diff options
| author |   Mike Pagano <mpagano@gentoo.org> | 2022-04-15 09:10:10 -0400 |
|---|---|---|
| committer | Mike Pagano <mpagano@gentoo.org> | 2022-04-15 09:10:10 -0400 |
| commit | cb97245efd51c07afa458a50f037235d1e5ca23d (patch) | |
| tree | 4abe81e055ff62764242253c2da9b09b79e7b2b9 | |
| parent | Select AUTOFS_FS when GENTOO_LINUX_INIT_SYSTEMD selected (diff) | |
| download | linux-patches-cb97245efd51c07afa458a50f037235d1e5ca23d.tar.gz linux-patches-cb97245efd51c07afa458a50f037235d1e5ca23d.tar.bz2 linux-patches-cb97245efd51c07afa458a50f037235d1e5ca23d.zip | |
Linux patch 5.4.1895.4-193
Signed-off-by: Mike Pagano <mpagano@gentoo.org>
| -rw-r--r-- | 0000_README | 4 | ||||
| -rw-r--r-- | 1188_linux-5.4.189.patch | 14679 |
2 files changed, 14683 insertions, 0 deletions
diff --git a/0000_README b/0000_README index 0cc3f59a..516fc13c 100644 --- a/0000_README +++ b/0000_README @@ -795,6 +795,10 @@ Patch: 1187_linux-5.4.188.patch From: http://www.kernel.org Desc: Linux 5.4.188 +Patch: 1188_linux-5.4.189.patch +From: http://www.kernel.org +Desc: Linux 5.4.189 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1188_linux-5.4.189.patch b/1188_linux-5.4.189.patch new file mode 100644 index 00000000..fb36f2ce --- /dev/null +++ b/1188_linux-5.4.189.patch @@ -0,0 +1,14679 @@ +diff --git a/Documentation/DMA-attributes.txt b/Documentation/DMA-attributes.txt +index 8f8d97f65d737..7193505a98cab 100644 +--- a/Documentation/DMA-attributes.txt ++++ b/Documentation/DMA-attributes.txt +@@ -156,3 +156,13 @@ accesses to DMA buffers in both privileged "supervisor" and unprivileged + subsystem that the buffer is fully accessible at the elevated privilege + level (and ideally inaccessible or at least read-only at the + lesser-privileged levels). ++ ++DMA_ATTR_PRIVILEGED ++------------------- ++ ++Some advanced peripherals such as remote processors and GPUs perform ++accesses to DMA buffers in both privileged "supervisor" and unprivileged ++"user" modes. This attribute is used to indicate to the DMA-mapping ++subsystem that the buffer is fully accessible at the elevated privilege ++level (and ideally inaccessible or at least read-only at the ++lesser-privileged levels). +diff --git a/Documentation/devicetree/bindings/mtd/nand-controller.yaml b/Documentation/devicetree/bindings/mtd/nand-controller.yaml +index d261b7096c696..2767f182fd3c5 100644 +--- a/Documentation/devicetree/bindings/mtd/nand-controller.yaml ++++ b/Documentation/devicetree/bindings/mtd/nand-controller.yaml +@@ -44,7 +44,7 @@ patternProperties: + properties: + reg: + description: +- Contains the native Ready/Busy IDs. ++ Contains the chip-select IDs. + + nand-ecc-mode: + allOf: +@@ -139,6 +139,6 @@ examples: + nand-ecc-mode = "soft"; + nand-ecc-algo = "bch"; + +- /* controller specific properties */ ++ /* NAND chip specific properties */ + }; + }; +diff --git a/Documentation/devicetree/bindings/spi/spi-mxic.txt b/Documentation/devicetree/bindings/spi/spi-mxic.txt +index 529f2dab2648a..7bcbb229b78bb 100644 +--- a/Documentation/devicetree/bindings/spi/spi-mxic.txt ++++ b/Documentation/devicetree/bindings/spi/spi-mxic.txt +@@ -8,11 +8,13 @@ Required properties: + - reg: should contain 2 entries, one for the registers and one for the direct + mapping area + - reg-names: should contain "regs" and "dirmap" +-- interrupts: interrupt line connected to the SPI controller + - clock-names: should contain "ps_clk", "send_clk" and "send_dly_clk" + - clocks: should contain 3 entries for the "ps_clk", "send_clk" and + "send_dly_clk" clocks + ++Optional properties: ++- interrupts: interrupt line connected to the SPI controller ++ + Example: + + spi@43c30000 { +diff --git a/Documentation/process/stable-kernel-rules.rst b/Documentation/process/stable-kernel-rules.rst +index 06f743b612c48..bb53707f72cc5 100644 +--- a/Documentation/process/stable-kernel-rules.rst ++++ b/Documentation/process/stable-kernel-rules.rst +@@ -174,7 +174,16 @@ Trees + - The finalized and tagged releases of all stable kernels can be found + in separate branches per version at: + +- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git ++ https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git ++ ++ - The release candidate of all stable kernel versions can be found at: ++ ++ https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git/ ++ ++ .. warning:: ++ The -stable-rc tree is a snapshot in time of the stable-queue tree and ++ will change frequently, hence will be rebased often. It should only be ++ used for testing purposes (e.g. to be consumed by CI systems). + + + Review committee +diff --git a/Documentation/sound/hd-audio/models.rst b/Documentation/sound/hd-audio/models.rst +index 0ea967d345838..4c91abad7b35c 100644 +--- a/Documentation/sound/hd-audio/models.rst ++++ b/Documentation/sound/hd-audio/models.rst +@@ -261,6 +261,10 @@ alc-sense-combo + huawei-mbx-stereo + Enable initialization verbs for Huawei MBX stereo speakers; + might be risky, try this at your own risk ++alc298-samsung-headphone ++ Samsung laptops with ALC298 ++alc256-samsung-headphone ++ Samsung laptops with ALC256 + + ALC66x/67x/892 + ============== +diff --git a/Makefile b/Makefile +index 8684857148066..cbb71900d3dcf 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 5 + PATCHLEVEL = 4 +-SUBLEVEL = 188 ++SUBLEVEL = 189 + EXTRAVERSION = + NAME = Kleptomaniac Octopus + +diff --git a/arch/arm/boot/dts/bcm2837.dtsi b/arch/arm/boot/dts/bcm2837.dtsi +index beb6c502dadc7..bcad098a7fccb 100644 +--- a/arch/arm/boot/dts/bcm2837.dtsi ++++ b/arch/arm/boot/dts/bcm2837.dtsi +@@ -38,12 +38,26 @@ + #size-cells = <0>; + enable-method = "brcm,bcm2836-smp"; // for ARM 32-bit + ++ /* Source for d/i-cache-line-size and d/i-cache-sets ++ * https://developer.arm.com/documentation/ddi0500/e/level-1-memory-system ++ * /about-the-l1-memory-system?lang=en ++ * ++ * Source for d/i-cache-size ++ * https://magpi.raspberrypi.com/articles/raspberry-pi-3-specs-benchmarks ++ */ + cpu0: cpu@0 { + device_type = "cpu"; + compatible = "arm,cortex-a53"; + reg = <0>; + enable-method = "spin-table"; + cpu-release-addr = <0x0 0x000000d8>; ++ d-cache-size = <0x8000>; ++ d-cache-line-size = <64>; ++ d-cache-sets = <128>; // 32KiB(size)/64(line-size)=512ways/4-way set ++ i-cache-size = <0x8000>; ++ i-cache-line-size = <64>; ++ i-cache-sets = <256>; // 32KiB(size)/64(line-size)=512ways/2-way set ++ next-level-cache = <&l2>; + }; + + cpu1: cpu@1 { +@@ -52,6 +66,13 @@ + reg = <1>; + enable-method = "spin-table"; + cpu-release-addr = <0x0 0x000000e0>; ++ d-cache-size = <0x8000>; ++ d-cache-line-size = <64>; ++ d-cache-sets = <128>; // 32KiB(size)/64(line-size)=512ways/4-way set ++ i-cache-size = <0x8000>; ++ i-cache-line-size = <64>; ++ i-cache-sets = <256>; // 32KiB(size)/64(line-size)=512ways/2-way set ++ next-level-cache = <&l2>; + }; + + cpu2: cpu@2 { +@@ -60,6 +81,13 @@ + reg = <2>; + enable-method = "spin-table"; + cpu-release-addr = <0x0 0x000000e8>; ++ d-cache-size = <0x8000>; ++ d-cache-line-size = <64>; ++ d-cache-sets = <128>; // 32KiB(size)/64(line-size)=512ways/4-way set ++ i-cache-size = <0x8000>; ++ i-cache-line-size = <64>; ++ i-cache-sets = <256>; // 32KiB(size)/64(line-size)=512ways/2-way set ++ next-level-cache = <&l2>; + }; + + cpu3: cpu@3 { +@@ -68,6 +96,27 @@ + reg = <3>; + enable-method = "spin-table"; + cpu-release-addr = <0x0 0x000000f0>; ++ d-cache-size = <0x8000>; ++ d-cache-line-size = <64>; ++ d-cache-sets = <128>; // 32KiB(size)/64(line-size)=512ways/4-way set ++ i-cache-size = <0x8000>; ++ i-cache-line-size = <64>; ++ i-cache-sets = <256>; // 32KiB(size)/64(line-size)=512ways/2-way set ++ next-level-cache = <&l2>; ++ }; ++ ++ /* Source for cache-line-size + cache-sets ++ * https://developer.arm.com/documentation/ddi0500 ++ * /e/level-2-memory-system/about-the-l2-memory-system?lang=en ++ * Source for cache-size ++ * https://datasheets.raspberrypi.com/cm/cm1-and-cm3-datasheet.pdf ++ */ ++ l2: l2-cache0 { ++ compatible = "cache"; ++ cache-size = <0x80000>; ++ cache-line-size = <64>; ++ cache-sets = <512>; // 512KiB(size)/64(line-size)=8192ways/16-way set ++ cache-level = <2>; + }; + }; + }; +diff --git a/arch/arm/boot/dts/exynos5250-pinctrl.dtsi b/arch/arm/boot/dts/exynos5250-pinctrl.dtsi +index d31a68672bfac..d7d756614edd1 100644 +--- a/arch/arm/boot/dts/exynos5250-pinctrl.dtsi ++++ b/arch/arm/boot/dts/exynos5250-pinctrl.dtsi +@@ -260,7 +260,7 @@ + }; + + uart3_data: uart3-data { +- samsung,pins = "gpa1-4", "gpa1-4"; ++ samsung,pins = "gpa1-4", "gpa1-5"; + samsung,pin-function = <EXYNOS_PIN_FUNC_2>; + samsung,pin-pud = <EXYNOS_PIN_PULL_NONE>; + samsung,pin-drv = <EXYNOS4_PIN_DRV_LV1>; +diff --git a/arch/arm/boot/dts/exynos5250-smdk5250.dts b/arch/arm/boot/dts/exynos5250-smdk5250.dts +index 70a2b6e2ad3fa..fa5dd992e3273 100644 +--- a/arch/arm/boot/dts/exynos5250-smdk5250.dts ++++ b/arch/arm/boot/dts/exynos5250-smdk5250.dts +@@ -117,6 +117,9 @@ + status = "okay"; + ddc = <&i2c_2>; + hpd-gpios = <&gpx3 7 GPIO_ACTIVE_HIGH>; ++ vdd-supply = <&ldo8_reg>; ++ vdd_osc-supply = <&ldo10_reg>; ++ vdd_pll-supply = <&ldo8_reg>; + }; + + &i2c_0 { +diff --git a/arch/arm/boot/dts/exynos5420-smdk5420.dts b/arch/arm/boot/dts/exynos5420-smdk5420.dts +index 8240e51869729..fb92d87d8dedc 100644 +--- a/arch/arm/boot/dts/exynos5420-smdk5420.dts ++++ b/arch/arm/boot/dts/exynos5420-smdk5420.dts +@@ -132,6 +132,9 @@ + hpd-gpios = <&gpx3 7 GPIO_ACTIVE_HIGH>; + pinctrl-names = "default"; + pinctrl-0 = <&hdmi_hpd_irq>; ++ vdd-supply = <&ldo6_reg>; ++ vdd_osc-supply = <&ldo7_reg>; ++ vdd_pll-supply = <&ldo6_reg>; + }; + + &hsi2c_4 { +diff --git a/arch/arm/boot/dts/imx53-m53menlo.dts b/arch/arm/boot/dts/imx53-m53menlo.dts +index 03c43c1912a7e..d002c8f738b53 100644 +--- a/arch/arm/boot/dts/imx53-m53menlo.dts ++++ b/arch/arm/boot/dts/imx53-m53menlo.dts +@@ -53,6 +53,31 @@ + }; + }; + ++ lvds-decoder { ++ compatible = "ti,ds90cf364a", "lvds-decoder"; ++ ++ ports { ++ #address-cells = <1>; ++ #size-cells = <0>; ++ ++ port@0 { ++ reg = <0>; ++ ++ lvds_decoder_in: endpoint { ++ remote-endpoint = <&lvds0_out>; ++ }; ++ }; ++ ++ port@1 { ++ reg = <1>; ++ ++ lvds_decoder_out: endpoint { ++ remote-endpoint = <&panel_in>; ++ }; ++ }; ++ }; ++ }; ++ + panel { + compatible = "edt,etm0700g0dh6"; + pinctrl-0 = <&pinctrl_display_gpio>; +@@ -61,7 +86,7 @@ + + port { + panel_in: endpoint { +- remote-endpoint = <&lvds0_out>; ++ remote-endpoint = <&lvds_decoder_out>; + }; + }; + }; +@@ -450,7 +475,7 @@ + reg = <2>; + + lvds0_out: endpoint { +- remote-endpoint = <&panel_in>; ++ remote-endpoint = <&lvds_decoder_in>; + }; + }; + }; +diff --git a/arch/arm/boot/dts/qcom-ipq4019.dtsi b/arch/arm/boot/dts/qcom-ipq4019.dtsi +index 56f51599852d0..338256c59ca5a 100644 +--- a/arch/arm/boot/dts/qcom-ipq4019.dtsi ++++ b/arch/arm/boot/dts/qcom-ipq4019.dtsi +@@ -141,7 +141,8 @@ + clocks { + sleep_clk: sleep_clk { + compatible = "fixed-clock"; +- clock-frequency = <32768>; ++ clock-frequency = <32000>; ++ clock-output-names = "gcc_sleep_clk_src"; + #clock-cells = <0>; + }; + +diff --git a/arch/arm/boot/dts/qcom-msm8960.dtsi b/arch/arm/boot/dts/qcom-msm8960.dtsi +index f2aeaccdc1ad6..15ff0e8fd0d30 100644 +--- a/arch/arm/boot/dts/qcom-msm8960.dtsi ++++ b/arch/arm/boot/dts/qcom-msm8960.dtsi +@@ -145,7 +145,9 @@ + reg = <0x108000 0x1000>; + qcom,ipc = <&l2cc 0x8 2>; + +- interrupts = <0 19 0>, <0 21 0>, <0 22 0>; ++ interrupts = <GIC_SPI 19 IRQ_TYPE_EDGE_RISING>, ++ <GIC_SPI 21 IRQ_TYPE_EDGE_RISING>, ++ <GIC_SPI 22 IRQ_TYPE_EDGE_RISING>; + interrupt-names = "ack", "err", "wakeup"; + + regulators { +@@ -191,7 +193,7 @@ + compatible = "qcom,msm-uartdm-v1.3", "qcom,msm-uartdm"; + reg = <0x16440000 0x1000>, + <0x16400000 0x1000>; +- interrupts = <0 154 0x0>; ++ interrupts = <GIC_SPI 154 IRQ_TYPE_LEVEL_HIGH>; + clocks = <&gcc GSBI5_UART_CLK>, <&gcc GSBI5_H_CLK>; + clock-names = "core", "iface"; + status = "disabled"; +@@ -317,7 +319,7 @@ + #address-cells = <1>; + #size-cells = <0>; + reg = <0x16080000 0x1000>; +- interrupts = <0 147 0>; ++ interrupts = <GIC_SPI 147 IRQ_TYPE_LEVEL_HIGH>; + spi-max-frequency = <24000000>; + cs-gpios = <&msmgpio 8 0>; + +diff --git a/arch/arm/boot/dts/sama5d2.dtsi b/arch/arm/boot/dts/sama5d2.dtsi +index b05bab57f90a3..09816a2ee3670 100644 +--- a/arch/arm/boot/dts/sama5d2.dtsi ++++ b/arch/arm/boot/dts/sama5d2.dtsi +@@ -526,7 +526,7 @@ + pmecc: ecc-engine@f8014070 { + compatible = "atmel,sama5d2-pmecc"; + reg = <0xf8014070 0x490>, +- <0xf8014500 0x100>; ++ <0xf8014500 0x200>; + }; + }; + +diff --git a/arch/arm/boot/dts/spear1340.dtsi b/arch/arm/boot/dts/spear1340.dtsi +index 1a8f5e8b10e3a..66cd473ecb617 100644 +--- a/arch/arm/boot/dts/spear1340.dtsi ++++ b/arch/arm/boot/dts/spear1340.dtsi +@@ -136,9 +136,9 @@ + reg = <0xb4100000 0x1000>; + interrupts = <0 105 0x4>; + status = "disabled"; +- dmas = <&dwdma0 12 0 1>, +- <&dwdma0 13 1 0>; +- dma-names = "tx", "rx"; ++ dmas = <&dwdma0 13 0 1>, ++ <&dwdma0 12 1 0>; ++ dma-names = "rx", "tx"; + }; + + thermal@e07008c4 { +diff --git a/arch/arm/boot/dts/spear13xx.dtsi b/arch/arm/boot/dts/spear13xx.dtsi +index f187da4485f46..78672db9068be 100644 +--- a/arch/arm/boot/dts/spear13xx.dtsi ++++ b/arch/arm/boot/dts/spear13xx.dtsi +@@ -284,9 +284,9 @@ + #size-cells = <0>; + interrupts = <0 31 0x4>; + status = "disabled"; +- dmas = <&dwdma0 4 0 0>, +- <&dwdma0 5 0 0>; +- dma-names = "tx", "rx"; ++ dmas = <&dwdma0 5 0 0>, ++ <&dwdma0 4 0 0>; ++ dma-names = "rx", "tx"; + }; + + rtc@e0580000 { +diff --git a/arch/arm/boot/dts/tegra20-tamonten.dtsi b/arch/arm/boot/dts/tegra20-tamonten.dtsi +index 394a6b4dc69d5..69cb65d86c467 100644 +--- a/arch/arm/boot/dts/tegra20-tamonten.dtsi ++++ b/arch/arm/boot/dts/tegra20-tamonten.dtsi +@@ -183,8 +183,8 @@ + }; + conf_ata { + nvidia,pins = "ata", "atb", "atc", "atd", "ate", +- "cdev1", "cdev2", "dap1", "dtb", "gma", +- "gmb", "gmc", "gmd", "gme", "gpu7", ++ "cdev1", "cdev2", "dap1", "dtb", "dtf", ++ "gma", "gmb", "gmc", "gmd", "gme", "gpu7", + "gpv", "i2cp", "irrx", "irtx", "pta", + "rm", "slxa", "slxk", "spia", "spib", + "uac"; +@@ -203,7 +203,7 @@ + }; + conf_crtp { + nvidia,pins = "crtp", "dap2", "dap3", "dap4", +- "dtc", "dte", "dtf", "gpu", "sdio1", ++ "dtc", "dte", "gpu", "sdio1", + "slxc", "slxd", "spdi", "spdo", "spig", + "uda"; + nvidia,pull = <TEGRA_PIN_PULL_NONE>; +diff --git a/arch/arm/mach-iop32x/include/mach/entry-macro.S b/arch/arm/mach-iop32x/include/mach/entry-macro.S +index 8e6766d4621eb..341e5d9a6616d 100644 +--- a/arch/arm/mach-iop32x/include/mach/entry-macro.S ++++ b/arch/arm/mach-iop32x/include/mach/entry-macro.S +@@ -20,7 +20,7 @@ + mrc p6, 0, \irqstat, c8, c0, 0 @ Read IINTSRC + cmp \irqstat, #0 + clzne \irqnr, \irqstat +- rsbne \irqnr, \irqnr, #31 ++ rsbne \irqnr, \irqnr, #32 + .endm + + .macro arch_ret_to_user, tmp1, tmp2 +diff --git a/arch/arm/mach-iop32x/include/mach/irqs.h b/arch/arm/mach-iop32x/include/mach/irqs.h +index c4e78df428e86..e09ae5f48aec5 100644 +--- a/arch/arm/mach-iop32x/include/mach/irqs.h ++++ b/arch/arm/mach-iop32x/include/mach/irqs.h +@@ -9,6 +9,6 @@ + #ifndef __IRQS_H + #define __IRQS_H + +-#define NR_IRQS 32 ++#define NR_IRQS 33 + + #endif +diff --git a/arch/arm/mach-iop32x/irq.c b/arch/arm/mach-iop32x/irq.c +index 2d48bf1398c10..d1e8824cbd824 100644 +--- a/arch/arm/mach-iop32x/irq.c ++++ b/arch/arm/mach-iop32x/irq.c +@@ -32,14 +32,14 @@ static void intstr_write(u32 val) + static void + iop32x_irq_mask(struct irq_data *d) + { +- iop32x_mask &= ~(1 << d->irq); ++ iop32x_mask &= ~(1 << (d->irq - 1)); + intctl_write(iop32x_mask); + } + + static void + iop32x_irq_unmask(struct irq_data *d) + { +- iop32x_mask |= 1 << d->irq; ++ iop32x_mask |= 1 << (d->irq - 1); + intctl_write(iop32x_mask); + } + +@@ -65,7 +65,7 @@ void __init iop32x_init_irq(void) + machine_is_em7210()) + *IOP3XX_PCIIRSR = 0x0f; + +- for (i = 0; i < NR_IRQS; i++) { ++ for (i = 1; i < NR_IRQS; i++) { + irq_set_chip_and_handler(i, &ext_chip, handle_level_irq); + irq_clear_status_flags(i, IRQ_NOREQUEST | IRQ_NOPROBE); + } +diff --git a/arch/arm/mach-iop32x/irqs.h b/arch/arm/mach-iop32x/irqs.h +index 69858e4e905d1..e1dfc8b4e7d7e 100644 +--- a/arch/arm/mach-iop32x/irqs.h ++++ b/arch/arm/mach-iop32x/irqs.h +@@ -7,36 +7,40 @@ + #ifndef __IOP32X_IRQS_H + #define __IOP32X_IRQS_H + ++/* Interrupts in Linux start at 1, hardware starts at 0 */ ++ ++#define IOP_IRQ(x) ((x) + 1) ++ + /* + * IOP80321 chipset interrupts + */ +-#define IRQ_IOP32X_DMA0_EOT 0 +-#define IRQ_IOP32X_DMA0_EOC 1 +-#define IRQ_IOP32X_DMA1_EOT 2 +-#define IRQ_IOP32X_DMA1_EOC 3 +-#define IRQ_IOP32X_AA_EOT 6 +-#define IRQ_IOP32X_AA_EOC 7 +-#define IRQ_IOP32X_CORE_PMON 8 +-#define IRQ_IOP32X_TIMER0 9 +-#define IRQ_IOP32X_TIMER1 10 +-#define IRQ_IOP32X_I2C_0 11 +-#define IRQ_IOP32X_I2C_1 12 +-#define IRQ_IOP32X_MESSAGING 13 +-#define IRQ_IOP32X_ATU_BIST 14 +-#define IRQ_IOP32X_PERFMON 15 +-#define IRQ_IOP32X_CORE_PMU 16 +-#define IRQ_IOP32X_BIU_ERR 17 +-#define IRQ_IOP32X_ATU_ERR 18 +-#define IRQ_IOP32X_MCU_ERR 19 +-#define IRQ_IOP32X_DMA0_ERR 20 +-#define IRQ_IOP32X_DMA1_ERR 21 +-#define IRQ_IOP32X_AA_ERR 23 +-#define IRQ_IOP32X_MSG_ERR 24 +-#define IRQ_IOP32X_SSP 25 +-#define IRQ_IOP32X_XINT0 27 +-#define IRQ_IOP32X_XINT1 28 +-#define IRQ_IOP32X_XINT2 29 +-#define IRQ_IOP32X_XINT3 30 +-#define IRQ_IOP32X_HPI 31 ++#define IRQ_IOP32X_DMA0_EOT IOP_IRQ(0) ++#define IRQ_IOP32X_DMA0_EOC IOP_IRQ(1) ++#define IRQ_IOP32X_DMA1_EOT IOP_IRQ(2) ++#define IRQ_IOP32X_DMA1_EOC IOP_IRQ(3) ++#define IRQ_IOP32X_AA_EOT IOP_IRQ(6) ++#define IRQ_IOP32X_AA_EOC IOP_IRQ(7) ++#define IRQ_IOP32X_CORE_PMON IOP_IRQ(8) ++#define IRQ_IOP32X_TIMER0 IOP_IRQ(9) ++#define IRQ_IOP32X_TIMER1 IOP_IRQ(10) ++#define IRQ_IOP32X_I2C_0 IOP_IRQ(11) ++#define IRQ_IOP32X_I2C_1 IOP_IRQ(12) ++#define IRQ_IOP32X_MESSAGING IOP_IRQ(13) ++#define IRQ_IOP32X_ATU_BIST IOP_IRQ(14) ++#define IRQ_IOP32X_PERFMON IOP_IRQ(15) ++#define IRQ_IOP32X_CORE_PMU IOP_IRQ(16) ++#define IRQ_IOP32X_BIU_ERR IOP_IRQ(17) ++#define IRQ_IOP32X_ATU_ERR IOP_IRQ(18) ++#define IRQ_IOP32X_MCU_ERR IOP_IRQ(19) ++#define IRQ_IOP32X_DMA0_ERR IOP_IRQ(20) ++#define IRQ_IOP32X_DMA1_ERR IOP_IRQ(21) ++#define IRQ_IOP32X_AA_ERR IOP_IRQ(23) ++#define IRQ_IOP32X_MSG_ERR IOP_IRQ(24) ++#define IRQ_IOP32X_SSP IOP_IRQ(25) ++#define IRQ_IOP32X_XINT0 IOP_IRQ(27) ++#define IRQ_IOP32X_XINT1 IOP_IRQ(28) ++#define IRQ_IOP32X_XINT2 IOP_IRQ(29) ++#define IRQ_IOP32X_XINT3 IOP_IRQ(30) ++#define IRQ_IOP32X_HPI IOP_IRQ(31) + + #endif +diff --git a/arch/arm/mach-mmp/sram.c b/arch/arm/mach-mmp/sram.c +index 6794e2db1ad5f..ecc46c31004f6 100644 +--- a/arch/arm/mach-mmp/sram.c ++++ b/arch/arm/mach-mmp/sram.c +@@ -72,6 +72,8 @@ static int sram_probe(struct platform_device *pdev) + if (!info) + return -ENOMEM; + ++ platform_set_drvdata(pdev, info); ++ + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); + if (res == NULL) { + dev_err(&pdev->dev, "no memory resource defined\n"); +@@ -107,8 +109,6 @@ static int sram_probe(struct platform_device *pdev) + list_add(&info->node, &sram_bank_list); + mutex_unlock(&sram_lock); + +- platform_set_drvdata(pdev, info); +- + dev_info(&pdev->dev, "initialized\n"); + return 0; + +@@ -127,17 +127,19 @@ static int sram_remove(struct platform_device *pdev) + struct sram_bank_info *info; + + info = platform_get_drvdata(pdev); +- if (info == NULL) +- return -ENODEV; + +- mutex_lock(&sram_lock); +- list_del(&info->node); +- mutex_unlock(&sram_lock); ++ if (info->sram_size) { ++ mutex_lock(&sram_lock); ++ list_del(&info->node); ++ mutex_unlock(&sram_lock); ++ ++ gen_pool_destroy(info->gpool); ++ iounmap(info->sram_virt); ++ kfree(info->pool_name); ++ } + +- gen_pool_destroy(info->gpool); +- iounmap(info->sram_virt); +- kfree(info->pool_name); + kfree(info); ++ + return 0; + } + +diff --git a/arch/arm/mach-s3c24xx/mach-jive.c b/arch/arm/mach-s3c24xx/mach-jive.c +index 885e8f12e4b91..eedc9f8ed2109 100644 +--- a/arch/arm/mach-s3c24xx/mach-jive.c ++++ b/arch/arm/mach-s3c24xx/mach-jive.c +@@ -237,11 +237,11 @@ static int __init jive_mtdset(char *options) + unsigned long set; + + if (options == NULL || options[0] == '\0') +- return 0; ++ return 1; + + if (kstrtoul(options, 10, &set)) { + printk(KERN_ERR "failed to parse mtdset=%s\n", options); +- return 0; ++ return 1; + } + + switch (set) { +@@ -256,7 +256,7 @@ static int __init jive_mtdset(char *options) + "using default.", set); + } + +- return 0; ++ return 1; + } + + /* parse the mtdset= option given to the kernel command line */ +diff --git a/arch/arm64/boot/dts/broadcom/northstar2/ns2-svk.dts b/arch/arm64/boot/dts/broadcom/northstar2/ns2-svk.dts +index ec19fbf928a14..12a4b1c03390c 100644 +--- a/arch/arm64/boot/dts/broadcom/northstar2/ns2-svk.dts ++++ b/arch/arm64/boot/dts/broadcom/northstar2/ns2-svk.dts +@@ -111,8 +111,8 @@ + compatible = "silabs,si3226x"; + reg = <0>; + spi-max-frequency = <5000000>; +- spi-cpha = <1>; +- spi-cpol = <1>; ++ spi-cpha; ++ spi-cpol; + pl022,hierarchy = <0>; + pl022,interface = <0>; + pl022,slave-tx-disable = <0>; +@@ -135,8 +135,8 @@ + at25,byte-len = <0x8000>; + at25,addr-mode = <2>; + at25,page-size = <64>; +- spi-cpha = <1>; +- spi-cpol = <1>; ++ spi-cpha; ++ spi-cpol; + pl022,hierarchy = <0>; + pl022,interface = <0>; + pl022,slave-tx-disable = <0>; +diff --git a/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi b/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi +index 39802066232e1..edc1a8a4c4bc0 100644 +--- a/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi ++++ b/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi +@@ -687,7 +687,7 @@ + }; + }; + +- sata: ahci@663f2000 { ++ sata: sata@663f2000 { + compatible = "brcm,iproc-ahci", "generic-ahci"; + reg = <0x663f2000 0x1000>; + dma-coherent; +diff --git a/arch/arm64/boot/dts/qcom/sm8150.dtsi b/arch/arm64/boot/dts/qcom/sm8150.dtsi +index 9573da378826b..1954cef8c6f0b 100644 +--- a/arch/arm64/boot/dts/qcom/sm8150.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8150.dtsi +@@ -459,9 +459,9 @@ + qcom,tcs-offset = <0xd00>; + qcom,drv-id = <2>; + qcom,tcs-config = <ACTIVE_TCS 2>, +- <SLEEP_TCS 1>, +- <WAKE_TCS 1>, +- <CONTROL_TCS 0>; ++ <SLEEP_TCS 3>, ++ <WAKE_TCS 3>, ++ <CONTROL_TCS 1>; + + rpmhcc: clock-controller { + compatible = "qcom,sm8150-rpmh-clk"; +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-firefly.dts b/arch/arm64/boot/dts/rockchip/rk3399-firefly.dts +index 76f5db696009b..5b7e8fbf1ffec 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-firefly.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3399-firefly.dts +@@ -666,8 +666,8 @@ + sd-uhs-sdr104; + + /* Power supply */ +- vqmmc-supply = &vcc1v8_s3; /* IO line */ +- vmmc-supply = &vcc_sdio; /* card's power */ ++ vqmmc-supply = <&vcc1v8_s3>; /* IO line */ ++ vmmc-supply = <&vcc_sdio>; /* card's power */ + + #address-cells = <1>; + #size-cells = <0>; +diff --git a/arch/arm64/include/asm/kvm_mmu.h b/arch/arm64/include/asm/kvm_mmu.h +index 78d110667c0c7..ffe0aad96b17b 100644 +--- a/arch/arm64/include/asm/kvm_mmu.h ++++ b/arch/arm64/include/asm/kvm_mmu.h +@@ -479,7 +479,8 @@ static inline void *kvm_get_hyp_vector(void) + int slot = -1; + + if ((cpus_have_const_cap(ARM64_HARDEN_BRANCH_PREDICTOR) || +- cpus_have_const_cap(ARM64_SPECTRE_BHB)) && data->template_start) { ++ cpus_have_const_cap(ARM64_SPECTRE_BHB)) && ++ data && data->template_start) { + vect = kern_hyp_va(kvm_ksym_ref(__bp_harden_hyp_vecs_start)); + slot = data->hyp_vectors_slot; + } +diff --git a/arch/arm64/kernel/cpuidle.c b/arch/arm64/kernel/cpuidle.c +index e4d6af2fdec71..5397f0d9e5bbb 100644 +--- a/arch/arm64/kernel/cpuidle.c ++++ b/arch/arm64/kernel/cpuidle.c +@@ -53,6 +53,9 @@ static int psci_acpi_cpu_init_idle(unsigned int cpu) + struct acpi_lpi_state *lpi; + struct acpi_processor *pr = per_cpu(processors, cpu); + ++ if (unlikely(!pr || !pr->flags.has_lpi)) ++ return -EINVAL; ++ + /* + * If the PSCI cpu_suspend function hook has not been initialized + * idle states must not be enabled, so bail out +@@ -60,9 +63,6 @@ static int psci_acpi_cpu_init_idle(unsigned int cpu) + if (!psci_ops.cpu_suspend) + return -EOPNOTSUPP; + +- if (unlikely(!pr || !pr->flags.has_lpi)) +- return -EINVAL; +- + count = pr->power.count - 1; + if (count <= 0) + return -ENODEV; +diff --git a/arch/arm64/kernel/insn.c b/arch/arm64/kernel/insn.c +index 53bcf5386907f..a02c294a47530 100644 +--- a/arch/arm64/kernel/insn.c ++++ b/arch/arm64/kernel/insn.c +@@ -207,8 +207,8 @@ static int __kprobes aarch64_insn_patch_text_cb(void *arg) + int i, ret = 0; + struct aarch64_insn_patch *pp = arg; + +- /* The first CPU becomes master */ +- if (atomic_inc_return(&pp->cpu_count) == 1) { ++ /* The last CPU becomes master */ ++ if (atomic_inc_return(&pp->cpu_count) == num_online_cpus()) { + for (i = 0; ret == 0 && i < pp->insn_cnt; i++) + ret = aarch64_insn_patch_text_nosync(pp->text_addrs[i], + pp->new_insns[i]); +diff --git a/arch/arm64/kernel/module.lds b/arch/arm64/kernel/module.lds +index 09a0eef71d12b..9371abe2f4c2d 100644 +--- a/arch/arm64/kernel/module.lds ++++ b/arch/arm64/kernel/module.lds +@@ -1,5 +1,5 @@ + SECTIONS { +- .plt 0 (NOLOAD) : { BYTE(0) } +- .init.plt 0 (NOLOAD) : { BYTE(0) } +- .text.ftrace_trampoline 0 (NOLOAD) : { BYTE(0) } ++ .plt 0 : { BYTE(0) } ++ .init.plt 0 : { BYTE(0) } ++ .text.ftrace_trampoline 0 : { BYTE(0) } + } +diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c +index a343677837c77..17a8d1484f9b9 100644 +--- a/arch/arm64/net/bpf_jit_comp.c ++++ b/arch/arm64/net/bpf_jit_comp.c +@@ -909,15 +909,18 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) + goto out_off; + } + +- /* 1. Initial fake pass to compute ctx->idx. */ +- +- /* Fake pass to fill in ctx->offset. */ +- if (build_body(&ctx, extra_pass)) { ++ /* ++ * 1. Initial fake pass to compute ctx->idx and ctx->offset. ++ * ++ * BPF line info needs ctx->offset[i] to be the offset of ++ * instruction[i] in jited image, so build prologue first. ++ */ ++ if (build_prologue(&ctx, was_classic)) { + prog = orig_prog; + goto out_off; + } + +- if (build_prologue(&ctx, was_classic)) { ++ if (build_body(&ctx, extra_pass)) { + prog = orig_prog; + goto out_off; + } +@@ -983,6 +986,11 @@ skip_init_ctx: + prog->jited_len = image_size; + + if (!prog->is_func || extra_pass) { ++ int i; ++ ++ /* offset[prog->len] is the size of program */ ++ for (i = 0; i <= prog->len; i++) ++ ctx.offset[i] *= AARCH64_INSN_SIZE; + bpf_prog_fill_jited_linfo(prog, ctx.offset + 1); + out_off: + kfree(ctx.offset); +diff --git a/arch/microblaze/include/asm/uaccess.h b/arch/microblaze/include/asm/uaccess.h +index a1f206b90753a..c8cd66c8d2577 100644 +--- a/arch/microblaze/include/asm/uaccess.h ++++ b/arch/microblaze/include/asm/uaccess.h +@@ -171,27 +171,27 @@ extern long __user_bad(void); + + #define __get_user(x, ptr) \ + ({ \ +- unsigned long __gu_val = 0; \ + long __gu_err; \ + switch (sizeof(*(ptr))) { \ + case 1: \ +- __get_user_asm("lbu", (ptr), __gu_val, __gu_err); \ ++ __get_user_asm("lbu", (ptr), x, __gu_err); \ + break; \ + case 2: \ +- __get_user_asm("lhu", (ptr), __gu_val, __gu_err); \ ++ __get_user_asm("lhu", (ptr), x, __gu_err); \ + break; \ + case 4: \ +- __get_user_asm("lw", (ptr), __gu_val, __gu_err); \ ++ __get_user_asm("lw", (ptr), x, __gu_err); \ + break; \ +- case 8: \ +- __gu_err = __copy_from_user(&__gu_val, ptr, 8); \ +- if (__gu_err) \ +- __gu_err = -EFAULT; \ ++ case 8: { \ ++ __u64 __x = 0; \ ++ __gu_err = raw_copy_from_user(&__x, ptr, 8) ? \ ++ -EFAULT : 0; \ ++ (x) = (typeof(x))(typeof((x) - (x)))__x; \ + break; \ ++ } \ + default: \ + /* __gu_val = 0; __gu_err = -EINVAL;*/ __gu_err = __user_bad();\ + } \ +- x = (__force __typeof__(*(ptr))) __gu_val; \ + __gu_err; \ + }) + +diff --git a/arch/mips/dec/int-handler.S b/arch/mips/dec/int-handler.S +index a25ef822e7250..5ed38e6180190 100644 +--- a/arch/mips/dec/int-handler.S ++++ b/arch/mips/dec/int-handler.S +@@ -131,7 +131,7 @@ + */ + mfc0 t0,CP0_CAUSE # get pending interrupts + mfc0 t1,CP0_STATUS +-#ifdef CONFIG_32BIT ++#if defined(CONFIG_32BIT) && defined(CONFIG_MIPS_FP_SUPPORT) + lw t2,cpu_fpu_mask + #endif + andi t0,ST0_IM # CAUSE.CE may be non-zero! +@@ -139,7 +139,7 @@ + + beqz t0,spurious + +-#ifdef CONFIG_32BIT ++#if defined(CONFIG_32BIT) && defined(CONFIG_MIPS_FP_SUPPORT) + and t2,t0 + bnez t2,fpu # handle FPU immediately + #endif +@@ -280,7 +280,7 @@ handle_it: + j dec_irq_dispatch + nop + +-#ifdef CONFIG_32BIT ++#if defined(CONFIG_32BIT) && defined(CONFIG_MIPS_FP_SUPPORT) + fpu: + lw t0,fpu_kstat_irq + nop +diff --git a/arch/mips/dec/prom/Makefile b/arch/mips/dec/prom/Makefile +index d95016016b42b..2bad87551203b 100644 +--- a/arch/mips/dec/prom/Makefile ++++ b/arch/mips/dec/prom/Makefile +@@ -6,4 +6,4 @@ + + lib-y += init.o memory.o cmdline.o identify.o console.o + +-lib-$(CONFIG_32BIT) += locore.o ++lib-$(CONFIG_CPU_R3000) += locore.o +diff --git a/arch/mips/dec/setup.c b/arch/mips/dec/setup.c +index 1fc8dffa8d1d0..649b50ae5b1e3 100644 +--- a/arch/mips/dec/setup.c ++++ b/arch/mips/dec/setup.c +@@ -766,7 +766,8 @@ void __init arch_init_irq(void) + dec_interrupt[DEC_IRQ_HALT] = -1; + + /* Register board interrupts: FPU and cascade. */ +- if (dec_interrupt[DEC_IRQ_FPU] >= 0 && cpu_has_fpu) { ++ if (IS_ENABLED(CONFIG_MIPS_FP_SUPPORT) && ++ dec_interrupt[DEC_IRQ_FPU] >= 0 && cpu_has_fpu) { + struct irq_desc *desc_fpu; + int irq_fpu; + +diff --git a/arch/mips/include/asm/dec/prom.h b/arch/mips/include/asm/dec/prom.h +index 62c7dfb90e06c..1e1247add1cf8 100644 +--- a/arch/mips/include/asm/dec/prom.h ++++ b/arch/mips/include/asm/dec/prom.h +@@ -43,16 +43,11 @@ + */ + #define REX_PROM_MAGIC 0x30464354 + +-#ifdef CONFIG_64BIT +- +-#define prom_is_rex(magic) 1 /* KN04 and KN05 are REX PROMs. */ +- +-#else /* !CONFIG_64BIT */ +- +-#define prom_is_rex(magic) ((magic) == REX_PROM_MAGIC) +- +-#endif /* !CONFIG_64BIT */ +- ++/* KN04 and KN05 are REX PROMs, so only do the check for R3k systems. */ ++static inline bool prom_is_rex(u32 magic) ++{ ++ return !IS_ENABLED(CONFIG_CPU_R3000) || magic == REX_PROM_MAGIC; ++} + + /* + * 3MIN/MAXINE PROM entry points for DS5000/1xx's, DS5000/xx's and +diff --git a/arch/mips/include/asm/setup.h b/arch/mips/include/asm/setup.h +index bb36a400203df..8c56b862fd9c2 100644 +--- a/arch/mips/include/asm/setup.h ++++ b/arch/mips/include/asm/setup.h +@@ -16,7 +16,7 @@ static inline void setup_8250_early_printk_port(unsigned long base, + unsigned int reg_shift, unsigned int timeout) {} + #endif + +-extern void set_handler(unsigned long offset, void *addr, unsigned long len); ++void set_handler(unsigned long offset, const void *addr, unsigned long len); + extern void set_uncached_handler(unsigned long offset, void *addr, unsigned long len); + + typedef void (*vi_handler_t)(void); +diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c +index 8282d0feb0b21..749089c25d5e6 100644 +--- a/arch/mips/kernel/traps.c ++++ b/arch/mips/kernel/traps.c +@@ -2020,19 +2020,19 @@ static void *set_vi_srs_handler(int n, vi_handler_t addr, int srs) + * If no shadow set is selected then use the default handler + * that does normal register saving and standard interrupt exit + */ +- extern char except_vec_vi, except_vec_vi_lui; +- extern char except_vec_vi_ori, except_vec_vi_end; +- extern char rollback_except_vec_vi; +- char *vec_start = using_rollback_handler() ? +- &rollback_except_vec_vi : &except_vec_vi; ++ extern const u8 except_vec_vi[], except_vec_vi_lui[]; ++ extern const u8 except_vec_vi_ori[], except_vec_vi_end[]; ++ extern const u8 rollback_except_vec_vi[]; ++ const u8 *vec_start = using_rollback_handler() ? ++ rollback_except_vec_vi : except_vec_vi; + #if defined(CONFIG_CPU_MICROMIPS) || defined(CONFIG_CPU_BIG_ENDIAN) +- const int lui_offset = &except_vec_vi_lui - vec_start + 2; +- const int ori_offset = &except_vec_vi_ori - vec_start + 2; ++ const int lui_offset = except_vec_vi_lui - vec_start + 2; ++ const int ori_offset = except_vec_vi_ori - vec_start + 2; + #else +- const int lui_offset = &except_vec_vi_lui - vec_start; +- const int ori_offset = &except_vec_vi_ori - vec_start; ++ const int lui_offset = except_vec_vi_lui - vec_start; ++ const int ori_offset = except_vec_vi_ori - vec_start; + #endif +- const int handler_len = &except_vec_vi_end - vec_start; ++ const int handler_len = except_vec_vi_end - vec_start; + + if (handler_len > VECTORSPACING) { + /* +@@ -2240,7 +2240,7 @@ void per_cpu_trap_init(bool is_boot_cpu) + } + + /* Install CPU exception handler */ +-void set_handler(unsigned long offset, void *addr, unsigned long size) ++void set_handler(unsigned long offset, const void *addr, unsigned long size) + { + #ifdef CONFIG_CPU_MICROMIPS + memcpy((void *)(ebase + offset), ((unsigned char *)addr - 1), size); +diff --git a/arch/mips/ralink/ill_acc.c b/arch/mips/ralink/ill_acc.c +index 0ddeb31afa93a..45ca2b84f0962 100644 +--- a/arch/mips/ralink/ill_acc.c ++++ b/arch/mips/ralink/ill_acc.c +@@ -61,6 +61,7 @@ static int __init ill_acc_of_setup(void) + pdev = of_find_device_by_node(np); + if (!pdev) { + pr_err("%pOFn: failed to lookup pdev\n", np); ++ of_node_put(np); + return -EINVAL; + } + +diff --git a/arch/mips/rb532/devices.c b/arch/mips/rb532/devices.c +index c9ecf17f86605..74808619fefeb 100644 +--- a/arch/mips/rb532/devices.c ++++ b/arch/mips/rb532/devices.c +@@ -310,11 +310,9 @@ static int __init plat_setup_devices(void) + static int __init setup_kmac(char *s) + { + printk(KERN_INFO "korina mac = %s\n", s); +- if (!mac_pton(s, korina_dev0_data.mac)) { ++ if (!mac_pton(s, korina_dev0_data.mac)) + printk(KERN_ERR "Invalid mac\n"); +- return -EINVAL; +- } +- return 0; ++ return 1; + } + + __setup("kmac=", setup_kmac); +diff --git a/arch/nios2/include/asm/uaccess.h b/arch/nios2/include/asm/uaccess.h +index e83f831a76f93..6be5e913c42e4 100644 +--- a/arch/nios2/include/asm/uaccess.h ++++ b/arch/nios2/include/asm/uaccess.h +@@ -89,6 +89,7 @@ extern __must_check long strnlen_user(const char __user *s, long n); + /* Optimized macros */ + #define __get_user_asm(val, insn, addr, err) \ + { \ ++ unsigned long __gu_val; \ + __asm__ __volatile__( \ + " movi %0, %3\n" \ + "1: " insn " %1, 0(%2)\n" \ +@@ -97,14 +98,20 @@ extern __must_check long strnlen_user(const char __user *s, long n); + " .section __ex_table,\"a\"\n" \ + " .word 1b, 2b\n" \ + " .previous" \ +- : "=&r" (err), "=r" (val) \ ++ : "=&r" (err), "=r" (__gu_val) \ + : "r" (addr), "i" (-EFAULT)); \ ++ val = (__force __typeof__(*(addr)))__gu_val; \ + } + +-#define __get_user_unknown(val, size, ptr, err) do { \ ++extern void __get_user_unknown(void); ++ ++#define __get_user_8(val, ptr, err) do { \ ++ u64 __val = 0; \ + err = 0; \ +- if (__copy_from_user(&(val), ptr, size)) { \ ++ if (raw_copy_from_user(&(__val), ptr, sizeof(val))) { \ + err = -EFAULT; \ ++ } else { \ ++ val = (typeof(val))(typeof((val) - (val)))__val; \ + } \ + } while (0) + +@@ -120,8 +127,11 @@ do { \ + case 4: \ + __get_user_asm(val, "ldw", ptr, err); \ + break; \ ++ case 8: \ ++ __get_user_8(val, ptr, err); \ ++ break; \ + default: \ +- __get_user_unknown(val, size, ptr, err); \ ++ __get_user_unknown(); \ + break; \ + } \ + } while (0) +@@ -130,9 +140,7 @@ do { \ + ({ \ + long __gu_err = -EFAULT; \ + const __typeof__(*(ptr)) __user *__gu_ptr = (ptr); \ +- unsigned long __gu_val = 0; \ +- __get_user_common(__gu_val, sizeof(*(ptr)), __gu_ptr, __gu_err);\ +- (x) = (__force __typeof__(x))__gu_val; \ ++ __get_user_common(x, sizeof(*(ptr)), __gu_ptr, __gu_err); \ + __gu_err; \ + }) + +@@ -140,11 +148,9 @@ do { \ + ({ \ + long __gu_err = -EFAULT; \ + const __typeof__(*(ptr)) __user *__gu_ptr = (ptr); \ +- unsigned long __gu_val = 0; \ + if (access_ok( __gu_ptr, sizeof(*__gu_ptr))) \ +- __get_user_common(__gu_val, sizeof(*__gu_ptr), \ ++ __get_user_common(x, sizeof(*__gu_ptr), \ + __gu_ptr, __gu_err); \ +- (x) = (__force __typeof__(x))__gu_val; \ + __gu_err; \ + }) + +diff --git a/arch/parisc/kernel/patch.c b/arch/parisc/kernel/patch.c +index 80a0ab372802d..e59574f65e641 100644 +--- a/arch/parisc/kernel/patch.c ++++ b/arch/parisc/kernel/patch.c +@@ -40,10 +40,7 @@ static void __kprobes *patch_map(void *addr, int fixmap, unsigned long *flags, + + *need_unmap = 1; + set_fixmap(fixmap, page_to_phys(page)); +- if (flags) +- raw_spin_lock_irqsave(&patch_lock, *flags); +- else +- __acquire(&patch_lock); ++ raw_spin_lock_irqsave(&patch_lock, *flags); + + return (void *) (__fix_to_virt(fixmap) + (uintaddr & ~PAGE_MASK)); + } +@@ -52,10 +49,7 @@ static void __kprobes patch_unmap(int fixmap, unsigned long *flags) + { + clear_fixmap(fixmap); + +- if (flags) +- raw_spin_unlock_irqrestore(&patch_lock, *flags); +- else +- __release(&patch_lock); ++ raw_spin_unlock_irqrestore(&patch_lock, *flags); + } + + void __kprobes __patch_text_multiple(void *addr, u32 *insn, unsigned int len) +@@ -67,8 +61,9 @@ void __kprobes __patch_text_multiple(void *addr, u32 *insn, unsigned int len) + int mapped; + + /* Make sure we don't have any aliases in cache */ +- flush_kernel_vmap_range(addr, len); +- flush_icache_range(start, end); ++ flush_kernel_dcache_range_asm(start, end); ++ flush_kernel_icache_range_asm(start, end); ++ flush_tlb_kernel_range(start, end); + + p = fixmap = patch_map(addr, FIX_TEXT_POKE0, &flags, &mapped); + +@@ -81,8 +76,10 @@ void __kprobes __patch_text_multiple(void *addr, u32 *insn, unsigned int len) + * We're crossing a page boundary, so + * need to remap + */ +- flush_kernel_vmap_range((void *)fixmap, +- (p-fixmap) * sizeof(*p)); ++ flush_kernel_dcache_range_asm((unsigned long)fixmap, ++ (unsigned long)p); ++ flush_tlb_kernel_range((unsigned long)fixmap, ++ (unsigned long)p); + if (mapped) + patch_unmap(FIX_TEXT_POKE0, &flags); + p = fixmap = patch_map(addr, FIX_TEXT_POKE0, &flags, +@@ -90,10 +87,10 @@ void __kprobes __patch_text_multiple(void *addr, u32 *insn, unsigned int len) + } + } + +- flush_kernel_vmap_range((void *)fixmap, (p-fixmap) * sizeof(*p)); ++ flush_kernel_dcache_range_asm((unsigned long)fixmap, (unsigned long)p); ++ flush_tlb_kernel_range((unsigned long)fixmap, (unsigned long)p); + if (mapped) + patch_unmap(FIX_TEXT_POKE0, &flags); +- flush_icache_range(start, end); + } + + void __kprobes __patch_text(void *addr, u32 insn) +diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile +index 9f73fb6b1cc91..b9d2fcf030d0d 100644 +--- a/arch/powerpc/Makefile ++++ b/arch/powerpc/Makefile +@@ -174,7 +174,7 @@ else + CFLAGS-$(CONFIG_GENERIC_CPU) += $(call cc-option,-mtune=power7,$(call cc-option,-mtune=power5)) + CFLAGS-$(CONFIG_GENERIC_CPU) += $(call cc-option,-mcpu=power5,-mcpu=power4) + endif +-else ++else ifdef CONFIG_PPC_BOOK3E_64 + CFLAGS-$(CONFIG_GENERIC_CPU) += -mcpu=powerpc64 + endif + +diff --git a/arch/powerpc/boot/dts/fsl/t104xrdb.dtsi b/arch/powerpc/boot/dts/fsl/t104xrdb.dtsi +index 099a598c74c00..bfe1ed5be3374 100644 +--- a/arch/powerpc/boot/dts/fsl/t104xrdb.dtsi ++++ b/arch/powerpc/boot/dts/fsl/t104xrdb.dtsi +@@ -139,12 +139,12 @@ + fman@400000 { + ethernet@e6000 { + phy-handle = <&phy_rgmii_0>; +- phy-connection-type = "rgmii"; ++ phy-connection-type = "rgmii-id"; + }; + + ethernet@e8000 { + phy-handle = <&phy_rgmii_1>; +- phy-connection-type = "rgmii"; ++ phy-connection-type = "rgmii-id"; + }; + + mdio0: mdio@fc000 { +diff --git a/arch/powerpc/include/asm/io.h b/arch/powerpc/include/asm/io.h +index a63ec938636de..daba2d2a02a0b 100644 +--- a/arch/powerpc/include/asm/io.h ++++ b/arch/powerpc/include/asm/io.h +@@ -345,25 +345,37 @@ static inline void __raw_writeq_be(unsigned long v, volatile void __iomem *addr) + */ + static inline void __raw_rm_writeb(u8 val, volatile void __iomem *paddr) + { +- __asm__ __volatile__("stbcix %0,0,%1" ++ __asm__ __volatile__(".machine push; \ ++ .machine power6; \ ++ stbcix %0,0,%1; \ ++ .machine pop;" + : : "r" (val), "r" (paddr) : "memory"); + } + + static inline void __raw_rm_writew(u16 val, volatile void __iomem *paddr) + { +- __asm__ __volatile__("sthcix %0,0,%1" ++ __asm__ __volatile__(".machine push; \ ++ .machine power6; \ ++ sthcix %0,0,%1; \ ++ .machine pop;" + : : "r" (val), "r" (paddr) : "memory"); + } + + static inline void __raw_rm_writel(u32 val, volatile void __iomem *paddr) + { +- __asm__ __volatile__("stwcix %0,0,%1" ++ __asm__ __volatile__(".machine push; \ ++ .machine power6; \ ++ stwcix %0,0,%1; \ ++ .machine pop;" + : : "r" (val), "r" (paddr) : "memory"); + } + + static inline void __raw_rm_writeq(u64 val, volatile void __iomem *paddr) + { +- __asm__ __volatile__("stdcix %0,0,%1" ++ __asm__ __volatile__(".machine push; \ ++ .machine power6; \ ++ stdcix %0,0,%1; \ ++ .machine pop;" + : : "r" (val), "r" (paddr) : "memory"); + } + +@@ -375,7 +387,10 @@ static inline void __raw_rm_writeq_be(u64 val, volatile void __iomem *paddr) + static inline u8 __raw_rm_readb(volatile void __iomem *paddr) + { + u8 ret; +- __asm__ __volatile__("lbzcix %0,0, %1" ++ __asm__ __volatile__(".machine push; \ ++ .machine power6; \ ++ lbzcix %0,0, %1; \ ++ .machine pop;" + : "=r" (ret) : "r" (paddr) : "memory"); + return ret; + } +@@ -383,7 +398,10 @@ static inline u8 __raw_rm_readb(volatile void __iomem *paddr) + static inline u16 __raw_rm_readw(volatile void __iomem *paddr) + { + u16 ret; +- __asm__ __volatile__("lhzcix %0,0, %1" ++ __asm__ __volatile__(".machine push; \ ++ .machine power6; \ ++ lhzcix %0,0, %1; \ ++ .machine pop;" + : "=r" (ret) : "r" (paddr) : "memory"); + return ret; + } +@@ -391,7 +409,10 @@ static inline u16 __raw_rm_readw(volatile void __iomem *paddr) + static inline u32 __raw_rm_readl(volatile void __iomem *paddr) + { + u32 ret; +- __asm__ __volatile__("lwzcix %0,0, %1" ++ __asm__ __volatile__(".machine push; \ ++ .machine power6; \ ++ lwzcix %0,0, %1; \ ++ .machine pop;" + : "=r" (ret) : "r" (paddr) : "memory"); + return ret; + } +@@ -399,7 +420,10 @@ static inline u32 __raw_rm_readl(volatile void __iomem *paddr) + static inline u64 __raw_rm_readq(volatile void __iomem *paddr) + { + u64 ret; +- __asm__ __volatile__("ldcix %0,0, %1" ++ __asm__ __volatile__(".machine push; \ ++ .machine power6; \ ++ ldcix %0,0, %1; \ ++ .machine pop;" + : "=r" (ret) : "r" (paddr) : "memory"); + return ret; + } +diff --git a/arch/powerpc/include/asm/uaccess.h b/arch/powerpc/include/asm/uaccess.h +index cafad1960e766..a14a32f6c3ccd 100644 +--- a/arch/powerpc/include/asm/uaccess.h ++++ b/arch/powerpc/include/asm/uaccess.h +@@ -191,8 +191,11 @@ extern long __get_user_bad(void); + */ + #define __get_user_atomic_128_aligned(kaddr, uaddr, err) \ + __asm__ __volatile__( \ ++ ".machine push\n" \ ++ ".machine altivec\n" \ + "1: lvx 0,0,%1 # get user\n" \ + " stvx 0,0,%2 # put kernel\n" \ ++ ".machine pop\n" \ + "2:\n" \ + ".section .fixup,\"ax\"\n" \ + "3: li %0,%3\n" \ +diff --git a/arch/powerpc/kernel/kvm.c b/arch/powerpc/kernel/kvm.c +index 617eba82531cb..d89cf802d9aa7 100644 +--- a/arch/powerpc/kernel/kvm.c ++++ b/arch/powerpc/kernel/kvm.c +@@ -669,7 +669,7 @@ static void __init kvm_use_magic_page(void) + on_each_cpu(kvm_map_magic_page, &features, 1); + + /* Quick self-test to see if the mapping works */ +- if (!fault_in_pages_readable((const char *)KVM_MAGIC_PAGE, sizeof(u32))) { ++ if (fault_in_pages_readable((const char *)KVM_MAGIC_PAGE, sizeof(u32))) { + kvm_patching_worked = false; + return; + } +diff --git a/arch/powerpc/kernel/machine_kexec.c b/arch/powerpc/kernel/machine_kexec.c +index 7a1c11a7cba5a..716f8bb17461c 100644 +--- a/arch/powerpc/kernel/machine_kexec.c ++++ b/arch/powerpc/kernel/machine_kexec.c +@@ -146,11 +146,18 @@ void __init reserve_crashkernel(void) + if (!crashk_res.start) { + #ifdef CONFIG_PPC64 + /* +- * On 64bit we split the RMO in half but cap it at half of +- * a small SLB (128MB) since the crash kernel needs to place +- * itself and some stacks to be in the first segment. ++ * On the LPAR platform place the crash kernel to mid of ++ * RMA size (512MB or more) to ensure the crash kernel ++ * gets enough space to place itself and some stack to be ++ * in the first segment. At the same time normal kernel ++ * also get enough space to allocate memory for essential ++ * system resource in the first segment. Keep the crash ++ * kernel starts at 128MB offset on other platforms. + */ +- crashk_res.start = min(0x8000000ULL, (ppc64_rma_size / 2)); ++ if (firmware_has_feature(FW_FEATURE_LPAR)) ++ crashk_res.start = ppc64_rma_size / 2; ++ else ++ crashk_res.start = min(0x8000000ULL, (ppc64_rma_size / 2)); + #else + crashk_res.start = KDUMP_KERNELBASE; + #endif +diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c +index c1e2e351ebff8..9392661ac8a87 100644 +--- a/arch/powerpc/kernel/rtas.c ++++ b/arch/powerpc/kernel/rtas.c +@@ -1244,6 +1244,12 @@ int __init early_init_dt_scan_rtas(unsigned long node, + entryp = of_get_flat_dt_prop(node, "linux,rtas-entry", NULL); + sizep = of_get_flat_dt_prop(node, "rtas-size", NULL); + ++#ifdef CONFIG_PPC64 ++ /* need this feature to decide the crashkernel offset */ ++ if (of_get_flat_dt_prop(node, "ibm,hypertas-functions", NULL)) ++ powerpc_firmware_features |= FW_FEATURE_LPAR; ++#endif ++ + if (basep && entryp && sizep) { + rtas.base = *basep; + rtas.entry = *entryp; +diff --git a/arch/powerpc/kvm/powerpc.c b/arch/powerpc/kvm/powerpc.c +index 8dd4d2b83677b..eb8c72846b7fc 100644 +--- a/arch/powerpc/kvm/powerpc.c ++++ b/arch/powerpc/kvm/powerpc.c +@@ -1495,7 +1495,7 @@ int kvmppc_handle_vmx_load(struct kvm_run *run, struct kvm_vcpu *vcpu, + { + enum emulation_result emulated = EMULATE_DONE; + +- if (vcpu->arch.mmio_vsx_copy_nums > 2) ++ if (vcpu->arch.mmio_vmx_copy_nums > 2) + return EMULATE_FAIL; + + while (vcpu->arch.mmio_vmx_copy_nums) { +@@ -1592,7 +1592,7 @@ int kvmppc_handle_vmx_store(struct kvm_run *run, struct kvm_vcpu *vcpu, + unsigned int index = rs & KVM_MMIO_REG_MASK; + enum emulation_result emulated = EMULATE_DONE; + +- if (vcpu->arch.mmio_vsx_copy_nums > 2) ++ if (vcpu->arch.mmio_vmx_copy_nums > 2) + return EMULATE_FAIL; + + vcpu->arch.io_gpr = rs; +diff --git a/arch/powerpc/lib/sstep.c b/arch/powerpc/lib/sstep.c +index dc6728dacbc6b..27650cd5857f9 100644 +--- a/arch/powerpc/lib/sstep.c ++++ b/arch/powerpc/lib/sstep.c +@@ -906,7 +906,10 @@ NOKPROBE_SYMBOL(emulate_dcbz); + + #define __put_user_asmx(x, addr, err, op, cr) \ + __asm__ __volatile__( \ ++ ".machine push\n" \ ++ ".machine power8\n" \ + "1: " op " %2,0,%3\n" \ ++ ".machine pop\n" \ + " mfcr %1\n" \ + "2:\n" \ + ".section .fixup,\"ax\"\n" \ +@@ -919,7 +922,10 @@ NOKPROBE_SYMBOL(emulate_dcbz); + + #define __get_user_asmx(x, addr, err, op) \ + __asm__ __volatile__( \ ++ ".machine push\n" \ ++ ".machine power8\n" \ + "1: "op" %1,0,%2\n" \ ++ ".machine pop\n" \ + "2:\n" \ + ".section .fixup,\"ax\"\n" \ + "3: li %0,%3\n" \ +@@ -2912,7 +2918,7 @@ int emulate_loadstore(struct pt_regs *regs, struct instruction_op *op) + __put_user_asmx(op->val, ea, err, "stbcx.", cr); + break; + case 2: +- __put_user_asmx(op->val, ea, err, "stbcx.", cr); ++ __put_user_asmx(op->val, ea, err, "sthcx.", cr); + break; + #endif + case 4: +diff --git a/arch/powerpc/mm/kasan/kasan_init_32.c b/arch/powerpc/mm/kasan/kasan_init_32.c +index 1cfe57b51d7e3..3f78007a72822 100644 +--- a/arch/powerpc/mm/kasan/kasan_init_32.c ++++ b/arch/powerpc/mm/kasan/kasan_init_32.c +@@ -121,7 +121,7 @@ static void __init kasan_remap_early_shadow_ro(void) + pmd_t *pmd = pmd_offset(pud_offset(pgd_offset_k(k_cur), k_cur), k_cur); + pte_t *ptep = pte_offset_kernel(pmd, k_cur); + +- if ((pte_val(*ptep) & PTE_RPN_MASK) != pa) ++ if (pte_page(*ptep) != virt_to_page(lm_alias(kasan_early_shadow_page))) + continue; + + __set_pte_at(&init_mm, k_cur, ptep, pfn_pte(PHYS_PFN(pa), prot), 0); +diff --git a/arch/powerpc/perf/imc-pmu.c b/arch/powerpc/perf/imc-pmu.c +index eb82dda884e51..d76e800a1f337 100644 +--- a/arch/powerpc/perf/imc-pmu.c ++++ b/arch/powerpc/perf/imc-pmu.c +@@ -1441,7 +1441,11 @@ static int trace_imc_event_init(struct perf_event *event) + event->hw.idx = -1; + target = event->hw.target; + +- event->pmu->task_ctx_nr = perf_hw_context; ++ /* ++ * There can only be a single PMU for perf_hw_context events which is assigned to ++ * core PMU. Hence use "perf_sw_context" for trace_imc. ++ */ ++ event->pmu->task_ctx_nr = perf_sw_context; + event->destroy = reset_global_refc; + return 0; + } +diff --git a/arch/powerpc/platforms/8xx/pic.c b/arch/powerpc/platforms/8xx/pic.c +index e9617d35fd1f6..209b12323aa4c 100644 +--- a/arch/powerpc/platforms/8xx/pic.c ++++ b/arch/powerpc/platforms/8xx/pic.c +@@ -153,6 +153,7 @@ int mpc8xx_pic_init(void) + if (mpc8xx_pic_host == NULL) { + printk(KERN_ERR "MPC8xx PIC: failed to allocate irq host!\n"); + ret = -ENOMEM; ++ goto out; + } + + ret = 0; +diff --git a/arch/powerpc/platforms/powernv/rng.c b/arch/powerpc/platforms/powernv/rng.c +index 8035caf6e297d..1c31863a9be6c 100644 +--- a/arch/powerpc/platforms/powernv/rng.c ++++ b/arch/powerpc/platforms/powernv/rng.c +@@ -43,7 +43,11 @@ static unsigned long rng_whiten(struct powernv_rng *rng, unsigned long val) + unsigned long parity; + + /* Calculate the parity of the value */ +- asm ("popcntd %0,%1" : "=r" (parity) : "r" (val)); ++ asm (".machine push; \ ++ .machine power7; \ ++ popcntd %0,%1; \ ++ .machine pop;" ++ : "=r" (parity) : "r" (val)); + + /* xor our value with the previous mask */ + val ^= rng->mask; +diff --git a/arch/powerpc/sysdev/fsl_gtm.c b/arch/powerpc/sysdev/fsl_gtm.c +index 8963eaffb1b7b..39186ad6b3c3a 100644 +--- a/arch/powerpc/sysdev/fsl_gtm.c ++++ b/arch/powerpc/sysdev/fsl_gtm.c +@@ -86,7 +86,7 @@ static LIST_HEAD(gtms); + */ + struct gtm_timer *gtm_get_timer16(void) + { +- struct gtm *gtm = NULL; ++ struct gtm *gtm; + int i; + + list_for_each_entry(gtm, >ms, list_node) { +@@ -103,7 +103,7 @@ struct gtm_timer *gtm_get_timer16(void) + spin_unlock_irq(>m->lock); + } + +- if (gtm) ++ if (!list_empty(>ms)) + return ERR_PTR(-EBUSY); + return ERR_PTR(-ENODEV); + } +diff --git a/arch/riscv/kernel/module.lds b/arch/riscv/kernel/module.lds +index 295ecfb341a29..18ec719899e28 100644 +--- a/arch/riscv/kernel/module.lds ++++ b/arch/riscv/kernel/module.lds +@@ -2,7 +2,7 @@ + /* Copyright (C) 2017 Andes Technology Corporation */ + + SECTIONS { +- .plt (NOLOAD) : { BYTE(0) } +- .got (NOLOAD) : { BYTE(0) } +- .got.plt (NOLOAD) : { BYTE(0) } ++ .plt : { BYTE(0) } ++ .got : { BYTE(0) } ++ .got.plt : { BYTE(0) } + } +diff --git a/arch/riscv/kernel/perf_callchain.c b/arch/riscv/kernel/perf_callchain.c +index 22a93009362d7..1de5991916eb9 100644 +--- a/arch/riscv/kernel/perf_callchain.c ++++ b/arch/riscv/kernel/perf_callchain.c +@@ -77,7 +77,7 @@ void perf_callchain_user(struct perf_callchain_entry_ctx *entry, + + bool fill_callchain(unsigned long pc, void *entry) + { +- return perf_callchain_store(entry, pc); ++ return perf_callchain_store(entry, pc) == 0; + } + + void notrace walk_stackframe(struct task_struct *task, +diff --git a/arch/um/drivers/mconsole_kern.c b/arch/um/drivers/mconsole_kern.c +index 0117489e9b30a..750acc1344328 100644 +--- a/arch/um/drivers/mconsole_kern.c ++++ b/arch/um/drivers/mconsole_kern.c +@@ -217,7 +217,7 @@ void mconsole_go(struct mc_request *req) + + void mconsole_stop(struct mc_request *req) + { +- deactivate_fd(req->originating_fd, MCONSOLE_IRQ); ++ block_signals(); + os_set_fd_block(req->originating_fd, 1); + mconsole_reply(req, "stopped", 0, 0); + for (;;) { +@@ -240,6 +240,7 @@ void mconsole_stop(struct mc_request *req) + } + os_set_fd_block(req->originating_fd, 0); + mconsole_reply(req, "", 0, 0); ++ unblock_signals(); + } + + static DEFINE_SPINLOCK(mc_devices_lock); +diff --git a/arch/x86/events/intel/pt.c b/arch/x86/events/intel/pt.c +index da289a44d5116..f4d2322f4c629 100644 +--- a/arch/x86/events/intel/pt.c ++++ b/arch/x86/events/intel/pt.c +@@ -460,7 +460,7 @@ static u64 pt_config_filters(struct perf_event *event) + pt->filters.filter[range].msr_b = filter->msr_b; + } + +- rtit_ctl |= filter->config << pt_address_ranges[range].reg_off; ++ rtit_ctl |= (u64)filter->config << pt_address_ranges[range].reg_off; + } + + return rtit_ctl; +diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c +index 6ff2c7cac4c46..408b51aba2930 100644 +--- a/arch/x86/kernel/kvm.c ++++ b/arch/x86/kernel/kvm.c +@@ -487,7 +487,7 @@ static void __send_ipi_mask(const struct cpumask *mask, int vector) + } else if (apic_id < min && max - apic_id < KVM_IPI_CLUSTER_SIZE) { + ipi_bitmap <<= min - apic_id; + min = apic_id; +- } else if (apic_id < min + KVM_IPI_CLUSTER_SIZE) { ++ } else if (apic_id > min && apic_id < min + KVM_IPI_CLUSTER_SIZE) { + max = apic_id < max ? max : apic_id; + } else { + ret = kvm_hypercall4(KVM_HC_SEND_IPI, (unsigned long)ipi_bitmap, +diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c +index 60c8dcb907a50..ea48a2fb1677d 100644 +--- a/arch/x86/kvm/emulate.c ++++ b/arch/x86/kvm/emulate.c +@@ -1714,11 +1714,6 @@ static int __load_segment_descriptor(struct x86_emulate_ctxt *ctxt, + goto exception; + } + +- if (!seg_desc.p) { +- err_vec = (seg == VCPU_SREG_SS) ? SS_VECTOR : NP_VECTOR; +- goto exception; +- } +- + dpl = seg_desc.dpl; + + switch (seg) { +@@ -1758,6 +1753,10 @@ static int __load_segment_descriptor(struct x86_emulate_ctxt *ctxt, + case VCPU_SREG_TR: + if (seg_desc.s || (seg_desc.type != 1 && seg_desc.type != 9)) + goto exception; ++ if (!seg_desc.p) { ++ err_vec = NP_VECTOR; ++ goto exception; ++ } + old_desc = seg_desc; + seg_desc.type |= 2; /* busy */ + ret = ctxt->ops->cmpxchg_emulated(ctxt, desc_addr, &old_desc, &seg_desc, +@@ -1782,6 +1781,11 @@ static int __load_segment_descriptor(struct x86_emulate_ctxt *ctxt, + break; + } + ++ if (!seg_desc.p) { ++ err_vec = (seg == VCPU_SREG_SS) ? SS_VECTOR : NP_VECTOR; ++ goto exception; ++ } ++ + if (seg_desc.s) { + /* mark segment as accessed */ + if (!(seg_desc.type & 1)) { +diff --git a/arch/x86/kvm/hyperv.c b/arch/x86/kvm/hyperv.c +index be92e8dccda3d..ca66459a2e895 100644 +--- a/arch/x86/kvm/hyperv.c ++++ b/arch/x86/kvm/hyperv.c +@@ -205,7 +205,7 @@ static int synic_set_msr(struct kvm_vcpu_hv_synic *synic, + struct kvm_vcpu *vcpu = synic_to_vcpu(synic); + int ret; + +- if (!synic->active && !host) ++ if (!synic->active && (!host || data)) + return 1; + + trace_kvm_hv_synic_set_msr(vcpu->vcpu_id, msr, data, host); +@@ -251,6 +251,9 @@ static int synic_set_msr(struct kvm_vcpu_hv_synic *synic, + case HV_X64_MSR_EOM: { + int i; + ++ if (!synic->active) ++ break; ++ + for (i = 0; i < ARRAY_SIZE(synic->sint); i++) + kvm_hv_notify_acked_sint(vcpu, i); + break; +@@ -514,6 +517,11 @@ static int stimer_set_config(struct kvm_vcpu_hv_stimer *stimer, u64 config, + { + union hv_stimer_config new_config = {.as_uint64 = config}, + old_config = {.as_uint64 = stimer->config.as_uint64}; ++ struct kvm_vcpu *vcpu = stimer_to_vcpu(stimer); ++ struct kvm_vcpu_hv_synic *synic = vcpu_to_synic(vcpu); ++ ++ if (!synic->active && (!host || config)) ++ return 1; + + trace_kvm_hv_stimer_set_config(stimer_to_vcpu(stimer)->vcpu_id, + stimer->index, config, host); +@@ -533,6 +541,12 @@ static int stimer_set_config(struct kvm_vcpu_hv_stimer *stimer, u64 config, + static int stimer_set_count(struct kvm_vcpu_hv_stimer *stimer, u64 count, + bool host) + { ++ struct kvm_vcpu *vcpu = stimer_to_vcpu(stimer); ++ struct kvm_vcpu_hv_synic *synic = vcpu_to_synic(vcpu); ++ ++ if (!synic->active && (!host || count)) ++ return 1; ++ + trace_kvm_hv_stimer_set_count(stimer_to_vcpu(stimer)->vcpu_id, + stimer->index, count, host); + +diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c +index eea2d6f10f59a..afe3b8e615146 100644 +--- a/arch/x86/kvm/lapic.c ++++ b/arch/x86/kvm/lapic.c +@@ -2099,10 +2099,7 @@ void kvm_set_lapic_tscdeadline_msr(struct kvm_vcpu *vcpu, u64 data) + + void kvm_lapic_set_tpr(struct kvm_vcpu *vcpu, unsigned long cr8) + { +- struct kvm_lapic *apic = vcpu->arch.apic; +- +- apic_set_tpr(apic, ((cr8 & 0x0f) << 4) +- | (kvm_lapic_get_reg(apic, APIC_TASKPRI) & 4)); ++ apic_set_tpr(vcpu->arch.apic, (cr8 & 0x0f) << 4); + } + + u64 kvm_lapic_get_cr8(struct kvm_vcpu *vcpu) +diff --git a/arch/x86/kvm/paging_tmpl.h b/arch/x86/kvm/paging_tmpl.h +index d4a8ad6c6a4bb..1a1d2b5e7b357 100644 +--- a/arch/x86/kvm/paging_tmpl.h ++++ b/arch/x86/kvm/paging_tmpl.h +@@ -34,9 +34,8 @@ + #define PT_HAVE_ACCESSED_DIRTY(mmu) true + #ifdef CONFIG_X86_64 + #define PT_MAX_FULL_LEVELS PT64_ROOT_MAX_LEVEL +- #define CMPXCHG cmpxchg ++ #define CMPXCHG "cmpxchgq" + #else +- #define CMPXCHG cmpxchg64 + #define PT_MAX_FULL_LEVELS 2 + #endif + #elif PTTYPE == 32 +@@ -52,7 +51,7 @@ + #define PT_GUEST_DIRTY_SHIFT PT_DIRTY_SHIFT + #define PT_GUEST_ACCESSED_SHIFT PT_ACCESSED_SHIFT + #define PT_HAVE_ACCESSED_DIRTY(mmu) true +- #define CMPXCHG cmpxchg ++ #define CMPXCHG "cmpxchgl" + #elif PTTYPE == PTTYPE_EPT + #define pt_element_t u64 + #define guest_walker guest_walkerEPT +@@ -65,8 +64,10 @@ + #define PT_GUEST_DIRTY_SHIFT 9 + #define PT_GUEST_ACCESSED_SHIFT 8 + #define PT_HAVE_ACCESSED_DIRTY(mmu) ((mmu)->ept_ad) +- #define CMPXCHG cmpxchg64 + #define PT_MAX_FULL_LEVELS 4 ++ #ifdef CONFIG_X86_64 ++ #define CMPXCHG "cmpxchgq" ++ #endif + #else + #error Invalid PTTYPE value + #endif +@@ -132,43 +133,39 @@ static int FNAME(cmpxchg_gpte)(struct kvm_vcpu *vcpu, struct kvm_mmu *mmu, + pt_element_t __user *ptep_user, unsigned index, + pt_element_t orig_pte, pt_element_t new_pte) + { +- int npages; +- pt_element_t ret; +- pt_element_t *table; +- struct page *page; +- +- npages = get_user_pages_fast((unsigned long)ptep_user, 1, FOLL_WRITE, &page); +- if (likely(npages == 1)) { +- table = kmap_atomic(page); +- ret = CMPXCHG(&table[index], orig_pte, new_pte); +- kunmap_atomic(table); +- +- kvm_release_page_dirty(page); +- } else { +- struct vm_area_struct *vma; +- unsigned long vaddr = (unsigned long)ptep_user & PAGE_MASK; +- unsigned long pfn; +- unsigned long paddr; +- +- down_read(¤t->mm->mmap_sem); +- vma = find_vma_intersection(current->mm, vaddr, vaddr + PAGE_SIZE); +- if (!vma || !(vma->vm_flags & VM_PFNMAP)) { +- up_read(¤t->mm->mmap_sem); +- return -EFAULT; +- } +- pfn = ((vaddr - vma->vm_start) >> PAGE_SHIFT) + vma->vm_pgoff; +- paddr = pfn << PAGE_SHIFT; +- table = memremap(paddr, PAGE_SIZE, MEMREMAP_WB); +- if (!table) { +- up_read(¤t->mm->mmap_sem); +- return -EFAULT; +- } +- ret = CMPXCHG(&table[index], orig_pte, new_pte); +- memunmap(table); +- up_read(¤t->mm->mmap_sem); +- } ++ int r = -EFAULT; ++ ++ if (!user_access_begin(ptep_user, sizeof(pt_element_t))) ++ return -EFAULT; ++ ++#ifdef CMPXCHG ++ asm volatile("1:" LOCK_PREFIX CMPXCHG " %[new], %[ptr]\n" ++ "mov $0, %[r]\n" ++ "setnz %b[r]\n" ++ "2:" ++ _ASM_EXTABLE_UA(1b, 2b) ++ : [ptr] "+m" (*ptep_user), ++ [old] "+a" (orig_pte), ++ [r] "+q" (r) ++ : [new] "r" (new_pte) ++ : "memory"); ++#else ++ asm volatile("1:" LOCK_PREFIX "cmpxchg8b %[ptr]\n" ++ "movl $0, %[r]\n" ++ "jz 2f\n" ++ "incl %[r]\n" ++ "2:" ++ _ASM_EXTABLE_UA(1b, 2b) ++ : [ptr] "+m" (*ptep_user), ++ [old] "+A" (orig_pte), ++ [r] "+rm" (r) ++ : [new_lo] "b" ((u32)new_pte), ++ [new_hi] "c" ((u32)(new_pte >> 32)) ++ : "memory"); ++#endif + +- return (ret != orig_pte); ++ user_access_end(); ++ return r; + } + + static bool FNAME(prefetch_invalid_gpte)(struct kvm_vcpu *vcpu, +diff --git a/arch/x86/kvm/pmu_amd.c b/arch/x86/kvm/pmu_amd.c +index d9990951fd0ac..6bc656abbe66d 100644 +--- a/arch/x86/kvm/pmu_amd.c ++++ b/arch/x86/kvm/pmu_amd.c +@@ -245,12 +245,10 @@ static int amd_pmu_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) + /* MSR_EVNTSELn */ + pmc = get_gp_pmc_amd(pmu, msr, PMU_TYPE_EVNTSEL); + if (pmc) { +- if (data == pmc->eventsel) +- return 0; +- if (!(data & pmu->reserved_bits)) { ++ data &= ~pmu->reserved_bits; ++ if (data != pmc->eventsel) + reprogram_gp_counter(pmc, data); +- return 0; +- } ++ return 0; + } + + return 1; +diff --git a/arch/x86/power/cpu.c b/arch/x86/power/cpu.c +index 915bb16397632..1bff0f68f0273 100644 +--- a/arch/x86/power/cpu.c ++++ b/arch/x86/power/cpu.c +@@ -40,7 +40,8 @@ static void msr_save_context(struct saved_context *ctxt) + struct saved_msr *end = msr + ctxt->saved_msrs.num; + + while (msr < end) { +- msr->valid = !rdmsrl_safe(msr->info.msr_no, &msr->info.reg.q); ++ if (msr->valid) ++ rdmsrl(msr->info.msr_no, msr->info.reg.q); + msr++; + } + } +@@ -421,8 +422,10 @@ static int msr_build_context(const u32 *msr_id, const int num) + } + + for (i = saved_msrs->num, j = 0; i < total_num; i++, j++) { ++ u64 dummy; ++ + msr_array[i].info.msr_no = msr_id[j]; +- msr_array[i].valid = false; ++ msr_array[i].valid = !rdmsrl_safe(msr_id[j], &dummy); + msr_array[i].info.reg.q = 0; + } + saved_msrs->num = total_num; +@@ -509,10 +512,24 @@ static int pm_cpu_check(const struct x86_cpu_id *c) + return ret; + } + ++static void pm_save_spec_msr(void) ++{ ++ u32 spec_msr_id[] = { ++ MSR_IA32_SPEC_CTRL, ++ MSR_IA32_TSX_CTRL, ++ MSR_TSX_FORCE_ABORT, ++ MSR_IA32_MCU_OPT_CTRL, ++ MSR_AMD64_LS_CFG, ++ }; ++ ++ msr_build_context(spec_msr_id, ARRAY_SIZE(spec_msr_id)); ++} ++ + static int pm_check_save_msr(void) + { + dmi_check_system(msr_save_dmi_table); + pm_cpu_check(msr_save_cpu_table); ++ pm_save_spec_msr(); + + return 0; + } +diff --git a/arch/x86/xen/pmu.c b/arch/x86/xen/pmu.c +index e13b0b49fcdfc..d7249f4c90f1b 100644 +--- a/arch/x86/xen/pmu.c ++++ b/arch/x86/xen/pmu.c +@@ -512,10 +512,7 @@ irqreturn_t xen_pmu_irq_handler(int irq, void *dev_id) + return ret; + } + +-bool is_xen_pmu(int cpu) +-{ +- return (get_xenpmu_data() != NULL); +-} ++bool is_xen_pmu; + + void xen_pmu_init(int cpu) + { +@@ -526,7 +523,7 @@ void xen_pmu_init(int cpu) + + BUILD_BUG_ON(sizeof(struct xen_pmu_data) > PAGE_SIZE); + +- if (xen_hvm_domain()) ++ if (xen_hvm_domain() || (cpu != 0 && !is_xen_pmu)) + return; + + xenpmu_data = (struct xen_pmu_data *)get_zeroed_page(GFP_KERNEL); +@@ -547,7 +544,8 @@ void xen_pmu_init(int cpu) + per_cpu(xenpmu_shared, cpu).xenpmu_data = xenpmu_data; + per_cpu(xenpmu_shared, cpu).flags = 0; + +- if (cpu == 0) { ++ if (!is_xen_pmu) { ++ is_xen_pmu = true; + perf_register_guest_info_callbacks(&xen_guest_cbs); + xen_pmu_arch_init(); + } +diff --git a/arch/x86/xen/pmu.h b/arch/x86/xen/pmu.h +index 0e83a160589bc..65c58894fc79f 100644 +--- a/arch/x86/xen/pmu.h ++++ b/arch/x86/xen/pmu.h +@@ -4,6 +4,8 @@ + + #include <xen/interface/xenpmu.h> + ++extern bool is_xen_pmu; ++ + irqreturn_t xen_pmu_irq_handler(int irq, void *dev_id); + #ifdef CONFIG_XEN_HAVE_VPMU + void xen_pmu_init(int cpu); +@@ -12,7 +14,6 @@ void xen_pmu_finish(int cpu); + static inline void xen_pmu_init(int cpu) {} + static inline void xen_pmu_finish(int cpu) {} + #endif +-bool is_xen_pmu(int cpu); + bool pmu_msr_read(unsigned int msr, uint64_t *val, int *err); + bool pmu_msr_write(unsigned int msr, uint32_t low, uint32_t high, int *err); + int pmu_apic_update(uint32_t reg); +diff --git a/arch/x86/xen/smp_hvm.c b/arch/x86/xen/smp_hvm.c +index f8d39440b2923..e5bd9eb421915 100644 +--- a/arch/x86/xen/smp_hvm.c ++++ b/arch/x86/xen/smp_hvm.c +@@ -18,6 +18,12 @@ static void __init xen_hvm_smp_prepare_boot_cpu(void) + */ + xen_vcpu_setup(0); + ++ /* ++ * Called again in case the kernel boots on vcpu >= MAX_VIRT_CPUS. ++ * Refer to comments in xen_hvm_init_time_ops(). ++ */ ++ xen_hvm_init_time_ops(); ++ + /* + * The alternative logic (which patches the unlock/lock) runs before + * the smp bootup up code is activated. Hence we need to set this up +diff --git a/arch/x86/xen/smp_pv.c b/arch/x86/xen/smp_pv.c +index 0cebe5db691d9..64e6ec2c32a76 100644 +--- a/arch/x86/xen/smp_pv.c ++++ b/arch/x86/xen/smp_pv.c +@@ -129,7 +129,7 @@ int xen_smp_intr_init_pv(unsigned int cpu) + per_cpu(xen_irq_work, cpu).irq = rc; + per_cpu(xen_irq_work, cpu).name = callfunc_name; + +- if (is_xen_pmu(cpu)) { ++ if (is_xen_pmu) { + pmu_name = kasprintf(GFP_KERNEL, "pmu%d", cpu); + rc = bind_virq_to_irqhandler(VIRQ_XENPMU, cpu, + xen_pmu_irq_handler, +diff --git a/arch/x86/xen/time.c b/arch/x86/xen/time.c +index befbdd8b17f01..4ec6c80f76872 100644 +--- a/arch/x86/xen/time.c ++++ b/arch/x86/xen/time.c +@@ -547,6 +547,11 @@ static void xen_hvm_setup_cpu_clockevents(void) + + void __init xen_hvm_init_time_ops(void) + { ++ static bool hvm_time_initialized; ++ ++ if (hvm_time_initialized) ++ return; ++ + /* + * vector callback is needed otherwise we cannot receive interrupts + * on cpu > 0 and at this point we don't know how many cpus are +@@ -556,7 +561,22 @@ void __init xen_hvm_init_time_ops(void) + return; + + if (!xen_feature(XENFEAT_hvm_safe_pvclock)) { +- pr_info("Xen doesn't support pvclock on HVM, disable pv timer"); ++ pr_info_once("Xen doesn't support pvclock on HVM, disable pv timer"); ++ return; ++ } ++ ++ /* ++ * Only MAX_VIRT_CPUS 'vcpu_info' are embedded inside 'shared_info'. ++ * The __this_cpu_read(xen_vcpu) is still NULL when Xen HVM guest ++ * boots on vcpu >= MAX_VIRT_CPUS (e.g., kexec), To access ++ * __this_cpu_read(xen_vcpu) via xen_clocksource_read() will panic. ++ * ++ * The xen_hvm_init_time_ops() should be called again later after ++ * __this_cpu_read(xen_vcpu) is available. ++ */ ++ if (!__this_cpu_read(xen_vcpu)) { ++ pr_info("Delay xen_init_time_common() as kernel is running on vcpu=%d\n", ++ xen_vcpu_nr(0)); + return; + } + +@@ -568,6 +588,8 @@ void __init xen_hvm_init_time_ops(void) + x86_platform.calibrate_tsc = xen_tsc_khz; + x86_platform.get_wallclock = xen_get_wallclock; + x86_platform.set_wallclock = xen_set_wallclock; ++ ++ hvm_time_initialized = true; + } + #endif + +diff --git a/arch/xtensa/boot/dts/xtfpga-flash-128m.dtsi b/arch/xtensa/boot/dts/xtfpga-flash-128m.dtsi +index 9bf8bad1dd18a..c33932568aa73 100644 +--- a/arch/xtensa/boot/dts/xtfpga-flash-128m.dtsi ++++ b/arch/xtensa/boot/dts/xtfpga-flash-128m.dtsi +@@ -8,19 +8,19 @@ + reg = <0x00000000 0x08000000>; + bank-width = <2>; + device-width = <2>; +- partition@0x0 { ++ partition@0 { + label = "data"; + reg = <0x00000000 0x06000000>; + }; +- partition@0x6000000 { ++ partition@6000000 { + label = "boot loader area"; + reg = <0x06000000 0x00800000>; + }; +- partition@0x6800000 { ++ partition@6800000 { + label = "kernel image"; + reg = <0x06800000 0x017e0000>; + }; +- partition@0x7fe0000 { ++ partition@7fe0000 { + label = "boot environment"; + reg = <0x07fe0000 0x00020000>; + }; +diff --git a/arch/xtensa/boot/dts/xtfpga-flash-16m.dtsi b/arch/xtensa/boot/dts/xtfpga-flash-16m.dtsi +index 40c2f81f7cb66..7bde2ab2d6fb5 100644 +--- a/arch/xtensa/boot/dts/xtfpga-flash-16m.dtsi ++++ b/arch/xtensa/boot/dts/xtfpga-flash-16m.dtsi +@@ -8,19 +8,19 @@ + reg = <0x08000000 0x01000000>; + bank-width = <2>; + device-width = <2>; +- partition@0x0 { ++ partition@0 { + label = "boot loader area"; + reg = <0x00000000 0x00400000>; + }; +- partition@0x400000 { ++ partition@400000 { + label = "kernel image"; + reg = <0x00400000 0x00600000>; + }; +- partition@0xa00000 { ++ partition@a00000 { + label = "data"; + reg = <0x00a00000 0x005e0000>; + }; +- partition@0xfe0000 { ++ partition@fe0000 { + label = "boot environment"; + reg = <0x00fe0000 0x00020000>; + }; +diff --git a/arch/xtensa/boot/dts/xtfpga-flash-4m.dtsi b/arch/xtensa/boot/dts/xtfpga-flash-4m.dtsi +index fb8d3a9f33c23..0655b868749a4 100644 +--- a/arch/xtensa/boot/dts/xtfpga-flash-4m.dtsi ++++ b/arch/xtensa/boot/dts/xtfpga-flash-4m.dtsi +@@ -8,11 +8,11 @@ + reg = <0x08000000 0x00400000>; + bank-width = <2>; + device-width = <2>; +- partition@0x0 { ++ partition@0 { + label = "boot loader area"; + reg = <0x00000000 0x003f0000>; + }; +- partition@0x3f0000 { ++ partition@3f0000 { + label = "boot environment"; + reg = <0x003f0000 0x00010000>; + }; +diff --git a/arch/xtensa/include/asm/processor.h b/arch/xtensa/include/asm/processor.h +index 7495520d7a3e9..fd1161de45356 100644 +--- a/arch/xtensa/include/asm/processor.h ++++ b/arch/xtensa/include/asm/processor.h +@@ -225,8 +225,8 @@ extern unsigned long get_wchan(struct task_struct *p); + + #define xtensa_set_sr(x, sr) \ + ({ \ +- unsigned int v = (unsigned int)(x); \ +- __asm__ __volatile__ ("wsr %0, "__stringify(sr) :: "a"(v)); \ ++ __asm__ __volatile__ ("wsr %0, "__stringify(sr) :: \ ++ "a"((unsigned int)(x))); \ + }) + + #define xtensa_get_sr(sr) \ +diff --git a/arch/xtensa/kernel/jump_label.c b/arch/xtensa/kernel/jump_label.c +index 61cf6497a646b..0dde21e0d3de4 100644 +--- a/arch/xtensa/kernel/jump_label.c ++++ b/arch/xtensa/kernel/jump_label.c +@@ -61,7 +61,7 @@ static void patch_text(unsigned long addr, const void *data, size_t sz) + .data = data, + }; + stop_machine_cpuslocked(patch_text_stop_machine, +- &patch, NULL); ++ &patch, cpu_online_mask); + } else { + unsigned long flags; + +diff --git a/block/bfq-cgroup.c b/block/bfq-cgroup.c +index 342a1cfa48c57..c17eb794f0aef 100644 +--- a/block/bfq-cgroup.c ++++ b/block/bfq-cgroup.c +@@ -625,6 +625,12 @@ void bfq_bfqq_move(struct bfq_data *bfqd, struct bfq_queue *bfqq, + { + struct bfq_entity *entity = &bfqq->entity; + ++ /* ++ * oom_bfqq is not allowed to move, oom_bfqq will hold ref to root_group ++ * until elevator exit. ++ */ ++ if (bfqq == &bfqd->oom_bfqq) ++ return; + /* + * Get extra reference to prevent bfqq from being freed in + * next possible expire or deactivate. +diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c +index 1a0c581512f28..1d443d17cf7c5 100644 +--- a/block/bfq-iosched.c ++++ b/block/bfq-iosched.c +@@ -2523,6 +2523,15 @@ bfq_setup_merge(struct bfq_queue *bfqq, struct bfq_queue *new_bfqq) + * are likely to increase the throughput. + */ + bfqq->new_bfqq = new_bfqq; ++ /* ++ * The above assignment schedules the following redirections: ++ * each time some I/O for bfqq arrives, the process that ++ * generated that I/O is disassociated from bfqq and ++ * associated with new_bfqq. Here we increases new_bfqq->ref ++ * in advance, adding the number of processes that are ++ * expected to be associated with new_bfqq as they happen to ++ * issue I/O. ++ */ + new_bfqq->ref += process_refs; + return new_bfqq; + } +@@ -2582,6 +2591,10 @@ bfq_setup_cooperator(struct bfq_data *bfqd, struct bfq_queue *bfqq, + { + struct bfq_queue *in_service_bfqq, *new_bfqq; + ++ /* if a merge has already been setup, then proceed with that first */ ++ if (bfqq->new_bfqq) ++ return bfqq->new_bfqq; ++ + /* + * Do not perform queue merging if the device is non + * rotational and performs internal queueing. In fact, such a +@@ -2636,9 +2649,6 @@ bfq_setup_cooperator(struct bfq_data *bfqd, struct bfq_queue *bfqq, + if (bfq_too_late_for_merging(bfqq)) + return NULL; + +- if (bfqq->new_bfqq) +- return bfqq->new_bfqq; +- + if (!io_struct || unlikely(bfqq == &bfqd->oom_bfqq)) + return NULL; + +@@ -4793,7 +4803,7 @@ static struct request *bfq_dispatch_request(struct blk_mq_hw_ctx *hctx) + struct bfq_data *bfqd = hctx->queue->elevator->elevator_data; + struct request *rq; + struct bfq_queue *in_serv_queue; +- bool waiting_rq, idle_timer_disabled; ++ bool waiting_rq, idle_timer_disabled = false; + + spin_lock_irq(&bfqd->lock); + +@@ -4801,14 +4811,15 @@ static struct request *bfq_dispatch_request(struct blk_mq_hw_ctx *hctx) + waiting_rq = in_serv_queue && bfq_bfqq_wait_request(in_serv_queue); + + rq = __bfq_dispatch_request(hctx); +- +- idle_timer_disabled = +- waiting_rq && !bfq_bfqq_wait_request(in_serv_queue); ++ if (in_serv_queue == bfqd->in_service_queue) { ++ idle_timer_disabled = ++ waiting_rq && !bfq_bfqq_wait_request(in_serv_queue); ++ } + + spin_unlock_irq(&bfqd->lock); +- +- bfq_update_dispatch_stats(hctx->queue, rq, in_serv_queue, +- idle_timer_disabled); ++ bfq_update_dispatch_stats(hctx->queue, rq, ++ idle_timer_disabled ? in_serv_queue : NULL, ++ idle_timer_disabled); + + return rq; + } +diff --git a/block/blk-merge.c b/block/blk-merge.c +index 4b022f0c49d20..a62692d135660 100644 +--- a/block/blk-merge.c ++++ b/block/blk-merge.c +@@ -7,6 +7,7 @@ + #include <linux/bio.h> + #include <linux/blkdev.h> + #include <linux/scatterlist.h> ++#include <linux/blk-cgroup.h> + + #include <trace/events/block.h> + +@@ -571,6 +572,9 @@ static inline unsigned int blk_rq_get_max_segments(struct request *rq) + static inline int ll_new_hw_segment(struct request *req, struct bio *bio, + unsigned int nr_phys_segs) + { ++ if (!blk_cgroup_mergeable(req, bio)) ++ goto no_merge; ++ + if (blk_integrity_merge_bio(req->q, req, bio) == false) + goto no_merge; + +@@ -662,6 +666,9 @@ static int ll_merge_requests_fn(struct request_queue *q, struct request *req, + if (total_phys_segments > blk_rq_get_max_segments(req)) + return 0; + ++ if (!blk_cgroup_mergeable(req, next->bio)) ++ return 0; ++ + if (blk_integrity_merge_rq(q, req, next) == false) + return 0; + +@@ -885,6 +892,10 @@ bool blk_rq_merge_ok(struct request *rq, struct bio *bio) + if (rq->rq_disk != bio->bi_disk) + return false; + ++ /* don't merge across cgroup boundaries */ ++ if (!blk_cgroup_mergeable(rq, bio)) ++ return false; ++ + /* only merge integrity protected bio into ditto rq */ + if (blk_integrity_merge_bio(rq->q, rq, bio) == false) + return false; +diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c +index bf33570da5ac7..3fb37135264b2 100644 +--- a/block/blk-sysfs.c ++++ b/block/blk-sysfs.c +@@ -1060,15 +1060,17 @@ void blk_unregister_queue(struct gendisk *disk) + */ + if (queue_is_mq(q)) + blk_mq_unregister_dev(disk_to_dev(disk), q); +- +- kobject_uevent(&q->kobj, KOBJ_REMOVE); +- kobject_del(&q->kobj); + blk_trace_remove_sysfs(disk_to_dev(disk)); + + mutex_lock(&q->sysfs_lock); + if (q->elevator) + elv_unregister_queue(q); + mutex_unlock(&q->sysfs_lock); ++ ++ /* Now that we've deleted all child objects, we can delete the queue. */ ++ kobject_uevent(&q->kobj, KOBJ_REMOVE); ++ kobject_del(&q->kobj); ++ + mutex_unlock(&q->sysfs_dir_lock); + + kobject_put(&disk_to_dev(disk)->kobj); +diff --git a/crypto/authenc.c b/crypto/authenc.c +index 3f0ed94025820..321da90389957 100644 +--- a/crypto/authenc.c ++++ b/crypto/authenc.c +@@ -263,7 +263,7 @@ static int crypto_authenc_decrypt_tail(struct aead_request *req, + dst = scatterwalk_ffwd(areq_ctx->dst, req->dst, req->assoclen); + + skcipher_request_set_tfm(skreq, ctx->enc); +- skcipher_request_set_callback(skreq, aead_request_flags(req), ++ skcipher_request_set_callback(skreq, flags, + req->base.complete, req->base.data); + skcipher_request_set_crypt(skreq, src, dst, + req->cryptlen - authsize, req->iv); +diff --git a/crypto/rsa-pkcs1pad.c b/crypto/rsa-pkcs1pad.c +index 0aa489711ec49..9cbafaf6dd851 100644 +--- a/crypto/rsa-pkcs1pad.c ++++ b/crypto/rsa-pkcs1pad.c +@@ -475,6 +475,8 @@ static int pkcs1pad_verify_complete(struct akcipher_request *req, int err) + pos++; + + if (digest_info) { ++ if (digest_info->size > dst_len - pos) ++ goto done; + if (crypto_memneq(out_buf + pos, digest_info->data, + digest_info->size)) + goto done; +@@ -494,7 +496,7 @@ static int pkcs1pad_verify_complete(struct akcipher_request *req, int err) + sg_nents_for_len(req->src, + req->src_len + req->dst_len), + req_ctx->out_buf + ctx->key_size, +- req->dst_len, ctx->key_size); ++ req->dst_len, req->src_len); + /* Do the actual verification step. */ + if (memcmp(req_ctx->out_buf + ctx->key_size, out_buf + pos, + req->dst_len) != 0) +@@ -537,7 +539,7 @@ static int pkcs1pad_verify(struct akcipher_request *req) + + if (WARN_ON(req->dst) || + WARN_ON(!req->dst_len) || +- !ctx->key_size || req->src_len < ctx->key_size) ++ !ctx->key_size || req->src_len != ctx->key_size) + return -EINVAL; + + req_ctx->out_buf = kmalloc(ctx->key_size + req->dst_len, GFP_KERNEL); +diff --git a/drivers/acpi/acpica/nswalk.c b/drivers/acpi/acpica/nswalk.c +index ceea6af79d121..bf4eb642f4232 100644 +--- a/drivers/acpi/acpica/nswalk.c ++++ b/drivers/acpi/acpica/nswalk.c +@@ -169,6 +169,9 @@ acpi_ns_walk_namespace(acpi_object_type type, + + if (start_node == ACPI_ROOT_OBJECT) { + start_node = acpi_gbl_root_node; ++ if (!start_node) { ++ return_ACPI_STATUS(AE_NO_NAMESPACE); ++ } + } + + /* Null child means "get first node" */ +diff --git a/drivers/acpi/apei/bert.c b/drivers/acpi/apei/bert.c +index 1155fb9dcc3ad..76b7539a37a93 100644 +--- a/drivers/acpi/apei/bert.c ++++ b/drivers/acpi/apei/bert.c +@@ -29,6 +29,7 @@ + + #undef pr_fmt + #define pr_fmt(fmt) "BERT: " fmt ++#define ACPI_BERT_PRINT_MAX_LEN 1024 + + static int bert_disable; + +@@ -58,8 +59,11 @@ static void __init bert_print_all(struct acpi_bert_region *region, + } + + pr_info_once("Error records from previous boot:\n"); +- +- cper_estatus_print(KERN_INFO HW_ERR, estatus); ++ if (region_len < ACPI_BERT_PRINT_MAX_LEN) ++ cper_estatus_print(KERN_INFO HW_ERR, estatus); ++ else ++ pr_info_once("Max print length exceeded, table data is available at:\n" ++ "/sys/firmware/acpi/tables/data/BERT"); + + /* + * Because the boot error source is "one-time polled" type, +@@ -77,7 +81,7 @@ static int __init setup_bert_disable(char *str) + { + bert_disable = 1; + +- return 0; ++ return 1; + } + __setup("bert_disable", setup_bert_disable); + +diff --git a/drivers/acpi/apei/erst.c b/drivers/acpi/apei/erst.c +index 2015a0967cbbf..5ee3cb7fcd906 100644 +--- a/drivers/acpi/apei/erst.c ++++ b/drivers/acpi/apei/erst.c +@@ -891,7 +891,7 @@ EXPORT_SYMBOL_GPL(erst_clear); + static int __init setup_erst_disable(char *str) + { + erst_disable = 1; +- return 0; ++ return 1; + } + + __setup("erst_disable", setup_erst_disable); +diff --git a/drivers/acpi/apei/hest.c b/drivers/acpi/apei/hest.c +index 267bdbf6a7bf0..add6416e78f23 100644 +--- a/drivers/acpi/apei/hest.c ++++ b/drivers/acpi/apei/hest.c +@@ -219,7 +219,7 @@ err: + static int __init setup_hest_disable(char *str) + { + hest_disable = HEST_DISABLED; +- return 0; ++ return 1; + } + + __setup("hest_disable", setup_hest_disable); +diff --git a/drivers/acpi/cppc_acpi.c b/drivers/acpi/cppc_acpi.c +index 2826bd45c61a1..0521b1d4c2fd0 100644 +--- a/drivers/acpi/cppc_acpi.c ++++ b/drivers/acpi/cppc_acpi.c +@@ -738,6 +738,11 @@ int acpi_cppc_processor_probe(struct acpi_processor *pr) + cpc_obj = &out_obj->package.elements[0]; + if (cpc_obj->type == ACPI_TYPE_INTEGER) { + num_ent = cpc_obj->integer.value; ++ if (num_ent <= 1) { ++ pr_debug("Unexpected _CPC NumEntries value (%d) for CPU:%d\n", ++ num_ent, pr->id); ++ goto out_free; ++ } + } else { + pr_debug("Unexpected entry type(%d) for NumEntries\n", + cpc_obj->type); +diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c +index 53ae679c00f01..0ea5e677f00ee 100644 +--- a/drivers/acpi/processor_idle.c ++++ b/drivers/acpi/processor_idle.c +@@ -1201,6 +1201,11 @@ static int flatten_lpi_states(struct acpi_processor *pr, + return 0; + } + ++int __weak acpi_processor_ffh_lpi_probe(unsigned int cpu) ++{ ++ return -EOPNOTSUPP; ++} ++ + static int acpi_processor_get_lpi_info(struct acpi_processor *pr) + { + int ret, i; +@@ -1209,6 +1214,11 @@ static int acpi_processor_get_lpi_info(struct acpi_processor *pr) + struct acpi_device *d = NULL; + struct acpi_lpi_states_array info[2], *tmp, *prev, *curr; + ++ /* make sure our architecture has support */ ++ ret = acpi_processor_ffh_lpi_probe(pr->id); ++ if (ret == -EOPNOTSUPP) ++ return ret; ++ + if (!osc_pc_lpi_support_confirmed) + return -EOPNOTSUPP; + +@@ -1260,11 +1270,6 @@ static int acpi_processor_get_lpi_info(struct acpi_processor *pr) + return 0; + } + +-int __weak acpi_processor_ffh_lpi_probe(unsigned int cpu) +-{ +- return -ENODEV; +-} +- + int __weak acpi_processor_ffh_lpi_enter(struct acpi_lpi_state *lpi) + { + return -ENODEV; +diff --git a/drivers/acpi/property.c b/drivers/acpi/property.c +index a08e3eb2a6f9f..a4b7cdd0c8446 100644 +--- a/drivers/acpi/property.c ++++ b/drivers/acpi/property.c +@@ -692,7 +692,7 @@ int __acpi_node_get_property_reference(const struct fwnode_handle *fwnode, + */ + if (obj->type == ACPI_TYPE_LOCAL_REFERENCE) { + if (index) +- return -EINVAL; ++ return -ENOENT; + + ret = acpi_bus_get_device(obj->reference.handle, &device); + if (ret) +diff --git a/drivers/ata/sata_dwc_460ex.c b/drivers/ata/sata_dwc_460ex.c +index 982fe91125322..464260f668708 100644 +--- a/drivers/ata/sata_dwc_460ex.c ++++ b/drivers/ata/sata_dwc_460ex.c +@@ -145,7 +145,11 @@ struct sata_dwc_device { + #endif + }; + +-#define SATA_DWC_QCMD_MAX 32 ++/* ++ * Allow one extra special slot for commands and DMA management ++ * to account for libata internal commands. ++ */ ++#define SATA_DWC_QCMD_MAX (ATA_MAX_QUEUE + 1) + + struct sata_dwc_device_port { + struct sata_dwc_device *hsdev; +diff --git a/drivers/base/dd.c b/drivers/base/dd.c +index cf7e5b4afc1be..26cd4ce3ac75f 100644 +--- a/drivers/base/dd.c ++++ b/drivers/base/dd.c +@@ -747,7 +747,7 @@ static int __init save_async_options(char *buf) + "Too long list of driver names for 'driver_async_probe'!\n"); + + strlcpy(async_probe_drv_names, buf, ASYNC_DRV_NAMES_MAX_LEN); +- return 0; ++ return 1; + } + __setup("driver_async_probe=", save_async_options); + +diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c +index 23af545120534..ae382c4018fd8 100644 +--- a/drivers/base/power/main.c ++++ b/drivers/base/power/main.c +@@ -2121,7 +2121,9 @@ static bool pm_ops_is_empty(const struct dev_pm_ops *ops) + + void device_pm_check_callbacks(struct device *dev) + { +- spin_lock_irq(&dev->power.lock); ++ unsigned long flags; ++ ++ spin_lock_irqsave(&dev->power.lock, flags); + dev->power.no_pm_callbacks = + (!dev->bus || (pm_ops_is_empty(dev->bus->pm) && + !dev->bus->suspend && !dev->bus->resume)) && +@@ -2130,7 +2132,7 @@ void device_pm_check_callbacks(struct device *dev) + (!dev->pm_domain || pm_ops_is_empty(&dev->pm_domain->ops)) && + (!dev->driver || (pm_ops_is_empty(dev->driver->pm) && + !dev->driver->suspend && !dev->driver->resume)); +- spin_unlock_irq(&dev->power.lock); ++ spin_unlock_irqrestore(&dev->power.lock, flags); + } + + bool dev_pm_smart_suspend_and_suspended(struct device *dev) +diff --git a/drivers/block/drbd/drbd_int.h b/drivers/block/drbd/drbd_int.h +index ddbf56014c51a..6da7f5749a7c4 100644 +--- a/drivers/block/drbd/drbd_int.h ++++ b/drivers/block/drbd/drbd_int.h +@@ -1673,22 +1673,22 @@ struct sib_info { + }; + void drbd_bcast_event(struct drbd_device *device, const struct sib_info *sib); + +-extern void notify_resource_state(struct sk_buff *, ++extern int notify_resource_state(struct sk_buff *, + unsigned int, + struct drbd_resource *, + struct resource_info *, + enum drbd_notification_type); +-extern void notify_device_state(struct sk_buff *, ++extern int notify_device_state(struct sk_buff *, + unsigned int, + struct drbd_device *, + struct device_info *, + enum drbd_notification_type); +-extern void notify_connection_state(struct sk_buff *, ++extern int notify_connection_state(struct sk_buff *, + unsigned int, + struct drbd_connection *, + struct connection_info *, + enum drbd_notification_type); +-extern void notify_peer_device_state(struct sk_buff *, ++extern int notify_peer_device_state(struct sk_buff *, + unsigned int, + struct drbd_peer_device *, + struct peer_device_info *, +diff --git a/drivers/block/drbd/drbd_nl.c b/drivers/block/drbd/drbd_nl.c +index 5d52a2d321559..bfb00d3b091f1 100644 +--- a/drivers/block/drbd/drbd_nl.c ++++ b/drivers/block/drbd/drbd_nl.c +@@ -4630,7 +4630,7 @@ static int nla_put_notification_header(struct sk_buff *msg, + return drbd_notification_header_to_skb(msg, &nh, true); + } + +-void notify_resource_state(struct sk_buff *skb, ++int notify_resource_state(struct sk_buff *skb, + unsigned int seq, + struct drbd_resource *resource, + struct resource_info *resource_info, +@@ -4672,16 +4672,17 @@ void notify_resource_state(struct sk_buff *skb, + if (err && err != -ESRCH) + goto failed; + } +- return; ++ return 0; + + nla_put_failure: + nlmsg_free(skb); + failed: + drbd_err(resource, "Error %d while broadcasting event. Event seq:%u\n", + err, seq); ++ return err; + } + +-void notify_device_state(struct sk_buff *skb, ++int notify_device_state(struct sk_buff *skb, + unsigned int seq, + struct drbd_device *device, + struct device_info *device_info, +@@ -4721,16 +4722,17 @@ void notify_device_state(struct sk_buff *skb, + if (err && err != -ESRCH) + goto failed; + } +- return; ++ return 0; + + nla_put_failure: + nlmsg_free(skb); + failed: + drbd_err(device, "Error %d while broadcasting event. Event seq:%u\n", + err, seq); ++ return err; + } + +-void notify_connection_state(struct sk_buff *skb, ++int notify_connection_state(struct sk_buff *skb, + unsigned int seq, + struct drbd_connection *connection, + struct connection_info *connection_info, +@@ -4770,16 +4772,17 @@ void notify_connection_state(struct sk_buff *skb, + if (err && err != -ESRCH) + goto failed; + } +- return; ++ return 0; + + nla_put_failure: + nlmsg_free(skb); + failed: + drbd_err(connection, "Error %d while broadcasting event. Event seq:%u\n", + err, seq); ++ return err; + } + +-void notify_peer_device_state(struct sk_buff *skb, ++int notify_peer_device_state(struct sk_buff *skb, + unsigned int seq, + struct drbd_peer_device *peer_device, + struct peer_device_info *peer_device_info, +@@ -4820,13 +4823,14 @@ void notify_peer_device_state(struct sk_buff *skb, + if (err && err != -ESRCH) + goto failed; + } +- return; ++ return 0; + + nla_put_failure: + nlmsg_free(skb); + failed: + drbd_err(peer_device, "Error %d while broadcasting event. Event seq:%u\n", + err, seq); ++ return err; + } + + void notify_helper(enum drbd_notification_type type, +@@ -4877,7 +4881,7 @@ fail: + err, seq); + } + +-static void notify_initial_state_done(struct sk_buff *skb, unsigned int seq) ++static int notify_initial_state_done(struct sk_buff *skb, unsigned int seq) + { + struct drbd_genlmsghdr *dh; + int err; +@@ -4891,11 +4895,12 @@ static void notify_initial_state_done(struct sk_buff *skb, unsigned int seq) + if (nla_put_notification_header(skb, NOTIFY_EXISTS)) + goto nla_put_failure; + genlmsg_end(skb, dh); +- return; ++ return 0; + + nla_put_failure: + nlmsg_free(skb); + pr_err("Error %d sending event. Event seq:%u\n", err, seq); ++ return err; + } + + static void free_state_changes(struct list_head *list) +@@ -4922,6 +4927,7 @@ static int get_initial_state(struct sk_buff *skb, struct netlink_callback *cb) + unsigned int seq = cb->args[2]; + unsigned int n; + enum drbd_notification_type flags = 0; ++ int err = 0; + + /* There is no need for taking notification_mutex here: it doesn't + matter if the initial state events mix with later state chage +@@ -4930,32 +4936,32 @@ static int get_initial_state(struct sk_buff *skb, struct netlink_callback *cb) + + cb->args[5]--; + if (cb->args[5] == 1) { +- notify_initial_state_done(skb, seq); ++ err = notify_initial_state_done(skb, seq); + goto out; + } + n = cb->args[4]++; + if (cb->args[4] < cb->args[3]) + flags |= NOTIFY_CONTINUES; + if (n < 1) { +- notify_resource_state_change(skb, seq, state_change->resource, ++ err = notify_resource_state_change(skb, seq, state_change->resource, + NOTIFY_EXISTS | flags); + goto next; + } + n--; + if (n < state_change->n_connections) { +- notify_connection_state_change(skb, seq, &state_change->connections[n], ++ err = notify_connection_state_change(skb, seq, &state_change->connections[n], + NOTIFY_EXISTS | flags); + goto next; + } + n -= state_change->n_connections; + if (n < state_change->n_devices) { +- notify_device_state_change(skb, seq, &state_change->devices[n], ++ err = notify_device_state_change(skb, seq, &state_change->devices[n], + NOTIFY_EXISTS | flags); + goto next; + } + n -= state_change->n_devices; + if (n < state_change->n_devices * state_change->n_connections) { +- notify_peer_device_state_change(skb, seq, &state_change->peer_devices[n], ++ err = notify_peer_device_state_change(skb, seq, &state_change->peer_devices[n], + NOTIFY_EXISTS | flags); + goto next; + } +@@ -4970,7 +4976,10 @@ next: + cb->args[4] = 0; + } + out: +- return skb->len; ++ if (err) ++ return err; ++ else ++ return skb->len; + } + + int drbd_adm_get_initial_state(struct sk_buff *skb, struct netlink_callback *cb) +diff --git a/drivers/block/drbd/drbd_req.c b/drivers/block/drbd/drbd_req.c +index f86cea4c0f8df..5e92632881d81 100644 +--- a/drivers/block/drbd/drbd_req.c ++++ b/drivers/block/drbd/drbd_req.c +@@ -195,7 +195,8 @@ void start_new_tl_epoch(struct drbd_connection *connection) + void complete_master_bio(struct drbd_device *device, + struct bio_and_error *m) + { +- m->bio->bi_status = errno_to_blk_status(m->error); ++ if (unlikely(m->error)) ++ m->bio->bi_status = errno_to_blk_status(m->error); + bio_endio(m->bio); + dec_ap_bio(device); + } +diff --git a/drivers/block/drbd/drbd_state.c b/drivers/block/drbd/drbd_state.c +index eeaa3b49b2649..4dad4dd0ceb66 100644 +--- a/drivers/block/drbd/drbd_state.c ++++ b/drivers/block/drbd/drbd_state.c +@@ -1537,7 +1537,7 @@ int drbd_bitmap_io_from_worker(struct drbd_device *device, + return rv; + } + +-void notify_resource_state_change(struct sk_buff *skb, ++int notify_resource_state_change(struct sk_buff *skb, + unsigned int seq, + struct drbd_resource_state_change *resource_state_change, + enum drbd_notification_type type) +@@ -1550,10 +1550,10 @@ void notify_resource_state_change(struct sk_buff *skb, + .res_susp_fen = resource_state_change->susp_fen[NEW], + }; + +- notify_resource_state(skb, seq, resource, &resource_info, type); ++ return notify_resource_state(skb, seq, resource, &resource_info, type); + } + +-void notify_connection_state_change(struct sk_buff *skb, ++int notify_connection_state_change(struct sk_buff *skb, + unsigned int seq, + struct drbd_connection_state_change *connection_state_change, + enum drbd_notification_type type) +@@ -1564,10 +1564,10 @@ void notify_connection_state_change(struct sk_buff *skb, + .conn_role = connection_state_change->peer_role[NEW], + }; + +- notify_connection_state(skb, seq, connection, &connection_info, type); ++ return notify_connection_state(skb, seq, connection, &connection_info, type); + } + +-void notify_device_state_change(struct sk_buff *skb, ++int notify_device_state_change(struct sk_buff *skb, + unsigned int seq, + struct drbd_device_state_change *device_state_change, + enum drbd_notification_type type) +@@ -1577,10 +1577,10 @@ void notify_device_state_change(struct sk_buff *skb, + .dev_disk_state = device_state_change->disk_state[NEW], + }; + +- notify_device_state(skb, seq, device, &device_info, type); ++ return notify_device_state(skb, seq, device, &device_info, type); + } + +-void notify_peer_device_state_change(struct sk_buff *skb, ++int notify_peer_device_state_change(struct sk_buff *skb, + unsigned int seq, + struct drbd_peer_device_state_change *p, + enum drbd_notification_type type) +@@ -1594,7 +1594,7 @@ void notify_peer_device_state_change(struct sk_buff *skb, + .peer_resync_susp_dependency = p->resync_susp_dependency[NEW], + }; + +- notify_peer_device_state(skb, seq, peer_device, &peer_device_info, type); ++ return notify_peer_device_state(skb, seq, peer_device, &peer_device_info, type); + } + + static void broadcast_state_change(struct drbd_state_change *state_change) +@@ -1602,7 +1602,7 @@ static void broadcast_state_change(struct drbd_state_change *state_change) + struct drbd_resource_state_change *resource_state_change = &state_change->resource[0]; + bool resource_state_has_changed; + unsigned int n_device, n_connection, n_peer_device, n_peer_devices; +- void (*last_func)(struct sk_buff *, unsigned int, void *, ++ int (*last_func)(struct sk_buff *, unsigned int, void *, + enum drbd_notification_type) = NULL; + void *uninitialized_var(last_arg); + +diff --git a/drivers/block/drbd/drbd_state_change.h b/drivers/block/drbd/drbd_state_change.h +index ba80f612d6abb..d5b0479bc9a66 100644 +--- a/drivers/block/drbd/drbd_state_change.h ++++ b/drivers/block/drbd/drbd_state_change.h +@@ -44,19 +44,19 @@ extern struct drbd_state_change *remember_old_state(struct drbd_resource *, gfp_ + extern void copy_old_to_new_state_change(struct drbd_state_change *); + extern void forget_state_change(struct drbd_state_change *); + +-extern void notify_resource_state_change(struct sk_buff *, ++extern int notify_resource_state_change(struct sk_buff *, + unsigned int, + struct drbd_resource_state_change *, + enum drbd_notification_type type); +-extern void notify_connection_state_change(struct sk_buff *, ++extern int notify_connection_state_change(struct sk_buff *, + unsigned int, + struct drbd_connection_state_change *, + enum drbd_notification_type type); +-extern void notify_device_state_change(struct sk_buff *, ++extern int notify_device_state_change(struct sk_buff *, + unsigned int, + struct drbd_device_state_change *, + enum drbd_notification_type type); +-extern void notify_peer_device_state_change(struct sk_buff *, ++extern int notify_peer_device_state_change(struct sk_buff *, + unsigned int, + struct drbd_peer_device_state_change *, + enum drbd_notification_type type); +diff --git a/drivers/block/loop.c b/drivers/block/loop.c +index ffbe792410d1c..6b3e27b8cd245 100644 +--- a/drivers/block/loop.c ++++ b/drivers/block/loop.c +@@ -794,33 +794,33 @@ static ssize_t loop_attr_backing_file_show(struct loop_device *lo, char *buf) + + static ssize_t loop_attr_offset_show(struct loop_device *lo, char *buf) + { +- return sprintf(buf, "%llu\n", (unsigned long long)lo->lo_offset); ++ return sysfs_emit(buf, "%llu\n", (unsigned long long)lo->lo_offset); + } + + static ssize_t loop_attr_sizelimit_show(struct loop_device *lo, char *buf) + { +- return sprintf(buf, "%llu\n", (unsigned long long)lo->lo_sizelimit); ++ return sysfs_emit(buf, "%llu\n", (unsigned long long)lo->lo_sizelimit); + } + + static ssize_t loop_attr_autoclear_show(struct loop_device *lo, char *buf) + { + int autoclear = (lo->lo_flags & LO_FLAGS_AUTOCLEAR); + +- return sprintf(buf, "%s\n", autoclear ? "1" : "0"); ++ return sysfs_emit(buf, "%s\n", autoclear ? "1" : "0"); + } + + static ssize_t loop_attr_partscan_show(struct loop_device *lo, char *buf) + { + int partscan = (lo->lo_flags & LO_FLAGS_PARTSCAN); + +- return sprintf(buf, "%s\n", partscan ? "1" : "0"); ++ return sysfs_emit(buf, "%s\n", partscan ? "1" : "0"); + } + + static ssize_t loop_attr_dio_show(struct loop_device *lo, char *buf) + { + int dio = (lo->lo_flags & LO_FLAGS_DIRECT_IO); + +- return sprintf(buf, "%s\n", dio ? "1" : "0"); ++ return sysfs_emit(buf, "%s\n", dio ? "1" : "0"); + } + + LOOP_ATTR_RO(backing_file); +diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c +index 4b3645e648ee9..2a5cd502feae7 100644 +--- a/drivers/block/virtio_blk.c ++++ b/drivers/block/virtio_blk.c +@@ -936,9 +936,17 @@ static int virtblk_probe(struct virtio_device *vdev) + err = virtio_cread_feature(vdev, VIRTIO_BLK_F_BLK_SIZE, + struct virtio_blk_config, blk_size, + &blk_size); +- if (!err) ++ if (!err) { ++ err = blk_validate_block_size(blk_size); ++ if (err) { ++ dev_err(&vdev->dev, ++ "virtio_blk: invalid block size: 0x%x\n", ++ blk_size); ++ goto out_free_tags; ++ } ++ + blk_queue_logical_block_size(q, blk_size); +- else ++ } else + blk_size = queue_logical_block_size(q); + + /* Use topology information if available */ +diff --git a/drivers/bluetooth/btmtksdio.c b/drivers/bluetooth/btmtksdio.c +index c2eb64bcd5d5d..0e7f44461946e 100644 +--- a/drivers/bluetooth/btmtksdio.c ++++ b/drivers/bluetooth/btmtksdio.c +@@ -980,6 +980,8 @@ static int btmtksdio_probe(struct sdio_func *func, + hdev->manufacturer = 70; + set_bit(HCI_QUIRK_NON_PERSISTENT_SETUP, &hdev->quirks); + ++ sdio_set_drvdata(func, bdev); ++ + err = hci_register_dev(hdev); + if (err < 0) { + dev_err(&func->dev, "Can't register HCI device\n"); +@@ -987,8 +989,6 @@ static int btmtksdio_probe(struct sdio_func *func, + return err; + } + +- sdio_set_drvdata(func, bdev); +- + /* pm_runtime_enable would be done after the firmware is being + * downloaded because the core layer probably already enables + * runtime PM for this func such as the case host->caps & +diff --git a/drivers/bluetooth/hci_serdev.c b/drivers/bluetooth/hci_serdev.c +index 1b4ad231e6ed3..fd081bdd2dd8a 100644 +--- a/drivers/bluetooth/hci_serdev.c ++++ b/drivers/bluetooth/hci_serdev.c +@@ -279,6 +279,8 @@ int hci_uart_register_device(struct hci_uart *hu, + if (err) + return err; + ++ percpu_init_rwsem(&hu->proto_lock); ++ + err = p->open(hu); + if (err) + goto err_open; +@@ -301,7 +303,6 @@ int hci_uart_register_device(struct hci_uart *hu, + + INIT_WORK(&hu->init_ready, hci_uart_init_work); + INIT_WORK(&hu->write_work, hci_uart_write_work); +- percpu_init_rwsem(&hu->proto_lock); + + /* Only when vendor specific setup callback is provided, consider + * the manufacturer information valid. This avoids filling in the +diff --git a/drivers/char/hw_random/atmel-rng.c b/drivers/char/hw_random/atmel-rng.c +index e55705745d5e4..f4c94f8acfe0d 100644 +--- a/drivers/char/hw_random/atmel-rng.c ++++ b/drivers/char/hw_random/atmel-rng.c +@@ -96,6 +96,7 @@ static int atmel_trng_probe(struct platform_device *pdev) + + err_register: + clk_disable_unprepare(trng->clk); ++ atmel_trng_disable(trng); + return ret; + } + +diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c +index 1838039b03333..17fbd7f7a2954 100644 +--- a/drivers/char/tpm/tpm-chip.c ++++ b/drivers/char/tpm/tpm-chip.c +@@ -274,14 +274,6 @@ static void tpm_dev_release(struct device *dev) + kfree(chip); + } + +-static void tpm_devs_release(struct device *dev) +-{ +- struct tpm_chip *chip = container_of(dev, struct tpm_chip, devs); +- +- /* release the master device reference */ +- put_device(&chip->dev); +-} +- + /** + * tpm_class_shutdown() - prepare the TPM device for loss of power. + * @dev: device to which the chip is associated. +@@ -344,7 +336,6 @@ struct tpm_chip *tpm_chip_alloc(struct device *pdev, + chip->dev_num = rc; + + device_initialize(&chip->dev); +- device_initialize(&chip->devs); + + chip->dev.class = tpm_class; + chip->dev.class->shutdown_pre = tpm_class_shutdown; +@@ -352,29 +343,12 @@ struct tpm_chip *tpm_chip_alloc(struct device *pdev, + chip->dev.parent = pdev; + chip->dev.groups = chip->groups; + +- chip->devs.parent = pdev; +- chip->devs.class = tpmrm_class; +- chip->devs.release = tpm_devs_release; +- /* get extra reference on main device to hold on +- * behalf of devs. This holds the chip structure +- * while cdevs is in use. The corresponding put +- * is in the tpm_devs_release (TPM2 only) +- */ +- if (chip->flags & TPM_CHIP_FLAG_TPM2) +- get_device(&chip->dev); +- + if (chip->dev_num == 0) + chip->dev.devt = MKDEV(MISC_MAJOR, TPM_MINOR); + else + chip->dev.devt = MKDEV(MAJOR(tpm_devt), chip->dev_num); + +- chip->devs.devt = +- MKDEV(MAJOR(tpm_devt), chip->dev_num + TPM_NUM_DEVICES); +- + rc = dev_set_name(&chip->dev, "tpm%d", chip->dev_num); +- if (rc) +- goto out; +- rc = dev_set_name(&chip->devs, "tpmrm%d", chip->dev_num); + if (rc) + goto out; + +@@ -382,9 +356,7 @@ struct tpm_chip *tpm_chip_alloc(struct device *pdev, + chip->flags |= TPM_CHIP_FLAG_VIRTUAL; + + cdev_init(&chip->cdev, &tpm_fops); +- cdev_init(&chip->cdevs, &tpmrm_fops); + chip->cdev.owner = THIS_MODULE; +- chip->cdevs.owner = THIS_MODULE; + + rc = tpm2_init_space(&chip->work_space, TPM2_SPACE_BUFFER_SIZE); + if (rc) { +@@ -396,7 +368,6 @@ struct tpm_chip *tpm_chip_alloc(struct device *pdev, + return chip; + + out: +- put_device(&chip->devs); + put_device(&chip->dev); + return ERR_PTR(rc); + } +@@ -445,14 +416,9 @@ static int tpm_add_char_device(struct tpm_chip *chip) + } + + if (chip->flags & TPM_CHIP_FLAG_TPM2) { +- rc = cdev_device_add(&chip->cdevs, &chip->devs); +- if (rc) { +- dev_err(&chip->devs, +- "unable to cdev_device_add() %s, major %d, minor %d, err=%d\n", +- dev_name(&chip->devs), MAJOR(chip->devs.devt), +- MINOR(chip->devs.devt), rc); +- return rc; +- } ++ rc = tpm_devs_add(chip); ++ if (rc) ++ goto err_del_cdev; + } + + /* Make the chip available. */ +@@ -460,6 +426,10 @@ static int tpm_add_char_device(struct tpm_chip *chip) + idr_replace(&dev_nums_idr, chip, chip->dev_num); + mutex_unlock(&idr_lock); + ++ return 0; ++ ++err_del_cdev: ++ cdev_device_del(&chip->cdev, &chip->dev); + return rc; + } + +@@ -641,7 +611,7 @@ void tpm_chip_unregister(struct tpm_chip *chip) + hwrng_unregister(&chip->hwrng); + tpm_bios_log_teardown(chip); + if (chip->flags & TPM_CHIP_FLAG_TPM2) +- cdev_device_del(&chip->cdevs, &chip->devs); ++ tpm_devs_remove(chip); + tpm_del_char_device(chip); + } + EXPORT_SYMBOL_GPL(tpm_chip_unregister); +diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h +index 37f010421a369..58312062d435c 100644 +--- a/drivers/char/tpm/tpm.h ++++ b/drivers/char/tpm/tpm.h +@@ -466,6 +466,8 @@ int tpm2_prepare_space(struct tpm_chip *chip, struct tpm_space *space, u8 *cmd, + size_t cmdsiz); + int tpm2_commit_space(struct tpm_chip *chip, struct tpm_space *space, void *buf, + size_t *bufsiz); ++int tpm_devs_add(struct tpm_chip *chip); ++void tpm_devs_remove(struct tpm_chip *chip); + + void tpm_bios_log_setup(struct tpm_chip *chip); + void tpm_bios_log_teardown(struct tpm_chip *chip); +diff --git a/drivers/char/tpm/tpm2-space.c b/drivers/char/tpm/tpm2-space.c +index d2225020e4d2c..ffb35f0154c16 100644 +--- a/drivers/char/tpm/tpm2-space.c ++++ b/drivers/char/tpm/tpm2-space.c +@@ -574,3 +574,68 @@ out: + dev_err(&chip->dev, "%s: error %d\n", __func__, rc); + return rc; + } ++ ++/* ++ * Put the reference to the main device. ++ */ ++static void tpm_devs_release(struct device *dev) ++{ ++ struct tpm_chip *chip = container_of(dev, struct tpm_chip, devs); ++ ++ /* release the master device reference */ ++ put_device(&chip->dev); ++} ++ ++/* ++ * Remove the device file for exposed TPM spaces and release the device ++ * reference. This may also release the reference to the master device. ++ */ ++void tpm_devs_remove(struct tpm_chip *chip) ++{ ++ cdev_device_del(&chip->cdevs, &chip->devs); ++ put_device(&chip->devs); ++} ++ ++/* ++ * Add a device file to expose TPM spaces. Also take a reference to the ++ * main device. ++ */ ++int tpm_devs_add(struct tpm_chip *chip) ++{ ++ int rc; ++ ++ device_initialize(&chip->devs); ++ chip->devs.parent = chip->dev.parent; ++ chip->devs.class = tpmrm_class; ++ ++ /* ++ * Get extra reference on main device to hold on behalf of devs. ++ * This holds the chip structure while cdevs is in use. The ++ * corresponding put is in the tpm_devs_release. ++ */ ++ get_device(&chip->dev); ++ chip->devs.release = tpm_devs_release; ++ chip->devs.devt = MKDEV(MAJOR(tpm_devt), chip->dev_num + TPM_NUM_DEVICES); ++ cdev_init(&chip->cdevs, &tpmrm_fops); ++ chip->cdevs.owner = THIS_MODULE; ++ ++ rc = dev_set_name(&chip->devs, "tpmrm%d", chip->dev_num); ++ if (rc) ++ goto err_put_devs; ++ ++ rc = cdev_device_add(&chip->cdevs, &chip->devs); ++ if (rc) { ++ dev_err(&chip->devs, ++ "unable to cdev_device_add() %s, major %d, minor %d, err=%d\n", ++ dev_name(&chip->devs), MAJOR(chip->devs.devt), ++ MINOR(chip->devs.devt), rc); ++ goto err_put_devs; ++ } ++ ++ return 0; ++ ++err_put_devs: ++ put_device(&chip->devs); ++ ++ return rc; ++} +diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c +index b453029487a12..c736adef9d3c8 100644 +--- a/drivers/char/virtio_console.c ++++ b/drivers/char/virtio_console.c +@@ -1961,6 +1961,13 @@ static void virtcons_remove(struct virtio_device *vdev) + list_del(&portdev->list); + spin_unlock_irq(&pdrvdata_lock); + ++ /* Device is going away, exit any polling for buffers */ ++ virtio_break_device(vdev); ++ if (use_multiport(portdev)) ++ flush_work(&portdev->control_work); ++ else ++ flush_work(&portdev->config_work); ++ + /* Disable interrupts for vqs */ + vdev->config->reset(vdev); + /* Finish up work that's lined up */ +@@ -2234,7 +2241,7 @@ static struct virtio_driver virtio_rproc_serial = { + .remove = virtcons_remove, + }; + +-static int __init init(void) ++static int __init virtio_console_init(void) + { + int err; + +@@ -2271,7 +2278,7 @@ free: + return err; + } + +-static void __exit fini(void) ++static void __exit virtio_console_fini(void) + { + reclaim_dma_bufs(); + +@@ -2281,8 +2288,8 @@ static void __exit fini(void) + class_destroy(pdrvdata.class); + debugfs_remove_recursive(pdrvdata.debugfs_dir); + } +-module_init(init); +-module_exit(fini); ++module_init(virtio_console_init); ++module_exit(virtio_console_fini); + + MODULE_DESCRIPTION("Virtio console driver"); + MODULE_LICENSE("GPL"); +diff --git a/drivers/clk/actions/owl-s700.c b/drivers/clk/actions/owl-s700.c +index a2f34d13fb543..6ea7da1d6d755 100644 +--- a/drivers/clk/actions/owl-s700.c ++++ b/drivers/clk/actions/owl-s700.c +@@ -162,6 +162,7 @@ static struct clk_div_table hdmia_div_table[] = { + + static struct clk_div_table rmii_div_table[] = { + {0, 4}, {1, 10}, ++ {0, 0} + }; + + /* divider clocks */ +diff --git a/drivers/clk/actions/owl-s900.c b/drivers/clk/actions/owl-s900.c +index 790890978424a..5144ada2c7e1a 100644 +--- a/drivers/clk/actions/owl-s900.c ++++ b/drivers/clk/actions/owl-s900.c +@@ -140,7 +140,7 @@ static struct clk_div_table rmii_ref_div_table[] = { + + static struct clk_div_table usb3_mac_div_table[] = { + { 1, 2 }, { 2, 3 }, { 3, 4 }, +- { 0, 8 }, ++ { 0, 0 } + }; + + static struct clk_div_table i2s_div_table[] = { +diff --git a/drivers/clk/clk-clps711x.c b/drivers/clk/clk-clps711x.c +index a2c6486ef1708..f8417ee2961aa 100644 +--- a/drivers/clk/clk-clps711x.c ++++ b/drivers/clk/clk-clps711x.c +@@ -28,11 +28,13 @@ static const struct clk_div_table spi_div_table[] = { + { .val = 1, .div = 8, }, + { .val = 2, .div = 2, }, + { .val = 3, .div = 1, }, ++ { /* sentinel */ } + }; + + static const struct clk_div_table timer_div_table[] = { + { .val = 0, .div = 256, }, + { .val = 1, .div = 1, }, ++ { /* sentinel */ } + }; + + struct clps711x_clk { +diff --git a/drivers/clk/clk-si5341.c b/drivers/clk/clk-si5341.c +index 20ed0955416a3..07ef9995b3cb1 100644 +--- a/drivers/clk/clk-si5341.c ++++ b/drivers/clk/clk-si5341.c +@@ -638,6 +638,15 @@ static unsigned long si5341_output_clk_recalc_rate(struct clk_hw *hw, + u32 r_divider; + u8 r[3]; + ++ err = regmap_read(output->data->regmap, ++ SI5341_OUT_CONFIG(output), &val); ++ if (err < 0) ++ return err; ++ ++ /* If SI5341_OUT_CFG_RDIV_FORCE2 is set, r_divider is 2 */ ++ if (val & SI5341_OUT_CFG_RDIV_FORCE2) ++ return parent_rate / 2; ++ + err = regmap_bulk_read(output->data->regmap, + SI5341_OUT_R_REG(output), r, 3); + if (err < 0) +@@ -654,13 +663,6 @@ static unsigned long si5341_output_clk_recalc_rate(struct clk_hw *hw, + r_divider += 1; + r_divider <<= 1; + +- err = regmap_read(output->data->regmap, +- SI5341_OUT_CONFIG(output), &val); +- if (err < 0) +- return err; +- +- if (val & SI5341_OUT_CFG_RDIV_FORCE2) +- r_divider = 2; + + return parent_rate / r_divider; + } +diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c +index e4e1b4e94a67b..13332f89e034b 100644 +--- a/drivers/clk/clk.c ++++ b/drivers/clk/clk.c +@@ -637,6 +637,24 @@ static void clk_core_get_boundaries(struct clk_core *core, + *max_rate = min(*max_rate, clk_user->max_rate); + } + ++static bool clk_core_check_boundaries(struct clk_core *core, ++ unsigned long min_rate, ++ unsigned long max_rate) ++{ ++ struct clk *user; ++ ++ lockdep_assert_held(&prepare_lock); ++ ++ if (min_rate > core->max_rate || max_rate < core->min_rate) ++ return false; ++ ++ hlist_for_each_entry(user, &core->clks, clks_node) ++ if (min_rate > user->max_rate || max_rate < user->min_rate) ++ return false; ++ ++ return true; ++} ++ + void clk_hw_set_rate_range(struct clk_hw *hw, unsigned long min_rate, + unsigned long max_rate) + { +@@ -2306,6 +2324,11 @@ int clk_set_rate_range(struct clk *clk, unsigned long min, unsigned long max) + clk->min_rate = min; + clk->max_rate = max; + ++ if (!clk_core_check_boundaries(clk->core, min, max)) { ++ ret = -EINVAL; ++ goto out; ++ } ++ + rate = clk_core_get_rate_nolock(clk->core); + if (rate < min || rate > max) { + /* +@@ -2334,6 +2357,7 @@ int clk_set_rate_range(struct clk *clk, unsigned long min, unsigned long max) + } + } + ++out: + if (clk->exclusive_count) + clk_core_rate_protect(clk->core); + +@@ -3278,6 +3302,19 @@ static void clk_core_reparent_orphans_nolock(void) + __clk_set_parent_after(orphan, parent, NULL); + __clk_recalc_accuracies(orphan); + __clk_recalc_rates(orphan, 0); ++ ++ /* ++ * __clk_init_parent() will set the initial req_rate to ++ * 0 if the clock doesn't have clk_ops::recalc_rate and ++ * is an orphan when it's registered. ++ * ++ * 'req_rate' is used by clk_set_rate_range() and ++ * clk_put() to trigger a clk_set_rate() call whenever ++ * the boundaries are modified. Let's make sure ++ * 'req_rate' is set to something non-zero so that ++ * clk_set_rate_range() doesn't drop the frequency. ++ */ ++ orphan->req_rate = orphan->rate; + } + } + } +diff --git a/drivers/clk/imx/clk-imx7d.c b/drivers/clk/imx/clk-imx7d.c +index fbea774ef6877..58577548fe212 100644 +--- a/drivers/clk/imx/clk-imx7d.c ++++ b/drivers/clk/imx/clk-imx7d.c +@@ -859,7 +859,6 @@ static void __init imx7d_clocks_init(struct device_node *ccm_node) + hws[IMX7D_WDOG4_ROOT_CLK] = imx_clk_hw_gate4("wdog4_root_clk", "wdog_post_div", base + 0x49f0, 0); + hws[IMX7D_KPP_ROOT_CLK] = imx_clk_hw_gate4("kpp_root_clk", "ipg_root_clk", base + 0x4aa0, 0); + hws[IMX7D_CSI_MCLK_ROOT_CLK] = imx_clk_hw_gate4("csi_mclk_root_clk", "csi_mclk_post_div", base + 0x4490, 0); +- hws[IMX7D_AUDIO_MCLK_ROOT_CLK] = imx_clk_hw_gate4("audio_mclk_root_clk", "audio_mclk_post_div", base + 0x4790, 0); + hws[IMX7D_WRCLK_ROOT_CLK] = imx_clk_hw_gate4("wrclk_root_clk", "wrclk_post_div", base + 0x47a0, 0); + hws[IMX7D_USB_CTRL_CLK] = imx_clk_hw_gate4("usb_ctrl_clk", "ahb_root_clk", base + 0x4680, 0); + hws[IMX7D_USB_PHY1_CLK] = imx_clk_hw_gate4("usb_phy1_clk", "pll_usb1_main_clk", base + 0x46a0, 0); +diff --git a/drivers/clk/loongson1/clk-loongson1c.c b/drivers/clk/loongson1/clk-loongson1c.c +index 703f87622cf5f..1ebf740380efb 100644 +--- a/drivers/clk/loongson1/clk-loongson1c.c ++++ b/drivers/clk/loongson1/clk-loongson1c.c +@@ -37,6 +37,7 @@ static const struct clk_div_table ahb_div_table[] = { + [1] = { .val = 1, .div = 4 }, + [2] = { .val = 2, .div = 3 }, + [3] = { .val = 3, .div = 3 }, ++ [4] = { /* sentinel */ } + }; + + void __init ls1x_clk_init(void) +diff --git a/drivers/clk/qcom/clk-rcg2.c b/drivers/clk/qcom/clk-rcg2.c +index a88101480e337..89c1adeb84d44 100644 +--- a/drivers/clk/qcom/clk-rcg2.c ++++ b/drivers/clk/qcom/clk-rcg2.c +@@ -263,7 +263,7 @@ static int clk_rcg2_determine_floor_rate(struct clk_hw *hw, + + static int __clk_rcg2_configure(struct clk_rcg2 *rcg, const struct freq_tbl *f) + { +- u32 cfg, mask; ++ u32 cfg, mask, d_val, not2d_val, n_minus_m; + struct clk_hw *hw = &rcg->clkr.hw; + int ret, index = qcom_find_src_index(hw, rcg->parent_map, f->src); + +@@ -282,8 +282,17 @@ static int __clk_rcg2_configure(struct clk_rcg2 *rcg, const struct freq_tbl *f) + if (ret) + return ret; + ++ /* Calculate 2d value */ ++ d_val = f->n; ++ ++ n_minus_m = f->n - f->m; ++ n_minus_m *= 2; ++ ++ d_val = clamp_t(u32, d_val, f->m, n_minus_m); ++ not2d_val = ~d_val & mask; ++ + ret = regmap_update_bits(rcg->clkr.regmap, +- RCG_D_OFFSET(rcg), mask, ~f->n); ++ RCG_D_OFFSET(rcg), mask, not2d_val); + if (ret) + return ret; + } +@@ -638,6 +647,7 @@ static const struct frac_entry frac_table_pixel[] = { + { 2, 9 }, + { 4, 9 }, + { 1, 1 }, ++ { 2, 3 }, + { } + }; + +diff --git a/drivers/clk/qcom/gcc-ipq8074.c b/drivers/clk/qcom/gcc-ipq8074.c +index e01f5f591d1e2..de48ba7eba3a1 100644 +--- a/drivers/clk/qcom/gcc-ipq8074.c ++++ b/drivers/clk/qcom/gcc-ipq8074.c +@@ -1074,7 +1074,7 @@ static struct clk_rcg2 sdcc1_apps_clk_src = { + .name = "sdcc1_apps_clk_src", + .parent_names = gcc_xo_gpll0_gpll2_gpll0_out_main_div2, + .num_parents = 4, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_floor_ops, + }, + }; + +diff --git a/drivers/clk/qcom/gcc-msm8994.c b/drivers/clk/qcom/gcc-msm8994.c +index b7fc8c7ba1957..14f0d5d840802 100644 +--- a/drivers/clk/qcom/gcc-msm8994.c ++++ b/drivers/clk/qcom/gcc-msm8994.c +@@ -107,6 +107,7 @@ static struct clk_alpha_pll gpll4_early = { + + static struct clk_alpha_pll_postdiv gpll4 = { + .offset = 0x1dc0, ++ .width = 4, + .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT], + .clkr.hw.init = &(struct clk_init_data) + { +diff --git a/drivers/clk/tegra/clk-emc.c b/drivers/clk/tegra/clk-emc.c +index ea39caf3d7622..0c1b83bedb73d 100644 +--- a/drivers/clk/tegra/clk-emc.c ++++ b/drivers/clk/tegra/clk-emc.c +@@ -191,6 +191,7 @@ static struct tegra_emc *emc_ensure_emc_driver(struct tegra_clk_emc *tegra) + + tegra->emc = platform_get_drvdata(pdev); + if (!tegra->emc) { ++ put_device(&pdev->dev); + pr_err("%s: cannot find EMC driver\n", __func__); + return NULL; + } +diff --git a/drivers/clk/uniphier/clk-uniphier-fixed-rate.c b/drivers/clk/uniphier/clk-uniphier-fixed-rate.c +index 5319cd3804801..3bc55ab75314b 100644 +--- a/drivers/clk/uniphier/clk-uniphier-fixed-rate.c ++++ b/drivers/clk/uniphier/clk-uniphier-fixed-rate.c +@@ -24,6 +24,7 @@ struct clk_hw *uniphier_clk_register_fixed_rate(struct device *dev, + + init.name = name; + init.ops = &clk_fixed_rate_ops; ++ init.flags = 0; + init.parent_names = NULL; + init.num_parents = 0; + +diff --git a/drivers/clocksource/acpi_pm.c b/drivers/clocksource/acpi_pm.c +index eb596ff9e7bb3..279ddff81ab49 100644 +--- a/drivers/clocksource/acpi_pm.c ++++ b/drivers/clocksource/acpi_pm.c +@@ -229,8 +229,10 @@ static int __init parse_pmtmr(char *arg) + int ret; + + ret = kstrtouint(arg, 16, &base); +- if (ret) +- return ret; ++ if (ret) { ++ pr_warn("PMTMR: invalid 'pmtmr=' value: '%s'\n", arg); ++ return 1; ++ } + + pr_info("PMTMR IOPort override: 0x%04x -> 0x%04x\n", pmtmr_ioport, + base); +diff --git a/drivers/clocksource/timer-of.c b/drivers/clocksource/timer-of.c +index a3c73e972fce1..bf2a6f64ba0c5 100644 +--- a/drivers/clocksource/timer-of.c ++++ b/drivers/clocksource/timer-of.c +@@ -157,9 +157,9 @@ static __init int timer_of_base_init(struct device_node *np, + of_base->base = of_base->name ? + of_io_request_and_map(np, of_base->index, of_base->name) : + of_iomap(np, of_base->index); +- if (IS_ERR(of_base->base)) { +- pr_err("Failed to iomap (%s)\n", of_base->name); +- return PTR_ERR(of_base->base); ++ if (IS_ERR_OR_NULL(of_base->base)) { ++ pr_err("Failed to iomap (%s:%s)\n", np->name, of_base->name); ++ return of_base->base ? PTR_ERR(of_base->base) : -ENOMEM; + } + + return 0; +diff --git a/drivers/crypto/ccp/ccp-dmaengine.c b/drivers/crypto/ccp/ccp-dmaengine.c +index 0770a83bf1a57..b3eea329f840f 100644 +--- a/drivers/crypto/ccp/ccp-dmaengine.c ++++ b/drivers/crypto/ccp/ccp-dmaengine.c +@@ -633,6 +633,20 @@ static int ccp_terminate_all(struct dma_chan *dma_chan) + return 0; + } + ++static void ccp_dma_release(struct ccp_device *ccp) ++{ ++ struct ccp_dma_chan *chan; ++ struct dma_chan *dma_chan; ++ unsigned int i; ++ ++ for (i = 0; i < ccp->cmd_q_count; i++) { ++ chan = ccp->ccp_dma_chan + i; ++ dma_chan = &chan->dma_chan; ++ tasklet_kill(&chan->cleanup_tasklet); ++ list_del_rcu(&dma_chan->device_node); ++ } ++} ++ + int ccp_dmaengine_register(struct ccp_device *ccp) + { + struct ccp_dma_chan *chan; +@@ -737,6 +751,7 @@ int ccp_dmaengine_register(struct ccp_device *ccp) + return 0; + + err_reg: ++ ccp_dma_release(ccp); + kmem_cache_destroy(ccp->dma_desc_cache); + + err_cache: +@@ -753,6 +768,7 @@ void ccp_dmaengine_unregister(struct ccp_device *ccp) + return; + + dma_async_device_unregister(dma_dev); ++ ccp_dma_release(ccp); + + kmem_cache_destroy(ccp->dma_desc_cache); + kmem_cache_destroy(ccp->dma_cmd_cache); +diff --git a/drivers/crypto/ccree/cc_buffer_mgr.c b/drivers/crypto/ccree/cc_buffer_mgr.c +index 954f14bddf1d7..dce30ae2b7040 100644 +--- a/drivers/crypto/ccree/cc_buffer_mgr.c ++++ b/drivers/crypto/ccree/cc_buffer_mgr.c +@@ -295,6 +295,13 @@ static int cc_map_sg(struct device *dev, struct scatterlist *sg, + { + int ret = 0; + ++ if (!nbytes) { ++ *mapped_nents = 0; ++ *lbytes = 0; ++ *nents = 0; ++ return 0; ++ } ++ + *nents = cc_get_sgl_nents(dev, sg, nbytes, lbytes); + if (*nents > max_sg_nents) { + *nents = 0; +diff --git a/drivers/crypto/mxs-dcp.c b/drivers/crypto/mxs-dcp.c +index 5471110792071..9443f31acd27b 100644 +--- a/drivers/crypto/mxs-dcp.c ++++ b/drivers/crypto/mxs-dcp.c +@@ -329,7 +329,7 @@ static int mxs_dcp_aes_block_crypt(struct crypto_async_request *arq) + memset(key + AES_KEYSIZE_128, 0, AES_KEYSIZE_128); + } + +- for_each_sg(req->src, src, sg_nents(src), i) { ++ for_each_sg(req->src, src, sg_nents(req->src), i) { + src_buf = sg_virt(src); + len = sg_dma_len(src); + tlen += len; +diff --git a/drivers/crypto/vmx/Kconfig b/drivers/crypto/vmx/Kconfig +index c85fab7ef0bdd..b2c28b87f14b3 100644 +--- a/drivers/crypto/vmx/Kconfig ++++ b/drivers/crypto/vmx/Kconfig +@@ -2,7 +2,11 @@ + config CRYPTO_DEV_VMX_ENCRYPT + tristate "Encryption acceleration support on P8 CPU" + depends on CRYPTO_DEV_VMX ++ select CRYPTO_AES ++ select CRYPTO_CBC ++ select CRYPTO_CTR + select CRYPTO_GHASH ++ select CRYPTO_XTS + default m + help + Support for VMX cryptographic acceleration instructions on Power8 CPU. +diff --git a/drivers/dax/super.c b/drivers/dax/super.c +index 8074e5de815b9..5005b92b197d7 100644 +--- a/drivers/dax/super.c ++++ b/drivers/dax/super.c +@@ -691,6 +691,7 @@ static int dax_fs_init(void) + static void dax_fs_exit(void) + { + kern_unmount(dax_mnt); ++ rcu_barrier(); + kmem_cache_destroy(dax_cache); + } + +diff --git a/drivers/dma-buf/udmabuf.c b/drivers/dma-buf/udmabuf.c +index 9635897458a09..e553c6a937f69 100644 +--- a/drivers/dma-buf/udmabuf.c ++++ b/drivers/dma-buf/udmabuf.c +@@ -145,6 +145,10 @@ static long udmabuf_create(const struct udmabuf_create_list *head, + if (ubuf->pagecount > pglimit) + goto err; + } ++ ++ if (!ubuf->pagecount) ++ goto err; ++ + ubuf->pages = kmalloc_array(ubuf->pagecount, sizeof(*ubuf->pages), + GFP_KERNEL); + if (!ubuf->pages) { +diff --git a/drivers/dma/sh/shdma-base.c b/drivers/dma/sh/shdma-base.c +index 19eee3d0900b0..c51de498b5b4b 100644 +--- a/drivers/dma/sh/shdma-base.c ++++ b/drivers/dma/sh/shdma-base.c +@@ -115,10 +115,8 @@ static dma_cookie_t shdma_tx_submit(struct dma_async_tx_descriptor *tx) + ret = pm_runtime_get(schan->dev); + + spin_unlock_irq(&schan->chan_lock); +- if (ret < 0) { ++ if (ret < 0) + dev_err(schan->dev, "%s(): GET = %d\n", __func__, ret); +- pm_runtime_put(schan->dev); +- } + + pm_runtime_barrier(schan->dev); + +diff --git a/drivers/firmware/google/Kconfig b/drivers/firmware/google/Kconfig +index 2fba0aa7fc54d..20dfe39a0537a 100644 +--- a/drivers/firmware/google/Kconfig ++++ b/drivers/firmware/google/Kconfig +@@ -21,7 +21,7 @@ config GOOGLE_SMI + + config GOOGLE_COREBOOT_TABLE + tristate "Coreboot Table Access" +- depends on ACPI || OF ++ depends on HAS_IOMEM && (ACPI || OF) + help + This option enables the coreboot_table module, which provides other + firmware modules access to the coreboot table. The coreboot table +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v10.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v10.c +index ce30d4e8bf25f..f7c4337c1ffe6 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v10.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v10.c +@@ -165,7 +165,7 @@ static const struct kfd2kgd_calls kfd2kgd = { + .get_tile_config = amdgpu_amdkfd_get_tile_config, + }; + +-struct kfd2kgd_calls *amdgpu_amdkfd_gfx_10_0_get_functions() ++struct kfd2kgd_calls *amdgpu_amdkfd_gfx_10_0_get_functions(void) + { + return (struct kfd2kgd_calls *)&kfd2kgd; + } +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +index 82823d9a8ba88..fddeea2b17e50 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +@@ -1542,6 +1542,7 @@ int amdgpu_cs_fence_to_handle_ioctl(struct drm_device *dev, void *data, + return 0; + + default: ++ dma_fence_put(fence); + return -EINVAL; + } + } +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c +index f9bef3154b998..2659202f2026b 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c +@@ -263,7 +263,7 @@ static int amdgpu_gfx_kiq_acquire(struct amdgpu_device *adev, + * adev->gfx.mec.num_pipe_per_mec + * adev->gfx.mec.num_queue_per_pipe; + +- while (queue_bit-- >= 0) { ++ while (--queue_bit >= 0) { + if (test_bit(queue_bit, adev->gfx.mec.queue_bitmap)) + continue; + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c +index 532d1842f6a30..4cc0dd494a42b 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c +@@ -1305,7 +1305,8 @@ void amdgpu_bo_release_notify(struct ttm_buffer_object *bo) + !(abo->flags & AMDGPU_GEM_CREATE_VRAM_WIPE_ON_RELEASE)) + return; + +- dma_resv_lock(bo->base.resv, NULL); ++ if (WARN_ON_ONCE(!dma_resv_trylock(bo->base.resv))) ++ return; + + r = amdgpu_fill_buffer(abo, AMDGPU_POISON, bo->base.resv, &fence); + if (!WARN_ON(r)) { +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_crat.c b/drivers/gpu/drm/amd/amdkfd/kfd_crat.c +index 66387caf966e2..3685e89415d5c 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_crat.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_crat.c +@@ -758,7 +758,7 @@ int kfd_create_crat_image_acpi(void **crat_image, size_t *size) + /* Fetch the CRAT table from ACPI */ + status = acpi_get_table(CRAT_SIGNATURE, 0, &crat_table); + if (status == AE_NOT_FOUND) { +- pr_warn("CRAT table not found\n"); ++ pr_info("CRAT table not found\n"); + return -ENODATA; + } else if (ACPI_FAILURE(status)) { + const char *err = acpi_format_exception(status); +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_module.c b/drivers/gpu/drm/amd/amdkfd/kfd_module.c +index 986ff52d5750c..f4b7f7e6c40e4 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_module.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_module.c +@@ -82,7 +82,7 @@ static void kfd_exit(void) + kfd_chardev_exit(); + } + +-int kgd2kfd_init() ++int kgd2kfd_init(void) + { + return kfd_init(); + } +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index 8e4d863c7570b..c5231c50c4126 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -5013,6 +5013,9 @@ static void amdgpu_dm_connector_add_common_modes(struct drm_encoder *encoder, + mode = amdgpu_dm_create_common_mode(encoder, + common_modes[i].name, common_modes[i].w, + common_modes[i].h); ++ if (!mode) ++ continue; ++ + drm_mode_probed_add(connector, mode); + amdgpu_dm_connector->num_modes++; + } +@@ -7265,10 +7268,13 @@ cleanup: + static int add_affected_mst_dsc_crtcs(struct drm_atomic_state *state, struct drm_crtc *crtc) + { + struct drm_connector *connector; +- struct drm_connector_state *conn_state; ++ struct drm_connector_state *conn_state, *old_conn_state; + struct amdgpu_dm_connector *aconnector = NULL; + int i; +- for_each_new_connector_in_state(state, connector, conn_state, i) { ++ for_each_oldnew_connector_in_state(state, connector, old_conn_state, conn_state, i) { ++ if (!conn_state->crtc) ++ conn_state = old_conn_state; ++ + if (conn_state->crtc != crtc) + continue; + +diff --git a/drivers/gpu/drm/amd/display/dc/irq/dcn21/irq_service_dcn21.c b/drivers/gpu/drm/amd/display/dc/irq/dcn21/irq_service_dcn21.c +index 623455cd75203..d6f988403941b 100644 +--- a/drivers/gpu/drm/amd/display/dc/irq/dcn21/irq_service_dcn21.c ++++ b/drivers/gpu/drm/amd/display/dc/irq/dcn21/irq_service_dcn21.c +@@ -227,14 +227,6 @@ static const struct irq_source_info_funcs vupdate_no_lock_irq_info_funcs = { + .funcs = &pflip_irq_info_funcs\ + } + +-#define vupdate_int_entry(reg_num)\ +- [DC_IRQ_SOURCE_VUPDATE1 + reg_num] = {\ +- IRQ_REG_ENTRY(OTG, reg_num,\ +- OTG_GLOBAL_SYNC_STATUS, VUPDATE_INT_EN,\ +- OTG_GLOBAL_SYNC_STATUS, VUPDATE_EVENT_CLEAR),\ +- .funcs = &vblank_irq_info_funcs\ +- } +- + /* vupdate_no_lock_int_entry maps to DC_IRQ_SOURCE_VUPDATEx, to match semantic + * of DCE's DC_IRQ_SOURCE_VUPDATEx. + */ +@@ -348,12 +340,6 @@ irq_source_info_dcn21[DAL_IRQ_SOURCES_NUMBER] = { + dc_underflow_int_entry(6), + [DC_IRQ_SOURCE_DMCU_SCP] = dummy_irq_entry(), + [DC_IRQ_SOURCE_VBIOS_SW] = dummy_irq_entry(), +- vupdate_int_entry(0), +- vupdate_int_entry(1), +- vupdate_int_entry(2), +- vupdate_int_entry(3), +- vupdate_int_entry(4), +- vupdate_int_entry(5), + vupdate_no_lock_int_entry(0), + vupdate_no_lock_int_entry(1), + vupdate_no_lock_int_entry(2), +diff --git a/drivers/gpu/drm/bridge/cdns-dsi.c b/drivers/gpu/drm/bridge/cdns-dsi.c +index 0cb9dd6986ec3..9c3f9110895e8 100644 +--- a/drivers/gpu/drm/bridge/cdns-dsi.c ++++ b/drivers/gpu/drm/bridge/cdns-dsi.c +@@ -1284,6 +1284,7 @@ static const struct of_device_id cdns_dsi_of_match[] = { + { .compatible = "cdns,dsi" }, + { }, + }; ++MODULE_DEVICE_TABLE(of, cdns_dsi_of_match); + + static struct platform_driver cdns_dsi_platform_driver = { + .probe = cdns_dsi_drm_probe, +diff --git a/drivers/gpu/drm/bridge/sil-sii8620.c b/drivers/gpu/drm/bridge/sil-sii8620.c +index 04431dbac4a4f..fb0b64c965b74 100644 +--- a/drivers/gpu/drm/bridge/sil-sii8620.c ++++ b/drivers/gpu/drm/bridge/sil-sii8620.c +@@ -2118,7 +2118,7 @@ static void sii8620_init_rcp_input_dev(struct sii8620 *ctx) + if (ret) { + dev_err(ctx->dev, "Failed to register RC device\n"); + ctx->error = ret; +- rc_free_device(ctx->rc_dev); ++ rc_free_device(rc_dev); + return; + } + ctx->rc_dev = rc_dev; +diff --git a/drivers/gpu/drm/bridge/synopsys/dw-mipi-dsi.c b/drivers/gpu/drm/bridge/synopsys/dw-mipi-dsi.c +index 77384c49fb8dd..2fc27931d3b56 100644 +--- a/drivers/gpu/drm/bridge/synopsys/dw-mipi-dsi.c ++++ b/drivers/gpu/drm/bridge/synopsys/dw-mipi-dsi.c +@@ -1057,6 +1057,7 @@ __dw_mipi_dsi_probe(struct platform_device *pdev, + ret = mipi_dsi_host_register(&dsi->dsi_host); + if (ret) { + dev_err(dev, "Failed to register MIPI host: %d\n", ret); ++ pm_runtime_disable(dev); + dw_mipi_dsi_debugfs_remove(dsi); + return ERR_PTR(ret); + } +diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c +index 3f0a798906004..aeeab1b57aad3 100644 +--- a/drivers/gpu/drm/drm_edid.c ++++ b/drivers/gpu/drm/drm_edid.c +@@ -4380,7 +4380,8 @@ bool drm_detect_monitor_audio(struct edid *edid) + if (!edid_ext) + goto end; + +- has_audio = ((edid_ext[3] & EDID_BASIC_AUDIO) != 0); ++ has_audio = (edid_ext[0] == CEA_EXT && ++ (edid_ext[3] & EDID_BASIC_AUDIO) != 0); + + if (has_audio) { + DRM_DEBUG_KMS("Monitor has basic audio support\n"); +@@ -4533,16 +4534,8 @@ static void drm_parse_hdmi_deep_color_info(struct drm_connector *connector, + connector->name, dc_bpc); + info->bpc = dc_bpc; + +- /* +- * Deep color support mandates RGB444 support for all video +- * modes and forbids YCRCB422 support for all video modes per +- * HDMI 1.3 spec. +- */ +- info->color_formats = DRM_COLOR_FORMAT_RGB444; +- + /* YCRCB444 is optional according to spec. */ + if (hdmi[6] & DRM_EDID_HDMI_DC_Y444) { +- info->color_formats |= DRM_COLOR_FORMAT_YCRCB444; + DRM_DEBUG("%s: HDMI sink does YCRCB444 in deep color.\n", + connector->name); + } +diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c +index 448c2f2d803a6..f5ab891731d0b 100644 +--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c ++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c +@@ -166,6 +166,12 @@ static const struct dmi_system_id orientation_data[] = { + DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "MicroPC"), + }, + .driver_data = (void *)&lcd720x1280_rightside_up, ++ }, { /* GPD Win Max */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "GPD"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "G1619-01"), ++ }, ++ .driver_data = (void *)&lcd800x1280_rightside_up, + }, { /* + * GPD Pocket, note that the the DMI data is less generic then + * it seems, devices with a board-vendor of "AMI Corporation" +diff --git a/drivers/gpu/drm/imx/parallel-display.c b/drivers/gpu/drm/imx/parallel-display.c +index be55548f352af..e24272428744c 100644 +--- a/drivers/gpu/drm/imx/parallel-display.c ++++ b/drivers/gpu/drm/imx/parallel-display.c +@@ -68,8 +68,10 @@ static int imx_pd_connector_get_modes(struct drm_connector *connector) + ret = of_get_drm_display_mode(np, &imxpd->mode, + &imxpd->bus_flags, + OF_USE_NATIVE_MODE); +- if (ret) ++ if (ret) { ++ drm_mode_destroy(connector->dev, mode); + return ret; ++ } + + drm_mode_copy(mode, &imxpd->mode); + mode->type |= DRM_MODE_TYPE_DRIVER | DRM_MODE_TYPE_PREFERRED, +diff --git a/drivers/gpu/drm/tegra/dsi.c b/drivers/gpu/drm/tegra/dsi.c +index a5d47e301c5f7..13413d2b26028 100644 +--- a/drivers/gpu/drm/tegra/dsi.c ++++ b/drivers/gpu/drm/tegra/dsi.c +@@ -1455,8 +1455,10 @@ static int tegra_dsi_ganged_probe(struct tegra_dsi *dsi) + dsi->slave = platform_get_drvdata(gangster); + of_node_put(np); + +- if (!dsi->slave) ++ if (!dsi->slave) { ++ put_device(&gangster->dev); + return -EPROBE_DEFER; ++ } + + dsi->slave->master = dsi; + } +diff --git a/drivers/greybus/svc.c b/drivers/greybus/svc.c +index ce7740ef449ba..51d0875a34800 100644 +--- a/drivers/greybus/svc.c ++++ b/drivers/greybus/svc.c +@@ -866,8 +866,14 @@ static int gb_svc_hello(struct gb_operation *op) + + gb_svc_debugfs_init(svc); + +- return gb_svc_queue_deferred_request(op); ++ ret = gb_svc_queue_deferred_request(op); ++ if (ret) ++ goto err_remove_debugfs; ++ ++ return 0; + ++err_remove_debugfs: ++ gb_svc_debugfs_exit(svc); + err_unregister_device: + gb_svc_watchdog_destroy(svc); + device_del(&svc->dev); +diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c +index 4267e2f2e70f4..a663cbb7b6832 100644 +--- a/drivers/hid/hid-logitech-dj.c ++++ b/drivers/hid/hid-logitech-dj.c +@@ -1000,6 +1000,7 @@ static void logi_hidpp_recv_queue_notif(struct hid_device *hdev, + workitem.reports_supported |= STD_KEYBOARD; + break; + case 0x0f: ++ case 0x11: + device_type = "eQUAD Lightspeed 1.2"; + logi_hidpp_dev_conn_notif_equad(hdev, hidpp_report, &workitem); + workitem.reports_supported |= STD_KEYBOARD; +diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c +index ac076ac73de5d..1547b0ec6a113 100644 +--- a/drivers/hid/i2c-hid/i2c-hid-core.c ++++ b/drivers/hid/i2c-hid/i2c-hid-core.c +@@ -622,6 +622,17 @@ static int i2c_hid_get_raw_report(struct hid_device *hid, + if (report_type == HID_OUTPUT_REPORT) + return -EINVAL; + ++ /* ++ * In case of unnumbered reports the response from the device will ++ * not have the report ID that the upper layers expect, so we need ++ * to stash it the buffer ourselves and adjust the data size. ++ */ ++ if (!report_number) { ++ buf[0] = 0; ++ buf++; ++ count--; ++ } ++ + /* +2 bytes to include the size of the reply in the query buffer */ + ask_count = min(count + 2, (size_t)ihid->bufsize); + +@@ -643,6 +654,9 @@ static int i2c_hid_get_raw_report(struct hid_device *hid, + count = min(count, ret_count - 2); + memcpy(buf, ihid->rawbuf + 2, count); + ++ if (!report_number) ++ count++; ++ + return count; + } + +@@ -659,17 +673,19 @@ static int i2c_hid_output_raw_report(struct hid_device *hid, __u8 *buf, + + mutex_lock(&ihid->reset_lock); + +- if (report_id) { +- buf++; +- count--; +- } +- ++ /* ++ * Note that both numbered and unnumbered reports passed here ++ * are supposed to have report ID stored in the 1st byte of the ++ * buffer, so we strip it off unconditionally before passing payload ++ * to i2c_hid_set_or_send_report which takes care of encoding ++ * everything properly. ++ */ + ret = i2c_hid_set_or_send_report(client, + report_type == HID_FEATURE_REPORT ? 0x03 : 0x02, +- report_id, buf, count, use_data); ++ report_id, buf + 1, count - 1, use_data); + +- if (report_id && ret >= 0) +- ret++; /* add report_id to the number of transfered bytes */ ++ if (ret >= 0) ++ ret++; /* add report_id to the number of transferred bytes */ + + mutex_unlock(&ihid->reset_lock); + +diff --git a/drivers/hid/intel-ish-hid/ishtp-fw-loader.c b/drivers/hid/intel-ish-hid/ishtp-fw-loader.c +index 6cf59fd26ad78..b6d6d119035ca 100644 +--- a/drivers/hid/intel-ish-hid/ishtp-fw-loader.c ++++ b/drivers/hid/intel-ish-hid/ishtp-fw-loader.c +@@ -656,21 +656,12 @@ static int ish_fw_xfer_direct_dma(struct ishtp_cl_data *client_data, + */ + payload_max_size &= ~(L1_CACHE_BYTES - 1); + +- dma_buf = kmalloc(payload_max_size, GFP_KERNEL | GFP_DMA32); ++ dma_buf = dma_alloc_coherent(devc, payload_max_size, &dma_buf_phy, GFP_KERNEL); + if (!dma_buf) { + client_data->flag_retry = true; + return -ENOMEM; + } + +- dma_buf_phy = dma_map_single(devc, dma_buf, payload_max_size, +- DMA_TO_DEVICE); +- if (dma_mapping_error(devc, dma_buf_phy)) { +- dev_err(cl_data_to_dev(client_data), "DMA map failed\n"); +- client_data->flag_retry = true; +- rv = -ENOMEM; +- goto end_err_dma_buf_release; +- } +- + ldr_xfer_dma_frag.fragment.hdr.command = LOADER_CMD_XFER_FRAGMENT; + ldr_xfer_dma_frag.fragment.xfer_mode = LOADER_XFER_MODE_DIRECT_DMA; + ldr_xfer_dma_frag.ddr_phys_addr = (u64)dma_buf_phy; +@@ -690,14 +681,7 @@ static int ish_fw_xfer_direct_dma(struct ishtp_cl_data *client_data, + ldr_xfer_dma_frag.fragment.size = fragment_size; + memcpy(dma_buf, &fw->data[fragment_offset], fragment_size); + +- dma_sync_single_for_device(devc, dma_buf_phy, +- payload_max_size, +- DMA_TO_DEVICE); +- +- /* +- * Flush cache here because the dma_sync_single_for_device() +- * does not do for x86. +- */ ++ /* Flush cache to be sure the data is in main memory. */ + clflush_cache_range(dma_buf, payload_max_size); + + dev_dbg(cl_data_to_dev(client_data), +@@ -720,15 +704,8 @@ static int ish_fw_xfer_direct_dma(struct ishtp_cl_data *client_data, + fragment_offset += fragment_size; + } + +- dma_unmap_single(devc, dma_buf_phy, payload_max_size, DMA_TO_DEVICE); +- kfree(dma_buf); +- return 0; +- + end_err_resp_buf_release: +- /* Free ISH buffer if not done already, in error case */ +- dma_unmap_single(devc, dma_buf_phy, payload_max_size, DMA_TO_DEVICE); +-end_err_dma_buf_release: +- kfree(dma_buf); ++ dma_free_coherent(devc, payload_max_size, dma_buf, dma_buf_phy); + return rv; + } + +diff --git a/drivers/hv/hv_balloon.c b/drivers/hv/hv_balloon.c +index bd4e72f6dfd49..44d6de6fc03da 100644 +--- a/drivers/hv/hv_balloon.c ++++ b/drivers/hv/hv_balloon.c +@@ -1550,7 +1550,7 @@ static void balloon_onchannelcallback(void *context) + break; + + default: +- pr_warn("Unhandled message: type: %d\n", dm_hdr->type); ++ pr_warn_ratelimited("Unhandled message: type: %d\n", dm_hdr->type); + + } + } +diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c +index 6b7ab8f234e87..943654ded73d0 100644 +--- a/drivers/hv/vmbus_drv.c ++++ b/drivers/hv/vmbus_drv.c +@@ -2493,10 +2493,15 @@ static void __exit vmbus_exit(void) + if (ms_hyperv.misc_features & HV_FEATURE_GUEST_CRASH_MSR_AVAILABLE) { + kmsg_dump_unregister(&hv_kmsg_dumper); + unregister_die_notifier(&hyperv_die_block); +- atomic_notifier_chain_unregister(&panic_notifier_list, +- &hyperv_panic_block); + } + ++ /* ++ * The panic notifier is always registered, hence we should ++ * also unconditionally unregister it here as well. ++ */ ++ atomic_notifier_chain_unregister(&panic_notifier_list, ++ &hyperv_panic_block); ++ + free_page((unsigned long)hv_panic_page); + unregister_sysctl_table(hv_ctl_table_hdr); + hv_ctl_table_hdr = NULL; +diff --git a/drivers/hwmon/pmbus/pmbus.h b/drivers/hwmon/pmbus/pmbus.h +index d198af3a92b6f..9731f1f830b16 100644 +--- a/drivers/hwmon/pmbus/pmbus.h ++++ b/drivers/hwmon/pmbus/pmbus.h +@@ -292,6 +292,7 @@ enum pmbus_fan_mode { percent = 0, rpm }; + /* + * STATUS_VOUT, STATUS_INPUT + */ ++#define PB_VOLTAGE_VIN_OFF BIT(3) + #define PB_VOLTAGE_UV_FAULT BIT(4) + #define PB_VOLTAGE_UV_WARNING BIT(5) + #define PB_VOLTAGE_OV_WARNING BIT(6) +diff --git a/drivers/hwmon/pmbus/pmbus_core.c b/drivers/hwmon/pmbus/pmbus_core.c +index 8470097907bc2..beb443d020c20 100644 +--- a/drivers/hwmon/pmbus/pmbus_core.c ++++ b/drivers/hwmon/pmbus/pmbus_core.c +@@ -1324,7 +1324,7 @@ static const struct pmbus_limit_attr vin_limit_attrs[] = { + .reg = PMBUS_VIN_UV_FAULT_LIMIT, + .attr = "lcrit", + .alarm = "lcrit_alarm", +- .sbit = PB_VOLTAGE_UV_FAULT, ++ .sbit = PB_VOLTAGE_UV_FAULT | PB_VOLTAGE_VIN_OFF, + }, { + .reg = PMBUS_VIN_OV_WARN_LIMIT, + .attr = "max", +@@ -2174,10 +2174,14 @@ static int pmbus_regulator_is_enabled(struct regulator_dev *rdev) + { + struct device *dev = rdev_get_dev(rdev); + struct i2c_client *client = to_i2c_client(dev->parent); ++ struct pmbus_data *data = i2c_get_clientdata(client); + u8 page = rdev_get_id(rdev); + int ret; + ++ mutex_lock(&data->update_lock); + ret = pmbus_read_byte_data(client, page, PMBUS_OPERATION); ++ mutex_unlock(&data->update_lock); ++ + if (ret < 0) + return ret; + +@@ -2188,11 +2192,17 @@ static int _pmbus_regulator_on_off(struct regulator_dev *rdev, bool enable) + { + struct device *dev = rdev_get_dev(rdev); + struct i2c_client *client = to_i2c_client(dev->parent); ++ struct pmbus_data *data = i2c_get_clientdata(client); + u8 page = rdev_get_id(rdev); ++ int ret; + +- return pmbus_update_byte_data(client, page, PMBUS_OPERATION, +- PB_OPERATION_CONTROL_ON, +- enable ? PB_OPERATION_CONTROL_ON : 0); ++ mutex_lock(&data->update_lock); ++ ret = pmbus_update_byte_data(client, page, PMBUS_OPERATION, ++ PB_OPERATION_CONTROL_ON, ++ enable ? PB_OPERATION_CONTROL_ON : 0); ++ mutex_unlock(&data->update_lock); ++ ++ return ret; + } + + static int pmbus_regulator_enable(struct regulator_dev *rdev) +diff --git a/drivers/hwmon/sch56xx-common.c b/drivers/hwmon/sch56xx-common.c +index 6c84780e358e8..066b12990fbfb 100644 +--- a/drivers/hwmon/sch56xx-common.c ++++ b/drivers/hwmon/sch56xx-common.c +@@ -424,7 +424,7 @@ struct sch56xx_watchdog_data *sch56xx_watchdog_register(struct device *parent, + if (nowayout) + set_bit(WDOG_NO_WAY_OUT, &data->wddev.status); + if (output_enable & SCH56XX_WDOG_OUTPUT_ENABLE) +- set_bit(WDOG_ACTIVE, &data->wddev.status); ++ set_bit(WDOG_HW_RUNNING, &data->wddev.status); + + /* Since the watchdog uses a downcounter there is no register to read + the BIOS set timeout from (if any was set at all) -> +diff --git a/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c b/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c +index ee44640edeb52..4c9e2fc533529 100644 +--- a/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c ++++ b/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c +@@ -364,8 +364,12 @@ static ssize_t mode_store(struct device *dev, + mode = ETM_MODE_QELEM(config->mode); + /* start by clearing QE bits */ + config->cfg &= ~(BIT(13) | BIT(14)); +- /* if supported, Q elements with instruction counts are enabled */ +- if ((mode & BIT(0)) && (drvdata->q_support & BIT(0))) ++ /* ++ * if supported, Q elements with instruction counts are enabled. ++ * Always set the low bit for any requested mode. Valid combos are ++ * 0b00, 0b01 and 0b11. ++ */ ++ if (mode && drvdata->q_support) + config->cfg |= BIT(13); + /* + * if supported, Q elements with and without instruction +diff --git a/drivers/i2c/busses/i2c-xiic.c b/drivers/i2c/busses/i2c-xiic.c +index 37b3b9307d076..a48bee59dcdec 100644 +--- a/drivers/i2c/busses/i2c-xiic.c ++++ b/drivers/i2c/busses/i2c-xiic.c +@@ -715,7 +715,6 @@ static const struct i2c_adapter_quirks xiic_quirks = { + + static const struct i2c_adapter xiic_adapter = { + .owner = THIS_MODULE, +- .name = DRIVER_NAME, + .class = I2C_CLASS_DEPRECATED, + .algo = &xiic_algorithm, + .quirks = &xiic_quirks, +@@ -752,6 +751,8 @@ static int xiic_i2c_probe(struct platform_device *pdev) + i2c_set_adapdata(&i2c->adap, i2c); + i2c->adap.dev.parent = &pdev->dev; + i2c->adap.dev.of_node = pdev->dev.of_node; ++ snprintf(i2c->adap.name, sizeof(i2c->adap.name), ++ DRIVER_NAME " %s", pdev->name); + + mutex_init(&i2c->lock); + init_waitqueue_head(&i2c->wait); +diff --git a/drivers/i2c/muxes/i2c-demux-pinctrl.c b/drivers/i2c/muxes/i2c-demux-pinctrl.c +index 5365199a31f41..f7a7405d4350a 100644 +--- a/drivers/i2c/muxes/i2c-demux-pinctrl.c ++++ b/drivers/i2c/muxes/i2c-demux-pinctrl.c +@@ -261,7 +261,7 @@ static int i2c_demux_pinctrl_probe(struct platform_device *pdev) + + err = device_create_file(&pdev->dev, &dev_attr_available_masters); + if (err) +- goto err_rollback; ++ goto err_rollback_activation; + + err = device_create_file(&pdev->dev, &dev_attr_current_master); + if (err) +@@ -271,8 +271,9 @@ static int i2c_demux_pinctrl_probe(struct platform_device *pdev) + + err_rollback_available: + device_remove_file(&pdev->dev, &dev_attr_available_masters); +-err_rollback: ++err_rollback_activation: + i2c_demux_deactivate_master(priv); ++err_rollback: + for (j = 0; j < i; j++) { + of_node_put(priv->chan[j].parent_np); + of_changeset_destroy(&priv->chan[j].chgset); +diff --git a/drivers/iio/adc/twl6030-gpadc.c b/drivers/iio/adc/twl6030-gpadc.c +index f24148bd15de4..fb77c3ff5a3e4 100644 +--- a/drivers/iio/adc/twl6030-gpadc.c ++++ b/drivers/iio/adc/twl6030-gpadc.c +@@ -911,6 +911,8 @@ static int twl6030_gpadc_probe(struct platform_device *pdev) + ret = devm_request_threaded_irq(dev, irq, NULL, + twl6030_gpadc_irq_handler, + IRQF_ONESHOT, "twl6030_gpadc", indio_dev); ++ if (ret) ++ return ret; + + ret = twl6030_gpadc_enable_irq(TWL6030_GPADC_RT_SW1_EOC_MASK); + if (ret < 0) { +diff --git a/drivers/iio/afe/iio-rescale.c b/drivers/iio/afe/iio-rescale.c +index e9ceee66d1e7c..d9c41db8155f9 100644 +--- a/drivers/iio/afe/iio-rescale.c ++++ b/drivers/iio/afe/iio-rescale.c +@@ -38,7 +38,7 @@ static int rescale_read_raw(struct iio_dev *indio_dev, + int *val, int *val2, long mask) + { + struct rescale *rescale = iio_priv(indio_dev); +- unsigned long long tmp; ++ s64 tmp; + int ret; + + switch (mask) { +@@ -59,10 +59,10 @@ static int rescale_read_raw(struct iio_dev *indio_dev, + *val2 = rescale->denominator; + return IIO_VAL_FRACTIONAL; + case IIO_VAL_FRACTIONAL_LOG2: +- tmp = *val * 1000000000LL; +- do_div(tmp, rescale->denominator); ++ tmp = (s64)*val * 1000000000LL; ++ tmp = div_s64(tmp, rescale->denominator); + tmp *= rescale->numerator; +- do_div(tmp, 1000000000LL); ++ tmp = div_s64(tmp, 1000000000LL); + *val = tmp; + return ret; + default: +diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c +index 5a8351c9a4265..ca0fe902a7db4 100644 +--- a/drivers/iio/inkern.c ++++ b/drivers/iio/inkern.c +@@ -588,28 +588,50 @@ EXPORT_SYMBOL_GPL(iio_read_channel_average_raw); + static int iio_convert_raw_to_processed_unlocked(struct iio_channel *chan, + int raw, int *processed, unsigned int scale) + { +- int scale_type, scale_val, scale_val2, offset; ++ int scale_type, scale_val, scale_val2; ++ int offset_type, offset_val, offset_val2; + s64 raw64 = raw; +- int ret; + +- ret = iio_channel_read(chan, &offset, NULL, IIO_CHAN_INFO_OFFSET); +- if (ret >= 0) +- raw64 += offset; ++ offset_type = iio_channel_read(chan, &offset_val, &offset_val2, ++ IIO_CHAN_INFO_OFFSET); ++ if (offset_type >= 0) { ++ switch (offset_type) { ++ case IIO_VAL_INT: ++ break; ++ case IIO_VAL_INT_PLUS_MICRO: ++ case IIO_VAL_INT_PLUS_NANO: ++ /* ++ * Both IIO_VAL_INT_PLUS_MICRO and IIO_VAL_INT_PLUS_NANO ++ * implicitely truncate the offset to it's integer form. ++ */ ++ break; ++ case IIO_VAL_FRACTIONAL: ++ offset_val /= offset_val2; ++ break; ++ case IIO_VAL_FRACTIONAL_LOG2: ++ offset_val >>= offset_val2; ++ break; ++ default: ++ return -EINVAL; ++ } ++ ++ raw64 += offset_val; ++ } + + scale_type = iio_channel_read(chan, &scale_val, &scale_val2, + IIO_CHAN_INFO_SCALE); + if (scale_type < 0) { + /* +- * Just pass raw values as processed if no scaling is +- * available. ++ * If no channel scaling is available apply consumer scale to ++ * raw value and return. + */ +- *processed = raw; ++ *processed = raw * scale; + return 0; + } + + switch (scale_type) { + case IIO_VAL_INT: +- *processed = raw64 * scale_val; ++ *processed = raw64 * scale_val * scale; + break; + case IIO_VAL_INT_PLUS_MICRO: + if (scale_val2 < 0) +diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c +index 5e2b688e36fca..de7df5ab06f3b 100644 +--- a/drivers/infiniband/core/cma.c ++++ b/drivers/infiniband/core/cma.c +@@ -2559,7 +2559,7 @@ int rdma_set_ack_timeout(struct rdma_cm_id *id, u8 timeout) + { + struct rdma_id_private *id_priv; + +- if (id->qp_type != IB_QPT_RC) ++ if (id->qp_type != IB_QPT_RC && id->qp_type != IB_QPT_XRC_INI) + return -EINVAL; + + id_priv = container_of(id, struct rdma_id_private, id); +diff --git a/drivers/infiniband/hw/mlx5/devx.c b/drivers/infiniband/hw/mlx5/devx.c +index 664e0f374ac00..747f42855b7bd 100644 +--- a/drivers/infiniband/hw/mlx5/devx.c ++++ b/drivers/infiniband/hw/mlx5/devx.c +@@ -1844,8 +1844,10 @@ subscribe_event_xa_alloc(struct mlx5_devx_event_table *devx_event_table, + key_level2, + obj_event, + GFP_KERNEL); +- if (err) ++ if (err) { ++ kfree(obj_event); + return err; ++ } + INIT_LIST_HEAD(&obj_event->obj_sub_list); + } + +diff --git a/drivers/infiniband/sw/rdmavt/qp.c b/drivers/infiniband/sw/rdmavt/qp.c +index a5152f097cb7a..48e8612c1bc8d 100644 +--- a/drivers/infiniband/sw/rdmavt/qp.c ++++ b/drivers/infiniband/sw/rdmavt/qp.c +@@ -3227,7 +3227,11 @@ serr_no_r_lock: + spin_lock_irqsave(&sqp->s_lock, flags); + rvt_send_complete(sqp, wqe, send_status); + if (sqp->ibqp.qp_type == IB_QPT_RC) { +- int lastwqe = rvt_error_qp(sqp, IB_WC_WR_FLUSH_ERR); ++ int lastwqe; ++ ++ spin_lock(&sqp->r_lock); ++ lastwqe = rvt_error_qp(sqp, IB_WC_WR_FLUSH_ERR); ++ spin_unlock(&sqp->r_lock); + + sqp->s_flags &= ~RVT_S_BUSY; + spin_unlock_irqrestore(&sqp->s_lock, flags); +diff --git a/drivers/input/input.c b/drivers/input/input.c +index f7398b996bacf..e2eb9b9b8363d 100644 +--- a/drivers/input/input.c ++++ b/drivers/input/input.c +@@ -2181,12 +2181,6 @@ int input_register_device(struct input_dev *dev) + /* KEY_RESERVED is not supposed to be transmitted to userspace. */ + __clear_bit(KEY_RESERVED, dev->keybit); + +- /* Buttonpads should not map BTN_RIGHT and/or BTN_MIDDLE. */ +- if (test_bit(INPUT_PROP_BUTTONPAD, dev->propbit)) { +- __clear_bit(BTN_RIGHT, dev->keybit); +- __clear_bit(BTN_MIDDLE, dev->keybit); +- } +- + /* Make sure that bitmasks not mentioned in dev->evbit are clean. */ + input_cleanse_bitmasks(dev); + +diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c +index ef6af714a7e64..02c2fb551f381 100644 +--- a/drivers/iommu/arm-smmu-v3.c ++++ b/drivers/iommu/arm-smmu-v3.c +@@ -1708,6 +1708,7 @@ static irqreturn_t arm_smmu_evtq_thread(int irq, void *dev) + dev_info(smmu->dev, "\t0x%016llx\n", + (unsigned long long)evt[i]); + ++ cond_resched(); + } + + /* +diff --git a/drivers/iommu/iova.c b/drivers/iommu/iova.c +index 906582a21124d..628a586be6959 100644 +--- a/drivers/iommu/iova.c ++++ b/drivers/iommu/iova.c +@@ -138,10 +138,11 @@ __cached_rbnode_delete_update(struct iova_domain *iovad, struct iova *free) + cached_iova = rb_entry(iovad->cached32_node, struct iova, node); + if (free == cached_iova || + (free->pfn_hi < iovad->dma_32bit_pfn && +- free->pfn_lo >= cached_iova->pfn_lo)) { ++ free->pfn_lo >= cached_iova->pfn_lo)) + iovad->cached32_node = rb_next(&free->node); ++ ++ if (free->pfn_lo < iovad->dma_32bit_pfn) + iovad->max32_alloc_size = iovad->dma_32bit_pfn; +- } + + cached_iova = rb_entry(iovad->cached_node, struct iova, node); + if (free->pfn_lo >= cached_iova->pfn_lo) +diff --git a/drivers/iommu/ipmmu-vmsa.c b/drivers/iommu/ipmmu-vmsa.c +index 2639fc7181171..584eefab1dbcd 100644 +--- a/drivers/iommu/ipmmu-vmsa.c ++++ b/drivers/iommu/ipmmu-vmsa.c +@@ -1061,7 +1061,9 @@ static int ipmmu_probe(struct platform_device *pdev) + bitmap_zero(mmu->ctx, IPMMU_CTX_MAX); + mmu->features = of_device_get_match_data(&pdev->dev); + memset(mmu->utlb_ctx, IPMMU_CTX_INVALID, mmu->features->num_utlbs); +- dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(40)); ++ ret = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(40)); ++ if (ret) ++ return ret; + + /* Map I/O memory and request IRQ. */ + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); +diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c +index 9d0b42cb9903e..f589ca2480a1d 100644 +--- a/drivers/irqchip/irq-gic-v3.c ++++ b/drivers/irqchip/irq-gic-v3.c +@@ -162,11 +162,11 @@ static inline void __iomem *gic_dist_base(struct irq_data *d) + } + } + +-static void gic_do_wait_for_rwp(void __iomem *base) ++static void gic_do_wait_for_rwp(void __iomem *base, u32 bit) + { + u32 count = 1000000; /* 1s! */ + +- while (readl_relaxed(base + GICD_CTLR) & GICD_CTLR_RWP) { ++ while (readl_relaxed(base + GICD_CTLR) & bit) { + count--; + if (!count) { + pr_err_ratelimited("RWP timeout, gone fishing\n"); +@@ -180,13 +180,13 @@ static void gic_do_wait_for_rwp(void __iomem *base) + /* Wait for completion of a distributor change */ + static void gic_dist_wait_for_rwp(void) + { +- gic_do_wait_for_rwp(gic_data.dist_base); ++ gic_do_wait_for_rwp(gic_data.dist_base, GICD_CTLR_RWP); + } + + /* Wait for completion of a redistributor change */ + static void gic_redist_wait_for_rwp(void) + { +- gic_do_wait_for_rwp(gic_data_rdist_rd_base()); ++ gic_do_wait_for_rwp(gic_data_rdist_rd_base(), GICR_CTLR_RWP); + } + + #ifdef CONFIG_ARM64 +diff --git a/drivers/irqchip/irq-nvic.c b/drivers/irqchip/irq-nvic.c +index 160b39b5cd108..128a26d219e2c 100644 +--- a/drivers/irqchip/irq-nvic.c ++++ b/drivers/irqchip/irq-nvic.c +@@ -105,6 +105,7 @@ static int __init nvic_of_init(struct device_node *node, + + if (!nvic_irq_domain) { + pr_warn("Failed to allocate irq domain\n"); ++ iounmap(nvic_base); + return -ENOMEM; + } + +@@ -114,6 +115,7 @@ static int __init nvic_of_init(struct device_node *node, + if (ret) { + pr_warn("Failed to allocate irq chips\n"); + irq_domain_remove(nvic_irq_domain); ++ iounmap(nvic_base); + return ret; + } + +diff --git a/drivers/irqchip/qcom-pdc.c b/drivers/irqchip/qcom-pdc.c +index faa7d61b9d6c4..239a889df6080 100644 +--- a/drivers/irqchip/qcom-pdc.c ++++ b/drivers/irqchip/qcom-pdc.c +@@ -50,17 +50,18 @@ static u32 pdc_reg_read(int reg, u32 i) + static void pdc_enable_intr(struct irq_data *d, bool on) + { + int pin_out = d->hwirq; ++ unsigned long flags; + u32 index, mask; + u32 enable; + + index = pin_out / 32; + mask = pin_out % 32; + +- raw_spin_lock(&pdc_lock); ++ raw_spin_lock_irqsave(&pdc_lock, flags); + enable = pdc_reg_read(IRQ_ENABLE_BANK, index); + enable = on ? ENABLE_INTR(enable, mask) : CLEAR_INTR(enable, mask); + pdc_reg_write(IRQ_ENABLE_BANK, index, enable); +- raw_spin_unlock(&pdc_lock); ++ raw_spin_unlock_irqrestore(&pdc_lock, flags); + } + + static void qcom_pdc_gic_mask(struct irq_data *d) +diff --git a/drivers/mailbox/tegra-hsp.c b/drivers/mailbox/tegra-hsp.c +index 834b35dc3b137..e9b392dc09bc2 100644 +--- a/drivers/mailbox/tegra-hsp.c ++++ b/drivers/mailbox/tegra-hsp.c +@@ -403,6 +403,11 @@ static int tegra_hsp_mailbox_flush(struct mbox_chan *chan, + value = tegra_hsp_channel_readl(ch, HSP_SM_SHRD_MBOX); + if ((value & HSP_SM_SHRD_MBOX_FULL) == 0) { + mbox_chan_txdone(chan, 0); ++ ++ /* Wait until channel is empty */ ++ if (chan->active_req != NULL) ++ continue; ++ + return 0; + } + +diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c +index 571c04e70343a..3ed8ca47bc6e6 100644 +--- a/drivers/md/dm-crypt.c ++++ b/drivers/md/dm-crypt.c +@@ -2010,7 +2010,7 @@ static int crypt_set_keyring_key(struct crypt_config *cc, const char *key_string + + static int get_key_size(char **key_string) + { +- return (*key_string[0] == ':') ? -EINVAL : strlen(*key_string) >> 1; ++ return (*key_string[0] == ':') ? -EINVAL : (int)(strlen(*key_string) >> 1); + } + + #endif +diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c +index 3f15d8dc2b71f..7a73f2fa0ad72 100644 +--- a/drivers/md/dm-ioctl.c ++++ b/drivers/md/dm-ioctl.c +@@ -17,6 +17,7 @@ + #include <linux/dm-ioctl.h> + #include <linux/hdreg.h> + #include <linux/compat.h> ++#include <linux/nospec.h> + + #include <linux/uaccess.h> + +@@ -1696,6 +1697,7 @@ static ioctl_fn lookup_ioctl(unsigned int cmd, int *ioctl_flags) + if (unlikely(cmd >= ARRAY_SIZE(_ioctls))) + return NULL; + ++ cmd = array_index_nospec(cmd, ARRAY_SIZE(_ioctls)); + *ioctl_flags = _ioctls[cmd].flags; + return _ioctls[cmd].fn; + } +diff --git a/drivers/media/i2c/adv7511-v4l2.c b/drivers/media/i2c/adv7511-v4l2.c +index 809fa44ed9880..86267e01c2511 100644 +--- a/drivers/media/i2c/adv7511-v4l2.c ++++ b/drivers/media/i2c/adv7511-v4l2.c +@@ -555,7 +555,7 @@ static void log_infoframe(struct v4l2_subdev *sd, const struct adv7511_cfg_read_ + buffer[3] = 0; + buffer[3] = hdmi_infoframe_checksum(buffer, len + 4); + +- if (hdmi_infoframe_unpack(&frame, buffer, sizeof(buffer)) < 0) { ++ if (hdmi_infoframe_unpack(&frame, buffer, len + 4) < 0) { + v4l2_err(sd, "%s: unpack of %s infoframe failed\n", __func__, cri->desc); + return; + } +diff --git a/drivers/media/i2c/adv7604.c b/drivers/media/i2c/adv7604.c +index b887299ac195f..1cee69919e1b9 100644 +--- a/drivers/media/i2c/adv7604.c ++++ b/drivers/media/i2c/adv7604.c +@@ -2444,7 +2444,7 @@ static int adv76xx_read_infoframe(struct v4l2_subdev *sd, int index, + buffer[i + 3] = infoframe_read(sd, + adv76xx_cri[index].payload_addr + i); + +- if (hdmi_infoframe_unpack(frame, buffer, sizeof(buffer)) < 0) { ++ if (hdmi_infoframe_unpack(frame, buffer, len + 3) < 0) { + v4l2_err(sd, "%s: unpack of %s infoframe failed\n", __func__, + adv76xx_cri[index].desc); + return -ENOENT; +diff --git a/drivers/media/i2c/adv7842.c b/drivers/media/i2c/adv7842.c +index 02cbab826d0b6..a581e822ce6f5 100644 +--- a/drivers/media/i2c/adv7842.c ++++ b/drivers/media/i2c/adv7842.c +@@ -2574,7 +2574,7 @@ static void log_infoframe(struct v4l2_subdev *sd, struct adv7842_cfg_read_infofr + for (i = 0; i < len; i++) + buffer[i + 3] = infoframe_read(sd, cri->payload_addr + i); + +- if (hdmi_infoframe_unpack(&frame, buffer, sizeof(buffer)) < 0) { ++ if (hdmi_infoframe_unpack(&frame, buffer, len + 3) < 0) { + v4l2_err(sd, "%s: unpack of %s infoframe failed\n", __func__, cri->desc); + return; + } +diff --git a/drivers/media/pci/bt8xx/bttv-driver.c b/drivers/media/pci/bt8xx/bttv-driver.c +index 570530d976d21..6441e7d63d971 100644 +--- a/drivers/media/pci/bt8xx/bttv-driver.c ++++ b/drivers/media/pci/bt8xx/bttv-driver.c +@@ -3898,7 +3898,7 @@ static int bttv_register_video(struct bttv *btv) + + /* video */ + vdev_init(btv, &btv->video_dev, &bttv_video_template, "video"); +- btv->video_dev.device_caps = V4L2_CAP_VIDEO_CAPTURE | V4L2_CAP_TUNER | ++ btv->video_dev.device_caps = V4L2_CAP_VIDEO_CAPTURE | + V4L2_CAP_READWRITE | V4L2_CAP_STREAMING; + if (btv->tuner_type != TUNER_ABSENT) + btv->video_dev.device_caps |= V4L2_CAP_TUNER; +@@ -3919,7 +3919,7 @@ static int bttv_register_video(struct bttv *btv) + /* vbi */ + vdev_init(btv, &btv->vbi_dev, &bttv_video_template, "vbi"); + btv->vbi_dev.device_caps = V4L2_CAP_VBI_CAPTURE | V4L2_CAP_READWRITE | +- V4L2_CAP_STREAMING | V4L2_CAP_TUNER; ++ V4L2_CAP_STREAMING; + if (btv->tuner_type != TUNER_ABSENT) + btv->vbi_dev.device_caps |= V4L2_CAP_TUNER; + +diff --git a/drivers/media/pci/cx88/cx88-mpeg.c b/drivers/media/pci/cx88/cx88-mpeg.c +index a57c991b165b1..10d2971ef0624 100644 +--- a/drivers/media/pci/cx88/cx88-mpeg.c ++++ b/drivers/media/pci/cx88/cx88-mpeg.c +@@ -162,6 +162,9 @@ int cx8802_start_dma(struct cx8802_dev *dev, + cx_write(MO_TS_GPCNTRL, GP_COUNT_CONTROL_RESET); + q->count = 0; + ++ /* clear interrupt status register */ ++ cx_write(MO_TS_INTSTAT, 0x1f1111); ++ + /* enable irqs */ + dprintk(1, "setting the interrupt mask\n"); + cx_set(MO_PCI_INTMSK, core->pci_irqmask | PCI_INT_TSINT); +diff --git a/drivers/media/pci/ivtv/ivtv-driver.h b/drivers/media/pci/ivtv/ivtv-driver.h +index cafba6b1055df..90f38552bd362 100644 +--- a/drivers/media/pci/ivtv/ivtv-driver.h ++++ b/drivers/media/pci/ivtv/ivtv-driver.h +@@ -333,7 +333,6 @@ struct ivtv_stream { + struct ivtv *itv; /* for ease of use */ + const char *name; /* name of the stream */ + int type; /* stream type */ +- u32 caps; /* V4L2 capabilities */ + + struct v4l2_fh *fh; /* pointer to the streaming filehandle */ + spinlock_t qlock; /* locks access to the queues */ +diff --git a/drivers/media/pci/ivtv/ivtv-ioctl.c b/drivers/media/pci/ivtv/ivtv-ioctl.c +index 137853944e461..396cc931f41a2 100644 +--- a/drivers/media/pci/ivtv/ivtv-ioctl.c ++++ b/drivers/media/pci/ivtv/ivtv-ioctl.c +@@ -443,7 +443,7 @@ static int ivtv_g_fmt_vid_out_overlay(struct file *file, void *fh, struct v4l2_f + struct ivtv_stream *s = &itv->streams[fh2id(fh)->type]; + struct v4l2_window *winfmt = &fmt->fmt.win; + +- if (!(s->caps & V4L2_CAP_VIDEO_OUTPUT_OVERLAY)) ++ if (!(s->vdev.device_caps & V4L2_CAP_VIDEO_OUTPUT_OVERLAY)) + return -EINVAL; + if (!itv->osd_video_pbase) + return -EINVAL; +@@ -554,7 +554,7 @@ static int ivtv_try_fmt_vid_out_overlay(struct file *file, void *fh, struct v4l2 + u32 chromakey = fmt->fmt.win.chromakey; + u8 global_alpha = fmt->fmt.win.global_alpha; + +- if (!(s->caps & V4L2_CAP_VIDEO_OUTPUT_OVERLAY)) ++ if (!(s->vdev.device_caps & V4L2_CAP_VIDEO_OUTPUT_OVERLAY)) + return -EINVAL; + if (!itv->osd_video_pbase) + return -EINVAL; +@@ -1386,7 +1386,7 @@ static int ivtv_g_fbuf(struct file *file, void *fh, struct v4l2_framebuffer *fb) + 0, + }; + +- if (!(s->caps & V4L2_CAP_VIDEO_OUTPUT_OVERLAY)) ++ if (!(s->vdev.device_caps & V4L2_CAP_VIDEO_OUTPUT_OVERLAY)) + return -ENOTTY; + if (!itv->osd_video_pbase) + return -ENOTTY; +@@ -1453,7 +1453,7 @@ static int ivtv_s_fbuf(struct file *file, void *fh, const struct v4l2_framebuffe + struct ivtv_stream *s = &itv->streams[fh2id(fh)->type]; + struct yuv_playback_info *yi = &itv->yuv_info; + +- if (!(s->caps & V4L2_CAP_VIDEO_OUTPUT_OVERLAY)) ++ if (!(s->vdev.device_caps & V4L2_CAP_VIDEO_OUTPUT_OVERLAY)) + return -ENOTTY; + if (!itv->osd_video_pbase) + return -ENOTTY; +@@ -1473,7 +1473,7 @@ static int ivtv_overlay(struct file *file, void *fh, unsigned int on) + struct ivtv *itv = id->itv; + struct ivtv_stream *s = &itv->streams[fh2id(fh)->type]; + +- if (!(s->caps & V4L2_CAP_VIDEO_OUTPUT_OVERLAY)) ++ if (!(s->vdev.device_caps & V4L2_CAP_VIDEO_OUTPUT_OVERLAY)) + return -ENOTTY; + if (!itv->osd_video_pbase) + return -ENOTTY; +diff --git a/drivers/media/pci/ivtv/ivtv-streams.c b/drivers/media/pci/ivtv/ivtv-streams.c +index f7de9118f609d..200d2100dbffd 100644 +--- a/drivers/media/pci/ivtv/ivtv-streams.c ++++ b/drivers/media/pci/ivtv/ivtv-streams.c +@@ -176,7 +176,7 @@ static void ivtv_stream_init(struct ivtv *itv, int type) + s->itv = itv; + s->type = type; + s->name = ivtv_stream_info[type].name; +- s->caps = ivtv_stream_info[type].v4l2_caps; ++ s->vdev.device_caps = ivtv_stream_info[type].v4l2_caps; + + if (ivtv_stream_info[type].pio) + s->dma = PCI_DMA_NONE; +@@ -299,12 +299,9 @@ static int ivtv_reg_dev(struct ivtv *itv, int type) + if (s_mpg->vdev.v4l2_dev) + num = s_mpg->vdev.num + ivtv_stream_info[type].num_offset; + } +- s->vdev.device_caps = s->caps; +- if (itv->osd_video_pbase) { +- itv->streams[IVTV_DEC_STREAM_TYPE_YUV].vdev.device_caps |= +- V4L2_CAP_VIDEO_OUTPUT_OVERLAY; +- itv->streams[IVTV_DEC_STREAM_TYPE_MPG].vdev.device_caps |= +- V4L2_CAP_VIDEO_OUTPUT_OVERLAY; ++ if (itv->osd_video_pbase && (type == IVTV_DEC_STREAM_TYPE_YUV || ++ type == IVTV_DEC_STREAM_TYPE_MPG)) { ++ s->vdev.device_caps |= V4L2_CAP_VIDEO_OUTPUT_OVERLAY; + itv->v4l2_cap |= V4L2_CAP_VIDEO_OUTPUT_OVERLAY; + } + video_set_drvdata(&s->vdev, s); +diff --git a/drivers/media/platform/aspeed-video.c b/drivers/media/platform/aspeed-video.c +index 1e0867016bf37..c87eddb1c93f7 100644 +--- a/drivers/media/platform/aspeed-video.c ++++ b/drivers/media/platform/aspeed-video.c +@@ -151,7 +151,7 @@ + #define VE_SRC_TB_EDGE_DET_BOT GENMASK(28, VE_SRC_TB_EDGE_DET_BOT_SHF) + + #define VE_MODE_DETECT_STATUS 0x098 +-#define VE_MODE_DETECT_H_PIXELS GENMASK(11, 0) ++#define VE_MODE_DETECT_H_PERIOD GENMASK(11, 0) + #define VE_MODE_DETECT_V_LINES_SHF 16 + #define VE_MODE_DETECT_V_LINES GENMASK(27, VE_MODE_DETECT_V_LINES_SHF) + #define VE_MODE_DETECT_STATUS_VSYNC BIT(28) +@@ -162,6 +162,8 @@ + #define VE_SYNC_STATUS_VSYNC_SHF 16 + #define VE_SYNC_STATUS_VSYNC GENMASK(27, VE_SYNC_STATUS_VSYNC_SHF) + ++#define VE_H_TOTAL_PIXELS 0x0A0 ++ + #define VE_INTERRUPT_CTRL 0x304 + #define VE_INTERRUPT_STATUS 0x308 + #define VE_INTERRUPT_MODE_DETECT_WD BIT(0) +@@ -743,6 +745,7 @@ static void aspeed_video_get_resolution(struct aspeed_video *video) + u32 src_lr_edge; + u32 src_tb_edge; + u32 sync; ++ u32 htotal; + struct v4l2_bt_timings *det = &video->detected_timings; + + det->width = MIN_WIDTH; +@@ -787,6 +790,7 @@ static void aspeed_video_get_resolution(struct aspeed_video *video) + src_tb_edge = aspeed_video_read(video, VE_SRC_TB_EDGE_DET); + mds = aspeed_video_read(video, VE_MODE_DETECT_STATUS); + sync = aspeed_video_read(video, VE_SYNC_STATUS); ++ htotal = aspeed_video_read(video, VE_H_TOTAL_PIXELS); + + video->frame_bottom = (src_tb_edge & VE_SRC_TB_EDGE_DET_BOT) >> + VE_SRC_TB_EDGE_DET_BOT_SHF; +@@ -803,8 +807,7 @@ static void aspeed_video_get_resolution(struct aspeed_video *video) + VE_SRC_LR_EDGE_DET_RT_SHF; + video->frame_left = src_lr_edge & VE_SRC_LR_EDGE_DET_LEFT; + det->hfrontporch = video->frame_left; +- det->hbackporch = (mds & VE_MODE_DETECT_H_PIXELS) - +- video->frame_right; ++ det->hbackporch = htotal - video->frame_right; + det->hsync = sync & VE_SYNC_STATUS_HSYNC; + if (video->frame_left > video->frame_right) + continue; +diff --git a/drivers/media/platform/coda/coda-common.c b/drivers/media/platform/coda/coda-common.c +index 834f11fe9dc29..0adc54832657b 100644 +--- a/drivers/media/platform/coda/coda-common.c ++++ b/drivers/media/platform/coda/coda-common.c +@@ -372,6 +372,7 @@ static struct vdoa_data *coda_get_vdoa_data(void) + if (!vdoa_data) + vdoa_data = ERR_PTR(-EPROBE_DEFER); + ++ put_device(&vdoa_pdev->dev); + out: + of_node_put(vdoa_node); + +diff --git a/drivers/media/platform/davinci/vpif.c b/drivers/media/platform/davinci/vpif.c +index df66461f5d4f1..e7e8eba048acf 100644 +--- a/drivers/media/platform/davinci/vpif.c ++++ b/drivers/media/platform/davinci/vpif.c +@@ -496,6 +496,7 @@ static int vpif_probe(struct platform_device *pdev) + + static int vpif_remove(struct platform_device *pdev) + { ++ pm_runtime_put(&pdev->dev); + pm_runtime_disable(&pdev->dev); + return 0; + } +diff --git a/drivers/media/usb/em28xx/em28xx-cards.c b/drivers/media/usb/em28xx/em28xx-cards.c +index bfca9d0a1fe15..5ae13ee9272d5 100644 +--- a/drivers/media/usb/em28xx/em28xx-cards.c ++++ b/drivers/media/usb/em28xx/em28xx-cards.c +@@ -3821,6 +3821,8 @@ static int em28xx_usb_probe(struct usb_interface *intf, + goto err_free; + } + ++ kref_init(&dev->ref); ++ + dev->devno = nr; + dev->model = id->driver_info; + dev->alt = -1; +@@ -3921,6 +3923,8 @@ static int em28xx_usb_probe(struct usb_interface *intf, + } + + if (dev->board.has_dual_ts && em28xx_duplicate_dev(dev) == 0) { ++ kref_init(&dev->dev_next->ref); ++ + dev->dev_next->ts = SECONDARY_TS; + dev->dev_next->alt = -1; + dev->dev_next->is_audio_only = has_vendor_audio && +@@ -3975,12 +3979,8 @@ static int em28xx_usb_probe(struct usb_interface *intf, + em28xx_write_reg(dev, 0x0b, 0x82); + mdelay(100); + } +- +- kref_init(&dev->dev_next->ref); + } + +- kref_init(&dev->ref); +- + request_modules(dev); + + /* +@@ -4035,11 +4035,8 @@ static void em28xx_usb_disconnect(struct usb_interface *intf) + + em28xx_close_extension(dev); + +- if (dev->dev_next) { +- em28xx_close_extension(dev->dev_next); ++ if (dev->dev_next) + em28xx_release_resources(dev->dev_next); +- } +- + em28xx_release_resources(dev); + + if (dev->dev_next) { +diff --git a/drivers/media/usb/go7007/s2250-board.c b/drivers/media/usb/go7007/s2250-board.c +index 49e75a1a1f3f8..af3b18c6d9e17 100644 +--- a/drivers/media/usb/go7007/s2250-board.c ++++ b/drivers/media/usb/go7007/s2250-board.c +@@ -504,6 +504,7 @@ static int s2250_probe(struct i2c_client *client, + u8 *data; + struct go7007 *go = i2c_get_adapdata(adapter); + struct go7007_usb *usb = go->hpi_context; ++ int err = -EIO; + + audio = i2c_new_dummy_device(adapter, TLV320_ADDRESS >> 1); + if (IS_ERR(audio)) +@@ -532,11 +533,8 @@ static int s2250_probe(struct i2c_client *client, + V4L2_CID_HUE, -512, 511, 1, 0); + sd->ctrl_handler = &state->hdl; + if (state->hdl.error) { +- int err = state->hdl.error; +- +- v4l2_ctrl_handler_free(&state->hdl); +- kfree(state); +- return err; ++ err = state->hdl.error; ++ goto fail; + } + + state->std = V4L2_STD_NTSC; +@@ -600,7 +598,7 @@ fail: + i2c_unregister_device(audio); + v4l2_ctrl_handler_free(&state->hdl); + kfree(state); +- return -EIO; ++ return err; + } + + static int s2250_remove(struct i2c_client *client) +diff --git a/drivers/media/usb/hdpvr/hdpvr-video.c b/drivers/media/usb/hdpvr/hdpvr-video.c +index bad71d863d395..7849f1fbbcc4d 100644 +--- a/drivers/media/usb/hdpvr/hdpvr-video.c ++++ b/drivers/media/usb/hdpvr/hdpvr-video.c +@@ -308,7 +308,6 @@ static int hdpvr_start_streaming(struct hdpvr_device *dev) + + dev->status = STATUS_STREAMING; + +- INIT_WORK(&dev->worker, hdpvr_transmit_buffers); + schedule_work(&dev->worker); + + v4l2_dbg(MSG_BUFFER, hdpvr_debug, &dev->v4l2_dev, +@@ -1165,6 +1164,9 @@ int hdpvr_register_videodev(struct hdpvr_device *dev, struct device *parent, + bool ac3 = dev->flags & HDPVR_FLAG_AC3_CAP; + int res; + ++ // initialize dev->worker ++ INIT_WORK(&dev->worker, hdpvr_transmit_buffers); ++ + dev->cur_std = V4L2_STD_525_60; + dev->width = 720; + dev->height = 480; +diff --git a/drivers/media/usb/stk1160/stk1160-core.c b/drivers/media/usb/stk1160/stk1160-core.c +index 4e1698f788187..ce717502ea4c3 100644 +--- a/drivers/media/usb/stk1160/stk1160-core.c ++++ b/drivers/media/usb/stk1160/stk1160-core.c +@@ -403,7 +403,7 @@ static void stk1160_disconnect(struct usb_interface *interface) + /* Here is the only place where isoc get released */ + stk1160_uninit_isoc(dev); + +- stk1160_clear_queue(dev); ++ stk1160_clear_queue(dev, VB2_BUF_STATE_ERROR); + + video_unregister_device(&dev->vdev); + v4l2_device_disconnect(&dev->v4l2_dev); +diff --git a/drivers/media/usb/stk1160/stk1160-v4l.c b/drivers/media/usb/stk1160/stk1160-v4l.c +index bcd14c66e8dfa..a307807571ab9 100644 +--- a/drivers/media/usb/stk1160/stk1160-v4l.c ++++ b/drivers/media/usb/stk1160/stk1160-v4l.c +@@ -258,7 +258,7 @@ out_uninit: + stk1160_uninit_isoc(dev); + out_stop_hw: + usb_set_interface(dev->udev, 0, 0); +- stk1160_clear_queue(dev); ++ stk1160_clear_queue(dev, VB2_BUF_STATE_QUEUED); + + mutex_unlock(&dev->v4l_lock); + +@@ -306,7 +306,7 @@ static int stk1160_stop_streaming(struct stk1160 *dev) + + stk1160_stop_hw(dev); + +- stk1160_clear_queue(dev); ++ stk1160_clear_queue(dev, VB2_BUF_STATE_ERROR); + + stk1160_dbg("streaming stopped\n"); + +@@ -745,7 +745,7 @@ static const struct video_device v4l_template = { + /********************************************************************/ + + /* Must be called with both v4l_lock and vb_queue_lock hold */ +-void stk1160_clear_queue(struct stk1160 *dev) ++void stk1160_clear_queue(struct stk1160 *dev, enum vb2_buffer_state vb2_state) + { + struct stk1160_buffer *buf; + unsigned long flags; +@@ -756,7 +756,7 @@ void stk1160_clear_queue(struct stk1160 *dev) + buf = list_first_entry(&dev->avail_bufs, + struct stk1160_buffer, list); + list_del(&buf->list); +- vb2_buffer_done(&buf->vb.vb2_buf, VB2_BUF_STATE_ERROR); ++ vb2_buffer_done(&buf->vb.vb2_buf, vb2_state); + stk1160_dbg("buffer [%p/%d] aborted\n", + buf, buf->vb.vb2_buf.index); + } +@@ -766,7 +766,7 @@ void stk1160_clear_queue(struct stk1160 *dev) + buf = dev->isoc_ctl.buf; + dev->isoc_ctl.buf = NULL; + +- vb2_buffer_done(&buf->vb.vb2_buf, VB2_BUF_STATE_ERROR); ++ vb2_buffer_done(&buf->vb.vb2_buf, vb2_state); + stk1160_dbg("buffer [%p/%d] aborted\n", + buf, buf->vb.vb2_buf.index); + } +diff --git a/drivers/media/usb/stk1160/stk1160.h b/drivers/media/usb/stk1160/stk1160.h +index a31ea1c80f255..a70963ce87533 100644 +--- a/drivers/media/usb/stk1160/stk1160.h ++++ b/drivers/media/usb/stk1160/stk1160.h +@@ -166,7 +166,7 @@ struct regval { + int stk1160_vb2_setup(struct stk1160 *dev); + int stk1160_video_register(struct stk1160 *dev); + void stk1160_video_unregister(struct stk1160 *dev); +-void stk1160_clear_queue(struct stk1160 *dev); ++void stk1160_clear_queue(struct stk1160 *dev, enum vb2_buffer_state vb2_state); + + /* Provided by stk1160-video.c */ + int stk1160_alloc_isoc(struct stk1160 *dev); +diff --git a/drivers/memory/emif.c b/drivers/memory/emif.c +index af296b6fcbbdc..9c4c668f9a88a 100644 +--- a/drivers/memory/emif.c ++++ b/drivers/memory/emif.c +@@ -1423,7 +1423,7 @@ static struct emif_data *__init_or_module get_device_details( + temp = devm_kzalloc(dev, sizeof(*pd), GFP_KERNEL); + dev_info = devm_kzalloc(dev, sizeof(*dev_info), GFP_KERNEL); + +- if (!emif || !pd || !dev_info) { ++ if (!emif || !temp || !dev_info) { + dev_err(dev, "%s:%d: allocation error\n", __func__, __LINE__); + goto error; + } +@@ -1515,7 +1515,7 @@ static int __init_or_module emif_probe(struct platform_device *pdev) + { + struct emif_data *emif; + struct resource *res; +- int irq; ++ int irq, ret; + + if (pdev->dev.of_node) + emif = of_get_memory_device_details(pdev->dev.of_node, &pdev->dev); +@@ -1549,7 +1549,9 @@ static int __init_or_module emif_probe(struct platform_device *pdev) + emif_onetime_settings(emif); + emif_debugfs_init(emif); + disable_and_clear_all_interrupts(emif); +- setup_interrupts(emif, irq); ++ ret = setup_interrupts(emif, irq); ++ if (ret) ++ goto error; + + /* One-time actions taken on probing the first device */ + if (!emif1) { +diff --git a/drivers/mfd/asic3.c b/drivers/mfd/asic3.c +index a6bd2134cea2a..14e4bbe6a9da3 100644 +--- a/drivers/mfd/asic3.c ++++ b/drivers/mfd/asic3.c +@@ -914,14 +914,14 @@ static int __init asic3_mfd_probe(struct platform_device *pdev, + ret = mfd_add_devices(&pdev->dev, pdev->id, + &asic3_cell_ds1wm, 1, mem, asic->irq_base, NULL); + if (ret < 0) +- goto out; ++ goto out_unmap; + } + + if (mem_sdio && (irq >= 0)) { + ret = mfd_add_devices(&pdev->dev, pdev->id, + &asic3_cell_mmc, 1, mem_sdio, irq, NULL); + if (ret < 0) +- goto out; ++ goto out_unmap; + } + + ret = 0; +@@ -935,8 +935,12 @@ static int __init asic3_mfd_probe(struct platform_device *pdev, + ret = mfd_add_devices(&pdev->dev, 0, + asic3_cell_leds, ASIC3_NUM_LEDS, NULL, 0, NULL); + } ++ return ret; + +- out: ++out_unmap: ++ if (asic->tmio_cnf) ++ iounmap(asic->tmio_cnf); ++out: + return ret; + } + +diff --git a/drivers/mfd/mc13xxx-core.c b/drivers/mfd/mc13xxx-core.c +index 1abe7432aad82..e281a9202f110 100644 +--- a/drivers/mfd/mc13xxx-core.c ++++ b/drivers/mfd/mc13xxx-core.c +@@ -323,8 +323,10 @@ int mc13xxx_adc_do_conversion(struct mc13xxx *mc13xxx, unsigned int mode, + adc1 |= MC13783_ADC1_ATOX; + + dev_dbg(mc13xxx->dev, "%s: request irq\n", __func__); +- mc13xxx_irq_request(mc13xxx, MC13XXX_IRQ_ADCDONE, ++ ret = mc13xxx_irq_request(mc13xxx, MC13XXX_IRQ_ADCDONE, + mc13xxx_handler_adcdone, __func__, &adcdone_data); ++ if (ret) ++ goto out; + + mc13xxx_reg_write(mc13xxx, MC13XXX_ADC0, adc0); + mc13xxx_reg_write(mc13xxx, MC13XXX_ADC1, adc1); +diff --git a/drivers/misc/cardreader/alcor_pci.c b/drivers/misc/cardreader/alcor_pci.c +index 1fadb95b85b09..ba5d5c102b3cc 100644 +--- a/drivers/misc/cardreader/alcor_pci.c ++++ b/drivers/misc/cardreader/alcor_pci.c +@@ -260,7 +260,7 @@ static int alcor_pci_probe(struct pci_dev *pdev, + if (!priv) + return -ENOMEM; + +- ret = ida_simple_get(&alcor_pci_idr, 0, 0, GFP_KERNEL); ++ ret = ida_alloc(&alcor_pci_idr, GFP_KERNEL); + if (ret < 0) + return ret; + priv->id = ret; +@@ -274,7 +274,8 @@ static int alcor_pci_probe(struct pci_dev *pdev, + ret = pci_request_regions(pdev, DRV_NAME_ALCOR_PCI); + if (ret) { + dev_err(&pdev->dev, "Cannot request region\n"); +- return -ENOMEM; ++ ret = -ENOMEM; ++ goto error_free_ida; + } + + if (!(pci_resource_flags(pdev, bar) & IORESOURCE_MEM)) { +@@ -318,6 +319,8 @@ static int alcor_pci_probe(struct pci_dev *pdev, + + error_release_regions: + pci_release_regions(pdev); ++error_free_ida: ++ ida_free(&alcor_pci_idr, priv->id); + return ret; + } + +@@ -331,7 +334,7 @@ static void alcor_pci_remove(struct pci_dev *pdev) + + mfd_remove_devices(&pdev->dev); + +- ida_simple_remove(&alcor_pci_idr, priv->id); ++ ida_free(&alcor_pci_idr, priv->id); + + pci_release_regions(pdev); + pci_set_drvdata(pdev, NULL); +diff --git a/drivers/misc/kgdbts.c b/drivers/misc/kgdbts.c +index 8d18f19c99c4b..2f88581057335 100644 +--- a/drivers/misc/kgdbts.c ++++ b/drivers/misc/kgdbts.c +@@ -1060,10 +1060,10 @@ static int kgdbts_option_setup(char *opt) + { + if (strlen(opt) >= MAX_CONFIG_LEN) { + printk(KERN_ERR "kgdbts: config string too long\n"); +- return -ENOSPC; ++ return 1; + } + strcpy(config, opt); +- return 0; ++ return 1; + } + + __setup("kgdbts=", kgdbts_option_setup); +diff --git a/drivers/mmc/core/host.c b/drivers/mmc/core/host.c +index e955f1ef25643..32801639e0be5 100644 +--- a/drivers/mmc/core/host.c ++++ b/drivers/mmc/core/host.c +@@ -497,6 +497,16 @@ struct mmc_host *mmc_alloc_host(int extra, struct device *dev) + + EXPORT_SYMBOL(mmc_alloc_host); + ++static int mmc_validate_host_caps(struct mmc_host *host) ++{ ++ if (host->caps & MMC_CAP_SDIO_IRQ && !host->ops->enable_sdio_irq) { ++ dev_warn(host->parent, "missing ->enable_sdio_irq() ops\n"); ++ return -EINVAL; ++ } ++ ++ return 0; ++} ++ + /** + * mmc_add_host - initialise host hardware + * @host: mmc host +@@ -509,8 +519,9 @@ int mmc_add_host(struct mmc_host *host) + { + int err; + +- WARN_ON((host->caps & MMC_CAP_SDIO_IRQ) && +- !host->ops->enable_sdio_irq); ++ err = mmc_validate_host_caps(host); ++ if (err) ++ return err; + + err = device_add(&host->class_dev); + if (err) +diff --git a/drivers/mmc/host/davinci_mmc.c b/drivers/mmc/host/davinci_mmc.c +index ebfaeb33bc8c0..ade7c022a33c0 100644 +--- a/drivers/mmc/host/davinci_mmc.c ++++ b/drivers/mmc/host/davinci_mmc.c +@@ -1376,8 +1376,12 @@ static int davinci_mmcsd_suspend(struct device *dev) + static int davinci_mmcsd_resume(struct device *dev) + { + struct mmc_davinci_host *host = dev_get_drvdata(dev); ++ int ret; ++ ++ ret = clk_enable(host->clk); ++ if (ret) ++ return ret; + +- clk_enable(host->clk); + mmc_davinci_reset_ctrl(host, 0); + + return 0; +diff --git a/drivers/mmc/host/mmci_stm32_sdmmc.c b/drivers/mmc/host/mmci_stm32_sdmmc.c +index 0953bd8a4f79d..3bb59d670220f 100644 +--- a/drivers/mmc/host/mmci_stm32_sdmmc.c ++++ b/drivers/mmc/host/mmci_stm32_sdmmc.c +@@ -36,8 +36,8 @@ int sdmmc_idma_validate_data(struct mmci_host *host, + * excepted the last element which has no constraint on idmasize + */ + for_each_sg(data->sg, sg, data->sg_len - 1, i) { +- if (!IS_ALIGNED(sg_dma_address(data->sg), sizeof(u32)) || +- !IS_ALIGNED(sg_dma_len(data->sg), SDMMC_IDMA_BURST)) { ++ if (!IS_ALIGNED(sg->offset, sizeof(u32)) || ++ !IS_ALIGNED(sg->length, SDMMC_IDMA_BURST)) { + dev_err(mmc_dev(host->mmc), + "unaligned scatterlist: ofst:%x length:%d\n", + data->sg->offset, data->sg->length); +@@ -45,7 +45,7 @@ int sdmmc_idma_validate_data(struct mmci_host *host, + } + } + +- if (!IS_ALIGNED(sg_dma_address(data->sg), sizeof(u32))) { ++ if (!IS_ALIGNED(sg->offset, sizeof(u32))) { + dev_err(mmc_dev(host->mmc), + "unaligned last scatterlist: ofst:%x length:%d\n", + data->sg->offset, data->sg->length); +diff --git a/drivers/mmc/host/renesas_sdhi_core.c b/drivers/mmc/host/renesas_sdhi_core.c +index 689eb119d44fc..23fd93407eced 100644 +--- a/drivers/mmc/host/renesas_sdhi_core.c ++++ b/drivers/mmc/host/renesas_sdhi_core.c +@@ -349,10 +349,10 @@ static void renesas_sdhi_hs400_complete(struct tmio_mmc_host *host) + SH_MOBILE_SDHI_SCC_TMPPORT2_HS400OSEL) | + sd_scc_read32(host, priv, SH_MOBILE_SDHI_SCC_TMPPORT2)); + +- /* Set the sampling clock selection range of HS400 mode */ + sd_scc_write32(host, priv, SH_MOBILE_SDHI_SCC_DTCNTL, + SH_MOBILE_SDHI_SCC_DTCNTL_TAPEN | +- 0x4 << SH_MOBILE_SDHI_SCC_DTCNTL_TAPNUM_SHIFT); ++ sd_scc_read32(host, priv, ++ SH_MOBILE_SDHI_SCC_DTCNTL)); + + + if (host->pdata->flags & TMIO_MMC_HAVE_4TAP_HS400) +diff --git a/drivers/mmc/host/sdhci-xenon.c b/drivers/mmc/host/sdhci-xenon.c +index 5f57e78e5f13f..6f6fb4c4448f0 100644 +--- a/drivers/mmc/host/sdhci-xenon.c ++++ b/drivers/mmc/host/sdhci-xenon.c +@@ -240,16 +240,6 @@ static void xenon_voltage_switch(struct sdhci_host *host) + { + /* Wait for 5ms after set 1.8V signal enable bit */ + usleep_range(5000, 5500); +- +- /* +- * For some reason the controller's Host Control2 register reports +- * the bit representing 1.8V signaling as 0 when read after it was +- * written as 1. Subsequent read reports 1. +- * +- * Since this may cause some issues, do an empty read of the Host +- * Control2 register here to circumvent this. +- */ +- sdhci_readw(host, SDHCI_HOST_CONTROL2); + } + + static const struct sdhci_ops sdhci_xenon_ops = { +diff --git a/drivers/mtd/nand/onenand/generic.c b/drivers/mtd/nand/onenand/generic.c +index 8b6f4da5d7201..a4b8b65fe15f5 100644 +--- a/drivers/mtd/nand/onenand/generic.c ++++ b/drivers/mtd/nand/onenand/generic.c +@@ -53,7 +53,12 @@ static int generic_onenand_probe(struct platform_device *pdev) + } + + info->onenand.mmcontrol = pdata ? pdata->mmcontrol : NULL; +- info->onenand.irq = platform_get_irq(pdev, 0); ++ ++ err = platform_get_irq(pdev, 0); ++ if (err < 0) ++ goto out_iounmap; ++ ++ info->onenand.irq = err; + + info->mtd.dev.parent = &pdev->dev; + info->mtd.priv = &info->onenand; +diff --git a/drivers/mtd/nand/raw/atmel/nand-controller.c b/drivers/mtd/nand/raw/atmel/nand-controller.c +index 23d11e8b56441..17c751f359d3d 100644 +--- a/drivers/mtd/nand/raw/atmel/nand-controller.c ++++ b/drivers/mtd/nand/raw/atmel/nand-controller.c +@@ -2004,13 +2004,15 @@ static int atmel_nand_controller_init(struct atmel_nand_controller *nc, + nc->mck = of_clk_get(dev->parent->of_node, 0); + if (IS_ERR(nc->mck)) { + dev_err(dev, "Failed to retrieve MCK clk\n"); +- return PTR_ERR(nc->mck); ++ ret = PTR_ERR(nc->mck); ++ goto out_release_dma; + } + + np = of_parse_phandle(dev->parent->of_node, "atmel,smc", 0); + if (!np) { + dev_err(dev, "Missing or invalid atmel,smc property\n"); +- return -EINVAL; ++ ret = -EINVAL; ++ goto out_release_dma; + } + + nc->smc = syscon_node_to_regmap(np); +@@ -2018,10 +2020,16 @@ static int atmel_nand_controller_init(struct atmel_nand_controller *nc, + if (IS_ERR(nc->smc)) { + ret = PTR_ERR(nc->smc); + dev_err(dev, "Could not get SMC regmap (err = %d)\n", ret); +- return ret; ++ goto out_release_dma; + } + + return 0; ++ ++out_release_dma: ++ if (nc->dmac) ++ dma_release_channel(nc->dmac); ++ ++ return ret; + } + + static int +diff --git a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c +index ab2f824abf549..02218c3b548f9 100644 +--- a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c ++++ b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c +@@ -645,6 +645,7 @@ static void gpmi_nfc_compute_timings(struct gpmi_nand_data *this, + const struct nand_sdr_timings *sdr) + { + struct gpmi_nfc_hardware_timing *hw = &this->hw; ++ struct resources *r = &this->resources; + unsigned int dll_threshold_ps = this->devdata->max_chain_delay; + unsigned int period_ps, reference_period_ps; + unsigned int data_setup_cycles, data_hold_cycles, addr_setup_cycles; +@@ -668,6 +669,8 @@ static void gpmi_nfc_compute_timings(struct gpmi_nand_data *this, + wrn_dly_sel = BV_GPMI_CTRL1_WRN_DLY_SEL_NO_DELAY; + } + ++ hw->clk_rate = clk_round_rate(r->clock[0], hw->clk_rate); ++ + /* SDR core timings are given in picoseconds */ + period_ps = div_u64((u64)NSEC_PER_SEC * 1000, hw->clk_rate); + +diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c +index d636bbe214cb9..df521ff0b3280 100644 +--- a/drivers/mtd/ubi/build.c ++++ b/drivers/mtd/ubi/build.c +@@ -350,9 +350,6 @@ static ssize_t dev_attribute_show(struct device *dev, + * we still can use 'ubi->ubi_num'. + */ + ubi = container_of(dev, struct ubi_device, dev); +- ubi = ubi_get_device(ubi->ubi_num); +- if (!ubi) +- return -ENODEV; + + if (attr == &dev_eraseblock_size) + ret = sprintf(buf, "%d\n", ubi->leb_size); +@@ -381,7 +378,6 @@ static ssize_t dev_attribute_show(struct device *dev, + else + ret = -EINVAL; + +- ubi_put_device(ubi); + return ret; + } + +@@ -956,9 +952,6 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num, + goto out_detach; + } + +- /* Make device "available" before it becomes accessible via sysfs */ +- ubi_devices[ubi_num] = ubi; +- + err = uif_init(ubi); + if (err) + goto out_detach; +@@ -1003,6 +996,7 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num, + wake_up_process(ubi->bgt_thread); + spin_unlock(&ubi->wl_lock); + ++ ubi_devices[ubi_num] = ubi; + ubi_notify_all(ubi, UBI_VOLUME_ADDED, NULL); + return ubi_num; + +@@ -1011,7 +1005,6 @@ out_debugfs: + out_uif: + uif_close(ubi); + out_detach: +- ubi_devices[ubi_num] = NULL; + ubi_wl_close(ubi); + ubi_free_internal_volumes(ubi); + vfree(ubi->vtbl); +diff --git a/drivers/mtd/ubi/fastmap.c b/drivers/mtd/ubi/fastmap.c +index 53f448e7433a9..6e95c4b1473e6 100644 +--- a/drivers/mtd/ubi/fastmap.c ++++ b/drivers/mtd/ubi/fastmap.c +@@ -468,7 +468,9 @@ static int scan_pool(struct ubi_device *ubi, struct ubi_attach_info *ai, + if (err == UBI_IO_FF_BITFLIPS) + scrub = 1; + +- add_aeb(ai, free, pnum, ec, scrub); ++ ret = add_aeb(ai, free, pnum, ec, scrub); ++ if (ret) ++ goto out; + continue; + } else if (err == 0 || err == UBI_IO_BITFLIPS) { + dbg_bld("Found non empty PEB:%i in pool", pnum); +@@ -638,8 +640,10 @@ static int ubi_attach_fastmap(struct ubi_device *ubi, + if (fm_pos >= fm_size) + goto fail_bad; + +- add_aeb(ai, &ai->free, be32_to_cpu(fmec->pnum), +- be32_to_cpu(fmec->ec), 0); ++ ret = add_aeb(ai, &ai->free, be32_to_cpu(fmec->pnum), ++ be32_to_cpu(fmec->ec), 0); ++ if (ret) ++ goto fail; + } + + /* read EC values from used list */ +@@ -649,8 +653,10 @@ static int ubi_attach_fastmap(struct ubi_device *ubi, + if (fm_pos >= fm_size) + goto fail_bad; + +- add_aeb(ai, &used, be32_to_cpu(fmec->pnum), +- be32_to_cpu(fmec->ec), 0); ++ ret = add_aeb(ai, &used, be32_to_cpu(fmec->pnum), ++ be32_to_cpu(fmec->ec), 0); ++ if (ret) ++ goto fail; + } + + /* read EC values from scrub list */ +@@ -660,8 +666,10 @@ static int ubi_attach_fastmap(struct ubi_device *ubi, + if (fm_pos >= fm_size) + goto fail_bad; + +- add_aeb(ai, &used, be32_to_cpu(fmec->pnum), +- be32_to_cpu(fmec->ec), 1); ++ ret = add_aeb(ai, &used, be32_to_cpu(fmec->pnum), ++ be32_to_cpu(fmec->ec), 1); ++ if (ret) ++ goto fail; + } + + /* read EC values from erase list */ +@@ -671,8 +679,10 @@ static int ubi_attach_fastmap(struct ubi_device *ubi, + if (fm_pos >= fm_size) + goto fail_bad; + +- add_aeb(ai, &ai->erase, be32_to_cpu(fmec->pnum), +- be32_to_cpu(fmec->ec), 1); ++ ret = add_aeb(ai, &ai->erase, be32_to_cpu(fmec->pnum), ++ be32_to_cpu(fmec->ec), 1); ++ if (ret) ++ goto fail; + } + + ai->mean_ec = div_u64(ai->ec_sum, ai->ec_count); +diff --git a/drivers/mtd/ubi/vmt.c b/drivers/mtd/ubi/vmt.c +index 139ee132bfbcf..1bc7b3a056046 100644 +--- a/drivers/mtd/ubi/vmt.c ++++ b/drivers/mtd/ubi/vmt.c +@@ -56,16 +56,11 @@ static ssize_t vol_attribute_show(struct device *dev, + { + int ret; + struct ubi_volume *vol = container_of(dev, struct ubi_volume, dev); +- struct ubi_device *ubi; +- +- ubi = ubi_get_device(vol->ubi->ubi_num); +- if (!ubi) +- return -ENODEV; ++ struct ubi_device *ubi = vol->ubi; + + spin_lock(&ubi->volumes_lock); + if (!ubi->volumes[vol->vol_id]) { + spin_unlock(&ubi->volumes_lock); +- ubi_put_device(ubi); + return -ENODEV; + } + /* Take a reference to prevent volume removal */ +@@ -103,7 +98,6 @@ static ssize_t vol_attribute_show(struct device *dev, + vol->ref_count -= 1; + ubi_assert(vol->ref_count >= 0); + spin_unlock(&ubi->volumes_lock); +- ubi_put_device(ubi); + return ret; + } + +diff --git a/drivers/net/can/usb/ems_usb.c b/drivers/net/can/usb/ems_usb.c +index 249d2fba28c7f..6458da9c13b95 100644 +--- a/drivers/net/can/usb/ems_usb.c ++++ b/drivers/net/can/usb/ems_usb.c +@@ -823,7 +823,6 @@ static netdev_tx_t ems_usb_start_xmit(struct sk_buff *skb, struct net_device *ne + + usb_unanchor_urb(urb); + usb_free_coherent(dev->udev, size, buf, urb->transfer_dma); +- dev_kfree_skb(skb); + + atomic_dec(&dev->active_tx_urbs); + +diff --git a/drivers/net/can/usb/mcba_usb.c b/drivers/net/can/usb/mcba_usb.c +index 41eee6f0491c6..957e51a77d4d1 100644 +--- a/drivers/net/can/usb/mcba_usb.c ++++ b/drivers/net/can/usb/mcba_usb.c +@@ -33,10 +33,6 @@ + #define MCBA_USB_RX_BUFF_SIZE 64 + #define MCBA_USB_TX_BUFF_SIZE (sizeof(struct mcba_usb_msg)) + +-/* MCBA endpoint numbers */ +-#define MCBA_USB_EP_IN 1 +-#define MCBA_USB_EP_OUT 1 +- + /* Microchip command id */ + #define MBCA_CMD_RECEIVE_MESSAGE 0xE3 + #define MBCA_CMD_I_AM_ALIVE_FROM_CAN 0xF5 +@@ -84,6 +80,8 @@ struct mcba_priv { + atomic_t free_ctx_cnt; + void *rxbuf[MCBA_MAX_RX_URBS]; + dma_addr_t rxbuf_dma[MCBA_MAX_RX_URBS]; ++ int rx_pipe; ++ int tx_pipe; + }; + + /* CAN frame */ +@@ -272,10 +270,8 @@ static netdev_tx_t mcba_usb_xmit(struct mcba_priv *priv, + + memcpy(buf, usb_msg, MCBA_USB_TX_BUFF_SIZE); + +- usb_fill_bulk_urb(urb, priv->udev, +- usb_sndbulkpipe(priv->udev, MCBA_USB_EP_OUT), buf, +- MCBA_USB_TX_BUFF_SIZE, mcba_usb_write_bulk_callback, +- ctx); ++ usb_fill_bulk_urb(urb, priv->udev, priv->tx_pipe, buf, MCBA_USB_TX_BUFF_SIZE, ++ mcba_usb_write_bulk_callback, ctx); + + urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP; + usb_anchor_urb(urb, &priv->tx_submitted); +@@ -368,7 +364,6 @@ static netdev_tx_t mcba_usb_start_xmit(struct sk_buff *skb, + xmit_failed: + can_free_echo_skb(priv->netdev, ctx->ndx); + mcba_usb_free_ctx(ctx); +- dev_kfree_skb(skb); + stats->tx_dropped++; + + return NETDEV_TX_OK; +@@ -611,7 +606,7 @@ static void mcba_usb_read_bulk_callback(struct urb *urb) + resubmit_urb: + + usb_fill_bulk_urb(urb, priv->udev, +- usb_rcvbulkpipe(priv->udev, MCBA_USB_EP_OUT), ++ priv->rx_pipe, + urb->transfer_buffer, MCBA_USB_RX_BUFF_SIZE, + mcba_usb_read_bulk_callback, priv); + +@@ -656,7 +651,7 @@ static int mcba_usb_start(struct mcba_priv *priv) + urb->transfer_dma = buf_dma; + + usb_fill_bulk_urb(urb, priv->udev, +- usb_rcvbulkpipe(priv->udev, MCBA_USB_EP_IN), ++ priv->rx_pipe, + buf, MCBA_USB_RX_BUFF_SIZE, + mcba_usb_read_bulk_callback, priv); + urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP; +@@ -810,6 +805,13 @@ static int mcba_usb_probe(struct usb_interface *intf, + struct mcba_priv *priv; + int err = -ENOMEM; + struct usb_device *usbdev = interface_to_usbdev(intf); ++ struct usb_endpoint_descriptor *in, *out; ++ ++ err = usb_find_common_endpoints(intf->cur_altsetting, &in, &out, NULL, NULL); ++ if (err) { ++ dev_err(&intf->dev, "Can't find endpoints\n"); ++ return err; ++ } + + netdev = alloc_candev(sizeof(struct mcba_priv), MCBA_MAX_TX_URBS); + if (!netdev) { +@@ -855,6 +857,9 @@ static int mcba_usb_probe(struct usb_interface *intf, + goto cleanup_free_candev; + } + ++ priv->rx_pipe = usb_rcvbulkpipe(priv->udev, in->bEndpointAddress); ++ priv->tx_pipe = usb_sndbulkpipe(priv->udev, out->bEndpointAddress); ++ + devm_can_led_init(netdev); + + /* Start USB dev only if we have successfully registered CAN device */ +diff --git a/drivers/net/can/vxcan.c b/drivers/net/can/vxcan.c +index 7000c6cd1e48b..282c53ef76d23 100644 +--- a/drivers/net/can/vxcan.c ++++ b/drivers/net/can/vxcan.c +@@ -148,7 +148,7 @@ static void vxcan_setup(struct net_device *dev) + dev->hard_header_len = 0; + dev->addr_len = 0; + dev->tx_queue_len = 0; +- dev->flags = (IFF_NOARP|IFF_ECHO); ++ dev->flags = IFF_NOARP; + dev->netdev_ops = &vxcan_netdev_ops; + dev->needs_free_netdev = true; + +diff --git a/drivers/net/dsa/bcm_sf2_cfp.c b/drivers/net/dsa/bcm_sf2_cfp.c +index e15d18bb981e9..5cc31118b97e9 100644 +--- a/drivers/net/dsa/bcm_sf2_cfp.c ++++ b/drivers/net/dsa/bcm_sf2_cfp.c +@@ -542,14 +542,14 @@ static void bcm_sf2_cfp_slice_ipv6(struct bcm_sf2_priv *priv, + static struct cfp_rule *bcm_sf2_cfp_rule_find(struct bcm_sf2_priv *priv, + int port, u32 location) + { +- struct cfp_rule *rule = NULL; ++ struct cfp_rule *rule; + + list_for_each_entry(rule, &priv->cfp.rules_list, next) { + if (rule->port == port && rule->fs.location == location) +- break; ++ return rule; + } + +- return rule; ++ return NULL; + } + + static int bcm_sf2_cfp_rule_cmp(struct bcm_sf2_priv *priv, int port, +diff --git a/drivers/net/dsa/microchip/ksz8795_spi.c b/drivers/net/dsa/microchip/ksz8795_spi.c +index 8b00f8e6c02f4..5639c5c59e255 100644 +--- a/drivers/net/dsa/microchip/ksz8795_spi.c ++++ b/drivers/net/dsa/microchip/ksz8795_spi.c +@@ -86,12 +86,23 @@ static const struct of_device_id ksz8795_dt_ids[] = { + }; + MODULE_DEVICE_TABLE(of, ksz8795_dt_ids); + ++static const struct spi_device_id ksz8795_spi_ids[] = { ++ { "ksz8765" }, ++ { "ksz8794" }, ++ { "ksz8795" }, ++ { "ksz8863" }, ++ { "ksz8873" }, ++ { }, ++}; ++MODULE_DEVICE_TABLE(spi, ksz8795_spi_ids); ++ + static struct spi_driver ksz8795_spi_driver = { + .driver = { + .name = "ksz8795-switch", + .owner = THIS_MODULE, + .of_match_table = of_match_ptr(ksz8795_dt_ids), + }, ++ .id_table = ksz8795_spi_ids, + .probe = ksz8795_spi_probe, + .remove = ksz8795_spi_remove, + .shutdown = ksz8795_spi_shutdown, +diff --git a/drivers/net/dsa/microchip/ksz9477_spi.c b/drivers/net/dsa/microchip/ksz9477_spi.c +index 1142768969c20..9bda83d063e8e 100644 +--- a/drivers/net/dsa/microchip/ksz9477_spi.c ++++ b/drivers/net/dsa/microchip/ksz9477_spi.c +@@ -88,12 +88,24 @@ static const struct of_device_id ksz9477_dt_ids[] = { + }; + MODULE_DEVICE_TABLE(of, ksz9477_dt_ids); + ++static const struct spi_device_id ksz9477_spi_ids[] = { ++ { "ksz9477" }, ++ { "ksz9897" }, ++ { "ksz9893" }, ++ { "ksz9563" }, ++ { "ksz8563" }, ++ { "ksz9567" }, ++ { }, ++}; ++MODULE_DEVICE_TABLE(spi, ksz9477_spi_ids); ++ + static struct spi_driver ksz9477_spi_driver = { + .driver = { + .name = "ksz9477-switch", + .owner = THIS_MODULE, + .of_match_table = of_match_ptr(ksz9477_dt_ids), + }, ++ .id_table = ksz9477_spi_ids, + .probe = ksz9477_spi_probe, + .remove = ksz9477_spi_remove, + .shutdown = ksz9477_spi_shutdown, +diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c +index 40b105daaf9e7..87d28ef82559e 100644 +--- a/drivers/net/dsa/mv88e6xxx/chip.c ++++ b/drivers/net/dsa/mv88e6xxx/chip.c +@@ -3062,6 +3062,7 @@ static const struct mv88e6xxx_ops mv88e6097_ops = { + .port_set_duplex = mv88e6xxx_port_set_duplex, + .port_set_speed = mv88e6185_port_set_speed, + .port_tag_remap = mv88e6095_port_tag_remap, ++ .port_set_policy = mv88e6352_port_set_policy, + .port_set_frame_mode = mv88e6351_port_set_frame_mode, + .port_set_egress_floods = mv88e6352_port_set_egress_floods, + .port_set_ether_type = mv88e6351_port_set_ether_type, +diff --git a/drivers/net/ethernet/8390/mcf8390.c b/drivers/net/ethernet/8390/mcf8390.c +index 4ad8031ab6695..065fdbe66c425 100644 +--- a/drivers/net/ethernet/8390/mcf8390.c ++++ b/drivers/net/ethernet/8390/mcf8390.c +@@ -406,12 +406,12 @@ static int mcf8390_init(struct net_device *dev) + static int mcf8390_probe(struct platform_device *pdev) + { + struct net_device *dev; +- struct resource *mem, *irq; ++ struct resource *mem; + resource_size_t msize; +- int ret; ++ int ret, irq; + +- irq = platform_get_resource(pdev, IORESOURCE_IRQ, 0); +- if (irq == NULL) { ++ irq = platform_get_irq(pdev, 0); ++ if (irq < 0) { + dev_err(&pdev->dev, "no IRQ specified?\n"); + return -ENXIO; + } +@@ -434,7 +434,7 @@ static int mcf8390_probe(struct platform_device *pdev) + SET_NETDEV_DEV(dev, &pdev->dev); + platform_set_drvdata(pdev, dev); + +- dev->irq = irq->start; ++ dev->irq = irq; + dev->base_addr = mem->start; + + ret = mcf8390_init(dev); +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h +index 8ba369c0100b4..9e8a0c772ca93 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h +@@ -559,7 +559,8 @@ struct nqe_cn { + #define BNXT_MAX_MTU 9500 + #define BNXT_MAX_PAGE_MODE_MTU \ + ((unsigned int)PAGE_SIZE - VLAN_ETH_HLEN - NET_IP_ALIGN - \ +- XDP_PACKET_HEADROOM) ++ XDP_PACKET_HEADROOM - \ ++ SKB_DATA_ALIGN((unsigned int)sizeof(struct skb_shared_info))) + + #define BNXT_MIN_PKT_SIZE 52 + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +index 97aff84fd1d17..d74c6a34b936a 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +@@ -1673,9 +1673,7 @@ static int bnxt_set_pauseparam(struct net_device *dev, + } + + link_info->autoneg |= BNXT_AUTONEG_FLOW_CTRL; +- if (bp->hwrm_spec_code >= 0x10201) +- link_info->req_flow_ctrl = +- PORT_PHY_CFG_REQ_AUTO_PAUSE_AUTONEG_PAUSE; ++ link_info->req_flow_ctrl = 0; + } else { + /* when transition from auto pause to force pause, + * force a link change +diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-ptp.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-ptp.c +index 6437fe6b9abf0..a6b8f573ab5b5 100644 +--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-ptp.c ++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-ptp.c +@@ -148,7 +148,7 @@ static int dpaa2_ptp_probe(struct fsl_mc_device *mc_dev) + base = of_iomap(node, 0); + if (!base) { + err = -ENOMEM; +- goto err_close; ++ goto err_put; + } + + err = fsl_mc_allocate_irqs(mc_dev); +@@ -191,6 +191,8 @@ err_free_mc_irq: + fsl_mc_free_irqs(mc_dev); + err_unmap: + iounmap(base); ++err_put: ++ of_node_put(node); + err_close: + dprtc_close(mc_dev->mc_io, 0, mc_dev->mc_handle); + err_free_mcp: +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +index 8ecfabaefa85b..d58abdfdb9b7b 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +@@ -8344,11 +8344,11 @@ int hclge_set_vlan_filter(struct hnae3_handle *handle, __be16 proto, + } + + if (!ret) { +- if (is_kill) +- hclge_rm_vport_vlan_table(vport, vlan_id, false); +- else ++ if (!is_kill) + hclge_add_vport_vlan_table(vport, vlan_id, + writen_to_tbl); ++ else if (is_kill && vlan_id != 0) ++ hclge_rm_vport_vlan_table(vport, vlan_id, false); + } else if (is_kill) { + /* when remove hw vlan filter failed, record the vlan id, + * and try to remove it from hw later, to be consistence +diff --git a/drivers/net/ethernet/intel/i40e/i40e_xsk.c b/drivers/net/ethernet/intel/i40e/i40e_xsk.c +index a9ad788c4913d..fd2da58c71401 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_xsk.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_xsk.c +@@ -505,13 +505,11 @@ static struct sk_buff *i40e_construct_skb_zc(struct i40e_ring *rx_ring, + struct sk_buff *skb; + + /* allocate a skb to store the frags */ +- skb = __napi_alloc_skb(&rx_ring->q_vector->napi, +- xdp->data_end - xdp->data_hard_start, ++ skb = __napi_alloc_skb(&rx_ring->q_vector->napi, datasize, + GFP_ATOMIC | __GFP_NOWARN); + if (unlikely(!skb)) + return NULL; + +- skb_reserve(skb, xdp->data - xdp->data_hard_start); + memcpy(__skb_put(skb, datasize), xdp->data, datasize); + if (metasize) + skb_metadata_set(skb, metasize); +diff --git a/drivers/net/ethernet/qlogic/qed/qed_sriov.c b/drivers/net/ethernet/qlogic/qed/qed_sriov.c +index 5e8f8eb916e64..20f840ea05030 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_sriov.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_sriov.c +@@ -3003,12 +3003,16 @@ static int qed_iov_pre_update_vport(struct qed_hwfn *hwfn, + u8 mask = QED_ACCEPT_UCAST_UNMATCHED | QED_ACCEPT_MCAST_UNMATCHED; + struct qed_filter_accept_flags *flags = ¶ms->accept_flags; + struct qed_public_vf_info *vf_info; ++ u16 tlv_mask; ++ ++ tlv_mask = BIT(QED_IOV_VP_UPDATE_ACCEPT_PARAM) | ++ BIT(QED_IOV_VP_UPDATE_ACCEPT_ANY_VLAN); + + /* Untrusted VFs can't even be trusted to know that fact. + * Simply indicate everything is configured fine, and trace + * configuration 'behind their back'. + */ +- if (!(*tlvs & BIT(QED_IOV_VP_UPDATE_ACCEPT_PARAM))) ++ if (!(*tlvs & tlv_mask)) + return 0; + + vf_info = qed_iov_get_public_vf_info(hwfn, vfid, true); +@@ -3025,6 +3029,13 @@ static int qed_iov_pre_update_vport(struct qed_hwfn *hwfn, + flags->tx_accept_filter &= ~mask; + } + ++ if (params->update_accept_any_vlan_flg) { ++ vf_info->accept_any_vlan = params->accept_any_vlan; ++ ++ if (vf_info->forced_vlan && !vf_info->is_trusted_configured) ++ params->accept_any_vlan = false; ++ } ++ + return 0; + } + +@@ -4717,6 +4728,7 @@ static int qed_get_vf_config(struct qed_dev *cdev, + tx_rate = vf_info->tx_rate; + ivi->max_tx_rate = tx_rate ? tx_rate : link.speed; + ivi->min_tx_rate = qed_iov_get_vf_min_rate(hwfn, vf_id); ++ ivi->trusted = vf_info->is_trusted_request; + + return 0; + } +@@ -5147,6 +5159,12 @@ static void qed_iov_handle_trust_change(struct qed_hwfn *hwfn) + + params.update_ctl_frame_check = 1; + params.mac_chk_en = !vf_info->is_trusted_configured; ++ params.update_accept_any_vlan_flg = 0; ++ ++ if (vf_info->accept_any_vlan && vf_info->forced_vlan) { ++ params.update_accept_any_vlan_flg = 1; ++ params.accept_any_vlan = vf_info->accept_any_vlan; ++ } + + if (vf_info->rx_accept_mode & mask) { + flags->update_rx_mode_config = 1; +@@ -5162,13 +5180,20 @@ static void qed_iov_handle_trust_change(struct qed_hwfn *hwfn) + if (!vf_info->is_trusted_configured) { + flags->rx_accept_filter &= ~mask; + flags->tx_accept_filter &= ~mask; ++ params.accept_any_vlan = false; + } + + if (flags->update_rx_mode_config || + flags->update_tx_mode_config || +- params.update_ctl_frame_check) ++ params.update_ctl_frame_check || ++ params.update_accept_any_vlan_flg) { ++ DP_VERBOSE(hwfn, QED_MSG_IOV, ++ "vport update config for %s VF[abs 0x%x rel 0x%x]\n", ++ vf_info->is_trusted_configured ? "trusted" : "untrusted", ++ vf->abs_vf_id, vf->relative_vf_id); + qed_sp_vport_update(hwfn, ¶ms, + QED_SPQ_MODE_EBLOCK, NULL); ++ } + } + } + +diff --git a/drivers/net/ethernet/qlogic/qed/qed_sriov.h b/drivers/net/ethernet/qlogic/qed/qed_sriov.h +index 9a8fd79611f24..853be06bccdf6 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_sriov.h ++++ b/drivers/net/ethernet/qlogic/qed/qed_sriov.h +@@ -88,6 +88,7 @@ struct qed_public_vf_info { + bool is_trusted_request; + u8 rx_accept_mode; + u8 tx_accept_mode; ++ bool accept_any_vlan; + }; + + struct qed_iov_vf_init_params { +diff --git a/drivers/net/ethernet/qlogic/qede/qede_fp.c b/drivers/net/ethernet/qlogic/qede/qede_fp.c +index b81579afa361d..f16032635ba73 100644 +--- a/drivers/net/ethernet/qlogic/qede/qede_fp.c ++++ b/drivers/net/ethernet/qlogic/qede/qede_fp.c +@@ -723,6 +723,9 @@ qede_build_skb(struct qede_rx_queue *rxq, + buf = page_address(bd->data) + bd->page_offset; + skb = build_skb(buf, rxq->rx_buf_seg_size); + ++ if (unlikely(!skb)) ++ return NULL; ++ + skb_reserve(skb, pad); + skb_put(skb, len); + +diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.h +index f4aa6331b367b..0a9d24e86715d 100644 +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.h ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.h +@@ -52,7 +52,7 @@ static inline int qlcnic_dcb_get_hw_capability(struct qlcnic_dcb *dcb) + if (dcb && dcb->ops->get_hw_capability) + return dcb->ops->get_hw_capability(dcb); + +- return 0; ++ return -EOPNOTSUPP; + } + + static inline void qlcnic_dcb_free(struct qlcnic_dcb *dcb) +@@ -66,7 +66,7 @@ static inline int qlcnic_dcb_attach(struct qlcnic_dcb *dcb) + if (dcb && dcb->ops->attach) + return dcb->ops->attach(dcb); + +- return 0; ++ return -EOPNOTSUPP; + } + + static inline int +@@ -75,7 +75,7 @@ qlcnic_dcb_query_hw_capability(struct qlcnic_dcb *dcb, char *buf) + if (dcb && dcb->ops->query_hw_capability) + return dcb->ops->query_hw_capability(dcb, buf); + +- return 0; ++ return -EOPNOTSUPP; + } + + static inline void qlcnic_dcb_get_info(struct qlcnic_dcb *dcb) +@@ -90,7 +90,7 @@ qlcnic_dcb_query_cee_param(struct qlcnic_dcb *dcb, char *buf, u8 type) + if (dcb && dcb->ops->query_cee_param) + return dcb->ops->query_cee_param(dcb, buf, type); + +- return 0; ++ return -EOPNOTSUPP; + } + + static inline int qlcnic_dcb_get_cee_cfg(struct qlcnic_dcb *dcb) +@@ -98,7 +98,7 @@ static inline int qlcnic_dcb_get_cee_cfg(struct qlcnic_dcb *dcb) + if (dcb && dcb->ops->get_cee_cfg) + return dcb->ops->get_cee_cfg(dcb); + +- return 0; ++ return -EOPNOTSUPP; + } + + static inline void qlcnic_dcb_aen_handler(struct qlcnic_dcb *dcb, void *msg) +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c +index a46fea472bc46..70cbf48c2c038 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c +@@ -428,8 +428,7 @@ stmmac_probe_config_dt(struct platform_device *pdev, const char **mac) + plat->phylink_node = np; + + /* Get max speed of operation from device tree */ +- if (of_property_read_u32(np, "max-speed", &plat->max_speed)) +- plat->max_speed = -1; ++ of_property_read_u32(np, "max-speed", &plat->max_speed); + + plat->bus_id = of_alias_get_id(np, "ethernet"); + if (plat->bus_id < 0) +diff --git a/drivers/net/ethernet/sun/sunhme.c b/drivers/net/ethernet/sun/sunhme.c +index d007dfeba5c35..3133f903279ce 100644 +--- a/drivers/net/ethernet/sun/sunhme.c ++++ b/drivers/net/ethernet/sun/sunhme.c +@@ -3164,7 +3164,7 @@ static int happy_meal_pci_probe(struct pci_dev *pdev, + if (err) { + printk(KERN_ERR "happymeal(PCI): Cannot register net device, " + "aborting.\n"); +- goto err_out_iounmap; ++ goto err_out_free_coherent; + } + + pci_set_drvdata(pdev, hp); +@@ -3197,6 +3197,10 @@ static int happy_meal_pci_probe(struct pci_dev *pdev, + + return 0; + ++err_out_free_coherent: ++ dma_free_coherent(hp->dma_dev, PAGE_SIZE, ++ hp->happy_block, hp->hblock_dvma); ++ + err_out_iounmap: + iounmap(hp->gregs); + +diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c +index bd0beb16d68a9..02d6f3ad9aca8 100644 +--- a/drivers/net/hamradio/6pack.c ++++ b/drivers/net/hamradio/6pack.c +@@ -674,14 +674,14 @@ static void sixpack_close(struct tty_struct *tty) + */ + netif_stop_queue(sp->dev); + ++ unregister_netdev(sp->dev); ++ + del_timer_sync(&sp->tx_t); + del_timer_sync(&sp->resync_t); + + /* Free all 6pack frame buffers. */ + kfree(sp->rbuff); + kfree(sp->xbuff); +- +- unregister_netdev(sp->dev); + } + + /* Perform I/O control on an active 6pack channel. */ +diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c +index 694e2f5dbbe59..39801c31e5071 100644 +--- a/drivers/net/macvtap.c ++++ b/drivers/net/macvtap.c +@@ -133,11 +133,17 @@ static void macvtap_setup(struct net_device *dev) + dev->tx_queue_len = TUN_READQ_SIZE; + } + ++static struct net *macvtap_link_net(const struct net_device *dev) ++{ ++ return dev_net(macvlan_dev_real_dev(dev)); ++} ++ + static struct rtnl_link_ops macvtap_link_ops __read_mostly = { + .kind = "macvtap", + .setup = macvtap_setup, + .newlink = macvtap_newlink, + .dellink = macvtap_dellink, ++ .get_link_net = macvtap_link_net, + .priv_size = sizeof(struct macvtap_dev), + }; + +diff --git a/drivers/net/phy/broadcom.c b/drivers/net/phy/broadcom.c +index c23fec34b50e9..7be75a611e9e8 100644 +--- a/drivers/net/phy/broadcom.c ++++ b/drivers/net/phy/broadcom.c +@@ -11,6 +11,7 @@ + */ + + #include "bcm-phy-lib.h" ++#include <linux/delay.h> + #include <linux/module.h> + #include <linux/phy.h> + #include <linux/brcmphy.h> +@@ -479,6 +480,26 @@ static int brcm_fet_config_init(struct phy_device *phydev) + if (err < 0) + return err; + ++ /* The datasheet indicates the PHY needs up to 1us to complete a reset, ++ * build some slack here. ++ */ ++ usleep_range(1000, 2000); ++ ++ /* The PHY requires 65 MDC clock cycles to complete a write operation ++ * and turnaround the line properly. ++ * ++ * We ignore -EIO here as the MDIO controller (e.g.: mdio-bcm-unimac) ++ * may flag the lack of turn-around as a read failure. This is ++ * particularly true with this combination since the MDIO controller ++ * only used 64 MDC cycles. This is not a critical failure in this ++ * specific case and it has no functional impact otherwise, so we let ++ * that one go through. If there is a genuine bus error, the next read ++ * of MII_BRCM_FET_INTREG will error out. ++ */ ++ err = phy_read(phydev, MII_BMCR); ++ if (err < 0 && err != -EIO) ++ return err; ++ + reg = phy_read(phydev, MII_BRCM_FET_INTREG); + if (reg < 0) + return reg; +diff --git a/drivers/net/tap.c b/drivers/net/tap.c +index f285422a80717..f870d08bb1f86 100644 +--- a/drivers/net/tap.c ++++ b/drivers/net/tap.c +@@ -1214,7 +1214,8 @@ static int tap_sendmsg(struct socket *sock, struct msghdr *m, + struct xdp_buff *xdp; + int i; + +- if (ctl && (ctl->type == TUN_MSG_PTR)) { ++ if (m->msg_controllen == sizeof(struct tun_msg_ctl) && ++ ctl && ctl->type == TUN_MSG_PTR) { + for (i = 0; i < ctl->num; i++) { + xdp = &((struct xdp_buff *)ctl->ptr)[i]; + tap_get_user_xdp(q, xdp); +diff --git a/drivers/net/tun.c b/drivers/net/tun.c +index 10211ea605140..d9993884a97d9 100644 +--- a/drivers/net/tun.c ++++ b/drivers/net/tun.c +@@ -2561,7 +2561,8 @@ static int tun_sendmsg(struct socket *sock, struct msghdr *m, size_t total_len) + if (!tun) + return -EBADFD; + +- if (ctl && (ctl->type == TUN_MSG_PTR)) { ++ if (m->msg_controllen == sizeof(struct tun_msg_ctl) && ++ ctl && ctl->type == TUN_MSG_PTR) { + struct tun_page tpage; + int n = ctl->num; + int flush = 0; +diff --git a/drivers/net/wireless/ath/ath10k/wow.c b/drivers/net/wireless/ath/ath10k/wow.c +index 8c26adddd034e..b4f54ca127561 100644 +--- a/drivers/net/wireless/ath/ath10k/wow.c ++++ b/drivers/net/wireless/ath/ath10k/wow.c +@@ -337,14 +337,15 @@ static int ath10k_vif_wow_set_wakeups(struct ath10k_vif *arvif, + if (patterns[i].mask[j / 8] & BIT(j % 8)) + bitmask[j] = 0xff; + old_pattern.mask = bitmask; +- new_pattern = old_pattern; + + if (ar->wmi.rx_decap_mode == ATH10K_HW_TXRX_NATIVE_WIFI) { +- if (patterns[i].pkt_offset < ETH_HLEN) ++ if (patterns[i].pkt_offset < ETH_HLEN) { + ath10k_wow_convert_8023_to_80211(&new_pattern, + &old_pattern); +- else ++ } else { ++ new_pattern = old_pattern; + new_pattern.pkt_offset += WOW_HDR_LEN - ETH_HLEN; ++ } + } + + if (WARN_ON(new_pattern.pattern_len > WOW_MAX_PATTERN_SIZE)) +diff --git a/drivers/net/wireless/ath/ath5k/eeprom.c b/drivers/net/wireless/ath/ath5k/eeprom.c +index 94d34ee02265d..01163b3339451 100644 +--- a/drivers/net/wireless/ath/ath5k/eeprom.c ++++ b/drivers/net/wireless/ath/ath5k/eeprom.c +@@ -746,6 +746,9 @@ ath5k_eeprom_convert_pcal_info_5111(struct ath5k_hw *ah, int mode, + } + } + ++ if (idx == AR5K_EEPROM_N_PD_CURVES) ++ goto err_out; ++ + ee->ee_pd_gains[mode] = 1; + + pd = &chinfo[pier].pd_curves[idx]; +diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c +index 510e61e97dbcb..994ec48b2f669 100644 +--- a/drivers/net/wireless/ath/ath9k/htc_hst.c ++++ b/drivers/net/wireless/ath/ath9k/htc_hst.c +@@ -30,6 +30,7 @@ static int htc_issue_send(struct htc_target *target, struct sk_buff* skb, + hdr->endpoint_id = epid; + hdr->flags = flags; + hdr->payload_len = cpu_to_be16(len); ++ memset(hdr->control, 0, sizeof(hdr->control)); + + status = target->hif->send(target->hif_dev, endpoint->ul_pipeid, skb); + +@@ -272,6 +273,10 @@ int htc_connect_service(struct htc_target *target, + conn_msg->dl_pipeid = endpoint->dl_pipeid; + conn_msg->ul_pipeid = endpoint->ul_pipeid; + ++ /* To prevent infoleak */ ++ conn_msg->svc_meta_len = 0; ++ conn_msg->pad = 0; ++ + ret = htc_issue_send(target, skb, skb->len, 0, ENDPOINT0); + if (ret) + goto err; +diff --git a/drivers/net/wireless/ath/carl9170/main.c b/drivers/net/wireless/ath/carl9170/main.c +index 21ca62b06214a..8d708e7588bcb 100644 +--- a/drivers/net/wireless/ath/carl9170/main.c ++++ b/drivers/net/wireless/ath/carl9170/main.c +@@ -1917,7 +1917,7 @@ static int carl9170_parse_eeprom(struct ar9170 *ar) + WARN_ON(!(tx_streams >= 1 && tx_streams <= + IEEE80211_HT_MCS_TX_MAX_STREAMS)); + +- tx_params = (tx_streams - 1) << ++ tx_params |= (tx_streams - 1) << + IEEE80211_HT_MCS_TX_MAX_STREAMS_SHIFT; + + carl9170_band_2GHz.ht_cap.mcs.tx_params |= tx_params; +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c +index 3aed4c4b887aa..544ad80629a99 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c +@@ -207,6 +207,8 @@ static int brcmf_init_nvram_parser(struct nvram_parser *nvp, + size = BRCMF_FW_MAX_NVRAM_SIZE; + else + size = data_len; ++ /* Add space for properties we may add */ ++ size += strlen(BRCMF_FW_DEFAULT_BOARDREV) + 1; + /* Alloc for extra 0 byte + roundup by 4 + length field */ + size += 1 + 3 + sizeof(u32); + nvp->nvram = kzalloc(size, GFP_KERNEL); +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c +index e6001f0a81a3a..b5d2e5b9f67cc 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c +@@ -12,6 +12,7 @@ + #include <linux/interrupt.h> + #include <linux/bcma/bcma.h> + #include <linux/sched.h> ++#include <linux/io.h> + #include <asm/unaligned.h> + + #include <soc.h> +@@ -444,47 +445,6 @@ brcmf_pcie_write_ram32(struct brcmf_pciedev_info *devinfo, u32 mem_offset, + } + + +-static void +-brcmf_pcie_copy_mem_todev(struct brcmf_pciedev_info *devinfo, u32 mem_offset, +- void *srcaddr, u32 len) +-{ +- void __iomem *address = devinfo->tcm + mem_offset; +- __le32 *src32; +- __le16 *src16; +- u8 *src8; +- +- if (((ulong)address & 4) || ((ulong)srcaddr & 4) || (len & 4)) { +- if (((ulong)address & 2) || ((ulong)srcaddr & 2) || (len & 2)) { +- src8 = (u8 *)srcaddr; +- while (len) { +- iowrite8(*src8, address); +- address++; +- src8++; +- len--; +- } +- } else { +- len = len / 2; +- src16 = (__le16 *)srcaddr; +- while (len) { +- iowrite16(le16_to_cpu(*src16), address); +- address += 2; +- src16++; +- len--; +- } +- } +- } else { +- len = len / 4; +- src32 = (__le32 *)srcaddr; +- while (len) { +- iowrite32(le32_to_cpu(*src32), address); +- address += 4; +- src32++; +- len--; +- } +- } +-} +- +- + static void + brcmf_pcie_copy_dev_tomem(struct brcmf_pciedev_info *devinfo, u32 mem_offset, + void *dstaddr, u32 len) +@@ -1346,6 +1306,18 @@ static void brcmf_pcie_down(struct device *dev) + { + } + ++static int brcmf_pcie_preinit(struct device *dev) ++{ ++ struct brcmf_bus *bus_if = dev_get_drvdata(dev); ++ struct brcmf_pciedev *buspub = bus_if->bus_priv.pcie; ++ ++ brcmf_dbg(PCIE, "Enter\n"); ++ ++ brcmf_pcie_intr_enable(buspub->devinfo); ++ brcmf_pcie_hostready(buspub->devinfo); ++ ++ return 0; ++} + + static int brcmf_pcie_tx(struct device *dev, struct sk_buff *skb) + { +@@ -1454,6 +1426,7 @@ static int brcmf_pcie_reset(struct device *dev) + } + + static const struct brcmf_bus_ops brcmf_pcie_bus_ops = { ++ .preinit = brcmf_pcie_preinit, + .txdata = brcmf_pcie_tx, + .stop = brcmf_pcie_down, + .txctl = brcmf_pcie_tx_ctlpkt, +@@ -1561,8 +1534,8 @@ static int brcmf_pcie_download_fw_nvram(struct brcmf_pciedev_info *devinfo, + return err; + + brcmf_dbg(PCIE, "Download FW %s\n", devinfo->fw_name); +- brcmf_pcie_copy_mem_todev(devinfo, devinfo->ci->rambase, +- (void *)fw->data, fw->size); ++ memcpy_toio(devinfo->tcm + devinfo->ci->rambase, ++ (void *)fw->data, fw->size); + + resetintr = get_unaligned_le32(fw->data); + release_firmware(fw); +@@ -1576,7 +1549,7 @@ static int brcmf_pcie_download_fw_nvram(struct brcmf_pciedev_info *devinfo, + brcmf_dbg(PCIE, "Download NVRAM %s\n", devinfo->nvram_name); + address = devinfo->ci->rambase + devinfo->ci->ramsize - + nvram_len; +- brcmf_pcie_copy_mem_todev(devinfo, address, nvram, nvram_len); ++ memcpy_toio(devinfo->tcm + address, nvram, nvram_len); + brcmf_fw_nvram_free(nvram); + } else { + brcmf_dbg(PCIE, "No matching NVRAM file found %s\n", +@@ -1775,6 +1748,8 @@ static void brcmf_pcie_setup(struct device *dev, int ret, + ret = brcmf_chip_get_raminfo(devinfo->ci); + if (ret) { + brcmf_err(bus, "Failed to get RAM info\n"); ++ release_firmware(fw); ++ brcmf_fw_nvram_free(nvram); + goto fail; + } + +@@ -1824,9 +1799,6 @@ static void brcmf_pcie_setup(struct device *dev, int ret, + + init_waitqueue_head(&devinfo->mbdata_resp_wait); + +- brcmf_pcie_intr_enable(devinfo); +- brcmf_pcie_hostready(devinfo); +- + ret = brcmf_attach(&devinfo->pdev->dev); + if (ret) + goto fail; +diff --git a/drivers/net/wireless/intel/iwlwifi/dvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/dvm/mac80211.c +index 6512d25e35630..f3bb1f91b5878 100644 +--- a/drivers/net/wireless/intel/iwlwifi/dvm/mac80211.c ++++ b/drivers/net/wireless/intel/iwlwifi/dvm/mac80211.c +@@ -303,7 +303,7 @@ static int iwlagn_mac_start(struct ieee80211_hw *hw) + + priv->is_open = 1; + IWL_DEBUG_MAC80211(priv, "leave\n"); +- return 0; ++ return ret; + } + + static void iwlagn_mac_stop(struct ieee80211_hw *hw) +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c +index 7272d8522a9e9..c5b08a68f6fa1 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c +@@ -1417,8 +1417,10 @@ int iwl_mvm_up(struct iwl_mvm *mvm) + while (!sband && i < NUM_NL80211_BANDS) + sband = mvm->hw->wiphy->bands[i++]; + +- if (WARN_ON_ONCE(!sband)) ++ if (WARN_ON_ONCE(!sband)) { ++ ret = -ENODEV; + goto error; ++ } + + chan = &sband->channels[0]; + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/main.c b/drivers/net/wireless/mediatek/mt76/mt7603/main.c +index 0a5695c3d9241..625492284389c 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7603/main.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7603/main.c +@@ -605,6 +605,9 @@ mt7603_sta_rate_tbl_update(struct ieee80211_hw *hw, struct ieee80211_vif *vif, + struct ieee80211_sta_rates *sta_rates = rcu_dereference(sta->rates); + int i; + ++ if (!sta_rates) ++ return; ++ + spin_lock_bh(&dev->mt76.lock); + for (i = 0; i < ARRAY_SIZE(msta->rates); i++) { + msta->rates[i].idx = sta_rates->rate[i].idx; +diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/main.c b/drivers/net/wireless/mediatek/mt76/mt7615/main.c +index 38183aef0eb92..5ad8b0afa41f0 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7615/main.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7615/main.c +@@ -385,6 +385,9 @@ static void mt7615_sta_rate_tbl_update(struct ieee80211_hw *hw, + struct ieee80211_sta_rates *sta_rates = rcu_dereference(sta->rates); + int i; + ++ if (!sta_rates) ++ return; ++ + spin_lock_bh(&dev->mt76.lock); + for (i = 0; i < ARRAY_SIZE(msta->rates); i++) { + msta->rates[i].idx = sta_rates->rate[i].idx; +diff --git a/drivers/net/wireless/ray_cs.c b/drivers/net/wireless/ray_cs.c +index cf372684b6812..3836d6ac53049 100644 +--- a/drivers/net/wireless/ray_cs.c ++++ b/drivers/net/wireless/ray_cs.c +@@ -382,6 +382,8 @@ static int ray_config(struct pcmcia_device *link) + goto failed; + local->sram = ioremap(link->resource[2]->start, + resource_size(link->resource[2])); ++ if (!local->sram) ++ goto failed; + + /*** Set up 16k window for shared memory (receive buffer) ***************/ + link->resource[3]->flags |= +@@ -396,6 +398,8 @@ static int ray_config(struct pcmcia_device *link) + goto failed; + local->rmem = ioremap(link->resource[3]->start, + resource_size(link->resource[3])); ++ if (!local->rmem) ++ goto failed; + + /*** Set up window for attribute memory ***********************************/ + link->resource[4]->flags |= +@@ -410,6 +414,8 @@ static int ray_config(struct pcmcia_device *link) + goto failed; + local->amem = ioremap(link->resource[4]->start, + resource_size(link->resource[4])); ++ if (!local->amem) ++ goto failed; + + dev_dbg(&link->dev, "ray_config sram=%p\n", local->sram); + dev_dbg(&link->dev, "ray_config rmem=%p\n", local->rmem); +diff --git a/drivers/parisc/dino.c b/drivers/parisc/dino.c +index 544287e9f449b..f4de8be05c614 100644 +--- a/drivers/parisc/dino.c ++++ b/drivers/parisc/dino.c +@@ -142,9 +142,8 @@ struct dino_device + { + struct pci_hba_data hba; /* 'C' inheritance - must be first */ + spinlock_t dinosaur_pen; +- unsigned long txn_addr; /* EIR addr to generate interrupt */ +- u32 txn_data; /* EIR data assign to each dino */ + u32 imr; /* IRQ's which are enabled */ ++ struct gsc_irq gsc_irq; + int global_irq[DINO_LOCAL_IRQS]; /* map IMR bit to global irq */ + #ifdef DINO_DEBUG + unsigned int dino_irr0; /* save most recent IRQ line stat */ +@@ -339,14 +338,43 @@ static void dino_unmask_irq(struct irq_data *d) + if (tmp & DINO_MASK_IRQ(local_irq)) { + DBG(KERN_WARNING "%s(): IRQ asserted! (ILR 0x%x)\n", + __func__, tmp); +- gsc_writel(dino_dev->txn_data, dino_dev->txn_addr); ++ gsc_writel(dino_dev->gsc_irq.txn_data, dino_dev->gsc_irq.txn_addr); + } + } + ++#ifdef CONFIG_SMP ++static int dino_set_affinity_irq(struct irq_data *d, const struct cpumask *dest, ++ bool force) ++{ ++ struct dino_device *dino_dev = irq_data_get_irq_chip_data(d); ++ struct cpumask tmask; ++ int cpu_irq; ++ u32 eim; ++ ++ if (!cpumask_and(&tmask, dest, cpu_online_mask)) ++ return -EINVAL; ++ ++ cpu_irq = cpu_check_affinity(d, &tmask); ++ if (cpu_irq < 0) ++ return cpu_irq; ++ ++ dino_dev->gsc_irq.txn_addr = txn_affinity_addr(d->irq, cpu_irq); ++ eim = ((u32) dino_dev->gsc_irq.txn_addr) | dino_dev->gsc_irq.txn_data; ++ __raw_writel(eim, dino_dev->hba.base_addr+DINO_IAR0); ++ ++ irq_data_update_effective_affinity(d, &tmask); ++ ++ return IRQ_SET_MASK_OK; ++} ++#endif ++ + static struct irq_chip dino_interrupt_type = { + .name = "GSC-PCI", + .irq_unmask = dino_unmask_irq, + .irq_mask = dino_mask_irq, ++#ifdef CONFIG_SMP ++ .irq_set_affinity = dino_set_affinity_irq, ++#endif + }; + + +@@ -806,7 +834,6 @@ static int __init dino_common_init(struct parisc_device *dev, + { + int status; + u32 eim; +- struct gsc_irq gsc_irq; + struct resource *res; + + pcibios_register_hba(&dino_dev->hba); +@@ -821,10 +848,8 @@ static int __init dino_common_init(struct parisc_device *dev, + ** still only has 11 IRQ input lines - just map some of them + ** to a different processor. + */ +- dev->irq = gsc_alloc_irq(&gsc_irq); +- dino_dev->txn_addr = gsc_irq.txn_addr; +- dino_dev->txn_data = gsc_irq.txn_data; +- eim = ((u32) gsc_irq.txn_addr) | gsc_irq.txn_data; ++ dev->irq = gsc_alloc_irq(&dino_dev->gsc_irq); ++ eim = ((u32) dino_dev->gsc_irq.txn_addr) | dino_dev->gsc_irq.txn_data; + + /* + ** Dino needs a PA "IRQ" to get a processor's attention. +diff --git a/drivers/parisc/gsc.c b/drivers/parisc/gsc.c +index ed9371acf37eb..ec175ae998733 100644 +--- a/drivers/parisc/gsc.c ++++ b/drivers/parisc/gsc.c +@@ -135,10 +135,41 @@ static void gsc_asic_unmask_irq(struct irq_data *d) + */ + } + ++#ifdef CONFIG_SMP ++static int gsc_set_affinity_irq(struct irq_data *d, const struct cpumask *dest, ++ bool force) ++{ ++ struct gsc_asic *gsc_dev = irq_data_get_irq_chip_data(d); ++ struct cpumask tmask; ++ int cpu_irq; ++ ++ if (!cpumask_and(&tmask, dest, cpu_online_mask)) ++ return -EINVAL; ++ ++ cpu_irq = cpu_check_affinity(d, &tmask); ++ if (cpu_irq < 0) ++ return cpu_irq; ++ ++ gsc_dev->gsc_irq.txn_addr = txn_affinity_addr(d->irq, cpu_irq); ++ gsc_dev->eim = ((u32) gsc_dev->gsc_irq.txn_addr) | gsc_dev->gsc_irq.txn_data; ++ ++ /* switch IRQ's for devices below LASI/WAX to other CPU */ ++ gsc_writel(gsc_dev->eim, gsc_dev->hpa + OFFSET_IAR); ++ ++ irq_data_update_effective_affinity(d, &tmask); ++ ++ return IRQ_SET_MASK_OK; ++} ++#endif ++ ++ + static struct irq_chip gsc_asic_interrupt_type = { + .name = "GSC-ASIC", + .irq_unmask = gsc_asic_unmask_irq, + .irq_mask = gsc_asic_mask_irq, ++#ifdef CONFIG_SMP ++ .irq_set_affinity = gsc_set_affinity_irq, ++#endif + }; + + int gsc_assign_irq(struct irq_chip *type, void *data) +diff --git a/drivers/parisc/gsc.h b/drivers/parisc/gsc.h +index 86abad3fa2150..73cbd0bb1975a 100644 +--- a/drivers/parisc/gsc.h ++++ b/drivers/parisc/gsc.h +@@ -31,6 +31,7 @@ struct gsc_asic { + int version; + int type; + int eim; ++ struct gsc_irq gsc_irq; + int global_irq[32]; + }; + +diff --git a/drivers/parisc/lasi.c b/drivers/parisc/lasi.c +index 4e4fd12c2112e..6ef621adb63a8 100644 +--- a/drivers/parisc/lasi.c ++++ b/drivers/parisc/lasi.c +@@ -163,7 +163,6 @@ static int __init lasi_init_chip(struct parisc_device *dev) + { + extern void (*chassis_power_off)(void); + struct gsc_asic *lasi; +- struct gsc_irq gsc_irq; + int ret; + + lasi = kzalloc(sizeof(*lasi), GFP_KERNEL); +@@ -185,7 +184,7 @@ static int __init lasi_init_chip(struct parisc_device *dev) + lasi_init_irq(lasi); + + /* the IRQ lasi should use */ +- dev->irq = gsc_alloc_irq(&gsc_irq); ++ dev->irq = gsc_alloc_irq(&lasi->gsc_irq); + if (dev->irq < 0) { + printk(KERN_ERR "%s(): cannot get GSC irq\n", + __func__); +@@ -193,9 +192,9 @@ static int __init lasi_init_chip(struct parisc_device *dev) + return -EBUSY; + } + +- lasi->eim = ((u32) gsc_irq.txn_addr) | gsc_irq.txn_data; ++ lasi->eim = ((u32) lasi->gsc_irq.txn_addr) | lasi->gsc_irq.txn_data; + +- ret = request_irq(gsc_irq.irq, gsc_asic_intr, 0, "lasi", lasi); ++ ret = request_irq(lasi->gsc_irq.irq, gsc_asic_intr, 0, "lasi", lasi); + if (ret < 0) { + kfree(lasi); + return ret; +diff --git a/drivers/parisc/wax.c b/drivers/parisc/wax.c +index 5b6df15162354..73a2b01f8d9ca 100644 +--- a/drivers/parisc/wax.c ++++ b/drivers/parisc/wax.c +@@ -68,7 +68,6 @@ static int __init wax_init_chip(struct parisc_device *dev) + { + struct gsc_asic *wax; + struct parisc_device *parent; +- struct gsc_irq gsc_irq; + int ret; + + wax = kzalloc(sizeof(*wax), GFP_KERNEL); +@@ -85,7 +84,7 @@ static int __init wax_init_chip(struct parisc_device *dev) + wax_init_irq(wax); + + /* the IRQ wax should use */ +- dev->irq = gsc_claim_irq(&gsc_irq, WAX_GSC_IRQ); ++ dev->irq = gsc_claim_irq(&wax->gsc_irq, WAX_GSC_IRQ); + if (dev->irq < 0) { + printk(KERN_ERR "%s(): cannot get GSC irq\n", + __func__); +@@ -93,9 +92,9 @@ static int __init wax_init_chip(struct parisc_device *dev) + return -EBUSY; + } + +- wax->eim = ((u32) gsc_irq.txn_addr) | gsc_irq.txn_data; ++ wax->eim = ((u32) wax->gsc_irq.txn_addr) | wax->gsc_irq.txn_data; + +- ret = request_irq(gsc_irq.irq, gsc_asic_intr, 0, "wax", wax); ++ ret = request_irq(wax->gsc_irq.irq, gsc_asic_intr, 0, "wax", wax); + if (ret < 0) { + kfree(wax); + return ret; +diff --git a/drivers/pci/access.c b/drivers/pci/access.c +index 0914ddeae17f4..c909c66a63e2d 100644 +--- a/drivers/pci/access.c ++++ b/drivers/pci/access.c +@@ -160,9 +160,12 @@ int pci_generic_config_write32(struct pci_bus *bus, unsigned int devfn, + * write happen to have any RW1C (write-one-to-clear) bits set, we + * just inadvertently cleared something we shouldn't have. + */ +- dev_warn_ratelimited(&bus->dev, "%d-byte config write to %04x:%02x:%02x.%d offset %#x may corrupt adjacent RW1C bits\n", +- size, pci_domain_nr(bus), bus->number, +- PCI_SLOT(devfn), PCI_FUNC(devfn), where); ++ if (!bus->unsafe_warn) { ++ dev_warn(&bus->dev, "%d-byte config write to %04x:%02x:%02x.%d offset %#x may corrupt adjacent RW1C bits\n", ++ size, pci_domain_nr(bus), bus->number, ++ PCI_SLOT(devfn), PCI_FUNC(devfn), where); ++ bus->unsafe_warn = 1; ++ } + + mask = ~(((1 << (size * 8)) - 1) << ((where & 0x3) * 8)); + tmp = readl(addr) & mask; +diff --git a/drivers/pci/controller/pci-aardvark.c b/drivers/pci/controller/pci-aardvark.c +index d2f8cd3a9568b..721d2652319ce 100644 +--- a/drivers/pci/controller/pci-aardvark.c ++++ b/drivers/pci/controller/pci-aardvark.c +@@ -835,7 +835,9 @@ advk_pci_bridge_emul_pcie_conf_read(struct pci_bridge_emul *bridge, + case PCI_EXP_RTSTA: { + u32 isr0 = advk_readl(pcie, PCIE_ISR0_REG); + u32 msglog = advk_readl(pcie, PCIE_MSG_LOG_REG); +- *value = (isr0 & PCIE_MSG_PM_PME_MASK) << 16 | (msglog >> 16); ++ *value = msglog >> 16; ++ if (isr0 & PCIE_MSG_PM_PME_MASK) ++ *value |= PCI_EXP_RTSTA_PME; + return PCI_BRIDGE_EMUL_HANDLED; + } + +@@ -1168,7 +1170,7 @@ static void advk_msi_irq_compose_msi_msg(struct irq_data *data, + + msg->address_lo = lower_32_bits(msi_msg); + msg->address_hi = upper_32_bits(msi_msg); +- msg->data = data->irq; ++ msg->data = data->hwirq; + } + + static int advk_msi_set_affinity(struct irq_data *irq_data, +@@ -1185,15 +1187,11 @@ static int advk_msi_irq_domain_alloc(struct irq_domain *domain, + int hwirq, i; + + mutex_lock(&pcie->msi_used_lock); +- hwirq = bitmap_find_next_zero_area(pcie->msi_used, MSI_IRQ_NUM, +- 0, nr_irqs, 0); +- if (hwirq >= MSI_IRQ_NUM) { +- mutex_unlock(&pcie->msi_used_lock); +- return -ENOSPC; +- } +- +- bitmap_set(pcie->msi_used, hwirq, nr_irqs); ++ hwirq = bitmap_find_free_region(pcie->msi_used, MSI_IRQ_NUM, ++ order_base_2(nr_irqs)); + mutex_unlock(&pcie->msi_used_lock); ++ if (hwirq < 0) ++ return -ENOSPC; + + for (i = 0; i < nr_irqs; i++) + irq_domain_set_info(domain, virq + i, hwirq + i, +@@ -1211,7 +1209,7 @@ static void advk_msi_irq_domain_free(struct irq_domain *domain, + struct advk_pcie *pcie = domain->host_data; + + mutex_lock(&pcie->msi_used_lock); +- bitmap_clear(pcie->msi_used, d->hwirq, nr_irqs); ++ bitmap_release_region(pcie->msi_used, d->hwirq, order_base_2(nr_irqs)); + mutex_unlock(&pcie->msi_used_lock); + } + +diff --git a/drivers/pci/hotplug/pciehp_hpc.c b/drivers/pci/hotplug/pciehp_hpc.c +index 907b8be86ce04..13f3bc239c660 100644 +--- a/drivers/pci/hotplug/pciehp_hpc.c ++++ b/drivers/pci/hotplug/pciehp_hpc.c +@@ -79,6 +79,8 @@ static int pcie_poll_cmd(struct controller *ctrl, int timeout) + if (slot_status & PCI_EXP_SLTSTA_CC) { + pcie_capability_write_word(pdev, PCI_EXP_SLTSTA, + PCI_EXP_SLTSTA_CC); ++ ctrl->cmd_busy = 0; ++ smp_mb(); + return 1; + } + if (timeout < 0) +@@ -957,6 +959,8 @@ static void quirk_cmd_compl(struct pci_dev *pdev) + } + DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, PCI_ANY_ID, + PCI_CLASS_BRIDGE_PCI, 8, quirk_cmd_compl); ++DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_QCOM, 0x0110, ++ PCI_CLASS_BRIDGE_PCI, 8, quirk_cmd_compl); + DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_QCOM, 0x0400, + PCI_CLASS_BRIDGE_PCI, 8, quirk_cmd_compl); + DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_QCOM, 0x0401, +diff --git a/drivers/perf/qcom_l2_pmu.c b/drivers/perf/qcom_l2_pmu.c +index 4da37f650f983..7018eb21d1892 100644 +--- a/drivers/perf/qcom_l2_pmu.c ++++ b/drivers/perf/qcom_l2_pmu.c +@@ -781,7 +781,7 @@ static struct cluster_pmu *l2_cache_associate_cpu_with_cluster( + { + u64 mpidr; + int cpu_cluster_id; +- struct cluster_pmu *cluster = NULL; ++ struct cluster_pmu *cluster; + + /* + * This assumes that the cluster_id is in MPIDR[aff1] for +@@ -803,10 +803,10 @@ static struct cluster_pmu *l2_cache_associate_cpu_with_cluster( + cluster->cluster_id); + cpumask_set_cpu(cpu, &cluster->cluster_cpus); + *per_cpu_ptr(l2cache_pmu->pmu_cluster, cpu) = cluster; +- break; ++ return cluster; + } + +- return cluster; ++ return NULL; + } + + static int l2cache_pmu_online_cpu(unsigned int cpu, struct hlist_node *node) +diff --git a/drivers/phy/phy-core-mipi-dphy.c b/drivers/phy/phy-core-mipi-dphy.c +index 14e0551cd3190..0aa740b73d0db 100644 +--- a/drivers/phy/phy-core-mipi-dphy.c ++++ b/drivers/phy/phy-core-mipi-dphy.c +@@ -66,10 +66,10 @@ int phy_mipi_dphy_get_default_config(unsigned long pixel_clock, + cfg->hs_trail = max(4 * 8 * ui, 60000 + 4 * 4 * ui); + + cfg->init = 100; +- cfg->lpx = 60000; ++ cfg->lpx = 50000; + cfg->ta_get = 5 * cfg->lpx; + cfg->ta_go = 4 * cfg->lpx; +- cfg->ta_sure = 2 * cfg->lpx; ++ cfg->ta_sure = cfg->lpx; + cfg->wakeup = 1000; + + cfg->hs_clk_rate = hs_clk_rate; +diff --git a/drivers/pinctrl/mediatek/pinctrl-mtk-common.c b/drivers/pinctrl/mediatek/pinctrl-mtk-common.c +index 53f52b9a0acdc..c2df70712ca22 100644 +--- a/drivers/pinctrl/mediatek/pinctrl-mtk-common.c ++++ b/drivers/pinctrl/mediatek/pinctrl-mtk-common.c +@@ -1038,6 +1038,7 @@ int mtk_pctrl_init(struct platform_device *pdev, + node = of_parse_phandle(np, "mediatek,pctl-regmap", 0); + if (node) { + pctl->regmap1 = syscon_node_to_regmap(node); ++ of_node_put(node); + if (IS_ERR(pctl->regmap1)) + return PTR_ERR(pctl->regmap1); + } else if (regmap) { +@@ -1051,6 +1052,7 @@ int mtk_pctrl_init(struct platform_device *pdev, + node = of_parse_phandle(np, "mediatek,pctl-regmap", 1); + if (node) { + pctl->regmap2 = syscon_node_to_regmap(node); ++ of_node_put(node); + if (IS_ERR(pctl->regmap2)) + return PTR_ERR(pctl->regmap2); + } +diff --git a/drivers/pinctrl/mediatek/pinctrl-paris.c b/drivers/pinctrl/mediatek/pinctrl-paris.c +index 923264d0e9ef2..31449514a8c0c 100644 +--- a/drivers/pinctrl/mediatek/pinctrl-paris.c ++++ b/drivers/pinctrl/mediatek/pinctrl-paris.c +@@ -198,8 +198,7 @@ static int mtk_pinconf_get(struct pinctrl_dev *pctldev, + } + + static int mtk_pinconf_set(struct pinctrl_dev *pctldev, unsigned int pin, +- enum pin_config_param param, +- enum pin_config_param arg) ++ enum pin_config_param param, u32 arg) + { + struct mtk_pinctrl *hw = pinctrl_dev_get_drvdata(pctldev); + const struct mtk_pin_desc *desc; +@@ -647,10 +646,10 @@ static int mtk_pconf_group_get(struct pinctrl_dev *pctldev, unsigned group, + unsigned long *config) + { + struct mtk_pinctrl *hw = pinctrl_dev_get_drvdata(pctldev); ++ struct mtk_pinctrl_group *grp = &hw->groups[group]; + +- *config = hw->groups[group].config; +- +- return 0; ++ /* One pin per group only */ ++ return mtk_pinconf_get(pctldev, grp->pin, config); + } + + static int mtk_pconf_group_set(struct pinctrl_dev *pctldev, unsigned group, +@@ -666,8 +665,6 @@ static int mtk_pconf_group_set(struct pinctrl_dev *pctldev, unsigned group, + pinconf_to_config_argument(configs[i])); + if (ret < 0) + return ret; +- +- grp->config = configs[i]; + } + + return 0; +diff --git a/drivers/pinctrl/nomadik/pinctrl-nomadik.c b/drivers/pinctrl/nomadik/pinctrl-nomadik.c +index 2a8190b11d104..9f00adfefba8e 100644 +--- a/drivers/pinctrl/nomadik/pinctrl-nomadik.c ++++ b/drivers/pinctrl/nomadik/pinctrl-nomadik.c +@@ -1923,8 +1923,10 @@ static int nmk_pinctrl_probe(struct platform_device *pdev) + } + + prcm_np = of_parse_phandle(np, "prcm", 0); +- if (prcm_np) ++ if (prcm_np) { + npct->prcm_base = of_iomap(prcm_np, 0); ++ of_node_put(prcm_np); ++ } + if (!npct->prcm_base) { + if (version == PINCTRL_NMK_STN8815) { + dev_info(&pdev->dev, +diff --git a/drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c b/drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c +index 17f909d8b63a9..2dccd24c65557 100644 +--- a/drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c ++++ b/drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c +@@ -78,7 +78,6 @@ struct npcm7xx_gpio { + struct gpio_chip gc; + int irqbase; + int irq; +- void *priv; + struct irq_chip irq_chip; + u32 pinctrl_id; + int (*direction_input)(struct gpio_chip *chip, unsigned offset); +@@ -226,7 +225,7 @@ static void npcmgpio_irq_handler(struct irq_desc *desc) + chained_irq_enter(chip, desc); + sts = ioread32(bank->base + NPCM7XX_GP_N_EVST); + en = ioread32(bank->base + NPCM7XX_GP_N_EVEN); +- dev_dbg(chip->parent_device, "==> got irq sts %.8x %.8x\n", sts, ++ dev_dbg(bank->gc.parent, "==> got irq sts %.8x %.8x\n", sts, + en); + + sts &= en; +@@ -241,33 +240,33 @@ static int npcmgpio_set_irq_type(struct irq_data *d, unsigned int type) + gpiochip_get_data(irq_data_get_irq_chip_data(d)); + unsigned int gpio = BIT(d->hwirq); + +- dev_dbg(d->chip->parent_device, "setirqtype: %u.%u = %u\n", gpio, ++ dev_dbg(bank->gc.parent, "setirqtype: %u.%u = %u\n", gpio, + d->irq, type); + switch (type) { + case IRQ_TYPE_EDGE_RISING: +- dev_dbg(d->chip->parent_device, "edge.rising\n"); ++ dev_dbg(bank->gc.parent, "edge.rising\n"); + npcm_gpio_clr(&bank->gc, bank->base + NPCM7XX_GP_N_EVBE, gpio); + npcm_gpio_clr(&bank->gc, bank->base + NPCM7XX_GP_N_POL, gpio); + break; + case IRQ_TYPE_EDGE_FALLING: +- dev_dbg(d->chip->parent_device, "edge.falling\n"); ++ dev_dbg(bank->gc.parent, "edge.falling\n"); + npcm_gpio_clr(&bank->gc, bank->base + NPCM7XX_GP_N_EVBE, gpio); + npcm_gpio_set(&bank->gc, bank->base + NPCM7XX_GP_N_POL, gpio); + break; + case IRQ_TYPE_EDGE_BOTH: +- dev_dbg(d->chip->parent_device, "edge.both\n"); ++ dev_dbg(bank->gc.parent, "edge.both\n"); + npcm_gpio_set(&bank->gc, bank->base + NPCM7XX_GP_N_EVBE, gpio); + break; + case IRQ_TYPE_LEVEL_LOW: +- dev_dbg(d->chip->parent_device, "level.low\n"); ++ dev_dbg(bank->gc.parent, "level.low\n"); + npcm_gpio_set(&bank->gc, bank->base + NPCM7XX_GP_N_POL, gpio); + break; + case IRQ_TYPE_LEVEL_HIGH: +- dev_dbg(d->chip->parent_device, "level.high\n"); ++ dev_dbg(bank->gc.parent, "level.high\n"); + npcm_gpio_clr(&bank->gc, bank->base + NPCM7XX_GP_N_POL, gpio); + break; + default: +- dev_dbg(d->chip->parent_device, "invalid irq type\n"); ++ dev_dbg(bank->gc.parent, "invalid irq type\n"); + return -EINVAL; + } + +@@ -289,7 +288,7 @@ static void npcmgpio_irq_ack(struct irq_data *d) + gpiochip_get_data(irq_data_get_irq_chip_data(d)); + unsigned int gpio = d->hwirq; + +- dev_dbg(d->chip->parent_device, "irq_ack: %u.%u\n", gpio, d->irq); ++ dev_dbg(bank->gc.parent, "irq_ack: %u.%u\n", gpio, d->irq); + iowrite32(BIT(gpio), bank->base + NPCM7XX_GP_N_EVST); + } + +@@ -301,7 +300,7 @@ static void npcmgpio_irq_mask(struct irq_data *d) + unsigned int gpio = d->hwirq; + + /* Clear events */ +- dev_dbg(d->chip->parent_device, "irq_mask: %u.%u\n", gpio, d->irq); ++ dev_dbg(bank->gc.parent, "irq_mask: %u.%u\n", gpio, d->irq); + iowrite32(BIT(gpio), bank->base + NPCM7XX_GP_N_EVENC); + } + +@@ -313,7 +312,7 @@ static void npcmgpio_irq_unmask(struct irq_data *d) + unsigned int gpio = d->hwirq; + + /* Enable events */ +- dev_dbg(d->chip->parent_device, "irq_unmask: %u.%u\n", gpio, d->irq); ++ dev_dbg(bank->gc.parent, "irq_unmask: %u.%u\n", gpio, d->irq); + iowrite32(BIT(gpio), bank->base + NPCM7XX_GP_N_EVENS); + } + +@@ -323,7 +322,7 @@ static unsigned int npcmgpio_irq_startup(struct irq_data *d) + unsigned int gpio = d->hwirq; + + /* active-high, input, clear interrupt, enable interrupt */ +- dev_dbg(d->chip->parent_device, "startup: %u.%u\n", gpio, d->irq); ++ dev_dbg(gc->parent, "startup: %u.%u\n", gpio, d->irq); + npcmgpio_direction_input(gc, gpio); + npcmgpio_irq_ack(d); + npcmgpio_irq_unmask(d); +@@ -905,7 +904,7 @@ static struct npcm7xx_func npcm7xx_funcs[] = { + #define DRIVE_STRENGTH_HI_SHIFT 12 + #define DRIVE_STRENGTH_MASK 0x0000FF00 + +-#define DS(lo, hi) (((lo) << DRIVE_STRENGTH_LO_SHIFT) | \ ++#define DSTR(lo, hi) (((lo) << DRIVE_STRENGTH_LO_SHIFT) | \ + ((hi) << DRIVE_STRENGTH_HI_SHIFT)) + #define DSLO(x) (((x) >> DRIVE_STRENGTH_LO_SHIFT) & 0xF) + #define DSHI(x) (((x) >> DRIVE_STRENGTH_HI_SHIFT) & 0xF) +@@ -925,31 +924,31 @@ struct npcm7xx_pincfg { + static const struct npcm7xx_pincfg pincfg[] = { + /* PIN FUNCTION 1 FUNCTION 2 FUNCTION 3 FLAGS */ + NPCM7XX_PINCFG(0, iox1, MFSEL1, 30, none, NONE, 0, none, NONE, 0, 0), +- NPCM7XX_PINCFG(1, iox1, MFSEL1, 30, none, NONE, 0, none, NONE, 0, DS(8, 12)), +- NPCM7XX_PINCFG(2, iox1, MFSEL1, 30, none, NONE, 0, none, NONE, 0, DS(8, 12)), ++ NPCM7XX_PINCFG(1, iox1, MFSEL1, 30, none, NONE, 0, none, NONE, 0, DSTR(8, 12)), ++ NPCM7XX_PINCFG(2, iox1, MFSEL1, 30, none, NONE, 0, none, NONE, 0, DSTR(8, 12)), + NPCM7XX_PINCFG(3, iox1, MFSEL1, 30, none, NONE, 0, none, NONE, 0, 0), + NPCM7XX_PINCFG(4, iox2, MFSEL3, 14, smb1d, I2CSEGSEL, 7, none, NONE, 0, SLEW), + NPCM7XX_PINCFG(5, iox2, MFSEL3, 14, smb1d, I2CSEGSEL, 7, none, NONE, 0, SLEW), + NPCM7XX_PINCFG(6, iox2, MFSEL3, 14, smb2d, I2CSEGSEL, 10, none, NONE, 0, SLEW), + NPCM7XX_PINCFG(7, iox2, MFSEL3, 14, smb2d, I2CSEGSEL, 10, none, NONE, 0, SLEW), +- NPCM7XX_PINCFG(8, lkgpo1, FLOCKR1, 4, none, NONE, 0, none, NONE, 0, DS(8, 12)), +- NPCM7XX_PINCFG(9, lkgpo2, FLOCKR1, 8, none, NONE, 0, none, NONE, 0, DS(8, 12)), +- NPCM7XX_PINCFG(10, ioxh, MFSEL3, 18, none, NONE, 0, none, NONE, 0, DS(8, 12)), +- NPCM7XX_PINCFG(11, ioxh, MFSEL3, 18, none, NONE, 0, none, NONE, 0, DS(8, 12)), ++ NPCM7XX_PINCFG(8, lkgpo1, FLOCKR1, 4, none, NONE, 0, none, NONE, 0, DSTR(8, 12)), ++ NPCM7XX_PINCFG(9, lkgpo2, FLOCKR1, 8, none, NONE, 0, none, NONE, 0, DSTR(8, 12)), ++ NPCM7XX_PINCFG(10, ioxh, MFSEL3, 18, none, NONE, 0, none, NONE, 0, DSTR(8, 12)), ++ NPCM7XX_PINCFG(11, ioxh, MFSEL3, 18, none, NONE, 0, none, NONE, 0, DSTR(8, 12)), + NPCM7XX_PINCFG(12, gspi, MFSEL1, 24, smb5b, I2CSEGSEL, 19, none, NONE, 0, SLEW), + NPCM7XX_PINCFG(13, gspi, MFSEL1, 24, smb5b, I2CSEGSEL, 19, none, NONE, 0, SLEW), + NPCM7XX_PINCFG(14, gspi, MFSEL1, 24, smb5c, I2CSEGSEL, 20, none, NONE, 0, SLEW), + NPCM7XX_PINCFG(15, gspi, MFSEL1, 24, smb5c, I2CSEGSEL, 20, none, NONE, 0, SLEW), +- NPCM7XX_PINCFG(16, lkgpo0, FLOCKR1, 0, none, NONE, 0, none, NONE, 0, DS(8, 12)), +- NPCM7XX_PINCFG(17, pspi2, MFSEL3, 13, smb4den, I2CSEGSEL, 23, none, NONE, 0, DS(8, 12)), +- NPCM7XX_PINCFG(18, pspi2, MFSEL3, 13, smb4b, I2CSEGSEL, 14, none, NONE, 0, DS(8, 12)), +- NPCM7XX_PINCFG(19, pspi2, MFSEL3, 13, smb4b, I2CSEGSEL, 14, none, NONE, 0, DS(8, 12)), ++ NPCM7XX_PINCFG(16, lkgpo0, FLOCKR1, 0, none, NONE, 0, none, NONE, 0, DSTR(8, 12)), ++ NPCM7XX_PINCFG(17, pspi2, MFSEL3, 13, smb4den, I2CSEGSEL, 23, none, NONE, 0, DSTR(8, 12)), ++ NPCM7XX_PINCFG(18, pspi2, MFSEL3, 13, smb4b, I2CSEGSEL, 14, none, NONE, 0, DSTR(8, 12)), ++ NPCM7XX_PINCFG(19, pspi2, MFSEL3, 13, smb4b, I2CSEGSEL, 14, none, NONE, 0, DSTR(8, 12)), + NPCM7XX_PINCFG(20, smb4c, I2CSEGSEL, 15, smb15, MFSEL3, 8, none, NONE, 0, 0), + NPCM7XX_PINCFG(21, smb4c, I2CSEGSEL, 15, smb15, MFSEL3, 8, none, NONE, 0, 0), + NPCM7XX_PINCFG(22, smb4d, I2CSEGSEL, 16, smb14, MFSEL3, 7, none, NONE, 0, 0), + NPCM7XX_PINCFG(23, smb4d, I2CSEGSEL, 16, smb14, MFSEL3, 7, none, NONE, 0, 0), +- NPCM7XX_PINCFG(24, ioxh, MFSEL3, 18, none, NONE, 0, none, NONE, 0, DS(8, 12)), +- NPCM7XX_PINCFG(25, ioxh, MFSEL3, 18, none, NONE, 0, none, NONE, 0, DS(8, 12)), ++ NPCM7XX_PINCFG(24, ioxh, MFSEL3, 18, none, NONE, 0, none, NONE, 0, DSTR(8, 12)), ++ NPCM7XX_PINCFG(25, ioxh, MFSEL3, 18, none, NONE, 0, none, NONE, 0, DSTR(8, 12)), + NPCM7XX_PINCFG(26, smb5, MFSEL1, 2, none, NONE, 0, none, NONE, 0, 0), + NPCM7XX_PINCFG(27, smb5, MFSEL1, 2, none, NONE, 0, none, NONE, 0, 0), + NPCM7XX_PINCFG(28, smb4, MFSEL1, 1, none, NONE, 0, none, NONE, 0, 0), +@@ -965,12 +964,12 @@ static const struct npcm7xx_pincfg pincfg[] = { + NPCM7XX_PINCFG(39, smb3b, I2CSEGSEL, 11, none, NONE, 0, none, NONE, 0, SLEW), + NPCM7XX_PINCFG(40, smb3b, I2CSEGSEL, 11, none, NONE, 0, none, NONE, 0, SLEW), + NPCM7XX_PINCFG(41, bmcuart0a, MFSEL1, 9, none, NONE, 0, none, NONE, 0, 0), +- NPCM7XX_PINCFG(42, bmcuart0a, MFSEL1, 9, none, NONE, 0, none, NONE, 0, DS(2, 4) | GPO), ++ NPCM7XX_PINCFG(42, bmcuart0a, MFSEL1, 9, none, NONE, 0, none, NONE, 0, DSTR(2, 4) | GPO), + NPCM7XX_PINCFG(43, uart1, MFSEL1, 10, jtag2, MFSEL4, 0, bmcuart1, MFSEL3, 24, 0), + NPCM7XX_PINCFG(44, uart1, MFSEL1, 10, jtag2, MFSEL4, 0, bmcuart1, MFSEL3, 24, 0), + NPCM7XX_PINCFG(45, uart1, MFSEL1, 10, jtag2, MFSEL4, 0, none, NONE, 0, 0), +- NPCM7XX_PINCFG(46, uart1, MFSEL1, 10, jtag2, MFSEL4, 0, none, NONE, 0, DS(2, 8)), +- NPCM7XX_PINCFG(47, uart1, MFSEL1, 10, jtag2, MFSEL4, 0, none, NONE, 0, DS(2, 8)), ++ NPCM7XX_PINCFG(46, uart1, MFSEL1, 10, jtag2, MFSEL4, 0, none, NONE, 0, DSTR(2, 8)), ++ NPCM7XX_PINCFG(47, uart1, MFSEL1, 10, jtag2, MFSEL4, 0, none, NONE, 0, DSTR(2, 8)), + NPCM7XX_PINCFG(48, uart2, MFSEL1, 11, bmcuart0b, MFSEL4, 1, none, NONE, 0, GPO), + NPCM7XX_PINCFG(49, uart2, MFSEL1, 11, bmcuart0b, MFSEL4, 1, none, NONE, 0, 0), + NPCM7XX_PINCFG(50, uart2, MFSEL1, 11, none, NONE, 0, none, NONE, 0, 0), +@@ -980,8 +979,8 @@ static const struct npcm7xx_pincfg pincfg[] = { + NPCM7XX_PINCFG(54, uart2, MFSEL1, 11, none, NONE, 0, none, NONE, 0, 0), + NPCM7XX_PINCFG(55, uart2, MFSEL1, 11, none, NONE, 0, none, NONE, 0, 0), + NPCM7XX_PINCFG(56, r1err, MFSEL1, 12, none, NONE, 0, none, NONE, 0, 0), +- NPCM7XX_PINCFG(57, r1md, MFSEL1, 13, none, NONE, 0, none, NONE, 0, DS(2, 4)), +- NPCM7XX_PINCFG(58, r1md, MFSEL1, 13, none, NONE, 0, none, NONE, 0, DS(2, 4)), ++ NPCM7XX_PINCFG(57, r1md, MFSEL1, 13, none, NONE, 0, none, NONE, 0, DSTR(2, 4)), ++ NPCM7XX_PINCFG(58, r1md, MFSEL1, 13, none, NONE, 0, none, NONE, 0, DSTR(2, 4)), + NPCM7XX_PINCFG(59, smb3d, I2CSEGSEL, 13, none, NONE, 0, none, NONE, 0, 0), + NPCM7XX_PINCFG(60, smb3d, I2CSEGSEL, 13, none, NONE, 0, none, NONE, 0, 0), + NPCM7XX_PINCFG(61, uart1, MFSEL1, 10, none, NONE, 0, none, NONE, 0, GPO), +@@ -1004,19 +1003,19 @@ static const struct npcm7xx_pincfg pincfg[] = { + NPCM7XX_PINCFG(77, fanin13, MFSEL2, 13, none, NONE, 0, none, NONE, 0, 0), + NPCM7XX_PINCFG(78, fanin14, MFSEL2, 14, none, NONE, 0, none, NONE, 0, 0), + NPCM7XX_PINCFG(79, fanin15, MFSEL2, 15, none, NONE, 0, none, NONE, 0, 0), +- NPCM7XX_PINCFG(80, pwm0, MFSEL2, 16, none, NONE, 0, none, NONE, 0, DS(4, 8)), +- NPCM7XX_PINCFG(81, pwm1, MFSEL2, 17, none, NONE, 0, none, NONE, 0, DS(4, 8)), +- NPCM7XX_PINCFG(82, pwm2, MFSEL2, 18, none, NONE, 0, none, NONE, 0, DS(4, 8)), +- NPCM7XX_PINCFG(83, pwm3, MFSEL2, 19, none, NONE, 0, none, NONE, 0, DS(4, 8)), +- NPCM7XX_PINCFG(84, r2, MFSEL1, 14, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), +- NPCM7XX_PINCFG(85, r2, MFSEL1, 14, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), +- NPCM7XX_PINCFG(86, r2, MFSEL1, 14, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), ++ NPCM7XX_PINCFG(80, pwm0, MFSEL2, 16, none, NONE, 0, none, NONE, 0, DSTR(4, 8)), ++ NPCM7XX_PINCFG(81, pwm1, MFSEL2, 17, none, NONE, 0, none, NONE, 0, DSTR(4, 8)), ++ NPCM7XX_PINCFG(82, pwm2, MFSEL2, 18, none, NONE, 0, none, NONE, 0, DSTR(4, 8)), ++ NPCM7XX_PINCFG(83, pwm3, MFSEL2, 19, none, NONE, 0, none, NONE, 0, DSTR(4, 8)), ++ NPCM7XX_PINCFG(84, r2, MFSEL1, 14, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), ++ NPCM7XX_PINCFG(85, r2, MFSEL1, 14, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), ++ NPCM7XX_PINCFG(86, r2, MFSEL1, 14, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), + NPCM7XX_PINCFG(87, r2, MFSEL1, 14, none, NONE, 0, none, NONE, 0, 0), + NPCM7XX_PINCFG(88, r2, MFSEL1, 14, none, NONE, 0, none, NONE, 0, 0), + NPCM7XX_PINCFG(89, r2, MFSEL1, 14, none, NONE, 0, none, NONE, 0, 0), + NPCM7XX_PINCFG(90, r2err, MFSEL1, 15, none, NONE, 0, none, NONE, 0, 0), +- NPCM7XX_PINCFG(91, r2md, MFSEL1, 16, none, NONE, 0, none, NONE, 0, DS(2, 4)), +- NPCM7XX_PINCFG(92, r2md, MFSEL1, 16, none, NONE, 0, none, NONE, 0, DS(2, 4)), ++ NPCM7XX_PINCFG(91, r2md, MFSEL1, 16, none, NONE, 0, none, NONE, 0, DSTR(2, 4)), ++ NPCM7XX_PINCFG(92, r2md, MFSEL1, 16, none, NONE, 0, none, NONE, 0, DSTR(2, 4)), + NPCM7XX_PINCFG(93, ga20kbc, MFSEL1, 17, smb5d, I2CSEGSEL, 21, none, NONE, 0, 0), + NPCM7XX_PINCFG(94, ga20kbc, MFSEL1, 17, smb5d, I2CSEGSEL, 21, none, NONE, 0, 0), + NPCM7XX_PINCFG(95, lpc, NONE, 0, espi, MFSEL4, 8, gpio, MFSEL1, 26, 0), +@@ -1062,34 +1061,34 @@ static const struct npcm7xx_pincfg pincfg[] = { + NPCM7XX_PINCFG(133, smb10, MFSEL4, 13, none, NONE, 0, none, NONE, 0, 0), + NPCM7XX_PINCFG(134, smb11, MFSEL4, 14, none, NONE, 0, none, NONE, 0, 0), + NPCM7XX_PINCFG(135, smb11, MFSEL4, 14, none, NONE, 0, none, NONE, 0, 0), +- NPCM7XX_PINCFG(136, sd1, MFSEL3, 12, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), +- NPCM7XX_PINCFG(137, sd1, MFSEL3, 12, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), +- NPCM7XX_PINCFG(138, sd1, MFSEL3, 12, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), +- NPCM7XX_PINCFG(139, sd1, MFSEL3, 12, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), +- NPCM7XX_PINCFG(140, sd1, MFSEL3, 12, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), ++ NPCM7XX_PINCFG(136, sd1, MFSEL3, 12, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), ++ NPCM7XX_PINCFG(137, sd1, MFSEL3, 12, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), ++ NPCM7XX_PINCFG(138, sd1, MFSEL3, 12, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), ++ NPCM7XX_PINCFG(139, sd1, MFSEL3, 12, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), ++ NPCM7XX_PINCFG(140, sd1, MFSEL3, 12, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), + NPCM7XX_PINCFG(141, sd1, MFSEL3, 12, none, NONE, 0, none, NONE, 0, 0), +- NPCM7XX_PINCFG(142, sd1, MFSEL3, 12, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), ++ NPCM7XX_PINCFG(142, sd1, MFSEL3, 12, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), + NPCM7XX_PINCFG(143, sd1, MFSEL3, 12, sd1pwr, MFSEL4, 5, none, NONE, 0, 0), +- NPCM7XX_PINCFG(144, pwm4, MFSEL2, 20, none, NONE, 0, none, NONE, 0, DS(4, 8)), +- NPCM7XX_PINCFG(145, pwm5, MFSEL2, 21, none, NONE, 0, none, NONE, 0, DS(4, 8)), +- NPCM7XX_PINCFG(146, pwm6, MFSEL2, 22, none, NONE, 0, none, NONE, 0, DS(4, 8)), +- NPCM7XX_PINCFG(147, pwm7, MFSEL2, 23, none, NONE, 0, none, NONE, 0, DS(4, 8)), +- NPCM7XX_PINCFG(148, mmc8, MFSEL3, 11, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), +- NPCM7XX_PINCFG(149, mmc8, MFSEL3, 11, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), +- NPCM7XX_PINCFG(150, mmc8, MFSEL3, 11, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), +- NPCM7XX_PINCFG(151, mmc8, MFSEL3, 11, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), +- NPCM7XX_PINCFG(152, mmc, MFSEL3, 10, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), ++ NPCM7XX_PINCFG(144, pwm4, MFSEL2, 20, none, NONE, 0, none, NONE, 0, DSTR(4, 8)), ++ NPCM7XX_PINCFG(145, pwm5, MFSEL2, 21, none, NONE, 0, none, NONE, 0, DSTR(4, 8)), ++ NPCM7XX_PINCFG(146, pwm6, MFSEL2, 22, none, NONE, 0, none, NONE, 0, DSTR(4, 8)), ++ NPCM7XX_PINCFG(147, pwm7, MFSEL2, 23, none, NONE, 0, none, NONE, 0, DSTR(4, 8)), ++ NPCM7XX_PINCFG(148, mmc8, MFSEL3, 11, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), ++ NPCM7XX_PINCFG(149, mmc8, MFSEL3, 11, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), ++ NPCM7XX_PINCFG(150, mmc8, MFSEL3, 11, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), ++ NPCM7XX_PINCFG(151, mmc8, MFSEL3, 11, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), ++ NPCM7XX_PINCFG(152, mmc, MFSEL3, 10, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), + NPCM7XX_PINCFG(153, mmcwp, FLOCKR1, 24, none, NONE, 0, none, NONE, 0, 0), /* Z1/A1 */ +- NPCM7XX_PINCFG(154, mmc, MFSEL3, 10, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), ++ NPCM7XX_PINCFG(154, mmc, MFSEL3, 10, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), + NPCM7XX_PINCFG(155, mmccd, MFSEL3, 25, mmcrst, MFSEL4, 6, none, NONE, 0, 0), /* Z1/A1 */ +- NPCM7XX_PINCFG(156, mmc, MFSEL3, 10, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), +- NPCM7XX_PINCFG(157, mmc, MFSEL3, 10, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), +- NPCM7XX_PINCFG(158, mmc, MFSEL3, 10, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), +- NPCM7XX_PINCFG(159, mmc, MFSEL3, 10, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), +- +- NPCM7XX_PINCFG(160, clkout, MFSEL1, 21, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), +- NPCM7XX_PINCFG(161, lpc, NONE, 0, espi, MFSEL4, 8, gpio, MFSEL1, 26, DS(8, 12)), +- NPCM7XX_PINCFG(162, serirq, NONE, 0, gpio, MFSEL1, 31, none, NONE, 0, DS(8, 12)), ++ NPCM7XX_PINCFG(156, mmc, MFSEL3, 10, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), ++ NPCM7XX_PINCFG(157, mmc, MFSEL3, 10, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), ++ NPCM7XX_PINCFG(158, mmc, MFSEL3, 10, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), ++ NPCM7XX_PINCFG(159, mmc, MFSEL3, 10, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), ++ ++ NPCM7XX_PINCFG(160, clkout, MFSEL1, 21, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), ++ NPCM7XX_PINCFG(161, lpc, NONE, 0, espi, MFSEL4, 8, gpio, MFSEL1, 26, DSTR(8, 12)), ++ NPCM7XX_PINCFG(162, serirq, NONE, 0, gpio, MFSEL1, 31, none, NONE, 0, DSTR(8, 12)), + NPCM7XX_PINCFG(163, lpc, NONE, 0, espi, MFSEL4, 8, gpio, MFSEL1, 26, 0), + NPCM7XX_PINCFG(164, lpc, NONE, 0, espi, MFSEL4, 8, gpio, MFSEL1, 26, SLEWLPC), + NPCM7XX_PINCFG(165, lpc, NONE, 0, espi, MFSEL4, 8, gpio, MFSEL1, 26, SLEWLPC), +@@ -1102,25 +1101,25 @@ static const struct npcm7xx_pincfg pincfg[] = { + NPCM7XX_PINCFG(172, smb6, MFSEL3, 1, none, NONE, 0, none, NONE, 0, 0), + NPCM7XX_PINCFG(173, smb7, MFSEL3, 2, none, NONE, 0, none, NONE, 0, 0), + NPCM7XX_PINCFG(174, smb7, MFSEL3, 2, none, NONE, 0, none, NONE, 0, 0), +- NPCM7XX_PINCFG(175, pspi1, MFSEL3, 4, faninx, MFSEL3, 3, none, NONE, 0, DS(8, 12)), +- NPCM7XX_PINCFG(176, pspi1, MFSEL3, 4, faninx, MFSEL3, 3, none, NONE, 0, DS(8, 12)), +- NPCM7XX_PINCFG(177, pspi1, MFSEL3, 4, faninx, MFSEL3, 3, none, NONE, 0, DS(8, 12)), +- NPCM7XX_PINCFG(178, r1, MFSEL3, 9, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), +- NPCM7XX_PINCFG(179, r1, MFSEL3, 9, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), +- NPCM7XX_PINCFG(180, r1, MFSEL3, 9, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), ++ NPCM7XX_PINCFG(175, pspi1, MFSEL3, 4, faninx, MFSEL3, 3, none, NONE, 0, DSTR(8, 12)), ++ NPCM7XX_PINCFG(176, pspi1, MFSEL3, 4, faninx, MFSEL3, 3, none, NONE, 0, DSTR(8, 12)), ++ NPCM7XX_PINCFG(177, pspi1, MFSEL3, 4, faninx, MFSEL3, 3, none, NONE, 0, DSTR(8, 12)), ++ NPCM7XX_PINCFG(178, r1, MFSEL3, 9, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), ++ NPCM7XX_PINCFG(179, r1, MFSEL3, 9, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), ++ NPCM7XX_PINCFG(180, r1, MFSEL3, 9, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), + NPCM7XX_PINCFG(181, r1, MFSEL3, 9, none, NONE, 0, none, NONE, 0, 0), + NPCM7XX_PINCFG(182, r1, MFSEL3, 9, none, NONE, 0, none, NONE, 0, 0), +- NPCM7XX_PINCFG(183, spi3, MFSEL4, 16, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), +- NPCM7XX_PINCFG(184, spi3, MFSEL4, 16, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW | GPO), +- NPCM7XX_PINCFG(185, spi3, MFSEL4, 16, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW | GPO), +- NPCM7XX_PINCFG(186, spi3, MFSEL4, 16, none, NONE, 0, none, NONE, 0, DS(8, 12)), +- NPCM7XX_PINCFG(187, spi3cs1, MFSEL4, 17, none, NONE, 0, none, NONE, 0, DS(8, 12)), +- NPCM7XX_PINCFG(188, spi3quad, MFSEL4, 20, spi3cs2, MFSEL4, 18, none, NONE, 0, DS(8, 12) | SLEW), +- NPCM7XX_PINCFG(189, spi3quad, MFSEL4, 20, spi3cs3, MFSEL4, 19, none, NONE, 0, DS(8, 12) | SLEW), +- NPCM7XX_PINCFG(190, gpio, FLOCKR1, 20, nprd_smi, NONE, 0, none, NONE, 0, DS(2, 4)), +- NPCM7XX_PINCFG(191, none, NONE, 0, none, NONE, 0, none, NONE, 0, DS(8, 12)), /* XX */ +- +- NPCM7XX_PINCFG(192, none, NONE, 0, none, NONE, 0, none, NONE, 0, DS(8, 12)), /* XX */ ++ NPCM7XX_PINCFG(183, spi3, MFSEL4, 16, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), ++ NPCM7XX_PINCFG(184, spi3, MFSEL4, 16, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW | GPO), ++ NPCM7XX_PINCFG(185, spi3, MFSEL4, 16, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW | GPO), ++ NPCM7XX_PINCFG(186, spi3, MFSEL4, 16, none, NONE, 0, none, NONE, 0, DSTR(8, 12)), ++ NPCM7XX_PINCFG(187, spi3cs1, MFSEL4, 17, none, NONE, 0, none, NONE, 0, DSTR(8, 12)), ++ NPCM7XX_PINCFG(188, spi3quad, MFSEL4, 20, spi3cs2, MFSEL4, 18, none, NONE, 0, DSTR(8, 12) | SLEW), ++ NPCM7XX_PINCFG(189, spi3quad, MFSEL4, 20, spi3cs3, MFSEL4, 19, none, NONE, 0, DSTR(8, 12) | SLEW), ++ NPCM7XX_PINCFG(190, gpio, FLOCKR1, 20, nprd_smi, NONE, 0, none, NONE, 0, DSTR(2, 4)), ++ NPCM7XX_PINCFG(191, none, NONE, 0, none, NONE, 0, none, NONE, 0, DSTR(8, 12)), /* XX */ ++ ++ NPCM7XX_PINCFG(192, none, NONE, 0, none, NONE, 0, none, NONE, 0, DSTR(8, 12)), /* XX */ + NPCM7XX_PINCFG(193, r1, MFSEL3, 9, none, NONE, 0, none, NONE, 0, 0), + NPCM7XX_PINCFG(194, smb0b, I2CSEGSEL, 0, none, NONE, 0, none, NONE, 0, 0), + NPCM7XX_PINCFG(195, smb0b, I2CSEGSEL, 0, none, NONE, 0, none, NONE, 0, 0), +@@ -1131,11 +1130,11 @@ static const struct npcm7xx_pincfg pincfg[] = { + NPCM7XX_PINCFG(200, r2, MFSEL1, 14, none, NONE, 0, none, NONE, 0, 0), + NPCM7XX_PINCFG(201, r1, MFSEL3, 9, none, NONE, 0, none, NONE, 0, 0), + NPCM7XX_PINCFG(202, smb0c, I2CSEGSEL, 1, none, NONE, 0, none, NONE, 0, 0), +- NPCM7XX_PINCFG(203, faninx, MFSEL3, 3, none, NONE, 0, none, NONE, 0, DS(8, 12)), ++ NPCM7XX_PINCFG(203, faninx, MFSEL3, 3, none, NONE, 0, none, NONE, 0, DSTR(8, 12)), + NPCM7XX_PINCFG(204, ddc, NONE, 0, gpio, MFSEL3, 22, none, NONE, 0, SLEW), + NPCM7XX_PINCFG(205, ddc, NONE, 0, gpio, MFSEL3, 22, none, NONE, 0, SLEW), +- NPCM7XX_PINCFG(206, ddc, NONE, 0, gpio, MFSEL3, 22, none, NONE, 0, DS(4, 8)), +- NPCM7XX_PINCFG(207, ddc, NONE, 0, gpio, MFSEL3, 22, none, NONE, 0, DS(4, 8)), ++ NPCM7XX_PINCFG(206, ddc, NONE, 0, gpio, MFSEL3, 22, none, NONE, 0, DSTR(4, 8)), ++ NPCM7XX_PINCFG(207, ddc, NONE, 0, gpio, MFSEL3, 22, none, NONE, 0, DSTR(4, 8)), + NPCM7XX_PINCFG(208, rg2, MFSEL4, 24, ddr, MFSEL3, 26, none, NONE, 0, 0), + NPCM7XX_PINCFG(209, rg2, MFSEL4, 24, ddr, MFSEL3, 26, none, NONE, 0, 0), + NPCM7XX_PINCFG(210, rg2, MFSEL4, 24, ddr, MFSEL3, 26, none, NONE, 0, 0), +@@ -1147,20 +1146,20 @@ static const struct npcm7xx_pincfg pincfg[] = { + NPCM7XX_PINCFG(216, rg2mdio, MFSEL4, 23, ddr, MFSEL3, 26, none, NONE, 0, 0), + NPCM7XX_PINCFG(217, rg2mdio, MFSEL4, 23, ddr, MFSEL3, 26, none, NONE, 0, 0), + NPCM7XX_PINCFG(218, wdog1, MFSEL3, 19, none, NONE, 0, none, NONE, 0, 0), +- NPCM7XX_PINCFG(219, wdog2, MFSEL3, 20, none, NONE, 0, none, NONE, 0, DS(4, 8)), ++ NPCM7XX_PINCFG(219, wdog2, MFSEL3, 20, none, NONE, 0, none, NONE, 0, DSTR(4, 8)), + NPCM7XX_PINCFG(220, smb12, MFSEL3, 5, none, NONE, 0, none, NONE, 0, 0), + NPCM7XX_PINCFG(221, smb12, MFSEL3, 5, none, NONE, 0, none, NONE, 0, 0), + NPCM7XX_PINCFG(222, smb13, MFSEL3, 6, none, NONE, 0, none, NONE, 0, 0), + NPCM7XX_PINCFG(223, smb13, MFSEL3, 6, none, NONE, 0, none, NONE, 0, 0), + + NPCM7XX_PINCFG(224, spix, MFSEL4, 27, none, NONE, 0, none, NONE, 0, SLEW), +- NPCM7XX_PINCFG(225, spix, MFSEL4, 27, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW | GPO), +- NPCM7XX_PINCFG(226, spix, MFSEL4, 27, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW | GPO), +- NPCM7XX_PINCFG(227, spix, MFSEL4, 27, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), +- NPCM7XX_PINCFG(228, spixcs1, MFSEL4, 28, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), +- NPCM7XX_PINCFG(229, spix, MFSEL4, 27, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), +- NPCM7XX_PINCFG(230, spix, MFSEL4, 27, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), +- NPCM7XX_PINCFG(231, clkreq, MFSEL4, 9, none, NONE, 0, none, NONE, 0, DS(8, 12)), ++ NPCM7XX_PINCFG(225, spix, MFSEL4, 27, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW | GPO), ++ NPCM7XX_PINCFG(226, spix, MFSEL4, 27, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW | GPO), ++ NPCM7XX_PINCFG(227, spix, MFSEL4, 27, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), ++ NPCM7XX_PINCFG(228, spixcs1, MFSEL4, 28, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), ++ NPCM7XX_PINCFG(229, spix, MFSEL4, 27, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), ++ NPCM7XX_PINCFG(230, spix, MFSEL4, 27, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), ++ NPCM7XX_PINCFG(231, clkreq, MFSEL4, 9, none, NONE, 0, none, NONE, 0, DSTR(8, 12)), + NPCM7XX_PINCFG(253, none, NONE, 0, none, NONE, 0, none, NONE, 0, GPI), /* SDHC1 power */ + NPCM7XX_PINCFG(254, none, NONE, 0, none, NONE, 0, none, NONE, 0, GPI), /* SDHC2 power */ + NPCM7XX_PINCFG(255, none, NONE, 0, none, NONE, 0, none, NONE, 0, GPI), /* DACOSEL */ +@@ -1561,7 +1560,7 @@ static int npcm7xx_get_groups_count(struct pinctrl_dev *pctldev) + { + struct npcm7xx_pinctrl *npcm = pinctrl_dev_get_drvdata(pctldev); + +- dev_dbg(npcm->dev, "group size: %d\n", ARRAY_SIZE(npcm7xx_groups)); ++ dev_dbg(npcm->dev, "group size: %zu\n", ARRAY_SIZE(npcm7xx_groups)); + return ARRAY_SIZE(npcm7xx_groups); + } + +diff --git a/drivers/pinctrl/pinconf-generic.c b/drivers/pinctrl/pinconf-generic.c +index 9eb86309c70bf..355bc4c748e26 100644 +--- a/drivers/pinctrl/pinconf-generic.c ++++ b/drivers/pinctrl/pinconf-generic.c +@@ -30,10 +30,10 @@ static const struct pin_config_item conf_items[] = { + PCONFDUMP(PIN_CONFIG_BIAS_BUS_HOLD, "input bias bus hold", NULL, false), + PCONFDUMP(PIN_CONFIG_BIAS_DISABLE, "input bias disabled", NULL, false), + PCONFDUMP(PIN_CONFIG_BIAS_HIGH_IMPEDANCE, "input bias high impedance", NULL, false), +- PCONFDUMP(PIN_CONFIG_BIAS_PULL_DOWN, "input bias pull down", NULL, false), ++ PCONFDUMP(PIN_CONFIG_BIAS_PULL_DOWN, "input bias pull down", "ohms", true), + PCONFDUMP(PIN_CONFIG_BIAS_PULL_PIN_DEFAULT, +- "input bias pull to pin specific state", NULL, false), +- PCONFDUMP(PIN_CONFIG_BIAS_PULL_UP, "input bias pull up", NULL, false), ++ "input bias pull to pin specific state", "ohms", true), ++ PCONFDUMP(PIN_CONFIG_BIAS_PULL_UP, "input bias pull up", "ohms", true), + PCONFDUMP(PIN_CONFIG_DRIVE_OPEN_DRAIN, "output drive open drain", NULL, false), + PCONFDUMP(PIN_CONFIG_DRIVE_OPEN_SOURCE, "output drive open source", NULL, false), + PCONFDUMP(PIN_CONFIG_DRIVE_PUSH_PULL, "output drive push pull", NULL, false), +diff --git a/drivers/pinctrl/pinctrl-rockchip.c b/drivers/pinctrl/pinctrl-rockchip.c +index 59fe3204e965d..4b972be3487f9 100644 +--- a/drivers/pinctrl/pinctrl-rockchip.c ++++ b/drivers/pinctrl/pinctrl-rockchip.c +@@ -3433,6 +3433,7 @@ static int rockchip_pinctrl_probe(struct platform_device *pdev) + node = of_parse_phandle(np, "rockchip,grf", 0); + if (node) { + info->regmap_base = syscon_node_to_regmap(node); ++ of_node_put(node); + if (IS_ERR(info->regmap_base)) + return PTR_ERR(info->regmap_base); + } else { +@@ -3469,6 +3470,7 @@ static int rockchip_pinctrl_probe(struct platform_device *pdev) + node = of_parse_phandle(np, "rockchip,pmu", 0); + if (node) { + info->regmap_pmu = syscon_node_to_regmap(node); ++ of_node_put(node); + if (IS_ERR(info->regmap_pmu)) + return PTR_ERR(info->regmap_pmu); + } +diff --git a/drivers/pinctrl/samsung/pinctrl-samsung.c b/drivers/pinctrl/samsung/pinctrl-samsung.c +index 601fffeba39fe..131fa7958f754 100644 +--- a/drivers/pinctrl/samsung/pinctrl-samsung.c ++++ b/drivers/pinctrl/samsung/pinctrl-samsung.c +@@ -1002,6 +1002,16 @@ samsung_pinctrl_get_soc_data_for_of_alias(struct platform_device *pdev) + return &(of_data->ctrl[id]); + } + ++static void samsung_banks_of_node_put(struct samsung_pinctrl_drv_data *d) ++{ ++ struct samsung_pin_bank *bank; ++ unsigned int i; ++ ++ bank = d->pin_banks; ++ for (i = 0; i < d->nr_banks; ++i, ++bank) ++ of_node_put(bank->of_node); ++} ++ + /* retrieve the soc specific data */ + static const struct samsung_pin_ctrl * + samsung_pinctrl_get_soc_data(struct samsung_pinctrl_drv_data *d, +@@ -1116,19 +1126,19 @@ static int samsung_pinctrl_probe(struct platform_device *pdev) + if (ctrl->retention_data) { + drvdata->retention_ctrl = ctrl->retention_data->init(drvdata, + ctrl->retention_data); +- if (IS_ERR(drvdata->retention_ctrl)) +- return PTR_ERR(drvdata->retention_ctrl); ++ if (IS_ERR(drvdata->retention_ctrl)) { ++ ret = PTR_ERR(drvdata->retention_ctrl); ++ goto err_put_banks; ++ } + } + + ret = samsung_pinctrl_register(pdev, drvdata); + if (ret) +- return ret; ++ goto err_put_banks; + + ret = samsung_gpiolib_register(pdev, drvdata); +- if (ret) { +- samsung_pinctrl_unregister(pdev, drvdata); +- return ret; +- } ++ if (ret) ++ goto err_unregister; + + if (ctrl->eint_gpio_init) + ctrl->eint_gpio_init(drvdata); +@@ -1138,6 +1148,12 @@ static int samsung_pinctrl_probe(struct platform_device *pdev) + platform_set_drvdata(pdev, drvdata); + + return 0; ++ ++err_unregister: ++ samsung_pinctrl_unregister(pdev, drvdata); ++err_put_banks: ++ samsung_banks_of_node_put(drvdata); ++ return ret; + } + + /** +diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a77470.c b/drivers/pinctrl/sh-pfc/pfc-r8a77470.c +index b3b116da1bb0d..14005725a726b 100644 +--- a/drivers/pinctrl/sh-pfc/pfc-r8a77470.c ++++ b/drivers/pinctrl/sh-pfc/pfc-r8a77470.c +@@ -2121,7 +2121,7 @@ static const unsigned int vin0_clk_mux[] = { + VI0_CLK_MARK, + }; + /* - VIN1 ------------------------------------------------------------------- */ +-static const union vin_data vin1_data_pins = { ++static const union vin_data12 vin1_data_pins = { + .data12 = { + RCAR_GP_PIN(3, 1), RCAR_GP_PIN(3, 2), + RCAR_GP_PIN(3, 3), RCAR_GP_PIN(3, 4), +@@ -2131,7 +2131,7 @@ static const union vin_data vin1_data_pins = { + RCAR_GP_PIN(3, 15), RCAR_GP_PIN(3, 16), + }, + }; +-static const union vin_data vin1_data_mux = { ++static const union vin_data12 vin1_data_mux = { + .data12 = { + VI1_DATA0_MARK, VI1_DATA1_MARK, + VI1_DATA2_MARK, VI1_DATA3_MARK, +diff --git a/drivers/power/reset/gemini-poweroff.c b/drivers/power/reset/gemini-poweroff.c +index 90e35c07240ae..b7f7a8225f22e 100644 +--- a/drivers/power/reset/gemini-poweroff.c ++++ b/drivers/power/reset/gemini-poweroff.c +@@ -107,8 +107,8 @@ static int gemini_poweroff_probe(struct platform_device *pdev) + return PTR_ERR(gpw->base); + + irq = platform_get_irq(pdev, 0); +- if (!irq) +- return -EINVAL; ++ if (irq < 0) ++ return irq; + + gpw->dev = dev; + +diff --git a/drivers/power/supply/ab8500_fg.c b/drivers/power/supply/ab8500_fg.c +index 69452fc085b99..4c229e6fb750a 100644 +--- a/drivers/power/supply/ab8500_fg.c ++++ b/drivers/power/supply/ab8500_fg.c +@@ -2541,8 +2541,10 @@ static int ab8500_fg_sysfs_init(struct ab8500_fg *di) + ret = kobject_init_and_add(&di->fg_kobject, + &ab8500_fg_ktype, + NULL, "battery"); +- if (ret < 0) ++ if (ret < 0) { ++ kobject_put(&di->fg_kobject); + dev_err(di->dev, "failed to create sysfs entry\n"); ++ } + + return ret; + } +diff --git a/drivers/power/supply/axp20x_battery.c b/drivers/power/supply/axp20x_battery.c +index e84b6e4da14a8..9fda98b950bab 100644 +--- a/drivers/power/supply/axp20x_battery.c ++++ b/drivers/power/supply/axp20x_battery.c +@@ -185,7 +185,6 @@ static int axp20x_battery_get_prop(struct power_supply *psy, + union power_supply_propval *val) + { + struct axp20x_batt_ps *axp20x_batt = power_supply_get_drvdata(psy); +- struct iio_channel *chan; + int ret = 0, reg, val1; + + switch (psp) { +@@ -265,12 +264,12 @@ static int axp20x_battery_get_prop(struct power_supply *psy, + if (ret) + return ret; + +- if (reg & AXP20X_PWR_STATUS_BAT_CHARGING) +- chan = axp20x_batt->batt_chrg_i; +- else +- chan = axp20x_batt->batt_dischrg_i; +- +- ret = iio_read_channel_processed(chan, &val->intval); ++ if (reg & AXP20X_PWR_STATUS_BAT_CHARGING) { ++ ret = iio_read_channel_processed(axp20x_batt->batt_chrg_i, &val->intval); ++ } else { ++ ret = iio_read_channel_processed(axp20x_batt->batt_dischrg_i, &val1); ++ val->intval = -val1; ++ } + if (ret) + return ret; + +diff --git a/drivers/power/supply/axp288_charger.c b/drivers/power/supply/axp288_charger.c +index 7d09e49f04d3b..2ee6bb7c08045 100644 +--- a/drivers/power/supply/axp288_charger.c ++++ b/drivers/power/supply/axp288_charger.c +@@ -41,11 +41,11 @@ + #define VBUS_ISPOUT_CUR_LIM_1500MA 0x1 /* 1500mA */ + #define VBUS_ISPOUT_CUR_LIM_2000MA 0x2 /* 2000mA */ + #define VBUS_ISPOUT_CUR_NO_LIM 0x3 /* 2500mA */ +-#define VBUS_ISPOUT_VHOLD_SET_MASK 0x31 ++#define VBUS_ISPOUT_VHOLD_SET_MASK 0x38 + #define VBUS_ISPOUT_VHOLD_SET_BIT_POS 0x3 + #define VBUS_ISPOUT_VHOLD_SET_OFFSET 4000 /* 4000mV */ + #define VBUS_ISPOUT_VHOLD_SET_LSB_RES 100 /* 100mV */ +-#define VBUS_ISPOUT_VHOLD_SET_4300MV 0x3 /* 4300mV */ ++#define VBUS_ISPOUT_VHOLD_SET_4400MV 0x4 /* 4400mV */ + #define VBUS_ISPOUT_VBUS_PATH_DIS BIT(7) + + #define CHRG_CCCV_CC_MASK 0xf /* 4 bits */ +@@ -744,6 +744,16 @@ static int charger_init_hw_regs(struct axp288_chrg_info *info) + ret = axp288_charger_vbus_path_select(info, true); + if (ret < 0) + return ret; ++ } else { ++ /* Set Vhold to the factory default / recommended 4.4V */ ++ val = VBUS_ISPOUT_VHOLD_SET_4400MV << VBUS_ISPOUT_VHOLD_SET_BIT_POS; ++ ret = regmap_update_bits(info->regmap, AXP20X_VBUS_IPSOUT_MGMT, ++ VBUS_ISPOUT_VHOLD_SET_MASK, val); ++ if (ret < 0) { ++ dev_err(&info->pdev->dev, "register(%x) write error(%d)\n", ++ AXP20X_VBUS_IPSOUT_MGMT, ret); ++ return ret; ++ } + } + + /* Read current charge voltage and current limit */ +diff --git a/drivers/power/supply/bq24190_charger.c b/drivers/power/supply/bq24190_charger.c +index 1ae5d6d42c9e3..64d87dccea82c 100644 +--- a/drivers/power/supply/bq24190_charger.c ++++ b/drivers/power/supply/bq24190_charger.c +@@ -41,6 +41,7 @@ + #define BQ24190_REG_POC_CHG_CONFIG_DISABLE 0x0 + #define BQ24190_REG_POC_CHG_CONFIG_CHARGE 0x1 + #define BQ24190_REG_POC_CHG_CONFIG_OTG 0x2 ++#define BQ24190_REG_POC_CHG_CONFIG_OTG_ALT 0x3 + #define BQ24190_REG_POC_SYS_MIN_MASK (BIT(3) | BIT(2) | BIT(1)) + #define BQ24190_REG_POC_SYS_MIN_SHIFT 1 + #define BQ24190_REG_POC_SYS_MIN_MIN 3000 +@@ -550,7 +551,11 @@ static int bq24190_vbus_is_enabled(struct regulator_dev *dev) + pm_runtime_mark_last_busy(bdi->dev); + pm_runtime_put_autosuspend(bdi->dev); + +- return ret ? ret : val == BQ24190_REG_POC_CHG_CONFIG_OTG; ++ if (ret) ++ return ret; ++ ++ return (val == BQ24190_REG_POC_CHG_CONFIG_OTG || ++ val == BQ24190_REG_POC_CHG_CONFIG_OTG_ALT); + } + + static const struct regulator_ops bq24190_vbus_ops = { +diff --git a/drivers/power/supply/wm8350_power.c b/drivers/power/supply/wm8350_power.c +index 26923af574f43..4fe9ea9721b39 100644 +--- a/drivers/power/supply/wm8350_power.c ++++ b/drivers/power/supply/wm8350_power.c +@@ -408,44 +408,112 @@ static const struct power_supply_desc wm8350_usb_desc = { + * Initialisation + *********************************************************************/ + +-static void wm8350_init_charger(struct wm8350 *wm8350) ++static int wm8350_init_charger(struct wm8350 *wm8350) + { ++ int ret; ++ + /* register our interest in charger events */ +- wm8350_register_irq(wm8350, WM8350_IRQ_CHG_BAT_HOT, ++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CHG_BAT_HOT, + wm8350_charger_handler, 0, "Battery hot", wm8350); +- wm8350_register_irq(wm8350, WM8350_IRQ_CHG_BAT_COLD, ++ if (ret) ++ goto err; ++ ++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CHG_BAT_COLD, + wm8350_charger_handler, 0, "Battery cold", wm8350); +- wm8350_register_irq(wm8350, WM8350_IRQ_CHG_BAT_FAIL, ++ if (ret) ++ goto free_chg_bat_hot; ++ ++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CHG_BAT_FAIL, + wm8350_charger_handler, 0, "Battery fail", wm8350); +- wm8350_register_irq(wm8350, WM8350_IRQ_CHG_TO, ++ if (ret) ++ goto free_chg_bat_cold; ++ ++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CHG_TO, + wm8350_charger_handler, 0, + "Charger timeout", wm8350); +- wm8350_register_irq(wm8350, WM8350_IRQ_CHG_END, ++ if (ret) ++ goto free_chg_bat_fail; ++ ++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CHG_END, + wm8350_charger_handler, 0, + "Charge end", wm8350); +- wm8350_register_irq(wm8350, WM8350_IRQ_CHG_START, ++ if (ret) ++ goto free_chg_to; ++ ++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CHG_START, + wm8350_charger_handler, 0, + "Charge start", wm8350); +- wm8350_register_irq(wm8350, WM8350_IRQ_CHG_FAST_RDY, ++ if (ret) ++ goto free_chg_end; ++ ++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CHG_FAST_RDY, + wm8350_charger_handler, 0, + "Fast charge ready", wm8350); +- wm8350_register_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_3P9, ++ if (ret) ++ goto free_chg_start; ++ ++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_3P9, + wm8350_charger_handler, 0, + "Battery <3.9V", wm8350); +- wm8350_register_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_3P1, ++ if (ret) ++ goto free_chg_fast_rdy; ++ ++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_3P1, + wm8350_charger_handler, 0, + "Battery <3.1V", wm8350); +- wm8350_register_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_2P85, ++ if (ret) ++ goto free_chg_vbatt_lt_3p9; ++ ++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_2P85, + wm8350_charger_handler, 0, + "Battery <2.85V", wm8350); ++ if (ret) ++ goto free_chg_vbatt_lt_3p1; + + /* and supply change events */ +- wm8350_register_irq(wm8350, WM8350_IRQ_EXT_USB_FB, ++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_EXT_USB_FB, + wm8350_charger_handler, 0, "USB", wm8350); +- wm8350_register_irq(wm8350, WM8350_IRQ_EXT_WALL_FB, ++ if (ret) ++ goto free_chg_vbatt_lt_2p85; ++ ++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_EXT_WALL_FB, + wm8350_charger_handler, 0, "Wall", wm8350); +- wm8350_register_irq(wm8350, WM8350_IRQ_EXT_BAT_FB, ++ if (ret) ++ goto free_ext_usb_fb; ++ ++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_EXT_BAT_FB, + wm8350_charger_handler, 0, "Battery", wm8350); ++ if (ret) ++ goto free_ext_wall_fb; ++ ++ return 0; ++ ++free_ext_wall_fb: ++ wm8350_free_irq(wm8350, WM8350_IRQ_EXT_WALL_FB, wm8350); ++free_ext_usb_fb: ++ wm8350_free_irq(wm8350, WM8350_IRQ_EXT_USB_FB, wm8350); ++free_chg_vbatt_lt_2p85: ++ wm8350_free_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_2P85, wm8350); ++free_chg_vbatt_lt_3p1: ++ wm8350_free_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_3P1, wm8350); ++free_chg_vbatt_lt_3p9: ++ wm8350_free_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_3P9, wm8350); ++free_chg_fast_rdy: ++ wm8350_free_irq(wm8350, WM8350_IRQ_CHG_FAST_RDY, wm8350); ++free_chg_start: ++ wm8350_free_irq(wm8350, WM8350_IRQ_CHG_START, wm8350); ++free_chg_end: ++ wm8350_free_irq(wm8350, WM8350_IRQ_CHG_END, wm8350); ++free_chg_to: ++ wm8350_free_irq(wm8350, WM8350_IRQ_CHG_TO, wm8350); ++free_chg_bat_fail: ++ wm8350_free_irq(wm8350, WM8350_IRQ_CHG_BAT_FAIL, wm8350); ++free_chg_bat_cold: ++ wm8350_free_irq(wm8350, WM8350_IRQ_CHG_BAT_COLD, wm8350); ++free_chg_bat_hot: ++ wm8350_free_irq(wm8350, WM8350_IRQ_CHG_BAT_HOT, wm8350); ++err: ++ return ret; + } + + static void free_charger_irq(struct wm8350 *wm8350) +@@ -456,6 +524,7 @@ static void free_charger_irq(struct wm8350 *wm8350) + wm8350_free_irq(wm8350, WM8350_IRQ_CHG_TO, wm8350); + wm8350_free_irq(wm8350, WM8350_IRQ_CHG_END, wm8350); + wm8350_free_irq(wm8350, WM8350_IRQ_CHG_START, wm8350); ++ wm8350_free_irq(wm8350, WM8350_IRQ_CHG_FAST_RDY, wm8350); + wm8350_free_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_3P9, wm8350); + wm8350_free_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_3P1, wm8350); + wm8350_free_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_2P85, wm8350); +diff --git a/drivers/ptp/ptp_sysfs.c b/drivers/ptp/ptp_sysfs.c +index be076a91e20e6..8cd59e8481631 100644 +--- a/drivers/ptp/ptp_sysfs.c ++++ b/drivers/ptp/ptp_sysfs.c +@@ -13,7 +13,7 @@ static ssize_t clock_name_show(struct device *dev, + struct device_attribute *attr, char *page) + { + struct ptp_clock *ptp = dev_get_drvdata(dev); +- return snprintf(page, PAGE_SIZE-1, "%s\n", ptp->info->name); ++ return sysfs_emit(page, "%s\n", ptp->info->name); + } + static DEVICE_ATTR_RO(clock_name); + +@@ -227,7 +227,7 @@ static ssize_t ptp_pin_show(struct device *dev, struct device_attribute *attr, + + mutex_unlock(&ptp->pincfg_mux); + +- return snprintf(page, PAGE_SIZE, "%u %u\n", func, chan); ++ return sysfs_emit(page, "%u %u\n", func, chan); + } + + static ssize_t ptp_pin_store(struct device *dev, struct device_attribute *attr, +diff --git a/drivers/pwm/pwm-lpc18xx-sct.c b/drivers/pwm/pwm-lpc18xx-sct.c +index 5ff11145c1a30..9b15b6a79082a 100644 +--- a/drivers/pwm/pwm-lpc18xx-sct.c ++++ b/drivers/pwm/pwm-lpc18xx-sct.c +@@ -400,12 +400,6 @@ static int lpc18xx_pwm_probe(struct platform_device *pdev) + lpc18xx_pwm_writel(lpc18xx_pwm, LPC18XX_PWM_LIMIT, + BIT(lpc18xx_pwm->period_event)); + +- ret = pwmchip_add(&lpc18xx_pwm->chip); +- if (ret < 0) { +- dev_err(&pdev->dev, "pwmchip_add failed: %d\n", ret); +- goto disable_pwmclk; +- } +- + for (i = 0; i < lpc18xx_pwm->chip.npwm; i++) { + struct lpc18xx_pwm_data *data; + +@@ -415,14 +409,12 @@ static int lpc18xx_pwm_probe(struct platform_device *pdev) + GFP_KERNEL); + if (!data) { + ret = -ENOMEM; +- goto remove_pwmchip; ++ goto disable_pwmclk; + } + + pwm_set_chip_data(pwm, data); + } + +- platform_set_drvdata(pdev, lpc18xx_pwm); +- + val = lpc18xx_pwm_readl(lpc18xx_pwm, LPC18XX_PWM_CTRL); + val &= ~LPC18XX_PWM_BIDIR; + val &= ~LPC18XX_PWM_CTRL_HALT; +@@ -430,10 +422,16 @@ static int lpc18xx_pwm_probe(struct platform_device *pdev) + val |= LPC18XX_PWM_PRE(0); + lpc18xx_pwm_writel(lpc18xx_pwm, LPC18XX_PWM_CTRL, val); + ++ ret = pwmchip_add(&lpc18xx_pwm->chip); ++ if (ret < 0) { ++ dev_err(&pdev->dev, "pwmchip_add failed: %d\n", ret); ++ goto disable_pwmclk; ++ } ++ ++ platform_set_drvdata(pdev, lpc18xx_pwm); ++ + return 0; + +-remove_pwmchip: +- pwmchip_remove(&lpc18xx_pwm->chip); + disable_pwmclk: + clk_disable_unprepare(lpc18xx_pwm->pwm_clk); + return ret; +diff --git a/drivers/regulator/qcom_smd-regulator.c b/drivers/regulator/qcom_smd-regulator.c +index e6601c28ab431..a4c82f5e2dae7 100644 +--- a/drivers/regulator/qcom_smd-regulator.c ++++ b/drivers/regulator/qcom_smd-regulator.c +@@ -854,8 +854,10 @@ static int rpm_reg_probe(struct platform_device *pdev) + + for_each_available_child_of_node(dev->of_node, node) { + vreg = devm_kzalloc(&pdev->dev, sizeof(*vreg), GFP_KERNEL); +- if (!vreg) ++ if (!vreg) { ++ of_node_put(node); + return -ENOMEM; ++ } + + ret = rpm_regulator_init_vreg(vreg, dev, node, rpm, vreg_data); + +diff --git a/drivers/remoteproc/qcom_q6v5_adsp.c b/drivers/remoteproc/qcom_q6v5_adsp.c +index 24e8b7e271773..6b131a490ebf8 100644 +--- a/drivers/remoteproc/qcom_q6v5_adsp.c ++++ b/drivers/remoteproc/qcom_q6v5_adsp.c +@@ -389,6 +389,7 @@ static int adsp_alloc_memory_region(struct qcom_adsp *adsp) + } + + ret = of_address_to_resource(node, 0, &r); ++ of_node_put(node); + if (ret) + return ret; + +diff --git a/drivers/remoteproc/qcom_wcnss.c b/drivers/remoteproc/qcom_wcnss.c +index dc135754bb9c5..c72f1b3b60858 100644 +--- a/drivers/remoteproc/qcom_wcnss.c ++++ b/drivers/remoteproc/qcom_wcnss.c +@@ -440,6 +440,7 @@ static int wcnss_alloc_memory_region(struct qcom_wcnss *wcnss) + } + + ret = of_address_to_resource(node, 0, &r); ++ of_node_put(node); + if (ret) + return ret; + +diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c +index 5c1378d2fab3d..ba345a379e262 100644 +--- a/drivers/rtc/interface.c ++++ b/drivers/rtc/interface.c +@@ -793,9 +793,13 @@ static int rtc_timer_enqueue(struct rtc_device *rtc, struct rtc_timer *timer) + struct timerqueue_node *next = timerqueue_getnext(&rtc->timerqueue); + struct rtc_time tm; + ktime_t now; ++ int err; ++ ++ err = __rtc_read_time(rtc, &tm); ++ if (err) ++ return err; + + timer->enabled = 1; +- __rtc_read_time(rtc, &tm); + now = rtc_tm_to_ktime(tm); + + /* Skip over expired timers */ +@@ -809,7 +813,6 @@ static int rtc_timer_enqueue(struct rtc_device *rtc, struct rtc_timer *timer) + trace_rtc_timer_enqueue(timer); + if (!next || ktime_before(timer->node.expires, next->expires)) { + struct rtc_wkalrm alarm; +- int err; + + alarm.time = rtc_ktime_to_tm(timer->node.expires); + alarm.enabled = 1; +diff --git a/drivers/rtc/rtc-wm8350.c b/drivers/rtc/rtc-wm8350.c +index 2018614f258f6..6eaa9321c0741 100644 +--- a/drivers/rtc/rtc-wm8350.c ++++ b/drivers/rtc/rtc-wm8350.c +@@ -432,14 +432,21 @@ static int wm8350_rtc_probe(struct platform_device *pdev) + return ret; + } + +- wm8350_register_irq(wm8350, WM8350_IRQ_RTC_SEC, ++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_RTC_SEC, + wm8350_rtc_update_handler, 0, + "RTC Seconds", wm8350); ++ if (ret) ++ return ret; ++ + wm8350_mask_irq(wm8350, WM8350_IRQ_RTC_SEC); + +- wm8350_register_irq(wm8350, WM8350_IRQ_RTC_ALM, ++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_RTC_ALM, + wm8350_rtc_alarm_handler, 0, + "RTC Alarm", wm8350); ++ if (ret) { ++ wm8350_free_irq(wm8350, WM8350_IRQ_RTC_SEC, wm8350); ++ return ret; ++ } + + return 0; + } +diff --git a/drivers/scsi/aha152x.c b/drivers/scsi/aha152x.c +index eb466c2e1839e..fdd9f1a5100c7 100644 +--- a/drivers/scsi/aha152x.c ++++ b/drivers/scsi/aha152x.c +@@ -3368,13 +3368,11 @@ static int __init aha152x_setup(char *str) + setup[setup_count].synchronous = ints[0] >= 6 ? ints[6] : 1; + setup[setup_count].delay = ints[0] >= 7 ? ints[7] : DELAY_DEFAULT; + setup[setup_count].ext_trans = ints[0] >= 8 ? ints[8] : 0; +- if (ints[0] > 8) { /*}*/ ++ if (ints[0] > 8) + printk(KERN_NOTICE "aha152x: usage: aha152x=<IOBASE>[,<IRQ>[,<SCSI ID>" + "[,<RECONNECT>[,<PARITY>[,<SYNCHRONOUS>[,<DELAY>[,<EXT_TRANS>]]]]]]]\n"); +- } else { ++ else + setup_count++; +- return 0; +- } + + return 1; + } +diff --git a/drivers/scsi/bfa/bfad_attr.c b/drivers/scsi/bfa/bfad_attr.c +index fbfce02e5b935..c285f401ff7b5 100644 +--- a/drivers/scsi/bfa/bfad_attr.c ++++ b/drivers/scsi/bfa/bfad_attr.c +@@ -711,7 +711,7 @@ bfad_im_serial_num_show(struct device *dev, struct device_attribute *attr, + char serial_num[BFA_ADAPTER_SERIAL_NUM_LEN]; + + bfa_get_adapter_serial_num(&bfad->bfa, serial_num); +- return snprintf(buf, PAGE_SIZE, "%s\n", serial_num); ++ return sysfs_emit(buf, "%s\n", serial_num); + } + + static ssize_t +@@ -725,7 +725,7 @@ bfad_im_model_show(struct device *dev, struct device_attribute *attr, + char model[BFA_ADAPTER_MODEL_NAME_LEN]; + + bfa_get_adapter_model(&bfad->bfa, model); +- return snprintf(buf, PAGE_SIZE, "%s\n", model); ++ return sysfs_emit(buf, "%s\n", model); + } + + static ssize_t +@@ -805,7 +805,7 @@ bfad_im_model_desc_show(struct device *dev, struct device_attribute *attr, + snprintf(model_descr, BFA_ADAPTER_MODEL_DESCR_LEN, + "Invalid Model"); + +- return snprintf(buf, PAGE_SIZE, "%s\n", model_descr); ++ return sysfs_emit(buf, "%s\n", model_descr); + } + + static ssize_t +@@ -819,7 +819,7 @@ bfad_im_node_name_show(struct device *dev, struct device_attribute *attr, + u64 nwwn; + + nwwn = bfa_fcs_lport_get_nwwn(port->fcs_port); +- return snprintf(buf, PAGE_SIZE, "0x%llx\n", cpu_to_be64(nwwn)); ++ return sysfs_emit(buf, "0x%llx\n", cpu_to_be64(nwwn)); + } + + static ssize_t +@@ -836,7 +836,7 @@ bfad_im_symbolic_name_show(struct device *dev, struct device_attribute *attr, + bfa_fcs_lport_get_attr(&bfad->bfa_fcs.fabric.bport, &port_attr); + strlcpy(symname, port_attr.port_cfg.sym_name.symname, + BFA_SYMNAME_MAXLEN); +- return snprintf(buf, PAGE_SIZE, "%s\n", symname); ++ return sysfs_emit(buf, "%s\n", symname); + } + + static ssize_t +@@ -850,14 +850,14 @@ bfad_im_hw_version_show(struct device *dev, struct device_attribute *attr, + char hw_ver[BFA_VERSION_LEN]; + + bfa_get_pci_chip_rev(&bfad->bfa, hw_ver); +- return snprintf(buf, PAGE_SIZE, "%s\n", hw_ver); ++ return sysfs_emit(buf, "%s\n", hw_ver); + } + + static ssize_t + bfad_im_drv_version_show(struct device *dev, struct device_attribute *attr, + char *buf) + { +- return snprintf(buf, PAGE_SIZE, "%s\n", BFAD_DRIVER_VERSION); ++ return sysfs_emit(buf, "%s\n", BFAD_DRIVER_VERSION); + } + + static ssize_t +@@ -871,7 +871,7 @@ bfad_im_optionrom_version_show(struct device *dev, + char optrom_ver[BFA_VERSION_LEN]; + + bfa_get_adapter_optrom_ver(&bfad->bfa, optrom_ver); +- return snprintf(buf, PAGE_SIZE, "%s\n", optrom_ver); ++ return sysfs_emit(buf, "%s\n", optrom_ver); + } + + static ssize_t +@@ -885,7 +885,7 @@ bfad_im_fw_version_show(struct device *dev, struct device_attribute *attr, + char fw_ver[BFA_VERSION_LEN]; + + bfa_get_adapter_fw_ver(&bfad->bfa, fw_ver); +- return snprintf(buf, PAGE_SIZE, "%s\n", fw_ver); ++ return sysfs_emit(buf, "%s\n", fw_ver); + } + + static ssize_t +@@ -897,7 +897,7 @@ bfad_im_num_of_ports_show(struct device *dev, struct device_attribute *attr, + (struct bfad_im_port_s *) shost->hostdata[0]; + struct bfad_s *bfad = im_port->bfad; + +- return snprintf(buf, PAGE_SIZE, "%d\n", ++ return sysfs_emit(buf, "%d\n", + bfa_get_nports(&bfad->bfa)); + } + +@@ -905,7 +905,7 @@ static ssize_t + bfad_im_drv_name_show(struct device *dev, struct device_attribute *attr, + char *buf) + { +- return snprintf(buf, PAGE_SIZE, "%s\n", BFAD_DRIVER_NAME); ++ return sysfs_emit(buf, "%s\n", BFAD_DRIVER_NAME); + } + + static ssize_t +@@ -924,14 +924,14 @@ bfad_im_num_of_discovered_ports_show(struct device *dev, + rports = kcalloc(nrports, sizeof(struct bfa_rport_qualifier_s), + GFP_ATOMIC); + if (rports == NULL) +- return snprintf(buf, PAGE_SIZE, "Failed\n"); ++ return sysfs_emit(buf, "Failed\n"); + + spin_lock_irqsave(&bfad->bfad_lock, flags); + bfa_fcs_lport_get_rport_quals(port->fcs_port, rports, &nrports); + spin_unlock_irqrestore(&bfad->bfad_lock, flags); + kfree(rports); + +- return snprintf(buf, PAGE_SIZE, "%d\n", nrports); ++ return sysfs_emit(buf, "%d\n", nrports); + } + + static DEVICE_ATTR(serial_number, S_IRUGO, +diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +index 13f314fa757e8..a86aae52d94f4 100644 +--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c ++++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +@@ -504,7 +504,7 @@ MODULE_PARM_DESC(intr_conv, "interrupt converge enable (0-1)"); + + /* permit overriding the host protection capabilities mask (EEDP/T10 PI) */ + static int prot_mask; +-module_param(prot_mask, int, 0); ++module_param(prot_mask, int, 0444); + MODULE_PARM_DESC(prot_mask, " host protection capabilities mask, def=0x0 "); + + static bool auto_affine_msi_experimental; +diff --git a/drivers/scsi/libfc/fc_exch.c b/drivers/scsi/libfc/fc_exch.c +index e5b18e5d46dac..6e2a36eeb12a7 100644 +--- a/drivers/scsi/libfc/fc_exch.c ++++ b/drivers/scsi/libfc/fc_exch.c +@@ -1697,6 +1697,7 @@ static void fc_exch_abts_resp(struct fc_exch *ep, struct fc_frame *fp) + if (cancel_delayed_work_sync(&ep->timeout_work)) { + FC_EXCH_DBG(ep, "Exchange timer canceled due to ABTS response\n"); + fc_exch_release(ep); /* release from pending timer hold */ ++ return; + } + + spin_lock_bh(&ep->ex_lock); +diff --git a/drivers/scsi/libsas/sas_ata.c b/drivers/scsi/libsas/sas_ata.c +index 5d28bb7f2ca40..5c801705c4700 100644 +--- a/drivers/scsi/libsas/sas_ata.c ++++ b/drivers/scsi/libsas/sas_ata.c +@@ -201,7 +201,7 @@ static unsigned int sas_ata_qc_issue(struct ata_queued_cmd *qc) + task->total_xfer_len = qc->nbytes; + task->num_scatter = qc->n_elem; + task->data_dir = qc->dma_dir; +- } else if (qc->tf.protocol == ATA_PROT_NODATA) { ++ } else if (!ata_is_data(qc->tf.protocol)) { + task->data_dir = DMA_NONE; + } else { + for_each_sg(qc->sg, sg, qc->n_elem, si) +diff --git a/drivers/scsi/mvsas/mv_init.c b/drivers/scsi/mvsas/mv_init.c +index 52405ce58ade8..c16d7fb0fdcbb 100644 +--- a/drivers/scsi/mvsas/mv_init.c ++++ b/drivers/scsi/mvsas/mv_init.c +@@ -697,7 +697,7 @@ static ssize_t + mvs_show_driver_version(struct device *cdev, + struct device_attribute *attr, char *buffer) + { +- return snprintf(buffer, PAGE_SIZE, "%s\n", DRV_VERSION); ++ return sysfs_emit(buffer, "%s\n", DRV_VERSION); + } + + static DEVICE_ATTR(driver_version, +@@ -749,7 +749,7 @@ mvs_store_interrupt_coalescing(struct device *cdev, + static ssize_t mvs_show_interrupt_coalescing(struct device *cdev, + struct device_attribute *attr, char *buffer) + { +- return snprintf(buffer, PAGE_SIZE, "%d\n", interrupt_coalescing); ++ return sysfs_emit(buffer, "%d\n", interrupt_coalescing); + } + + static DEVICE_ATTR(interrupt_coalescing, +diff --git a/drivers/scsi/pm8001/pm8001_hwi.c b/drivers/scsi/pm8001/pm8001_hwi.c +index 68a8217032d0f..fec653b54307a 100644 +--- a/drivers/scsi/pm8001/pm8001_hwi.c ++++ b/drivers/scsi/pm8001/pm8001_hwi.c +@@ -1750,6 +1750,7 @@ static void pm8001_send_abort_all(struct pm8001_hba_info *pm8001_ha, + ccb->device = pm8001_ha_dev; + ccb->ccb_tag = ccb_tag; + ccb->task = task; ++ ccb->n_elem = 0; + + circularQ = &pm8001_ha->inbnd_q_tbl[0]; + +@@ -1812,6 +1813,7 @@ static void pm8001_send_read_log(struct pm8001_hba_info *pm8001_ha, + ccb->device = pm8001_ha_dev; + ccb->ccb_tag = ccb_tag; + ccb->task = task; ++ ccb->n_elem = 0; + pm8001_ha_dev->id |= NCQ_READ_LOG_FLAG; + pm8001_ha_dev->id |= NCQ_2ND_RLE_FLAG; + +@@ -1828,7 +1830,7 @@ static void pm8001_send_read_log(struct pm8001_hba_info *pm8001_ha, + + sata_cmd.tag = cpu_to_le32(ccb_tag); + sata_cmd.device_id = cpu_to_le32(pm8001_ha_dev->device_id); +- sata_cmd.ncqtag_atap_dir_m |= ((0x1 << 7) | (0x5 << 9)); ++ sata_cmd.ncqtag_atap_dir_m = cpu_to_le32((0x1 << 7) | (0x5 << 9)); + memcpy(&sata_cmd.sata_fis, &fis, sizeof(struct host_to_dev_fis)); + + res = pm8001_mpi_build_cmd(pm8001_ha, circularQ, opc, &sata_cmd, 0); +@@ -3773,12 +3775,11 @@ int pm8001_mpi_task_abort_resp(struct pm8001_hba_info *pm8001_ha, void *piomb) + mb(); + + if (pm8001_dev->id & NCQ_ABORT_ALL_FLAG) { +- pm8001_tag_free(pm8001_ha, tag); + sas_free_task(t); +- /* clear the flag */ +- pm8001_dev->id &= 0xBFFFFFFF; +- } else ++ pm8001_dev->id &= ~NCQ_ABORT_ALL_FLAG; ++ } else { + t->task_done(t); ++ } + + return 0; + } +@@ -4727,7 +4728,7 @@ int pm8001_chip_ssp_tm_req(struct pm8001_hba_info *pm8001_ha, + memcpy(sspTMCmd.lun, task->ssp_task.LUN, 8); + sspTMCmd.tag = cpu_to_le32(ccb->ccb_tag); + if (pm8001_ha->chip_id != chip_8001) +- sspTMCmd.ds_ads_m = 0x08; ++ sspTMCmd.ds_ads_m = cpu_to_le32(0x08); + circularQ = &pm8001_ha->inbnd_q_tbl[0]; + ret = pm8001_mpi_build_cmd(pm8001_ha, circularQ, opc, &sspTMCmd, 0); + return ret; +diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c +index 161bf4760eac7..ce67965a504fa 100644 +--- a/drivers/scsi/pm8001/pm80xx_hwi.c ++++ b/drivers/scsi/pm8001/pm80xx_hwi.c +@@ -881,9 +881,11 @@ pm80xx_set_thermal_config(struct pm8001_hba_info *pm8001_ha) + else + page_code = THERMAL_PAGE_CODE_8H; + +- payload.cfg_pg[0] = (THERMAL_LOG_ENABLE << 9) | +- (THERMAL_ENABLE << 8) | page_code; +- payload.cfg_pg[1] = (LTEMPHIL << 24) | (RTEMPHIL << 8); ++ payload.cfg_pg[0] = ++ cpu_to_le32((THERMAL_LOG_ENABLE << 9) | ++ (THERMAL_ENABLE << 8) | page_code); ++ payload.cfg_pg[1] = ++ cpu_to_le32((LTEMPHIL << 24) | (RTEMPHIL << 8)); + + rc = pm8001_mpi_build_cmd(pm8001_ha, circularQ, opc, &payload, 0); + if (rc) +@@ -1435,6 +1437,7 @@ static void pm80xx_send_abort_all(struct pm8001_hba_info *pm8001_ha, + ccb->device = pm8001_ha_dev; + ccb->ccb_tag = ccb_tag; + ccb->task = task; ++ ccb->n_elem = 0; + + circularQ = &pm8001_ha->inbnd_q_tbl[0]; + +@@ -1516,7 +1519,7 @@ static void pm80xx_send_read_log(struct pm8001_hba_info *pm8001_ha, + + sata_cmd.tag = cpu_to_le32(ccb_tag); + sata_cmd.device_id = cpu_to_le32(pm8001_ha_dev->device_id); +- sata_cmd.ncqtag_atap_dir_m_dad |= ((0x1 << 7) | (0x5 << 9)); ++ sata_cmd.ncqtag_atap_dir_m_dad = cpu_to_le32(((0x1 << 7) | (0x5 << 9))); + memcpy(&sata_cmd.sata_fis, &fis, sizeof(struct host_to_dev_fis)); + + res = pm8001_mpi_build_cmd(pm8001_ha, circularQ, opc, &sata_cmd, 0); +diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c +index 8f85ca0112961..59f5dc9876cc5 100644 +--- a/drivers/scsi/qla2xxx/qla_attr.c ++++ b/drivers/scsi/qla2xxx/qla_attr.c +@@ -527,7 +527,7 @@ qla2x00_sysfs_read_vpd(struct file *filp, struct kobject *kobj, + if (!capable(CAP_SYS_ADMIN)) + return -EINVAL; + +- if (IS_NOCACHE_VPD_TYPE(ha)) ++ if (!IS_NOCACHE_VPD_TYPE(ha)) + goto skip; + + faddr = ha->flt_region_vpd << 2; +@@ -710,7 +710,7 @@ qla2x00_sysfs_write_reset(struct file *filp, struct kobject *kobj, + ql_log(ql_log_info, vha, 0x706f, + "Issuing MPI reset.\n"); + +- if (IS_QLA83XX(ha) || IS_QLA27XX(ha) || IS_QLA28XX(ha)) { ++ if (IS_QLA83XX(ha)) { + uint32_t idc_control; + + qla83xx_idc_lock(vha, 0); +@@ -1020,9 +1020,6 @@ qla2x00_free_sysfs_attr(scsi_qla_host_t *vha, bool stop_beacon) + continue; + if (iter->type == 3 && !(IS_CNA_CAPABLE(ha))) + continue; +- if (iter->type == 0x27 && +- (!IS_QLA27XX(ha) || !IS_QLA28XX(ha))) +- continue; + + sysfs_remove_bin_file(&host->shost_gendev.kobj, + iter->attr); +diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h +index 7c22f8eea3ead..caf28c5281aa5 100644 +--- a/drivers/scsi/qla2xxx/qla_def.h ++++ b/drivers/scsi/qla2xxx/qla_def.h +@@ -2725,7 +2725,11 @@ struct ct_fdmiv2_hba_attributes { + #define FDMI_PORT_SPEED_8GB 0x10 + #define FDMI_PORT_SPEED_16GB 0x20 + #define FDMI_PORT_SPEED_32GB 0x40 +-#define FDMI_PORT_SPEED_64GB 0x80 ++#define FDMI_PORT_SPEED_20GB 0x80 ++#define FDMI_PORT_SPEED_40GB 0x100 ++#define FDMI_PORT_SPEED_128GB 0x200 ++#define FDMI_PORT_SPEED_64GB 0x400 ++#define FDMI_PORT_SPEED_256GB 0x800 + #define FDMI_PORT_SPEED_UNKNOWN 0x8000 + + #define FC_CLASS_2 0x04 +@@ -4866,4 +4870,8 @@ struct sff_8247_a0 { + #include "qla_gbl.h" + #include "qla_dbg.h" + #include "qla_inline.h" ++ ++#define IS_SESSION_DELETED(_fcport) (_fcport->disc_state == DSC_DELETE_PEND || \ ++ _fcport->disc_state == DSC_DELETED) ++ + #endif +diff --git a/drivers/scsi/qla2xxx/qla_gs.c b/drivers/scsi/qla2xxx/qla_gs.c +index d9b5ea77fde99..e9f03370afba3 100644 +--- a/drivers/scsi/qla2xxx/qla_gs.c ++++ b/drivers/scsi/qla2xxx/qla_gs.c +@@ -675,8 +675,7 @@ qla2x00_rff_id(scsi_qla_host_t *vha, u8 type) + return (QLA_SUCCESS); + } + +- return qla_async_rffid(vha, &vha->d_id, qlt_rff_id(vha), +- FC4_TYPE_FCP_SCSI); ++ return qla_async_rffid(vha, &vha->d_id, qlt_rff_id(vha), type); + } + + static int qla_async_rffid(scsi_qla_host_t *vha, port_id_t *d_id, +@@ -726,7 +725,7 @@ static int qla_async_rffid(scsi_qla_host_t *vha, port_id_t *d_id, + /* Prepare CT arguments -- port_id, FC-4 feature, FC-4 type */ + ct_req->req.rff_id.port_id = port_id_to_be_id(*d_id); + ct_req->req.rff_id.fc4_feature = fc4feature; +- ct_req->req.rff_id.fc4_type = fc4type; /* SCSI - FCP */ ++ ct_req->req.rff_id.fc4_type = fc4type; /* SCSI-FCP or FC-NVMe */ + + sp->u.iocb_cmd.u.ctarg.req_size = RFF_ID_REQ_SIZE; + sp->u.iocb_cmd.u.ctarg.rsp_size = RFF_ID_RSP_SIZE; +diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c +index 37c1f27a76cf6..a6e24cef89a0b 100644 +--- a/drivers/scsi/qla2xxx/qla_init.c ++++ b/drivers/scsi/qla2xxx/qla_init.c +@@ -572,6 +572,14 @@ qla2x00_async_adisc(struct scsi_qla_host *vha, fc_port_t *fcport, + struct srb_iocb *lio; + int rval = QLA_FUNCTION_FAILED; + ++ if (IS_SESSION_DELETED(fcport)) { ++ ql_log(ql_log_warn, vha, 0xffff, ++ "%s: %8phC is being delete - not sending command.\n", ++ __func__, fcport->port_name); ++ fcport->flags &= ~FCF_ASYNC_ACTIVE; ++ return rval; ++ } ++ + if (!vha->flags.online || (fcport->flags & FCF_ASYNC_SENT)) + return rval; + +@@ -955,6 +963,9 @@ static void qla24xx_handle_gnl_done_event(scsi_qla_host_t *vha, + set_bit(RELOGIN_NEEDED, &vha->dpc_flags); + } + break; ++ case ISP_CFG_NL: ++ qla24xx_fcport_handle_login(vha, fcport); ++ break; + default: + break; + } +@@ -1311,14 +1322,21 @@ int qla24xx_async_gpdb(struct scsi_qla_host *vha, fc_port_t *fcport, u8 opt) + struct port_database_24xx *pd; + struct qla_hw_data *ha = vha->hw; + +- if (!vha->flags.online || (fcport->flags & FCF_ASYNC_SENT) || +- fcport->loop_id == FC_NO_LOOP_ID) { ++ if (IS_SESSION_DELETED(fcport)) { + ql_log(ql_log_warn, vha, 0xffff, +- "%s: %8phC - not sending command.\n", +- __func__, fcport->port_name); ++ "%s: %8phC is being delete - not sending command.\n", ++ __func__, fcport->port_name); ++ fcport->flags &= ~FCF_ASYNC_ACTIVE; + return rval; + } + ++ if (!vha->flags.online || fcport->flags & FCF_ASYNC_SENT) { ++ ql_log(ql_log_warn, vha, 0xffff, ++ "%s: %8phC online %d flags %x - not sending command.\n", ++ __func__, fcport->port_name, vha->flags.online, fcport->flags); ++ goto done; ++ } ++ + sp = qla2x00_get_sp(vha, fcport, GFP_KERNEL); + if (!sp) + goto done; +@@ -1477,6 +1495,11 @@ static void qla_chk_n2n_b4_login(struct scsi_qla_host *vha, fc_port_t *fcport) + u8 login = 0; + int rc; + ++ ql_dbg(ql_dbg_disc, vha, 0x307b, ++ "%s %8phC DS %d LS %d lid %d retries=%d\n", ++ __func__, fcport->port_name, fcport->disc_state, ++ fcport->fw_login_state, fcport->loop_id, fcport->login_retry); ++ + if (qla_tgt_mode_enabled(vha)) + return; + +@@ -1534,7 +1557,8 @@ int qla24xx_fcport_handle_login(struct scsi_qla_host *vha, fc_port_t *fcport) + fcport->conflict, fcport->last_rscn_gen, fcport->rscn_gen, + fcport->login_gen, fcport->loop_id, fcport->scan_state); + +- if (fcport->scan_state != QLA_FCPORT_FOUND) ++ if (fcport->scan_state != QLA_FCPORT_FOUND || ++ fcport->disc_state == DSC_DELETE_PEND) + return 0; + + if ((fcport->loop_id != FC_NO_LOOP_ID) && +@@ -1555,7 +1579,7 @@ int qla24xx_fcport_handle_login(struct scsi_qla_host *vha, fc_port_t *fcport) + if (vha->host->active_mode == MODE_TARGET) + return 0; + +- if (fcport->flags & FCF_ASYNC_SENT) { ++ if (fcport->flags & (FCF_ASYNC_SENT | FCF_ASYNC_ACTIVE)) { + set_bit(RELOGIN_NEEDED, &vha->dpc_flags); + return 0; + } +@@ -3223,6 +3247,14 @@ qla2x00_alloc_fw_dump(scsi_qla_host_t *vha) + struct rsp_que *rsp = ha->rsp_q_map[0]; + struct qla2xxx_fw_dump *fw_dump; + ++ if (ha->fw_dump) { ++ ql_dbg(ql_dbg_init, vha, 0x00bd, ++ "Firmware dump already allocated.\n"); ++ return; ++ } ++ ++ ha->fw_dumped = 0; ++ ha->fw_dump_cap_flags = 0; + dump_size = fixed_size = mem_size = eft_size = fce_size = mq_size = 0; + req_q_size = rsp_q_size = 0; + +@@ -3233,7 +3265,7 @@ qla2x00_alloc_fw_dump(scsi_qla_host_t *vha) + mem_size = (ha->fw_memory_size - 0x11000 + 1) * + sizeof(uint16_t); + } else if (IS_FWI2_CAPABLE(ha)) { +- if (IS_QLA83XX(ha) || IS_QLA27XX(ha) || IS_QLA28XX(ha)) ++ if (IS_QLA83XX(ha)) + fixed_size = offsetof(struct qla83xx_fw_dump, ext_mem); + else if (IS_QLA81XX(ha)) + fixed_size = offsetof(struct qla81xx_fw_dump, ext_mem); +@@ -3245,8 +3277,7 @@ qla2x00_alloc_fw_dump(scsi_qla_host_t *vha) + mem_size = (ha->fw_memory_size - 0x100000 + 1) * + sizeof(uint32_t); + if (ha->mqenable) { +- if (!IS_QLA83XX(ha) && !IS_QLA27XX(ha) && +- !IS_QLA28XX(ha)) ++ if (!IS_QLA83XX(ha)) + mq_size = sizeof(struct qla2xxx_mq_chain); + /* + * Allocate maximum buffer size for all queues - Q0. +@@ -3743,8 +3774,7 @@ enable_82xx_npiv: + ha->fw_major_version, ha->fw_minor_version, + ha->fw_subminor_version); + +- if (IS_QLA83XX(ha) || IS_QLA27XX(ha) || +- IS_QLA28XX(ha)) { ++ if (IS_QLA83XX(ha)) { + ha->flags.fac_supported = 0; + rval = QLA_SUCCESS; + } +@@ -5217,6 +5247,13 @@ skip_login: + memcpy(fcport->node_name, new_fcport->node_name, + WWN_SIZE); + fcport->scan_state = QLA_FCPORT_FOUND; ++ if (fcport->login_retry == 0) { ++ fcport->login_retry = vha->hw->login_retry_count; ++ ql_dbg(ql_dbg_disc, vha, 0x2135, ++ "Port login retry %8phN, lid 0x%04x retry cnt=%d.\n", ++ fcport->port_name, fcport->loop_id, ++ fcport->login_retry); ++ } + found++; + break; + } +@@ -5351,6 +5388,8 @@ qla2x00_reg_remote_port(scsi_qla_host_t *vha, fc_port_t *fcport) + if (atomic_read(&fcport->state) == FCS_ONLINE) + return; + ++ qla2x00_set_fcport_state(fcport, FCS_ONLINE); ++ + rport_ids.node_name = wwn_to_u64(fcport->node_name); + rport_ids.port_name = wwn_to_u64(fcport->port_name); + rport_ids.port_id = fcport->d_id.b.domain << 16 | +@@ -5446,6 +5485,7 @@ qla2x00_update_fcport(scsi_qla_host_t *vha, fc_port_t *fcport) + qla2x00_reg_remote_port(vha, fcport); + break; + case MODE_TARGET: ++ qla2x00_set_fcport_state(fcport, FCS_ONLINE); + if (!vha->vha_tgt.qla_tgt->tgt_stop && + !vha->vha_tgt.qla_tgt->tgt_stopped) + qlt_fc_port_added(vha, fcport); +@@ -5460,8 +5500,6 @@ qla2x00_update_fcport(scsi_qla_host_t *vha, fc_port_t *fcport) + break; + } + +- qla2x00_set_fcport_state(fcport, FCS_ONLINE); +- + if (IS_IIDMA_CAPABLE(vha->hw) && vha->hw->flags.gpsc_supported) { + if (fcport->id_changed) { + fcport->id_changed = 0; +@@ -9001,7 +9039,7 @@ struct qla_qpair *qla2xxx_create_qpair(struct scsi_qla_host *vha, int qos, + qpair->rsp->req = qpair->req; + qpair->rsp->qpair = qpair; + /* init qpair to this cpu. Will adjust at run time. */ +- qla_cpu_update(qpair, smp_processor_id()); ++ qla_cpu_update(qpair, raw_smp_processor_id()); + + if (IS_T10_PI_CAPABLE(ha) && ql2xenabledif) { + if (ha->fw_attributes & BIT_4) +diff --git a/drivers/scsi/qla2xxx/qla_iocb.c b/drivers/scsi/qla2xxx/qla_iocb.c +index 936103604d02d..103288b0377e0 100644 +--- a/drivers/scsi/qla2xxx/qla_iocb.c ++++ b/drivers/scsi/qla2xxx/qla_iocb.c +@@ -2859,6 +2859,7 @@ static void qla2x00_els_dcmd2_sp_done(srb_t *sp, int res) + set_bit(ISP_ABORT_NEEDED, + &vha->dpc_flags); + qla2xxx_wake_dpc(vha); ++ break; + } + /* fall through */ + default: +@@ -2868,9 +2869,7 @@ static void qla2x00_els_dcmd2_sp_done(srb_t *sp, int res) + fw_status[0], fw_status[1], fw_status[2]); + + fcport->flags &= ~FCF_ASYNC_SENT; +- qla2x00_set_fcport_disc_state(fcport, +- DSC_LOGIN_FAILED); +- set_bit(RELOGIN_NEEDED, &vha->dpc_flags); ++ qlt_schedule_sess_for_deletion(fcport); + break; + } + break; +@@ -2882,8 +2881,7 @@ static void qla2x00_els_dcmd2_sp_done(srb_t *sp, int res) + fw_status[0], fw_status[1], fw_status[2]); + + sp->fcport->flags &= ~FCF_ASYNC_SENT; +- qla2x00_set_fcport_disc_state(fcport, DSC_LOGIN_FAILED); +- set_bit(RELOGIN_NEEDED, &vha->dpc_flags); ++ qlt_schedule_sess_for_deletion(fcport); + break; + } + +diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c +index 3e9c5768815e5..d7cf7f9570874 100644 +--- a/drivers/scsi/qla2xxx/qla_isr.c ++++ b/drivers/scsi/qla2xxx/qla_isr.c +@@ -1839,6 +1839,7 @@ qla24xx_tm_iocb_entry(scsi_qla_host_t *vha, struct req_que *req, void *tsk) + iocb->u.tmf.data = QLA_FUNCTION_FAILED; + } else if ((le16_to_cpu(sts->scsi_status) & + SS_RESPONSE_INFO_LEN_VALID)) { ++ host_to_fcp_swap(sts->data, sizeof(sts->data)); + if (le32_to_cpu(sts->rsp_data_len) < 4) { + ql_log(ql_log_warn, fcport->vha, 0x503b, + "Async-%s error - hdl=%x not enough response(%d).\n", +diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c +index 098388a12febc..29f2730fbf66a 100644 +--- a/drivers/scsi/qla2xxx/qla_mbx.c ++++ b/drivers/scsi/qla2xxx/qla_mbx.c +@@ -10,6 +10,12 @@ + #include <linux/delay.h> + #include <linux/gfp.h> + ++#ifdef CONFIG_PPC ++#define IS_PPCARCH true ++#else ++#define IS_PPCARCH false ++#endif ++ + static struct mb_cmd_name { + uint16_t cmd; + const char *str; +@@ -731,6 +737,9 @@ qla2x00_execute_fw(scsi_qla_host_t *vha, uint32_t risc_addr) + vha->min_supported_speed = + nv->min_supported_speed; + } ++ ++ if (IS_PPCARCH) ++ mcp->mb[11] |= BIT_4; + } + + if (ha->flags.exlogins_enabled) +@@ -2897,8 +2906,7 @@ qla2x00_get_resource_cnts(scsi_qla_host_t *vha) + ha->orig_fw_iocb_count = mcp->mb[10]; + if (ha->flags.npiv_supported) + ha->max_npiv_vports = mcp->mb[11]; +- if (IS_QLA81XX(ha) || IS_QLA83XX(ha) || IS_QLA27XX(ha) || +- IS_QLA28XX(ha)) ++ if (IS_QLA81XX(ha) || IS_QLA83XX(ha)) + ha->fw_max_fcf_count = mcp->mb[12]; + } + +@@ -5391,7 +5399,7 @@ qla2x00_get_data_rate(scsi_qla_host_t *vha) + mcp->out_mb = MBX_1|MBX_0; + mcp->in_mb = MBX_2|MBX_1|MBX_0; + if (IS_QLA83XX(ha) || IS_QLA27XX(ha) || IS_QLA28XX(ha)) +- mcp->in_mb |= MBX_3; ++ mcp->in_mb |= MBX_4|MBX_3; + mcp->tov = MBX_TOV_SECONDS; + mcp->flags = 0; + rval = qla2x00_mailbox_command(vha, mcp); +diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c +index 97453c12b7358..a15af048cd820 100644 +--- a/drivers/scsi/qla2xxx/qla_nvme.c ++++ b/drivers/scsi/qla2xxx/qla_nvme.c +@@ -36,6 +36,11 @@ int qla_nvme_register_remote(struct scsi_qla_host *vha, struct fc_port *fcport) + (fcport->nvme_flag & NVME_FLAG_REGISTERED)) + return 0; + ++ if (atomic_read(&fcport->state) == FCS_ONLINE) ++ return 0; ++ ++ qla2x00_set_fcport_state(fcport, FCS_ONLINE); ++ + fcport->nvme_flag &= ~NVME_FLAG_RESETTING; + + memset(&req, 0, sizeof(struct nvme_fc_port_info)); +@@ -152,6 +157,18 @@ out: + qla2xxx_rel_qpair_sp(sp->qpair, sp); + } + ++static void qla_nvme_ls_unmap(struct srb *sp, struct nvmefc_ls_req *fd) ++{ ++ if (sp->flags & SRB_DMA_VALID) { ++ struct srb_iocb *nvme = &sp->u.iocb_cmd; ++ struct qla_hw_data *ha = sp->fcport->vha->hw; ++ ++ dma_unmap_single(&ha->pdev->dev, nvme->u.nvme.cmd_dma, ++ fd->rqstlen, DMA_TO_DEVICE); ++ sp->flags &= ~SRB_DMA_VALID; ++ } ++} ++ + static void qla_nvme_release_ls_cmd_kref(struct kref *kref) + { + struct srb *sp = container_of(kref, struct srb, cmd_kref); +@@ -168,6 +185,8 @@ static void qla_nvme_release_ls_cmd_kref(struct kref *kref) + spin_unlock_irqrestore(&priv->cmd_lock, flags); + + fd = priv->fd; ++ ++ qla_nvme_ls_unmap(sp, fd); + fd->done(fd, priv->comp_status); + out: + qla2x00_rel_sp(sp); +@@ -314,6 +333,8 @@ static int qla_nvme_ls_req(struct nvme_fc_local_port *lport, + dma_sync_single_for_device(&ha->pdev->dev, nvme->u.nvme.cmd_dma, + fd->rqstlen, DMA_TO_DEVICE); + ++ sp->flags |= SRB_DMA_VALID; ++ + rval = qla2x00_start_sp(sp); + if (rval != QLA_SUCCESS) { + ql_log(ql_log_warn, vha, 0x700e, +@@ -321,6 +342,7 @@ static int qla_nvme_ls_req(struct nvme_fc_local_port *lport, + wake_up(&sp->nvme_ls_waitq); + sp->priv = NULL; + priv->sp = NULL; ++ qla_nvme_ls_unmap(sp, fd); + qla2x00_rel_sp(sp); + return rval; + } +diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c +index c1d4c964b0dd4..a5dbaa3491f82 100644 +--- a/drivers/scsi/qla2xxx/qla_os.c ++++ b/drivers/scsi/qla2xxx/qla_os.c +@@ -3627,8 +3627,7 @@ qla2x00_unmap_iobases(struct qla_hw_data *ha) + if (ha->mqiobase) + iounmap(ha->mqiobase); + +- if ((IS_QLA83XX(ha) || IS_QLA27XX(ha) || IS_QLA28XX(ha)) && +- ha->msixbase) ++ if (ha->msixbase) + iounmap(ha->msixbase); + } + } +@@ -5348,6 +5347,11 @@ void qla2x00_relogin(struct scsi_qla_host *vha) + memset(&ea, 0, sizeof(ea)); + ea.fcport = fcport; + qla24xx_handle_relogin_event(vha, &ea); ++ } else if (vha->hw->current_topology == ++ ISP_CFG_NL && ++ IS_QLA2XXX_MIDTYPE(vha->hw)) { ++ (void)qla24xx_fcport_handle_login(vha, ++ fcport); + } else if (vha->hw->current_topology == + ISP_CFG_NL) { + fcport->login_retry--; +diff --git a/drivers/scsi/qla2xxx/qla_sup.c b/drivers/scsi/qla2xxx/qla_sup.c +index bbe90354f49b0..d306f3ca0f3bf 100644 +--- a/drivers/scsi/qla2xxx/qla_sup.c ++++ b/drivers/scsi/qla2xxx/qla_sup.c +@@ -843,7 +843,7 @@ qla2xxx_get_flt_info(scsi_qla_host_t *vha, uint32_t flt_addr) + ha->flt_region_nvram = start; + break; + case FLT_REG_IMG_PRI_27XX: +- if (IS_QLA27XX(ha) && !IS_QLA28XX(ha)) ++ if (IS_QLA27XX(ha) || IS_QLA28XX(ha)) + ha->flt_region_img_status_pri = start; + break; + case FLT_REG_IMG_SEC_27XX: +@@ -1355,7 +1355,7 @@ next: + flash_data_addr(ha, faddr), cpu_to_le32(*dwptr)); + if (ret) { + ql_dbg(ql_dbg_user, vha, 0x7006, +- "Failed slopw write %x (%x)\n", faddr, *dwptr); ++ "Failed slow write %x (%x)\n", faddr, *dwptr); + break; + } + } +diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c +index 0111c543f0e64..df598c377161d 100644 +--- a/drivers/scsi/qla2xxx/qla_target.c ++++ b/drivers/scsi/qla2xxx/qla_target.c +@@ -3251,6 +3251,7 @@ int qlt_xmit_response(struct qla_tgt_cmd *cmd, int xmit_type, + "RESET-RSP online/active/old-count/new-count = %d/%d/%d/%d.\n", + vha->flags.online, qla2x00_reset_active(vha), + cmd->reset_count, qpair->chip_reset); ++ res = 0; + goto out_unmap_unlock; + } + +@@ -7083,8 +7084,7 @@ qlt_probe_one_stage1(struct scsi_qla_host *base_vha, struct qla_hw_data *ha) + if (!QLA_TGT_MODE_ENABLED()) + return; + +- if ((ql2xenablemsix == 0) || IS_QLA83XX(ha) || IS_QLA27XX(ha) || +- IS_QLA28XX(ha)) { ++ if (ha->mqenable || IS_QLA83XX(ha) || IS_QLA27XX(ha) || IS_QLA28XX(ha)) { + ISP_ATIO_Q_IN(base_vha) = &ha->mqiobase->isp25mq.atio_q_in; + ISP_ATIO_Q_OUT(base_vha) = &ha->mqiobase->isp25mq.atio_q_out; + } else { +diff --git a/drivers/scsi/zorro7xx.c b/drivers/scsi/zorro7xx.c +index 27b9e2baab1a6..7acf9193a9e80 100644 +--- a/drivers/scsi/zorro7xx.c ++++ b/drivers/scsi/zorro7xx.c +@@ -159,6 +159,8 @@ static void zorro7xx_remove_one(struct zorro_dev *z) + scsi_remove_host(host); + + NCR_700_release(host); ++ if (host->base > 0x01000000) ++ iounmap(hostdata->base); + kfree(hostdata); + free_irq(host->irq, host); + zorro_release_device(z); +diff --git a/drivers/soc/qcom/qcom_aoss.c b/drivers/soc/qcom/qcom_aoss.c +index 45c5aa712edac..f16d6ec780644 100644 +--- a/drivers/soc/qcom/qcom_aoss.c ++++ b/drivers/soc/qcom/qcom_aoss.c +@@ -544,7 +544,7 @@ static int qmp_probe(struct platform_device *pdev) + } + + irq = platform_get_irq(pdev, 0); +- ret = devm_request_irq(&pdev->dev, irq, qmp_intr, IRQF_ONESHOT, ++ ret = devm_request_irq(&pdev->dev, irq, qmp_intr, 0, + "aoss-qmp", qmp); + if (ret < 0) { + dev_err(&pdev->dev, "failed to request interrupt\n"); +diff --git a/drivers/soc/qcom/rpmpd.c b/drivers/soc/qcom/rpmpd.c +index 3c1a55cf25d62..4715acfecff49 100644 +--- a/drivers/soc/qcom/rpmpd.c ++++ b/drivers/soc/qcom/rpmpd.c +@@ -362,6 +362,9 @@ static int rpmpd_probe(struct platform_device *pdev) + + data->domains = devm_kcalloc(&pdev->dev, num, sizeof(*data->domains), + GFP_KERNEL); ++ if (!data->domains) ++ return -ENOMEM; ++ + data->num_domains = num; + + for (i = 0; i < num; i++) { +diff --git a/drivers/soc/ti/wkup_m3_ipc.c b/drivers/soc/ti/wkup_m3_ipc.c +index e9ece45d7a333..ef3f95fefab58 100644 +--- a/drivers/soc/ti/wkup_m3_ipc.c ++++ b/drivers/soc/ti/wkup_m3_ipc.c +@@ -447,9 +447,9 @@ static int wkup_m3_ipc_probe(struct platform_device *pdev) + } + + irq = platform_get_irq(pdev, 0); +- if (!irq) { ++ if (irq < 0) { + dev_err(&pdev->dev, "no irq resource\n"); +- return -ENXIO; ++ return irq; + } + + ret = devm_request_irq(dev, irq, wkup_m3_txev_handler, +diff --git a/drivers/spi/spi-bcm-qspi.c b/drivers/spi/spi-bcm-qspi.c +index 3755be04346a6..d933a6eda5fdc 100644 +--- a/drivers/spi/spi-bcm-qspi.c ++++ b/drivers/spi/spi-bcm-qspi.c +@@ -960,7 +960,7 @@ static int bcm_qspi_exec_mem_op(struct spi_mem *mem, + addr = op->addr.val; + len = op->data.nbytes; + +- if (bcm_qspi_bspi_ver_three(qspi) == true) { ++ if (has_bspi(qspi) && bcm_qspi_bspi_ver_three(qspi) == true) { + /* + * The address coming into this function is a raw flash offset. + * But for BSPI <= V3, we need to convert it to a remapped BSPI +@@ -979,7 +979,7 @@ static int bcm_qspi_exec_mem_op(struct spi_mem *mem, + len < 4) + mspi_read = true; + +- if (mspi_read) ++ if (!has_bspi(qspi) || mspi_read) + return bcm_qspi_mspi_exec_mem_op(spi, op); + + ret = bcm_qspi_bspi_set_mode(qspi, op, 0); +diff --git a/drivers/spi/spi-mxic.c b/drivers/spi/spi-mxic.c +index eba706d5671e2..d0b5db88cd164 100644 +--- a/drivers/spi/spi-mxic.c ++++ b/drivers/spi/spi-mxic.c +@@ -304,25 +304,21 @@ static int mxic_spi_data_xfer(struct mxic_spi *mxic, const void *txbuf, + + writel(data, mxic->regs + TXD(nbytes % 4)); + ++ ret = readl_poll_timeout(mxic->regs + INT_STS, sts, ++ sts & INT_TX_EMPTY, 0, USEC_PER_SEC); ++ if (ret) ++ return ret; ++ ++ ret = readl_poll_timeout(mxic->regs + INT_STS, sts, ++ sts & INT_RX_NOT_EMPTY, 0, ++ USEC_PER_SEC); ++ if (ret) ++ return ret; ++ ++ data = readl(mxic->regs + RXD); + if (rxbuf) { +- ret = readl_poll_timeout(mxic->regs + INT_STS, sts, +- sts & INT_TX_EMPTY, 0, +- USEC_PER_SEC); +- if (ret) +- return ret; +- +- ret = readl_poll_timeout(mxic->regs + INT_STS, sts, +- sts & INT_RX_NOT_EMPTY, 0, +- USEC_PER_SEC); +- if (ret) +- return ret; +- +- data = readl(mxic->regs + RXD); + data >>= (8 * (4 - nbytes)); + memcpy(rxbuf + pos, &data, nbytes); +- WARN_ON(readl(mxic->regs + INT_STS) & INT_RX_NOT_EMPTY); +- } else { +- readl(mxic->regs + RXD); + } + WARN_ON(readl(mxic->regs + INT_STS) & INT_RX_NOT_EMPTY); + +diff --git a/drivers/spi/spi-pxa2xx-pci.c b/drivers/spi/spi-pxa2xx-pci.c +index aafac128bb5f1..4eb979a096c78 100644 +--- a/drivers/spi/spi-pxa2xx-pci.c ++++ b/drivers/spi/spi-pxa2xx-pci.c +@@ -74,14 +74,23 @@ static bool lpss_dma_filter(struct dma_chan *chan, void *param) + return true; + } + ++static void lpss_dma_put_device(void *dma_dev) ++{ ++ pci_dev_put(dma_dev); ++} ++ + static int lpss_spi_setup(struct pci_dev *dev, struct pxa_spi_info *c) + { + struct pci_dev *dma_dev; ++ int ret; + + c->num_chipselect = 1; + c->max_clk_rate = 50000000; + + dma_dev = pci_get_slot(dev->bus, PCI_DEVFN(PCI_SLOT(dev->devfn), 0)); ++ ret = devm_add_action_or_reset(&dev->dev, lpss_dma_put_device, dma_dev); ++ if (ret) ++ return ret; + + if (c->tx_param) { + struct dw_dma_slave *slave = c->tx_param; +@@ -105,8 +114,9 @@ static int lpss_spi_setup(struct pci_dev *dev, struct pxa_spi_info *c) + + static int mrfld_spi_setup(struct pci_dev *dev, struct pxa_spi_info *c) + { +- struct pci_dev *dma_dev = pci_get_slot(dev->bus, PCI_DEVFN(21, 0)); + struct dw_dma_slave *tx, *rx; ++ struct pci_dev *dma_dev; ++ int ret; + + switch (PCI_FUNC(dev->devfn)) { + case 0: +@@ -131,6 +141,11 @@ static int mrfld_spi_setup(struct pci_dev *dev, struct pxa_spi_info *c) + return -ENODEV; + } + ++ dma_dev = pci_get_slot(dev->bus, PCI_DEVFN(21, 0)); ++ ret = devm_add_action_or_reset(&dev->dev, lpss_dma_put_device, dma_dev); ++ if (ret) ++ return ret; ++ + tx = c->tx_param; + tx->dma_dev = &dma_dev->dev; + +diff --git a/drivers/spi/spi-tegra114.c b/drivers/spi/spi-tegra114.c +index 594905bf89aa8..3f7a64b2a5d06 100644 +--- a/drivers/spi/spi-tegra114.c ++++ b/drivers/spi/spi-tegra114.c +@@ -1352,6 +1352,10 @@ static int tegra_spi_probe(struct platform_device *pdev) + tspi->phys = r->start; + + spi_irq = platform_get_irq(pdev, 0); ++ if (spi_irq < 0) { ++ ret = spi_irq; ++ goto exit_free_master; ++ } + tspi->irq = spi_irq; + + tspi->clk = devm_clk_get(&pdev->dev, "spi"); +diff --git a/drivers/spi/spi-tegra20-slink.c b/drivers/spi/spi-tegra20-slink.c +index 9b59539c87359..e6b12f78c8f01 100644 +--- a/drivers/spi/spi-tegra20-slink.c ++++ b/drivers/spi/spi-tegra20-slink.c +@@ -1011,14 +1011,8 @@ static int tegra_slink_probe(struct platform_device *pdev) + struct resource *r; + int ret, spi_irq; + const struct tegra_slink_chip_data *cdata = NULL; +- const struct of_device_id *match; + +- match = of_match_device(tegra_slink_of_match, &pdev->dev); +- if (!match) { +- dev_err(&pdev->dev, "Error: No device match found\n"); +- return -ENODEV; +- } +- cdata = match->data; ++ cdata = of_device_get_match_data(&pdev->dev); + + master = spi_alloc_master(&pdev->dev, sizeof(*tspi)); + if (!master) { +diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c +index ac05c9c864884..b18ae50db1f52 100644 +--- a/drivers/spi/spi.c ++++ b/drivers/spi/spi.c +@@ -844,10 +844,10 @@ int spi_map_buf(struct spi_controller *ctlr, struct device *dev, + int i, ret; + + if (vmalloced_buf || kmap_buf) { +- desc_len = min_t(int, max_seg_size, PAGE_SIZE); ++ desc_len = min_t(unsigned long, max_seg_size, PAGE_SIZE); + sgs = DIV_ROUND_UP(len + offset_in_page(buf), desc_len); + } else if (virt_addr_valid(buf)) { +- desc_len = min_t(int, max_seg_size, ctlr->max_dma_len); ++ desc_len = min_t(size_t, max_seg_size, ctlr->max_dma_len); + sgs = DIV_ROUND_UP(len, desc_len); + } else { + return -EINVAL; +diff --git a/drivers/staging/iio/adc/ad7280a.c b/drivers/staging/iio/adc/ad7280a.c +index 19a5f244dcae2..d8886c5c0d1f2 100644 +--- a/drivers/staging/iio/adc/ad7280a.c ++++ b/drivers/staging/iio/adc/ad7280a.c +@@ -107,9 +107,9 @@ + static unsigned int ad7280a_devaddr(unsigned int addr) + { + return ((addr & 0x1) << 4) | +- ((addr & 0x2) << 3) | ++ ((addr & 0x2) << 2) | + (addr & 0x4) | +- ((addr & 0x8) >> 3) | ++ ((addr & 0x8) >> 2) | + ((addr & 0x10) >> 4); + } + +diff --git a/drivers/staging/media/hantro/hantro_h1_jpeg_enc.c b/drivers/staging/media/hantro/hantro_h1_jpeg_enc.c +index 8b76f1f13b062..e81a354b88720 100644 +--- a/drivers/staging/media/hantro/hantro_h1_jpeg_enc.c ++++ b/drivers/staging/media/hantro/hantro_h1_jpeg_enc.c +@@ -23,7 +23,7 @@ static void hantro_h1_set_src_img_ctrl(struct hantro_dev *vpu, + + reg = H1_REG_IN_IMG_CTRL_ROW_LEN(pix_fmt->width) + | H1_REG_IN_IMG_CTRL_OVRFLR_D4(0) +- | H1_REG_IN_IMG_CTRL_OVRFLB_D4(0) ++ | H1_REG_IN_IMG_CTRL_OVRFLB(0) + | H1_REG_IN_IMG_CTRL_FMT(ctx->vpu_src_fmt->enc_fmt); + vepu_write_relaxed(vpu, reg, H1_REG_IN_IMG_CTRL); + } +diff --git a/drivers/staging/media/hantro/hantro_h1_regs.h b/drivers/staging/media/hantro/hantro_h1_regs.h +index d6e9825bb5c7b..30e7e7b920b55 100644 +--- a/drivers/staging/media/hantro/hantro_h1_regs.h ++++ b/drivers/staging/media/hantro/hantro_h1_regs.h +@@ -47,7 +47,7 @@ + #define H1_REG_IN_IMG_CTRL 0x03c + #define H1_REG_IN_IMG_CTRL_ROW_LEN(x) ((x) << 12) + #define H1_REG_IN_IMG_CTRL_OVRFLR_D4(x) ((x) << 10) +-#define H1_REG_IN_IMG_CTRL_OVRFLB_D4(x) ((x) << 6) ++#define H1_REG_IN_IMG_CTRL_OVRFLB(x) ((x) << 6) + #define H1_REG_IN_IMG_CTRL_FMT(x) ((x) << 2) + #define H1_REG_ENC_CTRL0 0x040 + #define H1_REG_ENC_CTRL0_INIT_QP(x) ((x) << 26) +diff --git a/drivers/staging/mt7621-dts/gbpc1.dts b/drivers/staging/mt7621-dts/gbpc1.dts +index 1fb560ff059c8..1713283e60d4e 100644 +--- a/drivers/staging/mt7621-dts/gbpc1.dts ++++ b/drivers/staging/mt7621-dts/gbpc1.dts +@@ -11,7 +11,8 @@ + + memory@0 { + device_type = "memory"; +- reg = <0x0 0x1c000000>, <0x20000000 0x4000000>; ++ reg = <0x00000000 0x1c000000>, ++ <0x20000000 0x04000000>; + }; + + chosen { +@@ -37,24 +38,16 @@ + gpio-leds { + compatible = "gpio-leds"; + +- system { +- label = "gb-pc1:green:system"; ++ power { ++ label = "green:power"; + gpios = <&gpio 6 GPIO_ACTIVE_LOW>; ++ linux,default-trigger = "default-on"; + }; + +- status { +- label = "gb-pc1:green:status"; ++ system { ++ label = "green:system"; + gpios = <&gpio 8 GPIO_ACTIVE_LOW>; +- }; +- +- lan1 { +- label = "gb-pc1:green:lan1"; +- gpios = <&gpio 24 GPIO_ACTIVE_LOW>; +- }; +- +- lan2 { +- label = "gb-pc1:green:lan2"; +- gpios = <&gpio 25 GPIO_ACTIVE_LOW>; ++ linux,default-trigger = "disk-activity"; + }; + }; + }; +@@ -94,9 +87,8 @@ + + partition@50000 { + label = "firmware"; +- reg = <0x50000 0x1FB0000>; ++ reg = <0x50000 0x1fb0000>; + }; +- + }; + }; + +@@ -118,9 +110,12 @@ + }; + + &pinctrl { +- state_default: pinctrl0 { +- default_gpio: gpio { +- groups = "wdt", "rgmii2", "uart3"; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&state_default>; ++ ++ state_default: state-default { ++ gpio-pinmux { ++ groups = "rgmii2", "uart3", "wdt"; + function = "gpio"; + }; + }; +@@ -129,12 +124,13 @@ + &switch0 { + ports { + port@0 { ++ status = "okay"; + label = "ethblack"; +- status = "ok"; + }; ++ + port@4 { ++ status = "okay"; + label = "ethblue"; +- status = "ok"; + }; + }; + }; +diff --git a/drivers/thermal/intel/int340x_thermal/int3400_thermal.c b/drivers/thermal/intel/int340x_thermal/int3400_thermal.c +index a31163547fbaa..3a1a28a79d463 100644 +--- a/drivers/thermal/intel/int340x_thermal/int3400_thermal.c ++++ b/drivers/thermal/intel/int340x_thermal/int3400_thermal.c +@@ -49,7 +49,7 @@ struct int3400_thermal_priv { + struct art *arts; + int trt_count; + struct trt *trts; +- u8 uuid_bitmap; ++ u32 uuid_bitmap; + int rel_misc_dev_res; + int current_uuid_index; + }; +diff --git a/drivers/tty/hvc/hvc_iucv.c b/drivers/tty/hvc/hvc_iucv.c +index 2af1e5751bd63..796fbff623f6e 100644 +--- a/drivers/tty/hvc/hvc_iucv.c ++++ b/drivers/tty/hvc/hvc_iucv.c +@@ -1470,7 +1470,9 @@ out_error: + */ + static int __init hvc_iucv_config(char *val) + { +- return kstrtoul(val, 10, &hvc_iucv_devices); ++ if (kstrtoul(val, 10, &hvc_iucv_devices)) ++ pr_warn("hvc_iucv= invalid parameter value '%s'\n", val); ++ return 1; + } + + +diff --git a/drivers/tty/mxser.c b/drivers/tty/mxser.c +index 9d00ff5ef9611..085dc8dd1327b 100644 +--- a/drivers/tty/mxser.c ++++ b/drivers/tty/mxser.c +@@ -861,6 +861,7 @@ static int mxser_activate(struct tty_port *port, struct tty_struct *tty) + struct mxser_port *info = container_of(port, struct mxser_port, port); + unsigned long page; + unsigned long flags; ++ int ret; + + page = __get_free_page(GFP_KERNEL); + if (!page) +@@ -870,9 +871,9 @@ static int mxser_activate(struct tty_port *port, struct tty_struct *tty) + + if (!info->ioaddr || !info->type) { + set_bit(TTY_IO_ERROR, &tty->flags); +- free_page(page); + spin_unlock_irqrestore(&info->slock, flags); +- return 0; ++ ret = 0; ++ goto err_free_xmit; + } + info->port.xmit_buf = (unsigned char *) page; + +@@ -898,8 +899,10 @@ static int mxser_activate(struct tty_port *port, struct tty_struct *tty) + if (capable(CAP_SYS_ADMIN)) { + set_bit(TTY_IO_ERROR, &tty->flags); + return 0; +- } else +- return -ENODEV; ++ } ++ ++ ret = -ENODEV; ++ goto err_free_xmit; + } + + /* +@@ -944,6 +947,10 @@ static int mxser_activate(struct tty_port *port, struct tty_struct *tty) + spin_unlock_irqrestore(&info->slock, flags); + + return 0; ++err_free_xmit: ++ free_page(page); ++ info->port.xmit_buf = NULL; ++ return ret; + } + + /* +diff --git a/drivers/tty/serial/8250/8250_mid.c b/drivers/tty/serial/8250/8250_mid.c +index efa0515139f8e..e6c1791609ddf 100644 +--- a/drivers/tty/serial/8250/8250_mid.c ++++ b/drivers/tty/serial/8250/8250_mid.c +@@ -73,6 +73,11 @@ static int pnw_setup(struct mid8250 *mid, struct uart_port *p) + return 0; + } + ++static void pnw_exit(struct mid8250 *mid) ++{ ++ pci_dev_put(mid->dma_dev); ++} ++ + static int tng_handle_irq(struct uart_port *p) + { + struct mid8250 *mid = p->private_data; +@@ -124,6 +129,11 @@ static int tng_setup(struct mid8250 *mid, struct uart_port *p) + return 0; + } + ++static void tng_exit(struct mid8250 *mid) ++{ ++ pci_dev_put(mid->dma_dev); ++} ++ + static int dnv_handle_irq(struct uart_port *p) + { + struct mid8250 *mid = p->private_data; +@@ -330,9 +340,9 @@ static int mid8250_probe(struct pci_dev *pdev, const struct pci_device_id *id) + + pci_set_drvdata(pdev, mid); + return 0; ++ + err: +- if (mid->board->exit) +- mid->board->exit(mid); ++ mid->board->exit(mid); + return ret; + } + +@@ -342,8 +352,7 @@ static void mid8250_remove(struct pci_dev *pdev) + + serial8250_unregister_port(mid->line); + +- if (mid->board->exit) +- mid->board->exit(mid); ++ mid->board->exit(mid); + } + + static const struct mid8250_board pnw_board = { +@@ -351,6 +360,7 @@ static const struct mid8250_board pnw_board = { + .freq = 50000000, + .base_baud = 115200, + .setup = pnw_setup, ++ .exit = pnw_exit, + }; + + static const struct mid8250_board tng_board = { +@@ -358,6 +368,7 @@ static const struct mid8250_board tng_board = { + .freq = 38400000, + .base_baud = 1843200, + .setup = tng_setup, ++ .exit = tng_exit, + }; + + static const struct mid8250_board dnv_board = { +diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c +index 777ef1a9591c0..87567515591e1 100644 +--- a/drivers/tty/serial/8250/8250_port.c ++++ b/drivers/tty/serial/8250/8250_port.c +@@ -1545,6 +1545,18 @@ static inline void start_tx_rs485(struct uart_port *port) + if (!(up->port.rs485.flags & SER_RS485_RX_DURING_TX)) + serial8250_stop_rx(&up->port); + ++ /* ++ * While serial8250_em485_handle_stop_tx() is a noop if ++ * em485->active_timer != &em485->stop_tx_timer, it might happen that ++ * the timer is still armed and triggers only after the current bunch of ++ * chars is send and em485->active_timer == &em485->stop_tx_timer again. ++ * So cancel the timer. There is still a theoretical race condition if ++ * the timer is already running and only comes around to check for ++ * em485->active_timer when &em485->stop_tx_timer is armed again. ++ */ ++ if (em485->active_timer == &em485->stop_tx_timer) ++ hrtimer_try_to_cancel(&em485->stop_tx_timer); ++ + em485->active_timer = NULL; + + mcr = serial8250_in_MCR(up); +diff --git a/drivers/tty/serial/kgdboc.c b/drivers/tty/serial/kgdboc.c +index f5608ad68ae1a..6d4792ec9e5fa 100644 +--- a/drivers/tty/serial/kgdboc.c ++++ b/drivers/tty/serial/kgdboc.c +@@ -391,16 +391,16 @@ static int kgdboc_option_setup(char *opt) + { + if (!opt) { + pr_err("config string not provided\n"); +- return -EINVAL; ++ return 1; + } + + if (strlen(opt) >= MAX_CONFIG_LEN) { + pr_err("config string too long\n"); +- return -ENOSPC; ++ return 1; + } + strcpy(config, opt); + +- return 0; ++ return 1; + } + + __setup("kgdboc=", kgdboc_option_setup); +diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c +index c7683beb3412a..6040d5a6139ab 100644 +--- a/drivers/tty/serial/samsung.c ++++ b/drivers/tty/serial/samsung.c +@@ -761,11 +761,8 @@ static irqreturn_t s3c24xx_serial_tx_chars(int irq, void *id) + goto out; + } + +- if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS) { +- spin_unlock(&port->lock); ++ if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS) + uart_write_wakeup(port); +- spin_lock(&port->lock); +- } + + if (uart_circ_empty(xmit)) + s3c24xx_serial_stop_tx(port); +diff --git a/drivers/usb/dwc3/dwc3-omap.c b/drivers/usb/dwc3/dwc3-omap.c +index e8acad49a53a8..81ee1cd794f7d 100644 +--- a/drivers/usb/dwc3/dwc3-omap.c ++++ b/drivers/usb/dwc3/dwc3-omap.c +@@ -242,7 +242,7 @@ static void dwc3_omap_set_mailbox(struct dwc3_omap *omap, + break; + + case OMAP_DWC3_ID_FLOAT: +- if (omap->vbus_reg) ++ if (omap->vbus_reg && regulator_is_enabled(omap->vbus_reg)) + regulator_disable(omap->vbus_reg); + val = dwc3_omap_read_utmi_ctrl(omap); + val |= USBOTGSS_UTMI_OTG_CTRL_IDDIG; +diff --git a/drivers/usb/host/ehci-pci.c b/drivers/usb/host/ehci-pci.c +index 774ccaa5aceea..1962140a59f20 100644 +--- a/drivers/usb/host/ehci-pci.c ++++ b/drivers/usb/host/ehci-pci.c +@@ -21,6 +21,9 @@ static const char hcd_name[] = "ehci-pci"; + /* defined here to avoid adding to pci_ids.h for single instance use */ + #define PCI_DEVICE_ID_INTEL_CE4100_USB 0x2e70 + ++#define PCI_VENDOR_ID_ASPEED 0x1a03 ++#define PCI_DEVICE_ID_ASPEED_EHCI 0x2603 ++ + /*-------------------------------------------------------------------------*/ + #define PCI_DEVICE_ID_INTEL_QUARK_X1000_SOC 0x0939 + static inline bool is_intel_quark_x1000(struct pci_dev *pdev) +@@ -223,6 +226,12 @@ static int ehci_pci_setup(struct usb_hcd *hcd) + ehci->has_synopsys_hc_bug = 1; + } + break; ++ case PCI_VENDOR_ID_ASPEED: ++ if (pdev->device == PCI_DEVICE_ID_ASPEED_EHCI) { ++ ehci_info(ehci, "applying Aspeed HC workaround\n"); ++ ehci->is_aspeed = 1; ++ } ++ break; + } + + /* optional debug port, normally in the first BAR */ +diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c +index 48832f7f2fc3c..db65e1ad00deb 100644 +--- a/drivers/usb/host/xhci-hub.c ++++ b/drivers/usb/host/xhci-hub.c +@@ -674,7 +674,7 @@ static int xhci_exit_test_mode(struct xhci_hcd *xhci) + } + pm_runtime_allow(xhci_to_hcd(xhci)->self.controller); + xhci->test_mode = 0; +- return xhci_reset(xhci); ++ return xhci_reset(xhci, XHCI_RESET_SHORT_USEC); + } + + void xhci_set_link_state(struct xhci_hcd *xhci, struct xhci_port *port, +@@ -1000,6 +1000,9 @@ static void xhci_get_usb2_port_status(struct xhci_port *port, u32 *status, + if (link_state == XDEV_U2) + *status |= USB_PORT_STAT_L1; + if (link_state == XDEV_U0) { ++ if (bus_state->resume_done[portnum]) ++ usb_hcd_end_port_resume(&port->rhub->hcd->self, ++ portnum); + bus_state->resume_done[portnum] = 0; + clear_bit(portnum, &bus_state->resuming_ports); + if (bus_state->suspended_ports & (1 << portnum)) { +diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c +index 160caef09c5ea..ef23a69c6553a 100644 +--- a/drivers/usb/host/xhci-mem.c ++++ b/drivers/usb/host/xhci-mem.c +@@ -2583,7 +2583,7 @@ int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags) + + fail: + xhci_halt(xhci); +- xhci_reset(xhci); ++ xhci_reset(xhci, XHCI_RESET_SHORT_USEC); + xhci_mem_cleanup(xhci); + return -ENOMEM; + } +diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c +index 8f029d44e9c9e..476dc6abd5a21 100644 +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -66,7 +66,7 @@ static bool td_on_ring(struct xhci_td *td, struct xhci_ring *ring) + * handshake done). There are two failure modes: "usec" have passed (major + * hardware flakeout), or the register reads as all-ones (hardware removed). + */ +-int xhci_handshake(void __iomem *ptr, u32 mask, u32 done, int usec) ++int xhci_handshake(void __iomem *ptr, u32 mask, u32 done, u64 timeout_us) + { + u32 result; + int ret; +@@ -74,7 +74,7 @@ int xhci_handshake(void __iomem *ptr, u32 mask, u32 done, int usec) + ret = readl_poll_timeout_atomic(ptr, result, + (result & mask) == done || + result == U32_MAX, +- 1, usec); ++ 1, timeout_us); + if (result == U32_MAX) /* card removed */ + return -ENODEV; + +@@ -163,7 +163,7 @@ int xhci_start(struct xhci_hcd *xhci) + * Transactions will be terminated immediately, and operational registers + * will be set to their defaults. + */ +-int xhci_reset(struct xhci_hcd *xhci) ++int xhci_reset(struct xhci_hcd *xhci, u64 timeout_us) + { + u32 command; + u32 state; +@@ -196,8 +196,7 @@ int xhci_reset(struct xhci_hcd *xhci) + if (xhci->quirks & XHCI_INTEL_HOST) + udelay(1000); + +- ret = xhci_handshake(&xhci->op_regs->command, +- CMD_RESET, 0, 10 * 1000 * 1000); ++ ret = xhci_handshake(&xhci->op_regs->command, CMD_RESET, 0, timeout_us); + if (ret) + return ret; + +@@ -210,8 +209,7 @@ int xhci_reset(struct xhci_hcd *xhci) + * xHCI cannot write to any doorbells or operational registers other + * than status until the "Controller Not Ready" flag is cleared. + */ +- ret = xhci_handshake(&xhci->op_regs->status, +- STS_CNR, 0, 10 * 1000 * 1000); ++ ret = xhci_handshake(&xhci->op_regs->status, STS_CNR, 0, timeout_us); + + xhci->usb2_rhub.bus_state.port_c_suspend = 0; + xhci->usb2_rhub.bus_state.suspended_ports = 0; +@@ -732,7 +730,7 @@ static void xhci_stop(struct usb_hcd *hcd) + xhci->xhc_state |= XHCI_STATE_HALTED; + xhci->cmd_ring_state = CMD_RING_STATE_STOPPED; + xhci_halt(xhci); +- xhci_reset(xhci); ++ xhci_reset(xhci, XHCI_RESET_SHORT_USEC); + spin_unlock_irq(&xhci->lock); + + xhci_cleanup_msix(xhci); +@@ -785,7 +783,7 @@ void xhci_shutdown(struct usb_hcd *hcd) + xhci_halt(xhci); + /* Workaround for spurious wakeups at shutdown with HSW */ + if (xhci->quirks & XHCI_SPURIOUS_WAKEUP) +- xhci_reset(xhci); ++ xhci_reset(xhci, XHCI_RESET_SHORT_USEC); + spin_unlock_irq(&xhci->lock); + + xhci_cleanup_msix(xhci); +@@ -1170,7 +1168,7 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated) + xhci_dbg(xhci, "Stop HCD\n"); + xhci_halt(xhci); + xhci_zero_64b_regs(xhci); +- retval = xhci_reset(xhci); ++ retval = xhci_reset(xhci, XHCI_RESET_LONG_USEC); + spin_unlock_irq(&xhci->lock); + if (retval) + return retval; +@@ -5272,7 +5270,7 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks) + + xhci_dbg(xhci, "Resetting HCD\n"); + /* Reset the internal HC memory state and registers. */ +- retval = xhci_reset(xhci); ++ retval = xhci_reset(xhci, XHCI_RESET_LONG_USEC); + if (retval) + return retval; + xhci_dbg(xhci, "Reset complete\n"); +diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h +index 02df309e44093..4b05d767e08f7 100644 +--- a/drivers/usb/host/xhci.h ++++ b/drivers/usb/host/xhci.h +@@ -229,6 +229,9 @@ struct xhci_op_regs { + #define CMD_ETE (1 << 14) + /* bits 15:31 are reserved (and should be preserved on writes). */ + ++#define XHCI_RESET_LONG_USEC (10 * 1000 * 1000) ++#define XHCI_RESET_SHORT_USEC (250 * 1000) ++ + /* IMAN - Interrupt Management Register */ + #define IMAN_IE (1 << 1) + #define IMAN_IP (1 << 0) +@@ -2061,11 +2064,11 @@ void xhci_free_container_ctx(struct xhci_hcd *xhci, + + /* xHCI host controller glue */ + typedef void (*xhci_get_quirks_t)(struct device *, struct xhci_hcd *); +-int xhci_handshake(void __iomem *ptr, u32 mask, u32 done, int usec); ++int xhci_handshake(void __iomem *ptr, u32 mask, u32 done, u64 timeout_us); + void xhci_quiesce(struct xhci_hcd *xhci); + int xhci_halt(struct xhci_hcd *xhci); + int xhci_start(struct xhci_hcd *xhci); +-int xhci_reset(struct xhci_hcd *xhci); ++int xhci_reset(struct xhci_hcd *xhci, u64 timeout_us); + int xhci_run(struct usb_hcd *hcd); + int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks); + void xhci_shutdown(struct usb_hcd *hcd); +@@ -2449,6 +2452,8 @@ static inline const char *xhci_decode_ctrl_ctx(unsigned long drop, + unsigned int bit; + int ret = 0; + ++ str[0] = '\0'; ++ + if (drop) { + ret = sprintf(str, "Drop:"); + for_each_set_bit(bit, &drop, 32) +diff --git a/drivers/usb/serial/Kconfig b/drivers/usb/serial/Kconfig +index 67279c6bce338..31ad8682ad9b8 100644 +--- a/drivers/usb/serial/Kconfig ++++ b/drivers/usb/serial/Kconfig +@@ -66,6 +66,7 @@ config USB_SERIAL_SIMPLE + - Libtransistor USB console + - a number of Motorola phones + - Motorola Tetra devices ++ - Nokia mobile phones + - Novatel Wireless GPS receivers + - Siemens USB/MPI adapter. + - ViVOtech ViVOpay USB device. +diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c +index 9600cee957697..2a91219dee7e6 100644 +--- a/drivers/usb/serial/pl2303.c ++++ b/drivers/usb/serial/pl2303.c +@@ -110,6 +110,7 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(ADLINK_VENDOR_ID, ADLINK_ND6530GC_PRODUCT_ID) }, + { USB_DEVICE(SMART_VENDOR_ID, SMART_PRODUCT_ID) }, + { USB_DEVICE(AT_VENDOR_ID, AT_VTKIT3_PRODUCT_ID) }, ++ { USB_DEVICE(IBM_VENDOR_ID, IBM_PRODUCT_ID) }, + { } /* Terminating entry */ + }; + +diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h +index 3e5442573fe4e..15f746e977a71 100644 +--- a/drivers/usb/serial/pl2303.h ++++ b/drivers/usb/serial/pl2303.h +@@ -29,6 +29,9 @@ + #define ATEN_PRODUCT_UC232B 0x2022 + #define ATEN_PRODUCT_ID2 0x2118 + ++#define IBM_VENDOR_ID 0x04b3 ++#define IBM_PRODUCT_ID 0x4016 ++ + #define IODATA_VENDOR_ID 0x04bb + #define IODATA_PRODUCT_ID 0x0a03 + #define IODATA_PRODUCT_ID_RSAQ5 0x0a0e +diff --git a/drivers/usb/serial/usb-serial-simple.c b/drivers/usb/serial/usb-serial-simple.c +index bd23a7cb1be2b..4c6747889a194 100644 +--- a/drivers/usb/serial/usb-serial-simple.c ++++ b/drivers/usb/serial/usb-serial-simple.c +@@ -91,6 +91,11 @@ DEVICE(moto_modem, MOTO_IDS); + { USB_DEVICE(0x0cad, 0x9016) } /* TPG2200 */ + DEVICE(motorola_tetra, MOTOROLA_TETRA_IDS); + ++/* Nokia mobile phone driver */ ++#define NOKIA_IDS() \ ++ { USB_DEVICE(0x0421, 0x069a) } /* Nokia 130 (RM-1035) */ ++DEVICE(nokia, NOKIA_IDS); ++ + /* Novatel Wireless GPS driver */ + #define NOVATEL_IDS() \ + { USB_DEVICE(0x09d7, 0x0100) } /* NovAtel FlexPack GPS */ +@@ -123,6 +128,7 @@ static struct usb_serial_driver * const serial_drivers[] = { + &vivopay_device, + &moto_modem_device, + &motorola_tetra_device, ++ &nokia_device, + &novatel_gps_device, + &hp4x_device, + &suunto_device, +@@ -140,6 +146,7 @@ static const struct usb_device_id id_table[] = { + VIVOPAY_IDS(), + MOTO_IDS(), + MOTOROLA_TETRA_IDS(), ++ NOKIA_IDS(), + NOVATEL_IDS(), + HP4X_IDS(), + SUUNTO_IDS(), +diff --git a/drivers/usb/storage/ene_ub6250.c b/drivers/usb/storage/ene_ub6250.c +index 8b1b730654218..9c984f3c7248a 100644 +--- a/drivers/usb/storage/ene_ub6250.c ++++ b/drivers/usb/storage/ene_ub6250.c +@@ -237,36 +237,33 @@ static struct us_unusual_dev ene_ub6250_unusual_dev_list[] = { + #define memstick_logaddr(logadr1, logadr0) ((((u16)(logadr1)) << 8) | (logadr0)) + + +-struct SD_STATUS { +- u8 Insert:1; +- u8 Ready:1; +- u8 MediaChange:1; +- u8 IsMMC:1; +- u8 HiCapacity:1; +- u8 HiSpeed:1; +- u8 WtP:1; +- u8 Reserved:1; +-}; +- +-struct MS_STATUS { +- u8 Insert:1; +- u8 Ready:1; +- u8 MediaChange:1; +- u8 IsMSPro:1; +- u8 IsMSPHG:1; +- u8 Reserved1:1; +- u8 WtP:1; +- u8 Reserved2:1; +-}; +- +-struct SM_STATUS { +- u8 Insert:1; +- u8 Ready:1; +- u8 MediaChange:1; +- u8 Reserved:3; +- u8 WtP:1; +- u8 IsMS:1; +-}; ++/* SD_STATUS bits */ ++#define SD_Insert BIT(0) ++#define SD_Ready BIT(1) ++#define SD_MediaChange BIT(2) ++#define SD_IsMMC BIT(3) ++#define SD_HiCapacity BIT(4) ++#define SD_HiSpeed BIT(5) ++#define SD_WtP BIT(6) ++ /* Bit 7 reserved */ ++ ++/* MS_STATUS bits */ ++#define MS_Insert BIT(0) ++#define MS_Ready BIT(1) ++#define MS_MediaChange BIT(2) ++#define MS_IsMSPro BIT(3) ++#define MS_IsMSPHG BIT(4) ++ /* Bit 5 reserved */ ++#define MS_WtP BIT(6) ++ /* Bit 7 reserved */ ++ ++/* SM_STATUS bits */ ++#define SM_Insert BIT(0) ++#define SM_Ready BIT(1) ++#define SM_MediaChange BIT(2) ++ /* Bits 3-5 reserved */ ++#define SM_WtP BIT(6) ++#define SM_IsMS BIT(7) + + struct ms_bootblock_cis { + u8 bCistplDEVICE[6]; /* 0 */ +@@ -437,9 +434,9 @@ struct ene_ub6250_info { + u8 *bbuf; + + /* for 6250 code */ +- struct SD_STATUS SD_Status; +- struct MS_STATUS MS_Status; +- struct SM_STATUS SM_Status; ++ u8 SD_Status; ++ u8 MS_Status; ++ u8 SM_Status; + + /* ----- SD Control Data ---------------- */ + /*SD_REGISTER SD_Regs; */ +@@ -602,7 +599,7 @@ static int sd_scsi_test_unit_ready(struct us_data *us, struct scsi_cmnd *srb) + { + struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra; + +- if (info->SD_Status.Insert && info->SD_Status.Ready) ++ if ((info->SD_Status & SD_Insert) && (info->SD_Status & SD_Ready)) + return USB_STOR_TRANSPORT_GOOD; + else { + ene_sd_init(us); +@@ -622,7 +619,7 @@ static int sd_scsi_mode_sense(struct us_data *us, struct scsi_cmnd *srb) + 0x0b, 0x00, 0x80, 0x08, 0x00, 0x00, + 0x71, 0xc0, 0x00, 0x00, 0x02, 0x00 }; + +- if (info->SD_Status.WtP) ++ if (info->SD_Status & SD_WtP) + usb_stor_set_xfer_buf(mediaWP, 12, srb); + else + usb_stor_set_xfer_buf(mediaNoWP, 12, srb); +@@ -641,9 +638,9 @@ static int sd_scsi_read_capacity(struct us_data *us, struct scsi_cmnd *srb) + struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra; + + usb_stor_dbg(us, "sd_scsi_read_capacity\n"); +- if (info->SD_Status.HiCapacity) { ++ if (info->SD_Status & SD_HiCapacity) { + bl_len = 0x200; +- if (info->SD_Status.IsMMC) ++ if (info->SD_Status & SD_IsMMC) + bl_num = info->HC_C_SIZE-1; + else + bl_num = (info->HC_C_SIZE + 1) * 1024 - 1; +@@ -693,7 +690,7 @@ static int sd_scsi_read(struct us_data *us, struct scsi_cmnd *srb) + return USB_STOR_TRANSPORT_ERROR; + } + +- if (info->SD_Status.HiCapacity) ++ if (info->SD_Status & SD_HiCapacity) + bnByte = bn; + + /* set up the command wrapper */ +@@ -733,7 +730,7 @@ static int sd_scsi_write(struct us_data *us, struct scsi_cmnd *srb) + return USB_STOR_TRANSPORT_ERROR; + } + +- if (info->SD_Status.HiCapacity) ++ if (info->SD_Status & SD_HiCapacity) + bnByte = bn; + + /* set up the command wrapper */ +@@ -1455,7 +1452,7 @@ static int ms_scsi_test_unit_ready(struct us_data *us, struct scsi_cmnd *srb) + struct ene_ub6250_info *info = (struct ene_ub6250_info *)(us->extra); + + /* pr_info("MS_SCSI_Test_Unit_Ready\n"); */ +- if (info->MS_Status.Insert && info->MS_Status.Ready) { ++ if ((info->MS_Status & MS_Insert) && (info->MS_Status & MS_Ready)) { + return USB_STOR_TRANSPORT_GOOD; + } else { + ene_ms_init(us); +@@ -1475,7 +1472,7 @@ static int ms_scsi_mode_sense(struct us_data *us, struct scsi_cmnd *srb) + 0x0b, 0x00, 0x80, 0x08, 0x00, 0x00, + 0x71, 0xc0, 0x00, 0x00, 0x02, 0x00 }; + +- if (info->MS_Status.WtP) ++ if (info->MS_Status & MS_WtP) + usb_stor_set_xfer_buf(mediaWP, 12, srb); + else + usb_stor_set_xfer_buf(mediaNoWP, 12, srb); +@@ -1494,7 +1491,7 @@ static int ms_scsi_read_capacity(struct us_data *us, struct scsi_cmnd *srb) + + usb_stor_dbg(us, "ms_scsi_read_capacity\n"); + bl_len = 0x200; +- if (info->MS_Status.IsMSPro) ++ if (info->MS_Status & MS_IsMSPro) + bl_num = info->MSP_TotalBlock - 1; + else + bl_num = info->MS_Lib.NumberOfLogBlock * info->MS_Lib.blockSize * 2 - 1; +@@ -1649,7 +1646,7 @@ static int ms_scsi_read(struct us_data *us, struct scsi_cmnd *srb) + if (bn > info->bl_num) + return USB_STOR_TRANSPORT_ERROR; + +- if (info->MS_Status.IsMSPro) { ++ if (info->MS_Status & MS_IsMSPro) { + result = ene_load_bincode(us, MSP_RW_PATTERN); + if (result != USB_STOR_XFER_GOOD) { + usb_stor_dbg(us, "Load MPS RW pattern Fail !!\n"); +@@ -1750,7 +1747,7 @@ static int ms_scsi_write(struct us_data *us, struct scsi_cmnd *srb) + if (bn > info->bl_num) + return USB_STOR_TRANSPORT_ERROR; + +- if (info->MS_Status.IsMSPro) { ++ if (info->MS_Status & MS_IsMSPro) { + result = ene_load_bincode(us, MSP_RW_PATTERN); + if (result != USB_STOR_XFER_GOOD) { + pr_info("Load MSP RW pattern Fail !!\n"); +@@ -1858,12 +1855,12 @@ static int ene_get_card_status(struct us_data *us, u8 *buf) + + tmpreg = (u16) reg4b; + reg4b = *(u32 *)(&buf[0x14]); +- if (info->SD_Status.HiCapacity && !info->SD_Status.IsMMC) ++ if ((info->SD_Status & SD_HiCapacity) && !(info->SD_Status & SD_IsMMC)) + info->HC_C_SIZE = (reg4b >> 8) & 0x3fffff; + + info->SD_C_SIZE = ((tmpreg & 0x03) << 10) | (u16)(reg4b >> 22); + info->SD_C_SIZE_MULT = (u8)(reg4b >> 7) & 0x07; +- if (info->SD_Status.HiCapacity && info->SD_Status.IsMMC) ++ if ((info->SD_Status & SD_HiCapacity) && (info->SD_Status & SD_IsMMC)) + info->HC_C_SIZE = *(u32 *)(&buf[0x100]); + + if (info->SD_READ_BL_LEN > SD_BLOCK_LEN) { +@@ -2075,6 +2072,7 @@ static int ene_ms_init(struct us_data *us) + u16 MSP_BlockSize, MSP_UserAreaBlocks; + struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra; + u8 *bbuf = info->bbuf; ++ unsigned int s; + + printk(KERN_INFO "transport --- ENE_MSInit\n"); + +@@ -2099,15 +2097,16 @@ static int ene_ms_init(struct us_data *us) + return USB_STOR_TRANSPORT_ERROR; + } + /* the same part to test ENE */ +- info->MS_Status = *(struct MS_STATUS *) bbuf; +- +- if (info->MS_Status.Insert && info->MS_Status.Ready) { +- printk(KERN_INFO "Insert = %x\n", info->MS_Status.Insert); +- printk(KERN_INFO "Ready = %x\n", info->MS_Status.Ready); +- printk(KERN_INFO "IsMSPro = %x\n", info->MS_Status.IsMSPro); +- printk(KERN_INFO "IsMSPHG = %x\n", info->MS_Status.IsMSPHG); +- printk(KERN_INFO "WtP= %x\n", info->MS_Status.WtP); +- if (info->MS_Status.IsMSPro) { ++ info->MS_Status = bbuf[0]; ++ ++ s = info->MS_Status; ++ if ((s & MS_Insert) && (s & MS_Ready)) { ++ printk(KERN_INFO "Insert = %x\n", !!(s & MS_Insert)); ++ printk(KERN_INFO "Ready = %x\n", !!(s & MS_Ready)); ++ printk(KERN_INFO "IsMSPro = %x\n", !!(s & MS_IsMSPro)); ++ printk(KERN_INFO "IsMSPHG = %x\n", !!(s & MS_IsMSPHG)); ++ printk(KERN_INFO "WtP= %x\n", !!(s & MS_WtP)); ++ if (s & MS_IsMSPro) { + MSP_BlockSize = (bbuf[6] << 8) | bbuf[7]; + MSP_UserAreaBlocks = (bbuf[10] << 8) | bbuf[11]; + info->MSP_TotalBlock = MSP_BlockSize * MSP_UserAreaBlocks; +@@ -2168,17 +2167,17 @@ static int ene_sd_init(struct us_data *us) + return USB_STOR_TRANSPORT_ERROR; + } + +- info->SD_Status = *(struct SD_STATUS *) bbuf; +- if (info->SD_Status.Insert && info->SD_Status.Ready) { +- struct SD_STATUS *s = &info->SD_Status; ++ info->SD_Status = bbuf[0]; ++ if ((info->SD_Status & SD_Insert) && (info->SD_Status & SD_Ready)) { ++ unsigned int s = info->SD_Status; + + ene_get_card_status(us, bbuf); +- usb_stor_dbg(us, "Insert = %x\n", s->Insert); +- usb_stor_dbg(us, "Ready = %x\n", s->Ready); +- usb_stor_dbg(us, "IsMMC = %x\n", s->IsMMC); +- usb_stor_dbg(us, "HiCapacity = %x\n", s->HiCapacity); +- usb_stor_dbg(us, "HiSpeed = %x\n", s->HiSpeed); +- usb_stor_dbg(us, "WtP = %x\n", s->WtP); ++ usb_stor_dbg(us, "Insert = %x\n", !!(s & SD_Insert)); ++ usb_stor_dbg(us, "Ready = %x\n", !!(s & SD_Ready)); ++ usb_stor_dbg(us, "IsMMC = %x\n", !!(s & SD_IsMMC)); ++ usb_stor_dbg(us, "HiCapacity = %x\n", !!(s & SD_HiCapacity)); ++ usb_stor_dbg(us, "HiSpeed = %x\n", !!(s & SD_HiSpeed)); ++ usb_stor_dbg(us, "WtP = %x\n", !!(s & SD_WtP)); + } else { + usb_stor_dbg(us, "SD Card Not Ready --- %x\n", bbuf[0]); + return USB_STOR_TRANSPORT_ERROR; +@@ -2200,14 +2199,14 @@ static int ene_init(struct us_data *us) + + misc_reg03 = bbuf[0]; + if (misc_reg03 & 0x01) { +- if (!info->SD_Status.Ready) { ++ if (!(info->SD_Status & SD_Ready)) { + result = ene_sd_init(us); + if (result != USB_STOR_XFER_GOOD) + return USB_STOR_TRANSPORT_ERROR; + } + } + if (misc_reg03 & 0x02) { +- if (!info->MS_Status.Ready) { ++ if (!(info->MS_Status & MS_Ready)) { + result = ene_ms_init(us); + if (result != USB_STOR_XFER_GOOD) + return USB_STOR_TRANSPORT_ERROR; +@@ -2306,14 +2305,14 @@ static int ene_transport(struct scsi_cmnd *srb, struct us_data *us) + + /*US_DEBUG(usb_stor_show_command(us, srb)); */ + scsi_set_resid(srb, 0); +- if (unlikely(!(info->SD_Status.Ready || info->MS_Status.Ready))) ++ if (unlikely(!(info->SD_Status & SD_Ready) || (info->MS_Status & MS_Ready))) + result = ene_init(us); + if (result == USB_STOR_XFER_GOOD) { + result = USB_STOR_TRANSPORT_ERROR; +- if (info->SD_Status.Ready) ++ if (info->SD_Status & SD_Ready) + result = sd_scsi_irp(us, srb); + +- if (info->MS_Status.Ready) ++ if (info->MS_Status & MS_Ready) + result = ms_scsi_irp(us, srb); + } + return result; +@@ -2377,7 +2376,6 @@ static int ene_ub6250_probe(struct usb_interface *intf, + + static int ene_ub6250_resume(struct usb_interface *iface) + { +- u8 tmp = 0; + struct us_data *us = usb_get_intfdata(iface); + struct ene_ub6250_info *info = (struct ene_ub6250_info *)(us->extra); + +@@ -2389,17 +2387,16 @@ static int ene_ub6250_resume(struct usb_interface *iface) + mutex_unlock(&us->dev_mutex); + + info->Power_IsResum = true; +- /*info->SD_Status.Ready = 0; */ +- info->SD_Status = *(struct SD_STATUS *)&tmp; +- info->MS_Status = *(struct MS_STATUS *)&tmp; +- info->SM_Status = *(struct SM_STATUS *)&tmp; ++ /* info->SD_Status &= ~SD_Ready; */ ++ info->SD_Status = 0; ++ info->MS_Status = 0; ++ info->SM_Status = 0; + + return 0; + } + + static int ene_ub6250_reset_resume(struct usb_interface *iface) + { +- u8 tmp = 0; + struct us_data *us = usb_get_intfdata(iface); + struct ene_ub6250_info *info = (struct ene_ub6250_info *)(us->extra); + +@@ -2411,10 +2408,10 @@ static int ene_ub6250_reset_resume(struct usb_interface *iface) + * the device + */ + info->Power_IsResum = true; +- /*info->SD_Status.Ready = 0; */ +- info->SD_Status = *(struct SD_STATUS *)&tmp; +- info->MS_Status = *(struct MS_STATUS *)&tmp; +- info->SM_Status = *(struct SM_STATUS *)&tmp; ++ /* info->SD_Status &= ~SD_Ready; */ ++ info->SD_Status = 0; ++ info->MS_Status = 0; ++ info->SM_Status = 0; + + return 0; + } +diff --git a/drivers/usb/storage/realtek_cr.c b/drivers/usb/storage/realtek_cr.c +index 3789698d9d3c6..0c423916d7bfa 100644 +--- a/drivers/usb/storage/realtek_cr.c ++++ b/drivers/usb/storage/realtek_cr.c +@@ -365,7 +365,7 @@ static int rts51x_read_mem(struct us_data *us, u16 addr, u8 *data, u16 len) + + buf = kmalloc(len, GFP_NOIO); + if (buf == NULL) +- return USB_STOR_TRANSPORT_ERROR; ++ return -ENOMEM; + + usb_stor_dbg(us, "addr = 0x%x, len = %d\n", addr, len); + +diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c +index cec9173aac6f5..1058aba8d5734 100644 +--- a/drivers/vhost/net.c ++++ b/drivers/vhost/net.c +@@ -472,6 +472,7 @@ static void vhost_tx_batch(struct vhost_net *net, + goto signal_used; + + msghdr->msg_control = &ctl; ++ msghdr->msg_controllen = sizeof(ctl); + err = sock->ops->sendmsg(sock, msghdr, 0); + if (unlikely(err < 0)) { + vq_err(&nvq->vq, "Fail to batch sending packets\n"); +diff --git a/drivers/video/fbdev/atafb.c b/drivers/video/fbdev/atafb.c +index 51f5d1c56fd9c..c1ee817d7dcc5 100644 +--- a/drivers/video/fbdev/atafb.c ++++ b/drivers/video/fbdev/atafb.c +@@ -1692,9 +1692,9 @@ static int falcon_setcolreg(unsigned int regno, unsigned int red, + ((blue & 0xfc00) >> 8)); + if (regno < 16) { + shifter_tt.color_reg[regno] = +- (((red & 0xe000) >> 13) | ((red & 0x1000) >> 12) << 8) | +- (((green & 0xe000) >> 13) | ((green & 0x1000) >> 12) << 4) | +- ((blue & 0xe000) >> 13) | ((blue & 0x1000) >> 12); ++ ((((red & 0xe000) >> 13) | ((red & 0x1000) >> 12)) << 8) | ++ ((((green & 0xe000) >> 13) | ((green & 0x1000) >> 12)) << 4) | ++ ((blue & 0xe000) >> 13) | ((blue & 0x1000) >> 12); + ((u32 *)info->pseudo_palette)[regno] = ((red & 0xf800) | + ((green & 0xfc00) >> 5) | + ((blue & 0xf800) >> 11)); +@@ -1980,9 +1980,9 @@ static int stste_setcolreg(unsigned int regno, unsigned int red, + green >>= 12; + if (ATARIHW_PRESENT(EXTD_SHIFTER)) + shifter_tt.color_reg[regno] = +- (((red & 0xe) >> 1) | ((red & 1) << 3) << 8) | +- (((green & 0xe) >> 1) | ((green & 1) << 3) << 4) | +- ((blue & 0xe) >> 1) | ((blue & 1) << 3); ++ ((((red & 0xe) >> 1) | ((red & 1) << 3)) << 8) | ++ ((((green & 0xe) >> 1) | ((green & 1) << 3)) << 4) | ++ ((blue & 0xe) >> 1) | ((blue & 1) << 3); + else + shifter_tt.color_reg[regno] = + ((red & 0xe) << 7) | +diff --git a/drivers/video/fbdev/atmel_lcdfb.c b/drivers/video/fbdev/atmel_lcdfb.c +index cf2bfff2efbf1..b91919861075b 100644 +--- a/drivers/video/fbdev/atmel_lcdfb.c ++++ b/drivers/video/fbdev/atmel_lcdfb.c +@@ -1062,15 +1062,16 @@ static int __init atmel_lcdfb_probe(struct platform_device *pdev) + + INIT_LIST_HEAD(&info->modelist); + +- if (pdev->dev.of_node) { +- ret = atmel_lcdfb_of_init(sinfo); +- if (ret) +- goto free_info; +- } else { ++ if (!pdev->dev.of_node) { + dev_err(dev, "cannot get default configuration\n"); + goto free_info; + } + ++ ret = atmel_lcdfb_of_init(sinfo); ++ if (ret) ++ goto free_info; ++ ++ ret = -ENODEV; + if (!sinfo->config) + goto free_info; + +diff --git a/drivers/video/fbdev/cirrusfb.c b/drivers/video/fbdev/cirrusfb.c +index e4ce5667b1251..1b0a58f96af25 100644 +--- a/drivers/video/fbdev/cirrusfb.c ++++ b/drivers/video/fbdev/cirrusfb.c +@@ -470,7 +470,7 @@ static int cirrusfb_check_mclk(struct fb_info *info, long freq) + return 0; + } + +-static int cirrusfb_check_pixclock(const struct fb_var_screeninfo *var, ++static int cirrusfb_check_pixclock(struct fb_var_screeninfo *var, + struct fb_info *info) + { + long freq; +@@ -479,9 +479,7 @@ static int cirrusfb_check_pixclock(const struct fb_var_screeninfo *var, + unsigned maxclockidx = var->bits_per_pixel >> 3; + + /* convert from ps to kHz */ +- freq = PICOS2KHZ(var->pixclock); +- +- dev_dbg(info->device, "desired pixclock: %ld kHz\n", freq); ++ freq = PICOS2KHZ(var->pixclock ? : 1); + + maxclock = cirrusfb_board_info[cinfo->btype].maxclock[maxclockidx]; + cinfo->multiplexing = 0; +@@ -489,11 +487,13 @@ static int cirrusfb_check_pixclock(const struct fb_var_screeninfo *var, + /* If the frequency is greater than we can support, we might be able + * to use multiplexing for the video mode */ + if (freq > maxclock) { +- dev_err(info->device, +- "Frequency greater than maxclock (%ld kHz)\n", +- maxclock); +- return -EINVAL; ++ var->pixclock = KHZ2PICOS(maxclock); ++ ++ while ((freq = PICOS2KHZ(var->pixclock)) > maxclock) ++ var->pixclock++; + } ++ dev_dbg(info->device, "desired pixclock: %ld kHz\n", freq); ++ + /* + * Additional constraint: 8bpp uses DAC clock doubling to allow maximum + * pixel clock +diff --git a/drivers/video/fbdev/core/fbcvt.c b/drivers/video/fbdev/core/fbcvt.c +index 55d2bd0ce5c02..64843464c6613 100644 +--- a/drivers/video/fbdev/core/fbcvt.c ++++ b/drivers/video/fbdev/core/fbcvt.c +@@ -214,9 +214,11 @@ static u32 fb_cvt_aspect_ratio(struct fb_cvt_data *cvt) + static void fb_cvt_print_name(struct fb_cvt_data *cvt) + { + u32 pixcount, pixcount_mod; +- int cnt = 255, offset = 0, read = 0; +- u8 *buf = kzalloc(256, GFP_KERNEL); ++ int size = 256; ++ int off = 0; ++ u8 *buf; + ++ buf = kzalloc(size, GFP_KERNEL); + if (!buf) + return; + +@@ -224,43 +226,30 @@ static void fb_cvt_print_name(struct fb_cvt_data *cvt) + pixcount_mod = (cvt->xres * (cvt->yres/cvt->interlace)) % 1000000; + pixcount_mod /= 1000; + +- read = snprintf(buf+offset, cnt, "fbcvt: %dx%d@%d: CVT Name - ", +- cvt->xres, cvt->yres, cvt->refresh); +- offset += read; +- cnt -= read; ++ off += scnprintf(buf + off, size - off, "fbcvt: %dx%d@%d: CVT Name - ", ++ cvt->xres, cvt->yres, cvt->refresh); + +- if (cvt->status) +- snprintf(buf+offset, cnt, "Not a CVT standard - %d.%03d Mega " +- "Pixel Image\n", pixcount, pixcount_mod); +- else { +- if (pixcount) { +- read = snprintf(buf+offset, cnt, "%d", pixcount); +- cnt -= read; +- offset += read; +- } ++ if (cvt->status) { ++ off += scnprintf(buf + off, size - off, ++ "Not a CVT standard - %d.%03d Mega Pixel Image\n", ++ pixcount, pixcount_mod); ++ } else { ++ if (pixcount) ++ off += scnprintf(buf + off, size - off, "%d", pixcount); + +- read = snprintf(buf+offset, cnt, ".%03dM", pixcount_mod); +- cnt -= read; +- offset += read; ++ off += scnprintf(buf + off, size - off, ".%03dM", pixcount_mod); + + if (cvt->aspect_ratio == 0) +- read = snprintf(buf+offset, cnt, "3"); ++ off += scnprintf(buf + off, size - off, "3"); + else if (cvt->aspect_ratio == 3) +- read = snprintf(buf+offset, cnt, "4"); ++ off += scnprintf(buf + off, size - off, "4"); + else if (cvt->aspect_ratio == 1 || cvt->aspect_ratio == 4) +- read = snprintf(buf+offset, cnt, "9"); ++ off += scnprintf(buf + off, size - off, "9"); + else if (cvt->aspect_ratio == 2) +- read = snprintf(buf+offset, cnt, "A"); +- else +- read = 0; +- cnt -= read; +- offset += read; +- +- if (cvt->flags & FB_CVT_FLAG_REDUCED_BLANK) { +- read = snprintf(buf+offset, cnt, "-R"); +- cnt -= read; +- offset += read; +- } ++ off += scnprintf(buf + off, size - off, "A"); ++ ++ if (cvt->flags & FB_CVT_FLAG_REDUCED_BLANK) ++ off += scnprintf(buf + off, size - off, "-R"); + } + + printk(KERN_INFO "%s\n", buf); +diff --git a/drivers/video/fbdev/nvidia/nv_i2c.c b/drivers/video/fbdev/nvidia/nv_i2c.c +index d7994a1732459..0b48965a6420c 100644 +--- a/drivers/video/fbdev/nvidia/nv_i2c.c ++++ b/drivers/video/fbdev/nvidia/nv_i2c.c +@@ -86,7 +86,7 @@ static int nvidia_setup_i2c_bus(struct nvidia_i2c_chan *chan, const char *name, + { + int rc; + +- strcpy(chan->adapter.name, name); ++ strscpy(chan->adapter.name, name, sizeof(chan->adapter.name)); + chan->adapter.owner = THIS_MODULE; + chan->adapter.class = i2c_class; + chan->adapter.algo_data = &chan->algo; +diff --git a/drivers/video/fbdev/omap2/omapfb/displays/connector-dvi.c b/drivers/video/fbdev/omap2/omapfb/displays/connector-dvi.c +index b4a1aefff7661..777f6d66c28c3 100644 +--- a/drivers/video/fbdev/omap2/omapfb/displays/connector-dvi.c ++++ b/drivers/video/fbdev/omap2/omapfb/displays/connector-dvi.c +@@ -251,6 +251,7 @@ static int dvic_probe_of(struct platform_device *pdev) + adapter_node = of_parse_phandle(node, "ddc-i2c-bus", 0); + if (adapter_node) { + adapter = of_get_i2c_adapter_by_node(adapter_node); ++ of_node_put(adapter_node); + if (adapter == NULL) { + dev_err(&pdev->dev, "failed to parse ddc-i2c-bus\n"); + omap_dss_put_device(ddata->in); +diff --git a/drivers/video/fbdev/omap2/omapfb/displays/panel-dsi-cm.c b/drivers/video/fbdev/omap2/omapfb/displays/panel-dsi-cm.c +index 4b0793abdd84b..a2c7c5cb15234 100644 +--- a/drivers/video/fbdev/omap2/omapfb/displays/panel-dsi-cm.c ++++ b/drivers/video/fbdev/omap2/omapfb/displays/panel-dsi-cm.c +@@ -409,7 +409,7 @@ static ssize_t dsicm_num_errors_show(struct device *dev, + if (r) + return r; + +- return snprintf(buf, PAGE_SIZE, "%d\n", errors); ++ return sysfs_emit(buf, "%d\n", errors); + } + + static ssize_t dsicm_hw_revision_show(struct device *dev, +@@ -439,7 +439,7 @@ static ssize_t dsicm_hw_revision_show(struct device *dev, + if (r) + return r; + +- return snprintf(buf, PAGE_SIZE, "%02x.%02x.%02x\n", id1, id2, id3); ++ return sysfs_emit(buf, "%02x.%02x.%02x\n", id1, id2, id3); + } + + static ssize_t dsicm_store_ulps(struct device *dev, +@@ -487,7 +487,7 @@ static ssize_t dsicm_show_ulps(struct device *dev, + t = ddata->ulps_enabled; + mutex_unlock(&ddata->lock); + +- return snprintf(buf, PAGE_SIZE, "%u\n", t); ++ return sysfs_emit(buf, "%u\n", t); + } + + static ssize_t dsicm_store_ulps_timeout(struct device *dev, +@@ -532,7 +532,7 @@ static ssize_t dsicm_show_ulps_timeout(struct device *dev, + t = ddata->ulps_timeout; + mutex_unlock(&ddata->lock); + +- return snprintf(buf, PAGE_SIZE, "%u\n", t); ++ return sysfs_emit(buf, "%u\n", t); + } + + static DEVICE_ATTR(num_dsi_errors, S_IRUGO, dsicm_num_errors_show, NULL); +diff --git a/drivers/video/fbdev/omap2/omapfb/displays/panel-sony-acx565akm.c b/drivers/video/fbdev/omap2/omapfb/displays/panel-sony-acx565akm.c +index 1293515e4b169..0cbc5b9183f89 100644 +--- a/drivers/video/fbdev/omap2/omapfb/displays/panel-sony-acx565akm.c ++++ b/drivers/video/fbdev/omap2/omapfb/displays/panel-sony-acx565akm.c +@@ -476,7 +476,7 @@ static ssize_t show_cabc_available_modes(struct device *dev, + int i; + + if (!ddata->has_cabc) +- return snprintf(buf, PAGE_SIZE, "%s\n", cabc_modes[0]); ++ return sysfs_emit(buf, "%s\n", cabc_modes[0]); + + for (i = 0, len = 0; + len < PAGE_SIZE && i < ARRAY_SIZE(cabc_modes); i++) +diff --git a/drivers/video/fbdev/omap2/omapfb/displays/panel-tpo-td043mtea1.c b/drivers/video/fbdev/omap2/omapfb/displays/panel-tpo-td043mtea1.c +index bb85b21f07248..9f6ef9e04d9ce 100644 +--- a/drivers/video/fbdev/omap2/omapfb/displays/panel-tpo-td043mtea1.c ++++ b/drivers/video/fbdev/omap2/omapfb/displays/panel-tpo-td043mtea1.c +@@ -169,7 +169,7 @@ static ssize_t tpo_td043_vmirror_show(struct device *dev, + { + struct panel_drv_data *ddata = dev_get_drvdata(dev); + +- return snprintf(buf, PAGE_SIZE, "%d\n", ddata->vmirror); ++ return sysfs_emit(buf, "%d\n", ddata->vmirror); + } + + static ssize_t tpo_td043_vmirror_store(struct device *dev, +@@ -199,7 +199,7 @@ static ssize_t tpo_td043_mode_show(struct device *dev, + { + struct panel_drv_data *ddata = dev_get_drvdata(dev); + +- return snprintf(buf, PAGE_SIZE, "%d\n", ddata->mode); ++ return sysfs_emit(buf, "%d\n", ddata->mode); + } + + static ssize_t tpo_td043_mode_store(struct device *dev, +diff --git a/drivers/video/fbdev/sm712fb.c b/drivers/video/fbdev/sm712fb.c +index 2466814145779..83d05600360dd 100644 +--- a/drivers/video/fbdev/sm712fb.c ++++ b/drivers/video/fbdev/sm712fb.c +@@ -1047,7 +1047,7 @@ static ssize_t smtcfb_read(struct fb_info *info, char __user *buf, + if (count + p > total_size) + count = total_size - p; + +- buffer = kmalloc((count > PAGE_SIZE) ? PAGE_SIZE : count, GFP_KERNEL); ++ buffer = kmalloc(PAGE_SIZE, GFP_KERNEL); + if (!buffer) + return -ENOMEM; + +@@ -1059,25 +1059,14 @@ static ssize_t smtcfb_read(struct fb_info *info, char __user *buf, + while (count) { + c = (count > PAGE_SIZE) ? PAGE_SIZE : count; + dst = buffer; +- for (i = c >> 2; i--;) { +- *dst = fb_readl(src++); +- *dst = big_swap(*dst); ++ for (i = (c + 3) >> 2; i--;) { ++ u32 val; ++ ++ val = fb_readl(src); ++ *dst = big_swap(val); ++ src++; + dst++; + } +- if (c & 3) { +- u8 *dst8 = (u8 *)dst; +- u8 __iomem *src8 = (u8 __iomem *)src; +- +- for (i = c & 3; i--;) { +- if (i & 1) { +- *dst8++ = fb_readb(++src8); +- } else { +- *dst8++ = fb_readb(--src8); +- src8 += 2; +- } +- } +- src = (u32 __iomem *)src8; +- } + + if (copy_to_user(buf, buffer, c)) { + err = -EFAULT; +@@ -1130,7 +1119,7 @@ static ssize_t smtcfb_write(struct fb_info *info, const char __user *buf, + count = total_size - p; + } + +- buffer = kmalloc((count > PAGE_SIZE) ? PAGE_SIZE : count, GFP_KERNEL); ++ buffer = kmalloc(PAGE_SIZE, GFP_KERNEL); + if (!buffer) + return -ENOMEM; + +@@ -1148,24 +1137,11 @@ static ssize_t smtcfb_write(struct fb_info *info, const char __user *buf, + break; + } + +- for (i = c >> 2; i--;) { +- fb_writel(big_swap(*src), dst++); ++ for (i = (c + 3) >> 2; i--;) { ++ fb_writel(big_swap(*src), dst); ++ dst++; + src++; + } +- if (c & 3) { +- u8 *src8 = (u8 *)src; +- u8 __iomem *dst8 = (u8 __iomem *)dst; +- +- for (i = c & 3; i--;) { +- if (i & 1) { +- fb_writeb(*src8++, ++dst8); +- } else { +- fb_writeb(*src8++, --dst8); +- dst8 += 2; +- } +- } +- dst = (u32 __iomem *)dst8; +- } + + *ppos += c; + buf += c; +diff --git a/drivers/video/fbdev/smscufx.c b/drivers/video/fbdev/smscufx.c +index 0e0f5bbfc5efc..ad60f739c6a19 100644 +--- a/drivers/video/fbdev/smscufx.c ++++ b/drivers/video/fbdev/smscufx.c +@@ -1657,6 +1657,7 @@ static int ufx_usb_probe(struct usb_interface *interface, + info->par = dev; + info->pseudo_palette = dev->pseudo_palette; + info->fbops = &ufx_ops; ++ INIT_LIST_HEAD(&info->modelist); + + retval = fb_alloc_cmap(&info->cmap, 256, 0); + if (retval < 0) { +@@ -1667,8 +1668,6 @@ static int ufx_usb_probe(struct usb_interface *interface, + INIT_DELAYED_WORK(&dev->free_framebuffer_work, + ufx_free_framebuffer_work); + +- INIT_LIST_HEAD(&info->modelist); +- + retval = ufx_reg_read(dev, 0x3000, &id_rev); + check_warn_goto_error(retval, "error %d reading 0x3000 register from device", retval); + dev_dbg(dev->gdev, "ID_REV register value 0x%08x", id_rev); +diff --git a/drivers/video/fbdev/udlfb.c b/drivers/video/fbdev/udlfb.c +index ecbfbbf1c1a79..e269b1391e146 100644 +--- a/drivers/video/fbdev/udlfb.c ++++ b/drivers/video/fbdev/udlfb.c +@@ -1427,7 +1427,7 @@ static ssize_t metrics_bytes_rendered_show(struct device *fbdev, + struct device_attribute *a, char *buf) { + struct fb_info *fb_info = dev_get_drvdata(fbdev); + struct dlfb_data *dlfb = fb_info->par; +- return snprintf(buf, PAGE_SIZE, "%u\n", ++ return sysfs_emit(buf, "%u\n", + atomic_read(&dlfb->bytes_rendered)); + } + +@@ -1435,7 +1435,7 @@ static ssize_t metrics_bytes_identical_show(struct device *fbdev, + struct device_attribute *a, char *buf) { + struct fb_info *fb_info = dev_get_drvdata(fbdev); + struct dlfb_data *dlfb = fb_info->par; +- return snprintf(buf, PAGE_SIZE, "%u\n", ++ return sysfs_emit(buf, "%u\n", + atomic_read(&dlfb->bytes_identical)); + } + +@@ -1443,7 +1443,7 @@ static ssize_t metrics_bytes_sent_show(struct device *fbdev, + struct device_attribute *a, char *buf) { + struct fb_info *fb_info = dev_get_drvdata(fbdev); + struct dlfb_data *dlfb = fb_info->par; +- return snprintf(buf, PAGE_SIZE, "%u\n", ++ return sysfs_emit(buf, "%u\n", + atomic_read(&dlfb->bytes_sent)); + } + +@@ -1451,7 +1451,7 @@ static ssize_t metrics_cpu_kcycles_used_show(struct device *fbdev, + struct device_attribute *a, char *buf) { + struct fb_info *fb_info = dev_get_drvdata(fbdev); + struct dlfb_data *dlfb = fb_info->par; +- return snprintf(buf, PAGE_SIZE, "%u\n", ++ return sysfs_emit(buf, "%u\n", + atomic_read(&dlfb->cpu_kcycles_used)); + } + +diff --git a/drivers/video/fbdev/w100fb.c b/drivers/video/fbdev/w100fb.c +index e30f9427b3355..52ec80bbfe5ea 100644 +--- a/drivers/video/fbdev/w100fb.c ++++ b/drivers/video/fbdev/w100fb.c +@@ -770,12 +770,18 @@ out: + fb_dealloc_cmap(&info->cmap); + kfree(info->pseudo_palette); + } +- if (remapped_fbuf != NULL) ++ if (remapped_fbuf != NULL) { + iounmap(remapped_fbuf); +- if (remapped_regs != NULL) ++ remapped_fbuf = NULL; ++ } ++ if (remapped_regs != NULL) { + iounmap(remapped_regs); +- if (remapped_base != NULL) ++ remapped_regs = NULL; ++ } ++ if (remapped_base != NULL) { + iounmap(remapped_base); ++ remapped_base = NULL; ++ } + if (info) + framebuffer_release(info); + return err; +@@ -795,8 +801,11 @@ static int w100fb_remove(struct platform_device *pdev) + fb_dealloc_cmap(&info->cmap); + + iounmap(remapped_base); ++ remapped_base = NULL; + iounmap(remapped_regs); ++ remapped_regs = NULL; + iounmap(remapped_fbuf); ++ remapped_fbuf = NULL; + + framebuffer_release(info); + +diff --git a/drivers/w1/slaves/w1_therm.c b/drivers/w1/slaves/w1_therm.c +index e028e00927991..cf1e01f0dede3 100644 +--- a/drivers/w1/slaves/w1_therm.c ++++ b/drivers/w1/slaves/w1_therm.c +@@ -679,16 +679,20 @@ static ssize_t w1_seq_show(struct device *device, + if (sl->reg_num.id == reg_num->id) + seq = i; + ++ if (w1_reset_bus(sl->master)) ++ goto error; ++ ++ /* Put the device into chain DONE state */ ++ w1_write_8(sl->master, W1_MATCH_ROM); ++ w1_write_block(sl->master, (u8 *)&rn, 8); + w1_write_8(sl->master, W1_42_CHAIN); + w1_write_8(sl->master, W1_42_CHAIN_DONE); + w1_write_8(sl->master, W1_42_CHAIN_DONE_INV); +- w1_read_block(sl->master, &ack, sizeof(ack)); + + /* check for acknowledgment */ + ack = w1_read_8(sl->master); + if (ack != W1_42_SUCCESS_CONFIRM_BYTE) + goto error; +- + } + + /* Exit from CHAIN state */ +diff --git a/fs/btrfs/extent_io.h b/fs/btrfs/extent_io.h +index fcf1807cc8dd7..c8def2bdf2474 100644 +--- a/fs/btrfs/extent_io.h ++++ b/fs/btrfs/extent_io.h +@@ -202,7 +202,7 @@ struct extent_buffer { + */ + struct extent_changeset { + /* How many bytes are set/cleared in this operation */ +- unsigned int bytes_changed; ++ u64 bytes_changed; + + /* Changed ranges */ + struct ulist range_changed; +diff --git a/fs/ext2/super.c b/fs/ext2/super.c +index 065cd2d1bdc68..db403c01d4d5c 100644 +--- a/fs/ext2/super.c ++++ b/fs/ext2/super.c +@@ -770,8 +770,12 @@ static loff_t ext2_max_size(int bits) + res += 1LL << (bits-2); + res += 1LL << (2*(bits-2)); + res += 1LL << (3*(bits-2)); ++ /* Compute how many metadata blocks are needed */ ++ meta_blocks = 1; ++ meta_blocks += 1 + ppb; ++ meta_blocks += 1 + ppb + ppb * ppb; + /* Does block tree limit file size? */ +- if (res < upper_limit) ++ if (res + meta_blocks <= upper_limit) + goto check_lfs; + + res = upper_limit; +diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c +index dcbd8ac8d4711..0d62f05f89256 100644 +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -2161,6 +2161,15 @@ static int ext4_writepage(struct page *page, + else + len = PAGE_SIZE; + ++ /* Should never happen but for bugs in other kernel subsystems */ ++ if (!page_has_buffers(page)) { ++ ext4_warning_inode(inode, ++ "page %lu does not have buffers attached", page->index); ++ ClearPageDirty(page); ++ unlock_page(page); ++ return 0; ++ } ++ + page_bufs = page_buffers(page); + /* + * We cannot do block allocation or other extent handling in this +@@ -2710,6 +2719,22 @@ static int mpage_prepare_extent_to_map(struct mpage_da_data *mpd) + wait_on_page_writeback(page); + BUG_ON(PageWriteback(page)); + ++ /* ++ * Should never happen but for buggy code in ++ * other subsystems that call ++ * set_page_dirty() without properly warning ++ * the file system first. See [1] for more ++ * information. ++ * ++ * [1] https://lore.kernel.org/linux-mm/20180103100430.GE4911@quack2.suse.cz ++ */ ++ if (!page_has_buffers(page)) { ++ ext4_warning_inode(mpd->inode, "page %lu does not have buffers attached", page->index); ++ ClearPageDirty(page); ++ unlock_page(page); ++ continue; ++ } ++ + if (mpd->map.m_len == 0) + mpd->first_page = page->index; + mpd->next_page = page->index + 1; +diff --git a/fs/f2fs/checkpoint.c b/fs/f2fs/checkpoint.c +index 03dce3980d90a..54f0d2c4c7d87 100644 +--- a/fs/f2fs/checkpoint.c ++++ b/fs/f2fs/checkpoint.c +@@ -848,6 +848,7 @@ static struct page *validate_checkpoint(struct f2fs_sb_info *sbi, + struct page *cp_page_1 = NULL, *cp_page_2 = NULL; + struct f2fs_checkpoint *cp_block = NULL; + unsigned long long cur_version = 0, pre_version = 0; ++ unsigned int cp_blocks; + int err; + + err = get_checkpoint_version(sbi, cp_addr, &cp_block, +@@ -855,15 +856,16 @@ static struct page *validate_checkpoint(struct f2fs_sb_info *sbi, + if (err) + return NULL; + +- if (le32_to_cpu(cp_block->cp_pack_total_block_count) > +- sbi->blocks_per_seg) { ++ cp_blocks = le32_to_cpu(cp_block->cp_pack_total_block_count); ++ ++ if (cp_blocks > sbi->blocks_per_seg || cp_blocks <= F2FS_CP_PACKS) { + f2fs_warn(sbi, "invalid cp_pack_total_block_count:%u", + le32_to_cpu(cp_block->cp_pack_total_block_count)); + goto invalid_cp; + } + pre_version = *version; + +- cp_addr += le32_to_cpu(cp_block->cp_pack_total_block_count) - 1; ++ cp_addr += cp_blocks - 1; + err = get_checkpoint_version(sbi, cp_addr, &cp_block, + &cp_page_2, version); + if (err) +diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c +index 1679f9c0b63b3..773028921c481 100644 +--- a/fs/f2fs/data.c ++++ b/fs/f2fs/data.c +@@ -2467,8 +2467,12 @@ static int __f2fs_write_data_pages(struct address_space *mapping, + /* to avoid spliting IOs due to mixed WB_SYNC_ALL and WB_SYNC_NONE */ + if (wbc->sync_mode == WB_SYNC_ALL) + atomic_inc(&sbi->wb_sync_req[DATA]); +- else if (atomic_read(&sbi->wb_sync_req[DATA])) ++ else if (atomic_read(&sbi->wb_sync_req[DATA])) { ++ /* to avoid potential deadlock */ ++ if (current->plug) ++ blk_finish_plug(current->plug); + goto skip_write; ++ } + + if (__should_serialize_io(inode, wbc)) { + mutex_lock(&sbi->writepages); +diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c +index 16abb017e497f..68d5c73c5ed1f 100644 +--- a/fs/f2fs/gc.c ++++ b/fs/f2fs/gc.c +@@ -633,8 +633,10 @@ static bool is_alive(struct f2fs_sb_info *sbi, struct f2fs_summary *sum, + set_sbi_flag(sbi, SBI_NEED_FSCK); + } + +- if (f2fs_check_nid_range(sbi, dni->ino)) ++ if (f2fs_check_nid_range(sbi, dni->ino)) { ++ f2fs_put_page(node_page, 1); + return false; ++ } + + *nofs = ofs_of_node(node_page); + source_blkaddr = datablock_addr(NULL, node_page, ofs_in_node); +diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c +index 2383d52b1f424..264c19e177797 100644 +--- a/fs/f2fs/inode.c ++++ b/fs/f2fs/inode.c +@@ -777,6 +777,7 @@ void f2fs_handle_failed_inode(struct inode *inode) + err = f2fs_get_node_info(sbi, inode->i_ino, &ni); + if (err) { + set_sbi_flag(sbi, SBI_NEED_FSCK); ++ set_inode_flag(inode, FI_FREE_NID); + f2fs_warn(sbi, "May loss orphan inode, run fsck to fix."); + goto out; + } +diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c +index 0cd1d51dde06d..3dc7cc3d6ac69 100644 +--- a/fs/f2fs/node.c ++++ b/fs/f2fs/node.c +@@ -1995,8 +1995,12 @@ static int f2fs_write_node_pages(struct address_space *mapping, + + if (wbc->sync_mode == WB_SYNC_ALL) + atomic_inc(&sbi->wb_sync_req[NODE]); +- else if (atomic_read(&sbi->wb_sync_req[NODE])) ++ else if (atomic_read(&sbi->wb_sync_req[NODE])) { ++ /* to avoid potential deadlock */ ++ if (current->plug) ++ blk_finish_plug(current->plug); + goto skip_write; ++ } + + trace_f2fs_writepages(mapping->host, wbc, NODE); + +diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c +index a6c9c9fdf21d1..6bd8a944902ef 100644 +--- a/fs/f2fs/super.c ++++ b/fs/f2fs/super.c +@@ -2066,7 +2066,7 @@ int f2fs_quota_sync(struct super_block *sb, int type) + struct f2fs_sb_info *sbi = F2FS_SB(sb); + struct quota_info *dqopt = sb_dqopt(sb); + int cnt; +- int ret; ++ int ret = 0; + + /* + * Now when everything is written we can discard the pagecache so +@@ -2077,8 +2077,8 @@ int f2fs_quota_sync(struct super_block *sb, int type) + if (type != -1 && cnt != type) + continue; + +- if (!sb_has_quota_active(sb, type)) +- return 0; ++ if (!sb_has_quota_active(sb, cnt)) ++ continue; + + inode_lock(dqopt->files[cnt]); + +diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c +index c056ed5c6df30..d7ec0ac87fc03 100644 +--- a/fs/gfs2/rgrp.c ++++ b/fs/gfs2/rgrp.c +@@ -1429,7 +1429,8 @@ int gfs2_fitrim(struct file *filp, void __user *argp) + + start = r.start >> bs_shift; + end = start + (r.len >> bs_shift); +- minlen = max_t(u64, r.minlen, ++ minlen = max_t(u64, r.minlen, sdp->sd_sb.sb_bsize); ++ minlen = max_t(u64, minlen, + q->limits.discard_granularity) >> bs_shift; + + if (end <= start || minlen > sdp->sd_max_rg_data) +diff --git a/fs/io_uring.c b/fs/io_uring.c +index 478df7e10767a..e73969fa96bcb 100644 +--- a/fs/io_uring.c ++++ b/fs/io_uring.c +@@ -438,6 +438,22 @@ static struct io_ring_ctx *io_ring_ctx_alloc(struct io_uring_params *p) + return ctx; + } + ++static void io_req_put_fs(struct io_kiocb *req) ++{ ++ struct fs_struct *fs = req->fs; ++ ++ if (!fs) ++ return; ++ ++ spin_lock(&req->fs->lock); ++ if (--fs->users) ++ fs = NULL; ++ spin_unlock(&req->fs->lock); ++ if (fs) ++ free_fs_struct(fs); ++ req->fs = NULL; ++} ++ + static inline bool __io_sequence_defer(struct io_ring_ctx *ctx, + struct io_kiocb *req) + { +@@ -695,6 +711,7 @@ static void io_free_req_many(struct io_ring_ctx *ctx, void **reqs, int *nr) + + static void __io_free_req(struct io_kiocb *req) + { ++ io_req_put_fs(req); + if (req->file && !(req->flags & REQ_F_FIXED_FILE)) + fput(req->file); + percpu_ref_put(&req->ctx->refs); +@@ -1701,16 +1718,7 @@ static int io_send_recvmsg(struct io_kiocb *req, const struct io_uring_sqe *sqe, + ret = -EINTR; + } + +- if (req->fs) { +- struct fs_struct *fs = req->fs; +- +- spin_lock(&req->fs->lock); +- if (--fs->users) +- fs = NULL; +- spin_unlock(&req->fs->lock); +- if (fs) +- free_fs_struct(fs); +- } ++ io_req_put_fs(req); + io_cqring_add_event(req->ctx, sqe->user_data, ret); + io_put_req(req); + return 0; +diff --git a/fs/jffs2/build.c b/fs/jffs2/build.c +index b288c8ae1236b..837cd55fd4c5e 100644 +--- a/fs/jffs2/build.c ++++ b/fs/jffs2/build.c +@@ -415,13 +415,15 @@ int jffs2_do_mount_fs(struct jffs2_sb_info *c) + jffs2_free_ino_caches(c); + jffs2_free_raw_node_refs(c); + ret = -EIO; +- goto out_free; ++ goto out_sum_exit; + } + + jffs2_calc_trigger_levels(c); + + return 0; + ++ out_sum_exit: ++ jffs2_sum_exit(c); + out_free: + kvfree(c->blocks); + +diff --git a/fs/jffs2/fs.c b/fs/jffs2/fs.c +index ab8cdd9e93259..ad1eba809e7e1 100644 +--- a/fs/jffs2/fs.c ++++ b/fs/jffs2/fs.c +@@ -602,8 +602,8 @@ out_root: + jffs2_free_ino_caches(c); + jffs2_free_raw_node_refs(c); + kvfree(c->blocks); +- out_inohash: + jffs2_clear_xattr_subsystem(c); ++ out_inohash: + kfree(c->inocache_list); + out_wbuf: + jffs2_flash_cleanup(c); +diff --git a/fs/jffs2/scan.c b/fs/jffs2/scan.c +index 0b1a7f68b7122..f73904c08b39c 100644 +--- a/fs/jffs2/scan.c ++++ b/fs/jffs2/scan.c +@@ -136,7 +136,7 @@ int jffs2_scan_medium(struct jffs2_sb_info *c) + if (!s) { + JFFS2_WARNING("Can't allocate memory for summary\n"); + ret = -ENOMEM; +- goto out; ++ goto out_buf; + } + } + +@@ -274,13 +274,15 @@ int jffs2_scan_medium(struct jffs2_sb_info *c) + } + ret = 0; + out: ++ jffs2_sum_reset_collected(s); ++ kfree(s); ++ out_buf: + if (buf_size) + kfree(flashbuf); + #ifndef __ECOS + else + mtd_unpoint(c->mtd, 0, c->mtd->size); + #endif +- kfree(s); + return ret; + } + +diff --git a/fs/jfs/inode.c b/fs/jfs/inode.c +index d862cfc3d3a83..62c4a5450cda2 100644 +--- a/fs/jfs/inode.c ++++ b/fs/jfs/inode.c +@@ -146,12 +146,13 @@ void jfs_evict_inode(struct inode *inode) + dquot_initialize(inode); + + if (JFS_IP(inode)->fileset == FILESYSTEM_I) { ++ struct inode *ipimap = JFS_SBI(inode->i_sb)->ipimap; + truncate_inode_pages_final(&inode->i_data); + + if (test_cflag(COMMIT_Freewmap, inode)) + jfs_free_zero_link(inode); + +- if (JFS_SBI(inode->i_sb)->ipimap) ++ if (ipimap && JFS_IP(ipimap)->i_imap) + diFree(inode); + + /* +diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c +index 6fe82ce8663ef..79f3440e204b6 100644 +--- a/fs/jfs/jfs_dmap.c ++++ b/fs/jfs/jfs_dmap.c +@@ -148,6 +148,7 @@ static const s8 budtab[256] = { + * 0 - success + * -ENOMEM - insufficient memory + * -EIO - i/o error ++ * -EINVAL - wrong bmap data + */ + int dbMount(struct inode *ipbmap) + { +@@ -179,6 +180,12 @@ int dbMount(struct inode *ipbmap) + bmp->db_nfree = le64_to_cpu(dbmp_le->dn_nfree); + bmp->db_l2nbperpage = le32_to_cpu(dbmp_le->dn_l2nbperpage); + bmp->db_numag = le32_to_cpu(dbmp_le->dn_numag); ++ if (!bmp->db_numag) { ++ release_metapage(mp); ++ kfree(bmp); ++ return -EINVAL; ++ } ++ + bmp->db_maxlevel = le32_to_cpu(dbmp_le->dn_maxlevel); + bmp->db_maxag = le32_to_cpu(dbmp_le->dn_maxag); + bmp->db_agpref = le32_to_cpu(dbmp_le->dn_agpref); +diff --git a/fs/minix/inode.c b/fs/minix/inode.c +index 7b09a9158e401..3fffc709afd43 100644 +--- a/fs/minix/inode.c ++++ b/fs/minix/inode.c +@@ -447,7 +447,8 @@ static const struct address_space_operations minix_aops = { + .writepage = minix_writepage, + .write_begin = minix_write_begin, + .write_end = generic_write_end, +- .bmap = minix_bmap ++ .bmap = minix_bmap, ++ .direct_IO = noop_direct_IO + }; + + static const struct inode_operations minix_symlink_inode_operations = { +diff --git a/fs/nfs/callback_proc.c b/fs/nfs/callback_proc.c +index b8a7b223b5b18..31922657e836e 100644 +--- a/fs/nfs/callback_proc.c ++++ b/fs/nfs/callback_proc.c +@@ -364,12 +364,11 @@ __be32 nfs4_callback_devicenotify(void *argp, void *resp, + struct cb_process_state *cps) + { + struct cb_devicenotifyargs *args = argp; ++ const struct pnfs_layoutdriver_type *ld = NULL; + uint32_t i; + __be32 res = 0; +- struct nfs_client *clp = cps->clp; +- struct nfs_server *server = NULL; + +- if (!clp) { ++ if (!cps->clp) { + res = cpu_to_be32(NFS4ERR_OP_NOT_IN_SESSION); + goto out; + } +@@ -377,23 +376,15 @@ __be32 nfs4_callback_devicenotify(void *argp, void *resp, + for (i = 0; i < args->ndevs; i++) { + struct cb_devicenotifyitem *dev = &args->devs[i]; + +- if (!server || +- server->pnfs_curr_ld->id != dev->cbd_layout_type) { +- rcu_read_lock(); +- list_for_each_entry_rcu(server, &clp->cl_superblocks, client_link) +- if (server->pnfs_curr_ld && +- server->pnfs_curr_ld->id == dev->cbd_layout_type) { +- rcu_read_unlock(); +- goto found; +- } +- rcu_read_unlock(); +- continue; ++ if (!ld || ld->id != dev->cbd_layout_type) { ++ pnfs_put_layoutdriver(ld); ++ ld = pnfs_find_layoutdriver(dev->cbd_layout_type); ++ if (!ld) ++ continue; + } +- +- found: +- nfs4_delete_deviceid(server->pnfs_curr_ld, clp, &dev->cbd_dev_id); ++ nfs4_delete_deviceid(ld, cps->clp, &dev->cbd_dev_id); + } +- ++ pnfs_put_layoutdriver(ld); + out: + kfree(args->devs); + return res; +diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c +index 90b5511c4c440..04d27f0ed39ac 100644 +--- a/fs/nfs/callback_xdr.c ++++ b/fs/nfs/callback_xdr.c +@@ -271,10 +271,6 @@ __be32 decode_devicenotify_args(struct svc_rqst *rqstp, + n = ntohl(*p++); + if (n == 0) + goto out; +- if (n > ULONG_MAX / sizeof(*args->devs)) { +- status = htonl(NFS4ERR_BADXDR); +- goto out; +- } + + args->devs = kmalloc_array(n, sizeof(*args->devs), GFP_KERNEL); + if (!args->devs) { +diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c +index 6b0bf4ebd8124..0682037f972be 100644 +--- a/fs/nfs/direct.c ++++ b/fs/nfs/direct.c +@@ -272,8 +272,8 @@ ssize_t nfs_direct_IO(struct kiocb *iocb, struct iov_iter *iter) + VM_BUG_ON(iov_iter_count(iter) != PAGE_SIZE); + + if (iov_iter_rw(iter) == READ) +- return nfs_file_direct_read(iocb, iter); +- return nfs_file_direct_write(iocb, iter); ++ return nfs_file_direct_read(iocb, iter, true); ++ return nfs_file_direct_write(iocb, iter, true); + } + + static void nfs_direct_release_pages(struct page **pages, unsigned int npages) +@@ -524,6 +524,7 @@ static ssize_t nfs_direct_read_schedule_iovec(struct nfs_direct_req *dreq, + * nfs_file_direct_read - file direct read operation for NFS files + * @iocb: target I/O control block + * @iter: vector of user buffers into which to read data ++ * @swap: flag indicating this is swap IO, not O_DIRECT IO + * + * We use this function for direct reads instead of calling + * generic_file_aio_read() in order to avoid gfar's check to see if +@@ -539,7 +540,8 @@ static ssize_t nfs_direct_read_schedule_iovec(struct nfs_direct_req *dreq, + * client must read the updated atime from the server back into its + * cache. + */ +-ssize_t nfs_file_direct_read(struct kiocb *iocb, struct iov_iter *iter) ++ssize_t nfs_file_direct_read(struct kiocb *iocb, struct iov_iter *iter, ++ bool swap) + { + struct file *file = iocb->ki_filp; + struct address_space *mapping = file->f_mapping; +@@ -581,12 +583,14 @@ ssize_t nfs_file_direct_read(struct kiocb *iocb, struct iov_iter *iter) + if (iter_is_iovec(iter)) + dreq->flags = NFS_ODIRECT_SHOULD_DIRTY; + +- nfs_start_io_direct(inode); ++ if (!swap) ++ nfs_start_io_direct(inode); + + NFS_I(inode)->read_io += count; + requested = nfs_direct_read_schedule_iovec(dreq, iter, iocb->ki_pos); + +- nfs_end_io_direct(inode); ++ if (!swap) ++ nfs_end_io_direct(inode); + + if (requested > 0) { + result = nfs_direct_wait(dreq); +@@ -851,7 +855,7 @@ static const struct nfs_pgio_completion_ops nfs_direct_write_completion_ops = { + */ + static ssize_t nfs_direct_write_schedule_iovec(struct nfs_direct_req *dreq, + struct iov_iter *iter, +- loff_t pos) ++ loff_t pos, int ioflags) + { + struct nfs_pageio_descriptor desc; + struct inode *inode = dreq->inode; +@@ -859,7 +863,7 @@ static ssize_t nfs_direct_write_schedule_iovec(struct nfs_direct_req *dreq, + size_t requested_bytes = 0; + size_t wsize = max_t(size_t, NFS_SERVER(inode)->wsize, PAGE_SIZE); + +- nfs_pageio_init_write(&desc, inode, FLUSH_COND_STABLE, false, ++ nfs_pageio_init_write(&desc, inode, ioflags, false, + &nfs_direct_write_completion_ops); + desc.pg_dreq = dreq; + get_dreq(dreq); +@@ -937,6 +941,7 @@ static ssize_t nfs_direct_write_schedule_iovec(struct nfs_direct_req *dreq, + * nfs_file_direct_write - file direct write operation for NFS files + * @iocb: target I/O control block + * @iter: vector of user buffers from which to write data ++ * @swap: flag indicating this is swap IO, not O_DIRECT IO + * + * We use this function for direct writes instead of calling + * generic_file_aio_write() in order to avoid taking the inode +@@ -953,7 +958,8 @@ static ssize_t nfs_direct_write_schedule_iovec(struct nfs_direct_req *dreq, + * Note that O_APPEND is not supported for NFS direct writes, as there + * is no atomic O_APPEND write facility in the NFS protocol. + */ +-ssize_t nfs_file_direct_write(struct kiocb *iocb, struct iov_iter *iter) ++ssize_t nfs_file_direct_write(struct kiocb *iocb, struct iov_iter *iter, ++ bool swap) + { + ssize_t result = -EINVAL, requested; + size_t count; +@@ -967,7 +973,11 @@ ssize_t nfs_file_direct_write(struct kiocb *iocb, struct iov_iter *iter) + dfprintk(FILE, "NFS: direct write(%pD2, %zd@%Ld)\n", + file, iov_iter_count(iter), (long long) iocb->ki_pos); + +- result = generic_write_checks(iocb, iter); ++ if (swap) ++ /* bypass generic checks */ ++ result = iov_iter_count(iter); ++ else ++ result = generic_write_checks(iocb, iter); + if (result <= 0) + return result; + count = result; +@@ -997,16 +1007,22 @@ ssize_t nfs_file_direct_write(struct kiocb *iocb, struct iov_iter *iter) + if (!is_sync_kiocb(iocb)) + dreq->iocb = iocb; + +- nfs_start_io_direct(inode); ++ if (swap) { ++ requested = nfs_direct_write_schedule_iovec(dreq, iter, pos, ++ FLUSH_STABLE); ++ } else { ++ nfs_start_io_direct(inode); + +- requested = nfs_direct_write_schedule_iovec(dreq, iter, pos); ++ requested = nfs_direct_write_schedule_iovec(dreq, iter, pos, ++ FLUSH_COND_STABLE); + +- if (mapping->nrpages) { +- invalidate_inode_pages2_range(mapping, +- pos >> PAGE_SHIFT, end); +- } ++ if (mapping->nrpages) { ++ invalidate_inode_pages2_range(mapping, ++ pos >> PAGE_SHIFT, end); ++ } + +- nfs_end_io_direct(inode); ++ nfs_end_io_direct(inode); ++ } + + if (requested > 0) { + result = nfs_direct_wait(dreq); +diff --git a/fs/nfs/file.c b/fs/nfs/file.c +index 387a2cfa7e172..73415970af381 100644 +--- a/fs/nfs/file.c ++++ b/fs/nfs/file.c +@@ -161,7 +161,7 @@ nfs_file_read(struct kiocb *iocb, struct iov_iter *to) + ssize_t result; + + if (iocb->ki_flags & IOCB_DIRECT) +- return nfs_file_direct_read(iocb, to); ++ return nfs_file_direct_read(iocb, to, false); + + dprintk("NFS: read(%pD2, %zu@%lu)\n", + iocb->ki_filp, +@@ -609,7 +609,7 @@ ssize_t nfs_file_write(struct kiocb *iocb, struct iov_iter *from) + return result; + + if (iocb->ki_flags & IOCB_DIRECT) +- return nfs_file_direct_write(iocb, from); ++ return nfs_file_direct_write(iocb, from, false); + + dprintk("NFS: write(%pD2, %zu@%Ld)\n", + file, iov_iter_count(from), (long long) iocb->ki_pos); +diff --git a/fs/nfs/nfs2xdr.c b/fs/nfs/nfs2xdr.c +index 887f9136a9db3..af557dc2cfe1d 100644 +--- a/fs/nfs/nfs2xdr.c ++++ b/fs/nfs/nfs2xdr.c +@@ -953,7 +953,7 @@ int nfs2_decode_dirent(struct xdr_stream *xdr, struct nfs_entry *entry, + + error = decode_filename_inline(xdr, &entry->name, &entry->len); + if (unlikely(error)) +- return error; ++ return -EAGAIN; + + /* + * The type (size and byte order) of nfscookie isn't defined in +diff --git a/fs/nfs/nfs3xdr.c b/fs/nfs/nfs3xdr.c +index 23d75cddbb2ee..84369d51353a5 100644 +--- a/fs/nfs/nfs3xdr.c ++++ b/fs/nfs/nfs3xdr.c +@@ -1968,7 +1968,6 @@ int nfs3_decode_dirent(struct xdr_stream *xdr, struct nfs_entry *entry, + bool plus) + { + struct user_namespace *userns = rpc_userns(entry->server->client); +- struct nfs_entry old = *entry; + __be32 *p; + int error; + u64 new_cookie; +@@ -1988,15 +1987,15 @@ int nfs3_decode_dirent(struct xdr_stream *xdr, struct nfs_entry *entry, + + error = decode_fileid3(xdr, &entry->ino); + if (unlikely(error)) +- return error; ++ return -EAGAIN; + + error = decode_inline_filename3(xdr, &entry->name, &entry->len); + if (unlikely(error)) +- return error; ++ return -EAGAIN; + + error = decode_cookie3(xdr, &new_cookie); + if (unlikely(error)) +- return error; ++ return -EAGAIN; + + entry->d_type = DT_UNKNOWN; + +@@ -2004,7 +2003,7 @@ int nfs3_decode_dirent(struct xdr_stream *xdr, struct nfs_entry *entry, + entry->fattr->valid = 0; + error = decode_post_op_attr(xdr, entry->fattr, userns); + if (unlikely(error)) +- return error; ++ return -EAGAIN; + if (entry->fattr->valid & NFS_ATTR_FATTR_V3) + entry->d_type = nfs_umode_to_dtype(entry->fattr->mode); + +@@ -2019,11 +2018,8 @@ int nfs3_decode_dirent(struct xdr_stream *xdr, struct nfs_entry *entry, + return -EAGAIN; + if (*p != xdr_zero) { + error = decode_nfs_fh3(xdr, entry->fh); +- if (unlikely(error)) { +- if (error == -E2BIG) +- goto out_truncated; +- return error; +- } ++ if (unlikely(error)) ++ return -EAGAIN; + } else + zero_nfs_fh3(entry->fh); + } +@@ -2032,11 +2028,6 @@ int nfs3_decode_dirent(struct xdr_stream *xdr, struct nfs_entry *entry, + entry->cookie = new_cookie; + + return 0; +- +-out_truncated: +- dprintk("NFS: directory entry contains invalid file handle\n"); +- *entry = old; +- return -EAGAIN; + } + + /* +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index fb3d1532f11dd..76baf7b441f3c 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -7918,6 +7918,7 @@ nfs4_bind_one_conn_to_session_done(struct rpc_task *task, void *calldata) + case -NFS4ERR_DEADSESSION: + nfs4_schedule_session_recovery(clp->cl_session, + task->tk_status); ++ return; + } + if (args->dir == NFS4_CDFC4_FORE_OR_BOTH && + res->dir != NFS4_CDFS4_BOTH) { +diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c +index aa2caba38a014..1d2b81a233bbb 100644 +--- a/fs/nfs/nfs4state.c ++++ b/fs/nfs/nfs4state.c +@@ -49,6 +49,7 @@ + #include <linux/workqueue.h> + #include <linux/bitops.h> + #include <linux/jiffies.h> ++#include <linux/sched/mm.h> + + #include <linux/sunrpc/clnt.h> + +@@ -2504,9 +2505,17 @@ static int nfs4_bind_conn_to_session(struct nfs_client *clp) + + static void nfs4_state_manager(struct nfs_client *clp) + { ++ unsigned int memflags; + int status = 0; + const char *section = "", *section_sep = ""; + ++ /* ++ * State recovery can deadlock if the direct reclaim code tries ++ * start NFS writeback. So ensure memory allocations are all ++ * GFP_NOFS. ++ */ ++ memflags = memalloc_nofs_save(); ++ + /* Ensure exclusive access to NFSv4 state */ + do { + clear_bit(NFS4CLNT_RUN_MANAGER, &clp->cl_state); +@@ -2600,6 +2609,7 @@ static void nfs4_state_manager(struct nfs_client *clp) + clear_bit(NFS4CLNT_RECLAIM_NOGRACE, &clp->cl_state); + } + ++ memalloc_nofs_restore(memflags); + nfs4_end_drain_session(clp); + nfs4_clear_state_manager_bit(clp); + +@@ -2616,6 +2626,7 @@ static void nfs4_state_manager(struct nfs_client *clp) + return; + if (test_and_set_bit(NFS4CLNT_MANAGER_RUNNING, &clp->cl_state) != 0) + return; ++ memflags = memalloc_nofs_save(); + } while (refcount_read(&clp->cl_count) > 1 && !signalled()); + goto out_drain; + +@@ -2627,6 +2638,7 @@ out_error: + clp->cl_hostname, -status); + ssleep(1); + out_drain: ++ memalloc_nofs_restore(memflags); + nfs4_end_drain_session(clp); + nfs4_clear_state_manager_bit(clp); + } +diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c +index 1b512df1003f9..0471b6e0da16f 100644 +--- a/fs/nfs/pnfs.c ++++ b/fs/nfs/pnfs.c +@@ -92,6 +92,17 @@ find_pnfs_driver(u32 id) + return local; + } + ++const struct pnfs_layoutdriver_type *pnfs_find_layoutdriver(u32 id) ++{ ++ return find_pnfs_driver(id); ++} ++ ++void pnfs_put_layoutdriver(const struct pnfs_layoutdriver_type *ld) ++{ ++ if (ld) ++ module_put(ld->owner); ++} ++ + void + unset_pnfs_layoutdriver(struct nfs_server *nfss) + { +diff --git a/fs/nfs/pnfs.h b/fs/nfs/pnfs.h +index 3d55edd6b25ad..68339680bb7d1 100644 +--- a/fs/nfs/pnfs.h ++++ b/fs/nfs/pnfs.h +@@ -226,6 +226,8 @@ struct pnfs_devicelist { + + extern int pnfs_register_layoutdriver(struct pnfs_layoutdriver_type *); + extern void pnfs_unregister_layoutdriver(struct pnfs_layoutdriver_type *); ++extern const struct pnfs_layoutdriver_type *pnfs_find_layoutdriver(u32 id); ++extern void pnfs_put_layoutdriver(const struct pnfs_layoutdriver_type *ld); + + /* nfs4proc.c */ + extern size_t max_response_pages(struct nfs_server *server); +diff --git a/fs/nfsd/nfsproc.c b/fs/nfsd/nfsproc.c +index 754c763374dd5..4aca93e11af77 100644 +--- a/fs/nfsd/nfsproc.c ++++ b/fs/nfsd/nfsproc.c +@@ -230,7 +230,7 @@ nfsd_proc_write(struct svc_rqst *rqstp) + unsigned long cnt = argp->len; + unsigned int nvecs; + +- dprintk("nfsd: WRITE %s %d bytes at %d\n", ++ dprintk("nfsd: WRITE %s %u bytes at %d\n", + SVCFH_fmt(&argp->fh), + argp->len, argp->offset); + +diff --git a/fs/nfsd/xdr.h b/fs/nfsd/xdr.h +index ea7cca3a64b76..6251d8754c82b 100644 +--- a/fs/nfsd/xdr.h ++++ b/fs/nfsd/xdr.h +@@ -33,7 +33,7 @@ struct nfsd_readargs { + struct nfsd_writeargs { + svc_fh fh; + __u32 offset; +- int len; ++ __u32 len; + struct kvec first; + }; + +diff --git a/fs/ntfs/inode.c b/fs/ntfs/inode.c +index ea18e4a2a691d..cf222c9225d6d 100644 +--- a/fs/ntfs/inode.c ++++ b/fs/ntfs/inode.c +@@ -1881,6 +1881,10 @@ int ntfs_read_inode_mount(struct inode *vi) + } + /* Now allocate memory for the attribute list. */ + ni->attr_list_size = (u32)ntfs_attr_size(a); ++ if (!ni->attr_list_size) { ++ ntfs_error(sb, "Attr_list_size is zero"); ++ goto put_err_out; ++ } + ni->attr_list = ntfs_malloc_nofs(ni->attr_list_size); + if (!ni->attr_list) { + ntfs_error(sb, "Not enough memory to allocate buffer " +diff --git a/fs/ubifs/dir.c b/fs/ubifs/dir.c +index eeb93f009b282..83a173feb6989 100644 +--- a/fs/ubifs/dir.c ++++ b/fs/ubifs/dir.c +@@ -361,15 +361,18 @@ static int do_tmpfile(struct inode *dir, struct dentry *dentry, + { + struct inode *inode; + struct ubifs_info *c = dir->i_sb->s_fs_info; +- struct ubifs_budget_req req = { .new_ino = 1, .new_dent = 1}; ++ struct ubifs_budget_req req = { .new_ino = 1, .new_dent = 1, ++ .dirtied_ino = 1}; + struct ubifs_budget_req ino_req = { .dirtied_ino = 1 }; + struct ubifs_inode *ui, *dir_ui = ubifs_inode(dir); + int err, instantiated = 0; + struct fscrypt_name nm; + + /* +- * Budget request settings: new dirty inode, new direntry, +- * budget for dirtied inode will be released via writeback. ++ * Budget request settings: new inode, new direntry, changing the ++ * parent directory inode. ++ * Allocate budget separately for new dirtied inode, the budget will ++ * be released via writeback. + */ + + dbg_gen("dent '%pd', mode %#hx in dir ino %lu", +@@ -439,6 +442,8 @@ out_inode: + make_bad_inode(inode); + if (!instantiated) + iput(inode); ++ else if (whiteout) ++ iput(*whiteout); + out_budg: + ubifs_release_budget(c, &req); + if (!instantiated) +@@ -955,7 +960,8 @@ static int ubifs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode) + struct ubifs_inode *dir_ui = ubifs_inode(dir); + struct ubifs_info *c = dir->i_sb->s_fs_info; + int err, sz_change; +- struct ubifs_budget_req req = { .new_ino = 1, .new_dent = 1 }; ++ struct ubifs_budget_req req = { .new_ino = 1, .new_dent = 1, ++ .dirtied_ino = 1}; + struct fscrypt_name nm; + + /* +@@ -1330,6 +1336,7 @@ static int do_rename(struct inode *old_dir, struct dentry *old_dentry, + + if (flags & RENAME_WHITEOUT) { + union ubifs_dev_desc *dev = NULL; ++ struct ubifs_budget_req wht_req; + + dev = kmalloc(sizeof(union ubifs_dev_desc), GFP_NOFS); + if (!dev) { +@@ -1351,6 +1358,23 @@ static int do_rename(struct inode *old_dir, struct dentry *old_dentry, + whiteout_ui->data = dev; + whiteout_ui->data_len = ubifs_encode_dev(dev, MKDEV(0, 0)); + ubifs_assert(c, !whiteout_ui->dirty); ++ ++ memset(&wht_req, 0, sizeof(struct ubifs_budget_req)); ++ wht_req.dirtied_ino = 1; ++ wht_req.dirtied_ino_d = ALIGN(whiteout_ui->data_len, 8); ++ /* ++ * To avoid deadlock between space budget (holds ui_mutex and ++ * waits wb work) and writeback work(waits ui_mutex), do space ++ * budget before ubifs inodes locked. ++ */ ++ err = ubifs_budget_space(c, &wht_req); ++ if (err) { ++ iput(whiteout); ++ goto out_release; ++ } ++ ++ /* Add the old_dentry size to the old_dir size. */ ++ old_sz -= CALC_DENT_SIZE(fname_len(&old_nm)); + } + + lock_4_inodes(old_dir, new_dir, new_inode, whiteout); +@@ -1425,18 +1449,6 @@ static int do_rename(struct inode *old_dir, struct dentry *old_dentry, + } + + if (whiteout) { +- struct ubifs_budget_req wht_req = { .dirtied_ino = 1, +- .dirtied_ino_d = \ +- ALIGN(ubifs_inode(whiteout)->data_len, 8) }; +- +- err = ubifs_budget_space(c, &wht_req); +- if (err) { +- kfree(whiteout_ui->data); +- whiteout_ui->data_len = 0; +- iput(whiteout); +- goto out_release; +- } +- + inc_nlink(whiteout); + mark_inode_dirty(whiteout); + +diff --git a/fs/ubifs/io.c b/fs/ubifs/io.c +index eae9cf5a57b05..89b671ad0f9aa 100644 +--- a/fs/ubifs/io.c ++++ b/fs/ubifs/io.c +@@ -846,16 +846,42 @@ int ubifs_wbuf_write_nolock(struct ubifs_wbuf *wbuf, void *buf, int len) + */ + n = aligned_len >> c->max_write_shift; + if (n) { +- n <<= c->max_write_shift; ++ int m = n - 1; ++ + dbg_io("write %d bytes to LEB %d:%d", n, wbuf->lnum, + wbuf->offs); +- err = ubifs_leb_write(c, wbuf->lnum, buf + written, +- wbuf->offs, n); ++ ++ if (m) { ++ /* '(n-1)<<c->max_write_shift < len' is always true. */ ++ m <<= c->max_write_shift; ++ err = ubifs_leb_write(c, wbuf->lnum, buf + written, ++ wbuf->offs, m); ++ if (err) ++ goto out; ++ wbuf->offs += m; ++ aligned_len -= m; ++ len -= m; ++ written += m; ++ } ++ ++ /* ++ * The non-written len of buf may be less than 'n' because ++ * parameter 'len' is not 8 bytes aligned, so here we read ++ * min(len, n) bytes from buf. ++ */ ++ n = 1 << c->max_write_shift; ++ memcpy(wbuf->buf, buf + written, min(len, n)); ++ if (n > len) { ++ ubifs_assert(c, n - len < 8); ++ ubifs_pad(c, wbuf->buf + len, n - len); ++ } ++ ++ err = ubifs_leb_write(c, wbuf->lnum, wbuf->buf, wbuf->offs, n); + if (err) + goto out; + wbuf->offs += n; + aligned_len -= n; +- len -= n; ++ len -= min(len, n); + written += n; + } + +diff --git a/fs/ubifs/ioctl.c b/fs/ubifs/ioctl.c +index eeb1be2598881..2923d5a6a7c0b 100644 +--- a/fs/ubifs/ioctl.c ++++ b/fs/ubifs/ioctl.c +@@ -101,7 +101,7 @@ static int setflags(struct inode *inode, int flags) + struct ubifs_inode *ui = ubifs_inode(inode); + struct ubifs_info *c = inode->i_sb->s_fs_info; + struct ubifs_budget_req req = { .dirtied_ino = 1, +- .dirtied_ino_d = ui->data_len }; ++ .dirtied_ino_d = ALIGN(ui->data_len, 8) }; + + err = ubifs_budget_space(c, &req); + if (err) +diff --git a/include/linux/blk-cgroup.h b/include/linux/blk-cgroup.h +index bed9e43f94260..46139c0f510fa 100644 +--- a/include/linux/blk-cgroup.h ++++ b/include/linux/blk-cgroup.h +@@ -22,6 +22,7 @@ + #include <linux/atomic.h> + #include <linux/kthread.h> + #include <linux/fs.h> ++#include <linux/blkdev.h> + + /* percpu_counter batch for blkg_[rw]stats, per-cpu drift doesn't matter */ + #define BLKG_STAT_CPU_BATCH (INT_MAX / 2) +@@ -768,6 +769,21 @@ static inline void blkcg_use_delay(struct blkcg_gq *blkg) + atomic_inc(&blkg->blkcg->css.cgroup->congestion_count); + } + ++/** ++ * blk_cgroup_mergeable - Determine whether to allow or disallow merges ++ * @rq: request to merge into ++ * @bio: bio to merge ++ * ++ * @bio and @rq should belong to the same cgroup and their issue_as_root should ++ * match. The latter is necessary as we don't want to throttle e.g. a metadata ++ * update because it happens to be next to a regular IO. ++ */ ++static inline bool blk_cgroup_mergeable(struct request *rq, struct bio *bio) ++{ ++ return rq->bio->bi_blkg == bio->bi_blkg && ++ bio_issue_as_root_blkg(rq->bio) == bio_issue_as_root_blkg(bio); ++} ++ + static inline int blkcg_unuse_delay(struct blkcg_gq *blkg) + { + int old = atomic_read(&blkg->use_delay); +@@ -868,6 +884,7 @@ static inline bool blkcg_punt_bio_submit(struct bio *bio) { return false; } + static inline void blkcg_bio_issue_init(struct bio *bio) { } + static inline bool blkcg_bio_issue_check(struct request_queue *q, + struct bio *bio) { return true; } ++static inline bool blk_cgroup_mergeable(struct request *rq, struct bio *bio) { return true; } + + #define blk_queue_for_each_rl(rl, q) \ + for ((rl) = &(q)->root_rl; (rl); (rl) = NULL) +diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h +index d5338b9ee5502..8cc766743270f 100644 +--- a/include/linux/blkdev.h ++++ b/include/linux/blkdev.h +@@ -59,6 +59,14 @@ struct blk_stat_callback; + */ + #define BLKCG_MAX_POLS 5 + ++static inline int blk_validate_block_size(unsigned int bsize) ++{ ++ if (bsize < 512 || bsize > PAGE_SIZE || !is_power_of_2(bsize)) ++ return -EINVAL; ++ ++ return 0; ++} ++ + typedef void (rq_end_io_fn)(struct request *, blk_status_t); + + /* +diff --git a/include/linux/dma-mapping.h b/include/linux/dma-mapping.h +index 4d450672b7d66..da90f20e11c1c 100644 +--- a/include/linux/dma-mapping.h ++++ b/include/linux/dma-mapping.h +@@ -70,6 +70,14 @@ + */ + #define DMA_ATTR_PRIVILEGED (1UL << 9) + ++/* ++ * This is a hint to the DMA-mapping subsystem that the device is expected ++ * to overwrite the entire mapped size, thus the caller does not require any ++ * of the previous buffer contents to be preserved. This allows ++ * bounce-buffering implementations to optimise DMA_FROM_DEVICE transfers. ++ */ ++#define DMA_ATTR_OVERWRITE (1UL << 10) ++ + /* + * A dma_addr_t can hold any valid DMA or bus address for the platform. + * It can be given to a device to use as a DMA source or target. A CPU cannot +diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h +index bbe297bbbca52..d5c507311efb1 100644 +--- a/include/linux/ipv6.h ++++ b/include/linux/ipv6.h +@@ -50,7 +50,7 @@ struct ipv6_devconf { + __s32 use_optimistic; + #endif + #ifdef CONFIG_IPV6_MROUTE +- __s32 mc_forwarding; ++ atomic_t mc_forwarding; + #endif + __s32 disable_ipv6; + __s32 drop_unicast_in_l2_multicast; +diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h +index bc8a70a7c5a13..e4f9df955040f 100644 +--- a/include/linux/mmzone.h ++++ b/include/linux/mmzone.h +@@ -1250,13 +1250,16 @@ static inline unsigned long *section_to_usemap(struct mem_section *ms) + + static inline struct mem_section *__nr_to_section(unsigned long nr) + { ++ unsigned long root = SECTION_NR_TO_ROOT(nr); ++ ++ if (unlikely(root >= NR_SECTION_ROOTS)) ++ return NULL; ++ + #ifdef CONFIG_SPARSEMEM_EXTREME +- if (!mem_section) ++ if (!mem_section || !mem_section[root]) + return NULL; + #endif +- if (!mem_section[SECTION_NR_TO_ROOT(nr)]) +- return NULL; +- return &mem_section[SECTION_NR_TO_ROOT(nr)][nr & SECTION_ROOT_MASK]; ++ return &mem_section[root][nr & SECTION_ROOT_MASK]; + } + extern unsigned long __section_nr(struct mem_section *ms); + extern size_t mem_section_usage_size(void); +diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h +index 288a586782563..c70b79dba1dc1 100644 +--- a/include/linux/netdevice.h ++++ b/include/linux/netdevice.h +@@ -3777,7 +3777,8 @@ void netdev_run_todo(void); + */ + static inline void dev_put(struct net_device *dev) + { +- this_cpu_dec(*dev->pcpu_refcnt); ++ if (dev) ++ this_cpu_dec(*dev->pcpu_refcnt); + } + + /** +@@ -3788,7 +3789,8 @@ static inline void dev_put(struct net_device *dev) + */ + static inline void dev_hold(struct net_device *dev) + { +- this_cpu_inc(*dev->pcpu_refcnt); ++ if (dev) ++ this_cpu_inc(*dev->pcpu_refcnt); + } + + /* Carrier loss detection, dial on demand. The functions netif_carrier_on +diff --git a/include/linux/nfs_fs.h b/include/linux/nfs_fs.h +index 978ef674f0388..49cf5c855cbe5 100644 +--- a/include/linux/nfs_fs.h ++++ b/include/linux/nfs_fs.h +@@ -480,10 +480,10 @@ static inline const struct cred *nfs_file_cred(struct file *file) + * linux/fs/nfs/direct.c + */ + extern ssize_t nfs_direct_IO(struct kiocb *, struct iov_iter *); +-extern ssize_t nfs_file_direct_read(struct kiocb *iocb, +- struct iov_iter *iter); +-extern ssize_t nfs_file_direct_write(struct kiocb *iocb, +- struct iov_iter *iter); ++ssize_t nfs_file_direct_read(struct kiocb *iocb, ++ struct iov_iter *iter, bool swap); ++ssize_t nfs_file_direct_write(struct kiocb *iocb, ++ struct iov_iter *iter, bool swap); + + /* + * linux/fs/nfs/dir.c +diff --git a/include/linux/pci.h b/include/linux/pci.h +index bc35b15efadd0..fc343d123127b 100644 +--- a/include/linux/pci.h ++++ b/include/linux/pci.h +@@ -604,6 +604,7 @@ struct pci_bus { + struct bin_attribute *legacy_io; /* Legacy I/O for this bus */ + struct bin_attribute *legacy_mem; /* Legacy mem */ + unsigned int is_added:1; ++ unsigned int unsafe_warn:1; /* warned about RW1C config write */ + }; + + #define to_pci_bus(n) container_of(n, struct pci_bus, dev) +diff --git a/include/linux/sunrpc/xdr.h b/include/linux/sunrpc/xdr.h +index a8d68c5a4ca61..fb0a6d6c91e48 100644 +--- a/include/linux/sunrpc/xdr.h ++++ b/include/linux/sunrpc/xdr.h +@@ -536,6 +536,8 @@ xdr_stream_decode_uint32_array(struct xdr_stream *xdr, + + if (unlikely(xdr_stream_decode_u32(xdr, &len) < 0)) + return -EBADMSG; ++ if (len > SIZE_MAX / sizeof(*p)) ++ return -EBADMSG; + p = xdr_inline_decode(xdr, len * sizeof(*p)); + if (unlikely(!p)) + return -EBADMSG; +diff --git a/include/net/arp.h b/include/net/arp.h +index 4950191f6b2bf..4a23a97195f33 100644 +--- a/include/net/arp.h ++++ b/include/net/arp.h +@@ -71,6 +71,7 @@ void arp_send(int type, int ptype, __be32 dest_ip, + const unsigned char *src_hw, const unsigned char *th); + int arp_mc_map(__be32 addr, u8 *haddr, struct net_device *dev, int dir); + void arp_ifdown(struct net_device *dev); ++int arp_invalidate(struct net_device *dev, __be32 ip, bool force); + + struct sk_buff *arp_create(int type, int ptype, __be32 dest_ip, + struct net_device *dev, __be32 src_ip, +diff --git a/include/net/udp.h b/include/net/udp.h +index d9d39cc20a847..9787a42f7ed3e 100644 +--- a/include/net/udp.h ++++ b/include/net/udp.h +@@ -459,6 +459,7 @@ void udp_init(void); + + DECLARE_STATIC_KEY_FALSE(udp_encap_needed_key); + void udp_encap_enable(void); ++void udp_encap_disable(void); + #if IS_ENABLED(CONFIG_IPV6) + DECLARE_STATIC_KEY_FALSE(udpv6_encap_needed_key); + void udpv6_encap_enable(void); +diff --git a/include/net/udp_tunnel.h b/include/net/udp_tunnel.h +index 4b1f95e083070..27bf9f4dd1d45 100644 +--- a/include/net/udp_tunnel.h ++++ b/include/net/udp_tunnel.h +@@ -178,9 +178,8 @@ static inline void udp_tunnel_encap_enable(struct socket *sock) + #if IS_ENABLED(CONFIG_IPV6) + if (sock->sk->sk_family == PF_INET6) + ipv6_stub->udpv6_encap_enable(); +- else + #endif +- udp_encap_enable(); ++ udp_encap_enable(); + } + + #endif +diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h +index 63038eb23560b..cb0631098f918 100644 +--- a/include/uapi/linux/bpf.h ++++ b/include/uapi/linux/bpf.h +@@ -1294,8 +1294,8 @@ union bpf_attr { + * Return + * The return value depends on the result of the test, and can be: + * +- * * 0, if current task belongs to the cgroup2. +- * * 1, if current task does not belong to the cgroup2. ++ * * 1, if current task belongs to the cgroup2. ++ * * 0, if current task does not belong to the cgroup2. + * * A negative error code, if an error occurred. + * + * int bpf_skb_change_tail(struct sk_buff *skb, u32 len, u64 flags) +@@ -3068,7 +3068,8 @@ struct bpf_sock { + __u32 src_ip4; + __u32 src_ip6[4]; + __u32 src_port; /* host byte order */ +- __u32 dst_port; /* network byte order */ ++ __be16 dst_port; /* network byte order */ ++ __u16 :16; /* zero padding */ + __u32 dst_ip4; + __u32 dst_ip6[4]; + __u32 state; +diff --git a/init/main.c b/init/main.c +index e6a1fb14f3085..d292daabd9a22 100644 +--- a/init/main.c ++++ b/init/main.c +@@ -831,7 +831,7 @@ static int __init initcall_blacklist(char *str) + } + } while (str_entry); + +- return 0; ++ return 1; + } + + static bool __init_or_module initcall_blacklisted(initcall_t fn) +@@ -1072,7 +1072,9 @@ static noinline void __init kernel_init_freeable(void); + bool rodata_enabled __ro_after_init = true; + static int __init set_debug_rodata(char *str) + { +- return strtobool(str, &rodata_enabled); ++ if (strtobool(str, &rodata_enabled)) ++ pr_warn("Invalid option string for rodata: '%s'\n", str); ++ return 1; + } + __setup("rodata=", set_debug_rodata); + #endif +diff --git a/kernel/audit.h b/kernel/audit.h +index ddc22878433d0..fed8e93ce1699 100644 +--- a/kernel/audit.h ++++ b/kernel/audit.h +@@ -191,6 +191,10 @@ struct audit_context { + struct { + char *name; + } module; ++ struct { ++ struct audit_ntp_data ntp_data; ++ struct timespec64 tk_injoffset; ++ } time; + }; + int fds[2]; + struct audit_proctitle proctitle; +diff --git a/kernel/auditsc.c b/kernel/auditsc.c +index d33c5dccde1c7..e8e90c0c49367 100644 +--- a/kernel/auditsc.c ++++ b/kernel/auditsc.c +@@ -1185,6 +1185,53 @@ static void audit_log_fcaps(struct audit_buffer *ab, struct audit_names *name) + from_kuid(&init_user_ns, name->fcap.rootid)); + } + ++static void audit_log_time(struct audit_context *context, struct audit_buffer **ab) ++{ ++ const struct audit_ntp_data *ntp = &context->time.ntp_data; ++ const struct timespec64 *tk = &context->time.tk_injoffset; ++ static const char * const ntp_name[] = { ++ "offset", ++ "freq", ++ "status", ++ "tai", ++ "tick", ++ "adjust", ++ }; ++ int type; ++ ++ if (context->type == AUDIT_TIME_ADJNTPVAL) { ++ for (type = 0; type < AUDIT_NTP_NVALS; type++) { ++ if (ntp->vals[type].newval != ntp->vals[type].oldval) { ++ if (!*ab) { ++ *ab = audit_log_start(context, ++ GFP_KERNEL, ++ AUDIT_TIME_ADJNTPVAL); ++ if (!*ab) ++ return; ++ } ++ audit_log_format(*ab, "op=%s old=%lli new=%lli", ++ ntp_name[type], ++ ntp->vals[type].oldval, ++ ntp->vals[type].newval); ++ audit_log_end(*ab); ++ *ab = NULL; ++ } ++ } ++ } ++ if (tk->tv_sec != 0 || tk->tv_nsec != 0) { ++ if (!*ab) { ++ *ab = audit_log_start(context, GFP_KERNEL, ++ AUDIT_TIME_INJOFFSET); ++ if (!*ab) ++ return; ++ } ++ audit_log_format(*ab, "sec=%lli nsec=%li", ++ (long long)tk->tv_sec, tk->tv_nsec); ++ audit_log_end(*ab); ++ *ab = NULL; ++ } ++} ++ + static void show_special(struct audit_context *context, int *call_panic) + { + struct audit_buffer *ab; +@@ -1290,6 +1337,11 @@ static void show_special(struct audit_context *context, int *call_panic) + audit_log_format(ab, "(null)"); + + break; ++ case AUDIT_TIME_ADJNTPVAL: ++ case AUDIT_TIME_INJOFFSET: ++ /* this call deviates from the rest, eating the buffer */ ++ audit_log_time(context, &ab); ++ break; + } + audit_log_end(ab); + } +@@ -2518,31 +2570,26 @@ void __audit_fanotify(unsigned int response) + + void __audit_tk_injoffset(struct timespec64 offset) + { +- audit_log(audit_context(), GFP_KERNEL, AUDIT_TIME_INJOFFSET, +- "sec=%lli nsec=%li", +- (long long)offset.tv_sec, offset.tv_nsec); +-} +- +-static void audit_log_ntp_val(const struct audit_ntp_data *ad, +- const char *op, enum audit_ntp_type type) +-{ +- const struct audit_ntp_val *val = &ad->vals[type]; +- +- if (val->newval == val->oldval) +- return; ++ struct audit_context *context = audit_context(); + +- audit_log(audit_context(), GFP_KERNEL, AUDIT_TIME_ADJNTPVAL, +- "op=%s old=%lli new=%lli", op, val->oldval, val->newval); ++ /* only set type if not already set by NTP */ ++ if (!context->type) ++ context->type = AUDIT_TIME_INJOFFSET; ++ memcpy(&context->time.tk_injoffset, &offset, sizeof(offset)); + } + + void __audit_ntp_log(const struct audit_ntp_data *ad) + { +- audit_log_ntp_val(ad, "offset", AUDIT_NTP_OFFSET); +- audit_log_ntp_val(ad, "freq", AUDIT_NTP_FREQ); +- audit_log_ntp_val(ad, "status", AUDIT_NTP_STATUS); +- audit_log_ntp_val(ad, "tai", AUDIT_NTP_TAI); +- audit_log_ntp_val(ad, "tick", AUDIT_NTP_TICK); +- audit_log_ntp_val(ad, "adjust", AUDIT_NTP_ADJUST); ++ struct audit_context *context = audit_context(); ++ int type; ++ ++ for (type = 0; type < AUDIT_NTP_NVALS; type++) ++ if (ad->vals[type].newval != ad->vals[type].oldval) { ++ /* unconditionally set type, overwriting TK */ ++ context->type = AUDIT_TIME_ADJNTPVAL; ++ memcpy(&context->time.ntp_data, ad, sizeof(*ad)); ++ break; ++ } + } + + static void audit_log_task(struct audit_buffer *ab) +diff --git a/kernel/cgroup/cgroup-internal.h b/kernel/cgroup/cgroup-internal.h +index 809e34a3c0172..236f290224aae 100644 +--- a/kernel/cgroup/cgroup-internal.h ++++ b/kernel/cgroup/cgroup-internal.h +@@ -65,6 +65,25 @@ static inline struct cgroup_fs_context *cgroup_fc2context(struct fs_context *fc) + return container_of(kfc, struct cgroup_fs_context, kfc); + } + ++struct cgroup_pidlist; ++ ++struct cgroup_file_ctx { ++ struct cgroup_namespace *ns; ++ ++ struct { ++ void *trigger; ++ } psi; ++ ++ struct { ++ bool started; ++ struct css_task_iter iter; ++ } procs; ++ ++ struct { ++ struct cgroup_pidlist *pidlist; ++ } procs1; ++}; ++ + /* + * A cgroup can be associated with multiple css_sets as different tasks may + * belong to different cgroups on different hierarchies. In the other +diff --git a/kernel/cgroup/cgroup-v1.c b/kernel/cgroup/cgroup-v1.c +index 5e465c4b1e64c..117d70098cd49 100644 +--- a/kernel/cgroup/cgroup-v1.c ++++ b/kernel/cgroup/cgroup-v1.c +@@ -398,6 +398,7 @@ static void *cgroup_pidlist_start(struct seq_file *s, loff_t *pos) + * next pid to display, if any + */ + struct kernfs_open_file *of = s->private; ++ struct cgroup_file_ctx *ctx = of->priv; + struct cgroup *cgrp = seq_css(s)->cgroup; + struct cgroup_pidlist *l; + enum cgroup_filetype type = seq_cft(s)->private; +@@ -407,25 +408,24 @@ static void *cgroup_pidlist_start(struct seq_file *s, loff_t *pos) + mutex_lock(&cgrp->pidlist_mutex); + + /* +- * !NULL @of->priv indicates that this isn't the first start() +- * after open. If the matching pidlist is around, we can use that. +- * Look for it. Note that @of->priv can't be used directly. It +- * could already have been destroyed. ++ * !NULL @ctx->procs1.pidlist indicates that this isn't the first ++ * start() after open. If the matching pidlist is around, we can use ++ * that. Look for it. Note that @ctx->procs1.pidlist can't be used ++ * directly. It could already have been destroyed. + */ +- if (of->priv) +- of->priv = cgroup_pidlist_find(cgrp, type); ++ if (ctx->procs1.pidlist) ++ ctx->procs1.pidlist = cgroup_pidlist_find(cgrp, type); + + /* + * Either this is the first start() after open or the matching + * pidlist has been destroyed inbetween. Create a new one. + */ +- if (!of->priv) { +- ret = pidlist_array_load(cgrp, type, +- (struct cgroup_pidlist **)&of->priv); ++ if (!ctx->procs1.pidlist) { ++ ret = pidlist_array_load(cgrp, type, &ctx->procs1.pidlist); + if (ret) + return ERR_PTR(ret); + } +- l = of->priv; ++ l = ctx->procs1.pidlist; + + if (pid) { + int end = l->length; +@@ -453,7 +453,8 @@ static void *cgroup_pidlist_start(struct seq_file *s, loff_t *pos) + static void cgroup_pidlist_stop(struct seq_file *s, void *v) + { + struct kernfs_open_file *of = s->private; +- struct cgroup_pidlist *l = of->priv; ++ struct cgroup_file_ctx *ctx = of->priv; ++ struct cgroup_pidlist *l = ctx->procs1.pidlist; + + if (l) + mod_delayed_work(cgroup_pidlist_destroy_wq, &l->destroy_dwork, +@@ -464,7 +465,8 @@ static void cgroup_pidlist_stop(struct seq_file *s, void *v) + static void *cgroup_pidlist_next(struct seq_file *s, void *v, loff_t *pos) + { + struct kernfs_open_file *of = s->private; +- struct cgroup_pidlist *l = of->priv; ++ struct cgroup_file_ctx *ctx = of->priv; ++ struct cgroup_pidlist *l = ctx->procs1.pidlist; + pid_t *p = v; + pid_t *end = l->list + l->length; + /* +@@ -507,10 +509,11 @@ static ssize_t __cgroup1_procs_write(struct kernfs_open_file *of, + goto out_unlock; + + /* +- * Even if we're attaching all tasks in the thread group, we only +- * need to check permissions on one of them. ++ * Even if we're attaching all tasks in the thread group, we only need ++ * to check permissions on one of them. Check permissions using the ++ * credentials from file open to protect against inherited fd attacks. + */ +- cred = current_cred(); ++ cred = of->file->f_cred; + tcred = get_task_cred(task); + if (!uid_eq(cred->euid, GLOBAL_ROOT_UID) && + !uid_eq(cred->euid, tcred->uid) && +diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c +index ce1745ac7b8c0..177d57ce90164 100644 +--- a/kernel/cgroup/cgroup.c ++++ b/kernel/cgroup/cgroup.c +@@ -3648,6 +3648,7 @@ static int cgroup_cpu_pressure_show(struct seq_file *seq, void *v) + static ssize_t cgroup_pressure_write(struct kernfs_open_file *of, char *buf, + size_t nbytes, enum psi_res res) + { ++ struct cgroup_file_ctx *ctx = of->priv; + struct psi_trigger *new; + struct cgroup *cgrp; + struct psi_group *psi; +@@ -3660,7 +3661,7 @@ static ssize_t cgroup_pressure_write(struct kernfs_open_file *of, char *buf, + cgroup_kn_unlock(of->kn); + + /* Allow only one trigger per file descriptor */ +- if (of->priv) { ++ if (ctx->psi.trigger) { + cgroup_put(cgrp); + return -EBUSY; + } +@@ -3672,7 +3673,7 @@ static ssize_t cgroup_pressure_write(struct kernfs_open_file *of, char *buf, + return PTR_ERR(new); + } + +- smp_store_release(&of->priv, new); ++ smp_store_release(&ctx->psi.trigger, new); + cgroup_put(cgrp); + + return nbytes; +@@ -3702,12 +3703,15 @@ static ssize_t cgroup_cpu_pressure_write(struct kernfs_open_file *of, + static __poll_t cgroup_pressure_poll(struct kernfs_open_file *of, + poll_table *pt) + { +- return psi_trigger_poll(&of->priv, of->file, pt); ++ struct cgroup_file_ctx *ctx = of->priv; ++ return psi_trigger_poll(&ctx->psi.trigger, of->file, pt); + } + + static void cgroup_pressure_release(struct kernfs_open_file *of) + { +- psi_trigger_destroy(of->priv); ++ struct cgroup_file_ctx *ctx = of->priv; ++ ++ psi_trigger_destroy(ctx->psi.trigger); + } + #endif /* CONFIG_PSI */ + +@@ -3748,24 +3752,43 @@ static ssize_t cgroup_freeze_write(struct kernfs_open_file *of, + static int cgroup_file_open(struct kernfs_open_file *of) + { + struct cftype *cft = of->kn->priv; ++ struct cgroup_file_ctx *ctx; ++ int ret; + +- if (cft->open) +- return cft->open(of); +- return 0; ++ ctx = kzalloc(sizeof(*ctx), GFP_KERNEL); ++ if (!ctx) ++ return -ENOMEM; ++ ++ ctx->ns = current->nsproxy->cgroup_ns; ++ get_cgroup_ns(ctx->ns); ++ of->priv = ctx; ++ ++ if (!cft->open) ++ return 0; ++ ++ ret = cft->open(of); ++ if (ret) { ++ put_cgroup_ns(ctx->ns); ++ kfree(ctx); ++ } ++ return ret; + } + + static void cgroup_file_release(struct kernfs_open_file *of) + { + struct cftype *cft = of->kn->priv; ++ struct cgroup_file_ctx *ctx = of->priv; + + if (cft->release) + cft->release(of); ++ put_cgroup_ns(ctx->ns); ++ kfree(ctx); + } + + static ssize_t cgroup_file_write(struct kernfs_open_file *of, char *buf, + size_t nbytes, loff_t off) + { +- struct cgroup_namespace *ns = current->nsproxy->cgroup_ns; ++ struct cgroup_file_ctx *ctx = of->priv; + struct cgroup *cgrp = of->kn->parent->priv; + struct cftype *cft = of->kn->priv; + struct cgroup_subsys_state *css; +@@ -3779,7 +3802,7 @@ static ssize_t cgroup_file_write(struct kernfs_open_file *of, char *buf, + */ + if ((cgrp->root->flags & CGRP_ROOT_NS_DELEGATE) && + !(cft->flags & CFTYPE_NS_DELEGATABLE) && +- ns != &init_cgroup_ns && ns->root_cset->dfl_cgrp == cgrp) ++ ctx->ns != &init_cgroup_ns && ctx->ns->root_cset->dfl_cgrp == cgrp) + return -EPERM; + + if (cft->write) +@@ -4687,21 +4710,21 @@ void css_task_iter_end(struct css_task_iter *it) + + static void cgroup_procs_release(struct kernfs_open_file *of) + { +- if (of->priv) { +- css_task_iter_end(of->priv); +- kfree(of->priv); +- } ++ struct cgroup_file_ctx *ctx = of->priv; ++ ++ if (ctx->procs.started) ++ css_task_iter_end(&ctx->procs.iter); + } + + static void *cgroup_procs_next(struct seq_file *s, void *v, loff_t *pos) + { + struct kernfs_open_file *of = s->private; +- struct css_task_iter *it = of->priv; ++ struct cgroup_file_ctx *ctx = of->priv; + + if (pos) + (*pos)++; + +- return css_task_iter_next(it); ++ return css_task_iter_next(&ctx->procs.iter); + } + + static void *__cgroup_procs_start(struct seq_file *s, loff_t *pos, +@@ -4709,21 +4732,18 @@ static void *__cgroup_procs_start(struct seq_file *s, loff_t *pos, + { + struct kernfs_open_file *of = s->private; + struct cgroup *cgrp = seq_css(s)->cgroup; +- struct css_task_iter *it = of->priv; ++ struct cgroup_file_ctx *ctx = of->priv; ++ struct css_task_iter *it = &ctx->procs.iter; + + /* + * When a seq_file is seeked, it's always traversed sequentially + * from position 0, so we can simply keep iterating on !0 *pos. + */ +- if (!it) { ++ if (!ctx->procs.started) { + if (WARN_ON_ONCE((*pos))) + return ERR_PTR(-EINVAL); +- +- it = kzalloc(sizeof(*it), GFP_KERNEL); +- if (!it) +- return ERR_PTR(-ENOMEM); +- of->priv = it; + css_task_iter_start(&cgrp->self, iter_flags, it); ++ ctx->procs.started = true; + } else if (!(*pos)) { + css_task_iter_end(it); + css_task_iter_start(&cgrp->self, iter_flags, it); +@@ -4758,9 +4778,9 @@ static int cgroup_procs_show(struct seq_file *s, void *v) + + static int cgroup_procs_write_permission(struct cgroup *src_cgrp, + struct cgroup *dst_cgrp, +- struct super_block *sb) ++ struct super_block *sb, ++ struct cgroup_namespace *ns) + { +- struct cgroup_namespace *ns = current->nsproxy->cgroup_ns; + struct cgroup *com_cgrp = src_cgrp; + struct inode *inode; + int ret; +@@ -4796,8 +4816,10 @@ static int cgroup_procs_write_permission(struct cgroup *src_cgrp, + static ssize_t cgroup_procs_write(struct kernfs_open_file *of, + char *buf, size_t nbytes, loff_t off) + { ++ struct cgroup_file_ctx *ctx = of->priv; + struct cgroup *src_cgrp, *dst_cgrp; + struct task_struct *task; ++ const struct cred *saved_cred; + ssize_t ret; + + dst_cgrp = cgroup_kn_lock_live(of->kn, false); +@@ -4814,8 +4836,16 @@ static ssize_t cgroup_procs_write(struct kernfs_open_file *of, + src_cgrp = task_cgroup_from_root(task, &cgrp_dfl_root); + spin_unlock_irq(&css_set_lock); + ++ /* ++ * Process and thread migrations follow same delegation rule. Check ++ * permissions using the credentials from file open to protect against ++ * inherited fd attacks. ++ */ ++ saved_cred = override_creds(of->file->f_cred); + ret = cgroup_procs_write_permission(src_cgrp, dst_cgrp, +- of->file->f_path.dentry->d_sb); ++ of->file->f_path.dentry->d_sb, ++ ctx->ns); ++ revert_creds(saved_cred); + if (ret) + goto out_finish; + +@@ -4837,8 +4867,10 @@ static void *cgroup_threads_start(struct seq_file *s, loff_t *pos) + static ssize_t cgroup_threads_write(struct kernfs_open_file *of, + char *buf, size_t nbytes, loff_t off) + { ++ struct cgroup_file_ctx *ctx = of->priv; + struct cgroup *src_cgrp, *dst_cgrp; + struct task_struct *task; ++ const struct cred *saved_cred; + ssize_t ret; + + buf = strstrip(buf); +@@ -4857,9 +4889,16 @@ static ssize_t cgroup_threads_write(struct kernfs_open_file *of, + src_cgrp = task_cgroup_from_root(task, &cgrp_dfl_root); + spin_unlock_irq(&css_set_lock); + +- /* thread migrations follow the cgroup.procs delegation rule */ ++ /* ++ * Process and thread migrations follow same delegation rule. Check ++ * permissions using the credentials from file open to protect against ++ * inherited fd attacks. ++ */ ++ saved_cred = override_creds(of->file->f_cred); + ret = cgroup_procs_write_permission(src_cgrp, dst_cgrp, +- of->file->f_path.dentry->d_sb); ++ of->file->f_path.dentry->d_sb, ++ ctx->ns); ++ revert_creds(saved_cred); + if (ret) + goto out_finish; + +diff --git a/kernel/dma/debug.c b/kernel/dma/debug.c +index b28665f4d8c7a..4dc3bbfd3e3f3 100644 +--- a/kernel/dma/debug.c ++++ b/kernel/dma/debug.c +@@ -980,7 +980,7 @@ static __init int dma_debug_cmdline(char *str) + global_disable = true; + } + +- return 0; ++ return 1; + } + + static __init int dma_debug_entries_cmdline(char *str) +@@ -989,7 +989,7 @@ static __init int dma_debug_entries_cmdline(char *str) + return -EINVAL; + if (!get_option(&str, &nr_prealloc_entries)) + nr_prealloc_entries = PREALLOC_DMA_DEBUG_ENTRIES; +- return 0; ++ return 1; + } + + __setup("dma_debug=", dma_debug_cmdline); +diff --git a/kernel/dma/swiotlb.c b/kernel/dma/swiotlb.c +index f99b79d7e1235..f17b771856d1c 100644 +--- a/kernel/dma/swiotlb.c ++++ b/kernel/dma/swiotlb.c +@@ -572,7 +572,8 @@ found: + for (i = 0; i < nslots; i++) + io_tlb_orig_addr[index+i] = orig_addr + (i << IO_TLB_SHIFT); + if (!(attrs & DMA_ATTR_SKIP_CPU_SYNC) && +- (dir == DMA_TO_DEVICE || dir == DMA_BIDIRECTIONAL)) ++ (!(attrs & DMA_ATTR_OVERWRITE) || dir == DMA_TO_DEVICE || ++ dir == DMA_BIDIRECTIONAL)) + swiotlb_bounce(orig_addr, tlb_addr, mapping_size, DMA_TO_DEVICE); + + return tlb_addr; +diff --git a/kernel/events/core.c b/kernel/events/core.c +index f720a40ccaf5f..52f4a9e467040 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -9490,8 +9490,11 @@ perf_event_parse_addr_filter(struct perf_event *event, char *fstr, + } + + /* ready to consume more filters */ ++ kfree(filename); ++ filename = NULL; + state = IF_STATE_ACTION; + filter = NULL; ++ kernel = 0; + } + } + +diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c +index 6cafb2e910a11..406b4cbbec5e7 100644 +--- a/kernel/power/hibernate.c ++++ b/kernel/power/hibernate.c +@@ -1216,7 +1216,7 @@ static int __init resumedelay_setup(char *str) + int rc = kstrtouint(str, 0, &resume_delay); + + if (rc) +- return rc; ++ pr_warn("resumedelay: bad option string '%s'\n", str); + return 1; + } + +diff --git a/kernel/power/suspend_test.c b/kernel/power/suspend_test.c +index 60564b58de077..bfd2a96c695ca 100644 +--- a/kernel/power/suspend_test.c ++++ b/kernel/power/suspend_test.c +@@ -157,22 +157,22 @@ static int __init setup_test_suspend(char *value) + value++; + suspend_type = strsep(&value, ","); + if (!suspend_type) +- return 0; ++ return 1; + + repeat = strsep(&value, ","); + if (repeat) { + if (kstrtou32(repeat, 0, &test_repeat_count_max)) +- return 0; ++ return 1; + } + + for (i = PM_SUSPEND_MIN; i < PM_SUSPEND_MAX; i++) + if (!strcmp(pm_labels[i], suspend_type)) { + test_state_label = pm_labels[i]; +- return 0; ++ return 1; + } + + printk(warn_bad_state, suspend_type); +- return 0; ++ return 1; + } + __setup("test_suspend", setup_test_suspend); + +diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c +index 23e26a203a9e9..bb2198b40756d 100644 +--- a/kernel/printk/printk.c ++++ b/kernel/printk/printk.c +@@ -146,8 +146,10 @@ static int __control_devkmsg(char *str) + + static int __init control_devkmsg(char *str) + { +- if (__control_devkmsg(str) < 0) ++ if (__control_devkmsg(str) < 0) { ++ pr_warn("printk.devkmsg: bad option string '%s'\n", str); + return 1; ++ } + + /* + * Set sysctl string accordingly: +@@ -166,7 +168,7 @@ static int __init control_devkmsg(char *str) + */ + devkmsg_log |= DEVKMSG_LOG_MASK_LOCK; + +- return 0; ++ return 1; + } + __setup("printk.devkmsg=", control_devkmsg); + +diff --git a/kernel/ptrace.c b/kernel/ptrace.c +index eb4d04cb3aaf5..d99f73f83bf5f 100644 +--- a/kernel/ptrace.c ++++ b/kernel/ptrace.c +@@ -370,6 +370,26 @@ bool ptrace_may_access(struct task_struct *task, unsigned int mode) + return !err; + } + ++static int check_ptrace_options(unsigned long data) ++{ ++ if (data & ~(unsigned long)PTRACE_O_MASK) ++ return -EINVAL; ++ ++ if (unlikely(data & PTRACE_O_SUSPEND_SECCOMP)) { ++ if (!IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) || ++ !IS_ENABLED(CONFIG_SECCOMP)) ++ return -EINVAL; ++ ++ if (!capable(CAP_SYS_ADMIN)) ++ return -EPERM; ++ ++ if (seccomp_mode(¤t->seccomp) != SECCOMP_MODE_DISABLED || ++ current->ptrace & PT_SUSPEND_SECCOMP) ++ return -EPERM; ++ } ++ return 0; ++} ++ + static int ptrace_attach(struct task_struct *task, long request, + unsigned long addr, + unsigned long flags) +@@ -381,8 +401,16 @@ static int ptrace_attach(struct task_struct *task, long request, + if (seize) { + if (addr != 0) + goto out; ++ /* ++ * This duplicates the check in check_ptrace_options() because ++ * ptrace_attach() and ptrace_setoptions() have historically ++ * used different error codes for unknown ptrace options. ++ */ + if (flags & ~(unsigned long)PTRACE_O_MASK) + goto out; ++ retval = check_ptrace_options(flags); ++ if (retval) ++ return retval; + flags = PT_PTRACED | PT_SEIZED | (flags << PT_OPT_FLAG_SHIFT); + } else { + flags = PT_PTRACED; +@@ -655,22 +683,11 @@ int ptrace_writedata(struct task_struct *tsk, char __user *src, unsigned long ds + static int ptrace_setoptions(struct task_struct *child, unsigned long data) + { + unsigned flags; ++ int ret; + +- if (data & ~(unsigned long)PTRACE_O_MASK) +- return -EINVAL; +- +- if (unlikely(data & PTRACE_O_SUSPEND_SECCOMP)) { +- if (!IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) || +- !IS_ENABLED(CONFIG_SECCOMP)) +- return -EINVAL; +- +- if (!capable(CAP_SYS_ADMIN)) +- return -EPERM; +- +- if (seccomp_mode(¤t->seccomp) != SECCOMP_MODE_DISABLED || +- current->ptrace & PT_SUSPEND_SECCOMP) +- return -EPERM; +- } ++ ret = check_ptrace_options(data); ++ if (ret) ++ return ret; + + /* Avoid intermediate state when all opts are cleared */ + flags = child->ptrace; +diff --git a/kernel/sched/debug.c b/kernel/sched/debug.c +index faada713cfae8..d5f7fc7099bc4 100644 +--- a/kernel/sched/debug.c ++++ b/kernel/sched/debug.c +@@ -847,25 +847,15 @@ void print_numa_stats(struct seq_file *m, int node, unsigned long tsf, + static void sched_show_numa(struct task_struct *p, struct seq_file *m) + { + #ifdef CONFIG_NUMA_BALANCING +- struct mempolicy *pol; +- + if (p->mm) + P(mm->numa_scan_seq); + +- task_lock(p); +- pol = p->mempolicy; +- if (pol && !(pol->flags & MPOL_F_MORON)) +- pol = NULL; +- mpol_get(pol); +- task_unlock(p); +- + P(numa_pages_migrated); + P(numa_preferred_nid); + P(total_numa_faults); + SEQ_printf(m, "current_node=%d, numa_group_id=%d\n", + task_node(p), task_numa_group_id(p)); + show_numa_stats(p, m); +- mpol_put(pol); + #endif + } + +diff --git a/lib/lz4/lz4_decompress.c b/lib/lz4/lz4_decompress.c +index 4d0b59fa5550f..46f24b7a32217 100644 +--- a/lib/lz4/lz4_decompress.c ++++ b/lib/lz4/lz4_decompress.c +@@ -268,8 +268,12 @@ static FORCE_INLINE int LZ4_decompress_generic( + ip += length; + op += length; + +- /* Necessarily EOF, due to parsing restrictions */ +- if (!partialDecoding || (cpy == oend)) ++ /* Necessarily EOF when !partialDecoding. ++ * When partialDecoding, it is EOF if we've either ++ * filled the output buffer or ++ * can't proceed with reading an offset for following match. ++ */ ++ if (!partialDecoding || (cpy == oend) || (ip >= (iend - 2))) + break; + } else { + /* may overwrite up to WILDCOPYLENGTH beyond cpy */ +diff --git a/lib/raid6/test/Makefile b/lib/raid6/test/Makefile +index b9e6c3648be1a..98b9fd0354dd1 100644 +--- a/lib/raid6/test/Makefile ++++ b/lib/raid6/test/Makefile +@@ -4,6 +4,8 @@ + # from userspace. + # + ++pound := \# ++ + CC = gcc + OPTFLAGS = -O2 # Adjust as desired + CFLAGS = -I.. -I ../../../include -g $(OPTFLAGS) +@@ -47,7 +49,7 @@ else ifeq ($(HAS_NEON),yes) + OBJS += neon.o neon1.o neon2.o neon4.o neon8.o recov_neon.o recov_neon_inner.o + CFLAGS += -DCONFIG_KERNEL_MODE_NEON=1 + else +- HAS_ALTIVEC := $(shell printf '\#include <altivec.h>\nvector int a;\n' |\ ++ HAS_ALTIVEC := $(shell printf '$(pound)include <altivec.h>\nvector int a;\n' |\ + gcc -c -x c - >/dev/null && rm ./-.o && echo yes) + ifeq ($(HAS_ALTIVEC),yes) + CFLAGS += -I../../../arch/powerpc/include +diff --git a/lib/raid6/test/test.c b/lib/raid6/test/test.c +index a3cf071941ab4..841a55242abaa 100644 +--- a/lib/raid6/test/test.c ++++ b/lib/raid6/test/test.c +@@ -19,7 +19,6 @@ + #define NDISKS 16 /* Including P and Q */ + + const char raid6_empty_zero_page[PAGE_SIZE] __attribute__((aligned(PAGE_SIZE))); +-struct raid6_calls raid6_call; + + char *dataptrs[NDISKS]; + char data[NDISKS][PAGE_SIZE] __attribute__((aligned(PAGE_SIZE))); +diff --git a/lib/test_kmod.c b/lib/test_kmod.c +index 87a0cc750ea23..6813b183aa348 100644 +--- a/lib/test_kmod.c ++++ b/lib/test_kmod.c +@@ -1155,6 +1155,7 @@ static struct kmod_test_device *register_test_dev_kmod(void) + if (ret) { + pr_err("could not register misc device: %d\n", ret); + free_test_dev_kmod(test_dev); ++ test_dev = NULL; + goto out; + } + +diff --git a/lib/test_xarray.c b/lib/test_xarray.c +index 8262c3f05a5d3..aefa377c9c26a 100644 +--- a/lib/test_xarray.c ++++ b/lib/test_xarray.c +@@ -1438,6 +1438,25 @@ unlock: + XA_BUG_ON(xa, !xa_empty(xa)); + } + ++static noinline void check_create_range_5(struct xarray *xa, ++ unsigned long index, unsigned int order) ++{ ++ XA_STATE_ORDER(xas, xa, index, order); ++ unsigned int i; ++ ++ xa_store_order(xa, index, order, xa_mk_index(index), GFP_KERNEL); ++ ++ for (i = 0; i < order + 10; i++) { ++ do { ++ xas_lock(&xas); ++ xas_create_range(&xas); ++ xas_unlock(&xas); ++ } while (xas_nomem(&xas, GFP_KERNEL)); ++ } ++ ++ xa_destroy(xa); ++} ++ + static noinline void check_create_range(struct xarray *xa) + { + unsigned int order; +@@ -1465,6 +1484,9 @@ static noinline void check_create_range(struct xarray *xa) + check_create_range_4(xa, (3U << order) + 1, order); + check_create_range_4(xa, (3U << order) - 1, order); + check_create_range_4(xa, (1U << 24) + 1, order); ++ ++ check_create_range_5(xa, 0, order); ++ check_create_range_5(xa, (1U << order), order); + } + + check_create_range_3(); +diff --git a/lib/xarray.c b/lib/xarray.c +index 7d22b30591275..61464c52c20e6 100644 +--- a/lib/xarray.c ++++ b/lib/xarray.c +@@ -722,6 +722,8 @@ void xas_create_range(struct xa_state *xas) + + for (;;) { + struct xa_node *node = xas->xa_node; ++ if (node->shift >= shift) ++ break; + xas->xa_node = xa_parent_locked(xas->xa, node); + xas->xa_offset = node->offset - 1; + if (node->offset != 0) +@@ -1078,6 +1080,7 @@ void xas_split(struct xa_state *xas, void *entry, unsigned int order) + xa_mk_node(child)); + if (xa_is_value(curr)) + values--; ++ xas_update(xas, child); + } else { + unsigned int canon = offset - xas->xa_sibs; + +@@ -1092,6 +1095,7 @@ void xas_split(struct xa_state *xas, void *entry, unsigned int order) + } while (offset-- > xas->xa_offset); + + node->nr_values += values; ++ xas_update(xas, node); + } + EXPORT_SYMBOL_GPL(xas_split); + #endif +diff --git a/mm/kmemleak.c b/mm/kmemleak.c +index 4a669c81f4e22..d8cde7292bf92 100644 +--- a/mm/kmemleak.c ++++ b/mm/kmemleak.c +@@ -787,6 +787,8 @@ static void add_scan_area(unsigned long ptr, size_t size, gfp_t gfp) + unsigned long flags; + struct kmemleak_object *object; + struct kmemleak_scan_area *area = NULL; ++ unsigned long untagged_ptr; ++ unsigned long untagged_objp; + + object = find_and_get_object(ptr, 1); + if (!object) { +@@ -795,6 +797,9 @@ static void add_scan_area(unsigned long ptr, size_t size, gfp_t gfp) + return; + } + ++ untagged_ptr = (unsigned long)kasan_reset_tag((void *)ptr); ++ untagged_objp = (unsigned long)kasan_reset_tag((void *)object->pointer); ++ + if (scan_area_cache) + area = kmem_cache_alloc(scan_area_cache, gfp_kmemleak_mask(gfp)); + +@@ -806,8 +811,8 @@ static void add_scan_area(unsigned long ptr, size_t size, gfp_t gfp) + goto out_unlock; + } + if (size == SIZE_MAX) { +- size = object->pointer + object->size - ptr; +- } else if (ptr + size > object->pointer + object->size) { ++ size = untagged_objp + object->size - untagged_ptr; ++ } else if (untagged_ptr + size > untagged_objp + object->size) { + kmemleak_warn("Scan area larger than object 0x%08lx\n", ptr); + dump_object_info(object); + kmem_cache_free(scan_area_cache, area); +diff --git a/mm/memcontrol.c b/mm/memcontrol.c +index 6d7fe3589e4a0..8fc6635454987 100644 +--- a/mm/memcontrol.c ++++ b/mm/memcontrol.c +@@ -6973,7 +6973,7 @@ static int __init cgroup_memory(char *s) + if (!strcmp(token, "nokmem")) + cgroup_memory_nokmem = true; + } +- return 0; ++ return 1; + } + __setup("cgroup.memory=", cgroup_memory); + +diff --git a/mm/memory.c b/mm/memory.c +index 4bb7c6a364c81..8a72fd3e73bf1 100644 +--- a/mm/memory.c ++++ b/mm/memory.c +@@ -1013,6 +1013,17 @@ int copy_page_range(struct mm_struct *dst_mm, struct mm_struct *src_mm, + return ret; + } + ++/* Whether we should zap all COWed (private) pages too */ ++static inline bool should_zap_cows(struct zap_details *details) ++{ ++ /* By default, zap all pages */ ++ if (!details) ++ return true; ++ ++ /* Or, we zap COWed pages only if the caller wants to */ ++ return !details->check_mapping; ++} ++ + static unsigned long zap_pte_range(struct mmu_gather *tlb, + struct vm_area_struct *vma, pmd_t *pmd, + unsigned long addr, unsigned long end, +@@ -1104,16 +1115,18 @@ again: + continue; + } + +- /* If details->check_mapping, we leave swap entries. */ +- if (unlikely(details)) +- continue; +- +- if (!non_swap_entry(entry)) ++ if (!non_swap_entry(entry)) { ++ /* Genuine swap entry, hence a private anon page */ ++ if (!should_zap_cows(details)) ++ continue; + rss[MM_SWAPENTS]--; +- else if (is_migration_entry(entry)) { ++ } else if (is_migration_entry(entry)) { + struct page *page; + + page = migration_entry_to_page(entry); ++ if (details && details->check_mapping && ++ details->check_mapping != page_rmapping(page)) ++ continue; + rss[mm_counter(page)]--; + } + if (unlikely(!free_swap_and_cache(entry))) +@@ -3245,11 +3258,20 @@ static vm_fault_t __do_fault(struct vm_fault *vmf) + return ret; + + if (unlikely(PageHWPoison(vmf->page))) { +- if (ret & VM_FAULT_LOCKED) +- unlock_page(vmf->page); +- put_page(vmf->page); ++ struct page *page = vmf->page; ++ vm_fault_t poisonret = VM_FAULT_HWPOISON; ++ if (ret & VM_FAULT_LOCKED) { ++ if (page_mapped(page)) ++ unmap_mapping_pages(page_mapping(page), ++ page->index, 1, false); ++ /* Retry if a clean page was removed from the cache. */ ++ if (invalidate_inode_page(page)) ++ poisonret = VM_FAULT_NOPAGE; ++ unlock_page(page); ++ } ++ put_page(page); + vmf->page = NULL; +- return VM_FAULT_HWPOISON; ++ return poisonret; + } + + if (unlikely(!(ret & VM_FAULT_LOCKED))) +diff --git a/mm/mempolicy.c b/mm/mempolicy.c +index 2c4082f71d258..d79ab5116a7be 100644 +--- a/mm/mempolicy.c ++++ b/mm/mempolicy.c +@@ -731,7 +731,6 @@ static int vma_replace_policy(struct vm_area_struct *vma, + static int mbind_range(struct mm_struct *mm, unsigned long start, + unsigned long end, struct mempolicy *new_pol) + { +- struct vm_area_struct *next; + struct vm_area_struct *prev; + struct vm_area_struct *vma; + int err = 0; +@@ -747,8 +746,7 @@ static int mbind_range(struct mm_struct *mm, unsigned long start, + if (start > vma->vm_start) + prev = vma; + +- for (; vma && vma->vm_start < end; prev = vma, vma = next) { +- next = vma->vm_next; ++ for (; vma && vma->vm_start < end; prev = vma, vma = vma->vm_next) { + vmstart = max(start, vma->vm_start); + vmend = min(end, vma->vm_end); + +@@ -762,10 +760,6 @@ static int mbind_range(struct mm_struct *mm, unsigned long start, + new_pol, vma->vm_userfaultfd_ctx); + if (prev) { + vma = prev; +- next = vma->vm_next; +- if (mpol_equal(vma_policy(vma), new_pol)) +- continue; +- /* vma_merge() joined vma && vma->next, case 8 */ + goto replace; + } + if (vma->vm_start != vmstart) { +@@ -2565,6 +2559,7 @@ alloc_new: + mpol_new = kmem_cache_alloc(policy_cache, GFP_KERNEL); + if (!mpol_new) + goto err_out; ++ atomic_set(&mpol_new->refcnt, 1); + goto restart; + } + +diff --git a/mm/mmap.c b/mm/mmap.c +index ba78f1f1b1bd1..58cfd5b1e0b16 100644 +--- a/mm/mmap.c ++++ b/mm/mmap.c +@@ -2515,7 +2515,7 @@ static int __init cmdline_parse_stack_guard_gap(char *p) + if (!*endptr) + stack_guard_gap = val << PAGE_SHIFT; + +- return 0; ++ return 1; + } + __setup("stack_guard_gap=", cmdline_parse_stack_guard_gap); + +diff --git a/mm/mremap.c b/mm/mremap.c +index 8005d0b2b8438..8ce1b7632fbb8 100644 +--- a/mm/mremap.c ++++ b/mm/mremap.c +@@ -246,6 +246,9 @@ unsigned long move_page_tables(struct vm_area_struct *vma, + struct mmu_notifier_range range; + pmd_t *old_pmd, *new_pmd; + ++ if (!len) ++ return 0; ++ + old_end = old_addr + len; + flush_cache_range(vma, old_addr, old_end); + +diff --git a/mm/page_alloc.c b/mm/page_alloc.c +index c3835915d1157..5038611563dfb 100644 +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -7326,10 +7326,17 @@ restart: + + out2: + /* Align start of ZONE_MOVABLE on all nids to MAX_ORDER_NR_PAGES */ +- for (nid = 0; nid < MAX_NUMNODES; nid++) ++ for (nid = 0; nid < MAX_NUMNODES; nid++) { ++ unsigned long start_pfn, end_pfn; ++ + zone_movable_pfn[nid] = + roundup(zone_movable_pfn[nid], MAX_ORDER_NR_PAGES); + ++ get_pfn_range_for_nid(nid, &start_pfn, &end_pfn); ++ if (zone_movable_pfn[nid] >= end_pfn) ++ zone_movable_pfn[nid] = 0; ++ } ++ + out: + /* restore the node_state */ + node_states[N_MEMORY] = saved_node_state; +diff --git a/mm/rmap.c b/mm/rmap.c +index 45f2106852e84..6d80e92688fe7 100644 +--- a/mm/rmap.c ++++ b/mm/rmap.c +@@ -1602,7 +1602,30 @@ static bool try_to_unmap_one(struct page *page, struct vm_area_struct *vma, + + /* MADV_FREE page check */ + if (!PageSwapBacked(page)) { +- if (!PageDirty(page)) { ++ int ref_count, map_count; ++ ++ /* ++ * Synchronize with gup_pte_range(): ++ * - clear PTE; barrier; read refcount ++ * - inc refcount; barrier; read PTE ++ */ ++ smp_mb(); ++ ++ ref_count = page_ref_count(page); ++ map_count = page_mapcount(page); ++ ++ /* ++ * Order reads for page refcount and dirty flag ++ * (see comments in __remove_mapping()). ++ */ ++ smp_rmb(); ++ ++ /* ++ * The only page refs must be one from isolation ++ * plus the rmap(s) (dropped by discard:). ++ */ ++ if (ref_count == 1 + map_count && ++ !PageDirty(page)) { + /* Invalidate as we cleared the pte */ + mmu_notifier_invalidate_range(mm, + address, address + PAGE_SIZE); +diff --git a/mm/usercopy.c b/mm/usercopy.c +index 660717a1ea5cd..f70455bad7f32 100644 +--- a/mm/usercopy.c ++++ b/mm/usercopy.c +@@ -294,7 +294,10 @@ static bool enable_checks __initdata = true; + + static int __init parse_hardened_usercopy(char *str) + { +- return strtobool(str, &enable_checks); ++ if (strtobool(str, &enable_checks)) ++ pr_warn("Invalid option string for hardened_usercopy: '%s'\n", ++ str); ++ return 1; + } + + __setup("hardened_usercopy=", parse_hardened_usercopy); +diff --git a/net/batman-adv/multicast.c b/net/batman-adv/multicast.c +index 09d81f9c2a649..6f0a9f4392333 100644 +--- a/net/batman-adv/multicast.c ++++ b/net/batman-adv/multicast.c +@@ -136,7 +136,7 @@ static u8 batadv_mcast_mla_rtr_flags_softif_get_ipv6(struct net_device *dev) + { + struct inet6_dev *in6_dev = __in6_dev_get(dev); + +- if (in6_dev && in6_dev->cnf.mc_forwarding) ++ if (in6_dev && atomic_read(&in6_dev->cnf.mc_forwarding)) + return BATADV_NO_FLAGS; + else + return BATADV_MCAST_WANT_NO_RTR6; +diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c +index 082a262ab49c3..ff6625493c9f8 100644 +--- a/net/bluetooth/hci_event.c ++++ b/net/bluetooth/hci_event.c +@@ -4911,8 +4911,9 @@ static void hci_disconn_phylink_complete_evt(struct hci_dev *hdev, + hci_dev_lock(hdev); + + hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle); +- if (hcon) { ++ if (hcon && hcon->type == AMP_LINK) { + hcon->state = BT_CLOSED; ++ hci_disconn_cfm(hcon, ev->reason); + hci_conn_del(hcon); + } + +diff --git a/net/core/filter.c b/net/core/filter.c +index d39518f691b4b..e16b2b5cda981 100644 +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -5824,24 +5824,33 @@ BPF_CALL_5(bpf_tcp_check_syncookie, struct sock *, sk, void *, iph, u32, iph_len + if (!th->ack || th->rst || th->syn) + return -ENOENT; + ++ if (unlikely(iph_len < sizeof(struct iphdr))) ++ return -EINVAL; ++ + if (tcp_synq_no_recent_overflow(sk)) + return -ENOENT; + + cookie = ntohl(th->ack_seq) - 1; + +- switch (sk->sk_family) { +- case AF_INET: +- if (unlikely(iph_len < sizeof(struct iphdr))) ++ /* Both struct iphdr and struct ipv6hdr have the version field at the ++ * same offset so we can cast to the shorter header (struct iphdr). ++ */ ++ switch (((struct iphdr *)iph)->version) { ++ case 4: ++ if (sk->sk_family == AF_INET6 && ipv6_only_sock(sk)) + return -EINVAL; + + ret = __cookie_v4_check((struct iphdr *)iph, th, cookie); + break; + + #if IS_BUILTIN(CONFIG_IPV6) +- case AF_INET6: ++ case 6: + if (unlikely(iph_len < sizeof(struct ipv6hdr))) + return -EINVAL; + ++ if (sk->sk_family != AF_INET6) ++ return -EINVAL; ++ + ret = __cookie_v6_check((struct ipv6hdr *)iph, th, cookie); + break; + #endif /* CONFIG_IPV6 */ +@@ -6708,6 +6717,7 @@ bool bpf_sock_is_valid_access(int off, int size, enum bpf_access_type type, + struct bpf_insn_access_aux *info) + { + const int size_default = sizeof(__u32); ++ int field_size; + + if (off < 0 || off >= sizeof(struct bpf_sock)) + return false; +@@ -6719,7 +6729,6 @@ bool bpf_sock_is_valid_access(int off, int size, enum bpf_access_type type, + case offsetof(struct bpf_sock, family): + case offsetof(struct bpf_sock, type): + case offsetof(struct bpf_sock, protocol): +- case offsetof(struct bpf_sock, dst_port): + case offsetof(struct bpf_sock, src_port): + case bpf_ctx_range(struct bpf_sock, src_ip4): + case bpf_ctx_range_till(struct bpf_sock, src_ip6[0], src_ip6[3]): +@@ -6727,6 +6736,14 @@ bool bpf_sock_is_valid_access(int off, int size, enum bpf_access_type type, + case bpf_ctx_range_till(struct bpf_sock, dst_ip6[0], dst_ip6[3]): + bpf_ctx_record_field_size(info, size_default); + return bpf_ctx_narrow_access_ok(off, size, size_default); ++ case bpf_ctx_range(struct bpf_sock, dst_port): ++ field_size = size == size_default ? ++ size_default : sizeof_field(struct bpf_sock, dst_port); ++ bpf_ctx_record_field_size(info, field_size); ++ return bpf_ctx_narrow_access_ok(off, size, field_size); ++ case offsetofend(struct bpf_sock, dst_port) ... ++ offsetof(struct bpf_sock, dst_ip4) - 1: ++ return false; + } + + return size == size_default; +diff --git a/net/core/skmsg.c b/net/core/skmsg.c +index 17cc1edd149cb..a606ad8e8be25 100644 +--- a/net/core/skmsg.c ++++ b/net/core/skmsg.c +@@ -27,6 +27,7 @@ int sk_msg_alloc(struct sock *sk, struct sk_msg *msg, int len, + int elem_first_coalesce) + { + struct page_frag *pfrag = sk_page_frag(sk); ++ u32 osize = msg->sg.size; + int ret = 0; + + len -= msg->sg.size; +@@ -35,13 +36,17 @@ int sk_msg_alloc(struct sock *sk, struct sk_msg *msg, int len, + u32 orig_offset; + int use, i; + +- if (!sk_page_frag_refill(sk, pfrag)) +- return -ENOMEM; ++ if (!sk_page_frag_refill(sk, pfrag)) { ++ ret = -ENOMEM; ++ goto msg_trim; ++ } + + orig_offset = pfrag->offset; + use = min_t(int, len, pfrag->size - orig_offset); +- if (!sk_wmem_schedule(sk, use)) +- return -ENOMEM; ++ if (!sk_wmem_schedule(sk, use)) { ++ ret = -ENOMEM; ++ goto msg_trim; ++ } + + i = msg->sg.end; + sk_msg_iter_var_prev(i); +@@ -71,6 +76,10 @@ int sk_msg_alloc(struct sock *sk, struct sk_msg *msg, int len, + } + + return ret; ++ ++msg_trim: ++ sk_msg_trim(sk, msg, osize); ++ return ret; + } + EXPORT_SYMBOL_GPL(sk_msg_alloc); + +diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c +index 7b951992c372b..b8fe943ae89d0 100644 +--- a/net/ipv4/arp.c ++++ b/net/ipv4/arp.c +@@ -1116,13 +1116,18 @@ static int arp_req_get(struct arpreq *r, struct net_device *dev) + return err; + } + +-static int arp_invalidate(struct net_device *dev, __be32 ip) ++int arp_invalidate(struct net_device *dev, __be32 ip, bool force) + { + struct neighbour *neigh = neigh_lookup(&arp_tbl, &ip, dev); + int err = -ENXIO; + struct neigh_table *tbl = &arp_tbl; + + if (neigh) { ++ if ((neigh->nud_state & NUD_VALID) && !force) { ++ neigh_release(neigh); ++ return 0; ++ } ++ + if (neigh->nud_state & ~NUD_NOARP) + err = neigh_update(neigh, NULL, NUD_FAILED, + NEIGH_UPDATE_F_OVERRIDE| +@@ -1169,7 +1174,7 @@ static int arp_req_delete(struct net *net, struct arpreq *r, + if (!dev) + return -EINVAL; + } +- return arp_invalidate(dev, ip); ++ return arp_invalidate(dev, ip, true); + } + + /* +diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c +index a95102fe66371..ef3e7a3e3a29e 100644 +--- a/net/ipv4/fib_frontend.c ++++ b/net/ipv4/fib_frontend.c +@@ -1122,9 +1122,11 @@ void fib_add_ifaddr(struct in_ifaddr *ifa) + return; + + /* Add broadcast address, if it is explicitly assigned. */ +- if (ifa->ifa_broadcast && ifa->ifa_broadcast != htonl(0xFFFFFFFF)) ++ if (ifa->ifa_broadcast && ifa->ifa_broadcast != htonl(0xFFFFFFFF)) { + fib_magic(RTM_NEWROUTE, RTN_BROADCAST, ifa->ifa_broadcast, 32, + prim, 0); ++ arp_invalidate(dev, ifa->ifa_broadcast, false); ++ } + + if (!ipv4_is_zeronet(prefix) && !(ifa->ifa_flags & IFA_F_SECONDARY) && + (prefix != addr || ifa->ifa_prefixlen < 32)) { +@@ -1140,6 +1142,7 @@ void fib_add_ifaddr(struct in_ifaddr *ifa) + prim, 0); + fib_magic(RTM_NEWROUTE, RTN_BROADCAST, prefix | ~mask, + 32, prim, 0); ++ arp_invalidate(dev, prefix | ~mask, false); + } + } + } +diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c +index 692ba6d6180f8..f99ad4a98907d 100644 +--- a/net/ipv4/fib_semantics.c ++++ b/net/ipv4/fib_semantics.c +@@ -876,8 +876,13 @@ int fib_nh_match(struct fib_config *cfg, struct fib_info *fi, + } + + if (cfg->fc_oif || cfg->fc_gw_family) { +- struct fib_nh *nh = fib_info_nh(fi, 0); ++ struct fib_nh *nh; ++ ++ /* cannot match on nexthop object attributes */ ++ if (fi->nh) ++ return 1; + ++ nh = fib_info_nh(fi, 0); + if (cfg->fc_encap) { + if (fib_encap_match(cfg->fc_encap_type, cfg->fc_encap, + nh, cfg, extack)) +diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c +index 7df7ec74807ac..bcc13368c8363 100644 +--- a/net/ipv4/tcp_bpf.c ++++ b/net/ipv4/tcp_bpf.c +@@ -296,10 +296,9 @@ int tcp_bpf_sendmsg_redir(struct sock *sk, struct sk_msg *msg, + struct sk_psock *psock = sk_psock_get(sk); + int ret; + +- if (unlikely(!psock)) { +- sk_msg_free(sk, msg); +- return 0; +- } ++ if (unlikely(!psock)) ++ return -EPIPE; ++ + ret = ingress ? bpf_tcp_ingress(sk, psock, msg, bytes, flags) : + tcp_bpf_push_locked(sk, msg, bytes, flags, false); + sk_psock_put(sk, psock); +@@ -367,7 +366,7 @@ more_data: + cork = true; + psock->cork = NULL; + } +- sk_msg_return(sk, msg, tosend); ++ sk_msg_return(sk, msg, msg->sg.size); + release_sock(sk); + + ret = tcp_bpf_sendmsg_redir(sk_redir, msg, tosend, flags); +@@ -407,8 +406,11 @@ more_data: + } + if (msg && + msg->sg.data[msg->sg.start].page_link && +- msg->sg.data[msg->sg.start].length) ++ msg->sg.data[msg->sg.start].length) { ++ if (eval == __SK_REDIRECT) ++ sk_mem_charge(sk, msg->sg.size); + goto more_data; ++ } + } + return ret; + } +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c +index 638d7b49ad716..139e962d1aef3 100644 +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -3492,6 +3492,7 @@ static void tcp_connect_queue_skb(struct sock *sk, struct sk_buff *skb) + */ + static int tcp_send_syn_data(struct sock *sk, struct sk_buff *syn) + { ++ struct inet_connection_sock *icsk = inet_csk(sk); + struct tcp_sock *tp = tcp_sk(sk); + struct tcp_fastopen_request *fo = tp->fastopen_req; + int space, err = 0; +@@ -3506,8 +3507,10 @@ static int tcp_send_syn_data(struct sock *sk, struct sk_buff *syn) + * private TCP options. The cost is reduced data space in SYN :( + */ + tp->rx_opt.mss_clamp = tcp_mss_clamp(tp, tp->rx_opt.mss_clamp); ++ /* Sync mss_cache after updating the mss_clamp */ ++ tcp_sync_mss(sk, icsk->icsk_pmtu_cookie); + +- space = __tcp_mtu_to_mss(sk, inet_csk(sk)->icsk_pmtu_cookie) - ++ space = __tcp_mtu_to_mss(sk, icsk->icsk_pmtu_cookie) - + MAX_TCP_OPTION_SPACE; + + space = min_t(size_t, space, fo->size); +diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c +index 3cdf011a8dd8d..83fd4fa40d5e6 100644 +--- a/net/ipv4/udp.c ++++ b/net/ipv4/udp.c +@@ -544,6 +544,12 @@ void udp_encap_enable(void) + } + EXPORT_SYMBOL(udp_encap_enable); + ++void udp_encap_disable(void) ++{ ++ static_branch_dec(&udp_encap_needed_key); ++} ++EXPORT_SYMBOL(udp_encap_disable); ++ + /* Handler for tunnels with arbitrary destination ports: no socket lookup, go + * through error handlers in encapsulations looking for a match. + */ +diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c +index 60d070b254846..69aef71f32ea7 100644 +--- a/net/ipv6/addrconf.c ++++ b/net/ipv6/addrconf.c +@@ -542,7 +542,7 @@ static int inet6_netconf_fill_devconf(struct sk_buff *skb, int ifindex, + #ifdef CONFIG_IPV6_MROUTE + if ((all || type == NETCONFA_MC_FORWARDING) && + nla_put_s32(skb, NETCONFA_MC_FORWARDING, +- devconf->mc_forwarding) < 0) ++ atomic_read(&devconf->mc_forwarding)) < 0) + goto nla_put_failure; + #endif + if ((all || type == NETCONFA_PROXY_NEIGH) && +@@ -5460,7 +5460,7 @@ static inline void ipv6_store_devconf(struct ipv6_devconf *cnf, + array[DEVCONF_USE_OPTIMISTIC] = cnf->use_optimistic; + #endif + #ifdef CONFIG_IPV6_MROUTE +- array[DEVCONF_MC_FORWARDING] = cnf->mc_forwarding; ++ array[DEVCONF_MC_FORWARDING] = atomic_read(&cnf->mc_forwarding); + #endif + array[DEVCONF_DISABLE_IPV6] = cnf->disable_ipv6; + array[DEVCONF_ACCEPT_DAD] = cnf->accept_dad; +diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c +index 7e5df23cbe7bf..e6c4966aa956c 100644 +--- a/net/ipv6/ip6_input.c ++++ b/net/ipv6/ip6_input.c +@@ -485,7 +485,7 @@ int ip6_mc_input(struct sk_buff *skb) + /* + * IPv6 multicast router mode is now supported ;) + */ +- if (dev_net(skb->dev)->ipv6.devconf_all->mc_forwarding && ++ if (atomic_read(&dev_net(skb->dev)->ipv6.devconf_all->mc_forwarding) && + !(ipv6_addr_type(&hdr->daddr) & + (IPV6_ADDR_LOOPBACK|IPV6_ADDR_LINKLOCAL)) && + likely(!(IP6CB(skb)->flags & IP6SKB_FORWARDED))) { +diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c +index aee1f6bc039ab..6248e00c2bf72 100644 +--- a/net/ipv6/ip6mr.c ++++ b/net/ipv6/ip6mr.c +@@ -736,7 +736,7 @@ static int mif6_delete(struct mr_table *mrt, int vifi, int notify, + + in6_dev = __in6_dev_get(dev); + if (in6_dev) { +- in6_dev->cnf.mc_forwarding--; ++ atomic_dec(&in6_dev->cnf.mc_forwarding); + inet6_netconf_notify_devconf(dev_net(dev), RTM_NEWNETCONF, + NETCONFA_MC_FORWARDING, + dev->ifindex, &in6_dev->cnf); +@@ -904,7 +904,7 @@ static int mif6_add(struct net *net, struct mr_table *mrt, + + in6_dev = __in6_dev_get(dev); + if (in6_dev) { +- in6_dev->cnf.mc_forwarding++; ++ atomic_inc(&in6_dev->cnf.mc_forwarding); + inet6_netconf_notify_devconf(dev_net(dev), RTM_NEWNETCONF, + NETCONFA_MC_FORWARDING, + dev->ifindex, &in6_dev->cnf); +@@ -1553,7 +1553,7 @@ static int ip6mr_sk_init(struct mr_table *mrt, struct sock *sk) + } else { + rcu_assign_pointer(mrt->mroute_sk, sk); + sock_set_flag(sk, SOCK_RCU_FREE); +- net->ipv6.devconf_all->mc_forwarding++; ++ atomic_inc(&net->ipv6.devconf_all->mc_forwarding); + } + write_unlock_bh(&mrt_lock); + +@@ -1586,7 +1586,7 @@ int ip6mr_sk_done(struct sock *sk) + * so the RCU grace period before sk freeing + * is guaranteed by sk_destruct() + */ +- net->ipv6.devconf_all->mc_forwarding--; ++ atomic_dec(&net->ipv6.devconf_all->mc_forwarding); + write_unlock_bh(&mrt_lock); + inet6_netconf_notify_devconf(net, RTM_NEWNETCONF, + NETCONFA_MC_FORWARDING, +diff --git a/net/ipv6/route.c b/net/ipv6/route.c +index 2a13394ab8541..619d9dffa9e44 100644 +--- a/net/ipv6/route.c ++++ b/net/ipv6/route.c +@@ -4403,7 +4403,7 @@ static int ip6_pkt_drop(struct sk_buff *skb, u8 code, int ipstats_mib_noroutes) + struct inet6_dev *idev; + int type; + +- if (netif_is_l3_master(skb->dev) && ++ if (netif_is_l3_master(skb->dev) || + dst->dev == net->loopback_dev) + idev = __in6_dev_get_safely(dev_get_by_index_rcu(net, IP6CB(skb)->iif)); + else +diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c +index a71bfa5b02770..040869f45682d 100644 +--- a/net/ipv6/udp.c ++++ b/net/ipv6/udp.c +@@ -1553,8 +1553,10 @@ void udpv6_destroy_sock(struct sock *sk) + if (encap_destroy) + encap_destroy(sk); + } +- if (up->encap_enabled) ++ if (up->encap_enabled) { + static_branch_dec(&udpv6_encap_needed_key); ++ udp_encap_disable(); ++ } + } + + inet6_destroy_sock(sk); +diff --git a/net/ipv6/xfrm6_output.c b/net/ipv6/xfrm6_output.c +index 6b0ed6c593e2b..a6f13fab963f7 100644 +--- a/net/ipv6/xfrm6_output.c ++++ b/net/ipv6/xfrm6_output.c +@@ -140,6 +140,19 @@ static int __xfrm6_output_finish(struct net *net, struct sock *sk, struct sk_buf + return __xfrm6_output_state_finish(x, sk, skb); + } + ++static int xfrm6_noneed_fragment(struct sk_buff *skb) ++{ ++ struct frag_hdr *fh; ++ u8 prevhdr = ipv6_hdr(skb)->nexthdr; ++ ++ if (prevhdr != NEXTHDR_FRAGMENT) ++ return 0; ++ fh = (struct frag_hdr *)(skb->data + sizeof(struct ipv6hdr)); ++ if (fh->nexthdr == NEXTHDR_ESP || fh->nexthdr == NEXTHDR_AUTH) ++ return 1; ++ return 0; ++} ++ + static int __xfrm6_output(struct net *net, struct sock *sk, struct sk_buff *skb) + { + struct dst_entry *dst = skb_dst(skb); +@@ -168,6 +181,9 @@ static int __xfrm6_output(struct net *net, struct sock *sk, struct sk_buff *skb) + xfrm6_local_rxpmtu(skb, mtu); + kfree_skb(skb); + return -EMSGSIZE; ++ } else if (toobig && xfrm6_noneed_fragment(skb)) { ++ skb->ignore_df = 1; ++ goto skip_frag; + } else if (!skb->ignore_df && toobig && skb->sk) { + xfrm_local_error(skb, mtu); + kfree_skb(skb); +diff --git a/net/key/af_key.c b/net/key/af_key.c +index 406e13478b01b..2ac9560020f91 100644 +--- a/net/key/af_key.c ++++ b/net/key/af_key.c +@@ -1703,7 +1703,7 @@ static int pfkey_register(struct sock *sk, struct sk_buff *skb, const struct sad + + xfrm_probe_algs(); + +- supp_skb = compose_sadb_supported(hdr, GFP_KERNEL); ++ supp_skb = compose_sadb_supported(hdr, GFP_KERNEL | __GFP_ZERO); + if (!supp_skb) { + if (hdr->sadb_msg_satype != SADB_SATYPE_UNSPEC) + pfk->registered &= ~(1<<hdr->sadb_msg_satype); +diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c +index 848b137151c26..b8cc3339a2495 100644 +--- a/net/netfilter/nf_conntrack_proto_tcp.c ++++ b/net/netfilter/nf_conntrack_proto_tcp.c +@@ -354,8 +354,8 @@ static void tcp_options(const struct sk_buff *skb, + length, buff); + BUG_ON(ptr == NULL); + +- state->td_scale = +- state->flags = 0; ++ state->td_scale = 0; ++ state->flags &= IP_CT_TCP_FLAG_BE_LIBERAL; + + while (length > 0) { + int opcode=*ptr++; +@@ -840,6 +840,16 @@ static bool nf_conntrack_tcp_established(const struct nf_conn *ct) + test_bit(IPS_ASSURED_BIT, &ct->status); + } + ++static void nf_ct_tcp_state_reset(struct ip_ct_tcp_state *state) ++{ ++ state->td_end = 0; ++ state->td_maxend = 0; ++ state->td_maxwin = 0; ++ state->td_maxack = 0; ++ state->td_scale = 0; ++ state->flags &= IP_CT_TCP_FLAG_BE_LIBERAL; ++} ++ + /* Returns verdict for packet, or -1 for invalid. */ + int nf_conntrack_tcp_packet(struct nf_conn *ct, + struct sk_buff *skb, +@@ -946,8 +956,7 @@ int nf_conntrack_tcp_packet(struct nf_conn *ct, + ct->proto.tcp.last_flags &= ~IP_CT_EXP_CHALLENGE_ACK; + ct->proto.tcp.seen[ct->proto.tcp.last_dir].flags = + ct->proto.tcp.last_flags; +- memset(&ct->proto.tcp.seen[dir], 0, +- sizeof(struct ip_ct_tcp_state)); ++ nf_ct_tcp_state_reset(&ct->proto.tcp.seen[dir]); + break; + } + ct->proto.tcp.last_index = index; +diff --git a/net/netlabel/netlabel_kapi.c b/net/netlabel/netlabel_kapi.c +index 5e1239cef0005..91b35b7c80d82 100644 +--- a/net/netlabel/netlabel_kapi.c ++++ b/net/netlabel/netlabel_kapi.c +@@ -885,6 +885,8 @@ int netlbl_bitmap_walk(const unsigned char *bitmap, u32 bitmap_len, + unsigned char bitmask; + unsigned char byte; + ++ if (offset >= bitmap_len) ++ return -1; + byte_offset = offset / 8; + byte = bitmap[byte_offset]; + bit_spot = offset; +diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c +index 891e029ad0f89..fb28969899af0 100644 +--- a/net/netlink/af_netlink.c ++++ b/net/netlink/af_netlink.c +@@ -148,6 +148,8 @@ static const struct rhashtable_params netlink_rhashtable_params; + + static inline u32 netlink_group_mask(u32 group) + { ++ if (group > 32) ++ return 0; + return group ? 1 << (group - 1) : 0; + } + +diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c +index 2c0f8cbc5c43b..ae40593daf214 100644 +--- a/net/openvswitch/actions.c ++++ b/net/openvswitch/actions.c +@@ -1037,7 +1037,7 @@ static int clone(struct datapath *dp, struct sk_buff *skb, + int rem = nla_len(attr); + bool dont_clone_flow_key; + +- /* The first action is always 'OVS_CLONE_ATTR_ARG'. */ ++ /* The first action is always 'OVS_CLONE_ATTR_EXEC'. */ + clone_arg = nla_data(attr); + dont_clone_flow_key = nla_get_u32(clone_arg); + actions = nla_next(clone_arg, &rem); +diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c +index b6f98eba71f1b..816036b9c223a 100644 +--- a/net/openvswitch/conntrack.c ++++ b/net/openvswitch/conntrack.c +@@ -730,6 +730,57 @@ static bool skb_nfct_cached(struct net *net, + } + + #if IS_ENABLED(CONFIG_NF_NAT) ++static void ovs_nat_update_key(struct sw_flow_key *key, ++ const struct sk_buff *skb, ++ enum nf_nat_manip_type maniptype) ++{ ++ if (maniptype == NF_NAT_MANIP_SRC) { ++ __be16 src; ++ ++ key->ct_state |= OVS_CS_F_SRC_NAT; ++ if (key->eth.type == htons(ETH_P_IP)) ++ key->ipv4.addr.src = ip_hdr(skb)->saddr; ++ else if (key->eth.type == htons(ETH_P_IPV6)) ++ memcpy(&key->ipv6.addr.src, &ipv6_hdr(skb)->saddr, ++ sizeof(key->ipv6.addr.src)); ++ else ++ return; ++ ++ if (key->ip.proto == IPPROTO_UDP) ++ src = udp_hdr(skb)->source; ++ else if (key->ip.proto == IPPROTO_TCP) ++ src = tcp_hdr(skb)->source; ++ else if (key->ip.proto == IPPROTO_SCTP) ++ src = sctp_hdr(skb)->source; ++ else ++ return; ++ ++ key->tp.src = src; ++ } else { ++ __be16 dst; ++ ++ key->ct_state |= OVS_CS_F_DST_NAT; ++ if (key->eth.type == htons(ETH_P_IP)) ++ key->ipv4.addr.dst = ip_hdr(skb)->daddr; ++ else if (key->eth.type == htons(ETH_P_IPV6)) ++ memcpy(&key->ipv6.addr.dst, &ipv6_hdr(skb)->daddr, ++ sizeof(key->ipv6.addr.dst)); ++ else ++ return; ++ ++ if (key->ip.proto == IPPROTO_UDP) ++ dst = udp_hdr(skb)->dest; ++ else if (key->ip.proto == IPPROTO_TCP) ++ dst = tcp_hdr(skb)->dest; ++ else if (key->ip.proto == IPPROTO_SCTP) ++ dst = sctp_hdr(skb)->dest; ++ else ++ return; ++ ++ key->tp.dst = dst; ++ } ++} ++ + /* Modelled after nf_nat_ipv[46]_fn(). + * range is only used for new, uninitialized NAT state. + * Returns either NF_ACCEPT or NF_DROP. +@@ -737,7 +788,7 @@ static bool skb_nfct_cached(struct net *net, + static int ovs_ct_nat_execute(struct sk_buff *skb, struct nf_conn *ct, + enum ip_conntrack_info ctinfo, + const struct nf_nat_range2 *range, +- enum nf_nat_manip_type maniptype) ++ enum nf_nat_manip_type maniptype, struct sw_flow_key *key) + { + int hooknum, nh_off, err = NF_ACCEPT; + +@@ -810,58 +861,11 @@ push: + skb_push(skb, nh_off); + skb_postpush_rcsum(skb, skb->data, nh_off); + +- return err; +-} +- +-static void ovs_nat_update_key(struct sw_flow_key *key, +- const struct sk_buff *skb, +- enum nf_nat_manip_type maniptype) +-{ +- if (maniptype == NF_NAT_MANIP_SRC) { +- __be16 src; +- +- key->ct_state |= OVS_CS_F_SRC_NAT; +- if (key->eth.type == htons(ETH_P_IP)) +- key->ipv4.addr.src = ip_hdr(skb)->saddr; +- else if (key->eth.type == htons(ETH_P_IPV6)) +- memcpy(&key->ipv6.addr.src, &ipv6_hdr(skb)->saddr, +- sizeof(key->ipv6.addr.src)); +- else +- return; +- +- if (key->ip.proto == IPPROTO_UDP) +- src = udp_hdr(skb)->source; +- else if (key->ip.proto == IPPROTO_TCP) +- src = tcp_hdr(skb)->source; +- else if (key->ip.proto == IPPROTO_SCTP) +- src = sctp_hdr(skb)->source; +- else +- return; +- +- key->tp.src = src; +- } else { +- __be16 dst; +- +- key->ct_state |= OVS_CS_F_DST_NAT; +- if (key->eth.type == htons(ETH_P_IP)) +- key->ipv4.addr.dst = ip_hdr(skb)->daddr; +- else if (key->eth.type == htons(ETH_P_IPV6)) +- memcpy(&key->ipv6.addr.dst, &ipv6_hdr(skb)->daddr, +- sizeof(key->ipv6.addr.dst)); +- else +- return; +- +- if (key->ip.proto == IPPROTO_UDP) +- dst = udp_hdr(skb)->dest; +- else if (key->ip.proto == IPPROTO_TCP) +- dst = tcp_hdr(skb)->dest; +- else if (key->ip.proto == IPPROTO_SCTP) +- dst = sctp_hdr(skb)->dest; +- else +- return; ++ /* Update the flow key if NAT successful. */ ++ if (err == NF_ACCEPT) ++ ovs_nat_update_key(key, skb, maniptype); + +- key->tp.dst = dst; +- } ++ return err; + } + + /* Returns NF_DROP if the packet should be dropped, NF_ACCEPT otherwise. */ +@@ -903,7 +907,7 @@ static int ovs_ct_nat(struct net *net, struct sw_flow_key *key, + } else { + return NF_ACCEPT; /* Connection is not NATed. */ + } +- err = ovs_ct_nat_execute(skb, ct, ctinfo, &info->range, maniptype); ++ err = ovs_ct_nat_execute(skb, ct, ctinfo, &info->range, maniptype, key); + + if (err == NF_ACCEPT && ct->status & IPS_DST_NAT) { + if (ct->status & IPS_SRC_NAT) { +@@ -913,17 +917,13 @@ static int ovs_ct_nat(struct net *net, struct sw_flow_key *key, + maniptype = NF_NAT_MANIP_SRC; + + err = ovs_ct_nat_execute(skb, ct, ctinfo, &info->range, +- maniptype); ++ maniptype, key); + } else if (CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL) { + err = ovs_ct_nat_execute(skb, ct, ctinfo, NULL, +- NF_NAT_MANIP_SRC); ++ NF_NAT_MANIP_SRC, key); + } + } + +- /* Mark NAT done if successful and update the flow key. */ +- if (err == NF_ACCEPT) +- ovs_nat_update_key(key, skb, maniptype); +- + return err; + } + #else /* !CONFIG_NF_NAT */ +diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c +index d7559c64795dc..d3f068ad154cb 100644 +--- a/net/openvswitch/flow_netlink.c ++++ b/net/openvswitch/flow_netlink.c +@@ -2179,8 +2179,8 @@ static int __ovs_nla_put_key(const struct sw_flow_key *swkey, + icmpv6_key->icmpv6_type = ntohs(output->tp.src); + icmpv6_key->icmpv6_code = ntohs(output->tp.dst); + +- if (icmpv6_key->icmpv6_type == NDISC_NEIGHBOUR_SOLICITATION || +- icmpv6_key->icmpv6_type == NDISC_NEIGHBOUR_ADVERTISEMENT) { ++ if (swkey->tp.src == htons(NDISC_NEIGHBOUR_SOLICITATION) || ++ swkey->tp.src == htons(NDISC_NEIGHBOUR_ADVERTISEMENT)) { + struct ovs_key_nd *nd_key; + + nla = nla_reserve(skb, OVS_KEY_ATTR_ND, sizeof(*nd_key)); +@@ -3284,7 +3284,9 @@ static int clone_action_to_attr(const struct nlattr *attr, + if (!start) + return -EMSGSIZE; + +- err = ovs_nla_put_actions(nla_data(attr), rem, skb); ++ /* Skipping the OVS_CLONE_ATTR_EXEC that is always the first attribute. */ ++ attr = nla_next(nla_data(attr), &rem); ++ err = ovs_nla_put_actions(attr, rem, skb); + + if (err) + nla_nest_cancel(skb, start); +diff --git a/net/rxrpc/net_ns.c b/net/rxrpc/net_ns.c +index b312aab80fed6..9a76b74af37bc 100644 +--- a/net/rxrpc/net_ns.c ++++ b/net/rxrpc/net_ns.c +@@ -116,8 +116,8 @@ static __net_exit void rxrpc_exit_net(struct net *net) + struct rxrpc_net *rxnet = rxrpc_net(net); + + rxnet->live = false; +- del_timer_sync(&rxnet->peer_keepalive_timer); + cancel_work_sync(&rxnet->peer_keepalive_work); ++ del_timer_sync(&rxnet->peer_keepalive_timer); + rxrpc_destroy_all_calls(rxnet); + rxrpc_destroy_all_connections(rxnet); + rxrpc_destroy_all_peers(rxnet); +diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c +index 12672019f76c5..66cdfd5725acf 100644 +--- a/net/smc/smc_core.c ++++ b/net/smc/smc_core.c +@@ -734,7 +734,7 @@ static struct smc_buf_desc *smc_buf_get_slot(int compressed_bufsize, + */ + static inline int smc_rmb_wnd_update_limit(int rmbe_size) + { +- return min_t(int, rmbe_size / 10, SOCK_MIN_SNDBUF / 2); ++ return max_t(int, rmbe_size / 10, SOCK_MIN_SNDBUF / 2); + } + + static struct smc_buf_desc *smcr_new_buf_create(struct smc_link_group *lgr, +diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c +index b6039642df67e..08e1ccc01e983 100644 +--- a/net/sunrpc/clnt.c ++++ b/net/sunrpc/clnt.c +@@ -2223,6 +2223,7 @@ call_transmit_status(struct rpc_task *task) + * socket just returned a connection error, + * then hold onto the transport lock. + */ ++ case -ENOMEM: + case -ENOBUFS: + rpc_delay(task, HZ>>2); + /* fall through */ +@@ -2308,6 +2309,7 @@ call_bc_transmit_status(struct rpc_task *task) + case -ENOTCONN: + case -EPIPE: + break; ++ case -ENOMEM: + case -ENOBUFS: + rpc_delay(task, HZ>>2); + /* fall through */ +@@ -2392,6 +2394,11 @@ call_status(struct rpc_task *task) + case -EPIPE: + case -EAGAIN: + break; ++ case -ENFILE: ++ case -ENOBUFS: ++ case -ENOMEM: ++ rpc_delay(task, HZ>>2); ++ break; + case -EIO: + /* shutdown or soft timeout */ + goto out_exit; +diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c +index 8fc4a6b3422f4..32ffa801a5b97 100644 +--- a/net/sunrpc/sched.c ++++ b/net/sunrpc/sched.c +@@ -1039,8 +1039,10 @@ int rpc_malloc(struct rpc_task *task) + struct rpc_buffer *buf; + gfp_t gfp = GFP_NOFS; + ++ if (RPC_IS_ASYNC(task)) ++ gfp = GFP_NOWAIT | __GFP_NOWARN; + if (RPC_IS_SWAPPER(task)) +- gfp = __GFP_MEMALLOC | GFP_NOWAIT | __GFP_NOWARN; ++ gfp |= __GFP_MEMALLOC; + + size += sizeof(struct rpc_buffer); + if (size <= RPC_BUFFER_MAXSIZE) +diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c +index 93b6afd28405e..8ac579778e487 100644 +--- a/net/sunrpc/xprt.c ++++ b/net/sunrpc/xprt.c +@@ -2006,7 +2006,14 @@ static void xprt_destroy(struct rpc_xprt *xprt) + */ + wait_on_bit_lock(&xprt->state, XPRT_LOCKED, TASK_UNINTERRUPTIBLE); + ++ /* ++ * xprt_schedule_autodisconnect() can run after XPRT_LOCKED ++ * is cleared. We use ->transport_lock to ensure the mod_timer() ++ * can only run *before* del_time_sync(), never after. ++ */ ++ spin_lock(&xprt->transport_lock); + del_timer_sync(&xprt->timer); ++ spin_unlock(&xprt->transport_lock); + + /* + * Destroy sockets etc from the system workqueue so they can +diff --git a/net/sunrpc/xprtrdma/transport.c b/net/sunrpc/xprtrdma/transport.c +index 2f21e3c52bfc1..866bcd99bdc0e 100644 +--- a/net/sunrpc/xprtrdma/transport.c ++++ b/net/sunrpc/xprtrdma/transport.c +@@ -626,8 +626,10 @@ xprt_rdma_allocate(struct rpc_task *task) + gfp_t flags; + + flags = RPCRDMA_DEF_GFP; ++ if (RPC_IS_ASYNC(task)) ++ flags = GFP_NOWAIT | __GFP_NOWARN; + if (RPC_IS_SWAPPER(task)) +- flags = __GFP_MEMALLOC | GFP_NOWAIT | __GFP_NOWARN; ++ flags |= __GFP_MEMALLOC; + + if (!rpcrdma_check_regbuf(r_xprt, req->rl_sendbuf, rqst->rq_callsize, + flags)) +diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c +index 8ffc54b6661f8..480e879e74ae5 100644 +--- a/net/sunrpc/xprtsock.c ++++ b/net/sunrpc/xprtsock.c +@@ -872,12 +872,12 @@ out: + /** + * xs_nospace - handle transmit was incomplete + * @req: pointer to RPC request ++ * @transport: pointer to struct sock_xprt + * + */ +-static int xs_nospace(struct rpc_rqst *req) ++static int xs_nospace(struct rpc_rqst *req, struct sock_xprt *transport) + { +- struct rpc_xprt *xprt = req->rq_xprt; +- struct sock_xprt *transport = container_of(xprt, struct sock_xprt, xprt); ++ struct rpc_xprt *xprt = &transport->xprt; + struct sock *sk = transport->inet; + int ret = -EAGAIN; + +@@ -891,25 +891,49 @@ static int xs_nospace(struct rpc_rqst *req) + + /* Don't race with disconnect */ + if (xprt_connected(xprt)) { ++ struct socket_wq *wq; ++ ++ rcu_read_lock(); ++ wq = rcu_dereference(sk->sk_wq); ++ set_bit(SOCKWQ_ASYNC_NOSPACE, &wq->flags); ++ rcu_read_unlock(); ++ + /* wait for more buffer space */ ++ set_bit(SOCK_NOSPACE, &sk->sk_socket->flags); + sk->sk_write_pending++; + xprt_wait_for_buffer_space(xprt); + } else + ret = -ENOTCONN; + + spin_unlock(&xprt->transport_lock); ++ return ret; ++} + +- /* Race breaker in case memory is freed before above code is called */ +- if (ret == -EAGAIN) { +- struct socket_wq *wq; ++static int xs_sock_nospace(struct rpc_rqst *req) ++{ ++ struct sock_xprt *transport = ++ container_of(req->rq_xprt, struct sock_xprt, xprt); ++ struct sock *sk = transport->inet; ++ int ret = -EAGAIN; + +- rcu_read_lock(); +- wq = rcu_dereference(sk->sk_wq); +- set_bit(SOCKWQ_ASYNC_NOSPACE, &wq->flags); +- rcu_read_unlock(); ++ lock_sock(sk); ++ if (!sock_writeable(sk)) ++ ret = xs_nospace(req, transport); ++ release_sock(sk); ++ return ret; ++} + +- sk->sk_write_space(sk); +- } ++static int xs_stream_nospace(struct rpc_rqst *req) ++{ ++ struct sock_xprt *transport = ++ container_of(req->rq_xprt, struct sock_xprt, xprt); ++ struct sock *sk = transport->inet; ++ int ret = -EAGAIN; ++ ++ lock_sock(sk); ++ if (!sk_stream_memory_free(sk)) ++ ret = xs_nospace(req, transport); ++ release_sock(sk); + return ret; + } + +@@ -996,7 +1020,7 @@ static int xs_local_send_request(struct rpc_rqst *req) + case -ENOBUFS: + break; + case -EAGAIN: +- status = xs_nospace(req); ++ status = xs_stream_nospace(req); + break; + default: + dprintk("RPC: sendmsg returned unrecognized error %d\n", +@@ -1068,7 +1092,7 @@ process_status: + /* Should we call xs_close() here? */ + break; + case -EAGAIN: +- status = xs_nospace(req); ++ status = xs_sock_nospace(req); + break; + case -ENETUNREACH: + case -ENOBUFS: +@@ -1181,7 +1205,7 @@ static int xs_tcp_send_request(struct rpc_rqst *req) + /* Should we call xs_close() here? */ + break; + case -EAGAIN: +- status = xs_nospace(req); ++ status = xs_stream_nospace(req); + break; + case -ECONNRESET: + case -ECONNREFUSED: +diff --git a/net/tipc/socket.c b/net/tipc/socket.c +index f4217673eee70..d543c4556df20 100644 +--- a/net/tipc/socket.c ++++ b/net/tipc/socket.c +@@ -2698,7 +2698,8 @@ static void tipc_sk_retry_connect(struct sock *sk, struct sk_buff_head *list) + + /* Try again later if dest link is congested */ + if (tsk->cong_link_cnt) { +- sk_reset_timer(sk, &sk->sk_timer, msecs_to_jiffies(100)); ++ sk_reset_timer(sk, &sk->sk_timer, ++ jiffies + msecs_to_jiffies(100)); + return; + } + /* Prepare SYN for retransmit */ +diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c +index 1436a36c1934a..af3be9a29d6db 100644 +--- a/net/tls/tls_sw.c ++++ b/net/tls/tls_sw.c +@@ -1479,7 +1479,7 @@ static int decrypt_internal(struct sock *sk, struct sk_buff *skb, + } + if (prot->version == TLS_1_3_VERSION) + memcpy(iv + iv_offset, tls_ctx->rx.iv, +- crypto_aead_ivsize(ctx->aead_recv)); ++ prot->iv_size + prot->salt_size); + else + memcpy(iv + iv_offset, tls_ctx->rx.iv, prot->salt_size); + +diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c +index d8d603aa48875..c94aa587e0c92 100644 +--- a/net/x25/af_x25.c ++++ b/net/x25/af_x25.c +@@ -1767,10 +1767,15 @@ void x25_kill_by_neigh(struct x25_neigh *nb) + + write_lock_bh(&x25_list_lock); + +- sk_for_each(s, &x25_list) +- if (x25_sk(s)->neighbour == nb) ++ sk_for_each(s, &x25_list) { ++ if (x25_sk(s)->neighbour == nb) { ++ write_unlock_bh(&x25_list_lock); ++ lock_sock(s); + x25_disconnect(s, ENETUNREACH, 0, 0); +- ++ release_sock(s); ++ write_lock_bh(&x25_list_lock); ++ } ++ } + write_unlock_bh(&x25_list_lock); + + /* Remove any related forwards */ +diff --git a/net/xfrm/xfrm_interface.c b/net/xfrm/xfrm_interface.c +index 3932d3aaff270..4cfa79e04e3d1 100644 +--- a/net/xfrm/xfrm_interface.c ++++ b/net/xfrm/xfrm_interface.c +@@ -300,7 +300,10 @@ xfrmi_xmit2(struct sk_buff *skb, struct net_device *dev, struct flowi *fl) + if (mtu < IPV6_MIN_MTU) + mtu = IPV6_MIN_MTU; + +- icmpv6_ndo_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu); ++ if (skb->len > 1280) ++ icmpv6_ndo_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu); ++ else ++ goto xmit; + } else { + if (!(ip_hdr(skb)->frag_off & htons(IP_DF))) + goto xmit; +diff --git a/scripts/gcc-plugins/stackleak_plugin.c b/scripts/gcc-plugins/stackleak_plugin.c +index dbd37460c573e..f46abb315010d 100644 +--- a/scripts/gcc-plugins/stackleak_plugin.c ++++ b/scripts/gcc-plugins/stackleak_plugin.c +@@ -262,6 +262,23 @@ static unsigned int stackleak_cleanup_execute(void) + return 0; + } + ++/* ++ * STRING_CST may or may not be NUL terminated: ++ * https://gcc.gnu.org/onlinedocs/gccint/Constant-expressions.html ++ */ ++static inline bool string_equal(tree node, const char *string, int length) ++{ ++ if (TREE_STRING_LENGTH(node) < length) ++ return false; ++ if (TREE_STRING_LENGTH(node) > length + 1) ++ return false; ++ if (TREE_STRING_LENGTH(node) == length + 1 && ++ TREE_STRING_POINTER(node)[length] != '\0') ++ return false; ++ return !memcmp(TREE_STRING_POINTER(node), string, length); ++} ++#define STRING_EQUAL(node, str) string_equal(node, str, strlen(str)) ++ + static bool stackleak_gate(void) + { + tree section; +@@ -271,13 +288,13 @@ static bool stackleak_gate(void) + if (section && TREE_VALUE(section)) { + section = TREE_VALUE(TREE_VALUE(section)); + +- if (!strncmp(TREE_STRING_POINTER(section), ".init.text", 10)) ++ if (STRING_EQUAL(section, ".init.text")) + return false; +- if (!strncmp(TREE_STRING_POINTER(section), ".devinit.text", 13)) ++ if (STRING_EQUAL(section, ".devinit.text")) + return false; +- if (!strncmp(TREE_STRING_POINTER(section), ".cpuinit.text", 13)) ++ if (STRING_EQUAL(section, ".cpuinit.text")) + return false; +- if (!strncmp(TREE_STRING_POINTER(section), ".meminit.text", 13)) ++ if (STRING_EQUAL(section, ".meminit.text")) + return false; + } + +diff --git a/security/keys/keyctl_pkey.c b/security/keys/keyctl_pkey.c +index 931d8dfb4a7f4..63e5c646f7620 100644 +--- a/security/keys/keyctl_pkey.c ++++ b/security/keys/keyctl_pkey.c +@@ -135,15 +135,23 @@ static int keyctl_pkey_params_get_2(const struct keyctl_pkey_params __user *_par + + switch (op) { + case KEYCTL_PKEY_ENCRYPT: ++ if (uparams.in_len > info.max_dec_size || ++ uparams.out_len > info.max_enc_size) ++ return -EINVAL; ++ break; + case KEYCTL_PKEY_DECRYPT: + if (uparams.in_len > info.max_enc_size || + uparams.out_len > info.max_dec_size) + return -EINVAL; + break; + case KEYCTL_PKEY_SIGN: ++ if (uparams.in_len > info.max_data_size || ++ uparams.out_len > info.max_sig_size) ++ return -EINVAL; ++ break; + case KEYCTL_PKEY_VERIFY: +- if (uparams.in_len > info.max_sig_size || +- uparams.out_len > info.max_data_size) ++ if (uparams.in_len > info.max_data_size || ++ uparams.in2_len > info.max_sig_size) + return -EINVAL; + break; + default: +@@ -151,7 +159,7 @@ static int keyctl_pkey_params_get_2(const struct keyctl_pkey_params __user *_par + } + + params->in_len = uparams.in_len; +- params->out_len = uparams.out_len; ++ params->out_len = uparams.out_len; /* Note: same as in2_len */ + return 0; + } + +diff --git a/security/security.c b/security/security.c +index c34ec4c7d98cc..f633717311a34 100644 +--- a/security/security.c ++++ b/security/security.c +@@ -802,9 +802,22 @@ int security_fs_context_dup(struct fs_context *fc, struct fs_context *src_fc) + return call_int_hook(fs_context_dup, 0, fc, src_fc); + } + +-int security_fs_context_parse_param(struct fs_context *fc, struct fs_parameter *param) ++int security_fs_context_parse_param(struct fs_context *fc, ++ struct fs_parameter *param) + { +- return call_int_hook(fs_context_parse_param, -ENOPARAM, fc, param); ++ struct security_hook_list *hp; ++ int trc; ++ int rc = -ENOPARAM; ++ ++ hlist_for_each_entry(hp, &security_hook_heads.fs_context_parse_param, ++ list) { ++ trc = hp->hook.fs_context_parse_param(fc, param); ++ if (trc == 0) ++ rc = 0; ++ else if (trc != -ENOPARAM) ++ return trc; ++ } ++ return rc; + } + + int security_sb_alloc(struct super_block *sb) +diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c +index 56418cf72069d..d9f15c84aab7d 100644 +--- a/security/selinux/hooks.c ++++ b/security/selinux/hooks.c +@@ -2855,10 +2855,9 @@ static int selinux_fs_context_parse_param(struct fs_context *fc, + return opt; + + rc = selinux_add_opt(opt, param->string, &fc->security); +- if (!rc) { ++ if (!rc) + param->string = NULL; +- rc = 1; +- } ++ + return rc; + } + +diff --git a/security/selinux/xfrm.c b/security/selinux/xfrm.c +index 7314196185d15..00e95f8bd7c73 100644 +--- a/security/selinux/xfrm.c ++++ b/security/selinux/xfrm.c +@@ -346,7 +346,7 @@ int selinux_xfrm_state_alloc_acquire(struct xfrm_state *x, + int rc; + struct xfrm_sec_ctx *ctx; + char *ctx_str = NULL; +- int str_len; ++ u32 str_len; + + if (!polsec) + return 0; +diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c +index 12c0fa85d9f82..0253cd2e2358a 100644 +--- a/security/smack/smack_lsm.c ++++ b/security/smack/smack_lsm.c +@@ -2501,7 +2501,7 @@ static int smk_ipv6_check(struct smack_known *subject, + #ifdef CONFIG_AUDIT + smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net); + ad.a.u.net->family = PF_INET6; +- ad.a.u.net->dport = ntohs(address->sin6_port); ++ ad.a.u.net->dport = address->sin6_port; + if (act == SMK_RECEIVING) + ad.a.u.net->v6info.saddr = address->sin6_addr; + else +diff --git a/security/tomoyo/load_policy.c b/security/tomoyo/load_policy.c +index 3445ae6fd4794..363b65be87ab7 100644 +--- a/security/tomoyo/load_policy.c ++++ b/security/tomoyo/load_policy.c +@@ -24,7 +24,7 @@ static const char *tomoyo_loader; + static int __init tomoyo_loader_setup(char *str) + { + tomoyo_loader = str; +- return 0; ++ return 1; + } + + __setup("TOMOYO_loader=", tomoyo_loader_setup); +@@ -64,7 +64,7 @@ static const char *tomoyo_trigger; + static int __init tomoyo_trigger_setup(char *str) + { + tomoyo_trigger = str; +- return 0; ++ return 1; + } + + __setup("TOMOYO_trigger=", tomoyo_trigger_setup); +diff --git a/sound/firewire/fcp.c b/sound/firewire/fcp.c +index bbfbebf4affbc..df44dd5dc4b22 100644 +--- a/sound/firewire/fcp.c ++++ b/sound/firewire/fcp.c +@@ -240,9 +240,7 @@ int fcp_avc_transaction(struct fw_unit *unit, + t.response_match_bytes = response_match_bytes; + t.state = STATE_PENDING; + init_waitqueue_head(&t.wait); +- +- if (*(const u8 *)command == 0x00 || *(const u8 *)command == 0x03) +- t.deferrable = true; ++ t.deferrable = (*(const u8 *)command == 0x00 || *(const u8 *)command == 0x03); + + spin_lock_irq(&transactions_lock); + list_add_tail(&t.list, &transactions); +diff --git a/sound/isa/cs423x/cs4236.c b/sound/isa/cs423x/cs4236.c +index fa3c39cff5f85..9ee3a312c6793 100644 +--- a/sound/isa/cs423x/cs4236.c ++++ b/sound/isa/cs423x/cs4236.c +@@ -544,7 +544,7 @@ static int snd_cs423x_pnpbios_detect(struct pnp_dev *pdev, + static int dev; + int err; + struct snd_card *card; +- struct pnp_dev *cdev; ++ struct pnp_dev *cdev, *iter; + char cid[PNP_ID_LEN]; + + if (pnp_device_is_isapnp(pdev)) +@@ -560,9 +560,11 @@ static int snd_cs423x_pnpbios_detect(struct pnp_dev *pdev, + strcpy(cid, pdev->id[0].id); + cid[5] = '1'; + cdev = NULL; +- list_for_each_entry(cdev, &(pdev->protocol->devices), protocol_list) { +- if (!strcmp(cdev->id[0].id, cid)) ++ list_for_each_entry(iter, &(pdev->protocol->devices), protocol_list) { ++ if (!strcmp(iter->id[0].id, cid)) { ++ cdev = iter; + break; ++ } + } + err = snd_cs423x_card_new(&pdev->dev, dev, &card); + if (err < 0) +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index d201043d661c1..05ca4196cb0fd 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -3557,8 +3557,8 @@ static void alc256_shutup(struct hda_codec *codec) + /* If disable 3k pulldown control for alc257, the Mic detection will not work correctly + * when booting with headset plugged. So skip setting it for the codec alc257 + */ +- if (spec->codec_variant != ALC269_TYPE_ALC257 && +- spec->codec_variant != ALC269_TYPE_ALC256) ++ if (codec->core.vendor_id != 0x10ec0236 && ++ codec->core.vendor_id != 0x10ec0257) + alc_update_coef_idx(codec, 0x46, 0, 3 << 12); + + if (!spec->no_shutup_pins) +@@ -6456,6 +6456,7 @@ enum { + ALC285_FIXUP_HP_MUTE_LED, + ALC236_FIXUP_HP_MUTE_LED, + ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET, ++ ALC256_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET, + ALC295_FIXUP_ASUS_MIC_NO_PRESENCE, + ALC269VC_FIXUP_ACER_VCOPPERBOX_PINS, + ALC269VC_FIXUP_ACER_HEADSET_MIC, +@@ -7740,6 +7741,14 @@ static const struct hda_fixup alc269_fixups[] = { + { } + }, + }, ++ [ALC256_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET] = { ++ .type = HDA_FIXUP_VERBS, ++ .v.verbs = (const struct hda_verb[]) { ++ { 0x20, AC_VERB_SET_COEF_INDEX, 0x08}, ++ { 0x20, AC_VERB_SET_PROC_COEF, 0x2fcf}, ++ { } ++ }, ++ }, + [ALC295_FIXUP_ASUS_MIC_NO_PRESENCE] = { + .type = HDA_FIXUP_PINS, + .v.pins = (const struct hda_pintbl[]) { +@@ -8217,6 +8226,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x144d, 0xc740, "Samsung Ativ book 8 (NP870Z5G)", ALC269_FIXUP_ATIV_BOOK_8), + SND_PCI_QUIRK(0x144d, 0xc812, "Samsung Notebook Pen S (NT950SBE-X58)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET), + SND_PCI_QUIRK(0x144d, 0xc830, "Samsung Galaxy Book Ion (NT950XCJ-X716A)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET), ++ SND_PCI_QUIRK(0x144d, 0xc832, "Samsung Galaxy Book Flex Alpha (NP730QCJ)", ALC256_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET), + SND_PCI_QUIRK(0x1458, 0xfa53, "Gigabyte BXBT-2807", ALC283_FIXUP_HEADSET_MIC), + SND_PCI_QUIRK(0x1462, 0xb120, "MSI Cubi MS-B120", ALC283_FIXUP_HEADSET_MIC), + SND_PCI_QUIRK(0x1462, 0xb171, "Cubi N 8GL (MS-B171)", ALC283_FIXUP_HEADSET_MIC), +@@ -8540,6 +8550,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = { + {.id = ALC298_FIXUP_HUAWEI_MBX_STEREO, .name = "huawei-mbx-stereo"}, + {.id = ALC256_FIXUP_MEDION_HEADSET_NO_PRESENCE, .name = "alc256-medion-headset"}, + {.id = ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET, .name = "alc298-samsung-headphone"}, ++ {.id = ALC256_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET, .name = "alc256-samsung-headphone"}, + {.id = ALC255_FIXUP_XIAOMI_HEADSET_MIC, .name = "alc255-xiaomi-headset"}, + {.id = ALC274_FIXUP_HP_MIC, .name = "alc274-hp-mic-detect"}, + {.id = ALC295_FIXUP_HP_OMEN, .name = "alc295-hp-omen"}, +diff --git a/sound/soc/atmel/atmel_ssc_dai.c b/sound/soc/atmel/atmel_ssc_dai.c +index ca603397651c0..1e0973322cd00 100644 +--- a/sound/soc/atmel/atmel_ssc_dai.c ++++ b/sound/soc/atmel/atmel_ssc_dai.c +@@ -280,7 +280,10 @@ static int atmel_ssc_startup(struct snd_pcm_substream *substream, + + /* Enable PMC peripheral clock for this SSC */ + pr_debug("atmel_ssc_dai: Starting clock\n"); +- clk_enable(ssc_p->ssc->clk); ++ ret = clk_enable(ssc_p->ssc->clk); ++ if (ret) ++ return ret; ++ + ssc_p->mck_rate = clk_get_rate(ssc_p->ssc->clk); + + /* Reset the SSC unless initialized to keep it in a clean state */ +diff --git a/sound/soc/atmel/sam9g20_wm8731.c b/sound/soc/atmel/sam9g20_wm8731.c +index b1bef2bf142dc..05277a88e20d8 100644 +--- a/sound/soc/atmel/sam9g20_wm8731.c ++++ b/sound/soc/atmel/sam9g20_wm8731.c +@@ -214,6 +214,7 @@ static int at91sam9g20ek_audio_probe(struct platform_device *pdev) + cpu_np = of_parse_phandle(np, "atmel,ssc-controller", 0); + if (!cpu_np) { + dev_err(&pdev->dev, "dai and pcm info missing\n"); ++ of_node_put(codec_np); + return -EINVAL; + } + at91sam9g20ek_dai.cpus->of_node = cpu_np; +diff --git a/sound/soc/codecs/Kconfig b/sound/soc/codecs/Kconfig +index 229cc89f8c5a5..466dc67799f4c 100644 +--- a/sound/soc/codecs/Kconfig ++++ b/sound/soc/codecs/Kconfig +@@ -586,21 +586,26 @@ config SND_SOC_CS4349 + + config SND_SOC_CS47L15 + tristate ++ depends on MFD_CS47L15 + + config SND_SOC_CS47L24 + tristate + + config SND_SOC_CS47L35 + tristate ++ depends on MFD_CS47L35 + + config SND_SOC_CS47L85 + tristate ++ depends on MFD_CS47L85 + + config SND_SOC_CS47L90 + tristate ++ depends on MFD_CS47L90 + + config SND_SOC_CS47L92 + tristate ++ depends on MFD_CS47L92 + + # Cirrus Logic Quad-Channel ADC + config SND_SOC_CS53L30 +diff --git a/sound/soc/codecs/msm8916-wcd-analog.c b/sound/soc/codecs/msm8916-wcd-analog.c +index 337bddb7c2a49..5a8eedea6be03 100644 +--- a/sound/soc/codecs/msm8916-wcd-analog.c ++++ b/sound/soc/codecs/msm8916-wcd-analog.c +@@ -1195,8 +1195,10 @@ static int pm8916_wcd_analog_spmi_probe(struct platform_device *pdev) + } + + irq = platform_get_irq_byname(pdev, "mbhc_switch_int"); +- if (irq < 0) +- return irq; ++ if (irq < 0) { ++ ret = irq; ++ goto err_disable_clk; ++ } + + ret = devm_request_threaded_irq(dev, irq, NULL, + pm8916_mbhc_switch_irq_handler, +@@ -1208,8 +1210,10 @@ static int pm8916_wcd_analog_spmi_probe(struct platform_device *pdev) + + if (priv->mbhc_btn_enabled) { + irq = platform_get_irq_byname(pdev, "mbhc_but_press_det"); +- if (irq < 0) +- return irq; ++ if (irq < 0) { ++ ret = irq; ++ goto err_disable_clk; ++ } + + ret = devm_request_threaded_irq(dev, irq, NULL, + mbhc_btn_press_irq_handler, +@@ -1220,8 +1224,10 @@ static int pm8916_wcd_analog_spmi_probe(struct platform_device *pdev) + dev_err(dev, "cannot request mbhc button press irq\n"); + + irq = platform_get_irq_byname(pdev, "mbhc_but_rel_det"); +- if (irq < 0) +- return irq; ++ if (irq < 0) { ++ ret = irq; ++ goto err_disable_clk; ++ } + + ret = devm_request_threaded_irq(dev, irq, NULL, + mbhc_btn_release_irq_handler, +@@ -1238,6 +1244,10 @@ static int pm8916_wcd_analog_spmi_probe(struct platform_device *pdev) + return devm_snd_soc_register_component(dev, &pm8916_wcd_analog, + pm8916_wcd_analog_dai, + ARRAY_SIZE(pm8916_wcd_analog_dai)); ++ ++err_disable_clk: ++ clk_disable_unprepare(priv->mclk); ++ return ret; + } + + static int pm8916_wcd_analog_spmi_remove(struct platform_device *pdev) +diff --git a/sound/soc/codecs/msm8916-wcd-digital.c b/sound/soc/codecs/msm8916-wcd-digital.c +index 09fccacadd6b1..d5269ab5f91c5 100644 +--- a/sound/soc/codecs/msm8916-wcd-digital.c ++++ b/sound/soc/codecs/msm8916-wcd-digital.c +@@ -1201,7 +1201,7 @@ static int msm8916_wcd_digital_probe(struct platform_device *pdev) + ret = clk_prepare_enable(priv->mclk); + if (ret < 0) { + dev_err(dev, "failed to enable mclk %d\n", ret); +- return ret; ++ goto err_clk; + } + + dev_set_drvdata(dev, priv); +@@ -1209,6 +1209,9 @@ static int msm8916_wcd_digital_probe(struct platform_device *pdev) + return devm_snd_soc_register_component(dev, &msm8916_wcd_digital, + msm8916_wcd_digital_dai, + ARRAY_SIZE(msm8916_wcd_digital_dai)); ++err_clk: ++ clk_disable_unprepare(priv->ahbclk); ++ return ret; + } + + static int msm8916_wcd_digital_remove(struct platform_device *pdev) +diff --git a/sound/soc/codecs/mt6358.c b/sound/soc/codecs/mt6358.c +index bb737fd678cc6..494ba0eeb4336 100644 +--- a/sound/soc/codecs/mt6358.c ++++ b/sound/soc/codecs/mt6358.c +@@ -103,6 +103,7 @@ int mt6358_set_mtkaif_protocol(struct snd_soc_component *cmpnt, + priv->mtkaif_protocol = mtkaif_protocol; + return 0; + } ++EXPORT_SYMBOL_GPL(mt6358_set_mtkaif_protocol); + + static void playback_gpio_set(struct mt6358_priv *priv) + { +@@ -269,6 +270,7 @@ int mt6358_mtkaif_calibration_enable(struct snd_soc_component *cmpnt) + 1 << RG_AUD_PAD_TOP_DAT_MISO_LOOPBACK_SFT); + return 0; + } ++EXPORT_SYMBOL_GPL(mt6358_mtkaif_calibration_enable); + + int mt6358_mtkaif_calibration_disable(struct snd_soc_component *cmpnt) + { +@@ -292,6 +294,7 @@ int mt6358_mtkaif_calibration_disable(struct snd_soc_component *cmpnt) + capture_gpio_reset(priv); + return 0; + } ++EXPORT_SYMBOL_GPL(mt6358_mtkaif_calibration_disable); + + int mt6358_set_mtkaif_calibration_phase(struct snd_soc_component *cmpnt, + int phase_1, int phase_2) +@@ -306,6 +309,7 @@ int mt6358_set_mtkaif_calibration_phase(struct snd_soc_component *cmpnt, + phase_2 << RG_AUD_PAD_TOP_PHASE_MODE2_SFT); + return 0; + } ++EXPORT_SYMBOL_GPL(mt6358_set_mtkaif_calibration_phase); + + /* dl pga gain */ + enum { +diff --git a/sound/soc/codecs/rt5663.c b/sound/soc/codecs/rt5663.c +index 3610be1590fcc..19e2f622718d6 100644 +--- a/sound/soc/codecs/rt5663.c ++++ b/sound/soc/codecs/rt5663.c +@@ -3478,6 +3478,8 @@ static int rt5663_parse_dp(struct rt5663_priv *rt5663, struct device *dev) + table_size = sizeof(struct impedance_mapping_table) * + rt5663->pdata.impedance_sensing_num; + rt5663->imp_table = devm_kzalloc(dev, table_size, GFP_KERNEL); ++ if (!rt5663->imp_table) ++ return -ENOMEM; + ret = device_property_read_u32_array(dev, + "realtek,impedance_sensing_table", + (u32 *)rt5663->imp_table, table_size); +diff --git a/sound/soc/codecs/wm8350.c b/sound/soc/codecs/wm8350.c +index fe99584c917f8..9cd91bb0a9022 100644 +--- a/sound/soc/codecs/wm8350.c ++++ b/sound/soc/codecs/wm8350.c +@@ -1535,18 +1535,38 @@ static int wm8350_component_probe(struct snd_soc_component *component) + wm8350_clear_bits(wm8350, WM8350_JACK_DETECT, + WM8350_JDL_ENA | WM8350_JDR_ENA); + +- wm8350_register_irq(wm8350, WM8350_IRQ_CODEC_JCK_DET_L, ++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CODEC_JCK_DET_L, + wm8350_hpl_jack_handler, 0, "Left jack detect", + priv); +- wm8350_register_irq(wm8350, WM8350_IRQ_CODEC_JCK_DET_R, ++ if (ret != 0) ++ goto err; ++ ++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CODEC_JCK_DET_R, + wm8350_hpr_jack_handler, 0, "Right jack detect", + priv); +- wm8350_register_irq(wm8350, WM8350_IRQ_CODEC_MICSCD, ++ if (ret != 0) ++ goto free_jck_det_l; ++ ++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CODEC_MICSCD, + wm8350_mic_handler, 0, "Microphone short", priv); +- wm8350_register_irq(wm8350, WM8350_IRQ_CODEC_MICD, ++ if (ret != 0) ++ goto free_jck_det_r; ++ ++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CODEC_MICD, + wm8350_mic_handler, 0, "Microphone detect", priv); ++ if (ret != 0) ++ goto free_micscd; + + return 0; ++ ++free_micscd: ++ wm8350_free_irq(wm8350, WM8350_IRQ_CODEC_MICSCD, priv); ++free_jck_det_r: ++ wm8350_free_irq(wm8350, WM8350_IRQ_CODEC_JCK_DET_R, priv); ++free_jck_det_l: ++ wm8350_free_irq(wm8350, WM8350_IRQ_CODEC_JCK_DET_L, priv); ++err: ++ return ret; + } + + static void wm8350_component_remove(struct snd_soc_component *component) +diff --git a/sound/soc/fsl/imx-es8328.c b/sound/soc/fsl/imx-es8328.c +index fad1eb6253d53..9e602c3456196 100644 +--- a/sound/soc/fsl/imx-es8328.c ++++ b/sound/soc/fsl/imx-es8328.c +@@ -87,6 +87,7 @@ static int imx_es8328_probe(struct platform_device *pdev) + if (int_port > MUX_PORT_MAX || int_port == 0) { + dev_err(dev, "mux-int-port: hardware only has %d mux ports\n", + MUX_PORT_MAX); ++ ret = -EINVAL; + goto fail; + } + +diff --git a/sound/soc/mxs/mxs-saif.c b/sound/soc/mxs/mxs-saif.c +index 1e38ce8583262..cb1b525cbe9de 100644 +--- a/sound/soc/mxs/mxs-saif.c ++++ b/sound/soc/mxs/mxs-saif.c +@@ -455,7 +455,10 @@ static int mxs_saif_hw_params(struct snd_pcm_substream *substream, + * basic clock which should be fast enough for the internal + * logic. + */ +- clk_enable(saif->clk); ++ ret = clk_enable(saif->clk); ++ if (ret) ++ return ret; ++ + ret = clk_set_rate(saif->clk, 24000000); + clk_disable(saif->clk); + if (ret) +diff --git a/sound/soc/mxs/mxs-sgtl5000.c b/sound/soc/mxs/mxs-sgtl5000.c +index 9841e1da97826..8282fe6d00dd4 100644 +--- a/sound/soc/mxs/mxs-sgtl5000.c ++++ b/sound/soc/mxs/mxs-sgtl5000.c +@@ -118,6 +118,9 @@ static int mxs_sgtl5000_probe(struct platform_device *pdev) + codec_np = of_parse_phandle(np, "audio-codec", 0); + if (!saif_np[0] || !saif_np[1] || !codec_np) { + dev_err(&pdev->dev, "phandle missing or invalid\n"); ++ of_node_put(codec_np); ++ of_node_put(saif_np[0]); ++ of_node_put(saif_np[1]); + return -EINVAL; + } + +diff --git a/sound/soc/sh/fsi.c b/sound/soc/sh/fsi.c +index 3447dbdba1f17..6ac7df30a2890 100644 +--- a/sound/soc/sh/fsi.c ++++ b/sound/soc/sh/fsi.c +@@ -816,14 +816,27 @@ static int fsi_clk_enable(struct device *dev, + return ret; + } + +- clk_enable(clock->xck); +- clk_enable(clock->ick); +- clk_enable(clock->div); ++ ret = clk_enable(clock->xck); ++ if (ret) ++ goto err; ++ ret = clk_enable(clock->ick); ++ if (ret) ++ goto disable_xck; ++ ret = clk_enable(clock->div); ++ if (ret) ++ goto disable_ick; + + clock->count++; + } + + return ret; ++ ++disable_ick: ++ clk_disable(clock->ick); ++disable_xck: ++ clk_disable(clock->xck); ++err: ++ return ret; + } + + static int fsi_clk_disable(struct device *dev, +diff --git a/sound/soc/soc-compress.c b/sound/soc/soc-compress.c +index 9e54d8ae6d2cf..da6e40aef7b6e 100644 +--- a/sound/soc/soc-compress.c ++++ b/sound/soc/soc-compress.c +@@ -871,6 +871,11 @@ int snd_soc_new_compress(struct snd_soc_pcm_runtime *rtd, int num) + return -EINVAL; + } + ++ if (!codec_dai) { ++ dev_err(rtd->card->dev, "Missing codec\n"); ++ return -EINVAL; ++ } ++ + /* check client and interface hw capabilities */ + if (snd_soc_dai_stream_valid(codec_dai, SNDRV_PCM_STREAM_PLAYBACK) && + snd_soc_dai_stream_valid(cpu_dai, SNDRV_PCM_STREAM_PLAYBACK)) +diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c +index c0e03cc8ea822..093ab32ea2c3a 100644 +--- a/sound/soc/soc-core.c ++++ b/sound/soc/soc-core.c +@@ -3362,7 +3362,7 @@ int snd_soc_get_dai_name(struct of_phandle_args *args, + for_each_component(pos) { + component_of_node = soc_component_to_node(pos); + +- if (component_of_node != args->np) ++ if (component_of_node != args->np || !pos->num_dai) + continue; + + ret = snd_soc_component_of_xlate_dai_name(pos, args, dai_name); +diff --git a/sound/soc/soc-generic-dmaengine-pcm.c b/sound/soc/soc-generic-dmaengine-pcm.c +index 5552c66ca6422..ca4b17bd95d14 100644 +--- a/sound/soc/soc-generic-dmaengine-pcm.c ++++ b/sound/soc/soc-generic-dmaengine-pcm.c +@@ -91,10 +91,10 @@ static int dmaengine_pcm_hw_params(struct snd_pcm_substream *substream, + + memset(&slave_config, 0, sizeof(slave_config)); + +- if (!pcm->config) +- prepare_slave_config = snd_dmaengine_pcm_prepare_slave_config; +- else ++ if (pcm->config && pcm->config->prepare_slave_config) + prepare_slave_config = pcm->config->prepare_slave_config; ++ else ++ prepare_slave_config = snd_dmaengine_pcm_prepare_slave_config; + + if (prepare_slave_config) { + ret = prepare_slave_config(substream, params, &slave_config); +diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c +index 21f859e56b700..870b002293535 100644 +--- a/sound/soc/soc-topology.c ++++ b/sound/soc/soc-topology.c +@@ -587,7 +587,8 @@ static int soc_tplg_kcontrol_bind_io(struct snd_soc_tplg_ctl_hdr *hdr, + + if (le32_to_cpu(hdr->ops.info) == SND_SOC_TPLG_CTL_BYTES + && k->iface & SNDRV_CTL_ELEM_IFACE_MIXER +- && k->access & SNDRV_CTL_ELEM_ACCESS_TLV_READWRITE ++ && (k->access & SNDRV_CTL_ELEM_ACCESS_TLV_READ ++ || k->access & SNDRV_CTL_ELEM_ACCESS_TLV_WRITE) + && k->access & SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK) { + struct soc_bytes_ext *sbe; + struct snd_soc_tplg_bytes_control *be; +diff --git a/sound/soc/sof/intel/hda-loader.c b/sound/soc/sof/intel/hda-loader.c +index 356bb134ae93a..7573f3f9f0f21 100644 +--- a/sound/soc/sof/intel/hda-loader.c ++++ b/sound/soc/sof/intel/hda-loader.c +@@ -50,7 +50,7 @@ static int cl_stream_prepare(struct snd_sof_dev *sdev, unsigned int format, + ret = snd_dma_alloc_pages(SNDRV_DMA_TYPE_DEV_SG, &pci->dev, size, dmab); + if (ret < 0) { + dev_err(sdev->dev, "error: memory alloc failed: %x\n", ret); +- goto error; ++ goto out_put; + } + + hstream->period_bytes = 0;/* initialize period_bytes */ +@@ -60,16 +60,17 @@ static int cl_stream_prepare(struct snd_sof_dev *sdev, unsigned int format, + ret = hda_dsp_stream_hw_params(sdev, dsp_stream, dmab, NULL); + if (ret < 0) { + dev_err(sdev->dev, "error: hdac prepare failed: %x\n", ret); +- goto error; ++ goto out_free; + } + + hda_dsp_stream_spib_config(sdev, dsp_stream, HDA_DSP_SPIB_ENABLE, size); + + return hstream->stream_tag; + +-error: +- hda_dsp_stream_put(sdev, direction, hstream->stream_tag); ++out_free: + snd_dma_free_pages(dmab); ++out_put: ++ hda_dsp_stream_put(sdev, direction, hstream->stream_tag); + return ret; + } + +diff --git a/sound/soc/ti/davinci-i2s.c b/sound/soc/ti/davinci-i2s.c +index d89b5c928c4d7..b2b2dcdb05d4c 100644 +--- a/sound/soc/ti/davinci-i2s.c ++++ b/sound/soc/ti/davinci-i2s.c +@@ -708,7 +708,9 @@ static int davinci_i2s_probe(struct platform_device *pdev) + dev->clk = clk_get(&pdev->dev, NULL); + if (IS_ERR(dev->clk)) + return -ENODEV; +- clk_enable(dev->clk); ++ ret = clk_enable(dev->clk); ++ if (ret) ++ goto err_put_clk; + + dev->dev = &pdev->dev; + dev_set_drvdata(&pdev->dev, dev); +@@ -730,6 +732,7 @@ err_unregister_component: + snd_soc_unregister_component(&pdev->dev); + err_release_clk: + clk_disable(dev->clk); ++err_put_clk: + clk_put(dev->clk); + return ret; + } +diff --git a/sound/spi/at73c213.c b/sound/spi/at73c213.c +index 4de1ba9a418d9..6e5d315bab59b 100644 +--- a/sound/spi/at73c213.c ++++ b/sound/spi/at73c213.c +@@ -218,7 +218,9 @@ static int snd_at73c213_pcm_open(struct snd_pcm_substream *substream) + runtime->hw = snd_at73c213_playback_hw; + chip->substream = substream; + +- clk_enable(chip->ssc->clk); ++ err = clk_enable(chip->ssc->clk); ++ if (err) ++ return err; + + return 0; + } +@@ -784,7 +786,9 @@ static int snd_at73c213_chip_init(struct snd_at73c213 *chip) + goto out; + + /* Enable DAC master clock. */ +- clk_enable(chip->board->dac_clk); ++ retval = clk_enable(chip->board->dac_clk); ++ if (retval) ++ goto out; + + /* Initialize at73c213 on SPI bus. */ + retval = snd_at73c213_write_reg(chip, DAC_RST, 0x04); +@@ -897,7 +901,9 @@ static int snd_at73c213_dev_init(struct snd_card *card, + chip->card = card; + chip->irq = -1; + +- clk_enable(chip->ssc->clk); ++ retval = clk_enable(chip->ssc->clk); ++ if (retval) ++ return retval; + + retval = request_irq(irq, snd_at73c213_interrupt, 0, "at73c213", chip); + if (retval) { +@@ -1016,7 +1022,9 @@ static int snd_at73c213_remove(struct spi_device *spi) + int retval; + + /* Stop playback. */ +- clk_enable(chip->ssc->clk); ++ retval = clk_enable(chip->ssc->clk); ++ if (retval) ++ goto out; + ssc_writel(chip->ssc->regs, CR, SSC_BIT(CR_TXDIS)); + clk_disable(chip->ssc->clk); + +@@ -1096,9 +1104,16 @@ static int snd_at73c213_resume(struct device *dev) + { + struct snd_card *card = dev_get_drvdata(dev); + struct snd_at73c213 *chip = card->private_data; ++ int retval; + +- clk_enable(chip->board->dac_clk); +- clk_enable(chip->ssc->clk); ++ retval = clk_enable(chip->board->dac_clk); ++ if (retval) ++ return retval; ++ retval = clk_enable(chip->ssc->clk); ++ if (retval) { ++ clk_disable(chip->board->dac_clk); ++ return retval; ++ } + ssc_writel(chip->ssc->regs, CR, SSC_BIT(CR_TXEN)); + + return 0; +diff --git a/tools/build/feature/Makefile b/tools/build/feature/Makefile +index 2a261b909dd8d..88392219d425e 100644 +--- a/tools/build/feature/Makefile ++++ b/tools/build/feature/Makefile +@@ -204,9 +204,16 @@ strip-libs = $(filter-out -l%,$(1)) + PERL_EMBED_LDOPTS = $(shell perl -MExtUtils::Embed -e ldopts 2>/dev/null) + PERL_EMBED_LDFLAGS = $(call strip-libs,$(PERL_EMBED_LDOPTS)) + PERL_EMBED_LIBADD = $(call grep-libs,$(PERL_EMBED_LDOPTS)) +-PERL_EMBED_CCOPTS = `perl -MExtUtils::Embed -e ccopts 2>/dev/null` ++PERL_EMBED_CCOPTS = $(shell perl -MExtUtils::Embed -e ccopts 2>/dev/null) + FLAGS_PERL_EMBED=$(PERL_EMBED_CCOPTS) $(PERL_EMBED_LDOPTS) + ++ifeq ($(CC_NO_CLANG), 0) ++ PERL_EMBED_LDOPTS := $(filter-out -specs=%,$(PERL_EMBED_LDOPTS)) ++ PERL_EMBED_CCOPTS := $(filter-out -flto=auto -ffat-lto-objects, $(PERL_EMBED_CCOPTS)) ++ PERL_EMBED_CCOPTS := $(filter-out -specs=%,$(PERL_EMBED_CCOPTS)) ++ FLAGS_PERL_EMBED += -Wno-compound-token-split-by-macro ++endif ++ + $(OUTPUT)test-libperl.bin: + $(BUILD) $(FLAGS_PERL_EMBED) + +diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h +index 63038eb23560b..0bfad86ec960a 100644 +--- a/tools/include/uapi/linux/bpf.h ++++ b/tools/include/uapi/linux/bpf.h +@@ -1294,8 +1294,8 @@ union bpf_attr { + * Return + * The return value depends on the result of the test, and can be: + * +- * * 0, if current task belongs to the cgroup2. +- * * 1, if current task does not belong to the cgroup2. ++ * * 1, if current task belongs to the cgroup2. ++ * * 0, if current task does not belong to the cgroup2. + * * A negative error code, if an error occurred. + * + * int bpf_skb_change_tail(struct sk_buff *skb, u32 len, u64 flags) +diff --git a/tools/lib/bpf/btf_dump.c b/tools/lib/bpf/btf_dump.c +index b2fc452504501..a1176a9e8430a 100644 +--- a/tools/lib/bpf/btf_dump.c ++++ b/tools/lib/bpf/btf_dump.c +@@ -1366,6 +1366,11 @@ static const char *btf_dump_resolve_name(struct btf_dump *d, __u32 id, + if (s->name_resolved) + return *cached_name ? *cached_name : orig_name; + ++ if (btf_is_fwd(t) || (btf_is_enum(t) && btf_vlen(t) == 0)) { ++ s->name_resolved = 1; ++ return orig_name; ++ } ++ + dup_cnt = btf_dump_name_dups(d, name_map, orig_name); + if (dup_cnt > 1) { + const size_t max_len = 256; +diff --git a/tools/perf/Makefile.config b/tools/perf/Makefile.config +index 7578af2504549..b94d9afad3f79 100644 +--- a/tools/perf/Makefile.config ++++ b/tools/perf/Makefile.config +@@ -706,6 +706,9 @@ else + LDFLAGS += $(PERL_EMBED_LDFLAGS) + EXTLIBS += $(PERL_EMBED_LIBADD) + CFLAGS += -DHAVE_LIBPERL_SUPPORT ++ ifeq ($(CC_NO_CLANG), 0) ++ CFLAGS += -Wno-compound-token-split-by-macro ++ endif + $(call detected,CONFIG_LIBPERL) + endif + endif +diff --git a/tools/perf/perf.c b/tools/perf/perf.c +index 27f94b0bb8747..505e2a2f1872b 100644 +--- a/tools/perf/perf.c ++++ b/tools/perf/perf.c +@@ -433,7 +433,7 @@ void pthread__unblock_sigwinch(void) + static int libperf_print(enum libperf_print_level level, + const char *fmt, va_list ap) + { +- return eprintf(level, verbose, fmt, ap); ++ return veprintf(level, verbose, fmt, ap); + } + + int main(int argc, const char **argv) +diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c +index 8ff2c98e90322..01e15b445cb58 100644 +--- a/tools/perf/util/session.c ++++ b/tools/perf/util/session.c +@@ -1960,6 +1960,7 @@ prefetch_event(char *buf, u64 head, size_t mmap_size, + bool needs_swap, union perf_event *error) + { + union perf_event *event; ++ u16 event_size; + + /* + * Ensure we have enough space remaining to read +@@ -1972,15 +1973,23 @@ prefetch_event(char *buf, u64 head, size_t mmap_size, + if (needs_swap) + perf_event_header__bswap(&event->header); + +- if (head + event->header.size <= mmap_size) ++ event_size = event->header.size; ++ if (head + event_size <= mmap_size) + return event; + + /* We're not fetching the event so swap back again */ + if (needs_swap) + perf_event_header__bswap(&event->header); + +- pr_debug("%s: head=%#" PRIx64 " event->header_size=%#x, mmap_size=%#zx:" +- " fuzzed or compressed perf.data?\n",__func__, head, event->header.size, mmap_size); ++ /* Check if the event fits into the next mmapped buf. */ ++ if (event_size <= mmap_size - head % page_size) { ++ /* Remap buf and fetch again. */ ++ return NULL; ++ } ++ ++ /* Invalid input. Event size should never exceed mmap_size. */ ++ pr_debug("%s: head=%#" PRIx64 " event->header.size=%#x, mmap_size=%#zx:" ++ " fuzzed or compressed perf.data?\n", __func__, head, event_size, mmap_size); + + return error; + } +diff --git a/tools/testing/selftests/bpf/test_lirc_mode2.sh b/tools/testing/selftests/bpf/test_lirc_mode2.sh +index ec4e15948e406..5252b91f48a18 100755 +--- a/tools/testing/selftests/bpf/test_lirc_mode2.sh ++++ b/tools/testing/selftests/bpf/test_lirc_mode2.sh +@@ -3,6 +3,7 @@ + + # Kselftest framework requirement - SKIP code is 4. + ksft_skip=4 ++ret=$ksft_skip + + msg="skip all tests:" + if [ $UID != 0 ]; then +@@ -25,7 +26,7 @@ do + fi + done + +-if [ -n $LIRCDEV ]; ++if [ -n "$LIRCDEV" ]; + then + TYPE=lirc_mode2 + ./test_lirc_mode2_user $LIRCDEV $INPUTDEV +@@ -36,3 +37,5 @@ then + echo -e ${GREEN}"PASS: $TYPE"${NC} + fi + fi ++ ++exit $ret +diff --git a/tools/testing/selftests/bpf/test_lwt_ip_encap.sh b/tools/testing/selftests/bpf/test_lwt_ip_encap.sh +index b497bb85b667f..6c69c42b1d607 100755 +--- a/tools/testing/selftests/bpf/test_lwt_ip_encap.sh ++++ b/tools/testing/selftests/bpf/test_lwt_ip_encap.sh +@@ -120,6 +120,14 @@ setup() + ip netns exec ${NS2} sysctl -wq net.ipv4.conf.default.rp_filter=0 + ip netns exec ${NS3} sysctl -wq net.ipv4.conf.default.rp_filter=0 + ++ # disable IPv6 DAD because it sometimes takes too long and fails tests ++ ip netns exec ${NS1} sysctl -wq net.ipv6.conf.all.accept_dad=0 ++ ip netns exec ${NS2} sysctl -wq net.ipv6.conf.all.accept_dad=0 ++ ip netns exec ${NS3} sysctl -wq net.ipv6.conf.all.accept_dad=0 ++ ip netns exec ${NS1} sysctl -wq net.ipv6.conf.default.accept_dad=0 ++ ip netns exec ${NS2} sysctl -wq net.ipv6.conf.default.accept_dad=0 ++ ip netns exec ${NS3} sysctl -wq net.ipv6.conf.default.accept_dad=0 ++ + ip link add veth1 type veth peer name veth2 + ip link add veth3 type veth peer name veth4 + ip link add veth5 type veth peer name veth6 +@@ -289,7 +297,7 @@ test_ping() + ip netns exec ${NS1} ping -c 1 -W 1 -I veth1 ${IPv4_DST} 2>&1 > /dev/null + RET=$? + elif [ "${PROTO}" == "IPv6" ] ; then +- ip netns exec ${NS1} ping6 -c 1 -W 6 -I veth1 ${IPv6_DST} 2>&1 > /dev/null ++ ip netns exec ${NS1} ping6 -c 1 -W 1 -I veth1 ${IPv6_DST} 2>&1 > /dev/null + RET=$? + else + echo " test_ping: unknown PROTO: ${PROTO}" +diff --git a/tools/testing/selftests/cgroup/cgroup_util.c b/tools/testing/selftests/cgroup/cgroup_util.c +index 5e939ff1e3f95..819f3480a6f71 100644 +--- a/tools/testing/selftests/cgroup/cgroup_util.c ++++ b/tools/testing/selftests/cgroup/cgroup_util.c +@@ -202,7 +202,7 @@ int cg_find_unified_root(char *root, size_t len) + + int cg_create(const char *cgroup) + { +- return mkdir(cgroup, 0644); ++ return mkdir(cgroup, 0755); + } + + int cg_wait_for_proc_count(const char *cgroup, int count) +diff --git a/tools/testing/selftests/cgroup/test_core.c b/tools/testing/selftests/cgroup/test_core.c +index 79053a4f47838..599234c5e496c 100644 +--- a/tools/testing/selftests/cgroup/test_core.c ++++ b/tools/testing/selftests/cgroup/test_core.c +@@ -1,8 +1,13 @@ + /* SPDX-License-Identifier: GPL-2.0 */ + ++#define _GNU_SOURCE + #include <linux/limits.h> ++#include <linux/sched.h> + #include <sys/types.h> ++#include <sys/wait.h> + #include <unistd.h> ++#include <fcntl.h> ++#include <sched.h> + #include <stdio.h> + #include <errno.h> + +@@ -354,6 +359,166 @@ cleanup: + return ret; + } + ++/* ++ * cgroup migration permission check should be performed based on the ++ * credentials at the time of open instead of write. ++ */ ++static int test_cgcore_lesser_euid_open(const char *root) ++{ ++ const uid_t test_euid = 65534; /* usually nobody, any !root is fine */ ++ int ret = KSFT_FAIL; ++ char *cg_test_a = NULL, *cg_test_b = NULL; ++ char *cg_test_a_procs = NULL, *cg_test_b_procs = NULL; ++ int cg_test_b_procs_fd = -1; ++ uid_t saved_uid; ++ ++ cg_test_a = cg_name(root, "cg_test_a"); ++ cg_test_b = cg_name(root, "cg_test_b"); ++ ++ if (!cg_test_a || !cg_test_b) ++ goto cleanup; ++ ++ cg_test_a_procs = cg_name(cg_test_a, "cgroup.procs"); ++ cg_test_b_procs = cg_name(cg_test_b, "cgroup.procs"); ++ ++ if (!cg_test_a_procs || !cg_test_b_procs) ++ goto cleanup; ++ ++ if (cg_create(cg_test_a) || cg_create(cg_test_b)) ++ goto cleanup; ++ ++ if (cg_enter_current(cg_test_a)) ++ goto cleanup; ++ ++ if (chown(cg_test_a_procs, test_euid, -1) || ++ chown(cg_test_b_procs, test_euid, -1)) ++ goto cleanup; ++ ++ saved_uid = geteuid(); ++ if (seteuid(test_euid)) ++ goto cleanup; ++ ++ cg_test_b_procs_fd = open(cg_test_b_procs, O_RDWR); ++ ++ if (seteuid(saved_uid)) ++ goto cleanup; ++ ++ if (cg_test_b_procs_fd < 0) ++ goto cleanup; ++ ++ if (write(cg_test_b_procs_fd, "0", 1) >= 0 || errno != EACCES) ++ goto cleanup; ++ ++ ret = KSFT_PASS; ++ ++cleanup: ++ cg_enter_current(root); ++ if (cg_test_b_procs_fd >= 0) ++ close(cg_test_b_procs_fd); ++ if (cg_test_b) ++ cg_destroy(cg_test_b); ++ if (cg_test_a) ++ cg_destroy(cg_test_a); ++ free(cg_test_b_procs); ++ free(cg_test_a_procs); ++ free(cg_test_b); ++ free(cg_test_a); ++ return ret; ++} ++ ++struct lesser_ns_open_thread_arg { ++ const char *path; ++ int fd; ++ int err; ++}; ++ ++static int lesser_ns_open_thread_fn(void *arg) ++{ ++ struct lesser_ns_open_thread_arg *targ = arg; ++ ++ targ->fd = open(targ->path, O_RDWR); ++ targ->err = errno; ++ return 0; ++} ++ ++/* ++ * cgroup migration permission check should be performed based on the cgroup ++ * namespace at the time of open instead of write. ++ */ ++static int test_cgcore_lesser_ns_open(const char *root) ++{ ++ static char stack[65536]; ++ const uid_t test_euid = 65534; /* usually nobody, any !root is fine */ ++ int ret = KSFT_FAIL; ++ char *cg_test_a = NULL, *cg_test_b = NULL; ++ char *cg_test_a_procs = NULL, *cg_test_b_procs = NULL; ++ int cg_test_b_procs_fd = -1; ++ struct lesser_ns_open_thread_arg targ = { .fd = -1 }; ++ pid_t pid; ++ int status; ++ ++ cg_test_a = cg_name(root, "cg_test_a"); ++ cg_test_b = cg_name(root, "cg_test_b"); ++ ++ if (!cg_test_a || !cg_test_b) ++ goto cleanup; ++ ++ cg_test_a_procs = cg_name(cg_test_a, "cgroup.procs"); ++ cg_test_b_procs = cg_name(cg_test_b, "cgroup.procs"); ++ ++ if (!cg_test_a_procs || !cg_test_b_procs) ++ goto cleanup; ++ ++ if (cg_create(cg_test_a) || cg_create(cg_test_b)) ++ goto cleanup; ++ ++ if (cg_enter_current(cg_test_b)) ++ goto cleanup; ++ ++ if (chown(cg_test_a_procs, test_euid, -1) || ++ chown(cg_test_b_procs, test_euid, -1)) ++ goto cleanup; ++ ++ targ.path = cg_test_b_procs; ++ pid = clone(lesser_ns_open_thread_fn, stack + sizeof(stack), ++ CLONE_NEWCGROUP | CLONE_FILES | CLONE_VM | SIGCHLD, ++ &targ); ++ if (pid < 0) ++ goto cleanup; ++ ++ if (waitpid(pid, &status, 0) < 0) ++ goto cleanup; ++ ++ if (!WIFEXITED(status)) ++ goto cleanup; ++ ++ cg_test_b_procs_fd = targ.fd; ++ if (cg_test_b_procs_fd < 0) ++ goto cleanup; ++ ++ if (cg_enter_current(cg_test_a)) ++ goto cleanup; ++ ++ if ((status = write(cg_test_b_procs_fd, "0", 1)) >= 0 || errno != ENOENT) ++ goto cleanup; ++ ++ ret = KSFT_PASS; ++ ++cleanup: ++ cg_enter_current(root); ++ if (cg_test_b_procs_fd >= 0) ++ close(cg_test_b_procs_fd); ++ if (cg_test_b) ++ cg_destroy(cg_test_b); ++ if (cg_test_a) ++ cg_destroy(cg_test_a); ++ free(cg_test_b_procs); ++ free(cg_test_a_procs); ++ free(cg_test_b); ++ free(cg_test_a); ++ return ret; ++} ++ + #define T(x) { x, #x } + struct corecg_test { + int (*fn)(const char *root); +@@ -366,6 +531,8 @@ struct corecg_test { + T(test_cgcore_parent_becomes_threaded), + T(test_cgcore_invalid_domain), + T(test_cgcore_populated), ++ T(test_cgcore_lesser_euid_open), ++ T(test_cgcore_lesser_ns_open), + }; + #undef T + +diff --git a/tools/testing/selftests/net/test_vxlan_under_vrf.sh b/tools/testing/selftests/net/test_vxlan_under_vrf.sh +index 09f9ed92cbe4c..a44b9aca74272 100755 +--- a/tools/testing/selftests/net/test_vxlan_under_vrf.sh ++++ b/tools/testing/selftests/net/test_vxlan_under_vrf.sh +@@ -118,11 +118,11 @@ echo "[ OK ]" + + # Move the underlay to a non-default VRF + ip -netns hv-1 link set veth0 vrf vrf-underlay +-ip -netns hv-1 link set veth0 down +-ip -netns hv-1 link set veth0 up ++ip -netns hv-1 link set vxlan0 down ++ip -netns hv-1 link set vxlan0 up + ip -netns hv-2 link set veth0 vrf vrf-underlay +-ip -netns hv-2 link set veth0 down +-ip -netns hv-2 link set veth0 up ++ip -netns hv-2 link set vxlan0 down ++ip -netns hv-2 link set vxlan0 up + + echo -n "Check VM connectivity through VXLAN (underlay in a VRF) " + ip netns exec vm-1 ping -c 1 -W 1 10.0.0.2 &> /dev/null || (echo "[FAIL]"; false) +diff --git a/tools/testing/selftests/x86/check_cc.sh b/tools/testing/selftests/x86/check_cc.sh +index 3e2089c8cf549..8c669c0d662ee 100755 +--- a/tools/testing/selftests/x86/check_cc.sh ++++ b/tools/testing/selftests/x86/check_cc.sh +@@ -7,7 +7,7 @@ CC="$1" + TESTPROG="$2" + shift 2 + +-if "$CC" -o /dev/null "$TESTPROG" -O0 "$@" 2>/dev/null; then ++if [ -n "$CC" ] && $CC -o /dev/null "$TESTPROG" -O0 "$@" 2>/dev/null; then + echo 1 + else + echo 0 +diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c +index f31976010622f..287444e52ccf8 100644 +--- a/virt/kvm/kvm_main.c ++++ b/virt/kvm/kvm_main.c +@@ -115,6 +115,8 @@ EXPORT_SYMBOL_GPL(kvm_debugfs_dir); + static int kvm_debugfs_num_entries; + static const struct file_operations *stat_fops_per_vm[]; + ++static struct file_operations kvm_chardev_ops; ++ + static long kvm_vcpu_ioctl(struct file *file, unsigned int ioctl, + unsigned long arg); + #ifdef CONFIG_KVM_COMPAT +@@ -766,6 +768,16 @@ static struct kvm *kvm_create_vm(unsigned long type) + + preempt_notifier_inc(); + ++ /* ++ * When the fd passed to this ioctl() is opened it pins the module, ++ * but try_module_get() also prevents getting a reference if the module ++ * is in MODULE_STATE_GOING (e.g. if someone ran "rmmod --wait"). ++ */ ++ if (!try_module_get(kvm_chardev_ops.owner)) { ++ r = -ENODEV; ++ goto out_err; ++ } ++ + return kvm; + + out_err: +@@ -844,6 +856,7 @@ static void kvm_destroy_vm(struct kvm *kvm) + preempt_notifier_dec(); + hardware_disable_all(); + mmdrop(mm); ++ module_put(kvm_chardev_ops.owner); + } + + void kvm_get_kvm(struct kvm *kvm) |