diff options
| -rw-r--r-- | 0000_README | 4 | ||||
| -rw-r--r-- | 1008_linux-4.18.9.patch | 5298 |
2 files changed, 5302 insertions, 0 deletions
diff --git a/0000_README b/0000_README index 597262e0..6534d27c 100644 --- a/0000_README +++ b/0000_README @@ -75,6 +75,10 @@ Patch: 1007_linux-4.18.8.patch From: http://www.kernel.org Desc: Linux 4.18.8 +Patch: 1008_linux-4.18.9.patch +From: http://www.kernel.org +Desc: Linux 4.18.9 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1008_linux-4.18.9.patch b/1008_linux-4.18.9.patch new file mode 100644 index 00000000..877b17a1 --- /dev/null +++ b/1008_linux-4.18.9.patch @@ -0,0 +1,5298 @@ +diff --git a/Makefile b/Makefile +index 0d73431f66cd..1178348fb9ca 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 18 +-SUBLEVEL = 8 ++SUBLEVEL = 9 + EXTRAVERSION = + NAME = Merciless Moray + +diff --git a/arch/arc/boot/dts/axs10x_mb.dtsi b/arch/arc/boot/dts/axs10x_mb.dtsi +index 47b74fbc403c..37bafd44e36d 100644 +--- a/arch/arc/boot/dts/axs10x_mb.dtsi ++++ b/arch/arc/boot/dts/axs10x_mb.dtsi +@@ -9,6 +9,10 @@ + */ + + / { ++ aliases { ++ ethernet = &gmac; ++ }; ++ + axs10x_mb { + compatible = "simple-bus"; + #address-cells = <1>; +@@ -68,7 +72,7 @@ + }; + }; + +- ethernet@0x18000 { ++ gmac: ethernet@0x18000 { + #interrupt-cells = <1>; + compatible = "snps,dwmac"; + reg = < 0x18000 0x2000 >; +@@ -81,6 +85,7 @@ + max-speed = <100>; + resets = <&creg_rst 5>; + reset-names = "stmmaceth"; ++ mac-address = [00 00 00 00 00 00]; /* Filled in by U-Boot */ + }; + + ehci@0x40000 { +diff --git a/arch/arc/boot/dts/hsdk.dts b/arch/arc/boot/dts/hsdk.dts +index 006aa3de5348..d00f283094d3 100644 +--- a/arch/arc/boot/dts/hsdk.dts ++++ b/arch/arc/boot/dts/hsdk.dts +@@ -25,6 +25,10 @@ + bootargs = "earlycon=uart8250,mmio32,0xf0005000,115200n8 console=ttyS0,115200n8 debug print-fatal-signals=1"; + }; + ++ aliases { ++ ethernet = &gmac; ++ }; ++ + cpus { + #address-cells = <1>; + #size-cells = <0>; +@@ -163,7 +167,7 @@ + #clock-cells = <0>; + }; + +- ethernet@8000 { ++ gmac: ethernet@8000 { + #interrupt-cells = <1>; + compatible = "snps,dwmac"; + reg = <0x8000 0x2000>; +@@ -176,6 +180,7 @@ + phy-handle = <&phy0>; + resets = <&cgu_rst HSDK_ETH_RESET>; + reset-names = "stmmaceth"; ++ mac-address = [00 00 00 00 00 00]; /* Filled in by U-Boot */ + + mdio { + #address-cells = <1>; +diff --git a/arch/arc/configs/axs101_defconfig b/arch/arc/configs/axs101_defconfig +index a635ea972304..df848c44dacd 100644 +--- a/arch/arc/configs/axs101_defconfig ++++ b/arch/arc/configs/axs101_defconfig +@@ -1,5 +1,4 @@ + CONFIG_DEFAULT_HOSTNAME="ARCLinux" +-# CONFIG_SWAP is not set + CONFIG_SYSVIPC=y + CONFIG_POSIX_MQUEUE=y + # CONFIG_CROSS_MEMORY_ATTACH is not set +diff --git a/arch/arc/configs/axs103_defconfig b/arch/arc/configs/axs103_defconfig +index aa507e423075..bcbdc0494faa 100644 +--- a/arch/arc/configs/axs103_defconfig ++++ b/arch/arc/configs/axs103_defconfig +@@ -1,5 +1,4 @@ + CONFIG_DEFAULT_HOSTNAME="ARCLinux" +-# CONFIG_SWAP is not set + CONFIG_SYSVIPC=y + CONFIG_POSIX_MQUEUE=y + # CONFIG_CROSS_MEMORY_ATTACH is not set +diff --git a/arch/arc/configs/axs103_smp_defconfig b/arch/arc/configs/axs103_smp_defconfig +index eba07f468654..d145bce7ebdf 100644 +--- a/arch/arc/configs/axs103_smp_defconfig ++++ b/arch/arc/configs/axs103_smp_defconfig +@@ -1,5 +1,4 @@ + CONFIG_DEFAULT_HOSTNAME="ARCLinux" +-# CONFIG_SWAP is not set + CONFIG_SYSVIPC=y + CONFIG_POSIX_MQUEUE=y + # CONFIG_CROSS_MEMORY_ATTACH is not set +diff --git a/arch/arm64/kvm/hyp/switch.c b/arch/arm64/kvm/hyp/switch.c +index d496ef579859..ca46153d7915 100644 +--- a/arch/arm64/kvm/hyp/switch.c ++++ b/arch/arm64/kvm/hyp/switch.c +@@ -98,8 +98,10 @@ static void activate_traps_vhe(struct kvm_vcpu *vcpu) + val = read_sysreg(cpacr_el1); + val |= CPACR_EL1_TTA; + val &= ~CPACR_EL1_ZEN; +- if (!update_fp_enabled(vcpu)) ++ if (!update_fp_enabled(vcpu)) { + val &= ~CPACR_EL1_FPEN; ++ __activate_traps_fpsimd32(vcpu); ++ } + + write_sysreg(val, cpacr_el1); + +@@ -114,8 +116,10 @@ static void __hyp_text __activate_traps_nvhe(struct kvm_vcpu *vcpu) + + val = CPTR_EL2_DEFAULT; + val |= CPTR_EL2_TTA | CPTR_EL2_TZ; +- if (!update_fp_enabled(vcpu)) ++ if (!update_fp_enabled(vcpu)) { + val |= CPTR_EL2_TFP; ++ __activate_traps_fpsimd32(vcpu); ++ } + + write_sysreg(val, cptr_el2); + } +@@ -129,7 +133,6 @@ static void __hyp_text __activate_traps(struct kvm_vcpu *vcpu) + if (cpus_have_const_cap(ARM64_HAS_RAS_EXTN) && (hcr & HCR_VSE)) + write_sysreg_s(vcpu->arch.vsesr_el2, SYS_VSESR_EL2); + +- __activate_traps_fpsimd32(vcpu); + if (has_vhe()) + activate_traps_vhe(vcpu); + else +diff --git a/arch/mips/boot/dts/mscc/ocelot.dtsi b/arch/mips/boot/dts/mscc/ocelot.dtsi +index 4f33dbc67348..7096915f26e0 100644 +--- a/arch/mips/boot/dts/mscc/ocelot.dtsi ++++ b/arch/mips/boot/dts/mscc/ocelot.dtsi +@@ -184,7 +184,7 @@ + #address-cells = <1>; + #size-cells = <0>; + compatible = "mscc,ocelot-miim"; +- reg = <0x107009c 0x36>, <0x10700f0 0x8>; ++ reg = <0x107009c 0x24>, <0x10700f0 0x8>; + interrupts = <14>; + status = "disabled"; + +diff --git a/arch/mips/cavium-octeon/octeon-platform.c b/arch/mips/cavium-octeon/octeon-platform.c +index 8505db478904..1d92efb82c37 100644 +--- a/arch/mips/cavium-octeon/octeon-platform.c ++++ b/arch/mips/cavium-octeon/octeon-platform.c +@@ -322,6 +322,7 @@ static int __init octeon_ehci_device_init(void) + return 0; + + pd = of_find_device_by_node(ehci_node); ++ of_node_put(ehci_node); + if (!pd) + return 0; + +@@ -384,6 +385,7 @@ static int __init octeon_ohci_device_init(void) + return 0; + + pd = of_find_device_by_node(ohci_node); ++ of_node_put(ohci_node); + if (!pd) + return 0; + +diff --git a/arch/mips/generic/init.c b/arch/mips/generic/init.c +index 5ba6fcc26fa7..94a78dbbc91f 100644 +--- a/arch/mips/generic/init.c ++++ b/arch/mips/generic/init.c +@@ -204,6 +204,7 @@ void __init arch_init_irq(void) + "mti,cpu-interrupt-controller"); + if (!cpu_has_veic && !intc_node) + mips_cpu_irq_init(); ++ of_node_put(intc_node); + + irqchip_init(); + } +diff --git a/arch/mips/include/asm/io.h b/arch/mips/include/asm/io.h +index cea8ad864b3f..57b34257be2b 100644 +--- a/arch/mips/include/asm/io.h ++++ b/arch/mips/include/asm/io.h +@@ -141,14 +141,14 @@ static inline void * phys_to_virt(unsigned long address) + /* + * ISA I/O bus memory addresses are 1:1 with the physical address. + */ +-static inline unsigned long isa_virt_to_bus(volatile void * address) ++static inline unsigned long isa_virt_to_bus(volatile void *address) + { +- return (unsigned long)address - PAGE_OFFSET; ++ return virt_to_phys(address); + } + +-static inline void * isa_bus_to_virt(unsigned long address) ++static inline void *isa_bus_to_virt(unsigned long address) + { +- return (void *)(address + PAGE_OFFSET); ++ return phys_to_virt(address); + } + + #define isa_page_to_bus page_to_phys +diff --git a/arch/mips/kernel/vdso.c b/arch/mips/kernel/vdso.c +index 019035d7225c..8f845f6e5f42 100644 +--- a/arch/mips/kernel/vdso.c ++++ b/arch/mips/kernel/vdso.c +@@ -13,6 +13,7 @@ + #include <linux/err.h> + #include <linux/init.h> + #include <linux/ioport.h> ++#include <linux/kernel.h> + #include <linux/mm.h> + #include <linux/sched.h> + #include <linux/slab.h> +@@ -20,6 +21,7 @@ + + #include <asm/abi.h> + #include <asm/mips-cps.h> ++#include <asm/page.h> + #include <asm/vdso.h> + + /* Kernel-provided data used by the VDSO. */ +@@ -128,12 +130,30 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp) + vvar_size = gic_size + PAGE_SIZE; + size = vvar_size + image->size; + ++ /* ++ * Find a region that's large enough for us to perform the ++ * colour-matching alignment below. ++ */ ++ if (cpu_has_dc_aliases) ++ size += shm_align_mask + 1; ++ + base = get_unmapped_area(NULL, 0, size, 0, 0); + if (IS_ERR_VALUE(base)) { + ret = base; + goto out; + } + ++ /* ++ * If we suffer from dcache aliasing, ensure that the VDSO data page ++ * mapping is coloured the same as the kernel's mapping of that memory. ++ * This ensures that when the kernel updates the VDSO data userland ++ * will observe it without requiring cache invalidations. ++ */ ++ if (cpu_has_dc_aliases) { ++ base = __ALIGN_MASK(base, shm_align_mask); ++ base += ((unsigned long)&vdso_data - gic_size) & shm_align_mask; ++ } ++ + data_addr = base + gic_size; + vdso_addr = data_addr + PAGE_SIZE; + +diff --git a/arch/mips/mm/c-r4k.c b/arch/mips/mm/c-r4k.c +index e12dfa48b478..a5893b2cdc0e 100644 +--- a/arch/mips/mm/c-r4k.c ++++ b/arch/mips/mm/c-r4k.c +@@ -835,7 +835,8 @@ static void r4k_flush_icache_user_range(unsigned long start, unsigned long end) + static void r4k_dma_cache_wback_inv(unsigned long addr, unsigned long size) + { + /* Catch bad driver code */ +- BUG_ON(size == 0); ++ if (WARN_ON(size == 0)) ++ return; + + preempt_disable(); + if (cpu_has_inclusive_pcaches) { +@@ -871,7 +872,8 @@ static void r4k_dma_cache_wback_inv(unsigned long addr, unsigned long size) + static void r4k_dma_cache_inv(unsigned long addr, unsigned long size) + { + /* Catch bad driver code */ +- BUG_ON(size == 0); ++ if (WARN_ON(size == 0)) ++ return; + + preempt_disable(); + if (cpu_has_inclusive_pcaches) { +diff --git a/arch/powerpc/include/asm/book3s/64/pgalloc.h b/arch/powerpc/include/asm/book3s/64/pgalloc.h +index 01ee40f11f3a..76234a14b97d 100644 +--- a/arch/powerpc/include/asm/book3s/64/pgalloc.h ++++ b/arch/powerpc/include/asm/book3s/64/pgalloc.h +@@ -9,6 +9,7 @@ + + #include <linux/slab.h> + #include <linux/cpumask.h> ++#include <linux/kmemleak.h> + #include <linux/percpu.h> + + struct vmemmap_backing { +@@ -82,6 +83,13 @@ static inline pgd_t *pgd_alloc(struct mm_struct *mm) + + pgd = kmem_cache_alloc(PGT_CACHE(PGD_INDEX_SIZE), + pgtable_gfp_flags(mm, GFP_KERNEL)); ++ /* ++ * Don't scan the PGD for pointers, it contains references to PUDs but ++ * those references are not full pointers and so can't be recognised by ++ * kmemleak. ++ */ ++ kmemleak_no_scan(pgd); ++ + /* + * With hugetlb, we don't clear the second half of the page table. + * If we share the same slab cache with the pmd or pud level table, +@@ -110,8 +118,19 @@ static inline void pgd_populate(struct mm_struct *mm, pgd_t *pgd, pud_t *pud) + + static inline pud_t *pud_alloc_one(struct mm_struct *mm, unsigned long addr) + { +- return kmem_cache_alloc(PGT_CACHE(PUD_CACHE_INDEX), +- pgtable_gfp_flags(mm, GFP_KERNEL)); ++ pud_t *pud; ++ ++ pud = kmem_cache_alloc(PGT_CACHE(PUD_CACHE_INDEX), ++ pgtable_gfp_flags(mm, GFP_KERNEL)); ++ /* ++ * Tell kmemleak to ignore the PUD, that means don't scan it for ++ * pointers and don't consider it a leak. PUDs are typically only ++ * referred to by their PGD, but kmemleak is not able to recognise those ++ * as pointers, leading to false leak reports. ++ */ ++ kmemleak_ignore(pud); ++ ++ return pud; + } + + static inline void pud_free(struct mm_struct *mm, pud_t *pud) +diff --git a/arch/powerpc/kvm/book3s_64_mmu_radix.c b/arch/powerpc/kvm/book3s_64_mmu_radix.c +index 176f911ee983..7efc42538ccf 100644 +--- a/arch/powerpc/kvm/book3s_64_mmu_radix.c ++++ b/arch/powerpc/kvm/book3s_64_mmu_radix.c +@@ -738,10 +738,10 @@ int kvm_unmap_radix(struct kvm *kvm, struct kvm_memory_slot *memslot, + gpa, shift); + kvmppc_radix_tlbie_page(kvm, gpa, shift); + if ((old & _PAGE_DIRTY) && memslot->dirty_bitmap) { +- unsigned long npages = 1; ++ unsigned long psize = PAGE_SIZE; + if (shift) +- npages = 1ul << (shift - PAGE_SHIFT); +- kvmppc_update_dirty_map(memslot, gfn, npages); ++ psize = 1ul << shift; ++ kvmppc_update_dirty_map(memslot, gfn, psize); + } + } + return 0; +diff --git a/arch/powerpc/platforms/4xx/msi.c b/arch/powerpc/platforms/4xx/msi.c +index 81b2cbce7df8..7c324eff2f22 100644 +--- a/arch/powerpc/platforms/4xx/msi.c ++++ b/arch/powerpc/platforms/4xx/msi.c +@@ -146,13 +146,19 @@ static int ppc4xx_setup_pcieh_hw(struct platform_device *dev, + const u32 *sdr_addr; + dma_addr_t msi_phys; + void *msi_virt; ++ int err; + + sdr_addr = of_get_property(dev->dev.of_node, "sdr-base", NULL); + if (!sdr_addr) +- return -1; ++ return -EINVAL; + +- mtdcri(SDR0, *sdr_addr, upper_32_bits(res.start)); /*HIGH addr */ +- mtdcri(SDR0, *sdr_addr + 1, lower_32_bits(res.start)); /* Low addr */ ++ msi_data = of_get_property(dev->dev.of_node, "msi-data", NULL); ++ if (!msi_data) ++ return -EINVAL; ++ ++ msi_mask = of_get_property(dev->dev.of_node, "msi-mask", NULL); ++ if (!msi_mask) ++ return -EINVAL; + + msi->msi_dev = of_find_node_by_name(NULL, "ppc4xx-msi"); + if (!msi->msi_dev) +@@ -160,30 +166,30 @@ static int ppc4xx_setup_pcieh_hw(struct platform_device *dev, + + msi->msi_regs = of_iomap(msi->msi_dev, 0); + if (!msi->msi_regs) { +- dev_err(&dev->dev, "of_iomap problem failed\n"); +- return -ENOMEM; ++ dev_err(&dev->dev, "of_iomap failed\n"); ++ err = -ENOMEM; ++ goto node_put; + } + dev_dbg(&dev->dev, "PCIE-MSI: msi register mapped 0x%x 0x%x\n", + (u32) (msi->msi_regs + PEIH_TERMADH), (u32) (msi->msi_regs)); + + msi_virt = dma_alloc_coherent(&dev->dev, 64, &msi_phys, GFP_KERNEL); +- if (!msi_virt) +- return -ENOMEM; ++ if (!msi_virt) { ++ err = -ENOMEM; ++ goto iounmap; ++ } + msi->msi_addr_hi = upper_32_bits(msi_phys); + msi->msi_addr_lo = lower_32_bits(msi_phys & 0xffffffff); + dev_dbg(&dev->dev, "PCIE-MSI: msi address high 0x%x, low 0x%x\n", + msi->msi_addr_hi, msi->msi_addr_lo); + ++ mtdcri(SDR0, *sdr_addr, upper_32_bits(res.start)); /*HIGH addr */ ++ mtdcri(SDR0, *sdr_addr + 1, lower_32_bits(res.start)); /* Low addr */ ++ + /* Progam the Interrupt handler Termination addr registers */ + out_be32(msi->msi_regs + PEIH_TERMADH, msi->msi_addr_hi); + out_be32(msi->msi_regs + PEIH_TERMADL, msi->msi_addr_lo); + +- msi_data = of_get_property(dev->dev.of_node, "msi-data", NULL); +- if (!msi_data) +- return -1; +- msi_mask = of_get_property(dev->dev.of_node, "msi-mask", NULL); +- if (!msi_mask) +- return -1; + /* Program MSI Expected data and Mask bits */ + out_be32(msi->msi_regs + PEIH_MSIED, *msi_data); + out_be32(msi->msi_regs + PEIH_MSIMK, *msi_mask); +@@ -191,6 +197,12 @@ static int ppc4xx_setup_pcieh_hw(struct platform_device *dev, + dma_free_coherent(&dev->dev, 64, msi_virt, msi_phys); + + return 0; ++ ++iounmap: ++ iounmap(msi->msi_regs); ++node_put: ++ of_node_put(msi->msi_dev); ++ return err; + } + + static int ppc4xx_of_msi_remove(struct platform_device *dev) +@@ -209,7 +221,6 @@ static int ppc4xx_of_msi_remove(struct platform_device *dev) + msi_bitmap_free(&msi->bitmap); + iounmap(msi->msi_regs); + of_node_put(msi->msi_dev); +- kfree(msi); + + return 0; + } +@@ -223,18 +234,16 @@ static int ppc4xx_msi_probe(struct platform_device *dev) + + dev_dbg(&dev->dev, "PCIE-MSI: Setting up MSI support...\n"); + +- msi = kzalloc(sizeof(*msi), GFP_KERNEL); +- if (!msi) { +- dev_err(&dev->dev, "No memory for MSI structure\n"); ++ msi = devm_kzalloc(&dev->dev, sizeof(*msi), GFP_KERNEL); ++ if (!msi) + return -ENOMEM; +- } + dev->dev.platform_data = msi; + + /* Get MSI ranges */ + err = of_address_to_resource(dev->dev.of_node, 0, &res); + if (err) { + dev_err(&dev->dev, "%pOF resource error!\n", dev->dev.of_node); +- goto error_out; ++ return err; + } + + msi_irqs = of_irq_count(dev->dev.of_node); +@@ -243,7 +252,7 @@ static int ppc4xx_msi_probe(struct platform_device *dev) + + err = ppc4xx_setup_pcieh_hw(dev, res, msi); + if (err) +- goto error_out; ++ return err; + + err = ppc4xx_msi_init_allocator(dev, msi); + if (err) { +@@ -256,7 +265,7 @@ static int ppc4xx_msi_probe(struct platform_device *dev) + phb->controller_ops.setup_msi_irqs = ppc4xx_setup_msi_irqs; + phb->controller_ops.teardown_msi_irqs = ppc4xx_teardown_msi_irqs; + } +- return err; ++ return 0; + + error_out: + ppc4xx_of_msi_remove(dev); +diff --git a/arch/powerpc/platforms/powernv/npu-dma.c b/arch/powerpc/platforms/powernv/npu-dma.c +index 8cdf91f5d3a4..c773465b2c95 100644 +--- a/arch/powerpc/platforms/powernv/npu-dma.c ++++ b/arch/powerpc/platforms/powernv/npu-dma.c +@@ -437,8 +437,9 @@ static int get_mmio_atsd_reg(struct npu *npu) + int i; + + for (i = 0; i < npu->mmio_atsd_count; i++) { +- if (!test_and_set_bit_lock(i, &npu->mmio_atsd_usage)) +- return i; ++ if (!test_bit(i, &npu->mmio_atsd_usage)) ++ if (!test_and_set_bit_lock(i, &npu->mmio_atsd_usage)) ++ return i; + } + + return -ENOSPC; +diff --git a/arch/powerpc/platforms/pseries/setup.c b/arch/powerpc/platforms/pseries/setup.c +index 8a4868a3964b..cb098e962ffe 100644 +--- a/arch/powerpc/platforms/pseries/setup.c ++++ b/arch/powerpc/platforms/pseries/setup.c +@@ -647,6 +647,15 @@ void of_pci_parse_iov_addrs(struct pci_dev *dev, const int *indexes) + } + } + ++static void pseries_disable_sriov_resources(struct pci_dev *pdev) ++{ ++ int i; ++ ++ pci_warn(pdev, "No hypervisor support for SR-IOV on this device, IOV BARs disabled.\n"); ++ for (i = 0; i < PCI_SRIOV_NUM_BARS; i++) ++ pdev->resource[i + PCI_IOV_RESOURCES].flags = 0; ++} ++ + static void pseries_pci_fixup_resources(struct pci_dev *pdev) + { + const int *indexes; +@@ -654,10 +663,10 @@ static void pseries_pci_fixup_resources(struct pci_dev *pdev) + + /*Firmware must support open sriov otherwise dont configure*/ + indexes = of_get_property(dn, "ibm,open-sriov-vf-bar-info", NULL); +- if (!indexes) +- return; +- /* Assign the addresses from device tree*/ +- of_pci_set_vf_bar_size(pdev, indexes); ++ if (indexes) ++ of_pci_set_vf_bar_size(pdev, indexes); ++ else ++ pseries_disable_sriov_resources(pdev); + } + + static void pseries_pci_fixup_iov_resources(struct pci_dev *pdev) +@@ -669,10 +678,10 @@ static void pseries_pci_fixup_iov_resources(struct pci_dev *pdev) + return; + /*Firmware must support open sriov otherwise dont configure*/ + indexes = of_get_property(dn, "ibm,open-sriov-vf-bar-info", NULL); +- if (!indexes) +- return; +- /* Assign the addresses from device tree*/ +- of_pci_parse_iov_addrs(pdev, indexes); ++ if (indexes) ++ of_pci_parse_iov_addrs(pdev, indexes); ++ else ++ pseries_disable_sriov_resources(pdev); + } + + static resource_size_t pseries_pci_iov_resource_alignment(struct pci_dev *pdev, +diff --git a/arch/s390/kvm/vsie.c b/arch/s390/kvm/vsie.c +index 84c89cb9636f..cbdd8341f17e 100644 +--- a/arch/s390/kvm/vsie.c ++++ b/arch/s390/kvm/vsie.c +@@ -173,7 +173,8 @@ static int shadow_crycb(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page) + return set_validity_icpt(scb_s, 0x0039U); + + /* copy only the wrapping keys */ +- if (read_guest_real(vcpu, crycb_addr + 72, &vsie_page->crycb, 56)) ++ if (read_guest_real(vcpu, crycb_addr + 72, ++ vsie_page->crycb.dea_wrapping_key_mask, 56)) + return set_validity_icpt(scb_s, 0x0035U); + + scb_s->ecb3 |= ecb3_flags; +diff --git a/arch/x86/include/asm/kdebug.h b/arch/x86/include/asm/kdebug.h +index 395c9631e000..75f1e35e7c15 100644 +--- a/arch/x86/include/asm/kdebug.h ++++ b/arch/x86/include/asm/kdebug.h +@@ -22,10 +22,20 @@ enum die_val { + DIE_NMIUNKNOWN, + }; + ++enum show_regs_mode { ++ SHOW_REGS_SHORT, ++ /* ++ * For when userspace crashed, but we don't think it's our fault, and ++ * therefore don't print kernel registers. ++ */ ++ SHOW_REGS_USER, ++ SHOW_REGS_ALL ++}; ++ + extern void die(const char *, struct pt_regs *,long); + extern int __must_check __die(const char *, struct pt_regs *, long); + extern void show_stack_regs(struct pt_regs *regs); +-extern void __show_regs(struct pt_regs *regs, int all); ++extern void __show_regs(struct pt_regs *regs, enum show_regs_mode); + extern void show_iret_regs(struct pt_regs *regs); + extern unsigned long oops_begin(void); + extern void oops_end(unsigned long, struct pt_regs *, int signr); +diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h +index acebb808c4b5..0722b7745382 100644 +--- a/arch/x86/include/asm/kvm_host.h ++++ b/arch/x86/include/asm/kvm_host.h +@@ -1198,18 +1198,22 @@ enum emulation_result { + #define EMULTYPE_NO_DECODE (1 << 0) + #define EMULTYPE_TRAP_UD (1 << 1) + #define EMULTYPE_SKIP (1 << 2) +-#define EMULTYPE_RETRY (1 << 3) +-#define EMULTYPE_NO_REEXECUTE (1 << 4) +-#define EMULTYPE_NO_UD_ON_FAIL (1 << 5) +-#define EMULTYPE_VMWARE (1 << 6) ++#define EMULTYPE_ALLOW_RETRY (1 << 3) ++#define EMULTYPE_NO_UD_ON_FAIL (1 << 4) ++#define EMULTYPE_VMWARE (1 << 5) + int x86_emulate_instruction(struct kvm_vcpu *vcpu, unsigned long cr2, + int emulation_type, void *insn, int insn_len); + + static inline int emulate_instruction(struct kvm_vcpu *vcpu, + int emulation_type) + { +- return x86_emulate_instruction(vcpu, 0, +- emulation_type | EMULTYPE_NO_REEXECUTE, NULL, 0); ++ return x86_emulate_instruction(vcpu, 0, emulation_type, NULL, 0); ++} ++ ++static inline int kvm_emulate_instruction_from_buffer(struct kvm_vcpu *vcpu, ++ void *insn, int insn_len) ++{ ++ return x86_emulate_instruction(vcpu, 0, 0, insn, insn_len); + } + + void kvm_enable_efer_bits(u64); +diff --git a/arch/x86/kernel/apic/vector.c b/arch/x86/kernel/apic/vector.c +index c9b773401fd8..21d1fa5eaa5f 100644 +--- a/arch/x86/kernel/apic/vector.c ++++ b/arch/x86/kernel/apic/vector.c +@@ -422,7 +422,7 @@ static int activate_managed(struct irq_data *irqd) + if (WARN_ON_ONCE(cpumask_empty(vector_searchmask))) { + /* Something in the core code broke! Survive gracefully */ + pr_err("Managed startup for irq %u, but no CPU\n", irqd->irq); +- return EINVAL; ++ return -EINVAL; + } + + ret = assign_managed_vector(irqd, vector_searchmask); +diff --git a/arch/x86/kernel/cpu/microcode/amd.c b/arch/x86/kernel/cpu/microcode/amd.c +index 0624957aa068..07b5fc00b188 100644 +--- a/arch/x86/kernel/cpu/microcode/amd.c ++++ b/arch/x86/kernel/cpu/microcode/amd.c +@@ -504,6 +504,7 @@ static enum ucode_state apply_microcode_amd(int cpu) + struct microcode_amd *mc_amd; + struct ucode_cpu_info *uci; + struct ucode_patch *p; ++ enum ucode_state ret; + u32 rev, dummy; + + BUG_ON(raw_smp_processor_id() != cpu); +@@ -521,9 +522,8 @@ static enum ucode_state apply_microcode_amd(int cpu) + + /* need to apply patch? */ + if (rev >= mc_amd->hdr.patch_id) { +- c->microcode = rev; +- uci->cpu_sig.rev = rev; +- return UCODE_OK; ++ ret = UCODE_OK; ++ goto out; + } + + if (__apply_microcode_amd(mc_amd)) { +@@ -531,13 +531,21 @@ static enum ucode_state apply_microcode_amd(int cpu) + cpu, mc_amd->hdr.patch_id); + return UCODE_ERROR; + } +- pr_info("CPU%d: new patch_level=0x%08x\n", cpu, +- mc_amd->hdr.patch_id); + +- uci->cpu_sig.rev = mc_amd->hdr.patch_id; +- c->microcode = mc_amd->hdr.patch_id; ++ rev = mc_amd->hdr.patch_id; ++ ret = UCODE_UPDATED; ++ ++ pr_info("CPU%d: new patch_level=0x%08x\n", cpu, rev); + +- return UCODE_UPDATED; ++out: ++ uci->cpu_sig.rev = rev; ++ c->microcode = rev; ++ ++ /* Update boot_cpu_data's revision too, if we're on the BSP: */ ++ if (c->cpu_index == boot_cpu_data.cpu_index) ++ boot_cpu_data.microcode = rev; ++ ++ return ret; + } + + static int install_equiv_cpu_table(const u8 *buf) +diff --git a/arch/x86/kernel/cpu/microcode/intel.c b/arch/x86/kernel/cpu/microcode/intel.c +index 97ccf4c3b45b..16936a24795c 100644 +--- a/arch/x86/kernel/cpu/microcode/intel.c ++++ b/arch/x86/kernel/cpu/microcode/intel.c +@@ -795,6 +795,7 @@ static enum ucode_state apply_microcode_intel(int cpu) + struct ucode_cpu_info *uci = ucode_cpu_info + cpu; + struct cpuinfo_x86 *c = &cpu_data(cpu); + struct microcode_intel *mc; ++ enum ucode_state ret; + static int prev_rev; + u32 rev; + +@@ -817,9 +818,8 @@ static enum ucode_state apply_microcode_intel(int cpu) + */ + rev = intel_get_microcode_revision(); + if (rev >= mc->hdr.rev) { +- uci->cpu_sig.rev = rev; +- c->microcode = rev; +- return UCODE_OK; ++ ret = UCODE_OK; ++ goto out; + } + + /* +@@ -848,10 +848,17 @@ static enum ucode_state apply_microcode_intel(int cpu) + prev_rev = rev; + } + ++ ret = UCODE_UPDATED; ++ ++out: + uci->cpu_sig.rev = rev; +- c->microcode = rev; ++ c->microcode = rev; ++ ++ /* Update boot_cpu_data's revision too, if we're on the BSP: */ ++ if (c->cpu_index == boot_cpu_data.cpu_index) ++ boot_cpu_data.microcode = rev; + +- return UCODE_UPDATED; ++ return ret; + } + + static enum ucode_state generic_load_microcode(int cpu, void *data, size_t size, +diff --git a/arch/x86/kernel/dumpstack.c b/arch/x86/kernel/dumpstack.c +index 17b02adc79aa..0c5a9fc6e36d 100644 +--- a/arch/x86/kernel/dumpstack.c ++++ b/arch/x86/kernel/dumpstack.c +@@ -155,7 +155,7 @@ static void show_regs_if_on_stack(struct stack_info *info, struct pt_regs *regs, + * they can be printed in the right context. + */ + if (!partial && on_stack(info, regs, sizeof(*regs))) { +- __show_regs(regs, 0); ++ __show_regs(regs, SHOW_REGS_SHORT); + + } else if (partial && on_stack(info, (void *)regs + IRET_FRAME_OFFSET, + IRET_FRAME_SIZE)) { +@@ -353,7 +353,7 @@ void oops_end(unsigned long flags, struct pt_regs *regs, int signr) + oops_exit(); + + /* Executive summary in case the oops scrolled away */ +- __show_regs(&exec_summary_regs, true); ++ __show_regs(&exec_summary_regs, SHOW_REGS_ALL); + + if (!signr) + return; +@@ -416,14 +416,9 @@ void die(const char *str, struct pt_regs *regs, long err) + + void show_regs(struct pt_regs *regs) + { +- bool all = true; +- + show_regs_print_info(KERN_DEFAULT); + +- if (IS_ENABLED(CONFIG_X86_32)) +- all = !user_mode(regs); +- +- __show_regs(regs, all); ++ __show_regs(regs, user_mode(regs) ? SHOW_REGS_USER : SHOW_REGS_ALL); + + /* + * When in-kernel, we also print out the stack at the time of the fault.. +diff --git a/arch/x86/kernel/process_32.c b/arch/x86/kernel/process_32.c +index 0ae659de21eb..666d1825390d 100644 +--- a/arch/x86/kernel/process_32.c ++++ b/arch/x86/kernel/process_32.c +@@ -59,7 +59,7 @@ + #include <asm/intel_rdt_sched.h> + #include <asm/proto.h> + +-void __show_regs(struct pt_regs *regs, int all) ++void __show_regs(struct pt_regs *regs, enum show_regs_mode mode) + { + unsigned long cr0 = 0L, cr2 = 0L, cr3 = 0L, cr4 = 0L; + unsigned long d0, d1, d2, d3, d6, d7; +@@ -85,7 +85,7 @@ void __show_regs(struct pt_regs *regs, int all) + printk(KERN_DEFAULT "DS: %04x ES: %04x FS: %04x GS: %04x SS: %04x EFLAGS: %08lx\n", + (u16)regs->ds, (u16)regs->es, (u16)regs->fs, gs, ss, regs->flags); + +- if (!all) ++ if (mode != SHOW_REGS_ALL) + return; + + cr0 = read_cr0(); +diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c +index 4344a032ebe6..0091a733c1cf 100644 +--- a/arch/x86/kernel/process_64.c ++++ b/arch/x86/kernel/process_64.c +@@ -62,7 +62,7 @@ + __visible DEFINE_PER_CPU(unsigned long, rsp_scratch); + + /* Prints also some state that isn't saved in the pt_regs */ +-void __show_regs(struct pt_regs *regs, int all) ++void __show_regs(struct pt_regs *regs, enum show_regs_mode mode) + { + unsigned long cr0 = 0L, cr2 = 0L, cr3 = 0L, cr4 = 0L, fs, gs, shadowgs; + unsigned long d0, d1, d2, d3, d6, d7; +@@ -87,9 +87,17 @@ void __show_regs(struct pt_regs *regs, int all) + printk(KERN_DEFAULT "R13: %016lx R14: %016lx R15: %016lx\n", + regs->r13, regs->r14, regs->r15); + +- if (!all) ++ if (mode == SHOW_REGS_SHORT) + return; + ++ if (mode == SHOW_REGS_USER) { ++ rdmsrl(MSR_FS_BASE, fs); ++ rdmsrl(MSR_KERNEL_GS_BASE, shadowgs); ++ printk(KERN_DEFAULT "FS: %016lx GS: %016lx\n", ++ fs, shadowgs); ++ return; ++ } ++ + asm("movl %%ds,%0" : "=r" (ds)); + asm("movl %%cs,%0" : "=r" (cs)); + asm("movl %%es,%0" : "=r" (es)); +diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c +index 42f1ba92622a..97d41754769e 100644 +--- a/arch/x86/kvm/mmu.c ++++ b/arch/x86/kvm/mmu.c +@@ -4960,7 +4960,7 @@ static int make_mmu_pages_available(struct kvm_vcpu *vcpu) + int kvm_mmu_page_fault(struct kvm_vcpu *vcpu, gva_t cr2, u64 error_code, + void *insn, int insn_len) + { +- int r, emulation_type = EMULTYPE_RETRY; ++ int r, emulation_type = 0; + enum emulation_result er; + bool direct = vcpu->arch.mmu.direct_map; + +@@ -4973,10 +4973,8 @@ int kvm_mmu_page_fault(struct kvm_vcpu *vcpu, gva_t cr2, u64 error_code, + r = RET_PF_INVALID; + if (unlikely(error_code & PFERR_RSVD_MASK)) { + r = handle_mmio_page_fault(vcpu, cr2, direct); +- if (r == RET_PF_EMULATE) { +- emulation_type = 0; ++ if (r == RET_PF_EMULATE) + goto emulate; +- } + } + + if (r == RET_PF_INVALID) { +@@ -5003,8 +5001,19 @@ int kvm_mmu_page_fault(struct kvm_vcpu *vcpu, gva_t cr2, u64 error_code, + return 1; + } + +- if (mmio_info_in_cache(vcpu, cr2, direct)) +- emulation_type = 0; ++ /* ++ * vcpu->arch.mmu.page_fault returned RET_PF_EMULATE, but we can still ++ * optimistically try to just unprotect the page and let the processor ++ * re-execute the instruction that caused the page fault. Do not allow ++ * retrying MMIO emulation, as it's not only pointless but could also ++ * cause us to enter an infinite loop because the processor will keep ++ * faulting on the non-existent MMIO address. Retrying an instruction ++ * from a nested guest is also pointless and dangerous as we are only ++ * explicitly shadowing L1's page tables, i.e. unprotecting something ++ * for L1 isn't going to magically fix whatever issue cause L2 to fail. ++ */ ++ if (!mmio_info_in_cache(vcpu, cr2, direct) && !is_guest_mode(vcpu)) ++ emulation_type = EMULTYPE_ALLOW_RETRY; + emulate: + /* + * On AMD platforms, under certain conditions insn_len may be zero on #NPF. +diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c +index 9799f86388e7..ef772e5634d4 100644 +--- a/arch/x86/kvm/svm.c ++++ b/arch/x86/kvm/svm.c +@@ -3875,8 +3875,8 @@ static int emulate_on_interception(struct vcpu_svm *svm) + + static int rsm_interception(struct vcpu_svm *svm) + { +- return x86_emulate_instruction(&svm->vcpu, 0, 0, +- rsm_ins_bytes, 2) == EMULATE_DONE; ++ return kvm_emulate_instruction_from_buffer(&svm->vcpu, ++ rsm_ins_bytes, 2) == EMULATE_DONE; + } + + static int rdpmc_interception(struct vcpu_svm *svm) +diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c +index 9869bfd0c601..d0c3be353bb6 100644 +--- a/arch/x86/kvm/vmx.c ++++ b/arch/x86/kvm/vmx.c +@@ -7539,8 +7539,8 @@ static int handle_ept_misconfig(struct kvm_vcpu *vcpu) + if (!static_cpu_has(X86_FEATURE_HYPERVISOR)) + return kvm_skip_emulated_instruction(vcpu); + else +- return x86_emulate_instruction(vcpu, gpa, EMULTYPE_SKIP, +- NULL, 0) == EMULATE_DONE; ++ return emulate_instruction(vcpu, EMULTYPE_SKIP) == ++ EMULATE_DONE; + } + + return kvm_mmu_page_fault(vcpu, gpa, PFERR_RSVD_MASK, NULL, 0); +diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c +index 94cd63081471..97fcac34e007 100644 +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -5810,7 +5810,10 @@ static bool reexecute_instruction(struct kvm_vcpu *vcpu, gva_t cr2, + gpa_t gpa = cr2; + kvm_pfn_t pfn; + +- if (emulation_type & EMULTYPE_NO_REEXECUTE) ++ if (!(emulation_type & EMULTYPE_ALLOW_RETRY)) ++ return false; ++ ++ if (WARN_ON_ONCE(is_guest_mode(vcpu))) + return false; + + if (!vcpu->arch.mmu.direct_map) { +@@ -5898,7 +5901,10 @@ static bool retry_instruction(struct x86_emulate_ctxt *ctxt, + */ + vcpu->arch.last_retry_eip = vcpu->arch.last_retry_addr = 0; + +- if (!(emulation_type & EMULTYPE_RETRY)) ++ if (!(emulation_type & EMULTYPE_ALLOW_RETRY)) ++ return false; ++ ++ if (WARN_ON_ONCE(is_guest_mode(vcpu))) + return false; + + if (x86_page_table_writing_insn(ctxt)) +diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c +index d1f1612672c7..045338ac1667 100644 +--- a/arch/x86/mm/fault.c ++++ b/arch/x86/mm/fault.c +@@ -317,8 +317,6 @@ static noinline int vmalloc_fault(unsigned long address) + if (!(address >= VMALLOC_START && address < VMALLOC_END)) + return -1; + +- WARN_ON_ONCE(in_nmi()); +- + /* + * Synchronize this task's top level page-table + * with the 'reference' page table. +diff --git a/block/bfq-cgroup.c b/block/bfq-cgroup.c +index 58c6efa9f9a9..9fe5952d117d 100644 +--- a/block/bfq-cgroup.c ++++ b/block/bfq-cgroup.c +@@ -275,9 +275,9 @@ static void bfqg_and_blkg_get(struct bfq_group *bfqg) + + void bfqg_and_blkg_put(struct bfq_group *bfqg) + { +- bfqg_put(bfqg); +- + blkg_put(bfqg_to_blkg(bfqg)); ++ ++ bfqg_put(bfqg); + } + + /* @stats = 0 */ +diff --git a/block/blk-core.c b/block/blk-core.c +index 746a5eac4541..cbaca5a73f2e 100644 +--- a/block/blk-core.c ++++ b/block/blk-core.c +@@ -2161,9 +2161,12 @@ static inline bool bio_check_ro(struct bio *bio, struct hd_struct *part) + { + const int op = bio_op(bio); + +- if (part->policy && (op_is_write(op) && !op_is_flush(op))) { ++ if (part->policy && op_is_write(op)) { + char b[BDEVNAME_SIZE]; + ++ if (op_is_flush(bio->bi_opf) && !bio_sectors(bio)) ++ return false; ++ + WARN_ONCE(1, + "generic_make_request: Trying to write " + "to read-only block-device %s (partno %d)\n", +diff --git a/block/blk-mq-tag.c b/block/blk-mq-tag.c +index d5f2c21d8531..816923bf874d 100644 +--- a/block/blk-mq-tag.c ++++ b/block/blk-mq-tag.c +@@ -402,8 +402,6 @@ int blk_mq_tag_update_depth(struct blk_mq_hw_ctx *hctx, + if (tdepth <= tags->nr_reserved_tags) + return -EINVAL; + +- tdepth -= tags->nr_reserved_tags; +- + /* + * If we are allowed to grow beyond the original size, allocate + * a new set of tags before freeing the old one. +@@ -423,7 +421,8 @@ int blk_mq_tag_update_depth(struct blk_mq_hw_ctx *hctx, + if (tdepth > 16 * BLKDEV_MAX_RQ) + return -EINVAL; + +- new = blk_mq_alloc_rq_map(set, hctx->queue_num, tdepth, 0); ++ new = blk_mq_alloc_rq_map(set, hctx->queue_num, tdepth, ++ tags->nr_reserved_tags); + if (!new) + return -ENOMEM; + ret = blk_mq_alloc_rqs(set, new, hctx->queue_num, tdepth); +@@ -440,7 +439,8 @@ int blk_mq_tag_update_depth(struct blk_mq_hw_ctx *hctx, + * Don't need (or can't) update reserved tags here, they + * remain static and should never need resizing. + */ +- sbitmap_queue_resize(&tags->bitmap_tags, tdepth); ++ sbitmap_queue_resize(&tags->bitmap_tags, ++ tdepth - tags->nr_reserved_tags); + } + + return 0; +diff --git a/block/partitions/aix.c b/block/partitions/aix.c +index 007f95eea0e1..903f3ed175d0 100644 +--- a/block/partitions/aix.c ++++ b/block/partitions/aix.c +@@ -178,7 +178,7 @@ int aix_partition(struct parsed_partitions *state) + u32 vgda_sector = 0; + u32 vgda_len = 0; + int numlvs = 0; +- struct pvd *pvd; ++ struct pvd *pvd = NULL; + struct lv_info { + unsigned short pps_per_lv; + unsigned short pps_found; +@@ -232,10 +232,11 @@ int aix_partition(struct parsed_partitions *state) + if (lvip[i].pps_per_lv) + foundlvs += 1; + } ++ /* pvd loops depend on n[].name and lvip[].pps_per_lv */ ++ pvd = alloc_pvd(state, vgda_sector + 17); + } + put_dev_sector(sect); + } +- pvd = alloc_pvd(state, vgda_sector + 17); + if (pvd) { + int numpps = be16_to_cpu(pvd->pp_count); + int psn_part1 = be32_to_cpu(pvd->psn_part1); +@@ -282,10 +283,14 @@ int aix_partition(struct parsed_partitions *state) + next_lp_ix += 1; + } + for (i = 0; i < state->limit; i += 1) +- if (lvip[i].pps_found && !lvip[i].lv_is_contiguous) ++ if (lvip[i].pps_found && !lvip[i].lv_is_contiguous) { ++ char tmp[sizeof(n[i].name) + 1]; // null char ++ ++ snprintf(tmp, sizeof(tmp), "%s", n[i].name); + pr_warn("partition %s (%u pp's found) is " + "not contiguous\n", +- n[i].name, lvip[i].pps_found); ++ tmp, lvip[i].pps_found); ++ } + kfree(pvd); + } + kfree(n); +diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c +index 9706613eecf9..bf64cfa30feb 100644 +--- a/drivers/acpi/acpi_lpss.c ++++ b/drivers/acpi/acpi_lpss.c +@@ -879,7 +879,7 @@ static void acpi_lpss_dismiss(struct device *dev) + #define LPSS_GPIODEF0_DMA_LLP BIT(13) + + static DEFINE_MUTEX(lpss_iosf_mutex); +-static bool lpss_iosf_d3_entered; ++static bool lpss_iosf_d3_entered = true; + + static void lpss_iosf_enter_d3_state(void) + { +diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c +index 2628806c64a2..3d5277a39097 100644 +--- a/drivers/android/binder_alloc.c ++++ b/drivers/android/binder_alloc.c +@@ -327,6 +327,35 @@ err_no_vma: + return vma ? -ENOMEM : -ESRCH; + } + ++ ++static inline void binder_alloc_set_vma(struct binder_alloc *alloc, ++ struct vm_area_struct *vma) ++{ ++ if (vma) ++ alloc->vma_vm_mm = vma->vm_mm; ++ /* ++ * If we see alloc->vma is not NULL, buffer data structures set up ++ * completely. Look at smp_rmb side binder_alloc_get_vma. ++ * We also want to guarantee new alloc->vma_vm_mm is always visible ++ * if alloc->vma is set. ++ */ ++ smp_wmb(); ++ alloc->vma = vma; ++} ++ ++static inline struct vm_area_struct *binder_alloc_get_vma( ++ struct binder_alloc *alloc) ++{ ++ struct vm_area_struct *vma = NULL; ++ ++ if (alloc->vma) { ++ /* Look at description in binder_alloc_set_vma */ ++ smp_rmb(); ++ vma = alloc->vma; ++ } ++ return vma; ++} ++ + static struct binder_buffer *binder_alloc_new_buf_locked( + struct binder_alloc *alloc, + size_t data_size, +@@ -343,7 +372,7 @@ static struct binder_buffer *binder_alloc_new_buf_locked( + size_t size, data_offsets_size; + int ret; + +- if (alloc->vma == NULL) { ++ if (!binder_alloc_get_vma(alloc)) { + pr_err("%d: binder_alloc_buf, no vma\n", + alloc->pid); + return ERR_PTR(-ESRCH); +@@ -714,9 +743,7 @@ int binder_alloc_mmap_handler(struct binder_alloc *alloc, + buffer->free = 1; + binder_insert_free_buffer(alloc, buffer); + alloc->free_async_space = alloc->buffer_size / 2; +- barrier(); +- alloc->vma = vma; +- alloc->vma_vm_mm = vma->vm_mm; ++ binder_alloc_set_vma(alloc, vma); + mmgrab(alloc->vma_vm_mm); + + return 0; +@@ -743,10 +770,10 @@ void binder_alloc_deferred_release(struct binder_alloc *alloc) + int buffers, page_count; + struct binder_buffer *buffer; + +- BUG_ON(alloc->vma); +- + buffers = 0; + mutex_lock(&alloc->mutex); ++ BUG_ON(alloc->vma); ++ + while ((n = rb_first(&alloc->allocated_buffers))) { + buffer = rb_entry(n, struct binder_buffer, rb_node); + +@@ -889,7 +916,7 @@ int binder_alloc_get_allocated_count(struct binder_alloc *alloc) + */ + void binder_alloc_vma_close(struct binder_alloc *alloc) + { +- WRITE_ONCE(alloc->vma, NULL); ++ binder_alloc_set_vma(alloc, NULL); + } + + /** +@@ -924,7 +951,7 @@ enum lru_status binder_alloc_free_page(struct list_head *item, + + index = page - alloc->pages; + page_addr = (uintptr_t)alloc->buffer + index * PAGE_SIZE; +- vma = alloc->vma; ++ vma = binder_alloc_get_vma(alloc); + if (vma) { + if (!mmget_not_zero(alloc->vma_vm_mm)) + goto err_mmget; +diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c +index 09620c2ffa0f..704a761f94b2 100644 +--- a/drivers/ata/libahci.c ++++ b/drivers/ata/libahci.c +@@ -2107,7 +2107,7 @@ static void ahci_set_aggressive_devslp(struct ata_port *ap, bool sleep) + struct ahci_host_priv *hpriv = ap->host->private_data; + void __iomem *port_mmio = ahci_port_base(ap); + struct ata_device *dev = ap->link.device; +- u32 devslp, dm, dito, mdat, deto; ++ u32 devslp, dm, dito, mdat, deto, dito_conf; + int rc; + unsigned int err_mask; + +@@ -2131,8 +2131,15 @@ static void ahci_set_aggressive_devslp(struct ata_port *ap, bool sleep) + return; + } + +- /* device sleep was already enabled */ +- if (devslp & PORT_DEVSLP_ADSE) ++ dm = (devslp & PORT_DEVSLP_DM_MASK) >> PORT_DEVSLP_DM_OFFSET; ++ dito = devslp_idle_timeout / (dm + 1); ++ if (dito > 0x3ff) ++ dito = 0x3ff; ++ ++ dito_conf = (devslp >> PORT_DEVSLP_DITO_OFFSET) & 0x3FF; ++ ++ /* device sleep was already enabled and same dito */ ++ if ((devslp & PORT_DEVSLP_ADSE) && (dito_conf == dito)) + return; + + /* set DITO, MDAT, DETO and enable DevSlp, need to stop engine first */ +@@ -2140,11 +2147,6 @@ static void ahci_set_aggressive_devslp(struct ata_port *ap, bool sleep) + if (rc) + return; + +- dm = (devslp & PORT_DEVSLP_DM_MASK) >> PORT_DEVSLP_DM_OFFSET; +- dito = devslp_idle_timeout / (dm + 1); +- if (dito > 0x3ff) +- dito = 0x3ff; +- + /* Use the nominal value 10 ms if the read MDAT is zero, + * the nominal value of DETO is 20 ms. + */ +@@ -2162,6 +2164,8 @@ static void ahci_set_aggressive_devslp(struct ata_port *ap, bool sleep) + deto = 20; + } + ++ /* Make dito, mdat, deto bits to 0s */ ++ devslp &= ~GENMASK_ULL(24, 2); + devslp |= ((dito << PORT_DEVSLP_DITO_OFFSET) | + (mdat << PORT_DEVSLP_MDAT_OFFSET) | + (deto << PORT_DEVSLP_DETO_OFFSET) | +diff --git a/drivers/base/memory.c b/drivers/base/memory.c +index f5e560188a18..622ab8edc035 100644 +--- a/drivers/base/memory.c ++++ b/drivers/base/memory.c +@@ -416,26 +416,24 @@ static ssize_t show_valid_zones(struct device *dev, + struct zone *default_zone; + int nid; + +- /* +- * The block contains more than one zone can not be offlined. +- * This can happen e.g. for ZONE_DMA and ZONE_DMA32 +- */ +- if (!test_pages_in_a_zone(start_pfn, start_pfn + nr_pages, &valid_start_pfn, &valid_end_pfn)) +- return sprintf(buf, "none\n"); +- +- start_pfn = valid_start_pfn; +- nr_pages = valid_end_pfn - start_pfn; +- + /* + * Check the existing zone. Make sure that we do that only on the + * online nodes otherwise the page_zone is not reliable + */ + if (mem->state == MEM_ONLINE) { ++ /* ++ * The block contains more than one zone can not be offlined. ++ * This can happen e.g. for ZONE_DMA and ZONE_DMA32 ++ */ ++ if (!test_pages_in_a_zone(start_pfn, start_pfn + nr_pages, ++ &valid_start_pfn, &valid_end_pfn)) ++ return sprintf(buf, "none\n"); ++ start_pfn = valid_start_pfn; + strcat(buf, page_zone(pfn_to_page(start_pfn))->name); + goto out; + } + +- nid = pfn_to_nid(start_pfn); ++ nid = mem->nid; + default_zone = zone_for_pfn_range(MMOP_ONLINE_KEEP, nid, start_pfn, nr_pages); + strcat(buf, default_zone->name); + +diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c +index 3fb95c8d9fd8..15a5ce5bba3d 100644 +--- a/drivers/block/nbd.c ++++ b/drivers/block/nbd.c +@@ -1239,6 +1239,9 @@ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd, + case NBD_SET_SOCK: + return nbd_add_socket(nbd, arg, false); + case NBD_SET_BLKSIZE: ++ if (!arg || !is_power_of_2(arg) || arg < 512 || ++ arg > PAGE_SIZE) ++ return -EINVAL; + nbd_size_set(nbd, arg, + div_s64(config->bytesize, arg)); + return 0; +diff --git a/drivers/block/pktcdvd.c b/drivers/block/pktcdvd.c +index b3f83cd96f33..01f59be71433 100644 +--- a/drivers/block/pktcdvd.c ++++ b/drivers/block/pktcdvd.c +@@ -67,7 +67,7 @@ + #include <scsi/scsi.h> + #include <linux/debugfs.h> + #include <linux/device.h> +- ++#include <linux/nospec.h> + #include <linux/uaccess.h> + + #define DRIVER_NAME "pktcdvd" +@@ -2231,6 +2231,8 @@ static struct pktcdvd_device *pkt_find_dev_from_minor(unsigned int dev_minor) + { + if (dev_minor >= MAX_WRITERS) + return NULL; ++ ++ dev_minor = array_index_nospec(dev_minor, MAX_WRITERS); + return pkt_devs[dev_minor]; + } + +diff --git a/drivers/bluetooth/Kconfig b/drivers/bluetooth/Kconfig +index f3c643a0473c..5f953ca8ac5b 100644 +--- a/drivers/bluetooth/Kconfig ++++ b/drivers/bluetooth/Kconfig +@@ -159,6 +159,7 @@ config BT_HCIUART_LL + config BT_HCIUART_3WIRE + bool "Three-wire UART (H5) protocol support" + depends on BT_HCIUART ++ depends on BT_HCIUART_SERDEV + help + The HCI Three-wire UART Transport Layer makes it possible to + user the Bluetooth HCI over a serial port interface. The HCI +diff --git a/drivers/char/tpm/tpm_i2c_infineon.c b/drivers/char/tpm/tpm_i2c_infineon.c +index 6116cd05e228..9086edc9066b 100644 +--- a/drivers/char/tpm/tpm_i2c_infineon.c ++++ b/drivers/char/tpm/tpm_i2c_infineon.c +@@ -117,7 +117,7 @@ static int iic_tpm_read(u8 addr, u8 *buffer, size_t len) + /* Lock the adapter for the duration of the whole sequence. */ + if (!tpm_dev.client->adapter->algo->master_xfer) + return -EOPNOTSUPP; +- i2c_lock_adapter(tpm_dev.client->adapter); ++ i2c_lock_bus(tpm_dev.client->adapter, I2C_LOCK_SEGMENT); + + if (tpm_dev.chip_type == SLB9645) { + /* use a combined read for newer chips +@@ -192,7 +192,7 @@ static int iic_tpm_read(u8 addr, u8 *buffer, size_t len) + } + + out: +- i2c_unlock_adapter(tpm_dev.client->adapter); ++ i2c_unlock_bus(tpm_dev.client->adapter, I2C_LOCK_SEGMENT); + /* take care of 'guard time' */ + usleep_range(SLEEP_DURATION_LOW, SLEEP_DURATION_HI); + +@@ -224,7 +224,7 @@ static int iic_tpm_write_generic(u8 addr, u8 *buffer, size_t len, + + if (!tpm_dev.client->adapter->algo->master_xfer) + return -EOPNOTSUPP; +- i2c_lock_adapter(tpm_dev.client->adapter); ++ i2c_lock_bus(tpm_dev.client->adapter, I2C_LOCK_SEGMENT); + + /* prepend the 'register address' to the buffer */ + tpm_dev.buf[0] = addr; +@@ -243,7 +243,7 @@ static int iic_tpm_write_generic(u8 addr, u8 *buffer, size_t len, + usleep_range(sleep_low, sleep_hi); + } + +- i2c_unlock_adapter(tpm_dev.client->adapter); ++ i2c_unlock_bus(tpm_dev.client->adapter, I2C_LOCK_SEGMENT); + /* take care of 'guard time' */ + usleep_range(SLEEP_DURATION_LOW, SLEEP_DURATION_HI); + +diff --git a/drivers/char/tpm/tpm_tis_spi.c b/drivers/char/tpm/tpm_tis_spi.c +index 424ff2fde1f2..9914f6973463 100644 +--- a/drivers/char/tpm/tpm_tis_spi.c ++++ b/drivers/char/tpm/tpm_tis_spi.c +@@ -199,6 +199,7 @@ static const struct tpm_tis_phy_ops tpm_spi_phy_ops = { + static int tpm_tis_spi_probe(struct spi_device *dev) + { + struct tpm_tis_spi_phy *phy; ++ int irq; + + phy = devm_kzalloc(&dev->dev, sizeof(struct tpm_tis_spi_phy), + GFP_KERNEL); +@@ -211,7 +212,13 @@ static int tpm_tis_spi_probe(struct spi_device *dev) + if (!phy->iobuf) + return -ENOMEM; + +- return tpm_tis_core_init(&dev->dev, &phy->priv, -1, &tpm_spi_phy_ops, ++ /* If the SPI device has an IRQ then use that */ ++ if (dev->irq > 0) ++ irq = dev->irq; ++ else ++ irq = -1; ++ ++ return tpm_tis_core_init(&dev->dev, &phy->priv, irq, &tpm_spi_phy_ops, + NULL); + } + +diff --git a/drivers/clk/clk-scmi.c b/drivers/clk/clk-scmi.c +index bb2a6f2f5516..a985bf5e1ac6 100644 +--- a/drivers/clk/clk-scmi.c ++++ b/drivers/clk/clk-scmi.c +@@ -38,7 +38,6 @@ static unsigned long scmi_clk_recalc_rate(struct clk_hw *hw, + static long scmi_clk_round_rate(struct clk_hw *hw, unsigned long rate, + unsigned long *parent_rate) + { +- int step; + u64 fmin, fmax, ftmp; + struct scmi_clk *clk = to_scmi_clk(hw); + +@@ -60,9 +59,9 @@ static long scmi_clk_round_rate(struct clk_hw *hw, unsigned long rate, + + ftmp = rate - fmin; + ftmp += clk->info->range.step_size - 1; /* to round up */ +- step = do_div(ftmp, clk->info->range.step_size); ++ do_div(ftmp, clk->info->range.step_size); + +- return step * clk->info->range.step_size + fmin; ++ return ftmp * clk->info->range.step_size + fmin; + } + + static int scmi_clk_set_rate(struct clk_hw *hw, unsigned long rate, +diff --git a/drivers/dax/pmem.c b/drivers/dax/pmem.c +index fd49b24fd6af..99e2aace8078 100644 +--- a/drivers/dax/pmem.c ++++ b/drivers/dax/pmem.c +@@ -105,15 +105,19 @@ static int dax_pmem_probe(struct device *dev) + if (rc) + return rc; + +- rc = devm_add_action_or_reset(dev, dax_pmem_percpu_exit, +- &dax_pmem->ref); +- if (rc) ++ rc = devm_add_action(dev, dax_pmem_percpu_exit, &dax_pmem->ref); ++ if (rc) { ++ percpu_ref_exit(&dax_pmem->ref); + return rc; ++ } + + dax_pmem->pgmap.ref = &dax_pmem->ref; + addr = devm_memremap_pages(dev, &dax_pmem->pgmap); +- if (IS_ERR(addr)) ++ if (IS_ERR(addr)) { ++ devm_remove_action(dev, dax_pmem_percpu_exit, &dax_pmem->ref); ++ percpu_ref_exit(&dax_pmem->ref); + return PTR_ERR(addr); ++ } + + rc = devm_add_action_or_reset(dev, dax_pmem_percpu_kill, + &dax_pmem->ref); +diff --git a/drivers/firmware/google/vpd.c b/drivers/firmware/google/vpd.c +index e9db895916c3..1aa67bb5d8c0 100644 +--- a/drivers/firmware/google/vpd.c ++++ b/drivers/firmware/google/vpd.c +@@ -246,6 +246,7 @@ static int vpd_section_destroy(struct vpd_section *sec) + sysfs_remove_bin_file(vpd_kobj, &sec->bin_attr); + kfree(sec->raw_name); + memunmap(sec->baseaddr); ++ sec->enabled = false; + } + + return 0; +@@ -279,8 +280,10 @@ static int vpd_sections_init(phys_addr_t physaddr) + ret = vpd_section_init("rw", &rw_vpd, + physaddr + sizeof(struct vpd_cbmem) + + header.ro_size, header.rw_size); +- if (ret) ++ if (ret) { ++ vpd_section_destroy(&ro_vpd); + return ret; ++ } + } + + return 0; +diff --git a/drivers/gpio/gpio-ml-ioh.c b/drivers/gpio/gpio-ml-ioh.c +index b23d9a36be1f..51c7d1b84c2e 100644 +--- a/drivers/gpio/gpio-ml-ioh.c ++++ b/drivers/gpio/gpio-ml-ioh.c +@@ -496,9 +496,10 @@ static int ioh_gpio_probe(struct pci_dev *pdev, + return 0; + + err_gpiochip_add: ++ chip = chip_save; + while (--i >= 0) { +- chip--; + gpiochip_remove(&chip->gpio); ++ chip++; + } + kfree(chip_save); + +diff --git a/drivers/gpio/gpio-pxa.c b/drivers/gpio/gpio-pxa.c +index 1e66f808051c..2e33fd552899 100644 +--- a/drivers/gpio/gpio-pxa.c ++++ b/drivers/gpio/gpio-pxa.c +@@ -241,6 +241,17 @@ int pxa_irq_to_gpio(int irq) + return irq_gpio0; + } + ++static bool pxa_gpio_has_pinctrl(void) ++{ ++ switch (gpio_type) { ++ case PXA3XX_GPIO: ++ return false; ++ ++ default: ++ return true; ++ } ++} ++ + static int pxa_gpio_to_irq(struct gpio_chip *chip, unsigned offset) + { + struct pxa_gpio_chip *pchip = chip_to_pxachip(chip); +@@ -255,9 +266,11 @@ static int pxa_gpio_direction_input(struct gpio_chip *chip, unsigned offset) + unsigned long flags; + int ret; + +- ret = pinctrl_gpio_direction_input(chip->base + offset); +- if (!ret) +- return 0; ++ if (pxa_gpio_has_pinctrl()) { ++ ret = pinctrl_gpio_direction_input(chip->base + offset); ++ if (!ret) ++ return 0; ++ } + + spin_lock_irqsave(&gpio_lock, flags); + +@@ -282,9 +295,11 @@ static int pxa_gpio_direction_output(struct gpio_chip *chip, + + writel_relaxed(mask, base + (value ? GPSR_OFFSET : GPCR_OFFSET)); + +- ret = pinctrl_gpio_direction_output(chip->base + offset); +- if (ret) +- return ret; ++ if (pxa_gpio_has_pinctrl()) { ++ ret = pinctrl_gpio_direction_output(chip->base + offset); ++ if (ret) ++ return ret; ++ } + + spin_lock_irqsave(&gpio_lock, flags); + +@@ -348,8 +363,12 @@ static int pxa_init_gpio_chip(struct pxa_gpio_chip *pchip, int ngpio, + pchip->chip.set = pxa_gpio_set; + pchip->chip.to_irq = pxa_gpio_to_irq; + pchip->chip.ngpio = ngpio; +- pchip->chip.request = gpiochip_generic_request; +- pchip->chip.free = gpiochip_generic_free; ++ ++ if (pxa_gpio_has_pinctrl()) { ++ pchip->chip.request = gpiochip_generic_request; ++ pchip->chip.free = gpiochip_generic_free; ++ } ++ + #ifdef CONFIG_OF_GPIO + pchip->chip.of_node = np; + pchip->chip.of_xlate = pxa_gpio_of_xlate; +diff --git a/drivers/gpio/gpio-tegra.c b/drivers/gpio/gpio-tegra.c +index 94396caaca75..d5d79727c55d 100644 +--- a/drivers/gpio/gpio-tegra.c ++++ b/drivers/gpio/gpio-tegra.c +@@ -720,4 +720,4 @@ static int __init tegra_gpio_init(void) + { + return platform_driver_register(&tegra_gpio_driver); + } +-postcore_initcall(tegra_gpio_init); ++subsys_initcall(tegra_gpio_init); +diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_dmcu.c b/drivers/gpu/drm/amd/display/dc/dce/dce_dmcu.c +index a576b8bbb3cd..dea40b322191 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce/dce_dmcu.c ++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_dmcu.c +@@ -150,7 +150,7 @@ static void dce_dmcu_set_psr_enable(struct dmcu *dmcu, bool enable, bool wait) + } + } + +-static void dce_dmcu_setup_psr(struct dmcu *dmcu, ++static bool dce_dmcu_setup_psr(struct dmcu *dmcu, + struct dc_link *link, + struct psr_context *psr_context) + { +@@ -261,6 +261,8 @@ static void dce_dmcu_setup_psr(struct dmcu *dmcu, + + /* notifyDMCUMsg */ + REG_UPDATE(MASTER_COMM_CNTL_REG, MASTER_COMM_INTERRUPT, 1); ++ ++ return true; + } + + static bool dce_is_dmcu_initialized(struct dmcu *dmcu) +@@ -545,24 +547,25 @@ static void dcn10_dmcu_set_psr_enable(struct dmcu *dmcu, bool enable, bool wait) + * least a few frames. Should never hit the max retry assert below. + */ + if (wait == true) { +- for (retryCount = 0; retryCount <= 1000; retryCount++) { +- dcn10_get_dmcu_psr_state(dmcu, &psr_state); +- if (enable) { +- if (psr_state != 0) +- break; +- } else { +- if (psr_state == 0) +- break; ++ for (retryCount = 0; retryCount <= 1000; retryCount++) { ++ dcn10_get_dmcu_psr_state(dmcu, &psr_state); ++ if (enable) { ++ if (psr_state != 0) ++ break; ++ } else { ++ if (psr_state == 0) ++ break; ++ } ++ udelay(500); + } +- udelay(500); +- } + +- /* assert if max retry hit */ +- ASSERT(retryCount <= 1000); ++ /* assert if max retry hit */ ++ if (retryCount >= 1000) ++ ASSERT(0); + } + } + +-static void dcn10_dmcu_setup_psr(struct dmcu *dmcu, ++static bool dcn10_dmcu_setup_psr(struct dmcu *dmcu, + struct dc_link *link, + struct psr_context *psr_context) + { +@@ -577,7 +580,7 @@ static void dcn10_dmcu_setup_psr(struct dmcu *dmcu, + + /* If microcontroller is not running, do nothing */ + if (dmcu->dmcu_state != DMCU_RUNNING) +- return; ++ return false; + + link->link_enc->funcs->psr_program_dp_dphy_fast_training(link->link_enc, + psr_context->psrExitLinkTrainingRequired); +@@ -677,6 +680,11 @@ static void dcn10_dmcu_setup_psr(struct dmcu *dmcu, + + /* notifyDMCUMsg */ + REG_UPDATE(MASTER_COMM_CNTL_REG, MASTER_COMM_INTERRUPT, 1); ++ ++ /* waitDMCUReadyForCmd */ ++ REG_WAIT(MASTER_COMM_CNTL_REG, MASTER_COMM_INTERRUPT, 0, 1, 10000); ++ ++ return true; + } + + static void dcn10_psr_wait_loop( +diff --git a/drivers/gpu/drm/amd/display/dc/inc/hw/dmcu.h b/drivers/gpu/drm/amd/display/dc/inc/hw/dmcu.h +index de60f940030d..4550747fb61c 100644 +--- a/drivers/gpu/drm/amd/display/dc/inc/hw/dmcu.h ++++ b/drivers/gpu/drm/amd/display/dc/inc/hw/dmcu.h +@@ -48,7 +48,7 @@ struct dmcu_funcs { + const char *src, + unsigned int bytes); + void (*set_psr_enable)(struct dmcu *dmcu, bool enable, bool wait); +- void (*setup_psr)(struct dmcu *dmcu, ++ bool (*setup_psr)(struct dmcu *dmcu, + struct dc_link *link, + struct psr_context *psr_context); + void (*get_psr_state)(struct dmcu *dmcu, uint32_t *psr_state); +diff --git a/drivers/gpu/ipu-v3/ipu-common.c b/drivers/gpu/ipu-v3/ipu-common.c +index 48685cddbad1..c73bd003f845 100644 +--- a/drivers/gpu/ipu-v3/ipu-common.c ++++ b/drivers/gpu/ipu-v3/ipu-common.c +@@ -1401,6 +1401,8 @@ static int ipu_probe(struct platform_device *pdev) + return -ENODEV; + + ipu->id = of_alias_get_id(np, "ipu"); ++ if (ipu->id < 0) ++ ipu->id = 0; + + if (of_device_is_compatible(np, "fsl,imx6qp-ipu") && + IS_ENABLED(CONFIG_DRM)) { +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index c7981ddd8776..e80bcd71fe1e 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -528,6 +528,7 @@ + + #define I2C_VENDOR_ID_RAYD 0x2386 + #define I2C_PRODUCT_ID_RAYD_3118 0x3118 ++#define I2C_PRODUCT_ID_RAYD_4B33 0x4B33 + + #define USB_VENDOR_ID_HANWANG 0x0b57 + #define USB_DEVICE_ID_HANWANG_TABLET_FIRST 0x5000 +diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c +index ab93dd5927c3..b23c4b5854d8 100644 +--- a/drivers/hid/hid-input.c ++++ b/drivers/hid/hid-input.c +@@ -1579,6 +1579,7 @@ static struct hid_input *hidinput_allocate(struct hid_device *hid, + input_dev->dev.parent = &hid->dev; + + hidinput->input = input_dev; ++ hidinput->application = application; + list_add_tail(&hidinput->list, &hid->inputs); + + INIT_LIST_HEAD(&hidinput->reports); +@@ -1674,8 +1675,7 @@ static struct hid_input *hidinput_match_application(struct hid_report *report) + struct hid_input *hidinput; + + list_for_each_entry(hidinput, &hid->inputs, list) { +- if (hidinput->report && +- hidinput->report->application == report->application) ++ if (hidinput->application == report->application) + return hidinput; + } + +@@ -1812,6 +1812,7 @@ void hidinput_disconnect(struct hid_device *hid) + input_unregister_device(hidinput->input); + else + input_free_device(hidinput->input); ++ kfree(hidinput->name); + kfree(hidinput); + } + +diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c +index 45968f7970f8..15c934ef6b18 100644 +--- a/drivers/hid/hid-multitouch.c ++++ b/drivers/hid/hid-multitouch.c +@@ -1167,7 +1167,8 @@ static bool mt_need_to_apply_feature(struct hid_device *hdev, + struct hid_usage *usage, + enum latency_mode latency, + bool surface_switch, +- bool button_switch) ++ bool button_switch, ++ bool *inputmode_found) + { + struct mt_device *td = hid_get_drvdata(hdev); + struct mt_class *cls = &td->mtclass; +@@ -1179,6 +1180,14 @@ static bool mt_need_to_apply_feature(struct hid_device *hdev, + + switch (usage->hid) { + case HID_DG_INPUTMODE: ++ /* ++ * Some elan panels wrongly declare 2 input mode features, ++ * and silently ignore when we set the value in the second ++ * field. Skip the second feature and hope for the best. ++ */ ++ if (*inputmode_found) ++ return false; ++ + if (cls->quirks & MT_QUIRK_FORCE_GET_FEATURE) { + report_len = hid_report_len(report); + buf = hid_alloc_report_buf(report, GFP_KERNEL); +@@ -1194,6 +1203,7 @@ static bool mt_need_to_apply_feature(struct hid_device *hdev, + } + + field->value[index] = td->inputmode_value; ++ *inputmode_found = true; + return true; + + case HID_DG_CONTACTMAX: +@@ -1231,6 +1241,7 @@ static void mt_set_modes(struct hid_device *hdev, enum latency_mode latency, + struct hid_usage *usage; + int i, j; + bool update_report; ++ bool inputmode_found = false; + + rep_enum = &hdev->report_enum[HID_FEATURE_REPORT]; + list_for_each_entry(rep, &rep_enum->report_list, list) { +@@ -1249,7 +1260,8 @@ static void mt_set_modes(struct hid_device *hdev, enum latency_mode latency, + usage, + latency, + surface_switch, +- button_switch)) ++ button_switch, ++ &inputmode_found)) + update_report = true; + } + } +@@ -1476,6 +1488,9 @@ static int mt_probe(struct hid_device *hdev, const struct hid_device_id *id) + */ + hdev->quirks |= HID_QUIRK_INPUT_PER_APP; + ++ if (id->group != HID_GROUP_MULTITOUCH_WIN_8) ++ hdev->quirks |= HID_QUIRK_MULTI_INPUT; ++ + timer_setup(&td->release_timer, mt_expired_timeout, 0); + + ret = hid_parse(hdev); +diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c +index eae0cb3ddec6..5fd1159fc095 100644 +--- a/drivers/hid/i2c-hid/i2c-hid.c ++++ b/drivers/hid/i2c-hid/i2c-hid.c +@@ -174,6 +174,8 @@ static const struct i2c_hid_quirks { + I2C_HID_QUIRK_RESEND_REPORT_DESCR }, + { USB_VENDOR_ID_SIS_TOUCH, USB_DEVICE_ID_SIS10FB_TOUCH, + I2C_HID_QUIRK_RESEND_REPORT_DESCR }, ++ { I2C_VENDOR_ID_RAYD, I2C_PRODUCT_ID_RAYD_4B33, ++ I2C_HID_QUIRK_RESEND_REPORT_DESCR }, + { 0, 0 } + }; + +diff --git a/drivers/hv/hv.c b/drivers/hv/hv.c +index 658dc765753b..553adccb05d7 100644 +--- a/drivers/hv/hv.c ++++ b/drivers/hv/hv.c +@@ -242,6 +242,10 @@ int hv_synic_alloc(void) + + return 0; + err: ++ /* ++ * Any memory allocations that succeeded will be freed when ++ * the caller cleans up by calling hv_synic_free() ++ */ + return -ENOMEM; + } + +@@ -254,12 +258,10 @@ void hv_synic_free(void) + struct hv_per_cpu_context *hv_cpu + = per_cpu_ptr(hv_context.cpu_context, cpu); + +- if (hv_cpu->synic_event_page) +- free_page((unsigned long)hv_cpu->synic_event_page); +- if (hv_cpu->synic_message_page) +- free_page((unsigned long)hv_cpu->synic_message_page); +- if (hv_cpu->post_msg_page) +- free_page((unsigned long)hv_cpu->post_msg_page); ++ kfree(hv_cpu->clk_evt); ++ free_page((unsigned long)hv_cpu->synic_event_page); ++ free_page((unsigned long)hv_cpu->synic_message_page); ++ free_page((unsigned long)hv_cpu->post_msg_page); + } + + kfree(hv_context.hv_numa_map); +diff --git a/drivers/i2c/busses/i2c-aspeed.c b/drivers/i2c/busses/i2c-aspeed.c +index 60e4d0e939a3..715b6fdb4989 100644 +--- a/drivers/i2c/busses/i2c-aspeed.c ++++ b/drivers/i2c/busses/i2c-aspeed.c +@@ -868,7 +868,7 @@ static int aspeed_i2c_probe_bus(struct platform_device *pdev) + if (!match) + bus->get_clk_reg_val = aspeed_i2c_24xx_get_clk_reg_val; + else +- bus->get_clk_reg_val = match->data; ++ bus->get_clk_reg_val = (u32 (*)(u32))match->data; + + /* Initialize the I2C adapter */ + spin_lock_init(&bus->lock); +diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c +index aa726607645e..45fcf0c37a9e 100644 +--- a/drivers/i2c/busses/i2c-i801.c ++++ b/drivers/i2c/busses/i2c-i801.c +@@ -139,6 +139,7 @@ + + #define SBREG_BAR 0x10 + #define SBREG_SMBCTRL 0xc6000c ++#define SBREG_SMBCTRL_DNV 0xcf000c + + /* Host status bits for SMBPCISTS */ + #define SMBPCISTS_INTS BIT(3) +@@ -1396,7 +1397,11 @@ static void i801_add_tco(struct i801_priv *priv) + spin_unlock(&p2sb_spinlock); + + res = &tco_res[ICH_RES_MEM_OFF]; +- res->start = (resource_size_t)base64_addr + SBREG_SMBCTRL; ++ if (pci_dev->device == PCI_DEVICE_ID_INTEL_DNV_SMBUS) ++ res->start = (resource_size_t)base64_addr + SBREG_SMBCTRL_DNV; ++ else ++ res->start = (resource_size_t)base64_addr + SBREG_SMBCTRL; ++ + res->end = res->start + 3; + res->flags = IORESOURCE_MEM; + +diff --git a/drivers/i2c/busses/i2c-xiic.c b/drivers/i2c/busses/i2c-xiic.c +index 9a71e50d21f1..0c51c0ffdda9 100644 +--- a/drivers/i2c/busses/i2c-xiic.c ++++ b/drivers/i2c/busses/i2c-xiic.c +@@ -532,6 +532,7 @@ static void xiic_start_recv(struct xiic_i2c *i2c) + { + u8 rx_watermark; + struct i2c_msg *msg = i2c->rx_msg = i2c->tx_msg; ++ unsigned long flags; + + /* Clear and enable Rx full interrupt. */ + xiic_irq_clr_en(i2c, XIIC_INTR_RX_FULL_MASK | XIIC_INTR_TX_ERROR_MASK); +@@ -547,6 +548,7 @@ static void xiic_start_recv(struct xiic_i2c *i2c) + rx_watermark = IIC_RX_FIFO_DEPTH; + xiic_setreg8(i2c, XIIC_RFD_REG_OFFSET, rx_watermark - 1); + ++ local_irq_save(flags); + if (!(msg->flags & I2C_M_NOSTART)) + /* write the address */ + xiic_setreg16(i2c, XIIC_DTR_REG_OFFSET, +@@ -556,6 +558,8 @@ static void xiic_start_recv(struct xiic_i2c *i2c) + + xiic_setreg16(i2c, XIIC_DTR_REG_OFFSET, + msg->len | ((i2c->nmsgs == 1) ? XIIC_TX_DYN_STOP_MASK : 0)); ++ local_irq_restore(flags); ++ + if (i2c->nmsgs == 1) + /* very last, enable bus not busy as well */ + xiic_irq_clr_en(i2c, XIIC_INTR_BNB_MASK); +diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c +index bff10ab141b0..dafcb6f019b3 100644 +--- a/drivers/infiniband/core/cma.c ++++ b/drivers/infiniband/core/cma.c +@@ -1445,9 +1445,16 @@ static bool cma_match_net_dev(const struct rdma_cm_id *id, + (addr->src_addr.ss_family == AF_IB || + rdma_protocol_roce(id->device, port_num)); + +- return !addr->dev_addr.bound_dev_if || +- (net_eq(dev_net(net_dev), addr->dev_addr.net) && +- addr->dev_addr.bound_dev_if == net_dev->ifindex); ++ /* ++ * Net namespaces must match, and if the listner is listening ++ * on a specific netdevice than netdevice must match as well. ++ */ ++ if (net_eq(dev_net(net_dev), addr->dev_addr.net) && ++ (!!addr->dev_addr.bound_dev_if == ++ (addr->dev_addr.bound_dev_if == net_dev->ifindex))) ++ return true; ++ else ++ return false; + } + + static struct rdma_id_private *cma_find_listener( +diff --git a/drivers/infiniband/hw/hns/hns_roce_hem.c b/drivers/infiniband/hw/hns/hns_roce_hem.c +index 63b5b3edabcb..8dc336a85128 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_hem.c ++++ b/drivers/infiniband/hw/hns/hns_roce_hem.c +@@ -494,6 +494,9 @@ static int hns_roce_table_mhop_get(struct hns_roce_dev *hr_dev, + step_idx = 1; + } else if (hop_num == HNS_ROCE_HOP_NUM_0) { + step_idx = 0; ++ } else { ++ ret = -EINVAL; ++ goto err_dma_alloc_l1; + } + + /* set HEM base address to hardware */ +diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +index a6e11be0ea0f..c00925ed9da8 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c ++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +@@ -273,7 +273,8 @@ static int hns_roce_v2_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr, + switch (wr->opcode) { + case IB_WR_SEND_WITH_IMM: + case IB_WR_RDMA_WRITE_WITH_IMM: +- ud_sq_wqe->immtdata = wr->ex.imm_data; ++ ud_sq_wqe->immtdata = ++ cpu_to_le32(be32_to_cpu(wr->ex.imm_data)); + break; + default: + ud_sq_wqe->immtdata = 0; +@@ -371,7 +372,8 @@ static int hns_roce_v2_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr, + switch (wr->opcode) { + case IB_WR_SEND_WITH_IMM: + case IB_WR_RDMA_WRITE_WITH_IMM: +- rc_sq_wqe->immtdata = wr->ex.imm_data; ++ rc_sq_wqe->immtdata = ++ cpu_to_le32(be32_to_cpu(wr->ex.imm_data)); + break; + case IB_WR_SEND_WITH_INV: + rc_sq_wqe->inv_key = +@@ -1931,7 +1933,8 @@ static int hns_roce_v2_poll_one(struct hns_roce_cq *hr_cq, + case HNS_ROCE_V2_OPCODE_RDMA_WRITE_IMM: + wc->opcode = IB_WC_RECV_RDMA_WITH_IMM; + wc->wc_flags = IB_WC_WITH_IMM; +- wc->ex.imm_data = cqe->immtdata; ++ wc->ex.imm_data = ++ cpu_to_be32(le32_to_cpu(cqe->immtdata)); + break; + case HNS_ROCE_V2_OPCODE_SEND: + wc->opcode = IB_WC_RECV; +@@ -1940,7 +1943,8 @@ static int hns_roce_v2_poll_one(struct hns_roce_cq *hr_cq, + case HNS_ROCE_V2_OPCODE_SEND_WITH_IMM: + wc->opcode = IB_WC_RECV; + wc->wc_flags = IB_WC_WITH_IMM; +- wc->ex.imm_data = cqe->immtdata; ++ wc->ex.imm_data = ++ cpu_to_be32(le32_to_cpu(cqe->immtdata)); + break; + case HNS_ROCE_V2_OPCODE_SEND_WITH_INV: + wc->opcode = IB_WC_RECV; +diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h b/drivers/infiniband/hw/hns/hns_roce_hw_v2.h +index d47675f365c7..7e2c740e0df5 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h ++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.h +@@ -768,7 +768,7 @@ struct hns_roce_v2_cqe { + __le32 byte_4; + union { + __le32 rkey; +- __be32 immtdata; ++ __le32 immtdata; + }; + __le32 byte_12; + __le32 byte_16; +@@ -926,7 +926,7 @@ struct hns_roce_v2_cq_db { + struct hns_roce_v2_ud_send_wqe { + __le32 byte_4; + __le32 msg_len; +- __be32 immtdata; ++ __le32 immtdata; + __le32 byte_16; + __le32 byte_20; + __le32 byte_24; +@@ -1012,7 +1012,7 @@ struct hns_roce_v2_rc_send_wqe { + __le32 msg_len; + union { + __le32 inv_key; +- __be32 immtdata; ++ __le32 immtdata; + }; + __le32 byte_16; + __le32 byte_20; +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c +index 6709328d90f8..c7e034963738 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c +@@ -822,6 +822,7 @@ void ipoib_mcast_send(struct net_device *dev, u8 *daddr, struct sk_buff *skb) + if (neigh && list_empty(&neigh->list)) { + kref_get(&mcast->ah->ref); + neigh->ah = mcast->ah; ++ neigh->ah->valid = 1; + list_add_tail(&neigh->list, &mcast->neigh_list); + } + } +diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c b/drivers/input/touchscreen/atmel_mxt_ts.c +index 54fe190fd4bc..48c5ccab00a0 100644 +--- a/drivers/input/touchscreen/atmel_mxt_ts.c ++++ b/drivers/input/touchscreen/atmel_mxt_ts.c +@@ -1658,10 +1658,11 @@ static int mxt_parse_object_table(struct mxt_data *data, + break; + case MXT_TOUCH_MULTI_T9: + data->multitouch = MXT_TOUCH_MULTI_T9; ++ /* Only handle messages from first T9 instance */ + data->T9_reportid_min = min_id; +- data->T9_reportid_max = max_id; +- data->num_touchids = object->num_report_ids +- * mxt_obj_instances(object); ++ data->T9_reportid_max = min_id + ++ object->num_report_ids - 1; ++ data->num_touchids = object->num_report_ids; + break; + case MXT_SPT_MESSAGECOUNT_T44: + data->T44_address = object->start_address; +diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c +index 1d647104bccc..b73c6a7bf7f2 100644 +--- a/drivers/iommu/arm-smmu-v3.c ++++ b/drivers/iommu/arm-smmu-v3.c +@@ -24,6 +24,7 @@ + #include <linux/acpi_iort.h> + #include <linux/bitfield.h> + #include <linux/bitops.h> ++#include <linux/crash_dump.h> + #include <linux/delay.h> + #include <linux/dma-iommu.h> + #include <linux/err.h> +@@ -2211,8 +2212,12 @@ static int arm_smmu_update_gbpa(struct arm_smmu_device *smmu, u32 set, u32 clr) + reg &= ~clr; + reg |= set; + writel_relaxed(reg | GBPA_UPDATE, gbpa); +- return readl_relaxed_poll_timeout(gbpa, reg, !(reg & GBPA_UPDATE), +- 1, ARM_SMMU_POLL_TIMEOUT_US); ++ ret = readl_relaxed_poll_timeout(gbpa, reg, !(reg & GBPA_UPDATE), ++ 1, ARM_SMMU_POLL_TIMEOUT_US); ++ ++ if (ret) ++ dev_err(smmu->dev, "GBPA not responding to update\n"); ++ return ret; + } + + static void arm_smmu_free_msis(void *data) +@@ -2392,8 +2397,15 @@ static int arm_smmu_device_reset(struct arm_smmu_device *smmu, bool bypass) + + /* Clear CR0 and sync (disables SMMU and queue processing) */ + reg = readl_relaxed(smmu->base + ARM_SMMU_CR0); +- if (reg & CR0_SMMUEN) ++ if (reg & CR0_SMMUEN) { ++ if (is_kdump_kernel()) { ++ arm_smmu_update_gbpa(smmu, GBPA_ABORT, 0); ++ arm_smmu_device_disable(smmu); ++ return -EBUSY; ++ } ++ + dev_warn(smmu->dev, "SMMU currently enabled! Resetting...\n"); ++ } + + ret = arm_smmu_device_disable(smmu); + if (ret) +@@ -2491,10 +2503,8 @@ static int arm_smmu_device_reset(struct arm_smmu_device *smmu, bool bypass) + enables |= CR0_SMMUEN; + } else { + ret = arm_smmu_update_gbpa(smmu, 0, GBPA_ABORT); +- if (ret) { +- dev_err(smmu->dev, "GBPA not responding to update\n"); ++ if (ret) + return ret; +- } + } + ret = arm_smmu_write_reg_sync(smmu, enables, ARM_SMMU_CR0, + ARM_SMMU_CR0ACK); +diff --git a/drivers/iommu/ipmmu-vmsa.c b/drivers/iommu/ipmmu-vmsa.c +index 09b47260c74b..feb1664815b7 100644 +--- a/drivers/iommu/ipmmu-vmsa.c ++++ b/drivers/iommu/ipmmu-vmsa.c +@@ -73,7 +73,7 @@ struct ipmmu_vmsa_domain { + struct io_pgtable_ops *iop; + + unsigned int context_id; +- spinlock_t lock; /* Protects mappings */ ++ struct mutex mutex; /* Protects mappings */ + }; + + static struct ipmmu_vmsa_domain *to_vmsa_domain(struct iommu_domain *dom) +@@ -595,7 +595,7 @@ static struct iommu_domain *__ipmmu_domain_alloc(unsigned type) + if (!domain) + return NULL; + +- spin_lock_init(&domain->lock); ++ mutex_init(&domain->mutex); + + return &domain->io_domain; + } +@@ -641,7 +641,6 @@ static int ipmmu_attach_device(struct iommu_domain *io_domain, + struct iommu_fwspec *fwspec = dev->iommu_fwspec; + struct ipmmu_vmsa_device *mmu = to_ipmmu(dev); + struct ipmmu_vmsa_domain *domain = to_vmsa_domain(io_domain); +- unsigned long flags; + unsigned int i; + int ret = 0; + +@@ -650,7 +649,7 @@ static int ipmmu_attach_device(struct iommu_domain *io_domain, + return -ENXIO; + } + +- spin_lock_irqsave(&domain->lock, flags); ++ mutex_lock(&domain->mutex); + + if (!domain->mmu) { + /* The domain hasn't been used yet, initialize it. */ +@@ -674,7 +673,7 @@ static int ipmmu_attach_device(struct iommu_domain *io_domain, + } else + dev_info(dev, "Reusing IPMMU context %u\n", domain->context_id); + +- spin_unlock_irqrestore(&domain->lock, flags); ++ mutex_unlock(&domain->mutex); + + if (ret < 0) + return ret; +diff --git a/drivers/macintosh/via-pmu.c b/drivers/macintosh/via-pmu.c +index 25c1ce811053..1fdd09ebb3f1 100644 +--- a/drivers/macintosh/via-pmu.c ++++ b/drivers/macintosh/via-pmu.c +@@ -534,8 +534,9 @@ init_pmu(void) + int timeout; + struct adb_request req; + +- out_8(&via[B], via[B] | TREQ); /* negate TREQ */ +- out_8(&via[DIRB], (via[DIRB] | TREQ) & ~TACK); /* TACK in, TREQ out */ ++ /* Negate TREQ. Set TACK to input and TREQ to output. */ ++ out_8(&via[B], in_8(&via[B]) | TREQ); ++ out_8(&via[DIRB], (in_8(&via[DIRB]) | TREQ) & ~TACK); + + pmu_request(&req, NULL, 2, PMU_SET_INTR_MASK, pmu_intr_mask); + timeout = 100000; +@@ -1418,8 +1419,8 @@ pmu_sr_intr(void) + struct adb_request *req; + int bite = 0; + +- if (via[B] & TREQ) { +- printk(KERN_ERR "PMU: spurious SR intr (%x)\n", via[B]); ++ if (in_8(&via[B]) & TREQ) { ++ printk(KERN_ERR "PMU: spurious SR intr (%x)\n", in_8(&via[B])); + out_8(&via[IFR], SR_INT); + return NULL; + } +diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c +index ce14a3d1f609..44df244807e5 100644 +--- a/drivers/md/dm-cache-target.c ++++ b/drivers/md/dm-cache-target.c +@@ -2250,7 +2250,7 @@ static int parse_features(struct cache_args *ca, struct dm_arg_set *as, + {0, 2, "Invalid number of cache feature arguments"}, + }; + +- int r; ++ int r, mode_ctr = 0; + unsigned argc; + const char *arg; + struct cache_features *cf = &ca->features; +@@ -2264,14 +2264,20 @@ static int parse_features(struct cache_args *ca, struct dm_arg_set *as, + while (argc--) { + arg = dm_shift_arg(as); + +- if (!strcasecmp(arg, "writeback")) ++ if (!strcasecmp(arg, "writeback")) { + cf->io_mode = CM_IO_WRITEBACK; ++ mode_ctr++; ++ } + +- else if (!strcasecmp(arg, "writethrough")) ++ else if (!strcasecmp(arg, "writethrough")) { + cf->io_mode = CM_IO_WRITETHROUGH; ++ mode_ctr++; ++ } + +- else if (!strcasecmp(arg, "passthrough")) ++ else if (!strcasecmp(arg, "passthrough")) { + cf->io_mode = CM_IO_PASSTHROUGH; ++ mode_ctr++; ++ } + + else if (!strcasecmp(arg, "metadata2")) + cf->metadata_version = 2; +@@ -2282,6 +2288,11 @@ static int parse_features(struct cache_args *ca, struct dm_arg_set *as, + } + } + ++ if (mode_ctr > 1) { ++ *error = "Duplicate cache io_mode features requested"; ++ return -EINVAL; ++ } ++ + return 0; + } + +diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c +index 2031506a0ecd..49107c52c8e6 100644 +--- a/drivers/md/raid5.c ++++ b/drivers/md/raid5.c +@@ -4521,6 +4521,12 @@ static void analyse_stripe(struct stripe_head *sh, struct stripe_head_state *s) + s->failed++; + if (rdev && !test_bit(Faulty, &rdev->flags)) + do_recovery = 1; ++ else if (!rdev) { ++ rdev = rcu_dereference( ++ conf->disks[i].replacement); ++ if (rdev && !test_bit(Faulty, &rdev->flags)) ++ do_recovery = 1; ++ } + } + + if (test_bit(R5_InJournal, &dev->flags)) +diff --git a/drivers/media/dvb-frontends/helene.c b/drivers/media/dvb-frontends/helene.c +index a0d0b53c91d7..a5de65dcf784 100644 +--- a/drivers/media/dvb-frontends/helene.c ++++ b/drivers/media/dvb-frontends/helene.c +@@ -897,7 +897,10 @@ static int helene_x_pon(struct helene_priv *priv) + helene_write_regs(priv, 0x99, cdata, sizeof(cdata)); + + /* 0x81 - 0x94 */ +- data[0] = 0x18; /* xtal 24 MHz */ ++ if (priv->xtal == SONY_HELENE_XTAL_16000) ++ data[0] = 0x10; /* xtal 16 MHz */ ++ else ++ data[0] = 0x18; /* xtal 24 MHz */ + data[1] = (uint8_t)(0x80 | (0x04 & 0x1F)); /* 4 x 25 = 100uA */ + data[2] = (uint8_t)(0x80 | (0x26 & 0x7F)); /* 38 x 0.25 = 9.5pF */ + data[3] = 0x80; /* REFOUT signal output 500mVpp */ +diff --git a/drivers/media/platform/davinci/vpif_display.c b/drivers/media/platform/davinci/vpif_display.c +index 7be636237acf..0f324055cc9f 100644 +--- a/drivers/media/platform/davinci/vpif_display.c ++++ b/drivers/media/platform/davinci/vpif_display.c +@@ -1114,6 +1114,14 @@ vpif_init_free_channel_objects: + return err; + } + ++static void free_vpif_objs(void) ++{ ++ int i; ++ ++ for (i = 0; i < VPIF_DISPLAY_MAX_DEVICES; i++) ++ kfree(vpif_obj.dev[i]); ++} ++ + static int vpif_async_bound(struct v4l2_async_notifier *notifier, + struct v4l2_subdev *subdev, + struct v4l2_async_subdev *asd) +@@ -1255,11 +1263,6 @@ static __init int vpif_probe(struct platform_device *pdev) + return -EINVAL; + } + +- if (!pdev->dev.platform_data) { +- dev_warn(&pdev->dev, "Missing platform data. Giving up.\n"); +- return -EINVAL; +- } +- + vpif_dev = &pdev->dev; + err = initialize_vpif(); + +@@ -1271,7 +1274,7 @@ static __init int vpif_probe(struct platform_device *pdev) + err = v4l2_device_register(vpif_dev, &vpif_obj.v4l2_dev); + if (err) { + v4l2_err(vpif_dev->driver, "Error registering v4l2 device\n"); +- return err; ++ goto vpif_free; + } + + while ((res = platform_get_resource(pdev, IORESOURCE_IRQ, res_idx))) { +@@ -1314,7 +1317,10 @@ static __init int vpif_probe(struct platform_device *pdev) + if (vpif_obj.sd[i]) + vpif_obj.sd[i]->grp_id = 1 << i; + } +- vpif_probe_complete(); ++ err = vpif_probe_complete(); ++ if (err) { ++ goto probe_subdev_out; ++ } + } else { + vpif_obj.notifier.subdevs = vpif_obj.config->asd; + vpif_obj.notifier.num_subdevs = vpif_obj.config->asd_sizes[0]; +@@ -1334,6 +1340,8 @@ probe_subdev_out: + kfree(vpif_obj.sd); + vpif_unregister: + v4l2_device_unregister(&vpif_obj.v4l2_dev); ++vpif_free: ++ free_vpif_objs(); + + return err; + } +@@ -1355,8 +1363,8 @@ static int vpif_remove(struct platform_device *device) + ch = vpif_obj.dev[i]; + /* Unregister video device */ + video_unregister_device(&ch->video_dev); +- kfree(vpif_obj.dev[i]); + } ++ free_vpif_objs(); + + return 0; + } +diff --git a/drivers/media/platform/qcom/camss-8x16/camss-csid.c b/drivers/media/platform/qcom/camss-8x16/camss-csid.c +index 226f36ef7419..2bf65805f2c1 100644 +--- a/drivers/media/platform/qcom/camss-8x16/camss-csid.c ++++ b/drivers/media/platform/qcom/camss-8x16/camss-csid.c +@@ -392,9 +392,6 @@ static int csid_set_stream(struct v4l2_subdev *sd, int enable) + !media_entity_remote_pad(&csid->pads[MSM_CSID_PAD_SINK])) + return -ENOLINK; + +- dt = csid_get_fmt_entry(csid->fmt[MSM_CSID_PAD_SRC].code)-> +- data_type; +- + if (tg->enabled) { + /* Config Test Generator */ + struct v4l2_mbus_framefmt *f = +@@ -416,6 +413,9 @@ static int csid_set_stream(struct v4l2_subdev *sd, int enable) + writel_relaxed(val, csid->base + + CAMSS_CSID_TG_DT_n_CGG_0(0)); + ++ dt = csid_get_fmt_entry( ++ csid->fmt[MSM_CSID_PAD_SRC].code)->data_type; ++ + /* 5:0 data type */ + val = dt; + writel_relaxed(val, csid->base + +@@ -425,6 +425,9 @@ static int csid_set_stream(struct v4l2_subdev *sd, int enable) + val = tg->payload_mode; + writel_relaxed(val, csid->base + + CAMSS_CSID_TG_DT_n_CGG_2(0)); ++ ++ df = csid_get_fmt_entry( ++ csid->fmt[MSM_CSID_PAD_SRC].code)->decode_format; + } else { + struct csid_phy_config *phy = &csid->phy; + +@@ -439,13 +442,16 @@ static int csid_set_stream(struct v4l2_subdev *sd, int enable) + + writel_relaxed(val, + csid->base + CAMSS_CSID_CORE_CTRL_1); ++ ++ dt = csid_get_fmt_entry( ++ csid->fmt[MSM_CSID_PAD_SINK].code)->data_type; ++ df = csid_get_fmt_entry( ++ csid->fmt[MSM_CSID_PAD_SINK].code)->decode_format; + } + + /* Config LUT */ + + dt_shift = (cid % 4) * 8; +- df = csid_get_fmt_entry(csid->fmt[MSM_CSID_PAD_SINK].code)-> +- decode_format; + + val = readl_relaxed(csid->base + CAMSS_CSID_CID_LUT_VC_n(vc)); + val &= ~(0xff << dt_shift); +diff --git a/drivers/media/platform/rcar-vin/rcar-csi2.c b/drivers/media/platform/rcar-vin/rcar-csi2.c +index daef72d410a3..dc5ae8025832 100644 +--- a/drivers/media/platform/rcar-vin/rcar-csi2.c ++++ b/drivers/media/platform/rcar-vin/rcar-csi2.c +@@ -339,6 +339,7 @@ enum rcar_csi2_pads { + + struct rcar_csi2_info { + int (*init_phtw)(struct rcar_csi2 *priv, unsigned int mbps); ++ int (*confirm_start)(struct rcar_csi2 *priv); + const struct rcsi2_mbps_reg *hsfreqrange; + unsigned int csi0clkfreqrange; + bool clear_ulps; +@@ -545,6 +546,13 @@ static int rcsi2_start(struct rcar_csi2 *priv) + if (ret) + return ret; + ++ /* Confirm start */ ++ if (priv->info->confirm_start) { ++ ret = priv->info->confirm_start(priv); ++ if (ret) ++ return ret; ++ } ++ + /* Clear Ultra Low Power interrupt. */ + if (priv->info->clear_ulps) + rcsi2_write(priv, INTSTATE_REG, +@@ -880,6 +888,11 @@ static int rcsi2_init_phtw_h3_v3h_m3n(struct rcar_csi2 *priv, unsigned int mbps) + } + + static int rcsi2_init_phtw_v3m_e3(struct rcar_csi2 *priv, unsigned int mbps) ++{ ++ return rcsi2_phtw_write_mbps(priv, mbps, phtw_mbps_v3m_e3, 0x44); ++} ++ ++static int rcsi2_confirm_start_v3m_e3(struct rcar_csi2 *priv) + { + static const struct phtw_value step1[] = { + { .data = 0xed, .code = 0x34 }, +@@ -890,12 +903,6 @@ static int rcsi2_init_phtw_v3m_e3(struct rcar_csi2 *priv, unsigned int mbps) + { /* sentinel */ }, + }; + +- int ret; +- +- ret = rcsi2_phtw_write_mbps(priv, mbps, phtw_mbps_v3m_e3, 0x44); +- if (ret) +- return ret; +- + return rcsi2_phtw_write_array(priv, step1); + } + +@@ -949,6 +956,7 @@ static const struct rcar_csi2_info rcar_csi2_info_r8a77965 = { + + static const struct rcar_csi2_info rcar_csi2_info_r8a77970 = { + .init_phtw = rcsi2_init_phtw_v3m_e3, ++ .confirm_start = rcsi2_confirm_start_v3m_e3, + }; + + static const struct of_device_id rcar_csi2_of_table[] = { +diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc.c b/drivers/media/platform/s5p-mfc/s5p_mfc.c +index a80251ed3143..780548dd650e 100644 +--- a/drivers/media/platform/s5p-mfc/s5p_mfc.c ++++ b/drivers/media/platform/s5p-mfc/s5p_mfc.c +@@ -254,24 +254,24 @@ static void s5p_mfc_handle_frame_all_extracted(struct s5p_mfc_ctx *ctx) + static void s5p_mfc_handle_frame_copy_time(struct s5p_mfc_ctx *ctx) + { + struct s5p_mfc_dev *dev = ctx->dev; +- struct s5p_mfc_buf *dst_buf, *src_buf; +- size_t dec_y_addr; ++ struct s5p_mfc_buf *dst_buf, *src_buf; ++ u32 dec_y_addr; + unsigned int frame_type; + + /* Make sure we actually have a new frame before continuing. */ + frame_type = s5p_mfc_hw_call(dev->mfc_ops, get_dec_frame_type, dev); + if (frame_type == S5P_FIMV_DECODE_FRAME_SKIPPED) + return; +- dec_y_addr = s5p_mfc_hw_call(dev->mfc_ops, get_dec_y_adr, dev); ++ dec_y_addr = (u32)s5p_mfc_hw_call(dev->mfc_ops, get_dec_y_adr, dev); + + /* Copy timestamp / timecode from decoded src to dst and set + appropriate flags. */ + src_buf = list_entry(ctx->src_queue.next, struct s5p_mfc_buf, list); + list_for_each_entry(dst_buf, &ctx->dst_queue, list) { +- if (vb2_dma_contig_plane_dma_addr(&dst_buf->b->vb2_buf, 0) +- == dec_y_addr) { +- dst_buf->b->timecode = +- src_buf->b->timecode; ++ u32 addr = (u32)vb2_dma_contig_plane_dma_addr(&dst_buf->b->vb2_buf, 0); ++ ++ if (addr == dec_y_addr) { ++ dst_buf->b->timecode = src_buf->b->timecode; + dst_buf->b->vb2_buf.timestamp = + src_buf->b->vb2_buf.timestamp; + dst_buf->b->flags &= +@@ -307,10 +307,10 @@ static void s5p_mfc_handle_frame_new(struct s5p_mfc_ctx *ctx, unsigned int err) + { + struct s5p_mfc_dev *dev = ctx->dev; + struct s5p_mfc_buf *dst_buf; +- size_t dspl_y_addr; ++ u32 dspl_y_addr; + unsigned int frame_type; + +- dspl_y_addr = s5p_mfc_hw_call(dev->mfc_ops, get_dspl_y_adr, dev); ++ dspl_y_addr = (u32)s5p_mfc_hw_call(dev->mfc_ops, get_dspl_y_adr, dev); + if (IS_MFCV6_PLUS(dev)) + frame_type = s5p_mfc_hw_call(dev->mfc_ops, + get_disp_frame_type, ctx); +@@ -329,9 +329,10 @@ static void s5p_mfc_handle_frame_new(struct s5p_mfc_ctx *ctx, unsigned int err) + /* The MFC returns address of the buffer, now we have to + * check which videobuf does it correspond to */ + list_for_each_entry(dst_buf, &ctx->dst_queue, list) { ++ u32 addr = (u32)vb2_dma_contig_plane_dma_addr(&dst_buf->b->vb2_buf, 0); ++ + /* Check if this is the buffer we're looking for */ +- if (vb2_dma_contig_plane_dma_addr(&dst_buf->b->vb2_buf, 0) +- == dspl_y_addr) { ++ if (addr == dspl_y_addr) { + list_del(&dst_buf->list); + ctx->dst_queue_cnt--; + dst_buf->b->sequence = ctx->sequence; +diff --git a/drivers/media/usb/dvb-usb/dw2102.c b/drivers/media/usb/dvb-usb/dw2102.c +index 0d4fdd34a710..9ce8b4d79d1f 100644 +--- a/drivers/media/usb/dvb-usb/dw2102.c ++++ b/drivers/media/usb/dvb-usb/dw2102.c +@@ -2101,14 +2101,12 @@ static struct dvb_usb_device_properties s6x0_properties = { + } + }; + +-static struct dvb_usb_device_properties *p1100; + static const struct dvb_usb_device_description d1100 = { + "Prof 1100 USB ", + {&dw2102_table[PROF_1100], NULL}, + {NULL}, + }; + +-static struct dvb_usb_device_properties *s660; + static const struct dvb_usb_device_description d660 = { + "TeVii S660 USB", + {&dw2102_table[TEVII_S660], NULL}, +@@ -2127,14 +2125,12 @@ static const struct dvb_usb_device_description d480_2 = { + {NULL}, + }; + +-static struct dvb_usb_device_properties *p7500; + static const struct dvb_usb_device_description d7500 = { + "Prof 7500 USB DVB-S2", + {&dw2102_table[PROF_7500], NULL}, + {NULL}, + }; + +-static struct dvb_usb_device_properties *s421; + static const struct dvb_usb_device_description d421 = { + "TeVii S421 PCI", + {&dw2102_table[TEVII_S421], NULL}, +@@ -2334,6 +2330,11 @@ static int dw2102_probe(struct usb_interface *intf, + const struct usb_device_id *id) + { + int retval = -ENOMEM; ++ struct dvb_usb_device_properties *p1100; ++ struct dvb_usb_device_properties *s660; ++ struct dvb_usb_device_properties *p7500; ++ struct dvb_usb_device_properties *s421; ++ + p1100 = kmemdup(&s6x0_properties, + sizeof(struct dvb_usb_device_properties), GFP_KERNEL); + if (!p1100) +@@ -2402,8 +2403,16 @@ static int dw2102_probe(struct usb_interface *intf, + 0 == dvb_usb_device_init(intf, &t220_properties, + THIS_MODULE, NULL, adapter_nr) || + 0 == dvb_usb_device_init(intf, &tt_s2_4600_properties, +- THIS_MODULE, NULL, adapter_nr)) ++ THIS_MODULE, NULL, adapter_nr)) { ++ ++ /* clean up copied properties */ ++ kfree(s421); ++ kfree(p7500); ++ kfree(s660); ++ kfree(p1100); ++ + return 0; ++ } + + retval = -ENODEV; + kfree(s421); +diff --git a/drivers/media/usb/em28xx/em28xx-cards.c b/drivers/media/usb/em28xx/em28xx-cards.c +index 6c8438311d3b..ff5e41ac4723 100644 +--- a/drivers/media/usb/em28xx/em28xx-cards.c ++++ b/drivers/media/usb/em28xx/em28xx-cards.c +@@ -3376,7 +3376,9 @@ void em28xx_free_device(struct kref *ref) + if (!dev->disconnected) + em28xx_release_resources(dev); + +- kfree(dev->alt_max_pkt_size_isoc); ++ if (dev->ts == PRIMARY_TS) ++ kfree(dev->alt_max_pkt_size_isoc); ++ + kfree(dev); + } + EXPORT_SYMBOL_GPL(em28xx_free_device); +diff --git a/drivers/media/usb/em28xx/em28xx-core.c b/drivers/media/usb/em28xx/em28xx-core.c +index f70845e7d8c6..45b24776a695 100644 +--- a/drivers/media/usb/em28xx/em28xx-core.c ++++ b/drivers/media/usb/em28xx/em28xx-core.c +@@ -655,12 +655,12 @@ int em28xx_capture_start(struct em28xx *dev, int start) + rc = em28xx_write_reg_bits(dev, + EM2874_R5F_TS_ENABLE, + start ? EM2874_TS1_CAPTURE_ENABLE : 0x00, +- EM2874_TS1_CAPTURE_ENABLE); ++ EM2874_TS1_CAPTURE_ENABLE | EM2874_TS1_FILTER_ENABLE | EM2874_TS1_NULL_DISCARD); + else + rc = em28xx_write_reg_bits(dev, + EM2874_R5F_TS_ENABLE, + start ? EM2874_TS2_CAPTURE_ENABLE : 0x00, +- EM2874_TS2_CAPTURE_ENABLE); ++ EM2874_TS2_CAPTURE_ENABLE | EM2874_TS2_FILTER_ENABLE | EM2874_TS2_NULL_DISCARD); + } else { + /* FIXME: which is the best order? */ + /* video registers are sampled by VREF */ +diff --git a/drivers/media/usb/em28xx/em28xx-dvb.c b/drivers/media/usb/em28xx/em28xx-dvb.c +index b778d8a1983e..a73faf12f7e4 100644 +--- a/drivers/media/usb/em28xx/em28xx-dvb.c ++++ b/drivers/media/usb/em28xx/em28xx-dvb.c +@@ -218,7 +218,9 @@ static int em28xx_start_streaming(struct em28xx_dvb *dvb) + dvb_alt = dev->dvb_alt_isoc; + } + +- usb_set_interface(udev, dev->ifnum, dvb_alt); ++ if (!dev->board.has_dual_ts) ++ usb_set_interface(udev, dev->ifnum, dvb_alt); ++ + rc = em28xx_set_mode(dev, EM28XX_DIGITAL_MODE); + if (rc < 0) + return rc; +diff --git a/drivers/memory/ti-aemif.c b/drivers/memory/ti-aemif.c +index 31112f622b88..475e5b3790ed 100644 +--- a/drivers/memory/ti-aemif.c ++++ b/drivers/memory/ti-aemif.c +@@ -411,7 +411,7 @@ static int aemif_probe(struct platform_device *pdev) + if (ret < 0) + goto error; + } +- } else { ++ } else if (pdata) { + for (i = 0; i < pdata->num_sub_devices; i++) { + pdata->sub_devices[i].dev.parent = dev; + ret = platform_device_register(&pdata->sub_devices[i]); +diff --git a/drivers/mfd/rave-sp.c b/drivers/mfd/rave-sp.c +index 36dcd98977d6..4f545fdc6ebc 100644 +--- a/drivers/mfd/rave-sp.c ++++ b/drivers/mfd/rave-sp.c +@@ -776,6 +776,13 @@ static int rave_sp_probe(struct serdev_device *serdev) + return ret; + + serdev_device_set_baudrate(serdev, baud); ++ serdev_device_set_flow_control(serdev, false); ++ ++ ret = serdev_device_set_parity(serdev, SERDEV_PARITY_NONE); ++ if (ret) { ++ dev_err(dev, "Failed to set parity\n"); ++ return ret; ++ } + + ret = rave_sp_get_status(sp); + if (ret) { +diff --git a/drivers/mfd/ti_am335x_tscadc.c b/drivers/mfd/ti_am335x_tscadc.c +index 47012c0899cd..7a30546880a4 100644 +--- a/drivers/mfd/ti_am335x_tscadc.c ++++ b/drivers/mfd/ti_am335x_tscadc.c +@@ -209,14 +209,13 @@ static int ti_tscadc_probe(struct platform_device *pdev) + * The TSC_ADC_SS controller design assumes the OCP clock is + * at least 6x faster than the ADC clock. + */ +- clk = clk_get(&pdev->dev, "adc_tsc_fck"); ++ clk = devm_clk_get(&pdev->dev, "adc_tsc_fck"); + if (IS_ERR(clk)) { + dev_err(&pdev->dev, "failed to get TSC fck\n"); + err = PTR_ERR(clk); + goto err_disable_clk; + } + clock_rate = clk_get_rate(clk); +- clk_put(clk); + tscadc->clk_div = clock_rate / ADC_CLK; + + /* TSCADC_CLKDIV needs to be configured to the value minus 1 */ +diff --git a/drivers/misc/mic/scif/scif_api.c b/drivers/misc/mic/scif/scif_api.c +index 7b2dddcdd46d..42f7a12894d6 100644 +--- a/drivers/misc/mic/scif/scif_api.c ++++ b/drivers/misc/mic/scif/scif_api.c +@@ -370,11 +370,10 @@ int scif_bind(scif_epd_t epd, u16 pn) + goto scif_bind_exit; + } + } else { +- pn = scif_get_new_port(); +- if (!pn) { +- ret = -ENOSPC; ++ ret = scif_get_new_port(); ++ if (ret < 0) + goto scif_bind_exit; +- } ++ pn = ret; + } + + ep->state = SCIFEP_BOUND; +@@ -648,13 +647,12 @@ int __scif_connect(scif_epd_t epd, struct scif_port_id *dst, bool non_block) + err = -EISCONN; + break; + case SCIFEP_UNBOUND: +- ep->port.port = scif_get_new_port(); +- if (!ep->port.port) { +- err = -ENOSPC; +- } else { +- ep->port.node = scif_info.nodeid; +- ep->conn_async_state = ASYNC_CONN_IDLE; +- } ++ err = scif_get_new_port(); ++ if (err < 0) ++ break; ++ ep->port.port = err; ++ ep->port.node = scif_info.nodeid; ++ ep->conn_async_state = ASYNC_CONN_IDLE; + /* Fall through */ + case SCIFEP_BOUND: + /* +diff --git a/drivers/misc/ti-st/st_kim.c b/drivers/misc/ti-st/st_kim.c +index 5ec3f5a43718..14a5e9da32bd 100644 +--- a/drivers/misc/ti-st/st_kim.c ++++ b/drivers/misc/ti-st/st_kim.c +@@ -756,14 +756,14 @@ static int kim_probe(struct platform_device *pdev) + err = gpio_request(kim_gdata->nshutdown, "kim"); + if (unlikely(err)) { + pr_err(" gpio %d request failed ", kim_gdata->nshutdown); +- return err; ++ goto err_sysfs_group; + } + + /* Configure nShutdown GPIO as output=0 */ + err = gpio_direction_output(kim_gdata->nshutdown, 0); + if (unlikely(err)) { + pr_err(" unable to configure gpio %d", kim_gdata->nshutdown); +- return err; ++ goto err_sysfs_group; + } + /* get reference of pdev for request_firmware + */ +diff --git a/drivers/mtd/nand/raw/nand_base.c b/drivers/mtd/nand/raw/nand_base.c +index b01d15ec4c56..3e3e6a8f1abc 100644 +--- a/drivers/mtd/nand/raw/nand_base.c ++++ b/drivers/mtd/nand/raw/nand_base.c +@@ -2668,8 +2668,8 @@ static bool nand_subop_instr_is_valid(const struct nand_subop *subop, + return subop && instr_idx < subop->ninstrs; + } + +-static int nand_subop_get_start_off(const struct nand_subop *subop, +- unsigned int instr_idx) ++static unsigned int nand_subop_get_start_off(const struct nand_subop *subop, ++ unsigned int instr_idx) + { + if (instr_idx) + return 0; +@@ -2688,12 +2688,12 @@ static int nand_subop_get_start_off(const struct nand_subop *subop, + * + * Given an address instruction, returns the offset of the first cycle to issue. + */ +-int nand_subop_get_addr_start_off(const struct nand_subop *subop, +- unsigned int instr_idx) ++unsigned int nand_subop_get_addr_start_off(const struct nand_subop *subop, ++ unsigned int instr_idx) + { +- if (!nand_subop_instr_is_valid(subop, instr_idx) || +- subop->instrs[instr_idx].type != NAND_OP_ADDR_INSTR) +- return -EINVAL; ++ if (WARN_ON(!nand_subop_instr_is_valid(subop, instr_idx) || ++ subop->instrs[instr_idx].type != NAND_OP_ADDR_INSTR)) ++ return 0; + + return nand_subop_get_start_off(subop, instr_idx); + } +@@ -2710,14 +2710,14 @@ EXPORT_SYMBOL_GPL(nand_subop_get_addr_start_off); + * + * Given an address instruction, returns the number of address cycle to issue. + */ +-int nand_subop_get_num_addr_cyc(const struct nand_subop *subop, +- unsigned int instr_idx) ++unsigned int nand_subop_get_num_addr_cyc(const struct nand_subop *subop, ++ unsigned int instr_idx) + { + int start_off, end_off; + +- if (!nand_subop_instr_is_valid(subop, instr_idx) || +- subop->instrs[instr_idx].type != NAND_OP_ADDR_INSTR) +- return -EINVAL; ++ if (WARN_ON(!nand_subop_instr_is_valid(subop, instr_idx) || ++ subop->instrs[instr_idx].type != NAND_OP_ADDR_INSTR)) ++ return 0; + + start_off = nand_subop_get_addr_start_off(subop, instr_idx); + +@@ -2742,12 +2742,12 @@ EXPORT_SYMBOL_GPL(nand_subop_get_num_addr_cyc); + * + * Given a data instruction, returns the offset to start from. + */ +-int nand_subop_get_data_start_off(const struct nand_subop *subop, +- unsigned int instr_idx) ++unsigned int nand_subop_get_data_start_off(const struct nand_subop *subop, ++ unsigned int instr_idx) + { +- if (!nand_subop_instr_is_valid(subop, instr_idx) || +- !nand_instr_is_data(&subop->instrs[instr_idx])) +- return -EINVAL; ++ if (WARN_ON(!nand_subop_instr_is_valid(subop, instr_idx) || ++ !nand_instr_is_data(&subop->instrs[instr_idx]))) ++ return 0; + + return nand_subop_get_start_off(subop, instr_idx); + } +@@ -2764,14 +2764,14 @@ EXPORT_SYMBOL_GPL(nand_subop_get_data_start_off); + * + * Returns the length of the chunk of data to send/receive. + */ +-int nand_subop_get_data_len(const struct nand_subop *subop, +- unsigned int instr_idx) ++unsigned int nand_subop_get_data_len(const struct nand_subop *subop, ++ unsigned int instr_idx) + { + int start_off = 0, end_off; + +- if (!nand_subop_instr_is_valid(subop, instr_idx) || +- !nand_instr_is_data(&subop->instrs[instr_idx])) +- return -EINVAL; ++ if (WARN_ON(!nand_subop_instr_is_valid(subop, instr_idx) || ++ !nand_instr_is_data(&subop->instrs[instr_idx]))) ++ return 0; + + start_off = nand_subop_get_data_start_off(subop, instr_idx); + +diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c +index 82ac1d10f239..b4253d0e056b 100644 +--- a/drivers/net/ethernet/marvell/mvneta.c ++++ b/drivers/net/ethernet/marvell/mvneta.c +@@ -3196,7 +3196,6 @@ static int mvneta_change_mtu(struct net_device *dev, int mtu) + + on_each_cpu(mvneta_percpu_enable, pp, true); + mvneta_start_dev(pp); +- mvneta_port_up(pp); + + netdev_update_features(dev); + +diff --git a/drivers/net/phy/mdio-mux-bcm-iproc.c b/drivers/net/phy/mdio-mux-bcm-iproc.c +index 0c5b68e7da51..9b3167054843 100644 +--- a/drivers/net/phy/mdio-mux-bcm-iproc.c ++++ b/drivers/net/phy/mdio-mux-bcm-iproc.c +@@ -22,7 +22,7 @@ + #include <linux/mdio-mux.h> + #include <linux/delay.h> + +-#define MDIO_PARAM_OFFSET 0x00 ++#define MDIO_PARAM_OFFSET 0x23c + #define MDIO_PARAM_MIIM_CYCLE 29 + #define MDIO_PARAM_INTERNAL_SEL 25 + #define MDIO_PARAM_BUS_ID 22 +@@ -30,20 +30,22 @@ + #define MDIO_PARAM_PHY_ID 16 + #define MDIO_PARAM_PHY_DATA 0 + +-#define MDIO_READ_OFFSET 0x04 ++#define MDIO_READ_OFFSET 0x240 + #define MDIO_READ_DATA_MASK 0xffff +-#define MDIO_ADDR_OFFSET 0x08 ++#define MDIO_ADDR_OFFSET 0x244 + +-#define MDIO_CTRL_OFFSET 0x0C ++#define MDIO_CTRL_OFFSET 0x248 + #define MDIO_CTRL_WRITE_OP 0x1 + #define MDIO_CTRL_READ_OP 0x2 + +-#define MDIO_STAT_OFFSET 0x10 ++#define MDIO_STAT_OFFSET 0x24c + #define MDIO_STAT_DONE 1 + + #define BUS_MAX_ADDR 32 + #define EXT_BUS_START_ADDR 16 + ++#define MDIO_REG_ADDR_SPACE_SIZE 0x250 ++ + struct iproc_mdiomux_desc { + void *mux_handle; + void __iomem *base; +@@ -169,6 +171,14 @@ static int mdio_mux_iproc_probe(struct platform_device *pdev) + md->dev = &pdev->dev; + + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); ++ if (res->start & 0xfff) { ++ /* For backward compatibility in case the ++ * base address is specified with an offset. ++ */ ++ dev_info(&pdev->dev, "fix base address in dt-blob\n"); ++ res->start &= ~0xfff; ++ res->end = res->start + MDIO_REG_ADDR_SPACE_SIZE - 1; ++ } + md->base = devm_ioremap_resource(&pdev->dev, res); + if (IS_ERR(md->base)) { + dev_err(&pdev->dev, "failed to ioremap register\n"); +diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c +index 836e0a47b94a..747c6951b5c1 100644 +--- a/drivers/net/wireless/ath/ath10k/mac.c ++++ b/drivers/net/wireless/ath/ath10k/mac.c +@@ -3085,6 +3085,13 @@ static int ath10k_update_channel_list(struct ath10k *ar) + passive = channel->flags & IEEE80211_CHAN_NO_IR; + ch->passive = passive; + ++ /* the firmware is ignoring the "radar" flag of the ++ * channel and is scanning actively using Probe Requests ++ * on "Radar detection"/DFS channels which are not ++ * marked as "available" ++ */ ++ ch->passive |= ch->chan_radar; ++ + ch->freq = channel->center_freq; + ch->band_center_freq1 = channel->center_freq; + ch->min_power = 0; +diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.c b/drivers/net/wireless/ath/ath10k/wmi-tlv.c +index 8c49a26fc571..21eb3a598a86 100644 +--- a/drivers/net/wireless/ath/ath10k/wmi-tlv.c ++++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.c +@@ -1584,6 +1584,11 @@ static struct sk_buff *ath10k_wmi_tlv_op_gen_init(struct ath10k *ar) + cfg->keep_alive_pattern_size = __cpu_to_le32(0); + cfg->max_tdls_concurrent_sleep_sta = __cpu_to_le32(1); + cfg->max_tdls_concurrent_buffer_sta = __cpu_to_le32(1); ++ cfg->wmi_send_separate = __cpu_to_le32(0); ++ cfg->num_ocb_vdevs = __cpu_to_le32(0); ++ cfg->num_ocb_channels = __cpu_to_le32(0); ++ cfg->num_ocb_schedules = __cpu_to_le32(0); ++ cfg->host_capab = __cpu_to_le32(0); + + ath10k_wmi_put_host_mem_chunks(ar, chunks); + +diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.h b/drivers/net/wireless/ath/ath10k/wmi-tlv.h +index 3e1e340cd834..1cb93d09b8a9 100644 +--- a/drivers/net/wireless/ath/ath10k/wmi-tlv.h ++++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.h +@@ -1670,6 +1670,11 @@ struct wmi_tlv_resource_config { + __le32 keep_alive_pattern_size; + __le32 max_tdls_concurrent_sleep_sta; + __le32 max_tdls_concurrent_buffer_sta; ++ __le32 wmi_send_separate; ++ __le32 num_ocb_vdevs; ++ __le32 num_ocb_channels; ++ __le32 num_ocb_schedules; ++ __le32 host_capab; + } __packed; + + struct wmi_tlv_init_cmd { +diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c +index e60bea4604e4..fcd9d5eeae72 100644 +--- a/drivers/net/wireless/ath/ath9k/hw.c ++++ b/drivers/net/wireless/ath/ath9k/hw.c +@@ -2942,16 +2942,19 @@ void ath9k_hw_apply_txpower(struct ath_hw *ah, struct ath9k_channel *chan, + struct ath_regulatory *reg = ath9k_hw_regulatory(ah); + struct ieee80211_channel *channel; + int chan_pwr, new_pwr; ++ u16 ctl = NO_CTL; + + if (!chan) + return; + ++ if (!test) ++ ctl = ath9k_regd_get_ctl(reg, chan); ++ + channel = chan->chan; + chan_pwr = min_t(int, channel->max_power * 2, MAX_RATE_POWER); + new_pwr = min_t(int, chan_pwr, reg->power_limit); + +- ah->eep_ops->set_txpower(ah, chan, +- ath9k_regd_get_ctl(reg, chan), ++ ah->eep_ops->set_txpower(ah, chan, ctl, + get_antenna_gain(ah, chan), new_pwr, test); + } + +diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c +index 7fdb152be0bb..a249ee747dc9 100644 +--- a/drivers/net/wireless/ath/ath9k/xmit.c ++++ b/drivers/net/wireless/ath/ath9k/xmit.c +@@ -86,7 +86,8 @@ static void ath_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb) + struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb); + struct ieee80211_sta *sta = info->status.status_driver_data[0]; + +- if (info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS) { ++ if (info->flags & (IEEE80211_TX_CTL_REQ_TX_STATUS | ++ IEEE80211_TX_STATUS_EOSP)) { + ieee80211_tx_status(hw, skb); + return; + } +diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c +index 8520523b91b4..d8d8443c1c93 100644 +--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c +@@ -1003,6 +1003,10 @@ static int iwl_pci_resume(struct device *device) + if (!trans->op_mode) + return 0; + ++ /* In WOWLAN, let iwl_trans_pcie_d3_resume do the rest of the work */ ++ if (test_bit(STATUS_DEVICE_ENABLED, &trans->status)) ++ return 0; ++ + /* reconfigure the MSI-X mapping to get the correct IRQ for rfkill */ + iwl_pcie_conf_msix_hw(trans_pcie); + +diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c +index 7229991ae70d..a2a98087eb41 100644 +--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c +@@ -1539,18 +1539,6 @@ static int iwl_trans_pcie_d3_resume(struct iwl_trans *trans, + + iwl_pcie_enable_rx_wake(trans, true); + +- /* +- * Reconfigure IVAR table in case of MSIX or reset ict table in +- * MSI mode since HW reset erased it. +- * Also enables interrupts - none will happen as +- * the device doesn't know we're waking it up, only when +- * the opmode actually tells it after this call. +- */ +- iwl_pcie_conf_msix_hw(trans_pcie); +- if (!trans_pcie->msix_enabled) +- iwl_pcie_reset_ict(trans); +- iwl_enable_interrupts(trans); +- + iwl_set_bit(trans, CSR_GP_CNTRL, + BIT(trans->cfg->csr->flag_mac_access_req)); + iwl_set_bit(trans, CSR_GP_CNTRL, +@@ -1568,6 +1556,18 @@ static int iwl_trans_pcie_d3_resume(struct iwl_trans *trans, + return ret; + } + ++ /* ++ * Reconfigure IVAR table in case of MSIX or reset ict table in ++ * MSI mode since HW reset erased it. ++ * Also enables interrupts - none will happen as ++ * the device doesn't know we're waking it up, only when ++ * the opmode actually tells it after this call. ++ */ ++ iwl_pcie_conf_msix_hw(trans_pcie); ++ if (!trans_pcie->msix_enabled) ++ iwl_pcie_reset_ict(trans); ++ iwl_enable_interrupts(trans); ++ + iwl_pcie_set_pwr(trans, false); + + if (!reset) { +diff --git a/drivers/net/wireless/ti/wlcore/rx.c b/drivers/net/wireless/ti/wlcore/rx.c +index 0f15696195f8..078a4940bc5c 100644 +--- a/drivers/net/wireless/ti/wlcore/rx.c ++++ b/drivers/net/wireless/ti/wlcore/rx.c +@@ -59,7 +59,7 @@ static u32 wlcore_rx_get_align_buf_size(struct wl1271 *wl, u32 pkt_len) + static void wl1271_rx_status(struct wl1271 *wl, + struct wl1271_rx_descriptor *desc, + struct ieee80211_rx_status *status, +- u8 beacon) ++ u8 beacon, u8 probe_rsp) + { + memset(status, 0, sizeof(struct ieee80211_rx_status)); + +@@ -106,6 +106,9 @@ static void wl1271_rx_status(struct wl1271 *wl, + } + } + ++ if (beacon || probe_rsp) ++ status->boottime_ns = ktime_get_boot_ns(); ++ + if (beacon) + wlcore_set_pending_regdomain_ch(wl, (u16)desc->channel, + status->band); +@@ -191,7 +194,8 @@ static int wl1271_rx_handle_data(struct wl1271 *wl, u8 *data, u32 length, + if (ieee80211_is_data_present(hdr->frame_control)) + is_data = 1; + +- wl1271_rx_status(wl, desc, IEEE80211_SKB_RXCB(skb), beacon); ++ wl1271_rx_status(wl, desc, IEEE80211_SKB_RXCB(skb), beacon, ++ ieee80211_is_probe_resp(hdr->frame_control)); + wlcore_hw_set_rx_csum(wl, desc, skb); + + seq_num = (le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_SEQ) >> 4; +diff --git a/drivers/pci/controller/pcie-mobiveil.c b/drivers/pci/controller/pcie-mobiveil.c +index cf0aa7cee5b0..a939e8d31735 100644 +--- a/drivers/pci/controller/pcie-mobiveil.c ++++ b/drivers/pci/controller/pcie-mobiveil.c +@@ -23,6 +23,8 @@ + #include <linux/platform_device.h> + #include <linux/slab.h> + ++#include "../pci.h" ++ + /* register offsets and bit positions */ + + /* +@@ -130,7 +132,7 @@ struct mobiveil_pcie { + void __iomem *config_axi_slave_base; /* endpoint config base */ + void __iomem *csr_axi_slave_base; /* root port config base */ + void __iomem *apb_csr_base; /* MSI register base */ +- void __iomem *pcie_reg_base; /* Physical PCIe Controller Base */ ++ phys_addr_t pcie_reg_base; /* Physical PCIe Controller Base */ + struct irq_domain *intx_domain; + raw_spinlock_t intx_mask_lock; + int irq; +diff --git a/drivers/pci/switch/switchtec.c b/drivers/pci/switch/switchtec.c +index 47cd0c037433..f96af1467984 100644 +--- a/drivers/pci/switch/switchtec.c ++++ b/drivers/pci/switch/switchtec.c +@@ -14,6 +14,8 @@ + #include <linux/poll.h> + #include <linux/wait.h> + ++#include <linux/nospec.h> ++ + MODULE_DESCRIPTION("Microsemi Switchtec(tm) PCIe Management Driver"); + MODULE_VERSION("0.1"); + MODULE_LICENSE("GPL"); +@@ -909,6 +911,8 @@ static int ioctl_port_to_pff(struct switchtec_dev *stdev, + default: + if (p.port > ARRAY_SIZE(pcfg->dsp_pff_inst_id)) + return -EINVAL; ++ p.port = array_index_nospec(p.port, ++ ARRAY_SIZE(pcfg->dsp_pff_inst_id) + 1); + p.pff = ioread32(&pcfg->dsp_pff_inst_id[p.port - 1]); + break; + } +diff --git a/drivers/pinctrl/berlin/berlin.c b/drivers/pinctrl/berlin/berlin.c +index d6d183e9db17..b5903fffb3d0 100644 +--- a/drivers/pinctrl/berlin/berlin.c ++++ b/drivers/pinctrl/berlin/berlin.c +@@ -216,10 +216,8 @@ static int berlin_pinctrl_build_state(struct platform_device *pdev) + } + + /* we will reallocate later */ +- pctrl->functions = devm_kcalloc(&pdev->dev, +- max_functions, +- sizeof(*pctrl->functions), +- GFP_KERNEL); ++ pctrl->functions = kcalloc(max_functions, ++ sizeof(*pctrl->functions), GFP_KERNEL); + if (!pctrl->functions) + return -ENOMEM; + +@@ -257,8 +255,10 @@ static int berlin_pinctrl_build_state(struct platform_device *pdev) + function++; + } + +- if (!found) ++ if (!found) { ++ kfree(pctrl->functions); + return -EINVAL; ++ } + + if (!function->groups) { + function->groups = +@@ -267,8 +267,10 @@ static int berlin_pinctrl_build_state(struct platform_device *pdev) + sizeof(char *), + GFP_KERNEL); + +- if (!function->groups) ++ if (!function->groups) { ++ kfree(pctrl->functions); + return -ENOMEM; ++ } + } + + groups = function->groups; +diff --git a/drivers/pinctrl/freescale/pinctrl-imx.c b/drivers/pinctrl/freescale/pinctrl-imx.c +index 1c6bb15579e1..b04edc22dad7 100644 +--- a/drivers/pinctrl/freescale/pinctrl-imx.c ++++ b/drivers/pinctrl/freescale/pinctrl-imx.c +@@ -383,7 +383,7 @@ static void imx_pinconf_group_dbg_show(struct pinctrl_dev *pctldev, + const char *name; + int i, ret; + +- if (group > pctldev->num_groups) ++ if (group >= pctldev->num_groups) + return; + + seq_puts(s, "\n"); +diff --git a/drivers/pinctrl/pinctrl-amd.c b/drivers/pinctrl/pinctrl-amd.c +index 04ae139671c8..b91db89eb924 100644 +--- a/drivers/pinctrl/pinctrl-amd.c ++++ b/drivers/pinctrl/pinctrl-amd.c +@@ -552,7 +552,8 @@ static irqreturn_t amd_gpio_irq_handler(int irq, void *dev_id) + /* Each status bit covers four pins */ + for (i = 0; i < 4; i++) { + regval = readl(regs + i); +- if (!(regval & PIN_IRQ_PENDING)) ++ if (!(regval & PIN_IRQ_PENDING) || ++ !(regval & BIT(INTERRUPT_MASK_OFF))) + continue; + irq = irq_find_mapping(gc->irq.domain, irqnr + i); + generic_handle_irq(irq); +diff --git a/drivers/regulator/tps65217-regulator.c b/drivers/regulator/tps65217-regulator.c +index fc12badf3805..d84fab616abf 100644 +--- a/drivers/regulator/tps65217-regulator.c ++++ b/drivers/regulator/tps65217-regulator.c +@@ -232,6 +232,8 @@ static int tps65217_regulator_probe(struct platform_device *pdev) + tps->strobes = devm_kcalloc(&pdev->dev, + TPS65217_NUM_REGULATOR, sizeof(u8), + GFP_KERNEL); ++ if (!tps->strobes) ++ return -ENOMEM; + + platform_set_drvdata(pdev, tps); + +diff --git a/drivers/rpmsg/rpmsg_core.c b/drivers/rpmsg/rpmsg_core.c +index b714a543a91d..8122807db380 100644 +--- a/drivers/rpmsg/rpmsg_core.c ++++ b/drivers/rpmsg/rpmsg_core.c +@@ -15,6 +15,7 @@ + #include <linux/module.h> + #include <linux/rpmsg.h> + #include <linux/of_device.h> ++#include <linux/pm_domain.h> + #include <linux/slab.h> + + #include "rpmsg_internal.h" +@@ -449,6 +450,10 @@ static int rpmsg_dev_probe(struct device *dev) + struct rpmsg_endpoint *ept = NULL; + int err; + ++ err = dev_pm_domain_attach(dev, true); ++ if (err) ++ goto out; ++ + if (rpdrv->callback) { + strncpy(chinfo.name, rpdev->id.name, RPMSG_NAME_SIZE); + chinfo.src = rpdev->src; +@@ -490,6 +495,8 @@ static int rpmsg_dev_remove(struct device *dev) + + rpdrv->remove(rpdev); + ++ dev_pm_domain_detach(dev, true); ++ + if (rpdev->ept) + rpmsg_destroy_ept(rpdev->ept); + +diff --git a/drivers/scsi/3w-9xxx.c b/drivers/scsi/3w-9xxx.c +index 99ba4a770406..27521fc3ef5a 100644 +--- a/drivers/scsi/3w-9xxx.c ++++ b/drivers/scsi/3w-9xxx.c +@@ -2038,6 +2038,7 @@ static int twa_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id) + + if (twa_initialize_device_extension(tw_dev)) { + TW_PRINTK(tw_dev->host, TW_DRIVER, 0x25, "Failed to initialize device extension"); ++ retval = -ENOMEM; + goto out_free_device_extension; + } + +@@ -2060,6 +2061,7 @@ static int twa_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id) + tw_dev->base_addr = ioremap(mem_addr, mem_len); + if (!tw_dev->base_addr) { + TW_PRINTK(tw_dev->host, TW_DRIVER, 0x35, "Failed to ioremap"); ++ retval = -ENOMEM; + goto out_release_mem_region; + } + +@@ -2067,8 +2069,10 @@ static int twa_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id) + TW_DISABLE_INTERRUPTS(tw_dev); + + /* Initialize the card */ +- if (twa_reset_sequence(tw_dev, 0)) ++ if (twa_reset_sequence(tw_dev, 0)) { ++ retval = -ENOMEM; + goto out_iounmap; ++ } + + /* Set host specific parameters */ + if ((pdev->device == PCI_DEVICE_ID_3WARE_9650SE) || +diff --git a/drivers/scsi/3w-sas.c b/drivers/scsi/3w-sas.c +index cf9f2a09b47d..40c1e6e64f58 100644 +--- a/drivers/scsi/3w-sas.c ++++ b/drivers/scsi/3w-sas.c +@@ -1594,6 +1594,7 @@ static int twl_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id) + + if (twl_initialize_device_extension(tw_dev)) { + TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1a, "Failed to initialize device extension"); ++ retval = -ENOMEM; + goto out_free_device_extension; + } + +@@ -1608,6 +1609,7 @@ static int twl_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id) + tw_dev->base_addr = pci_iomap(pdev, 1, 0); + if (!tw_dev->base_addr) { + TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1c, "Failed to ioremap"); ++ retval = -ENOMEM; + goto out_release_mem_region; + } + +@@ -1617,6 +1619,7 @@ static int twl_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id) + /* Initialize the card */ + if (twl_reset_sequence(tw_dev, 0)) { + TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1d, "Controller reset failed during probe"); ++ retval = -ENOMEM; + goto out_iounmap; + } + +diff --git a/drivers/scsi/3w-xxxx.c b/drivers/scsi/3w-xxxx.c +index f6179e3d6953..961ea6f7def8 100644 +--- a/drivers/scsi/3w-xxxx.c ++++ b/drivers/scsi/3w-xxxx.c +@@ -2280,6 +2280,7 @@ static int tw_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id) + + if (tw_initialize_device_extension(tw_dev)) { + printk(KERN_WARNING "3w-xxxx: Failed to initialize device extension."); ++ retval = -ENOMEM; + goto out_free_device_extension; + } + +@@ -2294,6 +2295,7 @@ static int tw_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id) + tw_dev->base_addr = pci_resource_start(pdev, 0); + if (!tw_dev->base_addr) { + printk(KERN_WARNING "3w-xxxx: Failed to get io address."); ++ retval = -ENOMEM; + goto out_release_mem_region; + } + +diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h +index 20b249a649dd..902004dc8dc7 100644 +--- a/drivers/scsi/lpfc/lpfc.h ++++ b/drivers/scsi/lpfc/lpfc.h +@@ -672,7 +672,7 @@ struct lpfc_hba { + #define LS_NPIV_FAB_SUPPORTED 0x2 /* Fabric supports NPIV */ + #define LS_IGNORE_ERATT 0x4 /* intr handler should ignore ERATT */ + #define LS_MDS_LINK_DOWN 0x8 /* MDS Diagnostics Link Down */ +-#define LS_MDS_LOOPBACK 0x16 /* MDS Diagnostics Link Up (Loopback) */ ++#define LS_MDS_LOOPBACK 0x10 /* MDS Diagnostics Link Up (Loopback) */ + + uint32_t hba_flag; /* hba generic flags */ + #define HBA_ERATT_HANDLED 0x1 /* This flag is set when eratt handled */ +diff --git a/drivers/scsi/lpfc/lpfc_nvme.c b/drivers/scsi/lpfc/lpfc_nvme.c +index 76a5a99605aa..d723fd1d7b26 100644 +--- a/drivers/scsi/lpfc/lpfc_nvme.c ++++ b/drivers/scsi/lpfc/lpfc_nvme.c +@@ -2687,7 +2687,7 @@ lpfc_nvme_register_port(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp) + struct lpfc_nvme_rport *oldrport; + struct nvme_fc_remote_port *remote_port; + struct nvme_fc_port_info rpinfo; +- struct lpfc_nodelist *prev_ndlp; ++ struct lpfc_nodelist *prev_ndlp = NULL; + + lpfc_printf_vlog(ndlp->vport, KERN_INFO, LOG_NVME_DISC, + "6006 Register NVME PORT. DID x%06x nlptype x%x\n", +@@ -2736,23 +2736,29 @@ lpfc_nvme_register_port(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp) + spin_unlock_irq(&vport->phba->hbalock); + rport = remote_port->private; + if (oldrport) { ++ /* New remoteport record does not guarantee valid ++ * host private memory area. ++ */ ++ prev_ndlp = oldrport->ndlp; + if (oldrport == remote_port->private) { +- /* Same remoteport. Just reuse. */ ++ /* Same remoteport - ndlp should match. ++ * Just reuse. ++ */ + lpfc_printf_vlog(ndlp->vport, KERN_INFO, + LOG_NVME_DISC, + "6014 Rebinding lport to " + "remoteport %p wwpn 0x%llx, " +- "Data: x%x x%x %p x%x x%06x\n", ++ "Data: x%x x%x %p %p x%x x%06x\n", + remote_port, + remote_port->port_name, + remote_port->port_id, + remote_port->port_role, ++ prev_ndlp, + ndlp, + ndlp->nlp_type, + ndlp->nlp_DID); + return 0; + } +- prev_ndlp = rport->ndlp; + + /* Sever the ndlp<->rport association + * before dropping the ndlp ref from +@@ -2786,13 +2792,13 @@ lpfc_nvme_register_port(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp) + lpfc_printf_vlog(vport, KERN_INFO, + LOG_NVME_DISC | LOG_NODE, + "6022 Binding new rport to " +- "lport %p Remoteport %p WWNN 0x%llx, " ++ "lport %p Remoteport %p rport %p WWNN 0x%llx, " + "Rport WWPN 0x%llx DID " +- "x%06x Role x%x, ndlp %p\n", +- lport, remote_port, ++ "x%06x Role x%x, ndlp %p prev_ndlp %p\n", ++ lport, remote_port, rport, + rpinfo.node_name, rpinfo.port_name, + rpinfo.port_id, rpinfo.port_role, +- ndlp); ++ ndlp, prev_ndlp); + } else { + lpfc_printf_vlog(vport, KERN_ERR, + LOG_NVME_DISC | LOG_NODE, +diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c +index ec550ee0108e..75d34def2361 100644 +--- a/drivers/scsi/qla2xxx/qla_init.c ++++ b/drivers/scsi/qla2xxx/qla_init.c +@@ -1074,9 +1074,12 @@ void qla24xx_handle_gpdb_event(scsi_qla_host_t *vha, struct event_arg *ea) + case PDS_PLOGI_COMPLETE: + case PDS_PRLI_PENDING: + case PDS_PRLI2_PENDING: +- ql_dbg(ql_dbg_disc, vha, 0x20d5, "%s %d %8phC relogin needed\n", +- __func__, __LINE__, fcport->port_name); +- set_bit(RELOGIN_NEEDED, &vha->dpc_flags); ++ /* Set discovery state back to GNL to Relogin attempt */ ++ if (qla_dual_mode_enabled(vha) || ++ qla_ini_mode_enabled(vha)) { ++ fcport->disc_state = DSC_GNL; ++ set_bit(RELOGIN_NEEDED, &vha->dpc_flags); ++ } + return; + case PDS_LOGO_PENDING: + case PDS_PORT_UNAVAILABLE: +diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c +index 1027b0cb7fa3..6dc1b1bd8069 100644 +--- a/drivers/scsi/qla2xxx/qla_target.c ++++ b/drivers/scsi/qla2xxx/qla_target.c +@@ -982,8 +982,9 @@ void qlt_free_session_done(struct work_struct *work) + + logo.id = sess->d_id; + logo.cmd_count = 0; ++ if (!own) ++ qlt_send_first_logo(vha, &logo); + sess->send_els_logo = 0; +- qlt_send_first_logo(vha, &logo); + } + + if (sess->logout_on_delete && sess->loop_id != FC_NO_LOOP_ID) { +diff --git a/drivers/scsi/qla2xxx/qla_tmpl.c b/drivers/scsi/qla2xxx/qla_tmpl.c +index 731ca0d8520a..9f3c263756a8 100644 +--- a/drivers/scsi/qla2xxx/qla_tmpl.c ++++ b/drivers/scsi/qla2xxx/qla_tmpl.c +@@ -571,6 +571,15 @@ qla27xx_fwdt_entry_t268(struct scsi_qla_host *vha, + } + break; + ++ case T268_BUF_TYPE_REQ_MIRROR: ++ case T268_BUF_TYPE_RSP_MIRROR: ++ /* ++ * Mirror pointers are not implemented in the ++ * driver, instead shadow pointers are used by ++ * the drier. Skip these entries. ++ */ ++ qla27xx_skip_entry(ent, buf); ++ break; + default: + ql_dbg(ql_dbg_async, vha, 0xd02b, + "%s: unknown buffer %x\n", __func__, ent->t268.buf_type); +diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c +index ee5081ba5313..1fc87a3260cc 100644 +--- a/drivers/target/target_core_transport.c ++++ b/drivers/target/target_core_transport.c +@@ -316,6 +316,7 @@ void __transport_register_session( + { + const struct target_core_fabric_ops *tfo = se_tpg->se_tpg_tfo; + unsigned char buf[PR_REG_ISID_LEN]; ++ unsigned long flags; + + se_sess->se_tpg = se_tpg; + se_sess->fabric_sess_ptr = fabric_sess_ptr; +@@ -352,7 +353,7 @@ void __transport_register_session( + se_sess->sess_bin_isid = get_unaligned_be64(&buf[0]); + } + +- spin_lock_irq(&se_nacl->nacl_sess_lock); ++ spin_lock_irqsave(&se_nacl->nacl_sess_lock, flags); + /* + * The se_nacl->nacl_sess pointer will be set to the + * last active I_T Nexus for each struct se_node_acl. +@@ -361,7 +362,7 @@ void __transport_register_session( + + list_add_tail(&se_sess->sess_acl_list, + &se_nacl->acl_sess_list); +- spin_unlock_irq(&se_nacl->nacl_sess_lock); ++ spin_unlock_irqrestore(&se_nacl->nacl_sess_lock, flags); + } + list_add_tail(&se_sess->sess_list, &se_tpg->tpg_sess_list); + +diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c +index d8dc3d22051f..b8dc5efc606b 100644 +--- a/drivers/target/target_core_user.c ++++ b/drivers/target/target_core_user.c +@@ -1745,9 +1745,11 @@ static int tcmu_configure_device(struct se_device *dev) + + info = &udev->uio_info; + ++ mutex_lock(&udev->cmdr_lock); + udev->data_bitmap = kcalloc(BITS_TO_LONGS(udev->max_blocks), + sizeof(unsigned long), + GFP_KERNEL); ++ mutex_unlock(&udev->cmdr_lock); + if (!udev->data_bitmap) { + ret = -ENOMEM; + goto err_bitmap_alloc; +@@ -1957,7 +1959,7 @@ static match_table_t tokens = { + {Opt_hw_block_size, "hw_block_size=%u"}, + {Opt_hw_max_sectors, "hw_max_sectors=%u"}, + {Opt_nl_reply_supported, "nl_reply_supported=%d"}, +- {Opt_max_data_area_mb, "max_data_area_mb=%u"}, ++ {Opt_max_data_area_mb, "max_data_area_mb=%d"}, + {Opt_err, NULL} + }; + +@@ -1985,13 +1987,48 @@ static int tcmu_set_dev_attrib(substring_t *arg, u32 *dev_attrib) + return 0; + } + ++static int tcmu_set_max_blocks_param(struct tcmu_dev *udev, substring_t *arg) ++{ ++ int val, ret; ++ ++ ret = match_int(arg, &val); ++ if (ret < 0) { ++ pr_err("match_int() failed for max_data_area_mb=. Error %d.\n", ++ ret); ++ return ret; ++ } ++ ++ if (val <= 0) { ++ pr_err("Invalid max_data_area %d.\n", val); ++ return -EINVAL; ++ } ++ ++ mutex_lock(&udev->cmdr_lock); ++ if (udev->data_bitmap) { ++ pr_err("Cannot set max_data_area_mb after it has been enabled.\n"); ++ ret = -EINVAL; ++ goto unlock; ++ } ++ ++ udev->max_blocks = TCMU_MBS_TO_BLOCKS(val); ++ if (udev->max_blocks > tcmu_global_max_blocks) { ++ pr_err("%d is too large. Adjusting max_data_area_mb to global limit of %u\n", ++ val, TCMU_BLOCKS_TO_MBS(tcmu_global_max_blocks)); ++ udev->max_blocks = tcmu_global_max_blocks; ++ } ++ ++unlock: ++ mutex_unlock(&udev->cmdr_lock); ++ return ret; ++} ++ + static ssize_t tcmu_set_configfs_dev_params(struct se_device *dev, + const char *page, ssize_t count) + { + struct tcmu_dev *udev = TCMU_DEV(dev); + char *orig, *ptr, *opts, *arg_p; + substring_t args[MAX_OPT_ARGS]; +- int ret = 0, token, tmpval; ++ int ret = 0, token; + + opts = kstrdup(page, GFP_KERNEL); + if (!opts) +@@ -2044,37 +2081,7 @@ static ssize_t tcmu_set_configfs_dev_params(struct se_device *dev, + pr_err("kstrtoint() failed for nl_reply_supported=\n"); + break; + case Opt_max_data_area_mb: +- if (dev->export_count) { +- pr_err("Unable to set max_data_area_mb while exports exist\n"); +- ret = -EINVAL; +- break; +- } +- +- arg_p = match_strdup(&args[0]); +- if (!arg_p) { +- ret = -ENOMEM; +- break; +- } +- ret = kstrtoint(arg_p, 0, &tmpval); +- kfree(arg_p); +- if (ret < 0) { +- pr_err("kstrtoint() failed for max_data_area_mb=\n"); +- break; +- } +- +- if (tmpval <= 0) { +- pr_err("Invalid max_data_area %d\n", tmpval); +- ret = -EINVAL; +- break; +- } +- +- udev->max_blocks = TCMU_MBS_TO_BLOCKS(tmpval); +- if (udev->max_blocks > tcmu_global_max_blocks) { +- pr_err("%d is too large. Adjusting max_data_area_mb to global limit of %u\n", +- tmpval, +- TCMU_BLOCKS_TO_MBS(tcmu_global_max_blocks)); +- udev->max_blocks = tcmu_global_max_blocks; +- } ++ ret = tcmu_set_max_blocks_param(udev, &args[0]); + break; + default: + break; +diff --git a/drivers/thermal/rcar_thermal.c b/drivers/thermal/rcar_thermal.c +index 45fb284d4c11..e77e63070e99 100644 +--- a/drivers/thermal/rcar_thermal.c ++++ b/drivers/thermal/rcar_thermal.c +@@ -598,7 +598,7 @@ static int rcar_thermal_probe(struct platform_device *pdev) + enr_bits |= 3 << (i * 8); + } + +- if (enr_bits) ++ if (common->base && enr_bits) + rcar_thermal_common_write(common, ENR, enr_bits); + + dev_info(dev, "%d sensor probed\n", i); +diff --git a/drivers/thermal/thermal_hwmon.c b/drivers/thermal/thermal_hwmon.c +index 11278836ed12..0bd47007c57f 100644 +--- a/drivers/thermal/thermal_hwmon.c ++++ b/drivers/thermal/thermal_hwmon.c +@@ -142,6 +142,7 @@ int thermal_add_hwmon_sysfs(struct thermal_zone_device *tz) + + INIT_LIST_HEAD(&hwmon->tz_list); + strlcpy(hwmon->type, tz->type, THERMAL_NAME_LENGTH); ++ strreplace(hwmon->type, '-', '_'); + hwmon->device = hwmon_device_register_with_info(NULL, hwmon->type, + hwmon, NULL, NULL); + if (IS_ERR(hwmon->device)) { +diff --git a/drivers/tty/rocket.c b/drivers/tty/rocket.c +index bdd17d2aaafd..b121d8f8f3d7 100644 +--- a/drivers/tty/rocket.c ++++ b/drivers/tty/rocket.c +@@ -1881,7 +1881,7 @@ static __init int register_PCI(int i, struct pci_dev *dev) + ByteIO_t UPCIRingInd = 0; + + if (!dev || !pci_match_id(rocket_pci_ids, dev) || +- pci_enable_device(dev)) ++ pci_enable_device(dev) || i >= NUM_BOARDS) + return 0; + + rcktpt_io_addr[i] = pci_resource_start(dev, 0); +diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c +index f68c1121fa7c..6c58ad1abd7e 100644 +--- a/drivers/uio/uio.c ++++ b/drivers/uio/uio.c +@@ -622,6 +622,12 @@ static ssize_t uio_write(struct file *filep, const char __user *buf, + ssize_t retval; + s32 irq_on; + ++ if (count != sizeof(s32)) ++ return -EINVAL; ++ ++ if (copy_from_user(&irq_on, buf, count)) ++ return -EFAULT; ++ + mutex_lock(&idev->info_lock); + if (!idev->info) { + retval = -EINVAL; +@@ -633,21 +639,11 @@ static ssize_t uio_write(struct file *filep, const char __user *buf, + goto out; + } + +- if (count != sizeof(s32)) { +- retval = -EINVAL; +- goto out; +- } +- + if (!idev->info->irqcontrol) { + retval = -ENOSYS; + goto out; + } + +- if (copy_from_user(&irq_on, buf, count)) { +- retval = -EFAULT; +- goto out; +- } +- + retval = idev->info->irqcontrol(idev->info, irq_on); + + out: +@@ -955,8 +951,6 @@ int __uio_register_device(struct module *owner, + if (ret) + goto err_uio_dev_add_attributes; + +- info->uio_dev = idev; +- + if (info->irq && (info->irq != UIO_IRQ_CUSTOM)) { + /* + * Note that we deliberately don't use devm_request_irq +@@ -972,6 +966,7 @@ int __uio_register_device(struct module *owner, + goto err_request_irq; + } + ++ info->uio_dev = idev; + return 0; + + err_request_irq: +diff --git a/fs/autofs/autofs_i.h b/fs/autofs/autofs_i.h +index 9400a9f6318a..5057b9f0f846 100644 +--- a/fs/autofs/autofs_i.h ++++ b/fs/autofs/autofs_i.h +@@ -26,6 +26,7 @@ + #include <linux/list.h> + #include <linux/completion.h> + #include <linux/file.h> ++#include <linux/magic.h> + + /* This is the range of ioctl() numbers we claim as ours */ + #define AUTOFS_IOC_FIRST AUTOFS_IOC_READY +@@ -124,7 +125,8 @@ struct autofs_sb_info { + + static inline struct autofs_sb_info *autofs_sbi(struct super_block *sb) + { +- return (struct autofs_sb_info *)(sb->s_fs_info); ++ return sb->s_magic != AUTOFS_SUPER_MAGIC ? ++ NULL : (struct autofs_sb_info *)(sb->s_fs_info); + } + + static inline struct autofs_info *autofs_dentry_ino(struct dentry *dentry) +diff --git a/fs/autofs/inode.c b/fs/autofs/inode.c +index b51980fc274e..846c052569dd 100644 +--- a/fs/autofs/inode.c ++++ b/fs/autofs/inode.c +@@ -10,7 +10,6 @@ + #include <linux/seq_file.h> + #include <linux/pagemap.h> + #include <linux/parser.h> +-#include <linux/magic.h> + + #include "autofs_i.h" + +diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c +index 53cac20650d8..4ab0bccfa281 100644 +--- a/fs/btrfs/extent-tree.c ++++ b/fs/btrfs/extent-tree.c +@@ -5935,7 +5935,7 @@ void btrfs_trans_release_chunk_metadata(struct btrfs_trans_handle *trans) + * root: the root of the parent directory + * rsv: block reservation + * items: the number of items that we need do reservation +- * qgroup_reserved: used to return the reserved size in qgroup ++ * use_global_rsv: allow fallback to the global block reservation + * + * This function is used to reserve the space for snapshot/subvolume + * creation and deletion. Those operations are different with the +@@ -5945,10 +5945,10 @@ void btrfs_trans_release_chunk_metadata(struct btrfs_trans_handle *trans) + * the space reservation mechanism in start_transaction(). + */ + int btrfs_subvolume_reserve_metadata(struct btrfs_root *root, +- struct btrfs_block_rsv *rsv, +- int items, ++ struct btrfs_block_rsv *rsv, int items, + bool use_global_rsv) + { ++ u64 qgroup_num_bytes = 0; + u64 num_bytes; + int ret; + struct btrfs_fs_info *fs_info = root->fs_info; +@@ -5956,12 +5956,11 @@ int btrfs_subvolume_reserve_metadata(struct btrfs_root *root, + + if (test_bit(BTRFS_FS_QUOTA_ENABLED, &fs_info->flags)) { + /* One for parent inode, two for dir entries */ +- num_bytes = 3 * fs_info->nodesize; +- ret = btrfs_qgroup_reserve_meta_prealloc(root, num_bytes, true); ++ qgroup_num_bytes = 3 * fs_info->nodesize; ++ ret = btrfs_qgroup_reserve_meta_prealloc(root, ++ qgroup_num_bytes, true); + if (ret) + return ret; +- } else { +- num_bytes = 0; + } + + num_bytes = btrfs_calc_trans_metadata_size(fs_info, items); +@@ -5973,8 +5972,8 @@ int btrfs_subvolume_reserve_metadata(struct btrfs_root *root, + if (ret == -ENOSPC && use_global_rsv) + ret = btrfs_block_rsv_migrate(global_rsv, rsv, num_bytes, 1); + +- if (ret && num_bytes) +- btrfs_qgroup_free_meta_prealloc(root, num_bytes); ++ if (ret && qgroup_num_bytes) ++ btrfs_qgroup_free_meta_prealloc(root, qgroup_num_bytes); + + return ret; + } +diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c +index b077544b5232..f3d6be0c657b 100644 +--- a/fs/btrfs/ioctl.c ++++ b/fs/btrfs/ioctl.c +@@ -3463,6 +3463,25 @@ static int btrfs_extent_same_range(struct inode *src, u64 loff, u64 olen, + + same_lock_start = min_t(u64, loff, dst_loff); + same_lock_len = max_t(u64, loff, dst_loff) + len - same_lock_start; ++ } else { ++ /* ++ * If the source and destination inodes are different, the ++ * source's range end offset matches the source's i_size, that ++ * i_size is not a multiple of the sector size, and the ++ * destination range does not go past the destination's i_size, ++ * we must round down the length to the nearest sector size ++ * multiple. If we don't do this adjustment we end replacing ++ * with zeroes the bytes in the range that starts at the ++ * deduplication range's end offset and ends at the next sector ++ * size multiple. ++ */ ++ if (loff + olen == i_size_read(src) && ++ dst_loff + len < i_size_read(dst)) { ++ const u64 sz = BTRFS_I(src)->root->fs_info->sectorsize; ++ ++ len = round_down(i_size_read(src), sz) - loff; ++ olen = len; ++ } + } + + again: +diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c +index 9d02563b2147..44043f809a3c 100644 +--- a/fs/cifs/connect.c ++++ b/fs/cifs/connect.c +@@ -2523,7 +2523,7 @@ cifs_setup_ipc(struct cifs_ses *ses, struct smb_vol *volume_info) + if (tcon == NULL) + return -ENOMEM; + +- snprintf(unc, sizeof(unc), "\\\\%s\\IPC$", ses->serverName); ++ snprintf(unc, sizeof(unc), "\\\\%s\\IPC$", ses->server->hostname); + + /* cannot fail */ + nls_codepage = load_nls_default(); +diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c +index 9051b9dfd590..d279fa5472db 100644 +--- a/fs/cifs/inode.c ++++ b/fs/cifs/inode.c +@@ -469,6 +469,8 @@ cifs_sfu_type(struct cifs_fattr *fattr, const char *path, + oparms.cifs_sb = cifs_sb; + oparms.desired_access = GENERIC_READ; + oparms.create_options = CREATE_NOT_DIR; ++ if (backup_cred(cifs_sb)) ++ oparms.create_options |= CREATE_OPEN_BACKUP_INTENT; + oparms.disposition = FILE_OPEN; + oparms.path = path; + oparms.fid = &fid; +diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c +index ee6c4a952ce9..5ecbc99f46e4 100644 +--- a/fs/cifs/smb2ops.c ++++ b/fs/cifs/smb2ops.c +@@ -626,7 +626,10 @@ smb2_is_path_accessible(const unsigned int xid, struct cifs_tcon *tcon, + oparms.tcon = tcon; + oparms.desired_access = FILE_READ_ATTRIBUTES; + oparms.disposition = FILE_OPEN; +- oparms.create_options = 0; ++ if (backup_cred(cifs_sb)) ++ oparms.create_options = CREATE_OPEN_BACKUP_INTENT; ++ else ++ oparms.create_options = 0; + oparms.fid = &fid; + oparms.reconnect = false; + +@@ -775,7 +778,10 @@ smb2_query_eas(const unsigned int xid, struct cifs_tcon *tcon, + oparms.tcon = tcon; + oparms.desired_access = FILE_READ_EA; + oparms.disposition = FILE_OPEN; +- oparms.create_options = 0; ++ if (backup_cred(cifs_sb)) ++ oparms.create_options = CREATE_OPEN_BACKUP_INTENT; ++ else ++ oparms.create_options = 0; + oparms.fid = &fid; + oparms.reconnect = false; + +@@ -854,7 +860,10 @@ smb2_set_ea(const unsigned int xid, struct cifs_tcon *tcon, + oparms.tcon = tcon; + oparms.desired_access = FILE_WRITE_EA; + oparms.disposition = FILE_OPEN; +- oparms.create_options = 0; ++ if (backup_cred(cifs_sb)) ++ oparms.create_options = CREATE_OPEN_BACKUP_INTENT; ++ else ++ oparms.create_options = 0; + oparms.fid = &fid; + oparms.reconnect = false; + +@@ -1460,7 +1469,10 @@ smb2_query_dir_first(const unsigned int xid, struct cifs_tcon *tcon, + oparms.tcon = tcon; + oparms.desired_access = FILE_READ_ATTRIBUTES | FILE_READ_DATA; + oparms.disposition = FILE_OPEN; +- oparms.create_options = 0; ++ if (backup_cred(cifs_sb)) ++ oparms.create_options = CREATE_OPEN_BACKUP_INTENT; ++ else ++ oparms.create_options = 0; + oparms.fid = fid; + oparms.reconnect = false; + +@@ -1735,7 +1747,10 @@ smb2_query_symlink(const unsigned int xid, struct cifs_tcon *tcon, + oparms.tcon = tcon; + oparms.desired_access = FILE_READ_ATTRIBUTES; + oparms.disposition = FILE_OPEN; +- oparms.create_options = 0; ++ if (backup_cred(cifs_sb)) ++ oparms.create_options = CREATE_OPEN_BACKUP_INTENT; ++ else ++ oparms.create_options = 0; + oparms.fid = &fid; + oparms.reconnect = false; + +@@ -3463,7 +3478,7 @@ struct smb_version_values smb21_values = { + struct smb_version_values smb3any_values = { + .version_string = SMB3ANY_VERSION_STRING, + .protocol_id = SMB302_PROT_ID, /* doesn't matter, send protocol array */ +- .req_capabilities = SMB2_GLOBAL_CAP_DFS | SMB2_GLOBAL_CAP_LEASING | SMB2_GLOBAL_CAP_LARGE_MTU | SMB2_GLOBAL_CAP_PERSISTENT_HANDLES | SMB2_GLOBAL_CAP_ENCRYPTION, ++ .req_capabilities = SMB2_GLOBAL_CAP_DFS | SMB2_GLOBAL_CAP_LEASING | SMB2_GLOBAL_CAP_LARGE_MTU | SMB2_GLOBAL_CAP_PERSISTENT_HANDLES | SMB2_GLOBAL_CAP_ENCRYPTION | SMB2_GLOBAL_CAP_DIRECTORY_LEASING, + .large_lock_type = 0, + .exclusive_lock_type = SMB2_LOCKFLAG_EXCLUSIVE_LOCK, + .shared_lock_type = SMB2_LOCKFLAG_SHARED_LOCK, +@@ -3484,7 +3499,7 @@ struct smb_version_values smb3any_values = { + struct smb_version_values smbdefault_values = { + .version_string = SMBDEFAULT_VERSION_STRING, + .protocol_id = SMB302_PROT_ID, /* doesn't matter, send protocol array */ +- .req_capabilities = SMB2_GLOBAL_CAP_DFS | SMB2_GLOBAL_CAP_LEASING | SMB2_GLOBAL_CAP_LARGE_MTU | SMB2_GLOBAL_CAP_PERSISTENT_HANDLES | SMB2_GLOBAL_CAP_ENCRYPTION, ++ .req_capabilities = SMB2_GLOBAL_CAP_DFS | SMB2_GLOBAL_CAP_LEASING | SMB2_GLOBAL_CAP_LARGE_MTU | SMB2_GLOBAL_CAP_PERSISTENT_HANDLES | SMB2_GLOBAL_CAP_ENCRYPTION | SMB2_GLOBAL_CAP_DIRECTORY_LEASING, + .large_lock_type = 0, + .exclusive_lock_type = SMB2_LOCKFLAG_EXCLUSIVE_LOCK, + .shared_lock_type = SMB2_LOCKFLAG_SHARED_LOCK, +@@ -3505,7 +3520,7 @@ struct smb_version_values smbdefault_values = { + struct smb_version_values smb30_values = { + .version_string = SMB30_VERSION_STRING, + .protocol_id = SMB30_PROT_ID, +- .req_capabilities = SMB2_GLOBAL_CAP_DFS | SMB2_GLOBAL_CAP_LEASING | SMB2_GLOBAL_CAP_LARGE_MTU | SMB2_GLOBAL_CAP_PERSISTENT_HANDLES | SMB2_GLOBAL_CAP_ENCRYPTION, ++ .req_capabilities = SMB2_GLOBAL_CAP_DFS | SMB2_GLOBAL_CAP_LEASING | SMB2_GLOBAL_CAP_LARGE_MTU | SMB2_GLOBAL_CAP_PERSISTENT_HANDLES | SMB2_GLOBAL_CAP_ENCRYPTION | SMB2_GLOBAL_CAP_DIRECTORY_LEASING, + .large_lock_type = 0, + .exclusive_lock_type = SMB2_LOCKFLAG_EXCLUSIVE_LOCK, + .shared_lock_type = SMB2_LOCKFLAG_SHARED_LOCK, +@@ -3526,7 +3541,7 @@ struct smb_version_values smb30_values = { + struct smb_version_values smb302_values = { + .version_string = SMB302_VERSION_STRING, + .protocol_id = SMB302_PROT_ID, +- .req_capabilities = SMB2_GLOBAL_CAP_DFS | SMB2_GLOBAL_CAP_LEASING | SMB2_GLOBAL_CAP_LARGE_MTU | SMB2_GLOBAL_CAP_PERSISTENT_HANDLES | SMB2_GLOBAL_CAP_ENCRYPTION, ++ .req_capabilities = SMB2_GLOBAL_CAP_DFS | SMB2_GLOBAL_CAP_LEASING | SMB2_GLOBAL_CAP_LARGE_MTU | SMB2_GLOBAL_CAP_PERSISTENT_HANDLES | SMB2_GLOBAL_CAP_ENCRYPTION | SMB2_GLOBAL_CAP_DIRECTORY_LEASING, + .large_lock_type = 0, + .exclusive_lock_type = SMB2_LOCKFLAG_EXCLUSIVE_LOCK, + .shared_lock_type = SMB2_LOCKFLAG_SHARED_LOCK, +@@ -3548,7 +3563,7 @@ struct smb_version_values smb302_values = { + struct smb_version_values smb311_values = { + .version_string = SMB311_VERSION_STRING, + .protocol_id = SMB311_PROT_ID, +- .req_capabilities = SMB2_GLOBAL_CAP_DFS | SMB2_GLOBAL_CAP_LEASING | SMB2_GLOBAL_CAP_LARGE_MTU | SMB2_GLOBAL_CAP_PERSISTENT_HANDLES | SMB2_GLOBAL_CAP_ENCRYPTION, ++ .req_capabilities = SMB2_GLOBAL_CAP_DFS | SMB2_GLOBAL_CAP_LEASING | SMB2_GLOBAL_CAP_LARGE_MTU | SMB2_GLOBAL_CAP_PERSISTENT_HANDLES | SMB2_GLOBAL_CAP_ENCRYPTION | SMB2_GLOBAL_CAP_DIRECTORY_LEASING, + .large_lock_type = 0, + .exclusive_lock_type = SMB2_LOCKFLAG_EXCLUSIVE_LOCK, + .shared_lock_type = SMB2_LOCKFLAG_SHARED_LOCK, +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index 44e511a35559..82be1dfeca33 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -2179,6 +2179,9 @@ SMB2_open(const unsigned int xid, struct cifs_open_parms *oparms, __le16 *path, + if (!(server->capabilities & SMB2_GLOBAL_CAP_LEASING) || + *oplock == SMB2_OPLOCK_LEVEL_NONE) + req->RequestedOplockLevel = *oplock; ++ else if (!(server->capabilities & SMB2_GLOBAL_CAP_DIRECTORY_LEASING) && ++ (oparms->create_options & CREATE_NOT_FILE)) ++ req->RequestedOplockLevel = *oplock; /* no srv lease support */ + else { + rc = add_lease_context(server, iov, &n_iov, + oparms->fid->lease_key, oplock); +diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h +index 4d8b1de83143..b6f2dc8163e1 100644 +--- a/fs/f2fs/f2fs.h ++++ b/fs/f2fs/f2fs.h +@@ -1680,18 +1680,20 @@ static inline int inc_valid_block_count(struct f2fs_sb_info *sbi, + sbi->total_valid_block_count -= diff; + if (!*count) { + spin_unlock(&sbi->stat_lock); +- percpu_counter_sub(&sbi->alloc_valid_block_count, diff); + goto enospc; + } + } + spin_unlock(&sbi->stat_lock); + +- if (unlikely(release)) ++ if (unlikely(release)) { ++ percpu_counter_sub(&sbi->alloc_valid_block_count, release); + dquot_release_reservation_block(inode, release); ++ } + f2fs_i_blocks_write(inode, *count, true, true); + return 0; + + enospc: ++ percpu_counter_sub(&sbi->alloc_valid_block_count, release); + dquot_release_reservation_block(inode, release); + return -ENOSPC; + } +@@ -1954,8 +1956,13 @@ static inline struct page *f2fs_grab_cache_page(struct address_space *mapping, + pgoff_t index, bool for_write) + { + #ifdef CONFIG_F2FS_FAULT_INJECTION +- struct page *page = find_lock_page(mapping, index); ++ struct page *page; + ++ if (!for_write) ++ page = find_get_page_flags(mapping, index, ++ FGP_LOCK | FGP_ACCESSED); ++ else ++ page = find_lock_page(mapping, index); + if (page) + return page; + +@@ -2812,7 +2819,7 @@ int f2fs_fsync_node_pages(struct f2fs_sb_info *sbi, struct inode *inode, + int f2fs_sync_node_pages(struct f2fs_sb_info *sbi, + struct writeback_control *wbc, + bool do_balance, enum iostat_type io_type); +-void f2fs_build_free_nids(struct f2fs_sb_info *sbi, bool sync, bool mount); ++int f2fs_build_free_nids(struct f2fs_sb_info *sbi, bool sync, bool mount); + bool f2fs_alloc_nid(struct f2fs_sb_info *sbi, nid_t *nid); + void f2fs_alloc_nid_done(struct f2fs_sb_info *sbi, nid_t nid); + void f2fs_alloc_nid_failed(struct f2fs_sb_info *sbi, nid_t nid); +diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c +index 3ffa341cf586..4c9f9bcbd2d9 100644 +--- a/fs/f2fs/file.c ++++ b/fs/f2fs/file.c +@@ -1882,7 +1882,7 @@ static int f2fs_ioc_shutdown(struct file *filp, unsigned long arg) + struct f2fs_sb_info *sbi = F2FS_I_SB(inode); + struct super_block *sb = sbi->sb; + __u32 in; +- int ret; ++ int ret = 0; + + if (!capable(CAP_SYS_ADMIN)) + return -EPERM; +diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c +index 9093be6e7a7d..37ab2d10a872 100644 +--- a/fs/f2fs/gc.c ++++ b/fs/f2fs/gc.c +@@ -986,7 +986,13 @@ static int do_garbage_collect(struct f2fs_sb_info *sbi, + goto next; + + sum = page_address(sum_page); +- f2fs_bug_on(sbi, type != GET_SUM_TYPE((&sum->footer))); ++ if (type != GET_SUM_TYPE((&sum->footer))) { ++ f2fs_msg(sbi->sb, KERN_ERR, "Inconsistent segment (%u) " ++ "type [%d, %d] in SSA and SIT", ++ segno, type, GET_SUM_TYPE((&sum->footer))); ++ set_sbi_flag(sbi, SBI_NEED_FSCK); ++ goto next; ++ } + + /* + * this is to avoid deadlock: +diff --git a/fs/f2fs/inline.c b/fs/f2fs/inline.c +index 043830be5662..2bcb2d36f024 100644 +--- a/fs/f2fs/inline.c ++++ b/fs/f2fs/inline.c +@@ -130,6 +130,16 @@ int f2fs_convert_inline_page(struct dnode_of_data *dn, struct page *page) + if (err) + return err; + ++ if (unlikely(dn->data_blkaddr != NEW_ADDR)) { ++ f2fs_put_dnode(dn); ++ set_sbi_flag(fio.sbi, SBI_NEED_FSCK); ++ f2fs_msg(fio.sbi->sb, KERN_WARNING, ++ "%s: corrupted inline inode ino=%lx, i_addr[0]:0x%x, " ++ "run fsck to fix.", ++ __func__, dn->inode->i_ino, dn->data_blkaddr); ++ return -EINVAL; ++ } ++ + f2fs_bug_on(F2FS_P_SB(page), PageWriteback(page)); + + f2fs_do_read_inline_data(page, dn->inode_page); +@@ -363,6 +373,17 @@ static int f2fs_move_inline_dirents(struct inode *dir, struct page *ipage, + if (err) + goto out; + ++ if (unlikely(dn.data_blkaddr != NEW_ADDR)) { ++ f2fs_put_dnode(&dn); ++ set_sbi_flag(F2FS_P_SB(page), SBI_NEED_FSCK); ++ f2fs_msg(F2FS_P_SB(page)->sb, KERN_WARNING, ++ "%s: corrupted inline inode ino=%lx, i_addr[0]:0x%x, " ++ "run fsck to fix.", ++ __func__, dir->i_ino, dn.data_blkaddr); ++ err = -EINVAL; ++ goto out; ++ } ++ + f2fs_wait_on_page_writeback(page, DATA, true); + + dentry_blk = page_address(page); +@@ -477,6 +498,7 @@ static int f2fs_move_rehashed_dirents(struct inode *dir, struct page *ipage, + return 0; + recover: + lock_page(ipage); ++ f2fs_wait_on_page_writeback(ipage, NODE, true); + memcpy(inline_dentry, backup_dentry, MAX_INLINE_DATA(dir)); + f2fs_i_depth_write(dir, 0); + f2fs_i_size_write(dir, MAX_INLINE_DATA(dir)); +diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c +index f121c864f4c0..cf0f944fcaea 100644 +--- a/fs/f2fs/inode.c ++++ b/fs/f2fs/inode.c +@@ -197,6 +197,16 @@ static bool sanity_check_inode(struct inode *inode) + __func__, inode->i_ino); + return false; + } ++ ++ if (f2fs_has_extra_attr(inode) && ++ !f2fs_sb_has_extra_attr(sbi->sb)) { ++ set_sbi_flag(sbi, SBI_NEED_FSCK); ++ f2fs_msg(sbi->sb, KERN_WARNING, ++ "%s: inode (ino=%lx) is with extra_attr, " ++ "but extra_attr feature is off", ++ __func__, inode->i_ino); ++ return false; ++ } + return true; + } + +@@ -249,6 +259,11 @@ static int do_read_inode(struct inode *inode) + + get_inline_info(inode, ri); + ++ if (!sanity_check_inode(inode)) { ++ f2fs_put_page(node_page, 1); ++ return -EINVAL; ++ } ++ + fi->i_extra_isize = f2fs_has_extra_attr(inode) ? + le16_to_cpu(ri->i_extra_isize) : 0; + +@@ -330,10 +345,6 @@ struct inode *f2fs_iget(struct super_block *sb, unsigned long ino) + ret = do_read_inode(inode); + if (ret) + goto bad_inode; +- if (!sanity_check_inode(inode)) { +- ret = -EINVAL; +- goto bad_inode; +- } + make_now: + if (ino == F2FS_NODE_INO(sbi)) { + inode->i_mapping->a_ops = &f2fs_node_aops; +diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c +index 10643b11bd59..52ed02b0327c 100644 +--- a/fs/f2fs/node.c ++++ b/fs/f2fs/node.c +@@ -1633,7 +1633,9 @@ next_step: + !is_cold_node(page))) + continue; + lock_node: +- if (!trylock_page(page)) ++ if (wbc->sync_mode == WB_SYNC_ALL) ++ lock_page(page); ++ else if (!trylock_page(page)) + continue; + + if (unlikely(page->mapping != NODE_MAPPING(sbi))) { +@@ -1968,7 +1970,7 @@ static void remove_free_nid(struct f2fs_sb_info *sbi, nid_t nid) + kmem_cache_free(free_nid_slab, i); + } + +-static void scan_nat_page(struct f2fs_sb_info *sbi, ++static int scan_nat_page(struct f2fs_sb_info *sbi, + struct page *nat_page, nid_t start_nid) + { + struct f2fs_nm_info *nm_i = NM_I(sbi); +@@ -1986,7 +1988,10 @@ static void scan_nat_page(struct f2fs_sb_info *sbi, + break; + + blk_addr = le32_to_cpu(nat_blk->entries[i].block_addr); +- f2fs_bug_on(sbi, blk_addr == NEW_ADDR); ++ ++ if (blk_addr == NEW_ADDR) ++ return -EINVAL; ++ + if (blk_addr == NULL_ADDR) { + add_free_nid(sbi, start_nid, true, true); + } else { +@@ -1995,6 +2000,8 @@ static void scan_nat_page(struct f2fs_sb_info *sbi, + spin_unlock(&NM_I(sbi)->nid_list_lock); + } + } ++ ++ return 0; + } + + static void scan_curseg_cache(struct f2fs_sb_info *sbi) +@@ -2050,11 +2057,11 @@ out: + up_read(&nm_i->nat_tree_lock); + } + +-static void __f2fs_build_free_nids(struct f2fs_sb_info *sbi, ++static int __f2fs_build_free_nids(struct f2fs_sb_info *sbi, + bool sync, bool mount) + { + struct f2fs_nm_info *nm_i = NM_I(sbi); +- int i = 0; ++ int i = 0, ret; + nid_t nid = nm_i->next_scan_nid; + + if (unlikely(nid >= nm_i->max_nid)) +@@ -2062,17 +2069,17 @@ static void __f2fs_build_free_nids(struct f2fs_sb_info *sbi, + + /* Enough entries */ + if (nm_i->nid_cnt[FREE_NID] >= NAT_ENTRY_PER_BLOCK) +- return; ++ return 0; + + if (!sync && !f2fs_available_free_memory(sbi, FREE_NIDS)) +- return; ++ return 0; + + if (!mount) { + /* try to find free nids in free_nid_bitmap */ + scan_free_nid_bits(sbi); + + if (nm_i->nid_cnt[FREE_NID] >= NAT_ENTRY_PER_BLOCK) +- return; ++ return 0; + } + + /* readahead nat pages to be scanned */ +@@ -2086,8 +2093,16 @@ static void __f2fs_build_free_nids(struct f2fs_sb_info *sbi, + nm_i->nat_block_bitmap)) { + struct page *page = get_current_nat_page(sbi, nid); + +- scan_nat_page(sbi, page, nid); ++ ret = scan_nat_page(sbi, page, nid); + f2fs_put_page(page, 1); ++ ++ if (ret) { ++ up_read(&nm_i->nat_tree_lock); ++ f2fs_bug_on(sbi, !mount); ++ f2fs_msg(sbi->sb, KERN_ERR, ++ "NAT is corrupt, run fsck to fix it"); ++ return -EINVAL; ++ } + } + + nid += (NAT_ENTRY_PER_BLOCK - (nid % NAT_ENTRY_PER_BLOCK)); +@@ -2108,13 +2123,19 @@ static void __f2fs_build_free_nids(struct f2fs_sb_info *sbi, + + f2fs_ra_meta_pages(sbi, NAT_BLOCK_OFFSET(nm_i->next_scan_nid), + nm_i->ra_nid_pages, META_NAT, false); ++ ++ return 0; + } + +-void f2fs_build_free_nids(struct f2fs_sb_info *sbi, bool sync, bool mount) ++int f2fs_build_free_nids(struct f2fs_sb_info *sbi, bool sync, bool mount) + { ++ int ret; ++ + mutex_lock(&NM_I(sbi)->build_lock); +- __f2fs_build_free_nids(sbi, sync, mount); ++ ret = __f2fs_build_free_nids(sbi, sync, mount); + mutex_unlock(&NM_I(sbi)->build_lock); ++ ++ return ret; + } + + /* +@@ -2801,8 +2822,7 @@ int f2fs_build_node_manager(struct f2fs_sb_info *sbi) + /* load free nid status from nat_bits table */ + load_free_nid_bitmap(sbi); + +- f2fs_build_free_nids(sbi, true, true); +- return 0; ++ return f2fs_build_free_nids(sbi, true, true); + } + + void f2fs_destroy_node_manager(struct f2fs_sb_info *sbi) +diff --git a/fs/f2fs/recovery.c b/fs/f2fs/recovery.c +index 38f25f0b193a..ad70e62c5da4 100644 +--- a/fs/f2fs/recovery.c ++++ b/fs/f2fs/recovery.c +@@ -241,8 +241,8 @@ static int find_fsync_dnodes(struct f2fs_sb_info *sbi, struct list_head *head, + struct page *page = NULL; + block_t blkaddr; + unsigned int loop_cnt = 0; +- unsigned int free_blocks = sbi->user_block_count - +- valid_user_blocks(sbi); ++ unsigned int free_blocks = MAIN_SEGS(sbi) * sbi->blocks_per_seg - ++ valid_user_blocks(sbi); + int err = 0; + + /* get node pages in the current segment */ +diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c +index 9efce174c51a..43fecd5eb252 100644 +--- a/fs/f2fs/segment.c ++++ b/fs/f2fs/segment.c +@@ -1643,21 +1643,30 @@ void f2fs_clear_prefree_segments(struct f2fs_sb_info *sbi, + unsigned int start = 0, end = -1; + unsigned int secno, start_segno; + bool force = (cpc->reason & CP_DISCARD); ++ bool need_align = test_opt(sbi, LFS) && sbi->segs_per_sec > 1; + + mutex_lock(&dirty_i->seglist_lock); + + while (1) { + int i; ++ ++ if (need_align && end != -1) ++ end--; + start = find_next_bit(prefree_map, MAIN_SEGS(sbi), end + 1); + if (start >= MAIN_SEGS(sbi)) + break; + end = find_next_zero_bit(prefree_map, MAIN_SEGS(sbi), + start + 1); + +- for (i = start; i < end; i++) +- clear_bit(i, prefree_map); ++ if (need_align) { ++ start = rounddown(start, sbi->segs_per_sec); ++ end = roundup(end, sbi->segs_per_sec); ++ } + +- dirty_i->nr_dirty[PRE] -= end - start; ++ for (i = start; i < end; i++) { ++ if (test_and_clear_bit(i, prefree_map)) ++ dirty_i->nr_dirty[PRE]--; ++ } + + if (!test_opt(sbi, DISCARD)) + continue; +@@ -2437,6 +2446,7 @@ int f2fs_trim_fs(struct f2fs_sb_info *sbi, struct fstrim_range *range) + struct discard_policy dpolicy; + unsigned long long trimmed = 0; + int err = 0; ++ bool need_align = test_opt(sbi, LFS) && sbi->segs_per_sec > 1; + + if (start >= MAX_BLKADDR(sbi) || range->len < sbi->blocksize) + return -EINVAL; +@@ -2454,6 +2464,10 @@ int f2fs_trim_fs(struct f2fs_sb_info *sbi, struct fstrim_range *range) + start_segno = (start <= MAIN_BLKADDR(sbi)) ? 0 : GET_SEGNO(sbi, start); + end_segno = (end >= MAX_BLKADDR(sbi)) ? MAIN_SEGS(sbi) - 1 : + GET_SEGNO(sbi, end); ++ if (need_align) { ++ start_segno = rounddown(start_segno, sbi->segs_per_sec); ++ end_segno = roundup(end_segno + 1, sbi->segs_per_sec) - 1; ++ } + + cpc.reason = CP_DISCARD; + cpc.trim_minlen = max_t(__u64, 1, F2FS_BYTES_TO_BLK(range->minlen)); +diff --git a/fs/f2fs/segment.h b/fs/f2fs/segment.h +index f18fc82fbe99..38c549d77a80 100644 +--- a/fs/f2fs/segment.h ++++ b/fs/f2fs/segment.h +@@ -448,6 +448,8 @@ static inline void __set_test_and_free(struct f2fs_sb_info *sbi, + if (test_and_clear_bit(segno, free_i->free_segmap)) { + free_i->free_segments++; + ++ if (IS_CURSEC(sbi, secno)) ++ goto skip_free; + next = find_next_bit(free_i->free_segmap, + start_segno + sbi->segs_per_sec, start_segno); + if (next >= start_segno + sbi->segs_per_sec) { +@@ -455,6 +457,7 @@ static inline void __set_test_and_free(struct f2fs_sb_info *sbi, + free_i->free_sections++; + } + } ++skip_free: + spin_unlock(&free_i->segmap_lock); + } + +diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c +index 3995e926ba3a..128d489acebb 100644 +--- a/fs/f2fs/super.c ++++ b/fs/f2fs/super.c +@@ -2229,9 +2229,9 @@ static int sanity_check_raw_super(struct f2fs_sb_info *sbi, + return 1; + } + +- if (secs_per_zone > total_sections) { ++ if (secs_per_zone > total_sections || !secs_per_zone) { + f2fs_msg(sb, KERN_INFO, +- "Wrong secs_per_zone (%u > %u)", ++ "Wrong secs_per_zone / total_sections (%u, %u)", + secs_per_zone, total_sections); + return 1; + } +@@ -2282,12 +2282,17 @@ int f2fs_sanity_check_ckpt(struct f2fs_sb_info *sbi) + struct f2fs_checkpoint *ckpt = F2FS_CKPT(sbi); + unsigned int ovp_segments, reserved_segments; + unsigned int main_segs, blocks_per_seg; ++ unsigned int sit_segs, nat_segs; ++ unsigned int sit_bitmap_size, nat_bitmap_size; ++ unsigned int log_blocks_per_seg; + int i; + + total = le32_to_cpu(raw_super->segment_count); + fsmeta = le32_to_cpu(raw_super->segment_count_ckpt); +- fsmeta += le32_to_cpu(raw_super->segment_count_sit); +- fsmeta += le32_to_cpu(raw_super->segment_count_nat); ++ sit_segs = le32_to_cpu(raw_super->segment_count_sit); ++ fsmeta += sit_segs; ++ nat_segs = le32_to_cpu(raw_super->segment_count_nat); ++ fsmeta += nat_segs; + fsmeta += le32_to_cpu(ckpt->rsvd_segment_count); + fsmeta += le32_to_cpu(raw_super->segment_count_ssa); + +@@ -2318,6 +2323,18 @@ int f2fs_sanity_check_ckpt(struct f2fs_sb_info *sbi) + return 1; + } + ++ sit_bitmap_size = le32_to_cpu(ckpt->sit_ver_bitmap_bytesize); ++ nat_bitmap_size = le32_to_cpu(ckpt->nat_ver_bitmap_bytesize); ++ log_blocks_per_seg = le32_to_cpu(raw_super->log_blocks_per_seg); ++ ++ if (sit_bitmap_size != ((sit_segs / 2) << log_blocks_per_seg) / 8 || ++ nat_bitmap_size != ((nat_segs / 2) << log_blocks_per_seg) / 8) { ++ f2fs_msg(sbi->sb, KERN_ERR, ++ "Wrong bitmap size: sit: %u, nat:%u", ++ sit_bitmap_size, nat_bitmap_size); ++ return 1; ++ } ++ + if (unlikely(f2fs_cp_error(sbi))) { + f2fs_msg(sbi->sb, KERN_ERR, "A bug case: need to run fsck"); + return 1; +diff --git a/fs/f2fs/sysfs.c b/fs/f2fs/sysfs.c +index 2e7e611deaef..bca1236fd6fa 100644 +--- a/fs/f2fs/sysfs.c ++++ b/fs/f2fs/sysfs.c +@@ -9,6 +9,7 @@ + * it under the terms of the GNU General Public License version 2 as + * published by the Free Software Foundation. + */ ++#include <linux/compiler.h> + #include <linux/proc_fs.h> + #include <linux/f2fs_fs.h> + #include <linux/seq_file.h> +@@ -286,8 +287,10 @@ static ssize_t f2fs_sbi_store(struct f2fs_attr *a, + bool gc_entry = (!strcmp(a->attr.name, "gc_urgent") || + a->struct_type == GC_THREAD); + +- if (gc_entry) +- down_read(&sbi->sb->s_umount); ++ if (gc_entry) { ++ if (!down_read_trylock(&sbi->sb->s_umount)) ++ return -EAGAIN; ++ } + ret = __sbi_store(a, sbi, buf, count); + if (gc_entry) + up_read(&sbi->sb->s_umount); +@@ -516,7 +519,8 @@ static struct kobject f2fs_feat = { + .kset = &f2fs_kset, + }; + +-static int segment_info_seq_show(struct seq_file *seq, void *offset) ++static int __maybe_unused segment_info_seq_show(struct seq_file *seq, ++ void *offset) + { + struct super_block *sb = seq->private; + struct f2fs_sb_info *sbi = F2FS_SB(sb); +@@ -543,7 +547,8 @@ static int segment_info_seq_show(struct seq_file *seq, void *offset) + return 0; + } + +-static int segment_bits_seq_show(struct seq_file *seq, void *offset) ++static int __maybe_unused segment_bits_seq_show(struct seq_file *seq, ++ void *offset) + { + struct super_block *sb = seq->private; + struct f2fs_sb_info *sbi = F2FS_SB(sb); +@@ -567,7 +572,8 @@ static int segment_bits_seq_show(struct seq_file *seq, void *offset) + return 0; + } + +-static int iostat_info_seq_show(struct seq_file *seq, void *offset) ++static int __maybe_unused iostat_info_seq_show(struct seq_file *seq, ++ void *offset) + { + struct super_block *sb = seq->private; + struct f2fs_sb_info *sbi = F2FS_SB(sb); +diff --git a/fs/nfs/callback_proc.c b/fs/nfs/callback_proc.c +index 5d57e818d0c3..6d049dfddb14 100644 +--- a/fs/nfs/callback_proc.c ++++ b/fs/nfs/callback_proc.c +@@ -215,9 +215,9 @@ static u32 pnfs_check_callback_stateid(struct pnfs_layout_hdr *lo, + { + u32 oldseq, newseq; + +- /* Is the stateid still not initialised? */ ++ /* Is the stateid not initialised? */ + if (!pnfs_layout_is_valid(lo)) +- return NFS4ERR_DELAY; ++ return NFS4ERR_NOMATCHING_LAYOUT; + + /* Mismatched stateid? */ + if (!nfs4_stateid_match_other(&lo->plh_stateid, new)) +diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c +index a813979b5be0..cb905c0e606c 100644 +--- a/fs/nfs/callback_xdr.c ++++ b/fs/nfs/callback_xdr.c +@@ -883,16 +883,21 @@ static __be32 nfs4_callback_compound(struct svc_rqst *rqstp) + + if (hdr_arg.minorversion == 0) { + cps.clp = nfs4_find_client_ident(SVC_NET(rqstp), hdr_arg.cb_ident); +- if (!cps.clp || !check_gss_callback_principal(cps.clp, rqstp)) ++ if (!cps.clp || !check_gss_callback_principal(cps.clp, rqstp)) { ++ if (cps.clp) ++ nfs_put_client(cps.clp); + goto out_invalidcred; ++ } + } + + cps.minorversion = hdr_arg.minorversion; + hdr_res.taglen = hdr_arg.taglen; + hdr_res.tag = hdr_arg.tag; +- if (encode_compound_hdr_res(&xdr_out, &hdr_res) != 0) ++ if (encode_compound_hdr_res(&xdr_out, &hdr_res) != 0) { ++ if (cps.clp) ++ nfs_put_client(cps.clp); + return rpc_system_err; +- ++ } + while (status == 0 && nops != hdr_arg.nops) { + status = process_op(nops, rqstp, &xdr_in, + rqstp->rq_argp, &xdr_out, rqstp->rq_resp, +diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c +index 979631411a0e..d7124fb12041 100644 +--- a/fs/nfs/nfs4client.c ++++ b/fs/nfs/nfs4client.c +@@ -1127,7 +1127,7 @@ struct nfs_server *nfs4_create_referral_server(struct nfs_clone_mount *data, + nfs_server_copy_userdata(server, parent_server); + + /* Get a client representation */ +-#ifdef CONFIG_SUNRPC_XPRT_RDMA ++#if IS_ENABLED(CONFIG_SUNRPC_XPRT_RDMA) + rpc_set_port(data->addr, NFS_RDMA_PORT); + error = nfs4_set_client(server, data->hostname, + data->addr, +@@ -1139,7 +1139,7 @@ struct nfs_server *nfs4_create_referral_server(struct nfs_clone_mount *data, + parent_client->cl_net); + if (!error) + goto init_server; +-#endif /* CONFIG_SUNRPC_XPRT_RDMA */ ++#endif /* IS_ENABLED(CONFIG_SUNRPC_XPRT_RDMA) */ + + rpc_set_port(data->addr, NFS_PORT); + error = nfs4_set_client(server, data->hostname, +@@ -1153,7 +1153,7 @@ struct nfs_server *nfs4_create_referral_server(struct nfs_clone_mount *data, + if (error < 0) + goto error; + +-#ifdef CONFIG_SUNRPC_XPRT_RDMA ++#if IS_ENABLED(CONFIG_SUNRPC_XPRT_RDMA) + init_server: + #endif + error = nfs_init_server_rpcclient(server, parent_server->client->cl_timeout, data->authflavor); +diff --git a/include/linux/hid.h b/include/linux/hid.h +index 773bcb1d4044..5482dd6ae9ef 100644 +--- a/include/linux/hid.h ++++ b/include/linux/hid.h +@@ -520,6 +520,7 @@ struct hid_input { + const char *name; + bool registered; + struct list_head reports; /* the list of reports */ ++ unsigned int application; /* application usage for this input */ + }; + + enum hid_type { +diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h +index 22651e124071..a590419e46c5 100644 +--- a/include/linux/mm_types.h ++++ b/include/linux/mm_types.h +@@ -340,7 +340,7 @@ struct kioctx_table; + struct mm_struct { + struct vm_area_struct *mmap; /* list of VMAs */ + struct rb_root mm_rb; +- u32 vmacache_seqnum; /* per-thread vmacache */ ++ u64 vmacache_seqnum; /* per-thread vmacache */ + #ifdef CONFIG_MMU + unsigned long (*get_unmapped_area) (struct file *filp, + unsigned long addr, unsigned long len, +diff --git a/include/linux/mm_types_task.h b/include/linux/mm_types_task.h +index 5fe87687664c..d7016dcb245e 100644 +--- a/include/linux/mm_types_task.h ++++ b/include/linux/mm_types_task.h +@@ -32,7 +32,7 @@ + #define VMACACHE_MASK (VMACACHE_SIZE - 1) + + struct vmacache { +- u32 seqnum; ++ u64 seqnum; + struct vm_area_struct *vmas[VMACACHE_SIZE]; + }; + +diff --git a/include/linux/mtd/rawnand.h b/include/linux/mtd/rawnand.h +index 3e8ec3b8a39c..87c635d6c773 100644 +--- a/include/linux/mtd/rawnand.h ++++ b/include/linux/mtd/rawnand.h +@@ -986,14 +986,14 @@ struct nand_subop { + unsigned int last_instr_end_off; + }; + +-int nand_subop_get_addr_start_off(const struct nand_subop *subop, +- unsigned int op_id); +-int nand_subop_get_num_addr_cyc(const struct nand_subop *subop, +- unsigned int op_id); +-int nand_subop_get_data_start_off(const struct nand_subop *subop, +- unsigned int op_id); +-int nand_subop_get_data_len(const struct nand_subop *subop, +- unsigned int op_id); ++unsigned int nand_subop_get_addr_start_off(const struct nand_subop *subop, ++ unsigned int op_id); ++unsigned int nand_subop_get_num_addr_cyc(const struct nand_subop *subop, ++ unsigned int op_id); ++unsigned int nand_subop_get_data_start_off(const struct nand_subop *subop, ++ unsigned int op_id); ++unsigned int nand_subop_get_data_len(const struct nand_subop *subop, ++ unsigned int op_id); + + /** + * struct nand_op_parser_addr_constraints - Constraints for address instructions +diff --git a/include/linux/vm_event_item.h b/include/linux/vm_event_item.h +index 5c7f010676a7..47a3441cf4c4 100644 +--- a/include/linux/vm_event_item.h ++++ b/include/linux/vm_event_item.h +@@ -105,7 +105,6 @@ enum vm_event_item { PGPGIN, PGPGOUT, PSWPIN, PSWPOUT, + #ifdef CONFIG_DEBUG_VM_VMACACHE + VMACACHE_FIND_CALLS, + VMACACHE_FIND_HITS, +- VMACACHE_FULL_FLUSHES, + #endif + #ifdef CONFIG_SWAP + SWAP_RA, +diff --git a/include/linux/vmacache.h b/include/linux/vmacache.h +index a5b3aa8d281f..a09b28f76460 100644 +--- a/include/linux/vmacache.h ++++ b/include/linux/vmacache.h +@@ -16,7 +16,6 @@ static inline void vmacache_flush(struct task_struct *tsk) + memset(tsk->vmacache.vmas, 0, sizeof(tsk->vmacache.vmas)); + } + +-extern void vmacache_flush_all(struct mm_struct *mm); + extern void vmacache_update(unsigned long addr, struct vm_area_struct *newvma); + extern struct vm_area_struct *vmacache_find(struct mm_struct *mm, + unsigned long addr); +@@ -30,10 +29,6 @@ extern struct vm_area_struct *vmacache_find_exact(struct mm_struct *mm, + static inline void vmacache_invalidate(struct mm_struct *mm) + { + mm->vmacache_seqnum++; +- +- /* deal with overflows */ +- if (unlikely(mm->vmacache_seqnum == 0)) +- vmacache_flush_all(mm); + } + + #endif /* __LINUX_VMACACHE_H */ +diff --git a/include/uapi/linux/ethtool.h b/include/uapi/linux/ethtool.h +index 7363f18e65a5..813282cc8af6 100644 +--- a/include/uapi/linux/ethtool.h ++++ b/include/uapi/linux/ethtool.h +@@ -902,13 +902,13 @@ struct ethtool_rx_flow_spec { + static inline __u64 ethtool_get_flow_spec_ring(__u64 ring_cookie) + { + return ETHTOOL_RX_FLOW_SPEC_RING & ring_cookie; +-}; ++} + + static inline __u64 ethtool_get_flow_spec_ring_vf(__u64 ring_cookie) + { + return (ETHTOOL_RX_FLOW_SPEC_RING_VF & ring_cookie) >> + ETHTOOL_RX_FLOW_SPEC_RING_VF_OFF; +-}; ++} + + /** + * struct ethtool_rxnfc - command to get or set RX flow classification rules +diff --git a/kernel/cpu.c b/kernel/cpu.c +index f80afc674f02..517907b082df 100644 +--- a/kernel/cpu.c ++++ b/kernel/cpu.c +@@ -608,15 +608,15 @@ static void cpuhp_thread_fun(unsigned int cpu) + bool bringup = st->bringup; + enum cpuhp_state state; + ++ if (WARN_ON_ONCE(!st->should_run)) ++ return; ++ + /* + * ACQUIRE for the cpuhp_should_run() load of ->should_run. Ensures + * that if we see ->should_run we also see the rest of the state. + */ + smp_mb(); + +- if (WARN_ON_ONCE(!st->should_run)) +- return; +- + cpuhp_lock_acquire(bringup); + + if (st->single) { +@@ -928,7 +928,8 @@ static int cpuhp_down_callbacks(unsigned int cpu, struct cpuhp_cpu_state *st, + ret = cpuhp_invoke_callback(cpu, st->state, false, NULL, NULL); + if (ret) { + st->target = prev_state; +- undo_cpu_down(cpu, st); ++ if (st->state < prev_state) ++ undo_cpu_down(cpu, st); + break; + } + } +@@ -981,7 +982,7 @@ static int __ref _cpu_down(unsigned int cpu, int tasks_frozen, + * to do the further cleanups. + */ + ret = cpuhp_down_callbacks(cpu, st, target); +- if (ret && st->state > CPUHP_TEARDOWN_CPU && st->state < prev_state) { ++ if (ret && st->state == CPUHP_TEARDOWN_CPU && st->state < prev_state) { + cpuhp_reset_state(st, prev_state); + __cpuhp_kick_ap(st); + } +diff --git a/kernel/time/clocksource.c b/kernel/time/clocksource.c +index f89a78e2792b..443941aa784e 100644 +--- a/kernel/time/clocksource.c ++++ b/kernel/time/clocksource.c +@@ -129,19 +129,40 @@ static void inline clocksource_watchdog_unlock(unsigned long *flags) + spin_unlock_irqrestore(&watchdog_lock, *flags); + } + ++static int clocksource_watchdog_kthread(void *data); ++static void __clocksource_change_rating(struct clocksource *cs, int rating); ++ + /* + * Interval: 0.5sec Threshold: 0.0625s + */ + #define WATCHDOG_INTERVAL (HZ >> 1) + #define WATCHDOG_THRESHOLD (NSEC_PER_SEC >> 4) + ++static void clocksource_watchdog_work(struct work_struct *work) ++{ ++ /* ++ * We cannot directly run clocksource_watchdog_kthread() here, because ++ * clocksource_select() calls timekeeping_notify() which uses ++ * stop_machine(). One cannot use stop_machine() from a workqueue() due ++ * lock inversions wrt CPU hotplug. ++ * ++ * Also, we only ever run this work once or twice during the lifetime ++ * of the kernel, so there is no point in creating a more permanent ++ * kthread for this. ++ * ++ * If kthread_run fails the next watchdog scan over the ++ * watchdog_list will find the unstable clock again. ++ */ ++ kthread_run(clocksource_watchdog_kthread, NULL, "kwatchdog"); ++} ++ + static void __clocksource_unstable(struct clocksource *cs) + { + cs->flags &= ~(CLOCK_SOURCE_VALID_FOR_HRES | CLOCK_SOURCE_WATCHDOG); + cs->flags |= CLOCK_SOURCE_UNSTABLE; + + /* +- * If the clocksource is registered clocksource_watchdog_work() will ++ * If the clocksource is registered clocksource_watchdog_kthread() will + * re-rate and re-select. + */ + if (list_empty(&cs->list)) { +@@ -152,7 +173,7 @@ static void __clocksource_unstable(struct clocksource *cs) + if (cs->mark_unstable) + cs->mark_unstable(cs); + +- /* kick clocksource_watchdog_work() */ ++ /* kick clocksource_watchdog_kthread() */ + if (finished_booting) + schedule_work(&watchdog_work); + } +@@ -162,7 +183,7 @@ static void __clocksource_unstable(struct clocksource *cs) + * @cs: clocksource to be marked unstable + * + * This function is called by the x86 TSC code to mark clocksources as unstable; +- * it defers demotion and re-selection to a work. ++ * it defers demotion and re-selection to a kthread. + */ + void clocksource_mark_unstable(struct clocksource *cs) + { +@@ -387,9 +408,7 @@ static void clocksource_dequeue_watchdog(struct clocksource *cs) + } + } + +-static void __clocksource_change_rating(struct clocksource *cs, int rating); +- +-static int __clocksource_watchdog_work(void) ++static int __clocksource_watchdog_kthread(void) + { + struct clocksource *cs, *tmp; + unsigned long flags; +@@ -414,12 +433,13 @@ static int __clocksource_watchdog_work(void) + return select; + } + +-static void clocksource_watchdog_work(struct work_struct *work) ++static int clocksource_watchdog_kthread(void *data) + { + mutex_lock(&clocksource_mutex); +- if (__clocksource_watchdog_work()) ++ if (__clocksource_watchdog_kthread()) + clocksource_select(); + mutex_unlock(&clocksource_mutex); ++ return 0; + } + + static bool clocksource_is_watchdog(struct clocksource *cs) +@@ -438,7 +458,7 @@ static void clocksource_enqueue_watchdog(struct clocksource *cs) + static void clocksource_select_watchdog(bool fallback) { } + static inline void clocksource_dequeue_watchdog(struct clocksource *cs) { } + static inline void clocksource_resume_watchdog(void) { } +-static inline int __clocksource_watchdog_work(void) { return 0; } ++static inline int __clocksource_watchdog_kthread(void) { return 0; } + static bool clocksource_is_watchdog(struct clocksource *cs) { return false; } + void clocksource_mark_unstable(struct clocksource *cs) { } + +@@ -672,7 +692,7 @@ static int __init clocksource_done_booting(void) + /* + * Run the watchdog first to eliminate unstable clock sources + */ +- __clocksource_watchdog_work(); ++ __clocksource_watchdog_kthread(); + clocksource_select(); + mutex_unlock(&clocksource_mutex); + return 0; +diff --git a/kernel/time/timer.c b/kernel/time/timer.c +index cc2d23e6ff61..786f8c014e7e 100644 +--- a/kernel/time/timer.c ++++ b/kernel/time/timer.c +@@ -1657,6 +1657,22 @@ static inline void __run_timers(struct timer_base *base) + + raw_spin_lock_irq(&base->lock); + ++ /* ++ * timer_base::must_forward_clk must be cleared before running ++ * timers so that any timer functions that call mod_timer() will ++ * not try to forward the base. Idle tracking / clock forwarding ++ * logic is only used with BASE_STD timers. ++ * ++ * The must_forward_clk flag is cleared unconditionally also for ++ * the deferrable base. The deferrable base is not affected by idle ++ * tracking and never forwarded, so clearing the flag is a NOOP. ++ * ++ * The fact that the deferrable base is never forwarded can cause ++ * large variations in granularity for deferrable timers, but they ++ * can be deferred for long periods due to idle anyway. ++ */ ++ base->must_forward_clk = false; ++ + while (time_after_eq(jiffies, base->clk)) { + + levels = collect_expired_timers(base, heads); +@@ -1676,19 +1692,6 @@ static __latent_entropy void run_timer_softirq(struct softirq_action *h) + { + struct timer_base *base = this_cpu_ptr(&timer_bases[BASE_STD]); + +- /* +- * must_forward_clk must be cleared before running timers so that any +- * timer functions that call mod_timer will not try to forward the +- * base. idle trcking / clock forwarding logic is only used with +- * BASE_STD timers. +- * +- * The deferrable base does not do idle tracking at all, so we do +- * not forward it. This can result in very large variations in +- * granularity for deferrable timers, but they can be deferred for +- * long periods due to idle. +- */ +- base->must_forward_clk = false; +- + __run_timers(base); + if (IS_ENABLED(CONFIG_NO_HZ_COMMON)) + __run_timers(this_cpu_ptr(&timer_bases[BASE_DEF])); +diff --git a/mm/debug.c b/mm/debug.c +index 38c926520c97..bd10aad8539a 100644 +--- a/mm/debug.c ++++ b/mm/debug.c +@@ -114,7 +114,7 @@ EXPORT_SYMBOL(dump_vma); + + void dump_mm(const struct mm_struct *mm) + { +- pr_emerg("mm %px mmap %px seqnum %d task_size %lu\n" ++ pr_emerg("mm %px mmap %px seqnum %llu task_size %lu\n" + #ifdef CONFIG_MMU + "get_unmapped_area %px\n" + #endif +@@ -142,7 +142,7 @@ void dump_mm(const struct mm_struct *mm) + "tlb_flush_pending %d\n" + "def_flags: %#lx(%pGv)\n", + +- mm, mm->mmap, mm->vmacache_seqnum, mm->task_size, ++ mm, mm->mmap, (long long) mm->vmacache_seqnum, mm->task_size, + #ifdef CONFIG_MMU + mm->get_unmapped_area, + #endif +diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c +index 7deb49f69e27..785252397e35 100644 +--- a/mm/memory_hotplug.c ++++ b/mm/memory_hotplug.c +@@ -1341,7 +1341,8 @@ static unsigned long scan_movable_pages(unsigned long start, unsigned long end) + if (__PageMovable(page)) + return pfn; + if (PageHuge(page)) { +- if (page_huge_active(page)) ++ if (hugepage_migration_supported(page_hstate(page)) && ++ page_huge_active(page)) + return pfn; + else + pfn = round_up(pfn + 1, +diff --git a/mm/page_alloc.c b/mm/page_alloc.c +index 3222193c46c6..65f2e6481c99 100644 +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -7649,6 +7649,10 @@ bool has_unmovable_pages(struct zone *zone, struct page *page, int count, + * handle each tail page individually in migration. + */ + if (PageHuge(page)) { ++ ++ if (!hugepage_migration_supported(page_hstate(page))) ++ goto unmovable; ++ + iter = round_up(iter + 1, 1<<compound_order(page)) - 1; + continue; + } +diff --git a/mm/vmacache.c b/mm/vmacache.c +index db7596eb6132..f1729617dc85 100644 +--- a/mm/vmacache.c ++++ b/mm/vmacache.c +@@ -7,44 +7,6 @@ + #include <linux/mm.h> + #include <linux/vmacache.h> + +-/* +- * Flush vma caches for threads that share a given mm. +- * +- * The operation is safe because the caller holds the mmap_sem +- * exclusively and other threads accessing the vma cache will +- * have mmap_sem held at least for read, so no extra locking +- * is required to maintain the vma cache. +- */ +-void vmacache_flush_all(struct mm_struct *mm) +-{ +- struct task_struct *g, *p; +- +- count_vm_vmacache_event(VMACACHE_FULL_FLUSHES); +- +- /* +- * Single threaded tasks need not iterate the entire +- * list of process. We can avoid the flushing as well +- * since the mm's seqnum was increased and don't have +- * to worry about other threads' seqnum. Current's +- * flush will occur upon the next lookup. +- */ +- if (atomic_read(&mm->mm_users) == 1) +- return; +- +- rcu_read_lock(); +- for_each_process_thread(g, p) { +- /* +- * Only flush the vmacache pointers as the +- * mm seqnum is already set and curr's will +- * be set upon invalidation when the next +- * lookup is done. +- */ +- if (mm == p->mm) +- vmacache_flush(p); +- } +- rcu_read_unlock(); +-} +- + /* + * This task may be accessing a foreign mm via (for example) + * get_user_pages()->find_vma(). The vmacache is task-local and this +diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c +index 3bba8f4b08a9..253975cce943 100644 +--- a/net/bluetooth/hidp/core.c ++++ b/net/bluetooth/hidp/core.c +@@ -775,7 +775,7 @@ static int hidp_setup_hid(struct hidp_session *session, + hid->version = req->version; + hid->country = req->country; + +- strncpy(hid->name, req->name, sizeof(req->name) - 1); ++ strncpy(hid->name, req->name, sizeof(hid->name)); + + snprintf(hid->phys, sizeof(hid->phys), "%pMR", + &l2cap_pi(session->ctrl_sock->sk)->chan->src); +diff --git a/net/dcb/dcbnl.c b/net/dcb/dcbnl.c +index 2589a6b78aa1..013fdb6fa07a 100644 +--- a/net/dcb/dcbnl.c ++++ b/net/dcb/dcbnl.c +@@ -1786,7 +1786,7 @@ static struct dcb_app_type *dcb_app_lookup(const struct dcb_app *app, + if (itr->app.selector == app->selector && + itr->app.protocol == app->protocol && + itr->ifindex == ifindex && +- (!prio || itr->app.priority == prio)) ++ ((prio == -1) || itr->app.priority == prio)) + return itr; + } + +@@ -1821,7 +1821,8 @@ u8 dcb_getapp(struct net_device *dev, struct dcb_app *app) + u8 prio = 0; + + spin_lock_bh(&dcb_lock); +- if ((itr = dcb_app_lookup(app, dev->ifindex, 0))) ++ itr = dcb_app_lookup(app, dev->ifindex, -1); ++ if (itr) + prio = itr->app.priority; + spin_unlock_bh(&dcb_lock); + +@@ -1849,7 +1850,8 @@ int dcb_setapp(struct net_device *dev, struct dcb_app *new) + + spin_lock_bh(&dcb_lock); + /* Search for existing match and replace */ +- if ((itr = dcb_app_lookup(new, dev->ifindex, 0))) { ++ itr = dcb_app_lookup(new, dev->ifindex, -1); ++ if (itr) { + if (new->priority) + itr->app.priority = new->priority; + else { +@@ -1882,7 +1884,8 @@ u8 dcb_ieee_getapp_mask(struct net_device *dev, struct dcb_app *app) + u8 prio = 0; + + spin_lock_bh(&dcb_lock); +- if ((itr = dcb_app_lookup(app, dev->ifindex, 0))) ++ itr = dcb_app_lookup(app, dev->ifindex, -1); ++ if (itr) + prio |= 1 << itr->app.priority; + spin_unlock_bh(&dcb_lock); + +diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c +index 932985ca4e66..3f80a5ca4050 100644 +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -1612,6 +1612,7 @@ ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx) + */ + if (!ieee80211_hw_check(&sta->local->hw, AP_LINK_PS) && + !ieee80211_has_morefrags(hdr->frame_control) && ++ !is_multicast_ether_addr(hdr->addr1) && + (ieee80211_is_mgmt(hdr->frame_control) || + ieee80211_is_data(hdr->frame_control)) && + !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) && +diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c +index 20a171ac4bb2..16849969c138 100644 +--- a/sound/pci/hda/hda_codec.c ++++ b/sound/pci/hda/hda_codec.c +@@ -3910,7 +3910,8 @@ void snd_hda_bus_reset_codecs(struct hda_bus *bus) + + list_for_each_codec(codec, bus) { + /* FIXME: maybe a better way needed for forced reset */ +- cancel_delayed_work_sync(&codec->jackpoll_work); ++ if (current_work() != &codec->jackpoll_work.work) ++ cancel_delayed_work_sync(&codec->jackpoll_work); + #ifdef CONFIG_PM + if (hda_codec_is_power_on(codec)) { + hda_call_codec_suspend(codec); +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index f6af3e1c2b93..d14b05f68d6d 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -6530,6 +6530,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x103c, 0x827e, "HP x360", ALC295_FIXUP_HP_X360), + SND_PCI_QUIRK(0x103c, 0x82bf, "HP", ALC221_FIXUP_HP_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x103c, 0x82c0, "HP", ALC221_FIXUP_HP_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x103c, 0x83b9, "HP Spectre x360", ALC269_FIXUP_HP_MUTE_LED_MIC3), + SND_PCI_QUIRK(0x1043, 0x103e, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC), + SND_PCI_QUIRK(0x1043, 0x103f, "ASUS TX300", ALC282_FIXUP_ASUS_TX300), + SND_PCI_QUIRK(0x1043, 0x106d, "Asus K53BE", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), +diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c +index 5feae9666822..55d6c9488d8e 100644 +--- a/sound/soc/soc-pcm.c ++++ b/sound/soc/soc-pcm.c +@@ -1165,6 +1165,9 @@ static snd_pcm_uframes_t soc_pcm_pointer(struct snd_pcm_substream *substream) + snd_pcm_sframes_t codec_delay = 0; + int i; + ++ /* clearing the previous total delay */ ++ runtime->delay = 0; ++ + for_each_rtdcom(rtd, rtdcom) { + component = rtdcom->component; + +@@ -1176,6 +1179,8 @@ static snd_pcm_uframes_t soc_pcm_pointer(struct snd_pcm_substream *substream) + offset = component->driver->ops->pointer(substream); + break; + } ++ /* base delay if assigned in pointer callback */ ++ delay = runtime->delay; + + if (cpu_dai->driver->ops->delay) + delay += cpu_dai->driver->ops->delay(substream, cpu_dai); +diff --git a/tools/perf/Makefile.config b/tools/perf/Makefile.config +index f5a3b402589e..67b042738ed7 100644 +--- a/tools/perf/Makefile.config ++++ b/tools/perf/Makefile.config +@@ -905,8 +905,8 @@ bindir = $(abspath $(prefix)/$(bindir_relative)) + mandir = share/man + infodir = share/info + perfexecdir = libexec/perf-core +-perf_include_dir = lib/include/perf +-perf_examples_dir = lib/examples/perf ++perf_include_dir = lib/perf/include ++perf_examples_dir = lib/perf/examples + sharedir = $(prefix)/share + template_dir = share/perf-core/templates + STRACE_GROUPS_DIR = share/perf-core/strace/groups +diff --git a/tools/perf/builtin-c2c.c b/tools/perf/builtin-c2c.c +index 6a8738f7ead3..eab66e3b0a19 100644 +--- a/tools/perf/builtin-c2c.c ++++ b/tools/perf/builtin-c2c.c +@@ -2349,6 +2349,9 @@ static int perf_c2c__browse_cacheline(struct hist_entry *he) + " s Toggle full length of symbol and source line columns \n" + " q Return back to cacheline list \n"; + ++ if (!he) ++ return 0; ++ + /* Display compact version first. */ + c2c.symbol_full = false; + +diff --git a/tools/perf/perf.h b/tools/perf/perf.h +index d215714f48df..21bf7f5a3cf5 100644 +--- a/tools/perf/perf.h ++++ b/tools/perf/perf.h +@@ -25,7 +25,9 @@ static inline unsigned long long rdclock(void) + return ts.tv_sec * 1000000000ULL + ts.tv_nsec; + } + ++#ifndef MAX_NR_CPUS + #define MAX_NR_CPUS 1024 ++#endif + + extern const char *input_name; + extern bool perf_host, perf_guest; +diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c +index 94fce4f537e9..0d5504751cc5 100644 +--- a/tools/perf/util/evsel.c ++++ b/tools/perf/util/evsel.c +@@ -848,6 +848,12 @@ static void apply_config_terms(struct perf_evsel *evsel, + } + } + ++static bool is_dummy_event(struct perf_evsel *evsel) ++{ ++ return (evsel->attr.type == PERF_TYPE_SOFTWARE) && ++ (evsel->attr.config == PERF_COUNT_SW_DUMMY); ++} ++ + /* + * The enable_on_exec/disabled value strategy: + * +@@ -1086,6 +1092,14 @@ void perf_evsel__config(struct perf_evsel *evsel, struct record_opts *opts, + else + perf_evsel__reset_sample_bit(evsel, PERIOD); + } ++ ++ /* ++ * For initial_delay, a dummy event is added implicitly. ++ * The software event will trigger -EOPNOTSUPP error out, ++ * if BRANCH_STACK bit is set. ++ */ ++ if (opts->initial_delay && is_dummy_event(evsel)) ++ perf_evsel__reset_sample_bit(evsel, BRANCH_STACK); + } + + static int perf_evsel__alloc_fd(struct perf_evsel *evsel, int ncpus, int nthreads) +diff --git a/tools/testing/nvdimm/pmem-dax.c b/tools/testing/nvdimm/pmem-dax.c +index b53596ad601b..2e7fd8227969 100644 +--- a/tools/testing/nvdimm/pmem-dax.c ++++ b/tools/testing/nvdimm/pmem-dax.c +@@ -31,17 +31,21 @@ long __pmem_direct_access(struct pmem_device *pmem, pgoff_t pgoff, + if (get_nfit_res(pmem->phys_addr + offset)) { + struct page *page; + +- *kaddr = pmem->virt_addr + offset; ++ if (kaddr) ++ *kaddr = pmem->virt_addr + offset; + page = vmalloc_to_page(pmem->virt_addr + offset); +- *pfn = page_to_pfn_t(page); ++ if (pfn) ++ *pfn = page_to_pfn_t(page); + pr_debug_ratelimited("%s: pmem: %p pgoff: %#lx pfn: %#lx\n", + __func__, pmem, pgoff, page_to_pfn(page)); + + return 1; + } + +- *kaddr = pmem->virt_addr + offset; +- *pfn = phys_to_pfn_t(pmem->phys_addr + offset, pmem->pfn_flags); ++ if (kaddr) ++ *kaddr = pmem->virt_addr + offset; ++ if (pfn) ++ *pfn = phys_to_pfn_t(pmem->phys_addr + offset, pmem->pfn_flags); + + /* + * If badblocks are present, limit known good range to the +diff --git a/tools/testing/selftests/bpf/test_verifier.c b/tools/testing/selftests/bpf/test_verifier.c +index 41106d9d5cc7..f9c856c8e472 100644 +--- a/tools/testing/selftests/bpf/test_verifier.c ++++ b/tools/testing/selftests/bpf/test_verifier.c +@@ -6997,7 +6997,7 @@ static struct bpf_test tests[] = { + BPF_MOV64_REG(BPF_REG_1, BPF_REG_0), + BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, + BPF_FUNC_map_lookup_elem), +- BPF_MOV64_REG(BPF_REG_0, 0), ++ BPF_MOV64_IMM(BPF_REG_0, 0), + BPF_EXIT_INSN(), + }, + .fixup_map_in_map = { 3 }, +@@ -7020,7 +7020,7 @@ static struct bpf_test tests[] = { + BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), + BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, + BPF_FUNC_map_lookup_elem), +- BPF_MOV64_REG(BPF_REG_0, 0), ++ BPF_MOV64_IMM(BPF_REG_0, 0), + BPF_EXIT_INSN(), + }, + .fixup_map_in_map = { 3 }, +@@ -7042,7 +7042,7 @@ static struct bpf_test tests[] = { + BPF_MOV64_REG(BPF_REG_1, BPF_REG_0), + BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, + BPF_FUNC_map_lookup_elem), +- BPF_MOV64_REG(BPF_REG_0, 0), ++ BPF_MOV64_IMM(BPF_REG_0, 0), + BPF_EXIT_INSN(), + }, + .fixup_map_in_map = { 3 }, +diff --git a/tools/testing/selftests/tc-testing/tc-tests/actions/connmark.json b/tools/testing/selftests/tc-testing/tc-tests/actions/connmark.json +index 70952bd98ff9..13147a1f5731 100644 +--- a/tools/testing/selftests/tc-testing/tc-tests/actions/connmark.json ++++ b/tools/testing/selftests/tc-testing/tc-tests/actions/connmark.json +@@ -17,7 +17,7 @@ + "cmdUnderTest": "$TC actions add action connmark", + "expExitCode": "0", + "verifyCmd": "$TC actions list action connmark", +- "matchPattern": "action order [0-9]+: connmark zone 0 pipe", ++ "matchPattern": "action order [0-9]+: connmark zone 0 pipe", + "matchCount": "1", + "teardown": [ + "$TC actions flush action connmark" +@@ -41,7 +41,7 @@ + "cmdUnderTest": "$TC actions add action connmark pass index 1", + "expExitCode": "0", + "verifyCmd": "$TC actions get action connmark index 1", +- "matchPattern": "action order [0-9]+: connmark zone 0 pass.*index 1 ref", ++ "matchPattern": "action order [0-9]+: connmark zone 0 pass.*index 1 ref", + "matchCount": "1", + "teardown": [ + "$TC actions flush action connmark" +@@ -65,7 +65,7 @@ + "cmdUnderTest": "$TC actions add action connmark drop index 100", + "expExitCode": "0", + "verifyCmd": "$TC actions get action connmark index 100", +- "matchPattern": "action order [0-9]+: connmark zone 0 drop.*index 100 ref", ++ "matchPattern": "action order [0-9]+: connmark zone 0 drop.*index 100 ref", + "matchCount": "1", + "teardown": [ + "$TC actions flush action connmark" +@@ -89,7 +89,7 @@ + "cmdUnderTest": "$TC actions add action connmark pipe index 455", + "expExitCode": "0", + "verifyCmd": "$TC actions get action connmark index 455", +- "matchPattern": "action order [0-9]+: connmark zone 0 pipe.*index 455 ref", ++ "matchPattern": "action order [0-9]+: connmark zone 0 pipe.*index 455 ref", + "matchCount": "1", + "teardown": [ + "$TC actions flush action connmark" +@@ -113,7 +113,7 @@ + "cmdUnderTest": "$TC actions add action connmark reclassify index 7", + "expExitCode": "0", + "verifyCmd": "$TC actions list action connmark", +- "matchPattern": "action order [0-9]+: connmark zone 0 reclassify.*index 7 ref", ++ "matchPattern": "action order [0-9]+: connmark zone 0 reclassify.*index 7 ref", + "matchCount": "1", + "teardown": [ + "$TC actions flush action connmark" +@@ -137,7 +137,7 @@ + "cmdUnderTest": "$TC actions add action connmark continue index 17", + "expExitCode": "0", + "verifyCmd": "$TC actions list action connmark", +- "matchPattern": "action order [0-9]+: connmark zone 0 continue.*index 17 ref", ++ "matchPattern": "action order [0-9]+: connmark zone 0 continue.*index 17 ref", + "matchCount": "1", + "teardown": [ + "$TC actions flush action connmark" +@@ -161,7 +161,7 @@ + "cmdUnderTest": "$TC actions add action connmark jump 10 index 17", + "expExitCode": "0", + "verifyCmd": "$TC actions list action connmark", +- "matchPattern": "action order [0-9]+: connmark zone 0 jump 10.*index 17 ref", ++ "matchPattern": "action order [0-9]+: connmark zone 0 jump 10.*index 17 ref", + "matchCount": "1", + "teardown": [ + "$TC actions flush action connmark" +@@ -185,7 +185,7 @@ + "cmdUnderTest": "$TC actions add action connmark zone 100 pipe index 1", + "expExitCode": "0", + "verifyCmd": "$TC actions get action connmark index 1", +- "matchPattern": "action order [0-9]+: connmark zone 100 pipe.*index 1 ref", ++ "matchPattern": "action order [0-9]+: connmark zone 100 pipe.*index 1 ref", + "matchCount": "1", + "teardown": [ + "$TC actions flush action connmark" +@@ -209,7 +209,7 @@ + "cmdUnderTest": "$TC actions add action connmark zone 65536 reclassify index 21", + "expExitCode": "255", + "verifyCmd": "$TC actions get action connmark index 1", +- "matchPattern": "action order [0-9]+: connmark zone 65536 reclassify.*index 21 ref", ++ "matchPattern": "action order [0-9]+: connmark zone 65536 reclassify.*index 21 ref", + "matchCount": "0", + "teardown": [ + "$TC actions flush action connmark" +@@ -233,7 +233,7 @@ + "cmdUnderTest": "$TC actions add action connmark zone 655 unsupp_arg pass index 2", + "expExitCode": "255", + "verifyCmd": "$TC actions get action connmark index 2", +- "matchPattern": "action order [0-9]+: connmark zone 655 unsupp_arg pass.*index 2 ref", ++ "matchPattern": "action order [0-9]+: connmark zone 655 unsupp_arg pass.*index 2 ref", + "matchCount": "0", + "teardown": [ + "$TC actions flush action connmark" +@@ -258,7 +258,7 @@ + "cmdUnderTest": "$TC actions replace action connmark zone 555 reclassify index 555", + "expExitCode": "0", + "verifyCmd": "$TC actions get action connmark index 555", +- "matchPattern": "action order [0-9]+: connmark zone 555 reclassify.*index 555 ref", ++ "matchPattern": "action order [0-9]+: connmark zone 555 reclassify.*index 555 ref", + "matchCount": "1", + "teardown": [ + "$TC actions flush action connmark" +@@ -282,7 +282,7 @@ + "cmdUnderTest": "$TC actions add action connmark zone 555 pipe index 5 cookie aabbccddeeff112233445566778800a1", + "expExitCode": "0", + "verifyCmd": "$TC actions get action connmark index 5", +- "matchPattern": "action order [0-9]+: connmark zone 555 pipe.*index 5 ref.*cookie aabbccddeeff112233445566778800a1", ++ "matchPattern": "action order [0-9]+: connmark zone 555 pipe.*index 5 ref.*cookie aabbccddeeff112233445566778800a1", + "matchCount": "1", + "teardown": [ + "$TC actions flush action connmark" +diff --git a/tools/testing/selftests/tc-testing/tc-tests/actions/mirred.json b/tools/testing/selftests/tc-testing/tc-tests/actions/mirred.json +index 6e4edfae1799..db49fd0f8445 100644 +--- a/tools/testing/selftests/tc-testing/tc-tests/actions/mirred.json ++++ b/tools/testing/selftests/tc-testing/tc-tests/actions/mirred.json +@@ -44,7 +44,8 @@ + "matchPattern": "action order [0-9]*: mirred \\(Egress Redirect to device lo\\).*index 2 ref", + "matchCount": "1", + "teardown": [ +- "$TC actions flush action mirred" ++ "$TC actions flush action mirred", ++ "$TC actions flush action gact" + ] + }, + { +diff --git a/virt/kvm/arm/mmu.c b/virt/kvm/arm/mmu.c +index c2b95a22959b..fd8c88463928 100644 +--- a/virt/kvm/arm/mmu.c ++++ b/virt/kvm/arm/mmu.c +@@ -1831,13 +1831,20 @@ static int kvm_set_spte_handler(struct kvm *kvm, gpa_t gpa, u64 size, void *data + void kvm_set_spte_hva(struct kvm *kvm, unsigned long hva, pte_t pte) + { + unsigned long end = hva + PAGE_SIZE; ++ kvm_pfn_t pfn = pte_pfn(pte); + pte_t stage2_pte; + + if (!kvm->arch.pgd) + return; + + trace_kvm_set_spte_hva(hva); +- stage2_pte = pfn_pte(pte_pfn(pte), PAGE_S2); ++ ++ /* ++ * We've moved a page around, probably through CoW, so let's treat it ++ * just like a translation fault and clean the cache to the PoC. ++ */ ++ clean_dcache_guest_page(pfn, PAGE_SIZE); ++ stage2_pte = pfn_pte(pfn, PAGE_S2); + handle_hva_to_gpa(kvm, hva, end, &kvm_set_spte_handler, &stage2_pte); + } + |