --git a/sound/soc/meson/axg-tdm-formatter.c b/sound/soc/meson/axg-tdm-formatter.c +index 358c8c0d861c..f7e8e9da68a0 100644 +--- a/sound/soc/meson/axg-tdm-formatter.c ++++ b/sound/soc/meson/axg-tdm-formatter.c +@@ -70,7 +70,7 @@ EXPORT_SYMBOL_GPL(axg_tdm_formatter_set_channel_masks); + static int axg_tdm_formatter_enable(struct axg_tdm_formatter *formatter) + { + struct axg_tdm_stream *ts = formatter->stream; +- bool invert = formatter->drv->quirks->invert_sclk; ++ bool invert; + int ret; + + /* Do nothing if the formatter is already enabled */ +@@ -96,11 +96,12 @@ static int axg_tdm_formatter_enable(struct axg_tdm_formatter *formatter) + return ret; + + /* +- * If sclk is inverted, invert it back and provide the inversion +- * required by the formatter ++ * If sclk is inverted, it means the bit should latched on the ++ * rising edge which is what our HW expects. If not, we need to ++ * invert it before the formatter. + */ +- invert ^= axg_tdm_sclk_invert(ts->iface->fmt); +- ret = clk_set_phase(formatter->sclk, invert ? 180 : 0); ++ invert = axg_tdm_sclk_invert(ts->iface->fmt); ++ ret = clk_set_phase(formatter->sclk, invert ? 0 : 180); + if (ret) + return ret; + +diff --git a/sound/soc/meson/axg-tdm-formatter.h b/sound/soc/meson/axg-tdm-formatter.h +index 9ef98e955cb2..a1f0dcc0ff13 100644 +--- a/sound/soc/meson/axg-tdm-formatter.h ++++ b/sound/soc/meson/axg-tdm-formatter.h +@@ -16,7 +16,6 @@ struct snd_kcontrol; + + struct axg_tdm_formatter_hw { + unsigned int skew_offset; +- bool invert_sclk; + }; + + struct axg_tdm_formatter_ops { +diff --git a/sound/soc/meson/axg-tdm-interface.c b/sound/soc/meson/axg-tdm-interface.c +index d51f3344be7c..e25336f73912 100644 +--- a/sound/soc/meson/axg-tdm-interface.c ++++ b/sound/soc/meson/axg-tdm-interface.c +@@ -119,18 +119,25 @@ static int axg_tdm_iface_set_fmt(struct snd_soc_dai *dai, unsigned int fmt) + { + struct axg_tdm_iface *iface = snd_soc_dai_get_drvdata(dai); + +- /* These modes are not supported */ +- if (fmt & (SND_SOC_DAIFMT_CBS_CFM | SND_SOC_DAIFMT_CBM_CFS)) { ++ switch (fmt & SND_SOC_DAIFMT_MASTER_MASK) { ++ case SND_SOC_DAIFMT_CBS_CFS: ++ if (!iface->mclk) { ++ dev_err(dai->dev, "cpu clock master: mclk missing\n"); ++ return -ENODEV; ++ } ++ break; ++ ++ case SND_SOC_DAIFMT_CBM_CFM: ++ break; ++ ++ case SND_SOC_DAIFMT_CBS_CFM: ++ case SND_SOC_DAIFMT_CBM_CFS: + dev_err(dai->dev, "only CBS_CFS and CBM_CFM are supported\n"); ++ /* Fall-through */ ++ default: + return -EINVAL; + } + +- /* If the TDM interface is the clock master, it requires mclk */ +- if (!iface->mclk && (fmt & SND_SOC_DAIFMT_CBS_CFS)) { +- dev_err(dai->dev, "cpu clock master: mclk missing\n"); +- return -ENODEV; +- } +- + iface->fmt = fmt; + return 0; + } +@@ -319,7 +326,8 @@ static int axg_tdm_iface_hw_params(struct snd_pcm_substream *substream, + if (ret) + return ret; + +- if (iface->fmt & SND_SOC_DAIFMT_CBS_CFS) { ++ if ((iface->fmt & SND_SOC_DAIFMT_MASTER_MASK) == ++ SND_SOC_DAIFMT_CBS_CFS) { + ret = axg_tdm_iface_set_sclk(dai, params); + if (ret) + return ret; +diff --git a/sound/soc/meson/axg-tdmin.c b/sound/soc/meson/axg-tdmin.c +index 973d4c02ef8d..88ed95ae886b 100644 +--- a/sound/soc/meson/axg-tdmin.c ++++ b/sound/soc/meson/axg-tdmin.c +@@ -228,15 +228,29 @@ static const struct axg_tdm_formatter_driver axg_tdmin_drv = { + .regmap_cfg = &axg_tdmin_regmap_cfg, + .ops = &axg_tdmin_ops, + .quirks = &(const struct axg_tdm_formatter_hw) { +- .invert_sclk = false, + .skew_offset = 2, + }, + }; + ++static const struct axg_tdm_formatter_driver g12a_tdmin_drv = { ++ .component_drv = &axg_tdmin_component_drv, ++ .regmap_cfg = &axg_tdmin_regmap_cfg, ++ .ops = &axg_tdmin_ops, ++ .quirks = &(const struct axg_tdm_formatter_hw) { ++ .skew_offset = 3, ++ }, ++}; ++ + static const struct of_device_id axg_tdmin_of_match[] = { + { + .compatible = "amlogic,axg-tdmin", + .data = &axg_tdmin_drv, ++ }, { ++ .compatible = "amlogic,g12a-tdmin", ++ .data = &g12a_tdmin_drv, ++ }, { ++ .compatible = "amlogic,sm1-tdmin", ++ .data = &g12a_tdmin_drv, + }, {} + }; + MODULE_DEVICE_TABLE(of, axg_tdmin_of_match); +diff --git a/sound/soc/meson/axg-tdmout.c b/sound/soc/meson/axg-tdmout.c +index 418ec314b37d..3ceabddae629 100644 +--- a/sound/soc/meson/axg-tdmout.c ++++ b/sound/soc/meson/axg-tdmout.c +@@ -238,7 +238,6 @@ static const struct axg_tdm_formatter_driver axg_tdmout_drv = { + .regmap_cfg = &axg_tdmout_regmap_cfg, + .ops = &axg_tdmout_ops, + .quirks = &(const struct axg_tdm_formatter_hw) { +- .invert_sclk = true, + .skew_offset = 1, + }, + }; +@@ -248,7 +247,6 @@ static const struct axg_tdm_formatter_driver g12a_tdmout_drv = { + .regmap_cfg = &axg_tdmout_regmap_cfg, + .ops = &axg_tdmout_ops, + .quirks = &(const struct axg_tdm_formatter_hw) { +- .invert_sclk = true, + .skew_offset = 2, + }, + }; +@@ -309,7 +307,6 @@ static const struct axg_tdm_formatter_driver sm1_tdmout_drv = { + .regmap_cfg = &axg_tdmout_regmap_cfg, + .ops = &axg_tdmout_ops, + .quirks = &(const struct axg_tdm_formatter_hw) { +- .invert_sclk = true, + .skew_offset = 2, + }, + }; +diff --git a/sound/soc/sof/nocodec.c b/sound/soc/sof/nocodec.c +index ea0fe9a09f3f..71410116add1 100644 +--- a/sound/soc/sof/nocodec.c ++++ b/sound/soc/sof/nocodec.c +@@ -14,6 +14,7 @@ + + static struct snd_soc_card sof_nocodec_card = { + .name = "nocodec", /* the sof- prefix is added by the core */ ++ .owner = THIS_MODULE + }; + + static int sof_nocodec_bes_setup(struct device *dev, +diff --git a/sound/usb/card.h b/sound/usb/card.h +index f39f23e3525d..d8ec5caf464d 100644 +--- a/sound/usb/card.h ++++ b/sound/usb/card.h +@@ -133,6 +133,7 @@ struct snd_usb_substream { + unsigned int tx_length_quirk:1; /* add length specifier to transfers */ + unsigned int fmt_type; /* USB audio format type (1-3) */ + unsigned int pkt_offset_adj; /* Bytes to drop from beginning of packets (for non-compliant devices) */ ++ unsigned int stream_offset_adj; /* Bytes to drop from beginning of stream (for non-compliant devices) */ + + unsigned int running: 1; /* running status */ + +diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c +index d39bf5b648d1..49f0dc0e3e4d 100644 +--- a/sound/usb/mixer_quirks.c ++++ b/sound/usb/mixer_quirks.c +@@ -184,6 +184,7 @@ static const struct rc_config { + { USB_ID(0x041e, 0x3042), 0, 1, 1, 1, 1, 0x000d }, /* Usb X-Fi S51 */ + { USB_ID(0x041e, 0x30df), 0, 1, 1, 1, 1, 0x000d }, /* Usb X-Fi S51 Pro */ + { USB_ID(0x041e, 0x3237), 0, 1, 1, 1, 1, 0x000d }, /* Usb X-Fi S51 Pro */ ++ { USB_ID(0x041e, 0x3263), 0, 1, 1, 1, 1, 0x000d }, /* Usb X-Fi S51 Pro */ + { USB_ID(0x041e, 0x3048), 2, 2, 6, 6, 2, 0x6e91 }, /* Toshiba SB0500 */ + }; + +diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c +index d11d00efc574..7b41f9748978 100644 +--- a/sound/usb/pcm.c ++++ b/sound/usb/pcm.c +@@ -1417,6 +1417,12 @@ static void retire_capture_urb(struct snd_usb_substream *subs, + // continue; + } + bytes = urb->iso_frame_desc[i].actual_length; ++ if (subs->stream_offset_adj > 0) { ++ unsigned int adj = min(subs->stream_offset_adj, bytes); ++ cp += adj; ++ bytes -= adj; ++ subs->stream_offset_adj -= adj; ++ } + frames = bytes / stride; + if (!subs->txfr_quirk) + bytes = frames * stride; +diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h +index 562179492a33..1573229d8cf4 100644 +--- a/sound/usb/quirks-table.h ++++ b/sound/usb/quirks-table.h +@@ -3570,6 +3570,62 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"), + } + } + }, ++{ ++ /* ++ * PIONEER DJ DDJ-RB ++ * PCM is 4 channels out, 2 dummy channels in @ 44.1 fixed ++ * The feedback for the output is the dummy input. ++ */ ++ USB_DEVICE_VENDOR_SPEC(0x2b73, 0x000e), ++ .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { ++ .ifnum = QUIRK_ANY_INTERFACE, ++ .type = QUIRK_COMPOSITE, ++ .data = (const struct snd_usb_audio_quirk[]) { ++ { ++ .ifnum = 0, ++ .type = QUIRK_AUDIO_FIXED_ENDPOINT, ++ .data = &(const struct audioformat) { ++ .formats = SNDRV_PCM_FMTBIT_S24_3LE, ++ .channels = 4, ++ .iface = 0, ++ .altsetting = 1, ++ .altset_idx = 1, ++ .endpoint = 0x01, ++ .ep_attr = USB_ENDPOINT_XFER_ISOC| ++ USB_ENDPOINT_SYNC_ASYNC, ++ .rates = SNDRV_PCM_RATE_44100, ++ .rate_min = 44100, ++ .rate_max = 44100, ++ .nr_rates = 1, ++ .rate_table = (unsigned int[]) { 44100 } ++ } ++ }, ++ { ++ .ifnum = 0, ++ .type = QUIRK_AUDIO_FIXED_ENDPOINT, ++ .data = &(const struct audioformat) { ++ .formats = SNDRV_PCM_FMTBIT_S24_3LE, ++ .channels = 2, ++ .iface = 0, ++ .altsetting = 1, ++ .altset_idx = 1, ++ .endpoint = 0x82, ++ .ep_attr = USB_ENDPOINT_XFER_ISOC| ++ USB_ENDPOINT_SYNC_ASYNC| ++ USB_ENDPOINT_USAGE_IMPLICIT_FB, ++ .rates = SNDRV_PCM_RATE_44100, ++ .rate_min = 44100, ++ .rate_max = 44100, ++ .nr_rates = 1, ++ .rate_table = (unsigned int[]) { 44100 } ++ } ++ }, ++ { ++ .ifnum = -1 ++ } ++ } ++ } ++}, + + #define ALC1220_VB_DESKTOP(vend, prod) { \ + USB_DEVICE(vend, prod), \ +@@ -3623,7 +3679,13 @@ ALC1220_VB_DESKTOP(0x26ce, 0x0a01), /* Asrock TRX40 Creator */ + * with. + */ + { +- USB_DEVICE(0x534d, 0x2109), ++ .match_flags = USB_DEVICE_ID_MATCH_DEVICE | ++ USB_DEVICE_ID_MATCH_INT_CLASS | ++ USB_DEVICE_ID_MATCH_INT_SUBCLASS, ++ .idVendor = 0x534d, ++ .idProduct = 0x2109, ++ .bInterfaceClass = USB_CLASS_AUDIO, ++ .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL, + .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { + .vendor_name = "MacroSilicon", + .product_name = "MS2109", +diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c +index a8bb953cc468..a756f50d9f07 100644 +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -1432,6 +1432,9 @@ void snd_usb_set_format_quirk(struct snd_usb_substream *subs, + case USB_ID(0x041e, 0x3f19): /* E-Mu 0204 USB */ + set_format_emu_quirk(subs, fmt); + break; ++ case USB_ID(0x534d, 0x2109): /* MacroSilicon MS2109 */ ++ subs->stream_offset_adj = 2; ++ break; + } + } + +diff --git a/sound/usb/stream.c b/sound/usb/stream.c +index 11785f9652ad..d01edd5da6cf 100644 +--- a/sound/usb/stream.c ++++ b/sound/usb/stream.c +@@ -94,6 +94,7 @@ static void snd_usb_init_substream(struct snd_usb_stream *as, + subs->tx_length_quirk = as->chip->tx_length_quirk; + subs->speed = snd_usb_get_speed(subs->dev); + subs->pkt_offset_adj = 0; ++ subs->stream_offset_adj = 0; + + snd_usb_set_pcm_ops(as->pcm, stream); + +diff --git a/tools/bpf/bpftool/btf.c b/tools/bpf/bpftool/btf.c +index 9a9376d1d3df..66765f970bc5 100644 +--- a/tools/bpf/bpftool/btf.c ++++ b/tools/bpf/bpftool/btf.c +@@ -510,7 +510,7 @@ static int do_dump(int argc, char **argv) + goto done; + } + if (!btf) { +- err = ENOENT; ++ err = -ENOENT; + p_err("can't find btf with ID (%u)", btf_id); + goto done; + } +diff --git a/tools/build/Build.include b/tools/build/Build.include +index 9ec01f4454f9..585486e40995 100644 +--- a/tools/build/Build.include ++++ b/tools/build/Build.include +@@ -74,7 +74,8 @@ dep-cmd = $(if $(wildcard $(fixdep)), + # dependencies in the cmd file + if_changed_dep = $(if $(strip $(any-prereq) $(arg-check)), \ + @set -e; \ +- $(echo-cmd) $(cmd_$(1)) && $(dep-cmd)) ++ $(echo-cmd) $(cmd_$(1)); \ ++ $(dep-cmd)) + + # if_changed - execute command if any prerequisite is newer than + # target, or command line has changed +diff --git a/tools/testing/selftests/powerpc/benchmarks/context_switch.c b/tools/testing/selftests/powerpc/benchmarks/context_switch.c +index a2e8c9da7fa5..d50cc05df495 100644 +--- a/tools/testing/selftests/powerpc/benchmarks/context_switch.c ++++ b/tools/testing/selftests/powerpc/benchmarks/context_switch.c +@@ -19,6 +19,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -104,8 +105,9 @@ static void start_thread_on(void *(*fn)(void *), void *arg, unsigned long cpu) + + static void start_process_on(void *(*fn)(void *), void *arg, unsigned long cpu) + { +- int pid; +- cpu_set_t cpuset; ++ int pid, ncpus; ++ cpu_set_t *cpuset; ++ size_t size; + + pid = fork(); + if (pid == -1) { +@@ -116,14 +118,23 @@ static void start_process_on(void *(*fn)(void *), void *arg, unsigned long cpu) + if (pid) + return; + +- CPU_ZERO(&cpuset); +- CPU_SET(cpu, &cpuset); ++ ncpus = get_nprocs(); ++ size = CPU_ALLOC_SIZE(ncpus); ++ cpuset = CPU_ALLOC(ncpus); ++ if (!cpuset) { ++ perror("malloc"); ++ exit(1); ++ } ++ CPU_ZERO_S(size, cpuset); ++ CPU_SET_S(cpu, size, cpuset); + +- if (sched_setaffinity(0, sizeof(cpuset), &cpuset)) { ++ if (sched_setaffinity(0, size, cpuset)) { + perror("sched_setaffinity"); ++ CPU_FREE(cpuset); + exit(1); + } + ++ CPU_FREE(cpuset); + fn(arg); + + exit(0); +diff --git a/tools/testing/selftests/powerpc/eeh/eeh-functions.sh b/tools/testing/selftests/powerpc/eeh/eeh-functions.sh +index f52ed92b53e7..00dc32c0ed75 100755 +--- a/tools/testing/selftests/powerpc/eeh/eeh-functions.sh ++++ b/tools/testing/selftests/powerpc/eeh/eeh-functions.sh +@@ -5,12 +5,17 @@ pe_ok() { + local dev="$1" + local path="/sys/bus/pci/devices/$dev/eeh_pe_state" + +- if ! [ -e "$path" ] ; then ++ # if a driver doesn't support the error handling callbacks then the ++ # device is recovered by removing and re-probing it. This causes the ++ # sysfs directory to disappear so read the PE state once and squash ++ # any potential error messages ++ local eeh_state="$(cat $path 2>/dev/null)" ++ if [ -z "$eeh_state" ]; then + return 1; + fi + +- local fw_state="$(cut -d' ' -f1 < $path)" +- local sw_state="$(cut -d' ' -f2 < $path)" ++ local fw_state="$(echo $eeh_state | cut -d' ' -f1)" ++ local sw_state="$(echo $eeh_state | cut -d' ' -f2)" + + # If EEH_PE_ISOLATED or EEH_PE_RECOVERING are set then the PE is in an + # error state or being recovered. Either way, not ok. +diff --git a/tools/testing/selftests/powerpc/utils.c b/tools/testing/selftests/powerpc/utils.c +index c02d24835db4..176102eca994 100644 +--- a/tools/testing/selftests/powerpc/utils.c ++++ b/tools/testing/selftests/powerpc/utils.c +@@ -16,6 +16,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -88,28 +89,40 @@ void *get_auxv_entry(int type) + + int pick_online_cpu(void) + { +- cpu_set_t mask; +- int cpu; ++ int ncpus, cpu = -1; ++ cpu_set_t *mask; ++ size_t size; ++ ++ ncpus = get_nprocs_conf(); ++ size = CPU_ALLOC_SIZE(ncpus); ++ mask = CPU_ALLOC(ncpus); ++ if (!mask) { ++ perror("malloc"); ++ return -1; ++ } + +- CPU_ZERO(&mask); ++ CPU_ZERO_S(size, mask); + +- if (sched_getaffinity(0, sizeof(mask), &mask)) { ++ if (sched_getaffinity(0, size, mask)) { + perror("sched_getaffinity"); +- return -1; ++ goto done; + } + + /* We prefer a primary thread, but skip 0 */ +- for (cpu = 8; cpu < CPU_SETSIZE; cpu += 8) +- if (CPU_ISSET(cpu, &mask)) +- return cpu; ++ for (cpu = 8; cpu < ncpus; cpu += 8) ++ if (CPU_ISSET_S(cpu, size, mask)) ++ goto done; + + /* Search for anything, but in reverse */ +- for (cpu = CPU_SETSIZE - 1; cpu >= 0; cpu--) +- if (CPU_ISSET(cpu, &mask)) +- return cpu; ++ for (cpu = ncpus - 1; cpu >= 0; cpu--) ++ if (CPU_ISSET_S(cpu, size, mask)) ++ goto done; + + printf("No cpus in affinity mask?!\n"); +- return -1; ++ ++done: ++ CPU_FREE(mask); ++ return cpu; + } + + bool is_ppc64le(void) +diff --git a/tools/testing/selftests/seccomp/seccomp_bpf.c b/tools/testing/selftests/seccomp/seccomp_bpf.c +index 96bbda4f10fc..19c7351eeb74 100644 +--- a/tools/testing/selftests/seccomp/seccomp_bpf.c ++++ b/tools/testing/selftests/seccomp/seccomp_bpf.c +@@ -177,7 +177,7 @@ struct seccomp_metadata { + #define SECCOMP_IOCTL_NOTIF_RECV SECCOMP_IOWR(0, struct seccomp_notif) + #define SECCOMP_IOCTL_NOTIF_SEND SECCOMP_IOWR(1, \ + struct seccomp_notif_resp) +-#define SECCOMP_IOCTL_NOTIF_ID_VALID SECCOMP_IOR(2, __u64) ++#define SECCOMP_IOCTL_NOTIF_ID_VALID SECCOMP_IOW(2, __u64) + + struct seccomp_notif { + __u64 id; diff --git a/patch/kernel/odroidxu4-current/patch-5.4.59-60.patch b/patch/kernel/odroidxu4-current/patch-5.4.59-60.patch new file mode 100644 index 000000000..280c19f64 --- /dev/null +++ b/patch/kernel/odroidxu4-current/patch-5.4.59-60.patch @@ -0,0 +1,4875 @@ +diff --git a/Documentation/devicetree/bindings/iio/multiplexer/io-channel-mux.txt b/Documentation/devicetree/bindings/iio/multiplexer/io-channel-mux.txt +index c82794002595f..89647d7143879 100644 +--- a/Documentation/devicetree/bindings/iio/multiplexer/io-channel-mux.txt ++++ b/Documentation/devicetree/bindings/iio/multiplexer/io-channel-mux.txt +@@ -21,7 +21,7 @@ controller state. The mux controller state is described in + + Example: + mux: mux-controller { +- compatible = "mux-gpio"; ++ compatible = "gpio-mux"; + #mux-control-cells = <0>; + + mux-gpios = <&pioA 0 GPIO_ACTIVE_HIGH>, +diff --git a/Makefile b/Makefile +index cc72b8472f24a..7c001e21e28e7 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 5 + PATCHLEVEL = 4 +-SUBLEVEL = 59 ++SUBLEVEL = 60 + EXTRAVERSION = + NAME = Kleptomaniac Octopus + +diff --git a/arch/arm64/boot/dts/marvell/armada-3720-espressobin.dts b/arch/arm64/boot/dts/marvell/armada-3720-espressobin.dts +index fbcf03f86c967..05dc58c13fa41 100644 +--- a/arch/arm64/boot/dts/marvell/armada-3720-espressobin.dts ++++ b/arch/arm64/boot/dts/marvell/armada-3720-espressobin.dts +@@ -19,6 +19,12 @@ + model = "Globalscale Marvell ESPRESSOBin Board"; + compatible = "globalscale,espressobin", "marvell,armada3720", "marvell,armada3710"; + ++ aliases { ++ ethernet0 = ð0; ++ serial0 = &uart0; ++ serial1 = &uart1; ++ }; ++ + chosen { + stdout-path = "serial0:115200n8"; + }; +diff --git a/arch/arm64/kernel/perf_event.c b/arch/arm64/kernel/perf_event.c +index a0b4f1bca4917..19128d994ee97 100644 +--- a/arch/arm64/kernel/perf_event.c ++++ b/arch/arm64/kernel/perf_event.c +@@ -155,7 +155,7 @@ armv8pmu_events_sysfs_show(struct device *dev, + + pmu_attr = container_of(attr, struct perf_pmu_events_attr, attr); + +- return sprintf(page, "event=0x%03llx\n", pmu_attr->id); ++ return sprintf(page, "event=0x%04llx\n", pmu_attr->id); + } + + #define ARMV8_EVENT_ATTR(name, config) \ +@@ -303,10 +303,13 @@ armv8pmu_event_attr_is_visible(struct kobject *kobj, + test_bit(pmu_attr->id, cpu_pmu->pmceid_bitmap)) + return attr->mode; + +- pmu_attr->id -= ARMV8_PMUV3_EXT_COMMON_EVENT_BASE; +- if (pmu_attr->id < ARMV8_PMUV3_MAX_COMMON_EVENTS && +- test_bit(pmu_attr->id, cpu_pmu->pmceid_ext_bitmap)) +- return attr->mode; ++ if (pmu_attr->id >= ARMV8_PMUV3_EXT_COMMON_EVENT_BASE) { ++ u64 id = pmu_attr->id - ARMV8_PMUV3_EXT_COMMON_EVENT_BASE; ++ ++ if (id < ARMV8_PMUV3_MAX_COMMON_EVENTS && ++ test_bit(id, cpu_pmu->pmceid_ext_bitmap)) ++ return attr->mode; ++ } + + return 0; + } +diff --git a/arch/mips/boot/dts/ingenic/qi_lb60.dts b/arch/mips/boot/dts/ingenic/qi_lb60.dts +index 7a371d9c5a33f..eda37fb516f0e 100644 +--- a/arch/mips/boot/dts/ingenic/qi_lb60.dts ++++ b/arch/mips/boot/dts/ingenic/qi_lb60.dts +@@ -69,7 +69,7 @@ + "Speaker", "OUTL", + "Speaker", "OUTR", + "INL", "LOUT", +- "INL", "ROUT"; ++ "INR", "ROUT"; + + simple-audio-card,aux-devs = <&>; + +diff --git a/arch/mips/kernel/topology.c b/arch/mips/kernel/topology.c +index cd3e1f82e1a5d..08ad6371fbe08 100644 +--- a/arch/mips/kernel/topology.c ++++ b/arch/mips/kernel/topology.c +@@ -20,7 +20,7 @@ static int __init topology_init(void) + for_each_present_cpu(i) { + struct cpu *c = &per_cpu(cpu_devices, i); + +- c->hotpluggable = 1; ++ c->hotpluggable = !!i; + ret = register_cpu(c, i); + if (ret) + printk(KERN_WARNING "topology_init: register_cpu %d " +diff --git a/arch/openrisc/kernel/stacktrace.c b/arch/openrisc/kernel/stacktrace.c +index 43f140a28bc72..54d38809e22cb 100644 +--- a/arch/openrisc/kernel/stacktrace.c ++++ b/arch/openrisc/kernel/stacktrace.c +@@ -13,6 +13,7 @@ + #include + #include + #include ++#include + #include + + #include +@@ -68,12 +69,25 @@ void save_stack_trace_tsk(struct task_struct *tsk, struct stack_trace *trace) + { + unsigned long *sp = NULL; + ++ if (!try_get_task_stack(tsk)) ++ return; ++ + if (tsk == current) + sp = (unsigned long *) &sp; +- else +- sp = (unsigned long *) KSTK_ESP(tsk); ++ else { ++ unsigned long ksp; ++ ++ /* Locate stack from kernel context */ ++ ksp = task_thread_info(tsk)->ksp; ++ ksp += STACK_FRAME_OVERHEAD; /* redzone */ ++ ksp += sizeof(struct pt_regs); ++ ++ sp = (unsigned long *) ksp; ++ } + + unwind_stack(trace, sp, save_stack_address_nosched); ++ ++ put_task_stack(tsk); + } + EXPORT_SYMBOL_GPL(save_stack_trace_tsk); + +diff --git a/arch/powerpc/include/asm/percpu.h b/arch/powerpc/include/asm/percpu.h +index dce863a7635cd..8e5b7d0b851c6 100644 +--- a/arch/powerpc/include/asm/percpu.h ++++ b/arch/powerpc/include/asm/percpu.h +@@ -10,8 +10,6 @@ + + #ifdef CONFIG_SMP + +-#include +- + #define __my_cpu_offset local_paca->data_offset + + #endif /* CONFIG_SMP */ +@@ -19,4 +17,6 @@ + + #include + ++#include ++ + #endif /* _ASM_POWERPC_PERCPU_H_ */ +diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c +index 881a026a603a6..187047592d53c 100644 +--- a/arch/powerpc/mm/fault.c ++++ b/arch/powerpc/mm/fault.c +@@ -241,6 +241,9 @@ static bool bad_kernel_fault(struct pt_regs *regs, unsigned long error_code, + return false; + } + ++// This comes from 64-bit struct rt_sigframe + __SIGNAL_FRAMESIZE ++#define SIGFRAME_MAX_SIZE (4096 + 128) ++ + static bool bad_stack_expansion(struct pt_regs *regs, unsigned long address, + struct vm_area_struct *vma, unsigned int flags, + bool *must_retry) +@@ -248,7 +251,7 @@ static bool bad_stack_expansion(struct pt_regs *regs, unsigned long address, + /* + * N.B. The POWER/Open ABI allows programs to access up to + * 288 bytes below the stack pointer. +- * The kernel signal delivery code writes up to about 1.5kB ++ * The kernel signal delivery code writes a bit over 4KB + * below the stack pointer (r1) before decrementing it. + * The exec code can write slightly over 640kB to the stack + * before setting the user r1. Thus we allow the stack to +@@ -273,7 +276,7 @@ static bool bad_stack_expansion(struct pt_regs *regs, unsigned long address, + * between the last mapped region and the stack will + * expand the stack rather than segfaulting. + */ +- if (address + 2048 >= uregs->gpr[1]) ++ if (address + SIGFRAME_MAX_SIZE >= uregs->gpr[1]) + return false; + + if ((flags & FAULT_FLAG_WRITE) && (flags & FAULT_FLAG_USER) && +diff --git a/arch/powerpc/mm/ptdump/hashpagetable.c b/arch/powerpc/mm/ptdump/hashpagetable.c +index a07278027c6f4..a2e8c3b2cf351 100644 +--- a/arch/powerpc/mm/ptdump/hashpagetable.c ++++ b/arch/powerpc/mm/ptdump/hashpagetable.c +@@ -259,7 +259,7 @@ static int pseries_find(unsigned long ea, int psize, bool primary, u64 *v, u64 * + for (i = 0; i < HPTES_PER_GROUP; i += 4, hpte_group += 4) { + lpar_rc = plpar_pte_read_4(0, hpte_group, (void *)ptes); + +- if (lpar_rc != H_SUCCESS) ++ if (lpar_rc) + continue; + for (j = 0; j < 4; j++) { + if (HPTE_V_COMPARE(ptes[j].v, want_v) && +diff --git a/arch/powerpc/platforms/pseries/hotplug-memory.c b/arch/powerpc/platforms/pseries/hotplug-memory.c +index f1888352b4e0b..e7d23a933a0d3 100644 +--- a/arch/powerpc/platforms/pseries/hotplug-memory.c ++++ b/arch/powerpc/platforms/pseries/hotplug-memory.c +@@ -27,7 +27,7 @@ static bool rtas_hp_event; + unsigned long pseries_memory_block_size(void) + { + struct device_node *np; +- unsigned int memblock_size = MIN_MEMORY_BLOCK_SIZE; ++ u64 memblock_size = MIN_MEMORY_BLOCK_SIZE; + struct resource r; + + np = of_find_node_by_path("/ibm,dynamic-reconfiguration-memory"); +diff --git a/arch/sh/boards/mach-landisk/setup.c b/arch/sh/boards/mach-landisk/setup.c +index 16b4d8b0bb850..2c44b94f82fb2 100644 +--- a/arch/sh/boards/mach-landisk/setup.c ++++ b/arch/sh/boards/mach-landisk/setup.c +@@ -82,6 +82,9 @@ device_initcall(landisk_devices_setup); + + static void __init landisk_setup(char **cmdline_p) + { ++ /* I/O port identity mapping */ ++ __set_io_port_base(0); ++ + /* LED ON */ + __raw_writeb(__raw_readb(PA_LED) | 0x03, PA_LED); + +diff --git a/arch/x86/events/rapl.c b/arch/x86/events/rapl.c +index 3c222d6fdee3b..187c72a58e69c 100644 +--- a/arch/x86/events/rapl.c ++++ b/arch/x86/events/rapl.c +@@ -642,7 +642,7 @@ static const struct attribute_group *rapl_attr_update[] = { + &rapl_events_pkg_group, + &rapl_events_ram_group, + &rapl_events_gpu_group, +- &rapl_events_gpu_group, ++ &rapl_events_psys_group, + NULL, + }; + +diff --git a/arch/x86/kernel/apic/vector.c b/arch/x86/kernel/apic/vector.c +index df4d5385e6ddd..c8203694d9ce4 100644 +--- a/arch/x86/kernel/apic/vector.c ++++ b/arch/x86/kernel/apic/vector.c +@@ -554,6 +554,10 @@ static int x86_vector_alloc_irqs(struct irq_domain *domain, unsigned int virq, + irqd->chip_data = apicd; + irqd->hwirq = virq + i; + irqd_set_single_target(irqd); ++ ++ /* Don't invoke affinity setter on deactivated interrupts */ ++ irqd_set_affinity_on_activate(irqd); ++ + /* + * Legacy vectors are already assigned when the IOAPIC + * takes them over. They stay on the same vector. This is +diff --git a/arch/x86/kernel/tsc_msr.c b/arch/x86/kernel/tsc_msr.c +index c65adaf813848..41200706e6da1 100644 +--- a/arch/x86/kernel/tsc_msr.c ++++ b/arch/x86/kernel/tsc_msr.c +@@ -133,10 +133,15 @@ static const struct freq_desc freq_desc_ann = { + .mask = 0x0f, + }; + +-/* 24 MHz crystal? : 24 * 13 / 4 = 78 MHz */ ++/* ++ * 24 MHz crystal? : 24 * 13 / 4 = 78 MHz ++ * Frequency step for Lightning Mountain SoC is fixed to 78 MHz, ++ * so all the frequency entries are 78000. ++ */ + static const struct freq_desc freq_desc_lgm = { + .use_msr_plat = true, +- .freqs = { 78000, 78000, 78000, 78000, 78000, 78000, 78000, 78000 }, ++ .freqs = { 78000, 78000, 78000, 78000, 78000, 78000, 78000, 78000, ++ 78000, 78000, 78000, 78000, 78000, 78000, 78000, 78000 }, + .mask = 0x0f, + }; + +diff --git a/arch/xtensa/include/asm/thread_info.h b/arch/xtensa/include/asm/thread_info.h +index f092cc3f4e66d..956d4d47c6cd1 100644 +--- a/arch/xtensa/include/asm/thread_info.h ++++ b/arch/xtensa/include/asm/thread_info.h +@@ -55,6 +55,10 @@ struct thread_info { + mm_segment_t addr_limit; /* thread address space */ + + unsigned long cpenable; ++#if XCHAL_HAVE_EXCLUSIVE ++ /* result of the most recent exclusive store */ ++ unsigned long atomctl8; ++#endif + + /* Allocate storage for extra user states and coprocessor states. */ + #if XTENSA_HAVE_COPROCESSORS +diff --git a/arch/xtensa/kernel/asm-offsets.c b/arch/xtensa/kernel/asm-offsets.c +index 33a257b33723a..dc5c83cad9be8 100644 +--- a/arch/xtensa/kernel/asm-offsets.c ++++ b/arch/xtensa/kernel/asm-offsets.c +@@ -93,6 +93,9 @@ int main(void) + DEFINE(THREAD_RA, offsetof (struct task_struct, thread.ra)); + DEFINE(THREAD_SP, offsetof (struct task_struct, thread.sp)); + DEFINE(THREAD_CPENABLE, offsetof (struct thread_info, cpenable)); ++#if XCHAL_HAVE_EXCLUSIVE ++ DEFINE(THREAD_ATOMCTL8, offsetof (struct thread_info, atomctl8)); ++#endif + #if XTENSA_HAVE_COPROCESSORS + DEFINE(THREAD_XTREGS_CP0, offsetof(struct thread_info, xtregs_cp.cp0)); + DEFINE(THREAD_XTREGS_CP1, offsetof(struct thread_info, xtregs_cp.cp1)); +diff --git a/arch/xtensa/kernel/entry.S b/arch/xtensa/kernel/entry.S +index 9e3676879168a..59671603c9c62 100644 +--- a/arch/xtensa/kernel/entry.S ++++ b/arch/xtensa/kernel/entry.S +@@ -374,6 +374,11 @@ common_exception: + s32i a2, a1, PT_LCOUNT + #endif + ++#if XCHAL_HAVE_EXCLUSIVE ++ /* Clear exclusive access monitor set by interrupted code */ ++ clrex ++#endif ++ + /* It is now save to restore the EXC_TABLE_FIXUP variable. */ + + rsr a2, exccause +@@ -2024,6 +2029,12 @@ ENTRY(_switch_to) + s32i a3, a4, THREAD_CPENABLE + #endif + ++#if XCHAL_HAVE_EXCLUSIVE ++ l32i a3, a5, THREAD_ATOMCTL8 ++ getex a3 ++ s32i a3, a4, THREAD_ATOMCTL8 ++#endif ++ + /* Flush register file. */ + + spill_registers_kernel +diff --git a/arch/xtensa/kernel/perf_event.c b/arch/xtensa/kernel/perf_event.c +index 9bae79f703013..86c9ba9631551 100644 +--- a/arch/xtensa/kernel/perf_event.c ++++ b/arch/xtensa/kernel/perf_event.c +@@ -401,7 +401,7 @@ static struct pmu xtensa_pmu = { + .read = xtensa_pmu_read, + }; + +-static int xtensa_pmu_setup(int cpu) ++static int xtensa_pmu_setup(unsigned int cpu) + { + unsigned i; + +diff --git a/crypto/af_alg.c b/crypto/af_alg.c +index a3b9df99af6de..35e026ba2c7ed 100644 +--- a/crypto/af_alg.c ++++ b/crypto/af_alg.c +@@ -635,6 +635,7 @@ void af_alg_pull_tsgl(struct sock *sk, size_t used, struct scatterlist *dst, + + if (!ctx->used) + ctx->merge = 0; ++ ctx->init = ctx->more; + } + EXPORT_SYMBOL_GPL(af_alg_pull_tsgl); + +@@ -734,9 +735,10 @@ EXPORT_SYMBOL_GPL(af_alg_wmem_wakeup); + * + * @sk socket of connection to user space + * @flags If MSG_DONTWAIT is set, then only report if function would sleep ++ * @min Set to minimum request size if partial requests are allowed. + * @return 0 when writable memory is available, < 0 upon error + */ +-int af_alg_wait_for_data(struct sock *sk, unsigned flags) ++int af_alg_wait_for_data(struct sock *sk, unsigned flags, unsigned min) + { + DEFINE_WAIT_FUNC(wait, woken_wake_function); + struct alg_sock *ask = alg_sk(sk); +@@ -754,7 +756,9 @@ int af_alg_wait_for_data(struct sock *sk, unsigned flags) + if (signal_pending(current)) + break; + timeout = MAX_SCHEDULE_TIMEOUT; +- if (sk_wait_event(sk, &timeout, (ctx->used || !ctx->more), ++ if (sk_wait_event(sk, &timeout, ++ ctx->init && (!ctx->more || ++ (min && ctx->used >= min)), + &wait)) { + err = 0; + break; +@@ -843,10 +847,11 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size, + } + + lock_sock(sk); +- if (!ctx->more && ctx->used) { ++ if (ctx->init && (init || !ctx->more)) { + err = -EINVAL; + goto unlock; + } ++ ctx->init = true; + + if (init) { + ctx->enc = enc; +diff --git a/crypto/algif_aead.c b/crypto/algif_aead.c +index 0ae000a61c7f5..43c6aa784858b 100644 +--- a/crypto/algif_aead.c ++++ b/crypto/algif_aead.c +@@ -106,8 +106,8 @@ static int _aead_recvmsg(struct socket *sock, struct msghdr *msg, + size_t usedpages = 0; /* [in] RX bufs to be used from user */ + size_t processed = 0; /* [in] TX bufs to be consumed */ + +- if (!ctx->used) { +- err = af_alg_wait_for_data(sk, flags); ++ if (!ctx->init || ctx->more) { ++ err = af_alg_wait_for_data(sk, flags, 0); + if (err) + return err; + } +@@ -558,12 +558,6 @@ static int aead_accept_parent_nokey(void *private, struct sock *sk) + + INIT_LIST_HEAD(&ctx->tsgl_list); + ctx->len = len; +- ctx->used = 0; +- atomic_set(&ctx->rcvused, 0); +- ctx->more = 0; +- ctx->merge = 0; +- ctx->enc = 0; +- ctx->aead_assoclen = 0; + crypto_init_wait(&ctx->wait); + + ask->private = ctx; +diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c +index ec5567c87a6df..81c4022285a7c 100644 +--- a/crypto/algif_skcipher.c ++++ b/crypto/algif_skcipher.c +@@ -61,8 +61,8 @@ static int _skcipher_recvmsg(struct socket *sock, struct msghdr *msg, + int err = 0; + size_t len = 0; + +- if (!ctx->used) { +- err = af_alg_wait_for_data(sk, flags); ++ if (!ctx->init || (ctx->more && ctx->used < bs)) { ++ err = af_alg_wait_for_data(sk, flags, bs); + if (err) + return err; + } +@@ -333,6 +333,7 @@ static int skcipher_accept_parent_nokey(void *private, struct sock *sk) + ctx = sock_kmalloc(sk, len, GFP_KERNEL); + if (!ctx) + return -ENOMEM; ++ memset(ctx, 0, len); + + ctx->iv = sock_kmalloc(sk, crypto_skcipher_ivsize(tfm), + GFP_KERNEL); +@@ -340,16 +341,10 @@ static int skcipher_accept_parent_nokey(void *private, struct sock *sk) + sock_kfree_s(sk, ctx, len); + return -ENOMEM; + } +- + memset(ctx->iv, 0, crypto_skcipher_ivsize(tfm)); + + INIT_LIST_HEAD(&ctx->tsgl_list); + ctx->len = len; +- ctx->used = 0; +- atomic_set(&ctx->rcvused, 0); +- ctx->more = 0; +- ctx->merge = 0; +- ctx->enc = 0; + crypto_init_wait(&ctx->wait); + + ask->private = ctx; +diff --git a/drivers/base/dd.c b/drivers/base/dd.c +index b25bcab2a26bd..1d5dd37f3abe4 100644 +--- a/drivers/base/dd.c ++++ b/drivers/base/dd.c +@@ -872,7 +872,9 @@ static int __device_attach(struct device *dev, bool allow_async) + int ret = 0; + + device_lock(dev); +- if (dev->driver) { ++ if (dev->p->dead) { ++ goto out_unlock; ++ } else if (dev->driver) { + if (device_is_bound(dev)) { + ret = 1; + goto out_unlock; +diff --git a/drivers/clk/actions/owl-s500.c b/drivers/clk/actions/owl-s500.c +index e2007ac4d235d..0eb83a0b70bcc 100644 +--- a/drivers/clk/actions/owl-s500.c ++++ b/drivers/clk/actions/owl-s500.c +@@ -183,7 +183,7 @@ static OWL_GATE(timer_clk, "timer_clk", "hosc", CMU_DEVCLKEN1, 27, 0, 0); + static OWL_GATE(hdmi_clk, "hdmi_clk", "hosc", CMU_DEVCLKEN1, 3, 0, 0); + + /* divider clocks */ +-static OWL_DIVIDER(h_clk, "h_clk", "ahbprevdiv_clk", CMU_BUSCLK1, 12, 2, NULL, 0, 0); ++static OWL_DIVIDER(h_clk, "h_clk", "ahbprediv_clk", CMU_BUSCLK1, 12, 2, NULL, 0, 0); + static OWL_DIVIDER(rmii_ref_clk, "rmii_ref_clk", "ethernet_pll_clk", CMU_ETHERNETPLL, 1, 1, rmii_ref_div_table, 0, 0); + + /* factor clocks */ +diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c +index 6e5d635f030f4..45420b514149f 100644 +--- a/drivers/clk/bcm/clk-bcm2835.c ++++ b/drivers/clk/bcm/clk-bcm2835.c +@@ -314,6 +314,7 @@ struct bcm2835_cprman { + struct device *dev; + void __iomem *regs; + spinlock_t regs_lock; /* spinlock for all clocks */ ++ unsigned int soc; + + /* + * Real names of cprman clock parents looked up through +@@ -525,6 +526,20 @@ static int bcm2835_pll_is_on(struct clk_hw *hw) + A2W_PLL_CTRL_PRST_DISABLE; + } + ++static u32 bcm2835_pll_get_prediv_mask(struct bcm2835_cprman *cprman, ++ const struct bcm2835_pll_data *data) ++{ ++ /* ++ * On BCM2711 there isn't a pre-divisor available in the PLL feedback ++ * loop. Bits 13:14 of ANA1 (PLLA,PLLB,PLLC,PLLD) have been re-purposed ++ * for to for VCO RANGE bits. ++ */ ++ if (cprman->soc & SOC_BCM2711) ++ return 0; ++ ++ return data->ana->fb_prediv_mask; ++} ++ + static void bcm2835_pll_choose_ndiv_and_fdiv(unsigned long rate, + unsigned long parent_rate, + u32 *ndiv, u32 *fdiv) +@@ -582,7 +597,7 @@ static unsigned long bcm2835_pll_get_rate(struct clk_hw *hw, + ndiv = (a2wctrl & A2W_PLL_CTRL_NDIV_MASK) >> A2W_PLL_CTRL_NDIV_SHIFT; + pdiv = (a2wctrl & A2W_PLL_CTRL_PDIV_MASK) >> A2W_PLL_CTRL_PDIV_SHIFT; + using_prediv = cprman_read(cprman, data->ana_reg_base + 4) & +- data->ana->fb_prediv_mask; ++ bcm2835_pll_get_prediv_mask(cprman, data); + + if (using_prediv) { + ndiv *= 2; +@@ -665,6 +680,7 @@ static int bcm2835_pll_set_rate(struct clk_hw *hw, + struct bcm2835_pll *pll = container_of(hw, struct bcm2835_pll, hw); + struct bcm2835_cprman *cprman = pll->cprman; + const struct bcm2835_pll_data *data = pll->data; ++ u32 prediv_mask = bcm2835_pll_get_prediv_mask(cprman, data); + bool was_using_prediv, use_fb_prediv, do_ana_setup_first; + u32 ndiv, fdiv, a2w_ctl; + u32 ana[4]; +@@ -682,7 +698,7 @@ static int bcm2835_pll_set_rate(struct clk_hw *hw, + for (i = 3; i >= 0; i--) + ana[i] = cprman_read(cprman, data->ana_reg_base + i * 4); + +- was_using_prediv = ana[1] & data->ana->fb_prediv_mask; ++ was_using_prediv = ana[1] & prediv_mask; + + ana[0] &= ~data->ana->mask0; + ana[0] |= data->ana->set0; +@@ -692,10 +708,10 @@ static int bcm2835_pll_set_rate(struct clk_hw *hw, + ana[3] |= data->ana->set3; + + if (was_using_prediv && !use_fb_prediv) { +- ana[1] &= ~data->ana->fb_prediv_mask; ++ ana[1] &= ~prediv_mask; + do_ana_setup_first = true; + } else if (!was_using_prediv && use_fb_prediv) { +- ana[1] |= data->ana->fb_prediv_mask; ++ ana[1] |= prediv_mask; + do_ana_setup_first = false; + } else { + do_ana_setup_first = true; +@@ -2234,6 +2250,7 @@ static int bcm2835_clk_probe(struct platform_device *pdev) + platform_set_drvdata(pdev, cprman); + + cprman->onecell.num = asize; ++ cprman->soc = pdata->soc; + hws = cprman->onecell.hws; + + for (i = 0; i < asize; i++) { +diff --git a/drivers/clk/qcom/clk-alpha-pll.c b/drivers/clk/qcom/clk-alpha-pll.c +index 055318f979915..a69f53e435ed5 100644 +--- a/drivers/clk/qcom/clk-alpha-pll.c ++++ b/drivers/clk/qcom/clk-alpha-pll.c +@@ -55,7 +55,6 @@ + #define PLL_STATUS(p) ((p)->offset + (p)->regs[PLL_OFF_STATUS]) + #define PLL_OPMODE(p) ((p)->offset + (p)->regs[PLL_OFF_OPMODE]) + #define PLL_FRAC(p) ((p)->offset + (p)->regs[PLL_OFF_FRAC]) +-#define PLL_CAL_VAL(p) ((p)->offset + (p)->regs[PLL_OFF_CAL_VAL]) + + const u8 clk_alpha_pll_regs[][PLL_OFF_MAX_REGS] = { + [CLK_ALPHA_PLL_TYPE_DEFAULT] = { +@@ -114,7 +113,6 @@ const u8 clk_alpha_pll_regs[][PLL_OFF_MAX_REGS] = { + [PLL_OFF_STATUS] = 0x30, + [PLL_OFF_OPMODE] = 0x38, + [PLL_OFF_ALPHA_VAL] = 0x40, +- [PLL_OFF_CAL_VAL] = 0x44, + }, + }; + EXPORT_SYMBOL_GPL(clk_alpha_pll_regs); +diff --git a/drivers/clk/qcom/gcc-sdm660.c b/drivers/clk/qcom/gcc-sdm660.c +index bf5730832ef3d..c6fb57cd576f5 100644 +--- a/drivers/clk/qcom/gcc-sdm660.c ++++ b/drivers/clk/qcom/gcc-sdm660.c +@@ -1715,6 +1715,9 @@ static struct clk_branch gcc_mss_cfg_ahb_clk = { + + static struct clk_branch gcc_mss_mnoc_bimc_axi_clk = { + .halt_reg = 0x8a004, ++ .halt_check = BRANCH_HALT, ++ .hwcg_reg = 0x8a004, ++ .hwcg_bit = 1, + .clkr = { + .enable_reg = 0x8a004, + .enable_mask = BIT(0), +diff --git a/drivers/clk/qcom/gcc-sm8150.c b/drivers/clk/qcom/gcc-sm8150.c +index fad42897a7a7f..ee908fbfeab17 100644 +--- a/drivers/clk/qcom/gcc-sm8150.c ++++ b/drivers/clk/qcom/gcc-sm8150.c +@@ -1616,6 +1616,7 @@ static struct clk_branch gcc_gpu_cfg_ahb_clk = { + }; + + static struct clk_branch gcc_gpu_gpll0_clk_src = { ++ .halt_check = BRANCH_HALT_SKIP, + .clkr = { + .enable_reg = 0x52004, + .enable_mask = BIT(15), +@@ -1631,13 +1632,14 @@ static struct clk_branch gcc_gpu_gpll0_clk_src = { + }; + + static struct clk_branch gcc_gpu_gpll0_div_clk_src = { ++ .halt_check = BRANCH_HALT_SKIP, + .clkr = { + .enable_reg = 0x52004, + .enable_mask = BIT(16), + .hw.init = &(struct clk_init_data){ + .name = "gcc_gpu_gpll0_div_clk_src", + .parent_hws = (const struct clk_hw *[]){ +- &gcc_gpu_gpll0_clk_src.clkr.hw }, ++ &gpll0_out_even.clkr.hw }, + .num_parents = 1, + .flags = CLK_SET_RATE_PARENT, + .ops = &clk_branch2_ops, +@@ -1728,6 +1730,7 @@ static struct clk_branch gcc_npu_cfg_ahb_clk = { + }; + + static struct clk_branch gcc_npu_gpll0_clk_src = { ++ .halt_check = BRANCH_HALT_SKIP, + .clkr = { + .enable_reg = 0x52004, + .enable_mask = BIT(18), +@@ -1743,13 +1746,14 @@ static struct clk_branch gcc_npu_gpll0_clk_src = { + }; + + static struct clk_branch gcc_npu_gpll0_div_clk_src = { ++ .halt_check = BRANCH_HALT_SKIP, + .clkr = { + .enable_reg = 0x52004, + .enable_mask = BIT(19), + .hw.init = &(struct clk_init_data){ + .name = "gcc_npu_gpll0_div_clk_src", + .parent_hws = (const struct clk_hw *[]){ +- &gcc_npu_gpll0_clk_src.clkr.hw }, ++ &gpll0_out_even.clkr.hw }, + .num_parents = 1, + .flags = CLK_SET_RATE_PARENT, + .ops = &clk_branch2_ops, +diff --git a/drivers/clk/sirf/clk-atlas6.c b/drivers/clk/sirf/clk-atlas6.c +index c84d5bab7ac28..b95483bb6a5ec 100644 +--- a/drivers/clk/sirf/clk-atlas6.c ++++ b/drivers/clk/sirf/clk-atlas6.c +@@ -135,7 +135,7 @@ static void __init atlas6_clk_init(struct device_node *np) + + for (i = pll1; i < maxclk; i++) { + atlas6_clks[i] = clk_register(NULL, atlas6_clk_hw_array[i]); +- BUG_ON(!atlas6_clks[i]); ++ BUG_ON(IS_ERR(atlas6_clks[i])); + } + clk_register_clkdev(atlas6_clks[cpu], NULL, "cpu"); + clk_register_clkdev(atlas6_clks[io], NULL, "io"); +diff --git a/drivers/crypto/caam/caamalg.c b/drivers/crypto/caam/caamalg.c +index 4ce9c2b4544a2..fdd994ee55e22 100644 +--- a/drivers/crypto/caam/caamalg.c ++++ b/drivers/crypto/caam/caamalg.c +@@ -818,12 +818,6 @@ static int ctr_skcipher_setkey(struct crypto_skcipher *skcipher, + return skcipher_setkey(skcipher, key, keylen, ctx1_iv_off); + } + +-static int arc4_skcipher_setkey(struct crypto_skcipher *skcipher, +- const u8 *key, unsigned int keylen) +-{ +- return skcipher_setkey(skcipher, key, keylen, 0); +-} +- + static int des_skcipher_setkey(struct crypto_skcipher *skcipher, + const u8 *key, unsigned int keylen) + { +@@ -2058,21 +2052,6 @@ static struct caam_skcipher_alg driver_algs[] = { + }, + .caam.class1_alg_type = OP_ALG_ALGSEL_3DES | OP_ALG_AAI_ECB, + }, +- { +- .skcipher = { +- .base = { +- .cra_name = "ecb(arc4)", +- .cra_driver_name = "ecb-arc4-caam", +- .cra_blocksize = ARC4_BLOCK_SIZE, +- }, +- .setkey = arc4_skcipher_setkey, +- .encrypt = skcipher_encrypt, +- .decrypt = skcipher_decrypt, +- .min_keysize = ARC4_MIN_KEY_SIZE, +- .max_keysize = ARC4_MAX_KEY_SIZE, +- }, +- .caam.class1_alg_type = OP_ALG_ALGSEL_ARC4 | OP_ALG_AAI_ECB, +- }, + }; + + static struct caam_aead_alg driver_aeads[] = { +@@ -3533,7 +3512,6 @@ int caam_algapi_init(struct device *ctrldev) + struct caam_drv_private *priv = dev_get_drvdata(ctrldev); + int i = 0, err = 0; + u32 aes_vid, aes_inst, des_inst, md_vid, md_inst, ccha_inst, ptha_inst; +- u32 arc4_inst; + unsigned int md_limit = SHA512_DIGEST_SIZE; + bool registered = false, gcm_support; + +@@ -3553,8 +3531,6 @@ int caam_algapi_init(struct device *ctrldev) + CHA_ID_LS_DES_SHIFT; + aes_inst = cha_inst & CHA_ID_LS_AES_MASK; + md_inst = (cha_inst & CHA_ID_LS_MD_MASK) >> CHA_ID_LS_MD_SHIFT; +- arc4_inst = (cha_inst & CHA_ID_LS_ARC4_MASK) >> +- CHA_ID_LS_ARC4_SHIFT; + ccha_inst = 0; + ptha_inst = 0; + +@@ -3575,7 +3551,6 @@ int caam_algapi_init(struct device *ctrldev) + md_inst = mdha & CHA_VER_NUM_MASK; + ccha_inst = rd_reg32(&priv->ctrl->vreg.ccha) & CHA_VER_NUM_MASK; + ptha_inst = rd_reg32(&priv->ctrl->vreg.ptha) & CHA_VER_NUM_MASK; +- arc4_inst = rd_reg32(&priv->ctrl->vreg.afha) & CHA_VER_NUM_MASK; + + gcm_support = aesa & CHA_VER_MISC_AES_GCM; + } +@@ -3598,10 +3573,6 @@ int caam_algapi_init(struct device *ctrldev) + if (!aes_inst && (alg_sel == OP_ALG_ALGSEL_AES)) + continue; + +- /* Skip ARC4 algorithms if not supported by device */ +- if (!arc4_inst && alg_sel == OP_ALG_ALGSEL_ARC4) +- continue; +- + /* + * Check support for AES modes not available + * on LP devices. +diff --git a/drivers/crypto/caam/compat.h b/drivers/crypto/caam/compat.h +index 60e2a54c19f11..c3c22a8de4c00 100644 +--- a/drivers/crypto/caam/compat.h ++++ b/drivers/crypto/caam/compat.h +@@ -43,7 +43,6 @@ + #include + #include + #include +-#include + #include + #include + #include +diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn10/rv1_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn10/rv1_clk_mgr.c +index 47f529ce280ae..2718396083ee4 100644 +--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn10/rv1_clk_mgr.c ++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn10/rv1_clk_mgr.c +@@ -85,12 +85,77 @@ static int rv1_determine_dppclk_threshold(struct clk_mgr_internal *clk_mgr, stru + return disp_clk_threshold; + } + +-static void ramp_up_dispclk_with_dpp(struct clk_mgr_internal *clk_mgr, struct dc *dc, struct dc_clocks *new_clocks) ++static void ramp_up_dispclk_with_dpp( ++ struct clk_mgr_internal *clk_mgr, ++ struct dc *dc, ++ struct dc_clocks *new_clocks, ++ bool safe_to_lower) + { + int i; + int dispclk_to_dpp_threshold = rv1_determine_dppclk_threshold(clk_mgr, new_clocks); + bool request_dpp_div = new_clocks->dispclk_khz > new_clocks->dppclk_khz; + ++ /* this function is to change dispclk, dppclk and dprefclk according to ++ * bandwidth requirement. Its call stack is rv1_update_clocks --> ++ * update_clocks --> dcn10_prepare_bandwidth / dcn10_optimize_bandwidth ++ * --> prepare_bandwidth / optimize_bandwidth. before change dcn hw, ++ * prepare_bandwidth will be called first to allow enough clock, ++ * watermark for change, after end of dcn hw change, optimize_bandwidth ++ * is executed to lower clock to save power for new dcn hw settings. ++ * ++ * below is sequence of commit_planes_for_stream: ++ * ++ * step 1: prepare_bandwidth - raise clock to have enough bandwidth ++ * step 2: lock_doublebuffer_enable ++ * step 3: pipe_control_lock(true) - make dchubp register change will ++ * not take effect right way ++ * step 4: apply_ctx_for_surface - program dchubp ++ * step 5: pipe_control_lock(false) - dchubp register change take effect ++ * step 6: optimize_bandwidth --> dc_post_update_surfaces_to_stream ++ * for full_date, optimize clock to save power ++ * ++ * at end of step 1, dcn clocks (dprefclk, dispclk, dppclk) may be ++ * changed for new dchubp configuration. but real dcn hub dchubps are ++ * still running with old configuration until end of step 5. this need ++ * clocks settings at step 1 should not less than that before step 1. ++ * this is checked by two conditions: 1. if (should_set_clock(safe_to_lower ++ * , new_clocks->dispclk_khz, clk_mgr_base->clks.dispclk_khz) || ++ * new_clocks->dispclk_khz == clk_mgr_base->clks.dispclk_khz) ++ * 2. request_dpp_div = new_clocks->dispclk_khz > new_clocks->dppclk_khz ++ * ++ * the second condition is based on new dchubp configuration. dppclk ++ * for new dchubp may be different from dppclk before step 1. ++ * for example, before step 1, dchubps are as below: ++ * pipe 0: recout=(0,40,1920,980) viewport=(0,0,1920,979) ++ * pipe 1: recout=(0,0,1920,1080) viewport=(0,0,1920,1080) ++ * for dppclk for pipe0 need dppclk = dispclk ++ * ++ * new dchubp pipe split configuration: ++ * pipe 0: recout=(0,0,960,1080) viewport=(0,0,960,1080) ++ * pipe 1: recout=(960,0,960,1080) viewport=(960,0,960,1080) ++ * dppclk only needs dppclk = dispclk /2. ++ * ++ * dispclk, dppclk are not lock by otg master lock. they take effect ++ * after step 1. during this transition, dispclk are the same, but ++ * dppclk is changed to half of previous clock for old dchubp ++ * configuration between step 1 and step 6. This may cause p-state ++ * warning intermittently. ++ * ++ * for new_clocks->dispclk_khz == clk_mgr_base->clks.dispclk_khz, we ++ * need make sure dppclk are not changed to less between step 1 and 6. ++ * for new_clocks->dispclk_khz > clk_mgr_base->clks.dispclk_khz, ++ * new display clock is raised, but we do not know ratio of ++ * new_clocks->dispclk_khz and clk_mgr_base->clks.dispclk_khz, ++ * new_clocks->dispclk_khz /2 does not guarantee equal or higher than ++ * old dppclk. we could ignore power saving different between ++ * dppclk = displck and dppclk = dispclk / 2 between step 1 and step 6. ++ * as long as safe_to_lower = false, set dpclk = dispclk to simplify ++ * condition check. ++ * todo: review this change for other asic. ++ **/ ++ if (!safe_to_lower) ++ request_dpp_div = false; ++ + /* set disp clk to dpp clk threshold */ + + clk_mgr->funcs->set_dispclk(clk_mgr, dispclk_to_dpp_threshold); +@@ -206,7 +271,7 @@ static void rv1_update_clocks(struct clk_mgr *clk_mgr_base, + /* program dispclk on = as a w/a for sleep resume clock ramping issues */ + if (should_set_clock(safe_to_lower, new_clocks->dispclk_khz, clk_mgr_base->clks.dispclk_khz) + || new_clocks->dispclk_khz == clk_mgr_base->clks.dispclk_khz) { +- ramp_up_dispclk_with_dpp(clk_mgr, dc, new_clocks); ++ ramp_up_dispclk_with_dpp(clk_mgr, dc, new_clocks, safe_to_lower); + clk_mgr_base->clks.dispclk_khz = new_clocks->dispclk_khz; + send_request_to_lower = true; + } +diff --git a/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c b/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c +index 2e71ca3e19f58..09a3d8ae44491 100644 +--- a/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c ++++ b/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c +@@ -2725,7 +2725,10 @@ static int ci_initialize_mc_reg_table(struct pp_hwmgr *hwmgr) + + static bool ci_is_dpm_running(struct pp_hwmgr *hwmgr) + { +- return ci_is_smc_ram_running(hwmgr); ++ return (1 == PHM_READ_INDIRECT_FIELD(hwmgr->device, ++ CGS_IND_REG__SMC, FEATURE_STATUS, ++ VOLTAGE_CONTROLLER_ON)) ++ ? true : false; + } + + static int ci_smu_init(struct pp_hwmgr *hwmgr) +diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c +index 006d6087700fb..2de1eebe591f9 100644 +--- a/drivers/gpu/drm/drm_dp_mst_topology.c ++++ b/drivers/gpu/drm/drm_dp_mst_topology.c +@@ -3369,11 +3369,11 @@ bool drm_dp_mst_allocate_vcpi(struct drm_dp_mst_topology_mgr *mgr, + { + int ret; + +- port = drm_dp_mst_topology_get_port_validated(mgr, port); +- if (!port) ++ if (slots < 0) + return false; + +- if (slots < 0) ++ port = drm_dp_mst_topology_get_port_validated(mgr, port); ++ if (!port) + return false; + + if (port->vcpi.vcpi > 0) { +@@ -3389,6 +3389,7 @@ bool drm_dp_mst_allocate_vcpi(struct drm_dp_mst_topology_mgr *mgr, + if (ret) { + DRM_DEBUG_KMS("failed to init vcpi slots=%d max=63 ret=%d\n", + DIV_ROUND_UP(pbn, mgr->pbn_div), ret); ++ drm_dp_mst_topology_put_port(port); + goto out; + } + DRM_DEBUG_KMS("initing vcpi for pbn=%d slots=%d\n", +diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c +index d00ea384dcbfe..58f5dc2f6dd52 100644 +--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c ++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c +@@ -121,6 +121,12 @@ static const struct dmi_system_id orientation_data[] = { + DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T101HA"), + }, + .driver_data = (void *)&lcd800x1280_rightside_up, ++ }, { /* Asus T103HAF */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T103HAF"), ++ }, ++ .driver_data = (void *)&lcd800x1280_rightside_up, + }, { /* GPD MicroPC (generic strings, also match on bios date) */ + .matches = { + DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Default string"), +diff --git a/drivers/gpu/drm/imx/imx-ldb.c b/drivers/gpu/drm/imx/imx-ldb.c +index 9af5a08d5490f..d6629fc869f3f 100644 +--- a/drivers/gpu/drm/imx/imx-ldb.c ++++ b/drivers/gpu/drm/imx/imx-ldb.c +@@ -302,18 +302,19 @@ static void imx_ldb_encoder_disable(struct drm_encoder *encoder) + { + struct imx_ldb_channel *imx_ldb_ch = enc_to_imx_ldb_ch(encoder); + struct imx_ldb *ldb = imx_ldb_ch->ldb; ++ int dual = ldb->ldb_ctrl & LDB_SPLIT_MODE_EN; + int mux, ret; + + drm_panel_disable(imx_ldb_ch->panel); + +- if (imx_ldb_ch == &ldb->channel[0]) ++ if (imx_ldb_ch == &ldb->channel[0] || dual) + ldb->ldb_ctrl &= ~LDB_CH0_MODE_EN_MASK; +- else if (imx_ldb_ch == &ldb->channel[1]) ++ if (imx_ldb_ch == &ldb->channel[1] || dual) + ldb->ldb_ctrl &= ~LDB_CH1_MODE_EN_MASK; + + regmap_write(ldb->regmap, IOMUXC_GPR2, ldb->ldb_ctrl); + +- if (ldb->ldb_ctrl & LDB_SPLIT_MODE_EN) { ++ if (dual) { + clk_disable_unprepare(ldb->clk[0]); + clk_disable_unprepare(ldb->clk[1]); + } +diff --git a/drivers/gpu/drm/panfrost/panfrost_gem.c b/drivers/gpu/drm/panfrost/panfrost_gem.c +index 77c3a3855c682..c05e013bb8e3d 100644 +--- a/drivers/gpu/drm/panfrost/panfrost_gem.c ++++ b/drivers/gpu/drm/panfrost/panfrost_gem.c +@@ -46,7 +46,7 @@ static void panfrost_gem_free_object(struct drm_gem_object *obj) + sg_free_table(&bo->sgts[i]); + } + } +- kfree(bo->sgts); ++ kvfree(bo->sgts); + } + + drm_gem_shmem_free_object(obj); +diff --git a/drivers/gpu/drm/panfrost/panfrost_mmu.c b/drivers/gpu/drm/panfrost/panfrost_mmu.c +index 5d75f8cf64776..3dc9b30a64b01 100644 +--- a/drivers/gpu/drm/panfrost/panfrost_mmu.c ++++ b/drivers/gpu/drm/panfrost/panfrost_mmu.c +@@ -486,7 +486,7 @@ static int panfrost_mmu_map_fault_addr(struct panfrost_device *pfdev, int as, + pages = kvmalloc_array(bo->base.base.size >> PAGE_SHIFT, + sizeof(struct page *), GFP_KERNEL | __GFP_ZERO); + if (!pages) { +- kfree(bo->sgts); ++ kvfree(bo->sgts); + bo->sgts = NULL; + mutex_unlock(&bo->base.pages_lock); + ret = -ENOMEM; +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c +index f47d5710cc951..33b1519887474 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c +@@ -2666,7 +2666,7 @@ int vmw_kms_fbdev_init_data(struct vmw_private *dev_priv, + ++i; + } + +- if (i != unit) { ++ if (&con->head == &dev_priv->dev->mode_config.connector_list) { + DRM_ERROR("Could not find initial display unit.\n"); + ret = -EINVAL; + goto out_unlock; +@@ -2690,13 +2690,13 @@ int vmw_kms_fbdev_init_data(struct vmw_private *dev_priv, + break; + } + +- if (mode->type & DRM_MODE_TYPE_PREFERRED) +- *p_mode = mode; +- else { ++ if (&mode->head == &con->modes) { + WARN_ONCE(true, "Could not find initial preferred mode.\n"); + *p_mode = list_first_entry(&con->modes, + struct drm_display_mode, + head); ++ } else { ++ *p_mode = mode; + } + + out_unlock: +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c b/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c +index 5702219ec38f6..7b54c1f56208f 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c +@@ -81,7 +81,7 @@ static int vmw_ldu_commit_list(struct vmw_private *dev_priv) + struct vmw_legacy_display_unit *entry; + struct drm_framebuffer *fb = NULL; + struct drm_crtc *crtc = NULL; +- int i = 0; ++ int i; + + /* If there is no display topology the host just assumes + * that the guest will set the same layout as the host. +@@ -92,12 +92,11 @@ static int vmw_ldu_commit_list(struct vmw_private *dev_priv) + crtc = &entry->base.crtc; + w = max(w, crtc->x + crtc->mode.hdisplay); + h = max(h, crtc->y + crtc->mode.vdisplay); +- i++; + } + + if (crtc == NULL) + return 0; +- fb = entry->base.crtc.primary->state->fb; ++ fb = crtc->primary->state->fb; + + return vmw_kms_write_svga(dev_priv, w, h, fb->pitches[0], + fb->format->cpp[0] * 8, +diff --git a/drivers/gpu/ipu-v3/ipu-image-convert.c b/drivers/gpu/ipu-v3/ipu-image-convert.c +index eeca50d9a1ee4..aa1d4b6d278f7 100644 +--- a/drivers/gpu/ipu-v3/ipu-image-convert.c ++++ b/drivers/gpu/ipu-v3/ipu-image-convert.c +@@ -137,6 +137,17 @@ struct ipu_image_convert_ctx; + struct ipu_image_convert_chan; + struct ipu_image_convert_priv; + ++enum eof_irq_mask { ++ EOF_IRQ_IN = BIT(0), ++ EOF_IRQ_ROT_IN = BIT(1), ++ EOF_IRQ_OUT = BIT(2), ++ EOF_IRQ_ROT_OUT = BIT(3), ++}; ++ ++#define EOF_IRQ_COMPLETE (EOF_IRQ_IN | EOF_IRQ_OUT) ++#define EOF_IRQ_ROT_COMPLETE (EOF_IRQ_IN | EOF_IRQ_OUT | \ ++ EOF_IRQ_ROT_IN | EOF_IRQ_ROT_OUT) ++ + struct ipu_image_convert_ctx { + struct ipu_image_convert_chan *chan; + +@@ -173,6 +184,9 @@ struct ipu_image_convert_ctx { + /* where to place converted tile in dest image */ + unsigned int out_tile_map[MAX_TILES]; + ++ /* mask of completed EOF irqs at every tile conversion */ ++ enum eof_irq_mask eof_mask; ++ + struct list_head list; + }; + +@@ -189,6 +203,8 @@ struct ipu_image_convert_chan { + struct ipuv3_channel *rotation_out_chan; + + /* the IPU end-of-frame irqs */ ++ int in_eof_irq; ++ int rot_in_eof_irq; + int out_eof_irq; + int rot_out_eof_irq; + +@@ -1380,6 +1396,9 @@ static int convert_start(struct ipu_image_convert_run *run, unsigned int tile) + dev_dbg(priv->ipu->dev, "%s: task %u: starting ctx %p run %p tile %u -> %u\n", + __func__, chan->ic_task, ctx, run, tile, dst_tile); + ++ /* clear EOF irq mask */ ++ ctx->eof_mask = 0; ++ + if (ipu_rot_mode_is_irt(ctx->rot_mode)) { + /* swap width/height for resizer */ + dest_width = d_image->tile[dst_tile].height; +@@ -1615,7 +1634,7 @@ static bool ic_settings_changed(struct ipu_image_convert_ctx *ctx) + } + + /* hold irqlock when calling */ +-static irqreturn_t do_irq(struct ipu_image_convert_run *run) ++static irqreturn_t do_tile_complete(struct ipu_image_convert_run *run) + { + struct ipu_image_convert_ctx *ctx = run->ctx; + struct ipu_image_convert_chan *chan = ctx->chan; +@@ -1700,6 +1719,7 @@ static irqreturn_t do_irq(struct ipu_image_convert_run *run) + ctx->cur_buf_num ^= 1; + } + ++ ctx->eof_mask = 0; /* clear EOF irq mask for next tile */ + ctx->next_tile++; + return IRQ_HANDLED; + done: +@@ -1709,13 +1729,15 @@ done: + return IRQ_WAKE_THREAD; + } + +-static irqreturn_t norotate_irq(int irq, void *data) ++static irqreturn_t eof_irq(int irq, void *data) + { + struct ipu_image_convert_chan *chan = data; ++ struct ipu_image_convert_priv *priv = chan->priv; + struct ipu_image_convert_ctx *ctx; + struct ipu_image_convert_run *run; ++ irqreturn_t ret = IRQ_HANDLED; ++ bool tile_complete = false; + unsigned long flags; +- irqreturn_t ret; + + spin_lock_irqsave(&chan->irqlock, flags); + +@@ -1728,46 +1750,33 @@ static irqreturn_t norotate_irq(int irq, void *data) + + ctx = run->ctx; + +- if (ipu_rot_mode_is_irt(ctx->rot_mode)) { +- /* this is a rotation operation, just ignore */ +- spin_unlock_irqrestore(&chan->irqlock, flags); +- return IRQ_HANDLED; +- } +- +- ret = do_irq(run); +-out: +- spin_unlock_irqrestore(&chan->irqlock, flags); +- return ret; +-} +- +-static irqreturn_t rotate_irq(int irq, void *data) +-{ +- struct ipu_image_convert_chan *chan = data; +- struct ipu_image_convert_priv *priv = chan->priv; +- struct ipu_image_convert_ctx *ctx; +- struct ipu_image_convert_run *run; +- unsigned long flags; +- irqreturn_t ret; +- +- spin_lock_irqsave(&chan->irqlock, flags); +- +- /* get current run and its context */ +- run = chan->current_run; +- if (!run) { ++ if (irq == chan->in_eof_irq) { ++ ctx->eof_mask |= EOF_IRQ_IN; ++ } else if (irq == chan->out_eof_irq) { ++ ctx->eof_mask |= EOF_IRQ_OUT; ++ } else if (irq == chan->rot_in_eof_irq || ++ irq == chan->rot_out_eof_irq) { ++ if (!ipu_rot_mode_is_irt(ctx->rot_mode)) { ++ /* this was NOT a rotation op, shouldn't happen */ ++ dev_err(priv->ipu->dev, ++ "Unexpected rotation interrupt\n"); ++ goto out; ++ } ++ ctx->eof_mask |= (irq == chan->rot_in_eof_irq) ? ++ EOF_IRQ_ROT_IN : EOF_IRQ_ROT_OUT; ++ } else { ++ dev_err(priv->ipu->dev, "Received unknown irq %d\n", irq); + ret = IRQ_NONE; + goto out; + } + +- ctx = run->ctx; +- +- if (!ipu_rot_mode_is_irt(ctx->rot_mode)) { +- /* this was NOT a rotation operation, shouldn't happen */ +- dev_err(priv->ipu->dev, "Unexpected rotation interrupt\n"); +- spin_unlock_irqrestore(&chan->irqlock, flags); +- return IRQ_HANDLED; +- } ++ if (ipu_rot_mode_is_irt(ctx->rot_mode)) ++ tile_complete = (ctx->eof_mask == EOF_IRQ_ROT_COMPLETE); ++ else ++ tile_complete = (ctx->eof_mask == EOF_IRQ_COMPLETE); + +- ret = do_irq(run); ++ if (tile_complete) ++ ret = do_tile_complete(run); + out: + spin_unlock_irqrestore(&chan->irqlock, flags); + return ret; +@@ -1801,6 +1810,10 @@ static void force_abort(struct ipu_image_convert_ctx *ctx) + + static void release_ipu_resources(struct ipu_image_convert_chan *chan) + { ++ if (chan->in_eof_irq >= 0) ++ free_irq(chan->in_eof_irq, chan); ++ if (chan->rot_in_eof_irq >= 0) ++ free_irq(chan->rot_in_eof_irq, chan); + if (chan->out_eof_irq >= 0) + free_irq(chan->out_eof_irq, chan); + if (chan->rot_out_eof_irq >= 0) +@@ -1819,7 +1832,27 @@ static void release_ipu_resources(struct ipu_image_convert_chan *chan) + + chan->in_chan = chan->out_chan = chan->rotation_in_chan = + chan->rotation_out_chan = NULL; +- chan->out_eof_irq = chan->rot_out_eof_irq = -1; ++ chan->in_eof_irq = -1; ++ chan->rot_in_eof_irq = -1; ++ chan->out_eof_irq = -1; ++ chan->rot_out_eof_irq = -1; ++} ++ ++static int get_eof_irq(struct ipu_image_convert_chan *chan, ++ struct ipuv3_channel *channel) ++{ ++ struct ipu_image_convert_priv *priv = chan->priv; ++ int ret, irq; ++ ++ irq = ipu_idmac_channel_irq(priv->ipu, channel, IPU_IRQ_EOF); ++ ++ ret = request_threaded_irq(irq, eof_irq, do_bh, 0, "ipu-ic", chan); ++ if (ret < 0) { ++ dev_err(priv->ipu->dev, "could not acquire irq %d\n", irq); ++ return ret; ++ } ++ ++ return irq; + } + + static int get_ipu_resources(struct ipu_image_convert_chan *chan) +@@ -1855,31 +1888,33 @@ static int get_ipu_resources(struct ipu_image_convert_chan *chan) + } + + /* acquire the EOF interrupts */ +- chan->out_eof_irq = ipu_idmac_channel_irq(priv->ipu, +- chan->out_chan, +- IPU_IRQ_EOF); ++ ret = get_eof_irq(chan, chan->in_chan); ++ if (ret < 0) { ++ chan->in_eof_irq = -1; ++ goto err; ++ } ++ chan->in_eof_irq = ret; + +- ret = request_threaded_irq(chan->out_eof_irq, norotate_irq, do_bh, +- 0, "ipu-ic", chan); ++ ret = get_eof_irq(chan, chan->rotation_in_chan); + if (ret < 0) { +- dev_err(priv->ipu->dev, "could not acquire irq %d\n", +- chan->out_eof_irq); +- chan->out_eof_irq = -1; ++ chan->rot_in_eof_irq = -1; + goto err; + } ++ chan->rot_in_eof_irq = ret; + +- chan->rot_out_eof_irq = ipu_idmac_channel_irq(priv->ipu, +- chan->rotation_out_chan, +- IPU_IRQ_EOF); ++ ret = get_eof_irq(chan, chan->out_chan); ++ if (ret < 0) { ++ chan->out_eof_irq = -1; ++ goto err; ++ } ++ chan->out_eof_irq = ret; + +- ret = request_threaded_irq(chan->rot_out_eof_irq, rotate_irq, do_bh, +- 0, "ipu-ic", chan); ++ ret = get_eof_irq(chan, chan->rotation_out_chan); + if (ret < 0) { +- dev_err(priv->ipu->dev, "could not acquire irq %d\n", +- chan->rot_out_eof_irq); + chan->rot_out_eof_irq = -1; + goto err; + } ++ chan->rot_out_eof_irq = ret; + + return 0; + err: +@@ -2458,6 +2493,8 @@ int ipu_image_convert_init(struct ipu_soc *ipu, struct device *dev) + chan->ic_task = i; + chan->priv = priv; + chan->dma_ch = &image_convert_dma_chan[i]; ++ chan->in_eof_irq = -1; ++ chan->rot_in_eof_irq = -1; + chan->out_eof_irq = -1; + chan->rot_out_eof_irq = -1; + +diff --git a/drivers/i2c/busses/i2c-bcm-iproc.c b/drivers/i2c/busses/i2c-bcm-iproc.c +index 03475f1799730..dd9661c11782a 100644 +--- a/drivers/i2c/busses/i2c-bcm-iproc.c ++++ b/drivers/i2c/busses/i2c-bcm-iproc.c +@@ -1037,7 +1037,7 @@ static int bcm_iproc_i2c_unreg_slave(struct i2c_client *slave) + if (!iproc_i2c->slave) + return -EINVAL; + +- iproc_i2c->slave = NULL; ++ disable_irq(iproc_i2c->irq); + + /* disable all slave interrupts */ + tmp = iproc_i2c_rd_reg(iproc_i2c, IE_OFFSET); +@@ -1050,6 +1050,17 @@ static int bcm_iproc_i2c_unreg_slave(struct i2c_client *slave) + tmp &= ~BIT(S_CFG_EN_NIC_SMB_ADDR3_SHIFT); + iproc_i2c_wr_reg(iproc_i2c, S_CFG_SMBUS_ADDR_OFFSET, tmp); + ++ /* flush TX/RX FIFOs */ ++ tmp = (BIT(S_FIFO_RX_FLUSH_SHIFT) | BIT(S_FIFO_TX_FLUSH_SHIFT)); ++ iproc_i2c_wr_reg(iproc_i2c, S_FIFO_CTRL_OFFSET, tmp); ++ ++ /* clear all pending slave interrupts */ ++ iproc_i2c_wr_reg(iproc_i2c, IS_OFFSET, ISR_MASK_SLAVE); ++ ++ iproc_i2c->slave = NULL; ++ ++ enable_irq(iproc_i2c->irq); ++ + return 0; + } + +diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c +index 36af8fdb66586..0b90aa0318df3 100644 +--- a/drivers/i2c/busses/i2c-rcar.c ++++ b/drivers/i2c/busses/i2c-rcar.c +@@ -580,13 +580,14 @@ static bool rcar_i2c_slave_irq(struct rcar_i2c_priv *priv) + rcar_i2c_write(priv, ICSIER, SDR | SSR | SAR); + } + +- rcar_i2c_write(priv, ICSSR, ~SAR & 0xff); ++ /* Clear SSR, too, because of old STOPs to other clients than us */ ++ rcar_i2c_write(priv, ICSSR, ~(SAR | SSR) & 0xff); + } + + /* master sent stop */ + if (ssr_filtered & SSR) { + i2c_slave_event(priv->slave, I2C_SLAVE_STOP, &value); +- rcar_i2c_write(priv, ICSIER, SAR | SSR); ++ rcar_i2c_write(priv, ICSIER, SAR); + rcar_i2c_write(priv, ICSSR, ~SSR & 0xff); + } + +@@ -850,7 +851,7 @@ static int rcar_reg_slave(struct i2c_client *slave) + priv->slave = slave; + rcar_i2c_write(priv, ICSAR, slave->addr); + rcar_i2c_write(priv, ICSSR, 0); +- rcar_i2c_write(priv, ICSIER, SAR | SSR); ++ rcar_i2c_write(priv, ICSIER, SAR); + rcar_i2c_write(priv, ICSCR, SIE | SDBS); + + return 0; +@@ -862,12 +863,14 @@ static int rcar_unreg_slave(struct i2c_client *slave) + + WARN_ON(!priv->slave); + +- /* disable irqs and ensure none is running before clearing ptr */ ++ /* ensure no irq is running before clearing ptr */ ++ disable_irq(priv->irq); + rcar_i2c_write(priv, ICSIER, 0); +- rcar_i2c_write(priv, ICSCR, 0); ++ rcar_i2c_write(priv, ICSSR, 0); ++ enable_irq(priv->irq); ++ rcar_i2c_write(priv, ICSCR, SDBS); + rcar_i2c_write(priv, ICSAR, 0); /* Gen2: must be 0 if not using slave */ + +- synchronize_irq(priv->irq); + priv->slave = NULL; + + pm_runtime_put(rcar_i2c_priv_to_dev(priv)); +diff --git a/drivers/iio/dac/ad5592r-base.c b/drivers/iio/dac/ad5592r-base.c +index 2d897e64c6a9e..424922cad1e39 100644 +--- a/drivers/iio/dac/ad5592r-base.c ++++ b/drivers/iio/dac/ad5592r-base.c +@@ -416,7 +416,7 @@ static int ad5592r_read_raw(struct iio_dev *iio_dev, + s64 tmp = *val * (3767897513LL / 25LL); + *val = div_s64_rem(tmp, 1000000000LL, val2); + +- ret = IIO_VAL_INT_PLUS_MICRO; ++ return IIO_VAL_INT_PLUS_MICRO; + } else { + int mult; + +@@ -447,7 +447,7 @@ static int ad5592r_read_raw(struct iio_dev *iio_dev, + ret = IIO_VAL_INT; + break; + default: +- ret = -EINVAL; ++ return -EINVAL; + } + + unlock: +diff --git a/drivers/infiniband/core/counters.c b/drivers/infiniband/core/counters.c +index 11210bf7fd61b..f454d63008d69 100644 +--- a/drivers/infiniband/core/counters.c ++++ b/drivers/infiniband/core/counters.c +@@ -284,7 +284,7 @@ int rdma_counter_bind_qp_auto(struct ib_qp *qp, u8 port) + struct rdma_counter *counter; + int ret; + +- if (!qp->res.valid) ++ if (!qp->res.valid || rdma_is_kernel_res(&qp->res)) + return 0; + + if (!rdma_is_port_valid(dev, port)) +@@ -487,7 +487,7 @@ int rdma_counter_bind_qpn(struct ib_device *dev, u8 port, + goto err; + } + +- if (counter->res.task != qp->res.task) { ++ if (rdma_is_kernel_res(&counter->res) != rdma_is_kernel_res(&qp->res)) { + ret = -EINVAL; + goto err_task; + } +diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c +index e2ddcb0dc4ee3..c398d1a64614c 100644 +--- a/drivers/infiniband/core/uverbs_cmd.c ++++ b/drivers/infiniband/core/uverbs_cmd.c +@@ -757,6 +757,7 @@ static int ib_uverbs_reg_mr(struct uverbs_attr_bundle *attrs) + mr->uobject = uobj; + atomic_inc(&pd->usecnt); + mr->res.type = RDMA_RESTRACK_MR; ++ mr->iova = cmd.hca_va; + rdma_restrack_uadd(&mr->res); + + uobj->object = mr; +@@ -847,6 +848,9 @@ static int ib_uverbs_rereg_mr(struct uverbs_attr_bundle *attrs) + atomic_dec(&old_pd->usecnt); + } + ++ if (cmd.flags & IB_MR_REREG_TRANS) ++ mr->iova = cmd.hca_va; ++ + memset(&resp, 0, sizeof(resp)); + resp.lkey = mr->lkey; + resp.rkey = mr->rkey; +diff --git a/drivers/infiniband/hw/cxgb4/mem.c b/drivers/infiniband/hw/cxgb4/mem.c +index 35c284af574da..dcb58cef336d9 100644 +--- a/drivers/infiniband/hw/cxgb4/mem.c ++++ b/drivers/infiniband/hw/cxgb4/mem.c +@@ -399,7 +399,6 @@ static int finish_mem_reg(struct c4iw_mr *mhp, u32 stag) + mmid = stag >> 8; + mhp->ibmr.rkey = mhp->ibmr.lkey = stag; + mhp->ibmr.length = mhp->attr.len; +- mhp->ibmr.iova = mhp->attr.va_fbo; + mhp->ibmr.page_size = 1U << (mhp->attr.page_size + 12); + pr_debug("mmid 0x%x mhp %p\n", mmid, mhp); + return xa_insert_irq(&mhp->rhp->mrs, mmid, mhp, GFP_KERNEL); +diff --git a/drivers/infiniband/hw/mlx4/mr.c b/drivers/infiniband/hw/mlx4/mr.c +index 6ae503cfc5264..9114cb7307692 100644 +--- a/drivers/infiniband/hw/mlx4/mr.c ++++ b/drivers/infiniband/hw/mlx4/mr.c +@@ -439,7 +439,6 @@ struct ib_mr *mlx4_ib_reg_user_mr(struct ib_pd *pd, u64 start, u64 length, + + mr->ibmr.rkey = mr->ibmr.lkey = mr->mmr.key; + mr->ibmr.length = length; +- mr->ibmr.iova = virt_addr; + mr->ibmr.page_size = 1U << shift; + + return &mr->ibmr; +diff --git a/drivers/infiniband/ulp/ipoib/ipoib.h b/drivers/infiniband/ulp/ipoib/ipoib.h +index 0e5f27caf2b2d..50a3557386090 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib.h ++++ b/drivers/infiniband/ulp/ipoib/ipoib.h +@@ -515,7 +515,7 @@ void ipoib_ib_dev_cleanup(struct net_device *dev); + + int ipoib_ib_dev_open_default(struct net_device *dev); + int ipoib_ib_dev_open(struct net_device *dev); +-int ipoib_ib_dev_stop(struct net_device *dev); ++void ipoib_ib_dev_stop(struct net_device *dev); + void ipoib_ib_dev_up(struct net_device *dev); + void ipoib_ib_dev_down(struct net_device *dev); + int ipoib_ib_dev_stop_default(struct net_device *dev); +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c +index da3c5315bbb51..494f413dc3c6c 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c +@@ -670,13 +670,12 @@ int ipoib_send(struct net_device *dev, struct sk_buff *skb, + return rc; + } + +-static void __ipoib_reap_ah(struct net_device *dev) ++static void ipoib_reap_dead_ahs(struct ipoib_dev_priv *priv) + { +- struct ipoib_dev_priv *priv = ipoib_priv(dev); + struct ipoib_ah *ah, *tah; + unsigned long flags; + +- netif_tx_lock_bh(dev); ++ netif_tx_lock_bh(priv->dev); + spin_lock_irqsave(&priv->lock, flags); + + list_for_each_entry_safe(ah, tah, &priv->dead_ahs, list) +@@ -687,37 +686,37 @@ static void __ipoib_reap_ah(struct net_device *dev) + } + + spin_unlock_irqrestore(&priv->lock, flags); +- netif_tx_unlock_bh(dev); ++ netif_tx_unlock_bh(priv->dev); + } + + void ipoib_reap_ah(struct work_struct *work) + { + struct ipoib_dev_priv *priv = + container_of(work, struct ipoib_dev_priv, ah_reap_task.work); +- struct net_device *dev = priv->dev; + +- __ipoib_reap_ah(dev); ++ ipoib_reap_dead_ahs(priv); + + if (!test_bit(IPOIB_STOP_REAPER, &priv->flags)) + queue_delayed_work(priv->wq, &priv->ah_reap_task, + round_jiffies_relative(HZ)); + } + +-static void ipoib_flush_ah(struct net_device *dev) ++static void ipoib_start_ah_reaper(struct ipoib_dev_priv *priv) + { +- struct ipoib_dev_priv *priv = ipoib_priv(dev); +- +- cancel_delayed_work(&priv->ah_reap_task); +- flush_workqueue(priv->wq); +- ipoib_reap_ah(&priv->ah_reap_task.work); ++ clear_bit(IPOIB_STOP_REAPER, &priv->flags); ++ queue_delayed_work(priv->wq, &priv->ah_reap_task, ++ round_jiffies_relative(HZ)); + } + +-static void ipoib_stop_ah(struct net_device *dev) ++static void ipoib_stop_ah_reaper(struct ipoib_dev_priv *priv) + { +- struct ipoib_dev_priv *priv = ipoib_priv(dev); +- + set_bit(IPOIB_STOP_REAPER, &priv->flags); +- ipoib_flush_ah(dev); ++ cancel_delayed_work(&priv->ah_reap_task); ++ /* ++ * After ipoib_stop_ah_reaper() we always go through ++ * ipoib_reap_dead_ahs() which ensures the work is really stopped and ++ * does a final flush out of the dead_ah's list ++ */ + } + + static int recvs_pending(struct net_device *dev) +@@ -846,18 +845,6 @@ timeout: + return 0; + } + +-int ipoib_ib_dev_stop(struct net_device *dev) +-{ +- struct ipoib_dev_priv *priv = ipoib_priv(dev); +- +- priv->rn_ops->ndo_stop(dev); +- +- clear_bit(IPOIB_FLAG_INITIALIZED, &priv->flags); +- ipoib_flush_ah(dev); +- +- return 0; +-} +- + int ipoib_ib_dev_open_default(struct net_device *dev) + { + struct ipoib_dev_priv *priv = ipoib_priv(dev); +@@ -901,10 +888,7 @@ int ipoib_ib_dev_open(struct net_device *dev) + return -1; + } + +- clear_bit(IPOIB_STOP_REAPER, &priv->flags); +- queue_delayed_work(priv->wq, &priv->ah_reap_task, +- round_jiffies_relative(HZ)); +- ++ ipoib_start_ah_reaper(priv); + if (priv->rn_ops->ndo_open(dev)) { + pr_warn("%s: Failed to open dev\n", dev->name); + goto dev_stop; +@@ -915,13 +899,20 @@ int ipoib_ib_dev_open(struct net_device *dev) + return 0; + + dev_stop: +- set_bit(IPOIB_STOP_REAPER, &priv->flags); +- cancel_delayed_work(&priv->ah_reap_task); +- set_bit(IPOIB_FLAG_INITIALIZED, &priv->flags); +- ipoib_ib_dev_stop(dev); ++ ipoib_stop_ah_reaper(priv); + return -1; + } + ++void ipoib_ib_dev_stop(struct net_device *dev) ++{ ++ struct ipoib_dev_priv *priv = ipoib_priv(dev); ++ ++ priv->rn_ops->ndo_stop(dev); ++ ++ clear_bit(IPOIB_FLAG_INITIALIZED, &priv->flags); ++ ipoib_stop_ah_reaper(priv); ++} ++ + void ipoib_pkey_dev_check_presence(struct net_device *dev) + { + struct ipoib_dev_priv *priv = ipoib_priv(dev); +@@ -1232,7 +1223,7 @@ static void __ipoib_ib_dev_flush(struct ipoib_dev_priv *priv, + ipoib_mcast_dev_flush(dev); + if (oper_up) + set_bit(IPOIB_FLAG_OPER_UP, &priv->flags); +- ipoib_flush_ah(dev); ++ ipoib_reap_dead_ahs(priv); + } + + if (level >= IPOIB_FLUSH_NORMAL) +@@ -1307,7 +1298,7 @@ void ipoib_ib_dev_cleanup(struct net_device *dev) + * the neighbor garbage collection is stopped and reaped. + * That should all be done now, so make a final ah flush. + */ +- ipoib_stop_ah(dev); ++ ipoib_reap_dead_ahs(priv); + + clear_bit(IPOIB_PKEY_ASSIGNED, &priv->flags); + +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c +index 4fd095fd63b6f..044bcacad6e48 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c +@@ -1979,6 +1979,8 @@ static void ipoib_ndo_uninit(struct net_device *dev) + + /* no more works over the priv->wq */ + if (priv->wq) { ++ /* See ipoib_mcast_carrier_on_task() */ ++ WARN_ON(test_bit(IPOIB_FLAG_OPER_UP, &priv->flags)); + flush_workqueue(priv->wq); + destroy_workqueue(priv->wq); + priv->wq = NULL; +diff --git a/drivers/input/mouse/sentelic.c b/drivers/input/mouse/sentelic.c +index e99d9bf1a267d..e78c4c7eda34d 100644 +--- a/drivers/input/mouse/sentelic.c ++++ b/drivers/input/mouse/sentelic.c +@@ -441,7 +441,7 @@ static ssize_t fsp_attr_set_setreg(struct psmouse *psmouse, void *data, + + fsp_reg_write_enable(psmouse, false); + +- return count; ++ return retval; + } + + PSMOUSE_DEFINE_WO_ATTR(setreg, S_IWUSR, NULL, fsp_attr_set_setreg); +diff --git a/drivers/iommu/omap-iommu-debug.c b/drivers/iommu/omap-iommu-debug.c +index 8e19bfa94121e..a99afb5d9011c 100644 +--- a/drivers/iommu/omap-iommu-debug.c ++++ b/drivers/iommu/omap-iommu-debug.c +@@ -98,8 +98,11 @@ static ssize_t debug_read_regs(struct file *file, char __user *userbuf, + mutex_lock(&iommu_debug_lock); + + bytes = omap_iommu_dump_ctx(obj, p, count); ++ if (bytes < 0) ++ goto err; + bytes = simple_read_from_buffer(userbuf, count, ppos, buf, bytes); + ++err: + mutex_unlock(&iommu_debug_lock); + kfree(buf); + +diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c +index 263cf9240b168..7966b19ceba79 100644 +--- a/drivers/irqchip/irq-gic-v3-its.c ++++ b/drivers/irqchip/irq-gic-v3-its.c +@@ -2581,6 +2581,7 @@ static int its_irq_domain_alloc(struct irq_domain *domain, unsigned int virq, + msi_alloc_info_t *info = args; + struct its_device *its_dev = info->scratchpad[0].ptr; + struct its_node *its = its_dev->its; ++ struct irq_data *irqd; + irq_hw_number_t hwirq; + int err; + int i; +@@ -2600,7 +2601,9 @@ static int its_irq_domain_alloc(struct irq_domain *domain, unsigned int virq, + + irq_domain_set_hwirq_and_chip(domain, virq + i, + hwirq + i, &its_irq_chip, its_dev); +- irqd_set_single_target(irq_desc_get_irq_data(irq_to_desc(virq + i))); ++ irqd = irq_get_irq_data(virq + i); ++ irqd_set_single_target(irqd); ++ irqd_set_affinity_on_activate(irqd); + pr_debug("ID:%d pID:%d vID:%d\n", + (int)(hwirq + i - its_dev->event_map.lpi_base), + (int)(hwirq + i), virq + i); +diff --git a/drivers/md/bcache/bcache.h b/drivers/md/bcache/bcache.h +index 3d2b63585da95..217c838a1b405 100644 +--- a/drivers/md/bcache/bcache.h ++++ b/drivers/md/bcache/bcache.h +@@ -264,7 +264,7 @@ struct bcache_device { + #define BCACHE_DEV_UNLINK_DONE 2 + #define BCACHE_DEV_WB_RUNNING 3 + #define BCACHE_DEV_RATE_DW_RUNNING 4 +- unsigned int nr_stripes; ++ int nr_stripes; + unsigned int stripe_size; + atomic_t *stripe_sectors_dirty; + unsigned long *full_dirty_stripes; +diff --git a/drivers/md/bcache/bset.c b/drivers/md/bcache/bset.c +index 08768796b5439..fda68c00ddd53 100644 +--- a/drivers/md/bcache/bset.c ++++ b/drivers/md/bcache/bset.c +@@ -321,7 +321,7 @@ int bch_btree_keys_alloc(struct btree_keys *b, + + b->page_order = page_order; + +- t->data = (void *) __get_free_pages(gfp, b->page_order); ++ t->data = (void *) __get_free_pages(__GFP_COMP|gfp, b->page_order); + if (!t->data) + goto err; + +diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c +index 3c1109fceb2fb..46556bde032e2 100644 +--- a/drivers/md/bcache/btree.c ++++ b/drivers/md/bcache/btree.c +@@ -840,7 +840,7 @@ int bch_btree_cache_alloc(struct cache_set *c) + mutex_init(&c->verify_lock); + + c->verify_ondisk = (void *) +- __get_free_pages(GFP_KERNEL, ilog2(bucket_pages(c))); ++ __get_free_pages(GFP_KERNEL|__GFP_COMP, ilog2(bucket_pages(c))); + + c->verify_data = mca_bucket_alloc(c, &ZERO_KEY, GFP_KERNEL); + +diff --git a/drivers/md/bcache/journal.c b/drivers/md/bcache/journal.c +index 6730820780b06..8250d2d1d780c 100644 +--- a/drivers/md/bcache/journal.c ++++ b/drivers/md/bcache/journal.c +@@ -1002,8 +1002,8 @@ int bch_journal_alloc(struct cache_set *c) + j->w[1].c = c; + + if (!(init_fifo(&j->pin, JOURNAL_PIN, GFP_KERNEL)) || +- !(j->w[0].data = (void *) __get_free_pages(GFP_KERNEL, JSET_BITS)) || +- !(j->w[1].data = (void *) __get_free_pages(GFP_KERNEL, JSET_BITS))) ++ !(j->w[0].data = (void *) __get_free_pages(GFP_KERNEL|__GFP_COMP, JSET_BITS)) || ++ !(j->w[1].data = (void *) __get_free_pages(GFP_KERNEL|__GFP_COMP, JSET_BITS))) + return -ENOMEM; + + return 0; +diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c +index 168d647078591..25ad64a3919f6 100644 +--- a/drivers/md/bcache/super.c ++++ b/drivers/md/bcache/super.c +@@ -1754,7 +1754,7 @@ void bch_cache_set_unregister(struct cache_set *c) + } + + #define alloc_bucket_pages(gfp, c) \ +- ((void *) __get_free_pages(__GFP_ZERO|gfp, ilog2(bucket_pages(c)))) ++ ((void *) __get_free_pages(__GFP_ZERO|__GFP_COMP|gfp, ilog2(bucket_pages(c)))) + + struct cache_set *bch_cache_set_alloc(struct cache_sb *sb) + { +diff --git a/drivers/md/bcache/writeback.c b/drivers/md/bcache/writeback.c +index d60268fe49e10..0b02210ab4355 100644 +--- a/drivers/md/bcache/writeback.c ++++ b/drivers/md/bcache/writeback.c +@@ -519,15 +519,19 @@ void bcache_dev_sectors_dirty_add(struct cache_set *c, unsigned int inode, + uint64_t offset, int nr_sectors) + { + struct bcache_device *d = c->devices[inode]; +- unsigned int stripe_offset, stripe, sectors_dirty; ++ unsigned int stripe_offset, sectors_dirty; ++ int stripe; + + if (!d) + return; + ++ stripe = offset_to_stripe(d, offset); ++ if (stripe < 0) ++ return; ++ + if (UUID_FLASH_ONLY(&c->uuids[inode])) + atomic_long_add(nr_sectors, &c->flash_dev_dirty_sectors); + +- stripe = offset_to_stripe(d, offset); + stripe_offset = offset & (d->stripe_size - 1); + + while (nr_sectors) { +@@ -567,12 +571,12 @@ static bool dirty_pred(struct keybuf *buf, struct bkey *k) + static void refill_full_stripes(struct cached_dev *dc) + { + struct keybuf *buf = &dc->writeback_keys; +- unsigned int start_stripe, stripe, next_stripe; ++ unsigned int start_stripe, next_stripe; ++ int stripe; + bool wrapped = false; + + stripe = offset_to_stripe(&dc->disk, KEY_OFFSET(&buf->last_scanned)); +- +- if (stripe >= dc->disk.nr_stripes) ++ if (stripe < 0) + stripe = 0; + + start_stripe = stripe; +diff --git a/drivers/md/bcache/writeback.h b/drivers/md/bcache/writeback.h +index 4e4c6810dc3c7..c4ff76037227b 100644 +--- a/drivers/md/bcache/writeback.h ++++ b/drivers/md/bcache/writeback.h +@@ -33,10 +33,22 @@ static inline uint64_t bcache_dev_sectors_dirty(struct bcache_device *d) + return ret; + } + +-static inline unsigned int offset_to_stripe(struct bcache_device *d, ++static inline int offset_to_stripe(struct bcache_device *d, + uint64_t offset) + { + do_div(offset, d->stripe_size); ++ ++ /* d->nr_stripes is in range [1, INT_MAX] */ ++ if (unlikely(offset >= d->nr_stripes)) { ++ pr_err("Invalid stripe %llu (>= nr_stripes %d).\n", ++ offset, d->nr_stripes); ++ return -EINVAL; ++ } ++ ++ /* ++ * Here offset is definitly smaller than INT_MAX, ++ * return it as int will never overflow. ++ */ + return offset; + } + +@@ -44,7 +56,10 @@ static inline bool bcache_dev_stripe_dirty(struct cached_dev *dc, + uint64_t offset, + unsigned int nr_sectors) + { +- unsigned int stripe = offset_to_stripe(&dc->disk, offset); ++ int stripe = offset_to_stripe(&dc->disk, offset); ++ ++ if (stripe < 0) ++ return false; + + while (1) { + if (atomic_read(dc->disk.stripe_sectors_dirty + stripe)) +diff --git a/drivers/md/dm-rq.c b/drivers/md/dm-rq.c +index 3f8577e2c13be..2bd2444ad99c6 100644 +--- a/drivers/md/dm-rq.c ++++ b/drivers/md/dm-rq.c +@@ -70,9 +70,6 @@ void dm_start_queue(struct request_queue *q) + + void dm_stop_queue(struct request_queue *q) + { +- if (blk_mq_queue_stopped(q)) +- return; +- + blk_mq_quiesce_queue(q); + } + +diff --git a/drivers/md/md-cluster.c b/drivers/md/md-cluster.c +index 73fd50e779754..d50737ec40394 100644 +--- a/drivers/md/md-cluster.c ++++ b/drivers/md/md-cluster.c +@@ -1139,6 +1139,7 @@ static int resize_bitmaps(struct mddev *mddev, sector_t newsize, sector_t oldsiz + bitmap = get_bitmap_from_slot(mddev, i); + if (IS_ERR(bitmap)) { + pr_err("can't get bitmap from slot %d\n", i); ++ bitmap = NULL; + goto out; + } + counts = &bitmap->counts; +diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c +index a3cbc9f4fec17..02acd5d5a8488 100644 +--- a/drivers/md/raid5.c ++++ b/drivers/md/raid5.c +@@ -3604,6 +3604,7 @@ static int need_this_block(struct stripe_head *sh, struct stripe_head_state *s, + * is missing/faulty, then we need to read everything we can. + */ + if (sh->raid_conf->level != 6 && ++ sh->raid_conf->rmw_level != PARITY_DISABLE_RMW && + sh->sector < sh->raid_conf->mddev->recovery_cp) + /* reconstruct-write isn't being forced */ + return 0; +@@ -4839,7 +4840,7 @@ static void handle_stripe(struct stripe_head *sh) + * or to load a block that is being partially written. + */ + if (s.to_read || s.non_overwrite +- || (conf->level == 6 && s.to_write && s.failed) ++ || (s.to_write && s.failed) + || (s.syncing && (s.uptodate + s.compute < disks)) + || s.replacing + || s.expanding) +diff --git a/drivers/media/platform/rockchip/rga/rga-hw.c b/drivers/media/platform/rockchip/rga/rga-hw.c +index 4be6dcf292fff..aaa96f256356b 100644 +--- a/drivers/media/platform/rockchip/rga/rga-hw.c ++++ b/drivers/media/platform/rockchip/rga/rga-hw.c +@@ -200,22 +200,25 @@ static void rga_cmd_set_trans_info(struct rga_ctx *ctx) + dst_info.data.format = ctx->out.fmt->hw_format; + dst_info.data.swap = ctx->out.fmt->color_swap; + +- if (ctx->in.fmt->hw_format >= RGA_COLOR_FMT_YUV422SP) { +- if (ctx->out.fmt->hw_format < RGA_COLOR_FMT_YUV422SP) { +- switch (ctx->in.colorspace) { +- case V4L2_COLORSPACE_REC709: +- src_info.data.csc_mode = +- RGA_SRC_CSC_MODE_BT709_R0; +- break; +- default: +- src_info.data.csc_mode = +- RGA_SRC_CSC_MODE_BT601_R0; +- break; +- } ++ /* ++ * CSC mode must only be set when the colorspace families differ between ++ * input and output. It must remain unset (zeroed) if both are the same. ++ */ ++ ++ if (RGA_COLOR_FMT_IS_YUV(ctx->in.fmt->hw_format) && ++ RGA_COLOR_FMT_IS_RGB(ctx->out.fmt->hw_format)) { ++ switch (ctx->in.colorspace) { ++ case V4L2_COLORSPACE_REC709: ++ src_info.data.csc_mode = RGA_SRC_CSC_MODE_BT709_R0; ++ break; ++ default: ++ src_info.data.csc_mode = RGA_SRC_CSC_MODE_BT601_R0; ++ break; + } + } + +- if (ctx->out.fmt->hw_format >= RGA_COLOR_FMT_YUV422SP) { ++ if (RGA_COLOR_FMT_IS_RGB(ctx->in.fmt->hw_format) && ++ RGA_COLOR_FMT_IS_YUV(ctx->out.fmt->hw_format)) { + switch (ctx->out.colorspace) { + case V4L2_COLORSPACE_REC709: + dst_info.data.csc_mode = RGA_SRC_CSC_MODE_BT709_R0; +diff --git a/drivers/media/platform/rockchip/rga/rga-hw.h b/drivers/media/platform/rockchip/rga/rga-hw.h +index 96cb0314dfa70..e8917e5630a48 100644 +--- a/drivers/media/platform/rockchip/rga/rga-hw.h ++++ b/drivers/media/platform/rockchip/rga/rga-hw.h +@@ -95,6 +95,11 @@ + #define RGA_COLOR_FMT_CP_8BPP 15 + #define RGA_COLOR_FMT_MASK 15 + ++#define RGA_COLOR_FMT_IS_YUV(fmt) \ ++ (((fmt) >= RGA_COLOR_FMT_YUV422SP) && ((fmt) < RGA_COLOR_FMT_CP_1BPP)) ++#define RGA_COLOR_FMT_IS_RGB(fmt) \ ++ ((fmt) < RGA_COLOR_FMT_YUV422SP) ++ + #define RGA_COLOR_NONE_SWAP 0 + #define RGA_COLOR_RB_SWAP 1 + #define RGA_COLOR_ALPHA_SWAP 2 +diff --git a/drivers/media/platform/vsp1/vsp1_dl.c b/drivers/media/platform/vsp1/vsp1_dl.c +index d7b43037e500a..e07b135613eb5 100644 +--- a/drivers/media/platform/vsp1/vsp1_dl.c ++++ b/drivers/media/platform/vsp1/vsp1_dl.c +@@ -431,6 +431,8 @@ vsp1_dl_cmd_pool_create(struct vsp1_device *vsp1, enum vsp1_extcmd_type type, + if (!pool) + return NULL; + ++ pool->vsp1 = vsp1; ++ + spin_lock_init(&pool->lock); + INIT_LIST_HEAD(&pool->free); + +diff --git a/drivers/mfd/arizona-core.c b/drivers/mfd/arizona-core.c +index 4a31907a4525f..3ff872c205eeb 100644 +--- a/drivers/mfd/arizona-core.c ++++ b/drivers/mfd/arizona-core.c +@@ -1430,6 +1430,15 @@ err_irq: + arizona_irq_exit(arizona); + err_pm: + pm_runtime_disable(arizona->dev); ++ ++ switch (arizona->pdata.clk32k_src) { ++ case ARIZONA_32KZ_MCLK1: ++ case ARIZONA_32KZ_MCLK2: ++ arizona_clk32k_disable(arizona); ++ break; ++ default: ++ break; ++ } + err_reset: + arizona_enable_reset(arizona); + regulator_disable(arizona->dcvdd); +@@ -1452,6 +1461,15 @@ int arizona_dev_exit(struct arizona *arizona) + regulator_disable(arizona->dcvdd); + regulator_put(arizona->dcvdd); + ++ switch (arizona->pdata.clk32k_src) { ++ case ARIZONA_32KZ_MCLK1: ++ case ARIZONA_32KZ_MCLK2: ++ arizona_clk32k_disable(arizona); ++ break; ++ default: ++ break; ++ } ++ + mfd_remove_devices(arizona->dev); + arizona_free_irq(arizona, ARIZONA_IRQ_UNDERCLOCKED, arizona); + arizona_free_irq(arizona, ARIZONA_IRQ_OVERCLOCKED, arizona); +diff --git a/drivers/mfd/dln2.c b/drivers/mfd/dln2.c +index 4faa8d2e5d045..707f4287ab4a0 100644 +--- a/drivers/mfd/dln2.c ++++ b/drivers/mfd/dln2.c +@@ -287,7 +287,11 @@ static void dln2_rx(struct urb *urb) + len = urb->actual_length - sizeof(struct dln2_header); + + if (handle == DLN2_HANDLE_EVENT) { ++ unsigned long flags; ++ ++ spin_lock_irqsave(&dln2->event_cb_lock, flags); + dln2_run_event_callbacks(dln2, id, echo, data, len); ++ spin_unlock_irqrestore(&dln2->event_cb_lock, flags); + } else { + /* URB will be re-submitted in _dln2_transfer (free_rx_slot) */ + if (dln2_transfer_complete(dln2, urb, handle, echo)) +diff --git a/drivers/mmc/host/renesas_sdhi_internal_dmac.c b/drivers/mmc/host/renesas_sdhi_internal_dmac.c +index a66f8d6d61d1b..cb89f0578d425 100644 +--- a/drivers/mmc/host/renesas_sdhi_internal_dmac.c ++++ b/drivers/mmc/host/renesas_sdhi_internal_dmac.c +@@ -229,15 +229,12 @@ static void renesas_sdhi_internal_dmac_issue_tasklet_fn(unsigned long arg) + DTRAN_CTRL_DM_START); + } + +-static void renesas_sdhi_internal_dmac_complete_tasklet_fn(unsigned long arg) ++static bool renesas_sdhi_internal_dmac_complete(struct tmio_mmc_host *host) + { +- struct tmio_mmc_host *host = (struct tmio_mmc_host *)arg; + enum dma_data_direction dir; + +- spin_lock_irq(&host->lock); +- + if (!host->data) +- goto out; ++ return false; + + if (host->data->flags & MMC_DATA_READ) + dir = DMA_FROM_DEVICE; +@@ -250,6 +247,17 @@ static void renesas_sdhi_internal_dmac_complete_tasklet_fn(unsigned long arg) + if (dir == DMA_FROM_DEVICE) + clear_bit(SDHI_INTERNAL_DMAC_RX_IN_USE, &global_flags); + ++ return true; ++} ++ ++static void renesas_sdhi_internal_dmac_complete_tasklet_fn(unsigned long arg) ++{ ++ struct tmio_mmc_host *host = (struct tmio_mmc_host *)arg; ++ ++ spin_lock_irq(&host->lock); ++ if (!renesas_sdhi_internal_dmac_complete(host)) ++ goto out; ++ + tmio_mmc_do_data_irq(host); + out: + spin_unlock_irq(&host->lock); +diff --git a/drivers/mtd/nand/raw/fsl_upm.c b/drivers/mtd/nand/raw/fsl_upm.c +index 1054cc070747e..20b0ee174dc61 100644 +--- a/drivers/mtd/nand/raw/fsl_upm.c ++++ b/drivers/mtd/nand/raw/fsl_upm.c +@@ -62,7 +62,6 @@ static int fun_chip_ready(struct nand_chip *chip) + static void fun_wait_rnb(struct fsl_upm_nand *fun) + { + if (fun->rnb_gpio[fun->mchip_number] >= 0) { +- struct mtd_info *mtd = nand_to_mtd(&fun->chip); + int cnt = 1000000; + + while (--cnt && !fun_chip_ready(&fun->chip)) +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/common.h b/drivers/net/ethernet/marvell/octeontx2/af/common.h +index 413c3f254cf85..c881a573da662 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/common.h ++++ b/drivers/net/ethernet/marvell/octeontx2/af/common.h +@@ -43,7 +43,7 @@ struct qmem { + void *base; + dma_addr_t iova; + int alloc_sz; +- u8 entry_sz; ++ u16 entry_sz; + u8 align; + u32 qsize; + }; +diff --git a/drivers/net/ethernet/qualcomm/emac/emac.c b/drivers/net/ethernet/qualcomm/emac/emac.c +index c84ab052ef265..3eee8df359a12 100644 +--- a/drivers/net/ethernet/qualcomm/emac/emac.c ++++ b/drivers/net/ethernet/qualcomm/emac/emac.c +@@ -485,13 +485,24 @@ static int emac_clks_phase1_init(struct platform_device *pdev, + + ret = clk_prepare_enable(adpt->clk[EMAC_CLK_CFG_AHB]); + if (ret) +- return ret; ++ goto disable_clk_axi; + + ret = clk_set_rate(adpt->clk[EMAC_CLK_HIGH_SPEED], 19200000); + if (ret) +- return ret; ++ goto disable_clk_cfg_ahb; ++ ++ ret = clk_prepare_enable(adpt->clk[EMAC_CLK_HIGH_SPEED]); ++ if (ret) ++ goto disable_clk_cfg_ahb; + +- return clk_prepare_enable(adpt->clk[EMAC_CLK_HIGH_SPEED]); ++ return 0; ++ ++disable_clk_cfg_ahb: ++ clk_disable_unprepare(adpt->clk[EMAC_CLK_CFG_AHB]); ++disable_clk_axi: ++ clk_disable_unprepare(adpt->clk[EMAC_CLK_AXI]); ++ ++ return ret; + } + + /* Enable clocks; needs emac_clks_phase1_init to be called before */ +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c +index 4d75158c64b29..826626e870d5c 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c +@@ -350,6 +350,7 @@ static int ipq806x_gmac_probe(struct platform_device *pdev) + plat_dat->has_gmac = true; + plat_dat->bsp_priv = gmac; + plat_dat->fix_mac_speed = ipq806x_gmac_fix_mac_speed; ++ plat_dat->multicast_filter_bins = 0; + + err = stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res); + if (err) +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c +index bc9b01376e807..1d0b64bd1e1a9 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c +@@ -166,6 +166,9 @@ static void dwmac1000_set_filter(struct mac_device_info *hw, + value = GMAC_FRAME_FILTER_PR | GMAC_FRAME_FILTER_PCF; + } else if (dev->flags & IFF_ALLMULTI) { + value = GMAC_FRAME_FILTER_PM; /* pass all multi */ ++ } else if (!netdev_mc_empty(dev) && (mcbitslog2 == 0)) { ++ /* Fall back to all multicast if we've no filter */ ++ value = GMAC_FRAME_FILTER_PM; + } else if (!netdev_mc_empty(dev)) { + struct netdev_hw_addr *ha; + +diff --git a/drivers/nvdimm/security.c b/drivers/nvdimm/security.c +index 89b85970912db..35d265014e1ec 100644 +--- a/drivers/nvdimm/security.c ++++ b/drivers/nvdimm/security.c +@@ -450,14 +450,19 @@ void __nvdimm_security_overwrite_query(struct nvdimm *nvdimm) + else + dev_dbg(&nvdimm->dev, "overwrite completed\n"); + +- if (nvdimm->sec.overwrite_state) +- sysfs_notify_dirent(nvdimm->sec.overwrite_state); ++ /* ++ * Mark the overwrite work done and update dimm security flags, ++ * then send a sysfs event notification to wake up userspace ++ * poll threads to picked up the changed state. ++ */ + nvdimm->sec.overwrite_tmo = 0; + clear_bit(NDD_SECURITY_OVERWRITE, &nvdimm->flags); + clear_bit(NDD_WORK_PENDING, &nvdimm->flags); +- put_device(&nvdimm->dev); + nvdimm->sec.flags = nvdimm_security_flags(nvdimm, NVDIMM_USER); +- nvdimm->sec.flags = nvdimm_security_flags(nvdimm, NVDIMM_MASTER); ++ nvdimm->sec.ext_flags = nvdimm_security_flags(nvdimm, NVDIMM_MASTER); ++ if (nvdimm->sec.overwrite_state) ++ sysfs_notify_dirent(nvdimm->sec.overwrite_state); ++ put_device(&nvdimm->dev); + } + + void nvdimm_security_overwrite_query(struct work_struct *work) +diff --git a/drivers/pci/bus.c b/drivers/pci/bus.c +index 8e40b3e6da77d..3cef835b375fd 100644 +--- a/drivers/pci/bus.c ++++ b/drivers/pci/bus.c +@@ -322,12 +322,8 @@ void pci_bus_add_device(struct pci_dev *dev) + + dev->match_driver = true; + retval = device_attach(&dev->dev); +- if (retval < 0 && retval != -EPROBE_DEFER) { ++ if (retval < 0 && retval != -EPROBE_DEFER) + pci_warn(dev, "device attach failed (%d)\n", retval); +- pci_proc_detach_device(dev); +- pci_remove_sysfs_dev_files(dev); +- return; +- } + + pci_dev_assign_added(dev, true); + } +diff --git a/drivers/pci/controller/dwc/pcie-qcom.c b/drivers/pci/controller/dwc/pcie-qcom.c +index 70ded8900e285..270d502b8cd50 100644 +--- a/drivers/pci/controller/dwc/pcie-qcom.c ++++ b/drivers/pci/controller/dwc/pcie-qcom.c +@@ -45,7 +45,13 @@ + #define PCIE_CAP_CPL_TIMEOUT_DISABLE 0x10 + + #define PCIE20_PARF_PHY_CTRL 0x40 ++#define PHY_CTRL_PHY_TX0_TERM_OFFSET_MASK GENMASK(20, 16) ++#define PHY_CTRL_PHY_TX0_TERM_OFFSET(x) ((x) << 16) ++ + #define PCIE20_PARF_PHY_REFCLK 0x4C ++#define PHY_REFCLK_SSP_EN BIT(16) ++#define PHY_REFCLK_USE_PAD BIT(12) ++ + #define PCIE20_PARF_DBI_BASE_ADDR 0x168 + #define PCIE20_PARF_SLV_ADDR_SPACE_SIZE 0x16C + #define PCIE20_PARF_MHI_CLOCK_RESET_CTRL 0x174 +@@ -76,6 +82,18 @@ + #define DBI_RO_WR_EN 1 + + #define PERST_DELAY_US 1000 ++/* PARF registers */ ++#define PCIE20_PARF_PCS_DEEMPH 0x34 ++#define PCS_DEEMPH_TX_DEEMPH_GEN1(x) ((x) << 16) ++#define PCS_DEEMPH_TX_DEEMPH_GEN2_3_5DB(x) ((x) << 8) ++#define PCS_DEEMPH_TX_DEEMPH_GEN2_6DB(x) ((x) << 0) ++ ++#define PCIE20_PARF_PCS_SWING 0x38 ++#define PCS_SWING_TX_SWING_FULL(x) ((x) << 8) ++#define PCS_SWING_TX_SWING_LOW(x) ((x) << 0) ++ ++#define PCIE20_PARF_CONFIG_BITS 0x50 ++#define PHY_RX0_EQ(x) ((x) << 24) + + #define PCIE20_v3_PARF_SLV_ADDR_SPACE_SIZE 0x358 + #define SLV_ADDR_SPACE_SZ 0x10000000 +@@ -275,6 +293,7 @@ static int qcom_pcie_init_2_1_0(struct qcom_pcie *pcie) + struct qcom_pcie_resources_2_1_0 *res = &pcie->res.v2_1_0; + struct dw_pcie *pci = pcie->pci; + struct device *dev = pci->dev; ++ struct device_node *node = dev->of_node; + u32 val; + int ret; + +@@ -319,9 +338,29 @@ static int qcom_pcie_init_2_1_0(struct qcom_pcie *pcie) + val &= ~BIT(0); + writel(val, pcie->parf + PCIE20_PARF_PHY_CTRL); + ++ if (of_device_is_compatible(node, "qcom,pcie-ipq8064")) { ++ writel(PCS_DEEMPH_TX_DEEMPH_GEN1(24) | ++ PCS_DEEMPH_TX_DEEMPH_GEN2_3_5DB(24) | ++ PCS_DEEMPH_TX_DEEMPH_GEN2_6DB(34), ++ pcie->parf + PCIE20_PARF_PCS_DEEMPH); ++ writel(PCS_SWING_TX_SWING_FULL(120) | ++ PCS_SWING_TX_SWING_LOW(120), ++ pcie->parf + PCIE20_PARF_PCS_SWING); ++ writel(PHY_RX0_EQ(4), pcie->parf + PCIE20_PARF_CONFIG_BITS); ++ } ++ ++ if (of_device_is_compatible(node, "qcom,pcie-ipq8064")) { ++ /* set TX termination offset */ ++ val = readl(pcie->parf + PCIE20_PARF_PHY_CTRL); ++ val &= ~PHY_CTRL_PHY_TX0_TERM_OFFSET_MASK; ++ val |= PHY_CTRL_PHY_TX0_TERM_OFFSET(7); ++ writel(val, pcie->parf + PCIE20_PARF_PHY_CTRL); ++ } ++ + /* enable external reference clock */ + val = readl(pcie->parf + PCIE20_PARF_PHY_REFCLK); +- val |= BIT(16); ++ val &= ~PHY_REFCLK_USE_PAD; ++ val |= PHY_REFCLK_SSP_EN; + writel(val, pcie->parf + PCIE20_PARF_PHY_REFCLK); + + ret = reset_control_deassert(res->phy_reset); +diff --git a/drivers/pci/hotplug/acpiphp_glue.c b/drivers/pci/hotplug/acpiphp_glue.c +index b3869951c0eb7..6e60b4b1bf53b 100644 +--- a/drivers/pci/hotplug/acpiphp_glue.c ++++ b/drivers/pci/hotplug/acpiphp_glue.c +@@ -122,13 +122,21 @@ static struct acpiphp_context *acpiphp_grab_context(struct acpi_device *adev) + struct acpiphp_context *context; + + acpi_lock_hp_context(); ++ + context = acpiphp_get_context(adev); +- if (!context || context->func.parent->is_going_away) { +- acpi_unlock_hp_context(); +- return NULL; ++ if (!context) ++ goto unlock; ++ ++ if (context->func.parent->is_going_away) { ++ acpiphp_put_context(context); ++ context = NULL; ++ goto unlock; + } ++ + get_bridge(context->func.parent); + acpiphp_put_context(context); ++ ++unlock: + acpi_unlock_hp_context(); + return context; + } +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index 9bc0f321aaf0e..c98067579e9f3 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -5208,7 +5208,8 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_SERVERWORKS, 0x0422, quirk_no_ext_tags); + */ + static void quirk_amd_harvest_no_ats(struct pci_dev *pdev) + { +- if (pdev->device == 0x7340 && pdev->revision != 0xc5) ++ if ((pdev->device == 0x7312 && pdev->revision != 0x00) || ++ (pdev->device == 0x7340 && pdev->revision != 0xc5)) + return; + + pci_info(pdev, "disabling ATS\n"); +@@ -5219,6 +5220,8 @@ static void quirk_amd_harvest_no_ats(struct pci_dev *pdev) + DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x98e4, quirk_amd_harvest_no_ats); + /* AMD Iceland dGPU */ + DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x6900, quirk_amd_harvest_no_ats); ++/* AMD Navi10 dGPU */ ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x7312, quirk_amd_harvest_no_ats); + /* AMD Navi14 dGPU */ + DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x7340, quirk_amd_harvest_no_ats); + #endif /* CONFIG_PCI_ATS */ +diff --git a/drivers/pinctrl/pinctrl-ingenic.c b/drivers/pinctrl/pinctrl-ingenic.c +index 6e2683016c1f0..8bd0a078bfc47 100644 +--- a/drivers/pinctrl/pinctrl-ingenic.c ++++ b/drivers/pinctrl/pinctrl-ingenic.c +@@ -1500,9 +1500,9 @@ static void ingenic_gpio_irq_ack(struct irq_data *irqd) + */ + high = ingenic_gpio_get_value(jzgc, irq); + if (high) +- irq_set_type(jzgc, irq, IRQ_TYPE_EDGE_FALLING); ++ irq_set_type(jzgc, irq, IRQ_TYPE_LEVEL_LOW); + else +- irq_set_type(jzgc, irq, IRQ_TYPE_EDGE_RISING); ++ irq_set_type(jzgc, irq, IRQ_TYPE_LEVEL_HIGH); + } + + if (jzgc->jzpc->version >= ID_JZ4760) +@@ -1538,7 +1538,7 @@ static int ingenic_gpio_irq_set_type(struct irq_data *irqd, unsigned int type) + */ + bool high = ingenic_gpio_get_value(jzgc, irqd->hwirq); + +- type = high ? IRQ_TYPE_EDGE_FALLING : IRQ_TYPE_EDGE_RISING; ++ type = high ? IRQ_TYPE_LEVEL_LOW : IRQ_TYPE_LEVEL_HIGH; + } + + irq_set_type(jzgc, irqd->hwirq, type); +@@ -1644,7 +1644,8 @@ static int ingenic_gpio_get_direction(struct gpio_chip *gc, unsigned int offset) + unsigned int pin = gc->base + offset; + + if (jzpc->version >= ID_JZ4760) +- return ingenic_get_pin_config(jzpc, pin, JZ4760_GPIO_PAT1); ++ return ingenic_get_pin_config(jzpc, pin, JZ4760_GPIO_INT) || ++ ingenic_get_pin_config(jzpc, pin, JZ4760_GPIO_PAT1); + + if (ingenic_get_pin_config(jzpc, pin, JZ4740_GPIO_SELECT)) + return true; +diff --git a/drivers/platform/chrome/cros_ec_ishtp.c b/drivers/platform/chrome/cros_ec_ishtp.c +index 25ca2c894b4de..ab0662a33b41a 100644 +--- a/drivers/platform/chrome/cros_ec_ishtp.c ++++ b/drivers/platform/chrome/cros_ec_ishtp.c +@@ -645,8 +645,10 @@ static int cros_ec_ishtp_probe(struct ishtp_cl_device *cl_device) + + /* Register croc_ec_dev mfd */ + rv = cros_ec_dev_init(client_data); +- if (rv) ++ if (rv) { ++ down_write(&init_lock); + goto end_cros_ec_dev_init_error; ++ } + + return 0; + +diff --git a/drivers/pwm/pwm-bcm-iproc.c b/drivers/pwm/pwm-bcm-iproc.c +index 1f829edd8ee70..d392a828fc493 100644 +--- a/drivers/pwm/pwm-bcm-iproc.c ++++ b/drivers/pwm/pwm-bcm-iproc.c +@@ -85,8 +85,6 @@ static void iproc_pwmc_get_state(struct pwm_chip *chip, struct pwm_device *pwm, + u64 tmp, multi, rate; + u32 value, prescale; + +- rate = clk_get_rate(ip->clk); +- + value = readl(ip->base + IPROC_PWM_CTRL_OFFSET); + + if (value & BIT(IPROC_PWM_CTRL_EN_SHIFT(pwm->hwpwm))) +@@ -99,6 +97,13 @@ static void iproc_pwmc_get_state(struct pwm_chip *chip, struct pwm_device *pwm, + else + state->polarity = PWM_POLARITY_INVERSED; + ++ rate = clk_get_rate(ip->clk); ++ if (rate == 0) { ++ state->period = 0; ++ state->duty_cycle = 0; ++ return; ++ } ++ + value = readl(ip->base + IPROC_PWM_PRESCALE_OFFSET); + prescale = value >> IPROC_PWM_PRESCALE_SHIFT(pwm->hwpwm); + prescale &= IPROC_PWM_PRESCALE_MAX; +diff --git a/drivers/remoteproc/qcom_q6v5.c b/drivers/remoteproc/qcom_q6v5.c +index cb0f4a0be0322..eaeb6aee6da5c 100644 +--- a/drivers/remoteproc/qcom_q6v5.c ++++ b/drivers/remoteproc/qcom_q6v5.c +@@ -151,6 +151,8 @@ int qcom_q6v5_request_stop(struct qcom_q6v5 *q6v5) + { + int ret; + ++ q6v5->running = false; ++ + qcom_smem_state_update_bits(q6v5->state, + BIT(q6v5->stop_bit), BIT(q6v5->stop_bit)); + +diff --git a/drivers/remoteproc/qcom_q6v5_mss.c b/drivers/remoteproc/qcom_q6v5_mss.c +index d84e9f306086b..a67c55785b4de 100644 +--- a/drivers/remoteproc/qcom_q6v5_mss.c ++++ b/drivers/remoteproc/qcom_q6v5_mss.c +@@ -381,6 +381,12 @@ static int q6v5_load(struct rproc *rproc, const struct firmware *fw) + { + struct q6v5 *qproc = rproc->priv; + ++ /* MBA is restricted to a maximum size of 1M */ ++ if (fw->size > qproc->mba_size || fw->size > SZ_1M) { ++ dev_err(qproc->dev, "MBA firmware load failed\n"); ++ return -EINVAL; ++ } ++ + memcpy(qproc->mba_region, fw->data, fw->size); + + return 0; +@@ -1028,15 +1034,14 @@ static int q6v5_mpss_load(struct q6v5 *qproc) + } else if (phdr->p_filesz) { + /* Replace "xxx.xxx" with "xxx.bxx" */ + sprintf(fw_name + fw_name_len - 3, "b%02d", i); +- ret = request_firmware(&seg_fw, fw_name, qproc->dev); ++ ret = request_firmware_into_buf(&seg_fw, fw_name, qproc->dev, ++ ptr, phdr->p_filesz); + if (ret) { + dev_err(qproc->dev, "failed to load %s\n", fw_name); + iounmap(ptr); + goto release_firmware; + } + +- memcpy(ptr, seg_fw->data, seg_fw->size); +- + release_firmware(seg_fw); + } + +diff --git a/drivers/scsi/lpfc/lpfc_nvmet.c b/drivers/scsi/lpfc/lpfc_nvmet.c +index 9884228800a50..f14394ab0e037 100644 +--- a/drivers/scsi/lpfc/lpfc_nvmet.c ++++ b/drivers/scsi/lpfc/lpfc_nvmet.c +@@ -1923,7 +1923,7 @@ lpfc_nvmet_destroy_targetport(struct lpfc_hba *phba) + } + tgtp->tport_unreg_cmp = &tport_unreg_cmp; + nvmet_fc_unregister_targetport(phba->targetport); +- if (!wait_for_completion_timeout(tgtp->tport_unreg_cmp, ++ if (!wait_for_completion_timeout(&tport_unreg_cmp, + msecs_to_jiffies(LPFC_NVMET_WAIT_TMO))) + lpfc_printf_log(phba, KERN_ERR, LOG_NVME, + "6179 Unreg targetport x%px timeout " +diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c +index 9ad44a96dfe3a..33f1cca7eaa61 100644 +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -2480,12 +2480,11 @@ static int ftdi_prepare_write_buffer(struct usb_serial_port *port, + #define FTDI_RS_ERR_MASK (FTDI_RS_BI | FTDI_RS_PE | FTDI_RS_FE | FTDI_RS_OE) + + static int ftdi_process_packet(struct usb_serial_port *port, +- struct ftdi_private *priv, char *packet, int len) ++ struct ftdi_private *priv, unsigned char *buf, int len) + { ++ unsigned char status; + int i; +- char status; + char flag; +- char *ch; + + if (len < 2) { + dev_dbg(&port->dev, "malformed packet\n"); +@@ -2495,7 +2494,7 @@ static int ftdi_process_packet(struct usb_serial_port *port, + /* Compare new line status to the old one, signal if different/ + N.B. packet may be processed more than once, but differences + are only processed once. */ +- status = packet[0] & FTDI_STATUS_B0_MASK; ++ status = buf[0] & FTDI_STATUS_B0_MASK; + if (status != priv->prev_status) { + char diff_status = status ^ priv->prev_status; + +@@ -2521,13 +2520,12 @@ static int ftdi_process_packet(struct usb_serial_port *port, + } + + /* save if the transmitter is empty or not */ +- if (packet[1] & FTDI_RS_TEMT) ++ if (buf[1] & FTDI_RS_TEMT) + priv->transmit_empty = 1; + else + priv->transmit_empty = 0; + +- len -= 2; +- if (!len) ++ if (len == 2) + return 0; /* status only */ + + /* +@@ -2535,40 +2533,41 @@ static int ftdi_process_packet(struct usb_serial_port *port, + * data payload to avoid over-reporting. + */ + flag = TTY_NORMAL; +- if (packet[1] & FTDI_RS_ERR_MASK) { ++ if (buf[1] & FTDI_RS_ERR_MASK) { + /* Break takes precedence over parity, which takes precedence + * over framing errors */ +- if (packet[1] & FTDI_RS_BI) { ++ if (buf[1] & FTDI_RS_BI) { + flag = TTY_BREAK; + port->icount.brk++; + usb_serial_handle_break(port); +- } else if (packet[1] & FTDI_RS_PE) { ++ } else if (buf[1] & FTDI_RS_PE) { + flag = TTY_PARITY; + port->icount.parity++; +- } else if (packet[1] & FTDI_RS_FE) { ++ } else if (buf[1] & FTDI_RS_FE) { + flag = TTY_FRAME; + port->icount.frame++; + } + /* Overrun is special, not associated with a char */ +- if (packet[1] & FTDI_RS_OE) { ++ if (buf[1] & FTDI_RS_OE) { + port->icount.overrun++; + tty_insert_flip_char(&port->port, 0, TTY_OVERRUN); + } + } + +- port->icount.rx += len; +- ch = packet + 2; ++ port->icount.rx += len - 2; + + if (port->port.console && port->sysrq) { +- for (i = 0; i < len; i++, ch++) { +- if (!usb_serial_handle_sysrq_char(port, *ch)) +- tty_insert_flip_char(&port->port, *ch, flag); ++ for (i = 2; i < len; i++) { ++ if (usb_serial_handle_sysrq_char(port, buf[i])) ++ continue; ++ tty_insert_flip_char(&port->port, buf[i], flag); + } + } else { +- tty_insert_flip_string_fixed_flag(&port->port, ch, flag, len); ++ tty_insert_flip_string_fixed_flag(&port->port, buf + 2, flag, ++ len - 2); + } + +- return len; ++ return len - 2; + } + + static void ftdi_process_read_urb(struct urb *urb) +diff --git a/drivers/watchdog/f71808e_wdt.c b/drivers/watchdog/f71808e_wdt.c +index e46104c2fd94e..893cef70c1599 100644 +--- a/drivers/watchdog/f71808e_wdt.c ++++ b/drivers/watchdog/f71808e_wdt.c +@@ -689,9 +689,9 @@ static int __init watchdog_init(int sioaddr) + * into the module have been registered yet. + */ + watchdog.sioaddr = sioaddr; +- watchdog.ident.options = WDIOC_SETTIMEOUT +- | WDIOF_MAGICCLOSE +- | WDIOF_KEEPALIVEPING; ++ watchdog.ident.options = WDIOF_MAGICCLOSE ++ | WDIOF_KEEPALIVEPING ++ | WDIOF_CARDRESET; + + snprintf(watchdog.ident.identity, + sizeof(watchdog.ident.identity), "%s watchdog", +@@ -705,6 +705,13 @@ static int __init watchdog_init(int sioaddr) + wdt_conf = superio_inb(sioaddr, F71808FG_REG_WDT_CONF); + watchdog.caused_reboot = wdt_conf & BIT(F71808FG_FLAG_WDTMOUT_STS); + ++ /* ++ * We don't want WDTMOUT_STS to stick around till regular reboot. ++ * Write 1 to the bit to clear it to zero. ++ */ ++ superio_outb(sioaddr, F71808FG_REG_WDT_CONF, ++ wdt_conf | BIT(F71808FG_FLAG_WDTMOUT_STS)); ++ + superio_exit(sioaddr); + + err = watchdog_set_timeout(timeout); +diff --git a/drivers/watchdog/watchdog_dev.c b/drivers/watchdog/watchdog_dev.c +index c4147e93aa7d4..3729f99fd8eca 100644 +--- a/drivers/watchdog/watchdog_dev.c ++++ b/drivers/watchdog/watchdog_dev.c +@@ -974,6 +974,15 @@ static int watchdog_cdev_register(struct watchdog_device *wdd) + if (IS_ERR_OR_NULL(watchdog_kworker)) + return -ENODEV; + ++ device_initialize(&wd_data->dev); ++ wd_data->dev.devt = MKDEV(MAJOR(watchdog_devt), wdd->id); ++ wd_data->dev.class = &watchdog_class; ++ wd_data->dev.parent = wdd->parent; ++ wd_data->dev.groups = wdd->groups; ++ wd_data->dev.release = watchdog_core_data_release; ++ dev_set_drvdata(&wd_data->dev, wdd); ++ dev_set_name(&wd_data->dev, "watchdog%d", wdd->id); ++ + kthread_init_work(&wd_data->work, watchdog_ping_work); + hrtimer_init(&wd_data->timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL_HARD); + wd_data->timer.function = watchdog_timer_expired; +@@ -994,15 +1003,6 @@ static int watchdog_cdev_register(struct watchdog_device *wdd) + } + } + +- device_initialize(&wd_data->dev); +- wd_data->dev.devt = MKDEV(MAJOR(watchdog_devt), wdd->id); +- wd_data->dev.class = &watchdog_class; +- wd_data->dev.parent = wdd->parent; +- wd_data->dev.groups = wdd->groups; +- wd_data->dev.release = watchdog_core_data_release; +- dev_set_drvdata(&wd_data->dev, wdd); +- dev_set_name(&wd_data->dev, "watchdog%d", wdd->id); +- + /* Fill in the data structures */ + cdev_init(&wd_data->cdev, &watchdog_fops); + +diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h +index 36cd210ee2ef7..2374f3f6f3b70 100644 +--- a/fs/btrfs/ctree.h ++++ b/fs/btrfs/ctree.h +@@ -990,8 +990,10 @@ struct btrfs_root { + wait_queue_head_t log_writer_wait; + wait_queue_head_t log_commit_wait[2]; + struct list_head log_ctxs[2]; ++ /* Used only for log trees of subvolumes, not for the log root tree */ + atomic_t log_writers; + atomic_t log_commit[2]; ++ /* Used only for log trees of subvolumes, not for the log root tree */ + atomic_t log_batch; + int log_transid; + /* No matter the commit succeeds or not*/ +@@ -3164,7 +3166,7 @@ do { \ + /* Report first abort since mount */ \ + if (!test_and_set_bit(BTRFS_FS_STATE_TRANS_ABORTED, \ + &((trans)->fs_info->fs_state))) { \ +- if ((errno) != -EIO) { \ ++ if ((errno) != -EIO && (errno) != -EROFS) { \ + WARN(1, KERN_DEBUG \ + "BTRFS: Transaction aborted (error %d)\n", \ + (errno)); \ +diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c +index 273d1ccdd45df..ad1c8e3b8133a 100644 +--- a/fs/btrfs/disk-io.c ++++ b/fs/btrfs/disk-io.c +@@ -1475,9 +1475,16 @@ int btrfs_init_fs_root(struct btrfs_root *root) + spin_lock_init(&root->ino_cache_lock); + init_waitqueue_head(&root->ino_cache_wait); + +- ret = get_anon_bdev(&root->anon_dev); +- if (ret) +- goto fail; ++ /* ++ * Don't assign anonymous block device to roots that are not exposed to ++ * userspace, the id pool is limited to 1M ++ */ ++ if (is_fstree(root->root_key.objectid) && ++ btrfs_root_refs(&root->root_item) > 0) { ++ ret = get_anon_bdev(&root->anon_dev); ++ if (ret) ++ goto fail; ++ } + + mutex_lock(&root->objectid_mutex); + ret = btrfs_find_highest_objectid(root, +diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c +index 47ecf7216b3e5..739332b462059 100644 +--- a/fs/btrfs/extent-tree.c ++++ b/fs/btrfs/extent-tree.c +@@ -5221,7 +5221,14 @@ int btrfs_drop_snapshot(struct btrfs_root *root, + goto out; + } + +- trans = btrfs_start_transaction(tree_root, 0); ++ /* ++ * Use join to avoid potential EINTR from transaction start. See ++ * wait_reserve_ticket and the whole reservation callchain. ++ */ ++ if (for_reloc) ++ trans = btrfs_join_transaction(tree_root); ++ else ++ trans = btrfs_start_transaction(tree_root, 0); + if (IS_ERR(trans)) { + err = PTR_ERR(trans); + goto out_free; +diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c +index 99dcb38976592..035ea5bc692ad 100644 +--- a/fs/btrfs/extent_io.c ++++ b/fs/btrfs/extent_io.c +@@ -4467,15 +4467,25 @@ int try_release_extent_mapping(struct page *page, gfp_t mask) + free_extent_map(em); + break; + } +- if (!test_range_bit(tree, em->start, +- extent_map_end(em) - 1, +- EXTENT_LOCKED, 0, NULL)) { ++ if (test_range_bit(tree, em->start, ++ extent_map_end(em) - 1, ++ EXTENT_LOCKED, 0, NULL)) ++ goto next; ++ /* ++ * If it's not in the list of modified extents, used ++ * by a fast fsync, we can remove it. If it's being ++ * logged we can safely remove it since fsync took an ++ * extra reference on the em. ++ */ ++ if (list_empty(&em->list) || ++ test_bit(EXTENT_FLAG_LOGGING, &em->flags)) { + set_bit(BTRFS_INODE_NEEDS_FULL_SYNC, + &btrfs_inode->runtime_flags); + remove_extent_mapping(map, em); + /* once for the rb tree */ + free_extent_map(em); + } ++next: + start = extent_map_end(em); + write_unlock(&map->lock); + +diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c +index d86ada9c3c541..8bfc0f348ad55 100644 +--- a/fs/btrfs/free-space-cache.c ++++ b/fs/btrfs/free-space-cache.c +@@ -2166,7 +2166,7 @@ out: + static bool try_merge_free_space(struct btrfs_free_space_ctl *ctl, + struct btrfs_free_space *info, bool update_stat) + { +- struct btrfs_free_space *left_info; ++ struct btrfs_free_space *left_info = NULL; + struct btrfs_free_space *right_info; + bool merged = false; + u64 offset = info->offset; +@@ -2181,7 +2181,7 @@ static bool try_merge_free_space(struct btrfs_free_space_ctl *ctl, + if (right_info && rb_prev(&right_info->offset_index)) + left_info = rb_entry(rb_prev(&right_info->offset_index), + struct btrfs_free_space, offset_index); +- else ++ else if (!right_info) + left_info = tree_search_offset(ctl, offset - 1, 0, 0); + + if (right_info && !right_info->bitmap) { +diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c +index e408181a5eba3..fa7f3a59813ea 100644 +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -641,12 +641,18 @@ cont: + page_error_op | + PAGE_END_WRITEBACK); + +- for (i = 0; i < nr_pages; i++) { +- WARN_ON(pages[i]->mapping); +- put_page(pages[i]); ++ /* ++ * Ensure we only free the compressed pages if we have ++ * them allocated, as we can still reach here with ++ * inode_need_compress() == false. ++ */ ++ if (pages) { ++ for (i = 0; i < nr_pages; i++) { ++ WARN_ON(pages[i]->mapping); ++ put_page(pages[i]); ++ } ++ kfree(pages); + } +- kfree(pages); +- + return 0; + } + } +@@ -4681,6 +4687,8 @@ int btrfs_delete_subvolume(struct inode *dir, struct dentry *dentry) + } + } + ++ free_anon_bdev(dest->anon_dev); ++ dest->anon_dev = 0; + out_end_trans: + trans->block_rsv = NULL; + trans->bytes_reserved = 0; +@@ -7186,7 +7194,7 @@ struct extent_map *btrfs_get_extent(struct btrfs_inode *inode, + extent_type == BTRFS_FILE_EXTENT_PREALLOC) { + /* Only regular file could have regular/prealloc extent */ + if (!S_ISREG(inode->vfs_inode.i_mode)) { +- ret = -EUCLEAN; ++ err = -EUCLEAN; + btrfs_crit(fs_info, + "regular/prealloc extent found for non-regular inode %llu", + btrfs_ino(inode)); +diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c +index d88b8d8897cc5..88745b5182126 100644 +--- a/fs/btrfs/ioctl.c ++++ b/fs/btrfs/ioctl.c +@@ -167,8 +167,11 @@ static int btrfs_ioctl_getflags(struct file *file, void __user *arg) + return 0; + } + +-/* Check if @flags are a supported and valid set of FS_*_FL flags */ +-static int check_fsflags(unsigned int flags) ++/* ++ * Check if @flags are a supported and valid set of FS_*_FL flags and that ++ * the old and new flags are not conflicting ++ */ ++static int check_fsflags(unsigned int old_flags, unsigned int flags) + { + if (flags & ~(FS_IMMUTABLE_FL | FS_APPEND_FL | \ + FS_NOATIME_FL | FS_NODUMP_FL | \ +@@ -177,9 +180,19 @@ static int check_fsflags(unsigned int flags) + FS_NOCOW_FL)) + return -EOPNOTSUPP; + ++ /* COMPR and NOCOMP on new/old are valid */ + if ((flags & FS_NOCOMP_FL) && (flags & FS_COMPR_FL)) + return -EINVAL; + ++ if ((flags & FS_COMPR_FL) && (flags & FS_NOCOW_FL)) ++ return -EINVAL; ++ ++ /* NOCOW and compression options are mutually exclusive */ ++ if ((old_flags & FS_NOCOW_FL) && (flags & (FS_COMPR_FL | FS_NOCOMP_FL))) ++ return -EINVAL; ++ if ((flags & FS_NOCOW_FL) && (old_flags & (FS_COMPR_FL | FS_NOCOMP_FL))) ++ return -EINVAL; ++ + return 0; + } + +@@ -193,7 +206,7 @@ static int btrfs_ioctl_setflags(struct file *file, void __user *arg) + unsigned int fsflags, old_fsflags; + int ret; + const char *comp = NULL; +- u32 binode_flags = binode->flags; ++ u32 binode_flags; + + if (!inode_owner_or_capable(inode)) + return -EPERM; +@@ -204,22 +217,23 @@ static int btrfs_ioctl_setflags(struct file *file, void __user *arg) + if (copy_from_user(&fsflags, arg, sizeof(fsflags))) + return -EFAULT; + +- ret = check_fsflags(fsflags); +- if (ret) +- return ret; +- + ret = mnt_want_write_file(file); + if (ret) + return ret; + + inode_lock(inode); +- + fsflags = btrfs_mask_fsflags_for_type(inode, fsflags); + old_fsflags = btrfs_inode_flags_to_fsflags(binode->flags); ++ + ret = vfs_ioc_setflags_prepare(inode, old_fsflags, fsflags); + if (ret) + goto out_unlock; + ++ ret = check_fsflags(old_fsflags, fsflags); ++ if (ret) ++ goto out_unlock; ++ ++ binode_flags = binode->flags; + if (fsflags & FS_SYNC_FL) + binode_flags |= BTRFS_INODE_SYNC; + else +diff --git a/fs/btrfs/ref-verify.c b/fs/btrfs/ref-verify.c +index 454a1015d026b..9a2f15f4c80e0 100644 +--- a/fs/btrfs/ref-verify.c ++++ b/fs/btrfs/ref-verify.c +@@ -286,6 +286,8 @@ static struct block_entry *add_block_entry(struct btrfs_fs_info *fs_info, + exist_re = insert_root_entry(&exist->roots, re); + if (exist_re) + kfree(re); ++ } else { ++ kfree(re); + } + kfree(be); + return exist; +diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c +index 1b087ee338ccb..af3605a0bf2e0 100644 +--- a/fs/btrfs/relocation.c ++++ b/fs/btrfs/relocation.c +@@ -2312,12 +2312,20 @@ static noinline_for_stack int merge_reloc_root(struct reloc_control *rc, + btrfs_unlock_up_safe(path, 0); + } + +- min_reserved = fs_info->nodesize * (BTRFS_MAX_LEVEL - 1) * 2; ++ /* ++ * In merge_reloc_root(), we modify the upper level pointer to swap the ++ * tree blocks between reloc tree and subvolume tree. Thus for tree ++ * block COW, we COW at most from level 1 to root level for each tree. ++ * ++ * Thus the needed metadata size is at most root_level * nodesize, ++ * and * 2 since we have two trees to COW. ++ */ ++ min_reserved = fs_info->nodesize * btrfs_root_level(root_item) * 2; + memset(&next_key, 0, sizeof(next_key)); + + while (1) { + ret = btrfs_block_rsv_refill(root, rc->block_rsv, min_reserved, +- BTRFS_RESERVE_FLUSH_ALL); ++ BTRFS_RESERVE_FLUSH_LIMIT); + if (ret) { + err = ret; + goto out; +diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c +index aea24202cd355..4b0ee34aa65d5 100644 +--- a/fs/btrfs/super.c ++++ b/fs/btrfs/super.c +@@ -435,6 +435,7 @@ int btrfs_parse_options(struct btrfs_fs_info *info, char *options, + char *compress_type; + bool compress_force = false; + enum btrfs_compression_type saved_compress_type; ++ int saved_compress_level; + bool saved_compress_force; + int no_compress = 0; + +@@ -517,6 +518,7 @@ int btrfs_parse_options(struct btrfs_fs_info *info, char *options, + info->compress_type : BTRFS_COMPRESS_NONE; + saved_compress_force = + btrfs_test_opt(info, FORCE_COMPRESS); ++ saved_compress_level = info->compress_level; + if (token == Opt_compress || + token == Opt_compress_force || + strncmp(args[0].from, "zlib", 4) == 0) { +@@ -561,6 +563,8 @@ int btrfs_parse_options(struct btrfs_fs_info *info, char *options, + no_compress = 0; + } else if (strncmp(args[0].from, "no", 2) == 0) { + compress_type = "no"; ++ info->compress_level = 0; ++ info->compress_type = 0; + btrfs_clear_opt(info->mount_opt, COMPRESS); + btrfs_clear_opt(info->mount_opt, FORCE_COMPRESS); + compress_force = false; +@@ -581,11 +585,11 @@ int btrfs_parse_options(struct btrfs_fs_info *info, char *options, + */ + btrfs_clear_opt(info->mount_opt, FORCE_COMPRESS); + } +- if ((btrfs_test_opt(info, COMPRESS) && +- (info->compress_type != saved_compress_type || +- compress_force != saved_compress_force)) || +- (!btrfs_test_opt(info, COMPRESS) && +- no_compress == 1)) { ++ if (no_compress == 1) { ++ btrfs_info(info, "use no compression"); ++ } else if ((info->compress_type != saved_compress_type) || ++ (compress_force != saved_compress_force) || ++ (info->compress_level != saved_compress_level)) { + btrfs_info(info, "%s %s compression, level %d", + (compress_force) ? "force" : "use", + compress_type, info->compress_level); +@@ -1848,6 +1852,12 @@ static int btrfs_remount(struct super_block *sb, int *flags, char *data) + set_bit(BTRFS_FS_OPEN, &fs_info->flags); + } + out: ++ /* ++ * We need to set SB_I_VERSION here otherwise it'll get cleared by VFS, ++ * since the absence of the flag means it can be toggled off by remount. ++ */ ++ *flags |= SB_I_VERSION; ++ + wake_up_process(fs_info->transaction_kthread); + btrfs_remount_cleanup(fs_info, old_opts); + return 0; +@@ -2254,9 +2264,7 @@ static int btrfs_unfreeze(struct super_block *sb) + static int btrfs_show_devname(struct seq_file *m, struct dentry *root) + { + struct btrfs_fs_info *fs_info = btrfs_sb(root->d_sb); +- struct btrfs_fs_devices *cur_devices; + struct btrfs_device *dev, *first_dev = NULL; +- struct list_head *head; + + /* + * Lightweight locking of the devices. We should not need +@@ -2266,18 +2274,13 @@ static int btrfs_show_devname(struct seq_file *m, struct dentry *root) + * least until the rcu_read_unlock. + */ + rcu_read_lock(); +- cur_devices = fs_info->fs_devices; +- while (cur_devices) { +- head = &cur_devices->devices; +- list_for_each_entry_rcu(dev, head, dev_list) { +- if (test_bit(BTRFS_DEV_STATE_MISSING, &dev->dev_state)) +- continue; +- if (!dev->name) +- continue; +- if (!first_dev || dev->devid < first_dev->devid) +- first_dev = dev; +- } +- cur_devices = cur_devices->seed; ++ list_for_each_entry_rcu(dev, &fs_info->fs_devices->devices, dev_list) { ++ if (test_bit(BTRFS_DEV_STATE_MISSING, &dev->dev_state)) ++ continue; ++ if (!dev->name) ++ continue; ++ if (!first_dev || dev->devid < first_dev->devid) ++ first_dev = dev; + } + + if (first_dev) +diff --git a/fs/btrfs/sysfs.c b/fs/btrfs/sysfs.c +index f6d3c80f2e289..5c299e1f2297e 100644 +--- a/fs/btrfs/sysfs.c ++++ b/fs/btrfs/sysfs.c +@@ -975,7 +975,9 @@ int btrfs_sysfs_add_device_link(struct btrfs_fs_devices *fs_devices, + { + int error = 0; + struct btrfs_device *dev; ++ unsigned int nofs_flag; + ++ nofs_flag = memalloc_nofs_save(); + list_for_each_entry(dev, &fs_devices->devices, dev_list) { + struct hd_struct *disk; + struct kobject *disk_kobj; +@@ -994,6 +996,7 @@ int btrfs_sysfs_add_device_link(struct btrfs_fs_devices *fs_devices, + if (error) + break; + } ++ memalloc_nofs_restore(nofs_flag); + + return error; + } +diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c +index f46afbff668eb..3c090549ed07d 100644 +--- a/fs/btrfs/tree-log.c ++++ b/fs/btrfs/tree-log.c +@@ -3140,29 +3140,17 @@ int btrfs_sync_log(struct btrfs_trans_handle *trans, + btrfs_init_log_ctx(&root_log_ctx, NULL); + + mutex_lock(&log_root_tree->log_mutex); +- atomic_inc(&log_root_tree->log_batch); +- atomic_inc(&log_root_tree->log_writers); + + index2 = log_root_tree->log_transid % 2; + list_add_tail(&root_log_ctx.list, &log_root_tree->log_ctxs[index2]); + root_log_ctx.log_transid = log_root_tree->log_transid; + +- mutex_unlock(&log_root_tree->log_mutex); +- +- mutex_lock(&log_root_tree->log_mutex); +- + /* + * Now we are safe to update the log_root_tree because we're under the + * log_mutex, and we're a current writer so we're holding the commit + * open until we drop the log_mutex. + */ + ret = update_log_root(trans, log, &new_root_item); +- +- if (atomic_dec_and_test(&log_root_tree->log_writers)) { +- /* atomic_dec_and_test implies a barrier */ +- cond_wake_up_nomb(&log_root_tree->log_writer_wait); +- } +- + if (ret) { + if (!list_empty(&root_log_ctx.list)) + list_del_init(&root_log_ctx.list); +@@ -3208,8 +3196,6 @@ int btrfs_sync_log(struct btrfs_trans_handle *trans, + root_log_ctx.log_transid - 1); + } + +- wait_for_writer(log_root_tree); +- + /* + * now that we've moved on to the tree of log tree roots, + * check the full commit flag again +@@ -4054,11 +4040,8 @@ static noinline int copy_items(struct btrfs_trans_handle *trans, + fs_info->csum_root, + ds + cs, ds + cs + cl - 1, + &ordered_sums, 0); +- if (ret) { +- btrfs_release_path(dst_path); +- kfree(ins_data); +- return ret; +- } ++ if (ret) ++ break; + } + } + } +@@ -4071,7 +4054,6 @@ static noinline int copy_items(struct btrfs_trans_handle *trans, + * we have to do this after the loop above to avoid changing the + * log tree while trying to change the log tree. + */ +- ret = 0; + while (!list_empty(&ordered_sums)) { + struct btrfs_ordered_sum *sums = list_entry(ordered_sums.next, + struct btrfs_ordered_sum, +diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c +index 1e6e3c1d97dfa..196ddbcd29360 100644 +--- a/fs/btrfs/volumes.c ++++ b/fs/btrfs/volumes.c +@@ -219,7 +219,9 @@ static int __btrfs_map_block(struct btrfs_fs_info *fs_info, + * + * global::fs_devs - add, remove, updates to the global list + * +- * does not protect: manipulation of the fs_devices::devices list! ++ * does not protect: manipulation of the fs_devices::devices list in general ++ * but in mount context it could be used to exclude list modifications by eg. ++ * scan ioctl + * + * btrfs_device::name - renames (write side), read is RCU + * +@@ -232,6 +234,9 @@ static int __btrfs_map_block(struct btrfs_fs_info *fs_info, + * may be used to exclude some operations from running concurrently without any + * modifications to the list (see write_all_supers) + * ++ * Is not required at mount and close times, because our device list is ++ * protected by the uuid_mutex at that point. ++ * + * balance_mutex + * ------------- + * protects balance structures (status, state) and context accessed from +@@ -778,6 +783,11 @@ static int btrfs_free_stale_devices(const char *path, + return ret; + } + ++/* ++ * This is only used on mount, and we are protected from competing things ++ * messing with our fs_devices by the uuid_mutex, thus we do not need the ++ * fs_devices->device_list_mutex here. ++ */ + static int btrfs_open_one_device(struct btrfs_fs_devices *fs_devices, + struct btrfs_device *device, fmode_t flags, + void *holder) +@@ -1418,8 +1428,14 @@ int btrfs_open_devices(struct btrfs_fs_devices *fs_devices, + int ret; + + lockdep_assert_held(&uuid_mutex); ++ /* ++ * The device_list_mutex cannot be taken here in case opening the ++ * underlying device takes further locks like bd_mutex. ++ * ++ * We also don't need the lock here as this is called during mount and ++ * exclusion is provided by uuid_mutex ++ */ + +- mutex_lock(&fs_devices->device_list_mutex); + if (fs_devices->opened) { + fs_devices->opened++; + ret = 0; +@@ -1427,7 +1443,6 @@ int btrfs_open_devices(struct btrfs_fs_devices *fs_devices, + list_sort(NULL, &fs_devices->devices, devid_cmp); + ret = open_fs_devices(fs_devices, flags, holder); + } +- mutex_unlock(&fs_devices->device_list_mutex); + + return ret; + } +@@ -3283,7 +3298,7 @@ static int insert_balance_item(struct btrfs_fs_info *fs_info, + if (!path) + return -ENOMEM; + +- trans = btrfs_start_transaction(root, 0); ++ trans = btrfs_start_transaction_fallback_global_rsv(root, 0); + if (IS_ERR(trans)) { + btrfs_free_path(path); + return PTR_ERR(trans); +@@ -4246,7 +4261,22 @@ int btrfs_balance(struct btrfs_fs_info *fs_info, + mutex_lock(&fs_info->balance_mutex); + if (ret == -ECANCELED && atomic_read(&fs_info->balance_pause_req)) + btrfs_info(fs_info, "balance: paused"); +- else if (ret == -ECANCELED && atomic_read(&fs_info->balance_cancel_req)) ++ /* ++ * Balance can be canceled by: ++ * ++ * - Regular cancel request ++ * Then ret == -ECANCELED and balance_cancel_req > 0 ++ * ++ * - Fatal signal to "btrfs" process ++ * Either the signal caught by wait_reserve_ticket() and callers ++ * got -EINTR, or caught by btrfs_should_cancel_balance() and ++ * got -ECANCELED. ++ * Either way, in this case balance_cancel_req = 0, and ++ * ret == -EINTR or ret == -ECANCELED. ++ * ++ * So here we only check the return value to catch canceled balance. ++ */ ++ else if (ret == -ECANCELED || ret == -EINTR) + btrfs_info(fs_info, "balance: canceled"); + else + btrfs_info(fs_info, "balance: ended with status: %d", ret); +@@ -7267,7 +7297,6 @@ int btrfs_read_chunk_tree(struct btrfs_fs_info *fs_info) + * otherwise we don't need it. + */ + mutex_lock(&uuid_mutex); +- mutex_lock(&fs_info->chunk_mutex); + + /* + * It is possible for mount and umount to race in such a way that +@@ -7312,7 +7341,9 @@ int btrfs_read_chunk_tree(struct btrfs_fs_info *fs_info) + } else if (found_key.type == BTRFS_CHUNK_ITEM_KEY) { + struct btrfs_chunk *chunk; + chunk = btrfs_item_ptr(leaf, slot, struct btrfs_chunk); ++ mutex_lock(&fs_info->chunk_mutex); + ret = read_one_chunk(&found_key, leaf, chunk); ++ mutex_unlock(&fs_info->chunk_mutex); + if (ret) + goto error; + } +@@ -7342,7 +7373,6 @@ int btrfs_read_chunk_tree(struct btrfs_fs_info *fs_info) + } + ret = 0; + error: +- mutex_unlock(&fs_info->chunk_mutex); + mutex_unlock(&uuid_mutex); + + btrfs_free_path(path); +diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c +index 2e4764fd18727..3367a8194f24b 100644 +--- a/fs/ceph/dir.c ++++ b/fs/ceph/dir.c +@@ -920,6 +920,10 @@ static int ceph_symlink(struct inode *dir, struct dentry *dentry, + req->r_num_caps = 2; + req->r_dentry_drop = CEPH_CAP_FILE_SHARED | CEPH_CAP_AUTH_EXCL; + req->r_dentry_unless = CEPH_CAP_FILE_EXCL; ++ if (as_ctx.pagelist) { ++ req->r_pagelist = as_ctx.pagelist; ++ as_ctx.pagelist = NULL; ++ } + err = ceph_mdsc_do_request(mdsc, dir, req); + if (!err && !req->r_reply_info.head->is_dentry) + err = ceph_handle_notrace_create(dir, dentry); +diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c +index b79fe6549df6f..701bc3f4d4ba1 100644 +--- a/fs/ceph/mds_client.c ++++ b/fs/ceph/mds_client.c +@@ -3091,8 +3091,10 @@ static void handle_session(struct ceph_mds_session *session, + goto bad; + /* version >= 3, feature bits */ + ceph_decode_32_safe(&p, end, len, bad); +- ceph_decode_64_safe(&p, end, features, bad); +- p += len - sizeof(features); ++ if (len) { ++ ceph_decode_64_safe(&p, end, features, bad); ++ p += len - sizeof(features); ++ } + } + + mutex_lock(&mdsc->mutex); +diff --git a/fs/cifs/smb2misc.c b/fs/cifs/smb2misc.c +index 14265b4bbcc00..2fc96f7923ee5 100644 +--- a/fs/cifs/smb2misc.c ++++ b/fs/cifs/smb2misc.c +@@ -509,15 +509,31 @@ cifs_ses_oplock_break(struct work_struct *work) + kfree(lw); + } + ++static void ++smb2_queue_pending_open_break(struct tcon_link *tlink, __u8 *lease_key, ++ __le32 new_lease_state) ++{ ++ struct smb2_lease_break_work *lw; ++ ++ lw = kmalloc(sizeof(struct smb2_lease_break_work), GFP_KERNEL); ++ if (!lw) { ++ cifs_put_tlink(tlink); ++ return; ++ } ++ ++ INIT_WORK(&lw->lease_break, cifs_ses_oplock_break); ++ lw->tlink = tlink; ++ lw->lease_state = new_lease_state; ++ memcpy(lw->lease_key, lease_key, SMB2_LEASE_KEY_SIZE); ++ queue_work(cifsiod_wq, &lw->lease_break); ++} ++ + static bool +-smb2_tcon_has_lease(struct cifs_tcon *tcon, struct smb2_lease_break *rsp, +- struct smb2_lease_break_work *lw) ++smb2_tcon_has_lease(struct cifs_tcon *tcon, struct smb2_lease_break *rsp) + { +- bool found; + __u8 lease_state; + struct list_head *tmp; + struct cifsFileInfo *cfile; +- struct cifs_pending_open *open; + struct cifsInodeInfo *cinode; + int ack_req = le32_to_cpu(rsp->Flags & + SMB2_NOTIFY_BREAK_LEASE_FLAG_ACK_REQUIRED); +@@ -556,22 +572,29 @@ smb2_tcon_has_lease(struct cifs_tcon *tcon, struct smb2_lease_break *rsp, + &cinode->flags); + + cifs_queue_oplock_break(cfile); +- kfree(lw); + return true; + } + +- found = false; ++ return false; ++} ++ ++static struct cifs_pending_open * ++smb2_tcon_find_pending_open_lease(struct cifs_tcon *tcon, ++ struct smb2_lease_break *rsp) ++{ ++ __u8 lease_state = le32_to_cpu(rsp->NewLeaseState); ++ int ack_req = le32_to_cpu(rsp->Flags & ++ SMB2_NOTIFY_BREAK_LEASE_FLAG_ACK_REQUIRED); ++ struct cifs_pending_open *open; ++ struct cifs_pending_open *found = NULL; ++ + list_for_each_entry(open, &tcon->pending_opens, olist) { + if (memcmp(open->lease_key, rsp->LeaseKey, + SMB2_LEASE_KEY_SIZE)) + continue; + + if (!found && ack_req) { +- found = true; +- memcpy(lw->lease_key, open->lease_key, +- SMB2_LEASE_KEY_SIZE); +- lw->tlink = cifs_get_tlink(open->tlink); +- queue_work(cifsiod_wq, &lw->lease_break); ++ found = open; + } + + cifs_dbg(FYI, "found in the pending open list\n"); +@@ -592,14 +615,7 @@ smb2_is_valid_lease_break(char *buffer) + struct TCP_Server_Info *server; + struct cifs_ses *ses; + struct cifs_tcon *tcon; +- struct smb2_lease_break_work *lw; +- +- lw = kmalloc(sizeof(struct smb2_lease_break_work), GFP_KERNEL); +- if (!lw) +- return false; +- +- INIT_WORK(&lw->lease_break, cifs_ses_oplock_break); +- lw->lease_state = rsp->NewLeaseState; ++ struct cifs_pending_open *open; + + cifs_dbg(FYI, "Checking for lease break\n"); + +@@ -617,11 +633,27 @@ smb2_is_valid_lease_break(char *buffer) + spin_lock(&tcon->open_file_lock); + cifs_stats_inc( + &tcon->stats.cifs_stats.num_oplock_brks); +- if (smb2_tcon_has_lease(tcon, rsp, lw)) { ++ if (smb2_tcon_has_lease(tcon, rsp)) { + spin_unlock(&tcon->open_file_lock); + spin_unlock(&cifs_tcp_ses_lock); + return true; + } ++ open = smb2_tcon_find_pending_open_lease(tcon, ++ rsp); ++ if (open) { ++ __u8 lease_key[SMB2_LEASE_KEY_SIZE]; ++ struct tcon_link *tlink; ++ ++ tlink = cifs_get_tlink(open->tlink); ++ memcpy(lease_key, open->lease_key, ++ SMB2_LEASE_KEY_SIZE); ++ spin_unlock(&tcon->open_file_lock); ++ spin_unlock(&cifs_tcp_ses_lock); ++ smb2_queue_pending_open_break(tlink, ++ lease_key, ++ rsp->NewLeaseState); ++ return true; ++ } + spin_unlock(&tcon->open_file_lock); + + if (tcon->crfid.is_valid && +@@ -639,7 +671,6 @@ smb2_is_valid_lease_break(char *buffer) + } + } + spin_unlock(&cifs_tcp_ses_lock); +- kfree(lw); + cifs_dbg(FYI, "Can not process lease break - no lease matched\n"); + return false; + } +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index 06b1a86d76b18..7ff05c06f2a4c 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -1323,6 +1323,8 @@ SMB2_auth_kerberos(struct SMB2_sess_data *sess_data) + spnego_key = cifs_get_spnego_key(ses); + if (IS_ERR(spnego_key)) { + rc = PTR_ERR(spnego_key); ++ if (rc == -ENOKEY) ++ cifs_dbg(VFS, "Verify user has a krb5 ticket and keyutils is installed\n"); + spnego_key = NULL; + goto out; + } +diff --git a/fs/ext2/ialloc.c b/fs/ext2/ialloc.c +index fda7d3f5b4be5..432c3febea6df 100644 +--- a/fs/ext2/ialloc.c ++++ b/fs/ext2/ialloc.c +@@ -80,6 +80,7 @@ static void ext2_release_inode(struct super_block *sb, int group, int dir) + if (dir) + le16_add_cpu(&desc->bg_used_dirs_count, -1); + spin_unlock(sb_bgl_lock(EXT2_SB(sb), group)); ++ percpu_counter_inc(&EXT2_SB(sb)->s_freeinodes_counter); + if (dir) + percpu_counter_dec(&EXT2_SB(sb)->s_dirs_counter); + mark_buffer_dirty(bh); +@@ -528,7 +529,7 @@ got: + goto fail; + } + +- percpu_counter_add(&sbi->s_freeinodes_counter, -1); ++ percpu_counter_dec(&sbi->s_freeinodes_counter); + if (S_ISDIR(mode)) + percpu_counter_inc(&sbi->s_dirs_counter); + +diff --git a/fs/minix/inode.c b/fs/minix/inode.c +index 0dd929346f3f3..7b09a9158e401 100644 +--- a/fs/minix/inode.c ++++ b/fs/minix/inode.c +@@ -150,8 +150,10 @@ static int minix_remount (struct super_block * sb, int * flags, char * data) + return 0; + } + +-static bool minix_check_superblock(struct minix_sb_info *sbi) ++static bool minix_check_superblock(struct super_block *sb) + { ++ struct minix_sb_info *sbi = minix_sb(sb); ++ + if (sbi->s_imap_blocks == 0 || sbi->s_zmap_blocks == 0) + return false; + +@@ -161,7 +163,7 @@ static bool minix_check_superblock(struct minix_sb_info *sbi) + * of indirect blocks which places the limit well above U32_MAX. + */ + if (sbi->s_version == MINIX_V1 && +- sbi->s_max_size > (7 + 512 + 512*512) * BLOCK_SIZE) ++ sb->s_maxbytes > (7 + 512 + 512*512) * BLOCK_SIZE) + return false; + + return true; +@@ -202,7 +204,7 @@ static int minix_fill_super(struct super_block *s, void *data, int silent) + sbi->s_zmap_blocks = ms->s_zmap_blocks; + sbi->s_firstdatazone = ms->s_firstdatazone; + sbi->s_log_zone_size = ms->s_log_zone_size; +- sbi->s_max_size = ms->s_max_size; ++ s->s_maxbytes = ms->s_max_size; + s->s_magic = ms->s_magic; + if (s->s_magic == MINIX_SUPER_MAGIC) { + sbi->s_version = MINIX_V1; +@@ -233,7 +235,7 @@ static int minix_fill_super(struct super_block *s, void *data, int silent) + sbi->s_zmap_blocks = m3s->s_zmap_blocks; + sbi->s_firstdatazone = m3s->s_firstdatazone; + sbi->s_log_zone_size = m3s->s_log_zone_size; +- sbi->s_max_size = m3s->s_max_size; ++ s->s_maxbytes = m3s->s_max_size; + sbi->s_ninodes = m3s->s_ninodes; + sbi->s_nzones = m3s->s_zones; + sbi->s_dirsize = 64; +@@ -245,7 +247,7 @@ static int minix_fill_super(struct super_block *s, void *data, int silent) + } else + goto out_no_fs; + +- if (!minix_check_superblock(sbi)) ++ if (!minix_check_superblock(s)) + goto out_illegal_sb; + + /* +diff --git a/fs/minix/itree_v1.c b/fs/minix/itree_v1.c +index 046cc96ee7adb..1fed906042aa8 100644 +--- a/fs/minix/itree_v1.c ++++ b/fs/minix/itree_v1.c +@@ -29,12 +29,12 @@ static int block_to_path(struct inode * inode, long block, int offsets[DEPTH]) + if (block < 0) { + printk("MINIX-fs: block_to_path: block %ld < 0 on dev %pg\n", + block, inode->i_sb->s_bdev); +- } else if (block >= (minix_sb(inode->i_sb)->s_max_size/BLOCK_SIZE)) { +- if (printk_ratelimit()) +- printk("MINIX-fs: block_to_path: " +- "block %ld too big on dev %pg\n", +- block, inode->i_sb->s_bdev); +- } else if (block < 7) { ++ return 0; ++ } ++ if ((u64)block * BLOCK_SIZE >= inode->i_sb->s_maxbytes) ++ return 0; ++ ++ if (block < 7) { + offsets[n++] = block; + } else if ((block -= 7) < 512) { + offsets[n++] = 7; +diff --git a/fs/minix/itree_v2.c b/fs/minix/itree_v2.c +index f7fc7eccccccd..9d00f31a2d9d1 100644 +--- a/fs/minix/itree_v2.c ++++ b/fs/minix/itree_v2.c +@@ -32,13 +32,12 @@ static int block_to_path(struct inode * inode, long block, int offsets[DEPTH]) + if (block < 0) { + printk("MINIX-fs: block_to_path: block %ld < 0 on dev %pg\n", + block, sb->s_bdev); +- } else if ((u64)block * (u64)sb->s_blocksize >= +- minix_sb(sb)->s_max_size) { +- if (printk_ratelimit()) +- printk("MINIX-fs: block_to_path: " +- "block %ld too big on dev %pg\n", +- block, sb->s_bdev); +- } else if (block < DIRCOUNT) { ++ return 0; ++ } ++ if ((u64)block * (u64)sb->s_blocksize >= sb->s_maxbytes) ++ return 0; ++ ++ if (block < DIRCOUNT) { + offsets[n++] = block; + } else if ((block -= DIRCOUNT) < INDIRCOUNT(sb)) { + offsets[n++] = DIRCOUNT; +diff --git a/fs/minix/minix.h b/fs/minix/minix.h +index df081e8afcc3c..168d45d3de73e 100644 +--- a/fs/minix/minix.h ++++ b/fs/minix/minix.h +@@ -32,7 +32,6 @@ struct minix_sb_info { + unsigned long s_zmap_blocks; + unsigned long s_firstdatazone; + unsigned long s_log_zone_size; +- unsigned long s_max_size; + int s_dirsize; + int s_namelen; + struct buffer_head ** s_imap; +diff --git a/fs/nfs/file.c b/fs/nfs/file.c +index 95dc90570786c..387a2cfa7e172 100644 +--- a/fs/nfs/file.c ++++ b/fs/nfs/file.c +@@ -140,6 +140,7 @@ static int + nfs_file_flush(struct file *file, fl_owner_t id) + { + struct inode *inode = file_inode(file); ++ errseq_t since; + + dprintk("NFS: flush(%pD2)\n", file); + +@@ -148,7 +149,9 @@ nfs_file_flush(struct file *file, fl_owner_t id) + return 0; + + /* Flush writes to the server and return any errors */ +- return nfs_wb_all(inode); ++ since = filemap_sample_wb_err(file->f_mapping); ++ nfs_wb_all(inode); ++ return filemap_check_wb_err(file->f_mapping, since); + } + + ssize_t +@@ -580,12 +583,14 @@ static const struct vm_operations_struct nfs_file_vm_ops = { + .page_mkwrite = nfs_vm_page_mkwrite, + }; + +-static int nfs_need_check_write(struct file *filp, struct inode *inode) ++static int nfs_need_check_write(struct file *filp, struct inode *inode, ++ int error) + { + struct nfs_open_context *ctx; + + ctx = nfs_file_open_context(filp); +- if (nfs_ctx_key_to_expire(ctx, inode)) ++ if (nfs_error_is_fatal_on_server(error) || ++ nfs_ctx_key_to_expire(ctx, inode)) + return 1; + return 0; + } +@@ -596,6 +601,8 @@ ssize_t nfs_file_write(struct kiocb *iocb, struct iov_iter *from) + struct inode *inode = file_inode(file); + unsigned long written = 0; + ssize_t result; ++ errseq_t since; ++ int error; + + result = nfs_key_timeout_notify(file, inode); + if (result) +@@ -620,6 +627,7 @@ ssize_t nfs_file_write(struct kiocb *iocb, struct iov_iter *from) + if (iocb->ki_pos > i_size_read(inode)) + nfs_revalidate_mapping(inode, file->f_mapping); + ++ since = filemap_sample_wb_err(file->f_mapping); + nfs_start_io_write(inode); + result = generic_write_checks(iocb, from); + if (result > 0) { +@@ -638,7 +646,8 @@ ssize_t nfs_file_write(struct kiocb *iocb, struct iov_iter *from) + goto out; + + /* Return error values */ +- if (nfs_need_check_write(file, inode)) { ++ error = filemap_check_wb_err(file->f_mapping, since); ++ if (nfs_need_check_write(file, inode, error)) { + int err = nfs_wb_all(inode); + if (err < 0) + result = err; +diff --git a/fs/nfs/nfs4file.c b/fs/nfs/nfs4file.c +index fb55c04cdc6bd..534b6fd70ffdb 100644 +--- a/fs/nfs/nfs4file.c ++++ b/fs/nfs/nfs4file.c +@@ -109,6 +109,7 @@ static int + nfs4_file_flush(struct file *file, fl_owner_t id) + { + struct inode *inode = file_inode(file); ++ errseq_t since; + + dprintk("NFS: flush(%pD2)\n", file); + +@@ -124,7 +125,9 @@ nfs4_file_flush(struct file *file, fl_owner_t id) + return filemap_fdatawrite(file->f_mapping); + + /* Flush writes to the server and return any errors */ +- return nfs_wb_all(inode); ++ since = filemap_sample_wb_err(file->f_mapping); ++ nfs_wb_all(inode); ++ return filemap_check_wb_err(file->f_mapping, since); + } + + #ifdef CONFIG_NFS_V4_2 +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index 1a1bd2fe6e98d..d0cb827b72cfa 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -5811,8 +5811,6 @@ static int _nfs4_get_security_label(struct inode *inode, void *buf, + return ret; + if (!(fattr.valid & NFS_ATTR_FATTR_V4_SECURITY_LABEL)) + return -ENOENT; +- if (buflen < label.len) +- return -ERANGE; + return 0; + } + +diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c +index 7c0ff1a3b5914..677751bc3a334 100644 +--- a/fs/nfs/nfs4xdr.c ++++ b/fs/nfs/nfs4xdr.c +@@ -4169,7 +4169,11 @@ static int decode_attr_security_label(struct xdr_stream *xdr, uint32_t *bitmap, + return -EIO; + if (len < NFS4_MAXLABELLEN) { + if (label) { +- memcpy(label->label, p, len); ++ if (label->len) { ++ if (label->len < len) ++ return -ERANGE; ++ memcpy(label->label, p, len); ++ } + label->len = len; + label->pi = pi; + label->lfs = lfs; +diff --git a/fs/ocfs2/ocfs2.h b/fs/ocfs2/ocfs2.h +index 9461bd3e1c0c8..0a8cd8e59a92c 100644 +--- a/fs/ocfs2/ocfs2.h ++++ b/fs/ocfs2/ocfs2.h +@@ -326,8 +326,8 @@ struct ocfs2_super + spinlock_t osb_lock; + u32 s_next_generation; + unsigned long osb_flags; +- s16 s_inode_steal_slot; +- s16 s_meta_steal_slot; ++ u16 s_inode_steal_slot; ++ u16 s_meta_steal_slot; + atomic_t s_num_inodes_stolen; + atomic_t s_num_meta_stolen; + +diff --git a/fs/ocfs2/suballoc.c b/fs/ocfs2/suballoc.c +index 503e724d39f53..5e0eaea474055 100644 +--- a/fs/ocfs2/suballoc.c ++++ b/fs/ocfs2/suballoc.c +@@ -879,9 +879,9 @@ static void __ocfs2_set_steal_slot(struct ocfs2_super *osb, int slot, int type) + { + spin_lock(&osb->osb_lock); + if (type == INODE_ALLOC_SYSTEM_INODE) +- osb->s_inode_steal_slot = slot; ++ osb->s_inode_steal_slot = (u16)slot; + else if (type == EXTENT_ALLOC_SYSTEM_INODE) +- osb->s_meta_steal_slot = slot; ++ osb->s_meta_steal_slot = (u16)slot; + spin_unlock(&osb->osb_lock); + } + +diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c +index c81e86c623807..70d8857b161df 100644 +--- a/fs/ocfs2/super.c ++++ b/fs/ocfs2/super.c +@@ -78,7 +78,7 @@ struct mount_options + unsigned long commit_interval; + unsigned long mount_opt; + unsigned int atime_quantum; +- signed short slot; ++ unsigned short slot; + int localalloc_opt; + unsigned int resv_level; + int dir_resv_level; +@@ -1334,7 +1334,7 @@ static int ocfs2_parse_options(struct super_block *sb, + goto bail; + } + if (option) +- mopt->slot = (s16)option; ++ mopt->slot = (u16)option; + break; + case Opt_commit: + if (match_int(&args[0], &option)) { +diff --git a/fs/orangefs/file.c b/fs/orangefs/file.c +index a5612abc09363..bcd4fd5ad1751 100644 +--- a/fs/orangefs/file.c ++++ b/fs/orangefs/file.c +@@ -311,23 +311,8 @@ static ssize_t orangefs_file_read_iter(struct kiocb *iocb, + struct iov_iter *iter) + { + int ret; +- struct orangefs_read_options *ro; +- + orangefs_stats.reads++; + +- /* +- * Remember how they set "count" in read(2) or pread(2) or whatever - +- * users can use count as a knob to control orangefs io size and later +- * we can try to help them fill as many pages as possible in readpage. +- */ +- if (!iocb->ki_filp->private_data) { +- iocb->ki_filp->private_data = kmalloc(sizeof *ro, GFP_KERNEL); +- if (!iocb->ki_filp->private_data) +- return(ENOMEM); +- ro = iocb->ki_filp->private_data; +- ro->blksiz = iter->count; +- } +- + down_read(&file_inode(iocb->ki_filp)->i_rwsem); + ret = orangefs_revalidate_mapping(file_inode(iocb->ki_filp)); + if (ret) +@@ -615,12 +600,6 @@ static int orangefs_lock(struct file *filp, int cmd, struct file_lock *fl) + return rc; + } + +-static int orangefs_file_open(struct inode * inode, struct file *file) +-{ +- file->private_data = NULL; +- return generic_file_open(inode, file); +-} +- + static int orangefs_flush(struct file *file, fl_owner_t id) + { + /* +@@ -634,9 +613,6 @@ static int orangefs_flush(struct file *file, fl_owner_t id) + struct inode *inode = file->f_mapping->host; + int r; + +- kfree(file->private_data); +- file->private_data = NULL; +- + if (inode->i_state & I_DIRTY_TIME) { + spin_lock(&inode->i_lock); + inode->i_state &= ~I_DIRTY_TIME; +@@ -659,7 +635,7 @@ const struct file_operations orangefs_file_operations = { + .lock = orangefs_lock, + .unlocked_ioctl = orangefs_ioctl, + .mmap = orangefs_file_mmap, +- .open = orangefs_file_open, ++ .open = generic_file_open, + .flush = orangefs_flush, + .release = orangefs_file_release, + .fsync = orangefs_fsync, +diff --git a/fs/orangefs/inode.c b/fs/orangefs/inode.c +index efb12197da181..636892ffec0ba 100644 +--- a/fs/orangefs/inode.c ++++ b/fs/orangefs/inode.c +@@ -259,46 +259,19 @@ static int orangefs_readpage(struct file *file, struct page *page) + pgoff_t index; /* which page */ + struct page *next_page; + char *kaddr; +- struct orangefs_read_options *ro = file->private_data; + loff_t read_size; +- loff_t roundedup; + int buffer_index = -1; /* orangefs shared memory slot */ + int slot_index; /* index into slot */ + int remaining; + + /* +- * If they set some miniscule size for "count" in read(2) +- * (for example) then let's try to read a page, or the whole file +- * if it is smaller than a page. Once "count" goes over a page +- * then lets round up to the highest page size multiple that is +- * less than or equal to "count" and do that much orangefs IO and +- * try to fill as many pages as we can from it. +- * +- * "count" should be represented in ro->blksiz. +- * +- * inode->i_size = file size. ++ * Get up to this many bytes from Orangefs at a time and try ++ * to fill them into the page cache at once. Tests with dd made ++ * this seem like a reasonable static number, if there was ++ * interest perhaps this number could be made setable through ++ * sysfs... + */ +- if (ro) { +- if (ro->blksiz < PAGE_SIZE) { +- if (inode->i_size < PAGE_SIZE) +- read_size = inode->i_size; +- else +- read_size = PAGE_SIZE; +- } else { +- roundedup = ((PAGE_SIZE - 1) & ro->blksiz) ? +- ((ro->blksiz + PAGE_SIZE) & ~(PAGE_SIZE -1)) : +- ro->blksiz; +- if (roundedup > inode->i_size) +- read_size = inode->i_size; +- else +- read_size = roundedup; +- +- } +- } else { +- read_size = PAGE_SIZE; +- } +- if (!read_size) +- read_size = PAGE_SIZE; ++ read_size = 524288; + + if (PageDirty(page)) + orangefs_launder_page(page); +diff --git a/fs/orangefs/orangefs-kernel.h b/fs/orangefs/orangefs-kernel.h +index 34a6c99fa29bd..3003007681a05 100644 +--- a/fs/orangefs/orangefs-kernel.h ++++ b/fs/orangefs/orangefs-kernel.h +@@ -239,10 +239,6 @@ struct orangefs_write_range { + kgid_t gid; + }; + +-struct orangefs_read_options { +- ssize_t blksiz; +-}; +- + extern struct orangefs_stats orangefs_stats; + + /* +diff --git a/fs/ubifs/journal.c b/fs/ubifs/journal.c +index 826dad0243dcc..a6ae2428e4c96 100644 +--- a/fs/ubifs/journal.c ++++ b/fs/ubifs/journal.c +@@ -539,7 +539,7 @@ int ubifs_jnl_update(struct ubifs_info *c, const struct inode *dir, + const struct fscrypt_name *nm, const struct inode *inode, + int deletion, int xent) + { +- int err, dlen, ilen, len, lnum, ino_offs, dent_offs; ++ int err, dlen, ilen, len, lnum, ino_offs, dent_offs, orphan_added = 0; + int aligned_dlen, aligned_ilen, sync = IS_DIRSYNC(dir); + int last_reference = !!(deletion && inode->i_nlink == 0); + struct ubifs_inode *ui = ubifs_inode(inode); +@@ -630,6 +630,7 @@ int ubifs_jnl_update(struct ubifs_info *c, const struct inode *dir, + goto out_finish; + } + ui->del_cmtno = c->cmt_no; ++ orphan_added = 1; + } + + err = write_head(c, BASEHD, dent, len, &lnum, &dent_offs, sync); +@@ -702,7 +703,7 @@ out_release: + kfree(dent); + out_ro: + ubifs_ro_mode(c, err); +- if (last_reference) ++ if (orphan_added) + ubifs_delete_orphan(c, inode->i_ino); + finish_reservation(c); + return err; +@@ -1217,7 +1218,7 @@ int ubifs_jnl_rename(struct ubifs_info *c, const struct inode *old_dir, + void *p; + union ubifs_key key; + struct ubifs_dent_node *dent, *dent2; +- int err, dlen1, dlen2, ilen, lnum, offs, len; ++ int err, dlen1, dlen2, ilen, lnum, offs, len, orphan_added = 0; + int aligned_dlen1, aligned_dlen2, plen = UBIFS_INO_NODE_SZ; + int last_reference = !!(new_inode && new_inode->i_nlink == 0); + int move = (old_dir != new_dir); +@@ -1333,6 +1334,7 @@ int ubifs_jnl_rename(struct ubifs_info *c, const struct inode *old_dir, + goto out_finish; + } + new_ui->del_cmtno = c->cmt_no; ++ orphan_added = 1; + } + + err = write_head(c, BASEHD, dent, len, &lnum, &offs, sync); +@@ -1414,7 +1416,7 @@ out_release: + release_head(c, BASEHD); + out_ro: + ubifs_ro_mode(c, err); +- if (last_reference) ++ if (orphan_added) + ubifs_delete_orphan(c, new_inode->i_ino); + out_finish: + finish_reservation(c); +diff --git a/fs/ufs/super.c b/fs/ufs/super.c +index 1da0be667409b..e3b69fb280e8c 100644 +--- a/fs/ufs/super.c ++++ b/fs/ufs/super.c +@@ -101,7 +101,7 @@ static struct inode *ufs_nfs_get_inode(struct super_block *sb, u64 ino, u32 gene + struct ufs_sb_private_info *uspi = UFS_SB(sb)->s_uspi; + struct inode *inode; + +- if (ino < UFS_ROOTINO || ino > uspi->s_ncg * uspi->s_ipg) ++ if (ino < UFS_ROOTINO || ino > (u64)uspi->s_ncg * uspi->s_ipg) + return ERR_PTR(-ESTALE); + + inode = ufs_iget(sb, ino); +diff --git a/include/crypto/if_alg.h b/include/crypto/if_alg.h +index 864849e942c45..c1a8d4a41bb16 100644 +--- a/include/crypto/if_alg.h ++++ b/include/crypto/if_alg.h +@@ -135,6 +135,7 @@ struct af_alg_async_req { + * SG? + * @enc: Cryptographic operation to be performed when + * recvmsg is invoked. ++ * @init: True if metadata has been sent. + * @len: Length of memory allocated for this data structure. + */ + struct af_alg_ctx { +@@ -151,6 +152,7 @@ struct af_alg_ctx { + bool more; + bool merge; + bool enc; ++ bool init; + + unsigned int len; + }; +@@ -226,7 +228,7 @@ unsigned int af_alg_count_tsgl(struct sock *sk, size_t bytes, size_t offset); + void af_alg_pull_tsgl(struct sock *sk, size_t used, struct scatterlist *dst, + size_t dst_offset); + void af_alg_wmem_wakeup(struct sock *sk); +-int af_alg_wait_for_data(struct sock *sk, unsigned flags); ++int af_alg_wait_for_data(struct sock *sk, unsigned flags, unsigned min); + int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size, + unsigned int ivsize); + ssize_t af_alg_sendpage(struct socket *sock, struct page *page, +diff --git a/include/linux/intel-iommu.h b/include/linux/intel-iommu.h +index 1e5dad8b8e59b..ed870da78326b 100644 +--- a/include/linux/intel-iommu.h ++++ b/include/linux/intel-iommu.h +@@ -359,8 +359,8 @@ enum { + + #define QI_DEV_EIOTLB_ADDR(a) ((u64)(a) & VTD_PAGE_MASK) + #define QI_DEV_EIOTLB_SIZE (((u64)1) << 11) +-#define QI_DEV_EIOTLB_GLOB(g) ((u64)g) +-#define QI_DEV_EIOTLB_PASID(p) (((u64)p) << 32) ++#define QI_DEV_EIOTLB_GLOB(g) ((u64)(g) & 0x1) ++#define QI_DEV_EIOTLB_PASID(p) ((u64)((p) & 0xfffff) << 32) + #define QI_DEV_EIOTLB_SID(sid) ((u64)((sid) & 0xffff) << 16) + #define QI_DEV_EIOTLB_QDEP(qd) ((u64)((qd) & 0x1f) << 4) + #define QI_DEV_EIOTLB_PFSID(pfsid) (((u64)(pfsid & 0xf) << 12) | \ +diff --git a/include/linux/irq.h b/include/linux/irq.h +index f8755e5fcd742..e9e69c511ea92 100644 +--- a/include/linux/irq.h ++++ b/include/linux/irq.h +@@ -211,6 +211,8 @@ struct irq_data { + * IRQD_CAN_RESERVE - Can use reservation mode + * IRQD_MSI_NOMASK_QUIRK - Non-maskable MSI quirk for affinity change + * required ++ * IRQD_AFFINITY_ON_ACTIVATE - Affinity is set on activation. Don't call ++ * irq_chip::irq_set_affinity() when deactivated. + */ + enum { + IRQD_TRIGGER_MASK = 0xf, +@@ -234,6 +236,7 @@ enum { + IRQD_DEFAULT_TRIGGER_SET = (1 << 25), + IRQD_CAN_RESERVE = (1 << 26), + IRQD_MSI_NOMASK_QUIRK = (1 << 27), ++ IRQD_AFFINITY_ON_ACTIVATE = (1 << 29), + }; + + #define __irqd_to_state(d) ACCESS_PRIVATE((d)->common, state_use_accessors) +@@ -408,6 +411,16 @@ static inline bool irqd_msi_nomask_quirk(struct irq_data *d) + return __irqd_to_state(d) & IRQD_MSI_NOMASK_QUIRK; + } + ++static inline void irqd_set_affinity_on_activate(struct irq_data *d) ++{ ++ __irqd_to_state(d) |= IRQD_AFFINITY_ON_ACTIVATE; ++} ++ ++static inline bool irqd_affinity_on_activate(struct irq_data *d) ++{ ++ return __irqd_to_state(d) & IRQD_AFFINITY_ON_ACTIVATE; ++} ++ + #undef __irqd_to_state + + static inline irq_hw_number_t irqd_to_hwirq(struct irq_data *d) +diff --git a/include/net/sock.h b/include/net/sock.h +index 8263bbf756a22..6d9c1131fe5c8 100644 +--- a/include/net/sock.h ++++ b/include/net/sock.h +@@ -849,6 +849,8 @@ static inline int sk_memalloc_socks(void) + { + return static_branch_unlikely(&memalloc_socks_key); + } ++ ++void __receive_sock(struct file *file); + #else + + static inline int sk_memalloc_socks(void) +@@ -856,6 +858,8 @@ static inline int sk_memalloc_socks(void) + return 0; + } + ++static inline void __receive_sock(struct file *file) ++{ } + #endif + + static inline gfp_t sk_gfp_mask(const struct sock *sk, gfp_t gfp_mask) +diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c +index df73685de1144..3b1d0a4725a49 100644 +--- a/kernel/irq/manage.c ++++ b/kernel/irq/manage.c +@@ -281,12 +281,16 @@ static bool irq_set_affinity_deactivated(struct irq_data *data, + struct irq_desc *desc = irq_data_to_desc(data); + + /* ++ * Handle irq chips which can handle affinity only in activated ++ * state correctly ++ * + * If the interrupt is not yet activated, just store the affinity + * mask and do not call the chip driver at all. On activation the + * driver has to make sure anyway that the interrupt is in a + * useable state so startup works. + */ +- if (!IS_ENABLED(CONFIG_IRQ_DOMAIN_HIERARCHY) || irqd_is_activated(data)) ++ if (!IS_ENABLED(CONFIG_IRQ_DOMAIN_HIERARCHY) || ++ irqd_is_activated(data) || !irqd_affinity_on_activate(data)) + return false; + + cpumask_copy(desc->irq_common_data.affinity, mask); +diff --git a/kernel/irq/pm.c b/kernel/irq/pm.c +index 8f557fa1f4fe4..c6c7e187ae748 100644 +--- a/kernel/irq/pm.c ++++ b/kernel/irq/pm.c +@@ -185,14 +185,18 @@ void rearm_wake_irq(unsigned int irq) + unsigned long flags; + struct irq_desc *desc = irq_get_desc_buslock(irq, &flags, IRQ_GET_DESC_CHECK_GLOBAL); + +- if (!desc || !(desc->istate & IRQS_SUSPENDED) || +- !irqd_is_wakeup_set(&desc->irq_data)) ++ if (!desc) + return; + ++ if (!(desc->istate & IRQS_SUSPENDED) || ++ !irqd_is_wakeup_set(&desc->irq_data)) ++ goto unlock; ++ + desc->istate &= ~IRQS_SUSPENDED; + irqd_set(&desc->irq_data, IRQD_WAKEUP_ARMED); + __enable_irq(desc); + ++unlock: + irq_put_desc_busunlock(desc, flags); + } + +diff --git a/kernel/kprobes.c b/kernel/kprobes.c +index 0a967db226d8a..bbff4bccb885d 100644 +--- a/kernel/kprobes.c ++++ b/kernel/kprobes.c +@@ -2104,6 +2104,13 @@ static void kill_kprobe(struct kprobe *p) + * the original probed function (which will be freed soon) any more. + */ + arch_remove_kprobe(p); ++ ++ /* ++ * The module is going away. We should disarm the kprobe which ++ * is using ftrace. ++ */ ++ if (kprobe_ftrace(p)) ++ disarm_kprobe_ftrace(p); + } + + /* Disable one kprobe */ +diff --git a/kernel/module.c b/kernel/module.c +index 6baa1080cdb76..819c5d3b4c295 100644 +--- a/kernel/module.c ++++ b/kernel/module.c +@@ -1517,18 +1517,34 @@ struct module_sect_attrs { + struct module_sect_attr attrs[0]; + }; + ++#define MODULE_SECT_READ_SIZE (3 /* "0x", "\n" */ + (BITS_PER_LONG / 4)) + static ssize_t module_sect_read(struct file *file, struct kobject *kobj, + struct bin_attribute *battr, + char *buf, loff_t pos, size_t count) + { + struct module_sect_attr *sattr = + container_of(battr, struct module_sect_attr, battr); ++ char bounce[MODULE_SECT_READ_SIZE + 1]; ++ size_t wrote; + + if (pos != 0) + return -EINVAL; + +- return sprintf(buf, "0x%px\n", +- kallsyms_show_value(file->f_cred) ? (void *)sattr->address : NULL); ++ /* ++ * Since we're a binary read handler, we must account for the ++ * trailing NUL byte that sprintf will write: if "buf" is ++ * too small to hold the NUL, or the NUL is exactly the last ++ * byte, the read will look like it got truncated by one byte. ++ * Since there is no way to ask sprintf nicely to not write ++ * the NUL, we have to use a bounce buffer. ++ */ ++ wrote = scnprintf(bounce, sizeof(bounce), "0x%px\n", ++ kallsyms_show_value(file->f_cred) ++ ? (void *)sattr->address : NULL); ++ count = min(count, wrote); ++ memcpy(buf, bounce, count); ++ ++ return count; + } + + static void free_sect_attrs(struct module_sect_attrs *sect_attrs) +@@ -1577,7 +1593,7 @@ static void add_sect_attrs(struct module *mod, const struct load_info *info) + goto out; + sect_attrs->nsections++; + sattr->battr.read = module_sect_read; +- sattr->battr.size = 3 /* "0x", "\n" */ + (BITS_PER_LONG / 4); ++ sattr->battr.size = MODULE_SECT_READ_SIZE; + sattr->battr.attr.mode = 0400; + *(gattr++) = &(sattr++)->battr; + } +diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c +index 15160d707da45..705852c1724aa 100644 +--- a/kernel/trace/ftrace.c ++++ b/kernel/trace/ftrace.c +@@ -5699,8 +5699,11 @@ static int referenced_filters(struct dyn_ftrace *rec) + int cnt = 0; + + for (ops = ftrace_ops_list; ops != &ftrace_list_end; ops = ops->next) { +- if (ops_references_rec(ops, rec)) +- cnt++; ++ if (ops_references_rec(ops, rec)) { ++ cnt++; ++ if (ops->flags & FTRACE_OPS_FL_SAVE_REGS) ++ rec->flags |= FTRACE_FL_REGS; ++ } + } + + return cnt; +@@ -5877,8 +5880,8 @@ void ftrace_module_enable(struct module *mod) + if (ftrace_start_up) + cnt += referenced_filters(rec); + +- /* This clears FTRACE_FL_DISABLED */ +- rec->flags = cnt; ++ rec->flags &= ~FTRACE_FL_DISABLED; ++ rec->flags += cnt; + + if (ftrace_start_up && cnt) { + int failed = __ftrace_replace_code(rec, 1); +@@ -6459,12 +6462,12 @@ void ftrace_pid_follow_fork(struct trace_array *tr, bool enable) + if (enable) { + register_trace_sched_process_fork(ftrace_pid_follow_sched_process_fork, + tr); +- register_trace_sched_process_exit(ftrace_pid_follow_sched_process_exit, ++ register_trace_sched_process_free(ftrace_pid_follow_sched_process_exit, + tr); + } else { + unregister_trace_sched_process_fork(ftrace_pid_follow_sched_process_fork, + tr); +- unregister_trace_sched_process_exit(ftrace_pid_follow_sched_process_exit, ++ unregister_trace_sched_process_free(ftrace_pid_follow_sched_process_exit, + tr); + } + } +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c +index 721947b9962db..f9c2bdbbd8936 100644 +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -5686,7 +5686,7 @@ static int tracing_set_tracer(struct trace_array *tr, const char *buf) + } + + /* If trace pipe files are being read, we can't change the tracer */ +- if (tr->current_trace->ref) { ++ if (tr->trace_ref) { + ret = -EBUSY; + goto out; + } +@@ -5902,7 +5902,7 @@ static int tracing_open_pipe(struct inode *inode, struct file *filp) + + nonseekable_open(inode, filp); + +- tr->current_trace->ref++; ++ tr->trace_ref++; + out: + mutex_unlock(&trace_types_lock); + return ret; +@@ -5921,7 +5921,7 @@ static int tracing_release_pipe(struct inode *inode, struct file *file) + + mutex_lock(&trace_types_lock); + +- tr->current_trace->ref--; ++ tr->trace_ref--; + + if (iter->trace->pipe_close) + iter->trace->pipe_close(iter); +@@ -7230,7 +7230,7 @@ static int tracing_buffers_open(struct inode *inode, struct file *filp) + + filp->private_data = info; + +- tr->current_trace->ref++; ++ tr->trace_ref++; + + mutex_unlock(&trace_types_lock); + +@@ -7331,7 +7331,7 @@ static int tracing_buffers_release(struct inode *inode, struct file *file) + + mutex_lock(&trace_types_lock); + +- iter->tr->current_trace->ref--; ++ iter->tr->trace_ref--; + + __trace_array_put(iter->tr); + +@@ -8470,7 +8470,7 @@ static int __remove_instance(struct trace_array *tr) + { + int i; + +- if (tr->ref || (tr->current_trace && tr->current_trace->ref)) ++ if (tr->ref || (tr->current_trace && tr->trace_ref)) + return -EBUSY; + + list_del(&tr->list); +diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h +index a3c29d5fcc616..4055158c1dd25 100644 +--- a/kernel/trace/trace.h ++++ b/kernel/trace/trace.h +@@ -309,6 +309,7 @@ struct trace_array { + struct trace_event_file *trace_marker_file; + cpumask_var_t tracing_cpumask; /* only trace on set CPUs */ + int ref; ++ int trace_ref; + #ifdef CONFIG_FUNCTION_TRACER + struct ftrace_ops *ops; + struct trace_pid_list __rcu *function_pids; +@@ -498,7 +499,6 @@ struct tracer { + struct tracer *next; + struct tracer_flags *flags; + int enabled; +- int ref; + bool print_max; + bool allow_instances; + #ifdef CONFIG_TRACER_MAX_TRACE +diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c +index 995061bb2deca..ed9eb97b64b47 100644 +--- a/kernel/trace/trace_events.c ++++ b/kernel/trace/trace_events.c +@@ -527,12 +527,12 @@ void trace_event_follow_fork(struct trace_array *tr, bool enable) + if (enable) { + register_trace_prio_sched_process_fork(event_filter_pid_sched_process_fork, + tr, INT_MIN); +- register_trace_prio_sched_process_exit(event_filter_pid_sched_process_exit, ++ register_trace_prio_sched_process_free(event_filter_pid_sched_process_exit, + tr, INT_MAX); + } else { + unregister_trace_sched_process_fork(event_filter_pid_sched_process_fork, + tr); +- unregister_trace_sched_process_exit(event_filter_pid_sched_process_exit, ++ unregister_trace_sched_process_free(event_filter_pid_sched_process_exit, + tr); + } + } +diff --git a/kernel/trace/trace_hwlat.c b/kernel/trace/trace_hwlat.c +index 862f4b0139fcb..35512ed26d9ff 100644 +--- a/kernel/trace/trace_hwlat.c ++++ b/kernel/trace/trace_hwlat.c +@@ -270,6 +270,7 @@ static bool disable_migrate; + static void move_to_next_cpu(void) + { + struct cpumask *current_mask = &save_cpumask; ++ struct trace_array *tr = hwlat_trace; + int next_cpu; + + if (disable_migrate) +@@ -283,7 +284,7 @@ static void move_to_next_cpu(void) + goto disable; + + get_online_cpus(); +- cpumask_and(current_mask, cpu_online_mask, tracing_buffer_mask); ++ cpumask_and(current_mask, cpu_online_mask, tr->tracing_cpumask); + next_cpu = cpumask_next(smp_processor_id(), current_mask); + put_online_cpus(); + +@@ -360,7 +361,7 @@ static int start_kthread(struct trace_array *tr) + /* Just pick the first CPU on first iteration */ + current_mask = &save_cpumask; + get_online_cpus(); +- cpumask_and(current_mask, cpu_online_mask, tracing_buffer_mask); ++ cpumask_and(current_mask, cpu_online_mask, tr->tracing_cpumask); + put_online_cpus(); + next_cpu = cpumask_first(current_mask); + +diff --git a/lib/devres.c b/lib/devres.c +index 17624d35e82d4..77c80ca9e4856 100644 +--- a/lib/devres.c ++++ b/lib/devres.c +@@ -155,6 +155,7 @@ void __iomem *devm_ioremap_resource(struct device *dev, + { + resource_size_t size; + void __iomem *dest_ptr; ++ char *pretty_name; + + BUG_ON(!dev); + +@@ -165,7 +166,15 @@ void __iomem *devm_ioremap_resource(struct device *dev, + + size = resource_size(res); + +- if (!devm_request_mem_region(dev, res->start, size, dev_name(dev))) { ++ if (res->name) ++ pretty_name = devm_kasprintf(dev, GFP_KERNEL, "%s %s", ++ dev_name(dev), res->name); ++ else ++ pretty_name = devm_kstrdup(dev, dev_name(dev), GFP_KERNEL); ++ if (!pretty_name) ++ return IOMEM_ERR_PTR(-ENOMEM); ++ ++ if (!devm_request_mem_region(dev, res->start, size, pretty_name)) { + dev_err(dev, "can't request region for resource %pR\n", res); + return IOMEM_ERR_PTR(-EBUSY); + } +diff --git a/lib/test_kmod.c b/lib/test_kmod.c +index 9cf77628fc913..87a0cc750ea23 100644 +--- a/lib/test_kmod.c ++++ b/lib/test_kmod.c +@@ -745,7 +745,7 @@ static int trigger_config_run_type(struct kmod_test_device *test_dev, + break; + case TEST_KMOD_FS_TYPE: + kfree_const(config->test_fs); +- config->test_driver = NULL; ++ config->test_fs = NULL; + copied = config_copy_test_fs(config, test_str, + strlen(test_str)); + break; +diff --git a/mm/khugepaged.c b/mm/khugepaged.c +index 5977f7824a9ac..719f49d1fba2f 100644 +--- a/mm/khugepaged.c ++++ b/mm/khugepaged.c +@@ -1294,7 +1294,7 @@ void collapse_pte_mapped_thp(struct mm_struct *mm, unsigned long addr) + { + unsigned long haddr = addr & HPAGE_PMD_MASK; + struct vm_area_struct *vma = find_vma(mm, haddr); +- struct page *hpage = NULL; ++ struct page *hpage; + pte_t *start_pte, *pte; + pmd_t *pmd, _pmd; + spinlock_t *ptl; +@@ -1314,9 +1314,17 @@ void collapse_pte_mapped_thp(struct mm_struct *mm, unsigned long addr) + if (!hugepage_vma_check(vma, vma->vm_flags | VM_HUGEPAGE)) + return; + ++ hpage = find_lock_page(vma->vm_file->f_mapping, ++ linear_page_index(vma, haddr)); ++ if (!hpage) ++ return; ++ ++ if (!PageHead(hpage)) ++ goto drop_hpage; ++ + pmd = mm_find_pmd(mm, haddr); + if (!pmd) +- return; ++ goto drop_hpage; + + start_pte = pte_offset_map_lock(mm, pmd, haddr, &ptl); + +@@ -1335,30 +1343,11 @@ void collapse_pte_mapped_thp(struct mm_struct *mm, unsigned long addr) + + page = vm_normal_page(vma, addr, *pte); + +- if (!page || !PageCompound(page)) +- goto abort; +- +- if (!hpage) { +- hpage = compound_head(page); +- /* +- * The mapping of the THP should not change. +- * +- * Note that uprobe, debugger, or MAP_PRIVATE may +- * change the page table, but the new page will +- * not pass PageCompound() check. +- */ +- if (WARN_ON(hpage->mapping != vma->vm_file->f_mapping)) +- goto abort; +- } +- + /* +- * Confirm the page maps to the correct subpage. +- * +- * Note that uprobe, debugger, or MAP_PRIVATE may change +- * the page table, but the new page will not pass +- * PageCompound() check. ++ * Note that uprobe, debugger, or MAP_PRIVATE may change the ++ * page table, but the new page will not be a subpage of hpage. + */ +- if (WARN_ON(hpage + i != page)) ++ if (hpage + i != page) + goto abort; + count++; + } +@@ -1377,21 +1366,26 @@ void collapse_pte_mapped_thp(struct mm_struct *mm, unsigned long addr) + pte_unmap_unlock(start_pte, ptl); + + /* step 3: set proper refcount and mm_counters. */ +- if (hpage) { ++ if (count) { + page_ref_sub(hpage, count); + add_mm_counter(vma->vm_mm, mm_counter_file(hpage), -count); + } + + /* step 4: collapse pmd */ + ptl = pmd_lock(vma->vm_mm, pmd); +- _pmd = pmdp_collapse_flush(vma, addr, pmd); ++ _pmd = pmdp_collapse_flush(vma, haddr, pmd); + spin_unlock(ptl); + mm_dec_nr_ptes(mm); + pte_free(mm, pmd_pgtable(_pmd)); ++ ++drop_hpage: ++ unlock_page(hpage); ++ put_page(hpage); + return; + + abort: + pte_unmap_unlock(start_pte, ptl); ++ goto drop_hpage; + } + + static int khugepaged_collapse_pte_mapped_thps(struct mm_slot *mm_slot) +@@ -1420,6 +1414,7 @@ out: + static void retract_page_tables(struct address_space *mapping, pgoff_t pgoff) + { + struct vm_area_struct *vma; ++ struct mm_struct *mm; + unsigned long addr; + pmd_t *pmd, _pmd; + +@@ -1448,7 +1443,8 @@ static void retract_page_tables(struct address_space *mapping, pgoff_t pgoff) + continue; + if (vma->vm_end < addr + HPAGE_PMD_SIZE) + continue; +- pmd = mm_find_pmd(vma->vm_mm, addr); ++ mm = vma->vm_mm; ++ pmd = mm_find_pmd(mm, addr); + if (!pmd) + continue; + /* +@@ -1458,17 +1454,19 @@ static void retract_page_tables(struct address_space *mapping, pgoff_t pgoff) + * mmap_sem while holding page lock. Fault path does it in + * reverse order. Trylock is a way to avoid deadlock. + */ +- if (down_write_trylock(&vma->vm_mm->mmap_sem)) { +- spinlock_t *ptl = pmd_lock(vma->vm_mm, pmd); +- /* assume page table is clear */ +- _pmd = pmdp_collapse_flush(vma, addr, pmd); +- spin_unlock(ptl); +- up_write(&vma->vm_mm->mmap_sem); +- mm_dec_nr_ptes(vma->vm_mm); +- pte_free(vma->vm_mm, pmd_pgtable(_pmd)); ++ if (down_write_trylock(&mm->mmap_sem)) { ++ if (!khugepaged_test_exit(mm)) { ++ spinlock_t *ptl = pmd_lock(mm, pmd); ++ /* assume page table is clear */ ++ _pmd = pmdp_collapse_flush(vma, addr, pmd); ++ spin_unlock(ptl); ++ mm_dec_nr_ptes(mm); ++ pte_free(mm, pmd_pgtable(_pmd)); ++ } ++ up_write(&mm->mmap_sem); + } else { + /* Try again later */ +- khugepaged_add_pte_mapped_thp(vma->vm_mm, addr); ++ khugepaged_add_pte_mapped_thp(mm, addr); + } + } + i_mmap_unlock_write(mapping); +diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c +index c054945a9a742..3128d95847125 100644 +--- a/mm/memory_hotplug.c ++++ b/mm/memory_hotplug.c +@@ -1751,7 +1751,7 @@ static int __ref try_remove_memory(int nid, u64 start, u64 size) + */ + rc = walk_memory_blocks(start, size, NULL, check_memblock_offlined_cb); + if (rc) +- goto done; ++ return rc; + + /* remove memmap entry */ + firmware_map_remove(start, start + size, "System RAM"); +@@ -1771,9 +1771,8 @@ static int __ref try_remove_memory(int nid, u64 start, u64 size) + + try_offline_node(nid); + +-done: + mem_hotplug_done(); +- return rc; ++ return 0; + } + + /** +diff --git a/mm/page_counter.c b/mm/page_counter.c +index de31470655f66..147ff99187b81 100644 +--- a/mm/page_counter.c ++++ b/mm/page_counter.c +@@ -77,7 +77,7 @@ void page_counter_charge(struct page_counter *counter, unsigned long nr_pages) + long new; + + new = atomic_long_add_return(nr_pages, &c->usage); +- propagate_protected_usage(counter, new); ++ propagate_protected_usage(c, new); + /* + * This is indeed racy, but we can live with some + * inaccuracy in the watermark. +@@ -121,7 +121,7 @@ bool page_counter_try_charge(struct page_counter *counter, + new = atomic_long_add_return(nr_pages, &c->usage); + if (new > c->max) { + atomic_long_sub(nr_pages, &c->usage); +- propagate_protected_usage(counter, new); ++ propagate_protected_usage(c, new); + /* + * This is racy, but we can live with some + * inaccuracy in the failcnt. +@@ -130,7 +130,7 @@ bool page_counter_try_charge(struct page_counter *counter, + *fail = c; + goto failed; + } +- propagate_protected_usage(counter, new); ++ propagate_protected_usage(c, new); + /* + * Just like with failcnt, we can live with some + * inaccuracy in the watermark. +diff --git a/net/compat.c b/net/compat.c +index 0f7ded26059ec..c848bcb517f3e 100644 +--- a/net/compat.c ++++ b/net/compat.c +@@ -291,6 +291,7 @@ void scm_detach_fds_compat(struct msghdr *kmsg, struct scm_cookie *scm) + break; + } + /* Bump the usage count and install the file. */ ++ __receive_sock(fp[i]); + fd_install(new_fd, get_file(fp[i])); + } + +diff --git a/net/core/sock.c b/net/core/sock.c +index 991ab80234cec..919f1a1739e90 100644 +--- a/net/core/sock.c ++++ b/net/core/sock.c +@@ -2736,6 +2736,27 @@ int sock_no_mmap(struct file *file, struct socket *sock, struct vm_area_struct * + } + EXPORT_SYMBOL(sock_no_mmap); + ++/* ++ * When a file is received (via SCM_RIGHTS, etc), we must bump the ++ * various sock-based usage counts. ++ */ ++void __receive_sock(struct file *file) ++{ ++ struct socket *sock; ++ int error; ++ ++ /* ++ * The resulting value of "error" is ignored here since we only ++ * need to take action when the file is a socket and testing ++ * "sock" for NULL is sufficient. ++ */ ++ sock = sock_from_file(file, &error); ++ if (sock) { ++ sock_update_netprioidx(&sock->sk->sk_cgrp_data); ++ sock_update_classid(&sock->sk->sk_cgrp_data); ++ } ++} ++ + ssize_t sock_no_sendpage(struct socket *sock, struct page *page, int offset, size_t size, int flags) + { + ssize_t res; +diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c +index b1669f0244706..f5d96107af6de 100644 +--- a/net/mac80211/sta_info.c ++++ b/net/mac80211/sta_info.c +@@ -1033,7 +1033,7 @@ static void __sta_info_destroy_part2(struct sta_info *sta) + might_sleep(); + lockdep_assert_held(&local->sta_mtx); + +- while (sta->sta_state == IEEE80211_STA_AUTHORIZED) { ++ if (sta->sta_state == IEEE80211_STA_AUTHORIZED) { + ret = sta_info_move_state(sta, IEEE80211_STA_ASSOC); + WARN_ON_ONCE(ret); + } +diff --git a/scripts/recordmcount.c b/scripts/recordmcount.c +index e59022b3f1254..b9c2ee7ab43fa 100644 +--- a/scripts/recordmcount.c ++++ b/scripts/recordmcount.c +@@ -42,6 +42,8 @@ + #define R_ARM_THM_CALL 10 + #define R_ARM_CALL 28 + ++#define R_AARCH64_CALL26 283 ++ + static int fd_map; /* File descriptor for file being modified. */ + static int mmap_failed; /* Boolean flag. */ + static char gpfx; /* prefix for global symbol name (sometimes '_') */ +diff --git a/sound/pci/echoaudio/echoaudio.c b/sound/pci/echoaudio/echoaudio.c +index ca9125726be24..8596ae4c2bdef 100644 +--- a/sound/pci/echoaudio/echoaudio.c ++++ b/sound/pci/echoaudio/echoaudio.c +@@ -2198,7 +2198,6 @@ static int snd_echo_resume(struct device *dev) + if (err < 0) { + kfree(commpage_bak); + dev_err(dev, "resume init_hw err=%d\n", err); +- snd_echo_free(chip); + return err; + } + +@@ -2225,7 +2224,6 @@ static int snd_echo_resume(struct device *dev) + if (request_irq(pci->irq, snd_echo_interrupt, IRQF_SHARED, + KBUILD_MODNAME, chip)) { + dev_err(chip->card->dev, "cannot grab irq\n"); +- snd_echo_free(chip); + return -EBUSY; + } + chip->irq = pci->irq; +diff --git a/tools/build/Makefile.feature b/tools/build/Makefile.feature +index 8a19753cc26aa..8c6e1ea67f213 100644 +--- a/tools/build/Makefile.feature ++++ b/tools/build/Makefile.feature +@@ -8,7 +8,7 @@ endif + + feature_check = $(eval $(feature_check_code)) + define feature_check_code +- feature-$(1) := $(shell $(MAKE) OUTPUT=$(OUTPUT_FEATURES) CFLAGS="$(EXTRA_CFLAGS) $(FEATURE_CHECK_CFLAGS-$(1))" CXXFLAGS="$(EXTRA_CXXFLAGS) $(FEATURE_CHECK_CXXFLAGS-$(1))" LDFLAGS="$(LDFLAGS) $(FEATURE_CHECK_LDFLAGS-$(1))" -C $(feature_dir) $(OUTPUT_FEATURES)test-$1.bin >/dev/null 2>/dev/null && echo 1 || echo 0) ++ feature-$(1) := $(shell $(MAKE) OUTPUT=$(OUTPUT_FEATURES) CC="$(CC)" CXX="$(CXX)" CFLAGS="$(EXTRA_CFLAGS) $(FEATURE_CHECK_CFLAGS-$(1))" CXXFLAGS="$(EXTRA_CXXFLAGS) $(FEATURE_CHECK_CXXFLAGS-$(1))" LDFLAGS="$(LDFLAGS) $(FEATURE_CHECK_LDFLAGS-$(1))" -C $(feature_dir) $(OUTPUT_FEATURES)test-$1.bin >/dev/null 2>/dev/null && echo 1 || echo 0) + endef + + feature_set = $(eval $(feature_set_code)) +diff --git a/tools/build/feature/Makefile b/tools/build/feature/Makefile +index 8499385365c02..054e09ab4a9e4 100644 +--- a/tools/build/feature/Makefile ++++ b/tools/build/feature/Makefile +@@ -70,8 +70,6 @@ FILES= \ + + FILES := $(addprefix $(OUTPUT),$(FILES)) + +-CC ?= $(CROSS_COMPILE)gcc +-CXX ?= $(CROSS_COMPILE)g++ + PKG_CONFIG ?= $(CROSS_COMPILE)pkg-config + LLVM_CONFIG ?= llvm-config + +diff --git a/tools/perf/bench/mem-functions.c b/tools/perf/bench/mem-functions.c +index 9235b76501be8..19d45c377ac18 100644 +--- a/tools/perf/bench/mem-functions.c ++++ b/tools/perf/bench/mem-functions.c +@@ -223,12 +223,8 @@ static int bench_mem_common(int argc, const char **argv, struct bench_mem_info * + return 0; + } + +-static u64 do_memcpy_cycles(const struct function *r, size_t size, void *src, void *dst) ++static void memcpy_prefault(memcpy_t fn, size_t size, void *src, void *dst) + { +- u64 cycle_start = 0ULL, cycle_end = 0ULL; +- memcpy_t fn = r->fn.memcpy; +- int i; +- + /* Make sure to always prefault zero pages even if MMAP_THRESH is crossed: */ + memset(src, 0, size); + +@@ -237,6 +233,15 @@ static u64 do_memcpy_cycles(const struct function *r, size_t size, void *src, vo + * to not measure page fault overhead: + */ + fn(dst, src, size); ++} ++ ++static u64 do_memcpy_cycles(const struct function *r, size_t size, void *src, void *dst) ++{ ++ u64 cycle_start = 0ULL, cycle_end = 0ULL; ++ memcpy_t fn = r->fn.memcpy; ++ int i; ++ ++ memcpy_prefault(fn, size, src, dst); + + cycle_start = get_cycles(); + for (i = 0; i < nr_loops; ++i) +@@ -252,11 +257,7 @@ static double do_memcpy_gettimeofday(const struct function *r, size_t size, void + memcpy_t fn = r->fn.memcpy; + int i; + +- /* +- * We prefault the freshly allocated memory range here, +- * to not measure page fault overhead: +- */ +- fn(dst, src, size); ++ memcpy_prefault(fn, size, src, dst); + + BUG_ON(gettimeofday(&tv_start, NULL)); + for (i = 0; i < nr_loops; ++i) +diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c +index f8ccfd6be0eee..7ffcbd6fcd1ae 100644 +--- a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c ++++ b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c +@@ -1164,6 +1164,7 @@ static int intel_pt_walk_fup(struct intel_pt_decoder *decoder) + return 0; + if (err == -EAGAIN || + intel_pt_fup_with_nlip(decoder, &intel_pt_insn, ip, err)) { ++ decoder->pkt_state = INTEL_PT_STATE_IN_SYNC; + if (intel_pt_fup_event(decoder)) + return 0; + return -EAGAIN; +@@ -1942,17 +1943,13 @@ next: + } + if (decoder->set_fup_mwait) + no_tip = true; ++ if (no_tip) ++ decoder->pkt_state = INTEL_PT_STATE_FUP_NO_TIP; ++ else ++ decoder->pkt_state = INTEL_PT_STATE_FUP; + err = intel_pt_walk_fup(decoder); +- if (err != -EAGAIN) { +- if (err) +- return err; +- if (no_tip) +- decoder->pkt_state = +- INTEL_PT_STATE_FUP_NO_TIP; +- else +- decoder->pkt_state = INTEL_PT_STATE_FUP; +- return 0; +- } ++ if (err != -EAGAIN) ++ return err; + if (no_tip) { + no_tip = false; + break; +@@ -1980,8 +1977,10 @@ next: + * possibility of another CBR change that gets caught up + * in the PSB+. + */ +- if (decoder->cbr != decoder->cbr_seen) ++ if (decoder->cbr != decoder->cbr_seen) { ++ decoder->state.type = 0; + return 0; ++ } + break; + + case INTEL_PT_PIP: +@@ -2022,8 +2021,10 @@ next: + + case INTEL_PT_CBR: + intel_pt_calc_cbr(decoder); +- if (decoder->cbr != decoder->cbr_seen) ++ if (decoder->cbr != decoder->cbr_seen) { ++ decoder->state.type = 0; + return 0; ++ } + break; + + case INTEL_PT_MODE_EXEC: +@@ -2599,15 +2600,11 @@ const struct intel_pt_state *intel_pt_decode(struct intel_pt_decoder *decoder) + err = intel_pt_walk_tip(decoder); + break; + case INTEL_PT_STATE_FUP: +- decoder->pkt_state = INTEL_PT_STATE_IN_SYNC; + err = intel_pt_walk_fup(decoder); + if (err == -EAGAIN) + err = intel_pt_walk_fup_tip(decoder); +- else if (!err) +- decoder->pkt_state = INTEL_PT_STATE_FUP; + break; + case INTEL_PT_STATE_FUP_NO_TIP: +- decoder->pkt_state = INTEL_PT_STATE_IN_SYNC; + err = intel_pt_walk_fup(decoder); + if (err == -EAGAIN) + err = intel_pt_walk_trace(decoder); +diff --git a/tools/testing/selftests/bpf/test_progs.c b/tools/testing/selftests/bpf/test_progs.c +index 8cb3469dd11f2..48bbe8e0ce48d 100644 +--- a/tools/testing/selftests/bpf/test_progs.c ++++ b/tools/testing/selftests/bpf/test_progs.c +@@ -7,6 +7,8 @@ + #include + #include + ++#define EXIT_NO_TEST 2 ++ + /* defined in test_progs.h */ + struct test_env env; + +@@ -584,5 +586,8 @@ int main(int argc, char **argv) + free(env.test_selector.num_set); + free(env.subtest_selector.num_set); + ++ if (env.succ_cnt + env.fail_cnt + env.skip_cnt == 0) ++ return EXIT_NO_TEST; ++ + return env.fail_cnt ? EXIT_FAILURE : EXIT_SUCCESS; + } +diff --git a/tools/testing/selftests/powerpc/ptrace/ptrace-pkey.c b/tools/testing/selftests/powerpc/ptrace/ptrace-pkey.c +index bdbbbe8431e03..3694613f418f6 100644 +--- a/tools/testing/selftests/powerpc/ptrace/ptrace-pkey.c ++++ b/tools/testing/selftests/powerpc/ptrace/ptrace-pkey.c +@@ -44,7 +44,7 @@ struct shared_info { + unsigned long amr2; + + /* AMR value that ptrace should refuse to write to the child. */ +- unsigned long amr3; ++ unsigned long invalid_amr; + + /* IAMR value the parent expects to read from the child. */ + unsigned long expected_iamr; +@@ -57,8 +57,8 @@ struct shared_info { + * (even though they're valid ones) because userspace doesn't have + * access to those registers. + */ +- unsigned long new_iamr; +- unsigned long new_uamor; ++ unsigned long invalid_iamr; ++ unsigned long invalid_uamor; + }; + + static int sys_pkey_alloc(unsigned long flags, unsigned long init_access_rights) +@@ -66,11 +66,6 @@ static int sys_pkey_alloc(unsigned long flags, unsigned long init_access_rights) + return syscall(__NR_pkey_alloc, flags, init_access_rights); + } + +-static int sys_pkey_free(int pkey) +-{ +- return syscall(__NR_pkey_free, pkey); +-} +- + static int child(struct shared_info *info) + { + unsigned long reg; +@@ -100,28 +95,32 @@ static int child(struct shared_info *info) + + info->amr1 |= 3ul << pkeyshift(pkey1); + info->amr2 |= 3ul << pkeyshift(pkey2); +- info->amr3 |= info->amr2 | 3ul << pkeyshift(pkey3); ++ /* ++ * invalid amr value where we try to force write ++ * things which are deined by a uamor setting. ++ */ ++ info->invalid_amr = info->amr2 | (~0x0UL & ~info->expected_uamor); + ++ /* ++ * if PKEY_DISABLE_EXECUTE succeeded we should update the expected_iamr ++ */ + if (disable_execute) + info->expected_iamr |= 1ul << pkeyshift(pkey1); + else + info->expected_iamr &= ~(1ul << pkeyshift(pkey1)); + +- info->expected_iamr &= ~(1ul << pkeyshift(pkey2) | 1ul << pkeyshift(pkey3)); +- +- info->expected_uamor |= 3ul << pkeyshift(pkey1) | +- 3ul << pkeyshift(pkey2); +- info->new_iamr |= 1ul << pkeyshift(pkey1) | 1ul << pkeyshift(pkey2); +- info->new_uamor |= 3ul << pkeyshift(pkey1); ++ /* ++ * We allocated pkey2 and pkey 3 above. Clear the IAMR bits. ++ */ ++ info->expected_iamr &= ~(1ul << pkeyshift(pkey2)); ++ info->expected_iamr &= ~(1ul << pkeyshift(pkey3)); + + /* +- * We won't use pkey3. We just want a plausible but invalid key to test +- * whether ptrace will let us write to AMR bits we are not supposed to. +- * +- * This also tests whether the kernel restores the UAMOR permissions +- * after a key is freed. ++ * Create an IAMR value different from expected value. ++ * Kernel will reject an IAMR and UAMOR change. + */ +- sys_pkey_free(pkey3); ++ info->invalid_iamr = info->expected_iamr | (1ul << pkeyshift(pkey1) | 1ul << pkeyshift(pkey2)); ++ info->invalid_uamor = info->expected_uamor & ~(0x3ul << pkeyshift(pkey1)); + + printf("%-30s AMR: %016lx pkey1: %d pkey2: %d pkey3: %d\n", + user_write, info->amr1, pkey1, pkey2, pkey3); +@@ -196,9 +195,9 @@ static int parent(struct shared_info *info, pid_t pid) + PARENT_SKIP_IF_UNSUPPORTED(ret, &info->child_sync); + PARENT_FAIL_IF(ret, &info->child_sync); + +- info->amr1 = info->amr2 = info->amr3 = regs[0]; +- info->expected_iamr = info->new_iamr = regs[1]; +- info->expected_uamor = info->new_uamor = regs[2]; ++ info->amr1 = info->amr2 = regs[0]; ++ info->expected_iamr = regs[1]; ++ info->expected_uamor = regs[2]; + + /* Wake up child so that it can set itself up. */ + ret = prod_child(&info->child_sync); +@@ -234,10 +233,10 @@ static int parent(struct shared_info *info, pid_t pid) + return ret; + + /* Write invalid AMR value in child. */ +- ret = ptrace_write_regs(pid, NT_PPC_PKEY, &info->amr3, 1); ++ ret = ptrace_write_regs(pid, NT_PPC_PKEY, &info->invalid_amr, 1); + PARENT_FAIL_IF(ret, &info->child_sync); + +- printf("%-30s AMR: %016lx\n", ptrace_write_running, info->amr3); ++ printf("%-30s AMR: %016lx\n", ptrace_write_running, info->invalid_amr); + + /* Wake up child so that it can verify it didn't change. */ + ret = prod_child(&info->child_sync); +@@ -249,7 +248,7 @@ static int parent(struct shared_info *info, pid_t pid) + + /* Try to write to IAMR. */ + regs[0] = info->amr1; +- regs[1] = info->new_iamr; ++ regs[1] = info->invalid_iamr; + ret = ptrace_write_regs(pid, NT_PPC_PKEY, regs, 2); + PARENT_FAIL_IF(!ret, &info->child_sync); + +@@ -257,7 +256,7 @@ static int parent(struct shared_info *info, pid_t pid) + ptrace_write_running, regs[0], regs[1]); + + /* Try to write to IAMR and UAMOR. */ +- regs[2] = info->new_uamor; ++ regs[2] = info->invalid_uamor; + ret = ptrace_write_regs(pid, NT_PPC_PKEY, regs, 3); + PARENT_FAIL_IF(!ret, &info->child_sync); + diff --git a/patch/kernel/odroidxu4-current/patch-5.4.60-61.patch b/patch/kernel/odroidxu4-current/patch-5.4.60-61.patch new file mode 100644 index 000000000..bee93bccc --- /dev/null +++ b/patch/kernel/odroidxu4-current/patch-5.4.60-61.patch @@ -0,0 +1,3600 @@ +diff --git a/Documentation/kbuild/index.rst b/Documentation/kbuild/index.rst +index 0f144fad99a6a..3882bd5f7728c 100644 +--- a/Documentation/kbuild/index.rst ++++ b/Documentation/kbuild/index.rst +@@ -19,6 +19,7 @@ Kernel Build System + + issues + reproducible-builds ++ llvm + + .. only:: subproject and html + +diff --git a/Documentation/kbuild/kbuild.rst b/Documentation/kbuild/kbuild.rst +index f1e5dce86af7c..852ccc551bb3a 100644 +--- a/Documentation/kbuild/kbuild.rst ++++ b/Documentation/kbuild/kbuild.rst +@@ -262,3 +262,8 @@ KBUILD_BUILD_USER, KBUILD_BUILD_HOST + These two variables allow to override the user@host string displayed during + boot and in /proc/version. The default value is the output of the commands + whoami and host, respectively. ++ ++LLVM ++---- ++If this variable is set to 1, Kbuild will use Clang and LLVM utilities instead ++of GCC and GNU binutils to build the kernel. +diff --git a/Documentation/kbuild/llvm.rst b/Documentation/kbuild/llvm.rst +new file mode 100644 +index 0000000000000..c776b6eee969f +--- /dev/null ++++ b/Documentation/kbuild/llvm.rst +@@ -0,0 +1,87 @@ ++============================== ++Building Linux with Clang/LLVM ++============================== ++ ++This document covers how to build the Linux kernel with Clang and LLVM ++utilities. ++ ++About ++----- ++ ++The Linux kernel has always traditionally been compiled with GNU toolchains ++such as GCC and binutils. Ongoing work has allowed for `Clang ++`_ and `LLVM `_ utilities to be ++used as viable substitutes. Distributions such as `Android ++`_, `ChromeOS ++`_, and `OpenMandriva ++`_ use Clang built kernels. `LLVM is a ++collection of toolchain components implemented in terms of C++ objects ++`_. Clang is a front-end to LLVM that ++supports C and the GNU C extensions required by the kernel, and is pronounced ++"klang," not "see-lang." ++ ++Clang ++----- ++ ++The compiler used can be swapped out via `CC=` command line argument to `make`. ++`CC=` should be set when selecting a config and during a build. ++ ++ make CC=clang defconfig ++ ++ make CC=clang ++ ++Cross Compiling ++--------------- ++ ++A single Clang compiler binary will typically contain all supported backends, ++which can help simplify cross compiling. ++ ++ ARCH=arm64 CROSS_COMPILE=aarch64-linux-gnu- make CC=clang ++ ++`CROSS_COMPILE` is not used to prefix the Clang compiler binary, instead ++`CROSS_COMPILE` is used to set a command line flag: `--target `. For ++example: ++ ++ clang --target aarch64-linux-gnu foo.c ++ ++LLVM Utilities ++-------------- ++ ++LLVM has substitutes for GNU binutils utilities. Kbuild supports `LLVM=1` ++to enable them. ++ ++ make LLVM=1 ++ ++They can be enabled individually. The full list of the parameters: ++ ++ make CC=clang LD=ld.lld AR=llvm-ar NM=llvm-nm STRIP=llvm-strip \\ ++ OBJCOPY=llvm-objcopy OBJDUMP=llvm-objdump OBJSIZE=llvm-size \\ ++ READELF=llvm-readelf HOSTCC=clang HOSTCXX=clang++ HOSTAR=llvm-ar \\ ++ HOSTLD=ld.lld ++ ++Currently, the integrated assembler is disabled by default. You can pass ++`LLVM_IAS=1` to enable it. ++ ++Getting Help ++------------ ++ ++- `Website `_ ++- `Mailing List `_: ++- `Issue Tracker `_ ++- IRC: #clangbuiltlinux on chat.freenode.net ++- `Telegram `_: @ClangBuiltLinux ++- `Wiki `_ ++- `Beginner Bugs `_ ++ ++Getting LLVM ++------------- ++ ++- http://releases.llvm.org/download.html ++- https://github.com/llvm/llvm-project ++- https://llvm.org/docs/GettingStarted.html ++- https://llvm.org/docs/CMake.html ++- https://apt.llvm.org/ ++- https://www.archlinux.org/packages/extra/x86_64/llvm/ ++- https://github.com/ClangBuiltLinux/tc-build ++- https://github.com/ClangBuiltLinux/linux/wiki/Building-Clang-from-source ++- https://android.googlesource.com/platform/prebuilts/clang/host/linux-x86/ +diff --git a/MAINTAINERS b/MAINTAINERS +index fe6fa5d3a63e5..1407008df7491 100644 +--- a/MAINTAINERS ++++ b/MAINTAINERS +@@ -4028,6 +4028,7 @@ B: https://github.com/ClangBuiltLinux/linux/issues + C: irc://chat.freenode.net/clangbuiltlinux + S: Supported + K: \b(?i:clang|llvm)\b ++F: Documentation/kbuild/llvm.rst + + CLEANCACHE API + M: Konrad Rzeszutek Wilk +diff --git a/Makefile b/Makefile +index 7c001e21e28e7..2c21b922644d7 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 5 + PATCHLEVEL = 4 +-SUBLEVEL = 60 ++SUBLEVEL = 61 + EXTRAVERSION = + NAME = Kleptomaniac Octopus + +@@ -394,8 +394,13 @@ HOST_LFS_CFLAGS := $(shell getconf LFS_CFLAGS 2>/dev/null) + HOST_LFS_LDFLAGS := $(shell getconf LFS_LDFLAGS 2>/dev/null) + HOST_LFS_LIBS := $(shell getconf LFS_LIBS 2>/dev/null) + +-HOSTCC = gcc +-HOSTCXX = g++ ++ifneq ($(LLVM),) ++HOSTCC = clang ++HOSTCXX = clang++ ++else ++HOSTCC = gcc ++HOSTCXX = g++ ++endif + KBUILD_HOSTCFLAGS := -Wall -Wmissing-prototypes -Wstrict-prototypes -O2 \ + -fomit-frame-pointer -std=gnu89 $(HOST_LFS_CFLAGS) \ + $(HOSTCFLAGS) +@@ -404,16 +409,28 @@ KBUILD_HOSTLDFLAGS := $(HOST_LFS_LDFLAGS) $(HOSTLDFLAGS) + KBUILD_HOSTLDLIBS := $(HOST_LFS_LIBS) $(HOSTLDLIBS) + + # Make variables (CC, etc...) +-AS = $(CROSS_COMPILE)as +-LD = $(CROSS_COMPILE)ld +-CC = $(CROSS_COMPILE)gcc + CPP = $(CC) -E ++ifneq ($(LLVM),) ++CC = clang ++LD = ld.lld ++AR = llvm-ar ++NM = llvm-nm ++OBJCOPY = llvm-objcopy ++OBJDUMP = llvm-objdump ++READELF = llvm-readelf ++OBJSIZE = llvm-size ++STRIP = llvm-strip ++else ++CC = $(CROSS_COMPILE)gcc ++LD = $(CROSS_COMPILE)ld + AR = $(CROSS_COMPILE)ar + NM = $(CROSS_COMPILE)nm +-STRIP = $(CROSS_COMPILE)strip + OBJCOPY = $(CROSS_COMPILE)objcopy + OBJDUMP = $(CROSS_COMPILE)objdump ++READELF = $(CROSS_COMPILE)readelf + OBJSIZE = $(CROSS_COMPILE)size ++STRIP = $(CROSS_COMPILE)strip ++endif + PAHOLE = pahole + LEX = flex + YACC = bison +@@ -422,7 +439,6 @@ INSTALLKERNEL := installkernel + DEPMOD = /sbin/depmod + PERL = perl + PYTHON = python +-PYTHON2 = python2 + PYTHON3 = python3 + CHECK = sparse + BASH = bash +@@ -471,9 +487,9 @@ KBUILD_LDFLAGS := + GCC_PLUGINS_CFLAGS := + CLANG_FLAGS := + +-export ARCH SRCARCH CONFIG_SHELL BASH HOSTCC KBUILD_HOSTCFLAGS CROSS_COMPILE AS LD CC +-export CPP AR NM STRIP OBJCOPY OBJDUMP OBJSIZE PAHOLE LEX YACC AWK INSTALLKERNEL +-export PERL PYTHON PYTHON2 PYTHON3 CHECK CHECKFLAGS MAKE UTS_MACHINE HOSTCXX ++export ARCH SRCARCH CONFIG_SHELL BASH HOSTCC KBUILD_HOSTCFLAGS CROSS_COMPILE LD CC ++export CPP AR NM STRIP OBJCOPY OBJDUMP OBJSIZE READELF PAHOLE LEX YACC AWK INSTALLKERNEL ++export PERL PYTHON PYTHON3 CHECK CHECKFLAGS MAKE UTS_MACHINE HOSTCXX + export KBUILD_HOSTCXXFLAGS KBUILD_HOSTLDFLAGS KBUILD_HOSTLDLIBS LDFLAGS_MODULE + + export KBUILD_CPPFLAGS NOSTDINC_FLAGS LINUXINCLUDE OBJCOPYFLAGS KBUILD_LDFLAGS +@@ -534,7 +550,7 @@ endif + ifneq ($(GCC_TOOLCHAIN),) + CLANG_FLAGS += --gcc-toolchain=$(GCC_TOOLCHAIN) + endif +-ifeq ($(shell $(AS) --version 2>&1 | head -n 1 | grep clang),) ++ifneq ($(LLVM_IAS),1) + CLANG_FLAGS += -no-integrated-as + endif + CLANG_FLAGS += -Werror=unknown-warning-option +diff --git a/arch/alpha/include/asm/io.h b/arch/alpha/include/asm/io.h +index b771bf1b53523..103270d5a9fc6 100644 +--- a/arch/alpha/include/asm/io.h ++++ b/arch/alpha/include/asm/io.h +@@ -502,10 +502,10 @@ extern inline void writeq(u64 b, volatile void __iomem *addr) + } + #endif + +-#define ioread16be(p) be16_to_cpu(ioread16(p)) +-#define ioread32be(p) be32_to_cpu(ioread32(p)) +-#define iowrite16be(v,p) iowrite16(cpu_to_be16(v), (p)) +-#define iowrite32be(v,p) iowrite32(cpu_to_be32(v), (p)) ++#define ioread16be(p) swab16(ioread16(p)) ++#define ioread32be(p) swab32(ioread32(p)) ++#define iowrite16be(v,p) iowrite16(swab16(v), (p)) ++#define iowrite32be(v,p) iowrite32(swab32(v), (p)) + + #define inb_p inb + #define inw_p inw +diff --git a/arch/arm/include/asm/kvm_host.h b/arch/arm/include/asm/kvm_host.h +index 1b179b1f46bc5..dd03d5e01a946 100644 +--- a/arch/arm/include/asm/kvm_host.h ++++ b/arch/arm/include/asm/kvm_host.h +@@ -266,7 +266,7 @@ int __kvm_arm_vcpu_set_events(struct kvm_vcpu *vcpu, + + #define KVM_ARCH_WANT_MMU_NOTIFIER + int kvm_unmap_hva_range(struct kvm *kvm, +- unsigned long start, unsigned long end); ++ unsigned long start, unsigned long end, unsigned flags); + int kvm_set_spte_hva(struct kvm *kvm, unsigned long hva, pte_t pte); + + unsigned long kvm_arm_num_regs(struct kvm_vcpu *vcpu); +diff --git a/arch/arm64/Makefile b/arch/arm64/Makefile +index d65aef47ece3b..11a7d6208087f 100644 +--- a/arch/arm64/Makefile ++++ b/arch/arm64/Makefile +@@ -146,6 +146,7 @@ zinstall install: + PHONY += vdso_install + vdso_install: + $(Q)$(MAKE) $(build)=arch/arm64/kernel/vdso $@ ++ $(Q)$(MAKE) $(build)=arch/arm64/kernel/vdso32 $@ + + # We use MRPROPER_FILES and CLEAN_FILES now + archclean: +diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h +index 0c3bd6aff6e91..d719c6b4dd81c 100644 +--- a/arch/arm64/include/asm/kvm_host.h ++++ b/arch/arm64/include/asm/kvm_host.h +@@ -427,7 +427,7 @@ int __kvm_arm_vcpu_set_events(struct kvm_vcpu *vcpu, + + #define KVM_ARCH_WANT_MMU_NOTIFIER + int kvm_unmap_hva_range(struct kvm *kvm, +- unsigned long start, unsigned long end); ++ unsigned long start, unsigned long end, unsigned flags); + int kvm_set_spte_hva(struct kvm *kvm, unsigned long hva, pte_t pte); + int kvm_age_hva(struct kvm *kvm, unsigned long start, unsigned long end); + int kvm_test_age_hva(struct kvm *kvm, unsigned long hva); +diff --git a/arch/arm64/kernel/vdso32/Makefile b/arch/arm64/kernel/vdso32/Makefile +index 76b327f88fbb1..40dffe60b8454 100644 +--- a/arch/arm64/kernel/vdso32/Makefile ++++ b/arch/arm64/kernel/vdso32/Makefile +@@ -190,7 +190,7 @@ quiet_cmd_vdsosym = VDSOSYM $@ + cmd_vdsosym = $(NM) $< | $(gen-vdsosym) | LC_ALL=C sort > $@ + + # Install commands for the unstripped file +-quiet_cmd_vdso_install = INSTALL $@ ++quiet_cmd_vdso_install = INSTALL32 $@ + cmd_vdso_install = cp $(obj)/$@.dbg $(MODLIB)/vdso/vdso32.so + + vdso.so: $(obj)/vdso.so.dbg +diff --git a/arch/m68k/include/asm/m53xxacr.h b/arch/m68k/include/asm/m53xxacr.h +index 9138a624c5c81..692f90e7fecc1 100644 +--- a/arch/m68k/include/asm/m53xxacr.h ++++ b/arch/m68k/include/asm/m53xxacr.h +@@ -89,9 +89,9 @@ + * coherency though in all cases. And for copyback caches we will need + * to push cached data as well. + */ +-#define CACHE_INIT CACR_CINVA +-#define CACHE_INVALIDATE CACR_CINVA +-#define CACHE_INVALIDATED CACR_CINVA ++#define CACHE_INIT (CACHE_MODE + CACR_CINVA - CACR_EC) ++#define CACHE_INVALIDATE (CACHE_MODE + CACR_CINVA) ++#define CACHE_INVALIDATED (CACHE_MODE + CACR_CINVA) + + #define ACR0_MODE ((CONFIG_RAMBASE & 0xff000000) + \ + (0x000f0000) + \ +diff --git a/arch/mips/include/asm/kvm_host.h b/arch/mips/include/asm/kvm_host.h +index 7b47a323dc23e..356c61074d136 100644 +--- a/arch/mips/include/asm/kvm_host.h ++++ b/arch/mips/include/asm/kvm_host.h +@@ -939,7 +939,7 @@ enum kvm_mips_fault_result kvm_trap_emul_gva_fault(struct kvm_vcpu *vcpu, + + #define KVM_ARCH_WANT_MMU_NOTIFIER + int kvm_unmap_hva_range(struct kvm *kvm, +- unsigned long start, unsigned long end); ++ unsigned long start, unsigned long end, unsigned flags); + int kvm_set_spte_hva(struct kvm *kvm, unsigned long hva, pte_t pte); + int kvm_age_hva(struct kvm *kvm, unsigned long start, unsigned long end); + int kvm_test_age_hva(struct kvm *kvm, unsigned long hva); +diff --git a/arch/mips/kernel/setup.c b/arch/mips/kernel/setup.c +index 7b06e6ee6817d..b8884de89c81e 100644 +--- a/arch/mips/kernel/setup.c ++++ b/arch/mips/kernel/setup.c +@@ -494,7 +494,7 @@ static void __init mips_parse_crashkernel(void) + if (ret != 0 || crash_size <= 0) + return; + +- if (!memblock_find_in_range(crash_base, crash_base + crash_size, crash_size, 0)) { ++ if (!memblock_find_in_range(crash_base, crash_base + crash_size, crash_size, 1)) { + pr_warn("Invalid memory region reserved for crash kernel\n"); + return; + } +diff --git a/arch/mips/kvm/mmu.c b/arch/mips/kvm/mmu.c +index 97e538a8c1be2..97f63a84aa51f 100644 +--- a/arch/mips/kvm/mmu.c ++++ b/arch/mips/kvm/mmu.c +@@ -512,7 +512,8 @@ static int kvm_unmap_hva_handler(struct kvm *kvm, gfn_t gfn, gfn_t gfn_end, + return 1; + } + +-int kvm_unmap_hva_range(struct kvm *kvm, unsigned long start, unsigned long end) ++int kvm_unmap_hva_range(struct kvm *kvm, unsigned long start, unsigned long end, ++ unsigned flags) + { + handle_hva_to_gpa(kvm, start, end, &kvm_unmap_hva_handler, NULL); + +diff --git a/arch/powerpc/include/asm/kvm_host.h b/arch/powerpc/include/asm/kvm_host.h +index 6fe6ad64cba57..740b52ec35097 100644 +--- a/arch/powerpc/include/asm/kvm_host.h ++++ b/arch/powerpc/include/asm/kvm_host.h +@@ -58,7 +58,8 @@ + #define KVM_ARCH_WANT_MMU_NOTIFIER + + extern int kvm_unmap_hva_range(struct kvm *kvm, +- unsigned long start, unsigned long end); ++ unsigned long start, unsigned long end, ++ unsigned flags); + extern int kvm_age_hva(struct kvm *kvm, unsigned long start, unsigned long end); + extern int kvm_test_age_hva(struct kvm *kvm, unsigned long hva); + extern int kvm_set_spte_hva(struct kvm *kvm, unsigned long hva, pte_t pte); +diff --git a/arch/powerpc/kvm/book3s.c b/arch/powerpc/kvm/book3s.c +index ec2547cc5ecbe..1ff971f3b06f9 100644 +--- a/arch/powerpc/kvm/book3s.c ++++ b/arch/powerpc/kvm/book3s.c +@@ -867,7 +867,8 @@ void kvmppc_core_commit_memory_region(struct kvm *kvm, + kvm->arch.kvm_ops->commit_memory_region(kvm, mem, old, new, change); + } + +-int kvm_unmap_hva_range(struct kvm *kvm, unsigned long start, unsigned long end) ++int kvm_unmap_hva_range(struct kvm *kvm, unsigned long start, unsigned long end, ++ unsigned flags) + { + return kvm->arch.kvm_ops->unmap_hva_range(kvm, start, end); + } +diff --git a/arch/powerpc/kvm/e500_mmu_host.c b/arch/powerpc/kvm/e500_mmu_host.c +index 321db0fdb9db8..7154bd424d243 100644 +--- a/arch/powerpc/kvm/e500_mmu_host.c ++++ b/arch/powerpc/kvm/e500_mmu_host.c +@@ -734,7 +734,8 @@ static int kvm_unmap_hva(struct kvm *kvm, unsigned long hva) + return 0; + } + +-int kvm_unmap_hva_range(struct kvm *kvm, unsigned long start, unsigned long end) ++int kvm_unmap_hva_range(struct kvm *kvm, unsigned long start, unsigned long end, ++ unsigned flags) + { + /* kvm_unmap_hva flushes everything anyways */ + kvm_unmap_hva(kvm, start); +diff --git a/arch/powerpc/platforms/pseries/ras.c b/arch/powerpc/platforms/pseries/ras.c +index 13ef77fd648f4..b3c4848869e52 100644 +--- a/arch/powerpc/platforms/pseries/ras.c ++++ b/arch/powerpc/platforms/pseries/ras.c +@@ -184,7 +184,6 @@ static void handle_system_shutdown(char event_modifier) + case EPOW_SHUTDOWN_ON_UPS: + pr_emerg("Loss of system power detected. System is running on" + " UPS/battery. Check RTAS error log for details\n"); +- orderly_poweroff(true); + break; + + case EPOW_SHUTDOWN_LOSS_OF_CRITICAL_FUNCTIONS: +diff --git a/arch/s390/kernel/ptrace.c b/arch/s390/kernel/ptrace.c +index 5aa786063eb3e..c6aef2ecf2890 100644 +--- a/arch/s390/kernel/ptrace.c ++++ b/arch/s390/kernel/ptrace.c +@@ -1283,7 +1283,6 @@ static bool is_ri_cb_valid(struct runtime_instr_cb *cb) + cb->pc == 1 && + cb->qc == 0 && + cb->reserved2 == 0 && +- cb->key == PAGE_DEFAULT_KEY && + cb->reserved3 == 0 && + cb->reserved4 == 0 && + cb->reserved5 == 0 && +@@ -1347,7 +1346,11 @@ static int s390_runtime_instr_set(struct task_struct *target, + kfree(data); + return -EINVAL; + } +- ++ /* ++ * Override access key in any case, since user space should ++ * not be able to set it, nor should it care about it. ++ */ ++ ri_cb.key = PAGE_DEFAULT_KEY >> 4; + preempt_disable(); + if (!target->thread.ri_cb) + target->thread.ri_cb = data; +diff --git a/arch/s390/kernel/runtime_instr.c b/arch/s390/kernel/runtime_instr.c +index 125c7f6e87150..1788a5454b6fc 100644 +--- a/arch/s390/kernel/runtime_instr.c ++++ b/arch/s390/kernel/runtime_instr.c +@@ -57,7 +57,7 @@ static void init_runtime_instr_cb(struct runtime_instr_cb *cb) + cb->k = 1; + cb->ps = 1; + cb->pc = 1; +- cb->key = PAGE_DEFAULT_KEY; ++ cb->key = PAGE_DEFAULT_KEY >> 4; + cb->v = 1; + } + +diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile +index 6b84afdd75382..98aac5b4bdb7e 100644 +--- a/arch/x86/boot/compressed/Makefile ++++ b/arch/x86/boot/compressed/Makefile +@@ -102,7 +102,7 @@ vmlinux-objs-$(CONFIG_EFI_MIXED) += $(obj)/efi_thunk_$(BITS).o + quiet_cmd_check_data_rel = DATAREL $@ + define cmd_check_data_rel + for obj in $(filter %.o,$^); do \ +- ${CROSS_COMPILE}readelf -S $$obj | grep -qF .rel.local && { \ ++ $(READELF) -S $$obj | grep -qF .rel.local && { \ + echo "error: $$obj has data relocations!" >&2; \ + exit 1; \ + } || true; \ +diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h +index 742de9d97ba14..c41686641c3fb 100644 +--- a/arch/x86/include/asm/kvm_host.h ++++ b/arch/x86/include/asm/kvm_host.h +@@ -1553,7 +1553,8 @@ asmlinkage void kvm_spurious_fault(void); + _ASM_EXTABLE(666b, 667b) + + #define KVM_ARCH_WANT_MMU_NOTIFIER +-int kvm_unmap_hva_range(struct kvm *kvm, unsigned long start, unsigned long end); ++int kvm_unmap_hva_range(struct kvm *kvm, unsigned long start, unsigned long end, ++ unsigned flags); + int kvm_age_hva(struct kvm *kvm, unsigned long start, unsigned long end); + int kvm_test_age_hva(struct kvm *kvm, unsigned long hva); + int kvm_set_spte_hva(struct kvm *kvm, unsigned long hva, pte_t pte); +diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c +index 342d9ddf35c3a..bb743f956c232 100644 +--- a/arch/x86/kvm/mmu.c ++++ b/arch/x86/kvm/mmu.c +@@ -2045,7 +2045,8 @@ static int kvm_handle_hva(struct kvm *kvm, unsigned long hva, + return kvm_handle_hva_range(kvm, hva, hva + 1, data, handler); + } + +-int kvm_unmap_hva_range(struct kvm *kvm, unsigned long start, unsigned long end) ++int kvm_unmap_hva_range(struct kvm *kvm, unsigned long start, unsigned long end, ++ unsigned flags) + { + return kvm_handle_hva_range(kvm, start, end, 0, kvm_unmap_rmapp); + } +diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c +index 38b2df0e71096..8920ee7b28811 100644 +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -972,7 +972,7 @@ int kvm_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4) + { + unsigned long old_cr4 = kvm_read_cr4(vcpu); + unsigned long pdptr_bits = X86_CR4_PGE | X86_CR4_PSE | X86_CR4_PAE | +- X86_CR4_SMEP | X86_CR4_SMAP | X86_CR4_PKE; ++ X86_CR4_SMEP; + + if (kvm_valid_cr4(vcpu, cr4)) + return 1; +diff --git a/arch/x86/pci/xen.c b/arch/x86/pci/xen.c +index 91220cc258547..5c11ae66b5d8e 100644 +--- a/arch/x86/pci/xen.c ++++ b/arch/x86/pci/xen.c +@@ -26,6 +26,7 @@ + #include + #include + #include ++#include + #include + + static int xen_pcifront_enable_irq(struct pci_dev *dev) +diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c +index d3d7c4ef7d045..53dc0fd6f6d3c 100644 +--- a/drivers/cpufreq/intel_pstate.c ++++ b/drivers/cpufreq/intel_pstate.c +@@ -1571,6 +1571,7 @@ static void intel_pstate_get_cpu_pstates(struct cpudata *cpu) + + intel_pstate_get_hwp_max(cpu->cpu, &phy_max, ¤t_max); + cpu->pstate.turbo_freq = phy_max * cpu->pstate.scaling; ++ cpu->pstate.turbo_pstate = phy_max; + } else { + cpu->pstate.turbo_freq = cpu->pstate.turbo_pstate * cpu->pstate.scaling; + } +diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c +index c1167ef5d2b35..b299e22b7532a 100644 +--- a/drivers/firmware/efi/efi.c ++++ b/drivers/firmware/efi/efi.c +@@ -345,6 +345,7 @@ static int __init efisubsys_init(void) + efi_kobj = kobject_create_and_add("efi", firmware_kobj); + if (!efi_kobj) { + pr_err("efi: Firmware registration failed.\n"); ++ destroy_workqueue(efi_rts_wq); + return -ENOMEM; + } + +@@ -381,6 +382,7 @@ err_unregister: + generic_ops_unregister(); + err_put: + kobject_put(efi_kobj); ++ destroy_workqueue(efi_rts_wq); + return error; + } + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index 6091194a3955c..2c0eb7140ca0e 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -1434,6 +1434,7 @@ amdgpu_dm_update_connector_after_detect(struct amdgpu_dm_connector *aconnector) + + drm_connector_update_edid_property(connector, + aconnector->edid); ++ drm_add_edid_modes(connector, aconnector->edid); + + if (aconnector->dc_link->aux_mode) + drm_dp_cec_set_edid(&aconnector->dm_dp_aux.aux, +diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c +index c13dce760098c..05b98eadc2899 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c +@@ -2845,7 +2845,7 @@ static bool dcn20_validate_bandwidth_internal(struct dc *dc, struct dc_state *co + int vlevel = 0; + int pipe_split_from[MAX_PIPES]; + int pipe_cnt = 0; +- display_e2e_pipe_params_st *pipes = kzalloc(dc->res_pool->pipe_count * sizeof(display_e2e_pipe_params_st), GFP_KERNEL); ++ display_e2e_pipe_params_st *pipes = kzalloc(dc->res_pool->pipe_count * sizeof(display_e2e_pipe_params_st), GFP_ATOMIC); + DC_LOGGER_INIT(dc->ctx->logger); + + BW_VAL_TRACE_COUNT(); +diff --git a/drivers/gpu/drm/amd/display/include/fixed31_32.h b/drivers/gpu/drm/amd/display/include/fixed31_32.h +index 89ef9f6860e5b..16df2a485dd0d 100644 +--- a/drivers/gpu/drm/amd/display/include/fixed31_32.h ++++ b/drivers/gpu/drm/amd/display/include/fixed31_32.h +@@ -431,6 +431,9 @@ struct fixed31_32 dc_fixpt_log(struct fixed31_32 arg); + */ + static inline struct fixed31_32 dc_fixpt_pow(struct fixed31_32 arg1, struct fixed31_32 arg2) + { ++ if (arg1.value == 0) ++ return arg2.value == 0 ? dc_fixpt_one : dc_fixpt_zero; ++ + return dc_fixpt_exp( + dc_fixpt_mul( + dc_fixpt_log(arg1), +diff --git a/drivers/gpu/drm/ttm/ttm_bo_vm.c b/drivers/gpu/drm/ttm/ttm_bo_vm.c +index 46dc3de7e81bf..f2bad14ac04ab 100644 +--- a/drivers/gpu/drm/ttm/ttm_bo_vm.c ++++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c +@@ -358,8 +358,10 @@ static int ttm_bo_vm_access_kmap(struct ttm_buffer_object *bo, + static int ttm_bo_vm_access(struct vm_area_struct *vma, unsigned long addr, + void *buf, int len, int write) + { +- unsigned long offset = (addr) - vma->vm_start; + struct ttm_buffer_object *bo = vma->vm_private_data; ++ unsigned long offset = (addr) - vma->vm_start + ++ ((vma->vm_pgoff - drm_vma_node_start(&bo->base.vma_node)) ++ << PAGE_SHIFT); + int ret; + + if (len < 1 || (offset + len) >> PAGE_SHIFT > bo->num_pages) +diff --git a/drivers/gpu/drm/vgem/vgem_drv.c b/drivers/gpu/drm/vgem/vgem_drv.c +index 909eba43664a2..204d1df5a21d1 100644 +--- a/drivers/gpu/drm/vgem/vgem_drv.c ++++ b/drivers/gpu/drm/vgem/vgem_drv.c +@@ -229,32 +229,6 @@ static int vgem_gem_dumb_create(struct drm_file *file, struct drm_device *dev, + return 0; + } + +-static int vgem_gem_dumb_map(struct drm_file *file, struct drm_device *dev, +- uint32_t handle, uint64_t *offset) +-{ +- struct drm_gem_object *obj; +- int ret; +- +- obj = drm_gem_object_lookup(file, handle); +- if (!obj) +- return -ENOENT; +- +- if (!obj->filp) { +- ret = -EINVAL; +- goto unref; +- } +- +- ret = drm_gem_create_mmap_offset(obj); +- if (ret) +- goto unref; +- +- *offset = drm_vma_node_offset_addr(&obj->vma_node); +-unref: +- drm_gem_object_put_unlocked(obj); +- +- return ret; +-} +- + static struct drm_ioctl_desc vgem_ioctls[] = { + DRM_IOCTL_DEF_DRV(VGEM_FENCE_ATTACH, vgem_fence_attach_ioctl, DRM_RENDER_ALLOW), + DRM_IOCTL_DEF_DRV(VGEM_FENCE_SIGNAL, vgem_fence_signal_ioctl, DRM_RENDER_ALLOW), +@@ -448,7 +422,6 @@ static struct drm_driver vgem_driver = { + .fops = &vgem_driver_fops, + + .dumb_create = vgem_gem_dumb_create, +- .dumb_map_offset = vgem_gem_dumb_map, + + .prime_handle_to_fd = drm_gem_prime_handle_to_fd, + .prime_fd_to_handle = drm_gem_prime_fd_to_handle, +diff --git a/drivers/infiniband/hw/bnxt_re/main.c b/drivers/infiniband/hw/bnxt_re/main.c +index 27e2df44d043d..cfe5f47d9890e 100644 +--- a/drivers/infiniband/hw/bnxt_re/main.c ++++ b/drivers/infiniband/hw/bnxt_re/main.c +@@ -789,7 +789,8 @@ static int bnxt_re_handle_qp_async_event(struct creq_qp_event *qp_event, + struct ib_event event; + unsigned int flags; + +- if (qp->qplib_qp.state == CMDQ_MODIFY_QP_NEW_STATE_ERR) { ++ if (qp->qplib_qp.state == CMDQ_MODIFY_QP_NEW_STATE_ERR && ++ rdma_is_kernel_res(&qp->ib_qp.res)) { + flags = bnxt_re_lock_cqs(qp); + bnxt_qplib_add_flush_qp(&qp->qplib_qp); + bnxt_re_unlock_cqs(qp, flags); +diff --git a/drivers/infiniband/hw/hfi1/tid_rdma.c b/drivers/infiniband/hw/hfi1/tid_rdma.c +index 7c6fd720fb2ea..c018fc633cca3 100644 +--- a/drivers/infiniband/hw/hfi1/tid_rdma.c ++++ b/drivers/infiniband/hw/hfi1/tid_rdma.c +@@ -3215,6 +3215,7 @@ bool hfi1_tid_rdma_wqe_interlock(struct rvt_qp *qp, struct rvt_swqe *wqe) + case IB_WR_ATOMIC_CMP_AND_SWP: + case IB_WR_ATOMIC_FETCH_AND_ADD: + case IB_WR_RDMA_WRITE: ++ case IB_WR_RDMA_WRITE_WITH_IMM: + switch (prev->wr.opcode) { + case IB_WR_TID_RDMA_WRITE: + req = wqe_to_tid_req(prev); +diff --git a/drivers/input/mouse/psmouse-base.c b/drivers/input/mouse/psmouse-base.c +index 527ae0b9a191e..0b4a3039f312f 100644 +--- a/drivers/input/mouse/psmouse-base.c ++++ b/drivers/input/mouse/psmouse-base.c +@@ -2042,7 +2042,7 @@ static int psmouse_get_maxproto(char *buffer, const struct kernel_param *kp) + { + int type = *((unsigned int *)kp->arg); + +- return sprintf(buffer, "%s", psmouse_protocol_by_type(type)->name); ++ return sprintf(buffer, "%s\n", psmouse_protocol_by_type(type)->name); + } + + static int __init psmouse_init(void) +diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c +index 25ad64a3919f6..2cbfcd99b7ee7 100644 +--- a/drivers/md/bcache/super.c ++++ b/drivers/md/bcache/super.c +@@ -816,19 +816,19 @@ static int bcache_device_init(struct bcache_device *d, unsigned int block_size, + struct request_queue *q; + const size_t max_stripes = min_t(size_t, INT_MAX, + SIZE_MAX / sizeof(atomic_t)); +- size_t n; ++ uint64_t n; + int idx; + + if (!d->stripe_size) + d->stripe_size = 1 << 31; + +- d->nr_stripes = DIV_ROUND_UP_ULL(sectors, d->stripe_size); +- +- if (!d->nr_stripes || d->nr_stripes > max_stripes) { +- pr_err("nr_stripes too large or invalid: %u (start sector beyond end of disk?)", +- (unsigned int)d->nr_stripes); ++ n = DIV_ROUND_UP_ULL(sectors, d->stripe_size); ++ if (!n || n > max_stripes) { ++ pr_err("nr_stripes too large or invalid: %llu (start sector beyond end of disk?)\n", ++ n); + return -ENOMEM; + } ++ d->nr_stripes = n; + + n = d->nr_stripes * sizeof(atomic_t); + d->stripe_sectors_dirty = kvzalloc(n, GFP_KERNEL); +diff --git a/drivers/media/pci/ttpci/budget-core.c b/drivers/media/pci/ttpci/budget-core.c +index fadbdeeb44955..293867b9e7961 100644 +--- a/drivers/media/pci/ttpci/budget-core.c ++++ b/drivers/media/pci/ttpci/budget-core.c +@@ -369,20 +369,25 @@ static int budget_register(struct budget *budget) + ret = dvbdemux->dmx.add_frontend(&dvbdemux->dmx, &budget->hw_frontend); + + if (ret < 0) +- return ret; ++ goto err_release_dmx; + + budget->mem_frontend.source = DMX_MEMORY_FE; + ret = dvbdemux->dmx.add_frontend(&dvbdemux->dmx, &budget->mem_frontend); + if (ret < 0) +- return ret; ++ goto err_release_dmx; + + ret = dvbdemux->dmx.connect_frontend(&dvbdemux->dmx, &budget->hw_frontend); + if (ret < 0) +- return ret; ++ goto err_release_dmx; + + dvb_net_init(&budget->dvb_adapter, &budget->dvb_net, &dvbdemux->dmx); + + return 0; ++ ++err_release_dmx: ++ dvb_dmxdev_release(&budget->dmxdev); ++ dvb_dmx_release(&budget->demux); ++ return ret; + } + + static void budget_unregister(struct budget *budget) +diff --git a/drivers/media/platform/davinci/vpss.c b/drivers/media/platform/davinci/vpss.c +index d38d2bbb6f0f8..7000f0bf0b353 100644 +--- a/drivers/media/platform/davinci/vpss.c ++++ b/drivers/media/platform/davinci/vpss.c +@@ -505,19 +505,31 @@ static void vpss_exit(void) + + static int __init vpss_init(void) + { ++ int ret; ++ + if (!request_mem_region(VPSS_CLK_CTRL, 4, "vpss_clock_control")) + return -EBUSY; + + oper_cfg.vpss_regs_base2 = ioremap(VPSS_CLK_CTRL, 4); + if (unlikely(!oper_cfg.vpss_regs_base2)) { +- release_mem_region(VPSS_CLK_CTRL, 4); +- return -ENOMEM; ++ ret = -ENOMEM; ++ goto err_ioremap; + } + + writel(VPSS_CLK_CTRL_VENCCLKEN | +- VPSS_CLK_CTRL_DACCLKEN, oper_cfg.vpss_regs_base2); ++ VPSS_CLK_CTRL_DACCLKEN, oper_cfg.vpss_regs_base2); ++ ++ ret = platform_driver_register(&vpss_driver); ++ if (ret) ++ goto err_pd_register; ++ ++ return 0; + +- return platform_driver_register(&vpss_driver); ++err_pd_register: ++ iounmap(oper_cfg.vpss_regs_base2); ++err_ioremap: ++ release_mem_region(VPSS_CLK_CTRL, 4); ++ return ret; + } + subsys_initcall(vpss_init); + module_exit(vpss_exit); +diff --git a/drivers/media/platform/qcom/camss/camss.c b/drivers/media/platform/qcom/camss/camss.c +index 3fdc9f964a3c6..2483641799dfb 100644 +--- a/drivers/media/platform/qcom/camss/camss.c ++++ b/drivers/media/platform/qcom/camss/camss.c +@@ -504,7 +504,6 @@ static int camss_of_parse_ports(struct camss *camss) + return num_subdevs; + + err_cleanup: +- v4l2_async_notifier_cleanup(&camss->notifier); + of_node_put(node); + return ret; + } +@@ -835,29 +834,38 @@ static int camss_probe(struct platform_device *pdev) + camss->csid_num = 4; + camss->vfe_num = 2; + } else { +- return -EINVAL; ++ ret = -EINVAL; ++ goto err_free; + } + + camss->csiphy = devm_kcalloc(dev, camss->csiphy_num, + sizeof(*camss->csiphy), GFP_KERNEL); +- if (!camss->csiphy) +- return -ENOMEM; ++ if (!camss->csiphy) { ++ ret = -ENOMEM; ++ goto err_free; ++ } + + camss->csid = devm_kcalloc(dev, camss->csid_num, sizeof(*camss->csid), + GFP_KERNEL); +- if (!camss->csid) +- return -ENOMEM; ++ if (!camss->csid) { ++ ret = -ENOMEM; ++ goto err_free; ++ } + + camss->vfe = devm_kcalloc(dev, camss->vfe_num, sizeof(*camss->vfe), + GFP_KERNEL); +- if (!camss->vfe) +- return -ENOMEM; ++ if (!camss->vfe) { ++ ret = -ENOMEM; ++ goto err_free; ++ } + + v4l2_async_notifier_init(&camss->notifier); + + num_subdevs = camss_of_parse_ports(camss); +- if (num_subdevs < 0) +- return num_subdevs; ++ if (num_subdevs < 0) { ++ ret = num_subdevs; ++ goto err_cleanup; ++ } + + ret = camss_init_subdevices(camss); + if (ret < 0) +@@ -936,6 +944,8 @@ err_register_entities: + v4l2_device_unregister(&camss->v4l2_dev); + err_cleanup: + v4l2_async_notifier_cleanup(&camss->notifier); ++err_free: ++ kfree(camss); + + return ret; + } +diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c +index 499845c32b1bc..0d7a173f8e61c 100644 +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -2037,7 +2037,8 @@ static int bond_release_and_destroy(struct net_device *bond_dev, + int ret; + + ret = __bond_release_one(bond_dev, slave_dev, false, true); +- if (ret == 0 && !bond_has_slaves(bond)) { ++ if (ret == 0 && !bond_has_slaves(bond) && ++ bond_dev->reg_state != NETREG_UNREGISTERING) { + bond_dev->priv_flags |= IFF_DISABLE_NETPOLL; + netdev_info(bond_dev, "Destroying bond\n"); + bond_remove_proc_entry(bond); +@@ -2777,6 +2778,9 @@ static int bond_ab_arp_inspect(struct bonding *bond) + if (bond_time_in_interval(bond, last_rx, 1)) { + bond_propose_link_state(slave, BOND_LINK_UP); + commit++; ++ } else if (slave->link == BOND_LINK_BACK) { ++ bond_propose_link_state(slave, BOND_LINK_FAIL); ++ commit++; + } + continue; + } +@@ -2885,6 +2889,19 @@ static void bond_ab_arp_commit(struct bonding *bond) + + continue; + ++ case BOND_LINK_FAIL: ++ bond_set_slave_link_state(slave, BOND_LINK_FAIL, ++ BOND_SLAVE_NOTIFY_NOW); ++ bond_set_slave_inactive_flags(slave, ++ BOND_SLAVE_NOTIFY_NOW); ++ ++ /* A slave has just been enslaved and has become ++ * the current active slave. ++ */ ++ if (rtnl_dereference(bond->curr_active_slave)) ++ RCU_INIT_POINTER(bond->current_arp_slave, NULL); ++ continue; ++ + default: + slave_err(bond->dev, slave->dev, + "impossible: link_new_state %d on slave\n", +@@ -2935,8 +2952,6 @@ static bool bond_ab_arp_probe(struct bonding *bond) + return should_notify_rtnl; + } + +- bond_set_slave_inactive_flags(curr_arp_slave, BOND_SLAVE_NOTIFY_LATER); +- + bond_for_each_slave_rcu(bond, slave, iter) { + if (!found && !before && bond_slave_is_up(slave)) + before = slave; +@@ -4246,13 +4261,23 @@ static netdev_tx_t bond_start_xmit(struct sk_buff *skb, struct net_device *dev) + return ret; + } + ++static u32 bond_mode_bcast_speed(struct slave *slave, u32 speed) ++{ ++ if (speed == 0 || speed == SPEED_UNKNOWN) ++ speed = slave->speed; ++ else ++ speed = min(speed, slave->speed); ++ ++ return speed; ++} ++ + static int bond_ethtool_get_link_ksettings(struct net_device *bond_dev, + struct ethtool_link_ksettings *cmd) + { + struct bonding *bond = netdev_priv(bond_dev); +- unsigned long speed = 0; + struct list_head *iter; + struct slave *slave; ++ u32 speed = 0; + + cmd->base.duplex = DUPLEX_UNKNOWN; + cmd->base.port = PORT_OTHER; +@@ -4264,8 +4289,13 @@ static int bond_ethtool_get_link_ksettings(struct net_device *bond_dev, + */ + bond_for_each_slave(bond, slave, iter) { + if (bond_slave_can_tx(slave)) { +- if (slave->speed != SPEED_UNKNOWN) +- speed += slave->speed; ++ if (slave->speed != SPEED_UNKNOWN) { ++ if (BOND_MODE(bond) == BOND_MODE_BROADCAST) ++ speed = bond_mode_bcast_speed(slave, ++ speed); ++ else ++ speed += slave->speed; ++ } + if (cmd->base.duplex == DUPLEX_UNKNOWN && + slave->duplex != DUPLEX_UNKNOWN) + cmd->base.duplex = slave->duplex; +diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c +index 14850b7fe6d7f..4bd66ba72c03c 100644 +--- a/drivers/net/dsa/b53/b53_common.c ++++ b/drivers/net/dsa/b53/b53_common.c +@@ -1523,6 +1523,8 @@ static int b53_arl_op(struct b53_device *dev, int op, int port, + return ret; + + switch (ret) { ++ case -ETIMEDOUT: ++ return ret; + case -ENOSPC: + dev_dbg(dev->dev, "{%pM,%.4d} no space left in ARL\n", + addr, vid); +diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c +index 26325f7b3c1fa..4d0d13d5d0998 100644 +--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c ++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c +@@ -2835,16 +2835,14 @@ static void ena_fw_reset_device(struct work_struct *work) + { + struct ena_adapter *adapter = + container_of(work, struct ena_adapter, reset_task); +- struct pci_dev *pdev = adapter->pdev; + +- if (unlikely(!test_bit(ENA_FLAG_TRIGGER_RESET, &adapter->flags))) { +- dev_err(&pdev->dev, +- "device reset schedule while reset bit is off\n"); +- return; +- } + rtnl_lock(); +- ena_destroy_device(adapter, false); +- ena_restore_device(adapter); ++ ++ if (likely(test_bit(ENA_FLAG_TRIGGER_RESET, &adapter->flags))) { ++ ena_destroy_device(adapter, false); ++ ena_restore_device(adapter); ++ } ++ + rtnl_unlock(); + } + +@@ -3675,8 +3673,11 @@ static void __ena_shutoff(struct pci_dev *pdev, bool shutdown) + netdev->rx_cpu_rmap = NULL; + } + #endif /* CONFIG_RFS_ACCEL */ +- del_timer_sync(&adapter->timer_service); + ++ /* Make sure timer and reset routine won't be called after ++ * freeing device resources. ++ */ ++ del_timer_sync(&adapter->timer_service); + cancel_work_sync(&adapter->reset_task); + + rtnl_lock(); /* lock released inside the below if-else block */ +diff --git a/drivers/net/ethernet/cortina/gemini.c b/drivers/net/ethernet/cortina/gemini.c +index 01ae113f122a0..28d4c54505f9a 100644 +--- a/drivers/net/ethernet/cortina/gemini.c ++++ b/drivers/net/ethernet/cortina/gemini.c +@@ -2388,7 +2388,7 @@ static int gemini_ethernet_port_probe(struct platform_device *pdev) + + dev_info(dev, "probe %s ID %d\n", dev_name(dev), id); + +- netdev = alloc_etherdev_mq(sizeof(*port), TX_QUEUE_NUM); ++ netdev = devm_alloc_etherdev_mqs(dev, sizeof(*port), TX_QUEUE_NUM, TX_QUEUE_NUM); + if (!netdev) { + dev_err(dev, "Can't allocate ethernet device #%d\n", id); + return -ENOMEM; +@@ -2520,7 +2520,6 @@ static int gemini_ethernet_port_probe(struct platform_device *pdev) + } + + port->netdev = NULL; +- free_netdev(netdev); + return ret; + } + +@@ -2529,7 +2528,6 @@ static int gemini_ethernet_port_remove(struct platform_device *pdev) + struct gemini_ethernet_port *port = platform_get_drvdata(pdev); + + gemini_port_remove(port); +- free_netdev(port->netdev); + return 0; + } + +diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c +index 39c112f1543c1..a0e4b12ac4ea2 100644 +--- a/drivers/net/ethernet/freescale/fec_main.c ++++ b/drivers/net/ethernet/freescale/fec_main.c +@@ -3707,11 +3707,11 @@ failed_mii_init: + failed_irq: + failed_init: + fec_ptp_stop(pdev); +- if (fep->reg_phy) +- regulator_disable(fep->reg_phy); + failed_reset: + pm_runtime_put_noidle(&pdev->dev); + pm_runtime_disable(&pdev->dev); ++ if (fep->reg_phy) ++ regulator_disable(fep->reg_phy); + failed_regulator: + clk_disable_unprepare(fep->clk_ahb); + failed_clk_ahb: +diff --git a/drivers/net/ethernet/intel/i40e/i40e_adminq_cmd.h b/drivers/net/ethernet/intel/i40e/i40e_adminq_cmd.h +index 69a2daaca5c56..d7684ac2522ef 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_adminq_cmd.h ++++ b/drivers/net/ethernet/intel/i40e/i40e_adminq_cmd.h +@@ -1211,7 +1211,7 @@ struct i40e_aqc_set_vsi_promiscuous_modes { + #define I40E_AQC_SET_VSI_PROMISC_BROADCAST 0x04 + #define I40E_AQC_SET_VSI_DEFAULT 0x08 + #define I40E_AQC_SET_VSI_PROMISC_VLAN 0x10 +-#define I40E_AQC_SET_VSI_PROMISC_TX 0x8000 ++#define I40E_AQC_SET_VSI_PROMISC_RX_ONLY 0x8000 + __le16 seid; + #define I40E_AQC_VSI_PROM_CMD_SEID_MASK 0x3FF + __le16 vlan_tag; +diff --git a/drivers/net/ethernet/intel/i40e/i40e_common.c b/drivers/net/ethernet/intel/i40e/i40e_common.c +index 3160b5bbe6728..66f7deaf46ae2 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_common.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_common.c +@@ -1949,6 +1949,21 @@ i40e_status i40e_aq_set_phy_debug(struct i40e_hw *hw, u8 cmd_flags, + return status; + } + ++/** ++ * i40e_is_aq_api_ver_ge ++ * @aq: pointer to AdminQ info containing HW API version to compare ++ * @maj: API major value ++ * @min: API minor value ++ * ++ * Assert whether current HW API version is greater/equal than provided. ++ **/ ++static bool i40e_is_aq_api_ver_ge(struct i40e_adminq_info *aq, u16 maj, ++ u16 min) ++{ ++ return (aq->api_maj_ver > maj || ++ (aq->api_maj_ver == maj && aq->api_min_ver >= min)); ++} ++ + /** + * i40e_aq_add_vsi + * @hw: pointer to the hw struct +@@ -2074,18 +2089,16 @@ i40e_status i40e_aq_set_vsi_unicast_promiscuous(struct i40e_hw *hw, + + if (set) { + flags |= I40E_AQC_SET_VSI_PROMISC_UNICAST; +- if (rx_only_promisc && +- (((hw->aq.api_maj_ver == 1) && (hw->aq.api_min_ver >= 5)) || +- (hw->aq.api_maj_ver > 1))) +- flags |= I40E_AQC_SET_VSI_PROMISC_TX; ++ if (rx_only_promisc && i40e_is_aq_api_ver_ge(&hw->aq, 1, 5)) ++ flags |= I40E_AQC_SET_VSI_PROMISC_RX_ONLY; + } + + cmd->promiscuous_flags = cpu_to_le16(flags); + + cmd->valid_flags = cpu_to_le16(I40E_AQC_SET_VSI_PROMISC_UNICAST); +- if (((hw->aq.api_maj_ver >= 1) && (hw->aq.api_min_ver >= 5)) || +- (hw->aq.api_maj_ver > 1)) +- cmd->valid_flags |= cpu_to_le16(I40E_AQC_SET_VSI_PROMISC_TX); ++ if (i40e_is_aq_api_ver_ge(&hw->aq, 1, 5)) ++ cmd->valid_flags |= ++ cpu_to_le16(I40E_AQC_SET_VSI_PROMISC_RX_ONLY); + + cmd->seid = cpu_to_le16(seid); + status = i40e_asq_send_command(hw, &desc, NULL, 0, cmd_details); +@@ -2182,11 +2195,17 @@ enum i40e_status_code i40e_aq_set_vsi_uc_promisc_on_vlan(struct i40e_hw *hw, + i40e_fill_default_direct_cmd_desc(&desc, + i40e_aqc_opc_set_vsi_promiscuous_modes); + +- if (enable) ++ if (enable) { + flags |= I40E_AQC_SET_VSI_PROMISC_UNICAST; ++ if (i40e_is_aq_api_ver_ge(&hw->aq, 1, 5)) ++ flags |= I40E_AQC_SET_VSI_PROMISC_RX_ONLY; ++ } + + cmd->promiscuous_flags = cpu_to_le16(flags); + cmd->valid_flags = cpu_to_le16(I40E_AQC_SET_VSI_PROMISC_UNICAST); ++ if (i40e_is_aq_api_ver_ge(&hw->aq, 1, 5)) ++ cmd->valid_flags |= ++ cpu_to_le16(I40E_AQC_SET_VSI_PROMISC_RX_ONLY); + cmd->seid = cpu_to_le16(seid); + cmd->vlan_tag = cpu_to_le16(vid | I40E_AQC_SET_VSI_VLAN_VALID); + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index 095ed81cc0ba4..b3c3911adfc2e 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -15342,6 +15342,9 @@ static void i40e_remove(struct pci_dev *pdev) + i40e_write_rx_ctl(hw, I40E_PFQF_HENA(0), 0); + i40e_write_rx_ctl(hw, I40E_PFQF_HENA(1), 0); + ++ while (test_bit(__I40E_RESET_RECOVERY_PENDING, pf->state)) ++ usleep_range(1000, 2000); ++ + /* no more scheduling of any task */ + set_bit(__I40E_SUSPENDED, pf->state); + set_bit(__I40E_DOWN, pf->state); +diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c +index 24bb721a12bc0..42eb7a7ecd96b 100644 +--- a/drivers/net/hyperv/netvsc_drv.c ++++ b/drivers/net/hyperv/netvsc_drv.c +@@ -501,7 +501,7 @@ static int netvsc_vf_xmit(struct net_device *net, struct net_device *vf_netdev, + int rc; + + skb->dev = vf_netdev; +- skb->queue_mapping = qdisc_skb_cb(skb)->slave_dev_queue_mapping; ++ skb_record_rx_queue(skb, qdisc_skb_cb(skb)->slave_dev_queue_mapping); + + rc = dev_queue_xmit(skb); + if (likely(rc == NET_XMIT_SUCCESS || rc == NET_XMIT_CN)) { +diff --git a/drivers/net/wan/Kconfig b/drivers/net/wan/Kconfig +index dd1a147f29716..058d77d2e693d 100644 +--- a/drivers/net/wan/Kconfig ++++ b/drivers/net/wan/Kconfig +@@ -200,7 +200,7 @@ config WANXL_BUILD_FIRMWARE + depends on WANXL && !PREVENT_FIRMWARE_BUILD + help + Allows you to rebuild firmware run by the QUICC processor. +- It requires as68k, ld68k and hexdump programs. ++ It requires m68k toolchains and hexdump programs. + + You should never need this option, say N. + +diff --git a/drivers/net/wan/Makefile b/drivers/net/wan/Makefile +index 701f5d2fe3b61..cf7a0a65aae8d 100644 +--- a/drivers/net/wan/Makefile ++++ b/drivers/net/wan/Makefile +@@ -40,17 +40,17 @@ $(obj)/wanxl.o: $(obj)/wanxlfw.inc + + ifeq ($(CONFIG_WANXL_BUILD_FIRMWARE),y) + ifeq ($(ARCH),m68k) +- AS68K = $(AS) +- LD68K = $(LD) ++ M68KCC = $(CC) ++ M68KLD = $(LD) + else +- AS68K = as68k +- LD68K = ld68k ++ M68KCC = $(CROSS_COMPILE_M68K)gcc ++ M68KLD = $(CROSS_COMPILE_M68K)ld + endif + + quiet_cmd_build_wanxlfw = BLD FW $@ + cmd_build_wanxlfw = \ +- $(CPP) -D__ASSEMBLY__ -Wp,-MD,$(depfile) -I$(srctree)/include/uapi $< | $(AS68K) -m68360 -o $(obj)/wanxlfw.o; \ +- $(LD68K) --oformat binary -Ttext 0x1000 $(obj)/wanxlfw.o -o $(obj)/wanxlfw.bin; \ ++ $(M68KCC) -D__ASSEMBLY__ -Wp,-MD,$(depfile) -I$(srctree)/include/uapi -c -o $(obj)/wanxlfw.o $<; \ ++ $(M68KLD) --oformat binary -Ttext 0x1000 $(obj)/wanxlfw.o -o $(obj)/wanxlfw.bin; \ + hexdump -ve '"\n" 16/1 "0x%02X,"' $(obj)/wanxlfw.bin | sed 's/0x ,//g;1s/^/static const u8 firmware[]={/;$$s/,$$/\n};\n/' >$(obj)/wanxlfw.inc; \ + rm -f $(obj)/wanxlfw.bin $(obj)/wanxlfw.o + +diff --git a/drivers/opp/core.c b/drivers/opp/core.c +index 9ff0538ee83a0..7b057c32e11b1 100644 +--- a/drivers/opp/core.c ++++ b/drivers/opp/core.c +@@ -843,10 +843,12 @@ int dev_pm_opp_set_rate(struct device *dev, unsigned long target_freq) + + /* Return early if nothing to do */ + if (old_freq == freq) { +- dev_dbg(dev, "%s: old/new frequencies (%lu Hz) are same, nothing to do\n", +- __func__, freq); +- ret = 0; +- goto put_opp_table; ++ if (!opp_table->required_opp_tables && !opp_table->regulators) { ++ dev_dbg(dev, "%s: old/new frequencies (%lu Hz) are same, nothing to do\n", ++ __func__, freq); ++ ret = 0; ++ goto put_opp_table; ++ } + } + + temp_freq = old_freq; +diff --git a/drivers/rtc/rtc-goldfish.c b/drivers/rtc/rtc-goldfish.c +index 1a3420ee6a4d9..d5083b013fbce 100644 +--- a/drivers/rtc/rtc-goldfish.c ++++ b/drivers/rtc/rtc-goldfish.c +@@ -73,6 +73,7 @@ static int goldfish_rtc_set_alarm(struct device *dev, + rtc_alarm64 = rtc_tm_to_time64(&alrm->time) * NSEC_PER_SEC; + writel((rtc_alarm64 >> 32), base + TIMER_ALARM_HIGH); + writel(rtc_alarm64, base + TIMER_ALARM_LOW); ++ writel(1, base + TIMER_IRQ_ENABLED); + } else { + /* + * if this function was called with enabled=0 +diff --git a/drivers/s390/scsi/zfcp_fsf.c b/drivers/s390/scsi/zfcp_fsf.c +index cf63916814cca..5c652deb6fed4 100644 +--- a/drivers/s390/scsi/zfcp_fsf.c ++++ b/drivers/s390/scsi/zfcp_fsf.c +@@ -409,7 +409,7 @@ static void zfcp_fsf_req_complete(struct zfcp_fsf_req *req) + return; + } + +- del_timer(&req->timer); ++ del_timer_sync(&req->timer); + zfcp_fsf_protstatus_eval(req); + zfcp_fsf_fsfstatus_eval(req); + req->handler(req); +@@ -762,7 +762,7 @@ static int zfcp_fsf_req_send(struct zfcp_fsf_req *req) + req->qdio_req.qdio_outb_usage = atomic_read(&qdio->req_q_free); + req->issued = get_tod_clock(); + if (zfcp_qdio_send(qdio, &req->qdio_req)) { +- del_timer(&req->timer); ++ del_timer_sync(&req->timer); + /* lookup request again, list might have changed */ + zfcp_reqlist_find_rm(adapter->req_list, req_id); + zfcp_erp_adapter_reopen(adapter, 0, "fsrs__1"); +diff --git a/drivers/scsi/libfc/fc_disc.c b/drivers/scsi/libfc/fc_disc.c +index 2b865c6423e29..e00dc4693fcbd 100644 +--- a/drivers/scsi/libfc/fc_disc.c ++++ b/drivers/scsi/libfc/fc_disc.c +@@ -581,8 +581,12 @@ static void fc_disc_gpn_id_resp(struct fc_seq *sp, struct fc_frame *fp, + + if (PTR_ERR(fp) == -FC_EX_CLOSED) + goto out; +- if (IS_ERR(fp)) +- goto redisc; ++ if (IS_ERR(fp)) { ++ mutex_lock(&disc->disc_mutex); ++ fc_disc_restart(disc); ++ mutex_unlock(&disc->disc_mutex); ++ goto out; ++ } + + cp = fc_frame_payload_get(fp, sizeof(*cp)); + if (!cp) +@@ -609,7 +613,7 @@ static void fc_disc_gpn_id_resp(struct fc_seq *sp, struct fc_frame *fp, + new_rdata->disc_id = disc->disc_id; + fc_rport_login(new_rdata); + } +- goto out; ++ goto free_fp; + } + rdata->disc_id = disc->disc_id; + mutex_unlock(&rdata->rp_mutex); +@@ -626,6 +630,8 @@ redisc: + fc_disc_restart(disc); + mutex_unlock(&disc->disc_mutex); + } ++free_fp: ++ fc_frame_free(fp); + out: + kref_put(&rdata->kref, fc_rport_destroy); + if (!IS_ERR(fp)) +diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c +index d7ec4083a0911..d91c95d9981ac 100644 +--- a/drivers/scsi/qla2xxx/qla_os.c ++++ b/drivers/scsi/qla2xxx/qla_os.c +@@ -2804,10 +2804,6 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id) + /* This may fail but that's ok */ + pci_enable_pcie_error_reporting(pdev); + +- /* Turn off T10-DIF when FC-NVMe is enabled */ +- if (ql2xnvmeenable) +- ql2xenabledif = 0; +- + ha = kzalloc(sizeof(struct qla_hw_data), GFP_KERNEL); + if (!ha) { + ql_log_pci(ql_log_fatal, pdev, 0x0009, +diff --git a/drivers/scsi/ufs/ufs_quirks.h b/drivers/scsi/ufs/ufs_quirks.h +index fe6cad9b2a0d2..03985919150b9 100644 +--- a/drivers/scsi/ufs/ufs_quirks.h ++++ b/drivers/scsi/ufs/ufs_quirks.h +@@ -12,6 +12,7 @@ + #define UFS_ANY_VENDOR 0xFFFF + #define UFS_ANY_MODEL "ANY_MODEL" + ++#define UFS_VENDOR_MICRON 0x12C + #define UFS_VENDOR_TOSHIBA 0x198 + #define UFS_VENDOR_SAMSUNG 0x1CE + #define UFS_VENDOR_SKHYNIX 0x1AD +diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c +index 2b6853c7375c9..b41b88bcab3d9 100644 +--- a/drivers/scsi/ufs/ufshcd.c ++++ b/drivers/scsi/ufs/ufshcd.c +@@ -217,6 +217,8 @@ ufs_get_desired_pm_lvl_for_dev_link_state(enum ufs_dev_pwr_mode dev_state, + + static struct ufs_dev_fix ufs_fixups[] = { + /* UFS cards deviations table */ ++ UFS_FIX(UFS_VENDOR_MICRON, UFS_ANY_MODEL, ++ UFS_DEVICE_QUIRK_DELAY_BEFORE_LPM), + UFS_FIX(UFS_VENDOR_SAMSUNG, UFS_ANY_MODEL, + UFS_DEVICE_QUIRK_DELAY_BEFORE_LPM), + UFS_FIX(UFS_VENDOR_SAMSUNG, UFS_ANY_MODEL, +diff --git a/drivers/spi/Kconfig b/drivers/spi/Kconfig +index 6f7fdcbb9151f..5bf7542087776 100644 +--- a/drivers/spi/Kconfig ++++ b/drivers/spi/Kconfig +@@ -944,4 +944,7 @@ config SPI_SLAVE_SYSTEM_CONTROL + + endif # SPI_SLAVE + ++config SPI_DYNAMIC ++ def_bool ACPI || OF_DYNAMIC || SPI_SLAVE ++ + endif # SPI +diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c +index b222ce8d083ef..7e92ab0cc9920 100644 +--- a/drivers/spi/spi-stm32.c ++++ b/drivers/spi/spi-stm32.c +@@ -14,6 +14,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -1986,6 +1987,8 @@ static int stm32_spi_remove(struct platform_device *pdev) + + pm_runtime_disable(&pdev->dev); + ++ pinctrl_pm_select_sleep_state(&pdev->dev); ++ + return 0; + } + +@@ -1997,13 +2000,18 @@ static int stm32_spi_runtime_suspend(struct device *dev) + + clk_disable_unprepare(spi->clk); + +- return 0; ++ return pinctrl_pm_select_sleep_state(dev); + } + + static int stm32_spi_runtime_resume(struct device *dev) + { + struct spi_master *master = dev_get_drvdata(dev); + struct stm32_spi *spi = spi_master_get_devdata(master); ++ int ret; ++ ++ ret = pinctrl_pm_select_default_state(dev); ++ if (ret) ++ return ret; + + return clk_prepare_enable(spi->clk); + } +@@ -2033,10 +2041,23 @@ static int stm32_spi_resume(struct device *dev) + return ret; + + ret = spi_master_resume(master); +- if (ret) ++ if (ret) { + clk_disable_unprepare(spi->clk); ++ return ret; ++ } + +- return ret; ++ ret = pm_runtime_get_sync(dev); ++ if (ret) { ++ dev_err(dev, "Unable to power device:%d\n", ret); ++ return ret; ++ } ++ ++ spi->cfg->config(spi); ++ ++ pm_runtime_mark_last_busy(dev); ++ pm_runtime_put_autosuspend(dev); ++ ++ return 0; + } + #endif + +diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c +index c6242f0a307f9..6a81b2a33cb4b 100644 +--- a/drivers/spi/spi.c ++++ b/drivers/spi/spi.c +@@ -475,6 +475,12 @@ static LIST_HEAD(spi_controller_list); + */ + static DEFINE_MUTEX(board_lock); + ++/* ++ * Prevents addition of devices with same chip select and ++ * addition of devices below an unregistering controller. ++ */ ++static DEFINE_MUTEX(spi_add_lock); ++ + /** + * spi_alloc_device - Allocate a new SPI device + * @ctlr: Controller to which device is connected +@@ -553,7 +559,6 @@ static int spi_dev_check(struct device *dev, void *data) + */ + int spi_add_device(struct spi_device *spi) + { +- static DEFINE_MUTEX(spi_add_lock); + struct spi_controller *ctlr = spi->controller; + struct device *dev = ctlr->dev.parent; + int status; +@@ -581,6 +586,13 @@ int spi_add_device(struct spi_device *spi) + goto done; + } + ++ /* Controller may unregister concurrently */ ++ if (IS_ENABLED(CONFIG_SPI_DYNAMIC) && ++ !device_is_registered(&ctlr->dev)) { ++ status = -ENODEV; ++ goto done; ++ } ++ + /* Descriptors take precedence */ + if (ctlr->cs_gpiods) + spi->cs_gpiod = ctlr->cs_gpiods[spi->chip_select]; +@@ -2582,6 +2594,10 @@ void spi_unregister_controller(struct spi_controller *ctlr) + struct spi_controller *found; + int id = ctlr->bus_num; + ++ /* Prevent addition of new devices, unregister existing ones */ ++ if (IS_ENABLED(CONFIG_SPI_DYNAMIC)) ++ mutex_lock(&spi_add_lock); ++ + device_for_each_child(&ctlr->dev, NULL, __unregister); + + /* First make sure that this controller was ever added */ +@@ -2602,6 +2618,9 @@ void spi_unregister_controller(struct spi_controller *ctlr) + if (found == ctlr) + idr_remove(&spi_master_idr, id); + mutex_unlock(&board_lock); ++ ++ if (IS_ENABLED(CONFIG_SPI_DYNAMIC)) ++ mutex_unlock(&spi_add_lock); + } + EXPORT_SYMBOL_GPL(spi_unregister_controller); + +diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c +index a497e7c1f4fcc..d766fb14942b3 100644 +--- a/drivers/target/target_core_user.c ++++ b/drivers/target/target_core_user.c +@@ -601,7 +601,7 @@ static inline void tcmu_flush_dcache_range(void *vaddr, size_t size) + size = round_up(size+offset, PAGE_SIZE); + + while (size) { +- flush_dcache_page(virt_to_page(start)); ++ flush_dcache_page(vmalloc_to_page(start)); + start += PAGE_SIZE; + size -= PAGE_SIZE; + } +diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c +index 6cc47af1f06d3..ca8c10aa4a4bc 100644 +--- a/drivers/vfio/vfio_iommu_type1.c ++++ b/drivers/vfio/vfio_iommu_type1.c +@@ -1187,13 +1187,16 @@ static int vfio_bus_type(struct device *dev, void *data) + static int vfio_iommu_replay(struct vfio_iommu *iommu, + struct vfio_domain *domain) + { +- struct vfio_domain *d; ++ struct vfio_domain *d = NULL; + struct rb_node *n; + unsigned long limit = rlimit(RLIMIT_MEMLOCK) >> PAGE_SHIFT; + int ret; + + /* Arbitrarily pick the first domain in the list for lookups */ +- d = list_first_entry(&iommu->domain_list, struct vfio_domain, next); ++ if (!list_empty(&iommu->domain_list)) ++ d = list_first_entry(&iommu->domain_list, ++ struct vfio_domain, next); ++ + n = rb_first(&iommu->dma_list); + + for (; n; n = rb_next(n)) { +@@ -1211,6 +1214,11 @@ static int vfio_iommu_replay(struct vfio_iommu *iommu, + phys_addr_t p; + dma_addr_t i; + ++ if (WARN_ON(!d)) { /* mapped w/o a domain?! */ ++ ret = -EINVAL; ++ goto unwind; ++ } ++ + phys = iommu_iova_to_phys(d->domain, iova); + + if (WARN_ON(!phys)) { +@@ -1240,7 +1248,7 @@ static int vfio_iommu_replay(struct vfio_iommu *iommu, + if (npage <= 0) { + WARN_ON(!npage); + ret = (int)npage; +- return ret; ++ goto unwind; + } + + phys = pfn << PAGE_SHIFT; +@@ -1249,14 +1257,67 @@ static int vfio_iommu_replay(struct vfio_iommu *iommu, + + ret = iommu_map(domain->domain, iova, phys, + size, dma->prot | domain->prot); +- if (ret) +- return ret; ++ if (ret) { ++ if (!dma->iommu_mapped) ++ vfio_unpin_pages_remote(dma, iova, ++ phys >> PAGE_SHIFT, ++ size >> PAGE_SHIFT, ++ true); ++ goto unwind; ++ } + + iova += size; + } ++ } ++ ++ /* All dmas are now mapped, defer to second tree walk for unwind */ ++ for (n = rb_first(&iommu->dma_list); n; n = rb_next(n)) { ++ struct vfio_dma *dma = rb_entry(n, struct vfio_dma, node); ++ + dma->iommu_mapped = true; + } ++ + return 0; ++ ++unwind: ++ for (; n; n = rb_prev(n)) { ++ struct vfio_dma *dma = rb_entry(n, struct vfio_dma, node); ++ dma_addr_t iova; ++ ++ if (dma->iommu_mapped) { ++ iommu_unmap(domain->domain, dma->iova, dma->size); ++ continue; ++ } ++ ++ iova = dma->iova; ++ while (iova < dma->iova + dma->size) { ++ phys_addr_t phys, p; ++ size_t size; ++ dma_addr_t i; ++ ++ phys = iommu_iova_to_phys(domain->domain, iova); ++ if (!phys) { ++ iova += PAGE_SIZE; ++ continue; ++ } ++ ++ size = PAGE_SIZE; ++ p = phys + size; ++ i = iova + size; ++ while (i < dma->iova + dma->size && ++ p == iommu_iova_to_phys(domain->domain, i)) { ++ size += PAGE_SIZE; ++ p += PAGE_SIZE; ++ i += PAGE_SIZE; ++ } ++ ++ iommu_unmap(domain->domain, iova, size); ++ vfio_unpin_pages_remote(dma, iova, phys >> PAGE_SHIFT, ++ size >> PAGE_SHIFT, true); ++ } ++ } ++ ++ return ret; + } + + /* +diff --git a/drivers/video/fbdev/efifb.c b/drivers/video/fbdev/efifb.c +index 51d97ec4f58f9..e0cbf5b3d2174 100644 +--- a/drivers/video/fbdev/efifb.c ++++ b/drivers/video/fbdev/efifb.c +@@ -453,7 +453,7 @@ static int efifb_probe(struct platform_device *dev) + info->apertures->ranges[0].base = efifb_fix.smem_start; + info->apertures->ranges[0].size = size_remap; + +- if (efi_enabled(EFI_BOOT) && ++ if (efi_enabled(EFI_MEMMAP) && + !efi_mem_desc_lookup(efifb_fix.smem_start, &md)) { + if ((efifb_fix.smem_start + efifb_fix.smem_len) > + (md.phys_addr + (md.num_pages << EFI_PAGE_SHIFT))) { +diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c +index 58b96baa8d488..4f7c73e6052f6 100644 +--- a/drivers/virtio/virtio_ring.c ++++ b/drivers/virtio/virtio_ring.c +@@ -1960,6 +1960,9 @@ bool virtqueue_poll(struct virtqueue *_vq, unsigned last_used_idx) + { + struct vring_virtqueue *vq = to_vvq(_vq); + ++ if (unlikely(vq->broken)) ++ return false; ++ + virtio_mb(vq->weak_barriers); + return vq->packed_ring ? virtqueue_poll_packed(_vq, last_used_idx) : + virtqueue_poll_split(_vq, last_used_idx); +diff --git a/drivers/xen/preempt.c b/drivers/xen/preempt.c +index 456a164364a22..98a9d6892d989 100644 +--- a/drivers/xen/preempt.c ++++ b/drivers/xen/preempt.c +@@ -27,7 +27,7 @@ EXPORT_SYMBOL_GPL(xen_in_preemptible_hcall); + asmlinkage __visible void xen_maybe_preempt_hcall(void) + { + if (unlikely(__this_cpu_read(xen_in_preemptible_hcall) +- && need_resched())) { ++ && need_resched() && !preempt_count())) { + /* + * Clear flag as we may be rescheduled on a different + * cpu. +diff --git a/drivers/xen/swiotlb-xen.c b/drivers/xen/swiotlb-xen.c +index bd3a10dfac157..06346422f7432 100644 +--- a/drivers/xen/swiotlb-xen.c ++++ b/drivers/xen/swiotlb-xen.c +@@ -335,6 +335,7 @@ xen_swiotlb_free_coherent(struct device *hwdev, size_t size, void *vaddr, + int order = get_order(size); + phys_addr_t phys; + u64 dma_mask = DMA_BIT_MASK(32); ++ struct page *page; + + if (hwdev && hwdev->coherent_dma_mask) + dma_mask = hwdev->coherent_dma_mask; +@@ -346,9 +347,14 @@ xen_swiotlb_free_coherent(struct device *hwdev, size_t size, void *vaddr, + /* Convert the size to actually allocated. */ + size = 1UL << (order + XEN_PAGE_SHIFT); + ++ if (is_vmalloc_addr(vaddr)) ++ page = vmalloc_to_page(vaddr); ++ else ++ page = virt_to_page(vaddr); ++ + if (!WARN_ON((dev_addr + size - 1 > dma_mask) || + range_straddles_page_boundary(phys, size)) && +- TestClearPageXenRemapped(virt_to_page(vaddr))) ++ TestClearPageXenRemapped(page)) + xen_destroy_contiguous_region(phys, order); + + xen_free_coherent_pages(hwdev, size, vaddr, (dma_addr_t)phys, attrs); +diff --git a/fs/afs/dynroot.c b/fs/afs/dynroot.c +index 7503899c0a1b5..f07e53ab808e3 100644 +--- a/fs/afs/dynroot.c ++++ b/fs/afs/dynroot.c +@@ -289,15 +289,17 @@ void afs_dynroot_depopulate(struct super_block *sb) + net->dynroot_sb = NULL; + mutex_unlock(&net->proc_cells_lock); + +- inode_lock(root->d_inode); +- +- /* Remove all the pins for dirs created for manually added cells */ +- list_for_each_entry_safe(subdir, tmp, &root->d_subdirs, d_child) { +- if (subdir->d_fsdata) { +- subdir->d_fsdata = NULL; +- dput(subdir); ++ if (root) { ++ inode_lock(root->d_inode); ++ ++ /* Remove all the pins for dirs created for manually added cells */ ++ list_for_each_entry_safe(subdir, tmp, &root->d_subdirs, d_child) { ++ if (subdir->d_fsdata) { ++ subdir->d_fsdata = NULL; ++ dput(subdir); ++ } + } +- } + +- inode_unlock(root->d_inode); ++ inode_unlock(root->d_inode); ++ } + } +diff --git a/fs/btrfs/block-group.c b/fs/btrfs/block-group.c +index 42d69e77f89d9..b167649f5f5de 100644 +--- a/fs/btrfs/block-group.c ++++ b/fs/btrfs/block-group.c +@@ -2168,7 +2168,7 @@ static int cache_save_setup(struct btrfs_block_group_cache *block_group, + return 0; + } + +- if (trans->aborted) ++ if (TRANS_ABORTED(trans)) + return 0; + again: + inode = lookup_free_space_inode(block_group, path); +diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h +index 2374f3f6f3b70..18357b054a91e 100644 +--- a/fs/btrfs/ctree.h ++++ b/fs/btrfs/ctree.h +@@ -2965,6 +2965,8 @@ int btrfs_defrag_leaves(struct btrfs_trans_handle *trans, + int btrfs_parse_options(struct btrfs_fs_info *info, char *options, + unsigned long new_flags); + int btrfs_sync_fs(struct super_block *sb, int wait); ++char *btrfs_get_subvol_name_from_objectid(struct btrfs_fs_info *fs_info, ++ u64 subvol_objectid); + + static inline __printf(2, 3) __cold + void btrfs_no_printk(const struct btrfs_fs_info *fs_info, const char *fmt, ...) +diff --git a/fs/btrfs/delayed-inode.c b/fs/btrfs/delayed-inode.c +index 5bcccfbcc7c15..a34ee9c2f3151 100644 +--- a/fs/btrfs/delayed-inode.c ++++ b/fs/btrfs/delayed-inode.c +@@ -1151,7 +1151,7 @@ static int __btrfs_run_delayed_items(struct btrfs_trans_handle *trans, int nr) + int ret = 0; + bool count = (nr > 0); + +- if (trans->aborted) ++ if (TRANS_ABORTED(trans)) + return -EIO; + + path = btrfs_alloc_path(); +diff --git a/fs/btrfs/export.c b/fs/btrfs/export.c +index ddf28ecf17f93..93cceeba484cc 100644 +--- a/fs/btrfs/export.c ++++ b/fs/btrfs/export.c +@@ -57,9 +57,9 @@ static int btrfs_encode_fh(struct inode *inode, u32 *fh, int *max_len, + return type; + } + +-static struct dentry *btrfs_get_dentry(struct super_block *sb, u64 objectid, +- u64 root_objectid, u32 generation, +- int check_generation) ++struct dentry *btrfs_get_dentry(struct super_block *sb, u64 objectid, ++ u64 root_objectid, u32 generation, ++ int check_generation) + { + struct btrfs_fs_info *fs_info = btrfs_sb(sb); + struct btrfs_root *root; +@@ -152,7 +152,7 @@ static struct dentry *btrfs_fh_to_dentry(struct super_block *sb, struct fid *fh, + return btrfs_get_dentry(sb, objectid, root_objectid, generation, 1); + } + +-static struct dentry *btrfs_get_parent(struct dentry *child) ++struct dentry *btrfs_get_parent(struct dentry *child) + { + struct inode *dir = d_inode(child); + struct btrfs_fs_info *fs_info = btrfs_sb(dir->i_sb); +diff --git a/fs/btrfs/export.h b/fs/btrfs/export.h +index 57488ecd7d4ef..f32f4113c976a 100644 +--- a/fs/btrfs/export.h ++++ b/fs/btrfs/export.h +@@ -18,4 +18,9 @@ struct btrfs_fid { + u64 parent_root_objectid; + } __attribute__ ((packed)); + ++struct dentry *btrfs_get_dentry(struct super_block *sb, u64 objectid, ++ u64 root_objectid, u32 generation, ++ int check_generation); ++struct dentry *btrfs_get_parent(struct dentry *child); ++ + #endif +diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c +index 739332b462059..a36bd4507bacd 100644 +--- a/fs/btrfs/extent-tree.c ++++ b/fs/btrfs/extent-tree.c +@@ -1561,7 +1561,7 @@ static int run_delayed_extent_op(struct btrfs_trans_handle *trans, + int err = 0; + int metadata = !extent_op->is_data; + +- if (trans->aborted) ++ if (TRANS_ABORTED(trans)) + return 0; + + if (metadata && !btrfs_fs_incompat(fs_info, SKINNY_METADATA)) +@@ -1681,7 +1681,7 @@ static int run_one_delayed_ref(struct btrfs_trans_handle *trans, + { + int ret = 0; + +- if (trans->aborted) { ++ if (TRANS_ABORTED(trans)) { + if (insert_reserved) + btrfs_pin_extent(trans->fs_info, node->bytenr, + node->num_bytes, 1); +@@ -2169,7 +2169,7 @@ int btrfs_run_delayed_refs(struct btrfs_trans_handle *trans, + int run_all = count == (unsigned long)-1; + + /* We'll clean this up in btrfs_cleanup_transaction */ +- if (trans->aborted) ++ if (TRANS_ABORTED(trans)) + return 0; + + if (test_bit(BTRFS_FS_CREATING_FREE_SPACE_TREE, &fs_info->flags)) +@@ -2892,7 +2892,7 @@ int btrfs_finish_extent_commit(struct btrfs_trans_handle *trans) + else + unpin = &fs_info->freed_extents[0]; + +- while (!trans->aborted) { ++ while (!TRANS_ABORTED(trans)) { + struct extent_state *cached_state = NULL; + + mutex_lock(&fs_info->unused_bg_unpin_mutex); +@@ -2924,7 +2924,7 @@ int btrfs_finish_extent_commit(struct btrfs_trans_handle *trans) + u64 trimmed = 0; + + ret = -EROFS; +- if (!trans->aborted) ++ if (!TRANS_ABORTED(trans)) + ret = btrfs_discard_extent(fs_info, + block_group->key.objectid, + block_group->key.offset, +diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c +index 035ea5bc692ad..5707bf0575d43 100644 +--- a/fs/btrfs/extent_io.c ++++ b/fs/btrfs/extent_io.c +@@ -4073,7 +4073,7 @@ retry: + if (!test_bit(BTRFS_FS_STATE_ERROR, &fs_info->fs_state)) { + ret = flush_write_bio(&epd); + } else { +- ret = -EUCLEAN; ++ ret = -EROFS; + end_write_bio(&epd, ret); + } + return ret; +diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c +index a7b043fd7a572..498b824148187 100644 +--- a/fs/btrfs/scrub.c ++++ b/fs/btrfs/scrub.c +@@ -3717,7 +3717,7 @@ static noinline_for_stack int scrub_supers(struct scrub_ctx *sctx, + struct btrfs_fs_info *fs_info = sctx->fs_info; + + if (test_bit(BTRFS_FS_STATE_ERROR, &fs_info->fs_state)) +- return -EIO; ++ return -EROFS; + + /* Seed devices of a new filesystem has their own generation. */ + if (scrub_dev->fs_devices != fs_info->fs_devices) +diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c +index 4b0ee34aa65d5..a1498df419b4f 100644 +--- a/fs/btrfs/super.c ++++ b/fs/btrfs/super.c +@@ -241,7 +241,7 @@ void __btrfs_abort_transaction(struct btrfs_trans_handle *trans, + { + struct btrfs_fs_info *fs_info = trans->fs_info; + +- trans->aborted = errno; ++ WRITE_ONCE(trans->aborted, errno); + /* Nothing used. The other threads that have joined this + * transaction may be able to continue. */ + if (!trans->dirty && list_empty(&trans->new_bgs)) { +@@ -1009,8 +1009,8 @@ out: + return error; + } + +-static char *get_subvol_name_from_objectid(struct btrfs_fs_info *fs_info, +- u64 subvol_objectid) ++char *btrfs_get_subvol_name_from_objectid(struct btrfs_fs_info *fs_info, ++ u64 subvol_objectid) + { + struct btrfs_root *root = fs_info->tree_root; + struct btrfs_root *fs_root; +@@ -1291,6 +1291,7 @@ static int btrfs_show_options(struct seq_file *seq, struct dentry *dentry) + { + struct btrfs_fs_info *info = btrfs_sb(dentry->d_sb); + const char *compress_type; ++ const char *subvol_name; + + if (btrfs_test_opt(info, DEGRADED)) + seq_puts(seq, ",degraded"); +@@ -1375,8 +1376,13 @@ static int btrfs_show_options(struct seq_file *seq, struct dentry *dentry) + seq_puts(seq, ",ref_verify"); + seq_printf(seq, ",subvolid=%llu", + BTRFS_I(d_inode(dentry))->root->root_key.objectid); +- seq_puts(seq, ",subvol="); +- seq_dentry(seq, dentry, " \t\n\\"); ++ subvol_name = btrfs_get_subvol_name_from_objectid(info, ++ BTRFS_I(d_inode(dentry))->root->root_key.objectid); ++ if (!IS_ERR(subvol_name)) { ++ seq_puts(seq, ",subvol="); ++ seq_escape(seq, subvol_name, " \t\n\\"); ++ kfree(subvol_name); ++ } + return 0; + } + +@@ -1421,8 +1427,8 @@ static struct dentry *mount_subvol(const char *subvol_name, u64 subvol_objectid, + goto out; + } + } +- subvol_name = get_subvol_name_from_objectid(btrfs_sb(mnt->mnt_sb), +- subvol_objectid); ++ subvol_name = btrfs_get_subvol_name_from_objectid( ++ btrfs_sb(mnt->mnt_sb), subvol_objectid); + if (IS_ERR(subvol_name)) { + root = ERR_CAST(subvol_name); + subvol_name = NULL; +diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c +index 54589e940f9af..c346ee7ec18d4 100644 +--- a/fs/btrfs/transaction.c ++++ b/fs/btrfs/transaction.c +@@ -174,7 +174,7 @@ loop: + + cur_trans = fs_info->running_transaction; + if (cur_trans) { +- if (cur_trans->aborted) { ++ if (TRANS_ABORTED(cur_trans)) { + spin_unlock(&fs_info->trans_lock); + return cur_trans->aborted; + } +@@ -390,7 +390,7 @@ static inline int is_transaction_blocked(struct btrfs_transaction *trans) + { + return (trans->state >= TRANS_STATE_BLOCKED && + trans->state < TRANS_STATE_UNBLOCKED && +- !trans->aborted); ++ !TRANS_ABORTED(trans)); + } + + /* wait for commit against the current transaction to become unblocked +@@ -409,7 +409,7 @@ static void wait_current_trans(struct btrfs_fs_info *fs_info) + + wait_event(fs_info->transaction_wait, + cur_trans->state >= TRANS_STATE_UNBLOCKED || +- cur_trans->aborted); ++ TRANS_ABORTED(cur_trans)); + btrfs_put_transaction(cur_trans); + } else { + spin_unlock(&fs_info->trans_lock); +@@ -870,10 +870,13 @@ static int __btrfs_end_transaction(struct btrfs_trans_handle *trans, + if (throttle) + btrfs_run_delayed_iputs(info); + +- if (trans->aborted || ++ if (TRANS_ABORTED(trans) || + test_bit(BTRFS_FS_STATE_ERROR, &info->fs_state)) { + wake_up_process(info->transaction_kthread); +- err = -EIO; ++ if (TRANS_ABORTED(trans)) ++ err = trans->aborted; ++ else ++ err = -EROFS; + } + + kmem_cache_free(btrfs_trans_handle_cachep, trans); +@@ -1727,7 +1730,8 @@ static void wait_current_trans_commit_start(struct btrfs_fs_info *fs_info, + struct btrfs_transaction *trans) + { + wait_event(fs_info->transaction_blocked_wait, +- trans->state >= TRANS_STATE_COMMIT_START || trans->aborted); ++ trans->state >= TRANS_STATE_COMMIT_START || ++ TRANS_ABORTED(trans)); + } + + /* +@@ -1739,7 +1743,8 @@ static void wait_current_trans_commit_start_and_unblock( + struct btrfs_transaction *trans) + { + wait_event(fs_info->transaction_wait, +- trans->state >= TRANS_STATE_UNBLOCKED || trans->aborted); ++ trans->state >= TRANS_STATE_UNBLOCKED || ++ TRANS_ABORTED(trans)); + } + + /* +@@ -1957,7 +1962,7 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans) + trans->dirty = true; + + /* Stop the commit early if ->aborted is set */ +- if (unlikely(READ_ONCE(cur_trans->aborted))) { ++ if (TRANS_ABORTED(cur_trans)) { + ret = cur_trans->aborted; + btrfs_end_transaction(trans); + return ret; +@@ -2031,7 +2036,7 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans) + + wait_for_commit(cur_trans); + +- if (unlikely(cur_trans->aborted)) ++ if (TRANS_ABORTED(cur_trans)) + ret = cur_trans->aborted; + + btrfs_put_transaction(cur_trans); +@@ -2050,7 +2055,7 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans) + spin_unlock(&fs_info->trans_lock); + + wait_for_commit(prev_trans); +- ret = prev_trans->aborted; ++ ret = READ_ONCE(prev_trans->aborted); + + btrfs_put_transaction(prev_trans); + if (ret) +@@ -2104,8 +2109,7 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans) + wait_event(cur_trans->writer_wait, + atomic_read(&cur_trans->num_writers) == 1); + +- /* ->aborted might be set after the previous check, so check it */ +- if (unlikely(READ_ONCE(cur_trans->aborted))) { ++ if (TRANS_ABORTED(cur_trans)) { + ret = cur_trans->aborted; + goto scrub_continue; + } +@@ -2223,7 +2227,7 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans) + * The tasks which save the space cache and inode cache may also + * update ->aborted, check it. + */ +- if (unlikely(READ_ONCE(cur_trans->aborted))) { ++ if (TRANS_ABORTED(cur_trans)) { + ret = cur_trans->aborted; + mutex_unlock(&fs_info->tree_log_mutex); + mutex_unlock(&fs_info->reloc_mutex); +diff --git a/fs/btrfs/transaction.h b/fs/btrfs/transaction.h +index b15c31d231488..7291a2a930751 100644 +--- a/fs/btrfs/transaction.h ++++ b/fs/btrfs/transaction.h +@@ -116,6 +116,10 @@ struct btrfs_trans_handle { + struct btrfs_block_rsv *orig_rsv; + refcount_t use_count; + unsigned int type; ++ /* ++ * Error code of transaction abort, set outside of locks and must use ++ * the READ_ONCE/WRITE_ONCE access ++ */ + short aborted; + bool adding_csums; + bool allocating_chunk; +@@ -127,6 +131,14 @@ struct btrfs_trans_handle { + struct list_head new_bgs; + }; + ++/* ++ * The abort status can be changed between calls and is not protected by locks. ++ * This accepts btrfs_transaction and btrfs_trans_handle as types. Once it's ++ * set to a non-zero value it does not change, so the macro should be in checks ++ * but is not necessary for further reads of the value. ++ */ ++#define TRANS_ABORTED(trans) (unlikely(READ_ONCE((trans)->aborted))) ++ + struct btrfs_pending_snapshot { + struct dentry *dentry; + struct inode *dir; +diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c +index 701bc3f4d4ba1..b0077f5a31688 100644 +--- a/fs/ceph/mds_client.c ++++ b/fs/ceph/mds_client.c +@@ -4143,7 +4143,6 @@ int ceph_mdsc_init(struct ceph_fs_client *fsc) + return -ENOMEM; + } + +- fsc->mdsc = mdsc; + init_completion(&mdsc->safe_umount_waiters); + init_waitqueue_head(&mdsc->session_close_wq); + INIT_LIST_HEAD(&mdsc->waiting_for_map); +@@ -4195,6 +4194,8 @@ int ceph_mdsc_init(struct ceph_fs_client *fsc) + + strscpy(mdsc->nodename, utsname()->nodename, + sizeof(mdsc->nodename)); ++ ++ fsc->mdsc = mdsc; + return 0; + } + +diff --git a/fs/eventpoll.c b/fs/eventpoll.c +index 6307c1d883e0a..0d9b1e2b9da72 100644 +--- a/fs/eventpoll.c ++++ b/fs/eventpoll.c +@@ -1991,9 +1991,11 @@ static int ep_loop_check_proc(void *priv, void *cookie, int call_nests) + * not already there, and calling reverse_path_check() + * during ep_insert(). + */ +- if (list_empty(&epi->ffd.file->f_tfile_llink)) ++ if (list_empty(&epi->ffd.file->f_tfile_llink)) { ++ get_file(epi->ffd.file); + list_add(&epi->ffd.file->f_tfile_llink, + &tfile_check_list); ++ } + } + } + mutex_unlock(&ep->mtx); +@@ -2037,6 +2039,7 @@ static void clear_tfile_check_list(void) + file = list_first_entry(&tfile_check_list, struct file, + f_tfile_llink); + list_del_init(&file->f_tfile_llink); ++ fput(file); + } + INIT_LIST_HEAD(&tfile_check_list); + } +@@ -2192,13 +2195,13 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd, + mutex_lock(&epmutex); + if (is_file_epoll(tf.file)) { + error = -ELOOP; +- if (ep_loop_check(ep, tf.file) != 0) { +- clear_tfile_check_list(); ++ if (ep_loop_check(ep, tf.file) != 0) + goto error_tgt_fput; +- } +- } else ++ } else { ++ get_file(tf.file); + list_add(&tf.file->f_tfile_llink, + &tfile_check_list); ++ } + mutex_lock_nested(&ep->mtx, 0); + if (is_file_epoll(tf.file)) { + tep = tf.file->private_data; +@@ -2222,8 +2225,6 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd, + error = ep_insert(ep, &epds, tf.file, fd, full_check); + } else + error = -EEXIST; +- if (full_check) +- clear_tfile_check_list(); + break; + case EPOLL_CTL_DEL: + if (epi) +@@ -2246,8 +2247,10 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd, + mutex_unlock(&ep->mtx); + + error_tgt_fput: +- if (full_check) ++ if (full_check) { ++ clear_tfile_check_list(); + mutex_unlock(&epmutex); ++ } + + fdput(tf); + error_fput: +diff --git a/fs/ext4/block_validity.c b/fs/ext4/block_validity.c +index ff8e1205127ee..ceb54ccc937e9 100644 +--- a/fs/ext4/block_validity.c ++++ b/fs/ext4/block_validity.c +@@ -68,7 +68,7 @@ static int add_system_zone(struct ext4_system_blocks *system_blks, + ext4_fsblk_t start_blk, + unsigned int count) + { +- struct ext4_system_zone *new_entry = NULL, *entry; ++ struct ext4_system_zone *new_entry, *entry; + struct rb_node **n = &system_blks->root.rb_node, *node; + struct rb_node *parent = NULL, *new_node = NULL; + +@@ -79,30 +79,20 @@ static int add_system_zone(struct ext4_system_blocks *system_blks, + n = &(*n)->rb_left; + else if (start_blk >= (entry->start_blk + entry->count)) + n = &(*n)->rb_right; +- else { +- if (start_blk + count > (entry->start_blk + +- entry->count)) +- entry->count = (start_blk + count - +- entry->start_blk); +- new_node = *n; +- new_entry = rb_entry(new_node, struct ext4_system_zone, +- node); +- break; +- } ++ else /* Unexpected overlap of system zones. */ ++ return -EFSCORRUPTED; + } + +- if (!new_entry) { +- new_entry = kmem_cache_alloc(ext4_system_zone_cachep, +- GFP_KERNEL); +- if (!new_entry) +- return -ENOMEM; +- new_entry->start_blk = start_blk; +- new_entry->count = count; +- new_node = &new_entry->node; +- +- rb_link_node(new_node, parent, n); +- rb_insert_color(new_node, &system_blks->root); +- } ++ new_entry = kmem_cache_alloc(ext4_system_zone_cachep, ++ GFP_KERNEL); ++ if (!new_entry) ++ return -ENOMEM; ++ new_entry->start_blk = start_blk; ++ new_entry->count = count; ++ new_node = &new_entry->node; ++ ++ rb_link_node(new_node, parent, n); ++ rb_insert_color(new_node, &system_blks->root); + + /* Can we merge to the left? */ + node = rb_prev(new_node); +diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c +index a564d0289a70a..36a81b57012a5 100644 +--- a/fs/ext4/namei.c ++++ b/fs/ext4/namei.c +@@ -1392,8 +1392,8 @@ int ext4_search_dir(struct buffer_head *bh, char *search_buf, int buf_size, + ext4_match(dir, fname, de)) { + /* found a match - just to be sure, do + * a full check */ +- if (ext4_check_dir_entry(dir, NULL, de, bh, bh->b_data, +- bh->b_size, offset)) ++ if (ext4_check_dir_entry(dir, NULL, de, bh, search_buf, ++ buf_size, offset)) + return -1; + *res_dir = de; + return 1; +@@ -1852,7 +1852,7 @@ static struct ext4_dir_entry_2 *do_split(handle_t *handle, struct inode *dir, + blocksize, hinfo, map); + map -= count; + dx_sort_map(map, count); +- /* Split the existing block in the middle, size-wise */ ++ /* Ensure that neither split block is over half full */ + size = 0; + move = 0; + for (i = count-1; i >= 0; i--) { +@@ -1862,8 +1862,18 @@ static struct ext4_dir_entry_2 *do_split(handle_t *handle, struct inode *dir, + size += map[i].size; + move++; + } +- /* map index at which we will split */ +- split = count - move; ++ /* ++ * map index at which we will split ++ * ++ * If the sum of active entries didn't exceed half the block size, just ++ * split it in half by count; each resulting block will have at least ++ * half the space free. ++ */ ++ if (i > 0) ++ split = count - move; ++ else ++ split = count/2; ++ + hash2 = map[split].hash; + continued = hash2 == map[split - 1].hash; + dxtrace(printk(KERN_INFO "Split block %lu at %x, %i/%i\n", +@@ -2462,7 +2472,7 @@ int ext4_generic_delete_entry(handle_t *handle, + de = (struct ext4_dir_entry_2 *)entry_buf; + while (i < buf_size - csum_size) { + if (ext4_check_dir_entry(dir, NULL, de, bh, +- bh->b_data, bh->b_size, i)) ++ entry_buf, buf_size, i)) + return -EFSCORRUPTED; + if (de == de_del) { + if (pde) +diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c +index adbb8fef22162..50fa3e08c02f3 100644 +--- a/fs/gfs2/bmap.c ++++ b/fs/gfs2/bmap.c +@@ -1350,9 +1350,15 @@ int gfs2_extent_map(struct inode *inode, u64 lblock, int *new, u64 *dblock, unsi + return ret; + } + ++/* ++ * NOTE: Never call gfs2_block_zero_range with an open transaction because it ++ * uses iomap write to perform its actions, which begin their own transactions ++ * (iomap_begin, page_prepare, etc.) ++ */ + static int gfs2_block_zero_range(struct inode *inode, loff_t from, + unsigned int length) + { ++ BUG_ON(current->journal_info); + return iomap_zero_range(inode, from, length, NULL, &gfs2_iomap_ops); + } + +@@ -1413,6 +1419,16 @@ static int trunc_start(struct inode *inode, u64 newsize) + u64 oldsize = inode->i_size; + int error; + ++ if (!gfs2_is_stuffed(ip)) { ++ unsigned int blocksize = i_blocksize(inode); ++ unsigned int offs = newsize & (blocksize - 1); ++ if (offs) { ++ error = gfs2_block_zero_range(inode, newsize, ++ blocksize - offs); ++ if (error) ++ return error; ++ } ++ } + if (journaled) + error = gfs2_trans_begin(sdp, RES_DINODE + RES_JDATA, GFS2_JTRUNC_REVOKES); + else +@@ -1426,19 +1442,10 @@ static int trunc_start(struct inode *inode, u64 newsize) + + gfs2_trans_add_meta(ip->i_gl, dibh); + +- if (gfs2_is_stuffed(ip)) { ++ if (gfs2_is_stuffed(ip)) + gfs2_buffer_clear_tail(dibh, sizeof(struct gfs2_dinode) + newsize); +- } else { +- unsigned int blocksize = i_blocksize(inode); +- unsigned int offs = newsize & (blocksize - 1); +- if (offs) { +- error = gfs2_block_zero_range(inode, newsize, +- blocksize - offs); +- if (error) +- goto out; +- } ++ else + ip->i_diskflags |= GFS2_DIF_TRUNC_IN_PROG; +- } + + i_size_write(inode, newsize); + ip->i_inode.i_mtime = ip->i_inode.i_ctime = current_time(&ip->i_inode); +@@ -2442,24 +2449,13 @@ int __gfs2_punch_hole(struct file *file, loff_t offset, loff_t length) + struct inode *inode = file_inode(file); + struct gfs2_inode *ip = GFS2_I(inode); + struct gfs2_sbd *sdp = GFS2_SB(inode); ++ unsigned int blocksize = i_blocksize(inode); ++ loff_t start, end; + int error; + +- if (gfs2_is_jdata(ip)) +- error = gfs2_trans_begin(sdp, RES_DINODE + 2 * RES_JDATA, +- GFS2_JTRUNC_REVOKES); +- else +- error = gfs2_trans_begin(sdp, RES_DINODE, 0); +- if (error) +- return error; ++ if (!gfs2_is_stuffed(ip)) { ++ unsigned int start_off, end_len; + +- if (gfs2_is_stuffed(ip)) { +- error = stuffed_zero_range(inode, offset, length); +- if (error) +- goto out; +- } else { +- unsigned int start_off, end_len, blocksize; +- +- blocksize = i_blocksize(inode); + start_off = offset & (blocksize - 1); + end_len = (offset + length) & (blocksize - 1); + if (start_off) { +@@ -2480,6 +2476,26 @@ int __gfs2_punch_hole(struct file *file, loff_t offset, loff_t length) + } + } + ++ start = round_down(offset, blocksize); ++ end = round_up(offset + length, blocksize) - 1; ++ error = filemap_write_and_wait_range(inode->i_mapping, start, end); ++ if (error) ++ return error; ++ ++ if (gfs2_is_jdata(ip)) ++ error = gfs2_trans_begin(sdp, RES_DINODE + 2 * RES_JDATA, ++ GFS2_JTRUNC_REVOKES); ++ else ++ error = gfs2_trans_begin(sdp, RES_DINODE, 0); ++ if (error) ++ return error; ++ ++ if (gfs2_is_stuffed(ip)) { ++ error = stuffed_zero_range(inode, offset, length); ++ if (error) ++ goto out; ++ } ++ + if (gfs2_is_jdata(ip)) { + BUG_ON(!current->journal_info); + gfs2_journaled_truncate_range(inode, offset, length); +diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c +index fa58835668a62..b7c5819bfc411 100644 +--- a/fs/jbd2/journal.c ++++ b/fs/jbd2/journal.c +@@ -1348,8 +1348,10 @@ static int jbd2_write_superblock(journal_t *journal, int write_flags) + int ret; + + /* Buffer got discarded which means block device got invalidated */ +- if (!buffer_mapped(bh)) ++ if (!buffer_mapped(bh)) { ++ unlock_buffer(bh); + return -EIO; ++ } + + trace_jbd2_write_superblock(journal, write_flags); + if (!(journal->j_flags & JBD2_BARRIER)) +diff --git a/fs/jffs2/dir.c b/fs/jffs2/dir.c +index f20cff1194bb6..776493713153f 100644 +--- a/fs/jffs2/dir.c ++++ b/fs/jffs2/dir.c +@@ -590,10 +590,14 @@ static int jffs2_rmdir (struct inode *dir_i, struct dentry *dentry) + int ret; + uint32_t now = JFFS2_NOW(); + ++ mutex_lock(&f->sem); + for (fd = f->dents ; fd; fd = fd->next) { +- if (fd->ino) ++ if (fd->ino) { ++ mutex_unlock(&f->sem); + return -ENOTEMPTY; ++ } + } ++ mutex_unlock(&f->sem); + + ret = jffs2_do_unlink(c, dir_f, dentry->d_name.name, + dentry->d_name.len, f, now); +diff --git a/fs/romfs/storage.c b/fs/romfs/storage.c +index 6b2b4362089e6..b57b3ffcbc327 100644 +--- a/fs/romfs/storage.c ++++ b/fs/romfs/storage.c +@@ -217,10 +217,8 @@ int romfs_dev_read(struct super_block *sb, unsigned long pos, + size_t limit; + + limit = romfs_maxsize(sb); +- if (pos >= limit) ++ if (pos >= limit || buflen > limit - pos) + return -EIO; +- if (buflen > limit - pos) +- buflen = limit - pos; + + #ifdef CONFIG_ROMFS_ON_MTD + if (sb->s_mtd) +diff --git a/fs/signalfd.c b/fs/signalfd.c +index 44b6845b071c3..5b78719be4455 100644 +--- a/fs/signalfd.c ++++ b/fs/signalfd.c +@@ -314,9 +314,10 @@ SYSCALL_DEFINE4(signalfd4, int, ufd, sigset_t __user *, user_mask, + { + sigset_t mask; + +- if (sizemask != sizeof(sigset_t) || +- copy_from_user(&mask, user_mask, sizeof(mask))) ++ if (sizemask != sizeof(sigset_t)) + return -EINVAL; ++ if (copy_from_user(&mask, user_mask, sizeof(mask))) ++ return -EFAULT; + return do_signalfd4(ufd, &mask, flags); + } + +@@ -325,9 +326,10 @@ SYSCALL_DEFINE3(signalfd, int, ufd, sigset_t __user *, user_mask, + { + sigset_t mask; + +- if (sizemask != sizeof(sigset_t) || +- copy_from_user(&mask, user_mask, sizeof(mask))) ++ if (sizemask != sizeof(sigset_t)) + return -EINVAL; ++ if (copy_from_user(&mask, user_mask, sizeof(mask))) ++ return -EFAULT; + return do_signalfd4(ufd, &mask, 0); + } + +diff --git a/fs/xfs/xfs_sysfs.h b/fs/xfs/xfs_sysfs.h +index e9f810fc67317..43585850f1546 100644 +--- a/fs/xfs/xfs_sysfs.h ++++ b/fs/xfs/xfs_sysfs.h +@@ -32,9 +32,11 @@ xfs_sysfs_init( + struct xfs_kobj *parent_kobj, + const char *name) + { ++ struct kobject *parent; ++ ++ parent = parent_kobj ? &parent_kobj->kobject : NULL; + init_completion(&kobj->complete); +- return kobject_init_and_add(&kobj->kobject, ktype, +- &parent_kobj->kobject, "%s", name); ++ return kobject_init_and_add(&kobj->kobject, ktype, parent, "%s", name); + } + + static inline void +diff --git a/fs/xfs/xfs_trans_dquot.c b/fs/xfs/xfs_trans_dquot.c +index 16457465833ba..904780dd74aa3 100644 +--- a/fs/xfs/xfs_trans_dquot.c ++++ b/fs/xfs/xfs_trans_dquot.c +@@ -646,7 +646,7 @@ xfs_trans_dqresv( + } + } + if (ninos > 0) { +- total_count = be64_to_cpu(dqp->q_core.d_icount) + ninos; ++ total_count = dqp->q_res_icount + ninos; + timer = be32_to_cpu(dqp->q_core.d_itimer); + warns = be16_to_cpu(dqp->q_core.d_iwarns); + warnlimit = dqp->q_mount->m_quotainfo->qi_iwarnlimit; +diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c +index aa83538efc238..a793bd23fe56c 100644 +--- a/kernel/events/uprobes.c ++++ b/kernel/events/uprobes.c +@@ -211,7 +211,7 @@ static int __replace_page(struct vm_area_struct *vma, unsigned long addr, + try_to_free_swap(old_page); + page_vma_mapped_walk_done(&pvmw); + +- if (vma->vm_flags & VM_LOCKED) ++ if ((vma->vm_flags & VM_LOCKED) && !PageCompound(old_page)) + munlock_vma_page(old_page); + put_page(old_page); + +diff --git a/kernel/kthread.c b/kernel/kthread.c +index b262f47046ca4..bfbfa481be3a5 100644 +--- a/kernel/kthread.c ++++ b/kernel/kthread.c +@@ -199,8 +199,15 @@ static void __kthread_parkme(struct kthread *self) + if (!test_bit(KTHREAD_SHOULD_PARK, &self->flags)) + break; + ++ /* ++ * Thread is going to call schedule(), do not preempt it, ++ * or the caller of kthread_park() may spend more time in ++ * wait_task_inactive(). ++ */ ++ preempt_disable(); + complete(&self->parked); +- schedule(); ++ schedule_preempt_disabled(); ++ preempt_enable(); + } + __set_current_state(TASK_RUNNING); + } +@@ -245,8 +252,14 @@ static int kthread(void *_create) + /* OK, tell user we're spawned, wait for stop or wakeup */ + __set_current_state(TASK_UNINTERRUPTIBLE); + create->result = current; ++ /* ++ * Thread is going to call schedule(), do not preempt it, ++ * or the creator may spend more time in wait_task_inactive(). ++ */ ++ preempt_disable(); + complete(done); +- schedule(); ++ schedule_preempt_disabled(); ++ preempt_enable(); + + ret = -EINTR; + if (!test_bit(KTHREAD_SHOULD_STOP, &self->flags)) { +diff --git a/kernel/relay.c b/kernel/relay.c +index 4b760ec163426..d3940becf2fc3 100644 +--- a/kernel/relay.c ++++ b/kernel/relay.c +@@ -197,6 +197,7 @@ free_buf: + static void relay_destroy_channel(struct kref *kref) + { + struct rchan *chan = container_of(kref, struct rchan, kref); ++ free_percpu(chan->buf); + kfree(chan); + } + +diff --git a/mm/hugetlb.c b/mm/hugetlb.c +index 2af1831596f22..2a83b03c54a69 100644 +--- a/mm/hugetlb.c ++++ b/mm/hugetlb.c +@@ -4846,25 +4846,21 @@ static bool vma_shareable(struct vm_area_struct *vma, unsigned long addr) + void adjust_range_if_pmd_sharing_possible(struct vm_area_struct *vma, + unsigned long *start, unsigned long *end) + { +- unsigned long check_addr = *start; ++ unsigned long a_start, a_end; + + if (!(vma->vm_flags & VM_MAYSHARE)) + return; + +- for (check_addr = *start; check_addr < *end; check_addr += PUD_SIZE) { +- unsigned long a_start = check_addr & PUD_MASK; +- unsigned long a_end = a_start + PUD_SIZE; ++ /* Extend the range to be PUD aligned for a worst case scenario */ ++ a_start = ALIGN_DOWN(*start, PUD_SIZE); ++ a_end = ALIGN(*end, PUD_SIZE); + +- /* +- * If sharing is possible, adjust start/end if necessary. +- */ +- if (range_in_vma(vma, a_start, a_end)) { +- if (a_start < *start) +- *start = a_start; +- if (a_end > *end) +- *end = a_end; +- } +- } ++ /* ++ * Intersect the range with the vma range, since pmd sharing won't be ++ * across vma after all ++ */ ++ *start = max(vma->vm_start, a_start); ++ *end = min(vma->vm_end, a_end); + } + + /* +diff --git a/mm/khugepaged.c b/mm/khugepaged.c +index 719f49d1fba2f..3623d1c5343f2 100644 +--- a/mm/khugepaged.c ++++ b/mm/khugepaged.c +@@ -401,7 +401,7 @@ static void insert_to_mm_slots_hash(struct mm_struct *mm, + + static inline int khugepaged_test_exit(struct mm_struct *mm) + { +- return atomic_read(&mm->mm_users) == 0; ++ return atomic_read(&mm->mm_users) == 0 || !mmget_still_valid(mm); + } + + static bool hugepage_vma_check(struct vm_area_struct *vma, +@@ -438,7 +438,7 @@ int __khugepaged_enter(struct mm_struct *mm) + return -ENOMEM; + + /* __khugepaged_exit() must not run from under us */ +- VM_BUG_ON_MM(khugepaged_test_exit(mm), mm); ++ VM_BUG_ON_MM(atomic_read(&mm->mm_users) == 0, mm); + if (unlikely(test_and_set_bit(MMF_VM_HUGEPAGE, &mm->flags))) { + free_mm_slot(mm_slot); + return 0; +@@ -1019,9 +1019,6 @@ static void collapse_huge_page(struct mm_struct *mm, + * handled by the anon_vma lock + PG_lock. + */ + down_write(&mm->mmap_sem); +- result = SCAN_ANY_PROCESS; +- if (!mmget_still_valid(mm)) +- goto out; + result = hugepage_vma_revalidate(mm, address, &vma); + if (result) + goto out; +diff --git a/mm/page_alloc.c b/mm/page_alloc.c +index 8686fe760f34c..67a9943aa595f 100644 +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -1256,6 +1256,11 @@ static void free_pcppages_bulk(struct zone *zone, int count, + struct page *page, *tmp; + LIST_HEAD(head); + ++ /* ++ * Ensure proper count is passed which otherwise would stuck in the ++ * below while (list_empty(list)) loop. ++ */ ++ count = min(pcp->count, count); + while (count) { + struct list_head *list; + +@@ -7867,7 +7872,7 @@ int __meminit init_per_zone_wmark_min(void) + + return 0; + } +-core_initcall(init_per_zone_wmark_min) ++postcore_initcall(init_per_zone_wmark_min) + + /* + * min_free_kbytes_sysctl_handler - just a wrapper around proc_dointvec() so +diff --git a/net/can/j1939/socket.c b/net/can/j1939/socket.c +index f7587428febdd..bf9fd6ee88fe0 100644 +--- a/net/can/j1939/socket.c ++++ b/net/can/j1939/socket.c +@@ -398,6 +398,7 @@ static int j1939_sk_init(struct sock *sk) + spin_lock_init(&jsk->sk_session_queue_lock); + INIT_LIST_HEAD(&jsk->sk_session_queue); + sk->sk_destruct = j1939_sk_sock_destruct; ++ sk->sk_protocol = CAN_J1939; + + return 0; + } +@@ -466,6 +467,14 @@ static int j1939_sk_bind(struct socket *sock, struct sockaddr *uaddr, int len) + goto out_release_sock; + } + ++ if (!ndev->ml_priv) { ++ netdev_warn_once(ndev, ++ "No CAN mid layer private allocated, please fix your driver and use alloc_candev()!\n"); ++ dev_put(ndev); ++ ret = -ENODEV; ++ goto out_release_sock; ++ } ++ + priv = j1939_netdev_start(ndev); + dev_put(ndev); + if (IS_ERR(priv)) { +@@ -553,6 +562,11 @@ static int j1939_sk_connect(struct socket *sock, struct sockaddr *uaddr, + static void j1939_sk_sock2sockaddr_can(struct sockaddr_can *addr, + const struct j1939_sock *jsk, int peer) + { ++ /* There are two holes (2 bytes and 3 bytes) to clear to avoid ++ * leaking kernel information to user space. ++ */ ++ memset(addr, 0, J1939_MIN_NAMELEN); ++ + addr->can_family = AF_CAN; + addr->can_ifindex = jsk->ifindex; + addr->can_addr.j1939.pgn = jsk->addr.pgn; +diff --git a/net/can/j1939/transport.c b/net/can/j1939/transport.c +index 9f99af5b0b11e..dbd215cbc53d8 100644 +--- a/net/can/j1939/transport.c ++++ b/net/can/j1939/transport.c +@@ -352,17 +352,16 @@ void j1939_session_skb_queue(struct j1939_session *session, + skb_queue_tail(&session->skb_queue, skb); + } + +-static struct sk_buff *j1939_session_skb_find(struct j1939_session *session) ++static struct ++sk_buff *j1939_session_skb_find_by_offset(struct j1939_session *session, ++ unsigned int offset_start) + { + struct j1939_priv *priv = session->priv; ++ struct j1939_sk_buff_cb *do_skcb; + struct sk_buff *skb = NULL; + struct sk_buff *do_skb; +- struct j1939_sk_buff_cb *do_skcb; +- unsigned int offset_start; + unsigned long flags; + +- offset_start = session->pkt.dpo * 7; +- + spin_lock_irqsave(&session->skb_queue.lock, flags); + skb_queue_walk(&session->skb_queue, do_skb) { + do_skcb = j1939_skb_to_cb(do_skb); +@@ -382,6 +381,14 @@ static struct sk_buff *j1939_session_skb_find(struct j1939_session *session) + return skb; + } + ++static struct sk_buff *j1939_session_skb_find(struct j1939_session *session) ++{ ++ unsigned int offset_start; ++ ++ offset_start = session->pkt.dpo * 7; ++ return j1939_session_skb_find_by_offset(session, offset_start); ++} ++ + /* see if we are receiver + * returns 0 for broadcasts, although we will receive them + */ +@@ -716,10 +723,12 @@ static int j1939_session_tx_rts(struct j1939_session *session) + return ret; + + session->last_txcmd = dat[0]; +- if (dat[0] == J1939_TP_CMD_BAM) ++ if (dat[0] == J1939_TP_CMD_BAM) { + j1939_tp_schedule_txtimer(session, 50); +- +- j1939_tp_set_rxtimeout(session, 1250); ++ j1939_tp_set_rxtimeout(session, 250); ++ } else { ++ j1939_tp_set_rxtimeout(session, 1250); ++ } + + netdev_dbg(session->priv->ndev, "%s: 0x%p\n", __func__, session); + +@@ -766,7 +775,7 @@ static int j1939_session_tx_dat(struct j1939_session *session) + int ret = 0; + u8 dat[8]; + +- se_skb = j1939_session_skb_find(session); ++ se_skb = j1939_session_skb_find_by_offset(session, session->pkt.tx * 7); + if (!se_skb) + return -ENOBUFS; + +@@ -787,6 +796,18 @@ static int j1939_session_tx_dat(struct j1939_session *session) + if (len > 7) + len = 7; + ++ if (offset + len > se_skb->len) { ++ netdev_err_once(priv->ndev, ++ "%s: 0x%p: requested data outside of queued buffer: offset %i, len %i, pkt.tx: %i\n", ++ __func__, session, skcb->offset, se_skb->len , session->pkt.tx); ++ return -EOVERFLOW; ++ } ++ ++ if (!len) { ++ ret = -ENOBUFS; ++ break; ++ } ++ + memcpy(&dat[1], &tpdat[offset], len); + ret = j1939_tp_tx_dat(session, dat, len + 1); + if (ret < 0) { +@@ -1055,9 +1076,9 @@ static void __j1939_session_cancel(struct j1939_session *session, + lockdep_assert_held(&session->priv->active_session_list_lock); + + session->err = j1939_xtp_abort_to_errno(priv, err); ++ session->state = J1939_SESSION_WAITING_ABORT; + /* do not send aborts on incoming broadcasts */ + if (!j1939_cb_is_broadcast(&session->skcb)) { +- session->state = J1939_SESSION_WAITING_ABORT; + j1939_xtp_tx_abort(priv, &session->skcb, + !session->transmission, + err, session->skcb.addr.pgn); +@@ -1120,6 +1141,9 @@ static enum hrtimer_restart j1939_tp_txtimer(struct hrtimer *hrtimer) + * cleanup including propagation of the error to user space. + */ + break; ++ case -EOVERFLOW: ++ j1939_session_cancel(session, J1939_XTP_ABORT_ECTS_TOO_BIG); ++ break; + case 0: + session->tx_retry = 0; + break; +@@ -1651,8 +1675,12 @@ static void j1939_xtp_rx_rts(struct j1939_priv *priv, struct sk_buff *skb, + return; + } + session = j1939_xtp_rx_rts_session_new(priv, skb); +- if (!session) ++ if (!session) { ++ if (cmd == J1939_TP_CMD_BAM && j1939_sk_recv_match(priv, skcb)) ++ netdev_info(priv->ndev, "%s: failed to create TP BAM session\n", ++ __func__); + return; ++ } + } else { + if (j1939_xtp_rx_rts_session_active(session, skb)) { + j1939_session_put(session); +@@ -1661,11 +1689,15 @@ static void j1939_xtp_rx_rts(struct j1939_priv *priv, struct sk_buff *skb, + } + session->last_cmd = cmd; + +- j1939_tp_set_rxtimeout(session, 1250); +- +- if (cmd != J1939_TP_CMD_BAM && !session->transmission) { +- j1939_session_txtimer_cancel(session); +- j1939_tp_schedule_txtimer(session, 0); ++ if (cmd == J1939_TP_CMD_BAM) { ++ if (!session->transmission) ++ j1939_tp_set_rxtimeout(session, 750); ++ } else { ++ if (!session->transmission) { ++ j1939_session_txtimer_cancel(session); ++ j1939_tp_schedule_txtimer(session, 0); ++ } ++ j1939_tp_set_rxtimeout(session, 1250); + } + + j1939_session_put(session); +@@ -1716,6 +1748,7 @@ static void j1939_xtp_rx_dat_one(struct j1939_session *session, + int offset; + int nbytes; + bool final = false; ++ bool remain = false; + bool do_cts_eoma = false; + int packet; + +@@ -1750,7 +1783,8 @@ static void j1939_xtp_rx_dat_one(struct j1939_session *session, + __func__, session); + goto out_session_cancel; + } +- se_skb = j1939_session_skb_find(session); ++ ++ se_skb = j1939_session_skb_find_by_offset(session, packet * 7); + if (!se_skb) { + netdev_warn(priv->ndev, "%s: 0x%p: no skb found\n", __func__, + session); +@@ -1777,6 +1811,8 @@ static void j1939_xtp_rx_dat_one(struct j1939_session *session, + j1939_cb_is_broadcast(&session->skcb)) { + if (session->pkt.rx >= session->pkt.total) + final = true; ++ else ++ remain = true; + } else { + /* never final, an EOMA must follow */ + if (session->pkt.rx >= session->pkt.last) +@@ -1784,7 +1820,11 @@ static void j1939_xtp_rx_dat_one(struct j1939_session *session, + } + + if (final) { ++ j1939_session_timers_cancel(session); + j1939_session_completed(session); ++ } else if (remain) { ++ if (!session->transmission) ++ j1939_tp_set_rxtimeout(session, 750); + } else if (do_cts_eoma) { + j1939_tp_set_rxtimeout(session, 1250); + if (!session->transmission) +@@ -1829,6 +1869,13 @@ static void j1939_xtp_rx_dat(struct j1939_priv *priv, struct sk_buff *skb) + else + j1939_xtp_rx_dat_one(session, skb); + } ++ ++ if (j1939_cb_is_broadcast(skcb)) { ++ session = j1939_session_get_by_addr(priv, &skcb->addr, false, ++ false); ++ if (session) ++ j1939_xtp_rx_dat_one(session, skb); ++ } + } + + /* j1939 main intf */ +@@ -1920,7 +1967,7 @@ static void j1939_tp_cmd_recv(struct j1939_priv *priv, struct sk_buff *skb) + if (j1939_tp_im_transmitter(skcb)) + j1939_xtp_rx_rts(priv, skb, true); + +- if (j1939_tp_im_receiver(skcb)) ++ if (j1939_tp_im_receiver(skcb) || j1939_cb_is_broadcast(skcb)) + j1939_xtp_rx_rts(priv, skb, false); + + break; +@@ -1984,7 +2031,7 @@ int j1939_tp_recv(struct j1939_priv *priv, struct sk_buff *skb) + { + struct j1939_sk_buff_cb *skcb = j1939_skb_to_cb(skb); + +- if (!j1939_tp_im_involved_anydir(skcb)) ++ if (!j1939_tp_im_involved_anydir(skcb) && !j1939_cb_is_broadcast(skcb)) + return 0; + + switch (skcb->addr.pgn) { +@@ -2017,6 +2064,10 @@ void j1939_simple_recv(struct j1939_priv *priv, struct sk_buff *skb) + if (!skb->sk) + return; + ++ if (skb->sk->sk_family != AF_CAN || ++ skb->sk->sk_protocol != CAN_J1939) ++ return; ++ + j1939_session_list_lock(priv); + session = j1939_session_get_simple(priv, skb); + j1939_session_list_unlock(priv); +diff --git a/net/core/filter.c b/net/core/filter.c +index bd1e46d61d8a1..5c490d473df1d 100644 +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -8010,6 +8010,43 @@ static u32 sock_ops_convert_ctx_access(enum bpf_access_type type, + offsetof(OBJ, OBJ_FIELD)); \ + } while (0) + ++#define SOCK_OPS_GET_SK() \ ++ do { \ ++ int fullsock_reg = si->dst_reg, reg = BPF_REG_9, jmp = 1; \ ++ if (si->dst_reg == reg || si->src_reg == reg) \ ++ reg--; \ ++ if (si->dst_reg == reg || si->src_reg == reg) \ ++ reg--; \ ++ if (si->dst_reg == si->src_reg) { \ ++ *insn++ = BPF_STX_MEM(BPF_DW, si->src_reg, reg, \ ++ offsetof(struct bpf_sock_ops_kern, \ ++ temp)); \ ++ fullsock_reg = reg; \ ++ jmp += 2; \ ++ } \ ++ *insn++ = BPF_LDX_MEM(BPF_FIELD_SIZEOF( \ ++ struct bpf_sock_ops_kern, \ ++ is_fullsock), \ ++ fullsock_reg, si->src_reg, \ ++ offsetof(struct bpf_sock_ops_kern, \ ++ is_fullsock)); \ ++ *insn++ = BPF_JMP_IMM(BPF_JEQ, fullsock_reg, 0, jmp); \ ++ if (si->dst_reg == si->src_reg) \ ++ *insn++ = BPF_LDX_MEM(BPF_DW, reg, si->src_reg, \ ++ offsetof(struct bpf_sock_ops_kern, \ ++ temp)); \ ++ *insn++ = BPF_LDX_MEM(BPF_FIELD_SIZEOF( \ ++ struct bpf_sock_ops_kern, sk),\ ++ si->dst_reg, si->src_reg, \ ++ offsetof(struct bpf_sock_ops_kern, sk));\ ++ if (si->dst_reg == si->src_reg) { \ ++ *insn++ = BPF_JMP_A(1); \ ++ *insn++ = BPF_LDX_MEM(BPF_DW, reg, si->src_reg, \ ++ offsetof(struct bpf_sock_ops_kern, \ ++ temp)); \ ++ } \ ++ } while (0) ++ + #define SOCK_OPS_GET_TCP_SOCK_FIELD(FIELD) \ + SOCK_OPS_GET_FIELD(FIELD, FIELD, struct tcp_sock) + +@@ -8294,17 +8331,7 @@ static u32 sock_ops_convert_ctx_access(enum bpf_access_type type, + SOCK_OPS_GET_TCP_SOCK_FIELD(bytes_acked); + break; + case offsetof(struct bpf_sock_ops, sk): +- *insn++ = BPF_LDX_MEM(BPF_FIELD_SIZEOF( +- struct bpf_sock_ops_kern, +- is_fullsock), +- si->dst_reg, si->src_reg, +- offsetof(struct bpf_sock_ops_kern, +- is_fullsock)); +- *insn++ = BPF_JMP_IMM(BPF_JEQ, si->dst_reg, 0, 1); +- *insn++ = BPF_LDX_MEM(BPF_FIELD_SIZEOF( +- struct bpf_sock_ops_kern, sk), +- si->dst_reg, si->src_reg, +- offsetof(struct bpf_sock_ops_kern, sk)); ++ SOCK_OPS_GET_SK(); + break; + } + return insn - insn_buf; +diff --git a/net/netfilter/nft_exthdr.c b/net/netfilter/nft_exthdr.c +index a5e8469859e39..427d77b111b17 100644 +--- a/net/netfilter/nft_exthdr.c ++++ b/net/netfilter/nft_exthdr.c +@@ -44,7 +44,7 @@ static void nft_exthdr_ipv6_eval(const struct nft_expr *expr, + + err = ipv6_find_hdr(pkt->skb, &offset, priv->type, NULL, NULL); + if (priv->flags & NFT_EXTHDR_F_PRESENT) { +- *dest = (err >= 0); ++ nft_reg_store8(dest, err >= 0); + return; + } else if (err < 0) { + goto err; +@@ -141,7 +141,7 @@ static void nft_exthdr_ipv4_eval(const struct nft_expr *expr, + + err = ipv4_find_option(nft_net(pkt), skb, &offset, priv->type); + if (priv->flags & NFT_EXTHDR_F_PRESENT) { +- *dest = (err >= 0); ++ nft_reg_store8(dest, err >= 0); + return; + } else if (err < 0) { + goto err; +diff --git a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c +index 0ce4e75b29812..d803d814a03ad 100644 +--- a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c ++++ b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c +@@ -265,6 +265,8 @@ static int svc_rdma_post_recv(struct svcxprt_rdma *rdma) + { + struct svc_rdma_recv_ctxt *ctxt; + ++ if (test_bit(XPT_CLOSE, &rdma->sc_xprt.xpt_flags)) ++ return 0; + ctxt = svc_rdma_recv_ctxt_get(rdma); + if (!ctxt) + return -ENOMEM; +diff --git a/scripts/kconfig/qconf.cc b/scripts/kconfig/qconf.cc +index 0f8c77f847114..a94909ad9a53a 100644 +--- a/scripts/kconfig/qconf.cc ++++ b/scripts/kconfig/qconf.cc +@@ -869,40 +869,40 @@ void ConfigList::focusInEvent(QFocusEvent *e) + + void ConfigList::contextMenuEvent(QContextMenuEvent *e) + { +- if (e->y() <= header()->geometry().bottom()) { +- if (!headerPopup) { +- QAction *action; +- +- headerPopup = new QMenu(this); +- action = new QAction("Show Name", this); +- action->setCheckable(true); +- connect(action, SIGNAL(toggled(bool)), +- parent(), SLOT(setShowName(bool))); +- connect(parent(), SIGNAL(showNameChanged(bool)), +- action, SLOT(setOn(bool))); +- action->setChecked(showName); +- headerPopup->addAction(action); +- action = new QAction("Show Range", this); +- action->setCheckable(true); +- connect(action, SIGNAL(toggled(bool)), +- parent(), SLOT(setShowRange(bool))); +- connect(parent(), SIGNAL(showRangeChanged(bool)), +- action, SLOT(setOn(bool))); +- action->setChecked(showRange); +- headerPopup->addAction(action); +- action = new QAction("Show Data", this); +- action->setCheckable(true); +- connect(action, SIGNAL(toggled(bool)), +- parent(), SLOT(setShowData(bool))); +- connect(parent(), SIGNAL(showDataChanged(bool)), +- action, SLOT(setOn(bool))); +- action->setChecked(showData); +- headerPopup->addAction(action); +- } +- headerPopup->exec(e->globalPos()); +- e->accept(); +- } else +- e->ignore(); ++ if (!headerPopup) { ++ QAction *action; ++ ++ headerPopup = new QMenu(this); ++ action = new QAction("Show Name", this); ++ action->setCheckable(true); ++ connect(action, SIGNAL(toggled(bool)), ++ parent(), SLOT(setShowName(bool))); ++ connect(parent(), SIGNAL(showNameChanged(bool)), ++ action, SLOT(setChecked(bool))); ++ action->setChecked(showName); ++ headerPopup->addAction(action); ++ ++ action = new QAction("Show Range", this); ++ action->setCheckable(true); ++ connect(action, SIGNAL(toggled(bool)), ++ parent(), SLOT(setShowRange(bool))); ++ connect(parent(), SIGNAL(showRangeChanged(bool)), ++ action, SLOT(setChecked(bool))); ++ action->setChecked(showRange); ++ headerPopup->addAction(action); ++ ++ action = new QAction("Show Data", this); ++ action->setCheckable(true); ++ connect(action, SIGNAL(toggled(bool)), ++ parent(), SLOT(setShowData(bool))); ++ connect(parent(), SIGNAL(showDataChanged(bool)), ++ action, SLOT(setChecked(bool))); ++ action->setChecked(showData); ++ headerPopup->addAction(action); ++ } ++ ++ headerPopup->exec(e->globalPos()); ++ e->accept(); + } + + ConfigView*ConfigView::viewList; +@@ -1228,7 +1228,7 @@ QMenu* ConfigInfoView::createStandardContextMenu(const QPoint & pos) + + action->setCheckable(true); + connect(action, SIGNAL(toggled(bool)), SLOT(setShowDebug(bool))); +- connect(this, SIGNAL(showDebugChanged(bool)), action, SLOT(setOn(bool))); ++ connect(this, SIGNAL(showDebugChanged(bool)), action, SLOT(setChecked(bool))); + action->setChecked(showDebug()); + popup->addSeparator(); + popup->addAction(action); +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 88629906f314c..06bbcfbb28153 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -7666,6 +7666,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x144d, 0xc109, "Samsung Ativ book 9 (NP900X3G)", ALC269_FIXUP_INV_DMIC), + SND_PCI_QUIRK(0x144d, 0xc169, "Samsung Notebook 9 Pen (NP930SBE-K01US)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET), + SND_PCI_QUIRK(0x144d, 0xc176, "Samsung Notebook 9 Pro (NP930MBE-K04US)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET), ++ SND_PCI_QUIRK(0x144d, 0xc189, "Samsung Galaxy Flex Book (NT950QCG-X716)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET), ++ SND_PCI_QUIRK(0x144d, 0xc18a, "Samsung Galaxy Book Ion (NT950XCJ-X716A)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET), + SND_PCI_QUIRK(0x144d, 0xc740, "Samsung Ativ book 8 (NP870Z5G)", ALC269_FIXUP_ATIV_BOOK_8), + SND_PCI_QUIRK(0x144d, 0xc812, "Samsung Notebook Pen S (NT950SBE-X58)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET), + SND_PCI_QUIRK(0x1458, 0xfa53, "Gigabyte BXBT-2807", ALC283_FIXUP_HEADSET_MIC), +diff --git a/sound/soc/codecs/msm8916-wcd-analog.c b/sound/soc/codecs/msm8916-wcd-analog.c +index 84289ebeae872..337bddb7c2a49 100644 +--- a/sound/soc/codecs/msm8916-wcd-analog.c ++++ b/sound/soc/codecs/msm8916-wcd-analog.c +@@ -19,8 +19,8 @@ + + #define CDC_D_REVISION1 (0xf000) + #define CDC_D_PERPH_SUBTYPE (0xf005) +-#define CDC_D_INT_EN_SET (0x015) +-#define CDC_D_INT_EN_CLR (0x016) ++#define CDC_D_INT_EN_SET (0xf015) ++#define CDC_D_INT_EN_CLR (0xf016) + #define MBHC_SWITCH_INT BIT(7) + #define MBHC_MIC_ELECTRICAL_INS_REM_DET BIT(6) + #define MBHC_BUTTON_PRESS_DET BIT(5) +diff --git a/sound/soc/intel/atom/sst-mfld-platform-pcm.c b/sound/soc/intel/atom/sst-mfld-platform-pcm.c +index 8cc3cc363eb03..31f1dd6541aa1 100644 +--- a/sound/soc/intel/atom/sst-mfld-platform-pcm.c ++++ b/sound/soc/intel/atom/sst-mfld-platform-pcm.c +@@ -331,7 +331,7 @@ static int sst_media_open(struct snd_pcm_substream *substream, + + ret_val = power_up_sst(stream); + if (ret_val < 0) +- return ret_val; ++ goto out_power_up; + + /* Make sure, that the period size is always even */ + snd_pcm_hw_constraint_step(substream->runtime, 0, +@@ -340,8 +340,9 @@ static int sst_media_open(struct snd_pcm_substream *substream, + return snd_pcm_hw_constraint_integer(runtime, + SNDRV_PCM_HW_PARAM_PERIODS); + out_ops: +- kfree(stream); + mutex_unlock(&sst_lock); ++out_power_up: ++ kfree(stream); + return ret_val; + } + +diff --git a/sound/soc/qcom/qdsp6/q6afe-dai.c b/sound/soc/qcom/qdsp6/q6afe-dai.c +index 2a5302f1db98a..0168af8492727 100644 +--- a/sound/soc/qcom/qdsp6/q6afe-dai.c ++++ b/sound/soc/qcom/qdsp6/q6afe-dai.c +@@ -1150,206 +1150,206 @@ static int q6afe_of_xlate_dai_name(struct snd_soc_component *component, + } + + static const struct snd_soc_dapm_widget q6afe_dai_widgets[] = { +- SND_SOC_DAPM_AIF_IN("HDMI_RX", NULL, 0, 0, 0, 0), +- SND_SOC_DAPM_AIF_IN("SLIMBUS_0_RX", NULL, 0, 0, 0, 0), +- SND_SOC_DAPM_AIF_IN("SLIMBUS_1_RX", NULL, 0, 0, 0, 0), +- SND_SOC_DAPM_AIF_IN("SLIMBUS_2_RX", NULL, 0, 0, 0, 0), +- SND_SOC_DAPM_AIF_IN("SLIMBUS_3_RX", NULL, 0, 0, 0, 0), +- SND_SOC_DAPM_AIF_IN("SLIMBUS_4_RX", NULL, 0, 0, 0, 0), +- SND_SOC_DAPM_AIF_IN("SLIMBUS_5_RX", NULL, 0, 0, 0, 0), +- SND_SOC_DAPM_AIF_IN("SLIMBUS_6_RX", NULL, 0, 0, 0, 0), +- SND_SOC_DAPM_AIF_OUT("SLIMBUS_0_TX", NULL, 0, 0, 0, 0), +- SND_SOC_DAPM_AIF_OUT("SLIMBUS_1_TX", NULL, 0, 0, 0, 0), +- SND_SOC_DAPM_AIF_OUT("SLIMBUS_2_TX", NULL, 0, 0, 0, 0), +- SND_SOC_DAPM_AIF_OUT("SLIMBUS_3_TX", NULL, 0, 0, 0, 0), +- SND_SOC_DAPM_AIF_OUT("SLIMBUS_4_TX", NULL, 0, 0, 0, 0), +- SND_SOC_DAPM_AIF_OUT("SLIMBUS_5_TX", NULL, 0, 0, 0, 0), +- SND_SOC_DAPM_AIF_OUT("SLIMBUS_6_TX", NULL, 0, 0, 0, 0), ++ SND_SOC_DAPM_AIF_IN("HDMI_RX", NULL, 0, SND_SOC_NOPM, 0, 0), ++ SND_SOC_DAPM_AIF_IN("SLIMBUS_0_RX", NULL, 0, SND_SOC_NOPM, 0, 0), ++ SND_SOC_DAPM_AIF_IN("SLIMBUS_1_RX", NULL, 0, SND_SOC_NOPM, 0, 0), ++ SND_SOC_DAPM_AIF_IN("SLIMBUS_2_RX", NULL, 0, SND_SOC_NOPM, 0, 0), ++ SND_SOC_DAPM_AIF_IN("SLIMBUS_3_RX", NULL, 0, SND_SOC_NOPM, 0, 0), ++ SND_SOC_DAPM_AIF_IN("SLIMBUS_4_RX", NULL, 0, SND_SOC_NOPM, 0, 0), ++ SND_SOC_DAPM_AIF_IN("SLIMBUS_5_RX", NULL, 0, SND_SOC_NOPM, 0, 0), ++ SND_SOC_DAPM_AIF_IN("SLIMBUS_6_RX", NULL, 0, SND_SOC_NOPM, 0, 0), ++ SND_SOC_DAPM_AIF_OUT("SLIMBUS_0_TX", NULL, 0, SND_SOC_NOPM, 0, 0), ++ SND_SOC_DAPM_AIF_OUT("SLIMBUS_1_TX", NULL, 0, SND_SOC_NOPM, 0, 0), ++ SND_SOC_DAPM_AIF_OUT("SLIMBUS_2_TX", NULL, 0, SND_SOC_NOPM, 0, 0), ++ SND_SOC_DAPM_AIF_OUT("SLIMBUS_3_TX", NULL, 0, SND_SOC_NOPM, 0, 0), ++ SND_SOC_DAPM_AIF_OUT("SLIMBUS_4_TX", NULL, 0, SND_SOC_NOPM, 0, 0), ++ SND_SOC_DAPM_AIF_OUT("SLIMBUS_5_TX", NULL, 0, SND_SOC_NOPM, 0, 0), ++ SND_SOC_DAPM_AIF_OUT("SLIMBUS_6_TX", NULL, 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_IN("QUAT_MI2S_RX", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_OUT("QUAT_MI2S_TX", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_IN("TERT_MI2S_RX", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_OUT("TERT_MI2S_TX", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_IN("SEC_MI2S_RX", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_OUT("SEC_MI2S_TX", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_IN("SEC_MI2S_RX_SD1", + "Secondary MI2S Playback SD1", +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_IN("PRI_MI2S_RX", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_OUT("PRI_MI2S_TX", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + + SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_RX_0", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_RX_1", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_RX_2", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_RX_3", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_RX_4", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_RX_5", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_RX_6", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_RX_7", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_TX_0", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_TX_1", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_TX_2", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_TX_3", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_TX_4", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_TX_5", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_TX_6", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_TX_7", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + + SND_SOC_DAPM_AIF_IN("SEC_TDM_RX_0", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_IN("SEC_TDM_RX_1", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_IN("SEC_TDM_RX_2", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_IN("SEC_TDM_RX_3", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_IN("SEC_TDM_RX_4", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_IN("SEC_TDM_RX_5", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_IN("SEC_TDM_RX_6", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_IN("SEC_TDM_RX_7", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_OUT("SEC_TDM_TX_0", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_OUT("SEC_TDM_TX_1", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_OUT("SEC_TDM_TX_2", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_OUT("SEC_TDM_TX_3", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_OUT("SEC_TDM_TX_4", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_OUT("SEC_TDM_TX_5", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_OUT("SEC_TDM_TX_6", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_OUT("SEC_TDM_TX_7", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + + SND_SOC_DAPM_AIF_IN("TERT_TDM_RX_0", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_IN("TERT_TDM_RX_1", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_IN("TERT_TDM_RX_2", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_IN("TERT_TDM_RX_3", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_IN("TERT_TDM_RX_4", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_IN("TERT_TDM_RX_5", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_IN("TERT_TDM_RX_6", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_IN("TERT_TDM_RX_7", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_OUT("TERT_TDM_TX_0", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_OUT("TERT_TDM_TX_1", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_OUT("TERT_TDM_TX_2", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_OUT("TERT_TDM_TX_3", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_OUT("TERT_TDM_TX_4", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_OUT("TERT_TDM_TX_5", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_OUT("TERT_TDM_TX_6", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_OUT("TERT_TDM_TX_7", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + + SND_SOC_DAPM_AIF_IN("QUAT_TDM_RX_0", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_IN("QUAT_TDM_RX_1", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_IN("QUAT_TDM_RX_2", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_IN("QUAT_TDM_RX_3", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_IN("QUAT_TDM_RX_4", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_IN("QUAT_TDM_RX_5", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_IN("QUAT_TDM_RX_6", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_IN("QUAT_TDM_RX_7", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_OUT("QUAT_TDM_TX_0", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_OUT("QUAT_TDM_TX_1", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_OUT("QUAT_TDM_TX_2", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_OUT("QUAT_TDM_TX_3", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_OUT("QUAT_TDM_TX_4", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_OUT("QUAT_TDM_TX_5", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_OUT("QUAT_TDM_TX_6", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_OUT("QUAT_TDM_TX_7", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + + SND_SOC_DAPM_AIF_IN("QUIN_TDM_RX_0", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_IN("QUIN_TDM_RX_1", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_IN("QUIN_TDM_RX_2", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_IN("QUIN_TDM_RX_3", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_IN("QUIN_TDM_RX_4", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_IN("QUIN_TDM_RX_5", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_IN("QUIN_TDM_RX_6", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_IN("QUIN_TDM_RX_7", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_OUT("QUIN_TDM_TX_0", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_OUT("QUIN_TDM_TX_1", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_OUT("QUIN_TDM_TX_2", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_OUT("QUIN_TDM_TX_3", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_OUT("QUIN_TDM_TX_4", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_OUT("QUIN_TDM_TX_5", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_OUT("QUIN_TDM_TX_6", NULL, +- 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_AIF_OUT("QUIN_TDM_TX_7", NULL, +- 0, 0, 0, 0), +- SND_SOC_DAPM_AIF_OUT("DISPLAY_PORT_RX", "NULL", 0, 0, 0, 0), ++ 0, SND_SOC_NOPM, 0, 0), ++ SND_SOC_DAPM_AIF_OUT("DISPLAY_PORT_RX", "NULL", 0, SND_SOC_NOPM, 0, 0), + }; + + static const struct snd_soc_component_driver q6afe_dai_component = { +diff --git a/sound/soc/qcom/qdsp6/q6routing.c b/sound/soc/qcom/qdsp6/q6routing.c +index ddcd9978cf57b..745cc9dd14f38 100644 +--- a/sound/soc/qcom/qdsp6/q6routing.c ++++ b/sound/soc/qcom/qdsp6/q6routing.c +@@ -996,6 +996,20 @@ static int msm_routing_probe(struct snd_soc_component *c) + return 0; + } + ++static unsigned int q6routing_reg_read(struct snd_soc_component *component, ++ unsigned int reg) ++{ ++ /* default value */ ++ return 0; ++} ++ ++static int q6routing_reg_write(struct snd_soc_component *component, ++ unsigned int reg, unsigned int val) ++{ ++ /* dummy */ ++ return 0; ++} ++ + static const struct snd_soc_component_driver msm_soc_routing_component = { + .ops = &q6pcm_routing_ops, + .probe = msm_routing_probe, +@@ -1004,6 +1018,8 @@ static const struct snd_soc_component_driver msm_soc_routing_component = { + .num_dapm_widgets = ARRAY_SIZE(msm_qdsp6_widgets), + .dapm_routes = intercon, + .num_dapm_routes = ARRAY_SIZE(intercon), ++ .read = q6routing_reg_read, ++ .write = q6routing_reg_write, + }; + + static int q6pcm_routing_probe(struct platform_device *pdev) +diff --git a/tools/objtool/Makefile b/tools/objtool/Makefile +index ee08aeff30a19..f591c4d1b6fe2 100644 +--- a/tools/objtool/Makefile ++++ b/tools/objtool/Makefile +@@ -3,9 +3,15 @@ include ../scripts/Makefile.include + include ../scripts/Makefile.arch + + # always use the host compiler ++ifneq ($(LLVM),) ++HOSTAR ?= llvm-ar ++HOSTCC ?= clang ++HOSTLD ?= ld.lld ++else + HOSTAR ?= ar + HOSTCC ?= gcc + HOSTLD ?= ld ++endif + AR = $(HOSTAR) + CC = $(HOSTCC) + LD = $(HOSTLD) +diff --git a/tools/perf/util/probe-finder.c b/tools/perf/util/probe-finder.c +index dc9d495e3d6ab..849d8d2e5976b 100644 +--- a/tools/perf/util/probe-finder.c ++++ b/tools/perf/util/probe-finder.c +@@ -1362,7 +1362,7 @@ int debuginfo__find_trace_events(struct debuginfo *dbg, + tf.ntevs = 0; + + ret = debuginfo__find_probes(dbg, &tf.pf); +- if (ret < 0) { ++ if (ret < 0 || tf.ntevs == 0) { + for (i = 0; i < tf.ntevs; i++) + clear_probe_trace_event(&tf.tevs[i]); + zfree(tevs); +diff --git a/tools/testing/selftests/cgroup/cgroup_util.c b/tools/testing/selftests/cgroup/cgroup_util.c +index bdb69599c4bdc..5e939ff1e3f95 100644 +--- a/tools/testing/selftests/cgroup/cgroup_util.c ++++ b/tools/testing/selftests/cgroup/cgroup_util.c +@@ -105,7 +105,7 @@ int cg_read_strcmp(const char *cgroup, const char *control, + + /* Handle the case of comparing against empty string */ + if (!expected) +- size = 32; ++ return -1; + else + size = strlen(expected) + 1; + +diff --git a/virt/kvm/arm/mmu.c b/virt/kvm/arm/mmu.c +index 767ac4eab4fe9..7501ec8a46004 100644 +--- a/virt/kvm/arm/mmu.c ++++ b/virt/kvm/arm/mmu.c +@@ -332,7 +332,8 @@ static void unmap_stage2_puds(struct kvm *kvm, pgd_t *pgd, + * destroying the VM), otherwise another faulting VCPU may come in and mess + * with things behind our backs. + */ +-static void unmap_stage2_range(struct kvm *kvm, phys_addr_t start, u64 size) ++static void __unmap_stage2_range(struct kvm *kvm, phys_addr_t start, u64 size, ++ bool may_block) + { + pgd_t *pgd; + phys_addr_t addr = start, end = start + size; +@@ -357,11 +358,16 @@ static void unmap_stage2_range(struct kvm *kvm, phys_addr_t start, u64 size) + * If the range is too large, release the kvm->mmu_lock + * to prevent starvation and lockup detector warnings. + */ +- if (next != end) ++ if (may_block && next != end) + cond_resched_lock(&kvm->mmu_lock); + } while (pgd++, addr = next, addr != end); + } + ++static void unmap_stage2_range(struct kvm *kvm, phys_addr_t start, u64 size) ++{ ++ __unmap_stage2_range(kvm, start, size, true); ++} ++ + static void stage2_flush_ptes(struct kvm *kvm, pmd_t *pmd, + phys_addr_t addr, phys_addr_t end) + { +@@ -2045,18 +2051,21 @@ static int handle_hva_to_gpa(struct kvm *kvm, + + static int kvm_unmap_hva_handler(struct kvm *kvm, gpa_t gpa, u64 size, void *data) + { +- unmap_stage2_range(kvm, gpa, size); ++ unsigned flags = *(unsigned *)data; ++ bool may_block = flags & MMU_NOTIFIER_RANGE_BLOCKABLE; ++ ++ __unmap_stage2_range(kvm, gpa, size, may_block); + return 0; + } + + int kvm_unmap_hva_range(struct kvm *kvm, +- unsigned long start, unsigned long end) ++ unsigned long start, unsigned long end, unsigned flags) + { + if (!kvm->arch.pgd) + return 0; + + trace_kvm_unmap_hva_range(start, end); +- handle_hva_to_gpa(kvm, start, end, &kvm_unmap_hva_handler, NULL); ++ handle_hva_to_gpa(kvm, start, end, &kvm_unmap_hva_handler, &flags); + return 0; + } + +diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c +index d5d4cd581af32..278bdc53047e8 100644 +--- a/virt/kvm/kvm_main.c ++++ b/virt/kvm/kvm_main.c +@@ -425,7 +425,8 @@ static int kvm_mmu_notifier_invalidate_range_start(struct mmu_notifier *mn, + * count is also read inside the mmu_lock critical section. + */ + kvm->mmu_notifier_count++; +- need_tlb_flush = kvm_unmap_hva_range(kvm, range->start, range->end); ++ need_tlb_flush = kvm_unmap_hva_range(kvm, range->start, range->end, ++ range->flags); + need_tlb_flush |= kvm->tlbs_dirty; + /* we've to flush the tlb before the pages can be freed */ + if (need_tlb_flush) diff --git a/patch/kernel/odroidxu4-dev/0011-MEMEKA-phy-exynos5-usbdrd-Calibrating-makes-sense-on.patch b/patch/kernel/odroidxu4-dev/0011-MEMEKA-phy-exynos5-usbdrd-Calibrating-makes-sense-on.patch deleted file mode 100644 index 274b13323..000000000 --- a/patch/kernel/odroidxu4-dev/0011-MEMEKA-phy-exynos5-usbdrd-Calibrating-makes-sense-on.patch +++ /dev/null @@ -1,34 +0,0 @@ -From cac7b544a26273bfd87553f1590da95b6e2faf78 Mon Sep 17 00:00:00 2001 -From: Marek Szyprowski -Date: Fri, 19 Jul 2019 11:27:34 +0200 -Subject: [PATCH 11/24] MEMEKA: phy: exynos5-usbdrd: Calibrating makes sense - only for USB2.0 PHY - -PHY calibration is needed only for USB2.0 (UTMI) PHY, so skip calling -calibration code when phy_calibrate() is called for USB3.0 (PIPE3) PHY. - -Fixes: d8c80bb3b55b ("phy: exynos5-usbdrd: Calibrate LOS levels for exynos5420/5800") -Signed-off-by: Marek Szyprowski -Signed-off-by: memeka ---- - drivers/phy/samsung/phy-exynos5-usbdrd.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - -diff --git a/drivers/phy/samsung/phy-exynos5-usbdrd.c b/drivers/phy/samsung/phy-exynos5-usbdrd.c -index e510732afb8b..7f6279fb4f8f 100644 ---- a/drivers/phy/samsung/phy-exynos5-usbdrd.c -+++ b/drivers/phy/samsung/phy-exynos5-usbdrd.c -@@ -714,7 +714,9 @@ static int exynos5_usbdrd_phy_calibrate(struct phy *phy) - struct phy_usb_instance *inst = phy_get_drvdata(phy); - struct exynos5_usbdrd_phy *phy_drd = to_usbdrd_phy(inst); - -- return exynos5420_usbdrd_phy_calibrate(phy_drd); -+ if (inst->phy_cfg->id == EXYNOS5_DRDPHY_UTMI) -+ return exynos5420_usbdrd_phy_calibrate(phy_drd); -+ return 0; - } - - static const struct phy_ops exynos5_usbdrd_phy_ops = { --- -2.20.1 - diff --git a/patch/kernel/odroidxu4-dev/0013-MEMEKA-thermal-exynos-add-support-for-8-trip-points-.patch b/patch/kernel/odroidxu4-dev/0013-MEMEKA-thermal-exynos-add-support-for-8-trip-points-.patch.disabled similarity index 100% rename from patch/kernel/odroidxu4-dev/0013-MEMEKA-thermal-exynos-add-support-for-8-trip-points-.patch rename to patch/kernel/odroidxu4-dev/0013-MEMEKA-thermal-exynos-add-support-for-8-trip-points-.patch.disabled diff --git a/patch/kernel/odroidxu4-dev/0014-MEMEKA-arm-dts-exynos5422-enable-Exynos5422-TMU.patch b/patch/kernel/odroidxu4-dev/0014-MEMEKA-arm-dts-exynos5422-enable-Exynos5422-TMU.patch.disabled similarity index 100% rename from patch/kernel/odroidxu4-dev/0014-MEMEKA-arm-dts-exynos5422-enable-Exynos5422-TMU.patch rename to patch/kernel/odroidxu4-dev/0014-MEMEKA-arm-dts-exynos5422-enable-Exynos5422-TMU.patch.disabled diff --git a/patch/kernel/odroidxu4-dev/0015-MEMEKA-thermal-add-irq-mode-configuration-for-trip-p.patch b/patch/kernel/odroidxu4-dev/0015-MEMEKA-thermal-add-irq-mode-configuration-for-trip-p.patch.disabled similarity index 100% rename from patch/kernel/odroidxu4-dev/0015-MEMEKA-thermal-add-irq-mode-configuration-for-trip-p.patch rename to patch/kernel/odroidxu4-dev/0015-MEMEKA-thermal-add-irq-mode-configuration-for-trip-p.patch.disabled diff --git a/patch/kernel/odroidxu4-dev/0016-MEMEKA-thermal-add-new-sysfs-file-for-irq-mode.patch b/patch/kernel/odroidxu4-dev/0016-MEMEKA-thermal-add-new-sysfs-file-for-irq-mode.patch.disabled similarity index 100% rename from patch/kernel/odroidxu4-dev/0016-MEMEKA-thermal-add-new-sysfs-file-for-irq-mode.patch rename to patch/kernel/odroidxu4-dev/0016-MEMEKA-thermal-add-new-sysfs-file-for-irq-mode.patch.disabled diff --git a/patch/kernel/odroidxu4-dev/wifi-4003-fix-sha256_state-clashes.patch b/patch/kernel/odroidxu4-dev/wifi-4003-fix-sha256_state-clashes.patch new file mode 100644 index 000000000..5d60cf198 --- /dev/null +++ b/patch/kernel/odroidxu4-dev/wifi-4003-fix-sha256_state-clashes.patch @@ -0,0 +1,372 @@ +diff --git a/drivers/net/wireless/rtl8189es/include/rtw_security.h b/drivers/net/wireless/rtl8189es/include/rtw_security.h +index 5820a55..3e8e428 100644 +--- a/drivers/net/wireless/rtl8189es/include/rtw_security.h ++++ b/drivers/net/wireless/rtl8189es/include/rtw_security.h +@@ -238,7 +238,7 @@ struct security_priv + #endif /* DBG_SW_SEC_CNT */ + }; + +-struct sha256_state { ++struct rtl_sha256_state { + u64 length; + u32 state[8], curlen; + u8 buf[64]; +diff --git a/drivers/net/wireless/rtl8189es/core/rtw_security.c b/drivers/net/wireless/rtl8189es/core/rtw_security.c +index 8dac771..9b3a1f9 100644 +--- a/drivers/net/wireless/rtl8189es/core/rtw_security.c ++++ b/drivers/net/wireless/rtl8189es/core/rtw_security.c +@@ -2281,7 +2281,7 @@ BIP_exit: + + #ifndef PLATFORM_FREEBSD + /* compress 512-bits */ +-static int sha256_compress(struct sha256_state *md, unsigned char *buf) ++static int sha256_compress(struct rtl_sha256_state *md, unsigned char *buf) + { + u32 S[8], W[64], t0, t1; + u32 t; +@@ -2323,7 +2323,7 @@ static int sha256_compress(struct sha256_state *md, unsigned char *buf) + } + + /* Initialize the hash state */ +-static void sha256_init(struct sha256_state *md) ++static void sha256_init(struct rtl_sha256_state *md) + { + md->curlen = 0; + md->length = 0; +@@ -2344,7 +2344,7 @@ static void sha256_init(struct sha256_state *md) + @param inlen The length of the data (octets) + @return CRYPT_OK if successful + */ +-static int sha256_process(struct sha256_state *md, unsigned char *in, ++static int sha256_process(struct rtl_sha256_state *md, unsigned char *in, + unsigned long inlen) + { + unsigned long n; +@@ -2385,7 +2385,7 @@ static int sha256_process(struct sha256_state *md, unsigned char *in, + @param out [out] The destination of the hash (32 bytes) + @return CRYPT_OK if successful + */ +-static int sha256_done(struct sha256_state *md, unsigned char *out) ++static int sha256_done(struct rtl_sha256_state *md, unsigned char *out) + { + int i; + +@@ -2437,7 +2437,7 @@ static int sha256_done(struct sha256_state *md, unsigned char *out) + static int sha256_vector(size_t num_elem, u8 *addr[], size_t *len, + u8 *mac) + { +- struct sha256_state ctx; ++ struct rtl_sha256_state ctx; + size_t i; + + sha256_init(&ctx); +diff --git a/drivers/net/wireless/rtl8189fs/include/rtw_security.h b/drivers/net/wireless/rtl8189fs/include/rtw_security.h +index 5820a55..3e8e428 100644 +--- a/drivers/net/wireless/rtl8189fs/include/rtw_security.h ++++ b/drivers/net/wireless/rtl8189fs/include/rtw_security.h +@@ -238,7 +238,7 @@ struct security_priv + #endif /* DBG_SW_SEC_CNT */ + }; + +-struct sha256_state { ++struct rtl_sha256_state { + u64 length; + u32 state[8], curlen; + u8 buf[64]; +diff --git a/drivers/net/wireless/rtl8189fs/core/rtw_security.c b/drivers/net/wireless/rtl8189fs/core/rtw_security.c +index 8dac771..9b3a1f9 100644 +--- a/drivers/net/wireless/rtl8189fs/core/rtw_security.c ++++ b/drivers/net/wireless/rtl8189fs/core/rtw_security.c +@@ -2281,7 +2281,7 @@ BIP_exit: + + #ifndef PLATFORM_FREEBSD + /* compress 512-bits */ +-static int sha256_compress(struct sha256_state *md, unsigned char *buf) ++static int sha256_compress(struct rtl_sha256_state *md, unsigned char *buf) + { + u32 S[8], W[64], t0, t1; + u32 t; +@@ -2323,7 +2323,7 @@ static int sha256_compress(struct sha256_state *md, unsigned char *buf) + } + + /* Initialize the hash state */ +-static void sha256_init(struct sha256_state *md) ++static void sha256_init(struct rtl_sha256_state *md) + { + md->curlen = 0; + md->length = 0; +@@ -2344,7 +2344,7 @@ static void sha256_init(struct sha256_state *md) + @param inlen The length of the data (octets) + @return CRYPT_OK if successful + */ +-static int sha256_process(struct sha256_state *md, unsigned char *in, ++static int sha256_process(struct rtl_sha256_state *md, unsigned char *in, + unsigned long inlen) + { + unsigned long n; +@@ -2385,7 +2385,7 @@ static int sha256_process(struct sha256_state *md, unsigned char *in, + @param out [out] The destination of the hash (32 bytes) + @return CRYPT_OK if successful + */ +-static int sha256_done(struct sha256_state *md, unsigned char *out) ++static int sha256_done(struct rtl_sha256_state *md, unsigned char *out) + { + int i; + +@@ -2437,7 +2437,7 @@ static int sha256_done(struct sha256_state *md, unsigned char *out) + static int sha256_vector(size_t num_elem, u8 *addr[], size_t *len, + u8 *mac) + { +- struct sha256_state ctx; ++ struct rtl_sha256_state ctx; + size_t i; + + sha256_init(&ctx); +diff --git a/drivers/net/wireless/rtl8811cu/include/rtw_security.h b/drivers/net/wireless/rtl8811cu/include/rtw_security.h +index ac8432e..5f74fb7 100755 +--- a/drivers/net/wireless/rtl8811cu/include/rtw_security.h ++++ b/drivers/net/wireless/rtl8811cu/include/rtw_security.h +@@ -249,7 +249,7 @@ struct security_priv { + #define SEC_IS_BIP_KEY_INSTALLED(sec) _FALSE + #endif + +-struct sha256_state { ++struct rtl_sha256_state { + u64 length; + u32 state[8], curlen; + u8 buf[64]; +diff --git a/drivers/net/wireless/rtl8811cu/core/rtw_security.c b/drivers/net/wireless/rtl8811cu/core/rtw_security.c +index b537a26..f8c42f4 100755 +--- a/drivers/net/wireless/rtl8811cu/core/rtw_security.c ++++ b/drivers/net/wireless/rtl8811cu/core/rtw_security.c +@@ -2133,7 +2133,7 @@ BIP_exit: + #ifndef PLATFORM_FREEBSD + #if defined(CONFIG_TDLS) + /* compress 512-bits */ +-static int sha256_compress(struct sha256_state *md, unsigned char *buf) ++static int sha256_compress(struct rtl_sha256_state *md, unsigned char *buf) + { + u32 S[8], W[64], t0, t1; + u32 t; +@@ -2181,7 +2181,7 @@ static int sha256_compress(struct sha256_state *md, unsigned char *buf) + } + + /* Initialize the hash state */ +-static void sha256_init(struct sha256_state *md) ++static void sha256_init(struct rtl_sha256_state *md) + { + md->curlen = 0; + md->length = 0; +@@ -2202,7 +2202,7 @@ static void sha256_init(struct sha256_state *md) + @param inlen The length of the data (octets) + @return CRYPT_OK if successful + */ +-static int sha256_process(struct sha256_state *md, unsigned char *in, ++static int sha256_process(struct rtl_sha256_state *md, unsigned char *in, + unsigned long inlen) + { + unsigned long n; +@@ -2243,7 +2243,7 @@ static int sha256_process(struct sha256_state *md, unsigned char *in, + @param out [out] The destination of the hash (32 bytes) + @return CRYPT_OK if successful + */ +-static int sha256_done(struct sha256_state *md, unsigned char *out) ++static int sha256_done(struct rtl_sha256_state *md, unsigned char *out) + { + int i; + +@@ -2293,7 +2293,7 @@ static int sha256_done(struct sha256_state *md, unsigned char *out) + static int sha256_vector(size_t num_elem, u8 *addr[], size_t *len, + u8 *mac) + { +- struct sha256_state ctx; ++ struct rtl_sha256_state ctx; + size_t i; + + sha256_init(&ctx); +diff --git a/drivers/net/wireless/rtl8188eu/include/rtw_security.h b/drivers/net/wireless/rtl8188eu/include/rtw_security.h +index 0adc700..2a9cf9d 100644 +--- a/drivers/net/wireless/rtl8188eu/include/rtw_security.h ++++ b/drivers/net/wireless/rtl8188eu/include/rtw_security.h +@@ -249,7 +249,7 @@ struct security_priv { + #define SEC_IS_BIP_KEY_INSTALLED(sec) _FALSE + #endif + +-struct sha256_state { ++struct rtl_sha256_state { + u64 length; + u32 state[8], curlen; + u8 buf[64]; +diff --git a/drivers/net/wireless/rtl8188eu/core/rtw_security.c b/drivers/net/wireless/rtl8188eu/core/rtw_security.c +index 5807521..0b3eed2 100644 +--- a/drivers/net/wireless/rtl8188eu/core/rtw_security.c ++++ b/drivers/net/wireless/rtl8188eu/core/rtw_security.c +@@ -2133,7 +2133,7 @@ BIP_exit: + #ifndef PLATFORM_FREEBSD + #if defined(CONFIG_TDLS) + /* compress 512-bits */ +-static int sha256_compress(struct sha256_state *md, unsigned char *buf) ++static int sha256_compress(struct rtl_sha256_state *md, unsigned char *buf) + { + u32 S[8], W[64], t0, t1; + u32 t; +@@ -2181,7 +2181,7 @@ static int sha256_compress(struct sha256_state *md, unsigned char *buf) + } + + /* Initialize the hash state */ +-static void sha256_init(struct sha256_state *md) ++static void sha256_init(struct rtl_sha256_state *md) + { + md->curlen = 0; + md->length = 0; +@@ -2202,7 +2202,7 @@ static void sha256_init(struct sha256_state *md) + @param inlen The length of the data (octets) + @return CRYPT_OK if successful + */ +-static int sha256_process(struct sha256_state *md, unsigned char *in, ++static int sha256_process(struct rtl_sha256_state *md, unsigned char *in, + unsigned long inlen) + { + unsigned long n; +@@ -2243,7 +2243,7 @@ static int sha256_process(struct sha256_state *md, unsigned char *in, + @param out [out] The destination of the hash (32 bytes) + @return CRYPT_OK if successful + */ +-static int sha256_done(struct sha256_state *md, unsigned char *out) ++static int sha256_done(struct rtl_sha256_state *md, unsigned char *out) + { + int i; + +@@ -2293,7 +2293,7 @@ static int sha256_done(struct sha256_state *md, unsigned char *out) + static int sha256_vector(size_t num_elem, u8 *addr[], size_t *len, + u8 *mac) + { +- struct sha256_state ctx; ++ struct rtl_sha256_state ctx; + size_t i; + + sha256_init(&ctx); +diff --git a/drivers/net/wireless/rtl88x2bu/include/rtw_security.h b/drivers/net/wireless/rtl88x2bu/include/rtw_security.h +index ac8432e..5f74fb7 100644 +--- a/drivers/net/wireless/rtl88x2bu/include/rtw_security.h ++++ b/drivers/net/wireless/rtl88x2bu/include/rtw_security.h +@@ -249,7 +249,7 @@ struct security_priv { + #define SEC_IS_BIP_KEY_INSTALLED(sec) _FALSE + #endif + +-struct sha256_state { ++struct rtl_sha256_state { + u64 length; + u32 state[8], curlen; + u8 buf[64]; +diff --git a/drivers/net/wireless/rtl88x2bu/core/rtw_security.c b/drivers/net/wireless/rtl88x2bu/core/rtw_security.c +index b537a26..f8c42f4 100644 +--- a/drivers/net/wireless/rtl88x2bu/core/rtw_security.c ++++ b/drivers/net/wireless/rtl88x2bu/core/rtw_security.c +@@ -2133,7 +2133,7 @@ BIP_exit: + #ifndef PLATFORM_FREEBSD + #if defined(CONFIG_TDLS) + /* compress 512-bits */ +-static int sha256_compress(struct sha256_state *md, unsigned char *buf) ++static int sha256_compress(struct rtl_sha256_state *md, unsigned char *buf) + { + u32 S[8], W[64], t0, t1; + u32 t; +@@ -2181,7 +2181,7 @@ static int sha256_compress(struct sha256_state *md, unsigned char *buf) + } + + /* Initialize the hash state */ +-static void sha256_init(struct sha256_state *md) ++static void sha256_init(struct rtl_sha256_state *md) + { + md->curlen = 0; + md->length = 0; +@@ -2202,7 +2202,7 @@ static void sha256_init(struct sha256_state *md) + @param inlen The length of the data (octets) + @return CRYPT_OK if successful + */ +-static int sha256_process(struct sha256_state *md, unsigned char *in, ++static int sha256_process(struct rtl_sha256_state *md, unsigned char *in, + unsigned long inlen) + { + unsigned long n; +@@ -2243,7 +2243,7 @@ static int sha256_process(struct sha256_state *md, unsigned char *in, + @param out [out] The destination of the hash (32 bytes) + @return CRYPT_OK if successful + */ +-static int sha256_done(struct sha256_state *md, unsigned char *out) ++static int sha256_done(struct rtl_sha256_state *md, unsigned char *out) + { + int i; + +@@ -2293,7 +2293,7 @@ static int sha256_done(struct sha256_state *md, unsigned char *out) + static int sha256_vector(size_t num_elem, u8 *addr[], size_t *len, + u8 *mac) + { +- struct sha256_state ctx; ++ struct rtl_sha256_state ctx; + size_t i; + + sha256_init(&ctx); +diff --git a/drivers/net/wireless/rtl8723ds/include/rtw_security.h b/drivers/net/wireless/rtl8723ds/include/rtw_security.h +index 83c06a5..bcea21a 100644 +--- a/drivers/net/wireless/rtl8723ds/include/rtw_security.h ++++ b/drivers/net/wireless/rtl8723ds/include/rtw_security.h +@@ -242,7 +242,7 @@ struct security_priv { + #endif /* DBG_SW_SEC_CNT */ + }; + +-struct sha256_state { ++struct rtl_sha256_state { + u64 length; + u32 state[8], curlen; + u8 buf[64]; +diff --git a/drivers/net/wireless/rtl8723ds/core/rtw_security.c b/drivers/net/wireless/rtl8723ds/core/rtw_security.c +index 88033df..11aa9a4 100644 +--- a/drivers/net/wireless/rtl8723ds/core/rtw_security.c ++++ b/drivers/net/wireless/rtl8723ds/core/rtw_security.c +@@ -2132,7 +2132,7 @@ BIP_exit: + #endif /* CONFIG_IEEE80211W */ + + /* compress 512-bits */ +-static int sha256_compress(struct sha256_state *md, unsigned char *buf) ++static int sha256_compress(struct rtl_sha256_state *md, unsigned char *buf) + { + u32 S[8], W[64], t0, t1; + u32 t; +@@ -2180,7 +2180,7 @@ static int sha256_compress(struct sha256_state *md, unsigned char *buf) + } + + /* Initialize the hash state */ +-static void sha256_init(struct sha256_state *md) ++static void sha256_init(struct rtl_sha256_state *md) + { + md->curlen = 0; + md->length = 0; +@@ -2201,7 +2201,7 @@ static void sha256_init(struct sha256_state *md) + @param inlen The length of the data (octets) + @return CRYPT_OK if successful + */ +-static int sha256_process(struct sha256_state *md, unsigned char *in, ++static int sha256_process(struct rtl_sha256_state *md, unsigned char *in, + unsigned long inlen) + { + unsigned long n; +@@ -2242,7 +2242,7 @@ static int sha256_process(struct sha256_state *md, unsigned char *in, + @param out [out] The destination of the hash (32 bytes) + @return CRYPT_OK if successful + */ +-static int sha256_done(struct sha256_state *md, unsigned char *out) ++static int sha256_done(struct rtl_sha256_state *md, unsigned char *out) + { + int i; + +@@ -2292,7 +2292,7 @@ static int sha256_done(struct sha256_state *md, unsigned char *out) + static int sha256_vector(size_t num_elem, u8 *addr[], size_t *len, + u8 *mac) + { +- struct sha256_state ctx; ++ struct rtl_sha256_state ctx; + size_t i; + + sha256_init(&ctx); diff --git a/patch/kernel/odroidxu4-dev/wifi-4004-fix-cfg80211-for-5.8.patch b/patch/kernel/odroidxu4-dev/wifi-4004-fix-cfg80211-for-5.8.patch new file mode 100644 index 000000000..89192644a --- /dev/null +++ b/patch/kernel/odroidxu4-dev/wifi-4004-fix-cfg80211-for-5.8.patch @@ -0,0 +1,354 @@ +diff --git a/drivers/net/wireless/rtl8189es/os_dep/linux/ioctl_cfg80211.c b/drivers/net/wireless/rtl8189es/os_dep/linux/ioctl_cfg80211.c +index d77cc17..32cc240 100644 +--- a/drivers/net/wireless/rtl8189es/os_dep/linux/ioctl_cfg80211.c ++++ b/drivers/net/wireless/rtl8189es/os_dep/linux/ioctl_cfg80211.c +@@ -5567,6 +5567,33 @@ exit: + return ret; + } + ++#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 8, 0)) ++ ++static void ++cfg80211_rtw_update_mgmt_frame_registrations(struct wiphy *wiphy, ++ struct wireless_dev *wdev, ++ struct mgmt_frame_regs *upd) ++{ ++ struct net_device *ndev = wdev_to_ndev(wdev); ++ struct rtw_wdev_priv *pwdev_priv; ++ _adapter *adapter; ++ ++ if (ndev == NULL) ++ return; ++ ++ adapter = (_adapter *)rtw_netdev_priv(ndev); ++ pwdev_priv = adapter_wdev_data(adapter); ++ ++#ifdef CONFIG_DEBUG_CFG80211 ++ RTW_INFO(FUNC_ADPT_FMT" stypes:%x\n", FUNC_ADPT_ARG(adapter), ++ upd->interface_stypes); ++#endif ++ ++ /* not implemented, see bellow */ ++} ++ ++#else ++ + static void cfg80211_rtw_mgmt_frame_register(struct wiphy *wiphy, + #if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0)) + struct wireless_dev *wdev, +@@ -5611,6 +5638,8 @@ exit: + return; + } + ++#endif ++ + #if defined(CONFIG_TDLS) && (LINUX_VERSION_CODE >= KERNEL_VERSION(3,2,0)) + static int cfg80211_rtw_tdls_mgmt(struct wiphy *wiphy, + struct net_device *ndev, +@@ -6505,7 +6534,11 @@ static struct cfg80211_ops rtw_cfg80211_ops = { + + #if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)) || defined(COMPAT_KERNEL_RELEASE) + .mgmt_tx = cfg80211_rtw_mgmt_tx, ++#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 8, 0)) ++ .update_mgmt_frame_registrations = cfg80211_rtw_update_mgmt_frame_registrations, ++#else + .mgmt_frame_register = cfg80211_rtw_mgmt_frame_register, ++#endif + #elif (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,34) && LINUX_VERSION_CODE<=KERNEL_VERSION(2,6,35)) + .action = cfg80211_rtw_mgmt_tx, + #endif +diff --git a/drivers/net/wireless/rtl8189fs/os_dep/linux/ioctl_cfg80211.c b/drivers/net/wireless/rtl8189fs/os_dep/linux/ioctl_cfg80211.c +index e894e97..e594cdf 100644 +--- a/drivers/net/wireless/rtl8189fs/os_dep/linux/ioctl_cfg80211.c ++++ b/drivers/net/wireless/rtl8189fs/os_dep/linux/ioctl_cfg80211.c +@@ -5711,6 +5711,33 @@ exit: + return ret; + } + ++#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 8, 0)) ++ ++static void ++cfg80211_rtw_update_mgmt_frame_registrations(struct wiphy *wiphy, ++ struct wireless_dev *wdev, ++ struct mgmt_frame_regs *upd) ++{ ++ struct net_device *ndev = wdev_to_ndev(wdev); ++ struct rtw_wdev_priv *pwdev_priv; ++ _adapter *adapter; ++ ++ if (ndev == NULL) ++ return; ++ ++ adapter = (_adapter *)rtw_netdev_priv(ndev); ++ pwdev_priv = adapter_wdev_data(adapter); ++ ++#ifdef CONFIG_DEBUG_CFG80211 ++ RTW_INFO(FUNC_ADPT_FMT" stypes:%x\n", FUNC_ADPT_ARG(adapter), ++ upd->interface_stypes); ++#endif ++ ++ /* not implemented, see bellow */ ++} ++ ++#else ++ + static void cfg80211_rtw_mgmt_frame_register(struct wiphy *wiphy, + #if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0)) + struct wireless_dev *wdev, +@@ -5755,6 +5782,8 @@ exit: + return; + } + ++#endif ++ + #if defined(CONFIG_TDLS) && (LINUX_VERSION_CODE >= KERNEL_VERSION(3,2,0)) + static int cfg80211_rtw_tdls_mgmt(struct wiphy *wiphy, + struct net_device *ndev, +@@ -6760,7 +6789,11 @@ static struct cfg80211_ops rtw_cfg80211_ops = { + + #if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)) || defined(COMPAT_KERNEL_RELEASE) + .mgmt_tx = cfg80211_rtw_mgmt_tx, ++#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 8, 0)) ++ .update_mgmt_frame_registrations = cfg80211_rtw_update_mgmt_frame_registrations, ++#else + .mgmt_frame_register = cfg80211_rtw_mgmt_frame_register, ++#endif + #elif (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,34) && LINUX_VERSION_CODE<=KERNEL_VERSION(2,6,35)) + .action = cfg80211_rtw_mgmt_tx, + #endif +diff --git a/drivers/net/wireless/rtl8811cu/os_dep/linux/ioctl_cfg80211.c b/drivers/net/wireless/rtl8811cu/os_dep/linux/ioctl_cfg80211.c +index c0df148..9bff924 100755 +--- a/drivers/net/wireless/rtl8811cu/os_dep/linux/ioctl_cfg80211.c ++++ b/drivers/net/wireless/rtl8811cu/os_dep/linux/ioctl_cfg80211.c +@@ -7143,6 +7143,33 @@ exit: + return ret; + } + ++#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 8, 0)) ++ ++static void ++cfg80211_rtw_update_mgmt_frame_registrations(struct wiphy *wiphy, ++ struct wireless_dev *wdev, ++ struct mgmt_frame_regs *upd) ++{ ++ struct net_device *ndev = wdev_to_ndev(wdev); ++ struct rtw_wdev_priv *pwdev_priv; ++ _adapter *adapter; ++ ++ if (ndev == NULL) ++ return; ++ ++ adapter = (_adapter *)rtw_netdev_priv(ndev); ++ pwdev_priv = adapter_wdev_data(adapter); ++ ++#ifdef CONFIG_DEBUG_CFG80211 ++ RTW_INFO(FUNC_ADPT_FMT" stypes:%x\n", FUNC_ADPT_ARG(adapter), ++ upd->interface_stypes); ++#endif ++ ++ /* not implemented, see bellow */ ++} ++ ++#else ++ + static void cfg80211_rtw_mgmt_frame_register(struct wiphy *wiphy, + #if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0)) + struct wireless_dev *wdev, +@@ -7187,6 +7214,8 @@ exit: + return; + } + ++#endif ++ + #if defined(CONFIG_TDLS) && (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 2, 0)) + static int cfg80211_rtw_tdls_mgmt(struct wiphy *wiphy, + struct net_device *ndev, +@@ -9457,7 +9486,11 @@ static struct cfg80211_ops rtw_cfg80211_ops = { + + #if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 37)) || defined(COMPAT_KERNEL_RELEASE) + .mgmt_tx = cfg80211_rtw_mgmt_tx, ++#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 8, 0)) ++ .update_mgmt_frame_registrations = cfg80211_rtw_update_mgmt_frame_registrations, ++#else + .mgmt_frame_register = cfg80211_rtw_mgmt_frame_register, ++#endif + #elif (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 34) && LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 35)) + .action = cfg80211_rtw_mgmt_tx, + #endif +diff --git a/drivers/net/wireless/rtl8188eu/os_dep/linux/ioctl_cfg80211.c b/drivers/net/wireless/rtl8188eu/os_dep/linux/ioctl_cfg80211.c +index 721723e..62fd530 100644 +--- a/drivers/net/wireless/rtl8188eu/os_dep/linux/ioctl_cfg80211.c ++++ b/drivers/net/wireless/rtl8188eu/os_dep/linux/ioctl_cfg80211.c +@@ -7470,6 +7470,33 @@ exit: + return ret; + } + ++#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 8, 0)) ++ ++static void ++cfg80211_rtw_update_mgmt_frame_registrations(struct wiphy *wiphy, ++ struct wireless_dev *wdev, ++ struct mgmt_frame_regs *upd) ++{ ++ struct net_device *ndev = wdev_to_ndev(wdev); ++ struct rtw_wdev_priv *pwdev_priv; ++ _adapter *adapter; ++ ++ if (ndev == NULL) ++ return; ++ ++ adapter = (_adapter *)rtw_netdev_priv(ndev); ++ pwdev_priv = adapter_wdev_data(adapter); ++ ++#ifdef CONFIG_DEBUG_CFG80211 ++ RTW_INFO(FUNC_ADPT_FMT" stypes:%x\n", FUNC_ADPT_ARG(adapter), ++ upd->interface_stypes); ++#endif ++ ++ /* not implemented, see bellow */ ++} ++ ++#else ++ + static void cfg80211_rtw_mgmt_frame_register(struct wiphy *wiphy, + #if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0)) + struct wireless_dev *wdev, +@@ -7525,6 +7552,8 @@ exit: + return; + } + ++#endif ++ + #if defined(CONFIG_TDLS) && (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 2, 0)) + static int cfg80211_rtw_tdls_mgmt(struct wiphy *wiphy, + struct net_device *ndev, +@@ -9903,7 +9932,11 @@ static struct cfg80211_ops rtw_cfg80211_ops = { + + #if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 37)) || defined(COMPAT_KERNEL_RELEASE) + .mgmt_tx = cfg80211_rtw_mgmt_tx, ++#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 8, 0)) ++ .update_mgmt_frame_registrations = cfg80211_rtw_update_mgmt_frame_registrations, ++#else + .mgmt_frame_register = cfg80211_rtw_mgmt_frame_register, ++#endif + #elif (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 34) && LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 35)) + .action = cfg80211_rtw_mgmt_tx, + #endif +diff --git a/drivers/net/wireless/rtl88x2bu/os_dep/linux/ioctl_cfg80211.c b/drivers/net/wireless/rtl88x2bu/os_dep/linux/ioctl_cfg80211.c +index 2fd4e28..b463e55 100755 +--- a/drivers/net/wireless/rtl88x2bu/os_dep/linux/ioctl_cfg80211.c ++++ b/drivers/net/wireless/rtl88x2bu/os_dep/linux/ioctl_cfg80211.c +@@ -7325,6 +7325,33 @@ exit: + return ret; + } + ++#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 8, 0)) ++ ++static void ++cfg80211_rtw_update_mgmt_frame_registrations(struct wiphy *wiphy, ++ struct wireless_dev *wdev, ++ struct mgmt_frame_regs *upd) ++{ ++ struct net_device *ndev = wdev_to_ndev(wdev); ++ struct rtw_wdev_priv *pwdev_priv; ++ _adapter *adapter; ++ ++ if (ndev == NULL) ++ return; ++ ++ adapter = (_adapter *)rtw_netdev_priv(ndev); ++ pwdev_priv = adapter_wdev_data(adapter); ++ ++#ifdef CONFIG_DEBUG_CFG80211 ++ RTW_INFO(FUNC_ADPT_FMT" stypes:%x\n", FUNC_ADPT_ARG(adapter), ++ upd->interface_stypes); ++#endif ++ ++ /* not implemented, see bellow */ ++} ++ ++#else ++ + static void cfg80211_rtw_mgmt_frame_register(struct wiphy *wiphy, + #if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0)) + struct wireless_dev *wdev, +@@ -7369,6 +7396,8 @@ exit: + return; + } + ++#endif ++ + #if defined(CONFIG_TDLS) && (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 2, 0)) + static int cfg80211_rtw_tdls_mgmt(struct wiphy *wiphy, + struct net_device *ndev, +@@ -9652,7 +9681,11 @@ static struct cfg80211_ops rtw_cfg80211_ops = { + + #if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 37)) || defined(COMPAT_KERNEL_RELEASE) + .mgmt_tx = cfg80211_rtw_mgmt_tx, ++#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 8, 0)) ++ .update_mgmt_frame_registrations = cfg80211_rtw_update_mgmt_frame_registrations, ++#else + .mgmt_frame_register = cfg80211_rtw_mgmt_frame_register, ++#endif + #elif (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 34) && LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 35)) + .action = cfg80211_rtw_mgmt_tx, + #endif +diff --git a/drivers/net/wireless/rtl8723ds/os_dep/linux/ioctl_cfg80211.c b/drivers/net/wireless/rtl8723ds/os_dep/linux/ioctl_cfg80211.c +index 564c2c5..921a452 100644 +--- a/drivers/net/wireless/rtl8723ds/os_dep/linux/ioctl_cfg80211.c ++++ b/drivers/net/wireless/rtl8723ds/os_dep/linux/ioctl_cfg80211.c +@@ -5872,6 +5872,33 @@ exit: + return ret; + } + ++#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 8, 0)) ++ ++static void ++cfg80211_rtw_update_mgmt_frame_registrations(struct wiphy *wiphy, ++ struct wireless_dev *wdev, ++ struct mgmt_frame_regs *upd) ++{ ++ struct net_device *ndev = wdev_to_ndev(wdev); ++ struct rtw_wdev_priv *pwdev_priv; ++ _adapter *adapter; ++ ++ if (ndev == NULL) ++ return; ++ ++ adapter = (_adapter *)rtw_netdev_priv(ndev); ++ pwdev_priv = adapter_wdev_data(adapter); ++ ++#ifdef CONFIG_DEBUG_CFG80211 ++ RTW_INFO(FUNC_ADPT_FMT" stypes:%x\n", FUNC_ADPT_ARG(adapter), ++ upd->interface_stypes); ++#endif ++ ++ /* not implemented, see bellow */ ++} ++ ++#else ++ + static void cfg80211_rtw_mgmt_frame_register(struct wiphy *wiphy, + #if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0)) + struct wireless_dev *wdev, +@@ -5916,6 +5943,8 @@ exit: + return; + } + ++#endif ++ + #if defined(CONFIG_TDLS) && (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 2, 0)) + static int cfg80211_rtw_tdls_mgmt(struct wiphy *wiphy, + struct net_device *ndev, +@@ -6866,7 +6895,11 @@ static struct cfg80211_ops rtw_cfg80211_ops = { + + #if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 37)) || defined(COMPAT_KERNEL_RELEASE) + .mgmt_tx = cfg80211_rtw_mgmt_tx, ++#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 8, 0)) ++ .update_mgmt_frame_registrations = cfg80211_rtw_update_mgmt_frame_registrations, ++#else + .mgmt_frame_register = cfg80211_rtw_mgmt_frame_register, ++#endif + #elif (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 34) && LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 35)) + .action = cfg80211_rtw_mgmt_tx, + #endif diff --git a/patch/kernel/odroidxu4-legacy/patch-4.14.191-192.patch b/patch/kernel/odroidxu4-legacy/patch-4.14.191-192.patch new file mode 100644 index 000000000..87bec01d4 --- /dev/null +++ b/patch/kernel/odroidxu4-legacy/patch-4.14.191-192.patch @@ -0,0 +1,1244 @@ +diff --git a/Makefile b/Makefile +index e31c1ce12895..60570fad811e 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 14 +-SUBLEVEL = 191 ++SUBLEVEL = 192 + EXTRAVERSION = + NAME = Petit Gorille + +diff --git a/arch/arm/kernel/hw_breakpoint.c b/arch/arm/kernel/hw_breakpoint.c +index af2a7f1e3103..a30f656f791f 100644 +--- a/arch/arm/kernel/hw_breakpoint.c ++++ b/arch/arm/kernel/hw_breakpoint.c +@@ -688,6 +688,12 @@ static void disable_single_step(struct perf_event *bp) + arch_install_hw_breakpoint(bp); + } + ++static int watchpoint_fault_on_uaccess(struct pt_regs *regs, ++ struct arch_hw_breakpoint *info) ++{ ++ return !user_mode(regs) && info->ctrl.privilege == ARM_BREAKPOINT_USER; ++} ++ + static void watchpoint_handler(unsigned long addr, unsigned int fsr, + struct pt_regs *regs) + { +@@ -747,16 +753,27 @@ static void watchpoint_handler(unsigned long addr, unsigned int fsr, + } + + pr_debug("watchpoint fired: address = 0x%x\n", info->trigger); ++ ++ /* ++ * If we triggered a user watchpoint from a uaccess routine, ++ * then handle the stepping ourselves since userspace really ++ * can't help us with this. ++ */ ++ if (watchpoint_fault_on_uaccess(regs, info)) ++ goto step; ++ + perf_bp_event(wp, regs); + + /* +- * If no overflow handler is present, insert a temporary +- * mismatch breakpoint so we can single-step over the +- * watchpoint trigger. ++ * Defer stepping to the overflow handler if one is installed. ++ * Otherwise, insert a temporary mismatch breakpoint so that ++ * we can single-step over the watchpoint trigger. + */ +- if (is_default_overflow_handler(wp)) +- enable_single_step(wp, instruction_pointer(regs)); ++ if (!is_default_overflow_handler(wp)) ++ goto unlock; + ++step: ++ enable_single_step(wp, instruction_pointer(regs)); + unlock: + rcu_read_unlock(); + } +diff --git a/arch/arm64/include/asm/alternative.h b/arch/arm64/include/asm/alternative.h +index 1824768fb1ee..3abb2dacb43f 100644 +--- a/arch/arm64/include/asm/alternative.h ++++ b/arch/arm64/include/asm/alternative.h +@@ -72,9 +72,9 @@ void apply_alternatives(void *start, size_t length); + "663:\n\t" \ + newinstr "\n" \ + "664:\n\t" \ +- ".previous\n\t" \ + ".org . - (664b-663b) + (662b-661b)\n\t" \ +- ".org . - (662b-661b) + (664b-663b)\n" \ ++ ".org . - (662b-661b) + (664b-663b)\n\t" \ ++ ".previous\n" \ + ".endif\n" + + #define __ALTERNATIVE_CFG_CB(oldinstr, feature, cfg_enabled, cb) \ +diff --git a/arch/arm64/include/asm/checksum.h b/arch/arm64/include/asm/checksum.h +index 0b6f5a7d4027..fd11e0d70e44 100644 +--- a/arch/arm64/include/asm/checksum.h ++++ b/arch/arm64/include/asm/checksum.h +@@ -30,16 +30,17 @@ static inline __sum16 ip_fast_csum(const void *iph, unsigned int ihl) + { + __uint128_t tmp; + u64 sum; ++ int n = ihl; /* we want it signed */ + + tmp = *(const __uint128_t *)iph; + iph += 16; +- ihl -= 4; ++ n -= 4; + tmp += ((tmp >> 64) | (tmp << 64)); + sum = tmp >> 64; + do { + sum += *(const u32 *)iph; + iph += 4; +- } while (--ihl); ++ } while (--n > 0); + + sum += ((sum >> 32) | (sum << 32)); + return csum_fold((__force u32)(sum >> 32)); +diff --git a/arch/parisc/include/asm/cmpxchg.h b/arch/parisc/include/asm/cmpxchg.h +index ab5c215cf46c..068958575871 100644 +--- a/arch/parisc/include/asm/cmpxchg.h ++++ b/arch/parisc/include/asm/cmpxchg.h +@@ -60,6 +60,7 @@ extern void __cmpxchg_called_with_bad_pointer(void); + extern unsigned long __cmpxchg_u32(volatile unsigned int *m, unsigned int old, + unsigned int new_); + extern u64 __cmpxchg_u64(volatile u64 *ptr, u64 old, u64 new_); ++extern u8 __cmpxchg_u8(volatile u8 *ptr, u8 old, u8 new_); + + /* don't worry...optimizer will get rid of most of this */ + static inline unsigned long +@@ -71,6 +72,7 @@ __cmpxchg(volatile void *ptr, unsigned long old, unsigned long new_, int size) + #endif + case 4: return __cmpxchg_u32((unsigned int *)ptr, + (unsigned int)old, (unsigned int)new_); ++ case 1: return __cmpxchg_u8((u8 *)ptr, (u8)old, (u8)new_); + } + __cmpxchg_called_with_bad_pointer(); + return old; +diff --git a/arch/parisc/lib/bitops.c b/arch/parisc/lib/bitops.c +index 70ffbcf889b8..2e4d1f05a926 100644 +--- a/arch/parisc/lib/bitops.c ++++ b/arch/parisc/lib/bitops.c +@@ -79,3 +79,15 @@ unsigned long __cmpxchg_u32(volatile unsigned int *ptr, unsigned int old, unsign + _atomic_spin_unlock_irqrestore(ptr, flags); + return (unsigned long)prev; + } ++ ++u8 __cmpxchg_u8(volatile u8 *ptr, u8 old, u8 new) ++{ ++ unsigned long flags; ++ u8 prev; ++ ++ _atomic_spin_lock_irqsave(ptr, flags); ++ if ((prev = *ptr) == old) ++ *ptr = new; ++ _atomic_spin_unlock_irqrestore(ptr, flags); ++ return prev; ++} +diff --git a/arch/sh/kernel/entry-common.S b/arch/sh/kernel/entry-common.S +index 28cc61216b64..ed5b758c650d 100644 +--- a/arch/sh/kernel/entry-common.S ++++ b/arch/sh/kernel/entry-common.S +@@ -203,7 +203,7 @@ syscall_trace_entry: + mov.l @(OFF_R7,r15), r7 ! arg3 + mov.l @(OFF_R3,r15), r3 ! syscall_nr + ! +- mov.l 2f, r10 ! Number of syscalls ++ mov.l 6f, r10 ! Number of syscalls + cmp/hs r10, r3 + bf syscall_call + mov #-ENOSYS, r0 +@@ -357,7 +357,7 @@ ENTRY(system_call) + tst r9, r8 + bf syscall_trace_entry + ! +- mov.l 2f, r8 ! Number of syscalls ++ mov.l 6f, r8 ! Number of syscalls + cmp/hs r8, r3 + bt syscall_badsys + ! +@@ -396,7 +396,7 @@ syscall_exit: + #if !defined(CONFIG_CPU_SH2) + 1: .long TRA + #endif +-2: .long NR_syscalls ++6: .long NR_syscalls + 3: .long sys_call_table + 7: .long do_syscall_trace_enter + 8: .long do_syscall_trace_leave +diff --git a/arch/x86/kernel/i8259.c b/arch/x86/kernel/i8259.c +index 02abc134367f..f7833ae4e3f1 100644 +--- a/arch/x86/kernel/i8259.c ++++ b/arch/x86/kernel/i8259.c +@@ -206,7 +206,7 @@ spurious_8259A_irq: + * lets ACK and report it. [once per IRQ] + */ + if (!(spurious_irq_mask & irqmask)) { +- printk(KERN_DEBUG ++ printk_deferred(KERN_DEBUG + "spurious 8259A interrupt: IRQ%d.\n", irq); + spurious_irq_mask |= irqmask; + } +diff --git a/arch/x86/kernel/unwind_orc.c b/arch/x86/kernel/unwind_orc.c +index a9a55e76a43f..a5e2ce931f69 100644 +--- a/arch/x86/kernel/unwind_orc.c ++++ b/arch/x86/kernel/unwind_orc.c +@@ -346,8 +346,11 @@ bool unwind_next_frame(struct unwind_state *state) + /* + * Find the orc_entry associated with the text address. + * +- * Decrement call return addresses by one so they work for sibling +- * calls and calls to noreturn functions. ++ * For a call frame (as opposed to a signal frame), state->ip points to ++ * the instruction after the call. That instruction's stack layout ++ * could be different from the call instruction's layout, for example ++ * if the call was to a noreturn function. So get the ORC data for the ++ * call instruction itself. + */ + orc = orc_find(state->signal ? state->ip : state->ip - 1); + if (!orc || orc->sp_reg == ORC_REG_UNDEFINED) +@@ -550,6 +553,7 @@ void __unwind_start(struct unwind_state *state, struct task_struct *task, + state->sp = task->thread.sp; + state->bp = READ_ONCE_NOCHECK(frame->bp); + state->ip = READ_ONCE_NOCHECK(frame->ret_addr); ++ state->signal = (void *)state->ip == ret_from_fork; + } + + if (get_stack_info((unsigned long *)state->sp, state->task, +diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S +index 8d8e33b720b4..d3dc8bc6b3ad 100644 +--- a/arch/x86/kernel/vmlinux.lds.S ++++ b/arch/x86/kernel/vmlinux.lds.S +@@ -352,7 +352,8 @@ SECTIONS + .bss : AT(ADDR(.bss) - LOAD_OFFSET) { + __bss_start = .; + *(.bss..page_aligned) +- *(.bss) ++ . = ALIGN(PAGE_SIZE); ++ *(BSS_MAIN) + . = ALIGN(PAGE_SIZE); + __bss_stop = .; + } +diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c +index 537c36b55b5d..d4fdf0e52144 100644 +--- a/arch/x86/kvm/lapic.c ++++ b/arch/x86/kvm/lapic.c +@@ -1918,7 +1918,7 @@ void kvm_set_lapic_tscdeadline_msr(struct kvm_vcpu *vcpu, u64 data) + { + struct kvm_lapic *apic = vcpu->arch.apic; + +- if (!lapic_in_kernel(vcpu) || apic_lvtt_oneshot(apic) || ++ if (!kvm_apic_present(vcpu) || apic_lvtt_oneshot(apic) || + apic_lvtt_period(apic)) + return; + +diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c +index 09f47c837c25..3aed03942d7d 100644 +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -3075,6 +3075,9 @@ static void kvm_steal_time_set_preempted(struct kvm_vcpu *vcpu) + if (!(vcpu->arch.st.msr_val & KVM_MSR_ENABLED)) + return; + ++ if (vcpu->arch.st.steal.preempted) ++ return; ++ + vcpu->arch.st.steal.preempted = 1; + + kvm_write_guest_offset_cached(vcpu->kvm, &vcpu->arch.st.stime, +diff --git a/drivers/crypto/ccp/ccp-ops.c b/drivers/crypto/ccp/ccp-ops.c +index 330853a2702f..43b74cf0787e 100644 +--- a/drivers/crypto/ccp/ccp-ops.c ++++ b/drivers/crypto/ccp/ccp-ops.c +@@ -1783,8 +1783,9 @@ ccp_run_sha_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd) + LSB_ITEM_SIZE); + break; + default: ++ kfree(hmac_buf); + ret = -EINVAL; +- goto e_ctx; ++ goto e_data; + } + + memset(&hmac_cmd, 0, sizeof(hmac_cmd)); +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c +index c93e72d8ac5f..22d9ec80a2ff 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c +@@ -527,8 +527,9 @@ static int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file + return n ? -EFAULT : 0; + } + case AMDGPU_INFO_DEV_INFO: { +- struct drm_amdgpu_info_device dev_info = {}; ++ struct drm_amdgpu_info_device dev_info; + ++ memset(&dev_info, 0, sizeof(dev_info)); + dev_info.device_id = dev->pdev->device; + dev_info.chip_rev = adev->rev_id; + dev_info.external_rev = adev->external_rev_id; +diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c +index d2c042af36b8..470a79eef254 100644 +--- a/drivers/gpu/drm/drm_gem.c ++++ b/drivers/gpu/drm/drm_gem.c +@@ -730,9 +730,6 @@ err: + * @file_priv: drm file-private structure + * + * Open an object using the global name, returning a handle and the size. +- * +- * This handle (of course) holds a reference to the object, so the object +- * will not go away until the handle is deleted. + */ + int + drm_gem_open_ioctl(struct drm_device *dev, void *data, +@@ -757,14 +754,15 @@ drm_gem_open_ioctl(struct drm_device *dev, void *data, + + /* drm_gem_handle_create_tail unlocks dev->object_name_lock. */ + ret = drm_gem_handle_create_tail(file_priv, obj, &handle); +- drm_gem_object_put_unlocked(obj); + if (ret) +- return ret; ++ goto err; + + args->handle = handle; + args->size = obj->size; + +- return 0; ++err: ++ drm_gem_object_put_unlocked(obj); ++ return ret; + } + + /** +diff --git a/drivers/i2c/busses/i2c-cadence.c b/drivers/i2c/busses/i2c-cadence.c +index d917cefc5a19..b13605718291 100644 +--- a/drivers/i2c/busses/i2c-cadence.c ++++ b/drivers/i2c/busses/i2c-cadence.c +@@ -382,10 +382,8 @@ static void cdns_i2c_mrecv(struct cdns_i2c *id) + * Check for the message size against FIFO depth and set the + * 'hold bus' bit if it is greater than FIFO depth. + */ +- if ((id->recv_count > CDNS_I2C_FIFO_DEPTH) || id->bus_hold_flag) ++ if (id->recv_count > CDNS_I2C_FIFO_DEPTH) + ctrl_reg |= CDNS_I2C_CR_HOLD; +- else +- ctrl_reg = ctrl_reg & ~CDNS_I2C_CR_HOLD; + + cdns_i2c_writereg(ctrl_reg, CDNS_I2C_CR_OFFSET); + +@@ -442,11 +440,8 @@ static void cdns_i2c_msend(struct cdns_i2c *id) + * Check for the message size against FIFO depth and set the + * 'hold bus' bit if it is greater than FIFO depth. + */ +- if ((id->send_count > CDNS_I2C_FIFO_DEPTH) || id->bus_hold_flag) ++ if (id->send_count > CDNS_I2C_FIFO_DEPTH) + ctrl_reg |= CDNS_I2C_CR_HOLD; +- else +- ctrl_reg = ctrl_reg & ~CDNS_I2C_CR_HOLD; +- + cdns_i2c_writereg(ctrl_reg, CDNS_I2C_CR_OFFSET); + + /* Clear the interrupts in interrupt status register. */ +diff --git a/drivers/iio/imu/adis16400_buffer.c b/drivers/iio/imu/adis16400_buffer.c +index e70a5339acb1..3fc11aec98b9 100644 +--- a/drivers/iio/imu/adis16400_buffer.c ++++ b/drivers/iio/imu/adis16400_buffer.c +@@ -38,8 +38,11 @@ int adis16400_update_scan_mode(struct iio_dev *indio_dev, + return -ENOMEM; + + adis->buffer = kzalloc(burst_length + sizeof(u16), GFP_KERNEL); +- if (!adis->buffer) ++ if (!adis->buffer) { ++ kfree(adis->xfer); ++ adis->xfer = NULL; + return -ENOMEM; ++ } + + tx = adis->buffer + burst_length; + tx[0] = ADIS_READ_REG(ADIS16400_GLOB_CMD); +diff --git a/drivers/media/pci/cx23885/cx23888-ir.c b/drivers/media/pci/cx23885/cx23888-ir.c +index 040323b0f945..f63a7e6f272c 100644 +--- a/drivers/media/pci/cx23885/cx23888-ir.c ++++ b/drivers/media/pci/cx23885/cx23888-ir.c +@@ -1178,8 +1178,11 @@ int cx23888_ir_probe(struct cx23885_dev *dev) + return -ENOMEM; + + spin_lock_init(&state->rx_kfifo_lock); +- if (kfifo_alloc(&state->rx_kfifo, CX23888_IR_RX_KFIFO_SIZE, GFP_KERNEL)) ++ if (kfifo_alloc(&state->rx_kfifo, CX23888_IR_RX_KFIFO_SIZE, ++ GFP_KERNEL)) { ++ kfree(state); + return -ENOMEM; ++ } + + state->dev = dev; + sd = &state->sd; +diff --git a/drivers/net/ethernet/chelsio/cxgb4/sge.c b/drivers/net/ethernet/chelsio/cxgb4/sge.c +index 0a5c4c7da505..006f8b8aaa7d 100644 +--- a/drivers/net/ethernet/chelsio/cxgb4/sge.c ++++ b/drivers/net/ethernet/chelsio/cxgb4/sge.c +@@ -1812,6 +1812,7 @@ static inline int uld_send(struct adapter *adap, struct sk_buff *skb, + txq_info = adap->sge.uld_txq_info[tx_uld_type]; + if (unlikely(!txq_info)) { + WARN_ON(true); ++ kfree_skb(skb); + return NET_XMIT_DROP; + } + +diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c +index 85c11dafb4cd..8b8a0c4fbc99 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -2324,7 +2324,7 @@ req_rx_irq_failed: + req_tx_irq_failed: + for (j = 0; j < i; j++) { + free_irq(adapter->tx_scrq[j]->irq, adapter->tx_scrq[j]); +- irq_dispose_mapping(adapter->rx_scrq[j]->irq); ++ irq_dispose_mapping(adapter->tx_scrq[j]->irq); + } + release_sub_crqs(adapter); + return rc; +diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c +index cf9011bb6e0f..c6660b61e836 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/main.c ++++ b/drivers/net/ethernet/mellanox/mlx4/main.c +@@ -4190,12 +4190,14 @@ end: + static void mlx4_shutdown(struct pci_dev *pdev) + { + struct mlx4_dev_persistent *persist = pci_get_drvdata(pdev); ++ struct mlx4_dev *dev = persist->dev; + + mlx4_info(persist->dev, "mlx4_shutdown was called\n"); + mutex_lock(&persist->interface_state_mutex); + if (persist->interface_state & MLX4_INTERFACE_STATE_UP) + mlx4_unload_one(pdev); + mutex_unlock(&persist->interface_state_mutex); ++ mlx4_pci_disable_device(dev); + } + + static const struct pci_error_handlers mlx4_err_handler = { +diff --git a/drivers/net/ethernet/mellanox/mlxsw/core.c b/drivers/net/ethernet/mellanox/mlxsw/core.c +index 96f9f267d16d..dc12ab33afff 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/core.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/core.c +@@ -1361,7 +1361,7 @@ static int mlxsw_core_reg_access_emad(struct mlxsw_core *mlxsw_core, + err = mlxsw_emad_reg_access(mlxsw_core, reg, payload, type, trans, + bulk_list, cb, cb_priv, tid); + if (err) { +- kfree(trans); ++ kfree_rcu(trans, rcu); + return err; + } + return 0; +@@ -1574,11 +1574,13 @@ void mlxsw_core_skb_receive(struct mlxsw_core *mlxsw_core, struct sk_buff *skb, + break; + } + } +- rcu_read_unlock(); +- if (!found) ++ if (!found) { ++ rcu_read_unlock(); + goto drop; ++ } + + rxl->func(skb, local_port, rxl_item->priv); ++ rcu_read_unlock(); + return; + + drop: +diff --git a/drivers/net/ethernet/qlogic/qed/qed_int.c b/drivers/net/ethernet/qlogic/qed/qed_int.c +index c5d9f290ec4c..f8d1d02a3cd4 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_int.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_int.c +@@ -1015,7 +1015,8 @@ static int qed_int_attentions(struct qed_hwfn *p_hwfn) + index, attn_bits, attn_acks, asserted_bits, + deasserted_bits, p_sb_attn_sw->known_attn); + } else if (asserted_bits == 0x100) { +- DP_INFO(p_hwfn, "MFW indication via attention\n"); ++ DP_VERBOSE(p_hwfn, NETIF_MSG_INTR, ++ "MFW indication via attention\n"); + } else { + DP_VERBOSE(p_hwfn, NETIF_MSG_INTR, + "MFW indication [deassertion]\n"); +diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c +index d73617cc3b15..9f4d93a16b7e 100644 +--- a/drivers/net/ethernet/renesas/ravb_main.c ++++ b/drivers/net/ethernet/renesas/ravb_main.c +@@ -1482,6 +1482,7 @@ static void ravb_tx_timeout_work(struct work_struct *work) + struct ravb_private *priv = container_of(work, struct ravb_private, + work); + struct net_device *ndev = priv->ndev; ++ int error; + + netif_tx_stop_all_queues(ndev); + +@@ -1490,15 +1491,36 @@ static void ravb_tx_timeout_work(struct work_struct *work) + ravb_ptp_stop(ndev); + + /* Wait for DMA stopping */ +- ravb_stop_dma(ndev); ++ if (ravb_stop_dma(ndev)) { ++ /* If ravb_stop_dma() fails, the hardware is still operating ++ * for TX and/or RX. So, this should not call the following ++ * functions because ravb_dmac_init() is possible to fail too. ++ * Also, this should not retry ravb_stop_dma() again and again ++ * here because it's possible to wait forever. So, this just ++ * re-enables the TX and RX and skip the following ++ * re-initialization procedure. ++ */ ++ ravb_rcv_snd_enable(ndev); ++ goto out; ++ } + + ravb_ring_free(ndev, RAVB_BE); + ravb_ring_free(ndev, RAVB_NC); + + /* Device init */ +- ravb_dmac_init(ndev); ++ error = ravb_dmac_init(ndev); ++ if (error) { ++ /* If ravb_dmac_init() fails, descriptors are freed. So, this ++ * should return here to avoid re-enabling the TX and RX in ++ * ravb_emac_init(). ++ */ ++ netdev_err(ndev, "%s: ravb_dmac_init() failed, error %d\n", ++ __func__, error); ++ return; ++ } + ravb_emac_init(ndev); + ++out: + /* Initialise PTP Clock driver */ + if (priv->chip_id == RCAR_GEN2) + ravb_ptp_init(ndev, priv->pdev); +diff --git a/drivers/net/phy/mdio-bcm-unimac.c b/drivers/net/phy/mdio-bcm-unimac.c +index 52703bbd4d66..df75efa96a7d 100644 +--- a/drivers/net/phy/mdio-bcm-unimac.c ++++ b/drivers/net/phy/mdio-bcm-unimac.c +@@ -237,6 +237,8 @@ static int unimac_mdio_probe(struct platform_device *pdev) + return -ENOMEM; + + r = platform_get_resource(pdev, IORESOURCE_MEM, 0); ++ if (!r) ++ return -EINVAL; + + /* Just ioremap, as this MDIO block is usually integrated into an + * Ethernet MAC controller register range +diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c +index 6597d1f8d68c..7988c41bff1d 100644 +--- a/drivers/net/usb/hso.c ++++ b/drivers/net/usb/hso.c +@@ -1402,8 +1402,9 @@ static void hso_serial_set_termios(struct tty_struct *tty, struct ktermios *old) + unsigned long flags; + + if (old) +- hso_dbg(0x16, "Termios called with: cflags new[%d] - old[%d]\n", +- tty->termios.c_cflag, old->c_cflag); ++ hso_dbg(0x16, "Termios called with: cflags new[%u] - old[%u]\n", ++ (unsigned int)tty->termios.c_cflag, ++ (unsigned int)old->c_cflag); + + /* the actual setup */ + spin_lock_irqsave(&serial->serial_lock, flags); +diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c +index b179a96ea08c..895f307979c8 100644 +--- a/drivers/net/usb/lan78xx.c ++++ b/drivers/net/usb/lan78xx.c +@@ -3629,6 +3629,11 @@ static int lan78xx_probe(struct usb_interface *intf, + netdev->max_mtu = MAX_SINGLE_PACKET_SIZE; + netif_set_gso_max_size(netdev, MAX_SINGLE_PACKET_SIZE - MAX_HEADER); + ++ if (intf->cur_altsetting->desc.bNumEndpoints < 3) { ++ ret = -ENODEV; ++ goto out3; ++ } ++ + dev->ep_blkin = (intf->cur_altsetting)->endpoint + 0; + dev->ep_blkout = (intf->cur_altsetting)->endpoint + 1; + dev->ep_intr = (intf->cur_altsetting)->endpoint + 2; +@@ -3653,6 +3658,7 @@ static int lan78xx_probe(struct usb_interface *intf, + usb_fill_int_urb(dev->urb_intr, dev->udev, + dev->pipe_intr, buf, maxp, + intr_complete, dev, period); ++ dev->urb_intr->transfer_flags |= URB_FREE_BUFFER; + } + } + +diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c +index d2e062eaf561..f705f0e1cb5b 100644 +--- a/drivers/net/wireless/ath/ath9k/htc_hst.c ++++ b/drivers/net/wireless/ath/ath9k/htc_hst.c +@@ -173,6 +173,7 @@ static int htc_config_pipe_credits(struct htc_target *target) + time_left = wait_for_completion_timeout(&target->cmd_wait, HZ); + if (!time_left) { + dev_err(target->dev, "HTC credit config timeout\n"); ++ kfree_skb(skb); + return -ETIMEDOUT; + } + +@@ -208,6 +209,7 @@ static int htc_setup_complete(struct htc_target *target) + time_left = wait_for_completion_timeout(&target->cmd_wait, HZ); + if (!time_left) { + dev_err(target->dev, "HTC start timeout\n"); ++ kfree_skb(skb); + return -ETIMEDOUT; + } + +@@ -280,6 +282,7 @@ int htc_connect_service(struct htc_target *target, + if (!time_left) { + dev_err(target->dev, "Service connection timeout for: %d\n", + service_connreq->service_id); ++ kfree_skb(skb); + return -ETIMEDOUT; + } + +diff --git a/drivers/net/wireless/ath/ath9k/wmi.c b/drivers/net/wireless/ath/ath9k/wmi.c +index f57f48e4d7a0..4b68804f3742 100644 +--- a/drivers/net/wireless/ath/ath9k/wmi.c ++++ b/drivers/net/wireless/ath/ath9k/wmi.c +@@ -338,6 +338,7 @@ int ath9k_wmi_cmd(struct wmi *wmi, enum wmi_cmd_id cmd_id, + ath_dbg(common, WMI, "Timeout waiting for WMI command: %s\n", + wmi_cmd_to_name(cmd_id)); + mutex_unlock(&wmi->op_mutex); ++ kfree_skb(skb); + return -ETIMEDOUT; + } + +diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c +index 91bf86cee273..1131397454bd 100644 +--- a/drivers/net/xen-netfront.c ++++ b/drivers/net/xen-netfront.c +@@ -63,6 +63,8 @@ module_param_named(max_queues, xennet_max_queues, uint, 0644); + MODULE_PARM_DESC(max_queues, + "Maximum number of queues per virtual interface"); + ++#define XENNET_TIMEOUT (5 * HZ) ++ + static const struct ethtool_ops xennet_ethtool_ops; + + struct netfront_cb { +@@ -1336,12 +1338,15 @@ static struct net_device *xennet_create_dev(struct xenbus_device *dev) + + netif_carrier_off(netdev); + +- xenbus_switch_state(dev, XenbusStateInitialising); +- wait_event(module_wq, +- xenbus_read_driver_state(dev->otherend) != +- XenbusStateClosed && +- xenbus_read_driver_state(dev->otherend) != +- XenbusStateUnknown); ++ do { ++ xenbus_switch_state(dev, XenbusStateInitialising); ++ err = wait_event_timeout(module_wq, ++ xenbus_read_driver_state(dev->otherend) != ++ XenbusStateClosed && ++ xenbus_read_driver_state(dev->otherend) != ++ XenbusStateUnknown, XENNET_TIMEOUT); ++ } while (!err); ++ + return netdev; + + exit: +@@ -2142,28 +2147,43 @@ static const struct attribute_group xennet_dev_group = { + }; + #endif /* CONFIG_SYSFS */ + +-static int xennet_remove(struct xenbus_device *dev) ++static void xennet_bus_close(struct xenbus_device *dev) + { +- struct netfront_info *info = dev_get_drvdata(&dev->dev); +- +- dev_dbg(&dev->dev, "%s\n", dev->nodename); ++ int ret; + +- if (xenbus_read_driver_state(dev->otherend) != XenbusStateClosed) { ++ if (xenbus_read_driver_state(dev->otherend) == XenbusStateClosed) ++ return; ++ do { + xenbus_switch_state(dev, XenbusStateClosing); +- wait_event(module_wq, +- xenbus_read_driver_state(dev->otherend) == +- XenbusStateClosing || +- xenbus_read_driver_state(dev->otherend) == +- XenbusStateUnknown); ++ ret = wait_event_timeout(module_wq, ++ xenbus_read_driver_state(dev->otherend) == ++ XenbusStateClosing || ++ xenbus_read_driver_state(dev->otherend) == ++ XenbusStateClosed || ++ xenbus_read_driver_state(dev->otherend) == ++ XenbusStateUnknown, ++ XENNET_TIMEOUT); ++ } while (!ret); ++ ++ if (xenbus_read_driver_state(dev->otherend) == XenbusStateClosed) ++ return; + ++ do { + xenbus_switch_state(dev, XenbusStateClosed); +- wait_event(module_wq, +- xenbus_read_driver_state(dev->otherend) == +- XenbusStateClosed || +- xenbus_read_driver_state(dev->otherend) == +- XenbusStateUnknown); +- } ++ ret = wait_event_timeout(module_wq, ++ xenbus_read_driver_state(dev->otherend) == ++ XenbusStateClosed || ++ xenbus_read_driver_state(dev->otherend) == ++ XenbusStateUnknown, ++ XENNET_TIMEOUT); ++ } while (!ret); ++} ++ ++static int xennet_remove(struct xenbus_device *dev) ++{ ++ struct netfront_info *info = dev_get_drvdata(&dev->dev); + ++ xennet_bus_close(dev); + xennet_disconnect_backend(info); + + if (info->netdev->reg_state == NETREG_REGISTERED) +diff --git a/drivers/nfc/s3fwrn5/core.c b/drivers/nfc/s3fwrn5/core.c +index 9d9c8d57a042..64b58455e620 100644 +--- a/drivers/nfc/s3fwrn5/core.c ++++ b/drivers/nfc/s3fwrn5/core.c +@@ -209,6 +209,7 @@ int s3fwrn5_recv_frame(struct nci_dev *ndev, struct sk_buff *skb, + case S3FWRN5_MODE_FW: + return s3fwrn5_fw_recv_frame(ndev, skb); + default: ++ kfree_skb(skb); + return -ENODEV; + } + } +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index 5f26c170315c..243b16ce0c8e 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -2086,6 +2086,19 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10f1, quirk_disable_aspm_l0s); + DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10f4, quirk_disable_aspm_l0s); + DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x1508, quirk_disable_aspm_l0s); + ++static void quirk_disable_aspm_l0s_l1(struct pci_dev *dev) ++{ ++ pci_info(dev, "Disabling ASPM L0s/L1\n"); ++ pci_disable_link_state(dev, PCIE_LINK_STATE_L0S | PCIE_LINK_STATE_L1); ++} ++ ++/* ++ * ASM1083/1085 PCIe-PCI bridge devices cause AER timeout errors on the ++ * upstream PCIe root port when ASPM is enabled. At least L0s mode is affected; ++ * disable both L0s and L1 for now to be safe. ++ */ ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ASMEDIA, 0x1080, quirk_disable_aspm_l0s_l1); ++ + /* + * Some Pericom PCIe-to-PCI bridges in reverse mode need the PCIe Retrain + * Link bit cleared after starting the link retrain process to allow this +diff --git a/drivers/scsi/libsas/sas_ata.c b/drivers/scsi/libsas/sas_ata.c +index 70be4425ae0b..2b3637b40dde 100644 +--- a/drivers/scsi/libsas/sas_ata.c ++++ b/drivers/scsi/libsas/sas_ata.c +@@ -730,7 +730,6 @@ int sas_discover_sata(struct domain_device *dev) + if (res) + return res; + +- sas_discover_event(dev->port, DISCE_PROBE); + return 0; + } + +diff --git a/drivers/scsi/libsas/sas_discover.c b/drivers/scsi/libsas/sas_discover.c +index b200edc665a5..d6365e2fcc60 100644 +--- a/drivers/scsi/libsas/sas_discover.c ++++ b/drivers/scsi/libsas/sas_discover.c +@@ -221,13 +221,9 @@ void sas_notify_lldd_dev_gone(struct domain_device *dev) + } + } + +-static void sas_probe_devices(struct work_struct *work) ++static void sas_probe_devices(struct asd_sas_port *port) + { + struct domain_device *dev, *n; +- struct sas_discovery_event *ev = to_sas_discovery_event(work); +- struct asd_sas_port *port = ev->port; +- +- clear_bit(DISCE_PROBE, &port->disc.pending); + + /* devices must be domain members before link recovery and probe */ + list_for_each_entry(dev, &port->disco_list, disco_list_node) { +@@ -303,7 +299,6 @@ int sas_discover_end_dev(struct domain_device *dev) + res = sas_notify_lldd_dev_found(dev); + if (res) + return res; +- sas_discover_event(dev->port, DISCE_PROBE); + + return 0; + } +@@ -362,13 +357,9 @@ static void sas_unregister_common_dev(struct asd_sas_port *port, struct domain_d + sas_put_device(dev); + } + +-static void sas_destruct_devices(struct work_struct *work) ++void sas_destruct_devices(struct asd_sas_port *port) + { + struct domain_device *dev, *n; +- struct sas_discovery_event *ev = to_sas_discovery_event(work); +- struct asd_sas_port *port = ev->port; +- +- clear_bit(DISCE_DESTRUCT, &port->disc.pending); + + list_for_each_entry_safe(dev, n, &port->destroy_list, disco_list_node) { + list_del_init(&dev->disco_list_node); +@@ -379,6 +370,16 @@ static void sas_destruct_devices(struct work_struct *work) + } + } + ++static void sas_destruct_ports(struct asd_sas_port *port) ++{ ++ struct sas_port *sas_port, *p; ++ ++ list_for_each_entry_safe(sas_port, p, &port->sas_port_del_list, del_list) { ++ list_del_init(&sas_port->del_list); ++ sas_port_delete(sas_port); ++ } ++} ++ + void sas_unregister_dev(struct asd_sas_port *port, struct domain_device *dev) + { + if (!test_bit(SAS_DEV_DESTROY, &dev->state) && +@@ -393,7 +394,6 @@ void sas_unregister_dev(struct asd_sas_port *port, struct domain_device *dev) + if (!test_and_set_bit(SAS_DEV_DESTROY, &dev->state)) { + sas_rphy_unlink(dev->rphy); + list_move_tail(&dev->disco_list_node, &port->destroy_list); +- sas_discover_event(dev->port, DISCE_DESTRUCT); + } + } + +@@ -499,6 +499,8 @@ static void sas_discover_domain(struct work_struct *work) + port->port_dev = NULL; + } + ++ sas_probe_devices(port); ++ + SAS_DPRINTK("DONE DISCOVERY on port %d, pid:%d, result:%d\n", port->id, + task_pid_nr(current), error); + } +@@ -532,6 +534,10 @@ static void sas_revalidate_domain(struct work_struct *work) + port->id, task_pid_nr(current), res); + out: + mutex_unlock(&ha->disco_mutex); ++ ++ sas_destruct_devices(port); ++ sas_destruct_ports(port); ++ sas_probe_devices(port); + } + + /* ---------- Events ---------- */ +@@ -587,10 +593,8 @@ void sas_init_disc(struct sas_discovery *disc, struct asd_sas_port *port) + static const work_func_t sas_event_fns[DISC_NUM_EVENTS] = { + [DISCE_DISCOVER_DOMAIN] = sas_discover_domain, + [DISCE_REVALIDATE_DOMAIN] = sas_revalidate_domain, +- [DISCE_PROBE] = sas_probe_devices, + [DISCE_SUSPEND] = sas_suspend_devices, + [DISCE_RESUME] = sas_resume_devices, +- [DISCE_DESTRUCT] = sas_destruct_devices, + }; + + disc->pending = 0; +diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c +index f77d72f01da9..84df6cf46760 100644 +--- a/drivers/scsi/libsas/sas_expander.c ++++ b/drivers/scsi/libsas/sas_expander.c +@@ -1946,7 +1946,8 @@ static void sas_unregister_devs_sas_addr(struct domain_device *parent, + sas_port_delete_phy(phy->port, phy->phy); + sas_device_set_phy(found, phy->port); + if (phy->port->num_phys == 0) +- sas_port_delete(phy->port); ++ list_add_tail(&phy->port->del_list, ++ &parent->port->sas_port_del_list); + phy->port = NULL; + } + } +@@ -2156,7 +2157,7 @@ int sas_ex_revalidate_domain(struct domain_device *port_dev) + struct domain_device *dev = NULL; + + res = sas_find_bcast_dev(port_dev, &dev); +- while (res == 0 && dev) { ++ if (res == 0 && dev) { + struct expander_device *ex = &dev->ex_dev; + int i = 0, phy_id; + +@@ -2168,9 +2169,6 @@ int sas_ex_revalidate_domain(struct domain_device *port_dev) + res = sas_rediscover(dev, phy_id); + i = phy_id + 1; + } while (i < ex->num_phys); +- +- dev = NULL; +- res = sas_find_bcast_dev(port_dev, &dev); + } + return res; + } +diff --git a/drivers/scsi/libsas/sas_internal.h b/drivers/scsi/libsas/sas_internal.h +index c07e08136491..f3449fde9c5f 100644 +--- a/drivers/scsi/libsas/sas_internal.h ++++ b/drivers/scsi/libsas/sas_internal.h +@@ -98,6 +98,7 @@ int sas_try_ata_reset(struct asd_sas_phy *phy); + void sas_hae_reset(struct work_struct *work); + + void sas_free_device(struct kref *kref); ++void sas_destruct_devices(struct asd_sas_port *port); + + #ifdef CONFIG_SCSI_SAS_HOST_SMP + extern void sas_smp_host_handler(struct bsg_job *job, struct Scsi_Host *shost); +diff --git a/drivers/scsi/libsas/sas_port.c b/drivers/scsi/libsas/sas_port.c +index d3c5297c6c89..5d3244c8f280 100644 +--- a/drivers/scsi/libsas/sas_port.c ++++ b/drivers/scsi/libsas/sas_port.c +@@ -66,6 +66,7 @@ static void sas_resume_port(struct asd_sas_phy *phy) + rc = sas_notify_lldd_dev_found(dev); + if (rc) { + sas_unregister_dev(port, dev); ++ sas_destruct_devices(port); + continue; + } + +@@ -219,6 +220,7 @@ void sas_deform_port(struct asd_sas_phy *phy, int gone) + + if (port->num_phys == 1) { + sas_unregister_domain_devices(port, gone); ++ sas_destruct_devices(port); + sas_port_delete(port->port); + port->port = NULL; + } else { +@@ -323,6 +325,7 @@ static void sas_init_port(struct asd_sas_port *port, + INIT_LIST_HEAD(&port->dev_list); + INIT_LIST_HEAD(&port->disco_list); + INIT_LIST_HEAD(&port->destroy_list); ++ INIT_LIST_HEAD(&port->sas_port_del_list); + spin_lock_init(&port->phy_list_lock); + INIT_LIST_HEAD(&port->phy_list); + port->ha = sas_ha; +diff --git a/fs/f2fs/dir.c b/fs/f2fs/dir.c +index 4abefd841b6c..ff519f7a8784 100644 +--- a/fs/f2fs/dir.c ++++ b/fs/f2fs/dir.c +@@ -817,6 +817,17 @@ int f2fs_fill_dentries(struct dir_context *ctx, struct f2fs_dentry_ptr *d, + de_name.name = d->filename[bit_pos]; + de_name.len = le16_to_cpu(de->name_len); + ++ /* check memory boundary before moving forward */ ++ bit_pos += GET_DENTRY_SLOTS(le16_to_cpu(de->name_len)); ++ if (unlikely(bit_pos > d->max || ++ le16_to_cpu(de->name_len) > F2FS_NAME_LEN)) { ++ f2fs_msg(F2FS_I_SB(d->inode)->sb, KERN_WARNING, ++ "%s: corrupted namelen=%d, run fsck to fix.", ++ __func__, le16_to_cpu(de->name_len)); ++ set_sbi_flag(F2FS_I_SB(d->inode)->sb->s_fs_info, SBI_NEED_FSCK); ++ return -EINVAL; ++ } ++ + if (f2fs_encrypted_inode(d->inode)) { + int save_len = fstr->len; + int err; +@@ -835,7 +846,6 @@ int f2fs_fill_dentries(struct dir_context *ctx, struct f2fs_dentry_ptr *d, + le32_to_cpu(de->ino), d_type)) + return 1; + +- bit_pos += GET_DENTRY_SLOTS(le16_to_cpu(de->name_len)); + ctx->pos = start_pos + bit_pos; + } + return 0; +diff --git a/fs/xfs/xfs_log.c b/fs/xfs/xfs_log.c +index 360e32220f93..0c0f70e6c7d9 100644 +--- a/fs/xfs/xfs_log.c ++++ b/fs/xfs/xfs_log.c +@@ -2684,7 +2684,6 @@ xlog_state_do_callback( + int funcdidcallbacks; /* flag: function did callbacks */ + int repeats; /* for issuing console warnings if + * looping too many times */ +- int wake = 0; + + spin_lock(&log->l_icloglock); + first_iclog = iclog = log->l_iclog; +@@ -2886,11 +2885,9 @@ xlog_state_do_callback( + #endif + + if (log->l_iclog->ic_state & (XLOG_STATE_ACTIVE|XLOG_STATE_IOERROR)) +- wake = 1; +- spin_unlock(&log->l_icloglock); +- +- if (wake) + wake_up_all(&log->l_flush_wait); ++ ++ spin_unlock(&log->l_icloglock); + } + + +@@ -4052,7 +4049,9 @@ xfs_log_force_umount( + * item committed callback functions will do this again under lock to + * avoid races. + */ ++ spin_lock(&log->l_cilp->xc_push_lock); + wake_up_all(&log->l_cilp->xc_commit_wait); ++ spin_unlock(&log->l_cilp->xc_push_lock); + xlog_state_do_callback(log, XFS_LI_ABORTED, NULL); + + #ifdef XFSERRORDEBUG +diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h +index c229ffbed6d4..48e618b20d34 100644 +--- a/include/asm-generic/vmlinux.lds.h ++++ b/include/asm-generic/vmlinux.lds.h +@@ -251,7 +251,8 @@ + + #define PAGE_ALIGNED_DATA(page_align) \ + . = ALIGN(page_align); \ +- *(.data..page_aligned) ++ *(.data..page_aligned) \ ++ . = ALIGN(page_align); + + #define READ_MOSTLY_DATA(align) \ + . = ALIGN(align); \ +@@ -619,7 +620,9 @@ + . = ALIGN(bss_align); \ + .bss : AT(ADDR(.bss) - LOAD_OFFSET) { \ + BSS_FIRST_SECTIONS \ ++ . = ALIGN(PAGE_SIZE); \ + *(.bss..page_aligned) \ ++ . = ALIGN(PAGE_SIZE); \ + *(.dynbss) \ + *(BSS_MAIN) \ + *(COMMON) \ +diff --git a/include/scsi/libsas.h b/include/scsi/libsas.h +index a966d281dedc..1b1cf9eff3b5 100644 +--- a/include/scsi/libsas.h ++++ b/include/scsi/libsas.h +@@ -87,10 +87,8 @@ enum discover_event { + DISCE_DISCOVER_DOMAIN = 0U, + DISCE_REVALIDATE_DOMAIN = 1, + DISCE_PORT_GONE = 2, +- DISCE_PROBE = 3, + DISCE_SUSPEND = 4, + DISCE_RESUME = 5, +- DISCE_DESTRUCT = 6, + DISC_NUM_EVENTS = 7, + }; + +@@ -269,6 +267,7 @@ struct asd_sas_port { + struct list_head dev_list; + struct list_head disco_list; + struct list_head destroy_list; ++ struct list_head sas_port_del_list; + enum sas_linkrate linkrate; + + struct sas_work work; +diff --git a/include/scsi/scsi_transport_sas.h b/include/scsi/scsi_transport_sas.h +index 62895b405933..05ec927a3c72 100644 +--- a/include/scsi/scsi_transport_sas.h ++++ b/include/scsi/scsi_transport_sas.h +@@ -156,6 +156,7 @@ struct sas_port { + + struct mutex phy_list_mutex; + struct list_head phy_list; ++ struct list_head del_list; /* libsas only */ + }; + + #define dev_to_sas_port(d) \ +diff --git a/include/uapi/linux/wireless.h b/include/uapi/linux/wireless.h +index 86eca3208b6b..a2c006a364e0 100644 +--- a/include/uapi/linux/wireless.h ++++ b/include/uapi/linux/wireless.h +@@ -74,6 +74,8 @@ + #include /* for "struct sockaddr" et al */ + #include /* for IFNAMSIZ and co... */ + ++#include /* for offsetof */ ++ + /***************************** VERSION *****************************/ + /* + * This constant is used to know the availability of the wireless +@@ -1090,8 +1092,7 @@ struct iw_event { + /* iw_point events are special. First, the payload (extra data) come at + * the end of the event, so they are bigger than IW_EV_POINT_LEN. Second, + * we omit the pointer, so start at an offset. */ +-#define IW_EV_POINT_OFF (((char *) &(((struct iw_point *) NULL)->length)) - \ +- (char *) NULL) ++#define IW_EV_POINT_OFF offsetof(struct iw_point, length) + #define IW_EV_POINT_LEN (IW_EV_LCP_LEN + sizeof(struct iw_point) - \ + IW_EV_POINT_OFF) + +diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c +index 505e69854eb8..6cc090d015f6 100644 +--- a/kernel/bpf/hashtab.c ++++ b/kernel/bpf/hashtab.c +@@ -656,15 +656,20 @@ static void htab_elem_free_rcu(struct rcu_head *head) + preempt_enable(); + } + +-static void free_htab_elem(struct bpf_htab *htab, struct htab_elem *l) ++static void htab_put_fd_value(struct bpf_htab *htab, struct htab_elem *l) + { + struct bpf_map *map = &htab->map; ++ void *ptr; + + if (map->ops->map_fd_put_ptr) { +- void *ptr = fd_htab_map_get_ptr(map, l); +- ++ ptr = fd_htab_map_get_ptr(map, l); + map->ops->map_fd_put_ptr(ptr); + } ++} ++ ++static void free_htab_elem(struct bpf_htab *htab, struct htab_elem *l) ++{ ++ htab_put_fd_value(htab, l); + + if (htab_is_prealloc(htab)) { + __pcpu_freelist_push(&htab->freelist, &l->fnode); +@@ -725,6 +730,7 @@ static struct htab_elem *alloc_htab_elem(struct bpf_htab *htab, void *key, + */ + pl_new = this_cpu_ptr(htab->extra_elems); + l_new = *pl_new; ++ htab_put_fd_value(htab, old_elem); + *pl_new = old_elem; + } else { + struct pcpu_freelist_node *l; +diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c +index a9c65f13b7f5..32de8afbfbf8 100644 +--- a/net/9p/trans_fd.c ++++ b/net/9p/trans_fd.c +@@ -301,7 +301,6 @@ static void p9_read_work(struct work_struct *work) + { + int n, err; + struct p9_conn *m; +- int status = REQ_STATUS_ERROR; + + m = container_of(work, struct p9_conn, rq); + +@@ -381,11 +380,21 @@ static void p9_read_work(struct work_struct *work) + if ((m->req) && (m->rc.offset == m->rc.capacity)) { + p9_debug(P9_DEBUG_TRANS, "got new packet\n"); + spin_lock(&m->client->lock); +- if (m->req->status != REQ_STATUS_ERROR) +- status = REQ_STATUS_RCVD; +- list_del(&m->req->req_list); +- /* update req->status while holding client->lock */ +- p9_client_cb(m->client, m->req, status); ++ if (m->req->status == REQ_STATUS_SENT) { ++ list_del(&m->req->req_list); ++ p9_client_cb(m->client, m->req, REQ_STATUS_RCVD); ++ } else if (m->req->status == REQ_STATUS_FLSHD) { ++ /* Ignore replies associated with a cancelled request. */ ++ p9_debug(P9_DEBUG_TRANS, ++ "Ignore replies associated with a cancelled request\n"); ++ } else { ++ spin_unlock(&m->client->lock); ++ p9_debug(P9_DEBUG_ERROR, ++ "Request tag %d errored out while we were reading the reply\n", ++ m->rc.tag); ++ err = -EIO; ++ goto error; ++ } + spin_unlock(&m->client->lock); + m->rc.sdata = NULL; + m->rc.offset = 0; +@@ -712,11 +721,20 @@ static int p9_fd_cancelled(struct p9_client *client, struct p9_req_t *req) + { + p9_debug(P9_DEBUG_TRANS, "client %p req %p\n", client, req); + ++ spin_lock(&client->lock); ++ /* Ignore cancelled request if message has been received ++ * before lock. ++ */ ++ if (req->status == REQ_STATUS_RCVD) { ++ spin_unlock(&client->lock); ++ return 0; ++ } ++ + /* we haven't received a response for oldreq, + * remove it from the list. + */ +- spin_lock(&client->lock); + list_del(&req->req_list); ++ req->status = REQ_STATUS_FLSHD; + spin_unlock(&client->lock); + + return 0; +diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c +index b1484b8316e8..c883cb67b731 100644 +--- a/net/mac80211/cfg.c ++++ b/net/mac80211/cfg.c +@@ -1997,6 +1997,7 @@ static int ieee80211_leave_mesh(struct wiphy *wiphy, struct net_device *dev) + ieee80211_stop_mesh(sdata); + mutex_lock(&sdata->local->mtx); + ieee80211_vif_release_channel(sdata); ++ kfree(sdata->u.mesh.ie); + mutex_unlock(&sdata->local->mtx); + + return 0; +diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c +index 130022091205..933f26e2ff8b 100644 +--- a/net/mac80211/mesh_pathtbl.c ++++ b/net/mac80211/mesh_pathtbl.c +@@ -554,6 +554,7 @@ static void mesh_path_free_rcu(struct mesh_table *tbl, + del_timer_sync(&mpath->timer); + atomic_dec(&sdata->u.mesh.mpaths); + atomic_dec(&tbl->entries); ++ mesh_path_flush_pending(mpath); + kfree_rcu(mpath, rcu); + } + +diff --git a/net/rds/recv.c b/net/rds/recv.c +index c27cceae52e1..ef022d24f87a 100644 +--- a/net/rds/recv.c ++++ b/net/rds/recv.c +@@ -453,12 +453,13 @@ static int rds_still_queued(struct rds_sock *rs, struct rds_incoming *inc, + int rds_notify_queue_get(struct rds_sock *rs, struct msghdr *msghdr) + { + struct rds_notifier *notifier; +- struct rds_rdma_notify cmsg = { 0 }; /* fill holes with zero */ ++ struct rds_rdma_notify cmsg; + unsigned int count = 0, max_messages = ~0U; + unsigned long flags; + LIST_HEAD(copy); + int err = 0; + ++ memset(&cmsg, 0, sizeof(cmsg)); /* fill holes with zero */ + + /* put_cmsg copies to user space and thus may sleep. We can't do this + * with rs_lock held, so first grab as many notifications as we can stuff +diff --git a/net/x25/x25_subr.c b/net/x25/x25_subr.c +index db0b1315d577..a946c1cfb5a2 100644 +--- a/net/x25/x25_subr.c ++++ b/net/x25/x25_subr.c +@@ -363,6 +363,12 @@ void x25_disconnect(struct sock *sk, int reason, unsigned char cause, + sk->sk_state_change(sk); + sock_set_flag(sk, SOCK_DEAD); + } ++ if (x25->neighbour) { ++ read_lock_bh(&x25_list_lock); ++ x25_neigh_put(x25->neighbour); ++ x25->neighbour = NULL; ++ read_unlock_bh(&x25_list_lock); ++ } + } + + /* +diff --git a/tools/testing/selftests/networking/timestamping/rxtimestamp.c b/tools/testing/selftests/networking/timestamping/rxtimestamp.c +index 7a573fb4c1c4..c6428f1ac22f 100644 +--- a/tools/testing/selftests/networking/timestamping/rxtimestamp.c ++++ b/tools/testing/selftests/networking/timestamping/rxtimestamp.c +@@ -328,8 +328,7 @@ int main(int argc, char **argv) + bool all_tests = true; + int arg_index = 0; + int failures = 0; +- int s, t; +- char opt; ++ int s, t, opt; + + while ((opt = getopt_long(argc, argv, "", long_options, + &arg_index)) != -1) { diff --git a/patch/kernel/odroidxu4-legacy/patch-4.14.192-193.patch b/patch/kernel/odroidxu4-legacy/patch-4.14.192-193.patch new file mode 100644 index 000000000..3df9868b3 --- /dev/null +++ b/patch/kernel/odroidxu4-legacy/patch-4.14.192-193.patch @@ -0,0 +1,488 @@ +diff --git a/Makefile b/Makefile +index 60570fad811e..b30927f29e2b 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 14 +-SUBLEVEL = 192 ++SUBLEVEL = 193 + EXTRAVERSION = + NAME = Petit Gorille + +diff --git a/arch/arm/include/asm/percpu.h b/arch/arm/include/asm/percpu.h +index a89b4076cde4..72821b4721ad 100644 +--- a/arch/arm/include/asm/percpu.h ++++ b/arch/arm/include/asm/percpu.h +@@ -16,6 +16,8 @@ + #ifndef _ASM_ARM_PERCPU_H_ + #define _ASM_ARM_PERCPU_H_ + ++#include ++ + /* + * Same as asm-generic/percpu.h, except that we store the per cpu offset + * in the TPIDRPRW. TPIDRPRW only exists on V6K and V7 +diff --git a/arch/arm/kernel/head-common.S b/arch/arm/kernel/head-common.S +index 7e662bdd5cb3..932b2244e709 100644 +--- a/arch/arm/kernel/head-common.S ++++ b/arch/arm/kernel/head-common.S +@@ -101,6 +101,7 @@ __mmap_switched: + str r2, [r6] @ Save atags pointer + cmp r7, #0 + strne r0, [r7] @ Save control register values ++ mov lr, #0 + b start_kernel + ENDPROC(__mmap_switched) + +diff --git a/drivers/char/random.c b/drivers/char/random.c +index 868d2620b7ac..b202f66fc383 100644 +--- a/drivers/char/random.c ++++ b/drivers/char/random.c +@@ -1246,6 +1246,7 @@ void add_interrupt_randomness(int irq, int irq_flags) + + fast_mix(fast_pool); + add_interrupt_bench(cycles); ++ this_cpu_add(net_rand_state.s1, fast_pool->pool[cycles & 3]); + + if (unlikely(crng_init == 0)) { + if ((fast_pool->count >= 64) && +diff --git a/drivers/scsi/libsas/sas_ata.c b/drivers/scsi/libsas/sas_ata.c +index 2b3637b40dde..70be4425ae0b 100644 +--- a/drivers/scsi/libsas/sas_ata.c ++++ b/drivers/scsi/libsas/sas_ata.c +@@ -730,6 +730,7 @@ int sas_discover_sata(struct domain_device *dev) + if (res) + return res; + ++ sas_discover_event(dev->port, DISCE_PROBE); + return 0; + } + +diff --git a/drivers/scsi/libsas/sas_discover.c b/drivers/scsi/libsas/sas_discover.c +index d6365e2fcc60..b200edc665a5 100644 +--- a/drivers/scsi/libsas/sas_discover.c ++++ b/drivers/scsi/libsas/sas_discover.c +@@ -221,9 +221,13 @@ void sas_notify_lldd_dev_gone(struct domain_device *dev) + } + } + +-static void sas_probe_devices(struct asd_sas_port *port) ++static void sas_probe_devices(struct work_struct *work) + { + struct domain_device *dev, *n; ++ struct sas_discovery_event *ev = to_sas_discovery_event(work); ++ struct asd_sas_port *port = ev->port; ++ ++ clear_bit(DISCE_PROBE, &port->disc.pending); + + /* devices must be domain members before link recovery and probe */ + list_for_each_entry(dev, &port->disco_list, disco_list_node) { +@@ -299,6 +303,7 @@ int sas_discover_end_dev(struct domain_device *dev) + res = sas_notify_lldd_dev_found(dev); + if (res) + return res; ++ sas_discover_event(dev->port, DISCE_PROBE); + + return 0; + } +@@ -357,9 +362,13 @@ static void sas_unregister_common_dev(struct asd_sas_port *port, struct domain_d + sas_put_device(dev); + } + +-void sas_destruct_devices(struct asd_sas_port *port) ++static void sas_destruct_devices(struct work_struct *work) + { + struct domain_device *dev, *n; ++ struct sas_discovery_event *ev = to_sas_discovery_event(work); ++ struct asd_sas_port *port = ev->port; ++ ++ clear_bit(DISCE_DESTRUCT, &port->disc.pending); + + list_for_each_entry_safe(dev, n, &port->destroy_list, disco_list_node) { + list_del_init(&dev->disco_list_node); +@@ -370,16 +379,6 @@ void sas_destruct_devices(struct asd_sas_port *port) + } + } + +-static void sas_destruct_ports(struct asd_sas_port *port) +-{ +- struct sas_port *sas_port, *p; +- +- list_for_each_entry_safe(sas_port, p, &port->sas_port_del_list, del_list) { +- list_del_init(&sas_port->del_list); +- sas_port_delete(sas_port); +- } +-} +- + void sas_unregister_dev(struct asd_sas_port *port, struct domain_device *dev) + { + if (!test_bit(SAS_DEV_DESTROY, &dev->state) && +@@ -394,6 +393,7 @@ void sas_unregister_dev(struct asd_sas_port *port, struct domain_device *dev) + if (!test_and_set_bit(SAS_DEV_DESTROY, &dev->state)) { + sas_rphy_unlink(dev->rphy); + list_move_tail(&dev->disco_list_node, &port->destroy_list); ++ sas_discover_event(dev->port, DISCE_DESTRUCT); + } + } + +@@ -499,8 +499,6 @@ static void sas_discover_domain(struct work_struct *work) + port->port_dev = NULL; + } + +- sas_probe_devices(port); +- + SAS_DPRINTK("DONE DISCOVERY on port %d, pid:%d, result:%d\n", port->id, + task_pid_nr(current), error); + } +@@ -534,10 +532,6 @@ static void sas_revalidate_domain(struct work_struct *work) + port->id, task_pid_nr(current), res); + out: + mutex_unlock(&ha->disco_mutex); +- +- sas_destruct_devices(port); +- sas_destruct_ports(port); +- sas_probe_devices(port); + } + + /* ---------- Events ---------- */ +@@ -593,8 +587,10 @@ void sas_init_disc(struct sas_discovery *disc, struct asd_sas_port *port) + static const work_func_t sas_event_fns[DISC_NUM_EVENTS] = { + [DISCE_DISCOVER_DOMAIN] = sas_discover_domain, + [DISCE_REVALIDATE_DOMAIN] = sas_revalidate_domain, ++ [DISCE_PROBE] = sas_probe_devices, + [DISCE_SUSPEND] = sas_suspend_devices, + [DISCE_RESUME] = sas_resume_devices, ++ [DISCE_DESTRUCT] = sas_destruct_devices, + }; + + disc->pending = 0; +diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c +index 84df6cf46760..f77d72f01da9 100644 +--- a/drivers/scsi/libsas/sas_expander.c ++++ b/drivers/scsi/libsas/sas_expander.c +@@ -1946,8 +1946,7 @@ static void sas_unregister_devs_sas_addr(struct domain_device *parent, + sas_port_delete_phy(phy->port, phy->phy); + sas_device_set_phy(found, phy->port); + if (phy->port->num_phys == 0) +- list_add_tail(&phy->port->del_list, +- &parent->port->sas_port_del_list); ++ sas_port_delete(phy->port); + phy->port = NULL; + } + } +@@ -2157,7 +2156,7 @@ int sas_ex_revalidate_domain(struct domain_device *port_dev) + struct domain_device *dev = NULL; + + res = sas_find_bcast_dev(port_dev, &dev); +- if (res == 0 && dev) { ++ while (res == 0 && dev) { + struct expander_device *ex = &dev->ex_dev; + int i = 0, phy_id; + +@@ -2169,6 +2168,9 @@ int sas_ex_revalidate_domain(struct domain_device *port_dev) + res = sas_rediscover(dev, phy_id); + i = phy_id + 1; + } while (i < ex->num_phys); ++ ++ dev = NULL; ++ res = sas_find_bcast_dev(port_dev, &dev); + } + return res; + } +diff --git a/drivers/scsi/libsas/sas_internal.h b/drivers/scsi/libsas/sas_internal.h +index f3449fde9c5f..c07e08136491 100644 +--- a/drivers/scsi/libsas/sas_internal.h ++++ b/drivers/scsi/libsas/sas_internal.h +@@ -98,7 +98,6 @@ int sas_try_ata_reset(struct asd_sas_phy *phy); + void sas_hae_reset(struct work_struct *work); + + void sas_free_device(struct kref *kref); +-void sas_destruct_devices(struct asd_sas_port *port); + + #ifdef CONFIG_SCSI_SAS_HOST_SMP + extern void sas_smp_host_handler(struct bsg_job *job, struct Scsi_Host *shost); +diff --git a/drivers/scsi/libsas/sas_port.c b/drivers/scsi/libsas/sas_port.c +index 5d3244c8f280..d3c5297c6c89 100644 +--- a/drivers/scsi/libsas/sas_port.c ++++ b/drivers/scsi/libsas/sas_port.c +@@ -66,7 +66,6 @@ static void sas_resume_port(struct asd_sas_phy *phy) + rc = sas_notify_lldd_dev_found(dev); + if (rc) { + sas_unregister_dev(port, dev); +- sas_destruct_devices(port); + continue; + } + +@@ -220,7 +219,6 @@ void sas_deform_port(struct asd_sas_phy *phy, int gone) + + if (port->num_phys == 1) { + sas_unregister_domain_devices(port, gone); +- sas_destruct_devices(port); + sas_port_delete(port->port); + port->port = NULL; + } else { +@@ -325,7 +323,6 @@ static void sas_init_port(struct asd_sas_port *port, + INIT_LIST_HEAD(&port->dev_list); + INIT_LIST_HEAD(&port->disco_list); + INIT_LIST_HEAD(&port->destroy_list); +- INIT_LIST_HEAD(&port->sas_port_del_list); + spin_lock_init(&port->phy_list_lock); + INIT_LIST_HEAD(&port->phy_list); + port->ha = sas_ha; +diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c +index 5f03a4fabeaa..845b8620afcf 100644 +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -3794,6 +3794,11 @@ static ssize_t ext4_direct_IO_read(struct kiocb *iocb, struct iov_iter *iter) + struct inode *inode = mapping->host; + size_t count = iov_iter_count(iter); + ssize_t ret; ++ loff_t offset = iocb->ki_pos; ++ loff_t size = i_size_read(inode); ++ ++ if (offset >= size) ++ return 0; + + /* + * Shared inode_lock is enough for us - it protects against concurrent +diff --git a/include/linux/prandom.h b/include/linux/prandom.h +new file mode 100644 +index 000000000000..aa16e6468f91 +--- /dev/null ++++ b/include/linux/prandom.h +@@ -0,0 +1,78 @@ ++/* SPDX-License-Identifier: GPL-2.0 */ ++/* ++ * include/linux/prandom.h ++ * ++ * Include file for the fast pseudo-random 32-bit ++ * generation. ++ */ ++#ifndef _LINUX_PRANDOM_H ++#define _LINUX_PRANDOM_H ++ ++#include ++#include ++ ++u32 prandom_u32(void); ++void prandom_bytes(void *buf, size_t nbytes); ++void prandom_seed(u32 seed); ++void prandom_reseed_late(void); ++ ++struct rnd_state { ++ __u32 s1, s2, s3, s4; ++}; ++ ++DECLARE_PER_CPU(struct rnd_state, net_rand_state); ++ ++u32 prandom_u32_state(struct rnd_state *state); ++void prandom_bytes_state(struct rnd_state *state, void *buf, size_t nbytes); ++void prandom_seed_full_state(struct rnd_state __percpu *pcpu_state); ++ ++#define prandom_init_once(pcpu_state) \ ++ DO_ONCE(prandom_seed_full_state, (pcpu_state)) ++ ++/** ++ * prandom_u32_max - returns a pseudo-random number in interval [0, ep_ro) ++ * @ep_ro: right open interval endpoint ++ * ++ * Returns a pseudo-random number that is in interval [0, ep_ro). Note ++ * that the result depends on PRNG being well distributed in [0, ~0U] ++ * u32 space. Here we use maximally equidistributed combined Tausworthe ++ * generator, that is, prandom_u32(). This is useful when requesting a ++ * random index of an array containing ep_ro elements, for example. ++ * ++ * Returns: pseudo-random number in interval [0, ep_ro) ++ */ ++static inline u32 prandom_u32_max(u32 ep_ro) ++{ ++ return (u32)(((u64) prandom_u32() * ep_ro) >> 32); ++} ++ ++/* ++ * Handle minimum values for seeds ++ */ ++static inline u32 __seed(u32 x, u32 m) ++{ ++ return (x < m) ? x + m : x; ++} ++ ++/** ++ * prandom_seed_state - set seed for prandom_u32_state(). ++ * @state: pointer to state structure to receive the seed. ++ * @seed: arbitrary 64-bit value to use as a seed. ++ */ ++static inline void prandom_seed_state(struct rnd_state *state, u64 seed) ++{ ++ u32 i = (seed >> 32) ^ (seed << 10) ^ seed; ++ ++ state->s1 = __seed(i, 2U); ++ state->s2 = __seed(i, 8U); ++ state->s3 = __seed(i, 16U); ++ state->s4 = __seed(i, 128U); ++} ++ ++/* Pseudo random number generator from numerical recipes. */ ++static inline u32 next_pseudo_random32(u32 seed) ++{ ++ return seed * 1664525 + 1013904223; ++} ++ ++#endif +diff --git a/include/linux/random.h b/include/linux/random.h +index 4024f7d9c77d..8eda8c0cbba7 100644 +--- a/include/linux/random.h ++++ b/include/linux/random.h +@@ -107,61 +107,12 @@ declare_get_random_var_wait(long) + + unsigned long randomize_page(unsigned long start, unsigned long range); + +-u32 prandom_u32(void); +-void prandom_bytes(void *buf, size_t nbytes); +-void prandom_seed(u32 seed); +-void prandom_reseed_late(void); +- +-struct rnd_state { +- __u32 s1, s2, s3, s4; +-}; +- +-u32 prandom_u32_state(struct rnd_state *state); +-void prandom_bytes_state(struct rnd_state *state, void *buf, size_t nbytes); +-void prandom_seed_full_state(struct rnd_state __percpu *pcpu_state); +- +-#define prandom_init_once(pcpu_state) \ +- DO_ONCE(prandom_seed_full_state, (pcpu_state)) +- +-/** +- * prandom_u32_max - returns a pseudo-random number in interval [0, ep_ro) +- * @ep_ro: right open interval endpoint +- * +- * Returns a pseudo-random number that is in interval [0, ep_ro). Note +- * that the result depends on PRNG being well distributed in [0, ~0U] +- * u32 space. Here we use maximally equidistributed combined Tausworthe +- * generator, that is, prandom_u32(). This is useful when requesting a +- * random index of an array containing ep_ro elements, for example. +- * +- * Returns: pseudo-random number in interval [0, ep_ro) +- */ +-static inline u32 prandom_u32_max(u32 ep_ro) +-{ +- return (u32)(((u64) prandom_u32() * ep_ro) >> 32); +-} +- + /* +- * Handle minimum values for seeds ++ * This is designed to be standalone for just prandom ++ * users, but for now we include it from ++ * for legacy reasons. + */ +-static inline u32 __seed(u32 x, u32 m) +-{ +- return (x < m) ? x + m : x; +-} +- +-/** +- * prandom_seed_state - set seed for prandom_u32_state(). +- * @state: pointer to state structure to receive the seed. +- * @seed: arbitrary 64-bit value to use as a seed. +- */ +-static inline void prandom_seed_state(struct rnd_state *state, u64 seed) +-{ +- u32 i = (seed >> 32) ^ (seed << 10) ^ seed; +- +- state->s1 = __seed(i, 2U); +- state->s2 = __seed(i, 8U); +- state->s3 = __seed(i, 16U); +- state->s4 = __seed(i, 128U); +-} ++#include + + #ifdef CONFIG_ARCH_RANDOM + # include +@@ -192,10 +143,4 @@ static inline bool arch_has_random_seed(void) + } + #endif + +-/* Pseudo random number generator from numerical recipes. */ +-static inline u32 next_pseudo_random32(u32 seed) +-{ +- return seed * 1664525 + 1013904223; +-} +- + #endif /* _LINUX_RANDOM_H */ +diff --git a/include/scsi/libsas.h b/include/scsi/libsas.h +index 1b1cf9eff3b5..a966d281dedc 100644 +--- a/include/scsi/libsas.h ++++ b/include/scsi/libsas.h +@@ -87,8 +87,10 @@ enum discover_event { + DISCE_DISCOVER_DOMAIN = 0U, + DISCE_REVALIDATE_DOMAIN = 1, + DISCE_PORT_GONE = 2, ++ DISCE_PROBE = 3, + DISCE_SUSPEND = 4, + DISCE_RESUME = 5, ++ DISCE_DESTRUCT = 6, + DISC_NUM_EVENTS = 7, + }; + +@@ -267,7 +269,6 @@ struct asd_sas_port { + struct list_head dev_list; + struct list_head disco_list; + struct list_head destroy_list; +- struct list_head sas_port_del_list; + enum sas_linkrate linkrate; + + struct sas_work work; +diff --git a/include/scsi/scsi_transport_sas.h b/include/scsi/scsi_transport_sas.h +index 05ec927a3c72..62895b405933 100644 +--- a/include/scsi/scsi_transport_sas.h ++++ b/include/scsi/scsi_transport_sas.h +@@ -156,7 +156,6 @@ struct sas_port { + + struct mutex phy_list_mutex; + struct list_head phy_list; +- struct list_head del_list; /* libsas only */ + }; + + #define dev_to_sas_port(d) \ +diff --git a/kernel/time/timer.c b/kernel/time/timer.c +index 7e88c87c3554..d4bc272e03ee 100644 +--- a/kernel/time/timer.c ++++ b/kernel/time/timer.c +@@ -44,6 +44,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -1595,6 +1596,13 @@ void update_process_times(int user_tick) + scheduler_tick(); + if (IS_ENABLED(CONFIG_POSIX_TIMERS)) + run_posix_cpu_timers(p); ++ ++ /* The current CPU might make use of net randoms without receiving IRQs ++ * to renew them often enough. Let's update the net_rand_state from a ++ * non-constant value that's not affine to the number of calls to make ++ * sure it's updated when there's some activity (we don't care in idle). ++ */ ++ this_cpu_add(net_rand_state.s1, rol32(jiffies, 24) + user_tick); + } + + /** +diff --git a/lib/random32.c b/lib/random32.c +index 0a90cb0e0fb6..6e2c48ab8072 100644 +--- a/lib/random32.c ++++ b/lib/random32.c +@@ -48,7 +48,7 @@ static inline void prandom_state_selftest(void) + } + #endif + +-static DEFINE_PER_CPU(struct rnd_state, net_rand_state) __latent_entropy; ++DEFINE_PER_CPU(struct rnd_state, net_rand_state); + + /** + * prandom_u32_state - seeded pseudo-random number generator. diff --git a/patch/kernel/odroidxu4-legacy/patch-4.14.193-194.patch b/patch/kernel/odroidxu4-legacy/patch-4.14.193-194.patch new file mode 100644 index 000000000..c0aeb3877 --- /dev/null +++ b/patch/kernel/odroidxu4-legacy/patch-4.14.193-194.patch @@ -0,0 +1,6900 @@ +diff --git a/Documentation/ABI/testing/sysfs-bus-iio b/Documentation/ABI/testing/sysfs-bus-iio +index 64e65450f4833..e21e2ca3e4f91 100644 +--- a/Documentation/ABI/testing/sysfs-bus-iio ++++ b/Documentation/ABI/testing/sysfs-bus-iio +@@ -1524,7 +1524,8 @@ What: /sys/bus/iio/devices/iio:deviceX/in_concentrationX_voc_raw + KernelVersion: 4.3 + Contact: linux-iio@vger.kernel.org + Description: +- Raw (unscaled no offset etc.) percentage reading of a substance. ++ Raw (unscaled no offset etc.) reading of a substance. Units ++ after application of scale and offset are percents. + + What: /sys/bus/iio/devices/iio:deviceX/in_resistance_raw + What: /sys/bus/iio/devices/iio:deviceX/in_resistanceX_raw +diff --git a/Documentation/devicetree/bindings/iio/multiplexer/io-channel-mux.txt b/Documentation/devicetree/bindings/iio/multiplexer/io-channel-mux.txt +index c82794002595f..89647d7143879 100644 +--- a/Documentation/devicetree/bindings/iio/multiplexer/io-channel-mux.txt ++++ b/Documentation/devicetree/bindings/iio/multiplexer/io-channel-mux.txt +@@ -21,7 +21,7 @@ controller state. The mux controller state is described in + + Example: + mux: mux-controller { +- compatible = "mux-gpio"; ++ compatible = "gpio-mux"; + #mux-control-cells = <0>; + + mux-gpios = <&pioA 0 GPIO_ACTIVE_HIGH>, +diff --git a/Makefile b/Makefile +index b30927f29e2b7..8e2a1418c5ae6 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 14 +-SUBLEVEL = 193 ++SUBLEVEL = 194 + EXTRAVERSION = + NAME = Petit Gorille + +diff --git a/arch/arm/kernel/stacktrace.c b/arch/arm/kernel/stacktrace.c +index 65228bf4c6dfe..ba9b9a77bcd2c 100644 +--- a/arch/arm/kernel/stacktrace.c ++++ b/arch/arm/kernel/stacktrace.c +@@ -20,6 +20,19 @@ + * A simple function epilogue looks like this: + * ldm sp, {fp, sp, pc} + * ++ * When compiled with clang, pc and sp are not pushed. A simple function ++ * prologue looks like this when built with clang: ++ * ++ * stmdb {..., fp, lr} ++ * add fp, sp, #x ++ * sub sp, sp, #y ++ * ++ * A simple function epilogue looks like this when built with clang: ++ * ++ * sub sp, fp, #x ++ * ldm {..., fp, pc} ++ * ++ * + * Note that with framepointer enabled, even the leaf functions have the same + * prologue and epilogue, therefore we can ignore the LR value in this case. + */ +@@ -32,6 +45,16 @@ int notrace unwind_frame(struct stackframe *frame) + low = frame->sp; + high = ALIGN(low, THREAD_SIZE); + ++#ifdef CONFIG_CC_IS_CLANG ++ /* check current frame pointer is within bounds */ ++ if (fp < low + 4 || fp > high - 4) ++ return -EINVAL; ++ ++ frame->sp = frame->fp; ++ frame->fp = *(unsigned long *)(fp); ++ frame->pc = frame->lr; ++ frame->lr = *(unsigned long *)(fp + 4); ++#else + /* check current frame pointer is within bounds */ + if (fp < low + 12 || fp > high - 4) + return -EINVAL; +@@ -40,6 +63,7 @@ int notrace unwind_frame(struct stackframe *frame) + frame->fp = *(unsigned long *)(fp - 12); + frame->sp = *(unsigned long *)(fp - 8); + frame->pc = *(unsigned long *)(fp - 4); ++#endif + + return 0; + } +diff --git a/arch/arm/mach-at91/pm.c b/arch/arm/mach-at91/pm.c +index 849014c01cf4d..bebaa0b0aef40 100644 +--- a/arch/arm/mach-at91/pm.c ++++ b/arch/arm/mach-at91/pm.c +@@ -456,13 +456,13 @@ static void __init at91_pm_sram_init(void) + sram_pool = gen_pool_get(&pdev->dev, NULL); + if (!sram_pool) { + pr_warn("%s: sram pool unavailable!\n", __func__); +- return; ++ goto out_put_device; + } + + sram_base = gen_pool_alloc(sram_pool, at91_pm_suspend_in_sram_sz); + if (!sram_base) { + pr_warn("%s: unable to alloc sram!\n", __func__); +- return; ++ goto out_put_device; + } + + sram_pbase = gen_pool_virt_to_phys(sram_pool, sram_base); +@@ -470,12 +470,17 @@ static void __init at91_pm_sram_init(void) + at91_pm_suspend_in_sram_sz, false); + if (!at91_suspend_sram_fn) { + pr_warn("SRAM: Could not map\n"); +- return; ++ goto out_put_device; + } + + /* Copy the pm suspend handler to SRAM */ + at91_suspend_sram_fn = fncpy(at91_suspend_sram_fn, + &at91_pm_suspend_in_sram, at91_pm_suspend_in_sram_sz); ++ return; ++ ++out_put_device: ++ put_device(&pdev->dev); ++ return; + } + + static void __init at91_pm_backup_init(void) +diff --git a/arch/arm/mach-socfpga/pm.c b/arch/arm/mach-socfpga/pm.c +index c378ab0c24317..93f2245c97750 100644 +--- a/arch/arm/mach-socfpga/pm.c ++++ b/arch/arm/mach-socfpga/pm.c +@@ -60,14 +60,14 @@ static int socfpga_setup_ocram_self_refresh(void) + if (!ocram_pool) { + pr_warn("%s: ocram pool unavailable!\n", __func__); + ret = -ENODEV; +- goto put_node; ++ goto put_device; + } + + ocram_base = gen_pool_alloc(ocram_pool, socfpga_sdram_self_refresh_sz); + if (!ocram_base) { + pr_warn("%s: unable to alloc ocram!\n", __func__); + ret = -ENOMEM; +- goto put_node; ++ goto put_device; + } + + ocram_pbase = gen_pool_virt_to_phys(ocram_pool, ocram_base); +@@ -78,7 +78,7 @@ static int socfpga_setup_ocram_self_refresh(void) + if (!suspend_ocram_base) { + pr_warn("%s: __arm_ioremap_exec failed!\n", __func__); + ret = -ENOMEM; +- goto put_node; ++ goto put_device; + } + + /* Copy the code that puts DDR in self refresh to ocram */ +@@ -92,6 +92,8 @@ static int socfpga_setup_ocram_self_refresh(void) + if (!socfpga_sdram_self_refresh_in_ocram) + ret = -EFAULT; + ++put_device: ++ put_device(&pdev->dev); + put_node: + of_node_put(np); + +diff --git a/arch/arm64/boot/dts/exynos/exynos7-espresso.dts b/arch/arm64/boot/dts/exynos/exynos7-espresso.dts +index 4a8b1fb51243c..c8824b918693d 100644 +--- a/arch/arm64/boot/dts/exynos/exynos7-espresso.dts ++++ b/arch/arm64/boot/dts/exynos/exynos7-espresso.dts +@@ -155,6 +155,7 @@ + regulator-min-microvolt = <700000>; + regulator-max-microvolt = <1150000>; + regulator-enable-ramp-delay = <125>; ++ regulator-always-on; + }; + + ldo8_reg: LDO8 { +diff --git a/arch/arm64/boot/dts/hisilicon/hi3660-hikey960.dts b/arch/arm64/boot/dts/hisilicon/hi3660-hikey960.dts +index e9f87cb61ade7..8587912e1eb00 100644 +--- a/arch/arm64/boot/dts/hisilicon/hi3660-hikey960.dts ++++ b/arch/arm64/boot/dts/hisilicon/hi3660-hikey960.dts +@@ -210,6 +210,17 @@ + status = "ok"; + compatible = "adi,adv7533"; + reg = <0x39>; ++ adi,dsi-lanes = <4>; ++ ports { ++ #address-cells = <1>; ++ #size-cells = <0>; ++ port@0 { ++ reg = <0>; ++ }; ++ port@1 { ++ reg = <1>; ++ }; ++ }; + }; + }; + +diff --git a/arch/arm64/boot/dts/hisilicon/hi6220-hikey.dts b/arch/arm64/boot/dts/hisilicon/hi6220-hikey.dts +index 6887cc1a743d4..f78e6468b02fc 100644 +--- a/arch/arm64/boot/dts/hisilicon/hi6220-hikey.dts ++++ b/arch/arm64/boot/dts/hisilicon/hi6220-hikey.dts +@@ -513,7 +513,7 @@ + reg = <0x39>; + interrupt-parent = <&gpio1>; + interrupts = <1 2>; +- pd-gpio = <&gpio0 4 0>; ++ pd-gpios = <&gpio0 4 0>; + adi,dsi-lanes = <4>; + #sound-dai-cells = <0>; + +diff --git a/arch/arm64/boot/dts/qcom/msm8916-pins.dtsi b/arch/arm64/boot/dts/qcom/msm8916-pins.dtsi +index 4cb0b58341432..69ba1d79bcd5d 100644 +--- a/arch/arm64/boot/dts/qcom/msm8916-pins.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8916-pins.dtsi +@@ -542,7 +542,7 @@ + pins = "gpio63", "gpio64", "gpio65", "gpio66", + "gpio67", "gpio68"; + drive-strength = <8>; +- bias-pull-none; ++ bias-disable; + }; + }; + cdc_pdm_lines_sus: pdm_lines_off { +@@ -571,7 +571,7 @@ + pins = "gpio113", "gpio114", "gpio115", + "gpio116"; + drive-strength = <8>; +- bias-pull-none; ++ bias-disable; + }; + }; + +@@ -599,7 +599,7 @@ + pinconf { + pins = "gpio110"; + drive-strength = <8>; +- bias-pull-none; ++ bias-disable; + }; + }; + +@@ -625,7 +625,7 @@ + pinconf { + pins = "gpio116"; + drive-strength = <8>; +- bias-pull-none; ++ bias-disable; + }; + }; + ext_mclk_tlmm_lines_sus: mclk_lines_off { +@@ -653,7 +653,7 @@ + pins = "gpio112", "gpio117", "gpio118", + "gpio119"; + drive-strength = <8>; +- bias-pull-none; ++ bias-disable; + }; + }; + ext_sec_tlmm_lines_sus: tlmm_lines_off { +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi +index 1fc5060d7027e..0d5679380b2a6 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi +@@ -138,7 +138,7 @@ + + vcc5v0_host: vcc5v0-host-regulator { + compatible = "regulator-fixed"; +- gpio = <&gpio4 RK_PA3 GPIO_ACTIVE_HIGH>; ++ gpio = <&gpio4 RK_PA3 GPIO_ACTIVE_LOW>; + enable-active-low; + pinctrl-names = "default"; + pinctrl-0 = <&vcc5v0_host_en>; +@@ -193,7 +193,7 @@ + phy-mode = "rgmii"; + pinctrl-names = "default"; + pinctrl-0 = <&rgmii_pins>; +- snps,reset-gpio = <&gpio3 RK_PC0 GPIO_ACTIVE_HIGH>; ++ snps,reset-gpio = <&gpio3 RK_PC0 GPIO_ACTIVE_LOW>; + snps,reset-active-low; + snps,reset-delays-us = <0 10000 50000>; + tx_delay = <0x10>; +diff --git a/arch/m68k/mac/iop.c b/arch/m68k/mac/iop.c +index 4c1e606e7d03b..0b94f6672c5f3 100644 +--- a/arch/m68k/mac/iop.c ++++ b/arch/m68k/mac/iop.c +@@ -183,7 +183,7 @@ static __inline__ void iop_writeb(volatile struct mac_iop *iop, __u16 addr, __u8 + + static __inline__ void iop_stop(volatile struct mac_iop *iop) + { +- iop->status_ctrl &= ~IOP_RUN; ++ iop->status_ctrl = IOP_AUTOINC; + } + + static __inline__ void iop_start(volatile struct mac_iop *iop) +@@ -191,14 +191,9 @@ static __inline__ void iop_start(volatile struct mac_iop *iop) + iop->status_ctrl = IOP_RUN | IOP_AUTOINC; + } + +-static __inline__ void iop_bypass(volatile struct mac_iop *iop) +-{ +- iop->status_ctrl |= IOP_BYPASS; +-} +- + static __inline__ void iop_interrupt(volatile struct mac_iop *iop) + { +- iop->status_ctrl |= IOP_IRQ; ++ iop->status_ctrl = IOP_IRQ | IOP_RUN | IOP_AUTOINC; + } + + static int iop_alive(volatile struct mac_iop *iop) +@@ -244,7 +239,6 @@ void __init iop_preinit(void) + } else { + iop_base[IOP_NUM_SCC] = (struct mac_iop *) SCC_IOP_BASE_QUADRA; + } +- iop_base[IOP_NUM_SCC]->status_ctrl = 0x87; + iop_scc_present = 1; + } else { + iop_base[IOP_NUM_SCC] = NULL; +@@ -256,7 +250,7 @@ void __init iop_preinit(void) + } else { + iop_base[IOP_NUM_ISM] = (struct mac_iop *) ISM_IOP_BASE_QUADRA; + } +- iop_base[IOP_NUM_ISM]->status_ctrl = 0; ++ iop_stop(iop_base[IOP_NUM_ISM]); + iop_ism_present = 1; + } else { + iop_base[IOP_NUM_ISM] = NULL; +@@ -416,7 +410,8 @@ static void iop_handle_send(uint iop_num, uint chan) + msg->status = IOP_MSGSTATUS_UNUSED; + msg = msg->next; + iop_send_queue[iop_num][chan] = msg; +- if (msg) iop_do_send(msg); ++ if (msg && iop_readb(iop, IOP_ADDR_SEND_STATE + chan) == IOP_MSG_IDLE) ++ iop_do_send(msg); + } + + /* +@@ -490,16 +485,12 @@ int iop_send_message(uint iop_num, uint chan, void *privdata, + + if (!(q = iop_send_queue[iop_num][chan])) { + iop_send_queue[iop_num][chan] = msg; ++ iop_do_send(msg); + } else { + while (q->next) q = q->next; + q->next = msg; + } + +- if (iop_readb(iop_base[iop_num], +- IOP_ADDR_SEND_STATE + chan) == IOP_MSG_IDLE) { +- iop_do_send(msg); +- } +- + return 0; + } + +diff --git a/arch/mips/cavium-octeon/octeon-usb.c b/arch/mips/cavium-octeon/octeon-usb.c +index bfdfaf32d2c49..75189ff2f3c78 100644 +--- a/arch/mips/cavium-octeon/octeon-usb.c ++++ b/arch/mips/cavium-octeon/octeon-usb.c +@@ -517,6 +517,7 @@ static int __init dwc3_octeon_device_init(void) + + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); + if (res == NULL) { ++ put_device(&pdev->dev); + dev_err(&pdev->dev, "No memory resources\n"); + return -ENXIO; + } +@@ -528,8 +529,10 @@ static int __init dwc3_octeon_device_init(void) + * know the difference. + */ + base = devm_ioremap_resource(&pdev->dev, res); +- if (IS_ERR(base)) ++ if (IS_ERR(base)) { ++ put_device(&pdev->dev); + return PTR_ERR(base); ++ } + + mutex_lock(&dwc3_octeon_clocks_mutex); + dwc3_octeon_clocks_start(&pdev->dev, (u64)base); +diff --git a/arch/mips/kernel/topology.c b/arch/mips/kernel/topology.c +index cd3e1f82e1a5d..08ad6371fbe08 100644 +--- a/arch/mips/kernel/topology.c ++++ b/arch/mips/kernel/topology.c +@@ -20,7 +20,7 @@ static int __init topology_init(void) + for_each_present_cpu(i) { + struct cpu *c = &per_cpu(cpu_devices, i); + +- c->hotpluggable = 1; ++ c->hotpluggable = !!i; + ret = register_cpu(c, i); + if (ret) + printk(KERN_WARNING "topology_init: register_cpu %d " +diff --git a/arch/parisc/include/asm/barrier.h b/arch/parisc/include/asm/barrier.h +index dbaaca84f27f3..640d46edf32e7 100644 +--- a/arch/parisc/include/asm/barrier.h ++++ b/arch/parisc/include/asm/barrier.h +@@ -26,6 +26,67 @@ + #define __smp_rmb() mb() + #define __smp_wmb() mb() + ++#define __smp_store_release(p, v) \ ++do { \ ++ typeof(p) __p = (p); \ ++ union { typeof(*p) __val; char __c[1]; } __u = \ ++ { .__val = (__force typeof(*p)) (v) }; \ ++ compiletime_assert_atomic_type(*p); \ ++ switch (sizeof(*p)) { \ ++ case 1: \ ++ asm volatile("stb,ma %0,0(%1)" \ ++ : : "r"(*(__u8 *)__u.__c), "r"(__p) \ ++ : "memory"); \ ++ break; \ ++ case 2: \ ++ asm volatile("sth,ma %0,0(%1)" \ ++ : : "r"(*(__u16 *)__u.__c), "r"(__p) \ ++ : "memory"); \ ++ break; \ ++ case 4: \ ++ asm volatile("stw,ma %0,0(%1)" \ ++ : : "r"(*(__u32 *)__u.__c), "r"(__p) \ ++ : "memory"); \ ++ break; \ ++ case 8: \ ++ if (IS_ENABLED(CONFIG_64BIT)) \ ++ asm volatile("std,ma %0,0(%1)" \ ++ : : "r"(*(__u64 *)__u.__c), "r"(__p) \ ++ : "memory"); \ ++ break; \ ++ } \ ++} while (0) ++ ++#define __smp_load_acquire(p) \ ++({ \ ++ union { typeof(*p) __val; char __c[1]; } __u; \ ++ typeof(p) __p = (p); \ ++ compiletime_assert_atomic_type(*p); \ ++ switch (sizeof(*p)) { \ ++ case 1: \ ++ asm volatile("ldb,ma 0(%1),%0" \ ++ : "=r"(*(__u8 *)__u.__c) : "r"(__p) \ ++ : "memory"); \ ++ break; \ ++ case 2: \ ++ asm volatile("ldh,ma 0(%1),%0" \ ++ : "=r"(*(__u16 *)__u.__c) : "r"(__p) \ ++ : "memory"); \ ++ break; \ ++ case 4: \ ++ asm volatile("ldw,ma 0(%1),%0" \ ++ : "=r"(*(__u32 *)__u.__c) : "r"(__p) \ ++ : "memory"); \ ++ break; \ ++ case 8: \ ++ if (IS_ENABLED(CONFIG_64BIT)) \ ++ asm volatile("ldd,ma 0(%1),%0" \ ++ : "=r"(*(__u64 *)__u.__c) : "r"(__p) \ ++ : "memory"); \ ++ break; \ ++ } \ ++ __u.__val; \ ++}) + #include + + #endif /* !__ASSEMBLY__ */ +diff --git a/arch/powerpc/include/asm/percpu.h b/arch/powerpc/include/asm/percpu.h +index dce863a7635cd..8e5b7d0b851c6 100644 +--- a/arch/powerpc/include/asm/percpu.h ++++ b/arch/powerpc/include/asm/percpu.h +@@ -10,8 +10,6 @@ + + #ifdef CONFIG_SMP + +-#include +- + #define __my_cpu_offset local_paca->data_offset + + #endif /* CONFIG_SMP */ +@@ -19,4 +17,6 @@ + + #include + ++#include ++ + #endif /* _ASM_POWERPC_PERCPU_H_ */ +diff --git a/arch/powerpc/kernel/vdso.c b/arch/powerpc/kernel/vdso.c +index 22b01a3962f06..3edaee28b6383 100644 +--- a/arch/powerpc/kernel/vdso.c ++++ b/arch/powerpc/kernel/vdso.c +@@ -704,7 +704,7 @@ int vdso_getcpu_init(void) + node = cpu_to_node(cpu); + WARN_ON_ONCE(node > 0xffff); + +- val = (cpu & 0xfff) | ((node & 0xffff) << 16); ++ val = (cpu & 0xffff) | ((node & 0xffff) << 16); + mtspr(SPRN_SPRG_VDSO_WRITE, val); + get_paca()->sprg_vdso = val; + +diff --git a/arch/powerpc/platforms/pseries/hotplug-memory.c b/arch/powerpc/platforms/pseries/hotplug-memory.c +index a0847be0b0358..1a3cffdaa1e8a 100644 +--- a/arch/powerpc/platforms/pseries/hotplug-memory.c ++++ b/arch/powerpc/platforms/pseries/hotplug-memory.c +@@ -30,7 +30,7 @@ static bool rtas_hp_event; + unsigned long pseries_memory_block_size(void) + { + struct device_node *np; +- unsigned int memblock_size = MIN_MEMORY_BLOCK_SIZE; ++ u64 memblock_size = MIN_MEMORY_BLOCK_SIZE; + struct resource r; + + np = of_find_node_by_path("/ibm,dynamic-reconfiguration-memory"); +diff --git a/arch/sh/boards/mach-landisk/setup.c b/arch/sh/boards/mach-landisk/setup.c +index f1147caebacf0..af69fb7fef7c7 100644 +--- a/arch/sh/boards/mach-landisk/setup.c ++++ b/arch/sh/boards/mach-landisk/setup.c +@@ -85,6 +85,9 @@ device_initcall(landisk_devices_setup); + + static void __init landisk_setup(char **cmdline_p) + { ++ /* I/O port identity mapping */ ++ __set_io_port_base(0); ++ + /* LED ON */ + __raw_writeb(__raw_readb(PA_LED) | 0x03, PA_LED); + +diff --git a/arch/x86/crypto/aes_ctrby8_avx-x86_64.S b/arch/x86/crypto/aes_ctrby8_avx-x86_64.S +index 5f6a5af9c489b..77043a82da510 100644 +--- a/arch/x86/crypto/aes_ctrby8_avx-x86_64.S ++++ b/arch/x86/crypto/aes_ctrby8_avx-x86_64.S +@@ -127,10 +127,6 @@ ddq_add_8: + + /* generate a unique variable for ddq_add_x */ + +-.macro setddq n +- var_ddq_add = ddq_add_\n +-.endm +- + /* generate a unique variable for xmm register */ + .macro setxdata n + var_xdata = %xmm\n +@@ -140,9 +136,7 @@ ddq_add_8: + + .macro club name, id + .altmacro +- .if \name == DDQ_DATA +- setddq %\id +- .elseif \name == XDATA ++ .if \name == XDATA + setxdata %\id + .endif + .noaltmacro +@@ -165,9 +159,8 @@ ddq_add_8: + + .set i, 1 + .rept (by - 1) +- club DDQ_DATA, i + club XDATA, i +- vpaddq var_ddq_add(%rip), xcounter, var_xdata ++ vpaddq (ddq_add_1 + 16 * (i - 1))(%rip), xcounter, var_xdata + vptest ddq_low_msk(%rip), var_xdata + jnz 1f + vpaddq ddq_high_add_1(%rip), var_xdata, var_xdata +@@ -180,8 +173,7 @@ ddq_add_8: + vmovdqa 1*16(p_keys), xkeyA + + vpxor xkey0, xdata0, xdata0 +- club DDQ_DATA, by +- vpaddq var_ddq_add(%rip), xcounter, xcounter ++ vpaddq (ddq_add_1 + 16 * (by - 1))(%rip), xcounter, xcounter + vptest ddq_low_msk(%rip), xcounter + jnz 1f + vpaddq ddq_high_add_1(%rip), xcounter, xcounter +diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c +index b5652233e6745..a1c4a13782da8 100644 +--- a/arch/x86/kernel/apic/io_apic.c ++++ b/arch/x86/kernel/apic/io_apic.c +@@ -2252,8 +2252,13 @@ static int mp_irqdomain_create(int ioapic) + + static void ioapic_destroy_irqdomain(int idx) + { ++ struct ioapic_domain_cfg *cfg = &ioapics[idx].irqdomain_cfg; ++ struct fwnode_handle *fn = ioapics[idx].irqdomain->fwnode; ++ + if (ioapics[idx].irqdomain) { + irq_domain_remove(ioapics[idx].irqdomain); ++ if (!cfg->dev) ++ irq_domain_free_fwnode(fn); + ioapics[idx].irqdomain = NULL; + } + } +diff --git a/arch/x86/kernel/apic/vector.c b/arch/x86/kernel/apic/vector.c +index 36cd34524ac19..637cf4dfccc9a 100644 +--- a/arch/x86/kernel/apic/vector.c ++++ b/arch/x86/kernel/apic/vector.c +@@ -368,6 +368,10 @@ static int x86_vector_alloc_irqs(struct irq_domain *domain, unsigned int virq, + irq_data->chip = &lapic_controller; + irq_data->chip_data = data; + irq_data->hwirq = virq + i; ++ ++ /* Don't invoke affinity setter on deactivated interrupts */ ++ irqd_set_affinity_on_activate(irq_data); ++ + err = assign_irq_vector_policy(virq + i, node, data, info, + irq_data); + if (err) { +diff --git a/arch/x86/kernel/cpu/mcheck/mce-inject.c b/arch/x86/kernel/cpu/mcheck/mce-inject.c +index e57b59762f9f5..94aa91b09c288 100644 +--- a/arch/x86/kernel/cpu/mcheck/mce-inject.c ++++ b/arch/x86/kernel/cpu/mcheck/mce-inject.c +@@ -518,7 +518,7 @@ static void do_inject(void) + */ + if (inj_type == DFR_INT_INJ) { + i_mce.status |= MCI_STATUS_DEFERRED; +- i_mce.status |= (i_mce.status & ~MCI_STATUS_UC); ++ i_mce.status &= ~MCI_STATUS_UC; + } + + /* +diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c +index 734549492a18b..dc4d27000aa35 100644 +--- a/arch/x86/kernel/ptrace.c ++++ b/arch/x86/kernel/ptrace.c +@@ -374,7 +374,7 @@ static unsigned long task_seg_base(struct task_struct *task, + */ + mutex_lock(&task->mm->context.lock); + ldt = task->mm->context.ldt; +- if (unlikely(idx >= ldt->nr_entries)) ++ if (unlikely(!ldt || idx >= ldt->nr_entries)) + base = 0; + else + base = get_desc_base(ldt->entries + idx); +diff --git a/arch/xtensa/kernel/perf_event.c b/arch/xtensa/kernel/perf_event.c +index ff1d81385ed7a..768e1f7ab8715 100644 +--- a/arch/xtensa/kernel/perf_event.c ++++ b/arch/xtensa/kernel/perf_event.c +@@ -404,7 +404,7 @@ static struct pmu xtensa_pmu = { + .read = xtensa_pmu_read, + }; + +-static int xtensa_pmu_setup(int cpu) ++static int xtensa_pmu_setup(unsigned int cpu) + { + unsigned i; + +diff --git a/drivers/acpi/acpica/exprep.c b/drivers/acpi/acpica/exprep.c +index 8de060664204e..e23f3d54bb31c 100644 +--- a/drivers/acpi/acpica/exprep.c ++++ b/drivers/acpi/acpica/exprep.c +@@ -507,10 +507,6 @@ acpi_status acpi_ex_prep_field_value(struct acpi_create_field_info *info) + (u8)access_byte_width; + } + } +- /* An additional reference for the container */ +- +- acpi_ut_add_reference(obj_desc->field.region_obj); +- + ACPI_DEBUG_PRINT((ACPI_DB_BFIELD, + "RegionField: BitOff %X, Off %X, Gran %X, Region %p\n", + obj_desc->field.start_field_bit_offset, +diff --git a/drivers/acpi/acpica/utdelete.c b/drivers/acpi/acpica/utdelete.c +index c6eb9fae70f9a..61a979d0fbc5a 100644 +--- a/drivers/acpi/acpica/utdelete.c ++++ b/drivers/acpi/acpica/utdelete.c +@@ -593,11 +593,6 @@ acpi_ut_update_object_reference(union acpi_operand_object *object, u16 action) + next_object = object->buffer_field.buffer_obj; + break; + +- case ACPI_TYPE_LOCAL_REGION_FIELD: +- +- next_object = object->field.region_obj; +- break; +- + case ACPI_TYPE_LOCAL_BANK_FIELD: + + next_object = object->bank_field.bank_obj; +@@ -638,6 +633,7 @@ acpi_ut_update_object_reference(union acpi_operand_object *object, u16 action) + } + break; + ++ case ACPI_TYPE_LOCAL_REGION_FIELD: + case ACPI_TYPE_REGION: + default: + +diff --git a/drivers/android/binder.c b/drivers/android/binder.c +index 05e75d18b4d93..bd74a29cf86c4 100644 +--- a/drivers/android/binder.c ++++ b/drivers/android/binder.c +@@ -2813,6 +2813,12 @@ static void binder_transaction(struct binder_proc *proc, + goto err_dead_binder; + } + e->to_node = target_node->debug_id; ++ if (WARN_ON(proc == target_proc)) { ++ return_error = BR_FAILED_REPLY; ++ return_error_param = -EINVAL; ++ return_error_line = __LINE__; ++ goto err_invalid_target_handle; ++ } + if (security_binder_transaction(proc->tsk, + target_proc->tsk) < 0) { + return_error = BR_FAILED_REPLY; +@@ -3288,10 +3294,17 @@ static int binder_thread_write(struct binder_proc *proc, + struct binder_node *ctx_mgr_node; + mutex_lock(&context->context_mgr_node_lock); + ctx_mgr_node = context->binder_context_mgr_node; +- if (ctx_mgr_node) ++ if (ctx_mgr_node) { ++ if (ctx_mgr_node->proc == proc) { ++ binder_user_error("%d:%d context manager tried to acquire desc 0\n", ++ proc->pid, thread->pid); ++ mutex_unlock(&context->context_mgr_node_lock); ++ return -EINVAL; ++ } + ret = binder_inc_ref_for_node( + proc, ctx_mgr_node, + strong, NULL, &rdata); ++ } + mutex_unlock(&context->context_mgr_node_lock); + } + if (ret) +diff --git a/drivers/atm/atmtcp.c b/drivers/atm/atmtcp.c +index afebeb1c3e1e9..723bad1201cc5 100644 +--- a/drivers/atm/atmtcp.c ++++ b/drivers/atm/atmtcp.c +@@ -432,9 +432,15 @@ static int atmtcp_remove_persistent(int itf) + return -EMEDIUMTYPE; + } + dev_data = PRIV(dev); +- if (!dev_data->persist) return 0; ++ if (!dev_data->persist) { ++ atm_dev_put(dev); ++ return 0; ++ } + dev_data->persist = 0; +- if (PRIV(dev)->vcc) return 0; ++ if (PRIV(dev)->vcc) { ++ atm_dev_put(dev); ++ return 0; ++ } + kfree(dev_data); + atm_dev_put(dev); + atm_dev_deregister(dev); +diff --git a/drivers/bluetooth/hci_serdev.c b/drivers/bluetooth/hci_serdev.c +index 69c00a3db5382..72cf2d97b682c 100644 +--- a/drivers/bluetooth/hci_serdev.c ++++ b/drivers/bluetooth/hci_serdev.c +@@ -361,7 +361,8 @@ void hci_uart_unregister_device(struct hci_uart *hu) + struct hci_dev *hdev = hu->hdev; + + clear_bit(HCI_UART_PROTO_READY, &hu->flags); +- hci_unregister_dev(hdev); ++ if (test_bit(HCI_UART_REGISTERED, &hu->flags)) ++ hci_unregister_dev(hdev); + hci_free_dev(hdev); + + cancel_work_sync(&hu->write_work); +diff --git a/drivers/char/agp/intel-gtt.c b/drivers/char/agp/intel-gtt.c +index 7516ba981b635..34cc853772bc4 100644 +--- a/drivers/char/agp/intel-gtt.c ++++ b/drivers/char/agp/intel-gtt.c +@@ -304,8 +304,10 @@ static int intel_gtt_setup_scratch_page(void) + if (intel_private.needs_dmar) { + dma_addr = pci_map_page(intel_private.pcidev, page, 0, + PAGE_SIZE, PCI_DMA_BIDIRECTIONAL); +- if (pci_dma_mapping_error(intel_private.pcidev, dma_addr)) ++ if (pci_dma_mapping_error(intel_private.pcidev, dma_addr)) { ++ __free_page(page); + return -EINVAL; ++ } + + intel_private.scratch_page_dma = dma_addr; + } else +diff --git a/drivers/clk/sirf/clk-atlas6.c b/drivers/clk/sirf/clk-atlas6.c +index 665fa681b2e1e..1e6bdf22c3b64 100644 +--- a/drivers/clk/sirf/clk-atlas6.c ++++ b/drivers/clk/sirf/clk-atlas6.c +@@ -136,7 +136,7 @@ static void __init atlas6_clk_init(struct device_node *np) + + for (i = pll1; i < maxclk; i++) { + atlas6_clks[i] = clk_register(NULL, atlas6_clk_hw_array[i]); +- BUG_ON(!atlas6_clks[i]); ++ BUG_ON(IS_ERR(atlas6_clks[i])); + } + clk_register_clkdev(atlas6_clks[cpu], NULL, "cpu"); + clk_register_clkdev(atlas6_clks[io], NULL, "io"); +diff --git a/drivers/crypto/cavium/cpt/cptvf_algs.c b/drivers/crypto/cavium/cpt/cptvf_algs.c +index df21d996db7ed..2d1b28c29a8e5 100644 +--- a/drivers/crypto/cavium/cpt/cptvf_algs.c ++++ b/drivers/crypto/cavium/cpt/cptvf_algs.c +@@ -205,6 +205,7 @@ static inline int cvm_enc_dec(struct ablkcipher_request *req, u32 enc) + int status; + + memset(req_info, 0, sizeof(struct cpt_request_info)); ++ req_info->may_sleep = (req->base.flags & CRYPTO_TFM_REQ_MAY_SLEEP) != 0; + memset(fctx, 0, sizeof(struct fc_context)); + create_input_list(req, enc, enc_iv_len); + create_output_list(req, enc_iv_len); +diff --git a/drivers/crypto/cavium/cpt/cptvf_reqmanager.c b/drivers/crypto/cavium/cpt/cptvf_reqmanager.c +index b0ba4331944b5..43fe69d0981ac 100644 +--- a/drivers/crypto/cavium/cpt/cptvf_reqmanager.c ++++ b/drivers/crypto/cavium/cpt/cptvf_reqmanager.c +@@ -136,7 +136,7 @@ static inline int setup_sgio_list(struct cpt_vf *cptvf, + + /* Setup gather (input) components */ + g_sz_bytes = ((req->incnt + 3) / 4) * sizeof(struct sglist_component); +- info->gather_components = kzalloc(g_sz_bytes, GFP_KERNEL); ++ info->gather_components = kzalloc(g_sz_bytes, req->may_sleep ? GFP_KERNEL : GFP_ATOMIC); + if (!info->gather_components) { + ret = -ENOMEM; + goto scatter_gather_clean; +@@ -153,7 +153,7 @@ static inline int setup_sgio_list(struct cpt_vf *cptvf, + + /* Setup scatter (output) components */ + s_sz_bytes = ((req->outcnt + 3) / 4) * sizeof(struct sglist_component); +- info->scatter_components = kzalloc(s_sz_bytes, GFP_KERNEL); ++ info->scatter_components = kzalloc(s_sz_bytes, req->may_sleep ? GFP_KERNEL : GFP_ATOMIC); + if (!info->scatter_components) { + ret = -ENOMEM; + goto scatter_gather_clean; +@@ -170,7 +170,7 @@ static inline int setup_sgio_list(struct cpt_vf *cptvf, + + /* Create and initialize DPTR */ + info->dlen = g_sz_bytes + s_sz_bytes + SG_LIST_HDR_SIZE; +- info->in_buffer = kzalloc(info->dlen, GFP_KERNEL); ++ info->in_buffer = kzalloc(info->dlen, req->may_sleep ? GFP_KERNEL : GFP_ATOMIC); + if (!info->in_buffer) { + ret = -ENOMEM; + goto scatter_gather_clean; +@@ -198,7 +198,7 @@ static inline int setup_sgio_list(struct cpt_vf *cptvf, + } + + /* Create and initialize RPTR */ +- info->out_buffer = kzalloc(COMPLETION_CODE_SIZE, GFP_KERNEL); ++ info->out_buffer = kzalloc(COMPLETION_CODE_SIZE, req->may_sleep ? GFP_KERNEL : GFP_ATOMIC); + if (!info->out_buffer) { + ret = -ENOMEM; + goto scatter_gather_clean; +@@ -434,7 +434,7 @@ int process_request(struct cpt_vf *cptvf, struct cpt_request_info *req) + struct cpt_vq_command vq_cmd; + union cpt_inst_s cptinst; + +- info = kzalloc(sizeof(*info), GFP_KERNEL); ++ info = kzalloc(sizeof(*info), req->may_sleep ? GFP_KERNEL : GFP_ATOMIC); + if (unlikely(!info)) { + dev_err(&pdev->dev, "Unable to allocate memory for info_buffer\n"); + return -ENOMEM; +@@ -456,7 +456,7 @@ int process_request(struct cpt_vf *cptvf, struct cpt_request_info *req) + * Get buffer for union cpt_res_s response + * structure and its physical address + */ +- info->completion_addr = kzalloc(sizeof(union cpt_res_s), GFP_KERNEL); ++ info->completion_addr = kzalloc(sizeof(union cpt_res_s), req->may_sleep ? GFP_KERNEL : GFP_ATOMIC); + if (unlikely(!info->completion_addr)) { + dev_err(&pdev->dev, "Unable to allocate memory for completion_addr\n"); + ret = -ENOMEM; +diff --git a/drivers/crypto/cavium/cpt/request_manager.h b/drivers/crypto/cavium/cpt/request_manager.h +index 80ee074c6e0cb..09930d95ad24b 100644 +--- a/drivers/crypto/cavium/cpt/request_manager.h ++++ b/drivers/crypto/cavium/cpt/request_manager.h +@@ -65,6 +65,8 @@ struct cpt_request_info { + union ctrl_info ctrl; /* User control information */ + struct cptvf_request req; /* Request Information (Core specific) */ + ++ bool may_sleep; ++ + struct buf_ptr in[MAX_BUF_CNT]; + struct buf_ptr out[MAX_BUF_CNT]; + +diff --git a/drivers/crypto/ccp/ccp-dev.h b/drivers/crypto/ccp/ccp-dev.h +index 7442b0422f8ac..bd43b5c1450c1 100644 +--- a/drivers/crypto/ccp/ccp-dev.h ++++ b/drivers/crypto/ccp/ccp-dev.h +@@ -471,6 +471,7 @@ struct ccp_sg_workarea { + unsigned int sg_used; + + struct scatterlist *dma_sg; ++ struct scatterlist *dma_sg_head; + struct device *dma_dev; + unsigned int dma_count; + enum dma_data_direction dma_dir; +diff --git a/drivers/crypto/ccp/ccp-ops.c b/drivers/crypto/ccp/ccp-ops.c +index 43b74cf0787e1..626b643d610eb 100644 +--- a/drivers/crypto/ccp/ccp-ops.c ++++ b/drivers/crypto/ccp/ccp-ops.c +@@ -67,7 +67,7 @@ static u32 ccp_gen_jobid(struct ccp_device *ccp) + static void ccp_sg_free(struct ccp_sg_workarea *wa) + { + if (wa->dma_count) +- dma_unmap_sg(wa->dma_dev, wa->dma_sg, wa->nents, wa->dma_dir); ++ dma_unmap_sg(wa->dma_dev, wa->dma_sg_head, wa->nents, wa->dma_dir); + + wa->dma_count = 0; + } +@@ -96,6 +96,7 @@ static int ccp_init_sg_workarea(struct ccp_sg_workarea *wa, struct device *dev, + return 0; + + wa->dma_sg = sg; ++ wa->dma_sg_head = sg; + wa->dma_dev = dev; + wa->dma_dir = dma_dir; + wa->dma_count = dma_map_sg(dev, sg, wa->nents, dma_dir); +@@ -108,14 +109,28 @@ static int ccp_init_sg_workarea(struct ccp_sg_workarea *wa, struct device *dev, + static void ccp_update_sg_workarea(struct ccp_sg_workarea *wa, unsigned int len) + { + unsigned int nbytes = min_t(u64, len, wa->bytes_left); ++ unsigned int sg_combined_len = 0; + + if (!wa->sg) + return; + + wa->sg_used += nbytes; + wa->bytes_left -= nbytes; +- if (wa->sg_used == wa->sg->length) { +- wa->sg = sg_next(wa->sg); ++ if (wa->sg_used == sg_dma_len(wa->dma_sg)) { ++ /* Advance to the next DMA scatterlist entry */ ++ wa->dma_sg = sg_next(wa->dma_sg); ++ ++ /* In the case that the DMA mapped scatterlist has entries ++ * that have been merged, the non-DMA mapped scatterlist ++ * must be advanced multiple times for each merged entry. ++ * This ensures that the current non-DMA mapped entry ++ * corresponds to the current DMA mapped entry. ++ */ ++ do { ++ sg_combined_len += wa->sg->length; ++ wa->sg = sg_next(wa->sg); ++ } while (wa->sg_used > sg_combined_len); ++ + wa->sg_used = 0; + } + } +@@ -304,7 +319,7 @@ static unsigned int ccp_queue_buf(struct ccp_data *data, unsigned int from) + /* Update the structures and generate the count */ + buf_count = 0; + while (sg_wa->bytes_left && (buf_count < dm_wa->length)) { +- nbytes = min(sg_wa->sg->length - sg_wa->sg_used, ++ nbytes = min(sg_dma_len(sg_wa->dma_sg) - sg_wa->sg_used, + dm_wa->length - buf_count); + nbytes = min_t(u64, sg_wa->bytes_left, nbytes); + +@@ -336,11 +351,11 @@ static void ccp_prepare_data(struct ccp_data *src, struct ccp_data *dst, + * and destination. The resulting len values will always be <= UINT_MAX + * because the dma length is an unsigned int. + */ +- sg_src_len = sg_dma_len(src->sg_wa.sg) - src->sg_wa.sg_used; ++ sg_src_len = sg_dma_len(src->sg_wa.dma_sg) - src->sg_wa.sg_used; + sg_src_len = min_t(u64, src->sg_wa.bytes_left, sg_src_len); + + if (dst) { +- sg_dst_len = sg_dma_len(dst->sg_wa.sg) - dst->sg_wa.sg_used; ++ sg_dst_len = sg_dma_len(dst->sg_wa.dma_sg) - dst->sg_wa.sg_used; + sg_dst_len = min_t(u64, src->sg_wa.bytes_left, sg_dst_len); + op_len = min(sg_src_len, sg_dst_len); + } else { +@@ -370,7 +385,7 @@ static void ccp_prepare_data(struct ccp_data *src, struct ccp_data *dst, + /* Enough data in the sg element, but we need to + * adjust for any previously copied data + */ +- op->src.u.dma.address = sg_dma_address(src->sg_wa.sg); ++ op->src.u.dma.address = sg_dma_address(src->sg_wa.dma_sg); + op->src.u.dma.offset = src->sg_wa.sg_used; + op->src.u.dma.length = op_len & ~(block_size - 1); + +@@ -391,7 +406,7 @@ static void ccp_prepare_data(struct ccp_data *src, struct ccp_data *dst, + /* Enough room in the sg element, but we need to + * adjust for any previously used area + */ +- op->dst.u.dma.address = sg_dma_address(dst->sg_wa.sg); ++ op->dst.u.dma.address = sg_dma_address(dst->sg_wa.dma_sg); + op->dst.u.dma.offset = dst->sg_wa.sg_used; + op->dst.u.dma.length = op->src.u.dma.length; + } +@@ -2034,7 +2049,7 @@ ccp_run_passthru_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd) + dst.sg_wa.sg_used = 0; + for (i = 1; i <= src.sg_wa.dma_count; i++) { + if (!dst.sg_wa.sg || +- (dst.sg_wa.sg->length < src.sg_wa.sg->length)) { ++ (sg_dma_len(dst.sg_wa.sg) < sg_dma_len(src.sg_wa.sg))) { + ret = -EINVAL; + goto e_dst; + } +@@ -2060,8 +2075,8 @@ ccp_run_passthru_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd) + goto e_dst; + } + +- dst.sg_wa.sg_used += src.sg_wa.sg->length; +- if (dst.sg_wa.sg_used == dst.sg_wa.sg->length) { ++ dst.sg_wa.sg_used += sg_dma_len(src.sg_wa.sg); ++ if (dst.sg_wa.sg_used == sg_dma_len(dst.sg_wa.sg)) { + dst.sg_wa.sg = sg_next(dst.sg_wa.sg); + dst.sg_wa.sg_used = 0; + } +diff --git a/drivers/crypto/qat/qat_common/qat_uclo.c b/drivers/crypto/qat/qat_common/qat_uclo.c +index e2454d90d9498..4f1cd83bf56f9 100644 +--- a/drivers/crypto/qat/qat_common/qat_uclo.c ++++ b/drivers/crypto/qat/qat_common/qat_uclo.c +@@ -332,13 +332,18 @@ static int qat_uclo_create_batch_init_list(struct icp_qat_fw_loader_handle + } + return 0; + out_err: ++ /* Do not free the list head unless we allocated it. */ ++ tail_old = tail_old->next; ++ if (flag) { ++ kfree(*init_tab_base); ++ *init_tab_base = NULL; ++ } ++ + while (tail_old) { + mem_init = tail_old->next; + kfree(tail_old); + tail_old = mem_init; + } +- if (flag) +- kfree(*init_tab_base); + return -ENOMEM; + } + +diff --git a/drivers/edac/edac_device_sysfs.c b/drivers/edac/edac_device_sysfs.c +index 0e7ea3591b781..5e75937537997 100644 +--- a/drivers/edac/edac_device_sysfs.c ++++ b/drivers/edac/edac_device_sysfs.c +@@ -275,6 +275,7 @@ int edac_device_register_sysfs_main_kobj(struct edac_device_ctl_info *edac_dev) + + /* Error exit stack */ + err_kobj_reg: ++ kobject_put(&edac_dev->kobj); + module_put(edac_dev->owner); + + err_out: +diff --git a/drivers/edac/edac_pci_sysfs.c b/drivers/edac/edac_pci_sysfs.c +index 72c9eb9fdffbe..53042af7262e2 100644 +--- a/drivers/edac/edac_pci_sysfs.c ++++ b/drivers/edac/edac_pci_sysfs.c +@@ -386,7 +386,7 @@ static int edac_pci_main_kobj_setup(void) + + /* Error unwind statck */ + kobject_init_and_add_fail: +- kfree(edac_pci_top_main_kobj); ++ kobject_put(edac_pci_top_main_kobj); + + kzalloc_fail: + module_put(THIS_MODULE); +diff --git a/drivers/gpu/drm/arm/malidp_planes.c b/drivers/gpu/drm/arm/malidp_planes.c +index 16b8b310ae5c7..7072d738b072b 100644 +--- a/drivers/gpu/drm/arm/malidp_planes.c ++++ b/drivers/gpu/drm/arm/malidp_planes.c +@@ -369,7 +369,7 @@ int malidp_de_planes_init(struct drm_device *drm) + const struct malidp_hw_regmap *map = &malidp->dev->map; + struct malidp_plane *plane = NULL; + enum drm_plane_type plane_type; +- unsigned long crtcs = 1 << drm->mode_config.num_crtc; ++ unsigned long crtcs = BIT(drm->mode_config.num_crtc); + unsigned long flags = DRM_MODE_ROTATE_0 | DRM_MODE_ROTATE_90 | DRM_MODE_ROTATE_180 | + DRM_MODE_ROTATE_270 | DRM_MODE_REFLECT_X | DRM_MODE_REFLECT_Y; + u32 *formats; +diff --git a/drivers/gpu/drm/bridge/sil-sii8620.c b/drivers/gpu/drm/bridge/sil-sii8620.c +index 0cb69ee94ac16..b93486892f4ae 100644 +--- a/drivers/gpu/drm/bridge/sil-sii8620.c ++++ b/drivers/gpu/drm/bridge/sil-sii8620.c +@@ -167,7 +167,7 @@ static void sii8620_read_buf(struct sii8620 *ctx, u16 addr, u8 *buf, int len) + + static u8 sii8620_readb(struct sii8620 *ctx, u16 addr) + { +- u8 ret; ++ u8 ret = 0; + + sii8620_read_buf(ctx, addr, &ret, 1); + return ret; +diff --git a/drivers/gpu/drm/drm_debugfs.c b/drivers/gpu/drm/drm_debugfs.c +index c1807d5754b2a..454deba13ee5b 100644 +--- a/drivers/gpu/drm/drm_debugfs.c ++++ b/drivers/gpu/drm/drm_debugfs.c +@@ -250,13 +250,13 @@ static ssize_t connector_write(struct file *file, const char __user *ubuf, + + buf[len] = '\0'; + +- if (!strcmp(buf, "on")) ++ if (sysfs_streq(buf, "on")) + connector->force = DRM_FORCE_ON; +- else if (!strcmp(buf, "digital")) ++ else if (sysfs_streq(buf, "digital")) + connector->force = DRM_FORCE_ON_DIGITAL; +- else if (!strcmp(buf, "off")) ++ else if (sysfs_streq(buf, "off")) + connector->force = DRM_FORCE_OFF; +- else if (!strcmp(buf, "unspecified")) ++ else if (sysfs_streq(buf, "unspecified")) + connector->force = DRM_FORCE_UNSPECIFIED; + else + return -EINVAL; +diff --git a/drivers/gpu/drm/drm_mipi_dsi.c b/drivers/gpu/drm/drm_mipi_dsi.c +index 4b47226b90d4b..6f0de951b75d5 100644 +--- a/drivers/gpu/drm/drm_mipi_dsi.c ++++ b/drivers/gpu/drm/drm_mipi_dsi.c +@@ -1029,11 +1029,11 @@ EXPORT_SYMBOL(mipi_dsi_dcs_set_pixel_format); + */ + int mipi_dsi_dcs_set_tear_scanline(struct mipi_dsi_device *dsi, u16 scanline) + { +- u8 payload[3] = { MIPI_DCS_SET_TEAR_SCANLINE, scanline >> 8, +- scanline & 0xff }; ++ u8 payload[2] = { scanline >> 8, scanline & 0xff }; + ssize_t err; + +- err = mipi_dsi_generic_write(dsi, payload, sizeof(payload)); ++ err = mipi_dsi_dcs_write(dsi, MIPI_DCS_SET_TEAR_SCANLINE, payload, ++ sizeof(payload)); + if (err < 0) + return err; + +diff --git a/drivers/gpu/drm/imx/imx-ldb.c b/drivers/gpu/drm/imx/imx-ldb.c +index 4f2e6c7e04c15..d38648a7ef2db 100644 +--- a/drivers/gpu/drm/imx/imx-ldb.c ++++ b/drivers/gpu/drm/imx/imx-ldb.c +@@ -311,18 +311,19 @@ static void imx_ldb_encoder_disable(struct drm_encoder *encoder) + { + struct imx_ldb_channel *imx_ldb_ch = enc_to_imx_ldb_ch(encoder); + struct imx_ldb *ldb = imx_ldb_ch->ldb; ++ int dual = ldb->ldb_ctrl & LDB_SPLIT_MODE_EN; + int mux, ret; + + drm_panel_disable(imx_ldb_ch->panel); + +- if (imx_ldb_ch == &ldb->channel[0]) ++ if (imx_ldb_ch == &ldb->channel[0] || dual) + ldb->ldb_ctrl &= ~LDB_CH0_MODE_EN_MASK; +- else if (imx_ldb_ch == &ldb->channel[1]) ++ if (imx_ldb_ch == &ldb->channel[1] || dual) + ldb->ldb_ctrl &= ~LDB_CH1_MODE_EN_MASK; + + regmap_write(ldb->regmap, IOMUXC_GPR2, ldb->ldb_ctrl); + +- if (ldb->ldb_ctrl & LDB_SPLIT_MODE_EN) { ++ if (dual) { + clk_disable_unprepare(ldb->clk[0]); + clk_disable_unprepare(ldb->clk[1]); + } +diff --git a/drivers/gpu/drm/imx/imx-tve.c b/drivers/gpu/drm/imx/imx-tve.c +index bc27c26994641..c22c3e6e9b7ac 100644 +--- a/drivers/gpu/drm/imx/imx-tve.c ++++ b/drivers/gpu/drm/imx/imx-tve.c +@@ -498,6 +498,13 @@ static int imx_tve_register(struct drm_device *drm, struct imx_tve *tve) + return 0; + } + ++static void imx_tve_disable_regulator(void *data) ++{ ++ struct imx_tve *tve = data; ++ ++ regulator_disable(tve->dac_reg); ++} ++ + static bool imx_tve_readable_reg(struct device *dev, unsigned int reg) + { + return (reg % 4 == 0) && (reg <= 0xdc); +@@ -622,6 +629,9 @@ static int imx_tve_bind(struct device *dev, struct device *master, void *data) + ret = regulator_enable(tve->dac_reg); + if (ret) + return ret; ++ ret = devm_add_action_or_reset(dev, imx_tve_disable_regulator, tve); ++ if (ret) ++ return ret; + } + + tve->clk = devm_clk_get(dev, "tve"); +@@ -668,18 +678,8 @@ static int imx_tve_bind(struct device *dev, struct device *master, void *data) + return 0; + } + +-static void imx_tve_unbind(struct device *dev, struct device *master, +- void *data) +-{ +- struct imx_tve *tve = dev_get_drvdata(dev); +- +- if (!IS_ERR(tve->dac_reg)) +- regulator_disable(tve->dac_reg); +-} +- + static const struct component_ops imx_tve_ops = { + .bind = imx_tve_bind, +- .unbind = imx_tve_unbind, + }; + + static int imx_tve_probe(struct platform_device *pdev) +diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c +index d00524a5d7f08..fb6b1d0f7fef3 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_drm.c ++++ b/drivers/gpu/drm/nouveau/nouveau_drm.c +@@ -840,8 +840,10 @@ nouveau_drm_open(struct drm_device *dev, struct drm_file *fpriv) + + /* need to bring up power immediately if opening device */ + ret = pm_runtime_get_sync(dev->dev); +- if (ret < 0 && ret != -EACCES) ++ if (ret < 0 && ret != -EACCES) { ++ pm_runtime_put_autosuspend(dev->dev); + return ret; ++ } + + get_task_comm(tmpname, current); + snprintf(name, sizeof(name), "%s[%d]", tmpname, pid_nr(fpriv->pid)); +@@ -930,8 +932,10 @@ nouveau_drm_ioctl(struct file *file, unsigned int cmd, unsigned long arg) + long ret; + + ret = pm_runtime_get_sync(dev->dev); +- if (ret < 0 && ret != -EACCES) ++ if (ret < 0 && ret != -EACCES) { ++ pm_runtime_put_autosuspend(dev->dev); + return ret; ++ } + + switch (_IOC_NR(cmd) - DRM_COMMAND_BASE) { + case DRM_NOUVEAU_NVIF: +diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c +index 2b12d82aac150..9ffb09679cc4a 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c ++++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c +@@ -310,7 +310,7 @@ nouveau_fbcon_create(struct drm_fb_helper *helper, + struct nouveau_framebuffer *fb; + struct nouveau_channel *chan; + struct nouveau_bo *nvbo; +- struct drm_mode_fb_cmd2 mode_cmd; ++ struct drm_mode_fb_cmd2 mode_cmd = {}; + int ret; + + mode_cmd.width = sizes->surface_width; +@@ -543,6 +543,7 @@ fini: + drm_fb_helper_fini(&fbcon->helper); + free: + kfree(fbcon); ++ drm->fbcon = NULL; + return ret; + } + +diff --git a/drivers/gpu/drm/nouveau/nouveau_gem.c b/drivers/gpu/drm/nouveau/nouveau_gem.c +index 60ffb70bb9089..c6149b5be073e 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_gem.c ++++ b/drivers/gpu/drm/nouveau/nouveau_gem.c +@@ -42,8 +42,10 @@ nouveau_gem_object_del(struct drm_gem_object *gem) + int ret; + + ret = pm_runtime_get_sync(dev); +- if (WARN_ON(ret < 0 && ret != -EACCES)) ++ if (WARN_ON(ret < 0 && ret != -EACCES)) { ++ pm_runtime_put_autosuspend(dev); + return; ++ } + + if (gem->import_attach) + drm_prime_gem_destroy(gem, nvbo->bo.sg); +diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c +index c1daed3fe8428..6df312ba1826b 100644 +--- a/drivers/gpu/drm/panel/panel-simple.c ++++ b/drivers/gpu/drm/panel/panel-simple.c +@@ -1253,7 +1253,7 @@ static const struct drm_display_mode lg_lb070wv8_mode = { + static const struct panel_desc lg_lb070wv8 = { + .modes = &lg_lb070wv8_mode, + .num_modes = 1, +- .bpc = 16, ++ .bpc = 8, + .size = { + .width = 151, + .height = 91, +diff --git a/drivers/gpu/drm/radeon/ci_dpm.c b/drivers/gpu/drm/radeon/ci_dpm.c +index 6e607cc7b6e5a..81bc2b89222f2 100644 +--- a/drivers/gpu/drm/radeon/ci_dpm.c ++++ b/drivers/gpu/drm/radeon/ci_dpm.c +@@ -4342,7 +4342,7 @@ static int ci_set_mc_special_registers(struct radeon_device *rdev, + table->mc_reg_table_entry[k].mc_data[j] |= 0x100; + } + j++; +- if (j > SMU7_DISCRETE_MC_REGISTER_ARRAY_SIZE) ++ if (j >= SMU7_DISCRETE_MC_REGISTER_ARRAY_SIZE) + return -EINVAL; + + if (!pi->mem_gddr5) { +diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c +index d86110cdf0852..b2334349799d1 100644 +--- a/drivers/gpu/drm/radeon/radeon_display.c ++++ b/drivers/gpu/drm/radeon/radeon_display.c +@@ -627,8 +627,10 @@ radeon_crtc_set_config(struct drm_mode_set *set, + dev = set->crtc->dev; + + ret = pm_runtime_get_sync(dev->dev); +- if (ret < 0) ++ if (ret < 0) { ++ pm_runtime_put_autosuspend(dev->dev); + return ret; ++ } + + ret = drm_crtc_helper_set_config(set, ctx); + +diff --git a/drivers/gpu/drm/radeon/radeon_drv.c b/drivers/gpu/drm/radeon/radeon_drv.c +index f6908e2f9e55a..41e8abd099784 100644 +--- a/drivers/gpu/drm/radeon/radeon_drv.c ++++ b/drivers/gpu/drm/radeon/radeon_drv.c +@@ -496,8 +496,10 @@ long radeon_drm_ioctl(struct file *filp, + long ret; + dev = file_priv->minor->dev; + ret = pm_runtime_get_sync(dev->dev); +- if (ret < 0) ++ if (ret < 0) { ++ pm_runtime_put_autosuspend(dev->dev); + return ret; ++ } + + ret = drm_ioctl(filp, cmd, arg); + +diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c +index dfee8f7d94ae5..2e28cf8118404 100644 +--- a/drivers/gpu/drm/radeon/radeon_kms.c ++++ b/drivers/gpu/drm/radeon/radeon_kms.c +@@ -659,8 +659,10 @@ int radeon_driver_open_kms(struct drm_device *dev, struct drm_file *file_priv) + file_priv->driver_priv = NULL; + + r = pm_runtime_get_sync(dev->dev); +- if (r < 0) ++ if (r < 0) { ++ pm_runtime_put_autosuspend(dev->dev); + return r; ++ } + + /* new gpu have virtual address space support */ + if (rdev->family >= CHIP_CAYMAN) { +diff --git a/drivers/gpu/drm/tilcdc/tilcdc_panel.c b/drivers/gpu/drm/tilcdc/tilcdc_panel.c +index 1813a3623ce60..0484b2cf0e2b5 100644 +--- a/drivers/gpu/drm/tilcdc/tilcdc_panel.c ++++ b/drivers/gpu/drm/tilcdc/tilcdc_panel.c +@@ -152,12 +152,16 @@ static int panel_connector_get_modes(struct drm_connector *connector) + int i; + + for (i = 0; i < timings->num_timings; i++) { +- struct drm_display_mode *mode = drm_mode_create(dev); ++ struct drm_display_mode *mode; + struct videomode vm; + + if (videomode_from_timings(timings, &vm, i)) + break; + ++ mode = drm_mode_create(dev); ++ if (!mode) ++ break; ++ + drm_display_mode_from_videomode(&vm, mode); + + mode->type = DRM_MODE_TYPE_DRIVER; +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c +index 11f1c30ead548..848c9d009be2a 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c +@@ -2707,7 +2707,7 @@ int vmw_kms_fbdev_init_data(struct vmw_private *dev_priv, + ++i; + } + +- if (i != unit) { ++ if (&con->head == &dev_priv->dev->mode_config.connector_list) { + DRM_ERROR("Could not find initial display unit.\n"); + return -EINVAL; + } +@@ -2729,13 +2729,13 @@ int vmw_kms_fbdev_init_data(struct vmw_private *dev_priv, + break; + } + +- if (mode->type & DRM_MODE_TYPE_PREFERRED) +- *p_mode = mode; +- else { ++ if (&mode->head == &con->modes) { + WARN_ONCE(true, "Could not find initial preferred mode.\n"); + *p_mode = list_first_entry(&con->modes, + struct drm_display_mode, + head); ++ } else { ++ *p_mode = mode; + } + + return 0; +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c b/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c +index 3824595fece12..39f4ad0dab8db 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c +@@ -79,7 +79,7 @@ static int vmw_ldu_commit_list(struct vmw_private *dev_priv) + struct vmw_legacy_display_unit *entry; + struct drm_framebuffer *fb = NULL; + struct drm_crtc *crtc = NULL; +- int i = 0; ++ int i; + + /* If there is no display topology the host just assumes + * that the guest will set the same layout as the host. +@@ -90,12 +90,11 @@ static int vmw_ldu_commit_list(struct vmw_private *dev_priv) + crtc = &entry->base.crtc; + w = max(w, crtc->x + crtc->mode.hdisplay); + h = max(h, crtc->y + crtc->mode.vdisplay); +- i++; + } + + if (crtc == NULL) + return 0; +- fb = entry->base.crtc.primary->state->fb; ++ fb = crtc->primary->state->fb; + + return vmw_kms_write_svga(dev_priv, w, h, fb->pitches[0], + fb->format->cpp[0] * 8, +diff --git a/drivers/gpu/host1x/debug.c b/drivers/gpu/host1x/debug.c +index 2aae0e63214c2..0b8c23c399c2a 100644 +--- a/drivers/gpu/host1x/debug.c ++++ b/drivers/gpu/host1x/debug.c +@@ -25,6 +25,8 @@ + #include "debug.h" + #include "channel.h" + ++static DEFINE_MUTEX(debug_lock); ++ + unsigned int host1x_debug_trace_cmdbuf; + + static pid_t host1x_debug_force_timeout_pid; +@@ -49,12 +51,14 @@ static int show_channel(struct host1x_channel *ch, void *data, bool show_fifo) + struct output *o = data; + + mutex_lock(&ch->cdma.lock); ++ mutex_lock(&debug_lock); + + if (show_fifo) + host1x_hw_show_channel_fifo(m, ch, o); + + host1x_hw_show_channel_cdma(m, ch, o); + ++ mutex_unlock(&debug_lock); + mutex_unlock(&ch->cdma.lock); + + return 0; +diff --git a/drivers/gpu/ipu-v3/ipu-image-convert.c b/drivers/gpu/ipu-v3/ipu-image-convert.c +index a5e33d58e02f7..d2f9e65522676 100644 +--- a/drivers/gpu/ipu-v3/ipu-image-convert.c ++++ b/drivers/gpu/ipu-v3/ipu-image-convert.c +@@ -992,9 +992,10 @@ done: + return IRQ_WAKE_THREAD; + } + +-static irqreturn_t norotate_irq(int irq, void *data) ++static irqreturn_t eof_irq(int irq, void *data) + { + struct ipu_image_convert_chan *chan = data; ++ struct ipu_image_convert_priv *priv = chan->priv; + struct ipu_image_convert_ctx *ctx; + struct ipu_image_convert_run *run; + unsigned long flags; +@@ -1011,45 +1012,26 @@ static irqreturn_t norotate_irq(int irq, void *data) + + ctx = run->ctx; + +- if (ipu_rot_mode_is_irt(ctx->rot_mode)) { +- /* this is a rotation operation, just ignore */ +- spin_unlock_irqrestore(&chan->irqlock, flags); +- return IRQ_HANDLED; +- } +- +- ret = do_irq(run); +-out: +- spin_unlock_irqrestore(&chan->irqlock, flags); +- return ret; +-} +- +-static irqreturn_t rotate_irq(int irq, void *data) +-{ +- struct ipu_image_convert_chan *chan = data; +- struct ipu_image_convert_priv *priv = chan->priv; +- struct ipu_image_convert_ctx *ctx; +- struct ipu_image_convert_run *run; +- unsigned long flags; +- irqreturn_t ret; +- +- spin_lock_irqsave(&chan->irqlock, flags); +- +- /* get current run and its context */ +- run = chan->current_run; +- if (!run) { ++ if (irq == chan->out_eof_irq) { ++ if (ipu_rot_mode_is_irt(ctx->rot_mode)) { ++ /* this is a rotation op, just ignore */ ++ ret = IRQ_HANDLED; ++ goto out; ++ } ++ } else if (irq == chan->rot_out_eof_irq) { ++ if (!ipu_rot_mode_is_irt(ctx->rot_mode)) { ++ /* this was NOT a rotation op, shouldn't happen */ ++ dev_err(priv->ipu->dev, ++ "Unexpected rotation interrupt\n"); ++ ret = IRQ_HANDLED; ++ goto out; ++ } ++ } else { ++ dev_err(priv->ipu->dev, "Received unknown irq %d\n", irq); + ret = IRQ_NONE; + goto out; + } + +- ctx = run->ctx; +- +- if (!ipu_rot_mode_is_irt(ctx->rot_mode)) { +- /* this was NOT a rotation operation, shouldn't happen */ +- dev_err(priv->ipu->dev, "Unexpected rotation interrupt\n"); +- spin_unlock_irqrestore(&chan->irqlock, flags); +- return IRQ_HANDLED; +- } +- + ret = do_irq(run); + out: + spin_unlock_irqrestore(&chan->irqlock, flags); +@@ -1142,7 +1124,7 @@ static int get_ipu_resources(struct ipu_image_convert_chan *chan) + chan->out_chan, + IPU_IRQ_EOF); + +- ret = request_threaded_irq(chan->out_eof_irq, norotate_irq, do_bh, ++ ret = request_threaded_irq(chan->out_eof_irq, eof_irq, do_bh, + 0, "ipu-ic", chan); + if (ret < 0) { + dev_err(priv->ipu->dev, "could not acquire irq %d\n", +@@ -1155,7 +1137,7 @@ static int get_ipu_resources(struct ipu_image_convert_chan *chan) + chan->rotation_out_chan, + IPU_IRQ_EOF); + +- ret = request_threaded_irq(chan->rot_out_eof_irq, rotate_irq, do_bh, ++ ret = request_threaded_irq(chan->rot_out_eof_irq, eof_irq, do_bh, + 0, "ipu-ic", chan); + if (ret < 0) { + dev_err(priv->ipu->dev, "could not acquire irq %d\n", +diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c +index 14e4003fde4dd..204ccf6745333 100644 +--- a/drivers/hid/hid-input.c ++++ b/drivers/hid/hid-input.c +@@ -362,13 +362,13 @@ static int hidinput_query_battery_capacity(struct hid_device *dev) + u8 *buf; + int ret; + +- buf = kmalloc(2, GFP_KERNEL); ++ buf = kmalloc(4, GFP_KERNEL); + if (!buf) + return -ENOMEM; + +- ret = hid_hw_raw_request(dev, dev->battery_report_id, buf, 2, ++ ret = hid_hw_raw_request(dev, dev->battery_report_id, buf, 4, + dev->battery_report_type, HID_REQ_GET_REPORT); +- if (ret != 2) { ++ if (ret < 2) { + kfree(buf); + return -ENODATA; + } +diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c +index 43eaf54736f4e..462f7f363faab 100644 +--- a/drivers/hv/channel_mgmt.c ++++ b/drivers/hv/channel_mgmt.c +@@ -1228,6 +1228,8 @@ channel_message_table[CHANNELMSG_COUNT] = { + { CHANNELMSG_19, 0, NULL }, + { CHANNELMSG_20, 0, NULL }, + { CHANNELMSG_TL_CONNECT_REQUEST, 0, NULL }, ++ { CHANNELMSG_22, 0, NULL }, ++ { CHANNELMSG_TL_CONNECT_RESULT, 0, NULL }, + }; + + /* +@@ -1239,23 +1241,14 @@ void vmbus_onmessage(void *context) + { + struct hv_message *msg = context; + struct vmbus_channel_message_header *hdr; +- int size; + + hdr = (struct vmbus_channel_message_header *)msg->u.payload; +- size = msg->header.payload_size; + +- if (hdr->msgtype >= CHANNELMSG_COUNT) { +- pr_err("Received invalid channel message type %d size %d\n", +- hdr->msgtype, size); +- print_hex_dump_bytes("", DUMP_PREFIX_NONE, +- (unsigned char *)msg->u.payload, size); +- return; +- } +- +- if (channel_message_table[hdr->msgtype].message_handler) +- channel_message_table[hdr->msgtype].message_handler(hdr); +- else +- pr_err("Unhandled channel message type %d\n", hdr->msgtype); ++ /* ++ * vmbus_on_msg_dpc() makes sure the hdr->msgtype here can not go ++ * out of bound and the message_handler pointer can not be NULL. ++ */ ++ channel_message_table[hdr->msgtype].message_handler(hdr); + } + + /* +diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c +index 1fd812ed679b4..45b8ccdfb0852 100644 +--- a/drivers/hv/vmbus_drv.c ++++ b/drivers/hv/vmbus_drv.c +@@ -890,6 +890,10 @@ void vmbus_on_msg_dpc(unsigned long data) + } + + entry = &channel_message_table[hdr->msgtype]; ++ ++ if (!entry->message_handler) ++ goto msg_handled; ++ + if (entry->handler_type == VMHT_BLOCKING) { + ctx = kmalloc(sizeof(*ctx), GFP_ATOMIC); + if (ctx == NULL) +diff --git a/drivers/hwtracing/coresight/coresight-tmc-etf.c b/drivers/hwtracing/coresight/coresight-tmc-etf.c +index 0a00f4e941fbb..9bddbfbfbe03b 100644 +--- a/drivers/hwtracing/coresight/coresight-tmc-etf.c ++++ b/drivers/hwtracing/coresight/coresight-tmc-etf.c +@@ -587,15 +587,14 @@ int tmc_read_unprepare_etb(struct tmc_drvdata *drvdata) + + spin_lock_irqsave(&drvdata->spinlock, flags); + +- /* There is no point in reading a TMC in HW FIFO mode */ +- mode = readl_relaxed(drvdata->base + TMC_MODE); +- if (mode != TMC_MODE_CIRCULAR_BUFFER) { +- spin_unlock_irqrestore(&drvdata->spinlock, flags); +- return -EINVAL; +- } +- + /* Re-enable the TMC if need be */ + if (drvdata->mode == CS_MODE_SYSFS) { ++ /* There is no point in reading a TMC in HW FIFO mode */ ++ mode = readl_relaxed(drvdata->base + TMC_MODE); ++ if (mode != TMC_MODE_CIRCULAR_BUFFER) { ++ spin_unlock_irqrestore(&drvdata->spinlock, flags); ++ return -EINVAL; ++ } + /* + * The trace run will continue with the same allocated trace + * buffer. As such zero-out the buffer so that we don't end +diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c +index db9ca8e926ca7..ed0f068109785 100644 +--- a/drivers/i2c/busses/i2c-rcar.c ++++ b/drivers/i2c/busses/i2c-rcar.c +@@ -538,13 +538,14 @@ static bool rcar_i2c_slave_irq(struct rcar_i2c_priv *priv) + rcar_i2c_write(priv, ICSIER, SDR | SSR | SAR); + } + +- rcar_i2c_write(priv, ICSSR, ~SAR & 0xff); ++ /* Clear SSR, too, because of old STOPs to other clients than us */ ++ rcar_i2c_write(priv, ICSSR, ~(SAR | SSR) & 0xff); + } + + /* master sent stop */ + if (ssr_filtered & SSR) { + i2c_slave_event(priv->slave, I2C_SLAVE_STOP, &value); +- rcar_i2c_write(priv, ICSIER, SAR | SSR); ++ rcar_i2c_write(priv, ICSIER, SAR); + rcar_i2c_write(priv, ICSSR, ~SSR & 0xff); + } + +@@ -802,7 +803,7 @@ static int rcar_reg_slave(struct i2c_client *slave) + priv->slave = slave; + rcar_i2c_write(priv, ICSAR, slave->addr); + rcar_i2c_write(priv, ICSSR, 0); +- rcar_i2c_write(priv, ICSIER, SAR | SSR); ++ rcar_i2c_write(priv, ICSIER, SAR); + rcar_i2c_write(priv, ICSCR, SIE | SDBS); + + return 0; +@@ -814,12 +815,14 @@ static int rcar_unreg_slave(struct i2c_client *slave) + + WARN_ON(!priv->slave); + +- /* disable irqs and ensure none is running before clearing ptr */ ++ /* ensure no irq is running before clearing ptr */ ++ disable_irq(priv->irq); + rcar_i2c_write(priv, ICSIER, 0); +- rcar_i2c_write(priv, ICSCR, 0); ++ rcar_i2c_write(priv, ICSSR, 0); ++ enable_irq(priv->irq); ++ rcar_i2c_write(priv, ICSCR, SDBS); + rcar_i2c_write(priv, ICSAR, 0); /* Gen2: must be 0 if not using slave */ + +- synchronize_irq(priv->irq); + priv->slave = NULL; + + pm_runtime_put(rcar_i2c_priv_to_dev(priv)); +diff --git a/drivers/i2c/i2c-core-slave.c b/drivers/i2c/i2c-core-slave.c +index 4a78c65e99713..d89bc31e06227 100644 +--- a/drivers/i2c/i2c-core-slave.c ++++ b/drivers/i2c/i2c-core-slave.c +@@ -22,10 +22,8 @@ int i2c_slave_register(struct i2c_client *client, i2c_slave_cb_t slave_cb) + { + int ret; + +- if (!client || !slave_cb) { +- WARN(1, "insufficient data\n"); ++ if (WARN(IS_ERR_OR_NULL(client) || !slave_cb, "insufficient data\n")) + return -EINVAL; +- } + + if (!(client->flags & I2C_CLIENT_SLAVE)) + dev_warn(&client->dev, "%s: client slave flag not set. You might see address collisions\n", +@@ -64,6 +62,9 @@ int i2c_slave_unregister(struct i2c_client *client) + { + int ret; + ++ if (IS_ERR_OR_NULL(client)) ++ return -EINVAL; ++ + if (!client->adapter->algo->unreg_slave) { + dev_err(&client->dev, "%s: not supported by adapter\n", __func__); + return -EOPNOTSUPP; +diff --git a/drivers/iio/dac/ad5592r-base.c b/drivers/iio/dac/ad5592r-base.c +index 69bde59098542..5c998ac8c840b 100644 +--- a/drivers/iio/dac/ad5592r-base.c ++++ b/drivers/iio/dac/ad5592r-base.c +@@ -417,7 +417,7 @@ static int ad5592r_read_raw(struct iio_dev *iio_dev, + s64 tmp = *val * (3767897513LL / 25LL); + *val = div_s64_rem(tmp, 1000000000LL, val2); + +- ret = IIO_VAL_INT_PLUS_MICRO; ++ return IIO_VAL_INT_PLUS_MICRO; + } else { + int mult; + +@@ -448,7 +448,7 @@ static int ad5592r_read_raw(struct iio_dev *iio_dev, + ret = IIO_VAL_INT; + break; + default: +- ret = -EINVAL; ++ return -EINVAL; + } + + unlock: +diff --git a/drivers/infiniband/ulp/ipoib/ipoib.h b/drivers/infiniband/ulp/ipoib/ipoib.h +index 4a5c7a07a6315..268e23ba4a636 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib.h ++++ b/drivers/infiniband/ulp/ipoib/ipoib.h +@@ -509,7 +509,7 @@ void ipoib_ib_dev_cleanup(struct net_device *dev); + + int ipoib_ib_dev_open_default(struct net_device *dev); + int ipoib_ib_dev_open(struct net_device *dev); +-int ipoib_ib_dev_stop(struct net_device *dev); ++void ipoib_ib_dev_stop(struct net_device *dev); + void ipoib_ib_dev_up(struct net_device *dev); + void ipoib_ib_dev_down(struct net_device *dev); + int ipoib_ib_dev_stop_default(struct net_device *dev); +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c +index d77e8e2ae05f2..8e1f48fe6f2e7 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c +@@ -809,7 +809,7 @@ timeout: + return 0; + } + +-int ipoib_ib_dev_stop(struct net_device *dev) ++void ipoib_ib_dev_stop(struct net_device *dev) + { + struct ipoib_dev_priv *priv = ipoib_priv(dev); + +@@ -817,8 +817,6 @@ int ipoib_ib_dev_stop(struct net_device *dev) + + clear_bit(IPOIB_FLAG_INITIALIZED, &priv->flags); + ipoib_flush_ah(dev); +- +- return 0; + } + + void ipoib_ib_tx_timer_func(unsigned long ctx) +diff --git a/drivers/input/mouse/sentelic.c b/drivers/input/mouse/sentelic.c +index 11c32ac8234b2..779d0b9341c0d 100644 +--- a/drivers/input/mouse/sentelic.c ++++ b/drivers/input/mouse/sentelic.c +@@ -454,7 +454,7 @@ static ssize_t fsp_attr_set_setreg(struct psmouse *psmouse, void *data, + + fsp_reg_write_enable(psmouse, false); + +- return count; ++ return retval; + } + + PSMOUSE_DEFINE_WO_ATTR(setreg, S_IWUSR, NULL, fsp_attr_set_setreg); +diff --git a/drivers/iommu/intel_irq_remapping.c b/drivers/iommu/intel_irq_remapping.c +index 154949a499c21..7cc5b04e30b7a 100644 +--- a/drivers/iommu/intel_irq_remapping.c ++++ b/drivers/iommu/intel_irq_remapping.c +@@ -601,13 +601,21 @@ out_free_table: + + static void intel_teardown_irq_remapping(struct intel_iommu *iommu) + { ++ struct fwnode_handle *fn; ++ + if (iommu && iommu->ir_table) { + if (iommu->ir_msi_domain) { ++ fn = iommu->ir_msi_domain->fwnode; ++ + irq_domain_remove(iommu->ir_msi_domain); ++ irq_domain_free_fwnode(fn); + iommu->ir_msi_domain = NULL; + } + if (iommu->ir_domain) { ++ fn = iommu->ir_domain->fwnode; ++ + irq_domain_remove(iommu->ir_domain); ++ irq_domain_free_fwnode(fn); + iommu->ir_domain = NULL; + } + free_pages((unsigned long)iommu->ir_table->base, +diff --git a/drivers/iommu/omap-iommu-debug.c b/drivers/iommu/omap-iommu-debug.c +index 505548aafeff2..cec33e90e3998 100644 +--- a/drivers/iommu/omap-iommu-debug.c ++++ b/drivers/iommu/omap-iommu-debug.c +@@ -101,8 +101,11 @@ static ssize_t debug_read_regs(struct file *file, char __user *userbuf, + mutex_lock(&iommu_debug_lock); + + bytes = omap_iommu_dump_ctx(obj, p, count); ++ if (bytes < 0) ++ goto err; + bytes = simple_read_from_buffer(userbuf, count, ppos, buf, bytes); + ++err: + mutex_unlock(&iommu_debug_lock); + kfree(buf); + +diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c +index 84b23d902d5b8..1d2267c6d31aa 100644 +--- a/drivers/irqchip/irq-gic-v3-its.c ++++ b/drivers/irqchip/irq-gic-v3-its.c +@@ -2199,6 +2199,7 @@ static int its_irq_domain_alloc(struct irq_domain *domain, unsigned int virq, + { + msi_alloc_info_t *info = args; + struct its_device *its_dev = info->scratchpad[0].ptr; ++ struct irq_data *irqd; + irq_hw_number_t hwirq; + int err; + int i; +@@ -2214,7 +2215,9 @@ static int its_irq_domain_alloc(struct irq_domain *domain, unsigned int virq, + + irq_domain_set_hwirq_and_chip(domain, virq + i, + hwirq + i, &its_irq_chip, its_dev); +- irqd_set_single_target(irq_desc_get_irq_data(irq_to_desc(virq + i))); ++ irqd = irq_get_irq_data(virq + i); ++ irqd_set_single_target(irqd); ++ irqd_set_affinity_on_activate(irqd); + pr_debug("ID:%d pID:%d vID:%d\n", + (int)(hwirq + i - its_dev->event_map.lpi_base), + (int)(hwirq + i), virq + i); +diff --git a/drivers/irqchip/irq-mtk-sysirq.c b/drivers/irqchip/irq-mtk-sysirq.c +index 90aaf190157f7..42455f31b0611 100644 +--- a/drivers/irqchip/irq-mtk-sysirq.c ++++ b/drivers/irqchip/irq-mtk-sysirq.c +@@ -23,7 +23,7 @@ + #include + + struct mtk_sysirq_chip_data { +- spinlock_t lock; ++ raw_spinlock_t lock; + u32 nr_intpol_bases; + void __iomem **intpol_bases; + u32 *intpol_words; +@@ -45,7 +45,7 @@ static int mtk_sysirq_set_type(struct irq_data *data, unsigned int type) + reg_index = chip_data->which_word[hwirq]; + offset = hwirq & 0x1f; + +- spin_lock_irqsave(&chip_data->lock, flags); ++ raw_spin_lock_irqsave(&chip_data->lock, flags); + value = readl_relaxed(base + reg_index * 4); + if (type == IRQ_TYPE_LEVEL_LOW || type == IRQ_TYPE_EDGE_FALLING) { + if (type == IRQ_TYPE_LEVEL_LOW) +@@ -61,7 +61,7 @@ static int mtk_sysirq_set_type(struct irq_data *data, unsigned int type) + + data = data->parent_data; + ret = data->chip->irq_set_type(data, type); +- spin_unlock_irqrestore(&chip_data->lock, flags); ++ raw_spin_unlock_irqrestore(&chip_data->lock, flags); + return ret; + } + +@@ -220,7 +220,7 @@ static int __init mtk_sysirq_of_init(struct device_node *node, + ret = -ENOMEM; + goto out_free_which_word; + } +- spin_lock_init(&chip_data->lock); ++ raw_spin_lock_init(&chip_data->lock); + + return 0; + +diff --git a/drivers/leds/led-class.c b/drivers/leds/led-class.c +index b0e2d55acbd6f..6c7269fcfa77c 100644 +--- a/drivers/leds/led-class.c ++++ b/drivers/leds/led-class.c +@@ -173,6 +173,7 @@ void led_classdev_suspend(struct led_classdev *led_cdev) + { + led_cdev->flags |= LED_SUSPENDED; + led_set_brightness_nopm(led_cdev, 0); ++ flush_work(&led_cdev->set_brightness_work); + } + EXPORT_SYMBOL_GPL(led_classdev_suspend); + +diff --git a/drivers/leds/leds-88pm860x.c b/drivers/leds/leds-88pm860x.c +index 77a104d2b1243..13f414ff6fd00 100644 +--- a/drivers/leds/leds-88pm860x.c ++++ b/drivers/leds/leds-88pm860x.c +@@ -207,21 +207,33 @@ static int pm860x_led_probe(struct platform_device *pdev) + data->cdev.brightness_set_blocking = pm860x_led_set; + mutex_init(&data->lock); + +- ret = devm_led_classdev_register(chip->dev, &data->cdev); ++ ret = led_classdev_register(chip->dev, &data->cdev); + if (ret < 0) { + dev_err(&pdev->dev, "Failed to register LED: %d\n", ret); + return ret; + } + pm860x_led_set(&data->cdev, 0); ++ ++ platform_set_drvdata(pdev, data); ++ + return 0; + } + ++static int pm860x_led_remove(struct platform_device *pdev) ++{ ++ struct pm860x_led *data = platform_get_drvdata(pdev); ++ ++ led_classdev_unregister(&data->cdev); ++ ++ return 0; ++} + + static struct platform_driver pm860x_led_driver = { + .driver = { + .name = "88pm860x-led", + }, + .probe = pm860x_led_probe, ++ .remove = pm860x_led_remove, + }; + + module_platform_driver(pm860x_led_driver); +diff --git a/drivers/leds/leds-da903x.c b/drivers/leds/leds-da903x.c +index 5ff7d72f73aa4..ecc265bb69a02 100644 +--- a/drivers/leds/leds-da903x.c ++++ b/drivers/leds/leds-da903x.c +@@ -113,12 +113,23 @@ static int da903x_led_probe(struct platform_device *pdev) + led->flags = pdata->flags; + led->master = pdev->dev.parent; + +- ret = devm_led_classdev_register(led->master, &led->cdev); ++ ret = led_classdev_register(led->master, &led->cdev); + if (ret) { + dev_err(&pdev->dev, "failed to register LED %d\n", id); + return ret; + } + ++ platform_set_drvdata(pdev, led); ++ ++ return 0; ++} ++ ++static int da903x_led_remove(struct platform_device *pdev) ++{ ++ struct da903x_led *led = platform_get_drvdata(pdev); ++ ++ led_classdev_unregister(&led->cdev); ++ + return 0; + } + +@@ -127,6 +138,7 @@ static struct platform_driver da903x_led_driver = { + .name = "da903x-led", + }, + .probe = da903x_led_probe, ++ .remove = da903x_led_remove, + }; + + module_platform_driver(da903x_led_driver); +diff --git a/drivers/leds/leds-lm3533.c b/drivers/leds/leds-lm3533.c +index 72224b599ffce..c1e562a4d6adf 100644 +--- a/drivers/leds/leds-lm3533.c ++++ b/drivers/leds/leds-lm3533.c +@@ -698,7 +698,7 @@ static int lm3533_led_probe(struct platform_device *pdev) + + platform_set_drvdata(pdev, led); + +- ret = devm_led_classdev_register(pdev->dev.parent, &led->cdev); ++ ret = led_classdev_register(pdev->dev.parent, &led->cdev); + if (ret) { + dev_err(&pdev->dev, "failed to register LED %d\n", pdev->id); + return ret; +@@ -708,13 +708,18 @@ static int lm3533_led_probe(struct platform_device *pdev) + + ret = lm3533_led_setup(led, pdata); + if (ret) +- return ret; ++ goto err_deregister; + + ret = lm3533_ctrlbank_enable(&led->cb); + if (ret) +- return ret; ++ goto err_deregister; + + return 0; ++ ++err_deregister: ++ led_classdev_unregister(&led->cdev); ++ ++ return ret; + } + + static int lm3533_led_remove(struct platform_device *pdev) +@@ -724,6 +729,7 @@ static int lm3533_led_remove(struct platform_device *pdev) + dev_dbg(&pdev->dev, "%s\n", __func__); + + lm3533_ctrlbank_disable(&led->cb); ++ led_classdev_unregister(&led->cdev); + + return 0; + } +diff --git a/drivers/leds/leds-lm355x.c b/drivers/leds/leds-lm355x.c +index 6cb94f9a2f3f3..b9c60dd2b1327 100644 +--- a/drivers/leds/leds-lm355x.c ++++ b/drivers/leds/leds-lm355x.c +@@ -168,18 +168,19 @@ static int lm355x_chip_init(struct lm355x_chip_data *chip) + /* input and output pins configuration */ + switch (chip->type) { + case CHIP_LM3554: +- reg_val = pdata->pin_tx2 | pdata->ntc_pin; ++ reg_val = (u32)pdata->pin_tx2 | (u32)pdata->ntc_pin; + ret = regmap_update_bits(chip->regmap, 0xE0, 0x28, reg_val); + if (ret < 0) + goto out; +- reg_val = pdata->pass_mode; ++ reg_val = (u32)pdata->pass_mode; + ret = regmap_update_bits(chip->regmap, 0xA0, 0x04, reg_val); + if (ret < 0) + goto out; + break; + + case CHIP_LM3556: +- reg_val = pdata->pin_tx2 | pdata->ntc_pin | pdata->pass_mode; ++ reg_val = (u32)pdata->pin_tx2 | (u32)pdata->ntc_pin | ++ (u32)pdata->pass_mode; + ret = regmap_update_bits(chip->regmap, 0x0A, 0xC4, reg_val); + if (ret < 0) + goto out; +diff --git a/drivers/leds/leds-wm831x-status.c b/drivers/leds/leds-wm831x-status.c +index be93b20e792a7..4f0ba19c35773 100644 +--- a/drivers/leds/leds-wm831x-status.c ++++ b/drivers/leds/leds-wm831x-status.c +@@ -283,12 +283,23 @@ static int wm831x_status_probe(struct platform_device *pdev) + drvdata->cdev.blink_set = wm831x_status_blink_set; + drvdata->cdev.groups = wm831x_status_groups; + +- ret = devm_led_classdev_register(wm831x->dev, &drvdata->cdev); ++ ret = led_classdev_register(wm831x->dev, &drvdata->cdev); + if (ret < 0) { + dev_err(&pdev->dev, "Failed to register LED: %d\n", ret); + return ret; + } + ++ platform_set_drvdata(pdev, drvdata); ++ ++ return 0; ++} ++ ++static int wm831x_status_remove(struct platform_device *pdev) ++{ ++ struct wm831x_status *drvdata = platform_get_drvdata(pdev); ++ ++ led_classdev_unregister(&drvdata->cdev); ++ + return 0; + } + +@@ -297,6 +308,7 @@ static struct platform_driver wm831x_status_driver = { + .name = "wm831x-status", + }, + .probe = wm831x_status_probe, ++ .remove = wm831x_status_remove, + }; + + module_platform_driver(wm831x_status_driver); +diff --git a/drivers/md/bcache/bset.c b/drivers/md/bcache/bset.c +index 1edf9515345ed..03fb06c61e1ca 100644 +--- a/drivers/md/bcache/bset.c ++++ b/drivers/md/bcache/bset.c +@@ -319,7 +319,7 @@ int bch_btree_keys_alloc(struct btree_keys *b, unsigned page_order, gfp_t gfp) + + b->page_order = page_order; + +- t->data = (void *) __get_free_pages(gfp, b->page_order); ++ t->data = (void *) __get_free_pages(__GFP_COMP|gfp, b->page_order); + if (!t->data) + goto err; + +diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c +index 66c764491a830..9fca837d0b41e 100644 +--- a/drivers/md/bcache/btree.c ++++ b/drivers/md/bcache/btree.c +@@ -794,7 +794,7 @@ int bch_btree_cache_alloc(struct cache_set *c) + mutex_init(&c->verify_lock); + + c->verify_ondisk = (void *) +- __get_free_pages(GFP_KERNEL, ilog2(bucket_pages(c))); ++ __get_free_pages(GFP_KERNEL|__GFP_COMP, ilog2(bucket_pages(c))); + + c->verify_data = mca_bucket_alloc(c, &ZERO_KEY, GFP_KERNEL); + +diff --git a/drivers/md/bcache/journal.c b/drivers/md/bcache/journal.c +index 6394be5ee9a8f..6aafda26903c8 100644 +--- a/drivers/md/bcache/journal.c ++++ b/drivers/md/bcache/journal.c +@@ -838,8 +838,8 @@ int bch_journal_alloc(struct cache_set *c) + j->w[1].c = c; + + if (!(init_fifo(&j->pin, JOURNAL_PIN, GFP_KERNEL)) || +- !(j->w[0].data = (void *) __get_free_pages(GFP_KERNEL, JSET_BITS)) || +- !(j->w[1].data = (void *) __get_free_pages(GFP_KERNEL, JSET_BITS))) ++ !(j->w[0].data = (void *) __get_free_pages(GFP_KERNEL|__GFP_COMP, JSET_BITS)) || ++ !(j->w[1].data = (void *) __get_free_pages(GFP_KERNEL|__GFP_COMP, JSET_BITS))) + return -ENOMEM; + + return 0; +diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c +index 690aeb09bbf55..7fcc1ba12bc01 100644 +--- a/drivers/md/bcache/super.c ++++ b/drivers/md/bcache/super.c +@@ -1468,7 +1468,7 @@ void bch_cache_set_unregister(struct cache_set *c) + } + + #define alloc_bucket_pages(gfp, c) \ +- ((void *) __get_free_pages(__GFP_ZERO|gfp, ilog2(bucket_pages(c)))) ++ ((void *) __get_free_pages(__GFP_ZERO|__GFP_COMP|gfp, ilog2(bucket_pages(c)))) + + struct cache_set *bch_cache_set_alloc(struct cache_sb *sb) + { +@@ -1780,7 +1780,14 @@ found: + sysfs_create_link(&c->kobj, &ca->kobj, buf)) + goto err; + +- if (ca->sb.seq > c->sb.seq) { ++ /* ++ * A special case is both ca->sb.seq and c->sb.seq are 0, ++ * such condition happens on a new created cache device whose ++ * super block is never flushed yet. In this case c->sb.version ++ * and other members should be updated too, otherwise we will ++ * have a mistaken super block version in cache set. ++ */ ++ if (ca->sb.seq > c->sb.seq || c->sb.seq == 0) { + c->sb.version = ca->sb.version; + memcpy(c->sb.set_uuid, ca->sb.set_uuid, 16); + c->sb.flags = ca->sb.flags; +diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c +index 69cdb29ef6be9..280873b13e744 100644 +--- a/drivers/md/dm-cache-target.c ++++ b/drivers/md/dm-cache-target.c +@@ -410,7 +410,6 @@ struct cache { + spinlock_t lock; + struct list_head deferred_cells; + struct bio_list deferred_bios; +- struct bio_list deferred_writethrough_bios; + sector_t migration_threshold; + wait_queue_head_t migration_wait; + atomic_t nr_allocated_migrations; +@@ -446,10 +445,10 @@ struct cache { + struct dm_kcopyd_client *copier; + struct workqueue_struct *wq; + struct work_struct deferred_bio_worker; +- struct work_struct deferred_writethrough_worker; + struct work_struct migration_worker; + struct delayed_work waker; + struct dm_bio_prison_v2 *prison; ++ struct bio_set *bs; + + mempool_t *migration_pool; + +@@ -490,15 +489,6 @@ struct per_bio_data { + struct dm_bio_prison_cell_v2 *cell; + struct dm_hook_info hook_info; + sector_t len; +- +- /* +- * writethrough fields. These MUST remain at the end of this +- * structure and the 'cache' member must be the first as it +- * is used to determine the offset of the writethrough fields. +- */ +- struct cache *cache; +- dm_cblock_t cblock; +- struct dm_bio_details bio_details; + }; + + struct dm_cache_migration { +@@ -515,19 +505,19 @@ struct dm_cache_migration { + + /*----------------------------------------------------------------*/ + +-static bool writethrough_mode(struct cache_features *f) ++static bool writethrough_mode(struct cache *cache) + { +- return f->io_mode == CM_IO_WRITETHROUGH; ++ return cache->features.io_mode == CM_IO_WRITETHROUGH; + } + +-static bool writeback_mode(struct cache_features *f) ++static bool writeback_mode(struct cache *cache) + { +- return f->io_mode == CM_IO_WRITEBACK; ++ return cache->features.io_mode == CM_IO_WRITEBACK; + } + +-static inline bool passthrough_mode(struct cache_features *f) ++static inline bool passthrough_mode(struct cache *cache) + { +- return unlikely(f->io_mode == CM_IO_PASSTHROUGH); ++ return unlikely(cache->features.io_mode == CM_IO_PASSTHROUGH); + } + + /*----------------------------------------------------------------*/ +@@ -537,14 +527,9 @@ static void wake_deferred_bio_worker(struct cache *cache) + queue_work(cache->wq, &cache->deferred_bio_worker); + } + +-static void wake_deferred_writethrough_worker(struct cache *cache) +-{ +- queue_work(cache->wq, &cache->deferred_writethrough_worker); +-} +- + static void wake_migration_worker(struct cache *cache) + { +- if (passthrough_mode(&cache->features)) ++ if (passthrough_mode(cache)) + return; + + queue_work(cache->wq, &cache->migration_worker); +@@ -618,15 +603,9 @@ static unsigned lock_level(struct bio *bio) + * Per bio data + *--------------------------------------------------------------*/ + +-/* +- * If using writeback, leave out struct per_bio_data's writethrough fields. +- */ +-#define PB_DATA_SIZE_WB (offsetof(struct per_bio_data, cache)) +-#define PB_DATA_SIZE_WT (sizeof(struct per_bio_data)) +- + static size_t get_per_bio_data_size(struct cache *cache) + { +- return writethrough_mode(&cache->features) ? PB_DATA_SIZE_WT : PB_DATA_SIZE_WB; ++ return sizeof(struct per_bio_data); + } + + static struct per_bio_data *get_per_bio_data(struct bio *bio, size_t data_size) +@@ -868,16 +847,23 @@ static void check_if_tick_bio_needed(struct cache *cache, struct bio *bio) + spin_unlock_irqrestore(&cache->lock, flags); + } + +-static void remap_to_origin_clear_discard(struct cache *cache, struct bio *bio, +- dm_oblock_t oblock) ++static void __remap_to_origin_clear_discard(struct cache *cache, struct bio *bio, ++ dm_oblock_t oblock, bool bio_has_pbd) + { +- // FIXME: this is called way too much. +- check_if_tick_bio_needed(cache, bio); ++ if (bio_has_pbd) ++ check_if_tick_bio_needed(cache, bio); + remap_to_origin(cache, bio); + if (bio_data_dir(bio) == WRITE) + clear_discard(cache, oblock_to_dblock(cache, oblock)); + } + ++static void remap_to_origin_clear_discard(struct cache *cache, struct bio *bio, ++ dm_oblock_t oblock) ++{ ++ // FIXME: check_if_tick_bio_needed() is called way too much through this interface ++ __remap_to_origin_clear_discard(cache, bio, oblock, true); ++} ++ + static void remap_to_cache_dirty(struct cache *cache, struct bio *bio, + dm_oblock_t oblock, dm_cblock_t cblock) + { +@@ -937,57 +923,26 @@ static void issue_op(struct bio *bio, void *context) + accounted_request(cache, bio); + } + +-static void defer_writethrough_bio(struct cache *cache, struct bio *bio) +-{ +- unsigned long flags; +- +- spin_lock_irqsave(&cache->lock, flags); +- bio_list_add(&cache->deferred_writethrough_bios, bio); +- spin_unlock_irqrestore(&cache->lock, flags); +- +- wake_deferred_writethrough_worker(cache); +-} +- +-static void writethrough_endio(struct bio *bio) +-{ +- struct per_bio_data *pb = get_per_bio_data(bio, PB_DATA_SIZE_WT); +- +- dm_unhook_bio(&pb->hook_info, bio); +- +- if (bio->bi_status) { +- bio_endio(bio); +- return; +- } +- +- dm_bio_restore(&pb->bio_details, bio); +- remap_to_cache(pb->cache, bio, pb->cblock); +- +- /* +- * We can't issue this bio directly, since we're in interrupt +- * context. So it gets put on a bio list for processing by the +- * worker thread. +- */ +- defer_writethrough_bio(pb->cache, bio); +-} +- + /* +- * FIXME: send in parallel, huge latency as is. + * When running in writethrough mode we need to send writes to clean blocks +- * to both the cache and origin devices. In future we'd like to clone the +- * bio and send them in parallel, but for now we're doing them in +- * series as this is easier. ++ * to both the cache and origin devices. Clone the bio and send them in parallel. + */ +-static void remap_to_origin_then_cache(struct cache *cache, struct bio *bio, +- dm_oblock_t oblock, dm_cblock_t cblock) ++static void remap_to_origin_and_cache(struct cache *cache, struct bio *bio, ++ dm_oblock_t oblock, dm_cblock_t cblock) + { +- struct per_bio_data *pb = get_per_bio_data(bio, PB_DATA_SIZE_WT); ++ struct bio *origin_bio = bio_clone_fast(bio, GFP_NOIO, cache->bs); + +- pb->cache = cache; +- pb->cblock = cblock; +- dm_hook_bio(&pb->hook_info, bio, writethrough_endio, NULL); +- dm_bio_record(&pb->bio_details, bio); ++ BUG_ON(!origin_bio); + +- remap_to_origin_clear_discard(pb->cache, bio, oblock); ++ bio_chain(origin_bio, bio); ++ /* ++ * Passing false to __remap_to_origin_clear_discard() skips ++ * all code that might use per_bio_data (since clone doesn't have it) ++ */ ++ __remap_to_origin_clear_discard(cache, origin_bio, oblock, false); ++ submit_bio(origin_bio); ++ ++ remap_to_cache(cache, bio, cblock); + } + + /*---------------------------------------------------------------- +@@ -1209,7 +1164,7 @@ static bool bio_writes_complete_block(struct cache *cache, struct bio *bio) + + static bool optimisable_bio(struct cache *cache, struct bio *bio, dm_oblock_t block) + { +- return writeback_mode(&cache->features) && ++ return writeback_mode(cache) && + (is_discarded_oblock(cache, block) || bio_writes_complete_block(cache, bio)); + } + +@@ -1862,7 +1817,7 @@ static int map_bio(struct cache *cache, struct bio *bio, dm_oblock_t block, + * Passthrough always maps to the origin, invalidating any + * cache blocks that are written to. + */ +- if (passthrough_mode(&cache->features)) { ++ if (passthrough_mode(cache)) { + if (bio_data_dir(bio) == WRITE) { + bio_drop_shared_lock(cache, bio); + atomic_inc(&cache->stats.demotion); +@@ -1871,9 +1826,9 @@ static int map_bio(struct cache *cache, struct bio *bio, dm_oblock_t block, + remap_to_origin_clear_discard(cache, bio, block); + + } else { +- if (bio_data_dir(bio) == WRITE && writethrough_mode(&cache->features) && ++ if (bio_data_dir(bio) == WRITE && writethrough_mode(cache) && + !is_dirty(cache, cblock)) { +- remap_to_origin_then_cache(cache, bio, block, cblock); ++ remap_to_origin_and_cache(cache, bio, block, cblock); + accounted_begin(cache, bio); + } else + remap_to_cache_dirty(cache, bio, block, cblock); +@@ -2003,28 +1958,6 @@ static void process_deferred_bios(struct work_struct *ws) + schedule_commit(&cache->committer); + } + +-static void process_deferred_writethrough_bios(struct work_struct *ws) +-{ +- struct cache *cache = container_of(ws, struct cache, deferred_writethrough_worker); +- +- unsigned long flags; +- struct bio_list bios; +- struct bio *bio; +- +- bio_list_init(&bios); +- +- spin_lock_irqsave(&cache->lock, flags); +- bio_list_merge(&bios, &cache->deferred_writethrough_bios); +- bio_list_init(&cache->deferred_writethrough_bios); +- spin_unlock_irqrestore(&cache->lock, flags); +- +- /* +- * These bios have already been through accounted_begin() +- */ +- while ((bio = bio_list_pop(&bios))) +- generic_make_request(bio); +-} +- + /*---------------------------------------------------------------- + * Main worker loop + *--------------------------------------------------------------*/ +@@ -2132,6 +2065,9 @@ static void destroy(struct cache *cache) + kfree(cache->ctr_args[i]); + kfree(cache->ctr_args); + ++ if (cache->bs) ++ bioset_free(cache->bs); ++ + kfree(cache); + } + +@@ -2589,6 +2525,13 @@ static int cache_create(struct cache_args *ca, struct cache **result) + cache->features = ca->features; + ti->per_io_data_size = get_per_bio_data_size(cache); + ++ if (writethrough_mode(cache)) { ++ /* Create bioset for writethrough bios issued to origin */ ++ cache->bs = bioset_create(BIO_POOL_SIZE, 0, 0); ++ if (!cache->bs) ++ goto bad; ++ } ++ + cache->callbacks.congested_fn = cache_is_congested; + dm_table_add_target_callbacks(ti->table, &cache->callbacks); + +@@ -2649,7 +2592,7 @@ static int cache_create(struct cache_args *ca, struct cache **result) + goto bad; + } + +- if (passthrough_mode(&cache->features)) { ++ if (passthrough_mode(cache)) { + bool all_clean; + + r = dm_cache_metadata_all_clean(cache->cmd, &all_clean); +@@ -2670,7 +2613,6 @@ static int cache_create(struct cache_args *ca, struct cache **result) + spin_lock_init(&cache->lock); + INIT_LIST_HEAD(&cache->deferred_cells); + bio_list_init(&cache->deferred_bios); +- bio_list_init(&cache->deferred_writethrough_bios); + atomic_set(&cache->nr_allocated_migrations, 0); + atomic_set(&cache->nr_io_migrations, 0); + init_waitqueue_head(&cache->migration_wait); +@@ -2709,8 +2651,6 @@ static int cache_create(struct cache_args *ca, struct cache **result) + goto bad; + } + INIT_WORK(&cache->deferred_bio_worker, process_deferred_bios); +- INIT_WORK(&cache->deferred_writethrough_worker, +- process_deferred_writethrough_bios); + INIT_WORK(&cache->migration_worker, check_migrations); + INIT_DELAYED_WORK(&cache->waker, do_waker); + +@@ -3279,13 +3219,13 @@ static void cache_status(struct dm_target *ti, status_type_t type, + else + DMEMIT("1 "); + +- if (writethrough_mode(&cache->features)) ++ if (writethrough_mode(cache)) + DMEMIT("writethrough "); + +- else if (passthrough_mode(&cache->features)) ++ else if (passthrough_mode(cache)) + DMEMIT("passthrough "); + +- else if (writeback_mode(&cache->features)) ++ else if (writeback_mode(cache)) + DMEMIT("writeback "); + + else { +@@ -3451,7 +3391,7 @@ static int process_invalidate_cblocks_message(struct cache *cache, unsigned coun + unsigned i; + struct cblock_range range; + +- if (!passthrough_mode(&cache->features)) { ++ if (!passthrough_mode(cache)) { + DMERR("%s: cache has to be in passthrough mode for invalidation", + cache_device_name(cache)); + return -EPERM; +diff --git a/drivers/md/dm-rq.c b/drivers/md/dm-rq.c +index eadfcfd106fff..cac8ec16e6031 100644 +--- a/drivers/md/dm-rq.c ++++ b/drivers/md/dm-rq.c +@@ -95,9 +95,6 @@ static void dm_old_stop_queue(struct request_queue *q) + + static void dm_mq_stop_queue(struct request_queue *q) + { +- if (blk_mq_queue_stopped(q)) +- return; +- + blk_mq_quiesce_queue(q); + } + +diff --git a/drivers/md/md-cluster.c b/drivers/md/md-cluster.c +index 10057ac85476e..035d5ec8e677f 100644 +--- a/drivers/md/md-cluster.c ++++ b/drivers/md/md-cluster.c +@@ -1423,6 +1423,7 @@ static void unlock_all_bitmaps(struct mddev *mddev) + } + } + kfree(cinfo->other_bitmap_lockres); ++ cinfo->other_bitmap_lockres = NULL; + } + } + +diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c +index d5c14d56a7141..cd055664dce3f 100644 +--- a/drivers/md/raid5.c ++++ b/drivers/md/raid5.c +@@ -3593,6 +3593,7 @@ static int need_this_block(struct stripe_head *sh, struct stripe_head_state *s, + * is missing/faulty, then we need to read everything we can. + */ + if (sh->raid_conf->level != 6 && ++ sh->raid_conf->rmw_level != PARITY_DISABLE_RMW && + sh->sector < sh->raid_conf->mddev->recovery_cp) + /* reconstruct-write isn't being forced */ + return 0; +@@ -4829,7 +4830,7 @@ static void handle_stripe(struct stripe_head *sh) + * or to load a block that is being partially written. + */ + if (s.to_read || s.non_overwrite +- || (conf->level == 6 && s.to_write && s.failed) ++ || (s.to_write && s.failed) + || (s.syncing && (s.uptodate + s.compute < disks)) + || s.replacing + || s.expanding) +diff --git a/drivers/media/firewire/firedtv-fw.c b/drivers/media/firewire/firedtv-fw.c +index 247f0e7cb5f7f..5d634706a7eaa 100644 +--- a/drivers/media/firewire/firedtv-fw.c ++++ b/drivers/media/firewire/firedtv-fw.c +@@ -271,6 +271,8 @@ static int node_probe(struct fw_unit *unit, const struct ieee1394_device_id *id) + + name_len = fw_csr_string(unit->directory, CSR_MODEL, + name, sizeof(name)); ++ if (name_len < 0) ++ return name_len; + for (i = ARRAY_SIZE(model_names); --i; ) + if (strlen(model_names[i]) <= name_len && + strncmp(name, model_names[i], name_len) == 0) +diff --git a/drivers/media/platform/exynos4-is/media-dev.c b/drivers/media/platform/exynos4-is/media-dev.c +index b2eb830c0360a..f772c9b92d9ba 100644 +--- a/drivers/media/platform/exynos4-is/media-dev.c ++++ b/drivers/media/platform/exynos4-is/media-dev.c +@@ -1258,6 +1258,9 @@ static int fimc_md_get_pinctrl(struct fimc_md *fmd) + + pctl->state_idle = pinctrl_lookup_state(pctl->pinctrl, + PINCTRL_STATE_IDLE); ++ if (IS_ERR(pctl->state_idle)) ++ return PTR_ERR(pctl->state_idle); ++ + return 0; + } + +diff --git a/drivers/media/platform/omap3isp/isppreview.c b/drivers/media/platform/omap3isp/isppreview.c +index e981eb2330f18..ac005ae4d21b4 100644 +--- a/drivers/media/platform/omap3isp/isppreview.c ++++ b/drivers/media/platform/omap3isp/isppreview.c +@@ -2290,7 +2290,7 @@ static int preview_init_entities(struct isp_prev_device *prev) + me->ops = &preview_media_ops; + ret = media_entity_pads_init(me, PREV_PADS_NUM, pads); + if (ret < 0) +- return ret; ++ goto error_handler_free; + + preview_init_formats(sd, NULL); + +@@ -2323,6 +2323,8 @@ error_video_out: + omap3isp_video_cleanup(&prev->video_in); + error_video_in: + media_entity_cleanup(&prev->subdev.entity); ++error_handler_free: ++ v4l2_ctrl_handler_free(&prev->ctrls); + return ret; + } + +diff --git a/drivers/mfd/arizona-core.c b/drivers/mfd/arizona-core.c +index ad8a5296c50ba..9aa33141e7f14 100644 +--- a/drivers/mfd/arizona-core.c ++++ b/drivers/mfd/arizona-core.c +@@ -1528,6 +1528,15 @@ err_irq: + arizona_irq_exit(arizona); + err_pm: + pm_runtime_disable(arizona->dev); ++ ++ switch (arizona->pdata.clk32k_src) { ++ case ARIZONA_32KZ_MCLK1: ++ case ARIZONA_32KZ_MCLK2: ++ arizona_clk32k_disable(arizona); ++ break; ++ default: ++ break; ++ } + err_reset: + arizona_enable_reset(arizona); + regulator_disable(arizona->dcvdd); +@@ -1550,6 +1559,15 @@ int arizona_dev_exit(struct arizona *arizona) + regulator_disable(arizona->dcvdd); + regulator_put(arizona->dcvdd); + ++ switch (arizona->pdata.clk32k_src) { ++ case ARIZONA_32KZ_MCLK1: ++ case ARIZONA_32KZ_MCLK2: ++ arizona_clk32k_disable(arizona); ++ break; ++ default: ++ break; ++ } ++ + mfd_remove_devices(arizona->dev); + arizona_free_irq(arizona, ARIZONA_IRQ_UNDERCLOCKED, arizona); + arizona_free_irq(arizona, ARIZONA_IRQ_OVERCLOCKED, arizona); +diff --git a/drivers/mfd/dln2.c b/drivers/mfd/dln2.c +index 672831d5ee32e..97a69cd6f1278 100644 +--- a/drivers/mfd/dln2.c ++++ b/drivers/mfd/dln2.c +@@ -294,7 +294,11 @@ static void dln2_rx(struct urb *urb) + len = urb->actual_length - sizeof(struct dln2_header); + + if (handle == DLN2_HANDLE_EVENT) { ++ unsigned long flags; ++ ++ spin_lock_irqsave(&dln2->event_cb_lock, flags); + dln2_run_event_callbacks(dln2, id, echo, data, len); ++ spin_unlock_irqrestore(&dln2->event_cb_lock, flags); + } else { + /* URB will be re-submitted in _dln2_transfer (free_rx_slot) */ + if (dln2_transfer_complete(dln2, urb, handle, echo)) +diff --git a/drivers/misc/cxl/sysfs.c b/drivers/misc/cxl/sysfs.c +index 393a80bdb846a..b0285c5d8d381 100644 +--- a/drivers/misc/cxl/sysfs.c ++++ b/drivers/misc/cxl/sysfs.c +@@ -606,7 +606,7 @@ static struct afu_config_record *cxl_sysfs_afu_new_cr(struct cxl_afu *afu, int c + rc = kobject_init_and_add(&cr->kobj, &afu_config_record_type, + &afu->dev.kobj, "cr%i", cr->cr); + if (rc) +- goto err; ++ goto err1; + + rc = sysfs_create_bin_file(&cr->kobj, &cr->config_attr); + if (rc) +diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c +index fa4d12217652b..18dd333f2d407 100644 +--- a/drivers/mtd/mtdchar.c ++++ b/drivers/mtd/mtdchar.c +@@ -372,9 +372,6 @@ static int mtdchar_writeoob(struct file *file, struct mtd_info *mtd, + uint32_t retlen; + int ret = 0; + +- if (!(file->f_mode & FMODE_WRITE)) +- return -EPERM; +- + if (length > 4096) + return -EINVAL; + +@@ -681,6 +678,48 @@ static int mtdchar_ioctl(struct file *file, u_int cmd, u_long arg) + return -EFAULT; + } + ++ /* ++ * Check the file mode to require "dangerous" commands to have write ++ * permissions. ++ */ ++ switch (cmd) { ++ /* "safe" commands */ ++ case MEMGETREGIONCOUNT: ++ case MEMGETREGIONINFO: ++ case MEMGETINFO: ++ case MEMREADOOB: ++ case MEMREADOOB64: ++ case MEMLOCK: ++ case MEMUNLOCK: ++ case MEMISLOCKED: ++ case MEMGETOOBSEL: ++ case MEMGETBADBLOCK: ++ case MEMSETBADBLOCK: ++ case OTPSELECT: ++ case OTPGETREGIONCOUNT: ++ case OTPGETREGIONINFO: ++ case OTPLOCK: ++ case ECCGETLAYOUT: ++ case ECCGETSTATS: ++ case MTDFILEMODE: ++ case BLKPG: ++ case BLKRRPART: ++ break; ++ ++ /* "dangerous" commands */ ++ case MEMERASE: ++ case MEMERASE64: ++ case MEMWRITEOOB: ++ case MEMWRITEOOB64: ++ case MEMWRITE: ++ if (!(file->f_mode & FMODE_WRITE)) ++ return -EPERM; ++ break; ++ ++ default: ++ return -ENOTTY; ++ } ++ + switch (cmd) { + case MEMGETREGIONCOUNT: + if (copy_to_user(argp, &(mtd->numeraseregions), sizeof(int))) +@@ -728,9 +767,6 @@ static int mtdchar_ioctl(struct file *file, u_int cmd, u_long arg) + { + struct erase_info *erase; + +- if(!(file->f_mode & FMODE_WRITE)) +- return -EPERM; +- + erase=kzalloc(sizeof(struct erase_info),GFP_KERNEL); + if (!erase) + ret = -ENOMEM; +@@ -1051,9 +1087,6 @@ static int mtdchar_ioctl(struct file *file, u_int cmd, u_long arg) + ret = 0; + break; + } +- +- default: +- ret = -ENOTTY; + } + + return ret; +@@ -1097,6 +1130,11 @@ static long mtdchar_compat_ioctl(struct file *file, unsigned int cmd, + struct mtd_oob_buf32 buf; + struct mtd_oob_buf32 __user *buf_user = argp; + ++ if (!(file->f_mode & FMODE_WRITE)) { ++ ret = -EPERM; ++ break; ++ } ++ + if (copy_from_user(&buf, argp, sizeof(buf))) + ret = -EFAULT; + else +diff --git a/drivers/mtd/nand/qcom_nandc.c b/drivers/mtd/nand/qcom_nandc.c +index 65d1be2c30497..b57678970033f 100644 +--- a/drivers/mtd/nand/qcom_nandc.c ++++ b/drivers/mtd/nand/qcom_nandc.c +@@ -435,11 +435,13 @@ struct qcom_nand_host { + * among different NAND controllers. + * @ecc_modes - ecc mode for NAND + * @is_bam - whether NAND controller is using BAM ++ * @is_qpic - whether NAND CTRL is part of qpic IP + * @dev_cmd_reg_start - NAND_DEV_CMD_* registers starting offset + */ + struct qcom_nandc_props { + u32 ecc_modes; + bool is_bam; ++ bool is_qpic; + u32 dev_cmd_reg_start; + }; + +@@ -2508,7 +2510,8 @@ static int qcom_nandc_setup(struct qcom_nand_controller *nandc) + u32 nand_ctrl; + + /* kill onenand */ +- nandc_write(nandc, SFLASHC_BURST_CFG, 0); ++ if (!nandc->props->is_qpic) ++ nandc_write(nandc, SFLASHC_BURST_CFG, 0); + nandc_write(nandc, dev_cmd_reg_addr(nandc, NAND_DEV_CMD_VLD), + NAND_DEV_CMD_VLD_VAL); + +@@ -2779,12 +2782,14 @@ static const struct qcom_nandc_props ipq806x_nandc_props = { + static const struct qcom_nandc_props ipq4019_nandc_props = { + .ecc_modes = (ECC_BCH_4BIT | ECC_BCH_8BIT), + .is_bam = true, ++ .is_qpic = true, + .dev_cmd_reg_start = 0x0, + }; + + static const struct qcom_nandc_props ipq8074_nandc_props = { + .ecc_modes = (ECC_BCH_4BIT | ECC_BCH_8BIT), + .is_bam = true, ++ .is_qpic = true, + .dev_cmd_reg_start = 0x7000, + }; + +diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c +index 10ea01459a36b..f4268f0322663 100644 +--- a/drivers/net/dsa/mv88e6xxx/chip.c ++++ b/drivers/net/dsa/mv88e6xxx/chip.c +@@ -2450,7 +2450,6 @@ static const struct mv88e6xxx_ops mv88e6097_ops = { + .port_set_frame_mode = mv88e6351_port_set_frame_mode, + .port_set_egress_floods = mv88e6352_port_set_egress_floods, + .port_set_ether_type = mv88e6351_port_set_ether_type, +- .port_set_jumbo_size = mv88e6165_port_set_jumbo_size, + .port_egress_rate_limiting = mv88e6095_port_egress_rate_limiting, + .port_pause_limit = mv88e6097_port_pause_limit, + .port_disable_learn_limit = mv88e6xxx_port_disable_learn_limit, +diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c +index b83ee74d28391..77e5c69268146 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c ++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c +@@ -746,7 +746,7 @@ static int hw_atl_a0_hw_multicast_list_set(struct aq_hw_s *self, + int err = 0; + + if (count > (HW_ATL_A0_MAC_MAX - HW_ATL_A0_MAC_MIN)) { +- err = EBADRQC; ++ err = -EBADRQC; + goto err_exit; + } + for (self->aq_nic_cfg->mc_list_count = 0U; +diff --git a/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c b/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c +index 2e089b5ff8f32..30f0e54f658e9 100644 +--- a/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c ++++ b/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c +@@ -1167,7 +1167,7 @@ static int cn23xx_get_pf_num(struct octeon_device *oct) + oct->pf_num = ((fdl_bit >> CN23XX_PCIE_SRIOV_FDL_BIT_POS) & + CN23XX_PCIE_SRIOV_FDL_MASK); + } else { +- ret = EINVAL; ++ ret = -EINVAL; + + /* Under some virtual environments, extended PCI regs are + * inaccessible, in which case the above read will have failed. +diff --git a/drivers/net/ethernet/freescale/fman/fman.c b/drivers/net/ethernet/freescale/fman/fman.c +index 9080d2332d030..cdd48b1cc84a7 100644 +--- a/drivers/net/ethernet/freescale/fman/fman.c ++++ b/drivers/net/ethernet/freescale/fman/fman.c +@@ -1396,8 +1396,7 @@ static void enable_time_stamp(struct fman *fman) + { + struct fman_fpm_regs __iomem *fpm_rg = fman->fpm_regs; + u16 fm_clk_freq = fman->state->fm_clk_freq; +- u32 tmp, intgr, ts_freq; +- u64 frac; ++ u32 tmp, intgr, ts_freq, frac; + + ts_freq = (u32)(1 << fman->state->count1_micro_bit); + /* configure timestamp so that bit 8 will count 1 microsecond +diff --git a/drivers/net/ethernet/freescale/fman/fman_dtsec.c b/drivers/net/ethernet/freescale/fman/fman_dtsec.c +index 7af31ddd093f8..61238b3af2041 100644 +--- a/drivers/net/ethernet/freescale/fman/fman_dtsec.c ++++ b/drivers/net/ethernet/freescale/fman/fman_dtsec.c +@@ -1159,7 +1159,7 @@ int dtsec_del_hash_mac_address(struct fman_mac *dtsec, enet_addr_t *eth_addr) + list_for_each(pos, + &dtsec->multicast_addr_hash->lsts[bucket]) { + hash_entry = ETH_HASH_ENTRY_OBJ(pos); +- if (hash_entry->addr == addr) { ++ if (hash_entry && hash_entry->addr == addr) { + list_del_init(&hash_entry->node); + kfree(hash_entry); + break; +@@ -1172,7 +1172,7 @@ int dtsec_del_hash_mac_address(struct fman_mac *dtsec, enet_addr_t *eth_addr) + list_for_each(pos, + &dtsec->unicast_addr_hash->lsts[bucket]) { + hash_entry = ETH_HASH_ENTRY_OBJ(pos); +- if (hash_entry->addr == addr) { ++ if (hash_entry && hash_entry->addr == addr) { + list_del_init(&hash_entry->node); + kfree(hash_entry); + break; +diff --git a/drivers/net/ethernet/freescale/fman/fman_mac.h b/drivers/net/ethernet/freescale/fman/fman_mac.h +index dd6d0526f6c1f..19f327efdaff3 100644 +--- a/drivers/net/ethernet/freescale/fman/fman_mac.h ++++ b/drivers/net/ethernet/freescale/fman/fman_mac.h +@@ -252,7 +252,7 @@ static inline struct eth_hash_t *alloc_hash_table(u16 size) + struct eth_hash_t *hash; + + /* Allocate address hash table */ +- hash = kmalloc_array(size, sizeof(struct eth_hash_t *), GFP_KERNEL); ++ hash = kmalloc(sizeof(*hash), GFP_KERNEL); + if (!hash) + return NULL; + +diff --git a/drivers/net/ethernet/freescale/fman/fman_memac.c b/drivers/net/ethernet/freescale/fman/fman_memac.c +index b33650a897f18..460f9e58e9877 100644 +--- a/drivers/net/ethernet/freescale/fman/fman_memac.c ++++ b/drivers/net/ethernet/freescale/fman/fman_memac.c +@@ -855,7 +855,6 @@ int memac_set_tx_pause_frames(struct fman_mac *memac, u8 priority, + + tmp = ioread32be(®s->command_config); + tmp &= ~CMD_CFG_PFC_MODE; +- priority = 0; + + iowrite32be(tmp, ®s->command_config); + +@@ -957,7 +956,7 @@ int memac_del_hash_mac_address(struct fman_mac *memac, enet_addr_t *eth_addr) + + list_for_each(pos, &memac->multicast_addr_hash->lsts[hash]) { + hash_entry = ETH_HASH_ENTRY_OBJ(pos); +- if (hash_entry->addr == addr) { ++ if (hash_entry && hash_entry->addr == addr) { + list_del_init(&hash_entry->node); + kfree(hash_entry); + break; +diff --git a/drivers/net/ethernet/freescale/fman/fman_port.c b/drivers/net/ethernet/freescale/fman/fman_port.c +index 495190764155a..ac3d791f52821 100644 +--- a/drivers/net/ethernet/freescale/fman/fman_port.c ++++ b/drivers/net/ethernet/freescale/fman/fman_port.c +@@ -1744,6 +1744,7 @@ static int fman_port_probe(struct platform_device *of_dev) + struct fman_port *port; + struct fman *fman; + struct device_node *fm_node, *port_node; ++ struct platform_device *fm_pdev; + struct resource res; + struct resource *dev_res; + u32 val; +@@ -1768,8 +1769,14 @@ static int fman_port_probe(struct platform_device *of_dev) + goto return_err; + } + +- fman = dev_get_drvdata(&of_find_device_by_node(fm_node)->dev); ++ fm_pdev = of_find_device_by_node(fm_node); + of_node_put(fm_node); ++ if (!fm_pdev) { ++ err = -EINVAL; ++ goto return_err; ++ } ++ ++ fman = dev_get_drvdata(&fm_pdev->dev); + if (!fman) { + err = -EINVAL; + goto return_err; +diff --git a/drivers/net/ethernet/freescale/fman/fman_tgec.c b/drivers/net/ethernet/freescale/fman/fman_tgec.c +index e575259d20f40..c8ad9b8a75f8e 100644 +--- a/drivers/net/ethernet/freescale/fman/fman_tgec.c ++++ b/drivers/net/ethernet/freescale/fman/fman_tgec.c +@@ -585,7 +585,7 @@ int tgec_del_hash_mac_address(struct fman_mac *tgec, enet_addr_t *eth_addr) + + list_for_each(pos, &tgec->multicast_addr_hash->lsts[hash]) { + hash_entry = ETH_HASH_ENTRY_OBJ(pos); +- if (hash_entry->addr == addr) { ++ if (hash_entry && hash_entry->addr == addr) { + list_del_init(&hash_entry->node); + kfree(hash_entry); + break; +diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c +index 9c7e75b3b6c7a..50fa0401c7014 100644 +--- a/drivers/net/ethernet/intel/igb/igb_main.c ++++ b/drivers/net/ethernet/intel/igb/igb_main.c +@@ -5487,9 +5487,18 @@ static void igb_reset_task(struct work_struct *work) + struct igb_adapter *adapter; + adapter = container_of(work, struct igb_adapter, reset_task); + ++ rtnl_lock(); ++ /* If we're already down or resetting, just bail */ ++ if (test_bit(__IGB_DOWN, &adapter->state) || ++ test_bit(__IGB_RESETTING, &adapter->state)) { ++ rtnl_unlock(); ++ return; ++ } ++ + igb_dump(adapter); + netdev_err(adapter->netdev, "Reset adapter\n"); + igb_reinit_locked(adapter); ++ rtnl_unlock(); + } + + /** +diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c +index 9ba699cbdbc5e..a52909db67f68 100644 +--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c ++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c +@@ -2452,6 +2452,8 @@ static int mtk_add_mac(struct mtk_eth *eth, struct device_node *np) + eth->netdev[id]->irq = eth->irq[0]; + eth->netdev[id]->dev.of_node = np; + ++ eth->netdev[id]->max_mtu = MTK_MAX_RX_LENGTH - MTK_RX_ETH_HLEN; ++ + return 0; + + free_netdev: +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c +index e69674d38f167..a3107d133b404 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c +@@ -180,7 +180,7 @@ int mlx5e_attr_get(struct net_device *dev, struct switchdev_attr *attr) + struct mlx5_eswitch_rep *rep = rpriv->rep; + struct mlx5_eswitch *esw = priv->mdev->priv.eswitch; + +- if (esw->mode == SRIOV_NONE) ++ if (esw->mode != SRIOV_OFFLOADS) + return -EOPNOTSUPP; + + switch (attr->id) { +diff --git a/drivers/net/ethernet/qualcomm/emac/emac.c b/drivers/net/ethernet/qualcomm/emac/emac.c +index 759543512117c..5ab83751a471f 100644 +--- a/drivers/net/ethernet/qualcomm/emac/emac.c ++++ b/drivers/net/ethernet/qualcomm/emac/emac.c +@@ -493,13 +493,24 @@ static int emac_clks_phase1_init(struct platform_device *pdev, + + ret = clk_prepare_enable(adpt->clk[EMAC_CLK_CFG_AHB]); + if (ret) +- return ret; ++ goto disable_clk_axi; + + ret = clk_set_rate(adpt->clk[EMAC_CLK_HIGH_SPEED], 19200000); + if (ret) +- return ret; ++ goto disable_clk_cfg_ahb; ++ ++ ret = clk_prepare_enable(adpt->clk[EMAC_CLK_HIGH_SPEED]); ++ if (ret) ++ goto disable_clk_cfg_ahb; + +- return clk_prepare_enable(adpt->clk[EMAC_CLK_HIGH_SPEED]); ++ return 0; ++ ++disable_clk_cfg_ahb: ++ clk_disable_unprepare(adpt->clk[EMAC_CLK_CFG_AHB]); ++disable_clk_axi: ++ clk_disable_unprepare(adpt->clk[EMAC_CLK_AXI]); ++ ++ return ret; + } + + /* Enable clocks; needs emac_clks_phase1_init to be called before */ +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c +index bcc5d1e16ce2c..1924788d28da0 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c +@@ -362,6 +362,7 @@ static int ipq806x_gmac_probe(struct platform_device *pdev) + plat_dat->has_gmac = true; + plat_dat->bsp_priv = gmac; + plat_dat->fix_mac_speed = ipq806x_gmac_fix_mac_speed; ++ plat_dat->multicast_filter_bins = 0; + + err = stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res); + if (err) +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c +index f76d4a7281af0..f07d9d3456a4f 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c +@@ -176,6 +176,9 @@ static void dwmac1000_set_filter(struct mac_device_info *hw, + value = GMAC_FRAME_FILTER_PR; + } else if (dev->flags & IFF_ALLMULTI) { + value = GMAC_FRAME_FILTER_PM; /* pass all multi */ ++ } else if (!netdev_mc_empty(dev) && (mcbitslog2 == 0)) { ++ /* Fall back to all multicast if we've no filter */ ++ value = GMAC_FRAME_FILTER_PM; + } else if (!netdev_mc_empty(dev)) { + struct netdev_hw_addr *ha; + +diff --git a/drivers/net/ethernet/toshiba/spider_net.c b/drivers/net/ethernet/toshiba/spider_net.c +index da136b8843dd9..a0fed9035f537 100644 +--- a/drivers/net/ethernet/toshiba/spider_net.c ++++ b/drivers/net/ethernet/toshiba/spider_net.c +@@ -296,8 +296,8 @@ spider_net_free_chain(struct spider_net_card *card, + descr = descr->next; + } while (descr != chain->ring); + +- dma_free_coherent(&card->pdev->dev, chain->num_desc, +- chain->hwring, chain->dma_addr); ++ dma_free_coherent(&card->pdev->dev, chain->num_desc * sizeof(struct spider_net_hw_descr), ++ chain->hwring, chain->dma_addr); + } + + /** +diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c +index 14451e14d99dc..10c3480c2da89 100644 +--- a/drivers/net/hyperv/netvsc_drv.c ++++ b/drivers/net/hyperv/netvsc_drv.c +@@ -532,12 +532,13 @@ static int netvsc_start_xmit(struct sk_buff *skb, struct net_device *net) + u32 hash; + struct hv_page_buffer pb[MAX_PAGE_BUFFER_COUNT]; + +- /* if VF is present and up then redirect packets +- * already called with rcu_read_lock_bh ++ /* If VF is present and up then redirect packets to it. ++ * Skip the VF if it is marked down or has no carrier. ++ * If netpoll is in uses, then VF can not be used either. + */ + vf_netdev = rcu_dereference_bh(net_device_ctx->vf_netdev); + if (vf_netdev && netif_running(vf_netdev) && +- !netpoll_tx_running(net)) ++ netif_carrier_ok(vf_netdev) && !netpoll_tx_running(net)) + return netvsc_vf_xmit(net, vf_netdev, skb); + + /* We will atmost need two pages to describe the rndis +diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c +index 7988c41bff1d5..0e3d13e192e38 100644 +--- a/drivers/net/usb/hso.c ++++ b/drivers/net/usb/hso.c +@@ -2272,12 +2272,14 @@ static int hso_serial_common_create(struct hso_serial *serial, int num_urbs, + + minor = get_free_serial_index(); + if (minor < 0) +- goto exit; ++ goto exit2; + + /* register our minor number */ + serial->parent->dev = tty_port_register_device_attr(&serial->port, + tty_drv, minor, &serial->parent->interface->dev, + serial->parent, hso_serial_dev_groups); ++ if (IS_ERR(serial->parent->dev)) ++ goto exit2; + dev = serial->parent->dev; + + /* fill in specific data for later use */ +@@ -2323,6 +2325,7 @@ static int hso_serial_common_create(struct hso_serial *serial, int num_urbs, + return 0; + exit: + hso_serial_tty_unregister(serial); ++exit2: + hso_serial_common_free(serial); + return -1; + } +diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c +index 895f307979c82..120e99914fd62 100644 +--- a/drivers/net/usb/lan78xx.c ++++ b/drivers/net/usb/lan78xx.c +@@ -363,10 +363,6 @@ struct lan78xx_net { + struct tasklet_struct bh; + struct delayed_work wq; + +- struct usb_host_endpoint *ep_blkin; +- struct usb_host_endpoint *ep_blkout; +- struct usb_host_endpoint *ep_intr; +- + int msg_enable; + + struct urb *urb_intr; +@@ -2751,78 +2747,12 @@ lan78xx_start_xmit(struct sk_buff *skb, struct net_device *net) + return NETDEV_TX_OK; + } + +-static int +-lan78xx_get_endpoints(struct lan78xx_net *dev, struct usb_interface *intf) +-{ +- int tmp; +- struct usb_host_interface *alt = NULL; +- struct usb_host_endpoint *in = NULL, *out = NULL; +- struct usb_host_endpoint *status = NULL; +- +- for (tmp = 0; tmp < intf->num_altsetting; tmp++) { +- unsigned ep; +- +- in = NULL; +- out = NULL; +- status = NULL; +- alt = intf->altsetting + tmp; +- +- for (ep = 0; ep < alt->desc.bNumEndpoints; ep++) { +- struct usb_host_endpoint *e; +- int intr = 0; +- +- e = alt->endpoint + ep; +- switch (e->desc.bmAttributes) { +- case USB_ENDPOINT_XFER_INT: +- if (!usb_endpoint_dir_in(&e->desc)) +- continue; +- intr = 1; +- /* FALLTHROUGH */ +- case USB_ENDPOINT_XFER_BULK: +- break; +- default: +- continue; +- } +- if (usb_endpoint_dir_in(&e->desc)) { +- if (!intr && !in) +- in = e; +- else if (intr && !status) +- status = e; +- } else { +- if (!out) +- out = e; +- } +- } +- if (in && out) +- break; +- } +- if (!alt || !in || !out) +- return -EINVAL; +- +- dev->pipe_in = usb_rcvbulkpipe(dev->udev, +- in->desc.bEndpointAddress & +- USB_ENDPOINT_NUMBER_MASK); +- dev->pipe_out = usb_sndbulkpipe(dev->udev, +- out->desc.bEndpointAddress & +- USB_ENDPOINT_NUMBER_MASK); +- dev->ep_intr = status; +- +- return 0; +-} +- + static int lan78xx_bind(struct lan78xx_net *dev, struct usb_interface *intf) + { + struct lan78xx_priv *pdata = NULL; + int ret; + int i; + +- ret = lan78xx_get_endpoints(dev, intf); +- if (ret) { +- netdev_warn(dev->net, "lan78xx_get_endpoints failed: %d\n", +- ret); +- return ret; +- } +- + dev->data[0] = (unsigned long)kzalloc(sizeof(*pdata), GFP_KERNEL); + + pdata = (struct lan78xx_priv *)(dev->data[0]); +@@ -3567,6 +3497,7 @@ static void lan78xx_stat_monitor(unsigned long param) + static int lan78xx_probe(struct usb_interface *intf, + const struct usb_device_id *id) + { ++ struct usb_host_endpoint *ep_blkin, *ep_blkout, *ep_intr; + struct lan78xx_net *dev; + struct net_device *netdev; + struct usb_device *udev; +@@ -3617,6 +3548,34 @@ static int lan78xx_probe(struct usb_interface *intf, + + mutex_init(&dev->stats.access_lock); + ++ if (intf->cur_altsetting->desc.bNumEndpoints < 3) { ++ ret = -ENODEV; ++ goto out2; ++ } ++ ++ dev->pipe_in = usb_rcvbulkpipe(udev, BULK_IN_PIPE); ++ ep_blkin = usb_pipe_endpoint(udev, dev->pipe_in); ++ if (!ep_blkin || !usb_endpoint_is_bulk_in(&ep_blkin->desc)) { ++ ret = -ENODEV; ++ goto out2; ++ } ++ ++ dev->pipe_out = usb_sndbulkpipe(udev, BULK_OUT_PIPE); ++ ep_blkout = usb_pipe_endpoint(udev, dev->pipe_out); ++ if (!ep_blkout || !usb_endpoint_is_bulk_out(&ep_blkout->desc)) { ++ ret = -ENODEV; ++ goto out2; ++ } ++ ++ ep_intr = &intf->cur_altsetting->endpoint[2]; ++ if (!usb_endpoint_is_int_in(&ep_intr->desc)) { ++ ret = -ENODEV; ++ goto out2; ++ } ++ ++ dev->pipe_intr = usb_rcvintpipe(dev->udev, ++ usb_endpoint_num(&ep_intr->desc)); ++ + ret = lan78xx_bind(dev, intf); + if (ret < 0) + goto out2; +@@ -3629,23 +3588,7 @@ static int lan78xx_probe(struct usb_interface *intf, + netdev->max_mtu = MAX_SINGLE_PACKET_SIZE; + netif_set_gso_max_size(netdev, MAX_SINGLE_PACKET_SIZE - MAX_HEADER); + +- if (intf->cur_altsetting->desc.bNumEndpoints < 3) { +- ret = -ENODEV; +- goto out3; +- } +- +- dev->ep_blkin = (intf->cur_altsetting)->endpoint + 0; +- dev->ep_blkout = (intf->cur_altsetting)->endpoint + 1; +- dev->ep_intr = (intf->cur_altsetting)->endpoint + 2; +- +- dev->pipe_in = usb_rcvbulkpipe(udev, BULK_IN_PIPE); +- dev->pipe_out = usb_sndbulkpipe(udev, BULK_OUT_PIPE); +- +- dev->pipe_intr = usb_rcvintpipe(dev->udev, +- dev->ep_intr->desc.bEndpointAddress & +- USB_ENDPOINT_NUMBER_MASK); +- period = dev->ep_intr->desc.bInterval; +- ++ period = ep_intr->desc.bInterval; + maxp = usb_maxpacket(dev->udev, dev->pipe_intr, 0); + buf = kmalloc(maxp, GFP_KERNEL); + if (buf) { +diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c +index afdc2c290fd03..82efa5bbf568b 100644 +--- a/drivers/net/vxlan.c ++++ b/drivers/net/vxlan.c +@@ -974,6 +974,7 @@ static int vxlan_fdb_dump(struct sk_buff *skb, struct netlink_callback *cb, + for (h = 0; h < FDB_HASH_SIZE; ++h) { + struct vxlan_fdb *f; + ++ rcu_read_lock(); + hlist_for_each_entry_rcu(f, &vxlan->fdb_head[h], hlist) { + struct vxlan_rdst *rd; + +@@ -986,12 +987,15 @@ static int vxlan_fdb_dump(struct sk_buff *skb, struct netlink_callback *cb, + cb->nlh->nlmsg_seq, + RTM_NEWNEIGH, + NLM_F_MULTI, rd); +- if (err < 0) ++ if (err < 0) { ++ rcu_read_unlock(); + goto out; ++ } + skip: + *idx += 1; + } + } ++ rcu_read_unlock(); + } + out: + return err; +@@ -2218,7 +2222,7 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev, + skb_dst_update_pmtu(skb, mtu); + } + +- tos = ip_tunnel_ecn_encap(RT_TOS(tos), old_iph, skb); ++ tos = ip_tunnel_ecn_encap(tos, old_iph, skb); + ttl = ttl ? : ip4_dst_hoplimit(&rt->dst); + err = vxlan_build_skb(skb, ndst, sizeof(struct iphdr), + vni, md, flags, udp_sum); +@@ -2259,7 +2263,7 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev, + skb_dst_update_pmtu(skb, mtu); + } + +- tos = ip_tunnel_ecn_encap(RT_TOS(tos), old_iph, skb); ++ tos = ip_tunnel_ecn_encap(tos, old_iph, skb); + ttl = ttl ? : ip6_dst_hoplimit(ndst); + skb_scrub_packet(skb, xnet); + err = vxlan_build_skb(skb, ndst, sizeof(struct ipv6hdr), +diff --git a/drivers/net/wan/lapbether.c b/drivers/net/wan/lapbether.c +index ac34257e9f203..c94dfa70f2a33 100644 +--- a/drivers/net/wan/lapbether.c ++++ b/drivers/net/wan/lapbether.c +@@ -160,6 +160,12 @@ static netdev_tx_t lapbeth_xmit(struct sk_buff *skb, + if (!netif_running(dev)) + goto drop; + ++ /* There should be a pseudo header of 1 byte added by upper layers. ++ * Check to make sure it is there before reading it. ++ */ ++ if (skb->len < 1) ++ goto drop; ++ + switch (skb->data[0]) { + case X25_IFACE_DATA: + break; +@@ -308,6 +314,7 @@ static void lapbeth_setup(struct net_device *dev) + dev->netdev_ops = &lapbeth_netdev_ops; + dev->needs_free_netdev = true; + dev->type = ARPHRD_X25; ++ dev->hard_header_len = 0; + dev->mtu = 1000; + dev->addr_len = 0; + } +@@ -334,7 +341,8 @@ static int lapbeth_new_device(struct net_device *dev) + * then this driver prepends a length field of 2 bytes, + * then the underlying Ethernet device prepends its own header. + */ +- ndev->hard_header_len = -1 + 3 + 2 + dev->hard_header_len; ++ ndev->needed_headroom = -1 + 3 + 2 + dev->hard_header_len ++ + dev->needed_headroom; + + lapbeth = netdev_priv(ndev); + lapbeth->axdev = ndev; +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h +index e0d22fedb2b45..05bd636011ec9 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h +@@ -30,7 +30,7 @@ + #define BRCMF_ARP_OL_PEER_AUTO_REPLY 0x00000008 + + #define BRCMF_BSS_INFO_VERSION 109 /* curr ver of brcmf_bss_info_le struct */ +-#define BRCMF_BSS_RSSI_ON_CHANNEL 0x0002 ++#define BRCMF_BSS_RSSI_ON_CHANNEL 0x0004 + + #define BRCMF_STA_WME 0x00000002 /* WMM association */ + #define BRCMF_STA_AUTHE 0x00000008 /* Authenticated */ +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c +index 2370060ef980a..0807331284895 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c +@@ -653,6 +653,7 @@ static inline int brcmf_fws_hanger_poppkt(struct brcmf_fws_hanger *h, + static void brcmf_fws_psq_flush(struct brcmf_fws_info *fws, struct pktq *q, + int ifidx) + { ++ struct brcmf_fws_hanger_item *hi; + bool (*matchfn)(struct sk_buff *, void *) = NULL; + struct sk_buff *skb; + int prec; +@@ -664,6 +665,9 @@ static void brcmf_fws_psq_flush(struct brcmf_fws_info *fws, struct pktq *q, + skb = brcmu_pktq_pdeq_match(q, prec, matchfn, &ifidx); + while (skb) { + hslot = brcmf_skb_htod_tag_get_field(skb, HSLOT); ++ hi = &fws->hanger.items[hslot]; ++ WARN_ON(skb != hi->pkt); ++ hi->state = BRCMF_FWS_HANGER_ITEM_STATE_FREE; + brcmf_fws_hanger_poppkt(&fws->hanger, hslot, &skb, + true); + brcmu_pkt_buf_free_skb(skb); +diff --git a/drivers/net/wireless/intel/iwlegacy/common.c b/drivers/net/wireless/intel/iwlegacy/common.c +index 6e6b124f0d5e3..3ca84577803cc 100644 +--- a/drivers/net/wireless/intel/iwlegacy/common.c ++++ b/drivers/net/wireless/intel/iwlegacy/common.c +@@ -4302,8 +4302,8 @@ il_apm_init(struct il_priv *il) + * power savings, even without L1. + */ + if (il->cfg->set_l0s) { +- pcie_capability_read_word(il->pci_dev, PCI_EXP_LNKCTL, &lctl); +- if (lctl & PCI_EXP_LNKCTL_ASPM_L1) { ++ ret = pcie_capability_read_word(il->pci_dev, PCI_EXP_LNKCTL, &lctl); ++ if (!ret && (lctl & PCI_EXP_LNKCTL_ASPM_L1)) { + /* L1-ASPM enabled; disable(!) L0S */ + il_set_bit(il, CSR_GIO_REG, + CSR_GIO_REG_VAL_L0S_ENABLED); +diff --git a/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c b/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c +index 0fba5b10ef2d7..19ce279df24d9 100644 +--- a/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c ++++ b/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c +@@ -585,6 +585,11 @@ static int mwifiex_ret_802_11_key_material_v1(struct mwifiex_private *priv, + { + struct host_cmd_ds_802_11_key_material *key = + &resp->params.key_material; ++ int len; ++ ++ len = le16_to_cpu(key->key_param_set.key_len); ++ if (len > sizeof(key->key_param_set.key)) ++ return -EINVAL; + + if (le16_to_cpu(key->action) == HostCmd_ACT_GEN_SET) { + if ((le16_to_cpu(key->key_param_set.key_info) & KEY_MCAST)) { +@@ -598,9 +603,8 @@ static int mwifiex_ret_802_11_key_material_v1(struct mwifiex_private *priv, + + memset(priv->aes_key.key_param_set.key, 0, + sizeof(key->key_param_set.key)); +- priv->aes_key.key_param_set.key_len = key->key_param_set.key_len; +- memcpy(priv->aes_key.key_param_set.key, key->key_param_set.key, +- le16_to_cpu(priv->aes_key.key_param_set.key_len)); ++ priv->aes_key.key_param_set.key_len = cpu_to_le16(len); ++ memcpy(priv->aes_key.key_param_set.key, key->key_param_set.key, len); + + return 0; + } +@@ -615,9 +619,14 @@ static int mwifiex_ret_802_11_key_material_v2(struct mwifiex_private *priv, + struct host_cmd_ds_command *resp) + { + struct host_cmd_ds_802_11_key_material_v2 *key_v2; +- __le16 len; ++ int len; + + key_v2 = &resp->params.key_material_v2; ++ ++ len = le16_to_cpu(key_v2->key_param_set.key_params.aes.key_len); ++ if (len > WLAN_KEY_LEN_CCMP) ++ return -EINVAL; ++ + if (le16_to_cpu(key_v2->action) == HostCmd_ACT_GEN_SET) { + if ((le16_to_cpu(key_v2->key_param_set.key_info) & KEY_MCAST)) { + mwifiex_dbg(priv->adapter, INFO, "info: key: GTK is set\n"); +@@ -633,10 +642,9 @@ static int mwifiex_ret_802_11_key_material_v2(struct mwifiex_private *priv, + memset(priv->aes_key_v2.key_param_set.key_params.aes.key, 0, + WLAN_KEY_LEN_CCMP); + priv->aes_key_v2.key_param_set.key_params.aes.key_len = +- key_v2->key_param_set.key_params.aes.key_len; +- len = priv->aes_key_v2.key_param_set.key_params.aes.key_len; ++ cpu_to_le16(len); + memcpy(priv->aes_key_v2.key_param_set.key_params.aes.key, +- key_v2->key_param_set.key_params.aes.key, le16_to_cpu(len)); ++ key_v2->key_param_set.key_params.aes.key, len); + + return 0; + } +diff --git a/drivers/net/wireless/ti/wl1251/event.c b/drivers/net/wireless/ti/wl1251/event.c +index f5acd24d0e2b1..988abb49771f9 100644 +--- a/drivers/net/wireless/ti/wl1251/event.c ++++ b/drivers/net/wireless/ti/wl1251/event.c +@@ -84,7 +84,7 @@ static int wl1251_event_ps_report(struct wl1251 *wl, + break; + } + +- return 0; ++ return ret; + } + + static void wl1251_event_mbox_dump(struct event_mailbox *mbox) +diff --git a/drivers/parisc/sba_iommu.c b/drivers/parisc/sba_iommu.c +index 5468490d2298b..55b3274328eb8 100644 +--- a/drivers/parisc/sba_iommu.c ++++ b/drivers/parisc/sba_iommu.c +@@ -1291,7 +1291,7 @@ sba_ioc_init_pluto(struct parisc_device *sba, struct ioc *ioc, int ioc_num) + ** (one that doesn't overlap memory or LMMIO space) in the + ** IBASE and IMASK registers. + */ +- ioc->ibase = READ_REG(ioc->ioc_hpa + IOC_IBASE); ++ ioc->ibase = READ_REG(ioc->ioc_hpa + IOC_IBASE) & ~0x1fffffULL; + iova_space_size = ~(READ_REG(ioc->ioc_hpa + IOC_IMASK) & 0xFFFFFFFFUL) + 1; + + if ((ioc->ibase < 0xfed00000UL) && ((ioc->ibase + iova_space_size) > 0xfee00000UL)) { +diff --git a/drivers/pci/access.c b/drivers/pci/access.c +index 913d6722ece98..8c585e7ca5209 100644 +--- a/drivers/pci/access.c ++++ b/drivers/pci/access.c +@@ -205,17 +205,13 @@ EXPORT_SYMBOL(pci_bus_set_ops); + static DECLARE_WAIT_QUEUE_HEAD(pci_cfg_wait); + + static noinline void pci_wait_cfg(struct pci_dev *dev) ++ __must_hold(&pci_lock) + { +- DECLARE_WAITQUEUE(wait, current); +- +- __add_wait_queue(&pci_cfg_wait, &wait); + do { +- set_current_state(TASK_UNINTERRUPTIBLE); + raw_spin_unlock_irq(&pci_lock); +- schedule(); ++ wait_event(pci_cfg_wait, !dev->block_cfg_access); + raw_spin_lock_irq(&pci_lock); + } while (dev->block_cfg_access); +- __remove_wait_queue(&pci_cfg_wait, &wait); + } + + /* Returns 0 on success, negative values indicate error. */ +diff --git a/drivers/pci/host/vmd.c b/drivers/pci/host/vmd.c +index 05f191ae0ff1b..79d56638878cf 100644 +--- a/drivers/pci/host/vmd.c ++++ b/drivers/pci/host/vmd.c +@@ -651,6 +651,7 @@ static int vmd_enable_domain(struct vmd_dev *vmd) + if (!vmd->bus) { + pci_free_resource_list(&resources); + irq_domain_remove(vmd->irq_domain); ++ irq_domain_free_fwnode(fn); + return -ENODEV; + } + +@@ -753,6 +754,7 @@ static void vmd_cleanup_srcu(struct vmd_dev *vmd) + static void vmd_remove(struct pci_dev *dev) + { + struct vmd_dev *vmd = pci_get_drvdata(dev); ++ struct fwnode_handle *fn = vmd->irq_domain->fwnode; + + sysfs_remove_link(&vmd->dev->dev.kobj, "domain"); + pci_stop_root_bus(vmd->bus); +@@ -761,6 +763,7 @@ static void vmd_remove(struct pci_dev *dev) + vmd_teardown_dma_ops(vmd); + vmd_detach_resources(vmd); + irq_domain_remove(vmd->irq_domain); ++ irq_domain_free_fwnode(fn); + } + + #ifdef CONFIG_PM_SLEEP +diff --git a/drivers/pci/hotplug/acpiphp_glue.c b/drivers/pci/hotplug/acpiphp_glue.c +index 711875afdd70a..f2c1008e0f76c 100644 +--- a/drivers/pci/hotplug/acpiphp_glue.c ++++ b/drivers/pci/hotplug/acpiphp_glue.c +@@ -136,13 +136,21 @@ static struct acpiphp_context *acpiphp_grab_context(struct acpi_device *adev) + struct acpiphp_context *context; + + acpi_lock_hp_context(); ++ + context = acpiphp_get_context(adev); +- if (!context || context->func.parent->is_going_away) { +- acpi_unlock_hp_context(); +- return NULL; ++ if (!context) ++ goto unlock; ++ ++ if (context->func.parent->is_going_away) { ++ acpiphp_put_context(context); ++ context = NULL; ++ goto unlock; + } ++ + get_bridge(context->func.parent); + acpiphp_put_context(context); ++ ++unlock: + acpi_unlock_hp_context(); + return context; + } +diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c +index 04d5c62588b77..f41c105adfbd4 100644 +--- a/drivers/pci/pcie/aspm.c ++++ b/drivers/pci/pcie/aspm.c +@@ -1111,6 +1111,7 @@ static int pcie_aspm_get_policy(char *buffer, struct kernel_param *kp) + cnt += sprintf(buffer + cnt, "[%s] ", policy_str[i]); + else + cnt += sprintf(buffer + cnt, "%s ", policy_str[i]); ++ cnt += sprintf(buffer + cnt, "\n"); + return cnt; + } + +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index 243b16ce0c8eb..da790f26d2950 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -4307,6 +4307,8 @@ static int pci_quirk_amd_sb_acs(struct pci_dev *dev, u16 acs_flags) + if (ACPI_FAILURE(status)) + return -ENODEV; + ++ acpi_put_table(header); ++ + /* Filter out flags not applicable to multifunction */ + acs_flags &= (PCI_ACS_RR | PCI_ACS_CR | PCI_ACS_EC | PCI_ACS_DT); + +diff --git a/drivers/pinctrl/pinctrl-single.c b/drivers/pinctrl/pinctrl-single.c +index b8b3d932cd73a..f751b5c3bf7e8 100644 +--- a/drivers/pinctrl/pinctrl-single.c ++++ b/drivers/pinctrl/pinctrl-single.c +@@ -888,7 +888,7 @@ static int pcs_parse_pinconf(struct pcs_device *pcs, struct device_node *np, + + /* If pinconf isn't supported, don't parse properties in below. */ + if (!PCS_HAS_PINCONF) +- return 0; ++ return -ENOTSUPP; + + /* cacluate how much properties are supported in current node */ + for (i = 0; i < ARRAY_SIZE(prop2); i++) { +@@ -900,7 +900,7 @@ static int pcs_parse_pinconf(struct pcs_device *pcs, struct device_node *np, + nconfs++; + } + if (!nconfs) +- return 0; ++ return -ENOTSUPP; + + func->conf = devm_kzalloc(pcs->dev, + sizeof(struct pcs_conf_vals) * nconfs, +@@ -1024,9 +1024,12 @@ static int pcs_parse_one_pinctrl_entry(struct pcs_device *pcs, + + if (PCS_HAS_PINCONF) { + res = pcs_parse_pinconf(pcs, np, function, map); +- if (res) ++ if (res == 0) ++ *num_maps = 2; ++ else if (res == -ENOTSUPP) ++ *num_maps = 1; ++ else + goto free_pingroups; +- *num_maps = 2; + } else { + *num_maps = 1; + } +diff --git a/drivers/platform/x86/intel-hid.c b/drivers/platform/x86/intel-hid.c +index e34fd70b67afe..3add7b3f9658b 100644 +--- a/drivers/platform/x86/intel-hid.c ++++ b/drivers/platform/x86/intel-hid.c +@@ -366,7 +366,7 @@ check_acpi_dev(acpi_handle handle, u32 lvl, void *context, void **rv) + return AE_OK; + + if (acpi_match_device_ids(dev, ids) == 0) +- if (acpi_create_platform_device(dev, NULL)) ++ if (!IS_ERR_OR_NULL(acpi_create_platform_device(dev, NULL))) + dev_info(&dev->dev, + "intel-hid: created platform device\n"); + +diff --git a/drivers/platform/x86/intel-vbtn.c b/drivers/platform/x86/intel-vbtn.c +index 58c5ff36523ab..d7fa2b88d27ab 100644 +--- a/drivers/platform/x86/intel-vbtn.c ++++ b/drivers/platform/x86/intel-vbtn.c +@@ -178,7 +178,7 @@ check_acpi_dev(acpi_handle handle, u32 lvl, void *context, void **rv) + return AE_OK; + + if (acpi_match_device_ids(dev, ids) == 0) +- if (acpi_create_platform_device(dev, NULL)) ++ if (!IS_ERR_OR_NULL(acpi_create_platform_device(dev, NULL))) + dev_info(&dev->dev, + "intel-vbtn: created platform device\n"); + +diff --git a/drivers/power/supply/88pm860x_battery.c b/drivers/power/supply/88pm860x_battery.c +index 63c57dc82ac1d..4eda5065b5bbc 100644 +--- a/drivers/power/supply/88pm860x_battery.c ++++ b/drivers/power/supply/88pm860x_battery.c +@@ -436,7 +436,7 @@ static void pm860x_init_battery(struct pm860x_battery_info *info) + int ret; + int data; + int bat_remove; +- int soc; ++ int soc = 0; + + /* measure enable on GPADC1 */ + data = MEAS1_GP1; +@@ -499,7 +499,9 @@ static void pm860x_init_battery(struct pm860x_battery_info *info) + } + mutex_unlock(&info->lock); + +- calc_soc(info, OCV_MODE_ACTIVE, &soc); ++ ret = calc_soc(info, OCV_MODE_ACTIVE, &soc); ++ if (ret < 0) ++ goto out; + + data = pm860x_reg_read(info->i2c, PM8607_POWER_UP_LOG); + bat_remove = data & BAT_WU_LOG; +diff --git a/drivers/pwm/pwm-bcm-iproc.c b/drivers/pwm/pwm-bcm-iproc.c +index 31b01035d0ab3..8cfba3614e601 100644 +--- a/drivers/pwm/pwm-bcm-iproc.c ++++ b/drivers/pwm/pwm-bcm-iproc.c +@@ -85,8 +85,6 @@ static void iproc_pwmc_get_state(struct pwm_chip *chip, struct pwm_device *pwm, + u64 tmp, multi, rate; + u32 value, prescale; + +- rate = clk_get_rate(ip->clk); +- + value = readl(ip->base + IPROC_PWM_CTRL_OFFSET); + + if (value & BIT(IPROC_PWM_CTRL_EN_SHIFT(pwm->hwpwm))) +@@ -99,6 +97,13 @@ static void iproc_pwmc_get_state(struct pwm_chip *chip, struct pwm_device *pwm, + else + state->polarity = PWM_POLARITY_INVERSED; + ++ rate = clk_get_rate(ip->clk); ++ if (rate == 0) { ++ state->period = 0; ++ state->duty_cycle = 0; ++ return; ++ } ++ + value = readl(ip->base + IPROC_PWM_PRESCALE_OFFSET); + prescale = value >> IPROC_PWM_PRESCALE_SHIFT(pwm->hwpwm); + prescale &= IPROC_PWM_PRESCALE_MAX; +diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c +index 6fa07c2469150..ae310d5ced105 100644 +--- a/drivers/s390/net/qeth_l2_main.c ++++ b/drivers/s390/net/qeth_l2_main.c +@@ -1559,6 +1559,10 @@ static void qeth_bridge_state_change(struct qeth_card *card, + int extrasize; + + QETH_CARD_TEXT(card, 2, "brstchng"); ++ if (qports->num_entries == 0) { ++ QETH_CARD_TEXT(card, 2, "BPempty"); ++ return; ++ } + if (qports->entry_length != sizeof(struct qeth_sbp_port_entry)) { + QETH_CARD_TEXT_(card, 2, "BPsz%04x", qports->entry_length); + return; +diff --git a/drivers/scsi/arm/cumana_2.c b/drivers/scsi/arm/cumana_2.c +index edce5f3cfdba0..93ba83e3148eb 100644 +--- a/drivers/scsi/arm/cumana_2.c ++++ b/drivers/scsi/arm/cumana_2.c +@@ -454,7 +454,7 @@ static int cumanascsi2_probe(struct expansion_card *ec, + + if (info->info.scsi.dma != NO_DMA) + free_dma(info->info.scsi.dma); +- free_irq(ec->irq, host); ++ free_irq(ec->irq, info); + + out_release: + fas216_release(host); +diff --git a/drivers/scsi/arm/eesox.c b/drivers/scsi/arm/eesox.c +index e93e047f43165..65bb34ce93b94 100644 +--- a/drivers/scsi/arm/eesox.c ++++ b/drivers/scsi/arm/eesox.c +@@ -575,7 +575,7 @@ static int eesoxscsi_probe(struct expansion_card *ec, const struct ecard_id *id) + + if (info->info.scsi.dma != NO_DMA) + free_dma(info->info.scsi.dma); +- free_irq(ec->irq, host); ++ free_irq(ec->irq, info); + + out_remove: + fas216_remove(host); +diff --git a/drivers/scsi/arm/powertec.c b/drivers/scsi/arm/powertec.c +index 79aa88911b7f3..b5e4a25ea1ef3 100644 +--- a/drivers/scsi/arm/powertec.c ++++ b/drivers/scsi/arm/powertec.c +@@ -382,7 +382,7 @@ static int powertecscsi_probe(struct expansion_card *ec, + + if (info->info.scsi.dma != NO_DMA) + free_dma(info->info.scsi.dma); +- free_irq(ec->irq, host); ++ free_irq(ec->irq, info); + + out_release: + fas216_release(host); +diff --git a/drivers/scsi/mesh.c b/drivers/scsi/mesh.c +index 1753e42826dd9..a880abf5abaad 100644 +--- a/drivers/scsi/mesh.c ++++ b/drivers/scsi/mesh.c +@@ -1044,6 +1044,8 @@ static void handle_error(struct mesh_state *ms) + while ((in_8(&mr->bus_status1) & BS1_RST) != 0) + udelay(1); + printk("done\n"); ++ if (ms->dma_started) ++ halt_dma(ms); + handle_reset(ms); + /* request_q is empty, no point in mesh_start() */ + return; +@@ -1356,7 +1358,8 @@ static void halt_dma(struct mesh_state *ms) + ms->conn_tgt, ms->data_ptr, scsi_bufflen(cmd), + ms->tgts[ms->conn_tgt].data_goes_out); + } +- scsi_dma_unmap(cmd); ++ if (cmd) ++ scsi_dma_unmap(cmd); + ms->dma_started = 0; + } + +@@ -1711,6 +1714,9 @@ static int mesh_host_reset(struct scsi_cmnd *cmd) + + spin_lock_irqsave(ms->host->host_lock, flags); + ++ if (ms->dma_started) ++ halt_dma(ms); ++ + /* Reset the controller & dbdma channel */ + out_le32(&md->control, (RUN|PAUSE|FLUSH|WAKE) << 16); /* stop dma */ + out_8(&mr->exception, 0xff); /* clear all exception bits */ +diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c +index ac936b5ca74e5..aba1a3396890b 100644 +--- a/drivers/scsi/scsi_debug.c ++++ b/drivers/scsi/scsi_debug.c +@@ -4993,6 +4993,12 @@ static int __init scsi_debug_init(void) + pr_err("submit_queues must be 1 or more\n"); + return -EINVAL; + } ++ ++ if ((sdebug_max_queue > SDEBUG_CANQUEUE) || (sdebug_max_queue < 1)) { ++ pr_err("max_queue must be in range [1, %d]\n", SDEBUG_CANQUEUE); ++ return -EINVAL; ++ } ++ + sdebug_q_arr = kcalloc(submit_queues, sizeof(struct sdebug_queue), + GFP_KERNEL); + if (sdebug_q_arr == NULL) +diff --git a/drivers/spi/spi-lantiq-ssc.c b/drivers/spi/spi-lantiq-ssc.c +index d5976615d924b..dc740b5f720ba 100644 +--- a/drivers/spi/spi-lantiq-ssc.c ++++ b/drivers/spi/spi-lantiq-ssc.c +@@ -187,6 +187,7 @@ struct lantiq_ssc_spi { + unsigned int tx_fifo_size; + unsigned int rx_fifo_size; + unsigned int base_cs; ++ unsigned int fdx_tx_level; + }; + + static u32 lantiq_ssc_readl(const struct lantiq_ssc_spi *spi, u32 reg) +@@ -484,6 +485,7 @@ static void tx_fifo_write(struct lantiq_ssc_spi *spi) + u32 data; + unsigned int tx_free = tx_fifo_free(spi); + ++ spi->fdx_tx_level = 0; + while (spi->tx_todo && tx_free) { + switch (spi->bits_per_word) { + case 2 ... 8: +@@ -512,6 +514,7 @@ static void tx_fifo_write(struct lantiq_ssc_spi *spi) + + lantiq_ssc_writel(spi, data, LTQ_SPI_TB); + tx_free--; ++ spi->fdx_tx_level++; + } + } + +@@ -523,6 +526,13 @@ static void rx_fifo_read_full_duplex(struct lantiq_ssc_spi *spi) + u32 data; + unsigned int rx_fill = rx_fifo_level(spi); + ++ /* ++ * Wait until all expected data to be shifted in. ++ * Otherwise, rx overrun may occur. ++ */ ++ while (rx_fill != spi->fdx_tx_level) ++ rx_fill = rx_fifo_level(spi); ++ + while (rx_fill) { + data = lantiq_ssc_readl(spi, LTQ_SPI_RB); + +diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c +index 167047760d79a..e444e7cc6968d 100644 +--- a/drivers/spi/spidev.c ++++ b/drivers/spi/spidev.c +@@ -232,6 +232,11 @@ static int spidev_message(struct spidev_data *spidev, + for (n = n_xfers, k_tmp = k_xfers, u_tmp = u_xfers; + n; + n--, k_tmp++, u_tmp++) { ++ /* Ensure that also following allocations from rx_buf/tx_buf will meet ++ * DMA alignment requirements. ++ */ ++ unsigned int len_aligned = ALIGN(u_tmp->len, ARCH_KMALLOC_MINALIGN); ++ + k_tmp->len = u_tmp->len; + + total += k_tmp->len; +@@ -247,17 +252,17 @@ static int spidev_message(struct spidev_data *spidev, + + if (u_tmp->rx_buf) { + /* this transfer needs space in RX bounce buffer */ +- rx_total += k_tmp->len; ++ rx_total += len_aligned; + if (rx_total > bufsiz) { + status = -EMSGSIZE; + goto done; + } + k_tmp->rx_buf = rx_buf; +- rx_buf += k_tmp->len; ++ rx_buf += len_aligned; + } + if (u_tmp->tx_buf) { + /* this transfer needs space in TX bounce buffer */ +- tx_total += k_tmp->len; ++ tx_total += len_aligned; + if (tx_total > bufsiz) { + status = -EMSGSIZE; + goto done; +@@ -267,7 +272,7 @@ static int spidev_message(struct spidev_data *spidev, + (uintptr_t) u_tmp->tx_buf, + u_tmp->len)) + goto done; +- tx_buf += k_tmp->len; ++ tx_buf += len_aligned; + } + + k_tmp->cs_change = !!u_tmp->cs_change; +@@ -297,16 +302,16 @@ static int spidev_message(struct spidev_data *spidev, + goto done; + + /* copy any rx data out of bounce buffer */ +- rx_buf = spidev->rx_buffer; +- for (n = n_xfers, u_tmp = u_xfers; n; n--, u_tmp++) { ++ for (n = n_xfers, k_tmp = k_xfers, u_tmp = u_xfers; ++ n; ++ n--, k_tmp++, u_tmp++) { + if (u_tmp->rx_buf) { + if (copy_to_user((u8 __user *) +- (uintptr_t) u_tmp->rx_buf, rx_buf, ++ (uintptr_t) u_tmp->rx_buf, k_tmp->rx_buf, + u_tmp->len)) { + status = -EFAULT; + goto done; + } +- rx_buf += u_tmp->len; + } + } + status = total; +diff --git a/drivers/staging/android/ashmem.c b/drivers/staging/android/ashmem.c +index 9481c0b233860..22cae548df49f 100644 +--- a/drivers/staging/android/ashmem.c ++++ b/drivers/staging/android/ashmem.c +@@ -100,6 +100,15 @@ static DEFINE_MUTEX(ashmem_mutex); + static struct kmem_cache *ashmem_area_cachep __read_mostly; + static struct kmem_cache *ashmem_range_cachep __read_mostly; + ++/* ++ * A separate lockdep class for the backing shmem inodes to resolve the lockdep ++ * warning about the race between kswapd taking fs_reclaim before inode_lock ++ * and write syscall taking inode_lock and then fs_reclaim. ++ * Note that such race is impossible because ashmem does not support write ++ * syscalls operating on the backing shmem. ++ */ ++static struct lock_class_key backing_shmem_inode_class; ++ + static inline unsigned long range_size(struct ashmem_range *range) + { + return range->pgend - range->pgstart + 1; +@@ -406,6 +415,7 @@ static int ashmem_mmap(struct file *file, struct vm_area_struct *vma) + if (!asma->file) { + char *name = ASHMEM_NAME_DEF; + struct file *vmfile; ++ struct inode *inode; + + if (asma->name[ASHMEM_NAME_PREFIX_LEN] != '\0') + name = asma->name; +@@ -417,6 +427,8 @@ static int ashmem_mmap(struct file *file, struct vm_area_struct *vma) + goto out; + } + vmfile->f_mode |= FMODE_LSEEK; ++ inode = file_inode(vmfile); ++ lockdep_set_class(&inode->i_rwsem, &backing_shmem_inode_class); + asma->file = vmfile; + /* + * override mmap operation of the vmfile so that it can't be +diff --git a/drivers/staging/rtl8192u/r8192U_core.c b/drivers/staging/rtl8192u/r8192U_core.c +index fbbd1b59dc11d..b5941ae410d9a 100644 +--- a/drivers/staging/rtl8192u/r8192U_core.c ++++ b/drivers/staging/rtl8192u/r8192U_core.c +@@ -2519,7 +2519,7 @@ static int rtl8192_read_eeprom_info(struct net_device *dev) + ret = eprom_read(dev, (EEPROM_TxPwIndex_CCK >> 1)); + if (ret < 0) + return ret; +- priv->EEPROMTxPowerLevelCCK = ((u16)ret & 0xff) >> 8; ++ priv->EEPROMTxPowerLevelCCK = ((u16)ret & 0xff00) >> 8; + } else + priv->EEPROMTxPowerLevelCCK = 0x10; + RT_TRACE(COMP_EPROM, "CCK Tx Power Levl: 0x%02x\n", priv->EEPROMTxPowerLevelCCK); +diff --git a/drivers/thermal/ti-soc-thermal/ti-thermal-common.c b/drivers/thermal/ti-soc-thermal/ti-thermal-common.c +index fa98c398d70f3..d43fbe4ad767e 100644 +--- a/drivers/thermal/ti-soc-thermal/ti-thermal-common.c ++++ b/drivers/thermal/ti-soc-thermal/ti-thermal-common.c +@@ -183,7 +183,7 @@ int ti_thermal_expose_sensor(struct ti_bandgap *bgp, int id, + + data = ti_bandgap_get_sensor_data(bgp, id); + +- if (!IS_ERR_OR_NULL(data)) ++ if (IS_ERR_OR_NULL(data)) + data = ti_thermal_build_data(bgp, id); + + if (!data) +diff --git a/drivers/usb/dwc2/platform.c b/drivers/usb/dwc2/platform.c +index 442cb93935dd4..405dccf92a315 100644 +--- a/drivers/usb/dwc2/platform.c ++++ b/drivers/usb/dwc2/platform.c +@@ -459,6 +459,7 @@ static int dwc2_driver_probe(struct platform_device *dev) + if (hsotg->gadget_enabled) { + retval = usb_add_gadget_udc(hsotg->dev, &hsotg->gadget); + if (retval) { ++ hsotg->gadget.udc = NULL; + dwc2_hsotg_remove(hsotg); + goto error; + } +@@ -467,7 +468,8 @@ static int dwc2_driver_probe(struct platform_device *dev) + return 0; + + error: +- dwc2_lowlevel_hw_disable(hsotg); ++ if (hsotg->dr_mode != USB_DR_MODE_PERIPHERAL) ++ dwc2_lowlevel_hw_disable(hsotg); + return retval; + } + +diff --git a/drivers/usb/gadget/udc/bdc/bdc_core.c b/drivers/usb/gadget/udc/bdc/bdc_core.c +index 7a8af4b916cff..58ba04d858bab 100644 +--- a/drivers/usb/gadget/udc/bdc/bdc_core.c ++++ b/drivers/usb/gadget/udc/bdc/bdc_core.c +@@ -288,6 +288,7 @@ static void bdc_mem_init(struct bdc *bdc, bool reinit) + * in that case reinit is passed as 1 + */ + if (reinit) { ++ int i; + /* Enable interrupts */ + temp = bdc_readl(bdc->regs, BDC_BDCSC); + temp |= BDC_GIE; +@@ -297,6 +298,9 @@ static void bdc_mem_init(struct bdc *bdc, bool reinit) + /* Initialize SRR to 0 */ + memset(bdc->srr.sr_bds, 0, + NUM_SR_ENTRIES * sizeof(struct bdc_bd)); ++ /* clear ep flags to avoid post disconnect stops/deconfigs */ ++ for (i = 1; i < bdc->num_eps; ++i) ++ bdc->bdc_ep_array[i]->flags = 0; + } else { + /* One time initiaization only */ + /* Enable status report function pointers */ +@@ -609,9 +613,14 @@ static int bdc_remove(struct platform_device *pdev) + static int bdc_suspend(struct device *dev) + { + struct bdc *bdc = dev_get_drvdata(dev); ++ int ret; + +- clk_disable_unprepare(bdc->clk); +- return 0; ++ /* Halt the controller */ ++ ret = bdc_stop(bdc); ++ if (!ret) ++ clk_disable_unprepare(bdc->clk); ++ ++ return ret; + } + + static int bdc_resume(struct device *dev) +diff --git a/drivers/usb/gadget/udc/bdc/bdc_ep.c b/drivers/usb/gadget/udc/bdc/bdc_ep.c +index be9f40bc9c12b..bb2d5ebd97b52 100644 +--- a/drivers/usb/gadget/udc/bdc/bdc_ep.c ++++ b/drivers/usb/gadget/udc/bdc/bdc_ep.c +@@ -621,7 +621,6 @@ int bdc_ep_enable(struct bdc_ep *ep) + } + bdc_dbg_bd_list(bdc, ep); + /* only for ep0: config ep is called for ep0 from connect event */ +- ep->flags |= BDC_EP_ENABLED; + if (ep->ep_num == 1) + return ret; + +@@ -765,10 +764,13 @@ static int ep_dequeue(struct bdc_ep *ep, struct bdc_req *req) + __func__, ep->name, start_bdi, end_bdi); + dev_dbg(bdc->dev, "ep_dequeue ep=%p ep->desc=%p\n", + ep, (void *)ep->usb_ep.desc); +- /* Stop the ep to see where the HW is ? */ +- ret = bdc_stop_ep(bdc, ep->ep_num); +- /* if there is an issue with stopping ep, then no need to go further */ +- if (ret) ++ /* if still connected, stop the ep to see where the HW is ? */ ++ if (!(bdc_readl(bdc->regs, BDC_USPC) & BDC_PST_MASK)) { ++ ret = bdc_stop_ep(bdc, ep->ep_num); ++ /* if there is an issue, then no need to go further */ ++ if (ret) ++ return 0; ++ } else + return 0; + + /* +@@ -1917,7 +1919,9 @@ static int bdc_gadget_ep_disable(struct usb_ep *_ep) + __func__, ep->name, ep->flags); + + if (!(ep->flags & BDC_EP_ENABLED)) { +- dev_warn(bdc->dev, "%s is already disabled\n", ep->name); ++ if (bdc->gadget.speed != USB_SPEED_UNKNOWN) ++ dev_warn(bdc->dev, "%s is already disabled\n", ++ ep->name); + return 0; + } + spin_lock_irqsave(&bdc->lock, flags); +diff --git a/drivers/usb/gadget/udc/net2280.c b/drivers/usb/gadget/udc/net2280.c +index 170327f84ea19..f1ac9a49e2bf1 100644 +--- a/drivers/usb/gadget/udc/net2280.c ++++ b/drivers/usb/gadget/udc/net2280.c +@@ -3786,8 +3786,10 @@ static int net2280_probe(struct pci_dev *pdev, const struct pci_device_id *id) + return 0; + + done: +- if (dev) ++ if (dev) { + net2280_remove(pdev); ++ kfree(dev); ++ } + return retval; + } + +diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c +index d4e29039305b8..72c3ba0824f70 100644 +--- a/drivers/usb/host/xhci-pci.c ++++ b/drivers/usb/host/xhci-pci.c +@@ -59,7 +59,10 @@ + #define PCI_DEVICE_ID_AMD_PROMONTORYA_3 0x43ba + #define PCI_DEVICE_ID_AMD_PROMONTORYA_2 0x43bb + #define PCI_DEVICE_ID_AMD_PROMONTORYA_1 0x43bc ++#define PCI_DEVICE_ID_ASMEDIA_1042_XHCI 0x1042 + #define PCI_DEVICE_ID_ASMEDIA_1042A_XHCI 0x1142 ++#define PCI_DEVICE_ID_ASMEDIA_1142_XHCI 0x1242 ++#define PCI_DEVICE_ID_ASMEDIA_2142_XHCI 0x2142 + + static const char hcd_name[] = "xhci_hcd"; + +@@ -230,13 +233,14 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) + xhci->quirks |= XHCI_BROKEN_STREAMS; + + if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA && +- pdev->device == 0x1042) ++ pdev->device == PCI_DEVICE_ID_ASMEDIA_1042_XHCI) + xhci->quirks |= XHCI_BROKEN_STREAMS; + if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA && +- pdev->device == 0x1142) ++ pdev->device == PCI_DEVICE_ID_ASMEDIA_1042A_XHCI) + xhci->quirks |= XHCI_TRUST_TX_LENGTH; + if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA && +- pdev->device == 0x2142) ++ (pdev->device == PCI_DEVICE_ID_ASMEDIA_1142_XHCI || ++ pdev->device == PCI_DEVICE_ID_ASMEDIA_2142_XHCI)) + xhci->quirks |= XHCI_NO_64BIT_SUPPORT; + + if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA && +diff --git a/drivers/usb/misc/iowarrior.c b/drivers/usb/misc/iowarrior.c +index 1ec32e5aa004c..27e1ab9e1b079 100644 +--- a/drivers/usb/misc/iowarrior.c ++++ b/drivers/usb/misc/iowarrior.c +@@ -1,8 +1,9 @@ + /* + * Native support for the I/O-Warrior USB devices + * +- * Copyright (c) 2003-2005 Code Mercenaries GmbH +- * written by Christian Lucht ++ * Copyright (c) 2003-2005, 2020 Code Mercenaries GmbH ++ * written by Christian Lucht and ++ * Christoph Jung + * + * based on + +@@ -821,14 +822,28 @@ static int iowarrior_probe(struct usb_interface *interface, + + /* we have to check the report_size often, so remember it in the endianness suitable for our machine */ + dev->report_size = usb_endpoint_maxp(dev->int_in_endpoint); +- if ((dev->interface->cur_altsetting->desc.bInterfaceNumber == 0) && +- ((dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW56) || +- (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW56AM) || +- (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW28) || +- (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW28L) || +- (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW100))) +- /* IOWarrior56 has wMaxPacketSize different from report size */ +- dev->report_size = 7; ++ ++ /* ++ * Some devices need the report size to be different than the ++ * endpoint size. ++ */ ++ if (dev->interface->cur_altsetting->desc.bInterfaceNumber == 0) { ++ switch (dev->product_id) { ++ case USB_DEVICE_ID_CODEMERCS_IOW56: ++ case USB_DEVICE_ID_CODEMERCS_IOW56AM: ++ dev->report_size = 7; ++ break; ++ ++ case USB_DEVICE_ID_CODEMERCS_IOW28: ++ case USB_DEVICE_ID_CODEMERCS_IOW28L: ++ dev->report_size = 4; ++ break; ++ ++ case USB_DEVICE_ID_CODEMERCS_IOW100: ++ dev->report_size = 13; ++ break; ++ } ++ } + + /* create the urb and buffer for reading */ + dev->int_in_urb = usb_alloc_urb(0, GFP_KERNEL); +diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c +index 8dd9852f399db..630c8338d7912 100644 +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -271,6 +271,8 @@ static struct usb_serial_driver cp210x_device = { + .break_ctl = cp210x_break_ctl, + .set_termios = cp210x_set_termios, + .tx_empty = cp210x_tx_empty, ++ .throttle = usb_serial_generic_throttle, ++ .unthrottle = usb_serial_generic_unthrottle, + .tiocmget = cp210x_tiocmget, + .tiocmset = cp210x_tiocmset, + .attach = cp210x_attach, +@@ -925,6 +927,7 @@ static void cp210x_get_termios_port(struct usb_serial_port *port, + u32 baud; + u16 bits; + u32 ctl_hs; ++ u32 flow_repl; + + cp210x_read_u32_reg(port, CP210X_GET_BAUDRATE, &baud); + +@@ -1025,6 +1028,22 @@ static void cp210x_get_termios_port(struct usb_serial_port *port, + ctl_hs = le32_to_cpu(flow_ctl.ulControlHandshake); + if (ctl_hs & CP210X_SERIAL_CTS_HANDSHAKE) { + dev_dbg(dev, "%s - flow control = CRTSCTS\n", __func__); ++ /* ++ * When the port is closed, the CP210x hardware disables ++ * auto-RTS and RTS is deasserted but it leaves auto-CTS when ++ * in hardware flow control mode. When re-opening the port, if ++ * auto-CTS is enabled on the cp210x, then auto-RTS must be ++ * re-enabled in the driver. ++ */ ++ flow_repl = le32_to_cpu(flow_ctl.ulFlowReplace); ++ flow_repl &= ~CP210X_SERIAL_RTS_MASK; ++ flow_repl |= CP210X_SERIAL_RTS_SHIFT(CP210X_SERIAL_RTS_FLOW_CTL); ++ flow_ctl.ulFlowReplace = cpu_to_le32(flow_repl); ++ cp210x_write_reg_block(port, ++ CP210X_SET_FLOW, ++ &flow_ctl, ++ sizeof(flow_ctl)); ++ + cflag |= CRTSCTS; + } else { + dev_dbg(dev, "%s - flow control = NONE\n", __func__); +diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c +index a962065227c48..8abb30c797d30 100644 +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -2042,12 +2042,11 @@ static int ftdi_prepare_write_buffer(struct usb_serial_port *port, + #define FTDI_RS_ERR_MASK (FTDI_RS_BI | FTDI_RS_PE | FTDI_RS_FE | FTDI_RS_OE) + + static int ftdi_process_packet(struct usb_serial_port *port, +- struct ftdi_private *priv, char *packet, int len) ++ struct ftdi_private *priv, unsigned char *buf, int len) + { ++ unsigned char status; + int i; +- char status; + char flag; +- char *ch; + + if (len < 2) { + dev_dbg(&port->dev, "malformed packet\n"); +@@ -2057,7 +2056,7 @@ static int ftdi_process_packet(struct usb_serial_port *port, + /* Compare new line status to the old one, signal if different/ + N.B. packet may be processed more than once, but differences + are only processed once. */ +- status = packet[0] & FTDI_STATUS_B0_MASK; ++ status = buf[0] & FTDI_STATUS_B0_MASK; + if (status != priv->prev_status) { + char diff_status = status ^ priv->prev_status; + +@@ -2083,13 +2082,12 @@ static int ftdi_process_packet(struct usb_serial_port *port, + } + + /* save if the transmitter is empty or not */ +- if (packet[1] & FTDI_RS_TEMT) ++ if (buf[1] & FTDI_RS_TEMT) + priv->transmit_empty = 1; + else + priv->transmit_empty = 0; + +- len -= 2; +- if (!len) ++ if (len == 2) + return 0; /* status only */ + + /* +@@ -2097,40 +2095,41 @@ static int ftdi_process_packet(struct usb_serial_port *port, + * data payload to avoid over-reporting. + */ + flag = TTY_NORMAL; +- if (packet[1] & FTDI_RS_ERR_MASK) { ++ if (buf[1] & FTDI_RS_ERR_MASK) { + /* Break takes precedence over parity, which takes precedence + * over framing errors */ +- if (packet[1] & FTDI_RS_BI) { ++ if (buf[1] & FTDI_RS_BI) { + flag = TTY_BREAK; + port->icount.brk++; + usb_serial_handle_break(port); +- } else if (packet[1] & FTDI_RS_PE) { ++ } else if (buf[1] & FTDI_RS_PE) { + flag = TTY_PARITY; + port->icount.parity++; +- } else if (packet[1] & FTDI_RS_FE) { ++ } else if (buf[1] & FTDI_RS_FE) { + flag = TTY_FRAME; + port->icount.frame++; + } + /* Overrun is special, not associated with a char */ +- if (packet[1] & FTDI_RS_OE) { ++ if (buf[1] & FTDI_RS_OE) { + port->icount.overrun++; + tty_insert_flip_char(&port->port, 0, TTY_OVERRUN); + } + } + +- port->icount.rx += len; +- ch = packet + 2; ++ port->icount.rx += len - 2; + + if (port->port.console && port->sysrq) { +- for (i = 0; i < len; i++, ch++) { +- if (!usb_serial_handle_sysrq_char(port, *ch)) +- tty_insert_flip_char(&port->port, *ch, flag); ++ for (i = 2; i < len; i++) { ++ if (usb_serial_handle_sysrq_char(port, buf[i])) ++ continue; ++ tty_insert_flip_char(&port->port, buf[i], flag); + } + } else { +- tty_insert_flip_string_fixed_flag(&port->port, ch, flag, len); ++ tty_insert_flip_string_fixed_flag(&port->port, buf + 2, flag, ++ len - 2); + } + +- return len; ++ return len - 2; + } + + static void ftdi_process_read_urb(struct urb *urb) +diff --git a/drivers/usb/serial/iuu_phoenix.c b/drivers/usb/serial/iuu_phoenix.c +index a1a11f8bb2a3d..0c9e24b217f7d 100644 +--- a/drivers/usb/serial/iuu_phoenix.c ++++ b/drivers/usb/serial/iuu_phoenix.c +@@ -359,10 +359,11 @@ static void iuu_led_activity_on(struct urb *urb) + struct usb_serial_port *port = urb->context; + int result; + char *buf_ptr = port->write_urb->transfer_buffer; +- *buf_ptr++ = IUU_SET_LED; ++ + if (xmas) { +- get_random_bytes(buf_ptr, 6); +- *(buf_ptr+7) = 1; ++ buf_ptr[0] = IUU_SET_LED; ++ get_random_bytes(buf_ptr + 1, 6); ++ buf_ptr[7] = 1; + } else { + iuu_rgbf_fill_buffer(buf_ptr, 255, 255, 0, 0, 0, 0, 255); + } +@@ -380,13 +381,14 @@ static void iuu_led_activity_off(struct urb *urb) + struct usb_serial_port *port = urb->context; + int result; + char *buf_ptr = port->write_urb->transfer_buffer; ++ + if (xmas) { + iuu_rxcmd(urb); + return; +- } else { +- *buf_ptr++ = IUU_SET_LED; +- iuu_rgbf_fill_buffer(buf_ptr, 0, 0, 255, 255, 0, 0, 255); + } ++ ++ iuu_rgbf_fill_buffer(buf_ptr, 0, 0, 255, 255, 0, 0, 255); ++ + usb_fill_bulk_urb(port->write_urb, port->serial->dev, + usb_sndbulkpipe(port->serial->dev, + port->bulk_out_endpointAddress), +diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c +index 27b4082f4d190..7662b2eb50d85 100644 +--- a/drivers/usb/serial/qcserial.c ++++ b/drivers/usb/serial/qcserial.c +@@ -159,6 +159,7 @@ static const struct usb_device_id id_table[] = { + {DEVICE_SWI(0x1199, 0x9056)}, /* Sierra Wireless Modem */ + {DEVICE_SWI(0x1199, 0x9060)}, /* Sierra Wireless Modem */ + {DEVICE_SWI(0x1199, 0x9061)}, /* Sierra Wireless Modem */ ++ {DEVICE_SWI(0x1199, 0x9062)}, /* Sierra Wireless EM7305 QDL */ + {DEVICE_SWI(0x1199, 0x9063)}, /* Sierra Wireless EM7305 */ + {DEVICE_SWI(0x1199, 0x9070)}, /* Sierra Wireless MC74xx */ + {DEVICE_SWI(0x1199, 0x9071)}, /* Sierra Wireless MC74xx */ +diff --git a/drivers/video/console/newport_con.c b/drivers/video/console/newport_con.c +index 42d02a206059b..d3b0850391e0d 100644 +--- a/drivers/video/console/newport_con.c ++++ b/drivers/video/console/newport_con.c +@@ -31,6 +31,8 @@ + #include + #include + ++#define NEWPORT_LEN 0x10000 ++ + #define FONT_DATA ((unsigned char *)font_vga_8x16.data) + + /* borrowed from fbcon.c */ +@@ -42,6 +44,7 @@ + static unsigned char *font_data[MAX_NR_CONSOLES]; + + static struct newport_regs *npregs; ++static unsigned long newport_addr; + + static int logo_active; + static int topscan; +@@ -701,7 +704,6 @@ const struct consw newport_con = { + static int newport_probe(struct gio_device *dev, + const struct gio_device_id *id) + { +- unsigned long newport_addr; + int err; + + if (!dev->resource.start) +@@ -711,7 +713,7 @@ static int newport_probe(struct gio_device *dev, + return -EBUSY; /* we only support one Newport as console */ + + newport_addr = dev->resource.start + 0xF0000; +- if (!request_mem_region(newport_addr, 0x10000, "Newport")) ++ if (!request_mem_region(newport_addr, NEWPORT_LEN, "Newport")) + return -ENODEV; + + npregs = (struct newport_regs *)/* ioremap cannot fail */ +@@ -719,6 +721,11 @@ static int newport_probe(struct gio_device *dev, + console_lock(); + err = do_take_over_console(&newport_con, 0, MAX_NR_CONSOLES - 1, 1); + console_unlock(); ++ ++ if (err) { ++ iounmap((void *)npregs); ++ release_mem_region(newport_addr, NEWPORT_LEN); ++ } + return err; + } + +@@ -726,6 +733,7 @@ static void newport_remove(struct gio_device *dev) + { + give_up_console(&newport_con); + iounmap((void *)npregs); ++ release_mem_region(newport_addr, NEWPORT_LEN); + } + + static struct gio_device_id newport_ids[] = { +diff --git a/drivers/video/console/vgacon.c b/drivers/video/console/vgacon.c +index ff6612a3ddc8d..8f061c18e115e 100644 +--- a/drivers/video/console/vgacon.c ++++ b/drivers/video/console/vgacon.c +@@ -246,6 +246,10 @@ static void vgacon_scrollback_update(struct vc_data *c, int t, int count) + p = (void *) (c->vc_origin + t * c->vc_size_row); + + while (count--) { ++ if ((vgacon_scrollback_cur->tail + c->vc_size_row) > ++ vgacon_scrollback_cur->size) ++ vgacon_scrollback_cur->tail = 0; ++ + scr_memcpyw(vgacon_scrollback_cur->data + + vgacon_scrollback_cur->tail, + p, c->vc_size_row); +diff --git a/drivers/video/fbdev/neofb.c b/drivers/video/fbdev/neofb.c +index 5d3a444083f74..2018e1ca33eb6 100644 +--- a/drivers/video/fbdev/neofb.c ++++ b/drivers/video/fbdev/neofb.c +@@ -1820,6 +1820,7 @@ static int neo_scan_monitor(struct fb_info *info) + #else + printk(KERN_ERR + "neofb: Only 640x480, 800x600/480 and 1024x768 panels are currently supported\n"); ++ kfree(info->monspecs.modedb); + return -1; + #endif + default: +diff --git a/drivers/video/fbdev/omap2/omapfb/dss/dss.c b/drivers/video/fbdev/omap2/omapfb/dss/dss.c +index 48c6500c24e1f..4429ad37b64cd 100644 +--- a/drivers/video/fbdev/omap2/omapfb/dss/dss.c ++++ b/drivers/video/fbdev/omap2/omapfb/dss/dss.c +@@ -843,7 +843,7 @@ static const struct dss_features omap34xx_dss_feats = { + }; + + static const struct dss_features omap3630_dss_feats = { +- .fck_div_max = 32, ++ .fck_div_max = 31, + .dss_fck_multiplier = 1, + .parent_clk_name = "dpll4_ck", + .dpi_select_source = &dss_dpi_select_source_omap2_omap3, +diff --git a/drivers/video/fbdev/pxafb.c b/drivers/video/fbdev/pxafb.c +index 29f00eccdd015..08ee77d5df8b2 100644 +--- a/drivers/video/fbdev/pxafb.c ++++ b/drivers/video/fbdev/pxafb.c +@@ -2449,8 +2449,8 @@ static int pxafb_remove(struct platform_device *dev) + + free_pages_exact(fbi->video_mem, fbi->video_mem_size); + +- dma_free_wc(&dev->dev, fbi->dma_buff_size, fbi->dma_buff, +- fbi->dma_buff_phys); ++ dma_free_coherent(&dev->dev, fbi->dma_buff_size, fbi->dma_buff, ++ fbi->dma_buff_phys); + + iounmap(fbi->mmio_base); + +diff --git a/drivers/video/fbdev/sm712fb.c b/drivers/video/fbdev/sm712fb.c +index f1dcc6766d1ef..1781ca697f66b 100644 +--- a/drivers/video/fbdev/sm712fb.c ++++ b/drivers/video/fbdev/sm712fb.c +@@ -1429,6 +1429,8 @@ static int smtc_map_smem(struct smtcfb_info *sfb, + static void smtc_unmap_smem(struct smtcfb_info *sfb) + { + if (sfb && sfb->fb->screen_base) { ++ if (sfb->chip_id == 0x720) ++ sfb->fb->screen_base -= 0x00200000; + iounmap(sfb->fb->screen_base); + sfb->fb->screen_base = NULL; + } +diff --git a/drivers/watchdog/f71808e_wdt.c b/drivers/watchdog/f71808e_wdt.c +index 88cd2a52d8d32..ae4974701e5c7 100644 +--- a/drivers/watchdog/f71808e_wdt.c ++++ b/drivers/watchdog/f71808e_wdt.c +@@ -688,9 +688,9 @@ static int __init watchdog_init(int sioaddr) + * into the module have been registered yet. + */ + watchdog.sioaddr = sioaddr; +- watchdog.ident.options = WDIOC_SETTIMEOUT +- | WDIOF_MAGICCLOSE +- | WDIOF_KEEPALIVEPING; ++ watchdog.ident.options = WDIOF_MAGICCLOSE ++ | WDIOF_KEEPALIVEPING ++ | WDIOF_CARDRESET; + + snprintf(watchdog.ident.identity, + sizeof(watchdog.ident.identity), "%s watchdog", +@@ -704,6 +704,13 @@ static int __init watchdog_init(int sioaddr) + wdt_conf = superio_inb(sioaddr, F71808FG_REG_WDT_CONF); + watchdog.caused_reboot = wdt_conf & BIT(F71808FG_FLAG_WDTMOUT_STS); + ++ /* ++ * We don't want WDTMOUT_STS to stick around till regular reboot. ++ * Write 1 to the bit to clear it to zero. ++ */ ++ superio_outb(sioaddr, F71808FG_REG_WDT_CONF, ++ wdt_conf | BIT(F71808FG_FLAG_WDTMOUT_STS)); ++ + superio_exit(sioaddr); + + err = watchdog_set_timeout(timeout); +diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c +index 3f9260af701f0..a8e0836dffd4b 100644 +--- a/drivers/xen/balloon.c ++++ b/drivers/xen/balloon.c +@@ -633,11 +633,13 @@ static int add_ballooned_pages(int nr_pages) + if (xen_hotplug_unpopulated) { + st = reserve_additional_memory(); + if (st != BP_ECANCELED) { ++ int rc; ++ + mutex_unlock(&balloon_mutex); +- wait_event(balloon_wq, ++ rc = wait_event_interruptible(balloon_wq, + !list_empty(&ballooned_pages)); + mutex_lock(&balloon_mutex); +- return 0; ++ return rc ? -ENOMEM : 0; + } + } + +@@ -695,6 +697,12 @@ int alloc_xenballooned_pages(int nr_pages, struct page **pages) + out_undo: + mutex_unlock(&balloon_mutex); + free_xenballooned_pages(pgno, pages); ++ /* ++ * NB: free_xenballooned_pages will only subtract pgno pages, but since ++ * target_unpopulated is incremented with nr_pages at the start we need ++ * to remove the remaining ones also, or accounting will be screwed. ++ */ ++ balloon_stats.target_unpopulated -= nr_pages - pgno; + return ret; + } + EXPORT_SYMBOL(alloc_xenballooned_pages); +diff --git a/fs/9p/v9fs.c b/fs/9p/v9fs.c +index c52f10efdc9c6..b4dbe7b711512 100644 +--- a/fs/9p/v9fs.c ++++ b/fs/9p/v9fs.c +@@ -513,10 +513,9 @@ void v9fs_session_close(struct v9fs_session_info *v9ses) + } + + #ifdef CONFIG_9P_FSCACHE +- if (v9ses->fscache) { ++ if (v9ses->fscache) + v9fs_cache_session_put_cookie(v9ses); +- kfree(v9ses->cachetag); +- } ++ kfree(v9ses->cachetag); + #endif + kfree(v9ses->uname); + kfree(v9ses->aname); +diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c +index 096c015b22a46..893066970c689 100644 +--- a/fs/btrfs/disk-io.c ++++ b/fs/btrfs/disk-io.c +@@ -1509,9 +1509,16 @@ int btrfs_init_fs_root(struct btrfs_root *root) + spin_lock_init(&root->ino_cache_lock); + init_waitqueue_head(&root->ino_cache_wait); + +- ret = get_anon_bdev(&root->anon_dev); +- if (ret) +- goto fail; ++ /* ++ * Don't assign anonymous block device to roots that are not exposed to ++ * userspace, the id pool is limited to 1M ++ */ ++ if (is_fstree(root->root_key.objectid) && ++ btrfs_root_refs(&root->root_item) > 0) { ++ ret = get_anon_bdev(&root->anon_dev); ++ if (ret) ++ goto fail; ++ } + + mutex_lock(&root->objectid_mutex); + ret = btrfs_find_highest_objectid(root, +diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c +index 6d2bfbb63d9ba..ef1fd6a09d8e5 100644 +--- a/fs/btrfs/extent_io.c ++++ b/fs/btrfs/extent_io.c +@@ -4323,6 +4323,8 @@ int try_release_extent_mapping(struct extent_map_tree *map, + + /* once for us */ + free_extent_map(em); ++ ++ cond_resched(); /* Allow large-extent preemption. */ + } + } + return try_release_extent_state(map, tree, page, mask); +diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c +index abeb26d48d0a2..57f89708fab1c 100644 +--- a/fs/btrfs/free-space-cache.c ++++ b/fs/btrfs/free-space-cache.c +@@ -2169,7 +2169,7 @@ out: + static bool try_merge_free_space(struct btrfs_free_space_ctl *ctl, + struct btrfs_free_space *info, bool update_stat) + { +- struct btrfs_free_space *left_info; ++ struct btrfs_free_space *left_info = NULL; + struct btrfs_free_space *right_info; + bool merged = false; + u64 offset = info->offset; +@@ -2184,7 +2184,7 @@ static bool try_merge_free_space(struct btrfs_free_space_ctl *ctl, + if (right_info && rb_prev(&right_info->offset_index)) + left_info = rb_entry(rb_prev(&right_info->offset_index), + struct btrfs_free_space, offset_index); +- else ++ else if (!right_info) + left_info = tree_search_offset(ctl, offset - 1, 0, 0); + + if (right_info && !right_info->bitmap) { +diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c +index bcfb7a772c8e5..3d30bf90d59ec 100644 +--- a/fs/btrfs/tree-log.c ++++ b/fs/btrfs/tree-log.c +@@ -3854,11 +3854,8 @@ static noinline int copy_items(struct btrfs_trans_handle *trans, + fs_info->csum_root, + ds + cs, ds + cs + cl - 1, + &ordered_sums, 0); +- if (ret) { +- btrfs_release_path(dst_path); +- kfree(ins_data); +- return ret; +- } ++ if (ret) ++ break; + } + } + } +@@ -3871,7 +3868,6 @@ static noinline int copy_items(struct btrfs_trans_handle *trans, + * we have to do this after the loop above to avoid changing the + * log tree while trying to change the log tree. + */ +- ret = 0; + while (!list_empty(&ordered_sums)) { + struct btrfs_ordered_sum *sums = list_entry(ordered_sums.next, + struct btrfs_ordered_sum, +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index 1c87a429ce72f..2097b5fd51baa 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -942,6 +942,8 @@ SMB2_auth_kerberos(struct SMB2_sess_data *sess_data) + spnego_key = cifs_get_spnego_key(ses); + if (IS_ERR(spnego_key)) { + rc = PTR_ERR(spnego_key); ++ if (rc == -ENOKEY) ++ cifs_dbg(VFS, "Verify user has a krb5 ticket and keyutils is installed\n"); + spnego_key = NULL; + goto out; + } +diff --git a/fs/dlm/lockspace.c b/fs/dlm/lockspace.c +index 9c8c9a09b4a6d..7a6b0327ceb0b 100644 +--- a/fs/dlm/lockspace.c ++++ b/fs/dlm/lockspace.c +@@ -633,6 +633,9 @@ static int new_lockspace(const char *name, const char *cluster, + wait_event(ls->ls_recover_lock_wait, + test_bit(LSFL_RECOVER_LOCK, &ls->ls_flags)); + ++ /* let kobject handle freeing of ls if there's an error */ ++ do_unreg = 1; ++ + ls->ls_kobj.kset = dlm_kset; + error = kobject_init_and_add(&ls->ls_kobj, &dlm_ktype, NULL, + "%s", ls->ls_name); +@@ -640,9 +643,6 @@ static int new_lockspace(const char *name, const char *cluster, + goto out_recoverd; + kobject_uevent(&ls->ls_kobj, KOBJ_ADD); + +- /* let kobject handle freeing of ls if there's an error */ +- do_unreg = 1; +- + /* This uevent triggers dlm_controld in userspace to add us to the + group of nodes that are members of this lockspace (managed by the + cluster infrastructure.) Once it's done that, it tells us who the +diff --git a/fs/ext2/ialloc.c b/fs/ext2/ialloc.c +index a1fc3dabca41b..6d5fce776d8e3 100644 +--- a/fs/ext2/ialloc.c ++++ b/fs/ext2/ialloc.c +@@ -80,6 +80,7 @@ static void ext2_release_inode(struct super_block *sb, int group, int dir) + if (dir) + le16_add_cpu(&desc->bg_used_dirs_count, -1); + spin_unlock(sb_bgl_lock(EXT2_SB(sb), group)); ++ percpu_counter_inc(&EXT2_SB(sb)->s_freeinodes_counter); + if (dir) + percpu_counter_dec(&EXT2_SB(sb)->s_dirs_counter); + mark_buffer_dirty(bh); +@@ -531,7 +532,7 @@ got: + goto fail; + } + +- percpu_counter_add(&sbi->s_freeinodes_counter, -1); ++ percpu_counter_dec(&sbi->s_freeinodes_counter); + if (S_ISDIR(mode)) + percpu_counter_inc(&sbi->s_dirs_counter); + +diff --git a/fs/minix/inode.c b/fs/minix/inode.c +index b6829d6796432..d49337b5abfad 100644 +--- a/fs/minix/inode.c ++++ b/fs/minix/inode.c +@@ -155,6 +155,23 @@ static int minix_remount (struct super_block * sb, int * flags, char * data) + return 0; + } + ++static bool minix_check_superblock(struct minix_sb_info *sbi) ++{ ++ if (sbi->s_imap_blocks == 0 || sbi->s_zmap_blocks == 0) ++ return false; ++ ++ /* ++ * s_max_size must not exceed the block mapping limitation. This check ++ * is only needed for V1 filesystems, since V2/V3 support an extra level ++ * of indirect blocks which places the limit well above U32_MAX. ++ */ ++ if (sbi->s_version == MINIX_V1 && ++ sbi->s_max_size > (7 + 512 + 512*512) * BLOCK_SIZE) ++ return false; ++ ++ return true; ++} ++ + static int minix_fill_super(struct super_block *s, void *data, int silent) + { + struct buffer_head *bh; +@@ -233,11 +250,12 @@ static int minix_fill_super(struct super_block *s, void *data, int silent) + } else + goto out_no_fs; + ++ if (!minix_check_superblock(sbi)) ++ goto out_illegal_sb; ++ + /* + * Allocate the buffer map to keep the superblock small. + */ +- if (sbi->s_imap_blocks == 0 || sbi->s_zmap_blocks == 0) +- goto out_illegal_sb; + i = (sbi->s_imap_blocks + sbi->s_zmap_blocks) * sizeof(bh); + map = kzalloc(i, GFP_KERNEL); + if (!map) +@@ -471,6 +489,13 @@ static struct inode *V1_minix_iget(struct inode *inode) + iget_failed(inode); + return ERR_PTR(-EIO); + } ++ if (raw_inode->i_nlinks == 0) { ++ printk("MINIX-fs: deleted inode referenced: %lu\n", ++ inode->i_ino); ++ brelse(bh); ++ iget_failed(inode); ++ return ERR_PTR(-ESTALE); ++ } + inode->i_mode = raw_inode->i_mode; + i_uid_write(inode, raw_inode->i_uid); + i_gid_write(inode, raw_inode->i_gid); +@@ -504,6 +529,13 @@ static struct inode *V2_minix_iget(struct inode *inode) + iget_failed(inode); + return ERR_PTR(-EIO); + } ++ if (raw_inode->i_nlinks == 0) { ++ printk("MINIX-fs: deleted inode referenced: %lu\n", ++ inode->i_ino); ++ brelse(bh); ++ iget_failed(inode); ++ return ERR_PTR(-ESTALE); ++ } + inode->i_mode = raw_inode->i_mode; + i_uid_write(inode, raw_inode->i_uid); + i_gid_write(inode, raw_inode->i_gid); +diff --git a/fs/minix/itree_common.c b/fs/minix/itree_common.c +index 043c3fdbc8e7e..446148792f411 100644 +--- a/fs/minix/itree_common.c ++++ b/fs/minix/itree_common.c +@@ -75,6 +75,7 @@ static int alloc_branch(struct inode *inode, + int n = 0; + int i; + int parent = minix_new_block(inode); ++ int err = -ENOSPC; + + branch[0].key = cpu_to_block(parent); + if (parent) for (n = 1; n < num; n++) { +@@ -85,6 +86,11 @@ static int alloc_branch(struct inode *inode, + break; + branch[n].key = cpu_to_block(nr); + bh = sb_getblk(inode->i_sb, parent); ++ if (!bh) { ++ minix_free_block(inode, nr); ++ err = -ENOMEM; ++ break; ++ } + lock_buffer(bh); + memset(bh->b_data, 0, bh->b_size); + branch[n].bh = bh; +@@ -103,7 +109,7 @@ static int alloc_branch(struct inode *inode, + bforget(branch[i].bh); + for (i = 0; i < n; i++) + minix_free_block(inode, block_to_cpu(branch[i].key)); +- return -ENOSPC; ++ return err; + } + + static inline int splice_branch(struct inode *inode, +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index a19bbcfab7c5e..4cfb84119e017 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -5323,8 +5323,6 @@ static int _nfs4_get_security_label(struct inode *inode, void *buf, + return ret; + if (!(fattr.valid & NFS_ATTR_FATTR_V4_SECURITY_LABEL)) + return -ENOENT; +- if (buflen < label.len) +- return -ERANGE; + return 0; + } + +diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c +index 0b2d051990e99..3cd04c98da6bc 100644 +--- a/fs/nfs/nfs4xdr.c ++++ b/fs/nfs/nfs4xdr.c +@@ -4258,7 +4258,11 @@ static int decode_attr_security_label(struct xdr_stream *xdr, uint32_t *bitmap, + goto out_overflow; + if (len < NFS4_MAXLABELLEN) { + if (label) { +- memcpy(label->label, p, len); ++ if (label->len) { ++ if (label->len < len) ++ return -ERANGE; ++ memcpy(label->label, p, len); ++ } + label->len = len; + label->pi = pi; + label->lfs = lfs; +diff --git a/fs/ocfs2/ocfs2.h b/fs/ocfs2/ocfs2.h +index 9a50f222ac97f..b15537a76516d 100644 +--- a/fs/ocfs2/ocfs2.h ++++ b/fs/ocfs2/ocfs2.h +@@ -336,8 +336,8 @@ struct ocfs2_super + spinlock_t osb_lock; + u32 s_next_generation; + unsigned long osb_flags; +- s16 s_inode_steal_slot; +- s16 s_meta_steal_slot; ++ u16 s_inode_steal_slot; ++ u16 s_meta_steal_slot; + atomic_t s_num_inodes_stolen; + atomic_t s_num_meta_stolen; + +diff --git a/fs/ocfs2/suballoc.c b/fs/ocfs2/suballoc.c +index 4ca2f71565f9a..8d03630dfd590 100644 +--- a/fs/ocfs2/suballoc.c ++++ b/fs/ocfs2/suballoc.c +@@ -895,9 +895,9 @@ static void __ocfs2_set_steal_slot(struct ocfs2_super *osb, int slot, int type) + { + spin_lock(&osb->osb_lock); + if (type == INODE_ALLOC_SYSTEM_INODE) +- osb->s_inode_steal_slot = slot; ++ osb->s_inode_steal_slot = (u16)slot; + else if (type == EXTENT_ALLOC_SYSTEM_INODE) +- osb->s_meta_steal_slot = slot; ++ osb->s_meta_steal_slot = (u16)slot; + spin_unlock(&osb->osb_lock); + } + +diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c +index 24ab735d91dd6..8216550faf45b 100644 +--- a/fs/ocfs2/super.c ++++ b/fs/ocfs2/super.c +@@ -92,7 +92,7 @@ struct mount_options + unsigned long commit_interval; + unsigned long mount_opt; + unsigned int atime_quantum; +- signed short slot; ++ unsigned short slot; + int localalloc_opt; + unsigned int resv_level; + int dir_resv_level; +@@ -1369,7 +1369,7 @@ static int ocfs2_parse_options(struct super_block *sb, + goto bail; + } + if (option) +- mopt->slot = (s16)option; ++ mopt->slot = (u16)option; + break; + case Opt_commit: + if (match_int(&args[0], &option)) { +diff --git a/fs/ufs/super.c b/fs/ufs/super.c +index 6440003f8ddc6..e3f3a0df60276 100644 +--- a/fs/ufs/super.c ++++ b/fs/ufs/super.c +@@ -99,7 +99,7 @@ static struct inode *ufs_nfs_get_inode(struct super_block *sb, u64 ino, u32 gene + struct ufs_sb_private_info *uspi = UFS_SB(sb)->s_uspi; + struct inode *inode; + +- if (ino < UFS_ROOTINO || ino > uspi->s_ncg * uspi->s_ipg) ++ if (ino < UFS_ROOTINO || ino > (u64)uspi->s_ncg * uspi->s_ipg) + return ERR_PTR(-ESTALE); + + inode = ufs_iget(sb, ino); +diff --git a/fs/xattr.c b/fs/xattr.c +index 50029811fbe38..94f9559ba0f86 100644 +--- a/fs/xattr.c ++++ b/fs/xattr.c +@@ -204,10 +204,22 @@ int __vfs_setxattr_noperm(struct dentry *dentry, const char *name, + return error; + } + +- ++/** ++ * __vfs_setxattr_locked: set an extended attribute while holding the inode ++ * lock ++ * ++ * @dentry - object to perform setxattr on ++ * @name - xattr name to set ++ * @value - value to set @name to ++ * @size - size of @value ++ * @flags - flags to pass into filesystem operations ++ * @delegated_inode - on return, will contain an inode pointer that ++ * a delegation was broken on, NULL if none. ++ */ + int +-vfs_setxattr(struct dentry *dentry, const char *name, const void *value, +- size_t size, int flags) ++__vfs_setxattr_locked(struct dentry *dentry, const char *name, ++ const void *value, size_t size, int flags, ++ struct inode **delegated_inode) + { + struct inode *inode = dentry->d_inode; + int error; +@@ -216,15 +228,40 @@ vfs_setxattr(struct dentry *dentry, const char *name, const void *value, + if (error) + return error; + +- inode_lock(inode); + error = security_inode_setxattr(dentry, name, value, size, flags); + if (error) + goto out; + ++ error = try_break_deleg(inode, delegated_inode); ++ if (error) ++ goto out; ++ + error = __vfs_setxattr_noperm(dentry, name, value, size, flags); + + out: ++ return error; ++} ++EXPORT_SYMBOL_GPL(__vfs_setxattr_locked); ++ ++int ++vfs_setxattr(struct dentry *dentry, const char *name, const void *value, ++ size_t size, int flags) ++{ ++ struct inode *inode = dentry->d_inode; ++ struct inode *delegated_inode = NULL; ++ int error; ++ ++retry_deleg: ++ inode_lock(inode); ++ error = __vfs_setxattr_locked(dentry, name, value, size, flags, ++ &delegated_inode); + inode_unlock(inode); ++ ++ if (delegated_inode) { ++ error = break_deleg_wait(&delegated_inode); ++ if (!error) ++ goto retry_deleg; ++ } + return error; + } + EXPORT_SYMBOL_GPL(vfs_setxattr); +@@ -380,8 +417,18 @@ __vfs_removexattr(struct dentry *dentry, const char *name) + } + EXPORT_SYMBOL(__vfs_removexattr); + ++/** ++ * __vfs_removexattr_locked: set an extended attribute while holding the inode ++ * lock ++ * ++ * @dentry - object to perform setxattr on ++ * @name - name of xattr to remove ++ * @delegated_inode - on return, will contain an inode pointer that ++ * a delegation was broken on, NULL if none. ++ */ + int +-vfs_removexattr(struct dentry *dentry, const char *name) ++__vfs_removexattr_locked(struct dentry *dentry, const char *name, ++ struct inode **delegated_inode) + { + struct inode *inode = dentry->d_inode; + int error; +@@ -390,11 +437,14 @@ vfs_removexattr(struct dentry *dentry, const char *name) + if (error) + return error; + +- inode_lock(inode); + error = security_inode_removexattr(dentry, name); + if (error) + goto out; + ++ error = try_break_deleg(inode, delegated_inode); ++ if (error) ++ goto out; ++ + error = __vfs_removexattr(dentry, name); + + if (!error) { +@@ -403,12 +453,32 @@ vfs_removexattr(struct dentry *dentry, const char *name) + } + + out: ++ return error; ++} ++EXPORT_SYMBOL_GPL(__vfs_removexattr_locked); ++ ++int ++vfs_removexattr(struct dentry *dentry, const char *name) ++{ ++ struct inode *inode = dentry->d_inode; ++ struct inode *delegated_inode = NULL; ++ int error; ++ ++retry_deleg: ++ inode_lock(inode); ++ error = __vfs_removexattr_locked(dentry, name, &delegated_inode); + inode_unlock(inode); ++ ++ if (delegated_inode) { ++ error = break_deleg_wait(&delegated_inode); ++ if (!error) ++ goto retry_deleg; ++ } ++ + return error; + } + EXPORT_SYMBOL_GPL(vfs_removexattr); + +- + /* + * Extended attribute SET operations + */ +diff --git a/fs/xfs/xfs_reflink.c b/fs/xfs/xfs_reflink.c +index db7f9fdd20a30..4d37f1b59436c 100644 +--- a/fs/xfs/xfs_reflink.c ++++ b/fs/xfs/xfs_reflink.c +@@ -1076,6 +1076,7 @@ xfs_reflink_remap_extent( + xfs_filblks_t rlen; + xfs_filblks_t unmap_len; + xfs_off_t newlen; ++ int64_t qres; + int error; + + unmap_len = irec->br_startoff + irec->br_blockcount - destoff; +@@ -1098,13 +1099,19 @@ xfs_reflink_remap_extent( + xfs_ilock(ip, XFS_ILOCK_EXCL); + xfs_trans_ijoin(tp, ip, 0); + +- /* If we're not just clearing space, then do we have enough quota? */ +- if (real_extent) { +- error = xfs_trans_reserve_quota_nblks(tp, ip, +- irec->br_blockcount, 0, XFS_QMOPT_RES_REGBLKS); +- if (error) +- goto out_cancel; +- } ++ /* ++ * Reserve quota for this operation. We don't know if the first unmap ++ * in the dest file will cause a bmap btree split, so we always reserve ++ * at least enough blocks for that split. If the extent being mapped ++ * in is written, we need to reserve quota for that too. ++ */ ++ qres = XFS_EXTENTADD_SPACE_RES(mp, XFS_DATA_FORK); ++ if (real_extent) ++ qres += irec->br_blockcount; ++ error = xfs_trans_reserve_quota_nblks(tp, ip, qres, 0, ++ XFS_QMOPT_RES_REGBLKS); ++ if (error) ++ goto out_cancel; + + trace_xfs_reflink_remap(ip, irec->br_startoff, + irec->br_blockcount, irec->br_startblock); +diff --git a/include/linux/bitfield.h b/include/linux/bitfield.h +index f2deb71958b2d..a0675db325e01 100644 +--- a/include/linux/bitfield.h ++++ b/include/linux/bitfield.h +@@ -71,7 +71,7 @@ + */ + #define FIELD_FIT(_mask, _val) \ + ({ \ +- __BF_FIELD_CHECK(_mask, 0ULL, _val, "FIELD_FIT: "); \ ++ __BF_FIELD_CHECK(_mask, 0ULL, 0ULL, "FIELD_FIT: "); \ + !((((typeof(_mask))_val) << __bf_shf(_mask)) & ~(_mask)); \ + }) + +diff --git a/include/linux/hyperv.h b/include/linux/hyperv.h +index 8d3ca6da33421..63cd81e5610d1 100644 +--- a/include/linux/hyperv.h ++++ b/include/linux/hyperv.h +@@ -422,6 +422,8 @@ enum vmbus_channel_message_type { + CHANNELMSG_19 = 19, + CHANNELMSG_20 = 20, + CHANNELMSG_TL_CONNECT_REQUEST = 21, ++ CHANNELMSG_22 = 22, ++ CHANNELMSG_TL_CONNECT_RESULT = 23, + CHANNELMSG_COUNT + }; + +diff --git a/include/linux/intel-iommu.h b/include/linux/intel-iommu.h +index 4def15c32a018..d2364ba99f6ce 100644 +--- a/include/linux/intel-iommu.h ++++ b/include/linux/intel-iommu.h +@@ -304,8 +304,8 @@ enum { + + #define QI_DEV_EIOTLB_ADDR(a) ((u64)(a) & VTD_PAGE_MASK) + #define QI_DEV_EIOTLB_SIZE (((u64)1) << 11) +-#define QI_DEV_EIOTLB_GLOB(g) ((u64)g) +-#define QI_DEV_EIOTLB_PASID(p) (((u64)p) << 32) ++#define QI_DEV_EIOTLB_GLOB(g) ((u64)(g) & 0x1) ++#define QI_DEV_EIOTLB_PASID(p) ((u64)((p) & 0xfffff) << 32) + #define QI_DEV_EIOTLB_SID(sid) ((u64)((sid) & 0xffff) << 16) + #define QI_DEV_EIOTLB_QDEP(qd) ((u64)((qd) & 0x1f) << 4) + #define QI_DEV_EIOTLB_PFSID(pfsid) (((u64)(pfsid & 0xf) << 12) | \ +diff --git a/include/linux/irq.h b/include/linux/irq.h +index 0d53626405bf8..c08758a63d268 100644 +--- a/include/linux/irq.h ++++ b/include/linux/irq.h +@@ -212,6 +212,8 @@ struct irq_data { + * mask. Applies only to affinity managed irqs. + * IRQD_SINGLE_TARGET - IRQ allows only a single affinity target + * IRQD_DEFAULT_TRIGGER_SET - Expected trigger already been set ++ * IRQD_AFFINITY_ON_ACTIVATE - Affinity is set on activation. Don't call ++ * irq_chip::irq_set_affinity() when deactivated. + */ + enum { + IRQD_TRIGGER_MASK = 0xf, +@@ -233,6 +235,7 @@ enum { + IRQD_MANAGED_SHUTDOWN = (1 << 23), + IRQD_SINGLE_TARGET = (1 << 24), + IRQD_DEFAULT_TRIGGER_SET = (1 << 25), ++ IRQD_AFFINITY_ON_ACTIVATE = (1 << 29), + }; + + #define __irqd_to_state(d) ACCESS_PRIVATE((d)->common, state_use_accessors) +@@ -377,6 +380,15 @@ static inline bool irqd_is_managed_and_shutdown(struct irq_data *d) + return __irqd_to_state(d) & IRQD_MANAGED_SHUTDOWN; + } + ++static inline void irqd_set_affinity_on_activate(struct irq_data *d) ++{ ++ __irqd_to_state(d) |= IRQD_AFFINITY_ON_ACTIVATE; ++} ++ ++static inline bool irqd_affinity_on_activate(struct irq_data *d) ++{ ++ return __irqd_to_state(d) & IRQD_AFFINITY_ON_ACTIVATE; ++} + #undef __irqd_to_state + + static inline irq_hw_number_t irqd_to_hwirq(struct irq_data *d) +diff --git a/include/linux/tracepoint.h b/include/linux/tracepoint.h +index a26ffbe09e715..06cb9184a42a0 100644 +--- a/include/linux/tracepoint.h ++++ b/include/linux/tracepoint.h +@@ -318,7 +318,7 @@ extern void syscall_unregfunc(void); + static const char *___tp_str __tracepoint_string = str; \ + ___tp_str; \ + }) +-#define __tracepoint_string __attribute__((section("__tracepoint_str"))) ++#define __tracepoint_string __attribute__((section("__tracepoint_str"), used)) + #else + /* + * tracepoint_string() is used to save the string address for userspace +diff --git a/include/linux/xattr.h b/include/linux/xattr.h +index d70f77a4b62ab..b0945fb7242f5 100644 +--- a/include/linux/xattr.h ++++ b/include/linux/xattr.h +@@ -52,8 +52,10 @@ ssize_t vfs_getxattr(struct dentry *, const char *, void *, size_t); + ssize_t vfs_listxattr(struct dentry *d, char *list, size_t size); + int __vfs_setxattr(struct dentry *, struct inode *, const char *, const void *, size_t, int); + int __vfs_setxattr_noperm(struct dentry *, const char *, const void *, size_t, int); ++int __vfs_setxattr_locked(struct dentry *, const char *, const void *, size_t, int, struct inode **); + int vfs_setxattr(struct dentry *, const char *, const void *, size_t, int); + int __vfs_removexattr(struct dentry *, const char *); ++int __vfs_removexattr_locked(struct dentry *, const char *, struct inode **); + int vfs_removexattr(struct dentry *, const char *); + + ssize_t generic_listxattr(struct dentry *dentry, char *buffer, size_t buffer_size); +diff --git a/include/net/addrconf.h b/include/net/addrconf.h +index f30ee99a1d72a..a4cda47682100 100644 +--- a/include/net/addrconf.h ++++ b/include/net/addrconf.h +@@ -270,6 +270,7 @@ int ipv6_sock_ac_join(struct sock *sk, int ifindex, + const struct in6_addr *addr); + int ipv6_sock_ac_drop(struct sock *sk, int ifindex, + const struct in6_addr *addr); ++void __ipv6_sock_ac_close(struct sock *sk); + void ipv6_sock_ac_close(struct sock *sk); + + int __ipv6_dev_ac_inc(struct inet6_dev *idev, const struct in6_addr *addr); +diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h +index 13e4c89a8231b..ceab3a5dd5309 100644 +--- a/include/net/inet_connection_sock.h ++++ b/include/net/inet_connection_sock.h +@@ -321,5 +321,9 @@ int inet_csk_compat_getsockopt(struct sock *sk, int level, int optname, + int inet_csk_compat_setsockopt(struct sock *sk, int level, int optname, + char __user *optval, unsigned int optlen); + ++/* update the fast reuse flag when adding a socket */ ++void inet_csk_update_fastreuse(struct inet_bind_bucket *tb, ++ struct sock *sk); ++ + struct dst_entry *inet_csk_update_pmtu(struct sock *sk, u32 mtu); + #endif /* _INET_CONNECTION_SOCK_H */ +diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h +index f4e5ac8aa3668..1fb79c78e2007 100644 +--- a/include/net/ip_vs.h ++++ b/include/net/ip_vs.h +@@ -1607,18 +1607,16 @@ static inline void ip_vs_conn_drop_conntrack(struct ip_vs_conn *cp) + } + #endif /* CONFIG_IP_VS_NFCT */ + +-/* Really using conntrack? */ +-static inline bool ip_vs_conn_uses_conntrack(struct ip_vs_conn *cp, +- struct sk_buff *skb) ++/* Using old conntrack that can not be redirected to another real server? */ ++static inline bool ip_vs_conn_uses_old_conntrack(struct ip_vs_conn *cp, ++ struct sk_buff *skb) + { + #ifdef CONFIG_IP_VS_NFCT + enum ip_conntrack_info ctinfo; + struct nf_conn *ct; + +- if (!(cp->flags & IP_VS_CONN_F_NFCT)) +- return false; + ct = nf_ct_get(skb, &ctinfo); +- if (ct) ++ if (ct && nf_ct_is_confirmed(ct)) + return true; + #endif + return false; +diff --git a/include/net/sock.h b/include/net/sock.h +index a2e10d0b12804..55d16db84ea44 100644 +--- a/include/net/sock.h ++++ b/include/net/sock.h +@@ -816,6 +816,8 @@ static inline int sk_memalloc_socks(void) + { + return static_key_false(&memalloc_socks); + } ++ ++void __receive_sock(struct file *file); + #else + + static inline int sk_memalloc_socks(void) +@@ -823,6 +825,8 @@ static inline int sk_memalloc_socks(void) + return 0; + } + ++static inline void __receive_sock(struct file *file) ++{ } + #endif + + static inline gfp_t sk_gfp_mask(const struct sock *sk, gfp_t gfp_mask) +diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c +index a2fed8fbd2bde..ada060e628ce3 100644 +--- a/kernel/cgroup/cgroup.c ++++ b/kernel/cgroup/cgroup.c +@@ -5827,6 +5827,8 @@ void cgroup_sk_clone(struct sock_cgroup_data *skcd) + { + /* Socket clone path */ + if (skcd->val) { ++ if (skcd->no_refcnt) ++ return; + /* + * We might be cloning a socket which is left in an empty + * cgroup and the cgroup might have already been rmdir'd. +diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c +index 5277949e82e09..3193be58805c2 100644 +--- a/kernel/irq/manage.c ++++ b/kernel/irq/manage.c +@@ -168,9 +168,9 @@ void irq_set_thread_affinity(struct irq_desc *desc) + set_bit(IRQTF_AFFINITY, &action->thread_flags); + } + ++#ifdef CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK + static void irq_validate_effective_affinity(struct irq_data *data) + { +-#ifdef CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK + const struct cpumask *m = irq_data_get_effective_affinity_mask(data); + struct irq_chip *chip = irq_data_get_irq_chip(data); + +@@ -178,9 +178,19 @@ static void irq_validate_effective_affinity(struct irq_data *data) + return; + pr_warn_once("irq_chip %s did not update eff. affinity mask of irq %u\n", + chip->name, data->irq); +-#endif + } + ++static inline void irq_init_effective_affinity(struct irq_data *data, ++ const struct cpumask *mask) ++{ ++ cpumask_copy(irq_data_get_effective_affinity_mask(data), mask); ++} ++#else ++static inline void irq_validate_effective_affinity(struct irq_data *data) { } ++static inline void irq_init_effective_affinity(struct irq_data *data, ++ const struct cpumask *mask) { } ++#endif ++ + int irq_do_set_affinity(struct irq_data *data, const struct cpumask *mask, + bool force) + { +@@ -205,6 +215,30 @@ int irq_do_set_affinity(struct irq_data *data, const struct cpumask *mask, + return ret; + } + ++static bool irq_set_affinity_deactivated(struct irq_data *data, ++ const struct cpumask *mask, bool force) ++{ ++ struct irq_desc *desc = irq_data_to_desc(data); ++ ++ /* ++ * Handle irq chips which can handle affinity only in activated ++ * state correctly ++ * ++ * If the interrupt is not yet activated, just store the affinity ++ * mask and do not call the chip driver at all. On activation the ++ * driver has to make sure anyway that the interrupt is in a ++ * useable state so startup works. ++ */ ++ if (!IS_ENABLED(CONFIG_IRQ_DOMAIN_HIERARCHY) || ++ irqd_is_activated(data) || !irqd_affinity_on_activate(data)) ++ return false; ++ ++ cpumask_copy(desc->irq_common_data.affinity, mask); ++ irq_init_effective_affinity(data, mask); ++ irqd_set(data, IRQD_AFFINITY_SET); ++ return true; ++} ++ + int irq_set_affinity_locked(struct irq_data *data, const struct cpumask *mask, + bool force) + { +@@ -215,6 +249,9 @@ int irq_set_affinity_locked(struct irq_data *data, const struct cpumask *mask, + if (!chip || !chip->irq_set_affinity) + return -EINVAL; + ++ if (irq_set_affinity_deactivated(data, mask, force)) ++ return 0; ++ + if (irq_can_move_pcntxt(data)) { + ret = irq_do_set_affinity(data, mask, force); + } else { +diff --git a/kernel/kprobes.c b/kernel/kprobes.c +index f2d2194b51ca3..7b3a5c35904a0 100644 +--- a/kernel/kprobes.c ++++ b/kernel/kprobes.c +@@ -2134,6 +2134,13 @@ static void kill_kprobe(struct kprobe *p) + * the original probed function (which will be freed soon) any more. + */ + arch_remove_kprobe(p); ++ ++ /* ++ * The module is going away. We should disarm the kprobe which ++ * is using ftrace. ++ */ ++ if (kprobe_ftrace(p)) ++ disarm_kprobe_ftrace(p); + } + + /* Disable one kprobe */ +diff --git a/kernel/sched/topology.c b/kernel/sched/topology.c +index 867d173dab482..152ffe0c24330 100644 +--- a/kernel/sched/topology.c ++++ b/kernel/sched/topology.c +@@ -1117,7 +1117,7 @@ sd_init(struct sched_domain_topology_level *tl, + sd_flags = (*tl->sd_flags)(); + if (WARN_ONCE(sd_flags & ~TOPOLOGY_SD_FLAGS, + "wrong sd_flags in topology description\n")) +- sd_flags &= ~TOPOLOGY_SD_FLAGS; ++ sd_flags &= TOPOLOGY_SD_FLAGS; + + *sd = (struct sched_domain){ + .min_interval = sd_weight, +diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c +index 8a8d92a8045b1..7cbfccd2fb031 100644 +--- a/kernel/trace/ftrace.c ++++ b/kernel/trace/ftrace.c +@@ -5721,8 +5721,11 @@ static int referenced_filters(struct dyn_ftrace *rec) + int cnt = 0; + + for (ops = ftrace_ops_list; ops != &ftrace_list_end; ops = ops->next) { +- if (ops_references_rec(ops, rec)) +- cnt++; ++ if (ops_references_rec(ops, rec)) { ++ cnt++; ++ if (ops->flags & FTRACE_OPS_FL_SAVE_REGS) ++ rec->flags |= FTRACE_FL_REGS; ++ } + } + + return cnt; +@@ -5871,8 +5874,8 @@ void ftrace_module_enable(struct module *mod) + if (ftrace_start_up) + cnt += referenced_filters(rec); + +- /* This clears FTRACE_FL_DISABLED */ +- rec->flags = cnt; ++ rec->flags &= ~FTRACE_FL_DISABLED; ++ rec->flags += cnt; + + if (ftrace_start_up && cnt) { + int failed = __ftrace_replace_code(rec, 1); +@@ -6239,12 +6242,12 @@ void ftrace_pid_follow_fork(struct trace_array *tr, bool enable) + if (enable) { + register_trace_sched_process_fork(ftrace_pid_follow_sched_process_fork, + tr); +- register_trace_sched_process_exit(ftrace_pid_follow_sched_process_exit, ++ register_trace_sched_process_free(ftrace_pid_follow_sched_process_exit, + tr); + } else { + unregister_trace_sched_process_fork(ftrace_pid_follow_sched_process_fork, + tr); +- unregister_trace_sched_process_exit(ftrace_pid_follow_sched_process_exit, ++ unregister_trace_sched_process_free(ftrace_pid_follow_sched_process_exit, + tr); + } + } +diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c +index 421166a39253a..e72a44ecb81da 100644 +--- a/kernel/trace/trace_events.c ++++ b/kernel/trace/trace_events.c +@@ -533,12 +533,12 @@ void trace_event_follow_fork(struct trace_array *tr, bool enable) + if (enable) { + register_trace_prio_sched_process_fork(event_filter_pid_sched_process_fork, + tr, INT_MIN); +- register_trace_prio_sched_process_exit(event_filter_pid_sched_process_exit, ++ register_trace_prio_sched_process_free(event_filter_pid_sched_process_exit, + tr, INT_MAX); + } else { + unregister_trace_sched_process_fork(event_filter_pid_sched_process_fork, + tr); +- unregister_trace_sched_process_exit(event_filter_pid_sched_process_exit, ++ unregister_trace_sched_process_free(event_filter_pid_sched_process_exit, + tr); + } + } +diff --git a/kernel/trace/trace_hwlat.c b/kernel/trace/trace_hwlat.c +index bff6c033d70e2..64a98a5bb6410 100644 +--- a/kernel/trace/trace_hwlat.c ++++ b/kernel/trace/trace_hwlat.c +@@ -272,6 +272,7 @@ static bool disable_migrate; + static void move_to_next_cpu(void) + { + struct cpumask *current_mask = &save_cpumask; ++ struct trace_array *tr = hwlat_trace; + int next_cpu; + + if (disable_migrate) +@@ -285,7 +286,7 @@ static void move_to_next_cpu(void) + goto disable; + + get_online_cpus(); +- cpumask_and(current_mask, cpu_online_mask, tracing_buffer_mask); ++ cpumask_and(current_mask, cpu_online_mask, tr->tracing_cpumask); + next_cpu = cpumask_next(smp_processor_id(), current_mask); + put_online_cpus(); + +@@ -359,7 +360,7 @@ static int start_kthread(struct trace_array *tr) + /* Just pick the first CPU on first iteration */ + current_mask = &save_cpumask; + get_online_cpus(); +- cpumask_and(current_mask, cpu_online_mask, tracing_buffer_mask); ++ cpumask_and(current_mask, cpu_online_mask, tr->tracing_cpumask); + put_online_cpus(); + next_cpu = cpumask_first(current_mask); + +diff --git a/lib/dynamic_debug.c b/lib/dynamic_debug.c +index c7c96bc7654af..91c451e0f4741 100644 +--- a/lib/dynamic_debug.c ++++ b/lib/dynamic_debug.c +@@ -85,22 +85,22 @@ static struct { unsigned flag:8; char opt_char; } opt_array[] = { + { _DPRINTK_FLAGS_NONE, '_' }, + }; + ++struct flagsbuf { char buf[ARRAY_SIZE(opt_array)+1]; }; ++ + /* format a string into buf[] which describes the _ddebug's flags */ +-static char *ddebug_describe_flags(struct _ddebug *dp, char *buf, +- size_t maxlen) ++static char *ddebug_describe_flags(unsigned int flags, struct flagsbuf *fb) + { +- char *p = buf; ++ char *p = fb->buf; + int i; + +- BUG_ON(maxlen < 6); + for (i = 0; i < ARRAY_SIZE(opt_array); ++i) +- if (dp->flags & opt_array[i].flag) ++ if (flags & opt_array[i].flag) + *p++ = opt_array[i].opt_char; +- if (p == buf) ++ if (p == fb->buf) + *p++ = '_'; + *p = '\0'; + +- return buf; ++ return fb->buf; + } + + #define vpr_info(fmt, ...) \ +@@ -142,7 +142,7 @@ static int ddebug_change(const struct ddebug_query *query, + struct ddebug_table *dt; + unsigned int newflags; + unsigned int nfound = 0; +- char flagbuf[10]; ++ struct flagsbuf fbuf; + + /* search for matching ddebugs */ + mutex_lock(&ddebug_lock); +@@ -199,8 +199,7 @@ static int ddebug_change(const struct ddebug_query *query, + vpr_info("changed %s:%d [%s]%s =%s\n", + trim_prefix(dp->filename), dp->lineno, + dt->mod_name, dp->function, +- ddebug_describe_flags(dp, flagbuf, +- sizeof(flagbuf))); ++ ddebug_describe_flags(dp->flags, &fbuf)); + } + } + mutex_unlock(&ddebug_lock); +@@ -779,7 +778,7 @@ static int ddebug_proc_show(struct seq_file *m, void *p) + { + struct ddebug_iter *iter = m->private; + struct _ddebug *dp = p; +- char flagsbuf[10]; ++ struct flagsbuf flags; + + vpr_info("called m=%p p=%p\n", m, p); + +@@ -792,7 +791,7 @@ static int ddebug_proc_show(struct seq_file *m, void *p) + seq_printf(m, "%s:%u [%s]%s =%s \"", + trim_prefix(dp->filename), dp->lineno, + iter->table->mod_name, dp->function, +- ddebug_describe_flags(dp, flagsbuf, sizeof(flagsbuf))); ++ ddebug_describe_flags(dp->flags, &flags)); + seq_escape(m, dp->format, "\t\r\n\""); + seq_puts(m, "\"\n"); + +diff --git a/lib/test_kmod.c b/lib/test_kmod.c +index cf619795a1822..c0ce0156d54bb 100644 +--- a/lib/test_kmod.c ++++ b/lib/test_kmod.c +@@ -747,7 +747,7 @@ static int trigger_config_run_type(struct kmod_test_device *test_dev, + break; + case TEST_KMOD_FS_TYPE: + kfree_const(config->test_fs); +- config->test_driver = NULL; ++ config->test_fs = NULL; + copied = config_copy_test_fs(config, test_str, + strlen(test_str)); + break; +diff --git a/mm/khugepaged.c b/mm/khugepaged.c +index acf66c5dc9bd9..04b4c38d0c184 100644 +--- a/mm/khugepaged.c ++++ b/mm/khugepaged.c +@@ -1252,6 +1252,7 @@ static void collect_mm_slot(struct mm_slot *mm_slot) + static void retract_page_tables(struct address_space *mapping, pgoff_t pgoff) + { + struct vm_area_struct *vma; ++ struct mm_struct *mm; + unsigned long addr; + pmd_t *pmd, _pmd; + +@@ -1265,7 +1266,8 @@ static void retract_page_tables(struct address_space *mapping, pgoff_t pgoff) + continue; + if (vma->vm_end < addr + HPAGE_PMD_SIZE) + continue; +- pmd = mm_find_pmd(vma->vm_mm, addr); ++ mm = vma->vm_mm; ++ pmd = mm_find_pmd(mm, addr); + if (!pmd) + continue; + /* +@@ -1274,14 +1276,16 @@ static void retract_page_tables(struct address_space *mapping, pgoff_t pgoff) + * re-fault. Not ideal, but it's more important to not disturb + * the system too much. + */ +- if (down_write_trylock(&vma->vm_mm->mmap_sem)) { +- spinlock_t *ptl = pmd_lock(vma->vm_mm, pmd); +- /* assume page table is clear */ +- _pmd = pmdp_collapse_flush(vma, addr, pmd); +- spin_unlock(ptl); +- up_write(&vma->vm_mm->mmap_sem); +- atomic_long_dec(&vma->vm_mm->nr_ptes); +- pte_free(vma->vm_mm, pmd_pgtable(_pmd)); ++ if (down_write_trylock(&mm->mmap_sem)) { ++ if (!khugepaged_test_exit(mm)) { ++ spinlock_t *ptl = pmd_lock(mm, pmd); ++ /* assume page table is clear */ ++ _pmd = pmdp_collapse_flush(vma, addr, pmd); ++ spin_unlock(ptl); ++ atomic_long_dec(&mm->nr_ptes); ++ pte_free(mm, pmd_pgtable(_pmd)); ++ } ++ up_write(&mm->mmap_sem); + } + } + i_mmap_unlock_write(mapping); +diff --git a/mm/mmap.c b/mm/mmap.c +index 8c6ed06983f9e..724b7c4f1a5b5 100644 +--- a/mm/mmap.c ++++ b/mm/mmap.c +@@ -3065,6 +3065,7 @@ void exit_mmap(struct mm_struct *mm) + if (vma->vm_flags & VM_ACCOUNT) + nr_accounted += vma_pages(vma); + vma = remove_vma(vma); ++ cond_resched(); + } + vm_unacct_memory(nr_accounted); + } +diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c +index 32de8afbfbf8e..9f020559c1928 100644 +--- a/net/9p/trans_fd.c ++++ b/net/9p/trans_fd.c +@@ -829,20 +829,28 @@ static int p9_fd_open(struct p9_client *client, int rfd, int wfd) + return -ENOMEM; + + ts->rd = fget(rfd); ++ if (!ts->rd) ++ goto out_free_ts; ++ if (!(ts->rd->f_mode & FMODE_READ)) ++ goto out_put_rd; + ts->wr = fget(wfd); +- if (!ts->rd || !ts->wr) { +- if (ts->rd) +- fput(ts->rd); +- if (ts->wr) +- fput(ts->wr); +- kfree(ts); +- return -EIO; +- } ++ if (!ts->wr) ++ goto out_put_rd; ++ if (!(ts->wr->f_mode & FMODE_WRITE)) ++ goto out_put_wr; + + client->trans = ts; + client->status = Connected; + + return 0; ++ ++out_put_wr: ++ fput(ts->wr); ++out_put_rd: ++ fput(ts->rd); ++out_free_ts: ++ kfree(ts); ++ return -EIO; + } + + static int p9_socket_open(struct p9_client *client, struct socket *csocket) +diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c +index 357475cceec61..9a75f9b00b512 100644 +--- a/net/bluetooth/6lowpan.c ++++ b/net/bluetooth/6lowpan.c +@@ -57,6 +57,7 @@ static bool enable_6lowpan; + /* We are listening incoming connections via this channel + */ + static struct l2cap_chan *listen_chan; ++static DEFINE_MUTEX(set_lock); + + struct lowpan_peer { + struct list_head list; +@@ -1082,12 +1083,14 @@ static void do_enable_set(struct work_struct *work) + + enable_6lowpan = set_enable->flag; + ++ mutex_lock(&set_lock); + if (listen_chan) { + l2cap_chan_close(listen_chan, 0); + l2cap_chan_put(listen_chan); + } + + listen_chan = bt_6lowpan_listen(); ++ mutex_unlock(&set_lock); + + kfree(set_enable); + } +@@ -1139,11 +1142,13 @@ static ssize_t lowpan_control_write(struct file *fp, + if (ret == -EINVAL) + return ret; + ++ mutex_lock(&set_lock); + if (listen_chan) { + l2cap_chan_close(listen_chan, 0); + l2cap_chan_put(listen_chan); + listen_chan = NULL; + } ++ mutex_unlock(&set_lock); + + if (conn) { + struct lowpan_peer *peer; +diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c +index 56e4ae7d7f638..70b8e2de40cf4 100644 +--- a/net/bluetooth/hci_event.c ++++ b/net/bluetooth/hci_event.c +@@ -2094,7 +2094,7 @@ static void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb) + + BT_DBG("%s num_rsp %d", hdev->name, num_rsp); + +- if (!num_rsp) ++ if (!num_rsp || skb->len < num_rsp * sizeof(*info) + 1) + return; + + if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) +@@ -3623,6 +3623,9 @@ static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev, + struct inquiry_info_with_rssi_and_pscan_mode *info; + info = (void *) (skb->data + 1); + ++ if (skb->len < num_rsp * sizeof(*info) + 1) ++ goto unlock; ++ + for (; num_rsp; num_rsp--, info++) { + u32 flags; + +@@ -3644,6 +3647,9 @@ static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev, + } else { + struct inquiry_info_with_rssi *info = (void *) (skb->data + 1); + ++ if (skb->len < num_rsp * sizeof(*info) + 1) ++ goto unlock; ++ + for (; num_rsp; num_rsp--, info++) { + u32 flags; + +@@ -3664,6 +3670,7 @@ static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev, + } + } + ++unlock: + hci_dev_unlock(hdev); + } + +@@ -3826,7 +3833,7 @@ static void hci_extended_inquiry_result_evt(struct hci_dev *hdev, + + BT_DBG("%s num_rsp %d", hdev->name, num_rsp); + +- if (!num_rsp) ++ if (!num_rsp || skb->len < num_rsp * sizeof(*info) + 1) + return; + + if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) +diff --git a/net/compat.c b/net/compat.c +index 790851e70dabb..45349658ed010 100644 +--- a/net/compat.c ++++ b/net/compat.c +@@ -289,6 +289,7 @@ void scm_detach_fds_compat(struct msghdr *kmsg, struct scm_cookie *scm) + break; + } + /* Bump the usage count and install the file. */ ++ __receive_sock(fp[i]); + fd_install(new_fd, get_file(fp[i])); + } + +diff --git a/net/core/sock.c b/net/core/sock.c +index af1201676abc3..3b65fedf77ca7 100644 +--- a/net/core/sock.c ++++ b/net/core/sock.c +@@ -2563,6 +2563,27 @@ int sock_no_mmap(struct file *file, struct socket *sock, struct vm_area_struct * + } + EXPORT_SYMBOL(sock_no_mmap); + ++/* ++ * When a file is received (via SCM_RIGHTS, etc), we must bump the ++ * various sock-based usage counts. ++ */ ++void __receive_sock(struct file *file) ++{ ++ struct socket *sock; ++ int error; ++ ++ /* ++ * The resulting value of "error" is ignored here since we only ++ * need to take action when the file is a socket and testing ++ * "sock" for NULL is sufficient. ++ */ ++ sock = sock_from_file(file, &error); ++ if (sock) { ++ sock_update_netprioidx(&sock->sk->sk_cgrp_data); ++ sock_update_classid(&sock->sk->sk_cgrp_data); ++ } ++} ++ + ssize_t sock_no_sendpage(struct socket *sock, struct page *page, int offset, size_t size, int flags) + { + ssize_t res; +diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c +index 3f9509679f0e1..0c8fcc050ad23 100644 +--- a/net/ipv4/fib_trie.c ++++ b/net/ipv4/fib_trie.c +@@ -1729,7 +1729,7 @@ struct fib_table *fib_trie_unmerge(struct fib_table *oldtb) + while ((l = leaf_walk_rcu(&tp, key)) != NULL) { + struct key_vector *local_l = NULL, *local_tp; + +- hlist_for_each_entry_rcu(fa, &l->leaf, fa_list) { ++ hlist_for_each_entry(fa, &l->leaf, fa_list) { + struct fib_alias *new_fa; + + if (local_tb->tb_id != fa->tb_id) +diff --git a/net/ipv4/gre_offload.c b/net/ipv4/gre_offload.c +index 6a7d980105f60..095c30863745a 100644 +--- a/net/ipv4/gre_offload.c ++++ b/net/ipv4/gre_offload.c +@@ -19,12 +19,12 @@ static struct sk_buff *gre_gso_segment(struct sk_buff *skb, + netdev_features_t features) + { + int tnl_hlen = skb_inner_mac_header(skb) - skb_transport_header(skb); ++ bool need_csum, need_recompute_csum, gso_partial; + struct sk_buff *segs = ERR_PTR(-EINVAL); + u16 mac_offset = skb->mac_header; + __be16 protocol = skb->protocol; + u16 mac_len = skb->mac_len; + int gre_offset, outer_hlen; +- bool need_csum, gso_partial; + + if (!skb->encapsulation) + goto out; +@@ -45,6 +45,7 @@ static struct sk_buff *gre_gso_segment(struct sk_buff *skb, + skb->protocol = skb->inner_protocol; + + need_csum = !!(skb_shinfo(skb)->gso_type & SKB_GSO_GRE_CSUM); ++ need_recompute_csum = skb->csum_not_inet; + skb->encap_hdr_csum = need_csum; + + features &= skb->dev->hw_enc_features; +@@ -102,7 +103,15 @@ static struct sk_buff *gre_gso_segment(struct sk_buff *skb, + } + + *(pcsum + 1) = 0; +- *pcsum = gso_make_checksum(skb, 0); ++ if (need_recompute_csum && !skb_is_gso(skb)) { ++ __wsum csum; ++ ++ csum = skb_checksum(skb, gre_offset, ++ skb->len - gre_offset, 0); ++ *pcsum = csum_fold(csum); ++ } else { ++ *pcsum = gso_make_checksum(skb, 0); ++ } + } while ((skb = skb->next)); + out: + return segs; +diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c +index 7826fba34b14b..08ba0f91f2aba 100644 +--- a/net/ipv4/inet_connection_sock.c ++++ b/net/ipv4/inet_connection_sock.c +@@ -276,51 +276,12 @@ static inline int sk_reuseport_match(struct inet_bind_bucket *tb, + ipv6_only_sock(sk), true); + } + +-/* Obtain a reference to a local port for the given sock, +- * if snum is zero it means select any available local port. +- * We try to allocate an odd port (and leave even ports for connect()) +- */ +-int inet_csk_get_port(struct sock *sk, unsigned short snum) ++void inet_csk_update_fastreuse(struct inet_bind_bucket *tb, ++ struct sock *sk) + { +- bool reuse = sk->sk_reuse && sk->sk_state != TCP_LISTEN; +- struct inet_hashinfo *hinfo = sk->sk_prot->h.hashinfo; +- int ret = 1, port = snum; +- struct inet_bind_hashbucket *head; +- struct net *net = sock_net(sk); +- struct inet_bind_bucket *tb = NULL; + kuid_t uid = sock_i_uid(sk); ++ bool reuse = sk->sk_reuse && sk->sk_state != TCP_LISTEN; + +- if (!port) { +- head = inet_csk_find_open_port(sk, &tb, &port); +- if (!head) +- return ret; +- if (!tb) +- goto tb_not_found; +- goto success; +- } +- head = &hinfo->bhash[inet_bhashfn(net, port, +- hinfo->bhash_size)]; +- spin_lock_bh(&head->lock); +- inet_bind_bucket_for_each(tb, &head->chain) +- if (net_eq(ib_net(tb), net) && tb->port == port) +- goto tb_found; +-tb_not_found: +- tb = inet_bind_bucket_create(hinfo->bind_bucket_cachep, +- net, head, port); +- if (!tb) +- goto fail_unlock; +-tb_found: +- if (!hlist_empty(&tb->owners)) { +- if (sk->sk_reuse == SK_FORCE_REUSE) +- goto success; +- +- if ((tb->fastreuse > 0 && reuse) || +- sk_reuseport_match(tb, sk)) +- goto success; +- if (inet_csk_bind_conflict(sk, tb, true, true)) +- goto fail_unlock; +- } +-success: + if (hlist_empty(&tb->owners)) { + tb->fastreuse = reuse; + if (sk->sk_reuseport) { +@@ -364,6 +325,54 @@ success: + tb->fastreuseport = 0; + } + } ++} ++ ++/* Obtain a reference to a local port for the given sock, ++ * if snum is zero it means select any available local port. ++ * We try to allocate an odd port (and leave even ports for connect()) ++ */ ++int inet_csk_get_port(struct sock *sk, unsigned short snum) ++{ ++ bool reuse = sk->sk_reuse && sk->sk_state != TCP_LISTEN; ++ struct inet_hashinfo *hinfo = sk->sk_prot->h.hashinfo; ++ int ret = 1, port = snum; ++ struct inet_bind_hashbucket *head; ++ struct net *net = sock_net(sk); ++ struct inet_bind_bucket *tb = NULL; ++ ++ if (!port) { ++ head = inet_csk_find_open_port(sk, &tb, &port); ++ if (!head) ++ return ret; ++ if (!tb) ++ goto tb_not_found; ++ goto success; ++ } ++ head = &hinfo->bhash[inet_bhashfn(net, port, ++ hinfo->bhash_size)]; ++ spin_lock_bh(&head->lock); ++ inet_bind_bucket_for_each(tb, &head->chain) ++ if (net_eq(ib_net(tb), net) && tb->port == port) ++ goto tb_found; ++tb_not_found: ++ tb = inet_bind_bucket_create(hinfo->bind_bucket_cachep, ++ net, head, port); ++ if (!tb) ++ goto fail_unlock; ++tb_found: ++ if (!hlist_empty(&tb->owners)) { ++ if (sk->sk_reuse == SK_FORCE_REUSE) ++ goto success; ++ ++ if ((tb->fastreuse > 0 && reuse) || ++ sk_reuseport_match(tb, sk)) ++ goto success; ++ if (inet_csk_bind_conflict(sk, tb, true, true)) ++ goto fail_unlock; ++ } ++success: ++ inet_csk_update_fastreuse(tb, sk); ++ + if (!inet_csk(sk)->icsk_bind_hash) + inet_bind_hash(sk, tb, port); + WARN_ON(inet_csk(sk)->icsk_bind_hash != tb); +diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c +index 0af13f5bdc9a3..8a54babf5c903 100644 +--- a/net/ipv4/inet_hashtables.c ++++ b/net/ipv4/inet_hashtables.c +@@ -160,6 +160,7 @@ int __inet_inherit_port(const struct sock *sk, struct sock *child) + return -ENOMEM; + } + } ++ inet_csk_update_fastreuse(tb, child); + } + inet_bind_hash(child, tb, port); + spin_unlock(&head->lock); +diff --git a/net/ipv6/anycast.c b/net/ipv6/anycast.c +index 0bbab8a4b5d84..4d8b3d1d530bd 100644 +--- a/net/ipv6/anycast.c ++++ b/net/ipv6/anycast.c +@@ -170,7 +170,7 @@ int ipv6_sock_ac_drop(struct sock *sk, int ifindex, const struct in6_addr *addr) + return 0; + } + +-void ipv6_sock_ac_close(struct sock *sk) ++void __ipv6_sock_ac_close(struct sock *sk) + { + struct ipv6_pinfo *np = inet6_sk(sk); + struct net_device *dev = NULL; +@@ -178,10 +178,7 @@ void ipv6_sock_ac_close(struct sock *sk) + struct net *net = sock_net(sk); + int prev_index; + +- if (!np->ipv6_ac_list) +- return; +- +- rtnl_lock(); ++ ASSERT_RTNL(); + pac = np->ipv6_ac_list; + np->ipv6_ac_list = NULL; + +@@ -198,6 +195,16 @@ void ipv6_sock_ac_close(struct sock *sk) + sock_kfree_s(sk, pac, sizeof(*pac)); + pac = next; + } ++} ++ ++void ipv6_sock_ac_close(struct sock *sk) ++{ ++ struct ipv6_pinfo *np = inet6_sk(sk); ++ ++ if (!np->ipv6_ac_list) ++ return; ++ rtnl_lock(); ++ __ipv6_sock_ac_close(sk); + rtnl_unlock(); + } + +diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c +index c183222967d09..3f44316db51b0 100644 +--- a/net/ipv6/ipv6_sockglue.c ++++ b/net/ipv6/ipv6_sockglue.c +@@ -207,6 +207,7 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname, + + fl6_free_socklist(sk); + __ipv6_sock_mc_close(sk); ++ __ipv6_sock_ac_close(sk); + + /* + * Sock is moving from IPv6 to IPv4 (sk_prot), so +diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c +index 77ab9cc1a230a..6af5fda6461ce 100644 +--- a/net/mac80211/sta_info.c ++++ b/net/mac80211/sta_info.c +@@ -952,7 +952,7 @@ static void __sta_info_destroy_part2(struct sta_info *sta) + might_sleep(); + lockdep_assert_held(&local->sta_mtx); + +- while (sta->sta_state == IEEE80211_STA_AUTHORIZED) { ++ if (sta->sta_state == IEEE80211_STA_AUTHORIZED) { + ret = sta_info_move_state(sta, IEEE80211_STA_ASSOC); + WARN_ON_ONCE(ret); + } +diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c +index 2156571455dbf..a95fe5fe9f046 100644 +--- a/net/netfilter/ipvs/ip_vs_core.c ++++ b/net/netfilter/ipvs/ip_vs_core.c +@@ -1916,14 +1916,14 @@ ip_vs_in(struct netns_ipvs *ipvs, unsigned int hooknum, struct sk_buff *skb, int + + conn_reuse_mode = sysctl_conn_reuse_mode(ipvs); + if (conn_reuse_mode && !iph.fragoffs && is_new_conn(skb, &iph) && cp) { +- bool uses_ct = false, resched = false; ++ bool old_ct = false, resched = false; + + if (unlikely(sysctl_expire_nodest_conn(ipvs)) && cp->dest && + unlikely(!atomic_read(&cp->dest->weight))) { + resched = true; +- uses_ct = ip_vs_conn_uses_conntrack(cp, skb); ++ old_ct = ip_vs_conn_uses_old_conntrack(cp, skb); + } else if (is_new_conn_expected(cp, conn_reuse_mode)) { +- uses_ct = ip_vs_conn_uses_conntrack(cp, skb); ++ old_ct = ip_vs_conn_uses_old_conntrack(cp, skb); + if (!atomic_read(&cp->n_control)) { + resched = true; + } else { +@@ -1931,15 +1931,17 @@ ip_vs_in(struct netns_ipvs *ipvs, unsigned int hooknum, struct sk_buff *skb, int + * that uses conntrack while it is still + * referenced by controlled connection(s). + */ +- resched = !uses_ct; ++ resched = !old_ct; + } + } + + if (resched) { ++ if (!old_ct) ++ cp->flags &= ~IP_VS_CONN_F_NFCT; + if (!atomic_read(&cp->n_control)) + ip_vs_conn_expire_now(cp); + __ip_vs_conn_put(cp); +- if (uses_ct) ++ if (old_ct) + return NF_DROP; + cp = NULL; + } +diff --git a/net/nfc/rawsock.c b/net/nfc/rawsock.c +index e2188deb08dc3..b927730d9ab06 100644 +--- a/net/nfc/rawsock.c ++++ b/net/nfc/rawsock.c +@@ -344,10 +344,13 @@ static int rawsock_create(struct net *net, struct socket *sock, + if ((sock->type != SOCK_SEQPACKET) && (sock->type != SOCK_RAW)) + return -ESOCKTNOSUPPORT; + +- if (sock->type == SOCK_RAW) ++ if (sock->type == SOCK_RAW) { ++ if (!capable(CAP_NET_RAW)) ++ return -EPERM; + sock->ops = &rawsock_raw_ops; +- else ++ } else { + sock->ops = &rawsock_ops; ++ } + + sk = sk_alloc(net, PF_NFC, GFP_ATOMIC, nfc_proto->proto, kern); + if (!sk) +diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c +index 737e37b28d93b..a39ef1a048fde 100644 +--- a/net/openvswitch/conntrack.c ++++ b/net/openvswitch/conntrack.c +@@ -255,10 +255,6 @@ void ovs_ct_fill_key(const struct sk_buff *skb, struct sw_flow_key *key) + ovs_ct_update_key(skb, NULL, key, false, false); + } + +-#define IN6_ADDR_INITIALIZER(ADDR) \ +- { (ADDR).s6_addr32[0], (ADDR).s6_addr32[1], \ +- (ADDR).s6_addr32[2], (ADDR).s6_addr32[3] } +- + int ovs_ct_put_key(const struct sw_flow_key *swkey, + const struct sw_flow_key *output, struct sk_buff *skb) + { +@@ -280,24 +276,30 @@ int ovs_ct_put_key(const struct sw_flow_key *swkey, + + if (swkey->ct_orig_proto) { + if (swkey->eth.type == htons(ETH_P_IP)) { +- struct ovs_key_ct_tuple_ipv4 orig = { +- output->ipv4.ct_orig.src, +- output->ipv4.ct_orig.dst, +- output->ct.orig_tp.src, +- output->ct.orig_tp.dst, +- output->ct_orig_proto, +- }; ++ struct ovs_key_ct_tuple_ipv4 orig; ++ ++ memset(&orig, 0, sizeof(orig)); ++ orig.ipv4_src = output->ipv4.ct_orig.src; ++ orig.ipv4_dst = output->ipv4.ct_orig.dst; ++ orig.src_port = output->ct.orig_tp.src; ++ orig.dst_port = output->ct.orig_tp.dst; ++ orig.ipv4_proto = output->ct_orig_proto; ++ + if (nla_put(skb, OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4, + sizeof(orig), &orig)) + return -EMSGSIZE; + } else if (swkey->eth.type == htons(ETH_P_IPV6)) { +- struct ovs_key_ct_tuple_ipv6 orig = { +- IN6_ADDR_INITIALIZER(output->ipv6.ct_orig.src), +- IN6_ADDR_INITIALIZER(output->ipv6.ct_orig.dst), +- output->ct.orig_tp.src, +- output->ct.orig_tp.dst, +- output->ct_orig_proto, +- }; ++ struct ovs_key_ct_tuple_ipv6 orig; ++ ++ memset(&orig, 0, sizeof(orig)); ++ memcpy(orig.ipv6_src, output->ipv6.ct_orig.src.s6_addr32, ++ sizeof(orig.ipv6_src)); ++ memcpy(orig.ipv6_dst, output->ipv6.ct_orig.dst.s6_addr32, ++ sizeof(orig.ipv6_dst)); ++ orig.src_port = output->ct.orig_tp.src; ++ orig.dst_port = output->ct.orig_tp.dst; ++ orig.ipv6_proto = output->ct_orig_proto; ++ + if (nla_put(skb, OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6, + sizeof(orig), &orig)) + return -EMSGSIZE; +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index 102750bd751cc..c2356611b3cba 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -989,6 +989,7 @@ static int prb_queue_frozen(struct tpacket_kbdq_core *pkc) + } + + static void prb_clear_blk_fill_status(struct packet_ring_buffer *rb) ++ __releases(&pkc->blk_fill_in_prog_lock) + { + struct tpacket_kbdq_core *pkc = GET_PBDQC_FROM_RB(rb); + atomic_dec(&pkc->blk_fill_in_prog); +@@ -1036,6 +1037,7 @@ static void prb_fill_curr_block(char *curr, + struct tpacket_kbdq_core *pkc, + struct tpacket_block_desc *pbd, + unsigned int len) ++ __acquires(&pkc->blk_fill_in_prog_lock) + { + struct tpacket3_hdr *ppd; + +@@ -2311,8 +2313,11 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, + if (do_vnet && + virtio_net_hdr_from_skb(skb, h.raw + macoff - + sizeof(struct virtio_net_hdr), +- vio_le(), true, 0)) ++ vio_le(), true, 0)) { ++ if (po->tp_version == TPACKET_V3) ++ prb_clear_blk_fill_status(&po->rx_ring); + goto drop_n_account; ++ } + + if (po->tp_version <= TPACKET_V2) { + packet_increment_rx_head(po, &po->rx_ring); +@@ -2418,7 +2423,7 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, + __clear_bit(slot_id, po->rx_ring.rx_owner_map); + spin_unlock(&sk->sk_receive_queue.lock); + sk->sk_data_ready(sk); +- } else { ++ } else if (po->tp_version == TPACKET_V3) { + prb_clear_blk_fill_status(&po->rx_ring); + } + +diff --git a/net/rxrpc/call_object.c b/net/rxrpc/call_object.c +index 7021725fa38a7..1c98a026b41ac 100644 +--- a/net/rxrpc/call_object.c ++++ b/net/rxrpc/call_object.c +@@ -275,7 +275,7 @@ struct rxrpc_call *rxrpc_new_client_call(struct rxrpc_sock *rx, + */ + ret = rxrpc_connect_call(call, cp, srx, gfp); + if (ret < 0) +- goto error; ++ goto error_attached_to_socket; + + trace_rxrpc_call(call, rxrpc_call_connected, atomic_read(&call->usage), + here, NULL); +@@ -295,18 +295,29 @@ struct rxrpc_call *rxrpc_new_client_call(struct rxrpc_sock *rx, + error_dup_user_ID: + write_unlock(&rx->call_lock); + release_sock(&rx->sk); +- ret = -EEXIST; +- +-error: + __rxrpc_set_call_completion(call, RXRPC_CALL_LOCAL_ERROR, +- RX_CALL_DEAD, ret); ++ RX_CALL_DEAD, -EEXIST); + trace_rxrpc_call(call, rxrpc_call_error, atomic_read(&call->usage), +- here, ERR_PTR(ret)); ++ here, ERR_PTR(-EEXIST)); + rxrpc_release_call(rx, call); + mutex_unlock(&call->user_mutex); + rxrpc_put_call(call, rxrpc_call_put); +- _leave(" = %d", ret); +- return ERR_PTR(ret); ++ _leave(" = -EEXIST"); ++ return ERR_PTR(-EEXIST); ++ ++ /* We got an error, but the call is attached to the socket and is in ++ * need of release. However, we might now race with recvmsg() when ++ * completing the call queues it. Return 0 from sys_sendmsg() and ++ * leave the error to recvmsg() to deal with. ++ */ ++error_attached_to_socket: ++ trace_rxrpc_call(call, rxrpc_call_error, atomic_read(&call->usage), ++ here, ERR_PTR(ret)); ++ set_bit(RXRPC_CALL_DISCONNECTED, &call->flags); ++ __rxrpc_set_call_completion(call, RXRPC_CALL_LOCAL_ERROR, ++ RX_CALL_DEAD, ret); ++ _leave(" = c=%08x [err]", call->debug_id); ++ return call; + } + + /* +diff --git a/net/rxrpc/conn_object.c b/net/rxrpc/conn_object.c +index af02328205979..0e5087b9e07c9 100644 +--- a/net/rxrpc/conn_object.c ++++ b/net/rxrpc/conn_object.c +@@ -196,9 +196,11 @@ void rxrpc_disconnect_call(struct rxrpc_call *call) + + call->peer->cong_cwnd = call->cong_cwnd; + +- spin_lock_bh(&conn->params.peer->lock); +- hlist_del_init(&call->error_link); +- spin_unlock_bh(&conn->params.peer->lock); ++ if (!hlist_unhashed(&call->error_link)) { ++ spin_lock_bh(&conn->params.peer->lock); ++ hlist_del_init(&call->error_link); ++ spin_unlock_bh(&conn->params.peer->lock); ++ } + + if (rxrpc_is_client_call(call)) + return rxrpc_disconnect_client_call(call); +diff --git a/net/rxrpc/recvmsg.c b/net/rxrpc/recvmsg.c +index e82e91fe61789..1cdd8b380d47b 100644 +--- a/net/rxrpc/recvmsg.c ++++ b/net/rxrpc/recvmsg.c +@@ -522,7 +522,7 @@ try_again: + goto error_unlock_call; + } + +- if (msg->msg_name) { ++ if (msg->msg_name && call->peer) { + struct sockaddr_rxrpc *srx = msg->msg_name; + size_t len = sizeof(call->peer->srx); + +diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c +index f4386ad975cf0..8f9a2a7eeb7ce 100644 +--- a/net/rxrpc/sendmsg.c ++++ b/net/rxrpc/sendmsg.c +@@ -579,6 +579,9 @@ int rxrpc_do_sendmsg(struct rxrpc_sock *rx, struct msghdr *msg, size_t len) + if (IS_ERR(call)) + return PTR_ERR(call); + /* ... and we have the call lock. */ ++ ret = 0; ++ if (READ_ONCE(call->state) == RXRPC_CALL_COMPLETE) ++ goto out_put_unlock; + } else { + switch (READ_ONCE(call->state)) { + case RXRPC_CALL_UNINITIALISED: +diff --git a/net/socket.c b/net/socket.c +index 6a5ec658fcd83..c74cfe1ee1699 100644 +--- a/net/socket.c ++++ b/net/socket.c +@@ -496,7 +496,7 @@ static struct socket *sockfd_lookup_light(int fd, int *err, int *fput_needed) + if (f.file) { + sock = sock_from_file(f.file, err); + if (likely(sock)) { +- *fput_needed = f.flags; ++ *fput_needed = f.flags & FDPUT_FPUT; + return sock; + } + fdput(f); +diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c +index d0b75781e6f7a..9be7ee322093b 100644 +--- a/net/wireless/nl80211.c ++++ b/net/wireless/nl80211.c +@@ -11859,13 +11859,13 @@ static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info) + if (!wdev_running(wdev)) + return -ENETDOWN; + } +- +- if (!vcmd->doit) +- return -EOPNOTSUPP; + } else { + wdev = NULL; + } + ++ if (!vcmd->doit) ++ return -EOPNOTSUPP; ++ + if (info->attrs[NL80211_ATTR_VENDOR_DATA]) { + data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]); + len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]); +diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c +index 371ae368da355..accd3846f1e3e 100644 +--- a/security/smack/smackfs.c ++++ b/security/smack/smackfs.c +@@ -912,7 +912,7 @@ static ssize_t smk_set_cipso(struct file *file, const char __user *buf, + } + + ret = sscanf(rule, "%d", &maplevel); +- if (ret != 1 || maplevel > SMACK_CIPSO_MAXLEVEL) ++ if (ret != 1 || maplevel < 0 || maplevel > SMACK_CIPSO_MAXLEVEL) + goto out; + + rule += SMK_DIGITLEN; +@@ -933,6 +933,10 @@ static ssize_t smk_set_cipso(struct file *file, const char __user *buf, + + for (i = 0; i < catlen; i++) { + rule += SMK_DIGITLEN; ++ if (rule > data + count) { ++ rc = -EOVERFLOW; ++ goto out; ++ } + ret = sscanf(rule, "%u", &cat); + if (ret != 1 || cat > SMACK_CIPSO_MAXCATNUM) + goto out; +@@ -2746,7 +2750,6 @@ static int smk_open_relabel_self(struct inode *inode, struct file *file) + static ssize_t smk_write_relabel_self(struct file *file, const char __user *buf, + size_t count, loff_t *ppos) + { +- struct task_smack *tsp = current_security(); + char *data; + int rc; + LIST_HEAD(list_tmp); +@@ -2771,11 +2774,21 @@ static ssize_t smk_write_relabel_self(struct file *file, const char __user *buf, + kfree(data); + + if (!rc || (rc == -EINVAL && list_empty(&list_tmp))) { ++ struct cred *new; ++ struct task_smack *tsp; ++ ++ new = prepare_creds(); ++ if (!new) { ++ rc = -ENOMEM; ++ goto out; ++ } ++ tsp = new->security; + smk_destroy_label_list(&tsp->smk_relabel); + list_splice(&list_tmp, &tsp->smk_relabel); ++ commit_creds(new); + return count; + } +- ++out: + smk_destroy_label_list(&list_tmp); + return rc; + } +diff --git a/sound/core/seq/oss/seq_oss.c b/sound/core/seq/oss/seq_oss.c +index 8cdf489df80e0..4b78979599131 100644 +--- a/sound/core/seq/oss/seq_oss.c ++++ b/sound/core/seq/oss/seq_oss.c +@@ -181,10 +181,16 @@ static long + odev_ioctl(struct file *file, unsigned int cmd, unsigned long arg) + { + struct seq_oss_devinfo *dp; ++ long rc; ++ + dp = file->private_data; + if (snd_BUG_ON(!dp)) + return -ENXIO; +- return snd_seq_oss_ioctl(dp, cmd, arg); ++ ++ mutex_lock(®ister_mutex); ++ rc = snd_seq_oss_ioctl(dp, cmd, arg); ++ mutex_unlock(®ister_mutex); ++ return rc; + } + + #ifdef CONFIG_COMPAT +diff --git a/sound/pci/echoaudio/echoaudio.c b/sound/pci/echoaudio/echoaudio.c +index e1f0bcd45c378..b58a098a7270d 100644 +--- a/sound/pci/echoaudio/echoaudio.c ++++ b/sound/pci/echoaudio/echoaudio.c +@@ -2215,7 +2215,6 @@ static int snd_echo_resume(struct device *dev) + if (err < 0) { + kfree(commpage_bak); + dev_err(dev, "resume init_hw err=%d\n", err); +- snd_echo_free(chip); + return err; + } + +@@ -2242,7 +2241,6 @@ static int snd_echo_resume(struct device *dev) + if (request_irq(pci->irq, snd_echo_interrupt, IRQF_SHARED, + KBUILD_MODNAME, chip)) { + dev_err(chip->card->dev, "cannot grab irq\n"); +- snd_echo_free(chip); + return -EBUSY; + } + chip->irq = pci->irq; +diff --git a/sound/soc/intel/boards/bxt_rt298.c b/sound/soc/intel/boards/bxt_rt298.c +index 7843104fadcbf..1b01bc318fd25 100644 +--- a/sound/soc/intel/boards/bxt_rt298.c ++++ b/sound/soc/intel/boards/bxt_rt298.c +@@ -529,6 +529,7 @@ static int bxt_card_late_probe(struct snd_soc_card *card) + /* broxton audio machine driver for SPT + RT298S */ + static struct snd_soc_card broxton_rt298 = { + .name = "broxton-rt298", ++ .owner = THIS_MODULE, + .dai_link = broxton_rt298_dais, + .num_links = ARRAY_SIZE(broxton_rt298_dais), + .controls = broxton_controls, +@@ -544,6 +545,7 @@ static struct snd_soc_card broxton_rt298 = { + + static struct snd_soc_card geminilake_rt298 = { + .name = "geminilake-rt298", ++ .owner = THIS_MODULE, + .dai_link = broxton_rt298_dais, + .num_links = ARRAY_SIZE(broxton_rt298_dais), + .controls = broxton_controls, +diff --git a/sound/usb/card.h b/sound/usb/card.h +index ed87cc83eb47d..0cde519bfa420 100644 +--- a/sound/usb/card.h ++++ b/sound/usb/card.h +@@ -126,6 +126,7 @@ struct snd_usb_substream { + unsigned int tx_length_quirk:1; /* add length specifier to transfers */ + unsigned int fmt_type; /* USB audio format type (1-3) */ + unsigned int pkt_offset_adj; /* Bytes to drop from beginning of packets (for non-compliant devices) */ ++ unsigned int stream_offset_adj; /* Bytes to drop from beginning of stream (for non-compliant devices) */ + + unsigned int running: 1; /* running status */ + +diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c +index 5604cce30a582..d7878ed5ecc07 100644 +--- a/sound/usb/mixer_quirks.c ++++ b/sound/usb/mixer_quirks.c +@@ -196,6 +196,7 @@ static const struct rc_config { + { USB_ID(0x041e, 0x3042), 0, 1, 1, 1, 1, 0x000d }, /* Usb X-Fi S51 */ + { USB_ID(0x041e, 0x30df), 0, 1, 1, 1, 1, 0x000d }, /* Usb X-Fi S51 Pro */ + { USB_ID(0x041e, 0x3237), 0, 1, 1, 1, 1, 0x000d }, /* Usb X-Fi S51 Pro */ ++ { USB_ID(0x041e, 0x3263), 0, 1, 1, 1, 1, 0x000d }, /* Usb X-Fi S51 Pro */ + { USB_ID(0x041e, 0x3048), 2, 2, 6, 6, 2, 0x6e91 }, /* Toshiba SB0500 */ + }; + +diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c +index ff38fca1781b6..f27213b846e6b 100644 +--- a/sound/usb/pcm.c ++++ b/sound/usb/pcm.c +@@ -1313,6 +1313,12 @@ static void retire_capture_urb(struct snd_usb_substream *subs, + // continue; + } + bytes = urb->iso_frame_desc[i].actual_length; ++ if (subs->stream_offset_adj > 0) { ++ unsigned int adj = min(subs->stream_offset_adj, bytes); ++ cp += adj; ++ bytes -= adj; ++ subs->stream_offset_adj -= adj; ++ } + frames = bytes / stride; + if (!subs->txfr_quirk) + bytes = frames * stride; +diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h +index ec56ce3820619..689fd3103e5b6 100644 +--- a/sound/usb/quirks-table.h ++++ b/sound/usb/quirks-table.h +@@ -3335,7 +3335,13 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"), + * with. + */ + { +- USB_DEVICE(0x534d, 0x2109), ++ .match_flags = USB_DEVICE_ID_MATCH_DEVICE | ++ USB_DEVICE_ID_MATCH_INT_CLASS | ++ USB_DEVICE_ID_MATCH_INT_SUBCLASS, ++ .idVendor = 0x534d, ++ .idProduct = 0x2109, ++ .bInterfaceClass = USB_CLASS_AUDIO, ++ .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL, + .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { + .vendor_name = "MacroSilicon", + .product_name = "MS2109", +@@ -3374,5 +3380,61 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"), + } + } + }, ++{ ++ /* ++ * PIONEER DJ DDJ-RB ++ * PCM is 4 channels out, 2 dummy channels in @ 44.1 fixed ++ * The feedback for the output is the dummy input. ++ */ ++ USB_DEVICE_VENDOR_SPEC(0x2b73, 0x000e), ++ .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { ++ .ifnum = QUIRK_ANY_INTERFACE, ++ .type = QUIRK_COMPOSITE, ++ .data = (const struct snd_usb_audio_quirk[]) { ++ { ++ .ifnum = 0, ++ .type = QUIRK_AUDIO_FIXED_ENDPOINT, ++ .data = &(const struct audioformat) { ++ .formats = SNDRV_PCM_FMTBIT_S24_3LE, ++ .channels = 4, ++ .iface = 0, ++ .altsetting = 1, ++ .altset_idx = 1, ++ .endpoint = 0x01, ++ .ep_attr = USB_ENDPOINT_XFER_ISOC| ++ USB_ENDPOINT_SYNC_ASYNC, ++ .rates = SNDRV_PCM_RATE_44100, ++ .rate_min = 44100, ++ .rate_max = 44100, ++ .nr_rates = 1, ++ .rate_table = (unsigned int[]) { 44100 } ++ } ++ }, ++ { ++ .ifnum = 0, ++ .type = QUIRK_AUDIO_FIXED_ENDPOINT, ++ .data = &(const struct audioformat) { ++ .formats = SNDRV_PCM_FMTBIT_S24_3LE, ++ .channels = 2, ++ .iface = 0, ++ .altsetting = 1, ++ .altset_idx = 1, ++ .endpoint = 0x82, ++ .ep_attr = USB_ENDPOINT_XFER_ISOC| ++ USB_ENDPOINT_SYNC_ASYNC| ++ USB_ENDPOINT_USAGE_IMPLICIT_FB, ++ .rates = SNDRV_PCM_RATE_44100, ++ .rate_min = 44100, ++ .rate_max = 44100, ++ .nr_rates = 1, ++ .rate_table = (unsigned int[]) { 44100 } ++ } ++ }, ++ { ++ .ifnum = -1 ++ } ++ } ++ } ++}, + + #undef USB_DEVICE_VENDOR_SPEC +diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c +index cd36394e27ae6..4f4dc43e56a7b 100644 +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -1120,6 +1120,9 @@ void snd_usb_set_format_quirk(struct snd_usb_substream *subs, + case USB_ID(0x041e, 0x3f19): /* E-Mu 0204 USB */ + set_format_emu_quirk(subs, fmt); + break; ++ case USB_ID(0x534d, 0x2109): /* MacroSilicon MS2109 */ ++ subs->stream_offset_adj = 2; ++ break; + } + } + +diff --git a/sound/usb/stream.c b/sound/usb/stream.c +index d1776e5517ffe..452646959586e 100644 +--- a/sound/usb/stream.c ++++ b/sound/usb/stream.c +@@ -95,6 +95,7 @@ static void snd_usb_init_substream(struct snd_usb_stream *as, + subs->tx_length_quirk = as->chip->tx_length_quirk; + subs->speed = snd_usb_get_speed(subs->dev); + subs->pkt_offset_adj = 0; ++ subs->stream_offset_adj = 0; + + snd_usb_set_pcm_ops(as->pcm, stream); + +diff --git a/tools/build/Build.include b/tools/build/Build.include +index d9048f145f97a..63bb9752612a8 100644 +--- a/tools/build/Build.include ++++ b/tools/build/Build.include +@@ -74,7 +74,8 @@ dep-cmd = $(if $(wildcard $(fixdep)), + # dependencies in the cmd file + if_changed_dep = $(if $(strip $(any-prereq) $(arg-check)), \ + @set -e; \ +- $(echo-cmd) $(cmd_$(1)) && $(dep-cmd)) ++ $(echo-cmd) $(cmd_$(1)); \ ++ $(dep-cmd)) + + # if_changed - execute command if any prerequisite is newer than + # target, or command line has changed +diff --git a/tools/build/Makefile.feature b/tools/build/Makefile.feature +index c71a05b9c984f..79427b09590c5 100644 +--- a/tools/build/Makefile.feature ++++ b/tools/build/Makefile.feature +@@ -7,7 +7,7 @@ endif + + feature_check = $(eval $(feature_check_code)) + define feature_check_code +- feature-$(1) := $(shell $(MAKE) OUTPUT=$(OUTPUT_FEATURES) CFLAGS="$(EXTRA_CFLAGS) $(FEATURE_CHECK_CFLAGS-$(1))" CXXFLAGS="$(EXTRA_CXXFLAGS) $(FEATURE_CHECK_CXXFLAGS-$(1))" LDFLAGS="$(LDFLAGS) $(FEATURE_CHECK_LDFLAGS-$(1))" -C $(feature_dir) $(OUTPUT_FEATURES)test-$1.bin >/dev/null 2>/dev/null && echo 1 || echo 0) ++ feature-$(1) := $(shell $(MAKE) OUTPUT=$(OUTPUT_FEATURES) CC="$(CC)" CXX="$(CXX)" CFLAGS="$(EXTRA_CFLAGS) $(FEATURE_CHECK_CFLAGS-$(1))" CXXFLAGS="$(EXTRA_CXXFLAGS) $(FEATURE_CHECK_CXXFLAGS-$(1))" LDFLAGS="$(LDFLAGS) $(FEATURE_CHECK_LDFLAGS-$(1))" -C $(feature_dir) $(OUTPUT_FEATURES)test-$1.bin >/dev/null 2>/dev/null && echo 1 || echo 0) + endef + + feature_set = $(eval $(feature_set_code)) +diff --git a/tools/build/feature/Makefile b/tools/build/feature/Makefile +index 96982640fbf88..26316749e594a 100644 +--- a/tools/build/feature/Makefile ++++ b/tools/build/feature/Makefile +@@ -55,8 +55,6 @@ FILES= \ + + FILES := $(addprefix $(OUTPUT),$(FILES)) + +-CC ?= $(CROSS_COMPILE)gcc +-CXX ?= $(CROSS_COMPILE)g++ + PKG_CONFIG ?= $(CROSS_COMPILE)pkg-config + LLVM_CONFIG ?= llvm-config + +diff --git a/tools/lib/traceevent/event-parse.c b/tools/lib/traceevent/event-parse.c +index 8211e8010e09b..d260ca680f074 100644 +--- a/tools/lib/traceevent/event-parse.c ++++ b/tools/lib/traceevent/event-parse.c +@@ -2780,6 +2780,7 @@ process_dynamic_array_len(struct event_format *event, struct print_arg *arg, + if (read_expected(EVENT_DELIM, ")") < 0) + goto out_err; + ++ free_token(token); + type = read_token(&token); + *tok = token; + +diff --git a/tools/perf/bench/mem-functions.c b/tools/perf/bench/mem-functions.c +index 0251dd348124a..4864fc67d01b5 100644 +--- a/tools/perf/bench/mem-functions.c ++++ b/tools/perf/bench/mem-functions.c +@@ -222,12 +222,8 @@ static int bench_mem_common(int argc, const char **argv, struct bench_mem_info * + return 0; + } + +-static u64 do_memcpy_cycles(const struct function *r, size_t size, void *src, void *dst) ++static void memcpy_prefault(memcpy_t fn, size_t size, void *src, void *dst) + { +- u64 cycle_start = 0ULL, cycle_end = 0ULL; +- memcpy_t fn = r->fn.memcpy; +- int i; +- + /* Make sure to always prefault zero pages even if MMAP_THRESH is crossed: */ + memset(src, 0, size); + +@@ -236,6 +232,15 @@ static u64 do_memcpy_cycles(const struct function *r, size_t size, void *src, vo + * to not measure page fault overhead: + */ + fn(dst, src, size); ++} ++ ++static u64 do_memcpy_cycles(const struct function *r, size_t size, void *src, void *dst) ++{ ++ u64 cycle_start = 0ULL, cycle_end = 0ULL; ++ memcpy_t fn = r->fn.memcpy; ++ int i; ++ ++ memcpy_prefault(fn, size, src, dst); + + cycle_start = get_cycles(); + for (i = 0; i < nr_loops; ++i) +@@ -251,11 +256,7 @@ static double do_memcpy_gettimeofday(const struct function *r, size_t size, void + memcpy_t fn = r->fn.memcpy; + int i; + +- /* +- * We prefault the freshly allocated memory range here, +- * to not measure page fault overhead: +- */ +- fn(dst, src, size); ++ memcpy_prefault(fn, size, src, dst); + + BUG_ON(gettimeofday(&tv_start, NULL)); + for (i = 0; i < nr_loops; ++i) +diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c +index 4357141c7c924..6522b6513895c 100644 +--- a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c ++++ b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c +@@ -1129,6 +1129,7 @@ static int intel_pt_walk_fup(struct intel_pt_decoder *decoder) + return 0; + if (err == -EAGAIN || + intel_pt_fup_with_nlip(decoder, &intel_pt_insn, ip, err)) { ++ decoder->pkt_state = INTEL_PT_STATE_IN_SYNC; + if (intel_pt_fup_event(decoder)) + return 0; + return -EAGAIN; +@@ -1780,17 +1781,13 @@ next: + } + if (decoder->set_fup_mwait) + no_tip = true; ++ if (no_tip) ++ decoder->pkt_state = INTEL_PT_STATE_FUP_NO_TIP; ++ else ++ decoder->pkt_state = INTEL_PT_STATE_FUP; + err = intel_pt_walk_fup(decoder); +- if (err != -EAGAIN) { +- if (err) +- return err; +- if (no_tip) +- decoder->pkt_state = +- INTEL_PT_STATE_FUP_NO_TIP; +- else +- decoder->pkt_state = INTEL_PT_STATE_FUP; +- return 0; +- } ++ if (err != -EAGAIN) ++ return err; + if (no_tip) { + no_tip = false; + break; +@@ -2375,15 +2372,11 @@ const struct intel_pt_state *intel_pt_decode(struct intel_pt_decoder *decoder) + err = intel_pt_walk_tip(decoder); + break; + case INTEL_PT_STATE_FUP: +- decoder->pkt_state = INTEL_PT_STATE_IN_SYNC; + err = intel_pt_walk_fup(decoder); + if (err == -EAGAIN) + err = intel_pt_walk_fup_tip(decoder); +- else if (!err) +- decoder->pkt_state = INTEL_PT_STATE_FUP; + break; + case INTEL_PT_STATE_FUP_NO_TIP: +- decoder->pkt_state = INTEL_PT_STATE_IN_SYNC; + err = intel_pt_walk_fup(decoder); + if (err == -EAGAIN) + err = intel_pt_walk_trace(decoder); +diff --git a/tools/testing/selftests/net/msg_zerocopy.c b/tools/testing/selftests/net/msg_zerocopy.c +index e11fe84de0fd9..6184d2a4c4a62 100644 +--- a/tools/testing/selftests/net/msg_zerocopy.c ++++ b/tools/testing/selftests/net/msg_zerocopy.c +@@ -121,9 +121,8 @@ static int do_setcpu(int cpu) + CPU_ZERO(&mask); + CPU_SET(cpu, &mask); + if (sched_setaffinity(0, sizeof(mask), &mask)) +- error(1, 0, "setaffinity %d", cpu); +- +- if (cfg_verbose) ++ fprintf(stderr, "cpu: unable to pin, may increase variance.\n"); ++ else if (cfg_verbose) + fprintf(stderr, "cpu: %u\n", cpu); + + return 0; +diff --git a/tools/testing/selftests/powerpc/benchmarks/context_switch.c b/tools/testing/selftests/powerpc/benchmarks/context_switch.c +index f4241339edd2a..7136eae2170b7 100644 +--- a/tools/testing/selftests/powerpc/benchmarks/context_switch.c ++++ b/tools/testing/selftests/powerpc/benchmarks/context_switch.c +@@ -22,6 +22,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -97,8 +98,9 @@ static void start_thread_on(void *(*fn)(void *), void *arg, unsigned long cpu) + + static void start_process_on(void *(*fn)(void *), void *arg, unsigned long cpu) + { +- int pid; +- cpu_set_t cpuset; ++ int pid, ncpus; ++ cpu_set_t *cpuset; ++ size_t size; + + pid = fork(); + if (pid == -1) { +@@ -109,14 +111,23 @@ static void start_process_on(void *(*fn)(void *), void *arg, unsigned long cpu) + if (pid) + return; + +- CPU_ZERO(&cpuset); +- CPU_SET(cpu, &cpuset); ++ ncpus = get_nprocs(); ++ size = CPU_ALLOC_SIZE(ncpus); ++ cpuset = CPU_ALLOC(ncpus); ++ if (!cpuset) { ++ perror("malloc"); ++ exit(1); ++ } ++ CPU_ZERO_S(size, cpuset); ++ CPU_SET_S(cpu, size, cpuset); + +- if (sched_setaffinity(0, sizeof(cpuset), &cpuset)) { ++ if (sched_setaffinity(0, size, cpuset)) { + perror("sched_setaffinity"); ++ CPU_FREE(cpuset); + exit(1); + } + ++ CPU_FREE(cpuset); + fn(arg); + + exit(0); +diff --git a/tools/testing/selftests/powerpc/utils.c b/tools/testing/selftests/powerpc/utils.c +index d46916867a6fb..77db4f6ecf2f0 100644 +--- a/tools/testing/selftests/powerpc/utils.c ++++ b/tools/testing/selftests/powerpc/utils.c +@@ -12,6 +12,7 @@ + #include + #include + #include ++#include + #include + #include + +@@ -81,26 +82,38 @@ void *get_auxv_entry(int type) + + int pick_online_cpu(void) + { +- cpu_set_t mask; +- int cpu; ++ int ncpus, cpu = -1; ++ cpu_set_t *mask; ++ size_t size; ++ ++ ncpus = get_nprocs_conf(); ++ size = CPU_ALLOC_SIZE(ncpus); ++ mask = CPU_ALLOC(ncpus); ++ if (!mask) { ++ perror("malloc"); ++ return -1; ++ } + +- CPU_ZERO(&mask); ++ CPU_ZERO_S(size, mask); + +- if (sched_getaffinity(0, sizeof(mask), &mask)) { ++ if (sched_getaffinity(0, size, mask)) { + perror("sched_getaffinity"); +- return -1; ++ goto done; + } + + /* We prefer a primary thread, but skip 0 */ +- for (cpu = 8; cpu < CPU_SETSIZE; cpu += 8) +- if (CPU_ISSET(cpu, &mask)) +- return cpu; ++ for (cpu = 8; cpu < ncpus; cpu += 8) ++ if (CPU_ISSET_S(cpu, size, mask)) ++ goto done; + + /* Search for anything, but in reverse */ +- for (cpu = CPU_SETSIZE - 1; cpu >= 0; cpu--) +- if (CPU_ISSET(cpu, &mask)) +- return cpu; ++ for (cpu = ncpus - 1; cpu >= 0; cpu--) ++ if (CPU_ISSET_S(cpu, size, mask)) ++ goto done; + + printf("No cpus in affinity mask?!\n"); +- return -1; ++ ++done: ++ CPU_FREE(mask); ++ return cpu; + } diff --git a/patch/kernel/odroidxu4-legacy/patch-4.14.194-195.patch b/patch/kernel/odroidxu4-legacy/patch-4.14.194-195.patch new file mode 100644 index 000000000..b7cb544a5 --- /dev/null +++ b/patch/kernel/odroidxu4-legacy/patch-4.14.194-195.patch @@ -0,0 +1,1484 @@ +diff --git a/Makefile b/Makefile +index 8e2a1418c5ae6..a5946969f4fcb 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 14 +-SUBLEVEL = 194 ++SUBLEVEL = 195 + EXTRAVERSION = + NAME = Petit Gorille + +diff --git a/arch/alpha/include/asm/io.h b/arch/alpha/include/asm/io.h +index d123ff90f7a83..9995bed6e92e2 100644 +--- a/arch/alpha/include/asm/io.h ++++ b/arch/alpha/include/asm/io.h +@@ -493,10 +493,10 @@ extern inline void writeq(u64 b, volatile void __iomem *addr) + } + #endif + +-#define ioread16be(p) be16_to_cpu(ioread16(p)) +-#define ioread32be(p) be32_to_cpu(ioread32(p)) +-#define iowrite16be(v,p) iowrite16(cpu_to_be16(v), (p)) +-#define iowrite32be(v,p) iowrite32(cpu_to_be32(v), (p)) ++#define ioread16be(p) swab16(ioread16(p)) ++#define ioread32be(p) swab32(ioread32(p)) ++#define iowrite16be(v,p) iowrite16(swab16(v), (p)) ++#define iowrite32be(v,p) iowrite32(swab32(v), (p)) + + #define inb_p inb + #define inw_p inw +diff --git a/arch/m68k/include/asm/m53xxacr.h b/arch/m68k/include/asm/m53xxacr.h +index 9138a624c5c81..692f90e7fecc1 100644 +--- a/arch/m68k/include/asm/m53xxacr.h ++++ b/arch/m68k/include/asm/m53xxacr.h +@@ -89,9 +89,9 @@ + * coherency though in all cases. And for copyback caches we will need + * to push cached data as well. + */ +-#define CACHE_INIT CACR_CINVA +-#define CACHE_INVALIDATE CACR_CINVA +-#define CACHE_INVALIDATED CACR_CINVA ++#define CACHE_INIT (CACHE_MODE + CACR_CINVA - CACR_EC) ++#define CACHE_INVALIDATE (CACHE_MODE + CACR_CINVA) ++#define CACHE_INVALIDATED (CACHE_MODE + CACR_CINVA) + + #define ACR0_MODE ((CONFIG_RAMBASE & 0xff000000) + \ + (0x000f0000) + \ +diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c +index 5fc8a010fdf07..ebe97e5500ee5 100644 +--- a/arch/powerpc/mm/fault.c ++++ b/arch/powerpc/mm/fault.c +@@ -22,6 +22,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -66,15 +67,11 @@ static inline bool notify_page_fault(struct pt_regs *regs) + } + + /* +- * Check whether the instruction at regs->nip is a store using ++ * Check whether the instruction inst is a store using + * an update addressing form which will update r1. + */ +-static bool store_updates_sp(struct pt_regs *regs) ++static bool store_updates_sp(unsigned int inst) + { +- unsigned int inst; +- +- if (get_user(inst, (unsigned int __user *)regs->nip)) +- return false; + /* check for 1 in the rA field */ + if (((inst >> 16) & 0x1f) != 1) + return false; +@@ -227,20 +224,24 @@ static bool bad_kernel_fault(bool is_exec, unsigned long error_code, + return is_exec || (address >= TASK_SIZE); + } + ++// This comes from 64-bit struct rt_sigframe + __SIGNAL_FRAMESIZE ++#define SIGFRAME_MAX_SIZE (4096 + 128) ++ + static bool bad_stack_expansion(struct pt_regs *regs, unsigned long address, +- struct vm_area_struct *vma, +- bool store_update_sp) ++ struct vm_area_struct *vma, unsigned int flags, ++ bool *must_retry) + { + /* + * N.B. The POWER/Open ABI allows programs to access up to + * 288 bytes below the stack pointer. +- * The kernel signal delivery code writes up to about 1.5kB ++ * The kernel signal delivery code writes a bit over 4KB + * below the stack pointer (r1) before decrementing it. + * The exec code can write slightly over 640kB to the stack + * before setting the user r1. Thus we allow the stack to + * expand to 1MB without further checks. + */ + if (address + 0x100000 < vma->vm_end) { ++ unsigned int __user *nip = (unsigned int __user *)regs->nip; + /* get user regs even if this fault is in kernel mode */ + struct pt_regs *uregs = current->thread.regs; + if (uregs == NULL) +@@ -258,8 +259,22 @@ static bool bad_stack_expansion(struct pt_regs *regs, unsigned long address, + * between the last mapped region and the stack will + * expand the stack rather than segfaulting. + */ +- if (address + 2048 < uregs->gpr[1] && !store_update_sp) +- return true; ++ if (address + SIGFRAME_MAX_SIZE >= uregs->gpr[1]) ++ return false; ++ ++ if ((flags & FAULT_FLAG_WRITE) && (flags & FAULT_FLAG_USER) && ++ access_ok(VERIFY_READ, nip, sizeof(*nip))) { ++ unsigned int inst; ++ int res; ++ ++ pagefault_disable(); ++ res = __get_user_inatomic(inst, nip); ++ pagefault_enable(); ++ if (!res) ++ return !store_updates_sp(inst); ++ *must_retry = true; ++ } ++ return true; + } + return false; + } +@@ -392,7 +407,7 @@ static int __do_page_fault(struct pt_regs *regs, unsigned long address, + int is_user = user_mode(regs); + int is_write = page_fault_is_write(error_code); + int fault, major = 0; +- bool store_update_sp = false; ++ bool must_retry = false; + + if (notify_page_fault(regs)) + return 0; +@@ -439,9 +454,6 @@ static int __do_page_fault(struct pt_regs *regs, unsigned long address, + * can result in fault, which will cause a deadlock when called with + * mmap_sem held + */ +- if (is_write && is_user) +- store_update_sp = store_updates_sp(regs); +- + if (is_user) + flags |= FAULT_FLAG_USER; + if (is_write) +@@ -488,8 +500,17 @@ retry: + return bad_area(regs, address); + + /* The stack is being expanded, check if it's valid */ +- if (unlikely(bad_stack_expansion(regs, address, vma, store_update_sp))) +- return bad_area(regs, address); ++ if (unlikely(bad_stack_expansion(regs, address, vma, flags, ++ &must_retry))) { ++ if (!must_retry) ++ return bad_area(regs, address); ++ ++ up_read(&mm->mmap_sem); ++ if (fault_in_pages_readable((const char __user *)regs->nip, ++ sizeof(unsigned int))) ++ return bad_area_nosemaphore(regs, address); ++ goto retry; ++ } + + /* Try to expand it */ + if (unlikely(expand_stack(vma, address))) +diff --git a/arch/powerpc/platforms/pseries/ras.c b/arch/powerpc/platforms/pseries/ras.c +index 5ec935521204a..8d20d49b252a0 100644 +--- a/arch/powerpc/platforms/pseries/ras.c ++++ b/arch/powerpc/platforms/pseries/ras.c +@@ -115,7 +115,6 @@ static void handle_system_shutdown(char event_modifier) + case EPOW_SHUTDOWN_ON_UPS: + pr_emerg("Loss of system power detected. System is running on" + " UPS/battery. Check RTAS error log for details\n"); +- orderly_poweroff(true); + break; + + case EPOW_SHUTDOWN_LOSS_OF_CRITICAL_FUNCTIONS: +diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c +index 44b6f23cc851d..4289c519af1be 100644 +--- a/drivers/clk/clk.c ++++ b/drivers/clk/clk.c +@@ -39,6 +39,17 @@ static HLIST_HEAD(clk_root_list); + static HLIST_HEAD(clk_orphan_list); + static LIST_HEAD(clk_notifier_list); + ++static struct hlist_head *all_lists[] = { ++ &clk_root_list, ++ &clk_orphan_list, ++ NULL, ++}; ++ ++static struct hlist_head *orphan_list[] = { ++ &clk_orphan_list, ++ NULL, ++}; ++ + /*** private data structures ***/ + + struct clk_core { +@@ -1993,17 +2004,6 @@ static int inited = 0; + static DEFINE_MUTEX(clk_debug_lock); + static HLIST_HEAD(clk_debug_list); + +-static struct hlist_head *all_lists[] = { +- &clk_root_list, +- &clk_orphan_list, +- NULL, +-}; +- +-static struct hlist_head *orphan_list[] = { +- &clk_orphan_list, +- NULL, +-}; +- + static void clk_summary_show_one(struct seq_file *s, struct clk_core *c, + int level) + { +@@ -2735,6 +2735,34 @@ static const struct clk_ops clk_nodrv_ops = { + .set_parent = clk_nodrv_set_parent, + }; + ++static void clk_core_evict_parent_cache_subtree(struct clk_core *root, ++ struct clk_core *target) ++{ ++ int i; ++ struct clk_core *child; ++ ++ for (i = 0; i < root->num_parents; i++) ++ if (root->parents[i] == target) ++ root->parents[i] = NULL; ++ ++ hlist_for_each_entry(child, &root->children, child_node) ++ clk_core_evict_parent_cache_subtree(child, target); ++} ++ ++/* Remove this clk from all parent caches */ ++static void clk_core_evict_parent_cache(struct clk_core *core) ++{ ++ struct hlist_head **lists; ++ struct clk_core *root; ++ ++ lockdep_assert_held(&prepare_lock); ++ ++ for (lists = all_lists; *lists; lists++) ++ hlist_for_each_entry(root, *lists, child_node) ++ clk_core_evict_parent_cache_subtree(root, core); ++ ++} ++ + /** + * clk_unregister - unregister a currently registered clock + * @clk: clock to unregister +@@ -2773,6 +2801,8 @@ void clk_unregister(struct clk *clk) + clk_core_set_parent(child, NULL); + } + ++ clk_core_evict_parent_cache(clk->core); ++ + hlist_del_init(&clk->core->child_node); + + if (clk->core->prepare_count) +diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c +index 1aa0b05c8cbdf..5c41dc9aaa46d 100644 +--- a/drivers/cpufreq/intel_pstate.c ++++ b/drivers/cpufreq/intel_pstate.c +@@ -1378,6 +1378,7 @@ static void intel_pstate_get_cpu_pstates(struct cpudata *cpu) + + intel_pstate_get_hwp_max(cpu->cpu, &phy_max, ¤t_max); + cpu->pstate.turbo_freq = phy_max * cpu->pstate.scaling; ++ cpu->pstate.turbo_pstate = phy_max; + } else { + cpu->pstate.turbo_freq = cpu->pstate.turbo_pstate * cpu->pstate.scaling; + } +diff --git a/drivers/gpu/drm/vgem/vgem_drv.c b/drivers/gpu/drm/vgem/vgem_drv.c +index aa592277d5108..67037eb9a80ee 100644 +--- a/drivers/gpu/drm/vgem/vgem_drv.c ++++ b/drivers/gpu/drm/vgem/vgem_drv.c +@@ -220,32 +220,6 @@ static int vgem_gem_dumb_create(struct drm_file *file, struct drm_device *dev, + return 0; + } + +-static int vgem_gem_dumb_map(struct drm_file *file, struct drm_device *dev, +- uint32_t handle, uint64_t *offset) +-{ +- struct drm_gem_object *obj; +- int ret; +- +- obj = drm_gem_object_lookup(file, handle); +- if (!obj) +- return -ENOENT; +- +- if (!obj->filp) { +- ret = -EINVAL; +- goto unref; +- } +- +- ret = drm_gem_create_mmap_offset(obj); +- if (ret) +- goto unref; +- +- *offset = drm_vma_node_offset_addr(&obj->vma_node); +-unref: +- drm_gem_object_put_unlocked(obj); +- +- return ret; +-} +- + static struct drm_ioctl_desc vgem_ioctls[] = { + DRM_IOCTL_DEF_DRV(VGEM_FENCE_ATTACH, vgem_fence_attach_ioctl, DRM_AUTH|DRM_RENDER_ALLOW), + DRM_IOCTL_DEF_DRV(VGEM_FENCE_SIGNAL, vgem_fence_signal_ioctl, DRM_AUTH|DRM_RENDER_ALLOW), +@@ -439,7 +413,6 @@ static struct drm_driver vgem_driver = { + .fops = &vgem_driver_fops, + + .dumb_create = vgem_gem_dumb_create, +- .dumb_map_offset = vgem_gem_dumb_map, + + .prime_handle_to_fd = drm_gem_prime_handle_to_fd, + .prime_fd_to_handle = drm_gem_prime_fd_to_handle, +diff --git a/drivers/input/mouse/psmouse-base.c b/drivers/input/mouse/psmouse-base.c +index 8ac9e03c05b45..ca8f726dab2e7 100644 +--- a/drivers/input/mouse/psmouse-base.c ++++ b/drivers/input/mouse/psmouse-base.c +@@ -2012,7 +2012,7 @@ static int psmouse_get_maxproto(char *buffer, const struct kernel_param *kp) + { + int type = *((unsigned int *)kp->arg); + +- return sprintf(buffer, "%s", psmouse_protocol_by_type(type)->name); ++ return sprintf(buffer, "%s\n", psmouse_protocol_by_type(type)->name); + } + + static int __init psmouse_init(void) +diff --git a/drivers/media/pci/ttpci/budget-core.c b/drivers/media/pci/ttpci/budget-core.c +index 97499b2af7144..20524376b83be 100644 +--- a/drivers/media/pci/ttpci/budget-core.c ++++ b/drivers/media/pci/ttpci/budget-core.c +@@ -383,20 +383,25 @@ static int budget_register(struct budget *budget) + ret = dvbdemux->dmx.add_frontend(&dvbdemux->dmx, &budget->hw_frontend); + + if (ret < 0) +- return ret; ++ goto err_release_dmx; + + budget->mem_frontend.source = DMX_MEMORY_FE; + ret = dvbdemux->dmx.add_frontend(&dvbdemux->dmx, &budget->mem_frontend); + if (ret < 0) +- return ret; ++ goto err_release_dmx; + + ret = dvbdemux->dmx.connect_frontend(&dvbdemux->dmx, &budget->hw_frontend); + if (ret < 0) +- return ret; ++ goto err_release_dmx; + + dvb_net_init(&budget->dvb_adapter, &budget->dvb_net, &dvbdemux->dmx); + + return 0; ++ ++err_release_dmx: ++ dvb_dmxdev_release(&budget->dmxdev); ++ dvb_dmx_release(&budget->demux); ++ return ret; + } + + static void budget_unregister(struct budget *budget) +diff --git a/drivers/media/platform/davinci/vpss.c b/drivers/media/platform/davinci/vpss.c +index 2ee4cd9e6d80f..d984f45c03149 100644 +--- a/drivers/media/platform/davinci/vpss.c ++++ b/drivers/media/platform/davinci/vpss.c +@@ -514,19 +514,31 @@ static void vpss_exit(void) + + static int __init vpss_init(void) + { ++ int ret; ++ + if (!request_mem_region(VPSS_CLK_CTRL, 4, "vpss_clock_control")) + return -EBUSY; + + oper_cfg.vpss_regs_base2 = ioremap(VPSS_CLK_CTRL, 4); + if (unlikely(!oper_cfg.vpss_regs_base2)) { +- release_mem_region(VPSS_CLK_CTRL, 4); +- return -ENOMEM; ++ ret = -ENOMEM; ++ goto err_ioremap; + } + + writel(VPSS_CLK_CTRL_VENCCLKEN | +- VPSS_CLK_CTRL_DACCLKEN, oper_cfg.vpss_regs_base2); ++ VPSS_CLK_CTRL_DACCLKEN, oper_cfg.vpss_regs_base2); ++ ++ ret = platform_driver_register(&vpss_driver); ++ if (ret) ++ goto err_pd_register; ++ ++ return 0; + +- return platform_driver_register(&vpss_driver); ++err_pd_register: ++ iounmap(oper_cfg.vpss_regs_base2); ++err_ioremap: ++ release_mem_region(VPSS_CLK_CTRL, 4); ++ return ret; + } + subsys_initcall(vpss_init); + module_exit(vpss_exit); +diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c +index 1f867e275408e..861d2c0a521a4 100644 +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -2010,7 +2010,8 @@ static int bond_release_and_destroy(struct net_device *bond_dev, + int ret; + + ret = __bond_release_one(bond_dev, slave_dev, false, true); +- if (ret == 0 && !bond_has_slaves(bond)) { ++ if (ret == 0 && !bond_has_slaves(bond) && ++ bond_dev->reg_state != NETREG_UNREGISTERING) { + bond_dev->priv_flags |= IFF_DISABLE_NETPOLL; + netdev_info(bond_dev, "Destroying bond %s\n", + bond_dev->name); +@@ -2752,6 +2753,9 @@ static int bond_ab_arp_inspect(struct bonding *bond) + if (bond_time_in_interval(bond, last_rx, 1)) { + bond_propose_link_state(slave, BOND_LINK_UP); + commit++; ++ } else if (slave->link == BOND_LINK_BACK) { ++ bond_propose_link_state(slave, BOND_LINK_FAIL); ++ commit++; + } + continue; + } +@@ -2862,6 +2866,19 @@ static void bond_ab_arp_commit(struct bonding *bond) + + continue; + ++ case BOND_LINK_FAIL: ++ bond_set_slave_link_state(slave, BOND_LINK_FAIL, ++ BOND_SLAVE_NOTIFY_NOW); ++ bond_set_slave_inactive_flags(slave, ++ BOND_SLAVE_NOTIFY_NOW); ++ ++ /* A slave has just been enslaved and has become ++ * the current active slave. ++ */ ++ if (rtnl_dereference(bond->curr_active_slave)) ++ RCU_INIT_POINTER(bond->current_arp_slave, NULL); ++ continue; ++ + default: + netdev_err(bond->dev, "impossible: new_link %d on slave %s\n", + slave->link_new_state, slave->dev->name); +@@ -2911,8 +2928,6 @@ static bool bond_ab_arp_probe(struct bonding *bond) + return should_notify_rtnl; + } + +- bond_set_slave_inactive_flags(curr_arp_slave, BOND_SLAVE_NOTIFY_LATER); +- + bond_for_each_slave_rcu(bond, slave, iter) { + if (!found && !before && bond_slave_is_up(slave)) + before = slave; +@@ -4156,13 +4171,23 @@ static netdev_tx_t bond_start_xmit(struct sk_buff *skb, struct net_device *dev) + return ret; + } + ++static u32 bond_mode_bcast_speed(struct slave *slave, u32 speed) ++{ ++ if (speed == 0 || speed == SPEED_UNKNOWN) ++ speed = slave->speed; ++ else ++ speed = min(speed, slave->speed); ++ ++ return speed; ++} ++ + static int bond_ethtool_get_link_ksettings(struct net_device *bond_dev, + struct ethtool_link_ksettings *cmd) + { + struct bonding *bond = netdev_priv(bond_dev); +- unsigned long speed = 0; + struct list_head *iter; + struct slave *slave; ++ u32 speed = 0; + + cmd->base.duplex = DUPLEX_UNKNOWN; + cmd->base.port = PORT_OTHER; +@@ -4174,8 +4199,13 @@ static int bond_ethtool_get_link_ksettings(struct net_device *bond_dev, + */ + bond_for_each_slave(bond, slave, iter) { + if (bond_slave_can_tx(slave)) { +- if (slave->speed != SPEED_UNKNOWN) +- speed += slave->speed; ++ if (slave->speed != SPEED_UNKNOWN) { ++ if (BOND_MODE(bond) == BOND_MODE_BROADCAST) ++ speed = bond_mode_bcast_speed(slave, ++ speed); ++ else ++ speed += slave->speed; ++ } + if (cmd->base.duplex == DUPLEX_UNKNOWN && + slave->duplex != DUPLEX_UNKNOWN) + cmd->base.duplex = slave->duplex; +diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c +index 274d369151107..5c3fa0be8844e 100644 +--- a/drivers/net/dsa/b53/b53_common.c ++++ b/drivers/net/dsa/b53/b53_common.c +@@ -1160,6 +1160,8 @@ static int b53_arl_op(struct b53_device *dev, int op, int port, + return ret; + + switch (ret) { ++ case -ETIMEDOUT: ++ return ret; + case -ENOSPC: + dev_dbg(dev->dev, "{%pM,%.4d} no space left in ARL\n", + addr, vid); +diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c +index 8ba915cc4c2e4..22f964ef859e5 100644 +--- a/drivers/net/ethernet/freescale/fec_main.c ++++ b/drivers/net/ethernet/freescale/fec_main.c +@@ -3536,11 +3536,11 @@ failed_mii_init: + failed_irq: + failed_init: + fec_ptp_stop(pdev); +- if (fep->reg_phy) +- regulator_disable(fep->reg_phy); + failed_reset: + pm_runtime_put_noidle(&pdev->dev); + pm_runtime_disable(&pdev->dev); ++ if (fep->reg_phy) ++ regulator_disable(fep->reg_phy); + failed_regulator: + clk_disable_unprepare(fep->clk_ahb); + failed_clk_ahb: +diff --git a/drivers/net/ethernet/intel/i40e/i40e_adminq_cmd.h b/drivers/net/ethernet/intel/i40e/i40e_adminq_cmd.h +index 5d5f422cbae55..f82da2b47d9a5 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_adminq_cmd.h ++++ b/drivers/net/ethernet/intel/i40e/i40e_adminq_cmd.h +@@ -1175,7 +1175,7 @@ struct i40e_aqc_set_vsi_promiscuous_modes { + #define I40E_AQC_SET_VSI_PROMISC_BROADCAST 0x04 + #define I40E_AQC_SET_VSI_DEFAULT 0x08 + #define I40E_AQC_SET_VSI_PROMISC_VLAN 0x10 +-#define I40E_AQC_SET_VSI_PROMISC_TX 0x8000 ++#define I40E_AQC_SET_VSI_PROMISC_RX_ONLY 0x8000 + __le16 seid; + #define I40E_AQC_VSI_PROM_CMD_SEID_MASK 0x3FF + __le16 vlan_tag; +diff --git a/drivers/net/ethernet/intel/i40e/i40e_common.c b/drivers/net/ethernet/intel/i40e/i40e_common.c +index 111426ba5fbce..3fd2dfaf2bd53 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_common.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_common.c +@@ -1914,6 +1914,21 @@ i40e_status i40e_aq_set_phy_debug(struct i40e_hw *hw, u8 cmd_flags, + return status; + } + ++/** ++ * i40e_is_aq_api_ver_ge ++ * @aq: pointer to AdminQ info containing HW API version to compare ++ * @maj: API major value ++ * @min: API minor value ++ * ++ * Assert whether current HW API version is greater/equal than provided. ++ **/ ++static bool i40e_is_aq_api_ver_ge(struct i40e_adminq_info *aq, u16 maj, ++ u16 min) ++{ ++ return (aq->api_maj_ver > maj || ++ (aq->api_maj_ver == maj && aq->api_min_ver >= min)); ++} ++ + /** + * i40e_aq_add_vsi + * @hw: pointer to the hw struct +@@ -2039,18 +2054,16 @@ i40e_status i40e_aq_set_vsi_unicast_promiscuous(struct i40e_hw *hw, + + if (set) { + flags |= I40E_AQC_SET_VSI_PROMISC_UNICAST; +- if (rx_only_promisc && +- (((hw->aq.api_maj_ver == 1) && (hw->aq.api_min_ver >= 5)) || +- (hw->aq.api_maj_ver > 1))) +- flags |= I40E_AQC_SET_VSI_PROMISC_TX; ++ if (rx_only_promisc && i40e_is_aq_api_ver_ge(&hw->aq, 1, 5)) ++ flags |= I40E_AQC_SET_VSI_PROMISC_RX_ONLY; + } + + cmd->promiscuous_flags = cpu_to_le16(flags); + + cmd->valid_flags = cpu_to_le16(I40E_AQC_SET_VSI_PROMISC_UNICAST); +- if (((hw->aq.api_maj_ver >= 1) && (hw->aq.api_min_ver >= 5)) || +- (hw->aq.api_maj_ver > 1)) +- cmd->valid_flags |= cpu_to_le16(I40E_AQC_SET_VSI_PROMISC_TX); ++ if (i40e_is_aq_api_ver_ge(&hw->aq, 1, 5)) ++ cmd->valid_flags |= ++ cpu_to_le16(I40E_AQC_SET_VSI_PROMISC_RX_ONLY); + + cmd->seid = cpu_to_le16(seid); + status = i40e_asq_send_command(hw, &desc, NULL, 0, cmd_details); +@@ -2147,11 +2160,17 @@ enum i40e_status_code i40e_aq_set_vsi_uc_promisc_on_vlan(struct i40e_hw *hw, + i40e_fill_default_direct_cmd_desc(&desc, + i40e_aqc_opc_set_vsi_promiscuous_modes); + +- if (enable) ++ if (enable) { + flags |= I40E_AQC_SET_VSI_PROMISC_UNICAST; ++ if (i40e_is_aq_api_ver_ge(&hw->aq, 1, 5)) ++ flags |= I40E_AQC_SET_VSI_PROMISC_RX_ONLY; ++ } + + cmd->promiscuous_flags = cpu_to_le16(flags); + cmd->valid_flags = cpu_to_le16(I40E_AQC_SET_VSI_PROMISC_UNICAST); ++ if (i40e_is_aq_api_ver_ge(&hw->aq, 1, 5)) ++ cmd->valid_flags |= ++ cpu_to_le16(I40E_AQC_SET_VSI_PROMISC_RX_ONLY); + cmd->seid = cpu_to_le16(seid); + cmd->vlan_tag = cpu_to_le16(vid | I40E_AQC_SET_VSI_VLAN_VALID); + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index aa2b446d6ad0f..f4475cbf8ce86 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -11822,6 +11822,9 @@ static void i40e_remove(struct pci_dev *pdev) + i40e_write_rx_ctl(hw, I40E_PFQF_HENA(0), 0); + i40e_write_rx_ctl(hw, I40E_PFQF_HENA(1), 0); + ++ while (test_bit(__I40E_RESET_RECOVERY_PENDING, pf->state)) ++ usleep_range(1000, 2000); ++ + /* no more scheduling of any task */ + set_bit(__I40E_SUSPENDED, pf->state); + set_bit(__I40E_DOWN, pf->state); +diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c +index 10c3480c2da89..dbc6c9ed1c8f8 100644 +--- a/drivers/net/hyperv/netvsc_drv.c ++++ b/drivers/net/hyperv/netvsc_drv.c +@@ -500,7 +500,7 @@ static int netvsc_vf_xmit(struct net_device *net, struct net_device *vf_netdev, + int rc; + + skb->dev = vf_netdev; +- skb->queue_mapping = qdisc_skb_cb(skb)->slave_dev_queue_mapping; ++ skb_record_rx_queue(skb, qdisc_skb_cb(skb)->slave_dev_queue_mapping); + + rc = dev_queue_xmit(skb); + if (likely(rc == NET_XMIT_SUCCESS || rc == NET_XMIT_CN)) { +diff --git a/drivers/rtc/rtc-goldfish.c b/drivers/rtc/rtc-goldfish.c +index a1c44d0c85578..30cbe22c57a8e 100644 +--- a/drivers/rtc/rtc-goldfish.c ++++ b/drivers/rtc/rtc-goldfish.c +@@ -87,6 +87,7 @@ static int goldfish_rtc_set_alarm(struct device *dev, + rtc_alarm64 = rtc_alarm * NSEC_PER_SEC; + writel((rtc_alarm64 >> 32), base + TIMER_ALARM_HIGH); + writel(rtc_alarm64, base + TIMER_ALARM_LOW); ++ writel(1, base + TIMER_IRQ_ENABLED); + } else { + /* + * if this function was called with enabled=0 +diff --git a/drivers/scsi/libfc/fc_disc.c b/drivers/scsi/libfc/fc_disc.c +index 28b50ab2fbb01..62f83cc151b22 100644 +--- a/drivers/scsi/libfc/fc_disc.c ++++ b/drivers/scsi/libfc/fc_disc.c +@@ -605,8 +605,12 @@ static void fc_disc_gpn_id_resp(struct fc_seq *sp, struct fc_frame *fp, + + if (PTR_ERR(fp) == -FC_EX_CLOSED) + goto out; +- if (IS_ERR(fp)) +- goto redisc; ++ if (IS_ERR(fp)) { ++ mutex_lock(&disc->disc_mutex); ++ fc_disc_restart(disc); ++ mutex_unlock(&disc->disc_mutex); ++ goto out; ++ } + + cp = fc_frame_payload_get(fp, sizeof(*cp)); + if (!cp) +@@ -633,7 +637,7 @@ static void fc_disc_gpn_id_resp(struct fc_seq *sp, struct fc_frame *fp, + new_rdata->disc_id = disc->disc_id; + fc_rport_login(new_rdata); + } +- goto out; ++ goto free_fp; + } + rdata->disc_id = disc->disc_id; + mutex_unlock(&rdata->rp_mutex); +@@ -650,6 +654,8 @@ redisc: + fc_disc_restart(disc); + mutex_unlock(&disc->disc_mutex); + } ++free_fp: ++ fc_frame_free(fp); + out: + kref_put(&rdata->kref, fc_rport_destroy); + if (!IS_ERR(fp)) +diff --git a/drivers/scsi/ufs/ufs_quirks.h b/drivers/scsi/ufs/ufs_quirks.h +index 71f73d1d1ad1f..6c944fbefd40a 100644 +--- a/drivers/scsi/ufs/ufs_quirks.h ++++ b/drivers/scsi/ufs/ufs_quirks.h +@@ -21,6 +21,7 @@ + #define UFS_ANY_VENDOR 0xFFFF + #define UFS_ANY_MODEL "ANY_MODEL" + ++#define UFS_VENDOR_MICRON 0x12C + #define UFS_VENDOR_TOSHIBA 0x198 + #define UFS_VENDOR_SAMSUNG 0x1CE + #define UFS_VENDOR_SKHYNIX 0x1AD +diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c +index 1e2a97a10033b..11e917b44a0f1 100644 +--- a/drivers/scsi/ufs/ufshcd.c ++++ b/drivers/scsi/ufs/ufshcd.c +@@ -189,6 +189,8 @@ ufs_get_desired_pm_lvl_for_dev_link_state(enum ufs_dev_pwr_mode dev_state, + + static struct ufs_dev_fix ufs_fixups[] = { + /* UFS cards deviations table */ ++ UFS_FIX(UFS_VENDOR_MICRON, UFS_ANY_MODEL, ++ UFS_DEVICE_QUIRK_DELAY_BEFORE_LPM), + UFS_FIX(UFS_VENDOR_SAMSUNG, UFS_ANY_MODEL, + UFS_DEVICE_QUIRK_DELAY_BEFORE_LPM), + UFS_FIX(UFS_VENDOR_SAMSUNG, UFS_ANY_MODEL, UFS_DEVICE_NO_VCCQ), +diff --git a/drivers/spi/Kconfig b/drivers/spi/Kconfig +index a75f2a2cf7805..4b6a1629969f3 100644 +--- a/drivers/spi/Kconfig ++++ b/drivers/spi/Kconfig +@@ -827,4 +827,7 @@ config SPI_SLAVE_SYSTEM_CONTROL + + endif # SPI_SLAVE + ++config SPI_DYNAMIC ++ def_bool ACPI || OF_DYNAMIC || SPI_SLAVE ++ + endif # SPI +diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c +index 49eee894f51d4..ab6a4f85bcde7 100644 +--- a/drivers/spi/spi.c ++++ b/drivers/spi/spi.c +@@ -428,6 +428,12 @@ static LIST_HEAD(spi_controller_list); + */ + static DEFINE_MUTEX(board_lock); + ++/* ++ * Prevents addition of devices with same chip select and ++ * addition of devices below an unregistering controller. ++ */ ++static DEFINE_MUTEX(spi_add_lock); ++ + /** + * spi_alloc_device - Allocate a new SPI device + * @ctlr: Controller to which device is connected +@@ -506,7 +512,6 @@ static int spi_dev_check(struct device *dev, void *data) + */ + int spi_add_device(struct spi_device *spi) + { +- static DEFINE_MUTEX(spi_add_lock); + struct spi_controller *ctlr = spi->controller; + struct device *dev = ctlr->dev.parent; + int status; +@@ -534,6 +539,13 @@ int spi_add_device(struct spi_device *spi) + goto done; + } + ++ /* Controller may unregister concurrently */ ++ if (IS_ENABLED(CONFIG_SPI_DYNAMIC) && ++ !device_is_registered(&ctlr->dev)) { ++ status = -ENODEV; ++ goto done; ++ } ++ + if (ctlr->cs_gpios) + spi->cs_gpio = ctlr->cs_gpios[spi->chip_select]; + +@@ -2265,6 +2277,10 @@ void spi_unregister_controller(struct spi_controller *ctlr) + struct spi_controller *found; + int id = ctlr->bus_num; + ++ /* Prevent addition of new devices, unregister existing ones */ ++ if (IS_ENABLED(CONFIG_SPI_DYNAMIC)) ++ mutex_lock(&spi_add_lock); ++ + device_for_each_child(&ctlr->dev, NULL, __unregister); + + /* First make sure that this controller was ever added */ +@@ -2285,6 +2301,9 @@ void spi_unregister_controller(struct spi_controller *ctlr) + if (found == ctlr) + idr_remove(&spi_master_idr, id); + mutex_unlock(&board_lock); ++ ++ if (IS_ENABLED(CONFIG_SPI_DYNAMIC)) ++ mutex_unlock(&spi_add_lock); + } + EXPORT_SYMBOL_GPL(spi_unregister_controller); + +diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c +index 35a3750a6ddd3..f22425501bc16 100644 +--- a/drivers/vfio/vfio_iommu_type1.c ++++ b/drivers/vfio/vfio_iommu_type1.c +@@ -1086,13 +1086,16 @@ static int vfio_bus_type(struct device *dev, void *data) + static int vfio_iommu_replay(struct vfio_iommu *iommu, + struct vfio_domain *domain) + { +- struct vfio_domain *d; ++ struct vfio_domain *d = NULL; + struct rb_node *n; + unsigned long limit = rlimit(RLIMIT_MEMLOCK) >> PAGE_SHIFT; + int ret; + + /* Arbitrarily pick the first domain in the list for lookups */ +- d = list_first_entry(&iommu->domain_list, struct vfio_domain, next); ++ if (!list_empty(&iommu->domain_list)) ++ d = list_first_entry(&iommu->domain_list, ++ struct vfio_domain, next); ++ + n = rb_first(&iommu->dma_list); + + for (; n; n = rb_next(n)) { +@@ -1110,6 +1113,11 @@ static int vfio_iommu_replay(struct vfio_iommu *iommu, + phys_addr_t p; + dma_addr_t i; + ++ if (WARN_ON(!d)) { /* mapped w/o a domain?! */ ++ ret = -EINVAL; ++ goto unwind; ++ } ++ + phys = iommu_iova_to_phys(d->domain, iova); + + if (WARN_ON(!phys)) { +@@ -1139,7 +1147,7 @@ static int vfio_iommu_replay(struct vfio_iommu *iommu, + if (npage <= 0) { + WARN_ON(!npage); + ret = (int)npage; +- return ret; ++ goto unwind; + } + + phys = pfn << PAGE_SHIFT; +@@ -1148,14 +1156,67 @@ static int vfio_iommu_replay(struct vfio_iommu *iommu, + + ret = iommu_map(domain->domain, iova, phys, + size, dma->prot | domain->prot); +- if (ret) +- return ret; ++ if (ret) { ++ if (!dma->iommu_mapped) ++ vfio_unpin_pages_remote(dma, iova, ++ phys >> PAGE_SHIFT, ++ size >> PAGE_SHIFT, ++ true); ++ goto unwind; ++ } + + iova += size; + } ++ } ++ ++ /* All dmas are now mapped, defer to second tree walk for unwind */ ++ for (n = rb_first(&iommu->dma_list); n; n = rb_next(n)) { ++ struct vfio_dma *dma = rb_entry(n, struct vfio_dma, node); ++ + dma->iommu_mapped = true; + } ++ + return 0; ++ ++unwind: ++ for (; n; n = rb_prev(n)) { ++ struct vfio_dma *dma = rb_entry(n, struct vfio_dma, node); ++ dma_addr_t iova; ++ ++ if (dma->iommu_mapped) { ++ iommu_unmap(domain->domain, dma->iova, dma->size); ++ continue; ++ } ++ ++ iova = dma->iova; ++ while (iova < dma->iova + dma->size) { ++ phys_addr_t phys, p; ++ size_t size; ++ dma_addr_t i; ++ ++ phys = iommu_iova_to_phys(domain->domain, iova); ++ if (!phys) { ++ iova += PAGE_SIZE; ++ continue; ++ } ++ ++ size = PAGE_SIZE; ++ p = phys + size; ++ i = iova + size; ++ while (i < dma->iova + dma->size && ++ p == iommu_iova_to_phys(domain->domain, i)) { ++ size += PAGE_SIZE; ++ p += PAGE_SIZE; ++ i += PAGE_SIZE; ++ } ++ ++ iommu_unmap(domain->domain, iova, size); ++ vfio_unpin_pages_remote(dma, iova, phys >> PAGE_SHIFT, ++ size >> PAGE_SHIFT, true); ++ } ++ } ++ ++ return ret; + } + + /* +diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c +index b82bb0b081615..51278f8bd3ab3 100644 +--- a/drivers/virtio/virtio_ring.c ++++ b/drivers/virtio/virtio_ring.c +@@ -829,6 +829,9 @@ bool virtqueue_poll(struct virtqueue *_vq, unsigned last_used_idx) + { + struct vring_virtqueue *vq = to_vvq(_vq); + ++ if (unlikely(vq->broken)) ++ return false; ++ + virtio_mb(vq->weak_barriers); + return (u16)last_used_idx != virtio16_to_cpu(_vq->vdev, vq->vring.used->idx); + } +diff --git a/drivers/xen/preempt.c b/drivers/xen/preempt.c +index 5f6b77ea34fb5..128375ff80b8c 100644 +--- a/drivers/xen/preempt.c ++++ b/drivers/xen/preempt.c +@@ -31,7 +31,7 @@ EXPORT_SYMBOL_GPL(xen_in_preemptible_hcall); + asmlinkage __visible void xen_maybe_preempt_hcall(void) + { + if (unlikely(__this_cpu_read(xen_in_preemptible_hcall) +- && need_resched())) { ++ && need_resched() && !preempt_count())) { + /* + * Clear flag as we may be rescheduled on a different + * cpu. +diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h +index 5412b12491cb8..de951987fd23d 100644 +--- a/fs/btrfs/ctree.h ++++ b/fs/btrfs/ctree.h +@@ -3262,6 +3262,8 @@ ssize_t btrfs_listxattr(struct dentry *dentry, char *buffer, size_t size); + int btrfs_parse_options(struct btrfs_fs_info *info, char *options, + unsigned long new_flags); + int btrfs_sync_fs(struct super_block *sb, int wait); ++char *btrfs_get_subvol_name_from_objectid(struct btrfs_fs_info *fs_info, ++ u64 subvol_objectid); + + static inline __printf(2, 3) + void btrfs_no_printk(const struct btrfs_fs_info *fs_info, const char *fmt, ...) +diff --git a/fs/btrfs/export.c b/fs/btrfs/export.c +index 3aeb5770f8965..b6ce765aa7f33 100644 +--- a/fs/btrfs/export.c ++++ b/fs/btrfs/export.c +@@ -56,9 +56,9 @@ static int btrfs_encode_fh(struct inode *inode, u32 *fh, int *max_len, + return type; + } + +-static struct dentry *btrfs_get_dentry(struct super_block *sb, u64 objectid, +- u64 root_objectid, u32 generation, +- int check_generation) ++struct dentry *btrfs_get_dentry(struct super_block *sb, u64 objectid, ++ u64 root_objectid, u32 generation, ++ int check_generation) + { + struct btrfs_fs_info *fs_info = btrfs_sb(sb); + struct btrfs_root *root; +@@ -151,7 +151,7 @@ static struct dentry *btrfs_fh_to_dentry(struct super_block *sb, struct fid *fh, + return btrfs_get_dentry(sb, objectid, root_objectid, generation, 1); + } + +-static struct dentry *btrfs_get_parent(struct dentry *child) ++struct dentry *btrfs_get_parent(struct dentry *child) + { + struct inode *dir = d_inode(child); + struct btrfs_fs_info *fs_info = btrfs_sb(dir->i_sb); +diff --git a/fs/btrfs/export.h b/fs/btrfs/export.h +index 91b3908e7c549..15db024621414 100644 +--- a/fs/btrfs/export.h ++++ b/fs/btrfs/export.h +@@ -17,4 +17,9 @@ struct btrfs_fid { + u64 parent_root_objectid; + } __attribute__ ((packed)); + ++struct dentry *btrfs_get_dentry(struct super_block *sb, u64 objectid, ++ u64 root_objectid, u32 generation, ++ int check_generation); ++struct dentry *btrfs_get_parent(struct dentry *child); ++ + #endif +diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c +index 57908ee964a20..17856e92b93d1 100644 +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -629,7 +629,21 @@ cont: + btrfs_free_reserved_data_space_noquota(inode, + start, + end - start + 1); +- goto free_pages_out; ++ ++ /* ++ * Ensure we only free the compressed pages if we have ++ * them allocated, as we can still reach here with ++ * inode_need_compress() == false. ++ */ ++ if (pages) { ++ for (i = 0; i < nr_pages; i++) { ++ WARN_ON(pages[i]->mapping); ++ put_page(pages[i]); ++ } ++ kfree(pages); ++ } ++ ++ return; + } + } + +@@ -708,13 +722,6 @@ cleanup_and_bail_uncompressed: + *num_added += 1; + + return; +- +-free_pages_out: +- for (i = 0; i < nr_pages; i++) { +- WARN_ON(pages[i]->mapping); +- put_page(pages[i]); +- } +- kfree(pages); + } + + static void free_async_extent_pages(struct async_extent *async_extent) +diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c +index 17a8463ef35c1..eb64d4b159e07 100644 +--- a/fs/btrfs/super.c ++++ b/fs/btrfs/super.c +@@ -939,8 +939,8 @@ out: + return error; + } + +-static char *get_subvol_name_from_objectid(struct btrfs_fs_info *fs_info, +- u64 subvol_objectid) ++char *btrfs_get_subvol_name_from_objectid(struct btrfs_fs_info *fs_info, ++ u64 subvol_objectid) + { + struct btrfs_root *root = fs_info->tree_root; + struct btrfs_root *fs_root; +@@ -1221,6 +1221,7 @@ static int btrfs_show_options(struct seq_file *seq, struct dentry *dentry) + { + struct btrfs_fs_info *info = btrfs_sb(dentry->d_sb); + char *compress_type; ++ const char *subvol_name; + + if (btrfs_test_opt(info, DEGRADED)) + seq_puts(seq, ",degraded"); +@@ -1307,8 +1308,13 @@ static int btrfs_show_options(struct seq_file *seq, struct dentry *dentry) + #endif + seq_printf(seq, ",subvolid=%llu", + BTRFS_I(d_inode(dentry))->root->root_key.objectid); +- seq_puts(seq, ",subvol="); +- seq_dentry(seq, dentry, " \t\n\\"); ++ subvol_name = btrfs_get_subvol_name_from_objectid(info, ++ BTRFS_I(d_inode(dentry))->root->root_key.objectid); ++ if (!IS_ERR(subvol_name)) { ++ seq_puts(seq, ",subvol="); ++ seq_escape(seq, subvol_name, " \t\n\\"); ++ kfree(subvol_name); ++ } + return 0; + } + +@@ -1427,8 +1433,8 @@ static struct dentry *mount_subvol(const char *subvol_name, u64 subvol_objectid, + goto out; + } + } +- subvol_name = get_subvol_name_from_objectid(btrfs_sb(mnt->mnt_sb), +- subvol_objectid); ++ subvol_name = btrfs_get_subvol_name_from_objectid( ++ btrfs_sb(mnt->mnt_sb), subvol_objectid); + if (IS_ERR(subvol_name)) { + root = ERR_CAST(subvol_name); + subvol_name = NULL; +diff --git a/fs/btrfs/sysfs.c b/fs/btrfs/sysfs.c +index f05341bda1d14..383546ff62f04 100644 +--- a/fs/btrfs/sysfs.c ++++ b/fs/btrfs/sysfs.c +@@ -25,6 +25,7 @@ + #include + #include + #include ++#include + + #include "ctree.h" + #include "disk-io.h" +@@ -749,7 +750,9 @@ int btrfs_sysfs_add_device_link(struct btrfs_fs_devices *fs_devices, + { + int error = 0; + struct btrfs_device *dev; ++ unsigned int nofs_flag; + ++ nofs_flag = memalloc_nofs_save(); + list_for_each_entry(dev, &fs_devices->devices, dev_list) { + struct hd_struct *disk; + struct kobject *disk_kobj; +@@ -768,6 +771,7 @@ int btrfs_sysfs_add_device_link(struct btrfs_fs_devices *fs_devices, + if (error) + break; + } ++ memalloc_nofs_restore(nofs_flag); + + return error; + } +diff --git a/fs/eventpoll.c b/fs/eventpoll.c +index c291bf61afb9c..00f0902e27e88 100644 +--- a/fs/eventpoll.c ++++ b/fs/eventpoll.c +@@ -1900,9 +1900,11 @@ static int ep_loop_check_proc(void *priv, void *cookie, int call_nests) + * not already there, and calling reverse_path_check() + * during ep_insert(). + */ +- if (list_empty(&epi->ffd.file->f_tfile_llink)) ++ if (list_empty(&epi->ffd.file->f_tfile_llink)) { ++ get_file(epi->ffd.file); + list_add(&epi->ffd.file->f_tfile_llink, + &tfile_check_list); ++ } + } + } + mutex_unlock(&ep->mtx); +@@ -1946,6 +1948,7 @@ static void clear_tfile_check_list(void) + file = list_first_entry(&tfile_check_list, struct file, + f_tfile_llink); + list_del_init(&file->f_tfile_llink); ++ fput(file); + } + INIT_LIST_HEAD(&tfile_check_list); + } +@@ -2096,13 +2099,13 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd, + mutex_lock(&epmutex); + if (is_file_epoll(tf.file)) { + error = -ELOOP; +- if (ep_loop_check(ep, tf.file) != 0) { +- clear_tfile_check_list(); ++ if (ep_loop_check(ep, tf.file) != 0) + goto error_tgt_fput; +- } +- } else ++ } else { ++ get_file(tf.file); + list_add(&tf.file->f_tfile_llink, + &tfile_check_list); ++ } + mutex_lock_nested(&ep->mtx, 0); + if (is_file_epoll(tf.file)) { + tep = tf.file->private_data; +@@ -2126,8 +2129,6 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd, + error = ep_insert(ep, &epds, tf.file, fd, full_check); + } else + error = -EEXIST; +- if (full_check) +- clear_tfile_check_list(); + break; + case EPOLL_CTL_DEL: + if (epi) +@@ -2150,8 +2151,10 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd, + mutex_unlock(&ep->mtx); + + error_tgt_fput: +- if (full_check) ++ if (full_check) { ++ clear_tfile_check_list(); + mutex_unlock(&epmutex); ++ } + + fdput(tf); + error_fput: +diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c +index 161099f39ab9c..3f999053457b6 100644 +--- a/fs/ext4/namei.c ++++ b/fs/ext4/namei.c +@@ -1308,8 +1308,8 @@ int ext4_search_dir(struct buffer_head *bh, char *search_buf, int buf_size, + ext4_match(fname, de)) { + /* found a match - just to be sure, do + * a full check */ +- if (ext4_check_dir_entry(dir, NULL, de, bh, bh->b_data, +- bh->b_size, offset)) ++ if (ext4_check_dir_entry(dir, NULL, de, bh, search_buf, ++ buf_size, offset)) + return -1; + *res_dir = de; + return 1; +@@ -1741,7 +1741,7 @@ static struct ext4_dir_entry_2 *do_split(handle_t *handle, struct inode *dir, + blocksize, hinfo, map); + map -= count; + dx_sort_map(map, count); +- /* Split the existing block in the middle, size-wise */ ++ /* Ensure that neither split block is over half full */ + size = 0; + move = 0; + for (i = count-1; i >= 0; i--) { +@@ -1751,8 +1751,18 @@ static struct ext4_dir_entry_2 *do_split(handle_t *handle, struct inode *dir, + size += map[i].size; + move++; + } +- /* map index at which we will split */ +- split = count - move; ++ /* ++ * map index at which we will split ++ * ++ * If the sum of active entries didn't exceed half the block size, just ++ * split it in half by count; each resulting block will have at least ++ * half the space free. ++ */ ++ if (i > 0) ++ split = count - move; ++ else ++ split = count/2; ++ + hash2 = map[split].hash; + continued = hash2 == map[split - 1].hash; + dxtrace(printk(KERN_INFO "Split block %lu at %x, %i/%i\n", +@@ -2353,7 +2363,7 @@ int ext4_generic_delete_entry(handle_t *handle, + de = (struct ext4_dir_entry_2 *)entry_buf; + while (i < buf_size - csum_size) { + if (ext4_check_dir_entry(dir, NULL, de, bh, +- bh->b_data, bh->b_size, i)) ++ entry_buf, buf_size, i)) + return -EFSCORRUPTED; + if (de == de_del) { + if (pde) +diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c +index 6e054b368b5fe..93a466cf58ba7 100644 +--- a/fs/jbd2/journal.c ++++ b/fs/jbd2/journal.c +@@ -1356,8 +1356,10 @@ static int jbd2_write_superblock(journal_t *journal, int write_flags) + int ret; + + /* Buffer got discarded which means block device got invalidated */ +- if (!buffer_mapped(bh)) ++ if (!buffer_mapped(bh)) { ++ unlock_buffer(bh); + return -EIO; ++ } + + trace_jbd2_write_superblock(journal, write_flags); + if (!(journal->j_flags & JBD2_BARRIER)) +diff --git a/fs/jffs2/dir.c b/fs/jffs2/dir.c +index e5a6deb38e1e1..f4a5ec92f5dc7 100644 +--- a/fs/jffs2/dir.c ++++ b/fs/jffs2/dir.c +@@ -590,10 +590,14 @@ static int jffs2_rmdir (struct inode *dir_i, struct dentry *dentry) + int ret; + uint32_t now = get_seconds(); + ++ mutex_lock(&f->sem); + for (fd = f->dents ; fd; fd = fd->next) { +- if (fd->ino) ++ if (fd->ino) { ++ mutex_unlock(&f->sem); + return -ENOTEMPTY; ++ } + } ++ mutex_unlock(&f->sem); + + ret = jffs2_do_unlink(c, dir_f, dentry->d_name.name, + dentry->d_name.len, f, now); +diff --git a/fs/romfs/storage.c b/fs/romfs/storage.c +index f86f51f99aceb..1dcadd22b440d 100644 +--- a/fs/romfs/storage.c ++++ b/fs/romfs/storage.c +@@ -221,10 +221,8 @@ int romfs_dev_read(struct super_block *sb, unsigned long pos, + size_t limit; + + limit = romfs_maxsize(sb); +- if (pos >= limit) ++ if (pos >= limit || buflen > limit - pos) + return -EIO; +- if (buflen > limit - pos) +- buflen = limit - pos; + + #ifdef CONFIG_ROMFS_ON_MTD + if (sb->s_mtd) +diff --git a/fs/xfs/xfs_sysfs.h b/fs/xfs/xfs_sysfs.h +index d04637181ef21..980c9429abec5 100644 +--- a/fs/xfs/xfs_sysfs.h ++++ b/fs/xfs/xfs_sysfs.h +@@ -44,9 +44,11 @@ xfs_sysfs_init( + struct xfs_kobj *parent_kobj, + const char *name) + { ++ struct kobject *parent; ++ ++ parent = parent_kobj ? &parent_kobj->kobject : NULL; + init_completion(&kobj->complete); +- return kobject_init_and_add(&kobj->kobject, ktype, +- &parent_kobj->kobject, "%s", name); ++ return kobject_init_and_add(&kobj->kobject, ktype, parent, "%s", name); + } + + static inline void +diff --git a/fs/xfs/xfs_trans_dquot.c b/fs/xfs/xfs_trans_dquot.c +index c3d547211d160..9c42e50a5cb7e 100644 +--- a/fs/xfs/xfs_trans_dquot.c ++++ b/fs/xfs/xfs_trans_dquot.c +@@ -669,7 +669,7 @@ xfs_trans_dqresv( + } + } + if (ninos > 0) { +- total_count = be64_to_cpu(dqp->q_core.d_icount) + ninos; ++ total_count = dqp->q_res_icount + ninos; + timer = be32_to_cpu(dqp->q_core.d_itimer); + warns = be16_to_cpu(dqp->q_core.d_iwarns); + warnlimit = dqp->q_mount->m_quotainfo->qi_iwarnlimit; +diff --git a/kernel/relay.c b/kernel/relay.c +index b141ce697679f..53c2a1a4b057f 100644 +--- a/kernel/relay.c ++++ b/kernel/relay.c +@@ -196,6 +196,7 @@ free_buf: + static void relay_destroy_channel(struct kref *kref) + { + struct rchan *chan = container_of(kref, struct rchan, kref); ++ free_percpu(chan->buf); + kfree(chan); + } + +diff --git a/mm/hugetlb.c b/mm/hugetlb.c +index d6464045d3b97..194125cf2d2b9 100644 +--- a/mm/hugetlb.c ++++ b/mm/hugetlb.c +@@ -4575,25 +4575,21 @@ static bool vma_shareable(struct vm_area_struct *vma, unsigned long addr) + void adjust_range_if_pmd_sharing_possible(struct vm_area_struct *vma, + unsigned long *start, unsigned long *end) + { +- unsigned long check_addr = *start; ++ unsigned long a_start, a_end; + + if (!(vma->vm_flags & VM_MAYSHARE)) + return; + +- for (check_addr = *start; check_addr < *end; check_addr += PUD_SIZE) { +- unsigned long a_start = check_addr & PUD_MASK; +- unsigned long a_end = a_start + PUD_SIZE; ++ /* Extend the range to be PUD aligned for a worst case scenario */ ++ a_start = ALIGN_DOWN(*start, PUD_SIZE); ++ a_end = ALIGN(*end, PUD_SIZE); + +- /* +- * If sharing is possible, adjust start/end if necessary. +- */ +- if (range_in_vma(vma, a_start, a_end)) { +- if (a_start < *start) +- *start = a_start; +- if (a_end > *end) +- *end = a_end; +- } +- } ++ /* ++ * Intersect the range with the vma range, since pmd sharing won't be ++ * across vma after all ++ */ ++ *start = max(vma->vm_start, a_start); ++ *end = min(vma->vm_end, a_end); + } + + /* +diff --git a/mm/khugepaged.c b/mm/khugepaged.c +index 04b4c38d0c184..9dfe364d4c0d1 100644 +--- a/mm/khugepaged.c ++++ b/mm/khugepaged.c +@@ -394,7 +394,7 @@ static void insert_to_mm_slots_hash(struct mm_struct *mm, + + static inline int khugepaged_test_exit(struct mm_struct *mm) + { +- return atomic_read(&mm->mm_users) == 0; ++ return atomic_read(&mm->mm_users) == 0 || !mmget_still_valid(mm); + } + + int __khugepaged_enter(struct mm_struct *mm) +@@ -407,7 +407,7 @@ int __khugepaged_enter(struct mm_struct *mm) + return -ENOMEM; + + /* __khugepaged_exit() must not run from under us */ +- VM_BUG_ON_MM(khugepaged_test_exit(mm), mm); ++ VM_BUG_ON_MM(atomic_read(&mm->mm_users) == 0, mm); + if (unlikely(test_and_set_bit(MMF_VM_HUGEPAGE, &mm->flags))) { + free_mm_slot(mm_slot); + return 0; +@@ -1006,9 +1006,6 @@ static void collapse_huge_page(struct mm_struct *mm, + * handled by the anon_vma lock + PG_lock. + */ + down_write(&mm->mmap_sem); +- result = SCAN_ANY_PROCESS; +- if (!mmget_still_valid(mm)) +- goto out; + result = hugepage_vma_revalidate(mm, address, &vma); + if (result) + goto out; +diff --git a/mm/page_alloc.c b/mm/page_alloc.c +index e992afe3a58e9..a3958b4fec6cb 100644 +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -1114,6 +1114,11 @@ static void free_pcppages_bulk(struct zone *zone, int count, + spin_lock(&zone->lock); + isolated_pageblocks = has_isolate_pageblock(zone); + ++ /* ++ * Ensure proper count is passed which otherwise would stuck in the ++ * below while (list_empty(list)) loop. ++ */ ++ count = min(pcp->count, count); + while (count) { + struct page *page; + struct list_head *list; +@@ -7018,7 +7023,7 @@ int __meminit init_per_zone_wmark_min(void) + + return 0; + } +-core_initcall(init_per_zone_wmark_min) ++postcore_initcall(init_per_zone_wmark_min) + + /* + * min_free_kbytes_sysctl_handler - just a wrapper around proc_dointvec() so +diff --git a/sound/soc/codecs/msm8916-wcd-analog.c b/sound/soc/codecs/msm8916-wcd-analog.c +index 3633eb30dd135..4f949ad50d6a7 100644 +--- a/sound/soc/codecs/msm8916-wcd-analog.c ++++ b/sound/soc/codecs/msm8916-wcd-analog.c +@@ -16,8 +16,8 @@ + + #define CDC_D_REVISION1 (0xf000) + #define CDC_D_PERPH_SUBTYPE (0xf005) +-#define CDC_D_INT_EN_SET (0x015) +-#define CDC_D_INT_EN_CLR (0x016) ++#define CDC_D_INT_EN_SET (0xf015) ++#define CDC_D_INT_EN_CLR (0xf016) + #define MBHC_SWITCH_INT BIT(7) + #define MBHC_MIC_ELECTRICAL_INS_REM_DET BIT(6) + #define MBHC_BUTTON_PRESS_DET BIT(5) +diff --git a/sound/soc/intel/atom/sst-mfld-platform-pcm.c b/sound/soc/intel/atom/sst-mfld-platform-pcm.c +index 4558c8b930363..3a645fc425cd4 100644 +--- a/sound/soc/intel/atom/sst-mfld-platform-pcm.c ++++ b/sound/soc/intel/atom/sst-mfld-platform-pcm.c +@@ -339,7 +339,7 @@ static int sst_media_open(struct snd_pcm_substream *substream, + + ret_val = power_up_sst(stream); + if (ret_val < 0) +- return ret_val; ++ goto out_power_up; + + /* Make sure, that the period size is always even */ + snd_pcm_hw_constraint_step(substream->runtime, 0, +@@ -348,8 +348,9 @@ static int sst_media_open(struct snd_pcm_substream *substream, + return snd_pcm_hw_constraint_integer(runtime, + SNDRV_PCM_HW_PARAM_PERIODS); + out_ops: +- kfree(stream); + mutex_unlock(&sst_lock); ++out_power_up: ++ kfree(stream); + return ret_val; + } + +diff --git a/tools/perf/util/probe-finder.c b/tools/perf/util/probe-finder.c +index 8f7f9d05f38c0..bfa6d9d215569 100644 +--- a/tools/perf/util/probe-finder.c ++++ b/tools/perf/util/probe-finder.c +@@ -1354,7 +1354,7 @@ int debuginfo__find_trace_events(struct debuginfo *dbg, + tf.ntevs = 0; + + ret = debuginfo__find_probes(dbg, &tf.pf); +- if (ret < 0) { ++ if (ret < 0 || tf.ntevs == 0) { + for (i = 0; i < tf.ntevs; i++) + clear_probe_trace_event(&tf.tevs[i]); + zfree(tevs); +diff --git a/virt/kvm/arm/mmu.c b/virt/kvm/arm/mmu.c +index 3814cdad643a5..7fe673248e984 100644 +--- a/virt/kvm/arm/mmu.c ++++ b/virt/kvm/arm/mmu.c +@@ -307,12 +307,6 @@ static void unmap_stage2_range(struct kvm *kvm, phys_addr_t start, u64 size) + next = stage2_pgd_addr_end(addr, end); + if (!stage2_pgd_none(*pgd)) + unmap_stage2_puds(kvm, pgd, addr, next); +- /* +- * If the range is too large, release the kvm->mmu_lock +- * to prevent starvation and lockup detector warnings. +- */ +- if (next != end) +- cond_resched_lock(&kvm->mmu_lock); + } while (pgd++, addr = next, addr != end); + } +