diff --git a/config/kernel/linux-odroidxu4-legacy.config b/config/kernel/linux-odroidxu4-legacy.config index 515a80935..19cc158ad 100644 --- a/config/kernel/linux-odroidxu4-legacy.config +++ b/config/kernel/linux-odroidxu4-legacy.config @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/arm 4.14.141 Kernel Configuration +# Linux/arm 4.14.161 Kernel Configuration # CONFIG_ARM=y CONFIG_ARM_HAS_SG_CHAIN=y @@ -137,7 +137,7 @@ CONFIG_CGROUP_SCHED=y CONFIG_FAIR_GROUP_SCHED=y CONFIG_CFS_BANDWIDTH=y CONFIG_RT_GROUP_SCHED=y -CONFIG_CGROUP_PIDS=y +# CONFIG_CGROUP_PIDS is not set # CONFIG_CGROUP_RDMA is not set CONFIG_CGROUP_FREEZER=y CONFIG_CPUSETS=y @@ -2143,6 +2143,7 @@ CONFIG_WLAN_VENDOR_TI=y # CONFIG_WLCORE is not set CONFIG_RTL8822BU=m CONFIG_RTL8188EU=m +CONFIG_RTL8821CU=m CONFIG_RTL8812AU=m CONFIG_WLAN_VENDOR_ZYDAS=y CONFIG_USB_ZD1201=m @@ -4343,7 +4344,6 @@ CONFIG_USB_EMI62=m CONFIG_USB_EMI26=m CONFIG_USB_ADUTUX=m CONFIG_USB_SEVSEG=m -# CONFIG_USB_RIO500 is not set # CONFIG_USB_LEGOTOWER is not set # CONFIG_USB_LCD is not set # CONFIG_USB_CYPRESS_CY7C63 is not set @@ -6124,6 +6124,7 @@ CONFIG_TEXTSEARCH_FSM=m CONFIG_ASSOCIATIVE_ARRAY=y CONFIG_HAS_IOMEM=y CONFIG_HAS_DMA=y +CONFIG_SGL_ALLOC=y # CONFIG_DMA_NOOP_OPS is not set # CONFIG_DMA_VIRT_OPS is not set CONFIG_CPU_RMAP=y diff --git a/config/sources/families/odroidxu4.conf b/config/sources/families/odroidxu4.conf index 91db9c9c6..2f26de70a 100644 --- a/config/sources/families/odroidxu4.conf +++ b/config/sources/families/odroidxu4.conf @@ -12,6 +12,7 @@ case $BRANCH in KERNELSOURCE='https://github.com/hardkernel/linux' KERNELBRANCH='branch:odroidxu4-4.14.y' + KERNEL_USE_GCC='< 7.5' KERNELDIR='linux-odroidxu4' ;; diff --git a/patch/kernel/odroidxu4-legacy/0001-aufs4.14-20181119.patch b/patch/kernel/odroidxu4-legacy/0001-aufs4.14-20190902.patch similarity index 98% rename from patch/kernel/odroidxu4-legacy/0001-aufs4.14-20181119.patch rename to patch/kernel/odroidxu4-legacy/0001-aufs4.14-20190902.patch index c8f021a47..8e10b6720 100644 --- a/patch/kernel/odroidxu4-legacy/0001-aufs4.14-20181119.patch +++ b/patch/kernel/odroidxu4-legacy/0001-aufs4.14-20190902.patch @@ -1,6 +1,6 @@ diff --git a/Documentation/ABI/testing/debugfs-aufs b/Documentation/ABI/testing/debugfs-aufs new file mode 100644 -index 00000000..4a669419 +index 000000000..4a6694194 --- /dev/null +++ b/Documentation/ABI/testing/debugfs-aufs @@ -0,0 +1,55 @@ @@ -61,7 +61,7 @@ index 00000000..4a669419 + will be empty. About XINO files, see the aufs manual. diff --git a/Documentation/ABI/testing/sysfs-aufs b/Documentation/ABI/testing/sysfs-aufs new file mode 100644 -index 00000000..82f95184 +index 000000000..82f951849 --- /dev/null +++ b/Documentation/ABI/testing/sysfs-aufs @@ -0,0 +1,31 @@ @@ -98,10 +98,10 @@ index 00000000..82f95184 + will be empty. About XINO files, see the aufs manual. diff --git a/Documentation/filesystems/aufs/README b/Documentation/filesystems/aufs/README new file mode 100644 -index 00000000..fb05e3b7 +index 000000000..029c3e5df --- /dev/null +++ b/Documentation/filesystems/aufs/README -@@ -0,0 +1,395 @@ +@@ -0,0 +1,402 @@ + +Aufs4 -- advanced multi layered unification filesystem version 4.x +http://aufs.sf.net @@ -356,6 +356,13 @@ index 00000000..fb05e3b7 + Supports a nested loopback mount in a branch-fs. This patch is + unnecessary until aufs produces a message like "you may want to try + another patch for loopback file". ++- proc_mounts.patch ++ When there are many mountpoints and many mount(2)/umount(2) are ++ running, then /proc/mounts may not show the all mountpoints. This ++ patch makes /proc/mounts always show the full mountpoints list. ++ If you don't want to apply this patch and meet such problem, then you ++ need to increase the value of 'ProcMounts_Times' make-variable in ++ aufs-util.git as a second best solution. +- vfs-ino.patch + Modifies a system global kernel internal function get_next_ino() in + order to stop assigning 0 for an inode-number. Not directly related to @@ -499,12 +506,12 @@ index 00000000..fb05e3b7 +# End: ; diff --git a/Documentation/filesystems/aufs/design/01intro.txt b/Documentation/filesystems/aufs/design/01intro.txt new file mode 100644 -index 00000000..aa105298 +index 000000000..609bf0e9b --- /dev/null +++ b/Documentation/filesystems/aufs/design/01intro.txt @@ -0,0 +1,171 @@ + -+# Copyright (C) 2005-2018 Junjiro R. Okajima ++# Copyright (C) 2005-2019 Junjiro R. Okajima +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by @@ -676,12 +683,12 @@ index 00000000..aa105298 +about it. But currently I have implemented it in kernel space. diff --git a/Documentation/filesystems/aufs/design/02struct.txt b/Documentation/filesystems/aufs/design/02struct.txt new file mode 100644 -index 00000000..f5fb6a8a +index 000000000..2467788c7 --- /dev/null +++ b/Documentation/filesystems/aufs/design/02struct.txt @@ -0,0 +1,258 @@ + -+# Copyright (C) 2005-2018 Junjiro R. Okajima ++# Copyright (C) 2005-2019 Junjiro R. Okajima +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by @@ -940,12 +947,12 @@ index 00000000..f5fb6a8a +For this purpose, use "aumvdown" command in aufs-util.git. diff --git a/Documentation/filesystems/aufs/design/03atomic_open.txt b/Documentation/filesystems/aufs/design/03atomic_open.txt new file mode 100644 -index 00000000..1b0699f8 +index 000000000..9f16ac1e0 --- /dev/null +++ b/Documentation/filesystems/aufs/design/03atomic_open.txt @@ -0,0 +1,85 @@ + -+# Copyright (C) 2015-2018 Junjiro R. Okajima ++# Copyright (C) 2015-2019 Junjiro R. Okajima +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by @@ -1031,12 +1038,12 @@ index 00000000..1b0699f8 + be implemented in aufs, but not all I am afraid. diff --git a/Documentation/filesystems/aufs/design/03lookup.txt b/Documentation/filesystems/aufs/design/03lookup.txt new file mode 100644 -index 00000000..80ae63bc +index 000000000..08b443d94 --- /dev/null +++ b/Documentation/filesystems/aufs/design/03lookup.txt @@ -0,0 +1,113 @@ + -+# Copyright (C) 2005-2018 Junjiro R. Okajima ++# Copyright (C) 2005-2019 Junjiro R. Okajima +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by @@ -1150,12 +1157,12 @@ index 00000000..80ae63bc + by over-mounting something (or another method). diff --git a/Documentation/filesystems/aufs/design/04branch.txt b/Documentation/filesystems/aufs/design/04branch.txt new file mode 100644 -index 00000000..0c128973 +index 000000000..3ab3682a4 --- /dev/null +++ b/Documentation/filesystems/aufs/design/04branch.txt @@ -0,0 +1,74 @@ + -+# Copyright (C) 2005-2018 Junjiro R. Okajima ++# Copyright (C) 2005-2019 Junjiro R. Okajima +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by @@ -1230,12 +1237,12 @@ index 00000000..0c128973 + same named entry on the upper branch. diff --git a/Documentation/filesystems/aufs/design/05wbr_policy.txt b/Documentation/filesystems/aufs/design/05wbr_policy.txt new file mode 100644 -index 00000000..cc5b7979 +index 000000000..1f9b86bc6 --- /dev/null +++ b/Documentation/filesystems/aufs/design/05wbr_policy.txt @@ -0,0 +1,64 @@ + -+# Copyright (C) 2005-2018 Junjiro R. Okajima ++# Copyright (C) 2005-2019 Junjiro R. Okajima +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by @@ -1300,7 +1307,7 @@ index 00000000..cc5b7979 + copyup policy. diff --git a/Documentation/filesystems/aufs/design/06dirren.dot b/Documentation/filesystems/aufs/design/06dirren.dot new file mode 100644 -index 00000000..2d62bb6d +index 000000000..2d62bb6dd --- /dev/null +++ b/Documentation/filesystems/aufs/design/06dirren.dot @@ -0,0 +1,31 @@ @@ -1337,12 +1344,12 @@ index 00000000..2d62bb6d +} diff --git a/Documentation/filesystems/aufs/design/06dirren.txt b/Documentation/filesystems/aufs/design/06dirren.txt new file mode 100644 -index 00000000..1f3cb86d +index 000000000..3b80f8659 --- /dev/null +++ b/Documentation/filesystems/aufs/design/06dirren.txt @@ -0,0 +1,102 @@ + -+# Copyright (C) 2017-2018 Junjiro R. Okajima ++# Copyright (C) 2017-2019 Junjiro R. Okajima +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by @@ -1445,12 +1452,12 @@ index 00000000..1f3cb86d +equivalen to udba=reval case. diff --git a/Documentation/filesystems/aufs/design/06fhsm.txt b/Documentation/filesystems/aufs/design/06fhsm.txt new file mode 100644 -index 00000000..ddfebecd +index 000000000..8b498d0af --- /dev/null +++ b/Documentation/filesystems/aufs/design/06fhsm.txt @@ -0,0 +1,120 @@ + -+# Copyright (C) 2011-2018 Junjiro R. Okajima ++# Copyright (C) 2011-2019 Junjiro R. Okajima +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by @@ -1571,12 +1578,12 @@ index 00000000..ddfebecd +should restore the original file state after an error happens. diff --git a/Documentation/filesystems/aufs/design/06mmap.txt b/Documentation/filesystems/aufs/design/06mmap.txt new file mode 100644 -index 00000000..9a0a096b +index 000000000..cdd84ea77 --- /dev/null +++ b/Documentation/filesystems/aufs/design/06mmap.txt @@ -0,0 +1,72 @@ + -+# Copyright (C) 2005-2018 Junjiro R. Okajima ++# Copyright (C) 2005-2019 Junjiro R. Okajima +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by @@ -1649,12 +1656,12 @@ index 00000000..9a0a096b +I have to give up this "looks-smater" approach. diff --git a/Documentation/filesystems/aufs/design/06xattr.txt b/Documentation/filesystems/aufs/design/06xattr.txt new file mode 100644 -index 00000000..be441e8d +index 000000000..edd7553f3 --- /dev/null +++ b/Documentation/filesystems/aufs/design/06xattr.txt @@ -0,0 +1,96 @@ + -+# Copyright (C) 2014-2018 Junjiro R. Okajima ++# Copyright (C) 2014-2019 Junjiro R. Okajima +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by @@ -1751,12 +1758,12 @@ index 00000000..be441e8d +now, aufs implements the branch attributes to ignore the error. diff --git a/Documentation/filesystems/aufs/design/07export.txt b/Documentation/filesystems/aufs/design/07export.txt new file mode 100644 -index 00000000..bb700cb1 +index 000000000..9b983f3dd --- /dev/null +++ b/Documentation/filesystems/aufs/design/07export.txt @@ -0,0 +1,58 @@ + -+# Copyright (C) 2005-2018 Junjiro R. Okajima ++# Copyright (C) 2005-2019 Junjiro R. Okajima +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by @@ -1815,12 +1822,12 @@ index 00000000..bb700cb1 + lookup_one_len(), vfs_getattr(), encode_fh() and others. diff --git a/Documentation/filesystems/aufs/design/08shwh.txt b/Documentation/filesystems/aufs/design/08shwh.txt new file mode 100644 -index 00000000..1dad573f +index 000000000..647a86a65 --- /dev/null +++ b/Documentation/filesystems/aufs/design/08shwh.txt @@ -0,0 +1,52 @@ + -+# Copyright (C) 2005-2018 Junjiro R. Okajima ++# Copyright (C) 2005-2019 Junjiro R. Okajima +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by @@ -1873,12 +1880,12 @@ index 00000000..1dad573f +initramfs will use it to replace the old one at the next boot. diff --git a/Documentation/filesystems/aufs/design/10dynop.txt b/Documentation/filesystems/aufs/design/10dynop.txt new file mode 100644 -index 00000000..710313c0 +index 000000000..13e8583f2 --- /dev/null +++ b/Documentation/filesystems/aufs/design/10dynop.txt @@ -0,0 +1,47 @@ + -+# Copyright (C) 2010-2018 Junjiro R. Okajima ++# Copyright (C) 2010-2019 Junjiro R. Okajima +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by @@ -1925,7 +1932,7 @@ index 00000000..710313c0 +Currently this approach is applied to address_space_operations for +regular files only. diff --git a/MAINTAINERS b/MAINTAINERS -index 546beb6b..c413f03f 100644 +index 029f96c43..4b98496c4 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -2465,6 +2465,19 @@ F: include/linux/audit.h @@ -1934,8 +1941,8 @@ index 546beb6b..c413f03f 100644 +AUFS (advanced multi layered unification filesystem) FILESYSTEM +M: "J. R. Okajima" -+L: linux-unionfs@vger.kernel.org +L: aufs-users@lists.sourceforge.net (members only) ++L: linux-unionfs@vger.kernel.org +W: http://aufs.sourceforge.net +T: git://github.com/sfjro/aufs4-linux.git +S: Supported @@ -1949,10 +1956,10 @@ index 546beb6b..c413f03f 100644 M: Miguel Ojeda Sandonis W: http://miguelojeda.es/auxdisplay.htm diff --git a/drivers/block/loop.c b/drivers/block/loop.c -index 6d61633a..1d92600c 100644 +index 453e3728e..023376f3b 100644 --- a/drivers/block/loop.c +++ b/drivers/block/loop.c -@@ -710,6 +710,24 @@ static int loop_change_fd(struct loop_device *lo, struct block_device *bdev, +@@ -720,6 +720,24 @@ static int loop_change_fd(struct loop_device *lo, struct block_device *bdev, return error; } @@ -1978,7 +1985,7 @@ index 6d61633a..1d92600c 100644 static ssize_t loop_attr_show(struct device *dev, char *page, diff --git a/fs/Kconfig b/fs/Kconfig -index 7aee6d69..ec920312 100644 +index 7aee6d699..ec9203120 100644 --- a/fs/Kconfig +++ b/fs/Kconfig @@ -248,6 +248,7 @@ source "fs/pstore/Kconfig" @@ -1990,7 +1997,7 @@ index 7aee6d69..ec920312 100644 endif # MISC_FILESYSTEMS diff --git a/fs/Makefile b/fs/Makefile -index ef772f1e..51779e68 100644 +index ef772f1ea..51779e68c 100644 --- a/fs/Makefile +++ b/fs/Makefile @@ -129,3 +129,4 @@ obj-y += exofs/ # Multiple modules @@ -2000,7 +2007,7 @@ index ef772f1e..51779e68 100644 +obj-$(CONFIG_AUFS_FS) += aufs/ diff --git a/fs/aufs/Kconfig b/fs/aufs/Kconfig new file mode 100644 -index 00000000..9f436425 +index 000000000..9f4364257 --- /dev/null +++ b/fs/aufs/Kconfig @@ -0,0 +1,199 @@ @@ -2205,7 +2212,7 @@ index 00000000..9f436425 +endif diff --git a/fs/aufs/Makefile b/fs/aufs/Makefile new file mode 100644 -index 00000000..2c819a64 +index 000000000..2c819a649 --- /dev/null +++ b/fs/aufs/Makefile @@ -0,0 +1,46 @@ @@ -2257,13 +2264,13 @@ index 00000000..2c819a64 +aufs-$(CONFIG_AUFS_MAGIC_SYSRQ) += sysrq.o diff --git a/fs/aufs/aufs.h b/fs/aufs/aufs.h new file mode 100644 -index 00000000..24569174 +index 000000000..a62a85211 --- /dev/null +++ b/fs/aufs/aufs.h @@ -0,0 +1,62 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* -+ * Copyright (C) 2005-2018 Junjiro R. Okajima ++ * Copyright (C) 2005-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -2325,13 +2332,13 @@ index 00000000..24569174 +#endif /* __AUFS_H__ */ diff --git a/fs/aufs/branch.c b/fs/aufs/branch.c new file mode 100644 -index 00000000..2fc6dc1e +index 000000000..598cf370a --- /dev/null +++ b/fs/aufs/branch.c @@ -0,0 +1,1422 @@ +// SPDX-License-Identifier: GPL-2.0 +/* -+ * Copyright (C) 2005-2018 Junjiro R. Okajima ++ * Copyright (C) 2005-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -2384,7 +2391,7 @@ index 00000000..2fc6dc1e + + if (br->br_fhsm) { + au_br_fhsm_fin(br->br_fhsm); -+ kfree(br->br_fhsm); ++ au_kfree_try_rcu(br->br_fhsm); + } + + key = br->br_dykey; @@ -2399,12 +2406,12 @@ index 00000000..2fc6dc1e + lockdep_off(); + path_put(&br->br_path); + lockdep_on(); -+ kfree(wbr); ++ au_kfree_rcu(wbr); + au_lcnt_wait_for_fin(&br->br_nfiles); + au_lcnt_wait_for_fin(&br->br_count); + /* I don't know why, but percpu_refcount requires this */ + /* synchronize_rcu(); */ -+ kfree(br); ++ au_kfree_rcu(br); +} + +/* @@ -2505,13 +2512,13 @@ index 00000000..2fc6dc1e + return add_branch; /* success */ + +out_wbr: -+ kfree(add_branch->br_wbr); ++ au_kfree_rcu(add_branch->br_wbr); +out_hnotify: + au_hnotify_fin_br(add_branch); +out_xino: + au_xino_put(add_branch); +out_br: -+ kfree(add_branch); ++ au_kfree_rcu(add_branch); +out: + return ERR_PTR(err); +} @@ -2677,7 +2684,7 @@ index 00000000..2fc6dc1e + br->br_perm = old_perm; + + if (!err && wbr && !au_br_writable(new_perm)) { -+ kfree(wbr); ++ au_kfree_rcu(wbr); + br->br_wbr = NULL; + } + @@ -3704,7 +3711,7 @@ index 00000000..2fc6dc1e + if (br->br_wbr) { + err = au_wbr_init(br, sb, mod->perm); + if (unlikely(err)) { -+ kfree(br->br_wbr); ++ au_kfree_rcu(br->br_wbr); + br->br_wbr = NULL; + } + } @@ -3716,7 +3723,7 @@ index 00000000..2fc6dc1e + if (!au_br_fhsm(mod->perm)) { + /* fhsm --> non-fhsm */ + au_br_fhsm_fin(br->br_fhsm); -+ kfree(br->br_fhsm); ++ au_kfree_rcu(br->br_fhsm); + br->br_fhsm = NULL; + } + } else if (au_br_fhsm(mod->perm)) @@ -3728,7 +3735,7 @@ index 00000000..2fc6dc1e + goto out; /* success */ + +out_bf: -+ kfree(bf); ++ au_kfree_try_rcu(bf); +out: + AuTraceErr(err); + return err; @@ -3753,13 +3760,13 @@ index 00000000..2fc6dc1e +} diff --git a/fs/aufs/branch.h b/fs/aufs/branch.h new file mode 100644 -index 00000000..3a551cec +index 000000000..012459ad5 --- /dev/null +++ b/fs/aufs/branch.h -@@ -0,0 +1,365 @@ +@@ -0,0 +1,366 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* -+ * Copyright (C) 2005-2018 Junjiro R. Okajima ++ * Copyright (C) 2005-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -3984,7 +3991,8 @@ index 00000000..3a551cec +static const loff_t au_loff_max = LLONG_MAX; + +aufs_bindex_t au_xi_root(struct super_block *sb, struct dentry *dentry); -+struct file *au_xino_create(struct super_block *sb, char *fpath, int silent); ++struct file *au_xino_create(struct super_block *sb, char *fpath, int silent, ++ int wbrtop); +struct file *au_xino_create2(struct super_block *sb, struct path *base, + struct file *copy_src); +struct au_xi_new { @@ -4124,7 +4132,7 @@ index 00000000..3a551cec +#endif /* __AUFS_BRANCH_H__ */ diff --git a/fs/aufs/conf.mk b/fs/aufs/conf.mk new file mode 100644 -index 00000000..12782f8e +index 000000000..12782f8e0 --- /dev/null +++ b/fs/aufs/conf.mk @@ -0,0 +1,40 @@ @@ -4170,13 +4178,13 @@ index 00000000..12782f8e +-include ${srctree}/${src}/conf_priv.mk diff --git a/fs/aufs/cpup.c b/fs/aufs/cpup.c new file mode 100644 -index 00000000..f094f7e6 +index 000000000..8fdaf6329 --- /dev/null +++ b/fs/aufs/cpup.c -@@ -0,0 +1,1446 @@ +@@ -0,0 +1,1449 @@ +// SPDX-License-Identifier: GPL-2.0 +/* -+ * Copyright (C) 2005-2018 Junjiro R. Okajima ++ * Copyright (C) 2005-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -4513,9 +4521,11 @@ index 00000000..f094f7e6 + unsigned long blksize; + unsigned char do_kfree; + char *buf; ++ struct super_block *h_sb; + + err = -ENOMEM; -+ blksize = dst->f_path.dentry->d_sb->s_blocksize; ++ h_sb = file_inode(dst)->i_sb; ++ blksize = h_sb->s_blocksize; + if (!blksize || PAGE_SIZE < blksize) + blksize = PAGE_SIZE; + AuDbg("blksize %lu\n", blksize); @@ -4533,9 +4543,10 @@ index 00000000..f094f7e6 + src->f_pos = 0; + dst->f_pos = 0; + err = au_do_copy_file(dst, src, len, buf, blksize); -+ if (do_kfree) -+ kfree(buf); -+ else ++ if (do_kfree) { ++ AuDebugOn(!au_kfree_do_sz_test(blksize)); ++ au_kfree_do_rcu(buf); ++ } else + free_page((unsigned long)buf); + +out: @@ -5129,7 +5140,7 @@ index 00000000..f094f7e6 + } +out_parent: + dput(dst_parent); -+ kfree(a); ++ au_kfree_rcu(a); +out: + return err; +} @@ -5622,13 +5633,13 @@ index 00000000..f094f7e6 +} diff --git a/fs/aufs/cpup.h b/fs/aufs/cpup.h new file mode 100644 -index 00000000..ce764a09 +index 000000000..c932e6b60 --- /dev/null +++ b/fs/aufs/cpup.h @@ -0,0 +1,100 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* -+ * Copyright (C) 2005-2018 Junjiro R. Okajima ++ * Copyright (C) 2005-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -5728,13 +5739,13 @@ index 00000000..ce764a09 +#endif /* __AUFS_CPUP_H__ */ diff --git a/fs/aufs/dbgaufs.c b/fs/aufs/dbgaufs.c new file mode 100644 -index 00000000..13872925 +index 000000000..e32d91d1f --- /dev/null +++ b/fs/aufs/dbgaufs.c -@@ -0,0 +1,519 @@ +@@ -0,0 +1,526 @@ +// SPDX-License-Identifier: GPL-2.0 +/* -+ * Copyright (C) 2005-2018 Junjiro R. Okajima ++ * Copyright (C) 2005-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -5776,7 +5787,14 @@ index 00000000..13872925 +static int dbgaufs_xi_release(struct inode *inode __maybe_unused, + struct file *file) +{ -+ kfree(file->private_data); ++ void *p; ++ ++ p = file->private_data; ++ if (p) { ++ /* this is struct dbgaufs_arg */ ++ AuDebugOn(!au_kfree_sz_test(p)); ++ au_kfree_do_rcu(p); ++ } + return 0; +} + @@ -6253,13 +6271,13 @@ index 00000000..13872925 +} diff --git a/fs/aufs/dbgaufs.h b/fs/aufs/dbgaufs.h new file mode 100644 -index 00000000..59d7b9d0 +index 000000000..1ea241bf0 --- /dev/null +++ b/fs/aufs/dbgaufs.h @@ -0,0 +1,53 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* -+ * Copyright (C) 2005-2018 Junjiro R. Okajima ++ * Copyright (C) 2005-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -6312,13 +6330,13 @@ index 00000000..59d7b9d0 +#endif /* __DBGAUFS_H__ */ diff --git a/fs/aufs/dcsub.c b/fs/aufs/dcsub.c new file mode 100644 -index 00000000..c850ed1a +index 000000000..ec5e2bbac --- /dev/null +++ b/fs/aufs/dcsub.c @@ -0,0 +1,226 @@ +// SPDX-License-Identifier: GPL-2.0 +/* -+ * Copyright (C) 2005-2018 Junjiro R. Okajima ++ * Copyright (C) 2005-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -6371,7 +6389,7 @@ index 00000000..c850ed1a + return 0; /* success */ + +out_dpages: -+ kfree(dpages->dpages); ++ au_kfree_try_rcu(dpages->dpages); +out: + return err; +} @@ -6384,7 +6402,7 @@ index 00000000..c850ed1a + p = dpages->dpages; + for (i = 0; i < dpages->ndpage; i++) + au_dpage_free(p++); -+ kfree(dpages->dpages); ++ au_kfree_try_rcu(dpages->dpages); +} + +static int au_dpages_append(struct au_dcsub_pages *dpages, @@ -6544,13 +6562,13 @@ index 00000000..c850ed1a +} diff --git a/fs/aufs/dcsub.h b/fs/aufs/dcsub.h new file mode 100644 -index 00000000..c610133d +index 000000000..5e578995c --- /dev/null +++ b/fs/aufs/dcsub.h @@ -0,0 +1,137 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* -+ * Copyright (C) 2005-2018 Junjiro R. Okajima ++ * Copyright (C) 2005-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -6687,13 +6705,13 @@ index 00000000..c610133d +#endif /* __AUFS_DCSUB_H__ */ diff --git a/fs/aufs/debug.c b/fs/aufs/debug.c new file mode 100644 -index 00000000..f1074919 +index 000000000..e8b122e35 --- /dev/null +++ b/fs/aufs/debug.c @@ -0,0 +1,440 @@ +// SPDX-License-Identifier: GPL-2.0 +/* -+ * Copyright (C) 2005-2018 Junjiro R. Okajima ++ * Copyright (C) 2005-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -7029,7 +7047,7 @@ index 00000000..f1074919 + a->mnt.mnt_sb = sb; + a->fake.br_path.mnt = &a->mnt; + err = do_pri_br(-1, &a->fake); -+ kfree(a); ++ au_kfree_rcu(a); + dpri("dev 0x%x\n", sb->s_dev); + if (err || !au_test_aufs(sb)) + return; @@ -7133,13 +7151,13 @@ index 00000000..f1074919 +} diff --git a/fs/aufs/debug.h b/fs/aufs/debug.h new file mode 100644 -index 00000000..b80bb5a9 +index 000000000..9c52470a6 --- /dev/null +++ b/fs/aufs/debug.h @@ -0,0 +1,226 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* -+ * Copyright (C) 2005-2018 Junjiro R. Okajima ++ * Copyright (C) 2005-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -7365,13 +7383,13 @@ index 00000000..b80bb5a9 +#endif /* __AUFS_DEBUG_H__ */ diff --git a/fs/aufs/dentry.c b/fs/aufs/dentry.c new file mode 100644 -index 00000000..2ee5c296 +index 000000000..55bb0dad2 --- /dev/null +++ b/fs/aufs/dentry.c @@ -0,0 +1,1153 @@ +// SPDX-License-Identifier: GPL-2.0 +/* -+ * Copyright (C) 2005-2018 Junjiro R. Okajima ++ * Copyright (C) 2005-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -7605,7 +7623,7 @@ index 00000000..2ee5c296 + +out_parent: + dput(parent); -+ kfree(args.whname.name); ++ au_kfree_try_rcu(args.whname.name); + if (dirren) + au_dr_lkup_fin(&args); +out: @@ -8524,13 +8542,13 @@ index 00000000..2ee5c296 +}; diff --git a/fs/aufs/dentry.h b/fs/aufs/dentry.h new file mode 100644 -index 00000000..adc2ac99 +index 000000000..3b443fc7e --- /dev/null +++ b/fs/aufs/dentry.h -@@ -0,0 +1,267 @@ +@@ -0,0 +1,268 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* -+ * Copyright (C) 2005-2018 Junjiro R. Okajima ++ * Copyright (C) 2005-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -8571,6 +8589,7 @@ index 00000000..adc2ac99 + aufs_bindex_t di_btop, di_bbot, di_bwh, di_bdiropq; + unsigned char di_tmpfile; /* to allow the different name */ + struct au_hdentry *di_hdentry; ++ struct rcu_head rcu; +} ____cacheline_aligned_in_smp; + +/* ---------------------------------------------------------------------- */ @@ -8797,13 +8816,13 @@ index 00000000..adc2ac99 +#endif /* __AUFS_DENTRY_H__ */ diff --git a/fs/aufs/dinfo.c b/fs/aufs/dinfo.c new file mode 100644 -index 00000000..7e56fe74 +index 000000000..86140548f --- /dev/null +++ b/fs/aufs/dinfo.c @@ -0,0 +1,554 @@ +// SPDX-License-Identifier: GPL-2.0 +/* -+ * Copyright (C) 2005-2018 Junjiro R. Okajima ++ * Copyright (C) 2005-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -8877,7 +8896,7 @@ index 00000000..7e56fe74 + while (bindex++ <= bbot) + au_hdput(p++); + } -+ kfree(dinfo->di_hdentry); ++ au_kfree_try_rcu(dinfo->di_hdentry); + au_cache_free_dinfo(dinfo); +} + @@ -9357,13 +9376,13 @@ index 00000000..7e56fe74 +} diff --git a/fs/aufs/dir.c b/fs/aufs/dir.c new file mode 100644 -index 00000000..af2c0640 +index 000000000..ab117dfd4 --- /dev/null +++ b/fs/aufs/dir.c @@ -0,0 +1,762 @@ +// SPDX-License-Identifier: GPL-2.0 +/* -+ * Copyright (C) 2005-2018 Junjiro R. Okajima ++ * Copyright (C) 2005-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -9520,7 +9539,7 @@ index 00000000..af2c0640 +out: + dput(a->dentry); + au_nwt_done(&au_sbi(sb)->si_nowait); -+ kfree(arg); ++ au_kfree_try_rcu(arg); +} + +void au_dir_ts(struct inode *dir, aufs_bindex_t bindex) @@ -9556,7 +9575,7 @@ index 00000000..af2c0640 + if (unlikely(wkq_err)) { + pr_err("wkq %d\n", wkq_err); + dput(dentry); -+ kfree(arg); ++ au_kfree_try_rcu(arg); + } + +out: @@ -9675,7 +9694,7 @@ index 00000000..af2c0640 + }; + err = au_do_open(file, &args); + if (unlikely(err)) -+ kfree(fidir); ++ au_kfree_rcu(fidir); + } + si_read_unlock(sb); + return err; @@ -9711,7 +9730,7 @@ index 00000000..af2c0640 + if (hf->hf_file) + au_hfput(hf, /*execed*/0); + } -+ kfree(fidir); ++ au_kfree_rcu(fidir); + finfo->fi_hdir = NULL; + } + au_finfo_fin(file); @@ -10125,13 +10144,13 @@ index 00000000..af2c0640 +}; diff --git a/fs/aufs/dir.h b/fs/aufs/dir.h new file mode 100644 -index 00000000..ce6b9091 +index 000000000..ff578fc5e --- /dev/null +++ b/fs/aufs/dir.h -@@ -0,0 +1,132 @@ +@@ -0,0 +1,134 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* -+ * Copyright (C) 2005-2018 Junjiro R. Okajima ++ * Copyright (C) 2005-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -10175,6 +10194,7 @@ index 00000000..ce6b9091 +struct au_vdir_dehstr { + struct hlist_node hash; + struct au_vdir_destr *str; ++ struct rcu_head rcu; +} ____cacheline_aligned_in_smp; + +struct au_vdir_de { @@ -10212,7 +10232,8 @@ index 00000000..ce6b9091 + + unsigned long vd_version; + unsigned int vd_deblk_sz; -+ unsigned long vd_jiffy; ++ unsigned long vd_jiffy; ++ struct rcu_head rcu; +} ____cacheline_aligned_in_smp; + +/* ---------------------------------------------------------------------- */ @@ -10263,13 +10284,13 @@ index 00000000..ce6b9091 +#endif /* __AUFS_DIR_H__ */ diff --git a/fs/aufs/dirren.c b/fs/aufs/dirren.c new file mode 100644 -index 00000000..aa97c275 +index 000000000..0c19b9c73 --- /dev/null +++ b/fs/aufs/dirren.c @@ -0,0 +1,1316 @@ +// SPDX-License-Identifier: GPL-2.0 +/* -+ * Copyright (C) 2017-2018 Junjiro R. Okajima ++ * Copyright (C) 2017-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -10387,7 +10408,7 @@ index 00000000..aa97c275 + hbl = dr->dr_h_ino + i; + /* no spinlock since sbinfo must be write-locked */ + hlist_bl_for_each_entry_safe(ent, pos, tmp, hbl, dr_hnode) -+ kfree(ent); ++ au_kfree_rcu(ent); + INIT_HLIST_BL_HEAD(hbl); + } +} @@ -10829,7 +10850,7 @@ index 00000000..aa97c275 + *ret = *drinfo; + ssz = vfsub_read_k(file, (void *)ret->oldname, len, &pos); + if (unlikely(ssz != len)) { -+ kfree(ret); ++ au_kfree_rcu(ret); + ret = ERR_PTR(-EIO); + AuIOErr("ssz %zd, %u, %pD2\n", ssz, len, file); + goto out; @@ -11025,7 +11046,7 @@ index 00000000..aa97c275 + +static void au_drinfo_store_work_fin(struct au_drinfo_store *w) +{ -+ kfree(w->fdata); ++ au_kfree_rcu(w->fdata); +} + +static void au_drinfo_store_rev(struct au_drinfo_rev *rev, @@ -11062,7 +11083,7 @@ index 00000000..aa97c275 + elm->info_last->oldname, + elm->info_last->oldnamelen); + err = au_drinfo_store_sio(w, /*elm*/NULL); -+ kfree(elm->info_last); ++ au_kfree_rcu(elm->info_last); + } + if (unlikely(err)) + AuIOErr("%d, %s\n", err, w->whname); @@ -11138,7 +11159,7 @@ index 00000000..aa97c275 + if (unlikely(err)) { + /* revert all drinfo */ + au_drinfo_store_rev(rev, &work); -+ kfree(rev); ++ au_kfree_try_rcu(rev); + *p = NULL; + } + au_hn_inode_unlock(hdir); @@ -11194,7 +11215,7 @@ index 00000000..aa97c275 + /* revert */ + if (!already) + au_dr_hino_del(dr, ent); -+ kfree(ent); ++ au_kfree_rcu(ent); + +out: + AuTraceErr(err); @@ -11211,9 +11232,9 @@ index 00000000..aa97c275 + elm = rev->elm; + for (nelm = rev->nelm; nelm > 0; nelm--, elm++) { + dput(elm->info_dentry); -+ kfree(elm->info_last); ++ au_kfree_rcu(elm->info_last); + } -+ kfree(rev); ++ au_kfree_try_rcu(rev); +} + +void au_dr_rename_rev(struct dentry *src, aufs_bindex_t btgt, void *_rev) @@ -11245,10 +11266,10 @@ index 00000000..aa97c275 + ent = au_dr_hino_find(dr, h_inode->i_ino); + BUG_ON(!ent); + au_dr_hino_del(dr, ent); -+ kfree(ent); ++ au_kfree_rcu(ent); + +out: -+ kfree(rev); ++ au_kfree_try_rcu(rev); + if (unlikely(err)) + pr_err("failed to remove dirren info\n"); +} @@ -11373,7 +11394,7 @@ index 00000000..aa97c275 + oldname.name = drinfo->oldname; + if (au_qstreq(w->qname, &oldname)) { + /* the name is renamed back */ -+ kfree(drinfo); ++ au_kfree_rcu(drinfo); + drinfo = NULL; + + infopath.dentry = info_dentry; @@ -11388,7 +11409,7 @@ index 00000000..aa97c275 + if (unlikely(e == -EWOULDBLOCK)) + iput(delegated); + } -+ kfree(w->drinfo[bindex]); ++ au_kfree_rcu(w->drinfo[bindex]); + w->drinfo[bindex] = drinfo; + dput(info_dentry); + @@ -11404,8 +11425,8 @@ index 00000000..aa97c275 + struct au_drinfo **p = drinfo; + + while (n-- > 0) -+ kfree(*drinfo++); -+ kfree(p); ++ au_kfree_rcu(*drinfo++); ++ au_kfree_try_rcu(p); +} + +int au_dr_lkup(struct au_do_lookup_args *lkup, struct dentry *dentry, @@ -11458,7 +11479,7 @@ index 00000000..aa97c275 + ent = au_dr_hino_find(&br->br_dirren, h_dir->i_ino); + AuDebugOn(!ent); + au_dr_hino_del(&br->br_dirren, ent); -+ kfree(ent); ++ au_kfree_rcu(ent); + } + goto out; /* success */ + @@ -11489,7 +11510,7 @@ index 00000000..aa97c275 + if (!drinfo) + goto out; + -+ kfree(lkup->whname.name); ++ au_kfree_try_rcu(lkup->whname.name); + lkup->whname.name = NULL; + lkup->dirren.dr_name.len = drinfo->oldnamelen; + lkup->dirren.dr_name.name = drinfo->oldname; @@ -11585,13 +11606,13 @@ index 00000000..aa97c275 +} diff --git a/fs/aufs/dirren.h b/fs/aufs/dirren.h new file mode 100644 -index 00000000..f5139a30 +index 000000000..a98673646 --- /dev/null +++ b/fs/aufs/dirren.h @@ -0,0 +1,140 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* -+ * Copyright (C) 2017-2018 Junjiro R. Okajima ++ * Copyright (C) 2017-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -11731,13 +11752,13 @@ index 00000000..f5139a30 +#endif /* __AUFS_DIRREN_H__ */ diff --git a/fs/aufs/dynop.c b/fs/aufs/dynop.c new file mode 100644 -index 00000000..f2ff9f3a +index 000000000..7c7d8432d --- /dev/null +++ b/fs/aufs/dynop.c @@ -0,0 +1,370 @@ +// SPDX-License-Identifier: GPL-2.0 +/* -+ * Copyright (C) 2010-2018 Junjiro R. Okajima ++ * Copyright (C) 2010-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -11777,8 +11798,8 @@ index 00000000..f2ff9f3a + hlist_bl_lock(hbl); + hlist_bl_for_each_entry(tmp, pos, hbl, dk_hnode) + if (tmp->dk_op.dy_hop == h_op) { -+ key = tmp; -+ kref_get(&key->dk_kref); ++ if (kref_get_unless_zero(&tmp->dk_kref)) ++ key = tmp; + break; + } + hlist_bl_unlock(hbl); @@ -11832,8 +11853,8 @@ index 00000000..f2ff9f3a + hlist_bl_lock(hbl); + hlist_bl_for_each_entry(tmp, pos, hbl, dk_hnode) + if (tmp->dk_op.dy_hop == h_op) { -+ kref_get(&tmp->dk_kref); -+ found = tmp; ++ if (kref_get_unless_zero(&tmp->dk_kref)) ++ found = tmp; + break; + } + if (!found) @@ -11979,7 +12000,7 @@ index 00000000..f2ff9f3a + p->set(key, op->dy_hop, au_br_sb(br)); + old = dy_gadd(hbl, key); + if (old) { -+ kfree(key); ++ au_kfree_rcu(key); + key = old; + } + @@ -12107,13 +12128,13 @@ index 00000000..f2ff9f3a +} diff --git a/fs/aufs/dynop.h b/fs/aufs/dynop.h new file mode 100644 -index 00000000..d4015351 +index 000000000..f3301c2a6 --- /dev/null +++ b/fs/aufs/dynop.h @@ -0,0 +1,75 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* -+ * Copyright (C) 2010-2018 Junjiro R. Okajima ++ * Copyright (C) 2010-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -12188,13 +12209,13 @@ index 00000000..d4015351 +#endif /* __AUFS_DYNOP_H__ */ diff --git a/fs/aufs/export.c b/fs/aufs/export.c new file mode 100644 -index 00000000..0358fbec +index 000000000..1da2ca0a9 --- /dev/null +++ b/fs/aufs/export.c @@ -0,0 +1,838 @@ +// SPDX-License-Identifier: GPL-2.0 +/* -+ * Copyright (C) 2005-2018 Junjiro R. Okajima ++ * Copyright (C) 2005-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -13032,13 +13053,13 @@ index 00000000..0358fbec +} diff --git a/fs/aufs/f_op.c b/fs/aufs/f_op.c new file mode 100644 -index 00000000..0733ae8a +index 000000000..5254b5cd3 --- /dev/null +++ b/fs/aufs/f_op.c @@ -0,0 +1,819 @@ +// SPDX-License-Identifier: GPL-2.0 +/* -+ * Copyright (C) 2005-2018 Junjiro R. Okajima ++ * Copyright (C) 2005-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -13857,13 +13878,13 @@ index 00000000..0733ae8a +}; diff --git a/fs/aufs/fhsm.c b/fs/aufs/fhsm.c new file mode 100644 -index 00000000..79a328e0 +index 000000000..d5fca9596 --- /dev/null +++ b/fs/aufs/fhsm.c @@ -0,0 +1,428 @@ +// SPDX-License-Identifier: GPL-2.0 +/* -+ * Copyright (C) 2011-2018 Junjiro R. Okajima ++ * Copyright (C) 2011-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -14291,13 +14312,13 @@ index 00000000..79a328e0 +} diff --git a/fs/aufs/file.c b/fs/aufs/file.c new file mode 100644 -index 00000000..c01b9879 +index 000000000..dbb33855d --- /dev/null +++ b/fs/aufs/file.c @@ -0,0 +1,863 @@ +// SPDX-License-Identifier: GPL-2.0 +/* -+ * Copyright (C) 2005-2018 Junjiro R. Okajima ++ * Copyright (C) 2005-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -15160,13 +15181,13 @@ index 00000000..c01b9879 +}; diff --git a/fs/aufs/file.h b/fs/aufs/file.h new file mode 100644 -index 00000000..b6a10058 +index 000000000..4ee95dde0 --- /dev/null +++ b/fs/aufs/file.h -@@ -0,0 +1,341 @@ +@@ -0,0 +1,342 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* -+ * Copyright (C) 2005-2018 Junjiro R. Okajima ++ * Copyright (C) 2005-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -15232,6 +15253,7 @@ index 00000000..b6a10058 + + struct hlist_bl_node fi_hlist; + struct file *fi_file; /* very ugly */ ++ struct rcu_head rcu; +} ____cacheline_aligned_in_smp; + +/* ---------------------------------------------------------------------- */ @@ -15507,13 +15529,13 @@ index 00000000..b6a10058 +#endif /* __AUFS_FILE_H__ */ diff --git a/fs/aufs/finfo.c b/fs/aufs/finfo.c new file mode 100644 -index 00000000..44636ce6 +index 000000000..448c5e9cd --- /dev/null +++ b/fs/aufs/finfo.c @@ -0,0 +1,149 @@ +// SPDX-License-Identifier: GPL-2.0 +/* -+ * Copyright (C) 2005-2018 Junjiro R. Okajima ++ * Copyright (C) 2005-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -15662,13 +15684,13 @@ index 00000000..44636ce6 +} diff --git a/fs/aufs/fstype.h b/fs/aufs/fstype.h new file mode 100644 -index 00000000..5c9d5c83 +index 000000000..88cfefac7 --- /dev/null +++ b/fs/aufs/fstype.h @@ -0,0 +1,401 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* -+ * Copyright (C) 2005-2018 Junjiro R. Okajima ++ * Copyright (C) 2005-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -16069,13 +16091,13 @@ index 00000000..5c9d5c83 +#endif /* __AUFS_FSTYPE_H__ */ diff --git a/fs/aufs/hbl.h b/fs/aufs/hbl.h new file mode 100644 -index 00000000..265d7ab6 +index 000000000..6db65b16b --- /dev/null +++ b/fs/aufs/hbl.h @@ -0,0 +1,65 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* -+ * Copyright (C) 2017-2018 Junjiro R. Okajima ++ * Copyright (C) 2017-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -16140,13 +16162,13 @@ index 00000000..265d7ab6 +#endif /* __AUFS_HBL_H__ */ diff --git a/fs/aufs/hfsnotify.c b/fs/aufs/hfsnotify.c new file mode 100644 -index 00000000..a0db252a +index 000000000..e92d73141 --- /dev/null +++ b/fs/aufs/hfsnotify.c @@ -0,0 +1,290 @@ +// SPDX-License-Identifier: GPL-2.0 +/* -+ * Copyright (C) 2005-2018 Junjiro R. Okajima ++ * Copyright (C) 2005-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -16303,7 +16325,7 @@ index 00000000..a0db252a + struct au_br_hfsnotify *hfsn = group->private; + + /* AuDbg("here\n"); */ -+ kfree(hfsn); ++ au_kfree_try_rcu(hfsn); +} + +static int au_hfsn_handle_event(struct fsnotify_group *group, @@ -16399,7 +16421,7 @@ index 00000000..a0db252a + goto out; /* success */ + +out_hfsn: -+ kfree(hfsn); ++ au_kfree_try_rcu(hfsn); +out: + return err; +} @@ -16436,13 +16458,13 @@ index 00000000..a0db252a +}; diff --git a/fs/aufs/hfsplus.c b/fs/aufs/hfsplus.c new file mode 100644 -index 00000000..b1f59970 +index 000000000..3bd869a69 --- /dev/null +++ b/fs/aufs/hfsplus.c @@ -0,0 +1,60 @@ +// SPDX-License-Identifier: GPL-2.0 +/* -+ * Copyright (C) 2010-2018 Junjiro R. Okajima ++ * Copyright (C) 2010-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -16502,13 +16524,13 @@ index 00000000..b1f59970 +} diff --git a/fs/aufs/hnotify.c b/fs/aufs/hnotify.c new file mode 100644 -index 00000000..187a9750 +index 000000000..af35561f3 --- /dev/null +++ b/fs/aufs/hnotify.c @@ -0,0 +1,720 @@ +// SPDX-License-Identifier: GPL-2.0 +/* -+ * Copyright (C) 2005-2018 Junjiro R. Okajima ++ * Copyright (C) 2005-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -17049,7 +17071,7 @@ index 00000000..187a9750 + iput(a->dir); + si_write_unlock(sb); + au_nwt_done(&sbinfo->si_nowait); -+ kfree(a); ++ au_kfree_rcu(a); +} + +/* ---------------------------------------------------------------------- */ @@ -17155,7 +17177,7 @@ index 00000000..187a9750 + iput(args->h_child_inode); + iput(args->h_dir); + iput(args->dir); -+ kfree(args); ++ au_kfree_rcu(args); + } + +out: @@ -17228,13 +17250,13 @@ index 00000000..187a9750 +} diff --git a/fs/aufs/i_op.c b/fs/aufs/i_op.c new file mode 100644 -index 00000000..5a8131db +index 000000000..14cbe48ee --- /dev/null +++ b/fs/aufs/i_op.c @@ -0,0 +1,1508 @@ +// SPDX-License-Identifier: GPL-2.0 +/* -+ * Copyright (C) 2005-2018 Junjiro R. Okajima ++ * Copyright (C) 2005-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -18293,7 +18315,7 @@ index 00000000..5a8131db +out_si: + si_read_unlock(sb); +out_kfree: -+ kfree(a); ++ au_kfree_rcu(a); +out: + AuTraceErr(err); + return err; @@ -18384,7 +18406,7 @@ index 00000000..5a8131db + di_write_unlock(dentry); + si_read_unlock(sb); +out_kfree: -+ kfree(a); ++ au_kfree_rcu(a); +out: + AuTraceErr(err); + return err; @@ -18742,13 +18764,13 @@ index 00000000..5a8131db +}; diff --git a/fs/aufs/i_op_add.c b/fs/aufs/i_op_add.c new file mode 100644 -index 00000000..9ad5d523 +index 000000000..f8c0724c8 --- /dev/null +++ b/fs/aufs/i_op_add.c @@ -0,0 +1,934 @@ +// SPDX-License-Identifier: GPL-2.0 +/* -+ * Copyright (C) 2005-2018 Junjiro R. Okajima ++ * Copyright (C) 2005-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -19107,7 +19129,7 @@ index 00000000..9ad5d523 + if (!try_aopen) + aufs_read_unlock(dentry, AuLock_DW); +out_free: -+ kfree(a); ++ au_kfree_rcu(a); +out: + return err; +} @@ -19567,7 +19589,7 @@ index 00000000..9ad5d523 + } + aufs_read_and_write_unlock2(dentry, src_dentry); +out_kfree: -+ kfree(a); ++ au_kfree_rcu(a); +out: + AuTraceErr(err); + return err; @@ -19676,19 +19698,19 @@ index 00000000..9ad5d523 + } + aufs_read_unlock(dentry, AuLock_DW); +out_free: -+ kfree(a); ++ au_kfree_rcu(a); +out: + return err; +} diff --git a/fs/aufs/i_op_del.c b/fs/aufs/i_op_del.c new file mode 100644 -index 00000000..af85e999 +index 000000000..f4e2ef352 --- /dev/null +++ b/fs/aufs/i_op_del.c @@ -0,0 +1,512 @@ +// SPDX-License-Identifier: GPL-2.0 +/* -+ * Copyright (C) 2005-2018 Junjiro R. Okajima ++ * Copyright (C) 2005-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -20083,7 +20105,7 @@ index 00000000..af85e999 +out_unlock: + aufs_read_unlock(dentry, AuLock_DW); +out_free: -+ kfree(a); ++ au_kfree_rcu(a); +out: + return err; +} @@ -20193,20 +20215,20 @@ index 00000000..af85e999 +out_unlock: + aufs_read_unlock(dentry, AuLock_DW); +out_free: -+ kfree(a); ++ au_kfree_rcu(a); +out: + AuTraceErr(err); + return err; +} diff --git a/fs/aufs/i_op_ren.c b/fs/aufs/i_op_ren.c new file mode 100644 -index 00000000..5d9baeb7 +index 000000000..8524b0852 --- /dev/null +++ b/fs/aufs/i_op_ren.c @@ -0,0 +1,1249 @@ +// SPDX-License-Identifier: GPL-2.0 +/* -+ * Copyright (C) 2005-2018 Junjiro R. Okajima ++ * Copyright (C) 2005-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -21448,20 +21470,20 @@ index 00000000..5d9baeb7 + iput(a->dst_inode); + if (a->thargs) + au_whtmp_rmdir_free(a->thargs); -+ kfree(a); ++ au_kfree_rcu(a); +out: + AuTraceErr(err); + return err; +} diff --git a/fs/aufs/iinfo.c b/fs/aufs/iinfo.c new file mode 100644 -index 00000000..f6c512d9 +index 000000000..098fd1150 --- /dev/null +++ b/fs/aufs/iinfo.c @@ -0,0 +1,286 @@ +// SPDX-License-Identifier: GPL-2.0 +/* -+ * Copyright (C) 2005-2018 Junjiro R. Okajima ++ * Copyright (C) 2005-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -21742,18 +21764,18 @@ index 00000000..f6c512d9 + hi++; + } + } -+ kfree(iinfo->ii_hinode); ++ au_kfree_rcu(iinfo->ii_hinode); + AuRwDestroy(&iinfo->ii_rwsem); +} diff --git a/fs/aufs/inode.c b/fs/aufs/inode.c new file mode 100644 -index 00000000..af1092b7 +index 000000000..2db13c0aa --- /dev/null +++ b/fs/aufs/inode.c @@ -0,0 +1,528 @@ +// SPDX-License-Identifier: GPL-2.0 +/* -+ * Copyright (C) 2005-2018 Junjiro R. Okajima ++ * Copyright (C) 2005-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -22281,13 +22303,13 @@ index 00000000..af1092b7 +} diff --git a/fs/aufs/inode.h b/fs/aufs/inode.h new file mode 100644 -index 00000000..340d4908 +index 000000000..741b5b835 --- /dev/null +++ b/fs/aufs/inode.h -@@ -0,0 +1,696 @@ +@@ -0,0 +1,698 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* -+ * Copyright (C) 2005-2018 Junjiro R. Okajima ++ * Copyright (C) 2005-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -22324,6 +22346,7 @@ index 00000000..340d4908 + struct fsnotify_mark hn_mark; +#endif + struct inode *hn_aufs_inode; /* no get/put */ ++ struct rcu_head rcu; +#endif +} ____cacheline_aligned_in_smp; + @@ -22364,9 +22387,10 @@ index 00000000..340d4908 +}; + +struct au_icntnr { -+ struct au_iinfo iinfo; -+ struct inode vfs_inode; -+ struct hlist_bl_node plink; ++ struct au_iinfo iinfo; ++ struct inode vfs_inode; ++ struct hlist_bl_node plink; ++ struct rcu_head rcu; +} ____cacheline_aligned_in_smp; + +/* au_pin flags */ @@ -22983,13 +23007,13 @@ index 00000000..340d4908 +#endif /* __AUFS_INODE_H__ */ diff --git a/fs/aufs/ioctl.c b/fs/aufs/ioctl.c new file mode 100644 -index 00000000..279bd749 +index 000000000..fb2fb7582 --- /dev/null +++ b/fs/aufs/ioctl.c @@ -0,0 +1,220 @@ +// SPDX-License-Identifier: GPL-2.0 +/* -+ * Copyright (C) 2005-2018 Junjiro R. Okajima ++ * Copyright (C) 2005-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -23209,13 +23233,13 @@ index 00000000..279bd749 +#endif diff --git a/fs/aufs/lcnt.h b/fs/aufs/lcnt.h new file mode 100644 -index 00000000..5e089c93 +index 000000000..d8508f875 --- /dev/null +++ b/fs/aufs/lcnt.h @@ -0,0 +1,186 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* -+ * Copyright (C) 2018 Junjiro R. Okajima ++ * Copyright (C) 2018-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -23401,13 +23425,13 @@ index 00000000..5e089c93 +#endif /* __AUFS_LCNT_H__ */ diff --git a/fs/aufs/loop.c b/fs/aufs/loop.c new file mode 100644 -index 00000000..0c6af623 +index 000000000..cef7d9636 --- /dev/null +++ b/fs/aufs/loop.c @@ -0,0 +1,148 @@ +// SPDX-License-Identifier: GPL-2.0 +/* -+ * Copyright (C) 2005-2018 Junjiro R. Okajima ++ * Copyright (C) 2005-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -23551,17 +23575,17 @@ index 00000000..0c6af623 +{ + if (backing_file_func) + symbol_put(loop_backing_file); -+ kfree(au_warn_loopback_array); ++ au_kfree_try_rcu(au_warn_loopback_array); +} diff --git a/fs/aufs/loop.h b/fs/aufs/loop.h new file mode 100644 -index 00000000..048a6504 +index 000000000..7fc394e72 --- /dev/null +++ b/fs/aufs/loop.h -@@ -0,0 +1,53 @@ +@@ -0,0 +1,55 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* -+ * Copyright (C) 2005-2018 Junjiro R. Okajima ++ * Copyright (C) 2005-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -23601,6 +23625,8 @@ index 00000000..048a6504 +int au_loopback_init(void); +void au_loopback_fin(void); +#else ++AuStub(struct file *, loop_backing_file, return NULL, struct super_block *sb) ++ +AuStubInt0(au_test_loopback_overlap, struct super_block *sb, + struct dentry *h_adding) +AuStubInt0(au_test_loopback_kthread, void) @@ -23614,7 +23640,7 @@ index 00000000..048a6504 +#endif /* __AUFS_LOOP_H__ */ diff --git a/fs/aufs/magic.mk b/fs/aufs/magic.mk new file mode 100644 -index 00000000..7bc9eef3 +index 000000000..7bc9eef3f --- /dev/null +++ b/fs/aufs/magic.mk @@ -0,0 +1,31 @@ @@ -23651,13 +23677,13 @@ index 00000000..7bc9eef3 +endif diff --git a/fs/aufs/module.c b/fs/aufs/module.c new file mode 100644 -index 00000000..5f5f67e6 +index 000000000..295736adf --- /dev/null +++ b/fs/aufs/module.c @@ -0,0 +1,273 @@ +// SPDX-License-Identifier: GPL-2.0 +/* -+ * Copyright (C) 2005-2018 Junjiro R. Okajima ++ * Copyright (C) 2005-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -23692,7 +23718,7 @@ index 00000000..5f5f67e6 + if (p) { +#if 0 /* unused */ + if (!new_sz) { -+ kfree(p); ++ au_kfree_rcu(p); + p = NULL; + goto out; + } @@ -23716,7 +23742,7 @@ index 00000000..5f5f67e6 + if (q) { + if (p) { + memcpy(q, p, new_sz); -+ kfree(p); ++ au_kfree_try_rcu(p); + } + p = q; + } else @@ -23930,13 +23956,13 @@ index 00000000..5f5f67e6 +module_exit(aufs_exit); diff --git a/fs/aufs/module.h b/fs/aufs/module.h new file mode 100644 -index 00000000..00076104 +index 000000000..3036754b9 --- /dev/null +++ b/fs/aufs/module.h -@@ -0,0 +1,102 @@ +@@ -0,0 +1,166 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* -+ * Copyright (C) 2005-2018 Junjiro R. Okajima ++ * Copyright (C) 2005-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -23962,6 +23988,11 @@ index 00000000..00076104 +#ifdef __KERNEL__ + +#include ++#include "debug.h" ++#include "dentry.h" ++#include "dir.h" ++#include "file.h" ++#include "inode.h" + +struct path; +struct seq_file; @@ -23978,6 +24009,53 @@ index 00000000..00076104 +void *au_kzrealloc(void *p, unsigned int nused, unsigned int new_sz, gfp_t gfp, + int may_shrink); + ++/* ++ * Comparing the size of the object with sizeof(struct rcu_head) ++ * case 1: object is always larger ++ * --> au_kfree_rcu() or au_kfree_do_rcu() ++ * case 2: object is always smaller ++ * --> au_kfree_small() ++ * case 3: object can be any size ++ * --> au_kfree_try_rcu() ++ */ ++ ++static inline void au_kfree_do_rcu(const void *p) ++{ ++ struct { ++ struct rcu_head rcu; ++ } *a = (void *)p; ++ ++ kfree_rcu(a, rcu); ++} ++ ++#define au_kfree_rcu(_p) do { \ ++ typeof(_p) p = (_p); \ ++ BUILD_BUG_ON(sizeof(*p) < sizeof(struct rcu_head)); \ ++ if (p) \ ++ au_kfree_do_rcu(p); \ ++ } while (0) ++ ++#define au_kfree_do_sz_test(sz) (sz >= sizeof(struct rcu_head)) ++#define au_kfree_sz_test(p) (p && au_kfree_do_sz_test(ksize(p))) ++ ++static inline void au_kfree_try_rcu(const void *p) ++{ ++ if (!p) ++ return; ++ if (au_kfree_sz_test(p)) ++ au_kfree_do_rcu(p); ++ else ++ kfree(p); ++} ++ ++static inline void au_kfree_small(const void *p) ++{ ++ if (!p) ++ return; ++ AuDebugOn(au_kfree_sz_test(p)); ++ kfree(p); ++} ++ +static inline int au_kmidx_sub(size_t sz, size_t new_sz) +{ +#ifndef CONFIG_SLOB @@ -24019,11 +24097,23 @@ index 00000000..00076104 + kmem_cache_create(#type, sizeof(struct type), \ + __alignof__(struct type), AuCacheFlags, ctor) + -+#define AuCacheFuncs(name, index) \ -+static inline struct au_##name *au_cache_alloc_##name(void) \ -+{ return kmem_cache_alloc(au_cache[AuCache_##index], GFP_NOFS); } \ -+static inline void au_cache_free_##name(struct au_##name *p) \ -+{ kmem_cache_free(au_cache[AuCache_##index], p); } ++#define AuCacheFuncs(name, index) \ ++ static inline struct au_##name *au_cache_alloc_##name(void) \ ++ { return kmem_cache_alloc(au_cache[AuCache_##index], GFP_NOFS); } \ ++ static inline void au_cache_free_##name##_norcu(struct au_##name *p) \ ++ { kmem_cache_free(au_cache[AuCache_##index], p); } \ ++ \ ++ static inline void au_cache_free_##name##_rcu_cb(struct rcu_head *rcu) \ ++ { void *p = rcu; \ ++ p -= offsetof(struct au_##name, rcu); \ ++ kmem_cache_free(au_cache[AuCache_##index], p); } \ ++ static inline void au_cache_free_##name##_rcu(struct au_##name *p) \ ++ { BUILD_BUG_ON(sizeof(struct au_##name) < sizeof(struct rcu_head)); \ ++ call_rcu(&p->rcu, au_cache_free_##name##_rcu_cb); } \ ++ \ ++ static inline void au_cache_free_##name(struct au_##name *p) \ ++ { /* au_cache_free_##name##_norcu(p); */ \ ++ au_cache_free_##name##_rcu(p); } + +AuCacheFuncs(dinfo, DINFO); +AuCacheFuncs(icntnr, ICNTNR); @@ -24038,13 +24128,13 @@ index 00000000..00076104 +#endif /* __AUFS_MODULE_H__ */ diff --git a/fs/aufs/mvdown.c b/fs/aufs/mvdown.c new file mode 100644 -index 00000000..9603ef73 +index 000000000..59ce2d700 --- /dev/null +++ b/fs/aufs/mvdown.c @@ -0,0 +1,705 @@ +// SPDX-License-Identifier: GPL-2.0 +/* -+ * Copyright (C) 2011-2018 Junjiro R. Okajima ++ * Copyright (C) 2011-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -24742,20 +24832,20 @@ index 00000000..9603ef73 + e = copy_to_user(uarg, &args->mvdown, sizeof(args->mvdown)); + if (unlikely(e)) + err = -EFAULT; -+ kfree(args); ++ au_kfree_rcu(args); +out: + AuTraceErr(err); + return err; +} diff --git a/fs/aufs/opts.c b/fs/aufs/opts.c new file mode 100644 -index 00000000..341f2a56 +index 000000000..1663e7901 --- /dev/null +++ b/fs/aufs/opts.c -@@ -0,0 +1,1877 @@ +@@ -0,0 +1,1880 @@ +// SPDX-License-Identifier: GPL-2.0 +/* -+ * Copyright (C) 2005-2018 Junjiro R. Okajima ++ * Copyright (C) 2005-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -25673,7 +25763,7 @@ index 00000000..341f2a56 + int err; + struct file *file; + -+ file = au_xino_create(sb, args[0].from, /*silent*/0); ++ file = au_xino_create(sb, args[0].from, /*silent*/0, /*wbrtop*/0); + err = PTR_ERR(file); + if (IS_ERR(file)) + goto out; @@ -26015,7 +26105,7 @@ index 00000000..341f2a56 + } + } + -+ kfree(a); ++ au_kfree_rcu(a); + dump_opts(opts); + if (unlikely(err)) + au_opts_free(opts); @@ -26141,6 +26231,7 @@ index 00000000..341f2a56 + case Opt_wsum: + au_opt_clr(sbinfo->si_mntflags, SUM); + au_opt_set(sbinfo->si_mntflags, SUM_W); ++ break; + case Opt_nosum: + au_opt_clr(sbinfo->si_mntflags, SUM); + au_opt_clr(sbinfo->si_mntflags, SUM_W); @@ -26266,8 +26357,10 @@ index 00000000..341f2a56 + if (opt->add.bindex < 0) + opt->add.bindex = 0; + goto add; ++ /* Always goto add, not fallthrough */ + case Opt_prepend: + opt->add.bindex = 0; ++ /* fallthrough */ + add: /* indented label */ + case Opt_add: + err = au_br_add(sb, &opt->add, @@ -26445,7 +26538,7 @@ index 00000000..341f2a56 + au_hn_inode_unlock(hdir); + + if (!err && do_free) { -+ kfree(wbr); ++ au_kfree_rcu(wbr); + br->br_wbr = NULL; + } + } @@ -26632,13 +26725,13 @@ index 00000000..341f2a56 +} diff --git a/fs/aufs/opts.h b/fs/aufs/opts.h new file mode 100644 -index 00000000..fd167bd0 +index 000000000..6326b5434 --- /dev/null +++ b/fs/aufs/opts.h @@ -0,0 +1,225 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* -+ * Copyright (C) 2005-2018 Junjiro R. Okajima ++ * Copyright (C) 2005-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -26684,7 +26777,7 @@ index 00000000..fd167bd0 +#define AuOpt_SUM (1 << 10) /* summation for statfs(2) */ +#define AuOpt_SUM_W (1 << 11) /* unimplemented */ +#define AuOpt_WARN_PERM (1 << 12) /* warn when add-branch */ -+#define AuOpt_VERBOSE (1 << 13) /* busy inode when del-branch */ ++#define AuOpt_VERBOSE (1 << 13) /* print the cause of error */ +#define AuOpt_DIO (1 << 14) /* direct io */ +#define AuOpt_DIRREN (1 << 15) /* directory rename */ + @@ -26863,13 +26956,13 @@ index 00000000..fd167bd0 +#endif /* __AUFS_OPTS_H__ */ diff --git a/fs/aufs/plink.c b/fs/aufs/plink.c new file mode 100644 -index 00000000..ef51ffa6 +index 000000000..8a3bf96b6 --- /dev/null +++ b/fs/aufs/plink.c @@ -0,0 +1,516 @@ +// SPDX-License-Identifier: GPL-2.0 +/* -+ * Copyright (C) 2005-2018 Junjiro R. Okajima ++ * Copyright (C) 2005-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -27385,13 +27478,13 @@ index 00000000..ef51ffa6 +} diff --git a/fs/aufs/poll.c b/fs/aufs/poll.c new file mode 100644 -index 00000000..82c859ce +index 000000000..d25202722 --- /dev/null +++ b/fs/aufs/poll.c @@ -0,0 +1,54 @@ +// SPDX-License-Identifier: GPL-2.0 +/* -+ * Copyright (C) 2005-2018 Junjiro R. Okajima ++ * Copyright (C) 2005-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -27445,13 +27538,13 @@ index 00000000..82c859ce +} diff --git a/fs/aufs/posix_acl.c b/fs/aufs/posix_acl.c new file mode 100644 -index 00000000..b851a3bb +index 000000000..64c504002 --- /dev/null +++ b/fs/aufs/posix_acl.c @@ -0,0 +1,103 @@ +// SPDX-License-Identifier: GPL-2.0 +/* -+ * Copyright (C) 2014-2018 Junjiro R. Okajima ++ * Copyright (C) 2014-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -27554,13 +27647,13 @@ index 00000000..b851a3bb +} diff --git a/fs/aufs/procfs.c b/fs/aufs/procfs.c new file mode 100644 -index 00000000..100dbcfe +index 000000000..582dd486f --- /dev/null +++ b/fs/aufs/procfs.c @@ -0,0 +1,171 @@ +// SPDX-License-Identifier: GPL-2.0 +/* -+ * Copyright (C) 2010-2018 Junjiro R. Okajima ++ * Copyright (C) 2010-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -27621,8 +27714,8 @@ index 00000000..100dbcfe + hlist_bl_lock(&au_sbilist); + hlist_bl_for_each_entry(sbinfo, pos, &au_sbilist, si_list) + if (id == sysaufs_si_id(sbinfo)) { -+ kobject_get(&sbinfo->si_kobj); -+ sb = sbinfo->si_sb; ++ if (kobject_get_unless_zero(&sbinfo->si_kobj)) ++ sb = sbinfo->si_sb; + break; + } + hlist_bl_unlock(&au_sbilist); @@ -27731,13 +27824,13 @@ index 00000000..100dbcfe +} diff --git a/fs/aufs/rdu.c b/fs/aufs/rdu.c new file mode 100644 -index 00000000..60f4957b +index 000000000..bf0233a28 --- /dev/null +++ b/fs/aufs/rdu.c @@ -0,0 +1,382 @@ +// SPDX-License-Identifier: GPL-2.0 +/* -+ * Copyright (C) 2005-2018 Junjiro R. Okajima ++ * Copyright (C) 2005-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -28119,13 +28212,13 @@ index 00000000..60f4957b +#endif diff --git a/fs/aufs/rwsem.h b/fs/aufs/rwsem.h new file mode 100644 -index 00000000..bcb538ee +index 000000000..2f8988fa1 --- /dev/null +++ b/fs/aufs/rwsem.h @@ -0,0 +1,73 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* -+ * Copyright (C) 2005-2018 Junjiro R. Okajima ++ * Copyright (C) 2005-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -28198,13 +28291,13 @@ index 00000000..bcb538ee +#endif /* __AUFS_RWSEM_H__ */ diff --git a/fs/aufs/sbinfo.c b/fs/aufs/sbinfo.c new file mode 100644 -index 00000000..1a65676e +index 000000000..7318df0fe --- /dev/null +++ b/fs/aufs/sbinfo.c @@ -0,0 +1,313 @@ +// SPDX-License-Identifier: GPL-2.0 +/* -+ * Copyright (C) 2005-2018 Junjiro R. Okajima ++ * Copyright (C) 2005-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -28250,13 +28343,13 @@ index 00000000..1a65676e + au_br_free(sbinfo); + au_rw_write_unlock(&sbinfo->si_rwsem); + -+ kfree(sbinfo->si_branch); ++ au_kfree_try_rcu(sbinfo->si_branch); + mutex_destroy(&sbinfo->si_xib_mtx); + AuRwDestroy(&sbinfo->si_rwsem); + + au_lcnt_wait_for_fin(&sbinfo->si_ninodes); + /* si_nfiles is waited too */ -+ kfree(sbinfo); ++ au_kfree_rcu(sbinfo); +} + +int au_si_alloc(struct super_block *sb) @@ -28332,9 +28425,9 @@ index 00000000..1a65676e + return 0; /* success */ + +out_br: -+ kfree(sbinfo->si_branch); ++ au_kfree_try_rcu(sbinfo->si_branch); +out_sbinfo: -+ kfree(sbinfo); ++ au_kfree_rcu(sbinfo); +out: + return err; +} @@ -28517,13 +28610,13 @@ index 00000000..1a65676e +} diff --git a/fs/aufs/super.c b/fs/aufs/super.c new file mode 100644 -index 00000000..e3ea1f35 +index 000000000..25d8b27ec --- /dev/null +++ b/fs/aufs/super.c @@ -0,0 +1,1043 @@ +// SPDX-License-Identifier: GPL-2.0 +/* -+ * Copyright (C) 2005-2018 Junjiro R. Okajima ++ * Copyright (C) 2005-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -29566,13 +29659,13 @@ index 00000000..e3ea1f35 +}; diff --git a/fs/aufs/super.h b/fs/aufs/super.h new file mode 100644 -index 00000000..79e47da4 +index 000000000..74571acf3 --- /dev/null +++ b/fs/aufs/super.h @@ -0,0 +1,589 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* -+ * Copyright (C) 2005-2018 Junjiro R. Okajima ++ * Copyright (C) 2005-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -30161,13 +30254,13 @@ index 00000000..79e47da4 +#endif /* __AUFS_SUPER_H__ */ diff --git a/fs/aufs/sysaufs.c b/fs/aufs/sysaufs.c new file mode 100644 -index 00000000..cb34a53f +index 000000000..32a0811c5 --- /dev/null +++ b/fs/aufs/sysaufs.c @@ -0,0 +1,93 @@ +// SPDX-License-Identifier: GPL-2.0 +/* -+ * Copyright (C) 2005-2018 Junjiro R. Okajima ++ * Copyright (C) 2005-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -30260,13 +30353,13 @@ index 00000000..cb34a53f +} diff --git a/fs/aufs/sysaufs.h b/fs/aufs/sysaufs.h new file mode 100644 -index 00000000..9a64191c +index 000000000..195fe279b --- /dev/null +++ b/fs/aufs/sysaufs.h @@ -0,0 +1,102 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* -+ * Copyright (C) 2005-2018 Junjiro R. Okajima ++ * Copyright (C) 2005-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -30368,13 +30461,13 @@ index 00000000..9a64191c +#endif /* __SYSAUFS_H__ */ diff --git a/fs/aufs/sysfs.c b/fs/aufs/sysfs.c new file mode 100644 -index 00000000..89a4cbf6 +index 000000000..927f6b252 --- /dev/null +++ b/fs/aufs/sysfs.c @@ -0,0 +1,373 @@ +// SPDX-License-Identifier: GPL-2.0 +/* -+ * Copyright (C) 2005-2018 Junjiro R. Okajima ++ * Copyright (C) 2005-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -30584,7 +30677,7 @@ index 00000000..89a4cbf6 + if (unlikely(err == PAGE_SIZE)) + err = -EFBIG; + } -+ kfree(seq); ++ au_kfree_rcu(seq); +out_unlock: + si_read_unlock(sb); +out: @@ -30655,7 +30748,7 @@ index 00000000..89a4cbf6 + err = -EFAULT; + +out_seq: -+ kfree(seq); ++ au_kfree_rcu(seq); +out_buf: + free_page((unsigned long)buf); +out: @@ -30747,13 +30840,13 @@ index 00000000..89a4cbf6 +} diff --git a/fs/aufs/sysrq.c b/fs/aufs/sysrq.c new file mode 100644 -index 00000000..2dbf2374 +index 000000000..db10ec528 --- /dev/null +++ b/fs/aufs/sysrq.c @@ -0,0 +1,160 @@ +// SPDX-License-Identifier: GPL-2.0 +/* -+ * Copyright (C) 2005-2018 Junjiro R. Okajima ++ * Copyright (C) 2005-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -30913,13 +31006,13 @@ index 00000000..2dbf2374 +} diff --git a/fs/aufs/vdir.c b/fs/aufs/vdir.c new file mode 100644 -index 00000000..8606ed77 +index 000000000..13ec60bb4 --- /dev/null +++ b/fs/aufs/vdir.c @@ -0,0 +1,895 @@ +// SPDX-License-Identifier: GPL-2.0 +/* -+ * Copyright (C) 2005-2018 Junjiro R. Okajima ++ * Copyright (C) 2005-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -31030,7 +31123,7 @@ index 00000000..8606ed77 + struct hlist_node *node; + + hlist_for_each_entry_safe(pos, node, head, wh_hash) -+ kfree(pos); ++ au_kfree_rcu(pos); +} + +static void au_nhash_de_do_free(struct hlist_head *head) @@ -31057,7 +31150,7 @@ index 00000000..8606ed77 + nhash_count(head); + free(head++); + } -+ kfree(nhash->nh_head); ++ au_kfree_try_rcu(nhash->nh_head); +} + +void au_nhash_wh_free(struct au_nhash *whlist) @@ -31276,8 +31369,8 @@ index 00000000..8606ed77 + + deblk = vdir->vd_deblk; + while (vdir->vd_nblk--) -+ kfree(*deblk++); -+ kfree(vdir->vd_deblk); ++ au_kfree_try_rcu(*deblk++); ++ au_kfree_try_rcu(vdir->vd_deblk); + au_cache_free_vdir(vdir); +} + @@ -31312,7 +31405,7 @@ index 00000000..8606ed77 + if (!err) + return vdir; /* success */ + -+ kfree(vdir->vd_deblk); ++ au_kfree_try_rcu(vdir->vd_deblk); + +out_free: + au_cache_free_vdir(vdir); @@ -31327,7 +31420,7 @@ index 00000000..8606ed77 + union au_vdir_deblk_p p, deblk_end; + + while (vdir->vd_nblk > 1) { -+ kfree(vdir->vd_deblk[vdir->vd_nblk - 1]); ++ au_kfree_try_rcu(vdir->vd_deblk[vdir->vd_nblk - 1]); + /* vdir->vd_deblk[vdir->vd_nblk - 1] = NULL; */ + vdir->vd_nblk--; + } @@ -31814,13 +31907,13 @@ index 00000000..8606ed77 +} diff --git a/fs/aufs/vfsub.c b/fs/aufs/vfsub.c new file mode 100644 -index 00000000..9386eb48 +index 000000000..a9074da42 --- /dev/null +++ b/fs/aufs/vfsub.c @@ -0,0 +1,903 @@ +// SPDX-License-Identifier: GPL-2.0 +/* -+ * Copyright (C) 2005-2018 Junjiro R. Okajima ++ * Copyright (C) 2005-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -32723,13 +32816,13 @@ index 00000000..9386eb48 +} diff --git a/fs/aufs/vfsub.h b/fs/aufs/vfsub.h new file mode 100644 -index 00000000..7f36a164 +index 000000000..2953aa410 --- /dev/null +++ b/fs/aufs/vfsub.h @@ -0,0 +1,362 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* -+ * Copyright (C) 2005-2018 Junjiro R. Okajima ++ * Copyright (C) 2005-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -33091,13 +33184,13 @@ index 00000000..7f36a164 +#endif /* __AUFS_VFSUB_H__ */ diff --git a/fs/aufs/wbr_policy.c b/fs/aufs/wbr_policy.c new file mode 100644 -index 00000000..6e97c806 +index 000000000..64954145c --- /dev/null +++ b/fs/aufs/wbr_policy.c @@ -0,0 +1,830 @@ +// SPDX-License-Identifier: GPL-2.0 +/* -+ * Copyright (C) 2005-2018 Junjiro R. Okajima ++ * Copyright (C) 2005-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -33558,7 +33651,7 @@ index 00000000..6e97c806 + + mfs->mfsrr_bytes = bavail; + AuDbg("b%d\n", mfs->mfs_bindex); -+ kfree(st); ++ au_kfree_rcu(st); +} + +static int au_wbr_create_mfs(struct dentry *dentry, unsigned int flags) @@ -33927,13 +34020,13 @@ index 00000000..6e97c806 +}; diff --git a/fs/aufs/whout.c b/fs/aufs/whout.c new file mode 100644 -index 00000000..2325c2ee +index 000000000..6c9c85015 --- /dev/null +++ b/fs/aufs/whout.c @@ -0,0 +1,1062 @@ +// SPDX-License-Identifier: GPL-2.0 +/* -+ * Copyright (C) 2005-2018 Junjiro R. Okajima ++ * Copyright (C) 2005-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -34096,7 +34189,7 @@ index 00000000..2325c2ee + +out_name: + if (name != defname) -+ kfree(name); ++ au_kfree_try_rcu(name); +out: + AuTraceErrPtr(dentry); + return dentry; @@ -34536,7 +34629,7 @@ index 00000000..2325c2ee + au_lcnt_dec(&a->br->br_count); + si_write_unlock(a->sb); + au_nwt_done(&au_sbi(a->sb)->si_nowait); -+ kfree(arg); ++ au_kfree_rcu(a); + if (unlikely(err)) + AuIOErr("err %d\n", err); +} @@ -34564,7 +34657,7 @@ index 00000000..2325c2ee + if (unlikely(wkq_err)) { + atomic_dec(&br->br_wbr->wbr_wh_running); + au_lcnt_dec(&br->br_count); -+ kfree(arg); ++ au_kfree_rcu(arg); + } + do_dec = 0; + } @@ -34723,7 +34816,7 @@ index 00000000..2325c2ee + wh_dentry = ERR_PTR(err); + if (!err) { + wh_dentry = vfsub_lkup_one(&wh_name, h_parent); -+ kfree(wh_name.name); ++ au_kfree_try_rcu(wh_name.name); + } + return wh_dentry; +} @@ -34841,7 +34934,7 @@ index 00000000..2325c2ee + rdhash = AUFS_RDHASH_DEF; + err = au_nhash_alloc(&whtmp->whlist, rdhash, gfp); + if (unlikely(err)) { -+ kfree(whtmp); ++ au_kfree_rcu(whtmp); + whtmp = ERR_PTR(err); + } + @@ -34856,7 +34949,7 @@ index 00000000..2325c2ee + dput(whtmp->wh_dentry); + iput(whtmp->dir); + au_nhash_wh_free(&whtmp->whlist); -+ kfree(whtmp); ++ au_kfree_rcu(whtmp); +} + +/* @@ -34995,13 +35088,13 @@ index 00000000..2325c2ee +} diff --git a/fs/aufs/whout.h b/fs/aufs/whout.h new file mode 100644 -index 00000000..2bbc38ba +index 000000000..06f69b24e --- /dev/null +++ b/fs/aufs/whout.h @@ -0,0 +1,86 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* -+ * Copyright (C) 2005-2018 Junjiro R. Okajima ++ * Copyright (C) 2005-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -35087,13 +35180,13 @@ index 00000000..2bbc38ba +#endif /* __AUFS_WHOUT_H__ */ diff --git a/fs/aufs/wkq.c b/fs/aufs/wkq.c new file mode 100644 -index 00000000..55fab985 +index 000000000..b0dd8df4e --- /dev/null +++ b/fs/aufs/wkq.c @@ -0,0 +1,392 @@ +// SPDX-License-Identifier: GPL-2.0 +/* -+ * Copyright (C) 2005-2018 Junjiro R. Okajima ++ * Copyright (C) 2005-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -35265,7 +35358,7 @@ index 00000000..55fab985 + +static void au_wkq_lockdep_free(struct au_wkinfo *wkinfo) +{ -+ kfree(wkinfo->hlock); ++ au_kfree_try_rcu(wkinfo->hlock); +} + +static void au_wkq_lockdep_pre(struct au_wkinfo *wkinfo) @@ -35317,7 +35410,7 @@ index 00000000..55fab985 + else { + kobject_put(wkinfo->kobj); + module_put(THIS_MODULE); /* todo: ?? */ -+ kfree(wkinfo); ++ au_kfree_rcu(wkinfo); + } +} + @@ -35340,7 +35433,7 @@ index 00000000..55fab985 + +static void au_wkq_comp_free(struct completion *comp) +{ -+ kfree(comp); ++ au_kfree_rcu(comp); +} + +#else @@ -35485,13 +35578,13 @@ index 00000000..55fab985 +} diff --git a/fs/aufs/wkq.h b/fs/aufs/wkq.h new file mode 100644 -index 00000000..2e50ed83 +index 000000000..235370d91 --- /dev/null +++ b/fs/aufs/wkq.h @@ -0,0 +1,89 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* -+ * Copyright (C) 2005-2018 Junjiro R. Okajima ++ * Copyright (C) 2005-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -35580,13 +35673,13 @@ index 00000000..2e50ed83 +#endif /* __AUFS_WKQ_H__ */ diff --git a/fs/aufs/xattr.c b/fs/aufs/xattr.c new file mode 100644 -index 00000000..a31b57e4 +index 000000000..4b25f2f14 --- /dev/null +++ b/fs/aufs/xattr.c @@ -0,0 +1,356 @@ +// SPDX-License-Identifier: GPL-2.0 +/* -+ * Copyright (C) 2014-2018 Junjiro R. Okajima ++ * Copyright (C) 2014-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -35765,10 +35858,10 @@ index 00000000..a31b57e4 + AuTraceErr(err); + } + -+ kfree(value); ++ au_kfree_try_rcu(value); + +out_free: -+ kfree(o); ++ au_kfree_try_rcu(o); +out: + if (!unlocked) + inode_unlock_shared(h_isrc); @@ -35942,13 +36035,13 @@ index 00000000..a31b57e4 +} diff --git a/fs/aufs/xino.c b/fs/aufs/xino.c new file mode 100644 -index 00000000..c5fca81b +index 000000000..35ea33469 --- /dev/null +++ b/fs/aufs/xino.c -@@ -0,0 +1,1956 @@ +@@ -0,0 +1,1965 @@ +// SPDX-License-Identifier: GPL-2.0 +/* -+ * Copyright (C) 2005-2018 Junjiro R. Okajima ++ * Copyright (C) 2005-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -36108,22 +36201,28 @@ index 00000000..c5fca81b +/* + * create and set a new xino file + */ -+struct file *au_xino_create(struct super_block *sb, char *fpath, int silent) ++struct file *au_xino_create(struct super_block *sb, char *fpath, int silent, ++ int wbrtop) +{ + struct file *file; + struct dentry *h_parent, *d; + struct inode *h_dir, *inode; + int err; ++ static DEFINE_MUTEX(mtx); + + /* + * at mount-time, and the xino file is the default path, + * hnotify is disabled so we have no notify events to ignore. + * when a user specified the xino, we cannot get au_hdir to be ignored. + */ ++ if (!wbrtop) ++ mutex_lock(&mtx); + file = vfsub_filp_open(fpath, O_RDWR | O_CREAT | O_EXCL | O_LARGEFILE + /* | __FMODE_NONOTIFY */, + 0666); + if (IS_ERR(file)) { ++ if (!wbrtop) ++ mutex_unlock(&mtx); + if (!silent) + pr_err("open %s(%ld)\n", fpath, PTR_ERR(file)); + return file; @@ -36133,6 +36232,8 @@ index 00000000..c5fca81b + err = 0; + d = file->f_path.dentry; + h_parent = au_dget_parent_lock(d, AuLsc_I_PARENT); ++ if (!wbrtop) ++ mutex_unlock(&mtx); + /* mnt_want_write() is unnecessary here */ + h_dir = d_inode(h_parent); + inode = file_inode(file); @@ -36420,7 +36521,7 @@ index 00000000..c5fca81b + au_sbi(sb)->si_xino_jiffy = jiffy; + +out_st: -+ kfree(st); ++ au_kfree_rcu(st); +out: + return err; +} @@ -36457,7 +36558,7 @@ index 00000000..c5fca81b + au_lcnt_dec(&br->br_count); + si_write_unlock(sb); + au_nwt_done(&au_sbi(sb)->si_nowait); -+ kfree(args); ++ au_kfree_rcu(args); +} + +/* @@ -36529,7 +36630,7 @@ index 00000000..c5fca81b + + pr_err("wkq %d\n", wkq_err); + au_lcnt_dec(&br->br_count); -+ kfree(args); ++ au_kfree_rcu(args); + +out: + atomic_dec(&br->br_xino->xi_truncating); @@ -36648,14 +36749,14 @@ index 00000000..c5fca81b + } + } + hlist_bl_unlock(hbl); -+ kfree(del); ++ au_kfree_rcu(del); + +out: + au_lcnt_dec(&br->br_count); + ii_read_unlock(root); + si_read_unlock(sb); + au_nwt_done(&sbi->si_nowait); -+ kfree(args); ++ au_kfree_rcu(a); +} + +/* @@ -36681,7 +36782,7 @@ index 00000000..c5fca81b + if (unlikely(err)) { + pr_err("wkq %d\n", err); + au_lcnt_dec(&br->br_count); -+ kfree(arg); ++ au_kfree_rcu(arg); + } + +out: @@ -37244,9 +37345,9 @@ index 00000000..c5fca81b + goto out; /* success */ + +out_file: -+ kfree(xi->xi_file); ++ au_kfree_try_rcu(xi->xi_file); +out_free: -+ kfree(xi); ++ au_kfree_rcu(xi); + xi = NULL; +out: + return xi; @@ -37297,13 +37398,13 @@ index 00000000..c5fca81b + hlist_bl_lock(hbl); + hlist_bl_for_each_entry_safe (p, pos, n, hbl, node) { + hlist_bl_del(&p->node); -+ kfree(p); ++ au_kfree_rcu(p); + } + hlist_bl_unlock(hbl); + } -+ kfree(xi->xi_file); -+ kfree(xi->xi_nondir.array); -+ kfree(xi); ++ au_kfree_try_rcu(xi->xi_file); ++ au_kfree_try_rcu(xi->xi_nondir.array); ++ au_kfree_rcu(xi); +} + +int au_xino_put(struct au_branch *br) @@ -37615,11 +37716,12 @@ index 00000000..c5fca81b + if (!IS_ERR(p)) { + strcat(p, "/" AUFS_XINO_FNAME); + AuDbg("%s\n", p); -+ file = au_xino_create(sb, p, /*silent*/0); ++ file = au_xino_create(sb, p, /*silent*/0, /*wbrtop*/1); + } + free_page((unsigned long)page); + } else { -+ file = au_xino_create(sb, AUFS_XINO_DEFPATH, /*silent*/0); ++ file = au_xino_create(sb, AUFS_XINO_DEFPATH, /*silent*/0, ++ /*wbrtop*/0); + if (IS_ERR(file)) + goto out; + h_sb = file->f_path.dentry->d_sb; @@ -37903,10 +38005,10 @@ index 00000000..c5fca81b + return err; +} diff --git a/fs/dcache.c b/fs/dcache.c -index 28b2e770..d514ed23 100644 +index 9ac1290ae..c4fe6f8db 100644 --- a/fs/dcache.c +++ b/fs/dcache.c -@@ -1221,7 +1221,7 @@ enum d_walk_ret { +@@ -1217,7 +1217,7 @@ enum d_walk_ret { * * The @enter() and @finish() callbacks are called with d_lock held. */ @@ -37915,7 +38017,7 @@ index 28b2e770..d514ed23 100644 enum d_walk_ret (*enter)(void *, struct dentry *), void (*finish)(void *)) { -@@ -1329,6 +1329,7 @@ static void d_walk(struct dentry *parent, void *data, +@@ -1325,6 +1325,7 @@ static void d_walk(struct dentry *parent, void *data, seq = 1; goto again; } @@ -37923,7 +38025,7 @@ index 28b2e770..d514ed23 100644 struct check_mount { struct vfsmount *mnt; -@@ -2954,6 +2955,7 @@ void d_exchange(struct dentry *dentry1, struct dentry *dentry2) +@@ -2950,6 +2951,7 @@ void d_exchange(struct dentry *dentry1, struct dentry *dentry2) write_sequnlock(&rename_lock); } @@ -37932,7 +38034,7 @@ index 28b2e770..d514ed23 100644 /** * d_ancestor - search for an ancestor diff --git a/fs/exec.c b/fs/exec.c -index 0da4d748..5c94194b 100644 +index 7def97f6a..20c38005d 100644 --- a/fs/exec.c +++ b/fs/exec.c @@ -109,6 +109,7 @@ bool path_noexec(const struct path *path) @@ -37944,7 +38046,7 @@ index 0da4d748..5c94194b 100644 #ifdef CONFIG_USELIB /* diff --git a/fs/fcntl.c b/fs/fcntl.c -index 0345a46b..e8c9dc38 100644 +index 0345a46b8..e8c9dc38c 100644 --- a/fs/fcntl.c +++ b/fs/fcntl.c @@ -32,7 +32,7 @@ @@ -37974,7 +38076,7 @@ index 0345a46b..e8c9dc38 100644 static void f_modown(struct file *filp, struct pid *pid, enum pid_type type, int force) diff --git a/fs/file_table.c b/fs/file_table.c -index 61517f57..c6bab39c 100644 +index 61517f57f..c6bab39c1 100644 --- a/fs/file_table.c +++ b/fs/file_table.c @@ -148,6 +148,7 @@ struct file *get_empty_filp(void) @@ -38010,7 +38112,7 @@ index 61517f57..c6bab39c 100644 void __init files_init(void) { diff --git a/fs/inode.c b/fs/inode.c -index cfc36d11..8ca32869 100644 +index 76f7535fe..5e0542f25 100644 --- a/fs/inode.c +++ b/fs/inode.c @@ -1656,7 +1656,7 @@ EXPORT_SYMBOL(generic_update_time); @@ -38031,7 +38133,7 @@ index cfc36d11..8ca32869 100644 /** * touch_atime - update the access time diff --git a/fs/namespace.c b/fs/namespace.c -index 9dc146e7..902c99ca 100644 +index e9c13eedd..3e03d3633 100644 --- a/fs/namespace.c +++ b/fs/namespace.c @@ -517,6 +517,7 @@ void __mnt_drop_write(struct vfsmount *mnt) @@ -38056,7 +38158,7 @@ index 9dc146e7..902c99ca 100644 /* * vfsmount lock must be held for write */ -@@ -1906,6 +1914,7 @@ int iterate_mounts(int (*f)(struct vfsmount *, void *), void *arg, +@@ -1918,6 +1926,7 @@ int iterate_mounts(int (*f)(struct vfsmount *, void *), void *arg, } return 0; } @@ -38065,18 +38167,10 @@ index 9dc146e7..902c99ca 100644 static void cleanup_group_ids(struct mount *mnt, struct mount *end) { diff --git a/fs/notify/group.c b/fs/notify/group.c -index 32357534..14a2d48f 100644 +index 32357534d..952690873 100644 --- a/fs/notify/group.c +++ b/fs/notify/group.c -@@ -22,6 +22,7 @@ - #include - #include - #include -+#include - - #include - #include "fsnotify.h" -@@ -109,6 +110,7 @@ void fsnotify_get_group(struct fsnotify_group *group) +@@ -109,6 +109,7 @@ void fsnotify_get_group(struct fsnotify_group *group) { atomic_inc(&group->refcnt); } @@ -38084,7 +38178,7 @@ index 32357534..14a2d48f 100644 /* * Drop a reference to a group. Free it if it's through. -@@ -118,6 +120,7 @@ void fsnotify_put_group(struct fsnotify_group *group) +@@ -118,6 +119,7 @@ void fsnotify_put_group(struct fsnotify_group *group) if (atomic_dec_and_test(&group->refcnt)) fsnotify_final_destroy_group(group); } @@ -38092,7 +38186,7 @@ index 32357534..14a2d48f 100644 /* * Create a new fsnotify_group and hold a reference for the group returned. -@@ -147,6 +150,7 @@ struct fsnotify_group *fsnotify_alloc_group(const struct fsnotify_ops *ops) +@@ -147,6 +149,7 @@ struct fsnotify_group *fsnotify_alloc_group(const struct fsnotify_ops *ops) return group; } @@ -38101,7 +38195,7 @@ index 32357534..14a2d48f 100644 int fsnotify_fasync(int fd, struct file *file, int on) { diff --git a/fs/notify/mark.c b/fs/notify/mark.c -index 258d9908..cd0dd398 100644 +index 258d99087..cd0dd398f 100644 --- a/fs/notify/mark.c +++ b/fs/notify/mark.c @@ -245,6 +245,7 @@ void fsnotify_put_mark(struct fsnotify_mark *mark) @@ -38137,7 +38231,7 @@ index 258d9908..cd0dd398 100644 /* * Destroy all marks in destroy_list, waits for SRCU period to finish before diff --git a/fs/open.c b/fs/open.c -index 7ea11847..6e2e2418 100644 +index 29a2cdcbc..41d8c00fb 100644 --- a/fs/open.c +++ b/fs/open.c @@ -64,6 +64,7 @@ int do_truncate(struct dentry *dentry, loff_t length, unsigned int time_attrs, @@ -38148,7 +38242,7 @@ index 7ea11847..6e2e2418 100644 long vfs_truncate(const struct path *path, loff_t length) { -@@ -691,6 +692,7 @@ int open_check_o_direct(struct file *f) +@@ -710,6 +711,7 @@ int open_check_o_direct(struct file *f) } return 0; } @@ -38157,10 +38251,10 @@ index 7ea11847..6e2e2418 100644 static int do_dentry_open(struct file *f, struct inode *inode, diff --git a/fs/proc/base.c b/fs/proc/base.c -index 9063738f..47f3fd3b 100644 +index 64695dcf8..eeaad0f45 100644 --- a/fs/proc/base.c +++ b/fs/proc/base.c -@@ -2035,7 +2035,7 @@ static int map_files_get_link(struct dentry *dentry, struct path *path) +@@ -2031,7 +2031,7 @@ static int map_files_get_link(struct dentry *dentry, struct path *path) down_read(&mm->mmap_sem); vma = find_exact_vma(mm, vm_start, vm_end); if (vma && vma->vm_file) { @@ -38170,7 +38264,7 @@ index 9063738f..47f3fd3b 100644 rc = 0; } diff --git a/fs/proc/nommu.c b/fs/proc/nommu.c -index 75634379..7c0dc0ff 100644 +index 75634379f..7c0dc0ff4 100644 --- a/fs/proc/nommu.c +++ b/fs/proc/nommu.c @@ -45,7 +45,10 @@ static int nommu_region_show(struct seq_file *m, struct vm_region *region) @@ -38186,7 +38280,7 @@ index 75634379..7c0dc0ff 100644 ino = inode->i_ino; } diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c -index 2b47757c..912f287d 100644 +index 309d24118..c6288e71e 100644 --- a/fs/proc/task_mmu.c +++ b/fs/proc/task_mmu.c @@ -310,7 +310,10 @@ show_map_vma(struct seq_file *m, struct vm_area_struct *vma, int is_pid) @@ -38201,7 +38295,7 @@ index 2b47757c..912f287d 100644 dev = inode->i_sb->s_dev; ino = inode->i_ino; pgoff = ((loff_t)vma->vm_pgoff) << PAGE_SHIFT; -@@ -1751,7 +1754,7 @@ static int show_numa_map(struct seq_file *m, void *v, int is_pid) +@@ -1775,7 +1778,7 @@ static int show_numa_map(struct seq_file *m, void *v, int is_pid) struct proc_maps_private *proc_priv = &numa_priv->proc_maps; struct vm_area_struct *vma = v; struct numa_maps *md = &numa_priv->md; @@ -38211,7 +38305,7 @@ index 2b47757c..912f287d 100644 struct mm_walk walk = { .hugetlb_entry = gather_hugetlb_stats, diff --git a/fs/proc/task_nommu.c b/fs/proc/task_nommu.c -index 5b62f57b..dfb4a3bd 100644 +index 5b62f57bd..dfb4a3bd0 100644 --- a/fs/proc/task_nommu.c +++ b/fs/proc/task_nommu.c @@ -156,7 +156,10 @@ static int nommu_vma_show(struct seq_file *m, struct vm_area_struct *vma, @@ -38227,7 +38321,7 @@ index 5b62f57b..dfb4a3bd 100644 ino = inode->i_ino; pgoff = (loff_t)vma->vm_pgoff << PAGE_SHIFT; diff --git a/fs/read_write.c b/fs/read_write.c -index 57a00ef8..1221dda3 100644 +index e8136a72c..bdb1d223a 100644 --- a/fs/read_write.c +++ b/fs/read_write.c @@ -454,6 +454,7 @@ ssize_t vfs_read(struct file *file, char __user *buf, size_t count, loff_t *pos) @@ -38278,7 +38372,7 @@ index 57a00ef8..1221dda3 100644 static inline loff_t file_pos_read(struct file *file) { diff --git a/fs/splice.c b/fs/splice.c -index f3084cce..7ab89d23 100644 +index c84ac7e97..3724bd22e 100644 --- a/fs/splice.c +++ b/fs/splice.c @@ -837,8 +837,8 @@ EXPORT_SYMBOL(generic_splice_sendpage); @@ -38319,7 +38413,7 @@ index f3084cce..7ab89d23 100644 /** * splice_direct_to_actor - splices data directly between two non-pipes diff --git a/fs/sync.c b/fs/sync.c -index 83ac79a9..e3386eab 100644 +index 83ac79a96..e3386eabb 100644 --- a/fs/sync.c +++ b/fs/sync.c @@ -28,7 +28,7 @@ @@ -38340,7 +38434,7 @@ index 83ac79a9..e3386eab 100644 /* * Write out and wait upon all dirty data associated with this diff --git a/fs/xattr.c b/fs/xattr.c -index 50029811..ee34b725 100644 +index 50029811f..ee34b7256 100644 --- a/fs/xattr.c +++ b/fs/xattr.c @@ -297,6 +297,7 @@ vfs_getxattr_alloc(struct dentry *dentry, const char *name, char **xattr_value, @@ -38352,7 +38446,7 @@ index 50029811..ee34b725 100644 ssize_t __vfs_getxattr(struct dentry *dentry, struct inode *inode, const char *name, diff --git a/include/linux/file.h b/include/linux/file.h -index 279720db..76e38ead 100644 +index 279720db9..76e38eade 100644 --- a/include/linux/file.h +++ b/include/linux/file.h @@ -20,6 +20,7 @@ struct dentry; @@ -38364,10 +38458,10 @@ index 279720db..76e38ead 100644 static inline void fput_light(struct file *file, int fput_needed) { diff --git a/include/linux/fs.h b/include/linux/fs.h -index 7374639f..48520a1c 100644 +index f0fddf4ea..85ac9197c 100644 --- a/include/linux/fs.h +++ b/include/linux/fs.h -@@ -1265,6 +1265,7 @@ extern void fasync_free(struct fasync_struct *); +@@ -1270,6 +1270,7 @@ extern void fasync_free(struct fasync_struct *); /* can be called from interrupts */ extern void kill_fasync(struct fasync_struct **, int, int); @@ -38375,7 +38469,7 @@ index 7374639f..48520a1c 100644 extern void __f_setown(struct file *filp, struct pid *, enum pid_type, int force); extern int f_setown(struct file *filp, unsigned long arg, int force); extern void f_delown(struct file *filp); -@@ -1712,6 +1713,7 @@ struct file_operations { +@@ -1717,6 +1718,7 @@ struct file_operations { ssize_t (*sendpage) (struct file *, struct page *, int, size_t, loff_t *, int); unsigned long (*get_unmapped_area)(struct file *, unsigned long, unsigned long, unsigned long, unsigned long); int (*check_flags)(int); @@ -38383,7 +38477,7 @@ index 7374639f..48520a1c 100644 int (*flock) (struct file *, int, struct file_lock *); ssize_t (*splice_write)(struct pipe_inode_info *, struct file *, loff_t *, size_t, unsigned int); ssize_t (*splice_read)(struct file *, loff_t *, struct pipe_inode_info *, size_t, unsigned int); -@@ -1782,6 +1784,12 @@ ssize_t rw_copy_check_uvector(int type, const struct iovec __user * uvector, +@@ -1787,6 +1789,12 @@ ssize_t rw_copy_check_uvector(int type, const struct iovec __user * uvector, struct iovec *fast_pointer, struct iovec **ret_pointer); @@ -38396,7 +38490,7 @@ index 7374639f..48520a1c 100644 extern ssize_t __vfs_read(struct file *, char __user *, size_t, loff_t *); extern ssize_t vfs_read(struct file *, char __user *, size_t, loff_t *); extern ssize_t vfs_write(struct file *, const char __user *, size_t, loff_t *); -@@ -2186,6 +2194,7 @@ extern int current_umask(void); +@@ -2191,6 +2199,7 @@ extern int current_umask(void); extern void ihold(struct inode * inode); extern void iput(struct inode *); extern int generic_update_time(struct inode *, struct timespec *, int); @@ -38404,7 +38498,7 @@ index 7374639f..48520a1c 100644 /* /sys/fs */ extern struct kobject *fs_kobj; -@@ -2466,6 +2475,7 @@ static inline bool sb_is_blkdev_sb(struct super_block *sb) +@@ -2471,6 +2480,7 @@ static inline bool sb_is_blkdev_sb(struct super_block *sb) return false; } #endif @@ -38413,7 +38507,7 @@ index 7374639f..48520a1c 100644 extern const struct file_operations def_blk_fops; extern const struct file_operations def_chr_fops; diff --git a/include/linux/lockdep.h b/include/linux/lockdep.h -index f301d31b..c26f5b42 100644 +index f301d31b4..c26f5b420 100644 --- a/include/linux/lockdep.h +++ b/include/linux/lockdep.h @@ -406,6 +406,8 @@ static inline int lockdep_match_key(struct lockdep_map *lock, @@ -38434,10 +38528,10 @@ index f301d31b..c26f5b42 100644 #define lockdep_assert_held(l) do { (void)(l); } while (0) diff --git a/include/linux/mm.h b/include/linux/mm.h -index 58f2263d..e8b2d404 100644 +index 858ce84ac..977676601 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h -@@ -1350,6 +1350,28 @@ static inline int fixup_user_fault(struct task_struct *tsk, +@@ -1358,6 +1358,28 @@ static inline int fixup_user_fault(struct task_struct *tsk, } #endif @@ -38467,10 +38561,10 @@ index 58f2263d..e8b2d404 100644 unsigned int gup_flags); extern int access_remote_vm(struct mm_struct *mm, unsigned long addr, diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h -index e41ef532..bf258a4e 100644 +index be5d445ba..dca97e717 100644 --- a/include/linux/mm_types.h +++ b/include/linux/mm_types.h -@@ -253,6 +253,7 @@ struct vm_region { +@@ -258,6 +258,7 @@ struct vm_region { unsigned long vm_top; /* region allocated to here */ unsigned long vm_pgoff; /* the offset in vm_file corresponding to vm_start */ struct file *vm_file; /* the backing file or NULL */ @@ -38478,7 +38572,7 @@ index e41ef532..bf258a4e 100644 int vm_usage; /* region usage count (access under nommu_region_sem) */ bool vm_icache_flushed : 1; /* true if the icache has been flushed for -@@ -327,6 +328,7 @@ struct vm_area_struct { +@@ -332,6 +333,7 @@ struct vm_area_struct { unsigned long vm_pgoff; /* Offset (within vm_file) in PAGE_SIZE units */ struct file * vm_file; /* File we map to (can be NULL). */ @@ -38487,7 +38581,7 @@ index e41ef532..bf258a4e 100644 atomic_long_t swap_readahead_info; diff --git a/include/linux/mnt_namespace.h b/include/linux/mnt_namespace.h -index 35942084..24f5fd1a 100644 +index 35942084c..24f5fd1a7 100644 --- a/include/linux/mnt_namespace.h +++ b/include/linux/mnt_namespace.h @@ -6,11 +6,14 @@ @@ -38506,7 +38600,7 @@ index 35942084..24f5fd1a 100644 extern const struct file_operations proc_mountinfo_operations; extern const struct file_operations proc_mountstats_operations; diff --git a/include/linux/splice.h b/include/linux/splice.h -index 74b4911a..19789fbe 100644 +index 74b4911ac..19789fbea 100644 --- a/include/linux/splice.h +++ b/include/linux/splice.h @@ -87,4 +87,10 @@ extern void splice_shrink_spd(struct splice_pipe_desc *); @@ -38522,13 +38616,13 @@ index 74b4911a..19789fbe 100644 #endif diff --git a/include/uapi/linux/aufs_type.h b/include/uapi/linux/aufs_type.h new file mode 100644 -index 00000000..06a75451 +index 000000000..d8e39df98 --- /dev/null +++ b/include/uapi/linux/aufs_type.h -@@ -0,0 +1,448 @@ +@@ -0,0 +1,452 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* -+ * Copyright (C) 2005-2018 Junjiro R. Okajima ++ * Copyright (C) 2005-2019 Junjiro R. Okajima + * + * This program, aufs is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by @@ -38568,7 +38662,7 @@ index 00000000..06a75451 + +#include + -+#define AUFS_VERSION "4.14.73+-20181119" ++#define AUFS_VERSION "4.14.73+-20190902" + +/* todo? move this to linux-2.6.19/include/magic.h */ +#define AUFS_SUPER_MAGIC ('a' << 24 | 'u' << 16 | 'f' << 8 | 's') @@ -38782,7 +38876,11 @@ index 00000000..06a75451 + +/* borrowed from linux/include/linux/kernel.h */ +#ifndef ALIGN ++#ifdef _GNU_SOURCE +#define ALIGN(x, a) __ALIGN_MASK(x, (typeof(x))(a)-1) ++#else ++#define ALIGN(x, a) (((x) + (a) - 1) & ~((a) - 1)) ++#endif +#define __ALIGN_MASK(x, mask) (((x)+(mask))&~(mask)) +#endif + @@ -38975,10 +39073,10 @@ index 00000000..06a75451 + +#endif /* __AUFS_TYPE_H__ */ diff --git a/kernel/fork.c b/kernel/fork.c -index 6a219fea..a19ee252 100644 +index 0a328cf0c..dc9ce1b30 100644 --- a/kernel/fork.c +++ b/kernel/fork.c -@@ -675,7 +675,7 @@ static __latent_entropy int dup_mmap(struct mm_struct *mm, +@@ -670,7 +670,7 @@ static __latent_entropy int dup_mmap(struct mm_struct *mm, struct inode *inode = file_inode(file); struct address_space *mapping = file->f_mapping; @@ -38988,7 +39086,7 @@ index 6a219fea..a19ee252 100644 atomic_dec(&inode->i_writecount); i_mmap_lock_write(mapping); diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c -index bf694c70..28e6c758 100644 +index 90a3469a7..6d8e312df 100644 --- a/kernel/locking/lockdep.c +++ b/kernel/locking/lockdep.c @@ -143,7 +143,7 @@ static struct lock_list list_entries[MAX_LOCKDEP_ENTRIES]; @@ -39010,7 +39108,7 @@ index bf694c70..28e6c758 100644 #ifdef CONFIG_LOCK_STAT static DEFINE_PER_CPU(struct lock_class_stats[MAX_LOCKDEP_KEYS], cpu_lock_stats); diff --git a/kernel/task_work.c b/kernel/task_work.c -index 0fef3956..83fb1ecf 100644 +index 0fef39566..83fb1ecfc 100644 --- a/kernel/task_work.c +++ b/kernel/task_work.c @@ -116,3 +116,4 @@ void task_work_run(void) @@ -39019,7 +39117,7 @@ index 0fef3956..83fb1ecf 100644 } +EXPORT_SYMBOL_GPL(task_work_run); diff --git a/mm/Makefile b/mm/Makefile -index e7ebd176..d6bcfb01 100644 +index e7ebd176f..d6bcfb01b 100644 --- a/mm/Makefile +++ b/mm/Makefile @@ -39,7 +39,7 @@ obj-y := filemap.o mempool.o oom_kill.o \ @@ -39032,10 +39130,10 @@ index e7ebd176..d6bcfb01 100644 obj-y += init-mm.o diff --git a/mm/filemap.c b/mm/filemap.c -index e2e738cc..2a410810 100644 +index a30dbf93d..c1fdca33d 100644 --- a/mm/filemap.c +++ b/mm/filemap.c -@@ -2589,7 +2589,7 @@ int filemap_page_mkwrite(struct vm_fault *vmf) +@@ -2612,7 +2612,7 @@ int filemap_page_mkwrite(struct vm_fault *vmf) int ret = VM_FAULT_LOCKED; sb_start_pagefault(inode->i_sb); @@ -39045,10 +39143,10 @@ index e2e738cc..2a410810 100644 if (page->mapping != inode->i_mapping) { unlock_page(page); diff --git a/mm/mmap.c b/mm/mmap.c -index 23987761..753b6329 100644 +index db0e29239..60bf78943 100644 --- a/mm/mmap.c +++ b/mm/mmap.c -@@ -171,7 +171,7 @@ static struct vm_area_struct *remove_vma(struct vm_area_struct *vma) +@@ -172,7 +172,7 @@ static struct vm_area_struct *remove_vma(struct vm_area_struct *vma) if (vma->vm_ops && vma->vm_ops->close) vma->vm_ops->close(vma); if (vma->vm_file) @@ -39057,7 +39155,7 @@ index 23987761..753b6329 100644 mpol_put(vma_policy(vma)); kmem_cache_free(vm_area_cachep, vma); return next; -@@ -896,7 +896,7 @@ int __vma_adjust(struct vm_area_struct *vma, unsigned long start, +@@ -897,7 +897,7 @@ int __vma_adjust(struct vm_area_struct *vma, unsigned long start, if (remove_next) { if (file) { uprobe_munmap(next, next->vm_start, next->vm_end); @@ -39066,7 +39164,7 @@ index 23987761..753b6329 100644 } if (next->anon_vma) anon_vma_merge(vma, next); -@@ -1778,8 +1778,8 @@ unsigned long mmap_region(struct file *file, unsigned long addr, +@@ -1747,8 +1747,8 @@ unsigned long mmap_region(struct file *file, unsigned long addr, return addr; unmap_and_free_vma: @@ -39076,7 +39174,7 @@ index 23987761..753b6329 100644 /* Undo any partial mapping done by a device driver. */ unmap_region(mm, vma, prev, vma->vm_start, vma->vm_end); -@@ -2603,7 +2603,7 @@ int __split_vma(struct mm_struct *mm, struct vm_area_struct *vma, +@@ -2575,7 +2575,7 @@ int __split_vma(struct mm_struct *mm, struct vm_area_struct *vma, goto out_free_mpol; if (new->vm_file) @@ -39085,7 +39183,7 @@ index 23987761..753b6329 100644 if (new->vm_ops && new->vm_ops->open) new->vm_ops->open(new); -@@ -2622,7 +2622,7 @@ int __split_vma(struct mm_struct *mm, struct vm_area_struct *vma, +@@ -2594,7 +2594,7 @@ int __split_vma(struct mm_struct *mm, struct vm_area_struct *vma, if (new->vm_ops && new->vm_ops->close) new->vm_ops->close(new); if (new->vm_file) @@ -39094,7 +39192,7 @@ index 23987761..753b6329 100644 unlink_anon_vmas(new); out_free_mpol: mpol_put(vma_policy(new)); -@@ -2784,7 +2784,7 @@ SYSCALL_DEFINE5(remap_file_pages, unsigned long, start, unsigned long, size, +@@ -2756,7 +2756,7 @@ SYSCALL_DEFINE5(remap_file_pages, unsigned long, start, unsigned long, size, struct vm_area_struct *vma; unsigned long populate = 0; unsigned long ret = -EINVAL; @@ -39103,7 +39201,7 @@ index 23987761..753b6329 100644 pr_warn_once("%s (%d) uses deprecated remap_file_pages() syscall. See Documentation/vm/remap_file_pages.txt.\n", current->comm, current->pid); -@@ -2859,10 +2859,27 @@ SYSCALL_DEFINE5(remap_file_pages, unsigned long, start, unsigned long, size, +@@ -2831,10 +2831,27 @@ SYSCALL_DEFINE5(remap_file_pages, unsigned long, start, unsigned long, size, } } @@ -39132,7 +39230,7 @@ index 23987761..753b6329 100644 out: up_write(&mm->mmap_sem); if (populate) -@@ -3173,7 +3190,7 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap, +@@ -3145,7 +3162,7 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap, if (anon_vma_clone(new_vma, vma)) goto out_free_mempol; if (new_vma->vm_file) @@ -39142,7 +39240,7 @@ index 23987761..753b6329 100644 new_vma->vm_ops->open(new_vma); vma_link(mm, new_vma, prev, rb_link, rb_parent); diff --git a/mm/nommu.c b/mm/nommu.c -index 17c00d93..4bcdf944 100644 +index 17c00d93d..4bcdf9448 100644 --- a/mm/nommu.c +++ b/mm/nommu.c @@ -641,7 +641,7 @@ static void __put_nommu_region(struct vm_region *region) @@ -39187,7 +39285,7 @@ index 17c00d93..4bcdf944 100644 diff --git a/mm/prfile.c b/mm/prfile.c new file mode 100644 -index 00000000..a27ac368 +index 000000000..024cdcfae --- /dev/null +++ b/mm/prfile.c @@ -0,0 +1,86 @@ @@ -39199,7 +39297,7 @@ index 00000000..a27ac368 + * + * See Documentation/filesystems/aufs/design/06mmap.txt + * -+ * Copyright (c) 2014-2018 Junjro R. Okajima ++ * Copyright (c) 2014-2019 Junjro R. Okajima + * Copyright (c) 2014 Ian Campbell + */ + @@ -39277,38 +39375,11 @@ index 00000000..a27ac368 + fput(pr); +} +#endif /* !CONFIG_MMU */ -diff --git a/security/commoncap.c b/security/commoncap.c -index ae26ef00..19cffd0b 100644 ---- a/security/commoncap.c -+++ b/security/commoncap.c -@@ -1269,12 +1269,14 @@ int cap_mmap_addr(unsigned long addr) - } - return ret; - } -+EXPORT_SYMBOL_GPL(cap_mmap_addr); - - int cap_mmap_file(struct file *file, unsigned long reqprot, - unsigned long prot, unsigned long flags) - { - return 0; - } -+EXPORT_SYMBOL_GPL(cap_mmap_file); - - #ifdef CONFIG_SECURITY - diff --git a/security/device_cgroup.c b/security/device_cgroup.c -index 5ef7e524..e2e959dc 100644 +index ea014df89..92120f60e 100644 --- a/security/device_cgroup.c +++ b/security/device_cgroup.c -@@ -8,6 +8,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -850,6 +851,7 @@ int __devcgroup_inode_permission(struct inode *inode, int mask) +@@ -850,6 +850,7 @@ int __devcgroup_inode_permission(struct inode *inode, int mask) return __devcgroup_check_permission(type, imajor(inode), iminor(inode), access); } @@ -39317,7 +39388,7 @@ index 5ef7e524..e2e959dc 100644 int devcgroup_inode_mknod(int mode, dev_t dev) { diff --git a/security/security.c b/security/security.c -index 95a1a0f5..1627a963 100644 +index 4fbe4e495..640687ed1 100644 --- a/security/security.c +++ b/security/security.c @@ -532,6 +532,7 @@ int security_path_rmdir(const struct path *dir, struct dentry *dentry) @@ -39368,15 +39439,7 @@ index 95a1a0f5..1627a963 100644 int security_path_chroot(const struct path *path) { -@@ -682,6 +688,7 @@ int security_inode_readlink(struct dentry *dentry) - return 0; - return call_int_hook(inode_readlink, 0, dentry); - } -+EXPORT_SYMBOL_GPL(security_inode_readlink); - - int security_inode_follow_link(struct dentry *dentry, struct inode *inode, - bool rcu) -@@ -697,6 +704,7 @@ int security_inode_permission(struct inode *inode, int mask) +@@ -697,6 +703,7 @@ int security_inode_permission(struct inode *inode, int mask) return 0; return call_int_hook(inode_permission, 0, inode, mask); } @@ -39384,7 +39447,7 @@ index 95a1a0f5..1627a963 100644 int security_inode_setattr(struct dentry *dentry, struct iattr *attr) { -@@ -868,6 +876,7 @@ int security_file_permission(struct file *file, int mask) +@@ -868,6 +875,7 @@ int security_file_permission(struct file *file, int mask) return fsnotify_perm(file, mask); } @@ -39392,7 +39455,7 @@ index 95a1a0f5..1627a963 100644 int security_file_alloc(struct file *file) { -@@ -927,6 +936,7 @@ int security_mmap_file(struct file *file, unsigned long prot, +@@ -927,6 +935,7 @@ int security_mmap_file(struct file *file, unsigned long prot, return ret; return ima_file_mmap(file, prot); } diff --git a/patch/kernel/odroidxu4-legacy/increasing_DMA_block_memory_allocation_to_2048.patch b/patch/kernel/odroidxu4-legacy/increasing_DMA_block_memory_allocation_to_2048.patch deleted file mode 100644 index 1c4d60250..000000000 --- a/patch/kernel/odroidxu4-legacy/increasing_DMA_block_memory_allocation_to_2048.patch +++ /dev/null @@ -1,13 +0,0 @@ -diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c -index bd83c53..af7cfe3 ---- a/arch/arm/mm/dma-mapping.c -+++ b/arch/arm/mm/dma-mapping.c -@@ -374,7 +374,7 @@ static void __dma_free_remap(void *cpu_addr, size_t size) - VM_ARM_DMA_CONSISTENT | VM_USERMAP); - } - --#define DEFAULT_DMA_COHERENT_POOL_SIZE SZ_256K -+#define DEFAULT_DMA_COHERENT_POOL_SIZE SZ_2M - static struct gen_pool *atomic_pool; - - static size_t atomic_pool_size = DEFAULT_DMA_COHERENT_POOL_SIZE; diff --git a/patch/kernel/odroidxu4-legacy/patch-4.14.157-158.patch b/patch/kernel/odroidxu4-legacy/patch-4.14.157-158.patch new file mode 100644 index 000000000..1719a84c7 --- /dev/null +++ b/patch/kernel/odroidxu4-legacy/patch-4.14.157-158.patch @@ -0,0 +1,7483 @@ +diff --git a/Documentation/hid/uhid.txt b/Documentation/hid/uhid.txt +index c8656dd029a9..958fff945304 100644 +--- a/Documentation/hid/uhid.txt ++++ b/Documentation/hid/uhid.txt +@@ -160,7 +160,7 @@ them but you should handle them according to your needs. + UHID_OUTPUT: + This is sent if the HID device driver wants to send raw data to the I/O + device on the interrupt channel. You should read the payload and forward it to +- the device. The payload is of type "struct uhid_data_req". ++ the device. The payload is of type "struct uhid_output_req". + This may be received even though you haven't received UHID_OPEN, yet. + + UHID_GET_REPORT: +diff --git a/Makefile b/Makefile +index dad90f53faeb..d97288c0754f 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 14 +-SUBLEVEL = 157 ++SUBLEVEL = 158 + EXTRAVERSION = + NAME = Petit Gorille + +diff --git a/arch/arm/Kconfig.debug b/arch/arm/Kconfig.debug +index 954ba8b81052..fd4b679945d3 100644 +--- a/arch/arm/Kconfig.debug ++++ b/arch/arm/Kconfig.debug +@@ -1376,21 +1376,21 @@ config DEBUG_OMAP2PLUS_UART + depends on ARCH_OMAP2PLUS + + config DEBUG_IMX_UART_PORT +- int "i.MX Debug UART Port Selection" if DEBUG_IMX1_UART || \ +- DEBUG_IMX25_UART || \ +- DEBUG_IMX21_IMX27_UART || \ +- DEBUG_IMX31_UART || \ +- DEBUG_IMX35_UART || \ +- DEBUG_IMX50_UART || \ +- DEBUG_IMX51_UART || \ +- DEBUG_IMX53_UART || \ +- DEBUG_IMX6Q_UART || \ +- DEBUG_IMX6SL_UART || \ +- DEBUG_IMX6SX_UART || \ +- DEBUG_IMX6UL_UART || \ +- DEBUG_IMX7D_UART ++ int "i.MX Debug UART Port Selection" ++ depends on DEBUG_IMX1_UART || \ ++ DEBUG_IMX25_UART || \ ++ DEBUG_IMX21_IMX27_UART || \ ++ DEBUG_IMX31_UART || \ ++ DEBUG_IMX35_UART || \ ++ DEBUG_IMX50_UART || \ ++ DEBUG_IMX51_UART || \ ++ DEBUG_IMX53_UART || \ ++ DEBUG_IMX6Q_UART || \ ++ DEBUG_IMX6SL_UART || \ ++ DEBUG_IMX6SX_UART || \ ++ DEBUG_IMX6UL_UART || \ ++ DEBUG_IMX7D_UART + default 1 +- depends on ARCH_MXC + help + Choose UART port on which kernel low-level debug messages + should be output. +diff --git a/arch/arm/boot/dts/gemini-sq201.dts b/arch/arm/boot/dts/gemini-sq201.dts +index 63c02ca9513c..e9e2f6ff0c58 100644 +--- a/arch/arm/boot/dts/gemini-sq201.dts ++++ b/arch/arm/boot/dts/gemini-sq201.dts +@@ -20,7 +20,7 @@ + }; + + chosen { +- bootargs = "console=ttyS0,115200n8"; ++ bootargs = "console=ttyS0,115200n8 root=/dev/mtdblock2 rw rootfstype=squashfs,jffs2 rootwait"; + stdout-path = &uart0; + }; + +@@ -71,37 +71,10 @@ + /* 16MB of flash */ + reg = <0x30000000 0x01000000>; + +- partition@0 { +- label = "RedBoot"; +- reg = <0x00000000 0x00120000>; +- read-only; +- }; +- partition@120000 { +- label = "Kernel"; +- reg = <0x00120000 0x00200000>; +- }; +- partition@320000 { +- label = "Ramdisk"; +- reg = <0x00320000 0x00600000>; +- }; +- partition@920000 { +- label = "Application"; +- reg = <0x00920000 0x00600000>; +- }; +- partition@f20000 { +- label = "VCTL"; +- reg = <0x00f20000 0x00020000>; +- read-only; +- }; +- partition@f40000 { +- label = "CurConf"; +- reg = <0x00f40000 0x000a0000>; +- read-only; +- }; +- partition@fe0000 { +- label = "FIS directory"; +- reg = <0x00fe0000 0x00020000>; +- read-only; ++ partitions { ++ compatible = "redboot-fis"; ++ /* Eraseblock at 0xfe0000 */ ++ fis-index-block = <0x1fc>; + }; + }; + +diff --git a/arch/arm/boot/dts/imx53-voipac-dmm-668.dtsi b/arch/arm/boot/dts/imx53-voipac-dmm-668.dtsi +index df8dafe2564d..2297ed90ee89 100644 +--- a/arch/arm/boot/dts/imx53-voipac-dmm-668.dtsi ++++ b/arch/arm/boot/dts/imx53-voipac-dmm-668.dtsi +@@ -17,12 +17,8 @@ + + memory@70000000 { + device_type = "memory"; +- reg = <0x70000000 0x20000000>; +- }; +- +- memory@b0000000 { +- device_type = "memory"; +- reg = <0xb0000000 0x20000000>; ++ reg = <0x70000000 0x20000000>, ++ <0xb0000000 0x20000000>; + }; + + regulators { +diff --git a/arch/arm/mach-ks8695/board-acs5k.c b/arch/arm/mach-ks8695/board-acs5k.c +index e4d709c8ed32..76d3083f1f63 100644 +--- a/arch/arm/mach-ks8695/board-acs5k.c ++++ b/arch/arm/mach-ks8695/board-acs5k.c +@@ -92,7 +92,7 @@ static struct i2c_board_info acs5k_i2c_devs[] __initdata = { + }, + }; + +-static void acs5k_i2c_init(void) ++static void __init acs5k_i2c_init(void) + { + /* The gpio interface */ + platform_device_register(&acs5k_i2c_device); +diff --git a/arch/arm/mach-omap1/Makefile b/arch/arm/mach-omap1/Makefile +index e8ccf51c6f29..ec0235899de2 100644 +--- a/arch/arm/mach-omap1/Makefile ++++ b/arch/arm/mach-omap1/Makefile +@@ -25,7 +25,7 @@ obj-y += $(i2c-omap-m) $(i2c-omap-y) + + led-y := leds.o + +-usb-fs-$(CONFIG_USB) := usb.o ++usb-fs-$(CONFIG_USB_SUPPORT) := usb.o + obj-y += $(usb-fs-m) $(usb-fs-y) + + # Specific board support +diff --git a/arch/arm/mach-omap1/include/mach/usb.h b/arch/arm/mach-omap1/include/mach/usb.h +index 77867778d4ec..5429d86c7190 100644 +--- a/arch/arm/mach-omap1/include/mach/usb.h ++++ b/arch/arm/mach-omap1/include/mach/usb.h +@@ -11,7 +11,7 @@ + + #include + +-#if IS_ENABLED(CONFIG_USB) ++#if IS_ENABLED(CONFIG_USB_SUPPORT) + void omap1_usb_init(struct omap_usb_config *pdata); + #else + static inline void omap1_usb_init(struct omap_usb_config *pdata) +diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S +index 92cc7b51f100..9c00fd2acc2a 100644 +--- a/arch/arm64/kernel/head.S ++++ b/arch/arm64/kernel/head.S +@@ -594,6 +594,7 @@ secondary_startup: + /* + * Common entry point for secondary CPUs. + */ ++ bl __cpu_secondary_check52bitva + bl __cpu_setup // initialise processor + bl __enable_mmu + ldr x8, =__secondary_switched +@@ -668,6 +669,31 @@ ENTRY(__enable_mmu) + ret + ENDPROC(__enable_mmu) + ++ENTRY(__cpu_secondary_check52bitva) ++#ifdef CONFIG_ARM64_52BIT_VA ++ ldr_l x0, vabits_user ++ cmp x0, #52 ++ b.ne 2f ++ ++ mrs_s x0, SYS_ID_AA64MMFR2_EL1 ++ and x0, x0, #(0xf << ID_AA64MMFR2_LVA_SHIFT) ++ cbnz x0, 2f ++ ++ adr_l x0, va52mismatch ++ mov w1, #1 ++ strb w1, [x0] ++ dmb sy ++ dc ivac, x0 // Invalidate potentially stale cache line ++ ++ update_early_cpu_boot_status CPU_STUCK_IN_KERNEL, x0, x1 ++1: wfe ++ wfi ++ b 1b ++ ++#endif ++2: ret ++ENDPROC(__cpu_secondary_check52bitva) ++ + __no_granule_support: + /* Indicate that this CPU can't boot and is stuck in the kernel */ + update_early_cpu_boot_status CPU_STUCK_IN_KERNEL, x1, x2 +diff --git a/arch/arm64/kernel/smp.c b/arch/arm64/kernel/smp.c +index a683cd499515..909bf3926fd2 100644 +--- a/arch/arm64/kernel/smp.c ++++ b/arch/arm64/kernel/smp.c +@@ -106,6 +106,7 @@ static int boot_secondary(unsigned int cpu, struct task_struct *idle) + } + + static DECLARE_COMPLETION(cpu_running); ++bool va52mismatch __ro_after_init; + + int __cpu_up(unsigned int cpu, struct task_struct *idle) + { +@@ -135,10 +136,15 @@ int __cpu_up(unsigned int cpu, struct task_struct *idle) + + if (!cpu_online(cpu)) { + pr_crit("CPU%u: failed to come online\n", cpu); ++ ++ if (IS_ENABLED(CONFIG_ARM64_52BIT_VA) && va52mismatch) ++ pr_crit("CPU%u: does not support 52-bit VAs\n", cpu); ++ + ret = -EIO; + } + } else { + pr_err("CPU%u: failed to boot: %d\n", cpu, ret); ++ return ret; + } + + secondary_data.task = NULL; +diff --git a/arch/microblaze/Makefile b/arch/microblaze/Makefile +index d269dd4b8279..fe5e48184c3c 100644 +--- a/arch/microblaze/Makefile ++++ b/arch/microblaze/Makefile +@@ -83,19 +83,21 @@ archclean: + + linux.bin linux.bin.gz linux.bin.ub: vmlinux + $(Q)$(MAKE) $(build)=$(boot) $(boot)/$@ ++ @echo 'Kernel: $(boot)/$@ is ready' ' (#'`cat .version`')' + + simpleImage.%: vmlinux + $(Q)$(MAKE) $(build)=$(boot) $(boot)/$@ ++ @echo 'Kernel: $(boot)/$@ is ready' ' (#'`cat .version`')' + + define archhelp + echo '* linux.bin - Create raw binary' + echo ' linux.bin.gz - Create compressed raw binary' + echo ' linux.bin.ub - Create U-Boot wrapped raw binary' +- echo ' simpleImage.
- ELF image with $(arch)/boot/dts/
.dts linked in' +- echo ' - stripped elf with fdt blob' +- echo ' simpleImage.
.unstrip - full ELF image with fdt blob' +- echo ' *_defconfig - Select default config from arch/microblaze/configs' +- echo '' ++ echo ' simpleImage.
- Create the following images with
.dtb linked in' ++ echo ' simpleImage.
: raw image' ++ echo ' simpleImage.
.ub : raw image with U-Boot header' ++ echo ' simpleImage.
.unstrip: ELF (identical to vmlinux)' ++ echo ' simpleImage.
.strip : stripped ELF' + echo ' Targets with
embed a device tree blob inside the image' + echo ' These targets support board with firmware that does not' + echo ' support passing a device tree directly. Replace
with the' +diff --git a/arch/microblaze/boot/Makefile b/arch/microblaze/boot/Makefile +index 7c2f52d4a0e4..49dbd1063d71 100644 +--- a/arch/microblaze/boot/Makefile ++++ b/arch/microblaze/boot/Makefile +@@ -9,15 +9,12 @@ OBJCOPYFLAGS := -R .note -R .comment -R .note.gnu.build-id -O binary + + $(obj)/linux.bin: vmlinux FORCE + $(call if_changed,objcopy) +- @echo 'Kernel: $@ is ready' ' (#'`cat .version`')' + + $(obj)/linux.bin.ub: $(obj)/linux.bin FORCE + $(call if_changed,uimage) +- @echo 'Kernel: $@ is ready' ' (#'`cat .version`')' + + $(obj)/linux.bin.gz: $(obj)/linux.bin FORCE + $(call if_changed,gzip) +- @echo 'Kernel: $@ is ready' ' (#'`cat .version`')' + + quiet_cmd_cp = CP $< $@$2 + cmd_cp = cat $< >$@$2 || (rm -f $@ && echo false) +@@ -35,6 +32,5 @@ $(obj)/simpleImage.%: vmlinux FORCE + $(call if_changed,objcopy) + $(call if_changed,uimage) + $(call if_changed,strip,.strip) +- @echo 'Kernel: $(UIMAGE_OUT) is ready' ' (#'`cat .version`')' + + clean-files += simpleImage.*.unstrip linux.bin.ub dts/*.dtb +diff --git a/arch/openrisc/kernel/entry.S b/arch/openrisc/kernel/entry.S +index b16e95a4e875..1107d34e45bf 100644 +--- a/arch/openrisc/kernel/entry.S ++++ b/arch/openrisc/kernel/entry.S +@@ -184,7 +184,7 @@ handler: ;\ + * occured. in fact they never do. if you need them use + * values saved on stack (for SPR_EPC, SPR_ESR) or content + * of r4 (for SPR_EEAR). for details look at EXCEPTION_HANDLE() +- * in 'arch/or32/kernel/head.S' ++ * in 'arch/openrisc/kernel/head.S' + */ + + /* =====================================================[ exceptions] === */ +diff --git a/arch/openrisc/kernel/head.S b/arch/openrisc/kernel/head.S +index 90979acdf165..4d878d13b860 100644 +--- a/arch/openrisc/kernel/head.S ++++ b/arch/openrisc/kernel/head.S +@@ -1551,7 +1551,7 @@ _string_nl: + + /* + * .data section should be page aligned +- * (look into arch/or32/kernel/vmlinux.lds) ++ * (look into arch/openrisc/kernel/vmlinux.lds.S) + */ + .section .data,"aw" + .align 8192 +diff --git a/arch/powerpc/boot/dts/bamboo.dts b/arch/powerpc/boot/dts/bamboo.dts +index aa68911f6560..084b82ba7493 100644 +--- a/arch/powerpc/boot/dts/bamboo.dts ++++ b/arch/powerpc/boot/dts/bamboo.dts +@@ -268,8 +268,10 @@ + /* Outbound ranges, one memory and one IO, + * later cannot be changed. Chip supports a second + * IO range but we don't use it for now ++ * The chip also supports a larger memory range but ++ * it's not naturally aligned, so our code will break + */ +- ranges = <0x02000000 0x00000000 0xa0000000 0x00000000 0xa0000000 0x00000000 0x40000000 ++ ranges = <0x02000000 0x00000000 0xa0000000 0x00000000 0xa0000000 0x00000000 0x20000000 + 0x02000000 0x00000000 0x00000000 0x00000000 0xe0000000 0x00000000 0x00100000 + 0x01000000 0x00000000 0x00000000 0x00000000 0xe8000000 0x00000000 0x00010000>; + +diff --git a/arch/powerpc/include/asm/cputable.h b/arch/powerpc/include/asm/cputable.h +index 7e3ccf21830e..e4451b30d7e3 100644 +--- a/arch/powerpc/include/asm/cputable.h ++++ b/arch/powerpc/include/asm/cputable.h +@@ -45,6 +45,7 @@ extern int machine_check_e500(struct pt_regs *regs); + extern int machine_check_e200(struct pt_regs *regs); + extern int machine_check_47x(struct pt_regs *regs); + int machine_check_8xx(struct pt_regs *regs); ++int machine_check_83xx(struct pt_regs *regs); + + extern void cpu_down_flush_e500v2(void); + extern void cpu_down_flush_e500mc(void); +diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h +index b779f3ccd412..05f3c2b3aa0e 100644 +--- a/arch/powerpc/include/asm/reg.h ++++ b/arch/powerpc/include/asm/reg.h +@@ -733,6 +733,8 @@ + #define SRR1_PROGTRAP 0x00020000 /* Trap */ + #define SRR1_PROGADDR 0x00010000 /* SRR0 contains subsequent addr */ + ++#define SRR1_MCE_MCP 0x00080000 /* Machine check signal caused interrupt */ ++ + #define SPRN_HSRR0 0x13A /* Save/Restore Register 0 */ + #define SPRN_HSRR1 0x13B /* Save/Restore Register 1 */ + #define HSRR1_DENORM 0x00100000 /* Denorm exception */ +diff --git a/arch/powerpc/kernel/cputable.c b/arch/powerpc/kernel/cputable.c +index 760872916013..da4b0e379238 100644 +--- a/arch/powerpc/kernel/cputable.c ++++ b/arch/powerpc/kernel/cputable.c +@@ -1185,6 +1185,7 @@ static struct cpu_spec __initdata cpu_specs[] = { + .machine_check = machine_check_generic, + .platform = "ppc603", + }, ++#ifdef CONFIG_PPC_83xx + { /* e300c1 (a 603e core, plus some) on 83xx */ + .pvr_mask = 0x7fff0000, + .pvr_value = 0x00830000, +@@ -1195,7 +1196,7 @@ static struct cpu_spec __initdata cpu_specs[] = { + .icache_bsize = 32, + .dcache_bsize = 32, + .cpu_setup = __setup_cpu_603, +- .machine_check = machine_check_generic, ++ .machine_check = machine_check_83xx, + .platform = "ppc603", + }, + { /* e300c2 (an e300c1 core, plus some, minus FPU) on 83xx */ +@@ -1209,7 +1210,7 @@ static struct cpu_spec __initdata cpu_specs[] = { + .icache_bsize = 32, + .dcache_bsize = 32, + .cpu_setup = __setup_cpu_603, +- .machine_check = machine_check_generic, ++ .machine_check = machine_check_83xx, + .platform = "ppc603", + }, + { /* e300c3 (e300c1, plus one IU, half cache size) on 83xx */ +@@ -1223,7 +1224,7 @@ static struct cpu_spec __initdata cpu_specs[] = { + .icache_bsize = 32, + .dcache_bsize = 32, + .cpu_setup = __setup_cpu_603, +- .machine_check = machine_check_generic, ++ .machine_check = machine_check_83xx, + .num_pmcs = 4, + .oprofile_cpu_type = "ppc/e300", + .oprofile_type = PPC_OPROFILE_FSL_EMB, +@@ -1240,12 +1241,13 @@ static struct cpu_spec __initdata cpu_specs[] = { + .icache_bsize = 32, + .dcache_bsize = 32, + .cpu_setup = __setup_cpu_603, +- .machine_check = machine_check_generic, ++ .machine_check = machine_check_83xx, + .num_pmcs = 4, + .oprofile_cpu_type = "ppc/e300", + .oprofile_type = PPC_OPROFILE_FSL_EMB, + .platform = "ppc603", + }, ++#endif + { /* default match, we assume split I/D cache & TB (non-601)... */ + .pvr_mask = 0x00000000, + .pvr_value = 0x00000000, +diff --git a/arch/powerpc/kernel/prom.c b/arch/powerpc/kernel/prom.c +index f83056297441..d96b28415090 100644 +--- a/arch/powerpc/kernel/prom.c ++++ b/arch/powerpc/kernel/prom.c +@@ -128,7 +128,7 @@ static void __init move_device_tree(void) + p = __va(memblock_alloc(size, PAGE_SIZE)); + memcpy(p, initial_boot_params, size); + initial_boot_params = p; +- DBG("Moved device tree to 0x%p\n", p); ++ DBG("Moved device tree to 0x%px\n", p); + } + + DBG("<- move_device_tree\n"); +@@ -662,7 +662,7 @@ void __init early_init_devtree(void *params) + { + phys_addr_t limit; + +- DBG(" -> early_init_devtree(%p)\n", params); ++ DBG(" -> early_init_devtree(%px)\n", params); + + /* Too early to BUG_ON(), do it by hand */ + if (!early_init_dt_verify(params)) +@@ -722,7 +722,7 @@ void __init early_init_devtree(void *params) + memblock_allow_resize(); + memblock_dump_all(); + +- DBG("Phys. mem: %llx\n", memblock_phys_mem_size()); ++ DBG("Phys. mem: %llx\n", (unsigned long long)memblock_phys_mem_size()); + + /* We may need to relocate the flat tree, do it now. + * FIXME .. and the initrd too? */ +diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c +index 52863deed65d..5fc8a010fdf0 100644 +--- a/arch/powerpc/mm/fault.c ++++ b/arch/powerpc/mm/fault.c +@@ -581,21 +581,22 @@ void bad_page_fault(struct pt_regs *regs, unsigned long address, int sig) + switch (regs->trap) { + case 0x300: + case 0x380: +- printk(KERN_ALERT "Unable to handle kernel paging request for " +- "data at address 0x%08lx\n", regs->dar); ++ pr_alert("BUG: %s at 0x%08lx\n", ++ regs->dar < PAGE_SIZE ? "Kernel NULL pointer dereference" : ++ "Unable to handle kernel data access", regs->dar); + break; + case 0x400: + case 0x480: +- printk(KERN_ALERT "Unable to handle kernel paging request for " +- "instruction fetch\n"); ++ pr_alert("BUG: Unable to handle kernel instruction fetch%s", ++ regs->nip < PAGE_SIZE ? " (NULL pointer?)\n" : "\n"); + break; + case 0x600: +- printk(KERN_ALERT "Unable to handle kernel paging request for " +- "unaligned access at address 0x%08lx\n", regs->dar); ++ pr_alert("BUG: Unable to handle kernel unaligned access at 0x%08lx\n", ++ regs->dar); + break; + default: +- printk(KERN_ALERT "Unable to handle kernel paging request for " +- "unknown fault\n"); ++ pr_alert("BUG: Unable to handle unknown paging fault at 0x%08lx\n", ++ regs->dar); + break; + } + printk(KERN_ALERT "Faulting instruction address: 0x%08lx\n", +diff --git a/arch/powerpc/mm/ppc_mmu_32.c b/arch/powerpc/mm/ppc_mmu_32.c +index 2a049fb8523d..96c52271e9c2 100644 +--- a/arch/powerpc/mm/ppc_mmu_32.c ++++ b/arch/powerpc/mm/ppc_mmu_32.c +@@ -52,7 +52,7 @@ struct batrange { /* stores address ranges mapped by BATs */ + phys_addr_t v_block_mapped(unsigned long va) + { + int b; +- for (b = 0; b < 4; ++b) ++ for (b = 0; b < ARRAY_SIZE(bat_addrs); ++b) + if (va >= bat_addrs[b].start && va < bat_addrs[b].limit) + return bat_addrs[b].phys + (va - bat_addrs[b].start); + return 0; +@@ -64,7 +64,7 @@ phys_addr_t v_block_mapped(unsigned long va) + unsigned long p_block_mapped(phys_addr_t pa) + { + int b; +- for (b = 0; b < 4; ++b) ++ for (b = 0; b < ARRAY_SIZE(bat_addrs); ++b) + if (pa >= bat_addrs[b].phys + && pa < (bat_addrs[b].limit-bat_addrs[b].start) + +bat_addrs[b].phys) +diff --git a/arch/powerpc/perf/isa207-common.c b/arch/powerpc/perf/isa207-common.c +index cf9c35aa0cf4..7ecea7143e58 100644 +--- a/arch/powerpc/perf/isa207-common.c ++++ b/arch/powerpc/perf/isa207-common.c +@@ -150,6 +150,14 @@ static bool is_thresh_cmp_valid(u64 event) + return true; + } + ++static unsigned int dc_ic_rld_quad_l1_sel(u64 event) ++{ ++ unsigned int cache; ++ ++ cache = (event >> EVENT_CACHE_SEL_SHIFT) & MMCR1_DC_IC_QUAL_MASK; ++ return cache; ++} ++ + static inline u64 isa207_find_source(u64 idx, u32 sub_idx) + { + u64 ret = PERF_MEM_NA; +@@ -290,10 +298,10 @@ int isa207_get_constraint(u64 event, unsigned long *maskp, unsigned long *valp) + * have a cache selector of zero. The bank selector (bit 3) is + * irrelevant, as long as the rest of the value is 0. + */ +- if (cache & 0x7) ++ if (!cpu_has_feature(CPU_FTR_ARCH_300) && (cache & 0x7)) + return -1; + +- } else if (event & EVENT_IS_L1) { ++ } else if (cpu_has_feature(CPU_FTR_ARCH_300) || (event & EVENT_IS_L1)) { + mask |= CNST_L1_QUAL_MASK; + value |= CNST_L1_QUAL_VAL(cache); + } +@@ -396,11 +404,14 @@ int isa207_compute_mmcr(u64 event[], int n_ev, + /* In continuous sampling mode, update SDAR on TLB miss */ + mmcra_sdar_mode(event[i], &mmcra); + +- if (event[i] & EVENT_IS_L1) { +- cache = event[i] >> EVENT_CACHE_SEL_SHIFT; +- mmcr1 |= (cache & 1) << MMCR1_IC_QUAL_SHIFT; +- cache >>= 1; +- mmcr1 |= (cache & 1) << MMCR1_DC_QUAL_SHIFT; ++ if (cpu_has_feature(CPU_FTR_ARCH_300)) { ++ cache = dc_ic_rld_quad_l1_sel(event[i]); ++ mmcr1 |= (cache) << MMCR1_DC_IC_QUAL_SHIFT; ++ } else { ++ if (event[i] & EVENT_IS_L1) { ++ cache = dc_ic_rld_quad_l1_sel(event[i]); ++ mmcr1 |= (cache) << MMCR1_DC_IC_QUAL_SHIFT; ++ } + } + + if (is_event_marked(event[i])) { +diff --git a/arch/powerpc/perf/isa207-common.h b/arch/powerpc/perf/isa207-common.h +index 6c737d675792..493e5cc5fa8a 100644 +--- a/arch/powerpc/perf/isa207-common.h ++++ b/arch/powerpc/perf/isa207-common.h +@@ -232,8 +232,8 @@ + #define MMCR1_COMBINE_SHIFT(pmc) (35 - ((pmc) - 1)) + #define MMCR1_PMCSEL_SHIFT(pmc) (24 - (((pmc) - 1)) * 8) + #define MMCR1_FAB_SHIFT 36 +-#define MMCR1_DC_QUAL_SHIFT 47 +-#define MMCR1_IC_QUAL_SHIFT 46 ++#define MMCR1_DC_IC_QUAL_MASK 0x3 ++#define MMCR1_DC_IC_QUAL_SHIFT 46 + + /* MMCR1 Combine bits macro for power9 */ + #define p9_MMCR1_COMBINE_SHIFT(pmc) (38 - ((pmc - 1) * 2)) +diff --git a/arch/powerpc/platforms/83xx/misc.c b/arch/powerpc/platforms/83xx/misc.c +index d75c9816a5c9..2b6589fe812d 100644 +--- a/arch/powerpc/platforms/83xx/misc.c ++++ b/arch/powerpc/platforms/83xx/misc.c +@@ -14,6 +14,7 @@ + #include + #include + ++#include + #include + #include + #include +@@ -150,3 +151,19 @@ void __init mpc83xx_setup_arch(void) + + mpc83xx_setup_pci(); + } ++ ++int machine_check_83xx(struct pt_regs *regs) ++{ ++ u32 mask = 1 << (31 - IPIC_MCP_WDT); ++ ++ if (!(regs->msr & SRR1_MCE_MCP) || !(ipic_get_mcp_status() & mask)) ++ return machine_check_generic(regs); ++ ipic_clear_mcp_status(mask); ++ ++ if (debugger_fault_handler(regs)) ++ return 1; ++ ++ die("Watchdog NMI Reset", regs, 0); ++ ++ return 1; ++} +diff --git a/arch/powerpc/platforms/powernv/eeh-powernv.c b/arch/powerpc/platforms/powernv/eeh-powernv.c +index 8864065eba22..fa2965c96155 100644 +--- a/arch/powerpc/platforms/powernv/eeh-powernv.c ++++ b/arch/powerpc/platforms/powernv/eeh-powernv.c +@@ -548,8 +548,8 @@ static void pnv_eeh_get_phb_diag(struct eeh_pe *pe) + static int pnv_eeh_get_phb_state(struct eeh_pe *pe) + { + struct pnv_phb *phb = pe->phb->private_data; +- u8 fstate; +- __be16 pcierr; ++ u8 fstate = 0; ++ __be16 pcierr = 0; + s64 rc; + int result = 0; + +@@ -587,8 +587,8 @@ static int pnv_eeh_get_phb_state(struct eeh_pe *pe) + static int pnv_eeh_get_pe_state(struct eeh_pe *pe) + { + struct pnv_phb *phb = pe->phb->private_data; +- u8 fstate; +- __be16 pcierr; ++ u8 fstate = 0; ++ __be16 pcierr = 0; + s64 rc; + int result; + +diff --git a/arch/powerpc/platforms/powernv/pci-ioda.c b/arch/powerpc/platforms/powernv/pci-ioda.c +index ddef22e00ddd..d3d5796f7df6 100644 +--- a/arch/powerpc/platforms/powernv/pci-ioda.c ++++ b/arch/powerpc/platforms/powernv/pci-ioda.c +@@ -598,8 +598,8 @@ static int pnv_ioda_unfreeze_pe(struct pnv_phb *phb, int pe_no, int opt) + static int pnv_ioda_get_pe_state(struct pnv_phb *phb, int pe_no) + { + struct pnv_ioda_pe *slave, *pe; +- u8 fstate, state; +- __be16 pcierr; ++ u8 fstate = 0, state; ++ __be16 pcierr = 0; + s64 rc; + + /* Sanity check on PE number */ +diff --git a/arch/powerpc/platforms/powernv/pci.c b/arch/powerpc/platforms/powernv/pci.c +index 5422f4a6317c..e2d031a3ec15 100644 +--- a/arch/powerpc/platforms/powernv/pci.c ++++ b/arch/powerpc/platforms/powernv/pci.c +@@ -600,8 +600,8 @@ static void pnv_pci_handle_eeh_config(struct pnv_phb *phb, u32 pe_no) + static void pnv_pci_config_check_eeh(struct pci_dn *pdn) + { + struct pnv_phb *phb = pdn->phb->private_data; +- u8 fstate; +- __be16 pcierr; ++ u8 fstate = 0; ++ __be16 pcierr = 0; + unsigned int pe_no; + s64 rc; + +diff --git a/arch/powerpc/platforms/pseries/dlpar.c b/arch/powerpc/platforms/pseries/dlpar.c +index f4e6565dd7a9..fb2876a84fbe 100644 +--- a/arch/powerpc/platforms/pseries/dlpar.c ++++ b/arch/powerpc/platforms/pseries/dlpar.c +@@ -63,6 +63,10 @@ static struct property *dlpar_parse_cc_property(struct cc_workarea *ccwa) + + name = (char *)ccwa + be32_to_cpu(ccwa->name_offset); + prop->name = kstrdup(name, GFP_KERNEL); ++ if (!prop->name) { ++ dlpar_free_cc_property(prop); ++ return NULL; ++ } + + prop->length = be32_to_cpu(ccwa->prop_length); + value = (char *)ccwa + be32_to_cpu(ccwa->prop_offset); +diff --git a/arch/powerpc/platforms/pseries/hotplug-memory.c b/arch/powerpc/platforms/pseries/hotplug-memory.c +index 99a3cf51c5ba..fdfce7a46d73 100644 +--- a/arch/powerpc/platforms/pseries/hotplug-memory.c ++++ b/arch/powerpc/platforms/pseries/hotplug-memory.c +@@ -295,6 +295,7 @@ static u32 lookup_lmb_associativity_index(struct of_drconf_cell *lmb) + + aa_index = find_aa_index(dr_node, ala_prop, lmb_assoc); + ++ of_node_put(dr_node); + dlpar_free_cc_nodes(lmb_node); + return aa_index; + } +diff --git a/arch/powerpc/xmon/xmon.c b/arch/powerpc/xmon/xmon.c +index 5a739588aa50..51a53fd51722 100644 +--- a/arch/powerpc/xmon/xmon.c ++++ b/arch/powerpc/xmon/xmon.c +@@ -3293,7 +3293,7 @@ void dump_segments(void) + + printf("sr0-15 ="); + for (i = 0; i < 16; ++i) +- printf(" %x", mfsrin(i)); ++ printf(" %x", mfsrin(i << 28)); + printf("\n"); + } + #endif +diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c +index ff62a4fe2159..91c24e87fe10 100644 +--- a/arch/s390/kvm/kvm-s390.c ++++ b/arch/s390/kvm/kvm-s390.c +@@ -361,19 +361,30 @@ static void kvm_s390_cpu_feat_init(void) + + int kvm_arch_init(void *opaque) + { ++ int rc; ++ + kvm_s390_dbf = debug_register("kvm-trace", 32, 1, 7 * sizeof(long)); + if (!kvm_s390_dbf) + return -ENOMEM; + + if (debug_register_view(kvm_s390_dbf, &debug_sprintf_view)) { +- debug_unregister(kvm_s390_dbf); +- return -ENOMEM; ++ rc = -ENOMEM; ++ goto out_debug_unreg; + } + + kvm_s390_cpu_feat_init(); + + /* Register floating interrupt controller interface. */ +- return kvm_register_device_ops(&kvm_flic_ops, KVM_DEV_TYPE_FLIC); ++ rc = kvm_register_device_ops(&kvm_flic_ops, KVM_DEV_TYPE_FLIC); ++ if (rc) { ++ pr_err("Failed to register FLIC rc=%d\n", rc); ++ goto out_debug_unreg; ++ } ++ return 0; ++ ++out_debug_unreg: ++ debug_unregister(kvm_s390_dbf); ++ return rc; + } + + void kvm_arch_exit(void) +diff --git a/arch/s390/mm/gup.c b/arch/s390/mm/gup.c +index 05c8abd864f1..9bce54eac0b0 100644 +--- a/arch/s390/mm/gup.c ++++ b/arch/s390/mm/gup.c +@@ -39,7 +39,8 @@ static inline int gup_pte_range(pmd_t *pmdp, pmd_t pmd, unsigned long addr, + VM_BUG_ON(!pfn_valid(pte_pfn(pte))); + page = pte_page(pte); + head = compound_head(page); +- if (!page_cache_get_speculative(head)) ++ if (unlikely(WARN_ON_ONCE(page_ref_count(head) < 0) ++ || !page_cache_get_speculative(head))) + return 0; + if (unlikely(pte_val(pte) != pte_val(*ptep))) { + put_page(head); +@@ -77,7 +78,8 @@ static inline int gup_huge_pmd(pmd_t *pmdp, pmd_t pmd, unsigned long addr, + refs++; + } while (addr += PAGE_SIZE, addr != end); + +- if (!page_cache_add_speculative(head, refs)) { ++ if (unlikely(WARN_ON_ONCE(page_ref_count(head) < 0) ++ || !page_cache_add_speculative(head, refs))) { + *nr -= refs; + return 0; + } +@@ -151,7 +153,8 @@ static int gup_huge_pud(pud_t *pudp, pud_t pud, unsigned long addr, + refs++; + } while (addr += PAGE_SIZE, addr != end); + +- if (!page_cache_add_speculative(head, refs)) { ++ if (unlikely(WARN_ON_ONCE(page_ref_count(head) < 0) ++ || !page_cache_add_speculative(head, refs))) { + *nr -= refs; + return 0; + } +diff --git a/arch/um/Kconfig.debug b/arch/um/Kconfig.debug +index 967d3109689f..39d44bfb241d 100644 +--- a/arch/um/Kconfig.debug ++++ b/arch/um/Kconfig.debug +@@ -19,6 +19,7 @@ config GPROF + config GCOV + bool "Enable gcov support" + depends on DEBUG_INFO ++ depends on !KCOV + help + This option allows developers to retrieve coverage data from a UML + session. +diff --git a/arch/x86/kernel/cpu/intel_rdt_ctrlmondata.c b/arch/x86/kernel/cpu/intel_rdt_ctrlmondata.c +index f6ea94f8954a..f892cb0b485e 100644 +--- a/arch/x86/kernel/cpu/intel_rdt_ctrlmondata.c ++++ b/arch/x86/kernel/cpu/intel_rdt_ctrlmondata.c +@@ -313,6 +313,10 @@ int rdtgroup_mondata_show(struct seq_file *m, void *arg) + int ret = 0; + + rdtgrp = rdtgroup_kn_lock_live(of->kn); ++ if (!rdtgrp) { ++ ret = -ENOENT; ++ goto out; ++ } + + md.priv = of->kn->priv; + resid = md.u.rid; +diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c +index f67fc0f359ff..c579cda1721e 100644 +--- a/arch/x86/kvm/vmx.c ++++ b/arch/x86/kvm/vmx.c +@@ -2818,9 +2818,6 @@ static void setup_msrs(struct vcpu_vmx *vmx) + index = __find_msr_index(vmx, MSR_CSTAR); + if (index >= 0) + move_msr_up(vmx, index, save_nmsrs++); +- index = __find_msr_index(vmx, MSR_TSC_AUX); +- if (index >= 0 && guest_cpuid_has(&vmx->vcpu, X86_FEATURE_RDTSCP)) +- move_msr_up(vmx, index, save_nmsrs++); + /* + * MSR_STAR is only needed on long mode guests, and only + * if efer.sce is enabled. +@@ -2833,6 +2830,9 @@ static void setup_msrs(struct vcpu_vmx *vmx) + index = __find_msr_index(vmx, MSR_EFER); + if (index >= 0 && update_transition_efer(vmx, index)) + move_msr_up(vmx, index, save_nmsrs++); ++ index = __find_msr_index(vmx, MSR_TSC_AUX); ++ if (index >= 0 && guest_cpuid_has(&vmx->vcpu, X86_FEATURE_RDTSCP)) ++ move_msr_up(vmx, index, save_nmsrs++); + + vmx->save_nmsrs = save_nmsrs; + +@@ -10000,10 +10000,6 @@ static void vmx_switch_vmcs(struct kvm_vcpu *vcpu, struct loaded_vmcs *vmcs) + vmx_vcpu_load(vcpu, cpu); + vcpu->cpu = cpu; + put_cpu(); +- +- vm_entry_controls_reset_shadow(vmx); +- vm_exit_controls_reset_shadow(vmx); +- vmx_segment_cache_clear(vmx); + } + + /* +@@ -11432,6 +11428,7 @@ static int enter_vmx_non_root_mode(struct kvm_vcpu *vcpu, bool from_vmentry) + vmx->nested.vmcs01_debugctl = vmcs_read64(GUEST_IA32_DEBUGCTL); + + vmx_switch_vmcs(vcpu, &vmx->nested.vmcs02); ++ vmx_segment_cache_clear(vmx); + + if (prepare_vmcs02(vcpu, vmcs12, from_vmentry, &exit_qual)) { + leave_guest_mode(vcpu); +@@ -12175,6 +12172,9 @@ static void nested_vmx_vmexit(struct kvm_vcpu *vcpu, u32 exit_reason, + } + + vmx_switch_vmcs(vcpu, &vmx->vmcs01); ++ vm_entry_controls_reset_shadow(vmx); ++ vm_exit_controls_reset_shadow(vmx); ++ vmx_segment_cache_clear(vmx); + + /* Update any VMCS fields that might have changed while L2 ran */ + vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, vmx->msr_autoload.host.nr); +diff --git a/arch/x86/xen/xen-asm_64.S b/arch/x86/xen/xen-asm_64.S +index 3a6feed76dfc..a93d8a7cef26 100644 +--- a/arch/x86/xen/xen-asm_64.S ++++ b/arch/x86/xen/xen-asm_64.S +@@ -12,6 +12,7 @@ + #include + #include + #include ++#include + + #include + +@@ -24,6 +25,7 @@ ENTRY(xen_\name) + pop %r11 + jmp \name + END(xen_\name) ++_ASM_NOKPROBE(xen_\name) + .endm + + xen_pv_trap divide_error +diff --git a/crypto/crypto_user.c b/crypto/crypto_user.c +index 2b8fb8f1391e..5e457a7dd1c9 100644 +--- a/crypto/crypto_user.c ++++ b/crypto/crypto_user.c +@@ -296,30 +296,33 @@ drop_alg: + + static int crypto_dump_report(struct sk_buff *skb, struct netlink_callback *cb) + { +- struct crypto_alg *alg; ++ const size_t start_pos = cb->args[0]; ++ size_t pos = 0; + struct crypto_dump_info info; +- int err; +- +- if (cb->args[0]) +- goto out; +- +- cb->args[0] = 1; ++ struct crypto_alg *alg; ++ int res; + + info.in_skb = cb->skb; + info.out_skb = skb; + info.nlmsg_seq = cb->nlh->nlmsg_seq; + info.nlmsg_flags = NLM_F_MULTI; + ++ down_read(&crypto_alg_sem); + list_for_each_entry(alg, &crypto_alg_list, cra_list) { +- err = crypto_report_alg(alg, &info); +- if (err) +- goto out_err; ++ if (pos >= start_pos) { ++ res = crypto_report_alg(alg, &info); ++ if (res == -EMSGSIZE) ++ break; ++ if (res) ++ goto out; ++ } ++ pos++; + } +- ++ cb->args[0] = pos; ++ res = skb->len; + out: +- return skb->len; +-out_err: +- return err; ++ up_read(&crypto_alg_sem); ++ return res; + } + + static int crypto_dump_report_done(struct netlink_callback *cb) +@@ -503,7 +506,7 @@ static int crypto_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, + if ((type == (CRYPTO_MSG_GETALG - CRYPTO_MSG_BASE) && + (nlh->nlmsg_flags & NLM_F_DUMP))) { + struct crypto_alg *alg; +- u16 dump_alloc = 0; ++ unsigned long dump_alloc = 0; + + if (link->dump == NULL) + return -EINVAL; +@@ -511,16 +514,16 @@ static int crypto_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, + down_read(&crypto_alg_sem); + list_for_each_entry(alg, &crypto_alg_list, cra_list) + dump_alloc += CRYPTO_REPORT_MAXSIZE; ++ up_read(&crypto_alg_sem); + + { + struct netlink_dump_control c = { + .dump = link->dump, + .done = link->done, +- .min_dump_alloc = dump_alloc, ++ .min_dump_alloc = min(dump_alloc, 65535UL), + }; + err = netlink_dump_start(crypto_nlsk, skb, nlh, &c); + } +- up_read(&crypto_alg_sem); + + return err; + } +diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c +index 1ab8d7223b25..84b1d30f699c 100644 +--- a/drivers/acpi/acpi_lpss.c ++++ b/drivers/acpi/acpi_lpss.c +@@ -518,12 +518,7 @@ static int acpi_lpss_create_device(struct acpi_device *adev, + * have _PS0 and _PS3 without _PSC (and no power resources), so + * acpi_bus_init_power() will assume that the BIOS has put them into D0. + */ +- ret = acpi_device_fix_up_power(adev); +- if (ret) { +- /* Skip the device, but continue the namespace scan. */ +- ret = 0; +- goto err_out; +- } ++ acpi_device_fix_up_power(adev); + + adev->driver_data = pdata; + pdev = acpi_create_platform_device(adev, dev_desc->properties); +diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c +index 5889f6407fea..cd6fae6ad4c2 100644 +--- a/drivers/acpi/apei/ghes.c ++++ b/drivers/acpi/apei/ghes.c +@@ -33,7 +33,6 @@ + #include + #include + #include +-#include + #include + #include + #include +@@ -171,40 +170,40 @@ static int ghes_estatus_pool_init(void) + return 0; + } + +-static void ghes_estatus_pool_free_chunk_page(struct gen_pool *pool, ++static void ghes_estatus_pool_free_chunk(struct gen_pool *pool, + struct gen_pool_chunk *chunk, + void *data) + { +- free_page(chunk->start_addr); ++ vfree((void *)chunk->start_addr); + } + + static void ghes_estatus_pool_exit(void) + { + gen_pool_for_each_chunk(ghes_estatus_pool, +- ghes_estatus_pool_free_chunk_page, NULL); ++ ghes_estatus_pool_free_chunk, NULL); + gen_pool_destroy(ghes_estatus_pool); + } + + static int ghes_estatus_pool_expand(unsigned long len) + { +- unsigned long i, pages, size, addr; +- int ret; ++ unsigned long size, addr; + + ghes_estatus_pool_size_request += PAGE_ALIGN(len); + size = gen_pool_size(ghes_estatus_pool); + if (size >= ghes_estatus_pool_size_request) + return 0; +- pages = (ghes_estatus_pool_size_request - size) / PAGE_SIZE; +- for (i = 0; i < pages; i++) { +- addr = __get_free_page(GFP_KERNEL); +- if (!addr) +- return -ENOMEM; +- ret = gen_pool_add(ghes_estatus_pool, addr, PAGE_SIZE, -1); +- if (ret) +- return ret; +- } + +- return 0; ++ addr = (unsigned long)vmalloc(PAGE_ALIGN(len)); ++ if (!addr) ++ return -ENOMEM; ++ ++ /* ++ * New allocation must be visible in all pgd before it can be found by ++ * an NMI allocating from the pool. ++ */ ++ vmalloc_sync_all(); ++ ++ return gen_pool_add(ghes_estatus_pool, addr, PAGE_ALIGN(len), -1); + } + + static int map_gen_v2(struct ghes *ghes) +@@ -936,7 +935,6 @@ static int ghes_notify_nmi(unsigned int cmd, struct pt_regs *regs) + + sev = ghes_severity(ghes->estatus->error_severity); + if (sev >= GHES_SEV_PANIC) { +- oops_begin(); + ghes_print_queued_estatus(); + __ghes_panic(ghes); + } +diff --git a/drivers/base/platform.c b/drivers/base/platform.c +index 9045c5f3734e..f1105de0d9fe 100644 +--- a/drivers/base/platform.c ++++ b/drivers/base/platform.c +@@ -27,6 +27,7 @@ + #include + #include + #include ++#include + + #include "base.h" + #include "power/power.h" +@@ -526,6 +527,8 @@ struct platform_device *platform_device_register_full( + if (!pdev->dev.dma_mask) + goto err; + ++ kmemleak_ignore(pdev->dev.dma_mask); ++ + *pdev->dev.dma_mask = pdevinfo->dma_mask; + pdev->dev.coherent_dma_mask = pdevinfo->dma_mask; + } +diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c +index 8cb3791898ae..7ea13b5497fd 100644 +--- a/drivers/block/drbd/drbd_main.c ++++ b/drivers/block/drbd/drbd_main.c +@@ -795,7 +795,6 @@ int __drbd_send_protocol(struct drbd_connection *connection, enum drbd_packet cm + + if (nc->tentative && connection->agreed_pro_version < 92) { + rcu_read_unlock(); +- mutex_unlock(&sock->mutex); + drbd_err(connection, "--dry-run is not supported by peer"); + return -EOPNOTSUPP; + } +diff --git a/drivers/block/drbd/drbd_nl.c b/drivers/block/drbd/drbd_nl.c +index ad13ec66c8e4..31d7fe4480af 100644 +--- a/drivers/block/drbd/drbd_nl.c ++++ b/drivers/block/drbd/drbd_nl.c +@@ -1515,6 +1515,30 @@ static void sanitize_disk_conf(struct drbd_device *device, struct disk_conf *dis + } + } + ++static int disk_opts_check_al_size(struct drbd_device *device, struct disk_conf *dc) ++{ ++ int err = -EBUSY; ++ ++ if (device->act_log && ++ device->act_log->nr_elements == dc->al_extents) ++ return 0; ++ ++ drbd_suspend_io(device); ++ /* If IO completion is currently blocked, we would likely wait ++ * "forever" for the activity log to become unused. So we don't. */ ++ if (atomic_read(&device->ap_bio_cnt)) ++ goto out; ++ ++ wait_event(device->al_wait, lc_try_lock(device->act_log)); ++ drbd_al_shrink(device); ++ err = drbd_check_al_size(device, dc); ++ lc_unlock(device->act_log); ++ wake_up(&device->al_wait); ++out: ++ drbd_resume_io(device); ++ return err; ++} ++ + int drbd_adm_disk_opts(struct sk_buff *skb, struct genl_info *info) + { + struct drbd_config_context adm_ctx; +@@ -1577,15 +1601,12 @@ int drbd_adm_disk_opts(struct sk_buff *skb, struct genl_info *info) + } + } + +- drbd_suspend_io(device); +- wait_event(device->al_wait, lc_try_lock(device->act_log)); +- drbd_al_shrink(device); +- err = drbd_check_al_size(device, new_disk_conf); +- lc_unlock(device->act_log); +- wake_up(&device->al_wait); +- drbd_resume_io(device); +- ++ err = disk_opts_check_al_size(device, new_disk_conf); + if (err) { ++ /* Could be just "busy". Ignore? ++ * Introduce dedicated error code? */ ++ drbd_msg_put_info(adm_ctx.reply_skb, ++ "Try again without changing current al-extents setting"); + retcode = ERR_NOMEM; + goto fail_unlock; + } +@@ -1935,9 +1956,9 @@ int drbd_adm_attach(struct sk_buff *skb, struct genl_info *info) + } + } + +- if (device->state.conn < C_CONNECTED && +- device->state.role == R_PRIMARY && device->ed_uuid && +- (device->ed_uuid & ~((u64)1)) != (nbc->md.uuid[UI_CURRENT] & ~((u64)1))) { ++ if (device->state.pdsk != D_UP_TO_DATE && device->ed_uuid && ++ (device->state.role == R_PRIMARY || device->state.peer == R_PRIMARY) && ++ (device->ed_uuid & ~((u64)1)) != (nbc->md.uuid[UI_CURRENT] & ~((u64)1))) { + drbd_err(device, "Can only attach to data with current UUID=%016llX\n", + (unsigned long long)device->ed_uuid); + retcode = ERR_DATA_NOT_CURRENT; +diff --git a/drivers/block/drbd/drbd_receiver.c b/drivers/block/drbd/drbd_receiver.c +index 8fbdfaacc222..a7c180426c60 100644 +--- a/drivers/block/drbd/drbd_receiver.c ++++ b/drivers/block/drbd/drbd_receiver.c +@@ -3977,6 +3977,7 @@ static int receive_sizes(struct drbd_connection *connection, struct packet_info + struct o_qlim *o = (connection->agreed_features & DRBD_FF_WSAME) ? p->qlim : NULL; + enum determine_dev_size dd = DS_UNCHANGED; + sector_t p_size, p_usize, p_csize, my_usize; ++ sector_t new_size, cur_size; + int ldsc = 0; /* local disk size changed */ + enum dds_flags ddsf; + +@@ -3984,6 +3985,7 @@ static int receive_sizes(struct drbd_connection *connection, struct packet_info + if (!peer_device) + return config_unknown_volume(connection, pi); + device = peer_device->device; ++ cur_size = drbd_get_capacity(device->this_bdev); + + p_size = be64_to_cpu(p->d_size); + p_usize = be64_to_cpu(p->u_size); +@@ -3994,7 +3996,6 @@ static int receive_sizes(struct drbd_connection *connection, struct packet_info + device->p_size = p_size; + + if (get_ldev(device)) { +- sector_t new_size, cur_size; + rcu_read_lock(); + my_usize = rcu_dereference(device->ldev->disk_conf)->disk_size; + rcu_read_unlock(); +@@ -4012,7 +4013,6 @@ static int receive_sizes(struct drbd_connection *connection, struct packet_info + /* Never shrink a device with usable data during connect. + But allow online shrinking if we are connected. */ + new_size = drbd_new_dev_size(device, device->ldev, p_usize, 0); +- cur_size = drbd_get_capacity(device->this_bdev); + if (new_size < cur_size && + device->state.disk >= D_OUTDATED && + device->state.conn < C_CONNECTED) { +@@ -4077,9 +4077,36 @@ static int receive_sizes(struct drbd_connection *connection, struct packet_info + * + * However, if he sends a zero current size, + * take his (user-capped or) backing disk size anyways. ++ * ++ * Unless of course he does not have a disk himself. ++ * In which case we ignore this completely. + */ ++ sector_t new_size = p_csize ?: p_usize ?: p_size; + drbd_reconsider_queue_parameters(device, NULL, o); +- drbd_set_my_capacity(device, p_csize ?: p_usize ?: p_size); ++ if (new_size == 0) { ++ /* Ignore, peer does not know nothing. */ ++ } else if (new_size == cur_size) { ++ /* nothing to do */ ++ } else if (cur_size != 0 && p_size == 0) { ++ drbd_warn(device, "Ignored diskless peer device size (peer:%llu != me:%llu sectors)!\n", ++ (unsigned long long)new_size, (unsigned long long)cur_size); ++ } else if (new_size < cur_size && device->state.role == R_PRIMARY) { ++ drbd_err(device, "The peer's device size is too small! (%llu < %llu sectors); demote me first!\n", ++ (unsigned long long)new_size, (unsigned long long)cur_size); ++ conn_request_state(peer_device->connection, NS(conn, C_DISCONNECTING), CS_HARD); ++ return -EIO; ++ } else { ++ /* I believe the peer, if ++ * - I don't have a current size myself ++ * - we agree on the size anyways ++ * - I do have a current size, am Secondary, ++ * and he has the only disk ++ * - I do have a current size, am Primary, ++ * and he has the only disk, ++ * which is larger than my current size ++ */ ++ drbd_set_my_capacity(device, new_size); ++ } + } + + if (get_ldev(device)) { +@@ -4365,6 +4392,25 @@ static int receive_state(struct drbd_connection *connection, struct packet_info + if (peer_state.conn == C_AHEAD) + ns.conn = C_BEHIND; + ++ /* TODO: ++ * if (primary and diskless and peer uuid != effective uuid) ++ * abort attach on peer; ++ * ++ * If this node does not have good data, was already connected, but ++ * the peer did a late attach only now, trying to "negotiate" with me, ++ * AND I am currently Primary, possibly frozen, with some specific ++ * "effective" uuid, this should never be reached, really, because ++ * we first send the uuids, then the current state. ++ * ++ * In this scenario, we already dropped the connection hard ++ * when we received the unsuitable uuids (receive_uuids(). ++ * ++ * Should we want to change this, that is: not drop the connection in ++ * receive_uuids() already, then we would need to add a branch here ++ * that aborts the attach of "unsuitable uuids" on the peer in case ++ * this node is currently Diskless Primary. ++ */ ++ + if (device->p_uuid && peer_state.disk >= D_NEGOTIATING && + get_ldev_if_state(device, D_NEGOTIATING)) { + int cr; /* consider resync */ +diff --git a/drivers/block/drbd/drbd_state.h b/drivers/block/drbd/drbd_state.h +index ea58301d0895..b2a390ba73a0 100644 +--- a/drivers/block/drbd/drbd_state.h ++++ b/drivers/block/drbd/drbd_state.h +@@ -131,7 +131,7 @@ extern enum drbd_state_rv _drbd_set_state(struct drbd_device *, union drbd_state + enum chg_state_flags, + struct completion *done); + extern void print_st_err(struct drbd_device *, union drbd_state, +- union drbd_state, int); ++ union drbd_state, enum drbd_state_rv); + + enum drbd_state_rv + _conn_request_state(struct drbd_connection *connection, union drbd_state mask, union drbd_state val, +diff --git a/drivers/bluetooth/hci_bcm.c b/drivers/bluetooth/hci_bcm.c +index 6d41b2023f09..61971ddbd231 100644 +--- a/drivers/bluetooth/hci_bcm.c ++++ b/drivers/bluetooth/hci_bcm.c +@@ -50,6 +50,12 @@ + #define BCM_LM_DIAG_PKT 0x07 + #define BCM_LM_DIAG_SIZE 63 + ++#define BCM_TYPE49_PKT 0x31 ++#define BCM_TYPE49_SIZE 0 ++ ++#define BCM_TYPE52_PKT 0x34 ++#define BCM_TYPE52_SIZE 0 ++ + #define BCM_AUTOSUSPEND_DELAY 5000 /* default autosleep delay */ + + /* platform device driver resources */ +@@ -483,12 +489,28 @@ finalize: + .lsize = 0, \ + .maxlen = BCM_NULL_SIZE + ++#define BCM_RECV_TYPE49 \ ++ .type = BCM_TYPE49_PKT, \ ++ .hlen = BCM_TYPE49_SIZE, \ ++ .loff = 0, \ ++ .lsize = 0, \ ++ .maxlen = BCM_TYPE49_SIZE ++ ++#define BCM_RECV_TYPE52 \ ++ .type = BCM_TYPE52_PKT, \ ++ .hlen = BCM_TYPE52_SIZE, \ ++ .loff = 0, \ ++ .lsize = 0, \ ++ .maxlen = BCM_TYPE52_SIZE ++ + static const struct h4_recv_pkt bcm_recv_pkts[] = { + { H4_RECV_ACL, .recv = hci_recv_frame }, + { H4_RECV_SCO, .recv = hci_recv_frame }, + { H4_RECV_EVENT, .recv = hci_recv_frame }, + { BCM_RECV_LM_DIAG, .recv = hci_recv_diag }, + { BCM_RECV_NULL, .recv = hci_recv_diag }, ++ { BCM_RECV_TYPE49, .recv = hci_recv_diag }, ++ { BCM_RECV_TYPE52, .recv = hci_recv_diag }, + }; + + static int bcm_recv(struct hci_uart *hu, const void *data, int count) +diff --git a/drivers/char/hw_random/stm32-rng.c b/drivers/char/hw_random/stm32-rng.c +index 83c695938a2d..f53d47e3355d 100644 +--- a/drivers/char/hw_random/stm32-rng.c ++++ b/drivers/char/hw_random/stm32-rng.c +@@ -166,6 +166,13 @@ static int stm32_rng_probe(struct platform_device *ofdev) + return devm_hwrng_register(dev, &priv->rng); + } + ++static int stm32_rng_remove(struct platform_device *ofdev) ++{ ++ pm_runtime_disable(&ofdev->dev); ++ ++ return 0; ++} ++ + #ifdef CONFIG_PM + static int stm32_rng_runtime_suspend(struct device *dev) + { +@@ -202,6 +209,7 @@ static struct platform_driver stm32_rng_driver = { + .of_match_table = stm32_rng_match, + }, + .probe = stm32_rng_probe, ++ .remove = stm32_rng_remove, + }; + + module_platform_driver(stm32_rng_driver); +diff --git a/drivers/clk/at91/clk-generated.c b/drivers/clk/at91/clk-generated.c +index 113152425a95..ea23002be4de 100644 +--- a/drivers/clk/at91/clk-generated.c ++++ b/drivers/clk/at91/clk-generated.c +@@ -284,7 +284,7 @@ static void clk_generated_startup(struct clk_generated *gck) + static struct clk_hw * __init + at91_clk_register_generated(struct regmap *regmap, spinlock_t *lock, + const char *name, const char **parent_names, +- u8 num_parents, u8 id, ++ u8 num_parents, u8 id, bool pll_audio, + const struct clk_range *range) + { + struct clk_generated *gck; +@@ -308,6 +308,7 @@ at91_clk_register_generated(struct regmap *regmap, spinlock_t *lock, + gck->regmap = regmap; + gck->lock = lock; + gck->range = *range; ++ gck->audio_pll_allowed = pll_audio; + + clk_generated_startup(gck); + hw = &gck->hw; +@@ -333,7 +334,6 @@ static void __init of_sama5d2_clk_generated_setup(struct device_node *np) + struct device_node *gcknp; + struct clk_range range = CLK_RANGE(0, 0); + struct regmap *regmap; +- struct clk_generated *gck; + + num_parents = of_clk_get_parent_count(np); + if (num_parents == 0 || num_parents > GENERATED_SOURCE_MAX) +@@ -350,6 +350,8 @@ static void __init of_sama5d2_clk_generated_setup(struct device_node *np) + return; + + for_each_child_of_node(np, gcknp) { ++ bool pll_audio = false; ++ + if (of_property_read_u32(gcknp, "reg", &id)) + continue; + +@@ -362,24 +364,14 @@ static void __init of_sama5d2_clk_generated_setup(struct device_node *np) + of_at91_get_clk_range(gcknp, "atmel,clk-output-range", + &range); + ++ if (of_device_is_compatible(np, "atmel,sama5d2-clk-generated") && ++ (id == GCK_ID_I2S0 || id == GCK_ID_I2S1 || ++ id == GCK_ID_CLASSD)) ++ pll_audio = true; ++ + hw = at91_clk_register_generated(regmap, &pmc_pcr_lock, name, + parent_names, num_parents, +- id, &range); +- +- gck = to_clk_generated(hw); +- +- if (of_device_is_compatible(np, +- "atmel,sama5d2-clk-generated")) { +- if (gck->id == GCK_ID_SSC0 || gck->id == GCK_ID_SSC1 || +- gck->id == GCK_ID_I2S0 || gck->id == GCK_ID_I2S1 || +- gck->id == GCK_ID_CLASSD) +- gck->audio_pll_allowed = true; +- else +- gck->audio_pll_allowed = false; +- } else { +- gck->audio_pll_allowed = false; +- } +- ++ id, pll_audio, &range); + if (IS_ERR(hw)) + continue; + +diff --git a/drivers/clk/at91/clk-main.c b/drivers/clk/at91/clk-main.c +index 2f97a843d6d6..90988e7a5b47 100644 +--- a/drivers/clk/at91/clk-main.c ++++ b/drivers/clk/at91/clk-main.c +@@ -162,7 +162,7 @@ at91_clk_register_main_osc(struct regmap *regmap, + if (bypass) + regmap_update_bits(regmap, + AT91_CKGR_MOR, MOR_KEY_MASK | +- AT91_PMC_MOSCEN, ++ AT91_PMC_OSCBYPASS, + AT91_PMC_OSCBYPASS | AT91_PMC_KEY); + + hw = &osc->hw; +@@ -354,7 +354,10 @@ static int clk_main_probe_frequency(struct regmap *regmap) + regmap_read(regmap, AT91_CKGR_MCFR, &mcfr); + if (mcfr & AT91_PMC_MAINRDY) + return 0; +- usleep_range(MAINF_LOOP_MIN_WAIT, MAINF_LOOP_MAX_WAIT); ++ if (system_state < SYSTEM_RUNNING) ++ udelay(MAINF_LOOP_MIN_WAIT); ++ else ++ usleep_range(MAINF_LOOP_MIN_WAIT, MAINF_LOOP_MAX_WAIT); + } while (time_before(prep_time, timeout)); + + return -ETIMEDOUT; +diff --git a/drivers/clk/at91/sckc.c b/drivers/clk/at91/sckc.c +index ab6ecefc49ad..43ba2a8b03fa 100644 +--- a/drivers/clk/at91/sckc.c ++++ b/drivers/clk/at91/sckc.c +@@ -74,7 +74,10 @@ static int clk_slow_osc_prepare(struct clk_hw *hw) + + writel(tmp | AT91_SCKC_OSC32EN, sckcr); + +- usleep_range(osc->startup_usec, osc->startup_usec + 1); ++ if (system_state < SYSTEM_RUNNING) ++ udelay(osc->startup_usec); ++ else ++ usleep_range(osc->startup_usec, osc->startup_usec + 1); + + return 0; + } +@@ -197,7 +200,10 @@ static int clk_slow_rc_osc_prepare(struct clk_hw *hw) + + writel(readl(sckcr) | AT91_SCKC_RCEN, sckcr); + +- usleep_range(osc->startup_usec, osc->startup_usec + 1); ++ if (system_state < SYSTEM_RUNNING) ++ udelay(osc->startup_usec); ++ else ++ usleep_range(osc->startup_usec, osc->startup_usec + 1); + + return 0; + } +@@ -310,7 +316,10 @@ static int clk_sam9x5_slow_set_parent(struct clk_hw *hw, u8 index) + + writel(tmp, sckcr); + +- usleep_range(SLOWCK_SW_TIME_USEC, SLOWCK_SW_TIME_USEC + 1); ++ if (system_state < SYSTEM_RUNNING) ++ udelay(SLOWCK_SW_TIME_USEC); ++ else ++ usleep_range(SLOWCK_SW_TIME_USEC, SLOWCK_SW_TIME_USEC + 1); + + return 0; + } +@@ -443,7 +452,10 @@ static int clk_sama5d4_slow_osc_prepare(struct clk_hw *hw) + return 0; + } + +- usleep_range(osc->startup_usec, osc->startup_usec + 1); ++ if (system_state < SYSTEM_RUNNING) ++ udelay(osc->startup_usec); ++ else ++ usleep_range(osc->startup_usec, osc->startup_usec + 1); + osc->prepared = true; + + return 0; +diff --git a/drivers/clk/meson/gxbb.c b/drivers/clk/meson/gxbb.c +index 92168348ffa6..f2d27addf485 100644 +--- a/drivers/clk/meson/gxbb.c ++++ b/drivers/clk/meson/gxbb.c +@@ -687,6 +687,7 @@ static struct clk_divider gxbb_sar_adc_clk_div = { + .ops = &clk_divider_ops, + .parent_names = (const char *[]){ "sar_adc_clk_sel" }, + .num_parents = 1, ++ .flags = CLK_SET_RATE_PARENT, + }, + }; + +diff --git a/drivers/clk/samsung/clk-exynos5420.c b/drivers/clk/samsung/clk-exynos5420.c +index a882f7038bce..47a14f93f869 100644 +--- a/drivers/clk/samsung/clk-exynos5420.c ++++ b/drivers/clk/samsung/clk-exynos5420.c +@@ -170,12 +170,18 @@ static const unsigned long exynos5x_clk_regs[] __initconst = { + GATE_BUS_CPU, + GATE_SCLK_CPU, + CLKOUT_CMU_CPU, ++ CPLL_CON0, ++ DPLL_CON0, + EPLL_CON0, + EPLL_CON1, + EPLL_CON2, + RPLL_CON0, + RPLL_CON1, + RPLL_CON2, ++ IPLL_CON0, ++ SPLL_CON0, ++ VPLL_CON0, ++ MPLL_CON0, + SRC_TOP0, + SRC_TOP1, + SRC_TOP2, +diff --git a/drivers/clk/sunxi-ng/ccu-sun9i-a80.c b/drivers/clk/sunxi-ng/ccu-sun9i-a80.c +index 8936ef87652c..c14bf782b2b3 100644 +--- a/drivers/clk/sunxi-ng/ccu-sun9i-a80.c ++++ b/drivers/clk/sunxi-ng/ccu-sun9i-a80.c +@@ -1231,7 +1231,7 @@ static int sun9i_a80_ccu_probe(struct platform_device *pdev) + + /* Enforce d1 = 0, d2 = 0 for Audio PLL */ + val = readl(reg + SUN9I_A80_PLL_AUDIO_REG); +- val &= (BIT(16) & BIT(18)); ++ val &= ~(BIT(16) | BIT(18)); + writel(val, reg + SUN9I_A80_PLL_AUDIO_REG); + + /* Enforce P = 1 for both CPU cluster PLLs */ +diff --git a/drivers/clk/ti/clk-dra7-atl.c b/drivers/clk/ti/clk-dra7-atl.c +index 148815470431..beb672a215b6 100644 +--- a/drivers/clk/ti/clk-dra7-atl.c ++++ b/drivers/clk/ti/clk-dra7-atl.c +@@ -174,7 +174,6 @@ static void __init of_dra7_atl_clock_setup(struct device_node *node) + struct clk_init_data init = { NULL }; + const char **parent_names = NULL; + struct clk *clk; +- int ret; + + clk_hw = kzalloc(sizeof(*clk_hw), GFP_KERNEL); + if (!clk_hw) { +@@ -207,11 +206,6 @@ static void __init of_dra7_atl_clock_setup(struct device_node *node) + clk = ti_clk_register(NULL, &clk_hw->hw, node->name); + + if (!IS_ERR(clk)) { +- ret = ti_clk_add_alias(NULL, clk, node->name); +- if (ret) { +- clk_unregister(clk); +- goto cleanup; +- } + of_clk_add_provider(node, of_clk_src_simple_get, clk); + kfree(parent_names); + return; +diff --git a/drivers/clocksource/timer-fttmr010.c b/drivers/clocksource/timer-fttmr010.c +index cdfe1c82f3f0..3928f3999015 100644 +--- a/drivers/clocksource/timer-fttmr010.c ++++ b/drivers/clocksource/timer-fttmr010.c +@@ -21,7 +21,7 @@ + #include + + /* +- * Register definitions for the timers ++ * Register definitions common for all the timer variants. + */ + #define TIMER1_COUNT (0x00) + #define TIMER1_LOAD (0x04) +@@ -36,9 +36,10 @@ + #define TIMER3_MATCH1 (0x28) + #define TIMER3_MATCH2 (0x2c) + #define TIMER_CR (0x30) +-#define TIMER_INTR_STATE (0x34) +-#define TIMER_INTR_MASK (0x38) + ++/* ++ * Control register (TMC30) bit fields for fttmr010/gemini/moxart timers. ++ */ + #define TIMER_1_CR_ENABLE BIT(0) + #define TIMER_1_CR_CLOCK BIT(1) + #define TIMER_1_CR_INT BIT(2) +@@ -53,8 +54,9 @@ + #define TIMER_3_CR_UPDOWN BIT(11) + + /* +- * The Aspeed AST2400 moves bits around in the control register +- * and lacks bits for setting the timer to count upwards. ++ * Control register (TMC30) bit fields for aspeed ast2400/ast2500 timers. ++ * The aspeed timers move bits around in the control register and lacks ++ * bits for setting the timer to count upwards. + */ + #define TIMER_1_CR_ASPEED_ENABLE BIT(0) + #define TIMER_1_CR_ASPEED_CLOCK BIT(1) +@@ -66,6 +68,18 @@ + #define TIMER_3_CR_ASPEED_CLOCK BIT(9) + #define TIMER_3_CR_ASPEED_INT BIT(10) + ++/* ++ * Interrupt status/mask register definitions for fttmr010/gemini/moxart ++ * timers. ++ * The registers don't exist and they are not needed on aspeed timers ++ * because: ++ * - aspeed timer overflow interrupt is controlled by bits in Control ++ * Register (TMC30). ++ * - aspeed timers always generate interrupt when either one of the ++ * Match registers equals to Status register. ++ */ ++#define TIMER_INTR_STATE (0x34) ++#define TIMER_INTR_MASK (0x38) + #define TIMER_1_INT_MATCH1 BIT(0) + #define TIMER_1_INT_MATCH2 BIT(1) + #define TIMER_1_INT_OVERFLOW BIT(2) +@@ -80,7 +94,7 @@ + struct fttmr010 { + void __iomem *base; + unsigned int tick_rate; +- bool count_down; ++ bool is_aspeed; + u32 t1_enable_val; + struct clock_event_device clkevt; + #ifdef CONFIG_ARM +@@ -130,7 +144,7 @@ static int fttmr010_timer_set_next_event(unsigned long cycles, + cr &= ~fttmr010->t1_enable_val; + writel(cr, fttmr010->base + TIMER_CR); + +- if (fttmr010->count_down) { ++ if (fttmr010->is_aspeed) { + /* + * ASPEED Timer Controller will load TIMER1_LOAD register + * into TIMER1_COUNT register when the timer is re-enabled. +@@ -175,16 +189,17 @@ static int fttmr010_timer_set_oneshot(struct clock_event_device *evt) + + /* Setup counter start from 0 or ~0 */ + writel(0, fttmr010->base + TIMER1_COUNT); +- if (fttmr010->count_down) ++ if (fttmr010->is_aspeed) { + writel(~0, fttmr010->base + TIMER1_LOAD); +- else ++ } else { + writel(0, fttmr010->base + TIMER1_LOAD); + +- /* Enable interrupt */ +- cr = readl(fttmr010->base + TIMER_INTR_MASK); +- cr &= ~(TIMER_1_INT_OVERFLOW | TIMER_1_INT_MATCH2); +- cr |= TIMER_1_INT_MATCH1; +- writel(cr, fttmr010->base + TIMER_INTR_MASK); ++ /* Enable interrupt */ ++ cr = readl(fttmr010->base + TIMER_INTR_MASK); ++ cr &= ~(TIMER_1_INT_OVERFLOW | TIMER_1_INT_MATCH2); ++ cr |= TIMER_1_INT_MATCH1; ++ writel(cr, fttmr010->base + TIMER_INTR_MASK); ++ } + + return 0; + } +@@ -201,9 +216,8 @@ static int fttmr010_timer_set_periodic(struct clock_event_device *evt) + writel(cr, fttmr010->base + TIMER_CR); + + /* Setup timer to fire at 1/HZ intervals. */ +- if (fttmr010->count_down) { ++ if (fttmr010->is_aspeed) { + writel(period, fttmr010->base + TIMER1_LOAD); +- writel(0, fttmr010->base + TIMER1_MATCH1); + } else { + cr = 0xffffffff - (period - 1); + writel(cr, fttmr010->base + TIMER1_COUNT); +@@ -281,23 +295,21 @@ static int __init fttmr010_common_init(struct device_node *np, bool is_aspeed) + } + + /* +- * The Aspeed AST2400 moves bits around in the control register, +- * otherwise it works the same. ++ * The Aspeed timers move bits around in the control register. + */ + if (is_aspeed) { + fttmr010->t1_enable_val = TIMER_1_CR_ASPEED_ENABLE | + TIMER_1_CR_ASPEED_INT; +- /* Downward not available */ +- fttmr010->count_down = true; ++ fttmr010->is_aspeed = true; + } else { + fttmr010->t1_enable_val = TIMER_1_CR_ENABLE | TIMER_1_CR_INT; +- } + +- /* +- * Reset the interrupt mask and status +- */ +- writel(TIMER_INT_ALL_MASK, fttmr010->base + TIMER_INTR_MASK); +- writel(0, fttmr010->base + TIMER_INTR_STATE); ++ /* ++ * Reset the interrupt mask and status ++ */ ++ writel(TIMER_INT_ALL_MASK, fttmr010->base + TIMER_INTR_MASK); ++ writel(0, fttmr010->base + TIMER_INTR_STATE); ++ } + + /* + * Enable timer 1 count up, timer 2 count up, except on Aspeed, +@@ -306,9 +318,8 @@ static int __init fttmr010_common_init(struct device_node *np, bool is_aspeed) + if (is_aspeed) + val = TIMER_2_CR_ASPEED_ENABLE; + else { +- val = TIMER_2_CR_ENABLE; +- if (!fttmr010->count_down) +- val |= TIMER_1_CR_UPDOWN | TIMER_2_CR_UPDOWN; ++ val = TIMER_2_CR_ENABLE | TIMER_1_CR_UPDOWN | ++ TIMER_2_CR_UPDOWN; + } + writel(val, fttmr010->base + TIMER_CR); + +@@ -321,7 +332,7 @@ static int __init fttmr010_common_init(struct device_node *np, bool is_aspeed) + writel(0, fttmr010->base + TIMER2_MATCH1); + writel(0, fttmr010->base + TIMER2_MATCH2); + +- if (fttmr010->count_down) { ++ if (fttmr010->is_aspeed) { + writel(~0, fttmr010->base + TIMER2_LOAD); + clocksource_mmio_init(fttmr010->base + TIMER2_COUNT, + "FTTMR010-TIMER2", +@@ -371,7 +382,7 @@ static int __init fttmr010_common_init(struct device_node *np, bool is_aspeed) + + #ifdef CONFIG_ARM + /* Also use this timer for delays */ +- if (fttmr010->count_down) ++ if (fttmr010->is_aspeed) + fttmr010->delay_timer.read_current_timer = + fttmr010_read_current_timer_down; + else +diff --git a/drivers/crypto/mxc-scc.c b/drivers/crypto/mxc-scc.c +index e01c46387df8..519086730791 100644 +--- a/drivers/crypto/mxc-scc.c ++++ b/drivers/crypto/mxc-scc.c +@@ -178,12 +178,12 @@ static int mxc_scc_get_data(struct mxc_scc_ctx *ctx, + else + from = scc->black_memory; + +- dev_dbg(scc->dev, "pcopy: from 0x%p %d bytes\n", from, ++ dev_dbg(scc->dev, "pcopy: from 0x%p %zu bytes\n", from, + ctx->dst_nents * 8); + len = sg_pcopy_from_buffer(ablkreq->dst, ctx->dst_nents, + from, ctx->size, ctx->offset); + if (!len) { +- dev_err(scc->dev, "pcopy err from 0x%p (len=%d)\n", from, len); ++ dev_err(scc->dev, "pcopy err from 0x%p (len=%zu)\n", from, len); + return -EINVAL; + } + +@@ -274,7 +274,7 @@ static int mxc_scc_put_data(struct mxc_scc_ctx *ctx, + len = sg_pcopy_to_buffer(req->src, ctx->src_nents, + to, len, ctx->offset); + if (!len) { +- dev_err(scc->dev, "pcopy err to 0x%p (len=%d)\n", to, len); ++ dev_err(scc->dev, "pcopy err to 0x%p (len=%zu)\n", to, len); + return -EINVAL; + } + +@@ -335,9 +335,9 @@ static void mxc_scc_ablkcipher_next(struct mxc_scc_ctx *ctx, + return; + } + +- dev_dbg(scc->dev, "Start encryption (0x%p/0x%p)\n", +- (void *)readl(scc->base + SCC_SCM_RED_START), +- (void *)readl(scc->base + SCC_SCM_BLACK_START)); ++ dev_dbg(scc->dev, "Start encryption (0x%x/0x%x)\n", ++ readl(scc->base + SCC_SCM_RED_START), ++ readl(scc->base + SCC_SCM_BLACK_START)); + + /* clear interrupt control registers */ + writel(SCC_SCM_INTR_CTRL_CLR_INTR, +diff --git a/drivers/crypto/stm32/stm32-hash.c b/drivers/crypto/stm32/stm32-hash.c +index 4835dd4a9e50..4909f820e953 100644 +--- a/drivers/crypto/stm32/stm32-hash.c ++++ b/drivers/crypto/stm32/stm32-hash.c +@@ -361,7 +361,7 @@ static int stm32_hash_xmit_cpu(struct stm32_hash_dev *hdev, + return -ETIMEDOUT; + + if ((hdev->flags & HASH_FLAGS_HMAC) && +- (hdev->flags & ~HASH_FLAGS_HMAC_KEY)) { ++ (!(hdev->flags & HASH_FLAGS_HMAC_KEY))) { + hdev->flags |= HASH_FLAGS_HMAC_KEY; + stm32_hash_write_key(hdev); + if (stm32_hash_wait_busy(hdev)) +diff --git a/drivers/gpu/ipu-v3/ipu-pre.c b/drivers/gpu/ipu-v3/ipu-pre.c +index 1d1612e28854..6fd4af647f59 100644 +--- a/drivers/gpu/ipu-v3/ipu-pre.c ++++ b/drivers/gpu/ipu-v3/ipu-pre.c +@@ -102,6 +102,7 @@ struct ipu_pre { + void *buffer_virt; + bool in_use; + unsigned int safe_window_end; ++ unsigned int last_bufaddr; + }; + + static DEFINE_MUTEX(ipu_pre_list_mutex); +@@ -177,6 +178,7 @@ void ipu_pre_configure(struct ipu_pre *pre, unsigned int width, + + writel(bufaddr, pre->regs + IPU_PRE_CUR_BUF); + writel(bufaddr, pre->regs + IPU_PRE_NEXT_BUF); ++ pre->last_bufaddr = bufaddr; + + val = IPU_PRE_PREF_ENG_CTRL_INPUT_PIXEL_FORMAT(0) | + IPU_PRE_PREF_ENG_CTRL_INPUT_ACTIVE_BPP(active_bpp) | +@@ -218,7 +220,11 @@ void ipu_pre_update(struct ipu_pre *pre, unsigned int bufaddr) + unsigned short current_yblock; + u32 val; + ++ if (bufaddr == pre->last_bufaddr) ++ return; ++ + writel(bufaddr, pre->regs + IPU_PRE_NEXT_BUF); ++ pre->last_bufaddr = bufaddr; + + do { + if (time_after(jiffies, timeout)) { +diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c +index 0b0fa257299d..0c547bf841f4 100644 +--- a/drivers/hid/hid-core.c ++++ b/drivers/hid/hid-core.c +@@ -195,6 +195,18 @@ static unsigned hid_lookup_collection(struct hid_parser *parser, unsigned type) + return 0; /* we know nothing about this usage type */ + } + ++/* ++ * Concatenate usage which defines 16 bits or less with the ++ * currently defined usage page to form a 32 bit usage ++ */ ++ ++static void complete_usage(struct hid_parser *parser, unsigned int index) ++{ ++ parser->local.usage[index] &= 0xFFFF; ++ parser->local.usage[index] |= ++ (parser->global.usage_page & 0xFFFF) << 16; ++} ++ + /* + * Add a usage to the temporary parser table. + */ +@@ -206,6 +218,14 @@ static int hid_add_usage(struct hid_parser *parser, unsigned usage, u8 size) + return -1; + } + parser->local.usage[parser->local.usage_index] = usage; ++ ++ /* ++ * If Usage item only includes usage id, concatenate it with ++ * currently defined usage page ++ */ ++ if (size <= 2) ++ complete_usage(parser, parser->local.usage_index); ++ + parser->local.usage_size[parser->local.usage_index] = size; + parser->local.collection_index[parser->local.usage_index] = + parser->collection_stack_ptr ? +@@ -522,13 +542,32 @@ static int hid_parser_local(struct hid_parser *parser, struct hid_item *item) + * usage value." + */ + +-static void hid_concatenate_usage_page(struct hid_parser *parser) ++static void hid_concatenate_last_usage_page(struct hid_parser *parser) + { + int i; ++ unsigned int usage_page; ++ unsigned int current_page; + +- for (i = 0; i < parser->local.usage_index; i++) +- if (parser->local.usage_size[i] <= 2) +- parser->local.usage[i] += parser->global.usage_page << 16; ++ if (!parser->local.usage_index) ++ return; ++ ++ usage_page = parser->global.usage_page; ++ ++ /* ++ * Concatenate usage page again only if last declared Usage Page ++ * has not been already used in previous usages concatenation ++ */ ++ for (i = parser->local.usage_index - 1; i >= 0; i--) { ++ if (parser->local.usage_size[i] > 2) ++ /* Ignore extended usages */ ++ continue; ++ ++ current_page = parser->local.usage[i] >> 16; ++ if (current_page == usage_page) ++ break; ++ ++ complete_usage(parser, i); ++ } + } + + /* +@@ -540,7 +579,7 @@ static int hid_parser_main(struct hid_parser *parser, struct hid_item *item) + __u32 data; + int ret; + +- hid_concatenate_usage_page(parser); ++ hid_concatenate_last_usage_page(parser); + + data = item_udata(item); + +@@ -751,7 +790,7 @@ static int hid_scan_main(struct hid_parser *parser, struct hid_item *item) + __u32 data; + int i; + +- hid_concatenate_usage_page(parser); ++ hid_concatenate_last_usage_page(parser); + + data = item_udata(item); + +diff --git a/drivers/hid/intel-ish-hid/ishtp-hid.c b/drivers/hid/intel-ish-hid/ishtp-hid.c +index cd23903ddcf1..e918d78e541c 100644 +--- a/drivers/hid/intel-ish-hid/ishtp-hid.c ++++ b/drivers/hid/intel-ish-hid/ishtp-hid.c +@@ -222,7 +222,7 @@ int ishtp_hid_probe(unsigned int cur_hid_dev, + err_hid_device: + kfree(hid_data); + err_hid_data: +- kfree(hid); ++ hid_destroy_device(hid); + return rv; + } + +diff --git a/drivers/infiniband/hw/qib/qib_sdma.c b/drivers/infiniband/hw/qib/qib_sdma.c +index 891873b38a1e..5f3f197678b7 100644 +--- a/drivers/infiniband/hw/qib/qib_sdma.c ++++ b/drivers/infiniband/hw/qib/qib_sdma.c +@@ -600,8 +600,10 @@ retry: + dw = (len + 3) >> 2; + addr = dma_map_single(&ppd->dd->pcidev->dev, sge->vaddr, + dw << 2, DMA_TO_DEVICE); +- if (dma_mapping_error(&ppd->dd->pcidev->dev, addr)) ++ if (dma_mapping_error(&ppd->dd->pcidev->dev, addr)) { ++ ret = -ENOMEM; + goto unmap; ++ } + sdmadesc[0] = 0; + make_sdma_desc(ppd, sdmadesc, (u64) addr, dw, dwoffset); + /* SDmaUseLargeBuf has to be set in every descriptor */ +diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c +index aa533f08e017..5c7aa6ff1538 100644 +--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c ++++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c +@@ -550,7 +550,7 @@ struct ib_ah *pvrdma_create_ah(struct ib_pd *pd, struct rdma_ah_attr *ah_attr, + if (!atomic_add_unless(&dev->num_ahs, 1, dev->dsr->caps.max_ah)) + return ERR_PTR(-ENOMEM); + +- ah = kzalloc(sizeof(*ah), GFP_KERNEL); ++ ah = kzalloc(sizeof(*ah), GFP_ATOMIC); + if (!ah) { + atomic_dec(&dev->num_ahs); + return ERR_PTR(-ENOMEM); +diff --git a/drivers/infiniband/sw/rxe/rxe_hw_counters.c b/drivers/infiniband/sw/rxe/rxe_hw_counters.c +index 6aeb7a165e46..ea4542a9d69e 100644 +--- a/drivers/infiniband/sw/rxe/rxe_hw_counters.c ++++ b/drivers/infiniband/sw/rxe/rxe_hw_counters.c +@@ -59,7 +59,7 @@ int rxe_ib_get_hw_stats(struct ib_device *ibdev, + return -EINVAL; + + for (cnt = 0; cnt < ARRAY_SIZE(rxe_counter_name); cnt++) +- stats->value[cnt] = dev->stats_counters[cnt]; ++ stats->value[cnt] = atomic64_read(&dev->stats_counters[cnt]); + + return ARRAY_SIZE(rxe_counter_name); + } +diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.h b/drivers/infiniband/sw/rxe/rxe_verbs.h +index b2b76a316eba..d1cc89f6f2e3 100644 +--- a/drivers/infiniband/sw/rxe/rxe_verbs.h ++++ b/drivers/infiniband/sw/rxe/rxe_verbs.h +@@ -410,16 +410,16 @@ struct rxe_dev { + spinlock_t mmap_offset_lock; /* guard mmap_offset */ + int mmap_offset; + +- u64 stats_counters[RXE_NUM_OF_COUNTERS]; ++ atomic64_t stats_counters[RXE_NUM_OF_COUNTERS]; + + struct rxe_port port; + struct list_head list; + struct crypto_shash *tfm; + }; + +-static inline void rxe_counter_inc(struct rxe_dev *rxe, enum rxe_counters cnt) ++static inline void rxe_counter_inc(struct rxe_dev *rxe, enum rxe_counters index) + { +- rxe->stats_counters[cnt]++; ++ atomic64_inc(&rxe->stats_counters[index]); + } + + static inline struct rxe_dev *to_rdev(struct ib_device *dev) +diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c +index 3f5b5893792c..9f7287f45d06 100644 +--- a/drivers/infiniband/ulp/srp/ib_srp.c ++++ b/drivers/infiniband/ulp/srp/ib_srp.c +@@ -2210,6 +2210,7 @@ static int srp_queuecommand(struct Scsi_Host *shost, struct scsi_cmnd *scmnd) + + if (srp_post_send(ch, iu, len)) { + shost_printk(KERN_ERR, target->scsi_host, PFX "Send failed\n"); ++ scmnd->result = DID_ERROR << 16; + goto err_unmap; + } + +diff --git a/drivers/input/serio/gscps2.c b/drivers/input/serio/gscps2.c +index aa9f29b875de..d84e3b70215a 100644 +--- a/drivers/input/serio/gscps2.c ++++ b/drivers/input/serio/gscps2.c +@@ -382,9 +382,9 @@ static int __init gscps2_probe(struct parisc_device *dev) + goto fail; + #endif + +- printk(KERN_INFO "serio: %s port at 0x%p irq %d @ %s\n", ++ pr_info("serio: %s port at 0x%08lx irq %d @ %s\n", + ps2port->port->name, +- ps2port->addr, ++ hpa, + ps2port->padev->irq, + ps2port->port->phys); + +diff --git a/drivers/input/serio/hp_sdc.c b/drivers/input/serio/hp_sdc.c +index 8eef6849d066..5585823ced19 100644 +--- a/drivers/input/serio/hp_sdc.c ++++ b/drivers/input/serio/hp_sdc.c +@@ -887,8 +887,8 @@ static int __init hp_sdc_init(void) + "HP SDC NMI", &hp_sdc)) + goto err2; + +- printk(KERN_INFO PREFIX "HP SDC at 0x%p, IRQ %d (NMI IRQ %d)\n", +- (void *)hp_sdc.base_io, hp_sdc.irq, hp_sdc.nmi); ++ pr_info(PREFIX "HP SDC at 0x%08lx, IRQ %d (NMI IRQ %d)\n", ++ hp_sdc.base_io, hp_sdc.irq, hp_sdc.nmi); + + hp_sdc_status_in8(); + hp_sdc_data_in8(); +diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c +index 07b6cf58fd99..d09c24825734 100644 +--- a/drivers/iommu/amd_iommu.c ++++ b/drivers/iommu/amd_iommu.c +@@ -139,10 +139,14 @@ static struct lock_class_key reserved_rbtree_key; + static inline int match_hid_uid(struct device *dev, + struct acpihid_map_entry *entry) + { ++ struct acpi_device *adev = ACPI_COMPANION(dev); + const char *hid, *uid; + +- hid = acpi_device_hid(ACPI_COMPANION(dev)); +- uid = acpi_device_uid(ACPI_COMPANION(dev)); ++ if (!adev) ++ return -ENODEV; ++ ++ hid = acpi_device_hid(adev); ++ uid = acpi_device_uid(adev); + + if (!hid || !(*hid)) + return -ENODEV; +diff --git a/drivers/mailbox/mailbox-test.c b/drivers/mailbox/mailbox-test.c +index 93f3d4d61fa7..546ba140f83d 100644 +--- a/drivers/mailbox/mailbox-test.c ++++ b/drivers/mailbox/mailbox-test.c +@@ -363,22 +363,24 @@ static int mbox_test_probe(struct platform_device *pdev) + + /* It's okay for MMIO to be NULL */ + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); +- size = resource_size(res); + tdev->tx_mmio = devm_ioremap_resource(&pdev->dev, res); +- if (PTR_ERR(tdev->tx_mmio) == -EBUSY) ++ if (PTR_ERR(tdev->tx_mmio) == -EBUSY) { + /* if reserved area in SRAM, try just ioremap */ ++ size = resource_size(res); + tdev->tx_mmio = devm_ioremap(&pdev->dev, res->start, size); +- else if (IS_ERR(tdev->tx_mmio)) ++ } else if (IS_ERR(tdev->tx_mmio)) { + tdev->tx_mmio = NULL; ++ } + + /* If specified, second reg entry is Rx MMIO */ + res = platform_get_resource(pdev, IORESOURCE_MEM, 1); +- size = resource_size(res); + tdev->rx_mmio = devm_ioremap_resource(&pdev->dev, res); +- if (PTR_ERR(tdev->rx_mmio) == -EBUSY) ++ if (PTR_ERR(tdev->rx_mmio) == -EBUSY) { ++ size = resource_size(res); + tdev->rx_mmio = devm_ioremap(&pdev->dev, res->start, size); +- else if (IS_ERR(tdev->rx_mmio)) ++ } else if (IS_ERR(tdev->rx_mmio)) { + tdev->rx_mmio = tdev->tx_mmio; ++ } + + tdev->tx_channel = mbox_test_request_channel(pdev, "tx"); + tdev->rx_channel = mbox_test_request_channel(pdev, "rx"); +diff --git a/drivers/md/dm-flakey.c b/drivers/md/dm-flakey.c +index 0c1ef63c3461..b1b68e01b889 100644 +--- a/drivers/md/dm-flakey.c ++++ b/drivers/md/dm-flakey.c +@@ -282,20 +282,31 @@ static void flakey_map_bio(struct dm_target *ti, struct bio *bio) + + static void corrupt_bio_data(struct bio *bio, struct flakey_c *fc) + { +- unsigned bio_bytes = bio_cur_bytes(bio); +- char *data = bio_data(bio); ++ unsigned int corrupt_bio_byte = fc->corrupt_bio_byte - 1; ++ ++ struct bvec_iter iter; ++ struct bio_vec bvec; ++ ++ if (!bio_has_data(bio)) ++ return; + + /* +- * Overwrite the Nth byte of the data returned. ++ * Overwrite the Nth byte of the bio's data, on whichever page ++ * it falls. + */ +- if (data && bio_bytes >= fc->corrupt_bio_byte) { +- data[fc->corrupt_bio_byte - 1] = fc->corrupt_bio_value; +- +- DMDEBUG("Corrupting data bio=%p by writing %u to byte %u " +- "(rw=%c bi_opf=%u bi_sector=%llu cur_bytes=%u)\n", +- bio, fc->corrupt_bio_value, fc->corrupt_bio_byte, +- (bio_data_dir(bio) == WRITE) ? 'w' : 'r', bio->bi_opf, +- (unsigned long long)bio->bi_iter.bi_sector, bio_bytes); ++ bio_for_each_segment(bvec, bio, iter) { ++ if (bio_iter_len(bio, iter) > corrupt_bio_byte) { ++ char *segment = (page_address(bio_iter_page(bio, iter)) ++ + bio_iter_offset(bio, iter)); ++ segment[corrupt_bio_byte] = fc->corrupt_bio_value; ++ DMDEBUG("Corrupting data bio=%p by writing %u to byte %u " ++ "(rw=%c bi_opf=%u bi_sector=%llu size=%u)\n", ++ bio, fc->corrupt_bio_value, fc->corrupt_bio_byte, ++ (bio_data_dir(bio) == WRITE) ? 'w' : 'r', bio->bi_opf, ++ (unsigned long long)bio->bi_iter.bi_sector, bio->bi_iter.bi_size); ++ break; ++ } ++ corrupt_bio_byte -= bio_iter_len(bio, iter); + } + } + +diff --git a/drivers/media/platform/atmel/atmel-isc.c b/drivers/media/platform/atmel/atmel-isc.c +index d7103c5f92c3..0dea3cf2cb52 100644 +--- a/drivers/media/platform/atmel/atmel-isc.c ++++ b/drivers/media/platform/atmel/atmel-isc.c +@@ -1555,6 +1555,8 @@ static int isc_async_complete(struct v4l2_async_notifier *notifier) + struct vb2_queue *q = &isc->vb2_vidq; + int ret; + ++ INIT_WORK(&isc->awb_work, isc_awb_work); ++ + ret = v4l2_device_register_subdev_nodes(&isc->v4l2_dev); + if (ret < 0) { + v4l2_err(&isc->v4l2_dev, "Failed to register subdev nodes\n"); +@@ -1614,8 +1616,6 @@ static int isc_async_complete(struct v4l2_async_notifier *notifier) + return ret; + } + +- INIT_WORK(&isc->awb_work, isc_awb_work); +- + /* Register video device */ + strlcpy(vdev->name, ATMEL_ISC_NAME, sizeof(vdev->name)); + vdev->release = video_device_release_empty; +@@ -1722,8 +1722,11 @@ static int isc_parse_dt(struct device *dev, struct isc_device *isc) + break; + } + +- subdev_entity->asd = devm_kzalloc(dev, +- sizeof(*subdev_entity->asd), GFP_KERNEL); ++ /* asd will be freed by the subsystem once it's added to the ++ * notifier list ++ */ ++ subdev_entity->asd = kzalloc(sizeof(*subdev_entity->asd), ++ GFP_KERNEL); + if (subdev_entity->asd == NULL) { + of_node_put(rem); + ret = -ENOMEM; +@@ -1859,6 +1862,7 @@ static int atmel_isc_probe(struct platform_device *pdev) + &subdev_entity->notifier); + if (ret) { + dev_err(dev, "fail to register async notifier\n"); ++ kfree(subdev_entity->asd); + goto cleanup_subdev; + } + +diff --git a/drivers/media/platform/stm32/stm32-dcmi.c b/drivers/media/platform/stm32/stm32-dcmi.c +index 4281f3f76ab1..f157ccbd8286 100644 +--- a/drivers/media/platform/stm32/stm32-dcmi.c ++++ b/drivers/media/platform/stm32/stm32-dcmi.c +@@ -161,6 +161,9 @@ struct stm32_dcmi { + u32 misr; + int errors_count; + int buffers_count; ++ ++ /* Ensure DMA operations atomicity */ ++ struct mutex dma_lock; + }; + + static inline struct stm32_dcmi *notifier_to_dcmi(struct v4l2_async_notifier *n) +@@ -291,6 +294,13 @@ static int dcmi_start_dma(struct stm32_dcmi *dcmi, + return ret; + } + ++ /* ++ * Avoid call of dmaengine_terminate_all() between ++ * dmaengine_prep_slave_single() and dmaengine_submit() ++ * by locking the whole DMA submission sequence ++ */ ++ mutex_lock(&dcmi->dma_lock); ++ + /* Prepare a DMA transaction */ + desc = dmaengine_prep_slave_single(dcmi->dma_chan, buf->paddr, + buf->size, +@@ -298,6 +308,7 @@ static int dcmi_start_dma(struct stm32_dcmi *dcmi, + if (!desc) { + dev_err(dcmi->dev, "%s: DMA dmaengine_prep_slave_single failed for buffer size %zu\n", + __func__, buf->size); ++ mutex_unlock(&dcmi->dma_lock); + return -EINVAL; + } + +@@ -309,9 +320,12 @@ static int dcmi_start_dma(struct stm32_dcmi *dcmi, + dcmi->dma_cookie = dmaengine_submit(desc); + if (dma_submit_error(dcmi->dma_cookie)) { + dev_err(dcmi->dev, "%s: DMA submission failed\n", __func__); ++ mutex_unlock(&dcmi->dma_lock); + return -ENXIO; + } + ++ mutex_unlock(&dcmi->dma_lock); ++ + dma_async_issue_pending(dcmi->dma_chan); + + return 0; +@@ -690,7 +704,9 @@ static void dcmi_stop_streaming(struct vb2_queue *vq) + spin_unlock_irq(&dcmi->irqlock); + + /* Stop all pending DMA operations */ ++ mutex_lock(&dcmi->dma_lock); + dmaengine_terminate_all(dcmi->dma_chan); ++ mutex_unlock(&dcmi->dma_lock); + + clk_disable(dcmi->mclk); + +@@ -1662,6 +1678,7 @@ static int dcmi_probe(struct platform_device *pdev) + + spin_lock_init(&dcmi->irqlock); + mutex_init(&dcmi->lock); ++ mutex_init(&dcmi->dma_lock); + init_completion(&dcmi->complete); + INIT_LIST_HEAD(&dcmi->buffers); + +diff --git a/drivers/media/v4l2-core/v4l2-ctrls.c b/drivers/media/v4l2-core/v4l2-ctrls.c +index 1ee072e939e4..34d6ae43fc45 100644 +--- a/drivers/media/v4l2-core/v4l2-ctrls.c ++++ b/drivers/media/v4l2-core/v4l2-ctrls.c +@@ -1014,6 +1014,7 @@ void v4l2_ctrl_fill(u32 id, const char **name, enum v4l2_ctrl_type *type, + case V4L2_CID_FLASH_STROBE_STOP: + case V4L2_CID_AUTO_FOCUS_START: + case V4L2_CID_AUTO_FOCUS_STOP: ++ case V4L2_CID_DO_WHITE_BALANCE: + *type = V4L2_CTRL_TYPE_BUTTON; + *flags |= V4L2_CTRL_FLAG_WRITE_ONLY | + V4L2_CTRL_FLAG_EXECUTE_ON_WRITE; +diff --git a/drivers/misc/mei/bus.c b/drivers/misc/mei/bus.c +index 37b13bc5c16f..8f6ab516041b 100644 +--- a/drivers/misc/mei/bus.c ++++ b/drivers/misc/mei/bus.c +@@ -850,15 +850,16 @@ static const struct device_type mei_cl_device_type = { + + /** + * mei_cl_bus_set_name - set device name for me client device ++ * - ++ * Example: 0000:00:16.0-55213584-9a29-4916-badf-0fb7ed682aeb + * + * @cldev: me client device + */ + static inline void mei_cl_bus_set_name(struct mei_cl_device *cldev) + { +- dev_set_name(&cldev->dev, "mei:%s:%pUl:%02X", +- cldev->name, +- mei_me_cl_uuid(cldev->me_cl), +- mei_me_cl_ver(cldev->me_cl)); ++ dev_set_name(&cldev->dev, "%s-%pUl", ++ dev_name(cldev->bus->dev), ++ mei_me_cl_uuid(cldev->me_cl)); + } + + /** +diff --git a/drivers/mmc/host/meson-gx-mmc.c b/drivers/mmc/host/meson-gx-mmc.c +index 08a55c2e96e1..53ce1bb83d2c 100644 +--- a/drivers/mmc/host/meson-gx-mmc.c ++++ b/drivers/mmc/host/meson-gx-mmc.c +@@ -21,6 +21,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -74,9 +75,11 @@ + #define CFG_CLK_ALWAYS_ON BIT(18) + #define CFG_CHK_DS BIT(20) + #define CFG_AUTO_CLK BIT(23) ++#define CFG_ERR_ABORT BIT(27) + + #define SD_EMMC_STATUS 0x48 + #define STATUS_BUSY BIT(31) ++#define STATUS_DESC_BUSY BIT(30) + #define STATUS_DATI GENMASK(23, 16) + + #define SD_EMMC_IRQ_EN 0x4c +@@ -905,6 +908,7 @@ static void meson_mmc_start_cmd(struct mmc_host *mmc, struct mmc_command *cmd) + + cmd_cfg |= FIELD_PREP(CMD_CFG_CMD_INDEX_MASK, cmd->opcode); + cmd_cfg |= CMD_CFG_OWNER; /* owned by CPU */ ++ cmd_cfg |= CMD_CFG_ERROR; /* stop in case of error */ + + meson_mmc_set_response_bits(cmd, &cmd_cfg); + +@@ -999,6 +1003,17 @@ static irqreturn_t meson_mmc_irq(int irq, void *dev_id) + u32 irq_en, status, raw_status; + irqreturn_t ret = IRQ_NONE; + ++ irq_en = readl(host->regs + SD_EMMC_IRQ_EN); ++ raw_status = readl(host->regs + SD_EMMC_STATUS); ++ status = raw_status & irq_en; ++ ++ if (!status) { ++ dev_dbg(host->dev, ++ "Unexpected IRQ! irq_en 0x%08x - status 0x%08x\n", ++ irq_en, raw_status); ++ return IRQ_NONE; ++ } ++ + if (WARN_ON(!host) || WARN_ON(!host->cmd)) + return IRQ_NONE; + +@@ -1006,22 +1021,18 @@ static irqreturn_t meson_mmc_irq(int irq, void *dev_id) + + cmd = host->cmd; + data = cmd->data; +- irq_en = readl(host->regs + SD_EMMC_IRQ_EN); +- raw_status = readl(host->regs + SD_EMMC_STATUS); +- status = raw_status & irq_en; +- + cmd->error = 0; + if (status & IRQ_CRC_ERR) { + dev_dbg(host->dev, "CRC Error - status 0x%08x\n", status); + cmd->error = -EILSEQ; +- ret = IRQ_HANDLED; ++ ret = IRQ_WAKE_THREAD; + goto out; + } + + if (status & IRQ_TIMEOUTS) { + dev_dbg(host->dev, "Timeout - status 0x%08x\n", status); + cmd->error = -ETIMEDOUT; +- ret = IRQ_HANDLED; ++ ret = IRQ_WAKE_THREAD; + goto out; + } + +@@ -1046,17 +1057,49 @@ out: + /* ack all enabled interrupts */ + writel(irq_en, host->regs + SD_EMMC_STATUS); + ++ if (cmd->error) { ++ /* Stop desc in case of errors */ ++ u32 start = readl(host->regs + SD_EMMC_START); ++ ++ start &= ~START_DESC_BUSY; ++ writel(start, host->regs + SD_EMMC_START); ++ } ++ + if (ret == IRQ_HANDLED) + meson_mmc_request_done(host->mmc, cmd->mrq); +- else if (ret == IRQ_NONE) +- dev_warn(host->dev, +- "Unexpected IRQ! status=0x%08x, irq_en=0x%08x\n", +- raw_status, irq_en); + + spin_unlock(&host->lock); + return ret; + } + ++static int meson_mmc_wait_desc_stop(struct meson_host *host) ++{ ++ int loop; ++ u32 status; ++ ++ /* ++ * It may sometimes take a while for it to actually halt. Here, we ++ * are giving it 5ms to comply ++ * ++ * If we don't confirm the descriptor is stopped, it might raise new ++ * IRQs after we have called mmc_request_done() which is bad. ++ */ ++ for (loop = 50; loop; loop--) { ++ status = readl(host->regs + SD_EMMC_STATUS); ++ if (status & (STATUS_BUSY | STATUS_DESC_BUSY)) ++ udelay(100); ++ else ++ break; ++ } ++ ++ if (status & (STATUS_BUSY | STATUS_DESC_BUSY)) { ++ dev_err(host->dev, "Timed out waiting for host to stop\n"); ++ return -ETIMEDOUT; ++ } ++ ++ return 0; ++} ++ + static irqreturn_t meson_mmc_irq_thread(int irq, void *dev_id) + { + struct meson_host *host = dev_id; +@@ -1067,6 +1110,13 @@ static irqreturn_t meson_mmc_irq_thread(int irq, void *dev_id) + if (WARN_ON(!cmd)) + return IRQ_NONE; + ++ if (cmd->error) { ++ meson_mmc_wait_desc_stop(host); ++ meson_mmc_request_done(host->mmc, cmd->mrq); ++ ++ return IRQ_HANDLED; ++ } ++ + data = cmd->data; + if (meson_mmc_bounce_buf_read(data)) { + xfer_bytes = data->blksz * data->blocks; +@@ -1107,6 +1157,9 @@ static void meson_mmc_cfg_init(struct meson_host *host) + cfg |= FIELD_PREP(CFG_RC_CC_MASK, ilog2(SD_EMMC_CFG_CMD_GAP)); + cfg |= FIELD_PREP(CFG_BLK_LEN_MASK, ilog2(SD_EMMC_CFG_BLK_SIZE)); + ++ /* abort chain on R/W errors */ ++ cfg |= CFG_ERR_ABORT; ++ + writel(cfg, host->regs + SD_EMMC_CFG); + } + +diff --git a/drivers/mtd/mtdcore.h b/drivers/mtd/mtdcore.h +index 37accfd0400e..24480b75a88d 100644 +--- a/drivers/mtd/mtdcore.h ++++ b/drivers/mtd/mtdcore.h +@@ -7,7 +7,7 @@ + extern struct mutex mtd_table_mutex; + + struct mtd_info *__mtd_next_device(int i); +-int add_mtd_device(struct mtd_info *mtd); ++int __must_check add_mtd_device(struct mtd_info *mtd); + int del_mtd_device(struct mtd_info *mtd); + int add_mtd_partitions(struct mtd_info *, const struct mtd_partition *, int); + int del_mtd_partitions(struct mtd_info *); +diff --git a/drivers/mtd/mtdpart.c b/drivers/mtd/mtdpart.c +index a308e707392d..45626b0eed64 100644 +--- a/drivers/mtd/mtdpart.c ++++ b/drivers/mtd/mtdpart.c +@@ -684,10 +684,21 @@ int mtd_add_partition(struct mtd_info *parent, const char *name, + list_add(&new->list, &mtd_partitions); + mutex_unlock(&mtd_partitions_mutex); + +- add_mtd_device(&new->mtd); ++ ret = add_mtd_device(&new->mtd); ++ if (ret) ++ goto err_remove_part; + + mtd_add_partition_attrs(new); + ++ return 0; ++ ++err_remove_part: ++ mutex_lock(&mtd_partitions_mutex); ++ list_del(&new->list); ++ mutex_unlock(&mtd_partitions_mutex); ++ ++ free_partition(new); ++ + return ret; + } + EXPORT_SYMBOL_GPL(mtd_add_partition); +@@ -778,22 +789,31 @@ int add_mtd_partitions(struct mtd_info *master, + { + struct mtd_part *slave; + uint64_t cur_offset = 0; +- int i; ++ int i, ret; + + printk(KERN_NOTICE "Creating %d MTD partitions on \"%s\":\n", nbparts, master->name); + + for (i = 0; i < nbparts; i++) { + slave = allocate_partition(master, parts + i, i, cur_offset); + if (IS_ERR(slave)) { +- del_mtd_partitions(master); +- return PTR_ERR(slave); ++ ret = PTR_ERR(slave); ++ goto err_del_partitions; + } + + mutex_lock(&mtd_partitions_mutex); + list_add(&slave->list, &mtd_partitions); + mutex_unlock(&mtd_partitions_mutex); + +- add_mtd_device(&slave->mtd); ++ ret = add_mtd_device(&slave->mtd); ++ if (ret) { ++ mutex_lock(&mtd_partitions_mutex); ++ list_del(&slave->list); ++ mutex_unlock(&mtd_partitions_mutex); ++ ++ free_partition(slave); ++ goto err_del_partitions; ++ } ++ + mtd_add_partition_attrs(slave); + if (parts[i].types) + mtd_parse_part(slave, parts[i].types); +@@ -802,6 +822,11 @@ int add_mtd_partitions(struct mtd_info *master, + } + + return 0; ++ ++err_del_partitions: ++ del_mtd_partitions(master); ++ ++ return ret; + } + + static DEFINE_SPINLOCK(part_parser_lock); +diff --git a/drivers/mtd/nand/atmel/nand-controller.c b/drivers/mtd/nand/atmel/nand-controller.c +index 0b93f152d993..d5a493e8ee08 100644 +--- a/drivers/mtd/nand/atmel/nand-controller.c ++++ b/drivers/mtd/nand/atmel/nand-controller.c +@@ -1888,7 +1888,7 @@ static int atmel_nand_controller_add_nands(struct atmel_nand_controller *nc) + + ret = of_property_read_u32(np, "#size-cells", &val); + if (ret) { +- dev_err(dev, "missing #address-cells property\n"); ++ dev_err(dev, "missing #size-cells property\n"); + return ret; + } + +diff --git a/drivers/mtd/nand/atmel/pmecc.c b/drivers/mtd/nand/atmel/pmecc.c +index 4124bf91bee6..8cd153974e8d 100644 +--- a/drivers/mtd/nand/atmel/pmecc.c ++++ b/drivers/mtd/nand/atmel/pmecc.c +@@ -875,23 +875,32 @@ static struct atmel_pmecc *atmel_pmecc_get_by_node(struct device *userdev, + { + struct platform_device *pdev; + struct atmel_pmecc *pmecc, **ptr; ++ int ret; + + pdev = of_find_device_by_node(np); +- if (!pdev || !platform_get_drvdata(pdev)) ++ if (!pdev) + return ERR_PTR(-EPROBE_DEFER); ++ pmecc = platform_get_drvdata(pdev); ++ if (!pmecc) { ++ ret = -EPROBE_DEFER; ++ goto err_put_device; ++ } + + ptr = devres_alloc(devm_atmel_pmecc_put, sizeof(*ptr), GFP_KERNEL); +- if (!ptr) +- return ERR_PTR(-ENOMEM); +- +- get_device(&pdev->dev); +- pmecc = platform_get_drvdata(pdev); ++ if (!ptr) { ++ ret = -ENOMEM; ++ goto err_put_device; ++ } + + *ptr = pmecc; + + devres_add(userdev, ptr); + + return pmecc; ++ ++err_put_device: ++ put_device(&pdev->dev); ++ return ERR_PTR(ret); + } + + static const int atmel_pmecc_strengths[] = { 2, 4, 8, 12, 24, 32 }; +diff --git a/drivers/mtd/nand/sunxi_nand.c b/drivers/mtd/nand/sunxi_nand.c +index 958974821582..8e5231482397 100644 +--- a/drivers/mtd/nand/sunxi_nand.c ++++ b/drivers/mtd/nand/sunxi_nand.c +@@ -1435,7 +1435,7 @@ static int sunxi_nfc_hw_ecc_write_page_dma(struct mtd_info *mtd, + sunxi_nfc_randomizer_enable(mtd); + + writel((NAND_CMD_RNDIN << 8) | NAND_CMD_PAGEPROG, +- nfc->regs + NFC_REG_RCMD_SET); ++ nfc->regs + NFC_REG_WCMD_SET); + + dma_async_issue_pending(nfc->dmac); + +diff --git a/drivers/mtd/spi-nor/spi-nor.c b/drivers/mtd/spi-nor/spi-nor.c +index 6c013341ef09..d550148177a0 100644 +--- a/drivers/mtd/spi-nor/spi-nor.c ++++ b/drivers/mtd/spi-nor/spi-nor.c +@@ -2382,7 +2382,7 @@ static int spi_nor_init_params(struct spi_nor *nor, + memset(params, 0, sizeof(*params)); + + /* Set SPI NOR sizes. */ +- params->size = info->sector_size * info->n_sectors; ++ params->size = (u64)info->sector_size * info->n_sectors; + params->page_size = info->page_size; + + /* (Fast) Read settings. */ +diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c +index 6445c693d935..0104d9537329 100644 +--- a/drivers/mtd/ubi/build.c ++++ b/drivers/mtd/ubi/build.c +@@ -1092,10 +1092,10 @@ int ubi_detach_mtd_dev(int ubi_num, int anyway) + ubi_wl_close(ubi); + ubi_free_internal_volumes(ubi); + vfree(ubi->vtbl); +- put_mtd_device(ubi->mtd); + vfree(ubi->peb_buf); + vfree(ubi->fm_buf); + ubi_msg(ubi, "mtd%d is detached", ubi->mtd->index); ++ put_mtd_device(ubi->mtd); + put_device(&ubi->dev); + return 0; + } +diff --git a/drivers/mtd/ubi/kapi.c b/drivers/mtd/ubi/kapi.c +index d4b2e8744498..c2cf6bd3c162 100644 +--- a/drivers/mtd/ubi/kapi.c ++++ b/drivers/mtd/ubi/kapi.c +@@ -227,9 +227,9 @@ out_unlock: + out_free: + kfree(desc); + out_put_ubi: +- ubi_put_device(ubi); + ubi_err(ubi, "cannot open device %d, volume %d, error %d", + ubi_num, vol_id, err); ++ ubi_put_device(ubi); + return ERR_PTR(err); + } + EXPORT_SYMBOL_GPL(ubi_open_volume); +diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c +index 9b61bfbea6cd..24c6015f6c92 100644 +--- a/drivers/net/can/c_can/c_can.c ++++ b/drivers/net/can/c_can/c_can.c +@@ -52,6 +52,7 @@ + #define CONTROL_EX_PDR BIT(8) + + /* control register */ ++#define CONTROL_SWR BIT(15) + #define CONTROL_TEST BIT(7) + #define CONTROL_CCE BIT(6) + #define CONTROL_DISABLE_AR BIT(5) +@@ -572,6 +573,26 @@ static void c_can_configure_msg_objects(struct net_device *dev) + IF_MCONT_RCV_EOB); + } + ++static int c_can_software_reset(struct net_device *dev) ++{ ++ struct c_can_priv *priv = netdev_priv(dev); ++ int retry = 0; ++ ++ if (priv->type != BOSCH_D_CAN) ++ return 0; ++ ++ priv->write_reg(priv, C_CAN_CTRL_REG, CONTROL_SWR | CONTROL_INIT); ++ while (priv->read_reg(priv, C_CAN_CTRL_REG) & CONTROL_SWR) { ++ msleep(20); ++ if (retry++ > 100) { ++ netdev_err(dev, "CCTRL: software reset failed\n"); ++ return -EIO; ++ } ++ } ++ ++ return 0; ++} ++ + /* + * Configure C_CAN chip: + * - enable/disable auto-retransmission +@@ -581,6 +602,11 @@ static void c_can_configure_msg_objects(struct net_device *dev) + static int c_can_chip_config(struct net_device *dev) + { + struct c_can_priv *priv = netdev_priv(dev); ++ int err; ++ ++ err = c_can_software_reset(dev); ++ if (err) ++ return err; + + /* enable automatic retransmission */ + priv->write_reg(priv, C_CAN_CTRL_REG, CONTROL_ENABLE_AR); +diff --git a/drivers/net/can/rx-offload.c b/drivers/net/can/rx-offload.c +index 1a7c183e6678..54ffd1e91a69 100644 +--- a/drivers/net/can/rx-offload.c ++++ b/drivers/net/can/rx-offload.c +@@ -116,37 +116,95 @@ static int can_rx_offload_compare(struct sk_buff *a, struct sk_buff *b) + return cb_b->timestamp - cb_a->timestamp; + } + +-static struct sk_buff *can_rx_offload_offload_one(struct can_rx_offload *offload, unsigned int n) ++/** ++ * can_rx_offload_offload_one() - Read one CAN frame from HW ++ * @offload: pointer to rx_offload context ++ * @n: number of mailbox to read ++ * ++ * The task of this function is to read a CAN frame from mailbox @n ++ * from the device and return the mailbox's content as a struct ++ * sk_buff. ++ * ++ * If the struct can_rx_offload::skb_queue exceeds the maximal queue ++ * length (struct can_rx_offload::skb_queue_len_max) or no skb can be ++ * allocated, the mailbox contents is discarded by reading it into an ++ * overflow buffer. This way the mailbox is marked as free by the ++ * driver. ++ * ++ * Return: A pointer to skb containing the CAN frame on success. ++ * ++ * NULL if the mailbox @n is empty. ++ * ++ * ERR_PTR() in case of an error ++ */ ++static struct sk_buff * ++can_rx_offload_offload_one(struct can_rx_offload *offload, unsigned int n) + { +- struct sk_buff *skb = NULL; ++ struct sk_buff *skb = NULL, *skb_error = NULL; + struct can_rx_offload_cb *cb; + struct can_frame *cf; + int ret; + +- /* If queue is full or skb not available, read to discard mailbox */ +- if (likely(skb_queue_len(&offload->skb_queue) <= +- offload->skb_queue_len_max)) ++ if (likely(skb_queue_len(&offload->skb_queue) < ++ offload->skb_queue_len_max)) { + skb = alloc_can_skb(offload->dev, &cf); ++ if (unlikely(!skb)) ++ skb_error = ERR_PTR(-ENOMEM); /* skb alloc failed */ ++ } else { ++ skb_error = ERR_PTR(-ENOBUFS); /* skb_queue is full */ ++ } + +- if (!skb) { ++ /* If queue is full or skb not available, drop by reading into ++ * overflow buffer. ++ */ ++ if (unlikely(skb_error)) { + struct can_frame cf_overflow; + u32 timestamp; + + ret = offload->mailbox_read(offload, &cf_overflow, + ×tamp, n); +- if (ret) +- offload->dev->stats.rx_dropped++; + +- return NULL; ++ /* Mailbox was empty. */ ++ if (unlikely(!ret)) ++ return NULL; ++ ++ /* Mailbox has been read and we're dropping it or ++ * there was a problem reading the mailbox. ++ * ++ * Increment error counters in any case. ++ */ ++ offload->dev->stats.rx_dropped++; ++ offload->dev->stats.rx_fifo_errors++; ++ ++ /* There was a problem reading the mailbox, propagate ++ * error value. ++ */ ++ if (unlikely(ret < 0)) ++ return ERR_PTR(ret); ++ ++ return skb_error; + } + + cb = can_rx_offload_get_cb(skb); + ret = offload->mailbox_read(offload, cf, &cb->timestamp, n); +- if (!ret) { ++ ++ /* Mailbox was empty. */ ++ if (unlikely(!ret)) { + kfree_skb(skb); + return NULL; + } + ++ /* There was a problem reading the mailbox, propagate error value. */ ++ if (unlikely(ret < 0)) { ++ kfree_skb(skb); ++ ++ offload->dev->stats.rx_dropped++; ++ offload->dev->stats.rx_fifo_errors++; ++ ++ return ERR_PTR(ret); ++ } ++ ++ /* Mailbox was read. */ + return skb; + } + +@@ -166,8 +224,8 @@ int can_rx_offload_irq_offload_timestamp(struct can_rx_offload *offload, u64 pen + continue; + + skb = can_rx_offload_offload_one(offload, i); +- if (!skb) +- break; ++ if (IS_ERR_OR_NULL(skb)) ++ continue; + + __skb_queue_add_sort(&skb_queue, skb, can_rx_offload_compare); + } +@@ -197,7 +255,13 @@ int can_rx_offload_irq_offload_fifo(struct can_rx_offload *offload) + struct sk_buff *skb; + int received = 0; + +- while ((skb = can_rx_offload_offload_one(offload, 0))) { ++ while (1) { ++ skb = can_rx_offload_offload_one(offload, 0); ++ if (IS_ERR(skb)) ++ continue; ++ if (!skb) ++ break; ++ + skb_queue_tail(&offload->skb_queue, skb); + received++; + } +@@ -261,8 +325,10 @@ int can_rx_offload_queue_tail(struct can_rx_offload *offload, + struct sk_buff *skb) + { + if (skb_queue_len(&offload->skb_queue) > +- offload->skb_queue_len_max) +- return -ENOMEM; ++ offload->skb_queue_len_max) { ++ kfree_skb(skb); ++ return -ENOBUFS; ++ } + + skb_queue_tail(&offload->skb_queue, skb); + can_rx_offload_schedule(offload); +diff --git a/drivers/net/can/usb/peak_usb/pcan_usb.c b/drivers/net/can/usb/peak_usb/pcan_usb.c +index e626c2afbbb1..0e1fc6c4360e 100644 +--- a/drivers/net/can/usb/peak_usb/pcan_usb.c ++++ b/drivers/net/can/usb/peak_usb/pcan_usb.c +@@ -441,8 +441,8 @@ static int pcan_usb_decode_error(struct pcan_usb_msg_context *mc, u8 n, + } + if ((n & PCAN_USB_ERROR_BUS_LIGHT) == 0) { + /* no error (back to active state) */ +- mc->pdev->dev.can.state = CAN_STATE_ERROR_ACTIVE; +- return 0; ++ new_state = CAN_STATE_ERROR_ACTIVE; ++ break; + } + break; + +@@ -465,9 +465,9 @@ static int pcan_usb_decode_error(struct pcan_usb_msg_context *mc, u8 n, + } + + if ((n & PCAN_USB_ERROR_BUS_HEAVY) == 0) { +- /* no error (back to active state) */ +- mc->pdev->dev.can.state = CAN_STATE_ERROR_ACTIVE; +- return 0; ++ /* no error (back to warning state) */ ++ new_state = CAN_STATE_ERROR_WARNING; ++ break; + } + break; + +@@ -506,6 +506,11 @@ static int pcan_usb_decode_error(struct pcan_usb_msg_context *mc, u8 n, + mc->pdev->dev.can.can_stats.error_warning++; + break; + ++ case CAN_STATE_ERROR_ACTIVE: ++ cf->can_id |= CAN_ERR_CRTL; ++ cf->data[1] = CAN_ERR_CRTL_ACTIVE; ++ break; ++ + default: + /* CAN_STATE_MAX (trick to handle other errors) */ + cf->can_id |= CAN_ERR_CRTL; +diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c +index af666951a959..94ad2fdd6ef0 100644 +--- a/drivers/net/dsa/bcm_sf2.c ++++ b/drivers/net/dsa/bcm_sf2.c +@@ -432,11 +432,10 @@ static int bcm_sf2_sw_mdio_write(struct mii_bus *bus, int addr, int regnum, + * send them to our master MDIO bus controller + */ + if (addr == BRCM_PSEUDO_PHY_ADDR && priv->indir_phy_mask & BIT(addr)) +- bcm_sf2_sw_indir_rw(priv, 0, addr, regnum, val); ++ return bcm_sf2_sw_indir_rw(priv, 0, addr, regnum, val); + else +- mdiobus_write_nested(priv->master_mii_bus, addr, regnum, val); +- +- return 0; ++ return mdiobus_write_nested(priv->master_mii_bus, addr, ++ regnum, val); + } + + static irqreturn_t bcm_sf2_switch_0_isr(int irq, void *dev_id) +diff --git a/drivers/net/ethernet/atheros/atl1e/atl1e_main.c b/drivers/net/ethernet/atheros/atl1e/atl1e_main.c +index 4f7e195af0bc..0d08039981b5 100644 +--- a/drivers/net/ethernet/atheros/atl1e/atl1e_main.c ++++ b/drivers/net/ethernet/atheros/atl1e/atl1e_main.c +@@ -472,7 +472,9 @@ static void atl1e_mdio_write(struct net_device *netdev, int phy_id, + { + struct atl1e_adapter *adapter = netdev_priv(netdev); + +- atl1e_write_phy_reg(&adapter->hw, reg_num & MDIO_REG_ADDR_MASK, val); ++ if (atl1e_write_phy_reg(&adapter->hw, ++ reg_num & MDIO_REG_ADDR_MASK, val)) ++ netdev_err(netdev, "write phy register failed\n"); + } + + static int atl1e_mii_ioctl(struct net_device *netdev, +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +index a22336fef66b..fc8e185718a1 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +@@ -1339,14 +1339,22 @@ static int bnxt_flash_nvram(struct net_device *dev, + rc = hwrm_send_message(bp, &req, sizeof(req), FLASH_NVRAM_TIMEOUT); + dma_free_coherent(&bp->pdev->dev, data_len, kmem, dma_handle); + ++ if (rc == HWRM_ERR_CODE_RESOURCE_ACCESS_DENIED) { ++ netdev_info(dev, ++ "PF does not have admin privileges to flash the device\n"); ++ rc = -EACCES; ++ } else if (rc) { ++ rc = -EIO; ++ } + return rc; + } + + static int bnxt_firmware_reset(struct net_device *dev, + u16 dir_type) + { +- struct bnxt *bp = netdev_priv(dev); + struct hwrm_fw_reset_input req = {0}; ++ struct bnxt *bp = netdev_priv(dev); ++ int rc; + + bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_FW_RESET, -1, -1); + +@@ -1380,7 +1388,15 @@ static int bnxt_firmware_reset(struct net_device *dev, + return -EINVAL; + } + +- return hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT); ++ rc = hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT); ++ if (rc == HWRM_ERR_CODE_RESOURCE_ACCESS_DENIED) { ++ netdev_info(dev, ++ "PF does not have admin privileges to reset the device\n"); ++ rc = -EACCES; ++ } else if (rc) { ++ rc = -EIO; ++ } ++ return rc; + } + + static int bnxt_flash_firmware(struct net_device *dev, +@@ -1587,9 +1603,9 @@ static int bnxt_flash_package_from_file(struct net_device *dev, + struct hwrm_nvm_install_update_output *resp = bp->hwrm_cmd_resp_addr; + struct hwrm_nvm_install_update_input install = {0}; + const struct firmware *fw; ++ int rc, hwrm_err = 0; + u32 item_len; + u16 index; +- int rc; + + bnxt_hwrm_fw_set_time(bp); + +@@ -1632,15 +1648,16 @@ static int bnxt_flash_package_from_file(struct net_device *dev, + memcpy(kmem, fw->data, fw->size); + modify.host_src_addr = cpu_to_le64(dma_handle); + +- rc = hwrm_send_message(bp, &modify, sizeof(modify), +- FLASH_PACKAGE_TIMEOUT); ++ hwrm_err = hwrm_send_message(bp, &modify, ++ sizeof(modify), ++ FLASH_PACKAGE_TIMEOUT); + dma_free_coherent(&bp->pdev->dev, fw->size, kmem, + dma_handle); + } + } + release_firmware(fw); +- if (rc) +- return rc; ++ if (rc || hwrm_err) ++ goto err_exit; + + if ((install_type & 0xffff) == 0) + install_type >>= 16; +@@ -1648,12 +1665,10 @@ static int bnxt_flash_package_from_file(struct net_device *dev, + install.install_type = cpu_to_le32(install_type); + + mutex_lock(&bp->hwrm_cmd_lock); +- rc = _hwrm_send_message(bp, &install, sizeof(install), +- INSTALL_PACKAGE_TIMEOUT); +- if (rc) { +- rc = -EOPNOTSUPP; ++ hwrm_err = _hwrm_send_message(bp, &install, sizeof(install), ++ INSTALL_PACKAGE_TIMEOUT); ++ if (hwrm_err) + goto flash_pkg_exit; +- } + + if (resp->error_code) { + u8 error_code = ((struct hwrm_err_output *)resp)->cmd_err; +@@ -1661,12 +1676,11 @@ static int bnxt_flash_package_from_file(struct net_device *dev, + if (error_code == NVM_INSTALL_UPDATE_CMD_ERR_CODE_FRAG_ERR) { + install.flags |= cpu_to_le16( + NVM_INSTALL_UPDATE_REQ_FLAGS_ALLOWED_TO_DEFRAG); +- rc = _hwrm_send_message(bp, &install, sizeof(install), +- INSTALL_PACKAGE_TIMEOUT); +- if (rc) { +- rc = -EOPNOTSUPP; ++ hwrm_err = _hwrm_send_message(bp, &install, ++ sizeof(install), ++ INSTALL_PACKAGE_TIMEOUT); ++ if (hwrm_err) + goto flash_pkg_exit; +- } + } + } + +@@ -1677,6 +1691,14 @@ static int bnxt_flash_package_from_file(struct net_device *dev, + } + flash_pkg_exit: + mutex_unlock(&bp->hwrm_cmd_lock); ++err_exit: ++ if (hwrm_err == HWRM_ERR_CODE_RESOURCE_ACCESS_DENIED) { ++ netdev_info(dev, ++ "PF does not have admin privileges to flash the device\n"); ++ rc = -EACCES; ++ } else if (hwrm_err) { ++ rc = -EOPNOTSUPP; ++ } + return rc; + } + +@@ -2236,17 +2258,37 @@ static int bnxt_hwrm_mac_loopback(struct bnxt *bp, bool enable) + return hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT); + } + ++static int bnxt_query_force_speeds(struct bnxt *bp, u16 *force_speeds) ++{ ++ struct hwrm_port_phy_qcaps_output *resp = bp->hwrm_cmd_resp_addr; ++ struct hwrm_port_phy_qcaps_input req = {0}; ++ int rc; ++ ++ bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_PORT_PHY_QCAPS, -1, -1); ++ mutex_lock(&bp->hwrm_cmd_lock); ++ rc = _hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT); ++ if (!rc) ++ *force_speeds = le16_to_cpu(resp->supported_speeds_force_mode); ++ ++ mutex_unlock(&bp->hwrm_cmd_lock); ++ return rc; ++} ++ + static int bnxt_disable_an_for_lpbk(struct bnxt *bp, + struct hwrm_port_phy_cfg_input *req) + { + struct bnxt_link_info *link_info = &bp->link_info; +- u16 fw_advertising = link_info->advertising; ++ u16 fw_advertising; + u16 fw_speed; + int rc; + + if (!link_info->autoneg) + return 0; + ++ rc = bnxt_query_force_speeds(bp, &fw_advertising); ++ if (rc) ++ return rc; ++ + fw_speed = PORT_PHY_CFG_REQ_FORCE_LINK_SPEED_1GB; + if (netif_carrier_ok(bp->dev)) + fw_speed = bp->link_info.link_speed; +diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c +index b6af286fa5c7..3e3044fe3206 100644 +--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c ++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c +@@ -2611,8 +2611,10 @@ static void bcmgenet_irq_task(struct work_struct *work) + } + + if (status & UMAC_IRQ_PHY_DET_R && +- priv->dev->phydev->autoneg != AUTONEG_ENABLE) ++ priv->dev->phydev->autoneg != AUTONEG_ENABLE) { + phy_init_hw(priv->dev->phydev); ++ genphy_config_aneg(priv->dev->phydev); ++ } + + /* Link UP/DOWN event */ + if (status & UMAC_IRQ_LINK_EVENT) +@@ -3688,6 +3690,7 @@ static int bcmgenet_resume(struct device *d) + + phy_init_hw(priv->phydev); + /* Speed settings must be restored */ ++ genphy_config_aneg(dev->phydev); + bcmgenet_mii_config(priv->dev, false); + + /* disable ethernet MAC while updating its registers */ +diff --git a/drivers/net/ethernet/cadence/macb.h b/drivers/net/ethernet/cadence/macb.h +index c93f3a2dc6c1..4c0bcfd1d250 100644 +--- a/drivers/net/ethernet/cadence/macb.h ++++ b/drivers/net/ethernet/cadence/macb.h +@@ -457,7 +457,11 @@ + + /* Bitfields in TISUBN */ + #define GEM_SUBNSINCR_OFFSET 0 +-#define GEM_SUBNSINCR_SIZE 16 ++#define GEM_SUBNSINCRL_OFFSET 24 ++#define GEM_SUBNSINCRL_SIZE 8 ++#define GEM_SUBNSINCRH_OFFSET 0 ++#define GEM_SUBNSINCRH_SIZE 16 ++#define GEM_SUBNSINCR_SIZE 24 + + /* Bitfields in TI */ + #define GEM_NSINCR_OFFSET 0 +diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c +index 2287749de087..5aff1b460151 100644 +--- a/drivers/net/ethernet/cadence/macb_main.c ++++ b/drivers/net/ethernet/cadence/macb_main.c +@@ -852,7 +852,9 @@ static void macb_tx_interrupt(struct macb_queue *queue) + + /* First, update TX stats if needed */ + if (skb) { +- if (gem_ptp_do_txstamp(queue, skb, desc) == 0) { ++ if (unlikely(skb_shinfo(skb)->tx_flags & ++ SKBTX_HW_TSTAMP) && ++ gem_ptp_do_txstamp(queue, skb, desc) == 0) { + /* skb now belongs to timestamp buffer + * and will be removed later + */ +@@ -2822,7 +2824,7 @@ static int macb_clk_init(struct platform_device *pdev, struct clk **pclk, + if (!err) + err = -ENODEV; + +- dev_err(&pdev->dev, "failed to get macb_clk (%u)\n", err); ++ dev_err(&pdev->dev, "failed to get macb_clk (%d)\n", err); + return err; + } + +@@ -2831,7 +2833,7 @@ static int macb_clk_init(struct platform_device *pdev, struct clk **pclk, + if (!err) + err = -ENODEV; + +- dev_err(&pdev->dev, "failed to get hclk (%u)\n", err); ++ dev_err(&pdev->dev, "failed to get hclk (%d)\n", err); + return err; + } + +@@ -2845,25 +2847,25 @@ static int macb_clk_init(struct platform_device *pdev, struct clk **pclk, + + err = clk_prepare_enable(*pclk); + if (err) { +- dev_err(&pdev->dev, "failed to enable pclk (%u)\n", err); ++ dev_err(&pdev->dev, "failed to enable pclk (%d)\n", err); + return err; + } + + err = clk_prepare_enable(*hclk); + if (err) { +- dev_err(&pdev->dev, "failed to enable hclk (%u)\n", err); ++ dev_err(&pdev->dev, "failed to enable hclk (%d)\n", err); + goto err_disable_pclk; + } + + err = clk_prepare_enable(*tx_clk); + if (err) { +- dev_err(&pdev->dev, "failed to enable tx_clk (%u)\n", err); ++ dev_err(&pdev->dev, "failed to enable tx_clk (%d)\n", err); + goto err_disable_hclk; + } + + err = clk_prepare_enable(*rx_clk); + if (err) { +- dev_err(&pdev->dev, "failed to enable rx_clk (%u)\n", err); ++ dev_err(&pdev->dev, "failed to enable rx_clk (%d)\n", err); + goto err_disable_txclk; + } + +@@ -3298,7 +3300,7 @@ static int at91ether_clk_init(struct platform_device *pdev, struct clk **pclk, + + err = clk_prepare_enable(*pclk); + if (err) { +- dev_err(&pdev->dev, "failed to enable pclk (%u)\n", err); ++ dev_err(&pdev->dev, "failed to enable pclk (%d)\n", err); + return err; + } + +diff --git a/drivers/net/ethernet/cadence/macb_ptp.c b/drivers/net/ethernet/cadence/macb_ptp.c +index 678835136bf8..f1f07e9d53f8 100755 +--- a/drivers/net/ethernet/cadence/macb_ptp.c ++++ b/drivers/net/ethernet/cadence/macb_ptp.c +@@ -115,7 +115,10 @@ static int gem_tsu_incr_set(struct macb *bp, struct tsu_incr *incr_spec) + * to take effect. + */ + spin_lock_irqsave(&bp->tsu_clk_lock, flags); +- gem_writel(bp, TISUBN, GEM_BF(SUBNSINCR, incr_spec->sub_ns)); ++ /* RegBit[15:0] = Subns[23:8]; RegBit[31:24] = Subns[7:0] */ ++ gem_writel(bp, TISUBN, GEM_BF(SUBNSINCRL, incr_spec->sub_ns) | ++ GEM_BF(SUBNSINCRH, (incr_spec->sub_ns >> ++ GEM_SUBNSINCRL_SIZE))); + gem_writel(bp, TI, GEM_BF(NSINCR, incr_spec->ns)); + spin_unlock_irqrestore(&bp->tsu_clk_lock, flags); + +diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c +index 0ae6532b02e0..62bc19bedb06 100644 +--- a/drivers/net/ethernet/freescale/fec_main.c ++++ b/drivers/net/ethernet/freescale/fec_main.c +@@ -3565,6 +3565,11 @@ fec_drv_remove(struct platform_device *pdev) + struct net_device *ndev = platform_get_drvdata(pdev); + struct fec_enet_private *fep = netdev_priv(ndev); + struct device_node *np = pdev->dev.of_node; ++ int ret; ++ ++ ret = pm_runtime_get_sync(&pdev->dev); ++ if (ret < 0) ++ return ret; + + cancel_work_sync(&fep->tx_timeout_work); + fec_ptp_stop(pdev); +@@ -3572,13 +3577,17 @@ fec_drv_remove(struct platform_device *pdev) + fec_enet_mii_remove(fep); + if (fep->reg_phy) + regulator_disable(fep->reg_phy); +- pm_runtime_put(&pdev->dev); +- pm_runtime_disable(&pdev->dev); ++ + if (of_phy_is_fixed_link(np)) + of_phy_deregister_fixed_link(np); + of_node_put(fep->phy_node); + free_netdev(ndev); + ++ clk_disable_unprepare(fep->clk_ahb); ++ clk_disable_unprepare(fep->clk_ipg); ++ pm_runtime_put_noidle(&pdev->dev); ++ pm_runtime_disable(&pdev->dev); ++ + return 0; + } + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c +index 8b511e6e0ce9..396ea0db7102 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c +@@ -251,6 +251,8 @@ int hclge_cmd_send(struct hclge_hw *hw, struct hclge_desc *desc, int num) + if ((enum hclge_cmd_return_status)desc_ret == + HCLGE_CMD_EXEC_SUCCESS) + retval = 0; ++ else if (desc_ret == HCLGE_CMD_NOT_SUPPORTED) ++ retval = -EOPNOTSUPP; + else + retval = -EIO; + hw->cmq.last_status = (enum hclge_cmd_status)desc_ret; +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h +index 758cf3948131..3823ae6303ad 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h +@@ -52,7 +52,7 @@ struct hclge_cmq_ring { + enum hclge_cmd_return_status { + HCLGE_CMD_EXEC_SUCCESS = 0, + HCLGE_CMD_NO_AUTH = 1, +- HCLGE_CMD_NOT_EXEC = 2, ++ HCLGE_CMD_NOT_SUPPORTED = 2, + HCLGE_CMD_QUEUE_FULL = 3, + }; + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c +index 97874c2568fc..1ac0e173da12 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c +@@ -838,11 +838,9 @@ static int mlx5_pci_init(struct mlx5_core_dev *dev, struct mlx5_priv *priv) + + priv->numa_node = dev_to_node(&dev->pdev->dev); + +- priv->dbg_root = debugfs_create_dir(dev_name(&pdev->dev), mlx5_debugfs_root); +- if (!priv->dbg_root) { +- dev_err(&pdev->dev, "Cannot create debugfs dir, aborting\n"); +- return -ENOMEM; +- } ++ if (mlx5_debugfs_root) ++ priv->dbg_root = ++ debugfs_create_dir(pci_name(pdev), mlx5_debugfs_root); + + err = mlx5_pci_enable_device(dev); + if (err) { +diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c +index 09352ee43b55..2d92a9fe4606 100644 +--- a/drivers/net/ethernet/sfc/ef10.c ++++ b/drivers/net/ethernet/sfc/ef10.c +@@ -5852,22 +5852,25 @@ static const struct efx_ef10_nvram_type_info efx_ef10_nvram_types[] = { + { NVRAM_PARTITION_TYPE_LICENSE, 0, 0, "sfc_license" }, + { NVRAM_PARTITION_TYPE_PHY_MIN, 0xff, 0, "sfc_phy_fw" }, + }; ++#define EF10_NVRAM_PARTITION_COUNT ARRAY_SIZE(efx_ef10_nvram_types) + + static int efx_ef10_mtd_probe_partition(struct efx_nic *efx, + struct efx_mcdi_mtd_partition *part, +- unsigned int type) ++ unsigned int type, ++ unsigned long *found) + { + MCDI_DECLARE_BUF(inbuf, MC_CMD_NVRAM_METADATA_IN_LEN); + MCDI_DECLARE_BUF(outbuf, MC_CMD_NVRAM_METADATA_OUT_LENMAX); + const struct efx_ef10_nvram_type_info *info; + size_t size, erase_size, outlen; ++ int type_idx = 0; + bool protected; + int rc; + +- for (info = efx_ef10_nvram_types; ; info++) { +- if (info == +- efx_ef10_nvram_types + ARRAY_SIZE(efx_ef10_nvram_types)) ++ for (type_idx = 0; ; type_idx++) { ++ if (type_idx == EF10_NVRAM_PARTITION_COUNT) + return -ENODEV; ++ info = efx_ef10_nvram_types + type_idx; + if ((type & ~info->type_mask) == info->type) + break; + } +@@ -5880,6 +5883,13 @@ static int efx_ef10_mtd_probe_partition(struct efx_nic *efx, + if (protected) + return -ENODEV; /* hide it */ + ++ /* If we've already exposed a partition of this type, hide this ++ * duplicate. All operations on MTDs are keyed by the type anyway, ++ * so we can't act on the duplicate. ++ */ ++ if (__test_and_set_bit(type_idx, found)) ++ return -EEXIST; ++ + part->nvram_type = type; + + MCDI_SET_DWORD(inbuf, NVRAM_METADATA_IN_TYPE, type); +@@ -5908,6 +5918,7 @@ static int efx_ef10_mtd_probe_partition(struct efx_nic *efx, + static int efx_ef10_mtd_probe(struct efx_nic *efx) + { + MCDI_DECLARE_BUF(outbuf, MC_CMD_NVRAM_PARTITIONS_OUT_LENMAX); ++ DECLARE_BITMAP(found, EF10_NVRAM_PARTITION_COUNT) = { 0 }; + struct efx_mcdi_mtd_partition *parts; + size_t outlen, n_parts_total, i, n_parts; + unsigned int type; +@@ -5936,11 +5947,13 @@ static int efx_ef10_mtd_probe(struct efx_nic *efx) + for (i = 0; i < n_parts_total; i++) { + type = MCDI_ARRAY_DWORD(outbuf, NVRAM_PARTITIONS_OUT_TYPE_ID, + i); +- rc = efx_ef10_mtd_probe_partition(efx, &parts[n_parts], type); +- if (rc == 0) +- n_parts++; +- else if (rc != -ENODEV) ++ rc = efx_ef10_mtd_probe_partition(efx, &parts[n_parts], type, ++ found); ++ if (rc == -EEXIST || rc == -ENODEV) ++ continue; ++ if (rc) + goto fail; ++ n_parts++; + } + + rc = efx_mtd_add(efx, &parts[0].common, n_parts, sizeof(*parts)); +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c +index d07520fb969e..62ccbd47c1db 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c +@@ -59,7 +59,9 @@ static int sun7i_gmac_init(struct platform_device *pdev, void *priv) + gmac->clk_enabled = 1; + } else { + clk_set_rate(gmac->tx_clk, SUN7I_GMAC_MII_RATE); +- clk_prepare(gmac->tx_clk); ++ ret = clk_prepare(gmac->tx_clk); ++ if (ret) ++ return ret; + } + + return 0; +diff --git a/drivers/net/ethernet/ti/cpts.c b/drivers/net/ethernet/ti/cpts.c +index e7b76f6b4f67..7d1281d81248 100644 +--- a/drivers/net/ethernet/ti/cpts.c ++++ b/drivers/net/ethernet/ti/cpts.c +@@ -567,7 +567,9 @@ struct cpts *cpts_create(struct device *dev, void __iomem *regs, + return ERR_PTR(PTR_ERR(cpts->refclk)); + } + +- clk_prepare(cpts->refclk); ++ ret = clk_prepare(cpts->refclk); ++ if (ret) ++ return ERR_PTR(ret); + + cpts->cc.read = cpts_systim_read; + cpts->cc.mask = CLOCKSOURCE_MASK(32); +diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c +index 963a02c988e9..8d5f88a538fc 100644 +--- a/drivers/net/macvlan.c ++++ b/drivers/net/macvlan.c +@@ -363,10 +363,11 @@ static void macvlan_broadcast_enqueue(struct macvlan_port *port, + } + spin_unlock(&port->bc_queue.lock); + ++ schedule_work(&port->bc_work); ++ + if (err) + goto free_nskb; + +- schedule_work(&port->bc_work); + return; + + free_nskb: +diff --git a/drivers/net/slip/slip.c b/drivers/net/slip/slip.c +index 2901b7db9d2e..d6dc00b4ba55 100644 +--- a/drivers/net/slip/slip.c ++++ b/drivers/net/slip/slip.c +@@ -859,6 +859,7 @@ err_free_chan: + sl->tty = NULL; + tty->disc_data = NULL; + clear_bit(SLF_INUSE, &sl->flags); ++ sl_free_netdev(sl->dev); + free_netdev(sl->dev); + + err_exit: +diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c +index 6d26bbd190dd..153a81ece9fe 100644 +--- a/drivers/net/vxlan.c ++++ b/drivers/net/vxlan.c +@@ -3217,6 +3217,7 @@ static int __vxlan_dev_create(struct net *net, struct net_device *dev, + struct vxlan_net *vn = net_generic(net, vxlan_net_id); + struct vxlan_dev *vxlan = netdev_priv(dev); + struct vxlan_fdb *f = NULL; ++ bool unregister = false; + int err; + + err = vxlan_dev_configure(net, dev, conf, false, extack); +@@ -3242,12 +3243,11 @@ static int __vxlan_dev_create(struct net *net, struct net_device *dev, + err = register_netdevice(dev); + if (err) + goto errout; ++ unregister = true; + + err = rtnl_configure_link(dev, NULL); +- if (err) { +- unregister_netdevice(dev); ++ if (err) + goto errout; +- } + + /* notify default fdb entry */ + if (f) +@@ -3255,9 +3255,16 @@ static int __vxlan_dev_create(struct net *net, struct net_device *dev, + + list_add(&vxlan->next, &vn->vxlan_list); + return 0; ++ + errout: ++ /* unregister_netdevice() destroys the default FDB entry with deletion ++ * notification. But the addition notification was not sent yet, so ++ * destroy the entry by hand here. ++ */ + if (f) + vxlan_fdb_destroy(vxlan, f, false); ++ if (unregister) ++ unregister_netdevice(dev); + return err; + } + +diff --git a/drivers/net/wan/fsl_ucc_hdlc.c b/drivers/net/wan/fsl_ucc_hdlc.c +index 18b648648adb..289dff262948 100644 +--- a/drivers/net/wan/fsl_ucc_hdlc.c ++++ b/drivers/net/wan/fsl_ucc_hdlc.c +@@ -1114,7 +1114,6 @@ static int ucc_hdlc_probe(struct platform_device *pdev) + if (register_hdlc_device(dev)) { + ret = -ENOBUFS; + pr_err("ucc_hdlc: unable to register hdlc device\n"); +- free_netdev(dev); + goto free_dev; + } + +diff --git a/drivers/net/wireless/ath/ath6kl/cfg80211.c b/drivers/net/wireless/ath/ath6kl/cfg80211.c +index 414b5b596efc..37deb9bae364 100644 +--- a/drivers/net/wireless/ath/ath6kl/cfg80211.c ++++ b/drivers/net/wireless/ath/ath6kl/cfg80211.c +@@ -939,7 +939,7 @@ static int ath6kl_set_probed_ssids(struct ath6kl *ar, + else + ssid_list[i].flag = ANY_SSID_FLAG; + +- if (n_match_ssid == 0) ++ if (ar->wiphy->max_match_sets != 0 && n_match_ssid == 0) + ssid_list[i].flag |= MATCH_SSID_FLAG; + } + +@@ -1093,7 +1093,7 @@ void ath6kl_cfg80211_scan_complete_event(struct ath6kl_vif *vif, bool aborted) + if (vif->scan_req->n_ssids && vif->scan_req->ssids[0].ssid_len) { + for (i = 0; i < vif->scan_req->n_ssids; i++) { + ath6kl_wmi_probedssid_cmd(ar->wmi, vif->fw_vif_idx, +- i + 1, DISABLE_SSID_FLAG, ++ i, DISABLE_SSID_FLAG, + 0, NULL); + } + } +diff --git a/drivers/net/wireless/intel/iwlwifi/dvm/main.c b/drivers/net/wireless/intel/iwlwifi/dvm/main.c +index 2acd94da9efe..051a2fea9572 100644 +--- a/drivers/net/wireless/intel/iwlwifi/dvm/main.c ++++ b/drivers/net/wireless/intel/iwlwifi/dvm/main.c +@@ -1229,6 +1229,23 @@ static int iwl_eeprom_init_hw_params(struct iwl_priv *priv) + return 0; + } + ++static int iwl_nvm_check_version(struct iwl_nvm_data *data, ++ struct iwl_trans *trans) ++{ ++ if (data->nvm_version >= trans->cfg->nvm_ver || ++ data->calib_version >= trans->cfg->nvm_calib_ver) { ++ IWL_DEBUG_INFO(trans, "device EEPROM VER=0x%x, CALIB=0x%x\n", ++ data->nvm_version, data->calib_version); ++ return 0; ++ } ++ ++ IWL_ERR(trans, ++ "Unsupported (too old) EEPROM VER=0x%x < 0x%x CALIB=0x%x < 0x%x\n", ++ data->nvm_version, trans->cfg->nvm_ver, ++ data->calib_version, trans->cfg->nvm_calib_ver); ++ return -EINVAL; ++} ++ + static struct iwl_op_mode *iwl_op_mode_dvm_start(struct iwl_trans *trans, + const struct iwl_cfg *cfg, + const struct iwl_fw *fw, +diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-parse.c b/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-parse.c +index 3199d345b427..92727f7e42db 100644 +--- a/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-parse.c ++++ b/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-parse.c +@@ -928,22 +928,3 @@ iwl_parse_eeprom_data(struct device *dev, const struct iwl_cfg *cfg, + return NULL; + } + IWL_EXPORT_SYMBOL(iwl_parse_eeprom_data); +- +-/* helper functions */ +-int iwl_nvm_check_version(struct iwl_nvm_data *data, +- struct iwl_trans *trans) +-{ +- if (data->nvm_version >= trans->cfg->nvm_ver || +- data->calib_version >= trans->cfg->nvm_calib_ver) { +- IWL_DEBUG_INFO(trans, "device EEPROM VER=0x%x, CALIB=0x%x\n", +- data->nvm_version, data->calib_version); +- return 0; +- } +- +- IWL_ERR(trans, +- "Unsupported (too old) EEPROM VER=0x%x < 0x%x CALIB=0x%x < 0x%x\n", +- data->nvm_version, trans->cfg->nvm_ver, +- data->calib_version, trans->cfg->nvm_calib_ver); +- return -EINVAL; +-} +-IWL_EXPORT_SYMBOL(iwl_nvm_check_version); +diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-parse.h b/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-parse.h +index b33888991b94..5545210151cd 100644 +--- a/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-parse.h ++++ b/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-parse.h +@@ -7,6 +7,7 @@ + * + * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved. + * Copyright(c) 2015 Intel Mobile Communications GmbH ++ * Copyright (C) 2018 Intel Corporation + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of version 2 of the GNU General Public License as +@@ -33,6 +34,7 @@ + * + * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved. + * Copyright(c) 2015 Intel Mobile Communications GmbH ++ * Copyright (C) 2018 Intel Corporation + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without +@@ -121,9 +123,6 @@ struct iwl_nvm_data * + iwl_parse_eeprom_data(struct device *dev, const struct iwl_cfg *cfg, + const u8 *eeprom, size_t eeprom_size); + +-int iwl_nvm_check_version(struct iwl_nvm_data *data, +- struct iwl_trans *trans); +- + int iwl_init_sband_channels(struct iwl_nvm_data *data, + struct ieee80211_supported_band *sband, + int n_channels, enum nl80211_band band); +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c +index 534c0ea7b232..78228f870f8f 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c +@@ -501,7 +501,9 @@ int iwl_run_init_mvm_ucode(struct iwl_mvm *mvm, bool read_nvm) + if (mvm->nvm_file_name) + iwl_mvm_load_nvm_to_nic(mvm); + +- WARN_ON(iwl_nvm_check_version(mvm->nvm_data, mvm->trans)); ++ WARN_ONCE(mvm->nvm_data->nvm_version < mvm->trans->cfg->nvm_ver, ++ "Too old NVM version (0x%0x, required = 0x%0x)", ++ mvm->nvm_data->nvm_version, mvm->trans->cfg->nvm_ver); + + /* + * abort after reading the nvm in case RF Kill is on, we will complete +diff --git a/drivers/net/wireless/marvell/mwifiex/debugfs.c b/drivers/net/wireless/marvell/mwifiex/debugfs.c +index 6f4239be609d..49ca84ef1a99 100644 +--- a/drivers/net/wireless/marvell/mwifiex/debugfs.c ++++ b/drivers/net/wireless/marvell/mwifiex/debugfs.c +@@ -296,15 +296,13 @@ mwifiex_histogram_read(struct file *file, char __user *ubuf, + "total samples = %d\n", + atomic_read(&phist_data->num_samples)); + +- p += sprintf(p, "rx rates (in Mbps): 0=1M 1=2M"); +- p += sprintf(p, "2=5.5M 3=11M 4=6M 5=9M 6=12M\n"); +- p += sprintf(p, "7=18M 8=24M 9=36M 10=48M 11=54M"); +- p += sprintf(p, "12-27=MCS0-15(BW20) 28-43=MCS0-15(BW40)\n"); ++ p += sprintf(p, ++ "rx rates (in Mbps): 0=1M 1=2M 2=5.5M 3=11M 4=6M 5=9M 6=12M\n" ++ "7=18M 8=24M 9=36M 10=48M 11=54M 12-27=MCS0-15(BW20) 28-43=MCS0-15(BW40)\n"); + + if (ISSUPP_11ACENABLED(priv->adapter->fw_cap_info)) { +- p += sprintf(p, "44-53=MCS0-9(VHT:BW20)"); +- p += sprintf(p, "54-63=MCS0-9(VHT:BW40)"); +- p += sprintf(p, "64-73=MCS0-9(VHT:BW80)\n\n"); ++ p += sprintf(p, ++ "44-53=MCS0-9(VHT:BW20) 54-63=MCS0-9(VHT:BW40) 64-73=MCS0-9(VHT:BW80)\n\n"); + } else { + p += sprintf(p, "\n"); + } +@@ -333,7 +331,7 @@ mwifiex_histogram_read(struct file *file, char __user *ubuf, + for (i = 0; i < MWIFIEX_MAX_NOISE_FLR; i++) { + value = atomic_read(&phist_data->noise_flr[i]); + if (value) +- p += sprintf(p, "noise_flr[-%02ddBm] = %d\n", ++ p += sprintf(p, "noise_flr[%02ddBm] = %d\n", + (int)(i-128), value); + } + for (i = 0; i < MWIFIEX_MAX_SIG_STRENGTH; i++) { +diff --git a/drivers/net/wireless/marvell/mwifiex/scan.c b/drivers/net/wireless/marvell/mwifiex/scan.c +index 67c334221077..c013c94fbf15 100644 +--- a/drivers/net/wireless/marvell/mwifiex/scan.c ++++ b/drivers/net/wireless/marvell/mwifiex/scan.c +@@ -1901,15 +1901,17 @@ mwifiex_parse_single_response_buf(struct mwifiex_private *priv, u8 **bss_info, + ETH_ALEN)) + mwifiex_update_curr_bss_params(priv, + bss); +- cfg80211_put_bss(priv->wdev.wiphy, bss); +- } + +- if ((chan->flags & IEEE80211_CHAN_RADAR) || +- (chan->flags & IEEE80211_CHAN_NO_IR)) { +- mwifiex_dbg(adapter, INFO, +- "radar or passive channel %d\n", +- channel); +- mwifiex_save_hidden_ssid_channels(priv, bss); ++ if ((chan->flags & IEEE80211_CHAN_RADAR) || ++ (chan->flags & IEEE80211_CHAN_NO_IR)) { ++ mwifiex_dbg(adapter, INFO, ++ "radar or passive channel %d\n", ++ channel); ++ mwifiex_save_hidden_ssid_channels(priv, ++ bss); ++ } ++ ++ cfg80211_put_bss(priv->wdev.wiphy, bss); + } + } + } else { +diff --git a/drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c b/drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c +index 9a1d15b3ce45..518caaaf8a98 100644 +--- a/drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c ++++ b/drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c +@@ -444,12 +444,13 @@ static int rtl8187_init_urbs(struct ieee80211_hw *dev) + skb_queue_tail(&priv->rx_queue, skb); + usb_anchor_urb(entry, &priv->anchored); + ret = usb_submit_urb(entry, GFP_KERNEL); +- usb_put_urb(entry); + if (ret) { + skb_unlink(skb, &priv->rx_queue); + usb_unanchor_urb(entry); ++ usb_put_urb(entry); + goto err; + } ++ usb_put_urb(entry); + } + return ret; + +diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c +index 536e9a5cd2b1..d66ef88e13cf 100644 +--- a/drivers/pci/msi.c ++++ b/drivers/pci/msi.c +@@ -1156,7 +1156,8 @@ int pci_alloc_irq_vectors_affinity(struct pci_dev *dev, unsigned int min_vecs, + const struct irq_affinity *affd) + { + static const struct irq_affinity msi_default_affd; +- int vecs = -ENOSPC; ++ int msix_vecs = -ENOSPC; ++ int msi_vecs = -ENOSPC; + + if (flags & PCI_IRQ_AFFINITY) { + if (!affd) +@@ -1167,16 +1168,17 @@ int pci_alloc_irq_vectors_affinity(struct pci_dev *dev, unsigned int min_vecs, + } + + if (flags & PCI_IRQ_MSIX) { +- vecs = __pci_enable_msix_range(dev, NULL, min_vecs, max_vecs, +- affd); +- if (vecs > 0) +- return vecs; ++ msix_vecs = __pci_enable_msix_range(dev, NULL, min_vecs, ++ max_vecs, affd); ++ if (msix_vecs > 0) ++ return msix_vecs; + } + + if (flags & PCI_IRQ_MSI) { +- vecs = __pci_enable_msi_range(dev, min_vecs, max_vecs, affd); +- if (vecs > 0) +- return vecs; ++ msi_vecs = __pci_enable_msi_range(dev, min_vecs, max_vecs, ++ affd); ++ if (msi_vecs > 0) ++ return msi_vecs; + } + + /* use legacy irq if allowed */ +@@ -1187,7 +1189,9 @@ int pci_alloc_irq_vectors_affinity(struct pci_dev *dev, unsigned int min_vecs, + } + } + +- return vecs; ++ if (msix_vecs == -ENOSPC) ++ return -ENOSPC; ++ return msi_vecs; + } + EXPORT_SYMBOL(pci_alloc_irq_vectors_affinity); + +diff --git a/drivers/pinctrl/pinctrl-xway.c b/drivers/pinctrl/pinctrl-xway.c +index f9e98a7d4f0c..1b0c5958c56a 100644 +--- a/drivers/pinctrl/pinctrl-xway.c ++++ b/drivers/pinctrl/pinctrl-xway.c +@@ -1748,14 +1748,6 @@ static int pinmux_xway_probe(struct platform_device *pdev) + } + xway_pctrl_desc.pins = xway_info.pads; + +- /* register the gpio chip */ +- xway_chip.parent = &pdev->dev; +- ret = devm_gpiochip_add_data(&pdev->dev, &xway_chip, NULL); +- if (ret) { +- dev_err(&pdev->dev, "Failed to register gpio chip\n"); +- return ret; +- } +- + /* setup the data needed by pinctrl */ + xway_pctrl_desc.name = dev_name(&pdev->dev); + xway_pctrl_desc.npins = xway_chip.ngpio; +@@ -1777,10 +1769,33 @@ static int pinmux_xway_probe(struct platform_device *pdev) + return ret; + } + +- /* finish with registering the gpio range in pinctrl */ +- xway_gpio_range.npins = xway_chip.ngpio; +- xway_gpio_range.base = xway_chip.base; +- pinctrl_add_gpio_range(xway_info.pctrl, &xway_gpio_range); ++ /* register the gpio chip */ ++ xway_chip.parent = &pdev->dev; ++ xway_chip.owner = THIS_MODULE; ++ xway_chip.of_node = pdev->dev.of_node; ++ ret = devm_gpiochip_add_data(&pdev->dev, &xway_chip, NULL); ++ if (ret) { ++ dev_err(&pdev->dev, "Failed to register gpio chip\n"); ++ return ret; ++ } ++ ++ /* ++ * For DeviceTree-supported systems, the gpio core checks the ++ * pinctrl's device node for the "gpio-ranges" property. ++ * If it is present, it takes care of adding the pin ranges ++ * for the driver. In this case the driver can skip ahead. ++ * ++ * In order to remain compatible with older, existing DeviceTree ++ * files which don't set the "gpio-ranges" property or systems that ++ * utilize ACPI the driver has to call gpiochip_add_pin_range(). ++ */ ++ if (!of_property_read_bool(pdev->dev.of_node, "gpio-ranges")) { ++ /* finish with registering the gpio range in pinctrl */ ++ xway_gpio_range.npins = xway_chip.ngpio; ++ xway_gpio_range.base = xway_chip.base; ++ pinctrl_add_gpio_range(xway_info.pctrl, &xway_gpio_range); ++ } ++ + dev_info(&pdev->dev, "Init done\n"); + return 0; + } +diff --git a/drivers/pinctrl/sh-pfc/pfc-sh7264.c b/drivers/pinctrl/sh-pfc/pfc-sh7264.c +index 8070765311db..e1c34e19222e 100644 +--- a/drivers/pinctrl/sh-pfc/pfc-sh7264.c ++++ b/drivers/pinctrl/sh-pfc/pfc-sh7264.c +@@ -1716,6 +1716,9 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = { + }, + + { PINMUX_CFG_REG("PFCR3", 0xfffe38a8, 16, 4) { ++ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, ++ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, ++ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, + PF12MD_000, PF12MD_001, 0, PF12MD_011, + PF12MD_100, PF12MD_101, 0, 0, + 0, 0, 0, 0, 0, 0, 0, 0 } +@@ -1759,8 +1762,10 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = { + 0, 0, 0, 0, 0, 0, 0, 0, + PF1MD_000, PF1MD_001, PF1MD_010, PF1MD_011, + PF1MD_100, PF1MD_101, 0, 0, +- 0, 0, 0, 0, 0, 0, 0, 0 +- } ++ 0, 0, 0, 0, 0, 0, 0, 0, ++ PF0MD_000, PF0MD_001, PF0MD_010, PF0MD_011, ++ PF0MD_100, PF0MD_101, 0, 0, ++ 0, 0, 0, 0, 0, 0, 0, 0 } + }, + + { PINMUX_CFG_REG("PFIOR0", 0xfffe38b2, 16, 1) { +diff --git a/drivers/pinctrl/sh-pfc/pfc-sh7734.c b/drivers/pinctrl/sh-pfc/pfc-sh7734.c +index 6502e676d368..33232041ee86 100644 +--- a/drivers/pinctrl/sh-pfc/pfc-sh7734.c ++++ b/drivers/pinctrl/sh-pfc/pfc-sh7734.c +@@ -2213,22 +2213,22 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = { + /* IP10_22 [1] */ + FN_CAN_CLK_A, FN_RX4_D, + /* IP10_21_19 [3] */ +- FN_AUDIO_CLKOUT, FN_TX1_E, FN_HRTS0_C, FN_FSE_B, +- FN_LCD_M_DISP_B, 0, 0, 0, ++ FN_AUDIO_CLKOUT, FN_TX1_E, 0, FN_HRTS0_C, FN_FSE_B, ++ FN_LCD_M_DISP_B, 0, 0, + /* IP10_18_16 [3] */ +- FN_AUDIO_CLKC, FN_SCK1_E, FN_HCTS0_C, FN_FRB_B, +- FN_LCD_VEPWC_B, 0, 0, 0, ++ FN_AUDIO_CLKC, FN_SCK1_E, 0, FN_HCTS0_C, FN_FRB_B, ++ FN_LCD_VEPWC_B, 0, 0, + /* IP10_15 [1] */ + FN_AUDIO_CLKB_A, FN_LCD_CLK_B, + /* IP10_14_12 [3] */ + FN_AUDIO_CLKA_A, FN_VI1_CLK_B, FN_SCK1_D, FN_IECLK_B, + FN_LCD_FLM_B, 0, 0, 0, + /* IP10_11_9 [3] */ +- FN_SSI_SDATA3, FN_VI1_7_B, FN_HTX0_C, FN_FWE_B, +- FN_LCD_CL2_B, 0, 0, 0, ++ FN_SSI_SDATA3, FN_VI1_7_B, 0, FN_HTX0_C, FN_FWE_B, ++ FN_LCD_CL2_B, 0, 0, + /* IP10_8_6 [3] */ +- FN_SSI_SDATA2, FN_VI1_6_B, FN_HRX0_C, FN_FRE_B, +- FN_LCD_CL1_B, 0, 0, 0, ++ FN_SSI_SDATA2, FN_VI1_6_B, 0, FN_HRX0_C, FN_FRE_B, ++ FN_LCD_CL1_B, 0, 0, + /* IP10_5_3 [3] */ + FN_SSI_WS23, FN_VI1_5_B, FN_TX1_D, FN_HSCK0_C, FN_FALE_B, + FN_LCD_DON_B, 0, 0, 0, +diff --git a/drivers/pinctrl/stm32/pinctrl-stm32.c b/drivers/pinctrl/stm32/pinctrl-stm32.c +index 50299ad96659..072bd11074c6 100644 +--- a/drivers/pinctrl/stm32/pinctrl-stm32.c ++++ b/drivers/pinctrl/stm32/pinctrl-stm32.c +@@ -403,7 +403,7 @@ static int stm32_pctrl_dt_subnode_to_map(struct pinctrl_dev *pctldev, + unsigned int num_configs; + bool has_config = 0; + unsigned reserve = 0; +- int num_pins, num_funcs, maps_per_pin, i, err; ++ int num_pins, num_funcs, maps_per_pin, i, err = 0; + + pctl = pinctrl_dev_get_drvdata(pctldev); + +@@ -430,41 +430,45 @@ static int stm32_pctrl_dt_subnode_to_map(struct pinctrl_dev *pctldev, + if (has_config && num_pins >= 1) + maps_per_pin++; + +- if (!num_pins || !maps_per_pin) +- return -EINVAL; ++ if (!num_pins || !maps_per_pin) { ++ err = -EINVAL; ++ goto exit; ++ } + + reserve = num_pins * maps_per_pin; + + err = pinctrl_utils_reserve_map(pctldev, map, + reserved_maps, num_maps, reserve); + if (err) +- return err; ++ goto exit; + + for (i = 0; i < num_pins; i++) { + err = of_property_read_u32_index(node, "pinmux", + i, &pinfunc); + if (err) +- return err; ++ goto exit; + + pin = STM32_GET_PIN_NO(pinfunc); + func = STM32_GET_PIN_FUNC(pinfunc); + + if (!stm32_pctrl_is_function_valid(pctl, pin, func)) { + dev_err(pctl->dev, "invalid function.\n"); +- return -EINVAL; ++ err = -EINVAL; ++ goto exit; + } + + grp = stm32_pctrl_find_group_by_pin(pctl, pin); + if (!grp) { + dev_err(pctl->dev, "unable to match pin %d to group\n", + pin); +- return -EINVAL; ++ err = -EINVAL; ++ goto exit; + } + + err = stm32_pctrl_dt_node_to_map_func(pctl, pin, func, grp, map, + reserved_maps, num_maps); + if (err) +- return err; ++ goto exit; + + if (has_config) { + err = pinctrl_utils_add_map_configs(pctldev, map, +@@ -472,11 +476,13 @@ static int stm32_pctrl_dt_subnode_to_map(struct pinctrl_dev *pctldev, + configs, num_configs, + PIN_MAP_TYPE_CONFIGS_GROUP); + if (err) +- return err; ++ goto exit; + } + } + +- return 0; ++exit: ++ kfree(configs); ++ return err; + } + + static int stm32_pctrl_dt_node_to_map(struct pinctrl_dev *pctldev, +diff --git a/drivers/platform/x86/hp-wmi.c b/drivers/platform/x86/hp-wmi.c +index b4224389febe..d0ffdd5d9199 100644 +--- a/drivers/platform/x86/hp-wmi.c ++++ b/drivers/platform/x86/hp-wmi.c +@@ -78,7 +78,7 @@ struct bios_args { + u32 command; + u32 commandtype; + u32 datasize; +- u32 data; ++ u8 data[128]; + }; + + enum hp_wmi_commandtype { +@@ -229,7 +229,7 @@ static int hp_wmi_perform_query(int query, enum hp_wmi_command command, + .command = command, + .commandtype = query, + .datasize = insize, +- .data = 0, ++ .data = { 0 }, + }; + struct acpi_buffer input = { sizeof(struct bios_args), &args }; + struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER, NULL }; +@@ -241,7 +241,7 @@ static int hp_wmi_perform_query(int query, enum hp_wmi_command command, + + if (WARN_ON(insize > sizeof(args.data))) + return -EINVAL; +- memcpy(&args.data, buffer, insize); ++ memcpy(&args.data[0], buffer, insize); + + wmi_evaluate_method(HPWMI_BIOS_GUID, 0, mid, &input, &output); + +@@ -393,7 +393,7 @@ static int hp_wmi_rfkill2_refresh(void) + int err, i; + + err = hp_wmi_perform_query(HPWMI_WIRELESS2_QUERY, HPWMI_READ, &state, +- 0, sizeof(state)); ++ sizeof(state), sizeof(state)); + if (err) + return err; + +@@ -790,7 +790,7 @@ static int __init hp_wmi_rfkill2_setup(struct platform_device *device) + int err, i; + + err = hp_wmi_perform_query(HPWMI_WIRELESS2_QUERY, HPWMI_READ, &state, +- 0, sizeof(state)); ++ sizeof(state), sizeof(state)); + if (err) + return err < 0 ? err : -EINVAL; + +diff --git a/drivers/power/avs/smartreflex.c b/drivers/power/avs/smartreflex.c +index 974fd684bab2..4b6fddc18394 100644 +--- a/drivers/power/avs/smartreflex.c ++++ b/drivers/power/avs/smartreflex.c +@@ -994,8 +994,7 @@ static int omap_sr_remove(struct platform_device *pdev) + + if (sr_info->autocomp_active) + sr_stop_vddautocomp(sr_info); +- if (sr_info->dbg_dir) +- debugfs_remove_recursive(sr_info->dbg_dir); ++ debugfs_remove_recursive(sr_info->dbg_dir); + + pm_runtime_disable(&pdev->dev); + list_del(&sr_info->node); +diff --git a/drivers/pwm/core.c b/drivers/pwm/core.c +index c45e5719ba17..b1b74cfb1571 100644 +--- a/drivers/pwm/core.c ++++ b/drivers/pwm/core.c +@@ -874,6 +874,7 @@ void pwm_put(struct pwm_device *pwm) + if (pwm->chip->ops->free) + pwm->chip->ops->free(pwm->chip, pwm); + ++ pwm_set_chip_data(pwm, NULL); + pwm->label = NULL; + + module_put(pwm->chip->ops->owner); +diff --git a/drivers/pwm/pwm-bcm-iproc.c b/drivers/pwm/pwm-bcm-iproc.c +index d961a8207b1c..31b01035d0ab 100644 +--- a/drivers/pwm/pwm-bcm-iproc.c ++++ b/drivers/pwm/pwm-bcm-iproc.c +@@ -187,6 +187,7 @@ static int iproc_pwmc_apply(struct pwm_chip *chip, struct pwm_device *pwm, + static const struct pwm_ops iproc_pwm_ops = { + .apply = iproc_pwmc_apply, + .get_state = iproc_pwmc_get_state, ++ .owner = THIS_MODULE, + }; + + static int iproc_pwmc_probe(struct platform_device *pdev) +diff --git a/drivers/pwm/pwm-berlin.c b/drivers/pwm/pwm-berlin.c +index 771859aca4be..7bb819e3c0c1 100644 +--- a/drivers/pwm/pwm-berlin.c ++++ b/drivers/pwm/pwm-berlin.c +@@ -78,7 +78,6 @@ static void berlin_pwm_free(struct pwm_chip *chip, struct pwm_device *pwm) + { + struct berlin_pwm_channel *channel = pwm_get_chip_data(pwm); + +- pwm_set_chip_data(pwm, NULL); + kfree(channel); + } + +diff --git a/drivers/pwm/pwm-clps711x.c b/drivers/pwm/pwm-clps711x.c +index 26ec24e457b1..7e16b7def0dc 100644 +--- a/drivers/pwm/pwm-clps711x.c ++++ b/drivers/pwm/pwm-clps711x.c +@@ -48,7 +48,7 @@ static void clps711x_pwm_update_val(struct clps711x_chip *priv, u32 n, u32 v) + static unsigned int clps711x_get_duty(struct pwm_device *pwm, unsigned int v) + { + /* Duty cycle 0..15 max */ +- return DIV_ROUND_CLOSEST(v * 0xf, pwm_get_period(pwm)); ++ return DIV_ROUND_CLOSEST(v * 0xf, pwm->args.period); + } + + static int clps711x_pwm_request(struct pwm_chip *chip, struct pwm_device *pwm) +@@ -71,7 +71,7 @@ static int clps711x_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm, + struct clps711x_chip *priv = to_clps711x_chip(chip); + unsigned int duty; + +- if (period_ns != pwm_get_period(pwm)) ++ if (period_ns != pwm->args.period) + return -EINVAL; + + duty = clps711x_get_duty(pwm, duty_ns); +diff --git a/drivers/pwm/pwm-pca9685.c b/drivers/pwm/pwm-pca9685.c +index a7eaf962a95b..567f5e2771c4 100644 +--- a/drivers/pwm/pwm-pca9685.c ++++ b/drivers/pwm/pwm-pca9685.c +@@ -176,7 +176,6 @@ static void pca9685_pwm_gpio_free(struct gpio_chip *gpio, unsigned int offset) + pm_runtime_put(pca->chip.dev); + mutex_lock(&pca->lock); + pwm = &pca->chip.pwms[offset]; +- pwm_set_chip_data(pwm, NULL); + mutex_unlock(&pca->lock); + } + +diff --git a/drivers/pwm/pwm-samsung.c b/drivers/pwm/pwm-samsung.c +index 062f2cfc45ec..3762432dd6a7 100644 +--- a/drivers/pwm/pwm-samsung.c ++++ b/drivers/pwm/pwm-samsung.c +@@ -238,7 +238,6 @@ static int pwm_samsung_request(struct pwm_chip *chip, struct pwm_device *pwm) + static void pwm_samsung_free(struct pwm_chip *chip, struct pwm_device *pwm) + { + devm_kfree(chip->dev, pwm_get_chip_data(pwm)); +- pwm_set_chip_data(pwm, NULL); + } + + static int pwm_samsung_enable(struct pwm_chip *chip, struct pwm_device *pwm) +diff --git a/drivers/regulator/palmas-regulator.c b/drivers/regulator/palmas-regulator.c +index bb5ab7d78895..c2cc392a27d4 100644 +--- a/drivers/regulator/palmas-regulator.c ++++ b/drivers/regulator/palmas-regulator.c +@@ -443,13 +443,16 @@ static int palmas_ldo_write(struct palmas *palmas, unsigned int reg, + static int palmas_set_mode_smps(struct regulator_dev *dev, unsigned int mode) + { + int id = rdev_get_id(dev); ++ int ret; + struct palmas_pmic *pmic = rdev_get_drvdata(dev); + struct palmas_pmic_driver_data *ddata = pmic->palmas->pmic_ddata; + struct palmas_regs_info *rinfo = &ddata->palmas_regs_info[id]; + unsigned int reg; + bool rail_enable = true; + +- palmas_smps_read(pmic->palmas, rinfo->ctrl_addr, ®); ++ ret = palmas_smps_read(pmic->palmas, rinfo->ctrl_addr, ®); ++ if (ret) ++ return ret; + + reg &= ~PALMAS_SMPS12_CTRL_MODE_ACTIVE_MASK; + +diff --git a/drivers/regulator/tps65910-regulator.c b/drivers/regulator/tps65910-regulator.c +index 81672a58fcc2..194fa0cbbc04 100644 +--- a/drivers/regulator/tps65910-regulator.c ++++ b/drivers/regulator/tps65910-regulator.c +@@ -1102,8 +1102,10 @@ static int tps65910_probe(struct platform_device *pdev) + platform_set_drvdata(pdev, pmic); + + /* Give control of all register to control port */ +- tps65910_reg_set_bits(pmic->mfd, TPS65910_DEVCTRL, ++ err = tps65910_reg_set_bits(pmic->mfd, TPS65910_DEVCTRL, + DEVCTRL_SR_CTL_I2C_SEL_MASK); ++ if (err < 0) ++ return err; + + switch (tps65910_chip_id(tps65910)) { + case TPS65910: +diff --git a/drivers/reset/core.c b/drivers/reset/core.c +index 72b96b5c75a8..7e0a14211c88 100644 +--- a/drivers/reset/core.c ++++ b/drivers/reset/core.c +@@ -513,6 +513,7 @@ static void reset_control_array_put(struct reset_control_array *resets) + for (i = 0; i < resets->num_rstcs; i++) + __reset_control_put_internal(resets->rstc[i]); + mutex_unlock(&reset_list_mutex); ++ kfree(resets); + } + + /** +diff --git a/drivers/scsi/csiostor/csio_init.c b/drivers/scsi/csiostor/csio_init.c +index 28a9c7d706cb..03c7b1603dbc 100644 +--- a/drivers/scsi/csiostor/csio_init.c ++++ b/drivers/scsi/csiostor/csio_init.c +@@ -649,7 +649,7 @@ csio_shost_init(struct csio_hw *hw, struct device *dev, + if (csio_lnode_init(ln, hw, pln)) + goto err_shost_put; + +- if (scsi_add_host(shost, dev)) ++ if (scsi_add_host_with_dma(shost, dev, &hw->pdev->dev)) + goto err_lnode_exit; + + return ln; +diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c +index 7f2d00354a85..f77d72f01da9 100644 +--- a/drivers/scsi/libsas/sas_expander.c ++++ b/drivers/scsi/libsas/sas_expander.c +@@ -614,7 +614,14 @@ int sas_smp_phy_control(struct domain_device *dev, int phy_id, + } + + res = smp_execute_task(dev, pc_req, PC_REQ_SIZE, pc_resp,PC_RESP_SIZE); +- ++ if (res) { ++ pr_err("ex %016llx phy%02d PHY control failed: %d\n", ++ SAS_ADDR(dev->sas_addr), phy_id, res); ++ } else if (pc_resp[2] != SMP_RESP_FUNC_ACC) { ++ pr_err("ex %016llx phy%02d PHY control failed: function result 0x%x\n", ++ SAS_ADDR(dev->sas_addr), phy_id, pc_resp[2]); ++ res = pc_resp[2]; ++ } + kfree(pc_resp); + kfree(pc_req); + return res; +@@ -817,6 +824,26 @@ static struct domain_device *sas_ex_discover_end_dev( + + #ifdef CONFIG_SCSI_SAS_ATA + if ((phy->attached_tproto & SAS_PROTOCOL_STP) || phy->attached_sata_dev) { ++ if (child->linkrate > parent->min_linkrate) { ++ struct sas_phy_linkrates rates = { ++ .maximum_linkrate = parent->min_linkrate, ++ .minimum_linkrate = parent->min_linkrate, ++ }; ++ int ret; ++ ++ pr_notice("ex %016llx phy%02d SATA device linkrate > min pathway connection rate, attempting to lower device linkrate\n", ++ SAS_ADDR(child->sas_addr), phy_id); ++ ret = sas_smp_phy_control(parent, phy_id, ++ PHY_FUNC_LINK_RESET, &rates); ++ if (ret) { ++ pr_err("ex %016llx phy%02d SATA device could not set linkrate (%d)\n", ++ SAS_ADDR(child->sas_addr), phy_id, ret); ++ goto out_free; ++ } ++ pr_notice("ex %016llx phy%02d SATA device set linkrate successfully\n", ++ SAS_ADDR(child->sas_addr), phy_id); ++ child->linkrate = child->min_linkrate; ++ } + res = sas_get_ata_info(child, phy); + if (res) + goto out_free; +diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h +index bc61cc8bc6f0..03e95a3216c8 100644 +--- a/drivers/scsi/lpfc/lpfc.h ++++ b/drivers/scsi/lpfc/lpfc.h +@@ -1239,6 +1239,12 @@ lpfc_sli_read_hs(struct lpfc_hba *phba) + static inline struct lpfc_sli_ring * + lpfc_phba_elsring(struct lpfc_hba *phba) + { ++ /* Return NULL if sli_rev has become invalid due to bad fw */ ++ if (phba->sli_rev != LPFC_SLI_REV4 && ++ phba->sli_rev != LPFC_SLI_REV3 && ++ phba->sli_rev != LPFC_SLI_REV2) ++ return NULL; ++ + if (phba->sli_rev == LPFC_SLI_REV4) { + if (phba->sli4_hba.els_wq) + return phba->sli4_hba.els_wq->pring; +diff --git a/drivers/scsi/lpfc/lpfc_attr.c b/drivers/scsi/lpfc/lpfc_attr.c +index 3da242201cb4..82ce5d193018 100644 +--- a/drivers/scsi/lpfc/lpfc_attr.c ++++ b/drivers/scsi/lpfc/lpfc_attr.c +@@ -1178,7 +1178,7 @@ lpfc_sli4_pdev_reg_request(struct lpfc_hba *phba, uint32_t opcode) + return -EACCES; + + if ((phba->sli_rev < LPFC_SLI_REV4) || +- (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) != ++ (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) < + LPFC_SLI_INTF_IF_TYPE_2)) + return -EPERM; + +@@ -4056,7 +4056,7 @@ lpfc_link_speed_store(struct device *dev, struct device_attribute *attr, + uint32_t prev_val, if_type; + + if_type = bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf); +- if (if_type == LPFC_SLI_INTF_IF_TYPE_2 && ++ if (if_type >= LPFC_SLI_INTF_IF_TYPE_2 && + phba->hba_flag & HBA_FORCED_LINK_SPEED) + return -EPERM; + +diff --git a/drivers/scsi/lpfc/lpfc_bsg.c b/drivers/scsi/lpfc/lpfc_bsg.c +index d89816222b23..6dde21dc82a3 100644 +--- a/drivers/scsi/lpfc/lpfc_bsg.c ++++ b/drivers/scsi/lpfc/lpfc_bsg.c +@@ -2221,7 +2221,7 @@ lpfc_bsg_diag_loopback_mode(struct bsg_job *job) + + if (phba->sli_rev < LPFC_SLI_REV4) + rc = lpfc_sli3_bsg_diag_loopback_mode(phba, job); +- else if (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) == ++ else if (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) >= + LPFC_SLI_INTF_IF_TYPE_2) + rc = lpfc_sli4_bsg_diag_loopback_mode(phba, job); + else +@@ -2261,7 +2261,7 @@ lpfc_sli4_bsg_diag_mode_end(struct bsg_job *job) + + if (phba->sli_rev < LPFC_SLI_REV4) + return -ENODEV; +- if (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) != ++ if (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) < + LPFC_SLI_INTF_IF_TYPE_2) + return -ENODEV; + +@@ -2353,7 +2353,7 @@ lpfc_sli4_bsg_link_diag_test(struct bsg_job *job) + rc = -ENODEV; + goto job_error; + } +- if (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) != ++ if (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) < + LPFC_SLI_INTF_IF_TYPE_2) { + rc = -ENODEV; + goto job_error; +diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c +index e5db20e8979d..c851fd14ff3e 100644 +--- a/drivers/scsi/lpfc/lpfc_els.c ++++ b/drivers/scsi/lpfc/lpfc_els.c +@@ -1337,6 +1337,8 @@ lpfc_els_abort_flogi(struct lpfc_hba *phba) + Fabric_DID); + + pring = lpfc_phba_elsring(phba); ++ if (unlikely(!pring)) ++ return -EIO; + + /* + * Check the txcmplq for an iocb that matches the nport the driver is +@@ -5548,7 +5550,7 @@ lpfc_els_rcv_rdp(struct lpfc_vport *vport, struct lpfc_iocbq *cmdiocb, + struct ls_rjt stat; + + if (phba->sli_rev < LPFC_SLI_REV4 || +- bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) != ++ bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) < + LPFC_SLI_INTF_IF_TYPE_2) { + rjt_err = LSRJT_UNABLE_TPC; + rjt_expl = LSEXP_REQ_UNSUPPORTED; +diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c +index d850077c5e22..3f88f3d79622 100644 +--- a/drivers/scsi/lpfc/lpfc_hbadisc.c ++++ b/drivers/scsi/lpfc/lpfc_hbadisc.c +@@ -4769,7 +4769,7 @@ lpfc_unreg_rpi(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp) + if (phba->sli_rev == LPFC_SLI_REV4 && + (!(vport->load_flag & FC_UNLOADING)) && + (bf_get(lpfc_sli_intf_if_type, +- &phba->sli4_hba.sli_intf) == ++ &phba->sli4_hba.sli_intf) >= + LPFC_SLI_INTF_IF_TYPE_2) && + (kref_read(&ndlp->kref) > 0)) { + mbox->context1 = lpfc_nlp_get(ndlp); +diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c +index 15bcd00dd7a2..c69c2a2b2ead 100644 +--- a/drivers/scsi/lpfc/lpfc_init.c ++++ b/drivers/scsi/lpfc/lpfc_init.c +@@ -1773,7 +1773,12 @@ lpfc_sli4_port_sta_fn_reset(struct lpfc_hba *phba, int mbx_action, + lpfc_offline(phba); + /* release interrupt for possible resource change */ + lpfc_sli4_disable_intr(phba); +- lpfc_sli_brdrestart(phba); ++ rc = lpfc_sli_brdrestart(phba); ++ if (rc) { ++ lpfc_printf_log(phba, KERN_ERR, LOG_INIT, ++ "6309 Failed to restart board\n"); ++ return rc; ++ } + /* request and enable interrupt */ + intr_mode = lpfc_sli4_enable_intr(phba, phba->intr_mode); + if (intr_mode == LPFC_INTR_ERROR) { +diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c +index 07cb671bb855..2eba0c39ac1c 100644 +--- a/drivers/scsi/lpfc/lpfc_scsi.c ++++ b/drivers/scsi/lpfc/lpfc_scsi.c +@@ -2714,6 +2714,7 @@ lpfc_bg_scsi_prep_dma_buf_s3(struct lpfc_hba *phba, + int datasegcnt, protsegcnt, datadir = scsi_cmnd->sc_data_direction; + int prot_group_type = 0; + int fcpdl; ++ struct lpfc_vport *vport = phba->pport; + + /* + * Start the lpfc command prep by bumping the bpl beyond fcp_cmnd +@@ -2819,6 +2820,14 @@ lpfc_bg_scsi_prep_dma_buf_s3(struct lpfc_hba *phba, + */ + iocb_cmd->un.fcpi.fcpi_parm = fcpdl; + ++ /* ++ * For First burst, we may need to adjust the initial transfer ++ * length for DIF ++ */ ++ if (iocb_cmd->un.fcpi.fcpi_XRdy && ++ (fcpdl < vport->cfg_first_burst_size)) ++ iocb_cmd->un.fcpi.fcpi_XRdy = fcpdl; ++ + return 0; + err: + if (lpfc_cmd->seg_cnt) +@@ -3371,6 +3380,7 @@ lpfc_bg_scsi_prep_dma_buf_s4(struct lpfc_hba *phba, + int datasegcnt, protsegcnt, datadir = scsi_cmnd->sc_data_direction; + int prot_group_type = 0; + int fcpdl; ++ struct lpfc_vport *vport = phba->pport; + + /* + * Start the lpfc command prep by bumping the sgl beyond fcp_cmnd +@@ -3486,6 +3496,14 @@ lpfc_bg_scsi_prep_dma_buf_s4(struct lpfc_hba *phba, + */ + iocb_cmd->un.fcpi.fcpi_parm = fcpdl; + ++ /* ++ * For First burst, we may need to adjust the initial transfer ++ * length for DIF ++ */ ++ if (iocb_cmd->un.fcpi.fcpi_XRdy && ++ (fcpdl < vport->cfg_first_burst_size)) ++ iocb_cmd->un.fcpi.fcpi_XRdy = fcpdl; ++ + /* + * If the OAS driver feature is enabled and the lun is enabled for + * OAS, set the oas iocb related flags. +diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c +index ebf7d3cda367..62bea4ffdc25 100644 +--- a/drivers/scsi/lpfc/lpfc_sli.c ++++ b/drivers/scsi/lpfc/lpfc_sli.c +@@ -4421,6 +4421,8 @@ lpfc_sli_brdrestart_s4(struct lpfc_hba *phba) + hba_aer_enabled = phba->hba_flag & HBA_AER_ENABLED; + + rc = lpfc_sli4_brdreset(phba); ++ if (rc) ++ return rc; + + spin_lock_irq(&phba->hbalock); + phba->pport->stopped = 0; +diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.c b/drivers/scsi/qla2xxx/tcm_qla2xxx.c +index 2fcdaadd10fa..e08ac431bc49 100644 +--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c ++++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c +@@ -903,38 +903,14 @@ static ssize_t tcm_qla2xxx_tpg_enable_show(struct config_item *item, + atomic_read(&tpg->lport_tpg_enabled)); + } + +-static void tcm_qla2xxx_depend_tpg(struct work_struct *work) +-{ +- struct tcm_qla2xxx_tpg *base_tpg = container_of(work, +- struct tcm_qla2xxx_tpg, tpg_base_work); +- struct se_portal_group *se_tpg = &base_tpg->se_tpg; +- struct scsi_qla_host *base_vha = base_tpg->lport->qla_vha; +- +- if (!target_depend_item(&se_tpg->tpg_group.cg_item)) { +- atomic_set(&base_tpg->lport_tpg_enabled, 1); +- qlt_enable_vha(base_vha); +- } +- complete(&base_tpg->tpg_base_comp); +-} +- +-static void tcm_qla2xxx_undepend_tpg(struct work_struct *work) +-{ +- struct tcm_qla2xxx_tpg *base_tpg = container_of(work, +- struct tcm_qla2xxx_tpg, tpg_base_work); +- struct se_portal_group *se_tpg = &base_tpg->se_tpg; +- struct scsi_qla_host *base_vha = base_tpg->lport->qla_vha; +- +- if (!qlt_stop_phase1(base_vha->vha_tgt.qla_tgt)) { +- atomic_set(&base_tpg->lport_tpg_enabled, 0); +- target_undepend_item(&se_tpg->tpg_group.cg_item); +- } +- complete(&base_tpg->tpg_base_comp); +-} +- + static ssize_t tcm_qla2xxx_tpg_enable_store(struct config_item *item, + const char *page, size_t count) + { + struct se_portal_group *se_tpg = to_tpg(item); ++ struct se_wwn *se_wwn = se_tpg->se_tpg_wwn; ++ struct tcm_qla2xxx_lport *lport = container_of(se_wwn, ++ struct tcm_qla2xxx_lport, lport_wwn); ++ struct scsi_qla_host *vha = lport->qla_vha; + struct tcm_qla2xxx_tpg *tpg = container_of(se_tpg, + struct tcm_qla2xxx_tpg, se_tpg); + unsigned long op; +@@ -953,24 +929,16 @@ static ssize_t tcm_qla2xxx_tpg_enable_store(struct config_item *item, + if (atomic_read(&tpg->lport_tpg_enabled)) + return -EEXIST; + +- INIT_WORK(&tpg->tpg_base_work, tcm_qla2xxx_depend_tpg); ++ atomic_set(&tpg->lport_tpg_enabled, 1); ++ qlt_enable_vha(vha); + } else { + if (!atomic_read(&tpg->lport_tpg_enabled)) + return count; + +- INIT_WORK(&tpg->tpg_base_work, tcm_qla2xxx_undepend_tpg); ++ atomic_set(&tpg->lport_tpg_enabled, 0); ++ qlt_stop_phase1(vha->vha_tgt.qla_tgt); + } +- init_completion(&tpg->tpg_base_comp); +- schedule_work(&tpg->tpg_base_work); +- wait_for_completion(&tpg->tpg_base_comp); + +- if (op) { +- if (!atomic_read(&tpg->lport_tpg_enabled)) +- return -ENODEV; +- } else { +- if (atomic_read(&tpg->lport_tpg_enabled)) +- return -EPERM; +- } + return count; + } + +diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.h b/drivers/scsi/qla2xxx/tcm_qla2xxx.h +index 7550ba2831c3..147cf6c90366 100644 +--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.h ++++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.h +@@ -48,9 +48,6 @@ struct tcm_qla2xxx_tpg { + struct tcm_qla2xxx_tpg_attrib tpg_attrib; + /* Returned by tcm_qla2xxx_make_tpg() */ + struct se_portal_group se_tpg; +- /* Items for dealing with configfs_depend_item */ +- struct completion tpg_base_comp; +- struct work_struct tpg_base_work; + }; + + struct tcm_qla2xxx_fc_loopid { +diff --git a/drivers/staging/rtl8192e/rtl8192e/rtl_core.c b/drivers/staging/rtl8192e/rtl8192e/rtl_core.c +index aca52654825b..811cada301ac 100644 +--- a/drivers/staging/rtl8192e/rtl8192e/rtl_core.c ++++ b/drivers/staging/rtl8192e/rtl8192e/rtl_core.c +@@ -1630,14 +1630,15 @@ static void _rtl92e_hard_data_xmit(struct sk_buff *skb, struct net_device *dev, + memcpy((unsigned char *)(skb->cb), &dev, sizeof(dev)); + skb_push(skb, priv->rtllib->tx_headroom); + ret = _rtl92e_tx(dev, skb); +- if (ret != 0) +- kfree_skb(skb); + + if (queue_index != MGNT_QUEUE) { + priv->rtllib->stats.tx_bytes += (skb->len - + priv->rtllib->tx_headroom); + priv->rtllib->stats.tx_packets++; + } ++ ++ if (ret != 0) ++ kfree_skb(skb); + } + + static int _rtl92e_hard_start_xmit(struct sk_buff *skb, struct net_device *dev) +diff --git a/drivers/staging/rtl8723bs/os_dep/sdio_intf.c b/drivers/staging/rtl8723bs/os_dep/sdio_intf.c +index 943324877707..33e052106ce7 100644 +--- a/drivers/staging/rtl8723bs/os_dep/sdio_intf.c ++++ b/drivers/staging/rtl8723bs/os_dep/sdio_intf.c +@@ -25,18 +25,13 @@ + static const struct sdio_device_id sdio_ids[] = + { + { SDIO_DEVICE(0x024c, 0x0523), }, ++ { SDIO_DEVICE(0x024c, 0x0525), }, + { SDIO_DEVICE(0x024c, 0x0623), }, + { SDIO_DEVICE(0x024c, 0x0626), }, + { SDIO_DEVICE(0x024c, 0xb723), }, + { /* end: all zeroes */ }, + }; +-static const struct acpi_device_id acpi_ids[] = { +- {"OBDA8723", 0x0000}, +- {} +-}; +- + MODULE_DEVICE_TABLE(sdio, sdio_ids); +-MODULE_DEVICE_TABLE(acpi, acpi_ids); + + static int rtw_drv_init(struct sdio_func *func, const struct sdio_device_id *id); + static void rtw_dev_remove(struct sdio_func *func); +diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c +index d29b512a7d9f..c698ebab6d3b 100644 +--- a/drivers/tty/serial/8250/8250_core.c ++++ b/drivers/tty/serial/8250/8250_core.c +@@ -953,6 +953,21 @@ static struct uart_8250_port *serial8250_find_match_or_unused(struct uart_port * + return NULL; + } + ++static void serial_8250_overrun_backoff_work(struct work_struct *work) ++{ ++ struct uart_8250_port *up = ++ container_of(to_delayed_work(work), struct uart_8250_port, ++ overrun_backoff); ++ struct uart_port *port = &up->port; ++ unsigned long flags; ++ ++ spin_lock_irqsave(&port->lock, flags); ++ up->ier |= UART_IER_RLSI | UART_IER_RDI; ++ up->port.read_status_mask |= UART_LSR_DR; ++ serial_out(up, UART_IER, up->ier); ++ spin_unlock_irqrestore(&port->lock, flags); ++} ++ + /** + * serial8250_register_8250_port - register a serial port + * @up: serial port template +@@ -1062,7 +1077,18 @@ int serial8250_register_8250_port(struct uart_8250_port *up) + + ret = 0; + } ++ ++ /* Initialise interrupt backoff work if required */ ++ if (up->overrun_backoff_time_ms > 0) { ++ uart->overrun_backoff_time_ms = ++ up->overrun_backoff_time_ms; ++ INIT_DELAYED_WORK(&uart->overrun_backoff, ++ serial_8250_overrun_backoff_work); ++ } else { ++ uart->overrun_backoff_time_ms = 0; ++ } + } ++ + mutex_unlock(&serial_mutex); + + return ret; +diff --git a/drivers/tty/serial/8250/8250_fsl.c b/drivers/tty/serial/8250/8250_fsl.c +index 910bfee5a88b..cc138c24ae88 100644 +--- a/drivers/tty/serial/8250/8250_fsl.c ++++ b/drivers/tty/serial/8250/8250_fsl.c +@@ -48,8 +48,29 @@ int fsl8250_handle_irq(struct uart_port *port) + + lsr = orig_lsr = up->port.serial_in(&up->port, UART_LSR); + +- if (lsr & (UART_LSR_DR | UART_LSR_BI)) ++ /* Process incoming characters first */ ++ if ((lsr & (UART_LSR_DR | UART_LSR_BI)) && ++ (up->ier & (UART_IER_RLSI | UART_IER_RDI))) { + lsr = serial8250_rx_chars(up, lsr); ++ } ++ ++ /* Stop processing interrupts on input overrun */ ++ if ((orig_lsr & UART_LSR_OE) && (up->overrun_backoff_time_ms > 0)) { ++ unsigned long delay; ++ ++ up->ier = port->serial_in(port, UART_IER); ++ if (up->ier & (UART_IER_RLSI | UART_IER_RDI)) { ++ port->ops->stop_rx(port); ++ } else { ++ /* Keep restarting the timer until ++ * the input overrun subsides. ++ */ ++ cancel_delayed_work(&up->overrun_backoff); ++ } ++ ++ delay = msecs_to_jiffies(up->overrun_backoff_time_ms); ++ schedule_delayed_work(&up->overrun_backoff, delay); ++ } + + serial8250_modem_status(up); + +diff --git a/drivers/tty/serial/8250/8250_of.c b/drivers/tty/serial/8250/8250_of.c +index ec510e342e06..c51044ba503c 100644 +--- a/drivers/tty/serial/8250/8250_of.c ++++ b/drivers/tty/serial/8250/8250_of.c +@@ -232,6 +232,11 @@ static int of_platform_serial_probe(struct platform_device *ofdev) + if (of_property_read_bool(ofdev->dev.of_node, "auto-flow-control")) + port8250.capabilities |= UART_CAP_AFE; + ++ if (of_property_read_u32(ofdev->dev.of_node, ++ "overrun-throttle-ms", ++ &port8250.overrun_backoff_time_ms) != 0) ++ port8250.overrun_backoff_time_ms = 0; ++ + ret = serial8250_register_8250_port(&port8250); + if (ret < 0) + goto err_dispose; +diff --git a/drivers/tty/serial/max310x.c b/drivers/tty/serial/max310x.c +index 0969a0d97b2b..cec995ec11ea 100644 +--- a/drivers/tty/serial/max310x.c ++++ b/drivers/tty/serial/max310x.c +@@ -769,12 +769,9 @@ static void max310x_start_tx(struct uart_port *port) + + static unsigned int max310x_tx_empty(struct uart_port *port) + { +- unsigned int lvl, sts; ++ u8 lvl = max310x_port_read(port, MAX310X_TXFIFOLVL_REG); + +- lvl = max310x_port_read(port, MAX310X_TXFIFOLVL_REG); +- sts = max310x_port_read(port, MAX310X_IRQSTS_REG); +- +- return ((sts & MAX310X_IRQ_TXEMPTY_BIT) && !lvl) ? TIOCSER_TEMT : 0; ++ return lvl ? 0 : TIOCSER_TEMT; + } + + static unsigned int max310x_get_mctrl(struct uart_port *port) +diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c +index 8b5c99df0f2b..a962065227c4 100644 +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -1028,6 +1028,9 @@ static const struct usb_device_id id_table_combined[] = { + /* Sienna devices */ + { USB_DEVICE(FTDI_VID, FTDI_SIENNA_PID) }, + { USB_DEVICE(ECHELON_VID, ECHELON_U20_PID) }, ++ /* U-Blox devices */ ++ { USB_DEVICE(UBLOX_VID, UBLOX_C099F9P_ZED_PID) }, ++ { USB_DEVICE(UBLOX_VID, UBLOX_C099F9P_ODIN_PID) }, + { } /* Terminating entry */ + }; + +diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h +index 22d66217cb41..e8373528264c 100644 +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -1558,3 +1558,10 @@ + */ + #define UNJO_VID 0x22B7 + #define UNJO_ISODEBUG_V1_PID 0x150D ++ ++/* ++ * U-Blox products (http://www.u-blox.com). ++ */ ++#define UBLOX_VID 0x1546 ++#define UBLOX_C099F9P_ZED_PID 0x0502 ++#define UBLOX_C099F9P_ODIN_PID 0x0503 +diff --git a/drivers/vfio/vfio_iommu_spapr_tce.c b/drivers/vfio/vfio_iommu_spapr_tce.c +index b4c68f3b82be..eba9aaf3cc17 100644 +--- a/drivers/vfio/vfio_iommu_spapr_tce.c ++++ b/drivers/vfio/vfio_iommu_spapr_tce.c +@@ -409,6 +409,7 @@ static void tce_iommu_release(void *iommu_data) + { + struct tce_container *container = iommu_data; + struct tce_iommu_group *tcegrp; ++ struct tce_iommu_prereg *tcemem, *tmtmp; + long i; + + while (tce_groups_attached(container)) { +@@ -431,13 +432,8 @@ static void tce_iommu_release(void *iommu_data) + tce_iommu_free_table(container, tbl); + } + +- while (!list_empty(&container->prereg_list)) { +- struct tce_iommu_prereg *tcemem; +- +- tcemem = list_first_entry(&container->prereg_list, +- struct tce_iommu_prereg, next); +- WARN_ON_ONCE(tce_iommu_prereg_free(container, tcemem)); +- } ++ list_for_each_entry_safe(tcemem, tmtmp, &container->prereg_list, next) ++ WARN_ON(tce_iommu_prereg_free(container, tcemem)); + + tce_iommu_disable(container); + if (container->mm) +diff --git a/drivers/watchdog/meson_gxbb_wdt.c b/drivers/watchdog/meson_gxbb_wdt.c +index 69a5a57f1446..61297a6ab43a 100644 +--- a/drivers/watchdog/meson_gxbb_wdt.c ++++ b/drivers/watchdog/meson_gxbb_wdt.c +@@ -137,8 +137,8 @@ static unsigned int meson_gxbb_wdt_get_timeleft(struct watchdog_device *wdt_dev) + + reg = readl(data->reg_base + GXBB_WDT_TCNT_REG); + +- return ((reg >> GXBB_WDT_TCNT_CNT_SHIFT) - +- (reg & GXBB_WDT_TCNT_SETUP_MASK)) / 1000; ++ return ((reg & GXBB_WDT_TCNT_SETUP_MASK) - ++ (reg >> GXBB_WDT_TCNT_CNT_SHIFT)) / 1000; + } + + static const struct watchdog_ops meson_gxbb_wdt_ops = { +diff --git a/drivers/watchdog/sama5d4_wdt.c b/drivers/watchdog/sama5d4_wdt.c +index 0ae947c3d7bc..d8cf2039c6a4 100644 +--- a/drivers/watchdog/sama5d4_wdt.c ++++ b/drivers/watchdog/sama5d4_wdt.c +@@ -111,9 +111,7 @@ static int sama5d4_wdt_set_timeout(struct watchdog_device *wdd, + u32 value = WDT_SEC2TICKS(timeout); + + wdt->mr &= ~AT91_WDT_WDV; +- wdt->mr &= ~AT91_WDT_WDD; + wdt->mr |= AT91_WDT_SET_WDV(value); +- wdt->mr |= AT91_WDT_SET_WDD(value); + + /* + * WDDIS has to be 0 when updating WDD/WDV. The datasheet states: When +@@ -255,7 +253,7 @@ static int sama5d4_wdt_probe(struct platform_device *pdev) + + timeout = WDT_SEC2TICKS(wdd->timeout); + +- wdt->mr |= AT91_WDT_SET_WDD(timeout); ++ wdt->mr |= AT91_WDT_SET_WDD(WDT_SEC2TICKS(MAX_WDT_TIMEOUT)); + wdt->mr |= AT91_WDT_SET_WDV(timeout); + + ret = sama5d4_wdt_init(wdt); +diff --git a/drivers/xen/xen-pciback/pci_stub.c b/drivers/xen/xen-pciback/pci_stub.c +index 9e480fdebe1f..8c250f4a3a97 100644 +--- a/drivers/xen/xen-pciback/pci_stub.c ++++ b/drivers/xen/xen-pciback/pci_stub.c +@@ -106,7 +106,8 @@ static void pcistub_device_release(struct kref *kref) + * is called from "unbind" which takes a device_lock mutex. + */ + __pci_reset_function_locked(dev); +- if (pci_load_and_free_saved_state(dev, &dev_data->pci_saved_state)) ++ if (dev_data && ++ pci_load_and_free_saved_state(dev, &dev_data->pci_saved_state)) + dev_info(&dev->dev, "Could not reload PCI state\n"); + else + pci_restore_state(dev); +diff --git a/fs/btrfs/delayed-ref.c b/fs/btrfs/delayed-ref.c +index 93ffa898df6d..d56bd3625468 100644 +--- a/fs/btrfs/delayed-ref.c ++++ b/fs/btrfs/delayed-ref.c +@@ -195,8 +195,6 @@ static inline void drop_delayed_ref(struct btrfs_trans_handle *trans, + ref->in_tree = 0; + btrfs_put_delayed_ref(ref); + atomic_dec(&delayed_refs->num_entries); +- if (trans->delayed_ref_updates) +- trans->delayed_ref_updates--; + } + + static bool merge_ref(struct btrfs_trans_handle *trans, +@@ -458,7 +456,6 @@ add_tail: + if (ref->action == BTRFS_ADD_DELAYED_REF) + list_add_tail(&ref->add_list, &href->ref_add_list); + atomic_inc(&root->num_entries); +- trans->delayed_ref_updates++; + spin_unlock(&href->lock); + return ret; + } +diff --git a/fs/ceph/super.c b/fs/ceph/super.c +index f0694293b31a..088c4488b449 100644 +--- a/fs/ceph/super.c ++++ b/fs/ceph/super.c +@@ -232,6 +232,7 @@ static int parse_fsopt_token(char *c, void *private) + return -ENOMEM; + break; + case Opt_fscache_uniq: ++#ifdef CONFIG_CEPH_FSCACHE + kfree(fsopt->fscache_uniq); + fsopt->fscache_uniq = kstrndup(argstr[0].from, + argstr[0].to-argstr[0].from, +@@ -240,7 +241,10 @@ static int parse_fsopt_token(char *c, void *private) + return -ENOMEM; + fsopt->flags |= CEPH_MOUNT_OPT_FSCACHE; + break; +- /* misc */ ++#else ++ pr_err("fscache support is disabled\n"); ++ return -EINVAL; ++#endif + case Opt_wsize: + if (intval < PAGE_SIZE || intval > CEPH_MAX_WRITE_SIZE) + return -EINVAL; +@@ -312,8 +316,13 @@ static int parse_fsopt_token(char *c, void *private) + fsopt->flags &= ~CEPH_MOUNT_OPT_INO32; + break; + case Opt_fscache: ++#ifdef CONFIG_CEPH_FSCACHE + fsopt->flags |= CEPH_MOUNT_OPT_FSCACHE; + break; ++#else ++ pr_err("fscache support is disabled\n"); ++ return -EINVAL; ++#endif + case Opt_nofscache: + fsopt->flags &= ~CEPH_MOUNT_OPT_FSCACHE; + break; +diff --git a/fs/exec.c b/fs/exec.c +index 4623fc3ac86b..7def97f6aac2 100644 +--- a/fs/exec.c ++++ b/fs/exec.c +@@ -1007,7 +1007,7 @@ static int exec_mmap(struct mm_struct *mm) + /* Notify parent that we're no longer interested in the old VM */ + tsk = current; + old_mm = current->mm; +- mm_release(tsk, old_mm); ++ exec_mm_release(tsk, old_mm); + + if (old_mm) { + sync_mm_rss(old_mm); +diff --git a/fs/exofs/super.c b/fs/exofs/super.c +index c9ec652e2fcd..881d5798a181 100644 +--- a/fs/exofs/super.c ++++ b/fs/exofs/super.c +@@ -702,21 +702,18 @@ out: + /* + * Read the superblock from the OSD and fill in the fields + */ +-static int exofs_fill_super(struct super_block *sb, void *data, int silent) ++static int exofs_fill_super(struct super_block *sb, ++ struct exofs_mountopt *opts, ++ struct exofs_sb_info *sbi, ++ int silent) + { + struct inode *root; +- struct exofs_mountopt *opts = data; +- struct exofs_sb_info *sbi; /*extended info */ + struct osd_dev *od; /* Master device */ + struct exofs_fscb fscb; /*on-disk superblock info */ + struct ore_comp comp; + unsigned table_count; + int ret; + +- sbi = kzalloc(sizeof(*sbi), GFP_KERNEL); +- if (!sbi) +- return -ENOMEM; +- + /* use mount options to fill superblock */ + if (opts->is_osdname) { + struct osd_dev_info odi = {.systemid_len = 0}; +@@ -860,7 +857,9 @@ static struct dentry *exofs_mount(struct file_system_type *type, + int flags, const char *dev_name, + void *data) + { ++ struct super_block *s; + struct exofs_mountopt opts; ++ struct exofs_sb_info *sbi; + int ret; + + ret = parse_options(data, &opts); +@@ -869,9 +868,31 @@ static struct dentry *exofs_mount(struct file_system_type *type, + return ERR_PTR(ret); + } + ++ sbi = kzalloc(sizeof(*sbi), GFP_KERNEL); ++ if (!sbi) { ++ kfree(opts.dev_name); ++ return ERR_PTR(-ENOMEM); ++ } ++ ++ s = sget(type, NULL, set_anon_super, flags, NULL); ++ ++ if (IS_ERR(s)) { ++ kfree(opts.dev_name); ++ kfree(sbi); ++ return ERR_CAST(s); ++ } ++ + if (!opts.dev_name) + opts.dev_name = dev_name; +- return mount_nodev(type, flags, &opts, exofs_fill_super); ++ ++ ++ ret = exofs_fill_super(s, &opts, sbi, flags & SB_SILENT ? 1 : 0); ++ if (ret) { ++ deactivate_locked_super(s); ++ return ERR_PTR(ret); ++ } ++ s->s_flags |= SB_ACTIVE; ++ return dget(s->s_root); + } + + /* +diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c +index 8c987a1994d4..b3d5fd84b485 100644 +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -5751,8 +5751,23 @@ static int __ext4_expand_extra_isize(struct inode *inode, + { + struct ext4_inode *raw_inode; + struct ext4_xattr_ibody_header *header; ++ unsigned int inode_size = EXT4_INODE_SIZE(inode->i_sb); ++ struct ext4_inode_info *ei = EXT4_I(inode); + int error; + ++ /* this was checked at iget time, but double check for good measure */ ++ if ((EXT4_GOOD_OLD_INODE_SIZE + ei->i_extra_isize > inode_size) || ++ (ei->i_extra_isize & 3)) { ++ EXT4_ERROR_INODE(inode, "bad extra_isize %u (inode size %u)", ++ ei->i_extra_isize, ++ EXT4_INODE_SIZE(inode->i_sb)); ++ return -EFSCORRUPTED; ++ } ++ if ((new_extra_isize < ei->i_extra_isize) || ++ (new_extra_isize < 4) || ++ (new_extra_isize > inode_size - EXT4_GOOD_OLD_INODE_SIZE)) ++ return -EINVAL; /* Should never happen */ ++ + raw_inode = ext4_raw_inode(iloc); + + header = IHDR(inode, raw_inode); +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index 61d07608577e..1a0a56647974 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -3458,12 +3458,15 @@ static void ext4_clamp_want_extra_isize(struct super_block *sb) + { + struct ext4_sb_info *sbi = EXT4_SB(sb); + struct ext4_super_block *es = sbi->s_es; ++ unsigned def_extra_isize = sizeof(struct ext4_inode) - ++ EXT4_GOOD_OLD_INODE_SIZE; + +- /* determine the minimum size of new large inodes, if present */ +- if (sbi->s_inode_size > EXT4_GOOD_OLD_INODE_SIZE && +- sbi->s_want_extra_isize == 0) { +- sbi->s_want_extra_isize = sizeof(struct ext4_inode) - +- EXT4_GOOD_OLD_INODE_SIZE; ++ if (sbi->s_inode_size == EXT4_GOOD_OLD_INODE_SIZE) { ++ sbi->s_want_extra_isize = 0; ++ return; ++ } ++ if (sbi->s_want_extra_isize < 4) { ++ sbi->s_want_extra_isize = def_extra_isize; + if (ext4_has_feature_extra_isize(sb)) { + if (sbi->s_want_extra_isize < + le16_to_cpu(es->s_want_extra_isize)) +@@ -3476,10 +3479,10 @@ static void ext4_clamp_want_extra_isize(struct super_block *sb) + } + } + /* Check if enough inode space is available */ +- if (EXT4_GOOD_OLD_INODE_SIZE + sbi->s_want_extra_isize > +- sbi->s_inode_size) { +- sbi->s_want_extra_isize = sizeof(struct ext4_inode) - +- EXT4_GOOD_OLD_INODE_SIZE; ++ if ((sbi->s_want_extra_isize > sbi->s_inode_size) || ++ (EXT4_GOOD_OLD_INODE_SIZE + sbi->s_want_extra_isize > ++ sbi->s_inode_size)) { ++ sbi->s_want_extra_isize = def_extra_isize; + ext4_msg(sb, KERN_INFO, + "required extra inode space not available"); + } +diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c +index 1b1792199445..d68b0132718a 100644 +--- a/fs/f2fs/file.c ++++ b/fs/f2fs/file.c +@@ -1593,7 +1593,7 @@ static int __f2fs_ioc_setflags(struct inode *inode, unsigned int flags) + + inode->i_ctime = current_time(inode); + f2fs_set_inode_flags(inode); +- f2fs_mark_inode_dirty_sync(inode, false); ++ f2fs_mark_inode_dirty_sync(inode, true); + return 0; + } + +diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c +index 09432b25fe9b..b3a1b16d4e3e 100644 +--- a/fs/gfs2/bmap.c ++++ b/fs/gfs2/bmap.c +@@ -1445,6 +1445,8 @@ static int do_grow(struct inode *inode, u64 size) + } + + error = gfs2_trans_begin(sdp, RES_DINODE + RES_STATFS + RES_RG_BIT + ++ (unstuff && ++ gfs2_is_jdata(ip) ? RES_JDATA : 0) + + (sdp->sd_args.ar_quota == GFS2_QUOTA_OFF ? + 0 : RES_QUOTA), 0); + if (error) +diff --git a/fs/ocfs2/journal.c b/fs/ocfs2/journal.c +index f7fba58618ef..2459ae9d2234 100644 +--- a/fs/ocfs2/journal.c ++++ b/fs/ocfs2/journal.c +@@ -1018,7 +1018,8 @@ void ocfs2_journal_shutdown(struct ocfs2_super *osb) + mlog_errno(status); + } + +- if (status == 0) { ++ /* Shutdown the kernel journal system */ ++ if (!jbd2_journal_destroy(journal->j_journal) && !status) { + /* + * Do not toggle if flush was unsuccessful otherwise + * will leave dirty metadata in a "clean" journal +@@ -1027,9 +1028,6 @@ void ocfs2_journal_shutdown(struct ocfs2_super *osb) + if (status < 0) + mlog_errno(status); + } +- +- /* Shutdown the kernel journal system */ +- jbd2_journal_destroy(journal->j_journal); + journal->j_journal = NULL; + + OCFS2_I(inode)->ip_open_count--; +diff --git a/fs/xfs/xfs_ioctl32.c b/fs/xfs/xfs_ioctl32.c +index fa0bc4d46065..5f616a6a5358 100644 +--- a/fs/xfs/xfs_ioctl32.c ++++ b/fs/xfs/xfs_ioctl32.c +@@ -252,6 +252,32 @@ xfs_compat_ioc_bulkstat( + int done; + int error; + ++ /* ++ * Output structure handling functions. Depending on the command, ++ * either the xfs_bstat and xfs_inogrp structures are written out ++ * to userpace memory via bulkreq.ubuffer. Normally the compat ++ * functions and structure size are the correct ones to use ... ++ */ ++ inumbers_fmt_pf inumbers_func = xfs_inumbers_fmt_compat; ++ bulkstat_one_pf bs_one_func = xfs_bulkstat_one_compat; ++ size_t bs_one_size = sizeof(struct compat_xfs_bstat); ++ ++#ifdef CONFIG_X86_X32 ++ if (in_x32_syscall()) { ++ /* ++ * ... but on x32 the input xfs_fsop_bulkreq has pointers ++ * which must be handled in the "compat" (32-bit) way, while ++ * the xfs_bstat and xfs_inogrp structures follow native 64- ++ * bit layout convention. So adjust accordingly, otherwise ++ * the data written out in compat layout will not match what ++ * x32 userspace expects. ++ */ ++ inumbers_func = xfs_inumbers_fmt; ++ bs_one_func = xfs_bulkstat_one; ++ bs_one_size = sizeof(struct xfs_bstat); ++ } ++#endif ++ + /* done = 1 if there are more stats to get and if bulkstat */ + /* should be called again (unused here, but used in dmapi) */ + +@@ -283,15 +309,15 @@ xfs_compat_ioc_bulkstat( + + if (cmd == XFS_IOC_FSINUMBERS_32) { + error = xfs_inumbers(mp, &inlast, &count, +- bulkreq.ubuffer, xfs_inumbers_fmt_compat); ++ bulkreq.ubuffer, inumbers_func); + } else if (cmd == XFS_IOC_FSBULKSTAT_SINGLE_32) { + int res; + +- error = xfs_bulkstat_one_compat(mp, inlast, bulkreq.ubuffer, +- sizeof(compat_xfs_bstat_t), NULL, &res); ++ error = bs_one_func(mp, inlast, bulkreq.ubuffer, ++ bs_one_size, NULL, &res); + } else if (cmd == XFS_IOC_FSBULKSTAT_32) { + error = xfs_bulkstat(mp, &inlast, &count, +- xfs_bulkstat_one_compat, sizeof(compat_xfs_bstat_t), ++ bs_one_func, bs_one_size, + bulkreq.ubuffer, &done); + } else + error = -EINVAL; +@@ -347,6 +373,7 @@ xfs_compat_attrlist_by_handle( + { + int error; + attrlist_cursor_kern_t *cursor; ++ compat_xfs_fsop_attrlist_handlereq_t __user *p = arg; + compat_xfs_fsop_attrlist_handlereq_t al_hreq; + struct dentry *dentry; + char *kbuf; +@@ -381,6 +408,11 @@ xfs_compat_attrlist_by_handle( + if (error) + goto out_kfree; + ++ if (copy_to_user(&p->pos, cursor, sizeof(attrlist_cursor_kern_t))) { ++ error = -EFAULT; ++ goto out_kfree; ++ } ++ + if (copy_to_user(compat_ptr(al_hreq.buffer), kbuf, al_hreq.buflen)) + error = -EFAULT; + +diff --git a/fs/xfs/xfs_rtalloc.c b/fs/xfs/xfs_rtalloc.c +index 488719d43ca8..cdcb7235e41a 100644 +--- a/fs/xfs/xfs_rtalloc.c ++++ b/fs/xfs/xfs_rtalloc.c +@@ -1214,13 +1214,11 @@ xfs_rtmount_inodes( + xfs_sb_t *sbp; + + sbp = &mp->m_sb; +- if (sbp->sb_rbmino == NULLFSINO) +- return 0; + error = xfs_iget(mp, NULL, sbp->sb_rbmino, 0, 0, &mp->m_rbmip); + if (error) + return error; + ASSERT(mp->m_rbmip != NULL); +- ASSERT(sbp->sb_rsumino != NULLFSINO); ++ + error = xfs_iget(mp, NULL, sbp->sb_rsumino, 0, 0, &mp->m_rsumip); + if (error) { + IRELE(mp->m_rbmip); +diff --git a/include/linux/blktrace_api.h b/include/linux/blktrace_api.h +index 8804753805ac..7bb2d8de9f30 100644 +--- a/include/linux/blktrace_api.h ++++ b/include/linux/blktrace_api.h +@@ -116,7 +116,13 @@ extern void blk_fill_rwbs(char *rwbs, unsigned int op, int bytes); + + static inline sector_t blk_rq_trace_sector(struct request *rq) + { +- return blk_rq_is_passthrough(rq) ? 0 : blk_rq_pos(rq); ++ /* ++ * Tracing should ignore starting sector for passthrough requests and ++ * requests where starting sector didn't get set. ++ */ ++ if (blk_rq_is_passthrough(rq) || blk_rq_pos(rq) == (sector_t)-1) ++ return 0; ++ return blk_rq_pos(rq); + } + + static inline unsigned int blk_rq_trace_nr_sectors(struct request *rq) +diff --git a/include/linux/compat.h b/include/linux/compat.h +index 23909d12f729..cec96d4794d0 100644 +--- a/include/linux/compat.h ++++ b/include/linux/compat.h +@@ -324,8 +324,6 @@ struct compat_kexec_segment; + struct compat_mq_attr; + struct compat_msgbuf; + +-extern void compat_exit_robust_list(struct task_struct *curr); +- + asmlinkage long + compat_sys_set_robust_list(struct compat_robust_list_head __user *head, + compat_size_t len); +diff --git a/include/linux/futex.h b/include/linux/futex.h +index c0fb9a24bbd2..a4b6cba699bf 100644 +--- a/include/linux/futex.h ++++ b/include/linux/futex.h +@@ -2,7 +2,9 @@ + #ifndef _LINUX_FUTEX_H + #define _LINUX_FUTEX_H + ++#include + #include ++ + #include + + struct inode; +@@ -12,9 +14,6 @@ struct task_struct; + long do_futex(u32 __user *uaddr, int op, u32 val, ktime_t *timeout, + u32 __user *uaddr2, u32 val2, u32 val3); + +-extern int +-handle_futex_death(u32 __user *uaddr, struct task_struct *curr, int pi); +- + /* + * Futexes are matched on equal values of this key. + * The key type depends on whether it's a shared or private mapping. +@@ -54,24 +53,35 @@ union futex_key { + #define FUTEX_KEY_INIT (union futex_key) { .both = { .ptr = NULL } } + + #ifdef CONFIG_FUTEX +-extern void exit_robust_list(struct task_struct *curr); +-#ifdef CONFIG_HAVE_FUTEX_CMPXCHG +-#define futex_cmpxchg_enabled 1 +-#else +-extern int futex_cmpxchg_enabled; +-#endif +-#else +-static inline void exit_robust_list(struct task_struct *curr) ++enum { ++ FUTEX_STATE_OK, ++ FUTEX_STATE_EXITING, ++ FUTEX_STATE_DEAD, ++}; ++ ++static inline void futex_init_task(struct task_struct *tsk) + { +-} ++ tsk->robust_list = NULL; ++#ifdef CONFIG_COMPAT ++ tsk->compat_robust_list = NULL; + #endif ++ INIT_LIST_HEAD(&tsk->pi_state_list); ++ tsk->pi_state_cache = NULL; ++ tsk->futex_state = FUTEX_STATE_OK; ++ mutex_init(&tsk->futex_exit_mutex); ++} + +-#ifdef CONFIG_FUTEX_PI +-extern void exit_pi_state_list(struct task_struct *curr); ++void futex_exit_recursive(struct task_struct *tsk); ++void futex_exit_release(struct task_struct *tsk); ++void futex_exec_release(struct task_struct *tsk); ++ ++long do_futex(u32 __user *uaddr, int op, u32 val, ktime_t *timeout, ++ u32 __user *uaddr2, u32 val2, u32 val3); + #else +-static inline void exit_pi_state_list(struct task_struct *curr) +-{ +-} ++static inline void futex_init_task(struct task_struct *tsk) { } ++static inline void futex_exit_recursive(struct task_struct *tsk) { } ++static inline void futex_exit_release(struct task_struct *tsk) { } ++static inline void futex_exec_release(struct task_struct *tsk) { } + #endif + + #endif +diff --git a/include/linux/genalloc.h b/include/linux/genalloc.h +index 872f930f1b06..dd0a452373e7 100644 +--- a/include/linux/genalloc.h ++++ b/include/linux/genalloc.h +@@ -51,7 +51,8 @@ typedef unsigned long (*genpool_algo_t)(unsigned long *map, + unsigned long size, + unsigned long start, + unsigned int nr, +- void *data, struct gen_pool *pool); ++ void *data, struct gen_pool *pool, ++ unsigned long start_addr); + + /* + * General purpose special memory pool descriptor. +@@ -131,24 +132,24 @@ extern void gen_pool_set_algo(struct gen_pool *pool, genpool_algo_t algo, + + extern unsigned long gen_pool_first_fit(unsigned long *map, unsigned long size, + unsigned long start, unsigned int nr, void *data, +- struct gen_pool *pool); ++ struct gen_pool *pool, unsigned long start_addr); + + extern unsigned long gen_pool_fixed_alloc(unsigned long *map, + unsigned long size, unsigned long start, unsigned int nr, +- void *data, struct gen_pool *pool); ++ void *data, struct gen_pool *pool, unsigned long start_addr); + + extern unsigned long gen_pool_first_fit_align(unsigned long *map, + unsigned long size, unsigned long start, unsigned int nr, +- void *data, struct gen_pool *pool); ++ void *data, struct gen_pool *pool, unsigned long start_addr); + + + extern unsigned long gen_pool_first_fit_order_align(unsigned long *map, + unsigned long size, unsigned long start, unsigned int nr, +- void *data, struct gen_pool *pool); ++ void *data, struct gen_pool *pool, unsigned long start_addr); + + extern unsigned long gen_pool_best_fit(unsigned long *map, unsigned long size, + unsigned long start, unsigned int nr, void *data, +- struct gen_pool *pool); ++ struct gen_pool *pool, unsigned long start_addr); + + + extern struct gen_pool *devm_gen_pool_create(struct device *dev, +diff --git a/include/linux/gpio/consumer.h b/include/linux/gpio/consumer.h +index c4a350d83578..79ad4f8b889d 100644 +--- a/include/linux/gpio/consumer.h ++++ b/include/linux/gpio/consumer.h +@@ -404,7 +404,7 @@ static inline int gpiod_to_irq(const struct gpio_desc *desc) + + static inline struct gpio_desc *gpio_to_desc(unsigned gpio) + { +- return ERR_PTR(-EINVAL); ++ return NULL; + } + + static inline int desc_to_gpio(const struct gpio_desc *desc) +diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h +index 40b830d55fe5..4725a9d9597f 100644 +--- a/include/linux/netdevice.h ++++ b/include/linux/netdevice.h +@@ -3522,7 +3522,7 @@ static inline u32 netif_msg_init(int debug_value, int default_msg_enable_bits) + if (debug_value == 0) /* no output */ + return 0; + /* set low N bits */ +- return (1 << debug_value) - 1; ++ return (1U << debug_value) - 1; + } + + static inline void __netif_tx_lock(struct netdev_queue *txq, int cpu) +diff --git a/include/linux/reset-controller.h b/include/linux/reset-controller.h +index adb88f8cefbc..576caaf0c9af 100644 +--- a/include/linux/reset-controller.h ++++ b/include/linux/reset-controller.h +@@ -7,7 +7,7 @@ + struct reset_controller_dev; + + /** +- * struct reset_control_ops ++ * struct reset_control_ops - reset controller driver callbacks + * + * @reset: for self-deasserting resets, does all necessary + * things to reset the device +diff --git a/include/linux/sched.h b/include/linux/sched.h +index 866439c361a9..b06577652643 100644 +--- a/include/linux/sched.h ++++ b/include/linux/sched.h +@@ -959,6 +959,8 @@ struct task_struct { + #endif + struct list_head pi_state_list; + struct futex_pi_state *pi_state_cache; ++ struct mutex futex_exit_mutex; ++ unsigned int futex_state; + #endif + #ifdef CONFIG_PERF_EVENTS + struct perf_event_context *perf_event_ctxp[perf_nr_task_contexts]; +@@ -1334,7 +1336,6 @@ extern struct pid *cad_pid; + */ + #define PF_IDLE 0x00000002 /* I am an IDLE thread */ + #define PF_EXITING 0x00000004 /* Getting shut down */ +-#define PF_EXITPIDONE 0x00000008 /* PI exit done on shut down */ + #define PF_VCPU 0x00000010 /* I'm a virtual CPU */ + #define PF_WQ_WORKER 0x00000020 /* I'm a workqueue worker */ + #define PF_FORKNOEXEC 0x00000040 /* Forked but didn't exec */ +diff --git a/include/linux/sched/mm.h b/include/linux/sched/mm.h +index 9f7cc1d7ec4a..efb9e12e7f91 100644 +--- a/include/linux/sched/mm.h ++++ b/include/linux/sched/mm.h +@@ -125,8 +125,10 @@ extern struct mm_struct *get_task_mm(struct task_struct *task); + * succeeds. + */ + extern struct mm_struct *mm_access(struct task_struct *task, unsigned int mode); +-/* Remove the current tasks stale references to the old mm_struct */ +-extern void mm_release(struct task_struct *, struct mm_struct *); ++/* Remove the current tasks stale references to the old mm_struct on exit() */ ++extern void exit_mm_release(struct task_struct *, struct mm_struct *); ++/* Remove the current tasks stale references to the old mm_struct on exec() */ ++extern void exec_mm_release(struct task_struct *, struct mm_struct *); + + #ifdef CONFIG_MEMCG + extern void mm_update_next_owner(struct mm_struct *mm); +diff --git a/include/linux/sched/task.h b/include/linux/sched/task.h +index a74ec619ac51..11b4fba82950 100644 +--- a/include/linux/sched/task.h ++++ b/include/linux/sched/task.h +@@ -39,6 +39,8 @@ void __noreturn do_task_dead(void); + + extern void proc_caches_init(void); + ++extern void fork_init(void); ++ + extern void release_task(struct task_struct * p); + + #ifdef CONFIG_HAVE_COPY_THREAD_TLS +diff --git a/include/linux/serial_8250.h b/include/linux/serial_8250.h +index a27ef5f56431..791a6be0e394 100644 +--- a/include/linux/serial_8250.h ++++ b/include/linux/serial_8250.h +@@ -134,6 +134,10 @@ struct uart_8250_port { + void (*dl_write)(struct uart_8250_port *, int); + + struct uart_8250_em485 *em485; ++ ++ /* Serial port overrun backoff */ ++ struct delayed_work overrun_backoff; ++ u32 overrun_backoff_time_ms; + }; + + static inline struct uart_8250_port *up_to_u8250p(struct uart_port *up) +diff --git a/include/linux/swap.h b/include/linux/swap.h +index e643866912b7..411953964c34 100644 +--- a/include/linux/swap.h ++++ b/include/linux/swap.h +@@ -363,14 +363,8 @@ extern unsigned long vm_total_pages; + extern int node_reclaim_mode; + extern int sysctl_min_unmapped_ratio; + extern int sysctl_min_slab_ratio; +-extern int node_reclaim(struct pglist_data *, gfp_t, unsigned int); + #else + #define node_reclaim_mode 0 +-static inline int node_reclaim(struct pglist_data *pgdat, gfp_t mask, +- unsigned int order) +-{ +- return 0; +-} + #endif + + extern int page_evictable(struct page *page); +diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h +index 94c775773f58..c1f71dd464d3 100644 +--- a/include/net/sctp/structs.h ++++ b/include/net/sctp/structs.h +@@ -1181,6 +1181,9 @@ struct sctp_ep_common { + /* What socket does this endpoint belong to? */ + struct sock *sk; + ++ /* Cache netns and it won't change once set */ ++ struct net *net; ++ + /* This is where we receive inbound chunks. */ + struct sctp_inq inqueue; + +diff --git a/include/net/sock.h b/include/net/sock.h +index 780c6c0a86f0..0af46cbd3649 100644 +--- a/include/net/sock.h ++++ b/include/net/sock.h +@@ -1232,7 +1232,7 @@ static inline void sk_sockets_allocated_inc(struct sock *sk) + percpu_counter_inc(sk->sk_prot->sockets_allocated); + } + +-static inline int ++static inline u64 + sk_sockets_allocated_read_positive(struct sock *sk) + { + return percpu_counter_read_positive(sk->sk_prot->sockets_allocated); +diff --git a/init/main.c b/init/main.c +index 51067e2db509..b1ab36fe1a55 100644 +--- a/init/main.c ++++ b/init/main.c +@@ -98,7 +98,6 @@ + static int kernel_init(void *); + + extern void init_IRQ(void); +-extern void fork_init(void); + extern void radix_tree_init(void); + + /* +diff --git a/kernel/Makefile b/kernel/Makefile +index 3085141c055c..43e92e3691ec 100644 +--- a/kernel/Makefile ++++ b/kernel/Makefile +@@ -49,9 +49,6 @@ obj-$(CONFIG_PROFILING) += profile.o + obj-$(CONFIG_STACKTRACE) += stacktrace.o + obj-y += time/ + obj-$(CONFIG_FUTEX) += futex.o +-ifeq ($(CONFIG_COMPAT),y) +-obj-$(CONFIG_FUTEX) += futex_compat.o +-endif + obj-$(CONFIG_GENERIC_ISA_DMA) += dma.o + obj-$(CONFIG_SMP) += smp.o + ifneq ($(CONFIG_SMP),y) +diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c +index 59d2e94ecb79..f5c1d5479ba3 100644 +--- a/kernel/bpf/syscall.c ++++ b/kernel/bpf/syscall.c +@@ -348,12 +348,12 @@ static int map_create(union bpf_attr *attr) + err = bpf_map_new_fd(map); + if (err < 0) { + /* failed to allocate fd. +- * bpf_map_put() is needed because the above ++ * bpf_map_put_with_uref() is needed because the above + * bpf_map_alloc_id() has published the map + * to the userspace and the userspace may + * have refcnt-ed it through BPF_MAP_GET_FD_BY_ID. + */ +- bpf_map_put(map); ++ bpf_map_put_with_uref(map); + return err; + } + +@@ -1354,7 +1354,7 @@ static int bpf_map_get_fd_by_id(const union bpf_attr *attr) + + fd = bpf_map_new_fd(map); + if (fd < 0) +- bpf_map_put(map); ++ bpf_map_put_with_uref(map); + + return fd; + } +diff --git a/kernel/exit.c b/kernel/exit.c +index 15437cfdcd70..57cb0eb1271c 100644 +--- a/kernel/exit.c ++++ b/kernel/exit.c +@@ -497,7 +497,7 @@ static void exit_mm(void) + struct mm_struct *mm = current->mm; + struct core_state *core_state; + +- mm_release(current, mm); ++ exit_mm_release(current, mm); + if (!mm) + return; + sync_mm_rss(mm); +@@ -803,32 +803,12 @@ void __noreturn do_exit(long code) + */ + if (unlikely(tsk->flags & PF_EXITING)) { + pr_alert("Fixing recursive fault but reboot is needed!\n"); +- /* +- * We can do this unlocked here. The futex code uses +- * this flag just to verify whether the pi state +- * cleanup has been done or not. In the worst case it +- * loops once more. We pretend that the cleanup was +- * done as there is no way to return. Either the +- * OWNER_DIED bit is set by now or we push the blocked +- * task into the wait for ever nirwana as well. +- */ +- tsk->flags |= PF_EXITPIDONE; ++ futex_exit_recursive(tsk); + set_current_state(TASK_UNINTERRUPTIBLE); + schedule(); + } + + exit_signals(tsk); /* sets PF_EXITING */ +- /* +- * Ensure that all new tsk->pi_lock acquisitions must observe +- * PF_EXITING. Serializes against futex.c:attach_to_pi_owner(). +- */ +- smp_mb(); +- /* +- * Ensure that we must observe the pi_state in exit_mm() -> +- * mm_release() -> exit_pi_state_list(). +- */ +- raw_spin_lock_irq(&tsk->pi_lock); +- raw_spin_unlock_irq(&tsk->pi_lock); + + if (unlikely(in_atomic())) { + pr_info("note: %s[%d] exited with preempt_count %d\n", +@@ -902,12 +882,6 @@ void __noreturn do_exit(long code) + * Make sure we are holding no locks: + */ + debug_check_no_locks_held(); +- /* +- * We can do this unlocked here. The futex code uses this flag +- * just to verify whether the pi state cleanup has been done +- * or not. In the worst case it loops once more. +- */ +- tsk->flags |= PF_EXITPIDONE; + + if (tsk->io_context) + exit_io_context(tsk); +diff --git a/kernel/fork.c b/kernel/fork.c +index 3352fdbd5e20..0a328cf0cb13 100644 +--- a/kernel/fork.c ++++ b/kernel/fork.c +@@ -162,10 +162,6 @@ static inline void free_task_struct(struct task_struct *tsk) + } + #endif + +-void __weak arch_release_thread_stack(unsigned long *stack) +-{ +-} +- + #ifndef CONFIG_ARCH_THREAD_STACK_ALLOCATOR + + /* +@@ -348,7 +344,6 @@ static void release_task_stack(struct task_struct *tsk) + return; /* Better to leak the stack than to free prematurely */ + + account_kernel_stack(tsk, -1); +- arch_release_thread_stack(tsk->stack); + free_thread_stack(tsk); + tsk->stack = NULL; + #ifdef CONFIG_VMAP_STACK +@@ -1137,24 +1132,8 @@ static int wait_for_vfork_done(struct task_struct *child, + * restoring the old one. . . + * Eric Biederman 10 January 1998 + */ +-void mm_release(struct task_struct *tsk, struct mm_struct *mm) ++static void mm_release(struct task_struct *tsk, struct mm_struct *mm) + { +- /* Get rid of any futexes when releasing the mm */ +-#ifdef CONFIG_FUTEX +- if (unlikely(tsk->robust_list)) { +- exit_robust_list(tsk); +- tsk->robust_list = NULL; +- } +-#ifdef CONFIG_COMPAT +- if (unlikely(tsk->compat_robust_list)) { +- compat_exit_robust_list(tsk); +- tsk->compat_robust_list = NULL; +- } +-#endif +- if (unlikely(!list_empty(&tsk->pi_state_list))) +- exit_pi_state_list(tsk); +-#endif +- + uprobe_free_utask(tsk); + + /* Get rid of any cached register state */ +@@ -1187,6 +1166,18 @@ void mm_release(struct task_struct *tsk, struct mm_struct *mm) + complete_vfork_done(tsk); + } + ++void exit_mm_release(struct task_struct *tsk, struct mm_struct *mm) ++{ ++ futex_exit_release(tsk); ++ mm_release(tsk, mm); ++} ++ ++void exec_mm_release(struct task_struct *tsk, struct mm_struct *mm) ++{ ++ futex_exec_release(tsk); ++ mm_release(tsk, mm); ++} ++ + /* + * Allocate a new mm structure and copy contents from the + * mm structure of the passed in task structure. +@@ -1801,14 +1792,8 @@ static __latent_entropy struct task_struct *copy_process( + #ifdef CONFIG_BLOCK + p->plug = NULL; + #endif +-#ifdef CONFIG_FUTEX +- p->robust_list = NULL; +-#ifdef CONFIG_COMPAT +- p->compat_robust_list = NULL; +-#endif +- INIT_LIST_HEAD(&p->pi_state_list); +- p->pi_state_cache = NULL; +-#endif ++ futex_init_task(p); ++ + /* + * sigaltstack should be cleared when sharing the same VM + */ +diff --git a/kernel/futex.c b/kernel/futex.c +index afe6a81584c9..f5aae14c247b 100644 +--- a/kernel/futex.c ++++ b/kernel/futex.c +@@ -44,6 +44,7 @@ + * along with this program; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + */ ++#include + #include + #include + #include +@@ -173,8 +174,10 @@ + * double_lock_hb() and double_unlock_hb(), respectively. + */ + +-#ifndef CONFIG_HAVE_FUTEX_CMPXCHG +-int __read_mostly futex_cmpxchg_enabled; ++#ifdef CONFIG_HAVE_FUTEX_CMPXCHG ++#define futex_cmpxchg_enabled 1 ++#else ++static int __read_mostly futex_cmpxchg_enabled; + #endif + + /* +@@ -338,6 +341,12 @@ static inline bool should_fail_futex(bool fshared) + } + #endif /* CONFIG_FAIL_FUTEX */ + ++#ifdef CONFIG_COMPAT ++static void compat_exit_robust_list(struct task_struct *curr); ++#else ++static inline void compat_exit_robust_list(struct task_struct *curr) { } ++#endif ++ + static inline void futex_get_mm(union futex_key *key) + { + mmgrab(key->private.mm); +@@ -887,7 +896,7 @@ static struct task_struct *futex_find_get_task(pid_t pid) + * Kernel cleans up PI-state, but userspace is likely hosed. + * (Robust-futex cleanup is separate and might save the day for userspace.) + */ +-void exit_pi_state_list(struct task_struct *curr) ++static void exit_pi_state_list(struct task_struct *curr) + { + struct list_head *next, *head = &curr->pi_state_list; + struct futex_pi_state *pi_state; +@@ -957,7 +966,8 @@ void exit_pi_state_list(struct task_struct *curr) + } + raw_spin_unlock_irq(&curr->pi_lock); + } +- ++#else ++static inline void exit_pi_state_list(struct task_struct *curr) { } + #endif + + /* +@@ -1166,16 +1176,47 @@ out_error: + return ret; + } + ++/** ++ * wait_for_owner_exiting - Block until the owner has exited ++ * @exiting: Pointer to the exiting task ++ * ++ * Caller must hold a refcount on @exiting. ++ */ ++static void wait_for_owner_exiting(int ret, struct task_struct *exiting) ++{ ++ if (ret != -EBUSY) { ++ WARN_ON_ONCE(exiting); ++ return; ++ } ++ ++ if (WARN_ON_ONCE(ret == -EBUSY && !exiting)) ++ return; ++ ++ mutex_lock(&exiting->futex_exit_mutex); ++ /* ++ * No point in doing state checking here. If the waiter got here ++ * while the task was in exec()->exec_futex_release() then it can ++ * have any FUTEX_STATE_* value when the waiter has acquired the ++ * mutex. OK, if running, EXITING or DEAD if it reached exit() ++ * already. Highly unlikely and not a problem. Just one more round ++ * through the futex maze. ++ */ ++ mutex_unlock(&exiting->futex_exit_mutex); ++ ++ put_task_struct(exiting); ++} ++ + static int handle_exit_race(u32 __user *uaddr, u32 uval, + struct task_struct *tsk) + { + u32 uval2; + + /* +- * If PF_EXITPIDONE is not yet set, then try again. ++ * If the futex exit state is not yet FUTEX_STATE_DEAD, tell the ++ * caller that the alleged owner is busy. + */ +- if (tsk && !(tsk->flags & PF_EXITPIDONE)) +- return -EAGAIN; ++ if (tsk && tsk->futex_state != FUTEX_STATE_DEAD) ++ return -EBUSY; + + /* + * Reread the user space value to handle the following situation: +@@ -1193,8 +1234,9 @@ static int handle_exit_race(u32 __user *uaddr, u32 uval, + * *uaddr = 0xC0000000; tsk = get_task(PID); + * } if (!tsk->flags & PF_EXITING) { + * ... attach(); +- * tsk->flags |= PF_EXITPIDONE; } else { +- * if (!(tsk->flags & PF_EXITPIDONE)) ++ * tsk->futex_state = } else { ++ * FUTEX_STATE_DEAD; if (tsk->futex_state != ++ * FUTEX_STATE_DEAD) + * return -EAGAIN; + * return -ESRCH; <--- FAIL + * } +@@ -1225,7 +1267,8 @@ static int handle_exit_race(u32 __user *uaddr, u32 uval, + * it after doing proper sanity checks. + */ + static int attach_to_pi_owner(u32 __user *uaddr, u32 uval, union futex_key *key, +- struct futex_pi_state **ps) ++ struct futex_pi_state **ps, ++ struct task_struct **exiting) + { + pid_t pid = uval & FUTEX_TID_MASK; + struct futex_pi_state *pi_state; +@@ -1250,22 +1293,33 @@ static int attach_to_pi_owner(u32 __user *uaddr, u32 uval, union futex_key *key, + } + + /* +- * We need to look at the task state flags to figure out, +- * whether the task is exiting. To protect against the do_exit +- * change of the task flags, we do this protected by +- * p->pi_lock: ++ * We need to look at the task state to figure out, whether the ++ * task is exiting. To protect against the change of the task state ++ * in futex_exit_release(), we do this protected by p->pi_lock: + */ + raw_spin_lock_irq(&p->pi_lock); +- if (unlikely(p->flags & PF_EXITING)) { ++ if (unlikely(p->futex_state != FUTEX_STATE_OK)) { + /* +- * The task is on the way out. When PF_EXITPIDONE is +- * set, we know that the task has finished the +- * cleanup: ++ * The task is on the way out. When the futex state is ++ * FUTEX_STATE_DEAD, we know that the task has finished ++ * the cleanup: + */ + int ret = handle_exit_race(uaddr, uval, p); + + raw_spin_unlock_irq(&p->pi_lock); +- put_task_struct(p); ++ /* ++ * If the owner task is between FUTEX_STATE_EXITING and ++ * FUTEX_STATE_DEAD then store the task pointer and keep ++ * the reference on the task struct. The calling code will ++ * drop all locks, wait for the task to reach ++ * FUTEX_STATE_DEAD and then drop the refcount. This is ++ * required to prevent a live lock when the current task ++ * preempted the exiting task between the two states. ++ */ ++ if (ret == -EBUSY) ++ *exiting = p; ++ else ++ put_task_struct(p); + return ret; + } + +@@ -1304,7 +1358,8 @@ static int attach_to_pi_owner(u32 __user *uaddr, u32 uval, union futex_key *key, + + static int lookup_pi_state(u32 __user *uaddr, u32 uval, + struct futex_hash_bucket *hb, +- union futex_key *key, struct futex_pi_state **ps) ++ union futex_key *key, struct futex_pi_state **ps, ++ struct task_struct **exiting) + { + struct futex_q *top_waiter = futex_top_waiter(hb, key); + +@@ -1319,7 +1374,7 @@ static int lookup_pi_state(u32 __user *uaddr, u32 uval, + * We are the first waiter - try to look up the owner based on + * @uval and attach to it. + */ +- return attach_to_pi_owner(uaddr, uval, key, ps); ++ return attach_to_pi_owner(uaddr, uval, key, ps, exiting); + } + + static int lock_pi_update_atomic(u32 __user *uaddr, u32 uval, u32 newval) +@@ -1347,6 +1402,8 @@ static int lock_pi_update_atomic(u32 __user *uaddr, u32 uval, u32 newval) + * lookup + * @task: the task to perform the atomic lock work for. This will + * be "current" except in the case of requeue pi. ++ * @exiting: Pointer to store the task pointer of the owner task ++ * which is in the middle of exiting + * @set_waiters: force setting the FUTEX_WAITERS bit (1) or not (0) + * + * Return: +@@ -1355,11 +1412,17 @@ static int lock_pi_update_atomic(u32 __user *uaddr, u32 uval, u32 newval) + * - <0 - error + * + * The hb->lock and futex_key refs shall be held by the caller. ++ * ++ * @exiting is only set when the return value is -EBUSY. If so, this holds ++ * a refcount on the exiting task on return and the caller needs to drop it ++ * after waiting for the exit to complete. + */ + static int futex_lock_pi_atomic(u32 __user *uaddr, struct futex_hash_bucket *hb, + union futex_key *key, + struct futex_pi_state **ps, +- struct task_struct *task, int set_waiters) ++ struct task_struct *task, ++ struct task_struct **exiting, ++ int set_waiters) + { + u32 uval, newval, vpid = task_pid_vnr(task); + struct futex_q *top_waiter; +@@ -1429,7 +1492,7 @@ static int futex_lock_pi_atomic(u32 __user *uaddr, struct futex_hash_bucket *hb, + * attach to the owner. If that fails, no harm done, we only + * set the FUTEX_WAITERS bit in the user space variable. + */ +- return attach_to_pi_owner(uaddr, newval, key, ps); ++ return attach_to_pi_owner(uaddr, newval, key, ps, exiting); + } + + /** +@@ -1848,6 +1911,8 @@ void requeue_pi_wake_futex(struct futex_q *q, union futex_key *key, + * @key1: the from futex key + * @key2: the to futex key + * @ps: address to store the pi_state pointer ++ * @exiting: Pointer to store the task pointer of the owner task ++ * which is in the middle of exiting + * @set_waiters: force setting the FUTEX_WAITERS bit (1) or not (0) + * + * Try and get the lock on behalf of the top waiter if we can do it atomically. +@@ -1855,16 +1920,20 @@ void requeue_pi_wake_futex(struct futex_q *q, union futex_key *key, + * then direct futex_lock_pi_atomic() to force setting the FUTEX_WAITERS bit. + * hb1 and hb2 must be held by the caller. + * ++ * @exiting is only set when the return value is -EBUSY. If so, this holds ++ * a refcount on the exiting task on return and the caller needs to drop it ++ * after waiting for the exit to complete. ++ * + * Return: + * - 0 - failed to acquire the lock atomically; + * - >0 - acquired the lock, return value is vpid of the top_waiter + * - <0 - error + */ +-static int futex_proxy_trylock_atomic(u32 __user *pifutex, +- struct futex_hash_bucket *hb1, +- struct futex_hash_bucket *hb2, +- union futex_key *key1, union futex_key *key2, +- struct futex_pi_state **ps, int set_waiters) ++static int ++futex_proxy_trylock_atomic(u32 __user *pifutex, struct futex_hash_bucket *hb1, ++ struct futex_hash_bucket *hb2, union futex_key *key1, ++ union futex_key *key2, struct futex_pi_state **ps, ++ struct task_struct **exiting, int set_waiters) + { + struct futex_q *top_waiter = NULL; + u32 curval; +@@ -1901,7 +1970,7 @@ static int futex_proxy_trylock_atomic(u32 __user *pifutex, + */ + vpid = task_pid_vnr(top_waiter->task); + ret = futex_lock_pi_atomic(pifutex, hb2, key2, ps, top_waiter->task, +- set_waiters); ++ exiting, set_waiters); + if (ret == 1) { + requeue_pi_wake_futex(top_waiter, key2, hb2); + return vpid; +@@ -2030,6 +2099,8 @@ retry_private: + } + + if (requeue_pi && (task_count - nr_wake < nr_requeue)) { ++ struct task_struct *exiting = NULL; ++ + /* + * Attempt to acquire uaddr2 and wake the top waiter. If we + * intend to requeue waiters, force setting the FUTEX_WAITERS +@@ -2037,7 +2108,8 @@ retry_private: + * faults rather in the requeue loop below. + */ + ret = futex_proxy_trylock_atomic(uaddr2, hb1, hb2, &key1, +- &key2, &pi_state, nr_requeue); ++ &key2, &pi_state, ++ &exiting, nr_requeue); + + /* + * At this point the top_waiter has either taken uaddr2 or is +@@ -2064,7 +2136,8 @@ retry_private: + * If that call succeeds then we have pi_state and an + * initial refcount on it. + */ +- ret = lookup_pi_state(uaddr2, ret, hb2, &key2, &pi_state); ++ ret = lookup_pi_state(uaddr2, ret, hb2, &key2, ++ &pi_state, &exiting); + } + + switch (ret) { +@@ -2082,17 +2155,24 @@ retry_private: + if (!ret) + goto retry; + goto out; ++ case -EBUSY: + case -EAGAIN: + /* + * Two reasons for this: +- * - Owner is exiting and we just wait for the ++ * - EBUSY: Owner is exiting and we just wait for the + * exit to complete. +- * - The user space value changed. ++ * - EAGAIN: The user space value changed. + */ + double_unlock_hb(hb1, hb2); + hb_waiters_dec(hb2); + put_futex_key(&key2); + put_futex_key(&key1); ++ /* ++ * Handle the case where the owner is in the middle of ++ * exiting. Wait for the exit to complete otherwise ++ * this task might loop forever, aka. live lock. ++ */ ++ wait_for_owner_exiting(ret, exiting); + cond_resched(); + goto retry; + default: +@@ -2808,6 +2888,7 @@ static int futex_lock_pi(u32 __user *uaddr, unsigned int flags, + { + struct hrtimer_sleeper timeout, *to = NULL; + struct futex_pi_state *pi_state = NULL; ++ struct task_struct *exiting = NULL; + struct rt_mutex_waiter rt_waiter; + struct futex_hash_bucket *hb; + struct futex_q q = futex_q_init; +@@ -2835,7 +2916,8 @@ retry: + retry_private: + hb = queue_lock(&q); + +- ret = futex_lock_pi_atomic(uaddr, hb, &q.key, &q.pi_state, current, 0); ++ ret = futex_lock_pi_atomic(uaddr, hb, &q.key, &q.pi_state, current, ++ &exiting, 0); + if (unlikely(ret)) { + /* + * Atomic work succeeded and we got the lock, +@@ -2848,15 +2930,22 @@ retry_private: + goto out_unlock_put_key; + case -EFAULT: + goto uaddr_faulted; ++ case -EBUSY: + case -EAGAIN: + /* + * Two reasons for this: +- * - Task is exiting and we just wait for the ++ * - EBUSY: Task is exiting and we just wait for the + * exit to complete. +- * - The user space value changed. ++ * - EAGAIN: The user space value changed. + */ + queue_unlock(hb); + put_futex_key(&q.key); ++ /* ++ * Handle the case where the owner is in the middle of ++ * exiting. Wait for the exit to complete otherwise ++ * this task might loop forever, aka. live lock. ++ */ ++ wait_for_owner_exiting(ret, exiting); + cond_resched(); + goto retry; + default: +@@ -3472,11 +3561,16 @@ err_unlock: + return ret; + } + ++/* Constants for the pending_op argument of handle_futex_death */ ++#define HANDLE_DEATH_PENDING true ++#define HANDLE_DEATH_LIST false ++ + /* + * Process a futex-list entry, check whether it's owned by the + * dying task, and do notification if so: + */ +-int handle_futex_death(u32 __user *uaddr, struct task_struct *curr, int pi) ++static int handle_futex_death(u32 __user *uaddr, struct task_struct *curr, ++ bool pi, bool pending_op) + { + u32 uval, uninitialized_var(nval), mval; + int err; +@@ -3489,6 +3583,42 @@ retry: + if (get_user(uval, uaddr)) + return -1; + ++ /* ++ * Special case for regular (non PI) futexes. The unlock path in ++ * user space has two race scenarios: ++ * ++ * 1. The unlock path releases the user space futex value and ++ * before it can execute the futex() syscall to wake up ++ * waiters it is killed. ++ * ++ * 2. A woken up waiter is killed before it can acquire the ++ * futex in user space. ++ * ++ * In both cases the TID validation below prevents a wakeup of ++ * potential waiters which can cause these waiters to block ++ * forever. ++ * ++ * In both cases the following conditions are met: ++ * ++ * 1) task->robust_list->list_op_pending != NULL ++ * @pending_op == true ++ * 2) User space futex value == 0 ++ * 3) Regular futex: @pi == false ++ * ++ * If these conditions are met, it is safe to attempt waking up a ++ * potential waiter without touching the user space futex value and ++ * trying to set the OWNER_DIED bit. The user space futex value is ++ * uncontended and the rest of the user space mutex state is ++ * consistent, so a woken waiter will just take over the ++ * uncontended futex. Setting the OWNER_DIED bit would create ++ * inconsistent state and malfunction of the user space owner died ++ * handling. ++ */ ++ if (pending_op && !pi && !uval) { ++ futex_wake(uaddr, 1, 1, FUTEX_BITSET_MATCH_ANY); ++ return 0; ++ } ++ + if ((uval & FUTEX_TID_MASK) != task_pid_vnr(curr)) + return 0; + +@@ -3567,7 +3697,7 @@ static inline int fetch_robust_entry(struct robust_list __user **entry, + * + * We silently return on any sign of list-walking problem. + */ +-void exit_robust_list(struct task_struct *curr) ++static void exit_robust_list(struct task_struct *curr) + { + struct robust_list_head __user *head = curr->robust_list; + struct robust_list __user *entry, *next_entry, *pending; +@@ -3608,10 +3738,11 @@ void exit_robust_list(struct task_struct *curr) + * A pending lock might already be on the list, so + * don't process it twice: + */ +- if (entry != pending) ++ if (entry != pending) { + if (handle_futex_death((void __user *)entry + futex_offset, +- curr, pi)) ++ curr, pi, HANDLE_DEATH_LIST)) + return; ++ } + if (rc) + return; + entry = next_entry; +@@ -3625,9 +3756,118 @@ void exit_robust_list(struct task_struct *curr) + cond_resched(); + } + +- if (pending) ++ if (pending) { + handle_futex_death((void __user *)pending + futex_offset, +- curr, pip); ++ curr, pip, HANDLE_DEATH_PENDING); ++ } ++} ++ ++static void futex_cleanup(struct task_struct *tsk) ++{ ++ if (unlikely(tsk->robust_list)) { ++ exit_robust_list(tsk); ++ tsk->robust_list = NULL; ++ } ++ ++#ifdef CONFIG_COMPAT ++ if (unlikely(tsk->compat_robust_list)) { ++ compat_exit_robust_list(tsk); ++ tsk->compat_robust_list = NULL; ++ } ++#endif ++ ++ if (unlikely(!list_empty(&tsk->pi_state_list))) ++ exit_pi_state_list(tsk); ++} ++ ++/** ++ * futex_exit_recursive - Set the tasks futex state to FUTEX_STATE_DEAD ++ * @tsk: task to set the state on ++ * ++ * Set the futex exit state of the task lockless. The futex waiter code ++ * observes that state when a task is exiting and loops until the task has ++ * actually finished the futex cleanup. The worst case for this is that the ++ * waiter runs through the wait loop until the state becomes visible. ++ * ++ * This is called from the recursive fault handling path in do_exit(). ++ * ++ * This is best effort. Either the futex exit code has run already or ++ * not. If the OWNER_DIED bit has been set on the futex then the waiter can ++ * take it over. If not, the problem is pushed back to user space. If the ++ * futex exit code did not run yet, then an already queued waiter might ++ * block forever, but there is nothing which can be done about that. ++ */ ++void futex_exit_recursive(struct task_struct *tsk) ++{ ++ /* If the state is FUTEX_STATE_EXITING then futex_exit_mutex is held */ ++ if (tsk->futex_state == FUTEX_STATE_EXITING) ++ mutex_unlock(&tsk->futex_exit_mutex); ++ tsk->futex_state = FUTEX_STATE_DEAD; ++} ++ ++static void futex_cleanup_begin(struct task_struct *tsk) ++{ ++ /* ++ * Prevent various race issues against a concurrent incoming waiter ++ * including live locks by forcing the waiter to block on ++ * tsk->futex_exit_mutex when it observes FUTEX_STATE_EXITING in ++ * attach_to_pi_owner(). ++ */ ++ mutex_lock(&tsk->futex_exit_mutex); ++ ++ /* ++ * Switch the state to FUTEX_STATE_EXITING under tsk->pi_lock. ++ * ++ * This ensures that all subsequent checks of tsk->futex_state in ++ * attach_to_pi_owner() must observe FUTEX_STATE_EXITING with ++ * tsk->pi_lock held. ++ * ++ * It guarantees also that a pi_state which was queued right before ++ * the state change under tsk->pi_lock by a concurrent waiter must ++ * be observed in exit_pi_state_list(). ++ */ ++ raw_spin_lock_irq(&tsk->pi_lock); ++ tsk->futex_state = FUTEX_STATE_EXITING; ++ raw_spin_unlock_irq(&tsk->pi_lock); ++} ++ ++static void futex_cleanup_end(struct task_struct *tsk, int state) ++{ ++ /* ++ * Lockless store. The only side effect is that an observer might ++ * take another loop until it becomes visible. ++ */ ++ tsk->futex_state = state; ++ /* ++ * Drop the exit protection. This unblocks waiters which observed ++ * FUTEX_STATE_EXITING to reevaluate the state. ++ */ ++ mutex_unlock(&tsk->futex_exit_mutex); ++} ++ ++void futex_exec_release(struct task_struct *tsk) ++{ ++ /* ++ * The state handling is done for consistency, but in the case of ++ * exec() there is no way to prevent futher damage as the PID stays ++ * the same. But for the unlikely and arguably buggy case that a ++ * futex is held on exec(), this provides at least as much state ++ * consistency protection which is possible. ++ */ ++ futex_cleanup_begin(tsk); ++ futex_cleanup(tsk); ++ /* ++ * Reset the state to FUTEX_STATE_OK. The task is alive and about ++ * exec a new binary. ++ */ ++ futex_cleanup_end(tsk, FUTEX_STATE_OK); ++} ++ ++void futex_exit_release(struct task_struct *tsk) ++{ ++ futex_cleanup_begin(tsk); ++ futex_cleanup(tsk); ++ futex_cleanup_end(tsk, FUTEX_STATE_DEAD); + } + + long do_futex(u32 __user *uaddr, int op, u32 val, ktime_t *timeout, +@@ -3723,6 +3963,193 @@ SYSCALL_DEFINE6(futex, u32 __user *, uaddr, int, op, u32, val, + return do_futex(uaddr, op, val, tp, uaddr2, val2, val3); + } + ++#ifdef CONFIG_COMPAT ++/* ++ * Fetch a robust-list pointer. Bit 0 signals PI futexes: ++ */ ++static inline int ++compat_fetch_robust_entry(compat_uptr_t *uentry, struct robust_list __user **entry, ++ compat_uptr_t __user *head, unsigned int *pi) ++{ ++ if (get_user(*uentry, head)) ++ return -EFAULT; ++ ++ *entry = compat_ptr((*uentry) & ~1); ++ *pi = (unsigned int)(*uentry) & 1; ++ ++ return 0; ++} ++ ++static void __user *futex_uaddr(struct robust_list __user *entry, ++ compat_long_t futex_offset) ++{ ++ compat_uptr_t base = ptr_to_compat(entry); ++ void __user *uaddr = compat_ptr(base + futex_offset); ++ ++ return uaddr; ++} ++ ++/* ++ * Walk curr->robust_list (very carefully, it's a userspace list!) ++ * and mark any locks found there dead, and notify any waiters. ++ * ++ * We silently return on any sign of list-walking problem. ++ */ ++static void compat_exit_robust_list(struct task_struct *curr) ++{ ++ struct compat_robust_list_head __user *head = curr->compat_robust_list; ++ struct robust_list __user *entry, *next_entry, *pending; ++ unsigned int limit = ROBUST_LIST_LIMIT, pi, pip; ++ unsigned int uninitialized_var(next_pi); ++ compat_uptr_t uentry, next_uentry, upending; ++ compat_long_t futex_offset; ++ int rc; ++ ++ if (!futex_cmpxchg_enabled) ++ return; ++ ++ /* ++ * Fetch the list head (which was registered earlier, via ++ * sys_set_robust_list()): ++ */ ++ if (compat_fetch_robust_entry(&uentry, &entry, &head->list.next, &pi)) ++ return; ++ /* ++ * Fetch the relative futex offset: ++ */ ++ if (get_user(futex_offset, &head->futex_offset)) ++ return; ++ /* ++ * Fetch any possibly pending lock-add first, and handle it ++ * if it exists: ++ */ ++ if (compat_fetch_robust_entry(&upending, &pending, ++ &head->list_op_pending, &pip)) ++ return; ++ ++ next_entry = NULL; /* avoid warning with gcc */ ++ while (entry != (struct robust_list __user *) &head->list) { ++ /* ++ * Fetch the next entry in the list before calling ++ * handle_futex_death: ++ */ ++ rc = compat_fetch_robust_entry(&next_uentry, &next_entry, ++ (compat_uptr_t __user *)&entry->next, &next_pi); ++ /* ++ * A pending lock might already be on the list, so ++ * dont process it twice: ++ */ ++ if (entry != pending) { ++ void __user *uaddr = futex_uaddr(entry, futex_offset); ++ ++ if (handle_futex_death(uaddr, curr, pi, ++ HANDLE_DEATH_LIST)) ++ return; ++ } ++ if (rc) ++ return; ++ uentry = next_uentry; ++ entry = next_entry; ++ pi = next_pi; ++ /* ++ * Avoid excessively long or circular lists: ++ */ ++ if (!--limit) ++ break; ++ ++ cond_resched(); ++ } ++ if (pending) { ++ void __user *uaddr = futex_uaddr(pending, futex_offset); ++ ++ handle_futex_death(uaddr, curr, pip, HANDLE_DEATH_PENDING); ++ } ++} ++ ++COMPAT_SYSCALL_DEFINE2(set_robust_list, ++ struct compat_robust_list_head __user *, head, ++ compat_size_t, len) ++{ ++ if (!futex_cmpxchg_enabled) ++ return -ENOSYS; ++ ++ if (unlikely(len != sizeof(*head))) ++ return -EINVAL; ++ ++ current->compat_robust_list = head; ++ ++ return 0; ++} ++ ++COMPAT_SYSCALL_DEFINE3(get_robust_list, int, pid, ++ compat_uptr_t __user *, head_ptr, ++ compat_size_t __user *, len_ptr) ++{ ++ struct compat_robust_list_head __user *head; ++ unsigned long ret; ++ struct task_struct *p; ++ ++ if (!futex_cmpxchg_enabled) ++ return -ENOSYS; ++ ++ rcu_read_lock(); ++ ++ ret = -ESRCH; ++ if (!pid) ++ p = current; ++ else { ++ p = find_task_by_vpid(pid); ++ if (!p) ++ goto err_unlock; ++ } ++ ++ ret = -EPERM; ++ if (!ptrace_may_access(p, PTRACE_MODE_READ_REALCREDS)) ++ goto err_unlock; ++ ++ head = p->compat_robust_list; ++ rcu_read_unlock(); ++ ++ if (put_user(sizeof(*head), len_ptr)) ++ return -EFAULT; ++ return put_user(ptr_to_compat(head), head_ptr); ++ ++err_unlock: ++ rcu_read_unlock(); ++ ++ return ret; ++} ++ ++COMPAT_SYSCALL_DEFINE6(futex, u32 __user *, uaddr, int, op, u32, val, ++ struct compat_timespec __user *, utime, u32 __user *, uaddr2, ++ u32, val3) ++{ ++ struct timespec ts; ++ ktime_t t, *tp = NULL; ++ int val2 = 0; ++ int cmd = op & FUTEX_CMD_MASK; ++ ++ if (utime && (cmd == FUTEX_WAIT || cmd == FUTEX_LOCK_PI || ++ cmd == FUTEX_WAIT_BITSET || ++ cmd == FUTEX_WAIT_REQUEUE_PI)) { ++ if (compat_get_timespec(&ts, utime)) ++ return -EFAULT; ++ if (!timespec_valid(&ts)) ++ return -EINVAL; ++ ++ t = timespec_to_ktime(ts); ++ if (cmd == FUTEX_WAIT) ++ t = ktime_add_safe(ktime_get(), t); ++ tp = &t; ++ } ++ if (cmd == FUTEX_REQUEUE || cmd == FUTEX_CMP_REQUEUE || ++ cmd == FUTEX_CMP_REQUEUE_PI || cmd == FUTEX_WAKE_OP) ++ val2 = (int) (unsigned long) utime; ++ ++ return do_futex(uaddr, op, val, tp, uaddr2, val2, val3); ++} ++#endif /* CONFIG_COMPAT */ ++ + static void __init futex_detect_cmpxchg(void) + { + #ifndef CONFIG_HAVE_FUTEX_CMPXCHG +diff --git a/kernel/futex_compat.c b/kernel/futex_compat.c +deleted file mode 100644 +index 83f830acbb5f..000000000000 +--- a/kernel/futex_compat.c ++++ /dev/null +@@ -1,202 +0,0 @@ +-// SPDX-License-Identifier: GPL-2.0 +-/* +- * linux/kernel/futex_compat.c +- * +- * Futex compatibililty routines. +- * +- * Copyright 2006, Red Hat, Inc., Ingo Molnar +- */ +- +-#include +-#include +-#include +-#include +-#include +-#include +- +-#include +- +- +-/* +- * Fetch a robust-list pointer. Bit 0 signals PI futexes: +- */ +-static inline int +-fetch_robust_entry(compat_uptr_t *uentry, struct robust_list __user **entry, +- compat_uptr_t __user *head, unsigned int *pi) +-{ +- if (get_user(*uentry, head)) +- return -EFAULT; +- +- *entry = compat_ptr((*uentry) & ~1); +- *pi = (unsigned int)(*uentry) & 1; +- +- return 0; +-} +- +-static void __user *futex_uaddr(struct robust_list __user *entry, +- compat_long_t futex_offset) +-{ +- compat_uptr_t base = ptr_to_compat(entry); +- void __user *uaddr = compat_ptr(base + futex_offset); +- +- return uaddr; +-} +- +-/* +- * Walk curr->robust_list (very carefully, it's a userspace list!) +- * and mark any locks found there dead, and notify any waiters. +- * +- * We silently return on any sign of list-walking problem. +- */ +-void compat_exit_robust_list(struct task_struct *curr) +-{ +- struct compat_robust_list_head __user *head = curr->compat_robust_list; +- struct robust_list __user *entry, *next_entry, *pending; +- unsigned int limit = ROBUST_LIST_LIMIT, pi, pip; +- unsigned int uninitialized_var(next_pi); +- compat_uptr_t uentry, next_uentry, upending; +- compat_long_t futex_offset; +- int rc; +- +- if (!futex_cmpxchg_enabled) +- return; +- +- /* +- * Fetch the list head (which was registered earlier, via +- * sys_set_robust_list()): +- */ +- if (fetch_robust_entry(&uentry, &entry, &head->list.next, &pi)) +- return; +- /* +- * Fetch the relative futex offset: +- */ +- if (get_user(futex_offset, &head->futex_offset)) +- return; +- /* +- * Fetch any possibly pending lock-add first, and handle it +- * if it exists: +- */ +- if (fetch_robust_entry(&upending, &pending, +- &head->list_op_pending, &pip)) +- return; +- +- next_entry = NULL; /* avoid warning with gcc */ +- while (entry != (struct robust_list __user *) &head->list) { +- /* +- * Fetch the next entry in the list before calling +- * handle_futex_death: +- */ +- rc = fetch_robust_entry(&next_uentry, &next_entry, +- (compat_uptr_t __user *)&entry->next, &next_pi); +- /* +- * A pending lock might already be on the list, so +- * dont process it twice: +- */ +- if (entry != pending) { +- void __user *uaddr = futex_uaddr(entry, futex_offset); +- +- if (handle_futex_death(uaddr, curr, pi)) +- return; +- } +- if (rc) +- return; +- uentry = next_uentry; +- entry = next_entry; +- pi = next_pi; +- /* +- * Avoid excessively long or circular lists: +- */ +- if (!--limit) +- break; +- +- cond_resched(); +- } +- if (pending) { +- void __user *uaddr = futex_uaddr(pending, futex_offset); +- +- handle_futex_death(uaddr, curr, pip); +- } +-} +- +-COMPAT_SYSCALL_DEFINE2(set_robust_list, +- struct compat_robust_list_head __user *, head, +- compat_size_t, len) +-{ +- if (!futex_cmpxchg_enabled) +- return -ENOSYS; +- +- if (unlikely(len != sizeof(*head))) +- return -EINVAL; +- +- current->compat_robust_list = head; +- +- return 0; +-} +- +-COMPAT_SYSCALL_DEFINE3(get_robust_list, int, pid, +- compat_uptr_t __user *, head_ptr, +- compat_size_t __user *, len_ptr) +-{ +- struct compat_robust_list_head __user *head; +- unsigned long ret; +- struct task_struct *p; +- +- if (!futex_cmpxchg_enabled) +- return -ENOSYS; +- +- rcu_read_lock(); +- +- ret = -ESRCH; +- if (!pid) +- p = current; +- else { +- p = find_task_by_vpid(pid); +- if (!p) +- goto err_unlock; +- } +- +- ret = -EPERM; +- if (!ptrace_may_access(p, PTRACE_MODE_READ_REALCREDS)) +- goto err_unlock; +- +- head = p->compat_robust_list; +- rcu_read_unlock(); +- +- if (put_user(sizeof(*head), len_ptr)) +- return -EFAULT; +- return put_user(ptr_to_compat(head), head_ptr); +- +-err_unlock: +- rcu_read_unlock(); +- +- return ret; +-} +- +-COMPAT_SYSCALL_DEFINE6(futex, u32 __user *, uaddr, int, op, u32, val, +- struct compat_timespec __user *, utime, u32 __user *, uaddr2, +- u32, val3) +-{ +- struct timespec ts; +- ktime_t t, *tp = NULL; +- int val2 = 0; +- int cmd = op & FUTEX_CMD_MASK; +- +- if (utime && (cmd == FUTEX_WAIT || cmd == FUTEX_LOCK_PI || +- cmd == FUTEX_WAIT_BITSET || +- cmd == FUTEX_WAIT_REQUEUE_PI)) { +- if (compat_get_timespec(&ts, utime)) +- return -EFAULT; +- if (!timespec_valid(&ts)) +- return -EINVAL; +- +- t = timespec_to_ktime(ts); +- if (cmd == FUTEX_WAIT) +- t = ktime_add_safe(ktime_get(), t); +- tp = &t; +- } +- if (cmd == FUTEX_REQUEUE || cmd == FUTEX_CMP_REQUEUE || +- cmd == FUTEX_CMP_REQUEUE_PI || cmd == FUTEX_WAKE_OP) +- val2 = (int) (unsigned long) utime; +- +- return do_futex(uaddr, op, val, tp, uaddr2, val2, val3); +-} +diff --git a/lib/genalloc.c b/lib/genalloc.c +index ca06adc4f445..7e85d1e37a6e 100644 +--- a/lib/genalloc.c ++++ b/lib/genalloc.c +@@ -35,6 +35,7 @@ + #include + #include + #include ++#include + + static inline size_t chunk_size(const struct gen_pool_chunk *chunk) + { +@@ -187,7 +188,7 @@ int gen_pool_add_virt(struct gen_pool *pool, unsigned long virt, phys_addr_t phy + int nbytes = sizeof(struct gen_pool_chunk) + + BITS_TO_LONGS(nbits) * sizeof(long); + +- chunk = kzalloc_node(nbytes, GFP_KERNEL, nid); ++ chunk = vzalloc_node(nbytes, nid); + if (unlikely(chunk == NULL)) + return -ENOMEM; + +@@ -251,7 +252,7 @@ void gen_pool_destroy(struct gen_pool *pool) + bit = find_next_bit(chunk->bits, end_bit, 0); + BUG_ON(bit < end_bit); + +- kfree(chunk); ++ vfree(chunk); + } + kfree_const(pool->name); + kfree(pool); +@@ -311,7 +312,7 @@ unsigned long gen_pool_alloc_algo(struct gen_pool *pool, size_t size, + end_bit = chunk_size(chunk) >> order; + retry: + start_bit = algo(chunk->bits, end_bit, start_bit, +- nbits, data, pool); ++ nbits, data, pool, chunk->start_addr); + if (start_bit >= end_bit) + continue; + remain = bitmap_set_ll(chunk->bits, start_bit, nbits); +@@ -525,7 +526,7 @@ EXPORT_SYMBOL(gen_pool_set_algo); + */ + unsigned long gen_pool_first_fit(unsigned long *map, unsigned long size, + unsigned long start, unsigned int nr, void *data, +- struct gen_pool *pool) ++ struct gen_pool *pool, unsigned long start_addr) + { + return bitmap_find_next_zero_area(map, size, start, nr, 0); + } +@@ -543,16 +544,19 @@ EXPORT_SYMBOL(gen_pool_first_fit); + */ + unsigned long gen_pool_first_fit_align(unsigned long *map, unsigned long size, + unsigned long start, unsigned int nr, void *data, +- struct gen_pool *pool) ++ struct gen_pool *pool, unsigned long start_addr) + { + struct genpool_data_align *alignment; +- unsigned long align_mask; ++ unsigned long align_mask, align_off; + int order; + + alignment = data; + order = pool->min_alloc_order; + align_mask = ((alignment->align + (1UL << order) - 1) >> order) - 1; +- return bitmap_find_next_zero_area(map, size, start, nr, align_mask); ++ align_off = (start_addr & (alignment->align - 1)) >> order; ++ ++ return bitmap_find_next_zero_area_off(map, size, start, nr, ++ align_mask, align_off); + } + EXPORT_SYMBOL(gen_pool_first_fit_align); + +@@ -567,7 +571,7 @@ EXPORT_SYMBOL(gen_pool_first_fit_align); + */ + unsigned long gen_pool_fixed_alloc(unsigned long *map, unsigned long size, + unsigned long start, unsigned int nr, void *data, +- struct gen_pool *pool) ++ struct gen_pool *pool, unsigned long start_addr) + { + struct genpool_data_fixed *fixed_data; + int order; +@@ -601,7 +605,8 @@ EXPORT_SYMBOL(gen_pool_fixed_alloc); + */ + unsigned long gen_pool_first_fit_order_align(unsigned long *map, + unsigned long size, unsigned long start, +- unsigned int nr, void *data, struct gen_pool *pool) ++ unsigned int nr, void *data, struct gen_pool *pool, ++ unsigned long start_addr) + { + unsigned long align_mask = roundup_pow_of_two(nr) - 1; + +@@ -624,7 +629,7 @@ EXPORT_SYMBOL(gen_pool_first_fit_order_align); + */ + unsigned long gen_pool_best_fit(unsigned long *map, unsigned long size, + unsigned long start, unsigned int nr, void *data, +- struct gen_pool *pool) ++ struct gen_pool *pool, unsigned long start_addr) + { + unsigned long start_bit = size; + unsigned long len = size + 1; +diff --git a/lib/radix-tree.c b/lib/radix-tree.c +index d172f0341b80..ff00c816266b 100644 +--- a/lib/radix-tree.c ++++ b/lib/radix-tree.c +@@ -2184,7 +2184,7 @@ void __rcu **idr_get_free_cmn(struct radix_tree_root *root, + offset = radix_tree_find_next_bit(node, IDR_FREE, + offset + 1); + start = next_index(start, node, offset); +- if (start > max) ++ if (start > max || start == 0) + return ERR_PTR(-ENOSPC); + while (offset == RADIX_TREE_MAP_SIZE) { + offset = node->offset + 1; +diff --git a/mm/internal.h b/mm/internal.h +index 1df011f62480..a182506242c4 100644 +--- a/mm/internal.h ++++ b/mm/internal.h +@@ -455,6 +455,16 @@ static inline void mminit_validate_memmodel_limits(unsigned long *start_pfn, + #define NODE_RECLAIM_SOME 0 + #define NODE_RECLAIM_SUCCESS 1 + ++#ifdef CONFIG_NUMA ++extern int node_reclaim(struct pglist_data *, gfp_t, unsigned int); ++#else ++static inline int node_reclaim(struct pglist_data *pgdat, gfp_t mask, ++ unsigned int order) ++{ ++ return NODE_RECLAIM_NOSCAN; ++} ++#endif ++ + extern int hwpoison_filter(struct page *p); + + extern u32 hwpoison_filter_dev_major; +diff --git a/net/bridge/netfilter/ebt_dnat.c b/net/bridge/netfilter/ebt_dnat.c +index dfc86a0199da..1d8c834d9018 100644 +--- a/net/bridge/netfilter/ebt_dnat.c ++++ b/net/bridge/netfilter/ebt_dnat.c +@@ -19,7 +19,6 @@ static unsigned int + ebt_dnat_tg(struct sk_buff *skb, const struct xt_action_param *par) + { + const struct ebt_nat_info *info = par->targinfo; +- struct net_device *dev; + + if (!skb_make_writable(skb, 0)) + return EBT_DROP; +@@ -32,10 +31,22 @@ ebt_dnat_tg(struct sk_buff *skb, const struct xt_action_param *par) + else + skb->pkt_type = PACKET_MULTICAST; + } else { +- if (xt_hooknum(par) != NF_BR_BROUTING) +- dev = br_port_get_rcu(xt_in(par))->br->dev; +- else ++ const struct net_device *dev; ++ ++ switch (xt_hooknum(par)) { ++ case NF_BR_BROUTING: + dev = xt_in(par); ++ break; ++ case NF_BR_PRE_ROUTING: ++ dev = br_port_get_rcu(xt_in(par))->br->dev; ++ break; ++ default: ++ dev = NULL; ++ break; ++ } ++ ++ if (!dev) /* NF_BR_LOCAL_OUT */ ++ return info->target; + + if (ether_addr_equal(info->mac, dev->dev_addr)) + skb->pkt_type = PACKET_HOST; +diff --git a/net/core/neighbour.c b/net/core/neighbour.c +index eb3efeabac91..2664ad58e5c0 100644 +--- a/net/core/neighbour.c ++++ b/net/core/neighbour.c +@@ -18,6 +18,7 @@ + #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt + + #include ++#include + #include + #include + #include +@@ -361,12 +362,14 @@ static struct neigh_hash_table *neigh_hash_alloc(unsigned int shift) + ret = kmalloc(sizeof(*ret), GFP_ATOMIC); + if (!ret) + return NULL; +- if (size <= PAGE_SIZE) ++ if (size <= PAGE_SIZE) { + buckets = kzalloc(size, GFP_ATOMIC); +- else ++ } else { + buckets = (struct neighbour __rcu **) + __get_free_pages(GFP_ATOMIC | __GFP_ZERO, + get_order(size)); ++ kmemleak_alloc(buckets, size, 1, GFP_ATOMIC); ++ } + if (!buckets) { + kfree(ret); + return NULL; +@@ -386,10 +389,12 @@ static void neigh_hash_free_rcu(struct rcu_head *head) + size_t size = (1 << nht->hash_shift) * sizeof(struct neighbour *); + struct neighbour __rcu **buckets = nht->hash_buckets; + +- if (size <= PAGE_SIZE) ++ if (size <= PAGE_SIZE) { + kfree(buckets); +- else ++ } else { ++ kmemleak_free(buckets); + free_pages((unsigned long)buckets, get_order(size)); ++ } + kfree(nht); + } + +diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c +index 60b88718b1d4..1af25d53f63c 100644 +--- a/net/core/net_namespace.c ++++ b/net/core/net_namespace.c +@@ -854,7 +854,8 @@ static int __init net_ns_init(void) + + mutex_unlock(&net_mutex); + +- register_pernet_subsys(&net_ns_ops); ++ if (register_pernet_subsys(&net_ns_ops)) ++ panic("Could not register network namespace subsystems"); + + rtnl_register(PF_UNSPEC, RTM_NEWNSID, rtnl_net_newid, NULL, + RTNL_FLAG_DOIT_UNLOCKED); +diff --git a/net/core/sock.c b/net/core/sock.c +index 7ccbcd853cbc..90ccbbf9e6b0 100644 +--- a/net/core/sock.c ++++ b/net/core/sock.c +@@ -2357,7 +2357,7 @@ int __sk_mem_raise_allocated(struct sock *sk, int size, int amt, int kind) + } + + if (sk_has_memory_pressure(sk)) { +- int alloc; ++ u64 alloc; + + if (!sk_under_memory_pressure(sk)) + return 1; +diff --git a/net/decnet/dn_dev.c b/net/decnet/dn_dev.c +index df042b6d80b8..22876a197ebe 100644 +--- a/net/decnet/dn_dev.c ++++ b/net/decnet/dn_dev.c +@@ -56,7 +56,7 @@ + #include + #include + +-#define DN_IFREQ_SIZE (sizeof(struct ifreq) - sizeof(struct sockaddr) + sizeof(struct sockaddr_dn)) ++#define DN_IFREQ_SIZE (offsetof(struct ifreq, ifr_ifru) + sizeof(struct sockaddr_dn)) + + static char dn_rt_all_end_mcast[ETH_ALEN] = {0xAB,0x00,0x00,0x04,0x00,0x00}; + static char dn_rt_all_rt_mcast[ETH_ALEN] = {0xAB,0x00,0x00,0x03,0x00,0x00}; +diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c +index fabc299cb875..7a31287ff123 100644 +--- a/net/ipv4/ip_tunnel.c ++++ b/net/ipv4/ip_tunnel.c +@@ -661,13 +661,19 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, + dst = tnl_params->daddr; + if (dst == 0) { + /* NBMA tunnel */ ++ struct ip_tunnel_info *tun_info; + + if (!skb_dst(skb)) { + dev->stats.tx_fifo_errors++; + goto tx_error; + } + +- if (skb->protocol == htons(ETH_P_IP)) { ++ tun_info = skb_tunnel_info(skb); ++ if (tun_info && (tun_info->mode & IP_TUNNEL_INFO_TX) && ++ ip_tunnel_info_af(tun_info) == AF_INET && ++ tun_info->key.u.ipv4.dst) ++ dst = tun_info->key.u.ipv4.dst; ++ else if (skb->protocol == htons(ETH_P_IP)) { + rt = skb_rtable(skb); + dst = rt_nexthop(rt, inner_iph->daddr); + } +diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c +index f1b496222bda..1a86974b02e3 100644 +--- a/net/mac80211/sta_info.c ++++ b/net/mac80211/sta_info.c +@@ -2313,7 +2313,8 @@ unsigned long ieee80211_sta_last_active(struct sta_info *sta) + { + struct ieee80211_sta_rx_stats *stats = sta_get_last_rx_stats(sta); + +- if (time_after(stats->last_rx, sta->status_stats.last_ack)) ++ if (!sta->status_stats.last_ack || ++ time_after(stats->last_rx, sta->status_stats.last_ack)) + return stats->last_rx; + return sta->status_stats.last_ack; + } +diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c +index 2de2a923ff2b..3248cf04d0b3 100644 +--- a/net/openvswitch/datapath.c ++++ b/net/openvswitch/datapath.c +@@ -724,9 +724,13 @@ static size_t ovs_flow_cmd_msg_size(const struct sw_flow_actions *acts, + { + size_t len = NLMSG_ALIGN(sizeof(struct ovs_header)); + +- /* OVS_FLOW_ATTR_UFID */ ++ /* OVS_FLOW_ATTR_UFID, or unmasked flow key as fallback ++ * see ovs_nla_put_identifier() ++ */ + if (sfid && ovs_identifier_is_ufid(sfid)) + len += nla_total_size(sfid->ufid_len); ++ else ++ len += nla_total_size(ovs_key_attr_size()); + + /* OVS_FLOW_ATTR_KEY */ + if (!sfid || should_fill_key(sfid, ufid_flags)) +@@ -902,7 +906,10 @@ static struct sk_buff *ovs_flow_cmd_build_info(const struct sw_flow *flow, + retval = ovs_flow_cmd_fill_info(flow, dp_ifindex, skb, + info->snd_portid, info->snd_seq, 0, + cmd, ufid_flags); +- BUG_ON(retval < 0); ++ if (WARN_ON_ONCE(retval < 0)) { ++ kfree_skb(skb); ++ skb = ERR_PTR(retval); ++ } + return skb; + } + +@@ -1365,7 +1372,10 @@ static int ovs_flow_cmd_del(struct sk_buff *skb, struct genl_info *info) + OVS_FLOW_CMD_DEL, + ufid_flags); + rcu_read_unlock(); +- BUG_ON(err < 0); ++ if (WARN_ON_ONCE(err < 0)) { ++ kfree_skb(reply); ++ goto out_free; ++ } + + ovs_notify(&dp_flow_genl_family, reply, info); + } else { +@@ -1373,6 +1383,7 @@ static int ovs_flow_cmd_del(struct sk_buff *skb, struct genl_info *info) + } + } + ++out_free: + ovs_flow_free(flow, true); + return 0; + unlock: +diff --git a/net/psample/psample.c b/net/psample/psample.c +index 4cea353221da..30e8239bd774 100644 +--- a/net/psample/psample.c ++++ b/net/psample/psample.c +@@ -223,7 +223,7 @@ void psample_sample_packet(struct psample_group *group, struct sk_buff *skb, + data_len = PSAMPLE_MAX_PACKET_SIZE - meta_len - NLA_HDRLEN + - NLA_ALIGNTO; + +- nl_skb = genlmsg_new(meta_len + data_len, GFP_ATOMIC); ++ nl_skb = genlmsg_new(meta_len + nla_total_size(data_len), GFP_ATOMIC); + if (unlikely(!nl_skb)) + return; + +diff --git a/net/sched/sch_mq.c b/net/sched/sch_mq.c +index f3a3e507422b..442ac9c3f16f 100644 +--- a/net/sched/sch_mq.c ++++ b/net/sched/sch_mq.c +@@ -191,7 +191,8 @@ static int mq_dump_class_stats(struct Qdisc *sch, unsigned long cl, + struct netdev_queue *dev_queue = mq_queue_get(sch, cl); + + sch = dev_queue->qdisc_sleeping; +- if (gnet_stats_copy_basic(&sch->running, d, NULL, &sch->bstats) < 0 || ++ if (gnet_stats_copy_basic(&sch->running, d, sch->cpu_bstats, ++ &sch->bstats) < 0 || + gnet_stats_copy_queue(d, NULL, &sch->qstats, sch->q.qlen) < 0) + return -1; + return 0; +diff --git a/net/sched/sch_mqprio.c b/net/sched/sch_mqprio.c +index 6bcdfe6e7b63..bb8d3fbc13bb 100644 +--- a/net/sched/sch_mqprio.c ++++ b/net/sched/sch_mqprio.c +@@ -366,8 +366,8 @@ static int mqprio_dump_class_stats(struct Qdisc *sch, unsigned long cl, + struct netdev_queue *dev_queue = mqprio_queue_get(sch, cl); + + sch = dev_queue->qdisc_sleeping; +- if (gnet_stats_copy_basic(qdisc_root_sleeping_running(sch), +- d, NULL, &sch->bstats) < 0 || ++ if (gnet_stats_copy_basic(qdisc_root_sleeping_running(sch), d, ++ sch->cpu_bstats, &sch->bstats) < 0 || + gnet_stats_copy_queue(d, NULL, + &sch->qstats, sch->q.qlen) < 0) + return -1; +diff --git a/net/sched/sch_multiq.c b/net/sched/sch_multiq.c +index ff4fc3e0facd..65aa03d46857 100644 +--- a/net/sched/sch_multiq.c ++++ b/net/sched/sch_multiq.c +@@ -340,7 +340,7 @@ static int multiq_dump_class_stats(struct Qdisc *sch, unsigned long cl, + + cl_q = q->queues[cl - 1]; + if (gnet_stats_copy_basic(qdisc_root_sleeping_running(sch), +- d, NULL, &cl_q->bstats) < 0 || ++ d, cl_q->cpu_bstats, &cl_q->bstats) < 0 || + gnet_stats_copy_queue(d, NULL, &cl_q->qstats, cl_q->q.qlen) < 0) + return -1; + +diff --git a/net/sched/sch_prio.c b/net/sched/sch_prio.c +index 2dd6c68ae91e..c60777351de1 100644 +--- a/net/sched/sch_prio.c ++++ b/net/sched/sch_prio.c +@@ -298,7 +298,7 @@ static int prio_dump_class_stats(struct Qdisc *sch, unsigned long cl, + + cl_q = q->queues[cl - 1]; + if (gnet_stats_copy_basic(qdisc_root_sleeping_running(sch), +- d, NULL, &cl_q->bstats) < 0 || ++ d, cl_q->cpu_bstats, &cl_q->bstats) < 0 || + gnet_stats_copy_queue(d, NULL, &cl_q->qstats, cl_q->q.qlen) < 0) + return -1; + +diff --git a/net/sctp/associola.c b/net/sctp/associola.c +index 23fec3817e0c..dd1a3bd80be5 100644 +--- a/net/sctp/associola.c ++++ b/net/sctp/associola.c +@@ -80,6 +80,7 @@ static struct sctp_association *sctp_association_init( + /* Discarding const is appropriate here. */ + asoc->ep = (struct sctp_endpoint *)ep; + asoc->base.sk = (struct sock *)sk; ++ asoc->base.net = sock_net(sk); + + sctp_endpoint_hold(asoc->ep); + sock_hold(asoc->base.sk); +diff --git a/net/sctp/endpointola.c b/net/sctp/endpointola.c +index 5d4079ef3de6..c71b4191df1e 100644 +--- a/net/sctp/endpointola.c ++++ b/net/sctp/endpointola.c +@@ -165,6 +165,7 @@ static struct sctp_endpoint *sctp_endpoint_init(struct sctp_endpoint *ep, + + /* Remember who we are attached to. */ + ep->base.sk = sk; ++ ep->base.net = sock_net(sk); + sock_hold(ep->base.sk); + + return ep; +diff --git a/net/sctp/input.c b/net/sctp/input.c +index 0247cc432e02..3c0affecf272 100644 +--- a/net/sctp/input.c ++++ b/net/sctp/input.c +@@ -813,7 +813,7 @@ static inline int sctp_hash_cmp(struct rhashtable_compare_arg *arg, + if (!sctp_transport_hold(t)) + return err; + +- if (!net_eq(sock_net(t->asoc->base.sk), x->net)) ++ if (!net_eq(t->asoc->base.net, x->net)) + goto out; + if (x->lport != htons(t->asoc->base.bind_addr.port)) + goto out; +@@ -828,7 +828,7 @@ static inline __u32 sctp_hash_obj(const void *data, u32 len, u32 seed) + { + const struct sctp_transport *t = data; + const union sctp_addr *paddr = &t->ipaddr; +- const struct net *net = sock_net(t->asoc->base.sk); ++ const struct net *net = t->asoc->base.net; + __be16 lport = htons(t->asoc->base.bind_addr.port); + __u32 addr; + +diff --git a/net/sctp/transport.c b/net/sctp/transport.c +index 43105cf04bc4..274df899e7bf 100644 +--- a/net/sctp/transport.c ++++ b/net/sctp/transport.c +@@ -210,7 +210,8 @@ void sctp_transport_reset_hb_timer(struct sctp_transport *transport) + + /* When a data chunk is sent, reset the heartbeat interval. */ + expires = jiffies + sctp_transport_timeout(transport); +- if (time_before(transport->hb_timer.expires, expires) && ++ if ((time_before(transport->hb_timer.expires, expires) || ++ !timer_pending(&transport->hb_timer)) && + !mod_timer(&transport->hb_timer, + expires + prandom_u32_max(transport->rto))) + sctp_transport_hold(transport); +diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c +index f04a037dc967..0de788fa43e9 100644 +--- a/net/smc/smc_core.c ++++ b/net/smc/smc_core.c +@@ -103,6 +103,8 @@ static void smc_lgr_unregister_conn(struct smc_connection *conn) + struct smc_link_group *lgr = conn->lgr; + int reduced = 0; + ++ if (!lgr) ++ return; + write_lock_bh(&lgr->conns_lock); + if (conn->alert_token_local) { + reduced = 1; +@@ -431,6 +433,8 @@ int smc_conn_create(struct smc_sock *smc, __be32 peer_in_addr, + local_contact = SMC_REUSE_CONTACT; + conn->lgr = lgr; + smc_lgr_register_conn(conn); /* add smc conn to lgr */ ++ if (delayed_work_pending(&lgr->free_work)) ++ cancel_delayed_work(&lgr->free_work); + write_unlock_bh(&lgr->conns_lock); + break; + } +diff --git a/net/tipc/link.c b/net/tipc/link.c +index 631bfc7e9127..da749916faac 100644 +--- a/net/tipc/link.c ++++ b/net/tipc/link.c +@@ -1073,7 +1073,7 @@ static bool tipc_data_input(struct tipc_link *l, struct sk_buff *skb, + default: + pr_warn("Dropping received illegal msg type\n"); + kfree_skb(skb); +- return false; ++ return true; + }; + } + +diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c +index ad4dcc663c6d..fa0522cd683e 100644 +--- a/net/tipc/netlink_compat.c ++++ b/net/tipc/netlink_compat.c +@@ -539,7 +539,7 @@ static int tipc_nl_compat_link_stat_dump(struct tipc_nl_compat_msg *msg, + if (len <= 0) + return -EINVAL; + +- len = min_t(int, len, TIPC_MAX_BEARER_NAME); ++ len = min_t(int, len, TIPC_MAX_LINK_NAME); + if (!string_is_valid(name, len)) + return -EINVAL; + +@@ -821,7 +821,7 @@ static int tipc_nl_compat_link_reset_stats(struct tipc_nl_compat_cmd_doit *cmd, + if (len <= 0) + return -EINVAL; + +- len = min_t(int, len, TIPC_MAX_BEARER_NAME); ++ len = min_t(int, len, TIPC_MAX_LINK_NAME); + if (!string_is_valid(name, len)) + return -EINVAL; + +@@ -974,6 +974,10 @@ static int tipc_nl_compat_publ_dump(struct tipc_nl_compat_msg *msg, u32 sock) + + hdr = genlmsg_put(args, 0, 0, &tipc_genl_family, NLM_F_MULTI, + TIPC_NL_PUBL_GET); ++ if (!hdr) { ++ kfree_skb(args); ++ return -EMSGSIZE; ++ } + + nest = nla_nest_start(args, TIPC_NLA_SOCK); + if (!nest) { +@@ -1021,8 +1025,11 @@ static int tipc_nl_compat_sk_dump(struct tipc_nl_compat_msg *msg, + u32 node; + struct nlattr *con[TIPC_NLA_CON_MAX + 1]; + +- nla_parse_nested(con, TIPC_NLA_CON_MAX, +- sock[TIPC_NLA_SOCK_CON], NULL, NULL); ++ err = nla_parse_nested(con, TIPC_NLA_CON_MAX, ++ sock[TIPC_NLA_SOCK_CON], NULL, NULL); ++ ++ if (err) ++ return err; + + node = nla_get_u32(con[TIPC_NLA_CON_NODE]); + tipc_tlv_sprintf(msg->rep, " connected to <%u.%u.%u:%u>", +diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c +index 1939b77e98b7..73eac97e19fb 100644 +--- a/net/vmw_vsock/af_vsock.c ++++ b/net/vmw_vsock/af_vsock.c +@@ -107,6 +107,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -487,9 +488,13 @@ out: + static int __vsock_bind_stream(struct vsock_sock *vsk, + struct sockaddr_vm *addr) + { +- static u32 port = LAST_RESERVED_PORT + 1; ++ static u32 port = 0; + struct sockaddr_vm new_addr; + ++ if (!port) ++ port = LAST_RESERVED_PORT + 1 + ++ prandom_u32_max(U32_MAX - LAST_RESERVED_PORT); ++ + vsock_addr_init(&new_addr, addr->svm_cid, addr->svm_port); + + if (addr->svm_port == VMADDR_PORT_ANY) { +diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c +index bd16e6882017..190ca59d5ba3 100644 +--- a/net/xfrm/xfrm_state.c ++++ b/net/xfrm/xfrm_state.c +@@ -449,6 +449,8 @@ static void xfrm_state_gc_destroy(struct xfrm_state *x) + x->type->destructor(x); + xfrm_put_type(x->type); + } ++ if (x->xfrag.page) ++ put_page(x->xfrag.page); + xfrm_dev_state_free(x); + security_xfrm_state_free(x); + kfree(x); +diff --git a/samples/vfio-mdev/mtty.c b/samples/vfio-mdev/mtty.c +index ca495686b9c3..f8c7249fa705 100644 +--- a/samples/vfio-mdev/mtty.c ++++ b/samples/vfio-mdev/mtty.c +@@ -171,7 +171,7 @@ static struct mdev_state *find_mdev_state_by_uuid(uuid_le uuid) + return NULL; + } + +-void dump_buffer(char *buf, uint32_t count) ++void dump_buffer(u8 *buf, uint32_t count) + { + #if defined(DEBUG) + int i; +@@ -250,7 +250,7 @@ static void mtty_create_config_space(struct mdev_state *mdev_state) + } + + static void handle_pci_cfg_write(struct mdev_state *mdev_state, u16 offset, +- char *buf, u32 count) ++ u8 *buf, u32 count) + { + u32 cfg_addr, bar_mask, bar_index = 0; + +@@ -304,7 +304,7 @@ static void handle_pci_cfg_write(struct mdev_state *mdev_state, u16 offset, + } + + static void handle_bar_write(unsigned int index, struct mdev_state *mdev_state, +- u16 offset, char *buf, u32 count) ++ u16 offset, u8 *buf, u32 count) + { + u8 data = *buf; + +@@ -475,7 +475,7 @@ static void handle_bar_write(unsigned int index, struct mdev_state *mdev_state, + } + + static void handle_bar_read(unsigned int index, struct mdev_state *mdev_state, +- u16 offset, char *buf, u32 count) ++ u16 offset, u8 *buf, u32 count) + { + /* Handle read requests by guest */ + switch (offset) { +@@ -650,7 +650,7 @@ static void mdev_read_base(struct mdev_state *mdev_state) + } + } + +-static ssize_t mdev_access(struct mdev_device *mdev, char *buf, size_t count, ++static ssize_t mdev_access(struct mdev_device *mdev, u8 *buf, size_t count, + loff_t pos, bool is_write) + { + struct mdev_state *mdev_state; +@@ -698,7 +698,7 @@ static ssize_t mdev_access(struct mdev_device *mdev, char *buf, size_t count, + #if defined(DEBUG_REGS) + pr_info("%s: BAR%d WR @0x%llx %s val:0x%02x dlab:%d\n", + __func__, index, offset, wr_reg[offset], +- (u8)*buf, mdev_state->s[index].dlab); ++ *buf, mdev_state->s[index].dlab); + #endif + handle_bar_write(index, mdev_state, offset, buf, count); + } else { +@@ -708,7 +708,7 @@ static ssize_t mdev_access(struct mdev_device *mdev, char *buf, size_t count, + #if defined(DEBUG_REGS) + pr_info("%s: BAR%d RD @0x%llx %s val:0x%02x dlab:%d\n", + __func__, index, offset, rd_reg[offset], +- (u8)*buf, mdev_state->s[index].dlab); ++ *buf, mdev_state->s[index].dlab); + #endif + } + break; +@@ -827,7 +827,7 @@ ssize_t mtty_read(struct mdev_device *mdev, char __user *buf, size_t count, + if (count >= 4 && !(*ppos % 4)) { + u32 val; + +- ret = mdev_access(mdev, (char *)&val, sizeof(val), ++ ret = mdev_access(mdev, (u8 *)&val, sizeof(val), + *ppos, false); + if (ret <= 0) + goto read_err; +@@ -839,7 +839,7 @@ ssize_t mtty_read(struct mdev_device *mdev, char __user *buf, size_t count, + } else if (count >= 2 && !(*ppos % 2)) { + u16 val; + +- ret = mdev_access(mdev, (char *)&val, sizeof(val), ++ ret = mdev_access(mdev, (u8 *)&val, sizeof(val), + *ppos, false); + if (ret <= 0) + goto read_err; +@@ -851,7 +851,7 @@ ssize_t mtty_read(struct mdev_device *mdev, char __user *buf, size_t count, + } else { + u8 val; + +- ret = mdev_access(mdev, (char *)&val, sizeof(val), ++ ret = mdev_access(mdev, (u8 *)&val, sizeof(val), + *ppos, false); + if (ret <= 0) + goto read_err; +@@ -889,7 +889,7 @@ ssize_t mtty_write(struct mdev_device *mdev, const char __user *buf, + if (copy_from_user(&val, buf, sizeof(val))) + goto write_err; + +- ret = mdev_access(mdev, (char *)&val, sizeof(val), ++ ret = mdev_access(mdev, (u8 *)&val, sizeof(val), + *ppos, true); + if (ret <= 0) + goto write_err; +@@ -901,7 +901,7 @@ ssize_t mtty_write(struct mdev_device *mdev, const char __user *buf, + if (copy_from_user(&val, buf, sizeof(val))) + goto write_err; + +- ret = mdev_access(mdev, (char *)&val, sizeof(val), ++ ret = mdev_access(mdev, (u8 *)&val, sizeof(val), + *ppos, true); + if (ret <= 0) + goto write_err; +@@ -913,7 +913,7 @@ ssize_t mtty_write(struct mdev_device *mdev, const char __user *buf, + if (copy_from_user(&val, buf, sizeof(val))) + goto write_err; + +- ret = mdev_access(mdev, (char *)&val, sizeof(val), ++ ret = mdev_access(mdev, (u8 *)&val, sizeof(val), + *ppos, true); + if (ret <= 0) + goto write_err; +diff --git a/scripts/gdb/linux/symbols.py b/scripts/gdb/linux/symbols.py +index 004b0ac7fa72..4644f1a83b57 100644 +--- a/scripts/gdb/linux/symbols.py ++++ b/scripts/gdb/linux/symbols.py +@@ -99,7 +99,8 @@ lx-symbols command.""" + attrs[n]['name'].string(): attrs[n]['address'] + for n in range(int(sect_attrs['nsections']))} + args = [] +- for section_name in [".data", ".data..read_mostly", ".rodata", ".bss"]: ++ for section_name in [".data", ".data..read_mostly", ".rodata", ".bss", ++ ".text", ".text.hot", ".text.unlikely"]: + address = section_name_to_address.get(section_name) + if address: + args.append(" -s {name} {addr}".format( +diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c +index dd746bd69a9b..c106988c1b25 100644 +--- a/security/apparmor/apparmorfs.c ++++ b/security/apparmor/apparmorfs.c +@@ -363,6 +363,7 @@ static void aafs_remove(struct dentry *dentry) + simple_rmdir(dir, dentry); + else + simple_unlink(dir, dentry); ++ d_delete(dentry); + dput(dentry); + } + inode_unlock(dir); +diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c +index 2e2d18468491..7ae8e24dc1e6 100644 +--- a/sound/core/compress_offload.c ++++ b/sound/core/compress_offload.c +@@ -529,7 +529,7 @@ static int snd_compress_check_input(struct snd_compr_params *params) + { + /* first let's check the buffer parameter's */ + if (params->buffer.fragment_size == 0 || +- params->buffer.fragments > INT_MAX / params->buffer.fragment_size || ++ params->buffer.fragments > U32_MAX / params->buffer.fragment_size || + params->buffer.fragments == 0) + return -EINVAL; + +diff --git a/sound/soc/codecs/msm8916-wcd-analog.c b/sound/soc/codecs/msm8916-wcd-analog.c +index 0b9b014b4bb6..969283737787 100644 +--- a/sound/soc/codecs/msm8916-wcd-analog.c ++++ b/sound/soc/codecs/msm8916-wcd-analog.c +@@ -303,7 +303,7 @@ struct pm8916_wcd_analog_priv { + }; + + static const char *const adc2_mux_text[] = { "ZERO", "INP2", "INP3" }; +-static const char *const rdac2_mux_text[] = { "ZERO", "RX2", "RX1" }; ++static const char *const rdac2_mux_text[] = { "RX1", "RX2" }; + static const char *const hph_text[] = { "ZERO", "Switch", }; + + static const struct soc_enum hph_enum = SOC_ENUM_SINGLE_VIRT( +@@ -318,7 +318,7 @@ static const struct soc_enum adc2_enum = SOC_ENUM_SINGLE_VIRT( + + /* RDAC2 MUX */ + static const struct soc_enum rdac2_mux_enum = SOC_ENUM_SINGLE( +- CDC_D_CDC_CONN_HPHR_DAC_CTL, 0, 3, rdac2_mux_text); ++ CDC_D_CDC_CONN_HPHR_DAC_CTL, 0, 2, rdac2_mux_text); + + static const struct snd_kcontrol_new spkr_switch[] = { + SOC_DAPM_SINGLE("Switch", CDC_A_SPKR_DAC_CTL, 7, 1, 0) +diff --git a/sound/soc/kirkwood/kirkwood-i2s.c b/sound/soc/kirkwood/kirkwood-i2s.c +index 105a73cc5158..149b7cba10fb 100644 +--- a/sound/soc/kirkwood/kirkwood-i2s.c ++++ b/sound/soc/kirkwood/kirkwood-i2s.c +@@ -569,10 +569,6 @@ static int kirkwood_i2s_dev_probe(struct platform_device *pdev) + return PTR_ERR(priv->clk); + } + +- err = clk_prepare_enable(priv->clk); +- if (err < 0) +- return err; +- + priv->extclk = devm_clk_get(&pdev->dev, "extclk"); + if (IS_ERR(priv->extclk)) { + if (PTR_ERR(priv->extclk) == -EPROBE_DEFER) +@@ -588,6 +584,10 @@ static int kirkwood_i2s_dev_probe(struct platform_device *pdev) + } + } + ++ err = clk_prepare_enable(priv->clk); ++ if (err < 0) ++ return err; ++ + /* Some sensible defaults - this reflects the powerup values */ + priv->ctl_play = KIRKWOOD_PLAYCTL_SIZE_24; + priv->ctl_rec = KIRKWOOD_RECCTL_SIZE_24; +diff --git a/sound/soc/stm/stm32_i2s.c b/sound/soc/stm/stm32_i2s.c +index 6d0bf78d114d..aa2b1196171a 100644 +--- a/sound/soc/stm/stm32_i2s.c ++++ b/sound/soc/stm/stm32_i2s.c +@@ -246,8 +246,8 @@ static irqreturn_t stm32_i2s_isr(int irq, void *devid) + return IRQ_NONE; + } + +- regmap_update_bits(i2s->regmap, STM32_I2S_IFCR_REG, +- I2S_IFCR_MASK, flags); ++ regmap_write_bits(i2s->regmap, STM32_I2S_IFCR_REG, ++ I2S_IFCR_MASK, flags); + + if (flags & I2S_SR_OVR) { + dev_dbg(&pdev->dev, "Overrun\n"); +@@ -276,7 +276,6 @@ static bool stm32_i2s_readable_reg(struct device *dev, unsigned int reg) + case STM32_I2S_CFG2_REG: + case STM32_I2S_IER_REG: + case STM32_I2S_SR_REG: +- case STM32_I2S_IFCR_REG: + case STM32_I2S_TXDR_REG: + case STM32_I2S_RXDR_REG: + case STM32_I2S_CGFR_REG: +@@ -488,7 +487,7 @@ static int stm32_i2s_configure(struct snd_soc_dai *cpu_dai, + { + struct stm32_i2s_data *i2s = snd_soc_dai_get_drvdata(cpu_dai); + int format = params_width(params); +- u32 cfgr, cfgr_mask, cfg1, cfg1_mask; ++ u32 cfgr, cfgr_mask, cfg1; + unsigned int fthlv; + int ret; + +@@ -501,7 +500,7 @@ static int stm32_i2s_configure(struct snd_soc_dai *cpu_dai, + switch (format) { + case 16: + cfgr = I2S_CGFR_DATLEN_SET(I2S_I2SMOD_DATLEN_16); +- cfgr_mask = I2S_CGFR_DATLEN_MASK; ++ cfgr_mask = I2S_CGFR_DATLEN_MASK | I2S_CGFR_CHLEN; + break; + case 32: + cfgr = I2S_CGFR_DATLEN_SET(I2S_I2SMOD_DATLEN_32) | +@@ -529,15 +528,11 @@ static int stm32_i2s_configure(struct snd_soc_dai *cpu_dai, + if (ret < 0) + return ret; + +- cfg1 = I2S_CFG1_RXDMAEN | I2S_CFG1_TXDMAEN; +- cfg1_mask = cfg1; +- + fthlv = STM32_I2S_FIFO_SIZE * I2S_FIFO_TH_ONE_QUARTER / 4; +- cfg1 |= I2S_CFG1_FTHVL_SET(fthlv - 1); +- cfg1_mask |= I2S_CFG1_FTHVL_MASK; ++ cfg1 = I2S_CFG1_FTHVL_SET(fthlv - 1); + + return regmap_update_bits(i2s->regmap, STM32_I2S_CFG1_REG, +- cfg1_mask, cfg1); ++ I2S_CFG1_FTHVL_MASK, cfg1); + } + + static int stm32_i2s_startup(struct snd_pcm_substream *substream, +@@ -551,8 +546,8 @@ static int stm32_i2s_startup(struct snd_pcm_substream *substream, + i2s->refcount++; + spin_unlock(&i2s->lock_fd); + +- return regmap_update_bits(i2s->regmap, STM32_I2S_IFCR_REG, +- I2S_IFCR_MASK, I2S_IFCR_MASK); ++ return regmap_write_bits(i2s->regmap, STM32_I2S_IFCR_REG, ++ I2S_IFCR_MASK, I2S_IFCR_MASK); + } + + static int stm32_i2s_hw_params(struct snd_pcm_substream *substream, +@@ -589,6 +584,10 @@ static int stm32_i2s_trigger(struct snd_pcm_substream *substream, int cmd, + /* Enable i2s */ + dev_dbg(cpu_dai->dev, "start I2S\n"); + ++ cfg1_mask = I2S_CFG1_RXDMAEN | I2S_CFG1_TXDMAEN; ++ regmap_update_bits(i2s->regmap, STM32_I2S_CFG1_REG, ++ cfg1_mask, cfg1_mask); ++ + ret = regmap_update_bits(i2s->regmap, STM32_I2S_CR1_REG, + I2S_CR1_SPE, I2S_CR1_SPE); + if (ret < 0) { +@@ -603,8 +602,8 @@ static int stm32_i2s_trigger(struct snd_pcm_substream *substream, int cmd, + return ret; + } + +- regmap_update_bits(i2s->regmap, STM32_I2S_IFCR_REG, +- I2S_IFCR_MASK, I2S_IFCR_MASK); ++ regmap_write_bits(i2s->regmap, STM32_I2S_IFCR_REG, ++ I2S_IFCR_MASK, I2S_IFCR_MASK); + + if (playback_flg) { + ier = I2S_IER_UDRIE; +diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c +index cdaacdf7bc87..deff4b3eb972 100644 +--- a/virt/kvm/kvm_main.c ++++ b/virt/kvm/kvm_main.c +@@ -3989,7 +3989,7 @@ static void kvm_uevent_notify_change(unsigned int type, struct kvm *kvm) + } + add_uevent_var(env, "PID=%d", kvm->userspace_pid); + +- if (kvm->debugfs_dentry) { ++ if (!IS_ERR_OR_NULL(kvm->debugfs_dentry)) { + char *tmp, *p = kmalloc(PATH_MAX, GFP_KERNEL); + + if (p) { diff --git a/patch/kernel/odroidxu4-legacy/patch-4.14.158-159.patch b/patch/kernel/odroidxu4-legacy/patch-4.14.158-159.patch new file mode 100644 index 000000000..b9bf3342f --- /dev/null +++ b/patch/kernel/odroidxu4-legacy/patch-4.14.158-159.patch @@ -0,0 +1,7973 @@ +diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt +index b0da6050a254..933465eff40e 100644 +--- a/Documentation/admin-guide/kernel-parameters.txt ++++ b/Documentation/admin-guide/kernel-parameters.txt +@@ -4693,13 +4693,13 @@ + Flags is a set of characters, each corresponding + to a common usb-storage quirk flag as follows: + a = SANE_SENSE (collect more than 18 bytes +- of sense data); ++ of sense data, not on uas); + b = BAD_SENSE (don't collect more than 18 +- bytes of sense data); ++ bytes of sense data, not on uas); + c = FIX_CAPACITY (decrease the reported + device capacity by one sector); + d = NO_READ_DISC_INFO (don't use +- READ_DISC_INFO command); ++ READ_DISC_INFO command, not on uas); + e = NO_READ_CAPACITY_16 (don't use + READ_CAPACITY_16 command); + f = NO_REPORT_OPCODES (don't use report opcodes +@@ -4714,17 +4714,18 @@ + j = NO_REPORT_LUNS (don't use report luns + command, uas only); + l = NOT_LOCKABLE (don't try to lock and +- unlock ejectable media); ++ unlock ejectable media, not on uas); + m = MAX_SECTORS_64 (don't transfer more +- than 64 sectors = 32 KB at a time); ++ than 64 sectors = 32 KB at a time, ++ not on uas); + n = INITIAL_READ10 (force a retry of the +- initial READ(10) command); ++ initial READ(10) command, not on uas); + o = CAPACITY_OK (accept the capacity +- reported by the device); ++ reported by the device, not on uas); + p = WRITE_CACHE (the device cache is ON +- by default); ++ by default, not on uas); + r = IGNORE_RESIDUE (the device reports +- bogus residue values); ++ bogus residue values, not on uas); + s = SINGLE_LUN (the device has only one + Logical Unit); + t = NO_ATA_1X (don't allow ATA(12) and ATA(16) +@@ -4733,7 +4734,8 @@ + w = NO_WP_DETECT (don't test whether the + medium is write-protected). + y = ALWAYS_SYNC (issue a SYNCHRONIZE_CACHE +- even if the device claims no cache) ++ even if the device claims no cache, ++ not on uas) + Example: quirks=0419:aaf5:rl,0421:0433:rc + + user_debug= [KNL,ARM] +diff --git a/Documentation/devicetree/bindings/rtc/abracon,abx80x.txt b/Documentation/devicetree/bindings/rtc/abracon,abx80x.txt +index be789685a1c2..18b892d010d8 100644 +--- a/Documentation/devicetree/bindings/rtc/abracon,abx80x.txt ++++ b/Documentation/devicetree/bindings/rtc/abracon,abx80x.txt +@@ -27,4 +27,4 @@ and valid to enable charging: + + - "abracon,tc-diode": should be "standard" (0.6V) or "schottky" (0.3V) + - "abracon,tc-resistor": should be <0>, <3>, <6> or <11>. 0 disables the output +- resistor, the other values are in ohm. ++ resistor, the other values are in kOhm. +diff --git a/Makefile b/Makefile +index d97288c0754f..e14ad8f064ec 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 14 +-SUBLEVEL = 158 ++SUBLEVEL = 159 + EXTRAVERSION = + NAME = Petit Gorille + +@@ -1529,9 +1529,6 @@ else # KBUILD_EXTMOD + + # We are always building modules + KBUILD_MODULES := 1 +-PHONY += crmodverdir +-crmodverdir: +- $(cmd_crmodverdir) + + PHONY += $(objtree)/Module.symvers + $(objtree)/Module.symvers: +@@ -1543,7 +1540,7 @@ $(objtree)/Module.symvers: + + module-dirs := $(addprefix _module_,$(KBUILD_EXTMOD)) + PHONY += $(module-dirs) modules +-$(module-dirs): crmodverdir $(objtree)/Module.symvers ++$(module-dirs): prepare $(objtree)/Module.symvers + $(Q)$(MAKE) $(build)=$(patsubst _module_%,%,$@) + + modules: $(module-dirs) +@@ -1584,7 +1581,8 @@ help: + + # Dummies... + PHONY += prepare scripts +-prepare: ; ++prepare: ++ $(cmd_crmodverdir) + scripts: ; + endif # KBUILD_EXTMOD + +@@ -1709,17 +1707,14 @@ endif + + # Modules + /: prepare scripts FORCE +- $(cmd_crmodverdir) + $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \ + $(build)=$(build-dir) + # Make sure the latest headers are built for Documentation + Documentation/ samples/: headers_install + %/: prepare scripts FORCE +- $(cmd_crmodverdir) + $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \ + $(build)=$(build-dir) + %.ko: prepare scripts FORCE +- $(cmd_crmodverdir) + $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \ + $(build)=$(build-dir) $(@:.ko=.o) + $(Q)$(MAKE) -f $(srctree)/scripts/Makefile.modpost +diff --git a/arch/arm/Kconfig.debug b/arch/arm/Kconfig.debug +index fd4b679945d3..b14f154919a5 100644 +--- a/arch/arm/Kconfig.debug ++++ b/arch/arm/Kconfig.debug +@@ -1023,14 +1023,21 @@ choice + Say Y here if you want kernel low-level debugging support + on SOCFPGA(Cyclone 5 and Arria 5) based platforms. + +- config DEBUG_SOCFPGA_UART1 ++ config DEBUG_SOCFPGA_ARRIA10_UART1 + depends on ARCH_SOCFPGA +- bool "Use SOCFPGA UART1 for low-level debug" ++ bool "Use SOCFPGA Arria10 UART1 for low-level debug" + select DEBUG_UART_8250 + help + Say Y here if you want kernel low-level debugging support + on SOCFPGA(Arria 10) based platforms. + ++ config DEBUG_SOCFPGA_CYCLONE5_UART1 ++ depends on ARCH_SOCFPGA ++ bool "Use SOCFPGA Cyclone 5 UART1 for low-level debug" ++ select DEBUG_UART_8250 ++ help ++ Say Y here if you want kernel low-level debugging support ++ on SOCFPGA(Cyclone 5 and Arria 5) based platforms. + + config DEBUG_SUN9I_UART0 + bool "Kernel low-level debugging messages via sun9i UART0" +@@ -1585,7 +1592,8 @@ config DEBUG_UART_PHYS + default 0xfe800000 if ARCH_IOP32X + default 0xff690000 if DEBUG_RK32_UART2 + default 0xffc02000 if DEBUG_SOCFPGA_UART0 +- default 0xffc02100 if DEBUG_SOCFPGA_UART1 ++ default 0xffc02100 if DEBUG_SOCFPGA_ARRIA10_UART1 ++ default 0xffc03000 if DEBUG_SOCFPGA_CYCLONE5_UART1 + default 0xffd82340 if ARCH_IOP13XX + default 0xffe40000 if DEBUG_RCAR_GEN1_SCIF0 + default 0xffe42000 if DEBUG_RCAR_GEN1_SCIF2 +@@ -1689,7 +1697,8 @@ config DEBUG_UART_VIRT + default 0xfeb30c00 if DEBUG_KEYSTONE_UART0 + default 0xfeb31000 if DEBUG_KEYSTONE_UART1 + default 0xfec02000 if DEBUG_SOCFPGA_UART0 +- default 0xfec02100 if DEBUG_SOCFPGA_UART1 ++ default 0xfec02100 if DEBUG_SOCFPGA_ARRIA10_UART1 ++ default 0xfec03000 if DEBUG_SOCFPGA_CYCLONE5_UART1 + default 0xfec12000 if (DEBUG_MVEBU_UART0 || DEBUG_MVEBU_UART0_ALTERNATE) && ARCH_MVEBU + default 0xfec12100 if DEBUG_MVEBU_UART1_ALTERNATE + default 0xfec10000 if DEBUG_SIRFATLAS7_UART0 +@@ -1737,9 +1746,9 @@ config DEBUG_UART_8250_WORD + depends on DEBUG_LL_UART_8250 || DEBUG_UART_8250 + depends on DEBUG_UART_8250_SHIFT >= 2 + default y if DEBUG_PICOXCELL_UART || \ +- DEBUG_SOCFPGA_UART0 || DEBUG_SOCFPGA_UART1 || \ +- DEBUG_KEYSTONE_UART0 || DEBUG_KEYSTONE_UART1 || \ +- DEBUG_ALPINE_UART0 || \ ++ DEBUG_SOCFPGA_UART0 || DEBUG_SOCFPGA_ARRIA10_UART1 || \ ++ DEBUG_SOCFPGA_CYCLONE5_UART1 || DEBUG_KEYSTONE_UART0 || \ ++ DEBUG_KEYSTONE_UART1 || DEBUG_ALPINE_UART0 || \ + DEBUG_DAVINCI_DMx_UART0 || DEBUG_DAVINCI_DA8XX_UART1 || \ + DEBUG_DAVINCI_DA8XX_UART2 || \ + DEBUG_BCM_KONA_UART || DEBUG_RK32_UART2 +diff --git a/arch/arm/boot/dts/arm-realview-pb1176.dts b/arch/arm/boot/dts/arm-realview-pb1176.dts +index c1fd5615ddfe..939c108c24a6 100644 +--- a/arch/arm/boot/dts/arm-realview-pb1176.dts ++++ b/arch/arm/boot/dts/arm-realview-pb1176.dts +@@ -45,7 +45,7 @@ + }; + + /* The voltage to the MMC card is hardwired at 3.3V */ +- vmmc: fixedregulator@0 { ++ vmmc: regulator-vmmc { + compatible = "regulator-fixed"; + regulator-name = "vmmc"; + regulator-min-microvolt = <3300000>; +@@ -53,7 +53,7 @@ + regulator-boot-on; + }; + +- veth: fixedregulator@0 { ++ veth: regulator-veth { + compatible = "regulator-fixed"; + regulator-name = "veth"; + regulator-min-microvolt = <3300000>; +diff --git a/arch/arm/boot/dts/arm-realview-pb11mp.dts b/arch/arm/boot/dts/arm-realview-pb11mp.dts +index e306f1cceb4e..95037c48182d 100644 +--- a/arch/arm/boot/dts/arm-realview-pb11mp.dts ++++ b/arch/arm/boot/dts/arm-realview-pb11mp.dts +@@ -145,7 +145,7 @@ + }; + + /* The voltage to the MMC card is hardwired at 3.3V */ +- vmmc: fixedregulator@0 { ++ vmmc: regulator-vmmc { + compatible = "regulator-fixed"; + regulator-name = "vmmc"; + regulator-min-microvolt = <3300000>; +@@ -153,7 +153,7 @@ + regulator-boot-on; + }; + +- veth: fixedregulator@0 { ++ veth: regulator-veth { + compatible = "regulator-fixed"; + regulator-name = "veth"; + regulator-min-microvolt = <3300000>; +diff --git a/arch/arm/boot/dts/arm-realview-pbx.dtsi b/arch/arm/boot/dts/arm-realview-pbx.dtsi +index 2bf3958b2e6b..068293254fbb 100644 +--- a/arch/arm/boot/dts/arm-realview-pbx.dtsi ++++ b/arch/arm/boot/dts/arm-realview-pbx.dtsi +@@ -43,7 +43,7 @@ + }; + + /* The voltage to the MMC card is hardwired at 3.3V */ +- vmmc: fixedregulator@0 { ++ vmmc: regulator-vmmc { + compatible = "regulator-fixed"; + regulator-name = "vmmc"; + regulator-min-microvolt = <3300000>; +@@ -51,7 +51,7 @@ + regulator-boot-on; + }; + +- veth: fixedregulator@0 { ++ veth: regulator-veth { + compatible = "regulator-fixed"; + regulator-name = "veth"; + regulator-min-microvolt = <3300000>; +@@ -539,4 +539,3 @@ + }; + }; + }; +- +diff --git a/arch/arm/boot/dts/exynos3250.dtsi b/arch/arm/boot/dts/exynos3250.dtsi +index aa06a02c3ff5..5ba662254909 100644 +--- a/arch/arm/boot/dts/exynos3250.dtsi ++++ b/arch/arm/boot/dts/exynos3250.dtsi +@@ -359,7 +359,7 @@ + }; + + hsotg: hsotg@12480000 { +- compatible = "snps,dwc2"; ++ compatible = "samsung,s3c6400-hsotg", "snps,dwc2"; + reg = <0x12480000 0x20000>; + interrupts = ; + clocks = <&cmu CLK_USBOTG>; +diff --git a/arch/arm/boot/dts/mmp2.dtsi b/arch/arm/boot/dts/mmp2.dtsi +index 47e5b63339d1..e95deed6a797 100644 +--- a/arch/arm/boot/dts/mmp2.dtsi ++++ b/arch/arm/boot/dts/mmp2.dtsi +@@ -180,7 +180,7 @@ + clocks = <&soc_clocks MMP2_CLK_GPIO>; + resets = <&soc_clocks MMP2_CLK_GPIO>; + interrupt-controller; +- #interrupt-cells = <1>; ++ #interrupt-cells = <2>; + ranges; + + gcb0: gpio@d4019000 { +diff --git a/arch/arm/boot/dts/omap3-pandora-common.dtsi b/arch/arm/boot/dts/omap3-pandora-common.dtsi +index 53e007abdc71..964240a0f4a9 100644 +--- a/arch/arm/boot/dts/omap3-pandora-common.dtsi ++++ b/arch/arm/boot/dts/omap3-pandora-common.dtsi +@@ -221,6 +221,17 @@ + gpio = <&gpio6 4 GPIO_ACTIVE_HIGH>; /* GPIO_164 */ + }; + ++ /* wl1251 wifi+bt module */ ++ wlan_en: fixed-regulator-wg7210_en { ++ compatible = "regulator-fixed"; ++ regulator-name = "vwlan"; ++ regulator-min-microvolt = <1800000>; ++ regulator-max-microvolt = <1800000>; ++ startup-delay-us = <50000>; ++ enable-active-high; ++ gpio = <&gpio1 23 GPIO_ACTIVE_HIGH>; ++ }; ++ + /* wg7210 (wifi+bt module) 32k clock buffer */ + wg7210_32k: fixed-regulator-wg7210_32k { + compatible = "regulator-fixed"; +@@ -514,9 +525,30 @@ + /*wp-gpios = <&gpio4 31 GPIO_ACTIVE_HIGH>;*/ /* GPIO_127 */ + }; + +-/* mmc3 is probed using pdata-quirks to pass wl1251 card data */ + &mmc3 { +- status = "disabled"; ++ vmmc-supply = <&wlan_en>; ++ ++ bus-width = <4>; ++ non-removable; ++ ti,non-removable; ++ cap-power-off-card; ++ ++ pinctrl-names = "default"; ++ pinctrl-0 = <&mmc3_pins>; ++ ++ #address-cells = <1>; ++ #size-cells = <0>; ++ ++ wlan: wifi@1 { ++ compatible = "ti,wl1251"; ++ ++ reg = <1>; ++ ++ interrupt-parent = <&gpio1>; ++ interrupts = <21 IRQ_TYPE_LEVEL_HIGH>; /* GPIO_21 */ ++ ++ ti,wl1251-has-eeprom; ++ }; + }; + + /* bluetooth*/ +diff --git a/arch/arm/boot/dts/omap3-tao3530.dtsi b/arch/arm/boot/dts/omap3-tao3530.dtsi +index 9a601d15247b..5b7bda74752b 100644 +--- a/arch/arm/boot/dts/omap3-tao3530.dtsi ++++ b/arch/arm/boot/dts/omap3-tao3530.dtsi +@@ -224,7 +224,7 @@ + pinctrl-0 = <&mmc1_pins>; + vmmc-supply = <&vmmc1>; + vqmmc-supply = <&vsim>; +- cd-gpios = <&twl_gpio 0 GPIO_ACTIVE_HIGH>; ++ cd-gpios = <&twl_gpio 0 GPIO_ACTIVE_LOW>; + bus-width = <8>; + }; + +diff --git a/arch/arm/boot/dts/pxa27x.dtsi b/arch/arm/boot/dts/pxa27x.dtsi +index 3228ad5fb725..ccbecad9c5c7 100644 +--- a/arch/arm/boot/dts/pxa27x.dtsi ++++ b/arch/arm/boot/dts/pxa27x.dtsi +@@ -35,7 +35,7 @@ + clocks = <&clks CLK_NONE>; + }; + +- pxa27x_ohci: usb@4c000000 { ++ usb0: usb@4c000000 { + compatible = "marvell,pxa-ohci"; + reg = <0x4c000000 0x10000>; + interrupts = <3>; +diff --git a/arch/arm/boot/dts/pxa2xx.dtsi b/arch/arm/boot/dts/pxa2xx.dtsi +index e4ebcde17837..a03bca81ae8a 100644 +--- a/arch/arm/boot/dts/pxa2xx.dtsi ++++ b/arch/arm/boot/dts/pxa2xx.dtsi +@@ -117,13 +117,6 @@ + status = "disabled"; + }; + +- usb0: ohci@4c000000 { +- compatible = "marvell,pxa-ohci"; +- reg = <0x4c000000 0x10000>; +- interrupts = <3>; +- status = "disabled"; +- }; +- + mmc0: mmc@41100000 { + compatible = "marvell,pxa-mmc"; + reg = <0x41100000 0x1000>; +diff --git a/arch/arm/boot/dts/pxa3xx.dtsi b/arch/arm/boot/dts/pxa3xx.dtsi +index 55c75b67351c..affa5b6f6da1 100644 +--- a/arch/arm/boot/dts/pxa3xx.dtsi ++++ b/arch/arm/boot/dts/pxa3xx.dtsi +@@ -189,7 +189,7 @@ + status = "disabled"; + }; + +- pxa3xx_ohci: usb@4c000000 { ++ usb0: usb@4c000000 { + compatible = "marvell,pxa-ohci"; + reg = <0x4c000000 0x10000>; + interrupts = <3>; +diff --git a/arch/arm/boot/dts/rk3288-rock2-som.dtsi b/arch/arm/boot/dts/rk3288-rock2-som.dtsi +index b9c471fcbd42..862c2248fcb6 100644 +--- a/arch/arm/boot/dts/rk3288-rock2-som.dtsi ++++ b/arch/arm/boot/dts/rk3288-rock2-som.dtsi +@@ -63,7 +63,7 @@ + + vcc_flash: flash-regulator { + compatible = "regulator-fixed"; +- regulator-name = "vcc_sys"; ++ regulator-name = "vcc_flash"; + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <1800000>; + startup-delay-us = <150>; +diff --git a/arch/arm/boot/dts/rv1108.dtsi b/arch/arm/boot/dts/rv1108.dtsi +index e7cd1315db1b..aa4119eaea98 100644 +--- a/arch/arm/boot/dts/rv1108.dtsi ++++ b/arch/arm/boot/dts/rv1108.dtsi +@@ -101,7 +101,7 @@ + + arm-pmu { + compatible = "arm,cortex-a7-pmu"; +- interrupts = ; ++ interrupts = ; + }; + + timer { +@@ -522,7 +522,7 @@ + compatible = "rockchip,gpio-bank"; + reg = <0x20030000 0x100>; + interrupts = ; +- clocks = <&xin24m>; ++ clocks = <&cru PCLK_GPIO0_PMU>; + + gpio-controller; + #gpio-cells = <2>; +@@ -535,7 +535,7 @@ + compatible = "rockchip,gpio-bank"; + reg = <0x10310000 0x100>; + interrupts = ; +- clocks = <&xin24m>; ++ clocks = <&cru PCLK_GPIO1>; + + gpio-controller; + #gpio-cells = <2>; +@@ -548,7 +548,7 @@ + compatible = "rockchip,gpio-bank"; + reg = <0x10320000 0x100>; + interrupts = ; +- clocks = <&xin24m>; ++ clocks = <&cru PCLK_GPIO2>; + + gpio-controller; + #gpio-cells = <2>; +@@ -561,7 +561,7 @@ + compatible = "rockchip,gpio-bank"; + reg = <0x10330000 0x100>; + interrupts = ; +- clocks = <&xin24m>; ++ clocks = <&cru PCLK_GPIO3>; + + gpio-controller; + #gpio-cells = <2>; +diff --git a/arch/arm/boot/dts/sun5i-a10s.dtsi b/arch/arm/boot/dts/sun5i-a10s.dtsi +index 18f25c5e75ae..396fb6632bf0 100644 +--- a/arch/arm/boot/dts/sun5i-a10s.dtsi ++++ b/arch/arm/boot/dts/sun5i-a10s.dtsi +@@ -104,8 +104,6 @@ + }; + + hdmi_out: port@1 { +- #address-cells = <1>; +- #size-cells = <0>; + reg = <1>; + }; + }; +diff --git a/arch/arm/boot/dts/sun6i-a31.dtsi b/arch/arm/boot/dts/sun6i-a31.dtsi +index eef072a21acc..0bb82d0442a5 100644 +--- a/arch/arm/boot/dts/sun6i-a31.dtsi ++++ b/arch/arm/boot/dts/sun6i-a31.dtsi +@@ -173,7 +173,7 @@ + }; + + pmu { +- compatible = "arm,cortex-a7-pmu", "arm,cortex-a15-pmu"; ++ compatible = "arm,cortex-a7-pmu"; + interrupts = , + , + , +diff --git a/arch/arm/boot/dts/sun7i-a20.dtsi b/arch/arm/boot/dts/sun7i-a20.dtsi +index 96bee776e145..77f04dbdf996 100644 +--- a/arch/arm/boot/dts/sun7i-a20.dtsi ++++ b/arch/arm/boot/dts/sun7i-a20.dtsi +@@ -171,7 +171,7 @@ + }; + + pmu { +- compatible = "arm,cortex-a7-pmu", "arm,cortex-a15-pmu"; ++ compatible = "arm,cortex-a7-pmu"; + interrupts = , + ; + }; +diff --git a/arch/arm/boot/dts/sun8i-v3s-licheepi-zero.dts b/arch/arm/boot/dts/sun8i-v3s-licheepi-zero.dts +index 387fc2aa546d..333df90e8037 100644 +--- a/arch/arm/boot/dts/sun8i-v3s-licheepi-zero.dts ++++ b/arch/arm/boot/dts/sun8i-v3s-licheepi-zero.dts +@@ -78,7 +78,7 @@ + }; + + &mmc0 { +- pinctrl-0 = <&mmc0_pins_a>; ++ pinctrl-0 = <&mmc0_pins>; + pinctrl-names = "default"; + broken-cd; + bus-width = <4>; +@@ -87,7 +87,7 @@ + }; + + &uart0 { +- pinctrl-0 = <&uart0_pins_a>; ++ pinctrl-0 = <&uart0_pb_pins>; + pinctrl-names = "default"; + status = "okay"; + }; +diff --git a/arch/arm/boot/dts/sun8i-v3s.dtsi b/arch/arm/boot/dts/sun8i-v3s.dtsi +index 3a06dc5b3746..da5823c6fa3e 100644 +--- a/arch/arm/boot/dts/sun8i-v3s.dtsi ++++ b/arch/arm/boot/dts/sun8i-v3s.dtsi +@@ -292,17 +292,17 @@ + interrupt-controller; + #interrupt-cells = <3>; + +- i2c0_pins: i2c0 { ++ i2c0_pins: i2c0-pins { + pins = "PB6", "PB7"; + function = "i2c0"; + }; + +- uart0_pins_a: uart0@0 { ++ uart0_pb_pins: uart0-pb-pins { + pins = "PB8", "PB9"; + function = "uart0"; + }; + +- mmc0_pins_a: mmc0@0 { ++ mmc0_pins: mmc0-pins { + pins = "PF0", "PF1", "PF2", "PF3", + "PF4", "PF5"; + function = "mmc0"; +@@ -310,7 +310,7 @@ + bias-pull-up; + }; + +- mmc1_pins: mmc1 { ++ mmc1_pins: mmc1-pins { + pins = "PG0", "PG1", "PG2", "PG3", + "PG4", "PG5"; + function = "mmc1"; +@@ -318,7 +318,7 @@ + bias-pull-up; + }; + +- spi0_pins: spi0 { ++ spi0_pins: spi0-pins { + pins = "PC0", "PC1", "PC2", "PC3"; + function = "spi0"; + }; +diff --git a/arch/arm/include/asm/uaccess.h b/arch/arm/include/asm/uaccess.h +index a5807b67ca8a..fe47d24955ea 100644 +--- a/arch/arm/include/asm/uaccess.h ++++ b/arch/arm/include/asm/uaccess.h +@@ -349,6 +349,13 @@ do { \ + #define __get_user_asm_byte(x, addr, err) \ + __get_user_asm(x, addr, err, ldrb) + ++#if __LINUX_ARM_ARCH__ >= 6 ++ ++#define __get_user_asm_half(x, addr, err) \ ++ __get_user_asm(x, addr, err, ldrh) ++ ++#else ++ + #ifndef __ARMEB__ + #define __get_user_asm_half(x, __gu_addr, err) \ + ({ \ +@@ -367,6 +374,8 @@ do { \ + }) + #endif + ++#endif /* __LINUX_ARM_ARCH__ >= 6 */ ++ + #define __get_user_asm_word(x, addr, err) \ + __get_user_asm(x, addr, err, ldr) + #endif +@@ -442,6 +451,13 @@ do { \ + #define __put_user_asm_byte(x, __pu_addr, err) \ + __put_user_asm(x, __pu_addr, err, strb) + ++#if __LINUX_ARM_ARCH__ >= 6 ++ ++#define __put_user_asm_half(x, __pu_addr, err) \ ++ __put_user_asm(x, __pu_addr, err, strh) ++ ++#else ++ + #ifndef __ARMEB__ + #define __put_user_asm_half(x, __pu_addr, err) \ + ({ \ +@@ -458,6 +474,8 @@ do { \ + }) + #endif + ++#endif /* __LINUX_ARM_ARCH__ >= 6 */ ++ + #define __put_user_asm_word(x, __pu_addr, err) \ + __put_user_asm(x, __pu_addr, err, str) + +diff --git a/arch/arm/lib/getuser.S b/arch/arm/lib/getuser.S +index 746e7801dcdf..b2e4bc3a635e 100644 +--- a/arch/arm/lib/getuser.S ++++ b/arch/arm/lib/getuser.S +@@ -42,6 +42,12 @@ _ASM_NOKPROBE(__get_user_1) + + ENTRY(__get_user_2) + check_uaccess r0, 2, r1, r2, __get_user_bad ++#if __LINUX_ARM_ARCH__ >= 6 ++ ++2: TUSER(ldrh) r2, [r0] ++ ++#else ++ + #ifdef CONFIG_CPU_USE_DOMAINS + rb .req ip + 2: ldrbt r2, [r0], #1 +@@ -56,6 +62,9 @@ rb .req r0 + #else + orr r2, rb, r2, lsl #8 + #endif ++ ++#endif /* __LINUX_ARM_ARCH__ >= 6 */ ++ + mov r0, #0 + ret lr + ENDPROC(__get_user_2) +@@ -145,7 +154,9 @@ _ASM_NOKPROBE(__get_user_bad8) + .pushsection __ex_table, "a" + .long 1b, __get_user_bad + .long 2b, __get_user_bad ++#if __LINUX_ARM_ARCH__ < 6 + .long 3b, __get_user_bad ++#endif + .long 4b, __get_user_bad + .long 5b, __get_user_bad8 + .long 6b, __get_user_bad8 +diff --git a/arch/arm/lib/putuser.S b/arch/arm/lib/putuser.S +index 38d660d3705f..515eeaa9975c 100644 +--- a/arch/arm/lib/putuser.S ++++ b/arch/arm/lib/putuser.S +@@ -41,16 +41,13 @@ ENDPROC(__put_user_1) + + ENTRY(__put_user_2) + check_uaccess r0, 2, r1, ip, __put_user_bad +- mov ip, r2, lsr #8 +-#ifdef CONFIG_THUMB2_KERNEL +-#ifndef __ARMEB__ +-2: TUSER(strb) r2, [r0] +-3: TUSER(strb) ip, [r0, #1] ++#if __LINUX_ARM_ARCH__ >= 6 ++ ++2: TUSER(strh) r2, [r0] ++ + #else +-2: TUSER(strb) ip, [r0] +-3: TUSER(strb) r2, [r0, #1] +-#endif +-#else /* !CONFIG_THUMB2_KERNEL */ ++ ++ mov ip, r2, lsr #8 + #ifndef __ARMEB__ + 2: TUSER(strb) r2, [r0], #1 + 3: TUSER(strb) ip, [r0] +@@ -58,7 +55,8 @@ ENTRY(__put_user_2) + 2: TUSER(strb) ip, [r0], #1 + 3: TUSER(strb) r2, [r0] + #endif +-#endif /* CONFIG_THUMB2_KERNEL */ ++ ++#endif /* __LINUX_ARM_ARCH__ >= 6 */ + mov r0, #0 + ret lr + ENDPROC(__put_user_2) +@@ -91,7 +89,9 @@ ENDPROC(__put_user_bad) + .pushsection __ex_table, "a" + .long 1b, __put_user_bad + .long 2b, __put_user_bad ++#if __LINUX_ARM_ARCH__ < 6 + .long 3b, __put_user_bad ++#endif + .long 4b, __put_user_bad + .long 5b, __put_user_bad + .long 6b, __put_user_bad +diff --git a/arch/arm/mach-omap1/id.c b/arch/arm/mach-omap1/id.c +index 52de382fc804..7e49dfda3d2f 100644 +--- a/arch/arm/mach-omap1/id.c ++++ b/arch/arm/mach-omap1/id.c +@@ -200,10 +200,10 @@ void __init omap_check_revision(void) + printk(KERN_INFO "Unknown OMAP cpu type: 0x%02x\n", cpu_type); + } + +- printk(KERN_INFO "OMAP%04x", omap_revision >> 16); ++ pr_info("OMAP%04x", omap_revision >> 16); + if ((omap_revision >> 8) & 0xff) +- printk(KERN_INFO "%x", (omap_revision >> 8) & 0xff); +- printk(KERN_INFO " revision %i handled as %02xxx id: %08x%08x\n", ++ pr_cont("%x", (omap_revision >> 8) & 0xff); ++ pr_cont(" revision %i handled as %02xxx id: %08x%08x\n", + die_rev, omap_revision & 0xff, system_serial_low, + system_serial_high); + } +diff --git a/arch/arm/mach-omap2/id.c b/arch/arm/mach-omap2/id.c +index 16cb1c195fd8..79d71b1eae59 100644 +--- a/arch/arm/mach-omap2/id.c ++++ b/arch/arm/mach-omap2/id.c +@@ -199,8 +199,8 @@ void __init omap2xxx_check_revision(void) + + pr_info("%s", soc_name); + if ((omap_rev() >> 8) & 0x0f) +- pr_info("%s", soc_rev); +- pr_info("\n"); ++ pr_cont("%s", soc_rev); ++ pr_cont("\n"); + } + + #define OMAP3_SHOW_FEATURE(feat) \ +diff --git a/arch/arm/mach-omap2/pdata-quirks.c b/arch/arm/mach-omap2/pdata-quirks.c +index 6b433fce65a5..2477f6086de4 100644 +--- a/arch/arm/mach-omap2/pdata-quirks.c ++++ b/arch/arm/mach-omap2/pdata-quirks.c +@@ -307,108 +307,15 @@ static void __init omap3_logicpd_torpedo_init(void) + } + + /* omap3pandora legacy devices */ +-#define PANDORA_WIFI_IRQ_GPIO 21 +-#define PANDORA_WIFI_NRESET_GPIO 23 + + static struct platform_device pandora_backlight = { + .name = "pandora-backlight", + .id = -1, + }; + +-static struct regulator_consumer_supply pandora_vmmc3_supply[] = { +- REGULATOR_SUPPLY("vmmc", "omap_hsmmc.2"), +-}; +- +-static struct regulator_init_data pandora_vmmc3 = { +- .constraints = { +- .valid_ops_mask = REGULATOR_CHANGE_STATUS, +- }, +- .num_consumer_supplies = ARRAY_SIZE(pandora_vmmc3_supply), +- .consumer_supplies = pandora_vmmc3_supply, +-}; +- +-static struct fixed_voltage_config pandora_vwlan = { +- .supply_name = "vwlan", +- .microvolts = 1800000, /* 1.8V */ +- .gpio = PANDORA_WIFI_NRESET_GPIO, +- .startup_delay = 50000, /* 50ms */ +- .enable_high = 1, +- .init_data = &pandora_vmmc3, +-}; +- +-static struct platform_device pandora_vwlan_device = { +- .name = "reg-fixed-voltage", +- .id = 1, +- .dev = { +- .platform_data = &pandora_vwlan, +- }, +-}; +- +-static void pandora_wl1251_init_card(struct mmc_card *card) +-{ +- /* +- * We have TI wl1251 attached to MMC3. Pass this information to +- * SDIO core because it can't be probed by normal methods. +- */ +- if (card->type == MMC_TYPE_SDIO || card->type == MMC_TYPE_SD_COMBO) { +- card->quirks |= MMC_QUIRK_NONSTD_SDIO; +- card->cccr.wide_bus = 1; +- card->cis.vendor = 0x104c; +- card->cis.device = 0x9066; +- card->cis.blksize = 512; +- card->cis.max_dtr = 24000000; +- card->ocr = 0x80; +- } +-} +- +-static struct omap2_hsmmc_info pandora_mmc3[] = { +- { +- .mmc = 3, +- .caps = MMC_CAP_4_BIT_DATA | MMC_CAP_POWER_OFF_CARD, +- .gpio_cd = -EINVAL, +- .gpio_wp = -EINVAL, +- .init_card = pandora_wl1251_init_card, +- }, +- {} /* Terminator */ +-}; +- +-static void __init pandora_wl1251_init(void) +-{ +- struct wl1251_platform_data pandora_wl1251_pdata; +- int ret; +- +- memset(&pandora_wl1251_pdata, 0, sizeof(pandora_wl1251_pdata)); +- +- pandora_wl1251_pdata.power_gpio = -1; +- +- ret = gpio_request_one(PANDORA_WIFI_IRQ_GPIO, GPIOF_IN, "wl1251 irq"); +- if (ret < 0) +- goto fail; +- +- pandora_wl1251_pdata.irq = gpio_to_irq(PANDORA_WIFI_IRQ_GPIO); +- if (pandora_wl1251_pdata.irq < 0) +- goto fail_irq; +- +- pandora_wl1251_pdata.use_eeprom = true; +- ret = wl1251_set_platform_data(&pandora_wl1251_pdata); +- if (ret < 0) +- goto fail_irq; +- +- return; +- +-fail_irq: +- gpio_free(PANDORA_WIFI_IRQ_GPIO); +-fail: +- pr_err("wl1251 board initialisation failed\n"); +-} +- + static void __init omap3_pandora_legacy_init(void) + { + platform_device_register(&pandora_backlight); +- platform_device_register(&pandora_vwlan_device); +- omap_hsmmc_init(pandora_mmc3); +- omap_hsmmc_late_init(pandora_mmc3); +- pandora_wl1251_init(); + } + #endif /* CONFIG_ARCH_OMAP3 */ + +diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts b/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts +index 4b17a76959b2..c83c028e95af 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts ++++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts +@@ -178,7 +178,7 @@ + pinctrl-names = "default"; + }; + +-&pinctrl_aobus { ++&gpio_ao { + gpio-line-names = "UART TX", "UART RX", "Power Control", "Power Key In", + "VCCK En", "CON1 Header Pin31", + "I2S Header Pin6", "IR In", "I2S Header Pin7", +@@ -186,7 +186,7 @@ + "I2S Header Pin5", "HDMI CEC", "SYS LED"; + }; + +-&pinctrl_periphs { ++&gpio { + gpio-line-names = /* Bank GPIOZ */ + "Eth MDIO", "Eth MDC", "Eth RGMII RX Clk", + "Eth RX DV", "Eth RX D0", "Eth RX D1", "Eth RX D2", +diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts b/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts +index c3c65b06ba76..4ea23df81f21 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts ++++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts +@@ -189,7 +189,7 @@ + pinctrl-names = "default"; + }; + +-&pinctrl_aobus { ++&gpio_ao { + gpio-line-names = "UART TX", "UART RX", "VCCK En", "TF 3V3/1V8 En", + "USB HUB nRESET", "USB OTG Power En", + "J7 Header Pin2", "IR In", "J7 Header Pin4", +@@ -197,7 +197,7 @@ + "HDMI CEC", "SYS LED"; + }; + +-&pinctrl_periphs { ++&gpio { + gpio-line-names = /* Bank GPIOZ */ + "Eth MDIO", "Eth MDC", "Eth RGMII RX Clk", + "Eth RX DV", "Eth RX D0", "Eth RX D1", "Eth RX D2", +diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts +index edc512ad0bac..fb5db5f33e8c 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts ++++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts +@@ -112,7 +112,7 @@ + linux,rc-map-name = "rc-geekbox"; + }; + +-&pinctrl_aobus { ++&gpio_ao { + gpio-line-names = "UART TX", + "UART RX", + "Power Key In", +@@ -125,7 +125,7 @@ + "SYS LED"; + }; + +-&pinctrl_periphs { ++&gpio { + gpio-line-names = /* Bank GPIOZ */ + "", "", "", "", "", "", "", + "", "", "", "", "", "", "", +diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts +index 0814b6b29b86..e2c71753e327 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts ++++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts +@@ -139,7 +139,7 @@ + }; + }; + +-&pinctrl_aobus { ++&gpio_ao { + gpio-line-names = "UART TX", + "UART RX", + "Blue LED", +@@ -152,7 +152,7 @@ + "7J1 Header Pin13"; + }; + +-&pinctrl_periphs { ++&gpio { + gpio-line-names = /* Bank GPIOZ */ + "", "", "", "", "", "", "", + "", "", "", "", "", "", "", +diff --git a/arch/arm64/boot/dts/nvidia/tegra210-p2597.dtsi b/arch/arm64/boot/dts/nvidia/tegra210-p2597.dtsi +index d67ef4319f3b..97f31bc4fa1e 100644 +--- a/arch/arm64/boot/dts/nvidia/tegra210-p2597.dtsi ++++ b/arch/arm64/boot/dts/nvidia/tegra210-p2597.dtsi +@@ -1584,7 +1584,7 @@ + regulator-name = "VDD_HDMI_5V0"; + regulator-min-microvolt = <5000000>; + regulator-max-microvolt = <5000000>; +- gpio = <&exp1 12 GPIO_ACTIVE_LOW>; ++ gpio = <&exp1 12 GPIO_ACTIVE_HIGH>; + enable-active-high; + vin-supply = <&vdd_5v0_sys>; + }; +diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig +index ae4450e891ab..7e267d657c56 100644 +--- a/arch/mips/Kconfig ++++ b/arch/mips/Kconfig +@@ -812,6 +812,7 @@ config SIBYTE_LITTLESUR + select SYS_SUPPORTS_BIG_ENDIAN + select SYS_SUPPORTS_HIGHMEM + select SYS_SUPPORTS_LITTLE_ENDIAN ++ select ZONE_DMA32 if 64BIT + + config SIBYTE_SENTOSA + bool "Sibyte BCM91250E-Sentosa" +diff --git a/arch/mips/cavium-octeon/executive/cvmx-cmd-queue.c b/arch/mips/cavium-octeon/executive/cvmx-cmd-queue.c +index 8241fc6aa17d..3839feba68f2 100644 +--- a/arch/mips/cavium-octeon/executive/cvmx-cmd-queue.c ++++ b/arch/mips/cavium-octeon/executive/cvmx-cmd-queue.c +@@ -266,7 +266,7 @@ int cvmx_cmd_queue_length(cvmx_cmd_queue_id_t queue_id) + } else { + union cvmx_pko_mem_debug8 debug8; + debug8.u64 = cvmx_read_csr(CVMX_PKO_MEM_DEBUG8); +- return debug8.cn58xx.doorbell; ++ return debug8.cn50xx.doorbell; + } + case CVMX_CMD_QUEUE_ZIP: + case CVMX_CMD_QUEUE_DFA: +diff --git a/arch/mips/cavium-octeon/octeon-platform.c b/arch/mips/cavium-octeon/octeon-platform.c +index 1d92efb82c37..e1e24118c169 100644 +--- a/arch/mips/cavium-octeon/octeon-platform.c ++++ b/arch/mips/cavium-octeon/octeon-platform.c +@@ -501,7 +501,7 @@ static void __init octeon_fdt_set_phy(int eth, int phy_addr) + if (phy_addr >= 256 && alt_phy > 0) { + const struct fdt_property *phy_prop; + struct fdt_property *alt_prop; +- u32 phy_handle_name; ++ fdt32_t phy_handle_name; + + /* Use the alt phy node instead.*/ + phy_prop = fdt_get_property(initial_boot_params, eth, "phy-handle", NULL); +diff --git a/arch/mips/include/asm/octeon/cvmx-pko.h b/arch/mips/include/asm/octeon/cvmx-pko.h +index 5f47f76ed510..20eb9c46a75a 100644 +--- a/arch/mips/include/asm/octeon/cvmx-pko.h ++++ b/arch/mips/include/asm/octeon/cvmx-pko.h +@@ -611,7 +611,7 @@ static inline void cvmx_pko_get_port_status(uint64_t port_num, uint64_t clear, + pko_reg_read_idx.s.index = cvmx_pko_get_base_queue(port_num); + cvmx_write_csr(CVMX_PKO_REG_READ_IDX, pko_reg_read_idx.u64); + debug8.u64 = cvmx_read_csr(CVMX_PKO_MEM_DEBUG8); +- status->doorbell = debug8.cn58xx.doorbell; ++ status->doorbell = debug8.cn50xx.doorbell; + } + } + +diff --git a/arch/powerpc/include/asm/sfp-machine.h b/arch/powerpc/include/asm/sfp-machine.h +index d89beaba26ff..8b957aabb826 100644 +--- a/arch/powerpc/include/asm/sfp-machine.h ++++ b/arch/powerpc/include/asm/sfp-machine.h +@@ -213,30 +213,18 @@ + * respectively. The result is placed in HIGH_SUM and LOW_SUM. Overflow + * (i.e. carry out) is not stored anywhere, and is lost. + */ +-#define add_ssaaaa(sh, sl, ah, al, bh, bl) \ ++#define add_ssaaaa(sh, sl, ah, al, bh, bl) \ + do { \ + if (__builtin_constant_p (bh) && (bh) == 0) \ +- __asm__ ("{a%I4|add%I4c} %1,%3,%4\n\t{aze|addze} %0,%2" \ +- : "=r" ((USItype)(sh)), \ +- "=&r" ((USItype)(sl)) \ +- : "%r" ((USItype)(ah)), \ +- "%r" ((USItype)(al)), \ +- "rI" ((USItype)(bl))); \ +- else if (__builtin_constant_p (bh) && (bh) ==~(USItype) 0) \ +- __asm__ ("{a%I4|add%I4c} %1,%3,%4\n\t{ame|addme} %0,%2" \ +- : "=r" ((USItype)(sh)), \ +- "=&r" ((USItype)(sl)) \ +- : "%r" ((USItype)(ah)), \ +- "%r" ((USItype)(al)), \ +- "rI" ((USItype)(bl))); \ ++ __asm__ ("add%I4c %1,%3,%4\n\taddze %0,%2" \ ++ : "=r" (sh), "=&r" (sl) : "r" (ah), "%r" (al), "rI" (bl));\ ++ else if (__builtin_constant_p (bh) && (bh) == ~(USItype) 0) \ ++ __asm__ ("add%I4c %1,%3,%4\n\taddme %0,%2" \ ++ : "=r" (sh), "=&r" (sl) : "r" (ah), "%r" (al), "rI" (bl));\ + else \ +- __asm__ ("{a%I5|add%I5c} %1,%4,%5\n\t{ae|adde} %0,%2,%3" \ +- : "=r" ((USItype)(sh)), \ +- "=&r" ((USItype)(sl)) \ +- : "%r" ((USItype)(ah)), \ +- "r" ((USItype)(bh)), \ +- "%r" ((USItype)(al)), \ +- "rI" ((USItype)(bl))); \ ++ __asm__ ("add%I5c %1,%4,%5\n\tadde %0,%2,%3" \ ++ : "=r" (sh), "=&r" (sl) \ ++ : "%r" (ah), "r" (bh), "%r" (al), "rI" (bl)); \ + } while (0) + + /* sub_ddmmss is used in op-2.h and udivmodti4.c and should be equivalent to +@@ -248,44 +236,24 @@ + * and LOW_DIFFERENCE. Overflow (i.e. carry out) is not stored anywhere, + * and is lost. + */ +-#define sub_ddmmss(sh, sl, ah, al, bh, bl) \ ++#define sub_ddmmss(sh, sl, ah, al, bh, bl) \ + do { \ + if (__builtin_constant_p (ah) && (ah) == 0) \ +- __asm__ ("{sf%I3|subf%I3c} %1,%4,%3\n\t{sfze|subfze} %0,%2" \ +- : "=r" ((USItype)(sh)), \ +- "=&r" ((USItype)(sl)) \ +- : "r" ((USItype)(bh)), \ +- "rI" ((USItype)(al)), \ +- "r" ((USItype)(bl))); \ +- else if (__builtin_constant_p (ah) && (ah) ==~(USItype) 0) \ +- __asm__ ("{sf%I3|subf%I3c} %1,%4,%3\n\t{sfme|subfme} %0,%2" \ +- : "=r" ((USItype)(sh)), \ +- "=&r" ((USItype)(sl)) \ +- : "r" ((USItype)(bh)), \ +- "rI" ((USItype)(al)), \ +- "r" ((USItype)(bl))); \ ++ __asm__ ("subf%I3c %1,%4,%3\n\tsubfze %0,%2" \ ++ : "=r" (sh), "=&r" (sl) : "r" (bh), "rI" (al), "r" (bl));\ ++ else if (__builtin_constant_p (ah) && (ah) == ~(USItype) 0) \ ++ __asm__ ("subf%I3c %1,%4,%3\n\tsubfme %0,%2" \ ++ : "=r" (sh), "=&r" (sl) : "r" (bh), "rI" (al), "r" (bl));\ + else if (__builtin_constant_p (bh) && (bh) == 0) \ +- __asm__ ("{sf%I3|subf%I3c} %1,%4,%3\n\t{ame|addme} %0,%2" \ +- : "=r" ((USItype)(sh)), \ +- "=&r" ((USItype)(sl)) \ +- : "r" ((USItype)(ah)), \ +- "rI" ((USItype)(al)), \ +- "r" ((USItype)(bl))); \ +- else if (__builtin_constant_p (bh) && (bh) ==~(USItype) 0) \ +- __asm__ ("{sf%I3|subf%I3c} %1,%4,%3\n\t{aze|addze} %0,%2" \ +- : "=r" ((USItype)(sh)), \ +- "=&r" ((USItype)(sl)) \ +- : "r" ((USItype)(ah)), \ +- "rI" ((USItype)(al)), \ +- "r" ((USItype)(bl))); \ ++ __asm__ ("subf%I3c %1,%4,%3\n\taddme %0,%2" \ ++ : "=r" (sh), "=&r" (sl) : "r" (ah), "rI" (al), "r" (bl));\ ++ else if (__builtin_constant_p (bh) && (bh) == ~(USItype) 0) \ ++ __asm__ ("subf%I3c %1,%4,%3\n\taddze %0,%2" \ ++ : "=r" (sh), "=&r" (sl) : "r" (ah), "rI" (al), "r" (bl));\ + else \ +- __asm__ ("{sf%I4|subf%I4c} %1,%5,%4\n\t{sfe|subfe} %0,%3,%2" \ +- : "=r" ((USItype)(sh)), \ +- "=&r" ((USItype)(sl)) \ +- : "r" ((USItype)(ah)), \ +- "r" ((USItype)(bh)), \ +- "rI" ((USItype)(al)), \ +- "r" ((USItype)(bl))); \ ++ __asm__ ("subf%I4c %1,%5,%4\n\tsubfe %0,%3,%2" \ ++ : "=r" (sh), "=&r" (sl) \ ++ : "r" (ah), "r" (bh), "rI" (al), "r" (bl)); \ + } while (0) + + /* asm fragments for mul and div */ +@@ -294,13 +262,10 @@ + * UWtype integers MULTIPLER and MULTIPLICAND, and generates a two UWtype + * word product in HIGH_PROD and LOW_PROD. + */ +-#define umul_ppmm(ph, pl, m0, m1) \ ++#define umul_ppmm(ph, pl, m0, m1) \ + do { \ + USItype __m0 = (m0), __m1 = (m1); \ +- __asm__ ("mulhwu %0,%1,%2" \ +- : "=r" ((USItype)(ph)) \ +- : "%r" (__m0), \ +- "r" (__m1)); \ ++ __asm__ ("mulhwu %0,%1,%2" : "=r" (ph) : "%r" (m0), "r" (m1)); \ + (pl) = __m0 * __m1; \ + } while (0) + +@@ -312,9 +277,10 @@ + * significant bit of DENOMINATOR must be 1, then the pre-processor symbol + * UDIV_NEEDS_NORMALIZATION is defined to 1. + */ +-#define udiv_qrnnd(q, r, n1, n0, d) \ ++#define udiv_qrnnd(q, r, n1, n0, d) \ + do { \ +- UWtype __d1, __d0, __q1, __q0, __r1, __r0, __m; \ ++ UWtype __d1, __d0, __q1, __q0; \ ++ UWtype __r1, __r0, __m; \ + __d1 = __ll_highpart (d); \ + __d0 = __ll_lowpart (d); \ + \ +@@ -325,7 +291,7 @@ + if (__r1 < __m) \ + { \ + __q1--, __r1 += (d); \ +- if (__r1 >= (d)) /* we didn't get carry when adding to __r1 */ \ ++ if (__r1 >= (d)) /* i.e. we didn't get carry when adding to __r1 */\ + if (__r1 < __m) \ + __q1--, __r1 += (d); \ + } \ +diff --git a/arch/powerpc/include/asm/vdso_datapage.h b/arch/powerpc/include/asm/vdso_datapage.h +index 1afe90ade595..674c03350cd1 100644 +--- a/arch/powerpc/include/asm/vdso_datapage.h ++++ b/arch/powerpc/include/asm/vdso_datapage.h +@@ -86,6 +86,7 @@ struct vdso_data { + __s32 wtom_clock_nsec; + struct timespec stamp_xtime; /* xtime as at tb_orig_stamp */ + __u32 stamp_sec_fraction; /* fractional seconds of stamp_xtime */ ++ __u32 hrtimer_res; /* hrtimer resolution */ + __u32 syscall_map_64[SYSCALL_MAP_SIZE]; /* map of syscalls */ + __u32 syscall_map_32[SYSCALL_MAP_SIZE]; /* map of syscalls */ + }; +@@ -107,6 +108,7 @@ struct vdso_data { + __s32 wtom_clock_nsec; + struct timespec stamp_xtime; /* xtime as at tb_orig_stamp */ + __u32 stamp_sec_fraction; /* fractional seconds of stamp_xtime */ ++ __u32 hrtimer_res; /* hrtimer resolution */ + __u32 syscall_map_32[SYSCALL_MAP_SIZE]; /* map of syscalls */ + __u32 dcache_block_size; /* L1 d-cache block size */ + __u32 icache_block_size; /* L1 i-cache block size */ +diff --git a/arch/powerpc/kernel/Makefile b/arch/powerpc/kernel/Makefile +index 142b08d40642..5607ce67d178 100644 +--- a/arch/powerpc/kernel/Makefile ++++ b/arch/powerpc/kernel/Makefile +@@ -5,8 +5,8 @@ + + CFLAGS_ptrace.o += -DUTS_MACHINE='"$(UTS_MACHINE)"' + +-# Disable clang warning for using setjmp without setjmp.h header +-CFLAGS_crash.o += $(call cc-disable-warning, builtin-requires-header) ++# Avoid clang warnings around longjmp/setjmp declarations ++CFLAGS_crash.o += -ffreestanding + + subdir-ccflags-$(CONFIG_PPC_WERROR) := -Werror + +diff --git a/arch/powerpc/kernel/asm-offsets.c b/arch/powerpc/kernel/asm-offsets.c +index 2e5ea300258a..1bc761e537a9 100644 +--- a/arch/powerpc/kernel/asm-offsets.c ++++ b/arch/powerpc/kernel/asm-offsets.c +@@ -373,6 +373,7 @@ int main(void) + OFFSET(WTOM_CLOCK_NSEC, vdso_data, wtom_clock_nsec); + OFFSET(STAMP_XTIME, vdso_data, stamp_xtime); + OFFSET(STAMP_SEC_FRAC, vdso_data, stamp_sec_fraction); ++ OFFSET(CLOCK_HRTIMER_RES, vdso_data, hrtimer_res); + OFFSET(CFG_ICACHE_BLOCKSZ, vdso_data, icache_block_size); + OFFSET(CFG_DCACHE_BLOCKSZ, vdso_data, dcache_block_size); + OFFSET(CFG_ICACHE_LOGBLOCKSZ, vdso_data, icache_log_block_size); +@@ -401,7 +402,6 @@ int main(void) + DEFINE(CLOCK_REALTIME, CLOCK_REALTIME); + DEFINE(CLOCK_MONOTONIC, CLOCK_MONOTONIC); + DEFINE(NSEC_PER_SEC, NSEC_PER_SEC); +- DEFINE(CLOCK_REALTIME_RES, MONOTONIC_RES_NSEC); + + #ifdef CONFIG_BUG + DEFINE(BUG_ENTRY_SIZE, sizeof(struct bug_entry)); +diff --git a/arch/powerpc/kernel/misc_64.S b/arch/powerpc/kernel/misc_64.S +index 09af857ca099..afe086f48e7c 100644 +--- a/arch/powerpc/kernel/misc_64.S ++++ b/arch/powerpc/kernel/misc_64.S +@@ -86,7 +86,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_COHERENT_ICACHE) + subf r8,r6,r4 /* compute length */ + add r8,r8,r5 /* ensure we get enough */ + lwz r9,DCACHEL1LOGBLOCKSIZE(r10) /* Get log-2 of cache block size */ +- srw. r8,r8,r9 /* compute line count */ ++ srd. r8,r8,r9 /* compute line count */ + beqlr /* nothing to do? */ + mtctr r8 + 1: dcbst 0,r6 +@@ -102,7 +102,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_COHERENT_ICACHE) + subf r8,r6,r4 /* compute length */ + add r8,r8,r5 + lwz r9,ICACHEL1LOGBLOCKSIZE(r10) /* Get log-2 of Icache block size */ +- srw. r8,r8,r9 /* compute line count */ ++ srd. r8,r8,r9 /* compute line count */ + beqlr /* nothing to do? */ + mtctr r8 + 2: icbi 0,r6 +diff --git a/arch/powerpc/kernel/time.c b/arch/powerpc/kernel/time.c +index 7c7c5a16284d..14f3f28a089e 100644 +--- a/arch/powerpc/kernel/time.c ++++ b/arch/powerpc/kernel/time.c +@@ -920,6 +920,7 @@ void update_vsyscall(struct timekeeper *tk) + vdso_data->wtom_clock_nsec = tk->wall_to_monotonic.tv_nsec; + vdso_data->stamp_xtime = xt; + vdso_data->stamp_sec_fraction = frac_sec; ++ vdso_data->hrtimer_res = hrtimer_resolution; + smp_wmb(); + ++(vdso_data->tb_update_count); + } +diff --git a/arch/powerpc/kernel/vdso32/gettimeofday.S b/arch/powerpc/kernel/vdso32/gettimeofday.S +index 1e0bc5955a40..03a65fee8020 100644 +--- a/arch/powerpc/kernel/vdso32/gettimeofday.S ++++ b/arch/powerpc/kernel/vdso32/gettimeofday.S +@@ -160,12 +160,15 @@ V_FUNCTION_BEGIN(__kernel_clock_getres) + cror cr0*4+eq,cr0*4+eq,cr1*4+eq + bne cr0,99f + ++ mflr r12 ++ .cfi_register lr,r12 ++ bl __get_datapage@local /* get data page */ ++ lwz r5, CLOCK_HRTIMER_RES(r3) ++ mtlr r12 + li r3,0 + cmpli cr0,r4,0 + crclr cr0*4+so + beqlr +- lis r5,CLOCK_REALTIME_RES@h +- ori r5,r5,CLOCK_REALTIME_RES@l + stw r3,TSPC32_TV_SEC(r4) + stw r5,TSPC32_TV_NSEC(r4) + blr +diff --git a/arch/powerpc/kernel/vdso64/cacheflush.S b/arch/powerpc/kernel/vdso64/cacheflush.S +index 69c5af2b3c96..228a4a2383d6 100644 +--- a/arch/powerpc/kernel/vdso64/cacheflush.S ++++ b/arch/powerpc/kernel/vdso64/cacheflush.S +@@ -39,7 +39,7 @@ V_FUNCTION_BEGIN(__kernel_sync_dicache) + subf r8,r6,r4 /* compute length */ + add r8,r8,r5 /* ensure we get enough */ + lwz r9,CFG_DCACHE_LOGBLOCKSZ(r10) +- srw. r8,r8,r9 /* compute line count */ ++ srd. r8,r8,r9 /* compute line count */ + crclr cr0*4+so + beqlr /* nothing to do? */ + mtctr r8 +@@ -56,7 +56,7 @@ V_FUNCTION_BEGIN(__kernel_sync_dicache) + subf r8,r6,r4 /* compute length */ + add r8,r8,r5 + lwz r9,CFG_ICACHE_LOGBLOCKSZ(r10) +- srw. r8,r8,r9 /* compute line count */ ++ srd. r8,r8,r9 /* compute line count */ + crclr cr0*4+so + beqlr /* nothing to do? */ + mtctr r8 +diff --git a/arch/powerpc/kernel/vdso64/gettimeofday.S b/arch/powerpc/kernel/vdso64/gettimeofday.S +index 09b2a49f6dd5..c973378e1f2b 100644 +--- a/arch/powerpc/kernel/vdso64/gettimeofday.S ++++ b/arch/powerpc/kernel/vdso64/gettimeofday.S +@@ -145,12 +145,15 @@ V_FUNCTION_BEGIN(__kernel_clock_getres) + cror cr0*4+eq,cr0*4+eq,cr1*4+eq + bne cr0,99f + ++ mflr r12 ++ .cfi_register lr,r12 ++ bl V_LOCAL_FUNC(__get_datapage) ++ lwz r5, CLOCK_HRTIMER_RES(r3) ++ mtlr r12 + li r3,0 + cmpldi cr0,r4,0 + crclr cr0*4+so + beqlr +- lis r5,CLOCK_REALTIME_RES@h +- ori r5,r5,CLOCK_REALTIME_RES@l + std r3,TSPC64_TV_SEC(r4) + std r5,TSPC64_TV_NSEC(r4) + blr +diff --git a/arch/powerpc/sysdev/xive/common.c b/arch/powerpc/sysdev/xive/common.c +index 110d8bb16ebb..a820370883d9 100644 +--- a/arch/powerpc/sysdev/xive/common.c ++++ b/arch/powerpc/sysdev/xive/common.c +@@ -967,6 +967,15 @@ static int xive_irq_alloc_data(unsigned int virq, irq_hw_number_t hw) + xd->target = XIVE_INVALID_TARGET; + irq_set_handler_data(virq, xd); + ++ /* ++ * Turn OFF by default the interrupt being mapped. A side ++ * effect of this check is the mapping the ESB page of the ++ * interrupt in the Linux address space. This prevents page ++ * fault issues in the crash handler which masks all ++ * interrupts. ++ */ ++ xive_esb_read(xd, XIVE_ESB_SET_PQ_01); ++ + return 0; + } + +diff --git a/arch/powerpc/sysdev/xive/spapr.c b/arch/powerpc/sysdev/xive/spapr.c +index 091f1d0d0af1..7fc41bf30fd5 100644 +--- a/arch/powerpc/sysdev/xive/spapr.c ++++ b/arch/powerpc/sysdev/xive/spapr.c +@@ -293,20 +293,28 @@ static int xive_spapr_populate_irq_data(u32 hw_irq, struct xive_irq_data *data) + data->esb_shift = esb_shift; + data->trig_page = trig_page; + ++ data->hw_irq = hw_irq; ++ + /* + * No chip-id for the sPAPR backend. This has an impact how we + * pick a target. See xive_pick_irq_target(). + */ + data->src_chip = XIVE_INVALID_CHIP_ID; + ++ /* ++ * When the H_INT_ESB flag is set, the H_INT_ESB hcall should ++ * be used for interrupt management. Skip the remapping of the ++ * ESB pages which are not available. ++ */ ++ if (data->flags & XIVE_IRQ_FLAG_H_INT_ESB) ++ return 0; ++ + data->eoi_mmio = ioremap(data->eoi_page, 1u << data->esb_shift); + if (!data->eoi_mmio) { + pr_err("Failed to map EOI page for irq 0x%x\n", hw_irq); + return -ENOMEM; + } + +- data->hw_irq = hw_irq; +- + /* Full function page supports trigger */ + if (flags & XIVE_SRC_TRIGGER) { + data->trig_mmio = data->eoi_mmio; +diff --git a/arch/powerpc/xmon/Makefile b/arch/powerpc/xmon/Makefile +index ac5ee067aa51..a60c44b4a3e5 100644 +--- a/arch/powerpc/xmon/Makefile ++++ b/arch/powerpc/xmon/Makefile +@@ -1,8 +1,8 @@ + # SPDX-License-Identifier: GPL-2.0 + # Makefile for xmon + +-# Disable clang warning for using setjmp without setjmp.h header +-subdir-ccflags-y := $(call cc-disable-warning, builtin-requires-header) ++# Avoid clang warnings around longjmp/setjmp declarations ++subdir-ccflags-y := -ffreestanding + + subdir-ccflags-$(CONFIG_PPC_WERROR) += -Werror + +diff --git a/arch/s390/include/asm/pgtable.h b/arch/s390/include/asm/pgtable.h +index d7fe9838084d..328710b386e3 100644 +--- a/arch/s390/include/asm/pgtable.h ++++ b/arch/s390/include/asm/pgtable.h +@@ -1126,8 +1126,6 @@ int pgste_perform_essa(struct mm_struct *mm, unsigned long hva, int orc, + static inline void set_pte_at(struct mm_struct *mm, unsigned long addr, + pte_t *ptep, pte_t entry) + { +- if (!MACHINE_HAS_NX) +- pte_val(entry) &= ~_PAGE_NOEXEC; + if (pte_present(entry)) + pte_val(entry) &= ~_PAGE_UNUSED; + if (mm_has_pgste(mm)) +@@ -1144,6 +1142,8 @@ static inline pte_t mk_pte_phys(unsigned long physpage, pgprot_t pgprot) + { + pte_t __pte; + pte_val(__pte) = physpage + pgprot_val(pgprot); ++ if (!MACHINE_HAS_NX) ++ pte_val(__pte) &= ~_PAGE_NOEXEC; + return pte_mkyoung(__pte); + } + +diff --git a/arch/sparc/net/bpf_jit_comp_64.c b/arch/sparc/net/bpf_jit_comp_64.c +index adfb4581bd80..dfb1a62abe93 100644 +--- a/arch/sparc/net/bpf_jit_comp_64.c ++++ b/arch/sparc/net/bpf_jit_comp_64.c +@@ -1326,6 +1326,9 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx) + const u8 tmp2 = bpf2sparc[TMP_REG_2]; + u32 opcode = 0, rs2; + ++ if (insn->dst_reg == BPF_REG_FP) ++ ctx->saw_frame_pointer = true; ++ + ctx->tmp_2_used = true; + emit_loadimm(imm, tmp2, ctx); + +@@ -1364,6 +1367,9 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx) + const u8 tmp = bpf2sparc[TMP_REG_1]; + u32 opcode = 0, rs2; + ++ if (insn->dst_reg == BPF_REG_FP) ++ ctx->saw_frame_pointer = true; ++ + switch (BPF_SIZE(code)) { + case BPF_W: + opcode = ST32; +@@ -1396,6 +1402,9 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx) + const u8 tmp2 = bpf2sparc[TMP_REG_2]; + const u8 tmp3 = bpf2sparc[TMP_REG_3]; + ++ if (insn->dst_reg == BPF_REG_FP) ++ ctx->saw_frame_pointer = true; ++ + ctx->tmp_1_used = true; + ctx->tmp_2_used = true; + ctx->tmp_3_used = true; +@@ -1416,6 +1425,9 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx) + const u8 tmp2 = bpf2sparc[TMP_REG_2]; + const u8 tmp3 = bpf2sparc[TMP_REG_3]; + ++ if (insn->dst_reg == BPF_REG_FP) ++ ctx->saw_frame_pointer = true; ++ + ctx->tmp_1_used = true; + ctx->tmp_2_used = true; + ctx->tmp_3_used = true; +diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c +index 4f3be91f0b0b..c7bd2e549a6a 100644 +--- a/arch/x86/kernel/cpu/mcheck/mce.c ++++ b/arch/x86/kernel/cpu/mcheck/mce.c +@@ -1660,36 +1660,6 @@ static int __mcheck_cpu_apply_quirks(struct cpuinfo_x86 *c) + if (c->x86 == 0x15 && c->x86_model <= 0xf) + mce_flags.overflow_recov = 1; + +- /* +- * Turn off MC4_MISC thresholding banks on those models since +- * they're not supported there. +- */ +- if (c->x86 == 0x15 && +- (c->x86_model >= 0x10 && c->x86_model <= 0x1f)) { +- int i; +- u64 hwcr; +- bool need_toggle; +- u32 msrs[] = { +- 0x00000413, /* MC4_MISC0 */ +- 0xc0000408, /* MC4_MISC1 */ +- }; +- +- rdmsrl(MSR_K7_HWCR, hwcr); +- +- /* McStatusWrEn has to be set */ +- need_toggle = !(hwcr & BIT(18)); +- +- if (need_toggle) +- wrmsrl(MSR_K7_HWCR, hwcr | BIT(18)); +- +- /* Clear CntP bit safely */ +- for (i = 0; i < ARRAY_SIZE(msrs); i++) +- msr_clear_bit(msrs[i], 62); +- +- /* restore old settings */ +- if (need_toggle) +- wrmsrl(MSR_K7_HWCR, hwcr); +- } + } + + if (c->x86_vendor == X86_VENDOR_INTEL) { +diff --git a/arch/x86/kernel/cpu/mcheck/mce_amd.c b/arch/x86/kernel/cpu/mcheck/mce_amd.c +index 4fa97a44e73f..b434780ae680 100644 +--- a/arch/x86/kernel/cpu/mcheck/mce_amd.c ++++ b/arch/x86/kernel/cpu/mcheck/mce_amd.c +@@ -544,6 +544,40 @@ out: + return offset; + } + ++/* ++ * Turn off MC4_MISC thresholding banks on all family 0x15 models since ++ * they're not supported there. ++ */ ++void disable_err_thresholding(struct cpuinfo_x86 *c) ++{ ++ int i; ++ u64 hwcr; ++ bool need_toggle; ++ u32 msrs[] = { ++ 0x00000413, /* MC4_MISC0 */ ++ 0xc0000408, /* MC4_MISC1 */ ++ }; ++ ++ if (c->x86 != 0x15) ++ return; ++ ++ rdmsrl(MSR_K7_HWCR, hwcr); ++ ++ /* McStatusWrEn has to be set */ ++ need_toggle = !(hwcr & BIT(18)); ++ ++ if (need_toggle) ++ wrmsrl(MSR_K7_HWCR, hwcr | BIT(18)); ++ ++ /* Clear CntP bit safely */ ++ for (i = 0; i < ARRAY_SIZE(msrs); i++) ++ msr_clear_bit(msrs[i], 62); ++ ++ /* restore old settings */ ++ if (need_toggle) ++ wrmsrl(MSR_K7_HWCR, hwcr); ++} ++ + /* cpu init entry point, called from mce.c with preempt off */ + void mce_amd_feature_init(struct cpuinfo_x86 *c) + { +@@ -551,6 +585,8 @@ void mce_amd_feature_init(struct cpuinfo_x86 *c) + unsigned int bank, block, cpu = smp_processor_id(); + int offset = -1; + ++ disable_err_thresholding(c); ++ + for (bank = 0; bank < mca_cfg.banks; ++bank) { + if (mce_flags.smca) + smca_configure(bank, cpu); +diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c +index 33f87b696487..38959b173a42 100644 +--- a/arch/x86/kvm/cpuid.c ++++ b/arch/x86/kvm/cpuid.c +@@ -404,7 +404,7 @@ static inline int __do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function, + + r = -E2BIG; + +- if (*nent >= maxnent) ++ if (WARN_ON(*nent >= maxnent)) + goto out; + + do_cpuid_1_ent(entry, function, index); +@@ -707,6 +707,9 @@ out: + static int do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 func, + u32 idx, int *nent, int maxnent, unsigned int type) + { ++ if (*nent >= maxnent) ++ return -E2BIG; ++ + if (type == KVM_GET_EMULATED_CPUID) + return __do_cpuid_ent_emulated(entry, func, idx, nent, maxnent); + +diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c +index 1f9360320a82..8a51442247c5 100644 +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -276,13 +276,14 @@ int kvm_set_shared_msr(unsigned slot, u64 value, u64 mask) + struct kvm_shared_msrs *smsr = per_cpu_ptr(shared_msrs, cpu); + int err; + +- if (((value ^ smsr->values[slot].curr) & mask) == 0) ++ value = (value & mask) | (smsr->values[slot].host & ~mask); ++ if (value == smsr->values[slot].curr) + return 0; +- smsr->values[slot].curr = value; + err = wrmsrl_safe(shared_msrs_global.msrs[slot], value); + if (err) + return 1; + ++ smsr->values[slot].curr = value; + if (!smsr->registered) { + smsr->urn.on_user_return = kvm_on_user_return; + user_return_notifier_register(&smsr->urn); +@@ -1112,10 +1113,15 @@ u64 kvm_get_arch_capabilities(void) + * If TSX is disabled on the system, guests are also mitigated against + * TAA and clear CPU buffer mitigation is not required for guests. + */ +- if (boot_cpu_has_bug(X86_BUG_TAA) && boot_cpu_has(X86_FEATURE_RTM) && +- (data & ARCH_CAP_TSX_CTRL_MSR)) ++ if (!boot_cpu_has(X86_FEATURE_RTM)) ++ data &= ~ARCH_CAP_TAA_NO; ++ else if (!boot_cpu_has_bug(X86_BUG_TAA)) ++ data |= ARCH_CAP_TAA_NO; ++ else if (data & ARCH_CAP_TSX_CTRL_MSR) + data &= ~ARCH_CAP_MDS_NO; + ++ /* KVM does not emulate MSR_IA32_TSX_CTRL. */ ++ data &= ~ARCH_CAP_TSX_CTRL_MSR; + return data; + } + +diff --git a/arch/x86/pci/fixup.c b/arch/x86/pci/fixup.c +index 4210da7b44de..33e9b4f1ce20 100644 +--- a/arch/x86/pci/fixup.c ++++ b/arch/x86/pci/fixup.c +@@ -588,6 +588,17 @@ static void pci_fixup_amd_ehci_pme(struct pci_dev *dev) + } + DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, 0x7808, pci_fixup_amd_ehci_pme); + ++/* ++ * Device [1022:7914] ++ * When in D0, PME# doesn't get asserted when plugging USB 2.0 device. ++ */ ++static void pci_fixup_amd_fch_xhci_pme(struct pci_dev *dev) ++{ ++ dev_info(&dev->dev, "PME# does not work under D0, disabling it\n"); ++ dev->pme_support &= ~(PCI_PM_CAP_PME_D0 >> PCI_PM_CAP_PME_SHIFT); ++} ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, 0x7914, pci_fixup_amd_fch_xhci_pme); ++ + /* + * Apple MacBook Pro: Avoid [mem 0x7fa00000-0x7fbfffff] + * +diff --git a/block/blk-merge.c b/block/blk-merge.c +index 94650cdf2924..f61b50a01bc7 100644 +--- a/block/blk-merge.c ++++ b/block/blk-merge.c +@@ -765,7 +765,7 @@ static struct request *attempt_merge(struct request_queue *q, + + req->__data_len += blk_rq_bytes(next); + +- if (req_op(req) != REQ_OP_DISCARD) ++ if (!blk_discard_mergable(req)) + elv_merge_requests(q, req, next); + + /* +diff --git a/block/blk-mq-sysfs.c b/block/blk-mq-sysfs.c +index 79969c3c234f..c97fafa1b206 100644 +--- a/block/blk-mq-sysfs.c ++++ b/block/blk-mq-sysfs.c +@@ -145,20 +145,25 @@ static ssize_t blk_mq_hw_sysfs_nr_reserved_tags_show(struct blk_mq_hw_ctx *hctx, + + static ssize_t blk_mq_hw_sysfs_cpus_show(struct blk_mq_hw_ctx *hctx, char *page) + { ++ const size_t size = PAGE_SIZE - 1; + unsigned int i, first = 1; +- ssize_t ret = 0; ++ int ret = 0, pos = 0; + + for_each_cpu(i, hctx->cpumask) { + if (first) +- ret += sprintf(ret + page, "%u", i); ++ ret = snprintf(pos + page, size - pos, "%u", i); + else +- ret += sprintf(ret + page, ", %u", i); ++ ret = snprintf(pos + page, size - pos, ", %u", i); ++ ++ if (ret >= size - pos) ++ break; + + first = 0; ++ pos += ret; + } + +- ret += sprintf(ret + page, "\n"); +- return ret; ++ ret = snprintf(pos + page, size + 1 - pos, "\n"); ++ return pos + ret; + } + + static struct attribute *default_ctx_attrs[] = { +diff --git a/crypto/af_alg.c b/crypto/af_alg.c +index f816a7289104..422bba808f73 100644 +--- a/crypto/af_alg.c ++++ b/crypto/af_alg.c +@@ -1086,7 +1086,7 @@ void af_alg_async_cb(struct crypto_async_request *_req, int err) + af_alg_free_resources(areq); + sock_put(sk); + +- iocb->ki_complete(iocb, err ? err : resultlen, 0); ++ iocb->ki_complete(iocb, err ? err : (int)resultlen, 0); + } + EXPORT_SYMBOL_GPL(af_alg_async_cb); + +diff --git a/crypto/crypto_user.c b/crypto/crypto_user.c +index 5e457a7dd1c9..b6899be8065d 100644 +--- a/crypto/crypto_user.c ++++ b/crypto/crypto_user.c +@@ -288,8 +288,10 @@ static int crypto_report(struct sk_buff *in_skb, struct nlmsghdr *in_nlh, + drop_alg: + crypto_mod_put(alg); + +- if (err) ++ if (err) { ++ kfree_skb(skb); + return err; ++ } + + return nlmsg_unicast(crypto_nlsk, skb, NETLINK_CB(in_skb).portid); + } +diff --git a/crypto/ecc.c b/crypto/ecc.c +index 18f32f2a5e1c..65ee29dda063 100644 +--- a/crypto/ecc.c ++++ b/crypto/ecc.c +@@ -898,36 +898,50 @@ static void ecc_point_mult(struct ecc_point *result, + static inline void ecc_swap_digits(const u64 *in, u64 *out, + unsigned int ndigits) + { ++ const __be64 *src = (__force __be64 *)in; + int i; + + for (i = 0; i < ndigits; i++) +- out[i] = __swab64(in[ndigits - 1 - i]); ++ out[i] = be64_to_cpu(src[ndigits - 1 - i]); + } + +-int ecc_is_key_valid(unsigned int curve_id, unsigned int ndigits, +- const u64 *private_key, unsigned int private_key_len) ++static int __ecc_is_key_valid(const struct ecc_curve *curve, ++ const u64 *private_key, unsigned int ndigits) + { +- int nbytes; +- const struct ecc_curve *curve = ecc_get_curve(curve_id); ++ u64 one[ECC_MAX_DIGITS] = { 1, }; ++ u64 res[ECC_MAX_DIGITS]; + + if (!private_key) + return -EINVAL; + +- nbytes = ndigits << ECC_DIGITS_TO_BYTES_SHIFT; +- +- if (private_key_len != nbytes) ++ if (curve->g.ndigits != ndigits) + return -EINVAL; + +- if (vli_is_zero(private_key, ndigits)) ++ /* Make sure the private key is in the range [2, n-3]. */ ++ if (vli_cmp(one, private_key, ndigits) != -1) + return -EINVAL; +- +- /* Make sure the private key is in the range [1, n-1]. */ +- if (vli_cmp(curve->n, private_key, ndigits) != 1) ++ vli_sub(res, curve->n, one, ndigits); ++ vli_sub(res, res, one, ndigits); ++ if (vli_cmp(res, private_key, ndigits) != 1) + return -EINVAL; + + return 0; + } + ++int ecc_is_key_valid(unsigned int curve_id, unsigned int ndigits, ++ const u64 *private_key, unsigned int private_key_len) ++{ ++ int nbytes; ++ const struct ecc_curve *curve = ecc_get_curve(curve_id); ++ ++ nbytes = ndigits << ECC_DIGITS_TO_BYTES_SHIFT; ++ ++ if (private_key_len != nbytes) ++ return -EINVAL; ++ ++ return __ecc_is_key_valid(curve, private_key, ndigits); ++} ++ + /* + * ECC private keys are generated using the method of extra random bits, + * equivalent to that described in FIPS 186-4, Appendix B.4.1. +@@ -971,11 +985,8 @@ int ecc_gen_privkey(unsigned int curve_id, unsigned int ndigits, u64 *privkey) + if (err) + return err; + +- if (vli_is_zero(priv, ndigits)) +- return -EINVAL; +- +- /* Make sure the private key is in the range [1, n-1]. */ +- if (vli_cmp(curve->n, priv, ndigits) != 1) ++ /* Make sure the private key is in the valid range. */ ++ if (__ecc_is_key_valid(curve, priv, ndigits)) + return -EINVAL; + + ecc_swap_digits(priv, privkey, ndigits); +diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c +index f0348e388d01..1cb7c6a52f61 100644 +--- a/drivers/acpi/bus.c ++++ b/drivers/acpi/bus.c +@@ -196,7 +196,7 @@ int acpi_bus_get_private_data(acpi_handle handle, void **data) + { + acpi_status status; + +- if (!*data) ++ if (!data) + return -EINVAL; + + status = acpi_get_data(handle, acpi_bus_private_data_handler, data); +diff --git a/drivers/acpi/device_pm.c b/drivers/acpi/device_pm.c +index 18af71057b44..fc300ce3ae8e 100644 +--- a/drivers/acpi/device_pm.c ++++ b/drivers/acpi/device_pm.c +@@ -1154,9 +1154,19 @@ static void acpi_dev_pm_detach(struct device *dev, bool power_off) + */ + int acpi_dev_pm_attach(struct device *dev, bool power_on) + { ++ /* ++ * Skip devices whose ACPI companions match the device IDs below, ++ * because they require special power management handling incompatible ++ * with the generic ACPI PM domain. ++ */ ++ static const struct acpi_device_id special_pm_ids[] = { ++ {"PNP0C0B", }, /* Generic ACPI fan */ ++ {"INT3404", }, /* Fan */ ++ {} ++ }; + struct acpi_device *adev = ACPI_COMPANION(dev); + +- if (!adev) ++ if (!adev || !acpi_match_device_ids(adev, special_pm_ids)) + return -ENODEV; + + if (dev->pm_domain) +diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c +index 9da7e7d874bd..ff36b0101ff0 100644 +--- a/drivers/acpi/osl.c ++++ b/drivers/acpi/osl.c +@@ -371,19 +371,21 @@ void *__ref acpi_os_map_memory(acpi_physical_address phys, acpi_size size) + } + EXPORT_SYMBOL_GPL(acpi_os_map_memory); + +-static void acpi_os_drop_map_ref(struct acpi_ioremap *map) ++/* Must be called with mutex_lock(&acpi_ioremap_lock) */ ++static unsigned long acpi_os_drop_map_ref(struct acpi_ioremap *map) + { +- if (!--map->refcount) ++ unsigned long refcount = --map->refcount; ++ ++ if (!refcount) + list_del_rcu(&map->list); ++ return refcount; + } + + static void acpi_os_map_cleanup(struct acpi_ioremap *map) + { +- if (!map->refcount) { +- synchronize_rcu_expedited(); +- acpi_unmap(map->phys, map->virt); +- kfree(map); +- } ++ synchronize_rcu_expedited(); ++ acpi_unmap(map->phys, map->virt); ++ kfree(map); + } + + /** +@@ -403,6 +405,7 @@ static void acpi_os_map_cleanup(struct acpi_ioremap *map) + void __ref acpi_os_unmap_iomem(void __iomem *virt, acpi_size size) + { + struct acpi_ioremap *map; ++ unsigned long refcount; + + if (!acpi_permanent_mmap) { + __acpi_unmap_table(virt, size); +@@ -416,10 +419,11 @@ void __ref acpi_os_unmap_iomem(void __iomem *virt, acpi_size size) + WARN(true, PREFIX "%s: bad address %p\n", __func__, virt); + return; + } +- acpi_os_drop_map_ref(map); ++ refcount = acpi_os_drop_map_ref(map); + mutex_unlock(&acpi_ioremap_lock); + +- acpi_os_map_cleanup(map); ++ if (!refcount) ++ acpi_os_map_cleanup(map); + } + EXPORT_SYMBOL_GPL(acpi_os_unmap_iomem); + +@@ -454,6 +458,7 @@ void acpi_os_unmap_generic_address(struct acpi_generic_address *gas) + { + u64 addr; + struct acpi_ioremap *map; ++ unsigned long refcount; + + if (gas->space_id != ACPI_ADR_SPACE_SYSTEM_MEMORY) + return; +@@ -469,10 +474,11 @@ void acpi_os_unmap_generic_address(struct acpi_generic_address *gas) + mutex_unlock(&acpi_ioremap_lock); + return; + } +- acpi_os_drop_map_ref(map); ++ refcount = acpi_os_drop_map_ref(map); + mutex_unlock(&acpi_ioremap_lock); + +- acpi_os_map_cleanup(map); ++ if (!refcount) ++ acpi_os_map_cleanup(map); + } + EXPORT_SYMBOL(acpi_os_unmap_generic_address); + +diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c +index e0b0399ff7ec..9d5cb3b7a7a2 100644 +--- a/drivers/android/binder_alloc.c ++++ b/drivers/android/binder_alloc.c +@@ -289,8 +289,7 @@ static int binder_update_page_range(struct binder_alloc *alloc, int allocate, + return 0; + + free_range: +- for (page_addr = end - PAGE_SIZE; page_addr >= start; +- page_addr -= PAGE_SIZE) { ++ for (page_addr = end - PAGE_SIZE; 1; page_addr -= PAGE_SIZE) { + bool ret; + size_t index; + +@@ -303,6 +302,8 @@ free_range: + WARN_ON(!ret); + + trace_binder_free_lru_end(alloc, index); ++ if (page_addr == start) ++ break; + continue; + + err_vm_insert_page_failed: +@@ -312,7 +313,8 @@ err_map_kernel_failed: + page->page_ptr = NULL; + err_alloc_page_failed: + err_page_ptr_cleared: +- ; ++ if (page_addr == start) ++ break; + } + err_no_vma: + if (mm) { +diff --git a/drivers/block/drbd/drbd_state.c b/drivers/block/drbd/drbd_state.c +index 0813c654c893..b452359b6aae 100644 +--- a/drivers/block/drbd/drbd_state.c ++++ b/drivers/block/drbd/drbd_state.c +@@ -688,11 +688,9 @@ request_detach(struct drbd_device *device) + CS_VERBOSE | CS_ORDERED | CS_INHIBIT_MD_IO); + } + +-enum drbd_state_rv +-drbd_request_detach_interruptible(struct drbd_device *device) ++int drbd_request_detach_interruptible(struct drbd_device *device) + { +- enum drbd_state_rv rv; +- int ret; ++ int ret, rv; + + drbd_suspend_io(device); /* so no-one is stuck in drbd_al_begin_io */ + wait_event_interruptible(device->state_wait, +diff --git a/drivers/block/drbd/drbd_state.h b/drivers/block/drbd/drbd_state.h +index b2a390ba73a0..f87371e55e68 100644 +--- a/drivers/block/drbd/drbd_state.h ++++ b/drivers/block/drbd/drbd_state.h +@@ -162,8 +162,7 @@ static inline int drbd_request_state(struct drbd_device *device, + } + + /* for use in adm_detach() (drbd_adm_detach(), drbd_adm_down()) */ +-enum drbd_state_rv +-drbd_request_detach_interruptible(struct drbd_device *device); ++int drbd_request_detach_interruptible(struct drbd_device *device); + + enum drbd_role conn_highest_role(struct drbd_connection *connection); + enum drbd_role conn_highest_peer(struct drbd_connection *connection); +diff --git a/drivers/block/rsxx/core.c b/drivers/block/rsxx/core.c +index 34997df132e2..6beafaa335c7 100644 +--- a/drivers/block/rsxx/core.c ++++ b/drivers/block/rsxx/core.c +@@ -1025,8 +1025,10 @@ static void rsxx_pci_remove(struct pci_dev *dev) + + cancel_work_sync(&card->event_work); + ++ destroy_workqueue(card->event_wq); + rsxx_destroy_dev(card); + rsxx_dma_destroy(card); ++ destroy_workqueue(card->creg_ctrl.creg_wq); + + spin_lock_irqsave(&card->irq_lock, flags); + rsxx_disable_ier_and_isr(card, CR_INTR_ALL); +diff --git a/drivers/char/hw_random/omap-rng.c b/drivers/char/hw_random/omap-rng.c +index 25173454efa3..091753765d99 100644 +--- a/drivers/char/hw_random/omap-rng.c ++++ b/drivers/char/hw_random/omap-rng.c +@@ -66,6 +66,13 @@ + #define OMAP4_RNG_OUTPUT_SIZE 0x8 + #define EIP76_RNG_OUTPUT_SIZE 0x10 + ++/* ++ * EIP76 RNG takes approx. 700us to produce 16 bytes of output data ++ * as per testing results. And to account for the lack of udelay()'s ++ * reliability, we keep the timeout as 1000us. ++ */ ++#define RNG_DATA_FILL_TIMEOUT 100 ++ + enum { + RNG_OUTPUT_0_REG = 0, + RNG_OUTPUT_1_REG, +@@ -175,7 +182,7 @@ static int omap_rng_do_read(struct hwrng *rng, void *data, size_t max, + if (max < priv->pdata->data_size) + return 0; + +- for (i = 0; i < 20; i++) { ++ for (i = 0; i < RNG_DATA_FILL_TIMEOUT; i++) { + present = priv->pdata->data_present(priv); + if (present || !wait) + break; +diff --git a/drivers/char/ppdev.c b/drivers/char/ppdev.c +index d256110ba672..0023bde4d4ff 100644 +--- a/drivers/char/ppdev.c ++++ b/drivers/char/ppdev.c +@@ -623,20 +623,27 @@ static int pp_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg) + if (copy_from_user(time32, argp, sizeof(time32))) + return -EFAULT; + ++ if ((time32[0] < 0) || (time32[1] < 0)) ++ return -EINVAL; ++ + return pp_set_timeout(pp->pdev, time32[0], time32[1]); + + case PPSETTIME64: + if (copy_from_user(time64, argp, sizeof(time64))) + return -EFAULT; + ++ if ((time64[0] < 0) || (time64[1] < 0)) ++ return -EINVAL; ++ ++ if (IS_ENABLED(CONFIG_SPARC64) && !in_compat_syscall()) ++ time64[1] >>= 32; ++ + return pp_set_timeout(pp->pdev, time64[0], time64[1]); + + case PPGETTIME32: + jiffies_to_timespec64(pp->pdev->timeout, &ts); + time32[0] = ts.tv_sec; + time32[1] = ts.tv_nsec / NSEC_PER_USEC; +- if ((time32[0] < 0) || (time32[1] < 0)) +- return -EINVAL; + + if (copy_to_user(argp, time32, sizeof(time32))) + return -EFAULT; +@@ -647,8 +654,9 @@ static int pp_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg) + jiffies_to_timespec64(pp->pdev->timeout, &ts); + time64[0] = ts.tv_sec; + time64[1] = ts.tv_nsec / NSEC_PER_USEC; +- if ((time64[0] < 0) || (time64[1] < 0)) +- return -EINVAL; ++ ++ if (IS_ENABLED(CONFIG_SPARC64) && !in_compat_syscall()) ++ time64[1] <<= 32; + + if (copy_to_user(argp, time64, sizeof(time64))) + return -EFAULT; +diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c +index 44a3d16231f6..dd64b3b37400 100644 +--- a/drivers/char/tpm/tpm2-cmd.c ++++ b/drivers/char/tpm/tpm2-cmd.c +@@ -1029,6 +1029,10 @@ static int tpm2_get_cc_attrs_tbl(struct tpm_chip *chip) + + chip->cc_attrs_tbl = devm_kzalloc(&chip->dev, 4 * nr_commands, + GFP_KERNEL); ++ if (!chip->cc_attrs_tbl) { ++ rc = -ENOMEM; ++ goto out; ++ } + + rc = tpm_buf_init(&buf, TPM2_ST_NO_SESSIONS, TPM2_CC_GET_CAPABILITY); + if (rc) +diff --git a/drivers/clk/renesas/r8a77995-cpg-mssr.c b/drivers/clk/renesas/r8a77995-cpg-mssr.c +index e594cf8ee63b..8434d5530fb1 100644 +--- a/drivers/clk/renesas/r8a77995-cpg-mssr.c ++++ b/drivers/clk/renesas/r8a77995-cpg-mssr.c +@@ -141,8 +141,8 @@ static const struct mssr_mod_clk r8a77995_mod_clks[] __initconst = { + DEF_MOD("vspbs", 627, R8A77995_CLK_S0D1), + DEF_MOD("ehci0", 703, R8A77995_CLK_S3D2), + DEF_MOD("hsusb", 704, R8A77995_CLK_S3D2), +- DEF_MOD("du1", 723, R8A77995_CLK_S2D1), +- DEF_MOD("du0", 724, R8A77995_CLK_S2D1), ++ DEF_MOD("du1", 723, R8A77995_CLK_S1D1), ++ DEF_MOD("du0", 724, R8A77995_CLK_S1D1), + DEF_MOD("lvds", 727, R8A77995_CLK_S2D1), + DEF_MOD("vin7", 804, R8A77995_CLK_S1D2), + DEF_MOD("vin6", 805, R8A77995_CLK_S1D2), +diff --git a/drivers/clk/rockchip/clk-rk3188.c b/drivers/clk/rockchip/clk-rk3188.c +index 2b0d772b4f43..8cdfcd77e3ad 100644 +--- a/drivers/clk/rockchip/clk-rk3188.c ++++ b/drivers/clk/rockchip/clk-rk3188.c +@@ -362,8 +362,8 @@ static struct rockchip_clk_branch common_clk_branches[] __initdata = { + RK2928_CLKGATE_CON(2), 5, GFLAGS), + MUX(SCLK_MAC, "sclk_macref", mux_sclk_macref_p, CLK_SET_RATE_PARENT, + RK2928_CLKSEL_CON(21), 4, 1, MFLAGS), +- GATE(0, "sclk_mac_lbtest", "sclk_macref", +- RK2928_CLKGATE_CON(2), 12, 0, GFLAGS), ++ GATE(0, "sclk_mac_lbtest", "sclk_macref", 0, ++ RK2928_CLKGATE_CON(2), 12, GFLAGS), + + COMPOSITE(0, "hsadc_src", mux_pll_src_gpll_cpll_p, 0, + RK2928_CLKSEL_CON(22), 0, 1, MFLAGS, 8, 8, DFLAGS, +@@ -391,8 +391,8 @@ static struct rockchip_clk_branch common_clk_branches[] __initdata = { + * Clock-Architecture Diagram 4 + */ + +- GATE(SCLK_SMC, "sclk_smc", "hclk_peri", +- RK2928_CLKGATE_CON(2), 4, 0, GFLAGS), ++ GATE(SCLK_SMC, "sclk_smc", "hclk_peri", 0, ++ RK2928_CLKGATE_CON(2), 4, GFLAGS), + + COMPOSITE_NOMUX(SCLK_SPI0, "sclk_spi0", "pclk_peri", 0, + RK2928_CLKSEL_CON(25), 0, 7, DFLAGS, +diff --git a/drivers/clk/rockchip/clk-rk3328.c b/drivers/clk/rockchip/clk-rk3328.c +index 33d1cf4e6d80..0e5222d1944b 100644 +--- a/drivers/clk/rockchip/clk-rk3328.c ++++ b/drivers/clk/rockchip/clk-rk3328.c +@@ -392,7 +392,7 @@ static struct rockchip_clk_branch rk3328_clk_branches[] __initdata = { + RK3328_CLKGATE_CON(1), 5, GFLAGS, + &rk3328_i2s1_fracmux), + GATE(SCLK_I2S1, "clk_i2s1", "i2s1_pre", CLK_SET_RATE_PARENT, +- RK3328_CLKGATE_CON(0), 6, GFLAGS), ++ RK3328_CLKGATE_CON(1), 6, GFLAGS), + COMPOSITE_NODIV(SCLK_I2S1_OUT, "i2s1_out", mux_i2s1out_p, 0, + RK3328_CLKSEL_CON(8), 12, 1, MFLAGS, + RK3328_CLKGATE_CON(1), 7, GFLAGS), +diff --git a/drivers/clk/sunxi-ng/ccu-sun50i-a64.c b/drivers/clk/sunxi-ng/ccu-sun50i-a64.c +index 36a30a3cfad7..eaafc038368f 100644 +--- a/drivers/clk/sunxi-ng/ccu-sun50i-a64.c ++++ b/drivers/clk/sunxi-ng/ccu-sun50i-a64.c +@@ -565,7 +565,7 @@ static const char * const dsi_dphy_parents[] = { "pll-video0", "pll-periph0" }; + static const u8 dsi_dphy_table[] = { 0, 2, }; + static SUNXI_CCU_M_WITH_MUX_TABLE_GATE(dsi_dphy_clk, "dsi-dphy", + dsi_dphy_parents, dsi_dphy_table, +- 0x168, 0, 4, 8, 2, BIT(31), CLK_SET_RATE_PARENT); ++ 0x168, 0, 4, 8, 2, BIT(15), CLK_SET_RATE_PARENT); + + static SUNXI_CCU_M_WITH_GATE(gpu_clk, "gpu", "pll-gpu", + 0x1a0, 0, 3, BIT(31), CLK_SET_RATE_PARENT); +diff --git a/drivers/clk/sunxi-ng/ccu-sun8i-h3.c b/drivers/clk/sunxi-ng/ccu-sun8i-h3.c +index 1729ff6a5aae..b09acda71abe 100644 +--- a/drivers/clk/sunxi-ng/ccu-sun8i-h3.c ++++ b/drivers/clk/sunxi-ng/ccu-sun8i-h3.c +@@ -460,7 +460,7 @@ static const char * const csi_sclk_parents[] = { "pll-periph0", "pll-periph1" }; + static SUNXI_CCU_M_WITH_MUX_GATE(csi_sclk_clk, "csi-sclk", csi_sclk_parents, + 0x134, 16, 4, 24, 3, BIT(31), 0); + +-static const char * const csi_mclk_parents[] = { "osc24M", "pll-video", "pll-periph0" }; ++static const char * const csi_mclk_parents[] = { "osc24M", "pll-video", "pll-periph1" }; + static SUNXI_CCU_M_WITH_MUX_GATE(csi_mclk_clk, "csi-mclk", csi_mclk_parents, + 0x134, 0, 5, 8, 3, BIT(15), 0); + +diff --git a/drivers/cpufreq/powernv-cpufreq.c b/drivers/cpufreq/powernv-cpufreq.c +index a28bb8f3f395..33854bf127f9 100644 +--- a/drivers/cpufreq/powernv-cpufreq.c ++++ b/drivers/cpufreq/powernv-cpufreq.c +@@ -1002,9 +1002,14 @@ static struct cpufreq_driver powernv_cpufreq_driver = { + + static int init_chip_info(void) + { +- unsigned int chip[256]; ++ unsigned int *chip; + unsigned int cpu, i; + unsigned int prev_chip_id = UINT_MAX; ++ int ret = 0; ++ ++ chip = kcalloc(num_possible_cpus(), sizeof(*chip), GFP_KERNEL); ++ if (!chip) ++ return -ENOMEM; + + for_each_possible_cpu(cpu) { + unsigned int id = cpu_to_chip_id(cpu); +@@ -1016,8 +1021,10 @@ static int init_chip_info(void) + } + + chips = kcalloc(nr_chips, sizeof(struct chip), GFP_KERNEL); +- if (!chips) +- return -ENOMEM; ++ if (!chips) { ++ ret = -ENOMEM; ++ goto free_and_return; ++ } + + for (i = 0; i < nr_chips; i++) { + chips[i].id = chip[i]; +@@ -1027,7 +1034,9 @@ static int init_chip_info(void) + per_cpu(chip_info, cpu) = &chips[i]; + } + +- return 0; ++free_and_return: ++ kfree(chip); ++ return ret; + } + + static inline void clean_chip_info(void) +diff --git a/drivers/cpuidle/driver.c b/drivers/cpuidle/driver.c +index dc32f34e68d9..01acd88c4193 100644 +--- a/drivers/cpuidle/driver.c ++++ b/drivers/cpuidle/driver.c +@@ -62,24 +62,23 @@ static inline void __cpuidle_unset_driver(struct cpuidle_driver *drv) + * __cpuidle_set_driver - set per CPU driver variables for the given driver. + * @drv: a valid pointer to a struct cpuidle_driver + * +- * For each CPU in the driver's cpumask, unset the registered driver per CPU +- * to @drv. +- * +- * Returns 0 on success, -EBUSY if the CPUs have driver(s) already. ++ * Returns 0 on success, -EBUSY if any CPU in the cpumask have a driver ++ * different from drv already. + */ + static inline int __cpuidle_set_driver(struct cpuidle_driver *drv) + { + int cpu; + + for_each_cpu(cpu, drv->cpumask) { ++ struct cpuidle_driver *old_drv; + +- if (__cpuidle_get_cpu_driver(cpu)) { +- __cpuidle_unset_driver(drv); ++ old_drv = __cpuidle_get_cpu_driver(cpu); ++ if (old_drv && old_drv != drv) + return -EBUSY; +- } ++ } + ++ for_each_cpu(cpu, drv->cpumask) + per_cpu(cpuidle_drivers, cpu) = drv; +- } + + return 0; + } +diff --git a/drivers/crypto/amcc/crypto4xx_core.c b/drivers/crypto/amcc/crypto4xx_core.c +index 8d4d8db244e9..d1d041de7f8a 100644 +--- a/drivers/crypto/amcc/crypto4xx_core.c ++++ b/drivers/crypto/amcc/crypto4xx_core.c +@@ -399,12 +399,8 @@ static u32 crypto4xx_build_sdr(struct crypto4xx_device *dev) + dma_alloc_coherent(dev->core_dev->device, + dev->scatter_buffer_size * PPC4XX_NUM_SD, + &dev->scatter_buffer_pa, GFP_ATOMIC); +- if (!dev->scatter_buffer_va) { +- dma_free_coherent(dev->core_dev->device, +- sizeof(struct ce_sd) * PPC4XX_NUM_SD, +- dev->sdr, dev->sdr_pa); ++ if (!dev->scatter_buffer_va) + return -ENOMEM; +- } + + sd_array = dev->sdr; + +diff --git a/drivers/crypto/bcm/cipher.c b/drivers/crypto/bcm/cipher.c +index b6be383a51a6..84422435f39b 100644 +--- a/drivers/crypto/bcm/cipher.c ++++ b/drivers/crypto/bcm/cipher.c +@@ -4637,12 +4637,16 @@ static int spu_register_ahash(struct iproc_alg_s *driver_alg) + hash->halg.statesize = sizeof(struct spu_hash_export_s); + + if (driver_alg->auth_info.mode != HASH_MODE_HMAC) { +- hash->setkey = ahash_setkey; + hash->init = ahash_init; + hash->update = ahash_update; + hash->final = ahash_final; + hash->finup = ahash_finup; + hash->digest = ahash_digest; ++ if ((driver_alg->auth_info.alg == HASH_ALG_AES) && ++ ((driver_alg->auth_info.mode == HASH_MODE_XCBC) || ++ (driver_alg->auth_info.mode == HASH_MODE_CMAC))) { ++ hash->setkey = ahash_setkey; ++ } + } else { + hash->setkey = ahash_hmac_setkey; + hash->init = ahash_hmac_init; +diff --git a/drivers/crypto/ccp/ccp-dmaengine.c b/drivers/crypto/ccp/ccp-dmaengine.c +index d608043c0280..df82af3dd970 100644 +--- a/drivers/crypto/ccp/ccp-dmaengine.c ++++ b/drivers/crypto/ccp/ccp-dmaengine.c +@@ -341,6 +341,7 @@ static struct ccp_dma_desc *ccp_alloc_dma_desc(struct ccp_dma_chan *chan, + desc->tx_desc.flags = flags; + desc->tx_desc.tx_submit = ccp_tx_submit; + desc->ccp = chan->ccp; ++ INIT_LIST_HEAD(&desc->entry); + INIT_LIST_HEAD(&desc->pending); + INIT_LIST_HEAD(&desc->active); + desc->status = DMA_IN_PROGRESS; +diff --git a/drivers/devfreq/devfreq.c b/drivers/devfreq/devfreq.c +index 8a411514a7c5..dc9c0032c97b 100644 +--- a/drivers/devfreq/devfreq.c ++++ b/drivers/devfreq/devfreq.c +@@ -133,6 +133,7 @@ int devfreq_update_status(struct devfreq *devfreq, unsigned long freq) + int lev, prev_lev, ret = 0; + unsigned long cur_time; + ++ lockdep_assert_held(&devfreq->lock); + cur_time = jiffies; + + /* Immediately exit if previous_freq is not initialized yet. */ +@@ -1161,12 +1162,17 @@ static ssize_t trans_stat_show(struct device *dev, + int i, j; + unsigned int max_state = devfreq->profile->max_state; + +- if (!devfreq->stop_polling && +- devfreq_update_status(devfreq, devfreq->previous_freq)) +- return 0; + if (max_state == 0) + return sprintf(buf, "Not Supported.\n"); + ++ mutex_lock(&devfreq->lock); ++ if (!devfreq->stop_polling && ++ devfreq_update_status(devfreq, devfreq->previous_freq)) { ++ mutex_unlock(&devfreq->lock); ++ return 0; ++ } ++ mutex_unlock(&devfreq->lock); ++ + len = sprintf(buf, " From : To\n"); + len += sprintf(buf + len, " :"); + for (i = 0; i < max_state; i++) +diff --git a/drivers/dma/coh901318.c b/drivers/dma/coh901318.c +index 74794c9859f6..6d7d2d54eacf 100644 +--- a/drivers/dma/coh901318.c ++++ b/drivers/dma/coh901318.c +@@ -1797,13 +1797,10 @@ static struct dma_chan *coh901318_xlate(struct of_phandle_args *dma_spec, + static int coh901318_config(struct coh901318_chan *cohc, + struct coh901318_params *param) + { +- unsigned long flags; + const struct coh901318_params *p; + int channel = cohc->id; + void __iomem *virtbase = cohc->base->virtbase; + +- spin_lock_irqsave(&cohc->lock, flags); +- + if (param) + p = param; + else +@@ -1823,8 +1820,6 @@ static int coh901318_config(struct coh901318_chan *cohc, + coh901318_set_conf(cohc, p->config); + coh901318_set_ctrl(cohc, p->ctrl_lli_last); + +- spin_unlock_irqrestore(&cohc->lock, flags); +- + return 0; + } + +diff --git a/drivers/dma/dw/core.c b/drivers/dma/dw/core.c +index 0f389e008ce6..055d83b6cb68 100644 +--- a/drivers/dma/dw/core.c ++++ b/drivers/dma/dw/core.c +@@ -160,12 +160,14 @@ static void dwc_initialize_chan_idma32(struct dw_dma_chan *dwc) + + static void dwc_initialize_chan_dw(struct dw_dma_chan *dwc) + { ++ struct dw_dma *dw = to_dw_dma(dwc->chan.device); + u32 cfghi = DWC_CFGH_FIFO_MODE; + u32 cfglo = DWC_CFGL_CH_PRIOR(dwc->priority); + bool hs_polarity = dwc->dws.hs_polarity; + + cfghi |= DWC_CFGH_DST_PER(dwc->dws.dst_id); + cfghi |= DWC_CFGH_SRC_PER(dwc->dws.src_id); ++ cfghi |= DWC_CFGH_PROTCTL(dw->pdata->protctl); + + /* Set polarity of handshake interface */ + cfglo |= hs_polarity ? DWC_CFGL_HS_DST_POL | DWC_CFGL_HS_SRC_POL : 0; +diff --git a/drivers/dma/dw/platform.c b/drivers/dma/dw/platform.c +index bc31fe802061..46a519e07195 100644 +--- a/drivers/dma/dw/platform.c ++++ b/drivers/dma/dw/platform.c +@@ -162,6 +162,12 @@ dw_dma_parse_dt(struct platform_device *pdev) + pdata->multi_block[tmp] = 1; + } + ++ if (!of_property_read_u32(np, "snps,dma-protection-control", &tmp)) { ++ if (tmp > CHAN_PROTCTL_MASK) ++ return NULL; ++ pdata->protctl = tmp; ++ } ++ + return pdata; + } + #else +diff --git a/drivers/dma/dw/regs.h b/drivers/dma/dw/regs.h +index 09e7dfdbb790..646c9c960c07 100644 +--- a/drivers/dma/dw/regs.h ++++ b/drivers/dma/dw/regs.h +@@ -200,6 +200,10 @@ enum dw_dma_msize { + #define DWC_CFGH_FCMODE (1 << 0) + #define DWC_CFGH_FIFO_MODE (1 << 1) + #define DWC_CFGH_PROTCTL(x) ((x) << 2) ++#define DWC_CFGH_PROTCTL_DATA (0 << 2) /* data access - always set */ ++#define DWC_CFGH_PROTCTL_PRIV (1 << 2) /* privileged -> AHB HPROT[1] */ ++#define DWC_CFGH_PROTCTL_BUFFER (2 << 2) /* bufferable -> AHB HPROT[2] */ ++#define DWC_CFGH_PROTCTL_CACHE (4 << 2) /* cacheable -> AHB HPROT[3] */ + #define DWC_CFGH_DS_UPD_EN (1 << 5) + #define DWC_CFGH_SS_UPD_EN (1 << 6) + #define DWC_CFGH_SRC_PER(x) ((x) << 7) +diff --git a/drivers/extcon/extcon-max8997.c b/drivers/extcon/extcon-max8997.c +index 4a0612fb9c07..b9b48d45a6dc 100644 +--- a/drivers/extcon/extcon-max8997.c ++++ b/drivers/extcon/extcon-max8997.c +@@ -321,12 +321,10 @@ static int max8997_muic_handle_usb(struct max8997_muic_info *info, + { + int ret = 0; + +- if (usb_type == MAX8997_USB_HOST) { +- ret = max8997_muic_set_path(info, info->path_usb, attached); +- if (ret < 0) { +- dev_err(info->dev, "failed to update muic register\n"); +- return ret; +- } ++ ret = max8997_muic_set_path(info, info->path_usb, attached); ++ if (ret < 0) { ++ dev_err(info->dev, "failed to update muic register\n"); ++ return ret; + } + + switch (usb_type) { +diff --git a/drivers/firmware/qcom_scm-64.c b/drivers/firmware/qcom_scm-64.c +index 6e6d561708e2..e9001075f676 100644 +--- a/drivers/firmware/qcom_scm-64.c ++++ b/drivers/firmware/qcom_scm-64.c +@@ -158,7 +158,7 @@ static int qcom_scm_call(struct device *dev, u32 svc_id, u32 cmd_id, + kfree(args_virt); + } + +- if (res->a0 < 0) ++ if ((long)res->a0 < 0) + return qcom_scm_remap_error(res->a0); + + return 0; +diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c +index 715babaa886a..3aa7fe6baf2a 100644 +--- a/drivers/gpio/gpiolib-acpi.c ++++ b/drivers/gpio/gpiolib-acpi.c +@@ -1314,11 +1314,28 @@ late_initcall_sync(acpi_gpio_handle_deferred_request_irqs); + + static const struct dmi_system_id run_edge_events_on_boot_blacklist[] = { + { ++ /* ++ * The Minix Neo Z83-4 has a micro-USB-B id-pin handler for ++ * a non existing micro-USB-B connector which puts the HDMI ++ * DDC pins in GPIO mode, breaking HDMI support. ++ */ + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "MINIX"), + DMI_MATCH(DMI_PRODUCT_NAME, "Z83-4"), + } + }, ++ { ++ /* ++ * The Terra Pad 1061 has a micro-USB-B id-pin handler, which ++ * instead of controlling the actual micro-USB-B turns the 5V ++ * boost for its USB-A connector off. The actual micro-USB-B ++ * connector is wired for charging only. ++ */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Wortmann_AG"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "TERRA_PAD_1061"), ++ } ++ }, + {} /* Terminating entry */ + }; + +diff --git a/drivers/gpu/drm/i810/i810_dma.c b/drivers/gpu/drm/i810/i810_dma.c +index 576a417690d4..128d6cfb7bbb 100644 +--- a/drivers/gpu/drm/i810/i810_dma.c ++++ b/drivers/gpu/drm/i810/i810_dma.c +@@ -721,7 +721,7 @@ static void i810_dma_dispatch_vertex(struct drm_device *dev, + if (nbox > I810_NR_SAREA_CLIPRECTS) + nbox = I810_NR_SAREA_CLIPRECTS; + +- if (used > 4 * 1024) ++ if (used < 0 || used > 4 * 1024) + used = 0; + + if (sarea_priv->dirty) +@@ -1041,7 +1041,7 @@ static void i810_dma_dispatch_mc(struct drm_device *dev, struct drm_buf *buf, in + if (u != I810_BUF_CLIENT) + DRM_DEBUG("MC found buffer that isn't mine!\n"); + +- if (used > 4 * 1024) ++ if (used < 0 || used > 4 * 1024) + used = 0; + + sarea_priv->dirty = 0x7f; +diff --git a/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c b/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c +index 4e6eab53e34e..2f021c1a2fa6 100644 +--- a/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c ++++ b/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c +@@ -667,10 +667,13 @@ static ssize_t cyc_threshold_store(struct device *dev, + + if (kstrtoul(buf, 16, &val)) + return -EINVAL; ++ ++ /* mask off max threshold before checking min value */ ++ val &= ETM_CYC_THRESHOLD_MASK; + if (val < drvdata->ccitmin) + return -EINVAL; + +- config->ccctlr = val & ETM_CYC_THRESHOLD_MASK; ++ config->ccctlr = val; + return size; + } + static DEVICE_ATTR_RW(cyc_threshold); +@@ -701,14 +704,16 @@ static ssize_t bb_ctrl_store(struct device *dev, + return -EINVAL; + if (!drvdata->nr_addr_cmp) + return -EINVAL; ++ + /* +- * Bit[7:0] selects which address range comparator is used for +- * branch broadcast control. ++ * Bit[8] controls include(1) / exclude(0), bits[0-7] select ++ * individual range comparators. If include then at least 1 ++ * range must be selected. + */ +- if (BMVAL(val, 0, 7) > drvdata->nr_addr_cmp) ++ if ((val & BIT(8)) && (BMVAL(val, 0, 7) == 0)) + return -EINVAL; + +- config->bb_ctrl = val; ++ config->bb_ctrl = val & GENMASK(8, 0); + return size; + } + static DEVICE_ATTR_RW(bb_ctrl); +@@ -1341,8 +1346,8 @@ static ssize_t seq_event_store(struct device *dev, + + spin_lock(&drvdata->spinlock); + idx = config->seq_idx; +- /* RST, bits[7:0] */ +- config->seq_ctrl[idx] = val & 0xFF; ++ /* Seq control has two masks B[15:8] F[7:0] */ ++ config->seq_ctrl[idx] = val & 0xFFFF; + spin_unlock(&drvdata->spinlock); + return size; + } +@@ -1597,7 +1602,7 @@ static ssize_t res_ctrl_store(struct device *dev, + if (idx % 2 != 0) + /* PAIRINV, bit[21] */ + val &= ~BIT(21); +- config->res_ctrl[idx] = val; ++ config->res_ctrl[idx] = val & GENMASK(21, 0); + spin_unlock(&drvdata->spinlock); + return size; + } +diff --git a/drivers/hwtracing/intel_th/core.c b/drivers/hwtracing/intel_th/core.c +index 757801d27604..6a451b4fc04d 100644 +--- a/drivers/hwtracing/intel_th/core.c ++++ b/drivers/hwtracing/intel_th/core.c +@@ -628,10 +628,8 @@ intel_th_subdevice_alloc(struct intel_th *th, + } + + err = intel_th_device_add_resources(thdev, res, subdev->nres); +- if (err) { +- put_device(&thdev->dev); ++ if (err) + goto fail_put_device; +- } + + if (subdev->type == INTEL_TH_OUTPUT) { + thdev->dev.devt = MKDEV(th->major, th->num_thdevs); +@@ -644,10 +642,8 @@ intel_th_subdevice_alloc(struct intel_th *th, + } + + err = device_add(&thdev->dev); +- if (err) { +- put_device(&thdev->dev); ++ if (err) + goto fail_free_res; +- } + + /* need switch driver to be loaded to enumerate the rest */ + if (subdev->type == INTEL_TH_SWITCH && !req) { +diff --git a/drivers/hwtracing/intel_th/pci.c b/drivers/hwtracing/intel_th/pci.c +index 7486d5d67186..c224b92a80f1 100644 +--- a/drivers/hwtracing/intel_th/pci.c ++++ b/drivers/hwtracing/intel_th/pci.c +@@ -193,6 +193,16 @@ static const struct pci_device_id intel_th_pci_id_table[] = { + PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x45c5), + .driver_data = (kernel_ulong_t)&intel_th_2x, + }, ++ { ++ /* Ice Lake CPU */ ++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x8a29), ++ .driver_data = (kernel_ulong_t)&intel_th_2x, ++ }, ++ { ++ /* Tiger Lake CPU */ ++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x9a33), ++ .driver_data = (kernel_ulong_t)&intel_th_2x, ++ }, + { + /* Tiger Lake PCH */ + PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xa0a6), +diff --git a/drivers/i2c/busses/i2c-imx.c b/drivers/i2c/busses/i2c-imx.c +index b73dd837fb53..26f83029f64a 100644 +--- a/drivers/i2c/busses/i2c-imx.c ++++ b/drivers/i2c/busses/i2c-imx.c +@@ -1088,7 +1088,8 @@ static int i2c_imx_probe(struct platform_device *pdev) + /* Get I2C clock */ + i2c_imx->clk = devm_clk_get(&pdev->dev, NULL); + if (IS_ERR(i2c_imx->clk)) { +- dev_err(&pdev->dev, "can't get I2C clock\n"); ++ if (PTR_ERR(i2c_imx->clk) != -EPROBE_DEFER) ++ dev_err(&pdev->dev, "can't get I2C clock\n"); + return PTR_ERR(i2c_imx->clk); + } + +diff --git a/drivers/i2c/i2c-core-of.c b/drivers/i2c/i2c-core-of.c +index 8d474bb1dc15..17d727e0b842 100644 +--- a/drivers/i2c/i2c-core-of.c ++++ b/drivers/i2c/i2c-core-of.c +@@ -238,14 +238,14 @@ static int of_i2c_notify(struct notifier_block *nb, unsigned long action, + } + + client = of_i2c_register_device(adap, rd->dn); +- put_device(&adap->dev); +- + if (IS_ERR(client)) { + dev_err(&adap->dev, "failed to create client for '%pOF'\n", + rd->dn); ++ put_device(&adap->dev); + of_node_clear_flag(rd->dn, OF_POPULATED); + return notifier_from_errno(PTR_ERR(client)); + } ++ put_device(&adap->dev); + break; + case OF_RECONFIG_CHANGE_REMOVE: + /* already depopulated? */ +diff --git a/drivers/iio/humidity/hdc100x.c b/drivers/iio/humidity/hdc100x.c +index 7851bd90ef64..b470cb8132da 100644 +--- a/drivers/iio/humidity/hdc100x.c ++++ b/drivers/iio/humidity/hdc100x.c +@@ -237,7 +237,7 @@ static int hdc100x_read_raw(struct iio_dev *indio_dev, + *val2 = 65536; + return IIO_VAL_FRACTIONAL; + } else { +- *val = 100; ++ *val = 100000; + *val2 = 65536; + return IIO_VAL_FRACTIONAL; + } +diff --git a/drivers/iio/imu/adis16480.c b/drivers/iio/imu/adis16480.c +index 6f975538996c..c950aa10d0ae 100644 +--- a/drivers/iio/imu/adis16480.c ++++ b/drivers/iio/imu/adis16480.c +@@ -724,6 +724,7 @@ static const struct iio_info adis16480_info = { + .write_raw = &adis16480_write_raw, + .update_scan_mode = adis_update_scan_mode, + .driver_module = THIS_MODULE, ++ .debugfs_reg_access = adis_debugfs_reg_access, + }; + + static int adis16480_stop_device(struct iio_dev *indio_dev) +diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c +index 9dcdc0a8685e..9f78bb07744c 100644 +--- a/drivers/infiniband/hw/hfi1/chip.c ++++ b/drivers/infiniband/hw/hfi1/chip.c +@@ -1074,6 +1074,8 @@ static void log_state_transition(struct hfi1_pportdata *ppd, u32 state); + static void log_physical_state(struct hfi1_pportdata *ppd, u32 state); + static int wait_physical_linkstate(struct hfi1_pportdata *ppd, u32 state, + int msecs); ++static int wait_phys_link_out_of_offline(struct hfi1_pportdata *ppd, ++ int msecs); + static void read_planned_down_reason_code(struct hfi1_devdata *dd, u8 *pdrrc); + static void read_link_down_reason(struct hfi1_devdata *dd, u8 *ldr); + static void handle_temp_err(struct hfi1_devdata *dd); +@@ -10731,13 +10733,15 @@ int set_link_state(struct hfi1_pportdata *ppd, u32 state) + break; + + ppd->port_error_action = 0; +- ppd->host_link_state = HLS_DN_POLL; + + if (quick_linkup) { + /* quick linkup does not go into polling */ + ret = do_quick_linkup(dd); + } else { + ret1 = set_physical_link_state(dd, PLS_POLLING); ++ if (!ret1) ++ ret1 = wait_phys_link_out_of_offline(ppd, ++ 3000); + if (ret1 != HCMD_SUCCESS) { + dd_dev_err(dd, + "Failed to transition to Polling link state, return 0x%x\n", +@@ -10745,6 +10749,14 @@ int set_link_state(struct hfi1_pportdata *ppd, u32 state) + ret = -EINVAL; + } + } ++ ++ /* ++ * Change the host link state after requesting DC8051 to ++ * change its physical state so that we can ignore any ++ * interrupt with stale LNI(XX) error, which will not be ++ * cleared until DC8051 transitions to Polling state. ++ */ ++ ppd->host_link_state = HLS_DN_POLL; + ppd->offline_disabled_reason = + HFI1_ODR_MASK(OPA_LINKDOWN_REASON_NONE); + /* +@@ -12870,6 +12882,39 @@ static int wait_phys_link_offline_substates(struct hfi1_pportdata *ppd, + return read_state; + } + ++/* ++ * wait_phys_link_out_of_offline - wait for any out of offline state ++ * @ppd: port device ++ * @msecs: the number of milliseconds to wait ++ * ++ * Wait up to msecs milliseconds for any out of offline physical link ++ * state change to occur. ++ * Returns 0 if at least one state is reached, otherwise -ETIMEDOUT. ++ */ ++static int wait_phys_link_out_of_offline(struct hfi1_pportdata *ppd, ++ int msecs) ++{ ++ u32 read_state; ++ unsigned long timeout; ++ ++ timeout = jiffies + msecs_to_jiffies(msecs); ++ while (1) { ++ read_state = read_physical_state(ppd->dd); ++ if ((read_state & 0xF0) != PLS_OFFLINE) ++ break; ++ if (time_after(jiffies, timeout)) { ++ dd_dev_err(ppd->dd, ++ "timeout waiting for phy link out of offline. Read state 0x%x, %dms\n", ++ read_state, msecs); ++ return -ETIMEDOUT; ++ } ++ usleep_range(1950, 2050); /* sleep 2ms-ish */ ++ } ++ ++ log_state_transition(ppd, read_state); ++ return read_state; ++} ++ + #define CLEAR_STATIC_RATE_CONTROL_SMASK(r) \ + (r &= ~SEND_CTXT_CHECK_ENABLE_DISALLOW_PBC_STATIC_RATE_CONTROL_SMASK) + +diff --git a/drivers/infiniband/hw/hfi1/vnic_sdma.c b/drivers/infiniband/hw/hfi1/vnic_sdma.c +index c3c96c5869ed..718dcdef946e 100644 +--- a/drivers/infiniband/hw/hfi1/vnic_sdma.c ++++ b/drivers/infiniband/hw/hfi1/vnic_sdma.c +@@ -57,7 +57,6 @@ + + #define HFI1_VNIC_TXREQ_NAME_LEN 32 + #define HFI1_VNIC_SDMA_DESC_WTRMRK 64 +-#define HFI1_VNIC_SDMA_RETRY_COUNT 1 + + /* + * struct vnic_txreq - VNIC transmit descriptor +@@ -67,7 +66,6 @@ + * @pad: pad buffer + * @plen: pad length + * @pbc_val: pbc value +- * @retry_count: tx retry count + */ + struct vnic_txreq { + struct sdma_txreq txreq; +@@ -77,8 +75,6 @@ struct vnic_txreq { + unsigned char pad[HFI1_VNIC_MAX_PAD]; + u16 plen; + __le64 pbc_val; +- +- u32 retry_count; + }; + + static void vnic_sdma_complete(struct sdma_txreq *txreq, +@@ -196,7 +192,6 @@ int hfi1_vnic_send_dma(struct hfi1_devdata *dd, u8 q_idx, + ret = build_vnic_tx_desc(sde, tx, pbc); + if (unlikely(ret)) + goto free_desc; +- tx->retry_count = 0; + + ret = sdma_send_txreq(sde, &vnic_sdma->wait, &tx->txreq, + vnic_sdma->pkts_sent); +@@ -238,14 +233,14 @@ static int hfi1_vnic_sdma_sleep(struct sdma_engine *sde, + struct hfi1_vnic_sdma *vnic_sdma = + container_of(wait, struct hfi1_vnic_sdma, wait); + struct hfi1_ibdev *dev = &vnic_sdma->dd->verbs_dev; +- struct vnic_txreq *tx = container_of(txreq, struct vnic_txreq, txreq); + +- if (sdma_progress(sde, seq, txreq)) +- if (tx->retry_count++ < HFI1_VNIC_SDMA_RETRY_COUNT) +- return -EAGAIN; ++ write_seqlock(&dev->iowait_lock); ++ if (sdma_progress(sde, seq, txreq)) { ++ write_sequnlock(&dev->iowait_lock); ++ return -EAGAIN; ++ } + + vnic_sdma->state = HFI1_VNIC_SDMA_Q_DEFERRED; +- write_seqlock(&dev->iowait_lock); + if (list_empty(&vnic_sdma->wait.list)) + iowait_queue(pkts_sent, wait, &sde->dmawait); + write_sequnlock(&dev->iowait_lock); +diff --git a/drivers/infiniband/hw/hns/hns_roce_hem.h b/drivers/infiniband/hw/hns/hns_roce_hem.h +index 435748858252..8e8917ebb013 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_hem.h ++++ b/drivers/infiniband/hw/hns/hns_roce_hem.h +@@ -52,7 +52,7 @@ enum { + + #define HNS_ROCE_HEM_CHUNK_LEN \ + ((256 - sizeof(struct list_head) - 2 * sizeof(int)) / \ +- (sizeof(struct scatterlist))) ++ (sizeof(struct scatterlist) + sizeof(void *))) + + enum { + HNS_ROCE_HEM_PAGE_SHIFT = 12, +diff --git a/drivers/infiniband/hw/mlx4/sysfs.c b/drivers/infiniband/hw/mlx4/sysfs.c +index e219093d2764..d2da28d613f2 100644 +--- a/drivers/infiniband/hw/mlx4/sysfs.c ++++ b/drivers/infiniband/hw/mlx4/sysfs.c +@@ -353,16 +353,12 @@ err: + + static void get_name(struct mlx4_ib_dev *dev, char *name, int i, int max) + { +- char base_name[9]; +- +- /* pci_name format is: bus:dev:func -> xxxx:yy:zz.n */ +- strlcpy(name, pci_name(dev->dev->persist->pdev), max); +- strncpy(base_name, name, 8); /*till xxxx:yy:*/ +- base_name[8] = '\0'; +- /* with no ARI only 3 last bits are used so when the fn is higher than 8 ++ /* pci_name format is: bus:dev:func -> xxxx:yy:zz.n ++ * with no ARI only 3 last bits are used so when the fn is higher than 8 + * need to add it to the dev num, so count in the last number will be + * modulo 8 */ +- sprintf(name, "%s%.2d.%d", base_name, (i/8), (i%8)); ++ snprintf(name, max, "%.8s%.2d.%d", pci_name(dev->dev->persist->pdev), ++ i / 8, i % 8); + } + + struct mlx4_port { +diff --git a/drivers/infiniband/hw/qib/qib_sysfs.c b/drivers/infiniband/hw/qib/qib_sysfs.c +index ca2638d8f35e..d831f3e61ae8 100644 +--- a/drivers/infiniband/hw/qib/qib_sysfs.c ++++ b/drivers/infiniband/hw/qib/qib_sysfs.c +@@ -301,6 +301,9 @@ static ssize_t qib_portattr_show(struct kobject *kobj, + struct qib_pportdata *ppd = + container_of(kobj, struct qib_pportdata, pport_kobj); + ++ if (!pattr->show) ++ return -EIO; ++ + return pattr->show(ppd, buf); + } + +@@ -312,6 +315,9 @@ static ssize_t qib_portattr_store(struct kobject *kobj, + struct qib_pportdata *ppd = + container_of(kobj, struct qib_pportdata, pport_kobj); + ++ if (!pattr->store) ++ return -EIO; ++ + return pattr->store(ppd, buf, len); + } + +diff --git a/drivers/input/joystick/psxpad-spi.c b/drivers/input/joystick/psxpad-spi.c +index 28b473f6cbb6..092096ee06b9 100644 +--- a/drivers/input/joystick/psxpad-spi.c ++++ b/drivers/input/joystick/psxpad-spi.c +@@ -292,7 +292,7 @@ static int psxpad_spi_probe(struct spi_device *spi) + if (!pad) + return -ENOMEM; + +- pdev = input_allocate_polled_device(); ++ pdev = devm_input_allocate_polled_device(&spi->dev); + if (!pdev) { + dev_err(&spi->dev, "failed to allocate input device\n"); + return -ENOMEM; +diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c +index 7db53eab7012..111a71190547 100644 +--- a/drivers/input/mouse/synaptics.c ++++ b/drivers/input/mouse/synaptics.c +@@ -175,6 +175,7 @@ static const char * const smbus_pnp_ids[] = { + "LEN0071", /* T480 */ + "LEN0072", /* X1 Carbon Gen 5 (2017) - Elan/ALPS trackpoint */ + "LEN0073", /* X1 Carbon G5 (Elantech) */ ++ "LEN0091", /* X1 Carbon 6 */ + "LEN0092", /* X1 Carbon 6 */ + "LEN0093", /* T480 */ + "LEN0096", /* X280 */ +diff --git a/drivers/input/rmi4/rmi_f34v7.c b/drivers/input/rmi4/rmi_f34v7.c +index 3991d2943660..099dde68e332 100644 +--- a/drivers/input/rmi4/rmi_f34v7.c ++++ b/drivers/input/rmi4/rmi_f34v7.c +@@ -1192,6 +1192,9 @@ int rmi_f34v7_do_reflash(struct f34_data *f34, const struct firmware *fw) + { + int ret; + ++ f34->fn->rmi_dev->driver->set_irq_bits(f34->fn->rmi_dev, ++ f34->fn->irq_mask); ++ + rmi_f34v7_read_queries_bl_version(f34); + + f34->v7.image = fw->data; +diff --git a/drivers/input/rmi4/rmi_smbus.c b/drivers/input/rmi4/rmi_smbus.c +index b6ccf39c6a7b..4b2466cf2fb1 100644 +--- a/drivers/input/rmi4/rmi_smbus.c ++++ b/drivers/input/rmi4/rmi_smbus.c +@@ -166,7 +166,6 @@ static int rmi_smb_write_block(struct rmi_transport_dev *xport, u16 rmiaddr, + /* prepare to write next block of bytes */ + cur_len -= SMB_MAX_COUNT; + databuff += SMB_MAX_COUNT; +- rmiaddr += SMB_MAX_COUNT; + } + exit: + mutex_unlock(&rmi_smb->page_mutex); +@@ -218,7 +217,6 @@ static int rmi_smb_read_block(struct rmi_transport_dev *xport, u16 rmiaddr, + /* prepare to read next block of bytes */ + cur_len -= SMB_MAX_COUNT; + databuff += SMB_MAX_COUNT; +- rmiaddr += SMB_MAX_COUNT; + } + + retval = 0; +diff --git a/drivers/input/touchscreen/cyttsp4_core.c b/drivers/input/touchscreen/cyttsp4_core.c +index beaf61ce775b..a9af83de88bb 100644 +--- a/drivers/input/touchscreen/cyttsp4_core.c ++++ b/drivers/input/touchscreen/cyttsp4_core.c +@@ -1972,11 +1972,6 @@ static int cyttsp4_mt_probe(struct cyttsp4 *cd) + + /* get sysinfo */ + md->si = &cd->sysinfo; +- if (!md->si) { +- dev_err(dev, "%s: Fail get sysinfo pointer from core p=%p\n", +- __func__, md->si); +- goto error_get_sysinfo; +- } + + rc = cyttsp4_setup_input_device(cd); + if (rc) +@@ -1986,8 +1981,6 @@ static int cyttsp4_mt_probe(struct cyttsp4 *cd) + + error_init_input: + input_free_device(md->input); +-error_get_sysinfo: +- input_set_drvdata(md->input, NULL); + error_alloc_failed: + dev_err(dev, "%s failed.\n", __func__); + return rc; +diff --git a/drivers/input/touchscreen/goodix.c b/drivers/input/touchscreen/goodix.c +index 2bfa89ec552c..777dd5b159d3 100644 +--- a/drivers/input/touchscreen/goodix.c ++++ b/drivers/input/touchscreen/goodix.c +@@ -92,6 +92,15 @@ static const unsigned long goodix_irq_flags[] = { + */ + static const struct dmi_system_id rotated_screen[] = { + #if defined(CONFIG_DMI) && defined(CONFIG_X86) ++ { ++ .ident = "Teclast X89", ++ .matches = { ++ /* tPAD is too generic, also match on bios date */ ++ DMI_MATCH(DMI_BOARD_VENDOR, "TECLAST"), ++ DMI_MATCH(DMI_BOARD_NAME, "tPAD"), ++ DMI_MATCH(DMI_BIOS_DATE, "12/19/2014"), ++ }, ++ }, + { + .ident = "WinBook TW100", + .matches = { +diff --git a/drivers/isdn/gigaset/usb-gigaset.c b/drivers/isdn/gigaset/usb-gigaset.c +index eade36dafa34..4c239f18240d 100644 +--- a/drivers/isdn/gigaset/usb-gigaset.c ++++ b/drivers/isdn/gigaset/usb-gigaset.c +@@ -574,8 +574,7 @@ static int gigaset_initcshw(struct cardstate *cs) + { + struct usb_cardstate *ucs; + +- cs->hw.usb = ucs = +- kmalloc(sizeof(struct usb_cardstate), GFP_KERNEL); ++ cs->hw.usb = ucs = kzalloc(sizeof(struct usb_cardstate), GFP_KERNEL); + if (!ucs) { + pr_err("out of memory\n"); + return -ENOMEM; +@@ -587,9 +586,6 @@ static int gigaset_initcshw(struct cardstate *cs) + ucs->bchars[3] = 0; + ucs->bchars[4] = 0x11; + ucs->bchars[5] = 0x13; +- ucs->bulk_out_buffer = NULL; +- ucs->bulk_out_urb = NULL; +- ucs->read_urb = NULL; + tasklet_init(&cs->write_tasklet, + gigaset_modem_fill, (unsigned long) cs); + +@@ -688,6 +684,11 @@ static int gigaset_probe(struct usb_interface *interface, + return -ENODEV; + } + ++ if (hostif->desc.bNumEndpoints < 2) { ++ dev_err(&interface->dev, "missing endpoints\n"); ++ return -ENODEV; ++ } ++ + dev_info(&udev->dev, "%s: Device matched ... !\n", __func__); + + /* allocate memory for our device state and initialize it */ +@@ -707,6 +708,12 @@ static int gigaset_probe(struct usb_interface *interface, + + endpoint = &hostif->endpoint[0].desc; + ++ if (!usb_endpoint_is_bulk_out(endpoint)) { ++ dev_err(&interface->dev, "missing bulk-out endpoint\n"); ++ retval = -ENODEV; ++ goto error; ++ } ++ + buffer_size = le16_to_cpu(endpoint->wMaxPacketSize); + ucs->bulk_out_size = buffer_size; + ucs->bulk_out_epnum = usb_endpoint_num(endpoint); +@@ -726,6 +733,12 @@ static int gigaset_probe(struct usb_interface *interface, + + endpoint = &hostif->endpoint[1].desc; + ++ if (!usb_endpoint_is_int_in(endpoint)) { ++ dev_err(&interface->dev, "missing int-in endpoint\n"); ++ retval = -ENODEV; ++ goto error; ++ } ++ + ucs->busy = 0; + + ucs->read_urb = usb_alloc_urb(0, GFP_KERNEL); +diff --git a/drivers/md/dm-zoned-metadata.c b/drivers/md/dm-zoned-metadata.c +index b322821a6323..9b78f4a74a12 100644 +--- a/drivers/md/dm-zoned-metadata.c ++++ b/drivers/md/dm-zoned-metadata.c +@@ -552,6 +552,7 @@ static struct dmz_mblock *dmz_get_mblock(struct dmz_metadata *zmd, + TASK_UNINTERRUPTIBLE); + if (test_bit(DMZ_META_ERROR, &mblk->state)) { + dmz_release_mblock(zmd, mblk); ++ dmz_check_bdev(zmd->dev); + return ERR_PTR(-EIO); + } + +@@ -623,6 +624,8 @@ static int dmz_rdwr_block(struct dmz_metadata *zmd, int op, sector_t block, + ret = submit_bio_wait(bio); + bio_put(bio); + ++ if (ret) ++ dmz_check_bdev(zmd->dev); + return ret; + } + +@@ -689,6 +692,7 @@ static int dmz_write_dirty_mblocks(struct dmz_metadata *zmd, + TASK_UNINTERRUPTIBLE); + if (test_bit(DMZ_META_ERROR, &mblk->state)) { + clear_bit(DMZ_META_ERROR, &mblk->state); ++ dmz_check_bdev(zmd->dev); + ret = -EIO; + } + nr_mblks_submitted--; +@@ -766,7 +770,7 @@ int dmz_flush_metadata(struct dmz_metadata *zmd) + /* If there are no dirty metadata blocks, just flush the device cache */ + if (list_empty(&write_list)) { + ret = blkdev_issue_flush(zmd->dev->bdev, GFP_NOIO, NULL); +- goto out; ++ goto err; + } + + /* +@@ -776,7 +780,7 @@ int dmz_flush_metadata(struct dmz_metadata *zmd) + */ + ret = dmz_log_dirty_mblocks(zmd, &write_list); + if (ret) +- goto out; ++ goto err; + + /* + * The log is on disk. It is now safe to update in place +@@ -784,11 +788,11 @@ int dmz_flush_metadata(struct dmz_metadata *zmd) + */ + ret = dmz_write_dirty_mblocks(zmd, &write_list, zmd->mblk_primary); + if (ret) +- goto out; ++ goto err; + + ret = dmz_write_sb(zmd, zmd->mblk_primary); + if (ret) +- goto out; ++ goto err; + + while (!list_empty(&write_list)) { + mblk = list_first_entry(&write_list, struct dmz_mblock, link); +@@ -803,16 +807,20 @@ int dmz_flush_metadata(struct dmz_metadata *zmd) + + zmd->sb_gen++; + out: +- if (ret && !list_empty(&write_list)) { +- spin_lock(&zmd->mblk_lock); +- list_splice(&write_list, &zmd->mblk_dirty_list); +- spin_unlock(&zmd->mblk_lock); +- } +- + dmz_unlock_flush(zmd); + up_write(&zmd->mblk_sem); + + return ret; ++ ++err: ++ if (!list_empty(&write_list)) { ++ spin_lock(&zmd->mblk_lock); ++ list_splice(&write_list, &zmd->mblk_dirty_list); ++ spin_unlock(&zmd->mblk_lock); ++ } ++ if (!dmz_check_bdev(zmd->dev)) ++ ret = -EIO; ++ goto out; + } + + /* +@@ -1235,6 +1243,7 @@ static int dmz_update_zone(struct dmz_metadata *zmd, struct dm_zone *zone) + if (ret) { + dmz_dev_err(zmd->dev, "Get zone %u report failed", + dmz_id(zmd, zone)); ++ dmz_check_bdev(zmd->dev); + return ret; + } + +diff --git a/drivers/md/dm-zoned-reclaim.c b/drivers/md/dm-zoned-reclaim.c +index a9f84a998476..2fad512dce98 100644 +--- a/drivers/md/dm-zoned-reclaim.c ++++ b/drivers/md/dm-zoned-reclaim.c +@@ -81,6 +81,7 @@ static int dmz_reclaim_align_wp(struct dmz_reclaim *zrc, struct dm_zone *zone, + "Align zone %u wp %llu to %llu (wp+%u) blocks failed %d", + dmz_id(zmd, zone), (unsigned long long)wp_block, + (unsigned long long)block, nr_blocks, ret); ++ dmz_check_bdev(zrc->dev); + return ret; + } + +@@ -490,12 +491,7 @@ static void dmz_reclaim_work(struct work_struct *work) + ret = dmz_do_reclaim(zrc); + if (ret) { + dmz_dev_debug(zrc->dev, "Reclaim error %d\n", ret); +- if (ret == -EIO) +- /* +- * LLD might be performing some error handling sequence +- * at the underlying device. To not interfere, do not +- * attempt to schedule the next reclaim run immediately. +- */ ++ if (!dmz_check_bdev(zrc->dev)) + return; + } + +diff --git a/drivers/md/dm-zoned-target.c b/drivers/md/dm-zoned-target.c +index 4694763f9d40..497a2bc5da51 100644 +--- a/drivers/md/dm-zoned-target.c ++++ b/drivers/md/dm-zoned-target.c +@@ -79,6 +79,8 @@ static inline void dmz_bio_endio(struct bio *bio, blk_status_t status) + + if (status != BLK_STS_OK && bio->bi_status == BLK_STS_OK) + bio->bi_status = status; ++ if (bio->bi_status != BLK_STS_OK) ++ bioctx->target->dev->flags |= DMZ_CHECK_BDEV; + + if (atomic_dec_and_test(&bioctx->ref)) { + struct dm_zone *zone = bioctx->zone; +@@ -564,31 +566,51 @@ out: + } + + /* +- * Check the backing device availability. If it's on the way out, ++ * Check if the backing device is being removed. If it's on the way out, + * start failing I/O. Reclaim and metadata components also call this + * function to cleanly abort operation in the event of such failure. + */ + bool dmz_bdev_is_dying(struct dmz_dev *dmz_dev) + { +- struct gendisk *disk; ++ if (dmz_dev->flags & DMZ_BDEV_DYING) ++ return true; + +- if (!(dmz_dev->flags & DMZ_BDEV_DYING)) { +- disk = dmz_dev->bdev->bd_disk; +- if (blk_queue_dying(bdev_get_queue(dmz_dev->bdev))) { +- dmz_dev_warn(dmz_dev, "Backing device queue dying"); +- dmz_dev->flags |= DMZ_BDEV_DYING; +- } else if (disk->fops->check_events) { +- if (disk->fops->check_events(disk, 0) & +- DISK_EVENT_MEDIA_CHANGE) { +- dmz_dev_warn(dmz_dev, "Backing device offline"); +- dmz_dev->flags |= DMZ_BDEV_DYING; +- } +- } ++ if (dmz_dev->flags & DMZ_CHECK_BDEV) ++ return !dmz_check_bdev(dmz_dev); ++ ++ if (blk_queue_dying(bdev_get_queue(dmz_dev->bdev))) { ++ dmz_dev_warn(dmz_dev, "Backing device queue dying"); ++ dmz_dev->flags |= DMZ_BDEV_DYING; + } + + return dmz_dev->flags & DMZ_BDEV_DYING; + } + ++/* ++ * Check the backing device availability. This detects such events as ++ * backing device going offline due to errors, media removals, etc. ++ * This check is less efficient than dmz_bdev_is_dying() and should ++ * only be performed as a part of error handling. ++ */ ++bool dmz_check_bdev(struct dmz_dev *dmz_dev) ++{ ++ struct gendisk *disk; ++ ++ dmz_dev->flags &= ~DMZ_CHECK_BDEV; ++ ++ if (dmz_bdev_is_dying(dmz_dev)) ++ return false; ++ ++ disk = dmz_dev->bdev->bd_disk; ++ if (disk->fops->check_events && ++ disk->fops->check_events(disk, 0) & DISK_EVENT_MEDIA_CHANGE) { ++ dmz_dev_warn(dmz_dev, "Backing device offline"); ++ dmz_dev->flags |= DMZ_BDEV_DYING; ++ } ++ ++ return !(dmz_dev->flags & DMZ_BDEV_DYING); ++} ++ + /* + * Process a new BIO. + */ +@@ -901,8 +923,8 @@ static int dmz_prepare_ioctl(struct dm_target *ti, + { + struct dmz_target *dmz = ti->private; + +- if (dmz_bdev_is_dying(dmz->dev)) +- return -ENODEV; ++ if (!dmz_check_bdev(dmz->dev)) ++ return -EIO; + + *bdev = dmz->dev->bdev; + +diff --git a/drivers/md/dm-zoned.h b/drivers/md/dm-zoned.h +index 93a64529f219..2662746ba8b9 100644 +--- a/drivers/md/dm-zoned.h ++++ b/drivers/md/dm-zoned.h +@@ -71,6 +71,7 @@ struct dmz_dev { + + /* Device flags. */ + #define DMZ_BDEV_DYING (1 << 0) ++#define DMZ_CHECK_BDEV (2 << 0) + + /* + * Zone descriptor. +@@ -254,5 +255,6 @@ void dmz_schedule_reclaim(struct dmz_reclaim *zrc); + * Functions defined in dm-zoned-target.c + */ + bool dmz_bdev_is_dying(struct dmz_dev *dmz_dev); ++bool dmz_check_bdev(struct dmz_dev *dmz_dev); + + #endif /* DM_ZONED_H */ +diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c +index 449c4dd060fc..204adde004a3 100644 +--- a/drivers/md/raid0.c ++++ b/drivers/md/raid0.c +@@ -616,7 +616,7 @@ static bool raid0_make_request(struct mddev *mddev, struct bio *bio) + tmp_dev = map_sector(mddev, zone, sector, §or); + break; + default: +- WARN("md/raid0:%s: Invalid layout\n", mdname(mddev)); ++ WARN(1, "md/raid0:%s: Invalid layout\n", mdname(mddev)); + bio_io_error(bio); + return true; + } +diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c +index 4c49bed40f1f..d5c14d56a714 100644 +--- a/drivers/md/raid5.c ++++ b/drivers/md/raid5.c +@@ -5721,7 +5721,7 @@ static bool raid5_make_request(struct mddev *mddev, struct bio * bi) + do_flush = false; + } + +- if (!sh->batch_head) ++ if (!sh->batch_head || sh == sh->batch_head) + set_bit(STRIPE_HANDLE, &sh->state); + clear_bit(STRIPE_DELAYED, &sh->state); + if ((!sh->batch_head || sh == sh->batch_head) && +diff --git a/drivers/media/cec/cec-adap.c b/drivers/media/cec/cec-adap.c +index f8a808d45034..27e57915eb4d 100644 +--- a/drivers/media/cec/cec-adap.c ++++ b/drivers/media/cec/cec-adap.c +@@ -1403,6 +1403,13 @@ configured: + las->log_addr[i], + cec_phys_addr_exp(adap->phys_addr)); + cec_transmit_msg_fh(adap, &msg, NULL, false); ++ ++ /* Report Vendor ID */ ++ if (adap->log_addrs.vendor_id != CEC_VENDOR_ID_NONE) { ++ cec_msg_device_vendor_id(&msg, ++ adap->log_addrs.vendor_id); ++ cec_transmit_msg_fh(adap, &msg, NULL, false); ++ } + } + adap->kthread_config = NULL; + complete(&adap->config_completion); +diff --git a/drivers/media/platform/qcom/venus/vdec.c b/drivers/media/platform/qcom/venus/vdec.c +index c9e9576bb08a..5f0965593a0d 100644 +--- a/drivers/media/platform/qcom/venus/vdec.c ++++ b/drivers/media/platform/qcom/venus/vdec.c +@@ -1060,9 +1060,6 @@ static const struct v4l2_file_operations vdec_fops = { + .unlocked_ioctl = video_ioctl2, + .poll = v4l2_m2m_fop_poll, + .mmap = v4l2_m2m_fop_mmap, +-#ifdef CONFIG_COMPAT +- .compat_ioctl32 = v4l2_compat_ioctl32, +-#endif + }; + + static int vdec_probe(struct platform_device *pdev) +diff --git a/drivers/media/platform/qcom/venus/venc.c b/drivers/media/platform/qcom/venus/venc.c +index 3fcf0e9b7b29..a8af4a09485e 100644 +--- a/drivers/media/platform/qcom/venus/venc.c ++++ b/drivers/media/platform/qcom/venus/venc.c +@@ -1166,9 +1166,6 @@ static const struct v4l2_file_operations venc_fops = { + .unlocked_ioctl = video_ioctl2, + .poll = v4l2_m2m_fop_poll, + .mmap = v4l2_m2m_fop_mmap, +-#ifdef CONFIG_COMPAT +- .compat_ioctl32 = v4l2_compat_ioctl32, +-#endif + }; + + static int venc_probe(struct platform_device *pdev) +diff --git a/drivers/media/platform/sti/bdisp/bdisp-v4l2.c b/drivers/media/platform/sti/bdisp/bdisp-v4l2.c +index 939da6da7644..601ca2b2ecd3 100644 +--- a/drivers/media/platform/sti/bdisp/bdisp-v4l2.c ++++ b/drivers/media/platform/sti/bdisp/bdisp-v4l2.c +@@ -651,8 +651,7 @@ static int bdisp_release(struct file *file) + + dev_dbg(bdisp->dev, "%s\n", __func__); + +- if (mutex_lock_interruptible(&bdisp->lock)) +- return -ERESTARTSYS; ++ mutex_lock(&bdisp->lock); + + v4l2_m2m_ctx_release(ctx->fh.m2m_ctx); + +diff --git a/drivers/media/platform/vimc/vimc-common.c b/drivers/media/platform/vimc/vimc-common.c +index 743554de724d..a9ab3871ccda 100644 +--- a/drivers/media/platform/vimc/vimc-common.c ++++ b/drivers/media/platform/vimc/vimc-common.c +@@ -241,6 +241,8 @@ int vimc_pipeline_s_stream(struct media_entity *ent, int enable) + + /* Start the stream in the subdevice direct connected */ + pad = media_entity_remote_pad(&ent->pads[i]); ++ if (!pad) ++ continue; + + if (!is_media_entity_v4l2_subdev(pad->entity)) + return -EINVAL; +diff --git a/drivers/media/platform/vimc/vimc-core.c b/drivers/media/platform/vimc/vimc-core.c +index 57e5d6a020b0..447a01ff4e23 100644 +--- a/drivers/media/platform/vimc/vimc-core.c ++++ b/drivers/media/platform/vimc/vimc-core.c +@@ -243,10 +243,7 @@ static void vimc_comp_unbind(struct device *master) + + static int vimc_comp_compare(struct device *comp, void *data) + { +- const struct platform_device *pdev = to_platform_device(comp); +- const char *name = data; +- +- return !strcmp(pdev->dev.platform_data, name); ++ return comp == data; + } + + static struct component_match *vimc_add_subdevs(struct vimc_device *vimc) +@@ -275,7 +272,7 @@ static struct component_match *vimc_add_subdevs(struct vimc_device *vimc) + } + + component_match_add(&vimc->pdev.dev, &match, vimc_comp_compare, +- (void *)vimc->pipe_cfg->ents[i].name); ++ &vimc->subdevs[i]->dev); + } + + return match; +diff --git a/drivers/media/radio/radio-wl1273.c b/drivers/media/radio/radio-wl1273.c +index 903fcd5e99c0..fc1ae86911b9 100644 +--- a/drivers/media/radio/radio-wl1273.c ++++ b/drivers/media/radio/radio-wl1273.c +@@ -1156,8 +1156,7 @@ static int wl1273_fm_fops_release(struct file *file) + if (radio->rds_users > 0) { + radio->rds_users--; + if (radio->rds_users == 0) { +- if (mutex_lock_interruptible(&core->lock)) +- return -EINTR; ++ mutex_lock(&core->lock); + + radio->irq_flags &= ~WL1273_RDS_EVENT; + +diff --git a/drivers/media/usb/pulse8-cec/pulse8-cec.c b/drivers/media/usb/pulse8-cec/pulse8-cec.c +index 50146f263d90..12da631c0fda 100644 +--- a/drivers/media/usb/pulse8-cec/pulse8-cec.c ++++ b/drivers/media/usb/pulse8-cec/pulse8-cec.c +@@ -585,7 +585,7 @@ unlock: + else + pulse8->config_pending = true; + mutex_unlock(&pulse8->config_lock); +- return err; ++ return log_addr == CEC_LOG_ADDR_INVALID ? 0 : err; + } + + static int pulse8_cec_adap_transmit(struct cec_adapter *adap, u8 attempts, +diff --git a/drivers/media/usb/stkwebcam/stk-webcam.c b/drivers/media/usb/stkwebcam/stk-webcam.c +index a7da1356a36e..6992e84f8a8b 100644 +--- a/drivers/media/usb/stkwebcam/stk-webcam.c ++++ b/drivers/media/usb/stkwebcam/stk-webcam.c +@@ -164,7 +164,11 @@ int stk_camera_read_reg(struct stk_camera *dev, u16 index, u8 *value) + *value = *buf; + + kfree(buf); +- return ret; ++ ++ if (ret < 0) ++ return ret; ++ else ++ return 0; + } + + static int stk_start_stream(struct stk_camera *dev) +diff --git a/drivers/misc/altera-stapl/altera.c b/drivers/misc/altera-stapl/altera.c +index f53e217e963f..494e263daa74 100644 +--- a/drivers/misc/altera-stapl/altera.c ++++ b/drivers/misc/altera-stapl/altera.c +@@ -2176,8 +2176,7 @@ static int altera_get_note(u8 *p, s32 program_size, + key_ptr = &p[note_strings + + get_unaligned_be32( + &p[note_table + (8 * i)])]; +- if ((strncasecmp(key, key_ptr, strlen(key_ptr)) == 0) && +- (key != NULL)) { ++ if (key && !strncasecmp(key, key_ptr, strlen(key_ptr))) { + status = 0; + + value_ptr = &p[note_strings + +diff --git a/drivers/mmc/host/omap_hsmmc.c b/drivers/mmc/host/omap_hsmmc.c +index 3f3ff7530b76..ea12712bd2c3 100644 +--- a/drivers/mmc/host/omap_hsmmc.c ++++ b/drivers/mmc/host/omap_hsmmc.c +@@ -1678,6 +1678,36 @@ static void omap_hsmmc_init_card(struct mmc_host *mmc, struct mmc_card *card) + + if (mmc_pdata(host)->init_card) + mmc_pdata(host)->init_card(card); ++ else if (card->type == MMC_TYPE_SDIO || ++ card->type == MMC_TYPE_SD_COMBO) { ++ struct device_node *np = mmc_dev(mmc)->of_node; ++ ++ /* ++ * REVISIT: should be moved to sdio core and made more ++ * general e.g. by expanding the DT bindings of child nodes ++ * to provide a mechanism to provide this information: ++ * Documentation/devicetree/bindings/mmc/mmc-card.txt ++ */ ++ ++ np = of_get_compatible_child(np, "ti,wl1251"); ++ if (np) { ++ /* ++ * We have TI wl1251 attached to MMC3. Pass this ++ * information to the SDIO core because it can't be ++ * probed by normal methods. ++ */ ++ ++ dev_info(host->dev, "found wl1251\n"); ++ card->quirks |= MMC_QUIRK_NONSTD_SDIO; ++ card->cccr.wide_bus = 1; ++ card->cis.vendor = 0x104c; ++ card->cis.device = 0x9066; ++ card->cis.blksize = 512; ++ card->cis.max_dtr = 24000000; ++ card->ocr = 0x80; ++ of_node_put(np); ++ } ++ } + } + + static void omap_hsmmc_enable_sdio_irq(struct mmc_host *mmc, int enable) +diff --git a/drivers/mtd/devices/spear_smi.c b/drivers/mtd/devices/spear_smi.c +index ddf478976013..c2922e129db8 100644 +--- a/drivers/mtd/devices/spear_smi.c ++++ b/drivers/mtd/devices/spear_smi.c +@@ -595,6 +595,26 @@ static int spear_mtd_read(struct mtd_info *mtd, loff_t from, size_t len, + return 0; + } + ++/* ++ * The purpose of this function is to ensure a memcpy_toio() with byte writes ++ * only. Its structure is inspired from the ARM implementation of _memcpy_toio() ++ * which also does single byte writes but cannot be used here as this is just an ++ * implementation detail and not part of the API. Not mentioning the comment ++ * stating that _memcpy_toio() should be optimized. ++ */ ++static void spear_smi_memcpy_toio_b(volatile void __iomem *dest, ++ const void *src, size_t len) ++{ ++ const unsigned char *from = src; ++ ++ while (len) { ++ len--; ++ writeb(*from, dest); ++ from++; ++ dest++; ++ } ++} ++ + static inline int spear_smi_cpy_toio(struct spear_smi *dev, u32 bank, + void __iomem *dest, const void *src, size_t len) + { +@@ -617,7 +637,23 @@ static inline int spear_smi_cpy_toio(struct spear_smi *dev, u32 bank, + ctrlreg1 = readl(dev->io_base + SMI_CR1); + writel((ctrlreg1 | WB_MODE) & ~SW_MODE, dev->io_base + SMI_CR1); + +- memcpy_toio(dest, src, len); ++ /* ++ * In Write Burst mode (WB_MODE), the specs states that writes must be: ++ * - incremental ++ * - of the same size ++ * The ARM implementation of memcpy_toio() will optimize the number of ++ * I/O by using as much 4-byte writes as possible, surrounded by ++ * 2-byte/1-byte access if: ++ * - the destination is not 4-byte aligned ++ * - the length is not a multiple of 4-byte. ++ * Avoid this alternance of write access size by using our own 'byte ++ * access' helper if at least one of the two conditions above is true. ++ */ ++ if (IS_ALIGNED(len, sizeof(u32)) && ++ IS_ALIGNED((uintptr_t)dest, sizeof(u32))) ++ memcpy_toio(dest, src, len); ++ else ++ spear_smi_memcpy_toio_b(dest, src, len); + + writel(ctrlreg1, dev->io_base + SMI_CR1); + +diff --git a/drivers/net/can/slcan.c b/drivers/net/can/slcan.c +index 49427f44dc5b..a42737b4ac79 100644 +--- a/drivers/net/can/slcan.c ++++ b/drivers/net/can/slcan.c +@@ -613,6 +613,7 @@ err_free_chan: + sl->tty = NULL; + tty->disc_data = NULL; + clear_bit(SLF_INUSE, &sl->flags); ++ slc_free_netdev(sl->dev); + free_netdev(sl->dev); + + err_exit: +diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c +index be17194487c6..10ea01459a36 100644 +--- a/drivers/net/dsa/mv88e6xxx/chip.c ++++ b/drivers/net/dsa/mv88e6xxx/chip.c +@@ -2196,11 +2196,22 @@ static int mv88e6xxx_mdio_read(struct mii_bus *bus, int phy, int reg) + mutex_unlock(&chip->reg_lock); + + if (reg == MII_PHYSID2) { +- /* Some internal PHYS don't have a model number. Use +- * the mv88e6390 family model number instead. +- */ +- if (!(val & 0x3f0)) +- val |= MV88E6XXX_PORT_SWITCH_ID_PROD_6390 >> 4; ++ /* Some internal PHYs don't have a model number. */ ++ if (chip->info->family != MV88E6XXX_FAMILY_6165) ++ /* Then there is the 6165 family. It gets is ++ * PHYs correct. But it can also have two ++ * SERDES interfaces in the PHY address ++ * space. And these don't have a model ++ * number. But they are not PHYs, so we don't ++ * want to give them something a PHY driver ++ * will recognise. ++ * ++ * Use the mv88e6390 family model number ++ * instead, for anything which really could be ++ * a PHY, ++ */ ++ if (!(val & 0x3f0)) ++ val |= MV88E6XXX_PORT_SWITCH_ID_PROD_6390 >> 4; + } + + return err ? err : val; +diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h b/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h +index 57e796870595..ea4b7e97c61e 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h ++++ b/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h +@@ -40,8 +40,8 @@ + #define AQ_CFG_IS_LRO_DEF 1U + + /* RSS */ +-#define AQ_CFG_RSS_INDIRECTION_TABLE_MAX 128U +-#define AQ_CFG_RSS_HASHKEY_SIZE 320U ++#define AQ_CFG_RSS_INDIRECTION_TABLE_MAX 64U ++#define AQ_CFG_RSS_HASHKEY_SIZE 40U + + #define AQ_CFG_IS_RSS_DEF 1U + #define AQ_CFG_NUM_RSS_QUEUES_DEF AQ_CFG_VECS_DEF +diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c +index cc658a29cc33..a69f5f1ad32a 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c ++++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c +@@ -43,7 +43,7 @@ static void aq_nic_rss_init(struct aq_nic_s *self, unsigned int num_rss_queues) + struct aq_rss_parameters *rss_params = &cfg->aq_rss; + int i = 0; + +- static u8 rss_key[40] = { ++ static u8 rss_key[AQ_CFG_RSS_HASHKEY_SIZE] = { + 0x1e, 0xad, 0x71, 0x87, 0x65, 0xfc, 0x26, 0x7d, + 0x0d, 0x45, 0x67, 0x74, 0xcd, 0x06, 0x1a, 0x18, + 0xb6, 0xc1, 0xf0, 0xc7, 0xbb, 0x18, 0xbe, 0xf8, +diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c b/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c +index 8996ebbd222e..26ba18ea08c6 100644 +--- a/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c ++++ b/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c +@@ -714,6 +714,10 @@ static int adapter_up(struct adapter *adapter) + + if (adapter->flags & USING_MSIX) + name_msix_vecs(adapter); ++ ++ /* Initialize hash mac addr list*/ ++ INIT_LIST_HEAD(&adapter->mac_hlist); ++ + adapter->flags |= FULL_INIT_DONE; + } + +@@ -739,8 +743,6 @@ static int adapter_up(struct adapter *adapter) + enable_rx(adapter); + t4vf_sge_start(adapter); + +- /* Initialize hash mac addr list*/ +- INIT_LIST_HEAD(&adapter->mac_hlist); + return 0; + } + +diff --git a/drivers/net/ethernet/cirrus/ep93xx_eth.c b/drivers/net/ethernet/cirrus/ep93xx_eth.c +index e2a702996db4..82bd918bf967 100644 +--- a/drivers/net/ethernet/cirrus/ep93xx_eth.c ++++ b/drivers/net/ethernet/cirrus/ep93xx_eth.c +@@ -767,6 +767,7 @@ static int ep93xx_eth_remove(struct platform_device *pdev) + { + struct net_device *dev; + struct ep93xx_priv *ep; ++ struct resource *mem; + + dev = platform_get_drvdata(pdev); + if (dev == NULL) +@@ -782,8 +783,8 @@ static int ep93xx_eth_remove(struct platform_device *pdev) + iounmap(ep->base_addr); + + if (ep->res != NULL) { +- release_resource(ep->res); +- kfree(ep->res); ++ mem = platform_get_resource(pdev, IORESOURCE_MEM, 0); ++ release_mem_region(mem->start, resource_size(mem)); + } + + free_netdev(dev); +diff --git a/drivers/net/ethernet/huawei/hinic/hinic_main.c b/drivers/net/ethernet/huawei/hinic/hinic_main.c +index a696b5b2d40e..44c73215d026 100644 +--- a/drivers/net/ethernet/huawei/hinic/hinic_main.c ++++ b/drivers/net/ethernet/huawei/hinic/hinic_main.c +@@ -598,9 +598,6 @@ static int add_mac_addr(struct net_device *netdev, const u8 *addr) + u16 vid = 0; + int err; + +- if (!is_valid_ether_addr(addr)) +- return -EADDRNOTAVAIL; +- + netif_info(nic_dev, drv, netdev, "set mac addr = %02x %02x %02x %02x %02x %02x\n", + addr[0], addr[1], addr[2], addr[3], addr[4], addr[5]); + +@@ -724,6 +721,7 @@ static void set_rx_mode(struct work_struct *work) + { + struct hinic_rx_mode_work *rx_mode_work = work_to_rx_mode_work(work); + struct hinic_dev *nic_dev = rx_mode_work_to_nic_dev(rx_mode_work); ++ struct netdev_hw_addr *ha; + + netif_info(nic_dev, drv, nic_dev->netdev, "set rx mode work\n"); + +@@ -731,6 +729,9 @@ static void set_rx_mode(struct work_struct *work) + + __dev_uc_sync(nic_dev->netdev, add_mac_addr, remove_mac_addr); + __dev_mc_sync(nic_dev->netdev, add_mac_addr, remove_mac_addr); ++ ++ netdev_for_each_mc_addr(ha, nic_dev->netdev) ++ add_mac_addr(nic_dev->netdev, ha->addr); + } + + static void hinic_set_rx_mode(struct net_device *netdev) +diff --git a/drivers/net/ethernet/intel/e100.c b/drivers/net/ethernet/intel/e100.c +index 4d10270ddf8f..90974462743b 100644 +--- a/drivers/net/ethernet/intel/e100.c ++++ b/drivers/net/ethernet/intel/e100.c +@@ -1370,8 +1370,8 @@ static inline int e100_load_ucode_wait(struct nic *nic) + + fw = e100_request_firmware(nic); + /* If it's NULL, then no ucode is required */ +- if (!fw || IS_ERR(fw)) +- return PTR_ERR(fw); ++ if (IS_ERR_OR_NULL(fw)) ++ return PTR_ERR_OR_ZERO(fw); + + if ((err = e100_exec_cb(nic, (void *)fw, e100_setup_ucode))) + netif_err(nic, probe, nic->netdev, +diff --git a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c +index ef22793d6a03..751ac5616884 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c +@@ -969,6 +969,7 @@ static int i40e_set_pauseparam(struct net_device *netdev, + i40e_status status; + u8 aq_failures; + int err = 0; ++ u32 is_an; + + /* Changing the port's flow control is not supported if this isn't the + * port's controlling PF +@@ -981,15 +982,14 @@ static int i40e_set_pauseparam(struct net_device *netdev, + if (vsi != pf->vsi[pf->lan_vsi]) + return -EOPNOTSUPP; + +- if (pause->autoneg != ((hw_link_info->an_info & I40E_AQ_AN_COMPLETED) ? +- AUTONEG_ENABLE : AUTONEG_DISABLE)) { ++ is_an = hw_link_info->an_info & I40E_AQ_AN_COMPLETED; ++ if (pause->autoneg != is_an) { + netdev_info(netdev, "To change autoneg please use: ethtool -s autoneg \n"); + return -EOPNOTSUPP; + } + + /* If we have link and don't have autoneg */ +- if (!test_bit(__I40E_DOWN, pf->state) && +- !(hw_link_info->an_info & I40E_AQ_AN_COMPLETED)) { ++ if (!test_bit(__I40E_DOWN, pf->state) && !is_an) { + /* Send message that it might not necessarily work*/ + netdev_info(netdev, "Autoneg did not complete so changing settings may not result in an actual change.\n"); + } +@@ -1040,7 +1040,7 @@ static int i40e_set_pauseparam(struct net_device *netdev, + err = -EAGAIN; + } + +- if (!test_bit(__I40E_DOWN, pf->state)) { ++ if (!test_bit(__I40E_DOWN, pf->state) && is_an) { + /* Give it a little more time to try to come back */ + msleep(75); + if (!test_bit(__I40E_DOWN, pf->state)) +diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c +index c273a3ebb8e8..12d4b891301b 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/main.c ++++ b/drivers/net/ethernet/mellanox/mlx4/main.c +@@ -199,7 +199,7 @@ int mlx4_check_port_params(struct mlx4_dev *dev, + for (i = 0; i < dev->caps.num_ports - 1; i++) { + if (port_type[i] != port_type[i + 1]) { + mlx4_err(dev, "Only same port types supported on this HCA, aborting\n"); +- return -EINVAL; ++ return -EOPNOTSUPP; + } + } + } +@@ -208,7 +208,7 @@ int mlx4_check_port_params(struct mlx4_dev *dev, + if (!(port_type[i] & dev->caps.supported_type[i+1])) { + mlx4_err(dev, "Requested port type for port %d is not supported on this HCA\n", + i + 1); +- return -EINVAL; ++ return -EOPNOTSUPP; + } + } + return 0; +@@ -1152,8 +1152,7 @@ static int __set_port_type(struct mlx4_port_info *info, + mlx4_err(mdev, + "Requested port type for port %d is not supported on this HCA\n", + info->port); +- err = -EINVAL; +- goto err_sup; ++ return -EOPNOTSUPP; + } + + mlx4_stop_sense(mdev); +@@ -1175,7 +1174,7 @@ static int __set_port_type(struct mlx4_port_info *info, + for (i = 1; i <= mdev->caps.num_ports; i++) { + if (mdev->caps.possible_type[i] == MLX4_PORT_TYPE_AUTO) { + mdev->caps.possible_type[i] = mdev->caps.port_type[i]; +- err = -EINVAL; ++ err = -EOPNOTSUPP; + } + } + } +@@ -1201,7 +1200,7 @@ static int __set_port_type(struct mlx4_port_info *info, + out: + mlx4_start_sense(mdev); + mutex_unlock(&priv->port_mutex); +-err_sup: ++ + return err; + } + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c +index f6beb5ef5971..c3f1e2d76a46 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c +@@ -1625,7 +1625,7 @@ static int mlx5e_get_module_info(struct net_device *netdev, + break; + case MLX5_MODULE_ID_SFP: + modinfo->type = ETH_MODULE_SFF_8472; +- modinfo->eeprom_len = MLX5_EEPROM_PAGE_LENGTH; ++ modinfo->eeprom_len = ETH_MODULE_SFF_8472_LEN; + break; + default: + netdev_err(priv->netdev, "%s: cable type not recognized:0x%x\n", +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/qp.c b/drivers/net/ethernet/mellanox/mlx5/core/qp.c +index 889130edb715..5f091c6ea049 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/qp.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/qp.c +@@ -124,7 +124,7 @@ void mlx5_rsc_event(struct mlx5_core_dev *dev, u32 rsn, int event_type) + if (!is_event_type_allowed((rsn >> MLX5_USER_INDEX_LEN), event_type)) { + mlx5_core_warn(dev, "event 0x%.2x is not allowed on resource 0x%.8x\n", + event_type, rsn); +- return; ++ goto out; + } + + switch (common->res) { +@@ -138,7 +138,7 @@ void mlx5_rsc_event(struct mlx5_core_dev *dev, u32 rsn, int event_type) + default: + mlx5_core_warn(dev, "invalid resource type for 0x%x\n", rsn); + } +- ++out: + mlx5_core_put_rsc(common); + } + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c +index 3ed4fb346f23..05a2006a20b9 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c +@@ -1252,15 +1252,12 @@ mlxsw_sp_ipip_entry_matches_decap(struct mlxsw_sp *mlxsw_sp, + { + u32 ul_tb_id = l3mdev_fib_table(ul_dev) ? : RT_TABLE_MAIN; + enum mlxsw_sp_ipip_type ipipt = ipip_entry->ipipt; +- struct net_device *ipip_ul_dev; + + if (mlxsw_sp->router->ipip_ops_arr[ipipt]->ul_proto != ul_proto) + return false; + +- ipip_ul_dev = __mlxsw_sp_ipip_netdev_ul_dev_get(ipip_entry->ol_dev); + return mlxsw_sp_ipip_entry_saddr_matches(mlxsw_sp, ul_proto, ul_dip, +- ul_tb_id, ipip_entry) && +- (!ipip_ul_dev || ipip_ul_dev == ul_dev); ++ ul_tb_id, ipip_entry); + } + + /* Given decap parameters, find the corresponding IPIP entry. */ +@@ -1765,7 +1762,7 @@ static void mlxsw_sp_router_probe_unresolved_nexthops(struct work_struct *work) + static void + mlxsw_sp_nexthop_neigh_update(struct mlxsw_sp *mlxsw_sp, + struct mlxsw_sp_neigh_entry *neigh_entry, +- bool removing); ++ bool removing, bool dead); + + static enum mlxsw_reg_rauht_op mlxsw_sp_rauht_op(bool adding) + { +@@ -1894,7 +1891,8 @@ static void mlxsw_sp_router_neigh_event_work(struct work_struct *work) + + memcpy(neigh_entry->ha, ha, ETH_ALEN); + mlxsw_sp_neigh_entry_update(mlxsw_sp, neigh_entry, entry_connected); +- mlxsw_sp_nexthop_neigh_update(mlxsw_sp, neigh_entry, !entry_connected); ++ mlxsw_sp_nexthop_neigh_update(mlxsw_sp, neigh_entry, !entry_connected, ++ dead); + + if (!neigh_entry->connected && list_empty(&neigh_entry->nexthop_list)) + mlxsw_sp_neigh_entry_destroy(mlxsw_sp, neigh_entry); +@@ -2538,13 +2536,79 @@ static void __mlxsw_sp_nexthop_neigh_update(struct mlxsw_sp_nexthop *nh, + nh->update = 1; + } + ++static int ++mlxsw_sp_nexthop_dead_neigh_replace(struct mlxsw_sp *mlxsw_sp, ++ struct mlxsw_sp_neigh_entry *neigh_entry) ++{ ++ struct neighbour *n, *old_n = neigh_entry->key.n; ++ struct mlxsw_sp_nexthop *nh; ++ bool entry_connected; ++ u8 nud_state, dead; ++ int err; ++ ++ nh = list_first_entry(&neigh_entry->nexthop_list, ++ struct mlxsw_sp_nexthop, neigh_list_node); ++ ++ n = neigh_lookup(nh->nh_grp->neigh_tbl, &nh->gw_addr, nh->rif->dev); ++ if (!n) { ++ n = neigh_create(nh->nh_grp->neigh_tbl, &nh->gw_addr, ++ nh->rif->dev); ++ if (IS_ERR(n)) ++ return PTR_ERR(n); ++ neigh_event_send(n, NULL); ++ } ++ ++ mlxsw_sp_neigh_entry_remove(mlxsw_sp, neigh_entry); ++ neigh_entry->key.n = n; ++ err = mlxsw_sp_neigh_entry_insert(mlxsw_sp, neigh_entry); ++ if (err) ++ goto err_neigh_entry_insert; ++ ++ read_lock_bh(&n->lock); ++ nud_state = n->nud_state; ++ dead = n->dead; ++ read_unlock_bh(&n->lock); ++ entry_connected = nud_state & NUD_VALID && !dead; ++ ++ list_for_each_entry(nh, &neigh_entry->nexthop_list, ++ neigh_list_node) { ++ neigh_release(old_n); ++ neigh_clone(n); ++ __mlxsw_sp_nexthop_neigh_update(nh, !entry_connected); ++ mlxsw_sp_nexthop_group_refresh(mlxsw_sp, nh->nh_grp); ++ } ++ ++ neigh_release(n); ++ ++ return 0; ++ ++err_neigh_entry_insert: ++ neigh_entry->key.n = old_n; ++ mlxsw_sp_neigh_entry_insert(mlxsw_sp, neigh_entry); ++ neigh_release(n); ++ return err; ++} ++ + static void + mlxsw_sp_nexthop_neigh_update(struct mlxsw_sp *mlxsw_sp, + struct mlxsw_sp_neigh_entry *neigh_entry, +- bool removing) ++ bool removing, bool dead) + { + struct mlxsw_sp_nexthop *nh; + ++ if (list_empty(&neigh_entry->nexthop_list)) ++ return; ++ ++ if (dead) { ++ int err; ++ ++ err = mlxsw_sp_nexthop_dead_neigh_replace(mlxsw_sp, ++ neigh_entry); ++ if (err) ++ dev_err(mlxsw_sp->bus_info->dev, "Failed to replace dead neigh\n"); ++ return; ++ } ++ + list_for_each_entry(nh, &neigh_entry->nexthop_list, + neigh_list_node) { + __mlxsw_sp_nexthop_neigh_update(nh, removing); +diff --git a/drivers/net/ethernet/ti/cpts.c b/drivers/net/ethernet/ti/cpts.c +index 7d1281d81248..23c953496a0d 100644 +--- a/drivers/net/ethernet/ti/cpts.c ++++ b/drivers/net/ethernet/ti/cpts.c +@@ -116,9 +116,7 @@ static bool cpts_match_tx_ts(struct cpts *cpts, struct cpts_event *event) + mtype, seqid); + } else if (time_after(jiffies, skb_cb->tmo)) { + /* timeout any expired skbs over 1s */ +- dev_dbg(cpts->dev, +- "expiring tx timestamp mtype %u seqid %04x\n", +- mtype, seqid); ++ dev_dbg(cpts->dev, "expiring tx timestamp from txq\n"); + __skb_unlink(skb, &cpts->txq); + dev_consume_skb_any(skb); + } +diff --git a/drivers/net/wireless/ath/ar5523/ar5523.c b/drivers/net/wireless/ath/ar5523/ar5523.c +index 68f0463ed8df..ad4a1efc57c9 100644 +--- a/drivers/net/wireless/ath/ar5523/ar5523.c ++++ b/drivers/net/wireless/ath/ar5523/ar5523.c +@@ -255,7 +255,8 @@ static int ar5523_cmd(struct ar5523 *ar, u32 code, const void *idata, + + if (flags & AR5523_CMD_FLAG_MAGIC) + hdr->magic = cpu_to_be32(1 << 24); +- memcpy(hdr + 1, idata, ilen); ++ if (ilen) ++ memcpy(hdr + 1, idata, ilen); + + cmd->odata = odata; + cmd->olen = olen; +diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c +index 0298ddc1ff06..f9e409caca68 100644 +--- a/drivers/net/wireless/ath/ath10k/pci.c ++++ b/drivers/net/wireless/ath/ath10k/pci.c +@@ -1771,6 +1771,11 @@ static void ath10k_pci_hif_stop(struct ath10k *ar) + + ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot hif stop\n"); + ++ ath10k_pci_irq_disable(ar); ++ ath10k_pci_irq_sync(ar); ++ napi_synchronize(&ar->napi); ++ napi_disable(&ar->napi); ++ + /* Most likely the device has HTT Rx ring configured. The only way to + * prevent the device from accessing (and possible corrupting) host + * memory is to reset the chip now. +@@ -1784,10 +1789,6 @@ static void ath10k_pci_hif_stop(struct ath10k *ar) + */ + ath10k_pci_safe_chip_reset(ar); + +- ath10k_pci_irq_disable(ar); +- ath10k_pci_irq_sync(ar); +- napi_synchronize(&ar->napi); +- napi_disable(&ar->napi); + ath10k_pci_flush(ar); + + spin_lock_irqsave(&ar_pci->ps_lock, flags); +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +index 77ed6ecf5ee5..b86c7a36d3f1 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +@@ -822,6 +822,21 @@ static void iwl_mvm_mac_tx(struct ieee80211_hw *hw, + !ieee80211_is_bufferable_mmpdu(hdr->frame_control)) + sta = NULL; + ++ /* If there is no sta, and it's not offchannel - send through AP */ ++ if (info->control.vif->type == NL80211_IFTYPE_STATION && ++ info->hw_queue != IWL_MVM_OFFCHANNEL_QUEUE && !sta) { ++ struct iwl_mvm_vif *mvmvif = ++ iwl_mvm_vif_from_mac80211(info->control.vif); ++ u8 ap_sta_id = READ_ONCE(mvmvif->ap_sta_id); ++ ++ if (ap_sta_id < IWL_MVM_STATION_COUNT) { ++ /* mac80211 holds rcu read lock */ ++ sta = rcu_dereference(mvm->fw_id_to_mac_id[ap_sta_id]); ++ if (IS_ERR_OR_NULL(sta)) ++ goto drop; ++ } ++ } ++ + if (sta) { + if (iwl_mvm_defer_tx(mvm, sta, skb)) + return; +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c +index d16e2ed4419f..0cfdbaa2af3a 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c +@@ -436,6 +436,16 @@ static int iwl_mvm_remove_sta_queue_marking(struct iwl_mvm *mvm, int queue) + + rcu_read_unlock(); + ++ /* ++ * The TX path may have been using this TXQ_ID from the tid_data, ++ * so make sure it's no longer running so that we can safely reuse ++ * this TXQ later. We've set all the TIDs to IWL_MVM_INVALID_QUEUE ++ * above, but nothing guarantees we've stopped using them. Thus, ++ * without this, we could get to iwl_mvm_disable_txq() and remove ++ * the queue while still sending frames to it. ++ */ ++ synchronize_net(); ++ + return disable_agg_tids; + } + +diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c +index 6f45c8148b27..bbb39d6ec2ee 100644 +--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c +@@ -232,27 +232,23 @@ static int iwl_pcie_gen2_build_amsdu(struct iwl_trans *trans, + struct ieee80211_hdr *hdr = (void *)skb->data; + unsigned int snap_ip_tcp_hdrlen, ip_hdrlen, total_len, hdr_room; + unsigned int mss = skb_shinfo(skb)->gso_size; +- u16 length, iv_len, amsdu_pad; ++ u16 length, amsdu_pad; + u8 *start_hdr; + struct iwl_tso_hdr_page *hdr_page; + struct page **page_ptr; + struct tso_t tso; + +- /* if the packet is protected, then it must be CCMP or GCMP */ +- iv_len = ieee80211_has_protected(hdr->frame_control) ? +- IEEE80211_CCMP_HDR_LEN : 0; +- + trace_iwlwifi_dev_tx(trans->dev, skb, tfd, sizeof(*tfd), + &dev_cmd->hdr, start_len, 0); + + ip_hdrlen = skb_transport_header(skb) - skb_network_header(skb); + snap_ip_tcp_hdrlen = 8 + ip_hdrlen + tcp_hdrlen(skb); +- total_len = skb->len - snap_ip_tcp_hdrlen - hdr_len - iv_len; ++ total_len = skb->len - snap_ip_tcp_hdrlen - hdr_len; + amsdu_pad = 0; + + /* total amount of header we may need for this A-MSDU */ + hdr_room = DIV_ROUND_UP(total_len, mss) * +- (3 + snap_ip_tcp_hdrlen + sizeof(struct ethhdr)) + iv_len; ++ (3 + snap_ip_tcp_hdrlen + sizeof(struct ethhdr)); + + /* Our device supports 9 segments at most, it will fit in 1 page */ + hdr_page = get_page_hdr(trans, hdr_room); +@@ -263,14 +259,12 @@ static int iwl_pcie_gen2_build_amsdu(struct iwl_trans *trans, + start_hdr = hdr_page->pos; + page_ptr = (void *)((u8 *)skb->cb + trans_pcie->page_offs); + *page_ptr = hdr_page->page; +- memcpy(hdr_page->pos, skb->data + hdr_len, iv_len); +- hdr_page->pos += iv_len; + + /* +- * Pull the ieee80211 header + IV to be able to use TSO core, ++ * Pull the ieee80211 header to be able to use TSO core, + * we will restore it for the tx_status flow. + */ +- skb_pull(skb, hdr_len + iv_len); ++ skb_pull(skb, hdr_len); + + /* + * Remove the length of all the headers that we don't actually +@@ -348,8 +342,8 @@ static int iwl_pcie_gen2_build_amsdu(struct iwl_trans *trans, + } + } + +- /* re -add the WiFi header and IV */ +- skb_push(skb, hdr_len + iv_len); ++ /* re -add the WiFi header */ ++ skb_push(skb, hdr_len); + + return 0; + +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/hw.c +index cf28d25c551f..80002292cd27 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/hw.c ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/hw.c +@@ -1198,6 +1198,7 @@ void rtl92de_enable_interrupt(struct ieee80211_hw *hw) + + rtl_write_dword(rtlpriv, REG_HIMR, rtlpci->irq_mask[0] & 0xFFFFFFFF); + rtl_write_dword(rtlpriv, REG_HIMRE, rtlpci->irq_mask[1] & 0xFFFFFFFF); ++ rtlpci->irq_enabled = true; + } + + void rtl92de_disable_interrupt(struct ieee80211_hw *hw) +@@ -1207,7 +1208,7 @@ void rtl92de_disable_interrupt(struct ieee80211_hw *hw) + + rtl_write_dword(rtlpriv, REG_HIMR, IMR8190_DISABLED); + rtl_write_dword(rtlpriv, REG_HIMRE, IMR8190_DISABLED); +- synchronize_irq(rtlpci->pdev->irq); ++ rtlpci->irq_enabled = false; + } + + static void _rtl92de_poweroff_adapter(struct ieee80211_hw *hw) +@@ -1378,7 +1379,7 @@ void rtl92de_set_beacon_related_registers(struct ieee80211_hw *hw) + + bcn_interval = mac->beacon_interval; + atim_window = 2; +- /*rtl92de_disable_interrupt(hw); */ ++ rtl92de_disable_interrupt(hw); + rtl_write_word(rtlpriv, REG_ATIMWND, atim_window); + rtl_write_word(rtlpriv, REG_BCN_INTERVAL, bcn_interval); + rtl_write_word(rtlpriv, REG_BCNTCFG, 0x660f); +@@ -1398,9 +1399,9 @@ void rtl92de_set_beacon_interval(struct ieee80211_hw *hw) + + RT_TRACE(rtlpriv, COMP_BEACON, DBG_DMESG, + "beacon_interval:%d\n", bcn_interval); +- /* rtl92de_disable_interrupt(hw); */ ++ rtl92de_disable_interrupt(hw); + rtl_write_word(rtlpriv, REG_BCN_INTERVAL, bcn_interval); +- /* rtl92de_enable_interrupt(hw); */ ++ rtl92de_enable_interrupt(hw); + } + + void rtl92de_update_interrupt_mask(struct ieee80211_hw *hw, +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/sw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/sw.c +index a6549f5f6c59..3ec75032b9be 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/sw.c ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/sw.c +@@ -237,6 +237,7 @@ static struct rtl_hal_ops rtl8192de_hal_ops = { + .led_control = rtl92de_led_control, + .set_desc = rtl92de_set_desc, + .get_desc = rtl92de_get_desc, ++ .is_tx_desc_closed = rtl92de_is_tx_desc_closed, + .tx_polling = rtl92de_tx_polling, + .enable_hw_sec = rtl92de_enable_hw_security_config, + .set_key = rtl92de_set_key, +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/trx.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/trx.c +index 86019f654428..d1e56e09cfe8 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/trx.c ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/trx.c +@@ -839,13 +839,15 @@ u32 rtl92de_get_desc(u8 *p_desc, bool istx, u8 desc_name) + break; + } + } else { +- struct rx_desc_92c *pdesc = (struct rx_desc_92c *)p_desc; + switch (desc_name) { + case HW_DESC_OWN: +- ret = GET_RX_DESC_OWN(pdesc); ++ ret = GET_RX_DESC_OWN(p_desc); + break; + case HW_DESC_RXPKT_LEN: +- ret = GET_RX_DESC_PKT_LEN(pdesc); ++ ret = GET_RX_DESC_PKT_LEN(p_desc); ++ break; ++ case HW_DESC_RXBUFF_ADDR: ++ ret = GET_RX_DESC_BUFF_ADDR(p_desc); + break; + default: + WARN_ONCE(true, "rtl8192de: ERR rxdesc :%d not processed\n", +@@ -856,6 +858,23 @@ u32 rtl92de_get_desc(u8 *p_desc, bool istx, u8 desc_name) + return ret; + } + ++bool rtl92de_is_tx_desc_closed(struct ieee80211_hw *hw, ++ u8 hw_queue, u16 index) ++{ ++ struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw)); ++ struct rtl8192_tx_ring *ring = &rtlpci->tx_ring[hw_queue]; ++ u8 *entry = (u8 *)(&ring->desc[ring->idx]); ++ u8 own = (u8)rtl92de_get_desc(entry, true, HW_DESC_OWN); ++ ++ /* a beacon packet will only use the first ++ * descriptor by defaut, and the own bit may not ++ * be cleared by the hardware ++ */ ++ if (own) ++ return false; ++ return true; ++} ++ + void rtl92de_tx_polling(struct ieee80211_hw *hw, u8 hw_queue) + { + struct rtl_priv *rtlpriv = rtl_priv(hw); +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/trx.h b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/trx.h +index 9bb6cc648590..6cf23c278953 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/trx.h ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/trx.h +@@ -736,6 +736,8 @@ bool rtl92de_rx_query_desc(struct ieee80211_hw *hw, + void rtl92de_set_desc(struct ieee80211_hw *hw, u8 *pdesc, bool istx, + u8 desc_name, u8 *val); + u32 rtl92de_get_desc(u8 *pdesc, bool istx, u8 desc_name); ++bool rtl92de_is_tx_desc_closed(struct ieee80211_hw *hw, ++ u8 hw_queue, u16 index); + void rtl92de_tx_polling(struct ieee80211_hw *hw, u8 hw_queue); + void rtl92de_tx_fill_cmddesc(struct ieee80211_hw *hw, u8 *pdesc, + bool b_firstseg, bool b_lastseg, +diff --git a/drivers/net/wireless/rsi/rsi_91x_mgmt.c b/drivers/net/wireless/rsi/rsi_91x_mgmt.c +index f7b550f900c4..234e41e1cb57 100644 +--- a/drivers/net/wireless/rsi/rsi_91x_mgmt.c ++++ b/drivers/net/wireless/rsi/rsi_91x_mgmt.c +@@ -1576,6 +1576,7 @@ static int rsi_send_beacon(struct rsi_common *common) + skb_pull(skb, (64 - dword_align_bytes)); + if (rsi_prepare_beacon(common, skb)) { + rsi_dbg(ERR_ZONE, "Failed to prepare beacon\n"); ++ dev_kfree_skb(skb); + return -EINVAL; + } + skb_queue_tail(&common->tx_queue[MGMT_BEACON_Q], skb); +diff --git a/drivers/nfc/nxp-nci/i2c.c b/drivers/nfc/nxp-nci/i2c.c +index 198585bbc771..d9492cffd00e 100644 +--- a/drivers/nfc/nxp-nci/i2c.c ++++ b/drivers/nfc/nxp-nci/i2c.c +@@ -236,8 +236,10 @@ static irqreturn_t nxp_nci_i2c_irq_thread_fn(int irq, void *phy_id) + + if (r == -EREMOTEIO) { + phy->hard_fault = r; +- skb = NULL; +- } else if (r < 0) { ++ if (info->mode == NXP_NCI_MODE_FW) ++ nxp_nci_fw_recv_frame(phy->ndev, NULL); ++ } ++ if (r < 0) { + nfc_err(&client->dev, "Read failed with error %d\n", r); + goto exit_irq_handled; + } +diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c +index 9d204649c963..4bf6a9db6ac0 100644 +--- a/drivers/of/unittest.c ++++ b/drivers/of/unittest.c +@@ -965,8 +965,10 @@ static void attach_node_and_children(struct device_node *np) + full_name = kasprintf(GFP_KERNEL, "%pOF", np); + + if (!strcmp(full_name, "/__local_fixups__") || +- !strcmp(full_name, "/__fixups__")) ++ !strcmp(full_name, "/__fixups__")) { ++ kfree(full_name); + return; ++ } + + dup = of_find_node_by_path(full_name); + kfree(full_name); +diff --git a/drivers/phy/renesas/phy-rcar-gen3-usb2.c b/drivers/phy/renesas/phy-rcar-gen3-usb2.c +index 7f5e36bfeee8..f8c7ce89d8d7 100644 +--- a/drivers/phy/renesas/phy-rcar-gen3-usb2.c ++++ b/drivers/phy/renesas/phy-rcar-gen3-usb2.c +@@ -22,6 +22,7 @@ + #include + #include + #include ++#include + #include + + /******* USB2.0 Host registers (original offset is +0x200) *******/ +@@ -234,9 +235,9 @@ static ssize_t role_store(struct device *dev, struct device_attribute *attr, + */ + is_b_device = rcar_gen3_check_id(ch); + is_host = rcar_gen3_is_host(ch); +- if (!strncmp(buf, "host", strlen("host"))) ++ if (sysfs_streq(buf, "host")) + new_mode_is_host = true; +- else if (!strncmp(buf, "peripheral", strlen("peripheral"))) ++ else if (sysfs_streq(buf, "peripheral")) + new_mode_is_host = false; + else + return -EINVAL; +diff --git a/drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c b/drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c +index 0e153bae322e..6bed433e5420 100644 +--- a/drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c ++++ b/drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c +@@ -762,12 +762,23 @@ static int pm8xxx_gpio_probe(struct platform_device *pdev) + return ret; + } + +- ret = gpiochip_add_pin_range(&pctrl->chip, +- dev_name(pctrl->dev), +- 0, 0, pctrl->chip.ngpio); +- if (ret) { +- dev_err(pctrl->dev, "failed to add pin range\n"); +- goto unregister_gpiochip; ++ /* ++ * For DeviceTree-supported systems, the gpio core checks the ++ * pinctrl's device node for the "gpio-ranges" property. ++ * If it is present, it takes care of adding the pin ranges ++ * for the driver. In this case the driver can skip ahead. ++ * ++ * In order to remain compatible with older, existing DeviceTree ++ * files which don't set the "gpio-ranges" property or systems that ++ * utilize ACPI the driver has to call gpiochip_add_pin_range(). ++ */ ++ if (!of_property_read_bool(pctrl->dev->of_node, "gpio-ranges")) { ++ ret = gpiochip_add_pin_range(&pctrl->chip, dev_name(pctrl->dev), ++ 0, 0, pctrl->chip.ngpio); ++ if (ret) { ++ dev_err(pctrl->dev, "failed to add pin range\n"); ++ goto unregister_gpiochip; ++ } + } + + platform_set_drvdata(pdev, pctrl); +diff --git a/drivers/pinctrl/samsung/pinctrl-exynos.c b/drivers/pinctrl/samsung/pinctrl-exynos.c +index c8d0de7ea160..1c534d823fd7 100644 +--- a/drivers/pinctrl/samsung/pinctrl-exynos.c ++++ b/drivers/pinctrl/samsung/pinctrl-exynos.c +@@ -467,8 +467,10 @@ int exynos_eint_wkup_init(struct samsung_pinctrl_drv_data *d) + if (match) { + irq_chip = kmemdup(match->data, + sizeof(*irq_chip), GFP_KERNEL); +- if (!irq_chip) ++ if (!irq_chip) { ++ of_node_put(np); + return -ENOMEM; ++ } + wkup_np = np; + break; + } +diff --git a/drivers/pinctrl/samsung/pinctrl-s3c24xx.c b/drivers/pinctrl/samsung/pinctrl-s3c24xx.c +index 67da1cf18b68..46b1a9b2238b 100644 +--- a/drivers/pinctrl/samsung/pinctrl-s3c24xx.c ++++ b/drivers/pinctrl/samsung/pinctrl-s3c24xx.c +@@ -495,8 +495,10 @@ static int s3c24xx_eint_init(struct samsung_pinctrl_drv_data *d) + return -ENODEV; + + eint_data = devm_kzalloc(dev, sizeof(*eint_data), GFP_KERNEL); +- if (!eint_data) ++ if (!eint_data) { ++ of_node_put(eint_np); + return -ENOMEM; ++ } + + eint_data->drvdata = d; + +@@ -508,12 +510,14 @@ static int s3c24xx_eint_init(struct samsung_pinctrl_drv_data *d) + irq = irq_of_parse_and_map(eint_np, i); + if (!irq) { + dev_err(dev, "failed to get wakeup EINT IRQ %d\n", i); ++ of_node_put(eint_np); + return -ENXIO; + } + + eint_data->parents[i] = irq; + irq_set_chained_handler_and_data(irq, handlers[i], eint_data); + } ++ of_node_put(eint_np); + + bank = d->pin_banks; + for (i = 0; i < d->nr_banks; ++i, ++bank) { +diff --git a/drivers/pinctrl/samsung/pinctrl-s3c64xx.c b/drivers/pinctrl/samsung/pinctrl-s3c64xx.c +index 0bdc1e683181..cf3a3af82321 100644 +--- a/drivers/pinctrl/samsung/pinctrl-s3c64xx.c ++++ b/drivers/pinctrl/samsung/pinctrl-s3c64xx.c +@@ -709,8 +709,10 @@ static int s3c64xx_eint_eint0_init(struct samsung_pinctrl_drv_data *d) + return -ENODEV; + + data = devm_kzalloc(dev, sizeof(*data), GFP_KERNEL); +- if (!data) ++ if (!data) { ++ of_node_put(eint0_np); + return -ENOMEM; ++ } + data->drvdata = d; + + for (i = 0; i < NUM_EINT0_IRQ; ++i) { +@@ -719,6 +721,7 @@ static int s3c64xx_eint_eint0_init(struct samsung_pinctrl_drv_data *d) + irq = irq_of_parse_and_map(eint0_np, i); + if (!irq) { + dev_err(dev, "failed to get wakeup EINT IRQ %d\n", i); ++ of_node_put(eint0_np); + return -ENXIO; + } + +@@ -726,6 +729,7 @@ static int s3c64xx_eint_eint0_init(struct samsung_pinctrl_drv_data *d) + s3c64xx_eint0_handlers[i], + data); + } ++ of_node_put(eint0_np); + + bank = d->pin_banks; + for (i = 0; i < d->nr_banks; ++i, ++bank) { +diff --git a/drivers/pinctrl/samsung/pinctrl-samsung.c b/drivers/pinctrl/samsung/pinctrl-samsung.c +index 26e8fab736f1..7c0f5d4e89f3 100644 +--- a/drivers/pinctrl/samsung/pinctrl-samsung.c ++++ b/drivers/pinctrl/samsung/pinctrl-samsung.c +@@ -277,6 +277,7 @@ static int samsung_dt_node_to_map(struct pinctrl_dev *pctldev, + &reserved_maps, num_maps); + if (ret < 0) { + samsung_dt_free_map(pctldev, *map, *num_maps); ++ of_node_put(np); + return ret; + } + } +@@ -761,8 +762,10 @@ static struct samsung_pmx_func *samsung_pinctrl_create_functions( + if (!of_get_child_count(cfg_np)) { + ret = samsung_pinctrl_create_function(dev, drvdata, + cfg_np, func); +- if (ret < 0) ++ if (ret < 0) { ++ of_node_put(cfg_np); + return ERR_PTR(ret); ++ } + if (ret > 0) { + ++func; + ++func_cnt; +@@ -773,8 +776,11 @@ static struct samsung_pmx_func *samsung_pinctrl_create_functions( + for_each_child_of_node(cfg_np, func_np) { + ret = samsung_pinctrl_create_function(dev, drvdata, + func_np, func); +- if (ret < 0) ++ if (ret < 0) { ++ of_node_put(func_np); ++ of_node_put(cfg_np); + return ERR_PTR(ret); ++ } + if (ret > 0) { + ++func; + ++func_cnt; +diff --git a/drivers/power/supply/cpcap-battery.c b/drivers/power/supply/cpcap-battery.c +index fe7fcf3a2ad0..7df9d432ee42 100644 +--- a/drivers/power/supply/cpcap-battery.c ++++ b/drivers/power/supply/cpcap-battery.c +@@ -82,7 +82,7 @@ struct cpcap_battery_config { + }; + + struct cpcap_coulomb_counter_data { +- s32 sample; /* 24-bits */ ++ s32 sample; /* 24 or 32 bits */ + s32 accumulator; + s16 offset; /* 10-bits */ + }; +@@ -213,7 +213,7 @@ static int cpcap_battery_get_current(struct cpcap_battery_ddata *ddata) + * TI or ST coulomb counter in the PMIC. + */ + static int cpcap_battery_cc_raw_div(struct cpcap_battery_ddata *ddata, +- u32 sample, s32 accumulator, ++ s32 sample, s32 accumulator, + s16 offset, u32 divider) + { + s64 acc; +@@ -224,7 +224,6 @@ static int cpcap_battery_cc_raw_div(struct cpcap_battery_ddata *ddata, + if (!divider) + return 0; + +- sample &= 0xffffff; /* 24-bits, unsigned */ + offset &= 0x7ff; /* 10-bits, signed */ + + switch (ddata->vendor) { +@@ -259,7 +258,7 @@ static int cpcap_battery_cc_raw_div(struct cpcap_battery_ddata *ddata, + + /* 3600000μAms = 1μAh */ + static int cpcap_battery_cc_to_uah(struct cpcap_battery_ddata *ddata, +- u32 sample, s32 accumulator, ++ s32 sample, s32 accumulator, + s16 offset) + { + return cpcap_battery_cc_raw_div(ddata, sample, +@@ -268,7 +267,7 @@ static int cpcap_battery_cc_to_uah(struct cpcap_battery_ddata *ddata, + } + + static int cpcap_battery_cc_to_ua(struct cpcap_battery_ddata *ddata, +- u32 sample, s32 accumulator, ++ s32 sample, s32 accumulator, + s16 offset) + { + return cpcap_battery_cc_raw_div(ddata, sample, +@@ -312,6 +311,8 @@ cpcap_battery_read_accumulated(struct cpcap_battery_ddata *ddata, + /* Sample value CPCAP_REG_CCS1 & 2 */ + ccd->sample = (buf[1] & 0x0fff) << 16; + ccd->sample |= buf[0]; ++ if (ddata->vendor == CPCAP_VENDOR_TI) ++ ccd->sample = sign_extend32(24, ccd->sample); + + /* Accumulator value CPCAP_REG_CCA1 & 2 */ + ccd->accumulator = ((s16)buf[3]) << 16; +diff --git a/drivers/rtc/rtc-max8997.c b/drivers/rtc/rtc-max8997.c +index db984d4bf952..4cce5bd448f6 100644 +--- a/drivers/rtc/rtc-max8997.c ++++ b/drivers/rtc/rtc-max8997.c +@@ -221,7 +221,7 @@ static int max8997_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alrm) + + out: + mutex_unlock(&info->lock); +- return 0; ++ return ret; + } + + static int max8997_rtc_stop_alarm(struct max8997_rtc_info *info) +diff --git a/drivers/rtc/rtc-s3c.c b/drivers/rtc/rtc-s3c.c +index a8992c227f61..4120a305954a 100644 +--- a/drivers/rtc/rtc-s3c.c ++++ b/drivers/rtc/rtc-s3c.c +@@ -327,7 +327,6 @@ static int s3c_rtc_setalarm(struct device *dev, struct rtc_wkalrm *alrm) + struct rtc_time *tm = &alrm->time; + unsigned int alrm_en; + int ret; +- int year = tm->tm_year - 100; + + dev_dbg(dev, "s3c_rtc_setalarm: %d, %04d.%02d.%02d %02d:%02d:%02d\n", + alrm->enabled, +@@ -356,11 +355,6 @@ static int s3c_rtc_setalarm(struct device *dev, struct rtc_wkalrm *alrm) + writeb(bin2bcd(tm->tm_hour), info->base + S3C2410_ALMHOUR); + } + +- if (year < 100 && year >= 0) { +- alrm_en |= S3C2410_RTCALM_YEAREN; +- writeb(bin2bcd(year), info->base + S3C2410_ALMYEAR); +- } +- + if (tm->tm_mon < 12 && tm->tm_mon >= 0) { + alrm_en |= S3C2410_RTCALM_MONEN; + writeb(bin2bcd(tm->tm_mon + 1), info->base + S3C2410_ALMMON); +diff --git a/drivers/s390/scsi/zfcp_dbf.c b/drivers/s390/scsi/zfcp_dbf.c +index 599447032e50..bc6c1d6a1c42 100644 +--- a/drivers/s390/scsi/zfcp_dbf.c ++++ b/drivers/s390/scsi/zfcp_dbf.c +@@ -94,11 +94,9 @@ void zfcp_dbf_hba_fsf_res(char *tag, int level, struct zfcp_fsf_req *req) + memcpy(rec->u.res.fsf_status_qual, &q_head->fsf_status_qual, + FSF_STATUS_QUALIFIER_SIZE); + +- if (req->fsf_command != FSF_QTCB_FCP_CMND) { +- rec->pl_len = q_head->log_length; +- zfcp_dbf_pl_write(dbf, (char *)q_pref + q_head->log_start, +- rec->pl_len, "fsf_res", req->req_id); +- } ++ rec->pl_len = q_head->log_length; ++ zfcp_dbf_pl_write(dbf, (char *)q_pref + q_head->log_start, ++ rec->pl_len, "fsf_res", req->req_id); + + debug_event(dbf->hba, level, rec, sizeof(*rec)); + spin_unlock_irqrestore(&dbf->hba_lock, flags); +diff --git a/drivers/s390/scsi/zfcp_erp.c b/drivers/s390/scsi/zfcp_erp.c +index 64d70de98cdb..8f90e4cea254 100644 +--- a/drivers/s390/scsi/zfcp_erp.c ++++ b/drivers/s390/scsi/zfcp_erp.c +@@ -179,9 +179,6 @@ static int zfcp_erp_handle_failed(int want, struct zfcp_adapter *adapter, + adapter, ZFCP_STATUS_COMMON_ERP_FAILED); + } + break; +- default: +- need = 0; +- break; + } + + return need; +diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h +index 03e95a3216c8..5fc41aa53ceb 100644 +--- a/drivers/scsi/lpfc/lpfc.h ++++ b/drivers/scsi/lpfc/lpfc.h +@@ -969,7 +969,8 @@ struct lpfc_hba { + struct list_head port_list; + struct lpfc_vport *pport; /* physical lpfc_vport pointer */ + uint16_t max_vpi; /* Maximum virtual nports */ +-#define LPFC_MAX_VPI 0xFFFF /* Max number of VPI supported */ ++#define LPFC_MAX_VPI 0xFF /* Max number VPI supported 0 - 0xff */ ++#define LPFC_MAX_VPORTS 0x100 /* Max vports per port, with pport */ + uint16_t max_vports; /* + * For IOV HBAs max_vpi can change + * after a reset. max_vports is max +diff --git a/drivers/scsi/lpfc/lpfc_attr.c b/drivers/scsi/lpfc/lpfc_attr.c +index 82ce5d193018..f447355cc9c0 100644 +--- a/drivers/scsi/lpfc/lpfc_attr.c ++++ b/drivers/scsi/lpfc/lpfc_attr.c +@@ -1478,6 +1478,9 @@ lpfc_get_hba_info(struct lpfc_hba *phba, + max_vpi = (bf_get(lpfc_mbx_rd_conf_vpi_count, rd_config) > 0) ? + (bf_get(lpfc_mbx_rd_conf_vpi_count, rd_config) - 1) : 0; + ++ /* Limit the max we support */ ++ if (max_vpi > LPFC_MAX_VPI) ++ max_vpi = LPFC_MAX_VPI; + if (mvpi) + *mvpi = max_vpi; + if (avpi) +@@ -1493,8 +1496,13 @@ lpfc_get_hba_info(struct lpfc_hba *phba, + *axri = pmb->un.varRdConfig.avail_xri; + if (mvpi) + *mvpi = pmb->un.varRdConfig.max_vpi; +- if (avpi) +- *avpi = pmb->un.varRdConfig.avail_vpi; ++ if (avpi) { ++ /* avail_vpi is only valid if link is up and ready */ ++ if (phba->link_state == LPFC_HBA_READY) ++ *avpi = pmb->un.varRdConfig.avail_vpi; ++ else ++ *avpi = pmb->un.varRdConfig.max_vpi; ++ } + } + + mempool_free(pmboxq, phba->mbox_mem_pool); +diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c +index c69c2a2b2ead..9fc5507ee39e 100644 +--- a/drivers/scsi/lpfc/lpfc_init.c ++++ b/drivers/scsi/lpfc/lpfc_init.c +@@ -7643,6 +7643,9 @@ lpfc_sli4_read_config(struct lpfc_hba *phba) + bf_get(lpfc_mbx_rd_conf_xri_base, rd_config); + phba->sli4_hba.max_cfg_param.max_vpi = + bf_get(lpfc_mbx_rd_conf_vpi_count, rd_config); ++ /* Limit the max we support */ ++ if (phba->sli4_hba.max_cfg_param.max_vpi > LPFC_MAX_VPORTS) ++ phba->sli4_hba.max_cfg_param.max_vpi = LPFC_MAX_VPORTS; + phba->sli4_hba.max_cfg_param.vpi_base = + bf_get(lpfc_mbx_rd_conf_vpi_base, rd_config); + phba->sli4_hba.max_cfg_param.max_rpi = +diff --git a/drivers/scsi/lpfc/lpfc_nvme.c b/drivers/scsi/lpfc/lpfc_nvme.c +index 6c4499db969c..fcf4b4175d77 100644 +--- a/drivers/scsi/lpfc/lpfc_nvme.c ++++ b/drivers/scsi/lpfc/lpfc_nvme.c +@@ -1544,7 +1544,6 @@ lpfc_nvme_fcp_abort(struct nvme_fc_local_port *pnvme_lport, + bf_set(abort_cmd_criteria, &abts_wqe->abort_cmd, T_XRI_TAG); + + /* word 7 */ +- bf_set(wqe_ct, &abts_wqe->abort_cmd.wqe_com, 0); + bf_set(wqe_cmnd, &abts_wqe->abort_cmd.wqe_com, CMD_ABORT_XRI_CX); + bf_set(wqe_class, &abts_wqe->abort_cmd.wqe_com, + nvmereq_wqe->iocb.ulpClass); +@@ -1559,7 +1558,6 @@ lpfc_nvme_fcp_abort(struct nvme_fc_local_port *pnvme_lport, + abts_buf->iotag); + + /* word 10 */ +- bf_set(wqe_wqid, &abts_wqe->abort_cmd.wqe_com, nvmereq_wqe->hba_wqidx); + bf_set(wqe_qosd, &abts_wqe->abort_cmd.wqe_com, 1); + bf_set(wqe_lenloc, &abts_wqe->abort_cmd.wqe_com, LPFC_WQE_LENLOC_NONE); + +diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c +index 62bea4ffdc25..d3bad0dbfaf7 100644 +--- a/drivers/scsi/lpfc/lpfc_sli.c ++++ b/drivers/scsi/lpfc/lpfc_sli.c +@@ -10722,19 +10722,12 @@ lpfc_sli4_abort_nvme_io(struct lpfc_hba *phba, struct lpfc_sli_ring *pring, + + /* Complete prepping the abort wqe and issue to the FW. */ + abts_wqe = &abtsiocbp->wqe; +- bf_set(abort_cmd_ia, &abts_wqe->abort_cmd, 0); +- bf_set(abort_cmd_criteria, &abts_wqe->abort_cmd, T_XRI_TAG); +- +- /* Explicitly set reserved fields to zero.*/ +- abts_wqe->abort_cmd.rsrvd4 = 0; +- abts_wqe->abort_cmd.rsrvd5 = 0; + +- /* WQE Common - word 6. Context is XRI tag. Set 0. */ +- bf_set(wqe_xri_tag, &abts_wqe->abort_cmd.wqe_com, 0); +- bf_set(wqe_ctxt_tag, &abts_wqe->abort_cmd.wqe_com, 0); ++ /* Clear any stale WQE contents */ ++ memset(abts_wqe, 0, sizeof(union lpfc_wqe)); ++ bf_set(abort_cmd_criteria, &abts_wqe->abort_cmd, T_XRI_TAG); + + /* word 7 */ +- bf_set(wqe_ct, &abts_wqe->abort_cmd.wqe_com, 0); + bf_set(wqe_cmnd, &abts_wqe->abort_cmd.wqe_com, CMD_ABORT_XRI_CX); + bf_set(wqe_class, &abts_wqe->abort_cmd.wqe_com, + cmdiocb->iocb.ulpClass); +@@ -10749,7 +10742,6 @@ lpfc_sli4_abort_nvme_io(struct lpfc_hba *phba, struct lpfc_sli_ring *pring, + abtsiocbp->iotag); + + /* word 10 */ +- bf_set(wqe_wqid, &abts_wqe->abort_cmd.wqe_com, cmdiocb->hba_wqidx); + bf_set(wqe_qosd, &abts_wqe->abort_cmd.wqe_com, 1); + bf_set(wqe_lenloc, &abts_wqe->abort_cmd.wqe_com, LPFC_WQE_LENLOC_NONE); + +diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c +index 1844c2f59460..656253285db9 100644 +--- a/drivers/scsi/qla2xxx/qla_attr.c ++++ b/drivers/scsi/qla2xxx/qla_attr.c +@@ -652,7 +652,8 @@ qla2x00_sysfs_write_reset(struct file *filp, struct kobject *kobj, + break; + } else { + /* Make sure FC side is not in reset */ +- qla2x00_wait_for_hba_online(vha); ++ WARN_ON_ONCE(qla2x00_wait_for_hba_online(vha) != ++ QLA_SUCCESS); + + /* Issue MPI reset */ + scsi_block_requests(vha->host); +diff --git a/drivers/scsi/qla2xxx/qla_bsg.c b/drivers/scsi/qla2xxx/qla_bsg.c +index 7472d3882ad4..c1ca21a88a09 100644 +--- a/drivers/scsi/qla2xxx/qla_bsg.c ++++ b/drivers/scsi/qla2xxx/qla_bsg.c +@@ -342,6 +342,8 @@ qla2x00_process_els(struct bsg_job *bsg_job) + dma_map_sg(&ha->pdev->dev, bsg_job->request_payload.sg_list, + bsg_job->request_payload.sg_cnt, DMA_TO_DEVICE); + if (!req_sg_cnt) { ++ dma_unmap_sg(&ha->pdev->dev, bsg_job->request_payload.sg_list, ++ bsg_job->request_payload.sg_cnt, DMA_TO_DEVICE); + rval = -ENOMEM; + goto done_free_fcport; + } +@@ -349,6 +351,8 @@ qla2x00_process_els(struct bsg_job *bsg_job) + rsp_sg_cnt = dma_map_sg(&ha->pdev->dev, bsg_job->reply_payload.sg_list, + bsg_job->reply_payload.sg_cnt, DMA_FROM_DEVICE); + if (!rsp_sg_cnt) { ++ dma_unmap_sg(&ha->pdev->dev, bsg_job->reply_payload.sg_list, ++ bsg_job->reply_payload.sg_cnt, DMA_FROM_DEVICE); + rval = -ENOMEM; + goto done_free_fcport; + } +@@ -1778,8 +1782,8 @@ qla24xx_process_bidir_cmd(struct bsg_job *bsg_job) + uint16_t nextlid = 0; + uint32_t tot_dsds; + srb_t *sp = NULL; +- uint32_t req_data_len = 0; +- uint32_t rsp_data_len = 0; ++ uint32_t req_data_len; ++ uint32_t rsp_data_len; + + /* Check the type of the adapter */ + if (!IS_BIDI_CAPABLE(ha)) { +@@ -1884,6 +1888,9 @@ qla24xx_process_bidir_cmd(struct bsg_job *bsg_job) + goto done_unmap_sg; + } + ++ req_data_len = bsg_job->request_payload.payload_len; ++ rsp_data_len = bsg_job->reply_payload.payload_len; ++ + if (req_data_len != rsp_data_len) { + rval = EXT_STATUS_BUSY; + ql_log(ql_log_warn, vha, 0x70aa, +@@ -1891,10 +1898,6 @@ qla24xx_process_bidir_cmd(struct bsg_job *bsg_job) + goto done_unmap_sg; + } + +- req_data_len = bsg_job->request_payload.payload_len; +- rsp_data_len = bsg_job->reply_payload.payload_len; +- +- + /* Alloc SRB structure */ + sp = qla2x00_get_sp(vha, &(vha->bidir_fcport), GFP_KERNEL); + if (!sp) { +diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c +index 0e154fea693e..bd2421863510 100644 +--- a/drivers/scsi/qla2xxx/qla_init.c ++++ b/drivers/scsi/qla2xxx/qla_init.c +@@ -8092,8 +8092,6 @@ int qla2xxx_delete_qpair(struct scsi_qla_host *vha, struct qla_qpair *qpair) + struct qla_hw_data *ha = qpair->hw; + + qpair->delete_in_progress = 1; +- while (atomic_read(&qpair->ref_count)) +- msleep(500); + + ret = qla25xx_delete_req_que(vha, qpair->req); + if (ret != QLA_SUCCESS) +diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c +index 6a76d7217515..ebca1a470e9b 100644 +--- a/drivers/scsi/qla2xxx/qla_isr.c ++++ b/drivers/scsi/qla2xxx/qla_isr.c +@@ -3369,10 +3369,8 @@ qla24xx_enable_msix(struct qla_hw_data *ha, struct rsp_que *rsp) + ha->msix_count, ret); + goto msix_out; + } else if (ret < ha->msix_count) { +- ql_log(ql_log_warn, vha, 0x00c6, +- "MSI-X: Failed to enable support " +- "with %d vectors, using %d vectors.\n", +- ha->msix_count, ret); ++ ql_log(ql_log_info, vha, 0x00c6, ++ "MSI-X: Using %d vectors\n", ret); + ha->msix_count = ret; + /* Recalculate queue values */ + if (ha->mqiobase && ql2xmqsupport) { +diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c +index 11753ed3433c..69ed544d80ef 100644 +--- a/drivers/scsi/qla2xxx/qla_target.c ++++ b/drivers/scsi/qla2xxx/qla_target.c +@@ -5918,7 +5918,6 @@ static void qlt_abort_work(struct qla_tgt *tgt, + struct qla_hw_data *ha = vha->hw; + struct fc_port *sess = NULL; + unsigned long flags = 0, flags2 = 0; +- uint32_t be_s_id; + uint8_t s_id[3]; + int rc; + +@@ -5931,8 +5930,7 @@ static void qlt_abort_work(struct qla_tgt *tgt, + s_id[1] = prm->abts.fcp_hdr_le.s_id[1]; + s_id[2] = prm->abts.fcp_hdr_le.s_id[0]; + +- sess = ha->tgt.tgt_ops->find_sess_by_s_id(vha, +- (unsigned char *)&be_s_id); ++ sess = ha->tgt.tgt_ops->find_sess_by_s_id(vha, s_id); + if (!sess) { + spin_unlock_irqrestore(&ha->tgt.sess_lock, flags2); + +@@ -6396,7 +6394,8 @@ qlt_enable_vha(struct scsi_qla_host *vha) + } else { + set_bit(ISP_ABORT_NEEDED, &base_vha->dpc_flags); + qla2xxx_wake_dpc(base_vha); +- qla2x00_wait_for_hba_online(base_vha); ++ WARN_ON_ONCE(qla2x00_wait_for_hba_online(base_vha) != ++ QLA_SUCCESS); + } + } + EXPORT_SYMBOL(qlt_enable_vha); +@@ -6426,7 +6425,9 @@ static void qlt_disable_vha(struct scsi_qla_host *vha) + + set_bit(ISP_ABORT_NEEDED, &vha->dpc_flags); + qla2xxx_wake_dpc(vha); +- qla2x00_wait_for_hba_online(vha); ++ if (qla2x00_wait_for_hba_online(vha) != QLA_SUCCESS) ++ ql_dbg(ql_dbg_tgt, vha, 0xe081, ++ "qla2x00_wait_for_hba_online() failed\n"); + } + + /* +diff --git a/drivers/spi/spi-atmel.c b/drivers/spi/spi-atmel.c +index 047875861df1..d19331b66222 100644 +--- a/drivers/spi/spi-atmel.c ++++ b/drivers/spi/spi-atmel.c +@@ -1150,10 +1150,8 @@ static int atmel_spi_setup(struct spi_device *spi) + as = spi_master_get_devdata(spi->master); + + /* see notes above re chipselect */ +- if (!atmel_spi_is_v2(as) +- && spi->chip_select == 0 +- && (spi->mode & SPI_CS_HIGH)) { +- dev_dbg(&spi->dev, "setup: can't be active-high\n"); ++ if (!as->use_cs_gpios && (spi->mode & SPI_CS_HIGH)) { ++ dev_warn(&spi->dev, "setup: non GPIO CS can't be active-high\n"); + return -EINVAL; + } + +diff --git a/drivers/staging/iio/addac/adt7316-i2c.c b/drivers/staging/iio/addac/adt7316-i2c.c +index f66dd3ebbab1..856bcfa60c6c 100644 +--- a/drivers/staging/iio/addac/adt7316-i2c.c ++++ b/drivers/staging/iio/addac/adt7316-i2c.c +@@ -35,6 +35,8 @@ static int adt7316_i2c_read(void *client, u8 reg, u8 *data) + return ret; + } + ++ *data = ret; ++ + return 0; + } + +diff --git a/drivers/staging/rtl8188eu/os_dep/usb_intf.c b/drivers/staging/rtl8188eu/os_dep/usb_intf.c +index 77c339a93525..3733b73863b6 100644 +--- a/drivers/staging/rtl8188eu/os_dep/usb_intf.c ++++ b/drivers/staging/rtl8188eu/os_dep/usb_intf.c +@@ -78,7 +78,7 @@ static struct dvobj_priv *usb_dvobj_init(struct usb_interface *usb_intf) + phost_conf = pusbd->actconfig; + pconf_desc = &phost_conf->desc; + +- phost_iface = &usb_intf->altsetting[0]; ++ phost_iface = usb_intf->cur_altsetting; + piface_desc = &phost_iface->desc; + + pdvobjpriv->NumInterfaces = pconf_desc->bNumInterfaces; +diff --git a/drivers/staging/rtl8712/usb_intf.c b/drivers/staging/rtl8712/usb_intf.c +index b3e266bd57ab..8be4fcc54ad6 100644 +--- a/drivers/staging/rtl8712/usb_intf.c ++++ b/drivers/staging/rtl8712/usb_intf.c +@@ -275,7 +275,7 @@ static uint r8712_usb_dvobj_init(struct _adapter *padapter) + + pdvobjpriv->padapter = padapter; + padapter->EepromAddressSize = 6; +- phost_iface = &pintf->altsetting[0]; ++ phost_iface = pintf->cur_altsetting; + piface_desc = &phost_iface->desc; + pdvobjpriv->nr_endpoint = piface_desc->bNumEndpoints; + if (pusbd->speed == USB_SPEED_HIGH) { +diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c +index 456ef213dc14..fcefafe7df48 100644 +--- a/drivers/thermal/thermal_core.c ++++ b/drivers/thermal/thermal_core.c +@@ -299,7 +299,7 @@ static void thermal_zone_device_set_polling(struct thermal_zone_device *tz, + mod_delayed_work(system_freezable_wq, &tz->poll_queue, + msecs_to_jiffies(delay)); + else +- cancel_delayed_work_sync(&tz->poll_queue); ++ cancel_delayed_work(&tz->poll_queue); + } + + static void monitor_thermal_zone(struct thermal_zone_device *tz) +@@ -1350,7 +1350,7 @@ void thermal_zone_device_unregister(struct thermal_zone_device *tz) + + mutex_unlock(&thermal_list_lock); + +- thermal_zone_device_set_polling(tz, 0); ++ cancel_delayed_work_sync(&tz->poll_queue); + + thermal_set_governor(tz, NULL); + +diff --git a/drivers/tty/n_hdlc.c b/drivers/tty/n_hdlc.c +index e83dea8d6633..19c4aa800c81 100644 +--- a/drivers/tty/n_hdlc.c ++++ b/drivers/tty/n_hdlc.c +@@ -614,7 +614,7 @@ static ssize_t n_hdlc_tty_read(struct tty_struct *tty, struct file *file, + } + + /* no data */ +- if (file->f_flags & O_NONBLOCK) { ++ if (tty_io_nonblock(tty, file)) { + ret = -EAGAIN; + break; + } +@@ -681,7 +681,7 @@ static ssize_t n_hdlc_tty_write(struct tty_struct *tty, struct file *file, + if (tbuf) + break; + +- if (file->f_flags & O_NONBLOCK) { ++ if (tty_io_nonblock(tty, file)) { + error = -EAGAIN; + break; + } +diff --git a/drivers/tty/n_r3964.c b/drivers/tty/n_r3964.c +index 305b6490d405..08ac04d08991 100644 +--- a/drivers/tty/n_r3964.c ++++ b/drivers/tty/n_r3964.c +@@ -1080,7 +1080,7 @@ static ssize_t r3964_read(struct tty_struct *tty, struct file *file, + pMsg = remove_msg(pInfo, pClient); + if (pMsg == NULL) { + /* no messages available. */ +- if (file->f_flags & O_NONBLOCK) { ++ if (tty_io_nonblock(tty, file)) { + ret = -EAGAIN; + goto unlock; + } +diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c +index 904fc9c37fde..8214b0326b3a 100644 +--- a/drivers/tty/n_tty.c ++++ b/drivers/tty/n_tty.c +@@ -1704,7 +1704,7 @@ n_tty_receive_buf_common(struct tty_struct *tty, const unsigned char *cp, + + down_read(&tty->termios_rwsem); + +- while (1) { ++ do { + /* + * When PARMRK is set, each input char may take up to 3 chars + * in the read buf; reduce the buffer space avail by 3x +@@ -1746,7 +1746,7 @@ n_tty_receive_buf_common(struct tty_struct *tty, const unsigned char *cp, + fp += n; + count -= n; + rcvd += n; +- } ++ } while (!test_bit(TTY_LDISC_CHANGING, &tty->flags)); + + tty->receive_room = room; + +@@ -2213,7 +2213,7 @@ static ssize_t n_tty_read(struct tty_struct *tty, struct file *file, + break; + if (!timeout) + break; +- if (file->f_flags & O_NONBLOCK) { ++ if (tty_io_nonblock(tty, file)) { + retval = -EAGAIN; + break; + } +@@ -2367,7 +2367,7 @@ static ssize_t n_tty_write(struct tty_struct *tty, struct file *file, + } + if (!nr) + break; +- if (file->f_flags & O_NONBLOCK) { ++ if (tty_io_nonblock(tty, file)) { + retval = -EAGAIN; + break; + } +diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c +index 4a4a9f33715c..637f72fb6427 100644 +--- a/drivers/tty/serial/amba-pl011.c ++++ b/drivers/tty/serial/amba-pl011.c +@@ -829,10 +829,8 @@ __acquires(&uap->port.lock) + if (!uap->using_tx_dma) + return; + +- /* Avoid deadlock with the DMA engine callback */ +- spin_unlock(&uap->port.lock); +- dmaengine_terminate_all(uap->dmatx.chan); +- spin_lock(&uap->port.lock); ++ dmaengine_terminate_async(uap->dmatx.chan); ++ + if (uap->dmatx.queued) { + dma_unmap_sg(uap->dmatx.chan->device->dev, &uap->dmatx.sg, 1, + DMA_TO_DEVICE); +diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c +index 32a473f9d1d3..fb2dcb3f8591 100644 +--- a/drivers/tty/serial/fsl_lpuart.c ++++ b/drivers/tty/serial/fsl_lpuart.c +@@ -380,8 +380,8 @@ static void lpuart_dma_tx(struct lpuart_port *sport) + } + + sport->dma_tx_desc = dmaengine_prep_slave_sg(sport->dma_tx_chan, sgl, +- sport->dma_tx_nents, +- DMA_MEM_TO_DEV, DMA_PREP_INTERRUPT); ++ ret, DMA_MEM_TO_DEV, ++ DMA_PREP_INTERRUPT); + if (!sport->dma_tx_desc) { + dma_unmap_sg(dev, sgl, sport->dma_tx_nents, DMA_TO_DEVICE); + dev_err(dev, "Cannot prepare TX slave DMA!\n"); +diff --git a/drivers/tty/serial/ifx6x60.c b/drivers/tty/serial/ifx6x60.c +index f190a84a0246..d54ebe6b1d50 100644 +--- a/drivers/tty/serial/ifx6x60.c ++++ b/drivers/tty/serial/ifx6x60.c +@@ -1245,6 +1245,9 @@ static int ifx_spi_spi_remove(struct spi_device *spi) + struct ifx_spi_device *ifx_dev = spi_get_drvdata(spi); + /* stop activity */ + tasklet_kill(&ifx_dev->io_work_tasklet); ++ ++ pm_runtime_disable(&spi->dev); ++ + /* free irq */ + free_irq(gpio_to_irq(ifx_dev->gpio.reset_out), ifx_dev); + free_irq(gpio_to_irq(ifx_dev->gpio.srdy), ifx_dev); +diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c +index 4e827e5a52a3..aae68230fb7b 100644 +--- a/drivers/tty/serial/imx.c ++++ b/drivers/tty/serial/imx.c +@@ -1956,7 +1956,7 @@ imx_console_setup(struct console *co, char *options) + + retval = clk_prepare(sport->clk_per); + if (retval) +- clk_disable_unprepare(sport->clk_ipg); ++ clk_unprepare(sport->clk_ipg); + + error_console: + return retval; +diff --git a/drivers/tty/serial/msm_serial.c b/drivers/tty/serial/msm_serial.c +index 0e0ccc132ab0..e937fb189034 100644 +--- a/drivers/tty/serial/msm_serial.c ++++ b/drivers/tty/serial/msm_serial.c +@@ -988,6 +988,7 @@ static unsigned int msm_get_mctrl(struct uart_port *port) + static void msm_reset(struct uart_port *port) + { + struct msm_port *msm_port = UART_TO_MSM(port); ++ unsigned int mr; + + /* reset everything */ + msm_write(port, UART_CR_CMD_RESET_RX, UART_CR); +@@ -995,7 +996,10 @@ static void msm_reset(struct uart_port *port) + msm_write(port, UART_CR_CMD_RESET_ERR, UART_CR); + msm_write(port, UART_CR_CMD_RESET_BREAK_INT, UART_CR); + msm_write(port, UART_CR_CMD_RESET_CTS, UART_CR); +- msm_write(port, UART_CR_CMD_SET_RFR, UART_CR); ++ msm_write(port, UART_CR_CMD_RESET_RFR, UART_CR); ++ mr = msm_read(port, UART_MR1); ++ mr &= ~UART_MR1_RX_RDY_CTL; ++ msm_write(port, mr, UART_MR1); + + /* Disable DM modes */ + if (msm_port->is_uartdm) +diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c +index 17e2311f7b00..38bb8f85e88d 100644 +--- a/drivers/tty/serial/serial_core.c ++++ b/drivers/tty/serial/serial_core.c +@@ -1125,7 +1125,7 @@ static int uart_break_ctl(struct tty_struct *tty, int break_state) + if (!uport) + goto out; + +- if (uport->type != PORT_UNKNOWN) ++ if (uport->type != PORT_UNKNOWN && uport->ops->break_ctl) + uport->ops->break_ctl(uport, break_state); + ret = 0; + out: +diff --git a/drivers/tty/tty_ldisc.c b/drivers/tty/tty_ldisc.c +index 01fcdc7ff077..62dd2abb57fe 100644 +--- a/drivers/tty/tty_ldisc.c ++++ b/drivers/tty/tty_ldisc.c +@@ -348,6 +348,11 @@ int tty_ldisc_lock(struct tty_struct *tty, unsigned long timeout) + { + int ret; + ++ /* Kindly asking blocked readers to release the read side */ ++ set_bit(TTY_LDISC_CHANGING, &tty->flags); ++ wake_up_interruptible_all(&tty->read_wait); ++ wake_up_interruptible_all(&tty->write_wait); ++ + ret = __tty_ldisc_lock(tty, timeout); + if (!ret) + return -EBUSY; +@@ -358,6 +363,8 @@ int tty_ldisc_lock(struct tty_struct *tty, unsigned long timeout) + void tty_ldisc_unlock(struct tty_struct *tty) + { + clear_bit(TTY_LDISC_HALTED, &tty->flags); ++ /* Can be cleared here - ldisc_unlock will wake up writers firstly */ ++ clear_bit(TTY_LDISC_CHANGING, &tty->flags); + __tty_ldisc_unlock(tty); + } + +diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c +index 7506bbcf8259..b9ec4e2828e2 100644 +--- a/drivers/tty/vt/keyboard.c ++++ b/drivers/tty/vt/keyboard.c +@@ -1460,7 +1460,7 @@ static void kbd_event(struct input_handle *handle, unsigned int event_type, + + if (event_type == EV_MSC && event_code == MSC_RAW && HW_RAW(handle->dev)) + kbd_rawcode(value); +- if (event_type == EV_KEY) ++ if (event_type == EV_KEY && event_code <= KEY_MAX) + kbd_keycode(event_code, value, HW_RAW(handle->dev)); + + spin_unlock(&kbd_event_lock); +diff --git a/drivers/usb/atm/ueagle-atm.c b/drivers/usb/atm/ueagle-atm.c +index ba7616395db2..f649b7b83200 100644 +--- a/drivers/usb/atm/ueagle-atm.c ++++ b/drivers/usb/atm/ueagle-atm.c +@@ -2167,10 +2167,11 @@ resubmit: + /* + * Start the modem : init the data and start kernel thread + */ +-static int uea_boot(struct uea_softc *sc) ++static int uea_boot(struct uea_softc *sc, struct usb_interface *intf) + { +- int ret, size; + struct intr_pkt *intr; ++ int ret = -ENOMEM; ++ int size; + + uea_enters(INS_TO_USBDEV(sc)); + +@@ -2195,6 +2196,11 @@ static int uea_boot(struct uea_softc *sc) + if (UEA_CHIP_VERSION(sc) == ADI930) + load_XILINX_firmware(sc); + ++ if (intf->cur_altsetting->desc.bNumEndpoints < 1) { ++ ret = -ENODEV; ++ goto err0; ++ } ++ + intr = kmalloc(size, GFP_KERNEL); + if (!intr) + goto err0; +@@ -2206,8 +2212,7 @@ static int uea_boot(struct uea_softc *sc) + usb_fill_int_urb(sc->urb_int, sc->usb_dev, + usb_rcvintpipe(sc->usb_dev, UEA_INTR_PIPE), + intr, size, uea_intr, sc, +- sc->usb_dev->actconfig->interface[0]->altsetting[0]. +- endpoint[0].desc.bInterval); ++ intf->cur_altsetting->endpoint[0].desc.bInterval); + + ret = usb_submit_urb(sc->urb_int, GFP_KERNEL); + if (ret < 0) { +@@ -2222,6 +2227,7 @@ static int uea_boot(struct uea_softc *sc) + sc->kthread = kthread_create(uea_kthread, sc, "ueagle-atm"); + if (IS_ERR(sc->kthread)) { + uea_err(INS_TO_USBDEV(sc), "failed to create thread\n"); ++ ret = PTR_ERR(sc->kthread); + goto err2; + } + +@@ -2236,7 +2242,7 @@ err1: + kfree(intr); + err0: + uea_leaves(INS_TO_USBDEV(sc)); +- return -ENOMEM; ++ return ret; + } + + /* +@@ -2597,7 +2603,7 @@ static int uea_bind(struct usbatm_data *usbatm, struct usb_interface *intf, + if (ret < 0) + goto error; + +- ret = uea_boot(sc); ++ ret = uea_boot(sc, intf); + if (ret < 0) + goto error_rm_grp; + +diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c +index bb20aa433e98..4efccf8bf99f 100644 +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -5630,7 +5630,7 @@ re_enumerate_no_bos: + + /** + * usb_reset_device - warn interface drivers and perform a USB port reset +- * @udev: device to reset (not in SUSPENDED or NOTATTACHED state) ++ * @udev: device to reset (not in NOTATTACHED state) + * + * Warns all drivers bound to registered interfaces (using their pre_reset + * method), performs the port reset, and then lets the drivers know that +@@ -5658,8 +5658,7 @@ int usb_reset_device(struct usb_device *udev) + struct usb_host_config *config = udev->actconfig; + struct usb_hub *hub = usb_hub_to_struct_hub(udev->parent); + +- if (udev->state == USB_STATE_NOTATTACHED || +- udev->state == USB_STATE_SUSPENDED) { ++ if (udev->state == USB_STATE_NOTATTACHED) { + dev_dbg(&udev->dev, "device reset not allowed in state %d\n", + udev->state); + return -EINVAL; +diff --git a/drivers/usb/core/urb.c b/drivers/usb/core/urb.c +index 8b800e34407b..83bd48734af5 100644 +--- a/drivers/usb/core/urb.c ++++ b/drivers/usb/core/urb.c +@@ -45,6 +45,7 @@ void usb_init_urb(struct urb *urb) + if (urb) { + memset(urb, 0, sizeof(*urb)); + kref_init(&urb->kref); ++ INIT_LIST_HEAD(&urb->urb_list); + INIT_LIST_HEAD(&urb->anchor_list); + } + } +diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c +index 48755c501201..a497b878c3e2 100644 +--- a/drivers/usb/dwc3/core.c ++++ b/drivers/usb/dwc3/core.c +@@ -1261,7 +1261,8 @@ static int dwc3_probe(struct platform_device *pdev) + + ret = dwc3_core_init(dwc); + if (ret) { +- dev_err(dev, "failed to initialize core\n"); ++ if (ret != -EPROBE_DEFER) ++ dev_err(dev, "failed to initialize core: %d\n", ret); + goto err4; + } + +diff --git a/drivers/usb/dwc3/debug.h b/drivers/usb/dwc3/debug.h +index 5e9c070ec874..1b4c2f8bb3da 100644 +--- a/drivers/usb/dwc3/debug.h ++++ b/drivers/usb/dwc3/debug.h +@@ -124,6 +124,35 @@ dwc3_gadget_link_string(enum dwc3_link_state link_state) + } + } + ++/** ++ * dwc3_gadget_hs_link_string - returns highspeed and below link name ++ * @link_state: link state code ++ */ ++static inline const char * ++dwc3_gadget_hs_link_string(enum dwc3_link_state link_state) ++{ ++ switch (link_state) { ++ case DWC3_LINK_STATE_U0: ++ return "On"; ++ case DWC3_LINK_STATE_U2: ++ return "Sleep"; ++ case DWC3_LINK_STATE_U3: ++ return "Suspend"; ++ case DWC3_LINK_STATE_SS_DIS: ++ return "Disconnected"; ++ case DWC3_LINK_STATE_RX_DET: ++ return "Early Suspend"; ++ case DWC3_LINK_STATE_RECOV: ++ return "Recovery"; ++ case DWC3_LINK_STATE_RESET: ++ return "Reset"; ++ case DWC3_LINK_STATE_RESUME: ++ return "Resume"; ++ default: ++ return "UNKNOWN link state\n"; ++ } ++} ++ + /** + * dwc3_trb_type_string - returns TRB type as a string + * @type: the type of the TRB +diff --git a/drivers/usb/dwc3/debugfs.c b/drivers/usb/dwc3/debugfs.c +index 4e09be80e59f..0d6a6a168a7e 100644 +--- a/drivers/usb/dwc3/debugfs.c ++++ b/drivers/usb/dwc3/debugfs.c +@@ -436,13 +436,17 @@ static int dwc3_link_state_show(struct seq_file *s, void *unused) + unsigned long flags; + enum dwc3_link_state state; + u32 reg; ++ u8 speed; + + spin_lock_irqsave(&dwc->lock, flags); + reg = dwc3_readl(dwc->regs, DWC3_DSTS); + state = DWC3_DSTS_USBLNKST(reg); +- spin_unlock_irqrestore(&dwc->lock, flags); ++ speed = reg & DWC3_DSTS_CONNECTSPD; + +- seq_printf(s, "%s\n", dwc3_gadget_link_string(state)); ++ seq_printf(s, "%s\n", (speed >= DWC3_DSTS_SUPERSPEED) ? ++ dwc3_gadget_link_string(state) : ++ dwc3_gadget_hs_link_string(state)); ++ spin_unlock_irqrestore(&dwc->lock, flags); + + return 0; + } +@@ -460,6 +464,8 @@ static ssize_t dwc3_link_state_write(struct file *file, + unsigned long flags; + enum dwc3_link_state state = 0; + char buf[32]; ++ u32 reg; ++ u8 speed; + + if (copy_from_user(&buf, ubuf, min_t(size_t, sizeof(buf) - 1, count))) + return -EFAULT; +@@ -480,6 +486,15 @@ static ssize_t dwc3_link_state_write(struct file *file, + return -EINVAL; + + spin_lock_irqsave(&dwc->lock, flags); ++ reg = dwc3_readl(dwc->regs, DWC3_DSTS); ++ speed = reg & DWC3_DSTS_CONNECTSPD; ++ ++ if (speed < DWC3_DSTS_SUPERSPEED && ++ state != DWC3_LINK_STATE_RECOV) { ++ spin_unlock_irqrestore(&dwc->lock, flags); ++ return -EINVAL; ++ } ++ + dwc3_gadget_set_link_state(dwc, state); + spin_unlock_irqrestore(&dwc->lock, flags); + +diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c +index 89fe53c846ef..cb50806d2459 100644 +--- a/drivers/usb/dwc3/ep0.c ++++ b/drivers/usb/dwc3/ep0.c +@@ -1147,6 +1147,9 @@ static void dwc3_ep0_xfernotready(struct dwc3 *dwc, + void dwc3_ep0_interrupt(struct dwc3 *dwc, + const struct dwc3_event_depevt *event) + { ++ struct dwc3_ep *dep = dwc->eps[event->endpoint_number]; ++ u8 cmd; ++ + switch (event->endpoint_event) { + case DWC3_DEPEVT_XFERCOMPLETE: + dwc3_ep0_xfer_complete(dwc, event); +@@ -1159,7 +1162,12 @@ void dwc3_ep0_interrupt(struct dwc3 *dwc, + case DWC3_DEPEVT_XFERINPROGRESS: + case DWC3_DEPEVT_RXTXFIFOEVT: + case DWC3_DEPEVT_STREAMEVT: ++ break; + case DWC3_DEPEVT_EPCMDCMPLT: ++ cmd = DEPEVT_PARAMETER_CMD(event->parameters); ++ ++ if (cmd == DWC3_DEPCMD_ENDTRANSFER) ++ dep->flags &= ~DWC3_EP_TRANSFER_STARTED; + break; + } + } +diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c +index d0143d02e2f7..78a5832c209c 100644 +--- a/drivers/usb/gadget/configfs.c ++++ b/drivers/usb/gadget/configfs.c +@@ -1543,6 +1543,7 @@ static struct config_group *gadgets_make( + gi->composite.resume = NULL; + gi->composite.max_speed = USB_SPEED_SUPER; + ++ spin_lock_init(&gi->spinlock); + mutex_init(&gi->lock); + INIT_LIST_HEAD(&gi->string_list); + INIT_LIST_HEAD(&gi->available_func); +diff --git a/drivers/usb/gadget/function/u_serial.c b/drivers/usb/gadget/function/u_serial.c +index 4176216d54be..520ace49f91d 100644 +--- a/drivers/usb/gadget/function/u_serial.c ++++ b/drivers/usb/gadget/function/u_serial.c +@@ -1392,8 +1392,10 @@ int gserial_alloc_line(unsigned char *line_num) + __func__, port_num, PTR_ERR(tty_dev)); + + ret = PTR_ERR(tty_dev); ++ mutex_lock(&ports[port_num].lock); + port = ports[port_num].port; + ports[port_num].port = NULL; ++ mutex_unlock(&ports[port_num].lock); + gserial_free_port(port); + goto err; + } +diff --git a/drivers/usb/gadget/udc/pch_udc.c b/drivers/usb/gadget/udc/pch_udc.c +index 84dcbcd756f0..08bbe2c24134 100644 +--- a/drivers/usb/gadget/udc/pch_udc.c ++++ b/drivers/usb/gadget/udc/pch_udc.c +@@ -1523,7 +1523,6 @@ static void pch_udc_free_dma_chain(struct pch_udc_dev *dev, + td = phys_to_virt(addr); + addr2 = (dma_addr_t)td->next; + dma_pool_free(dev->data_requests, td, addr); +- td->next = 0x00; + addr = addr2; + } + req->chain_len = 1; +diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c +index 997ff183c9cb..95503bb9b067 100644 +--- a/drivers/usb/host/xhci-hub.c ++++ b/drivers/usb/host/xhci-hub.c +@@ -855,7 +855,7 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd, + struct xhci_bus_state *bus_state, + __le32 __iomem **port_array, + u16 wIndex, u32 raw_port_status, +- unsigned long flags) ++ unsigned long *flags) + __releases(&xhci->lock) + __acquires(&xhci->lock) + { +@@ -937,12 +937,12 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd, + xhci_set_link_state(xhci, port_array, wIndex, + XDEV_U0); + +- spin_unlock_irqrestore(&xhci->lock, flags); ++ spin_unlock_irqrestore(&xhci->lock, *flags); + time_left = wait_for_completion_timeout( + &bus_state->rexit_done[wIndex], + msecs_to_jiffies( + XHCI_MAX_REXIT_TIMEOUT_MS)); +- spin_lock_irqsave(&xhci->lock, flags); ++ spin_lock_irqsave(&xhci->lock, *flags); + + if (time_left) { + slot_id = xhci_find_slot_id_by_port(hcd, +@@ -1090,7 +1090,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, + break; + } + status = xhci_get_port_status(hcd, bus_state, port_array, +- wIndex, temp, flags); ++ wIndex, temp, &flags); + if (status == 0xffffffff) + goto error; + +diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c +index b7b55eb82714..a80a57decda1 100644 +--- a/drivers/usb/host/xhci-mem.c ++++ b/drivers/usb/host/xhci-mem.c +@@ -1866,10 +1866,14 @@ no_bw: + kfree(xhci->port_array); + kfree(xhci->rh_bw); + kfree(xhci->ext_caps); ++ kfree(xhci->usb2_rhub.psi); ++ kfree(xhci->usb3_rhub.psi); + + xhci->usb2_ports = NULL; + xhci->usb3_ports = NULL; + xhci->port_array = NULL; ++ xhci->usb2_rhub.psi = NULL; ++ xhci->usb3_rhub.psi = NULL; + xhci->rh_bw = NULL; + xhci->ext_caps = NULL; + +diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c +index 1de006aebec5..021a2d320acc 100644 +--- a/drivers/usb/host/xhci-pci.c ++++ b/drivers/usb/host/xhci-pci.c +@@ -499,6 +499,18 @@ static int xhci_pci_resume(struct usb_hcd *hcd, bool hibernated) + } + #endif /* CONFIG_PM */ + ++static void xhci_pci_shutdown(struct usb_hcd *hcd) ++{ ++ struct xhci_hcd *xhci = hcd_to_xhci(hcd); ++ struct pci_dev *pdev = to_pci_dev(hcd->self.controller); ++ ++ xhci_shutdown(hcd); ++ ++ /* Yet another workaround for spurious wakeups at shutdown with HSW */ ++ if (xhci->quirks & XHCI_SPURIOUS_WAKEUP) ++ pci_set_power_state(pdev, PCI_D3hot); ++} ++ + /*-------------------------------------------------------------------------*/ + + /* PCI driver selection metadata; PCI hotplugging uses this */ +@@ -534,6 +546,7 @@ static int __init xhci_pci_init(void) + #ifdef CONFIG_PM + xhci_pci_hc_driver.pci_suspend = xhci_pci_suspend; + xhci_pci_hc_driver.pci_resume = xhci_pci_resume; ++ xhci_pci_hc_driver.shutdown = xhci_pci_shutdown; + #endif + return pci_register_driver(&xhci_pci_driver); + } +diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c +index 009b6796f405..89af395cd89c 100644 +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -2398,7 +2398,8 @@ static int handle_tx_event(struct xhci_hcd *xhci, + case COMP_SUCCESS: + if (EVENT_TRB_LEN(le32_to_cpu(event->transfer_len)) == 0) + break; +- if (xhci->quirks & XHCI_TRUST_TX_LENGTH) ++ if (xhci->quirks & XHCI_TRUST_TX_LENGTH || ++ ep_ring->last_td_was_short) + trb_comp_code = COMP_SHORT_PACKET; + else + xhci_warn_ratelimited(xhci, +diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c +index 465d7fd507ad..6c0a0ca316d3 100644 +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -717,7 +717,7 @@ static void xhci_stop(struct usb_hcd *hcd) + * + * This will only ever be called with the main usb_hcd (the USB3 roothub). + */ +-static void xhci_shutdown(struct usb_hcd *hcd) ++void xhci_shutdown(struct usb_hcd *hcd) + { + struct xhci_hcd *xhci = hcd_to_xhci(hcd); + +@@ -736,11 +736,8 @@ static void xhci_shutdown(struct usb_hcd *hcd) + xhci_dbg_trace(xhci, trace_xhci_dbg_init, + "xhci_shutdown completed - status = %x", + readl(&xhci->op_regs->status)); +- +- /* Yet another workaround for spurious wakeups at shutdown with HSW */ +- if (xhci->quirks & XHCI_SPURIOUS_WAKEUP) +- pci_set_power_state(to_pci_dev(hcd->self.sysdev), PCI_D3hot); + } ++EXPORT_SYMBOL_GPL(xhci_shutdown); + + #ifdef CONFIG_PM + static void xhci_save_registers(struct xhci_hcd *xhci) +@@ -911,7 +908,7 @@ static bool xhci_pending_portevent(struct xhci_hcd *xhci) + int xhci_suspend(struct xhci_hcd *xhci, bool do_wakeup) + { + int rc = 0; +- unsigned int delay = XHCI_MAX_HALT_USEC; ++ unsigned int delay = XHCI_MAX_HALT_USEC * 2; + struct usb_hcd *hcd = xhci_to_hcd(xhci); + u32 command; + u32 res; +diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h +index cbc91536e512..db1af99d53bd 100644 +--- a/drivers/usb/host/xhci.h ++++ b/drivers/usb/host/xhci.h +@@ -2022,6 +2022,7 @@ int xhci_start(struct xhci_hcd *xhci); + int xhci_reset(struct xhci_hcd *xhci); + int xhci_run(struct usb_hcd *hcd); + int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks); ++void xhci_shutdown(struct usb_hcd *hcd); + void xhci_init_driver(struct hc_driver *drv, + const struct xhci_driver_overrides *over); + int xhci_disable_slot(struct xhci_hcd *xhci, u32 slot_id); +diff --git a/drivers/usb/misc/adutux.c b/drivers/usb/misc/adutux.c +index c8c8fa3f1f46..45390045c75d 100644 +--- a/drivers/usb/misc/adutux.c ++++ b/drivers/usb/misc/adutux.c +@@ -671,7 +671,7 @@ static int adu_probe(struct usb_interface *interface, + init_waitqueue_head(&dev->read_wait); + init_waitqueue_head(&dev->write_wait); + +- res = usb_find_common_endpoints_reverse(&interface->altsetting[0], ++ res = usb_find_common_endpoints_reverse(interface->cur_altsetting, + NULL, NULL, + &dev->interrupt_in_endpoint, + &dev->interrupt_out_endpoint); +diff --git a/drivers/usb/misc/idmouse.c b/drivers/usb/misc/idmouse.c +index 39d8fedfaf3b..01ef2551be46 100644 +--- a/drivers/usb/misc/idmouse.c ++++ b/drivers/usb/misc/idmouse.c +@@ -341,7 +341,7 @@ static int idmouse_probe(struct usb_interface *interface, + int result; + + /* check if we have gotten the data or the hid interface */ +- iface_desc = &interface->altsetting[0]; ++ iface_desc = interface->cur_altsetting; + if (iface_desc->desc.bInterfaceClass != 0x0A) + return -ENODEV; + +diff --git a/drivers/usb/mon/mon_bin.c b/drivers/usb/mon/mon_bin.c +index f932f40302df..156aebf62e61 100644 +--- a/drivers/usb/mon/mon_bin.c ++++ b/drivers/usb/mon/mon_bin.c +@@ -1038,12 +1038,18 @@ static long mon_bin_ioctl(struct file *file, unsigned int cmd, unsigned long arg + + mutex_lock(&rp->fetch_lock); + spin_lock_irqsave(&rp->b_lock, flags); +- mon_free_buff(rp->b_vec, rp->b_size/CHUNK_SIZE); +- kfree(rp->b_vec); +- rp->b_vec = vec; +- rp->b_size = size; +- rp->b_read = rp->b_in = rp->b_out = rp->b_cnt = 0; +- rp->cnt_lost = 0; ++ if (rp->mmap_active) { ++ mon_free_buff(vec, size/CHUNK_SIZE); ++ kfree(vec); ++ ret = -EBUSY; ++ } else { ++ mon_free_buff(rp->b_vec, rp->b_size/CHUNK_SIZE); ++ kfree(rp->b_vec); ++ rp->b_vec = vec; ++ rp->b_size = size; ++ rp->b_read = rp->b_in = rp->b_out = rp->b_cnt = 0; ++ rp->cnt_lost = 0; ++ } + spin_unlock_irqrestore(&rp->b_lock, flags); + mutex_unlock(&rp->fetch_lock); + } +@@ -1215,13 +1221,21 @@ mon_bin_poll(struct file *file, struct poll_table_struct *wait) + static void mon_bin_vma_open(struct vm_area_struct *vma) + { + struct mon_reader_bin *rp = vma->vm_private_data; ++ unsigned long flags; ++ ++ spin_lock_irqsave(&rp->b_lock, flags); + rp->mmap_active++; ++ spin_unlock_irqrestore(&rp->b_lock, flags); + } + + static void mon_bin_vma_close(struct vm_area_struct *vma) + { ++ unsigned long flags; ++ + struct mon_reader_bin *rp = vma->vm_private_data; ++ spin_lock_irqsave(&rp->b_lock, flags); + rp->mmap_active--; ++ spin_unlock_irqrestore(&rp->b_lock, flags); + } + + /* +@@ -1233,16 +1247,12 @@ static int mon_bin_vma_fault(struct vm_fault *vmf) + unsigned long offset, chunk_idx; + struct page *pageptr; + +- mutex_lock(&rp->fetch_lock); + offset = vmf->pgoff << PAGE_SHIFT; +- if (offset >= rp->b_size) { +- mutex_unlock(&rp->fetch_lock); ++ if (offset >= rp->b_size) + return VM_FAULT_SIGBUS; +- } + chunk_idx = offset / CHUNK_SIZE; + pageptr = rp->b_vec[chunk_idx].pg; + get_page(pageptr); +- mutex_unlock(&rp->fetch_lock); + vmf->page = pageptr; + return 0; + } +diff --git a/drivers/usb/mtu3/mtu3_qmu.c b/drivers/usb/mtu3/mtu3_qmu.c +index 7d9ba8a52368..c87947fb2694 100644 +--- a/drivers/usb/mtu3/mtu3_qmu.c ++++ b/drivers/usb/mtu3/mtu3_qmu.c +@@ -372,7 +372,7 @@ static void qmu_tx_zlp_error_handler(struct mtu3 *mtu, u8 epnum) + return; + } + +- dev_dbg(mtu->dev, "%s send ZLP for req=%p\n", __func__, mreq); ++ dev_dbg(mtu->dev, "%s send ZLP for req=%p\n", __func__, req); + + mtu3_clrbits(mbase, MU3D_EP_TXCR0(mep->epnum), TX_DMAREQEN); + +diff --git a/drivers/usb/serial/io_edgeport.c b/drivers/usb/serial/io_edgeport.c +index 01f3ac7769f3..51b61545ccf2 100644 +--- a/drivers/usb/serial/io_edgeport.c ++++ b/drivers/usb/serial/io_edgeport.c +@@ -2918,16 +2918,18 @@ static int edge_startup(struct usb_serial *serial) + response = 0; + + if (edge_serial->is_epic) { ++ struct usb_host_interface *alt; ++ ++ alt = serial->interface->cur_altsetting; ++ + /* EPIC thing, set up our interrupt polling now and our read + * urb, so that the device knows it really is connected. */ + interrupt_in_found = bulk_in_found = bulk_out_found = false; +- for (i = 0; i < serial->interface->altsetting[0] +- .desc.bNumEndpoints; ++i) { ++ for (i = 0; i < alt->desc.bNumEndpoints; ++i) { + struct usb_endpoint_descriptor *endpoint; + int buffer_size; + +- endpoint = &serial->interface->altsetting[0]. +- endpoint[i].desc; ++ endpoint = &alt->endpoint[i].desc; + buffer_size = usb_endpoint_maxp(endpoint); + if (!interrupt_in_found && + (usb_endpoint_is_int_in(endpoint))) { +diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c +index 1e62f2134b3a..8391a88cf90f 100644 +--- a/drivers/usb/storage/uas.c ++++ b/drivers/usb/storage/uas.c +@@ -832,6 +832,10 @@ static int uas_slave_configure(struct scsi_device *sdev) + sdev->wce_default_on = 1; + } + ++ /* Some disks cannot handle READ_CAPACITY_16 */ ++ if (devinfo->flags & US_FL_NO_READ_CAPACITY_16) ++ sdev->no_read_capacity_16 = 1; ++ + /* + * Some disks return the total number of blocks in response + * to READ CAPACITY rather than the highest block number. +@@ -840,6 +844,12 @@ static int uas_slave_configure(struct scsi_device *sdev) + if (devinfo->flags & US_FL_FIX_CAPACITY) + sdev->fix_capacity = 1; + ++ /* ++ * in some cases we have to guess ++ */ ++ if (devinfo->flags & US_FL_CAPACITY_HEURISTICS) ++ sdev->guess_capacity = 1; ++ + /* + * Some devices don't like MODE SENSE with page=0x3f, + * which is the command used for checking if a device +diff --git a/drivers/video/hdmi.c b/drivers/video/hdmi.c +index 111a0ab6280a..ce7c4a269f77 100644 +--- a/drivers/video/hdmi.c ++++ b/drivers/video/hdmi.c +@@ -1036,12 +1036,12 @@ static int hdmi_avi_infoframe_unpack(struct hdmi_avi_infoframe *frame, + if (ptr[0] & 0x10) + frame->active_aspect = ptr[1] & 0xf; + if (ptr[0] & 0x8) { +- frame->top_bar = (ptr[5] << 8) + ptr[6]; +- frame->bottom_bar = (ptr[7] << 8) + ptr[8]; ++ frame->top_bar = (ptr[6] << 8) | ptr[5]; ++ frame->bottom_bar = (ptr[8] << 8) | ptr[7]; + } + if (ptr[0] & 0x4) { +- frame->left_bar = (ptr[9] << 8) + ptr[10]; +- frame->right_bar = (ptr[11] << 8) + ptr[12]; ++ frame->left_bar = (ptr[10] << 8) | ptr[9]; ++ frame->right_bar = (ptr[12] << 8) | ptr[11]; + } + frame->scan_mode = ptr[0] & 0x3; + +diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c +index d9873aa014a6..499531608fa2 100644 +--- a/drivers/virtio/virtio_balloon.c ++++ b/drivers/virtio/virtio_balloon.c +@@ -492,6 +492,17 @@ static int virtballoon_migratepage(struct balloon_dev_info *vb_dev_info, + + get_page(newpage); /* balloon reference */ + ++ /* ++ * When we migrate a page to a different zone and adjusted the ++ * managed page count when inflating, we have to fixup the count of ++ * both involved zones. ++ */ ++ if (!virtio_has_feature(vb->vdev, VIRTIO_BALLOON_F_DEFLATE_ON_OOM) && ++ page_zone(page) != page_zone(newpage)) { ++ adjust_managed_page_count(page, 1); ++ adjust_managed_page_count(newpage, -1); ++ } ++ + /* balloon's page migration 1st step -- inflate "newpage" */ + spin_lock_irqsave(&vb_dev_info->pages_lock, flags); + balloon_page_insert(vb_dev_info, newpage); +diff --git a/drivers/watchdog/aspeed_wdt.c b/drivers/watchdog/aspeed_wdt.c +index cee7334b2a00..f5835cbd5d41 100644 +--- a/drivers/watchdog/aspeed_wdt.c ++++ b/drivers/watchdog/aspeed_wdt.c +@@ -204,11 +204,6 @@ static int aspeed_wdt_probe(struct platform_device *pdev) + if (IS_ERR(wdt->base)) + return PTR_ERR(wdt->base); + +- /* +- * The ast2400 wdt can run at PCLK, or 1MHz. The ast2500 only +- * runs at 1MHz. We chose to always run at 1MHz, as there's no +- * good reason to have a faster watchdog counter. +- */ + wdt->wdd.info = &aspeed_wdt_info; + wdt->wdd.ops = &aspeed_wdt_ops; + wdt->wdd.max_hw_heartbeat_ms = WDT_MAX_TIMEOUT_MS; +@@ -224,7 +219,16 @@ static int aspeed_wdt_probe(struct platform_device *pdev) + return -EINVAL; + config = ofdid->data; + +- wdt->ctrl = WDT_CTRL_1MHZ_CLK; ++ /* ++ * On clock rates: ++ * - ast2400 wdt can run at PCLK, or 1MHz ++ * - ast2500 only runs at 1MHz, hard coding bit 4 to 1 ++ * - ast2600 always runs at 1MHz ++ * ++ * Set the ast2400 to run at 1MHz as it simplifies the driver. ++ */ ++ if (of_device_is_compatible(np, "aspeed,ast2400-wdt")) ++ wdt->ctrl = WDT_CTRL_1MHZ_CLK; + + /* + * Control reset on a per-device basis to ensure the +diff --git a/fs/autofs4/expire.c b/fs/autofs4/expire.c +index 141f9bc213a3..94a0017c923b 100644 +--- a/fs/autofs4/expire.c ++++ b/fs/autofs4/expire.c +@@ -472,9 +472,10 @@ struct dentry *autofs4_expire_indirect(struct super_block *sb, + */ + flags &= ~AUTOFS_EXP_LEAVES; + found = should_expire(expired, mnt, timeout, how); +- if (!found || found != expired) +- /* Something has changed, continue */ ++ if (found != expired) { // something has changed, continue ++ dput(found); + goto next; ++ } + + if (expired != dentry) + dput(dentry); +diff --git a/fs/btrfs/delayed-inode.c b/fs/btrfs/delayed-inode.c +index 04f39111fafb..87414fc9e268 100644 +--- a/fs/btrfs/delayed-inode.c ++++ b/fs/btrfs/delayed-inode.c +@@ -1975,12 +1975,19 @@ void btrfs_kill_all_delayed_nodes(struct btrfs_root *root) + } + + inode_id = delayed_nodes[n - 1]->inode_id + 1; +- +- for (i = 0; i < n; i++) +- refcount_inc(&delayed_nodes[i]->refs); ++ for (i = 0; i < n; i++) { ++ /* ++ * Don't increase refs in case the node is dead and ++ * about to be removed from the tree in the loop below ++ */ ++ if (!refcount_inc_not_zero(&delayed_nodes[i]->refs)) ++ delayed_nodes[i] = NULL; ++ } + spin_unlock(&root->inode_lock); + + for (i = 0; i < n; i++) { ++ if (!delayed_nodes[i]) ++ continue; + __btrfs_kill_delayed_node(delayed_nodes[i]); + btrfs_release_delayed_node(delayed_nodes[i]); + } +diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c +index 6fbae1357644..bf654d48eb46 100644 +--- a/fs/btrfs/file.c ++++ b/fs/btrfs/file.c +@@ -1625,6 +1625,7 @@ static noinline ssize_t __btrfs_buffered_write(struct file *file, + break; + } + ++ only_release_metadata = false; + sector_offset = pos & (fs_info->sectorsize - 1); + reserve_bytes = round_up(write_bytes + sector_offset, + fs_info->sectorsize); +@@ -1778,7 +1779,6 @@ again: + set_extent_bit(&BTRFS_I(inode)->io_tree, lockstart, + lockend, EXTENT_NORESERVE, NULL, + NULL, GFP_NOFS); +- only_release_metadata = false; + } + + btrfs_drop_pages(pages, num_pages); +diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c +index 9f31b81a5e27..abeb26d48d0a 100644 +--- a/fs/btrfs/free-space-cache.c ++++ b/fs/btrfs/free-space-cache.c +@@ -398,6 +398,12 @@ static int io_ctl_prepare_pages(struct btrfs_io_ctl *io_ctl, struct inode *inode + if (uptodate && !PageUptodate(page)) { + btrfs_readpage(NULL, page); + lock_page(page); ++ if (page->mapping != inode->i_mapping) { ++ btrfs_err(BTRFS_I(inode)->root->fs_info, ++ "free space cache page truncated"); ++ io_ctl_drop_pages(io_ctl); ++ return -EIO; ++ } + if (!PageUptodate(page)) { + btrfs_err(BTRFS_I(inode)->root->fs_info, + "error reading free space cache"); +diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c +index ddc1d1d1a29f..739f45b04b52 100644 +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -9839,6 +9839,9 @@ static int btrfs_rename_exchange(struct inode *old_dir, + goto out_notrans; + } + ++ if (dest != root) ++ btrfs_record_root_in_trans(trans, dest); ++ + /* + * We need to find a free sequence number both in the source and + * in the destination directory for the exchange. +diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c +index a5905f97b3db..1211fdcd425d 100644 +--- a/fs/btrfs/send.c ++++ b/fs/btrfs/send.c +@@ -36,6 +36,14 @@ + #include "transaction.h" + #include "compression.h" + ++/* ++ * Maximum number of references an extent can have in order for us to attempt to ++ * issue clone operations instead of write operations. This currently exists to ++ * avoid hitting limitations of the backreference walking code (taking a lot of ++ * time and using too much memory for extents with large number of references). ++ */ ++#define SEND_MAX_EXTENT_REFS 64 ++ + /* + * A fs_path is a helper to dynamically build path names with unknown size. + * It reallocates the internal buffer on demand. +@@ -1324,6 +1332,7 @@ static int find_extent_clone(struct send_ctx *sctx, + struct clone_root *cur_clone_root; + struct btrfs_key found_key; + struct btrfs_path *tmp_path; ++ struct btrfs_extent_item *ei; + int compressed; + u32 i; + +@@ -1373,7 +1382,6 @@ static int find_extent_clone(struct send_ctx *sctx, + ret = extent_from_logical(fs_info, disk_byte, tmp_path, + &found_key, &flags); + up_read(&fs_info->commit_root_sem); +- btrfs_release_path(tmp_path); + + if (ret < 0) + goto out; +@@ -1382,6 +1390,21 @@ static int find_extent_clone(struct send_ctx *sctx, + goto out; + } + ++ ei = btrfs_item_ptr(tmp_path->nodes[0], tmp_path->slots[0], ++ struct btrfs_extent_item); ++ /* ++ * Backreference walking (iterate_extent_inodes() below) is currently ++ * too expensive when an extent has a large number of references, both ++ * in time spent and used memory. So for now just fallback to write ++ * operations instead of clone operations when an extent has more than ++ * a certain amount of references. ++ */ ++ if (btrfs_extent_refs(tmp_path->nodes[0], ei) > SEND_MAX_EXTENT_REFS) { ++ ret = -ENOENT; ++ goto out; ++ } ++ btrfs_release_path(tmp_path); ++ + /* + * Setup the clone roots. + */ +diff --git a/fs/btrfs/volumes.h b/fs/btrfs/volumes.h +index f6ae6cdf233d..07b805d08e55 100644 +--- a/fs/btrfs/volumes.h ++++ b/fs/btrfs/volumes.h +@@ -317,7 +317,6 @@ struct btrfs_bio { + u64 map_type; /* get from map_lookup->type */ + bio_end_io_t *end_io; + struct bio *orig_bio; +- unsigned long flags; + void *private; + atomic_t error; + int max_errors; +diff --git a/fs/cifs/file.c b/fs/cifs/file.c +index 40f22932343c..6dc0e092b0fc 100644 +--- a/fs/cifs/file.c ++++ b/fs/cifs/file.c +@@ -312,9 +312,6 @@ cifs_new_fileinfo(struct cifs_fid *fid, struct file *file, + INIT_LIST_HEAD(&fdlocks->locks); + fdlocks->cfile = cfile; + cfile->llist = fdlocks; +- cifs_down_write(&cinode->lock_sem); +- list_add(&fdlocks->llist, &cinode->llist); +- up_write(&cinode->lock_sem); + + cfile->count = 1; + cfile->pid = current->tgid; +@@ -338,6 +335,10 @@ cifs_new_fileinfo(struct cifs_fid *fid, struct file *file, + oplock = 0; + } + ++ cifs_down_write(&cinode->lock_sem); ++ list_add(&fdlocks->llist, &cinode->llist); ++ up_write(&cinode->lock_sem); ++ + spin_lock(&tcon->open_file_lock); + if (fid->pending_open->oplock != CIFS_OPLOCK_NO_CHANGE && oplock) + oplock = fid->pending_open->oplock; +diff --git a/fs/cifs/smb2misc.c b/fs/cifs/smb2misc.c +index 31f01f09d25a..ff2ad15f67d6 100644 +--- a/fs/cifs/smb2misc.c ++++ b/fs/cifs/smb2misc.c +@@ -622,10 +622,10 @@ smb2_is_valid_oplock_break(char *buffer, struct TCP_Server_Info *server) + spin_lock(&cifs_tcp_ses_lock); + list_for_each(tmp, &server->smb_ses_list) { + ses = list_entry(tmp, struct cifs_ses, smb_ses_list); ++ + list_for_each(tmp1, &ses->tcon_list) { + tcon = list_entry(tmp1, struct cifs_tcon, tcon_list); + +- cifs_stats_inc(&tcon->stats.cifs_stats.num_oplock_brks); + spin_lock(&tcon->open_file_lock); + list_for_each(tmp2, &tcon->openFileList) { + cfile = list_entry(tmp2, struct cifsFileInfo, +@@ -637,6 +637,8 @@ smb2_is_valid_oplock_break(char *buffer, struct TCP_Server_Info *server) + continue; + + cifs_dbg(FYI, "file id match, oplock break\n"); ++ cifs_stats_inc( ++ &tcon->stats.cifs_stats.num_oplock_brks); + cinode = CIFS_I(d_inode(cfile->dentry)); + spin_lock(&cfile->file_info_lock); + if (!CIFS_CACHE_WRITE(cinode) && +@@ -669,9 +671,6 @@ smb2_is_valid_oplock_break(char *buffer, struct TCP_Server_Info *server) + return true; + } + spin_unlock(&tcon->open_file_lock); +- spin_unlock(&cifs_tcp_ses_lock); +- cifs_dbg(FYI, "No matching file for oplock break\n"); +- return true; + } + } + spin_unlock(&cifs_tcp_ses_lock); +diff --git a/fs/dlm/lockspace.c b/fs/dlm/lockspace.c +index 610f72ae7ad6..9c8c9a09b4a6 100644 +--- a/fs/dlm/lockspace.c ++++ b/fs/dlm/lockspace.c +@@ -807,6 +807,7 @@ static int release_lockspace(struct dlm_ls *ls, int force) + + dlm_delete_debug_file(ls); + ++ idr_destroy(&ls->ls_recover_idr); + kfree(ls->ls_recover_buf); + + /* +diff --git a/fs/dlm/member.c b/fs/dlm/member.c +index cad6d85911a8..0bc43b35d2c5 100644 +--- a/fs/dlm/member.c ++++ b/fs/dlm/member.c +@@ -671,7 +671,7 @@ int dlm_ls_stop(struct dlm_ls *ls) + int dlm_ls_start(struct dlm_ls *ls) + { + struct dlm_recover *rv, *rv_old; +- struct dlm_config_node *nodes; ++ struct dlm_config_node *nodes = NULL; + int error, count; + + rv = kzalloc(sizeof(*rv), GFP_NOFS); +diff --git a/fs/dlm/memory.c b/fs/dlm/memory.c +index 7cd24bccd4fe..37be29f21d04 100644 +--- a/fs/dlm/memory.c ++++ b/fs/dlm/memory.c +@@ -38,10 +38,8 @@ int __init dlm_memory_init(void) + + void dlm_memory_exit(void) + { +- if (lkb_cache) +- kmem_cache_destroy(lkb_cache); +- if (rsb_cache) +- kmem_cache_destroy(rsb_cache); ++ kmem_cache_destroy(lkb_cache); ++ kmem_cache_destroy(rsb_cache); + } + + char *dlm_allocate_lvb(struct dlm_ls *ls) +@@ -86,8 +84,7 @@ void dlm_free_lkb(struct dlm_lkb *lkb) + struct dlm_user_args *ua; + ua = lkb->lkb_ua; + if (ua) { +- if (ua->lksb.sb_lvbptr) +- kfree(ua->lksb.sb_lvbptr); ++ kfree(ua->lksb.sb_lvbptr); + kfree(ua); + } + } +diff --git a/fs/dlm/user.c b/fs/dlm/user.c +index 1f0c071d4a86..02de11695d0b 100644 +--- a/fs/dlm/user.c ++++ b/fs/dlm/user.c +@@ -25,6 +25,7 @@ + #include "lvb_table.h" + #include "user.h" + #include "ast.h" ++#include "config.h" + + static const char name_prefix[] = "dlm"; + static const struct file_operations device_fops; +@@ -404,7 +405,7 @@ static int device_create_lockspace(struct dlm_lspace_params *params) + if (!capable(CAP_SYS_ADMIN)) + return -EPERM; + +- error = dlm_new_lockspace(params->name, NULL, params->flags, ++ error = dlm_new_lockspace(params->name, dlm_config.ci_cluster_name, params->flags, + DLM_USER_LVB_LEN, NULL, NULL, NULL, + &lockspace); + if (error) +diff --git a/fs/exportfs/expfs.c b/fs/exportfs/expfs.c +index c22cc9d2a5c9..a561ae17cf43 100644 +--- a/fs/exportfs/expfs.c ++++ b/fs/exportfs/expfs.c +@@ -508,26 +508,33 @@ struct dentry *exportfs_decode_fh(struct vfsmount *mnt, struct fid *fid, + * inode is actually connected to the parent. + */ + err = exportfs_get_name(mnt, target_dir, nbuf, result); +- if (!err) { +- inode_lock(target_dir->d_inode); +- nresult = lookup_one_len(nbuf, target_dir, +- strlen(nbuf)); +- inode_unlock(target_dir->d_inode); +- if (!IS_ERR(nresult)) { +- if (nresult->d_inode) { +- dput(result); +- result = nresult; +- } else +- dput(nresult); +- } ++ if (err) { ++ dput(target_dir); ++ goto err_result; + } + ++ inode_lock(target_dir->d_inode); ++ nresult = lookup_one_len(nbuf, target_dir, strlen(nbuf)); ++ if (!IS_ERR(nresult)) { ++ if (unlikely(nresult->d_inode != result->d_inode)) { ++ dput(nresult); ++ nresult = ERR_PTR(-ESTALE); ++ } ++ } ++ inode_unlock(target_dir->d_inode); + /* + * At this point we are done with the parent, but it's pinned + * by the child dentry anyway. + */ + dput(target_dir); + ++ if (IS_ERR(nresult)) { ++ err = PTR_ERR(nresult); ++ goto err_result; ++ } ++ dput(result); ++ result = nresult; ++ + /* + * And finally make sure the dentry is actually acceptable + * to NFSD. +diff --git a/fs/ext2/inode.c b/fs/ext2/inode.c +index a7c87d593083..31c5a7b5f1f3 100644 +--- a/fs/ext2/inode.c ++++ b/fs/ext2/inode.c +@@ -699,10 +699,13 @@ static int ext2_get_blocks(struct inode *inode, + if (!partial) { + count++; + mutex_unlock(&ei->truncate_mutex); +- if (err) +- goto cleanup; + goto got_it; + } ++ ++ if (err) { ++ mutex_unlock(&ei->truncate_mutex); ++ goto cleanup; ++ } + } + + /* +diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c +index b3d5fd84b485..11bc4c69bf16 100644 +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -195,7 +195,12 @@ void ext4_evict_inode(struct inode *inode) + { + handle_t *handle; + int err; +- int extra_credits = 3; ++ /* ++ * Credits for final inode cleanup and freeing: ++ * sb + inode (ext4_orphan_del()), block bitmap, group descriptor ++ * (xattr block freeing), bitmap, group descriptor (inode freeing) ++ */ ++ int extra_credits = 6; + struct ext4_xattr_inode_array *ea_inode_array = NULL; + + trace_ext4_evict_inode(inode); +@@ -251,8 +256,12 @@ void ext4_evict_inode(struct inode *inode) + if (!IS_NOQUOTA(inode)) + extra_credits += EXT4_MAXQUOTAS_DEL_BLOCKS(inode->i_sb); + ++ /* ++ * Block bitmap, group descriptor, and inode are accounted in both ++ * ext4_blocks_for_truncate() and extra_credits. So subtract 3. ++ */ + handle = ext4_journal_start(inode, EXT4_HT_TRUNCATE, +- ext4_blocks_for_truncate(inode)+extra_credits); ++ ext4_blocks_for_truncate(inode) + extra_credits - 3); + if (IS_ERR(handle)) { + ext4_std_error(inode->i_sb, PTR_ERR(handle)); + /* +@@ -5296,11 +5305,15 @@ static void ext4_wait_for_tail_page_commit(struct inode *inode) + + offset = inode->i_size & (PAGE_SIZE - 1); + /* +- * All buffers in the last page remain valid? Then there's nothing to +- * do. We do the check mainly to optimize the common PAGE_SIZE == +- * blocksize case ++ * If the page is fully truncated, we don't need to wait for any commit ++ * (and we even should not as __ext4_journalled_invalidatepage() may ++ * strip all buffers from the page but keep the page dirty which can then ++ * confuse e.g. concurrent ext4_writepage() seeing dirty page without ++ * buffers). Also we don't need to wait for any commit if all buffers in ++ * the page remain valid. This is most beneficial for the common case of ++ * blocksize == PAGESIZE. + */ +- if (offset > PAGE_SIZE - i_blocksize(inode)) ++ if (!offset || offset > (PAGE_SIZE - i_blocksize(inode))) + return; + while (1) { + page = find_lock_page(inode->i_mapping, +diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c +index 212b01861d94..b4e0c270def4 100644 +--- a/fs/ext4/namei.c ++++ b/fs/ext4/namei.c +@@ -3065,18 +3065,17 @@ static int ext4_unlink(struct inode *dir, struct dentry *dentry) + if (IS_DIRSYNC(dir)) + ext4_handle_sync(handle); + +- if (inode->i_nlink == 0) { +- ext4_warning_inode(inode, "Deleting file '%.*s' with no links", +- dentry->d_name.len, dentry->d_name.name); +- set_nlink(inode, 1); +- } + retval = ext4_delete_entry(handle, dir, de, bh); + if (retval) + goto end_unlink; + dir->i_ctime = dir->i_mtime = current_time(dir); + ext4_update_dx_flag(dir); + ext4_mark_inode_dirty(handle, dir); +- drop_nlink(inode); ++ if (inode->i_nlink == 0) ++ ext4_warning_inode(inode, "Deleting file '%.*s' with no links", ++ dentry->d_name.len, dentry->d_name.name); ++ else ++ drop_nlink(inode); + if (!inode->i_nlink) + ext4_orphan_add(handle, inode); + inode->i_ctime = current_time(inode); +diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c +index d68b0132718a..a90173b856f6 100644 +--- a/fs/f2fs/file.c ++++ b/fs/f2fs/file.c +@@ -2029,7 +2029,7 @@ do_more: + } + + ret = f2fs_gc(sbi, range.sync, true, GET_SEGNO(sbi, range.start)); +- range.start += sbi->blocks_per_seg; ++ range.start += BLKS_PER_SEC(sbi); + if (range.start <= end) + goto do_more; + out: +diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c +index 67120181dc2a..c2e4c6ce2cf7 100644 +--- a/fs/f2fs/gc.c ++++ b/fs/f2fs/gc.c +@@ -330,8 +330,7 @@ static int get_victim_by_default(struct f2fs_sb_info *sbi, + p.min_cost = get_max_cost(sbi, &p); + + if (*result != NULL_SEGNO) { +- if (IS_DATASEG(get_seg_entry(sbi, *result)->type) && +- get_valid_blocks(sbi, *result, false) && ++ if (get_valid_blocks(sbi, *result, false) && + !sec_usage_check(sbi, GET_SEC_FROM_SEG(sbi, *result))) + p.min_segno = *result; + goto out; +@@ -952,9 +951,9 @@ static int do_garbage_collect(struct f2fs_sb_info *sbi, + GET_SUM_BLOCK(sbi, segno)); + f2fs_put_page(sum_page, 0); + +- if (get_valid_blocks(sbi, segno, false) == 0 || +- !PageUptodate(sum_page) || +- unlikely(f2fs_cp_error(sbi))) ++ if (get_valid_blocks(sbi, segno, false) == 0) ++ goto freed; ++ if (!PageUptodate(sum_page) || unlikely(f2fs_cp_error(sbi))) + goto next; + + sum = page_address(sum_page); +@@ -981,6 +980,7 @@ static int do_garbage_collect(struct f2fs_sb_info *sbi, + + stat_inc_seg_count(sbi, type, gc_type); + ++freed: + if (gc_type == FG_GC && + get_valid_blocks(sbi, segno, false) == 0) + seg_freed++; +diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c +index b79bba77652a..4d95a416fc36 100644 +--- a/fs/fuse/dir.c ++++ b/fs/fuse/dir.c +@@ -234,7 +234,8 @@ static int fuse_dentry_revalidate(struct dentry *entry, unsigned int flags) + kfree(forget); + if (ret == -ENOMEM) + goto out; +- if (ret || (outarg.attr.mode ^ inode->i_mode) & S_IFMT) ++ if (ret || fuse_invalid_attr(&outarg.attr) || ++ (outarg.attr.mode ^ inode->i_mode) & S_IFMT) + goto invalid; + + forget_all_cached_acls(inode); +@@ -297,6 +298,12 @@ int fuse_valid_type(int m) + S_ISBLK(m) || S_ISFIFO(m) || S_ISSOCK(m); + } + ++bool fuse_invalid_attr(struct fuse_attr *attr) ++{ ++ return !fuse_valid_type(attr->mode) || ++ attr->size > LLONG_MAX; ++} ++ + int fuse_lookup_name(struct super_block *sb, u64 nodeid, const struct qstr *name, + struct fuse_entry_out *outarg, struct inode **inode) + { +@@ -328,7 +335,7 @@ int fuse_lookup_name(struct super_block *sb, u64 nodeid, const struct qstr *name + err = -EIO; + if (!outarg->nodeid) + goto out_put_forget; +- if (!fuse_valid_type(outarg->attr.mode)) ++ if (fuse_invalid_attr(&outarg->attr)) + goto out_put_forget; + + *inode = fuse_iget(sb, outarg->nodeid, outarg->generation, +@@ -451,7 +458,8 @@ static int fuse_create_open(struct inode *dir, struct dentry *entry, + goto out_free_ff; + + err = -EIO; +- if (!S_ISREG(outentry.attr.mode) || invalid_nodeid(outentry.nodeid)) ++ if (!S_ISREG(outentry.attr.mode) || invalid_nodeid(outentry.nodeid) || ++ fuse_invalid_attr(&outentry.attr)) + goto out_free_ff; + + ff->fh = outopen.fh; +@@ -557,7 +565,7 @@ static int create_new_entry(struct fuse_conn *fc, struct fuse_args *args, + goto out_put_forget_req; + + err = -EIO; +- if (invalid_nodeid(outarg.nodeid)) ++ if (invalid_nodeid(outarg.nodeid) || fuse_invalid_attr(&outarg.attr)) + goto out_put_forget_req; + + if ((outarg.attr.mode ^ mode) & S_IFMT) +@@ -830,7 +838,8 @@ static int fuse_link(struct dentry *entry, struct inode *newdir, + + spin_lock(&fc->lock); + fi->attr_version = ++fc->attr_version; +- inc_nlink(inode); ++ if (likely(inode->i_nlink < UINT_MAX)) ++ inc_nlink(inode); + spin_unlock(&fc->lock); + fuse_invalidate_attr(inode); + fuse_update_ctime(inode); +@@ -910,7 +919,8 @@ static int fuse_do_getattr(struct inode *inode, struct kstat *stat, + args.out.args[0].value = &outarg; + err = fuse_simple_request(fc, &args); + if (!err) { +- if ((inode->i_mode ^ outarg.attr.mode) & S_IFMT) { ++ if (fuse_invalid_attr(&outarg.attr) || ++ (inode->i_mode ^ outarg.attr.mode) & S_IFMT) { + make_bad_inode(inode); + err = -EIO; + } else { +@@ -1214,7 +1224,7 @@ static int fuse_direntplus_link(struct file *file, + + if (invalid_nodeid(o->nodeid)) + return -EIO; +- if (!fuse_valid_type(o->attr.mode)) ++ if (fuse_invalid_attr(&o->attr)) + return -EIO; + + fc = get_fuse_conn(dir); +@@ -1691,7 +1701,8 @@ int fuse_do_setattr(struct dentry *dentry, struct iattr *attr, + goto error; + } + +- if ((inode->i_mode ^ outarg.attr.mode) & S_IFMT) { ++ if (fuse_invalid_attr(&outarg.attr) || ++ (inode->i_mode ^ outarg.attr.mode) & S_IFMT) { + make_bad_inode(inode); + err = -EIO; + goto error; +diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h +index e682f2eff6c0..338aa5e266d6 100644 +--- a/fs/fuse/fuse_i.h ++++ b/fs/fuse/fuse_i.h +@@ -896,6 +896,8 @@ void fuse_ctl_remove_conn(struct fuse_conn *fc); + */ + int fuse_valid_type(int m); + ++bool fuse_invalid_attr(struct fuse_attr *attr); ++ + /** + * Is current process allowed to perform filesystem operation? + */ +diff --git a/fs/gfs2/log.c b/fs/gfs2/log.c +index 483b82e2be92..a3208511f35a 100644 +--- a/fs/gfs2/log.c ++++ b/fs/gfs2/log.c +@@ -594,6 +594,14 @@ void gfs2_add_revoke(struct gfs2_sbd *sdp, struct gfs2_bufdata *bd) + list_add(&bd->bd_list, &sdp->sd_log_le_revoke); + } + ++void gfs2_glock_remove_revoke(struct gfs2_glock *gl) ++{ ++ if (atomic_dec_return(&gl->gl_revokes) == 0) { ++ clear_bit(GLF_LFLUSH, &gl->gl_flags); ++ gfs2_glock_queue_put(gl); ++ } ++} ++ + void gfs2_write_revokes(struct gfs2_sbd *sdp) + { + struct gfs2_trans *tr; +diff --git a/fs/gfs2/log.h b/fs/gfs2/log.h +index 9499a6049212..3b7b7839ec6a 100644 +--- a/fs/gfs2/log.h ++++ b/fs/gfs2/log.h +@@ -80,6 +80,7 @@ extern void gfs2_ail1_flush(struct gfs2_sbd *sdp, struct writeback_control *wbc) + extern void gfs2_log_shutdown(struct gfs2_sbd *sdp); + extern int gfs2_logd(void *data); + extern void gfs2_add_revoke(struct gfs2_sbd *sdp, struct gfs2_bufdata *bd); ++extern void gfs2_glock_remove_revoke(struct gfs2_glock *gl); + extern void gfs2_write_revokes(struct gfs2_sbd *sdp); + + #endif /* __LOG_DOT_H__ */ +diff --git a/fs/gfs2/lops.c b/fs/gfs2/lops.c +index 049f8c6721b4..a5041e6d2c0d 100644 +--- a/fs/gfs2/lops.c ++++ b/fs/gfs2/lops.c +@@ -660,10 +660,7 @@ static void revoke_lo_after_commit(struct gfs2_sbd *sdp, struct gfs2_trans *tr) + bd = list_entry(head->next, struct gfs2_bufdata, bd_list); + list_del_init(&bd->bd_list); + gl = bd->bd_gl; +- if (atomic_dec_return(&gl->gl_revokes) == 0) { +- clear_bit(GLF_LFLUSH, &gl->gl_flags); +- gfs2_glock_queue_put(gl); +- } ++ gfs2_glock_remove_revoke(gl); + kmem_cache_free(gfs2_bufdata_cachep, bd); + } + } +diff --git a/fs/gfs2/trans.c b/fs/gfs2/trans.c +index affef3c066e0..69e3402a3cc5 100644 +--- a/fs/gfs2/trans.c ++++ b/fs/gfs2/trans.c +@@ -277,6 +277,8 @@ void gfs2_trans_add_unrevoke(struct gfs2_sbd *sdp, u64 blkno, unsigned int len) + list_del_init(&bd->bd_list); + gfs2_assert_withdraw(sdp, sdp->sd_log_num_revoke); + sdp->sd_log_num_revoke--; ++ if (bd->bd_gl) ++ gfs2_glock_remove_revoke(bd->bd_gl); + kmem_cache_free(gfs2_bufdata_cachep, bd); + tr->tr_num_revoke_rm++; + if (--n == 0) +diff --git a/fs/iomap.c b/fs/iomap.c +index 467d98bf7054..3f5b1655cfce 100644 +--- a/fs/iomap.c ++++ b/fs/iomap.c +@@ -941,7 +941,14 @@ iomap_dio_actor(struct inode *inode, loff_t pos, loff_t length, + dio->submit.cookie = submit_bio(bio); + } while (nr_pages); + +- if (need_zeroout) { ++ /* ++ * We need to zeroout the tail of a sub-block write if the extent type ++ * requires zeroing or the write extends beyond EOF. If we don't zero ++ * the block tail in the latter case, we can expose stale data via mmap ++ * reads of the EOF block. ++ */ ++ if (need_zeroout || ++ ((dio->flags & IOMAP_DIO_WRITE) && pos >= i_size_read(inode))) { + /* zero out from the end of the write to the end of the block */ + pad = pos & (fs_block_size - 1); + if (pad) +@@ -1046,8 +1053,15 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter, + } + pos += ret; + +- if (iov_iter_rw(iter) == READ && pos >= dio->i_size) ++ if (iov_iter_rw(iter) == READ && pos >= dio->i_size) { ++ /* ++ * We only report that we've read data up to i_size. ++ * Revert iter to a state corresponding to that as ++ * some callers (such as splice code) rely on it. ++ */ ++ iov_iter_revert(iter, pos - dio->i_size); + break; ++ } + } while ((count = iov_iter_count(iter)) > 0); + blk_finish_plug(&plug); + +diff --git a/fs/kernfs/dir.c b/fs/kernfs/dir.c +index 9e9117533fd7..8697b750b1c9 100644 +--- a/fs/kernfs/dir.c ++++ b/fs/kernfs/dir.c +@@ -623,7 +623,6 @@ static struct kernfs_node *__kernfs_new_node(struct kernfs_root *root, + { + struct kernfs_node *kn; + u32 gen; +- int cursor; + int ret; + + name = kstrdup_const(name, GFP_KERNEL); +@@ -636,11 +635,11 @@ static struct kernfs_node *__kernfs_new_node(struct kernfs_root *root, + + idr_preload(GFP_KERNEL); + spin_lock(&kernfs_idr_lock); +- cursor = idr_get_cursor(&root->ino_idr); + ret = idr_alloc_cyclic(&root->ino_idr, kn, 1, 0, GFP_ATOMIC); +- if (ret >= 0 && ret < cursor) ++ if (ret >= 0 && ret < root->last_ino) + root->next_generation++; + gen = root->next_generation; ++ root->last_ino = ret; + spin_unlock(&kernfs_idr_lock); + idr_preload_end(); + if (ret < 0) +diff --git a/fs/lockd/clnt4xdr.c b/fs/lockd/clnt4xdr.c +index 00d5ef5f99f7..214a2fa1f1e3 100644 +--- a/fs/lockd/clnt4xdr.c ++++ b/fs/lockd/clnt4xdr.c +@@ -128,24 +128,14 @@ static void encode_netobj(struct xdr_stream *xdr, + static int decode_netobj(struct xdr_stream *xdr, + struct xdr_netobj *obj) + { +- u32 length; +- __be32 *p; ++ ssize_t ret; + +- p = xdr_inline_decode(xdr, 4); +- if (unlikely(p == NULL)) +- goto out_overflow; +- length = be32_to_cpup(p++); +- if (unlikely(length > XDR_MAX_NETOBJ)) +- goto out_size; +- obj->len = length; +- obj->data = (u8 *)p; ++ ret = xdr_stream_decode_opaque_inline(xdr, (void *)&obj->data, ++ XDR_MAX_NETOBJ); ++ if (unlikely(ret < 0)) ++ return -EIO; ++ obj->len = ret; + return 0; +-out_size: +- dprintk("NFS: returned netobj was too long: %u\n", length); +- return -EIO; +-out_overflow: +- print_overflow_msg(__func__, xdr); +- return -EIO; + } + + /* +diff --git a/fs/lockd/clntxdr.c b/fs/lockd/clntxdr.c +index 2c6176387143..747b9c8c940a 100644 +--- a/fs/lockd/clntxdr.c ++++ b/fs/lockd/clntxdr.c +@@ -125,24 +125,14 @@ static void encode_netobj(struct xdr_stream *xdr, + static int decode_netobj(struct xdr_stream *xdr, + struct xdr_netobj *obj) + { +- u32 length; +- __be32 *p; ++ ssize_t ret; + +- p = xdr_inline_decode(xdr, 4); +- if (unlikely(p == NULL)) +- goto out_overflow; +- length = be32_to_cpup(p++); +- if (unlikely(length > XDR_MAX_NETOBJ)) +- goto out_size; +- obj->len = length; +- obj->data = (u8 *)p; ++ ret = xdr_stream_decode_opaque_inline(xdr, (void *)&obj->data, ++ XDR_MAX_NETOBJ); ++ if (unlikely(ret < 0)) ++ return -EIO; ++ obj->len = ret; + return 0; +-out_size: +- dprintk("NFS: returned netobj was too long: %u\n", length); +- return -EIO; +-out_overflow: +- print_overflow_msg(__func__, xdr); +- return -EIO; + } + + /* +diff --git a/fs/nfsd/nfs4recover.c b/fs/nfsd/nfs4recover.c +index 66eaeb1e8c2c..dc9586feab31 100644 +--- a/fs/nfsd/nfs4recover.c ++++ b/fs/nfsd/nfs4recover.c +@@ -661,7 +661,7 @@ struct cld_net { + struct cld_upcall { + struct list_head cu_list; + struct cld_net *cu_net; +- struct task_struct *cu_task; ++ struct completion cu_done; + struct cld_msg cu_msg; + }; + +@@ -670,23 +670,18 @@ __cld_pipe_upcall(struct rpc_pipe *pipe, struct cld_msg *cmsg) + { + int ret; + struct rpc_pipe_msg msg; ++ struct cld_upcall *cup = container_of(cmsg, struct cld_upcall, cu_msg); + + memset(&msg, 0, sizeof(msg)); + msg.data = cmsg; + msg.len = sizeof(*cmsg); + +- /* +- * Set task state before we queue the upcall. That prevents +- * wake_up_process in the downcall from racing with schedule. +- */ +- set_current_state(TASK_UNINTERRUPTIBLE); + ret = rpc_queue_upcall(pipe, &msg); + if (ret < 0) { +- set_current_state(TASK_RUNNING); + goto out; + } + +- schedule(); ++ wait_for_completion(&cup->cu_done); + + if (msg.errno < 0) + ret = msg.errno; +@@ -753,7 +748,7 @@ cld_pipe_downcall(struct file *filp, const char __user *src, size_t mlen) + if (copy_from_user(&cup->cu_msg, src, mlen) != 0) + return -EFAULT; + +- wake_up_process(cup->cu_task); ++ complete(&cup->cu_done); + return mlen; + } + +@@ -768,7 +763,7 @@ cld_pipe_destroy_msg(struct rpc_pipe_msg *msg) + if (msg->errno >= 0) + return; + +- wake_up_process(cup->cu_task); ++ complete(&cup->cu_done); + } + + static const struct rpc_pipe_ops cld_upcall_ops = { +@@ -899,7 +894,7 @@ restart_search: + goto restart_search; + } + } +- new->cu_task = current; ++ init_completion(&new->cu_done); + new->cu_msg.cm_vers = CLD_UPCALL_VERSION; + put_unaligned(cn->cn_xid++, &new->cu_msg.cm_xid); + new->cu_net = cn; +diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c +index f55527ef21e8..06d1f2edf2ec 100644 +--- a/fs/nfsd/vfs.c ++++ b/fs/nfsd/vfs.c +@@ -396,10 +396,23 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap, + bool get_write_count; + bool size_change = (iap->ia_valid & ATTR_SIZE); + +- if (iap->ia_valid & (ATTR_ATIME | ATTR_MTIME | ATTR_SIZE)) ++ if (iap->ia_valid & ATTR_SIZE) { + accmode |= NFSD_MAY_WRITE|NFSD_MAY_OWNER_OVERRIDE; +- if (iap->ia_valid & ATTR_SIZE) + ftype = S_IFREG; ++ } ++ ++ /* ++ * If utimes(2) and friends are called with times not NULL, we should ++ * not set NFSD_MAY_WRITE bit. Otherwise fh_verify->nfsd_permission ++ * will return EACCESS, when the caller's effective UID does not match ++ * the owner of the file, and the caller is not privileged. In this ++ * situation, we should return EPERM(notify_change will return this). ++ */ ++ if (iap->ia_valid & (ATTR_ATIME | ATTR_MTIME)) { ++ accmode |= NFSD_MAY_OWNER_OVERRIDE; ++ if (!(iap->ia_valid & (ATTR_ATIME_SET | ATTR_MTIME_SET))) ++ accmode |= NFSD_MAY_WRITE; ++ } + + /* Callers that do fh_verify should do the fh_want_write: */ + get_write_count = !fhp->fh_dentry; +diff --git a/fs/ocfs2/quota_global.c b/fs/ocfs2/quota_global.c +index b39d14cbfa34..d212d09c00b1 100644 +--- a/fs/ocfs2/quota_global.c ++++ b/fs/ocfs2/quota_global.c +@@ -727,7 +727,7 @@ static int ocfs2_release_dquot(struct dquot *dquot) + + mutex_lock(&dquot->dq_lock); + /* Check whether we are not racing with some other dqget() */ +- if (atomic_read(&dquot->dq_count) > 1) ++ if (dquot_is_busy(dquot)) + goto out; + /* Running from downconvert thread? Postpone quota processing to wq */ + if (current == osb->dc_task) { +diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c +index ef11fa7b869e..8c561703275a 100644 +--- a/fs/overlayfs/dir.c ++++ b/fs/overlayfs/dir.c +@@ -1042,7 +1042,7 @@ static int ovl_rename(struct inode *olddir, struct dentry *old, + if (newdentry == trap) + goto out_dput; + +- if (WARN_ON(olddentry->d_inode == newdentry->d_inode)) ++ if (olddentry->d_inode == newdentry->d_inode) + goto out_dput; + + err = 0; +diff --git a/fs/pstore/ram.c b/fs/pstore/ram.c +index 40bfc6c58374..1e675be10926 100644 +--- a/fs/pstore/ram.c ++++ b/fs/pstore/ram.c +@@ -297,6 +297,7 @@ static ssize_t ramoops_pstore_read(struct pstore_record *record) + GFP_KERNEL); + if (!tmp_prz) + return -ENOMEM; ++ prz = tmp_prz; + free_prz = true; + + while (cxt->ftrace_read_cnt < cxt->max_ftrace_cnt) { +@@ -319,7 +320,6 @@ static ssize_t ramoops_pstore_read(struct pstore_record *record) + goto out; + } + record->id = 0; +- prz = tmp_prz; + } + } + +diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c +index 9c81fd973418..3254c90fd899 100644 +--- a/fs/quota/dquot.c ++++ b/fs/quota/dquot.c +@@ -491,7 +491,7 @@ int dquot_release(struct dquot *dquot) + + mutex_lock(&dquot->dq_lock); + /* Check whether we are not racing with some other dqget() */ +- if (atomic_read(&dquot->dq_count) > 1) ++ if (dquot_is_busy(dquot)) + goto out_dqlock; + if (dqopt->ops[dquot->dq_id.type]->release_dqblk) { + ret = dqopt->ops[dquot->dq_id.type]->release_dqblk(dquot); +@@ -617,7 +617,7 @@ EXPORT_SYMBOL(dquot_scan_active); + /* Write all dquot structures to quota files */ + int dquot_writeback_dquots(struct super_block *sb, int type) + { +- struct list_head *dirty; ++ struct list_head dirty; + struct dquot *dquot; + struct quota_info *dqopt = sb_dqopt(sb); + int cnt; +@@ -631,9 +631,10 @@ int dquot_writeback_dquots(struct super_block *sb, int type) + if (!sb_has_quota_active(sb, cnt)) + continue; + spin_lock(&dq_list_lock); +- dirty = &dqopt->info[cnt].dqi_dirty_list; +- while (!list_empty(dirty)) { +- dquot = list_first_entry(dirty, struct dquot, ++ /* Move list away to avoid livelock. */ ++ list_replace_init(&dqopt->info[cnt].dqi_dirty_list, &dirty); ++ while (!list_empty(&dirty)) { ++ dquot = list_first_entry(&dirty, struct dquot, + dq_dirty); + + WARN_ON(!test_bit(DQ_ACTIVE_B, &dquot->dq_flags)); +diff --git a/fs/reiserfs/inode.c b/fs/reiserfs/inode.c +index 11a48affa882..683496322aa8 100644 +--- a/fs/reiserfs/inode.c ++++ b/fs/reiserfs/inode.c +@@ -2096,6 +2096,15 @@ int reiserfs_new_inode(struct reiserfs_transaction_handle *th, + goto out_inserted_sd; + } + ++ /* ++ * Mark it private if we're creating the privroot ++ * or something under it. ++ */ ++ if (IS_PRIVATE(dir) || dentry == REISERFS_SB(sb)->priv_root) { ++ inode->i_flags |= S_PRIVATE; ++ inode->i_opflags &= ~IOP_XATTR; ++ } ++ + if (reiserfs_posixacl(inode->i_sb)) { + reiserfs_write_unlock(inode->i_sb); + retval = reiserfs_inherit_default_acl(th, dir, dentry, inode); +@@ -2110,8 +2119,7 @@ int reiserfs_new_inode(struct reiserfs_transaction_handle *th, + reiserfs_warning(inode->i_sb, "jdm-13090", + "ACLs aren't enabled in the fs, " + "but vfs thinks they are!"); +- } else if (IS_PRIVATE(dir)) +- inode->i_flags |= S_PRIVATE; ++ } + + if (security->name) { + reiserfs_write_unlock(inode->i_sb); +diff --git a/fs/reiserfs/namei.c b/fs/reiserfs/namei.c +index 5089dac02660..14ba7a12b89d 100644 +--- a/fs/reiserfs/namei.c ++++ b/fs/reiserfs/namei.c +@@ -377,10 +377,13 @@ static struct dentry *reiserfs_lookup(struct inode *dir, struct dentry *dentry, + + /* + * Propagate the private flag so we know we're +- * in the priv tree ++ * in the priv tree. Also clear IOP_XATTR ++ * since we don't have xattrs on xattr files. + */ +- if (IS_PRIVATE(dir)) ++ if (IS_PRIVATE(dir)) { + inode->i_flags |= S_PRIVATE; ++ inode->i_opflags &= ~IOP_XATTR; ++ } + } + reiserfs_write_unlock(dir->i_sb); + if (retval == IO_ERROR) { +diff --git a/fs/reiserfs/reiserfs.h b/fs/reiserfs/reiserfs.h +index eabf85371ece..0efe7c7c4124 100644 +--- a/fs/reiserfs/reiserfs.h ++++ b/fs/reiserfs/reiserfs.h +@@ -1168,6 +1168,8 @@ static inline int bmap_would_wrap(unsigned bmap_nr) + return bmap_nr > ((1LL << 16) - 1); + } + ++extern const struct xattr_handler *reiserfs_xattr_handlers[]; ++ + /* + * this says about version of key of all items (but stat data) the + * object consists of +diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c +index 4885c7b6e44f..cc0b22c72e83 100644 +--- a/fs/reiserfs/super.c ++++ b/fs/reiserfs/super.c +@@ -2052,6 +2052,8 @@ static int reiserfs_fill_super(struct super_block *s, void *data, int silent) + if (replay_only(s)) + goto error_unlocked; + ++ s->s_xattr = reiserfs_xattr_handlers; ++ + if (bdev_read_only(s->s_bdev) && !sb_rdonly(s)) { + SWARN(silent, s, "clm-7000", + "Detected readonly device, marking FS readonly"); +diff --git a/fs/reiserfs/xattr.c b/fs/reiserfs/xattr.c +index 83423192588c..29a0c0969e91 100644 +--- a/fs/reiserfs/xattr.c ++++ b/fs/reiserfs/xattr.c +@@ -122,13 +122,13 @@ static struct dentry *open_xa_root(struct super_block *sb, int flags) + struct dentry *xaroot; + + if (d_really_is_negative(privroot)) +- return ERR_PTR(-ENODATA); ++ return ERR_PTR(-EOPNOTSUPP); + + inode_lock_nested(d_inode(privroot), I_MUTEX_XATTR); + + xaroot = dget(REISERFS_SB(sb)->xattr_root); + if (!xaroot) +- xaroot = ERR_PTR(-ENODATA); ++ xaroot = ERR_PTR(-EOPNOTSUPP); + else if (d_really_is_negative(xaroot)) { + int err = -ENODATA; + +@@ -610,6 +610,10 @@ int reiserfs_xattr_set(struct inode *inode, const char *name, + int error, error2; + size_t jbegin_count = reiserfs_xattr_nblocks(inode, buffer_size); + ++ /* Check before we start a transaction and then do nothing. */ ++ if (!d_really_is_positive(REISERFS_SB(inode->i_sb)->priv_root)) ++ return -EOPNOTSUPP; ++ + if (!(flags & XATTR_REPLACE)) + jbegin_count += reiserfs_xattr_jcreate_nblocks(inode); + +@@ -832,8 +836,7 @@ ssize_t reiserfs_listxattr(struct dentry * dentry, char *buffer, size_t size) + if (d_really_is_negative(dentry)) + return -EINVAL; + +- if (!dentry->d_sb->s_xattr || +- get_inode_sd_version(d_inode(dentry)) == STAT_DATA_V1) ++ if (get_inode_sd_version(d_inode(dentry)) == STAT_DATA_V1) + return -EOPNOTSUPP; + + dir = open_xa_dir(d_inode(dentry), XATTR_REPLACE); +@@ -873,6 +876,7 @@ static int create_privroot(struct dentry *dentry) + } + + d_inode(dentry)->i_flags |= S_PRIVATE; ++ d_inode(dentry)->i_opflags &= ~IOP_XATTR; + reiserfs_info(dentry->d_sb, "Created %s - reserved for xattr " + "storage.\n", PRIVROOT_NAME); + +@@ -886,7 +890,7 @@ static int create_privroot(struct dentry *dentry) { return 0; } + #endif + + /* Actual operations that are exported to VFS-land */ +-static const struct xattr_handler *reiserfs_xattr_handlers[] = { ++const struct xattr_handler *reiserfs_xattr_handlers[] = { + #ifdef CONFIG_REISERFS_FS_XATTR + &reiserfs_xattr_user_handler, + &reiserfs_xattr_trusted_handler, +@@ -957,8 +961,10 @@ int reiserfs_lookup_privroot(struct super_block *s) + if (!IS_ERR(dentry)) { + REISERFS_SB(s)->priv_root = dentry; + d_set_d_op(dentry, &xattr_lookup_poison_ops); +- if (d_really_is_positive(dentry)) ++ if (d_really_is_positive(dentry)) { + d_inode(dentry)->i_flags |= S_PRIVATE; ++ d_inode(dentry)->i_opflags &= ~IOP_XATTR; ++ } + } else + err = PTR_ERR(dentry); + inode_unlock(d_inode(s->s_root)); +@@ -987,7 +993,6 @@ int reiserfs_xattr_init(struct super_block *s, int mount_flags) + } + + if (d_really_is_positive(privroot)) { +- s->s_xattr = reiserfs_xattr_handlers; + inode_lock(d_inode(privroot)); + if (!REISERFS_SB(s)->xattr_root) { + struct dentry *dentry; +diff --git a/fs/reiserfs/xattr_acl.c b/fs/reiserfs/xattr_acl.c +index aa9380bac196..05f666794561 100644 +--- a/fs/reiserfs/xattr_acl.c ++++ b/fs/reiserfs/xattr_acl.c +@@ -320,10 +320,8 @@ reiserfs_inherit_default_acl(struct reiserfs_transaction_handle *th, + * would be useless since permissions are ignored, and a pain because + * it introduces locking cycles + */ +- if (IS_PRIVATE(dir)) { +- inode->i_flags |= S_PRIVATE; ++ if (IS_PRIVATE(inode)) + goto apply_umask; +- } + + err = posix_acl_create(dir, &inode->i_mode, &default_acl, &acl); + if (err) +diff --git a/include/dt-bindings/clock/rk3328-cru.h b/include/dt-bindings/clock/rk3328-cru.h +index d2b26a4b43eb..4a9db1b2669b 100644 +--- a/include/dt-bindings/clock/rk3328-cru.h ++++ b/include/dt-bindings/clock/rk3328-cru.h +@@ -178,7 +178,7 @@ + #define HCLK_TSP 309 + #define HCLK_GMAC 310 + #define HCLK_I2S0_8CH 311 +-#define HCLK_I2S1_8CH 313 ++#define HCLK_I2S1_8CH 312 + #define HCLK_I2S2_2CH 313 + #define HCLK_SPDIF_8CH 314 + #define HCLK_VOP 315 +diff --git a/include/linux/acpi.h b/include/linux/acpi.h +index d7a9700b9333..4bb3bca75004 100644 +--- a/include/linux/acpi.h ++++ b/include/linux/acpi.h +@@ -99,7 +99,7 @@ static inline bool has_acpi_companion(struct device *dev) + static inline void acpi_preset_companion(struct device *dev, + struct acpi_device *parent, u64 addr) + { +- ACPI_COMPANION_SET(dev, acpi_find_child_device(parent, addr, NULL)); ++ ACPI_COMPANION_SET(dev, acpi_find_child_device(parent, addr, false)); + } + + static inline const char *acpi_dev_name(struct acpi_device *adev) +diff --git a/include/linux/atalk.h b/include/linux/atalk.h +index 03885e63f92b..2664b9e89f9b 100644 +--- a/include/linux/atalk.h ++++ b/include/linux/atalk.h +@@ -108,7 +108,7 @@ static __inline__ struct elapaarp *aarp_hdr(struct sk_buff *skb) + #define AARP_RESOLVE_TIME (10 * HZ) + + extern struct datalink_proto *ddp_dl, *aarp_dl; +-extern void aarp_proto_init(void); ++extern int aarp_proto_init(void); + + /* Inter module exports */ + +diff --git a/include/linux/dma-mapping.h b/include/linux/dma-mapping.h +index 7bf3b99e6fbb..9aee5f345e29 100644 +--- a/include/linux/dma-mapping.h ++++ b/include/linux/dma-mapping.h +@@ -650,8 +650,7 @@ static inline unsigned int dma_get_max_seg_size(struct device *dev) + return SZ_64K; + } + +-static inline unsigned int dma_set_max_seg_size(struct device *dev, +- unsigned int size) ++static inline int dma_set_max_seg_size(struct device *dev, unsigned int size) + { + if (dev->dma_parms) { + dev->dma_parms->max_segment_size = size; +diff --git a/include/linux/jbd2.h b/include/linux/jbd2.h +index 11b3ab68f6a7..cb41329a3ee4 100644 +--- a/include/linux/jbd2.h ++++ b/include/linux/jbd2.h +@@ -1584,7 +1584,7 @@ static inline int jbd2_space_needed(journal_t *journal) + static inline unsigned long jbd2_log_space_left(journal_t *journal) + { + /* Allow for rounding errors */ +- unsigned long free = journal->j_free - 32; ++ long free = journal->j_free - 32; + + if (journal->j_committing_transaction) { + unsigned long committing = atomic_read(&journal-> +@@ -1593,7 +1593,7 @@ static inline unsigned long jbd2_log_space_left(journal_t *journal) + /* Transaction + control blocks */ + free -= committing + (committing >> JBD2_CONTROL_BLOCKS_SHIFT); + } +- return free; ++ return max_t(long, free, 0); + } + + /* +diff --git a/include/linux/kernfs.h b/include/linux/kernfs.h +index ab25c8b6d9e3..5e539e5bb70c 100644 +--- a/include/linux/kernfs.h ++++ b/include/linux/kernfs.h +@@ -185,6 +185,7 @@ struct kernfs_root { + + /* private fields, do not use outside kernfs proper */ + struct idr ino_idr; ++ u32 last_ino; + u32 next_generation; + struct kernfs_syscall_ops *syscall_ops; + +diff --git a/include/linux/mfd/rk808.h b/include/linux/mfd/rk808.h +index d3156594674c..338e0f6e2226 100644 +--- a/include/linux/mfd/rk808.h ++++ b/include/linux/mfd/rk808.h +@@ -443,7 +443,7 @@ enum { + enum { + RK805_ID = 0x8050, + RK808_ID = 0x0000, +- RK818_ID = 0x8181, ++ RK818_ID = 0x8180, + }; + + struct rk808 { +diff --git a/include/linux/mtd/mtd.h b/include/linux/mtd/mtd.h +index 6cd0f6b7658b..aadc2ee050f1 100644 +--- a/include/linux/mtd/mtd.h ++++ b/include/linux/mtd/mtd.h +@@ -401,7 +401,7 @@ static inline struct device_node *mtd_get_of_node(struct mtd_info *mtd) + return dev_of_node(&mtd->dev); + } + +-static inline int mtd_oobavail(struct mtd_info *mtd, struct mtd_oob_ops *ops) ++static inline u32 mtd_oobavail(struct mtd_info *mtd, struct mtd_oob_ops *ops) + { + return ops->mode == MTD_OPS_AUTO_OOB ? mtd->oobavail : mtd->oobsize; + } +diff --git a/include/linux/platform_data/dma-dw.h b/include/linux/platform_data/dma-dw.h +index 896cb71a382c..1a1d58ebffbf 100644 +--- a/include/linux/platform_data/dma-dw.h ++++ b/include/linux/platform_data/dma-dw.h +@@ -49,6 +49,7 @@ struct dw_dma_slave { + * @data_width: Maximum data width supported by hardware per AHB master + * (in bytes, power of 2) + * @multi_block: Multi block transfers supported by hardware per channel. ++ * @protctl: Protection control signals setting per channel. + */ + struct dw_dma_platform_data { + unsigned int nr_channels; +@@ -65,6 +66,11 @@ struct dw_dma_platform_data { + unsigned char nr_masters; + unsigned char data_width[DW_DMA_MAX_NR_MASTERS]; + unsigned char multi_block[DW_DMA_MAX_NR_CHANNELS]; ++#define CHAN_PROTCTL_PRIVILEGED BIT(0) ++#define CHAN_PROTCTL_BUFFERABLE BIT(1) ++#define CHAN_PROTCTL_CACHEABLE BIT(2) ++#define CHAN_PROTCTL_MASK GENMASK(2, 0) ++ unsigned char protctl; + }; + + #endif /* _PLATFORM_DATA_DMA_DW_H */ +diff --git a/include/linux/qcom_scm.h b/include/linux/qcom_scm.h +index e5380471c2cd..428278a44c7d 100644 +--- a/include/linux/qcom_scm.h ++++ b/include/linux/qcom_scm.h +@@ -44,6 +44,9 @@ extern int qcom_scm_restore_sec_cfg(u32 device_id, u32 spare); + extern int qcom_scm_iommu_secure_ptbl_size(u32 spare, size_t *size); + extern int qcom_scm_iommu_secure_ptbl_init(u64 addr, u32 size, u32 spare); + #else ++ ++#include ++ + static inline + int qcom_scm_set_cold_boot_addr(void *entry, const cpumask_t *cpus) + { +diff --git a/include/linux/quotaops.h b/include/linux/quotaops.h +index a109e6107c06..50ab5d6ccc4e 100644 +--- a/include/linux/quotaops.h ++++ b/include/linux/quotaops.h +@@ -51,6 +51,16 @@ static inline struct dquot *dqgrab(struct dquot *dquot) + atomic_inc(&dquot->dq_count); + return dquot; + } ++ ++static inline bool dquot_is_busy(struct dquot *dquot) ++{ ++ if (test_bit(DQ_MOD_B, &dquot->dq_flags)) ++ return true; ++ if (atomic_read(&dquot->dq_count) > 1) ++ return true; ++ return false; ++} ++ + void dqput(struct dquot *dquot); + int dquot_scan_active(struct super_block *sb, + int (*fn)(struct dquot *dquot, unsigned long priv), +diff --git a/include/linux/regulator/consumer.h b/include/linux/regulator/consumer.h +index 25602afd4844..f3f76051e8b0 100644 +--- a/include/linux/regulator/consumer.h ++++ b/include/linux/regulator/consumer.h +@@ -508,7 +508,7 @@ static inline int regulator_get_error_flags(struct regulator *regulator, + + static inline int regulator_set_load(struct regulator *regulator, int load_uA) + { +- return REGULATOR_MODE_NORMAL; ++ return 0; + } + + static inline int regulator_allow_bypass(struct regulator *regulator, +diff --git a/include/linux/serial_core.h b/include/linux/serial_core.h +index 868b60a79c0b..b2a7b7c15451 100644 +--- a/include/linux/serial_core.h ++++ b/include/linux/serial_core.h +@@ -166,6 +166,7 @@ struct uart_port { + struct console *cons; /* struct console, if any */ + #if defined(CONFIG_SERIAL_CORE_CONSOLE) || defined(SUPPORT_SYSRQ) + unsigned long sysrq; /* sysrq timeout */ ++ unsigned int sysrq_ch; /* char for sysrq */ + #endif + + /* flags must be updated while holding port mutex */ +@@ -474,8 +475,42 @@ uart_handle_sysrq_char(struct uart_port *port, unsigned int ch) + } + return 0; + } ++static inline int ++uart_prepare_sysrq_char(struct uart_port *port, unsigned int ch) ++{ ++ if (port->sysrq) { ++ if (ch && time_before(jiffies, port->sysrq)) { ++ port->sysrq_ch = ch; ++ port->sysrq = 0; ++ return 1; ++ } ++ port->sysrq = 0; ++ } ++ return 0; ++} ++static inline void ++uart_unlock_and_check_sysrq(struct uart_port *port, unsigned long irqflags) ++{ ++ int sysrq_ch; ++ ++ sysrq_ch = port->sysrq_ch; ++ port->sysrq_ch = 0; ++ ++ spin_unlock_irqrestore(&port->lock, irqflags); ++ ++ if (sysrq_ch) ++ handle_sysrq(sysrq_ch); ++} + #else +-#define uart_handle_sysrq_char(port,ch) ({ (void)port; 0; }) ++static inline int ++uart_handle_sysrq_char(struct uart_port *port, unsigned int ch) { return 0; } ++static inline int ++uart_prepare_sysrq_char(struct uart_port *port, unsigned int ch) { return 0; } ++static inline void ++uart_unlock_and_check_sysrq(struct uart_port *port, unsigned long irqflags) ++{ ++ spin_unlock_irqrestore(&port->lock, irqflags); ++} + #endif + + /* +diff --git a/include/linux/tty.h b/include/linux/tty.h +index 1dd587ba6d88..0cd621d8c7f0 100644 +--- a/include/linux/tty.h ++++ b/include/linux/tty.h +@@ -365,6 +365,7 @@ struct tty_file_private { + #define TTY_NO_WRITE_SPLIT 17 /* Preserve write boundaries to driver */ + #define TTY_HUPPED 18 /* Post driver->hangup() */ + #define TTY_HUPPING 19 /* Hangup in progress */ ++#define TTY_LDISC_CHANGING 20 /* Change pending - non-block IO */ + #define TTY_LDISC_HALTED 22 /* Line discipline is halted */ + + /* Values for tty->flow_change */ +@@ -382,6 +383,12 @@ static inline void tty_set_flow_change(struct tty_struct *tty, int val) + smp_mb(); + } + ++static inline bool tty_io_nonblock(struct tty_struct *tty, struct file *file) ++{ ++ return file->f_flags & O_NONBLOCK || ++ test_bit(TTY_LDISC_CHANGING, &tty->flags); ++} ++ + static inline bool tty_io_error(struct tty_struct *tty) + { + return test_bit(TTY_IO_ERROR, &tty->flags); +diff --git a/include/math-emu/soft-fp.h b/include/math-emu/soft-fp.h +index 3f284bc03180..5650c1628383 100644 +--- a/include/math-emu/soft-fp.h ++++ b/include/math-emu/soft-fp.h +@@ -138,7 +138,7 @@ do { \ + _FP_FRAC_ADDI_##wc(X, _FP_WORK_ROUND); \ + } while (0) + +-#define _FP_ROUND_ZERO(wc, X) 0 ++#define _FP_ROUND_ZERO(wc, X) (void)0 + + #define _FP_ROUND_PINF(wc, X) \ + do { \ +diff --git a/include/uapi/linux/cec.h b/include/uapi/linux/cec.h +index c3114c989e91..f50dd34e4f7b 100644 +--- a/include/uapi/linux/cec.h ++++ b/include/uapi/linux/cec.h +@@ -789,8 +789,8 @@ struct cec_event { + #define CEC_MSG_SELECT_DIGITAL_SERVICE 0x93 + #define CEC_MSG_TUNER_DEVICE_STATUS 0x07 + /* Recording Flag Operand (rec_flag) */ +-#define CEC_OP_REC_FLAG_USED 0 +-#define CEC_OP_REC_FLAG_NOT_USED 1 ++#define CEC_OP_REC_FLAG_NOT_USED 0 ++#define CEC_OP_REC_FLAG_USED 1 + /* Tuner Display Info Operand (tuner_display_info) */ + #define CEC_OP_TUNER_DISPLAY_INFO_DIGITAL 0 + #define CEC_OP_TUNER_DISPLAY_INFO_NONE 1 +diff --git a/kernel/audit_watch.c b/kernel/audit_watch.c +index 4a98f6e314a9..35f1d706bd5b 100644 +--- a/kernel/audit_watch.c ++++ b/kernel/audit_watch.c +@@ -365,12 +365,12 @@ static int audit_get_nd(struct audit_watch *watch, struct path *parent) + struct dentry *d = kern_path_locked(watch->path, parent); + if (IS_ERR(d)) + return PTR_ERR(d); +- inode_unlock(d_backing_inode(parent->dentry)); + if (d_is_positive(d)) { + /* update watch filter fields */ + watch->dev = d->d_sb->s_dev; + watch->ino = d_backing_inode(d)->i_ino; + } ++ inode_unlock(d_backing_inode(parent->dentry)); + dput(d); + return 0; + } +diff --git a/kernel/cgroup/pids.c b/kernel/cgroup/pids.c +index c9960baaa14f..940d2e8db776 100644 +--- a/kernel/cgroup/pids.c ++++ b/kernel/cgroup/pids.c +@@ -48,7 +48,7 @@ struct pids_cgroup { + * %PIDS_MAX = (%PID_MAX_LIMIT + 1). + */ + atomic64_t counter; +- int64_t limit; ++ atomic64_t limit; + + /* Handle for "pids.events" */ + struct cgroup_file events_file; +@@ -76,8 +76,8 @@ pids_css_alloc(struct cgroup_subsys_state *parent) + if (!pids) + return ERR_PTR(-ENOMEM); + +- pids->limit = PIDS_MAX; + atomic64_set(&pids->counter, 0); ++ atomic64_set(&pids->limit, PIDS_MAX); + atomic64_set(&pids->events_limit, 0); + return &pids->css; + } +@@ -149,13 +149,14 @@ static int pids_try_charge(struct pids_cgroup *pids, int num) + + for (p = pids; parent_pids(p); p = parent_pids(p)) { + int64_t new = atomic64_add_return(num, &p->counter); ++ int64_t limit = atomic64_read(&p->limit); + + /* + * Since new is capped to the maximum number of pid_t, if + * p->limit is %PIDS_MAX then we know that this test will never + * fail. + */ +- if (new > p->limit) ++ if (new > limit) + goto revert; + } + +@@ -280,7 +281,7 @@ set_limit: + * Limit updates don't need to be mutex'd, since it isn't + * critical that any racing fork()s follow the new limit. + */ +- pids->limit = limit; ++ atomic64_set(&pids->limit, limit); + return nbytes; + } + +@@ -288,7 +289,7 @@ static int pids_max_show(struct seq_file *sf, void *v) + { + struct cgroup_subsys_state *css = seq_css(sf); + struct pids_cgroup *pids = css_pids(css); +- int64_t limit = pids->limit; ++ int64_t limit = atomic64_read(&pids->limit); + + if (limit >= PIDS_MAX) + seq_printf(sf, "%s\n", PIDS_MAX_STR); +diff --git a/kernel/module.c b/kernel/module.c +index 468567591241..feb1e0fbc3e8 100644 +--- a/kernel/module.c ++++ b/kernel/module.c +@@ -1020,6 +1020,8 @@ SYSCALL_DEFINE2(delete_module, const char __user *, name_user, + strlcpy(last_unloaded_module, mod->name, sizeof(last_unloaded_module)); + + free_module(mod); ++ /* someone could wait for the module in add_unformed_module() */ ++ wake_up_all(&module_wq); + return 0; + out: + mutex_unlock(&module_mutex); +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index bbf8b32fc69e..97a27726ea21 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -5242,10 +5242,11 @@ void init_idle(struct task_struct *idle, int cpu) + struct rq *rq = cpu_rq(cpu); + unsigned long flags; + ++ __sched_fork(0, idle); ++ + raw_spin_lock_irqsave(&idle->pi_lock, flags); + raw_spin_lock(&rq->lock); + +- __sched_fork(0, idle); + idle->state = TASK_RUNNING; + idle->se.exec_start = sched_clock(); + idle->flags |= PF_IDLE; +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index 67433fbdcb5a..0b4e997fea1a 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -4655,20 +4655,28 @@ static enum hrtimer_restart sched_cfs_period_timer(struct hrtimer *timer) + if (++count > 3) { + u64 new, old = ktime_to_ns(cfs_b->period); + +- new = (old * 147) / 128; /* ~115% */ +- new = min(new, max_cfs_quota_period); +- +- cfs_b->period = ns_to_ktime(new); +- +- /* since max is 1s, this is limited to 1e9^2, which fits in u64 */ +- cfs_b->quota *= new; +- cfs_b->quota = div64_u64(cfs_b->quota, old); +- +- pr_warn_ratelimited( +- "cfs_period_timer[cpu%d]: period too short, scaling up (new cfs_period_us %lld, cfs_quota_us = %lld)\n", +- smp_processor_id(), +- div_u64(new, NSEC_PER_USEC), +- div_u64(cfs_b->quota, NSEC_PER_USEC)); ++ /* ++ * Grow period by a factor of 2 to avoid losing precision. ++ * Precision loss in the quota/period ratio can cause __cfs_schedulable ++ * to fail. ++ */ ++ new = old * 2; ++ if (new < max_cfs_quota_period) { ++ cfs_b->period = ns_to_ktime(new); ++ cfs_b->quota *= 2; ++ ++ pr_warn_ratelimited( ++ "cfs_period_timer[cpu%d]: period too short, scaling up (new cfs_period_us = %lld, cfs_quota_us = %lld)\n", ++ smp_processor_id(), ++ div_u64(new, NSEC_PER_USEC), ++ div_u64(cfs_b->quota, NSEC_PER_USEC)); ++ } else { ++ pr_warn_ratelimited( ++ "cfs_period_timer[cpu%d]: period too short, but cannot scale up without losing precision (cfs_period_us = %lld, cfs_quota_us = %lld)\n", ++ smp_processor_id(), ++ div_u64(old, NSEC_PER_USEC), ++ div_u64(cfs_b->quota, NSEC_PER_USEC)); ++ } + + /* reset count so we don't come right back in here */ + count = 0; +diff --git a/kernel/workqueue.c b/kernel/workqueue.c +index 08bc551976b2..a37f5dc7cb39 100644 +--- a/kernel/workqueue.c ++++ b/kernel/workqueue.c +@@ -2366,8 +2366,14 @@ repeat: + */ + if (need_to_create_worker(pool)) { + spin_lock(&wq_mayday_lock); +- get_pwq(pwq); +- list_move_tail(&pwq->mayday_node, &wq->maydays); ++ /* ++ * Queue iff we aren't racing destruction ++ * and somebody else hasn't queued it already. ++ */ ++ if (wq->rescuer && list_empty(&pwq->mayday_node)) { ++ get_pwq(pwq); ++ list_add_tail(&pwq->mayday_node, &wq->maydays); ++ } + spin_unlock(&wq_mayday_lock); + } + } +@@ -4084,9 +4090,29 @@ void destroy_workqueue(struct workqueue_struct *wq) + struct pool_workqueue *pwq; + int node; + ++ /* ++ * Remove it from sysfs first so that sanity check failure doesn't ++ * lead to sysfs name conflicts. ++ */ ++ workqueue_sysfs_unregister(wq); ++ + /* drain it before proceeding with destruction */ + drain_workqueue(wq); + ++ /* kill rescuer, if sanity checks fail, leave it w/o rescuer */ ++ if (wq->rescuer) { ++ struct worker *rescuer = wq->rescuer; ++ ++ /* this prevents new queueing */ ++ spin_lock_irq(&wq_mayday_lock); ++ wq->rescuer = NULL; ++ spin_unlock_irq(&wq_mayday_lock); ++ ++ /* rescuer will empty maydays list before exiting */ ++ kthread_stop(rescuer->task); ++ kfree(rescuer); ++ } ++ + /* sanity checks */ + mutex_lock(&wq->mutex); + for_each_pwq(pwq, wq) { +@@ -4118,11 +4144,6 @@ void destroy_workqueue(struct workqueue_struct *wq) + list_del_rcu(&wq->list); + mutex_unlock(&wq_pool_mutex); + +- workqueue_sysfs_unregister(wq); +- +- if (wq->rescuer) +- kthread_stop(wq->rescuer->task); +- + if (!(wq->flags & WQ_UNBOUND)) { + /* + * The base ref is never dropped on per-cpu pwqs. Directly +@@ -4399,7 +4420,8 @@ static void show_pwq(struct pool_workqueue *pwq) + pr_info(" pwq %d:", pool->id); + pr_cont_pool_info(pool); + +- pr_cont(" active=%d/%d%s\n", pwq->nr_active, pwq->max_active, ++ pr_cont(" active=%d/%d refcnt=%d%s\n", ++ pwq->nr_active, pwq->max_active, pwq->refcnt, + !list_empty(&pwq->mayday_node) ? " MAYDAY" : ""); + + hash_for_each(pool->busy_hash, bkt, worker, hentry) { +diff --git a/lib/raid6/unroll.awk b/lib/raid6/unroll.awk +index c6aa03631df8..0809805a7e23 100644 +--- a/lib/raid6/unroll.awk ++++ b/lib/raid6/unroll.awk +@@ -13,7 +13,7 @@ BEGIN { + for (i = 0; i < rep; ++i) { + tmp = $0 + gsub(/\$\$/, i, tmp) +- gsub(/\$\#/, n, tmp) ++ gsub(/\$#/, n, tmp) + gsub(/\$\*/, "$", tmp) + print tmp + } +diff --git a/mm/shmem.c b/mm/shmem.c +index e55aa460a2c0..69106c600692 100644 +--- a/mm/shmem.c ++++ b/mm/shmem.c +@@ -2895,7 +2895,7 @@ static long shmem_fallocate(struct file *file, int mode, loff_t offset, + } + + shmem_falloc.waitq = &shmem_falloc_waitq; +- shmem_falloc.start = unmap_start >> PAGE_SHIFT; ++ shmem_falloc.start = (u64)unmap_start >> PAGE_SHIFT; + shmem_falloc.next = (unmap_end + 1) >> PAGE_SHIFT; + spin_lock(&inode->i_lock); + inode->i_private = &shmem_falloc; +diff --git a/mm/vmstat.c b/mm/vmstat.c +index ba9168326413..e2197b03da57 100644 +--- a/mm/vmstat.c ++++ b/mm/vmstat.c +@@ -1805,12 +1805,13 @@ static bool need_update(int cpu) + + /* + * The fast way of checking if there are any vmstat diffs. +- * This works because the diffs are byte sized items. + */ +- if (memchr_inv(p->vm_stat_diff, 0, NR_VM_ZONE_STAT_ITEMS)) ++ if (memchr_inv(p->vm_stat_diff, 0, NR_VM_ZONE_STAT_ITEMS * ++ sizeof(p->vm_stat_diff[0]))) + return true; + #ifdef CONFIG_NUMA +- if (memchr_inv(p->vm_numa_stat_diff, 0, NR_VM_NUMA_STAT_ITEMS)) ++ if (memchr_inv(p->vm_numa_stat_diff, 0, NR_VM_NUMA_STAT_ITEMS * ++ sizeof(p->vm_numa_stat_diff[0]))) + return true; + #endif + } +diff --git a/net/appletalk/aarp.c b/net/appletalk/aarp.c +index 8ad3ec2610b6..b9e85a4751a6 100644 +--- a/net/appletalk/aarp.c ++++ b/net/appletalk/aarp.c +@@ -879,15 +879,24 @@ static struct notifier_block aarp_notifier = { + + static unsigned char aarp_snap_id[] = { 0x00, 0x00, 0x00, 0x80, 0xF3 }; + +-void __init aarp_proto_init(void) ++int __init aarp_proto_init(void) + { ++ int rc; ++ + aarp_dl = register_snap_client(aarp_snap_id, aarp_rcv); +- if (!aarp_dl) ++ if (!aarp_dl) { + printk(KERN_CRIT "Unable to register AARP with SNAP.\n"); ++ return -ENOMEM; ++ } + setup_timer(&aarp_timer, aarp_expire_timeout, 0); + aarp_timer.expires = jiffies + sysctl_aarp_expiry_time; + add_timer(&aarp_timer); +- register_netdevice_notifier(&aarp_notifier); ++ rc = register_netdevice_notifier(&aarp_notifier); ++ if (rc) { ++ del_timer_sync(&aarp_timer); ++ unregister_snap_client(aarp_dl); ++ } ++ return rc; + } + + /* Remove the AARP entries associated with a device. */ +diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c +index 475f332b1ad2..b4268bd2e557 100644 +--- a/net/appletalk/ddp.c ++++ b/net/appletalk/ddp.c +@@ -1911,9 +1911,6 @@ static unsigned char ddp_snap_id[] = { 0x08, 0x00, 0x07, 0x80, 0x9B }; + EXPORT_SYMBOL(atrtr_get_dev); + EXPORT_SYMBOL(atalk_find_dev_addr); + +-static const char atalk_err_snap[] __initconst = +- KERN_CRIT "Unable to register DDP with SNAP.\n"; +- + /* Called by proto.c on kernel start up */ + static int __init atalk_init(void) + { +@@ -1928,17 +1925,23 @@ static int __init atalk_init(void) + goto out_proto; + + ddp_dl = register_snap_client(ddp_snap_id, atalk_rcv); +- if (!ddp_dl) +- printk(atalk_err_snap); ++ if (!ddp_dl) { ++ pr_crit("Unable to register DDP with SNAP.\n"); ++ rc = -ENOMEM; ++ goto out_sock; ++ } + + dev_add_pack(<alk_packet_type); + dev_add_pack(&ppptalk_packet_type); + + rc = register_netdevice_notifier(&ddp_notifier); + if (rc) +- goto out_sock; ++ goto out_snap; ++ ++ rc = aarp_proto_init(); ++ if (rc) ++ goto out_dev; + +- aarp_proto_init(); + rc = atalk_proc_init(); + if (rc) + goto out_aarp; +@@ -1952,11 +1955,13 @@ out_proc: + atalk_proc_exit(); + out_aarp: + aarp_cleanup_module(); ++out_dev: + unregister_netdevice_notifier(&ddp_notifier); +-out_sock: ++out_snap: + dev_remove_pack(&ppptalk_packet_type); + dev_remove_pack(<alk_packet_type); + unregister_snap_client(ddp_dl); ++out_sock: + sock_unregister(PF_APPLETALK); + out_proto: + proto_unregister(&ddp_proto); +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c +index 5b808089eff8..6025cc509d97 100644 +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -2932,7 +2932,7 @@ int __tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb, int segs) + if (likely(!err)) { + TCP_SKB_CB(skb)->sacked |= TCPCB_EVER_RETRANS; + } else if (err != -EBUSY) { +- NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPRETRANSFAIL); ++ NET_ADD_STATS(sock_net(sk), LINUX_MIB_TCPRETRANSFAIL, segs); + } + return err; + } +diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c +index 592d6e9967a9..895129b0928c 100644 +--- a/net/ipv4/tcp_timer.c ++++ b/net/ipv4/tcp_timer.c +@@ -358,7 +358,7 @@ static void tcp_probe_timer(struct sock *sk) + return; + } + +- if (icsk->icsk_probes_out > max_probes) { ++ if (icsk->icsk_probes_out >= max_probes) { + abort: tcp_write_err(sk); + } else { + /* Only send another probe if we didn't close things up. */ +@@ -413,6 +413,7 @@ void tcp_retransmit_timer(struct sock *sk) + struct tcp_sock *tp = tcp_sk(sk); + struct net *net = sock_net(sk); + struct inet_connection_sock *icsk = inet_csk(sk); ++ struct sk_buff *skb; + + if (tp->fastopen_rsk) { + WARN_ON_ONCE(sk->sk_state != TCP_SYN_RECV && +@@ -423,10 +424,13 @@ void tcp_retransmit_timer(struct sock *sk) + */ + return; + } ++ + if (!tp->packets_out) +- goto out; ++ return; + +- WARN_ON(tcp_write_queue_empty(sk)); ++ skb = tcp_rtx_queue_head(sk); ++ if (WARN_ON_ONCE(!skb)) ++ return; + + tp->tlp_high_seq = 0; + +@@ -459,16 +463,17 @@ void tcp_retransmit_timer(struct sock *sk) + goto out; + } + tcp_enter_loss(sk); +- tcp_retransmit_skb(sk, tcp_write_queue_head(sk), 1); ++ tcp_retransmit_skb(sk, skb, 1); + __sk_dst_reset(sk); + goto out_reset_timer; + } + ++ __NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPTIMEOUTS); + if (tcp_write_timeout(sk)) + goto out; + + if (icsk->icsk_retransmits == 0) { +- int mib_idx; ++ int mib_idx = 0; + + if (icsk->icsk_ca_state == TCP_CA_Recovery) { + if (tcp_is_sack(tp)) +@@ -483,10 +488,9 @@ void tcp_retransmit_timer(struct sock *sk) + mib_idx = LINUX_MIB_TCPSACKFAILURES; + else + mib_idx = LINUX_MIB_TCPRENOFAILURES; +- } else { +- mib_idx = LINUX_MIB_TCPTIMEOUTS; + } +- __NET_INC_STATS(sock_net(sk), mib_idx); ++ if (mib_idx) ++ __NET_INC_STATS(sock_net(sk), mib_idx); + } + + tcp_enter_loss(sk); +diff --git a/net/smc/smc_wr.c b/net/smc/smc_wr.c +index de4537f66832..ed6736a1a112 100644 +--- a/net/smc/smc_wr.c ++++ b/net/smc/smc_wr.c +@@ -223,12 +223,14 @@ int smc_wr_tx_put_slot(struct smc_link *link, + + pend = container_of(wr_pend_priv, struct smc_wr_tx_pend, priv); + if (pend->idx < link->wr_tx_cnt) { ++ u32 idx = pend->idx; ++ + /* clear the full struct smc_wr_tx_pend including .priv */ + memset(&link->wr_tx_pends[pend->idx], 0, + sizeof(link->wr_tx_pends[pend->idx])); + memset(&link->wr_tx_bufs[pend->idx], 0, + sizeof(link->wr_tx_bufs[pend->idx])); +- test_and_clear_bit(pend->idx, link->wr_tx_mask); ++ test_and_clear_bit(idx, link->wr_tx_mask); + return 1; + } + +diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c +index 475b453dc7ae..556989b0b5fc 100644 +--- a/net/sunrpc/cache.c ++++ b/net/sunrpc/cache.c +@@ -54,9 +54,6 @@ static void cache_init(struct cache_head *h, struct cache_detail *detail) + h->last_refresh = now; + } + +-static inline int cache_is_valid(struct cache_head *h); +-static void cache_fresh_locked(struct cache_head *head, time_t expiry, +- struct cache_detail *detail); + static void cache_fresh_unlocked(struct cache_head *head, + struct cache_detail *detail); + +@@ -101,9 +98,6 @@ struct cache_head *sunrpc_cache_lookup(struct cache_detail *detail, + if (cache_is_expired(detail, tmp)) { + hlist_del_init(&tmp->cache_list); + detail->entries --; +- if (cache_is_valid(tmp) == -EAGAIN) +- set_bit(CACHE_NEGATIVE, &tmp->flags); +- cache_fresh_locked(tmp, 0, detail); + freeme = tmp; + break; + } +diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c +index 1b830a6ee3ff..a156b6dc3a72 100644 +--- a/net/x25/af_x25.c ++++ b/net/x25/af_x25.c +@@ -100,7 +100,7 @@ int x25_parse_address_block(struct sk_buff *skb, + } + + len = *skb->data; +- needed = 1 + (len >> 4) + (len & 0x0f); ++ needed = 1 + ((len >> 4) + (len & 0x0f) + 1) / 2; + + if (!pskb_may_pull(skb, needed)) { + /* packet is too short to hold the addresses it claims +@@ -288,7 +288,7 @@ static struct sock *x25_find_listener(struct x25_address *addr, + sk_for_each(s, &x25_list) + if ((!strcmp(addr->x25_addr, + x25_sk(s)->source_addr.x25_addr) || +- !strcmp(addr->x25_addr, ++ !strcmp(x25_sk(s)->source_addr.x25_addr, + null_x25_address.x25_addr)) && + s->sk_state == TCP_LISTEN) { + /* +@@ -684,11 +684,15 @@ static int x25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) + goto out; + } + +- len = strlen(addr->sx25_addr.x25_addr); +- for (i = 0; i < len; i++) { +- if (!isdigit(addr->sx25_addr.x25_addr[i])) { +- rc = -EINVAL; +- goto out; ++ /* check for the null_x25_address */ ++ if (strcmp(addr->sx25_addr.x25_addr, null_x25_address.x25_addr)) { ++ ++ len = strlen(addr->sx25_addr.x25_addr); ++ for (i = 0; i < len; i++) { ++ if (!isdigit(addr->sx25_addr.x25_addr[i])) { ++ rc = -EINVAL; ++ goto out; ++ } + } + } + +diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c +index fc0a9ce1be18..311597401b82 100644 +--- a/net/xfrm/xfrm_input.c ++++ b/net/xfrm/xfrm_input.c +@@ -245,6 +245,9 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type) + else + XFRM_INC_STATS(net, + LINUX_MIB_XFRMINSTATEINVALID); ++ ++ if (encap_type == -1) ++ dev_put(skb->dev); + goto drop; + } + +diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c +index c22041a4fc36..b6eb929899c5 100644 +--- a/scripts/mod/modpost.c ++++ b/scripts/mod/modpost.c +@@ -1174,6 +1174,14 @@ static const struct sectioncheck *section_mismatch( + * fromsec = text section + * refsymname = *.constprop.* + * ++ * Pattern 6: ++ * Hide section mismatch warnings for ELF local symbols. The goal ++ * is to eliminate false positive modpost warnings caused by ++ * compiler-generated ELF local symbol names such as ".LANCHOR1". ++ * Autogenerated symbol names bypass modpost's "Pattern 2" ++ * whitelisting, which relies on pattern-matching against symbol ++ * names to work. (One situation where gcc can autogenerate ELF ++ * local symbols is when "-fsection-anchors" is used.) + **/ + static int secref_whitelist(const struct sectioncheck *mismatch, + const char *fromsec, const char *fromsym, +@@ -1212,6 +1220,10 @@ static int secref_whitelist(const struct sectioncheck *mismatch, + match(fromsym, optim_symbols)) + return 0; + ++ /* Check for pattern 6 */ ++ if (strstarts(fromsym, ".L")) ++ return 0; ++ + return 1; + } + +diff --git a/sound/core/oss/linear.c b/sound/core/oss/linear.c +index 2045697f449d..797d838a2f9e 100644 +--- a/sound/core/oss/linear.c ++++ b/sound/core/oss/linear.c +@@ -107,6 +107,8 @@ static snd_pcm_sframes_t linear_transfer(struct snd_pcm_plugin *plugin, + } + } + #endif ++ if (frames > dst_channels[0].frames) ++ frames = dst_channels[0].frames; + convert(plugin, src_channels, dst_channels, frames); + return frames; + } +diff --git a/sound/core/oss/mulaw.c b/sound/core/oss/mulaw.c +index 7915564bd394..3788906421a7 100644 +--- a/sound/core/oss/mulaw.c ++++ b/sound/core/oss/mulaw.c +@@ -269,6 +269,8 @@ static snd_pcm_sframes_t mulaw_transfer(struct snd_pcm_plugin *plugin, + } + } + #endif ++ if (frames > dst_channels[0].frames) ++ frames = dst_channels[0].frames; + data = (struct mulaw_priv *)plugin->extra_data; + data->func(plugin, src_channels, dst_channels, frames); + return frames; +diff --git a/sound/core/oss/route.c b/sound/core/oss/route.c +index c8171f5783c8..72dea04197ef 100644 +--- a/sound/core/oss/route.c ++++ b/sound/core/oss/route.c +@@ -57,6 +57,8 @@ static snd_pcm_sframes_t route_transfer(struct snd_pcm_plugin *plugin, + return -ENXIO; + if (frames == 0) + return 0; ++ if (frames > dst_channels[0].frames) ++ frames = dst_channels[0].frames; + + nsrcs = plugin->src_format.channels; + ndsts = plugin->dst_format.channels; +diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c +index 729a85a6211d..80453266a2de 100644 +--- a/sound/core/pcm_lib.c ++++ b/sound/core/pcm_lib.c +@@ -1803,11 +1803,14 @@ void snd_pcm_period_elapsed(struct snd_pcm_substream *substream) + struct snd_pcm_runtime *runtime; + unsigned long flags; + +- if (PCM_RUNTIME_CHECK(substream)) ++ if (snd_BUG_ON(!substream)) + return; +- runtime = substream->runtime; + + snd_pcm_stream_lock_irqsave(substream, flags); ++ if (PCM_RUNTIME_CHECK(substream)) ++ goto _unlock; ++ runtime = substream->runtime; ++ + if (!snd_pcm_running(substream) || + snd_pcm_update_hw_ptr0(substream, 1) < 0) + goto _end; +@@ -1818,6 +1821,7 @@ void snd_pcm_period_elapsed(struct snd_pcm_substream *substream) + #endif + _end: + kill_fasync(&runtime->fasync, SIGIO, POLL_IN); ++ _unlock: + snd_pcm_stream_unlock_irqrestore(substream, flags); + } + EXPORT_SYMBOL(snd_pcm_period_elapsed); +diff --git a/sound/pci/hda/hda_bind.c b/sound/pci/hda/hda_bind.c +index 8db1890605f6..c175b2cf63f7 100644 +--- a/sound/pci/hda/hda_bind.c ++++ b/sound/pci/hda/hda_bind.c +@@ -42,6 +42,10 @@ static void hda_codec_unsol_event(struct hdac_device *dev, unsigned int ev) + { + struct hda_codec *codec = container_of(dev, struct hda_codec, core); + ++ /* ignore unsol events during shutdown */ ++ if (codec->bus->shutdown) ++ return; ++ + if (codec->patch_ops.unsol_event) + codec->patch_ops.unsol_event(codec, ev); + } +diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c +index 96e9b3944b92..890793ad85ca 100644 +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -1450,8 +1450,11 @@ static int azx_free(struct azx *chip) + static int azx_dev_disconnect(struct snd_device *device) + { + struct azx *chip = device->device_data; ++ struct hdac_bus *bus = azx_bus(chip); + + chip->bus.shutdown = 1; ++ cancel_work_sync(&bus->unsol_work); ++ + return 0; + } + +diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c +index 49be42d27761..382b6d2ed803 100644 +--- a/sound/pci/hda/patch_conexant.c ++++ b/sound/pci/hda/patch_conexant.c +@@ -960,6 +960,7 @@ static const struct snd_pci_quirk cxt5066_fixups[] = { + SND_PCI_QUIRK(0x103c, 0x837f, "HP ProBook 470 G5", CXT_FIXUP_MUTE_LED_GPIO), + SND_PCI_QUIRK(0x103c, 0x8299, "HP 800 G3 SFF", CXT_FIXUP_HP_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x103c, 0x829a, "HP 800 G3 DM", CXT_FIXUP_HP_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x103c, 0x8402, "HP ProBook 645 G4", CXT_FIXUP_MUTE_LED_GPIO), + SND_PCI_QUIRK(0x103c, 0x8455, "HP Z2 G4", CXT_FIXUP_HP_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1043, 0x138d, "Asus", CXT_FIXUP_HEADPHONE_MIC_PIN), + SND_PCI_QUIRK(0x152d, 0x0833, "OLPC XO-1.5", CXT_FIXUP_OLPC_XO), +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 404c50ab28fa..41e3c77d5fb7 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -333,9 +333,7 @@ static void alc_fill_eapd_coef(struct hda_codec *codec) + case 0x10ec0215: + case 0x10ec0233: + case 0x10ec0235: +- case 0x10ec0236: + case 0x10ec0255: +- case 0x10ec0256: + case 0x10ec0257: + case 0x10ec0282: + case 0x10ec0283: +@@ -347,6 +345,11 @@ static void alc_fill_eapd_coef(struct hda_codec *codec) + case 0x10ec0300: + alc_update_coef_idx(codec, 0x10, 1<<9, 0); + break; ++ case 0x10ec0236: ++ case 0x10ec0256: ++ alc_write_coef_idx(codec, 0x36, 0x5757); ++ alc_update_coef_idx(codec, 0x10, 1<<9, 0); ++ break; + case 0x10ec0275: + alc_update_coef_idx(codec, 0xe, 0, 1<<0); + break; +diff --git a/sound/soc/codecs/nau8540.c b/sound/soc/codecs/nau8540.c +index f9c9933acffb..c0c64f90a61b 100644 +--- a/sound/soc/codecs/nau8540.c ++++ b/sound/soc/codecs/nau8540.c +@@ -548,7 +548,7 @@ static int nau8540_calc_fll_param(unsigned int fll_in, + fvco_max = 0; + fvco_sel = ARRAY_SIZE(mclk_src_scaling); + for (i = 0; i < ARRAY_SIZE(mclk_src_scaling); i++) { +- fvco = 256 * fs * 2 * mclk_src_scaling[i].param; ++ fvco = 256ULL * fs * 2 * mclk_src_scaling[i].param; + if (fvco > NAU_FVCO_MIN && fvco < NAU_FVCO_MAX && + fvco_max < fvco) { + fvco_max = fvco; +diff --git a/sound/soc/sh/rcar/core.c b/sound/soc/sh/rcar/core.c +index ab0bbef7eb48..f203c0878e69 100644 +--- a/sound/soc/sh/rcar/core.c ++++ b/sound/soc/sh/rcar/core.c +@@ -1278,6 +1278,18 @@ int rsnd_kctrl_new(struct rsnd_mod *mod, + }; + int ret; + ++ /* ++ * 1) Avoid duplicate register for DVC with MIX case ++ * 2) Allow duplicate register for MIX ++ * 3) re-register if card was rebinded ++ */ ++ list_for_each_entry(kctrl, &card->controls, list) { ++ struct rsnd_kctrl_cfg *c = kctrl->private_data; ++ ++ if (c == cfg) ++ return 0; ++ } ++ + if (size > RSND_MAX_CHANNELS) + return -EINVAL; + +diff --git a/sound/soc/soc-jack.c b/sound/soc/soc-jack.c +index 99902ae1a2d9..b04ecc633da3 100644 +--- a/sound/soc/soc-jack.c ++++ b/sound/soc/soc-jack.c +@@ -127,10 +127,9 @@ void snd_soc_jack_report(struct snd_soc_jack *jack, int status, int mask) + unsigned int sync = 0; + int enable; + +- trace_snd_soc_jack_report(jack, mask, status); +- + if (!jack) + return; ++ trace_snd_soc_jack_report(jack, mask, status); + + dapm = &jack->card->dapm; + +diff --git a/virt/kvm/arm/vgic/vgic-v3.c b/virt/kvm/arm/vgic/vgic-v3.c +index 084edc9dc553..f16a55012ea3 100644 +--- a/virt/kvm/arm/vgic/vgic-v3.c ++++ b/virt/kvm/arm/vgic/vgic-v3.c +@@ -331,8 +331,8 @@ retry: + int vgic_v3_save_pending_tables(struct kvm *kvm) + { + struct vgic_dist *dist = &kvm->arch.vgic; +- int last_byte_offset = -1; + struct vgic_irq *irq; ++ gpa_t last_ptr = ~(gpa_t)0; + int ret; + u8 val; + +@@ -352,11 +352,11 @@ int vgic_v3_save_pending_tables(struct kvm *kvm) + bit_nr = irq->intid % BITS_PER_BYTE; + ptr = pendbase + byte_offset; + +- if (byte_offset != last_byte_offset) { ++ if (ptr != last_ptr) { + ret = kvm_read_guest_lock(kvm, ptr, &val, 1); + if (ret) + return ret; +- last_byte_offset = byte_offset; ++ last_ptr = ptr; + } + + stored = val & (1U << bit_nr); diff --git a/patch/kernel/odroidxu4-legacy/patch-4.14.159-160.patch b/patch/kernel/odroidxu4-legacy/patch-4.14.159-160.patch new file mode 100644 index 000000000..016b01fef --- /dev/null +++ b/patch/kernel/odroidxu4-legacy/patch-4.14.159-160.patch @@ -0,0 +1,1086 @@ +diff --git a/Makefile b/Makefile +index e14ad8f064ec..f011cb69545f 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 14 +-SUBLEVEL = 159 ++SUBLEVEL = 160 + EXTRAVERSION = + NAME = Petit Gorille + +diff --git a/arch/arm/boot/dts/s3c6410-mini6410.dts b/arch/arm/boot/dts/s3c6410-mini6410.dts +index f4afda3594f8..de04d8764b0f 100644 +--- a/arch/arm/boot/dts/s3c6410-mini6410.dts ++++ b/arch/arm/boot/dts/s3c6410-mini6410.dts +@@ -167,6 +167,10 @@ + }; + }; + ++&clocks { ++ clocks = <&fin_pll>; ++}; ++ + &sdhci0 { + pinctrl-names = "default"; + pinctrl-0 = <&sd0_clk>, <&sd0_cmd>, <&sd0_cd>, <&sd0_bus4>; +diff --git a/arch/arm/boot/dts/s3c6410-smdk6410.dts b/arch/arm/boot/dts/s3c6410-smdk6410.dts +index ecf35ec466f7..7ade1a0686d2 100644 +--- a/arch/arm/boot/dts/s3c6410-smdk6410.dts ++++ b/arch/arm/boot/dts/s3c6410-smdk6410.dts +@@ -71,6 +71,10 @@ + }; + }; + ++&clocks { ++ clocks = <&fin_pll>; ++}; ++ + &sdhci0 { + pinctrl-names = "default"; + pinctrl-0 = <&sd0_clk>, <&sd0_cmd>, <&sd0_cd>, <&sd0_bus4>; +diff --git a/arch/arm/mach-tegra/reset-handler.S b/arch/arm/mach-tegra/reset-handler.S +index 805f306fa6f7..e31f167a8199 100644 +--- a/arch/arm/mach-tegra/reset-handler.S ++++ b/arch/arm/mach-tegra/reset-handler.S +@@ -56,16 +56,16 @@ ENTRY(tegra_resume) + cmp r6, #TEGRA20 + beq 1f @ Yes + /* Clear the flow controller flags for this CPU. */ +- cpu_to_csr_reg r1, r0 ++ cpu_to_csr_reg r3, r0 + mov32 r2, TEGRA_FLOW_CTRL_BASE +- ldr r1, [r2, r1] ++ ldr r1, [r2, r3] + /* Clear event & intr flag */ + orr r1, r1, \ + #FLOW_CTRL_CSR_INTR_FLAG | FLOW_CTRL_CSR_EVENT_FLAG + movw r0, #0x3FFD @ enable, cluster_switch, immed, bitmaps + @ & ext flags for CPU power mgnt + bic r1, r1, r0 +- str r1, [r2] ++ str r1, [r2, r3] + 1: + + mov32 r9, 0xc09 +diff --git a/arch/xtensa/mm/tlb.c b/arch/xtensa/mm/tlb.c +index 35c822286bbe..3ce5ccdb054d 100644 +--- a/arch/xtensa/mm/tlb.c ++++ b/arch/xtensa/mm/tlb.c +@@ -218,6 +218,8 @@ static int check_tlb_entry(unsigned w, unsigned e, bool dtlb) + unsigned tlbidx = w | (e << PAGE_SHIFT); + unsigned r0 = dtlb ? + read_dtlb_virtual(tlbidx) : read_itlb_virtual(tlbidx); ++ unsigned r1 = dtlb ? ++ read_dtlb_translation(tlbidx) : read_itlb_translation(tlbidx); + unsigned vpn = (r0 & PAGE_MASK) | (e << PAGE_SHIFT); + unsigned pte = get_pte_for_vaddr(vpn); + unsigned mm_asid = (get_rasid_register() >> 8) & ASID_MASK; +@@ -233,8 +235,6 @@ static int check_tlb_entry(unsigned w, unsigned e, bool dtlb) + } + + if (tlb_asid == mm_asid) { +- unsigned r1 = dtlb ? read_dtlb_translation(tlbidx) : +- read_itlb_translation(tlbidx); + if ((pte ^ r1) & PAGE_MASK) { + pr_err("%cTLB: way: %u, entry: %u, mapping: %08x->%08x, PTE: %08x\n", + dtlb ? 'D' : 'I', w, e, r0, r1, pte); +diff --git a/drivers/dma-buf/sync_file.c b/drivers/dma-buf/sync_file.c +index 03830634e141..bf65e634590b 100644 +--- a/drivers/dma-buf/sync_file.c ++++ b/drivers/dma-buf/sync_file.c +@@ -230,7 +230,7 @@ static struct sync_file *sync_file_merge(const char *name, struct sync_file *a, + a_fences = get_fences(a, &a_num_fences); + b_fences = get_fences(b, &b_num_fences); + if (a_num_fences > INT_MAX - b_num_fences) +- return NULL; ++ goto err; + + num_fences = a_num_fences + b_num_fences; + +diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c +index c31e660e35db..a4929372090d 100644 +--- a/drivers/gpu/drm/radeon/r100.c ++++ b/drivers/gpu/drm/radeon/r100.c +@@ -1820,8 +1820,8 @@ static int r100_packet0_check(struct radeon_cs_parser *p, + track->textures[i].use_pitch = 1; + } else { + track->textures[i].use_pitch = 0; +- track->textures[i].width = 1 << ((idx_value >> RADEON_TXFORMAT_WIDTH_SHIFT) & RADEON_TXFORMAT_WIDTH_MASK); +- track->textures[i].height = 1 << ((idx_value >> RADEON_TXFORMAT_HEIGHT_SHIFT) & RADEON_TXFORMAT_HEIGHT_MASK); ++ track->textures[i].width = 1 << ((idx_value & RADEON_TXFORMAT_WIDTH_MASK) >> RADEON_TXFORMAT_WIDTH_SHIFT); ++ track->textures[i].height = 1 << ((idx_value & RADEON_TXFORMAT_HEIGHT_MASK) >> RADEON_TXFORMAT_HEIGHT_SHIFT); + } + if (idx_value & RADEON_TXFORMAT_CUBIC_MAP_ENABLE) + track->textures[i].tex_coord_type = 2; +diff --git a/drivers/gpu/drm/radeon/r200.c b/drivers/gpu/drm/radeon/r200.c +index c22321cc5a41..c2b506c707a2 100644 +--- a/drivers/gpu/drm/radeon/r200.c ++++ b/drivers/gpu/drm/radeon/r200.c +@@ -476,8 +476,8 @@ int r200_packet0_check(struct radeon_cs_parser *p, + track->textures[i].use_pitch = 1; + } else { + track->textures[i].use_pitch = 0; +- track->textures[i].width = 1 << ((idx_value >> RADEON_TXFORMAT_WIDTH_SHIFT) & RADEON_TXFORMAT_WIDTH_MASK); +- track->textures[i].height = 1 << ((idx_value >> RADEON_TXFORMAT_HEIGHT_SHIFT) & RADEON_TXFORMAT_HEIGHT_MASK); ++ track->textures[i].width = 1 << ((idx_value & RADEON_TXFORMAT_WIDTH_MASK) >> RADEON_TXFORMAT_WIDTH_SHIFT); ++ track->textures[i].height = 1 << ((idx_value & RADEON_TXFORMAT_HEIGHT_MASK) >> RADEON_TXFORMAT_HEIGHT_SHIFT); + } + if (idx_value & R200_TXFORMAT_LOOKUP_DISABLE) + track->textures[i].lookup_disable = true; +diff --git a/drivers/md/persistent-data/dm-btree-remove.c b/drivers/md/persistent-data/dm-btree-remove.c +index 21ea537bd55e..eff04fa23dfa 100644 +--- a/drivers/md/persistent-data/dm-btree-remove.c ++++ b/drivers/md/persistent-data/dm-btree-remove.c +@@ -203,7 +203,13 @@ static void __rebalance2(struct dm_btree_info *info, struct btree_node *parent, + struct btree_node *right = r->n; + uint32_t nr_left = le32_to_cpu(left->header.nr_entries); + uint32_t nr_right = le32_to_cpu(right->header.nr_entries); +- unsigned threshold = 2 * merge_threshold(left) + 1; ++ /* ++ * Ensure the number of entries in each child will be greater ++ * than or equal to (max_entries / 3 + 1), so no matter which ++ * child is used for removal, the number will still be not ++ * less than (max_entries / 3). ++ */ ++ unsigned int threshold = 2 * (merge_threshold(left) + 1); + + if (nr_left + nr_right < threshold) { + /* +diff --git a/drivers/net/ethernet/cavium/thunder/thunder_bgx.c b/drivers/net/ethernet/cavium/thunder/thunder_bgx.c +index 5e5c4d7796b8..586e35593310 100644 +--- a/drivers/net/ethernet/cavium/thunder/thunder_bgx.c ++++ b/drivers/net/ethernet/cavium/thunder/thunder_bgx.c +@@ -915,7 +915,7 @@ static int bgx_lmac_enable(struct bgx *bgx, u8 lmacid) + phy_interface_mode(lmac->lmac_type))) + return -ENODEV; + +- phy_start_aneg(lmac->phydev); ++ phy_start(lmac->phydev); + return 0; + } + +diff --git a/drivers/net/ethernet/stmicro/stmmac/common.h b/drivers/net/ethernet/stmicro/stmmac/common.h +index d824bf942a8f..efc4a1a8343a 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/common.h ++++ b/drivers/net/ethernet/stmicro/stmmac/common.h +@@ -367,7 +367,7 @@ struct dma_features { + struct stmmac_desc_ops { + /* DMA RX descriptor ring initialization */ + void (*init_rx_desc) (struct dma_desc *p, int disable_rx_ic, int mode, +- int end); ++ int end, int bfsize); + /* DMA TX descriptor ring initialization */ + void (*init_tx_desc) (struct dma_desc *p, int mode, int end); + +diff --git a/drivers/net/ethernet/stmicro/stmmac/descs_com.h b/drivers/net/ethernet/stmicro/stmmac/descs_com.h +index 40d6356a7e73..3dfb07a78952 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/descs_com.h ++++ b/drivers/net/ethernet/stmicro/stmmac/descs_com.h +@@ -29,11 +29,13 @@ + /* Specific functions used for Ring mode */ + + /* Enhanced descriptors */ +-static inline void ehn_desc_rx_set_on_ring(struct dma_desc *p, int end) ++static inline void ehn_desc_rx_set_on_ring(struct dma_desc *p, int end, ++ int bfsize) + { +- p->des1 |= cpu_to_le32((BUF_SIZE_8KiB +- << ERDES1_BUFFER2_SIZE_SHIFT) +- & ERDES1_BUFFER2_SIZE_MASK); ++ if (bfsize == BUF_SIZE_16KiB) ++ p->des1 |= cpu_to_le32((BUF_SIZE_8KiB ++ << ERDES1_BUFFER2_SIZE_SHIFT) ++ & ERDES1_BUFFER2_SIZE_MASK); + + if (end) + p->des1 |= cpu_to_le32(ERDES1_END_RING); +@@ -59,11 +61,15 @@ static inline void enh_set_tx_desc_len_on_ring(struct dma_desc *p, int len) + } + + /* Normal descriptors */ +-static inline void ndesc_rx_set_on_ring(struct dma_desc *p, int end) ++static inline void ndesc_rx_set_on_ring(struct dma_desc *p, int end, int bfsize) + { +- p->des1 |= cpu_to_le32(((BUF_SIZE_2KiB - 1) +- << RDES1_BUFFER2_SIZE_SHIFT) +- & RDES1_BUFFER2_SIZE_MASK); ++ if (bfsize >= BUF_SIZE_2KiB) { ++ int bfsize2; ++ ++ bfsize2 = min(bfsize - BUF_SIZE_2KiB + 1, BUF_SIZE_2KiB - 1); ++ p->des1 |= cpu_to_le32((bfsize2 << RDES1_BUFFER2_SIZE_SHIFT) ++ & RDES1_BUFFER2_SIZE_MASK); ++ } + + if (end) + p->des1 |= cpu_to_le32(RDES1_END_RING); +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c +index 37b77e7da132..2896ec100c75 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c +@@ -293,7 +293,7 @@ exit: + } + + static void dwmac4_rd_init_rx_desc(struct dma_desc *p, int disable_rx_ic, +- int mode, int end) ++ int mode, int end, int bfsize) + { + p->des3 = cpu_to_le32(RDES3_OWN | RDES3_BUFFER1_VALID_ADDR); + +diff --git a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c +index f2150efddc88..dfa6599ca1a7 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c ++++ b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c +@@ -265,15 +265,19 @@ static int enh_desc_get_rx_status(void *data, struct stmmac_extra_stats *x, + } + + static void enh_desc_init_rx_desc(struct dma_desc *p, int disable_rx_ic, +- int mode, int end) ++ int mode, int end, int bfsize) + { ++ int bfsize1; ++ + p->des0 |= cpu_to_le32(RDES0_OWN); +- p->des1 |= cpu_to_le32(BUF_SIZE_8KiB & ERDES1_BUFFER1_SIZE_MASK); ++ ++ bfsize1 = min(bfsize, BUF_SIZE_8KiB); ++ p->des1 |= cpu_to_le32(bfsize1 & ERDES1_BUFFER1_SIZE_MASK); + + if (mode == STMMAC_CHAIN_MODE) + ehn_desc_rx_set_on_chain(p); + else +- ehn_desc_rx_set_on_ring(p, end); ++ ehn_desc_rx_set_on_ring(p, end, bfsize); + + if (disable_rx_ic) + p->des1 |= cpu_to_le32(ERDES1_DISABLE_IC); +diff --git a/drivers/net/ethernet/stmicro/stmmac/norm_desc.c b/drivers/net/ethernet/stmicro/stmmac/norm_desc.c +index 66c17bab5997..44a4666290da 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/norm_desc.c ++++ b/drivers/net/ethernet/stmicro/stmmac/norm_desc.c +@@ -133,15 +133,19 @@ static int ndesc_get_rx_status(void *data, struct stmmac_extra_stats *x, + } + + static void ndesc_init_rx_desc(struct dma_desc *p, int disable_rx_ic, int mode, +- int end) ++ int end, int bfsize) + { ++ int bfsize1; ++ + p->des0 |= cpu_to_le32(RDES0_OWN); +- p->des1 |= cpu_to_le32((BUF_SIZE_2KiB - 1) & RDES1_BUFFER1_SIZE_MASK); ++ ++ bfsize1 = min(bfsize, BUF_SIZE_2KiB - 1); ++ p->des1 |= cpu_to_le32(bfsize1 & RDES1_BUFFER1_SIZE_MASK); + + if (mode == STMMAC_CHAIN_MODE) + ndesc_rx_set_on_chain(p, end); + else +- ndesc_rx_set_on_ring(p, end); ++ ndesc_rx_set_on_ring(p, end, bfsize); + + if (disable_rx_ic) + p->des1 |= cpu_to_le32(RDES1_DISABLE_IC); +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +index 612773b94ae3..e6d16c48ffef 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +@@ -1072,11 +1072,13 @@ static void stmmac_clear_rx_descriptors(struct stmmac_priv *priv, u32 queue) + if (priv->extend_desc) + priv->hw->desc->init_rx_desc(&rx_q->dma_erx[i].basic, + priv->use_riwt, priv->mode, +- (i == DMA_RX_SIZE - 1)); ++ (i == DMA_RX_SIZE - 1), ++ priv->dma_buf_sz); + else + priv->hw->desc->init_rx_desc(&rx_q->dma_rx[i], + priv->use_riwt, priv->mode, +- (i == DMA_RX_SIZE - 1)); ++ (i == DMA_RX_SIZE - 1), ++ priv->dma_buf_sz); + } + + /** +@@ -3299,7 +3301,7 @@ static inline void stmmac_rx_refill(struct stmmac_priv *priv, u32 queue) + dma_wmb(); + + if (unlikely(priv->synopsys_id >= DWMAC_CORE_4_00)) +- priv->hw->desc->init_rx_desc(p, priv->use_riwt, 0, 0); ++ priv->hw->desc->init_rx_desc(p, priv->use_riwt, 0, 0, priv->dma_buf_sz); + else + priv->hw->desc->set_rx_owner(p); + +@@ -3321,9 +3323,8 @@ static inline void stmmac_rx_refill(struct stmmac_priv *priv, u32 queue) + static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue) + { + struct stmmac_rx_queue *rx_q = &priv->rx_queue[queue]; +- unsigned int entry = rx_q->cur_rx; + int coe = priv->hw->rx_csum; +- unsigned int next_entry; ++ unsigned int next_entry = rx_q->cur_rx; + unsigned int count = 0; + + if (netif_msg_rx_status(priv)) { +@@ -3338,10 +3339,12 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue) + priv->hw->desc->display_ring(rx_head, DMA_RX_SIZE, true); + } + while (count < limit) { +- int status; ++ int entry, status; + struct dma_desc *p; + struct dma_desc *np; + ++ entry = next_entry; ++ + if (priv->extend_desc) + p = (struct dma_desc *)(rx_q->dma_erx + entry); + else +@@ -3408,7 +3411,7 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue) + "len %d larger than size (%d)\n", + frame_len, priv->dma_buf_sz); + priv->dev->stats.rx_length_errors++; +- break; ++ continue; + } + + /* ACS is set; GMAC core strips PAD/FCS for IEEE 802.3 +@@ -3444,7 +3447,7 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue) + dev_warn(priv->device, + "packet dropped\n"); + priv->dev->stats.rx_dropped++; +- break; ++ continue; + } + + dma_sync_single_for_cpu(priv->device, +@@ -3469,7 +3472,7 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue) + "%s: Inconsistent Rx chain\n", + priv->dev->name); + priv->dev->stats.rx_dropped++; +- break; ++ continue; + } + prefetch(skb->data - NET_IP_ALIGN); + rx_q->rx_skbuff[entry] = NULL; +@@ -3504,7 +3507,6 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue) + priv->dev->stats.rx_packets++; + priv->dev->stats.rx_bytes += frame_len; + } +- entry = next_entry; + } + + stmmac_rx_refill(priv, queue); +diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c +index a44838aac97d..3189afcd5888 100644 +--- a/drivers/net/ethernet/ti/cpsw.c ++++ b/drivers/net/ethernet/ti/cpsw.c +@@ -862,8 +862,8 @@ static irqreturn_t cpsw_rx_interrupt(int irq, void *dev_id) + { + struct cpsw_common *cpsw = dev_id; + +- cpdma_ctlr_eoi(cpsw->dma, CPDMA_EOI_RX); + writel(0, &cpsw->wr_regs->rx_en); ++ cpdma_ctlr_eoi(cpsw->dma, CPDMA_EOI_RX); + + if (cpsw->quirk_irq) { + disable_irq_nosync(cpsw->irqs_table[0]); +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index 768ac752a6e3..f543b9932c83 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -1331,7 +1331,7 @@ static int nvme_pr_reserve(struct block_device *bdev, u64 key, + static int nvme_pr_preempt(struct block_device *bdev, u64 old, u64 new, + enum pr_type type, bool abort) + { +- u32 cdw10 = nvme_pr_type(type) << 8 | abort ? 2 : 1; ++ u32 cdw10 = nvme_pr_type(type) << 8 | (abort ? 2 : 1); + return nvme_pr_command(bdev, cdw10, old, new, nvme_cmd_resv_acquire); + } + +@@ -1343,7 +1343,7 @@ static int nvme_pr_clear(struct block_device *bdev, u64 key) + + static int nvme_pr_release(struct block_device *bdev, u64 key, enum pr_type type) + { +- u32 cdw10 = nvme_pr_type(type) << 8 | key ? 1 << 3 : 0; ++ u32 cdw10 = nvme_pr_type(type) << 8 | (key ? 1 << 3 : 0); + return nvme_pr_command(bdev, cdw10, key, 0, nvme_cmd_resv_release); + } + +diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c +index d66ef88e13cf..2a203055b16e 100644 +--- a/drivers/pci/msi.c ++++ b/drivers/pci/msi.c +@@ -211,7 +211,7 @@ u32 __pci_msix_desc_mask_irq(struct msi_desc *desc, u32 flag) + return 0; + + mask_bits &= ~PCI_MSIX_ENTRY_CTRL_MASKBIT; +- if (flag) ++ if (flag & PCI_MSIX_ENTRY_CTRL_MASKBIT) + mask_bits |= PCI_MSIX_ENTRY_CTRL_MASKBIT; + writel(mask_bits, pci_msix_desc_addr(desc) + PCI_MSIX_ENTRY_VECTOR_CTRL); + +diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c +index 7e4bec75fcde..522e59274b5d 100644 +--- a/drivers/pci/pci-driver.c ++++ b/drivers/pci/pci-driver.c +@@ -967,17 +967,22 @@ static int pci_pm_thaw_noirq(struct device *dev) + return error; + } + +- if (pci_has_legacy_pm_support(pci_dev)) +- return pci_legacy_resume_early(dev); +- + /* +- * pci_restore_state() requires the device to be in D0 (because of MSI +- * restoration among other things), so force it into D0 in case the +- * driver's "freeze" callbacks put it into a low-power state directly. ++ * Both the legacy ->resume_early() and the new pm->thaw_noirq() ++ * callbacks assume the device has been returned to D0 and its ++ * config state has been restored. ++ * ++ * In addition, pci_restore_state() restores MSI-X state in MMIO ++ * space, which requires the device to be in D0, so return it to D0 ++ * in case the driver's "freeze" callbacks put it into a low-power ++ * state. + */ + pci_set_power_state(pci_dev, PCI_D0); + pci_restore_state(pci_dev); + ++ if (pci_has_legacy_pm_support(pci_dev)) ++ return pci_legacy_resume_early(dev); ++ + if (drv && drv->pm && drv->pm->thaw_noirq) + error = drv->pm->thaw_noirq(dev); + +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index 45c3fbd38f50..90df085e9f92 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -4252,15 +4252,21 @@ static int pci_quirk_amd_sb_acs(struct pci_dev *dev, u16 acs_flags) + + static bool pci_quirk_cavium_acs_match(struct pci_dev *dev) + { ++ if (!pci_is_pcie(dev) || pci_pcie_type(dev) != PCI_EXP_TYPE_ROOT_PORT) ++ return false; ++ ++ switch (dev->device) { + /* +- * Effectively selects all downstream ports for whole ThunderX 1 +- * family by 0xf800 mask (which represents 8 SoCs), while the lower +- * bits of device ID are used to indicate which subdevice is used +- * within the SoC. ++ * Effectively selects all downstream ports for whole ThunderX1 ++ * (which represents 8 SoCs). + */ +- return (pci_is_pcie(dev) && +- (pci_pcie_type(dev) == PCI_EXP_TYPE_ROOT_PORT) && +- ((dev->device & 0xf800) == 0xa000)); ++ case 0xa000 ... 0xa7ff: /* ThunderX1 */ ++ case 0xaf84: /* ThunderX2 */ ++ case 0xb884: /* ThunderX3 */ ++ return true; ++ default: ++ return false; ++ } + } + + static int pci_quirk_cavium_acs(struct pci_dev *dev, u16 acs_flags) +@@ -4600,7 +4606,7 @@ int pci_dev_specific_acs_enabled(struct pci_dev *dev, u16 acs_flags) + #define INTEL_BSPR_REG_BPPD (1 << 9) + + /* Upstream Peer Decode Configuration Register */ +-#define INTEL_UPDCR_REG 0x1114 ++#define INTEL_UPDCR_REG 0x1014 + /* 5:0 Peer Decode Enable bits */ + #define INTEL_UPDCR_REG_MASK 0x3f + +diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c +index d2428c262b7c..b2cb4f497ef6 100644 +--- a/drivers/regulator/core.c ++++ b/drivers/regulator/core.c +@@ -4503,7 +4503,7 @@ static int __init regulator_init(void) + /* init early to allow our consumers to complete system booting */ + core_initcall(regulator_init); + +-static int regulator_late_cleanup(struct device *dev, void *data) ++static int __init regulator_late_cleanup(struct device *dev, void *data) + { + struct regulator_dev *rdev = dev_to_rdev(dev); + const struct regulator_ops *ops = rdev->desc->ops; +@@ -4552,8 +4552,17 @@ unlock: + return 0; + } + +-static void regulator_init_complete_work_function(struct work_struct *work) ++static int __init regulator_init_complete(void) + { ++ /* ++ * Since DT doesn't provide an idiomatic mechanism for ++ * enabling full constraints and since it's much more natural ++ * with DT to provide them just assume that a DT enabled ++ * system has full constraints. ++ */ ++ if (of_have_populated_dt()) ++ has_full_constraints = true; ++ + /* + * Regulators may had failed to resolve their input supplies + * when were registered, either because the input supply was +@@ -4571,35 +4580,6 @@ static void regulator_init_complete_work_function(struct work_struct *work) + */ + class_for_each_device(®ulator_class, NULL, NULL, + regulator_late_cleanup); +-} +- +-static DECLARE_DELAYED_WORK(regulator_init_complete_work, +- regulator_init_complete_work_function); +- +-static int __init regulator_init_complete(void) +-{ +- /* +- * Since DT doesn't provide an idiomatic mechanism for +- * enabling full constraints and since it's much more natural +- * with DT to provide them just assume that a DT enabled +- * system has full constraints. +- */ +- if (of_have_populated_dt()) +- has_full_constraints = true; +- +- /* +- * We punt completion for an arbitrary amount of time since +- * systems like distros will load many drivers from userspace +- * so consumers might not always be ready yet, this is +- * particularly an issue with laptops where this might bounce +- * the display off then on. Ideally we'd get a notification +- * from userspace when this happens but we don't so just wait +- * a bit and hope we waited long enough. It'd be better if +- * we'd only do this on systems that need it, and a kernel +- * command line option might be useful. +- */ +- schedule_delayed_work(®ulator_init_complete_work, +- msecs_to_jiffies(30000)); + + return 0; + } +diff --git a/drivers/rpmsg/qcom_glink_native.c b/drivers/rpmsg/qcom_glink_native.c +index e8e12c2b1d0e..1e6253f1e070 100644 +--- a/drivers/rpmsg/qcom_glink_native.c ++++ b/drivers/rpmsg/qcom_glink_native.c +@@ -243,10 +243,31 @@ static void qcom_glink_channel_release(struct kref *ref) + { + struct glink_channel *channel = container_of(ref, struct glink_channel, + refcount); ++ struct glink_core_rx_intent *intent; ++ struct glink_core_rx_intent *tmp; + unsigned long flags; ++ int iid; ++ ++ /* cancel pending rx_done work */ ++ cancel_work_sync(&channel->intent_work); + + spin_lock_irqsave(&channel->intent_lock, flags); ++ /* Free all non-reuse intents pending rx_done work */ ++ list_for_each_entry_safe(intent, tmp, &channel->done_intents, node) { ++ if (!intent->reuse) { ++ kfree(intent->data); ++ kfree(intent); ++ } ++ } ++ ++ idr_for_each_entry(&channel->liids, tmp, iid) { ++ kfree(tmp->data); ++ kfree(tmp); ++ } + idr_destroy(&channel->liids); ++ ++ idr_for_each_entry(&channel->riids, tmp, iid) ++ kfree(tmp); + idr_destroy(&channel->riids); + spin_unlock_irqrestore(&channel->intent_lock, flags); + +@@ -1095,13 +1116,12 @@ static int qcom_glink_create_remote(struct qcom_glink *glink, + close_link: + /* + * Send a close request to "undo" our open-ack. The close-ack will +- * release the last reference. ++ * release qcom_glink_send_open_req() reference and the last reference ++ * will be relesed after receiving remote_close or transport unregister ++ * by calling qcom_glink_native_remove(). + */ + qcom_glink_send_close_req(glink, channel); + +- /* Release qcom_glink_send_open_req() reference */ +- kref_put(&channel->refcount, qcom_glink_channel_release); +- + return ret; + } + +@@ -1392,15 +1412,13 @@ static int qcom_glink_rx_open(struct qcom_glink *glink, unsigned int rcid, + + ret = rpmsg_register_device(rpdev); + if (ret) +- goto free_rpdev; ++ goto rcid_remove; + + channel->rpdev = rpdev; + } + + return 0; + +-free_rpdev: +- kfree(rpdev); + rcid_remove: + spin_lock_irqsave(&glink->idr_lock, flags); + idr_remove(&glink->rcids, channel->rcid); +@@ -1521,6 +1539,18 @@ static void qcom_glink_work(struct work_struct *work) + } + } + ++static void qcom_glink_cancel_rx_work(struct qcom_glink *glink) ++{ ++ struct glink_defer_cmd *dcmd; ++ struct glink_defer_cmd *tmp; ++ ++ /* cancel any pending deferred rx_work */ ++ cancel_work_sync(&glink->rx_work); ++ ++ list_for_each_entry_safe(dcmd, tmp, &glink->rx_queue, node) ++ kfree(dcmd); ++} ++ + struct qcom_glink *qcom_glink_native_probe(struct device *dev, + unsigned long features, + struct qcom_glink_pipe *rx, +@@ -1591,23 +1621,24 @@ void qcom_glink_native_remove(struct qcom_glink *glink) + struct glink_channel *channel; + int cid; + int ret; +- unsigned long flags; + + disable_irq(glink->irq); +- cancel_work_sync(&glink->rx_work); ++ qcom_glink_cancel_rx_work(glink); + + ret = device_for_each_child(glink->dev, NULL, qcom_glink_remove_device); + if (ret) + dev_warn(glink->dev, "Can't remove GLINK devices: %d\n", ret); + +- spin_lock_irqsave(&glink->idr_lock, flags); + /* Release any defunct local channels, waiting for close-ack */ + idr_for_each_entry(&glink->lcids, channel, cid) + kref_put(&channel->refcount, qcom_glink_channel_release); + ++ /* Release any defunct local channels, waiting for close-req */ ++ idr_for_each_entry(&glink->rcids, channel, cid) ++ kref_put(&channel->refcount, qcom_glink_channel_release); ++ + idr_destroy(&glink->lcids); + idr_destroy(&glink->rcids); +- spin_unlock_irqrestore(&glink->idr_lock, flags); + mbox_free_channel(glink->mbox_chan); + } + EXPORT_SYMBOL_GPL(qcom_glink_native_remove); +diff --git a/drivers/rpmsg/qcom_glink_smem.c b/drivers/rpmsg/qcom_glink_smem.c +index 5cdaa5f8fb61..53b3a43160f4 100644 +--- a/drivers/rpmsg/qcom_glink_smem.c ++++ b/drivers/rpmsg/qcom_glink_smem.c +@@ -119,7 +119,7 @@ static void glink_smem_rx_advance(struct qcom_glink_pipe *np, + tail = le32_to_cpu(*pipe->tail); + + tail += count; +- if (tail > pipe->native.length) ++ if (tail >= pipe->native.length) + tail -= pipe->native.length; + + *pipe->tail = cpu_to_le32(tail); +diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c +index 5ea5d42bac76..662df16b07a4 100644 +--- a/drivers/scsi/libiscsi.c ++++ b/drivers/scsi/libiscsi.c +@@ -1983,7 +1983,7 @@ enum blk_eh_timer_return iscsi_eh_cmd_timed_out(struct scsi_cmnd *sc) + + ISCSI_DBG_EH(session, "scsi cmd %p timedout\n", sc); + +- spin_lock(&session->frwd_lock); ++ spin_lock_bh(&session->frwd_lock); + task = (struct iscsi_task *)sc->SCp.ptr; + if (!task) { + /* +@@ -2110,7 +2110,7 @@ enum blk_eh_timer_return iscsi_eh_cmd_timed_out(struct scsi_cmnd *sc) + done: + if (task) + task->last_timeout = jiffies; +- spin_unlock(&session->frwd_lock); ++ spin_unlock_bh(&session->frwd_lock); + ISCSI_DBG_EH(session, "return %s\n", rc == BLK_EH_RESET_TIMER ? + "timer reset" : "shutdown or nh"); + return rc; +diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c +index 95503bb9b067..d1363f3fabfa 100644 +--- a/drivers/usb/host/xhci-hub.c ++++ b/drivers/usb/host/xhci-hub.c +@@ -887,6 +887,14 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd, + status |= USB_PORT_STAT_C_BH_RESET << 16; + if ((raw_port_status & PORT_CEC)) + status |= USB_PORT_STAT_C_CONFIG_ERROR << 16; ++ ++ /* USB3 remote wake resume signaling completed */ ++ if (bus_state->port_remote_wakeup & (1 << wIndex) && ++ (raw_port_status & PORT_PLS_MASK) != XDEV_RESUME && ++ (raw_port_status & PORT_PLS_MASK) != XDEV_RECOVERY) { ++ bus_state->port_remote_wakeup &= ~(1 << wIndex); ++ usb_hcd_end_port_resume(&hcd->self, wIndex); ++ } + } + + if (hcd->speed < HCD_USB3) { +diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c +index 89af395cd89c..61fa3007a74a 100644 +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -1679,9 +1679,6 @@ static void handle_port_status(struct xhci_hcd *xhci, + usb_hcd_resume_root_hub(hcd); + } + +- if (hcd->speed >= HCD_USB3 && (portsc & PORT_PLS_MASK) == XDEV_INACTIVE) +- bus_state->port_remote_wakeup &= ~(1 << faked_port_index); +- + if ((portsc & PORT_PLC) && (portsc & PORT_PLS_MASK) == XDEV_RESUME) { + xhci_dbg(xhci, "port resume event for port %d\n", port_id); + +@@ -1700,6 +1697,7 @@ static void handle_port_status(struct xhci_hcd *xhci, + bus_state->port_remote_wakeup |= 1 << faked_port_index; + xhci_test_and_clear_bit(xhci, port_array, + faked_port_index, PORT_PLC); ++ usb_hcd_start_port_resume(&hcd->self, faked_port_index); + xhci_set_link_state(xhci, port_array, faked_port_index, + XDEV_U0); + /* Need to wait until the next link state change +@@ -1737,8 +1735,6 @@ static void handle_port_status(struct xhci_hcd *xhci, + if (slot_id && xhci->devs[slot_id]) + xhci_ring_device(xhci, slot_id); + if (bus_state->port_remote_wakeup & (1 << faked_port_index)) { +- bus_state->port_remote_wakeup &= +- ~(1 << faked_port_index); + xhci_test_and_clear_bit(xhci, port_array, + faked_port_index, PORT_PLC); + usb_wakeup_notification(hcd->self.root_hub, +diff --git a/drivers/vfio/pci/vfio_pci_intrs.c b/drivers/vfio/pci/vfio_pci_intrs.c +index 1c46045b0e7f..94594dc63c41 100644 +--- a/drivers/vfio/pci/vfio_pci_intrs.c ++++ b/drivers/vfio/pci/vfio_pci_intrs.c +@@ -297,8 +297,8 @@ static int vfio_msi_set_vector_signal(struct vfio_pci_device *vdev, + irq = pci_irq_vector(pdev, vector); + + if (vdev->ctx[vector].trigger) { +- free_irq(irq, vdev->ctx[vector].trigger); + irq_bypass_unregister_producer(&vdev->ctx[vector].producer); ++ free_irq(irq, vdev->ctx[vector].trigger); + kfree(vdev->ctx[vector].name); + eventfd_ctx_put(vdev->ctx[vector].trigger); + vdev->ctx[vector].trigger = NULL; +diff --git a/fs/cifs/file.c b/fs/cifs/file.c +index 6dc0e092b0fc..5e75c5f77f4c 100644 +--- a/fs/cifs/file.c ++++ b/fs/cifs/file.c +@@ -722,6 +722,13 @@ cifs_reopen_file(struct cifsFileInfo *cfile, bool can_flush) + if (backup_cred(cifs_sb)) + create_options |= CREATE_OPEN_BACKUP_INTENT; + ++ /* O_SYNC also has bit for O_DSYNC so following check picks up either */ ++ if (cfile->f_flags & O_SYNC) ++ create_options |= CREATE_WRITE_THROUGH; ++ ++ if (cfile->f_flags & O_DIRECT) ++ create_options |= CREATE_NO_BUFFER; ++ + if (server->ops->get_lease_key) + server->ops->get_lease_key(inode, &cfile->fid); + +diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h +index 4725a9d9597f..8818291815bc 100644 +--- a/include/linux/netdevice.h ++++ b/include/linux/netdevice.h +@@ -1718,6 +1718,11 @@ struct net_device { + unsigned char if_port; + unsigned char dma; + ++ /* Note : dev->mtu is often read without holding a lock. ++ * Writers usually hold RTNL. ++ * It is recommended to use READ_ONCE() to annotate the reads, ++ * and to use WRITE_ONCE() to annotate the writes. ++ */ + unsigned int mtu; + unsigned int min_mtu; + unsigned int max_mtu; +diff --git a/include/linux/time.h b/include/linux/time.h +index 87c36cf1cec2..21086c5143d9 100644 +--- a/include/linux/time.h ++++ b/include/linux/time.h +@@ -301,4 +301,17 @@ static inline bool itimerspec64_valid(const struct itimerspec64 *its) + */ + #define time_after32(a, b) ((s32)((u32)(b) - (u32)(a)) < 0) + #define time_before32(b, a) time_after32(a, b) ++ ++/** ++ * time_between32 - check if a 32-bit timestamp is within a given time range ++ * @t: the time which may be within [l,h] ++ * @l: the lower bound of the range ++ * @h: the higher bound of the range ++ * ++ * time_before32(t, l, h) returns true if @l <= @t <= @h. All operands are ++ * treated as 32-bit integers. ++ * ++ * Equivalent to !(time_before32(@t, @l) || time_after32(@t, @h)). ++ */ ++#define time_between32(t, l, h) ((u32)(h) - (u32)(l) >= (u32)(t) - (u32)(l)) + #endif +diff --git a/include/net/ip.h b/include/net/ip.h +index b8ebee43941f..666d89ca4e2e 100644 +--- a/include/net/ip.h ++++ b/include/net/ip.h +@@ -644,4 +644,9 @@ extern int sysctl_icmp_msgs_burst; + int ip_misc_proc_init(void); + #endif + ++static inline bool inetdev_valid_mtu(unsigned int mtu) ++{ ++ return likely(mtu >= IPV4_MIN_MTU); ++} ++ + #endif /* _IP_H */ +diff --git a/include/net/tcp.h b/include/net/tcp.h +index 785c4ef4e1bf..00d10f0e1194 100644 +--- a/include/net/tcp.h ++++ b/include/net/tcp.h +@@ -500,19 +500,27 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb); + */ + static inline void tcp_synq_overflow(const struct sock *sk) + { +- unsigned long last_overflow = tcp_sk(sk)->rx_opt.ts_recent_stamp; ++ unsigned long last_overflow = READ_ONCE(tcp_sk(sk)->rx_opt.ts_recent_stamp); + unsigned long now = jiffies; + +- if (time_after(now, last_overflow + HZ)) +- tcp_sk(sk)->rx_opt.ts_recent_stamp = now; ++ if (!time_between32(now, last_overflow, last_overflow + HZ)) ++ WRITE_ONCE(tcp_sk(sk)->rx_opt.ts_recent_stamp, now); + } + + /* syncookies: no recent synqueue overflow on this listening socket? */ + static inline bool tcp_synq_no_recent_overflow(const struct sock *sk) + { +- unsigned long last_overflow = tcp_sk(sk)->rx_opt.ts_recent_stamp; ++ unsigned long last_overflow = READ_ONCE(tcp_sk(sk)->rx_opt.ts_recent_stamp); + +- return time_after(jiffies, last_overflow + TCP_SYNCOOKIE_VALID); ++ /* If last_overflow <= jiffies <= last_overflow + TCP_SYNCOOKIE_VALID, ++ * then we're under synflood. However, we have to use ++ * 'last_overflow - HZ' as lower bound. That's because a concurrent ++ * tcp_synq_overflow() could update .ts_recent_stamp after we read ++ * jiffies but before we store .ts_recent_stamp into last_overflow, ++ * which could lead to rejecting a valid syncookie. ++ */ ++ return !time_between32(jiffies, last_overflow - HZ, ++ last_overflow + TCP_SYNCOOKIE_VALID); + } + + static inline u32 tcp_cookie_time(void) +diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c +index f6b6a92f1c48..b7cc322acdc8 100644 +--- a/net/bridge/br_device.c ++++ b/net/bridge/br_device.c +@@ -217,6 +217,12 @@ static int br_set_mac_address(struct net_device *dev, void *p) + if (!is_valid_ether_addr(addr->sa_data)) + return -EADDRNOTAVAIL; + ++ /* dev_set_mac_addr() can be called by a master device on bridge's ++ * NETDEV_UNREGISTER, but since it's being destroyed do nothing ++ */ ++ if (dev->reg_state != NETREG_REGISTERED) ++ return -EBUSY; ++ + spin_lock_bh(&br->lock); + if (!ether_addr_equal(dev->dev_addr, addr->sa_data)) { + /* Mac address will be changed in br_stp_change_bridge_id(). */ +diff --git a/net/core/dev.c b/net/core/dev.c +index 3ce68484ed5a..f9f05b3df460 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -6876,7 +6876,8 @@ int __dev_set_mtu(struct net_device *dev, int new_mtu) + if (ops->ndo_change_mtu) + return ops->ndo_change_mtu(dev, new_mtu); + +- dev->mtu = new_mtu; ++ /* Pairs with all the lockless reads of dev->mtu in the stack */ ++ WRITE_ONCE(dev->mtu, new_mtu); + return 0; + } + EXPORT_SYMBOL(__dev_set_mtu); +diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c +index 7be5c20a93a5..071de3013364 100644 +--- a/net/core/flow_dissector.c ++++ b/net/core/flow_dissector.c +@@ -450,9 +450,10 @@ bool __skb_flow_dissect(const struct sk_buff *skb, + nhoff = skb_network_offset(skb); + hlen = skb_headlen(skb); + #if IS_ENABLED(CONFIG_NET_DSA) +- if (unlikely(skb->dev && netdev_uses_dsa(skb->dev))) { ++ if (unlikely(skb->dev && netdev_uses_dsa(skb->dev) && ++ proto == htons(ETH_P_XDSA))) { + const struct dsa_device_ops *ops; +- int offset; ++ int offset = 0; + + ops = skb->dev->dsa_ptr->tag_ops; + if (ops->flow_dissect && +diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c +index 5264510c9983..5f020c051af9 100644 +--- a/net/ipv4/devinet.c ++++ b/net/ipv4/devinet.c +@@ -1426,11 +1426,6 @@ skip: + } + } + +-static bool inetdev_valid_mtu(unsigned int mtu) +-{ +- return mtu >= IPV4_MIN_MTU; +-} +- + static void inetdev_send_gratuitous_arp(struct net_device *dev, + struct in_device *in_dev) + +diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c +index 34d49f76d1a7..73cd64c7692f 100644 +--- a/net/ipv4/ip_output.c ++++ b/net/ipv4/ip_output.c +@@ -1123,13 +1123,17 @@ static int ip_setup_cork(struct sock *sk, struct inet_cork *cork, + rt = *rtp; + if (unlikely(!rt)) + return -EFAULT; +- /* +- * We steal reference to this route, caller should not release it +- */ +- *rtp = NULL; ++ + cork->fragsize = ip_sk_use_pmtu(sk) ? +- dst_mtu(&rt->dst) : rt->dst.dev->mtu; ++ dst_mtu(&rt->dst) : READ_ONCE(rt->dst.dev->mtu); ++ ++ if (!inetdev_valid_mtu(cork->fragsize)) ++ return -ENETUNREACH; ++ + cork->dst = &rt->dst; ++ /* We stole this route, caller should not release it. */ ++ *rtp = NULL; ++ + cork->length = 0; + cork->ttl = ipc->ttl; + cork->tos = ipc->tos; +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c +index 6025cc509d97..e3b28140c10b 100644 +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -708,8 +708,9 @@ static unsigned int tcp_established_options(struct sock *sk, struct sk_buff *skb + min_t(unsigned int, eff_sacks, + (remaining - TCPOLEN_SACK_BASE_ALIGNED) / + TCPOLEN_SACK_PERBLOCK); +- size += TCPOLEN_SACK_BASE_ALIGNED + +- opts->num_sack_blocks * TCPOLEN_SACK_PERBLOCK; ++ if (likely(opts->num_sack_blocks)) ++ size += TCPOLEN_SACK_BASE_ALIGNED + ++ opts->num_sack_blocks * TCPOLEN_SACK_PERBLOCK; + } + + return size; +diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c +index 48d81857961c..737e37b28d93 100644 +--- a/net/openvswitch/conntrack.c ++++ b/net/openvswitch/conntrack.c +@@ -879,6 +879,17 @@ static int ovs_ct_nat(struct net *net, struct sw_flow_key *key, + } + err = ovs_ct_nat_execute(skb, ct, ctinfo, &info->range, maniptype); + ++ if (err == NF_ACCEPT && ++ ct->status & IPS_SRC_NAT && ct->status & IPS_DST_NAT) { ++ if (maniptype == NF_NAT_MANIP_SRC) ++ maniptype = NF_NAT_MANIP_DST; ++ else ++ maniptype = NF_NAT_MANIP_SRC; ++ ++ err = ovs_ct_nat_execute(skb, ct, ctinfo, &info->range, ++ maniptype); ++ } ++ + /* Mark NAT done if successful and update the flow key. */ + if (err == NF_ACCEPT) + ovs_nat_update_key(key, skb, maniptype); +diff --git a/net/tipc/core.c b/net/tipc/core.c +index 67ac10434ba2..35f162ece2b7 100644 +--- a/net/tipc/core.c ++++ b/net/tipc/core.c +@@ -116,14 +116,6 @@ static int __init tipc_init(void) + sysctl_tipc_rmem[1] = RCVBUF_DEF; + sysctl_tipc_rmem[2] = RCVBUF_MAX; + +- err = tipc_netlink_start(); +- if (err) +- goto out_netlink; +- +- err = tipc_netlink_compat_start(); +- if (err) +- goto out_netlink_compat; +- + err = tipc_register_sysctl(); + if (err) + goto out_sysctl; +@@ -144,8 +136,21 @@ static int __init tipc_init(void) + if (err) + goto out_bearer; + ++ err = tipc_netlink_start(); ++ if (err) ++ goto out_netlink; ++ ++ err = tipc_netlink_compat_start(); ++ if (err) ++ goto out_netlink_compat; ++ + pr_info("Started in single node mode\n"); + return 0; ++ ++out_netlink_compat: ++ tipc_netlink_stop(); ++out_netlink: ++ tipc_bearer_cleanup(); + out_bearer: + unregister_pernet_device(&tipc_topsrv_net_ops); + out_pernet_topsrv: +@@ -155,22 +160,18 @@ out_socket: + out_pernet: + tipc_unregister_sysctl(); + out_sysctl: +- tipc_netlink_compat_stop(); +-out_netlink_compat: +- tipc_netlink_stop(); +-out_netlink: + pr_err("Unable to start in single node mode\n"); + return err; + } + + static void __exit tipc_exit(void) + { ++ tipc_netlink_compat_stop(); ++ tipc_netlink_stop(); + tipc_bearer_cleanup(); + unregister_pernet_device(&tipc_topsrv_net_ops); + tipc_socket_stop(); + unregister_pernet_device(&tipc_net_ops); +- tipc_netlink_stop(); +- tipc_netlink_compat_stop(); + tipc_unregister_sysctl(); + + pr_info("Deactivated\n"); diff --git a/patch/kernel/odroidxu4-legacy/patch-4.14.160-161.patch b/patch/kernel/odroidxu4-legacy/patch-4.14.160-161.patch new file mode 100644 index 000000000..a74a8d40d --- /dev/null +++ b/patch/kernel/odroidxu4-legacy/patch-4.14.160-161.patch @@ -0,0 +1,4240 @@ +diff --git a/Makefile b/Makefile +index f011cb69545f..6b4528888a75 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 14 +-SUBLEVEL = 160 ++SUBLEVEL = 161 + EXTRAVERSION = + NAME = Petit Gorille + +diff --git a/arch/arm64/kernel/psci.c b/arch/arm64/kernel/psci.c +index e8edbf13302a..3856d51c645b 100644 +--- a/arch/arm64/kernel/psci.c ++++ b/arch/arm64/kernel/psci.c +@@ -84,7 +84,8 @@ static void cpu_psci_cpu_die(unsigned int cpu) + + static int cpu_psci_cpu_kill(unsigned int cpu) + { +- int err, i; ++ int err; ++ unsigned long start, end; + + if (!psci_ops.affinity_info) + return 0; +@@ -94,16 +95,18 @@ static int cpu_psci_cpu_kill(unsigned int cpu) + * while it is dying. So, try again a few times. + */ + +- for (i = 0; i < 10; i++) { ++ start = jiffies; ++ end = start + msecs_to_jiffies(100); ++ do { + err = psci_ops.affinity_info(cpu_logical_map(cpu), 0); + if (err == PSCI_0_2_AFFINITY_LEVEL_OFF) { +- pr_info("CPU%d killed.\n", cpu); ++ pr_info("CPU%d killed (polled %d ms)\n", cpu, ++ jiffies_to_msecs(jiffies - start)); + return 0; + } + +- msleep(10); +- pr_info("Retrying again to check for CPU kill\n"); +- } ++ usleep_range(100, 1000); ++ } while (time_before(jiffies, end)); + + pr_warn("CPU%d may not have shut down cleanly (AFFINITY_INFO reports %d)\n", + cpu, err); +diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c +index cfbf7bd0dfba..32ae5c9daac4 100644 +--- a/arch/arm64/kvm/sys_regs.c ++++ b/arch/arm64/kvm/sys_regs.c +@@ -1785,8 +1785,11 @@ static const struct sys_reg_desc *index_to_sys_reg_desc(struct kvm_vcpu *vcpu, + if ((id & KVM_REG_ARM_COPROC_MASK) != KVM_REG_ARM64_SYSREG) + return NULL; + ++ if (!index_to_params(id, ¶ms)) ++ return NULL; ++ + table = get_target_table(vcpu->arch.target, true, &num); +- r = find_reg_by_id(id, ¶ms, table, num); ++ r = find_reg(¶ms, table, num); + if (!r) + r = find_reg(¶ms, sys_reg_descs, ARRAY_SIZE(sys_reg_descs)); + +diff --git a/arch/mips/include/asm/pgtable-64.h b/arch/mips/include/asm/pgtable-64.h +index a2252c2a9ded..d0b9912fb63f 100644 +--- a/arch/mips/include/asm/pgtable-64.h ++++ b/arch/mips/include/asm/pgtable-64.h +@@ -18,10 +18,12 @@ + #include + + #define __ARCH_USE_5LEVEL_HACK +-#if defined(CONFIG_PAGE_SIZE_64KB) && !defined(CONFIG_MIPS_VA_BITS_48) ++#if CONFIG_PGTABLE_LEVELS == 2 + #include +-#elif !(defined(CONFIG_PAGE_SIZE_4KB) && defined(CONFIG_MIPS_VA_BITS_48)) ++#elif CONFIG_PGTABLE_LEVELS == 3 + #include ++#else ++#include + #endif + + /* +@@ -222,6 +224,9 @@ static inline unsigned long pgd_page_vaddr(pgd_t pgd) + return pgd_val(pgd); + } + ++#define pgd_phys(pgd) virt_to_phys((void *)pgd_val(pgd)) ++#define pgd_page(pgd) (pfn_to_page(pgd_phys(pgd) >> PAGE_SHIFT)) ++ + static inline pud_t *pud_offset(pgd_t *pgd, unsigned long address) + { + return (pud_t *)pgd_page_vaddr(*pgd) + pud_index(address); +diff --git a/arch/powerpc/kernel/irq.c b/arch/powerpc/kernel/irq.c +index 0ce8b0e5d7ba..207ba53a500b 100644 +--- a/arch/powerpc/kernel/irq.c ++++ b/arch/powerpc/kernel/irq.c +@@ -561,8 +561,6 @@ void __do_irq(struct pt_regs *regs) + + trace_irq_entry(regs); + +- check_stack_overflow(); +- + /* + * Query the platform PIC for the interrupt & ack it. + * +@@ -594,6 +592,8 @@ void do_IRQ(struct pt_regs *regs) + irqtp = hardirq_ctx[raw_smp_processor_id()]; + sirqtp = softirq_ctx[raw_smp_processor_id()]; + ++ check_stack_overflow(); ++ + /* Already there ? */ + if (unlikely(curtp == irqtp || curtp == sirqtp)) { + __do_irq(regs); +diff --git a/arch/s390/include/asm/pgalloc.h b/arch/s390/include/asm/pgalloc.h +index bbe99cb8219d..11857fea993c 100644 +--- a/arch/s390/include/asm/pgalloc.h ++++ b/arch/s390/include/asm/pgalloc.h +@@ -70,7 +70,12 @@ static inline p4d_t *p4d_alloc_one(struct mm_struct *mm, unsigned long address) + crst_table_init(table, _REGION2_ENTRY_EMPTY); + return (p4d_t *) table; + } +-#define p4d_free(mm, p4d) crst_table_free(mm, (unsigned long *) p4d) ++ ++static inline void p4d_free(struct mm_struct *mm, p4d_t *p4d) ++{ ++ if (!mm_p4d_folded(mm)) ++ crst_table_free(mm, (unsigned long *) p4d); ++} + + static inline pud_t *pud_alloc_one(struct mm_struct *mm, unsigned long address) + { +@@ -79,7 +84,12 @@ static inline pud_t *pud_alloc_one(struct mm_struct *mm, unsigned long address) + crst_table_init(table, _REGION3_ENTRY_EMPTY); + return (pud_t *) table; + } +-#define pud_free(mm, pud) crst_table_free(mm, (unsigned long *) pud) ++ ++static inline void pud_free(struct mm_struct *mm, pud_t *pud) ++{ ++ if (!mm_pud_folded(mm)) ++ crst_table_free(mm, (unsigned long *) pud); ++} + + static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long vmaddr) + { +@@ -97,6 +107,8 @@ static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long vmaddr) + + static inline void pmd_free(struct mm_struct *mm, pmd_t *pmd) + { ++ if (mm_pmd_folded(mm)) ++ return; + pgtable_pmd_page_dtor(virt_to_page(pmd)); + crst_table_free(mm, (unsigned long *) pmd); + } +diff --git a/arch/s390/include/asm/timex.h b/arch/s390/include/asm/timex.h +index 64539c221672..2dc9eb4e1acc 100644 +--- a/arch/s390/include/asm/timex.h ++++ b/arch/s390/include/asm/timex.h +@@ -10,8 +10,9 @@ + #ifndef _ASM_S390_TIMEX_H + #define _ASM_S390_TIMEX_H + +-#include ++#include + #include ++#include + + /* The value of the TOD clock for 1.1.1970. */ + #define TOD_UNIX_EPOCH 0x7d91048bca000000ULL +@@ -186,15 +187,18 @@ extern unsigned char tod_clock_base[16] __aligned(8); + /** + * get_clock_monotonic - returns current time in clock rate units + * +- * The caller must ensure that preemption is disabled. + * The clock and tod_clock_base get changed via stop_machine. +- * Therefore preemption must be disabled when calling this +- * function, otherwise the returned value is not guaranteed to +- * be monotonic. ++ * Therefore preemption must be disabled, otherwise the returned ++ * value is not guaranteed to be monotonic. + */ + static inline unsigned long long get_tod_clock_monotonic(void) + { +- return get_tod_clock() - *(unsigned long long *) &tod_clock_base[1]; ++ unsigned long long tod; ++ ++ preempt_disable_notrace(); ++ tod = get_tod_clock() - *(unsigned long long *) &tod_clock_base[1]; ++ preempt_enable_notrace(); ++ return tod; + } + + /** +diff --git a/arch/s390/kernel/dis.c b/arch/s390/kernel/dis.c +index 2394557653d5..6d154069c962 100644 +--- a/arch/s390/kernel/dis.c ++++ b/arch/s390/kernel/dis.c +@@ -1930,10 +1930,11 @@ static int print_insn(char *buffer, unsigned char *code, unsigned long addr) + ptr += sprintf(ptr, "%%c%i", value); + else if (operand->flags & OPERAND_VR) + ptr += sprintf(ptr, "%%v%i", value); +- else if (operand->flags & OPERAND_PCREL) +- ptr += sprintf(ptr, "%lx", (signed int) value +- + addr); +- else if (operand->flags & OPERAND_SIGNED) ++ else if (operand->flags & OPERAND_PCREL) { ++ void *pcrel = (void *)((int)value + addr); ++ ++ ptr += sprintf(ptr, "%px", pcrel); ++ } else if (operand->flags & OPERAND_SIGNED) + ptr += sprintf(ptr, "%i", value); + else + ptr += sprintf(ptr, "%u", value); +@@ -2005,7 +2006,7 @@ void show_code(struct pt_regs *regs) + else + *ptr++ = ' '; + addr = regs->psw.addr + start - 32; +- ptr += sprintf(ptr, "%016lx: ", addr); ++ ptr += sprintf(ptr, "%px: ", (void *)addr); + if (start + opsize >= end) + break; + for (i = 0; i < opsize; i++) +@@ -2033,7 +2034,7 @@ void print_fn_code(unsigned char *code, unsigned long len) + opsize = insn_length(*code); + if (opsize > len) + break; +- ptr += sprintf(ptr, "%p: ", code); ++ ptr += sprintf(ptr, "%px: ", code); + for (i = 0; i < opsize; i++) + ptr += sprintf(ptr, "%02x", code[i]); + *ptr++ = '\t'; +diff --git a/arch/sh/include/cpu-sh4/cpu/sh7734.h b/arch/sh/include/cpu-sh4/cpu/sh7734.h +index 96f0246ad2f2..82b63208135a 100644 +--- a/arch/sh/include/cpu-sh4/cpu/sh7734.h ++++ b/arch/sh/include/cpu-sh4/cpu/sh7734.h +@@ -134,7 +134,7 @@ enum { + GPIO_FN_EX_WAIT1, GPIO_FN_SD1_DAT0_A, GPIO_FN_DREQ2, GPIO_FN_CAN1_TX_C, + GPIO_FN_ET0_LINK_C, GPIO_FN_ET0_ETXD5_A, + GPIO_FN_EX_WAIT0, GPIO_FN_TCLK1_B, +- GPIO_FN_RD_WR, GPIO_FN_TCLK0, ++ GPIO_FN_RD_WR, GPIO_FN_TCLK0, GPIO_FN_CAN_CLK_B, GPIO_FN_ET0_ETXD4, + GPIO_FN_EX_CS5, GPIO_FN_SD1_CMD_A, GPIO_FN_ATADIR, GPIO_FN_QSSL_B, + GPIO_FN_ET0_ETXD3_A, + GPIO_FN_EX_CS4, GPIO_FN_SD1_WP_A, GPIO_FN_ATAWR, GPIO_FN_QMI_QIO1_B, +diff --git a/arch/x86/include/asm/crash.h b/arch/x86/include/asm/crash.h +index a7adb2bfbf0b..6b8ad6fa3979 100644 +--- a/arch/x86/include/asm/crash.h ++++ b/arch/x86/include/asm/crash.h +@@ -2,6 +2,8 @@ + #ifndef _ASM_X86_CRASH_H + #define _ASM_X86_CRASH_H + ++struct kimage; ++ + int crash_load_segments(struct kimage *image); + int crash_copy_backup_region(struct kimage *image); + int crash_setup_memmap_entries(struct kimage *image, +diff --git a/arch/x86/include/asm/fixmap.h b/arch/x86/include/asm/fixmap.h +index 6390bd8c141b..5e12b2319d7a 100644 +--- a/arch/x86/include/asm/fixmap.h ++++ b/arch/x86/include/asm/fixmap.h +@@ -159,7 +159,7 @@ extern pte_t *kmap_pte; + extern pte_t *pkmap_page_table; + + void __native_set_fixmap(enum fixed_addresses idx, pte_t pte); +-void native_set_fixmap(enum fixed_addresses idx, ++void native_set_fixmap(unsigned /* enum fixed_addresses */ idx, + phys_addr_t phys, pgprot_t flags); + + #ifndef CONFIG_PARAVIRT +diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c +index 566b7bc5deaa..2271adbc3c42 100644 +--- a/arch/x86/kernel/apic/io_apic.c ++++ b/arch/x86/kernel/apic/io_apic.c +@@ -1690,9 +1690,10 @@ static bool io_apic_level_ack_pending(struct mp_chip_data *data) + + static inline bool ioapic_irqd_mask(struct irq_data *data) + { +- /* If we are moving the irq we need to mask it */ ++ /* If we are moving the IRQ we need to mask it */ + if (unlikely(irqd_is_setaffinity_pending(data))) { +- mask_ioapic_irq(data); ++ if (!irqd_irq_masked(data)) ++ mask_ioapic_irq(data); + return true; + } + return false; +@@ -1729,7 +1730,9 @@ static inline void ioapic_irqd_unmask(struct irq_data *data, bool masked) + */ + if (!io_apic_level_ack_pending(data->chip_data)) + irq_move_masked_irq(data); +- unmask_ioapic_irq(data); ++ /* If the IRQ is masked in the core, leave it: */ ++ if (!irqd_irq_masked(data)) ++ unmask_ioapic_irq(data); + } + } + #else +diff --git a/arch/x86/kernel/cpu/mcheck/mce_amd.c b/arch/x86/kernel/cpu/mcheck/mce_amd.c +index b434780ae680..a8f47697276b 100644 +--- a/arch/x86/kernel/cpu/mcheck/mce_amd.c ++++ b/arch/x86/kernel/cpu/mcheck/mce_amd.c +@@ -228,10 +228,10 @@ static void smca_configure(unsigned int bank, unsigned int cpu) + } + + /* Return early if this bank was already initialized. */ +- if (smca_banks[bank].hwid) ++ if (smca_banks[bank].hwid && smca_banks[bank].hwid->hwid_mcatype != 0) + return; + +- if (rdmsr_safe_on_cpu(cpu, MSR_AMD64_SMCA_MCx_IPID(bank), &low, &high)) { ++ if (rdmsr_safe(MSR_AMD64_SMCA_MCx_IPID(bank), &low, &high)) { + pr_warn("Failed to read MCA_IPID for bank %d\n", bank); + return; + } +diff --git a/arch/x86/kernel/cpu/mcheck/therm_throt.c b/arch/x86/kernel/cpu/mcheck/therm_throt.c +index ee229ceee745..ec6a07b04fdb 100644 +--- a/arch/x86/kernel/cpu/mcheck/therm_throt.c ++++ b/arch/x86/kernel/cpu/mcheck/therm_throt.c +@@ -185,7 +185,7 @@ static void therm_throt_process(bool new_event, int event, int level) + /* if we just entered the thermal event */ + if (new_event) { + if (event == THERMAL_THROTTLING_EVENT) +- pr_crit("CPU%d: %s temperature above threshold, cpu clock throttled (total events = %lu)\n", ++ pr_warn("CPU%d: %s temperature above threshold, cpu clock throttled (total events = %lu)\n", + this_cpu, + level == CORE_LEVEL ? "Core" : "Package", + state->count); +diff --git a/arch/x86/lib/x86-opcode-map.txt b/arch/x86/lib/x86-opcode-map.txt +index e0b85930dd77..0a0e9112f284 100644 +--- a/arch/x86/lib/x86-opcode-map.txt ++++ b/arch/x86/lib/x86-opcode-map.txt +@@ -333,7 +333,7 @@ AVXcode: 1 + 06: CLTS + 07: SYSRET (o64) + 08: INVD +-09: WBINVD ++09: WBINVD | WBNOINVD (F3) + 0a: + 0b: UD2 (1B) + 0c: +@@ -364,7 +364,7 @@ AVXcode: 1 + # a ModR/M byte. + 1a: BNDCL Gv,Ev (F3) | BNDCU Gv,Ev (F2) | BNDMOV Gv,Ev (66) | BNDLDX Gv,Ev + 1b: BNDCN Gv,Ev (F2) | BNDMOV Ev,Gv (66) | BNDMK Gv,Ev (F3) | BNDSTX Ev,Gv +-1c: ++1c: Grp20 (1A),(1C) + 1d: + 1e: + 1f: NOP Ev +@@ -792,6 +792,8 @@ f3: Grp17 (1A) + f5: BZHI Gy,Ey,By (v) | PEXT Gy,By,Ey (F3),(v) | PDEP Gy,By,Ey (F2),(v) + f6: ADCX Gy,Ey (66) | ADOX Gy,Ey (F3) | MULX By,Gy,rDX,Ey (F2),(v) + f7: BEXTR Gy,Ey,By (v) | SHLX Gy,Ey,By (66),(v) | SARX Gy,Ey,By (F3),(v) | SHRX Gy,Ey,By (F2),(v) ++f8: MOVDIR64B Gv,Mdqq (66) | ENQCMD Gv,Mdqq (F2) | ENQCMDS Gv,Mdqq (F3) ++f9: MOVDIRI My,Gy + EndTable + + Table: 3-byte opcode 2 (0x0f 0x3a) +@@ -943,9 +945,9 @@ GrpTable: Grp6 + EndTable + + GrpTable: Grp7 +-0: SGDT Ms | VMCALL (001),(11B) | VMLAUNCH (010),(11B) | VMRESUME (011),(11B) | VMXOFF (100),(11B) +-1: SIDT Ms | MONITOR (000),(11B) | MWAIT (001),(11B) | CLAC (010),(11B) | STAC (011),(11B) +-2: LGDT Ms | XGETBV (000),(11B) | XSETBV (001),(11B) | VMFUNC (100),(11B) | XEND (101)(11B) | XTEST (110)(11B) ++0: SGDT Ms | VMCALL (001),(11B) | VMLAUNCH (010),(11B) | VMRESUME (011),(11B) | VMXOFF (100),(11B) | PCONFIG (101),(11B) | ENCLV (000),(11B) ++1: SIDT Ms | MONITOR (000),(11B) | MWAIT (001),(11B) | CLAC (010),(11B) | STAC (011),(11B) | ENCLS (111),(11B) ++2: LGDT Ms | XGETBV (000),(11B) | XSETBV (001),(11B) | VMFUNC (100),(11B) | XEND (101)(11B) | XTEST (110)(11B) | ENCLU (111),(11B) + 3: LIDT Ms + 4: SMSW Mw/Rv + 5: rdpkru (110),(11B) | wrpkru (111),(11B) +@@ -1020,7 +1022,7 @@ GrpTable: Grp15 + 3: vstmxcsr Md (v1) | WRGSBASE Ry (F3),(11B) + 4: XSAVE | ptwrite Ey (F3),(11B) + 5: XRSTOR | lfence (11B) +-6: XSAVEOPT | clwb (66) | mfence (11B) ++6: XSAVEOPT | clwb (66) | mfence (11B) | TPAUSE Rd (66),(11B) | UMONITOR Rv (F3),(11B) | UMWAIT Rd (F2),(11B) + 7: clflush | clflushopt (66) | sfence (11B) + EndTable + +@@ -1051,6 +1053,10 @@ GrpTable: Grp19 + 6: vscatterpf1qps/d Wx (66),(ev) + EndTable + ++GrpTable: Grp20 ++0: cldemote Mb ++EndTable ++ + # AMD's Prefetch Group + GrpTable: GrpP + 0: PREFETCH +diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c +index b4fd36271f90..55338b392221 100644 +--- a/arch/x86/mm/pgtable.c ++++ b/arch/x86/mm/pgtable.c +@@ -590,8 +590,8 @@ void __native_set_fixmap(enum fixed_addresses idx, pte_t pte) + fixmaps_set++; + } + +-void native_set_fixmap(enum fixed_addresses idx, phys_addr_t phys, +- pgprot_t flags) ++void native_set_fixmap(unsigned /* enum fixed_addresses */ idx, ++ phys_addr_t phys, pgprot_t flags) + { + __native_set_fixmap(idx, pfn_pte(phys >> PAGE_SHIFT, flags)); + } +diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c +index cbb162b683b6..08f67c109429 100644 +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -6676,6 +6676,9 @@ void ata_host_detach(struct ata_host *host) + { + int i; + ++ /* Ensure ata_port probe has completed */ ++ async_synchronize_full(); ++ + for (i = 0; i < host->n_ports; i++) + ata_port_detach(host->ports[i]); + +diff --git a/drivers/block/loop.c b/drivers/block/loop.c +index ec61dd873c93..453e3728e657 100644 +--- a/drivers/block/loop.c ++++ b/drivers/block/loop.c +@@ -414,18 +414,20 @@ out_free_page: + return ret; + } + +-static int lo_discard(struct loop_device *lo, struct request *rq, loff_t pos) ++static int lo_fallocate(struct loop_device *lo, struct request *rq, loff_t pos, ++ int mode) + { + /* +- * We use punch hole to reclaim the free space used by the +- * image a.k.a. discard. However we do not support discard if +- * encryption is enabled, because it may give an attacker +- * useful information. ++ * We use fallocate to manipulate the space mappings used by the image ++ * a.k.a. discard/zerorange. However we do not support this if ++ * encryption is enabled, because it may give an attacker useful ++ * information. + */ + struct file *file = lo->lo_backing_file; +- int mode = FALLOC_FL_PUNCH_HOLE | FALLOC_FL_KEEP_SIZE; + int ret; + ++ mode |= FALLOC_FL_KEEP_SIZE; ++ + if ((!file->f_op->fallocate) || lo->lo_encrypt_key_size) { + ret = -EOPNOTSUPP; + goto out; +@@ -565,9 +567,17 @@ static int do_req_filebacked(struct loop_device *lo, struct request *rq) + switch (req_op(rq)) { + case REQ_OP_FLUSH: + return lo_req_flush(lo, rq); +- case REQ_OP_DISCARD: + case REQ_OP_WRITE_ZEROES: +- return lo_discard(lo, rq, pos); ++ /* ++ * If the caller doesn't want deallocation, call zeroout to ++ * write zeroes the range. Otherwise, punch them out. ++ */ ++ return lo_fallocate(lo, rq, pos, ++ (rq->cmd_flags & REQ_NOUNMAP) ? ++ FALLOC_FL_ZERO_RANGE : ++ FALLOC_FL_PUNCH_HOLE); ++ case REQ_OP_DISCARD: ++ return lo_fallocate(lo, rq, pos, FALLOC_FL_PUNCH_HOLE); + case REQ_OP_WRITE: + if (lo->transfer) + return lo_write_transfer(lo, rq, pos); +diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c +index 929bd255a290..4c661ad91e7d 100644 +--- a/drivers/block/nbd.c ++++ b/drivers/block/nbd.c +@@ -1234,10 +1234,10 @@ static int nbd_start_device_ioctl(struct nbd_device *nbd, struct block_device *b + mutex_unlock(&nbd->config_lock); + ret = wait_event_interruptible(config->recv_wq, + atomic_read(&config->recv_threads) == 0); +- if (ret) { ++ if (ret) + sock_shutdown(nbd); +- flush_workqueue(nbd->recv_workq); +- } ++ flush_workqueue(nbd->recv_workq); ++ + mutex_lock(&nbd->config_lock); + bd_set_size(bdev, 0); + /* user requested, ignore socket errors */ +diff --git a/drivers/char/hw_random/omap3-rom-rng.c b/drivers/char/hw_random/omap3-rom-rng.c +index 38b719017186..648e39ce6bd9 100644 +--- a/drivers/char/hw_random/omap3-rom-rng.c ++++ b/drivers/char/hw_random/omap3-rom-rng.c +@@ -121,7 +121,8 @@ static int omap3_rom_rng_remove(struct platform_device *pdev) + { + cancel_delayed_work_sync(&idle_work); + hwrng_unregister(&omap3_rom_rng_ops); +- clk_disable_unprepare(rng_clk); ++ if (!rng_idle) ++ clk_disable_unprepare(rng_clk); + return 0; + } + +diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c +index 480e8c13567c..c798a1233e6a 100644 +--- a/drivers/cpufreq/cpufreq.c ++++ b/drivers/cpufreq/cpufreq.c +@@ -2475,6 +2475,13 @@ int cpufreq_register_driver(struct cpufreq_driver *driver_data) + if (cpufreq_disabled()) + return -ENODEV; + ++ /* ++ * The cpufreq core depends heavily on the availability of device ++ * structure, make sure they are available before proceeding further. ++ */ ++ if (!get_cpu_device(0)) ++ return -EPROBE_DEFER; ++ + if (!driver_data || !driver_data->verify || !driver_data->init || + !(driver_data->setpolicy || driver_data->target_index || + driver_data->target) || +diff --git a/drivers/crypto/sunxi-ss/sun4i-ss-cipher.c b/drivers/crypto/sunxi-ss/sun4i-ss-cipher.c +index 5cf64746731a..22e491857925 100644 +--- a/drivers/crypto/sunxi-ss/sun4i-ss-cipher.c ++++ b/drivers/crypto/sunxi-ss/sun4i-ss-cipher.c +@@ -81,7 +81,8 @@ static int sun4i_ss_opti_poll(struct skcipher_request *areq) + oi = 0; + oo = 0; + do { +- todo = min3(rx_cnt, ileft, (mi.length - oi) / 4); ++ todo = min(rx_cnt, ileft); ++ todo = min_t(size_t, todo, (mi.length - oi) / 4); + if (todo) { + ileft -= todo; + writesl(ss->base + SS_RXFIFO, mi.addr + oi, todo); +@@ -96,7 +97,8 @@ static int sun4i_ss_opti_poll(struct skcipher_request *areq) + rx_cnt = SS_RXFIFO_SPACES(spaces); + tx_cnt = SS_TXFIFO_SPACES(spaces); + +- todo = min3(tx_cnt, oleft, (mo.length - oo) / 4); ++ todo = min(tx_cnt, oleft); ++ todo = min_t(size_t, todo, (mo.length - oo) / 4); + if (todo) { + oleft -= todo; + readsl(ss->base + SS_TXFIFO, mo.addr + oo, todo); +@@ -220,7 +222,8 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq) + * todo is the number of consecutive 4byte word that we + * can read from current SG + */ +- todo = min3(rx_cnt, ileft / 4, (mi.length - oi) / 4); ++ todo = min(rx_cnt, ileft / 4); ++ todo = min_t(size_t, todo, (mi.length - oi) / 4); + if (todo && !ob) { + writesl(ss->base + SS_RXFIFO, mi.addr + oi, + todo); +@@ -234,8 +237,8 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq) + * we need to be able to write all buf in one + * pass, so it is why we min() with rx_cnt + */ +- todo = min3(rx_cnt * 4 - ob, ileft, +- mi.length - oi); ++ todo = min(rx_cnt * 4 - ob, ileft); ++ todo = min_t(size_t, todo, mi.length - oi); + memcpy(buf + ob, mi.addr + oi, todo); + ileft -= todo; + oi += todo; +@@ -255,7 +258,8 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq) + spaces = readl(ss->base + SS_FCSR); + rx_cnt = SS_RXFIFO_SPACES(spaces); + tx_cnt = SS_TXFIFO_SPACES(spaces); +- dev_dbg(ss->dev, "%x %u/%u %u/%u cnt=%u %u/%u %u/%u cnt=%u %u\n", ++ dev_dbg(ss->dev, ++ "%x %u/%zu %u/%u cnt=%u %u/%zu %u/%u cnt=%u %u\n", + mode, + oi, mi.length, ileft, areq->cryptlen, rx_cnt, + oo, mo.length, oleft, areq->cryptlen, tx_cnt, ob); +@@ -263,7 +267,8 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq) + if (!tx_cnt) + continue; + /* todo in 4bytes word */ +- todo = min3(tx_cnt, oleft / 4, (mo.length - oo) / 4); ++ todo = min(tx_cnt, oleft / 4); ++ todo = min_t(size_t, todo, (mo.length - oo) / 4); + if (todo) { + readsl(ss->base + SS_TXFIFO, mo.addr + oo, todo); + oleft -= todo * 4; +@@ -287,7 +292,8 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq) + * no more than remaining buffer + * no need to test against oleft + */ +- todo = min(mo.length - oo, obl - obo); ++ todo = min_t(size_t, ++ mo.length - oo, obl - obo); + memcpy(mo.addr + oo, bufo + obo, todo); + oleft -= todo; + obo += todo; +diff --git a/drivers/crypto/sunxi-ss/sun4i-ss-hash.c b/drivers/crypto/sunxi-ss/sun4i-ss-hash.c +index f6936bb3b7be..1a724263761b 100644 +--- a/drivers/crypto/sunxi-ss/sun4i-ss-hash.c ++++ b/drivers/crypto/sunxi-ss/sun4i-ss-hash.c +@@ -276,8 +276,8 @@ static int sun4i_hash(struct ahash_request *areq) + */ + while (op->len < 64 && i < end) { + /* how many bytes we can read from current SG */ +- in_r = min3(mi.length - in_i, end - i, +- 64 - op->len); ++ in_r = min(end - i, 64 - op->len); ++ in_r = min_t(size_t, mi.length - in_i, in_r); + memcpy(op->buf + op->len, mi.addr + in_i, in_r); + op->len += in_r; + i += in_r; +@@ -297,8 +297,8 @@ static int sun4i_hash(struct ahash_request *areq) + } + if (mi.length - in_i > 3 && i < end) { + /* how many bytes we can read from current SG */ +- in_r = min3(mi.length - in_i, areq->nbytes - i, +- ((mi.length - in_i) / 4) * 4); ++ in_r = min_t(size_t, mi.length - in_i, areq->nbytes - i); ++ in_r = min_t(size_t, ((mi.length - in_i) / 4) * 4, in_r); + /* how many bytes we can write in the device*/ + todo = min3((u32)(end - i) / 4, rx_cnt, (u32)in_r / 4); + writesl(ss->base + SS_RXFIFO, mi.addr + in_i, todo); +@@ -324,8 +324,8 @@ static int sun4i_hash(struct ahash_request *areq) + if ((areq->nbytes - i) < 64) { + while (i < areq->nbytes && in_i < mi.length && op->len < 64) { + /* how many bytes we can read from current SG */ +- in_r = min3(mi.length - in_i, areq->nbytes - i, +- 64 - op->len); ++ in_r = min(areq->nbytes - i, 64 - op->len); ++ in_r = min_t(size_t, mi.length - in_i, in_r); + memcpy(op->buf + op->len, mi.addr + in_i, in_r); + op->len += in_r; + i += in_r; +diff --git a/drivers/crypto/virtio/virtio_crypto_algs.c b/drivers/crypto/virtio/virtio_crypto_algs.c +index 5035b0dc1e40..e2231a1a05a1 100644 +--- a/drivers/crypto/virtio/virtio_crypto_algs.c ++++ b/drivers/crypto/virtio/virtio_crypto_algs.c +@@ -110,8 +110,6 @@ virtio_crypto_alg_validate_key(int key_len, uint32_t *alg) + *alg = VIRTIO_CRYPTO_CIPHER_AES_CBC; + break; + default: +- pr_err("virtio_crypto: Unsupported key length: %d\n", +- key_len); + return -EINVAL; + } + return 0; +@@ -485,6 +483,11 @@ static int virtio_crypto_ablkcipher_encrypt(struct ablkcipher_request *req) + /* Use the first data virtqueue as default */ + struct data_queue *data_vq = &vcrypto->data_vq[0]; + ++ if (!req->nbytes) ++ return 0; ++ if (req->nbytes % AES_BLOCK_SIZE) ++ return -EINVAL; ++ + vc_req->dataq = data_vq; + vc_req->alg_cb = virtio_crypto_dataq_sym_callback; + vc_sym_req->ablkcipher_ctx = ctx; +@@ -505,6 +508,11 @@ static int virtio_crypto_ablkcipher_decrypt(struct ablkcipher_request *req) + /* Use the first data virtqueue as default */ + struct data_queue *data_vq = &vcrypto->data_vq[0]; + ++ if (!req->nbytes) ++ return 0; ++ if (req->nbytes % AES_BLOCK_SIZE) ++ return -EINVAL; ++ + vc_req->dataq = data_vq; + vc_req->alg_cb = virtio_crypto_dataq_sym_callback; + vc_sym_req->ablkcipher_ctx = ctx; +diff --git a/drivers/crypto/vmx/Makefile b/drivers/crypto/vmx/Makefile +index cab32cfec9c4..709670d2b553 100644 +--- a/drivers/crypto/vmx/Makefile ++++ b/drivers/crypto/vmx/Makefile +@@ -3,13 +3,13 @@ obj-$(CONFIG_CRYPTO_DEV_VMX_ENCRYPT) += vmx-crypto.o + vmx-crypto-objs := vmx.o aesp8-ppc.o ghashp8-ppc.o aes.o aes_cbc.o aes_ctr.o aes_xts.o ghash.o + + ifeq ($(CONFIG_CPU_LITTLE_ENDIAN),y) +-TARGET := linux-ppc64le ++override flavour := linux-ppc64le + else +-TARGET := linux-ppc64 ++override flavour := linux-ppc64 + endif + + quiet_cmd_perl = PERL $@ +- cmd_perl = $(PERL) $(<) $(TARGET) > $(@) ++ cmd_perl = $(PERL) $(<) $(flavour) > $(@) + + targets += aesp8-ppc.S ghashp8-ppc.S + +diff --git a/drivers/edac/ghes_edac.c b/drivers/edac/ghes_edac.c +index 6f80eb65c26c..acae39278669 100644 +--- a/drivers/edac/ghes_edac.c ++++ b/drivers/edac/ghes_edac.c +@@ -187,6 +187,7 @@ void ghes_edac_report_mem_error(struct ghes *ghes, int sev, + /* Cleans the error report buffer */ + memset(e, 0, sizeof (*e)); + e->error_count = 1; ++ e->grain = 1; + strcpy(e->label, "unknown label"); + e->msg = pvt->msg; + e->other_detail = pvt->other_detail; +@@ -282,7 +283,7 @@ void ghes_edac_report_mem_error(struct ghes *ghes, int sev, + + /* Error grain */ + if (mem_err->validation_bits & CPER_MEM_VALID_PA_MASK) +- e->grain = ~(mem_err->physical_addr_mask & ~PAGE_MASK); ++ e->grain = ~mem_err->physical_addr_mask + 1; + + /* Memory error location, mapped on e->location */ + p = e->location; +@@ -389,8 +390,13 @@ void ghes_edac_report_mem_error(struct ghes *ghes, int sev, + if (p > pvt->other_detail) + *(p - 1) = '\0'; + ++ /* Sanity-check driver-supplied grain value. */ ++ if (WARN_ON_ONCE(!e->grain)) ++ e->grain = 1; ++ ++ grain_bits = fls_long(e->grain - 1); ++ + /* Generate the trace event */ +- grain_bits = fls_long(e->grain); + snprintf(pvt->detail_location, sizeof(pvt->detail_location), + "APEI location: %s %s", e->location, e->other_detail); + trace_mc_event(type, e->msg, e->label, e->error_count, +diff --git a/drivers/extcon/extcon-sm5502.c b/drivers/extcon/extcon-sm5502.c +index 106ef0297b53..1a1ee3db3455 100644 +--- a/drivers/extcon/extcon-sm5502.c ++++ b/drivers/extcon/extcon-sm5502.c +@@ -69,6 +69,10 @@ struct sm5502_muic_info { + /* Default value of SM5502 register to bring up MUIC device. */ + static struct reg_data sm5502_reg_data[] = { + { ++ .reg = SM5502_REG_RESET, ++ .val = SM5502_REG_RESET_MASK, ++ .invert = true, ++ }, { + .reg = SM5502_REG_CONTROL, + .val = SM5502_REG_CONTROL_MASK_INT_MASK, + .invert = false, +diff --git a/drivers/extcon/extcon-sm5502.h b/drivers/extcon/extcon-sm5502.h +index 974b53222f56..12f8b01e5753 100644 +--- a/drivers/extcon/extcon-sm5502.h ++++ b/drivers/extcon/extcon-sm5502.h +@@ -241,6 +241,8 @@ enum sm5502_reg { + #define DM_DP_SWITCH_UART ((DM_DP_CON_SWITCH_UART <dvdd10 = devm_regulator_get(dev, "dvdd10"); + if (IS_ERR(pdata->dvdd10)) { +- DRM_ERROR("DVDD10 regulator not found\n"); ++ if (PTR_ERR(pdata->dvdd10) != -EPROBE_DEFER) ++ DRM_ERROR("DVDD10 regulator not found\n"); ++ + return PTR_ERR(pdata->dvdd10); + } + +@@ -1344,7 +1346,9 @@ static int anx78xx_i2c_probe(struct i2c_client *client, + + err = anx78xx_init_pdata(anx78xx); + if (err) { +- DRM_ERROR("Failed to initialize pdata: %d\n", err); ++ if (err != -EPROBE_DEFER) ++ DRM_ERROR("Failed to initialize pdata: %d\n", err); ++ + return err; + } + +diff --git a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c +index 4db31b89507c..cc1094f90125 100644 +--- a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c ++++ b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c +@@ -39,6 +39,7 @@ + + #include + ++#define DDC_CI_ADDR 0x37 + #define DDC_SEGMENT_ADDR 0x30 + + #define HDMI_EDID_LEN 512 +@@ -320,6 +321,15 @@ static int dw_hdmi_i2c_xfer(struct i2c_adapter *adap, + u8 addr = msgs[0].addr; + int i, ret = 0; + ++ if (addr == DDC_CI_ADDR) ++ /* ++ * The internal I2C controller does not support the multi-byte ++ * read and write operations needed for DDC/CI. ++ * TOFIX: Blacklist the DDC/CI address until we filter out ++ * unsupported I2C operations. ++ */ ++ return -EOPNOTSUPP; ++ + dev_dbg(hdmi->dev, "xfer: num: %d, addr: %#x\n", num, addr); + + for (i = 0; i < num; i++) { +@@ -1733,7 +1743,7 @@ static int dw_hdmi_setup(struct dw_hdmi *hdmi, struct drm_display_mode *mode) + + /* HDMI Initialization Step E - Configure audio */ + hdmi_clk_regenerator_update_pixel_clock(hdmi); +- hdmi_enable_audio_clk(hdmi, true); ++ hdmi_enable_audio_clk(hdmi, hdmi->audio_enable); + } + + /* not for DVI mode */ +diff --git a/drivers/gpu/drm/gma500/oaktrail_crtc.c b/drivers/gpu/drm/gma500/oaktrail_crtc.c +index 0fff269d3fe6..42785f3df60f 100644 +--- a/drivers/gpu/drm/gma500/oaktrail_crtc.c ++++ b/drivers/gpu/drm/gma500/oaktrail_crtc.c +@@ -139,6 +139,7 @@ static bool mrst_sdvo_find_best_pll(const struct gma_limit_t *limit, + s32 freq_error, min_error = 100000; + + memset(best_clock, 0, sizeof(*best_clock)); ++ memset(&clock, 0, sizeof(clock)); + + for (clock.m = limit->m.min; clock.m <= limit->m.max; clock.m++) { + for (clock.n = limit->n.min; clock.n <= limit->n.max; +@@ -195,6 +196,7 @@ static bool mrst_lvds_find_best_pll(const struct gma_limit_t *limit, + int err = target; + + memset(best_clock, 0, sizeof(*best_clock)); ++ memset(&clock, 0, sizeof(clock)); + + for (clock.m = limit->m.min; clock.m <= limit->m.max; clock.m++) { + for (clock.p1 = limit->p1.min; clock.p1 <= limit->p1.max; +diff --git a/drivers/gpu/host1x/job.c b/drivers/gpu/host1x/job.c +index acd99783bbca..67f3c050c4cf 100644 +--- a/drivers/gpu/host1x/job.c ++++ b/drivers/gpu/host1x/job.c +@@ -545,7 +545,8 @@ out: + return err; + } + +-static inline int copy_gathers(struct host1x_job *job, struct device *dev) ++static inline int copy_gathers(struct device *host, struct host1x_job *job, ++ struct device *dev) + { + struct host1x_firewall fw; + size_t size = 0; +@@ -570,12 +571,12 @@ static inline int copy_gathers(struct host1x_job *job, struct device *dev) + * Try a non-blocking allocation from a higher priority pools first, + * as awaiting for the allocation here is a major performance hit. + */ +- job->gather_copy_mapped = dma_alloc_wc(dev, size, &job->gather_copy, ++ job->gather_copy_mapped = dma_alloc_wc(host, size, &job->gather_copy, + GFP_NOWAIT); + + /* the higher priority allocation failed, try the generic-blocking */ + if (!job->gather_copy_mapped) +- job->gather_copy_mapped = dma_alloc_wc(dev, size, ++ job->gather_copy_mapped = dma_alloc_wc(host, size, + &job->gather_copy, + GFP_KERNEL); + if (!job->gather_copy_mapped) +@@ -636,7 +637,7 @@ int host1x_job_pin(struct host1x_job *job, struct device *dev) + goto out; + + if (IS_ENABLED(CONFIG_TEGRA_HOST1X_FIREWALL)) { +- err = copy_gathers(job, dev); ++ err = copy_gathers(host->dev, job, dev); + if (err) + goto out; + } +@@ -701,7 +702,7 @@ void host1x_job_unpin(struct host1x_job *job) + job->num_unpins = 0; + + if (job->gather_copy_size) +- dma_free_wc(job->channel->dev, job->gather_copy_size, ++ dma_free_wc(host->dev, job->gather_copy_size, + job->gather_copy_mapped, job->gather_copy); + } + EXPORT_SYMBOL(host1x_job_unpin); +diff --git a/drivers/hwtracing/intel_th/pci.c b/drivers/hwtracing/intel_th/pci.c +index c224b92a80f1..fc371444407d 100644 +--- a/drivers/hwtracing/intel_th/pci.c ++++ b/drivers/hwtracing/intel_th/pci.c +@@ -188,6 +188,11 @@ static const struct pci_device_id intel_th_pci_id_table[] = { + PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x06a6), + .driver_data = (kernel_ulong_t)&intel_th_2x, + }, ++ { ++ /* Comet Lake PCH-V */ ++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xa3a6), ++ .driver_data = (kernel_ulong_t)&intel_th_2x, ++ }, + { + /* Ice Lake NNPI */ + PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x45c5), +@@ -213,6 +218,11 @@ static const struct pci_device_id intel_th_pci_id_table[] = { + PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x4da6), + .driver_data = (kernel_ulong_t)&intel_th_2x, + }, ++ { ++ /* Elkhart Lake */ ++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x4b26), ++ .driver_data = (kernel_ulong_t)&intel_th_2x, ++ }, + { 0 }, + }; + +diff --git a/drivers/iio/adc/dln2-adc.c b/drivers/iio/adc/dln2-adc.c +index ab8d6aed5085..2a299bbd6acf 100644 +--- a/drivers/iio/adc/dln2-adc.c ++++ b/drivers/iio/adc/dln2-adc.c +@@ -528,6 +528,10 @@ static int dln2_adc_triggered_buffer_postenable(struct iio_dev *indio_dev) + u16 conflict; + unsigned int trigger_chan; + ++ ret = iio_triggered_buffer_postenable(indio_dev); ++ if (ret) ++ return ret; ++ + mutex_lock(&dln2->mutex); + + /* Enable ADC */ +@@ -541,6 +545,7 @@ static int dln2_adc_triggered_buffer_postenable(struct iio_dev *indio_dev) + (int)conflict); + ret = -EBUSY; + } ++ iio_triggered_buffer_predisable(indio_dev); + return ret; + } + +@@ -554,6 +559,7 @@ static int dln2_adc_triggered_buffer_postenable(struct iio_dev *indio_dev) + mutex_unlock(&dln2->mutex); + if (ret < 0) { + dev_dbg(&dln2->pdev->dev, "Problem in %s\n", __func__); ++ iio_triggered_buffer_predisable(indio_dev); + return ret; + } + } else { +@@ -561,12 +567,12 @@ static int dln2_adc_triggered_buffer_postenable(struct iio_dev *indio_dev) + mutex_unlock(&dln2->mutex); + } + +- return iio_triggered_buffer_postenable(indio_dev); ++ return 0; + } + + static int dln2_adc_triggered_buffer_predisable(struct iio_dev *indio_dev) + { +- int ret; ++ int ret, ret2; + struct dln2_adc *dln2 = iio_priv(indio_dev); + + mutex_lock(&dln2->mutex); +@@ -581,12 +587,14 @@ static int dln2_adc_triggered_buffer_predisable(struct iio_dev *indio_dev) + ret = dln2_adc_set_port_enabled(dln2, false, NULL); + + mutex_unlock(&dln2->mutex); +- if (ret < 0) { ++ if (ret < 0) + dev_dbg(&dln2->pdev->dev, "Problem in %s\n", __func__); +- return ret; +- } + +- return iio_triggered_buffer_predisable(indio_dev); ++ ret2 = iio_triggered_buffer_predisable(indio_dev); ++ if (ret == 0) ++ ret = ret2; ++ ++ return ret; + } + + static const struct iio_buffer_setup_ops dln2_adc_buffer_setup_ops = { +diff --git a/drivers/iio/adc/max1027.c b/drivers/iio/adc/max1027.c +index ebc715927e63..03af02769370 100644 +--- a/drivers/iio/adc/max1027.c ++++ b/drivers/iio/adc/max1027.c +@@ -462,6 +462,14 @@ static int max1027_probe(struct spi_device *spi) + goto fail_dev_register; + } + ++ /* Internal reset */ ++ st->reg = MAX1027_RST_REG; ++ ret = spi_write(st->spi, &st->reg, 1); ++ if (ret < 0) { ++ dev_err(&indio_dev->dev, "Failed to reset the ADC\n"); ++ return ret; ++ } ++ + /* Disable averaging */ + st->reg = MAX1027_AVG_REG; + ret = spi_write(st->spi, &st->reg, 1); +diff --git a/drivers/iio/light/bh1750.c b/drivers/iio/light/bh1750.c +index 6c61187e630f..0b7ba02c8d16 100644 +--- a/drivers/iio/light/bh1750.c ++++ b/drivers/iio/light/bh1750.c +@@ -62,9 +62,9 @@ struct bh1750_chip_info { + + u16 int_time_low_mask; + u16 int_time_high_mask; +-} ++}; + +-static const bh1750_chip_info_tbl[] = { ++static const struct bh1750_chip_info bh1750_chip_info_tbl[] = { + [BH1710] = { 140, 1022, 300, 400, 250000000, 2, 0x001F, 0x03E0 }, + [BH1721] = { 140, 1020, 300, 400, 250000000, 2, 0x0010, 0x03E0 }, + [BH1750] = { 31, 254, 69, 1740, 57500000, 1, 0x001F, 0x00E0 }, +diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c +index 7f4cc9336442..656e7c1a4449 100644 +--- a/drivers/infiniband/hw/qedr/verbs.c ++++ b/drivers/infiniband/hw/qedr/verbs.c +@@ -1343,6 +1343,14 @@ static void qedr_cleanup_user(struct qedr_dev *dev, struct qedr_qp *qp) + if (qp->urq.umem) + ib_umem_release(qp->urq.umem); + qp->urq.umem = NULL; ++ ++ if (rdma_protocol_roce(&dev->ibdev, 1)) { ++ qedr_free_pbl(dev, &qp->usq.pbl_info, qp->usq.pbl_tbl); ++ qedr_free_pbl(dev, &qp->urq.pbl_info, qp->urq.pbl_tbl); ++ } else { ++ kfree(qp->usq.pbl_tbl); ++ kfree(qp->urq.pbl_tbl); ++ } + } + + static int qedr_create_user_qp(struct qedr_dev *dev, +@@ -2331,8 +2339,8 @@ int qedr_dereg_mr(struct ib_mr *ib_mr) + + dev->ops->rdma_free_tid(dev->rdma_ctx, mr->hw_mr.itid); + +- if ((mr->type != QEDR_MR_DMA) && (mr->type != QEDR_MR_FRMR)) +- qedr_free_pbl(dev, &mr->info.pbl_info, mr->info.pbl_table); ++ if (mr->type != QEDR_MR_DMA) ++ free_mr_info(dev, &mr->info); + + /* it could be user registered memory. */ + if (mr->umem) +diff --git a/drivers/infiniband/ulp/iser/iscsi_iser.c b/drivers/infiniband/ulp/iser/iscsi_iser.c +index 19624e023ebd..b5a789567b4e 100644 +--- a/drivers/infiniband/ulp/iser/iscsi_iser.c ++++ b/drivers/infiniband/ulp/iser/iscsi_iser.c +@@ -648,6 +648,7 @@ iscsi_iser_session_create(struct iscsi_endpoint *ep, + if (ib_conn->pi_support) { + u32 sig_caps = ib_conn->device->ib_device->attrs.sig_prot_cap; + ++ shost->sg_prot_tablesize = shost->sg_tablesize; + scsi_host_set_prot(shost, iser_dif_prot_caps(sig_caps)); + scsi_host_set_guard(shost, SHOST_DIX_GUARD_IP | + SHOST_DIX_GUARD_CRC); +diff --git a/drivers/media/i2c/ov2659.c b/drivers/media/i2c/ov2659.c +index ce23f436e130..44b0584eb8a6 100644 +--- a/drivers/media/i2c/ov2659.c ++++ b/drivers/media/i2c/ov2659.c +@@ -419,10 +419,14 @@ static struct sensor_register ov2659_720p[] = { + { REG_TIMING_YINC, 0x11 }, + { REG_TIMING_VERT_FORMAT, 0x80 }, + { REG_TIMING_HORIZ_FORMAT, 0x00 }, ++ { 0x370a, 0x12 }, + { 0x3a03, 0xe8 }, + { 0x3a09, 0x6f }, + { 0x3a0b, 0x5d }, + { 0x3a15, 0x9a }, ++ { REG_VFIFO_READ_START_H, 0x00 }, ++ { REG_VFIFO_READ_START_L, 0x80 }, ++ { REG_ISP_CTRL02, 0x00 }, + { REG_NULL, 0x00 }, + }; + +@@ -1203,11 +1207,15 @@ static int ov2659_s_stream(struct v4l2_subdev *sd, int on) + goto unlock; + } + +- ov2659_set_pixel_clock(ov2659); +- ov2659_set_frame_size(ov2659); +- ov2659_set_format(ov2659); +- ov2659_set_streaming(ov2659, 1); +- ov2659->streaming = on; ++ ret = ov2659_set_pixel_clock(ov2659); ++ if (!ret) ++ ret = ov2659_set_frame_size(ov2659); ++ if (!ret) ++ ret = ov2659_set_format(ov2659); ++ if (!ret) { ++ ov2659_set_streaming(ov2659, 1); ++ ov2659->streaming = on; ++ } + + unlock: + mutex_unlock(&ov2659->lock); +diff --git a/drivers/media/i2c/ov6650.c b/drivers/media/i2c/ov6650.c +index 025869eec2ac..348296be4925 100644 +--- a/drivers/media/i2c/ov6650.c ++++ b/drivers/media/i2c/ov6650.c +@@ -469,38 +469,39 @@ static int ov6650_set_selection(struct v4l2_subdev *sd, + { + struct i2c_client *client = v4l2_get_subdevdata(sd); + struct ov6650 *priv = to_ov6650(client); +- struct v4l2_rect rect = sel->r; + int ret; + + if (sel->which != V4L2_SUBDEV_FORMAT_ACTIVE || + sel->target != V4L2_SEL_TGT_CROP) + return -EINVAL; + +- v4l_bound_align_image(&rect.width, 2, W_CIF, 1, +- &rect.height, 2, H_CIF, 1, 0); +- v4l_bound_align_image(&rect.left, DEF_HSTRT << 1, +- (DEF_HSTRT << 1) + W_CIF - (__s32)rect.width, 1, +- &rect.top, DEF_VSTRT << 1, +- (DEF_VSTRT << 1) + H_CIF - (__s32)rect.height, 1, +- 0); ++ v4l_bound_align_image(&sel->r.width, 2, W_CIF, 1, ++ &sel->r.height, 2, H_CIF, 1, 0); ++ v4l_bound_align_image(&sel->r.left, DEF_HSTRT << 1, ++ (DEF_HSTRT << 1) + W_CIF - (__s32)sel->r.width, 1, ++ &sel->r.top, DEF_VSTRT << 1, ++ (DEF_VSTRT << 1) + H_CIF - (__s32)sel->r.height, ++ 1, 0); + +- ret = ov6650_reg_write(client, REG_HSTRT, rect.left >> 1); ++ ret = ov6650_reg_write(client, REG_HSTRT, sel->r.left >> 1); + if (!ret) { +- priv->rect.left = rect.left; ++ priv->rect.width += priv->rect.left - sel->r.left; ++ priv->rect.left = sel->r.left; + ret = ov6650_reg_write(client, REG_HSTOP, +- (rect.left + rect.width) >> 1); ++ (sel->r.left + sel->r.width) >> 1); + } + if (!ret) { +- priv->rect.width = rect.width; +- ret = ov6650_reg_write(client, REG_VSTRT, rect.top >> 1); ++ priv->rect.width = sel->r.width; ++ ret = ov6650_reg_write(client, REG_VSTRT, sel->r.top >> 1); + } + if (!ret) { +- priv->rect.top = rect.top; ++ priv->rect.height += priv->rect.top - sel->r.top; ++ priv->rect.top = sel->r.top; + ret = ov6650_reg_write(client, REG_VSTOP, +- (rect.top + rect.height) >> 1); ++ (sel->r.top + sel->r.height) >> 1); + } + if (!ret) +- priv->rect.height = rect.height; ++ priv->rect.height = sel->r.height; + + return ret; + } +@@ -614,7 +615,6 @@ static int ov6650_s_fmt(struct v4l2_subdev *sd, struct v4l2_mbus_framefmt *mf) + dev_err(&client->dev, "Pixel format not handled: 0x%x\n", code); + return -EINVAL; + } +- priv->code = code; + + if (code == MEDIA_BUS_FMT_Y8_1X8 || + code == MEDIA_BUS_FMT_SBGGR8_1X8) { +@@ -640,7 +640,6 @@ static int ov6650_s_fmt(struct v4l2_subdev *sd, struct v4l2_mbus_framefmt *mf) + dev_dbg(&client->dev, "max resolution: CIF\n"); + coma_mask |= COMA_QCIF; + } +- priv->half_scale = half_scale; + + clkrc = CLKRC_12MHz; + mclk = 12000000; +@@ -658,8 +657,13 @@ static int ov6650_s_fmt(struct v4l2_subdev *sd, struct v4l2_mbus_framefmt *mf) + ret = ov6650_reg_rmw(client, REG_COMA, coma_set, coma_mask); + if (!ret) + ret = ov6650_reg_write(client, REG_CLKRC, clkrc); +- if (!ret) ++ if (!ret) { ++ priv->half_scale = half_scale; ++ + ret = ov6650_reg_rmw(client, REG_COML, coml_set, coml_mask); ++ } ++ if (!ret) ++ priv->code = code; + + if (!ret) { + mf->colorspace = priv->colorspace; +diff --git a/drivers/media/pci/cx88/cx88-video.c b/drivers/media/pci/cx88/cx88-video.c +index 7d25ecd4404b..1748812bd7e5 100644 +--- a/drivers/media/pci/cx88/cx88-video.c ++++ b/drivers/media/pci/cx88/cx88-video.c +@@ -1310,7 +1310,7 @@ static int cx8800_initdev(struct pci_dev *pci_dev, + core = cx88_core_get(dev->pci); + if (!core) { + err = -EINVAL; +- goto fail_free; ++ goto fail_disable; + } + dev->core = core; + +@@ -1356,7 +1356,7 @@ static int cx8800_initdev(struct pci_dev *pci_dev, + cc->step, cc->default_value); + if (!vc) { + err = core->audio_hdl.error; +- goto fail_core; ++ goto fail_irq; + } + vc->priv = (void *)cc; + } +@@ -1370,7 +1370,7 @@ static int cx8800_initdev(struct pci_dev *pci_dev, + cc->step, cc->default_value); + if (!vc) { + err = core->video_hdl.error; +- goto fail_core; ++ goto fail_irq; + } + vc->priv = (void *)cc; + if (vc->id == V4L2_CID_CHROMA_AGC) +@@ -1533,11 +1533,14 @@ static int cx8800_initdev(struct pci_dev *pci_dev, + + fail_unreg: + cx8800_unregister_video(dev); +- free_irq(pci_dev->irq, dev); + mutex_unlock(&core->lock); ++fail_irq: ++ free_irq(pci_dev->irq, dev); + fail_core: + core->v4ldev = NULL; + cx88_core_put(core, dev->pci); ++fail_disable: ++ pci_disable_device(pci_dev); + fail_free: + kfree(dev); + return err; +diff --git a/drivers/media/platform/am437x/am437x-vpfe.c b/drivers/media/platform/am437x/am437x-vpfe.c +index dfcc484cab89..e92c5b56be42 100644 +--- a/drivers/media/platform/am437x/am437x-vpfe.c ++++ b/drivers/media/platform/am437x/am437x-vpfe.c +@@ -1848,6 +1848,10 @@ static int vpfe_s_std(struct file *file, void *priv, v4l2_std_id std_id) + if (!(sdinfo->inputs[0].capabilities & V4L2_IN_CAP_STD)) + return -ENODATA; + ++ /* if trying to set the same std then nothing to do */ ++ if (vpfe_standards[vpfe->std_index].std_id == std_id) ++ return 0; ++ + /* If streaming is started, return error */ + if (vb2_is_busy(&vpfe->buffer_queue)) { + vpfe_err(vpfe, "%s device busy\n", __func__); +diff --git a/drivers/media/platform/qcom/venus/core.c b/drivers/media/platform/qcom/venus/core.c +index 769e9e68562d..9360b36b82cd 100644 +--- a/drivers/media/platform/qcom/venus/core.c ++++ b/drivers/media/platform/qcom/venus/core.c +@@ -345,10 +345,11 @@ static const struct venus_resources msm8916_res = { + }; + + static const struct freq_tbl msm8996_freq_table[] = { +- { 1944000, 490000000 }, /* 4k UHD @ 60 */ +- { 972000, 320000000 }, /* 4k UHD @ 30 */ +- { 489600, 150000000 }, /* 1080p @ 60 */ +- { 244800, 75000000 }, /* 1080p @ 30 */ ++ { 1944000, 520000000 }, /* 4k UHD @ 60 (decode only) */ ++ { 972000, 520000000 }, /* 4k UHD @ 30 */ ++ { 489600, 346666667 }, /* 1080p @ 60 */ ++ { 244800, 150000000 }, /* 1080p @ 30 */ ++ { 108000, 75000000 }, /* 720p @ 30 */ + }; + + static const struct reg_val msm8996_reg_preset[] = { +diff --git a/drivers/media/platform/rcar_drif.c b/drivers/media/platform/rcar_drif.c +index 522364ff0d5d..3871ed6a1fcb 100644 +--- a/drivers/media/platform/rcar_drif.c ++++ b/drivers/media/platform/rcar_drif.c +@@ -915,6 +915,7 @@ static int rcar_drif_g_fmt_sdr_cap(struct file *file, void *priv, + { + struct rcar_drif_sdr *sdr = video_drvdata(file); + ++ memset(f->fmt.sdr.reserved, 0, sizeof(f->fmt.sdr.reserved)); + f->fmt.sdr.pixelformat = sdr->fmt->pixelformat; + f->fmt.sdr.buffersize = sdr->fmt->buffersize; + +diff --git a/drivers/media/platform/ti-vpe/vpdma.h b/drivers/media/platform/ti-vpe/vpdma.h +index 7e611501c291..f29074c84915 100644 +--- a/drivers/media/platform/ti-vpe/vpdma.h ++++ b/drivers/media/platform/ti-vpe/vpdma.h +@@ -60,6 +60,7 @@ struct vpdma_data_format { + * line stride of source and dest + * buffers should be 16 byte aligned + */ ++#define VPDMA_MAX_STRIDE 65520 /* Max line stride 16 byte aligned */ + #define VPDMA_DTD_DESC_SIZE 32 /* 8 words */ + #define VPDMA_CFD_CTD_DESC_SIZE 16 /* 4 words */ + +diff --git a/drivers/media/platform/ti-vpe/vpe.c b/drivers/media/platform/ti-vpe/vpe.c +index 45bd10544189..2e8970c7e22d 100644 +--- a/drivers/media/platform/ti-vpe/vpe.c ++++ b/drivers/media/platform/ti-vpe/vpe.c +@@ -352,20 +352,25 @@ enum { + }; + + /* find our format description corresponding to the passed v4l2_format */ +-static struct vpe_fmt *find_format(struct v4l2_format *f) ++static struct vpe_fmt *__find_format(u32 fourcc) + { + struct vpe_fmt *fmt; + unsigned int k; + + for (k = 0; k < ARRAY_SIZE(vpe_formats); k++) { + fmt = &vpe_formats[k]; +- if (fmt->fourcc == f->fmt.pix.pixelformat) ++ if (fmt->fourcc == fourcc) + return fmt; + } + + return NULL; + } + ++static struct vpe_fmt *find_format(struct v4l2_format *f) ++{ ++ return __find_format(f->fmt.pix.pixelformat); ++} ++ + /* + * there is one vpe_dev structure in the driver, it is shared by + * all instances. +@@ -1044,11 +1049,14 @@ static void add_out_dtd(struct vpe_ctx *ctx, int port) + dma_addr_t dma_addr; + u32 flags = 0; + u32 offset = 0; ++ u32 stride; + + if (port == VPE_PORT_MV_OUT) { + vpdma_fmt = &vpdma_misc_fmts[VPDMA_DATA_FMT_MV]; + dma_addr = ctx->mv_buf_dma[mv_buf_selector]; + q_data = &ctx->q_data[Q_DATA_SRC]; ++ stride = ALIGN((q_data->width * vpdma_fmt->depth) >> 3, ++ VPDMA_STRIDE_ALIGN); + } else { + /* to incorporate interleaved formats */ + int plane = fmt->coplanar ? p_data->vb_part : 0; +@@ -1075,6 +1083,7 @@ static void add_out_dtd(struct vpe_ctx *ctx, int port) + } + /* Apply the offset */ + dma_addr += offset; ++ stride = q_data->bytesperline[VPE_LUMA]; + } + + if (q_data->flags & Q_DATA_FRAME_1D) +@@ -1086,7 +1095,7 @@ static void add_out_dtd(struct vpe_ctx *ctx, int port) + MAX_W, MAX_H); + + vpdma_add_out_dtd(&ctx->desc_list, q_data->width, +- q_data->bytesperline[VPE_LUMA], &q_data->c_rect, ++ stride, &q_data->c_rect, + vpdma_fmt, dma_addr, MAX_OUT_WIDTH_REG1, + MAX_OUT_HEIGHT_REG1, p_data->channel, flags); + } +@@ -1105,10 +1114,13 @@ static void add_in_dtd(struct vpe_ctx *ctx, int port) + dma_addr_t dma_addr; + u32 flags = 0; + u32 offset = 0; ++ u32 stride; + + if (port == VPE_PORT_MV_IN) { + vpdma_fmt = &vpdma_misc_fmts[VPDMA_DATA_FMT_MV]; + dma_addr = ctx->mv_buf_dma[mv_buf_selector]; ++ stride = ALIGN((q_data->width * vpdma_fmt->depth) >> 3, ++ VPDMA_STRIDE_ALIGN); + } else { + /* to incorporate interleaved formats */ + int plane = fmt->coplanar ? p_data->vb_part : 0; +@@ -1135,6 +1147,7 @@ static void add_in_dtd(struct vpe_ctx *ctx, int port) + } + /* Apply the offset */ + dma_addr += offset; ++ stride = q_data->bytesperline[VPE_LUMA]; + + if (q_data->flags & Q_DATA_INTERLACED_SEQ_TB) { + /* +@@ -1170,10 +1183,10 @@ static void add_in_dtd(struct vpe_ctx *ctx, int port) + if (p_data->vb_part && fmt->fourcc == V4L2_PIX_FMT_NV12) + frame_height /= 2; + +- vpdma_add_in_dtd(&ctx->desc_list, q_data->width, +- q_data->bytesperline[VPE_LUMA], &q_data->c_rect, +- vpdma_fmt, dma_addr, p_data->channel, field, flags, frame_width, +- frame_height, 0, 0); ++ vpdma_add_in_dtd(&ctx->desc_list, q_data->width, stride, ++ &q_data->c_rect, vpdma_fmt, dma_addr, ++ p_data->channel, field, flags, frame_width, ++ frame_height, 0, 0); + } + + /* +@@ -1422,9 +1435,6 @@ static irqreturn_t vpe_irq(int irq_vpe, void *data) + /* the previous dst mv buffer becomes the next src mv buffer */ + ctx->src_mv_buf_selector = !ctx->src_mv_buf_selector; + +- if (ctx->aborting) +- goto finished; +- + s_vb = ctx->src_vbs[0]; + d_vb = ctx->dst_vb; + +@@ -1435,6 +1445,7 @@ static irqreturn_t vpe_irq(int irq_vpe, void *data) + d_vb->timecode = s_vb->timecode; + + d_vb->sequence = ctx->sequence; ++ s_vb->sequence = ctx->sequence; + + d_q_data = &ctx->q_data[Q_DATA_DST]; + if (d_q_data->flags & Q_IS_INTERLACED) { +@@ -1488,6 +1499,9 @@ static irqreturn_t vpe_irq(int irq_vpe, void *data) + ctx->src_vbs[0] = NULL; + ctx->dst_vb = NULL; + ++ if (ctx->aborting) ++ goto finished; ++ + ctx->bufs_completed++; + if (ctx->bufs_completed < ctx->bufs_per_job && job_ready(ctx)) { + device_run(ctx); +@@ -1600,9 +1614,9 @@ static int __vpe_try_fmt(struct vpe_ctx *ctx, struct v4l2_format *f, + unsigned int stride = 0; + + if (!fmt || !(fmt->types & type)) { +- vpe_err(ctx->dev, "Fourcc format (0x%08x) invalid.\n", ++ vpe_dbg(ctx->dev, "Fourcc format (0x%08x) invalid.\n", + pix->pixelformat); +- return -EINVAL; ++ fmt = __find_format(V4L2_PIX_FMT_YUYV); + } + + if (pix->field != V4L2_FIELD_NONE && pix->field != V4L2_FIELD_ALTERNATE +@@ -1649,7 +1663,7 @@ static int __vpe_try_fmt(struct vpe_ctx *ctx, struct v4l2_format *f, + &pix->height, MIN_H, MAX_H, H_ALIGN, + S_ALIGN); + +- if (!pix->num_planes) ++ if (!pix->num_planes || pix->num_planes > 2) + pix->num_planes = fmt->coplanar ? 2 : 1; + else if (pix->num_planes > 1 && !fmt->coplanar) + pix->num_planes = 1; +@@ -1688,6 +1702,10 @@ static int __vpe_try_fmt(struct vpe_ctx *ctx, struct v4l2_format *f, + if (stride > plane_fmt->bytesperline) + plane_fmt->bytesperline = stride; + ++ plane_fmt->bytesperline = clamp_t(u32, plane_fmt->bytesperline, ++ stride, ++ VPDMA_MAX_STRIDE); ++ + plane_fmt->bytesperline = ALIGN(plane_fmt->bytesperline, + VPDMA_STRIDE_ALIGN); + +@@ -2308,7 +2326,7 @@ static int vpe_open(struct file *file) + v4l2_ctrl_handler_setup(hdl); + + s_q_data = &ctx->q_data[Q_DATA_SRC]; +- s_q_data->fmt = &vpe_formats[2]; ++ s_q_data->fmt = __find_format(V4L2_PIX_FMT_YUYV); + s_q_data->width = 1920; + s_q_data->height = 1080; + s_q_data->nplanes = 1; +@@ -2386,6 +2404,12 @@ static int vpe_release(struct file *file) + + mutex_lock(&dev->dev_mutex); + free_mv_buffers(ctx); ++ ++ vpdma_unmap_desc_buf(dev->vpdma, &ctx->desc_list.buf); ++ vpdma_unmap_desc_buf(dev->vpdma, &ctx->mmr_adb); ++ vpdma_unmap_desc_buf(dev->vpdma, &ctx->sc_coeff_h); ++ vpdma_unmap_desc_buf(dev->vpdma, &ctx->sc_coeff_v); ++ + vpdma_free_desc_list(&ctx->desc_list); + vpdma_free_desc_buf(&ctx->mmr_adb); + +diff --git a/drivers/media/radio/si470x/radio-si470x-i2c.c b/drivers/media/radio/si470x/radio-si470x-i2c.c +index 8ce6f9cff746..b60fb6ed5aeb 100644 +--- a/drivers/media/radio/si470x/radio-si470x-i2c.c ++++ b/drivers/media/radio/si470x/radio-si470x-i2c.c +@@ -455,6 +455,8 @@ static int si470x_i2c_remove(struct i2c_client *client) + video_unregister_device(&radio->videodev); + kfree(radio); + ++ v4l2_ctrl_handler_free(&radio->hdl); ++ v4l2_device_unregister(&radio->v4l2_dev); + return 0; + } + +diff --git a/drivers/media/usb/b2c2/flexcop-usb.c b/drivers/media/usb/b2c2/flexcop-usb.c +index ac4fddfd0a43..f1807c16438d 100644 +--- a/drivers/media/usb/b2c2/flexcop-usb.c ++++ b/drivers/media/usb/b2c2/flexcop-usb.c +@@ -503,7 +503,13 @@ urb_error: + static int flexcop_usb_init(struct flexcop_usb *fc_usb) + { + /* use the alternate setting with the larges buffer */ +- usb_set_interface(fc_usb->udev,0,1); ++ int ret = usb_set_interface(fc_usb->udev, 0, 1); ++ ++ if (ret) { ++ err("set interface failed."); ++ return ret; ++ } ++ + switch (fc_usb->udev->speed) { + case USB_SPEED_LOW: + err("cannot handle USB speed because it is too slow."); +diff --git a/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c b/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c +index 4320bda9352d..e0413db26781 100644 +--- a/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c ++++ b/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c +@@ -915,8 +915,12 @@ static void pvr2_v4l2_internal_check(struct pvr2_channel *chp) + pvr2_v4l2_dev_disassociate_parent(vp->dev_video); + pvr2_v4l2_dev_disassociate_parent(vp->dev_radio); + if (!list_empty(&vp->dev_video->devbase.fh_list) || +- !list_empty(&vp->dev_radio->devbase.fh_list)) ++ (vp->dev_radio && ++ !list_empty(&vp->dev_radio->devbase.fh_list))) { ++ pvr2_trace(PVR2_TRACE_STRUCT, ++ "pvr2_v4l2 internal_check exit-empty id=%p", vp); + return; ++ } + pvr2_v4l2_destroy_no_lock(vp); + } + +@@ -990,7 +994,8 @@ static int pvr2_v4l2_release(struct file *file) + kfree(fhp); + if (vp->channel.mc_head->disconnect_flag && + list_empty(&vp->dev_video->devbase.fh_list) && +- list_empty(&vp->dev_radio->devbase.fh_list)) { ++ (!vp->dev_radio || ++ list_empty(&vp->dev_radio->devbase.fh_list))) { + pvr2_v4l2_destroy_no_lock(vp); + } + return 0; +diff --git a/drivers/media/v4l2-core/v4l2-ioctl.c b/drivers/media/v4l2-core/v4l2-ioctl.c +index 681eef972e63..7cafc8a57950 100644 +--- a/drivers/media/v4l2-core/v4l2-ioctl.c ++++ b/drivers/media/v4l2-core/v4l2-ioctl.c +@@ -1363,10 +1363,26 @@ static int v4l_enum_fmt(const struct v4l2_ioctl_ops *ops, + return ret; + } + ++static void v4l_pix_format_touch(struct v4l2_pix_format *p) ++{ ++ /* ++ * The v4l2_pix_format structure contains fields that make no sense for ++ * touch. Set them to default values in this case. ++ */ ++ ++ p->field = V4L2_FIELD_NONE; ++ p->colorspace = V4L2_COLORSPACE_RAW; ++ p->flags = 0; ++ p->ycbcr_enc = 0; ++ p->quantization = 0; ++ p->xfer_func = 0; ++} ++ + static int v4l_g_fmt(const struct v4l2_ioctl_ops *ops, + struct file *file, void *fh, void *arg) + { + struct v4l2_format *p = arg; ++ struct video_device *vfd = video_devdata(file); + int ret = check_fmt(file, p->type); + + if (ret) +@@ -1404,6 +1420,8 @@ static int v4l_g_fmt(const struct v4l2_ioctl_ops *ops, + ret = ops->vidioc_g_fmt_vid_cap(file, fh, arg); + /* just in case the driver zeroed it again */ + p->fmt.pix.priv = V4L2_PIX_FMT_PRIV_MAGIC; ++ if (vfd->vfl_type == VFL_TYPE_TOUCH) ++ v4l_pix_format_touch(&p->fmt.pix); + return ret; + case V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE: + return ops->vidioc_g_fmt_vid_cap_mplane(file, fh, arg); +@@ -1439,21 +1457,6 @@ static int v4l_g_fmt(const struct v4l2_ioctl_ops *ops, + return -EINVAL; + } + +-static void v4l_pix_format_touch(struct v4l2_pix_format *p) +-{ +- /* +- * The v4l2_pix_format structure contains fields that make no sense for +- * touch. Set them to default values in this case. +- */ +- +- p->field = V4L2_FIELD_NONE; +- p->colorspace = V4L2_COLORSPACE_RAW; +- p->flags = 0; +- p->ycbcr_enc = 0; +- p->quantization = 0; +- p->xfer_func = 0; +-} +- + static int v4l_s_fmt(const struct v4l2_ioctl_ops *ops, + struct file *file, void *fh, void *arg) + { +diff --git a/drivers/mmc/host/mtk-sd.c b/drivers/mmc/host/mtk-sd.c +index a2ac9938d945..1a5d5c40324b 100644 +--- a/drivers/mmc/host/mtk-sd.c ++++ b/drivers/mmc/host/mtk-sd.c +@@ -212,6 +212,8 @@ + #define MSDC_PATCH_BIT_SPCPUSH (0x1 << 29) /* RW */ + #define MSDC_PATCH_BIT_DECRCTMO (0x1 << 30) /* RW */ + ++#define MSDC_PATCH_BIT1_CMDTA (0x7 << 3) /* RW */ ++ + #define MSDC_PAD_TUNE_DATWRDLY (0x1f << 0) /* RW */ + #define MSDC_PAD_TUNE_DATRRDLY (0x1f << 8) /* RW */ + #define MSDC_PAD_TUNE_CMDRDLY (0x1f << 16) /* RW */ +@@ -1442,6 +1444,7 @@ static int hs400_tune_response(struct mmc_host *mmc, u32 opcode) + + /* select EMMC50 PAD CMD tune */ + sdr_set_bits(host->base + PAD_CMD_TUNE, BIT(0)); ++ sdr_set_field(host->base + MSDC_PATCH_BIT1, MSDC_PATCH_BIT1_CMDTA, 2); + + if (mmc->ios.timing == MMC_TIMING_MMC_HS200 || + mmc->ios.timing == MMC_TIMING_UHS_SDR104) +diff --git a/drivers/mmc/host/sdhci-of-esdhc.c b/drivers/mmc/host/sdhci-of-esdhc.c +index 176cbc67d08a..9a1ab39ee35e 100644 +--- a/drivers/mmc/host/sdhci-of-esdhc.c ++++ b/drivers/mmc/host/sdhci-of-esdhc.c +@@ -615,9 +615,6 @@ static void esdhc_reset(struct sdhci_host *host, u8 mask) + sdhci_writel(host, host->ier, SDHCI_INT_ENABLE); + sdhci_writel(host, host->ier, SDHCI_SIGNAL_ENABLE); + +- if (of_find_compatible_node(NULL, NULL, "fsl,p2020-esdhc")) +- mdelay(5); +- + if (mask & SDHCI_RESET_ALL) { + val = sdhci_readl(host, ESDHC_TBCTL); + val &= ~ESDHC_TB_EN; +@@ -889,8 +886,8 @@ static int sdhci_esdhc_probe(struct platform_device *pdev) + host->quirks &= ~SDHCI_QUIRK_NO_BUSY_IRQ; + + if (of_find_compatible_node(NULL, NULL, "fsl,p2020-esdhc")) { +- host->quirks2 |= SDHCI_QUIRK_RESET_AFTER_REQUEST; +- host->quirks2 |= SDHCI_QUIRK_BROKEN_TIMEOUT_VAL; ++ host->quirks |= SDHCI_QUIRK_RESET_AFTER_REQUEST; ++ host->quirks |= SDHCI_QUIRK_BROKEN_TIMEOUT_VAL; + } + + if (of_device_is_compatible(np, "fsl,p5040-esdhc") || +diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c +index 5807028c8309..645775dd4edb 100644 +--- a/drivers/mmc/host/sdhci.c ++++ b/drivers/mmc/host/sdhci.c +@@ -1635,9 +1635,7 @@ void sdhci_set_uhs_signaling(struct sdhci_host *host, unsigned timing) + ctrl_2 |= SDHCI_CTRL_UHS_SDR104; + else if (timing == MMC_TIMING_UHS_SDR12) + ctrl_2 |= SDHCI_CTRL_UHS_SDR12; +- else if (timing == MMC_TIMING_SD_HS || +- timing == MMC_TIMING_MMC_HS || +- timing == MMC_TIMING_UHS_SDR25) ++ else if (timing == MMC_TIMING_UHS_SDR25) + ctrl_2 |= SDHCI_CTRL_UHS_SDR25; + else if (timing == MMC_TIMING_UHS_SDR50) + ctrl_2 |= SDHCI_CTRL_UHS_SDR50; +@@ -2164,8 +2162,8 @@ static void __sdhci_execute_tuning(struct sdhci_host *host, u32 opcode) + sdhci_send_tuning(host, opcode); + + if (!host->tuning_done) { +- pr_info("%s: Tuning timeout, falling back to fixed sampling clock\n", +- mmc_hostname(host->mmc)); ++ pr_debug("%s: Tuning timeout, falling back to fixed sampling clock\n", ++ mmc_hostname(host->mmc)); + sdhci_abort_tuning(host, opcode); + return; + } +diff --git a/drivers/mmc/host/tmio_mmc_core.c b/drivers/mmc/host/tmio_mmc_core.c +index 2fd862dc9770..a09aad9155a5 100644 +--- a/drivers/mmc/host/tmio_mmc_core.c ++++ b/drivers/mmc/host/tmio_mmc_core.c +@@ -1220,7 +1220,7 @@ int tmio_mmc_host_probe(struct tmio_mmc_host *_host, + _host->start_signal_voltage_switch; + mmc->ops = &tmio_mmc_ops; + +- mmc->caps |= MMC_CAP_4_BIT_DATA | pdata->capabilities; ++ mmc->caps |= MMC_CAP_ERASE | MMC_CAP_4_BIT_DATA | pdata->capabilities; + mmc->caps2 |= pdata->capabilities2; + mmc->max_segs = pdata->max_segs ? : 32; + mmc->max_blk_size = 512; +diff --git a/drivers/net/dsa/Kconfig b/drivers/net/dsa/Kconfig +index 83a9bc892a3b..6ae13f2419e3 100644 +--- a/drivers/net/dsa/Kconfig ++++ b/drivers/net/dsa/Kconfig +@@ -55,6 +55,7 @@ config NET_DSA_QCA8K + config NET_DSA_SMSC_LAN9303 + tristate + select NET_DSA_TAG_LAN9303 ++ select REGMAP + ---help--- + This enables support for the SMSC/Microchip LAN9303 3 port ethernet + switch chips. +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c +index 9ca994d0bab6..1977e0c552df 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c +@@ -2389,15 +2389,21 @@ static int bnx2x_set_pf_tx_switching(struct bnx2x *bp, bool enable) + /* send the ramrod on all the queues of the PF */ + for_each_eth_queue(bp, i) { + struct bnx2x_fastpath *fp = &bp->fp[i]; ++ int tx_idx; + + /* Set the appropriate Queue object */ + q_params.q_obj = &bnx2x_sp_obj(bp, fp).q_obj; + +- /* Update the Queue state */ +- rc = bnx2x_queue_state_change(bp, &q_params); +- if (rc) { +- BNX2X_ERR("Failed to configure Tx switching\n"); +- return rc; ++ for (tx_idx = FIRST_TX_COS_INDEX; ++ tx_idx < fp->max_cos; tx_idx++) { ++ q_params.params.update.cid_index = tx_idx; ++ ++ /* Update the Queue state */ ++ rc = bnx2x_queue_state_change(bp, &q_params); ++ if (rc) { ++ BNX2X_ERR("Failed to configure Tx switching\n"); ++ return rc; ++ } + } + } + +diff --git a/drivers/net/ethernet/hisilicon/hip04_eth.c b/drivers/net/ethernet/hisilicon/hip04_eth.c +index 84c0f22ac2db..d5489cb0afff 100644 +--- a/drivers/net/ethernet/hisilicon/hip04_eth.c ++++ b/drivers/net/ethernet/hisilicon/hip04_eth.c +@@ -456,9 +456,9 @@ hip04_mac_start_xmit(struct sk_buff *skb, struct net_device *ndev) + skb_tx_timestamp(skb); + + hip04_set_xmit_desc(priv, phys); +- priv->tx_head = TX_NEXT(tx_head); + count++; + netdev_sent_queue(ndev, skb->len); ++ priv->tx_head = TX_NEXT(tx_head); + + stats->tx_bytes += skb->len; + stats->tx_packets++; +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +index 4801d96c4fa9..0edfd199937d 100644 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +@@ -8379,7 +8379,8 @@ netdev_tx_t ixgbe_xmit_frame_ring(struct sk_buff *skb, + + if (unlikely(skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) && + adapter->ptp_clock) { +- if (!test_and_set_bit_lock(__IXGBE_PTP_TX_IN_PROGRESS, ++ if (adapter->tstamp_config.tx_type == HWTSTAMP_TX_ON && ++ !test_and_set_bit_lock(__IXGBE_PTP_TX_IN_PROGRESS, + &adapter->state)) { + skb_shinfo(skb)->tx_flags |= SKBTX_IN_PROGRESS; + tx_flags |= IXGBE_TX_FLAGS_TSTAMP; +diff --git a/drivers/net/ethernet/qlogic/qede/qede_filter.c b/drivers/net/ethernet/qlogic/qede/qede_filter.c +index f79e36e4060a..e7ad95de3da8 100644 +--- a/drivers/net/ethernet/qlogic/qede/qede_filter.c ++++ b/drivers/net/ethernet/qlogic/qede/qede_filter.c +@@ -1181,7 +1181,7 @@ qede_configure_mcast_filtering(struct net_device *ndev, + netif_addr_lock_bh(ndev); + + mc_count = netdev_mc_count(ndev); +- if (mc_count < 64) { ++ if (mc_count <= 64) { + netdev_for_each_mc_addr(ha, ndev) { + ether_addr_copy(temp, ha->addr); + temp += ETH_ALEN; +diff --git a/drivers/net/ethernet/qlogic/qla3xxx.c b/drivers/net/ethernet/qlogic/qla3xxx.c +index 5fca9a75780c..cc53ee26bd3e 100644 +--- a/drivers/net/ethernet/qlogic/qla3xxx.c ++++ b/drivers/net/ethernet/qlogic/qla3xxx.c +@@ -2756,6 +2756,9 @@ static int ql_alloc_large_buffers(struct ql3_adapter *qdev) + int err; + + for (i = 0; i < qdev->num_large_buffers; i++) { ++ lrg_buf_cb = &qdev->lrg_buf[i]; ++ memset(lrg_buf_cb, 0, sizeof(struct ql_rcv_buf_cb)); ++ + skb = netdev_alloc_skb(qdev->ndev, + qdev->lrg_buffer_len); + if (unlikely(!skb)) { +@@ -2766,11 +2769,7 @@ static int ql_alloc_large_buffers(struct ql3_adapter *qdev) + ql_free_large_buffers(qdev); + return -ENOMEM; + } else { +- +- lrg_buf_cb = &qdev->lrg_buf[i]; +- memset(lrg_buf_cb, 0, sizeof(struct ql_rcv_buf_cb)); + lrg_buf_cb->index = i; +- lrg_buf_cb->skb = skb; + /* + * We save some space to copy the ethhdr from first + * buffer +@@ -2792,6 +2791,7 @@ static int ql_alloc_large_buffers(struct ql3_adapter *qdev) + return -ENOMEM; + } + ++ lrg_buf_cb->skb = skb; + dma_unmap_addr_set(lrg_buf_cb, mapaddr, map); + dma_unmap_len_set(lrg_buf_cb, maplen, + qdev->lrg_buffer_len - +diff --git a/drivers/net/fjes/fjes_main.c b/drivers/net/fjes/fjes_main.c +index 14d6579b292a..314e3eac09b9 100644 +--- a/drivers/net/fjes/fjes_main.c ++++ b/drivers/net/fjes/fjes_main.c +@@ -181,6 +181,9 @@ static int fjes_acpi_add(struct acpi_device *device) + /* create platform_device */ + plat_dev = platform_device_register_simple(DRV_NAME, 0, fjes_resource, + ARRAY_SIZE(fjes_resource)); ++ if (IS_ERR(plat_dev)) ++ return PTR_ERR(plat_dev); ++ + device->driver_data = plat_dev; + + return 0; +diff --git a/drivers/net/phy/dp83867.c b/drivers/net/phy/dp83867.c +index e03e91d5f1b1..0cbcced0870e 100644 +--- a/drivers/net/phy/dp83867.c ++++ b/drivers/net/phy/dp83867.c +@@ -84,6 +84,10 @@ + #define DP83867_IO_MUX_CFG_IO_IMPEDANCE_MAX 0x0 + #define DP83867_IO_MUX_CFG_IO_IMPEDANCE_MIN 0x1f + ++/* CFG3 bits */ ++#define DP83867_CFG3_INT_OE BIT(7) ++#define DP83867_CFG3_ROBUST_AUTO_MDIX BIT(9) ++ + /* CFG4 bits */ + #define DP83867_CFG4_PORT_MIRROR_EN BIT(0) + +@@ -320,12 +324,13 @@ static int dp83867_config_init(struct phy_device *phydev) + return ret; + } + ++ val = phy_read(phydev, DP83867_CFG3); + /* Enable Interrupt output INT_OE in CFG3 register */ +- if (phy_interrupt_is_valid(phydev)) { +- val = phy_read(phydev, DP83867_CFG3); +- val |= BIT(7); +- phy_write(phydev, DP83867_CFG3, val); +- } ++ if (phy_interrupt_is_valid(phydev)) ++ val |= DP83867_CFG3_INT_OE; ++ ++ val |= DP83867_CFG3_ROBUST_AUTO_MDIX; ++ phy_write(phydev, DP83867_CFG3, val); + + if (dp83867->port_mirroring != DP83867_PORT_MIRROING_KEEP) + dp83867_config_port_mirroring(phydev); +diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c +index ed7e3c70b511..a98c227a4c2e 100644 +--- a/drivers/net/phy/phy_device.c ++++ b/drivers/net/phy/phy_device.c +@@ -367,8 +367,8 @@ struct phy_device *phy_device_create(struct mii_bus *bus, int addr, int phy_id, + mdiodev->device_free = phy_mdio_device_free; + mdiodev->device_remove = phy_mdio_device_remove; + +- dev->speed = 0; +- dev->duplex = -1; ++ dev->speed = SPEED_UNKNOWN; ++ dev->duplex = DUPLEX_UNKNOWN; + dev->pause = 0; + dev->asym_pause = 0; + dev->link = 1; +diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c +index 2229284d16f5..7d1d5b30ecc3 100644 +--- a/drivers/net/usb/lan78xx.c ++++ b/drivers/net/usb/lan78xx.c +@@ -1765,6 +1765,7 @@ static int lan78xx_mdio_init(struct lan78xx_net *dev) + dev->mdiobus->read = lan78xx_mdiobus_read; + dev->mdiobus->write = lan78xx_mdiobus_write; + dev->mdiobus->name = "lan78xx-mdiobus"; ++ dev->mdiobus->parent = &dev->udev->dev; + + snprintf(dev->mdiobus->id, MII_BUS_ID_SIZE, "usb-%03d:%03d", + dev->udev->bus->busnum, dev->udev->devnum); +diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c +index dff34448588f..ea47ad4b2343 100644 +--- a/drivers/net/wireless/ath/ath10k/mac.c ++++ b/drivers/net/wireless/ath/ath10k/mac.c +@@ -3627,7 +3627,7 @@ static int ath10k_mac_tx(struct ath10k *ar, + struct ieee80211_vif *vif, + enum ath10k_hw_txrx_mode txmode, + enum ath10k_mac_tx_path txpath, +- struct sk_buff *skb) ++ struct sk_buff *skb, bool noque_offchan) + { + struct ieee80211_hw *hw = ar->hw; + struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb); +@@ -3655,10 +3655,10 @@ static int ath10k_mac_tx(struct ath10k *ar, + } + } + +- if (info->flags & IEEE80211_TX_CTL_TX_OFFCHAN) { ++ if (!noque_offchan && info->flags & IEEE80211_TX_CTL_TX_OFFCHAN) { + if (!ath10k_mac_tx_frm_has_freq(ar)) { +- ath10k_dbg(ar, ATH10K_DBG_MAC, "queued offchannel skb %pK\n", +- skb); ++ ath10k_dbg(ar, ATH10K_DBG_MAC, "mac queued offchannel skb %pK len %d\n", ++ skb, skb->len); + + skb_queue_tail(&ar->offchan_tx_queue, skb); + ieee80211_queue_work(hw, &ar->offchan_tx_work); +@@ -3720,8 +3720,8 @@ void ath10k_offchan_tx_work(struct work_struct *work) + + mutex_lock(&ar->conf_mutex); + +- ath10k_dbg(ar, ATH10K_DBG_MAC, "mac offchannel skb %pK\n", +- skb); ++ ath10k_dbg(ar, ATH10K_DBG_MAC, "mac offchannel skb %pK len %d\n", ++ skb, skb->len); + + hdr = (struct ieee80211_hdr *)skb->data; + peer_addr = ieee80211_get_DA(hdr); +@@ -3767,7 +3767,7 @@ void ath10k_offchan_tx_work(struct work_struct *work) + txmode = ath10k_mac_tx_h_get_txmode(ar, vif, sta, skb); + txpath = ath10k_mac_tx_h_get_txpath(ar, skb, txmode); + +- ret = ath10k_mac_tx(ar, vif, txmode, txpath, skb); ++ ret = ath10k_mac_tx(ar, vif, txmode, txpath, skb, true); + if (ret) { + ath10k_warn(ar, "failed to transmit offchannel frame: %d\n", + ret); +@@ -3777,8 +3777,8 @@ void ath10k_offchan_tx_work(struct work_struct *work) + time_left = + wait_for_completion_timeout(&ar->offchan_tx_completed, 3 * HZ); + if (time_left == 0) +- ath10k_warn(ar, "timed out waiting for offchannel skb %pK\n", +- skb); ++ ath10k_warn(ar, "timed out waiting for offchannel skb %pK, len: %d\n", ++ skb, skb->len); + + if (!peer && tmp_peer_created) { + ret = ath10k_peer_delete(ar, vdev_id, peer_addr); +@@ -3957,7 +3957,7 @@ int ath10k_mac_tx_push_txq(struct ieee80211_hw *hw, + spin_unlock_bh(&ar->htt.tx_lock); + } + +- ret = ath10k_mac_tx(ar, vif, txmode, txpath, skb); ++ ret = ath10k_mac_tx(ar, vif, txmode, txpath, skb, false); + if (unlikely(ret)) { + ath10k_warn(ar, "failed to push frame: %d\n", ret); + +@@ -4239,7 +4239,7 @@ static void ath10k_mac_op_tx(struct ieee80211_hw *hw, + spin_unlock_bh(&ar->htt.tx_lock); + } + +- ret = ath10k_mac_tx(ar, vif, txmode, txpath, skb); ++ ret = ath10k_mac_tx(ar, vif, txmode, txpath, skb, false); + if (ret) { + ath10k_warn(ar, "failed to transmit frame: %d\n", ret); + if (is_htt) { +diff --git a/drivers/net/wireless/ath/ath10k/txrx.c b/drivers/net/wireless/ath/ath10k/txrx.c +index d4986f626c35..9999c8c40269 100644 +--- a/drivers/net/wireless/ath/ath10k/txrx.c ++++ b/drivers/net/wireless/ath/ath10k/txrx.c +@@ -100,6 +100,8 @@ int ath10k_txrx_tx_unref(struct ath10k_htt *htt, + + info = IEEE80211_SKB_CB(msdu); + memset(&info->status, 0, sizeof(info->status)); ++ info->status.rates[0].idx = -1; ++ + trace_ath10k_txrx_tx_unref(ar, tx_done->msdu_id); + + if (tx_done->status == HTT_TX_COMPL_STATE_DISCARD) { +diff --git a/drivers/net/wireless/intel/iwlwifi/dvm/led.c b/drivers/net/wireless/intel/iwlwifi/dvm/led.c +index 1bbd17ada974..20e16c423990 100644 +--- a/drivers/net/wireless/intel/iwlwifi/dvm/led.c ++++ b/drivers/net/wireless/intel/iwlwifi/dvm/led.c +@@ -185,6 +185,9 @@ void iwl_leds_init(struct iwl_priv *priv) + + priv->led.name = kasprintf(GFP_KERNEL, "%s-led", + wiphy_name(priv->hw->wiphy)); ++ if (!priv->led.name) ++ return; ++ + priv->led.brightness_set = iwl_led_brightness_set; + priv->led.blink_set = iwl_led_blink_set; + priv->led.max_brightness = 1; +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/led.c b/drivers/net/wireless/intel/iwlwifi/mvm/led.c +index b27269504a62..072f80c90ce4 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/led.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/led.c +@@ -131,6 +131,9 @@ int iwl_mvm_leds_init(struct iwl_mvm *mvm) + + mvm->led.name = kasprintf(GFP_KERNEL, "%s-led", + wiphy_name(mvm->hw->wiphy)); ++ if (!mvm->led.name) ++ return -ENOMEM; ++ + mvm->led.brightness_set = iwl_led_brightness_set; + mvm->led.max_brightness = 1; + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rx.c b/drivers/net/wireless/intel/iwlwifi/mvm/rx.c +index c73e4be9bde3..c31303d13069 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/rx.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rx.c +@@ -62,6 +62,7 @@ + * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE + * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + *****************************************************************************/ ++#include + #include + #include + #include "iwl-trans.h" +@@ -290,7 +291,7 @@ void iwl_mvm_rx_rx_mpdu(struct iwl_mvm *mvm, struct napi_struct *napi, + rx_res = (struct iwl_rx_mpdu_res_start *)pkt->data; + hdr = (struct ieee80211_hdr *)(pkt->data + sizeof(*rx_res)); + len = le16_to_cpu(rx_res->byte_count); +- rx_pkt_status = le32_to_cpup((__le32 *) ++ rx_pkt_status = get_unaligned_le32((__le32 *) + (pkt->data + sizeof(*rx_res) + len)); + + /* Dont use dev_alloc_skb(), we'll have enough headroom once +diff --git a/drivers/net/wireless/marvell/libertas/if_sdio.c b/drivers/net/wireless/marvell/libertas/if_sdio.c +index 39bf85d0ade0..c7f8a29d2606 100644 +--- a/drivers/net/wireless/marvell/libertas/if_sdio.c ++++ b/drivers/net/wireless/marvell/libertas/if_sdio.c +@@ -1183,6 +1183,10 @@ static int if_sdio_probe(struct sdio_func *func, + + spin_lock_init(&card->lock); + card->workqueue = alloc_workqueue("libertas_sdio", WQ_MEM_RECLAIM, 0); ++ if (unlikely(!card->workqueue)) { ++ ret = -ENOMEM; ++ goto err_queue; ++ } + INIT_WORK(&card->packet_worker, if_sdio_host_to_card_worker); + init_waitqueue_head(&card->pwron_waitq); + +@@ -1234,6 +1238,7 @@ err_activate_card: + lbs_remove_card(priv); + free: + destroy_workqueue(card->workqueue); ++err_queue: + while (card->packets) { + packet = card->packets; + card->packets = card->packets->next; +diff --git a/drivers/net/wireless/marvell/mwifiex/pcie.c b/drivers/net/wireless/marvell/mwifiex/pcie.c +index 9511f5fe62f4..9d0d790a1319 100644 +--- a/drivers/net/wireless/marvell/mwifiex/pcie.c ++++ b/drivers/net/wireless/marvell/mwifiex/pcie.c +@@ -677,8 +677,11 @@ static int mwifiex_pcie_init_evt_ring(struct mwifiex_adapter *adapter) + skb_put(skb, MAX_EVENT_SIZE); + + if (mwifiex_map_pci_memory(adapter, skb, MAX_EVENT_SIZE, +- PCI_DMA_FROMDEVICE)) ++ PCI_DMA_FROMDEVICE)) { ++ kfree_skb(skb); ++ kfree(card->evtbd_ring_vbase); + return -1; ++ } + + buf_pa = MWIFIEX_SKB_DMA_ADDR(skb); + +diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h +index 95e3993d8a33..a895b6fd6f85 100644 +--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h ++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h +@@ -1349,6 +1349,7 @@ struct rtl8xxxu_fileops { + u8 has_s0s1:1; + u8 has_tx_report:1; + u8 gen2_thermal_meter:1; ++ u8 needs_full_init:1; + u32 adda_1t_init; + u32 adda_1t_path_on; + u32 adda_2t_path_on_a; +diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8723b.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8723b.c +index c4b86a84a721..27e97df996c7 100644 +--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8723b.c ++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8723b.c +@@ -1673,6 +1673,7 @@ struct rtl8xxxu_fileops rtl8723bu_fops = { + .has_s0s1 = 1, + .has_tx_report = 1, + .gen2_thermal_meter = 1, ++ .needs_full_init = 1, + .adda_1t_init = 0x01c00014, + .adda_1t_path_on = 0x01c00014, + .adda_2t_path_on_a = 0x01c00014, +diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c +index 91b01ca32e75..b58bf8e2cad2 100644 +--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c ++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c +@@ -3905,6 +3905,9 @@ static int rtl8xxxu_init_device(struct ieee80211_hw *hw) + else + macpower = true; + ++ if (fops->needs_full_init) ++ macpower = false; ++ + ret = fops->power_on(priv); + if (ret < 0) { + dev_warn(dev, "%s: Failed power on\n", __func__); +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/hw.c +index 530e80f0ef0b..1ee7f796113b 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/hw.c ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/hw.c +@@ -1556,6 +1556,8 @@ static bool usb_cmd_send_packet(struct ieee80211_hw *hw, struct sk_buff *skb) + * This is maybe necessary: + * rtlpriv->cfg->ops->fill_tx_cmddesc(hw, buffer, 1, 1, skb); + */ ++ dev_kfree_skb(skb); ++ + return true; + } + +diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c b/drivers/net/wireless/realtek/rtlwifi/usb.c +index 2401c8bdb211..93eda23f0123 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/usb.c ++++ b/drivers/net/wireless/realtek/rtlwifi/usb.c +@@ -1068,8 +1068,10 @@ int rtl_usb_probe(struct usb_interface *intf, + rtlpriv->hw = hw; + rtlpriv->usb_data = kzalloc(RTL_USB_MAX_RX_COUNT * sizeof(u32), + GFP_KERNEL); +- if (!rtlpriv->usb_data) ++ if (!rtlpriv->usb_data) { ++ ieee80211_free_hw(hw); + return -ENOMEM; ++ } + + /* this spin lock must be initialized early */ + spin_lock_init(&rtlpriv->locks.usb_lock); +@@ -1130,6 +1132,7 @@ error_out2: + _rtl_usb_io_handler_release(hw); + usb_put_dev(udev); + complete(&rtlpriv->firmware_loading_complete); ++ kfree(rtlpriv->usb_data); + return -ENODEV; + } + EXPORT_SYMBOL(rtl_usb_probe); +diff --git a/drivers/parport/share.c b/drivers/parport/share.c +index 7b4ee33c1935..15c81cffd2de 100644 +--- a/drivers/parport/share.c ++++ b/drivers/parport/share.c +@@ -230,6 +230,18 @@ static int port_check(struct device *dev, void *dev_drv) + return 0; + } + ++/* ++ * Iterates through all the devices connected to the bus and return 1 ++ * if the device is a parallel port. ++ */ ++ ++static int port_detect(struct device *dev, void *dev_drv) ++{ ++ if (is_parport(dev)) ++ return 1; ++ return 0; ++} ++ + /** + * parport_register_driver - register a parallel port device driver + * @drv: structure describing the driver +@@ -282,6 +294,15 @@ int __parport_register_driver(struct parport_driver *drv, struct module *owner, + if (ret) + return ret; + ++ /* ++ * check if bus has any parallel port registered, if ++ * none is found then load the lowlevel driver. ++ */ ++ ret = bus_for_each_dev(&parport_bus_type, NULL, NULL, ++ port_detect); ++ if (!ret) ++ get_lowlevel_driver(); ++ + mutex_lock(®istration_lock); + if (drv->match_port) + bus_for_each_dev(&parport_bus_type, NULL, drv, +diff --git a/drivers/phy/qualcomm/phy-qcom-usb-hs.c b/drivers/phy/qualcomm/phy-qcom-usb-hs.c +index 2d0c70b5589f..643934a2a70c 100644 +--- a/drivers/phy/qualcomm/phy-qcom-usb-hs.c ++++ b/drivers/phy/qualcomm/phy-qcom-usb-hs.c +@@ -159,8 +159,8 @@ static int qcom_usb_hs_phy_power_on(struct phy *phy) + /* setup initial state */ + qcom_usb_hs_phy_vbus_notifier(&uphy->vbus_notify, state, + uphy->vbus_edev); +- ret = devm_extcon_register_notifier(&ulpi->dev, uphy->vbus_edev, +- EXTCON_USB, &uphy->vbus_notify); ++ ret = extcon_register_notifier(uphy->vbus_edev, EXTCON_USB, ++ &uphy->vbus_notify); + if (ret) + goto err_ulpi; + } +@@ -181,6 +181,9 @@ static int qcom_usb_hs_phy_power_off(struct phy *phy) + { + struct qcom_usb_hs_phy *uphy = phy_get_drvdata(phy); + ++ if (uphy->vbus_edev) ++ extcon_unregister_notifier(uphy->vbus_edev, EXTCON_USB, ++ &uphy->vbus_notify); + regulator_disable(uphy->v3p3); + regulator_disable(uphy->v1p8); + clk_disable_unprepare(uphy->sleep_clk); +diff --git a/drivers/pinctrl/devicetree.c b/drivers/pinctrl/devicetree.c +index c4aa411f5935..3a7c2d6e4d5f 100644 +--- a/drivers/pinctrl/devicetree.c ++++ b/drivers/pinctrl/devicetree.c +@@ -40,6 +40,13 @@ struct pinctrl_dt_map { + static void dt_free_map(struct pinctrl_dev *pctldev, + struct pinctrl_map *map, unsigned num_maps) + { ++ int i; ++ ++ for (i = 0; i < num_maps; ++i) { ++ kfree_const(map[i].dev_name); ++ map[i].dev_name = NULL; ++ } ++ + if (pctldev) { + const struct pinctrl_ops *ops = pctldev->desc->pctlops; + if (ops->dt_free_map) +@@ -74,7 +81,13 @@ static int dt_remember_or_free_map(struct pinctrl *p, const char *statename, + + /* Initialize common mapping table entry fields */ + for (i = 0; i < num_maps; i++) { +- map[i].dev_name = dev_name(p->dev); ++ const char *devname; ++ ++ devname = kstrdup_const(dev_name(p->dev), GFP_KERNEL); ++ if (!devname) ++ goto err_free_map; ++ ++ map[i].dev_name = devname; + map[i].name = statename; + if (pctldev) + map[i].ctrl_dev_name = dev_name(pctldev->dev); +@@ -82,10 +95,8 @@ static int dt_remember_or_free_map(struct pinctrl *p, const char *statename, + + /* Remember the converted mapping table entries */ + dt_map = kzalloc(sizeof(*dt_map), GFP_KERNEL); +- if (!dt_map) { +- dt_free_map(pctldev, map, num_maps); +- return -ENOMEM; +- } ++ if (!dt_map) ++ goto err_free_map; + + dt_map->pctldev = pctldev; + dt_map->map = map; +@@ -93,6 +104,10 @@ static int dt_remember_or_free_map(struct pinctrl *p, const char *statename, + list_add_tail(&dt_map->node, &p->dt_maps); + + return pinctrl_register_map(map, num_maps, false); ++ ++err_free_map: ++ dt_free_map(pctldev, map, num_maps); ++ return -ENOMEM; + } + + struct pinctrl_dev *of_pinctrl_get(struct device_node *np) +diff --git a/drivers/pinctrl/pinctrl-amd.c b/drivers/pinctrl/pinctrl-amd.c +index b78f42abff2f..7385cd81498c 100644 +--- a/drivers/pinctrl/pinctrl-amd.c ++++ b/drivers/pinctrl/pinctrl-amd.c +@@ -509,7 +509,8 @@ static irqreturn_t amd_gpio_irq_handler(int irq, void *dev_id) + irqreturn_t ret = IRQ_NONE; + unsigned int i, irqnr; + unsigned long flags; +- u32 *regs, regval; ++ u32 __iomem *regs; ++ u32 regval; + u64 status, mask; + + /* Read the wake status */ +diff --git a/drivers/pinctrl/sh-pfc/pfc-sh7734.c b/drivers/pinctrl/sh-pfc/pfc-sh7734.c +index 33232041ee86..3eccc9b3ca84 100644 +--- a/drivers/pinctrl/sh-pfc/pfc-sh7734.c ++++ b/drivers/pinctrl/sh-pfc/pfc-sh7734.c +@@ -1453,7 +1453,7 @@ static const struct pinmux_func pinmux_func_gpios[] = { + GPIO_FN(ET0_ETXD2_A), + GPIO_FN(EX_CS5), GPIO_FN(SD1_CMD_A), GPIO_FN(ATADIR), GPIO_FN(QSSL_B), + GPIO_FN(ET0_ETXD3_A), +- GPIO_FN(RD_WR), GPIO_FN(TCLK1_B), ++ GPIO_FN(RD_WR), GPIO_FN(TCLK0), GPIO_FN(CAN_CLK_B), GPIO_FN(ET0_ETXD4), + GPIO_FN(EX_WAIT0), GPIO_FN(TCLK1_B), + GPIO_FN(EX_WAIT1), GPIO_FN(SD1_DAT0_A), GPIO_FN(DREQ2), + GPIO_FN(CAN1_TX_C), GPIO_FN(ET0_LINK_C), GPIO_FN(ET0_ETXD5_A), +@@ -1949,7 +1949,7 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = { + /* IP3_20 [1] */ + FN_EX_WAIT0, FN_TCLK1_B, + /* IP3_19_18 [2] */ +- FN_RD_WR, FN_TCLK1_B, 0, 0, ++ FN_RD_WR, FN_TCLK0, FN_CAN_CLK_B, FN_ET0_ETXD4, + /* IP3_17_15 [3] */ + FN_EX_CS5, FN_SD1_CMD_A, FN_ATADIR, FN_QSSL_B, + FN_ET0_ETXD3_A, 0, 0, 0, +diff --git a/drivers/platform/x86/hp-wmi.c b/drivers/platform/x86/hp-wmi.c +index d0ffdd5d9199..06a3c1ef8eee 100644 +--- a/drivers/platform/x86/hp-wmi.c ++++ b/drivers/platform/x86/hp-wmi.c +@@ -313,7 +313,7 @@ static int __init hp_wmi_bios_2008_later(void) + + static int __init hp_wmi_bios_2009_later(void) + { +- int state = 0; ++ u8 state[128]; + int ret = hp_wmi_perform_query(HPWMI_FEATURE2_QUERY, HPWMI_READ, &state, + sizeof(state), sizeof(state)); + if (!ret) +diff --git a/drivers/regulator/max8907-regulator.c b/drivers/regulator/max8907-regulator.c +index 860400d2cd85..a8f2f07239fb 100644 +--- a/drivers/regulator/max8907-regulator.c ++++ b/drivers/regulator/max8907-regulator.c +@@ -299,7 +299,10 @@ static int max8907_regulator_probe(struct platform_device *pdev) + memcpy(pmic->desc, max8907_regulators, sizeof(pmic->desc)); + + /* Backwards compatibility with MAX8907B; SD1 uses different voltages */ +- regmap_read(max8907->regmap_gen, MAX8907_REG_II2RR, &val); ++ ret = regmap_read(max8907->regmap_gen, MAX8907_REG_II2RR, &val); ++ if (ret) ++ return ret; ++ + if ((val & MAX8907_II2RR_VERSION_MASK) == + MAX8907_II2RR_VERSION_REV_B) { + pmic->desc[MAX8907_SD1].min_uV = 637500; +@@ -336,14 +339,20 @@ static int max8907_regulator_probe(struct platform_device *pdev) + } + + if (pmic->desc[i].ops == &max8907_ldo_ops) { +- regmap_read(config.regmap, pmic->desc[i].enable_reg, ++ ret = regmap_read(config.regmap, pmic->desc[i].enable_reg, + &val); ++ if (ret) ++ return ret; ++ + if ((val & MAX8907_MASK_LDO_SEQ) != + MAX8907_MASK_LDO_SEQ) + pmic->desc[i].ops = &max8907_ldo_hwctl_ops; + } else if (pmic->desc[i].ops == &max8907_out5v_ops) { +- regmap_read(config.regmap, pmic->desc[i].enable_reg, ++ ret = regmap_read(config.regmap, pmic->desc[i].enable_reg, + &val); ++ if (ret) ++ return ret; ++ + if ((val & (MAX8907_MASK_OUT5V_VINEN | + MAX8907_MASK_OUT5V_ENSRC)) != + MAX8907_MASK_OUT5V_ENSRC) +diff --git a/drivers/spi/spi-img-spfi.c b/drivers/spi/spi-img-spfi.c +index 7a37090dabbe..2e65b70c7879 100644 +--- a/drivers/spi/spi-img-spfi.c ++++ b/drivers/spi/spi-img-spfi.c +@@ -673,6 +673,8 @@ static int img_spfi_probe(struct platform_device *pdev) + dma_release_channel(spfi->tx_ch); + if (spfi->rx_ch) + dma_release_channel(spfi->rx_ch); ++ spfi->tx_ch = NULL; ++ spfi->rx_ch = NULL; + dev_warn(spfi->dev, "Failed to get DMA channels, falling back to PIO mode\n"); + } else { + master->dma_tx = spfi->tx_ch; +diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c +index 9bf3e5f945c7..b2245cdce230 100644 +--- a/drivers/spi/spi-pxa2xx.c ++++ b/drivers/spi/spi-pxa2xx.c +@@ -1559,7 +1559,13 @@ pxa2xx_spi_init_pdata(struct platform_device *pdev) + } + + ssp->clk = devm_clk_get(&pdev->dev, NULL); ++ if (IS_ERR(ssp->clk)) ++ return NULL; ++ + ssp->irq = platform_get_irq(pdev, 0); ++ if (ssp->irq < 0) ++ return NULL; ++ + ssp->type = type; + ssp->pdev = pdev; + ssp->port_id = pxa2xx_spi_get_port_id(adev); +diff --git a/drivers/spi/spi-st-ssc4.c b/drivers/spi/spi-st-ssc4.c +index a4e43fc19ece..5df01ffdef46 100644 +--- a/drivers/spi/spi-st-ssc4.c ++++ b/drivers/spi/spi-st-ssc4.c +@@ -385,6 +385,7 @@ static int spi_st_probe(struct platform_device *pdev) + return 0; + + clk_disable: ++ pm_runtime_disable(&pdev->dev); + clk_disable_unprepare(spi_st->clk); + put_master: + spi_master_put(master); +@@ -396,6 +397,8 @@ static int spi_st_remove(struct platform_device *pdev) + struct spi_master *master = platform_get_drvdata(pdev); + struct spi_st *spi_st = spi_master_get_devdata(master); + ++ pm_runtime_disable(&pdev->dev); ++ + clk_disable_unprepare(spi_st->clk); + + pinctrl_pm_select_sleep_state(&pdev->dev); +diff --git a/drivers/spi/spi-tegra20-slink.c b/drivers/spi/spi-tegra20-slink.c +index 9831c1106945..62b074b167a9 100644 +--- a/drivers/spi/spi-tegra20-slink.c ++++ b/drivers/spi/spi-tegra20-slink.c +@@ -1078,7 +1078,7 @@ static int tegra_slink_probe(struct platform_device *pdev) + ret = clk_enable(tspi->clk); + if (ret < 0) { + dev_err(&pdev->dev, "Clock enable failed %d\n", ret); +- goto exit_free_master; ++ goto exit_clk_unprepare; + } + + spi_irq = platform_get_irq(pdev, 0); +@@ -1151,6 +1151,8 @@ exit_free_irq: + free_irq(spi_irq, tspi); + exit_clk_disable: + clk_disable(tspi->clk); ++exit_clk_unprepare: ++ clk_unprepare(tspi->clk); + exit_free_master: + spi_master_put(master); + return ret; +@@ -1164,6 +1166,7 @@ static int tegra_slink_remove(struct platform_device *pdev) + free_irq(tspi->irq, tspi); + + clk_disable(tspi->clk); ++ clk_unprepare(tspi->clk); + + if (tspi->tx_dma_chan) + tegra_slink_deinit_dma_param(tspi, false); +diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c +index c5fe08bc34a0..028725573e63 100644 +--- a/drivers/spi/spidev.c ++++ b/drivers/spi/spidev.c +@@ -634,6 +634,9 @@ static int spidev_release(struct inode *inode, struct file *filp) + if (dofree) + kfree(spidev); + } ++#ifdef CONFIG_SPI_SLAVE ++ spi_slave_abort(spidev->spi); ++#endif + mutex_unlock(&device_list_lock); + + return 0; +diff --git a/drivers/staging/comedi/drivers/gsc_hpdi.c b/drivers/staging/comedi/drivers/gsc_hpdi.c +index e5b948405fd9..a09631f9d813 100644 +--- a/drivers/staging/comedi/drivers/gsc_hpdi.c ++++ b/drivers/staging/comedi/drivers/gsc_hpdi.c +@@ -632,6 +632,11 @@ static int gsc_hpdi_auto_attach(struct comedi_device *dev, + dma_alloc_coherent(&pcidev->dev, DMA_BUFFER_SIZE, + &devpriv->dio_buffer_phys_addr[i], + GFP_KERNEL); ++ if (!devpriv->dio_buffer[i]) { ++ dev_warn(dev->class_dev, ++ "failed to allocate DMA buffer\n"); ++ return -ENOMEM; ++ } + } + /* allocate dma descriptors */ + devpriv->dma_desc = dma_alloc_coherent(&pcidev->dev, +@@ -639,6 +644,11 @@ static int gsc_hpdi_auto_attach(struct comedi_device *dev, + NUM_DMA_DESCRIPTORS, + &devpriv->dma_desc_phys_addr, + GFP_KERNEL); ++ if (!devpriv->dma_desc) { ++ dev_warn(dev->class_dev, ++ "failed to allocate DMA descriptors\n"); ++ return -ENOMEM; ++ } + if (devpriv->dma_desc_phys_addr & 0xf) { + dev_warn(dev->class_dev, + " dma descriptors not quad-word aligned (bug)\n"); +diff --git a/drivers/staging/fbtft/fbtft-core.c b/drivers/staging/fbtft/fbtft-core.c +index 0cbcbad8f074..b81c6dfa5b24 100644 +--- a/drivers/staging/fbtft/fbtft-core.c ++++ b/drivers/staging/fbtft/fbtft-core.c +@@ -780,7 +780,7 @@ struct fb_info *fbtft_framebuffer_alloc(struct fbtft_display *display, + fbdefio->deferred_io = fbtft_deferred_io; + fb_deferred_io_init(info); + +- strncpy(info->fix.id, dev->driver->name, 16); ++ snprintf(info->fix.id, sizeof(info->fix.id), "%s", dev->driver->name); + info->fix.type = FB_TYPE_PACKED_PIXELS; + info->fix.visual = FB_VISUAL_TRUECOLOR; + info->fix.xpanstep = 0; +diff --git a/drivers/staging/rtl8188eu/core/rtw_xmit.c b/drivers/staging/rtl8188eu/core/rtw_xmit.c +index 904b988ecc4e..7c895af1ba31 100644 +--- a/drivers/staging/rtl8188eu/core/rtw_xmit.c ++++ b/drivers/staging/rtl8188eu/core/rtw_xmit.c +@@ -805,7 +805,7 @@ s32 rtw_make_wlanhdr(struct adapter *padapter, u8 *hdr, struct pkt_attrib *pattr + memcpy(pwlanhdr->addr2, get_bssid(pmlmepriv), ETH_ALEN); + memcpy(pwlanhdr->addr3, pattrib->src, ETH_ALEN); + +- if (psta->qos_option) ++ if (psta && psta->qos_option) + qos_option = true; + } else if (check_fwstate(pmlmepriv, WIFI_ADHOC_STATE) || + check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE)) { +@@ -813,7 +813,7 @@ s32 rtw_make_wlanhdr(struct adapter *padapter, u8 *hdr, struct pkt_attrib *pattr + memcpy(pwlanhdr->addr2, pattrib->src, ETH_ALEN); + memcpy(pwlanhdr->addr3, get_bssid(pmlmepriv), ETH_ALEN); + +- if (psta->qos_option) ++ if (psta && psta->qos_option) + qos_option = true; + } else { + RT_TRACE(_module_rtl871x_xmit_c_, _drv_err_, ("fw_state:%x is not allowed to xmit frame\n", get_fwstate(pmlmepriv))); +diff --git a/drivers/staging/rtl8192u/r8192U_core.c b/drivers/staging/rtl8192u/r8192U_core.c +index db3eb7ec5809..fbbd1b59dc11 100644 +--- a/drivers/staging/rtl8192u/r8192U_core.c ++++ b/drivers/staging/rtl8192u/r8192U_core.c +@@ -1506,7 +1506,7 @@ short rtl8192_tx(struct net_device *dev, struct sk_buff *skb) + (tx_fwinfo_819x_usb *)(skb->data + USB_HWDESC_HEADER_LEN); + struct usb_device *udev = priv->udev; + int pend; +- int status; ++ int status, rt = -1; + struct urb *tx_urb = NULL, *tx_urb_zero = NULL; + unsigned int idx_pipe; + +@@ -1650,8 +1650,10 @@ short rtl8192_tx(struct net_device *dev, struct sk_buff *skb) + } + if (bSend0Byte) { + tx_urb_zero = usb_alloc_urb(0, GFP_ATOMIC); +- if (!tx_urb_zero) +- return -ENOMEM; ++ if (!tx_urb_zero) { ++ rt = -ENOMEM; ++ goto error; ++ } + usb_fill_bulk_urb(tx_urb_zero, udev, + usb_sndbulkpipe(udev, idx_pipe), + &zero, 0, tx_zero_isr, dev); +@@ -1661,7 +1663,7 @@ short rtl8192_tx(struct net_device *dev, struct sk_buff *skb) + "Error TX URB for zero byte %d, error %d", + atomic_read(&priv->tx_pending[tcb_desc->queue_index]), + status); +- return -1; ++ goto error; + } + } + netif_trans_update(dev); +@@ -1672,7 +1674,12 @@ short rtl8192_tx(struct net_device *dev, struct sk_buff *skb) + RT_TRACE(COMP_ERR, "Error TX URB %d, error %d", + atomic_read(&priv->tx_pending[tcb_desc->queue_index]), + status); +- return -1; ++ ++error: ++ dev_kfree_skb_any(skb); ++ usb_free_urb(tx_urb); ++ usb_free_urb(tx_urb_zero); ++ return rt; + } + + static short rtl8192_usb_initendpoints(struct net_device *dev) +diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c +index 62b2a7105f02..4fb4cf8c2f14 100644 +--- a/drivers/usb/core/devio.c ++++ b/drivers/usb/core/devio.c +@@ -755,8 +755,15 @@ static int claimintf(struct usb_dev_state *ps, unsigned int ifnum) + intf = usb_ifnum_to_if(dev, ifnum); + if (!intf) + err = -ENOENT; +- else ++ else { ++ unsigned int old_suppress; ++ ++ /* suppress uevents while claiming interface */ ++ old_suppress = dev_get_uevent_suppress(&intf->dev); ++ dev_set_uevent_suppress(&intf->dev, 1); + err = usb_driver_claim_interface(&usbfs_driver, intf, ps); ++ dev_set_uevent_suppress(&intf->dev, old_suppress); ++ } + if (err == 0) + set_bit(ifnum, &ps->ifclaimed); + return err; +@@ -776,7 +783,13 @@ static int releaseintf(struct usb_dev_state *ps, unsigned int ifnum) + if (!intf) + err = -ENOENT; + else if (test_and_clear_bit(ifnum, &ps->ifclaimed)) { ++ unsigned int old_suppress; ++ ++ /* suppress uevents while releasing interface */ ++ old_suppress = dev_get_uevent_suppress(&intf->dev); ++ dev_set_uevent_suppress(&intf->dev, 1); + usb_driver_release_interface(&usbfs_driver, intf); ++ dev_set_uevent_suppress(&intf->dev, old_suppress); + err = 0; + } + return err; +diff --git a/drivers/usb/host/ehci-q.c b/drivers/usb/host/ehci-q.c +index 8f3f055c05fa..477ba3842cc4 100644 +--- a/drivers/usb/host/ehci-q.c ++++ b/drivers/usb/host/ehci-q.c +@@ -40,6 +40,10 @@ + + /*-------------------------------------------------------------------------*/ + ++/* PID Codes that are used here, from EHCI specification, Table 3-16. */ ++#define PID_CODE_IN 1 ++#define PID_CODE_SETUP 2 ++ + /* fill a qtd, returning how much of the buffer we were able to queue up */ + + static int +@@ -203,7 +207,7 @@ static int qtd_copy_status ( + int status = -EINPROGRESS; + + /* count IN/OUT bytes, not SETUP (even short packets) */ +- if (likely (QTD_PID (token) != 2)) ++ if (likely(QTD_PID(token) != PID_CODE_SETUP)) + urb->actual_length += length - QTD_LENGTH (token); + + /* don't modify error codes */ +@@ -219,6 +223,13 @@ static int qtd_copy_status ( + if (token & QTD_STS_BABBLE) { + /* FIXME "must" disable babbling device's port too */ + status = -EOVERFLOW; ++ /* ++ * When MMF is active and PID Code is IN, queue is halted. ++ * EHCI Specification, Table 4-13. ++ */ ++ } else if ((token & QTD_STS_MMF) && ++ (QTD_PID(token) == PID_CODE_IN)) { ++ status = -EPROTO; + /* CERR nonzero + halt --> stall */ + } else if (QTD_CERR(token)) { + status = -EPIPE; +diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c +index 021a2d320acc..09f228279c01 100644 +--- a/drivers/usb/host/xhci-pci.c ++++ b/drivers/usb/host/xhci-pci.c +@@ -497,7 +497,6 @@ static int xhci_pci_resume(struct usb_hcd *hcd, bool hibernated) + retval = xhci_resume(xhci, hibernated); + return retval; + } +-#endif /* CONFIG_PM */ + + static void xhci_pci_shutdown(struct usb_hcd *hcd) + { +@@ -510,6 +509,7 @@ static void xhci_pci_shutdown(struct usb_hcd *hcd) + if (xhci->quirks & XHCI_SPURIOUS_WAKEUP) + pci_set_power_state(pdev, PCI_D3hot); + } ++#endif /* CONFIG_PM */ + + /*-------------------------------------------------------------------------*/ + +diff --git a/drivers/usb/renesas_usbhs/common.h b/drivers/usb/renesas_usbhs/common.h +index b8620aa6b72e..8424c165f732 100644 +--- a/drivers/usb/renesas_usbhs/common.h ++++ b/drivers/usb/renesas_usbhs/common.h +@@ -163,11 +163,12 @@ struct usbhs_priv; + #define VBSTS (1 << 7) /* VBUS_0 and VBUSIN_0 Input Status */ + #define VALID (1 << 3) /* USB Request Receive */ + +-#define DVSQ_MASK (0x3 << 4) /* Device State */ ++#define DVSQ_MASK (0x7 << 4) /* Device State */ + #define POWER_STATE (0 << 4) + #define DEFAULT_STATE (1 << 4) + #define ADDRESS_STATE (2 << 4) + #define CONFIGURATION_STATE (3 << 4) ++#define SUSPENDED_STATE (4 << 4) + + #define CTSQ_MASK (0x7) /* Control Transfer Stage */ + #define IDLE_SETUP_STAGE 0 /* Idle stage or setup stage */ +diff --git a/drivers/usb/renesas_usbhs/mod_gadget.c b/drivers/usb/renesas_usbhs/mod_gadget.c +index 0dedb0d91dcc..b27f2135b66d 100644 +--- a/drivers/usb/renesas_usbhs/mod_gadget.c ++++ b/drivers/usb/renesas_usbhs/mod_gadget.c +@@ -465,12 +465,18 @@ static int usbhsg_irq_dev_state(struct usbhs_priv *priv, + { + struct usbhsg_gpriv *gpriv = usbhsg_priv_to_gpriv(priv); + struct device *dev = usbhsg_gpriv_to_dev(gpriv); ++ int state = usbhs_status_get_device_state(irq_state); + + gpriv->gadget.speed = usbhs_bus_get_speed(priv); + +- dev_dbg(dev, "state = %x : speed : %d\n", +- usbhs_status_get_device_state(irq_state), +- gpriv->gadget.speed); ++ dev_dbg(dev, "state = %x : speed : %d\n", state, gpriv->gadget.speed); ++ ++ if (gpriv->gadget.speed != USB_SPEED_UNKNOWN && ++ (state & SUSPENDED_STATE)) { ++ if (gpriv->driver && gpriv->driver->suspend) ++ gpriv->driver->suspend(&gpriv->gadget); ++ usb_gadget_set_state(&gpriv->gadget, USB_STATE_SUSPENDED); ++ } + + return 0; + } +diff --git a/drivers/usb/usbip/usbip_common.c b/drivers/usb/usbip/usbip_common.c +index da03451328cd..cd01f1e278ee 100644 +--- a/drivers/usb/usbip/usbip_common.c ++++ b/drivers/usb/usbip/usbip_common.c +@@ -742,6 +742,9 @@ int usbip_recv_xbuff(struct usbip_device *ud, struct urb *urb) + + copy -= recv; + ret += recv; ++ ++ if (!copy) ++ break; + } + + if (ret != size) +diff --git a/drivers/usb/usbip/vhci_rx.c b/drivers/usb/usbip/vhci_rx.c +index 3f998b605f03..c13dd526b996 100644 +--- a/drivers/usb/usbip/vhci_rx.c ++++ b/drivers/usb/usbip/vhci_rx.c +@@ -91,16 +91,21 @@ static void vhci_recv_ret_submit(struct vhci_device *vdev, + usbip_pack_pdu(pdu, urb, USBIP_RET_SUBMIT, 0); + + /* recv transfer buffer */ +- if (usbip_recv_xbuff(ud, urb) < 0) +- return; ++ if (usbip_recv_xbuff(ud, urb) < 0) { ++ urb->status = -EPROTO; ++ goto error; ++ } + + /* recv iso_packet_descriptor */ +- if (usbip_recv_iso(ud, urb) < 0) +- return; ++ if (usbip_recv_iso(ud, urb) < 0) { ++ urb->status = -EPROTO; ++ goto error; ++ } + + /* restore the padding in iso packets */ + usbip_pad_iso(ud, urb); + ++error: + if (usbip_dbg_flag_vhci_rx) + usbip_dump_urb(urb); + +diff --git a/fs/btrfs/async-thread.c b/fs/btrfs/async-thread.c +index e00c8a9fd5bb..72d7589072f5 100644 +--- a/fs/btrfs/async-thread.c ++++ b/fs/btrfs/async-thread.c +@@ -265,16 +265,17 @@ out: + } + } + +-static void run_ordered_work(struct __btrfs_workqueue *wq) ++static void run_ordered_work(struct __btrfs_workqueue *wq, ++ struct btrfs_work *self) + { + struct list_head *list = &wq->ordered_list; + struct btrfs_work *work; + spinlock_t *lock = &wq->list_lock; + unsigned long flags; ++ void *wtag; ++ bool free_self = false; + + while (1) { +- void *wtag; +- + spin_lock_irqsave(lock, flags); + if (list_empty(list)) + break; +@@ -300,16 +301,47 @@ static void run_ordered_work(struct __btrfs_workqueue *wq) + list_del(&work->ordered_list); + spin_unlock_irqrestore(lock, flags); + +- /* +- * We don't want to call the ordered free functions with the +- * lock held though. Save the work as tag for the trace event, +- * because the callback could free the structure. +- */ +- wtag = work; +- work->ordered_free(work); +- trace_btrfs_all_work_done(wq->fs_info, wtag); ++ if (work == self) { ++ /* ++ * This is the work item that the worker is currently ++ * executing. ++ * ++ * The kernel workqueue code guarantees non-reentrancy ++ * of work items. I.e., if a work item with the same ++ * address and work function is queued twice, the second ++ * execution is blocked until the first one finishes. A ++ * work item may be freed and recycled with the same ++ * work function; the workqueue code assumes that the ++ * original work item cannot depend on the recycled work ++ * item in that case (see find_worker_executing_work()). ++ * ++ * Note that the work of one Btrfs filesystem may depend ++ * on the work of another Btrfs filesystem via, e.g., a ++ * loop device. Therefore, we must not allow the current ++ * work item to be recycled until we are really done, ++ * otherwise we break the above assumption and can ++ * deadlock. ++ */ ++ free_self = true; ++ } else { ++ /* ++ * We don't want to call the ordered free functions with ++ * the lock held though. Save the work as tag for the ++ * trace event, because the callback could free the ++ * structure. ++ */ ++ wtag = work; ++ work->ordered_free(work); ++ trace_btrfs_all_work_done(wq->fs_info, wtag); ++ } + } + spin_unlock_irqrestore(lock, flags); ++ ++ if (free_self) { ++ wtag = self; ++ self->ordered_free(self); ++ trace_btrfs_all_work_done(wq->fs_info, wtag); ++ } + } + + static void normal_work_helper(struct btrfs_work *work) +@@ -337,7 +369,7 @@ static void normal_work_helper(struct btrfs_work *work) + work->func(work); + if (need_order) { + set_bit(WORK_DONE_BIT, &work->flags); +- run_ordered_work(wq); ++ run_ordered_work(wq, work); + } + if (!need_order) + trace_btrfs_all_work_done(wq->fs_info, wtag); +diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c +index d2263caff307..740ef428acdd 100644 +--- a/fs/btrfs/ctree.c ++++ b/fs/btrfs/ctree.c +@@ -427,7 +427,7 @@ void btrfs_put_tree_mod_seq(struct btrfs_fs_info *fs_info, + for (node = rb_first(tm_root); node; node = next) { + next = rb_next(node); + tm = rb_entry(node, struct tree_mod_elem, node); +- if (tm->seq > min_seq) ++ if (tm->seq >= min_seq) + continue; + rb_erase(node, tm_root); + kfree(tm); +diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c +index 813834552aa1..a8ea56218d6b 100644 +--- a/fs/btrfs/disk-io.c ++++ b/fs/btrfs/disk-io.c +@@ -1679,8 +1679,8 @@ static void end_workqueue_fn(struct btrfs_work *work) + bio->bi_status = end_io_wq->status; + bio->bi_private = end_io_wq->private; + bio->bi_end_io = end_io_wq->end_io; +- kmem_cache_free(btrfs_end_io_wq_cache, end_io_wq); + bio_endio(bio); ++ kmem_cache_free(btrfs_end_io_wq_cache, end_io_wq); + } + + static int cleaner_kthread(void *arg) +diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c +index 4cc534584665..fced434bbddc 100644 +--- a/fs/btrfs/extent_io.c ++++ b/fs/btrfs/extent_io.c +@@ -4949,12 +4949,14 @@ struct extent_buffer *alloc_test_extent_buffer(struct btrfs_fs_info *fs_info, + return eb; + eb = alloc_dummy_extent_buffer(fs_info, start); + if (!eb) +- return NULL; ++ return ERR_PTR(-ENOMEM); + eb->fs_info = fs_info; + again: + ret = radix_tree_preload(GFP_NOFS); +- if (ret) ++ if (ret) { ++ exists = ERR_PTR(ret); + goto free_eb; ++ } + spin_lock(&fs_info->buffer_lock); + ret = radix_tree_insert(&fs_info->buffer_radix, + start >> PAGE_SHIFT, eb); +diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c +index 739f45b04b52..f2dc517768f0 100644 +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -5729,7 +5729,6 @@ static void inode_tree_add(struct inode *inode) + + static void inode_tree_del(struct inode *inode) + { +- struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb); + struct btrfs_root *root = BTRFS_I(inode)->root; + int empty = 0; + +@@ -5742,7 +5741,6 @@ static void inode_tree_del(struct inode *inode) + spin_unlock(&root->inode_lock); + + if (empty && btrfs_root_refs(&root->root_item) == 0) { +- synchronize_srcu(&fs_info->subvol_srcu); + spin_lock(&root->inode_lock); + empty = RB_EMPTY_ROOT(&root->inode_tree); + spin_unlock(&root->inode_lock); +@@ -9820,9 +9818,8 @@ static int btrfs_rename_exchange(struct inode *old_dir, + return -EXDEV; + + /* close the race window with snapshot create/destroy ioctl */ +- if (old_ino == BTRFS_FIRST_FREE_OBJECTID) +- down_read(&fs_info->subvol_sem); +- if (new_ino == BTRFS_FIRST_FREE_OBJECTID) ++ if (old_ino == BTRFS_FIRST_FREE_OBJECTID || ++ new_ino == BTRFS_FIRST_FREE_OBJECTID) + down_read(&fs_info->subvol_sem); + + /* +@@ -10014,9 +10011,8 @@ out_fail: + ret2 = btrfs_end_transaction(trans); + ret = ret ? ret : ret2; + out_notrans: +- if (new_ino == BTRFS_FIRST_FREE_OBJECTID) +- up_read(&fs_info->subvol_sem); +- if (old_ino == BTRFS_FIRST_FREE_OBJECTID) ++ if (new_ino == BTRFS_FIRST_FREE_OBJECTID || ++ old_ino == BTRFS_FIRST_FREE_OBJECTID) + up_read(&fs_info->subvol_sem); + + return ret; +diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c +index dd3b4820ac30..e82b4f3f490c 100644 +--- a/fs/btrfs/ioctl.c ++++ b/fs/btrfs/ioctl.c +@@ -580,12 +580,18 @@ static noinline int create_subvol(struct inode *dir, + + btrfs_i_size_write(BTRFS_I(dir), dir->i_size + namelen * 2); + ret = btrfs_update_inode(trans, root, dir); +- BUG_ON(ret); ++ if (ret) { ++ btrfs_abort_transaction(trans, ret); ++ goto fail; ++ } + + ret = btrfs_add_root_ref(trans, fs_info, + objectid, root->root_key.objectid, + btrfs_ino(BTRFS_I(dir)), index, name, namelen); +- BUG_ON(ret); ++ if (ret) { ++ btrfs_abort_transaction(trans, ret); ++ goto fail; ++ } + + ret = btrfs_uuid_tree_add(trans, fs_info, root_item->uuid, + BTRFS_UUID_KEY_SUBVOL, objectid); +diff --git a/fs/btrfs/reada.c b/fs/btrfs/reada.c +index 3a4e15b39cc1..440c0d5d2050 100644 +--- a/fs/btrfs/reada.c ++++ b/fs/btrfs/reada.c +@@ -734,21 +734,19 @@ static int reada_start_machine_dev(struct btrfs_device *dev) + static void reada_start_machine_worker(struct btrfs_work *work) + { + struct reada_machine_work *rmw; +- struct btrfs_fs_info *fs_info; + int old_ioprio; + + rmw = container_of(work, struct reada_machine_work, work); +- fs_info = rmw->fs_info; +- +- kfree(rmw); + + old_ioprio = IOPRIO_PRIO_VALUE(task_nice_ioclass(current), + task_nice_ioprio(current)); + set_task_ioprio(current, BTRFS_IOPRIO_READA); +- __reada_start_machine(fs_info); ++ __reada_start_machine(rmw->fs_info); + set_task_ioprio(current, old_ioprio); + +- atomic_dec(&fs_info->reada_works_cnt); ++ atomic_dec(&rmw->fs_info->reada_works_cnt); ++ ++ kfree(rmw); + } + + static void __reada_start_machine(struct btrfs_fs_info *fs_info) +diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c +index 9fa6db6a6f7d..d4c00edd16d2 100644 +--- a/fs/btrfs/relocation.c ++++ b/fs/btrfs/relocation.c +@@ -4587,6 +4587,7 @@ int btrfs_recover_relocation(struct btrfs_root *root) + fs_root = read_fs_root(fs_info, reloc_root->root_key.offset); + if (IS_ERR(fs_root)) { + err = PTR_ERR(fs_root); ++ list_add_tail(&reloc_root->root_list, &reloc_roots); + goto out_free; + } + +diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c +index 61192c536e6c..2ebae9773978 100644 +--- a/fs/btrfs/scrub.c ++++ b/fs/btrfs/scrub.c +@@ -2421,14 +2421,13 @@ static void scrub_missing_raid56_worker(struct btrfs_work *work) + scrub_write_block_to_dev_replace(sblock); + } + +- scrub_block_put(sblock); +- + if (sctx->is_dev_replace && sctx->flush_all_writes) { + mutex_lock(&sctx->wr_lock); + scrub_wr_submit(sctx); + mutex_unlock(&sctx->wr_lock); + } + ++ scrub_block_put(sblock); + scrub_pending_bio_dec(sctx); + } + +diff --git a/fs/btrfs/tests/free-space-tree-tests.c b/fs/btrfs/tests/free-space-tree-tests.c +index 8444a018cca2..f6c783e959b7 100644 +--- a/fs/btrfs/tests/free-space-tree-tests.c ++++ b/fs/btrfs/tests/free-space-tree-tests.c +@@ -475,9 +475,9 @@ static int run_test(test_func_t test_func, int bitmaps, u32 sectorsize, + root->fs_info->tree_root = root; + + root->node = alloc_test_extent_buffer(root->fs_info, nodesize); +- if (!root->node) { +- test_msg("Couldn't allocate dummy buffer\n"); +- ret = -ENOMEM; ++ if (IS_ERR(root->node)) { ++ test_msg("couldn't allocate dummy buffer\n"); ++ ret = PTR_ERR(root->node); + goto out; + } + btrfs_set_header_level(root->node, 0); +diff --git a/fs/btrfs/tests/qgroup-tests.c b/fs/btrfs/tests/qgroup-tests.c +index 578fd045e859..eb72cf280546 100644 +--- a/fs/btrfs/tests/qgroup-tests.c ++++ b/fs/btrfs/tests/qgroup-tests.c +@@ -487,9 +487,9 @@ int btrfs_test_qgroups(u32 sectorsize, u32 nodesize) + * *cough*backref walking code*cough* + */ + root->node = alloc_test_extent_buffer(root->fs_info, nodesize); +- if (!root->node) { ++ if (IS_ERR(root->node)) { + test_msg("Couldn't allocate dummy buffer\n"); +- ret = -ENOMEM; ++ ret = PTR_ERR(root->node); + goto out; + } + btrfs_set_header_level(root->node, 0); +diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c +index e35301e5fe8e..98c397eb054c 100644 +--- a/fs/btrfs/tree-log.c ++++ b/fs/btrfs/tree-log.c +@@ -6018,9 +6018,28 @@ again: + wc.replay_dest = btrfs_read_fs_root_no_name(fs_info, &tmp_key); + if (IS_ERR(wc.replay_dest)) { + ret = PTR_ERR(wc.replay_dest); ++ ++ /* ++ * We didn't find the subvol, likely because it was ++ * deleted. This is ok, simply skip this log and go to ++ * the next one. ++ * ++ * We need to exclude the root because we can't have ++ * other log replays overwriting this log as we'll read ++ * it back in a few more times. This will keep our ++ * block from being modified, and we'll just bail for ++ * each subsequent pass. ++ */ ++ if (ret == -ENOENT) ++ ret = btrfs_pin_extent_for_log_replay(fs_info, ++ log->node->start, ++ log->node->len); + free_extent_buffer(log->node); + free_extent_buffer(log->commit_root); + kfree(log); ++ ++ if (!ret) ++ goto next; + btrfs_handle_fs_error(fs_info, ret, + "Couldn't read target root for tree log recovery."); + goto error; +@@ -6052,7 +6071,6 @@ again: + &root->highest_objectid); + } + +- key.offset = found_key.offset - 1; + wc.replay_dest->log_root = NULL; + free_extent_buffer(log->node); + free_extent_buffer(log->commit_root); +@@ -6060,9 +6078,10 @@ again: + + if (ret) + goto error; +- ++next: + if (found_key.offset == 0) + break; ++ key.offset = found_key.offset - 1; + } + btrfs_release_path(path); + +diff --git a/fs/btrfs/uuid-tree.c b/fs/btrfs/uuid-tree.c +index 726f928238d0..331f3a1ad23b 100644 +--- a/fs/btrfs/uuid-tree.c ++++ b/fs/btrfs/uuid-tree.c +@@ -336,6 +336,8 @@ again_search_slot: + } + if (ret < 0 && ret != -ENOENT) + goto out; ++ key.offset++; ++ goto again_search_slot; + } + item_size -= sizeof(subid_le); + offset += sizeof(subid_le); +diff --git a/fs/ext4/dir.c b/fs/ext4/dir.c +index 446b6c375b6f..c17855fead7b 100644 +--- a/fs/ext4/dir.c ++++ b/fs/ext4/dir.c +@@ -76,6 +76,11 @@ int __ext4_check_dir_entry(const char *function, unsigned int line, + error_msg = "rec_len is too small for name_len"; + else if (unlikely(((char *) de - buf) + rlen > size)) + error_msg = "directory entry overrun"; ++ else if (unlikely(((char *) de - buf) + rlen > ++ size - EXT4_DIR_REC_LEN(1) && ++ ((char *) de - buf) + rlen != size)) { ++ error_msg = "directory entry too close to block end"; ++ } + else if (unlikely(le32_to_cpu(de->inode) > + le32_to_cpu(EXT4_SB(dir->i_sb)->s_es->s_inodes_count))) + error_msg = "inode out of bounds"; +diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c +index 11bc4c69bf16..c2920cbfa3bf 100644 +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -5874,7 +5874,7 @@ int ext4_expand_extra_isize(struct inode *inode, + error = ext4_journal_get_write_access(handle, iloc->bh); + if (error) { + brelse(iloc->bh); +- goto out_stop; ++ goto out_unlock; + } + + error = __ext4_expand_extra_isize(inode, new_extra_isize, iloc, +@@ -5884,8 +5884,8 @@ int ext4_expand_extra_isize(struct inode *inode, + if (!error) + error = rc; + ++out_unlock: + ext4_write_unlock_xattr(inode, &no_expand); +-out_stop: + ext4_journal_stop(handle); + return error; + } +diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c +index b4e0c270def4..0b5c36bd5418 100644 +--- a/fs/ext4/namei.c ++++ b/fs/ext4/namei.c +@@ -2702,7 +2702,7 @@ bool ext4_empty_dir(struct inode *inode) + { + unsigned int offset; + struct buffer_head *bh; +- struct ext4_dir_entry_2 *de, *de1; ++ struct ext4_dir_entry_2 *de; + struct super_block *sb; + + if (ext4_has_inline_data(inode)) { +@@ -2727,19 +2727,25 @@ bool ext4_empty_dir(struct inode *inode) + return true; + + de = (struct ext4_dir_entry_2 *) bh->b_data; +- de1 = ext4_next_entry(de, sb->s_blocksize); +- if (le32_to_cpu(de->inode) != inode->i_ino || +- le32_to_cpu(de1->inode) == 0 || +- strcmp(".", de->name) || strcmp("..", de1->name)) { +- ext4_warning_inode(inode, "directory missing '.' and/or '..'"); ++ if (ext4_check_dir_entry(inode, NULL, de, bh, bh->b_data, bh->b_size, ++ 0) || ++ le32_to_cpu(de->inode) != inode->i_ino || strcmp(".", de->name)) { ++ ext4_warning_inode(inode, "directory missing '.'"); ++ brelse(bh); ++ return true; ++ } ++ offset = ext4_rec_len_from_disk(de->rec_len, sb->s_blocksize); ++ de = ext4_next_entry(de, sb->s_blocksize); ++ if (ext4_check_dir_entry(inode, NULL, de, bh, bh->b_data, bh->b_size, ++ offset) || ++ le32_to_cpu(de->inode) == 0 || strcmp("..", de->name)) { ++ ext4_warning_inode(inode, "directory missing '..'"); + brelse(bh); + return true; + } +- offset = ext4_rec_len_from_disk(de->rec_len, sb->s_blocksize) + +- ext4_rec_len_from_disk(de1->rec_len, sb->s_blocksize); +- de = ext4_next_entry(de1, sb->s_blocksize); ++ offset += ext4_rec_len_from_disk(de->rec_len, sb->s_blocksize); + while (offset < inode->i_size) { +- if ((void *) de >= (void *) (bh->b_data+sb->s_blocksize)) { ++ if (!(offset & (sb->s_blocksize - 1))) { + unsigned int lblock; + brelse(bh); + lblock = offset >> EXT4_BLOCK_SIZE_BITS(sb); +@@ -2750,12 +2756,11 @@ bool ext4_empty_dir(struct inode *inode) + } + if (IS_ERR(bh)) + return true; +- de = (struct ext4_dir_entry_2 *) bh->b_data; + } ++ de = (struct ext4_dir_entry_2 *) (bh->b_data + ++ (offset & (sb->s_blocksize - 1))); + if (ext4_check_dir_entry(inode, NULL, de, bh, + bh->b_data, bh->b_size, offset)) { +- de = (struct ext4_dir_entry_2 *)(bh->b_data + +- sb->s_blocksize); + offset = (offset | (sb->s_blocksize - 1)) + 1; + continue; + } +@@ -2764,7 +2769,6 @@ bool ext4_empty_dir(struct inode *inode) + return false; + } + offset += ext4_rec_len_from_disk(de->rec_len, sb->s_blocksize); +- de = ext4_next_entry(de, sb->s_blocksize); + } + brelse(bh); + return true; +diff --git a/include/drm/drm_dp_mst_helper.h b/include/drm/drm_dp_mst_helper.h +index d55abb75f29a..eec6cba204ea 100644 +--- a/include/drm/drm_dp_mst_helper.h ++++ b/include/drm/drm_dp_mst_helper.h +@@ -313,7 +313,7 @@ struct drm_dp_resource_status_notify { + + struct drm_dp_query_payload_ack_reply { + u8 port_number; +- u8 allocated_pbn; ++ u16 allocated_pbn; + }; + + struct drm_dp_sideband_msg_req_body { +diff --git a/include/linux/miscdevice.h b/include/linux/miscdevice.h +index 4de703d9e21f..5e1e50b8f8c4 100644 +--- a/include/linux/miscdevice.h ++++ b/include/linux/miscdevice.h +@@ -56,6 +56,7 @@ + #define UHID_MINOR 239 + #define USERIO_MINOR 240 + #define VHOST_VSOCK_MINOR 241 ++#define RFKILL_MINOR 242 + #define MISC_DYNAMIC_MINOR 255 + + struct device; +diff --git a/include/linux/mod_devicetable.h b/include/linux/mod_devicetable.h +index 1c2e8d6b7274..6db347b58644 100644 +--- a/include/linux/mod_devicetable.h ++++ b/include/linux/mod_devicetable.h +@@ -519,9 +519,9 @@ struct platform_device_id { + #define MDIO_NAME_SIZE 32 + #define MDIO_MODULE_PREFIX "mdio:" + +-#define MDIO_ID_FMT "%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d" ++#define MDIO_ID_FMT "%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u" + #define MDIO_ID_ARGS(_id) \ +- (_id)>>31, ((_id)>>30) & 1, ((_id)>>29) & 1, ((_id)>>28) & 1, \ ++ ((_id)>>31) & 1, ((_id)>>30) & 1, ((_id)>>29) & 1, ((_id)>>28) & 1, \ + ((_id)>>27) & 1, ((_id)>>26) & 1, ((_id)>>25) & 1, ((_id)>>24) & 1, \ + ((_id)>>23) & 1, ((_id)>>22) & 1, ((_id)>>21) & 1, ((_id)>>20) & 1, \ + ((_id)>>19) & 1, ((_id)>>18) & 1, ((_id)>>17) & 1, ((_id)>>16) & 1, \ +diff --git a/include/net/dst.h b/include/net/dst.h +index 2acd670fc86b..fe230dd62c28 100644 +--- a/include/net/dst.h ++++ b/include/net/dst.h +@@ -110,7 +110,7 @@ struct dst_entry { + struct dst_metrics { + u32 metrics[RTAX_MAX]; + refcount_t refcnt; +-}; ++} __aligned(4); /* Low pointer bits contain DST_METRICS_FLAGS */ + extern const struct dst_metrics dst_default_metrics; + + u32 *dst_cow_metrics_generic(struct dst_entry *dst, unsigned long old); +diff --git a/include/trace/events/wbt.h b/include/trace/events/wbt.h +index b048694070e2..37342a13c9cb 100644 +--- a/include/trace/events/wbt.h ++++ b/include/trace/events/wbt.h +@@ -33,7 +33,8 @@ TRACE_EVENT(wbt_stat, + ), + + TP_fast_assign( +- strncpy(__entry->name, dev_name(bdi->dev), 32); ++ strlcpy(__entry->name, dev_name(bdi->dev), ++ ARRAY_SIZE(__entry->name)); + __entry->rmean = stat[0].mean; + __entry->rmin = stat[0].min; + __entry->rmax = stat[0].max; +@@ -67,7 +68,8 @@ TRACE_EVENT(wbt_lat, + ), + + TP_fast_assign( +- strncpy(__entry->name, dev_name(bdi->dev), 32); ++ strlcpy(__entry->name, dev_name(bdi->dev), ++ ARRAY_SIZE(__entry->name)); + __entry->lat = div_u64(lat, 1000); + ), + +@@ -103,7 +105,8 @@ TRACE_EVENT(wbt_step, + ), + + TP_fast_assign( +- strncpy(__entry->name, dev_name(bdi->dev), 32); ++ strlcpy(__entry->name, dev_name(bdi->dev), ++ ARRAY_SIZE(__entry->name)); + __entry->msg = msg; + __entry->step = step; + __entry->window = div_u64(window, 1000); +@@ -138,7 +141,8 @@ TRACE_EVENT(wbt_timer, + ), + + TP_fast_assign( +- strncpy(__entry->name, dev_name(bdi->dev), 32); ++ strlcpy(__entry->name, dev_name(bdi->dev), ++ ARRAY_SIZE(__entry->name)); + __entry->status = status; + __entry->step = step; + __entry->inflight = inflight; +diff --git a/include/uapi/linux/cec-funcs.h b/include/uapi/linux/cec-funcs.h +index 28e8a2a86e16..2a114f7a24d4 100644 +--- a/include/uapi/linux/cec-funcs.h ++++ b/include/uapi/linux/cec-funcs.h +@@ -952,7 +952,8 @@ static inline void cec_msg_give_deck_status(struct cec_msg *msg, + msg->len = 3; + msg->msg[1] = CEC_MSG_GIVE_DECK_STATUS; + msg->msg[2] = status_req; +- msg->reply = reply ? CEC_MSG_DECK_STATUS : 0; ++ msg->reply = (reply && status_req != CEC_OP_STATUS_REQ_OFF) ? ++ CEC_MSG_DECK_STATUS : 0; + } + + static inline void cec_ops_give_deck_status(const struct cec_msg *msg, +@@ -1056,7 +1057,8 @@ static inline void cec_msg_give_tuner_device_status(struct cec_msg *msg, + msg->len = 3; + msg->msg[1] = CEC_MSG_GIVE_TUNER_DEVICE_STATUS; + msg->msg[2] = status_req; +- msg->reply = reply ? CEC_MSG_TUNER_DEVICE_STATUS : 0; ++ msg->reply = (reply && status_req != CEC_OP_STATUS_REQ_OFF) ? ++ CEC_MSG_TUNER_DEVICE_STATUS : 0; + } + + static inline void cec_ops_give_tuner_device_status(const struct cec_msg *msg, +diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c +index 6bc679cd3481..ff80a9d41ce1 100644 +--- a/net/bluetooth/hci_core.c ++++ b/net/bluetooth/hci_core.c +@@ -802,8 +802,8 @@ static int hci_init4_req(struct hci_request *req, unsigned long opt) + if (hdev->le_features[0] & HCI_LE_DATA_LEN_EXT) { + struct hci_cp_le_write_def_data_len cp; + +- cp.tx_len = hdev->le_max_tx_len; +- cp.tx_time = hdev->le_max_tx_time; ++ cp.tx_len = cpu_to_le16(hdev->le_max_tx_len); ++ cp.tx_time = cpu_to_le16(hdev->le_max_tx_time); + hci_req_add(req, HCI_OP_LE_WRITE_DEF_DATA_LEN, sizeof(cp), &cp); + } + +@@ -4215,7 +4215,14 @@ static void hci_rx_work(struct work_struct *work) + hci_send_to_sock(hdev, skb); + } + +- if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) { ++ /* If the device has been opened in HCI_USER_CHANNEL, ++ * the userspace has exclusive access to device. ++ * When device is HCI_INIT, we still need to process ++ * the data packets to the driver in order ++ * to complete its setup(). ++ */ ++ if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL) && ++ !test_bit(HCI_INIT, &hdev->flags)) { + kfree_skb(skb); + continue; + } +diff --git a/net/bluetooth/hci_request.c b/net/bluetooth/hci_request.c +index b73ac149de34..759329bec399 100644 +--- a/net/bluetooth/hci_request.c ++++ b/net/bluetooth/hci_request.c +@@ -1095,6 +1095,14 @@ static u8 create_instance_adv_data(struct hci_dev *hdev, u8 instance, u8 *ptr) + + instance_flags = get_adv_instance_flags(hdev, instance); + ++ /* If instance already has the flags set skip adding it once ++ * again. ++ */ ++ if (adv_instance && eir_get_data(adv_instance->adv_data, ++ adv_instance->adv_data_len, EIR_FLAGS, ++ NULL)) ++ goto skip_flags; ++ + /* The Add Advertising command allows userspace to set both the general + * and limited discoverable flags. + */ +@@ -1127,6 +1135,7 @@ static u8 create_instance_adv_data(struct hci_dev *hdev, u8 instance, u8 *ptr) + } + } + ++skip_flags: + if (adv_instance) { + memcpy(ptr, adv_instance->adv_data, + adv_instance->adv_data_len); +diff --git a/net/mac80211/status.c b/net/mac80211/status.c +index b18466cf466c..fbe7354aeac7 100644 +--- a/net/mac80211/status.c ++++ b/net/mac80211/status.c +@@ -856,7 +856,8 @@ static void __ieee80211_tx_status(struct ieee80211_hw *hw, + I802_DEBUG_INC(local->dot11FailedCount); + } + +- if (ieee80211_is_nullfunc(fc) && ieee80211_has_pm(fc) && ++ if ((ieee80211_is_nullfunc(fc) || ieee80211_is_qos_nullfunc(fc)) && ++ ieee80211_has_pm(fc) && + ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS) && + !(info->flags & IEEE80211_TX_CTL_INJECTED) && + local->ps_sdata && !(local->scanning)) { +diff --git a/net/nfc/nci/uart.c b/net/nfc/nci/uart.c +index 8d104c1db628..6f5addb5225c 100644 +--- a/net/nfc/nci/uart.c ++++ b/net/nfc/nci/uart.c +@@ -348,7 +348,7 @@ static int nci_uart_default_recv_buf(struct nci_uart *nu, const u8 *data, + nu->rx_packet_len = -1; + nu->rx_skb = nci_skb_alloc(nu->ndev, + NCI_MAX_PACKET_SIZE, +- GFP_KERNEL); ++ GFP_ATOMIC); + if (!nu->rx_skb) + return -ENOMEM; + } +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index 1f86bf0d1649..4e1058159b08 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -593,7 +593,8 @@ static int prb_calc_retire_blk_tmo(struct packet_sock *po, + msec = 1; + div = ecmd.base.speed / 1000; + } +- } ++ } else ++ return DEFAULT_PRB_RETIRE_TOV; + + mbits = (blk_size_in_bytes * 8) / (1024 * 1024); + +diff --git a/net/rfkill/core.c b/net/rfkill/core.c +index 2064c3a35ef8..99a2e55b01cf 100644 +--- a/net/rfkill/core.c ++++ b/net/rfkill/core.c +@@ -1312,10 +1312,12 @@ static const struct file_operations rfkill_fops = { + .llseek = no_llseek, + }; + ++#define RFKILL_NAME "rfkill" ++ + static struct miscdevice rfkill_miscdev = { +- .name = "rfkill", + .fops = &rfkill_fops, +- .minor = MISC_DYNAMIC_MINOR, ++ .name = RFKILL_NAME, ++ .minor = RFKILL_MINOR, + }; + + static int __init rfkill_init(void) +@@ -1367,3 +1369,6 @@ static void __exit rfkill_exit(void) + class_unregister(&rfkill_class); + } + module_exit(rfkill_exit); ++ ++MODULE_ALIAS_MISCDEV(RFKILL_MINOR); ++MODULE_ALIAS("devname:" RFKILL_NAME); +diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c +index 01f88e9abbc6..bf39f317953a 100644 +--- a/net/sctp/protocol.c ++++ b/net/sctp/protocol.c +@@ -253,6 +253,7 @@ static void sctp_v4_from_skb(union sctp_addr *addr, struct sk_buff *skb, + sa->sin_port = sh->dest; + sa->sin_addr.s_addr = ip_hdr(skb)->daddr; + } ++ memset(sa->sin_zero, 0, sizeof(sa->sin_zero)); + } + + /* Initialize an sctp_addr from a socket. */ +@@ -261,6 +262,7 @@ static void sctp_v4_from_sk(union sctp_addr *addr, struct sock *sk) + addr->v4.sin_family = AF_INET; + addr->v4.sin_port = 0; + addr->v4.sin_addr.s_addr = inet_sk(sk)->inet_rcv_saddr; ++ memset(addr->v4.sin_zero, 0, sizeof(addr->v4.sin_zero)); + } + + /* Initialize sk->sk_rcv_saddr from sctp_addr. */ +@@ -283,6 +285,7 @@ static void sctp_v4_from_addr_param(union sctp_addr *addr, + addr->v4.sin_family = AF_INET; + addr->v4.sin_port = port; + addr->v4.sin_addr.s_addr = param->v4.addr.s_addr; ++ memset(addr->v4.sin_zero, 0, sizeof(addr->v4.sin_zero)); + } + + /* Initialize an address parameter from a sctp_addr and return the length +@@ -307,6 +310,7 @@ static void sctp_v4_dst_saddr(union sctp_addr *saddr, struct flowi4 *fl4, + saddr->v4.sin_family = AF_INET; + saddr->v4.sin_port = port; + saddr->v4.sin_addr.s_addr = fl4->saddr; ++ memset(saddr->v4.sin_zero, 0, sizeof(saddr->v4.sin_zero)); + } + + /* Compare two addresses exactly. */ +@@ -329,6 +333,7 @@ static void sctp_v4_inaddr_any(union sctp_addr *addr, __be16 port) + addr->v4.sin_family = AF_INET; + addr->v4.sin_addr.s_addr = htonl(INADDR_ANY); + addr->v4.sin_port = port; ++ memset(addr->v4.sin_zero, 0, sizeof(addr->v4.sin_zero)); + } + + /* Is this a wildcard address? */ +diff --git a/samples/bpf/cgroup_helpers.c b/samples/bpf/cgroup_helpers.c +index 09afaddfc9ba..b5c09cd6c7bd 100644 +--- a/samples/bpf/cgroup_helpers.c ++++ b/samples/bpf/cgroup_helpers.c +@@ -43,7 +43,7 @@ + */ + int setup_cgroup_environment(void) + { +- char cgroup_workdir[PATH_MAX + 1]; ++ char cgroup_workdir[PATH_MAX - 24]; + + format_cgroup_path(cgroup_workdir, ""); + +diff --git a/samples/pktgen/functions.sh b/samples/pktgen/functions.sh +index 205e4cde4601..065a7e296ee3 100644 +--- a/samples/pktgen/functions.sh ++++ b/samples/pktgen/functions.sh +@@ -5,6 +5,8 @@ + # Author: Jesper Dangaaard Brouer + # License: GPL + ++set -o errexit ++ + ## -- General shell logging cmds -- + function err() { + local exitcode=$1 +@@ -58,6 +60,7 @@ function pg_set() { + function proc_cmd() { + local result + local proc_file=$1 ++ local status=0 + # after shift, the remaining args are contained in $@ + shift + local proc_ctrl=${PROC_DIR}/$proc_file +@@ -73,13 +76,13 @@ function proc_cmd() { + echo "cmd: $@ > $proc_ctrl" + fi + # Quoting of "$@" is important for space expansion +- echo "$@" > "$proc_ctrl" +- local status=$? ++ echo "$@" > "$proc_ctrl" || status=$? + +- result=$(grep "Result: OK:" $proc_ctrl) +- # Due to pgctrl, cannot use exit code $? from grep +- if [[ "$result" == "" ]]; then +- grep "Result:" $proc_ctrl >&2 ++ if [[ "$proc_file" != "pgctrl" ]]; then ++ result=$(grep "Result: OK:" $proc_ctrl) || true ++ if [[ "$result" == "" ]]; then ++ grep "Result:" $proc_ctrl >&2 ++ fi + fi + if (( $status != 0 )); then + err 5 "Write error($status) occurred cmd: \"$@ > $proc_ctrl\"" +@@ -105,6 +108,8 @@ function pgset() { + fi + } + ++[[ $EUID -eq 0 ]] && trap 'pg_ctrl "reset"' EXIT ++ + ## -- General shell tricks -- + + function root_check_run_with_sudo() { +diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c +index 182e4afd21eb..14b1ee29509d 100644 +--- a/sound/core/pcm_native.c ++++ b/sound/core/pcm_native.c +@@ -720,6 +720,10 @@ static int snd_pcm_hw_params(struct snd_pcm_substream *substream, + while (runtime->boundary * 2 <= LONG_MAX - runtime->buffer_size) + runtime->boundary *= 2; + ++ /* clear the buffer for avoiding possible kernel info leaks */ ++ if (runtime->dma_area && !substream->ops->copy_user) ++ memset(runtime->dma_area, 0, runtime->dma_bytes); ++ + snd_pcm_timer_resolution_change(substream); + snd_pcm_set_state(substream, SNDRV_PCM_STATE_SETUP); + +diff --git a/sound/core/timer.c b/sound/core/timer.c +index c60dfd52e8a6..22589a073423 100644 +--- a/sound/core/timer.c ++++ b/sound/core/timer.c +@@ -88,6 +88,9 @@ static LIST_HEAD(snd_timer_slave_list); + /* lock for slave active lists */ + static DEFINE_SPINLOCK(slave_active_lock); + ++#define MAX_SLAVE_INSTANCES 1000 ++static int num_slaves; ++ + static DEFINE_MUTEX(register_mutex); + + static int snd_timer_free(struct snd_timer *timer); +@@ -266,6 +269,10 @@ int snd_timer_open(struct snd_timer_instance **ti, + err = -EINVAL; + goto unlock; + } ++ if (num_slaves >= MAX_SLAVE_INSTANCES) { ++ err = -EBUSY; ++ goto unlock; ++ } + timeri = snd_timer_instance_new(owner, NULL); + if (!timeri) { + err = -ENOMEM; +@@ -275,6 +282,7 @@ int snd_timer_open(struct snd_timer_instance **ti, + timeri->slave_id = tid->device; + timeri->flags |= SNDRV_TIMER_IFLG_SLAVE; + list_add_tail(&timeri->open_list, &snd_timer_slave_list); ++ num_slaves++; + err = snd_timer_check_slave(timeri); + if (err < 0) { + snd_timer_close_locked(timeri, &card_dev_to_put); +@@ -364,6 +372,8 @@ static int snd_timer_close_locked(struct snd_timer_instance *timeri, + struct snd_timer_instance *slave, *tmp; + + list_del(&timeri->open_list); ++ if (timeri->flags & SNDRV_TIMER_IFLG_SLAVE) ++ num_slaves--; + + /* force to stop the timer */ + snd_timer_stop(timeri); +diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c +index 9876d8dc2ede..92f5f452bee2 100644 +--- a/sound/pci/hda/patch_ca0132.c ++++ b/sound/pci/hda/patch_ca0132.c +@@ -1300,13 +1300,14 @@ struct scp_msg { + + static void dspio_clear_response_queue(struct hda_codec *codec) + { ++ unsigned long timeout = jiffies + msecs_to_jiffies(1000); + unsigned int dummy = 0; +- int status = -1; ++ int status; + + /* clear all from the response queue */ + do { + status = dspio_read(codec, &dummy); +- } while (status == 0); ++ } while (status == 0 && time_before(jiffies, timeout)); + } + + static int dspio_get_response_data(struct hda_codec *codec) +@@ -4424,12 +4425,14 @@ static void ca0132_process_dsp_response(struct hda_codec *codec, + struct ca0132_spec *spec = codec->spec; + + codec_dbg(codec, "ca0132_process_dsp_response\n"); ++ snd_hda_power_up_pm(codec); + if (spec->wait_scp) { + if (dspio_get_response_data(codec) >= 0) + spec->wait_scp = 0; + } + + dspio_clear_response_queue(codec); ++ snd_hda_power_down_pm(codec); + } + + static void hp_callback(struct hda_codec *codec, struct hda_jack_callback *cb) +diff --git a/sound/soc/codecs/rt5677.c b/sound/soc/codecs/rt5677.c +index 1cd20b88a3a9..82ee8f4b965b 100644 +--- a/sound/soc/codecs/rt5677.c ++++ b/sound/soc/codecs/rt5677.c +@@ -297,6 +297,7 @@ static bool rt5677_volatile_register(struct device *dev, unsigned int reg) + case RT5677_I2C_MASTER_CTRL7: + case RT5677_I2C_MASTER_CTRL8: + case RT5677_HAP_GENE_CTRL2: ++ case RT5677_PWR_ANLG2: /* Modified by DSP firmware */ + case RT5677_PWR_DSP_ST: + case RT5677_PRIV_DATA: + case RT5677_ASRC_22: +diff --git a/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c b/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c +index 41cb1fefbd42..405196283688 100644 +--- a/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c ++++ b/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c +@@ -422,6 +422,9 @@ static int kabylake_dmic_startup(struct snd_pcm_substream *substream) + snd_pcm_hw_constraint_list(runtime, 0, SNDRV_PCM_HW_PARAM_CHANNELS, + dmic_constraints); + ++ runtime->hw.formats = SNDRV_PCM_FMTBIT_S16_LE; ++ snd_pcm_hw_constraint_msbits(runtime, 0, 16, 16); ++ + return snd_pcm_hw_constraint_list(substream->runtime, 0, + SNDRV_PCM_HW_PARAM_RATE, &constraints_rates); + } +diff --git a/tools/lib/subcmd/Makefile b/tools/lib/subcmd/Makefile +index 5b2cd5e58df0..5dbb0dde208c 100644 +--- a/tools/lib/subcmd/Makefile ++++ b/tools/lib/subcmd/Makefile +@@ -28,7 +28,9 @@ ifeq ($(DEBUG),0) + endif + endif + +-ifeq ($(CC_NO_CLANG), 0) ++ifeq ($(DEBUG),1) ++ CFLAGS += -O0 ++else ifeq ($(CC_NO_CLANG), 0) + CFLAGS += -O3 + else + CFLAGS += -O6 +diff --git a/tools/lib/traceevent/parse-filter.c b/tools/lib/traceevent/parse-filter.c +index 5e10ba796a6f..569bceff5f51 100644 +--- a/tools/lib/traceevent/parse-filter.c ++++ b/tools/lib/traceevent/parse-filter.c +@@ -1492,8 +1492,10 @@ static int copy_filter_type(struct event_filter *filter, + if (strcmp(str, "TRUE") == 0 || strcmp(str, "FALSE") == 0) { + /* Add trivial event */ + arg = allocate_arg(); +- if (arg == NULL) ++ if (arg == NULL) { ++ free(str); + return -1; ++ } + + arg->type = FILTER_ARG_BOOLEAN; + if (strcmp(str, "TRUE") == 0) +@@ -1502,8 +1504,11 @@ static int copy_filter_type(struct event_filter *filter, + arg->boolean.value = 0; + + filter_type = add_filter_type(filter, event->id); +- if (filter_type == NULL) ++ if (filter_type == NULL) { ++ free(str); ++ free_arg(arg); + return -1; ++ } + + filter_type->filter = arg; + +diff --git a/tools/objtool/arch/x86/lib/x86-opcode-map.txt b/tools/objtool/arch/x86/lib/x86-opcode-map.txt +index e0b85930dd77..0a0e9112f284 100644 +--- a/tools/objtool/arch/x86/lib/x86-opcode-map.txt ++++ b/tools/objtool/arch/x86/lib/x86-opcode-map.txt +@@ -333,7 +333,7 @@ AVXcode: 1 + 06: CLTS + 07: SYSRET (o64) + 08: INVD +-09: WBINVD ++09: WBINVD | WBNOINVD (F3) + 0a: + 0b: UD2 (1B) + 0c: +@@ -364,7 +364,7 @@ AVXcode: 1 + # a ModR/M byte. + 1a: BNDCL Gv,Ev (F3) | BNDCU Gv,Ev (F2) | BNDMOV Gv,Ev (66) | BNDLDX Gv,Ev + 1b: BNDCN Gv,Ev (F2) | BNDMOV Ev,Gv (66) | BNDMK Gv,Ev (F3) | BNDSTX Ev,Gv +-1c: ++1c: Grp20 (1A),(1C) + 1d: + 1e: + 1f: NOP Ev +@@ -792,6 +792,8 @@ f3: Grp17 (1A) + f5: BZHI Gy,Ey,By (v) | PEXT Gy,By,Ey (F3),(v) | PDEP Gy,By,Ey (F2),(v) + f6: ADCX Gy,Ey (66) | ADOX Gy,Ey (F3) | MULX By,Gy,rDX,Ey (F2),(v) + f7: BEXTR Gy,Ey,By (v) | SHLX Gy,Ey,By (66),(v) | SARX Gy,Ey,By (F3),(v) | SHRX Gy,Ey,By (F2),(v) ++f8: MOVDIR64B Gv,Mdqq (66) | ENQCMD Gv,Mdqq (F2) | ENQCMDS Gv,Mdqq (F3) ++f9: MOVDIRI My,Gy + EndTable + + Table: 3-byte opcode 2 (0x0f 0x3a) +@@ -943,9 +945,9 @@ GrpTable: Grp6 + EndTable + + GrpTable: Grp7 +-0: SGDT Ms | VMCALL (001),(11B) | VMLAUNCH (010),(11B) | VMRESUME (011),(11B) | VMXOFF (100),(11B) +-1: SIDT Ms | MONITOR (000),(11B) | MWAIT (001),(11B) | CLAC (010),(11B) | STAC (011),(11B) +-2: LGDT Ms | XGETBV (000),(11B) | XSETBV (001),(11B) | VMFUNC (100),(11B) | XEND (101)(11B) | XTEST (110)(11B) ++0: SGDT Ms | VMCALL (001),(11B) | VMLAUNCH (010),(11B) | VMRESUME (011),(11B) | VMXOFF (100),(11B) | PCONFIG (101),(11B) | ENCLV (000),(11B) ++1: SIDT Ms | MONITOR (000),(11B) | MWAIT (001),(11B) | CLAC (010),(11B) | STAC (011),(11B) | ENCLS (111),(11B) ++2: LGDT Ms | XGETBV (000),(11B) | XSETBV (001),(11B) | VMFUNC (100),(11B) | XEND (101)(11B) | XTEST (110)(11B) | ENCLU (111),(11B) + 3: LIDT Ms + 4: SMSW Mw/Rv + 5: rdpkru (110),(11B) | wrpkru (111),(11B) +@@ -1020,7 +1022,7 @@ GrpTable: Grp15 + 3: vstmxcsr Md (v1) | WRGSBASE Ry (F3),(11B) + 4: XSAVE | ptwrite Ey (F3),(11B) + 5: XRSTOR | lfence (11B) +-6: XSAVEOPT | clwb (66) | mfence (11B) ++6: XSAVEOPT | clwb (66) | mfence (11B) | TPAUSE Rd (66),(11B) | UMONITOR Rv (F3),(11B) | UMWAIT Rd (F2),(11B) + 7: clflush | clflushopt (66) | sfence (11B) + EndTable + +@@ -1051,6 +1053,10 @@ GrpTable: Grp19 + 6: vscatterpf1qps/d Wx (66),(ev) + EndTable + ++GrpTable: Grp20 ++0: cldemote Mb ++EndTable ++ + # AMD's Prefetch Group + GrpTable: GrpP + 0: PREFETCH +diff --git a/tools/perf/builtin-report.c b/tools/perf/builtin-report.c +index 4ddb0726eebc..fd4dd12b8f9d 100644 +--- a/tools/perf/builtin-report.c ++++ b/tools/perf/builtin-report.c +@@ -342,6 +342,13 @@ static int report__setup_sample_type(struct report *rep) + PERF_SAMPLE_BRANCH_ANY)) + rep->nonany_branch_mode = true; + ++#ifndef HAVE_LIBUNWIND_SUPPORT ++ if (dwarf_callchain_users) { ++ ui__warning("Please install libunwind development packages " ++ "during the perf build.\n"); ++ } ++#endif ++ + return 0; + } + +diff --git a/tools/perf/tests/task-exit.c b/tools/perf/tests/task-exit.c +index 89c8e1604ca7..94fe5464bc6f 100644 +--- a/tools/perf/tests/task-exit.c ++++ b/tools/perf/tests/task-exit.c +@@ -104,6 +104,7 @@ int test__task_exit(struct test *test __maybe_unused, int subtest __maybe_unused + if (perf_evlist__mmap(evlist, 128, true) < 0) { + pr_debug("failed to mmap events: %d (%s)\n", errno, + str_error_r(errno, sbuf, sizeof(sbuf))); ++ err = -1; + goto out_delete_evlist; + } + +diff --git a/tools/perf/util/dwarf-aux.c b/tools/perf/util/dwarf-aux.c +index f5acda13dcfa..289ef63208fb 100644 +--- a/tools/perf/util/dwarf-aux.c ++++ b/tools/perf/util/dwarf-aux.c +@@ -320,21 +320,51 @@ bool die_is_func_def(Dwarf_Die *dw_die) + dwarf_attr(dw_die, DW_AT_declaration, &attr) == NULL); + } + ++/** ++ * die_entrypc - Returns entry PC (the lowest address) of a DIE ++ * @dw_die: a DIE ++ * @addr: where to store entry PC ++ * ++ * Since dwarf_entrypc() does not return entry PC if the DIE has only address ++ * range, we have to use this to retrieve the lowest address from the address ++ * range attribute. ++ */ ++int die_entrypc(Dwarf_Die *dw_die, Dwarf_Addr *addr) ++{ ++ Dwarf_Addr base, end; ++ ++ if (!addr) ++ return -EINVAL; ++ ++ if (dwarf_entrypc(dw_die, addr) == 0) ++ return 0; ++ ++ return dwarf_ranges(dw_die, 0, &base, addr, &end) < 0 ? -ENOENT : 0; ++} ++ + /** + * die_is_func_instance - Ensure that this DIE is an instance of a subprogram + * @dw_die: a DIE + * + * Ensure that this DIE is an instance (which has an entry address). +- * This returns true if @dw_die is a function instance. If not, you need to +- * call die_walk_instances() to find actual instances. ++ * This returns true if @dw_die is a function instance. If not, the @dw_die ++ * must be a prototype. You can use die_walk_instances() to find actual ++ * instances. + **/ + bool die_is_func_instance(Dwarf_Die *dw_die) + { + Dwarf_Addr tmp; ++ Dwarf_Attribute attr_mem; ++ int tag = dwarf_tag(dw_die); + +- /* Actually gcc optimizes non-inline as like as inlined */ +- return !dwarf_func_inline(dw_die) && dwarf_entrypc(dw_die, &tmp) == 0; ++ if (tag != DW_TAG_subprogram && ++ tag != DW_TAG_inlined_subroutine) ++ return false; ++ ++ return dwarf_entrypc(dw_die, &tmp) == 0 || ++ dwarf_attr(dw_die, DW_AT_ranges, &attr_mem) != NULL; + } ++ + /** + * die_get_data_member_location - Get the data-member offset + * @mb_die: a DIE of a member of a data structure +@@ -611,6 +641,9 @@ static int __die_walk_instances_cb(Dwarf_Die *inst, void *data) + Dwarf_Die *origin; + int tmp; + ++ if (!die_is_func_instance(inst)) ++ return DIE_FIND_CB_CONTINUE; ++ + attr = dwarf_attr(inst, DW_AT_abstract_origin, &attr_mem); + if (attr == NULL) + return DIE_FIND_CB_CONTINUE; +@@ -682,15 +715,14 @@ static int __die_walk_funclines_cb(Dwarf_Die *in_die, void *data) + if (dwarf_tag(in_die) == DW_TAG_inlined_subroutine) { + fname = die_get_call_file(in_die); + lineno = die_get_call_lineno(in_die); +- if (fname && lineno > 0 && dwarf_entrypc(in_die, &addr) == 0) { ++ if (fname && lineno > 0 && die_entrypc(in_die, &addr) == 0) { + lw->retval = lw->callback(fname, lineno, addr, lw->data); + if (lw->retval != 0) + return DIE_FIND_CB_END; + } ++ if (!lw->recursive) ++ return DIE_FIND_CB_SIBLING; + } +- if (!lw->recursive) +- /* Don't need to search recursively */ +- return DIE_FIND_CB_SIBLING; + + if (addr) { + fname = dwarf_decl_file(in_die); +@@ -723,7 +755,7 @@ static int __die_walk_funclines(Dwarf_Die *sp_die, bool recursive, + /* Handle function declaration line */ + fname = dwarf_decl_file(sp_die); + if (fname && dwarf_decl_line(sp_die, &lineno) == 0 && +- dwarf_entrypc(sp_die, &addr) == 0) { ++ die_entrypc(sp_die, &addr) == 0) { + lw.retval = callback(fname, lineno, addr, data); + if (lw.retval != 0) + goto done; +@@ -737,6 +769,10 @@ static int __die_walk_culines_cb(Dwarf_Die *sp_die, void *data) + { + struct __line_walk_param *lw = data; + ++ /* ++ * Since inlined function can include another inlined function in ++ * the same file, we need to walk in it recursively. ++ */ + lw->retval = __die_walk_funclines(sp_die, true, lw->callback, lw->data); + if (lw->retval != 0) + return DWARF_CB_ABORT; +@@ -761,11 +797,12 @@ int die_walk_lines(Dwarf_Die *rt_die, line_walk_callback_t callback, void *data) + Dwarf_Lines *lines; + Dwarf_Line *line; + Dwarf_Addr addr; +- const char *fname, *decf = NULL; ++ const char *fname, *decf = NULL, *inf = NULL; + int lineno, ret = 0; + int decl = 0, inl; + Dwarf_Die die_mem, *cu_die; + size_t nlines, i; ++ bool flag; + + /* Get the CU die */ + if (dwarf_tag(rt_die) != DW_TAG_compile_unit) { +@@ -796,6 +833,12 @@ int die_walk_lines(Dwarf_Die *rt_die, line_walk_callback_t callback, void *data) + "Possible error in debuginfo.\n"); + continue; + } ++ /* Skip end-of-sequence */ ++ if (dwarf_lineendsequence(line, &flag) != 0 || flag) ++ continue; ++ /* Skip Non statement line-info */ ++ if (dwarf_linebeginstatement(line, &flag) != 0 || !flag) ++ continue; + /* Filter lines based on address */ + if (rt_die != cu_die) { + /* +@@ -805,13 +848,21 @@ int die_walk_lines(Dwarf_Die *rt_die, line_walk_callback_t callback, void *data) + */ + if (!dwarf_haspc(rt_die, addr)) + continue; ++ + if (die_find_inlinefunc(rt_die, addr, &die_mem)) { ++ /* Call-site check */ ++ inf = die_get_call_file(&die_mem); ++ if ((inf && !strcmp(inf, decf)) && ++ die_get_call_lineno(&die_mem) == lineno) ++ goto found; ++ + dwarf_decl_line(&die_mem, &inl); + if (inl != decl || + decf != dwarf_decl_file(&die_mem)) + continue; + } + } ++found: + /* Get source line */ + fname = dwarf_linesrc(line, NULL, NULL); + +@@ -826,8 +877,9 @@ int die_walk_lines(Dwarf_Die *rt_die, line_walk_callback_t callback, void *data) + */ + if (rt_die != cu_die) + /* +- * Don't need walk functions recursively, because nested +- * inlined functions don't have lines of the specified DIE. ++ * Don't need walk inlined functions recursively, because ++ * inner inlined functions don't have the lines of the ++ * specified function. + */ + ret = __die_walk_funclines(rt_die, false, callback, data); + else { +@@ -1002,7 +1054,7 @@ static int die_get_var_innermost_scope(Dwarf_Die *sp_die, Dwarf_Die *vr_die, + bool first = true; + const char *name; + +- ret = dwarf_entrypc(sp_die, &entry); ++ ret = die_entrypc(sp_die, &entry); + if (ret) + return ret; + +@@ -1065,7 +1117,7 @@ int die_get_var_range(Dwarf_Die *sp_die, Dwarf_Die *vr_die, struct strbuf *buf) + bool first = true; + const char *name; + +- ret = dwarf_entrypc(sp_die, &entry); ++ ret = die_entrypc(sp_die, &entry); + if (ret) + return ret; + +diff --git a/tools/perf/util/dwarf-aux.h b/tools/perf/util/dwarf-aux.h +index 8ac53bf1ec4e..ee15fac4e1d0 100644 +--- a/tools/perf/util/dwarf-aux.h ++++ b/tools/perf/util/dwarf-aux.h +@@ -41,6 +41,9 @@ int cu_walk_functions_at(Dwarf_Die *cu_die, Dwarf_Addr addr, + /* Get DW_AT_linkage_name (should be NULL for C binary) */ + const char *die_get_linkage_name(Dwarf_Die *dw_die); + ++/* Get the lowest PC in DIE (including range list) */ ++int die_entrypc(Dwarf_Die *dw_die, Dwarf_Addr *addr); ++ + /* Ensure that this DIE is a subprogram and definition (not declaration) */ + bool die_is_func_def(Dwarf_Die *dw_die); + +diff --git a/tools/perf/util/parse-events.c b/tools/perf/util/parse-events.c +index 29e2bb304168..096c52f296d7 100644 +--- a/tools/perf/util/parse-events.c ++++ b/tools/perf/util/parse-events.c +@@ -1253,8 +1253,15 @@ static int __parse_events_add_pmu(struct parse_events_state *parse_state, + if (get_config_terms(head_config, &config_terms)) + return -ENOMEM; + +- if (perf_pmu__config(pmu, &attr, head_config, parse_state->error)) ++ if (perf_pmu__config(pmu, &attr, head_config, parse_state->error)) { ++ struct perf_evsel_config_term *pos, *tmp; ++ ++ list_for_each_entry_safe(pos, tmp, &config_terms, list) { ++ list_del_init(&pos->list); ++ free(pos); ++ } + return -EINVAL; ++ } + + evsel = __add_event(list, &parse_state->idx, &attr, + get_config_name(head_config), pmu, +diff --git a/tools/perf/util/probe-finder.c b/tools/perf/util/probe-finder.c +index a5731de0e5eb..30a5e92b67bd 100644 +--- a/tools/perf/util/probe-finder.c ++++ b/tools/perf/util/probe-finder.c +@@ -767,6 +767,16 @@ static int find_best_scope_cb(Dwarf_Die *fn_die, void *data) + return 0; + } + ++/* Return innermost DIE */ ++static int find_inner_scope_cb(Dwarf_Die *fn_die, void *data) ++{ ++ struct find_scope_param *fsp = data; ++ ++ memcpy(fsp->die_mem, fn_die, sizeof(Dwarf_Die)); ++ fsp->found = true; ++ return 1; ++} ++ + /* Find an appropriate scope fits to given conditions */ + static Dwarf_Die *find_best_scope(struct probe_finder *pf, Dwarf_Die *die_mem) + { +@@ -778,8 +788,13 @@ static Dwarf_Die *find_best_scope(struct probe_finder *pf, Dwarf_Die *die_mem) + .die_mem = die_mem, + .found = false, + }; ++ int ret; + +- cu_walk_functions_at(&pf->cu_die, pf->addr, find_best_scope_cb, &fsp); ++ ret = cu_walk_functions_at(&pf->cu_die, pf->addr, find_best_scope_cb, ++ &fsp); ++ if (!ret && !fsp.found) ++ cu_walk_functions_at(&pf->cu_die, pf->addr, ++ find_inner_scope_cb, &fsp); + + return fsp.found ? die_mem : NULL; + } +@@ -953,7 +968,7 @@ static int probe_point_inline_cb(Dwarf_Die *in_die, void *data) + ret = find_probe_point_lazy(in_die, pf); + else { + /* Get probe address */ +- if (dwarf_entrypc(in_die, &addr) != 0) { ++ if (die_entrypc(in_die, &addr) != 0) { + pr_warning("Failed to get entry address of %s.\n", + dwarf_diename(in_die)); + return -ENOENT; +@@ -1005,7 +1020,7 @@ static int probe_point_search_cb(Dwarf_Die *sp_die, void *data) + param->retval = find_probe_point_by_line(pf); + } else if (die_is_func_instance(sp_die)) { + /* Instances always have the entry address */ +- dwarf_entrypc(sp_die, &pf->addr); ++ die_entrypc(sp_die, &pf->addr); + /* But in some case the entry address is 0 */ + if (pf->addr == 0) { + pr_debug("%s has no entry PC. Skipped\n", +@@ -1417,6 +1432,18 @@ error: + return DIE_FIND_CB_END; + } + ++static bool available_var_finder_overlap(struct available_var_finder *af) ++{ ++ int i; ++ ++ for (i = 0; i < af->nvls; i++) { ++ if (af->pf.addr == af->vls[i].point.address) ++ return true; ++ } ++ return false; ++ ++} ++ + /* Add a found vars into available variables list */ + static int add_available_vars(Dwarf_Die *sc_die, struct probe_finder *pf) + { +@@ -1427,6 +1454,14 @@ static int add_available_vars(Dwarf_Die *sc_die, struct probe_finder *pf) + Dwarf_Die die_mem; + int ret; + ++ /* ++ * For some reason (e.g. different column assigned to same address), ++ * this callback can be called with the address which already passed. ++ * Ignore it first. ++ */ ++ if (available_var_finder_overlap(af)) ++ return 0; ++ + /* Check number of tevs */ + if (af->nvls == af->max_vls) { + pr_warning("Too many( > %d) probe point found.\n", af->max_vls); +@@ -1570,7 +1605,7 @@ int debuginfo__find_probe_point(struct debuginfo *dbg, unsigned long addr, + /* Get function entry information */ + func = basefunc = dwarf_diename(&spdie); + if (!func || +- dwarf_entrypc(&spdie, &baseaddr) != 0 || ++ die_entrypc(&spdie, &baseaddr) != 0 || + dwarf_decl_line(&spdie, &baseline) != 0) { + lineno = 0; + goto post; +@@ -1587,7 +1622,7 @@ int debuginfo__find_probe_point(struct debuginfo *dbg, unsigned long addr, + while (die_find_top_inlinefunc(&spdie, (Dwarf_Addr)addr, + &indie)) { + /* There is an inline function */ +- if (dwarf_entrypc(&indie, &_addr) == 0 && ++ if (die_entrypc(&indie, &_addr) == 0 && + _addr == addr) { + /* + * addr is at an inline function entry. +diff --git a/tools/power/cpupower/utils/idle_monitor/hsw_ext_idle.c b/tools/power/cpupower/utils/idle_monitor/hsw_ext_idle.c +index f794d6bbb7e9..3e4ff4a1cdf4 100644 +--- a/tools/power/cpupower/utils/idle_monitor/hsw_ext_idle.c ++++ b/tools/power/cpupower/utils/idle_monitor/hsw_ext_idle.c +@@ -40,7 +40,6 @@ static cstate_t hsw_ext_cstates[HSW_EXT_CSTATE_COUNT] = { + { + .name = "PC9", + .desc = N_("Processor Package C9"), +- .desc = N_("Processor Package C2"), + .id = PC9, + .range = RANGE_PACKAGE, + .get_count_percent = hsw_ext_get_count_percent,