diff options
| author |   Mike Pagano <mpagano@gentoo.org> | 2023-09-23 06:17:54 -0400 |
|---|---|---|
| committer | Mike Pagano <mpagano@gentoo.org> | 2023-09-23 06:17:54 -0400 |
| commit | b811afa4da2a877b5ed36a9cedf52ff4082d30dd (patch) | |
| tree | 935d91f8cab9903038744ec3ca897fcc90c3895e | |
| parent | Linux patch 5.4.256 (diff) | |
| download | linux-patches-b811afa4da2a877b5ed36a9cedf52ff4082d30dd.tar.gz linux-patches-b811afa4da2a877b5ed36a9cedf52ff4082d30dd.tar.bz2 linux-patches-b811afa4da2a877b5ed36a9cedf52ff4082d30dd.zip | |
Linux patch 5.4.2575.4-264
Signed-off-by: Mike Pagano <mpagano@gentoo.org>
| -rw-r--r-- | 0000_README | 4 | ||||
| -rw-r--r-- | 1256_linux-5.4.257.patch | 15004 |
2 files changed, 15008 insertions, 0 deletions
diff --git a/0000_README b/0000_README index 89c53712..cd436d0d 100644 --- a/0000_README +++ b/0000_README @@ -1067,6 +1067,10 @@ Patch: 1255_linux-5.4.256.patch From: https://www.kernel.org Desc: Linux 5.4.256 +Patch: 1256_linux-5.4.257.patch +From: https://www.kernel.org +Desc: Linux 5.4.257 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1256_linux-5.4.257.patch b/1256_linux-5.4.257.patch new file mode 100644 index 00000000..d24a8886 --- /dev/null +++ b/1256_linux-5.4.257.patch @@ -0,0 +1,15004 @@ +diff --git a/Documentation/arm64/silicon-errata.rst b/Documentation/arm64/silicon-errata.rst +index 36a8c01191a07..6b70b6aabcffe 100644 +--- a/Documentation/arm64/silicon-errata.rst ++++ b/Documentation/arm64/silicon-errata.rst +@@ -134,6 +134,9 @@ stable kernels. + +----------------+-----------------+-----------------+-----------------------------+ + | Hisilicon | Hip08 SMMU PMCG | #162001800 | N/A | + +----------------+-----------------+-----------------+-----------------------------+ ++| Hisilicon | Hip08 SMMU PMCG | #162001900 | N/A | ++| | Hip09 SMMU PMCG | | | +++----------------+-----------------+-----------------+-----------------------------+ + +----------------+-----------------+-----------------+-----------------------------+ + | Qualcomm Tech. | Kryo/Falkor v1 | E1003 | QCOM_FALKOR_ERRATUM_1003 | + +----------------+-----------------+-----------------+-----------------------------+ +diff --git a/Makefile b/Makefile +index e5761a10f4a67..94e29594a3561 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 5 + PATCHLEVEL = 4 +-SUBLEVEL = 256 ++SUBLEVEL = 257 + EXTRAVERSION = + NAME = Kleptomaniac Octopus + +diff --git a/arch/arm/boot/dts/bcm4708-linksys-ea6500-v2.dts b/arch/arm/boot/dts/bcm4708-linksys-ea6500-v2.dts +index cd797b4202ad8..01c48faabfade 100644 +--- a/arch/arm/boot/dts/bcm4708-linksys-ea6500-v2.dts ++++ b/arch/arm/boot/dts/bcm4708-linksys-ea6500-v2.dts +@@ -19,7 +19,8 @@ + + memory@0 { + device_type = "memory"; +- reg = <0x00000000 0x08000000>; ++ reg = <0x00000000 0x08000000>, ++ <0x88000000 0x08000000>; + }; + + gpio-keys { +diff --git a/arch/arm/boot/dts/bcm47189-luxul-xap-1440.dts b/arch/arm/boot/dts/bcm47189-luxul-xap-1440.dts +index 57ca1cfaecd8e..5901160919dcd 100644 +--- a/arch/arm/boot/dts/bcm47189-luxul-xap-1440.dts ++++ b/arch/arm/boot/dts/bcm47189-luxul-xap-1440.dts +@@ -26,7 +26,6 @@ + wlan { + label = "bcm53xx:blue:wlan"; + gpios = <&chipcommon 10 GPIO_ACTIVE_LOW>; +- linux,default-trigger = "default-off"; + }; + + system { +@@ -46,3 +45,16 @@ + }; + }; + }; ++ ++&gmac0 { ++ phy-mode = "rgmii"; ++ phy-handle = <&bcm54210e>; ++ ++ mdio { ++ /delete-node/ switch@1e; ++ ++ bcm54210e: ethernet-phy@0 { ++ reg = <0>; ++ }; ++ }; ++}; +diff --git a/arch/arm/boot/dts/bcm47189-luxul-xap-810.dts b/arch/arm/boot/dts/bcm47189-luxul-xap-810.dts +index 2e1a7e382cb7a..8e7483272d47d 100644 +--- a/arch/arm/boot/dts/bcm47189-luxul-xap-810.dts ++++ b/arch/arm/boot/dts/bcm47189-luxul-xap-810.dts +@@ -26,7 +26,6 @@ + 5ghz { + label = "bcm53xx:blue:5ghz"; + gpios = <&chipcommon 11 GPIO_ACTIVE_HIGH>; +- linux,default-trigger = "default-off"; + }; + + system { +@@ -42,7 +41,6 @@ + 2ghz { + label = "bcm53xx:blue:2ghz"; + gpios = <&pcie0_chipcommon 3 GPIO_ACTIVE_HIGH>; +- linux,default-trigger = "default-off"; + }; + }; + +@@ -83,3 +81,16 @@ + }; + }; + }; ++ ++&gmac0 { ++ phy-mode = "rgmii"; ++ phy-handle = <&bcm54210e>; ++ ++ mdio { ++ /delete-node/ switch@1e; ++ ++ bcm54210e: ethernet-phy@0 { ++ reg = <0>; ++ }; ++ }; ++}; +diff --git a/arch/arm/boot/dts/bcm53573.dtsi b/arch/arm/boot/dts/bcm53573.dtsi +index 4af8e3293cff4..34bd72b5c9cda 100644 +--- a/arch/arm/boot/dts/bcm53573.dtsi ++++ b/arch/arm/boot/dts/bcm53573.dtsi +@@ -127,6 +127,9 @@ + + pcie0: pcie@2000 { + reg = <0x00002000 0x1000>; ++ ++ #address-cells = <3>; ++ #size-cells = <2>; + }; + + usb2: usb2@4000 { +diff --git a/arch/arm/boot/dts/bcm947189acdbmr.dts b/arch/arm/boot/dts/bcm947189acdbmr.dts +index b0b8c774a37f9..1f0be30e54435 100644 +--- a/arch/arm/boot/dts/bcm947189acdbmr.dts ++++ b/arch/arm/boot/dts/bcm947189acdbmr.dts +@@ -60,9 +60,9 @@ + spi { + compatible = "spi-gpio"; + num-chipselects = <1>; +- gpio-sck = <&chipcommon 21 0>; +- gpio-miso = <&chipcommon 22 0>; +- gpio-mosi = <&chipcommon 23 0>; ++ sck-gpios = <&chipcommon 21 0>; ++ miso-gpios = <&chipcommon 22 0>; ++ mosi-gpios = <&chipcommon 23 0>; + cs-gpios = <&chipcommon 24 0>; + #address-cells = <1>; + #size-cells = <0>; +diff --git a/arch/arm/boot/dts/s3c6410-mini6410.dts b/arch/arm/boot/dts/s3c6410-mini6410.dts +index 1aeac33b0d341..0b07b3c319604 100644 +--- a/arch/arm/boot/dts/s3c6410-mini6410.dts ++++ b/arch/arm/boot/dts/s3c6410-mini6410.dts +@@ -28,29 +28,21 @@ + bootargs = "console=ttySAC0,115200n8 earlyprintk rootwait root=/dev/mmcblk0p1"; + }; + +- clocks { +- compatible = "simple-bus"; +- #address-cells = <1>; +- #size-cells = <0>; +- +- fin_pll: oscillator@0 { +- compatible = "fixed-clock"; +- reg = <0>; +- clock-frequency = <12000000>; +- clock-output-names = "fin_pll"; +- #clock-cells = <0>; +- }; ++ fin_pll: oscillator-0 { ++ compatible = "fixed-clock"; ++ clock-frequency = <12000000>; ++ clock-output-names = "fin_pll"; ++ #clock-cells = <0>; ++ }; + +- xusbxti: oscillator@1 { +- compatible = "fixed-clock"; +- reg = <1>; +- clock-output-names = "xusbxti"; +- clock-frequency = <48000000>; +- #clock-cells = <0>; +- }; ++ xusbxti: oscillator-1 { ++ compatible = "fixed-clock"; ++ clock-output-names = "xusbxti"; ++ clock-frequency = <48000000>; ++ #clock-cells = <0>; + }; + +- srom-cs1@18000000 { ++ srom-cs1-bus@18000000 { + compatible = "simple-bus"; + #address-cells = <1>; + #size-cells = <1>; +@@ -59,7 +51,7 @@ + + ethernet@18000000 { + compatible = "davicom,dm9000"; +- reg = <0x18000000 0x2 0x18000004 0x2>; ++ reg = <0x18000000 0x2>, <0x18000004 0x2>; + interrupt-parent = <&gpn>; + interrupts = <7 IRQ_TYPE_LEVEL_HIGH>; + davicom,no-eeprom; +@@ -201,12 +193,12 @@ + }; + + &pinctrl0 { +- gpio_leds: gpio-leds { ++ gpio_leds: gpio-leds-pins { + samsung,pins = "gpk-4", "gpk-5", "gpk-6", "gpk-7"; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- gpio_keys: gpio-keys { ++ gpio_keys: gpio-keys-pins { + samsung,pins = "gpn-0", "gpn-1", "gpn-2", "gpn-3", + "gpn-4", "gpn-5", "gpl-11", "gpl-12"; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; +diff --git a/arch/arm/boot/dts/s3c64xx-pinctrl.dtsi b/arch/arm/boot/dts/s3c64xx-pinctrl.dtsi +index 8e9594d64b579..0a3186d57cb56 100644 +--- a/arch/arm/boot/dts/s3c64xx-pinctrl.dtsi ++++ b/arch/arm/boot/dts/s3c64xx-pinctrl.dtsi +@@ -16,111 +16,111 @@ + * Pin banks + */ + +- gpa: gpa { ++ gpa: gpa-gpio-bank { + gpio-controller; + #gpio-cells = <2>; + interrupt-controller; + #interrupt-cells = <2>; + }; + +- gpb: gpb { ++ gpb: gpb-gpio-bank { + gpio-controller; + #gpio-cells = <2>; + interrupt-controller; + #interrupt-cells = <2>; + }; + +- gpc: gpc { ++ gpc: gpc-gpio-bank { + gpio-controller; + #gpio-cells = <2>; + interrupt-controller; + #interrupt-cells = <2>; + }; + +- gpd: gpd { ++ gpd: gpd-gpio-bank { + gpio-controller; + #gpio-cells = <2>; + interrupt-controller; + #interrupt-cells = <2>; + }; + +- gpe: gpe { ++ gpe: gpe-gpio-bank { + gpio-controller; + #gpio-cells = <2>; + }; + +- gpf: gpf { ++ gpf: gpf-gpio-bank { + gpio-controller; + #gpio-cells = <2>; + interrupt-controller; + #interrupt-cells = <2>; + }; + +- gpg: gpg { ++ gpg: gpg-gpio-bank { + gpio-controller; + #gpio-cells = <2>; + interrupt-controller; + #interrupt-cells = <2>; + }; + +- gph: gph { ++ gph: gph-gpio-bank { + gpio-controller; + #gpio-cells = <2>; + interrupt-controller; + #interrupt-cells = <2>; + }; + +- gpi: gpi { ++ gpi: gpi-gpio-bank { + gpio-controller; + #gpio-cells = <2>; + }; + +- gpj: gpj { ++ gpj: gpj-gpio-bank { + gpio-controller; + #gpio-cells = <2>; + }; + +- gpk: gpk { ++ gpk: gpk-gpio-bank { + gpio-controller; + #gpio-cells = <2>; + }; + +- gpl: gpl { ++ gpl: gpl-gpio-bank { + gpio-controller; + #gpio-cells = <2>; + interrupt-controller; + #interrupt-cells = <2>; + }; + +- gpm: gpm { ++ gpm: gpm-gpio-bank { + gpio-controller; + #gpio-cells = <2>; + interrupt-controller; + #interrupt-cells = <2>; + }; + +- gpn: gpn { ++ gpn: gpn-gpio-bank { + gpio-controller; + #gpio-cells = <2>; + interrupt-controller; + #interrupt-cells = <2>; + }; + +- gpo: gpo { ++ gpo: gpo-gpio-bank { + gpio-controller; + #gpio-cells = <2>; + interrupt-controller; + #interrupt-cells = <2>; + }; + +- gpp: gpp { ++ gpp: gpp-gpio-bank { + gpio-controller; + #gpio-cells = <2>; + interrupt-controller; + #interrupt-cells = <2>; + }; + +- gpq: gpq { ++ gpq: gpq-gpio-bank { + gpio-controller; + #gpio-cells = <2>; + interrupt-controller; +@@ -131,225 +131,225 @@ + * Pin groups + */ + +- uart0_data: uart0-data { ++ uart0_data: uart0-data-pins { + samsung,pins = "gpa-0", "gpa-1"; + samsung,pin-function = <EXYNOS_PIN_FUNC_2>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- uart0_fctl: uart0-fctl { ++ uart0_fctl: uart0-fctl-pins { + samsung,pins = "gpa-2", "gpa-3"; + samsung,pin-function = <EXYNOS_PIN_FUNC_2>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- uart1_data: uart1-data { ++ uart1_data: uart1-data-pins { + samsung,pins = "gpa-4", "gpa-5"; + samsung,pin-function = <EXYNOS_PIN_FUNC_2>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- uart1_fctl: uart1-fctl { ++ uart1_fctl: uart1-fctl-pins { + samsung,pins = "gpa-6", "gpa-7"; + samsung,pin-function = <EXYNOS_PIN_FUNC_2>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- uart2_data: uart2-data { ++ uart2_data: uart2-data-pins { + samsung,pins = "gpb-0", "gpb-1"; + samsung,pin-function = <EXYNOS_PIN_FUNC_2>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- uart3_data: uart3-data { ++ uart3_data: uart3-data-pins { + samsung,pins = "gpb-2", "gpb-3"; + samsung,pin-function = <EXYNOS_PIN_FUNC_2>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- ext_dma_0: ext-dma-0 { ++ ext_dma_0: ext-dma-0-pins { + samsung,pins = "gpb-0", "gpb-1"; + samsung,pin-function = <EXYNOS_PIN_FUNC_3>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- ext_dma_1: ext-dma-1 { ++ ext_dma_1: ext-dma-1-pins { + samsung,pins = "gpb-2", "gpb-3"; + samsung,pin-function = <EXYNOS_PIN_FUNC_4>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- irda_data_0: irda-data-0 { ++ irda_data_0: irda-data-0-pins { + samsung,pins = "gpb-0", "gpb-1"; + samsung,pin-function = <EXYNOS_PIN_FUNC_4>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- irda_data_1: irda-data-1 { ++ irda_data_1: irda-data-1-pins { + samsung,pins = "gpb-2", "gpb-3"; + samsung,pin-function = <EXYNOS_PIN_FUNC_3>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- irda_sdbw: irda-sdbw { ++ irda_sdbw: irda-sdbw-pins { + samsung,pins = "gpb-4"; + samsung,pin-function = <EXYNOS_PIN_FUNC_2>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- i2c0_bus: i2c0-bus { ++ i2c0_bus: i2c0-bus-pins { + samsung,pins = "gpb-5", "gpb-6"; + samsung,pin-function = <EXYNOS_PIN_FUNC_2>; + samsung,pin-pud = <S3C64XX_PIN_PULL_UP>; + }; + +- i2c1_bus: i2c1-bus { ++ i2c1_bus: i2c1-bus-pins { + /* S3C6410-only */ + samsung,pins = "gpb-2", "gpb-3"; + samsung,pin-function = <EXYNOS_PIN_FUNC_6>; + samsung,pin-pud = <S3C64XX_PIN_PULL_UP>; + }; + +- spi0_bus: spi0-bus { ++ spi0_bus: spi0-bus-pins { + samsung,pins = "gpc-0", "gpc-1", "gpc-2"; + samsung,pin-function = <EXYNOS_PIN_FUNC_2>; + samsung,pin-pud = <S3C64XX_PIN_PULL_UP>; + }; + +- spi0_cs: spi0-cs { ++ spi0_cs: spi0-cs-pins { + samsung,pins = "gpc-3"; + samsung,pin-function = <EXYNOS_PIN_FUNC_2>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- spi1_bus: spi1-bus { ++ spi1_bus: spi1-bus-pins { + samsung,pins = "gpc-4", "gpc-5", "gpc-6"; + samsung,pin-function = <EXYNOS_PIN_FUNC_2>; + samsung,pin-pud = <S3C64XX_PIN_PULL_UP>; + }; + +- spi1_cs: spi1-cs { ++ spi1_cs: spi1-cs-pins { + samsung,pins = "gpc-7"; + samsung,pin-function = <EXYNOS_PIN_FUNC_2>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- sd0_cmd: sd0-cmd { ++ sd0_cmd: sd0-cmd-pins { + samsung,pins = "gpg-1"; + samsung,pin-function = <EXYNOS_PIN_FUNC_2>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- sd0_clk: sd0-clk { ++ sd0_clk: sd0-clk-pins { + samsung,pins = "gpg-0"; + samsung,pin-function = <EXYNOS_PIN_FUNC_2>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- sd0_bus1: sd0-bus1 { ++ sd0_bus1: sd0-bus1-pins { + samsung,pins = "gpg-2"; + samsung,pin-function = <EXYNOS_PIN_FUNC_2>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- sd0_bus4: sd0-bus4 { ++ sd0_bus4: sd0-bus4-pins { + samsung,pins = "gpg-2", "gpg-3", "gpg-4", "gpg-5"; + samsung,pin-function = <EXYNOS_PIN_FUNC_2>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- sd0_cd: sd0-cd { ++ sd0_cd: sd0-cd-pins { + samsung,pins = "gpg-6"; + samsung,pin-function = <EXYNOS_PIN_FUNC_2>; + samsung,pin-pud = <S3C64XX_PIN_PULL_UP>; + }; + +- sd1_cmd: sd1-cmd { ++ sd1_cmd: sd1-cmd-pins { + samsung,pins = "gph-1"; + samsung,pin-function = <EXYNOS_PIN_FUNC_2>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- sd1_clk: sd1-clk { ++ sd1_clk: sd1-clk-pins { + samsung,pins = "gph-0"; + samsung,pin-function = <EXYNOS_PIN_FUNC_2>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- sd1_bus1: sd1-bus1 { ++ sd1_bus1: sd1-bus1-pins { + samsung,pins = "gph-2"; + samsung,pin-function = <EXYNOS_PIN_FUNC_2>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- sd1_bus4: sd1-bus4 { ++ sd1_bus4: sd1-bus4-pins { + samsung,pins = "gph-2", "gph-3", "gph-4", "gph-5"; + samsung,pin-function = <EXYNOS_PIN_FUNC_2>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- sd1_bus8: sd1-bus8 { ++ sd1_bus8: sd1-bus8-pins { + samsung,pins = "gph-2", "gph-3", "gph-4", "gph-5", + "gph-6", "gph-7", "gph-8", "gph-9"; + samsung,pin-function = <EXYNOS_PIN_FUNC_2>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- sd1_cd: sd1-cd { ++ sd1_cd: sd1-cd-pins { + samsung,pins = "gpg-6"; + samsung,pin-function = <EXYNOS_PIN_FUNC_3>; + samsung,pin-pud = <S3C64XX_PIN_PULL_UP>; + }; + +- sd2_cmd: sd2-cmd { ++ sd2_cmd: sd2-cmd-pins { + samsung,pins = "gpc-4"; + samsung,pin-function = <EXYNOS_PIN_FUNC_3>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- sd2_clk: sd2-clk { ++ sd2_clk: sd2-clk-pins { + samsung,pins = "gpc-5"; + samsung,pin-function = <EXYNOS_PIN_FUNC_3>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- sd2_bus1: sd2-bus1 { ++ sd2_bus1: sd2-bus1-pins { + samsung,pins = "gph-6"; + samsung,pin-function = <EXYNOS_PIN_FUNC_3>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- sd2_bus4: sd2-bus4 { ++ sd2_bus4: sd2-bus4-pins { + samsung,pins = "gph-6", "gph-7", "gph-8", "gph-9"; + samsung,pin-function = <EXYNOS_PIN_FUNC_3>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- i2s0_bus: i2s0-bus { ++ i2s0_bus: i2s0-bus-pins { + samsung,pins = "gpd-0", "gpd-2", "gpd-3", "gpd-4"; + samsung,pin-function = <EXYNOS_PIN_FUNC_3>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- i2s0_cdclk: i2s0-cdclk { ++ i2s0_cdclk: i2s0-cdclk-pins { + samsung,pins = "gpd-1"; + samsung,pin-function = <EXYNOS_PIN_FUNC_3>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- i2s1_bus: i2s1-bus { ++ i2s1_bus: i2s1-bus-pins { + samsung,pins = "gpe-0", "gpe-2", "gpe-3", "gpe-4"; + samsung,pin-function = <EXYNOS_PIN_FUNC_3>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- i2s1_cdclk: i2s1-cdclk { ++ i2s1_cdclk: i2s1-cdclk-pins { + samsung,pins = "gpe-1"; + samsung,pin-function = <EXYNOS_PIN_FUNC_3>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- i2s2_bus: i2s2-bus { ++ i2s2_bus: i2s2-bus-pins { + /* S3C6410-only */ + samsung,pins = "gpc-4", "gpc-5", "gpc-6", "gph-6", + "gph-8", "gph-9"; +@@ -357,50 +357,50 @@ + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- i2s2_cdclk: i2s2-cdclk { ++ i2s2_cdclk: i2s2-cdclk-pins { + /* S3C6410-only */ + samsung,pins = "gph-7"; + samsung,pin-function = <EXYNOS_PIN_FUNC_5>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- pcm0_bus: pcm0-bus { ++ pcm0_bus: pcm0-bus-pins { + samsung,pins = "gpd-0", "gpd-2", "gpd-3", "gpd-4"; + samsung,pin-function = <EXYNOS_PIN_FUNC_2>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- pcm0_extclk: pcm0-extclk { ++ pcm0_extclk: pcm0-extclk-pins { + samsung,pins = "gpd-1"; + samsung,pin-function = <EXYNOS_PIN_FUNC_2>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- pcm1_bus: pcm1-bus { ++ pcm1_bus: pcm1-bus-pins { + samsung,pins = "gpe-0", "gpe-2", "gpe-3", "gpe-4"; + samsung,pin-function = <EXYNOS_PIN_FUNC_2>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- pcm1_extclk: pcm1-extclk { ++ pcm1_extclk: pcm1-extclk-pins { + samsung,pins = "gpe-1"; + samsung,pin-function = <EXYNOS_PIN_FUNC_2>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- ac97_bus_0: ac97-bus-0 { ++ ac97_bus_0: ac97-bus-0-pins { + samsung,pins = "gpd-0", "gpd-1", "gpd-2", "gpd-3", "gpd-4"; + samsung,pin-function = <EXYNOS_PIN_FUNC_4>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- ac97_bus_1: ac97-bus-1 { ++ ac97_bus_1: ac97-bus-1-pins { + samsung,pins = "gpe-0", "gpe-1", "gpe-2", "gpe-3", "gpe-4"; + samsung,pin-function = <EXYNOS_PIN_FUNC_4>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- cam_port: cam-port { ++ cam_port: cam-port-pins { + samsung,pins = "gpf-0", "gpf-1", "gpf-2", "gpf-4", + "gpf-5", "gpf-6", "gpf-7", "gpf-8", + "gpf-9", "gpf-10", "gpf-11", "gpf-12"; +@@ -408,242 +408,242 @@ + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- cam_rst: cam-rst { ++ cam_rst: cam-rst-pins { + samsung,pins = "gpf-3"; + samsung,pin-function = <EXYNOS_PIN_FUNC_2>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- cam_field: cam-field { ++ cam_field: cam-field-pins { + /* S3C6410-only */ + samsung,pins = "gpb-4"; + samsung,pin-function = <EXYNOS_PIN_FUNC_3>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- pwm_extclk: pwm-extclk { ++ pwm_extclk: pwm-extclk-pins { + samsung,pins = "gpf-13"; + samsung,pin-function = <EXYNOS_PIN_FUNC_2>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- pwm0_out: pwm0-out { ++ pwm0_out: pwm0-out-pins { + samsung,pins = "gpf-14"; + samsung,pin-function = <EXYNOS_PIN_FUNC_2>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- pwm1_out: pwm1-out { ++ pwm1_out: pwm1-out-pins { + samsung,pins = "gpf-15"; + samsung,pin-function = <EXYNOS_PIN_FUNC_2>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- clkout0: clkout-0 { ++ clkout0: clkout-0-pins { + samsung,pins = "gpf-14"; + samsung,pin-function = <EXYNOS_PIN_FUNC_3>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- keypad_col0_0: keypad-col0-0 { ++ keypad_col0_0: keypad-col0-0-pins { + samsung,pins = "gph-0"; + samsung,pin-function = <EXYNOS_PIN_FUNC_4>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- keypad_col1_0: keypad-col1-0 { ++ keypad_col1_0: keypad-col1-0-pins { + samsung,pins = "gph-1"; + samsung,pin-function = <EXYNOS_PIN_FUNC_4>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- keypad_col2_0: keypad-col2-0 { ++ keypad_col2_0: keypad-col2-0-pins { + samsung,pins = "gph-2"; + samsung,pin-function = <EXYNOS_PIN_FUNC_4>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- keypad_col3_0: keypad-col3-0 { ++ keypad_col3_0: keypad-col3-0-pins { + samsung,pins = "gph-3"; + samsung,pin-function = <EXYNOS_PIN_FUNC_4>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- keypad_col4_0: keypad-col4-0 { ++ keypad_col4_0: keypad-col4-0-pins { + samsung,pins = "gph-4"; + samsung,pin-function = <EXYNOS_PIN_FUNC_4>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- keypad_col5_0: keypad-col5-0 { ++ keypad_col5_0: keypad-col5-0-pins { + samsung,pins = "gph-5"; + samsung,pin-function = <EXYNOS_PIN_FUNC_4>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- keypad_col6_0: keypad-col6-0 { ++ keypad_col6_0: keypad-col6-0-pins { + samsung,pins = "gph-6"; + samsung,pin-function = <EXYNOS_PIN_FUNC_4>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- keypad_col7_0: keypad-col7-0 { ++ keypad_col7_0: keypad-col7-0-pins { + samsung,pins = "gph-7"; + samsung,pin-function = <EXYNOS_PIN_FUNC_4>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- keypad_col0_1: keypad-col0-1 { ++ keypad_col0_1: keypad-col0-1-pins { + samsung,pins = "gpl-0"; + samsung,pin-function = <EXYNOS_PIN_FUNC_3>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- keypad_col1_1: keypad-col1-1 { ++ keypad_col1_1: keypad-col1-1-pins { + samsung,pins = "gpl-1"; + samsung,pin-function = <EXYNOS_PIN_FUNC_3>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- keypad_col2_1: keypad-col2-1 { ++ keypad_col2_1: keypad-col2-1-pins { + samsung,pins = "gpl-2"; + samsung,pin-function = <EXYNOS_PIN_FUNC_3>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- keypad_col3_1: keypad-col3-1 { ++ keypad_col3_1: keypad-col3-1-pins { + samsung,pins = "gpl-3"; + samsung,pin-function = <EXYNOS_PIN_FUNC_3>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- keypad_col4_1: keypad-col4-1 { ++ keypad_col4_1: keypad-col4-1-pins { + samsung,pins = "gpl-4"; + samsung,pin-function = <EXYNOS_PIN_FUNC_3>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- keypad_col5_1: keypad-col5-1 { ++ keypad_col5_1: keypad-col5-1-pins { + samsung,pins = "gpl-5"; + samsung,pin-function = <EXYNOS_PIN_FUNC_3>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- keypad_col6_1: keypad-col6-1 { ++ keypad_col6_1: keypad-col6-1-pins { + samsung,pins = "gpl-6"; + samsung,pin-function = <EXYNOS_PIN_FUNC_3>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- keypad_col7_1: keypad-col7-1 { ++ keypad_col7_1: keypad-col7-1-pins { + samsung,pins = "gpl-7"; + samsung,pin-function = <EXYNOS_PIN_FUNC_3>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- keypad_row0_0: keypad-row0-0 { ++ keypad_row0_0: keypad-row0-0-pins { + samsung,pins = "gpk-8"; + samsung,pin-function = <EXYNOS_PIN_FUNC_3>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- keypad_row1_0: keypad-row1-0 { ++ keypad_row1_0: keypad-row1-0-pins { + samsung,pins = "gpk-9"; + samsung,pin-function = <EXYNOS_PIN_FUNC_3>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- keypad_row2_0: keypad-row2-0 { ++ keypad_row2_0: keypad-row2-0-pins { + samsung,pins = "gpk-10"; + samsung,pin-function = <EXYNOS_PIN_FUNC_3>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- keypad_row3_0: keypad-row3-0 { ++ keypad_row3_0: keypad-row3-0-pins { + samsung,pins = "gpk-11"; + samsung,pin-function = <EXYNOS_PIN_FUNC_3>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- keypad_row4_0: keypad-row4-0 { ++ keypad_row4_0: keypad-row4-0-pins { + samsung,pins = "gpk-12"; + samsung,pin-function = <EXYNOS_PIN_FUNC_3>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- keypad_row5_0: keypad-row5-0 { ++ keypad_row5_0: keypad-row5-0-pins { + samsung,pins = "gpk-13"; + samsung,pin-function = <EXYNOS_PIN_FUNC_3>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- keypad_row6_0: keypad-row6-0 { ++ keypad_row6_0: keypad-row6-0-pins { + samsung,pins = "gpk-14"; + samsung,pin-function = <EXYNOS_PIN_FUNC_3>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- keypad_row7_0: keypad-row7-0 { ++ keypad_row7_0: keypad-row7-0-pins { + samsung,pins = "gpk-15"; + samsung,pin-function = <EXYNOS_PIN_FUNC_3>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- keypad_row0_1: keypad-row0-1 { ++ keypad_row0_1: keypad-row0-1-pins { + samsung,pins = "gpn-0"; + samsung,pin-function = <EXYNOS_PIN_FUNC_3>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- keypad_row1_1: keypad-row1-1 { ++ keypad_row1_1: keypad-row1-1-pins { + samsung,pins = "gpn-1"; + samsung,pin-function = <EXYNOS_PIN_FUNC_3>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- keypad_row2_1: keypad-row2-1 { ++ keypad_row2_1: keypad-row2-1-pins { + samsung,pins = "gpn-2"; + samsung,pin-function = <EXYNOS_PIN_FUNC_3>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- keypad_row3_1: keypad-row3-1 { ++ keypad_row3_1: keypad-row3-1-pins { + samsung,pins = "gpn-3"; + samsung,pin-function = <EXYNOS_PIN_FUNC_3>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- keypad_row4_1: keypad-row4-1 { ++ keypad_row4_1: keypad-row4-1-pins { + samsung,pins = "gpn-4"; + samsung,pin-function = <EXYNOS_PIN_FUNC_3>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- keypad_row5_1: keypad-row5-1 { ++ keypad_row5_1: keypad-row5-1-pins { + samsung,pins = "gpn-5"; + samsung,pin-function = <EXYNOS_PIN_FUNC_3>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- keypad_row6_1: keypad-row6-1 { ++ keypad_row6_1: keypad-row6-1-pins { + samsung,pins = "gpn-6"; + samsung,pin-function = <EXYNOS_PIN_FUNC_3>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- keypad_row7_1: keypad-row7-1 { ++ keypad_row7_1: keypad-row7-1-pins { + samsung,pins = "gpn-7"; + samsung,pin-function = <EXYNOS_PIN_FUNC_3>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- lcd_ctrl: lcd-ctrl { ++ lcd_ctrl: lcd-ctrl-pins { + samsung,pins = "gpj-8", "gpj-9", "gpj-10", "gpj-11"; + samsung,pin-function = <EXYNOS_PIN_FUNC_2>; + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- lcd_data16: lcd-data-width16 { ++ lcd_data16: lcd-data-width16-pins { + samsung,pins = "gpi-3", "gpi-4", "gpi-5", "gpi-6", + "gpi-7", "gpi-10", "gpi-11", "gpi-12", + "gpi-13", "gpi-14", "gpi-15", "gpj-3", +@@ -652,7 +652,7 @@ + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- lcd_data18: lcd-data-width18 { ++ lcd_data18: lcd-data-width18-pins { + samsung,pins = "gpi-2", "gpi-3", "gpi-4", "gpi-5", + "gpi-6", "gpi-7", "gpi-10", "gpi-11", + "gpi-12", "gpi-13", "gpi-14", "gpi-15", +@@ -662,7 +662,7 @@ + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- lcd_data24: lcd-data-width24 { ++ lcd_data24: lcd-data-width24-pins { + samsung,pins = "gpi-0", "gpi-1", "gpi-2", "gpi-3", + "gpi-4", "gpi-5", "gpi-6", "gpi-7", + "gpi-8", "gpi-9", "gpi-10", "gpi-11", +@@ -673,7 +673,7 @@ + samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; + }; + +- hsi_bus: hsi-bus { ++ hsi_bus: hsi-bus-pins { + samsung,pins = "gpk-0", "gpk-1", "gpk-2", "gpk-3", + "gpk-4", "gpk-5", "gpk-6", "gpk-7"; + samsung,pin-function = <EXYNOS_PIN_FUNC_3>; +diff --git a/arch/arm/boot/dts/s5pv210-smdkv210.dts b/arch/arm/boot/dts/s5pv210-smdkv210.dts +index 84b38f1851991..53a841ecf7a44 100644 +--- a/arch/arm/boot/dts/s5pv210-smdkv210.dts ++++ b/arch/arm/boot/dts/s5pv210-smdkv210.dts +@@ -15,6 +15,7 @@ + */ + + /dts-v1/; ++#include <dt-bindings/interrupt-controller/irq.h> + #include <dt-bindings/input/input.h> + #include "s5pv210.dtsi" + +@@ -31,11 +32,18 @@ + reg = <0x20000000 0x40000000>; + }; + +- ethernet@18000000 { ++ pmic_ap_clk: clock-0 { ++ /* Workaround for missing PMIC and its clock */ ++ compatible = "fixed-clock"; ++ #clock-cells = <0>; ++ clock-frequency = <32768>; ++ }; ++ ++ ethernet@a8000000 { + compatible = "davicom,dm9000"; +- reg = <0xA8000000 0x2 0xA8000002 0x2>; ++ reg = <0xa8000000 0x2>, <0xa8000002 0x2>; + interrupt-parent = <&gph1>; +- interrupts = <1 4>; ++ interrupts = <1 IRQ_TYPE_LEVEL_HIGH>; + local-mac-address = [00 00 de ad be ef]; + davicom,no-eeprom; + }; +@@ -47,6 +55,14 @@ + default-brightness-level = <6>; + pinctrl-names = "default"; + pinctrl-0 = <&pwm3_out>; ++ power-supply = <&dc5v_reg>; ++ }; ++ ++ dc5v_reg: regulator-0 { ++ compatible = "regulator-fixed"; ++ regulator-name = "DC5V"; ++ regulator-min-microvolt = <5000000>; ++ regulator-max-microvolt = <5000000>; + }; + }; + +@@ -147,6 +163,8 @@ + + &rtc { + status = "okay"; ++ clocks = <&clocks CLK_RTC>, <&pmic_ap_clk>; ++ clock-names = "rtc", "rtc_src"; + }; + + &sdhci0 { +diff --git a/arch/arm/kernel/hw_breakpoint.c b/arch/arm/kernel/hw_breakpoint.c +index b06d9ea07c846..a69dd64a84017 100644 +--- a/arch/arm/kernel/hw_breakpoint.c ++++ b/arch/arm/kernel/hw_breakpoint.c +@@ -623,7 +623,7 @@ int hw_breakpoint_arch_parse(struct perf_event *bp, + hw->address &= ~alignment_mask; + hw->ctrl.len <<= offset; + +- if (is_default_overflow_handler(bp)) { ++ if (uses_default_overflow_handler(bp)) { + /* + * Mismatch breakpoints are required for single-stepping + * breakpoints. +@@ -795,7 +795,7 @@ static void watchpoint_handler(unsigned long addr, unsigned int fsr, + * Otherwise, insert a temporary mismatch breakpoint so that + * we can single-step over the watchpoint trigger. + */ +- if (!is_default_overflow_handler(wp)) ++ if (!uses_default_overflow_handler(wp)) + continue; + step: + enable_single_step(wp, instruction_pointer(regs)); +@@ -808,7 +808,7 @@ step: + info->trigger = addr; + pr_debug("watchpoint fired: address = 0x%x\n", info->trigger); + perf_bp_event(wp, regs); +- if (is_default_overflow_handler(wp)) ++ if (uses_default_overflow_handler(wp)) + enable_single_step(wp, instruction_pointer(regs)); + } + +@@ -883,7 +883,7 @@ static void breakpoint_handler(unsigned long unknown, struct pt_regs *regs) + info->trigger = addr; + pr_debug("breakpoint fired: address = 0x%x\n", addr); + perf_bp_event(bp, regs); +- if (is_default_overflow_handler(bp)) ++ if (uses_default_overflow_handler(bp)) + enable_single_step(bp, addr); + goto unlock; + } +diff --git a/arch/arm/mach-omap2/powerdomain.c b/arch/arm/mach-omap2/powerdomain.c +index 1cbac76136d46..6a10d23d787e8 100644 +--- a/arch/arm/mach-omap2/powerdomain.c ++++ b/arch/arm/mach-omap2/powerdomain.c +@@ -174,7 +174,7 @@ static int _pwrdm_state_switch(struct powerdomain *pwrdm, int flag) + break; + case PWRDM_STATE_PREV: + prev = pwrdm_read_prev_pwrst(pwrdm); +- if (pwrdm->state != prev) ++ if (prev >= 0 && pwrdm->state != prev) + pwrdm->state_counter[prev]++; + if (prev == PWRDM_POWER_RET) + _update_logic_membank_counters(pwrdm); +diff --git a/arch/arm/mach-pxa/sharpsl_pm.c b/arch/arm/mach-pxa/sharpsl_pm.c +index 83cfbb882a2d4..7f6bd7f069e49 100644 +--- a/arch/arm/mach-pxa/sharpsl_pm.c ++++ b/arch/arm/mach-pxa/sharpsl_pm.c +@@ -220,8 +220,6 @@ void sharpsl_battery_kick(void) + { + schedule_delayed_work(&sharpsl_bat, msecs_to_jiffies(125)); + } +-EXPORT_SYMBOL(sharpsl_battery_kick); +- + + static void sharpsl_battery_thread(struct work_struct *private_) + { +diff --git a/arch/arm/mach-pxa/spitz.c b/arch/arm/mach-pxa/spitz.c +index a4fdc399d152c..742c67301dee6 100644 +--- a/arch/arm/mach-pxa/spitz.c ++++ b/arch/arm/mach-pxa/spitz.c +@@ -9,7 +9,6 @@ + */ + + #include <linux/kernel.h> +-#include <linux/module.h> /* symbol_get ; symbol_put */ + #include <linux/platform_device.h> + #include <linux/delay.h> + #include <linux/gpio_keys.h> +@@ -514,17 +513,6 @@ static struct pxa2xx_spi_chip spitz_ads7846_chip = { + .gpio_cs = SPITZ_GPIO_ADS7846_CS, + }; + +-static void spitz_bl_kick_battery(void) +-{ +- void (*kick_batt)(void); +- +- kick_batt = symbol_get(sharpsl_battery_kick); +- if (kick_batt) { +- kick_batt(); +- symbol_put(sharpsl_battery_kick); +- } +-} +- + static struct corgi_lcd_platform_data spitz_lcdcon_info = { + .init_mode = CORGI_LCD_MODE_VGA, + .max_intensity = 0x2f, +@@ -532,7 +520,7 @@ static struct corgi_lcd_platform_data spitz_lcdcon_info = { + .limit_mask = 0x0b, + .gpio_backlight_cont = SPITZ_GPIO_BACKLIGHT_CONT, + .gpio_backlight_on = SPITZ_GPIO_BACKLIGHT_ON, +- .kick_battery = spitz_bl_kick_battery, ++ .kick_battery = sharpsl_battery_kick, + }; + + static struct pxa2xx_spi_chip spitz_lcdcon_chip = { +diff --git a/arch/arm64/boot/dts/qcom/sdm845.dtsi b/arch/arm64/boot/dts/qcom/sdm845.dtsi +index 2287354fef863..ca77fc8aa75bb 100644 +--- a/arch/arm64/boot/dts/qcom/sdm845.dtsi ++++ b/arch/arm64/boot/dts/qcom/sdm845.dtsi +@@ -715,6 +715,7 @@ + #clock-cells = <1>; + #reset-cells = <1>; + #power-domain-cells = <1>; ++ power-domains = <&rpmhpd SDM845_CX>; + }; + + qfprom@784000 { +diff --git a/arch/arm64/kernel/hw_breakpoint.c b/arch/arm64/kernel/hw_breakpoint.c +index b4a1607958246..534578eba556e 100644 +--- a/arch/arm64/kernel/hw_breakpoint.c ++++ b/arch/arm64/kernel/hw_breakpoint.c +@@ -654,7 +654,7 @@ static int breakpoint_handler(unsigned long unused, unsigned int esr, + perf_bp_event(bp, regs); + + /* Do we need to handle the stepping? */ +- if (is_default_overflow_handler(bp)) ++ if (uses_default_overflow_handler(bp)) + step = 1; + unlock: + rcu_read_unlock(); +@@ -733,7 +733,7 @@ static u64 get_distance_from_watchpoint(unsigned long addr, u64 val, + static int watchpoint_report(struct perf_event *wp, unsigned long addr, + struct pt_regs *regs) + { +- int step = is_default_overflow_handler(wp); ++ int step = uses_default_overflow_handler(wp); + struct arch_hw_breakpoint *info = counter_arch_bp(wp); + + info->trigger = addr; +diff --git a/arch/m68k/fpsp040/skeleton.S b/arch/m68k/fpsp040/skeleton.S +index a8f41615d94a7..31a9c634c81ed 100644 +--- a/arch/m68k/fpsp040/skeleton.S ++++ b/arch/m68k/fpsp040/skeleton.S +@@ -499,12 +499,12 @@ in_ea: + dbf %d0,morein + rts + +- .section .fixup,#alloc,#execinstr ++ .section .fixup,"ax" + .even + 1: + jbra fpsp040_die + +- .section __ex_table,#alloc ++ .section __ex_table,"a" + .align 4 + + .long in_ea,1b +diff --git a/arch/m68k/ifpsp060/os.S b/arch/m68k/ifpsp060/os.S +index 7a0d6e4280665..89e2ec224ab6c 100644 +--- a/arch/m68k/ifpsp060/os.S ++++ b/arch/m68k/ifpsp060/os.S +@@ -379,11 +379,11 @@ _060_real_access: + + + | Execption handling for movs access to illegal memory +- .section .fixup,#alloc,#execinstr ++ .section .fixup,"ax" + .even + 1: moveq #-1,%d1 + rts +-.section __ex_table,#alloc ++.section __ex_table,"a" + .align 4 + .long dmrbuae,1b + .long dmrwuae,1b +diff --git a/arch/m68k/kernel/relocate_kernel.S b/arch/m68k/kernel/relocate_kernel.S +index ab0f1e7d46535..f7667079e08e9 100644 +--- a/arch/m68k/kernel/relocate_kernel.S ++++ b/arch/m68k/kernel/relocate_kernel.S +@@ -26,7 +26,7 @@ ENTRY(relocate_new_kernel) + lea %pc@(.Lcopy),%a4 + 2: addl #0x00000000,%a4 /* virt_to_phys() */ + +- .section ".m68k_fixup","aw" ++ .section .m68k_fixup,"aw" + .long M68K_FIXUP_MEMOFFSET, 2b+2 + .previous + +@@ -49,7 +49,7 @@ ENTRY(relocate_new_kernel) + lea %pc@(.Lcont040),%a4 + 5: addl #0x00000000,%a4 /* virt_to_phys() */ + +- .section ".m68k_fixup","aw" ++ .section .m68k_fixup,"aw" + .long M68K_FIXUP_MEMOFFSET, 5b+2 + .previous + +diff --git a/arch/mips/alchemy/devboards/db1000.c b/arch/mips/alchemy/devboards/db1000.c +index 2c52ee27b4f25..50de86eb8784c 100644 +--- a/arch/mips/alchemy/devboards/db1000.c ++++ b/arch/mips/alchemy/devboards/db1000.c +@@ -14,7 +14,6 @@ + #include <linux/interrupt.h> + #include <linux/leds.h> + #include <linux/mmc/host.h> +-#include <linux/module.h> + #include <linux/platform_device.h> + #include <linux/pm.h> + #include <linux/spi/spi.h> +@@ -167,12 +166,7 @@ static struct platform_device db1x00_audio_dev = { + + static irqreturn_t db1100_mmc_cd(int irq, void *ptr) + { +- void (*mmc_cd)(struct mmc_host *, unsigned long); +- /* link against CONFIG_MMC=m */ +- mmc_cd = symbol_get(mmc_detect_change); +- mmc_cd(ptr, msecs_to_jiffies(500)); +- symbol_put(mmc_detect_change); +- ++ mmc_detect_change(ptr, msecs_to_jiffies(500)); + return IRQ_HANDLED; + } + +diff --git a/arch/mips/alchemy/devboards/db1200.c b/arch/mips/alchemy/devboards/db1200.c +index 421d651433b67..b70e2cf8a27bc 100644 +--- a/arch/mips/alchemy/devboards/db1200.c ++++ b/arch/mips/alchemy/devboards/db1200.c +@@ -10,7 +10,6 @@ + #include <linux/gpio.h> + #include <linux/i2c.h> + #include <linux/init.h> +-#include <linux/module.h> + #include <linux/interrupt.h> + #include <linux/io.h> + #include <linux/leds.h> +@@ -340,14 +339,7 @@ static irqreturn_t db1200_mmc_cd(int irq, void *ptr) + + static irqreturn_t db1200_mmc_cdfn(int irq, void *ptr) + { +- void (*mmc_cd)(struct mmc_host *, unsigned long); +- +- /* link against CONFIG_MMC=m */ +- mmc_cd = symbol_get(mmc_detect_change); +- if (mmc_cd) { +- mmc_cd(ptr, msecs_to_jiffies(200)); +- symbol_put(mmc_detect_change); +- } ++ mmc_detect_change(ptr, msecs_to_jiffies(200)); + + msleep(100); /* debounce */ + if (irq == DB1200_SD0_INSERT_INT) +@@ -431,14 +423,7 @@ static irqreturn_t pb1200_mmc1_cd(int irq, void *ptr) + + static irqreturn_t pb1200_mmc1_cdfn(int irq, void *ptr) + { +- void (*mmc_cd)(struct mmc_host *, unsigned long); +- +- /* link against CONFIG_MMC=m */ +- mmc_cd = symbol_get(mmc_detect_change); +- if (mmc_cd) { +- mmc_cd(ptr, msecs_to_jiffies(200)); +- symbol_put(mmc_detect_change); +- } ++ mmc_detect_change(ptr, msecs_to_jiffies(200)); + + msleep(100); /* debounce */ + if (irq == PB1200_SD1_INSERT_INT) +diff --git a/arch/mips/alchemy/devboards/db1300.c b/arch/mips/alchemy/devboards/db1300.c +index 8ac1f56ee57d0..6f16543c16fc5 100644 +--- a/arch/mips/alchemy/devboards/db1300.c ++++ b/arch/mips/alchemy/devboards/db1300.c +@@ -17,7 +17,6 @@ + #include <linux/interrupt.h> + #include <linux/ata_platform.h> + #include <linux/mmc/host.h> +-#include <linux/module.h> + #include <linux/mtd/mtd.h> + #include <linux/mtd/platnand.h> + #include <linux/platform_device.h> +@@ -459,14 +458,7 @@ static irqreturn_t db1300_mmc_cd(int irq, void *ptr) + + static irqreturn_t db1300_mmc_cdfn(int irq, void *ptr) + { +- void (*mmc_cd)(struct mmc_host *, unsigned long); +- +- /* link against CONFIG_MMC=m. We can only be called once MMC core has +- * initialized the controller, so symbol_get() should always succeed. +- */ +- mmc_cd = symbol_get(mmc_detect_change); +- mmc_cd(ptr, msecs_to_jiffies(200)); +- symbol_put(mmc_detect_change); ++ mmc_detect_change(ptr, msecs_to_jiffies(200)); + + msleep(100); /* debounce */ + if (irq == DB1300_SD1_INSERT_INT) +diff --git a/arch/parisc/include/asm/led.h b/arch/parisc/include/asm/led.h +index 6de13d08a3886..b70b9094fb7cd 100644 +--- a/arch/parisc/include/asm/led.h ++++ b/arch/parisc/include/asm/led.h +@@ -11,8 +11,8 @@ + #define LED1 0x02 + #define LED0 0x01 /* bottom (or furthest left) LED */ + +-#define LED_LAN_TX LED0 /* for LAN transmit activity */ +-#define LED_LAN_RCV LED1 /* for LAN receive activity */ ++#define LED_LAN_RCV LED0 /* for LAN receive activity */ ++#define LED_LAN_TX LED1 /* for LAN transmit activity */ + #define LED_DISK_IO LED2 /* for disk activity */ + #define LED_HEARTBEAT LED3 /* heartbeat */ + +diff --git a/arch/parisc/include/asm/processor.h b/arch/parisc/include/asm/processor.h +index 6e2a8176b0dd0..40135be979652 100644 +--- a/arch/parisc/include/asm/processor.h ++++ b/arch/parisc/include/asm/processor.h +@@ -97,7 +97,6 @@ struct cpuinfo_parisc { + unsigned long cpu_loc; /* CPU location from PAT firmware */ + unsigned int state; + struct parisc_device *dev; +- unsigned long loops_per_jiffy; + }; + + extern struct system_cpuinfo_parisc boot_cpu_data; +diff --git a/arch/parisc/kernel/processor.c b/arch/parisc/kernel/processor.c +index b0045889864c2..8b9c8f14760d4 100644 +--- a/arch/parisc/kernel/processor.c ++++ b/arch/parisc/kernel/processor.c +@@ -163,7 +163,6 @@ static int __init processor_probe(struct parisc_device *dev) + if (cpuid) + memset(p, 0, sizeof(struct cpuinfo_parisc)); + +- p->loops_per_jiffy = loops_per_jiffy; + p->dev = dev; /* Save IODC data in case we need it */ + p->hpa = dev->hpa.start; /* save CPU hpa */ + p->cpuid = cpuid; /* save CPU id */ +@@ -373,10 +372,18 @@ int + show_cpuinfo (struct seq_file *m, void *v) + { + unsigned long cpu; ++ char cpu_name[60], *p; ++ ++ /* strip PA path from CPU name to not confuse lscpu */ ++ strlcpy(cpu_name, per_cpu(cpu_data, 0).dev->name, sizeof(cpu_name)); ++ p = strrchr(cpu_name, '['); ++ if (p) ++ *(--p) = 0; + + for_each_online_cpu(cpu) { +- const struct cpuinfo_parisc *cpuinfo = &per_cpu(cpu_data, cpu); + #ifdef CONFIG_SMP ++ const struct cpuinfo_parisc *cpuinfo = &per_cpu(cpu_data, cpu); ++ + if (0 == cpuinfo->hpa) + continue; + #endif +@@ -421,8 +428,7 @@ show_cpuinfo (struct seq_file *m, void *v) + + seq_printf(m, "model\t\t: %s - %s\n", + boot_cpu_data.pdc.sys_model_name, +- cpuinfo->dev ? +- cpuinfo->dev->name : "Unknown"); ++ cpu_name); + + seq_printf(m, "hversion\t: 0x%08x\n" + "sversion\t: 0x%08x\n", +@@ -433,8 +439,8 @@ show_cpuinfo (struct seq_file *m, void *v) + show_cache_info(m); + + seq_printf(m, "bogomips\t: %lu.%02lu\n", +- cpuinfo->loops_per_jiffy / (500000 / HZ), +- (cpuinfo->loops_per_jiffy / (5000 / HZ)) % 100); ++ loops_per_jiffy / (500000 / HZ), ++ loops_per_jiffy / (5000 / HZ) % 100); + + seq_printf(m, "software id\t: %ld\n\n", + boot_cpu_data.pdc.model.sw_id); +diff --git a/arch/powerpc/kernel/fadump.c b/arch/powerpc/kernel/fadump.c +index 69d64f406204f..15405db43141c 100644 +--- a/arch/powerpc/kernel/fadump.c ++++ b/arch/powerpc/kernel/fadump.c +@@ -629,6 +629,7 @@ int __init fadump_reserve_mem(void) + return ret; + error_out: + fw_dump.fadump_enabled = 0; ++ fw_dump.reserve_dump_area_size = 0; + return 0; + } + +diff --git a/arch/powerpc/kernel/head_32.S b/arch/powerpc/kernel/head_32.S +index edaab1142498c..2b0e2eb7bde88 100644 +--- a/arch/powerpc/kernel/head_32.S ++++ b/arch/powerpc/kernel/head_32.S +@@ -922,7 +922,7 @@ END_MMU_FTR_SECTION_IFSET(MMU_FTR_HPTE_TABLE) + */ + lis r5, abatron_pteptrs@h + ori r5, r5, abatron_pteptrs@l +- stw r5, 0xf0(r0) /* This much match your Abatron config */ ++ stw r5, 0xf0(0) /* This much match your Abatron config */ + lis r6, swapper_pg_dir@h + ori r6, r6, swapper_pg_dir@l + tophys(r5, r5) +diff --git a/arch/powerpc/kernel/iommu.c b/arch/powerpc/kernel/iommu.c +index d7d42bd448c4a..dd062eef533b1 100644 +--- a/arch/powerpc/kernel/iommu.c ++++ b/arch/powerpc/kernel/iommu.c +@@ -133,17 +133,28 @@ static int fail_iommu_bus_notify(struct notifier_block *nb, + return 0; + } + +-static struct notifier_block fail_iommu_bus_notifier = { ++/* ++ * PCI and VIO buses need separate notifier_block structs, since they're linked ++ * list nodes. Sharing a notifier_block would mean that any notifiers later ++ * registered for PCI buses would also get called by VIO buses and vice versa. ++ */ ++static struct notifier_block fail_iommu_pci_bus_notifier = { + .notifier_call = fail_iommu_bus_notify + }; + ++#ifdef CONFIG_IBMVIO ++static struct notifier_block fail_iommu_vio_bus_notifier = { ++ .notifier_call = fail_iommu_bus_notify ++}; ++#endif ++ + static int __init fail_iommu_setup(void) + { + #ifdef CONFIG_PCI +- bus_register_notifier(&pci_bus_type, &fail_iommu_bus_notifier); ++ bus_register_notifier(&pci_bus_type, &fail_iommu_pci_bus_notifier); + #endif + #ifdef CONFIG_IBMVIO +- bus_register_notifier(&vio_bus_type, &fail_iommu_bus_notifier); ++ bus_register_notifier(&vio_bus_type, &fail_iommu_vio_bus_notifier); + #endif + + return 0; +diff --git a/arch/powerpc/platforms/pseries/ibmebus.c b/arch/powerpc/platforms/pseries/ibmebus.c +index b91eb0929ed14..55569e3c9db72 100644 +--- a/arch/powerpc/platforms/pseries/ibmebus.c ++++ b/arch/powerpc/platforms/pseries/ibmebus.c +@@ -450,6 +450,7 @@ static int __init ibmebus_bus_init(void) + if (err) { + printk(KERN_WARNING "%s: device_register returned %i\n", + __func__, err); ++ put_device(&ibmebus_bus_device); + bus_unregister(&ibmebus_bus_type); + + return err; +diff --git a/arch/s390/kernel/ipl.c b/arch/s390/kernel/ipl.c +index 7795cdee6427d..5aed5bcadb515 100644 +--- a/arch/s390/kernel/ipl.c ++++ b/arch/s390/kernel/ipl.c +@@ -429,6 +429,8 @@ static struct attribute_group ipl_ccw_attr_group_lpar = { + + static struct attribute *ipl_unknown_attrs[] = { + &sys_ipl_type_attr.attr, ++ &sys_ipl_secure_attr.attr, ++ &sys_ipl_has_secure_attr.attr, + NULL, + }; + +diff --git a/arch/sh/boards/mach-ap325rxa/setup.c b/arch/sh/boards/mach-ap325rxa/setup.c +index 665cad452798b..a80e2369f42b2 100644 +--- a/arch/sh/boards/mach-ap325rxa/setup.c ++++ b/arch/sh/boards/mach-ap325rxa/setup.c +@@ -529,7 +529,7 @@ static int __init ap325rxa_devices_setup(void) + device_initialize(&ap325rxa_ceu_device.dev); + dma_declare_coherent_memory(&ap325rxa_ceu_device.dev, + ceu_dma_membase, ceu_dma_membase, +- ceu_dma_membase + CEU_BUFFER_MEMORY_SIZE - 1); ++ CEU_BUFFER_MEMORY_SIZE); + + platform_device_add(&ap325rxa_ceu_device); + +diff --git a/arch/sh/boards/mach-ecovec24/setup.c b/arch/sh/boards/mach-ecovec24/setup.c +index acaa97459531c..3286afe2ea3dc 100644 +--- a/arch/sh/boards/mach-ecovec24/setup.c ++++ b/arch/sh/boards/mach-ecovec24/setup.c +@@ -1442,15 +1442,13 @@ static int __init arch_setup(void) + device_initialize(&ecovec_ceu_devices[0]->dev); + dma_declare_coherent_memory(&ecovec_ceu_devices[0]->dev, + ceu0_dma_membase, ceu0_dma_membase, +- ceu0_dma_membase + +- CEU_BUFFER_MEMORY_SIZE - 1); ++ CEU_BUFFER_MEMORY_SIZE); + platform_device_add(ecovec_ceu_devices[0]); + + device_initialize(&ecovec_ceu_devices[1]->dev); + dma_declare_coherent_memory(&ecovec_ceu_devices[1]->dev, + ceu1_dma_membase, ceu1_dma_membase, +- ceu1_dma_membase + +- CEU_BUFFER_MEMORY_SIZE - 1); ++ CEU_BUFFER_MEMORY_SIZE); + platform_device_add(ecovec_ceu_devices[1]); + + gpiod_add_lookup_table(&cn12_power_gpiod_table); +diff --git a/arch/sh/boards/mach-kfr2r09/setup.c b/arch/sh/boards/mach-kfr2r09/setup.c +index 96538ba3aa323..90b876194124f 100644 +--- a/arch/sh/boards/mach-kfr2r09/setup.c ++++ b/arch/sh/boards/mach-kfr2r09/setup.c +@@ -603,7 +603,7 @@ static int __init kfr2r09_devices_setup(void) + device_initialize(&kfr2r09_ceu_device.dev); + dma_declare_coherent_memory(&kfr2r09_ceu_device.dev, + ceu_dma_membase, ceu_dma_membase, +- ceu_dma_membase + CEU_BUFFER_MEMORY_SIZE - 1); ++ CEU_BUFFER_MEMORY_SIZE); + + platform_device_add(&kfr2r09_ceu_device); + +diff --git a/arch/sh/boards/mach-migor/setup.c b/arch/sh/boards/mach-migor/setup.c +index 9ed369dad62df..8598290932eab 100644 +--- a/arch/sh/boards/mach-migor/setup.c ++++ b/arch/sh/boards/mach-migor/setup.c +@@ -604,7 +604,7 @@ static int __init migor_devices_setup(void) + device_initialize(&migor_ceu_device.dev); + dma_declare_coherent_memory(&migor_ceu_device.dev, + ceu_dma_membase, ceu_dma_membase, +- ceu_dma_membase + CEU_BUFFER_MEMORY_SIZE - 1); ++ CEU_BUFFER_MEMORY_SIZE); + + platform_device_add(&migor_ceu_device); + +diff --git a/arch/sh/boards/mach-se/7724/setup.c b/arch/sh/boards/mach-se/7724/setup.c +index 32f5dd9448894..9e7b7cac36dc8 100644 +--- a/arch/sh/boards/mach-se/7724/setup.c ++++ b/arch/sh/boards/mach-se/7724/setup.c +@@ -939,15 +939,13 @@ static int __init devices_setup(void) + device_initialize(&ms7724se_ceu_devices[0]->dev); + dma_declare_coherent_memory(&ms7724se_ceu_devices[0]->dev, + ceu0_dma_membase, ceu0_dma_membase, +- ceu0_dma_membase + +- CEU_BUFFER_MEMORY_SIZE - 1); ++ CEU_BUFFER_MEMORY_SIZE); + platform_device_add(ms7724se_ceu_devices[0]); + + device_initialize(&ms7724se_ceu_devices[1]->dev); + dma_declare_coherent_memory(&ms7724se_ceu_devices[1]->dev, + ceu1_dma_membase, ceu1_dma_membase, +- ceu1_dma_membase + +- CEU_BUFFER_MEMORY_SIZE - 1); ++ CEU_BUFFER_MEMORY_SIZE); + platform_device_add(ms7724se_ceu_devices[1]); + + return platform_add_devices(ms7724se_devices, +diff --git a/arch/um/configs/i386_defconfig b/arch/um/configs/i386_defconfig +index 73e98bb57bf51..4229ac9165e83 100644 +--- a/arch/um/configs/i386_defconfig ++++ b/arch/um/configs/i386_defconfig +@@ -35,6 +35,7 @@ CONFIG_TTY_CHAN=y + CONFIG_XTERM_CHAN=y + CONFIG_CON_CHAN="pts" + CONFIG_SSL_CHAN="pts" ++CONFIG_SOUND=m + CONFIG_UML_SOUND=m + CONFIG_DEVTMPFS=y + CONFIG_DEVTMPFS_MOUNT=y +diff --git a/arch/um/configs/x86_64_defconfig b/arch/um/configs/x86_64_defconfig +index 3281d7600225b..f6993a0067272 100644 +--- a/arch/um/configs/x86_64_defconfig ++++ b/arch/um/configs/x86_64_defconfig +@@ -33,6 +33,7 @@ CONFIG_TTY_CHAN=y + CONFIG_XTERM_CHAN=y + CONFIG_CON_CHAN="pts" + CONFIG_SSL_CHAN="pts" ++CONFIG_SOUND=m + CONFIG_UML_SOUND=m + CONFIG_DEVTMPFS=y + CONFIG_DEVTMPFS_MOUNT=y +diff --git a/arch/um/drivers/Kconfig b/arch/um/drivers/Kconfig +index 388096fb45a25..12f54a4a3747d 100644 +--- a/arch/um/drivers/Kconfig ++++ b/arch/um/drivers/Kconfig +@@ -104,24 +104,14 @@ config SSL_CHAN + + config UML_SOUND + tristate "Sound support" ++ depends on SOUND ++ select SOUND_OSS_CORE + help + This option enables UML sound support. If enabled, it will pull in +- soundcore and the UML hostaudio relay, which acts as a intermediary ++ the UML hostaudio relay, which acts as a intermediary + between the host's dsp and mixer devices and the UML sound system. + It is safe to say 'Y' here. + +-config SOUND +- tristate +- default UML_SOUND +- +-config SOUND_OSS_CORE +- bool +- default UML_SOUND +- +-config HOSTAUDIO +- tristate +- default UML_SOUND +- + endmenu + + menu "UML Network Devices" +diff --git a/arch/um/drivers/Makefile b/arch/um/drivers/Makefile +index a290821e355c2..4d7fb606a5f04 100644 +--- a/arch/um/drivers/Makefile ++++ b/arch/um/drivers/Makefile +@@ -52,7 +52,7 @@ obj-$(CONFIG_UML_NET) += net.o + obj-$(CONFIG_MCONSOLE) += mconsole.o + obj-$(CONFIG_MMAPPER) += mmapper_kern.o + obj-$(CONFIG_BLK_DEV_UBD) += ubd.o +-obj-$(CONFIG_HOSTAUDIO) += hostaudio.o ++obj-$(CONFIG_UML_SOUND) += hostaudio.o + obj-$(CONFIG_NULL_CHAN) += null.o + obj-$(CONFIG_PORT_CHAN) += port.o + obj-$(CONFIG_PTY_CHAN) += pty.o +diff --git a/arch/x86/boot/compressed/head_32.S b/arch/x86/boot/compressed/head_32.S +index d7c0fcc1dbf9e..b788b986f3351 100644 +--- a/arch/x86/boot/compressed/head_32.S ++++ b/arch/x86/boot/compressed/head_32.S +@@ -210,7 +210,7 @@ ENDPROC(efi32_stub_entry) + #endif + + .text +-.Lrelocated: ++SYM_FUNC_START_LOCAL_NOALIGN(.Lrelocated) + + /* + * Clear BSS (stack is currently empty) +@@ -261,6 +261,7 @@ ENDPROC(efi32_stub_entry) + */ + xorl %ebx, %ebx + jmp *%eax ++SYM_FUNC_END(.Lrelocated) + + #ifdef CONFIG_EFI_STUB + .data +diff --git a/arch/x86/boot/compressed/head_64.S b/arch/x86/boot/compressed/head_64.S +index 50c9eeb36f0d8..d8164e6abaaff 100644 +--- a/arch/x86/boot/compressed/head_64.S ++++ b/arch/x86/boot/compressed/head_64.S +@@ -381,11 +381,25 @@ ENTRY(startup_64) + /* Save the trampoline address in RCX */ + movq %rax, %rcx + ++ /* Set up 32-bit addressable stack */ ++ leaq TRAMPOLINE_32BIT_STACK_END(%rcx), %rsp ++ ++ /* ++ * Preserve live 64-bit registers on the stack: this is necessary ++ * because the architecture does not guarantee that GPRs will retain ++ * their full 64-bit values across a 32-bit mode switch. ++ */ ++ pushq %rbp ++ pushq %rbx ++ pushq %rsi ++ + /* +- * Load the address of trampoline_return() into RDI. +- * It will be used by the trampoline to return to the main code. ++ * Push the 64-bit address of trampoline_return() onto the new stack. ++ * It will be used by the trampoline to return to the main code. Due to ++ * the 32-bit mode switch, it cannot be kept it in a register either. + */ + leaq trampoline_return(%rip), %rdi ++ pushq %rdi + + /* Switch to compatibility mode (CS.L = 0 CS.D = 1) via far return */ + pushq $__KERNEL32_CS +@@ -393,6 +407,11 @@ ENTRY(startup_64) + pushq %rax + lretq + trampoline_return: ++ /* Restore live 64-bit registers */ ++ popq %rsi ++ popq %rbx ++ popq %rbp ++ + /* Restore the stack, the 32-bit trampoline uses its own stack */ + leaq boot_stack_end(%rbx), %rsp + +@@ -517,7 +536,7 @@ ENDPROC(efi64_stub_entry) + #endif + + .text +-.Lrelocated: ++SYM_FUNC_START_LOCAL_NOALIGN(.Lrelocated) + + /* + * Clear BSS (stack is currently empty) +@@ -546,6 +565,7 @@ ENDPROC(efi64_stub_entry) + * Jump to the decompressed kernel. + */ + jmp *%rax ++SYM_FUNC_END(.Lrelocated) + + /* + * Adjust the global offset table +@@ -572,7 +592,7 @@ ENDPROC(efi64_stub_entry) + /* + * This is the 32-bit trampoline that will be copied over to low memory. + * +- * RDI contains the return address (might be above 4G). ++ * Return address is at the top of the stack (might be above 4G). + * ECX contains the base address of the trampoline memory. + * Non zero RDX means trampoline needs to enable 5-level paging. + */ +@@ -582,9 +602,6 @@ ENTRY(trampoline_32bit_src) + movl %eax, %ds + movl %eax, %ss + +- /* Set up new stack */ +- leal TRAMPOLINE_32BIT_STACK_END(%ecx), %esp +- + /* Disable paging */ + movl %cr0, %eax + btrl $X86_CR0_PG_BIT, %eax +@@ -641,9 +658,10 @@ ENTRY(trampoline_32bit_src) + lret + + .code64 +-.Lpaging_enabled: ++SYM_FUNC_START_LOCAL_NOALIGN(.Lpaging_enabled) + /* Return from the trampoline */ +- jmp *%rdi ++ retq ++SYM_FUNC_END(.Lpaging_enabled) + + /* + * The trampoline code has a size limit. +@@ -653,11 +671,12 @@ ENTRY(trampoline_32bit_src) + .org trampoline_32bit_src + TRAMPOLINE_32BIT_CODE_SIZE + + .code32 +-.Lno_longmode: ++SYM_FUNC_START_LOCAL_NOALIGN(.Lno_longmode) + /* This isn't an x86-64 CPU, so hang intentionally, we cannot continue */ + 1: + hlt + jmp 1b ++SYM_FUNC_END(.Lno_longmode) + + #include "../../kernel/verify_cpu.S" + +diff --git a/arch/x86/boot/pmjump.S b/arch/x86/boot/pmjump.S +index c22f9a7d1aeb9..81658fe353808 100644 +--- a/arch/x86/boot/pmjump.S ++++ b/arch/x86/boot/pmjump.S +@@ -40,13 +40,13 @@ GLOBAL(protected_mode_jump) + + # Transition to 32-bit mode + .byte 0x66, 0xea # ljmpl opcode +-2: .long in_pm32 # offset ++2: .long .Lin_pm32 # offset + .word __BOOT_CS # segment + ENDPROC(protected_mode_jump) + + .code32 + .section ".text32","ax" +-GLOBAL(in_pm32) ++SYM_FUNC_START_LOCAL_NOALIGN(.Lin_pm32) + # Set up data segments for flat 32-bit mode + movl %ecx, %ds + movl %ecx, %es +@@ -72,4 +72,4 @@ GLOBAL(in_pm32) + lldt %cx + + jmpl *%eax # Jump to the 32-bit entrypoint +-ENDPROC(in_pm32) ++SYM_FUNC_END(.Lin_pm32) +diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S +index bd7a4ad0937c4..640c7d36c26c7 100644 +--- a/arch/x86/entry/entry_64.S ++++ b/arch/x86/entry/entry_64.S +@@ -618,7 +618,7 @@ ret_from_intr: + jz retint_kernel + + /* Interrupt came from user space */ +-GLOBAL(retint_user) ++.Lretint_user: + mov %rsp,%rdi + call prepare_exit_to_usermode + TRACE_IRQS_IRETQ +@@ -1392,7 +1392,7 @@ ENTRY(error_exit) + TRACE_IRQS_OFF + testb $3, CS(%rsp) + jz retint_kernel +- jmp retint_user ++ jmp .Lretint_user + END(error_exit) + + /* +diff --git a/arch/x86/include/asm/virtext.h b/arch/x86/include/asm/virtext.h +index 8eefa3386d8ce..331474296e6f1 100644 +--- a/arch/x86/include/asm/virtext.h ++++ b/arch/x86/include/asm/virtext.h +@@ -95,12 +95,6 @@ static inline int cpu_has_svm(const char **msg) + return 0; + } + +- if (boot_cpu_data.extended_cpuid_level < SVM_CPUID_FUNC) { +- if (msg) +- *msg = "can't execute cpuid_8000000a"; +- return 0; +- } +- + if (!boot_cpu_has(X86_FEATURE_SVM)) { + if (msg) + *msg = "svm not available"; +diff --git a/arch/x86/kernel/apm_32.c b/arch/x86/kernel/apm_32.c +index 660270359d393..166d9991e7111 100644 +--- a/arch/x86/kernel/apm_32.c ++++ b/arch/x86/kernel/apm_32.c +@@ -237,12 +237,6 @@ + extern int (*console_blank_hook)(int); + #endif + +-/* +- * The apm_bios device is one of the misc char devices. +- * This is its minor number. +- */ +-#define APM_MINOR_DEV 134 +- + /* + * Various options can be changed at boot time as follows: + * (We allow underscores for compatibility with the modules code) +diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c +index 0c0c2cb038ad2..1592f309c3c1f 100644 +--- a/arch/x86/kernel/cpu/common.c ++++ b/arch/x86/kernel/cpu/common.c +@@ -1147,11 +1147,11 @@ static const struct x86_cpu_id cpu_vuln_blacklist[] __initconst = { + VULNBL_INTEL_STEPPINGS(BROADWELL_G, X86_STEPPING_ANY, SRBDS), + VULNBL_INTEL_STEPPINGS(BROADWELL_X, X86_STEPPING_ANY, MMIO), + VULNBL_INTEL_STEPPINGS(BROADWELL, X86_STEPPING_ANY, SRBDS), +- VULNBL_INTEL_STEPPINGS(SKYLAKE_L, X86_STEPPING_ANY, SRBDS | MMIO | RETBLEED), + VULNBL_INTEL_STEPPINGS(SKYLAKE_X, X86_STEPPING_ANY, MMIO | RETBLEED | GDS), +- VULNBL_INTEL_STEPPINGS(SKYLAKE, X86_STEPPING_ANY, SRBDS | MMIO | RETBLEED), +- VULNBL_INTEL_STEPPINGS(KABYLAKE_L, X86_STEPPING_ANY, SRBDS | MMIO | RETBLEED | GDS), +- VULNBL_INTEL_STEPPINGS(KABYLAKE, X86_STEPPING_ANY, SRBDS | MMIO | RETBLEED | GDS), ++ VULNBL_INTEL_STEPPINGS(SKYLAKE_L, X86_STEPPING_ANY, MMIO | RETBLEED | GDS | SRBDS), ++ VULNBL_INTEL_STEPPINGS(SKYLAKE, X86_STEPPING_ANY, MMIO | RETBLEED | GDS | SRBDS), ++ VULNBL_INTEL_STEPPINGS(KABYLAKE_L, X86_STEPPING_ANY, MMIO | RETBLEED | GDS | SRBDS), ++ VULNBL_INTEL_STEPPINGS(KABYLAKE, X86_STEPPING_ANY, MMIO | RETBLEED | GDS | SRBDS), + VULNBL_INTEL_STEPPINGS(CANNONLAKE_L, X86_STEPPING_ANY, RETBLEED), + VULNBL_INTEL_STEPPINGS(ICELAKE_L, X86_STEPPING_ANY, MMIO | MMIO_SBDS | RETBLEED | GDS), + VULNBL_INTEL_STEPPINGS(ICELAKE_D, X86_STEPPING_ANY, MMIO | GDS), +diff --git a/arch/x86/realmode/rm/wakeup_asm.S b/arch/x86/realmode/rm/wakeup_asm.S +index 05ac9c17c8111..dad6198f1a266 100644 +--- a/arch/x86/realmode/rm/wakeup_asm.S ++++ b/arch/x86/realmode/rm/wakeup_asm.S +@@ -73,7 +73,7 @@ ENTRY(wakeup_start) + movw %ax, %fs + movw %ax, %gs + +- lidtl wakeup_idt ++ lidtl .Lwakeup_idt + + /* Clear the EFLAGS */ + pushl $0 +@@ -171,8 +171,8 @@ END(wakeup_gdt) + + /* This is the standard real-mode IDT */ + .balign 16 +-GLOBAL(wakeup_idt) ++.Lwakeup_idt: + .word 0xffff /* limit */ + .long 0 /* address */ + .word 0 +-END(wakeup_idt) ++END(.Lwakeup_idt) +diff --git a/arch/xtensa/include/asm/core.h b/arch/xtensa/include/asm/core.h +index 5b4acb7d1c073..5975b244b7b80 100644 +--- a/arch/xtensa/include/asm/core.h ++++ b/arch/xtensa/include/asm/core.h +@@ -18,4 +18,13 @@ + #define XCHAL_SPANNING_WAY 0 + #endif + ++#ifndef XCHAL_HW_MIN_VERSION ++#if defined(XCHAL_HW_MIN_VERSION_MAJOR) && defined(XCHAL_HW_MIN_VERSION_MINOR) ++#define XCHAL_HW_MIN_VERSION (XCHAL_HW_MIN_VERSION_MAJOR * 100 + \ ++ XCHAL_HW_MIN_VERSION_MINOR) ++#else ++#define XCHAL_HW_MIN_VERSION 0 ++#endif ++#endif ++ + #endif +diff --git a/arch/xtensa/kernel/perf_event.c b/arch/xtensa/kernel/perf_event.c +index 86c9ba9631551..883f6359e70fc 100644 +--- a/arch/xtensa/kernel/perf_event.c ++++ b/arch/xtensa/kernel/perf_event.c +@@ -13,17 +13,26 @@ + #include <linux/perf_event.h> + #include <linux/platform_device.h> + ++#include <asm/core.h> + #include <asm/processor.h> + #include <asm/stacktrace.h> + ++#define XTENSA_HWVERSION_RG_2015_0 260000 ++ ++#if XCHAL_HW_MIN_VERSION >= XTENSA_HWVERSION_RG_2015_0 ++#define XTENSA_PMU_ERI_BASE 0x00101000 ++#else ++#define XTENSA_PMU_ERI_BASE 0x00001000 ++#endif ++ + /* Global control/status for all perf counters */ +-#define XTENSA_PMU_PMG 0x1000 ++#define XTENSA_PMU_PMG XTENSA_PMU_ERI_BASE + /* Perf counter values */ +-#define XTENSA_PMU_PM(i) (0x1080 + (i) * 4) ++#define XTENSA_PMU_PM(i) (XTENSA_PMU_ERI_BASE + 0x80 + (i) * 4) + /* Perf counter control registers */ +-#define XTENSA_PMU_PMCTRL(i) (0x1100 + (i) * 4) ++#define XTENSA_PMU_PMCTRL(i) (XTENSA_PMU_ERI_BASE + 0x100 + (i) * 4) + /* Perf counter status registers */ +-#define XTENSA_PMU_PMSTAT(i) (0x1180 + (i) * 4) ++#define XTENSA_PMU_PMSTAT(i) (XTENSA_PMU_ERI_BASE + 0x180 + (i) * 4) + + #define XTENSA_PMU_PMG_PMEN 0x1 + +diff --git a/crypto/asymmetric_keys/x509_public_key.c b/crypto/asymmetric_keys/x509_public_key.c +index d964cc82b69c6..4711dace329e6 100644 +--- a/crypto/asymmetric_keys/x509_public_key.c ++++ b/crypto/asymmetric_keys/x509_public_key.c +@@ -129,6 +129,11 @@ int x509_check_for_self_signed(struct x509_certificate *cert) + if (strcmp(cert->pub->pkey_algo, cert->sig->pkey_algo) != 0) + goto out; + ++ if (cert->unsupported_sig) { ++ ret = 0; ++ goto out; ++ } ++ + ret = public_key_verify_signature(cert->pub, cert->sig); + if (ret < 0) { + if (ret == -ENOPKG) { +diff --git a/drivers/acpi/acpica/psopcode.c b/drivers/acpi/acpica/psopcode.c +index 43775c5ce17c5..2f9b226ec4f63 100644 +--- a/drivers/acpi/acpica/psopcode.c ++++ b/drivers/acpi/acpica/psopcode.c +@@ -603,7 +603,7 @@ const struct acpi_opcode_info acpi_gbl_aml_op_info[AML_NUM_OPCODES] = { + + /* 7E */ ACPI_OP("Timer", ARGP_TIMER_OP, ARGI_TIMER_OP, ACPI_TYPE_ANY, + AML_CLASS_EXECUTE, AML_TYPE_EXEC_0A_0T_1R, +- AML_FLAGS_EXEC_0A_0T_1R), ++ AML_FLAGS_EXEC_0A_0T_1R | AML_NO_OPERAND_RESOLVE), + + /* ACPI 5.0 opcodes */ + +diff --git a/drivers/acpi/arm64/iort.c b/drivers/acpi/arm64/iort.c +index 553c89b0bdcbb..09eb170f26d27 100644 +--- a/drivers/acpi/arm64/iort.c ++++ b/drivers/acpi/arm64/iort.c +@@ -1393,7 +1393,10 @@ static void __init arm_smmu_v3_pmcg_init_resources(struct resource *res, + static struct acpi_platform_list pmcg_plat_info[] __initdata = { + /* HiSilicon Hip08 Platform */ + {"HISI ", "HIP08 ", 0, ACPI_SIG_IORT, greater_than_or_equal, +- "Erratum #162001800", IORT_SMMU_V3_PMCG_HISI_HIP08}, ++ "Erratum #162001800, Erratum #162001900", IORT_SMMU_V3_PMCG_HISI_HIP08}, ++ /* HiSilicon Hip09 Platform */ ++ {"HISI ", "HIP09 ", 0, ACPI_SIG_IORT, greater_than_or_equal, ++ "Erratum #162001900", IORT_SMMU_V3_PMCG_HISI_HIP09}, + { } + }; + +diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c +index ef40cd7f36eba..be9c70806b620 100644 +--- a/drivers/acpi/video_detect.c ++++ b/drivers/acpi/video_detect.c +@@ -310,6 +310,15 @@ static const struct dmi_system_id video_detect_dmi_table[] = { + DMI_MATCH(DMI_BOARD_NAME, "Lenovo IdeaPad S405"), + }, + }, ++ { ++ /* https://bugzilla.suse.com/show_bug.cgi?id=1208724 */ ++ .callback = video_detect_force_native, ++ /* Lenovo Ideapad Z470 */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_VERSION, "IdeaPad Z470"), ++ }, ++ }, + { + /* https://bugzilla.redhat.com/show_bug.cgi?id=1187004 */ + .callback = video_detect_force_native, +diff --git a/drivers/amba/bus.c b/drivers/amba/bus.c +index 702284bcd467c..252b0b43d50ee 100644 +--- a/drivers/amba/bus.c ++++ b/drivers/amba/bus.c +@@ -364,6 +364,7 @@ static void amba_device_release(struct device *dev) + { + struct amba_device *d = to_amba_device(dev); + ++ of_node_put(d->dev.of_node); + if (d->res.parent) + release_resource(&d->res); + kfree(d); +diff --git a/drivers/ata/pata_ftide010.c b/drivers/ata/pata_ftide010.c +index 34cb104f6b43e..bc30e2f305beb 100644 +--- a/drivers/ata/pata_ftide010.c ++++ b/drivers/ata/pata_ftide010.c +@@ -570,6 +570,7 @@ static struct platform_driver pata_ftide010_driver = { + }; + module_platform_driver(pata_ftide010_driver); + ++MODULE_DESCRIPTION("low level driver for Faraday Technology FTIDE010"); + MODULE_AUTHOR("Linus Walleij <linus.walleij@linaro.org>"); + MODULE_LICENSE("GPL"); + MODULE_ALIAS("platform:" DRV_NAME); +diff --git a/drivers/ata/sata_gemini.c b/drivers/ata/sata_gemini.c +index f793564f3d787..6fd54e968d10a 100644 +--- a/drivers/ata/sata_gemini.c ++++ b/drivers/ata/sata_gemini.c +@@ -435,6 +435,7 @@ static struct platform_driver gemini_sata_driver = { + }; + module_platform_driver(gemini_sata_driver); + ++MODULE_DESCRIPTION("low level driver for Cortina Systems Gemini SATA bridge"); + MODULE_AUTHOR("Linus Walleij <linus.walleij@linaro.org>"); + MODULE_LICENSE("GPL"); + MODULE_ALIAS("platform:" DRV_NAME); +diff --git a/drivers/base/regmap/regcache-rbtree.c b/drivers/base/regmap/regcache-rbtree.c +index fabf87058d80b..ae6b8788d5f3f 100644 +--- a/drivers/base/regmap/regcache-rbtree.c ++++ b/drivers/base/regmap/regcache-rbtree.c +@@ -277,7 +277,7 @@ static int regcache_rbtree_insert_to_block(struct regmap *map, + + blk = krealloc(rbnode->block, + blklen * map->cache_word_size, +- GFP_KERNEL); ++ map->alloc_flags); + if (!blk) + return -ENOMEM; + +@@ -286,7 +286,7 @@ static int regcache_rbtree_insert_to_block(struct regmap *map, + if (BITS_TO_LONGS(blklen) > BITS_TO_LONGS(rbnode->blklen)) { + present = krealloc(rbnode->cache_present, + BITS_TO_LONGS(blklen) * sizeof(*present), +- GFP_KERNEL); ++ map->alloc_flags); + if (!present) + return -ENOMEM; + +@@ -320,7 +320,7 @@ regcache_rbtree_node_alloc(struct regmap *map, unsigned int reg) + const struct regmap_range *range; + int i; + +- rbnode = kzalloc(sizeof(*rbnode), GFP_KERNEL); ++ rbnode = kzalloc(sizeof(*rbnode), map->alloc_flags); + if (!rbnode) + return NULL; + +@@ -346,13 +346,13 @@ regcache_rbtree_node_alloc(struct regmap *map, unsigned int reg) + } + + rbnode->block = kmalloc_array(rbnode->blklen, map->cache_word_size, +- GFP_KERNEL); ++ map->alloc_flags); + if (!rbnode->block) + goto err_free; + + rbnode->cache_present = kcalloc(BITS_TO_LONGS(rbnode->blklen), + sizeof(*rbnode->cache_present), +- GFP_KERNEL); ++ map->alloc_flags); + if (!rbnode->cache_present) + goto err_free_block; + +diff --git a/drivers/base/test/test_async_driver_probe.c b/drivers/base/test/test_async_driver_probe.c +index c157a912d6739..88336f093decd 100644 +--- a/drivers/base/test/test_async_driver_probe.c ++++ b/drivers/base/test/test_async_driver_probe.c +@@ -84,7 +84,7 @@ test_platform_device_register_node(char *name, int id, int nid) + + pdev = platform_device_alloc(name, id); + if (!pdev) +- return NULL; ++ return ERR_PTR(-ENOMEM); + + if (nid != NUMA_NO_NODE) + set_dev_node(&pdev->dev, nid); +diff --git a/drivers/bluetooth/btsdio.c b/drivers/bluetooth/btsdio.c +index fd9571d5fdac9..2c846f19bbd40 100644 +--- a/drivers/bluetooth/btsdio.c ++++ b/drivers/bluetooth/btsdio.c +@@ -346,6 +346,7 @@ static void btsdio_remove(struct sdio_func *func) + if (!data) + return; + ++ cancel_work_sync(&data->work); + hdev = data->hdev; + + sdio_set_drvdata(func, NULL); +diff --git a/drivers/bluetooth/hci_nokia.c b/drivers/bluetooth/hci_nokia.c +index 6463350b79779..82db15585196a 100644 +--- a/drivers/bluetooth/hci_nokia.c ++++ b/drivers/bluetooth/hci_nokia.c +@@ -734,7 +734,11 @@ static int nokia_bluetooth_serdev_probe(struct serdev_device *serdev) + return err; + } + +- clk_prepare_enable(sysclk); ++ err = clk_prepare_enable(sysclk); ++ if (err) { ++ dev_err(dev, "could not enable sysclk: %d", err); ++ return err; ++ } + btdev->sysclk_speed = clk_get_rate(sysclk); + clk_disable_unprepare(sysclk); + +diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c +index e1a9838c96655..b542c2b2aef49 100644 +--- a/drivers/bus/ti-sysc.c ++++ b/drivers/bus/ti-sysc.c +@@ -1379,6 +1379,8 @@ static const struct sysc_revision_quirk sysc_revision_quirks[] = { + SYSC_QUIRK_SWSUP_SIDLE | SYSC_QUIRK_LEGACY_IDLE), + SYSC_QUIRK("uart", 0, 0x50, 0x54, 0x58, 0x47422e03, 0xffffffff, + SYSC_QUIRK_SWSUP_SIDLE | SYSC_QUIRK_LEGACY_IDLE), ++ SYSC_QUIRK("uart", 0, 0x50, 0x54, 0x58, 0x47424e03, 0xffffffff, ++ SYSC_QUIRK_SWSUP_SIDLE | SYSC_QUIRK_LEGACY_IDLE), + + /* Quirks that need to be set based on the module address */ + SYSC_QUIRK("mcpdm", 0x40132000, 0, 0x10, -ENODEV, 0x50000800, 0xffffffff, +diff --git a/drivers/char/hw_random/iproc-rng200.c b/drivers/char/hw_random/iproc-rng200.c +index 92be1c0ab99f3..b2d3da17daa8e 100644 +--- a/drivers/char/hw_random/iproc-rng200.c ++++ b/drivers/char/hw_random/iproc-rng200.c +@@ -202,10 +202,12 @@ static int iproc_rng200_probe(struct platform_device *pdev) + return PTR_ERR(priv->base); + } + +- priv->rng.name = "iproc-rng200", +- priv->rng.read = iproc_rng200_read, +- priv->rng.init = iproc_rng200_init, +- priv->rng.cleanup = iproc_rng200_cleanup, ++ dev_set_drvdata(dev, priv); ++ ++ priv->rng.name = "iproc-rng200"; ++ priv->rng.read = iproc_rng200_read; ++ priv->rng.init = iproc_rng200_init; ++ priv->rng.cleanup = iproc_rng200_cleanup; + + /* Register driver */ + ret = devm_hwrng_register(dev, &priv->rng); +@@ -219,6 +221,28 @@ static int iproc_rng200_probe(struct platform_device *pdev) + return 0; + } + ++static int __maybe_unused iproc_rng200_suspend(struct device *dev) ++{ ++ struct iproc_rng200_dev *priv = dev_get_drvdata(dev); ++ ++ iproc_rng200_cleanup(&priv->rng); ++ ++ return 0; ++} ++ ++static int __maybe_unused iproc_rng200_resume(struct device *dev) ++{ ++ struct iproc_rng200_dev *priv = dev_get_drvdata(dev); ++ ++ iproc_rng200_init(&priv->rng); ++ ++ return 0; ++} ++ ++static const struct dev_pm_ops iproc_rng200_pm_ops = { ++ SET_SYSTEM_SLEEP_PM_OPS(iproc_rng200_suspend, iproc_rng200_resume) ++}; ++ + static const struct of_device_id iproc_rng200_of_match[] = { + { .compatible = "brcm,bcm7211-rng200", }, + { .compatible = "brcm,bcm7278-rng200", }, +@@ -231,6 +255,7 @@ static struct platform_driver iproc_rng200_driver = { + .driver = { + .name = "iproc-rng200", + .of_match_table = iproc_rng200_of_match, ++ .pm = &iproc_rng200_pm_ops, + }, + .probe = iproc_rng200_probe, + }; +diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c +index 2879b5267dfbe..c207f15dc7d1f 100644 +--- a/drivers/char/ipmi/ipmi_si_intf.c ++++ b/drivers/char/ipmi/ipmi_si_intf.c +@@ -2086,6 +2086,11 @@ static int try_smi_init(struct smi_info *new_smi) + new_smi->io.io_cleanup = NULL; + } + ++ if (rv && new_smi->si_sm) { ++ kfree(new_smi->si_sm); ++ new_smi->si_sm = NULL; ++ } ++ + return rv; + } + +diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c +index 2907b0bca1af0..a1b080dfa9604 100644 +--- a/drivers/char/ipmi/ipmi_ssif.c ++++ b/drivers/char/ipmi/ipmi_ssif.c +@@ -1410,7 +1410,7 @@ static struct ssif_addr_info *ssif_info_find(unsigned short addr, + restart: + list_for_each_entry(info, &ssif_infos, link) { + if (info->binfo.addr == addr) { +- if (info->addr_src == SI_SMBIOS) ++ if (info->addr_src == SI_SMBIOS && !info->adapter_name) + info->adapter_name = kstrdup(adapter_name, + GFP_KERNEL); + +@@ -1609,6 +1609,11 @@ static int ssif_add_infos(struct i2c_client *client) + info->addr_src = SI_ACPI; + info->client = client; + info->adapter_name = kstrdup(client->adapter->name, GFP_KERNEL); ++ if (!info->adapter_name) { ++ kfree(info); ++ return -ENOMEM; ++ } ++ + info->binfo.addr = client->addr; + list_add_tail(&info->link, &ssif_infos); + return 0; +diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c +index ef47d1d58ac3a..a084f732c1804 100644 +--- a/drivers/char/tpm/tpm_tis_core.c ++++ b/drivers/char/tpm/tpm_tis_core.c +@@ -421,10 +421,17 @@ static int tpm_tis_send_main(struct tpm_chip *chip, const u8 *buf, size_t len) + int rc; + u32 ordinal; + unsigned long dur; +- +- rc = tpm_tis_send_data(chip, buf, len); +- if (rc < 0) +- return rc; ++ unsigned int try; ++ ++ for (try = 0; try < TPM_RETRY; try++) { ++ rc = tpm_tis_send_data(chip, buf, len); ++ if (rc >= 0) ++ /* Data transfer done successfully */ ++ break; ++ else if (rc != -EIO) ++ /* Data transfer failed, not recoverable */ ++ return rc; ++ } + + /* go and do it */ + rc = tpm_tis_write8(priv, TPM_STS(priv->locality), TPM_STS_GO); +diff --git a/drivers/clk/Kconfig b/drivers/clk/Kconfig +index cc871ae3a1792..5b34dbc830ee4 100644 +--- a/drivers/clk/Kconfig ++++ b/drivers/clk/Kconfig +@@ -302,6 +302,7 @@ config COMMON_CLK_BD718XX + config COMMON_CLK_FIXED_MMIO + bool "Clock driver for Memory Mapped Fixed values" + depends on COMMON_CLK && OF ++ depends on HAS_IOMEM + help + Support for Memory Mapped IO Fixed clocks + +diff --git a/drivers/clk/imx/clk-composite-8m.c b/drivers/clk/imx/clk-composite-8m.c +index d3486ee79ab54..78122188ac39e 100644 +--- a/drivers/clk/imx/clk-composite-8m.c ++++ b/drivers/clk/imx/clk-composite-8m.c +@@ -95,7 +95,7 @@ static int imx8m_clk_composite_divider_set_rate(struct clk_hw *hw, + int prediv_value; + int div_value; + int ret; +- u32 val; ++ u32 orig, val; + + ret = imx8m_clk_composite_compute_dividers(rate, parent_rate, + &prediv_value, &div_value); +@@ -104,13 +104,15 @@ static int imx8m_clk_composite_divider_set_rate(struct clk_hw *hw, + + spin_lock_irqsave(divider->lock, flags); + +- val = readl(divider->reg); +- val &= ~((clk_div_mask(divider->width) << divider->shift) | +- (clk_div_mask(PCG_DIV_WIDTH) << PCG_DIV_SHIFT)); ++ orig = readl(divider->reg); ++ val = orig & ~((clk_div_mask(divider->width) << divider->shift) | ++ (clk_div_mask(PCG_DIV_WIDTH) << PCG_DIV_SHIFT)); + + val |= (u32)(prediv_value - 1) << divider->shift; + val |= (u32)(div_value - 1) << PCG_DIV_SHIFT; +- writel(val, divider->reg); ++ ++ if (val != orig) ++ writel(val, divider->reg); + + spin_unlock_irqrestore(divider->lock, flags); + +diff --git a/drivers/clk/imx/clk-imx8mm.c b/drivers/clk/imx/clk-imx8mm.c +index 172589e94f60e..ec34c52416369 100644 +--- a/drivers/clk/imx/clk-imx8mm.c ++++ b/drivers/clk/imx/clk-imx8mm.c +@@ -26,73 +26,6 @@ static u32 share_count_disp; + static u32 share_count_pdm; + static u32 share_count_nand; + +-static const struct imx_pll14xx_rate_table imx8mm_pll1416x_tbl[] = { +- PLL_1416X_RATE(1800000000U, 225, 3, 0), +- PLL_1416X_RATE(1600000000U, 200, 3, 0), +- PLL_1416X_RATE(1200000000U, 300, 3, 1), +- PLL_1416X_RATE(1000000000U, 250, 3, 1), +- PLL_1416X_RATE(800000000U, 200, 3, 1), +- PLL_1416X_RATE(750000000U, 250, 2, 2), +- PLL_1416X_RATE(700000000U, 350, 3, 2), +- PLL_1416X_RATE(600000000U, 300, 3, 2), +-}; +- +-static const struct imx_pll14xx_rate_table imx8mm_audiopll_tbl[] = { +- PLL_1443X_RATE(393216000U, 262, 2, 3, 9437), +- PLL_1443X_RATE(361267200U, 361, 3, 3, 17511), +-}; +- +-static const struct imx_pll14xx_rate_table imx8mm_videopll_tbl[] = { +- PLL_1443X_RATE(650000000U, 325, 3, 2, 0), +- PLL_1443X_RATE(594000000U, 198, 2, 2, 0), +-}; +- +-static const struct imx_pll14xx_rate_table imx8mm_drampll_tbl[] = { +- PLL_1443X_RATE(650000000U, 325, 3, 2, 0), +-}; +- +-static struct imx_pll14xx_clk imx8mm_audio_pll = { +- .type = PLL_1443X, +- .rate_table = imx8mm_audiopll_tbl, +- .rate_count = ARRAY_SIZE(imx8mm_audiopll_tbl), +-}; +- +-static struct imx_pll14xx_clk imx8mm_video_pll = { +- .type = PLL_1443X, +- .rate_table = imx8mm_videopll_tbl, +- .rate_count = ARRAY_SIZE(imx8mm_videopll_tbl), +-}; +- +-static struct imx_pll14xx_clk imx8mm_dram_pll = { +- .type = PLL_1443X, +- .rate_table = imx8mm_drampll_tbl, +- .rate_count = ARRAY_SIZE(imx8mm_drampll_tbl), +-}; +- +-static struct imx_pll14xx_clk imx8mm_arm_pll = { +- .type = PLL_1416X, +- .rate_table = imx8mm_pll1416x_tbl, +- .rate_count = ARRAY_SIZE(imx8mm_pll1416x_tbl), +-}; +- +-static struct imx_pll14xx_clk imx8mm_gpu_pll = { +- .type = PLL_1416X, +- .rate_table = imx8mm_pll1416x_tbl, +- .rate_count = ARRAY_SIZE(imx8mm_pll1416x_tbl), +-}; +- +-static struct imx_pll14xx_clk imx8mm_vpu_pll = { +- .type = PLL_1416X, +- .rate_table = imx8mm_pll1416x_tbl, +- .rate_count = ARRAY_SIZE(imx8mm_pll1416x_tbl), +-}; +- +-static struct imx_pll14xx_clk imx8mm_sys_pll = { +- .type = PLL_1416X, +- .rate_table = imx8mm_pll1416x_tbl, +- .rate_count = ARRAY_SIZE(imx8mm_pll1416x_tbl), +-}; +- + static const char *pll_ref_sels[] = { "osc_24m", "dummy", "dummy", "dummy", }; + static const char *audio_pll1_bypass_sels[] = {"audio_pll1", "audio_pll1_ref_sel", }; + static const char *audio_pll2_bypass_sels[] = {"audio_pll2", "audio_pll2_ref_sel", }; +@@ -396,16 +329,16 @@ static int imx8mm_clocks_probe(struct platform_device *pdev) + clks[IMX8MM_SYS_PLL2_REF_SEL] = imx_clk_mux("sys_pll2_ref_sel", base + 0x104, 0, 2, pll_ref_sels, ARRAY_SIZE(pll_ref_sels)); + clks[IMX8MM_SYS_PLL3_REF_SEL] = imx_clk_mux("sys_pll3_ref_sel", base + 0x114, 0, 2, pll_ref_sels, ARRAY_SIZE(pll_ref_sels)); + +- clks[IMX8MM_AUDIO_PLL1] = imx_clk_pll14xx("audio_pll1", "audio_pll1_ref_sel", base, &imx8mm_audio_pll); +- clks[IMX8MM_AUDIO_PLL2] = imx_clk_pll14xx("audio_pll2", "audio_pll2_ref_sel", base + 0x14, &imx8mm_audio_pll); +- clks[IMX8MM_VIDEO_PLL1] = imx_clk_pll14xx("video_pll1", "video_pll1_ref_sel", base + 0x28, &imx8mm_video_pll); +- clks[IMX8MM_DRAM_PLL] = imx_clk_pll14xx("dram_pll", "dram_pll_ref_sel", base + 0x50, &imx8mm_dram_pll); +- clks[IMX8MM_GPU_PLL] = imx_clk_pll14xx("gpu_pll", "gpu_pll_ref_sel", base + 0x64, &imx8mm_gpu_pll); +- clks[IMX8MM_VPU_PLL] = imx_clk_pll14xx("vpu_pll", "vpu_pll_ref_sel", base + 0x74, &imx8mm_vpu_pll); +- clks[IMX8MM_ARM_PLL] = imx_clk_pll14xx("arm_pll", "arm_pll_ref_sel", base + 0x84, &imx8mm_arm_pll); +- clks[IMX8MM_SYS_PLL1] = imx_clk_pll14xx("sys_pll1", "sys_pll1_ref_sel", base + 0x94, &imx8mm_sys_pll); +- clks[IMX8MM_SYS_PLL2] = imx_clk_pll14xx("sys_pll2", "sys_pll2_ref_sel", base + 0x104, &imx8mm_sys_pll); +- clks[IMX8MM_SYS_PLL3] = imx_clk_pll14xx("sys_pll3", "sys_pll3_ref_sel", base + 0x114, &imx8mm_sys_pll); ++ clks[IMX8MM_AUDIO_PLL1] = imx_clk_pll14xx("audio_pll1", "audio_pll1_ref_sel", base, &imx_1443x_pll); ++ clks[IMX8MM_AUDIO_PLL2] = imx_clk_pll14xx("audio_pll2", "audio_pll2_ref_sel", base + 0x14, &imx_1443x_pll); ++ clks[IMX8MM_VIDEO_PLL1] = imx_clk_pll14xx("video_pll1", "video_pll1_ref_sel", base + 0x28, &imx_1443x_pll); ++ clks[IMX8MM_DRAM_PLL] = imx_clk_pll14xx("dram_pll", "dram_pll_ref_sel", base + 0x50, &imx_1443x_pll); ++ clks[IMX8MM_GPU_PLL] = imx_clk_pll14xx("gpu_pll", "gpu_pll_ref_sel", base + 0x64, &imx_1416x_pll); ++ clks[IMX8MM_VPU_PLL] = imx_clk_pll14xx("vpu_pll", "vpu_pll_ref_sel", base + 0x74, &imx_1416x_pll); ++ clks[IMX8MM_ARM_PLL] = imx_clk_pll14xx("arm_pll", "arm_pll_ref_sel", base + 0x84, &imx_1416x_pll); ++ clks[IMX8MM_SYS_PLL1] = imx_clk_pll14xx("sys_pll1", "sys_pll1_ref_sel", base + 0x94, &imx_1416x_pll); ++ clks[IMX8MM_SYS_PLL2] = imx_clk_pll14xx("sys_pll2", "sys_pll2_ref_sel", base + 0x104, &imx_1416x_pll); ++ clks[IMX8MM_SYS_PLL3] = imx_clk_pll14xx("sys_pll3", "sys_pll3_ref_sel", base + 0x114, &imx_1416x_pll); + + /* PLL bypass out */ + clks[IMX8MM_AUDIO_PLL1_BYPASS] = imx_clk_mux_flags("audio_pll1_bypass", base, 16, 1, audio_pll1_bypass_sels, ARRAY_SIZE(audio_pll1_bypass_sels), CLK_SET_RATE_PARENT); +diff --git a/drivers/clk/imx/clk-pll14xx.c b/drivers/clk/imx/clk-pll14xx.c +index 047f1d8fe323f..c43e9653b4156 100644 +--- a/drivers/clk/imx/clk-pll14xx.c ++++ b/drivers/clk/imx/clk-pll14xx.c +@@ -41,6 +41,36 @@ struct clk_pll14xx { + + #define to_clk_pll14xx(_hw) container_of(_hw, struct clk_pll14xx, hw) + ++const struct imx_pll14xx_rate_table imx_pll1416x_tbl[] = { ++ PLL_1416X_RATE(1800000000U, 225, 3, 0), ++ PLL_1416X_RATE(1600000000U, 200, 3, 0), ++ PLL_1416X_RATE(1200000000U, 300, 3, 1), ++ PLL_1416X_RATE(1000000000U, 250, 3, 1), ++ PLL_1416X_RATE(800000000U, 200, 3, 1), ++ PLL_1416X_RATE(750000000U, 250, 2, 2), ++ PLL_1416X_RATE(700000000U, 350, 3, 2), ++ PLL_1416X_RATE(600000000U, 300, 3, 2), ++}; ++ ++const struct imx_pll14xx_rate_table imx_pll1443x_tbl[] = { ++ PLL_1443X_RATE(650000000U, 325, 3, 2, 0), ++ PLL_1443X_RATE(594000000U, 198, 2, 2, 0), ++ PLL_1443X_RATE(393216000U, 262, 2, 3, 9437), ++ PLL_1443X_RATE(361267200U, 361, 3, 3, 17511), ++}; ++ ++struct imx_pll14xx_clk imx_1443x_pll = { ++ .type = PLL_1443X, ++ .rate_table = imx_pll1443x_tbl, ++ .rate_count = ARRAY_SIZE(imx_pll1443x_tbl), ++}; ++ ++struct imx_pll14xx_clk imx_1416x_pll = { ++ .type = PLL_1416X, ++ .rate_table = imx_pll1416x_tbl, ++ .rate_count = ARRAY_SIZE(imx_pll1416x_tbl), ++}; ++ + static const struct imx_pll14xx_rate_table *imx_get_pll_settings( + struct clk_pll14xx *pll, unsigned long rate) + { +diff --git a/drivers/clk/imx/clk.h b/drivers/clk/imx/clk.h +index 6fe64ff8ffa12..30ddbc1ced2ee 100644 +--- a/drivers/clk/imx/clk.h ++++ b/drivers/clk/imx/clk.h +@@ -50,6 +50,9 @@ struct imx_pll14xx_clk { + int flags; + }; + ++extern struct imx_pll14xx_clk imx_1416x_pll; ++extern struct imx_pll14xx_clk imx_1443x_pll; ++ + #define imx_clk_cpu(name, parent_name, div, mux, pll, step) \ + to_clk(imx_clk_hw_cpu(name, parent_name, div, mux, pll, step)) + +diff --git a/drivers/clk/keystone/pll.c b/drivers/clk/keystone/pll.c +index d59a7621bb204..ee5c72369334f 100644 +--- a/drivers/clk/keystone/pll.c ++++ b/drivers/clk/keystone/pll.c +@@ -209,7 +209,7 @@ static void __init _of_pll_clk_init(struct device_node *node, bool pllctrl) + } + + clk = clk_register_pll(NULL, node->name, parent_name, pll_data); +- if (clk) { ++ if (!IS_ERR_OR_NULL(clk)) { + of_clk_add_provider(node, of_clk_src_simple_get, clk); + return; + } +diff --git a/drivers/clk/qcom/gcc-mdm9615.c b/drivers/clk/qcom/gcc-mdm9615.c +index 8bed02a748aba..470a277603a92 100644 +--- a/drivers/clk/qcom/gcc-mdm9615.c ++++ b/drivers/clk/qcom/gcc-mdm9615.c +@@ -58,7 +58,7 @@ static struct clk_regmap pll0_vote = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "pll0_vote", +- .parent_names = (const char *[]){ "pll8" }, ++ .parent_names = (const char *[]){ "pll0" }, + .num_parents = 1, + .ops = &clk_pll_vote_ops, + }, +diff --git a/drivers/clk/sunxi-ng/ccu_mmc_timing.c b/drivers/clk/sunxi-ng/ccu_mmc_timing.c +index de33414fc5c28..c6a6ce98ca03a 100644 +--- a/drivers/clk/sunxi-ng/ccu_mmc_timing.c ++++ b/drivers/clk/sunxi-ng/ccu_mmc_timing.c +@@ -43,7 +43,7 @@ int sunxi_ccu_set_mmc_timing_mode(struct clk *clk, bool new_mode) + EXPORT_SYMBOL_GPL(sunxi_ccu_set_mmc_timing_mode); + + /** +- * sunxi_ccu_set_mmc_timing_mode: Get the current MMC clock timing mode ++ * sunxi_ccu_get_mmc_timing_mode: Get the current MMC clock timing mode + * @clk: clock to query + * + * Returns 0 if the clock is in old timing mode, > 0 if it is in +diff --git a/drivers/cpufreq/brcmstb-avs-cpufreq.c b/drivers/cpufreq/brcmstb-avs-cpufreq.c +index a3c82f530d608..541486217984b 100644 +--- a/drivers/cpufreq/brcmstb-avs-cpufreq.c ++++ b/drivers/cpufreq/brcmstb-avs-cpufreq.c +@@ -410,7 +410,11 @@ brcm_avs_get_freq_table(struct device *dev, struct private_data *priv) + if (ret) + return ERR_PTR(ret); + +- table = devm_kcalloc(dev, AVS_PSTATE_MAX + 1, sizeof(*table), ++ /* ++ * We allocate space for the 5 different P-STATES AVS, ++ * plus extra space for a terminating element. ++ */ ++ table = devm_kcalloc(dev, AVS_PSTATE_MAX + 1 + 1, sizeof(*table), + GFP_KERNEL); + if (!table) + return ERR_PTR(-ENOMEM); +diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c +index 01f0a8bdd534b..11b9edc713baa 100644 +--- a/drivers/cpufreq/cpufreq.c ++++ b/drivers/cpufreq/cpufreq.c +@@ -441,8 +441,10 @@ void cpufreq_freq_transition_end(struct cpufreq_policy *policy, + + cpufreq_notify_post_transition(policy, freqs, transition_failed); + ++ spin_lock(&policy->transition_lock); + policy->transition_ongoing = false; + policy->transition_task = NULL; ++ spin_unlock(&policy->transition_lock); + + wake_up(&policy->transition_wait); + } +diff --git a/drivers/cpufreq/powernow-k8.c b/drivers/cpufreq/powernow-k8.c +index 1b2ec3be59eb7..c658e8e49f902 100644 +--- a/drivers/cpufreq/powernow-k8.c ++++ b/drivers/cpufreq/powernow-k8.c +@@ -1101,7 +1101,8 @@ static int powernowk8_cpu_exit(struct cpufreq_policy *pol) + + kfree(data->powernow_table); + kfree(data); +- for_each_cpu(cpu, pol->cpus) ++ /* pol->cpus will be empty here, use related_cpus instead. */ ++ for_each_cpu(cpu, pol->related_cpus) + per_cpu(powernow_data, cpu) = NULL; + + return 0; +diff --git a/drivers/crypto/caam/caampkc.c b/drivers/crypto/caam/caampkc.c +index 30e3f41ed8721..e0bba20c13cb5 100644 +--- a/drivers/crypto/caam/caampkc.c ++++ b/drivers/crypto/caam/caampkc.c +@@ -225,7 +225,9 @@ static int caam_rsa_count_leading_zeros(struct scatterlist *sgl, + if (len && *buff) + break; + +- sg_miter_next(&miter); ++ if (!sg_miter_next(&miter)) ++ break; ++ + buff = miter.addr; + len = miter.length; + +diff --git a/drivers/crypto/stm32/stm32-hash.c b/drivers/crypto/stm32/stm32-hash.c +index dcce15b558091..393d0cae10f19 100644 +--- a/drivers/crypto/stm32/stm32-hash.c ++++ b/drivers/crypto/stm32/stm32-hash.c +@@ -562,9 +562,9 @@ static int stm32_hash_dma_send(struct stm32_hash_dev *hdev) + } + + for_each_sg(rctx->sg, tsg, rctx->nents, i) { ++ sg[0] = *tsg; + len = sg->length; + +- sg[0] = *tsg; + if (sg_is_last(sg)) { + if (hdev->dma_mode == 1) { + len = (ALIGN(sg->length, 16) - 16); +@@ -1553,9 +1553,7 @@ static int stm32_hash_remove(struct platform_device *pdev) + if (!hdev) + return -ENODEV; + +- ret = pm_runtime_resume_and_get(hdev->dev); +- if (ret < 0) +- return ret; ++ ret = pm_runtime_get_sync(hdev->dev); + + stm32_hash_unregister_algs(hdev); + +@@ -1571,7 +1569,8 @@ static int stm32_hash_remove(struct platform_device *pdev) + pm_runtime_disable(hdev->dev); + pm_runtime_put_noidle(hdev->dev); + +- clk_disable_unprepare(hdev->clk); ++ if (ret >= 0) ++ clk_disable_unprepare(hdev->clk); + + return 0; + } +diff --git a/drivers/devfreq/devfreq.c b/drivers/devfreq/devfreq.c +index f5ad9b9986549..31e6cb5211bc4 100644 +--- a/drivers/devfreq/devfreq.c ++++ b/drivers/devfreq/devfreq.c +@@ -595,6 +595,7 @@ static void devfreq_dev_release(struct device *dev) + devfreq->profile->exit(devfreq->dev.parent); + + mutex_destroy(&devfreq->lock); ++ srcu_cleanup_notifier_head(&devfreq->transition_notifier_list); + kfree(devfreq); + } + +diff --git a/drivers/dma/Kconfig b/drivers/dma/Kconfig +index 1322461f1f3c5..66aad9dbd58c5 100644 +--- a/drivers/dma/Kconfig ++++ b/drivers/dma/Kconfig +@@ -208,6 +208,7 @@ config FSL_DMA + config FSL_EDMA + tristate "Freescale eDMA engine support" + depends on OF ++ depends on HAS_IOMEM + select DMA_ENGINE + select DMA_VIRTUAL_CHANNELS + help +@@ -268,6 +269,7 @@ config IMX_SDMA + + config INTEL_IDMA64 + tristate "Intel integrated DMA 64-bit support" ++ depends on HAS_IOMEM + select DMA_ENGINE + select DMA_VIRTUAL_CHANNELS + help +diff --git a/drivers/dma/ste_dma40.c b/drivers/dma/ste_dma40.c +index 6671bfe084895..96a808b487cbe 100644 +--- a/drivers/dma/ste_dma40.c ++++ b/drivers/dma/ste_dma40.c +@@ -3599,6 +3599,10 @@ static int __init d40_probe(struct platform_device *pdev) + spin_lock_init(&base->lcla_pool.lock); + + base->irq = platform_get_irq(pdev, 0); ++ if (base->irq < 0) { ++ ret = base->irq; ++ goto destroy_cache; ++ } + + ret = request_irq(base->irq, d40_handle_interrupt, 0, D40_NAME, base); + if (ret) { +diff --git a/drivers/firmware/stratix10-svc.c b/drivers/firmware/stratix10-svc.c +index 2da2aa79c87e2..c871b4227a642 100644 +--- a/drivers/firmware/stratix10-svc.c ++++ b/drivers/firmware/stratix10-svc.c +@@ -616,7 +616,7 @@ svc_create_memory_pool(struct platform_device *pdev, + paddr = begin; + size = end - begin; + va = devm_memremap(dev, paddr, size, MEMREMAP_WC); +- if (!va) { ++ if (IS_ERR(va)) { + dev_err(dev, "fail to remap shared memory\n"); + return ERR_PTR(-EINVAL); + } +diff --git a/drivers/fsi/fsi-master-ast-cf.c b/drivers/fsi/fsi-master-ast-cf.c +index 04d10ea8d343b..a7fc04bf6550a 100644 +--- a/drivers/fsi/fsi-master-ast-cf.c ++++ b/drivers/fsi/fsi-master-ast-cf.c +@@ -1438,3 +1438,4 @@ static struct platform_driver fsi_master_acf = { + + module_platform_driver(fsi_master_acf); + MODULE_LICENSE("GPL"); ++MODULE_FIRMWARE(FW_FILE_NAME); +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +index 0e478d4d830c9..1a83055211762 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +@@ -43,7 +43,6 @@ static int amdgpu_cs_user_fence_chunk(struct amdgpu_cs_parser *p, + struct drm_gem_object *gobj; + struct amdgpu_bo *bo; + unsigned long size; +- int r; + + gobj = drm_gem_object_lookup(p->filp, data->handle); + if (gobj == NULL) +@@ -58,23 +57,14 @@ static int amdgpu_cs_user_fence_chunk(struct amdgpu_cs_parser *p, + drm_gem_object_put_unlocked(gobj); + + size = amdgpu_bo_size(bo); +- if (size != PAGE_SIZE || (data->offset + 8) > size) { +- r = -EINVAL; +- goto error_unref; +- } ++ if (size != PAGE_SIZE || data->offset > (size - 8)) ++ return -EINVAL; + +- if (amdgpu_ttm_tt_get_usermm(bo->tbo.ttm)) { +- r = -EINVAL; +- goto error_unref; +- } ++ if (amdgpu_ttm_tt_get_usermm(bo->tbo.ttm)) ++ return -EINVAL; + + *offset = data->offset; +- + return 0; +- +-error_unref: +- amdgpu_bo_unref(&bo); +- return r; + } + + static int amdgpu_cs_bo_handles_chunk(struct amdgpu_cs_parser *p, +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +index d0e1fd011de54..e5032eb9ae291 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +@@ -759,6 +759,9 @@ int amdgpu_device_resize_fb_bar(struct amdgpu_device *adev) + u16 cmd; + int r; + ++ if (!IS_ENABLED(CONFIG_PHYS_ADDR_T_64BIT)) ++ return 0; ++ + /* Bypass for VF */ + if (amdgpu_sriov_vf(adev)) + return 0; +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c +index 59fd9ebf3a58b..26a1173df9586 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c +@@ -471,6 +471,7 @@ static int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file + crtc = (struct drm_crtc *)minfo->crtcs[i]; + if (crtc && crtc->base.id == info->mode_crtc.id) { + struct amdgpu_crtc *amdgpu_crtc = to_amdgpu_crtc(crtc); ++ + ui32 = amdgpu_crtc->crtc_id; + found = 1; + break; +@@ -489,7 +490,7 @@ static int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file + if (ret) + return ret; + +- ret = copy_to_user(out, &ip, min((size_t)size, sizeof(ip))); ++ ret = copy_to_user(out, &ip, min_t(size_t, size, sizeof(ip))); + return ret ? -EFAULT : 0; + } + case AMDGPU_INFO_HW_IP_COUNT: { +@@ -625,17 +626,18 @@ static int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file + ? -EFAULT : 0; + } + case AMDGPU_INFO_READ_MMR_REG: { +- unsigned n, alloc_size; ++ unsigned int n, alloc_size; + uint32_t *regs; +- unsigned se_num = (info->read_mmr_reg.instance >> ++ unsigned int se_num = (info->read_mmr_reg.instance >> + AMDGPU_INFO_MMR_SE_INDEX_SHIFT) & + AMDGPU_INFO_MMR_SE_INDEX_MASK; +- unsigned sh_num = (info->read_mmr_reg.instance >> ++ unsigned int sh_num = (info->read_mmr_reg.instance >> + AMDGPU_INFO_MMR_SH_INDEX_SHIFT) & + AMDGPU_INFO_MMR_SH_INDEX_MASK; + + /* set full masks if the userspace set all bits +- * in the bitfields */ ++ * in the bitfields ++ */ + if (se_num == AMDGPU_INFO_MMR_SE_INDEX_MASK) + se_num = 0xffffffff; + else if (se_num >= AMDGPU_GFX_MAX_SE) +@@ -766,7 +768,7 @@ static int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file + min((size_t)size, sizeof(dev_info))) ? -EFAULT : 0; + } + case AMDGPU_INFO_VCE_CLOCK_TABLE: { +- unsigned i; ++ unsigned int i; + struct drm_amdgpu_info_vce_clock_table vce_clk_table = {}; + struct amd_vce_state *vce_state; + +diff --git a/drivers/gpu/drm/amd/amdgpu/cik.c b/drivers/gpu/drm/amd/amdgpu/cik.c +index b81bb414fcb30..ee7e218c7daef 100644 +--- a/drivers/gpu/drm/amd/amdgpu/cik.c ++++ b/drivers/gpu/drm/amd/amdgpu/cik.c +@@ -1384,7 +1384,6 @@ static int cik_set_vce_clocks(struct amdgpu_device *adev, u32 evclk, u32 ecclk) + static void cik_pcie_gen3_enable(struct amdgpu_device *adev) + { + struct pci_dev *root = adev->pdev->bus->self; +- int bridge_pos, gpu_pos; + u32 speed_cntl, current_data_rate; + int i; + u16 tmp16; +@@ -1419,12 +1418,7 @@ static void cik_pcie_gen3_enable(struct amdgpu_device *adev) + DRM_INFO("enabling PCIE gen 2 link speeds, disable with amdgpu.pcie_gen2=0\n"); + } + +- bridge_pos = pci_pcie_cap(root); +- if (!bridge_pos) +- return; +- +- gpu_pos = pci_pcie_cap(adev->pdev); +- if (!gpu_pos) ++ if (!pci_is_pcie(root) || !pci_is_pcie(adev->pdev)) + return; + + if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN3) { +@@ -1434,14 +1428,8 @@ static void cik_pcie_gen3_enable(struct amdgpu_device *adev) + u16 bridge_cfg2, gpu_cfg2; + u32 max_lw, current_lw, tmp; + +- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL, &bridge_cfg); +- pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL, &gpu_cfg); +- +- tmp16 = bridge_cfg | PCI_EXP_LNKCTL_HAWD; +- pci_write_config_word(root, bridge_pos + PCI_EXP_LNKCTL, tmp16); +- +- tmp16 = gpu_cfg | PCI_EXP_LNKCTL_HAWD; +- pci_write_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL, tmp16); ++ pcie_capability_set_word(root, PCI_EXP_LNKCTL, PCI_EXP_LNKCTL_HAWD); ++ pcie_capability_set_word(adev->pdev, PCI_EXP_LNKCTL, PCI_EXP_LNKCTL_HAWD); + + tmp = RREG32_PCIE(ixPCIE_LC_STATUS1); + max_lw = (tmp & PCIE_LC_STATUS1__LC_DETECTED_LINK_WIDTH_MASK) >> +@@ -1465,15 +1453,23 @@ static void cik_pcie_gen3_enable(struct amdgpu_device *adev) + + for (i = 0; i < 10; i++) { + /* check status */ +- pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_DEVSTA, &tmp16); ++ pcie_capability_read_word(adev->pdev, ++ PCI_EXP_DEVSTA, ++ &tmp16); + if (tmp16 & PCI_EXP_DEVSTA_TRPND) + break; + +- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL, &bridge_cfg); +- pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL, &gpu_cfg); ++ pcie_capability_read_word(root, PCI_EXP_LNKCTL, ++ &bridge_cfg); ++ pcie_capability_read_word(adev->pdev, ++ PCI_EXP_LNKCTL, ++ &gpu_cfg); + +- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, &bridge_cfg2); +- pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &gpu_cfg2); ++ pcie_capability_read_word(root, PCI_EXP_LNKCTL2, ++ &bridge_cfg2); ++ pcie_capability_read_word(adev->pdev, ++ PCI_EXP_LNKCTL2, ++ &gpu_cfg2); + + tmp = RREG32_PCIE(ixPCIE_LC_CNTL4); + tmp |= PCIE_LC_CNTL4__LC_SET_QUIESCE_MASK; +@@ -1486,26 +1482,38 @@ static void cik_pcie_gen3_enable(struct amdgpu_device *adev) + msleep(100); + + /* linkctl */ +- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL, &tmp16); +- tmp16 &= ~PCI_EXP_LNKCTL_HAWD; +- tmp16 |= (bridge_cfg & PCI_EXP_LNKCTL_HAWD); +- pci_write_config_word(root, bridge_pos + PCI_EXP_LNKCTL, tmp16); +- +- pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL, &tmp16); +- tmp16 &= ~PCI_EXP_LNKCTL_HAWD; +- tmp16 |= (gpu_cfg & PCI_EXP_LNKCTL_HAWD); +- pci_write_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL, tmp16); ++ pcie_capability_clear_and_set_word(root, PCI_EXP_LNKCTL, ++ PCI_EXP_LNKCTL_HAWD, ++ bridge_cfg & ++ PCI_EXP_LNKCTL_HAWD); ++ pcie_capability_clear_and_set_word(adev->pdev, PCI_EXP_LNKCTL, ++ PCI_EXP_LNKCTL_HAWD, ++ gpu_cfg & ++ PCI_EXP_LNKCTL_HAWD); + + /* linkctl2 */ +- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, &tmp16); +- tmp16 &= ~((1 << 4) | (7 << 9)); +- tmp16 |= (bridge_cfg2 & ((1 << 4) | (7 << 9))); +- pci_write_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, tmp16); +- +- pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &tmp16); +- tmp16 &= ~((1 << 4) | (7 << 9)); +- tmp16 |= (gpu_cfg2 & ((1 << 4) | (7 << 9))); +- pci_write_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL2, tmp16); ++ pcie_capability_read_word(root, PCI_EXP_LNKCTL2, ++ &tmp16); ++ tmp16 &= ~(PCI_EXP_LNKCTL2_ENTER_COMP | ++ PCI_EXP_LNKCTL2_TX_MARGIN); ++ tmp16 |= (bridge_cfg2 & ++ (PCI_EXP_LNKCTL2_ENTER_COMP | ++ PCI_EXP_LNKCTL2_TX_MARGIN)); ++ pcie_capability_write_word(root, ++ PCI_EXP_LNKCTL2, ++ tmp16); ++ ++ pcie_capability_read_word(adev->pdev, ++ PCI_EXP_LNKCTL2, ++ &tmp16); ++ tmp16 &= ~(PCI_EXP_LNKCTL2_ENTER_COMP | ++ PCI_EXP_LNKCTL2_TX_MARGIN); ++ tmp16 |= (gpu_cfg2 & ++ (PCI_EXP_LNKCTL2_ENTER_COMP | ++ PCI_EXP_LNKCTL2_TX_MARGIN)); ++ pcie_capability_write_word(adev->pdev, ++ PCI_EXP_LNKCTL2, ++ tmp16); + + tmp = RREG32_PCIE(ixPCIE_LC_CNTL4); + tmp &= ~PCIE_LC_CNTL4__LC_SET_QUIESCE_MASK; +@@ -1520,15 +1528,16 @@ static void cik_pcie_gen3_enable(struct amdgpu_device *adev) + speed_cntl &= ~PCIE_LC_SPEED_CNTL__LC_FORCE_DIS_SW_SPEED_CHANGE_MASK; + WREG32_PCIE(ixPCIE_LC_SPEED_CNTL, speed_cntl); + +- pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &tmp16); +- tmp16 &= ~0xf; ++ pcie_capability_read_word(adev->pdev, PCI_EXP_LNKCTL2, &tmp16); ++ tmp16 &= ~PCI_EXP_LNKCTL2_TLS; ++ + if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN3) +- tmp16 |= 3; /* gen3 */ ++ tmp16 |= PCI_EXP_LNKCTL2_TLS_8_0GT; /* gen3 */ + else if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN2) +- tmp16 |= 2; /* gen2 */ ++ tmp16 |= PCI_EXP_LNKCTL2_TLS_5_0GT; /* gen2 */ + else +- tmp16 |= 1; /* gen1 */ +- pci_write_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL2, tmp16); ++ tmp16 |= PCI_EXP_LNKCTL2_TLS_2_5GT; /* gen1 */ ++ pcie_capability_write_word(adev->pdev, PCI_EXP_LNKCTL2, tmp16); + + speed_cntl = RREG32_PCIE(ixPCIE_LC_SPEED_CNTL); + speed_cntl |= PCIE_LC_SPEED_CNTL__LC_INITIATE_LINK_SPEED_CHANGE_MASK; +diff --git a/drivers/gpu/drm/amd/amdgpu/si.c b/drivers/gpu/drm/amd/amdgpu/si.c +index 493af42152f26..53f7719d688eb 100644 +--- a/drivers/gpu/drm/amd/amdgpu/si.c ++++ b/drivers/gpu/drm/amd/amdgpu/si.c +@@ -1633,7 +1633,6 @@ static void si_init_golden_registers(struct amdgpu_device *adev) + static void si_pcie_gen3_enable(struct amdgpu_device *adev) + { + struct pci_dev *root = adev->pdev->bus->self; +- int bridge_pos, gpu_pos; + u32 speed_cntl, current_data_rate; + int i; + u16 tmp16; +@@ -1668,12 +1667,7 @@ static void si_pcie_gen3_enable(struct amdgpu_device *adev) + DRM_INFO("enabling PCIE gen 2 link speeds, disable with amdgpu.pcie_gen2=0\n"); + } + +- bridge_pos = pci_pcie_cap(root); +- if (!bridge_pos) +- return; +- +- gpu_pos = pci_pcie_cap(adev->pdev); +- if (!gpu_pos) ++ if (!pci_is_pcie(root) || !pci_is_pcie(adev->pdev)) + return; + + if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN3) { +@@ -1682,14 +1676,8 @@ static void si_pcie_gen3_enable(struct amdgpu_device *adev) + u16 bridge_cfg2, gpu_cfg2; + u32 max_lw, current_lw, tmp; + +- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL, &bridge_cfg); +- pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL, &gpu_cfg); +- +- tmp16 = bridge_cfg | PCI_EXP_LNKCTL_HAWD; +- pci_write_config_word(root, bridge_pos + PCI_EXP_LNKCTL, tmp16); +- +- tmp16 = gpu_cfg | PCI_EXP_LNKCTL_HAWD; +- pci_write_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL, tmp16); ++ pcie_capability_set_word(root, PCI_EXP_LNKCTL, PCI_EXP_LNKCTL_HAWD); ++ pcie_capability_set_word(adev->pdev, PCI_EXP_LNKCTL, PCI_EXP_LNKCTL_HAWD); + + tmp = RREG32_PCIE(PCIE_LC_STATUS1); + max_lw = (tmp & LC_DETECTED_LINK_WIDTH_MASK) >> LC_DETECTED_LINK_WIDTH_SHIFT; +@@ -1706,15 +1694,23 @@ static void si_pcie_gen3_enable(struct amdgpu_device *adev) + } + + for (i = 0; i < 10; i++) { +- pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_DEVSTA, &tmp16); ++ pcie_capability_read_word(adev->pdev, ++ PCI_EXP_DEVSTA, ++ &tmp16); + if (tmp16 & PCI_EXP_DEVSTA_TRPND) + break; + +- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL, &bridge_cfg); +- pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL, &gpu_cfg); ++ pcie_capability_read_word(root, PCI_EXP_LNKCTL, ++ &bridge_cfg); ++ pcie_capability_read_word(adev->pdev, ++ PCI_EXP_LNKCTL, ++ &gpu_cfg); + +- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, &bridge_cfg2); +- pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &gpu_cfg2); ++ pcie_capability_read_word(root, PCI_EXP_LNKCTL2, ++ &bridge_cfg2); ++ pcie_capability_read_word(adev->pdev, ++ PCI_EXP_LNKCTL2, ++ &gpu_cfg2); + + tmp = RREG32_PCIE_PORT(PCIE_LC_CNTL4); + tmp |= LC_SET_QUIESCE; +@@ -1726,25 +1722,37 @@ static void si_pcie_gen3_enable(struct amdgpu_device *adev) + + mdelay(100); + +- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL, &tmp16); +- tmp16 &= ~PCI_EXP_LNKCTL_HAWD; +- tmp16 |= (bridge_cfg & PCI_EXP_LNKCTL_HAWD); +- pci_write_config_word(root, bridge_pos + PCI_EXP_LNKCTL, tmp16); +- +- pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL, &tmp16); +- tmp16 &= ~PCI_EXP_LNKCTL_HAWD; +- tmp16 |= (gpu_cfg & PCI_EXP_LNKCTL_HAWD); +- pci_write_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL, tmp16); +- +- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, &tmp16); +- tmp16 &= ~((1 << 4) | (7 << 9)); +- tmp16 |= (bridge_cfg2 & ((1 << 4) | (7 << 9))); +- pci_write_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, tmp16); +- +- pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &tmp16); +- tmp16 &= ~((1 << 4) | (7 << 9)); +- tmp16 |= (gpu_cfg2 & ((1 << 4) | (7 << 9))); +- pci_write_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL2, tmp16); ++ pcie_capability_clear_and_set_word(root, PCI_EXP_LNKCTL, ++ PCI_EXP_LNKCTL_HAWD, ++ bridge_cfg & ++ PCI_EXP_LNKCTL_HAWD); ++ pcie_capability_clear_and_set_word(adev->pdev, PCI_EXP_LNKCTL, ++ PCI_EXP_LNKCTL_HAWD, ++ gpu_cfg & ++ PCI_EXP_LNKCTL_HAWD); ++ ++ pcie_capability_read_word(root, PCI_EXP_LNKCTL2, ++ &tmp16); ++ tmp16 &= ~(PCI_EXP_LNKCTL2_ENTER_COMP | ++ PCI_EXP_LNKCTL2_TX_MARGIN); ++ tmp16 |= (bridge_cfg2 & ++ (PCI_EXP_LNKCTL2_ENTER_COMP | ++ PCI_EXP_LNKCTL2_TX_MARGIN)); ++ pcie_capability_write_word(root, ++ PCI_EXP_LNKCTL2, ++ tmp16); ++ ++ pcie_capability_read_word(adev->pdev, ++ PCI_EXP_LNKCTL2, ++ &tmp16); ++ tmp16 &= ~(PCI_EXP_LNKCTL2_ENTER_COMP | ++ PCI_EXP_LNKCTL2_TX_MARGIN); ++ tmp16 |= (gpu_cfg2 & ++ (PCI_EXP_LNKCTL2_ENTER_COMP | ++ PCI_EXP_LNKCTL2_TX_MARGIN)); ++ pcie_capability_write_word(adev->pdev, ++ PCI_EXP_LNKCTL2, ++ tmp16); + + tmp = RREG32_PCIE_PORT(PCIE_LC_CNTL4); + tmp &= ~LC_SET_QUIESCE; +@@ -1757,15 +1765,16 @@ static void si_pcie_gen3_enable(struct amdgpu_device *adev) + speed_cntl &= ~LC_FORCE_DIS_SW_SPEED_CHANGE; + WREG32_PCIE_PORT(PCIE_LC_SPEED_CNTL, speed_cntl); + +- pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &tmp16); +- tmp16 &= ~0xf; ++ pcie_capability_read_word(adev->pdev, PCI_EXP_LNKCTL2, &tmp16); ++ tmp16 &= ~PCI_EXP_LNKCTL2_TLS; ++ + if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN3) +- tmp16 |= 3; ++ tmp16 |= PCI_EXP_LNKCTL2_TLS_8_0GT; /* gen3 */ + else if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN2) +- tmp16 |= 2; ++ tmp16 |= PCI_EXP_LNKCTL2_TLS_5_0GT; /* gen2 */ + else +- tmp16 |= 1; +- pci_write_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL2, tmp16); ++ tmp16 |= PCI_EXP_LNKCTL2_TLS_2_5GT; /* gen1 */ ++ pcie_capability_write_word(adev->pdev, PCI_EXP_LNKCTL2, tmp16); + + speed_cntl = RREG32_PCIE_PORT(PCIE_LC_SPEED_CNTL); + speed_cntl |= LC_INITIATE_LINK_SPEED_CHANGE; +diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_mpc.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_mpc.c +index 068e79fa3490d..7044f7ada68ea 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_mpc.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_mpc.c +@@ -199,8 +199,9 @@ struct mpcc *mpc1_insert_plane( + /* check insert_above_mpcc exist in tree->opp_list */ + struct mpcc *temp_mpcc = tree->opp_list; + +- while (temp_mpcc && temp_mpcc->mpcc_bot != insert_above_mpcc) +- temp_mpcc = temp_mpcc->mpcc_bot; ++ if (temp_mpcc != insert_above_mpcc) ++ while (temp_mpcc && temp_mpcc->mpcc_bot != insert_above_mpcc) ++ temp_mpcc = temp_mpcc->mpcc_bot; + if (temp_mpcc == NULL) + return NULL; + } +diff --git a/drivers/gpu/drm/armada/armada_overlay.c b/drivers/gpu/drm/armada/armada_overlay.c +index 07f0da4d9ba19..8e7c5ce71608f 100644 +--- a/drivers/gpu/drm/armada/armada_overlay.c ++++ b/drivers/gpu/drm/armada/armada_overlay.c +@@ -4,6 +4,8 @@ + * Rewritten from the dovefb driver, and Armada510 manuals. + */ + ++#include <linux/bitfield.h> ++ + #include <drm/armada_drm.h> + #include <drm/drm_atomic.h> + #include <drm/drm_atomic_helper.h> +@@ -446,8 +448,8 @@ static int armada_overlay_get_property(struct drm_plane *plane, + drm_to_overlay_state(state)->colorkey_ug, + drm_to_overlay_state(state)->colorkey_vb, 0); + } else if (property == priv->colorkey_mode_prop) { +- *val = (drm_to_overlay_state(state)->colorkey_mode & +- CFG_CKMODE_MASK) >> ffs(CFG_CKMODE_MASK); ++ *val = FIELD_GET(CFG_CKMODE_MASK, ++ drm_to_overlay_state(state)->colorkey_mode); + } else if (property == priv->brightness_prop) { + *val = drm_to_overlay_state(state)->brightness + 256; + } else if (property == priv->contrast_prop) { +diff --git a/drivers/gpu/drm/ast/ast_post.c b/drivers/gpu/drm/ast/ast_post.c +index 2d1b186197432..60629a43207ca 100644 +--- a/drivers/gpu/drm/ast/ast_post.c ++++ b/drivers/gpu/drm/ast/ast_post.c +@@ -294,7 +294,7 @@ static void ast_init_dram_reg(struct drm_device *dev) + ; + } while (ast_read32(ast, 0x10100) != 0xa8); + } else {/* AST2100/1100 */ +- if (ast->chip == AST2100 || ast->chip == 2200) ++ if (ast->chip == AST2100 || ast->chip == AST2200) + dram_reg_info = ast2100_dram_table_data; + else + dram_reg_info = ast1100_dram_table_data; +diff --git a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c +index 62ef603627b77..2cdfbdcbf02d6 100644 +--- a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c ++++ b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c +@@ -756,8 +756,13 @@ static void adv7511_mode_set(struct adv7511 *adv7511, + else + low_refresh_rate = ADV7511_LOW_REFRESH_RATE_NONE; + +- regmap_update_bits(adv7511->regmap, 0xfb, +- 0x6, low_refresh_rate << 1); ++ if (adv7511->type == ADV7511) ++ regmap_update_bits(adv7511->regmap, 0xfb, ++ 0x6, low_refresh_rate << 1); ++ else ++ regmap_update_bits(adv7511->regmap, 0x4a, ++ 0xc, low_refresh_rate << 2); ++ + regmap_update_bits(adv7511->regmap, 0x17, + 0x60, (vsync_polarity << 6) | (hsync_polarity << 5)); + +diff --git a/drivers/gpu/drm/bridge/tc358764.c b/drivers/gpu/drm/bridge/tc358764.c +index 170f162ffa558..121250473761e 100644 +--- a/drivers/gpu/drm/bridge/tc358764.c ++++ b/drivers/gpu/drm/bridge/tc358764.c +@@ -180,7 +180,7 @@ static void tc358764_read(struct tc358764 *ctx, u16 addr, u32 *val) + if (ret >= 0) + le32_to_cpus(val); + +- dev_dbg(ctx->dev, "read: %d, addr: %d\n", addr, *val); ++ dev_dbg(ctx->dev, "read: addr=0x%04x data=0x%08x\n", addr, *val); + } + + static void tc358764_write(struct tc358764 *ctx, u16 addr, u32 val) +diff --git a/drivers/gpu/drm/drm_gem_vram_helper.c b/drivers/gpu/drm/drm_gem_vram_helper.c +index fd751078bae1d..32eee6fb7e02c 100644 +--- a/drivers/gpu/drm/drm_gem_vram_helper.c ++++ b/drivers/gpu/drm/drm_gem_vram_helper.c +@@ -73,6 +73,10 @@ static void drm_gem_vram_placement(struct drm_gem_vram_object *gbo, + } + } + ++/* ++ * Note that on error, drm_gem_vram_init will free the buffer object. ++ */ ++ + static int drm_gem_vram_init(struct drm_device *dev, + struct ttm_bo_device *bdev, + struct drm_gem_vram_object *gbo, +@@ -86,8 +90,10 @@ static int drm_gem_vram_init(struct drm_device *dev, + gbo->bo.base.funcs = &drm_gem_vram_object_funcs; + + ret = drm_gem_object_init(dev, &gbo->bo.base, size); +- if (ret) ++ if (ret) { ++ kfree(gbo); + return ret; ++ } + + acc_size = ttm_bo_dma_acc_size(bdev, size, sizeof(*gbo)); + +@@ -98,13 +104,13 @@ static int drm_gem_vram_init(struct drm_device *dev, + &gbo->placement, pg_align, interruptible, acc_size, + NULL, NULL, ttm_buffer_object_destroy); + if (ret) +- goto err_drm_gem_object_release; ++ /* ++ * A failing ttm_bo_init will call ttm_buffer_object_destroy ++ * to release gbo->bo.base and kfree gbo. ++ */ ++ return ret; + + return 0; +- +-err_drm_gem_object_release: +- drm_gem_object_release(&gbo->bo.base); +- return ret; + } + + /** +@@ -134,13 +140,9 @@ struct drm_gem_vram_object *drm_gem_vram_create(struct drm_device *dev, + + ret = drm_gem_vram_init(dev, bdev, gbo, size, pg_align, interruptible); + if (ret < 0) +- goto err_kfree; ++ return ERR_PTR(ret); + + return gbo; +- +-err_kfree: +- kfree(gbo); +- return ERR_PTR(ret); + } + EXPORT_SYMBOL(drm_gem_vram_create); + +diff --git a/drivers/gpu/drm/etnaviv/etnaviv_dump.c b/drivers/gpu/drm/etnaviv/etnaviv_dump.c +index 648cf02073092..67901f4586a3f 100644 +--- a/drivers/gpu/drm/etnaviv/etnaviv_dump.c ++++ b/drivers/gpu/drm/etnaviv/etnaviv_dump.c +@@ -125,9 +125,9 @@ void etnaviv_core_dump(struct etnaviv_gem_submit *submit) + return; + etnaviv_dump_core = false; + +- mutex_lock(&gpu->mmu_context->lock); ++ mutex_lock(&submit->mmu_context->lock); + +- mmu_size = etnaviv_iommu_dump_size(gpu->mmu_context); ++ mmu_size = etnaviv_iommu_dump_size(submit->mmu_context); + + /* We always dump registers, mmu, ring, hanging cmdbuf and end marker */ + n_obj = 5; +@@ -157,7 +157,7 @@ void etnaviv_core_dump(struct etnaviv_gem_submit *submit) + iter.start = __vmalloc(file_size, GFP_KERNEL | __GFP_NOWARN | __GFP_NORETRY, + PAGE_KERNEL); + if (!iter.start) { +- mutex_unlock(&gpu->mmu_context->lock); ++ mutex_unlock(&submit->mmu_context->lock); + dev_warn(gpu->dev, "failed to allocate devcoredump file\n"); + return; + } +@@ -169,18 +169,18 @@ void etnaviv_core_dump(struct etnaviv_gem_submit *submit) + memset(iter.hdr, 0, iter.data - iter.start); + + etnaviv_core_dump_registers(&iter, gpu); +- etnaviv_core_dump_mmu(&iter, gpu->mmu_context, mmu_size); ++ etnaviv_core_dump_mmu(&iter, submit->mmu_context, mmu_size); + etnaviv_core_dump_mem(&iter, ETDUMP_BUF_RING, gpu->buffer.vaddr, + gpu->buffer.size, + etnaviv_cmdbuf_get_va(&gpu->buffer, +- &gpu->mmu_context->cmdbuf_mapping)); ++ &submit->mmu_context->cmdbuf_mapping)); + + etnaviv_core_dump_mem(&iter, ETDUMP_BUF_CMD, + submit->cmdbuf.vaddr, submit->cmdbuf.size, + etnaviv_cmdbuf_get_va(&submit->cmdbuf, +- &gpu->mmu_context->cmdbuf_mapping)); ++ &submit->mmu_context->cmdbuf_mapping)); + +- mutex_unlock(&gpu->mmu_context->lock); ++ mutex_unlock(&submit->mmu_context->lock); + + /* Reserve space for the bomap */ + if (n_bomap_pages) { +diff --git a/drivers/gpu/drm/exynos/exynos_drm_crtc.c b/drivers/gpu/drm/exynos/exynos_drm_crtc.c +index 77ce78986408b..c10eea6db9a80 100644 +--- a/drivers/gpu/drm/exynos/exynos_drm_crtc.c ++++ b/drivers/gpu/drm/exynos/exynos_drm_crtc.c +@@ -39,13 +39,12 @@ static void exynos_drm_crtc_atomic_disable(struct drm_crtc *crtc, + if (exynos_crtc->ops->disable) + exynos_crtc->ops->disable(exynos_crtc); + ++ spin_lock_irq(&crtc->dev->event_lock); + if (crtc->state->event && !crtc->state->active) { +- spin_lock_irq(&crtc->dev->event_lock); + drm_crtc_send_vblank_event(crtc, crtc->state->event); +- spin_unlock_irq(&crtc->dev->event_lock); +- + crtc->state->event = NULL; + } ++ spin_unlock_irq(&crtc->dev->event_lock); + } + + static int exynos_crtc_atomic_check(struct drm_crtc *crtc, +diff --git a/drivers/gpu/drm/mediatek/mtk_drm_gem.c b/drivers/gpu/drm/mediatek/mtk_drm_gem.c +index 2fa432287d690..5f87d56d2d1d8 100644 +--- a/drivers/gpu/drm/mediatek/mtk_drm_gem.c ++++ b/drivers/gpu/drm/mediatek/mtk_drm_gem.c +@@ -267,7 +267,11 @@ void *mtk_drm_gem_prime_vmap(struct drm_gem_object *obj) + } + mtk_gem->kvaddr = vmap(mtk_gem->pages, npages, VM_MAP, + pgprot_writecombine(PAGE_KERNEL)); +- ++ if (!mtk_gem->kvaddr) { ++ kfree(sgt); ++ kfree(mtk_gem->pages); ++ return ERR_PTR(-ENOMEM); ++ } + out: + kfree(sgt); + +diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c +index 0dc23c86747e8..e1c1b4ad5ed04 100644 +--- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c ++++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c +@@ -221,8 +221,7 @@ static void mdp5_plane_destroy_state(struct drm_plane *plane, + { + struct mdp5_plane_state *pstate = to_mdp5_plane_state(state); + +- if (state->fb) +- drm_framebuffer_put(state->fb); ++ __drm_atomic_helper_plane_destroy_state(state); + + kfree(pstate); + } +diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c +index a87b79c8d76f7..63d17607ef89c 100644 +--- a/drivers/gpu/drm/panel/panel-simple.c ++++ b/drivers/gpu/drm/panel/panel-simple.c +@@ -919,7 +919,9 @@ static const struct panel_desc auo_t215hvn01 = { + .delay = { + .disable = 5, + .unprepare = 1000, +- } ++ }, ++ .bus_format = MEDIA_BUS_FMT_RGB888_1X7X4_SPWG, ++ .connector_type = DRM_MODE_CONNECTOR_LVDS, + }; + + static const struct drm_display_mode avic_tm070ddh03_mode = { +diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c +index 897442754fd03..c338bb82a1226 100644 +--- a/drivers/gpu/drm/radeon/cik.c ++++ b/drivers/gpu/drm/radeon/cik.c +@@ -9504,7 +9504,6 @@ static void cik_pcie_gen3_enable(struct radeon_device *rdev) + { + struct pci_dev *root = rdev->pdev->bus->self; + enum pci_bus_speed speed_cap; +- int bridge_pos, gpu_pos; + u32 speed_cntl, current_data_rate; + int i; + u16 tmp16; +@@ -9546,12 +9545,7 @@ static void cik_pcie_gen3_enable(struct radeon_device *rdev) + DRM_INFO("enabling PCIE gen 2 link speeds, disable with radeon.pcie_gen2=0\n"); + } + +- bridge_pos = pci_pcie_cap(root); +- if (!bridge_pos) +- return; +- +- gpu_pos = pci_pcie_cap(rdev->pdev); +- if (!gpu_pos) ++ if (!pci_is_pcie(root) || !pci_is_pcie(rdev->pdev)) + return; + + if (speed_cap == PCIE_SPEED_8_0GT) { +@@ -9561,14 +9555,8 @@ static void cik_pcie_gen3_enable(struct radeon_device *rdev) + u16 bridge_cfg2, gpu_cfg2; + u32 max_lw, current_lw, tmp; + +- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL, &bridge_cfg); +- pci_read_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL, &gpu_cfg); +- +- tmp16 = bridge_cfg | PCI_EXP_LNKCTL_HAWD; +- pci_write_config_word(root, bridge_pos + PCI_EXP_LNKCTL, tmp16); +- +- tmp16 = gpu_cfg | PCI_EXP_LNKCTL_HAWD; +- pci_write_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL, tmp16); ++ pcie_capability_set_word(root, PCI_EXP_LNKCTL, PCI_EXP_LNKCTL_HAWD); ++ pcie_capability_set_word(rdev->pdev, PCI_EXP_LNKCTL, PCI_EXP_LNKCTL_HAWD); + + tmp = RREG32_PCIE_PORT(PCIE_LC_STATUS1); + max_lw = (tmp & LC_DETECTED_LINK_WIDTH_MASK) >> LC_DETECTED_LINK_WIDTH_SHIFT; +@@ -9586,15 +9574,23 @@ static void cik_pcie_gen3_enable(struct radeon_device *rdev) + + for (i = 0; i < 10; i++) { + /* check status */ +- pci_read_config_word(rdev->pdev, gpu_pos + PCI_EXP_DEVSTA, &tmp16); ++ pcie_capability_read_word(rdev->pdev, ++ PCI_EXP_DEVSTA, ++ &tmp16); + if (tmp16 & PCI_EXP_DEVSTA_TRPND) + break; + +- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL, &bridge_cfg); +- pci_read_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL, &gpu_cfg); ++ pcie_capability_read_word(root, PCI_EXP_LNKCTL, ++ &bridge_cfg); ++ pcie_capability_read_word(rdev->pdev, ++ PCI_EXP_LNKCTL, ++ &gpu_cfg); + +- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, &bridge_cfg2); +- pci_read_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &gpu_cfg2); ++ pcie_capability_read_word(root, PCI_EXP_LNKCTL2, ++ &bridge_cfg2); ++ pcie_capability_read_word(rdev->pdev, ++ PCI_EXP_LNKCTL2, ++ &gpu_cfg2); + + tmp = RREG32_PCIE_PORT(PCIE_LC_CNTL4); + tmp |= LC_SET_QUIESCE; +@@ -9607,26 +9603,38 @@ static void cik_pcie_gen3_enable(struct radeon_device *rdev) + msleep(100); + + /* linkctl */ +- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL, &tmp16); +- tmp16 &= ~PCI_EXP_LNKCTL_HAWD; +- tmp16 |= (bridge_cfg & PCI_EXP_LNKCTL_HAWD); +- pci_write_config_word(root, bridge_pos + PCI_EXP_LNKCTL, tmp16); +- +- pci_read_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL, &tmp16); +- tmp16 &= ~PCI_EXP_LNKCTL_HAWD; +- tmp16 |= (gpu_cfg & PCI_EXP_LNKCTL_HAWD); +- pci_write_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL, tmp16); ++ pcie_capability_clear_and_set_word(root, PCI_EXP_LNKCTL, ++ PCI_EXP_LNKCTL_HAWD, ++ bridge_cfg & ++ PCI_EXP_LNKCTL_HAWD); ++ pcie_capability_clear_and_set_word(rdev->pdev, PCI_EXP_LNKCTL, ++ PCI_EXP_LNKCTL_HAWD, ++ gpu_cfg & ++ PCI_EXP_LNKCTL_HAWD); + + /* linkctl2 */ +- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, &tmp16); +- tmp16 &= ~((1 << 4) | (7 << 9)); +- tmp16 |= (bridge_cfg2 & ((1 << 4) | (7 << 9))); +- pci_write_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, tmp16); +- +- pci_read_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &tmp16); +- tmp16 &= ~((1 << 4) | (7 << 9)); +- tmp16 |= (gpu_cfg2 & ((1 << 4) | (7 << 9))); +- pci_write_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL2, tmp16); ++ pcie_capability_read_word(root, PCI_EXP_LNKCTL2, ++ &tmp16); ++ tmp16 &= ~(PCI_EXP_LNKCTL2_ENTER_COMP | ++ PCI_EXP_LNKCTL2_TX_MARGIN); ++ tmp16 |= (bridge_cfg2 & ++ (PCI_EXP_LNKCTL2_ENTER_COMP | ++ PCI_EXP_LNKCTL2_TX_MARGIN)); ++ pcie_capability_write_word(root, ++ PCI_EXP_LNKCTL2, ++ tmp16); ++ ++ pcie_capability_read_word(rdev->pdev, ++ PCI_EXP_LNKCTL2, ++ &tmp16); ++ tmp16 &= ~(PCI_EXP_LNKCTL2_ENTER_COMP | ++ PCI_EXP_LNKCTL2_TX_MARGIN); ++ tmp16 |= (gpu_cfg2 & ++ (PCI_EXP_LNKCTL2_ENTER_COMP | ++ PCI_EXP_LNKCTL2_TX_MARGIN)); ++ pcie_capability_write_word(rdev->pdev, ++ PCI_EXP_LNKCTL2, ++ tmp16); + + tmp = RREG32_PCIE_PORT(PCIE_LC_CNTL4); + tmp &= ~LC_SET_QUIESCE; +@@ -9640,15 +9648,15 @@ static void cik_pcie_gen3_enable(struct radeon_device *rdev) + speed_cntl &= ~LC_FORCE_DIS_SW_SPEED_CHANGE; + WREG32_PCIE_PORT(PCIE_LC_SPEED_CNTL, speed_cntl); + +- pci_read_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &tmp16); +- tmp16 &= ~0xf; ++ pcie_capability_read_word(rdev->pdev, PCI_EXP_LNKCTL2, &tmp16); ++ tmp16 &= ~PCI_EXP_LNKCTL2_TLS; + if (speed_cap == PCIE_SPEED_8_0GT) +- tmp16 |= 3; /* gen3 */ ++ tmp16 |= PCI_EXP_LNKCTL2_TLS_8_0GT; /* gen3 */ + else if (speed_cap == PCIE_SPEED_5_0GT) +- tmp16 |= 2; /* gen2 */ ++ tmp16 |= PCI_EXP_LNKCTL2_TLS_5_0GT; /* gen2 */ + else +- tmp16 |= 1; /* gen1 */ +- pci_write_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL2, tmp16); ++ tmp16 |= PCI_EXP_LNKCTL2_TLS_2_5GT; /* gen1 */ ++ pcie_capability_write_word(rdev->pdev, PCI_EXP_LNKCTL2, tmp16); + + speed_cntl = RREG32_PCIE_PORT(PCIE_LC_SPEED_CNTL); + speed_cntl |= LC_INITIATE_LINK_SPEED_CHANGE; +diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c +index 1d8efb0eefdb4..74cbed9377f09 100644 +--- a/drivers/gpu/drm/radeon/si.c ++++ b/drivers/gpu/drm/radeon/si.c +@@ -3257,7 +3257,7 @@ static void si_gpu_init(struct radeon_device *rdev) + /* XXX what about 12? */ + rdev->config.si.tile_config |= (3 << 0); + break; +- } ++ } + switch ((mc_arb_ramcfg & NOOFBANK_MASK) >> NOOFBANK_SHIFT) { + case 0: /* four banks */ + rdev->config.si.tile_config |= 0 << 4; +@@ -7087,7 +7087,6 @@ static void si_pcie_gen3_enable(struct radeon_device *rdev) + { + struct pci_dev *root = rdev->pdev->bus->self; + enum pci_bus_speed speed_cap; +- int bridge_pos, gpu_pos; + u32 speed_cntl, current_data_rate; + int i; + u16 tmp16; +@@ -7129,12 +7128,7 @@ static void si_pcie_gen3_enable(struct radeon_device *rdev) + DRM_INFO("enabling PCIE gen 2 link speeds, disable with radeon.pcie_gen2=0\n"); + } + +- bridge_pos = pci_pcie_cap(root); +- if (!bridge_pos) +- return; +- +- gpu_pos = pci_pcie_cap(rdev->pdev); +- if (!gpu_pos) ++ if (!pci_is_pcie(root) || !pci_is_pcie(rdev->pdev)) + return; + + if (speed_cap == PCIE_SPEED_8_0GT) { +@@ -7144,14 +7138,8 @@ static void si_pcie_gen3_enable(struct radeon_device *rdev) + u16 bridge_cfg2, gpu_cfg2; + u32 max_lw, current_lw, tmp; + +- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL, &bridge_cfg); +- pci_read_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL, &gpu_cfg); +- +- tmp16 = bridge_cfg | PCI_EXP_LNKCTL_HAWD; +- pci_write_config_word(root, bridge_pos + PCI_EXP_LNKCTL, tmp16); +- +- tmp16 = gpu_cfg | PCI_EXP_LNKCTL_HAWD; +- pci_write_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL, tmp16); ++ pcie_capability_set_word(root, PCI_EXP_LNKCTL, PCI_EXP_LNKCTL_HAWD); ++ pcie_capability_set_word(rdev->pdev, PCI_EXP_LNKCTL, PCI_EXP_LNKCTL_HAWD); + + tmp = RREG32_PCIE(PCIE_LC_STATUS1); + max_lw = (tmp & LC_DETECTED_LINK_WIDTH_MASK) >> LC_DETECTED_LINK_WIDTH_SHIFT; +@@ -7169,15 +7157,23 @@ static void si_pcie_gen3_enable(struct radeon_device *rdev) + + for (i = 0; i < 10; i++) { + /* check status */ +- pci_read_config_word(rdev->pdev, gpu_pos + PCI_EXP_DEVSTA, &tmp16); ++ pcie_capability_read_word(rdev->pdev, ++ PCI_EXP_DEVSTA, ++ &tmp16); + if (tmp16 & PCI_EXP_DEVSTA_TRPND) + break; + +- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL, &bridge_cfg); +- pci_read_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL, &gpu_cfg); ++ pcie_capability_read_word(root, PCI_EXP_LNKCTL, ++ &bridge_cfg); ++ pcie_capability_read_word(rdev->pdev, ++ PCI_EXP_LNKCTL, ++ &gpu_cfg); + +- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, &bridge_cfg2); +- pci_read_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &gpu_cfg2); ++ pcie_capability_read_word(root, PCI_EXP_LNKCTL2, ++ &bridge_cfg2); ++ pcie_capability_read_word(rdev->pdev, ++ PCI_EXP_LNKCTL2, ++ &gpu_cfg2); + + tmp = RREG32_PCIE_PORT(PCIE_LC_CNTL4); + tmp |= LC_SET_QUIESCE; +@@ -7190,26 +7186,38 @@ static void si_pcie_gen3_enable(struct radeon_device *rdev) + msleep(100); + + /* linkctl */ +- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL, &tmp16); +- tmp16 &= ~PCI_EXP_LNKCTL_HAWD; +- tmp16 |= (bridge_cfg & PCI_EXP_LNKCTL_HAWD); +- pci_write_config_word(root, bridge_pos + PCI_EXP_LNKCTL, tmp16); +- +- pci_read_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL, &tmp16); +- tmp16 &= ~PCI_EXP_LNKCTL_HAWD; +- tmp16 |= (gpu_cfg & PCI_EXP_LNKCTL_HAWD); +- pci_write_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL, tmp16); ++ pcie_capability_clear_and_set_word(root, PCI_EXP_LNKCTL, ++ PCI_EXP_LNKCTL_HAWD, ++ bridge_cfg & ++ PCI_EXP_LNKCTL_HAWD); ++ pcie_capability_clear_and_set_word(rdev->pdev, PCI_EXP_LNKCTL, ++ PCI_EXP_LNKCTL_HAWD, ++ gpu_cfg & ++ PCI_EXP_LNKCTL_HAWD); + + /* linkctl2 */ +- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, &tmp16); +- tmp16 &= ~((1 << 4) | (7 << 9)); +- tmp16 |= (bridge_cfg2 & ((1 << 4) | (7 << 9))); +- pci_write_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, tmp16); +- +- pci_read_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &tmp16); +- tmp16 &= ~((1 << 4) | (7 << 9)); +- tmp16 |= (gpu_cfg2 & ((1 << 4) | (7 << 9))); +- pci_write_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL2, tmp16); ++ pcie_capability_read_word(root, PCI_EXP_LNKCTL2, ++ &tmp16); ++ tmp16 &= ~(PCI_EXP_LNKCTL2_ENTER_COMP | ++ PCI_EXP_LNKCTL2_TX_MARGIN); ++ tmp16 |= (bridge_cfg2 & ++ (PCI_EXP_LNKCTL2_ENTER_COMP | ++ PCI_EXP_LNKCTL2_TX_MARGIN)); ++ pcie_capability_write_word(root, ++ PCI_EXP_LNKCTL2, ++ tmp16); ++ ++ pcie_capability_read_word(rdev->pdev, ++ PCI_EXP_LNKCTL2, ++ &tmp16); ++ tmp16 &= ~(PCI_EXP_LNKCTL2_ENTER_COMP | ++ PCI_EXP_LNKCTL2_TX_MARGIN); ++ tmp16 |= (gpu_cfg2 & ++ (PCI_EXP_LNKCTL2_ENTER_COMP | ++ PCI_EXP_LNKCTL2_TX_MARGIN)); ++ pcie_capability_write_word(rdev->pdev, ++ PCI_EXP_LNKCTL2, ++ tmp16); + + tmp = RREG32_PCIE_PORT(PCIE_LC_CNTL4); + tmp &= ~LC_SET_QUIESCE; +@@ -7223,15 +7231,15 @@ static void si_pcie_gen3_enable(struct radeon_device *rdev) + speed_cntl &= ~LC_FORCE_DIS_SW_SPEED_CHANGE; + WREG32_PCIE_PORT(PCIE_LC_SPEED_CNTL, speed_cntl); + +- pci_read_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &tmp16); +- tmp16 &= ~0xf; ++ pcie_capability_read_word(rdev->pdev, PCI_EXP_LNKCTL2, &tmp16); ++ tmp16 &= ~PCI_EXP_LNKCTL2_TLS; + if (speed_cap == PCIE_SPEED_8_0GT) +- tmp16 |= 3; /* gen3 */ ++ tmp16 |= PCI_EXP_LNKCTL2_TLS_8_0GT; /* gen3 */ + else if (speed_cap == PCIE_SPEED_5_0GT) +- tmp16 |= 2; /* gen2 */ ++ tmp16 |= PCI_EXP_LNKCTL2_TLS_5_0GT; /* gen2 */ + else +- tmp16 |= 1; /* gen1 */ +- pci_write_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL2, tmp16); ++ tmp16 |= PCI_EXP_LNKCTL2_TLS_2_5GT; /* gen1 */ ++ pcie_capability_write_word(rdev->pdev, PCI_EXP_LNKCTL2, tmp16); + + speed_cntl = RREG32_PCIE_PORT(PCIE_LC_SPEED_CNTL); + speed_cntl |= LC_INITIATE_LINK_SPEED_CHANGE; +diff --git a/drivers/gpu/drm/tegra/dpaux.c b/drivers/gpu/drm/tegra/dpaux.c +index a0f6f9b0d2585..a84d19087d094 100644 +--- a/drivers/gpu/drm/tegra/dpaux.c ++++ b/drivers/gpu/drm/tegra/dpaux.c +@@ -447,10 +447,8 @@ static int tegra_dpaux_probe(struct platform_device *pdev) + return PTR_ERR(dpaux->regs); + + dpaux->irq = platform_get_irq(pdev, 0); +- if (dpaux->irq < 0) { +- dev_err(&pdev->dev, "failed to get IRQ\n"); +- return -ENXIO; +- } ++ if (dpaux->irq < 0) ++ return dpaux->irq; + + if (!pdev->dev.pm_domain) { + dpaux->rst = devm_reset_control_get(&pdev->dev, "dpaux"); +diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c +index a663cbb7b6832..0c2aa9024b878 100644 +--- a/drivers/hid/hid-logitech-dj.c ++++ b/drivers/hid/hid-logitech-dj.c +@@ -1212,6 +1212,9 @@ static int logi_dj_recv_switch_to_dj_mode(struct dj_receiver_dev *djrcv_dev, + * 50 msec should gives enough time to the receiver to be ready. + */ + msleep(50); ++ ++ if (retval) ++ return retval; + } + + /* +@@ -1233,7 +1236,7 @@ static int logi_dj_recv_switch_to_dj_mode(struct dj_receiver_dev *djrcv_dev, + buf[5] = 0x09; + buf[6] = 0x00; + +- hid_hw_raw_request(hdev, REPORT_ID_HIDPP_SHORT, buf, ++ retval = hid_hw_raw_request(hdev, REPORT_ID_HIDPP_SHORT, buf, + HIDPP_REPORT_SHORT_LENGTH, HID_OUTPUT_REPORT, + HID_REQ_SET_REPORT); + +diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c +index 9db327654580c..0893b31e6f102 100644 +--- a/drivers/hid/hid-multitouch.c ++++ b/drivers/hid/hid-multitouch.c +@@ -1548,7 +1548,6 @@ static void mt_post_parse(struct mt_device *td, struct mt_application *app) + static int mt_input_configured(struct hid_device *hdev, struct hid_input *hi) + { + struct mt_device *td = hid_get_drvdata(hdev); +- char *name; + const char *suffix = NULL; + struct mt_report_data *rdata; + struct mt_application *mt_application = NULL; +@@ -1602,15 +1601,9 @@ static int mt_input_configured(struct hid_device *hdev, struct hid_input *hi) + break; + } + +- if (suffix) { +- name = devm_kzalloc(&hi->input->dev, +- strlen(hdev->name) + strlen(suffix) + 2, +- GFP_KERNEL); +- if (name) { +- sprintf(name, "%s %s", hdev->name, suffix); +- hi->input->name = name; +- } +- } ++ if (suffix) ++ hi->input->name = devm_kasprintf(&hdev->dev, GFP_KERNEL, ++ "%s %s", hdev->name, suffix); + + return 0; + } +diff --git a/drivers/hid/wacom.h b/drivers/hid/wacom.h +index 3f8b24a57014b..c034a1e850e45 100644 +--- a/drivers/hid/wacom.h ++++ b/drivers/hid/wacom.h +@@ -153,6 +153,7 @@ struct wacom_remote { + struct input_dev *input; + bool registered; + struct wacom_battery battery; ++ ktime_t active_time; + } remotes[WACOM_MAX_REMOTES]; + }; + +diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c +index 36cb456709ed7..1a7e1d3e7a379 100644 +--- a/drivers/hid/wacom_sys.c ++++ b/drivers/hid/wacom_sys.c +@@ -2529,6 +2529,18 @@ fail: + return; + } + ++static void wacom_remote_destroy_battery(struct wacom *wacom, int index) ++{ ++ struct wacom_remote *remote = wacom->remote; ++ ++ if (remote->remotes[index].battery.battery) { ++ devres_release_group(&wacom->hdev->dev, ++ &remote->remotes[index].battery.bat_desc); ++ remote->remotes[index].battery.battery = NULL; ++ remote->remotes[index].active_time = 0; ++ } ++} ++ + static void wacom_remote_destroy_one(struct wacom *wacom, unsigned int index) + { + struct wacom_remote *remote = wacom->remote; +@@ -2543,9 +2555,7 @@ static void wacom_remote_destroy_one(struct wacom *wacom, unsigned int index) + remote->remotes[i].registered = false; + spin_unlock_irqrestore(&remote->remote_lock, flags); + +- if (remote->remotes[i].battery.battery) +- devres_release_group(&wacom->hdev->dev, +- &remote->remotes[i].battery.bat_desc); ++ wacom_remote_destroy_battery(wacom, i); + + if (remote->remotes[i].group.name) + devres_release_group(&wacom->hdev->dev, +@@ -2553,7 +2563,6 @@ static void wacom_remote_destroy_one(struct wacom *wacom, unsigned int index) + + remote->remotes[i].serial = 0; + remote->remotes[i].group.name = NULL; +- remote->remotes[i].battery.battery = NULL; + wacom->led.groups[i].select = WACOM_STATUS_UNKNOWN; + } + } +@@ -2638,6 +2647,9 @@ static int wacom_remote_attach_battery(struct wacom *wacom, int index) + if (remote->remotes[index].battery.battery) + return 0; + ++ if (!remote->remotes[index].active_time) ++ return 0; ++ + if (wacom->led.groups[index].select == WACOM_STATUS_UNKNOWN) + return 0; + +@@ -2653,6 +2665,7 @@ static void wacom_remote_work(struct work_struct *work) + { + struct wacom *wacom = container_of(work, struct wacom, remote_work); + struct wacom_remote *remote = wacom->remote; ++ ktime_t kt = ktime_get(); + struct wacom_remote_data data; + unsigned long flags; + unsigned int count; +@@ -2679,6 +2692,10 @@ static void wacom_remote_work(struct work_struct *work) + serial = data.remote[i].serial; + if (data.remote[i].connected) { + ++ if (kt - remote->remotes[i].active_time > WACOM_REMOTE_BATTERY_TIMEOUT ++ && remote->remotes[i].active_time != 0) ++ wacom_remote_destroy_battery(wacom, i); ++ + if (remote->remotes[i].serial == serial) { + wacom_remote_attach_battery(wacom, i); + continue; +diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c +index 28da9b4087c3b..745fa9f1e10b0 100644 +--- a/drivers/hid/wacom_wac.c ++++ b/drivers/hid/wacom_wac.c +@@ -1127,6 +1127,7 @@ static int wacom_remote_irq(struct wacom_wac *wacom_wac, size_t len) + if (index < 0 || !remote->remotes[index].registered) + goto out; + ++ remote->remotes[i].active_time = ktime_get(); + input = remote->remotes[index].input; + + input_report_key(input, BTN_0, (data[9] & 0x01)); +diff --git a/drivers/hid/wacom_wac.h b/drivers/hid/wacom_wac.h +index 166731292c359..d393f96626fb1 100644 +--- a/drivers/hid/wacom_wac.h ++++ b/drivers/hid/wacom_wac.h +@@ -15,6 +15,7 @@ + #define WACOM_NAME_MAX 64 + #define WACOM_MAX_REMOTES 5 + #define WACOM_STATUS_UNKNOWN 255 ++#define WACOM_REMOTE_BATTERY_TIMEOUT 21000000000ll + + /* packet length for individual models */ + #define WACOM_PKGLEN_BBFUN 9 +diff --git a/drivers/hwtracing/coresight/coresight-tmc-etf.c b/drivers/hwtracing/coresight/coresight-tmc-etf.c +index 75dfa1e2f3f2c..e15726611c649 100644 +--- a/drivers/hwtracing/coresight/coresight-tmc-etf.c ++++ b/drivers/hwtracing/coresight/coresight-tmc-etf.c +@@ -426,7 +426,7 @@ static int tmc_set_etf_buffer(struct coresight_device *csdev, + return -EINVAL; + + /* wrap head around to the amount of space we have */ +- head = handle->head & ((buf->nr_pages << PAGE_SHIFT) - 1); ++ head = handle->head & (((unsigned long)buf->nr_pages << PAGE_SHIFT) - 1); + + /* find the page to write to */ + buf->cur = head / PAGE_SIZE; +diff --git a/drivers/hwtracing/coresight/coresight-tmc-etr.c b/drivers/hwtracing/coresight/coresight-tmc-etr.c +index 763463776a0e1..2a0a12c194c05 100644 +--- a/drivers/hwtracing/coresight/coresight-tmc-etr.c ++++ b/drivers/hwtracing/coresight/coresight-tmc-etr.c +@@ -47,7 +47,8 @@ struct etr_perf_buffer { + }; + + /* Convert the perf index to an offset within the ETR buffer */ +-#define PERF_IDX2OFF(idx, buf) ((idx) % ((buf)->nr_pages << PAGE_SHIFT)) ++#define PERF_IDX2OFF(idx, buf) \ ++ ((idx) % ((unsigned long)(buf)->nr_pages << PAGE_SHIFT)) + + /* Lower limit for ETR hardware buffer */ + #define TMC_ETR_PERF_MIN_BUF_SIZE SZ_1M +@@ -1215,7 +1216,7 @@ alloc_etr_buf(struct tmc_drvdata *drvdata, struct perf_event *event, + * than the size requested via sysfs. + */ + if ((nr_pages << PAGE_SHIFT) > drvdata->size) { +- etr_buf = tmc_alloc_etr_buf(drvdata, (nr_pages << PAGE_SHIFT), ++ etr_buf = tmc_alloc_etr_buf(drvdata, ((ssize_t)nr_pages << PAGE_SHIFT), + 0, node, NULL); + if (!IS_ERR(etr_buf)) + goto done; +diff --git a/drivers/hwtracing/coresight/coresight-tmc.h b/drivers/hwtracing/coresight/coresight-tmc.h +index 71de978575f36..1fcf6e29e8d3a 100644 +--- a/drivers/hwtracing/coresight/coresight-tmc.h ++++ b/drivers/hwtracing/coresight/coresight-tmc.h +@@ -320,7 +320,7 @@ ssize_t tmc_sg_table_get_data(struct tmc_sg_table *sg_table, + static inline unsigned long + tmc_sg_table_buf_size(struct tmc_sg_table *sg_table) + { +- return sg_table->data_pages.nr_pages << PAGE_SHIFT; ++ return (unsigned long)sg_table->data_pages.nr_pages << PAGE_SHIFT; + } + + struct coresight_device *tmc_etr_get_catu_device(struct tmc_drvdata *drvdata); +diff --git a/drivers/i2c/busses/i2c-aspeed.c b/drivers/i2c/busses/i2c-aspeed.c +index bdcc3c9d0abe5..8e04db09d7878 100644 +--- a/drivers/i2c/busses/i2c-aspeed.c ++++ b/drivers/i2c/busses/i2c-aspeed.c +@@ -693,13 +693,16 @@ static int aspeed_i2c_master_xfer(struct i2c_adapter *adap, + + if (time_left == 0) { + /* +- * If timed out and bus is still busy in a multi master +- * environment, attempt recovery at here. ++ * In a multi-master setup, if a timeout occurs, attempt ++ * recovery. But if the bus is idle, we still need to reset the ++ * i2c controller to clear the remaining interrupts. + */ + if (bus->multi_master && + (readl(bus->base + ASPEED_I2C_CMD_REG) & + ASPEED_I2CD_BUS_BUSY_STS)) + aspeed_i2c_recover_bus(bus); ++ else ++ aspeed_i2c_reset(bus); + + /* + * If timed out and the state is still pending, drop the pending +diff --git a/drivers/infiniband/core/uverbs_std_types_counters.c b/drivers/infiniband/core/uverbs_std_types_counters.c +index 9f013304e6778..35e41c5ca1bb1 100644 +--- a/drivers/infiniband/core/uverbs_std_types_counters.c ++++ b/drivers/infiniband/core/uverbs_std_types_counters.c +@@ -105,6 +105,8 @@ static int UVERBS_HANDLER(UVERBS_METHOD_COUNTERS_READ)( + return ret; + + uattr = uverbs_attr_get(attrs, UVERBS_ATTR_READ_COUNTERS_BUFF); ++ if (IS_ERR(uattr)) ++ return PTR_ERR(uattr); + read_attr.ncounters = uattr->ptr_attr.len / sizeof(u64); + read_attr.counters_buff = uverbs_zalloc( + attrs, array_size(read_attr.ncounters, sizeof(u64))); +diff --git a/drivers/infiniband/sw/siw/siw_cm.c b/drivers/infiniband/sw/siw/siw_cm.c +index 69fcf21eaf528..3d96b649889ca 100644 +--- a/drivers/infiniband/sw/siw/siw_cm.c ++++ b/drivers/infiniband/sw/siw/siw_cm.c +@@ -1525,7 +1525,6 @@ error: + + cep->cm_id = NULL; + id->rem_ref(id); +- siw_cep_put(cep); + + qp->cep = NULL; + siw_cep_put(cep); +diff --git a/drivers/infiniband/sw/siw/siw_verbs.c b/drivers/infiniband/sw/siw/siw_verbs.c +index c8c2014b79d22..236f9efaa75ce 100644 +--- a/drivers/infiniband/sw/siw/siw_verbs.c ++++ b/drivers/infiniband/sw/siw/siw_verbs.c +@@ -1509,7 +1509,7 @@ int siw_map_mr_sg(struct ib_mr *base_mr, struct scatterlist *sl, int num_sle, + + if (pbl->max_buf < num_sle) { + siw_dbg_mem(mem, "too many SGE's: %d > %d\n", +- mem->pbl->max_buf, num_sle); ++ num_sle, pbl->max_buf); + return -ENOMEM; + } + for_each_sg(sl, slp, num_sle, i) { +diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c +index 5bb1fc7fd79c9..6ff92dca2898c 100644 +--- a/drivers/infiniband/ulp/isert/ib_isert.c ++++ b/drivers/infiniband/ulp/isert/ib_isert.c +@@ -2646,6 +2646,8 @@ static void isert_wait_conn(struct iscsi_conn *conn) + isert_put_unsol_pending_cmds(conn); + isert_wait4cmds(conn); + isert_wait4logout(isert_conn); ++ ++ queue_work(isert_release_wq, &isert_conn->release_work); + } + + static void isert_free_conn(struct iscsi_conn *conn) +diff --git a/drivers/iommu/intel-pasid.c b/drivers/iommu/intel-pasid.c +index 58f060006ba31..9641eaa19e08e 100644 +--- a/drivers/iommu/intel-pasid.c ++++ b/drivers/iommu/intel-pasid.c +@@ -167,7 +167,7 @@ attach_out: + device_attach_pasid_table(info, pasid_table); + + if (!ecap_coherent(info->iommu->ecap)) +- clflush_cache_range(pasid_table->table, size); ++ clflush_cache_range(pasid_table->table, (1 << order) * PAGE_SIZE); + + return 0; + } +diff --git a/drivers/md/md-bitmap.c b/drivers/md/md-bitmap.c +index bea8265ce9b8e..843139447a964 100644 +--- a/drivers/md/md-bitmap.c ++++ b/drivers/md/md-bitmap.c +@@ -2480,11 +2480,35 @@ backlog_store(struct mddev *mddev, const char *buf, size_t len) + { + unsigned long backlog; + unsigned long old_mwb = mddev->bitmap_info.max_write_behind; ++ struct md_rdev *rdev; ++ bool has_write_mostly = false; + int rv = kstrtoul(buf, 10, &backlog); + if (rv) + return rv; + if (backlog > COUNTER_MAX) + return -EINVAL; ++ ++ rv = mddev_lock(mddev); ++ if (rv) ++ return rv; ++ ++ /* ++ * Without write mostly device, it doesn't make sense to set ++ * backlog for max_write_behind. ++ */ ++ rdev_for_each(rdev, mddev) { ++ if (test_bit(WriteMostly, &rdev->flags)) { ++ has_write_mostly = true; ++ break; ++ } ++ } ++ if (!has_write_mostly) { ++ pr_warn_ratelimited("%s: can't set backlog, no write mostly device available\n", ++ mdname(mddev)); ++ mddev_unlock(mddev); ++ return -EINVAL; ++ } ++ + mddev->bitmap_info.max_write_behind = backlog; + if (!backlog && mddev->wb_info_pool) { + /* wb_info_pool is not needed if backlog is zero */ +@@ -2499,6 +2523,8 @@ backlog_store(struct mddev *mddev, const char *buf, size_t len) + } + if (old_mwb != backlog) + md_bitmap_update_sb(mddev->bitmap); ++ ++ mddev_unlock(mddev); + return len; + } + +diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c +index 1919de4c8c12d..c40237cfdcb0f 100644 +--- a/drivers/md/raid1.c ++++ b/drivers/md/raid1.c +@@ -1810,6 +1810,9 @@ static int raid1_remove_disk(struct mddev *mddev, struct md_rdev *rdev) + int number = rdev->raid_disk; + struct raid1_info *p = conf->mirrors + number; + ++ if (unlikely(number >= conf->raid_disks)) ++ goto abort; ++ + if (rdev != p->rdev) + p = conf->mirrors + conf->raid_disks + number; + +diff --git a/drivers/media/dvb-frontends/ascot2e.c b/drivers/media/dvb-frontends/ascot2e.c +index 9b00b56230b61..cf8e5f1bd1018 100644 +--- a/drivers/media/dvb-frontends/ascot2e.c ++++ b/drivers/media/dvb-frontends/ascot2e.c +@@ -533,7 +533,7 @@ struct dvb_frontend *ascot2e_attach(struct dvb_frontend *fe, + priv->i2c_address, priv->i2c); + return fe; + } +-EXPORT_SYMBOL(ascot2e_attach); ++EXPORT_SYMBOL_GPL(ascot2e_attach); + + MODULE_DESCRIPTION("Sony ASCOT2E terr/cab tuner driver"); + MODULE_AUTHOR("info@netup.ru"); +diff --git a/drivers/media/dvb-frontends/atbm8830.c b/drivers/media/dvb-frontends/atbm8830.c +index bdd16b9c58244..778c865085bf9 100644 +--- a/drivers/media/dvb-frontends/atbm8830.c ++++ b/drivers/media/dvb-frontends/atbm8830.c +@@ -489,7 +489,7 @@ error_out: + return NULL; + + } +-EXPORT_SYMBOL(atbm8830_attach); ++EXPORT_SYMBOL_GPL(atbm8830_attach); + + MODULE_DESCRIPTION("AltoBeam ATBM8830/8831 GB20600 demodulator driver"); + MODULE_AUTHOR("David T. L. Wong <davidtlwong@gmail.com>"); +diff --git a/drivers/media/dvb-frontends/au8522_dig.c b/drivers/media/dvb-frontends/au8522_dig.c +index 78cafdf279618..230436bf6cbd9 100644 +--- a/drivers/media/dvb-frontends/au8522_dig.c ++++ b/drivers/media/dvb-frontends/au8522_dig.c +@@ -879,7 +879,7 @@ error: + au8522_release_state(state); + return NULL; + } +-EXPORT_SYMBOL(au8522_attach); ++EXPORT_SYMBOL_GPL(au8522_attach); + + static const struct dvb_frontend_ops au8522_ops = { + .delsys = { SYS_ATSC, SYS_DVBC_ANNEX_B }, +diff --git a/drivers/media/dvb-frontends/bcm3510.c b/drivers/media/dvb-frontends/bcm3510.c +index 6457b0912d14d..bc4cc8c24e1a2 100644 +--- a/drivers/media/dvb-frontends/bcm3510.c ++++ b/drivers/media/dvb-frontends/bcm3510.c +@@ -835,7 +835,7 @@ error: + kfree(state); + return NULL; + } +-EXPORT_SYMBOL(bcm3510_attach); ++EXPORT_SYMBOL_GPL(bcm3510_attach); + + static const struct dvb_frontend_ops bcm3510_ops = { + .delsys = { SYS_ATSC, SYS_DVBC_ANNEX_B }, +diff --git a/drivers/media/dvb-frontends/cx22700.c b/drivers/media/dvb-frontends/cx22700.c +index b39ff516271b2..1d04c0a652b26 100644 +--- a/drivers/media/dvb-frontends/cx22700.c ++++ b/drivers/media/dvb-frontends/cx22700.c +@@ -432,4 +432,4 @@ MODULE_DESCRIPTION("Conexant CX22700 DVB-T Demodulator driver"); + MODULE_AUTHOR("Holger Waechtler"); + MODULE_LICENSE("GPL"); + +-EXPORT_SYMBOL(cx22700_attach); ++EXPORT_SYMBOL_GPL(cx22700_attach); +diff --git a/drivers/media/dvb-frontends/cx22702.c b/drivers/media/dvb-frontends/cx22702.c +index cc6acbf6393d4..61ad34b7004b5 100644 +--- a/drivers/media/dvb-frontends/cx22702.c ++++ b/drivers/media/dvb-frontends/cx22702.c +@@ -604,7 +604,7 @@ error: + kfree(state); + return NULL; + } +-EXPORT_SYMBOL(cx22702_attach); ++EXPORT_SYMBOL_GPL(cx22702_attach); + + static const struct dvb_frontend_ops cx22702_ops = { + .delsys = { SYS_DVBT }, +diff --git a/drivers/media/dvb-frontends/cx24110.c b/drivers/media/dvb-frontends/cx24110.c +index 6f99d6a27be2d..9aeea089756fe 100644 +--- a/drivers/media/dvb-frontends/cx24110.c ++++ b/drivers/media/dvb-frontends/cx24110.c +@@ -653,4 +653,4 @@ MODULE_DESCRIPTION("Conexant CX24110 DVB-S Demodulator driver"); + MODULE_AUTHOR("Peter Hettkamp"); + MODULE_LICENSE("GPL"); + +-EXPORT_SYMBOL(cx24110_attach); ++EXPORT_SYMBOL_GPL(cx24110_attach); +diff --git a/drivers/media/dvb-frontends/cx24113.c b/drivers/media/dvb-frontends/cx24113.c +index 60a9f70275f75..619df8329fbbc 100644 +--- a/drivers/media/dvb-frontends/cx24113.c ++++ b/drivers/media/dvb-frontends/cx24113.c +@@ -590,7 +590,7 @@ error: + + return NULL; + } +-EXPORT_SYMBOL(cx24113_attach); ++EXPORT_SYMBOL_GPL(cx24113_attach); + + module_param(debug, int, 0644); + MODULE_PARM_DESC(debug, "Activates frontend debugging (default:0)"); +diff --git a/drivers/media/dvb-frontends/cx24116.c b/drivers/media/dvb-frontends/cx24116.c +index ea8264ccbb4e8..8b978a9f74a4e 100644 +--- a/drivers/media/dvb-frontends/cx24116.c ++++ b/drivers/media/dvb-frontends/cx24116.c +@@ -1133,7 +1133,7 @@ struct dvb_frontend *cx24116_attach(const struct cx24116_config *config, + state->frontend.demodulator_priv = state; + return &state->frontend; + } +-EXPORT_SYMBOL(cx24116_attach); ++EXPORT_SYMBOL_GPL(cx24116_attach); + + /* + * Initialise or wake up device +diff --git a/drivers/media/dvb-frontends/cx24120.c b/drivers/media/dvb-frontends/cx24120.c +index 2464b63fe0cf4..0fa033633f4cd 100644 +--- a/drivers/media/dvb-frontends/cx24120.c ++++ b/drivers/media/dvb-frontends/cx24120.c +@@ -305,7 +305,7 @@ error: + kfree(state); + return NULL; + } +-EXPORT_SYMBOL(cx24120_attach); ++EXPORT_SYMBOL_GPL(cx24120_attach); + + static int cx24120_test_rom(struct cx24120_state *state) + { +@@ -972,7 +972,9 @@ static void cx24120_set_clock_ratios(struct dvb_frontend *fe) + cmd.arg[8] = (clock_ratios_table[idx].rate >> 8) & 0xff; + cmd.arg[9] = (clock_ratios_table[idx].rate >> 0) & 0xff; + +- cx24120_message_send(state, &cmd); ++ ret = cx24120_message_send(state, &cmd); ++ if (ret != 0) ++ return; + + /* Calculate ber window rates for stat work */ + cx24120_calculate_ber_window(state, clock_ratios_table[idx].rate); +diff --git a/drivers/media/dvb-frontends/cx24123.c b/drivers/media/dvb-frontends/cx24123.c +index 3d84ee17e54c6..539889e638ccc 100644 +--- a/drivers/media/dvb-frontends/cx24123.c ++++ b/drivers/media/dvb-frontends/cx24123.c +@@ -1096,7 +1096,7 @@ error: + + return NULL; + } +-EXPORT_SYMBOL(cx24123_attach); ++EXPORT_SYMBOL_GPL(cx24123_attach); + + static const struct dvb_frontend_ops cx24123_ops = { + .delsys = { SYS_DVBS }, +diff --git a/drivers/media/dvb-frontends/cxd2820r_core.c b/drivers/media/dvb-frontends/cxd2820r_core.c +index d137199e13e69..4c2d3dcfe8ea8 100644 +--- a/drivers/media/dvb-frontends/cxd2820r_core.c ++++ b/drivers/media/dvb-frontends/cxd2820r_core.c +@@ -536,7 +536,7 @@ struct dvb_frontend *cxd2820r_attach(const struct cxd2820r_config *config, + + return pdata.get_dvb_frontend(client); + } +-EXPORT_SYMBOL(cxd2820r_attach); ++EXPORT_SYMBOL_GPL(cxd2820r_attach); + + static struct dvb_frontend *cxd2820r_get_dvb_frontend(struct i2c_client *client) + { +diff --git a/drivers/media/dvb-frontends/cxd2841er.c b/drivers/media/dvb-frontends/cxd2841er.c +index 1b30cf570803a..6b495fc36fd0c 100644 +--- a/drivers/media/dvb-frontends/cxd2841er.c ++++ b/drivers/media/dvb-frontends/cxd2841er.c +@@ -3920,14 +3920,14 @@ struct dvb_frontend *cxd2841er_attach_s(struct cxd2841er_config *cfg, + { + return cxd2841er_attach(cfg, i2c, SYS_DVBS); + } +-EXPORT_SYMBOL(cxd2841er_attach_s); ++EXPORT_SYMBOL_GPL(cxd2841er_attach_s); + + struct dvb_frontend *cxd2841er_attach_t_c(struct cxd2841er_config *cfg, + struct i2c_adapter *i2c) + { + return cxd2841er_attach(cfg, i2c, 0); + } +-EXPORT_SYMBOL(cxd2841er_attach_t_c); ++EXPORT_SYMBOL_GPL(cxd2841er_attach_t_c); + + static const struct dvb_frontend_ops cxd2841er_dvbs_s2_ops = { + .delsys = { SYS_DVBS, SYS_DVBS2 }, +diff --git a/drivers/media/dvb-frontends/cxd2880/cxd2880_top.c b/drivers/media/dvb-frontends/cxd2880/cxd2880_top.c +index f87e27481ea7b..ea1bc9a35618e 100644 +--- a/drivers/media/dvb-frontends/cxd2880/cxd2880_top.c ++++ b/drivers/media/dvb-frontends/cxd2880/cxd2880_top.c +@@ -1950,7 +1950,7 @@ struct dvb_frontend *cxd2880_attach(struct dvb_frontend *fe, + + return fe; + } +-EXPORT_SYMBOL(cxd2880_attach); ++EXPORT_SYMBOL_GPL(cxd2880_attach); + + MODULE_DESCRIPTION("Sony CXD2880 DVB-T2/T tuner + demod driver"); + MODULE_AUTHOR("Sony Semiconductor Solutions Corporation"); +diff --git a/drivers/media/dvb-frontends/dib0070.c b/drivers/media/dvb-frontends/dib0070.c +index 3b26f61785d8c..c4dfcb005b59b 100644 +--- a/drivers/media/dvb-frontends/dib0070.c ++++ b/drivers/media/dvb-frontends/dib0070.c +@@ -755,7 +755,7 @@ free_mem: + fe->tuner_priv = NULL; + return NULL; + } +-EXPORT_SYMBOL(dib0070_attach); ++EXPORT_SYMBOL_GPL(dib0070_attach); + + MODULE_AUTHOR("Patrick Boettcher <patrick.boettcher@posteo.de>"); + MODULE_DESCRIPTION("Driver for the DiBcom 0070 base-band RF Tuner"); +diff --git a/drivers/media/dvb-frontends/dib0090.c b/drivers/media/dvb-frontends/dib0090.c +index d13d2e81f8c9e..35c5a48d8fc81 100644 +--- a/drivers/media/dvb-frontends/dib0090.c ++++ b/drivers/media/dvb-frontends/dib0090.c +@@ -2631,7 +2631,7 @@ struct dvb_frontend *dib0090_register(struct dvb_frontend *fe, struct i2c_adapte + return NULL; + } + +-EXPORT_SYMBOL(dib0090_register); ++EXPORT_SYMBOL_GPL(dib0090_register); + + struct dvb_frontend *dib0090_fw_register(struct dvb_frontend *fe, struct i2c_adapter *i2c, const struct dib0090_config *config) + { +@@ -2657,7 +2657,7 @@ free_mem: + fe->tuner_priv = NULL; + return NULL; + } +-EXPORT_SYMBOL(dib0090_fw_register); ++EXPORT_SYMBOL_GPL(dib0090_fw_register); + + MODULE_AUTHOR("Patrick Boettcher <patrick.boettcher@posteo.de>"); + MODULE_AUTHOR("Olivier Grenie <olivier.grenie@parrot.com>"); +diff --git a/drivers/media/dvb-frontends/dib3000mb.c b/drivers/media/dvb-frontends/dib3000mb.c +index 46ed0e20c8fa7..282cdcf9f21bb 100644 +--- a/drivers/media/dvb-frontends/dib3000mb.c ++++ b/drivers/media/dvb-frontends/dib3000mb.c +@@ -815,4 +815,4 @@ MODULE_AUTHOR(DRIVER_AUTHOR); + MODULE_DESCRIPTION(DRIVER_DESC); + MODULE_LICENSE("GPL"); + +-EXPORT_SYMBOL(dib3000mb_attach); ++EXPORT_SYMBOL_GPL(dib3000mb_attach); +diff --git a/drivers/media/dvb-frontends/dib3000mc.c b/drivers/media/dvb-frontends/dib3000mc.c +index 692600ce5f230..c69665024330c 100644 +--- a/drivers/media/dvb-frontends/dib3000mc.c ++++ b/drivers/media/dvb-frontends/dib3000mc.c +@@ -935,7 +935,7 @@ error: + kfree(st); + return NULL; + } +-EXPORT_SYMBOL(dib3000mc_attach); ++EXPORT_SYMBOL_GPL(dib3000mc_attach); + + static const struct dvb_frontend_ops dib3000mc_ops = { + .delsys = { SYS_DVBT }, +diff --git a/drivers/media/dvb-frontends/dib7000m.c b/drivers/media/dvb-frontends/dib7000m.c +index e211830c9c991..7a0e06a420d96 100644 +--- a/drivers/media/dvb-frontends/dib7000m.c ++++ b/drivers/media/dvb-frontends/dib7000m.c +@@ -1434,7 +1434,7 @@ error: + kfree(st); + return NULL; + } +-EXPORT_SYMBOL(dib7000m_attach); ++EXPORT_SYMBOL_GPL(dib7000m_attach); + + static const struct dvb_frontend_ops dib7000m_ops = { + .delsys = { SYS_DVBT }, +diff --git a/drivers/media/dvb-frontends/dib7000p.c b/drivers/media/dvb-frontends/dib7000p.c +index 0d22c700016d4..fd08a851a4524 100644 +--- a/drivers/media/dvb-frontends/dib7000p.c ++++ b/drivers/media/dvb-frontends/dib7000p.c +@@ -497,7 +497,7 @@ static int dib7000p_update_pll(struct dvb_frontend *fe, struct dibx000_bandwidth + prediv = reg_1856 & 0x3f; + loopdiv = (reg_1856 >> 6) & 0x3f; + +- if ((bw != NULL) && (bw->pll_prediv != prediv || bw->pll_ratio != loopdiv)) { ++ if (loopdiv && bw && (bw->pll_prediv != prediv || bw->pll_ratio != loopdiv)) { + dprintk("Updating pll (prediv: old = %d new = %d ; loopdiv : old = %d new = %d)\n", prediv, bw->pll_prediv, loopdiv, bw->pll_ratio); + reg_1856 &= 0xf000; + reg_1857 = dib7000p_read_word(state, 1857); +@@ -2822,7 +2822,7 @@ void *dib7000p_attach(struct dib7000p_ops *ops) + + return ops; + } +-EXPORT_SYMBOL(dib7000p_attach); ++EXPORT_SYMBOL_GPL(dib7000p_attach); + + static const struct dvb_frontend_ops dib7000p_ops = { + .delsys = { SYS_DVBT }, +diff --git a/drivers/media/dvb-frontends/dib8000.c b/drivers/media/dvb-frontends/dib8000.c +index d67f2dd997d06..02cb48223dc67 100644 +--- a/drivers/media/dvb-frontends/dib8000.c ++++ b/drivers/media/dvb-frontends/dib8000.c +@@ -4527,7 +4527,7 @@ void *dib8000_attach(struct dib8000_ops *ops) + + return ops; + } +-EXPORT_SYMBOL(dib8000_attach); ++EXPORT_SYMBOL_GPL(dib8000_attach); + + MODULE_AUTHOR("Olivier Grenie <Olivier.Grenie@parrot.com, Patrick Boettcher <patrick.boettcher@posteo.de>"); + MODULE_DESCRIPTION("Driver for the DiBcom 8000 ISDB-T demodulator"); +diff --git a/drivers/media/dvb-frontends/dib9000.c b/drivers/media/dvb-frontends/dib9000.c +index 04d92d6142797..24f7f7a7598d4 100644 +--- a/drivers/media/dvb-frontends/dib9000.c ++++ b/drivers/media/dvb-frontends/dib9000.c +@@ -2546,7 +2546,7 @@ error: + kfree(st); + return NULL; + } +-EXPORT_SYMBOL(dib9000_attach); ++EXPORT_SYMBOL_GPL(dib9000_attach); + + static const struct dvb_frontend_ops dib9000_ops = { + .delsys = { SYS_DVBT }, +diff --git a/drivers/media/dvb-frontends/drx39xyj/drxj.c b/drivers/media/dvb-frontends/drx39xyj/drxj.c +index 2f5af4813a747..d6ab8a79629cd 100644 +--- a/drivers/media/dvb-frontends/drx39xyj/drxj.c ++++ b/drivers/media/dvb-frontends/drx39xyj/drxj.c +@@ -12366,7 +12366,7 @@ error: + + return NULL; + } +-EXPORT_SYMBOL(drx39xxj_attach); ++EXPORT_SYMBOL_GPL(drx39xxj_attach); + + static const struct dvb_frontend_ops drx39xxj_ops = { + .delsys = { SYS_ATSC, SYS_DVBC_ANNEX_B }, +diff --git a/drivers/media/dvb-frontends/drxd_hard.c b/drivers/media/dvb-frontends/drxd_hard.c +index fae6f3763364a..4be69230dd578 100644 +--- a/drivers/media/dvb-frontends/drxd_hard.c ++++ b/drivers/media/dvb-frontends/drxd_hard.c +@@ -2948,7 +2948,7 @@ error: + kfree(state); + return NULL; + } +-EXPORT_SYMBOL(drxd_attach); ++EXPORT_SYMBOL_GPL(drxd_attach); + + MODULE_DESCRIPTION("DRXD driver"); + MODULE_AUTHOR("Micronas"); +diff --git a/drivers/media/dvb-frontends/drxk_hard.c b/drivers/media/dvb-frontends/drxk_hard.c +index 2dccc9d0be121..d04ad020d6e12 100644 +--- a/drivers/media/dvb-frontends/drxk_hard.c ++++ b/drivers/media/dvb-frontends/drxk_hard.c +@@ -6857,7 +6857,7 @@ error: + kfree(state); + return NULL; + } +-EXPORT_SYMBOL(drxk_attach); ++EXPORT_SYMBOL_GPL(drxk_attach); + + MODULE_DESCRIPTION("DRX-K driver"); + MODULE_AUTHOR("Ralph Metzler"); +diff --git a/drivers/media/dvb-frontends/ds3000.c b/drivers/media/dvb-frontends/ds3000.c +index 20fcf31af1658..515aa7c7baf2a 100644 +--- a/drivers/media/dvb-frontends/ds3000.c ++++ b/drivers/media/dvb-frontends/ds3000.c +@@ -859,7 +859,7 @@ struct dvb_frontend *ds3000_attach(const struct ds3000_config *config, + ds3000_set_voltage(&state->frontend, SEC_VOLTAGE_OFF); + return &state->frontend; + } +-EXPORT_SYMBOL(ds3000_attach); ++EXPORT_SYMBOL_GPL(ds3000_attach); + + static int ds3000_set_carrier_offset(struct dvb_frontend *fe, + s32 carrier_offset_khz) +diff --git a/drivers/media/dvb-frontends/dvb-pll.c b/drivers/media/dvb-frontends/dvb-pll.c +index d45b4ddc8f912..846bfe7ef30eb 100644 +--- a/drivers/media/dvb-frontends/dvb-pll.c ++++ b/drivers/media/dvb-frontends/dvb-pll.c +@@ -866,7 +866,7 @@ out: + + return NULL; + } +-EXPORT_SYMBOL(dvb_pll_attach); ++EXPORT_SYMBOL_GPL(dvb_pll_attach); + + + static int +diff --git a/drivers/media/dvb-frontends/ec100.c b/drivers/media/dvb-frontends/ec100.c +index 03bd80666cf83..2ad0a3c2f7567 100644 +--- a/drivers/media/dvb-frontends/ec100.c ++++ b/drivers/media/dvb-frontends/ec100.c +@@ -299,7 +299,7 @@ error: + kfree(state); + return NULL; + } +-EXPORT_SYMBOL(ec100_attach); ++EXPORT_SYMBOL_GPL(ec100_attach); + + static const struct dvb_frontend_ops ec100_ops = { + .delsys = { SYS_DVBT }, +diff --git a/drivers/media/dvb-frontends/helene.c b/drivers/media/dvb-frontends/helene.c +index 8c1310c6b0bc2..c299d31dc7d27 100644 +--- a/drivers/media/dvb-frontends/helene.c ++++ b/drivers/media/dvb-frontends/helene.c +@@ -1025,7 +1025,7 @@ struct dvb_frontend *helene_attach_s(struct dvb_frontend *fe, + priv->i2c_address, priv->i2c); + return fe; + } +-EXPORT_SYMBOL(helene_attach_s); ++EXPORT_SYMBOL_GPL(helene_attach_s); + + struct dvb_frontend *helene_attach(struct dvb_frontend *fe, + const struct helene_config *config, +@@ -1061,7 +1061,7 @@ struct dvb_frontend *helene_attach(struct dvb_frontend *fe, + priv->i2c_address, priv->i2c); + return fe; + } +-EXPORT_SYMBOL(helene_attach); ++EXPORT_SYMBOL_GPL(helene_attach); + + static int helene_probe(struct i2c_client *client, + const struct i2c_device_id *id) +diff --git a/drivers/media/dvb-frontends/horus3a.c b/drivers/media/dvb-frontends/horus3a.c +index 24bf5cbcc1846..0330b78a5b3f2 100644 +--- a/drivers/media/dvb-frontends/horus3a.c ++++ b/drivers/media/dvb-frontends/horus3a.c +@@ -395,7 +395,7 @@ struct dvb_frontend *horus3a_attach(struct dvb_frontend *fe, + priv->i2c_address, priv->i2c); + return fe; + } +-EXPORT_SYMBOL(horus3a_attach); ++EXPORT_SYMBOL_GPL(horus3a_attach); + + MODULE_DESCRIPTION("Sony HORUS3A satellite tuner driver"); + MODULE_AUTHOR("Sergey Kozlov <serjk@netup.ru>"); +diff --git a/drivers/media/dvb-frontends/isl6405.c b/drivers/media/dvb-frontends/isl6405.c +index 2cd69b4ff82cb..7d28a743f97eb 100644 +--- a/drivers/media/dvb-frontends/isl6405.c ++++ b/drivers/media/dvb-frontends/isl6405.c +@@ -141,7 +141,7 @@ struct dvb_frontend *isl6405_attach(struct dvb_frontend *fe, struct i2c_adapter + + return fe; + } +-EXPORT_SYMBOL(isl6405_attach); ++EXPORT_SYMBOL_GPL(isl6405_attach); + + MODULE_DESCRIPTION("Driver for lnb supply and control ic isl6405"); + MODULE_AUTHOR("Hartmut Hackmann & Oliver Endriss"); +diff --git a/drivers/media/dvb-frontends/isl6421.c b/drivers/media/dvb-frontends/isl6421.c +index 43b0dfc6f453e..2e9f6f12f849e 100644 +--- a/drivers/media/dvb-frontends/isl6421.c ++++ b/drivers/media/dvb-frontends/isl6421.c +@@ -213,7 +213,7 @@ struct dvb_frontend *isl6421_attach(struct dvb_frontend *fe, struct i2c_adapter + + return fe; + } +-EXPORT_SYMBOL(isl6421_attach); ++EXPORT_SYMBOL_GPL(isl6421_attach); + + MODULE_DESCRIPTION("Driver for lnb supply and control ic isl6421"); + MODULE_AUTHOR("Andrew de Quincey & Oliver Endriss"); +diff --git a/drivers/media/dvb-frontends/isl6423.c b/drivers/media/dvb-frontends/isl6423.c +index 8cd1bb88ce6e7..a0d0a38340574 100644 +--- a/drivers/media/dvb-frontends/isl6423.c ++++ b/drivers/media/dvb-frontends/isl6423.c +@@ -289,7 +289,7 @@ exit: + fe->sec_priv = NULL; + return NULL; + } +-EXPORT_SYMBOL(isl6423_attach); ++EXPORT_SYMBOL_GPL(isl6423_attach); + + MODULE_DESCRIPTION("ISL6423 SEC"); + MODULE_AUTHOR("Manu Abraham"); +diff --git a/drivers/media/dvb-frontends/itd1000.c b/drivers/media/dvb-frontends/itd1000.c +index 1b33478653d16..f8f362f50e78d 100644 +--- a/drivers/media/dvb-frontends/itd1000.c ++++ b/drivers/media/dvb-frontends/itd1000.c +@@ -389,7 +389,7 @@ struct dvb_frontend *itd1000_attach(struct dvb_frontend *fe, struct i2c_adapter + + return fe; + } +-EXPORT_SYMBOL(itd1000_attach); ++EXPORT_SYMBOL_GPL(itd1000_attach); + + MODULE_AUTHOR("Patrick Boettcher <pb@linuxtv.org>"); + MODULE_DESCRIPTION("Integrant ITD1000 driver"); +diff --git a/drivers/media/dvb-frontends/ix2505v.c b/drivers/media/dvb-frontends/ix2505v.c +index 73f27105c139d..3212e333d472b 100644 +--- a/drivers/media/dvb-frontends/ix2505v.c ++++ b/drivers/media/dvb-frontends/ix2505v.c +@@ -302,7 +302,7 @@ error: + kfree(state); + return NULL; + } +-EXPORT_SYMBOL(ix2505v_attach); ++EXPORT_SYMBOL_GPL(ix2505v_attach); + + module_param_named(debug, ix2505v_debug, int, 0644); + MODULE_PARM_DESC(debug, "Turn on/off frontend debugging (default:off)."); +diff --git a/drivers/media/dvb-frontends/l64781.c b/drivers/media/dvb-frontends/l64781.c +index c5106a1ea1cd0..fe5af2453d559 100644 +--- a/drivers/media/dvb-frontends/l64781.c ++++ b/drivers/media/dvb-frontends/l64781.c +@@ -593,4 +593,4 @@ MODULE_DESCRIPTION("LSI L64781 DVB-T Demodulator driver"); + MODULE_AUTHOR("Holger Waechtler, Marko Kohtala"); + MODULE_LICENSE("GPL"); + +-EXPORT_SYMBOL(l64781_attach); ++EXPORT_SYMBOL_GPL(l64781_attach); +diff --git a/drivers/media/dvb-frontends/lg2160.c b/drivers/media/dvb-frontends/lg2160.c +index 10c152f461dd1..958c868132b3c 100644 +--- a/drivers/media/dvb-frontends/lg2160.c ++++ b/drivers/media/dvb-frontends/lg2160.c +@@ -1426,7 +1426,7 @@ struct dvb_frontend *lg2160_attach(const struct lg2160_config *config, + + return &state->frontend; + } +-EXPORT_SYMBOL(lg2160_attach); ++EXPORT_SYMBOL_GPL(lg2160_attach); + + MODULE_DESCRIPTION("LG Electronics LG216x ATSC/MH Demodulator Driver"); + MODULE_AUTHOR("Michael Krufky <mkrufky@linuxtv.org>"); +diff --git a/drivers/media/dvb-frontends/lgdt3305.c b/drivers/media/dvb-frontends/lgdt3305.c +index 62d7439889196..60a97f1cc74e5 100644 +--- a/drivers/media/dvb-frontends/lgdt3305.c ++++ b/drivers/media/dvb-frontends/lgdt3305.c +@@ -1148,7 +1148,7 @@ fail: + kfree(state); + return NULL; + } +-EXPORT_SYMBOL(lgdt3305_attach); ++EXPORT_SYMBOL_GPL(lgdt3305_attach); + + static const struct dvb_frontend_ops lgdt3304_ops = { + .delsys = { SYS_ATSC, SYS_DVBC_ANNEX_B }, +diff --git a/drivers/media/dvb-frontends/lgdt3306a.c b/drivers/media/dvb-frontends/lgdt3306a.c +index 6c4adec581747..0e7d97e7b0f50 100644 +--- a/drivers/media/dvb-frontends/lgdt3306a.c ++++ b/drivers/media/dvb-frontends/lgdt3306a.c +@@ -1881,7 +1881,7 @@ fail: + kfree(state); + return NULL; + } +-EXPORT_SYMBOL(lgdt3306a_attach); ++EXPORT_SYMBOL_GPL(lgdt3306a_attach); + + #ifdef DBG_DUMP + +diff --git a/drivers/media/dvb-frontends/lgdt330x.c b/drivers/media/dvb-frontends/lgdt330x.c +index 651c8aa75e172..1416aedb1234b 100644 +--- a/drivers/media/dvb-frontends/lgdt330x.c ++++ b/drivers/media/dvb-frontends/lgdt330x.c +@@ -928,7 +928,7 @@ struct dvb_frontend *lgdt330x_attach(const struct lgdt330x_config *_config, + + return lgdt330x_get_dvb_frontend(client); + } +-EXPORT_SYMBOL(lgdt330x_attach); ++EXPORT_SYMBOL_GPL(lgdt330x_attach); + + static const struct dvb_frontend_ops lgdt3302_ops = { + .delsys = { SYS_ATSC, SYS_DVBC_ANNEX_B }, +diff --git a/drivers/media/dvb-frontends/lgs8gxx.c b/drivers/media/dvb-frontends/lgs8gxx.c +index 30014979b985b..ffaf60e16ecd4 100644 +--- a/drivers/media/dvb-frontends/lgs8gxx.c ++++ b/drivers/media/dvb-frontends/lgs8gxx.c +@@ -1043,7 +1043,7 @@ error_out: + return NULL; + + } +-EXPORT_SYMBOL(lgs8gxx_attach); ++EXPORT_SYMBOL_GPL(lgs8gxx_attach); + + MODULE_DESCRIPTION("Legend Silicon LGS8913/LGS8GXX DMB-TH demodulator driver"); + MODULE_AUTHOR("David T. L. Wong <davidtlwong@gmail.com>"); +diff --git a/drivers/media/dvb-frontends/lnbh25.c b/drivers/media/dvb-frontends/lnbh25.c +index 9ffe06cd787dd..41bec050642b5 100644 +--- a/drivers/media/dvb-frontends/lnbh25.c ++++ b/drivers/media/dvb-frontends/lnbh25.c +@@ -173,7 +173,7 @@ struct dvb_frontend *lnbh25_attach(struct dvb_frontend *fe, + __func__, priv->i2c_address); + return fe; + } +-EXPORT_SYMBOL(lnbh25_attach); ++EXPORT_SYMBOL_GPL(lnbh25_attach); + + MODULE_DESCRIPTION("ST LNBH25 driver"); + MODULE_AUTHOR("info@netup.ru"); +diff --git a/drivers/media/dvb-frontends/lnbp21.c b/drivers/media/dvb-frontends/lnbp21.c +index e564974162d65..32593b1f75a38 100644 +--- a/drivers/media/dvb-frontends/lnbp21.c ++++ b/drivers/media/dvb-frontends/lnbp21.c +@@ -155,7 +155,7 @@ struct dvb_frontend *lnbh24_attach(struct dvb_frontend *fe, + return lnbx2x_attach(fe, i2c, override_set, override_clear, + i2c_addr, LNBH24_TTX); + } +-EXPORT_SYMBOL(lnbh24_attach); ++EXPORT_SYMBOL_GPL(lnbh24_attach); + + struct dvb_frontend *lnbp21_attach(struct dvb_frontend *fe, + struct i2c_adapter *i2c, u8 override_set, +@@ -164,7 +164,7 @@ struct dvb_frontend *lnbp21_attach(struct dvb_frontend *fe, + return lnbx2x_attach(fe, i2c, override_set, override_clear, + 0x08, LNBP21_ISEL); + } +-EXPORT_SYMBOL(lnbp21_attach); ++EXPORT_SYMBOL_GPL(lnbp21_attach); + + MODULE_DESCRIPTION("Driver for lnb supply and control ic lnbp21, lnbh24"); + MODULE_AUTHOR("Oliver Endriss, Igor M. Liplianin"); +diff --git a/drivers/media/dvb-frontends/lnbp22.c b/drivers/media/dvb-frontends/lnbp22.c +index b8c7145d4cefe..cb4ea5d3fad4a 100644 +--- a/drivers/media/dvb-frontends/lnbp22.c ++++ b/drivers/media/dvb-frontends/lnbp22.c +@@ -125,7 +125,7 @@ struct dvb_frontend *lnbp22_attach(struct dvb_frontend *fe, + + return fe; + } +-EXPORT_SYMBOL(lnbp22_attach); ++EXPORT_SYMBOL_GPL(lnbp22_attach); + + MODULE_DESCRIPTION("Driver for lnb supply and control ic lnbp22"); + MODULE_AUTHOR("Dominik Kuhlen"); +diff --git a/drivers/media/dvb-frontends/m88ds3103.c b/drivers/media/dvb-frontends/m88ds3103.c +index 3a367a5850842..1f8f0e3bb1950 100644 +--- a/drivers/media/dvb-frontends/m88ds3103.c ++++ b/drivers/media/dvb-frontends/m88ds3103.c +@@ -1284,7 +1284,7 @@ struct dvb_frontend *m88ds3103_attach(const struct m88ds3103_config *cfg, + *tuner_i2c_adapter = pdata.get_i2c_adapter(client); + return pdata.get_dvb_frontend(client); + } +-EXPORT_SYMBOL(m88ds3103_attach); ++EXPORT_SYMBOL_GPL(m88ds3103_attach); + + static const struct dvb_frontend_ops m88ds3103_ops = { + .delsys = {SYS_DVBS, SYS_DVBS2}, +diff --git a/drivers/media/dvb-frontends/m88rs2000.c b/drivers/media/dvb-frontends/m88rs2000.c +index 39cbb3ea1c9dc..d1f235b472ceb 100644 +--- a/drivers/media/dvb-frontends/m88rs2000.c ++++ b/drivers/media/dvb-frontends/m88rs2000.c +@@ -807,7 +807,7 @@ error: + + return NULL; + } +-EXPORT_SYMBOL(m88rs2000_attach); ++EXPORT_SYMBOL_GPL(m88rs2000_attach); + + MODULE_DESCRIPTION("M88RS2000 DVB-S Demodulator driver"); + MODULE_AUTHOR("Malcolm Priestley tvboxspy@gmail.com"); +diff --git a/drivers/media/dvb-frontends/mb86a16.c b/drivers/media/dvb-frontends/mb86a16.c +index 3843181bba16b..29d5d29d9f2c6 100644 +--- a/drivers/media/dvb-frontends/mb86a16.c ++++ b/drivers/media/dvb-frontends/mb86a16.c +@@ -1851,6 +1851,6 @@ error: + kfree(state); + return NULL; + } +-EXPORT_SYMBOL(mb86a16_attach); ++EXPORT_SYMBOL_GPL(mb86a16_attach); + MODULE_LICENSE("GPL"); + MODULE_AUTHOR("Manu Abraham"); +diff --git a/drivers/media/dvb-frontends/mb86a20s.c b/drivers/media/dvb-frontends/mb86a20s.c +index 4e50441c247ac..6bbf3fb44740b 100644 +--- a/drivers/media/dvb-frontends/mb86a20s.c ++++ b/drivers/media/dvb-frontends/mb86a20s.c +@@ -2089,7 +2089,7 @@ struct dvb_frontend *mb86a20s_attach(const struct mb86a20s_config *config, + dev_info(&i2c->dev, "Detected a Fujitsu mb86a20s frontend\n"); + return &state->frontend; + } +-EXPORT_SYMBOL(mb86a20s_attach); ++EXPORT_SYMBOL_GPL(mb86a20s_attach); + + static const struct dvb_frontend_ops mb86a20s_ops = { + .delsys = { SYS_ISDBT }, +diff --git a/drivers/media/dvb-frontends/mt312.c b/drivers/media/dvb-frontends/mt312.c +index 7cae7d6320302..2c01d912f1ceb 100644 +--- a/drivers/media/dvb-frontends/mt312.c ++++ b/drivers/media/dvb-frontends/mt312.c +@@ -832,7 +832,7 @@ error: + kfree(state); + return NULL; + } +-EXPORT_SYMBOL(mt312_attach); ++EXPORT_SYMBOL_GPL(mt312_attach); + + module_param(debug, int, 0644); + MODULE_PARM_DESC(debug, "Turn on/off frontend debugging (default:off)."); +diff --git a/drivers/media/dvb-frontends/mt352.c b/drivers/media/dvb-frontends/mt352.c +index 881897583cf2d..20add66b1466b 100644 +--- a/drivers/media/dvb-frontends/mt352.c ++++ b/drivers/media/dvb-frontends/mt352.c +@@ -593,4 +593,4 @@ MODULE_DESCRIPTION("Zarlink MT352 DVB-T Demodulator driver"); + MODULE_AUTHOR("Holger Waechtler, Daniel Mack, Antonio Mancuso"); + MODULE_LICENSE("GPL"); + +-EXPORT_SYMBOL(mt352_attach); ++EXPORT_SYMBOL_GPL(mt352_attach); +diff --git a/drivers/media/dvb-frontends/nxt200x.c b/drivers/media/dvb-frontends/nxt200x.c +index 35b83b1dd82ce..1124baf5baf4c 100644 +--- a/drivers/media/dvb-frontends/nxt200x.c ++++ b/drivers/media/dvb-frontends/nxt200x.c +@@ -1232,5 +1232,5 @@ MODULE_DESCRIPTION("NXT200X (ATSC 8VSB & ITU-T J.83 AnnexB 64/256 QAM) Demodulat + MODULE_AUTHOR("Kirk Lapray, Michael Krufky, Jean-Francois Thibert, and Taylor Jacob"); + MODULE_LICENSE("GPL"); + +-EXPORT_SYMBOL(nxt200x_attach); ++EXPORT_SYMBOL_GPL(nxt200x_attach); + +diff --git a/drivers/media/dvb-frontends/nxt6000.c b/drivers/media/dvb-frontends/nxt6000.c +index 136918f82dda0..e8d4940370ddf 100644 +--- a/drivers/media/dvb-frontends/nxt6000.c ++++ b/drivers/media/dvb-frontends/nxt6000.c +@@ -621,4 +621,4 @@ MODULE_DESCRIPTION("NxtWave NXT6000 DVB-T demodulator driver"); + MODULE_AUTHOR("Florian Schirmer"); + MODULE_LICENSE("GPL"); + +-EXPORT_SYMBOL(nxt6000_attach); ++EXPORT_SYMBOL_GPL(nxt6000_attach); +diff --git a/drivers/media/dvb-frontends/or51132.c b/drivers/media/dvb-frontends/or51132.c +index 35a3e47497c27..2ca01af5608ca 100644 +--- a/drivers/media/dvb-frontends/or51132.c ++++ b/drivers/media/dvb-frontends/or51132.c +@@ -605,4 +605,4 @@ MODULE_AUTHOR("Kirk Lapray"); + MODULE_AUTHOR("Trent Piepho"); + MODULE_LICENSE("GPL"); + +-EXPORT_SYMBOL(or51132_attach); ++EXPORT_SYMBOL_GPL(or51132_attach); +diff --git a/drivers/media/dvb-frontends/or51211.c b/drivers/media/dvb-frontends/or51211.c +index ddcaea5c9941f..dc60482162c54 100644 +--- a/drivers/media/dvb-frontends/or51211.c ++++ b/drivers/media/dvb-frontends/or51211.c +@@ -551,5 +551,5 @@ MODULE_DESCRIPTION("Oren OR51211 VSB [pcHDTV HD-2000] Demodulator Driver"); + MODULE_AUTHOR("Kirk Lapray"); + MODULE_LICENSE("GPL"); + +-EXPORT_SYMBOL(or51211_attach); ++EXPORT_SYMBOL_GPL(or51211_attach); + +diff --git a/drivers/media/dvb-frontends/s5h1409.c b/drivers/media/dvb-frontends/s5h1409.c +index 3089cc174a6f5..28b1dca077ead 100644 +--- a/drivers/media/dvb-frontends/s5h1409.c ++++ b/drivers/media/dvb-frontends/s5h1409.c +@@ -981,7 +981,7 @@ error: + kfree(state); + return NULL; + } +-EXPORT_SYMBOL(s5h1409_attach); ++EXPORT_SYMBOL_GPL(s5h1409_attach); + + static const struct dvb_frontend_ops s5h1409_ops = { + .delsys = { SYS_ATSC, SYS_DVBC_ANNEX_B }, +diff --git a/drivers/media/dvb-frontends/s5h1411.c b/drivers/media/dvb-frontends/s5h1411.c +index 89402916d301f..7f5313bb9b439 100644 +--- a/drivers/media/dvb-frontends/s5h1411.c ++++ b/drivers/media/dvb-frontends/s5h1411.c +@@ -900,7 +900,7 @@ error: + kfree(state); + return NULL; + } +-EXPORT_SYMBOL(s5h1411_attach); ++EXPORT_SYMBOL_GPL(s5h1411_attach); + + static const struct dvb_frontend_ops s5h1411_ops = { + .delsys = { SYS_ATSC, SYS_DVBC_ANNEX_B }, +diff --git a/drivers/media/dvb-frontends/s5h1420.c b/drivers/media/dvb-frontends/s5h1420.c +index 6bdec2898bc81..d700de1ea6c24 100644 +--- a/drivers/media/dvb-frontends/s5h1420.c ++++ b/drivers/media/dvb-frontends/s5h1420.c +@@ -918,7 +918,7 @@ error: + kfree(state); + return NULL; + } +-EXPORT_SYMBOL(s5h1420_attach); ++EXPORT_SYMBOL_GPL(s5h1420_attach); + + static const struct dvb_frontend_ops s5h1420_ops = { + .delsys = { SYS_DVBS }, +diff --git a/drivers/media/dvb-frontends/s5h1432.c b/drivers/media/dvb-frontends/s5h1432.c +index 956e8ee4b388e..ff5d3bdf3bc67 100644 +--- a/drivers/media/dvb-frontends/s5h1432.c ++++ b/drivers/media/dvb-frontends/s5h1432.c +@@ -355,7 +355,7 @@ struct dvb_frontend *s5h1432_attach(const struct s5h1432_config *config, + + return &state->frontend; + } +-EXPORT_SYMBOL(s5h1432_attach); ++EXPORT_SYMBOL_GPL(s5h1432_attach); + + static const struct dvb_frontend_ops s5h1432_ops = { + .delsys = { SYS_DVBT }, +diff --git a/drivers/media/dvb-frontends/s921.c b/drivers/media/dvb-frontends/s921.c +index f118d8e641030..7e461ac159fc1 100644 +--- a/drivers/media/dvb-frontends/s921.c ++++ b/drivers/media/dvb-frontends/s921.c +@@ -495,7 +495,7 @@ struct dvb_frontend *s921_attach(const struct s921_config *config, + + return &state->frontend; + } +-EXPORT_SYMBOL(s921_attach); ++EXPORT_SYMBOL_GPL(s921_attach); + + static const struct dvb_frontend_ops s921_ops = { + .delsys = { SYS_ISDBT }, +diff --git a/drivers/media/dvb-frontends/si21xx.c b/drivers/media/dvb-frontends/si21xx.c +index a116eff417f26..6d84a5534aba6 100644 +--- a/drivers/media/dvb-frontends/si21xx.c ++++ b/drivers/media/dvb-frontends/si21xx.c +@@ -938,7 +938,7 @@ error: + kfree(state); + return NULL; + } +-EXPORT_SYMBOL(si21xx_attach); ++EXPORT_SYMBOL_GPL(si21xx_attach); + + module_param(debug, int, 0644); + MODULE_PARM_DESC(debug, "Turn on/off frontend debugging (default:off)."); +diff --git a/drivers/media/dvb-frontends/sp887x.c b/drivers/media/dvb-frontends/sp887x.c +index c89a91a3daf40..72f58626475c4 100644 +--- a/drivers/media/dvb-frontends/sp887x.c ++++ b/drivers/media/dvb-frontends/sp887x.c +@@ -626,4 +626,4 @@ MODULE_PARM_DESC(debug, "Turn on/off frontend debugging (default:off)."); + MODULE_DESCRIPTION("Spase sp887x DVB-T demodulator driver"); + MODULE_LICENSE("GPL"); + +-EXPORT_SYMBOL(sp887x_attach); ++EXPORT_SYMBOL_GPL(sp887x_attach); +diff --git a/drivers/media/dvb-frontends/stb0899_drv.c b/drivers/media/dvb-frontends/stb0899_drv.c +index 4ee6c1e1e9f7d..2f4d8fb400cd6 100644 +--- a/drivers/media/dvb-frontends/stb0899_drv.c ++++ b/drivers/media/dvb-frontends/stb0899_drv.c +@@ -1638,7 +1638,7 @@ error: + kfree(state); + return NULL; + } +-EXPORT_SYMBOL(stb0899_attach); ++EXPORT_SYMBOL_GPL(stb0899_attach); + MODULE_PARM_DESC(verbose, "Set Verbosity level"); + MODULE_AUTHOR("Manu Abraham"); + MODULE_DESCRIPTION("STB0899 Multi-Std frontend"); +diff --git a/drivers/media/dvb-frontends/stb6000.c b/drivers/media/dvb-frontends/stb6000.c +index 8c9800d577e03..d74e34677b925 100644 +--- a/drivers/media/dvb-frontends/stb6000.c ++++ b/drivers/media/dvb-frontends/stb6000.c +@@ -232,7 +232,7 @@ struct dvb_frontend *stb6000_attach(struct dvb_frontend *fe, int addr, + + return fe; + } +-EXPORT_SYMBOL(stb6000_attach); ++EXPORT_SYMBOL_GPL(stb6000_attach); + + module_param(debug, int, 0644); + MODULE_PARM_DESC(debug, "Turn on/off frontend debugging (default:off)."); +diff --git a/drivers/media/dvb-frontends/stb6100.c b/drivers/media/dvb-frontends/stb6100.c +index d541d66136107..9f92760256cf5 100644 +--- a/drivers/media/dvb-frontends/stb6100.c ++++ b/drivers/media/dvb-frontends/stb6100.c +@@ -557,7 +557,7 @@ static void stb6100_release(struct dvb_frontend *fe) + kfree(state); + } + +-EXPORT_SYMBOL(stb6100_attach); ++EXPORT_SYMBOL_GPL(stb6100_attach); + MODULE_PARM_DESC(verbose, "Set Verbosity level"); + + MODULE_AUTHOR("Manu Abraham"); +diff --git a/drivers/media/dvb-frontends/stv0288.c b/drivers/media/dvb-frontends/stv0288.c +index 3ae1f3a2f1420..a5581bd60f9e8 100644 +--- a/drivers/media/dvb-frontends/stv0288.c ++++ b/drivers/media/dvb-frontends/stv0288.c +@@ -590,7 +590,7 @@ error: + + return NULL; + } +-EXPORT_SYMBOL(stv0288_attach); ++EXPORT_SYMBOL_GPL(stv0288_attach); + + module_param(debug_legacy_dish_switch, int, 0444); + MODULE_PARM_DESC(debug_legacy_dish_switch, +diff --git a/drivers/media/dvb-frontends/stv0297.c b/drivers/media/dvb-frontends/stv0297.c +index 6d5962d5697ac..9d4dbd99a5a79 100644 +--- a/drivers/media/dvb-frontends/stv0297.c ++++ b/drivers/media/dvb-frontends/stv0297.c +@@ -710,4 +710,4 @@ MODULE_DESCRIPTION("ST STV0297 DVB-C Demodulator driver"); + MODULE_AUTHOR("Dennis Noermann and Andrew de Quincey"); + MODULE_LICENSE("GPL"); + +-EXPORT_SYMBOL(stv0297_attach); ++EXPORT_SYMBOL_GPL(stv0297_attach); +diff --git a/drivers/media/dvb-frontends/stv0299.c b/drivers/media/dvb-frontends/stv0299.c +index 421395ea33343..0a1b57e9e2281 100644 +--- a/drivers/media/dvb-frontends/stv0299.c ++++ b/drivers/media/dvb-frontends/stv0299.c +@@ -751,4 +751,4 @@ MODULE_DESCRIPTION("ST STV0299 DVB Demodulator driver"); + MODULE_AUTHOR("Ralph Metzler, Holger Waechtler, Peter Schildmann, Felix Domke, Andreas Oberritter, Andrew de Quincey, Kenneth Aafly"); + MODULE_LICENSE("GPL"); + +-EXPORT_SYMBOL(stv0299_attach); ++EXPORT_SYMBOL_GPL(stv0299_attach); +diff --git a/drivers/media/dvb-frontends/stv0367.c b/drivers/media/dvb-frontends/stv0367.c +index 6c2b05fae1c55..0bfca1174e9e7 100644 +--- a/drivers/media/dvb-frontends/stv0367.c ++++ b/drivers/media/dvb-frontends/stv0367.c +@@ -1750,7 +1750,7 @@ error: + kfree(state); + return NULL; + } +-EXPORT_SYMBOL(stv0367ter_attach); ++EXPORT_SYMBOL_GPL(stv0367ter_attach); + + static int stv0367cab_gate_ctrl(struct dvb_frontend *fe, int enable) + { +@@ -2923,7 +2923,7 @@ error: + kfree(state); + return NULL; + } +-EXPORT_SYMBOL(stv0367cab_attach); ++EXPORT_SYMBOL_GPL(stv0367cab_attach); + + /* + * Functions for operation on Digital Devices hardware +@@ -3344,7 +3344,7 @@ error: + kfree(state); + return NULL; + } +-EXPORT_SYMBOL(stv0367ddb_attach); ++EXPORT_SYMBOL_GPL(stv0367ddb_attach); + + MODULE_PARM_DESC(debug, "Set debug"); + MODULE_PARM_DESC(i2c_debug, "Set i2c debug"); +diff --git a/drivers/media/dvb-frontends/stv0900_core.c b/drivers/media/dvb-frontends/stv0900_core.c +index 7d93a1617e866..eea22c1a9537a 100644 +--- a/drivers/media/dvb-frontends/stv0900_core.c ++++ b/drivers/media/dvb-frontends/stv0900_core.c +@@ -1957,7 +1957,7 @@ error: + kfree(state); + return NULL; + } +-EXPORT_SYMBOL(stv0900_attach); ++EXPORT_SYMBOL_GPL(stv0900_attach); + + MODULE_PARM_DESC(debug, "Set debug"); + +diff --git a/drivers/media/dvb-frontends/stv090x.c b/drivers/media/dvb-frontends/stv090x.c +index 90d24131d335f..799dbefb9eef7 100644 +--- a/drivers/media/dvb-frontends/stv090x.c ++++ b/drivers/media/dvb-frontends/stv090x.c +@@ -5073,7 +5073,7 @@ error: + kfree(state); + return NULL; + } +-EXPORT_SYMBOL(stv090x_attach); ++EXPORT_SYMBOL_GPL(stv090x_attach); + + static const struct i2c_device_id stv090x_id_table[] = { + {"stv090x", 0}, +diff --git a/drivers/media/dvb-frontends/stv6110.c b/drivers/media/dvb-frontends/stv6110.c +index 963f6a896102a..1cf9c095dbff0 100644 +--- a/drivers/media/dvb-frontends/stv6110.c ++++ b/drivers/media/dvb-frontends/stv6110.c +@@ -427,7 +427,7 @@ struct dvb_frontend *stv6110_attach(struct dvb_frontend *fe, + + return fe; + } +-EXPORT_SYMBOL(stv6110_attach); ++EXPORT_SYMBOL_GPL(stv6110_attach); + + module_param(debug, int, 0644); + MODULE_PARM_DESC(debug, "Turn on/off frontend debugging (default:off)."); +diff --git a/drivers/media/dvb-frontends/stv6110x.c b/drivers/media/dvb-frontends/stv6110x.c +index 5012d02316522..b08c7536a69fb 100644 +--- a/drivers/media/dvb-frontends/stv6110x.c ++++ b/drivers/media/dvb-frontends/stv6110x.c +@@ -469,7 +469,7 @@ const struct stv6110x_devctl *stv6110x_attach(struct dvb_frontend *fe, + dev_info(&stv6110x->i2c->dev, "Attaching STV6110x\n"); + return stv6110x->devctl; + } +-EXPORT_SYMBOL(stv6110x_attach); ++EXPORT_SYMBOL_GPL(stv6110x_attach); + + static const struct i2c_device_id stv6110x_id_table[] = { + {"stv6110x", 0}, +diff --git a/drivers/media/dvb-frontends/tda10021.c b/drivers/media/dvb-frontends/tda10021.c +index 9fb207b415765..3bc4f0006659e 100644 +--- a/drivers/media/dvb-frontends/tda10021.c ++++ b/drivers/media/dvb-frontends/tda10021.c +@@ -513,4 +513,4 @@ MODULE_DESCRIPTION("Philips TDA10021 DVB-C demodulator driver"); + MODULE_AUTHOR("Ralph Metzler, Holger Waechtler, Markus Schulz"); + MODULE_LICENSE("GPL"); + +-EXPORT_SYMBOL(tda10021_attach); ++EXPORT_SYMBOL_GPL(tda10021_attach); +diff --git a/drivers/media/dvb-frontends/tda10023.c b/drivers/media/dvb-frontends/tda10023.c +index 8f32edf6b700e..4c2541ecd7433 100644 +--- a/drivers/media/dvb-frontends/tda10023.c ++++ b/drivers/media/dvb-frontends/tda10023.c +@@ -594,4 +594,4 @@ MODULE_DESCRIPTION("Philips TDA10023 DVB-C demodulator driver"); + MODULE_AUTHOR("Georg Acher, Hartmut Birr"); + MODULE_LICENSE("GPL"); + +-EXPORT_SYMBOL(tda10023_attach); ++EXPORT_SYMBOL_GPL(tda10023_attach); +diff --git a/drivers/media/dvb-frontends/tda10048.c b/drivers/media/dvb-frontends/tda10048.c +index d1d206ebdedd7..f1d5e77d5dcce 100644 +--- a/drivers/media/dvb-frontends/tda10048.c ++++ b/drivers/media/dvb-frontends/tda10048.c +@@ -1138,7 +1138,7 @@ error: + kfree(state); + return NULL; + } +-EXPORT_SYMBOL(tda10048_attach); ++EXPORT_SYMBOL_GPL(tda10048_attach); + + static const struct dvb_frontend_ops tda10048_ops = { + .delsys = { SYS_DVBT }, +diff --git a/drivers/media/dvb-frontends/tda1004x.c b/drivers/media/dvb-frontends/tda1004x.c +index 83a798ca9b002..6f306db6c615f 100644 +--- a/drivers/media/dvb-frontends/tda1004x.c ++++ b/drivers/media/dvb-frontends/tda1004x.c +@@ -1378,5 +1378,5 @@ MODULE_DESCRIPTION("Philips TDA10045H & TDA10046H DVB-T Demodulator"); + MODULE_AUTHOR("Andrew de Quincey & Robert Schlabbach"); + MODULE_LICENSE("GPL"); + +-EXPORT_SYMBOL(tda10045_attach); +-EXPORT_SYMBOL(tda10046_attach); ++EXPORT_SYMBOL_GPL(tda10045_attach); ++EXPORT_SYMBOL_GPL(tda10046_attach); +diff --git a/drivers/media/dvb-frontends/tda10086.c b/drivers/media/dvb-frontends/tda10086.c +index be6b40138f6e0..3f51527c86b8a 100644 +--- a/drivers/media/dvb-frontends/tda10086.c ++++ b/drivers/media/dvb-frontends/tda10086.c +@@ -764,4 +764,4 @@ MODULE_DESCRIPTION("Philips TDA10086 DVB-S Demodulator"); + MODULE_AUTHOR("Andrew de Quincey"); + MODULE_LICENSE("GPL"); + +-EXPORT_SYMBOL(tda10086_attach); ++EXPORT_SYMBOL_GPL(tda10086_attach); +diff --git a/drivers/media/dvb-frontends/tda665x.c b/drivers/media/dvb-frontends/tda665x.c +index 13e8969da7f89..346be5011fb73 100644 +--- a/drivers/media/dvb-frontends/tda665x.c ++++ b/drivers/media/dvb-frontends/tda665x.c +@@ -227,7 +227,7 @@ struct dvb_frontend *tda665x_attach(struct dvb_frontend *fe, + + return fe; + } +-EXPORT_SYMBOL(tda665x_attach); ++EXPORT_SYMBOL_GPL(tda665x_attach); + + MODULE_DESCRIPTION("TDA665x driver"); + MODULE_AUTHOR("Manu Abraham"); +diff --git a/drivers/media/dvb-frontends/tda8083.c b/drivers/media/dvb-frontends/tda8083.c +index 5be11fd65e3b1..9fc16e917f342 100644 +--- a/drivers/media/dvb-frontends/tda8083.c ++++ b/drivers/media/dvb-frontends/tda8083.c +@@ -481,4 +481,4 @@ MODULE_DESCRIPTION("Philips TDA8083 DVB-S Demodulator"); + MODULE_AUTHOR("Ralph Metzler, Holger Waechtler"); + MODULE_LICENSE("GPL"); + +-EXPORT_SYMBOL(tda8083_attach); ++EXPORT_SYMBOL_GPL(tda8083_attach); +diff --git a/drivers/media/dvb-frontends/tda8261.c b/drivers/media/dvb-frontends/tda8261.c +index 0d576d41c67d8..8b06f92745dca 100644 +--- a/drivers/media/dvb-frontends/tda8261.c ++++ b/drivers/media/dvb-frontends/tda8261.c +@@ -188,7 +188,7 @@ exit: + return NULL; + } + +-EXPORT_SYMBOL(tda8261_attach); ++EXPORT_SYMBOL_GPL(tda8261_attach); + + MODULE_AUTHOR("Manu Abraham"); + MODULE_DESCRIPTION("TDA8261 8PSK/QPSK Tuner"); +diff --git a/drivers/media/dvb-frontends/tda826x.c b/drivers/media/dvb-frontends/tda826x.c +index f9703a1dd758c..eafcf5f7da3dc 100644 +--- a/drivers/media/dvb-frontends/tda826x.c ++++ b/drivers/media/dvb-frontends/tda826x.c +@@ -164,7 +164,7 @@ struct dvb_frontend *tda826x_attach(struct dvb_frontend *fe, int addr, struct i2 + + return fe; + } +-EXPORT_SYMBOL(tda826x_attach); ++EXPORT_SYMBOL_GPL(tda826x_attach); + + module_param(debug, int, 0644); + MODULE_PARM_DESC(debug, "Turn on/off frontend debugging (default:off)."); +diff --git a/drivers/media/dvb-frontends/ts2020.c b/drivers/media/dvb-frontends/ts2020.c +index 6c24d6d0d4c9d..06dedd42e7b19 100644 +--- a/drivers/media/dvb-frontends/ts2020.c ++++ b/drivers/media/dvb-frontends/ts2020.c +@@ -525,7 +525,7 @@ struct dvb_frontend *ts2020_attach(struct dvb_frontend *fe, + + return fe; + } +-EXPORT_SYMBOL(ts2020_attach); ++EXPORT_SYMBOL_GPL(ts2020_attach); + + /* + * We implement own regmap locking due to legacy DVB attach which uses frontend +diff --git a/drivers/media/dvb-frontends/tua6100.c b/drivers/media/dvb-frontends/tua6100.c +index 2483f614d0e7d..41dd9b6d31908 100644 +--- a/drivers/media/dvb-frontends/tua6100.c ++++ b/drivers/media/dvb-frontends/tua6100.c +@@ -186,7 +186,7 @@ struct dvb_frontend *tua6100_attach(struct dvb_frontend *fe, int addr, struct i2 + fe->tuner_priv = priv; + return fe; + } +-EXPORT_SYMBOL(tua6100_attach); ++EXPORT_SYMBOL_GPL(tua6100_attach); + + MODULE_DESCRIPTION("DVB tua6100 driver"); + MODULE_AUTHOR("Andrew de Quincey"); +diff --git a/drivers/media/dvb-frontends/ves1820.c b/drivers/media/dvb-frontends/ves1820.c +index 9df14d0be1c1a..ee5620e731e9b 100644 +--- a/drivers/media/dvb-frontends/ves1820.c ++++ b/drivers/media/dvb-frontends/ves1820.c +@@ -434,4 +434,4 @@ MODULE_DESCRIPTION("VLSI VES1820 DVB-C Demodulator driver"); + MODULE_AUTHOR("Ralph Metzler, Holger Waechtler"); + MODULE_LICENSE("GPL"); + +-EXPORT_SYMBOL(ves1820_attach); ++EXPORT_SYMBOL_GPL(ves1820_attach); +diff --git a/drivers/media/dvb-frontends/ves1x93.c b/drivers/media/dvb-frontends/ves1x93.c +index b747272863025..c60e21d26b881 100644 +--- a/drivers/media/dvb-frontends/ves1x93.c ++++ b/drivers/media/dvb-frontends/ves1x93.c +@@ -540,4 +540,4 @@ MODULE_DESCRIPTION("VLSI VES1x93 DVB-S Demodulator driver"); + MODULE_AUTHOR("Ralph Metzler"); + MODULE_LICENSE("GPL"); + +-EXPORT_SYMBOL(ves1x93_attach); ++EXPORT_SYMBOL_GPL(ves1x93_attach); +diff --git a/drivers/media/dvb-frontends/zl10036.c b/drivers/media/dvb-frontends/zl10036.c +index d392c7cce2ce0..7ba575e9c55f4 100644 +--- a/drivers/media/dvb-frontends/zl10036.c ++++ b/drivers/media/dvb-frontends/zl10036.c +@@ -496,7 +496,7 @@ error: + kfree(state); + return NULL; + } +-EXPORT_SYMBOL(zl10036_attach); ++EXPORT_SYMBOL_GPL(zl10036_attach); + + module_param_named(debug, zl10036_debug, int, 0644); + MODULE_PARM_DESC(debug, "Turn on/off frontend debugging (default:off)."); +diff --git a/drivers/media/dvb-frontends/zl10039.c b/drivers/media/dvb-frontends/zl10039.c +index 1335bf78d5b7f..a3e4d219400ce 100644 +--- a/drivers/media/dvb-frontends/zl10039.c ++++ b/drivers/media/dvb-frontends/zl10039.c +@@ -295,7 +295,7 @@ error: + kfree(state); + return NULL; + } +-EXPORT_SYMBOL(zl10039_attach); ++EXPORT_SYMBOL_GPL(zl10039_attach); + + module_param(debug, int, 0644); + MODULE_PARM_DESC(debug, "Turn on/off frontend debugging (default:off)."); +diff --git a/drivers/media/dvb-frontends/zl10353.c b/drivers/media/dvb-frontends/zl10353.c +index 2fc6aea580f90..a889d1cfe3f41 100644 +--- a/drivers/media/dvb-frontends/zl10353.c ++++ b/drivers/media/dvb-frontends/zl10353.c +@@ -665,4 +665,4 @@ MODULE_DESCRIPTION("Zarlink ZL10353 DVB-T demodulator driver"); + MODULE_AUTHOR("Chris Pascoe"); + MODULE_LICENSE("GPL"); + +-EXPORT_SYMBOL(zl10353_attach); ++EXPORT_SYMBOL_GPL(zl10353_attach); +diff --git a/drivers/media/i2c/ov2680.c b/drivers/media/i2c/ov2680.c +index 59cdbc33658ce..731a60f6a59af 100644 +--- a/drivers/media/i2c/ov2680.c ++++ b/drivers/media/i2c/ov2680.c +@@ -85,15 +85,8 @@ struct ov2680_mode_info { + + struct ov2680_ctrls { + struct v4l2_ctrl_handler handler; +- struct { +- struct v4l2_ctrl *auto_exp; +- struct v4l2_ctrl *exposure; +- }; +- struct { +- struct v4l2_ctrl *auto_gain; +- struct v4l2_ctrl *gain; +- }; +- ++ struct v4l2_ctrl *exposure; ++ struct v4l2_ctrl *gain; + struct v4l2_ctrl *hflip; + struct v4l2_ctrl *vflip; + struct v4l2_ctrl *test_pattern; +@@ -143,6 +136,7 @@ static const struct reg_value ov2680_setting_30fps_QUXGA_800_600[] = { + {0x380e, 0x02}, {0x380f, 0x84}, {0x3811, 0x04}, {0x3813, 0x04}, + {0x3814, 0x31}, {0x3815, 0x31}, {0x3820, 0xc0}, {0x4008, 0x00}, + {0x4009, 0x03}, {0x4837, 0x1e}, {0x3501, 0x4e}, {0x3502, 0xe0}, ++ {0x3503, 0x03}, + }; + + static const struct reg_value ov2680_setting_30fps_720P_1280_720[] = { +@@ -321,70 +315,49 @@ static void ov2680_power_down(struct ov2680_dev *sensor) + usleep_range(5000, 10000); + } + +-static int ov2680_bayer_order(struct ov2680_dev *sensor) ++static void ov2680_set_bayer_order(struct ov2680_dev *sensor) + { +- u32 format1; +- u32 format2; +- u32 hv_flip; +- int ret; +- +- ret = ov2680_read_reg(sensor, OV2680_REG_FORMAT1, &format1); +- if (ret < 0) +- return ret; ++ int hv_flip = 0; + +- ret = ov2680_read_reg(sensor, OV2680_REG_FORMAT2, &format2); +- if (ret < 0) +- return ret; ++ if (sensor->ctrls.vflip && sensor->ctrls.vflip->val) ++ hv_flip += 1; + +- hv_flip = (format2 & BIT(2) << 1) | (format1 & BIT(2)); ++ if (sensor->ctrls.hflip && sensor->ctrls.hflip->val) ++ hv_flip += 2; + + sensor->fmt.code = ov2680_hv_flip_bayer_order[hv_flip]; +- +- return 0; + } + +-static int ov2680_vflip_enable(struct ov2680_dev *sensor) ++static int ov2680_set_vflip(struct ov2680_dev *sensor, s32 val) + { + int ret; + +- ret = ov2680_mod_reg(sensor, OV2680_REG_FORMAT1, BIT(2), BIT(2)); +- if (ret < 0) +- return ret; +- +- return ov2680_bayer_order(sensor); +-} +- +-static int ov2680_vflip_disable(struct ov2680_dev *sensor) +-{ +- int ret; ++ if (sensor->is_streaming) ++ return -EBUSY; + +- ret = ov2680_mod_reg(sensor, OV2680_REG_FORMAT1, BIT(2), BIT(0)); ++ ret = ov2680_mod_reg(sensor, OV2680_REG_FORMAT1, ++ BIT(2), val ? BIT(2) : 0); + if (ret < 0) + return ret; + +- return ov2680_bayer_order(sensor); ++ ov2680_set_bayer_order(sensor); ++ return 0; + } + +-static int ov2680_hflip_enable(struct ov2680_dev *sensor) ++static int ov2680_set_hflip(struct ov2680_dev *sensor, s32 val) + { + int ret; + +- ret = ov2680_mod_reg(sensor, OV2680_REG_FORMAT2, BIT(2), BIT(2)); +- if (ret < 0) +- return ret; +- +- return ov2680_bayer_order(sensor); +-} +- +-static int ov2680_hflip_disable(struct ov2680_dev *sensor) +-{ +- int ret; ++ if (sensor->is_streaming) ++ return -EBUSY; + +- ret = ov2680_mod_reg(sensor, OV2680_REG_FORMAT2, BIT(2), BIT(0)); ++ ret = ov2680_mod_reg(sensor, OV2680_REG_FORMAT2, ++ BIT(2), val ? BIT(2) : 0); + if (ret < 0) + return ret; + +- return ov2680_bayer_order(sensor); ++ ov2680_set_bayer_order(sensor); ++ return 0; + } + + static int ov2680_test_pattern_set(struct ov2680_dev *sensor, int value) +@@ -405,69 +378,15 @@ static int ov2680_test_pattern_set(struct ov2680_dev *sensor, int value) + return 0; + } + +-static int ov2680_gain_set(struct ov2680_dev *sensor, bool auto_gain) ++static int ov2680_gain_set(struct ov2680_dev *sensor, u32 gain) + { +- struct ov2680_ctrls *ctrls = &sensor->ctrls; +- u32 gain; +- int ret; +- +- ret = ov2680_mod_reg(sensor, OV2680_REG_R_MANUAL, BIT(1), +- auto_gain ? 0 : BIT(1)); +- if (ret < 0) +- return ret; +- +- if (auto_gain || !ctrls->gain->is_new) +- return 0; +- +- gain = ctrls->gain->val; +- +- ret = ov2680_write_reg16(sensor, OV2680_REG_GAIN_PK, gain); +- +- return 0; ++ return ov2680_write_reg16(sensor, OV2680_REG_GAIN_PK, gain); + } + +-static int ov2680_gain_get(struct ov2680_dev *sensor) ++static int ov2680_exposure_set(struct ov2680_dev *sensor, u32 exp) + { +- u32 gain; +- int ret; +- +- ret = ov2680_read_reg16(sensor, OV2680_REG_GAIN_PK, &gain); +- if (ret) +- return ret; +- +- return gain; +-} +- +-static int ov2680_exposure_set(struct ov2680_dev *sensor, bool auto_exp) +-{ +- struct ov2680_ctrls *ctrls = &sensor->ctrls; +- u32 exp; +- int ret; +- +- ret = ov2680_mod_reg(sensor, OV2680_REG_R_MANUAL, BIT(0), +- auto_exp ? 0 : BIT(0)); +- if (ret < 0) +- return ret; +- +- if (auto_exp || !ctrls->exposure->is_new) +- return 0; +- +- exp = (u32)ctrls->exposure->val; +- exp <<= 4; +- +- return ov2680_write_reg24(sensor, OV2680_REG_EXPOSURE_PK_HIGH, exp); +-} +- +-static int ov2680_exposure_get(struct ov2680_dev *sensor) +-{ +- int ret; +- u32 exp; +- +- ret = ov2680_read_reg24(sensor, OV2680_REG_EXPOSURE_PK_HIGH, &exp); +- if (ret) +- return ret; +- +- return exp >> 4; ++ return ov2680_write_reg24(sensor, OV2680_REG_EXPOSURE_PK_HIGH, ++ exp << 4); + } + + static int ov2680_stream_enable(struct ov2680_dev *sensor) +@@ -482,33 +401,17 @@ static int ov2680_stream_disable(struct ov2680_dev *sensor) + + static int ov2680_mode_set(struct ov2680_dev *sensor) + { +- struct ov2680_ctrls *ctrls = &sensor->ctrls; + int ret; + +- ret = ov2680_gain_set(sensor, false); ++ ret = ov2680_load_regs(sensor, sensor->current_mode); + if (ret < 0) + return ret; + +- ret = ov2680_exposure_set(sensor, false); ++ /* Restore value of all ctrls */ ++ ret = __v4l2_ctrl_handler_setup(&sensor->ctrls.handler); + if (ret < 0) + return ret; + +- ret = ov2680_load_regs(sensor, sensor->current_mode); +- if (ret < 0) +- return ret; +- +- if (ctrls->auto_gain->val) { +- ret = ov2680_gain_set(sensor, true); +- if (ret < 0) +- return ret; +- } +- +- if (ctrls->auto_exp->val == V4L2_EXPOSURE_AUTO) { +- ret = ov2680_exposure_set(sensor, true); +- if (ret < 0) +- return ret; +- } +- + sensor->mode_pending_changes = false; + + return 0; +@@ -556,7 +459,7 @@ static int ov2680_power_on(struct ov2680_dev *sensor) + ret = ov2680_write_reg(sensor, OV2680_REG_SOFT_RESET, 0x01); + if (ret != 0) { + dev_err(dev, "sensor soft reset failed\n"); +- return ret; ++ goto err_disable_regulators; + } + usleep_range(1000, 2000); + } else { +@@ -566,7 +469,7 @@ static int ov2680_power_on(struct ov2680_dev *sensor) + + ret = clk_prepare_enable(sensor->xvclk); + if (ret < 0) +- return ret; ++ goto err_disable_regulators; + + sensor->is_enabled = true; + +@@ -576,6 +479,10 @@ static int ov2680_power_on(struct ov2680_dev *sensor) + ov2680_stream_disable(sensor); + + return 0; ++ ++err_disable_regulators: ++ regulator_bulk_disable(OV2680_NUM_SUPPLIES, sensor->supplies); ++ return ret; + } + + static int ov2680_s_power(struct v4l2_subdev *sd, int on) +@@ -590,15 +497,10 @@ static int ov2680_s_power(struct v4l2_subdev *sd, int on) + else + ret = ov2680_power_off(sensor); + +- mutex_unlock(&sensor->lock); +- +- if (on && ret == 0) { +- ret = v4l2_ctrl_handler_setup(&sensor->ctrls.handler); +- if (ret < 0) +- return ret; +- ++ if (on && ret == 0) + ret = ov2680_mode_restore(sensor); +- } ++ ++ mutex_unlock(&sensor->lock); + + return ret; + } +@@ -793,66 +695,23 @@ static int ov2680_enum_frame_interval(struct v4l2_subdev *sd, + return 0; + } + +-static int ov2680_g_volatile_ctrl(struct v4l2_ctrl *ctrl) +-{ +- struct v4l2_subdev *sd = ctrl_to_sd(ctrl); +- struct ov2680_dev *sensor = to_ov2680_dev(sd); +- struct ov2680_ctrls *ctrls = &sensor->ctrls; +- int val; +- +- if (!sensor->is_enabled) +- return 0; +- +- switch (ctrl->id) { +- case V4L2_CID_GAIN: +- val = ov2680_gain_get(sensor); +- if (val < 0) +- return val; +- ctrls->gain->val = val; +- break; +- case V4L2_CID_EXPOSURE: +- val = ov2680_exposure_get(sensor); +- if (val < 0) +- return val; +- ctrls->exposure->val = val; +- break; +- } +- +- return 0; +-} +- + static int ov2680_s_ctrl(struct v4l2_ctrl *ctrl) + { + struct v4l2_subdev *sd = ctrl_to_sd(ctrl); + struct ov2680_dev *sensor = to_ov2680_dev(sd); +- struct ov2680_ctrls *ctrls = &sensor->ctrls; + + if (!sensor->is_enabled) + return 0; + + switch (ctrl->id) { +- case V4L2_CID_AUTOGAIN: +- return ov2680_gain_set(sensor, !!ctrl->val); + case V4L2_CID_GAIN: +- return ov2680_gain_set(sensor, !!ctrls->auto_gain->val); +- case V4L2_CID_EXPOSURE_AUTO: +- return ov2680_exposure_set(sensor, !!ctrl->val); ++ return ov2680_gain_set(sensor, ctrl->val); + case V4L2_CID_EXPOSURE: +- return ov2680_exposure_set(sensor, !!ctrls->auto_exp->val); ++ return ov2680_exposure_set(sensor, ctrl->val); + case V4L2_CID_VFLIP: +- if (sensor->is_streaming) +- return -EBUSY; +- if (ctrl->val) +- return ov2680_vflip_enable(sensor); +- else +- return ov2680_vflip_disable(sensor); ++ return ov2680_set_vflip(sensor, ctrl->val); + case V4L2_CID_HFLIP: +- if (sensor->is_streaming) +- return -EBUSY; +- if (ctrl->val) +- return ov2680_hflip_enable(sensor); +- else +- return ov2680_hflip_disable(sensor); ++ return ov2680_set_hflip(sensor, ctrl->val); + case V4L2_CID_TEST_PATTERN: + return ov2680_test_pattern_set(sensor, ctrl->val); + default: +@@ -863,7 +722,6 @@ static int ov2680_s_ctrl(struct v4l2_ctrl *ctrl) + } + + static const struct v4l2_ctrl_ops ov2680_ctrl_ops = { +- .g_volatile_ctrl = ov2680_g_volatile_ctrl, + .s_ctrl = ov2680_s_ctrl, + }; + +@@ -935,7 +793,7 @@ static int ov2680_v4l2_register(struct ov2680_dev *sensor) + if (ret < 0) + return ret; + +- v4l2_ctrl_handler_init(hdl, 7); ++ v4l2_ctrl_handler_init(hdl, 5); + + hdl->lock = &sensor->lock; + +@@ -947,16 +805,9 @@ static int ov2680_v4l2_register(struct ov2680_dev *sensor) + ARRAY_SIZE(test_pattern_menu) - 1, + 0, 0, test_pattern_menu); + +- ctrls->auto_exp = v4l2_ctrl_new_std_menu(hdl, ops, +- V4L2_CID_EXPOSURE_AUTO, +- V4L2_EXPOSURE_MANUAL, 0, +- V4L2_EXPOSURE_AUTO); +- + ctrls->exposure = v4l2_ctrl_new_std(hdl, ops, V4L2_CID_EXPOSURE, + 0, 32767, 1, 0); + +- ctrls->auto_gain = v4l2_ctrl_new_std(hdl, ops, V4L2_CID_AUTOGAIN, +- 0, 1, 1, 1); + ctrls->gain = v4l2_ctrl_new_std(hdl, ops, V4L2_CID_GAIN, 0, 2047, 1, 0); + + if (hdl->error) { +@@ -964,11 +815,8 @@ static int ov2680_v4l2_register(struct ov2680_dev *sensor) + goto cleanup_entity; + } + +- ctrls->gain->flags |= V4L2_CTRL_FLAG_VOLATILE; +- ctrls->exposure->flags |= V4L2_CTRL_FLAG_VOLATILE; +- +- v4l2_ctrl_auto_cluster(2, &ctrls->auto_gain, 0, true); +- v4l2_ctrl_auto_cluster(2, &ctrls->auto_exp, 1, true); ++ ctrls->vflip->flags |= V4L2_CTRL_FLAG_MODIFY_LAYOUT; ++ ctrls->hflip->flags |= V4L2_CTRL_FLAG_MODIFY_LAYOUT; + + sensor->sd.ctrl_handler = hdl; + +diff --git a/drivers/media/i2c/ov5640.c b/drivers/media/i2c/ov5640.c +index 087fb464ffc12..2e5a49e87a74c 100644 +--- a/drivers/media/i2c/ov5640.c ++++ b/drivers/media/i2c/ov5640.c +@@ -1206,71 +1206,6 @@ static int ov5640_set_autogain(struct ov5640_dev *sensor, bool on) + + static int ov5640_set_stream_dvp(struct ov5640_dev *sensor, bool on) + { +- int ret; +- unsigned int flags = sensor->ep.bus.parallel.flags; +- u8 pclk_pol = 0; +- u8 hsync_pol = 0; +- u8 vsync_pol = 0; +- +- /* +- * Note about parallel port configuration. +- * +- * When configured in parallel mode, the OV5640 will +- * output 10 bits data on DVP data lines [9:0]. +- * If only 8 bits data are wanted, the 8 bits data lines +- * of the camera interface must be physically connected +- * on the DVP data lines [9:2]. +- * +- * Control lines polarity can be configured through +- * devicetree endpoint control lines properties. +- * If no endpoint control lines properties are set, +- * polarity will be as below: +- * - VSYNC: active high +- * - HREF: active low +- * - PCLK: active low +- */ +- +- if (on) { +- /* +- * configure parallel port control lines polarity +- * +- * POLARITY CTRL0 +- * - [5]: PCLK polarity (0: active low, 1: active high) +- * - [1]: HREF polarity (0: active low, 1: active high) +- * - [0]: VSYNC polarity (mismatch here between +- * datasheet and hardware, 0 is active high +- * and 1 is active low...) +- */ +- if (flags & V4L2_MBUS_PCLK_SAMPLE_RISING) +- pclk_pol = 1; +- if (flags & V4L2_MBUS_HSYNC_ACTIVE_HIGH) +- hsync_pol = 1; +- if (flags & V4L2_MBUS_VSYNC_ACTIVE_LOW) +- vsync_pol = 1; +- +- ret = ov5640_write_reg(sensor, +- OV5640_REG_POLARITY_CTRL00, +- (pclk_pol << 5) | +- (hsync_pol << 1) | +- vsync_pol); +- +- if (ret) +- return ret; +- } +- +- /* +- * powerdown MIPI TX/RX PHY & disable MIPI +- * +- * MIPI CONTROL 00 +- * 4: PWDN PHY TX +- * 3: PWDN PHY RX +- * 2: MIPI enable +- */ +- ret = ov5640_write_reg(sensor, +- OV5640_REG_IO_MIPI_CTRL00, on ? 0x18 : 0); +- if (ret) +- return ret; +- + return ov5640_write_reg(sensor, OV5640_REG_SYS_CTRL0, on ? + OV5640_REG_SYS_CTRL0_SW_PWUP : + OV5640_REG_SYS_CTRL0_SW_PWDN); +@@ -1992,9 +1927,9 @@ static int ov5640_set_power_mipi(struct ov5640_dev *sensor, bool on) + * "ov5640_set_stream_mipi()") + * [4] = 0 : Power up MIPI HS Tx + * [3] = 0 : Power up MIPI LS Rx +- * [2] = 0 : MIPI interface disabled ++ * [2] = 1 : MIPI interface enabled + */ +- ret = ov5640_write_reg(sensor, OV5640_REG_IO_MIPI_CTRL00, 0x40); ++ ret = ov5640_write_reg(sensor, OV5640_REG_IO_MIPI_CTRL00, 0x44); + if (ret) + return ret; + +@@ -2029,15 +1964,73 @@ static int ov5640_set_power_mipi(struct ov5640_dev *sensor, bool on) + + static int ov5640_set_power_dvp(struct ov5640_dev *sensor, bool on) + { ++ unsigned int flags = sensor->ep.bus.parallel.flags; ++ u8 pclk_pol = 0; ++ u8 hsync_pol = 0; ++ u8 vsync_pol = 0; + int ret; + + if (!on) { + /* Reset settings to their default values. */ ++ ov5640_write_reg(sensor, OV5640_REG_IO_MIPI_CTRL00, 0x58); ++ ov5640_write_reg(sensor, OV5640_REG_POLARITY_CTRL00, 0x20); + ov5640_write_reg(sensor, OV5640_REG_PAD_OUTPUT_ENABLE01, 0x00); + ov5640_write_reg(sensor, OV5640_REG_PAD_OUTPUT_ENABLE02, 0x00); + return 0; + } + ++ /* ++ * Note about parallel port configuration. ++ * ++ * When configured in parallel mode, the OV5640 will ++ * output 10 bits data on DVP data lines [9:0]. ++ * If only 8 bits data are wanted, the 8 bits data lines ++ * of the camera interface must be physically connected ++ * on the DVP data lines [9:2]. ++ * ++ * Control lines polarity can be configured through ++ * devicetree endpoint control lines properties. ++ * If no endpoint control lines properties are set, ++ * polarity will be as below: ++ * - VSYNC: active high ++ * - HREF: active low ++ * - PCLK: active low ++ */ ++ /* ++ * configure parallel port control lines polarity ++ * ++ * POLARITY CTRL0 ++ * - [5]: PCLK polarity (0: active low, 1: active high) ++ * - [1]: HREF polarity (0: active low, 1: active high) ++ * - [0]: VSYNC polarity (mismatch here between ++ * datasheet and hardware, 0 is active high ++ * and 1 is active low...) ++ */ ++ if (flags & V4L2_MBUS_PCLK_SAMPLE_RISING) ++ pclk_pol = 1; ++ if (flags & V4L2_MBUS_HSYNC_ACTIVE_HIGH) ++ hsync_pol = 1; ++ if (flags & V4L2_MBUS_VSYNC_ACTIVE_LOW) ++ vsync_pol = 1; ++ ++ ret = ov5640_write_reg(sensor, OV5640_REG_POLARITY_CTRL00, ++ (pclk_pol << 5) | (hsync_pol << 1) | vsync_pol); ++ ++ if (ret) ++ return ret; ++ ++ /* ++ * powerdown MIPI TX/RX PHY & disable MIPI ++ * ++ * MIPI CONTROL 00 ++ * 4: PWDN PHY TX ++ * 3: PWDN PHY RX ++ * 2: MIPI enable ++ */ ++ ret = ov5640_write_reg(sensor, OV5640_REG_IO_MIPI_CTRL00, 0x18); ++ if (ret) ++ return ret; ++ + /* + * enable VSYNC/HREF/PCLK DVP control lines + * & D[9:6] DVP data lines +diff --git a/drivers/media/pci/bt8xx/dst.c b/drivers/media/pci/bt8xx/dst.c +index 3e52a51982d76..110651e478314 100644 +--- a/drivers/media/pci/bt8xx/dst.c ++++ b/drivers/media/pci/bt8xx/dst.c +@@ -1722,7 +1722,7 @@ struct dst_state *dst_attach(struct dst_state *state, struct dvb_adapter *dvb_ad + return state; /* Manu (DST is a card not a frontend) */ + } + +-EXPORT_SYMBOL(dst_attach); ++EXPORT_SYMBOL_GPL(dst_attach); + + static const struct dvb_frontend_ops dst_dvbt_ops = { + .delsys = { SYS_DVBT }, +diff --git a/drivers/media/pci/bt8xx/dst_ca.c b/drivers/media/pci/bt8xx/dst_ca.c +index 85fcdc59f0d18..571392d80ccc6 100644 +--- a/drivers/media/pci/bt8xx/dst_ca.c ++++ b/drivers/media/pci/bt8xx/dst_ca.c +@@ -668,7 +668,7 @@ struct dvb_device *dst_ca_attach(struct dst_state *dst, struct dvb_adapter *dvb_ + return NULL; + } + +-EXPORT_SYMBOL(dst_ca_attach); ++EXPORT_SYMBOL_GPL(dst_ca_attach); + + MODULE_DESCRIPTION("DST DVB-S/T/C Combo CA driver"); + MODULE_AUTHOR("Manu Abraham"); +diff --git a/drivers/media/pci/cx23885/cx23885-video.c b/drivers/media/pci/cx23885/cx23885-video.c +index 7fc408ee4934f..f56b271db8bea 100644 +--- a/drivers/media/pci/cx23885/cx23885-video.c ++++ b/drivers/media/pci/cx23885/cx23885-video.c +@@ -409,7 +409,7 @@ static int buffer_prepare(struct vb2_buffer *vb) + dev->height >> 1); + break; + default: +- BUG(); ++ return -EINVAL; /* should not happen */ + } + dprintk(2, "[%p/%d] buffer_init - %dx%d %dbpp 0x%08x - dma=0x%08lx\n", + buf, buf->vb.vb2_buf.index, +diff --git a/drivers/media/pci/intel/ipu3/ipu3-cio2.c b/drivers/media/pci/intel/ipu3/ipu3-cio2.c +index 3457f0f545c48..9c0d117e093b1 100644 +--- a/drivers/media/pci/intel/ipu3/ipu3-cio2.c ++++ b/drivers/media/pci/intel/ipu3/ipu3-cio2.c +@@ -359,7 +359,7 @@ static int cio2_hw_init(struct cio2_device *cio2, struct cio2_queue *q) + void __iomem *const base = cio2->base; + u8 lanes, csi2bus = q->csi2.port; + u8 sensor_vc = SENSOR_VIR_CH_DFLT; +- struct cio2_csi2_timing timing; ++ struct cio2_csi2_timing timing = { 0 }; + int i, r; + + fmt = cio2_find_format(NULL, &q->subdev_fmt.code); +diff --git a/drivers/media/platform/mtk-vcodec/vdec/vdec_vp9_if.c b/drivers/media/platform/mtk-vcodec/vdec/vdec_vp9_if.c +index 5066c283d86d1..2fd7d913fd640 100644 +--- a/drivers/media/platform/mtk-vcodec/vdec/vdec_vp9_if.c ++++ b/drivers/media/platform/mtk-vcodec/vdec/vdec_vp9_if.c +@@ -222,10 +222,11 @@ static struct vdec_fb *vp9_rm_from_fb_use_list(struct vdec_vp9_inst + if (fb->base_y.va == addr) { + list_move_tail(&node->list, + &inst->available_fb_node_list); +- break; ++ return fb; + } + } +- return fb; ++ ++ return NULL; + } + + static void vp9_add_to_fb_free_list(struct vdec_vp9_inst *inst, +diff --git a/drivers/media/tuners/fc0011.c b/drivers/media/tuners/fc0011.c +index b7b5b33b11f4e..4df06d40503f8 100644 +--- a/drivers/media/tuners/fc0011.c ++++ b/drivers/media/tuners/fc0011.c +@@ -499,7 +499,7 @@ struct dvb_frontend *fc0011_attach(struct dvb_frontend *fe, + + return fe; + } +-EXPORT_SYMBOL(fc0011_attach); ++EXPORT_SYMBOL_GPL(fc0011_attach); + + MODULE_DESCRIPTION("Fitipower FC0011 silicon tuner driver"); + MODULE_AUTHOR("Michael Buesch <m@bues.ch>"); +diff --git a/drivers/media/tuners/fc0012.c b/drivers/media/tuners/fc0012.c +index 4429d5e8c5796..81e65acbdb170 100644 +--- a/drivers/media/tuners/fc0012.c ++++ b/drivers/media/tuners/fc0012.c +@@ -495,7 +495,7 @@ err: + + return fe; + } +-EXPORT_SYMBOL(fc0012_attach); ++EXPORT_SYMBOL_GPL(fc0012_attach); + + MODULE_DESCRIPTION("Fitipower FC0012 silicon tuner driver"); + MODULE_AUTHOR("Hans-Frieder Vogt <hfvogt@gmx.net>"); +diff --git a/drivers/media/tuners/fc0013.c b/drivers/media/tuners/fc0013.c +index 29dd9b55ff333..1006a2798eefc 100644 +--- a/drivers/media/tuners/fc0013.c ++++ b/drivers/media/tuners/fc0013.c +@@ -608,7 +608,7 @@ struct dvb_frontend *fc0013_attach(struct dvb_frontend *fe, + + return fe; + } +-EXPORT_SYMBOL(fc0013_attach); ++EXPORT_SYMBOL_GPL(fc0013_attach); + + MODULE_DESCRIPTION("Fitipower FC0013 silicon tuner driver"); + MODULE_AUTHOR("Hans-Frieder Vogt <hfvogt@gmx.net>"); +diff --git a/drivers/media/tuners/max2165.c b/drivers/media/tuners/max2165.c +index 1c746bed51fee..1575ab94e1c8b 100644 +--- a/drivers/media/tuners/max2165.c ++++ b/drivers/media/tuners/max2165.c +@@ -410,7 +410,7 @@ struct dvb_frontend *max2165_attach(struct dvb_frontend *fe, + + return fe; + } +-EXPORT_SYMBOL(max2165_attach); ++EXPORT_SYMBOL_GPL(max2165_attach); + + MODULE_AUTHOR("David T. L. Wong <davidtlwong@gmail.com>"); + MODULE_DESCRIPTION("Maxim MAX2165 silicon tuner driver"); +diff --git a/drivers/media/tuners/mc44s803.c b/drivers/media/tuners/mc44s803.c +index 0c9161516abdf..ed8bdf7ebd99d 100644 +--- a/drivers/media/tuners/mc44s803.c ++++ b/drivers/media/tuners/mc44s803.c +@@ -356,7 +356,7 @@ error: + kfree(priv); + return NULL; + } +-EXPORT_SYMBOL(mc44s803_attach); ++EXPORT_SYMBOL_GPL(mc44s803_attach); + + MODULE_AUTHOR("Jochen Friedrich"); + MODULE_DESCRIPTION("Freescale MC44S803 silicon tuner driver"); +diff --git a/drivers/media/tuners/mt2060.c b/drivers/media/tuners/mt2060.c +index 0e7ac2b49990f..b59c5ba2ee58e 100644 +--- a/drivers/media/tuners/mt2060.c ++++ b/drivers/media/tuners/mt2060.c +@@ -440,7 +440,7 @@ struct dvb_frontend * mt2060_attach(struct dvb_frontend *fe, struct i2c_adapter + + return fe; + } +-EXPORT_SYMBOL(mt2060_attach); ++EXPORT_SYMBOL_GPL(mt2060_attach); + + static int mt2060_probe(struct i2c_client *client, + const struct i2c_device_id *id) +diff --git a/drivers/media/tuners/mt2131.c b/drivers/media/tuners/mt2131.c +index 37f50ff6c0bd2..eebc060883414 100644 +--- a/drivers/media/tuners/mt2131.c ++++ b/drivers/media/tuners/mt2131.c +@@ -274,7 +274,7 @@ struct dvb_frontend * mt2131_attach(struct dvb_frontend *fe, + fe->tuner_priv = priv; + return fe; + } +-EXPORT_SYMBOL(mt2131_attach); ++EXPORT_SYMBOL_GPL(mt2131_attach); + + MODULE_AUTHOR("Steven Toth"); + MODULE_DESCRIPTION("Microtune MT2131 silicon tuner driver"); +diff --git a/drivers/media/tuners/mt2266.c b/drivers/media/tuners/mt2266.c +index 6136f20fa9b7f..2e92885a6bcb9 100644 +--- a/drivers/media/tuners/mt2266.c ++++ b/drivers/media/tuners/mt2266.c +@@ -336,7 +336,7 @@ struct dvb_frontend * mt2266_attach(struct dvb_frontend *fe, struct i2c_adapter + mt2266_calibrate(priv); + return fe; + } +-EXPORT_SYMBOL(mt2266_attach); ++EXPORT_SYMBOL_GPL(mt2266_attach); + + MODULE_AUTHOR("Olivier DANET"); + MODULE_DESCRIPTION("Microtune MT2266 silicon tuner driver"); +diff --git a/drivers/media/tuners/mxl5005s.c b/drivers/media/tuners/mxl5005s.c +index 1c07e2225fb39..cae6ded10b122 100644 +--- a/drivers/media/tuners/mxl5005s.c ++++ b/drivers/media/tuners/mxl5005s.c +@@ -4114,7 +4114,7 @@ struct dvb_frontend *mxl5005s_attach(struct dvb_frontend *fe, + fe->tuner_priv = state; + return fe; + } +-EXPORT_SYMBOL(mxl5005s_attach); ++EXPORT_SYMBOL_GPL(mxl5005s_attach); + + MODULE_DESCRIPTION("MaxLinear MXL5005S silicon tuner driver"); + MODULE_AUTHOR("Steven Toth"); +diff --git a/drivers/media/tuners/qt1010.c b/drivers/media/tuners/qt1010.c +index e48faf942830c..f7516cb52436e 100644 +--- a/drivers/media/tuners/qt1010.c ++++ b/drivers/media/tuners/qt1010.c +@@ -342,11 +342,12 @@ static int qt1010_init(struct dvb_frontend *fe) + else + valptr = &tmpval; + +- BUG_ON(i >= ARRAY_SIZE(i2c_data) - 1); +- +- err = qt1010_init_meas1(priv, i2c_data[i+1].reg, +- i2c_data[i].reg, +- i2c_data[i].val, valptr); ++ if (i >= ARRAY_SIZE(i2c_data) - 1) ++ err = -EIO; ++ else ++ err = qt1010_init_meas1(priv, i2c_data[i + 1].reg, ++ i2c_data[i].reg, ++ i2c_data[i].val, valptr); + i++; + break; + } +@@ -437,7 +438,7 @@ struct dvb_frontend * qt1010_attach(struct dvb_frontend *fe, + fe->tuner_priv = priv; + return fe; + } +-EXPORT_SYMBOL(qt1010_attach); ++EXPORT_SYMBOL_GPL(qt1010_attach); + + MODULE_DESCRIPTION("Quantek QT1010 silicon tuner driver"); + MODULE_AUTHOR("Antti Palosaari <crope@iki.fi>"); +diff --git a/drivers/media/tuners/tda18218.c b/drivers/media/tuners/tda18218.c +index 4ed94646116fa..7d8d84dcb2459 100644 +--- a/drivers/media/tuners/tda18218.c ++++ b/drivers/media/tuners/tda18218.c +@@ -336,7 +336,7 @@ struct dvb_frontend *tda18218_attach(struct dvb_frontend *fe, + + return fe; + } +-EXPORT_SYMBOL(tda18218_attach); ++EXPORT_SYMBOL_GPL(tda18218_attach); + + MODULE_DESCRIPTION("NXP TDA18218HN silicon tuner driver"); + MODULE_AUTHOR("Antti Palosaari <crope@iki.fi>"); +diff --git a/drivers/media/tuners/xc4000.c b/drivers/media/tuners/xc4000.c +index d9606738ce432..ef9af052007cb 100644 +--- a/drivers/media/tuners/xc4000.c ++++ b/drivers/media/tuners/xc4000.c +@@ -1744,7 +1744,7 @@ fail2: + xc4000_release(fe); + return NULL; + } +-EXPORT_SYMBOL(xc4000_attach); ++EXPORT_SYMBOL_GPL(xc4000_attach); + + MODULE_AUTHOR("Steven Toth, Davide Ferri"); + MODULE_DESCRIPTION("Xceive xc4000 silicon tuner driver"); +diff --git a/drivers/media/tuners/xc5000.c b/drivers/media/tuners/xc5000.c +index 734a92caad8d0..65b8863385575 100644 +--- a/drivers/media/tuners/xc5000.c ++++ b/drivers/media/tuners/xc5000.c +@@ -1460,7 +1460,7 @@ fail: + xc5000_release(fe); + return NULL; + } +-EXPORT_SYMBOL(xc5000_attach); ++EXPORT_SYMBOL_GPL(xc5000_attach); + + MODULE_AUTHOR("Steven Toth"); + MODULE_DESCRIPTION("Xceive xc5000 silicon tuner driver"); +diff --git a/drivers/media/usb/dvb-usb-v2/af9035.c b/drivers/media/usb/dvb-usb-v2/af9035.c +index 3afd18733614a..66dd1bdf6440a 100644 +--- a/drivers/media/usb/dvb-usb-v2/af9035.c ++++ b/drivers/media/usb/dvb-usb-v2/af9035.c +@@ -269,6 +269,7 @@ static int af9035_i2c_master_xfer(struct i2c_adapter *adap, + struct dvb_usb_device *d = i2c_get_adapdata(adap); + struct state *state = d_to_priv(d); + int ret; ++ u32 reg; + + if (mutex_lock_interruptible(&d->i2c_mutex) < 0) + return -EAGAIN; +@@ -321,8 +322,10 @@ static int af9035_i2c_master_xfer(struct i2c_adapter *adap, + ret = -EOPNOTSUPP; + } else if ((msg[0].addr == state->af9033_i2c_addr[0]) || + (msg[0].addr == state->af9033_i2c_addr[1])) { ++ if (msg[0].len < 3 || msg[1].len < 1) ++ return -EOPNOTSUPP; + /* demod access via firmware interface */ +- u32 reg = msg[0].buf[0] << 16 | msg[0].buf[1] << 8 | ++ reg = msg[0].buf[0] << 16 | msg[0].buf[1] << 8 | + msg[0].buf[2]; + + if (msg[0].addr == state->af9033_i2c_addr[1]) +@@ -380,17 +383,16 @@ static int af9035_i2c_master_xfer(struct i2c_adapter *adap, + ret = -EOPNOTSUPP; + } else if ((msg[0].addr == state->af9033_i2c_addr[0]) || + (msg[0].addr == state->af9033_i2c_addr[1])) { ++ if (msg[0].len < 3) ++ return -EOPNOTSUPP; + /* demod access via firmware interface */ +- u32 reg = msg[0].buf[0] << 16 | msg[0].buf[1] << 8 | ++ reg = msg[0].buf[0] << 16 | msg[0].buf[1] << 8 | + msg[0].buf[2]; + + if (msg[0].addr == state->af9033_i2c_addr[1]) + reg |= 0x100000; + +- ret = (msg[0].len >= 3) ? af9035_wr_regs(d, reg, +- &msg[0].buf[3], +- msg[0].len - 3) +- : -EOPNOTSUPP; ++ ret = af9035_wr_regs(d, reg, &msg[0].buf[3], msg[0].len - 3); + } else { + /* I2C write */ + u8 buf[MAX_XFER_SIZE]; +diff --git a/drivers/media/usb/dvb-usb-v2/anysee.c b/drivers/media/usb/dvb-usb-v2/anysee.c +index fb6d99dea31aa..08fdb9e5e3a22 100644 +--- a/drivers/media/usb/dvb-usb-v2/anysee.c ++++ b/drivers/media/usb/dvb-usb-v2/anysee.c +@@ -202,7 +202,7 @@ static int anysee_master_xfer(struct i2c_adapter *adap, struct i2c_msg *msg, + + while (i < num) { + if (num > i + 1 && (msg[i+1].flags & I2C_M_RD)) { +- if (msg[i].len > 2 || msg[i+1].len > 60) { ++ if (msg[i].len != 2 || msg[i + 1].len > 60) { + ret = -EOPNOTSUPP; + break; + } +diff --git a/drivers/media/usb/dvb-usb-v2/az6007.c b/drivers/media/usb/dvb-usb-v2/az6007.c +index 7524c90f5da61..6cbfe75791c21 100644 +--- a/drivers/media/usb/dvb-usb-v2/az6007.c ++++ b/drivers/media/usb/dvb-usb-v2/az6007.c +@@ -788,6 +788,10 @@ static int az6007_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[], + if (az6007_xfer_debug) + printk(KERN_DEBUG "az6007: I2C W addr=0x%x len=%d\n", + addr, msgs[i].len); ++ if (msgs[i].len < 1) { ++ ret = -EIO; ++ goto err; ++ } + req = AZ6007_I2C_WR; + index = msgs[i].buf[0]; + value = addr | (1 << 8); +@@ -802,6 +806,10 @@ static int az6007_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[], + if (az6007_xfer_debug) + printk(KERN_DEBUG "az6007: I2C R addr=0x%x len=%d\n", + addr, msgs[i].len); ++ if (msgs[i].len < 1) { ++ ret = -EIO; ++ goto err; ++ } + req = AZ6007_I2C_RD; + index = msgs[i].buf[0]; + value = addr; +diff --git a/drivers/media/usb/dvb-usb/af9005.c b/drivers/media/usb/dvb-usb/af9005.c +index 89b4b5d84cdff..827f9db16aa10 100644 +--- a/drivers/media/usb/dvb-usb/af9005.c ++++ b/drivers/media/usb/dvb-usb/af9005.c +@@ -422,6 +422,10 @@ static int af9005_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], + if (ret == 0) + ret = 2; + } else { ++ if (msg[0].len < 2) { ++ ret = -EOPNOTSUPP; ++ goto unlock; ++ } + /* write one or more registers */ + reg = msg[0].buf[0]; + addr = msg[0].addr; +@@ -431,6 +435,7 @@ static int af9005_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], + ret = 1; + } + ++unlock: + mutex_unlock(&d->i2c_mutex); + return ret; + } +diff --git a/drivers/media/usb/dvb-usb/dw2102.c b/drivers/media/usb/dvb-usb/dw2102.c +index f8f589ebab74b..924a6478007a8 100644 +--- a/drivers/media/usb/dvb-usb/dw2102.c ++++ b/drivers/media/usb/dvb-usb/dw2102.c +@@ -128,6 +128,10 @@ static int dw2102_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[], + + switch (num) { + case 2: ++ if (msg[0].len < 1) { ++ num = -EOPNOTSUPP; ++ break; ++ } + /* read stv0299 register */ + value = msg[0].buf[0];/* register */ + for (i = 0; i < msg[1].len; i++) { +@@ -139,6 +143,10 @@ static int dw2102_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[], + case 1: + switch (msg[0].addr) { + case 0x68: ++ if (msg[0].len < 2) { ++ num = -EOPNOTSUPP; ++ break; ++ } + /* write to stv0299 register */ + buf6[0] = 0x2a; + buf6[1] = msg[0].buf[0]; +@@ -148,6 +156,10 @@ static int dw2102_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[], + break; + case 0x60: + if (msg[0].flags == 0) { ++ if (msg[0].len < 4) { ++ num = -EOPNOTSUPP; ++ break; ++ } + /* write to tuner pll */ + buf6[0] = 0x2c; + buf6[1] = 5; +@@ -159,6 +171,10 @@ static int dw2102_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[], + dw210x_op_rw(d->udev, 0xb2, 0, 0, + buf6, 7, DW210X_WRITE_MSG); + } else { ++ if (msg[0].len < 1) { ++ num = -EOPNOTSUPP; ++ break; ++ } + /* read from tuner */ + dw210x_op_rw(d->udev, 0xb5, 0, 0, + buf6, 1, DW210X_READ_MSG); +@@ -166,12 +182,20 @@ static int dw2102_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[], + } + break; + case (DW2102_RC_QUERY): ++ if (msg[0].len < 2) { ++ num = -EOPNOTSUPP; ++ break; ++ } + dw210x_op_rw(d->udev, 0xb8, 0, 0, + buf6, 2, DW210X_READ_MSG); + msg[0].buf[0] = buf6[0]; + msg[0].buf[1] = buf6[1]; + break; + case (DW2102_VOLTAGE_CTRL): ++ if (msg[0].len < 1) { ++ num = -EOPNOTSUPP; ++ break; ++ } + buf6[0] = 0x30; + buf6[1] = msg[0].buf[0]; + dw210x_op_rw(d->udev, 0xb2, 0, 0, +diff --git a/drivers/media/usb/dvb-usb/m920x.c b/drivers/media/usb/dvb-usb/m920x.c +index 7282f60226558..8b19ae67f1879 100644 +--- a/drivers/media/usb/dvb-usb/m920x.c ++++ b/drivers/media/usb/dvb-usb/m920x.c +@@ -277,7 +277,6 @@ static int m920x_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], int nu + char *read = kmalloc(1, GFP_KERNEL); + if (!read) { + ret = -ENOMEM; +- kfree(read); + goto unlock; + } + +@@ -288,8 +287,10 @@ static int m920x_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], int nu + + if ((ret = m920x_read(d->udev, M9206_I2C, 0x0, + 0x20 | stop, +- read, 1)) != 0) ++ read, 1)) != 0) { ++ kfree(read); + goto unlock; ++ } + msg[i].buf[j] = read[0]; + } + +diff --git a/drivers/media/usb/go7007/go7007-i2c.c b/drivers/media/usb/go7007/go7007-i2c.c +index 38339dd2f83f7..2880370e45c8b 100644 +--- a/drivers/media/usb/go7007/go7007-i2c.c ++++ b/drivers/media/usb/go7007/go7007-i2c.c +@@ -165,8 +165,6 @@ static int go7007_i2c_master_xfer(struct i2c_adapter *adapter, + } else if (msgs[i].len == 3) { + if (msgs[i].flags & I2C_M_RD) + return -EIO; +- if (msgs[i].len != 3) +- return -EIO; + if (go7007_i2c_xfer(go, msgs[i].addr, 0, + (msgs[i].buf[0] << 8) | msgs[i].buf[1], + 0x01, &msgs[i].buf[2]) < 0) +diff --git a/drivers/media/usb/siano/smsusb.c b/drivers/media/usb/siano/smsusb.c +index 0358cd1043877..598ad05f5beac 100644 +--- a/drivers/media/usb/siano/smsusb.c ++++ b/drivers/media/usb/siano/smsusb.c +@@ -455,12 +455,7 @@ static int smsusb_init_device(struct usb_interface *intf, int board_id) + rc = smscore_register_device(¶ms, &dev->coredev, 0, mdev); + if (rc < 0) { + pr_err("smscore_register_device(...) failed, rc %d\n", rc); +- smsusb_term_device(intf); +-#ifdef CONFIG_MEDIA_CONTROLLER_DVB +- media_device_unregister(mdev); +-#endif +- kfree(mdev); +- return rc; ++ goto err_unregister_device; + } + + smscore_set_board_id(dev->coredev, board_id); +@@ -477,8 +472,7 @@ static int smsusb_init_device(struct usb_interface *intf, int board_id) + rc = smsusb_start_streaming(dev); + if (rc < 0) { + pr_err("smsusb_start_streaming(...) failed\n"); +- smsusb_term_device(intf); +- return rc; ++ goto err_unregister_device; + } + + dev->state = SMSUSB_ACTIVE; +@@ -486,13 +480,20 @@ static int smsusb_init_device(struct usb_interface *intf, int board_id) + rc = smscore_start_device(dev->coredev); + if (rc < 0) { + pr_err("smscore_start_device(...) failed\n"); +- smsusb_term_device(intf); +- return rc; ++ goto err_unregister_device; + } + + pr_debug("device 0x%p created\n", dev); + + return rc; ++ ++err_unregister_device: ++ smsusb_term_device(intf); ++#ifdef CONFIG_MEDIA_CONTROLLER_DVB ++ media_device_unregister(mdev); ++#endif ++ kfree(mdev); ++ return rc; + } + + static int smsusb_probe(struct usb_interface *intf, +diff --git a/drivers/media/v4l2-core/v4l2-fwnode.c b/drivers/media/v4l2-core/v4l2-fwnode.c +index 48c3b9f72722a..00d66495b47d7 100644 +--- a/drivers/media/v4l2-core/v4l2-fwnode.c ++++ b/drivers/media/v4l2-core/v4l2-fwnode.c +@@ -560,35 +560,38 @@ int v4l2_fwnode_endpoint_alloc_parse(struct fwnode_handle *fwnode, + } + EXPORT_SYMBOL_GPL(v4l2_fwnode_endpoint_alloc_parse); + +-int v4l2_fwnode_parse_link(struct fwnode_handle *__fwnode, ++int v4l2_fwnode_parse_link(struct fwnode_handle *fwnode, + struct v4l2_fwnode_link *link) + { +- const char *port_prop = is_of_node(__fwnode) ? "reg" : "port"; +- struct fwnode_handle *fwnode; ++ struct fwnode_endpoint fwep; + + memset(link, 0, sizeof(*link)); + +- fwnode = fwnode_get_parent(__fwnode); +- fwnode_property_read_u32(fwnode, port_prop, &link->local_port); +- fwnode = fwnode_get_next_parent(fwnode); +- if (is_of_node(fwnode) && of_node_name_eq(to_of_node(fwnode), "ports")) +- fwnode = fwnode_get_next_parent(fwnode); +- link->local_node = fwnode; +- +- fwnode = fwnode_graph_get_remote_endpoint(__fwnode); +- if (!fwnode) { +- fwnode_handle_put(fwnode); ++ fwnode_graph_parse_endpoint(fwnode, &fwep); ++ link->local_port = fwep.port; ++ link->local_node = fwnode_graph_get_port_parent(fwnode); ++ if (!link->local_node) + return -ENOLINK; +- } + +- fwnode = fwnode_get_parent(fwnode); +- fwnode_property_read_u32(fwnode, port_prop, &link->remote_port); +- fwnode = fwnode_get_next_parent(fwnode); +- if (is_of_node(fwnode) && of_node_name_eq(to_of_node(fwnode), "ports")) +- fwnode = fwnode_get_next_parent(fwnode); +- link->remote_node = fwnode; ++ fwnode = fwnode_graph_get_remote_endpoint(fwnode); ++ if (!fwnode) ++ goto err_put_local_node; ++ ++ fwnode_graph_parse_endpoint(fwnode, &fwep); ++ link->remote_port = fwep.port; ++ link->remote_node = fwnode_graph_get_port_parent(fwnode); ++ if (!link->remote_node) ++ goto err_put_remote_endpoint; + + return 0; ++ ++err_put_remote_endpoint: ++ fwnode_handle_put(fwnode); ++ ++err_put_local_node: ++ fwnode_handle_put(link->local_node); ++ ++ return -ENOLINK; + } + EXPORT_SYMBOL_GPL(v4l2_fwnode_parse_link); + +diff --git a/drivers/mmc/host/Kconfig b/drivers/mmc/host/Kconfig +index 1b4a40d910cfb..a93ea23e35da0 100644 +--- a/drivers/mmc/host/Kconfig ++++ b/drivers/mmc/host/Kconfig +@@ -466,11 +466,12 @@ config MMC_ALCOR + of Alcor Micro PCI-E card reader + + config MMC_AU1X +- tristate "Alchemy AU1XX0 MMC Card Interface support" ++ bool "Alchemy AU1XX0 MMC Card Interface support" + depends on MIPS_ALCHEMY ++ depends on MMC=y + help + This selects the AMD Alchemy(R) Multimedia card interface. +- If you have a Alchemy platform with a MMC slot, say Y or M here. ++ If you have a Alchemy platform with a MMC slot, say Y here. + + If unsure, say N. + +diff --git a/drivers/mmc/host/sdhci-esdhc-imx.c b/drivers/mmc/host/sdhci-esdhc-imx.c +index b3f761eca8299..762288c6d30ce 100644 +--- a/drivers/mmc/host/sdhci-esdhc-imx.c ++++ b/drivers/mmc/host/sdhci-esdhc-imx.c +@@ -153,8 +153,8 @@ + #define ESDHC_FLAG_HS400 BIT(9) + /* + * The IP has errata ERR010450 +- * uSDHC: Due to the I/O timing limit, for SDR mode, SD card clock can't +- * exceed 150MHz, for DDR mode, SD card clock can't exceed 45MHz. ++ * uSDHC: At 1.8V due to the I/O timing limit, for SDR mode, SD card ++ * clock can't exceed 150MHz, for DDR mode, SD card clock can't exceed 45MHz. + */ + #define ESDHC_FLAG_ERR010450 BIT(10) + /* The IP supports HS400ES mode */ +@@ -777,7 +777,8 @@ static inline void esdhc_pltfm_set_clock(struct sdhci_host *host, + | ESDHC_CLOCK_MASK); + sdhci_writel(host, temp, ESDHC_SYSTEM_CONTROL); + +- if (imx_data->socdata->flags & ESDHC_FLAG_ERR010450) { ++ if ((imx_data->socdata->flags & ESDHC_FLAG_ERR010450) && ++ (!(host->quirks2 & SDHCI_QUIRK2_NO_1_8_V))) { + unsigned int max_clock; + + max_clock = imx_data->is_ddr ? 45000000 : 150000000; +diff --git a/drivers/mtd/nand/raw/brcmnand/brcmnand.c b/drivers/mtd/nand/raw/brcmnand/brcmnand.c +index bd9f45edc9a34..e6efc115ef15b 100644 +--- a/drivers/mtd/nand/raw/brcmnand/brcmnand.c ++++ b/drivers/mtd/nand/raw/brcmnand/brcmnand.c +@@ -197,6 +197,7 @@ struct brcmnand_controller { + unsigned int max_page_size; + const unsigned int *page_sizes; + unsigned int max_oob; ++ u32 ecc_level_shift; + u32 features; + + /* for low-power standby/resume only */ +@@ -487,6 +488,34 @@ enum { + INTFC_CTLR_READY = BIT(31), + }; + ++/*********************************************************************** ++ * NAND ACC CONTROL bitfield ++ * ++ * Some bits have remained constant throughout hardware revision, while ++ * others have shifted around. ++ ***********************************************************************/ ++ ++/* Constant for all versions (where supported) */ ++enum { ++ /* See BRCMNAND_HAS_CACHE_MODE */ ++ ACC_CONTROL_CACHE_MODE = BIT(22), ++ ++ /* See BRCMNAND_HAS_PREFETCH */ ++ ACC_CONTROL_PREFETCH = BIT(23), ++ ++ ACC_CONTROL_PAGE_HIT = BIT(24), ++ ACC_CONTROL_WR_PREEMPT = BIT(25), ++ ACC_CONTROL_PARTIAL_PAGE = BIT(26), ++ ACC_CONTROL_RD_ERASED = BIT(27), ++ ACC_CONTROL_FAST_PGM_RDIN = BIT(28), ++ ACC_CONTROL_WR_ECC = BIT(30), ++ ACC_CONTROL_RD_ECC = BIT(31), ++}; ++ ++#define ACC_CONTROL_ECC_SHIFT 16 ++/* Only for v7.2 */ ++#define ACC_CONTROL_ECC_EXT_SHIFT 13 ++ + static inline u32 nand_readreg(struct brcmnand_controller *ctrl, u32 offs) + { + return brcmnand_readl(ctrl->nand_base + offs); +@@ -590,6 +619,12 @@ static int brcmnand_revision_init(struct brcmnand_controller *ctrl) + else if (of_property_read_bool(ctrl->dev->of_node, "brcm,nand-has-wp")) + ctrl->features |= BRCMNAND_HAS_WP; + ++ /* v7.2 has different ecc level shift in the acc register */ ++ if (ctrl->nand_version == 0x0702) ++ ctrl->ecc_level_shift = ACC_CONTROL_ECC_EXT_SHIFT; ++ else ++ ctrl->ecc_level_shift = ACC_CONTROL_ECC_SHIFT; ++ + return 0; + } + +@@ -752,30 +787,6 @@ static inline int brcmnand_cmd_shift(struct brcmnand_controller *ctrl) + return 0; + } + +-/*********************************************************************** +- * NAND ACC CONTROL bitfield +- * +- * Some bits have remained constant throughout hardware revision, while +- * others have shifted around. +- ***********************************************************************/ +- +-/* Constant for all versions (where supported) */ +-enum { +- /* See BRCMNAND_HAS_CACHE_MODE */ +- ACC_CONTROL_CACHE_MODE = BIT(22), +- +- /* See BRCMNAND_HAS_PREFETCH */ +- ACC_CONTROL_PREFETCH = BIT(23), +- +- ACC_CONTROL_PAGE_HIT = BIT(24), +- ACC_CONTROL_WR_PREEMPT = BIT(25), +- ACC_CONTROL_PARTIAL_PAGE = BIT(26), +- ACC_CONTROL_RD_ERASED = BIT(27), +- ACC_CONTROL_FAST_PGM_RDIN = BIT(28), +- ACC_CONTROL_WR_ECC = BIT(30), +- ACC_CONTROL_RD_ECC = BIT(31), +-}; +- + static inline u32 brcmnand_spare_area_mask(struct brcmnand_controller *ctrl) + { + if (ctrl->nand_version == 0x0702) +@@ -786,18 +797,15 @@ static inline u32 brcmnand_spare_area_mask(struct brcmnand_controller *ctrl) + return GENMASK(5, 0); + } + +-#define NAND_ACC_CONTROL_ECC_SHIFT 16 +-#define NAND_ACC_CONTROL_ECC_EXT_SHIFT 13 +- + static inline u32 brcmnand_ecc_level_mask(struct brcmnand_controller *ctrl) + { + u32 mask = (ctrl->nand_version >= 0x0600) ? 0x1f : 0x0f; + +- mask <<= NAND_ACC_CONTROL_ECC_SHIFT; ++ mask <<= ACC_CONTROL_ECC_SHIFT; + + /* v7.2 includes additional ECC levels */ +- if (ctrl->nand_version >= 0x0702) +- mask |= 0x7 << NAND_ACC_CONTROL_ECC_EXT_SHIFT; ++ if (ctrl->nand_version == 0x0702) ++ mask |= 0x7 << ACC_CONTROL_ECC_EXT_SHIFT; + + return mask; + } +@@ -811,8 +819,8 @@ static void brcmnand_set_ecc_enabled(struct brcmnand_host *host, int en) + + if (en) { + acc_control |= ecc_flags; /* enable RD/WR ECC */ +- acc_control |= host->hwcfg.ecc_level +- << NAND_ACC_CONTROL_ECC_SHIFT; ++ acc_control &= ~brcmnand_ecc_level_mask(ctrl); ++ acc_control |= host->hwcfg.ecc_level << ctrl->ecc_level_shift; + } else { + acc_control &= ~ecc_flags; /* disable RD/WR ECC */ + acc_control &= ~brcmnand_ecc_level_mask(ctrl); +@@ -891,6 +899,14 @@ static int bcmnand_ctrl_poll_status(struct brcmnand_controller *ctrl, + cpu_relax(); + } while (time_after(limit, jiffies)); + ++ /* ++ * do a final check after time out in case the CPU was busy and the driver ++ * did not get enough time to perform the polling to avoid false alarms ++ */ ++ val = brcmnand_read_reg(ctrl, BRCMNAND_INTFC_STATUS); ++ if ((val & mask) == expected_val) ++ return 0; ++ + dev_warn(ctrl->dev, "timeout on status poll (expected %x got %x)\n", + expected_val, val & mask); + +@@ -1273,19 +1289,33 @@ static int write_oob_to_regs(struct brcmnand_controller *ctrl, int i, + const u8 *oob, int sas, int sector_1k) + { + int tbytes = sas << sector_1k; +- int j; ++ int j, k = 0; ++ u32 last = 0xffffffff; ++ u8 *plast = (u8 *)&last; + + /* Adjust OOB values for 1K sector size */ + if (sector_1k && (i & 0x01)) + tbytes = max(0, tbytes - (int)ctrl->max_oob); + tbytes = min_t(int, tbytes, ctrl->max_oob); + +- for (j = 0; j < tbytes; j += 4) ++ /* ++ * tbytes may not be multiple of words. Make sure we don't read out of ++ * the boundary and stop at last word. ++ */ ++ for (j = 0; (j + 3) < tbytes; j += 4) + oob_reg_write(ctrl, j, + (oob[j + 0] << 24) | + (oob[j + 1] << 16) | + (oob[j + 2] << 8) | + (oob[j + 3] << 0)); ++ ++ /* handle the remaing bytes */ ++ while (j < tbytes) ++ plast[k++] = oob[j++]; ++ ++ if (tbytes & 0x3) ++ oob_reg_write(ctrl, (tbytes & ~0x3), (__force u32)cpu_to_be32(last)); ++ + return tbytes; + } + +@@ -1331,7 +1361,17 @@ static void brcmnand_send_cmd(struct brcmnand_host *host, int cmd) + + dev_dbg(ctrl->dev, "send native cmd %d addr 0x%llx\n", cmd, cmd_addr); + +- BUG_ON(ctrl->cmd_pending != 0); ++ /* ++ * If we came here through _panic_write and there is a pending ++ * command, try to wait for it. If it times out, rather than ++ * hitting BUG_ON, just return so we don't crash while crashing. ++ */ ++ if (oops_in_progress) { ++ if (ctrl->cmd_pending && ++ bcmnand_ctrl_poll_status(ctrl, NAND_CTRL_RDY, NAND_CTRL_RDY, 0)) ++ return; ++ } else ++ BUG_ON(ctrl->cmd_pending != 0); + ctrl->cmd_pending = cmd; + + ret = bcmnand_ctrl_poll_status(ctrl, NAND_CTRL_RDY, NAND_CTRL_RDY, 0); +@@ -2161,7 +2201,7 @@ static int brcmnand_set_cfg(struct brcmnand_host *host, + + tmp = nand_readreg(ctrl, acc_control_offs); + tmp &= ~brcmnand_ecc_level_mask(ctrl); +- tmp |= cfg->ecc_level << NAND_ACC_CONTROL_ECC_SHIFT; ++ tmp |= cfg->ecc_level << ctrl->ecc_level_shift; + tmp &= ~brcmnand_spare_area_mask(ctrl); + tmp |= cfg->spare_area_size; + nand_writereg(ctrl, acc_control_offs, tmp); +diff --git a/drivers/mtd/nand/raw/fsmc_nand.c b/drivers/mtd/nand/raw/fsmc_nand.c +index cc8369a595de3..bccadf8f27fa4 100644 +--- a/drivers/mtd/nand/raw/fsmc_nand.c ++++ b/drivers/mtd/nand/raw/fsmc_nand.c +@@ -1181,9 +1181,14 @@ static int fsmc_nand_suspend(struct device *dev) + static int fsmc_nand_resume(struct device *dev) + { + struct fsmc_nand_data *host = dev_get_drvdata(dev); ++ int ret; + + if (host) { +- clk_prepare_enable(host->clk); ++ ret = clk_prepare_enable(host->clk); ++ if (ret) { ++ dev_err(dev, "failed to enable clk\n"); ++ return ret; ++ } + if (host->dev_timings) + fsmc_nand_setup(host, host->dev_timings); + nand_reset(&host->nand, 0); +diff --git a/drivers/net/arcnet/arcnet.c b/drivers/net/arcnet/arcnet.c +index 553776cc1d29d..2b112d3d85409 100644 +--- a/drivers/net/arcnet/arcnet.c ++++ b/drivers/net/arcnet/arcnet.c +@@ -434,7 +434,7 @@ static void arcnet_reply_tasklet(unsigned long data) + + ret = sock_queue_err_skb(sk, ackskb); + if (ret) +- kfree_skb(ackskb); ++ dev_kfree_skb_irq(ackskb); + + local_irq_enable(); + }; +diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c +index de5e5385fc110..1a24c1d9dd8f7 100644 +--- a/drivers/net/can/usb/gs_usb.c ++++ b/drivers/net/can/usb/gs_usb.c +@@ -381,6 +381,9 @@ static void gs_usb_receive_bulk_callback(struct urb *urb) + } + + if (hf->flags & GS_CAN_FLAG_OVERFLOW) { ++ stats->rx_over_errors++; ++ stats->rx_errors++; ++ + skb = alloc_can_err_skb(netdev, &cf); + if (!skb) + goto resubmit_urb; +@@ -388,8 +391,6 @@ static void gs_usb_receive_bulk_callback(struct urb *urb) + cf->can_id |= CAN_ERR_CRTL; + cf->can_dlc = CAN_ERR_DLC; + cf->data[1] = CAN_ERR_CRTL_RX_OVERFLOW; +- stats->rx_over_errors++; +- stats->rx_errors++; + netif_rx(skb); + } + +diff --git a/drivers/net/ethernet/atheros/alx/ethtool.c b/drivers/net/ethernet/atheros/alx/ethtool.c +index 2f4eabf652e80..51e5aa2c74b34 100644 +--- a/drivers/net/ethernet/atheros/alx/ethtool.c ++++ b/drivers/net/ethernet/atheros/alx/ethtool.c +@@ -281,9 +281,8 @@ static void alx_get_ethtool_stats(struct net_device *netdev, + spin_lock(&alx->stats_lock); + + alx_update_hw_stats(hw); +- BUILD_BUG_ON(sizeof(hw->stats) - offsetof(struct alx_hw_stats, rx_ok) < +- ALX_NUM_STATS * sizeof(u64)); +- memcpy(data, &hw->stats.rx_ok, ALX_NUM_STATS * sizeof(u64)); ++ BUILD_BUG_ON(sizeof(hw->stats) != ALX_NUM_STATS * sizeof(u64)); ++ memcpy(data, &hw->stats, sizeof(hw->stats)); + + spin_unlock(&alx->stats_lock); + } +diff --git a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c +index 2b239ecea05f2..ff28dbf515747 100644 +--- a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c ++++ b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c +@@ -1989,8 +1989,11 @@ static int atl1c_tso_csum(struct atl1c_adapter *adapter, + real_len = (((unsigned char *)ip_hdr(skb) - skb->data) + + ntohs(ip_hdr(skb)->tot_len)); + +- if (real_len < skb->len) +- pskb_trim(skb, real_len); ++ if (real_len < skb->len) { ++ err = pskb_trim(skb, real_len); ++ if (err) ++ return err; ++ } + + hdr_len = (skb_transport_offset(skb) + tcp_hdrlen(skb)); + if (unlikely(skb->len == hdr_len)) { +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c +index b5f58c62e7d20..211fbc8f75712 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c +@@ -14426,11 +14426,16 @@ static void bnx2x_io_resume(struct pci_dev *pdev) + bp->fw_seq = SHMEM_RD(bp, func_mb[BP_FW_MB_IDX(bp)].drv_mb_header) & + DRV_MSG_SEQ_NUMBER_MASK; + +- if (netif_running(dev)) +- bnx2x_nic_load(bp, LOAD_NORMAL); ++ if (netif_running(dev)) { ++ if (bnx2x_nic_load(bp, LOAD_NORMAL)) { ++ netdev_err(bp->dev, "Error during driver initialization, try unloading/reloading the driver\n"); ++ goto done; ++ } ++ } + + netif_device_attach(dev); + ++done: + rtnl_unlock(); + } + +diff --git a/drivers/net/ethernet/freescale/enetc/enetc_ptp.c b/drivers/net/ethernet/freescale/enetc/enetc_ptp.c +index bc594892507ac..8c36615256944 100644 +--- a/drivers/net/ethernet/freescale/enetc/enetc_ptp.c ++++ b/drivers/net/ethernet/freescale/enetc/enetc_ptp.c +@@ -8,7 +8,7 @@ + #include "enetc.h" + + int enetc_phc_index = -1; +-EXPORT_SYMBOL(enetc_phc_index); ++EXPORT_SYMBOL_GPL(enetc_phc_index); + + static struct ptp_clock_info enetc_ptp_caps = { + .owner = THIS_MODULE, +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c b/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c +index 34e5448d59f6f..4ea19f546df08 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c +@@ -676,7 +676,9 @@ static int hns3_get_link_ksettings(struct net_device *netdev, + hns3_get_ksettings(h, cmd); + break; + case HNAE3_MEDIA_TYPE_FIBER: +- if (module_type == HNAE3_MODULE_TYPE_CR) ++ if (module_type == HNAE3_MODULE_TYPE_UNKNOWN) ++ cmd->base.port = PORT_OTHER; ++ else if (module_type == HNAE3_MODULE_TYPE_CR) + cmd->base.port = PORT_DA; + else + cmd->base.port = PORT_FIBRE; +diff --git a/drivers/net/ethernet/intel/igb/igb.h b/drivers/net/ethernet/intel/igb/igb.h +index 33cbe4f70d590..e6d99759d95a1 100644 +--- a/drivers/net/ethernet/intel/igb/igb.h ++++ b/drivers/net/ethernet/intel/igb/igb.h +@@ -32,11 +32,11 @@ struct igb_adapter; + /* TX/RX descriptor defines */ + #define IGB_DEFAULT_TXD 256 + #define IGB_DEFAULT_TX_WORK 128 +-#define IGB_MIN_TXD 80 ++#define IGB_MIN_TXD 64 + #define IGB_MAX_TXD 4096 + + #define IGB_DEFAULT_RXD 256 +-#define IGB_MIN_RXD 80 ++#define IGB_MIN_RXD 64 + #define IGB_MAX_RXD 4096 + + #define IGB_DEFAULT_ITR 3 /* dynamic */ +diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c +index 8c6c0d9c7f766..6638d314c811c 100644 +--- a/drivers/net/ethernet/intel/igb/igb_main.c ++++ b/drivers/net/ethernet/intel/igb/igb_main.c +@@ -3710,8 +3710,9 @@ static void igb_probe_vfs(struct igb_adapter *adapter) + struct pci_dev *pdev = adapter->pdev; + struct e1000_hw *hw = &adapter->hw; + +- /* Virtualization features not supported on i210 family. */ +- if ((hw->mac.type == e1000_i210) || (hw->mac.type == e1000_i211)) ++ /* Virtualization features not supported on i210 and 82580 family. */ ++ if ((hw->mac.type == e1000_i210) || (hw->mac.type == e1000_i211) || ++ (hw->mac.type == e1000_82580)) + return; + + /* Of the below we really only want the effect of getting +@@ -4552,6 +4553,10 @@ void igb_configure_rx_ring(struct igb_adapter *adapter, + static void igb_set_rx_buffer_len(struct igb_adapter *adapter, + struct igb_ring *rx_ring) + { ++#if (PAGE_SIZE < 8192) ++ struct e1000_hw *hw = &adapter->hw; ++#endif ++ + /* set build_skb and buffer size flags */ + clear_ring_build_skb_enabled(rx_ring); + clear_ring_uses_large_buffer(rx_ring); +@@ -4562,10 +4567,9 @@ static void igb_set_rx_buffer_len(struct igb_adapter *adapter, + set_ring_build_skb_enabled(rx_ring); + + #if (PAGE_SIZE < 8192) +- if (adapter->max_frame_size <= IGB_MAX_FRAME_BUILD_SKB) +- return; +- +- set_ring_uses_large_buffer(rx_ring); ++ if (adapter->max_frame_size > IGB_MAX_FRAME_BUILD_SKB || ++ rd32(E1000_RCTL) & E1000_RCTL_SBP) ++ set_ring_uses_large_buffer(rx_ring); + #endif + } + +diff --git a/drivers/net/ethernet/intel/igbvf/igbvf.h b/drivers/net/ethernet/intel/igbvf/igbvf.h +index eee26a3be90ba..52545cb25d058 100644 +--- a/drivers/net/ethernet/intel/igbvf/igbvf.h ++++ b/drivers/net/ethernet/intel/igbvf/igbvf.h +@@ -39,11 +39,11 @@ enum latency_range { + /* Tx/Rx descriptor defines */ + #define IGBVF_DEFAULT_TXD 256 + #define IGBVF_MAX_TXD 4096 +-#define IGBVF_MIN_TXD 80 ++#define IGBVF_MIN_TXD 64 + + #define IGBVF_DEFAULT_RXD 256 + #define IGBVF_MAX_RXD 4096 +-#define IGBVF_MIN_RXD 80 ++#define IGBVF_MIN_RXD 64 + + #define IGBVF_MIN_ITR_USECS 10 /* 100000 irq/sec */ + #define IGBVF_MAX_ITR_USECS 10000 /* 100 irq/sec */ +diff --git a/drivers/net/ethernet/intel/igc/igc.h b/drivers/net/ethernet/intel/igc/igc.h +index aec998c82b694..a46eca3ffbcc5 100644 +--- a/drivers/net/ethernet/intel/igc/igc.h ++++ b/drivers/net/ethernet/intel/igc/igc.h +@@ -78,11 +78,11 @@ extern char igc_driver_version[]; + /* TX/RX descriptor defines */ + #define IGC_DEFAULT_TXD 256 + #define IGC_DEFAULT_TX_WORK 128 +-#define IGC_MIN_TXD 80 ++#define IGC_MIN_TXD 64 + #define IGC_MAX_TXD 4096 + + #define IGC_DEFAULT_RXD 256 +-#define IGC_MIN_RXD 80 ++#define IGC_MIN_RXD 64 + #define IGC_MAX_RXD 4096 + + /* Transmit and receive queues */ +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c +index d155181b939e4..f5e36417c33e2 100644 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c +@@ -989,6 +989,7 @@ static int ixgbe_ptp_set_timestamp_mode(struct ixgbe_adapter *adapter, + u32 tsync_tx_ctl = IXGBE_TSYNCTXCTL_ENABLED; + u32 tsync_rx_ctl = IXGBE_TSYNCRXCTL_ENABLED; + u32 tsync_rx_mtrl = PTP_EV_PORT << 16; ++ u32 aflags = adapter->flags; + bool is_l2 = false; + u32 regval; + +@@ -1009,20 +1010,20 @@ static int ixgbe_ptp_set_timestamp_mode(struct ixgbe_adapter *adapter, + case HWTSTAMP_FILTER_NONE: + tsync_rx_ctl = 0; + tsync_rx_mtrl = 0; +- adapter->flags &= ~(IXGBE_FLAG_RX_HWTSTAMP_ENABLED | +- IXGBE_FLAG_RX_HWTSTAMP_IN_REGISTER); ++ aflags &= ~(IXGBE_FLAG_RX_HWTSTAMP_ENABLED | ++ IXGBE_FLAG_RX_HWTSTAMP_IN_REGISTER); + break; + case HWTSTAMP_FILTER_PTP_V1_L4_SYNC: + tsync_rx_ctl |= IXGBE_TSYNCRXCTL_TYPE_L4_V1; + tsync_rx_mtrl |= IXGBE_RXMTRL_V1_SYNC_MSG; +- adapter->flags |= (IXGBE_FLAG_RX_HWTSTAMP_ENABLED | +- IXGBE_FLAG_RX_HWTSTAMP_IN_REGISTER); ++ aflags |= (IXGBE_FLAG_RX_HWTSTAMP_ENABLED | ++ IXGBE_FLAG_RX_HWTSTAMP_IN_REGISTER); + break; + case HWTSTAMP_FILTER_PTP_V1_L4_DELAY_REQ: + tsync_rx_ctl |= IXGBE_TSYNCRXCTL_TYPE_L4_V1; + tsync_rx_mtrl |= IXGBE_RXMTRL_V1_DELAY_REQ_MSG; +- adapter->flags |= (IXGBE_FLAG_RX_HWTSTAMP_ENABLED | +- IXGBE_FLAG_RX_HWTSTAMP_IN_REGISTER); ++ aflags |= (IXGBE_FLAG_RX_HWTSTAMP_ENABLED | ++ IXGBE_FLAG_RX_HWTSTAMP_IN_REGISTER); + break; + case HWTSTAMP_FILTER_PTP_V2_EVENT: + case HWTSTAMP_FILTER_PTP_V2_L2_EVENT: +@@ -1036,8 +1037,8 @@ static int ixgbe_ptp_set_timestamp_mode(struct ixgbe_adapter *adapter, + tsync_rx_ctl |= IXGBE_TSYNCRXCTL_TYPE_EVENT_V2; + is_l2 = true; + config->rx_filter = HWTSTAMP_FILTER_PTP_V2_EVENT; +- adapter->flags |= (IXGBE_FLAG_RX_HWTSTAMP_ENABLED | +- IXGBE_FLAG_RX_HWTSTAMP_IN_REGISTER); ++ aflags |= (IXGBE_FLAG_RX_HWTSTAMP_ENABLED | ++ IXGBE_FLAG_RX_HWTSTAMP_IN_REGISTER); + break; + case HWTSTAMP_FILTER_PTP_V1_L4_EVENT: + case HWTSTAMP_FILTER_NTP_ALL: +@@ -1048,7 +1049,7 @@ static int ixgbe_ptp_set_timestamp_mode(struct ixgbe_adapter *adapter, + if (hw->mac.type >= ixgbe_mac_X550) { + tsync_rx_ctl |= IXGBE_TSYNCRXCTL_TYPE_ALL; + config->rx_filter = HWTSTAMP_FILTER_ALL; +- adapter->flags |= IXGBE_FLAG_RX_HWTSTAMP_ENABLED; ++ aflags |= IXGBE_FLAG_RX_HWTSTAMP_ENABLED; + break; + } + /* fall through */ +@@ -1059,8 +1060,6 @@ static int ixgbe_ptp_set_timestamp_mode(struct ixgbe_adapter *adapter, + * Delay_Req messages and hardware does not support + * timestamping all packets => return error + */ +- adapter->flags &= ~(IXGBE_FLAG_RX_HWTSTAMP_ENABLED | +- IXGBE_FLAG_RX_HWTSTAMP_IN_REGISTER); + config->rx_filter = HWTSTAMP_FILTER_NONE; + return -ERANGE; + } +@@ -1092,8 +1091,8 @@ static int ixgbe_ptp_set_timestamp_mode(struct ixgbe_adapter *adapter, + IXGBE_TSYNCRXCTL_TYPE_ALL | + IXGBE_TSYNCRXCTL_TSIP_UT_EN; + config->rx_filter = HWTSTAMP_FILTER_ALL; +- adapter->flags |= IXGBE_FLAG_RX_HWTSTAMP_ENABLED; +- adapter->flags &= ~IXGBE_FLAG_RX_HWTSTAMP_IN_REGISTER; ++ aflags |= IXGBE_FLAG_RX_HWTSTAMP_ENABLED; ++ aflags &= ~IXGBE_FLAG_RX_HWTSTAMP_IN_REGISTER; + is_l2 = true; + break; + default: +@@ -1126,6 +1125,9 @@ static int ixgbe_ptp_set_timestamp_mode(struct ixgbe_adapter *adapter, + + IXGBE_WRITE_FLUSH(hw); + ++ /* configure adapter flags only when HW is actually configured */ ++ adapter->flags = aflags; ++ + /* clear TX/RX time stamp registers, just to be sure */ + ixgbe_ptp_clear_tx_timestamp(adapter); + IXGBE_READ_REG(hw, IXGBE_RXSTMPH); +diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c +index 31dde6fbdbdca..7a2293a5bcc9f 100644 +--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c ++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c +@@ -4233,6 +4233,11 @@ static int mvpp2_ethtool_get_rxnfc(struct net_device *dev, + break; + case ETHTOOL_GRXCLSRLALL: + for (i = 0; i < MVPP2_N_RFS_ENTRIES_PER_FLOW; i++) { ++ if (loc == info->rule_cnt) { ++ ret = -EMSGSIZE; ++ break; ++ } ++ + if (port->rfs_rules[i]) + rules[loc++] = i; + } +diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c +index f9139150a8a26..7b9f5eba78dcc 100644 +--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c ++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c +@@ -2008,6 +2008,9 @@ static int mtk_hwlro_get_fdir_all(struct net_device *dev, + int i; + + for (i = 0; i < MTK_MAX_LRO_IP_CNT; i++) { ++ if (cnt == cmd->rule_cnt) ++ return -EMSGSIZE; ++ + if (mac->hwlro_ip[i]) { + rule_locs[cnt] = i; + cnt++; +diff --git a/drivers/net/ethernet/mellanox/mlxsw/i2c.c b/drivers/net/ethernet/mellanox/mlxsw/i2c.c +index 7cc4c30af1a71..b0d44b1361161 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/i2c.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/i2c.c +@@ -47,6 +47,7 @@ + #define MLXSW_I2C_MBOX_SIZE_BITS 12 + #define MLXSW_I2C_ADDR_BUF_SIZE 4 + #define MLXSW_I2C_BLK_DEF 32 ++#define MLXSW_I2C_BLK_MAX 100 + #define MLXSW_I2C_RETRY 5 + #define MLXSW_I2C_TIMEOUT_MSECS 5000 + #define MLXSW_I2C_MAX_DATA_SIZE 256 +@@ -427,7 +428,7 @@ mlxsw_i2c_cmd(struct device *dev, u16 opcode, u32 in_mod, size_t in_mbox_size, + } else { + /* No input mailbox is case of initialization query command. */ + reg_size = MLXSW_I2C_MAX_DATA_SIZE; +- num = reg_size / mlxsw_i2c->block_size; ++ num = DIV_ROUND_UP(reg_size, mlxsw_i2c->block_size); + + if (mutex_lock_interruptible(&mlxsw_i2c->cmd.lock) < 0) { + dev_err(&client->dev, "Could not acquire lock"); +@@ -575,7 +576,7 @@ static int mlxsw_i2c_probe(struct i2c_client *client, + return -EOPNOTSUPP; + } + +- mlxsw_i2c->block_size = max_t(u16, MLXSW_I2C_BLK_DEF, ++ mlxsw_i2c->block_size = min_t(u16, MLXSW_I2C_BLK_MAX, + min_t(u16, quirks->max_read_len, + quirks->max_write_len)); + } else { +diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c +index 25fa3ef5b804f..c16688327753b 100644 +--- a/drivers/net/macsec.c ++++ b/drivers/net/macsec.c +@@ -1350,8 +1350,7 @@ static struct crypto_aead *macsec_alloc_tfm(char *key, int key_len, int icv_len) + struct crypto_aead *tfm; + int ret; + +- /* Pick a sync gcm(aes) cipher to ensure order is preserved. */ +- tfm = crypto_alloc_aead("gcm(aes)", 0, CRYPTO_ALG_ASYNC); ++ tfm = crypto_alloc_aead("gcm(aes)", 0, 0); + + if (IS_ERR(tfm)) + return tfm; +diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c +index a4be176fdd249..ebc1f01d5ea27 100644 +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -1373,6 +1373,7 @@ static const struct usb_device_id products[] = { + {QMI_QUIRK_SET_DTR(0x2c7c, 0x0191, 4)}, /* Quectel EG91 */ + {QMI_QUIRK_SET_DTR(0x2c7c, 0x0195, 4)}, /* Quectel EG95 */ + {QMI_FIXED_INTF(0x2c7c, 0x0296, 4)}, /* Quectel BG96 */ ++ {QMI_QUIRK_SET_DTR(0x2c7c, 0x030e, 4)}, /* Quectel EM05GV2 */ + {QMI_QUIRK_SET_DTR(0x2cb7, 0x0104, 4)}, /* Fibocom NL678 series */ + {QMI_FIXED_INTF(0x0489, 0xe0b4, 0)}, /* Foxconn T77W968 LTE */ + {QMI_FIXED_INTF(0x0489, 0xe0b5, 0)}, /* Foxconn T77W968 LTE with eSIM support*/ +diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c +index b0412d14e8f6c..a19f0431e6f99 100644 +--- a/drivers/net/usb/r8152.c ++++ b/drivers/net/usb/r8152.c +@@ -2253,6 +2253,9 @@ static int r8152_poll(struct napi_struct *napi, int budget) + struct r8152 *tp = container_of(napi, struct r8152, napi); + int work_done; + ++ if (!budget) ++ return 0; ++ + work_done = rx_bottom(tp, budget); + + if (work_done < budget) { +diff --git a/drivers/net/veth.c b/drivers/net/veth.c +index a6445bba4f942..cae7247a397aa 100644 +--- a/drivers/net/veth.c ++++ b/drivers/net/veth.c +@@ -238,6 +238,7 @@ static netdev_tx_t veth_xmit(struct sk_buff *skb, struct net_device *dev) + { + struct veth_priv *rcv_priv, *priv = netdev_priv(dev); + struct veth_rq *rq = NULL; ++ int ret = NETDEV_TX_OK; + struct net_device *rcv; + int length = skb->len; + bool rcv_xdp = false; +@@ -270,6 +271,7 @@ static netdev_tx_t veth_xmit(struct sk_buff *skb, struct net_device *dev) + } else { + drop: + atomic64_inc(&priv->dropped); ++ ret = NET_XMIT_DROP; + } + + if (rcv_xdp) +@@ -277,7 +279,7 @@ drop: + + rcu_read_unlock(); + +- return NETDEV_TX_OK; ++ return ret; + } + + static u64 veth_stats_tx(struct pcpu_lstats *result, struct net_device *dev) +diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c +index 1e3e075454f33..8808a6540b190 100644 +--- a/drivers/net/vxlan.c ++++ b/drivers/net/vxlan.c +@@ -698,6 +698,32 @@ static int vxlan_fdb_append(struct vxlan_fdb *f, + return 1; + } + ++static bool vxlan_parse_gpe_proto(struct vxlanhdr *hdr, __be16 *protocol) ++{ ++ struct vxlanhdr_gpe *gpe = (struct vxlanhdr_gpe *)hdr; ++ ++ /* Need to have Next Protocol set for interfaces in GPE mode. */ ++ if (!gpe->np_applied) ++ return false; ++ /* "The initial version is 0. If a receiver does not support the ++ * version indicated it MUST drop the packet. ++ */ ++ if (gpe->version != 0) ++ return false; ++ /* "When the O bit is set to 1, the packet is an OAM packet and OAM ++ * processing MUST occur." However, we don't implement OAM ++ * processing, thus drop the packet. ++ */ ++ if (gpe->oam_flag) ++ return false; ++ ++ *protocol = tun_p_to_eth_p(gpe->next_protocol); ++ if (!*protocol) ++ return false; ++ ++ return true; ++} ++ + static struct vxlanhdr *vxlan_gro_remcsum(struct sk_buff *skb, + unsigned int off, + struct vxlanhdr *vh, size_t hdrlen, +@@ -1564,35 +1590,6 @@ out: + unparsed->vx_flags &= ~VXLAN_GBP_USED_BITS; + } + +-static bool vxlan_parse_gpe_hdr(struct vxlanhdr *unparsed, +- __be16 *protocol, +- struct sk_buff *skb, u32 vxflags) +-{ +- struct vxlanhdr_gpe *gpe = (struct vxlanhdr_gpe *)unparsed; +- +- /* Need to have Next Protocol set for interfaces in GPE mode. */ +- if (!gpe->np_applied) +- return false; +- /* "The initial version is 0. If a receiver does not support the +- * version indicated it MUST drop the packet. +- */ +- if (gpe->version != 0) +- return false; +- /* "When the O bit is set to 1, the packet is an OAM packet and OAM +- * processing MUST occur." However, we don't implement OAM +- * processing, thus drop the packet. +- */ +- if (gpe->oam_flag) +- return false; +- +- *protocol = tun_p_to_eth_p(gpe->next_protocol); +- if (!*protocol) +- return false; +- +- unparsed->vx_flags &= ~VXLAN_GPE_USED_BITS; +- return true; +-} +- + static bool vxlan_set_mac(struct vxlan_dev *vxlan, + struct vxlan_sock *vs, + struct sk_buff *skb, __be32 vni) +@@ -1694,8 +1691,9 @@ static int vxlan_rcv(struct sock *sk, struct sk_buff *skb) + * used by VXLAN extensions if explicitly requested. + */ + if (vs->flags & VXLAN_F_GPE) { +- if (!vxlan_parse_gpe_hdr(&unparsed, &protocol, skb, vs->flags)) ++ if (!vxlan_parse_gpe_proto(&unparsed, &protocol)) + goto drop; ++ unparsed.vx_flags &= ~VXLAN_GPE_USED_BITS; + raw_proto = true; + } + +diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c +index c28328c96307b..464dd0246a97d 100644 +--- a/drivers/net/wireless/ath/ath10k/pci.c ++++ b/drivers/net/wireless/ath/ath10k/pci.c +@@ -1960,8 +1960,9 @@ static int ath10k_pci_hif_start(struct ath10k *ar) + ath10k_pci_irq_enable(ar); + ath10k_pci_rx_post(ar); + +- pcie_capability_write_word(ar_pci->pdev, PCI_EXP_LNKCTL, +- ar_pci->link_ctl); ++ pcie_capability_clear_and_set_word(ar_pci->pdev, PCI_EXP_LNKCTL, ++ PCI_EXP_LNKCTL_ASPMC, ++ ar_pci->link_ctl & PCI_EXP_LNKCTL_ASPMC); + + return 0; + } +@@ -2818,8 +2819,8 @@ static int ath10k_pci_hif_power_up(struct ath10k *ar, + + pcie_capability_read_word(ar_pci->pdev, PCI_EXP_LNKCTL, + &ar_pci->link_ctl); +- pcie_capability_write_word(ar_pci->pdev, PCI_EXP_LNKCTL, +- ar_pci->link_ctl & ~PCI_EXP_LNKCTL_ASPMC); ++ pcie_capability_clear_word(ar_pci->pdev, PCI_EXP_LNKCTL, ++ PCI_EXP_LNKCTL_ASPMC); + + /* + * Bring the target up cleanly. +diff --git a/drivers/net/wireless/ath/ath9k/ahb.c b/drivers/net/wireless/ath/ath9k/ahb.c +index 63019c3de034d..26023e3b4b9df 100644 +--- a/drivers/net/wireless/ath/ath9k/ahb.c ++++ b/drivers/net/wireless/ath/ath9k/ahb.c +@@ -136,8 +136,8 @@ static int ath_ahb_probe(struct platform_device *pdev) + + ah = sc->sc_ah; + ath9k_hw_name(ah, hw_name, sizeof(hw_name)); +- wiphy_info(hw->wiphy, "%s mem=0x%lx, irq=%d\n", +- hw_name, (unsigned long)mem, irq); ++ wiphy_info(hw->wiphy, "%s mem=0x%p, irq=%d\n", ++ hw_name, mem, irq); + + return 0; + +diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_debug.c b/drivers/net/wireless/ath/ath9k/htc_drv_debug.c +index b3ed65e5c4da8..c55aab01fff5d 100644 +--- a/drivers/net/wireless/ath/ath9k/htc_drv_debug.c ++++ b/drivers/net/wireless/ath/ath9k/htc_drv_debug.c +@@ -491,7 +491,7 @@ int ath9k_htc_init_debug(struct ath_hw *ah) + + priv->debug.debugfs_phy = debugfs_create_dir(KBUILD_MODNAME, + priv->hw->wiphy->debugfsdir); +- if (!priv->debug.debugfs_phy) ++ if (IS_ERR(priv->debug.debugfs_phy)) + return -ENOMEM; + + ath9k_cmn_spectral_init_debug(&priv->spec_priv, priv->debug.debugfs_phy); +diff --git a/drivers/net/wireless/ath/ath9k/pci.c b/drivers/net/wireless/ath/ath9k/pci.c +index 92b2dd396436a..cb3318bd3cad2 100644 +--- a/drivers/net/wireless/ath/ath9k/pci.c ++++ b/drivers/net/wireless/ath/ath9k/pci.c +@@ -993,8 +993,8 @@ static int ath_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) + sc->sc_ah->msi_reg = 0; + + ath9k_hw_name(sc->sc_ah, hw_name, sizeof(hw_name)); +- wiphy_info(hw->wiphy, "%s mem=0x%lx, irq=%d\n", +- hw_name, (unsigned long)sc->mem, pdev->irq); ++ wiphy_info(hw->wiphy, "%s mem=0x%p, irq=%d\n", ++ hw_name, sc->mem, pdev->irq); + + return 0; + +diff --git a/drivers/net/wireless/ath/ath9k/wmi.c b/drivers/net/wireless/ath/ath9k/wmi.c +index ef861b19fd477..dd8027b8af63e 100644 +--- a/drivers/net/wireless/ath/ath9k/wmi.c ++++ b/drivers/net/wireless/ath/ath9k/wmi.c +@@ -239,10 +239,10 @@ static void ath9k_wmi_ctrl_rx(void *priv, struct sk_buff *skb, + spin_unlock_irqrestore(&wmi->wmi_lock, flags); + goto free_skb; + } +- spin_unlock_irqrestore(&wmi->wmi_lock, flags); + + /* WMI command response */ + ath9k_wmi_rsp_callback(wmi, skb); ++ spin_unlock_irqrestore(&wmi->wmi_lock, flags); + + free_skb: + kfree_skb(skb); +@@ -280,7 +280,8 @@ int ath9k_wmi_connect(struct htc_target *htc, struct wmi *wmi, + + static int ath9k_wmi_cmd_issue(struct wmi *wmi, + struct sk_buff *skb, +- enum wmi_cmd_id cmd, u16 len) ++ enum wmi_cmd_id cmd, u16 len, ++ u8 *rsp_buf, u32 rsp_len) + { + struct wmi_cmd_hdr *hdr; + unsigned long flags; +@@ -290,6 +291,11 @@ static int ath9k_wmi_cmd_issue(struct wmi *wmi, + hdr->seq_no = cpu_to_be16(++wmi->tx_seq_id); + + spin_lock_irqsave(&wmi->wmi_lock, flags); ++ ++ /* record the rsp buffer and length */ ++ wmi->cmd_rsp_buf = rsp_buf; ++ wmi->cmd_rsp_len = rsp_len; ++ + wmi->last_seq_id = wmi->tx_seq_id; + spin_unlock_irqrestore(&wmi->wmi_lock, flags); + +@@ -305,8 +311,8 @@ int ath9k_wmi_cmd(struct wmi *wmi, enum wmi_cmd_id cmd_id, + struct ath_common *common = ath9k_hw_common(ah); + u16 headroom = sizeof(struct htc_frame_hdr) + + sizeof(struct wmi_cmd_hdr); ++ unsigned long time_left, flags; + struct sk_buff *skb; +- unsigned long time_left; + int ret = 0; + + if (ah->ah_flags & AH_UNPLUGGED) +@@ -330,11 +336,7 @@ int ath9k_wmi_cmd(struct wmi *wmi, enum wmi_cmd_id cmd_id, + goto out; + } + +- /* record the rsp buffer and length */ +- wmi->cmd_rsp_buf = rsp_buf; +- wmi->cmd_rsp_len = rsp_len; +- +- ret = ath9k_wmi_cmd_issue(wmi, skb, cmd_id, cmd_len); ++ ret = ath9k_wmi_cmd_issue(wmi, skb, cmd_id, cmd_len, rsp_buf, rsp_len); + if (ret) + goto out; + +@@ -342,7 +344,9 @@ int ath9k_wmi_cmd(struct wmi *wmi, enum wmi_cmd_id cmd_id, + if (!time_left) { + ath_dbg(common, WMI, "Timeout waiting for WMI command: %s\n", + wmi_cmd_to_name(cmd_id)); ++ spin_lock_irqsave(&wmi->wmi_lock, flags); + wmi->last_seq_id = 0; ++ spin_unlock_irqrestore(&wmi->wmi_lock, flags); + mutex_unlock(&wmi->op_mutex); + return -ETIMEDOUT; + } +diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c +index f80b1d57d6c38..a21739b2f44e6 100644 +--- a/drivers/net/wireless/mac80211_hwsim.c ++++ b/drivers/net/wireless/mac80211_hwsim.c +@@ -3367,14 +3367,15 @@ static int hwsim_cloned_frame_received_nl(struct sk_buff *skb_2, + frame_data_len = nla_len(info->attrs[HWSIM_ATTR_FRAME]); + frame_data = (void *)nla_data(info->attrs[HWSIM_ATTR_FRAME]); + ++ if (frame_data_len < sizeof(struct ieee80211_hdr_3addr) || ++ frame_data_len > IEEE80211_MAX_DATA_LEN) ++ goto err; ++ + /* Allocate new skb here */ + skb = alloc_skb(frame_data_len, GFP_KERNEL); + if (skb == NULL) + goto err; + +- if (frame_data_len > IEEE80211_MAX_DATA_LEN) +- goto err; +- + /* Copy the data */ + skb_put_data(skb, frame_data, frame_data_len); + +diff --git a/drivers/net/wireless/marvell/mwifiex/debugfs.c b/drivers/net/wireless/marvell/mwifiex/debugfs.c +index 8ab114cf3467f..e4cb7ce1c8b85 100644 +--- a/drivers/net/wireless/marvell/mwifiex/debugfs.c ++++ b/drivers/net/wireless/marvell/mwifiex/debugfs.c +@@ -265,8 +265,11 @@ mwifiex_histogram_read(struct file *file, char __user *ubuf, + if (!p) + return -ENOMEM; + +- if (!priv || !priv->hist_data) +- return -EFAULT; ++ if (!priv || !priv->hist_data) { ++ ret = -EFAULT; ++ goto free_and_exit; ++ } ++ + phist_data = priv->hist_data; + + p += sprintf(p, "\n" +@@ -321,6 +324,8 @@ mwifiex_histogram_read(struct file *file, char __user *ubuf, + ret = simple_read_from_buffer(ubuf, count, ppos, (char *)page, + (unsigned long)p - page); + ++free_and_exit: ++ free_page(page); + return ret; + } + +diff --git a/drivers/net/wireless/marvell/mwifiex/pcie.c b/drivers/net/wireless/marvell/mwifiex/pcie.c +index b316e34917958..78d7674e71f9f 100644 +--- a/drivers/net/wireless/marvell/mwifiex/pcie.c ++++ b/drivers/net/wireless/marvell/mwifiex/pcie.c +@@ -50,6 +50,8 @@ static int mwifiex_pcie_probe_of(struct device *dev) + } + + static void mwifiex_pcie_work(struct work_struct *work); ++static int mwifiex_pcie_delete_rxbd_ring(struct mwifiex_adapter *adapter); ++static int mwifiex_pcie_delete_evtbd_ring(struct mwifiex_adapter *adapter); + + static int + mwifiex_map_pci_memory(struct mwifiex_adapter *adapter, struct sk_buff *skb, +@@ -58,8 +60,8 @@ mwifiex_map_pci_memory(struct mwifiex_adapter *adapter, struct sk_buff *skb, + struct pcie_service_card *card = adapter->card; + struct mwifiex_dma_mapping mapping; + +- mapping.addr = pci_map_single(card->dev, skb->data, size, flags); +- if (pci_dma_mapping_error(card->dev, mapping.addr)) { ++ mapping.addr = dma_map_single(&card->dev->dev, skb->data, size, flags); ++ if (dma_mapping_error(&card->dev->dev, mapping.addr)) { + mwifiex_dbg(adapter, ERROR, "failed to map pci memory!\n"); + return -1; + } +@@ -75,7 +77,7 @@ static void mwifiex_unmap_pci_memory(struct mwifiex_adapter *adapter, + struct mwifiex_dma_mapping mapping; + + mwifiex_get_mapping(skb, &mapping); +- pci_unmap_single(card->dev, mapping.addr, mapping.len, flags); ++ dma_unmap_single(&card->dev->dev, mapping.addr, mapping.len, flags); + } + + /* +@@ -465,10 +467,9 @@ static void mwifiex_delay_for_sleep_cookie(struct mwifiex_adapter *adapter, + struct sk_buff *cmdrsp = card->cmdrsp_buf; + + for (count = 0; count < max_delay_loop_cnt; count++) { +- pci_dma_sync_single_for_cpu(card->dev, +- MWIFIEX_SKB_DMA_ADDR(cmdrsp), +- sizeof(sleep_cookie), +- PCI_DMA_FROMDEVICE); ++ dma_sync_single_for_cpu(&card->dev->dev, ++ MWIFIEX_SKB_DMA_ADDR(cmdrsp), ++ sizeof(sleep_cookie), DMA_FROM_DEVICE); + buffer = cmdrsp->data; + sleep_cookie = get_unaligned_le32(buffer); + +@@ -477,10 +478,10 @@ static void mwifiex_delay_for_sleep_cookie(struct mwifiex_adapter *adapter, + "sleep cookie found at count %d\n", count); + break; + } +- pci_dma_sync_single_for_device(card->dev, +- MWIFIEX_SKB_DMA_ADDR(cmdrsp), +- sizeof(sleep_cookie), +- PCI_DMA_FROMDEVICE); ++ dma_sync_single_for_device(&card->dev->dev, ++ MWIFIEX_SKB_DMA_ADDR(cmdrsp), ++ sizeof(sleep_cookie), ++ DMA_FROM_DEVICE); + usleep_range(20, 30); + } + +@@ -628,14 +629,15 @@ static int mwifiex_init_rxq_ring(struct mwifiex_adapter *adapter) + if (!skb) { + mwifiex_dbg(adapter, ERROR, + "Unable to allocate skb for RX ring.\n"); +- kfree(card->rxbd_ring_vbase); + return -ENOMEM; + } + + if (mwifiex_map_pci_memory(adapter, skb, + MWIFIEX_RX_DATA_BUF_SIZE, +- PCI_DMA_FROMDEVICE)) +- return -1; ++ DMA_FROM_DEVICE)) { ++ kfree_skb(skb); ++ return -ENOMEM; ++ } + + buf_pa = MWIFIEX_SKB_DMA_ADDR(skb); + +@@ -685,16 +687,14 @@ static int mwifiex_pcie_init_evt_ring(struct mwifiex_adapter *adapter) + if (!skb) { + mwifiex_dbg(adapter, ERROR, + "Unable to allocate skb for EVENT buf.\n"); +- kfree(card->evtbd_ring_vbase); + return -ENOMEM; + } + skb_put(skb, MAX_EVENT_SIZE); + + if (mwifiex_map_pci_memory(adapter, skb, MAX_EVENT_SIZE, +- PCI_DMA_FROMDEVICE)) { ++ DMA_FROM_DEVICE)) { + kfree_skb(skb); +- kfree(card->evtbd_ring_vbase); +- return -1; ++ return -ENOMEM; + } + + buf_pa = MWIFIEX_SKB_DMA_ADDR(skb); +@@ -734,7 +734,7 @@ static void mwifiex_cleanup_txq_ring(struct mwifiex_adapter *adapter) + if (card->tx_buf_list[i]) { + skb = card->tx_buf_list[i]; + mwifiex_unmap_pci_memory(adapter, skb, +- PCI_DMA_TODEVICE); ++ DMA_TO_DEVICE); + dev_kfree_skb_any(skb); + } + memset(desc2, 0, sizeof(*desc2)); +@@ -743,7 +743,7 @@ static void mwifiex_cleanup_txq_ring(struct mwifiex_adapter *adapter) + if (card->tx_buf_list[i]) { + skb = card->tx_buf_list[i]; + mwifiex_unmap_pci_memory(adapter, skb, +- PCI_DMA_TODEVICE); ++ DMA_TO_DEVICE); + dev_kfree_skb_any(skb); + } + memset(desc, 0, sizeof(*desc)); +@@ -773,7 +773,7 @@ static void mwifiex_cleanup_rxq_ring(struct mwifiex_adapter *adapter) + if (card->rx_buf_list[i]) { + skb = card->rx_buf_list[i]; + mwifiex_unmap_pci_memory(adapter, skb, +- PCI_DMA_FROMDEVICE); ++ DMA_FROM_DEVICE); + dev_kfree_skb_any(skb); + } + memset(desc2, 0, sizeof(*desc2)); +@@ -782,7 +782,7 @@ static void mwifiex_cleanup_rxq_ring(struct mwifiex_adapter *adapter) + if (card->rx_buf_list[i]) { + skb = card->rx_buf_list[i]; + mwifiex_unmap_pci_memory(adapter, skb, +- PCI_DMA_FROMDEVICE); ++ DMA_FROM_DEVICE); + dev_kfree_skb_any(skb); + } + memset(desc, 0, sizeof(*desc)); +@@ -808,7 +808,7 @@ static void mwifiex_cleanup_evt_ring(struct mwifiex_adapter *adapter) + if (card->evt_buf_list[i]) { + skb = card->evt_buf_list[i]; + mwifiex_unmap_pci_memory(adapter, skb, +- PCI_DMA_FROMDEVICE); ++ DMA_FROM_DEVICE); + dev_kfree_skb_any(skb); + } + card->evt_buf_list[i] = NULL; +@@ -849,9 +849,10 @@ static int mwifiex_pcie_create_txbd_ring(struct mwifiex_adapter *adapter) + mwifiex_dbg(adapter, INFO, + "info: txbd_ring: Allocating %d bytes\n", + card->txbd_ring_size); +- card->txbd_ring_vbase = pci_alloc_consistent(card->dev, +- card->txbd_ring_size, +- &card->txbd_ring_pbase); ++ card->txbd_ring_vbase = dma_alloc_coherent(&card->dev->dev, ++ card->txbd_ring_size, ++ &card->txbd_ring_pbase, ++ GFP_KERNEL); + if (!card->txbd_ring_vbase) { + mwifiex_dbg(adapter, ERROR, + "allocate consistent memory (%d bytes) failed!\n", +@@ -875,9 +876,9 @@ static int mwifiex_pcie_delete_txbd_ring(struct mwifiex_adapter *adapter) + mwifiex_cleanup_txq_ring(adapter); + + if (card->txbd_ring_vbase) +- pci_free_consistent(card->dev, card->txbd_ring_size, +- card->txbd_ring_vbase, +- card->txbd_ring_pbase); ++ dma_free_coherent(&card->dev->dev, card->txbd_ring_size, ++ card->txbd_ring_vbase, ++ card->txbd_ring_pbase); + card->txbd_ring_size = 0; + card->txbd_wrptr = 0; + card->txbd_rdptr = 0 | reg->tx_rollover_ind; +@@ -892,6 +893,7 @@ static int mwifiex_pcie_delete_txbd_ring(struct mwifiex_adapter *adapter) + */ + static int mwifiex_pcie_create_rxbd_ring(struct mwifiex_adapter *adapter) + { ++ int ret; + struct pcie_service_card *card = adapter->card; + const struct mwifiex_pcie_card_reg *reg = card->pcie.reg; + +@@ -913,9 +915,10 @@ static int mwifiex_pcie_create_rxbd_ring(struct mwifiex_adapter *adapter) + mwifiex_dbg(adapter, INFO, + "info: rxbd_ring: Allocating %d bytes\n", + card->rxbd_ring_size); +- card->rxbd_ring_vbase = pci_alloc_consistent(card->dev, +- card->rxbd_ring_size, +- &card->rxbd_ring_pbase); ++ card->rxbd_ring_vbase = dma_alloc_coherent(&card->dev->dev, ++ card->rxbd_ring_size, ++ &card->rxbd_ring_pbase, ++ GFP_KERNEL); + if (!card->rxbd_ring_vbase) { + mwifiex_dbg(adapter, ERROR, + "allocate consistent memory (%d bytes) failed!\n", +@@ -929,7 +932,10 @@ static int mwifiex_pcie_create_rxbd_ring(struct mwifiex_adapter *adapter) + (u32)((u64)card->rxbd_ring_pbase >> 32), + card->rxbd_ring_size); + +- return mwifiex_init_rxq_ring(adapter); ++ ret = mwifiex_init_rxq_ring(adapter); ++ if (ret) ++ mwifiex_pcie_delete_rxbd_ring(adapter); ++ return ret; + } + + /* +@@ -943,9 +949,9 @@ static int mwifiex_pcie_delete_rxbd_ring(struct mwifiex_adapter *adapter) + mwifiex_cleanup_rxq_ring(adapter); + + if (card->rxbd_ring_vbase) +- pci_free_consistent(card->dev, card->rxbd_ring_size, +- card->rxbd_ring_vbase, +- card->rxbd_ring_pbase); ++ dma_free_coherent(&card->dev->dev, card->rxbd_ring_size, ++ card->rxbd_ring_vbase, ++ card->rxbd_ring_pbase); + card->rxbd_ring_size = 0; + card->rxbd_wrptr = 0; + card->rxbd_rdptr = 0 | reg->rx_rollover_ind; +@@ -960,6 +966,7 @@ static int mwifiex_pcie_delete_rxbd_ring(struct mwifiex_adapter *adapter) + */ + static int mwifiex_pcie_create_evtbd_ring(struct mwifiex_adapter *adapter) + { ++ int ret; + struct pcie_service_card *card = adapter->card; + const struct mwifiex_pcie_card_reg *reg = card->pcie.reg; + +@@ -977,9 +984,10 @@ static int mwifiex_pcie_create_evtbd_ring(struct mwifiex_adapter *adapter) + mwifiex_dbg(adapter, INFO, + "info: evtbd_ring: Allocating %d bytes\n", + card->evtbd_ring_size); +- card->evtbd_ring_vbase = pci_alloc_consistent(card->dev, +- card->evtbd_ring_size, +- &card->evtbd_ring_pbase); ++ card->evtbd_ring_vbase = dma_alloc_coherent(&card->dev->dev, ++ card->evtbd_ring_size, ++ &card->evtbd_ring_pbase, ++ GFP_KERNEL); + if (!card->evtbd_ring_vbase) { + mwifiex_dbg(adapter, ERROR, + "allocate consistent memory (%d bytes) failed!\n", +@@ -993,7 +1001,10 @@ static int mwifiex_pcie_create_evtbd_ring(struct mwifiex_adapter *adapter) + (u32)((u64)card->evtbd_ring_pbase >> 32), + card->evtbd_ring_size); + +- return mwifiex_pcie_init_evt_ring(adapter); ++ ret = mwifiex_pcie_init_evt_ring(adapter); ++ if (ret) ++ mwifiex_pcie_delete_evtbd_ring(adapter); ++ return ret; + } + + /* +@@ -1007,9 +1018,9 @@ static int mwifiex_pcie_delete_evtbd_ring(struct mwifiex_adapter *adapter) + mwifiex_cleanup_evt_ring(adapter); + + if (card->evtbd_ring_vbase) +- pci_free_consistent(card->dev, card->evtbd_ring_size, +- card->evtbd_ring_vbase, +- card->evtbd_ring_pbase); ++ dma_free_coherent(&card->dev->dev, card->evtbd_ring_size, ++ card->evtbd_ring_vbase, ++ card->evtbd_ring_pbase); + card->evtbd_wrptr = 0; + card->evtbd_rdptr = 0 | reg->evt_rollover_ind; + card->evtbd_ring_size = 0; +@@ -1036,7 +1047,7 @@ static int mwifiex_pcie_alloc_cmdrsp_buf(struct mwifiex_adapter *adapter) + } + skb_put(skb, MWIFIEX_UPLD_SIZE); + if (mwifiex_map_pci_memory(adapter, skb, MWIFIEX_UPLD_SIZE, +- PCI_DMA_FROMDEVICE)) { ++ DMA_FROM_DEVICE)) { + kfree_skb(skb); + return -1; + } +@@ -1060,14 +1071,14 @@ static int mwifiex_pcie_delete_cmdrsp_buf(struct mwifiex_adapter *adapter) + + if (card && card->cmdrsp_buf) { + mwifiex_unmap_pci_memory(adapter, card->cmdrsp_buf, +- PCI_DMA_FROMDEVICE); ++ DMA_FROM_DEVICE); + dev_kfree_skb_any(card->cmdrsp_buf); + card->cmdrsp_buf = NULL; + } + + if (card && card->cmd_buf) { + mwifiex_unmap_pci_memory(adapter, card->cmd_buf, +- PCI_DMA_TODEVICE); ++ DMA_TO_DEVICE); + dev_kfree_skb_any(card->cmd_buf); + card->cmd_buf = NULL; + } +@@ -1082,8 +1093,10 @@ static int mwifiex_pcie_alloc_sleep_cookie_buf(struct mwifiex_adapter *adapter) + struct pcie_service_card *card = adapter->card; + u32 *cookie; + +- card->sleep_cookie_vbase = pci_alloc_consistent(card->dev, sizeof(u32), +- &card->sleep_cookie_pbase); ++ card->sleep_cookie_vbase = dma_alloc_coherent(&card->dev->dev, ++ sizeof(u32), ++ &card->sleep_cookie_pbase, ++ GFP_KERNEL); + if (!card->sleep_cookie_vbase) { + mwifiex_dbg(adapter, ERROR, + "pci_alloc_consistent failed!\n"); +@@ -1111,9 +1124,9 @@ static int mwifiex_pcie_delete_sleep_cookie_buf(struct mwifiex_adapter *adapter) + card = adapter->card; + + if (card && card->sleep_cookie_vbase) { +- pci_free_consistent(card->dev, sizeof(u32), +- card->sleep_cookie_vbase, +- card->sleep_cookie_pbase); ++ dma_free_coherent(&card->dev->dev, sizeof(u32), ++ card->sleep_cookie_vbase, ++ card->sleep_cookie_pbase); + card->sleep_cookie_vbase = NULL; + } + +@@ -1185,7 +1198,7 @@ static int mwifiex_pcie_send_data_complete(struct mwifiex_adapter *adapter) + "SEND COMP: Detach skb %p at txbd_rdidx=%d\n", + skb, wrdoneidx); + mwifiex_unmap_pci_memory(adapter, skb, +- PCI_DMA_TODEVICE); ++ DMA_TO_DEVICE); + + unmap_count++; + +@@ -1278,7 +1291,7 @@ mwifiex_pcie_send_data(struct mwifiex_adapter *adapter, struct sk_buff *skb, + put_unaligned_le16(MWIFIEX_TYPE_DATA, payload + 2); + + if (mwifiex_map_pci_memory(adapter, skb, skb->len, +- PCI_DMA_TODEVICE)) ++ DMA_TO_DEVICE)) + return -1; + + wrindx = (card->txbd_wrptr & reg->tx_mask) >> reg->tx_start_ptr; +@@ -1368,7 +1381,7 @@ mwifiex_pcie_send_data(struct mwifiex_adapter *adapter, struct sk_buff *skb, + + return -EINPROGRESS; + done_unmap: +- mwifiex_unmap_pci_memory(adapter, skb, PCI_DMA_TODEVICE); ++ mwifiex_unmap_pci_memory(adapter, skb, DMA_TO_DEVICE); + card->tx_buf_list[wrindx] = NULL; + atomic_dec(&adapter->tx_hw_pending); + if (reg->pfu_enabled) +@@ -1422,7 +1435,7 @@ static int mwifiex_pcie_process_recv_data(struct mwifiex_adapter *adapter) + if (!skb_data) + return -ENOMEM; + +- mwifiex_unmap_pci_memory(adapter, skb_data, PCI_DMA_FROMDEVICE); ++ mwifiex_unmap_pci_memory(adapter, skb_data, DMA_FROM_DEVICE); + card->rx_buf_list[rd_index] = NULL; + + /* Get data length from interface header - +@@ -1460,7 +1473,7 @@ static int mwifiex_pcie_process_recv_data(struct mwifiex_adapter *adapter) + + if (mwifiex_map_pci_memory(adapter, skb_tmp, + MWIFIEX_RX_DATA_BUF_SIZE, +- PCI_DMA_FROMDEVICE)) ++ DMA_FROM_DEVICE)) + return -1; + + buf_pa = MWIFIEX_SKB_DMA_ADDR(skb_tmp); +@@ -1537,7 +1550,7 @@ mwifiex_pcie_send_boot_cmd(struct mwifiex_adapter *adapter, struct sk_buff *skb) + return -1; + } + +- if (mwifiex_map_pci_memory(adapter, skb, skb->len, PCI_DMA_TODEVICE)) ++ if (mwifiex_map_pci_memory(adapter, skb, skb->len, DMA_TO_DEVICE)) + return -1; + + buf_pa = MWIFIEX_SKB_DMA_ADDR(skb); +@@ -1549,7 +1562,7 @@ mwifiex_pcie_send_boot_cmd(struct mwifiex_adapter *adapter, struct sk_buff *skb) + mwifiex_dbg(adapter, ERROR, + "%s: failed to write download command to boot code.\n", + __func__); +- mwifiex_unmap_pci_memory(adapter, skb, PCI_DMA_TODEVICE); ++ mwifiex_unmap_pci_memory(adapter, skb, DMA_TO_DEVICE); + return -1; + } + +@@ -1561,7 +1574,7 @@ mwifiex_pcie_send_boot_cmd(struct mwifiex_adapter *adapter, struct sk_buff *skb) + mwifiex_dbg(adapter, ERROR, + "%s: failed to write download command to boot code.\n", + __func__); +- mwifiex_unmap_pci_memory(adapter, skb, PCI_DMA_TODEVICE); ++ mwifiex_unmap_pci_memory(adapter, skb, DMA_TO_DEVICE); + return -1; + } + +@@ -1570,7 +1583,7 @@ mwifiex_pcie_send_boot_cmd(struct mwifiex_adapter *adapter, struct sk_buff *skb) + mwifiex_dbg(adapter, ERROR, + "%s: failed to write command len to cmd_size scratch reg\n", + __func__); +- mwifiex_unmap_pci_memory(adapter, skb, PCI_DMA_TODEVICE); ++ mwifiex_unmap_pci_memory(adapter, skb, DMA_TO_DEVICE); + return -1; + } + +@@ -1579,7 +1592,7 @@ mwifiex_pcie_send_boot_cmd(struct mwifiex_adapter *adapter, struct sk_buff *skb) + CPU_INTR_DOOR_BELL)) { + mwifiex_dbg(adapter, ERROR, + "%s: failed to assert door-bell intr\n", __func__); +- mwifiex_unmap_pci_memory(adapter, skb, PCI_DMA_TODEVICE); ++ mwifiex_unmap_pci_memory(adapter, skb, DMA_TO_DEVICE); + return -1; + } + +@@ -1638,7 +1651,7 @@ mwifiex_pcie_send_cmd(struct mwifiex_adapter *adapter, struct sk_buff *skb) + put_unaligned_le16((u16)skb->len, &payload[0]); + put_unaligned_le16(MWIFIEX_TYPE_CMD, &payload[2]); + +- if (mwifiex_map_pci_memory(adapter, skb, skb->len, PCI_DMA_TODEVICE)) ++ if (mwifiex_map_pci_memory(adapter, skb, skb->len, DMA_TO_DEVICE)) + return -1; + + card->cmd_buf = skb; +@@ -1738,17 +1751,16 @@ static int mwifiex_pcie_process_cmd_complete(struct mwifiex_adapter *adapter) + "info: Rx CMD Response\n"); + + if (adapter->curr_cmd) +- mwifiex_unmap_pci_memory(adapter, skb, PCI_DMA_FROMDEVICE); ++ mwifiex_unmap_pci_memory(adapter, skb, DMA_FROM_DEVICE); + else +- pci_dma_sync_single_for_cpu(card->dev, +- MWIFIEX_SKB_DMA_ADDR(skb), +- MWIFIEX_UPLD_SIZE, +- PCI_DMA_FROMDEVICE); ++ dma_sync_single_for_cpu(&card->dev->dev, ++ MWIFIEX_SKB_DMA_ADDR(skb), ++ MWIFIEX_UPLD_SIZE, DMA_FROM_DEVICE); + + /* Unmap the command as a response has been received. */ + if (card->cmd_buf) { + mwifiex_unmap_pci_memory(adapter, card->cmd_buf, +- PCI_DMA_TODEVICE); ++ DMA_TO_DEVICE); + dev_kfree_skb_any(card->cmd_buf); + card->cmd_buf = NULL; + } +@@ -1759,10 +1771,10 @@ static int mwifiex_pcie_process_cmd_complete(struct mwifiex_adapter *adapter) + + if (!adapter->curr_cmd) { + if (adapter->ps_state == PS_STATE_SLEEP_CFM) { +- pci_dma_sync_single_for_device(card->dev, +- MWIFIEX_SKB_DMA_ADDR(skb), +- MWIFIEX_SLEEP_COOKIE_SIZE, +- PCI_DMA_FROMDEVICE); ++ dma_sync_single_for_device(&card->dev->dev, ++ MWIFIEX_SKB_DMA_ADDR(skb), ++ MWIFIEX_SLEEP_COOKIE_SIZE, ++ DMA_FROM_DEVICE); + if (mwifiex_write_reg(adapter, + PCIE_CPU_INT_EVENT, + CPU_INTR_SLEEP_CFM_DONE)) { +@@ -1773,7 +1785,7 @@ static int mwifiex_pcie_process_cmd_complete(struct mwifiex_adapter *adapter) + mwifiex_delay_for_sleep_cookie(adapter, + MWIFIEX_MAX_DELAY_COUNT); + mwifiex_unmap_pci_memory(adapter, skb, +- PCI_DMA_FROMDEVICE); ++ DMA_FROM_DEVICE); + skb_pull(skb, adapter->intf_hdr_len); + while (reg->sleep_cookie && (count++ < 10) && + mwifiex_pcie_ok_to_access_hw(adapter)) +@@ -1789,7 +1801,7 @@ static int mwifiex_pcie_process_cmd_complete(struct mwifiex_adapter *adapter) + min_t(u32, MWIFIEX_SIZE_OF_CMD_BUFFER, skb->len)); + skb_push(skb, adapter->intf_hdr_len); + if (mwifiex_map_pci_memory(adapter, skb, MWIFIEX_UPLD_SIZE, +- PCI_DMA_FROMDEVICE)) ++ DMA_FROM_DEVICE)) + return -1; + } else if (mwifiex_pcie_ok_to_access_hw(adapter)) { + skb_pull(skb, adapter->intf_hdr_len); +@@ -1831,7 +1843,7 @@ static int mwifiex_pcie_cmdrsp_complete(struct mwifiex_adapter *adapter, + card->cmdrsp_buf = skb; + skb_push(card->cmdrsp_buf, adapter->intf_hdr_len); + if (mwifiex_map_pci_memory(adapter, skb, MWIFIEX_UPLD_SIZE, +- PCI_DMA_FROMDEVICE)) ++ DMA_FROM_DEVICE)) + return -1; + } + +@@ -1886,7 +1898,7 @@ static int mwifiex_pcie_process_event_ready(struct mwifiex_adapter *adapter) + mwifiex_dbg(adapter, INFO, + "info: Read Index: %d\n", rdptr); + skb_cmd = card->evt_buf_list[rdptr]; +- mwifiex_unmap_pci_memory(adapter, skb_cmd, PCI_DMA_FROMDEVICE); ++ mwifiex_unmap_pci_memory(adapter, skb_cmd, DMA_FROM_DEVICE); + + /* Take the pointer and set it to event pointer in adapter + and will return back after event handling callback */ +@@ -1966,7 +1978,7 @@ static int mwifiex_pcie_event_complete(struct mwifiex_adapter *adapter, + skb_put(skb, MAX_EVENT_SIZE - skb->len); + if (mwifiex_map_pci_memory(adapter, skb, + MAX_EVENT_SIZE, +- PCI_DMA_FROMDEVICE)) ++ DMA_FROM_DEVICE)) + return -1; + card->evt_buf_list[rdptr] = skb; + desc = card->evtbd_ring[rdptr]; +@@ -2248,7 +2260,7 @@ static int mwifiex_prog_fw_w_helper(struct mwifiex_adapter *adapter, + "interrupt status during fw dnld.\n", + __func__); + mwifiex_unmap_pci_memory(adapter, skb, +- PCI_DMA_TODEVICE); ++ DMA_TO_DEVICE); + ret = -1; + goto done; + } +@@ -2260,12 +2272,12 @@ static int mwifiex_prog_fw_w_helper(struct mwifiex_adapter *adapter, + mwifiex_dbg(adapter, ERROR, "%s: Card failed to ACK download\n", + __func__); + mwifiex_unmap_pci_memory(adapter, skb, +- PCI_DMA_TODEVICE); ++ DMA_TO_DEVICE); + ret = -1; + goto done; + } + +- mwifiex_unmap_pci_memory(adapter, skb, PCI_DMA_TODEVICE); ++ mwifiex_unmap_pci_memory(adapter, skb, DMA_TO_DEVICE); + + offset += txlen; + } while (true); +@@ -2935,13 +2947,13 @@ static int mwifiex_init_pcie(struct mwifiex_adapter *adapter) + + pci_set_master(pdev); + +- ret = pci_set_dma_mask(pdev, DMA_BIT_MASK(32)); ++ ret = dma_set_mask(&pdev->dev, DMA_BIT_MASK(32)); + if (ret) { + pr_err("set_dma_mask(32) failed: %d\n", ret); + goto err_set_dma_mask; + } + +- ret = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(32)); ++ ret = dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(32)); + if (ret) { + pr_err("set_consistent_dma_mask(64) failed\n"); + goto err_set_dma_mask; +diff --git a/drivers/net/wireless/marvell/mwifiex/sta_rx.c b/drivers/net/wireless/marvell/mwifiex/sta_rx.c +index 52a2ce2e78b08..a42b8ff33b23f 100644 +--- a/drivers/net/wireless/marvell/mwifiex/sta_rx.c ++++ b/drivers/net/wireless/marvell/mwifiex/sta_rx.c +@@ -98,6 +98,15 @@ int mwifiex_process_rx_packet(struct mwifiex_private *priv, + rx_pkt_len = le16_to_cpu(local_rx_pd->rx_pkt_length); + rx_pkt_hdr = (void *)local_rx_pd + rx_pkt_off; + ++ if (sizeof(*rx_pkt_hdr) + rx_pkt_off > skb->len) { ++ mwifiex_dbg(priv->adapter, ERROR, ++ "wrong rx packet offset: len=%d, rx_pkt_off=%d\n", ++ skb->len, rx_pkt_off); ++ priv->stats.rx_dropped++; ++ dev_kfree_skb_any(skb); ++ return -1; ++ } ++ + if ((!memcmp(&rx_pkt_hdr->rfc1042_hdr, bridge_tunnel_header, + sizeof(bridge_tunnel_header))) || + (!memcmp(&rx_pkt_hdr->rfc1042_hdr, rfc1042_header, +@@ -206,7 +215,8 @@ int mwifiex_process_sta_rx_packet(struct mwifiex_private *priv, + + rx_pkt_hdr = (void *)local_rx_pd + rx_pkt_offset; + +- if ((rx_pkt_offset + rx_pkt_length) > (u16) skb->len) { ++ if ((rx_pkt_offset + rx_pkt_length) > skb->len || ++ sizeof(rx_pkt_hdr->eth803_hdr) + rx_pkt_offset > skb->len) { + mwifiex_dbg(adapter, ERROR, + "wrong rx packet: len=%d, rx_pkt_offset=%d, rx_pkt_length=%d\n", + skb->len, rx_pkt_offset, rx_pkt_length); +diff --git a/drivers/net/wireless/marvell/mwifiex/tdls.c b/drivers/net/wireless/marvell/mwifiex/tdls.c +index f8f282ce39bd4..17f8379351923 100644 +--- a/drivers/net/wireless/marvell/mwifiex/tdls.c ++++ b/drivers/net/wireless/marvell/mwifiex/tdls.c +@@ -734,6 +734,7 @@ mwifiex_construct_tdls_action_frame(struct mwifiex_private *priv, + int ret; + u16 capab; + struct ieee80211_ht_cap *ht_cap; ++ unsigned int extra; + u8 radio, *pos; + + capab = priv->curr_bss_params.bss_descriptor.cap_info_bitmap; +@@ -752,7 +753,10 @@ mwifiex_construct_tdls_action_frame(struct mwifiex_private *priv, + + switch (action_code) { + case WLAN_PUB_ACTION_TDLS_DISCOVER_RES: +- skb_put(skb, sizeof(mgmt->u.action.u.tdls_discover_resp) + 1); ++ /* See the layout of 'struct ieee80211_mgmt'. */ ++ extra = sizeof(mgmt->u.action.u.tdls_discover_resp) + ++ sizeof(mgmt->u.action.category); ++ skb_put(skb, extra); + mgmt->u.action.category = WLAN_CATEGORY_PUBLIC; + mgmt->u.action.u.tdls_discover_resp.action_code = + WLAN_PUB_ACTION_TDLS_DISCOVER_RES; +@@ -761,8 +765,7 @@ mwifiex_construct_tdls_action_frame(struct mwifiex_private *priv, + mgmt->u.action.u.tdls_discover_resp.capability = + cpu_to_le16(capab); + /* move back for addr4 */ +- memmove(pos + ETH_ALEN, &mgmt->u.action.category, +- sizeof(mgmt->u.action.u.tdls_discover_resp)); ++ memmove(pos + ETH_ALEN, &mgmt->u.action, extra); + /* init address 4 */ + eth_broadcast_addr(pos); + +diff --git a/drivers/net/wireless/marvell/mwifiex/uap_txrx.c b/drivers/net/wireless/marvell/mwifiex/uap_txrx.c +index 354b09c5e8dc0..cb3f72eee230a 100644 +--- a/drivers/net/wireless/marvell/mwifiex/uap_txrx.c ++++ b/drivers/net/wireless/marvell/mwifiex/uap_txrx.c +@@ -115,6 +115,16 @@ static void mwifiex_uap_queue_bridged_pkt(struct mwifiex_private *priv, + return; + } + ++ if (sizeof(*rx_pkt_hdr) + ++ le16_to_cpu(uap_rx_pd->rx_pkt_offset) > skb->len) { ++ mwifiex_dbg(adapter, ERROR, ++ "wrong rx packet offset: len=%d,rx_pkt_offset=%d\n", ++ skb->len, le16_to_cpu(uap_rx_pd->rx_pkt_offset)); ++ priv->stats.rx_dropped++; ++ dev_kfree_skb_any(skb); ++ return; ++ } ++ + if ((!memcmp(&rx_pkt_hdr->rfc1042_hdr, bridge_tunnel_header, + sizeof(bridge_tunnel_header))) || + (!memcmp(&rx_pkt_hdr->rfc1042_hdr, rfc1042_header, +@@ -255,7 +265,15 @@ int mwifiex_handle_uap_rx_forward(struct mwifiex_private *priv, + + if (is_multicast_ether_addr(ra)) { + skb_uap = skb_copy(skb, GFP_ATOMIC); +- mwifiex_uap_queue_bridged_pkt(priv, skb_uap); ++ if (likely(skb_uap)) { ++ mwifiex_uap_queue_bridged_pkt(priv, skb_uap); ++ } else { ++ mwifiex_dbg(adapter, ERROR, ++ "failed to copy skb for uAP\n"); ++ priv->stats.rx_dropped++; ++ dev_kfree_skb_any(skb); ++ return -1; ++ } + } else { + if (mwifiex_get_sta_entry(priv, ra)) { + /* Requeue Intra-BSS packet */ +@@ -383,6 +401,16 @@ int mwifiex_process_uap_rx_packet(struct mwifiex_private *priv, + rx_pkt_type = le16_to_cpu(uap_rx_pd->rx_pkt_type); + rx_pkt_hdr = (void *)uap_rx_pd + le16_to_cpu(uap_rx_pd->rx_pkt_offset); + ++ if (le16_to_cpu(uap_rx_pd->rx_pkt_offset) + ++ sizeof(rx_pkt_hdr->eth803_hdr) > skb->len) { ++ mwifiex_dbg(adapter, ERROR, ++ "wrong rx packet for struct ethhdr: len=%d, offset=%d\n", ++ skb->len, le16_to_cpu(uap_rx_pd->rx_pkt_offset)); ++ priv->stats.rx_dropped++; ++ dev_kfree_skb_any(skb); ++ return 0; ++ } ++ + ether_addr_copy(ta, rx_pkt_hdr->eth803_hdr.h_source); + + if ((le16_to_cpu(uap_rx_pd->rx_pkt_offset) + +diff --git a/drivers/net/wireless/marvell/mwifiex/util.c b/drivers/net/wireless/marvell/mwifiex/util.c +index 3b0d318276811..135b197fb4a36 100644 +--- a/drivers/net/wireless/marvell/mwifiex/util.c ++++ b/drivers/net/wireless/marvell/mwifiex/util.c +@@ -405,11 +405,15 @@ mwifiex_process_mgmt_packet(struct mwifiex_private *priv, + } + + rx_pd = (struct rxpd *)skb->data; ++ pkt_len = le16_to_cpu(rx_pd->rx_pkt_length); ++ if (pkt_len < sizeof(struct ieee80211_hdr) + sizeof(pkt_len)) { ++ mwifiex_dbg(priv->adapter, ERROR, "invalid rx_pkt_length"); ++ return -1; ++ } + + skb_pull(skb, le16_to_cpu(rx_pd->rx_pkt_offset)); + skb_pull(skb, sizeof(pkt_len)); +- +- pkt_len = le16_to_cpu(rx_pd->rx_pkt_length); ++ pkt_len -= sizeof(pkt_len); + + ieee_hdr = (void *)skb->data; + if (ieee80211_is_mgmt(ieee_hdr->frame_control)) { +@@ -422,7 +426,7 @@ mwifiex_process_mgmt_packet(struct mwifiex_private *priv, + skb->data + sizeof(struct ieee80211_hdr), + pkt_len - sizeof(struct ieee80211_hdr)); + +- pkt_len -= ETH_ALEN + sizeof(pkt_len); ++ pkt_len -= ETH_ALEN; + rx_pd->rx_pkt_length = cpu_to_le16(pkt_len); + + cfg80211_rx_mgmt(&priv->wdev, priv->roc_cfg.chan.center_freq, +diff --git a/drivers/ntb/ntb_transport.c b/drivers/ntb/ntb_transport.c +index 3cc0e8ebcdd5c..d1eb76386860f 100644 +--- a/drivers/ntb/ntb_transport.c ++++ b/drivers/ntb/ntb_transport.c +@@ -911,7 +911,7 @@ static int ntb_set_mw(struct ntb_transport_ctx *nt, int num_mw, + return 0; + } + +-static void ntb_qp_link_down_reset(struct ntb_transport_qp *qp) ++static void ntb_qp_link_context_reset(struct ntb_transport_qp *qp) + { + qp->link_is_up = false; + qp->active = false; +@@ -934,6 +934,13 @@ static void ntb_qp_link_down_reset(struct ntb_transport_qp *qp) + qp->tx_async = 0; + } + ++static void ntb_qp_link_down_reset(struct ntb_transport_qp *qp) ++{ ++ ntb_qp_link_context_reset(qp); ++ if (qp->remote_rx_info) ++ qp->remote_rx_info->entry = qp->rx_max_entry - 1; ++} ++ + static void ntb_qp_link_cleanup(struct ntb_transport_qp *qp) + { + struct ntb_transport_ctx *nt = qp->transport; +@@ -1176,7 +1183,7 @@ static int ntb_transport_init_queue(struct ntb_transport_ctx *nt, + qp->ndev = nt->ndev; + qp->client_ready = false; + qp->event_handler = NULL; +- ntb_qp_link_down_reset(qp); ++ ntb_qp_link_context_reset(qp); + + if (mw_num < qp_count % mw_count) + num_qps_mw = qp_count / mw_count + 1; +@@ -2278,9 +2285,13 @@ int ntb_transport_tx_enqueue(struct ntb_transport_qp *qp, void *cb, void *data, + struct ntb_queue_entry *entry; + int rc; + +- if (!qp || !qp->link_is_up || !len) ++ if (!qp || !len) + return -EINVAL; + ++ /* If the qp link is down already, just ignore. */ ++ if (!qp->link_is_up) ++ return 0; ++ + entry = ntb_list_rm(&qp->ntb_tx_free_q_lock, &qp->tx_free_q); + if (!entry) { + qp->tx_err_no_buf++; +@@ -2420,7 +2431,7 @@ unsigned int ntb_transport_tx_free_entry(struct ntb_transport_qp *qp) + unsigned int head = qp->tx_index; + unsigned int tail = qp->remote_rx_info->entry; + +- return tail > head ? tail - head : qp->tx_max_entry + tail - head; ++ return tail >= head ? tail - head : qp->tx_max_entry + tail - head; + } + EXPORT_SYMBOL_GPL(ntb_transport_tx_free_entry); + +diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c +index 5707c309a7545..42acbb3668b2c 100644 +--- a/drivers/of/unittest.c ++++ b/drivers/of/unittest.c +@@ -52,7 +52,7 @@ static void __init of_unittest_find_node_by_name(void) + + np = of_find_node_by_path("/testcase-data"); + name = kasprintf(GFP_KERNEL, "%pOF", np); +- unittest(np && !strcmp("/testcase-data", name), ++ unittest(np && name && !strcmp("/testcase-data", name), + "find /testcase-data failed\n"); + of_node_put(np); + kfree(name); +@@ -63,14 +63,14 @@ static void __init of_unittest_find_node_by_name(void) + + np = of_find_node_by_path("/testcase-data/phandle-tests/consumer-a"); + name = kasprintf(GFP_KERNEL, "%pOF", np); +- unittest(np && !strcmp("/testcase-data/phandle-tests/consumer-a", name), ++ unittest(np && name && !strcmp("/testcase-data/phandle-tests/consumer-a", name), + "find /testcase-data/phandle-tests/consumer-a failed\n"); + of_node_put(np); + kfree(name); + + np = of_find_node_by_path("testcase-alias"); + name = kasprintf(GFP_KERNEL, "%pOF", np); +- unittest(np && !strcmp("/testcase-data", name), ++ unittest(np && name && !strcmp("/testcase-data", name), + "find testcase-alias failed\n"); + of_node_put(np); + kfree(name); +@@ -81,7 +81,7 @@ static void __init of_unittest_find_node_by_name(void) + + np = of_find_node_by_path("testcase-alias/phandle-tests/consumer-a"); + name = kasprintf(GFP_KERNEL, "%pOF", np); +- unittest(np && !strcmp("/testcase-data/phandle-tests/consumer-a", name), ++ unittest(np && name && !strcmp("/testcase-data/phandle-tests/consumer-a", name), + "find testcase-alias/phandle-tests/consumer-a failed\n"); + of_node_put(np); + kfree(name); +@@ -1151,6 +1151,8 @@ static void attach_node_and_children(struct device_node *np) + const char *full_name; + + full_name = kasprintf(GFP_KERNEL, "%pOF", np); ++ if (!full_name) ++ return; + + if (!strcmp(full_name, "/__local_fixups__") || + !strcmp(full_name, "/__fixups__")) { +@@ -1580,7 +1582,7 @@ static int __init of_unittest_apply_revert_overlay_check(int overlay_nr, + } + + /* unittest device must be again in before state */ +- if (of_unittest_device_exists(unittest_nr, PDEV_OVERLAY) != before) { ++ if (of_unittest_device_exists(unittest_nr, ovtype) != before) { + unittest(0, "%s with device @\"%s\" %s\n", + overlay_name_from_nr(overlay_nr), + unittest_path(unittest_nr, ovtype), +diff --git a/drivers/opp/core.c b/drivers/opp/core.c +index 08f5d1c3d6651..e1810c4011b23 100644 +--- a/drivers/opp/core.c ++++ b/drivers/opp/core.c +@@ -1882,7 +1882,7 @@ struct opp_table *dev_pm_opp_attach_genpd(struct device *dev, + + virt_dev = dev_pm_domain_attach_by_name(dev, *name); + if (IS_ERR_OR_NULL(virt_dev)) { +- ret = PTR_ERR(virt_dev) ? : -ENODEV; ++ ret = virt_dev ? PTR_ERR(virt_dev) : -ENODEV; + dev_err(dev, "Couldn't attach to pm_domain: %d\n", ret); + goto err; + } +diff --git a/drivers/parisc/led.c b/drivers/parisc/led.c +index 609c747402d5f..9b33e84e04fc8 100644 +--- a/drivers/parisc/led.c ++++ b/drivers/parisc/led.c +@@ -56,8 +56,8 @@ + static int led_type __read_mostly = -1; + static unsigned char lastleds; /* LED state from most recent update */ + static unsigned int led_heartbeat __read_mostly = 1; +-static unsigned int led_diskio __read_mostly = 1; +-static unsigned int led_lanrxtx __read_mostly = 1; ++static unsigned int led_diskio __read_mostly; ++static unsigned int led_lanrxtx __read_mostly; + static char lcd_text[32] __read_mostly; + static char lcd_text_default[32] __read_mostly; + static int lcd_no_led_support __read_mostly = 0; /* KittyHawk doesn't support LED on its LCD */ +diff --git a/drivers/pci/hotplug/pciehp_hpc.c b/drivers/pci/hotplug/pciehp_hpc.c +index 651664fe4058d..bdbe01d4d9e90 100644 +--- a/drivers/pci/hotplug/pciehp_hpc.c ++++ b/drivers/pci/hotplug/pciehp_hpc.c +@@ -293,17 +293,11 @@ int pciehp_check_link_status(struct controller *ctrl) + static int __pciehp_link_set(struct controller *ctrl, bool enable) + { + struct pci_dev *pdev = ctrl_dev(ctrl); +- u16 lnk_ctrl; + +- pcie_capability_read_word(pdev, PCI_EXP_LNKCTL, &lnk_ctrl); ++ pcie_capability_clear_and_set_word(pdev, PCI_EXP_LNKCTL, ++ PCI_EXP_LNKCTL_LD, ++ enable ? 0 : PCI_EXP_LNKCTL_LD); + +- if (enable) +- lnk_ctrl &= ~PCI_EXP_LNKCTL_LD; +- else +- lnk_ctrl |= PCI_EXP_LNKCTL_LD; +- +- pcie_capability_write_word(pdev, PCI_EXP_LNKCTL, lnk_ctrl); +- ctrl_dbg(ctrl, "%s: lnk_ctrl = %x\n", __func__, lnk_ctrl); + return 0; + } + +diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c +index 55270180ae081..ee51e433fdedb 100644 +--- a/drivers/pci/pcie/aspm.c ++++ b/drivers/pci/pcie/aspm.c +@@ -257,7 +257,7 @@ static int pcie_retrain_link(struct pcie_link_state *link) + static void pcie_aspm_configure_common_clock(struct pcie_link_state *link) + { + int same_clock = 1; +- u16 reg16, parent_reg, child_reg[8]; ++ u16 reg16, ccc, parent_old_ccc, child_old_ccc[8]; + struct pci_dev *child, *parent = link->pdev; + struct pci_bus *linkbus = parent->subordinate; + /* +@@ -279,6 +279,7 @@ static void pcie_aspm_configure_common_clock(struct pcie_link_state *link) + + /* Port might be already in common clock mode */ + pcie_capability_read_word(parent, PCI_EXP_LNKCTL, ®16); ++ parent_old_ccc = reg16 & PCI_EXP_LNKCTL_CCC; + if (same_clock && (reg16 & PCI_EXP_LNKCTL_CCC)) { + bool consistent = true; + +@@ -295,34 +296,29 @@ static void pcie_aspm_configure_common_clock(struct pcie_link_state *link) + pci_warn(parent, "ASPM: current common clock configuration is broken, reconfiguring\n"); + } + ++ ccc = same_clock ? PCI_EXP_LNKCTL_CCC : 0; + /* Configure downstream component, all functions */ + list_for_each_entry(child, &linkbus->devices, bus_list) { + pcie_capability_read_word(child, PCI_EXP_LNKCTL, ®16); +- child_reg[PCI_FUNC(child->devfn)] = reg16; +- if (same_clock) +- reg16 |= PCI_EXP_LNKCTL_CCC; +- else +- reg16 &= ~PCI_EXP_LNKCTL_CCC; +- pcie_capability_write_word(child, PCI_EXP_LNKCTL, reg16); ++ child_old_ccc[PCI_FUNC(child->devfn)] = reg16 & PCI_EXP_LNKCTL_CCC; ++ pcie_capability_clear_and_set_word(child, PCI_EXP_LNKCTL, ++ PCI_EXP_LNKCTL_CCC, ccc); + } + + /* Configure upstream component */ +- pcie_capability_read_word(parent, PCI_EXP_LNKCTL, ®16); +- parent_reg = reg16; +- if (same_clock) +- reg16 |= PCI_EXP_LNKCTL_CCC; +- else +- reg16 &= ~PCI_EXP_LNKCTL_CCC; +- pcie_capability_write_word(parent, PCI_EXP_LNKCTL, reg16); ++ pcie_capability_clear_and_set_word(parent, PCI_EXP_LNKCTL, ++ PCI_EXP_LNKCTL_CCC, ccc); + + if (pcie_retrain_link(link)) { + + /* Training failed. Restore common clock configurations */ + pci_err(parent, "ASPM: Could not configure common clock\n"); + list_for_each_entry(child, &linkbus->devices, bus_list) +- pcie_capability_write_word(child, PCI_EXP_LNKCTL, +- child_reg[PCI_FUNC(child->devfn)]); +- pcie_capability_write_word(parent, PCI_EXP_LNKCTL, parent_reg); ++ pcie_capability_clear_and_set_word(child, PCI_EXP_LNKCTL, ++ PCI_EXP_LNKCTL_CCC, ++ child_old_ccc[PCI_FUNC(child->devfn)]); ++ pcie_capability_clear_and_set_word(parent, PCI_EXP_LNKCTL, ++ PCI_EXP_LNKCTL_CCC, parent_old_ccc); + } + } + +diff --git a/drivers/perf/arm_smmuv3_pmu.c b/drivers/perf/arm_smmuv3_pmu.c +index 0b6af77196418..de85e9191947a 100644 +--- a/drivers/perf/arm_smmuv3_pmu.c ++++ b/drivers/perf/arm_smmuv3_pmu.c +@@ -95,6 +95,7 @@ + #define SMMU_PMCG_PA_SHIFT 12 + + #define SMMU_PMCG_EVCNTR_RDONLY BIT(0) ++#define SMMU_PMCG_HARDEN_DISABLE BIT(1) + + static int cpuhp_state_num; + +@@ -138,6 +139,20 @@ static inline void smmu_pmu_enable(struct pmu *pmu) + writel(SMMU_PMCG_CR_ENABLE, smmu_pmu->reg_base + SMMU_PMCG_CR); + } + ++static int smmu_pmu_apply_event_filter(struct smmu_pmu *smmu_pmu, ++ struct perf_event *event, int idx); ++ ++static inline void smmu_pmu_enable_quirk_hip08_09(struct pmu *pmu) ++{ ++ struct smmu_pmu *smmu_pmu = to_smmu_pmu(pmu); ++ unsigned int idx; ++ ++ for_each_set_bit(idx, smmu_pmu->used_counters, smmu_pmu->num_counters) ++ smmu_pmu_apply_event_filter(smmu_pmu, smmu_pmu->events[idx], idx); ++ ++ smmu_pmu_enable(pmu); ++} ++ + static inline void smmu_pmu_disable(struct pmu *pmu) + { + struct smmu_pmu *smmu_pmu = to_smmu_pmu(pmu); +@@ -146,6 +161,22 @@ static inline void smmu_pmu_disable(struct pmu *pmu) + writel(0, smmu_pmu->reg_base + SMMU_PMCG_IRQ_CTRL); + } + ++static inline void smmu_pmu_disable_quirk_hip08_09(struct pmu *pmu) ++{ ++ struct smmu_pmu *smmu_pmu = to_smmu_pmu(pmu); ++ unsigned int idx; ++ ++ /* ++ * The global disable of PMU sometimes fail to stop the counting. ++ * Harden this by writing an invalid event type to each used counter ++ * to forcibly stop counting. ++ */ ++ for_each_set_bit(idx, smmu_pmu->used_counters, smmu_pmu->num_counters) ++ writel(0xffff, smmu_pmu->reg_base + SMMU_PMCG_EVTYPER(idx)); ++ ++ smmu_pmu_disable(pmu); ++} ++ + static inline void smmu_pmu_counter_set_value(struct smmu_pmu *smmu_pmu, + u32 idx, u64 value) + { +@@ -719,7 +750,10 @@ static void smmu_pmu_get_acpi_options(struct smmu_pmu *smmu_pmu) + switch (model) { + case IORT_SMMU_V3_PMCG_HISI_HIP08: + /* HiSilicon Erratum 162001800 */ +- smmu_pmu->options |= SMMU_PMCG_EVCNTR_RDONLY; ++ smmu_pmu->options |= SMMU_PMCG_EVCNTR_RDONLY | SMMU_PMCG_HARDEN_DISABLE; ++ break; ++ case IORT_SMMU_V3_PMCG_HISI_HIP09: ++ smmu_pmu->options |= SMMU_PMCG_HARDEN_DISABLE; + break; + } + +@@ -808,6 +842,16 @@ static int smmu_pmu_probe(struct platform_device *pdev) + + smmu_pmu_get_acpi_options(smmu_pmu); + ++ /* ++ * For platforms suffer this quirk, the PMU disable sometimes fails to ++ * stop the counters. This will leads to inaccurate or error counting. ++ * Forcibly disable the counters with these quirk handler. ++ */ ++ if (smmu_pmu->options & SMMU_PMCG_HARDEN_DISABLE) { ++ smmu_pmu->pmu.pmu_enable = smmu_pmu_enable_quirk_hip08_09; ++ smmu_pmu->pmu.pmu_disable = smmu_pmu_disable_quirk_hip08_09; ++ } ++ + /* Pick one CPU to be the preferred one to use */ + smmu_pmu->on_cpu = raw_smp_processor_id(); + WARN_ON(irq_set_affinity_hint(smmu_pmu->irq, +diff --git a/drivers/perf/fsl_imx8_ddr_perf.c b/drivers/perf/fsl_imx8_ddr_perf.c +index 912a220a9db92..a0e45c726bbf0 100644 +--- a/drivers/perf/fsl_imx8_ddr_perf.c ++++ b/drivers/perf/fsl_imx8_ddr_perf.c +@@ -77,6 +77,7 @@ struct ddr_pmu { + const struct fsl_ddr_devtype_data *devtype_data; + int irq; + int id; ++ int active_counter; + }; + + static ssize_t ddr_perf_cpumask_show(struct device *dev, +@@ -353,6 +354,10 @@ static void ddr_perf_event_start(struct perf_event *event, int flags) + + ddr_perf_counter_enable(pmu, event->attr.config, counter, true); + ++ if (!pmu->active_counter++) ++ ddr_perf_counter_enable(pmu, EVENT_CYCLES_ID, ++ EVENT_CYCLES_COUNTER, true); ++ + hwc->state = 0; + } + +@@ -407,6 +412,10 @@ static void ddr_perf_event_stop(struct perf_event *event, int flags) + ddr_perf_counter_enable(pmu, event->attr.config, counter, false); + ddr_perf_event_update(event); + ++ if (!--pmu->active_counter) ++ ddr_perf_counter_enable(pmu, EVENT_CYCLES_ID, ++ EVENT_CYCLES_COUNTER, false); ++ + hwc->state |= PERF_HES_STOPPED; + } + +@@ -425,25 +434,10 @@ static void ddr_perf_event_del(struct perf_event *event, int flags) + + static void ddr_perf_pmu_enable(struct pmu *pmu) + { +- struct ddr_pmu *ddr_pmu = to_ddr_pmu(pmu); +- +- /* enable cycle counter if cycle is not active event list */ +- if (ddr_pmu->events[EVENT_CYCLES_COUNTER] == NULL) +- ddr_perf_counter_enable(ddr_pmu, +- EVENT_CYCLES_ID, +- EVENT_CYCLES_COUNTER, +- true); + } + + static void ddr_perf_pmu_disable(struct pmu *pmu) + { +- struct ddr_pmu *ddr_pmu = to_ddr_pmu(pmu); +- +- if (ddr_pmu->events[EVENT_CYCLES_COUNTER] == NULL) +- ddr_perf_counter_enable(ddr_pmu, +- EVENT_CYCLES_ID, +- EVENT_CYCLES_COUNTER, +- false); + } + + static int ddr_perf_init(struct ddr_pmu *pmu, void __iomem *base, +diff --git a/drivers/phy/rockchip/phy-rockchip-inno-hdmi.c b/drivers/phy/rockchip/phy-rockchip-inno-hdmi.c +index 9ca20c947283d..2b0f5f2b4f339 100644 +--- a/drivers/phy/rockchip/phy-rockchip-inno-hdmi.c ++++ b/drivers/phy/rockchip/phy-rockchip-inno-hdmi.c +@@ -745,10 +745,12 @@ unsigned long inno_hdmi_phy_rk3328_clk_recalc_rate(struct clk_hw *hw, + do_div(vco, (nd * (no_a == 1 ? no_b : no_a) * no_d * 2)); + } + +- inno->pixclock = vco; +- dev_dbg(inno->dev, "%s rate %lu\n", __func__, inno->pixclock); ++ inno->pixclock = DIV_ROUND_CLOSEST((unsigned long)vco, 1000) * 1000; + +- return vco; ++ dev_dbg(inno->dev, "%s rate %lu vco %llu\n", ++ __func__, inno->pixclock, vco); ++ ++ return inno->pixclock; + } + + static long inno_hdmi_phy_rk3328_clk_round_rate(struct clk_hw *hw, +@@ -790,8 +792,8 @@ static int inno_hdmi_phy_rk3328_clk_set_rate(struct clk_hw *hw, + RK3328_PRE_PLL_POWER_DOWN); + + /* Configure pre-pll */ +- inno_update_bits(inno, 0xa0, RK3228_PCLK_VCO_DIV_5_MASK, +- RK3228_PCLK_VCO_DIV_5(cfg->vco_div_5_en)); ++ inno_update_bits(inno, 0xa0, RK3328_PCLK_VCO_DIV_5_MASK, ++ RK3328_PCLK_VCO_DIV_5(cfg->vco_div_5_en)); + inno_write(inno, 0xa1, RK3328_PRE_PLL_PRE_DIV(cfg->prediv)); + + val = RK3328_SPREAD_SPECTRUM_MOD_DISABLE; +@@ -1021,9 +1023,10 @@ inno_hdmi_phy_rk3328_power_on(struct inno_hdmi_phy *inno, + + inno_write(inno, 0xac, RK3328_POST_PLL_FB_DIV_7_0(cfg->fbdiv)); + if (cfg->postdiv == 1) { +- inno_write(inno, 0xaa, RK3328_POST_PLL_REFCLK_SEL_TMDS); + inno_write(inno, 0xab, RK3328_POST_PLL_FB_DIV_8(cfg->fbdiv) | + RK3328_POST_PLL_PRE_DIV(cfg->prediv)); ++ inno_write(inno, 0xaa, RK3328_POST_PLL_REFCLK_SEL_TMDS | ++ RK3328_POST_PLL_POWER_DOWN); + } else { + v = (cfg->postdiv / 2) - 1; + v &= RK3328_POST_PLL_POST_DIV_MASK; +@@ -1031,7 +1034,8 @@ inno_hdmi_phy_rk3328_power_on(struct inno_hdmi_phy *inno, + inno_write(inno, 0xab, RK3328_POST_PLL_FB_DIV_8(cfg->fbdiv) | + RK3328_POST_PLL_PRE_DIV(cfg->prediv)); + inno_write(inno, 0xaa, RK3328_POST_PLL_POST_DIV_ENABLE | +- RK3328_POST_PLL_REFCLK_SEL_TMDS); ++ RK3328_POST_PLL_REFCLK_SEL_TMDS | ++ RK3328_POST_PLL_POWER_DOWN); + } + + for (v = 0; v < 14; v++) +diff --git a/drivers/pinctrl/pinctrl-amd.c b/drivers/pinctrl/pinctrl-amd.c +index 2415085eadeda..6dbaf096854dd 100644 +--- a/drivers/pinctrl/pinctrl-amd.c ++++ b/drivers/pinctrl/pinctrl-amd.c +@@ -659,7 +659,7 @@ static int amd_pinconf_get(struct pinctrl_dev *pctldev, + break; + + default: +- dev_err(&gpio_dev->pdev->dev, "Invalid config param %04x\n", ++ dev_dbg(&gpio_dev->pdev->dev, "Invalid config param %04x\n", + param); + return -ENOTSUPP; + } +@@ -712,7 +712,7 @@ static int amd_pinconf_set(struct pinctrl_dev *pctldev, unsigned int pin, + break; + + default: +- dev_err(&gpio_dev->pdev->dev, ++ dev_dbg(&gpio_dev->pdev->dev, + "Invalid config param %04x\n", param); + ret = -ENOTSUPP; + } +diff --git a/drivers/platform/mellanox/mlxbf-tmfifo.c b/drivers/platform/mellanox/mlxbf-tmfifo.c +index 92bda873d44a4..194f3205e5597 100644 +--- a/drivers/platform/mellanox/mlxbf-tmfifo.c ++++ b/drivers/platform/mellanox/mlxbf-tmfifo.c +@@ -56,6 +56,7 @@ struct mlxbf_tmfifo; + * @vq: pointer to the virtio virtqueue + * @desc: current descriptor of the pending packet + * @desc_head: head descriptor of the pending packet ++ * @drop_desc: dummy desc for packet dropping + * @cur_len: processed length of the current descriptor + * @rem_len: remaining length of the pending packet + * @pkt_len: total length of the pending packet +@@ -72,6 +73,7 @@ struct mlxbf_tmfifo_vring { + struct virtqueue *vq; + struct vring_desc *desc; + struct vring_desc *desc_head; ++ struct vring_desc drop_desc; + int cur_len; + int rem_len; + u32 pkt_len; +@@ -83,6 +85,14 @@ struct mlxbf_tmfifo_vring { + struct mlxbf_tmfifo *fifo; + }; + ++/* Check whether vring is in drop mode. */ ++#define IS_VRING_DROP(_r) ({ \ ++ typeof(_r) (r) = (_r); \ ++ (r->desc_head == &r->drop_desc ? true : false); }) ++ ++/* A stub length to drop maximum length packet. */ ++#define VRING_DROP_DESC_MAX_LEN GENMASK(15, 0) ++ + /* Interrupt types. */ + enum { + MLXBF_TM_RX_LWM_IRQ, +@@ -195,7 +205,7 @@ static u8 mlxbf_tmfifo_net_default_mac[ETH_ALEN] = { + static efi_char16_t mlxbf_tmfifo_efi_name[] = L"RshimMacAddr"; + + /* Maximum L2 header length. */ +-#define MLXBF_TMFIFO_NET_L2_OVERHEAD 36 ++#define MLXBF_TMFIFO_NET_L2_OVERHEAD (ETH_HLEN + VLAN_HLEN) + + /* Supported virtio-net features. */ + #define MLXBF_TMFIFO_NET_FEATURES \ +@@ -243,6 +253,7 @@ static int mlxbf_tmfifo_alloc_vrings(struct mlxbf_tmfifo *fifo, + vring->align = SMP_CACHE_BYTES; + vring->index = i; + vring->vdev_id = tm_vdev->vdev.id.device; ++ vring->drop_desc.len = VRING_DROP_DESC_MAX_LEN; + dev = &tm_vdev->vdev.dev; + + size = vring_size(vring->num, vring->align); +@@ -348,7 +359,7 @@ static u32 mlxbf_tmfifo_get_pkt_len(struct mlxbf_tmfifo_vring *vring, + return len; + } + +-static void mlxbf_tmfifo_release_pending_pkt(struct mlxbf_tmfifo_vring *vring) ++static void mlxbf_tmfifo_release_pkt(struct mlxbf_tmfifo_vring *vring) + { + struct vring_desc *desc_head; + u32 len = 0; +@@ -577,19 +588,25 @@ static void mlxbf_tmfifo_rxtx_word(struct mlxbf_tmfifo_vring *vring, + + if (vring->cur_len + sizeof(u64) <= len) { + /* The whole word. */ +- if (is_rx) +- memcpy(addr + vring->cur_len, &data, sizeof(u64)); +- else +- memcpy(&data, addr + vring->cur_len, sizeof(u64)); ++ if (!IS_VRING_DROP(vring)) { ++ if (is_rx) ++ memcpy(addr + vring->cur_len, &data, ++ sizeof(u64)); ++ else ++ memcpy(&data, addr + vring->cur_len, ++ sizeof(u64)); ++ } + vring->cur_len += sizeof(u64); + } else { + /* Leftover bytes. */ +- if (is_rx) +- memcpy(addr + vring->cur_len, &data, +- len - vring->cur_len); +- else +- memcpy(&data, addr + vring->cur_len, +- len - vring->cur_len); ++ if (!IS_VRING_DROP(vring)) { ++ if (is_rx) ++ memcpy(addr + vring->cur_len, &data, ++ len - vring->cur_len); ++ else ++ memcpy(&data, addr + vring->cur_len, ++ len - vring->cur_len); ++ } + vring->cur_len = len; + } + +@@ -606,13 +623,14 @@ static void mlxbf_tmfifo_rxtx_word(struct mlxbf_tmfifo_vring *vring, + * flag is set. + */ + static void mlxbf_tmfifo_rxtx_header(struct mlxbf_tmfifo_vring *vring, +- struct vring_desc *desc, ++ struct vring_desc **desc, + bool is_rx, bool *vring_change) + { + struct mlxbf_tmfifo *fifo = vring->fifo; + struct virtio_net_config *config; + struct mlxbf_tmfifo_msg_hdr hdr; + int vdev_id, hdr_len; ++ bool drop_rx = false; + + /* Read/Write packet header. */ + if (is_rx) { +@@ -628,9 +646,12 @@ static void mlxbf_tmfifo_rxtx_header(struct mlxbf_tmfifo_vring *vring, + vdev_id = VIRTIO_ID_NET; + hdr_len = sizeof(struct virtio_net_hdr); + config = &fifo->vdev[vdev_id]->config.net; +- if (ntohs(hdr.len) > config->mtu + +- MLXBF_TMFIFO_NET_L2_OVERHEAD) +- return; ++ /* A legacy-only interface for now. */ ++ if (ntohs(hdr.len) > ++ __virtio16_to_cpu(virtio_legacy_is_little_endian(), ++ config->mtu) + ++ MLXBF_TMFIFO_NET_L2_OVERHEAD) ++ drop_rx = true; + } else { + vdev_id = VIRTIO_ID_CONSOLE; + hdr_len = 0; +@@ -645,16 +666,25 @@ static void mlxbf_tmfifo_rxtx_header(struct mlxbf_tmfifo_vring *vring, + + if (!tm_dev2) + return; +- vring->desc = desc; ++ vring->desc = *desc; + vring = &tm_dev2->vrings[MLXBF_TMFIFO_VRING_RX]; + *vring_change = true; + } ++ ++ if (drop_rx && !IS_VRING_DROP(vring)) { ++ if (vring->desc_head) ++ mlxbf_tmfifo_release_pkt(vring); ++ *desc = &vring->drop_desc; ++ vring->desc_head = *desc; ++ vring->desc = *desc; ++ } ++ + vring->pkt_len = ntohs(hdr.len) + hdr_len; + } else { + /* Network virtio has an extra header. */ + hdr_len = (vring->vdev_id == VIRTIO_ID_NET) ? + sizeof(struct virtio_net_hdr) : 0; +- vring->pkt_len = mlxbf_tmfifo_get_pkt_len(vring, desc); ++ vring->pkt_len = mlxbf_tmfifo_get_pkt_len(vring, *desc); + hdr.type = (vring->vdev_id == VIRTIO_ID_NET) ? + VIRTIO_ID_NET : VIRTIO_ID_CONSOLE; + hdr.len = htons(vring->pkt_len - hdr_len); +@@ -687,15 +717,23 @@ static bool mlxbf_tmfifo_rxtx_one_desc(struct mlxbf_tmfifo_vring *vring, + /* Get the descriptor of the next packet. */ + if (!vring->desc) { + desc = mlxbf_tmfifo_get_next_pkt(vring, is_rx); +- if (!desc) +- return false; ++ if (!desc) { ++ /* Drop next Rx packet to avoid stuck. */ ++ if (is_rx) { ++ desc = &vring->drop_desc; ++ vring->desc_head = desc; ++ vring->desc = desc; ++ } else { ++ return false; ++ } ++ } + } else { + desc = vring->desc; + } + + /* Beginning of a packet. Start to Rx/Tx packet header. */ + if (vring->pkt_len == 0) { +- mlxbf_tmfifo_rxtx_header(vring, desc, is_rx, &vring_change); ++ mlxbf_tmfifo_rxtx_header(vring, &desc, is_rx, &vring_change); + (*avail)--; + + /* Return if new packet is for another ring. */ +@@ -721,17 +759,24 @@ static bool mlxbf_tmfifo_rxtx_one_desc(struct mlxbf_tmfifo_vring *vring, + vring->rem_len -= len; + + /* Get the next desc on the chain. */ +- if (vring->rem_len > 0 && ++ if (!IS_VRING_DROP(vring) && vring->rem_len > 0 && + (virtio16_to_cpu(vdev, desc->flags) & VRING_DESC_F_NEXT)) { + idx = virtio16_to_cpu(vdev, desc->next); + desc = &vr->desc[idx]; + goto mlxbf_tmfifo_desc_done; + } + +- /* Done and release the pending packet. */ +- mlxbf_tmfifo_release_pending_pkt(vring); ++ /* Done and release the packet. */ + desc = NULL; + fifo->vring[is_rx] = NULL; ++ if (!IS_VRING_DROP(vring)) { ++ mlxbf_tmfifo_release_pkt(vring); ++ } else { ++ vring->pkt_len = 0; ++ vring->desc_head = NULL; ++ vring->desc = NULL; ++ return false; ++ } + + /* + * Make sure the load/store are in order before +@@ -865,6 +910,7 @@ static bool mlxbf_tmfifo_virtio_notify(struct virtqueue *vq) + tm_vdev = fifo->vdev[VIRTIO_ID_CONSOLE]; + mlxbf_tmfifo_console_output(tm_vdev, vring); + spin_unlock_irqrestore(&fifo->spin_lock[0], flags); ++ set_bit(MLXBF_TM_TX_LWM_IRQ, &fifo->pend_events); + } else if (test_and_set_bit(MLXBF_TM_TX_LWM_IRQ, + &fifo->pend_events)) { + return true; +@@ -910,7 +956,7 @@ static void mlxbf_tmfifo_virtio_del_vqs(struct virtio_device *vdev) + + /* Release the pending packet. */ + if (vring->desc) +- mlxbf_tmfifo_release_pending_pkt(vring); ++ mlxbf_tmfifo_release_pkt(vring); + vq = vring->vq; + if (vq) { + vring->vq = NULL; +@@ -1240,8 +1286,12 @@ static int mlxbf_tmfifo_probe(struct platform_device *pdev) + + /* Create the network vdev. */ + memset(&net_config, 0, sizeof(net_config)); +- net_config.mtu = ETH_DATA_LEN; +- net_config.status = VIRTIO_NET_S_LINK_UP; ++ ++ /* A legacy-only interface for now. */ ++ net_config.mtu = __cpu_to_virtio16(virtio_legacy_is_little_endian(), ++ ETH_DATA_LEN); ++ net_config.status = __cpu_to_virtio16(virtio_legacy_is_little_endian(), ++ VIRTIO_NET_S_LINK_UP); + mlxbf_tmfifo_get_cfg_mac(net_config.mac); + rc = mlxbf_tmfifo_create_vdev(dev, fifo, VIRTIO_ID_NET, + MLXBF_TMFIFO_NET_FEATURES, &net_config, +diff --git a/drivers/platform/x86/huawei-wmi.c b/drivers/platform/x86/huawei-wmi.c +index 195a7f3638cb1..e27f551a9afa4 100644 +--- a/drivers/platform/x86/huawei-wmi.c ++++ b/drivers/platform/x86/huawei-wmi.c +@@ -41,6 +41,8 @@ static const struct key_entry huawei_wmi_keymap[] = { + { KE_IGNORE, 0x293, { KEY_KBDILLUMTOGGLE } }, + { KE_IGNORE, 0x294, { KEY_KBDILLUMUP } }, + { KE_IGNORE, 0x295, { KEY_KBDILLUMUP } }, ++ // Ignore Ambient Light Sensoring ++ { KE_KEY, 0x2c1, { KEY_RESERVED } }, + { KE_END, 0 } + }; + +diff --git a/drivers/platform/x86/intel-hid.c b/drivers/platform/x86/intel-hid.c +index 164bebbfea214..050f8f7970374 100644 +--- a/drivers/platform/x86/intel-hid.c ++++ b/drivers/platform/x86/intel-hid.c +@@ -449,7 +449,7 @@ static bool button_array_present(struct platform_device *device) + static int intel_hid_probe(struct platform_device *device) + { + acpi_handle handle = ACPI_HANDLE(&device->dev); +- unsigned long long mode; ++ unsigned long long mode, dummy; + struct intel_hid_priv *priv; + acpi_status status; + int err; +@@ -501,18 +501,15 @@ static int intel_hid_probe(struct platform_device *device) + if (err) + goto err_remove_notify; + +- if (priv->array) { +- unsigned long long dummy; ++ intel_button_array_enable(&device->dev, true); + +- intel_button_array_enable(&device->dev, true); +- +- /* Call button load method to enable HID power button */ +- if (!intel_hid_evaluate_method(handle, INTEL_HID_DSM_BTNL_FN, +- &dummy)) { +- dev_warn(&device->dev, +- "failed to enable HID power button\n"); +- } +- } ++ /* ++ * Call button load method to enable HID power button ++ * Always do this since it activates events on some devices without ++ * a button array too. ++ */ ++ if (!intel_hid_evaluate_method(handle, INTEL_HID_DSM_BTNL_FN, &dummy)) ++ dev_warn(&device->dev, "failed to enable HID power button\n"); + + device_init_wakeup(&device->dev, true); + /* +diff --git a/drivers/pwm/pwm-lpc32xx.c b/drivers/pwm/pwm-lpc32xx.c +index 522f862eca526..504a8f506195a 100644 +--- a/drivers/pwm/pwm-lpc32xx.c ++++ b/drivers/pwm/pwm-lpc32xx.c +@@ -51,10 +51,10 @@ static int lpc32xx_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm, + if (duty_cycles > 255) + duty_cycles = 255; + +- val = readl(lpc32xx->base + (pwm->hwpwm << 2)); ++ val = readl(lpc32xx->base); + val &= ~0xFFFF; + val |= (period_cycles << 8) | duty_cycles; +- writel(val, lpc32xx->base + (pwm->hwpwm << 2)); ++ writel(val, lpc32xx->base); + + return 0; + } +@@ -69,9 +69,9 @@ static int lpc32xx_pwm_enable(struct pwm_chip *chip, struct pwm_device *pwm) + if (ret) + return ret; + +- val = readl(lpc32xx->base + (pwm->hwpwm << 2)); ++ val = readl(lpc32xx->base); + val |= PWM_ENABLE; +- writel(val, lpc32xx->base + (pwm->hwpwm << 2)); ++ writel(val, lpc32xx->base); + + return 0; + } +@@ -81,9 +81,9 @@ static void lpc32xx_pwm_disable(struct pwm_chip *chip, struct pwm_device *pwm) + struct lpc32xx_pwm_chip *lpc32xx = to_lpc32xx_pwm_chip(chip); + u32 val; + +- val = readl(lpc32xx->base + (pwm->hwpwm << 2)); ++ val = readl(lpc32xx->base); + val &= ~PWM_ENABLE; +- writel(val, lpc32xx->base + (pwm->hwpwm << 2)); ++ writel(val, lpc32xx->base); + + clk_disable_unprepare(lpc32xx->clk); + } +@@ -121,9 +121,9 @@ static int lpc32xx_pwm_probe(struct platform_device *pdev) + lpc32xx->chip.base = -1; + + /* If PWM is disabled, configure the output to the default value */ +- val = readl(lpc32xx->base + (lpc32xx->chip.pwms[0].hwpwm << 2)); ++ val = readl(lpc32xx->base); + val &= ~PWM_PIN_LEVEL; +- writel(val, lpc32xx->base + (lpc32xx->chip.pwms[0].hwpwm << 2)); ++ writel(val, lpc32xx->base); + + ret = pwmchip_add(&lpc32xx->chip); + if (ret < 0) { +diff --git a/drivers/rpmsg/qcom_glink_native.c b/drivers/rpmsg/qcom_glink_native.c +index 11ba44dc551e4..f65db95e78aa4 100644 +--- a/drivers/rpmsg/qcom_glink_native.c ++++ b/drivers/rpmsg/qcom_glink_native.c +@@ -222,6 +222,10 @@ static struct glink_channel *qcom_glink_alloc_channel(struct qcom_glink *glink, + + channel->glink = glink; + channel->name = kstrdup(name, GFP_KERNEL); ++ if (!channel->name) { ++ kfree(channel); ++ return ERR_PTR(-ENOMEM); ++ } + + init_completion(&channel->open_req); + init_completion(&channel->open_ack); +diff --git a/drivers/rtc/rtc-ds1685.c b/drivers/rtc/rtc-ds1685.c +index 184e4a3e2bef8..48a341a25c8ff 100644 +--- a/drivers/rtc/rtc-ds1685.c ++++ b/drivers/rtc/rtc-ds1685.c +@@ -1437,7 +1437,7 @@ ds1685_rtc_poweroff(struct platform_device *pdev) + unreachable(); + } + } +-EXPORT_SYMBOL(ds1685_rtc_poweroff); ++EXPORT_SYMBOL_GPL(ds1685_rtc_poweroff); + /* ----------------------------------------------------------------------- */ + + +diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c +index 187565830b5b4..58027cdc58e3e 100644 +--- a/drivers/s390/block/dasd.c ++++ b/drivers/s390/block/dasd.c +@@ -2985,41 +2985,32 @@ static void _dasd_wake_block_flush_cb(struct dasd_ccw_req *cqr, void *data) + * Requeue a request back to the block request queue + * only works for block requests + */ +-static int _dasd_requeue_request(struct dasd_ccw_req *cqr) ++static void _dasd_requeue_request(struct dasd_ccw_req *cqr) + { +- struct dasd_block *block = cqr->block; + struct request *req; + +- if (!block) +- return -EINVAL; + /* + * If the request is an ERP request there is nothing to requeue. + * This will be done with the remaining original request. + */ + if (cqr->refers) +- return 0; ++ return; + spin_lock_irq(&cqr->dq->lock); + req = (struct request *) cqr->callback_data; + blk_mq_requeue_request(req, true); + spin_unlock_irq(&cqr->dq->lock); + +- return 0; ++ return; + } + +-/* +- * Go through all request on the dasd_block request queue, cancel them +- * on the respective dasd_device, and return them to the generic +- * block layer. +- */ +-static int dasd_flush_block_queue(struct dasd_block *block) ++static int _dasd_requests_to_flushqueue(struct dasd_block *block, ++ struct list_head *flush_queue) + { + struct dasd_ccw_req *cqr, *n; +- int rc, i; +- struct list_head flush_queue; + unsigned long flags; ++ int rc, i; + +- INIT_LIST_HEAD(&flush_queue); +- spin_lock_bh(&block->queue_lock); ++ spin_lock_irqsave(&block->queue_lock, flags); + rc = 0; + restart: + list_for_each_entry_safe(cqr, n, &block->ccw_queue, blocklist) { +@@ -3034,13 +3025,32 @@ restart: + * is returned from the dasd_device layer. + */ + cqr->callback = _dasd_wake_block_flush_cb; +- for (i = 0; cqr != NULL; cqr = cqr->refers, i++) +- list_move_tail(&cqr->blocklist, &flush_queue); ++ for (i = 0; cqr; cqr = cqr->refers, i++) ++ list_move_tail(&cqr->blocklist, flush_queue); + if (i > 1) + /* moved more than one request - need to restart */ + goto restart; + } +- spin_unlock_bh(&block->queue_lock); ++ spin_unlock_irqrestore(&block->queue_lock, flags); ++ ++ return rc; ++} ++ ++/* ++ * Go through all request on the dasd_block request queue, cancel them ++ * on the respective dasd_device, and return them to the generic ++ * block layer. ++ */ ++static int dasd_flush_block_queue(struct dasd_block *block) ++{ ++ struct dasd_ccw_req *cqr, *n; ++ struct list_head flush_queue; ++ unsigned long flags; ++ int rc; ++ ++ INIT_LIST_HEAD(&flush_queue); ++ rc = _dasd_requests_to_flushqueue(block, &flush_queue); ++ + /* Now call the callback function of flushed requests */ + restart_cb: + list_for_each_entry_safe(cqr, n, &flush_queue, blocklist) { +@@ -3977,75 +3987,36 @@ EXPORT_SYMBOL_GPL(dasd_generic_space_avail); + */ + static int dasd_generic_requeue_all_requests(struct dasd_device *device) + { ++ struct dasd_block *block = device->block; + struct list_head requeue_queue; + struct dasd_ccw_req *cqr, *n; +- struct dasd_ccw_req *refers; + int rc; + +- INIT_LIST_HEAD(&requeue_queue); +- spin_lock_irq(get_ccwdev_lock(device->cdev)); +- rc = 0; +- list_for_each_entry_safe(cqr, n, &device->ccw_queue, devlist) { +- /* Check status and move request to flush_queue */ +- if (cqr->status == DASD_CQR_IN_IO) { +- rc = device->discipline->term_IO(cqr); +- if (rc) { +- /* unable to terminate requeust */ +- dev_err(&device->cdev->dev, +- "Unable to terminate request %p " +- "on suspend\n", cqr); +- spin_unlock_irq(get_ccwdev_lock(device->cdev)); +- dasd_put_device(device); +- return rc; +- } +- } +- list_move_tail(&cqr->devlist, &requeue_queue); +- } +- spin_unlock_irq(get_ccwdev_lock(device->cdev)); +- +- list_for_each_entry_safe(cqr, n, &requeue_queue, devlist) { +- wait_event(dasd_flush_wq, +- (cqr->status != DASD_CQR_CLEAR_PENDING)); ++ if (!block) ++ return 0; + +- /* +- * requeue requests to blocklayer will only work +- * for block device requests +- */ +- if (_dasd_requeue_request(cqr)) +- continue; ++ INIT_LIST_HEAD(&requeue_queue); ++ rc = _dasd_requests_to_flushqueue(block, &requeue_queue); + +- /* remove requests from device and block queue */ +- list_del_init(&cqr->devlist); +- while (cqr->refers != NULL) { +- refers = cqr->refers; +- /* remove the request from the block queue */ +- list_del(&cqr->blocklist); +- /* free the finished erp request */ +- dasd_free_erp_request(cqr, cqr->memdev); +- cqr = refers; ++ /* Now call the callback function of flushed requests */ ++restart_cb: ++ list_for_each_entry_safe(cqr, n, &requeue_queue, blocklist) { ++ wait_event(dasd_flush_wq, (cqr->status < DASD_CQR_QUEUED)); ++ /* Process finished ERP request. */ ++ if (cqr->refers) { ++ spin_lock_bh(&block->queue_lock); ++ __dasd_process_erp(block->base, cqr); ++ spin_unlock_bh(&block->queue_lock); ++ /* restart list_for_xx loop since dasd_process_erp ++ * might remove multiple elements ++ */ ++ goto restart_cb; + } +- +- /* +- * _dasd_requeue_request already checked for a valid +- * blockdevice, no need to check again +- * all erp requests (cqr->refers) have a cqr->block +- * pointer copy from the original cqr +- */ ++ _dasd_requeue_request(cqr); + list_del_init(&cqr->blocklist); + cqr->block->base->discipline->free_cp( + cqr, (struct request *) cqr->callback_data); + } +- +- /* +- * if requests remain then they are internal request +- * and go back to the device queue +- */ +- if (!list_empty(&requeue_queue)) { +- /* move freeze_queue to start of the ccw_queue */ +- spin_lock_irq(get_ccwdev_lock(device->cdev)); +- list_splice_tail(&requeue_queue, &device->ccw_queue); +- spin_unlock_irq(get_ccwdev_lock(device->cdev)); +- } + dasd_schedule_device_bh(device); + return rc; + } +diff --git a/drivers/s390/block/dasd_3990_erp.c b/drivers/s390/block/dasd_3990_erp.c +index ee73b0607e47c..8598c792ded30 100644 +--- a/drivers/s390/block/dasd_3990_erp.c ++++ b/drivers/s390/block/dasd_3990_erp.c +@@ -2436,7 +2436,7 @@ static struct dasd_ccw_req *dasd_3990_erp_add_erp(struct dasd_ccw_req *cqr) + erp->block = cqr->block; + erp->magic = cqr->magic; + erp->expires = cqr->expires; +- erp->retries = 256; ++ erp->retries = device->default_retries; + erp->buildclk = get_tod_clock(); + erp->status = DASD_CQR_FILLED; + +diff --git a/drivers/s390/crypto/zcrypt_api.c b/drivers/s390/crypto/zcrypt_api.c +index ec41a8a76398c..f376dfcd7dbeb 100644 +--- a/drivers/s390/crypto/zcrypt_api.c ++++ b/drivers/s390/crypto/zcrypt_api.c +@@ -397,6 +397,7 @@ static int zcdn_create(const char *name) + ZCRYPT_NAME "_%d", (int) MINOR(devt)); + nodename[sizeof(nodename)-1] = '\0'; + if (dev_set_name(&zcdndev->device, nodename)) { ++ kfree(zcdndev); + rc = -EINVAL; + goto unlockout; + } +diff --git a/drivers/scsi/be2iscsi/be_iscsi.c b/drivers/scsi/be2iscsi/be_iscsi.c +index 2058d50d62e12..737d7087723af 100644 +--- a/drivers/scsi/be2iscsi/be_iscsi.c ++++ b/drivers/scsi/be2iscsi/be_iscsi.c +@@ -441,6 +441,10 @@ int beiscsi_iface_set_param(struct Scsi_Host *shost, + } + + nla_for_each_attr(attrib, data, dt_len, rm_len) { ++ /* ignore nla_type as it is never used */ ++ if (nla_len(attrib) < sizeof(*iface_param)) ++ return -EINVAL; ++ + iface_param = nla_data(attrib); + + if (iface_param->param_type != ISCSI_NET_PARAM) +diff --git a/drivers/scsi/fcoe/fcoe_ctlr.c b/drivers/scsi/fcoe/fcoe_ctlr.c +index 7ce2a0434e1e5..d45e8c57051bf 100644 +--- a/drivers/scsi/fcoe/fcoe_ctlr.c ++++ b/drivers/scsi/fcoe/fcoe_ctlr.c +@@ -318,16 +318,17 @@ static void fcoe_ctlr_announce(struct fcoe_ctlr *fip) + { + struct fcoe_fcf *sel; + struct fcoe_fcf *fcf; ++ unsigned long flags; + + mutex_lock(&fip->ctlr_mutex); +- spin_lock_bh(&fip->ctlr_lock); ++ spin_lock_irqsave(&fip->ctlr_lock, flags); + + kfree_skb(fip->flogi_req); + fip->flogi_req = NULL; + list_for_each_entry(fcf, &fip->fcfs, list) + fcf->flogi_sent = 0; + +- spin_unlock_bh(&fip->ctlr_lock); ++ spin_unlock_irqrestore(&fip->ctlr_lock, flags); + sel = fip->sel_fcf; + + if (sel && ether_addr_equal(sel->fcf_mac, fip->dest_addr)) +@@ -697,6 +698,7 @@ int fcoe_ctlr_els_send(struct fcoe_ctlr *fip, struct fc_lport *lport, + { + struct fc_frame *fp; + struct fc_frame_header *fh; ++ unsigned long flags; + u16 old_xid; + u8 op; + u8 mac[ETH_ALEN]; +@@ -730,11 +732,11 @@ int fcoe_ctlr_els_send(struct fcoe_ctlr *fip, struct fc_lport *lport, + op = FIP_DT_FLOGI; + if (fip->mode == FIP_MODE_VN2VN) + break; +- spin_lock_bh(&fip->ctlr_lock); ++ spin_lock_irqsave(&fip->ctlr_lock, flags); + kfree_skb(fip->flogi_req); + fip->flogi_req = skb; + fip->flogi_req_send = 1; +- spin_unlock_bh(&fip->ctlr_lock); ++ spin_unlock_irqrestore(&fip->ctlr_lock, flags); + schedule_work(&fip->timer_work); + return -EINPROGRESS; + case ELS_FDISC: +@@ -1711,10 +1713,11 @@ static int fcoe_ctlr_flogi_send_locked(struct fcoe_ctlr *fip) + static int fcoe_ctlr_flogi_retry(struct fcoe_ctlr *fip) + { + struct fcoe_fcf *fcf; ++ unsigned long flags; + int error; + + mutex_lock(&fip->ctlr_mutex); +- spin_lock_bh(&fip->ctlr_lock); ++ spin_lock_irqsave(&fip->ctlr_lock, flags); + LIBFCOE_FIP_DBG(fip, "re-sending FLOGI - reselect\n"); + fcf = fcoe_ctlr_select(fip); + if (!fcf || fcf->flogi_sent) { +@@ -1725,7 +1728,7 @@ static int fcoe_ctlr_flogi_retry(struct fcoe_ctlr *fip) + fcoe_ctlr_solicit(fip, NULL); + error = fcoe_ctlr_flogi_send_locked(fip); + } +- spin_unlock_bh(&fip->ctlr_lock); ++ spin_unlock_irqrestore(&fip->ctlr_lock, flags); + mutex_unlock(&fip->ctlr_mutex); + return error; + } +@@ -1742,8 +1745,9 @@ static int fcoe_ctlr_flogi_retry(struct fcoe_ctlr *fip) + static void fcoe_ctlr_flogi_send(struct fcoe_ctlr *fip) + { + struct fcoe_fcf *fcf; ++ unsigned long flags; + +- spin_lock_bh(&fip->ctlr_lock); ++ spin_lock_irqsave(&fip->ctlr_lock, flags); + fcf = fip->sel_fcf; + if (!fcf || !fip->flogi_req_send) + goto unlock; +@@ -1770,7 +1774,7 @@ static void fcoe_ctlr_flogi_send(struct fcoe_ctlr *fip) + } else /* XXX */ + LIBFCOE_FIP_DBG(fip, "No FCF selected - defer send\n"); + unlock: +- spin_unlock_bh(&fip->ctlr_lock); ++ spin_unlock_irqrestore(&fip->ctlr_lock, flags); + } + + /** +diff --git a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c +index b97e046c6a6e1..a8ae573294e57 100644 +--- a/drivers/scsi/hosts.c ++++ b/drivers/scsi/hosts.c +@@ -518,7 +518,7 @@ EXPORT_SYMBOL(scsi_host_alloc); + static int __scsi_host_match(struct device *dev, const void *data) + { + struct Scsi_Host *p; +- const unsigned short *hostnum = data; ++ const unsigned int *hostnum = data; + + p = class_to_shost(dev); + return p->host_no == *hostnum; +@@ -535,7 +535,7 @@ static int __scsi_host_match(struct device *dev, const void *data) + * that scsi_host_get() took. The put_device() below dropped + * the reference from class_find_device(). + **/ +-struct Scsi_Host *scsi_host_lookup(unsigned short hostnum) ++struct Scsi_Host *scsi_host_lookup(unsigned int hostnum) + { + struct device *cdev; + struct Scsi_Host *shost = NULL; +diff --git a/drivers/scsi/megaraid/megaraid_sas.h b/drivers/scsi/megaraid/megaraid_sas.h +index ce0c36fa26bf7..0c6989e32d363 100644 +--- a/drivers/scsi/megaraid/megaraid_sas.h ++++ b/drivers/scsi/megaraid/megaraid_sas.h +@@ -2324,7 +2324,7 @@ struct megasas_instance { + u32 support_morethan256jbod; /* FW support for more than 256 PD/JBOD */ + bool use_seqnum_jbod_fp; /* Added for PD sequence */ + bool smp_affinity_enable; +- spinlock_t crashdump_lock; ++ struct mutex crashdump_lock; + + struct megasas_register_set __iomem *reg_set; + u32 __iomem *reply_post_host_index_addr[MR_MAX_MSIX_REG_ARRAY]; +diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c +index 617148567d8d7..c4b9762f19eea 100644 +--- a/drivers/scsi/megaraid/megaraid_sas_base.c ++++ b/drivers/scsi/megaraid/megaraid_sas_base.c +@@ -3208,14 +3208,13 @@ fw_crash_buffer_store(struct device *cdev, + struct megasas_instance *instance = + (struct megasas_instance *) shost->hostdata; + int val = 0; +- unsigned long flags; + + if (kstrtoint(buf, 0, &val) != 0) + return -EINVAL; + +- spin_lock_irqsave(&instance->crashdump_lock, flags); ++ mutex_lock(&instance->crashdump_lock); + instance->fw_crash_buffer_offset = val; +- spin_unlock_irqrestore(&instance->crashdump_lock, flags); ++ mutex_unlock(&instance->crashdump_lock); + return strlen(buf); + } + +@@ -3230,24 +3229,23 @@ fw_crash_buffer_show(struct device *cdev, + unsigned long dmachunk = CRASH_DMA_BUF_SIZE; + unsigned long chunk_left_bytes; + unsigned long src_addr; +- unsigned long flags; + u32 buff_offset; + +- spin_lock_irqsave(&instance->crashdump_lock, flags); ++ mutex_lock(&instance->crashdump_lock); + buff_offset = instance->fw_crash_buffer_offset; + if (!instance->crash_dump_buf || + !((instance->fw_crash_state == AVAILABLE) || + (instance->fw_crash_state == COPYING))) { + dev_err(&instance->pdev->dev, + "Firmware crash dump is not available\n"); +- spin_unlock_irqrestore(&instance->crashdump_lock, flags); ++ mutex_unlock(&instance->crashdump_lock); + return -EINVAL; + } + + if (buff_offset > (instance->fw_crash_buffer_size * dmachunk)) { + dev_err(&instance->pdev->dev, + "Firmware crash dump offset is out of range\n"); +- spin_unlock_irqrestore(&instance->crashdump_lock, flags); ++ mutex_unlock(&instance->crashdump_lock); + return 0; + } + +@@ -3259,7 +3257,7 @@ fw_crash_buffer_show(struct device *cdev, + src_addr = (unsigned long)instance->crash_buf[buff_offset / dmachunk] + + (buff_offset % dmachunk); + memcpy(buf, (void *)src_addr, size); +- spin_unlock_irqrestore(&instance->crashdump_lock, flags); ++ mutex_unlock(&instance->crashdump_lock); + + return size; + } +@@ -3284,7 +3282,6 @@ fw_crash_state_store(struct device *cdev, + struct megasas_instance *instance = + (struct megasas_instance *) shost->hostdata; + int val = 0; +- unsigned long flags; + + if (kstrtoint(buf, 0, &val) != 0) + return -EINVAL; +@@ -3298,9 +3295,9 @@ fw_crash_state_store(struct device *cdev, + instance->fw_crash_state = val; + + if ((val == COPIED) || (val == COPY_ERROR)) { +- spin_lock_irqsave(&instance->crashdump_lock, flags); ++ mutex_lock(&instance->crashdump_lock); + megasas_free_host_crash_buffer(instance); +- spin_unlock_irqrestore(&instance->crashdump_lock, flags); ++ mutex_unlock(&instance->crashdump_lock); + if (val == COPY_ERROR) + dev_info(&instance->pdev->dev, "application failed to " + "copy Firmware crash dump\n"); +@@ -7301,7 +7298,7 @@ static inline void megasas_init_ctrl_params(struct megasas_instance *instance) + init_waitqueue_head(&instance->int_cmd_wait_q); + init_waitqueue_head(&instance->abort_cmd_wait_q); + +- spin_lock_init(&instance->crashdump_lock); ++ mutex_init(&instance->crashdump_lock); + spin_lock_init(&instance->mfi_pool_lock); + spin_lock_init(&instance->hba_lock); + spin_lock_init(&instance->stream_lock); +diff --git a/drivers/scsi/qedf/qedf_dbg.h b/drivers/scsi/qedf/qedf_dbg.h +index d979f095aeda0..73e5756cade62 100644 +--- a/drivers/scsi/qedf/qedf_dbg.h ++++ b/drivers/scsi/qedf/qedf_dbg.h +@@ -60,6 +60,8 @@ extern uint qedf_debug; + #define QEDF_LOG_NOTICE 0x40000000 /* Notice logs */ + #define QEDF_LOG_WARN 0x80000000 /* Warning logs */ + ++#define QEDF_DEBUGFS_LOG_LEN (2 * PAGE_SIZE) ++ + /* Debug context structure */ + struct qedf_dbg_ctx { + unsigned int host_no; +diff --git a/drivers/scsi/qedf/qedf_debugfs.c b/drivers/scsi/qedf/qedf_debugfs.c +index b88bed9bb1338..b0a28a6a9c64a 100644 +--- a/drivers/scsi/qedf/qedf_debugfs.c ++++ b/drivers/scsi/qedf/qedf_debugfs.c +@@ -8,6 +8,7 @@ + #include <linux/uaccess.h> + #include <linux/debugfs.h> + #include <linux/module.h> ++#include <linux/vmalloc.h> + + #include "qedf.h" + #include "qedf_dbg.h" +@@ -100,7 +101,9 @@ static ssize_t + qedf_dbg_fp_int_cmd_read(struct file *filp, char __user *buffer, size_t count, + loff_t *ppos) + { ++ ssize_t ret; + size_t cnt = 0; ++ char *cbuf; + int id; + struct qedf_fastpath *fp = NULL; + struct qedf_dbg_ctx *qedf_dbg = +@@ -110,19 +113,25 @@ qedf_dbg_fp_int_cmd_read(struct file *filp, char __user *buffer, size_t count, + + QEDF_INFO(qedf_dbg, QEDF_LOG_DEBUGFS, "entered\n"); + +- cnt = sprintf(buffer, "\nFastpath I/O completions\n\n"); ++ cbuf = vmalloc(QEDF_DEBUGFS_LOG_LEN); ++ if (!cbuf) ++ return 0; ++ ++ cnt += scnprintf(cbuf + cnt, QEDF_DEBUGFS_LOG_LEN - cnt, "\nFastpath I/O completions\n\n"); + + for (id = 0; id < qedf->num_queues; id++) { + fp = &(qedf->fp_array[id]); + if (fp->sb_id == QEDF_SB_ID_NULL) + continue; +- cnt += sprintf((buffer + cnt), "#%d: %lu\n", id, +- fp->completions); ++ cnt += scnprintf(cbuf + cnt, QEDF_DEBUGFS_LOG_LEN - cnt, ++ "#%d: %lu\n", id, fp->completions); + } + +- cnt = min_t(int, count, cnt - *ppos); +- *ppos += cnt; +- return cnt; ++ ret = simple_read_from_buffer(buffer, count, ppos, cbuf, cnt); ++ ++ vfree(cbuf); ++ ++ return ret; + } + + static ssize_t +@@ -140,15 +149,14 @@ qedf_dbg_debug_cmd_read(struct file *filp, char __user *buffer, size_t count, + loff_t *ppos) + { + int cnt; ++ char cbuf[32]; + struct qedf_dbg_ctx *qedf_dbg = + (struct qedf_dbg_ctx *)filp->private_data; + + QEDF_INFO(qedf_dbg, QEDF_LOG_DEBUGFS, "debug mask=0x%x\n", qedf_debug); +- cnt = sprintf(buffer, "debug mask = 0x%x\n", qedf_debug); ++ cnt = scnprintf(cbuf, sizeof(cbuf), "debug mask = 0x%x\n", qedf_debug); + +- cnt = min_t(int, count, cnt - *ppos); +- *ppos += cnt; +- return cnt; ++ return simple_read_from_buffer(buffer, count, ppos, cbuf, cnt); + } + + static ssize_t +@@ -187,18 +195,17 @@ qedf_dbg_stop_io_on_error_cmd_read(struct file *filp, char __user *buffer, + size_t count, loff_t *ppos) + { + int cnt; ++ char cbuf[7]; + struct qedf_dbg_ctx *qedf_dbg = + (struct qedf_dbg_ctx *)filp->private_data; + struct qedf_ctx *qedf = container_of(qedf_dbg, + struct qedf_ctx, dbg_ctx); + + QEDF_INFO(qedf_dbg, QEDF_LOG_DEBUGFS, "entered\n"); +- cnt = sprintf(buffer, "%s\n", ++ cnt = scnprintf(cbuf, sizeof(cbuf), "%s\n", + qedf->stop_io_on_error ? "true" : "false"); + +- cnt = min_t(int, count, cnt - *ppos); +- *ppos += cnt; +- return cnt; ++ return simple_read_from_buffer(buffer, count, ppos, cbuf, cnt); + } + + static ssize_t +diff --git a/drivers/scsi/qedi/qedi_main.c b/drivers/scsi/qedi/qedi_main.c +index 92c4a367b7bd7..6b47921202eba 100644 +--- a/drivers/scsi/qedi/qedi_main.c ++++ b/drivers/scsi/qedi/qedi_main.c +@@ -1910,8 +1910,9 @@ static int qedi_cpu_offline(unsigned int cpu) + struct qedi_percpu_s *p = this_cpu_ptr(&qedi_percpu); + struct qedi_work *work, *tmp; + struct task_struct *thread; ++ unsigned long flags; + +- spin_lock_bh(&p->p_work_lock); ++ spin_lock_irqsave(&p->p_work_lock, flags); + thread = p->iothread; + p->iothread = NULL; + +@@ -1922,7 +1923,7 @@ static int qedi_cpu_offline(unsigned int cpu) + kfree(work); + } + +- spin_unlock_bh(&p->p_work_lock); ++ spin_unlock_irqrestore(&p->p_work_lock, flags); + if (thread) + kthread_stop(thread); + return 0; +diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c +index be3525d17fc92..2c295e1c9c9a5 100644 +--- a/drivers/scsi/qla2xxx/qla_attr.c ++++ b/drivers/scsi/qla2xxx/qla_attr.c +@@ -2864,8 +2864,6 @@ qla24xx_vport_create(struct fc_vport *fc_vport, bool disable) + vha->flags.difdix_supported = 1; + ql_dbg(ql_dbg_user, vha, 0x7082, + "Registered for DIF/DIX type 1 and 3 protection.\n"); +- if (ql2xenabledif == 1) +- prot = SHOST_DIX_TYPE0_PROTECTION; + scsi_host_set_prot(vha->host, + prot | SHOST_DIF_TYPE1_PROTECTION + | SHOST_DIF_TYPE2_PROTECTION +diff --git a/drivers/scsi/qla2xxx/qla_dbg.c b/drivers/scsi/qla2xxx/qla_dbg.c +index 88a56e8480f71..f5a30c2fcee80 100644 +--- a/drivers/scsi/qla2xxx/qla_dbg.c ++++ b/drivers/scsi/qla2xxx/qla_dbg.c +@@ -22,7 +22,7 @@ + * | Queue Command and IO tracing | 0x3074 | 0x300b | + * | | | 0x3027-0x3028 | + * | | | 0x303d-0x3041 | +- * | | | 0x302d,0x3033 | ++ * | | | 0x302e,0x3033 | + * | | | 0x3036,0x3038 | + * | | | 0x303a | + * | DPC Thread | 0x4023 | 0x4002,0x4013 | +diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c +index 85f65a0ac1508..f6d5d77ea45bb 100644 +--- a/drivers/scsi/qla2xxx/qla_init.c ++++ b/drivers/scsi/qla2xxx/qla_init.c +@@ -4176,15 +4176,16 @@ qla2x00_init_rings(scsi_qla_host_t *vha) + (ha->flags.fawwpn_enabled) ? "enabled" : "disabled"); + } + ++ QLA_FW_STARTED(ha); + rval = qla2x00_init_firmware(vha, ha->init_cb_size); + next_check: + if (rval) { ++ QLA_FW_STOPPED(ha); + ql_log(ql_log_fatal, vha, 0x00d2, + "Init Firmware **** FAILED ****.\n"); + } else { + ql_dbg(ql_dbg_init, vha, 0x00d3, + "Init Firmware -- success.\n"); +- QLA_FW_STARTED(ha); + vha->u_ql2xexchoffld = vha->u_ql2xiniexchg = 0; + } + +diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c +index 0892eb6bbfa33..aca8ec3ff9391 100644 +--- a/drivers/scsi/qla2xxx/qla_isr.c ++++ b/drivers/scsi/qla2xxx/qla_isr.c +@@ -639,8 +639,12 @@ qla2x00_async_event(scsi_qla_host_t *vha, struct rsp_que *rsp, uint16_t *mb) + unsigned long flags; + fc_port_t *fcport = NULL; + +- if (!vha->hw->flags.fw_started) ++ if (!vha->hw->flags.fw_started) { ++ ql_log(ql_log_warn, vha, 0x50ff, ++ "Dropping AEN - %04x %04x %04x %04x.\n", ++ mb[0], mb[1], mb[2], mb[3]); + return; ++ } + + /* Setup to process RIO completion. */ + handle_cnt = 0; +@@ -2711,7 +2715,6 @@ check_scsi_status: + case CS_PORT_BUSY: + case CS_INCOMPLETE: + case CS_PORT_UNAVAILABLE: +- case CS_TIMEOUT: + case CS_RESET: + + /* +diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c +index b67480456f45c..11ee87f76f4be 100644 +--- a/drivers/scsi/qla2xxx/qla_nvme.c ++++ b/drivers/scsi/qla2xxx/qla_nvme.c +@@ -577,7 +577,7 @@ static int qla_nvme_post_cmd(struct nvme_fc_local_port *lport, + + rval = qla2x00_start_nvme_mq(sp); + if (rval != QLA_SUCCESS) { +- ql_log(ql_log_warn, vha, 0x212d, ++ ql_dbg(ql_dbg_io + ql_dbg_verbose, vha, 0x212d, + "qla2x00_start_nvme_mq failed = %d\n", rval); + sp->priv = NULL; + priv->sp = NULL; +diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c +index 99d4bc2ab5a91..57f8d2378f778 100644 +--- a/drivers/scsi/qla2xxx/qla_os.c ++++ b/drivers/scsi/qla2xxx/qla_os.c +@@ -3112,6 +3112,13 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id) + host->max_id = ha->max_fibre_devices; + host->cmd_per_lun = 3; + host->unique_id = host->host_no; ++ ++ if (ql2xenabledif && ql2xenabledif != 2) { ++ ql_log(ql_log_warn, base_vha, 0x302d, ++ "Invalid value for ql2xenabledif, resetting it to default (2)\n"); ++ ql2xenabledif = 2; ++ } ++ + if (IS_T10_PI_CAPABLE(ha) && ql2xenabledif) + host->max_cmd_len = 32; + else +@@ -3343,8 +3350,6 @@ skip_dpc: + base_vha->flags.difdix_supported = 1; + ql_dbg(ql_dbg_init, base_vha, 0x00f1, + "Registering for DIF/DIX type 1 and 3 protection.\n"); +- if (ql2xenabledif == 1) +- prot = SHOST_DIX_TYPE0_PROTECTION; + if (ql2xprotmask) + scsi_host_set_prot(host, ql2xprotmask); + else +diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c +index df43cf6405a8e..ea15bbe0397fc 100644 +--- a/drivers/scsi/qla4xxx/ql4_os.c ++++ b/drivers/scsi/qla4xxx/ql4_os.c +@@ -939,6 +939,11 @@ static int qla4xxx_set_chap_entry(struct Scsi_Host *shost, void *data, int len) + memset(&chap_rec, 0, sizeof(chap_rec)); + + nla_for_each_attr(attr, data, len, rem) { ++ if (nla_len(attr) < sizeof(*param_info)) { ++ rc = -EINVAL; ++ goto exit_set_chap; ++ } ++ + param_info = nla_data(attr); + + switch (param_info->param) { +@@ -2723,6 +2728,11 @@ qla4xxx_iface_set_param(struct Scsi_Host *shost, void *data, uint32_t len) + } + + nla_for_each_attr(attr, data, len, rem) { ++ if (nla_len(attr) < sizeof(*iface_param)) { ++ rval = -EINVAL; ++ goto exit_init_fw_cb; ++ } ++ + iface_param = nla_data(attr); + + if (iface_param->param_type == ISCSI_NET_PARAM) { +@@ -8093,6 +8103,11 @@ qla4xxx_sysfs_ddb_set_param(struct iscsi_bus_flash_session *fnode_sess, + + memset((void *)&chap_tbl, 0, sizeof(chap_tbl)); + nla_for_each_attr(attr, data, len, rem) { ++ if (nla_len(attr) < sizeof(*fnode_param)) { ++ rc = -EINVAL; ++ goto exit_set_param; ++ } ++ + fnode_param = nla_data(attr); + + switch (fnode_param->param) { +diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c +index f6cce0befa7de..51f53638629cb 100644 +--- a/drivers/scsi/scsi_transport_iscsi.c ++++ b/drivers/scsi/scsi_transport_iscsi.c +@@ -2767,6 +2767,10 @@ iscsi_set_param(struct iscsi_transport *transport, struct iscsi_uevent *ev) + if (!conn || !session) + return -EINVAL; + ++ /* data will be regarded as NULL-ended string, do length check */ ++ if (strlen(data) > ev->u.set_param.len) ++ return -EINVAL; ++ + switch (ev->u.set_param.param) { + case ISCSI_PARAM_SESS_RECOVERY_TMO: + sscanf(data, "%d", &value); +@@ -2919,6 +2923,10 @@ iscsi_set_host_param(struct iscsi_transport *transport, + return -ENODEV; + } + ++ /* see similar check in iscsi_if_set_param() */ ++ if (strlen(data) > ev->u.set_host_param.len) ++ return -EINVAL; ++ + err = transport->set_host_param(shost, ev->u.set_host_param.param, + data, ev->u.set_host_param.len); + scsi_host_put(shost); +diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c +index 823088c7b199e..44f4e10f9bf9a 100644 +--- a/drivers/scsi/storvsc_drv.c ++++ b/drivers/scsi/storvsc_drv.c +@@ -1423,6 +1423,8 @@ static int storvsc_device_configure(struct scsi_device *sdevice) + { + blk_queue_rq_timeout(sdevice->request_queue, (storvsc_timeout * HZ)); + ++ /* storvsc devices don't support MAINTENANCE_IN SCSI cmd */ ++ sdevice->no_report_opcodes = 1; + sdevice->no_write_same = 1; + + /* +diff --git a/drivers/soc/qcom/qmi_encdec.c b/drivers/soc/qcom/qmi_encdec.c +index 3aaab71d1b2c1..dbc8b4c931903 100644 +--- a/drivers/soc/qcom/qmi_encdec.c ++++ b/drivers/soc/qcom/qmi_encdec.c +@@ -534,8 +534,8 @@ static int qmi_decode_string_elem(struct qmi_elem_info *ei_array, + decoded_bytes += rc; + } + +- if (string_len > temp_ei->elem_len) { +- pr_err("%s: String len %d > Max Len %d\n", ++ if (string_len >= temp_ei->elem_len) { ++ pr_err("%s: String len %d >= Max Len %d\n", + __func__, string_len, temp_ei->elem_len); + return -ETOOSMALL; + } else if (string_len > tlv_len) { +diff --git a/drivers/spi/spi-tegra20-sflash.c b/drivers/spi/spi-tegra20-sflash.c +index ecb620169753a..bfef41c717f35 100644 +--- a/drivers/spi/spi-tegra20-sflash.c ++++ b/drivers/spi/spi-tegra20-sflash.c +@@ -456,7 +456,11 @@ static int tegra_sflash_probe(struct platform_device *pdev) + goto exit_free_master; + } + +- tsd->irq = platform_get_irq(pdev, 0); ++ ret = platform_get_irq(pdev, 0); ++ if (ret < 0) ++ goto exit_free_master; ++ tsd->irq = ret; ++ + ret = request_irq(tsd->irq, tegra_sflash_isr, 0, + dev_name(&pdev->dev), tsd); + if (ret < 0) { +diff --git a/drivers/staging/rtl8712/os_intfs.c b/drivers/staging/rtl8712/os_intfs.c +index 0c3ae8495afb7..c0982c13ece71 100644 +--- a/drivers/staging/rtl8712/os_intfs.c ++++ b/drivers/staging/rtl8712/os_intfs.c +@@ -323,6 +323,7 @@ int r8712_init_drv_sw(struct _adapter *padapter) + mp871xinit(padapter); + init_default_value(padapter); + r8712_InitSwLeds(padapter); ++ mutex_init(&padapter->mutex_start); + return ret; + } + +diff --git a/drivers/staging/rtl8712/usb_intf.c b/drivers/staging/rtl8712/usb_intf.c +index f7c1258eaa394..fef9233cef42b 100644 +--- a/drivers/staging/rtl8712/usb_intf.c ++++ b/drivers/staging/rtl8712/usb_intf.c +@@ -570,7 +570,6 @@ static int r871xu_drv_init(struct usb_interface *pusb_intf, + if (rtl871x_load_fw(padapter)) + goto error; + spin_lock_init(&padapter->lock_rx_ff0_filter); +- mutex_init(&padapter->mutex_start); + return 0; + error: + usb_put_dev(udev); +diff --git a/drivers/target/iscsi/iscsi_target_configfs.c b/drivers/target/iscsi/iscsi_target_configfs.c +index 0fa1d57b26fa8..3cd671bbb9a41 100644 +--- a/drivers/target/iscsi/iscsi_target_configfs.c ++++ b/drivers/target/iscsi/iscsi_target_configfs.c +@@ -508,102 +508,102 @@ static ssize_t lio_target_nacl_info_show(struct config_item *item, char *page) + spin_lock_bh(&se_nacl->nacl_sess_lock); + se_sess = se_nacl->nacl_sess; + if (!se_sess) { +- rb += sprintf(page+rb, "No active iSCSI Session for Initiator" ++ rb += sysfs_emit_at(page, rb, "No active iSCSI Session for Initiator" + " Endpoint: %s\n", se_nacl->initiatorname); + } else { + sess = se_sess->fabric_sess_ptr; + +- rb += sprintf(page+rb, "InitiatorName: %s\n", ++ rb += sysfs_emit_at(page, rb, "InitiatorName: %s\n", + sess->sess_ops->InitiatorName); +- rb += sprintf(page+rb, "InitiatorAlias: %s\n", ++ rb += sysfs_emit_at(page, rb, "InitiatorAlias: %s\n", + sess->sess_ops->InitiatorAlias); + +- rb += sprintf(page+rb, ++ rb += sysfs_emit_at(page, rb, + "LIO Session ID: %u ISID: 0x%6ph TSIH: %hu ", + sess->sid, sess->isid, sess->tsih); +- rb += sprintf(page+rb, "SessionType: %s\n", ++ rb += sysfs_emit_at(page, rb, "SessionType: %s\n", + (sess->sess_ops->SessionType) ? + "Discovery" : "Normal"); +- rb += sprintf(page+rb, "Session State: "); ++ rb += sysfs_emit_at(page, rb, "Session State: "); + switch (sess->session_state) { + case TARG_SESS_STATE_FREE: +- rb += sprintf(page+rb, "TARG_SESS_FREE\n"); ++ rb += sysfs_emit_at(page, rb, "TARG_SESS_FREE\n"); + break; + case TARG_SESS_STATE_ACTIVE: +- rb += sprintf(page+rb, "TARG_SESS_STATE_ACTIVE\n"); ++ rb += sysfs_emit_at(page, rb, "TARG_SESS_STATE_ACTIVE\n"); + break; + case TARG_SESS_STATE_LOGGED_IN: +- rb += sprintf(page+rb, "TARG_SESS_STATE_LOGGED_IN\n"); ++ rb += sysfs_emit_at(page, rb, "TARG_SESS_STATE_LOGGED_IN\n"); + break; + case TARG_SESS_STATE_FAILED: +- rb += sprintf(page+rb, "TARG_SESS_STATE_FAILED\n"); ++ rb += sysfs_emit_at(page, rb, "TARG_SESS_STATE_FAILED\n"); + break; + case TARG_SESS_STATE_IN_CONTINUE: +- rb += sprintf(page+rb, "TARG_SESS_STATE_IN_CONTINUE\n"); ++ rb += sysfs_emit_at(page, rb, "TARG_SESS_STATE_IN_CONTINUE\n"); + break; + default: +- rb += sprintf(page+rb, "ERROR: Unknown Session" ++ rb += sysfs_emit_at(page, rb, "ERROR: Unknown Session" + " State!\n"); + break; + } + +- rb += sprintf(page+rb, "---------------------[iSCSI Session" ++ rb += sysfs_emit_at(page, rb, "---------------------[iSCSI Session" + " Values]-----------------------\n"); +- rb += sprintf(page+rb, " CmdSN/WR : CmdSN/WC : ExpCmdSN" ++ rb += sysfs_emit_at(page, rb, " CmdSN/WR : CmdSN/WC : ExpCmdSN" + " : MaxCmdSN : ITT : TTT\n"); + max_cmd_sn = (u32) atomic_read(&sess->max_cmd_sn); +- rb += sprintf(page+rb, " 0x%08x 0x%08x 0x%08x 0x%08x" ++ rb += sysfs_emit_at(page, rb, " 0x%08x 0x%08x 0x%08x 0x%08x" + " 0x%08x 0x%08x\n", + sess->cmdsn_window, + (max_cmd_sn - sess->exp_cmd_sn) + 1, + sess->exp_cmd_sn, max_cmd_sn, + sess->init_task_tag, sess->targ_xfer_tag); +- rb += sprintf(page+rb, "----------------------[iSCSI" ++ rb += sysfs_emit_at(page, rb, "----------------------[iSCSI" + " Connections]-------------------------\n"); + + spin_lock(&sess->conn_lock); + list_for_each_entry(conn, &sess->sess_conn_list, conn_list) { +- rb += sprintf(page+rb, "CID: %hu Connection" ++ rb += sysfs_emit_at(page, rb, "CID: %hu Connection" + " State: ", conn->cid); + switch (conn->conn_state) { + case TARG_CONN_STATE_FREE: +- rb += sprintf(page+rb, ++ rb += sysfs_emit_at(page, rb, + "TARG_CONN_STATE_FREE\n"); + break; + case TARG_CONN_STATE_XPT_UP: +- rb += sprintf(page+rb, ++ rb += sysfs_emit_at(page, rb, + "TARG_CONN_STATE_XPT_UP\n"); + break; + case TARG_CONN_STATE_IN_LOGIN: +- rb += sprintf(page+rb, ++ rb += sysfs_emit_at(page, rb, + "TARG_CONN_STATE_IN_LOGIN\n"); + break; + case TARG_CONN_STATE_LOGGED_IN: +- rb += sprintf(page+rb, ++ rb += sysfs_emit_at(page, rb, + "TARG_CONN_STATE_LOGGED_IN\n"); + break; + case TARG_CONN_STATE_IN_LOGOUT: +- rb += sprintf(page+rb, ++ rb += sysfs_emit_at(page, rb, + "TARG_CONN_STATE_IN_LOGOUT\n"); + break; + case TARG_CONN_STATE_LOGOUT_REQUESTED: +- rb += sprintf(page+rb, ++ rb += sysfs_emit_at(page, rb, + "TARG_CONN_STATE_LOGOUT_REQUESTED\n"); + break; + case TARG_CONN_STATE_CLEANUP_WAIT: +- rb += sprintf(page+rb, ++ rb += sysfs_emit_at(page, rb, + "TARG_CONN_STATE_CLEANUP_WAIT\n"); + break; + default: +- rb += sprintf(page+rb, ++ rb += sysfs_emit_at(page, rb, + "ERROR: Unknown Connection State!\n"); + break; + } + +- rb += sprintf(page+rb, " Address %pISc %s", &conn->login_sockaddr, ++ rb += sysfs_emit_at(page, rb, " Address %pISc %s", &conn->login_sockaddr, + (conn->network_transport == ISCSI_TCP) ? + "TCP" : "SCTP"); +- rb += sprintf(page+rb, " StatSN: 0x%08x\n", ++ rb += sysfs_emit_at(page, rb, " StatSN: 0x%08x\n", + conn->stat_sn); + } + spin_unlock(&sess->conn_lock); +diff --git a/drivers/tty/serial/cpm_uart/cpm_uart_core.c b/drivers/tty/serial/cpm_uart/cpm_uart_core.c +index de6d02f7abe2b..c37036fee231d 100644 +--- a/drivers/tty/serial/cpm_uart/cpm_uart_core.c ++++ b/drivers/tty/serial/cpm_uart/cpm_uart_core.c +@@ -1267,19 +1267,14 @@ static void cpm_uart_console_write(struct console *co, const char *s, + { + struct uart_cpm_port *pinfo = &cpm_uart_ports[co->index]; + unsigned long flags; +- int nolock = oops_in_progress; + +- if (unlikely(nolock)) { ++ if (unlikely(oops_in_progress)) { + local_irq_save(flags); +- } else { +- spin_lock_irqsave(&pinfo->port.lock, flags); +- } +- +- cpm_uart_early_write(pinfo, s, count, true); +- +- if (unlikely(nolock)) { ++ cpm_uart_early_write(pinfo, s, count, true); + local_irq_restore(flags); + } else { ++ spin_lock_irqsave(&pinfo->port.lock, flags); ++ cpm_uart_early_write(pinfo, s, count, true); + spin_unlock_irqrestore(&pinfo->port.lock, flags); + } + } +diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c +index 7d3ae31cc7204..091cf5fe90304 100644 +--- a/drivers/tty/serial/sc16is7xx.c ++++ b/drivers/tty/serial/sc16is7xx.c +@@ -1166,9 +1166,18 @@ static int sc16is7xx_gpio_direction_output(struct gpio_chip *chip, + state |= BIT(offset); + else + state &= ~BIT(offset); +- sc16is7xx_port_write(port, SC16IS7XX_IOSTATE_REG, state); ++ ++ /* ++ * If we write IOSTATE first, and then IODIR, the output value is not ++ * transferred to the corresponding I/O pin. ++ * The datasheet states that each register bit will be transferred to ++ * the corresponding I/O pin programmed as output when writing to ++ * IOSTATE. Therefore, configure direction first with IODIR, and then ++ * set value after with IOSTATE. ++ */ + sc16is7xx_port_update(port, SC16IS7XX_IODIR_REG, BIT(offset), + BIT(offset)); ++ sc16is7xx_port_write(port, SC16IS7XX_IOSTATE_REG, state); + + return 0; + } +@@ -1261,6 +1270,13 @@ static int sc16is7xx_probe(struct device *dev, + s->p[i].port.type = PORT_SC16IS7XX; + s->p[i].port.fifosize = SC16IS7XX_FIFO_SIZE; + s->p[i].port.flags = UPF_FIXED_TYPE | UPF_LOW_LATENCY; ++ s->p[i].port.iobase = i; ++ /* ++ * Use all ones as membase to make sure uart_configure_port() in ++ * serial_core.c does not abort for SPI/I2C devices where the ++ * membase address is not applicable. ++ */ ++ s->p[i].port.membase = (void __iomem *)~0; + s->p[i].port.iotype = UPIO_PORT; + s->p[i].port.uartclk = freq; + s->p[i].port.rs485_config = sc16is7xx_config_rs485; +diff --git a/drivers/tty/serial/serial-tegra.c b/drivers/tty/serial/serial-tegra.c +index 7930f2a81b4c1..2b5d26df5fcfc 100644 +--- a/drivers/tty/serial/serial-tegra.c ++++ b/drivers/tty/serial/serial-tegra.c +@@ -1000,7 +1000,11 @@ static int tegra_uart_hw_init(struct tegra_uart_port *tup) + tup->ier_shadow = 0; + tup->current_baud = 0; + +- clk_prepare_enable(tup->uart_clk); ++ ret = clk_prepare_enable(tup->uart_clk); ++ if (ret) { ++ dev_err(tup->uport.dev, "could not enable clk\n"); ++ return ret; ++ } + + /* Reset the UART controller to clear all previous status.*/ + reset_control_assert(tup->rst); +diff --git a/drivers/tty/serial/sprd_serial.c b/drivers/tty/serial/sprd_serial.c +index 07573de70445c..8b45b3ab63416 100644 +--- a/drivers/tty/serial/sprd_serial.c ++++ b/drivers/tty/serial/sprd_serial.c +@@ -371,7 +371,7 @@ static void sprd_rx_free_buf(struct sprd_uart_port *sp) + if (sp->rx_dma.virt) + dma_free_coherent(sp->port.dev, SPRD_UART_RX_SIZE, + sp->rx_dma.virt, sp->rx_dma.phys_addr); +- ++ sp->rx_dma.virt = NULL; + } + + static int sprd_rx_dma_config(struct uart_port *port, u32 burst) +@@ -1073,29 +1073,6 @@ static struct uart_driver sprd_uart_driver = { + .cons = SPRD_CONSOLE, + }; + +-static int sprd_probe_dt_alias(int index, struct device *dev) +-{ +- struct device_node *np; +- int ret = index; +- +- if (!IS_ENABLED(CONFIG_OF)) +- return ret; +- +- np = dev->of_node; +- if (!np) +- return ret; +- +- ret = of_alias_get_id(np, "serial"); +- if (ret < 0) +- ret = index; +- else if (ret >= ARRAY_SIZE(sprd_port) || sprd_port[ret] != NULL) { +- dev_warn(dev, "requested serial port %d not available.\n", ret); +- ret = index; +- } +- +- return ret; +-} +- + static int sprd_remove(struct platform_device *dev) + { + struct sprd_uart_port *sup = platform_get_drvdata(dev); +@@ -1126,7 +1103,7 @@ static bool sprd_uart_is_console(struct uart_port *uport) + static int sprd_clk_init(struct uart_port *uport) + { + struct clk *clk_uart, *clk_parent; +- struct sprd_uart_port *u = sprd_port[uport->line]; ++ struct sprd_uart_port *u = container_of(uport, struct sprd_uart_port, port); + + clk_uart = devm_clk_get(uport->dev, "uart"); + if (IS_ERR(clk_uart)) { +@@ -1169,25 +1146,22 @@ static int sprd_probe(struct platform_device *pdev) + { + struct resource *res; + struct uart_port *up; ++ struct sprd_uart_port *sport; + int irq; + int index; + int ret; + +- for (index = 0; index < ARRAY_SIZE(sprd_port); index++) +- if (sprd_port[index] == NULL) +- break; +- +- if (index == ARRAY_SIZE(sprd_port)) +- return -EBUSY; +- +- index = sprd_probe_dt_alias(index, &pdev->dev); ++ index = of_alias_get_id(pdev->dev.of_node, "serial"); ++ if (index < 0 || index >= UART_NR_MAX) { ++ dev_err(&pdev->dev, "got a wrong serial alias id %d\n", index); ++ return -EINVAL; ++ } + +- sprd_port[index] = devm_kzalloc(&pdev->dev, sizeof(*sprd_port[index]), +- GFP_KERNEL); +- if (!sprd_port[index]) ++ sport = devm_kzalloc(&pdev->dev, sizeof(*sport), GFP_KERNEL); ++ if (!sport) + return -ENOMEM; + +- up = &sprd_port[index]->port; ++ up = &sport->port; + up->dev = &pdev->dev; + up->line = index; + up->type = PORT_SPRD; +@@ -1217,7 +1191,7 @@ static int sprd_probe(struct platform_device *pdev) + * Allocate one dma buffer to prepare for receive transfer, in case + * memory allocation failure at runtime. + */ +- ret = sprd_rx_alloc_buf(sprd_port[index]); ++ ret = sprd_rx_alloc_buf(sport); + if (ret) + return ret; + +@@ -1225,19 +1199,27 @@ static int sprd_probe(struct platform_device *pdev) + ret = uart_register_driver(&sprd_uart_driver); + if (ret < 0) { + pr_err("Failed to register SPRD-UART driver\n"); +- return ret; ++ goto free_rx_buf; + } + } ++ + sprd_ports_num++; ++ sprd_port[index] = sport; + + ret = uart_add_one_port(&sprd_uart_driver, up); +- if (ret) { +- sprd_port[index] = NULL; +- sprd_remove(pdev); +- } ++ if (ret) ++ goto clean_port; + + platform_set_drvdata(pdev, up); + ++ return 0; ++ ++clean_port: ++ sprd_port[index] = NULL; ++ if (--sprd_ports_num == 0) ++ uart_unregister_driver(&sprd_uart_driver); ++free_rx_buf: ++ sprd_rx_free_buf(sport); + return ret; + } + +diff --git a/drivers/usb/gadget/function/f_mass_storage.c b/drivers/usb/gadget/function/f_mass_storage.c +index 7c96c4665178e..6c8aba574e6e9 100644 +--- a/drivers/usb/gadget/function/f_mass_storage.c ++++ b/drivers/usb/gadget/function/f_mass_storage.c +@@ -950,7 +950,7 @@ static void invalidate_sub(struct fsg_lun *curlun) + { + struct file *filp = curlun->filp; + struct inode *inode = file_inode(filp); +- unsigned long rc; ++ unsigned long __maybe_unused rc; + + rc = invalidate_mapping_pages(inode->i_mapping, 0, -1); + VLDBG(curlun, "invalidate_mapping_pages -> %ld\n", rc); +diff --git a/drivers/usb/gadget/udc/fsl_qe_udc.c b/drivers/usb/gadget/udc/fsl_qe_udc.c +index 2707be6282988..cbd8d6c74c938 100644 +--- a/drivers/usb/gadget/udc/fsl_qe_udc.c ++++ b/drivers/usb/gadget/udc/fsl_qe_udc.c +@@ -1950,9 +1950,13 @@ static void ch9getstatus(struct qe_udc *udc, u8 request_type, u16 value, + } else if ((request_type & USB_RECIP_MASK) == USB_RECIP_ENDPOINT) { + /* Get endpoint status */ + int pipe = index & USB_ENDPOINT_NUMBER_MASK; +- struct qe_ep *target_ep = &udc->eps[pipe]; ++ struct qe_ep *target_ep; + u16 usep; + ++ if (pipe >= USB_MAX_ENDPOINTS) ++ goto stall; ++ target_ep = &udc->eps[pipe]; ++ + /* stall if endpoint doesn't exist */ + if (!target_ep->ep.desc) + goto stall; +diff --git a/drivers/usb/phy/phy-mxs-usb.c b/drivers/usb/phy/phy-mxs-usb.c +index 70b8c8248caf7..5bcad9041284e 100644 +--- a/drivers/usb/phy/phy-mxs-usb.c ++++ b/drivers/usb/phy/phy-mxs-usb.c +@@ -388,14 +388,8 @@ static void __mxs_phy_disconnect_line(struct mxs_phy *mxs_phy, bool disconnect) + + static bool mxs_phy_is_otg_host(struct mxs_phy *mxs_phy) + { +- void __iomem *base = mxs_phy->phy.io_priv; +- u32 phyctrl = readl(base + HW_USBPHY_CTRL); +- +- if (IS_ENABLED(CONFIG_USB_OTG) && +- !(phyctrl & BM_USBPHY_CTRL_OTG_ID_VALUE)) +- return true; +- +- return false; ++ return IS_ENABLED(CONFIG_USB_OTG) && ++ mxs_phy->phy.last_event == USB_EVENT_ID; + } + + static void mxs_phy_disconnect_line(struct mxs_phy *mxs_phy, bool on) +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index 7ab6205ad50cf..dfe820af88385 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -259,6 +259,7 @@ static void option_instat_callback(struct urb *urb); + #define QUECTEL_PRODUCT_EM05G 0x030a + #define QUECTEL_PRODUCT_EM060K 0x030b + #define QUECTEL_PRODUCT_EM05G_CS 0x030c ++#define QUECTEL_PRODUCT_EM05GV2 0x030e + #define QUECTEL_PRODUCT_EM05CN_SG 0x0310 + #define QUECTEL_PRODUCT_EM05G_SG 0x0311 + #define QUECTEL_PRODUCT_EM05CN 0x0312 +@@ -1190,6 +1191,8 @@ static const struct usb_device_id option_ids[] = { + .driver_info = RSVD(6) | ZLP }, + { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05G_GR, 0xff), + .driver_info = RSVD(6) | ZLP }, ++ { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05GV2, 0xff), ++ .driver_info = RSVD(4) | ZLP }, + { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05G_CS, 0xff), + .driver_info = RSVD(6) | ZLP }, + { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05G_RS, 0xff), +@@ -2232,6 +2235,10 @@ static const struct usb_device_id option_ids[] = { + .driver_info = RSVD(0) | RSVD(1) | RSVD(6) }, + { USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe0db, 0xff), /* Foxconn T99W265 MBIM */ + .driver_info = RSVD(3) }, ++ { USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe0ee, 0xff), /* Foxconn T99W368 MBIM */ ++ .driver_info = RSVD(3) }, ++ { USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe0f0, 0xff), /* Foxconn T99W373 MBIM */ ++ .driver_info = RSVD(3) }, + { USB_DEVICE(0x1508, 0x1001), /* Fibocom NL668 (IOT version) */ + .driver_info = RSVD(4) | RSVD(5) | RSVD(6) }, + { USB_DEVICE(0x1782, 0x4d10) }, /* Fibocom L610 (AT mode) */ +diff --git a/drivers/usb/typec/bus.c b/drivers/usb/typec/bus.c +index 0369ad92a1c8e..052b8fb21344c 100644 +--- a/drivers/usb/typec/bus.c ++++ b/drivers/usb/typec/bus.c +@@ -146,12 +146,20 @@ EXPORT_SYMBOL_GPL(typec_altmode_exit); + * + * Notifies the partner of @adev about Attention command. + */ +-void typec_altmode_attention(struct typec_altmode *adev, u32 vdo) ++int typec_altmode_attention(struct typec_altmode *adev, u32 vdo) + { +- struct typec_altmode *pdev = &to_altmode(adev)->partner->adev; ++ struct altmode *partner = to_altmode(adev)->partner; ++ struct typec_altmode *pdev; ++ ++ if (!partner) ++ return -ENODEV; ++ ++ pdev = &partner->adev; + + if (pdev->ops && pdev->ops->attention) + pdev->ops->attention(pdev, vdo); ++ ++ return 0; + } + EXPORT_SYMBOL_GPL(typec_altmode_attention); + +diff --git a/drivers/usb/typec/tcpm/tcpci.c b/drivers/usb/typec/tcpm/tcpci.c +index 84b23ae48aeec..ccb72875c8ee5 100644 +--- a/drivers/usb/typec/tcpm/tcpci.c ++++ b/drivers/usb/typec/tcpm/tcpci.c +@@ -379,6 +379,10 @@ static int tcpci_init(struct tcpc_dev *tcpc) + if (time_after(jiffies, timeout)) + return -ETIMEDOUT; + ++ ret = tcpci_write16(tcpci, TCPC_FAULT_STATUS, TCPC_FAULT_STATUS_ALL_REG_RST_TO_DEFAULT); ++ if (ret < 0) ++ return ret; ++ + /* Handle vendor init */ + if (tcpci->data->init) { + ret = tcpci->data->init(tcpci, tcpci->data); +diff --git a/drivers/usb/typec/tcpm/tcpci.h b/drivers/usb/typec/tcpm/tcpci.h +index 303ebde265465..dcf60399f161f 100644 +--- a/drivers/usb/typec/tcpm/tcpci.h ++++ b/drivers/usb/typec/tcpm/tcpci.h +@@ -72,6 +72,7 @@ + #define TCPC_POWER_STATUS_VBUS_PRES BIT(2) + + #define TCPC_FAULT_STATUS 0x1f ++#define TCPC_FAULT_STATUS_ALL_REG_RST_TO_DEFAULT BIT(7) + + #define TCPC_COMMAND 0x23 + #define TCPC_CMD_WAKE_I2C 0x11 +diff --git a/drivers/usb/typec/tcpm/tcpm.c b/drivers/usb/typec/tcpm/tcpm.c +index b259a4a28f81a..07db1f1a1f72a 100644 +--- a/drivers/usb/typec/tcpm/tcpm.c ++++ b/drivers/usb/typec/tcpm/tcpm.c +@@ -159,6 +159,14 @@ enum pd_msg_request { + PD_MSG_DATA_SOURCE_CAP, + }; + ++enum adev_actions { ++ ADEV_NONE = 0, ++ ADEV_NOTIFY_USB_AND_QUEUE_VDM, ++ ADEV_QUEUE_VDM, ++ ADEV_QUEUE_VDM_SEND_EXIT_MODE_ON_FAIL, ++ ADEV_ATTENTION, ++}; ++ + /* Events from low level driver */ + + #define TCPM_CC_EVENT BIT(0) +@@ -969,16 +977,15 @@ static void tcpm_queue_vdm(struct tcpm_port *port, const u32 header, + port->vdm_state = VDM_STATE_READY; + } + +-static void svdm_consume_identity(struct tcpm_port *port, const __le32 *payload, +- int cnt) ++static void svdm_consume_identity(struct tcpm_port *port, const u32 *p, int cnt) + { +- u32 vdo = le32_to_cpu(payload[VDO_INDEX_IDH]); +- u32 product = le32_to_cpu(payload[VDO_INDEX_PRODUCT]); ++ u32 vdo = p[VDO_INDEX_IDH]; ++ u32 product = p[VDO_INDEX_PRODUCT]; + + memset(&port->mode_data, 0, sizeof(port->mode_data)); + + port->partner_ident.id_header = vdo; +- port->partner_ident.cert_stat = le32_to_cpu(payload[VDO_INDEX_CSTAT]); ++ port->partner_ident.cert_stat = p[VDO_INDEX_CSTAT]; + port->partner_ident.product = product; + + typec_partner_set_identity(port->partner); +@@ -988,17 +995,15 @@ static void svdm_consume_identity(struct tcpm_port *port, const __le32 *payload, + PD_PRODUCT_PID(product), product & 0xffff); + } + +-static bool svdm_consume_svids(struct tcpm_port *port, const __le32 *payload, +- int cnt) ++static bool svdm_consume_svids(struct tcpm_port *port, const u32 *p, int cnt) + { + struct pd_mode_data *pmdata = &port->mode_data; + int i; + + for (i = 1; i < cnt; i++) { +- u32 p = le32_to_cpu(payload[i]); + u16 svid; + +- svid = (p >> 16) & 0xffff; ++ svid = (p[i] >> 16) & 0xffff; + if (!svid) + return false; + +@@ -1008,7 +1013,7 @@ static bool svdm_consume_svids(struct tcpm_port *port, const __le32 *payload, + pmdata->svids[pmdata->nsvids++] = svid; + tcpm_log(port, "SVID %d: 0x%x", pmdata->nsvids, svid); + +- svid = p & 0xffff; ++ svid = p[i] & 0xffff; + if (!svid) + return false; + +@@ -1038,8 +1043,7 @@ abort: + return false; + } + +-static void svdm_consume_modes(struct tcpm_port *port, const __le32 *payload, +- int cnt) ++static void svdm_consume_modes(struct tcpm_port *port, const u32 *p, int cnt) + { + struct pd_mode_data *pmdata = &port->mode_data; + struct typec_altmode_desc *paltmode; +@@ -1056,7 +1060,7 @@ static void svdm_consume_modes(struct tcpm_port *port, const __le32 *payload, + + paltmode->svid = pmdata->svids[pmdata->svid_index]; + paltmode->mode = i; +- paltmode->vdo = le32_to_cpu(payload[i]); ++ paltmode->vdo = p[i]; + + tcpm_log(port, " Alternate mode %d: SVID 0x%04x, VDO %d: 0x%08x", + pmdata->altmodes, paltmode->svid, +@@ -1084,21 +1088,17 @@ static void tcpm_register_partner_altmodes(struct tcpm_port *port) + + #define supports_modal(port) PD_IDH_MODAL_SUPP((port)->partner_ident.id_header) + +-static int tcpm_pd_svdm(struct tcpm_port *port, const __le32 *payload, int cnt, +- u32 *response) ++static int tcpm_pd_svdm(struct tcpm_port *port, struct typec_altmode *adev, ++ const u32 *p, int cnt, u32 *response, ++ enum adev_actions *adev_action) + { +- struct typec_altmode *adev; + struct typec_altmode *pdev; + struct pd_mode_data *modep; +- u32 p[PD_MAX_PAYLOAD]; + int rlen = 0; + int cmd_type; + int cmd; + int i; + +- for (i = 0; i < cnt; i++) +- p[i] = le32_to_cpu(payload[i]); +- + cmd_type = PD_VDO_CMDT(p[0]); + cmd = PD_VDO_CMD(p[0]); + +@@ -1107,9 +1107,6 @@ static int tcpm_pd_svdm(struct tcpm_port *port, const __le32 *payload, int cnt, + + modep = &port->mode_data; + +- adev = typec_match_altmode(port->port_altmode, ALTMODE_DISCOVERY_MAX, +- PD_VDO_VID(p[0]), PD_VDO_OPOS(p[0])); +- + pdev = typec_match_altmode(port->partner_altmode, ALTMODE_DISCOVERY_MAX, + PD_VDO_VID(p[0]), PD_VDO_OPOS(p[0])); + +@@ -1135,8 +1132,7 @@ static int tcpm_pd_svdm(struct tcpm_port *port, const __le32 *payload, int cnt, + break; + case CMD_ATTENTION: + /* Attention command does not have response */ +- if (adev) +- typec_altmode_attention(adev, p[1]); ++ *adev_action = ADEV_ATTENTION; + return 0; + default: + break; +@@ -1159,13 +1155,13 @@ static int tcpm_pd_svdm(struct tcpm_port *port, const __le32 *payload, int cnt, + switch (cmd) { + case CMD_DISCOVER_IDENT: + /* 6.4.4.3.1 */ +- svdm_consume_identity(port, payload, cnt); ++ svdm_consume_identity(port, p, cnt); + response[0] = VDO(USB_SID_PD, 1, CMD_DISCOVER_SVID); + rlen = 1; + break; + case CMD_DISCOVER_SVID: + /* 6.4.4.3.2 */ +- if (svdm_consume_svids(port, payload, cnt)) { ++ if (svdm_consume_svids(port, p, cnt)) { + response[0] = VDO(USB_SID_PD, 1, + CMD_DISCOVER_SVID); + rlen = 1; +@@ -1177,7 +1173,7 @@ static int tcpm_pd_svdm(struct tcpm_port *port, const __le32 *payload, int cnt, + break; + case CMD_DISCOVER_MODES: + /* 6.4.4.3.3 */ +- svdm_consume_modes(port, payload, cnt); ++ svdm_consume_modes(port, p, cnt); + modep->svid_index++; + if (modep->svid_index < modep->nsvids) { + u16 svid = modep->svids[modep->svid_index]; +@@ -1190,23 +1186,15 @@ static int tcpm_pd_svdm(struct tcpm_port *port, const __le32 *payload, int cnt, + case CMD_ENTER_MODE: + if (adev && pdev) { + typec_altmode_update_active(pdev, true); +- +- if (typec_altmode_vdm(adev, p[0], &p[1], cnt)) { +- response[0] = VDO(adev->svid, 1, +- CMD_EXIT_MODE); +- response[0] |= VDO_OPOS(adev->mode); +- return 1; +- } ++ *adev_action = ADEV_QUEUE_VDM_SEND_EXIT_MODE_ON_FAIL; + } + return 0; + case CMD_EXIT_MODE: + if (adev && pdev) { + typec_altmode_update_active(pdev, false); +- + /* Back to USB Operation */ +- WARN_ON(typec_altmode_notify(adev, +- TYPEC_STATE_USB, +- NULL)); ++ *adev_action = ADEV_NOTIFY_USB_AND_QUEUE_VDM; ++ return 0; + } + break; + default: +@@ -1217,11 +1205,8 @@ static int tcpm_pd_svdm(struct tcpm_port *port, const __le32 *payload, int cnt, + switch (cmd) { + case CMD_ENTER_MODE: + /* Back to USB Operation */ +- if (adev) +- WARN_ON(typec_altmode_notify(adev, +- TYPEC_STATE_USB, +- NULL)); +- break; ++ *adev_action = ADEV_NOTIFY_USB_AND_QUEUE_VDM; ++ return 0; + default: + break; + } +@@ -1231,24 +1216,30 @@ static int tcpm_pd_svdm(struct tcpm_port *port, const __le32 *payload, int cnt, + } + + /* Informing the alternate mode drivers about everything */ +- if (adev) +- typec_altmode_vdm(adev, p[0], &p[1], cnt); +- ++ *adev_action = ADEV_QUEUE_VDM; + return rlen; + } + + static void tcpm_handle_vdm_request(struct tcpm_port *port, + const __le32 *payload, int cnt) + { +- int rlen = 0; ++ enum adev_actions adev_action = ADEV_NONE; ++ struct typec_altmode *adev; ++ u32 p[PD_MAX_PAYLOAD]; + u32 response[8] = { }; +- u32 p0 = le32_to_cpu(payload[0]); ++ int i, rlen = 0; ++ ++ for (i = 0; i < cnt; i++) ++ p[i] = le32_to_cpu(payload[i]); ++ ++ adev = typec_match_altmode(port->port_altmode, ALTMODE_DISCOVERY_MAX, ++ PD_VDO_VID(p[0]), PD_VDO_OPOS(p[0])); + + if (port->vdm_state == VDM_STATE_BUSY) { + /* If UFP responded busy retry after timeout */ +- if (PD_VDO_CMDT(p0) == CMDT_RSP_BUSY) { ++ if (PD_VDO_CMDT(p[0]) == CMDT_RSP_BUSY) { + port->vdm_state = VDM_STATE_WAIT_RSP_BUSY; +- port->vdo_retry = (p0 & ~VDO_CMDT_MASK) | ++ port->vdo_retry = (p[0] & ~VDO_CMDT_MASK) | + CMDT_INIT; + mod_delayed_work(port->wq, &port->vdm_state_machine, + msecs_to_jiffies(PD_T_VDM_BUSY)); +@@ -1257,8 +1248,33 @@ static void tcpm_handle_vdm_request(struct tcpm_port *port, + port->vdm_state = VDM_STATE_DONE; + } + +- if (PD_VDO_SVDM(p0)) +- rlen = tcpm_pd_svdm(port, payload, cnt, response); ++ if (PD_VDO_SVDM(p[0])) ++ rlen = tcpm_pd_svdm(port, adev, p, cnt, response, &adev_action); ++ ++ if (adev) { ++ switch (adev_action) { ++ case ADEV_NONE: ++ break; ++ case ADEV_NOTIFY_USB_AND_QUEUE_VDM: ++ WARN_ON(typec_altmode_notify(adev, TYPEC_STATE_USB, NULL)); ++ typec_altmode_vdm(adev, p[0], &p[1], cnt); ++ break; ++ case ADEV_QUEUE_VDM: ++ typec_altmode_vdm(adev, p[0], &p[1], cnt); ++ break; ++ case ADEV_QUEUE_VDM_SEND_EXIT_MODE_ON_FAIL: ++ if (typec_altmode_vdm(adev, p[0], &p[1], cnt)) { ++ response[0] = VDO(adev->svid, 1, CMD_EXIT_MODE); ++ response[0] |= VDO_OPOS(adev->mode); ++ rlen = 1; ++ } ++ break; ++ case ADEV_ATTENTION: ++ if (typec_altmode_attention(adev, p[1])) ++ tcpm_log(port, "typec_altmode_attention no port partner altmode"); ++ break; ++ } ++ } + + if (rlen > 0) { + tcpm_queue_vdm(port, response[0], &response[1], rlen - 1); +diff --git a/drivers/video/backlight/bd6107.c b/drivers/video/backlight/bd6107.c +index d344fb03cb867..ba0041194029c 100644 +--- a/drivers/video/backlight/bd6107.c ++++ b/drivers/video/backlight/bd6107.c +@@ -107,7 +107,7 @@ static int bd6107_backlight_check_fb(struct backlight_device *backlight, + { + struct bd6107 *bd = bl_get_data(backlight); + +- return bd->pdata->fbdev == NULL || bd->pdata->fbdev == info->dev; ++ return bd->pdata->fbdev == NULL || bd->pdata->fbdev == info->device; + } + + static const struct backlight_ops bd6107_backlight_ops = { +diff --git a/drivers/video/backlight/gpio_backlight.c b/drivers/video/backlight/gpio_backlight.c +index 18e053e4716c4..876c1be74787b 100644 +--- a/drivers/video/backlight/gpio_backlight.c ++++ b/drivers/video/backlight/gpio_backlight.c +@@ -46,7 +46,7 @@ static int gpio_backlight_check_fb(struct backlight_device *bl, + { + struct gpio_backlight *gbl = bl_get_data(bl); + +- return gbl->fbdev == NULL || gbl->fbdev == info->dev; ++ return gbl->fbdev == NULL || gbl->fbdev == info->device; + } + + static const struct backlight_ops gpio_backlight_ops = { +diff --git a/drivers/video/backlight/lv5207lp.c b/drivers/video/backlight/lv5207lp.c +index c6ad73a784e22..c139bbc881ff6 100644 +--- a/drivers/video/backlight/lv5207lp.c ++++ b/drivers/video/backlight/lv5207lp.c +@@ -72,7 +72,7 @@ static int lv5207lp_backlight_check_fb(struct backlight_device *backlight, + { + struct lv5207lp *lv = bl_get_data(backlight); + +- return lv->pdata->fbdev == NULL || lv->pdata->fbdev == info->dev; ++ return lv->pdata->fbdev == NULL || lv->pdata->fbdev == info->device; + } + + static const struct backlight_ops lv5207lp_backlight_ops = { +diff --git a/drivers/video/fbdev/ep93xx-fb.c b/drivers/video/fbdev/ep93xx-fb.c +index d04a047094fce..546a5db5241b7 100644 +--- a/drivers/video/fbdev/ep93xx-fb.c ++++ b/drivers/video/fbdev/ep93xx-fb.c +@@ -474,7 +474,6 @@ static int ep93xxfb_probe(struct platform_device *pdev) + if (!info) + return -ENOMEM; + +- info->dev = &pdev->dev; + platform_set_drvdata(pdev, info); + fbi = info->par; + fbi->mach_info = mach_info; +diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c +index b5c0509112769..e3c78c9f84584 100644 +--- a/drivers/virtio/virtio_ring.c ++++ b/drivers/virtio/virtio_ring.c +@@ -1180,7 +1180,7 @@ static inline int virtqueue_add_packed(struct virtqueue *_vq, + } + } + +- if (i < head) ++ if (i <= head) + vq->packed.avail_wrap_counter ^= 1; + + /* We're using some buffers from the free list. */ +diff --git a/drivers/watchdog/intel-mid_wdt.c b/drivers/watchdog/intel-mid_wdt.c +index 2cdbd37c700cf..7ee355c286284 100644 +--- a/drivers/watchdog/intel-mid_wdt.c ++++ b/drivers/watchdog/intel-mid_wdt.c +@@ -181,3 +181,4 @@ module_platform_driver(mid_wdt_driver); + MODULE_AUTHOR("David Cohen <david.a.cohen@linux.intel.com>"); + MODULE_DESCRIPTION("Watchdog Driver for Intel MID platform"); + MODULE_LICENSE("GPL"); ++MODULE_ALIAS("platform:intel_mid_wdt"); +diff --git a/fs/attr.c b/fs/attr.c +index 848ffe6e3c24b..95bbd49f75c8f 100644 +--- a/fs/attr.c ++++ b/fs/attr.c +@@ -253,9 +253,25 @@ int notify_change(struct dentry * dentry, struct iattr * attr, struct inode **de + } + + if ((ia_valid & ATTR_MODE)) { +- umode_t amode = attr->ia_mode; ++ /* ++ * Don't allow changing the mode of symlinks: ++ * ++ * (1) The vfs doesn't take the mode of symlinks into account ++ * during permission checking. ++ * (2) This has never worked correctly. Most major filesystems ++ * did return EOPNOTSUPP due to interactions with POSIX ACLs ++ * but did still updated the mode of the symlink. ++ * This inconsistency led system call wrapper providers such ++ * as libc to block changing the mode of symlinks with ++ * EOPNOTSUPP already. ++ * (3) To even do this in the first place one would have to use ++ * specific file descriptors and quite some effort. ++ */ ++ if (S_ISLNK(inode->i_mode)) ++ return -EOPNOTSUPP; ++ + /* Flag setting protected by i_mutex */ +- if (is_sxid(amode)) ++ if (is_sxid(attr->ia_mode)) + inode->i_flags &= ~S_NOSEC; + } + +diff --git a/fs/autofs/waitq.c b/fs/autofs/waitq.c +index b04c528b19d34..1230bdf329898 100644 +--- a/fs/autofs/waitq.c ++++ b/fs/autofs/waitq.c +@@ -32,8 +32,9 @@ void autofs_catatonic_mode(struct autofs_sb_info *sbi) + wq->status = -ENOENT; /* Magic is gone - report failure */ + kfree(wq->name.name); + wq->name.name = NULL; +- wq->wait_ctr--; + wake_up_interruptible(&wq->queue); ++ if (!--wq->wait_ctr) ++ kfree(wq); + wq = nwq; + } + fput(sbi->pipe); /* Close the pipe */ +diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h +index c2e5fe972f566..b141a7ba4507b 100644 +--- a/fs/btrfs/ctree.h ++++ b/fs/btrfs/ctree.h +@@ -482,8 +482,6 @@ struct btrfs_swapfile_pin { + bool is_block_group; + }; + +-bool btrfs_pinned_by_swapfile(struct btrfs_fs_info *fs_info, void *ptr); +- + enum { + BTRFS_FS_BARRIER, + BTRFS_FS_CLOSING_START, +diff --git a/fs/btrfs/delayed-inode.c b/fs/btrfs/delayed-inode.c +index e96890475bac7..eacc020b1419f 100644 +--- a/fs/btrfs/delayed-inode.c ++++ b/fs/btrfs/delayed-inode.c +@@ -1175,20 +1175,33 @@ static int __btrfs_run_delayed_items(struct btrfs_trans_handle *trans, int nr) + ret = __btrfs_commit_inode_delayed_items(trans, path, + curr_node); + if (ret) { +- btrfs_release_delayed_node(curr_node); +- curr_node = NULL; + btrfs_abort_transaction(trans, ret); + break; + } + + prev_node = curr_node; + curr_node = btrfs_next_delayed_node(curr_node); ++ /* ++ * See the comment below about releasing path before releasing ++ * node. If the commit of delayed items was successful the path ++ * should always be released, but in case of an error, it may ++ * point to locked extent buffers (a leaf at the very least). ++ */ ++ ASSERT(path->nodes[0] == NULL); + btrfs_release_delayed_node(prev_node); + } + ++ /* ++ * Release the path to avoid a potential deadlock and lockdep splat when ++ * releasing the delayed node, as that requires taking the delayed node's ++ * mutex. If another task starts running delayed items before we take ++ * the mutex, it will first lock the mutex and then it may try to lock ++ * the same btree path (leaf). ++ */ ++ btrfs_free_path(path); ++ + if (curr_node) + btrfs_release_delayed_node(curr_node); +- btrfs_free_path(path); + trans->block_rsv = block_rsv; + + return ret; +diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c +index d98cf8aba753b..b4ed11b5f1480 100644 +--- a/fs/btrfs/disk-io.c ++++ b/fs/btrfs/disk-io.c +@@ -2480,21 +2480,18 @@ static int validate_super(struct btrfs_fs_info *fs_info, + ret = -EINVAL; + } + +- if (memcmp(fs_info->fs_devices->fsid, fs_info->super_copy->fsid, +- BTRFS_FSID_SIZE)) { ++ if (memcmp(fs_info->fs_devices->fsid, sb->fsid, BTRFS_FSID_SIZE) != 0) { + btrfs_err(fs_info, + "superblock fsid doesn't match fsid of fs_devices: %pU != %pU", +- fs_info->super_copy->fsid, fs_info->fs_devices->fsid); ++ sb->fsid, fs_info->fs_devices->fsid); + ret = -EINVAL; + } + +- if (btrfs_fs_incompat(fs_info, METADATA_UUID) && +- memcmp(fs_info->fs_devices->metadata_uuid, +- fs_info->super_copy->metadata_uuid, BTRFS_FSID_SIZE)) { ++ if (memcmp(fs_info->fs_devices->metadata_uuid, btrfs_sb_fsid_ptr(sb), ++ BTRFS_FSID_SIZE) != 0) { + btrfs_err(fs_info, + "superblock metadata_uuid doesn't match metadata uuid of fs_devices: %pU != %pU", +- fs_info->super_copy->metadata_uuid, +- fs_info->fs_devices->metadata_uuid); ++ btrfs_sb_fsid_ptr(sb), fs_info->fs_devices->metadata_uuid); + ret = -EINVAL; + } + +diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c +index e47f53e780890..a9191a0d2f4c9 100644 +--- a/fs/btrfs/extent-tree.c ++++ b/fs/btrfs/extent-tree.c +@@ -895,6 +895,11 @@ again: + err = -ENOENT; + goto out; + } else if (WARN_ON(ret)) { ++ btrfs_print_leaf(path->nodes[0]); ++ btrfs_err(fs_info, ++"extent item not found for insert, bytenr %llu num_bytes %llu parent %llu root_objectid %llu owner %llu offset %llu", ++ bytenr, num_bytes, parent, root_objectid, owner, ++ offset); + err = -EIO; + goto out; + } +diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c +index f2e348d22dc1e..89ffc02554069 100644 +--- a/fs/btrfs/transaction.c ++++ b/fs/btrfs/transaction.c +@@ -190,10 +190,11 @@ loop: + spin_unlock(&fs_info->trans_lock); + + /* +- * If we are ATTACH, we just want to catch the current transaction, +- * and commit it. If there is no transaction, just return ENOENT. ++ * If we are ATTACH or TRANS_JOIN_NOSTART, we just want to catch the ++ * current transaction, and commit it. If there is no transaction, just ++ * return ENOENT. + */ +- if (type == TRANS_ATTACH) ++ if (type == TRANS_ATTACH || type == TRANS_JOIN_NOSTART) + return -ENOENT; + + /* +diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c +index 0d4afeacb237b..f9192dcb9208b 100644 +--- a/fs/btrfs/volumes.c ++++ b/fs/btrfs/volumes.c +@@ -895,6 +895,14 @@ error_brelse: + return -EINVAL; + } + ++u8 *btrfs_sb_fsid_ptr(struct btrfs_super_block *sb) ++{ ++ bool has_metadata_uuid = (btrfs_super_incompat_flags(sb) & ++ BTRFS_FEATURE_INCOMPAT_METADATA_UUID); ++ ++ return has_metadata_uuid ? sb->metadata_uuid : sb->fsid; ++} ++ + /* + * Handle scanned device having its CHANGING_FSID_V2 flag set and the fs_devices + * being created with a disk that has already completed its fsid change. +diff --git a/fs/btrfs/volumes.h b/fs/btrfs/volumes.h +index aa6a6d7b2978e..762c0a3754982 100644 +--- a/fs/btrfs/volumes.h ++++ b/fs/btrfs/volumes.h +@@ -581,4 +581,7 @@ int btrfs_bg_type_to_factor(u64 flags); + const char *btrfs_bg_type_to_raid_name(u64 flags); + int btrfs_verify_dev_extents(struct btrfs_fs_info *fs_info); + ++bool btrfs_pinned_by_swapfile(struct btrfs_fs_info *fs_info, void *ptr); ++u8 *btrfs_sb_fsid_ptr(struct btrfs_super_block *sb); ++ + #endif +diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c +index 871a7b044c1b8..b6149952ab846 100644 +--- a/fs/cifs/cifsfs.c ++++ b/fs/cifs/cifsfs.c +@@ -738,11 +738,6 @@ cifs_get_root(struct smb_vol *vol, struct super_block *sb) + struct inode *dir = d_inode(dentry); + struct dentry *child; + +- if (!dir) { +- dput(dentry); +- dentry = ERR_PTR(-ENOENT); +- break; +- } + if (!S_ISDIR(dir->i_mode)) { + dput(dentry); + dentry = ERR_PTR(-ENOTDIR); +@@ -759,7 +754,7 @@ cifs_get_root(struct smb_vol *vol, struct super_block *sb) + while (*s && *s != sep) + s++; + +- child = lookup_one_len_unlocked(p, dentry, s - p); ++ child = lookup_positive_unlocked(p, dentry, s - p); + dput(dentry); + dentry = child; + } while (!IS_ERR(dentry)); +diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c +index cd0030533bf7a..ad9b207432e10 100644 +--- a/fs/cifs/smb2ops.c ++++ b/fs/cifs/smb2ops.c +@@ -79,6 +79,7 @@ smb2_add_credits(struct TCP_Server_Info *server, + *val = 65000; /* Don't get near 64K credits, avoid srv bugs */ + printk_once(KERN_WARNING "server overflowed SMB3 credits\n"); + } ++ WARN_ON_ONCE(server->in_flight == 0); + server->in_flight--; + if (server->in_flight == 0 && (optype & CIFS_OP_MASK) != CIFS_NEG_OP) + rc = change_conf(server); +diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c +index e0f07382ebebc..258230f4e4855 100644 +--- a/fs/debugfs/inode.c ++++ b/fs/debugfs/inode.c +@@ -299,13 +299,9 @@ struct dentry *debugfs_lookup(const char *name, struct dentry *parent) + if (!parent) + parent = debugfs_mount->mnt_root; + +- dentry = lookup_one_len_unlocked(name, parent, strlen(name)); ++ dentry = lookup_positive_unlocked(name, parent, strlen(name)); + if (IS_ERR(dentry)) + return NULL; +- if (!d_really_is_positive(dentry)) { +- dput(dentry); +- return NULL; +- } + return dentry; + } + EXPORT_SYMBOL_GPL(debugfs_lookup); +diff --git a/fs/dlm/plock.c b/fs/dlm/plock.c +index 28735e8c5e206..5f2e2fa2ba090 100644 +--- a/fs/dlm/plock.c ++++ b/fs/dlm/plock.c +@@ -466,7 +466,8 @@ static ssize_t dev_write(struct file *file, const char __user *u, size_t count, + } + } else { + list_for_each_entry(iter, &recv_list, list) { +- if (!iter->info.wait) { ++ if (!iter->info.wait && ++ iter->info.fsid == info.fsid) { + op = iter; + break; + } +@@ -478,8 +479,7 @@ static ssize_t dev_write(struct file *file, const char __user *u, size_t count, + if (info.wait) + WARN_ON(op->info.optype != DLM_PLOCK_OP_LOCK); + else +- WARN_ON(op->info.fsid != info.fsid || +- op->info.number != info.number || ++ WARN_ON(op->info.number != info.number || + op->info.owner != info.owner || + op->info.optype != info.optype); + +diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c +index dcc377094f90b..fb718c3e3ebdf 100644 +--- a/fs/erofs/zdata.c ++++ b/fs/erofs/zdata.c +@@ -639,6 +639,8 @@ hitted: + cur = end - min_t(erofs_off_t, offset + end - map->m_la, end); + if (!(map->m_flags & EROFS_MAP_MAPPED)) { + zero_user_segment(page, cur, end); ++ ++spiltted; ++ tight = false; + goto next_part; + } + +diff --git a/fs/eventfd.c b/fs/eventfd.c +index 78e41c7c3d05b..e144094c831df 100644 +--- a/fs/eventfd.c ++++ b/fs/eventfd.c +@@ -181,11 +181,14 @@ static __poll_t eventfd_poll(struct file *file, poll_table *wait) + return events; + } + +-static void eventfd_ctx_do_read(struct eventfd_ctx *ctx, __u64 *cnt) ++void eventfd_ctx_do_read(struct eventfd_ctx *ctx, __u64 *cnt) + { +- *cnt = (ctx->flags & EFD_SEMAPHORE) ? 1 : ctx->count; ++ lockdep_assert_held(&ctx->wqh.lock); ++ ++ *cnt = ((ctx->flags & EFD_SEMAPHORE) && ctx->count) ? 1 : ctx->count; + ctx->count -= *cnt; + } ++EXPORT_SYMBOL_GPL(eventfd_ctx_do_read); + + /** + * eventfd_ctx_remove_wait_queue - Read the current counter and removes wait queue. +diff --git a/fs/ext2/xattr.c b/fs/ext2/xattr.c +index 62acbe27d8bf4..ca7ff31a1f194 100644 +--- a/fs/ext2/xattr.c ++++ b/fs/ext2/xattr.c +@@ -690,10 +690,10 @@ ext2_xattr_set2(struct inode *inode, struct buffer_head *old_bh, + /* We need to allocate a new block */ + ext2_fsblk_t goal = ext2_group_first_block_no(sb, + EXT2_I(inode)->i_block_group); +- int block = ext2_new_block(inode, goal, &error); ++ ext2_fsblk_t block = ext2_new_block(inode, goal, &error); + if (error) + goto cleanup; +- ea_idebug(inode, "creating block %d", block); ++ ea_idebug(inode, "creating block %lu", block); + + new_bh = sb_getblk(sb, block); + if (unlikely(!new_bh)) { +diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c +index 3da931a5c9556..87c6d619a564b 100644 +--- a/fs/ext4/namei.c ++++ b/fs/ext4/namei.c +@@ -325,17 +325,17 @@ static struct ext4_dir_entry_tail *get_dirent_tail(struct inode *inode, + struct buffer_head *bh) + { + struct ext4_dir_entry_tail *t; ++ int blocksize = EXT4_BLOCK_SIZE(inode->i_sb); + + #ifdef PARANOID + struct ext4_dir_entry *d, *top; + + d = (struct ext4_dir_entry *)bh->b_data; + top = (struct ext4_dir_entry *)(bh->b_data + +- (EXT4_BLOCK_SIZE(inode->i_sb) - +- sizeof(struct ext4_dir_entry_tail))); +- while (d < top && d->rec_len) ++ (blocksize - sizeof(struct ext4_dir_entry_tail))); ++ while (d < top && ext4_rec_len_from_disk(d->rec_len, blocksize)) + d = (struct ext4_dir_entry *)(((void *)d) + +- le16_to_cpu(d->rec_len)); ++ ext4_rec_len_from_disk(d->rec_len, blocksize)); + + if (d != top) + return NULL; +@@ -346,7 +346,8 @@ static struct ext4_dir_entry_tail *get_dirent_tail(struct inode *inode, + #endif + + if (t->det_reserved_zero1 || +- le16_to_cpu(t->det_rec_len) != sizeof(struct ext4_dir_entry_tail) || ++ (ext4_rec_len_from_disk(t->det_rec_len, blocksize) != ++ sizeof(struct ext4_dir_entry_tail)) || + t->det_reserved_zero2 || + t->det_reserved_ft != EXT4_FT_DIR_CSUM) + return NULL; +@@ -427,13 +428,14 @@ static struct dx_countlimit *get_dx_countlimit(struct inode *inode, + struct ext4_dir_entry *dp; + struct dx_root_info *root; + int count_offset; ++ int blocksize = EXT4_BLOCK_SIZE(inode->i_sb); ++ unsigned int rlen = ext4_rec_len_from_disk(dirent->rec_len, blocksize); + +- if (le16_to_cpu(dirent->rec_len) == EXT4_BLOCK_SIZE(inode->i_sb)) ++ if (rlen == blocksize) + count_offset = 8; +- else if (le16_to_cpu(dirent->rec_len) == 12) { ++ else if (rlen == 12) { + dp = (struct ext4_dir_entry *)(((void *)dirent) + 12); +- if (le16_to_cpu(dp->rec_len) != +- EXT4_BLOCK_SIZE(inode->i_sb) - 12) ++ if (ext4_rec_len_from_disk(dp->rec_len, blocksize) != blocksize - 12) + return NULL; + root = (struct dx_root_info *)(((void *)dp + 12)); + if (root->reserved_zero || +@@ -1246,6 +1248,7 @@ static int dx_make_map(struct inode *dir, struct buffer_head *bh, + unsigned int buflen = bh->b_size; + char *base = bh->b_data; + struct dx_hash_info h = *hinfo; ++ int blocksize = EXT4_BLOCK_SIZE(dir->i_sb); + + if (ext4_has_metadata_csum(dir->i_sb)) + buflen -= sizeof(struct ext4_dir_entry_tail); +@@ -1259,11 +1262,12 @@ static int dx_make_map(struct inode *dir, struct buffer_head *bh, + map_tail--; + map_tail->hash = h.hash; + map_tail->offs = ((char *) de - base)>>2; +- map_tail->size = le16_to_cpu(de->rec_len); ++ map_tail->size = ext4_rec_len_from_disk(de->rec_len, ++ blocksize); + count++; + cond_resched(); + } +- de = ext4_next_entry(de, dir->i_sb->s_blocksize); ++ de = ext4_next_entry(de, blocksize); + } + return count; + } +diff --git a/fs/fuse/readdir.c b/fs/fuse/readdir.c +index 70f685b61e3a5..512609da85902 100644 +--- a/fs/fuse/readdir.c ++++ b/fs/fuse/readdir.c +@@ -238,8 +238,16 @@ retry: + dput(dentry); + dentry = alias; + } +- if (IS_ERR(dentry)) ++ if (IS_ERR(dentry)) { ++ if (!IS_ERR(inode)) { ++ struct fuse_inode *fi = get_fuse_inode(inode); ++ ++ spin_lock(&fi->lock); ++ fi->nlookup--; ++ spin_unlock(&fi->lock); ++ } + return PTR_ERR(dentry); ++ } + } + if (fc->readdirplus_auto) + set_bit(FUSE_I_INIT_RDPLUS, &get_fuse_inode(inode)->state); +diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c +index 8e8d53241386f..a785c747a8cbb 100644 +--- a/fs/jfs/jfs_dmap.c ++++ b/fs/jfs/jfs_dmap.c +@@ -269,6 +269,7 @@ int dbUnmount(struct inode *ipbmap, int mounterror) + + /* free the memory for the in-memory bmap. */ + kfree(bmp); ++ JFS_SBI(ipbmap->i_sb)->bmap = NULL; + + return (0); + } +diff --git a/fs/jfs/jfs_extent.c b/fs/jfs/jfs_extent.c +index f65bd6b35412b..d4e063dbb9a0b 100644 +--- a/fs/jfs/jfs_extent.c ++++ b/fs/jfs/jfs_extent.c +@@ -508,6 +508,11 @@ extBalloc(struct inode *ip, s64 hint, s64 * nblocks, s64 * blkno) + * blocks in the map. in that case, we'll start off with the + * maximum free. + */ ++ ++ /* give up if no space left */ ++ if (bmp->db_maxfreebud == -1) ++ return -ENOSPC; ++ + max = (s64) 1 << bmp->db_maxfreebud; + if (*nblocks >= max && *nblocks > nbperpage) + nb = nblks = (max > nbperpage) ? max : nbperpage; +diff --git a/fs/jfs/jfs_imap.c b/fs/jfs/jfs_imap.c +index 937ca07b58b1d..67c67604b8c85 100644 +--- a/fs/jfs/jfs_imap.c ++++ b/fs/jfs/jfs_imap.c +@@ -195,6 +195,7 @@ int diUnmount(struct inode *ipimap, int mounterror) + * free in-memory control structure + */ + kfree(imap); ++ JFS_IP(ipimap)->i_imap = NULL; + + return (0); + } +diff --git a/fs/kernfs/mount.c b/fs/kernfs/mount.c +index 6c12fac2c2878..d62cec6d838d6 100644 +--- a/fs/kernfs/mount.c ++++ b/fs/kernfs/mount.c +@@ -200,7 +200,7 @@ struct dentry *kernfs_node_dentry(struct kernfs_node *kn, + dput(dentry); + return ERR_PTR(-EINVAL); + } +- dtmp = lookup_one_len_unlocked(kntmp->name, dentry, ++ dtmp = lookup_positive_unlocked(kntmp->name, dentry, + strlen(kntmp->name)); + dput(dentry); + if (IS_ERR(dtmp)) +diff --git a/fs/lockd/mon.c b/fs/lockd/mon.c +index 1eabd91870e6f..d770a41f85695 100644 +--- a/fs/lockd/mon.c ++++ b/fs/lockd/mon.c +@@ -276,6 +276,9 @@ static struct nsm_handle *nsm_create_handle(const struct sockaddr *sap, + { + struct nsm_handle *new; + ++ if (!hostname) ++ return NULL; ++ + new = kzalloc(sizeof(*new) + hostname_len + 1, GFP_KERNEL); + if (unlikely(new == NULL)) + return NULL; +diff --git a/fs/locks.c b/fs/locks.c +index b8a31c1c4fff3..90f92784aa554 100644 +--- a/fs/locks.c ++++ b/fs/locks.c +@@ -1338,6 +1338,7 @@ static int posix_lock_inode(struct inode *inode, struct file_lock *request, + out: + spin_unlock(&ctx->flc_lock); + percpu_up_read(&file_rwsem); ++ trace_posix_lock_inode(inode, request, error); + /* + * Free any unused locks. + */ +@@ -1346,7 +1347,6 @@ static int posix_lock_inode(struct inode *inode, struct file_lock *request, + if (new_fl2) + locks_free_lock(new_fl2); + locks_dispose_list(&dispose); +- trace_posix_lock_inode(inode, request, error); + + return error; + } +diff --git a/fs/namei.c b/fs/namei.c +index 14e600711f504..f6708ab8ec7ed 100644 +--- a/fs/namei.c ++++ b/fs/namei.c +@@ -2565,6 +2565,26 @@ struct dentry *lookup_one_len_unlocked(const char *name, + } + EXPORT_SYMBOL(lookup_one_len_unlocked); + ++/* ++ * Like lookup_one_len_unlocked(), except that it yields ERR_PTR(-ENOENT) ++ * on negatives. Returns known positive or ERR_PTR(); that's what ++ * most of the users want. Note that pinned negative with unlocked parent ++ * _can_ become positive at any time, so callers of lookup_one_len_unlocked() ++ * need to be very careful; pinned positives have ->d_inode stable, so ++ * this one avoids such problems. ++ */ ++struct dentry *lookup_positive_unlocked(const char *name, ++ struct dentry *base, int len) ++{ ++ struct dentry *ret = lookup_one_len_unlocked(name, base, len); ++ if (!IS_ERR(ret) && d_is_negative(ret)) { ++ dput(ret); ++ ret = ERR_PTR(-ENOENT); ++ } ++ return ret; ++} ++EXPORT_SYMBOL(lookup_positive_unlocked); ++ + #ifdef CONFIG_UNIX98_PTYS + int path_pts(struct path *path) + { +@@ -2583,7 +2603,7 @@ int path_pts(struct path *path) + this.name = "pts"; + this.len = 3; + child = d_hash_and_lookup(parent, &this); +- if (!child) ++ if (IS_ERR_OR_NULL(child)) + return -ENOENT; + + path->dentry = child; +diff --git a/fs/nfs/blocklayout/dev.c b/fs/nfs/blocklayout/dev.c +index dec5880ac6de2..6e3a14fdff9c8 100644 +--- a/fs/nfs/blocklayout/dev.c ++++ b/fs/nfs/blocklayout/dev.c +@@ -422,7 +422,7 @@ bl_parse_concat(struct nfs_server *server, struct pnfs_block_dev *d, + int ret, i; + + d->children = kcalloc(v->concat.volumes_count, +- sizeof(struct pnfs_block_dev), GFP_KERNEL); ++ sizeof(struct pnfs_block_dev), gfp_mask); + if (!d->children) + return -ENOMEM; + +@@ -451,7 +451,7 @@ bl_parse_stripe(struct nfs_server *server, struct pnfs_block_dev *d, + int ret, i; + + d->children = kcalloc(v->stripe.volumes_count, +- sizeof(struct pnfs_block_dev), GFP_KERNEL); ++ sizeof(struct pnfs_block_dev), gfp_mask); + if (!d->children) + return -ENOMEM; + +diff --git a/fs/nfs/nfs2xdr.c b/fs/nfs/nfs2xdr.c +index af557dc2cfe1d..6b783e2d28554 100644 +--- a/fs/nfs/nfs2xdr.c ++++ b/fs/nfs/nfs2xdr.c +@@ -953,7 +953,7 @@ int nfs2_decode_dirent(struct xdr_stream *xdr, struct nfs_entry *entry, + + error = decode_filename_inline(xdr, &entry->name, &entry->len); + if (unlikely(error)) +- return -EAGAIN; ++ return error == -ENAMETOOLONG ? -ENAMETOOLONG : -EAGAIN; + + /* + * The type (size and byte order) of nfscookie isn't defined in +diff --git a/fs/nfs/nfs3xdr.c b/fs/nfs/nfs3xdr.c +index 84369d51353a5..6d8768ce370d2 100644 +--- a/fs/nfs/nfs3xdr.c ++++ b/fs/nfs/nfs3xdr.c +@@ -1991,7 +1991,7 @@ int nfs3_decode_dirent(struct xdr_stream *xdr, struct nfs_entry *entry, + + error = decode_inline_filename3(xdr, &entry->name, &entry->len); + if (unlikely(error)) +- return -EAGAIN; ++ return error == -ENAMETOOLONG ? -ENAMETOOLONG : -EAGAIN; + + error = decode_cookie3(xdr, &new_cookie); + if (unlikely(error)) +diff --git a/fs/nfs/pnfs_dev.c b/fs/nfs/pnfs_dev.c +index 537b80d693f1e..d4829f3f22935 100644 +--- a/fs/nfs/pnfs_dev.c ++++ b/fs/nfs/pnfs_dev.c +@@ -152,7 +152,7 @@ nfs4_get_device_info(struct nfs_server *server, + set_bit(NFS_DEVICEID_NOCACHE, &d->flags); + + out_free_pages: +- for (i = 0; i < max_pages; i++) ++ while (--i >= 0) + __free_page(pages[i]); + kfree(pages); + out_free_pdev: +diff --git a/fs/nfsd/blocklayoutxdr.c b/fs/nfsd/blocklayoutxdr.c +index 442543304930b..2455dc8be18a8 100644 +--- a/fs/nfsd/blocklayoutxdr.c ++++ b/fs/nfsd/blocklayoutxdr.c +@@ -82,6 +82,15 @@ nfsd4_block_encode_getdeviceinfo(struct xdr_stream *xdr, + int len = sizeof(__be32), ret, i; + __be32 *p; + ++ /* ++ * See paragraph 5 of RFC 8881 S18.40.3. ++ */ ++ if (!gdp->gd_maxcount) { ++ if (xdr_stream_encode_u32(xdr, 0) != XDR_UNIT) ++ return nfserr_resource; ++ return nfs_ok; ++ } ++ + p = xdr_reserve_space(xdr, len + sizeof(__be32)); + if (!p) + return nfserr_resource; +diff --git a/fs/nfsd/flexfilelayoutxdr.c b/fs/nfsd/flexfilelayoutxdr.c +index e81d2a5cf381e..bb205328e043d 100644 +--- a/fs/nfsd/flexfilelayoutxdr.c ++++ b/fs/nfsd/flexfilelayoutxdr.c +@@ -85,6 +85,15 @@ nfsd4_ff_encode_getdeviceinfo(struct xdr_stream *xdr, + int addr_len; + __be32 *p; + ++ /* ++ * See paragraph 5 of RFC 8881 S18.40.3. ++ */ ++ if (!gdp->gd_maxcount) { ++ if (xdr_stream_encode_u32(xdr, 0) != XDR_UNIT) ++ return nfserr_resource; ++ return nfs_ok; ++ } ++ + /* len + padding for two strings */ + addr_len = 16 + da->netaddr.netid_len + da->netaddr.addr_len; + ver_len = 20; +diff --git a/fs/nfsd/nfs3xdr.c b/fs/nfsd/nfs3xdr.c +index 8f077e66e613f..03e8c45a52f3c 100644 +--- a/fs/nfsd/nfs3xdr.c ++++ b/fs/nfsd/nfs3xdr.c +@@ -868,13 +868,11 @@ compose_entry_fh(struct nfsd3_readdirres *cd, struct svc_fh *fhp, + } else + dchild = dget(dparent); + } else +- dchild = lookup_one_len_unlocked(name, dparent, namlen); ++ dchild = lookup_positive_unlocked(name, dparent, namlen); + if (IS_ERR(dchild)) + return rv; + if (d_mountpoint(dchild)) + goto out; +- if (d_really_is_negative(dchild)) +- goto out; + if (dchild->d_inode->i_ino != ino) + goto out; + rv = fh_compose(fhp, exp, dchild, &cd->fh); +diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c +index bd7846758947b..e38f873f98a7f 100644 +--- a/fs/nfsd/nfs4proc.c ++++ b/fs/nfsd/nfs4proc.c +@@ -865,8 +865,8 @@ nfsd4_rename(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, + rename->rn_tname, rename->rn_tnamelen); + if (status) + return status; +- set_change_info(&rename->rn_sinfo, &cstate->current_fh); +- set_change_info(&rename->rn_tinfo, &cstate->save_fh); ++ set_change_info(&rename->rn_sinfo, &cstate->save_fh); ++ set_change_info(&rename->rn_tinfo, &cstate->current_fh); + return nfs_ok; + } + +diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c +index ff95a08574721..1d24fff2709c5 100644 +--- a/fs/nfsd/nfs4xdr.c ++++ b/fs/nfsd/nfs4xdr.c +@@ -2991,18 +2991,9 @@ nfsd4_encode_dirent_fattr(struct xdr_stream *xdr, struct nfsd4_readdir *cd, + __be32 nfserr; + int ignore_crossmnt = 0; + +- dentry = lookup_one_len_unlocked(name, cd->rd_fhp->fh_dentry, namlen); ++ dentry = lookup_positive_unlocked(name, cd->rd_fhp->fh_dentry, namlen); + if (IS_ERR(dentry)) + return nfserrno(PTR_ERR(dentry)); +- if (d_really_is_negative(dentry)) { +- /* +- * we're not holding the i_mutex here, so there's +- * a window where this directory entry could have gone +- * away. +- */ +- dput(dentry); +- return nfserr_noent; +- } + + exp_get(exp); + /* +@@ -4135,20 +4126,17 @@ nfsd4_encode_getdeviceinfo(struct nfsd4_compoundres *resp, __be32 nfserr, + + *p++ = cpu_to_be32(gdev->gd_layout_type); + +- /* If maxcount is 0 then just update notifications */ +- if (gdev->gd_maxcount != 0) { +- ops = nfsd4_layout_ops[gdev->gd_layout_type]; +- nfserr = ops->encode_getdeviceinfo(xdr, gdev); +- if (nfserr) { +- /* +- * We don't bother to burden the layout drivers with +- * enforcing gd_maxcount, just tell the client to +- * come back with a bigger buffer if it's not enough. +- */ +- if (xdr->buf->len + 4 > gdev->gd_maxcount) +- goto toosmall; +- return nfserr; +- } ++ ops = nfsd4_layout_ops[gdev->gd_layout_type]; ++ nfserr = ops->encode_getdeviceinfo(xdr, gdev); ++ if (nfserr) { ++ /* ++ * We don't bother to burden the layout drivers with ++ * enforcing gd_maxcount, just tell the client to ++ * come back with a bigger buffer if it's not enough. ++ */ ++ if (xdr->buf->len + 4 > gdev->gd_maxcount) ++ goto toosmall; ++ return nfserr; + } + + if (gdev->gd_notify_types) { +diff --git a/fs/nilfs2/alloc.c b/fs/nilfs2/alloc.c +index 235b959fc2b3a..bbd82f650e93e 100644 +--- a/fs/nilfs2/alloc.c ++++ b/fs/nilfs2/alloc.c +@@ -205,7 +205,8 @@ static int nilfs_palloc_get_block(struct inode *inode, unsigned long blkoff, + int ret; + + spin_lock(lock); +- if (prev->bh && blkoff == prev->blkoff) { ++ if (prev->bh && blkoff == prev->blkoff && ++ likely(buffer_uptodate(prev->bh))) { + get_bh(prev->bh); + *bhp = prev->bh; + spin_unlock(lock); +diff --git a/fs/nilfs2/inode.c b/fs/nilfs2/inode.c +index 4eed9500f33a7..ea94dc21af0c9 100644 +--- a/fs/nilfs2/inode.c ++++ b/fs/nilfs2/inode.c +@@ -1036,7 +1036,7 @@ int nilfs_load_inode_block(struct inode *inode, struct buffer_head **pbh) + int err; + + spin_lock(&nilfs->ns_inode_lock); +- if (ii->i_bh == NULL) { ++ if (ii->i_bh == NULL || unlikely(!buffer_uptodate(ii->i_bh))) { + spin_unlock(&nilfs->ns_inode_lock); + err = nilfs_ifile_get_inode_block(ii->i_root->ifile, + inode->i_ino, pbh); +@@ -1045,7 +1045,10 @@ int nilfs_load_inode_block(struct inode *inode, struct buffer_head **pbh) + spin_lock(&nilfs->ns_inode_lock); + if (ii->i_bh == NULL) + ii->i_bh = *pbh; +- else { ++ else if (unlikely(!buffer_uptodate(ii->i_bh))) { ++ __brelse(ii->i_bh); ++ ii->i_bh = *pbh; ++ } else { + brelse(*pbh); + *pbh = ii->i_bh; + } +diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c +index 04e1e671b6134..fdcbed6ee8326 100644 +--- a/fs/nilfs2/segment.c ++++ b/fs/nilfs2/segment.c +@@ -730,6 +730,11 @@ static size_t nilfs_lookup_dirty_data_buffers(struct inode *inode, + struct page *page = pvec.pages[i]; + + lock_page(page); ++ if (unlikely(page->mapping != mapping)) { ++ /* Exclude pages removed from the address space */ ++ unlock_page(page); ++ continue; ++ } + if (!page_has_buffers(page)) + create_empty_buffers(page, i_blocksize(inode), 0); + unlock_page(page); +diff --git a/fs/nls/nls_base.c b/fs/nls/nls_base.c +index 52ccd34b1e792..a026dbd3593f6 100644 +--- a/fs/nls/nls_base.c ++++ b/fs/nls/nls_base.c +@@ -272,7 +272,7 @@ int unregister_nls(struct nls_table * nls) + return -EINVAL; + } + +-static struct nls_table *find_nls(char *charset) ++static struct nls_table *find_nls(const char *charset) + { + struct nls_table *nls; + spin_lock(&nls_lock); +@@ -288,7 +288,7 @@ static struct nls_table *find_nls(char *charset) + return nls; + } + +-struct nls_table *load_nls(char *charset) ++struct nls_table *load_nls(const char *charset) + { + return try_then_request_module(find_nls(charset), "nls_%s", charset); + } +diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c +index fb284bf3aed15..cd6a214398266 100644 +--- a/fs/ocfs2/namei.c ++++ b/fs/ocfs2/namei.c +@@ -1524,6 +1524,10 @@ static int ocfs2_rename(struct inode *old_dir, + status = ocfs2_add_entry(handle, new_dentry, old_inode, + OCFS2_I(old_inode)->ip_blkno, + new_dir_bh, &target_insert); ++ if (status < 0) { ++ mlog_errno(status); ++ goto bail; ++ } + } + + old_inode->i_ctime = current_time(old_inode); +diff --git a/fs/overlayfs/namei.c b/fs/overlayfs/namei.c +index f47c591402d76..625da4bc8d0fc 100644 +--- a/fs/overlayfs/namei.c ++++ b/fs/overlayfs/namei.c +@@ -200,7 +200,7 @@ static int ovl_lookup_single(struct dentry *base, struct ovl_lookup_data *d, + int err; + bool last_element = !post[0]; + +- this = lookup_one_len_unlocked(name, base, namelen); ++ this = lookup_positive_unlocked(name, base, namelen); + if (IS_ERR(this)) { + err = PTR_ERR(this); + this = NULL; +@@ -208,8 +208,6 @@ static int ovl_lookup_single(struct dentry *base, struct ovl_lookup_data *d, + goto out; + goto out_err; + } +- if (!this->d_inode) +- goto put_and_out; + + if (ovl_dentry_weird(this)) { + /* Don't support traversing automounts and other weirdness */ +@@ -659,7 +657,7 @@ struct dentry *ovl_get_index_fh(struct ovl_fs *ofs, struct ovl_fh *fh) + if (err) + return ERR_PTR(err); + +- index = lookup_one_len_unlocked(name.name, ofs->indexdir, name.len); ++ index = lookup_positive_unlocked(name.name, ofs->indexdir, name.len); + kfree(name.name); + if (IS_ERR(index)) { + if (PTR_ERR(index) == -ENOENT) +@@ -667,9 +665,7 @@ struct dentry *ovl_get_index_fh(struct ovl_fs *ofs, struct ovl_fh *fh) + return index; + } + +- if (d_is_negative(index)) +- err = 0; +- else if (ovl_is_whiteout(index)) ++ if (ovl_is_whiteout(index)) + err = -ESTALE; + else if (ovl_dentry_weird(index)) + err = -EIO; +@@ -693,7 +689,7 @@ struct dentry *ovl_lookup_index(struct ovl_fs *ofs, struct dentry *upper, + if (err) + return ERR_PTR(err); + +- index = lookup_one_len_unlocked(name.name, ofs->indexdir, name.len); ++ index = lookup_positive_unlocked(name.name, ofs->indexdir, name.len); + if (IS_ERR(index)) { + err = PTR_ERR(index); + if (err == -ENOENT) { +@@ -708,9 +704,7 @@ struct dentry *ovl_lookup_index(struct ovl_fs *ofs, struct dentry *upper, + } + + inode = d_inode(index); +- if (d_is_negative(index)) { +- goto out_dput; +- } else if (ovl_is_whiteout(index) && !verify) { ++ if (ovl_is_whiteout(index) && !verify) { + /* + * When index lookup is called with !verify for decoding an + * overlay file handle, a whiteout index implies that decode +@@ -1139,7 +1133,7 @@ bool ovl_lower_positive(struct dentry *dentry) + struct dentry *this; + struct dentry *lowerdir = poe->lowerstack[i].dentry; + +- this = lookup_one_len_unlocked(name->name, lowerdir, ++ this = lookup_positive_unlocked(name->name, lowerdir, + name->len); + if (IS_ERR(this)) { + switch (PTR_ERR(this)) { +@@ -1156,10 +1150,8 @@ bool ovl_lower_positive(struct dentry *dentry) + break; + } + } else { +- if (this->d_inode) { +- positive = !ovl_is_whiteout(this); +- done = true; +- } ++ positive = !ovl_is_whiteout(this); ++ done = true; + dput(this); + } + } +diff --git a/fs/proc/base.c b/fs/proc/base.c +index 5a187e9b72212..77a3eb7c39f54 100644 +--- a/fs/proc/base.c ++++ b/fs/proc/base.c +@@ -3412,7 +3412,8 @@ static int proc_tid_comm_permission(struct inode *inode, int mask) + } + + static const struct inode_operations proc_tid_comm_inode_operations = { +- .permission = proc_tid_comm_permission, ++ .setattr = proc_setattr, ++ .permission = proc_tid_comm_permission, + }; + + /* +diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c +index 73aed51447b9a..079f1a15cab0d 100644 +--- a/fs/pstore/ram_core.c ++++ b/fs/pstore/ram_core.c +@@ -506,7 +506,7 @@ static int persistent_ram_post_init(struct persistent_ram_zone *prz, u32 sig, + sig ^= PERSISTENT_RAM_SIG; + + if (prz->buffer->sig == sig) { +- if (buffer_size(prz) == 0) { ++ if (buffer_size(prz) == 0 && buffer_start(prz) == 0) { + pr_debug("found existing empty buffer\n"); + return 0; + } +diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c +index 3d1a71d2909bb..89990f9b31d50 100644 +--- a/fs/quota/dquot.c ++++ b/fs/quota/dquot.c +@@ -223,13 +223,22 @@ static void put_quota_format(struct quota_format_type *fmt) + + /* + * Dquot List Management: +- * The quota code uses four lists for dquot management: the inuse_list, +- * free_dquots, dqi_dirty_list, and dquot_hash[] array. A single dquot +- * structure may be on some of those lists, depending on its current state. ++ * The quota code uses five lists for dquot management: the inuse_list, ++ * releasing_dquots, free_dquots, dqi_dirty_list, and dquot_hash[] array. ++ * A single dquot structure may be on some of those lists, depending on ++ * its current state. + * + * All dquots are placed to the end of inuse_list when first created, and this + * list is used for invalidate operation, which must look at every dquot. + * ++ * When the last reference of a dquot will be dropped, the dquot will be ++ * added to releasing_dquots. We'd then queue work item which would call ++ * synchronize_srcu() and after that perform the final cleanup of all the ++ * dquots on the list. Both releasing_dquots and free_dquots use the ++ * dq_free list_head in the dquot struct. When a dquot is removed from ++ * releasing_dquots, a reference count is always subtracted, and if ++ * dq_count == 0 at that point, the dquot will be added to the free_dquots. ++ * + * Unused dquots (dq_count == 0) are added to the free_dquots list when freed, + * and this list is searched whenever we need an available dquot. Dquots are + * removed from the list as soon as they are used again, and +@@ -248,6 +257,7 @@ static void put_quota_format(struct quota_format_type *fmt) + + static LIST_HEAD(inuse_list); + static LIST_HEAD(free_dquots); ++static LIST_HEAD(releasing_dquots); + static unsigned int dq_hash_bits, dq_hash_mask; + static struct hlist_head *dquot_hash; + +@@ -258,6 +268,9 @@ static qsize_t inode_get_rsv_space(struct inode *inode); + static qsize_t __inode_get_rsv_space(struct inode *inode); + static int __dquot_initialize(struct inode *inode, int type); + ++static void quota_release_workfn(struct work_struct *work); ++static DECLARE_DELAYED_WORK(quota_release_work, quota_release_workfn); ++ + static inline unsigned int + hashfn(const struct super_block *sb, struct kqid qid) + { +@@ -305,12 +318,18 @@ static inline void put_dquot_last(struct dquot *dquot) + dqstats_inc(DQST_FREE_DQUOTS); + } + ++static inline void put_releasing_dquots(struct dquot *dquot) ++{ ++ list_add_tail(&dquot->dq_free, &releasing_dquots); ++} ++ + static inline void remove_free_dquot(struct dquot *dquot) + { + if (list_empty(&dquot->dq_free)) + return; + list_del_init(&dquot->dq_free); +- dqstats_dec(DQST_FREE_DQUOTS); ++ if (!atomic_read(&dquot->dq_count)) ++ dqstats_dec(DQST_FREE_DQUOTS); + } + + static inline void put_inuse(struct dquot *dquot) +@@ -336,6 +355,11 @@ static void wait_on_dquot(struct dquot *dquot) + mutex_unlock(&dquot->dq_lock); + } + ++static inline int dquot_active(struct dquot *dquot) ++{ ++ return test_bit(DQ_ACTIVE_B, &dquot->dq_flags); ++} ++ + static inline int dquot_dirty(struct dquot *dquot) + { + return test_bit(DQ_MOD_B, &dquot->dq_flags); +@@ -351,14 +375,14 @@ int dquot_mark_dquot_dirty(struct dquot *dquot) + { + int ret = 1; + +- if (!test_bit(DQ_ACTIVE_B, &dquot->dq_flags)) ++ if (!dquot_active(dquot)) + return 0; + + if (sb_dqopt(dquot->dq_sb)->flags & DQUOT_NOLIST_DIRTY) + return test_and_set_bit(DQ_MOD_B, &dquot->dq_flags); + + /* If quota is dirty already, we don't have to acquire dq_list_lock */ +- if (test_bit(DQ_MOD_B, &dquot->dq_flags)) ++ if (dquot_dirty(dquot)) + return 1; + + spin_lock(&dq_list_lock); +@@ -438,7 +462,7 @@ int dquot_acquire(struct dquot *dquot) + smp_mb__before_atomic(); + set_bit(DQ_READ_B, &dquot->dq_flags); + /* Instantiate dquot if needed */ +- if (!test_bit(DQ_ACTIVE_B, &dquot->dq_flags) && !dquot->dq_off) { ++ if (!dquot_active(dquot) && !dquot->dq_off) { + ret = dqopt->ops[dquot->dq_id.type]->commit_dqblk(dquot); + /* Write the info if needed */ + if (info_dirty(&dqopt->info[dquot->dq_id.type])) { +@@ -477,7 +501,7 @@ int dquot_commit(struct dquot *dquot) + goto out_lock; + /* Inactive dquot can be only if there was error during read/init + * => we have better not writing it */ +- if (test_bit(DQ_ACTIVE_B, &dquot->dq_flags)) ++ if (dquot_active(dquot)) + ret = dqopt->ops[dquot->dq_id.type]->commit_dqblk(dquot); + else + ret = -EIO; +@@ -538,6 +562,8 @@ static void invalidate_dquots(struct super_block *sb, int type) + struct dquot *dquot, *tmp; + + restart: ++ flush_delayed_work("a_release_work); ++ + spin_lock(&dq_list_lock); + list_for_each_entry_safe(dquot, tmp, &inuse_list, dq_inuse) { + if (dquot->dq_sb != sb) +@@ -546,6 +572,12 @@ restart: + continue; + /* Wait for dquot users */ + if (atomic_read(&dquot->dq_count)) { ++ /* dquot in releasing_dquots, flush and retry */ ++ if (!list_empty(&dquot->dq_free)) { ++ spin_unlock(&dq_list_lock); ++ goto restart; ++ } ++ + atomic_inc(&dquot->dq_count); + spin_unlock(&dq_list_lock); + /* +@@ -588,14 +620,13 @@ int dquot_scan_active(struct super_block *sb, + + spin_lock(&dq_list_lock); + list_for_each_entry(dquot, &inuse_list, dq_inuse) { +- if (!test_bit(DQ_ACTIVE_B, &dquot->dq_flags)) ++ if (!dquot_active(dquot)) + continue; + if (dquot->dq_sb != sb) + continue; + /* Now we have active dquot so we can just increase use count */ + atomic_inc(&dquot->dq_count); + spin_unlock(&dq_list_lock); +- dqstats_inc(DQST_LOOKUPS); + dqput(old_dquot); + old_dquot = dquot; + /* +@@ -604,7 +635,7 @@ int dquot_scan_active(struct super_block *sb, + * outstanding call and recheck the DQ_ACTIVE_B after that. + */ + wait_on_dquot(dquot); +- if (test_bit(DQ_ACTIVE_B, &dquot->dq_flags)) { ++ if (dquot_active(dquot)) { + ret = fn(dquot, priv); + if (ret < 0) + goto out; +@@ -620,6 +651,18 @@ out: + } + EXPORT_SYMBOL(dquot_scan_active); + ++static inline int dquot_write_dquot(struct dquot *dquot) ++{ ++ int ret = dquot->dq_sb->dq_op->write_dquot(dquot); ++ if (ret < 0) { ++ quota_error(dquot->dq_sb, "Can't write quota structure " ++ "(error %d). Quota may get out of sync!", ret); ++ /* Clear dirty bit anyway to avoid infinite loop. */ ++ clear_dquot_dirty(dquot); ++ } ++ return ret; ++} ++ + /* Write all dquot structures to quota files */ + int dquot_writeback_dquots(struct super_block *sb, int type) + { +@@ -643,24 +686,16 @@ int dquot_writeback_dquots(struct super_block *sb, int type) + dquot = list_first_entry(&dirty, struct dquot, + dq_dirty); + +- WARN_ON(!test_bit(DQ_ACTIVE_B, &dquot->dq_flags)); ++ WARN_ON(!dquot_active(dquot)); + + /* Now we have active dquot from which someone is + * holding reference so we can safely just increase + * use count */ + dqgrab(dquot); + spin_unlock(&dq_list_lock); +- dqstats_inc(DQST_LOOKUPS); +- err = sb->dq_op->write_dquot(dquot); +- if (err) { +- /* +- * Clear dirty bit anyway to avoid infinite +- * loop here. +- */ +- clear_dquot_dirty(dquot); +- if (!ret) +- ret = err; +- } ++ err = dquot_write_dquot(dquot); ++ if (err && !ret) ++ ret = err; + dqput(dquot); + spin_lock(&dq_list_lock); + } +@@ -753,13 +788,54 @@ static struct shrinker dqcache_shrinker = { + .seeks = DEFAULT_SEEKS, + }; + ++/* ++ * Safely release dquot and put reference to dquot. ++ */ ++static void quota_release_workfn(struct work_struct *work) ++{ ++ struct dquot *dquot; ++ struct list_head rls_head; ++ ++ spin_lock(&dq_list_lock); ++ /* Exchange the list head to avoid livelock. */ ++ list_replace_init(&releasing_dquots, &rls_head); ++ spin_unlock(&dq_list_lock); ++ ++restart: ++ synchronize_srcu(&dquot_srcu); ++ spin_lock(&dq_list_lock); ++ while (!list_empty(&rls_head)) { ++ dquot = list_first_entry(&rls_head, struct dquot, dq_free); ++ /* Dquot got used again? */ ++ if (atomic_read(&dquot->dq_count) > 1) { ++ remove_free_dquot(dquot); ++ atomic_dec(&dquot->dq_count); ++ continue; ++ } ++ if (dquot_dirty(dquot)) { ++ spin_unlock(&dq_list_lock); ++ /* Commit dquot before releasing */ ++ dquot_write_dquot(dquot); ++ goto restart; ++ } ++ if (dquot_active(dquot)) { ++ spin_unlock(&dq_list_lock); ++ dquot->dq_sb->dq_op->release_dquot(dquot); ++ goto restart; ++ } ++ /* Dquot is inactive and clean, now move it to free list */ ++ remove_free_dquot(dquot); ++ atomic_dec(&dquot->dq_count); ++ put_dquot_last(dquot); ++ } ++ spin_unlock(&dq_list_lock); ++} ++ + /* + * Put reference to dquot + */ + void dqput(struct dquot *dquot) + { +- int ret; +- + if (!dquot) + return; + #ifdef CONFIG_QUOTA_DEBUG +@@ -771,7 +847,7 @@ void dqput(struct dquot *dquot) + } + #endif + dqstats_inc(DQST_DROPS); +-we_slept: ++ + spin_lock(&dq_list_lock); + if (atomic_read(&dquot->dq_count) > 1) { + /* We have more than one user... nothing to do */ +@@ -783,35 +859,15 @@ we_slept: + spin_unlock(&dq_list_lock); + return; + } ++ + /* Need to release dquot? */ +- if (dquot_dirty(dquot)) { +- spin_unlock(&dq_list_lock); +- /* Commit dquot before releasing */ +- ret = dquot->dq_sb->dq_op->write_dquot(dquot); +- if (ret < 0) { +- quota_error(dquot->dq_sb, "Can't write quota structure" +- " (error %d). Quota may get out of sync!", +- ret); +- /* +- * We clear dirty bit anyway, so that we avoid +- * infinite loop here +- */ +- clear_dquot_dirty(dquot); +- } +- goto we_slept; +- } +- if (test_bit(DQ_ACTIVE_B, &dquot->dq_flags)) { +- spin_unlock(&dq_list_lock); +- dquot->dq_sb->dq_op->release_dquot(dquot); +- goto we_slept; +- } +- atomic_dec(&dquot->dq_count); + #ifdef CONFIG_QUOTA_DEBUG + /* sanity check */ + BUG_ON(!list_empty(&dquot->dq_free)); + #endif +- put_dquot_last(dquot); ++ put_releasing_dquots(dquot); + spin_unlock(&dq_list_lock); ++ queue_delayed_work(system_unbound_wq, "a_release_work, 1); + } + EXPORT_SYMBOL(dqput); + +@@ -901,7 +957,7 @@ we_slept: + * already finished or it will be canceled due to dq_count > 1 test */ + wait_on_dquot(dquot); + /* Read the dquot / allocate space in quota file */ +- if (!test_bit(DQ_ACTIVE_B, &dquot->dq_flags)) { ++ if (!dquot_active(dquot)) { + int err; + + err = sb->dq_op->acquire_dquot(dquot); +@@ -1418,7 +1474,7 @@ static int info_bdq_free(struct dquot *dquot, qsize_t space) + return QUOTA_NL_NOWARN; + } + +-static int dquot_active(const struct inode *inode) ++static int inode_quota_active(const struct inode *inode) + { + struct super_block *sb = inode->i_sb; + +@@ -1441,7 +1497,7 @@ static int __dquot_initialize(struct inode *inode, int type) + qsize_t rsv; + int ret = 0; + +- if (!dquot_active(inode)) ++ if (!inode_quota_active(inode)) + return 0; + + dquots = i_dquot(inode); +@@ -1549,7 +1605,7 @@ bool dquot_initialize_needed(struct inode *inode) + struct dquot **dquots; + int i; + +- if (!dquot_active(inode)) ++ if (!inode_quota_active(inode)) + return false; + + dquots = i_dquot(inode); +@@ -1660,7 +1716,7 @@ int __dquot_alloc_space(struct inode *inode, qsize_t number, int flags) + int reserve = flags & DQUOT_SPACE_RESERVE; + struct dquot **dquots; + +- if (!dquot_active(inode)) { ++ if (!inode_quota_active(inode)) { + if (reserve) { + spin_lock(&inode->i_lock); + *inode_reserved_space(inode) += number; +@@ -1730,7 +1786,7 @@ int dquot_alloc_inode(struct inode *inode) + struct dquot_warn warn[MAXQUOTAS]; + struct dquot * const *dquots; + +- if (!dquot_active(inode)) ++ if (!inode_quota_active(inode)) + return 0; + for (cnt = 0; cnt < MAXQUOTAS; cnt++) + warn[cnt].w_type = QUOTA_NL_NOWARN; +@@ -1773,7 +1829,7 @@ int dquot_claim_space_nodirty(struct inode *inode, qsize_t number) + struct dquot **dquots; + int cnt, index; + +- if (!dquot_active(inode)) { ++ if (!inode_quota_active(inode)) { + spin_lock(&inode->i_lock); + *inode_reserved_space(inode) -= number; + __inode_add_bytes(inode, number); +@@ -1815,7 +1871,7 @@ void dquot_reclaim_space_nodirty(struct inode *inode, qsize_t number) + struct dquot **dquots; + int cnt, index; + +- if (!dquot_active(inode)) { ++ if (!inode_quota_active(inode)) { + spin_lock(&inode->i_lock); + *inode_reserved_space(inode) += number; + __inode_sub_bytes(inode, number); +@@ -1859,7 +1915,7 @@ void __dquot_free_space(struct inode *inode, qsize_t number, int flags) + struct dquot **dquots; + int reserve = flags & DQUOT_SPACE_RESERVE, index; + +- if (!dquot_active(inode)) { ++ if (!inode_quota_active(inode)) { + if (reserve) { + spin_lock(&inode->i_lock); + *inode_reserved_space(inode) -= number; +@@ -1914,7 +1970,7 @@ void dquot_free_inode(struct inode *inode) + struct dquot * const *dquots; + int index; + +- if (!dquot_active(inode)) ++ if (!inode_quota_active(inode)) + return; + + dquots = i_dquot(inode); +@@ -2085,7 +2141,7 @@ int dquot_transfer(struct inode *inode, struct iattr *iattr) + struct super_block *sb = inode->i_sb; + int ret; + +- if (!dquot_active(inode)) ++ if (!inode_quota_active(inode)) + return 0; + + if (iattr->ia_valid & ATTR_UID && !uid_eq(iattr->ia_uid, inode->i_uid)){ +@@ -2543,21 +2599,15 @@ int dquot_quota_on_mount(struct super_block *sb, char *qf_name, + struct dentry *dentry; + int error; + +- dentry = lookup_one_len_unlocked(qf_name, sb->s_root, strlen(qf_name)); ++ dentry = lookup_positive_unlocked(qf_name, sb->s_root, strlen(qf_name)); + if (IS_ERR(dentry)) + return PTR_ERR(dentry); + +- if (d_really_is_negative(dentry)) { +- error = -ENOENT; +- goto out; +- } +- + error = security_quota_on(dentry); + if (!error) + error = vfs_load_quota_inode(d_inode(dentry), type, format_id, + DQUOT_USAGE_ENABLED | DQUOT_LIMITS_ENABLED); + +-out: + dput(dentry); + return error; + } +diff --git a/fs/reiserfs/journal.c b/fs/reiserfs/journal.c +index 09ad022a78a55..b8277a5dfe40e 100644 +--- a/fs/reiserfs/journal.c ++++ b/fs/reiserfs/journal.c +@@ -2327,7 +2327,7 @@ static struct buffer_head *reiserfs_breada(struct block_device *dev, + int i, j; + + bh = __getblk(dev, block, bufsize); +- if (buffer_uptodate(bh)) ++ if (!bh || buffer_uptodate(bh)) + return (bh); + + if (block + BUFNR > max_block) { +@@ -2337,6 +2337,8 @@ static struct buffer_head *reiserfs_breada(struct block_device *dev, + j = 1; + for (i = 1; i < blocks; i++) { + bh = __getblk(dev, block + i, bufsize); ++ if (!bh) ++ break; + if (buffer_uptodate(bh)) { + brelse(bh); + break; +diff --git a/fs/tracefs/inode.c b/fs/tracefs/inode.c +index 8fbf8658644f0..90ce45c8ecac7 100644 +--- a/fs/tracefs/inode.c ++++ b/fs/tracefs/inode.c +@@ -551,6 +551,9 @@ static struct dentry *__create_dir(const char *name, struct dentry *parent, + */ + struct dentry *tracefs_create_dir(const char *name, struct dentry *parent) + { ++ if (security_locked_down(LOCKDOWN_TRACEFS)) ++ return NULL; ++ + return __create_dir(name, parent, &simple_dir_inode_operations); + } + +diff --git a/fs/udf/balloc.c b/fs/udf/balloc.c +index 8e597db4d9710..f416b7fe092fc 100644 +--- a/fs/udf/balloc.c ++++ b/fs/udf/balloc.c +@@ -36,18 +36,41 @@ static int read_block_bitmap(struct super_block *sb, + unsigned long bitmap_nr) + { + struct buffer_head *bh = NULL; +- int retval = 0; ++ int i; ++ int max_bits, off, count; + struct kernel_lb_addr loc; + + loc.logicalBlockNum = bitmap->s_extPosition; + loc.partitionReferenceNum = UDF_SB(sb)->s_partition; + + bh = udf_tread(sb, udf_get_lb_pblock(sb, &loc, block)); ++ bitmap->s_block_bitmap[bitmap_nr] = bh; + if (!bh) +- retval = -EIO; ++ return -EIO; + +- bitmap->s_block_bitmap[bitmap_nr] = bh; +- return retval; ++ /* Check consistency of Space Bitmap buffer. */ ++ max_bits = sb->s_blocksize * 8; ++ if (!bitmap_nr) { ++ off = sizeof(struct spaceBitmapDesc) << 3; ++ count = min(max_bits - off, bitmap->s_nr_groups); ++ } else { ++ /* ++ * Rough check if bitmap number is too big to have any bitmap ++ * blocks reserved. ++ */ ++ if (bitmap_nr > ++ (bitmap->s_nr_groups >> (sb->s_blocksize_bits + 3)) + 2) ++ return 0; ++ off = 0; ++ count = bitmap->s_nr_groups - bitmap_nr * max_bits + ++ (sizeof(struct spaceBitmapDesc) << 3); ++ count = min(count, max_bits); ++ } ++ ++ for (i = 0; i < count; i++) ++ if (udf_test_bit(i + off, bh->b_data)) ++ return -EFSCORRUPTED; ++ return 0; + } + + static int __load_block_bitmap(struct super_block *sb, +diff --git a/fs/udf/inode.c b/fs/udf/inode.c +index 6b3531f55ee88..fef6e5e06e3f2 100644 +--- a/fs/udf/inode.c ++++ b/fs/udf/inode.c +@@ -57,15 +57,15 @@ static int udf_update_inode(struct inode *, int); + static int udf_sync_inode(struct inode *inode); + static int udf_alloc_i_data(struct inode *inode, size_t size); + static sector_t inode_getblk(struct inode *, sector_t, int *, int *); +-static int8_t udf_insert_aext(struct inode *, struct extent_position, +- struct kernel_lb_addr, uint32_t); ++static int udf_insert_aext(struct inode *, struct extent_position, ++ struct kernel_lb_addr, uint32_t); + static void udf_split_extents(struct inode *, int *, int, udf_pblk_t, + struct kernel_long_ad *, int *); + static void udf_prealloc_extents(struct inode *, int, int, + struct kernel_long_ad *, int *); + static void udf_merge_extents(struct inode *, struct kernel_long_ad *, int *); +-static void udf_update_extents(struct inode *, struct kernel_long_ad *, int, +- int, struct extent_position *); ++static int udf_update_extents(struct inode *, struct kernel_long_ad *, int, ++ int, struct extent_position *); + static int udf_get_block(struct inode *, sector_t, struct buffer_head *, int); + + static void __udf_clear_extent_cache(struct inode *inode) +@@ -698,7 +698,7 @@ static sector_t inode_getblk(struct inode *inode, sector_t block, + struct kernel_lb_addr eloc, tmpeloc; + int c = 1; + loff_t lbcount = 0, b_off = 0; +- udf_pblk_t newblocknum, newblock; ++ udf_pblk_t newblocknum, newblock = 0; + sector_t offset = 0; + int8_t etype; + struct udf_inode_info *iinfo = UDF_I(inode); +@@ -801,7 +801,6 @@ static sector_t inode_getblk(struct inode *inode, sector_t block, + ret = udf_do_extend_file(inode, &prev_epos, laarr, hole_len); + if (ret < 0) { + *err = ret; +- newblock = 0; + goto out_free; + } + c = 0; +@@ -864,7 +863,6 @@ static sector_t inode_getblk(struct inode *inode, sector_t block, + goal, err); + if (!newblocknum) { + *err = -ENOSPC; +- newblock = 0; + goto out_free; + } + if (isBeyondEOF) +@@ -890,7 +888,9 @@ static sector_t inode_getblk(struct inode *inode, sector_t block, + /* write back the new extents, inserting new extents if the new number + * of extents is greater than the old number, and deleting extents if + * the new number of extents is less than the old number */ +- udf_update_extents(inode, laarr, startnum, endnum, &prev_epos); ++ *err = udf_update_extents(inode, laarr, startnum, endnum, &prev_epos); ++ if (*err < 0) ++ goto out_free; + + newblock = udf_get_pblock(inode->i_sb, newblocknum, + iinfo->i_location.partitionReferenceNum, 0); +@@ -1158,21 +1158,30 @@ static void udf_merge_extents(struct inode *inode, struct kernel_long_ad *laarr, + } + } + +-static void udf_update_extents(struct inode *inode, struct kernel_long_ad *laarr, +- int startnum, int endnum, +- struct extent_position *epos) ++static int udf_update_extents(struct inode *inode, struct kernel_long_ad *laarr, ++ int startnum, int endnum, ++ struct extent_position *epos) + { + int start = 0, i; + struct kernel_lb_addr tmploc; + uint32_t tmplen; ++ int err; + + if (startnum > endnum) { + for (i = 0; i < (startnum - endnum); i++) + udf_delete_aext(inode, *epos); + } else if (startnum < endnum) { + for (i = 0; i < (endnum - startnum); i++) { +- udf_insert_aext(inode, *epos, laarr[i].extLocation, +- laarr[i].extLength); ++ err = udf_insert_aext(inode, *epos, ++ laarr[i].extLocation, ++ laarr[i].extLength); ++ /* ++ * If we fail here, we are likely corrupting the extent ++ * list and leaking blocks. At least stop early to ++ * limit the damage. ++ */ ++ if (err < 0) ++ return err; + udf_next_aext(inode, epos, &laarr[i].extLocation, + &laarr[i].extLength, 1); + start++; +@@ -1184,6 +1193,7 @@ static void udf_update_extents(struct inode *inode, struct kernel_long_ad *laarr + udf_write_aext(inode, epos, &laarr[i].extLocation, + laarr[i].extLength, 1); + } ++ return 0; + } + + struct buffer_head *udf_bread(struct inode *inode, udf_pblk_t block, +@@ -2218,12 +2228,13 @@ int8_t udf_current_aext(struct inode *inode, struct extent_position *epos, + return etype; + } + +-static int8_t udf_insert_aext(struct inode *inode, struct extent_position epos, +- struct kernel_lb_addr neloc, uint32_t nelen) ++static int udf_insert_aext(struct inode *inode, struct extent_position epos, ++ struct kernel_lb_addr neloc, uint32_t nelen) + { + struct kernel_lb_addr oeloc; + uint32_t oelen; + int8_t etype; ++ int err; + + if (epos.bh) + get_bh(epos.bh); +@@ -2233,10 +2244,10 @@ static int8_t udf_insert_aext(struct inode *inode, struct extent_position epos, + neloc = oeloc; + nelen = (etype << 30) | oelen; + } +- udf_add_aext(inode, &epos, &neloc, nelen, 1); ++ err = udf_add_aext(inode, &epos, &neloc, nelen, 1); + brelse(epos.bh); + +- return (nelen >> 30); ++ return err; + } + + int8_t udf_delete_aext(struct inode *inode, struct extent_position epos) +diff --git a/fs/verity/signature.c b/fs/verity/signature.c +index c8b255232de54..cd8cbc895a4f4 100644 +--- a/fs/verity/signature.c ++++ b/fs/verity/signature.c +@@ -58,6 +58,22 @@ int fsverity_verify_signature(const struct fsverity_info *vi, + return -EBADMSG; + } + ++ if (fsverity_keyring->keys.nr_leaves_on_tree == 0) { ++ /* ++ * The ".fs-verity" keyring is empty, due to builtin signatures ++ * being supported by the kernel but not actually being used. ++ * In this case, verify_pkcs7_signature() would always return an ++ * error, usually ENOKEY. It could also be EBADMSG if the ++ * PKCS#7 is malformed, but that isn't very important to ++ * distinguish. So, just skip to ENOKEY to avoid the attack ++ * surface of the PKCS#7 parser, which would otherwise be ++ * reachable by any task able to execute FS_IOC_ENABLE_VERITY. ++ */ ++ fsverity_err(inode, ++ "fs-verity keyring is empty, rejecting signed file!"); ++ return -ENOKEY; ++ } ++ + d = kzalloc(sizeof(*d) + hash_alg->digest_size, GFP_KERNEL); + if (!d) + return -ENOMEM; +diff --git a/include/linux/acpi_iort.h b/include/linux/acpi_iort.h +index 8e7e2ec37f1b2..64f700254ca0f 100644 +--- a/include/linux/acpi_iort.h ++++ b/include/linux/acpi_iort.h +@@ -21,6 +21,7 @@ + */ + #define IORT_SMMU_V3_PMCG_GENERIC 0x00000000 /* Generic SMMUv3 PMCG */ + #define IORT_SMMU_V3_PMCG_HISI_HIP08 0x00000001 /* HiSilicon HIP08 PMCG */ ++#define IORT_SMMU_V3_PMCG_HISI_HIP09 0x00000002 /* HiSilicon HIP09 PMCG */ + + int iort_register_domain_token(int trans_id, phys_addr_t base, + struct fwnode_handle *fw_node); +diff --git a/include/linux/eventfd.h b/include/linux/eventfd.h +index 3482f9365a4db..de0ad39d4281f 100644 +--- a/include/linux/eventfd.h ++++ b/include/linux/eventfd.h +@@ -41,6 +41,7 @@ struct eventfd_ctx *eventfd_ctx_fileget(struct file *file); + __u64 eventfd_signal(struct eventfd_ctx *ctx, __u64 n); + int eventfd_ctx_remove_wait_queue(struct eventfd_ctx *ctx, wait_queue_entry_t *wait, + __u64 *cnt); ++void eventfd_ctx_do_read(struct eventfd_ctx *ctx, __u64 *cnt); + + DECLARE_PER_CPU(int, eventfd_wake_count); + +@@ -82,6 +83,11 @@ static inline bool eventfd_signal_count(void) + return false; + } + ++static inline void eventfd_ctx_do_read(struct eventfd_ctx *ctx, __u64 *cnt) ++{ ++ ++} ++ + #endif + + #endif /* _LINUX_EVENTFD_H */ +diff --git a/include/linux/if_arp.h b/include/linux/if_arp.h +index e147ea6794670..91db78e67edcc 100644 +--- a/include/linux/if_arp.h ++++ b/include/linux/if_arp.h +@@ -52,6 +52,10 @@ static inline bool dev_is_mac_header_xmit(const struct net_device *dev) + case ARPHRD_NONE: + case ARPHRD_RAWIP: + case ARPHRD_PIMREG: ++ /* PPP adds its l2 header automatically in ppp_start_xmit(). ++ * This makes it look like an l3 device to __bpf_redirect() and tcf_mirred_init(). ++ */ ++ case ARPHRD_PPP: + return false; + default: + return true; +diff --git a/include/linux/namei.h b/include/linux/namei.h +index 397a08ade6a21..7fe7b87a3ded9 100644 +--- a/include/linux/namei.h ++++ b/include/linux/namei.h +@@ -60,6 +60,7 @@ extern int kern_path_mountpoint(int, const char *, struct path *, unsigned int); + extern struct dentry *try_lookup_one_len(const char *, struct dentry *, int); + extern struct dentry *lookup_one_len(const char *, struct dentry *, int); + extern struct dentry *lookup_one_len_unlocked(const char *, struct dentry *, int); ++extern struct dentry *lookup_positive_unlocked(const char *, struct dentry *, int); + + extern int follow_down_one(struct path *); + extern int follow_down(struct path *); +diff --git a/include/linux/nls.h b/include/linux/nls.h +index 499e486b3722d..e0bf8367b274a 100644 +--- a/include/linux/nls.h ++++ b/include/linux/nls.h +@@ -47,7 +47,7 @@ enum utf16_endian { + /* nls_base.c */ + extern int __register_nls(struct nls_table *, struct module *); + extern int unregister_nls(struct nls_table *); +-extern struct nls_table *load_nls(char *); ++extern struct nls_table *load_nls(const char *charset); + extern void unload_nls(struct nls_table *); + extern struct nls_table *load_nls_default(void); + #define register_nls(nls) __register_nls((nls), THIS_MODULE) +diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h +index b7ac395513c0f..c99e2f851d312 100644 +--- a/include/linux/perf_event.h ++++ b/include/linux/perf_event.h +@@ -1018,15 +1018,31 @@ extern int perf_event_output(struct perf_event *event, + struct pt_regs *regs); + + static inline bool +-is_default_overflow_handler(struct perf_event *event) ++__is_default_overflow_handler(perf_overflow_handler_t overflow_handler) + { +- if (likely(event->overflow_handler == perf_event_output_forward)) ++ if (likely(overflow_handler == perf_event_output_forward)) + return true; +- if (unlikely(event->overflow_handler == perf_event_output_backward)) ++ if (unlikely(overflow_handler == perf_event_output_backward)) + return true; + return false; + } + ++#define is_default_overflow_handler(event) \ ++ __is_default_overflow_handler((event)->overflow_handler) ++ ++#ifdef CONFIG_BPF_SYSCALL ++static inline bool uses_default_overflow_handler(struct perf_event *event) ++{ ++ if (likely(is_default_overflow_handler(event))) ++ return true; ++ ++ return __is_default_overflow_handler(event->orig_overflow_handler); ++} ++#else ++#define uses_default_overflow_handler(event) \ ++ is_default_overflow_handler(event) ++#endif ++ + extern void + perf_event_header__init_id(struct perf_event_header *header, + struct perf_sample_data *data, +diff --git a/include/linux/sched/task.h b/include/linux/sched/task.h +index 853ab403e77b8..e3c20a4f81f5e 100644 +--- a/include/linux/sched/task.h ++++ b/include/linux/sched/task.h +@@ -113,10 +113,36 @@ static inline struct task_struct *get_task_struct(struct task_struct *t) + } + + extern void __put_task_struct(struct task_struct *t); ++extern void __put_task_struct_rcu_cb(struct rcu_head *rhp); + + static inline void put_task_struct(struct task_struct *t) + { +- if (refcount_dec_and_test(&t->usage)) ++ if (!refcount_dec_and_test(&t->usage)) ++ return; ++ ++ /* ++ * under PREEMPT_RT, we can't call put_task_struct ++ * in atomic context because it will indirectly ++ * acquire sleeping locks. ++ * ++ * call_rcu() will schedule delayed_put_task_struct_rcu() ++ * to be called in process context. ++ * ++ * __put_task_struct() is called when ++ * refcount_dec_and_test(&t->usage) succeeds. ++ * ++ * This means that it can't "conflict" with ++ * put_task_struct_rcu_user() which abuses ->rcu the same ++ * way; rcu_users has a reference so task->usage can't be ++ * zero after rcu_users 1 -> 0 transition. ++ * ++ * delayed_free_task() also uses ->rcu, but it is only called ++ * when it fails to fork a process. Therefore, there is no ++ * way it can conflict with put_task_struct(). ++ */ ++ if (IS_ENABLED(CONFIG_PREEMPT_RT) && !preemptible()) ++ call_rcu(&t->rcu, __put_task_struct_rcu_cb); ++ else + __put_task_struct(t); + } + +diff --git a/include/linux/trace_events.h b/include/linux/trace_events.h +index 30a8cdcfd4a4f..a8e9d1a04f82c 100644 +--- a/include/linux/trace_events.h ++++ b/include/linux/trace_events.h +@@ -594,7 +594,8 @@ extern int perf_uprobe_init(struct perf_event *event, + extern void perf_uprobe_destroy(struct perf_event *event); + extern int bpf_get_uprobe_info(const struct perf_event *event, + u32 *fd_type, const char **filename, +- u64 *probe_offset, bool perf_type_tracepoint); ++ u64 *probe_offset, u64 *probe_addr, ++ bool perf_type_tracepoint); + #endif + extern int ftrace_profile_set_filter(struct perf_event *event, int event_id, + char *filter_str); +diff --git a/include/linux/usb/typec_altmode.h b/include/linux/usb/typec_altmode.h +index 9a88c74a1d0d0..969b7c5040875 100644 +--- a/include/linux/usb/typec_altmode.h ++++ b/include/linux/usb/typec_altmode.h +@@ -67,7 +67,7 @@ struct typec_altmode_ops { + + int typec_altmode_enter(struct typec_altmode *altmode); + int typec_altmode_exit(struct typec_altmode *altmode); +-void typec_altmode_attention(struct typec_altmode *altmode, u32 vdo); ++int typec_altmode_attention(struct typec_altmode *altmode, u32 vdo); + int typec_altmode_vdm(struct typec_altmode *altmode, + const u32 header, const u32 *vdo, int count); + int typec_altmode_notify(struct typec_altmode *altmode, unsigned long conf, +diff --git a/include/net/ip_tunnels.h b/include/net/ip_tunnels.h +index 8d063e23aa408..36376f8b84dac 100644 +--- a/include/net/ip_tunnels.h ++++ b/include/net/ip_tunnels.h +@@ -449,15 +449,14 @@ static inline void iptunnel_xmit_stats(struct net_device *dev, int pkt_len) + tstats->tx_packets++; + u64_stats_update_end(&tstats->syncp); + put_cpu_ptr(tstats); ++ return; ++ } ++ ++ if (pkt_len < 0) { ++ DEV_STATS_INC(dev, tx_errors); ++ DEV_STATS_INC(dev, tx_aborted_errors); + } else { +- struct net_device_stats *err_stats = &dev->stats; +- +- if (pkt_len < 0) { +- err_stats->tx_errors++; +- err_stats->tx_aborted_errors++; +- } else { +- err_stats->tx_dropped++; +- } ++ DEV_STATS_INC(dev, tx_dropped); + } + } + +diff --git a/include/net/lwtunnel.h b/include/net/lwtunnel.h +index 5d6c5b1fc6955..ed1cd431e2b3b 100644 +--- a/include/net/lwtunnel.h ++++ b/include/net/lwtunnel.h +@@ -16,9 +16,12 @@ + #define LWTUNNEL_STATE_INPUT_REDIRECT BIT(1) + #define LWTUNNEL_STATE_XMIT_REDIRECT BIT(2) + ++/* LWTUNNEL_XMIT_CONTINUE should be distinguishable from dst_output return ++ * values (NET_XMIT_xxx and NETDEV_TX_xxx in linux/netdevice.h) for safety. ++ */ + enum { + LWTUNNEL_XMIT_DONE, +- LWTUNNEL_XMIT_CONTINUE, ++ LWTUNNEL_XMIT_CONTINUE = 0x100, + }; + + +diff --git a/include/net/tcp.h b/include/net/tcp.h +index 4e909148fce39..3192ade55ad18 100644 +--- a/include/net/tcp.h ++++ b/include/net/tcp.h +@@ -343,7 +343,6 @@ ssize_t tcp_splice_read(struct socket *sk, loff_t *ppos, + struct pipe_inode_info *pipe, size_t len, + unsigned int flags); + +-void tcp_enter_quickack_mode(struct sock *sk, unsigned int max_quickacks); + static inline void tcp_dec_quickack_mode(struct sock *sk, + const unsigned int pkts) + { +diff --git a/include/scsi/scsi_host.h b/include/scsi/scsi_host.h +index 31e0d6ca1ebaa..4488c3468c6de 100644 +--- a/include/scsi/scsi_host.h ++++ b/include/scsi/scsi_host.h +@@ -744,7 +744,7 @@ extern void scsi_remove_host(struct Scsi_Host *); + extern struct Scsi_Host *scsi_host_get(struct Scsi_Host *); + extern int scsi_host_busy(struct Scsi_Host *shost); + extern void scsi_host_put(struct Scsi_Host *t); +-extern struct Scsi_Host *scsi_host_lookup(unsigned short); ++extern struct Scsi_Host *scsi_host_lookup(unsigned int hostnum); + extern const char *scsi_host_state_name(enum scsi_host_state); + + static inline int __must_check scsi_add_host(struct Scsi_Host *host, +diff --git a/include/uapi/linux/pci_regs.h b/include/uapi/linux/pci_regs.h +index b485d8b0d5a79..5d830a95daf20 100644 +--- a/include/uapi/linux/pci_regs.h ++++ b/include/uapi/linux/pci_regs.h +@@ -679,6 +679,8 @@ + #define PCI_EXP_LNKCTL2_TLS_8_0GT 0x0003 /* Supported Speed 8GT/s */ + #define PCI_EXP_LNKCTL2_TLS_16_0GT 0x0004 /* Supported Speed 16GT/s */ + #define PCI_EXP_LNKCTL2_TLS_32_0GT 0x0005 /* Supported Speed 32GT/s */ ++#define PCI_EXP_LNKCTL2_ENTER_COMP 0x0010 /* Enter Compliance */ ++#define PCI_EXP_LNKCTL2_TX_MARGIN 0x0380 /* Transmit Margin */ + #define PCI_EXP_LNKSTA2 50 /* Link Status 2 */ + #define PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 52 /* v2 endpoints with link end here */ + #define PCI_EXP_SLTCAP2 52 /* Slot Capabilities 2 */ +diff --git a/include/uapi/linux/sync_file.h b/include/uapi/linux/sync_file.h +index ee2dcfb3d6602..d7f7c04a6e0c1 100644 +--- a/include/uapi/linux/sync_file.h ++++ b/include/uapi/linux/sync_file.h +@@ -52,7 +52,7 @@ struct sync_fence_info { + * @name: name of fence + * @status: status of fence. 1: signaled 0:active <0:error + * @flags: sync_file_info flags +- * @num_fences number of fences in the sync_file ++ * @num_fences: number of fences in the sync_file + * @pad: padding for 64-bit alignment, should always be zero + * @sync_fence_info: pointer to array of structs sync_fence_info with all + * fences in the sync_file +diff --git a/kernel/auditsc.c b/kernel/auditsc.c +index e8e90c0c49367..fc4223f30e847 100644 +--- a/kernel/auditsc.c ++++ b/kernel/auditsc.c +@@ -2161,6 +2161,8 @@ void __audit_inode_child(struct inode *parent, + } + } + ++ cond_resched(); ++ + /* is there a matching child entry? */ + list_for_each_entry(n, &context->names_list, list) { + /* can only match entries that have a name */ +diff --git a/kernel/fork.c b/kernel/fork.c +index 39134effb2bff..1728aa77861cb 100644 +--- a/kernel/fork.c ++++ b/kernel/fork.c +@@ -749,6 +749,14 @@ void __put_task_struct(struct task_struct *tsk) + } + EXPORT_SYMBOL_GPL(__put_task_struct); + ++void __put_task_struct_rcu_cb(struct rcu_head *rhp) ++{ ++ struct task_struct *task = container_of(rhp, struct task_struct, rcu); ++ ++ __put_task_struct(task); ++} ++EXPORT_SYMBOL_GPL(__put_task_struct_rcu_cb); ++ + void __init __weak arch_task_cache_init(void) { } + + /* +diff --git a/kernel/module.c b/kernel/module.c +index 30ac7514bd2bf..ba1df1fb1c5d6 100644 +--- a/kernel/module.c ++++ b/kernel/module.c +@@ -2291,15 +2291,26 @@ static void free_module(struct module *mod) + void *__symbol_get(const char *symbol) + { + struct module *owner; ++ enum mod_license license; + const struct kernel_symbol *sym; + + preempt_disable(); +- sym = find_symbol(symbol, &owner, NULL, NULL, true, true); +- if (sym && strong_try_module_get(owner)) ++ sym = find_symbol(symbol, &owner, NULL, &license, true, true); ++ if (!sym) ++ goto fail; ++ if (license != GPL_ONLY) { ++ pr_warn("failing symbol_get of non-GPLONLY symbol %s.\n", ++ symbol); ++ goto fail; ++ } ++ if (strong_try_module_get(owner)) + sym = NULL; + preempt_enable(); + + return sym ? (void *)kernel_symbol_value(sym) : NULL; ++fail: ++ preempt_enable(); ++ return NULL; + } + EXPORT_SYMBOL_GPL(__symbol_get); + +diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c +index 1e1345cd21b4f..4a31763a8c5d7 100644 +--- a/kernel/trace/bpf_trace.c ++++ b/kernel/trace/bpf_trace.c +@@ -1453,7 +1453,7 @@ int bpf_get_perf_event_info(const struct perf_event *event, u32 *prog_id, + #ifdef CONFIG_UPROBE_EVENTS + if (flags & TRACE_EVENT_FL_UPROBE) + err = bpf_get_uprobe_info(event, fd_type, buf, +- probe_offset, ++ probe_offset, probe_addr, + event->attr.type == PERF_TYPE_TRACEPOINT); + #endif + } +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c +index ad0ee4de92485..f9c64329ec154 100644 +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -6791,6 +6791,11 @@ out: + return ret; + } + ++static void tracing_swap_cpu_buffer(void *tr) ++{ ++ update_max_tr_single((struct trace_array *)tr, current, smp_processor_id()); ++} ++ + static ssize_t + tracing_snapshot_write(struct file *filp, const char __user *ubuf, size_t cnt, + loff_t *ppos) +@@ -6849,13 +6854,15 @@ tracing_snapshot_write(struct file *filp, const char __user *ubuf, size_t cnt, + ret = tracing_alloc_snapshot_instance(tr); + if (ret < 0) + break; +- local_irq_disable(); + /* Now, we're going to swap */ +- if (iter->cpu_file == RING_BUFFER_ALL_CPUS) ++ if (iter->cpu_file == RING_BUFFER_ALL_CPUS) { ++ local_irq_disable(); + update_max_tr(tr, current, smp_processor_id(), NULL); +- else +- update_max_tr_single(tr, current, iter->cpu_file); +- local_irq_enable(); ++ local_irq_enable(); ++ } else { ++ smp_call_function_single(iter->cpu_file, tracing_swap_cpu_buffer, ++ (void *)tr, 1); ++ } + break; + default: + if (tr->allocated_snapshot) { +@@ -6944,10 +6951,11 @@ static const struct file_operations tracing_max_lat_fops = { + #endif + + static const struct file_operations set_tracer_fops = { +- .open = tracing_open_generic, ++ .open = tracing_open_generic_tr, + .read = tracing_set_trace_read, + .write = tracing_set_trace_write, + .llseek = generic_file_llseek, ++ .release = tracing_release_generic_tr, + }; + + static const struct file_operations tracing_pipe_fops = { +@@ -7988,12 +7996,33 @@ trace_options_write(struct file *filp, const char __user *ubuf, size_t cnt, + return cnt; + } + ++static int tracing_open_options(struct inode *inode, struct file *filp) ++{ ++ struct trace_option_dentry *topt = inode->i_private; ++ int ret; ++ ++ ret = tracing_check_open_get_tr(topt->tr); ++ if (ret) ++ return ret; ++ ++ filp->private_data = inode->i_private; ++ return 0; ++} ++ ++static int tracing_release_options(struct inode *inode, struct file *file) ++{ ++ struct trace_option_dentry *topt = file->private_data; ++ ++ trace_array_put(topt->tr); ++ return 0; ++} + + static const struct file_operations trace_options_fops = { +- .open = tracing_open_generic, ++ .open = tracing_open_options, + .read = trace_options_read, + .write = trace_options_write, + .llseek = generic_file_llseek, ++ .release = tracing_release_options, + }; + + /* +diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c +index 1a566bc675485..e924c04af627e 100644 +--- a/kernel/trace/trace_uprobe.c ++++ b/kernel/trace/trace_uprobe.c +@@ -1402,7 +1402,7 @@ static void uretprobe_perf_func(struct trace_uprobe *tu, unsigned long func, + + int bpf_get_uprobe_info(const struct perf_event *event, u32 *fd_type, + const char **filename, u64 *probe_offset, +- bool perf_type_tracepoint) ++ u64 *probe_addr, bool perf_type_tracepoint) + { + const char *pevent = trace_event_name(event->tp_event); + const char *group = event->tp_event->class->system; +@@ -1419,6 +1419,7 @@ int bpf_get_uprobe_info(const struct perf_event *event, u32 *fd_type, + : BPF_FD_TYPE_UPROBE; + *filename = tu->filename; + *probe_offset = tu->offset; ++ *probe_addr = 0; + return 0; + } + #endif /* CONFIG_PERF_EVENTS */ +diff --git a/lib/idr.c b/lib/idr.c +index b2bc190431ddf..a91ca1dfe1431 100644 +--- a/lib/idr.c ++++ b/lib/idr.c +@@ -100,7 +100,7 @@ EXPORT_SYMBOL_GPL(idr_alloc); + * @end: The maximum ID (exclusive). + * @gfp: Memory allocation flags. + * +- * Allocates an unused ID in the range specified by @nextid and @end. If ++ * Allocates an unused ID in the range specified by @start and @end. If + * @end is <= 0, it is treated as one larger than %INT_MAX. This allows + * callers to use @start + N as @end as long as N is within integer range. + * The search for an unused ID will start at the last ID allocated and will +diff --git a/lib/kobject.c b/lib/kobject.c +index 0c6d17503a113..c4025a880d753 100644 +--- a/lib/kobject.c ++++ b/lib/kobject.c +@@ -877,6 +877,11 @@ int kset_register(struct kset *k) + if (!k) + return -EINVAL; + ++ if (!k->kobj.ktype) { ++ pr_err("must have a ktype to be initialized properly!\n"); ++ return -EINVAL; ++ } ++ + kset_init(k); + err = kobject_add_internal(&k->kobj); + if (err) +diff --git a/lib/mpi/mpi-cmp.c b/lib/mpi/mpi-cmp.c +index d25e9e96c310f..ceaebe181cd70 100644 +--- a/lib/mpi/mpi-cmp.c ++++ b/lib/mpi/mpi-cmp.c +@@ -25,8 +25,12 @@ int mpi_cmp_ui(MPI u, unsigned long v) + mpi_limb_t limb = v; + + mpi_normalize(u); +- if (!u->nlimbs && !limb) +- return 0; ++ if (u->nlimbs == 0) { ++ if (v == 0) ++ return 0; ++ else ++ return -1; ++ } + if (u->sign) + return -1; + if (u->nlimbs > 1) +diff --git a/lib/test_meminit.c b/lib/test_meminit.c +index ab00c79423a5f..2c6c96b40e3d3 100644 +--- a/lib/test_meminit.c ++++ b/lib/test_meminit.c +@@ -86,7 +86,7 @@ static int __init test_pages(int *total_failures) + int failures = 0, num_tests = 0; + int i; + +- for (i = 0; i < 10; i++) ++ for (i = 0; i <= MAX_ORDER; i++) + num_tests += do_alloc_pages_order(i, &failures); + + REPORT_FAILURES_IN_FN(); +diff --git a/mm/shmem.c b/mm/shmem.c +index aae2f408f9053..264229680ad75 100644 +--- a/mm/shmem.c ++++ b/mm/shmem.c +@@ -3417,6 +3417,8 @@ static int shmem_parse_one(struct fs_context *fc, struct fs_parameter *param) + unsigned long long size; + char *rest; + int opt; ++ kuid_t kuid; ++ kgid_t kgid; + + opt = fs_parse(fc, &shmem_fs_parameters, param, &result); + if (opt < 0) +@@ -3452,14 +3454,32 @@ static int shmem_parse_one(struct fs_context *fc, struct fs_parameter *param) + ctx->mode = result.uint_32 & 07777; + break; + case Opt_uid: +- ctx->uid = make_kuid(current_user_ns(), result.uint_32); +- if (!uid_valid(ctx->uid)) ++ kuid = make_kuid(current_user_ns(), result.uint_32); ++ if (!uid_valid(kuid)) + goto bad_value; ++ ++ /* ++ * The requested uid must be representable in the ++ * filesystem's idmapping. ++ */ ++ if (!kuid_has_mapping(fc->user_ns, kuid)) ++ goto bad_value; ++ ++ ctx->uid = kuid; + break; + case Opt_gid: +- ctx->gid = make_kgid(current_user_ns(), result.uint_32); +- if (!gid_valid(ctx->gid)) ++ kgid = make_kgid(current_user_ns(), result.uint_32); ++ if (!gid_valid(kgid)) + goto bad_value; ++ ++ /* ++ * The requested gid must be representable in the ++ * filesystem's idmapping. ++ */ ++ if (!kgid_has_mapping(fc->user_ns, kgid)) ++ goto bad_value; ++ ++ ctx->gid = kgid; + break; + case Opt_huge: + ctx->huge = result.uint_32; +diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c +index f582351d84ecb..36b5f72e2165c 100644 +--- a/net/9p/trans_virtio.c ++++ b/net/9p/trans_virtio.c +@@ -394,7 +394,7 @@ p9_virtio_zc_request(struct p9_client *client, struct p9_req_t *req, + struct page **in_pages = NULL, **out_pages = NULL; + struct virtio_chan *chan = client->trans; + struct scatterlist *sgs[4]; +- size_t offs; ++ size_t offs = 0; + int need_drop = 0; + int kicked = 0; + +diff --git a/net/core/devlink.c b/net/core/devlink.c +index b4dabe5d89f72..5bd6330ab4275 100644 +--- a/net/core/devlink.c ++++ b/net/core/devlink.c +@@ -2953,7 +2953,7 @@ static int devlink_param_get(struct devlink *devlink, + const struct devlink_param *param, + struct devlink_param_gset_ctx *ctx) + { +- if (!param->get || devlink->reload_failed) ++ if (!param->get) + return -EOPNOTSUPP; + return param->get(devlink, param->id, ctx); + } +@@ -2962,7 +2962,7 @@ static int devlink_param_set(struct devlink *devlink, + const struct devlink_param *param, + struct devlink_param_gset_ctx *ctx) + { +- if (!param->set || devlink->reload_failed) ++ if (!param->set) + return -EOPNOTSUPP; + return param->set(devlink, param->id, ctx); + } +diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c +index 4dac27c986231..5daa72a930a9c 100644 +--- a/net/core/flow_dissector.c ++++ b/net/core/flow_dissector.c +@@ -1564,8 +1564,7 @@ u32 __skb_get_hash_symmetric(const struct sk_buff *skb) + + memset(&keys, 0, sizeof(keys)); + __skb_flow_dissect(NULL, skb, &flow_keys_dissector_symmetric, +- &keys, NULL, 0, 0, 0, +- FLOW_DISSECTOR_F_STOP_AT_FLOW_LABEL); ++ &keys, NULL, 0, 0, 0, 0); + + return __flow_hash_from_keys(&keys, &hashrnd); + } +diff --git a/net/core/lwt_bpf.c b/net/core/lwt_bpf.c +index bf270b6a99b4f..017ed82611a8d 100644 +--- a/net/core/lwt_bpf.c ++++ b/net/core/lwt_bpf.c +@@ -59,9 +59,8 @@ static int run_lwt_bpf(struct sk_buff *skb, struct bpf_lwt_prog *lwt, + ret = BPF_OK; + } else { + skb_reset_mac_header(skb); +- ret = skb_do_redirect(skb); +- if (ret == 0) +- ret = BPF_REDIRECT; ++ skb_do_redirect(skb); ++ ret = BPF_REDIRECT; + } + break; + +@@ -254,7 +253,7 @@ static int bpf_lwt_xmit_reroute(struct sk_buff *skb) + + err = dst_output(dev_net(skb_dst(skb)->dev), skb->sk, skb); + if (unlikely(err)) +- return err; ++ return net_xmit_errno(err); + + /* ip[6]_finish_output2 understand LWTUNNEL_XMIT_DONE */ + return LWTUNNEL_XMIT_DONE; +diff --git a/net/core/skbuff.c b/net/core/skbuff.c +index 9e297853112c4..2b84abd609736 100644 +--- a/net/core/skbuff.c ++++ b/net/core/skbuff.c +@@ -3686,21 +3686,20 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb, + struct sk_buff *segs = NULL; + struct sk_buff *tail = NULL; + struct sk_buff *list_skb = skb_shinfo(head_skb)->frag_list; +- skb_frag_t *frag = skb_shinfo(head_skb)->frags; + unsigned int mss = skb_shinfo(head_skb)->gso_size; + unsigned int doffset = head_skb->data - skb_mac_header(head_skb); +- struct sk_buff *frag_skb = head_skb; + unsigned int offset = doffset; + unsigned int tnl_hlen = skb_tnl_header_len(head_skb); + unsigned int partial_segs = 0; + unsigned int headroom; + unsigned int len = head_skb->len; ++ struct sk_buff *frag_skb; ++ skb_frag_t *frag; + __be16 proto; + bool csum, sg; +- int nfrags = skb_shinfo(head_skb)->nr_frags; + int err = -ENOMEM; + int i = 0; +- int pos; ++ int nfrags, pos; + int dummy; + + if ((skb_shinfo(head_skb)->gso_type & SKB_GSO_DODGY) && +@@ -3778,6 +3777,13 @@ normal: + headroom = skb_headroom(head_skb); + pos = skb_headlen(head_skb); + ++ if (skb_orphan_frags(head_skb, GFP_ATOMIC)) ++ return ERR_PTR(-ENOMEM); ++ ++ nfrags = skb_shinfo(head_skb)->nr_frags; ++ frag = skb_shinfo(head_skb)->frags; ++ frag_skb = head_skb; ++ + do { + struct sk_buff *nskb; + skb_frag_t *nskb_frag; +@@ -3802,6 +3808,10 @@ normal: + (skb_headlen(list_skb) == len || sg)) { + BUG_ON(skb_headlen(list_skb) > len); + ++ nskb = skb_clone(list_skb, GFP_ATOMIC); ++ if (unlikely(!nskb)) ++ goto err; ++ + i = 0; + nfrags = skb_shinfo(list_skb)->nr_frags; + frag = skb_shinfo(list_skb)->frags; +@@ -3820,12 +3830,8 @@ normal: + frag++; + } + +- nskb = skb_clone(list_skb, GFP_ATOMIC); + list_skb = list_skb->next; + +- if (unlikely(!nskb)) +- goto err; +- + if (unlikely(pskb_trim(nskb, len))) { + kfree_skb(nskb); + goto err; +@@ -3890,12 +3896,16 @@ normal: + skb_shinfo(nskb)->tx_flags |= skb_shinfo(head_skb)->tx_flags & + SKBTX_SHARED_FRAG; + +- if (skb_orphan_frags(frag_skb, GFP_ATOMIC) || +- skb_zerocopy_clone(nskb, frag_skb, GFP_ATOMIC)) ++ if (skb_zerocopy_clone(nskb, frag_skb, GFP_ATOMIC)) + goto err; + + while (pos < offset + len) { + if (i >= nfrags) { ++ if (skb_orphan_frags(list_skb, GFP_ATOMIC) || ++ skb_zerocopy_clone(nskb, list_skb, ++ GFP_ATOMIC)) ++ goto err; ++ + i = 0; + nfrags = skb_shinfo(list_skb)->nr_frags; + frag = skb_shinfo(list_skb)->frags; +@@ -3909,10 +3919,6 @@ normal: + i--; + frag--; + } +- if (skb_orphan_frags(frag_skb, GFP_ATOMIC) || +- skb_zerocopy_clone(nskb, frag_skb, +- GFP_ATOMIC)) +- goto err; + + list_skb = list_skb->next; + } +diff --git a/net/core/sock.c b/net/core/sock.c +index 69b4158a29f74..9979cd602dfac 100644 +--- a/net/core/sock.c ++++ b/net/core/sock.c +@@ -701,7 +701,8 @@ bool sk_mc_loop(struct sock *sk) + return false; + if (!sk) + return true; +- switch (sk->sk_family) { ++ /* IPV6_ADDRFORM can change sk->sk_family under us. */ ++ switch (READ_ONCE(sk->sk_family)) { + case AF_INET: + return inet_sk(sk)->mc_loop; + #if IS_ENABLED(CONFIG_IPV6) +@@ -2222,9 +2223,9 @@ static long sock_wait_for_wmem(struct sock *sk, long timeo) + prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE); + if (refcount_read(&sk->sk_wmem_alloc) < READ_ONCE(sk->sk_sndbuf)) + break; +- if (sk->sk_shutdown & SEND_SHUTDOWN) ++ if (READ_ONCE(sk->sk_shutdown) & SEND_SHUTDOWN) + break; +- if (sk->sk_err) ++ if (READ_ONCE(sk->sk_err)) + break; + timeo = schedule_timeout(timeo); + } +@@ -2252,7 +2253,7 @@ struct sk_buff *sock_alloc_send_pskb(struct sock *sk, unsigned long header_len, + goto failure; + + err = -EPIPE; +- if (sk->sk_shutdown & SEND_SHUTDOWN) ++ if (READ_ONCE(sk->sk_shutdown) & SEND_SHUTDOWN) + goto failure; + + if (sk_wmem_alloc_get(sk) < READ_ONCE(sk->sk_sndbuf)) +diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c +index cd59a669b8a78..bc4fef1250f45 100644 +--- a/net/dccp/ipv4.c ++++ b/net/dccp/ipv4.c +@@ -243,12 +243,17 @@ static int dccp_v4_err(struct sk_buff *skb, u32 info) + int err; + struct net *net = dev_net(skb->dev); + +- /* Only need dccph_dport & dccph_sport which are the first +- * 4 bytes in dccp header. ++ /* For the first __dccp_basic_hdr_len() check, we only need dh->dccph_x, ++ * which is in byte 7 of the dccp header. + * Our caller (icmp_socket_deliver()) already pulled 8 bytes for us. ++ * ++ * Later on, we want to access the sequence number fields, which are ++ * beyond 8 bytes, so we have to pskb_may_pull() ourselves. + */ +- BUILD_BUG_ON(offsetofend(struct dccp_hdr, dccph_sport) > 8); +- BUILD_BUG_ON(offsetofend(struct dccp_hdr, dccph_dport) > 8); ++ dh = (struct dccp_hdr *)(skb->data + offset); ++ if (!pskb_may_pull(skb, offset + __dccp_basic_hdr_len(dh))) ++ return -EINVAL; ++ iph = (struct iphdr *)skb->data; + dh = (struct dccp_hdr *)(skb->data + offset); + + sk = __inet_lookup_established(net, &dccp_hashinfo, +diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c +index 77cb4315b9669..5554752c21822 100644 +--- a/net/dccp/ipv6.c ++++ b/net/dccp/ipv6.c +@@ -67,7 +67,7 @@ static inline __u64 dccp_v6_init_sequence(struct sk_buff *skb) + static int dccp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt, + u8 type, u8 code, int offset, __be32 info) + { +- const struct ipv6hdr *hdr = (const struct ipv6hdr *)skb->data; ++ const struct ipv6hdr *hdr; + const struct dccp_hdr *dh; + struct dccp_sock *dp; + struct ipv6_pinfo *np; +@@ -76,12 +76,17 @@ static int dccp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt, + __u64 seq; + struct net *net = dev_net(skb->dev); + +- /* Only need dccph_dport & dccph_sport which are the first +- * 4 bytes in dccp header. ++ /* For the first __dccp_basic_hdr_len() check, we only need dh->dccph_x, ++ * which is in byte 7 of the dccp header. + * Our caller (icmpv6_notify()) already pulled 8 bytes for us. ++ * ++ * Later on, we want to access the sequence number fields, which are ++ * beyond 8 bytes, so we have to pskb_may_pull() ourselves. + */ +- BUILD_BUG_ON(offsetofend(struct dccp_hdr, dccph_sport) > 8); +- BUILD_BUG_ON(offsetofend(struct dccp_hdr, dccph_dport) > 8); ++ dh = (struct dccp_hdr *)(skb->data + offset); ++ if (!pskb_may_pull(skb, offset + __dccp_basic_hdr_len(dh))) ++ return -EINVAL; ++ hdr = (const struct ipv6hdr *)skb->data; + dh = (struct dccp_hdr *)(skb->data + offset); + + sk = __inet6_lookup_established(net, &dccp_hashinfo, +diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c +index 4a8ad46397c0e..4c013f8800f0c 100644 +--- a/net/ipv4/devinet.c ++++ b/net/ipv4/devinet.c +@@ -351,14 +351,14 @@ static void __inet_del_ifa(struct in_device *in_dev, + { + struct in_ifaddr *promote = NULL; + struct in_ifaddr *ifa, *ifa1; +- struct in_ifaddr *last_prim; ++ struct in_ifaddr __rcu **last_prim; + struct in_ifaddr *prev_prom = NULL; + int do_promote = IN_DEV_PROMOTE_SECONDARIES(in_dev); + + ASSERT_RTNL(); + + ifa1 = rtnl_dereference(*ifap); +- last_prim = rtnl_dereference(in_dev->ifa_list); ++ last_prim = ifap; + if (in_dev->dead) + goto no_promotions; + +@@ -372,7 +372,7 @@ static void __inet_del_ifa(struct in_device *in_dev, + while ((ifa = rtnl_dereference(*ifap1)) != NULL) { + if (!(ifa->ifa_flags & IFA_F_SECONDARY) && + ifa1->ifa_scope <= ifa->ifa_scope) +- last_prim = ifa; ++ last_prim = &ifa->ifa_next; + + if (!(ifa->ifa_flags & IFA_F_SECONDARY) || + ifa1->ifa_mask != ifa->ifa_mask || +@@ -436,9 +436,9 @@ no_promotions: + + rcu_assign_pointer(prev_prom->ifa_next, next_sec); + +- last_sec = rtnl_dereference(last_prim->ifa_next); ++ last_sec = rtnl_dereference(*last_prim); + rcu_assign_pointer(promote->ifa_next, last_sec); +- rcu_assign_pointer(last_prim->ifa_next, promote); ++ rcu_assign_pointer(*last_prim, promote); + } + + promote->ifa_flags &= ~IFA_F_SECONDARY; +diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c +index 42a4ee192f8dc..51cfb650060ba 100644 +--- a/net/ipv4/fib_semantics.c ++++ b/net/ipv4/fib_semantics.c +@@ -275,7 +275,8 @@ void fib_release_info(struct fib_info *fi) + hlist_del(&nexthop_nh->nh_hash); + } endfor_nexthops(fi) + } +- fi->fib_dead = 1; ++ /* Paired with READ_ONCE() from fib_table_lookup() */ ++ WRITE_ONCE(fi->fib_dead, 1); + fib_info_put(fi); + } + spin_unlock_bh(&fib_info_lock); +@@ -1586,6 +1587,7 @@ struct fib_info *fib_create_info(struct fib_config *cfg, + link_it: + ofi = fib_find_info(fi); + if (ofi) { ++ /* fib_table_lookup() should not see @fi yet. */ + fi->fib_dead = 1; + free_fib_info(fi); + ofi->fib_treeref++; +@@ -1623,6 +1625,7 @@ err_inval: + + failure: + if (fi) { ++ /* fib_table_lookup() should not see @fi yet. */ + fi->fib_dead = 1; + free_fib_info(fi); + } +diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c +index a1f830da4ad30..7f933ead3bf4c 100644 +--- a/net/ipv4/fib_trie.c ++++ b/net/ipv4/fib_trie.c +@@ -1448,7 +1448,8 @@ found: + } + if (fa->fa_tos && fa->fa_tos != flp->flowi4_tos) + continue; +- if (fi->fib_dead) ++ /* Paired with WRITE_ONCE() in fib_release_info() */ ++ if (READ_ONCE(fi->fib_dead)) + continue; + if (fa->fa_info->fib_scope < flp->flowi4_scope) + continue; +diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c +index 1023f881091ef..cb031e851c127 100644 +--- a/net/ipv4/igmp.c ++++ b/net/ipv4/igmp.c +@@ -355,8 +355,9 @@ static struct sk_buff *igmpv3_newpack(struct net_device *dev, unsigned int mtu) + struct flowi4 fl4; + int hlen = LL_RESERVED_SPACE(dev); + int tlen = dev->needed_tailroom; +- unsigned int size = mtu; ++ unsigned int size; + ++ size = min(mtu, IP_MAX_MTU); + while (1) { + skb = alloc_skb(size + hlen + tlen, + GFP_ATOMIC | __GFP_NOWARN); +diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c +index 08ccb501ff0cc..bf7c2333bc236 100644 +--- a/net/ipv4/ip_output.c ++++ b/net/ipv4/ip_output.c +@@ -222,7 +222,7 @@ static int ip_finish_output2(struct net *net, struct sock *sk, struct sk_buff *s + if (lwtunnel_xmit_redirect(dst->lwtstate)) { + int res = lwtunnel_xmit(skb); + +- if (res < 0 || res == LWTUNNEL_XMIT_DONE) ++ if (res != LWTUNNEL_XMIT_CONTINUE) + return res; + } + +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index 8308c3c3a6e46..1dfc1a5c21cd3 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -222,7 +222,7 @@ static void tcp_incr_quickack(struct sock *sk, unsigned int max_quickacks) + icsk->icsk_ack.quick = quickacks; + } + +-void tcp_enter_quickack_mode(struct sock *sk, unsigned int max_quickacks) ++static void tcp_enter_quickack_mode(struct sock *sk, unsigned int max_quickacks) + { + struct inet_connection_sock *icsk = inet_csk(sk); + +@@ -230,7 +230,6 @@ void tcp_enter_quickack_mode(struct sock *sk, unsigned int max_quickacks) + inet_csk_exit_pingpong_mode(sk); + icsk->icsk_ack.ato = TCP_ATO_MIN; + } +-EXPORT_SYMBOL(tcp_enter_quickack_mode); + + /* Send ACKs quickly, if "quick" count is not exhausted + * and the session is not interactive. +diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c +index a4c3cb72bdc6a..c523236d934eb 100644 +--- a/net/ipv6/addrconf.c ++++ b/net/ipv6/addrconf.c +@@ -1367,7 +1367,7 @@ retry: + * idev->desync_factor if it's larger + */ + cnf_temp_preferred_lft = READ_ONCE(idev->cnf.temp_prefered_lft); +- max_desync_factor = min_t(__u32, ++ max_desync_factor = min_t(long, + idev->cnf.max_desync_factor, + cnf_temp_preferred_lft - regen_advance); + +diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c +index 8231a7a3dd035..816275b2135fe 100644 +--- a/net/ipv6/ip6_output.c ++++ b/net/ipv6/ip6_output.c +@@ -130,7 +130,7 @@ static int ip6_finish_output2(struct net *net, struct sock *sk, struct sk_buff * + if (lwtunnel_xmit_redirect(dst->lwtstate)) { + int res = lwtunnel_xmit(skb); + +- if (res < 0 || res == LWTUNNEL_XMIT_DONE) ++ if (res != LWTUNNEL_XMIT_CONTINUE) + return res; + } + +diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c +index 1975403ce8bee..8a8ea7e6774d5 100644 +--- a/net/kcm/kcmsock.c ++++ b/net/kcm/kcmsock.c +@@ -1066,15 +1066,18 @@ partial_message: + out_error: + kcm_push(kcm); + +- if (copied && sock->type == SOCK_SEQPACKET) { ++ if (sock->type == SOCK_SEQPACKET) { + /* Wrote some bytes before encountering an + * error, return partial success. + */ +- goto partial_message; +- } +- +- if (head != kcm->seq_skb) ++ if (copied) ++ goto partial_message; ++ if (head != kcm->seq_skb) ++ kfree_skb(head); ++ } else { + kfree_skb(head); ++ kcm->seq_skb = NULL; ++ } + + err = sk_stream_error(sk, msg->msg_flags, err); + +@@ -1984,6 +1987,8 @@ static __net_exit void kcm_exit_net(struct net *net) + * that all multiplexors and psocks have been destroyed. + */ + WARN_ON(!list_empty(&knet->mux_list)); ++ ++ mutex_destroy(&knet->mutex); + } + + static struct pernet_operations kcm_net_ops = { +diff --git a/net/netfilter/ipset/ip_set_hash_netportnet.c b/net/netfilter/ipset/ip_set_hash_netportnet.c +index a82b70e8b9a63..aed319815358f 100644 +--- a/net/netfilter/ipset/ip_set_hash_netportnet.c ++++ b/net/netfilter/ipset/ip_set_hash_netportnet.c +@@ -35,6 +35,7 @@ MODULE_ALIAS("ip_set_hash:net,port,net"); + #define IP_SET_HASH_WITH_PROTO + #define IP_SET_HASH_WITH_NETS + #define IPSET_NET_COUNT 2 ++#define IP_SET_HASH_WITH_NET0 + + /* IPv4 variant */ + +diff --git a/net/netfilter/nfnetlink_osf.c b/net/netfilter/nfnetlink_osf.c +index 9dbaa5ce24e51..573a372e760f4 100644 +--- a/net/netfilter/nfnetlink_osf.c ++++ b/net/netfilter/nfnetlink_osf.c +@@ -316,6 +316,14 @@ static int nfnl_osf_add_callback(struct net *net, struct sock *ctnl, + + f = nla_data(osf_attrs[OSF_ATTR_FINGER]); + ++ if (f->opt_num > ARRAY_SIZE(f->opt)) ++ return -EINVAL; ++ ++ if (!memchr(f->genre, 0, MAXGENRELEN) || ++ !memchr(f->subtype, 0, MAXGENRELEN) || ++ !memchr(f->version, 0, MAXGENRELEN)) ++ return -EINVAL; ++ + kf = kmalloc(sizeof(struct nf_osf_finger), GFP_KERNEL); + if (!kf) + return -ENOMEM; +diff --git a/net/netfilter/xt_sctp.c b/net/netfilter/xt_sctp.c +index 680015ba7cb6e..d4bf089c9e3f9 100644 +--- a/net/netfilter/xt_sctp.c ++++ b/net/netfilter/xt_sctp.c +@@ -150,6 +150,8 @@ static int sctp_mt_check(const struct xt_mtchk_param *par) + { + const struct xt_sctp_info *info = par->matchinfo; + ++ if (info->flag_count > ARRAY_SIZE(info->flag_info)) ++ return -EINVAL; + if (info->flags & ~XT_SCTP_VALID_FLAGS) + return -EINVAL; + if (info->invflags & ~XT_SCTP_VALID_FLAGS) +diff --git a/net/netfilter/xt_u32.c b/net/netfilter/xt_u32.c +index 177b40d08098b..117d4615d6684 100644 +--- a/net/netfilter/xt_u32.c ++++ b/net/netfilter/xt_u32.c +@@ -96,11 +96,32 @@ static bool u32_mt(const struct sk_buff *skb, struct xt_action_param *par) + return ret ^ data->invert; + } + ++static int u32_mt_checkentry(const struct xt_mtchk_param *par) ++{ ++ const struct xt_u32 *data = par->matchinfo; ++ const struct xt_u32_test *ct; ++ unsigned int i; ++ ++ if (data->ntests > ARRAY_SIZE(data->tests)) ++ return -EINVAL; ++ ++ for (i = 0; i < data->ntests; ++i) { ++ ct = &data->tests[i]; ++ ++ if (ct->nnums > ARRAY_SIZE(ct->location) || ++ ct->nvalues > ARRAY_SIZE(ct->value)) ++ return -EINVAL; ++ } ++ ++ return 0; ++} ++ + static struct xt_match xt_u32_mt_reg __read_mostly = { + .name = "u32", + .revision = 0, + .family = NFPROTO_UNSPEC, + .match = u32_mt, ++ .checkentry = u32_mt_checkentry, + .matchsize = sizeof(struct xt_u32), + .me = THIS_MODULE, + }; +diff --git a/net/netlabel/netlabel_kapi.c b/net/netlabel/netlabel_kapi.c +index 91b35b7c80d82..96059c99b915e 100644 +--- a/net/netlabel/netlabel_kapi.c ++++ b/net/netlabel/netlabel_kapi.c +@@ -857,7 +857,8 @@ int netlbl_catmap_setlong(struct netlbl_lsm_catmap **catmap, + + offset -= iter->startbit; + idx = offset / NETLBL_CATMAP_MAPSIZE; +- iter->bitmap[idx] |= bitmap << (offset % NETLBL_CATMAP_MAPSIZE); ++ iter->bitmap[idx] |= (NETLBL_CATMAP_MAPTYPE)bitmap ++ << (offset % NETLBL_CATMAP_MAPSIZE); + + return 0; + } +diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c +index 7da77ddba5f4d..e18a73264c103 100644 +--- a/net/netrom/af_netrom.c ++++ b/net/netrom/af_netrom.c +@@ -638,6 +638,11 @@ static int nr_connect(struct socket *sock, struct sockaddr *uaddr, + goto out_release; + } + ++ if (sock->state == SS_CONNECTING) { ++ err = -EALREADY; ++ goto out_release; ++ } ++ + sk->sk_state = TCP_CLOSE; + sock->state = SS_UNCONNECTED; + +diff --git a/net/sched/Kconfig b/net/sched/Kconfig +index 2e4604cdaf23f..46f2847a071e5 100644 +--- a/net/sched/Kconfig ++++ b/net/sched/Kconfig +@@ -514,34 +514,6 @@ config CLS_U32_MARK + ---help--- + Say Y here to be able to use netfilter marks as u32 key. + +-config NET_CLS_RSVP +- tristate "IPv4 Resource Reservation Protocol (RSVP)" +- select NET_CLS +- ---help--- +- The Resource Reservation Protocol (RSVP) permits end systems to +- request a minimum and maximum data flow rate for a connection; this +- is important for real time data such as streaming sound or video. +- +- Say Y here if you want to be able to classify outgoing packets based +- on their RSVP requests. +- +- To compile this code as a module, choose M here: the +- module will be called cls_rsvp. +- +-config NET_CLS_RSVP6 +- tristate "IPv6 Resource Reservation Protocol (RSVP6)" +- select NET_CLS +- ---help--- +- The Resource Reservation Protocol (RSVP) permits end systems to +- request a minimum and maximum data flow rate for a connection; this +- is important for real time data such as streaming sound or video. +- +- Say Y here if you want to be able to classify outgoing packets based +- on their RSVP requests and you are using the IPv6 protocol. +- +- To compile this code as a module, choose M here: the +- module will be called cls_rsvp6. +- + config NET_CLS_FLOW + tristate "Flow classifier" + select NET_CLS +diff --git a/net/sched/Makefile b/net/sched/Makefile +index 9e1f904d0c184..fb2b90648a20b 100644 +--- a/net/sched/Makefile ++++ b/net/sched/Makefile +@@ -65,8 +65,6 @@ obj-$(CONFIG_NET_SCH_TAPRIO) += sch_taprio.o + obj-$(CONFIG_NET_CLS_U32) += cls_u32.o + obj-$(CONFIG_NET_CLS_ROUTE4) += cls_route.o + obj-$(CONFIG_NET_CLS_FW) += cls_fw.o +-obj-$(CONFIG_NET_CLS_RSVP) += cls_rsvp.o +-obj-$(CONFIG_NET_CLS_RSVP6) += cls_rsvp6.o + obj-$(CONFIG_NET_CLS_BASIC) += cls_basic.o + obj-$(CONFIG_NET_CLS_FLOW) += cls_flow.o + obj-$(CONFIG_NET_CLS_CGROUP) += cls_cgroup.o +diff --git a/net/sched/cls_rsvp.c b/net/sched/cls_rsvp.c +deleted file mode 100644 +index de1c1d4da5977..0000000000000 +--- a/net/sched/cls_rsvp.c ++++ /dev/null +@@ -1,24 +0,0 @@ +-// SPDX-License-Identifier: GPL-2.0-or-later +-/* +- * net/sched/cls_rsvp.c Special RSVP packet classifier for IPv4. +- * +- * Authors: Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru> +- */ +- +-#include <linux/module.h> +-#include <linux/types.h> +-#include <linux/kernel.h> +-#include <linux/string.h> +-#include <linux/errno.h> +-#include <linux/skbuff.h> +-#include <net/ip.h> +-#include <net/netlink.h> +-#include <net/act_api.h> +-#include <net/pkt_cls.h> +- +-#define RSVP_DST_LEN 1 +-#define RSVP_ID "rsvp" +-#define RSVP_OPS cls_rsvp_ops +- +-#include "cls_rsvp.h" +-MODULE_LICENSE("GPL"); +diff --git a/net/sched/cls_rsvp.h b/net/sched/cls_rsvp.h +deleted file mode 100644 +index d36949d9382c4..0000000000000 +--- a/net/sched/cls_rsvp.h ++++ /dev/null +@@ -1,777 +0,0 @@ +-/* SPDX-License-Identifier: GPL-2.0-or-later */ +-/* +- * net/sched/cls_rsvp.h Template file for RSVPv[46] classifiers. +- * +- * Authors: Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru> +- */ +- +-/* +- Comparing to general packet classification problem, +- RSVP needs only sevaral relatively simple rules: +- +- * (dst, protocol) are always specified, +- so that we are able to hash them. +- * src may be exact, or may be wildcard, so that +- we can keep a hash table plus one wildcard entry. +- * source port (or flow label) is important only if src is given. +- +- IMPLEMENTATION. +- +- We use a two level hash table: The top level is keyed by +- destination address and protocol ID, every bucket contains a list +- of "rsvp sessions", identified by destination address, protocol and +- DPI(="Destination Port ID"): triple (key, mask, offset). +- +- Every bucket has a smaller hash table keyed by source address +- (cf. RSVP flowspec) and one wildcard entry for wildcard reservations. +- Every bucket is again a list of "RSVP flows", selected by +- source address and SPI(="Source Port ID" here rather than +- "security parameter index"): triple (key, mask, offset). +- +- +- NOTE 1. All the packets with IPv6 extension headers (but AH and ESP) +- and all fragmented packets go to the best-effort traffic class. +- +- +- NOTE 2. Two "port id"'s seems to be redundant, rfc2207 requires +- only one "Generalized Port Identifier". So that for classic +- ah, esp (and udp,tcp) both *pi should coincide or one of them +- should be wildcard. +- +- At first sight, this redundancy is just a waste of CPU +- resources. But DPI and SPI add the possibility to assign different +- priorities to GPIs. Look also at note 4 about tunnels below. +- +- +- NOTE 3. One complication is the case of tunneled packets. +- We implement it as following: if the first lookup +- matches a special session with "tunnelhdr" value not zero, +- flowid doesn't contain the true flow ID, but the tunnel ID (1...255). +- In this case, we pull tunnelhdr bytes and restart lookup +- with tunnel ID added to the list of keys. Simple and stupid 8)8) +- It's enough for PIMREG and IPIP. +- +- +- NOTE 4. Two GPIs make it possible to parse even GRE packets. +- F.e. DPI can select ETH_P_IP (and necessary flags to make +- tunnelhdr correct) in GRE protocol field and SPI matches +- GRE key. Is it not nice? 8)8) +- +- +- Well, as result, despite its simplicity, we get a pretty +- powerful classification engine. */ +- +- +-struct rsvp_head { +- u32 tmap[256/32]; +- u32 hgenerator; +- u8 tgenerator; +- struct rsvp_session __rcu *ht[256]; +- struct rcu_head rcu; +-}; +- +-struct rsvp_session { +- struct rsvp_session __rcu *next; +- __be32 dst[RSVP_DST_LEN]; +- struct tc_rsvp_gpi dpi; +- u8 protocol; +- u8 tunnelid; +- /* 16 (src,sport) hash slots, and one wildcard source slot */ +- struct rsvp_filter __rcu *ht[16 + 1]; +- struct rcu_head rcu; +-}; +- +- +-struct rsvp_filter { +- struct rsvp_filter __rcu *next; +- __be32 src[RSVP_DST_LEN]; +- struct tc_rsvp_gpi spi; +- u8 tunnelhdr; +- +- struct tcf_result res; +- struct tcf_exts exts; +- +- u32 handle; +- struct rsvp_session *sess; +- struct rcu_work rwork; +-}; +- +-static inline unsigned int hash_dst(__be32 *dst, u8 protocol, u8 tunnelid) +-{ +- unsigned int h = (__force __u32)dst[RSVP_DST_LEN - 1]; +- +- h ^= h>>16; +- h ^= h>>8; +- return (h ^ protocol ^ tunnelid) & 0xFF; +-} +- +-static inline unsigned int hash_src(__be32 *src) +-{ +- unsigned int h = (__force __u32)src[RSVP_DST_LEN-1]; +- +- h ^= h>>16; +- h ^= h>>8; +- h ^= h>>4; +- return h & 0xF; +-} +- +-#define RSVP_APPLY_RESULT() \ +-{ \ +- int r = tcf_exts_exec(skb, &f->exts, res); \ +- if (r < 0) \ +- continue; \ +- else if (r > 0) \ +- return r; \ +-} +- +-static int rsvp_classify(struct sk_buff *skb, const struct tcf_proto *tp, +- struct tcf_result *res) +-{ +- struct rsvp_head *head = rcu_dereference_bh(tp->root); +- struct rsvp_session *s; +- struct rsvp_filter *f; +- unsigned int h1, h2; +- __be32 *dst, *src; +- u8 protocol; +- u8 tunnelid = 0; +- u8 *xprt; +-#if RSVP_DST_LEN == 4 +- struct ipv6hdr *nhptr; +- +- if (!pskb_network_may_pull(skb, sizeof(*nhptr))) +- return -1; +- nhptr = ipv6_hdr(skb); +-#else +- struct iphdr *nhptr; +- +- if (!pskb_network_may_pull(skb, sizeof(*nhptr))) +- return -1; +- nhptr = ip_hdr(skb); +-#endif +-restart: +- +-#if RSVP_DST_LEN == 4 +- src = &nhptr->saddr.s6_addr32[0]; +- dst = &nhptr->daddr.s6_addr32[0]; +- protocol = nhptr->nexthdr; +- xprt = ((u8 *)nhptr) + sizeof(struct ipv6hdr); +-#else +- src = &nhptr->saddr; +- dst = &nhptr->daddr; +- protocol = nhptr->protocol; +- xprt = ((u8 *)nhptr) + (nhptr->ihl<<2); +- if (ip_is_fragment(nhptr)) +- return -1; +-#endif +- +- h1 = hash_dst(dst, protocol, tunnelid); +- h2 = hash_src(src); +- +- for (s = rcu_dereference_bh(head->ht[h1]); s; +- s = rcu_dereference_bh(s->next)) { +- if (dst[RSVP_DST_LEN-1] == s->dst[RSVP_DST_LEN - 1] && +- protocol == s->protocol && +- !(s->dpi.mask & +- (*(u32 *)(xprt + s->dpi.offset) ^ s->dpi.key)) && +-#if RSVP_DST_LEN == 4 +- dst[0] == s->dst[0] && +- dst[1] == s->dst[1] && +- dst[2] == s->dst[2] && +-#endif +- tunnelid == s->tunnelid) { +- +- for (f = rcu_dereference_bh(s->ht[h2]); f; +- f = rcu_dereference_bh(f->next)) { +- if (src[RSVP_DST_LEN-1] == f->src[RSVP_DST_LEN - 1] && +- !(f->spi.mask & (*(u32 *)(xprt + f->spi.offset) ^ f->spi.key)) +-#if RSVP_DST_LEN == 4 +- && +- src[0] == f->src[0] && +- src[1] == f->src[1] && +- src[2] == f->src[2] +-#endif +- ) { +- *res = f->res; +- RSVP_APPLY_RESULT(); +- +-matched: +- if (f->tunnelhdr == 0) +- return 0; +- +- tunnelid = f->res.classid; +- nhptr = (void *)(xprt + f->tunnelhdr - sizeof(*nhptr)); +- goto restart; +- } +- } +- +- /* And wildcard bucket... */ +- for (f = rcu_dereference_bh(s->ht[16]); f; +- f = rcu_dereference_bh(f->next)) { +- *res = f->res; +- RSVP_APPLY_RESULT(); +- goto matched; +- } +- return -1; +- } +- } +- return -1; +-} +- +-static void rsvp_replace(struct tcf_proto *tp, struct rsvp_filter *n, u32 h) +-{ +- struct rsvp_head *head = rtnl_dereference(tp->root); +- struct rsvp_session *s; +- struct rsvp_filter __rcu **ins; +- struct rsvp_filter *pins; +- unsigned int h1 = h & 0xFF; +- unsigned int h2 = (h >> 8) & 0xFF; +- +- for (s = rtnl_dereference(head->ht[h1]); s; +- s = rtnl_dereference(s->next)) { +- for (ins = &s->ht[h2], pins = rtnl_dereference(*ins); ; +- ins = &pins->next, pins = rtnl_dereference(*ins)) { +- if (pins->handle == h) { +- RCU_INIT_POINTER(n->next, pins->next); +- rcu_assign_pointer(*ins, n); +- return; +- } +- } +- } +- +- /* Something went wrong if we are trying to replace a non-existant +- * node. Mind as well halt instead of silently failing. +- */ +- BUG_ON(1); +-} +- +-static void *rsvp_get(struct tcf_proto *tp, u32 handle) +-{ +- struct rsvp_head *head = rtnl_dereference(tp->root); +- struct rsvp_session *s; +- struct rsvp_filter *f; +- unsigned int h1 = handle & 0xFF; +- unsigned int h2 = (handle >> 8) & 0xFF; +- +- if (h2 > 16) +- return NULL; +- +- for (s = rtnl_dereference(head->ht[h1]); s; +- s = rtnl_dereference(s->next)) { +- for (f = rtnl_dereference(s->ht[h2]); f; +- f = rtnl_dereference(f->next)) { +- if (f->handle == handle) +- return f; +- } +- } +- return NULL; +-} +- +-static int rsvp_init(struct tcf_proto *tp) +-{ +- struct rsvp_head *data; +- +- data = kzalloc(sizeof(struct rsvp_head), GFP_KERNEL); +- if (data) { +- rcu_assign_pointer(tp->root, data); +- return 0; +- } +- return -ENOBUFS; +-} +- +-static void __rsvp_delete_filter(struct rsvp_filter *f) +-{ +- tcf_exts_destroy(&f->exts); +- tcf_exts_put_net(&f->exts); +- kfree(f); +-} +- +-static void rsvp_delete_filter_work(struct work_struct *work) +-{ +- struct rsvp_filter *f = container_of(to_rcu_work(work), +- struct rsvp_filter, +- rwork); +- rtnl_lock(); +- __rsvp_delete_filter(f); +- rtnl_unlock(); +-} +- +-static void rsvp_delete_filter(struct tcf_proto *tp, struct rsvp_filter *f) +-{ +- tcf_unbind_filter(tp, &f->res); +- /* all classifiers are required to call tcf_exts_destroy() after rcu +- * grace period, since converted-to-rcu actions are relying on that +- * in cleanup() callback +- */ +- if (tcf_exts_get_net(&f->exts)) +- tcf_queue_work(&f->rwork, rsvp_delete_filter_work); +- else +- __rsvp_delete_filter(f); +-} +- +-static void rsvp_destroy(struct tcf_proto *tp, bool rtnl_held, +- struct netlink_ext_ack *extack) +-{ +- struct rsvp_head *data = rtnl_dereference(tp->root); +- int h1, h2; +- +- if (data == NULL) +- return; +- +- for (h1 = 0; h1 < 256; h1++) { +- struct rsvp_session *s; +- +- while ((s = rtnl_dereference(data->ht[h1])) != NULL) { +- RCU_INIT_POINTER(data->ht[h1], s->next); +- +- for (h2 = 0; h2 <= 16; h2++) { +- struct rsvp_filter *f; +- +- while ((f = rtnl_dereference(s->ht[h2])) != NULL) { +- rcu_assign_pointer(s->ht[h2], f->next); +- rsvp_delete_filter(tp, f); +- } +- } +- kfree_rcu(s, rcu); +- } +- } +- kfree_rcu(data, rcu); +-} +- +-static int rsvp_delete(struct tcf_proto *tp, void *arg, bool *last, +- bool rtnl_held, struct netlink_ext_ack *extack) +-{ +- struct rsvp_head *head = rtnl_dereference(tp->root); +- struct rsvp_filter *nfp, *f = arg; +- struct rsvp_filter __rcu **fp; +- unsigned int h = f->handle; +- struct rsvp_session __rcu **sp; +- struct rsvp_session *nsp, *s = f->sess; +- int i, h1; +- +- fp = &s->ht[(h >> 8) & 0xFF]; +- for (nfp = rtnl_dereference(*fp); nfp; +- fp = &nfp->next, nfp = rtnl_dereference(*fp)) { +- if (nfp == f) { +- RCU_INIT_POINTER(*fp, f->next); +- rsvp_delete_filter(tp, f); +- +- /* Strip tree */ +- +- for (i = 0; i <= 16; i++) +- if (s->ht[i]) +- goto out; +- +- /* OK, session has no flows */ +- sp = &head->ht[h & 0xFF]; +- for (nsp = rtnl_dereference(*sp); nsp; +- sp = &nsp->next, nsp = rtnl_dereference(*sp)) { +- if (nsp == s) { +- RCU_INIT_POINTER(*sp, s->next); +- kfree_rcu(s, rcu); +- goto out; +- } +- } +- +- break; +- } +- } +- +-out: +- *last = true; +- for (h1 = 0; h1 < 256; h1++) { +- if (rcu_access_pointer(head->ht[h1])) { +- *last = false; +- break; +- } +- } +- +- return 0; +-} +- +-static unsigned int gen_handle(struct tcf_proto *tp, unsigned salt) +-{ +- struct rsvp_head *data = rtnl_dereference(tp->root); +- int i = 0xFFFF; +- +- while (i-- > 0) { +- u32 h; +- +- if ((data->hgenerator += 0x10000) == 0) +- data->hgenerator = 0x10000; +- h = data->hgenerator|salt; +- if (!rsvp_get(tp, h)) +- return h; +- } +- return 0; +-} +- +-static int tunnel_bts(struct rsvp_head *data) +-{ +- int n = data->tgenerator >> 5; +- u32 b = 1 << (data->tgenerator & 0x1F); +- +- if (data->tmap[n] & b) +- return 0; +- data->tmap[n] |= b; +- return 1; +-} +- +-static void tunnel_recycle(struct rsvp_head *data) +-{ +- struct rsvp_session __rcu **sht = data->ht; +- u32 tmap[256/32]; +- int h1, h2; +- +- memset(tmap, 0, sizeof(tmap)); +- +- for (h1 = 0; h1 < 256; h1++) { +- struct rsvp_session *s; +- for (s = rtnl_dereference(sht[h1]); s; +- s = rtnl_dereference(s->next)) { +- for (h2 = 0; h2 <= 16; h2++) { +- struct rsvp_filter *f; +- +- for (f = rtnl_dereference(s->ht[h2]); f; +- f = rtnl_dereference(f->next)) { +- if (f->tunnelhdr == 0) +- continue; +- data->tgenerator = f->res.classid; +- tunnel_bts(data); +- } +- } +- } +- } +- +- memcpy(data->tmap, tmap, sizeof(tmap)); +-} +- +-static u32 gen_tunnel(struct rsvp_head *data) +-{ +- int i, k; +- +- for (k = 0; k < 2; k++) { +- for (i = 255; i > 0; i--) { +- if (++data->tgenerator == 0) +- data->tgenerator = 1; +- if (tunnel_bts(data)) +- return data->tgenerator; +- } +- tunnel_recycle(data); +- } +- return 0; +-} +- +-static const struct nla_policy rsvp_policy[TCA_RSVP_MAX + 1] = { +- [TCA_RSVP_CLASSID] = { .type = NLA_U32 }, +- [TCA_RSVP_DST] = { .len = RSVP_DST_LEN * sizeof(u32) }, +- [TCA_RSVP_SRC] = { .len = RSVP_DST_LEN * sizeof(u32) }, +- [TCA_RSVP_PINFO] = { .len = sizeof(struct tc_rsvp_pinfo) }, +-}; +- +-static int rsvp_change(struct net *net, struct sk_buff *in_skb, +- struct tcf_proto *tp, unsigned long base, +- u32 handle, +- struct nlattr **tca, +- void **arg, bool ovr, bool rtnl_held, +- struct netlink_ext_ack *extack) +-{ +- struct rsvp_head *data = rtnl_dereference(tp->root); +- struct rsvp_filter *f, *nfp; +- struct rsvp_filter __rcu **fp; +- struct rsvp_session *nsp, *s; +- struct rsvp_session __rcu **sp; +- struct tc_rsvp_pinfo *pinfo = NULL; +- struct nlattr *opt = tca[TCA_OPTIONS]; +- struct nlattr *tb[TCA_RSVP_MAX + 1]; +- struct tcf_exts e; +- unsigned int h1, h2; +- __be32 *dst; +- int err; +- +- if (opt == NULL) +- return handle ? -EINVAL : 0; +- +- err = nla_parse_nested_deprecated(tb, TCA_RSVP_MAX, opt, rsvp_policy, +- NULL); +- if (err < 0) +- return err; +- +- err = tcf_exts_init(&e, net, TCA_RSVP_ACT, TCA_RSVP_POLICE); +- if (err < 0) +- return err; +- err = tcf_exts_validate(net, tp, tb, tca[TCA_RATE], &e, ovr, true, +- extack); +- if (err < 0) +- goto errout2; +- +- f = *arg; +- if (f) { +- /* Node exists: adjust only classid */ +- struct rsvp_filter *n; +- +- if (f->handle != handle && handle) +- goto errout2; +- +- n = kmemdup(f, sizeof(*f), GFP_KERNEL); +- if (!n) { +- err = -ENOMEM; +- goto errout2; +- } +- +- err = tcf_exts_init(&n->exts, net, TCA_RSVP_ACT, +- TCA_RSVP_POLICE); +- if (err < 0) { +- kfree(n); +- goto errout2; +- } +- +- if (tb[TCA_RSVP_CLASSID]) { +- n->res.classid = nla_get_u32(tb[TCA_RSVP_CLASSID]); +- tcf_bind_filter(tp, &n->res, base); +- } +- +- tcf_exts_change(&n->exts, &e); +- rsvp_replace(tp, n, handle); +- return 0; +- } +- +- /* Now more serious part... */ +- err = -EINVAL; +- if (handle) +- goto errout2; +- if (tb[TCA_RSVP_DST] == NULL) +- goto errout2; +- +- err = -ENOBUFS; +- f = kzalloc(sizeof(struct rsvp_filter), GFP_KERNEL); +- if (f == NULL) +- goto errout2; +- +- err = tcf_exts_init(&f->exts, net, TCA_RSVP_ACT, TCA_RSVP_POLICE); +- if (err < 0) +- goto errout; +- h2 = 16; +- if (tb[TCA_RSVP_SRC]) { +- memcpy(f->src, nla_data(tb[TCA_RSVP_SRC]), sizeof(f->src)); +- h2 = hash_src(f->src); +- } +- if (tb[TCA_RSVP_PINFO]) { +- pinfo = nla_data(tb[TCA_RSVP_PINFO]); +- f->spi = pinfo->spi; +- f->tunnelhdr = pinfo->tunnelhdr; +- } +- if (tb[TCA_RSVP_CLASSID]) +- f->res.classid = nla_get_u32(tb[TCA_RSVP_CLASSID]); +- +- dst = nla_data(tb[TCA_RSVP_DST]); +- h1 = hash_dst(dst, pinfo ? pinfo->protocol : 0, pinfo ? pinfo->tunnelid : 0); +- +- err = -ENOMEM; +- if ((f->handle = gen_handle(tp, h1 | (h2<<8))) == 0) +- goto errout; +- +- if (f->tunnelhdr) { +- err = -EINVAL; +- if (f->res.classid > 255) +- goto errout; +- +- err = -ENOMEM; +- if (f->res.classid == 0 && +- (f->res.classid = gen_tunnel(data)) == 0) +- goto errout; +- } +- +- for (sp = &data->ht[h1]; +- (s = rtnl_dereference(*sp)) != NULL; +- sp = &s->next) { +- if (dst[RSVP_DST_LEN-1] == s->dst[RSVP_DST_LEN-1] && +- pinfo && pinfo->protocol == s->protocol && +- memcmp(&pinfo->dpi, &s->dpi, sizeof(s->dpi)) == 0 && +-#if RSVP_DST_LEN == 4 +- dst[0] == s->dst[0] && +- dst[1] == s->dst[1] && +- dst[2] == s->dst[2] && +-#endif +- pinfo->tunnelid == s->tunnelid) { +- +-insert: +- /* OK, we found appropriate session */ +- +- fp = &s->ht[h2]; +- +- f->sess = s; +- if (f->tunnelhdr == 0) +- tcf_bind_filter(tp, &f->res, base); +- +- tcf_exts_change(&f->exts, &e); +- +- fp = &s->ht[h2]; +- for (nfp = rtnl_dereference(*fp); nfp; +- fp = &nfp->next, nfp = rtnl_dereference(*fp)) { +- __u32 mask = nfp->spi.mask & f->spi.mask; +- +- if (mask != f->spi.mask) +- break; +- } +- RCU_INIT_POINTER(f->next, nfp); +- rcu_assign_pointer(*fp, f); +- +- *arg = f; +- return 0; +- } +- } +- +- /* No session found. Create new one. */ +- +- err = -ENOBUFS; +- s = kzalloc(sizeof(struct rsvp_session), GFP_KERNEL); +- if (s == NULL) +- goto errout; +- memcpy(s->dst, dst, sizeof(s->dst)); +- +- if (pinfo) { +- s->dpi = pinfo->dpi; +- s->protocol = pinfo->protocol; +- s->tunnelid = pinfo->tunnelid; +- } +- sp = &data->ht[h1]; +- for (nsp = rtnl_dereference(*sp); nsp; +- sp = &nsp->next, nsp = rtnl_dereference(*sp)) { +- if ((nsp->dpi.mask & s->dpi.mask) != s->dpi.mask) +- break; +- } +- RCU_INIT_POINTER(s->next, nsp); +- rcu_assign_pointer(*sp, s); +- +- goto insert; +- +-errout: +- tcf_exts_destroy(&f->exts); +- kfree(f); +-errout2: +- tcf_exts_destroy(&e); +- return err; +-} +- +-static void rsvp_walk(struct tcf_proto *tp, struct tcf_walker *arg, +- bool rtnl_held) +-{ +- struct rsvp_head *head = rtnl_dereference(tp->root); +- unsigned int h, h1; +- +- if (arg->stop) +- return; +- +- for (h = 0; h < 256; h++) { +- struct rsvp_session *s; +- +- for (s = rtnl_dereference(head->ht[h]); s; +- s = rtnl_dereference(s->next)) { +- for (h1 = 0; h1 <= 16; h1++) { +- struct rsvp_filter *f; +- +- for (f = rtnl_dereference(s->ht[h1]); f; +- f = rtnl_dereference(f->next)) { +- if (arg->count < arg->skip) { +- arg->count++; +- continue; +- } +- if (arg->fn(tp, f, arg) < 0) { +- arg->stop = 1; +- return; +- } +- arg->count++; +- } +- } +- } +- } +-} +- +-static int rsvp_dump(struct net *net, struct tcf_proto *tp, void *fh, +- struct sk_buff *skb, struct tcmsg *t, bool rtnl_held) +-{ +- struct rsvp_filter *f = fh; +- struct rsvp_session *s; +- struct nlattr *nest; +- struct tc_rsvp_pinfo pinfo; +- +- if (f == NULL) +- return skb->len; +- s = f->sess; +- +- t->tcm_handle = f->handle; +- +- nest = nla_nest_start_noflag(skb, TCA_OPTIONS); +- if (nest == NULL) +- goto nla_put_failure; +- +- if (nla_put(skb, TCA_RSVP_DST, sizeof(s->dst), &s->dst)) +- goto nla_put_failure; +- pinfo.dpi = s->dpi; +- pinfo.spi = f->spi; +- pinfo.protocol = s->protocol; +- pinfo.tunnelid = s->tunnelid; +- pinfo.tunnelhdr = f->tunnelhdr; +- pinfo.pad = 0; +- if (nla_put(skb, TCA_RSVP_PINFO, sizeof(pinfo), &pinfo)) +- goto nla_put_failure; +- if (f->res.classid && +- nla_put_u32(skb, TCA_RSVP_CLASSID, f->res.classid)) +- goto nla_put_failure; +- if (((f->handle >> 8) & 0xFF) != 16 && +- nla_put(skb, TCA_RSVP_SRC, sizeof(f->src), f->src)) +- goto nla_put_failure; +- +- if (tcf_exts_dump(skb, &f->exts) < 0) +- goto nla_put_failure; +- +- nla_nest_end(skb, nest); +- +- if (tcf_exts_dump_stats(skb, &f->exts) < 0) +- goto nla_put_failure; +- return skb->len; +- +-nla_put_failure: +- nla_nest_cancel(skb, nest); +- return -1; +-} +- +-static void rsvp_bind_class(void *fh, u32 classid, unsigned long cl, void *q, +- unsigned long base) +-{ +- struct rsvp_filter *f = fh; +- +- if (f && f->res.classid == classid) { +- if (cl) +- __tcf_bind_filter(q, &f->res, base); +- else +- __tcf_unbind_filter(q, &f->res); +- } +-} +- +-static struct tcf_proto_ops RSVP_OPS __read_mostly = { +- .kind = RSVP_ID, +- .classify = rsvp_classify, +- .init = rsvp_init, +- .destroy = rsvp_destroy, +- .get = rsvp_get, +- .change = rsvp_change, +- .delete = rsvp_delete, +- .walk = rsvp_walk, +- .dump = rsvp_dump, +- .bind_class = rsvp_bind_class, +- .owner = THIS_MODULE, +-}; +- +-static int __init init_rsvp(void) +-{ +- return register_tcf_proto_ops(&RSVP_OPS); +-} +- +-static void __exit exit_rsvp(void) +-{ +- unregister_tcf_proto_ops(&RSVP_OPS); +-} +- +-module_init(init_rsvp) +-module_exit(exit_rsvp) +diff --git a/net/sched/cls_rsvp6.c b/net/sched/cls_rsvp6.c +deleted file mode 100644 +index 64078846000ef..0000000000000 +--- a/net/sched/cls_rsvp6.c ++++ /dev/null +@@ -1,24 +0,0 @@ +-// SPDX-License-Identifier: GPL-2.0-or-later +-/* +- * net/sched/cls_rsvp6.c Special RSVP packet classifier for IPv6. +- * +- * Authors: Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru> +- */ +- +-#include <linux/module.h> +-#include <linux/types.h> +-#include <linux/kernel.h> +-#include <linux/string.h> +-#include <linux/errno.h> +-#include <linux/ipv6.h> +-#include <linux/skbuff.h> +-#include <net/act_api.h> +-#include <net/pkt_cls.h> +-#include <net/netlink.h> +- +-#define RSVP_DST_LEN 4 +-#define RSVP_ID "rsvp6" +-#define RSVP_OPS cls_rsvp6_ops +- +-#include "cls_rsvp.h" +-MODULE_LICENSE("GPL"); +diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c +index 92ad4115e473c..2af4adb7e84e4 100644 +--- a/net/sched/sch_hfsc.c ++++ b/net/sched/sch_hfsc.c +@@ -1012,6 +1012,10 @@ hfsc_change_class(struct Qdisc *sch, u32 classid, u32 parentid, + if (parent == NULL) + return -ENOENT; + } ++ if (!(parent->cl_flags & HFSC_FSC) && parent != &q->root) { ++ NL_SET_ERR_MSG(extack, "Invalid parent - parent class must have FSC"); ++ return -EINVAL; ++ } + + if (classid == 0 || TC_H_MAJ(classid ^ sch->handle) != 0) + return -EINVAL; +diff --git a/net/sched/sch_plug.c b/net/sched/sch_plug.c +index cbc2ebca4548c..339990bb59817 100644 +--- a/net/sched/sch_plug.c ++++ b/net/sched/sch_plug.c +@@ -210,7 +210,7 @@ static struct Qdisc_ops plug_qdisc_ops __read_mostly = { + .priv_size = sizeof(struct plug_sched_data), + .enqueue = plug_enqueue, + .dequeue = plug_dequeue, +- .peek = qdisc_peek_head, ++ .peek = qdisc_peek_dequeued, + .init = plug_init, + .change = plug_change, + .reset = qdisc_reset_queue, +diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c +index 34a54dcd95f23..6e9e3405f26b9 100644 +--- a/net/sched/sch_qfq.c ++++ b/net/sched/sch_qfq.c +@@ -975,10 +975,13 @@ static void qfq_update_eligible(struct qfq_sched *q) + } + + /* Dequeue head packet of the head class in the DRR queue of the aggregate. */ +-static void agg_dequeue(struct qfq_aggregate *agg, +- struct qfq_class *cl, unsigned int len) ++static struct sk_buff *agg_dequeue(struct qfq_aggregate *agg, ++ struct qfq_class *cl, unsigned int len) + { +- qdisc_dequeue_peeked(cl->qdisc); ++ struct sk_buff *skb = qdisc_dequeue_peeked(cl->qdisc); ++ ++ if (!skb) ++ return NULL; + + cl->deficit -= (int) len; + +@@ -988,6 +991,8 @@ static void agg_dequeue(struct qfq_aggregate *agg, + cl->deficit += agg->lmax; + list_move_tail(&cl->alist, &agg->active); + } ++ ++ return skb; + } + + static inline struct sk_buff *qfq_peek_skb(struct qfq_aggregate *agg, +@@ -1133,11 +1138,18 @@ static struct sk_buff *qfq_dequeue(struct Qdisc *sch) + if (!skb) + return NULL; + +- qdisc_qstats_backlog_dec(sch, skb); + sch->q.qlen--; ++ ++ skb = agg_dequeue(in_serv_agg, cl, len); ++ ++ if (!skb) { ++ sch->q.qlen++; ++ return NULL; ++ } ++ ++ qdisc_qstats_backlog_dec(sch, skb); + qdisc_bstats_update(sch, skb); + +- agg_dequeue(in_serv_agg, cl, len); + /* If lmax is lowered, through qfq_change_class, for a class + * owning pending packets with larger size than the new value + * of lmax, then the following condition may hold. +diff --git a/net/sctp/proc.c b/net/sctp/proc.c +index 982a87b3e11f8..963b94517ec20 100644 +--- a/net/sctp/proc.c ++++ b/net/sctp/proc.c +@@ -284,7 +284,7 @@ static int sctp_assocs_seq_show(struct seq_file *seq, void *v) + assoc->init_retries, assoc->shutdown_retries, + assoc->rtx_data_chunks, + refcount_read(&sk->sk_wmem_alloc), +- sk->sk_wmem_queued, ++ READ_ONCE(sk->sk_wmem_queued), + sk->sk_sndbuf, + sk->sk_rcvbuf); + seq_printf(seq, "\n"); +diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c +index 8d32229199b96..c964e7ca6f7e5 100644 +--- a/net/sctp/sm_sideeffect.c ++++ b/net/sctp/sm_sideeffect.c +@@ -1240,7 +1240,10 @@ static int sctp_side_effects(enum sctp_event_type event_type, + default: + pr_err("impossible disposition %d in state %d, event_type %d, event_id %d\n", + status, state, event_type, subtype.chunk); +- BUG(); ++ error = status; ++ if (error >= 0) ++ error = -EINVAL; ++ WARN_ON_ONCE(1); + break; + } + +diff --git a/net/sctp/socket.c b/net/sctp/socket.c +index 431b9399a781f..d1dd261e8b010 100644 +--- a/net/sctp/socket.c ++++ b/net/sctp/socket.c +@@ -68,7 +68,7 @@ + #include <net/sctp/stream_sched.h> + + /* Forward declarations for internal helper functions. */ +-static bool sctp_writeable(struct sock *sk); ++static bool sctp_writeable(const struct sock *sk); + static void sctp_wfree(struct sk_buff *skb); + static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p, + size_t msg_len); +@@ -138,7 +138,7 @@ static inline void sctp_set_owner_w(struct sctp_chunk *chunk) + + refcount_add(sizeof(struct sctp_chunk), &sk->sk_wmem_alloc); + asoc->sndbuf_used += chunk->skb->truesize + sizeof(struct sctp_chunk); +- sk->sk_wmem_queued += chunk->skb->truesize + sizeof(struct sctp_chunk); ++ sk_wmem_queued_add(sk, chunk->skb->truesize + sizeof(struct sctp_chunk)); + sk_mem_charge(sk, chunk->skb->truesize); + } + +@@ -8997,7 +8997,7 @@ static void sctp_wfree(struct sk_buff *skb) + struct sock *sk = asoc->base.sk; + + sk_mem_uncharge(sk, skb->truesize); +- sk->sk_wmem_queued -= skb->truesize + sizeof(struct sctp_chunk); ++ sk_wmem_queued_add(sk, -(skb->truesize + sizeof(struct sctp_chunk))); + asoc->sndbuf_used -= skb->truesize + sizeof(struct sctp_chunk); + WARN_ON(refcount_sub_and_test(sizeof(struct sctp_chunk), + &sk->sk_wmem_alloc)); +@@ -9152,9 +9152,9 @@ void sctp_write_space(struct sock *sk) + * UDP-style sockets or TCP-style sockets, this code should work. + * - Daisy + */ +-static bool sctp_writeable(struct sock *sk) ++static bool sctp_writeable(const struct sock *sk) + { +- return sk->sk_sndbuf > sk->sk_wmem_queued; ++ return READ_ONCE(sk->sk_sndbuf) > READ_ONCE(sk->sk_wmem_queued); + } + + /* Wait for an association to go into ESTABLISHED state. If timeout is 0, +diff --git a/net/socket.c b/net/socket.c +index 9dd4c7ce8343a..146d0733a622a 100644 +--- a/net/socket.c ++++ b/net/socket.c +@@ -3637,7 +3637,11 @@ EXPORT_SYMBOL(kernel_accept); + int kernel_connect(struct socket *sock, struct sockaddr *addr, int addrlen, + int flags) + { +- return sock->ops->connect(sock, addr, addrlen, flags); ++ struct sockaddr_storage address; ++ ++ memcpy(&address, addr, addrlen); ++ ++ return sock->ops->connect(sock, (struct sockaddr *)&address, addrlen, flags); + } + EXPORT_SYMBOL(kernel_connect); + +diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c +index f4091fba4c722..62bc7e5c58e53 100644 +--- a/net/tls/tls_sw.c ++++ b/net/tls/tls_sw.c +@@ -807,7 +807,7 @@ static int bpf_exec_tx_verdict(struct sk_msg *msg, struct sock *sk, + psock = sk_psock_get(sk); + if (!psock || !policy) { + err = tls_push_record(sk, flags, record_type); +- if (err && sk->sk_err == EBADMSG) { ++ if (err && err != -EINPROGRESS && sk->sk_err == EBADMSG) { + *copied -= sk_msg_free(sk, msg); + tls_free_open_rec(sk); + err = -sk->sk_err; +@@ -836,7 +836,7 @@ more_data: + switch (psock->eval) { + case __SK_PASS: + err = tls_push_record(sk, flags, record_type); +- if (err && sk->sk_err == EBADMSG) { ++ if (err && err != -EINPROGRESS && sk->sk_err == EBADMSG) { + *copied -= sk_msg_free(sk, msg); + tls_free_open_rec(sk); + err = -sk->sk_err; +diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c +index baf0af49c5bd4..304eb26b34dca 100644 +--- a/net/unix/af_unix.c ++++ b/net/unix/af_unix.c +@@ -589,7 +589,7 @@ static void unix_release_sock(struct sock *sk, int embrion) + * What the above comment does talk about? --ANK(980817) + */ + +- if (unix_tot_inflight) ++ if (READ_ONCE(unix_tot_inflight)) + unix_gc(); /* Garbage collect fds */ + } + +diff --git a/net/unix/scm.c b/net/unix/scm.c +index ce700b22eccee..e881a6e78af53 100644 +--- a/net/unix/scm.c ++++ b/net/unix/scm.c +@@ -62,7 +62,7 @@ void unix_inflight(struct user_struct *user, struct file *fp) + /* Paired with READ_ONCE() in wait_for_unix_gc() */ + WRITE_ONCE(unix_tot_inflight, unix_tot_inflight + 1); + } +- user->unix_inflight++; ++ WRITE_ONCE(user->unix_inflight, user->unix_inflight + 1); + spin_unlock(&unix_gc_lock); + } + +@@ -83,7 +83,7 @@ void unix_notinflight(struct user_struct *user, struct file *fp) + /* Paired with READ_ONCE() in wait_for_unix_gc() */ + WRITE_ONCE(unix_tot_inflight, unix_tot_inflight - 1); + } +- user->unix_inflight--; ++ WRITE_ONCE(user->unix_inflight, user->unix_inflight - 1); + spin_unlock(&unix_gc_lock); + } + +@@ -97,7 +97,7 @@ static inline bool too_many_unix_fds(struct task_struct *p) + { + struct user_struct *user = current_user(); + +- if (unlikely(user->unix_inflight > task_rlimit(p, RLIMIT_NOFILE))) ++ if (unlikely(READ_ONCE(user->unix_inflight) > task_rlimit(p, RLIMIT_NOFILE))) + return !capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN); + return false; + } +diff --git a/scripts/kconfig/preprocess.c b/scripts/kconfig/preprocess.c +index 748da578b418c..d1f5bcff4b62d 100644 +--- a/scripts/kconfig/preprocess.c ++++ b/scripts/kconfig/preprocess.c +@@ -396,6 +396,9 @@ static char *eval_clause(const char *str, size_t len, int argc, char *argv[]) + + p++; + } ++ ++ if (new_argc >= FUNCTION_MAX_ARGS) ++ pperror("too many function arguments"); + new_argv[new_argc++] = prev; + + /* +diff --git a/security/integrity/ima/Kconfig b/security/integrity/ima/Kconfig +index d90ead61f0def..c97ce6265fc6b 100644 +--- a/security/integrity/ima/Kconfig ++++ b/security/integrity/ima/Kconfig +@@ -243,18 +243,6 @@ config IMA_APPRAISE_MODSIG + The modsig keyword can be used in the IMA policy to allow a hook + to accept such signatures. + +-config IMA_TRUSTED_KEYRING +- bool "Require all keys on the .ima keyring be signed (deprecated)" +- depends on IMA_APPRAISE && SYSTEM_TRUSTED_KEYRING +- depends on INTEGRITY_ASYMMETRIC_KEYS +- select INTEGRITY_TRUSTED_KEYRING +- default y +- help +- This option requires that all keys added to the .ima +- keyring be signed by a key on the system trusted keyring. +- +- This option is deprecated in favor of INTEGRITY_TRUSTED_KEYRING +- + config IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY + bool "Permit keys validly signed by a built-in or secondary CA cert (EXPERIMENTAL)" + depends on SYSTEM_TRUSTED_KEYRING +diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c +index edde63a63007f..f42968f349584 100644 +--- a/security/keys/keyctl.c ++++ b/security/keys/keyctl.c +@@ -977,14 +977,19 @@ long keyctl_chown_key(key_serial_t id, uid_t user, gid_t group) + ret = -EACCES; + down_write(&key->sem); + +- if (!capable(CAP_SYS_ADMIN)) { ++ { ++ bool is_privileged_op = false; ++ + /* only the sysadmin can chown a key to some other UID */ + if (user != (uid_t) -1 && !uid_eq(key->uid, uid)) +- goto error_put; ++ is_privileged_op = true; + + /* only the sysadmin can set the key's GID to a group other + * than one of those that the current process subscribes to */ + if (group != (gid_t) -1 && !gid_eq(gid, key->gid) && !in_group_p(gid)) ++ is_privileged_op = true; ++ ++ if (is_privileged_op && !capable(CAP_SYS_ADMIN)) + goto error_put; + } + +@@ -1084,7 +1089,7 @@ long keyctl_setperm_key(key_serial_t id, key_perm_t perm) + down_write(&key->sem); + + /* if we're not the sysadmin, we can only change a key that we own */ +- if (capable(CAP_SYS_ADMIN) || uid_eq(key->uid, current_fsuid())) { ++ if (uid_eq(key->uid, current_fsuid()) || capable(CAP_SYS_ADMIN)) { + key->perm = perm; + ret = 0; + } +diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c +index 6b6fec04c412b..a71975ea88a94 100644 +--- a/security/smack/smackfs.c ++++ b/security/smack/smackfs.c +@@ -895,7 +895,7 @@ static ssize_t smk_set_cipso(struct file *file, const char __user *buf, + } + + ret = sscanf(rule, "%d", &catlen); +- if (ret != 1 || catlen > SMACK_CIPSO_MAXCATNUM) ++ if (ret != 1 || catlen < 0 || catlen > SMACK_CIPSO_MAXCATNUM) + goto out; + + if (format == SMK_FIXED24_FMT && +diff --git a/sound/Kconfig b/sound/Kconfig +index 36785410fbe15..aaf2022ffc57d 100644 +--- a/sound/Kconfig ++++ b/sound/Kconfig +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0-only + menuconfig SOUND + tristate "Sound card support" +- depends on HAS_IOMEM ++ depends on HAS_IOMEM || UML + help + If you have a sound card in your computer, i.e. if it can say more + than an occasional beep, say Y. +diff --git a/sound/core/pcm_compat.c b/sound/core/pcm_compat.c +index 6f9003b1869a7..b30b18349e714 100644 +--- a/sound/core/pcm_compat.c ++++ b/sound/core/pcm_compat.c +@@ -315,10 +315,14 @@ static int snd_pcm_ioctl_hw_params_compat(struct snd_pcm_substream *substream, + goto error; + } + +- if (refine) ++ if (refine) { + err = snd_pcm_hw_refine(substream, data); +- else ++ if (err < 0) ++ goto error; ++ err = fixup_unreferenced_params(substream, data); ++ } else { + err = snd_pcm_hw_params(substream, data); ++ } + if (err < 0) + goto error; + if (copy_to_user(data32, data, sizeof(*data32)) || +diff --git a/sound/core/seq/oss/seq_oss_midi.c b/sound/core/seq/oss/seq_oss_midi.c +index f73ee0798aeab..be80ce72e0c72 100644 +--- a/sound/core/seq/oss/seq_oss_midi.c ++++ b/sound/core/seq/oss/seq_oss_midi.c +@@ -37,6 +37,7 @@ struct seq_oss_midi { + struct snd_midi_event *coder; /* MIDI event coder */ + struct seq_oss_devinfo *devinfo; /* assigned OSSseq device */ + snd_use_lock_t use_lock; ++ struct mutex open_mutex; + }; + + +@@ -171,6 +172,7 @@ snd_seq_oss_midi_check_new_port(struct snd_seq_port_info *pinfo) + mdev->flags = pinfo->capability; + mdev->opened = 0; + snd_use_lock_init(&mdev->use_lock); ++ mutex_init(&mdev->open_mutex); + + /* copy and truncate the name of synth device */ + strlcpy(mdev->name, pinfo->name, sizeof(mdev->name)); +@@ -319,14 +321,16 @@ snd_seq_oss_midi_open(struct seq_oss_devinfo *dp, int dev, int fmode) + int perm; + struct seq_oss_midi *mdev; + struct snd_seq_port_subscribe subs; ++ int err; + + if ((mdev = get_mididev(dp, dev)) == NULL) + return -ENODEV; + ++ mutex_lock(&mdev->open_mutex); + /* already used? */ + if (mdev->opened && mdev->devinfo != dp) { +- snd_use_lock_free(&mdev->use_lock); +- return -EBUSY; ++ err = -EBUSY; ++ goto unlock; + } + + perm = 0; +@@ -336,14 +340,14 @@ snd_seq_oss_midi_open(struct seq_oss_devinfo *dp, int dev, int fmode) + perm |= PERM_READ; + perm &= mdev->flags; + if (perm == 0) { +- snd_use_lock_free(&mdev->use_lock); +- return -ENXIO; ++ err = -ENXIO; ++ goto unlock; + } + + /* already opened? */ + if ((mdev->opened & perm) == perm) { +- snd_use_lock_free(&mdev->use_lock); +- return 0; ++ err = 0; ++ goto unlock; + } + + perm &= ~mdev->opened; +@@ -368,13 +372,17 @@ snd_seq_oss_midi_open(struct seq_oss_devinfo *dp, int dev, int fmode) + } + + if (! mdev->opened) { +- snd_use_lock_free(&mdev->use_lock); +- return -ENXIO; ++ err = -ENXIO; ++ goto unlock; + } + + mdev->devinfo = dp; ++ err = 0; ++ ++ unlock: ++ mutex_unlock(&mdev->open_mutex); + snd_use_lock_free(&mdev->use_lock); +- return 0; ++ return err; + } + + /* +@@ -388,10 +396,9 @@ snd_seq_oss_midi_close(struct seq_oss_devinfo *dp, int dev) + + if ((mdev = get_mididev(dp, dev)) == NULL) + return -ENODEV; +- if (! mdev->opened || mdev->devinfo != dp) { +- snd_use_lock_free(&mdev->use_lock); +- return 0; +- } ++ mutex_lock(&mdev->open_mutex); ++ if (!mdev->opened || mdev->devinfo != dp) ++ goto unlock; + + memset(&subs, 0, sizeof(subs)); + if (mdev->opened & PERM_WRITE) { +@@ -410,6 +417,8 @@ snd_seq_oss_midi_close(struct seq_oss_devinfo *dp, int dev) + mdev->opened = 0; + mdev->devinfo = NULL; + ++ unlock: ++ mutex_unlock(&mdev->open_mutex); + snd_use_lock_free(&mdev->use_lock); + return 0; + } +diff --git a/sound/pci/ac97/ac97_codec.c b/sound/pci/ac97/ac97_codec.c +index b920c739d6863..418a7a666cf4e 100644 +--- a/sound/pci/ac97/ac97_codec.c ++++ b/sound/pci/ac97/ac97_codec.c +@@ -2006,10 +2006,9 @@ int snd_ac97_mixer(struct snd_ac97_bus *bus, struct snd_ac97_template *template, + .dev_disconnect = snd_ac97_dev_disconnect, + }; + +- if (!rac97) +- return -EINVAL; +- if (snd_BUG_ON(!bus || !template)) ++ if (snd_BUG_ON(!bus || !template || !rac97)) + return -EINVAL; ++ *rac97 = NULL; + if (snd_BUG_ON(template->num >= 4)) + return -EINVAL; + if (bus->codec[template->num]) +diff --git a/sound/soc/atmel/atmel-i2s.c b/sound/soc/atmel/atmel-i2s.c +index d870f56c44cfc..0341b31197670 100644 +--- a/sound/soc/atmel/atmel-i2s.c ++++ b/sound/soc/atmel/atmel-i2s.c +@@ -163,11 +163,14 @@ struct atmel_i2s_gck_param { + + #define I2S_MCK_12M288 12288000UL + #define I2S_MCK_11M2896 11289600UL ++#define I2S_MCK_6M144 6144000UL + + /* mck = (32 * (imckfs+1) / (imckdiv+1)) * fs */ + static const struct atmel_i2s_gck_param gck_params[] = { ++ /* mck = 6.144Mhz */ ++ { 8000, I2S_MCK_6M144, 1, 47}, /* mck = 768 fs */ ++ + /* mck = 12.288MHz */ +- { 8000, I2S_MCK_12M288, 0, 47}, /* mck = 1536 fs */ + { 16000, I2S_MCK_12M288, 1, 47}, /* mck = 768 fs */ + { 24000, I2S_MCK_12M288, 3, 63}, /* mck = 512 fs */ + { 32000, I2S_MCK_12M288, 3, 47}, /* mck = 384 fs */ +diff --git a/sound/soc/codecs/da7219-aad.c b/sound/soc/codecs/da7219-aad.c +index 4f2a96e9fd45b..befe26749bc2b 100644 +--- a/sound/soc/codecs/da7219-aad.c ++++ b/sound/soc/codecs/da7219-aad.c +@@ -347,11 +347,15 @@ static irqreturn_t da7219_aad_irq_thread(int irq, void *data) + struct da7219_priv *da7219 = snd_soc_component_get_drvdata(component); + u8 events[DA7219_AAD_IRQ_REG_MAX]; + u8 statusa; +- int i, report = 0, mask = 0; ++ int i, ret, report = 0, mask = 0; + + /* Read current IRQ events */ +- regmap_bulk_read(da7219->regmap, DA7219_ACCDET_IRQ_EVENT_A, +- events, DA7219_AAD_IRQ_REG_MAX); ++ ret = regmap_bulk_read(da7219->regmap, DA7219_ACCDET_IRQ_EVENT_A, ++ events, DA7219_AAD_IRQ_REG_MAX); ++ if (ret) { ++ dev_warn_ratelimited(component->dev, "Failed to read IRQ events: %d\n", ret); ++ return IRQ_NONE; ++ } + + if (!events[DA7219_AAD_IRQ_REG_A] && !events[DA7219_AAD_IRQ_REG_B]) + return IRQ_NONE; +@@ -855,6 +859,8 @@ void da7219_aad_suspend(struct snd_soc_component *component) + } + } + } ++ ++ synchronize_irq(da7219_aad->irq); + } + + void da7219_aad_resume(struct snd_soc_component *component) +diff --git a/sound/soc/codecs/es8316.c b/sound/soc/codecs/es8316.c +index 131f41cccbe65..dd2df9a903e05 100644 +--- a/sound/soc/codecs/es8316.c ++++ b/sound/soc/codecs/es8316.c +@@ -153,7 +153,7 @@ static const char * const es8316_dmic_txt[] = { + "dmic data at high level", + "dmic data at low level", + }; +-static const unsigned int es8316_dmic_values[] = { 0, 1, 2 }; ++static const unsigned int es8316_dmic_values[] = { 0, 2, 3 }; + static const struct soc_enum es8316_dmic_src_enum = + SOC_VALUE_ENUM_SINGLE(ES8316_ADC_DMIC, 0, 3, + ARRAY_SIZE(es8316_dmic_txt), +diff --git a/tools/build/Makefile.feature b/tools/build/Makefile.feature +index 1ea26bb8c5791..6714c886940f8 100644 +--- a/tools/build/Makefile.feature ++++ b/tools/build/Makefile.feature +@@ -42,6 +42,7 @@ FEATURE_TESTS_BASIC := \ + gtk2-infobar \ + libaudit \ + libbfd \ ++ libbfd-buildid \ + libcap \ + libelf \ + libelf-getphdrnum \ +@@ -110,6 +111,7 @@ FEATURE_DISPLAY ?= \ + gtk2 \ + libaudit \ + libbfd \ ++ libbfd-buildid \ + libcap \ + libelf \ + libnuma \ +diff --git a/tools/build/feature/Makefile b/tools/build/feature/Makefile +index 88392219d425e..8104e505efde6 100644 +--- a/tools/build/feature/Makefile ++++ b/tools/build/feature/Makefile +@@ -15,6 +15,7 @@ FILES= \ + test-hello.bin \ + test-libaudit.bin \ + test-libbfd.bin \ ++ test-libbfd-buildid.bin \ + test-disassembler-four-args.bin \ + test-reallocarray.bin \ + test-libbfd-liberty.bin \ +@@ -223,6 +224,9 @@ $(OUTPUT)test-libpython.bin: + $(OUTPUT)test-libbfd.bin: + $(BUILD) -DPACKAGE='"perf"' -lbfd -ldl + ++$(OUTPUT)test-libbfd-buildid.bin: ++ $(BUILD) -DPACKAGE='"perf"' -lbfd -ldl ++ + $(OUTPUT)test-disassembler-four-args.bin: + $(BUILD) -DPACKAGE='"perf"' -lbfd -lopcodes + +diff --git a/tools/build/feature/test-all.c b/tools/build/feature/test-all.c +index 6eaeaf2da36ea..039bd2fbe7d9e 100644 +--- a/tools/build/feature/test-all.c ++++ b/tools/build/feature/test-all.c +@@ -90,6 +90,10 @@ + # include "test-libbfd.c" + #undef main + ++#define main main_test_libbfd_buildid ++# include "test-libbfd-buildid.c" ++#undef main ++ + #define main main_test_backtrace + # include "test-backtrace.c" + #undef main +@@ -208,6 +212,7 @@ int main(int argc, char *argv[]) + main_test_gtk2(argc, argv); + main_test_gtk2_infobar(argc, argv); + main_test_libbfd(); ++ main_test_libbfd_buildid(); + main_test_backtrace(); + main_test_libnuma(); + main_test_numa_num_possible_cpus(); +diff --git a/tools/build/feature/test-libbfd-buildid.c b/tools/build/feature/test-libbfd-buildid.c +new file mode 100644 +index 0000000000000..157644b04c052 +--- /dev/null ++++ b/tools/build/feature/test-libbfd-buildid.c +@@ -0,0 +1,8 @@ ++// SPDX-License-Identifier: GPL-2.0 ++#include <bfd.h> ++ ++int main(void) ++{ ++ bfd *abfd = bfd_openr("Pedro", 0); ++ return abfd && (!abfd->build_id || abfd->build_id->size > 0x506564726f); ++} +diff --git a/tools/perf/Makefile.config b/tools/perf/Makefile.config +index b94d9afad3f79..e95281586f65e 100644 +--- a/tools/perf/Makefile.config ++++ b/tools/perf/Makefile.config +@@ -752,27 +752,36 @@ else + endif + endif + +-ifeq ($(feature-libbfd), 1) +- EXTLIBS += -lbfd -lopcodes +-else +- # we are on a system that requires -liberty and (maybe) -lz +- # to link against -lbfd; test each case individually here +- +- # call all detections now so we get correct +- # status in VF output +- $(call feature_check,libbfd-liberty) +- $(call feature_check,libbfd-liberty-z) + +- ifeq ($(feature-libbfd-liberty), 1) +- EXTLIBS += -lbfd -lopcodes -liberty +- FEATURE_CHECK_LDFLAGS-disassembler-four-args += -liberty -ldl ++ifndef NO_LIBBFD ++ ifeq ($(feature-libbfd), 1) ++ EXTLIBS += -lbfd -lopcodes + else +- ifeq ($(feature-libbfd-liberty-z), 1) +- EXTLIBS += -lbfd -lopcodes -liberty -lz +- FEATURE_CHECK_LDFLAGS-disassembler-four-args += -liberty -lz -ldl ++ # we are on a system that requires -liberty and (maybe) -lz ++ # to link against -lbfd; test each case individually here ++ ++ # call all detections now so we get correct ++ # status in VF output ++ $(call feature_check,libbfd-liberty) ++ $(call feature_check,libbfd-liberty-z) ++ ++ ifeq ($(feature-libbfd-liberty), 1) ++ EXTLIBS += -lbfd -lopcodes -liberty ++ FEATURE_CHECK_LDFLAGS-disassembler-four-args += -liberty -ldl ++ else ++ ifeq ($(feature-libbfd-liberty-z), 1) ++ EXTLIBS += -lbfd -lopcodes -liberty -lz ++ FEATURE_CHECK_LDFLAGS-disassembler-four-args += -liberty -lz -ldl ++ endif + endif ++ $(call feature_check,disassembler-four-args) ++ endif ++ ++ ifeq ($(feature-libbfd-buildid), 1) ++ CFLAGS += -DHAVE_LIBBFD_BUILDID_SUPPORT ++ else ++ msg := $(warning Old version of libbfd/binutils things like PE executable profiling will not be available); + endif +- $(call feature_check,disassembler-four-args) + endif + + ifdef NO_DEMANGLE +diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c +index a30d62186f5e9..b83a861fab2ed 100644 +--- a/tools/perf/builtin-top.c ++++ b/tools/perf/builtin-top.c +@@ -1679,6 +1679,7 @@ int cmd_top(int argc, const char **argv) + top.session = perf_session__new(NULL, false, NULL); + if (IS_ERR(top.session)) { + status = PTR_ERR(top.session); ++ top.session = NULL; + goto out_delete_evlist; + } + +diff --git a/tools/perf/pmu-events/Build b/tools/perf/pmu-events/Build +index 215ba30b85343..a055dee6a46af 100644 +--- a/tools/perf/pmu-events/Build ++++ b/tools/perf/pmu-events/Build +@@ -6,10 +6,13 @@ pmu-events-y += pmu-events.o + JDIR = pmu-events/arch/$(SRCARCH) + JSON = $(shell [ -d $(JDIR) ] && \ + find $(JDIR) -name '*.json' -o -name 'mapfile.csv') ++JDIR_TEST = pmu-events/arch/test ++JSON_TEST = $(shell [ -d $(JDIR_TEST) ] && \ ++ find $(JDIR_TEST) -name '*.json') + + # + # Locate/process JSON files in pmu-events/arch/ + # directory and create tables in pmu-events.c. + # +-$(OUTPUT)pmu-events/pmu-events.c: $(JSON) $(JEVENTS) ++$(OUTPUT)pmu-events/pmu-events.c: $(JSON) $(JSON_TEST) $(JEVENTS) + $(Q)$(call echo-cmd,gen)$(JEVENTS) $(SRCARCH) pmu-events/arch $(OUTPUT)pmu-events/pmu-events.c $(V) +diff --git a/tools/perf/ui/browsers/hists.c b/tools/perf/ui/browsers/hists.c +index 514cef3a17b40..3461fa8cf4400 100644 +--- a/tools/perf/ui/browsers/hists.c ++++ b/tools/perf/ui/browsers/hists.c +@@ -1718,7 +1718,7 @@ static void hists_browser__hierarchy_headers(struct hist_browser *browser) + hists_browser__scnprintf_hierarchy_headers(browser, headers, + sizeof(headers)); + +- ui_browser__gotorc(&browser->b, 0, 0); ++ ui_browser__gotorc_title(&browser->b, 0, 0); + ui_browser__set_color(&browser->b, HE_COLORSET_ROOT); + ui_browser__write_nstring(&browser->b, headers, browser->b.width + 1); + } +diff --git a/tools/perf/util/annotate.c b/tools/perf/util/annotate.c +index e42bf572358c7..bd71cb0b52cf6 100644 +--- a/tools/perf/util/annotate.c ++++ b/tools/perf/util/annotate.c +@@ -1741,8 +1741,11 @@ static int symbol__disassemble_bpf(struct symbol *sym, + perf_exe(tpath, sizeof(tpath)); + + bfdf = bfd_openr(tpath, NULL); +- assert(bfdf); +- assert(bfd_check_format(bfdf, bfd_object)); ++ if (bfdf == NULL) ++ abort(); ++ ++ if (!bfd_check_format(bfdf, bfd_object)) ++ abort(); + + s = open_memstream(&buf, &buf_size); + if (!s) { +@@ -1790,7 +1793,8 @@ static int symbol__disassemble_bpf(struct symbol *sym, + #else + disassemble = disassembler(bfdf); + #endif +- assert(disassemble); ++ if (disassemble == NULL) ++ abort(); + + fflush(s); + do { +diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c +index d3412f2c0d18e..642528613927f 100644 +--- a/tools/perf/util/header.c ++++ b/tools/perf/util/header.c +@@ -3720,7 +3720,8 @@ int perf_event__process_attr(struct perf_tool *tool __maybe_unused, + union perf_event *event, + struct evlist **pevlist) + { +- u32 i, ids, n_ids; ++ u32 i, n_ids; ++ u64 *ids; + struct evsel *evsel; + struct evlist *evlist = *pevlist; + +@@ -3736,9 +3737,8 @@ int perf_event__process_attr(struct perf_tool *tool __maybe_unused, + + evlist__add(evlist, evsel); + +- ids = event->header.size; +- ids -= (void *)&event->attr.id - (void *)event; +- n_ids = ids / sizeof(u64); ++ n_ids = event->header.size - sizeof(event->header) - event->attr.attr.size; ++ n_ids = n_ids / sizeof(u64); + /* + * We don't have the cpu and thread maps on the header, so + * for allocating the perf_sample_id table we fake 1 cpu and +@@ -3747,8 +3747,9 @@ int perf_event__process_attr(struct perf_tool *tool __maybe_unused, + if (perf_evsel__alloc_id(&evsel->core, 1, n_ids)) + return -ENOMEM; + ++ ids = (void *)&event->attr.attr + event->attr.attr.size; + for (i = 0; i < n_ids; i++) { +- perf_evlist__id_add(&evlist->core, &evsel->core, 0, i, event->attr.id[i]); ++ perf_evlist__id_add(&evlist->core, &evsel->core, 0, i, ids[i]); + } + + return 0; +diff --git a/tools/testing/selftests/ftrace/ftracetest b/tools/testing/selftests/ftrace/ftracetest +index 19e9236dec5e2..f2e1b2bfcf0b0 100755 +--- a/tools/testing/selftests/ftrace/ftracetest ++++ b/tools/testing/selftests/ftrace/ftracetest +@@ -30,6 +30,9 @@ err_ret=1 + # kselftest skip code is 4 + err_skip=4 + ++# umount required ++UMOUNT_DIR="" ++ + # cgroup RT scheduling prevents chrt commands from succeeding, which + # induces failures in test wakeup tests. Disable for the duration of + # the tests. +@@ -44,6 +47,9 @@ setup() { + + cleanup() { + echo $sched_rt_runtime_orig > $sched_rt_runtime ++ if [ -n "${UMOUNT_DIR}" ]; then ++ umount ${UMOUNT_DIR} ||: ++ fi + } + + errexit() { # message +@@ -155,11 +161,13 @@ if [ -z "$TRACING_DIR" ]; then + mount -t tracefs nodev /sys/kernel/tracing || + errexit "Failed to mount /sys/kernel/tracing" + TRACING_DIR="/sys/kernel/tracing" ++ UMOUNT_DIR=${TRACING_DIR} + # If debugfs exists, then so does /sys/kernel/debug + elif [ -d "/sys/kernel/debug" ]; then + mount -t debugfs nodev /sys/kernel/debug || + errexit "Failed to mount /sys/kernel/debug" + TRACING_DIR="/sys/kernel/debug/tracing" ++ UMOUNT_DIR=${TRACING_DIR} + else + err_ret=$err_skip + errexit "debugfs and tracefs are not configured in this kernel" |