commit: 296b65bf1d5e66edd9c5be7cb619e8550f4e18c3
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Apr 3 10:46:59 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Apr 3 10:46:59 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=296b65bf
Linux patch 4.4.178
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
1177_linux-4.4.178.patch | 3818 ++++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 3818 insertions(+)
diff --git a/1177_linux-4.4.178.patch b/1177_linux-4.4.178.patch
new file mode 100644
index 0000000..0cb5643
--- /dev/null
+++ b/1177_linux-4.4.178.patch
@@ -0,0 +1,3818 @@
+diff --git a/Documentation/virtual/kvm/api.txt
b/Documentation/virtual/kvm/api.txt
+index df8ab4fc240a..496673adcb6b 100644
+--- a/Documentation/virtual/kvm/api.txt
++++ b/Documentation/virtual/kvm/api.txt
+@@ -13,7 +13,7 @@ of a virtual machine. The ioctls belong to three classes
+
+ - VM ioctls: These query and set attributes that affect an entire virtual
+ machine, for example memory layout. In addition a VM ioctl is used to
+- create virtual cpus (vcpus).
++ create virtual cpus (vcpus) and devices.
+
+ Only run VM ioctls from the same process (address space) that was used
+ to create the VM.
+@@ -24,6 +24,11 @@ of a virtual machine. The ioctls belong to three classes
+ Only run vcpu ioctls from the same thread that was used to create the
+ vcpu.
+
++ - device ioctls: These query and set attributes that control the operation
++ of a single device.
++
++ device ioctls must be issued from the same process (address space) that
++ was used to create the VM.
+
+ 2. File descriptors
+ -------------------
+@@ -32,10 +37,11 @@ The kvm API is centered around file descriptors. An
initial
+ open("/dev/kvm") obtains a handle to the kvm subsystem; this handle
+ can be used to issue system ioctls. A KVM_CREATE_VM ioctl on this
+ handle will create a VM file descriptor which can be used to issue VM
+-ioctls. A KVM_CREATE_VCPU ioctl on a VM fd will create a virtual cpu
+-and return a file descriptor pointing to it. Finally, ioctls on a vcpu
+-fd can be used to control the vcpu, including the important task of
+-actually running guest code.
++ioctls. A KVM_CREATE_VCPU or KVM_CREATE_DEVICE ioctl on a VM fd will
++create a virtual cpu or device and return a file descriptor pointing to
++the new resource. Finally, ioctls on a vcpu or device fd can be used
++to control the vcpu or device. For vcpus, this includes the important
++task of actually running guest code.
+
+ In general file descriptors can be migrated among processes by means
+ of fork() and the SCM_RIGHTS facility of unix domain socket. These
+diff --git a/Makefile b/Makefile
+index 1de443248119..35be7983ef2d 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 4
+ PATCHLEVEL = 4
+-SUBLEVEL = 177
++SUBLEVEL = 178
+ EXTRAVERSION =
+ NAME = Blurry Fish Butt
+
+diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
+index 3a0277c6c060..737c8b0dda84 100644
+--- a/arch/arm/Kconfig
++++ b/arch/arm/Kconfig
+@@ -1422,8 +1422,7 @@ config BIG_LITTLE
+
+ config BL_SWITCHER
+ bool "big.LITTLE switcher support"
+- depends on BIG_LITTLE && MCPM && HOTPLUG_CPU
+- select ARM_CPU_SUSPEND
++ depends on BIG_LITTLE && MCPM && HOTPLUG_CPU && ARM_GIC
+ select CPU_PM
+ help
+ The big.LITTLE "switcher" provides the core functionality to
+@@ -2141,7 +2140,8 @@ config ARCH_SUSPEND_POSSIBLE
+ def_bool y
+
+ config ARM_CPU_SUSPEND
+- def_bool PM_SLEEP
++ def_bool PM_SLEEP || BL_SWITCHER
++ depends on ARCH_SUSPEND_POSSIBLE
+
+ config ARCH_HIBERNATION_POSSIBLE
+ bool
+diff --git a/arch/arm/mach-imx/cpuidle-imx6q.c
b/arch/arm/mach-imx/cpuidle-imx6q.c
+index 353bb8774112..ec74c2812c1a 100644
+--- a/arch/arm/mach-imx/cpuidle-imx6q.c
++++ b/arch/arm/mach-imx/cpuidle-imx6q.c
+@@ -14,30 +14,23 @@
+ #include "cpuidle.h"
+ #include "hardware.h"
+
+-static atomic_t master = ATOMIC_INIT(0);
+-static DEFINE_SPINLOCK(master_lock);
++static int num_idle_cpus = 0;
++static DEFINE_SPINLOCK(cpuidle_lock);
+
+ static int imx6q_enter_wait(struct cpuidle_device *dev,
+ struct cpuidle_driver *drv, int index)
+ {
+- if (atomic_inc_return(&master) == num_online_cpus()) {
+- /*
+- * With this lock, we prevent other cpu to exit and enter
+- * this function again and become the master.
+- */
+- if (!spin_trylock(&master_lock))
+- goto idle;
++ spin_lock(&cpuidle_lock);
++ if (++num_idle_cpus == num_online_cpus())
+ imx6_set_lpm(WAIT_UNCLOCKED);
+- cpu_do_idle();
+- imx6_set_lpm(WAIT_CLOCKED);
+- spin_unlock(&master_lock);
+- goto done;
+- }
++ spin_unlock(&cpuidle_lock);
+
+-idle:
+ cpu_do_idle();
+-done:
+- atomic_dec(&master);
++
++ spin_lock(&cpuidle_lock);
++ if (num_idle_cpus-- == num_online_cpus())
++ imx6_set_lpm(WAIT_CLOCKED);
++ spin_unlock(&cpuidle_lock);
+
+ return index;
+ }
+diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c
+index e47cffd25c6c..aead23f15213 100644
+--- a/arch/arm/mm/mmu.c
++++ b/arch/arm/mm/mmu.c
+@@ -572,7 +572,7 @@ static void __init build_mem_type_table(void)
+ * in the Short-descriptor translation table format descriptors.
+ */
+ if (cpu_arch == CPU_ARCH_ARMv7 &&
+- (read_cpuid_ext(CPUID_EXT_MMFR0) & 0xF) == 4) {
++ (read_cpuid_ext(CPUID_EXT_MMFR0) & 0xF) >= 4) {
+ user_pmd_table |= PMD_PXNTABLE;
+ }
+ #endif
+diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
+index 5b47218809e0..f18b8c26a959 100644
+--- a/arch/arm64/Kconfig
++++ b/arch/arm64/Kconfig
+@@ -89,7 +89,6 @@ config ARM64
+ select PERF_USE_VMALLOC
+ select POWER_RESET
+ select POWER_SUPPLY
+- select RTC_LIB
+ select SPARSE_IRQ
+ select SYSCTL_EXCEPTION_TRACE
+ select HAVE_CONTEXT_TRACKING
+@@ -819,6 +818,10 @@ config SYSVIPC_COMPAT
+ def_bool y
+ depends on COMPAT && SYSVIPC
+
++config KEYS_COMPAT
++ def_bool y
++ depends on COMPAT && KEYS
++
+ endmenu
+
+ menu "Power management options"
+diff --git a/arch/arm64/include/asm/page.h b/arch/arm64/include/asm/page.h
+index 9b2f5a9d019d..fbafd0ad16df 100644
+--- a/arch/arm64/include/asm/page.h
++++ b/arch/arm64/include/asm/page.h
+@@ -19,6 +19,8 @@
+ #ifndef __ASM_PAGE_H
+ #define __ASM_PAGE_H
+
++#include <linux/const.h>
++
+ /* PAGE_SHIFT determines the page size */
+ /* CONT_SHIFT determines the number of pages which can be tracked together */
+ #ifdef CONFIG_ARM64_64K_PAGES
+diff --git a/arch/arm64/include/asm/shmparam.h
b/arch/arm64/include/asm/shmparam.h
+index 4df608a8459e..e368a55ebd22 100644
+--- a/arch/arm64/include/asm/shmparam.h
++++ b/arch/arm64/include/asm/shmparam.h
+@@ -21,7 +21,7 @@
+ * alignment value. Since we don't have aliasing D-caches, the rest of
+ * the time we can safely use PAGE_SIZE.
+ */
+-#define COMPAT_SHMLBA 0x4000
++#define COMPAT_SHMLBA (4 * PAGE_SIZE)
+
+ #include <asm-generic/shmparam.h>
+
+diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S
+index 3028d9b028c7..586326981769 100644
+--- a/arch/arm64/kernel/entry.S
++++ b/arch/arm64/kernel/entry.S
+@@ -243,7 +243,7 @@ END(vectors)
+ * Invalid mode handlers
+ */
+ .macro inv_entry, el, reason, regsize = 64
+- kernel_entry el, \regsize
++ kernel_entry \el, \regsize
+ mov x0, sp
+ mov x1, #\reason
+ mrs x2, esr_el1
+diff --git a/arch/arm64/kernel/image.h b/arch/arm64/kernel/image.h
+index bc2abb8b1599..999633bd7294 100644
+--- a/arch/arm64/kernel/image.h
++++ b/arch/arm64/kernel/image.h
+@@ -64,6 +64,16 @@
+
+ #ifdef CONFIG_EFI
+
++/*
++ * Prevent the symbol aliases below from being emitted into the kallsyms
++ * table, by forcing them to be absolute symbols (which are conveniently
++ * ignored by scripts/kallsyms) rather than section relative symbols.
++ * The distinction is only relevant for partial linking, and only for symbols
++ * that are defined within a section declaration (which is not the case for
++ * the definitions below) so the resulting values will be identical.
++ */
++#define KALLSYMS_HIDE(sym) ABSOLUTE(sym)
++
+ /*
+ * The EFI stub has its own symbol namespace prefixed by __efistub_, to
+ * isolate it from the kernel proper. The following symbols are legally
+@@ -73,25 +83,25 @@
+ * linked at. The routines below are all implemented in assembler in a
+ * position independent manner
+ */
+-__efistub_memcmp = __pi_memcmp;
+-__efistub_memchr = __pi_memchr;
+-__efistub_memcpy = __pi_memcpy;
+-__efistub_memmove = __pi_memmove;
+-__efistub_memset = __pi_memset;
+-__efistub_strlen = __pi_strlen;
+-__efistub_strcmp = __pi_strcmp;
+-__efistub_strncmp = __pi_strncmp;
+-__efistub___flush_dcache_area = __pi___flush_dcache_area;
++__efistub_memcmp = KALLSYMS_HIDE(__pi_memcmp);
++__efistub_memchr = KALLSYMS_HIDE(__pi_memchr);
++__efistub_memcpy = KALLSYMS_HIDE(__pi_memcpy);
++__efistub_memmove = KALLSYMS_HIDE(__pi_memmove);
++__efistub_memset = KALLSYMS_HIDE(__pi_memset);
++__efistub_strlen = KALLSYMS_HIDE(__pi_strlen);
++__efistub_strcmp = KALLSYMS_HIDE(__pi_strcmp);
++__efistub_strncmp = KALLSYMS_HIDE(__pi_strncmp);
++__efistub___flush_dcache_area = KALLSYMS_HIDE(__pi___flush_dcache_area);
+
+ #ifdef CONFIG_KASAN
+-__efistub___memcpy = __pi_memcpy;
+-__efistub___memmove = __pi_memmove;
+-__efistub___memset = __pi_memset;
++__efistub___memcpy = KALLSYMS_HIDE(__pi_memcpy);
++__efistub___memmove = KALLSYMS_HIDE(__pi_memmove);
++__efistub___memset = KALLSYMS_HIDE(__pi_memset);
+ #endif
+
+-__efistub__text = _text;
+-__efistub__end = _end;
+-__efistub__edata = _edata;
++__efistub__text = KALLSYMS_HIDE(_text);
++__efistub__end = KALLSYMS_HIDE(_end);
++__efistub__edata = KALLSYMS_HIDE(_edata);
+
+ #endif
+
+diff --git a/arch/arm64/kernel/traps.c b/arch/arm64/kernel/traps.c
+index 5d270ca76aec..6b4579e07aa2 100644
+--- a/arch/arm64/kernel/traps.c
++++ b/arch/arm64/kernel/traps.c
+@@ -239,10 +239,12 @@ void die(const char *str, struct pt_regs *regs, int err)
+ {
+ struct thread_info *thread = current_thread_info();
+ int ret;
++ unsigned long flags;
++
++ raw_spin_lock_irqsave(&die_lock, flags);
+
+ oops_enter();
+
+- raw_spin_lock_irq(&die_lock);
+ console_verbose();
+ bust_spinlocks(1);
+ ret = __die(str, err, thread, regs);
+@@ -252,13 +254,15 @@ void die(const char *str, struct pt_regs *regs, int err)
+
+ bust_spinlocks(0);
+ add_taint(TAINT_DIE, LOCKDEP_NOW_UNRELIABLE);
+- raw_spin_unlock_irq(&die_lock);
+ oops_exit();
+
+ if (in_interrupt())
+ panic("Fatal exception in interrupt");
+ if (panic_on_oops)
+ panic("Fatal exception");
++
++ raw_spin_unlock_irqrestore(&die_lock, flags);
++
+ if (ret != NOTIFY_STOP)
+ do_exit(SIGSEGV);
+ }
+diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c
+index be7f8416809f..04c4b88706d8 100644
+--- a/arch/arm64/mm/fault.c
++++ b/arch/arm64/mm/fault.c
+@@ -595,20 +595,33 @@ asmlinkage int __exception do_debug_exception(unsigned
long addr,
+ {
+ const struct fault_info *inf = debug_fault_info + DBG_ESR_EVT(esr);
+ struct siginfo info;
++ int rv;
+
+- if (!inf->fn(addr, esr, regs))
+- return 1;
++ /*
++ * Tell lockdep we disabled irqs in entry.S. Do nothing if they were
++ * already disabled to preserve the last enabled/disabled addresses.
++ */
++ if (interrupts_enabled(regs))
++ trace_hardirqs_off();
+
+- pr_alert("Unhandled debug exception: %s (0x%08x) at 0x%016lx\n",
+- inf->name, esr, addr);
++ if (!inf->fn(addr, esr, regs)) {
++ rv = 1;
++ } else {
++ pr_alert("Unhandled debug exception: %s (0x%08x) at 0x%016lx\n",
++ inf->name, esr, addr);
++
++ info.si_signo = inf->sig;
++ info.si_errno = 0;
++ info.si_code = inf->code;
++ info.si_addr = (void __user *)addr;
++ arm64_notify_die("", regs, &info, 0);
++ rv = 0;
++ }
+
+- info.si_signo = inf->sig;
+- info.si_errno = 0;
+- info.si_code = inf->code;
+- info.si_addr = (void __user *)addr;
+- arm64_notify_die("", regs, &info, 0);
++ if (interrupts_enabled(regs))
++ trace_hardirqs_on();
+
+- return 0;
++ return rv;
+ }
+
+ #ifdef CONFIG_ARM64_PAN
+diff --git a/arch/mips/include/asm/jump_label.h
b/arch/mips/include/asm/jump_label.h
+index e77672539e8e..e4456e450f94 100644
+--- a/arch/mips/include/asm/jump_label.h
++++ b/arch/mips/include/asm/jump_label.h
+@@ -21,15 +21,15 @@
+ #endif
+
+ #ifdef CONFIG_CPU_MICROMIPS
+-#define NOP_INSN "nop32"
++#define B_INSN "b32"
+ #else
+-#define NOP_INSN "nop"
++#define B_INSN "b"
+ #endif
+
+ static __always_inline bool arch_static_branch(struct static_key *key, bool
branch)
+ {
+- asm_volatile_goto("1:\t" NOP_INSN "\n\t"
+- "nop\n\t"
++ asm_volatile_goto("1:\t" B_INSN " 2f\n\t"
++ "2:\tnop\n\t"
+ ".pushsection __jump_table, \"aw\"\n\t"
+ WORD_INSN " 1b, %l[l_yes], %0\n\t"
+ ".popsection\n\t"
+diff --git a/arch/mips/loongson64/lemote-2f/irq.c
b/arch/mips/loongson64/lemote-2f/irq.c
+index cab5f43e0e29..d371f0294cbb 100644
+--- a/arch/mips/loongson64/lemote-2f/irq.c
++++ b/arch/mips/loongson64/lemote-2f/irq.c
+@@ -102,7 +102,7 @@ static struct irqaction ip6_irqaction = {
+ static struct irqaction cascade_irqaction = {
+ .handler = no_action,
+ .name = "cascade",
+- .flags = IRQF_NO_THREAD,
++ .flags = IRQF_NO_THREAD | IRQF_NO_SUSPEND,
+ };
+
+ void __init mach_init_irq(void)
+diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
+index 9beee7f364ad..4598d087dec2 100644
+--- a/arch/x86/Kconfig
++++ b/arch/x86/Kconfig
+@@ -1970,14 +1970,8 @@ config PHYSICAL_ALIGN
+ Don't change this unless you know what you are doing.
+
+ config HOTPLUG_CPU
+- bool "Support for hot-pluggable CPUs"
++ def_bool y
+ depends on SMP
+- ---help---
+- Say Y here to allow turning CPUs off and on. CPUs can be
+- controlled through /sys/devices/system/cpu.
+- ( Note: power management support will enable this option
+- automatically on SMP systems. )
+- Say N if you want to disable CPU hotplug.
+
+ config BOOTPARAM_HOTPLUG_CPU0
+ bool "Set default setting of cpu0_hotpluggable"
+diff --git a/drivers/extcon/extcon-usb-gpio.c
b/drivers/extcon/extcon-usb-gpio.c
+index 2b2fecffb1ad..c6a7c9ddf0ac 100644
+--- a/drivers/extcon/extcon-usb-gpio.c
++++ b/drivers/extcon/extcon-usb-gpio.c
+@@ -192,6 +192,9 @@ static int usb_extcon_resume(struct device *dev)
+ }
+
+ enable_irq(info->id_irq);
++ if (!device_may_wakeup(dev))
++ queue_delayed_work(system_power_efficient_wq,
++ &info->wq_detcable, 0);
+
+ return ret;
+ }
+diff --git a/drivers/firmware/efi/libstub/Makefile
b/drivers/firmware/efi/libstub/Makefile
+index 88bd6829a358..edb45f72b34c 100644
+--- a/drivers/firmware/efi/libstub/Makefile
++++ b/drivers/firmware/efi/libstub/Makefile
+@@ -8,7 +8,7 @@ cflags-$(CONFIG_X86_32) := -march=i386
+ cflags-$(CONFIG_X86_64) := -mcmodel=small
+ cflags-$(CONFIG_X86) += -m$(BITS) -D__KERNEL__ $(LINUX_INCLUDE) -O2 \
+ -fPIC -fno-strict-aliasing -mno-red-zone \
+- -mno-mmx -mno-sse -DDISABLE_BRANCH_PROFILING
++ -mno-mmx -mno-sse
+
+ cflags-$(CONFIG_ARM64) := $(subst -pg,,$(KBUILD_CFLAGS)) -fpie
+ cflags-$(CONFIG_ARM) := $(subst -pg,,$(KBUILD_CFLAGS)) \
+@@ -16,7 +16,7 @@ cflags-$(CONFIG_ARM) := $(subst
-pg,,$(KBUILD_CFLAGS)) \
+
+ cflags-$(CONFIG_EFI_ARMSTUB) += -I$(srctree)/scripts/dtc/libfdt
+
+-KBUILD_CFLAGS := $(cflags-y) \
++KBUILD_CFLAGS := $(cflags-y) -DDISABLE_BRANCH_PROFILING \
+ $(call cc-option,-ffreestanding) \
+ $(call cc-option,-fno-stack-protector)
+
+diff --git a/drivers/gpio/gpio-adnp.c b/drivers/gpio/gpio-adnp.c
+index d3d0a90fe542..995b2be45982 100644
+--- a/drivers/gpio/gpio-adnp.c
++++ b/drivers/gpio/gpio-adnp.c
+@@ -137,8 +137,10 @@ static int adnp_gpio_direction_input(struct gpio_chip
*chip, unsigned offset)
+ if (err < 0)
+ goto out;
+
+- if (err & BIT(pos))
+- err = -EACCES;
++ if (value & BIT(pos)) {
++ err = -EPERM;
++ goto out;
++ }
+
+ err = 0;
+
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
+index aec6e9eef489..55884cb5a0fc 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
+@@ -531,11 +531,9 @@ static int vmw_fb_set_par(struct fb_info *info)
+ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+ DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_PVSYNC)
+ };
+- struct drm_display_mode *old_mode;
+ struct drm_display_mode *mode;
+ int ret;
+
+- old_mode = par->set_mode;
+ mode = drm_mode_duplicate(vmw_priv->dev, &new_mode);
+ if (!mode) {
+ DRM_ERROR("Could not create new fb mode.\n");
+@@ -546,11 +544,7 @@ static int vmw_fb_set_par(struct fb_info *info)
+ mode->vdisplay = var->yres;
+ vmw_guess_mode_timing(mode);
+
+- if (old_mode && drm_mode_equal(old_mode, mode)) {
+- drm_mode_destroy(vmw_priv->dev, mode);
+- mode = old_mode;
+- old_mode = NULL;
+- } else if (!vmw_kms_validate_mode_vram(vmw_priv,
++ if (!vmw_kms_validate_mode_vram(vmw_priv,
+ mode->hdisplay *
+ DIV_ROUND_UP(var->bits_per_pixel, 8),
+ mode->vdisplay)) {
+@@ -613,8 +607,8 @@ static int vmw_fb_set_par(struct fb_info *info)
+ schedule_delayed_work(&par->local_work, 0);
+
+ out_unlock:
+- if (old_mode)
+- drm_mode_destroy(vmw_priv->dev, old_mode);
++ if (par->set_mode)
++ drm_mode_destroy(vmw_priv->dev, par->set_mode);
+ par->set_mode = mode;
+
+ drm_modeset_unlock_all(vmw_priv->dev);
+diff --git a/drivers/hid/hid-sensor-hub.c b/drivers/hid/hid-sensor-hub.c
+index 92870cdb52d9..8efaa88329aa 100644
+--- a/drivers/hid/hid-sensor-hub.c
++++ b/drivers/hid/hid-sensor-hub.c
+@@ -218,7 +218,8 @@ int sensor_hub_set_feature(struct hid_sensor_hub_device
*hsdev, u32 report_id,
+ goto done_proc;
+ }
+
+- remaining_bytes = do_div(buffer_size, sizeof(__s32));
++ remaining_bytes = buffer_size % sizeof(__s32);
++ buffer_size = buffer_size / sizeof(__s32);
+ if (buffer_size) {
+ for (i = 0; i < buffer_size; ++i) {
+ hid_set_field(report->field[field_index], i,
+diff --git a/drivers/hwtracing/coresight/coresight-etb10.c
b/drivers/hwtracing/coresight/coresight-etb10.c
+index 77d0f9c1118d..92969dae739d 100644
+--- a/drivers/hwtracing/coresight/coresight-etb10.c
++++ b/drivers/hwtracing/coresight/coresight-etb10.c
+@@ -489,15 +489,6 @@ err_misc_register:
+ return ret;
+ }
+
+-static int etb_remove(struct amba_device *adev)
+-{
+- struct etb_drvdata *drvdata = amba_get_drvdata(adev);
+-
+- misc_deregister(&drvdata->miscdev);
+- coresight_unregister(drvdata->csdev);
+- return 0;
+-}
+-
+ #ifdef CONFIG_PM
+ static int etb_runtime_suspend(struct device *dev)
+ {
+@@ -537,10 +528,10 @@ static struct amba_driver etb_driver = {
+ .name = "coresight-etb10",
+ .owner = THIS_MODULE,
+ .pm = &etb_dev_pm_ops,
++ .suppress_bind_attrs = true,
+
+ },
+ .probe = etb_probe,
+- .remove = etb_remove,
+ .id_table = etb_ids,
+ };
+
+diff --git a/drivers/hwtracing/coresight/coresight-etm3x.c
b/drivers/hwtracing/coresight/coresight-etm3x.c
+index d630b7ece735..5981fcc69960 100644
+--- a/drivers/hwtracing/coresight/coresight-etm3x.c
++++ b/drivers/hwtracing/coresight/coresight-etm3x.c
+@@ -1877,17 +1877,6 @@ err_arch_supported:
+ return ret;
+ }
+
+-static int etm_remove(struct amba_device *adev)
+-{
+- struct etm_drvdata *drvdata = amba_get_drvdata(adev);
+-
+- coresight_unregister(drvdata->csdev);
+- if (--etm_count == 0)
+- unregister_hotcpu_notifier(&etm_cpu_notifier);
+-
+- return 0;
+-}
+-
+ #ifdef CONFIG_PM
+ static int etm_runtime_suspend(struct device *dev)
+ {
+@@ -1948,9 +1937,9 @@ static struct amba_driver etm_driver = {
+ .name = "coresight-etm3x",
+ .owner = THIS_MODULE,
+ .pm = &etm_dev_pm_ops,
++ .suppress_bind_attrs = true,
+ },
+ .probe = etm_probe,
+- .remove = etm_remove,
+ .id_table = etm_ids,
+ };
+
+diff --git a/drivers/hwtracing/coresight/coresight-etm4x.c
b/drivers/hwtracing/coresight/coresight-etm4x.c
+index a6707642bb23..0edc10b44004 100644
+--- a/drivers/hwtracing/coresight/coresight-etm4x.c
++++ b/drivers/hwtracing/coresight/coresight-etm4x.c
+@@ -2219,7 +2219,7 @@ static ssize_t name##_show(struct device *_dev,
\
+ return scnprintf(buf, PAGE_SIZE, "0x%x\n", \
+ readl_relaxed(drvdata->base + offset)); \
+ } \
+-DEVICE_ATTR_RO(name)
++static DEVICE_ATTR_RO(name)
+
+ coresight_simple_func(trcoslsr, TRCOSLSR);
+ coresight_simple_func(trcpdcr, TRCPDCR);
+@@ -2684,17 +2684,6 @@ err_coresight_register:
+ return ret;
+ }
+
+-static int etm4_remove(struct amba_device *adev)
+-{
+- struct etmv4_drvdata *drvdata = amba_get_drvdata(adev);
+-
+- coresight_unregister(drvdata->csdev);
+- if (--etm4_count == 0)
+- unregister_hotcpu_notifier(&etm4_cpu_notifier);
+-
+- return 0;
+-}
+-
+ static struct amba_id etm4_ids[] = {
+ { /* ETM 4.0 - Qualcomm */
+ .id = 0x0003b95d,
+@@ -2712,9 +2701,9 @@ static struct amba_id etm4_ids[] = {
+ static struct amba_driver etm4x_driver = {
+ .drv = {
+ .name = "coresight-etm4x",
++ .suppress_bind_attrs = true,
+ },
+ .probe = etm4_probe,
+- .remove = etm4_remove,
+ .id_table = etm4_ids,
+ };
+
+diff --git a/drivers/hwtracing/coresight/coresight-funnel.c
b/drivers/hwtracing/coresight/coresight-funnel.c
+index 2e36bde7fcb4..25e8ea140a09 100644
+--- a/drivers/hwtracing/coresight/coresight-funnel.c
++++ b/drivers/hwtracing/coresight/coresight-funnel.c
+@@ -226,14 +226,6 @@ static int funnel_probe(struct amba_device *adev, const
struct amba_id *id)
+ return 0;
+ }
+
+-static int funnel_remove(struct amba_device *adev)
+-{
+- struct funnel_drvdata *drvdata = amba_get_drvdata(adev);
+-
+- coresight_unregister(drvdata->csdev);
+- return 0;
+-}
+-
+ #ifdef CONFIG_PM
+ static int funnel_runtime_suspend(struct device *dev)
+ {
+@@ -273,9 +265,9 @@ static struct amba_driver funnel_driver = {
+ .name = "coresight-funnel",
+ .owner = THIS_MODULE,
+ .pm = &funnel_dev_pm_ops,
++ .suppress_bind_attrs = true,
+ },
+ .probe = funnel_probe,
+- .remove = funnel_remove,
+ .id_table = funnel_ids,
+ };
+
+diff --git a/drivers/hwtracing/coresight/coresight-replicator-qcom.c
b/drivers/hwtracing/coresight/coresight-replicator-qcom.c
+index 584059e9e866..444815179460 100644
+--- a/drivers/hwtracing/coresight/coresight-replicator-qcom.c
++++ b/drivers/hwtracing/coresight/coresight-replicator-qcom.c
+@@ -156,15 +156,6 @@ static int replicator_probe(struct amba_device *adev,
const struct amba_id *id)
+ return 0;
+ }
+
+-static int replicator_remove(struct amba_device *adev)
+-{
+- struct replicator_state *drvdata = amba_get_drvdata(adev);
+-
+- pm_runtime_disable(&adev->dev);
+- coresight_unregister(drvdata->csdev);
+- return 0;
+-}
+-
+ #ifdef CONFIG_PM
+ static int replicator_runtime_suspend(struct device *dev)
+ {
+@@ -206,9 +197,9 @@ static struct amba_driver replicator_driver = {
+ .drv = {
+ .name = "coresight-replicator-qcom",
+ .pm = &replicator_dev_pm_ops,
++ .suppress_bind_attrs = true,
+ },
+ .probe = replicator_probe,
+- .remove = replicator_remove,
+ .id_table = replicator_ids,
+ };
+
+diff --git a/drivers/hwtracing/coresight/coresight-replicator.c
b/drivers/hwtracing/coresight/coresight-replicator.c
+index 963ac197c253..b77d700a3f0e 100644
+--- a/drivers/hwtracing/coresight/coresight-replicator.c
++++ b/drivers/hwtracing/coresight/coresight-replicator.c
+@@ -127,20 +127,6 @@ out_disable_pm:
+ return ret;
+ }
+
+-static int replicator_remove(struct platform_device *pdev)
+-{
+- struct replicator_drvdata *drvdata = platform_get_drvdata(pdev);
+-
+- coresight_unregister(drvdata->csdev);
+- pm_runtime_get_sync(&pdev->dev);
+- if (!IS_ERR(drvdata->atclk))
+- clk_disable_unprepare(drvdata->atclk);
+- pm_runtime_put_noidle(&pdev->dev);
+- pm_runtime_disable(&pdev->dev);
+-
+- return 0;
+-}
+-
+ #ifdef CONFIG_PM
+ static int replicator_runtime_suspend(struct device *dev)
+ {
+@@ -175,11 +161,11 @@ static const struct of_device_id replicator_match[] = {
+
+ static struct platform_driver replicator_driver = {
+ .probe = replicator_probe,
+- .remove = replicator_remove,
+ .driver = {
+ .name = "coresight-replicator",
+ .of_match_table = replicator_match,
+ .pm = &replicator_dev_pm_ops,
++ .suppress_bind_attrs = true,
+ },
+ };
+
+diff --git a/drivers/hwtracing/coresight/coresight-tmc.c
b/drivers/hwtracing/coresight/coresight-tmc.c
+index a57c7ec1661f..c4fa70ed14ce 100644
+--- a/drivers/hwtracing/coresight/coresight-tmc.c
++++ b/drivers/hwtracing/coresight/coresight-tmc.c
+@@ -124,7 +124,7 @@ struct tmc_drvdata {
+ bool reading;
+ char *buf;
+ dma_addr_t paddr;
+- void __iomem *vaddr;
++ void *vaddr;
+ u32 size;
+ bool enable;
+ enum tmc_config_type config_type;
+@@ -766,23 +766,10 @@ err_misc_register:
+ err_devm_kzalloc:
+ if (drvdata->config_type == TMC_CONFIG_TYPE_ETR)
+ dma_free_coherent(dev, drvdata->size,
+- &drvdata->paddr, GFP_KERNEL);
++ drvdata->vaddr, drvdata->paddr);
+ return ret;
+ }
+
+-static int tmc_remove(struct amba_device *adev)
+-{
+- struct tmc_drvdata *drvdata = amba_get_drvdata(adev);
+-
+- misc_deregister(&drvdata->miscdev);
+- coresight_unregister(drvdata->csdev);
+- if (drvdata->config_type == TMC_CONFIG_TYPE_ETR)
+- dma_free_coherent(drvdata->dev, drvdata->size,
+- &drvdata->paddr, GFP_KERNEL);
+-
+- return 0;
+-}
+-
+ static struct amba_id tmc_ids[] = {
+ {
+ .id = 0x0003b961,
+@@ -795,9 +782,9 @@ static struct amba_driver tmc_driver = {
+ .drv = {
+ .name = "coresight-tmc",
+ .owner = THIS_MODULE,
++ .suppress_bind_attrs = true,
+ },
+ .probe = tmc_probe,
+- .remove = tmc_remove,
+ .id_table = tmc_ids,
+ };
+
+diff --git a/drivers/hwtracing/coresight/coresight-tpiu.c
b/drivers/hwtracing/coresight/coresight-tpiu.c
+index fe3a2b19a5db..105c192eb2c1 100644
+--- a/drivers/hwtracing/coresight/coresight-tpiu.c
++++ b/drivers/hwtracing/coresight/coresight-tpiu.c
+@@ -180,14 +180,6 @@ static int tpiu_probe(struct amba_device *adev, const
struct amba_id *id)
+ return 0;
+ }
+
+-static int tpiu_remove(struct amba_device *adev)
+-{
+- struct tpiu_drvdata *drvdata = amba_get_drvdata(adev);
+-
+- coresight_unregister(drvdata->csdev);
+- return 0;
+-}
+-
+ #ifdef CONFIG_PM
+ static int tpiu_runtime_suspend(struct device *dev)
+ {
+@@ -231,9 +223,9 @@ static struct amba_driver tpiu_driver = {
+ .name = "coresight-tpiu",
+ .owner = THIS_MODULE,
+ .pm = &tpiu_dev_pm_ops,
++ .suppress_bind_attrs = true,
+ },
+ .probe = tpiu_probe,
+- .remove = tpiu_remove,
+ .id_table = tpiu_ids,
+ };
+
+diff --git a/drivers/hwtracing/coresight/coresight.c
b/drivers/hwtracing/coresight/coresight.c
+index 902ee6efd09c..c6aea4795d0b 100644
+--- a/drivers/hwtracing/coresight/coresight.c
++++ b/drivers/hwtracing/coresight/coresight.c
+@@ -484,6 +484,8 @@ static void coresight_device_release(struct device *dev)
+ {
+ struct coresight_device *csdev = to_coresight_device(dev);
+
++ kfree(csdev->conns);
++ kfree(csdev->refcnt);
+ kfree(csdev);
+ }
+
+@@ -571,6 +573,8 @@ static void coresight_fixup_device_conns(struct
coresight_device *csdev)
+
+ if (dev) {
+ conn->child_dev = to_coresight_device(dev);
++ /* and put reference from 'bus_find_device()' */
++ put_device(dev);
+ } else {
+ csdev->orphan = true;
+ conn->child_dev = NULL;
+@@ -578,6 +582,50 @@ static void coresight_fixup_device_conns(struct
coresight_device *csdev)
+ }
+ }
+
++static int coresight_remove_match(struct device *dev, void *data)
++{
++ int i;
++ struct coresight_device *csdev, *iterator;
++ struct coresight_connection *conn;
++
++ csdev = data;
++ iterator = to_coresight_device(dev);
++
++ /* No need to check oneself */
++ if (csdev == iterator)
++ return 0;
++
++ /*
++ * Circle throuch all the connection of that component. If we find
++ * a connection whose name matches @csdev, remove it.
++ */
++ for (i = 0; i < iterator->nr_outport; i++) {
++ conn = &iterator->conns[i];
++
++ if (conn->child_dev == NULL)
++ continue;
++
++ if (!strcmp(dev_name(&csdev->dev), conn->child_name)) {
++ iterator->orphan = true;
++ conn->child_dev = NULL;
++ /* No need to continue */
++ break;
++ }
++ }
++
++ /*
++ * Returning '0' ensures that all known component on the
++ * bus will be checked.
++ */
++ return 0;
++}
++
++static void coresight_remove_conns(struct coresight_device *csdev)
++{
++ bus_for_each_dev(&coresight_bustype, NULL,
++ csdev, coresight_remove_match);
++}
++
+ /**
+ * coresight_timeout - loop until a bit has changed to a specific state.
+ * @addr: base address of the area of interest.
+@@ -716,12 +764,9 @@ EXPORT_SYMBOL_GPL(coresight_register);
+
+ void coresight_unregister(struct coresight_device *csdev)
+ {
+- mutex_lock(&coresight_mutex);
+-
+- kfree(csdev->conns);
++ /* Remove references of that device in the topology */
++ coresight_remove_conns(csdev);
+ device_unregister(&csdev->dev);
+-
+- mutex_unlock(&coresight_mutex);
+ }
+ EXPORT_SYMBOL_GPL(coresight_unregister);
+
+diff --git a/drivers/hwtracing/coresight/of_coresight.c
b/drivers/hwtracing/coresight/of_coresight.c
+index 7d2bb1549608..fb7597b1c66f 100644
+--- a/drivers/hwtracing/coresight/of_coresight.c
++++ b/drivers/hwtracing/coresight/of_coresight.c
+@@ -86,7 +86,7 @@ static int of_coresight_alloc_memory(struct device *dev,
+ return -ENOMEM;
+
+ /* Children connected to this component via @outports */
+- pdata->child_names = devm_kzalloc(dev, pdata->nr_outport *
++ pdata->child_names = devm_kzalloc(dev, pdata->nr_outport *
+ sizeof(*pdata->child_names),
+ GFP_KERNEL);
+ if (!pdata->child_names)
+diff --git a/drivers/hwtracing/stm/Kconfig b/drivers/hwtracing/stm/Kconfig
+index e7a348807f0c..e0ac75395526 100644
+--- a/drivers/hwtracing/stm/Kconfig
++++ b/drivers/hwtracing/stm/Kconfig
+@@ -9,6 +9,8 @@ config STM
+
+ Say Y here to enable System Trace Module device support.
+
++if STM
++
+ config STM_DUMMY
+ tristate "Dummy STM driver"
+ help
+@@ -25,3 +27,5 @@ config STM_SOURCE_CONSOLE
+
+ If you want to send kernel console messages over STM devices,
+ say Y.
++
++endif
+diff --git a/drivers/hwtracing/stm/core.c b/drivers/hwtracing/stm/core.c
+index 92ab51aa8a74..b6cc841de79d 100644
+--- a/drivers/hwtracing/stm/core.c
++++ b/drivers/hwtracing/stm/core.c
+@@ -114,6 +114,7 @@ struct stm_device *stm_find_device(const char *buf)
+
+ stm = to_stm_device(dev);
+ if (!try_module_get(stm->owner)) {
++ /* matches class_find_device() above */
+ put_device(dev);
+ return NULL;
+ }
+@@ -126,7 +127,7 @@ struct stm_device *stm_find_device(const char *buf)
+ * @stm: stm device, previously acquired by stm_find_device()
+ *
+ * This drops the module reference and device reference taken by
+- * stm_find_device().
++ * stm_find_device() or stm_char_open().
+ */
+ void stm_put_device(struct stm_device *stm)
+ {
+@@ -186,6 +187,9 @@ static void stm_output_claim(struct stm_device *stm,
struct stm_output *output)
+ {
+ struct stp_master *master = stm_master(stm, output->master);
+
++ lockdep_assert_held(&stm->mc_lock);
++ lockdep_assert_held(&output->lock);
++
+ if (WARN_ON_ONCE(master->nr_free < output->nr_chans))
+ return;
+
+@@ -200,6 +204,9 @@ stm_output_disclaim(struct stm_device *stm, struct
stm_output *output)
+ {
+ struct stp_master *master = stm_master(stm, output->master);
+
++ lockdep_assert_held(&stm->mc_lock);
++ lockdep_assert_held(&output->lock);
++
+ bitmap_release_region(&master->chan_map[0], output->channel,
+ ilog2(output->nr_chans));
+
+@@ -292,6 +299,7 @@ static int stm_output_assign(struct stm_device *stm,
unsigned int width,
+ }
+
+ spin_lock(&stm->mc_lock);
++ spin_lock(&output->lock);
+ /* output is already assigned -- shouldn't happen */
+ if (WARN_ON_ONCE(output->nr_chans))
+ goto unlock;
+@@ -308,6 +316,7 @@ static int stm_output_assign(struct stm_device *stm,
unsigned int width,
+
+ ret = 0;
+ unlock:
++ spin_unlock(&output->lock);
+ spin_unlock(&stm->mc_lock);
+
+ return ret;
+@@ -316,11 +325,18 @@ unlock:
+ static void stm_output_free(struct stm_device *stm, struct stm_output *output)
+ {
+ spin_lock(&stm->mc_lock);
++ spin_lock(&output->lock);
+ if (output->nr_chans)
+ stm_output_disclaim(stm, output);
++ spin_unlock(&output->lock);
+ spin_unlock(&stm->mc_lock);
+ }
+
++static void stm_output_init(struct stm_output *output)
++{
++ spin_lock_init(&output->lock);
++}
++
+ static int major_match(struct device *dev, const void *data)
+ {
+ unsigned int major = *(unsigned int *)data;
+@@ -343,6 +359,7 @@ static int stm_char_open(struct inode *inode, struct file
*file)
+ if (!stmf)
+ return -ENOMEM;
+
++ stm_output_init(&stmf->output);
+ stmf->stm = to_stm_device(dev);
+
+ if (!try_module_get(stmf->stm->owner))
+@@ -353,6 +370,8 @@ static int stm_char_open(struct inode *inode, struct file
*file)
+ return nonseekable_open(inode, file);
+
+ err_free:
++ /* matches class_find_device() above */
++ put_device(dev);
+ kfree(stmf);
+
+ return err;
+@@ -363,6 +382,11 @@ static int stm_char_release(struct inode *inode, struct
file *file)
+ struct stm_file *stmf = file->private_data;
+
+ stm_output_free(stmf->stm, &stmf->output);
++
++ /*
++ * matches the stm_char_open()'s
++ * class_find_device() + try_module_get()
++ */
+ stm_put_device(stmf->stm);
+ kfree(stmf);
+
+@@ -410,6 +434,9 @@ static ssize_t stm_char_write(struct file *file, const
char __user *buf,
+ char *kbuf;
+ int err;
+
++ if (count + 1 > PAGE_SIZE)
++ count = PAGE_SIZE - 1;
++
+ /*
+ * if no m/c have been assigned to this writer up to this
+ * point, use "default" policy entry
+@@ -521,10 +548,8 @@ static int stm_char_policy_set_ioctl(struct stm_file
*stmf, void __user *arg)
+ ret = stm->data->link(stm->data, stmf->output.master,
+ stmf->output.channel);
+
+- if (ret) {
++ if (ret)
+ stm_output_free(stmf->stm, &stmf->output);
+- stm_put_device(stmf->stm);
+- }
+
+ err_free:
+ kfree(id);
+@@ -639,17 +664,11 @@ int stm_register_device(struct device *parent, struct
stm_data *stm_data,
+ stm->dev.parent = parent;
+ stm->dev.release = stm_device_release;
+
+- err = kobject_set_name(&stm->dev.kobj, "%s", stm_data->name);
+- if (err)
+- goto err_device;
+-
+- err = device_add(&stm->dev);
+- if (err)
+- goto err_device;
+-
++ mutex_init(&stm->link_mutex);
+ spin_lock_init(&stm->link_lock);
+ INIT_LIST_HEAD(&stm->link_list);
+
++ /* initialize the object before it is accessible via sysfs */
+ spin_lock_init(&stm->mc_lock);
+ mutex_init(&stm->policy_mutex);
+ stm->sw_nmasters = nmasters;
+@@ -657,9 +676,20 @@ int stm_register_device(struct device *parent, struct
stm_data *stm_data,
+ stm->data = stm_data;
+ stm_data->stm = stm;
+
++ err = kobject_set_name(&stm->dev.kobj, "%s", stm_data->name);
++ if (err)
++ goto err_device;
++
++ err = device_add(&stm->dev);
++ if (err)
++ goto err_device;
++
+ return 0;
+
+ err_device:
++ unregister_chrdev(stm->major, stm_data->name);
++
++ /* matches device_initialize() above */
+ put_device(&stm->dev);
+ err_free:
+ vfree(stm);
+@@ -668,20 +698,28 @@ err_free:
+ }
+ EXPORT_SYMBOL_GPL(stm_register_device);
+
+-static void __stm_source_link_drop(struct stm_source_device *src,
+- struct stm_device *stm);
++static int __stm_source_link_drop(struct stm_source_device *src,
++ struct stm_device *stm);
+
+ void stm_unregister_device(struct stm_data *stm_data)
+ {
+ struct stm_device *stm = stm_data->stm;
+ struct stm_source_device *src, *iter;
+- int i;
++ int i, ret;
+
+- spin_lock(&stm->link_lock);
++ mutex_lock(&stm->link_mutex);
+ list_for_each_entry_safe(src, iter, &stm->link_list, link_entry) {
+- __stm_source_link_drop(src, stm);
++ ret = __stm_source_link_drop(src, stm);
++ /*
++ * src <-> stm link must not change under the same
++ * stm::link_mutex, so complain loudly if it has;
++ * also in this situation ret!=0 means this src is
++ * not connected to this stm and it should be otherwise
++ * safe to proceed with the tear-down of stm.
++ */
++ WARN_ON_ONCE(ret);
+ }
+- spin_unlock(&stm->link_lock);
++ mutex_unlock(&stm->link_mutex);
+
+ synchronize_srcu(&stm_source_srcu);
+
+@@ -700,6 +738,17 @@ void stm_unregister_device(struct stm_data *stm_data)
+ }
+ EXPORT_SYMBOL_GPL(stm_unregister_device);
+
++/*
++ * stm::link_list access serialization uses a spinlock and a mutex; holding
++ * either of them guarantees that the list is stable; modification requires
++ * holding both of them.
++ *
++ * Lock ordering is as follows:
++ * stm::link_mutex
++ * stm::link_lock
++ * src::link_lock
++ */
++
+ /**
+ * stm_source_link_add() - connect an stm_source device to an stm device
+ * @src: stm_source device
+@@ -716,6 +765,7 @@ static int stm_source_link_add(struct stm_source_device
*src,
+ char *id;
+ int err;
+
++ mutex_lock(&stm->link_mutex);
+ spin_lock(&stm->link_lock);
+ spin_lock(&src->link_lock);
+
+@@ -725,6 +775,7 @@ static int stm_source_link_add(struct stm_source_device
*src,
+
+ spin_unlock(&src->link_lock);
+ spin_unlock(&stm->link_lock);
++ mutex_unlock(&stm->link_mutex);
+
+ id = kstrdup(src->data->name, GFP_KERNEL);
+ if (id) {
+@@ -759,9 +810,9 @@ static int stm_source_link_add(struct stm_source_device
*src,
+
+ fail_free_output:
+ stm_output_free(stm, &src->output);
+- stm_put_device(stm);
+
+ fail_detach:
++ mutex_lock(&stm->link_mutex);
+ spin_lock(&stm->link_lock);
+ spin_lock(&src->link_lock);
+
+@@ -770,6 +821,7 @@ fail_detach:
+
+ spin_unlock(&src->link_lock);
+ spin_unlock(&stm->link_lock);
++ mutex_unlock(&stm->link_mutex);
+
+ return err;
+ }
+@@ -782,28 +834,45 @@ fail_detach:
+ * If @stm is @src::link, disconnect them from one another and put the
+ * reference on the @stm device.
+ *
+- * Caller must hold stm::link_lock.
++ * Caller must hold stm::link_mutex.
+ */
+-static void __stm_source_link_drop(struct stm_source_device *src,
+- struct stm_device *stm)
++static int __stm_source_link_drop(struct stm_source_device *src,
++ struct stm_device *stm)
+ {
+ struct stm_device *link;
++ int ret = 0;
+
++ lockdep_assert_held(&stm->link_mutex);
++
++ /* for stm::link_list modification, we hold both mutex and spinlock */
++ spin_lock(&stm->link_lock);
+ spin_lock(&src->link_lock);
+ link = srcu_dereference_check(src->link, &stm_source_srcu, 1);
+- if (WARN_ON_ONCE(link != stm)) {
+- spin_unlock(&src->link_lock);
+- return;
++
++ /*
++ * The linked device may have changed since we last looked, because
++ * we weren't holding the src::link_lock back then; if this is the
++ * case, tell the caller to retry.
++ */
++ if (link != stm) {
++ ret = -EAGAIN;
++ goto unlock;
+ }
+
+ stm_output_free(link, &src->output);
+- /* caller must hold stm::link_lock */
+ list_del_init(&src->link_entry);
+ /* matches stm_find_device() from stm_source_link_store() */
+ stm_put_device(link);
+ rcu_assign_pointer(src->link, NULL);
+
++unlock:
+ spin_unlock(&src->link_lock);
++ spin_unlock(&stm->link_lock);
++
++ if (!ret && src->data->unlink)
++ src->data->unlink(src->data);
++
++ return ret;
+ }
+
+ /**
+@@ -819,21 +888,29 @@ static void __stm_source_link_drop(struct
stm_source_device *src,
+ static void stm_source_link_drop(struct stm_source_device *src)
+ {
+ struct stm_device *stm;
+- int idx;
++ int idx, ret;
+
++retry:
+ idx = srcu_read_lock(&stm_source_srcu);
++ /*
++ * The stm device will be valid for the duration of this
++ * read section, but the link may change before we grab
++ * the src::link_lock in __stm_source_link_drop().
++ */
+ stm = srcu_dereference(src->link, &stm_source_srcu);
+
++ ret = 0;
+ if (stm) {
+- if (src->data->unlink)
+- src->data->unlink(src->data);
+-
+- spin_lock(&stm->link_lock);
+- __stm_source_link_drop(src, stm);
+- spin_unlock(&stm->link_lock);
++ mutex_lock(&stm->link_mutex);
++ ret = __stm_source_link_drop(src, stm);
++ mutex_unlock(&stm->link_mutex);
+ }
+
+ srcu_read_unlock(&stm_source_srcu, idx);
++
++ /* if it did change, retry */
++ if (ret == -EAGAIN)
++ goto retry;
+ }
+
+ static ssize_t stm_source_link_show(struct device *dev,
+@@ -868,8 +945,10 @@ static ssize_t stm_source_link_store(struct device *dev,
+ return -EINVAL;
+
+ err = stm_source_link_add(src, link);
+- if (err)
++ if (err) {
++ /* matches the stm_find_device() above */
+ stm_put_device(link);
++ }
+
+ return err ? : count;
+ }
+@@ -931,6 +1010,7 @@ int stm_source_register_device(struct device *parent,
+ if (err)
+ goto err;
+
++ stm_output_init(&src->output);
+ spin_lock_init(&src->link_lock);
+ INIT_LIST_HEAD(&src->link_entry);
+ src->data = data;
+diff --git a/drivers/hwtracing/stm/policy.c b/drivers/hwtracing/stm/policy.c
+index 11ab6d01adf6..1db189657b2b 100644
+--- a/drivers/hwtracing/stm/policy.c
++++ b/drivers/hwtracing/stm/policy.c
+@@ -272,13 +272,17 @@ void stp_policy_unbind(struct stp_policy *policy)
+ {
+ struct stm_device *stm = policy->stm;
+
++ /*
++ * stp_policy_release() will not call here if the policy is already
++ * unbound; other users should not either, as no link exists between
++ * this policy and anything else in that case
++ */
+ if (WARN_ON_ONCE(!policy->stm))
+ return;
+
+- mutex_lock(&stm->policy_mutex);
+- stm->policy = NULL;
+- mutex_unlock(&stm->policy_mutex);
++ lockdep_assert_held(&stm->policy_mutex);
+
++ stm->policy = NULL;
+ policy->stm = NULL;
+
+ stm_put_device(stm);
+@@ -287,8 +291,16 @@ void stp_policy_unbind(struct stp_policy *policy)
+ static void stp_policy_release(struct config_item *item)
+ {
+ struct stp_policy *policy = to_stp_policy(item);
++ struct stm_device *stm = policy->stm;
+
++ /* a policy *can* be unbound and still exist in configfs tree */
++ if (!stm)
++ return;
++
++ mutex_lock(&stm->policy_mutex);
+ stp_policy_unbind(policy);
++ mutex_unlock(&stm->policy_mutex);
++
+ kfree(policy);
+ }
+
+@@ -320,10 +332,11 @@ stp_policies_make(struct config_group *group, const char
*name)
+
+ /*
+ * node must look like <device_name>.<policy_name>, where
+- * <device_name> is the name of an existing stm device and
+- * <policy_name> is an arbitrary string
++ * <device_name> is the name of an existing stm device; may
++ * contain dots;
++ * <policy_name> is an arbitrary string; may not contain dots
+ */
+- p = strchr(devname, '.');
++ p = strrchr(devname, '.');
+ if (!p) {
+ kfree(devname);
+ return ERR_PTR(-EINVAL);
+diff --git a/drivers/hwtracing/stm/stm.h b/drivers/hwtracing/stm/stm.h
+index 95ece0292c99..4e8c6926260f 100644
+--- a/drivers/hwtracing/stm/stm.h
++++ b/drivers/hwtracing/stm/stm.h
+@@ -45,6 +45,7 @@ struct stm_device {
+ int major;
+ unsigned int sw_nmasters;
+ struct stm_data *data;
++ struct mutex link_mutex;
+ spinlock_t link_lock;
+ struct list_head link_list;
+ /* master allocation */
+@@ -56,6 +57,7 @@ struct stm_device {
+ container_of((_d), struct stm_device, dev)
+
+ struct stm_output {
++ spinlock_t lock;
+ unsigned int master;
+ unsigned int channel;
+ unsigned int nr_chans;
+diff --git a/drivers/isdn/hardware/mISDN/hfcmulti.c
b/drivers/isdn/hardware/mISDN/hfcmulti.c
+index 28543d795188..9a27809bdaf2 100644
+--- a/drivers/isdn/hardware/mISDN/hfcmulti.c
++++ b/drivers/isdn/hardware/mISDN/hfcmulti.c
+@@ -4370,7 +4370,8 @@ setup_pci(struct hfc_multi *hc, struct pci_dev *pdev,
+ if (m->clock2)
+ test_and_set_bit(HFC_CHIP_CLOCK2, &hc->chip);
+
+- if (ent->device == 0xB410) {
++ if (ent->vendor == PCI_VENDOR_ID_DIGIUM &&
++ ent->device == PCI_DEVICE_ID_DIGIUM_HFC4S) {
+ test_and_set_bit(HFC_CHIP_B410P, &hc->chip);
+ test_and_set_bit(HFC_CHIP_PCM_MASTER, &hc->chip);
+ test_and_clear_bit(HFC_CHIP_PCM_SLAVE, &hc->chip);
+diff --git a/drivers/media/usb/uvc/uvc_ctrl.c
b/drivers/media/usb/uvc/uvc_ctrl.c
+index 618e4e2b4207..fea09a33c6c8 100644
+--- a/drivers/media/usb/uvc/uvc_ctrl.c
++++ b/drivers/media/usb/uvc/uvc_ctrl.c
+@@ -1202,7 +1202,7 @@ static void uvc_ctrl_fill_event(struct uvc_video_chain
*chain,
+
+ __uvc_query_v4l2_ctrl(chain, ctrl, mapping, &v4l2_ctrl);
+
+- memset(ev->reserved, 0, sizeof(ev->reserved));
++ memset(ev, 0, sizeof(*ev));
+ ev->type = V4L2_EVENT_CTRL;
+ ev->id = v4l2_ctrl.id;
+ ev->u.ctrl.value = value;
+diff --git a/drivers/media/v4l2-core/v4l2-ctrls.c
b/drivers/media/v4l2-core/v4l2-ctrls.c
+index 523758e71fe6..70097cc3a35d 100644
+--- a/drivers/media/v4l2-core/v4l2-ctrls.c
++++ b/drivers/media/v4l2-core/v4l2-ctrls.c
+@@ -1212,7 +1212,7 @@ static u32 user_flags(const struct v4l2_ctrl *ctrl)
+
+ static void fill_event(struct v4l2_event *ev, struct v4l2_ctrl *ctrl, u32
changes)
+ {
+- memset(ev->reserved, 0, sizeof(ev->reserved));
++ memset(ev, 0, sizeof(*ev));
+ ev->type = V4L2_EVENT_CTRL;
+ ev->id = ctrl->id;
+ ev->u.ctrl.changes = changes;
+diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c
+index f2b733275a0a..f600bdcaf5b4 100644
+--- a/drivers/mmc/card/block.c
++++ b/drivers/mmc/card/block.c
+@@ -47,13 +47,10 @@
+ #include "queue.h"
+
+ MODULE_ALIAS("mmc:block");
+-
+-#ifdef KERNEL
+ #ifdef MODULE_PARAM_PREFIX
+ #undef MODULE_PARAM_PREFIX
+ #endif
+ #define MODULE_PARAM_PREFIX "mmcblk."
+-#endif
+
+ #define INAND_CMD38_ARG_EXT_CSD 113
+ #define INAND_CMD38_ARG_ERASE 0x00
+@@ -171,11 +168,7 @@ static struct mmc_blk_data *mmc_blk_get(struct gendisk
*disk)
+
+ static inline int mmc_get_devidx(struct gendisk *disk)
+ {
+- int devmaj = MAJOR(disk_devt(disk));
+- int devidx = MINOR(disk_devt(disk)) / perdev_minors;
+-
+- if (!devmaj)
+- devidx = disk->first_minor / perdev_minors;
++ int devidx = disk->first_minor / perdev_minors;
+ return devidx;
+ }
+
+@@ -2252,6 +2245,7 @@ static struct mmc_blk_data *mmc_blk_alloc_req(struct
mmc_card *card,
+ md->disk->queue = md->queue.queue;
+ md->disk->driverfs_dev = parent;
+ set_disk_ro(md->disk, md->read_only || default_ro);
++ md->disk->flags = GENHD_FL_EXT_DEVT;
+ if (area_type & (MMC_BLK_DATA_AREA_RPMB | MMC_BLK_DATA_AREA_BOOT))
+ md->disk->flags |= GENHD_FL_NO_PART_SCAN;
+
+diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
+index 299a83f1ad38..df074f8c7cb7 100644
+--- a/drivers/mmc/core/core.c
++++ b/drivers/mmc/core/core.c
+@@ -1039,7 +1039,7 @@ static inline void mmc_set_ios(struct mmc_host *host)
+ "width %u timing %u\n",
+ mmc_hostname(host), ios->clock, ios->bus_mode,
+ ios->power_mode, ios->chip_select, ios->vdd,
+- ios->bus_width, ios->timing);
++ 1 << ios->bus_width, ios->timing);
+
+ host->ops->set_ios(host, ios);
+ }
+@@ -1220,8 +1220,12 @@ int mmc_of_parse_voltage(struct device_node *np, u32
*mask)
+
+ voltage_ranges = of_get_property(np, "voltage-ranges", &num_ranges);
+ num_ranges = num_ranges / sizeof(*voltage_ranges) / 2;
+- if (!voltage_ranges || !num_ranges) {
+- pr_info("%s: voltage-ranges unspecified\n", np->full_name);
++ if (!voltage_ranges) {
++ pr_debug("%s: voltage-ranges unspecified\n", np->full_name);
++ return -EINVAL;
++ }
++ if (!num_ranges) {
++ pr_err("%s: voltage-ranges empty\n", np->full_name);
+ return -EINVAL;
+ }
+
+diff --git a/drivers/mmc/core/debugfs.c b/drivers/mmc/core/debugfs.c
+index 154aced0b91b..705586dcd9fa 100644
+--- a/drivers/mmc/core/debugfs.c
++++ b/drivers/mmc/core/debugfs.c
+@@ -220,7 +220,7 @@ static int mmc_clock_opt_set(void *data, u64 val)
+ struct mmc_host *host = data;
+
+ /* We need this check due to input value is u64 */
+- if (val > host->f_max)
++ if (val != 0 && (val > host->f_max || val < host->f_min))
+ return -EINVAL;
+
+ mmc_claim_host(host);
+diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c
+index a31789be0840..7844baecf306 100644
+--- a/drivers/mmc/core/mmc.c
++++ b/drivers/mmc/core/mmc.c
+@@ -508,7 +508,7 @@ static int mmc_decode_ext_csd(struct mmc_card *card, u8
*ext_csd)
+ card->ext_csd.raw_bkops_status =
+ ext_csd[EXT_CSD_BKOPS_STATUS];
+ if (!card->ext_csd.man_bkops_en)
+- pr_info("%s: MAN_BKOPS_EN bit is not set\n",
++ pr_debug("%s: MAN_BKOPS_EN bit is not set\n",
+ mmc_hostname(card->host));
+ }
+
+@@ -952,7 +952,7 @@ static int mmc_select_bus_width(struct mmc_card *card)
+ break;
+ } else {
+ pr_warn("%s: switch to bus width %d failed\n",
+- mmc_hostname(host), ext_csd_bits[idx]);
++ mmc_hostname(host), 1 << bus_width);
+ }
+ }
+
+@@ -1251,10 +1251,11 @@ static int mmc_select_hs200(struct mmc_card *card)
+ {
+ struct mmc_host *host = card->host;
+ bool send_status = true;
+- unsigned int old_timing;
++ unsigned int old_timing, old_signal_voltage;
+ int err = -EINVAL;
+ u8 val;
+
++ old_signal_voltage = host->ios.signal_voltage;
+ if (card->mmc_avail_type & EXT_CSD_CARD_TYPE_HS200_1_2V)
+ err = __mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_120);
+
+@@ -1263,7 +1264,7 @@ static int mmc_select_hs200(struct mmc_card *card)
+
+ /* If fails try again during next card power cycle */
+ if (err)
+- goto err;
++ return err;
+
+ mmc_select_driver_type(card);
+
+@@ -1297,9 +1298,14 @@ static int mmc_select_hs200(struct mmc_card *card)
+ }
+ }
+ err:
+- if (err)
++ if (err) {
++ /* fall back to the old signal voltage, if fails report error */
++ if (__mmc_set_signal_voltage(host, old_signal_voltage))
++ err = -EIO;
++
+ pr_err("%s: %s failed, error %d\n", mmc_hostname(card->host),
+ __func__, err);
++ }
+ return err;
+ }
+
+diff --git a/drivers/mmc/core/mmc_ops.c b/drivers/mmc/core/mmc_ops.c
+index 1f444269ebbe..76b49b9772d0 100644
+--- a/drivers/mmc/core/mmc_ops.c
++++ b/drivers/mmc/core/mmc_ops.c
+@@ -542,7 +542,7 @@ int __mmc_switch(struct mmc_card *card, u8 set, u8 index,
u8 value,
+ timeout_ms = MMC_OPS_TIMEOUT_MS;
+
+ /* Must check status to be sure of no errors. */
+- timeout = jiffies + msecs_to_jiffies(timeout_ms);
++ timeout = jiffies + msecs_to_jiffies(timeout_ms) + 1;
+ do {
+ if (send_status) {
+ err = __mmc_send_status(card, &status, ignore_crc);
+diff --git a/drivers/mmc/core/pwrseq_simple.c
b/drivers/mmc/core/pwrseq_simple.c
+index d10538bb5e07..96f45caea109 100644
+--- a/drivers/mmc/core/pwrseq_simple.c
++++ b/drivers/mmc/core/pwrseq_simple.c
+@@ -29,15 +29,18 @@ struct mmc_pwrseq_simple {
+ static void mmc_pwrseq_simple_set_gpios_value(struct mmc_pwrseq_simple
*pwrseq,
+ int value)
+ {
+- int i;
+ struct gpio_descs *reset_gpios = pwrseq->reset_gpios;
+- int values[reset_gpios->ndescs];
+
+- for (i = 0; i < reset_gpios->ndescs; i++)
+- values[i] = value;
++ if (!IS_ERR(reset_gpios)) {
++ int i;
++ int values[reset_gpios->ndescs];
+
+- gpiod_set_array_value_cansleep(reset_gpios->ndescs, reset_gpios->desc,
+- values);
++ for (i = 0; i < reset_gpios->ndescs; i++)
++ values[i] = value;
++
++ gpiod_set_array_value_cansleep(
++ reset_gpios->ndescs, reset_gpios->desc, values);
++ }
+ }
+
+ static void mmc_pwrseq_simple_pre_power_on(struct mmc_host *host)
+@@ -79,7 +82,8 @@ static void mmc_pwrseq_simple_free(struct mmc_host *host)
+ struct mmc_pwrseq_simple *pwrseq = container_of(host->pwrseq,
+ struct mmc_pwrseq_simple, pwrseq);
+
+- gpiod_put_array(pwrseq->reset_gpios);
++ if (!IS_ERR(pwrseq->reset_gpios))
++ gpiod_put_array(pwrseq->reset_gpios);
+
+ if (!IS_ERR(pwrseq->ext_clk))
+ clk_put(pwrseq->ext_clk);
+@@ -112,7 +116,9 @@ struct mmc_pwrseq *mmc_pwrseq_simple_alloc(struct mmc_host
*host,
+ }
+
+ pwrseq->reset_gpios = gpiod_get_array(dev, "reset", GPIOD_OUT_HIGH);
+- if (IS_ERR(pwrseq->reset_gpios)) {
++ if (IS_ERR(pwrseq->reset_gpios) &&
++ PTR_ERR(pwrseq->reset_gpios) != -ENOENT &&
++ PTR_ERR(pwrseq->reset_gpios) != -ENOSYS) {
+ ret = PTR_ERR(pwrseq->reset_gpios);
+ goto clk_put;
+ }
+diff --git a/drivers/mmc/host/pxamci.c b/drivers/mmc/host/pxamci.c
+index 72bbb12fb938..1d57c12b191c 100644
+--- a/drivers/mmc/host/pxamci.c
++++ b/drivers/mmc/host/pxamci.c
+@@ -181,7 +181,7 @@ static void pxamci_dma_irq(void *param);
+ static void pxamci_setup_data(struct pxamci_host *host, struct mmc_data *data)
+ {
+ struct dma_async_tx_descriptor *tx;
+- enum dma_data_direction direction;
++ enum dma_transfer_direction direction;
+ struct dma_slave_config config;
+ struct dma_chan *chan;
+ unsigned int nob = data->blocks;
+diff --git a/drivers/mmc/host/tmio_mmc_pio.c b/drivers/mmc/host/tmio_mmc_pio.c
+index a10fde40b6c3..3c7c3a1c8f4f 100644
+--- a/drivers/mmc/host/tmio_mmc_pio.c
++++ b/drivers/mmc/host/tmio_mmc_pio.c
+@@ -716,7 +716,7 @@ irqreturn_t tmio_mmc_sdio_irq(int irq, void *devid)
+ unsigned int sdio_status;
+
+ if (!(pdata->flags & TMIO_MMC_SDIO_IRQ))
+- return IRQ_HANDLED;
++ return IRQ_NONE;
+
+ status = sd_ctrl_read16(host, CTL_SDIO_STATUS);
+ ireg = status & TMIO_SDIO_MASK_ALL & ~host->sdcard_irq_mask;
+@@ -730,7 +730,7 @@ irqreturn_t tmio_mmc_sdio_irq(int irq, void *devid)
+ if (mmc->caps & MMC_CAP_SDIO_IRQ && ireg & TMIO_SDIO_STAT_IOIRQ)
+ mmc_signal_sdio_irq(mmc);
+
+- return IRQ_HANDLED;
++ return IRQ_RETVAL(ireg);
+ }
+ EXPORT_SYMBOL(tmio_mmc_sdio_irq);
+
+@@ -747,9 +747,7 @@ irqreturn_t tmio_mmc_irq(int irq, void *devid)
+ if (__tmio_mmc_sdcard_irq(host, ireg, status))
+ return IRQ_HANDLED;
+
+- tmio_mmc_sdio_irq(irq, devid);
+-
+- return IRQ_HANDLED;
++ return tmio_mmc_sdio_irq(irq, devid);
+ }
+ EXPORT_SYMBOL(tmio_mmc_irq);
+
+diff --git a/drivers/net/ethernet/8390/mac8390.c
b/drivers/net/ethernet/8390/mac8390.c
+index b9283901136e..0fdc9ad32a2e 100644
+--- a/drivers/net/ethernet/8390/mac8390.c
++++ b/drivers/net/ethernet/8390/mac8390.c
+@@ -156,8 +156,6 @@ static void dayna_block_output(struct net_device *dev, int
count,
+ #define memcpy_fromio(a, b, c) memcpy((a), (void *)(b), (c))
+ #define memcpy_toio(a, b, c) memcpy((void *)(a), (b), (c))
+
+-#define memcmp_withio(a, b, c) memcmp((a), (void *)(b), (c))
+-
+ /* Slow Sane (16-bit chunk memory read/write) Cabletron uses this */
+ static void slow_sane_get_8390_hdr(struct net_device *dev,
+ struct e8390_pkt_hdr *hdr, int ring_page);
+@@ -237,19 +235,26 @@ static enum mac8390_type __init mac8390_ident(struct
nubus_dev *dev)
+
+ static enum mac8390_access __init mac8390_testio(volatile unsigned long
membase)
+ {
+- unsigned long outdata = 0xA5A0B5B0;
+- unsigned long indata = 0x00000000;
++ u32 outdata = 0xA5A0B5B0;
++ u32 indata = 0;
++
+ /* Try writing 32 bits */
+- memcpy_toio(membase, &outdata, 4);
+- /* Now compare them */
+- if (memcmp_withio(&outdata, membase, 4) == 0)
++ nubus_writel(outdata, membase);
++ /* Now read it back */
++ indata = nubus_readl(membase);
++ if (outdata == indata)
+ return ACCESS_32;
++
++ outdata = 0xC5C0D5D0;
++ indata = 0;
++
+ /* Write 16 bit output */
+ word_memcpy_tocard(membase, &outdata, 4);
+ /* Now read it back */
+ word_memcpy_fromcard(&indata, membase, 4);
+ if (outdata == indata)
+ return ACCESS_16;
++
+ return ACCESS_UNKNOWN;
+ }
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index 7bba30f24135..059113dce6e0 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -2529,6 +2529,20 @@ static int stmmac_ioctl(struct net_device *dev, struct
ifreq *rq, int cmd)
+ return ret;
+ }
+
++static int stmmac_set_mac_address(struct net_device *ndev, void *addr)
++{
++ struct stmmac_priv *priv = netdev_priv(ndev);
++ int ret = 0;
++
++ ret = eth_mac_addr(ndev, addr);
++ if (ret)
++ return ret;
++
++ priv->hw->mac->set_umac_addr(priv->hw, ndev->dev_addr, 0);
++
++ return ret;
++}
++
+ #ifdef CONFIG_DEBUG_FS
+ static struct dentry *stmmac_fs_dir;
+
+@@ -2730,7 +2744,7 @@ static const struct net_device_ops stmmac_netdev_ops = {
+ #ifdef CONFIG_NET_POLL_CONTROLLER
+ .ndo_poll_controller = stmmac_poll_controller,
+ #endif
+- .ndo_set_mac_address = eth_mac_addr,
++ .ndo_set_mac_address = stmmac_set_mac_address,
+ };
+
+ /**
+diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
+index 5dadfc508ade..835129152fc4 100644
+--- a/drivers/net/vxlan.c
++++ b/drivers/net/vxlan.c
+@@ -3276,10 +3276,8 @@ static void __net_exit vxlan_exit_net(struct net *net)
+ /* If vxlan->dev is in the same netns, it has already been added
+ * to the list by the previous loop.
+ */
+- if (!net_eq(dev_net(vxlan->dev), net)) {
+- gro_cells_destroy(&vxlan->gro_cells);
++ if (!net_eq(dev_net(vxlan->dev), net))
+ unregister_netdevice_queue(vxlan->dev, &list);
+- }
+ }
+
+ unregister_netdevice_many(&list);
+diff --git a/drivers/net/wireless/ath/ath10k/wmi.c
b/drivers/net/wireless/ath/ath10k/wmi.c
+index f201e50447d8..b867875aa6e6 100644
+--- a/drivers/net/wireless/ath/ath10k/wmi.c
++++ b/drivers/net/wireless/ath/ath10k/wmi.c
+@@ -4065,7 +4065,7 @@ static void ath10k_tpc_config_disp_tables(struct ath10k
*ar,
+ rate_code[i],
+ type);
+ snprintf(buff, sizeof(buff), "%8d ", tpc[j]);
+- strncat(tpc_value, buff, strlen(buff));
++ strlcat(tpc_value, buff, sizeof(tpc_value));
+ }
+ tpc_stats->tpc_table[type].pream_idx[i] = pream_idx;
+ tpc_stats->tpc_table[type].rate_code[i] = rate_code[i];
+diff --git a/drivers/rtc/rtc-lib.c b/drivers/rtc/rtc-lib.c
+index e6bfb9c42a10..5b136bdc03d4 100644
+--- a/drivers/rtc/rtc-lib.c
++++ b/drivers/rtc/rtc-lib.c
+@@ -52,13 +52,11 @@ EXPORT_SYMBOL(rtc_year_days);
+ */
+ void rtc_time64_to_tm(time64_t time, struct rtc_time *tm)
+ {
+- unsigned int month, year;
+- unsigned long secs;
++ unsigned int month, year, secs;
+ int days;
+
+ /* time must be positive */
+- days = div_s64(time, 86400);
+- secs = time - (unsigned int) days * 86400;
++ days = div_s64_rem(time, 86400, &secs);
+
+ /* day of the week, 1970-01-01 was a Thursday */
+ tm->tm_wday = (days + 4) % 7;
+diff --git a/drivers/s390/scsi/zfcp_erp.c b/drivers/s390/scsi/zfcp_erp.c
+index 2abcd331b05d..abe460eac712 100644
+--- a/drivers/s390/scsi/zfcp_erp.c
++++ b/drivers/s390/scsi/zfcp_erp.c
+@@ -652,6 +652,20 @@ static void zfcp_erp_strategy_memwait(struct
zfcp_erp_action *erp_action)
+ add_timer(&erp_action->timer);
+ }
+
++void zfcp_erp_port_forced_reopen_all(struct zfcp_adapter *adapter,
++ int clear, char *dbftag)
++{
++ unsigned long flags;
++ struct zfcp_port *port;
++
++ write_lock_irqsave(&adapter->erp_lock, flags);
++ read_lock(&adapter->port_list_lock);
++ list_for_each_entry(port, &adapter->port_list, list)
++ _zfcp_erp_port_forced_reopen(port, clear, dbftag);
++ read_unlock(&adapter->port_list_lock);
++ write_unlock_irqrestore(&adapter->erp_lock, flags);
++}
++
+ static void _zfcp_erp_port_reopen_all(struct zfcp_adapter *adapter,
+ int clear, char *id)
+ {
+@@ -1306,6 +1320,9 @@ static void zfcp_erp_try_rport_unblock(struct zfcp_port
*port)
+ struct zfcp_scsi_dev *zsdev = sdev_to_zfcp(sdev);
+ int lun_status;
+
++ if (sdev->sdev_state == SDEV_DEL ||
++ sdev->sdev_state == SDEV_CANCEL)
++ continue;
+ if (zsdev->port != port)
+ continue;
+ /* LUN under port of interest */
+diff --git a/drivers/s390/scsi/zfcp_ext.h b/drivers/s390/scsi/zfcp_ext.h
+index b326f05c7f89..a39a74500e23 100644
+--- a/drivers/s390/scsi/zfcp_ext.h
++++ b/drivers/s390/scsi/zfcp_ext.h
+@@ -68,6 +68,8 @@ extern void zfcp_erp_clear_port_status(struct zfcp_port *,
u32);
+ extern int zfcp_erp_port_reopen(struct zfcp_port *, int, char *);
+ extern void zfcp_erp_port_shutdown(struct zfcp_port *, int, char *);
+ extern void zfcp_erp_port_forced_reopen(struct zfcp_port *, int, char *);
++extern void zfcp_erp_port_forced_reopen_all(struct zfcp_adapter *adapter,
++ int clear, char *dbftag);
+ extern void zfcp_erp_set_lun_status(struct scsi_device *, u32);
+ extern void zfcp_erp_clear_lun_status(struct scsi_device *, u32);
+ extern void zfcp_erp_lun_reopen(struct scsi_device *, int, char *);
+diff --git a/drivers/s390/scsi/zfcp_scsi.c b/drivers/s390/scsi/zfcp_scsi.c
+index 3afb200b2829..bdb257eaa2e5 100644
+--- a/drivers/s390/scsi/zfcp_scsi.c
++++ b/drivers/s390/scsi/zfcp_scsi.c
+@@ -326,6 +326,10 @@ static int zfcp_scsi_eh_host_reset_handler(struct
scsi_cmnd *scpnt)
+ struct zfcp_adapter *adapter = zfcp_sdev->port->adapter;
+ int ret = SUCCESS, fc_ret;
+
++ if (!(adapter->connection_features & FSF_FEATURE_NPIV_MODE)) {
++ zfcp_erp_port_forced_reopen_all(adapter, 0, "schrh_p");
++ zfcp_erp_wait(adapter);
++ }
+ zfcp_erp_adapter_reopen(adapter, 0, "schrh_1");
+ zfcp_erp_wait(adapter);
+ fc_ret = fc_block_scsi_eh(scpnt);
+diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
+index ec80a0077ace..62adaca8fb97 100644
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -1276,11 +1276,6 @@ static void sd_release(struct gendisk *disk, fmode_t
mode)
+ scsi_set_medium_removal(sdev, SCSI_REMOVAL_ALLOW);
+ }
+
+- /*
+- * XXX and what if there are packets in flight and this close()
+- * XXX is followed by a "rmmod sd_mod"?
+- */
+-
+ scsi_disk_put(sdkp);
+ }
+
+@@ -3227,11 +3222,23 @@ static void scsi_disk_release(struct device *dev)
+ {
+ struct scsi_disk *sdkp = to_scsi_disk(dev);
+ struct gendisk *disk = sdkp->disk;
+-
++ struct request_queue *q = disk->queue;
++
+ spin_lock(&sd_index_lock);
+ ida_remove(&sd_index_ida, sdkp->index);
+ spin_unlock(&sd_index_lock);
+
++ /*
++ * Wait until all requests that are in progress have completed.
++ * This is necessary to avoid that e.g. scsi_end_request() crashes
++ * due to clearing the disk->private_data pointer. Wait from inside
++ * scsi_disk_release() instead of from sd_release() to avoid that
++ * freezing and unfreezing the request queue affects user space I/O
++ * in case multiple processes open a /dev/sd... node concurrently.
++ */
++ blk_mq_freeze_queue(q);
++ blk_mq_unfreeze_queue(q);
++
+ disk->private_data = NULL;
+ put_disk(disk);
+ put_device(&sdkp->device->sdev_gendev);
+diff --git a/drivers/staging/android/ashmem.c
b/drivers/staging/android/ashmem.c
+index e9c74c41aece..b4c425383f99 100644
+--- a/drivers/staging/android/ashmem.c
++++ b/drivers/staging/android/ashmem.c
+@@ -447,7 +447,9 @@ ashmem_shrink_scan(struct shrinker *shrink, struct
shrink_control *sc)
+ if (!(sc->gfp_mask & __GFP_FS))
+ return SHRINK_STOP;
+
+- mutex_lock(&ashmem_mutex);
++ if (!mutex_trylock(&ashmem_mutex))
++ return -1;
++
+ list_for_each_entry_safe(range, next, &ashmem_lru_list, lru) {
+ loff_t start = range->pgstart * PAGE_SIZE;
+ loff_t end = (range->pgend + 1) * PAGE_SIZE;
+diff --git a/drivers/staging/android/ion/ion_carveout_heap.c
b/drivers/staging/android/ion/ion_carveout_heap.c
+index 9156d8238c97..e702ce6461fc 100644
+--- a/drivers/staging/android/ion/ion_carveout_heap.c
++++ b/drivers/staging/android/ion/ion_carveout_heap.c
+@@ -167,7 +167,7 @@ struct ion_heap *ion_carveout_heap_create(struct
ion_platform_heap *heap_data)
+ if (!carveout_heap)
+ return ERR_PTR(-ENOMEM);
+
+- carveout_heap->pool = gen_pool_create(12, -1);
++ carveout_heap->pool = gen_pool_create(PAGE_SHIFT, -1);
+ if (!carveout_heap->pool) {
+ kfree(carveout_heap);
+ return ERR_PTR(-ENOMEM);
+diff --git a/drivers/staging/android/sync.c b/drivers/staging/android/sync.c
+index f83e00c78051..50a9945da27e 100644
+--- a/drivers/staging/android/sync.c
++++ b/drivers/staging/android/sync.c
+@@ -519,12 +519,10 @@ static const struct fence_ops android_fence_ops = {
+ static void sync_fence_free(struct kref *kref)
+ {
+ struct sync_fence *fence = container_of(kref, struct sync_fence, kref);
+- int i, status = atomic_read(&fence->status);
++ int i;
+
+ for (i = 0; i < fence->num_fences; ++i) {
+- if (status)
+- fence_remove_callback(fence->cbs[i].sync_pt,
+- &fence->cbs[i].cb);
++ fence_remove_callback(fence->cbs[i].sync_pt, &fence->cbs[i].cb);
+ fence_put(fence->cbs[i].sync_pt);
+ }
+
+diff --git a/drivers/staging/android/uapi/ashmem.h
b/drivers/staging/android/uapi/ashmem.h
+index ba4743c71d6b..13df42d200b7 100644
+--- a/drivers/staging/android/uapi/ashmem.h
++++ b/drivers/staging/android/uapi/ashmem.h
+@@ -13,6 +13,7 @@
+ #define _UAPI_LINUX_ASHMEM_H
+
+ #include <linux/ioctl.h>
++#include <linux/types.h>
+
+ #define ASHMEM_NAME_LEN 256
+
+diff --git a/drivers/staging/goldfish/goldfish_audio.c
b/drivers/staging/goldfish/goldfish_audio.c
+index b0927e49d0a8..6ca288bf4059 100644
+--- a/drivers/staging/goldfish/goldfish_audio.c
++++ b/drivers/staging/goldfish/goldfish_audio.c
+@@ -26,6 +26,7 @@
+ #include <linux/sched.h>
+ #include <linux/dma-mapping.h>
+ #include <linux/uaccess.h>
++#include <linux/slab.h>
+ #include <linux/goldfish.h>
+
+ MODULE_AUTHOR("Google, Inc.");
+diff --git a/drivers/staging/vt6655/device_main.c
b/drivers/staging/vt6655/device_main.c
+index 8fd8f3a2d1bf..58b6403458b7 100644
+--- a/drivers/staging/vt6655/device_main.c
++++ b/drivers/staging/vt6655/device_main.c
+@@ -972,8 +972,6 @@ static void vnt_interrupt_process(struct vnt_private *priv)
+ return;
+ }
+
+- MACvIntDisable(priv->PortOffset);
+-
+ spin_lock_irqsave(&priv->lock, flags);
+
+ /* Read low level stats */
+@@ -1062,8 +1060,6 @@ static void vnt_interrupt_process(struct vnt_private
*priv)
+ }
+
+ spin_unlock_irqrestore(&priv->lock, flags);
+-
+- MACvIntEnable(priv->PortOffset, IMR_MASK_VALUE);
+ }
+
+ static void vnt_interrupt_work(struct work_struct *work)
+@@ -1073,14 +1069,17 @@ static void vnt_interrupt_work(struct work_struct
*work)
+
+ if (priv->vif)
+ vnt_interrupt_process(priv);
++
++ MACvIntEnable(priv->PortOffset, IMR_MASK_VALUE);
+ }
+
+ static irqreturn_t vnt_interrupt(int irq, void *arg)
+ {
+ struct vnt_private *priv = arg;
+
+- if (priv->vif)
+- schedule_work(&priv->interrupt_work);
++ schedule_work(&priv->interrupt_work);
++
++ MACvIntDisable(priv->PortOffset);
+
+ return IRQ_HANDLED;
+ }
+diff --git a/drivers/tty/serial/atmel_serial.c
b/drivers/tty/serial/atmel_serial.c
+index e0277cf0bf58..f5c4e92b5172 100644
+--- a/drivers/tty/serial/atmel_serial.c
++++ b/drivers/tty/serial/atmel_serial.c
+@@ -1167,6 +1167,10 @@ static int atmel_prepare_rx_dma(struct uart_port *port)
+ sg_dma_len(&atmel_port->sg_rx)/2,
+ DMA_DEV_TO_MEM,
+ DMA_PREP_INTERRUPT);
++ if (!desc) {
++ dev_err(port->dev, "Preparing DMA cyclic failed\n");
++ goto chan_err;
++ }
+ desc->callback = atmel_complete_rx_dma;
+ desc->callback_param = port;
+ atmel_port->desc_rx = desc;
+diff --git a/drivers/tty/serial/kgdboc.c b/drivers/tty/serial/kgdboc.c
+index f2b0d8cee8ef..0314e78e31ff 100644
+--- a/drivers/tty/serial/kgdboc.c
++++ b/drivers/tty/serial/kgdboc.c
+@@ -148,8 +148,10 @@ static int configure_kgdboc(void)
+ char *cptr = config;
+ struct console *cons;
+
+- if (!strlen(config) || isspace(config[0]))
++ if (!strlen(config) || isspace(config[0])) {
++ err = 0;
+ goto noconfig;
++ }
+
+ kgdboc_io_ops.is_console = 0;
+ kgdb_tty_driver = NULL;
+diff --git a/drivers/tty/serial/max310x.c b/drivers/tty/serial/max310x.c
+index d45133056f51..be55fb6def89 100644
+--- a/drivers/tty/serial/max310x.c
++++ b/drivers/tty/serial/max310x.c
+@@ -1306,6 +1306,8 @@ static int max310x_spi_probe(struct spi_device *spi)
+ if (spi->dev.of_node) {
+ const struct of_device_id *of_id =
+ of_match_device(max310x_dt_ids, &spi->dev);
++ if (!of_id)
++ return -ENODEV;
+
+ devtype = (struct max310x_devtype *)of_id->data;
+ } else {
+diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
+index b63920481b1d..669134e27ed9 100644
+--- a/drivers/tty/serial/sh-sci.c
++++ b/drivers/tty/serial/sh-sci.c
+@@ -746,19 +746,9 @@ static void sci_transmit_chars(struct uart_port *port)
+
+ if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS)
+ uart_write_wakeup(port);
+- if (uart_circ_empty(xmit)) {
++ if (uart_circ_empty(xmit))
+ sci_stop_tx(port);
+- } else {
+- ctrl = serial_port_in(port, SCSCR);
+-
+- if (port->type != PORT_SCI) {
+- serial_port_in(port, SCxSR); /* Dummy read */
+- sci_clear_SCxSR(port, SCxSR_TDxE_CLEAR(port));
+- }
+
+- ctrl |= SCSCR_TIE;
+- serial_port_out(port, SCSCR, ctrl);
+- }
+ }
+
+ /* On SH3, SCIF may read end-of-break as a space->mark char */
+diff --git a/drivers/tty/serial/sprd_serial.c
b/drivers/tty/serial/sprd_serial.c
+index 1e302caaa450..c894eca57e73 100644
+--- a/drivers/tty/serial/sprd_serial.c
++++ b/drivers/tty/serial/sprd_serial.c
+@@ -36,7 +36,7 @@
+ #define SPRD_FIFO_SIZE 128
+ #define SPRD_DEF_RATE 26000000
+ #define SPRD_BAUD_IO_LIMIT 3000000
+-#define SPRD_TIMEOUT 256
++#define SPRD_TIMEOUT 256000
+
+ /* the offset of serial registers and BITs for them */
+ /* data registers */
+@@ -63,6 +63,7 @@
+
+ /* interrupt clear register */
+ #define SPRD_ICLR 0x0014
++#define SPRD_ICLR_TIMEOUT BIT(13)
+
+ /* line control register */
+ #define SPRD_LCR 0x0018
+@@ -298,7 +299,8 @@ static irqreturn_t sprd_handle_irq(int irq, void *dev_id)
+ return IRQ_NONE;
+ }
+
+- serial_out(port, SPRD_ICLR, ~0);
++ if (ims & SPRD_IMSR_TIMEOUT)
++ serial_out(port, SPRD_ICLR, SPRD_ICLR_TIMEOUT);
+
+ if (ims & (SPRD_IMSR_RX_FIFO_FULL |
+ SPRD_IMSR_BREAK_DETECT | SPRD_IMSR_TIMEOUT))
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index 557f08adf644..5e015631413c 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -2894,6 +2894,9 @@ void dwc3_gadget_exit(struct dwc3 *dwc)
+
+ int dwc3_gadget_suspend(struct dwc3 *dwc)
+ {
++ if (!dwc->gadget_driver)
++ return 0;
++
+ if (dwc->pullups_connected) {
+ dwc3_gadget_disable_irq(dwc);
+ dwc3_gadget_run_stop(dwc, true, true);
+@@ -2912,6 +2915,9 @@ int dwc3_gadget_resume(struct dwc3 *dwc)
+ struct dwc3_ep *dep;
+ int ret;
+
++ if (!dwc->gadget_driver)
++ return 0;
++
+ /* Start with SuperSpeed Default */
+ dwc3_gadget_ep0_desc.wMaxPacketSize = cpu_to_le16(512);
+
+diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
+index 58f5fbdb6959..8bf54477f472 100644
+--- a/drivers/usb/gadget/composite.c
++++ b/drivers/usb/gadget/composite.c
+@@ -1819,6 +1819,8 @@ unknown:
+ break;
+
+ case USB_RECIP_ENDPOINT:
++ if (!cdev->config)
++ break;
+ endp = ((w_index & 0x80) >> 3) | (w_index & 0x0f);
+ list_for_each_entry(f, &cdev->config->functions, list) {
+ if (test_bit(endp, f->endpoints))
+diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
+index 6abb6a10ee82..d412e234f336 100644
+--- a/drivers/usb/gadget/configfs.c
++++ b/drivers/usb/gadget/configfs.c
+@@ -1496,7 +1496,9 @@ void unregister_gadget_item(struct config_item *item)
+ {
+ struct gadget_info *gi = to_gadget_info(item);
+
++ mutex_lock(&gi->lock);
+ unregister_gadget(gi);
++ mutex_unlock(&gi->lock);
+ }
+ EXPORT_SYMBOL_GPL(unregister_gadget_item);
+
+diff --git a/drivers/usb/gadget/function/rndis.c
b/drivers/usb/gadget/function/rndis.c
+index 70d3917cc003..2582db38d6a6 100644
+--- a/drivers/usb/gadget/function/rndis.c
++++ b/drivers/usb/gadget/function/rndis.c
+@@ -680,6 +680,12 @@ static int rndis_reset_response(struct rndis_params
*params,
+ {
+ rndis_reset_cmplt_type *resp;
+ rndis_resp_t *r;
++ u8 *xbuf;
++ u32 length;
++
++ /* drain the response queue */
++ while ((xbuf = rndis_get_next_response(params, &length)))
++ rndis_free_response(params, xbuf);
+
+ r = rndis_add_response(params, sizeof(rndis_reset_cmplt_type));
+ if (!r)
+diff --git a/drivers/usb/gadget/function/u_serial.c
b/drivers/usb/gadget/function/u_serial.c
+index 4ea44f7122ee..d73618475664 100644
+--- a/drivers/usb/gadget/function/u_serial.c
++++ b/drivers/usb/gadget/function/u_serial.c
+@@ -361,10 +361,15 @@ __acquires(&port->port_lock)
+ */
+ {
+ struct list_head *pool = &port->write_pool;
+- struct usb_ep *in = port->port_usb->in;
++ struct usb_ep *in;
+ int status = 0;
+ bool do_tty_wake = false;
+
++ if (!port->port_usb)
++ return status;
++
++ in = port->port_usb->in;
++
+ while (!port->write_busy && !list_empty(pool)) {
+ struct usb_request *req;
+ int len;
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index 845fa426fa0d..80192698df87 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -1642,10 +1642,13 @@ static void handle_port_status(struct xhci_hcd *xhci,
+ }
+ }
+
+- if ((temp & PORT_PLC) && (temp & PORT_PLS_MASK) == XDEV_U0 &&
+- DEV_SUPERSPEED_ANY(temp)) {
++ if ((temp & PORT_PLC) &&
++ DEV_SUPERSPEED_ANY(temp) &&
++ ((temp & PORT_PLS_MASK) == XDEV_U0 ||
++ (temp & PORT_PLS_MASK) == XDEV_U1 ||
++ (temp & PORT_PLS_MASK) == XDEV_U2)) {
+ xhci_dbg(xhci, "resume SS port %d finished\n", port_id);
+- /* We've just brought the device into U0 through either the
++ /* We've just brought the device into U0/1/2 through either the
+ * Resume state after a device remote wakeup, or through the
+ * U3Exit state after a host-initiated resume. If it's a device
+ * initiated remote wake, don't pass up the link state change,
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index 0635cea42e6f..b57bee70cdef 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -309,6 +309,7 @@ struct xhci_op_regs {
+ */
+ #define PORT_PLS_MASK (0xf << 5)
+ #define XDEV_U0 (0x0 << 5)
++#define XDEV_U1 (0x1 << 5)
+ #define XDEV_U2 (0x2 << 5)
+ #define XDEV_U3 (0x3 << 5)
+ #define XDEV_INACTIVE (0x6 << 5)
+diff --git a/drivers/usb/renesas_usbhs/mod_gadget.c
b/drivers/usb/renesas_usbhs/mod_gadget.c
+index 8647d2c2a8c4..c5553028e616 100644
+--- a/drivers/usb/renesas_usbhs/mod_gadget.c
++++ b/drivers/usb/renesas_usbhs/mod_gadget.c
+@@ -641,14 +641,11 @@ static int usbhsg_ep_disable(struct usb_ep *ep)
+ struct usbhsg_uep *uep = usbhsg_ep_to_uep(ep);
+ struct usbhs_pipe *pipe;
+ unsigned long flags;
+- int ret = 0;
+
+ spin_lock_irqsave(&uep->lock, flags);
+ pipe = usbhsg_uep_to_pipe(uep);
+- if (!pipe) {
+- ret = -EINVAL;
++ if (!pipe)
+ goto out;
+- }
+
+ usbhsg_pipe_disable(uep);
+ usbhs_pipe_free(pipe);
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index b317594a6342..e3ea0fdd3913 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -76,6 +76,7 @@ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(0x10C4, 0x804E) }, /* Software Bisque Paramount ME
build-in converter */
+ { USB_DEVICE(0x10C4, 0x8053) }, /* Enfora EDG1228 */
+ { USB_DEVICE(0x10C4, 0x8054) }, /* Enfora GSM2228 */
++ { USB_DEVICE(0x10C4, 0x8056) }, /* Lorenz Messtechnik devices */
+ { USB_DEVICE(0x10C4, 0x8066) }, /* Argussoft In-System Programmer */
+ { USB_DEVICE(0x10C4, 0x806F) }, /* IMS USB to RS422 Converter Cable */
+ { USB_DEVICE(0x10C4, 0x807A) }, /* Crumb128 board */
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index 4287e2b1c175..af258bb632dd 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -604,6 +604,8 @@ static const struct usb_device_id id_table_combined[] = {
+ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+ { USB_DEVICE(FTDI_VID, FTDI_NT_ORIONLXM_PID),
+ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
++ { USB_DEVICE(FTDI_VID, FTDI_NT_ORIONLX_PLUS_PID) },
++ { USB_DEVICE(FTDI_VID, FTDI_NT_ORION_IO_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_SYNAPSE_SS200_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX2_PID) },
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h
b/drivers/usb/serial/ftdi_sio_ids.h
+index ddf5ab983dc9..15d220eaf6e6 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -566,7 +566,9 @@
+ /*
+ * NovaTech product ids (FTDI_VID)
+ */
+-#define FTDI_NT_ORIONLXM_PID 0x7c90 /* OrionLXm Substation Automation
Platform */
++#define FTDI_NT_ORIONLXM_PID 0x7c90 /* OrionLXm Substation
Automation Platform */
++#define FTDI_NT_ORIONLX_PLUS_PID 0x7c91 /* OrionLX+ Substation
Automation Platform */
++#define FTDI_NT_ORION_IO_PID 0x7c92 /* Orion I/O */
+
+ /*
+ * Synapse Wireless product ids (FTDI_VID)
+diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c
+index 4581fa1dec98..286b43c79d38 100644
+--- a/drivers/usb/serial/mos7720.c
++++ b/drivers/usb/serial/mos7720.c
+@@ -368,8 +368,6 @@ static int write_parport_reg_nonblock(struct
mos7715_parport *mos_parport,
+ if (!urbtrack)
+ return -ENOMEM;
+
+- kref_get(&mos_parport->ref_count);
+- urbtrack->mos_parport = mos_parport;
+ urbtrack->urb = usb_alloc_urb(0, GFP_ATOMIC);
+ if (!urbtrack->urb) {
+ kfree(urbtrack);
+@@ -390,6 +388,8 @@ static int write_parport_reg_nonblock(struct
mos7715_parport *mos_parport,
+ usb_sndctrlpipe(usbdev, 0),
+ (unsigned char *)urbtrack->setup,
+ NULL, 0, async_complete, urbtrack);
++ kref_get(&mos_parport->ref_count);
++ urbtrack->mos_parport = mos_parport;
+ kref_init(&urbtrack->ref_count);
+ INIT_LIST_HEAD(&urbtrack->urblist_entry);
+
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index b2b7c12e5c86..9f96dd274370 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1066,7 +1066,8 @@ static const struct usb_device_id option_ids[] = {
+ .driver_info = RSVD(3) },
+ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6613)}, /* Onda H600/ZTE MF330 */
+ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x0023)}, /* ONYX 3G device */
+- { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000)}, /* SIMCom SIM5218 */
++ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000), /* SIMCom SIM5218 */
++ .driver_info = NCTRL(0) | NCTRL(1) | NCTRL(2) | NCTRL(3) | RSVD(4) },
+ /* Quectel products using Qualcomm vendor ID */
+ { USB_DEVICE(QUALCOMM_VENDOR_ID, QUECTEL_PRODUCT_UC15)},
+ { USB_DEVICE(QUALCOMM_VENDOR_ID, QUECTEL_PRODUCT_UC20),
+@@ -1941,10 +1942,12 @@ static const struct usb_device_id option_ids[] = {
+ .driver_info = RSVD(4) },
+ { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e35, 0xff),
/* D-Link DWM-222 */
+ .driver_info = RSVD(4) },
+- { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /*
D-Link DWM-152/C1 */
+- { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /*
D-Link DWM-156/C1 */
+- { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) }, /*
D-Link DWM-156/A3 */
+- { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) }, /*
OLICARD300 - MT6225 */
++ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) },
/* D-Link DWM-152/C1 */
++ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) },
/* D-Link DWM-156/C1 */
++ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) },
/* D-Link DWM-156/A3 */
++ { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2031, 0xff),
/* Olicard 600 */
++ .driver_info = RSVD(4) },
++ { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) },
/* OLICARD300 - MT6225 */
+ { USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) },
+ { USB_DEVICE(VIATELECOM_VENDOR_ID, VIATELECOM_PRODUCT_CDS7) },
+ { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID,
WETELECOM_PRODUCT_WMD200, 0xff, 0xff, 0xff) },
+diff --git a/drivers/video/fbdev/goldfishfb.c
b/drivers/video/fbdev/goldfishfb.c
+index 14a93cb21310..66d58e93bc32 100644
+--- a/drivers/video/fbdev/goldfishfb.c
++++ b/drivers/video/fbdev/goldfishfb.c
+@@ -234,7 +234,7 @@ static int goldfish_fb_probe(struct platform_device *pdev)
+ fb->fb.var.activate = FB_ACTIVATE_NOW;
+ fb->fb.var.height = readl(fb->reg_base + FB_GET_PHYS_HEIGHT);
+ fb->fb.var.width = readl(fb->reg_base + FB_GET_PHYS_WIDTH);
+- fb->fb.var.pixclock = 10000;
++ fb->fb.var.pixclock = 0;
+
+ fb->fb.var.red.offset = 11;
+ fb->fb.var.red.length = 5;
+diff --git a/fs/btrfs/raid56.c b/fs/btrfs/raid56.c
+index b9fa99577bf7..2d2a76906786 100644
+--- a/fs/btrfs/raid56.c
++++ b/fs/btrfs/raid56.c
+@@ -2420,8 +2420,9 @@ static noinline void finish_parity_scrub(struct
btrfs_raid_bio *rbio,
+ bitmap_clear(rbio->dbitmap, pagenr, 1);
+ kunmap(p);
+
+- for (stripe = 0; stripe < rbio->real_stripes; stripe++)
++ for (stripe = 0; stripe < nr_data; stripe++)
+ kunmap(page_in_rbio(rbio, stripe, pagenr, 0));
++ kunmap(p_page);
+ }
+
+ __free_page(p_page);
+diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
+index 63f59f17c97e..c7190f322576 100644
+--- a/fs/btrfs/tree-log.c
++++ b/fs/btrfs/tree-log.c
+@@ -3321,9 +3321,16 @@ static noinline int log_dir_items(struct
btrfs_trans_handle *trans,
+ }
+ btrfs_release_path(path);
+
+- /* find the first key from this transaction again */
++ /*
++ * Find the first key from this transaction again. See the note for
++ * log_new_dir_dentries, if we're logging a directory recursively we
++ * won't be holding its i_mutex, which means we can modify the directory
++ * while we're logging it. If we remove an entry between our first
++ * search and this search we'll not find the key again and can just
++ * bail.
++ */
+ ret = btrfs_search_slot(NULL, root, &min_key, path, 0, 0);
+- if (WARN_ON(ret != 0))
++ if (ret != 0)
+ goto done;
+
+ /*
+diff --git a/fs/dcache.c b/fs/dcache.c
+index 9ffe60702299..cb554e406545 100644
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -1510,7 +1510,7 @@ static void check_and_drop(void *_data)
+ {
+ struct detach_data *data = _data;
+
+- if (!data->mountpoint && !data->select.found)
++ if (!data->mountpoint && list_empty(&data->select.dispose))
+ __d_drop(data->select.start);
+ }
+
+@@ -1552,17 +1552,15 @@ void d_invalidate(struct dentry *dentry)
+
+ d_walk(dentry, &data, detach_and_collect, check_and_drop);
+
+- if (data.select.found)
++ if (!list_empty(&data.select.dispose))
+ shrink_dentry_list(&data.select.dispose);
++ else if (!data.mountpoint)
++ return;
+
+ if (data.mountpoint) {
+ detach_mounts(data.mountpoint);
+ dput(data.mountpoint);
+ }
+-
+- if (!data.mountpoint && !data.select.found)
+- break;
+-
+ cond_resched();
+ }
+ }
+diff --git a/fs/ext4/ext4_jbd2.h b/fs/ext4/ext4_jbd2.h
+index f817ed58f5ad..b40e75dbf48c 100644
+--- a/fs/ext4/ext4_jbd2.h
++++ b/fs/ext4/ext4_jbd2.h
+@@ -372,7 +372,7 @@ static inline void ext4_update_inode_fsync_trans(handle_t
*handle,
+ {
+ struct ext4_inode_info *ei = EXT4_I(inode);
+
+- if (ext4_handle_valid(handle)) {
++ if (ext4_handle_valid(handle) && !is_handle_aborted(handle)) {
+ ei->i_sync_tid = handle->h_transaction->t_tid;
+ if (datasync)
+ ei->i_datasync_tid = handle->h_transaction->t_tid;
+diff --git a/fs/ext4/file.c b/fs/ext4/file.c
+index debf0707789d..2e5ae183a18a 100644
+--- a/fs/ext4/file.c
++++ b/fs/ext4/file.c
+@@ -79,7 +79,7 @@ ext4_unaligned_aio(struct inode *inode, struct iov_iter
*from, loff_t pos)
+ struct super_block *sb = inode->i_sb;
+ int blockmask = sb->s_blocksize - 1;
+
+- if (pos >= i_size_read(inode))
++ if (pos >= ALIGN(i_size_read(inode), sb->s_blocksize))
+ return 0;
+
+ if ((pos | iov_iter_alignment(from)) & blockmask)
+diff --git a/fs/ext4/indirect.c b/fs/ext4/indirect.c
+index 355ef9c36c87..8f3e78eb0bbd 100644
+--- a/fs/ext4/indirect.c
++++ b/fs/ext4/indirect.c
+@@ -1491,10 +1491,14 @@ end_range:
+ partial->p + 1,
+ partial2->p,
+ (chain+n-1) - partial);
+- BUFFER_TRACE(partial->bh, "call brelse");
+- brelse(partial->bh);
+- BUFFER_TRACE(partial2->bh, "call brelse");
+- brelse(partial2->bh);
++ while (partial > chain) {
++ BUFFER_TRACE(partial->bh, "call brelse");
++ brelse(partial->bh);
++ }
++ while (partial2 > chain2) {
++ BUFFER_TRACE(partial2->bh, "call brelse");
++ brelse(partial2->bh);
++ }
+ return 0;
+ }
+
+diff --git a/fs/inode.c b/fs/inode.c
+index a39c2724d8a0..b5c3a6473aaa 100644
+--- a/fs/inode.c
++++ b/fs/inode.c
+@@ -154,6 +154,12 @@ int inode_init_always(struct super_block *sb, struct
inode *inode)
+ inode->i_rdev = 0;
+ inode->dirtied_when = 0;
+
++#ifdef CONFIG_CGROUP_WRITEBACK
++ inode->i_wb_frn_winner = 0;
++ inode->i_wb_frn_avg_time = 0;
++ inode->i_wb_frn_history = 0;
++#endif
++
+ if (security_inode_alloc(inode))
+ goto out;
+ spin_lock_init(&inode->i_lock);
+diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c
+index 5e1054f028af..c7e32a891502 100644
+--- a/fs/proc/proc_sysctl.c
++++ b/fs/proc/proc_sysctl.c
+@@ -1550,7 +1550,8 @@ static void drop_sysctl_table(struct ctl_table_header
*header)
+ if (--header->nreg)
+ return;
+
+- put_links(header);
++ if (parent)
++ put_links(header);
+ start_unregistering(header);
+ if (!--header->count)
+ kfree_rcu(header, rcu);
+diff --git a/fs/udf/truncate.c b/fs/udf/truncate.c
+index 42b8c57795cb..c6ce7503a329 100644
+--- a/fs/udf/truncate.c
++++ b/fs/udf/truncate.c
+@@ -260,6 +260,9 @@ void udf_truncate_extents(struct inode *inode)
+ epos.block = eloc;
+ epos.bh = udf_tread(sb,
+ udf_get_lb_pblock(sb, &eloc, 0));
++ /* Error reading indirect block? */
++ if (!epos.bh)
++ return;
+ if (elen)
+ indirect_ext_len =
+ (elen + sb->s_blocksize - 1) >>
+diff --git a/include/asm-generic/fixmap.h b/include/asm-generic/fixmap.h
+index 1cbb8338edf3..827e4d3bbc7a 100644
+--- a/include/asm-generic/fixmap.h
++++ b/include/asm-generic/fixmap.h
+@@ -70,12 +70,12 @@ static inline unsigned long virt_to_fix(const unsigned
long vaddr)
+ #endif
+
+ /* Return a pointer with offset calculated */
+-#define __set_fixmap_offset(idx, phys, flags) \
+-({ \
+- unsigned long addr; \
+- __set_fixmap(idx, phys, flags); \
+- addr = fix_to_virt(idx) + ((phys) & (PAGE_SIZE - 1)); \
+- addr; \
++#define __set_fixmap_offset(idx, phys, flags) \
++({ \
++ unsigned long ________addr; \
++ __set_fixmap(idx, phys, flags); \
++ ________addr = fix_to_virt(idx) + ((phys) & (PAGE_SIZE - 1)); \
++ ________addr; \
+ })
+
+ #define set_fixmap_offset(idx, phys) \
+diff --git a/include/linux/rculist.h b/include/linux/rculist.h
+index 5ed540986019..a579240c64e9 100644
+--- a/include/linux/rculist.h
++++ b/include/linux/rculist.h
+@@ -401,6 +401,42 @@ static inline void hlist_add_head_rcu(struct hlist_node
*n,
+ first->pprev = &n->next;
+ }
+
++/**
++ * hlist_add_tail_rcu
++ * @n: the element to add to the hash list.
++ * @h: the list to add to.
++ *
++ * Description:
++ * Adds the specified element to the specified hlist,
++ * while permitting racing traversals.
++ *
++ * The caller must take whatever precautions are necessary
++ * (such as holding appropriate locks) to avoid racing
++ * with another list-mutation primitive, such as hlist_add_head_rcu()
++ * or hlist_del_rcu(), running on this same list.
++ * However, it is perfectly legal to run concurrently with
++ * the _rcu list-traversal primitives, such as
++ * hlist_for_each_entry_rcu(), used to prevent memory-consistency
++ * problems on Alpha CPUs. Regardless of the type of CPU, the
++ * list-traversal primitive must be guarded by rcu_read_lock().
++ */
++static inline void hlist_add_tail_rcu(struct hlist_node *n,
++ struct hlist_head *h)
++{
++ struct hlist_node *i, *last = NULL;
++
++ for (i = hlist_first_rcu(h); i; i = hlist_next_rcu(i))
++ last = i;
++
++ if (last) {
++ n->next = last->next;
++ n->pprev = &last->next;
++ rcu_assign_pointer(hlist_next_rcu(last), n);
++ } else {
++ hlist_add_head_rcu(n, h);
++ }
++}
++
+ /**
+ * hlist_add_before_rcu
+ * @n: the new element to add to the hash list.
+diff --git a/include/linux/vmstat.h b/include/linux/vmstat.h
+index 3e5d9075960f..73fae8c4a5fb 100644
+--- a/include/linux/vmstat.h
++++ b/include/linux/vmstat.h
+@@ -189,6 +189,7 @@ extern void __inc_zone_state(struct zone *, enum
zone_stat_item);
+ extern void dec_zone_state(struct zone *, enum zone_stat_item);
+ extern void __dec_zone_state(struct zone *, enum zone_stat_item);
+
++void quiet_vmstat(void);
+ void cpu_vm_stats_fold(int cpu);
+ void refresh_zone_stat_thresholds(void);
+
+@@ -249,6 +250,7 @@ static inline void __dec_zone_page_state(struct page *page,
+
+ static inline void refresh_zone_stat_thresholds(void) { }
+ static inline void cpu_vm_stats_fold(int cpu) { }
++static inline void quiet_vmstat(void) { }
+
+ static inline void drain_zonestat(struct zone *zone,
+ struct per_cpu_pageset *pset) { }
+diff --git a/include/net/inet_connection_sock.h
b/include/net/inet_connection_sock.h
+index 49dcad4fe99e..72599bbc8255 100644
+--- a/include/net/inet_connection_sock.h
++++ b/include/net/inet_connection_sock.h
+@@ -289,11 +289,6 @@ static inline int inet_csk_reqsk_queue_len(const struct
sock *sk)
+ return reqsk_queue_len(&inet_csk(sk)->icsk_accept_queue);
+ }
+
+-static inline int inet_csk_reqsk_queue_young(const struct sock *sk)
+-{
+- return reqsk_queue_len_young(&inet_csk(sk)->icsk_accept_queue);
+-}
+-
+ static inline int inet_csk_reqsk_queue_is_full(const struct sock *sk)
+ {
+ return inet_csk_reqsk_queue_len(sk) >= sk->sk_max_ack_backlog;
+diff --git a/include/net/sctp/checksum.h b/include/net/sctp/checksum.h
+index 4a5b9a306c69..803fc26ef0ba 100644
+--- a/include/net/sctp/checksum.h
++++ b/include/net/sctp/checksum.h
+@@ -60,7 +60,7 @@ static inline __wsum sctp_csum_combine(__wsum csum, __wsum
csum2,
+ static inline __le32 sctp_compute_cksum(const struct sk_buff *skb,
+ unsigned int offset)
+ {
+- struct sctphdr *sh = sctp_hdr(skb);
++ struct sctphdr *sh = (struct sctphdr *)(skb->data + offset);
+ __le32 ret, old = sh->checksum;
+ const struct skb_checksum_ops ops = {
+ .update = sctp_csum_update,
+diff --git a/include/net/sock.h b/include/net/sock.h
+index 7420299c31f5..0aadd3b03ced 100644
+--- a/include/net/sock.h
++++ b/include/net/sock.h
+@@ -651,6 +651,12 @@ static inline void sk_add_node_rcu(struct sock *sk,
struct hlist_head *list)
+ hlist_add_head_rcu(&sk->sk_node, list);
+ }
+
++static inline void sk_add_node_tail_rcu(struct sock *sk, struct hlist_head
*list)
++{
++ sock_hold(sk);
++ hlist_add_tail_rcu(&sk->sk_node, list);
++}
++
+ static inline void __sk_nulls_add_node_rcu(struct sock *sk, struct
hlist_nulls_head *list)
+ {
+ hlist_nulls_add_head_rcu(&sk->sk_nulls_node, list);
+diff --git a/kernel/cpu.c b/kernel/cpu.c
+index 40d20bf5de28..42ce0b0ae5c5 100644
+--- a/kernel/cpu.c
++++ b/kernel/cpu.c
+@@ -183,10 +183,17 @@ void cpu_hotplug_disable(void)
+ }
+ EXPORT_SYMBOL_GPL(cpu_hotplug_disable);
+
++static void __cpu_hotplug_enable(void)
++{
++ if (WARN_ONCE(!cpu_hotplug_disabled, "Unbalanced cpu hotplug enable\n"))
++ return;
++ cpu_hotplug_disabled--;
++}
++
+ void cpu_hotplug_enable(void)
+ {
+ cpu_maps_update_begin();
+- WARN_ON(--cpu_hotplug_disabled < 0);
++ __cpu_hotplug_enable();
+ cpu_maps_update_done();
+ }
+ EXPORT_SYMBOL_GPL(cpu_hotplug_enable);
+@@ -626,7 +633,7 @@ void enable_nonboot_cpus(void)
+
+ /* Allow everyone to use the CPU hotplug again */
+ cpu_maps_update_begin();
+- WARN_ON(--cpu_hotplug_disabled < 0);
++ __cpu_hotplug_enable();
+ if (cpumask_empty(frozen_cpus))
+ goto out;
+
+diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c
+index 358bb53c1e74..7324d83d6bd8 100644
+--- a/kernel/events/ring_buffer.c
++++ b/kernel/events/ring_buffer.c
+@@ -288,6 +288,13 @@ void *perf_aux_output_begin(struct perf_output_handle
*handle,
+ if (!rb_has_aux(rb) || !atomic_inc_not_zero(&rb->aux_refcount))
+ goto err;
+
++ /*
++ * If rb::aux_mmap_count is zero (and rb_has_aux() above went through),
++ * the aux buffer is in perf_mmap_close(), about to get freed.
++ */
++ if (!atomic_read(&rb->aux_mmap_count))
++ goto err;
++
+ /*
+ * Nesting is not supported for AUX area, make sure nested
+ * writers are caught early
+@@ -468,6 +475,25 @@ static void rb_free_aux_page(struct ring_buffer *rb, int
idx)
+ __free_page(page);
+ }
+
++static void __rb_free_aux(struct ring_buffer *rb)
++{
++ int pg;
++
++ if (rb->aux_priv) {
++ rb->free_aux(rb->aux_priv);
++ rb->free_aux = NULL;
++ rb->aux_priv = NULL;
++ }
++
++ if (rb->aux_nr_pages) {
++ for (pg = 0; pg < rb->aux_nr_pages; pg++)
++ rb_free_aux_page(rb, pg);
++
++ kfree(rb->aux_pages);
++ rb->aux_nr_pages = 0;
++ }
++}
++
+ int rb_alloc_aux(struct ring_buffer *rb, struct perf_event *event,
+ pgoff_t pgoff, int nr_pages, long watermark, int flags)
+ {
+@@ -556,30 +582,11 @@ out:
+ if (!ret)
+ rb->aux_pgoff = pgoff;
+ else
+- rb_free_aux(rb);
++ __rb_free_aux(rb);
+
+ return ret;
+ }
+
+-static void __rb_free_aux(struct ring_buffer *rb)
+-{
+- int pg;
+-
+- if (rb->aux_priv) {
+- rb->free_aux(rb->aux_priv);
+- rb->free_aux = NULL;
+- rb->aux_priv = NULL;
+- }
+-
+- if (rb->aux_nr_pages) {
+- for (pg = 0; pg < rb->aux_nr_pages; pg++)
+- rb_free_aux_page(rb, pg);
+-
+- kfree(rb->aux_pages);
+- rb->aux_nr_pages = 0;
+- }
+-}
+-
+ void rb_free_aux(struct ring_buffer *rb)
+ {
+ if (atomic_dec_and_test(&rb->aux_refcount))
+diff --git a/kernel/futex.c b/kernel/futex.c
+index 0c92c8d34ffa..ec9df5ba040b 100644
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -3067,6 +3067,10 @@ int handle_futex_death(u32 __user *uaddr, struct
task_struct *curr, int pi)
+ {
+ u32 uval, uninitialized_var(nval), mval;
+
++ /* Futex address must be 32bit aligned */
++ if ((((unsigned long)uaddr) % sizeof(*uaddr)) != 0)
++ return -1;
++
+ retry:
+ if (get_user(uval, uaddr))
+ return -1;
+diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c
+index 774ab79d3ec7..a49c565529a0 100644
+--- a/kernel/locking/lockdep.c
++++ b/kernel/locking/lockdep.c
+@@ -3314,6 +3314,9 @@ __lock_set_class(struct lockdep_map *lock, const char
*name,
+ unsigned int depth;
+ int i;
+
++ if (unlikely(!debug_locks))
++ return 0;
++
+ depth = curr->lockdep_depth;
+ /*
+ * This function is about (re)setting the class of a held lock,
+diff --git a/kernel/power/swap.c b/kernel/power/swap.c
+index 12cd989dadf6..160e1006640d 100644
+--- a/kernel/power/swap.c
++++ b/kernel/power/swap.c
+@@ -36,6 +36,14 @@
+
+ #define HIBERNATE_SIG "S1SUSPEND"
+
++/*
++ * When reading an {un,}compressed image, we may restore pages in place,
++ * in which case some architectures need these pages cleaning before they
++ * can be executed. We don't know which pages these may be, so clean the lot.
++ */
++static bool clean_pages_on_read;
++static bool clean_pages_on_decompress;
++
+ /*
+ * The swap map is a data structure used for keeping track of each page
+ * written to a swap partition. It consists of many swap_map_page
+@@ -241,6 +249,9 @@ static void hib_end_io(struct bio *bio)
+
+ if (bio_data_dir(bio) == WRITE)
+ put_page(page);
++ else if (clean_pages_on_read)
++ flush_icache_range((unsigned long)page_address(page),
++ (unsigned long)page_address(page) +
PAGE_SIZE);
+
+ if (bio->bi_error && !hb->error)
+ hb->error = bio->bi_error;
+@@ -1049,6 +1060,7 @@ static int load_image(struct swap_map_handle *handle,
+
+ hib_init_batch(&hb);
+
++ clean_pages_on_read = true;
+ printk(KERN_INFO "PM: Loading image data pages (%u pages)...\n",
+ nr_to_read);
+ m = nr_to_read / 10;
+@@ -1124,6 +1136,10 @@ static int lzo_decompress_threadfn(void *data)
+ d->unc_len = LZO_UNC_SIZE;
+ d->ret = lzo1x_decompress_safe(d->cmp + LZO_HEADER, d->cmp_len,
+ d->unc, &d->unc_len);
++ if (clean_pages_on_decompress)
++ flush_icache_range((unsigned long)d->unc,
++ (unsigned long)d->unc + d->unc_len);
++
+ atomic_set(&d->stop, 1);
+ wake_up(&d->done);
+ }
+@@ -1189,6 +1205,8 @@ static int load_image_lzo(struct swap_map_handle *handle,
+ }
+ memset(crc, 0, offsetof(struct crc_data, go));
+
++ clean_pages_on_decompress = true;
++
+ /*
+ * Start the decompression threads.
+ */
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index c2af250547bb..6051007918ad 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -2841,27 +2841,45 @@ dequeue_entity_load_avg(struct cfs_rq *cfs_rq, struct
sched_entity *se)
+ max_t(s64, cfs_rq->runnable_load_sum - se->avg.load_sum, 0);
+ }
+
+-/*
+- * Task first catches up with cfs_rq, and then subtract
+- * itself from the cfs_rq (task must be off the queue now).
+- */
+-void remove_entity_load_avg(struct sched_entity *se)
+-{
+- struct cfs_rq *cfs_rq = cfs_rq_of(se);
+- u64 last_update_time;
+-
+ #ifndef CONFIG_64BIT
++static inline u64 cfs_rq_last_update_time(struct cfs_rq *cfs_rq)
++{
+ u64 last_update_time_copy;
++ u64 last_update_time;
+
+ do {
+ last_update_time_copy = cfs_rq->load_last_update_time_copy;
+ smp_rmb();
+ last_update_time = cfs_rq->avg.last_update_time;
+ } while (last_update_time != last_update_time_copy);
++
++ return last_update_time;
++}
+ #else
+- last_update_time = cfs_rq->avg.last_update_time;
++static inline u64 cfs_rq_last_update_time(struct cfs_rq *cfs_rq)
++{
++ return cfs_rq->avg.last_update_time;
++}
+ #endif
+
++/*
++ * Task first catches up with cfs_rq, and then subtract
++ * itself from the cfs_rq (task must be off the queue now).
++ */
++void remove_entity_load_avg(struct sched_entity *se)
++{
++ struct cfs_rq *cfs_rq = cfs_rq_of(se);
++ u64 last_update_time;
++
++ /*
++ * Newly created task or never used group entity should not be removed
++ * from its (source) cfs_rq
++ */
++ if (se->avg.last_update_time == 0)
++ return;
++
++ last_update_time = cfs_rq_last_update_time(cfs_rq);
++
+ __update_load_avg(last_update_time, cpu_of(rq_of(cfs_rq)), &se->avg, 0,
0, NULL);
+ atomic_long_add(se->avg.load_avg, &cfs_rq->removed_load_avg);
+ atomic_long_add(se->avg.util_avg, &cfs_rq->removed_util_avg);
+diff --git a/kernel/sched/idle.c b/kernel/sched/idle.c
+index bfd573122e0d..306a859b36f0 100644
+--- a/kernel/sched/idle.c
++++ b/kernel/sched/idle.c
+@@ -219,6 +219,7 @@ static void cpu_idle_loop(void)
+ */
+
+ __current_set_polling();
++ quiet_vmstat();
+ tick_nohz_idle_enter();
+
+ while (!need_resched()) {
+diff --git a/lib/int_sqrt.c b/lib/int_sqrt.c
+index 1ef4cc344977..1afb545a37c5 100644
+--- a/lib/int_sqrt.c
++++ b/lib/int_sqrt.c
+@@ -22,6 +22,9 @@ unsigned long int_sqrt(unsigned long x)
+ return x;
+
+ m = 1UL << (BITS_PER_LONG - 2);
++ while (m > x)
++ m >>= 2;
++
+ while (m != 0) {
+ b = y + m;
+ y >>= 1;
+diff --git a/mm/rmap.c b/mm/rmap.c
+index 488dda209431..cf733fab230f 100644
+--- a/mm/rmap.c
++++ b/mm/rmap.c
+@@ -408,7 +408,7 @@ void unlink_anon_vmas(struct vm_area_struct *vma)
+ list_for_each_entry_safe(avc, next, &vma->anon_vma_chain, same_vma) {
+ struct anon_vma *anon_vma = avc->anon_vma;
+
+- BUG_ON(anon_vma->degree);
++ VM_WARN_ON(anon_vma->degree);
+ put_anon_vma(anon_vma);
+
+ list_del(&avc->same_vma);
+diff --git a/mm/vmstat.c b/mm/vmstat.c
+index a2d70ef74db7..6af9bbad94c7 100644
+--- a/mm/vmstat.c
++++ b/mm/vmstat.c
+@@ -460,7 +460,7 @@ static int fold_diff(int *diff)
+ *
+ * The function returns the number of global counters updated.
+ */
+-static int refresh_cpu_vm_stats(void)
++static int refresh_cpu_vm_stats(bool do_pagesets)
+ {
+ struct zone *zone;
+ int i;
+@@ -484,33 +484,35 @@ static int refresh_cpu_vm_stats(void)
+ #endif
+ }
+ }
+- cond_resched();
+ #ifdef CONFIG_NUMA
+- /*
+- * Deal with draining the remote pageset of this
+- * processor
+- *
+- * Check if there are pages remaining in this pageset
+- * if not then there is nothing to expire.
+- */
+- if (!__this_cpu_read(p->expire) ||
++ if (do_pagesets) {
++ cond_resched();
++ /*
++ * Deal with draining the remote pageset of this
++ * processor
++ *
++ * Check if there are pages remaining in this pageset
++ * if not then there is nothing to expire.
++ */
++ if (!__this_cpu_read(p->expire) ||
+ !__this_cpu_read(p->pcp.count))
+- continue;
++ continue;
+
+- /*
+- * We never drain zones local to this processor.
+- */
+- if (zone_to_nid(zone) == numa_node_id()) {
+- __this_cpu_write(p->expire, 0);
+- continue;
+- }
++ /*
++ * We never drain zones local to this processor.
++ */
++ if (zone_to_nid(zone) == numa_node_id()) {
++ __this_cpu_write(p->expire, 0);
++ continue;
++ }
+
+- if (__this_cpu_dec_return(p->expire))
+- continue;
++ if (__this_cpu_dec_return(p->expire))
++ continue;
+
+- if (__this_cpu_read(p->pcp.count)) {
+- drain_zone_pages(zone, this_cpu_ptr(&p->pcp));
+- changes++;
++ if (__this_cpu_read(p->pcp.count)) {
++ drain_zone_pages(zone, this_cpu_ptr(&p->pcp));
++ changes++;
++ }
+ }
+ #endif
+ }
+@@ -1393,7 +1395,7 @@ static cpumask_var_t cpu_stat_off;
+
+ static void vmstat_update(struct work_struct *w)
+ {
+- if (refresh_cpu_vm_stats()) {
++ if (refresh_cpu_vm_stats(true)) {
+ /*
+ * Counters were updated so we expect more updates
+ * to occur in the future. Keep on running the
+@@ -1424,6 +1426,23 @@ static void vmstat_update(struct work_struct *w)
+ }
+ }
+
++/*
++ * Switch off vmstat processing and then fold all the remaining differentials
++ * until the diffs stay at zero. The function is used by NOHZ and can only be
++ * invoked when tick processing is not active.
++ */
++void quiet_vmstat(void)
++{
++ if (system_state != SYSTEM_RUNNING)
++ return;
++
++ do {
++ if (!cpumask_test_and_set_cpu(smp_processor_id(), cpu_stat_off))
++ cancel_delayed_work(this_cpu_ptr(&vmstat_work));
++
++ } while (refresh_cpu_vm_stats(false));
++}
++
+ /*
+ * Check if the diffs for a certain cpu indicate that
+ * an update is needed.
+@@ -1456,7 +1475,7 @@ static bool need_update(int cpu)
+ */
+ static void vmstat_shepherd(struct work_struct *w);
+
+-static DECLARE_DELAYED_WORK(shepherd, vmstat_shepherd);
++static DECLARE_DEFERRABLE_WORK(shepherd, vmstat_shepherd);
+
+ static void vmstat_shepherd(struct work_struct *w)
+ {
+diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
+index af68674690af..f76e9c1e9f17 100644
+--- a/net/bluetooth/l2cap_core.c
++++ b/net/bluetooth/l2cap_core.c
+@@ -3315,16 +3315,22 @@ static int l2cap_parse_conf_req(struct l2cap_chan
*chan, void *data, size_t data
+
+ while (len >= L2CAP_CONF_OPT_SIZE) {
+ len -= l2cap_get_conf_opt(&req, &type, &olen, &val);
++ if (len < 0)
++ break;
+
+ hint = type & L2CAP_CONF_HINT;
+ type &= L2CAP_CONF_MASK;
+
+ switch (type) {
+ case L2CAP_CONF_MTU:
++ if (olen != 2)
++ break;
+ mtu = val;
+ break;
+
+ case L2CAP_CONF_FLUSH_TO:
++ if (olen != 2)
++ break;
+ chan->flush_to = val;
+ break;
+
+@@ -3332,26 +3338,30 @@ static int l2cap_parse_conf_req(struct l2cap_chan
*chan, void *data, size_t data
+ break;
+
+ case L2CAP_CONF_RFC:
+- if (olen == sizeof(rfc))
+- memcpy(&rfc, (void *) val, olen);
++ if (olen != sizeof(rfc))
++ break;
++ memcpy(&rfc, (void *) val, olen);
+ break;
+
+ case L2CAP_CONF_FCS:
++ if (olen != 1)
++ break;
+ if (val == L2CAP_FCS_NONE)
+ set_bit(CONF_RECV_NO_FCS, &chan->conf_state);
+ break;
+
+ case L2CAP_CONF_EFS:
+- if (olen == sizeof(efs)) {
+- remote_efs = 1;
+- memcpy(&efs, (void *) val, olen);
+- }
++ if (olen != sizeof(efs))
++ break;
++ remote_efs = 1;
++ memcpy(&efs, (void *) val, olen);
+ break;
+
+ case L2CAP_CONF_EWS:
++ if (olen != 2)
++ break;
+ if (!(chan->conn->local_fixed_chan & L2CAP_FC_A2MP))
+ return -ECONNREFUSED;
+-
+ set_bit(FLAG_EXT_CTRL, &chan->flags);
+ set_bit(CONF_EWS_RECV, &chan->conf_state);
+ chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW;
+@@ -3361,7 +3371,6 @@ static int l2cap_parse_conf_req(struct l2cap_chan *chan,
void *data, size_t data
+ default:
+ if (hint)
+ break;
+-
+ result = L2CAP_CONF_UNKNOWN;
+ *((u8 *) ptr++) = type;
+ break;
+@@ -3526,58 +3535,65 @@ static int l2cap_parse_conf_rsp(struct l2cap_chan
*chan, void *rsp, int len,
+
+ while (len >= L2CAP_CONF_OPT_SIZE) {
+ len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
++ if (len < 0)
++ break;
+
+ switch (type) {
+ case L2CAP_CONF_MTU:
++ if (olen != 2)
++ break;
+ if (val < L2CAP_DEFAULT_MIN_MTU) {
+ *result = L2CAP_CONF_UNACCEPT;
+ chan->imtu = L2CAP_DEFAULT_MIN_MTU;
+ } else
+ chan->imtu = val;
+- l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu,
endptr - ptr);
++ l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu,
++ endptr - ptr);
+ break;
+
+ case L2CAP_CONF_FLUSH_TO:
++ if (olen != 2)
++ break;
+ chan->flush_to = val;
+- l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO,
+- 2, chan->flush_to, endptr - ptr);
++ l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO, 2,
++ chan->flush_to, endptr - ptr);
+ break;
+
+ case L2CAP_CONF_RFC:
+- if (olen == sizeof(rfc))
+- memcpy(&rfc, (void *)val, olen);
+-
++ if (olen != sizeof(rfc))
++ break;
++ memcpy(&rfc, (void *)val, olen);
+ if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state) &&
+ rfc.mode != chan->mode)
+ return -ECONNREFUSED;
+-
+ chan->fcs = 0;
+-
+- l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
+- sizeof(rfc), (unsigned long) &rfc,
endptr - ptr);
++ l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
++ (unsigned long) &rfc, endptr - ptr);
+ break;
+
+ case L2CAP_CONF_EWS:
++ if (olen != 2)
++ break;
+ chan->ack_win = min_t(u16, val, chan->ack_win);
+ l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2,
+ chan->tx_win, endptr - ptr);
+ break;
+
+ case L2CAP_CONF_EFS:
+- if (olen == sizeof(efs)) {
+- memcpy(&efs, (void *)val, olen);
+-
+- if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&
+- efs.stype != L2CAP_SERV_NOTRAFIC &&
+- efs.stype != chan->local_stype)
+- return -ECONNREFUSED;
+-
+- l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS,
sizeof(efs),
+- (unsigned long) &efs, endptr
- ptr);
+- }
++ if (olen != sizeof(efs))
++ break;
++ memcpy(&efs, (void *)val, olen);
++ if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&
++ efs.stype != L2CAP_SERV_NOTRAFIC &&
++ efs.stype != chan->local_stype)
++ return -ECONNREFUSED;
++ l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, sizeof(efs),
++ (unsigned long) &efs, endptr - ptr);
+ break;
+
+ case L2CAP_CONF_FCS:
++ if (olen != 1)
++ break;
+ if (*result == L2CAP_CONF_PENDING)
+ if (val == L2CAP_FCS_NONE)
+ set_bit(CONF_RECV_NO_FCS,
+@@ -3706,13 +3722,18 @@ static void l2cap_conf_rfc_get(struct l2cap_chan
*chan, void *rsp, int len)
+
+ while (len >= L2CAP_CONF_OPT_SIZE) {
+ len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
++ if (len < 0)
++ break;
+
+ switch (type) {
+ case L2CAP_CONF_RFC:
+- if (olen == sizeof(rfc))
+- memcpy(&rfc, (void *)val, olen);
++ if (olen != sizeof(rfc))
++ break;
++ memcpy(&rfc, (void *)val, olen);
+ break;
+ case L2CAP_CONF_EWS:
++ if (olen != 2)
++ break;
+ txwin_ext = val;
+ break;
+ }
+diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
+index 45fd82e61e79..b0a577a79a6a 100644
+--- a/net/dccp/ipv4.c
++++ b/net/dccp/ipv4.c
+@@ -592,13 +592,7 @@ int dccp_v4_conn_request(struct sock *sk, struct sk_buff
*skb)
+ if (inet_csk_reqsk_queue_is_full(sk))
+ goto drop;
+
+- /*
+- * Accept backlog is full. If we have already queued enough
+- * of warm entries in syn queue, drop request. It is better than
+- * clogging syn queue with openreqs with exponentially increasing
+- * timeout.
+- */
+- if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1)
++ if (sk_acceptq_is_full(sk))
+ goto drop;
+
+ req = inet_reqsk_alloc(&dccp_request_sock_ops, sk, true);
+diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
+index 0bf41faeffc4..d2caa4d69159 100644
+--- a/net/dccp/ipv6.c
++++ b/net/dccp/ipv6.c
+@@ -324,7 +324,7 @@ static int dccp_v6_conn_request(struct sock *sk, struct
sk_buff *skb)
+ if (inet_csk_reqsk_queue_is_full(sk))
+ goto drop;
+
+- if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1)
++ if (sk_acceptq_is_full(sk))
+ goto drop;
+
+ req = inet_reqsk_alloc(&dccp6_request_sock_ops, sk, true);
+@@ -427,8 +427,8 @@ static struct sock *dccp_v6_request_recv_sock(const struct
sock *sk,
+ newnp->ipv6_mc_list = NULL;
+ newnp->ipv6_ac_list = NULL;
+ newnp->ipv6_fl_list = NULL;
+- newnp->mcast_oif = inet6_iif(skb);
+- newnp->mcast_hops = ipv6_hdr(skb)->hop_limit;
++ newnp->mcast_oif = inet_iif(skb);
++ newnp->mcast_hops = ip_hdr(skb)->ttl;
+
+ /*
+ * No need to charge this sock to the relevant IPv6 refcnt
debug socks count
+diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
+index ab9f8a66615d..386443e780da 100644
+--- a/net/ipv4/inet_diag.c
++++ b/net/ipv4/inet_diag.c
+@@ -366,13 +366,20 @@ int inet_diag_dump_one_icsk(struct inet_hashinfo
*hashinfo,
+ req->id.idiag_dport, req->id.idiag_src[0],
+ req->id.idiag_sport, req->id.idiag_if);
+ #if IS_ENABLED(CONFIG_IPV6)
+- else if (req->sdiag_family == AF_INET6)
+- sk = inet6_lookup(net, hashinfo,
+- (struct in6_addr *)req->id.idiag_dst,
+- req->id.idiag_dport,
+- (struct in6_addr *)req->id.idiag_src,
+- req->id.idiag_sport,
+- req->id.idiag_if);
++ else if (req->sdiag_family == AF_INET6) {
++ if (ipv6_addr_v4mapped((struct in6_addr *)req->id.idiag_dst) &&
++ ipv6_addr_v4mapped((struct in6_addr *)req->id.idiag_src))
++ sk = inet_lookup(net, hashinfo, req->id.idiag_dst[3],
++ req->id.idiag_dport,
req->id.idiag_src[3],
++ req->id.idiag_sport, req->id.idiag_if);
++ else
++ sk = inet6_lookup(net, hashinfo,
++ (struct in6_addr *)req->id.idiag_dst,
++ req->id.idiag_dport,
++ (struct in6_addr *)req->id.idiag_src,
++ req->id.idiag_sport,
++ req->id.idiag_if);
++ }
+ #endif
+ else
+ goto out_nosk;
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index 561f568e8938..aff90b0ddb63 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -6305,13 +6305,7 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops,
+ goto drop;
+ }
+
+-
+- /* Accept backlog is full. If we have already queued enough
+- * of warm entries in syn queue, drop request. It is better than
+- * clogging syn queue with openreqs with exponentially increasing
+- * timeout.
+- */
+- if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1) {
++ if (sk_acceptq_is_full(sk)) {
+ NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
+ goto drop;
+ }
+diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
+index 0a37ddc7af51..3697cd08c515 100644
+--- a/net/ipv6/icmp.c
++++ b/net/ipv6/icmp.c
+@@ -98,7 +98,7 @@ static void icmpv6_err(struct sk_buff *skb, struct
inet6_skb_parm *opt,
+
+ if (!(type & ICMPV6_INFOMSG_MASK))
+ if (icmp6->icmp6_type == ICMPV6_ECHO_REQUEST)
+- ping_err(skb, offset, info);
++ ping_err(skb, offset, ntohl(info));
+ }
+
+ static int icmpv6_rcv(struct sk_buff *skb);
+diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
+index d6c191158e07..6e7f99569bdf 100644
+--- a/net/ipv6/tcp_ipv6.c
++++ b/net/ipv6/tcp_ipv6.c
+@@ -1043,11 +1043,11 @@ static struct sock *tcp_v6_syn_recv_sock(const struct
sock *sk, struct sk_buff *
+ newnp->ipv6_fl_list = NULL;
+ newnp->pktoptions = NULL;
+ newnp->opt = NULL;
+- newnp->mcast_oif = tcp_v6_iif(skb);
+- newnp->mcast_hops = ipv6_hdr(skb)->hop_limit;
+- newnp->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(skb));
++ newnp->mcast_oif = inet_iif(skb);
++ newnp->mcast_hops = ip_hdr(skb)->ttl;
++ newnp->rcv_flowinfo = 0;
+ if (np->repflow)
+- newnp->flow_label = ip6_flowlabel(ipv6_hdr(skb));
++ newnp->flow_label = 0;
+
+ /*
+ * No need to charge this sock to the relevant IPv6 refcnt
debug socks count
+diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
+index 33d5271a9e32..466922f09d04 100644
+--- a/net/mac80211/mesh_hwmp.c
++++ b/net/mac80211/mesh_hwmp.c
+@@ -530,7 +530,7 @@ static void hwmp_preq_frame_process(struct
ieee80211_sub_if_data *sdata,
+ const u8 *target_addr, *orig_addr;
+ const u8 *da;
+ u8 target_flags, ttl, flags;
+- u32 orig_sn, target_sn, lifetime, target_metric;
++ u32 orig_sn, target_sn, lifetime, target_metric = 0;
+ bool reply = false;
+ bool forward = true;
+ bool root_is_gate;
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index d517dd7f4ac7..7d93228ba1e1 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -3155,7 +3155,7 @@ static int packet_create(struct net *net, struct socket
*sock, int protocol,
+ }
+
+ mutex_lock(&net->packet.sklist_lock);
+- sk_add_node_rcu(sk, &net->packet.sklist);
++ sk_add_node_tail_rcu(sk, &net->packet.sklist);
+ mutex_unlock(&net->packet.sklist_lock);
+
+ preempt_disable();
+@@ -4130,7 +4130,7 @@ static struct pgv *alloc_pg_vec(struct tpacket_req *req,
int order)
+ struct pgv *pg_vec;
+ int i;
+
+- pg_vec = kcalloc(block_nr, sizeof(struct pgv), GFP_KERNEL);
++ pg_vec = kcalloc(block_nr, sizeof(struct pgv), GFP_KERNEL |
__GFP_NOWARN);
+ if (unlikely(!pg_vec))
+ goto out;
+
+diff --git a/net/rose/rose_subr.c b/net/rose/rose_subr.c
+index 7ca57741b2fb..7849f286bb93 100644
+--- a/net/rose/rose_subr.c
++++ b/net/rose/rose_subr.c
+@@ -105,16 +105,17 @@ void rose_write_internal(struct sock *sk, int frametype)
+ struct sk_buff *skb;
+ unsigned char *dptr;
+ unsigned char lci1, lci2;
+- char buffer[100];
+- int len, faclen = 0;
++ int maxfaclen = 0;
++ int len, faclen;
++ int reserve;
+
+- len = AX25_BPQ_HEADER_LEN + AX25_MAX_HEADER_LEN + ROSE_MIN_LEN + 1;
++ reserve = AX25_BPQ_HEADER_LEN + AX25_MAX_HEADER_LEN + 1;
++ len = ROSE_MIN_LEN;
+
+ switch (frametype) {
+ case ROSE_CALL_REQUEST:
+ len += 1 + ROSE_ADDR_LEN + ROSE_ADDR_LEN;
+- faclen = rose_create_facilities(buffer, rose);
+- len += faclen;
++ maxfaclen = 256;
+ break;
+ case ROSE_CALL_ACCEPTED:
+ case ROSE_CLEAR_REQUEST:
+@@ -123,15 +124,16 @@ void rose_write_internal(struct sock *sk, int frametype)
+ break;
+ }
+
+- if ((skb = alloc_skb(len, GFP_ATOMIC)) == NULL)
++ skb = alloc_skb(reserve + len + maxfaclen, GFP_ATOMIC);
++ if (!skb)
+ return;
+
+ /*
+ * Space for AX.25 header and PID.
+ */
+- skb_reserve(skb, AX25_BPQ_HEADER_LEN + AX25_MAX_HEADER_LEN + 1);
++ skb_reserve(skb, reserve);
+
+- dptr = skb_put(skb, skb_tailroom(skb));
++ dptr = skb_put(skb, len);
+
+ lci1 = (rose->lci >> 8) & 0x0F;
+ lci2 = (rose->lci >> 0) & 0xFF;
+@@ -146,7 +148,8 @@ void rose_write_internal(struct sock *sk, int frametype)
+ dptr += ROSE_ADDR_LEN;
+ memcpy(dptr, &rose->source_addr, ROSE_ADDR_LEN);
+ dptr += ROSE_ADDR_LEN;
+- memcpy(dptr, buffer, faclen);
++ faclen = rose_create_facilities(dptr, rose);
++ skb_put(skb, faclen);
+ dptr += faclen;
+ break;
+
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index 642a78079ae1..81013490a99f 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -11721,7 +11721,7 @@ static void nl80211_send_mlme_event(struct
cfg80211_registered_device *rdev,
+ struct sk_buff *msg;
+ void *hdr;
+
+- msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
++ msg = nlmsg_new(100 + len, gfp);
+ if (!msg)
+ return;
+
+@@ -11873,7 +11873,7 @@ void nl80211_send_connect_result(struct
cfg80211_registered_device *rdev,
+ struct sk_buff *msg;
+ void *hdr;
+
+- msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
++ msg = nlmsg_new(100 + req_ie_len + resp_ie_len, gfp);
+ if (!msg)
+ return;
+
+@@ -11913,7 +11913,7 @@ void nl80211_send_roamed(struct
cfg80211_registered_device *rdev,
+ struct sk_buff *msg;
+ void *hdr;
+
+- msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
++ msg = nlmsg_new(100 + req_ie_len + resp_ie_len, gfp);
+ if (!msg)
+ return;
+
+@@ -11951,7 +11951,7 @@ void nl80211_send_disconnected(struct
cfg80211_registered_device *rdev,
+ struct sk_buff *msg;
+ void *hdr;
+
+- msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
++ msg = nlmsg_new(100 + ie_len, GFP_KERNEL);
+ if (!msg)
+ return;
+
+@@ -12028,7 +12028,7 @@ void cfg80211_notify_new_peer_candidate(struct
net_device *dev, const u8 *addr,
+
+ trace_cfg80211_notify_new_peer_candidate(dev, addr);
+
+- msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
++ msg = nlmsg_new(100 + ie_len, gfp);
+ if (!msg)
+ return;
+
+@@ -12397,7 +12397,7 @@ int nl80211_send_mgmt(struct
cfg80211_registered_device *rdev,
+ struct sk_buff *msg;
+ void *hdr;
+
+- msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
++ msg = nlmsg_new(100 + len, gfp);
+ if (!msg)
+ return -ENOMEM;
+
+@@ -12440,7 +12440,7 @@ void cfg80211_mgmt_tx_status(struct wireless_dev
*wdev, u64 cookie,
+
+ trace_cfg80211_mgmt_tx_status(wdev, cookie, ack);
+
+- msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
++ msg = nlmsg_new(100 + len, gfp);
+ if (!msg)
+ return;
+
+@@ -13244,7 +13244,7 @@ void cfg80211_ft_event(struct net_device *netdev,
+ if (!ft_event->target_ap)
+ return;
+
+- msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
++ msg = nlmsg_new(100 + ft_event->ric_ies_len, GFP_KERNEL);
+ if (!msg)
+ return;
+
+diff --git a/scripts/setlocalversion b/scripts/setlocalversion
+index 63d91e22ed7c..966dd3924ea9 100755
+--- a/scripts/setlocalversion
++++ b/scripts/setlocalversion
+@@ -143,7 +143,7 @@ fi
+ if test -e include/config/auto.conf; then
+ . include/config/auto.conf
+ else
+- echo "Error: kernelrelease not valid - run 'make prepare' to update it"
++ echo "Error: kernelrelease not valid - run 'make prepare' to update it"
>&2
+ exit 1
+ fi
+
+diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c
+index 2272aee12871..3c88a3384064 100644
+--- a/sound/core/compress_offload.c
++++ b/sound/core/compress_offload.c
+@@ -38,6 +38,7 @@
+ #include <linux/uio.h>
+ #include <linux/uaccess.h>
+ #include <linux/module.h>
++#include <linux/compat.h>
+ #include <sound/core.h>
+ #include <sound/initval.h>
+ #include <sound/compress_params.h>
+@@ -859,6 +860,15 @@ static long snd_compr_ioctl(struct file *f, unsigned int
cmd, unsigned long arg)
+ return retval;
+ }
+
++/* support of 32bit userspace on 64bit platforms */
++#ifdef CONFIG_COMPAT
++static long snd_compr_ioctl_compat(struct file *file, unsigned int cmd,
++ unsigned long arg)
++{
++ return snd_compr_ioctl(file, cmd, (unsigned long)compat_ptr(arg));
++}
++#endif
++
+ static const struct file_operations snd_compr_file_ops = {
+ .owner = THIS_MODULE,
+ .open = snd_compr_open,
+@@ -866,6 +876,9 @@ static const struct file_operations snd_compr_file_ops = {
+ .write = snd_compr_write,
+ .read = snd_compr_read,
+ .unlocked_ioctl = snd_compr_ioctl,
++#ifdef CONFIG_COMPAT
++ .compat_ioctl = snd_compr_ioctl_compat,
++#endif
+ .mmap = snd_compr_mmap,
+ .poll = snd_compr_poll,
+ };
+diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c
+index 07feb35f1935..443bb8ce8255 100644
+--- a/sound/core/oss/pcm_oss.c
++++ b/sound/core/oss/pcm_oss.c
+@@ -950,6 +950,28 @@ static int snd_pcm_oss_change_params_locked(struct
snd_pcm_substream *substream)
+ oss_frame_size = snd_pcm_format_physical_width(params_format(params)) *
+ params_channels(params) / 8;
+
++ err = snd_pcm_oss_period_size(substream, params, sparams);
++ if (err < 0)
++ goto failure;
++
++ n = snd_pcm_plug_slave_size(substream, runtime->oss.period_bytes /
oss_frame_size);
++ err = snd_pcm_hw_param_near(substream, sparams,
SNDRV_PCM_HW_PARAM_PERIOD_SIZE, n, NULL);
++ if (err < 0)
++ goto failure;
++
++ err = snd_pcm_hw_param_near(substream, sparams,
SNDRV_PCM_HW_PARAM_PERIODS,
++ runtime->oss.periods, NULL);
++ if (err < 0)
++ goto failure;
++
++ snd_pcm_kernel_ioctl(substream, SNDRV_PCM_IOCTL_DROP, NULL);
++
++ err = snd_pcm_kernel_ioctl(substream, SNDRV_PCM_IOCTL_HW_PARAMS,
sparams);
++ if (err < 0) {
++ pcm_dbg(substream->pcm, "HW_PARAMS failed: %i\n", err);
++ goto failure;
++ }
++
+ #ifdef CONFIG_SND_PCM_OSS_PLUGINS
+ snd_pcm_oss_plugin_clear(substream);
+ if (!direct) {
+@@ -984,27 +1006,6 @@ static int snd_pcm_oss_change_params_locked(struct
snd_pcm_substream *substream)
+ }
+ #endif
+
+- err = snd_pcm_oss_period_size(substream, params, sparams);
+- if (err < 0)
+- goto failure;
+-
+- n = snd_pcm_plug_slave_size(substream, runtime->oss.period_bytes /
oss_frame_size);
+- err = snd_pcm_hw_param_near(substream, sparams,
SNDRV_PCM_HW_PARAM_PERIOD_SIZE, n, NULL);
+- if (err < 0)
+- goto failure;
+-
+- err = snd_pcm_hw_param_near(substream, sparams,
SNDRV_PCM_HW_PARAM_PERIODS,
+- runtime->oss.periods, NULL);
+- if (err < 0)
+- goto failure;
+-
+- snd_pcm_kernel_ioctl(substream, SNDRV_PCM_IOCTL_DROP, NULL);
+-
+- if ((err = snd_pcm_kernel_ioctl(substream, SNDRV_PCM_IOCTL_HW_PARAMS,
sparams)) < 0) {
+- pcm_dbg(substream->pcm, "HW_PARAMS failed: %i\n", err);
+- goto failure;
+- }
+-
+ if (runtime->oss.trigger) {
+ sw_params->start_threshold = 1;
+ } else {
+diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
+index 9b6dcdea4431..4d6f0f56d54a 100644
+--- a/sound/core/pcm_native.c
++++ b/sound/core/pcm_native.c
+@@ -1254,8 +1254,15 @@ static int snd_pcm_pause(struct snd_pcm_substream
*substream, int push)
+ static int snd_pcm_pre_suspend(struct snd_pcm_substream *substream, int state)
+ {
+ struct snd_pcm_runtime *runtime = substream->runtime;
+- if (runtime->status->state == SNDRV_PCM_STATE_SUSPENDED)
++ switch (runtime->status->state) {
++ case SNDRV_PCM_STATE_SUSPENDED:
+ return -EBUSY;
++ /* unresumable PCM state; return -EBUSY for skipping suspend */
++ case SNDRV_PCM_STATE_OPEN:
++ case SNDRV_PCM_STATE_SETUP:
++ case SNDRV_PCM_STATE_DISCONNECTED:
++ return -EBUSY;
++ }
+ runtime->trigger_master = substream;
+ return 0;
+ }
+diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c
+index 59111cadaec2..c8b2309352d7 100644
+--- a/sound/core/rawmidi.c
++++ b/sound/core/rawmidi.c
+@@ -29,6 +29,7 @@
+ #include <linux/mutex.h>
+ #include <linux/module.h>
+ #include <linux/delay.h>
++#include <linux/nospec.h>
+ #include <sound/rawmidi.h>
+ #include <sound/info.h>
+ #include <sound/control.h>
+@@ -591,6 +592,7 @@ static int __snd_rawmidi_info_select(struct snd_card *card,
+ return -ENXIO;
+ if (info->stream < 0 || info->stream > 1)
+ return -EINVAL;
++ info->stream = array_index_nospec(info->stream, 2);
+ pstr = &rmidi->streams[info->stream];
+ if (pstr->substream_count == 0)
+ return -ENOENT;
+diff --git a/sound/core/seq/oss/seq_oss_synth.c
b/sound/core/seq/oss/seq_oss_synth.c
+index ea545f9291b4..df5b984bb33f 100644
+--- a/sound/core/seq/oss/seq_oss_synth.c
++++ b/sound/core/seq/oss/seq_oss_synth.c
+@@ -617,13 +617,14 @@ int
+ snd_seq_oss_synth_make_info(struct seq_oss_devinfo *dp, int dev, struct
synth_info *inf)
+ {
+ struct seq_oss_synth *rec;
++ struct seq_oss_synthinfo *info = get_synthinfo_nospec(dp, dev);
+
+- if (dev < 0 || dev >= dp->max_synthdev)
++ if (!info)
+ return -ENXIO;
+
+- if (dp->synths[dev].is_midi) {
++ if (info->is_midi) {
+ struct midi_info minf;
+- snd_seq_oss_midi_make_info(dp, dp->synths[dev].midi_mapped,
&minf);
++ snd_seq_oss_midi_make_info(dp, info->midi_mapped, &minf);
+ inf->synth_type = SYNTH_TYPE_MIDI;
+ inf->synth_subtype = 0;
+ inf->nr_voices = 16;
+diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
+index f6d4a1046e54..ad0b23a21bc8 100644
+--- a/sound/pci/hda/hda_codec.c
++++ b/sound/pci/hda/hda_codec.c
+@@ -3004,6 +3004,7 @@ static void hda_call_codec_resume(struct hda_codec
*codec)
+ hda_jackpoll_work(&codec->jackpoll_work.work);
+ else
+ snd_hda_jack_report_sync(codec);
++ codec->core.dev.power.power_state = PMSG_ON;
+ atomic_dec(&codec->core.in_pm);
+ }
+
+@@ -3036,10 +3037,62 @@ static int hda_codec_runtime_resume(struct device *dev)
+ }
+ #endif /* CONFIG_PM */
+
++#ifdef CONFIG_PM_SLEEP
++static int hda_codec_force_resume(struct device *dev)
++{
++ int ret;
++
++ /* The get/put pair below enforces the runtime resume even if the
++ * device hasn't been used at suspend time. This trick is needed to
++ * update the jack state change during the sleep.
++ */
++ pm_runtime_get_noresume(dev);
++ ret = pm_runtime_force_resume(dev);
++ pm_runtime_put(dev);
++ return ret;
++}
++
++static int hda_codec_pm_suspend(struct device *dev)
++{
++ dev->power.power_state = PMSG_SUSPEND;
++ return pm_runtime_force_suspend(dev);
++}
++
++static int hda_codec_pm_resume(struct device *dev)
++{
++ dev->power.power_state = PMSG_RESUME;
++ return hda_codec_force_resume(dev);
++}
++
++static int hda_codec_pm_freeze(struct device *dev)
++{
++ dev->power.power_state = PMSG_FREEZE;
++ return pm_runtime_force_suspend(dev);
++}
++
++static int hda_codec_pm_thaw(struct device *dev)
++{
++ dev->power.power_state = PMSG_THAW;
++ return hda_codec_force_resume(dev);
++}
++
++static int hda_codec_pm_restore(struct device *dev)
++{
++ dev->power.power_state = PMSG_RESTORE;
++ return hda_codec_force_resume(dev);
++}
++#endif /* CONFIG_PM_SLEEP */
++
+ /* referred in hda_bind.c */
+ const struct dev_pm_ops hda_codec_driver_pm = {
+- SET_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend,
+- pm_runtime_force_resume)
++#ifdef CONFIG_PM_SLEEP
++ .suspend = hda_codec_pm_suspend,
++ .resume = hda_codec_pm_resume,
++ .freeze = hda_codec_pm_freeze,
++ .thaw = hda_codec_pm_thaw,
++ .poweroff = hda_codec_pm_suspend,
++ .restore = hda_codec_pm_restore,
++#endif /* CONFIG_PM_SLEEP */
+ SET_RUNTIME_PM_OPS(hda_codec_runtime_suspend, hda_codec_runtime_resume,
+ NULL)
+ };
+diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
+index d01e2ce818f7..62b38f2ff60d 100644
+--- a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
++++ b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
+@@ -238,19 +238,15 @@ struct intel_pt_decoder *intel_pt_decoder_new(struct
intel_pt_params *params)
+ if (!(decoder->tsc_ctc_ratio_n % decoder->tsc_ctc_ratio_d))
+ decoder->tsc_ctc_mult = decoder->tsc_ctc_ratio_n /
+ decoder->tsc_ctc_ratio_d;
+-
+- /*
+- * Allow for timestamps appearing to backwards because a TSC
+- * packet has slipped past a MTC packet, so allow 2 MTC ticks
+- * or ...
+- */
+- decoder->tsc_slip = multdiv(2 << decoder->mtc_shift,
+- decoder->tsc_ctc_ratio_n,
+- decoder->tsc_ctc_ratio_d);
+ }
+- /* ... or 0x100 paranoia */
+- if (decoder->tsc_slip < 0x100)
+- decoder->tsc_slip = 0x100;
++
++ /*
++ * A TSC packet can slip past MTC packets so that the timestamp appears
++ * to go backwards. One estimate is that can be up to about 40 CPU
++ * cycles, which is certainly less than 0x1000 TSC ticks, but accept
++ * slippage an order of magnitude more to be on the safe side.
++ */
++ decoder->tsc_slip = 0x10000;
+
+ intel_pt_log("timestamp: mtc_shift %u\n", decoder->mtc_shift);
+ intel_pt_log("timestamp: tsc_ctc_ratio_n %u\n",
decoder->tsc_ctc_ratio_n);
+diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
+index fce48d11ae07..08a954582e31 100644
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -2611,6 +2611,9 @@ static long kvm_device_ioctl(struct file *filp, unsigned
int ioctl,
+ {
+ struct kvm_device *dev = filp->private_data;
+
++ if (dev->kvm->mm != current->mm)
++ return -EIO;
++
+ switch (ioctl) {
+ case KVM_SET_DEVICE_ATTR:
+ return kvm_device_ioctl_attr(dev, dev->ops->set_attr, arg);
