commit: 6d7852b8443ff4a7e48298983aa5257b1362d414 Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> AuthorDate: Fri Apr 5 21:44:47 2019 +0000 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> CommitDate: Fri Apr 5 21:44:47 2019 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=6d7852b8
Linux patch 4.14.111 Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org> 0000_README | 4 + 1110_linux-4.14.111.patch | 3963 +++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 3967 insertions(+) diff --git a/0000_README b/0000_README index a696c1c..f77da1f 100644 --- a/0000_README +++ b/0000_README @@ -483,6 +483,10 @@ Patch: 1109_4.14.110.patch From: http://www.kernel.org Desc: Linux 4.14.110 +Patch: 1110_4.14.111.patch +From: http://www.kernel.org +Desc: Linux 4.14.111 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1110_linux-4.14.111.patch b/1110_linux-4.14.111.patch new file mode 100644 index 0000000..27dc826 --- /dev/null +++ b/1110_linux-4.14.111.patch @@ -0,0 +1,3963 @@ +diff --git a/Documentation/arm/kernel_mode_neon.txt b/Documentation/arm/kernel_mode_neon.txt +index 525452726d31..b9e060c5b61e 100644 +--- a/Documentation/arm/kernel_mode_neon.txt ++++ b/Documentation/arm/kernel_mode_neon.txt +@@ -6,7 +6,7 @@ TL;DR summary + * Use only NEON instructions, or VFP instructions that don't rely on support + code + * Isolate your NEON code in a separate compilation unit, and compile it with +- '-mfpu=neon -mfloat-abi=softfp' ++ '-march=armv7-a -mfpu=neon -mfloat-abi=softfp' + * Put kernel_neon_begin() and kernel_neon_end() calls around the calls into your + NEON code + * Don't sleep in your NEON code, and be aware that it will be executed with +@@ -87,7 +87,7 @@ instructions appearing in unexpected places if no special care is taken. + Therefore, the recommended and only supported way of using NEON/VFP in the + kernel is by adhering to the following rules: + * isolate the NEON code in a separate compilation unit and compile it with +- '-mfpu=neon -mfloat-abi=softfp'; ++ '-march=armv7-a -mfpu=neon -mfloat-abi=softfp'; + * issue the calls to kernel_neon_begin(), kernel_neon_end() as well as the calls + into the unit containing the NEON code from a compilation unit which is *not* + built with the GCC flag '-mfpu=neon' set. +diff --git a/Makefile b/Makefile +index 37bd0b40876d..da223c660c9a 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 14 +-SUBLEVEL = 110 ++SUBLEVEL = 111 + EXTRAVERSION = + NAME = Petit Gorille + +diff --git a/arch/arm/boot/dts/lpc32xx.dtsi b/arch/arm/boot/dts/lpc32xx.dtsi +index d81fe433e3c8..f22a33a01819 100644 +--- a/arch/arm/boot/dts/lpc32xx.dtsi ++++ b/arch/arm/boot/dts/lpc32xx.dtsi +@@ -230,7 +230,7 @@ + status = "disabled"; + }; + +- i2s1: i2s@2009C000 { ++ i2s1: i2s@2009c000 { + compatible = "nxp,lpc3220-i2s"; + reg = <0x2009C000 0x1000>; + }; +@@ -273,7 +273,7 @@ + status = "disabled"; + }; + +- i2c1: i2c@400A0000 { ++ i2c1: i2c@400a0000 { + compatible = "nxp,pnx-i2c"; + reg = <0x400A0000 0x100>; + interrupt-parent = <&sic1>; +@@ -284,7 +284,7 @@ + clocks = <&clk LPC32XX_CLK_I2C1>; + }; + +- i2c2: i2c@400A8000 { ++ i2c2: i2c@400a8000 { + compatible = "nxp,pnx-i2c"; + reg = <0x400A8000 0x100>; + interrupt-parent = <&sic1>; +@@ -295,7 +295,7 @@ + clocks = <&clk LPC32XX_CLK_I2C2>; + }; + +- mpwm: mpwm@400E8000 { ++ mpwm: mpwm@400e8000 { + compatible = "nxp,lpc3220-motor-pwm"; + reg = <0x400E8000 0x78>; + status = "disabled"; +@@ -394,7 +394,7 @@ + #gpio-cells = <3>; /* bank, pin, flags */ + }; + +- timer4: timer@4002C000 { ++ timer4: timer@4002c000 { + compatible = "nxp,lpc3220-timer"; + reg = <0x4002C000 0x1000>; + interrupts = <3 IRQ_TYPE_LEVEL_LOW>; +@@ -412,7 +412,7 @@ + status = "disabled"; + }; + +- watchdog: watchdog@4003C000 { ++ watchdog: watchdog@4003c000 { + compatible = "nxp,pnx4008-wdt"; + reg = <0x4003C000 0x1000>; + clocks = <&clk LPC32XX_CLK_WDOG>; +@@ -451,7 +451,7 @@ + status = "disabled"; + }; + +- timer1: timer@4004C000 { ++ timer1: timer@4004c000 { + compatible = "nxp,lpc3220-timer"; + reg = <0x4004C000 0x1000>; + interrupts = <17 IRQ_TYPE_LEVEL_LOW>; +@@ -475,7 +475,7 @@ + status = "disabled"; + }; + +- pwm1: pwm@4005C000 { ++ pwm1: pwm@4005c000 { + compatible = "nxp,lpc3220-pwm"; + reg = <0x4005C000 0x4>; + clocks = <&clk LPC32XX_CLK_PWM1>; +@@ -484,7 +484,7 @@ + status = "disabled"; + }; + +- pwm2: pwm@4005C004 { ++ pwm2: pwm@4005c004 { + compatible = "nxp,lpc3220-pwm"; + reg = <0x4005C004 0x4>; + clocks = <&clk LPC32XX_CLK_PWM2>; +diff --git a/arch/arm/include/asm/barrier.h b/arch/arm/include/asm/barrier.h +index 69772e742a0a..83ae97c049d9 100644 +--- a/arch/arm/include/asm/barrier.h ++++ b/arch/arm/include/asm/barrier.h +@@ -11,6 +11,8 @@ + #define sev() __asm__ __volatile__ ("sev" : : : "memory") + #define wfe() __asm__ __volatile__ ("wfe" : : : "memory") + #define wfi() __asm__ __volatile__ ("wfi" : : : "memory") ++#else ++#define wfe() do { } while (0) + #endif + + #if __LINUX_ARM_ARCH__ >= 7 +diff --git a/arch/arm/include/asm/processor.h b/arch/arm/include/asm/processor.h +index c3d5fc124a05..768b6fe7640e 100644 +--- a/arch/arm/include/asm/processor.h ++++ b/arch/arm/include/asm/processor.h +@@ -77,7 +77,11 @@ extern void release_thread(struct task_struct *); + unsigned long get_wchan(struct task_struct *p); + + #if __LINUX_ARM_ARCH__ == 6 || defined(CONFIG_ARM_ERRATA_754327) +-#define cpu_relax() smp_mb() ++#define cpu_relax() \ ++ do { \ ++ smp_mb(); \ ++ __asm__ __volatile__("nop; nop; nop; nop; nop; nop; nop; nop; nop; nop;"); \ ++ } while (0) + #else + #define cpu_relax() barrier() + #endif +diff --git a/arch/arm/include/asm/v7m.h b/arch/arm/include/asm/v7m.h +index e6d9e29fcae4..6416fd3a3894 100644 +--- a/arch/arm/include/asm/v7m.h ++++ b/arch/arm/include/asm/v7m.h +@@ -49,7 +49,7 @@ + * (0 -> msp; 1 -> psp). Bits [1:0] are fixed to 0b01. + */ + #define EXC_RET_STACK_MASK 0x00000004 +-#define EXC_RET_THREADMODE_PROCESSSTACK 0xfffffffd ++#define EXC_RET_THREADMODE_PROCESSSTACK (3 << 2) + + /* Cache related definitions */ + +diff --git a/arch/arm/kernel/entry-header.S b/arch/arm/kernel/entry-header.S +index 773424843d6e..62db1c9746cb 100644 +--- a/arch/arm/kernel/entry-header.S ++++ b/arch/arm/kernel/entry-header.S +@@ -127,7 +127,8 @@ + */ + .macro v7m_exception_slow_exit ret_r0 + cpsid i +- ldr lr, =EXC_RET_THREADMODE_PROCESSSTACK ++ ldr lr, =exc_ret ++ ldr lr, [lr] + + @ read original r12, sp, lr, pc and xPSR + add r12, sp, #S_IP +diff --git a/arch/arm/kernel/entry-v7m.S b/arch/arm/kernel/entry-v7m.S +index abcf47848525..19d2dcd6530d 100644 +--- a/arch/arm/kernel/entry-v7m.S ++++ b/arch/arm/kernel/entry-v7m.S +@@ -146,3 +146,7 @@ ENTRY(vector_table) + .rept CONFIG_CPU_V7M_NUM_IRQ + .long __irq_entry @ External Interrupts + .endr ++ .align 2 ++ .globl exc_ret ++exc_ret: ++ .space 4 +diff --git a/arch/arm/kernel/machine_kexec.c b/arch/arm/kernel/machine_kexec.c +index c15318431986..6f77f52baf02 100644 +--- a/arch/arm/kernel/machine_kexec.c ++++ b/arch/arm/kernel/machine_kexec.c +@@ -91,8 +91,11 @@ void machine_crash_nonpanic_core(void *unused) + + set_cpu_online(smp_processor_id(), false); + atomic_dec(&waiting_for_crash_ipi); +- while (1) ++ ++ while (1) { + cpu_relax(); ++ wfe(); ++ } + } + + void crash_smp_send_stop(void) +diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c +index 65f85737c6a2..844bb2f1ddef 100644 +--- a/arch/arm/kernel/smp.c ++++ b/arch/arm/kernel/smp.c +@@ -602,8 +602,10 @@ static void ipi_cpu_stop(unsigned int cpu) + local_fiq_disable(); + local_irq_disable(); + +- while (1) ++ while (1) { + cpu_relax(); ++ wfe(); ++ } + } + + static DEFINE_PER_CPU(struct completion *, cpu_completion); +diff --git a/arch/arm/kernel/unwind.c b/arch/arm/kernel/unwind.c +index 0bee233fef9a..314cfb232a63 100644 +--- a/arch/arm/kernel/unwind.c ++++ b/arch/arm/kernel/unwind.c +@@ -93,7 +93,7 @@ extern const struct unwind_idx __start_unwind_idx[]; + static const struct unwind_idx *__origin_unwind_idx; + extern const struct unwind_idx __stop_unwind_idx[]; + +-static DEFINE_SPINLOCK(unwind_lock); ++static DEFINE_RAW_SPINLOCK(unwind_lock); + static LIST_HEAD(unwind_tables); + + /* Convert a prel31 symbol to an absolute address */ +@@ -201,7 +201,7 @@ static const struct unwind_idx *unwind_find_idx(unsigned long addr) + /* module unwind tables */ + struct unwind_table *table; + +- spin_lock_irqsave(&unwind_lock, flags); ++ raw_spin_lock_irqsave(&unwind_lock, flags); + list_for_each_entry(table, &unwind_tables, list) { + if (addr >= table->begin_addr && + addr < table->end_addr) { +@@ -213,7 +213,7 @@ static const struct unwind_idx *unwind_find_idx(unsigned long addr) + break; + } + } +- spin_unlock_irqrestore(&unwind_lock, flags); ++ raw_spin_unlock_irqrestore(&unwind_lock, flags); + } + + pr_debug("%s: idx = %p\n", __func__, idx); +@@ -529,9 +529,9 @@ struct unwind_table *unwind_table_add(unsigned long start, unsigned long size, + tab->begin_addr = text_addr; + tab->end_addr = text_addr + text_size; + +- spin_lock_irqsave(&unwind_lock, flags); ++ raw_spin_lock_irqsave(&unwind_lock, flags); + list_add_tail(&tab->list, &unwind_tables); +- spin_unlock_irqrestore(&unwind_lock, flags); ++ raw_spin_unlock_irqrestore(&unwind_lock, flags); + + return tab; + } +@@ -543,9 +543,9 @@ void unwind_table_del(struct unwind_table *tab) + if (!tab) + return; + +- spin_lock_irqsave(&unwind_lock, flags); ++ raw_spin_lock_irqsave(&unwind_lock, flags); + list_del(&tab->list); +- spin_unlock_irqrestore(&unwind_lock, flags); ++ raw_spin_unlock_irqrestore(&unwind_lock, flags); + + kfree(tab); + } +diff --git a/arch/arm/lib/Makefile b/arch/arm/lib/Makefile +index 4cb0b9624d8f..4cf026f3f00d 100644 +--- a/arch/arm/lib/Makefile ++++ b/arch/arm/lib/Makefile +@@ -39,7 +39,7 @@ $(obj)/csumpartialcopy.o: $(obj)/csumpartialcopygeneric.S + $(obj)/csumpartialcopyuser.o: $(obj)/csumpartialcopygeneric.S + + ifeq ($(CONFIG_KERNEL_MODE_NEON),y) +- NEON_FLAGS := -mfloat-abi=softfp -mfpu=neon ++ NEON_FLAGS := -march=armv7-a -mfloat-abi=softfp -mfpu=neon + CFLAGS_xor-neon.o += $(NEON_FLAGS) + obj-$(CONFIG_XOR_BLOCKS) += xor-neon.o + endif +diff --git a/arch/arm/lib/xor-neon.c b/arch/arm/lib/xor-neon.c +index 2c40aeab3eaa..c691b901092f 100644 +--- a/arch/arm/lib/xor-neon.c ++++ b/arch/arm/lib/xor-neon.c +@@ -14,7 +14,7 @@ + MODULE_LICENSE("GPL"); + + #ifndef __ARM_NEON__ +-#error You should compile this file with '-mfloat-abi=softfp -mfpu=neon' ++#error You should compile this file with '-march=armv7-a -mfloat-abi=softfp -mfpu=neon' + #endif + + /* +diff --git a/arch/arm/mach-omap2/prm_common.c b/arch/arm/mach-omap2/prm_common.c +index 09180a59b1c9..2f215facba10 100644 +--- a/arch/arm/mach-omap2/prm_common.c ++++ b/arch/arm/mach-omap2/prm_common.c +@@ -528,8 +528,10 @@ void omap_prm_reset_system(void) + + prm_ll_data->reset_system(); + +- while (1) ++ while (1) { + cpu_relax(); ++ wfe(); ++ } + } + + /** +diff --git a/arch/arm/mm/proc-v7m.S b/arch/arm/mm/proc-v7m.S +index 47a5acc64433..92e84181933a 100644 +--- a/arch/arm/mm/proc-v7m.S ++++ b/arch/arm/mm/proc-v7m.S +@@ -139,6 +139,9 @@ __v7m_setup_cont: + cpsie i + svc #0 + 1: cpsid i ++ ldr r0, =exc_ret ++ orr lr, lr, #EXC_RET_THREADMODE_PROCESSSTACK ++ str lr, [r0] + ldmia sp, {r0-r3, r12} + str r5, [r12, #11 * 4] @ restore the original SVC vector entry + mov lr, r6 @ restore LR +diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c +index 5edb706aacb0..465b90d7abf2 100644 +--- a/arch/arm64/mm/fault.c ++++ b/arch/arm64/mm/fault.c +@@ -834,11 +834,12 @@ void __init hook_debug_fault_code(int nr, + debug_fault_info[nr].name = name; + } + +-asmlinkage int __exception do_debug_exception(unsigned long addr, ++asmlinkage int __exception do_debug_exception(unsigned long addr_if_watchpoint, + unsigned int esr, + struct pt_regs *regs) + { + const struct fault_info *inf = debug_fault_info + DBG_ESR_EVT(esr); ++ unsigned long pc = instruction_pointer(regs); + struct siginfo info; + int rv; + +@@ -849,19 +850,19 @@ asmlinkage int __exception do_debug_exception(unsigned long addr, + if (interrupts_enabled(regs)) + trace_hardirqs_off(); + +- if (user_mode(regs) && instruction_pointer(regs) > TASK_SIZE) ++ if (user_mode(regs) && pc > TASK_SIZE) + arm64_apply_bp_hardening(); + +- if (!inf->fn(addr, esr, regs)) { ++ if (!inf->fn(addr_if_watchpoint, esr, regs)) { + rv = 1; + } else { + pr_alert("Unhandled debug exception: %s (0x%08x) at 0x%016lx\n", +- inf->name, esr, addr); ++ inf->name, esr, pc); + + info.si_signo = inf->sig; + info.si_errno = 0; + info.si_code = inf->code; +- info.si_addr = (void __user *)addr; ++ info.si_addr = (void __user *)pc; + arm64_notify_die("", regs, &info, 0); + rv = 0; + } +diff --git a/arch/h8300/Makefile b/arch/h8300/Makefile +index e1c02ca230cb..073bba6f9f60 100644 +--- a/arch/h8300/Makefile ++++ b/arch/h8300/Makefile +@@ -23,7 +23,7 @@ KBUILD_AFLAGS += $(aflags-y) + LDFLAGS += $(ldflags-y) + + ifeq ($(CROSS_COMPILE),) +-CROSS_COMPILE := h8300-unknown-linux- ++CROSS_COMPILE := $(call cc-cross-prefix, h8300-unknown-linux- h8300-linux-) + endif + + core-y += arch/$(ARCH)/kernel/ arch/$(ARCH)/mm/ +diff --git a/arch/powerpc/include/asm/topology.h b/arch/powerpc/include/asm/topology.h +index 66c72b356ac0..e6b185b4b3b1 100644 +--- a/arch/powerpc/include/asm/topology.h ++++ b/arch/powerpc/include/asm/topology.h +@@ -117,6 +117,8 @@ static inline int prrn_is_enabled(void) + #define topology_sibling_cpumask(cpu) (per_cpu(cpu_sibling_map, cpu)) + #define topology_core_cpumask(cpu) (per_cpu(cpu_core_map, cpu)) + #define topology_core_id(cpu) (cpu_to_core_id(cpu)) ++ ++int dlpar_cpu_readd(int cpu); + #endif + #endif + +diff --git a/arch/powerpc/mm/hugetlbpage-radix.c b/arch/powerpc/mm/hugetlbpage-radix.c +index bd022d16745c..a31bad29b55d 100644 +--- a/arch/powerpc/mm/hugetlbpage-radix.c ++++ b/arch/powerpc/mm/hugetlbpage-radix.c +@@ -1,6 +1,7 @@ + // SPDX-License-Identifier: GPL-2.0 + #include <linux/mm.h> + #include <linux/hugetlb.h> ++#include <linux/security.h> + #include <asm/pgtable.h> + #include <asm/pgalloc.h> + #include <asm/cacheflush.h> +@@ -79,7 +80,7 @@ radix__hugetlb_get_unmapped_area(struct file *file, unsigned long addr, + if (addr) { + addr = ALIGN(addr, huge_page_size(h)); + vma = find_vma(mm, addr); +- if (high_limit - len >= addr && ++ if (high_limit - len >= addr && addr >= mmap_min_addr && + (!vma || addr + len <= vm_start_gap(vma))) + return addr; + } +@@ -89,7 +90,7 @@ radix__hugetlb_get_unmapped_area(struct file *file, unsigned long addr, + */ + info.flags = VM_UNMAPPED_AREA_TOPDOWN; + info.length = len; +- info.low_limit = PAGE_SIZE; ++ info.low_limit = max(PAGE_SIZE, mmap_min_addr); + info.high_limit = mm->mmap_base + (high_limit - DEFAULT_MAP_WINDOW); + info.align_mask = PAGE_MASK & ~huge_page_mask(h); + info.align_offset = 0; +diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c +index 40fb9a8835fe..0a02c73a27b3 100644 +--- a/arch/powerpc/mm/numa.c ++++ b/arch/powerpc/mm/numa.c +@@ -1527,13 +1527,6 @@ static void reset_topology_timer(void) + + #ifdef CONFIG_SMP + +-static void stage_topology_update(int core_id) +-{ +- cpumask_or(&cpu_associativity_changes_mask, +- &cpu_associativity_changes_mask, cpu_sibling_mask(core_id)); +- reset_topology_timer(); +-} +- + static int dt_update_callback(struct notifier_block *nb, + unsigned long action, void *data) + { +@@ -1546,7 +1539,7 @@ static int dt_update_callback(struct notifier_block *nb, + !of_prop_cmp(update->prop->name, "ibm,associativity")) { + u32 core_id; + of_property_read_u32(update->dn, "reg", &core_id); +- stage_topology_update(core_id); ++ rc = dlpar_cpu_readd(core_id); + rc = NOTIFY_OK; + } + break; +diff --git a/arch/powerpc/platforms/pseries/hotplug-cpu.c b/arch/powerpc/platforms/pseries/hotplug-cpu.c +index b1ac8ac38434..0baaaa6b0929 100644 +--- a/arch/powerpc/platforms/pseries/hotplug-cpu.c ++++ b/arch/powerpc/platforms/pseries/hotplug-cpu.c +@@ -799,6 +799,25 @@ static int dlpar_cpu_add_by_count(u32 cpus_to_add) + return rc; + } + ++int dlpar_cpu_readd(int cpu) ++{ ++ struct device_node *dn; ++ struct device *dev; ++ u32 drc_index; ++ int rc; ++ ++ dev = get_cpu_device(cpu); ++ dn = dev->of_node; ++ ++ rc = of_property_read_u32(dn, "ibm,my-drc-index", &drc_index); ++ ++ rc = dlpar_cpu_remove_by_index(drc_index); ++ if (!rc) ++ rc = dlpar_cpu_add(drc_index); ++ ++ return rc; ++} ++ + int dlpar_cpu(struct pseries_hp_errorlog *hp_elog) + { + u32 count, drc_index; +diff --git a/arch/powerpc/xmon/ppc-dis.c b/arch/powerpc/xmon/ppc-dis.c +index 31db8c072acd..006c7f864f65 100644 +--- a/arch/powerpc/xmon/ppc-dis.c ++++ b/arch/powerpc/xmon/ppc-dis.c +@@ -162,7 +162,7 @@ int print_insn_powerpc (unsigned long insn, unsigned long memaddr) + dialect |= (PPC_OPCODE_POWER5 | PPC_OPCODE_POWER6 | PPC_OPCODE_POWER7 + | PPC_OPCODE_POWER8 | PPC_OPCODE_POWER9 | PPC_OPCODE_HTM + | PPC_OPCODE_ALTIVEC | PPC_OPCODE_ALTIVEC2 +- | PPC_OPCODE_VSX | PPC_OPCODE_VSX3), ++ | PPC_OPCODE_VSX | PPC_OPCODE_VSX3); + + /* Get the major opcode of the insn. */ + opcode = NULL; +diff --git a/arch/x86/boot/Makefile b/arch/x86/boot/Makefile +index d88a2fddba8c..1c060748c813 100644 +--- a/arch/x86/boot/Makefile ++++ b/arch/x86/boot/Makefile +@@ -100,7 +100,7 @@ $(obj)/zoffset.h: $(obj)/compressed/vmlinux FORCE + AFLAGS_header.o += -I$(objtree)/$(obj) + $(obj)/header.o: $(obj)/zoffset.h + +-LDFLAGS_setup.elf := -T ++LDFLAGS_setup.elf := -m elf_i386 -T + $(obj)/setup.elf: $(src)/setup.ld $(SETUP_OBJS) FORCE + $(call if_changed,ld) + +diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S +index b854ebf5851b..2384a2ae5ec3 100644 +--- a/arch/x86/kernel/vmlinux.lds.S ++++ b/arch/x86/kernel/vmlinux.lds.S +@@ -390,7 +390,7 @@ SECTIONS + * Per-cpu symbols which need to be offset from __per_cpu_load + * for the boot processor. + */ +-#define INIT_PER_CPU(x) init_per_cpu__##x = x + __per_cpu_load ++#define INIT_PER_CPU(x) init_per_cpu__##x = ABSOLUTE(x) + __per_cpu_load + INIT_PER_CPU(gdt_page); + INIT_PER_CPU(irq_stack_union); + +diff --git a/arch/x86/realmode/rm/Makefile b/arch/x86/realmode/rm/Makefile +index 4463fa72db94..96cb20de08af 100644 +--- a/arch/x86/realmode/rm/Makefile ++++ b/arch/x86/realmode/rm/Makefile +@@ -47,7 +47,7 @@ $(obj)/pasyms.h: $(REALMODE_OBJS) FORCE + targets += realmode.lds + $(obj)/realmode.lds: $(obj)/pasyms.h + +-LDFLAGS_realmode.elf := --emit-relocs -T ++LDFLAGS_realmode.elf := -m elf_i386 --emit-relocs -T + CPPFLAGS_realmode.lds += -P -C -I$(objtree)/$(obj) + + targets += realmode.elf +diff --git a/drivers/acpi/acpi_video.c b/drivers/acpi/acpi_video.c +index dbdd460a9958..e39a1489cc72 100644 +--- a/drivers/acpi/acpi_video.c ++++ b/drivers/acpi/acpi_video.c +@@ -2123,21 +2123,29 @@ static int __init intel_opregion_present(void) + return opregion; + } + ++/* Check if the chassis-type indicates there is no builtin LCD panel */ + static bool dmi_is_desktop(void) + { + const char *chassis_type; ++ unsigned long type; + + chassis_type = dmi_get_system_info(DMI_CHASSIS_TYPE); + if (!chassis_type) + return false; + +- if (!strcmp(chassis_type, "3") || /* 3: Desktop */ +- !strcmp(chassis_type, "4") || /* 4: Low Profile Desktop */ +- !strcmp(chassis_type, "5") || /* 5: Pizza Box */ +- !strcmp(chassis_type, "6") || /* 6: Mini Tower */ +- !strcmp(chassis_type, "7") || /* 7: Tower */ +- !strcmp(chassis_type, "11")) /* 11: Main Server Chassis */ ++ if (kstrtoul(chassis_type, 10, &type) != 0) ++ return false; ++ ++ switch (type) { ++ case 0x03: /* Desktop */ ++ case 0x04: /* Low Profile Desktop */ ++ case 0x05: /* Pizza Box */ ++ case 0x06: /* Mini Tower */ ++ case 0x07: /* Tower */ ++ case 0x10: /* Lunch Box */ ++ case 0x11: /* Main Server Chassis */ + return true; ++ } + + return false; + } +diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c +index 930b49606a8c..ea6558d4864c 100644 +--- a/drivers/cdrom/cdrom.c ++++ b/drivers/cdrom/cdrom.c +@@ -265,6 +265,7 @@ + /* #define ERRLOGMASK (CD_WARNING|CD_OPEN|CD_COUNT_TRACKS|CD_CLOSE) */ + /* #define ERRLOGMASK (CD_WARNING|CD_REG_UNREG|CD_DO_IOCTL|CD_OPEN|CD_CLOSE|CD_COUNT_TRACKS) */ + ++#include <linux/atomic.h> + #include <linux/module.h> + #include <linux/fs.h> + #include <linux/major.h> +@@ -3689,9 +3690,9 @@ static struct ctl_table_header *cdrom_sysctl_header; + + static void cdrom_sysctl_register(void) + { +- static int initialized; ++ static atomic_t initialized = ATOMIC_INIT(0); + +- if (initialized == 1) ++ if (!atomic_add_unless(&initialized, 1, 1)) + return; + + cdrom_sysctl_header = register_sysctl_table(cdrom_root_table); +@@ -3702,8 +3703,6 @@ static void cdrom_sysctl_register(void) + cdrom_sysctl_settings.debug = debug; + cdrom_sysctl_settings.lock = lockdoor; + cdrom_sysctl_settings.check = check_media_type; +- +- initialized = 1; + } + + static void cdrom_sysctl_unregister(void) +diff --git a/drivers/char/hpet.c b/drivers/char/hpet.c +index b941e6d59fd6..9dfb28b04559 100644 +--- a/drivers/char/hpet.c ++++ b/drivers/char/hpet.c +@@ -377,7 +377,7 @@ static __init int hpet_mmap_enable(char *str) + pr_info("HPET mmap %s\n", hpet_mmap_enabled ? "enabled" : "disabled"); + return 1; + } +-__setup("hpet_mmap", hpet_mmap_enable); ++__setup("hpet_mmap=", hpet_mmap_enable); + + static int hpet_mmap(struct file *file, struct vm_area_struct *vma) + { +diff --git a/drivers/char/hw_random/virtio-rng.c b/drivers/char/hw_random/virtio-rng.c +index 3fa2f8a009b3..1c5c4314c6b5 100644 +--- a/drivers/char/hw_random/virtio-rng.c ++++ b/drivers/char/hw_random/virtio-rng.c +@@ -73,7 +73,7 @@ static int virtio_read(struct hwrng *rng, void *buf, size_t size, bool wait) + + if (!vi->busy) { + vi->busy = true; +- init_completion(&vi->have_data); ++ reinit_completion(&vi->have_data); + register_buffer(vi, buf, size); + } + +diff --git a/drivers/clk/clk-fractional-divider.c b/drivers/clk/clk-fractional-divider.c +index fdf625fb10fa..083daa293280 100644 +--- a/drivers/clk/clk-fractional-divider.c ++++ b/drivers/clk/clk-fractional-divider.c +@@ -77,7 +77,7 @@ static long clk_fd_round_rate(struct clk_hw *hw, unsigned long rate, + unsigned long m, n; + u64 ret; + +- if (!rate || rate >= *parent_rate) ++ if (!rate || (!clk_hw_can_set_rate_parent(hw) && rate >= *parent_rate)) + return *parent_rate; + + if (fd->approximation) +diff --git a/drivers/clk/rockchip/clk-rk3328.c b/drivers/clk/rockchip/clk-rk3328.c +index b04f29774ee7..559abf76891e 100644 +--- a/drivers/clk/rockchip/clk-rk3328.c ++++ b/drivers/clk/rockchip/clk-rk3328.c +@@ -78,17 +78,17 @@ static struct rockchip_pll_rate_table rk3328_pll_rates[] = { + + static struct rockchip_pll_rate_table rk3328_pll_frac_rates[] = { + /* _mhz, _refdiv, _fbdiv, _postdiv1, _postdiv2, _dsmpd, _frac */ +- RK3036_PLL_RATE(1016064000, 3, 127, 1, 1, 0, 134217), ++ RK3036_PLL_RATE(1016064000, 3, 127, 1, 1, 0, 134218), + /* vco = 1016064000 */ +- RK3036_PLL_RATE(983040000, 24, 983, 1, 1, 0, 671088), ++ RK3036_PLL_RATE(983040000, 24, 983, 1, 1, 0, 671089), + /* vco = 983040000 */ +- RK3036_PLL_RATE(491520000, 24, 983, 2, 1, 0, 671088), ++ RK3036_PLL_RATE(491520000, 24, 983, 2, 1, 0, 671089), + /* vco = 983040000 */ +- RK3036_PLL_RATE(61440000, 6, 215, 7, 2, 0, 671088), ++ RK3036_PLL_RATE(61440000, 6, 215, 7, 2, 0, 671089), + /* vco = 860156000 */ +- RK3036_PLL_RATE(56448000, 12, 451, 4, 4, 0, 9797894), ++ RK3036_PLL_RATE(56448000, 12, 451, 4, 4, 0, 9797895), + /* vco = 903168000 */ +- RK3036_PLL_RATE(40960000, 12, 409, 4, 5, 0, 10066329), ++ RK3036_PLL_RATE(40960000, 12, 409, 4, 5, 0, 10066330), + /* vco = 819200000 */ + { /* sentinel */ }, + }; +diff --git a/drivers/cpufreq/acpi-cpufreq.c b/drivers/cpufreq/acpi-cpufreq.c +index d0c34df0529c..51a3c15ace09 100644 +--- a/drivers/cpufreq/acpi-cpufreq.c ++++ b/drivers/cpufreq/acpi-cpufreq.c +@@ -909,8 +909,10 @@ static void __init acpi_cpufreq_boost_init(void) + { + int ret; + +- if (!(boot_cpu_has(X86_FEATURE_CPB) || boot_cpu_has(X86_FEATURE_IDA))) ++ if (!(boot_cpu_has(X86_FEATURE_CPB) || boot_cpu_has(X86_FEATURE_IDA))) { ++ pr_debug("Boost capabilities not present in the processor\n"); + return; ++ } + + acpi_cpufreq_driver.set_boost = set_boost; + acpi_cpufreq_driver.boost_enabled = boost_state(0); +diff --git a/drivers/crypto/amcc/crypto4xx_trng.c b/drivers/crypto/amcc/crypto4xx_trng.c +index 677ca17fd223..368c5599515e 100644 +--- a/drivers/crypto/amcc/crypto4xx_trng.c ++++ b/drivers/crypto/amcc/crypto4xx_trng.c +@@ -80,8 +80,10 @@ void ppc4xx_trng_probe(struct crypto4xx_core_device *core_dev) + + /* Find the TRNG device node and map it */ + trng = of_find_matching_node(NULL, ppc4xx_trng_match); +- if (!trng || !of_device_is_available(trng)) ++ if (!trng || !of_device_is_available(trng)) { ++ of_node_put(trng); + return; ++ } + + dev->trng_base = of_iomap(trng, 0); + of_node_put(trng); +diff --git a/drivers/crypto/cavium/zip/zip_main.c b/drivers/crypto/cavium/zip/zip_main.c +index 1cd8aa488185..a6425a7afa7b 100644 +--- a/drivers/crypto/cavium/zip/zip_main.c ++++ b/drivers/crypto/cavium/zip/zip_main.c +@@ -351,6 +351,7 @@ static struct pci_driver zip_driver = { + + static struct crypto_alg zip_comp_deflate = { + .cra_name = "deflate", ++ .cra_driver_name = "deflate-cavium", + .cra_flags = CRYPTO_ALG_TYPE_COMPRESS, + .cra_ctxsize = sizeof(struct zip_kernel_ctx), + .cra_priority = 300, +@@ -365,6 +366,7 @@ static struct crypto_alg zip_comp_deflate = { + + static struct crypto_alg zip_comp_lzs = { + .cra_name = "lzs", ++ .cra_driver_name = "lzs-cavium", + .cra_flags = CRYPTO_ALG_TYPE_COMPRESS, + .cra_ctxsize = sizeof(struct zip_kernel_ctx), + .cra_priority = 300, +@@ -384,7 +386,7 @@ static struct scomp_alg zip_scomp_deflate = { + .decompress = zip_scomp_decompress, + .base = { + .cra_name = "deflate", +- .cra_driver_name = "deflate-scomp", ++ .cra_driver_name = "deflate-scomp-cavium", + .cra_module = THIS_MODULE, + .cra_priority = 300, + } +@@ -397,7 +399,7 @@ static struct scomp_alg zip_scomp_lzs = { + .decompress = zip_scomp_decompress, + .base = { + .cra_name = "lzs", +- .cra_driver_name = "lzs-scomp", ++ .cra_driver_name = "lzs-scomp-cavium", + .cra_module = THIS_MODULE, + .cra_priority = 300, + } +diff --git a/drivers/dma/imx-dma.c b/drivers/dma/imx-dma.c +index cb37730f9272..6eb1f05f7c3c 100644 +--- a/drivers/dma/imx-dma.c ++++ b/drivers/dma/imx-dma.c +@@ -290,7 +290,7 @@ static inline int imxdma_sg_next(struct imxdma_desc *d) + struct scatterlist *sg = d->sg; + unsigned long now; + +- now = min(d->len, sg_dma_len(sg)); ++ now = min_t(size_t, d->len, sg_dma_len(sg)); + if (d->len != IMX_DMA_LENGTH_LOOP) + d->len -= now; + +diff --git a/drivers/dma/qcom/hidma.c b/drivers/dma/qcom/hidma.c +index e3669850aef4..dd15a829e792 100644 +--- a/drivers/dma/qcom/hidma.c ++++ b/drivers/dma/qcom/hidma.c +@@ -133,24 +133,25 @@ static void hidma_process_completed(struct hidma_chan *mchan) + desc = &mdesc->desc; + last_cookie = desc->cookie; + ++ llstat = hidma_ll_status(mdma->lldev, mdesc->tre_ch); ++ + spin_lock_irqsave(&mchan->lock, irqflags); ++ if (llstat == DMA_COMPLETE) { ++ mchan->last_success = last_cookie; ++ result.result = DMA_TRANS_NOERROR; ++ } else { ++ result.result = DMA_TRANS_ABORTED; ++ } ++ + dma_cookie_complete(desc); + spin_unlock_irqrestore(&mchan->lock, irqflags); + +- llstat = hidma_ll_status(mdma->lldev, mdesc->tre_ch); + dmaengine_desc_get_callback(desc, &cb); + + dma_run_dependencies(desc); + + spin_lock_irqsave(&mchan->lock, irqflags); + list_move(&mdesc->node, &mchan->free); +- +- if (llstat == DMA_COMPLETE) { +- mchan->last_success = last_cookie; +- result.result = DMA_TRANS_NOERROR; +- } else +- result.result = DMA_TRANS_ABORTED; +- + spin_unlock_irqrestore(&mchan->lock, irqflags); + + dmaengine_desc_callback_invoke(&cb, &result); +@@ -410,6 +411,7 @@ hidma_prep_dma_memcpy(struct dma_chan *dmach, dma_addr_t dest, dma_addr_t src, + if (!mdesc) + return NULL; + ++ mdesc->desc.flags = flags; + hidma_ll_set_transfer_params(mdma->lldev, mdesc->tre_ch, + src, dest, len, flags, + HIDMA_TRE_MEMCPY); +@@ -442,6 +444,7 @@ hidma_prep_dma_memset(struct dma_chan *dmach, dma_addr_t dest, int value, + if (!mdesc) + return NULL; + ++ mdesc->desc.flags = flags; + hidma_ll_set_transfer_params(mdma->lldev, mdesc->tre_ch, + value, dest, len, flags, + HIDMA_TRE_MEMSET); +diff --git a/drivers/dma/tegra20-apb-dma.c b/drivers/dma/tegra20-apb-dma.c +index b9d75a54c896..7db2766b5fe9 100644 +--- a/drivers/dma/tegra20-apb-dma.c ++++ b/drivers/dma/tegra20-apb-dma.c +@@ -635,7 +635,10 @@ static void handle_cont_sngl_cycle_dma_done(struct tegra_dma_channel *tdc, + + sgreq = list_first_entry(&tdc->pending_sg_req, typeof(*sgreq), node); + dma_desc = sgreq->dma_desc; +- dma_desc->bytes_transferred += sgreq->req_len; ++ /* if we dma for long enough the transfer count will wrap */ ++ dma_desc->bytes_transferred = ++ (dma_desc->bytes_transferred + sgreq->req_len) % ++ dma_desc->bytes_requested; + + /* Callback need to be call */ + if (!dma_desc->cb_count) +diff --git a/drivers/firmware/efi/cper.c b/drivers/firmware/efi/cper.c +index d2fcafcea07e..ce23d5402bd6 100644 +--- a/drivers/firmware/efi/cper.c ++++ b/drivers/firmware/efi/cper.c +@@ -641,19 +641,24 @@ EXPORT_SYMBOL_GPL(cper_estatus_check_header); + int cper_estatus_check(const struct acpi_hest_generic_status *estatus) + { + struct acpi_hest_generic_data *gdata; +- unsigned int data_len, gedata_len; ++ unsigned int data_len, record_size; + int rc; + + rc = cper_estatus_check_header(estatus); + if (rc) + return rc; ++ + data_len = estatus->data_length; + + apei_estatus_for_each_section(estatus, gdata) { +- gedata_len = acpi_hest_get_error_length(gdata); +- if (gedata_len > data_len - acpi_hest_get_size(gdata)) ++ if (sizeof(struct acpi_hest_generic_data) > data_len) ++ return -EINVAL; ++ ++ record_size = acpi_hest_get_record_size(gdata); ++ if (record_size > data_len) + return -EINVAL; +- data_len -= acpi_hest_get_record_size(gdata); ++ ++ data_len -= record_size; + } + if (data_len) + return -EINVAL; +diff --git a/drivers/firmware/efi/libstub/arm-stub.c b/drivers/firmware/efi/libstub/arm-stub.c +index 01a9d78ee415..3b1e1dc3fb46 100644 +--- a/drivers/firmware/efi/libstub/arm-stub.c ++++ b/drivers/firmware/efi/libstub/arm-stub.c +@@ -364,6 +364,11 @@ void efi_get_virtmap(efi_memory_desc_t *memory_map, unsigned long map_size, + paddr = in->phys_addr; + size = in->num_pages * EFI_PAGE_SIZE; + ++ if (novamap()) { ++ in->virt_addr = in->phys_addr; ++ continue; ++ } ++ + /* + * Make the mapping compatible with 64k pages: this allows + * a 4k page size kernel to kexec a 64k page size kernel and +diff --git a/drivers/firmware/efi/libstub/efi-stub-helper.c b/drivers/firmware/efi/libstub/efi-stub-helper.c +index 50a9cab5a834..39f87e6dac5c 100644 +--- a/drivers/firmware/efi/libstub/efi-stub-helper.c ++++ b/drivers/firmware/efi/libstub/efi-stub-helper.c +@@ -34,6 +34,7 @@ static unsigned long __chunk_size = EFI_READ_CHUNK_SIZE; + + static int __section(.data) __nokaslr; + static int __section(.data) __quiet; ++static int __section(.data) __novamap; + + int __pure nokaslr(void) + { +@@ -43,6 +44,10 @@ int __pure is_quiet(void) + { + return __quiet; + } ++int __pure novamap(void) ++{ ++ return __novamap; ++} + + #define EFI_MMAP_NR_SLACK_SLOTS 8 + +@@ -454,6 +459,11 @@ efi_status_t efi_parse_options(char const *cmdline) + __chunk_size = -1UL; + } + ++ if (!strncmp(str, "novamap", 7)) { ++ str += strlen("novamap"); ++ __novamap = 1; ++ } ++ + /* Group words together, delimited by "," */ + while (*str && *str != ' ' && *str != ',') + str++; +diff --git a/drivers/firmware/efi/libstub/efistub.h b/drivers/firmware/efi/libstub/efistub.h +index f59564b72ddc..2adde22b4a9f 100644 +--- a/drivers/firmware/efi/libstub/efistub.h ++++ b/drivers/firmware/efi/libstub/efistub.h +@@ -27,6 +27,7 @@ + + extern int __pure nokaslr(void); + extern int __pure is_quiet(void); ++extern int __pure novamap(void); + + #define pr_efi(sys_table, msg) do { \ + if (!is_quiet()) efi_printk(sys_table, "EFI stub: "msg); \ +diff --git a/drivers/firmware/efi/libstub/fdt.c b/drivers/firmware/efi/libstub/fdt.c +index 0c0d2312f4a8..dba296a44f4e 100644 +--- a/drivers/firmware/efi/libstub/fdt.c ++++ b/drivers/firmware/efi/libstub/fdt.c +@@ -327,6 +327,9 @@ efi_status_t allocate_new_fdt_and_exit_boot(efi_system_table_t *sys_table, + if (status == EFI_SUCCESS) { + efi_set_virtual_address_map_t *svam; + ++ if (novamap()) ++ return EFI_SUCCESS; ++ + /* Install the new virtual address map */ + svam = sys_table->runtime->set_virtual_address_map; + status = svam(runtime_entry_count * desc_size, desc_size, +diff --git a/drivers/firmware/efi/memattr.c b/drivers/firmware/efi/memattr.c +index 8986757eafaf..aac972b056d9 100644 +--- a/drivers/firmware/efi/memattr.c ++++ b/drivers/firmware/efi/memattr.c +@@ -94,7 +94,7 @@ static bool entry_is_valid(const efi_memory_desc_t *in, efi_memory_desc_t *out) + + if (!(md->attribute & EFI_MEMORY_RUNTIME)) + continue; +- if (md->virt_addr == 0) { ++ if (md->virt_addr == 0 && md->phys_addr != 0) { + /* no virtual mapping has been installed by the stub */ + break; + } +diff --git a/drivers/gpio/gpio-omap.c b/drivers/gpio/gpio-omap.c +index 3233b72b6828..148e81eea35a 100644 +--- a/drivers/gpio/gpio-omap.c ++++ b/drivers/gpio/gpio-omap.c +@@ -841,14 +841,16 @@ static void omap_gpio_unmask_irq(struct irq_data *d) + if (trigger) + omap_set_gpio_triggering(bank, offset, trigger); + +- /* For level-triggered GPIOs, the clearing must be done after +- * the HW source is cleared, thus after the handler has run */ +- if (bank->level_mask & BIT(offset)) { +- omap_set_gpio_irqenable(bank, offset, 0); ++ omap_set_gpio_irqenable(bank, offset, 1); ++ ++ /* ++ * For level-triggered GPIOs, clearing must be done after the source ++ * is cleared, thus after the handler has run. OMAP4 needs this done ++ * after enabing the interrupt to clear the wakeup status. ++ */ ++ if (bank->level_mask & BIT(offset)) + omap_clear_gpio_irqstatus(bank, offset); +- } + +- omap_set_gpio_irqenable(bank, offset, 1); + raw_spin_unlock_irqrestore(&bank->lock, flags); + } + +diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c +index 2a4cf6837324..bb9a9852ec22 100644 +--- a/drivers/gpu/drm/drm_dp_mst_topology.c ++++ b/drivers/gpu/drm/drm_dp_mst_topology.c +@@ -3199,6 +3199,7 @@ static int drm_dp_mst_i2c_xfer(struct i2c_adapter *adapter, struct i2c_msg *msgs + msg.u.i2c_read.transactions[i].i2c_dev_id = msgs[i].addr; + msg.u.i2c_read.transactions[i].num_bytes = msgs[i].len; + msg.u.i2c_read.transactions[i].bytes = msgs[i].buf; ++ msg.u.i2c_read.transactions[i].no_stop_bit = !(msgs[i].flags & I2C_M_STOP); + } + msg.u.i2c_read.read_i2c_device_id = msgs[num - 1].addr; + msg.u.i2c_read.num_bytes_read = msgs[num - 1].len; +diff --git a/drivers/gpu/drm/drm_plane.c b/drivers/gpu/drm/drm_plane.c +index 7a00351d5b5d..71186bf90760 100644 +--- a/drivers/gpu/drm/drm_plane.c ++++ b/drivers/gpu/drm/drm_plane.c +@@ -203,6 +203,9 @@ int drm_universal_plane_init(struct drm_device *dev, struct drm_plane *plane, + format_modifier_count++; + } + ++ if (format_modifier_count) ++ config->allow_fb_modifiers = true; ++ + plane->modifier_count = format_modifier_count; + plane->modifiers = kmalloc_array(format_modifier_count, + sizeof(format_modifiers[0]), +diff --git a/drivers/gpu/drm/nouveau/dispnv04/tvnv17.c b/drivers/gpu/drm/nouveau/dispnv04/tvnv17.c +index 6d99f11fee4e..4bc8e9fe3095 100644 +--- a/drivers/gpu/drm/nouveau/dispnv04/tvnv17.c ++++ b/drivers/gpu/drm/nouveau/dispnv04/tvnv17.c +@@ -750,7 +750,9 @@ static int nv17_tv_set_property(struct drm_encoder *encoder, + /* Disable the crtc to ensure a full modeset is + * performed whenever it's turned on again. */ + if (crtc) +- drm_crtc_force_disable(crtc); ++ drm_crtc_helper_set_mode(crtc, &crtc->mode, ++ crtc->x, crtc->y, ++ crtc->primary->fb); + } + + return 0; +diff --git a/drivers/hid/intel-ish-hid/ipc/ipc.c b/drivers/hid/intel-ish-hid/ipc/ipc.c +index 9a60ec13cb10..a3106fcc2253 100644 +--- a/drivers/hid/intel-ish-hid/ipc/ipc.c ++++ b/drivers/hid/intel-ish-hid/ipc/ipc.c +@@ -91,7 +91,10 @@ static bool check_generated_interrupt(struct ishtp_device *dev) + IPC_INT_FROM_ISH_TO_HOST_CHV_AB(pisr_val); + } else { + pisr_val = ish_reg_read(dev, IPC_REG_PISR_BXT); +- interrupt_generated = IPC_INT_FROM_ISH_TO_HOST_BXT(pisr_val); ++ interrupt_generated = !!pisr_val; ++ /* only busy-clear bit is RW, others are RO */ ++ if (pisr_val) ++ ish_reg_write(dev, IPC_REG_PISR_BXT, pisr_val); + } + + return interrupt_generated; +@@ -843,11 +846,11 @@ int ish_hw_start(struct ishtp_device *dev) + { + ish_set_host_rdy(dev); + ++ set_host_ready(dev); ++ + /* After that we can enable ISH DMA operation and wakeup ISHFW */ + ish_wakeup(dev); + +- set_host_ready(dev); +- + /* wait for FW-initiated reset flow */ + if (!dev->recvd_hw_ready) + wait_event_interruptible_timeout(dev->wait_hw_ready, +diff --git a/drivers/hid/intel-ish-hid/ishtp/bus.c b/drivers/hid/intel-ish-hid/ishtp/bus.c +index 2623a567ffba..f546635e9ac9 100644 +--- a/drivers/hid/intel-ish-hid/ishtp/bus.c ++++ b/drivers/hid/intel-ish-hid/ishtp/bus.c +@@ -623,7 +623,8 @@ int ishtp_cl_device_bind(struct ishtp_cl *cl) + spin_lock_irqsave(&cl->dev->device_list_lock, flags); + list_for_each_entry(cl_device, &cl->dev->device_list, + device_link) { +- if (cl_device->fw_client->client_id == cl->fw_client_id) { ++ if (cl_device->fw_client && ++ cl_device->fw_client->client_id == cl->fw_client_id) { + cl->device = cl_device; + rv = 0; + break; +@@ -683,6 +684,7 @@ void ishtp_bus_remove_all_clients(struct ishtp_device *ishtp_dev, + spin_lock_irqsave(&ishtp_dev->device_list_lock, flags); + list_for_each_entry_safe(cl_device, n, &ishtp_dev->device_list, + device_link) { ++ cl_device->fw_client = NULL; + if (warm_reset && cl_device->reference_count) + continue; + +diff --git a/drivers/hwtracing/coresight/coresight-etm4x.c b/drivers/hwtracing/coresight/coresight-etm4x.c +index 5a1a14bcae72..78cb3b8881fa 100644 +--- a/drivers/hwtracing/coresight/coresight-etm4x.c ++++ b/drivers/hwtracing/coresight/coresight-etm4x.c +@@ -61,7 +61,8 @@ static void etm4_os_unlock(struct etmv4_drvdata *drvdata) + + static bool etm4_arch_supported(u8 arch) + { +- switch (arch) { ++ /* Mask out the minor version number */ ++ switch (arch & 0xf0) { + case ETM_ARCH_V4: + break; + default: +diff --git a/drivers/iio/adc/qcom-pm8xxx-xoadc.c b/drivers/iio/adc/qcom-pm8xxx-xoadc.c +index cea8f1fb444a..7e8da418a7b7 100644 +--- a/drivers/iio/adc/qcom-pm8xxx-xoadc.c ++++ b/drivers/iio/adc/qcom-pm8xxx-xoadc.c +@@ -423,18 +423,14 @@ static irqreturn_t pm8xxx_eoc_irq(int irq, void *d) + static struct pm8xxx_chan_info * + pm8xxx_get_channel(struct pm8xxx_xoadc *adc, u8 chan) + { +- struct pm8xxx_chan_info *ch; + int i; + + for (i = 0; i < adc->nchans; i++) { +- ch = &adc->chans[i]; ++ struct pm8xxx_chan_info *ch = &adc->chans[i]; + if (ch->hwchan->amux_channel == chan) +- break; ++ return ch; + } +- if (i == adc->nchans) +- return NULL; +- +- return ch; ++ return NULL; + } + + static int pm8xxx_read_channel_rsv(struct pm8xxx_xoadc *adc, +diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c +index daf7a56e5d7e..e17f11782821 100644 +--- a/drivers/infiniband/hw/cxgb4/cm.c ++++ b/drivers/infiniband/hw/cxgb4/cm.c +@@ -1884,8 +1884,10 @@ static int abort_rpl(struct c4iw_dev *dev, struct sk_buff *skb) + } + mutex_unlock(&ep->com.mutex); + +- if (release) ++ if (release) { ++ close_complete_upcall(ep, -ECONNRESET); + release_ep_resources(ep); ++ } + c4iw_put_ep(&ep->com); + return 0; + } +@@ -3584,7 +3586,6 @@ int c4iw_ep_disconnect(struct c4iw_ep *ep, int abrupt, gfp_t gfp) + if (close) { + if (abrupt) { + set_bit(EP_DISC_ABORT, &ep->com.history); +- close_complete_upcall(ep, -ECONNRESET); + ret = send_abort(ep); + } else { + set_bit(EP_DISC_CLOSE, &ep->com.history); +diff --git a/drivers/infiniband/hw/mlx4/cm.c b/drivers/infiniband/hw/mlx4/cm.c +index fedaf8260105..8c79a480f2b7 100644 +--- a/drivers/infiniband/hw/mlx4/cm.c ++++ b/drivers/infiniband/hw/mlx4/cm.c +@@ -39,7 +39,7 @@ + + #include "mlx4_ib.h" + +-#define CM_CLEANUP_CACHE_TIMEOUT (5 * HZ) ++#define CM_CLEANUP_CACHE_TIMEOUT (30 * HZ) + + struct id_map_entry { + struct rb_node node; +diff --git a/drivers/iommu/io-pgtable-arm-v7s.c b/drivers/iommu/io-pgtable-arm-v7s.c +index 29b7a6755fcd..56368c8bd791 100644 +--- a/drivers/iommu/io-pgtable-arm-v7s.c ++++ b/drivers/iommu/io-pgtable-arm-v7s.c +@@ -217,7 +217,8 @@ static void *__arm_v7s_alloc_table(int lvl, gfp_t gfp, + if (dma != phys) + goto out_unmap; + } +- kmemleak_ignore(table); ++ if (lvl == 2) ++ kmemleak_ignore(table); + return table; + + out_unmap: +diff --git a/drivers/leds/leds-lp55xx-common.c b/drivers/leds/leds-lp55xx-common.c +index 5377f22ff994..e2655953667c 100644 +--- a/drivers/leds/leds-lp55xx-common.c ++++ b/drivers/leds/leds-lp55xx-common.c +@@ -201,7 +201,7 @@ static void lp55xx_firmware_loaded(const struct firmware *fw, void *context) + + if (!fw) { + dev_err(dev, "firmware request failed\n"); +- goto out; ++ return; + } + + /* handling firmware data is chip dependent */ +@@ -214,9 +214,9 @@ static void lp55xx_firmware_loaded(const struct firmware *fw, void *context) + + mutex_unlock(&chip->lock); + +-out: + /* firmware should be released for other channel use */ + release_firmware(chip->fw); ++ chip->fw = NULL; + } + + static int lp55xx_request_firmware(struct lp55xx_chip *chip) +diff --git a/drivers/md/bcache/sysfs.c b/drivers/md/bcache/sysfs.c +index 5d81cd06af00..def9c3478b89 100644 +--- a/drivers/md/bcache/sysfs.c ++++ b/drivers/md/bcache/sysfs.c +@@ -217,7 +217,9 @@ STORE(__cached_dev) + d_strtoul(writeback_rate_d_term); + d_strtoul_nonzero(writeback_rate_p_term_inverse); + +- d_strtoi_h(sequential_cutoff); ++ sysfs_strtoul_clamp(sequential_cutoff, ++ dc->sequential_cutoff, ++ 0, UINT_MAX); + d_strtoi_h(readahead); + + if (attr == &sysfs_clear_stats) +@@ -660,8 +662,17 @@ STORE(__bch_cache_set) + c->error_limit = strtoul_or_return(buf) << IO_ERROR_SHIFT; + + /* See count_io_errors() for why 88 */ +- if (attr == &sysfs_io_error_halflife) +- c->error_decay = strtoul_or_return(buf) / 88; ++ if (attr == &sysfs_io_error_halflife) { ++ unsigned long v = 0; ++ ssize_t ret; ++ ++ ret = strtoul_safe_clamp(buf, v, 0, UINT_MAX); ++ if (!ret) { ++ c->error_decay = v / 88; ++ return size; ++ } ++ return ret; ++ } + + sysfs_strtoul(journal_delay_ms, c->journal_delay_ms); + sysfs_strtoul(verify, c->verify); +diff --git a/drivers/md/bcache/sysfs.h b/drivers/md/bcache/sysfs.h +index b54fe9602529..e6e258f897ca 100644 +--- a/drivers/md/bcache/sysfs.h ++++ b/drivers/md/bcache/sysfs.h +@@ -81,9 +81,16 @@ do { \ + + #define sysfs_strtoul_clamp(file, var, min, max) \ + do { \ +- if (attr == &sysfs_ ## file) \ +- return strtoul_safe_clamp(buf, var, min, max) \ +- ?: (ssize_t) size; \ ++ if (attr == &sysfs_ ## file) { \ ++ unsigned long v = 0; \ ++ ssize_t ret; \ ++ ret = strtoul_safe_clamp(buf, v, min, max); \ ++ if (!ret) { \ ++ var = v; \ ++ return size; \ ++ } \ ++ return ret; \ ++ } \ + } while (0) + + #define strtoul_or_return(cp) \ +diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c +index 18d6a8a10d5d..aa7795990989 100644 +--- a/drivers/md/dm-thin.c ++++ b/drivers/md/dm-thin.c +@@ -3292,6 +3292,13 @@ static int pool_ctr(struct dm_target *ti, unsigned argc, char **argv) + as.argc = argc; + as.argv = argv; + ++ /* make sure metadata and data are different devices */ ++ if (!strcmp(argv[0], argv[1])) { ++ ti->error = "Error setting metadata or data device"; ++ r = -EINVAL; ++ goto out_unlock; ++ } ++ + /* + * Set default pool features. + */ +@@ -4173,6 +4180,12 @@ static int thin_ctr(struct dm_target *ti, unsigned argc, char **argv) + tc->sort_bio_list = RB_ROOT; + + if (argc == 3) { ++ if (!strcmp(argv[0], argv[2])) { ++ ti->error = "Error setting origin device"; ++ r = -EINVAL; ++ goto bad_origin_dev; ++ } ++ + r = dm_get_device(ti, argv[2], FMODE_READ, &origin_dev); + if (r) { + ti->error = "Error opening origin device"; +diff --git a/drivers/media/i2c/mt9m111.c b/drivers/media/i2c/mt9m111.c +index 99b992e46702..5b10f74fcc32 100644 +--- a/drivers/media/i2c/mt9m111.c ++++ b/drivers/media/i2c/mt9m111.c +@@ -974,6 +974,8 @@ static int mt9m111_probe(struct i2c_client *client, + mt9m111->rect.top = MT9M111_MIN_DARK_ROWS; + mt9m111->rect.width = MT9M111_MAX_WIDTH; + mt9m111->rect.height = MT9M111_MAX_HEIGHT; ++ mt9m111->width = mt9m111->rect.width; ++ mt9m111->height = mt9m111->rect.height; + mt9m111->fmt = &mt9m111_colour_fmts[0]; + mt9m111->lastpage = -1; + mutex_init(&mt9m111->power_lock); +diff --git a/drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c b/drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c +index 226f90886484..46c996936798 100644 +--- a/drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c ++++ b/drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c +@@ -702,7 +702,7 @@ end: + v4l2_m2m_buf_queue(ctx->fh.m2m_ctx, to_vb2_v4l2_buffer(vb)); + } + +-static void *mtk_jpeg_buf_remove(struct mtk_jpeg_ctx *ctx, ++static struct vb2_v4l2_buffer *mtk_jpeg_buf_remove(struct mtk_jpeg_ctx *ctx, + enum v4l2_buf_type type) + { + if (V4L2_TYPE_IS_OUTPUT(type)) +@@ -714,7 +714,7 @@ static void *mtk_jpeg_buf_remove(struct mtk_jpeg_ctx *ctx, + static int mtk_jpeg_start_streaming(struct vb2_queue *q, unsigned int count) + { + struct mtk_jpeg_ctx *ctx = vb2_get_drv_priv(q); +- struct vb2_buffer *vb; ++ struct vb2_v4l2_buffer *vb; + int ret = 0; + + ret = pm_runtime_get_sync(ctx->jpeg->dev); +@@ -724,14 +724,14 @@ static int mtk_jpeg_start_streaming(struct vb2_queue *q, unsigned int count) + return 0; + err: + while ((vb = mtk_jpeg_buf_remove(ctx, q->type))) +- v4l2_m2m_buf_done(to_vb2_v4l2_buffer(vb), VB2_BUF_STATE_QUEUED); ++ v4l2_m2m_buf_done(vb, VB2_BUF_STATE_QUEUED); + return ret; + } + + static void mtk_jpeg_stop_streaming(struct vb2_queue *q) + { + struct mtk_jpeg_ctx *ctx = vb2_get_drv_priv(q); +- struct vb2_buffer *vb; ++ struct vb2_v4l2_buffer *vb; + + /* + * STREAMOFF is an acknowledgment for source change event. +@@ -743,7 +743,7 @@ static void mtk_jpeg_stop_streaming(struct vb2_queue *q) + struct mtk_jpeg_src_buf *src_buf; + + vb = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx); +- src_buf = mtk_jpeg_vb2_to_srcbuf(vb); ++ src_buf = mtk_jpeg_vb2_to_srcbuf(&vb->vb2_buf); + mtk_jpeg_set_queue_data(ctx, &src_buf->dec_param); + ctx->state = MTK_JPEG_RUNNING; + } else if (V4L2_TYPE_IS_OUTPUT(q->type)) { +@@ -751,7 +751,7 @@ static void mtk_jpeg_stop_streaming(struct vb2_queue *q) + } + + while ((vb = mtk_jpeg_buf_remove(ctx, q->type))) +- v4l2_m2m_buf_done(to_vb2_v4l2_buffer(vb), VB2_BUF_STATE_ERROR); ++ v4l2_m2m_buf_done(vb, VB2_BUF_STATE_ERROR); + + pm_runtime_put_sync(ctx->jpeg->dev); + } +@@ -807,7 +807,7 @@ static void mtk_jpeg_device_run(void *priv) + { + struct mtk_jpeg_ctx *ctx = priv; + struct mtk_jpeg_dev *jpeg = ctx->jpeg; +- struct vb2_buffer *src_buf, *dst_buf; ++ struct vb2_v4l2_buffer *src_buf, *dst_buf; + enum vb2_buffer_state buf_state = VB2_BUF_STATE_ERROR; + unsigned long flags; + struct mtk_jpeg_src_buf *jpeg_src_buf; +@@ -817,11 +817,11 @@ static void mtk_jpeg_device_run(void *priv) + + src_buf = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx); + dst_buf = v4l2_m2m_next_dst_buf(ctx->fh.m2m_ctx); +- jpeg_src_buf = mtk_jpeg_vb2_to_srcbuf(src_buf); ++ jpeg_src_buf = mtk_jpeg_vb2_to_srcbuf(&src_buf->vb2_buf); + + if (jpeg_src_buf->flags & MTK_JPEG_BUF_FLAGS_LAST_FRAME) { +- for (i = 0; i < dst_buf->num_planes; i++) +- vb2_set_plane_payload(dst_buf, i, 0); ++ for (i = 0; i < dst_buf->vb2_buf.num_planes; i++) ++ vb2_set_plane_payload(&dst_buf->vb2_buf, i, 0); + buf_state = VB2_BUF_STATE_DONE; + goto dec_end; + } +@@ -833,8 +833,8 @@ static void mtk_jpeg_device_run(void *priv) + return; + } + +- mtk_jpeg_set_dec_src(ctx, src_buf, &bs); +- if (mtk_jpeg_set_dec_dst(ctx, &jpeg_src_buf->dec_param, dst_buf, &fb)) ++ mtk_jpeg_set_dec_src(ctx, &src_buf->vb2_buf, &bs); ++ if (mtk_jpeg_set_dec_dst(ctx, &jpeg_src_buf->dec_param, &dst_buf->vb2_buf, &fb)) + goto dec_end; + + spin_lock_irqsave(&jpeg->hw_lock, flags); +@@ -849,8 +849,8 @@ static void mtk_jpeg_device_run(void *priv) + dec_end: + v4l2_m2m_src_buf_remove(ctx->fh.m2m_ctx); + v4l2_m2m_dst_buf_remove(ctx->fh.m2m_ctx); +- v4l2_m2m_buf_done(to_vb2_v4l2_buffer(src_buf), buf_state); +- v4l2_m2m_buf_done(to_vb2_v4l2_buffer(dst_buf), buf_state); ++ v4l2_m2m_buf_done(src_buf, buf_state); ++ v4l2_m2m_buf_done(dst_buf, buf_state); + v4l2_m2m_job_finish(jpeg->m2m_dev, ctx->fh.m2m_ctx); + } + +@@ -926,7 +926,7 @@ static irqreturn_t mtk_jpeg_dec_irq(int irq, void *priv) + { + struct mtk_jpeg_dev *jpeg = priv; + struct mtk_jpeg_ctx *ctx; +- struct vb2_buffer *src_buf, *dst_buf; ++ struct vb2_v4l2_buffer *src_buf, *dst_buf; + struct mtk_jpeg_src_buf *jpeg_src_buf; + enum vb2_buffer_state buf_state = VB2_BUF_STATE_ERROR; + u32 dec_irq_ret; +@@ -943,7 +943,7 @@ static irqreturn_t mtk_jpeg_dec_irq(int irq, void *priv) + + src_buf = v4l2_m2m_src_buf_remove(ctx->fh.m2m_ctx); + dst_buf = v4l2_m2m_dst_buf_remove(ctx->fh.m2m_ctx); +- jpeg_src_buf = mtk_jpeg_vb2_to_srcbuf(src_buf); ++ jpeg_src_buf = mtk_jpeg_vb2_to_srcbuf(&src_buf->vb2_buf); + + if (dec_irq_ret >= MTK_JPEG_DEC_RESULT_UNDERFLOW) + mtk_jpeg_dec_reset(jpeg->dec_reg_base); +@@ -953,15 +953,15 @@ static irqreturn_t mtk_jpeg_dec_irq(int irq, void *priv) + goto dec_end; + } + +- for (i = 0; i < dst_buf->num_planes; i++) +- vb2_set_plane_payload(dst_buf, i, ++ for (i = 0; i < dst_buf->vb2_buf.num_planes; i++) ++ vb2_set_plane_payload(&dst_buf->vb2_buf, i, + jpeg_src_buf->dec_param.comp_size[i]); + + buf_state = VB2_BUF_STATE_DONE; + + dec_end: +- v4l2_m2m_buf_done(to_vb2_v4l2_buffer(src_buf), buf_state); +- v4l2_m2m_buf_done(to_vb2_v4l2_buffer(dst_buf), buf_state); ++ v4l2_m2m_buf_done(src_buf, buf_state); ++ v4l2_m2m_buf_done(dst_buf, buf_state); + v4l2_m2m_job_finish(jpeg->m2m_dev, ctx->fh.m2m_ctx); + return IRQ_HANDLED; + } +diff --git a/drivers/media/platform/mx2_emmaprp.c b/drivers/media/platform/mx2_emmaprp.c +index 4a2b1afa19c4..951f2fd415b0 100644 +--- a/drivers/media/platform/mx2_emmaprp.c ++++ b/drivers/media/platform/mx2_emmaprp.c +@@ -288,7 +288,7 @@ static void emmaprp_device_run(void *priv) + { + struct emmaprp_ctx *ctx = priv; + struct emmaprp_q_data *s_q_data, *d_q_data; +- struct vb2_buffer *src_buf, *dst_buf; ++ struct vb2_v4l2_buffer *src_buf, *dst_buf; + struct emmaprp_dev *pcdev = ctx->dev; + unsigned int s_width, s_height; + unsigned int d_width, d_height; +@@ -308,8 +308,8 @@ static void emmaprp_device_run(void *priv) + d_height = d_q_data->height; + d_size = d_width * d_height; + +- p_in = vb2_dma_contig_plane_dma_addr(src_buf, 0); +- p_out = vb2_dma_contig_plane_dma_addr(dst_buf, 0); ++ p_in = vb2_dma_contig_plane_dma_addr(&src_buf->vb2_buf, 0); ++ p_out = vb2_dma_contig_plane_dma_addr(&dst_buf->vb2_buf, 0); + if (!p_in || !p_out) { + v4l2_err(&pcdev->v4l2_dev, + "Acquiring kernel pointers to buffers failed\n"); +diff --git a/drivers/media/platform/s5p-g2d/g2d.c b/drivers/media/platform/s5p-g2d/g2d.c +index 66aa8cf1d048..770100d40372 100644 +--- a/drivers/media/platform/s5p-g2d/g2d.c ++++ b/drivers/media/platform/s5p-g2d/g2d.c +@@ -498,7 +498,7 @@ static void device_run(void *prv) + { + struct g2d_ctx *ctx = prv; + struct g2d_dev *dev = ctx->dev; +- struct vb2_buffer *src, *dst; ++ struct vb2_v4l2_buffer *src, *dst; + unsigned long flags; + u32 cmd = 0; + +@@ -513,10 +513,10 @@ static void device_run(void *prv) + spin_lock_irqsave(&dev->ctrl_lock, flags); + + g2d_set_src_size(dev, &ctx->in); +- g2d_set_src_addr(dev, vb2_dma_contig_plane_dma_addr(src, 0)); ++ g2d_set_src_addr(dev, vb2_dma_contig_plane_dma_addr(&src->vb2_buf, 0)); + + g2d_set_dst_size(dev, &ctx->out); +- g2d_set_dst_addr(dev, vb2_dma_contig_plane_dma_addr(dst, 0)); ++ g2d_set_dst_addr(dev, vb2_dma_contig_plane_dma_addr(&dst->vb2_buf, 0)); + + g2d_set_rop4(dev, ctx->rop); + g2d_set_flip(dev, ctx->flip); +diff --git a/drivers/media/platform/s5p-jpeg/jpeg-core.c b/drivers/media/platform/s5p-jpeg/jpeg-core.c +index faac8161b683..4568e68e15fa 100644 +--- a/drivers/media/platform/s5p-jpeg/jpeg-core.c ++++ b/drivers/media/platform/s5p-jpeg/jpeg-core.c +@@ -793,14 +793,14 @@ static void skip(struct s5p_jpeg_buffer *buf, long len); + static void exynos4_jpeg_parse_decode_h_tbl(struct s5p_jpeg_ctx *ctx) + { + struct s5p_jpeg *jpeg = ctx->jpeg; +- struct vb2_buffer *vb = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx); ++ struct vb2_v4l2_buffer *vb = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx); + struct s5p_jpeg_buffer jpeg_buffer; + unsigned int word; + int c, x, components; + + jpeg_buffer.size = 2; /* Ls */ + jpeg_buffer.data = +- (unsigned long)vb2_plane_vaddr(vb, 0) + ctx->out_q.sos + 2; ++ (unsigned long)vb2_plane_vaddr(&vb->vb2_buf, 0) + ctx->out_q.sos + 2; + jpeg_buffer.curr = 0; + + word = 0; +@@ -830,14 +830,14 @@ static void exynos4_jpeg_parse_decode_h_tbl(struct s5p_jpeg_ctx *ctx) + static void exynos4_jpeg_parse_huff_tbl(struct s5p_jpeg_ctx *ctx) + { + struct s5p_jpeg *jpeg = ctx->jpeg; +- struct vb2_buffer *vb = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx); ++ struct vb2_v4l2_buffer *vb = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx); + struct s5p_jpeg_buffer jpeg_buffer; + unsigned int word; + int c, i, n, j; + + for (j = 0; j < ctx->out_q.dht.n; ++j) { + jpeg_buffer.size = ctx->out_q.dht.len[j]; +- jpeg_buffer.data = (unsigned long)vb2_plane_vaddr(vb, 0) + ++ jpeg_buffer.data = (unsigned long)vb2_plane_vaddr(&vb->vb2_buf, 0) + + ctx->out_q.dht.marker[j]; + jpeg_buffer.curr = 0; + +@@ -889,13 +889,13 @@ static void exynos4_jpeg_parse_huff_tbl(struct s5p_jpeg_ctx *ctx) + static void exynos4_jpeg_parse_decode_q_tbl(struct s5p_jpeg_ctx *ctx) + { + struct s5p_jpeg *jpeg = ctx->jpeg; +- struct vb2_buffer *vb = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx); ++ struct vb2_v4l2_buffer *vb = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx); + struct s5p_jpeg_buffer jpeg_buffer; + int c, x, components; + + jpeg_buffer.size = ctx->out_q.sof_len; + jpeg_buffer.data = +- (unsigned long)vb2_plane_vaddr(vb, 0) + ctx->out_q.sof; ++ (unsigned long)vb2_plane_vaddr(&vb->vb2_buf, 0) + ctx->out_q.sof; + jpeg_buffer.curr = 0; + + skip(&jpeg_buffer, 5); /* P, Y, X */ +@@ -920,14 +920,14 @@ static void exynos4_jpeg_parse_decode_q_tbl(struct s5p_jpeg_ctx *ctx) + static void exynos4_jpeg_parse_q_tbl(struct s5p_jpeg_ctx *ctx) + { + struct s5p_jpeg *jpeg = ctx->jpeg; +- struct vb2_buffer *vb = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx); ++ struct vb2_v4l2_buffer *vb = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx); + struct s5p_jpeg_buffer jpeg_buffer; + unsigned int word; + int c, i, j; + + for (j = 0; j < ctx->out_q.dqt.n; ++j) { + jpeg_buffer.size = ctx->out_q.dqt.len[j]; +- jpeg_buffer.data = (unsigned long)vb2_plane_vaddr(vb, 0) + ++ jpeg_buffer.data = (unsigned long)vb2_plane_vaddr(&vb->vb2_buf, 0) + + ctx->out_q.dqt.marker[j]; + jpeg_buffer.curr = 0; + +@@ -1293,13 +1293,16 @@ static int s5p_jpeg_querycap(struct file *file, void *priv, + return 0; + } + +-static int enum_fmt(struct s5p_jpeg_fmt *sjpeg_formats, int n, ++static int enum_fmt(struct s5p_jpeg_ctx *ctx, ++ struct s5p_jpeg_fmt *sjpeg_formats, int n, + struct v4l2_fmtdesc *f, u32 type) + { + int i, num = 0; ++ unsigned int fmt_ver_flag = ctx->jpeg->variant->fmt_ver_flag; + + for (i = 0; i < n; ++i) { +- if (sjpeg_formats[i].flags & type) { ++ if (sjpeg_formats[i].flags & type && ++ sjpeg_formats[i].flags & fmt_ver_flag) { + /* index-th format of type type found ? */ + if (num == f->index) + break; +@@ -1326,11 +1329,11 @@ static int s5p_jpeg_enum_fmt_vid_cap(struct file *file, void *priv, + struct s5p_jpeg_ctx *ctx = fh_to_ctx(priv); + + if (ctx->mode == S5P_JPEG_ENCODE) +- return enum_fmt(sjpeg_formats, SJPEG_NUM_FORMATS, f, ++ return enum_fmt(ctx, sjpeg_formats, SJPEG_NUM_FORMATS, f, + SJPEG_FMT_FLAG_ENC_CAPTURE); + +- return enum_fmt(sjpeg_formats, SJPEG_NUM_FORMATS, f, +- SJPEG_FMT_FLAG_DEC_CAPTURE); ++ return enum_fmt(ctx, sjpeg_formats, SJPEG_NUM_FORMATS, f, ++ SJPEG_FMT_FLAG_DEC_CAPTURE); + } + + static int s5p_jpeg_enum_fmt_vid_out(struct file *file, void *priv, +@@ -1339,11 +1342,11 @@ static int s5p_jpeg_enum_fmt_vid_out(struct file *file, void *priv, + struct s5p_jpeg_ctx *ctx = fh_to_ctx(priv); + + if (ctx->mode == S5P_JPEG_ENCODE) +- return enum_fmt(sjpeg_formats, SJPEG_NUM_FORMATS, f, ++ return enum_fmt(ctx, sjpeg_formats, SJPEG_NUM_FORMATS, f, + SJPEG_FMT_FLAG_ENC_OUTPUT); + +- return enum_fmt(sjpeg_formats, SJPEG_NUM_FORMATS, f, +- SJPEG_FMT_FLAG_DEC_OUTPUT); ++ return enum_fmt(ctx, sjpeg_formats, SJPEG_NUM_FORMATS, f, ++ SJPEG_FMT_FLAG_DEC_OUTPUT); + } + + static struct s5p_jpeg_q_data *get_q_data(struct s5p_jpeg_ctx *ctx, +@@ -2072,15 +2075,15 @@ static void s5p_jpeg_device_run(void *priv) + { + struct s5p_jpeg_ctx *ctx = priv; + struct s5p_jpeg *jpeg = ctx->jpeg; +- struct vb2_buffer *src_buf, *dst_buf; ++ struct vb2_v4l2_buffer *src_buf, *dst_buf; + unsigned long src_addr, dst_addr, flags; + + spin_lock_irqsave(&ctx->jpeg->slock, flags); + + src_buf = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx); + dst_buf = v4l2_m2m_next_dst_buf(ctx->fh.m2m_ctx); +- src_addr = vb2_dma_contig_plane_dma_addr(src_buf, 0); +- dst_addr = vb2_dma_contig_plane_dma_addr(dst_buf, 0); ++ src_addr = vb2_dma_contig_plane_dma_addr(&src_buf->vb2_buf, 0); ++ dst_addr = vb2_dma_contig_plane_dma_addr(&dst_buf->vb2_buf, 0); + + s5p_jpeg_reset(jpeg->regs); + s5p_jpeg_poweron(jpeg->regs); +@@ -2153,7 +2156,7 @@ static void exynos4_jpeg_set_img_addr(struct s5p_jpeg_ctx *ctx) + { + struct s5p_jpeg *jpeg = ctx->jpeg; + struct s5p_jpeg_fmt *fmt; +- struct vb2_buffer *vb; ++ struct vb2_v4l2_buffer *vb; + struct s5p_jpeg_addr jpeg_addr = {}; + u32 pix_size, padding_bytes = 0; + +@@ -2172,7 +2175,7 @@ static void exynos4_jpeg_set_img_addr(struct s5p_jpeg_ctx *ctx) + vb = v4l2_m2m_next_dst_buf(ctx->fh.m2m_ctx); + } + +- jpeg_addr.y = vb2_dma_contig_plane_dma_addr(vb, 0); ++ jpeg_addr.y = vb2_dma_contig_plane_dma_addr(&vb->vb2_buf, 0); + + if (fmt->colplanes == 2) { + jpeg_addr.cb = jpeg_addr.y + pix_size - padding_bytes; +@@ -2190,7 +2193,7 @@ static void exynos4_jpeg_set_img_addr(struct s5p_jpeg_ctx *ctx) + static void exynos4_jpeg_set_jpeg_addr(struct s5p_jpeg_ctx *ctx) + { + struct s5p_jpeg *jpeg = ctx->jpeg; +- struct vb2_buffer *vb; ++ struct vb2_v4l2_buffer *vb; + unsigned int jpeg_addr = 0; + + if (ctx->mode == S5P_JPEG_ENCODE) +@@ -2198,7 +2201,7 @@ static void exynos4_jpeg_set_jpeg_addr(struct s5p_jpeg_ctx *ctx) + else + vb = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx); + +- jpeg_addr = vb2_dma_contig_plane_dma_addr(vb, 0); ++ jpeg_addr = vb2_dma_contig_plane_dma_addr(&vb->vb2_buf, 0); + if (jpeg->variant->version == SJPEG_EXYNOS5433 && + ctx->mode == S5P_JPEG_DECODE) + jpeg_addr += ctx->out_q.sos; +@@ -2314,7 +2317,7 @@ static void exynos3250_jpeg_set_img_addr(struct s5p_jpeg_ctx *ctx) + { + struct s5p_jpeg *jpeg = ctx->jpeg; + struct s5p_jpeg_fmt *fmt; +- struct vb2_buffer *vb; ++ struct vb2_v4l2_buffer *vb; + struct s5p_jpeg_addr jpeg_addr = {}; + u32 pix_size; + +@@ -2328,7 +2331,7 @@ static void exynos3250_jpeg_set_img_addr(struct s5p_jpeg_ctx *ctx) + fmt = ctx->cap_q.fmt; + } + +- jpeg_addr.y = vb2_dma_contig_plane_dma_addr(vb, 0); ++ jpeg_addr.y = vb2_dma_contig_plane_dma_addr(&vb->vb2_buf, 0); + + if (fmt->colplanes == 2) { + jpeg_addr.cb = jpeg_addr.y + pix_size; +@@ -2346,7 +2349,7 @@ static void exynos3250_jpeg_set_img_addr(struct s5p_jpeg_ctx *ctx) + static void exynos3250_jpeg_set_jpeg_addr(struct s5p_jpeg_ctx *ctx) + { + struct s5p_jpeg *jpeg = ctx->jpeg; +- struct vb2_buffer *vb; ++ struct vb2_v4l2_buffer *vb; + unsigned int jpeg_addr = 0; + + if (ctx->mode == S5P_JPEG_ENCODE) +@@ -2354,7 +2357,7 @@ static void exynos3250_jpeg_set_jpeg_addr(struct s5p_jpeg_ctx *ctx) + else + vb = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx); + +- jpeg_addr = vb2_dma_contig_plane_dma_addr(vb, 0); ++ jpeg_addr = vb2_dma_contig_plane_dma_addr(&vb->vb2_buf, 0); + exynos3250_jpeg_jpgadr(jpeg->regs, jpeg_addr); + } + +diff --git a/drivers/media/platform/sh_veu.c b/drivers/media/platform/sh_veu.c +index 15a562af13c7..a4f593220ef0 100644 +--- a/drivers/media/platform/sh_veu.c ++++ b/drivers/media/platform/sh_veu.c +@@ -276,13 +276,13 @@ static void sh_veu_process(struct sh_veu_dev *veu, + static void sh_veu_device_run(void *priv) + { + struct sh_veu_dev *veu = priv; +- struct vb2_buffer *src_buf, *dst_buf; ++ struct vb2_v4l2_buffer *src_buf, *dst_buf; + + src_buf = v4l2_m2m_next_src_buf(veu->m2m_ctx); + dst_buf = v4l2_m2m_next_dst_buf(veu->m2m_ctx); + + if (src_buf && dst_buf) +- sh_veu_process(veu, src_buf, dst_buf); ++ sh_veu_process(veu, &src_buf->vb2_buf, &dst_buf->vb2_buf); + } + + /* ========== video ioctls ========== */ +diff --git a/drivers/mmc/host/omap.c b/drivers/mmc/host/omap.c +index c28c51ad650f..f11245a0521c 100644 +--- a/drivers/mmc/host/omap.c ++++ b/drivers/mmc/host/omap.c +@@ -920,7 +920,7 @@ static inline void set_cmd_timeout(struct mmc_omap_host *host, struct mmc_reques + reg &= ~(1 << 5); + OMAP_MMC_WRITE(host, SDIO, reg); + /* Set maximum timeout */ +- OMAP_MMC_WRITE(host, CTO, 0xff); ++ OMAP_MMC_WRITE(host, CTO, 0xfd); + } + + static inline void set_data_timeout(struct mmc_omap_host *host, struct mmc_request *req) +diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c +index ced348e15a63..19f374b180fc 100644 +--- a/drivers/net/ethernet/cisco/enic/enic_main.c ++++ b/drivers/net/ethernet/cisco/enic/enic_main.c +@@ -119,7 +119,7 @@ static void enic_init_affinity_hint(struct enic *enic) + + for (i = 0; i < enic->intr_count; i++) { + if (enic_is_err_intr(enic, i) || enic_is_notify_intr(enic, i) || +- (enic->msix[i].affinity_mask && ++ (cpumask_available(enic->msix[i].affinity_mask) && + !cpumask_empty(enic->msix[i].affinity_mask))) + continue; + if (zalloc_cpumask_var(&enic->msix[i].affinity_mask, +@@ -148,7 +148,7 @@ static void enic_set_affinity_hint(struct enic *enic) + for (i = 0; i < enic->intr_count; i++) { + if (enic_is_err_intr(enic, i) || + enic_is_notify_intr(enic, i) || +- !enic->msix[i].affinity_mask || ++ !cpumask_available(enic->msix[i].affinity_mask) || + cpumask_empty(enic->msix[i].affinity_mask)) + continue; + err = irq_set_affinity_hint(enic->msix_entry[i].vector, +@@ -161,7 +161,7 @@ static void enic_set_affinity_hint(struct enic *enic) + for (i = 0; i < enic->wq_count; i++) { + int wq_intr = enic_msix_wq_intr(enic, i); + +- if (enic->msix[wq_intr].affinity_mask && ++ if (cpumask_available(enic->msix[wq_intr].affinity_mask) && + !cpumask_empty(enic->msix[wq_intr].affinity_mask)) + netif_set_xps_queue(enic->netdev, + enic->msix[wq_intr].affinity_mask, +diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c +index a25dc581a903..3c214a47c1c4 100644 +--- a/drivers/net/ethernet/intel/e1000e/netdev.c ++++ b/drivers/net/ethernet/intel/e1000e/netdev.c +@@ -2120,7 +2120,7 @@ static int e1000_request_msix(struct e1000_adapter *adapter) + if (strlen(netdev->name) < (IFNAMSIZ - 5)) + snprintf(adapter->rx_ring->name, + sizeof(adapter->rx_ring->name) - 1, +- "%s-rx-0", netdev->name); ++ "%.14s-rx-0", netdev->name); + else + memcpy(adapter->rx_ring->name, netdev->name, IFNAMSIZ); + err = request_irq(adapter->msix_entries[vector].vector, +@@ -2136,7 +2136,7 @@ static int e1000_request_msix(struct e1000_adapter *adapter) + if (strlen(netdev->name) < (IFNAMSIZ - 5)) + snprintf(adapter->tx_ring->name, + sizeof(adapter->tx_ring->name) - 1, +- "%s-tx-0", netdev->name); ++ "%.14s-tx-0", netdev->name); + else + memcpy(adapter->tx_ring->name, netdev->name, IFNAMSIZ); + err = request_irq(adapter->msix_entries[vector].vector, +@@ -5306,8 +5306,13 @@ static void e1000_watchdog_task(struct work_struct *work) + /* 8000ES2LAN requires a Rx packet buffer work-around + * on link down event; reset the controller to flush + * the Rx packet buffer. ++ * ++ * If the link is lost the controller stops DMA, but ++ * if there is queued Tx work it cannot be done. So ++ * reset the controller to flush the Tx packet buffers. + */ +- if (adapter->flags & FLAG_RX_NEEDS_RESTART) ++ if ((adapter->flags & FLAG_RX_NEEDS_RESTART) || ++ e1000_desc_unused(tx_ring) + 1 < tx_ring->count) + adapter->flags |= FLAG_RESTART_NOW; + else + pm_schedule_suspend(netdev->dev.parent, +@@ -5330,14 +5335,6 @@ link_up: + adapter->gotc_old = adapter->stats.gotc; + spin_unlock(&adapter->stats64_lock); + +- /* If the link is lost the controller stops DMA, but +- * if there is queued Tx work it cannot be done. So +- * reset the controller to flush the Tx packet buffers. +- */ +- if (!netif_carrier_ok(netdev) && +- (e1000_desc_unused(tx_ring) + 1 < tx_ring->count)) +- adapter->flags |= FLAG_RESTART_NOW; +- + /* If reset is necessary, do it outside of interrupt context. */ + if (adapter->flags & FLAG_RESTART_NOW) { + schedule_work(&adapter->reset_task); +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c +index 2f93e6e9dc9e..d2914116af8e 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c +@@ -1719,7 +1719,7 @@ int mlx5_eswitch_set_vport_mac(struct mlx5_eswitch *esw, + u64 node_guid; + int err = 0; + +- if (!MLX5_CAP_GEN(esw->dev, vport_group_manager)) ++ if (!esw || !MLX5_CAP_GEN(esw->dev, vport_group_manager)) + return -EPERM; + if (!LEGAL_VPORT(esw, vport) || is_multicast_ether_addr(mac)) + return -EINVAL; +@@ -1793,7 +1793,7 @@ int mlx5_eswitch_get_vport_config(struct mlx5_eswitch *esw, + { + struct mlx5_vport *evport; + +- if (!MLX5_CAP_GEN(esw->dev, vport_group_manager)) ++ if (!esw || !MLX5_CAP_GEN(esw->dev, vport_group_manager)) + return -EPERM; + if (!LEGAL_VPORT(esw, vport)) + return -EINVAL; +@@ -1966,19 +1966,24 @@ static int normalize_vports_min_rate(struct mlx5_eswitch *esw, u32 divider) + int mlx5_eswitch_set_vport_rate(struct mlx5_eswitch *esw, int vport, + u32 max_rate, u32 min_rate) + { +- u32 fw_max_bw_share = MLX5_CAP_QOS(esw->dev, max_tsar_bw_share); +- bool min_rate_supported = MLX5_CAP_QOS(esw->dev, esw_bw_share) && +- fw_max_bw_share >= MLX5_MIN_BW_SHARE; +- bool max_rate_supported = MLX5_CAP_QOS(esw->dev, esw_rate_limit); + struct mlx5_vport *evport; ++ u32 fw_max_bw_share; + u32 previous_min_rate; + u32 divider; ++ bool min_rate_supported; ++ bool max_rate_supported; + int err = 0; + + if (!ESW_ALLOWED(esw)) + return -EPERM; + if (!LEGAL_VPORT(esw, vport)) + return -EINVAL; ++ ++ fw_max_bw_share = MLX5_CAP_QOS(esw->dev, max_tsar_bw_share); ++ min_rate_supported = MLX5_CAP_QOS(esw->dev, esw_bw_share) && ++ fw_max_bw_share >= MLX5_MIN_BW_SHARE; ++ max_rate_supported = MLX5_CAP_QOS(esw->dev, esw_rate_limit); ++ + if ((min_rate && !min_rate_supported) || (max_rate && !max_rate_supported)) + return -EOPNOTSUPP; + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c +index 8ff92649f9ce..29d37355d8c6 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c +@@ -2019,7 +2019,7 @@ static void mlxsw_sp_port_get_prio_strings(u8 **p, int prio) + int i; + + for (i = 0; i < MLXSW_SP_PORT_HW_PRIO_STATS_LEN; i++) { +- snprintf(*p, ETH_GSTRING_LEN, "%s_%d", ++ snprintf(*p, ETH_GSTRING_LEN, "%.29s_%.1d", + mlxsw_sp_port_hw_prio_stats[i].str, prio); + *p += ETH_GSTRING_LEN; + } +@@ -2030,7 +2030,7 @@ static void mlxsw_sp_port_get_tc_strings(u8 **p, int tc) + int i; + + for (i = 0; i < MLXSW_SP_PORT_HW_TC_STATS_LEN; i++) { +- snprintf(*p, ETH_GSTRING_LEN, "%s_%d", ++ snprintf(*p, ETH_GSTRING_LEN, "%.29s_%.1d", + mlxsw_sp_port_hw_tc_stats[i].str, tc); + *p += ETH_GSTRING_LEN; + } +diff --git a/drivers/net/wireless/ath/wil6210/cfg80211.c b/drivers/net/wireless/ath/wil6210/cfg80211.c +index 85d5c04618eb..c374ed311520 100644 +--- a/drivers/net/wireless/ath/wil6210/cfg80211.c ++++ b/drivers/net/wireless/ath/wil6210/cfg80211.c +@@ -1224,6 +1224,12 @@ static int _wil_cfg80211_merge_extra_ies(const u8 *ies1, u16 ies1_len, + u8 *buf, *dpos; + const u8 *spos; + ++ if (!ies1) ++ ies1_len = 0; ++ ++ if (!ies2) ++ ies2_len = 0; ++ + if (ies1_len == 0 && ies2_len == 0) { + *merged_ies = NULL; + *merged_len = 0; +@@ -1233,17 +1239,19 @@ static int _wil_cfg80211_merge_extra_ies(const u8 *ies1, u16 ies1_len, + buf = kmalloc(ies1_len + ies2_len, GFP_KERNEL); + if (!buf) + return -ENOMEM; +- memcpy(buf, ies1, ies1_len); ++ if (ies1) ++ memcpy(buf, ies1, ies1_len); + dpos = buf + ies1_len; + spos = ies2; +- while (spos + 1 < ies2 + ies2_len) { ++ while (spos && (spos + 1 < ies2 + ies2_len)) { + /* IE tag at offset 0, length at offset 1 */ + u16 ielen = 2 + spos[1]; + + if (spos + ielen > ies2 + ies2_len) + break; + if (spos[0] == WLAN_EID_VENDOR_SPECIFIC && +- !_wil_cfg80211_find_ie(ies1, ies1_len, spos, ielen)) { ++ (!ies1 || !_wil_cfg80211_find_ie(ies1, ies1_len, ++ spos, ielen))) { + memcpy(dpos, spos, ielen); + dpos += ielen; + } +diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c +index 5a15362ef671..a40ad4675e19 100644 +--- a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c +@@ -475,7 +475,7 @@ static void iwl_pcie_rx_allocator(struct iwl_trans *trans) + struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans); + struct iwl_rb_allocator *rba = &trans_pcie->rba; + struct list_head local_empty; +- int pending = atomic_xchg(&rba->req_pending, 0); ++ int pending = atomic_read(&rba->req_pending); + + IWL_DEBUG_RX(trans, "Pending allocation requests = %d\n", pending); + +@@ -530,11 +530,13 @@ static void iwl_pcie_rx_allocator(struct iwl_trans *trans) + i++; + } + ++ atomic_dec(&rba->req_pending); + pending--; ++ + if (!pending) { +- pending = atomic_xchg(&rba->req_pending, 0); ++ pending = atomic_read(&rba->req_pending); + IWL_DEBUG_RX(trans, +- "Pending allocation requests = %d\n", ++ "Got more pending allocation requests = %d\n", + pending); + } + +@@ -546,12 +548,15 @@ static void iwl_pcie_rx_allocator(struct iwl_trans *trans) + spin_unlock(&rba->lock); + + atomic_inc(&rba->req_ready); ++ + } + + spin_lock(&rba->lock); + /* return unused rbds to the allocator empty list */ + list_splice_tail(&local_empty, &rba->rbd_empty); + spin_unlock(&rba->lock); ++ ++ IWL_DEBUG_RX(trans, "%s, exit.\n", __func__); + } + + /* +diff --git a/drivers/net/wireless/mediatek/mt7601u/eeprom.h b/drivers/net/wireless/mediatek/mt7601u/eeprom.h +index 662d12703b69..57b503ae63f1 100644 +--- a/drivers/net/wireless/mediatek/mt7601u/eeprom.h ++++ b/drivers/net/wireless/mediatek/mt7601u/eeprom.h +@@ -17,7 +17,7 @@ + + struct mt7601u_dev; + +-#define MT7601U_EE_MAX_VER 0x0c ++#define MT7601U_EE_MAX_VER 0x0d + #define MT7601U_EEPROM_SIZE 256 + + #define MT7601U_DEFAULT_TX_POWER 6 +diff --git a/drivers/net/wireless/ti/wlcore/main.c b/drivers/net/wireless/ti/wlcore/main.c +index c346c021b999..eb3a7971c1d3 100644 +--- a/drivers/net/wireless/ti/wlcore/main.c ++++ b/drivers/net/wireless/ti/wlcore/main.c +@@ -1058,8 +1058,11 @@ static int wl12xx_chip_wakeup(struct wl1271 *wl, bool plt) + goto out; + + ret = wl12xx_fetch_firmware(wl, plt); +- if (ret < 0) +- goto out; ++ if (ret < 0) { ++ kfree(wl->fw_status); ++ kfree(wl->raw_fw_status); ++ kfree(wl->tx_res_if); ++ } + + out: + return ret; +diff --git a/drivers/pci/pcie/pme.c b/drivers/pci/pcie/pme.c +index df290aa58dce..c2e6e3d1073f 100644 +--- a/drivers/pci/pcie/pme.c ++++ b/drivers/pci/pcie/pme.c +@@ -367,6 +367,16 @@ static bool pcie_pme_check_wakeup(struct pci_bus *bus) + return false; + } + ++static void pcie_pme_disable_interrupt(struct pci_dev *port, ++ struct pcie_pme_service_data *data) ++{ ++ spin_lock_irq(&data->lock); ++ pcie_pme_interrupt_enable(port, false); ++ pcie_clear_root_pme_status(port); ++ data->noirq = true; ++ spin_unlock_irq(&data->lock); ++} ++ + /** + * pcie_pme_suspend - Suspend PCIe PME service device. + * @srv: PCIe service device to suspend. +@@ -391,11 +401,7 @@ static int pcie_pme_suspend(struct pcie_device *srv) + return 0; + } + +- spin_lock_irq(&data->lock); +- pcie_pme_interrupt_enable(port, false); +- pcie_clear_root_pme_status(port); +- data->noirq = true; +- spin_unlock_irq(&data->lock); ++ pcie_pme_disable_interrupt(port, data); + + synchronize_irq(srv->irq); + +@@ -431,9 +437,11 @@ static int pcie_pme_resume(struct pcie_device *srv) + */ + static void pcie_pme_remove(struct pcie_device *srv) + { +- pcie_pme_suspend(srv); ++ struct pcie_pme_service_data *data = get_service_data(srv); ++ ++ pcie_pme_disable_interrupt(srv->port, data); + free_irq(srv->irq, srv); +- kfree(get_service_data(srv)); ++ kfree(data); + } + + static struct pcie_port_service_driver pcie_pme_driver = { +diff --git a/drivers/platform/x86/intel_pmc_core.c b/drivers/platform/x86/intel_pmc_core.c +index 17e08b42b0a9..aaeb0242a99d 100644 +--- a/drivers/platform/x86/intel_pmc_core.c ++++ b/drivers/platform/x86/intel_pmc_core.c +@@ -222,7 +222,8 @@ static int pmc_core_ppfear_sts_show(struct seq_file *s, void *unused) + index < PPFEAR_MAX_NUM_ENTRIES; index++, iter++) + pf_regs[index] = pmc_core_reg_read_byte(pmcdev, iter); + +- for (index = 0; map[index].name; index++) ++ for (index = 0; map[index].name && ++ index < pmcdev->map->ppfear_buckets * 8; index++) + pmc_core_display_map(s, index, pf_regs[index / 8], map); + + return 0; +diff --git a/drivers/platform/x86/intel_pmc_core.h b/drivers/platform/x86/intel_pmc_core.h +index 3d225a9cc09f..1f13426eb61a 100644 +--- a/drivers/platform/x86/intel_pmc_core.h ++++ b/drivers/platform/x86/intel_pmc_core.h +@@ -38,7 +38,7 @@ + #define SPT_PMC_SLP_S0_RES_COUNTER_STEP 0x64 + #define PMC_BASE_ADDR_MASK ~(SPT_PMC_MMIO_REG_LEN - 1) + #define MTPMC_MASK 0xffff0000 +-#define PPFEAR_MAX_NUM_ENTRIES 5 ++#define PPFEAR_MAX_NUM_ENTRIES 12 + #define SPT_PPFEAR_NUM_ENTRIES 5 + #define SPT_PMC_READ_DISABLE_BIT 0x16 + #define SPT_PMC_MSG_FULL_STS_BIT 0x18 +diff --git a/drivers/regulator/act8865-regulator.c b/drivers/regulator/act8865-regulator.c +index 7652477e6a9d..39e8d60df060 100644 +--- a/drivers/regulator/act8865-regulator.c ++++ b/drivers/regulator/act8865-regulator.c +@@ -131,7 +131,7 @@ + * ACT8865 voltage number + */ + #define ACT8865_VOLTAGE_NUM 64 +-#define ACT8600_SUDCDC_VOLTAGE_NUM 255 ++#define ACT8600_SUDCDC_VOLTAGE_NUM 256 + + struct act8865 { + struct regmap *regmap; +@@ -222,7 +222,8 @@ static const struct regulator_linear_range act8600_sudcdc_voltage_ranges[] = { + REGULATOR_LINEAR_RANGE(3000000, 0, 63, 0), + REGULATOR_LINEAR_RANGE(3000000, 64, 159, 100000), + REGULATOR_LINEAR_RANGE(12600000, 160, 191, 200000), +- REGULATOR_LINEAR_RANGE(19000000, 191, 255, 400000), ++ REGULATOR_LINEAR_RANGE(19000000, 192, 247, 400000), ++ REGULATOR_LINEAR_RANGE(41400000, 248, 255, 0), + }; + + static struct regulator_ops act8865_ops = { +diff --git a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c +index 89f09b122135..116a56f0af01 100644 +--- a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c ++++ b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c +@@ -1445,7 +1445,7 @@ bind_err: + static struct bnx2fc_interface * + bnx2fc_interface_create(struct bnx2fc_hba *hba, + struct net_device *netdev, +- enum fip_state fip_mode) ++ enum fip_mode fip_mode) + { + struct fcoe_ctlr_device *ctlr_dev; + struct bnx2fc_interface *interface; +diff --git a/drivers/scsi/fcoe/fcoe.c b/drivers/scsi/fcoe/fcoe.c +index 85f9a3eba387..99b46dc87a37 100644 +--- a/drivers/scsi/fcoe/fcoe.c ++++ b/drivers/scsi/fcoe/fcoe.c +@@ -390,7 +390,7 @@ static int fcoe_interface_setup(struct fcoe_interface *fcoe, + * Returns: pointer to a struct fcoe_interface or NULL on error + */ + static struct fcoe_interface *fcoe_interface_create(struct net_device *netdev, +- enum fip_state fip_mode) ++ enum fip_mode fip_mode) + { + struct fcoe_ctlr_device *ctlr_dev; + struct fcoe_ctlr *ctlr; +diff --git a/drivers/scsi/fcoe/fcoe_ctlr.c b/drivers/scsi/fcoe/fcoe_ctlr.c +index 03019e07abb9..bd61bf4e2da2 100644 +--- a/drivers/scsi/fcoe/fcoe_ctlr.c ++++ b/drivers/scsi/fcoe/fcoe_ctlr.c +@@ -147,7 +147,7 @@ static void fcoe_ctlr_map_dest(struct fcoe_ctlr *fip) + * fcoe_ctlr_init() - Initialize the FCoE Controller instance + * @fip: The FCoE controller to initialize + */ +-void fcoe_ctlr_init(struct fcoe_ctlr *fip, enum fip_state mode) ++void fcoe_ctlr_init(struct fcoe_ctlr *fip, enum fip_mode mode) + { + fcoe_ctlr_set_state(fip, FIP_ST_LINK_WAIT); + fip->mode = mode; +@@ -454,7 +454,10 @@ void fcoe_ctlr_link_up(struct fcoe_ctlr *fip) + mutex_unlock(&fip->ctlr_mutex); + fc_linkup(fip->lp); + } else if (fip->state == FIP_ST_LINK_WAIT) { +- fcoe_ctlr_set_state(fip, fip->mode); ++ if (fip->mode == FIP_MODE_NON_FIP) ++ fcoe_ctlr_set_state(fip, FIP_ST_NON_FIP); ++ else ++ fcoe_ctlr_set_state(fip, FIP_ST_AUTO); + switch (fip->mode) { + default: + LIBFCOE_FIP_DBG(fip, "invalid mode %d\n", fip->mode); +diff --git a/drivers/scsi/fcoe/fcoe_transport.c b/drivers/scsi/fcoe/fcoe_transport.c +index 375c536cbc68..f5ed2d6cc70c 100644 +--- a/drivers/scsi/fcoe/fcoe_transport.c ++++ b/drivers/scsi/fcoe/fcoe_transport.c +@@ -870,7 +870,7 @@ static int fcoe_transport_create(const char *buffer, struct kernel_param *kp) + int rc = -ENODEV; + struct net_device *netdev = NULL; + struct fcoe_transport *ft = NULL; +- enum fip_state fip_mode = (enum fip_state)(long)kp->arg; ++ enum fip_mode fip_mode = (enum fip_mode)kp->arg; + + mutex_lock(&ft_mutex); + +diff --git a/drivers/scsi/hisi_sas/hisi_sas_main.c b/drivers/scsi/hisi_sas/hisi_sas_main.c +index 8fa9bb336ad4..b167411580ba 100644 +--- a/drivers/scsi/hisi_sas/hisi_sas_main.c ++++ b/drivers/scsi/hisi_sas/hisi_sas_main.c +@@ -10,6 +10,7 @@ + */ + + #include "hisi_sas.h" ++#include "../libsas/sas_internal.h" + #define DRV_NAME "hisi_sas" + + #define DEV_IS_GONE(dev) \ +@@ -1508,9 +1509,18 @@ static void hisi_sas_port_formed(struct asd_sas_phy *sas_phy) + + static void hisi_sas_phy_disconnected(struct hisi_sas_phy *phy) + { ++ struct asd_sas_phy *sas_phy = &phy->sas_phy; ++ struct sas_phy *sphy = sas_phy->phy; ++ struct sas_phy_data *d = sphy->hostdata; ++ + phy->phy_attached = 0; + phy->phy_type = 0; + phy->port = NULL; ++ ++ if (d->enable) ++ sphy->negotiated_linkrate = SAS_LINK_RATE_UNKNOWN; ++ else ++ sphy->negotiated_linkrate = SAS_PHY_DISABLED; + } + + void hisi_sas_phy_down(struct hisi_hba *hisi_hba, int phy_no, int rdy) +diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c +index d0abee3e6ed9..7f1ecd264652 100644 +--- a/drivers/scsi/megaraid/megaraid_sas_base.c ++++ b/drivers/scsi/megaraid/megaraid_sas_base.c +@@ -4087,6 +4087,7 @@ int megasas_alloc_cmds(struct megasas_instance *instance) + if (megasas_create_frame_pool(instance)) { + dev_printk(KERN_DEBUG, &instance->pdev->dev, "Error creating frame DMA pool\n"); + megasas_free_cmds(instance); ++ return -ENOMEM; + } + + return 0; +diff --git a/drivers/scsi/qedf/qedf_main.c b/drivers/scsi/qedf/qedf_main.c +index 56bcdd412d26..7756901f99da 100644 +--- a/drivers/scsi/qedf/qedf_main.c ++++ b/drivers/scsi/qedf/qedf_main.c +@@ -1382,7 +1382,7 @@ static struct libfc_function_template qedf_lport_template = { + + static void qedf_fcoe_ctlr_setup(struct qedf_ctx *qedf) + { +- fcoe_ctlr_init(&qedf->ctlr, FIP_ST_AUTO); ++ fcoe_ctlr_init(&qedf->ctlr, FIP_MODE_AUTO); + + qedf->ctlr.send = qedf_fip_send; + qedf->ctlr.get_src_addr = qedf_get_src_mac; +diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c +index 40124648a07b..0b11405bfd7e 100644 +--- a/drivers/scsi/scsi_scan.c ++++ b/drivers/scsi/scsi_scan.c +@@ -220,7 +220,7 @@ static struct scsi_device *scsi_alloc_sdev(struct scsi_target *starget, + struct Scsi_Host *shost = dev_to_shost(starget->dev.parent); + + sdev = kzalloc(sizeof(*sdev) + shost->transportt->device_size, +- GFP_ATOMIC); ++ GFP_KERNEL); + if (!sdev) + goto out; + +@@ -796,7 +796,7 @@ static int scsi_add_lun(struct scsi_device *sdev, unsigned char *inq_result, + */ + sdev->inquiry = kmemdup(inq_result, + max_t(size_t, sdev->inquiry_len, 36), +- GFP_ATOMIC); ++ GFP_KERNEL); + if (sdev->inquiry == NULL) + return SCSI_SCAN_NO_RESPONSE; + +@@ -1085,7 +1085,7 @@ static int scsi_probe_and_add_lun(struct scsi_target *starget, + if (!sdev) + goto out; + +- result = kmalloc(result_len, GFP_ATOMIC | ++ result = kmalloc(result_len, GFP_KERNEL | + ((shost->unchecked_isa_dma) ? __GFP_DMA : 0)); + if (!result) + goto out_free_sdev; +diff --git a/drivers/soc/qcom/qcom_gsbi.c b/drivers/soc/qcom/qcom_gsbi.c +index 09c669e70d63..038abc377fdb 100644 +--- a/drivers/soc/qcom/qcom_gsbi.c ++++ b/drivers/soc/qcom/qcom_gsbi.c +@@ -138,7 +138,7 @@ static int gsbi_probe(struct platform_device *pdev) + struct resource *res; + void __iomem *base; + struct gsbi_info *gsbi; +- int i; ++ int i, ret; + u32 mask, gsbi_num; + const struct crci_config *config = NULL; + +@@ -221,7 +221,10 @@ static int gsbi_probe(struct platform_device *pdev) + + platform_set_drvdata(pdev, gsbi); + +- return of_platform_populate(node, NULL, NULL, &pdev->dev); ++ ret = of_platform_populate(node, NULL, NULL, &pdev->dev); ++ if (ret) ++ clk_disable_unprepare(gsbi->hclk); ++ return ret; + } + + static int gsbi_remove(struct platform_device *pdev) +diff --git a/drivers/soc/tegra/fuse/fuse-tegra.c b/drivers/soc/tegra/fuse/fuse-tegra.c +index b7c552e3133c..37bde5c8268d 100644 +--- a/drivers/soc/tegra/fuse/fuse-tegra.c ++++ b/drivers/soc/tegra/fuse/fuse-tegra.c +@@ -133,13 +133,17 @@ static int tegra_fuse_probe(struct platform_device *pdev) + /* take over the memory region from the early initialization */ + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); + fuse->base = devm_ioremap_resource(&pdev->dev, res); +- if (IS_ERR(fuse->base)) +- return PTR_ERR(fuse->base); ++ if (IS_ERR(fuse->base)) { ++ err = PTR_ERR(fuse->base); ++ fuse->base = base; ++ return err; ++ } + + fuse->clk = devm_clk_get(&pdev->dev, "fuse"); + if (IS_ERR(fuse->clk)) { + dev_err(&pdev->dev, "failed to get FUSE clock: %ld", + PTR_ERR(fuse->clk)); ++ fuse->base = base; + return PTR_ERR(fuse->clk); + } + +@@ -148,8 +152,10 @@ static int tegra_fuse_probe(struct platform_device *pdev) + + if (fuse->soc->probe) { + err = fuse->soc->probe(fuse); +- if (err < 0) ++ if (err < 0) { ++ fuse->base = base; + return err; ++ } + } + + if (tegra_fuse_create_sysfs(&pdev->dev, fuse->soc->info->size, +diff --git a/drivers/tty/serial/8250/8250_pxa.c b/drivers/tty/serial/8250/8250_pxa.c +index 4d68731af534..de1372ba24b1 100644 +--- a/drivers/tty/serial/8250/8250_pxa.c ++++ b/drivers/tty/serial/8250/8250_pxa.c +@@ -118,6 +118,10 @@ static int serial_pxa_probe(struct platform_device *pdev) + if (ret) + return ret; + ++ ret = of_alias_get_id(pdev->dev.of_node, "serial"); ++ if (ret >= 0) ++ uart.port.line = ret; ++ + uart.port.type = PORT_XSCALE; + uart.port.iotype = UPIO_MEM32; + uart.port.mapbase = mmres->start; +diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c +index 9f1cef59fa28..f747f1a1780c 100644 +--- a/drivers/tty/serial/atmel_serial.c ++++ b/drivers/tty/serial/atmel_serial.c +@@ -176,6 +176,8 @@ struct atmel_uart_port { + unsigned int pending_status; + spinlock_t lock_suspended; + ++ bool hd_start_rx; /* can start RX during half-duplex operation */ ++ + #ifdef CONFIG_PM + struct { + u32 cr; +@@ -238,6 +240,12 @@ static inline void atmel_uart_write_char(struct uart_port *port, u8 value) + __raw_writeb(value, port->membase + ATMEL_US_THR); + } + ++static inline int atmel_uart_is_half_duplex(struct uart_port *port) ++{ ++ return (port->rs485.flags & SER_RS485_ENABLED) && ++ !(port->rs485.flags & SER_RS485_RX_DURING_TX); ++} ++ + #ifdef CONFIG_SERIAL_ATMEL_PDC + static bool atmel_use_pdc_rx(struct uart_port *port) + { +@@ -489,9 +497,9 @@ static void atmel_stop_tx(struct uart_port *port) + /* Disable interrupts */ + atmel_uart_writel(port, ATMEL_US_IDR, atmel_port->tx_done_mask); + +- if ((port->rs485.flags & SER_RS485_ENABLED) && +- !(port->rs485.flags & SER_RS485_RX_DURING_TX)) ++ if (atmel_uart_is_half_duplex(port)) + atmel_start_rx(port); ++ + } + + /* +@@ -508,8 +516,7 @@ static void atmel_start_tx(struct uart_port *port) + return; + + if (atmel_use_pdc_tx(port) || atmel_use_dma_tx(port)) +- if ((port->rs485.flags & SER_RS485_ENABLED) && +- !(port->rs485.flags & SER_RS485_RX_DURING_TX)) ++ if (atmel_uart_is_half_duplex(port)) + atmel_stop_rx(port); + + if (atmel_use_pdc_tx(port)) +@@ -806,10 +813,14 @@ static void atmel_complete_tx_dma(void *arg) + */ + if (!uart_circ_empty(xmit)) + atmel_tasklet_schedule(atmel_port, &atmel_port->tasklet_tx); +- else if ((port->rs485.flags & SER_RS485_ENABLED) && +- !(port->rs485.flags & SER_RS485_RX_DURING_TX)) { +- /* DMA done, stop TX, start RX for RS485 */ +- atmel_start_rx(port); ++ else if (atmel_uart_is_half_duplex(port)) { ++ /* ++ * DMA done, re-enable TXEMPTY and signal that we can stop ++ * TX and start RX for RS485 ++ */ ++ atmel_port->hd_start_rx = true; ++ atmel_uart_writel(port, ATMEL_US_IER, ++ atmel_port->tx_done_mask); + } + + spin_unlock_irqrestore(&port->lock, flags); +@@ -1254,9 +1265,20 @@ atmel_handle_transmit(struct uart_port *port, unsigned int pending) + struct atmel_uart_port *atmel_port = to_atmel_uart_port(port); + + if (pending & atmel_port->tx_done_mask) { +- /* Either PDC or interrupt transmission */ + atmel_uart_writel(port, ATMEL_US_IDR, + atmel_port->tx_done_mask); ++ ++ /* Start RX if flag was set and FIFO is empty */ ++ if (atmel_port->hd_start_rx) { ++ if (!(atmel_uart_readl(port, ATMEL_US_CSR) ++ & ATMEL_US_TXEMPTY)) ++ dev_warn(port->dev, "Should start RX, but TX fifo is not empty\n"); ++ ++ atmel_port->hd_start_rx = false; ++ atmel_start_rx(port); ++ return; ++ } ++ + atmel_tasklet_schedule(atmel_port, &atmel_port->tasklet_tx); + } + } +@@ -1383,8 +1405,7 @@ static void atmel_tx_pdc(struct uart_port *port) + atmel_uart_writel(port, ATMEL_US_IER, + atmel_port->tx_done_mask); + } else { +- if ((port->rs485.flags & SER_RS485_ENABLED) && +- !(port->rs485.flags & SER_RS485_RX_DURING_TX)) { ++ if (atmel_uart_is_half_duplex(port)) { + /* DMA done, stop TX, start RX for RS485 */ + atmel_start_rx(port); + } +diff --git a/drivers/tty/tty_buffer.c b/drivers/tty/tty_buffer.c +index 217114227f8d..cf11882d2602 100644 +--- a/drivers/tty/tty_buffer.c ++++ b/drivers/tty/tty_buffer.c +@@ -25,7 +25,7 @@ + * Byte threshold to limit memory consumption for flip buffers. + * The actual memory limit is > 2x this amount. + */ +-#define TTYB_DEFAULT_MEM_LIMIT 65536 ++#define TTYB_DEFAULT_MEM_LIMIT (640 * 1024UL) + + /* + * We default to dicing tty buffer allocations to this many characters +diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c +index 43ea5fb87b9a..70306ae039c0 100644 +--- a/drivers/usb/chipidea/core.c ++++ b/drivers/usb/chipidea/core.c +@@ -938,8 +938,15 @@ static int ci_hdrc_probe(struct platform_device *pdev) + } else if (ci->platdata->usb_phy) { + ci->usb_phy = ci->platdata->usb_phy; + } else { ++ ci->usb_phy = devm_usb_get_phy_by_phandle(dev->parent, "phys", ++ 0); + ci->phy = devm_phy_get(dev->parent, "usb-phy"); +- ci->usb_phy = devm_usb_get_phy(dev->parent, USB_PHY_TYPE_USB2); ++ ++ /* Fallback to grabbing any registered USB2 PHY */ ++ if (IS_ERR(ci->usb_phy) && ++ PTR_ERR(ci->usb_phy) != -EPROBE_DEFER) ++ ci->usb_phy = devm_usb_get_phy(dev->parent, ++ USB_PHY_TYPE_USB2); + + /* if both generic PHY and USB PHY layers aren't enabled */ + if (PTR_ERR(ci->phy) == -ENOSYS && +diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c +index 32dd0d3462da..1b99d44e52b9 100644 +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -3286,6 +3286,8 @@ int dwc3_gadget_init(struct dwc3 *dwc) + goto err4; + } + ++ dwc3_gadget_set_speed(&dwc->gadget, dwc->maximum_speed); ++ + return 0; + + err4: +diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c +index 52e6897fa35a..79900c0b4f3a 100644 +--- a/drivers/usb/gadget/function/f_fs.c ++++ b/drivers/usb/gadget/function/f_fs.c +@@ -1009,6 +1009,7 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data) + * condition with req->complete callback. + */ + usb_ep_dequeue(ep->ep, req); ++ wait_for_completion(&done); + interrupted = ep->status < 0; + } + +diff --git a/drivers/video/backlight/pwm_bl.c b/drivers/video/backlight/pwm_bl.c +index 155153ecb894..2a0ce0c68302 100644 +--- a/drivers/video/backlight/pwm_bl.c ++++ b/drivers/video/backlight/pwm_bl.c +@@ -212,7 +212,7 @@ static int pwm_backlight_initial_power_state(const struct pwm_bl_data *pb) + */ + + /* if the enable GPIO is disabled, do not enable the backlight */ +- if (pb->enable_gpio && gpiod_get_value(pb->enable_gpio) == 0) ++ if (pb->enable_gpio && gpiod_get_value_cansleep(pb->enable_gpio) == 0) + return FB_BLANK_POWERDOWN; + + /* The regulator is disabled, do not enable the backlight */ +diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c +index 302cce7185e3..83961a22bef1 100644 +--- a/drivers/video/fbdev/core/fbmem.c ++++ b/drivers/video/fbdev/core/fbmem.c +@@ -427,6 +427,9 @@ static void fb_do_show_logo(struct fb_info *info, struct fb_image *image, + { + unsigned int x; + ++ if (image->width > info->var.xres || image->height > info->var.yres) ++ return; ++ + if (rotate == FB_ROTATE_UR) { + for (x = 0; + x < num && image->dx + image->width <= info->var.xres; +diff --git a/fs/buffer.c b/fs/buffer.c +index 8086cc8ff0bc..bdca7b10e239 100644 +--- a/fs/buffer.c ++++ b/fs/buffer.c +@@ -3084,6 +3084,13 @@ void guard_bio_eod(int op, struct bio *bio) + /* Uhhuh. We've got a bio that straddles the device size! */ + truncated_bytes = bio->bi_iter.bi_size - (maxsector << 9); + ++ /* ++ * The bio contains more than one segment which spans EOD, just return ++ * and let IO layer turn it into an EIO ++ */ ++ if (truncated_bytes > bvec->bv_len) ++ return; ++ + /* Truncate the bio.. */ + bio->bi_iter.bi_size -= truncated_bytes; + bvec->bv_len -= truncated_bytes; +diff --git a/fs/cifs/cifs_dfs_ref.c b/fs/cifs/cifs_dfs_ref.c +index 6b61df117fd4..563e2f6268c3 100644 +--- a/fs/cifs/cifs_dfs_ref.c ++++ b/fs/cifs/cifs_dfs_ref.c +@@ -271,9 +271,9 @@ static void dump_referral(const struct dfs_info3_param *ref) + { + cifs_dbg(FYI, "DFS: ref path: %s\n", ref->path_name); + cifs_dbg(FYI, "DFS: node path: %s\n", ref->node_name); +- cifs_dbg(FYI, "DFS: fl: %hd, srv_type: %hd\n", ++ cifs_dbg(FYI, "DFS: fl: %d, srv_type: %d\n", + ref->flags, ref->server_type); +- cifs_dbg(FYI, "DFS: ref_flags: %hd, path_consumed: %hd\n", ++ cifs_dbg(FYI, "DFS: ref_flags: %d, path_consumed: %d\n", + ref->ref_flag, ref->path_consumed); + } + +diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c +index 48aa854c564a..33cd844579ae 100644 +--- a/fs/cifs/connect.c ++++ b/fs/cifs/connect.c +@@ -1265,6 +1265,11 @@ cifs_parse_devname(const char *devname, struct smb_vol *vol) + const char *delims = "/\\"; + size_t len; + ++ if (unlikely(!devname || !*devname)) { ++ cifs_dbg(VFS, "Device name not specified.\n"); ++ return -EINVAL; ++ } ++ + /* make sure we have a valid UNC double delimiter prefix */ + len = strspn(devname, delims); + if (len != 2) +diff --git a/fs/cifs/file.c b/fs/cifs/file.c +index 72d6f4db9bdc..cd69c1e9750f 100644 +--- a/fs/cifs/file.c ++++ b/fs/cifs/file.c +@@ -1631,8 +1631,20 @@ cifs_setlk(struct file *file, struct file_lock *flock, __u32 type, + rc = server->ops->mand_unlock_range(cfile, flock, xid); + + out: +- if (flock->fl_flags & FL_POSIX && !rc) ++ if (flock->fl_flags & FL_POSIX) { ++ /* ++ * If this is a request to remove all locks because we ++ * are closing the file, it doesn't matter if the ++ * unlocking failed as both cifs.ko and the SMB server ++ * remove the lock on file close ++ */ ++ if (rc) { ++ cifs_dbg(VFS, "%s failed rc=%d\n", __func__, rc); ++ if (!(flock->fl_flags & FL_CLOSE)) ++ return rc; ++ } + rc = locks_lock_file_wait(file, flock); ++ } + return rc; + } + +diff --git a/fs/cifs/smb1ops.c b/fs/cifs/smb1ops.c +index d8cd82001c1c..f50d3d0b9b87 100644 +--- a/fs/cifs/smb1ops.c ++++ b/fs/cifs/smb1ops.c +@@ -306,7 +306,7 @@ coalesce_t2(char *second_buf, struct smb_hdr *target_hdr) + remaining = tgt_total_cnt - total_in_tgt; + + if (remaining < 0) { +- cifs_dbg(FYI, "Server sent too much data. tgt_total_cnt=%hu total_in_tgt=%hu\n", ++ cifs_dbg(FYI, "Server sent too much data. tgt_total_cnt=%hu total_in_tgt=%u\n", + tgt_total_cnt, total_in_tgt); + return -EPROTO; + } +diff --git a/fs/ext4/indirect.c b/fs/ext4/indirect.c +index 9e96a0bd08d9..e1801b288847 100644 +--- a/fs/ext4/indirect.c ++++ b/fs/ext4/indirect.c +@@ -1219,6 +1219,7 @@ int ext4_ind_remove_space(handle_t *handle, struct inode *inode, + ext4_lblk_t offsets[4], offsets2[4]; + Indirect chain[4], chain2[4]; + Indirect *partial, *partial2; ++ Indirect *p = NULL, *p2 = NULL; + ext4_lblk_t max_block; + __le32 nr = 0, nr2 = 0; + int n = 0, n2 = 0; +@@ -1260,7 +1261,7 @@ int ext4_ind_remove_space(handle_t *handle, struct inode *inode, + } + + +- partial = ext4_find_shared(inode, n, offsets, chain, &nr); ++ partial = p = ext4_find_shared(inode, n, offsets, chain, &nr); + if (nr) { + if (partial == chain) { + /* Shared branch grows from the inode */ +@@ -1285,13 +1286,11 @@ int ext4_ind_remove_space(handle_t *handle, struct inode *inode, + partial->p + 1, + (__le32 *)partial->bh->b_data+addr_per_block, + (chain+n-1) - partial); +- BUFFER_TRACE(partial->bh, "call brelse"); +- brelse(partial->bh); + partial--; + } + + end_range: +- partial2 = ext4_find_shared(inode, n2, offsets2, chain2, &nr2); ++ partial2 = p2 = ext4_find_shared(inode, n2, offsets2, chain2, &nr2); + if (nr2) { + if (partial2 == chain2) { + /* +@@ -1321,16 +1320,14 @@ end_range: + (__le32 *)partial2->bh->b_data, + partial2->p, + (chain2+n2-1) - partial2); +- BUFFER_TRACE(partial2->bh, "call brelse"); +- brelse(partial2->bh); + partial2--; + } + goto do_indirects; + } + + /* Punch happened within the same level (n == n2) */ +- partial = ext4_find_shared(inode, n, offsets, chain, &nr); +- partial2 = ext4_find_shared(inode, n2, offsets2, chain2, &nr2); ++ partial = p = ext4_find_shared(inode, n, offsets, chain, &nr); ++ partial2 = p2 = ext4_find_shared(inode, n2, offsets2, chain2, &nr2); + + /* Free top, but only if partial2 isn't its subtree. */ + if (nr) { +@@ -1387,15 +1384,7 @@ end_range: + partial->p + 1, + partial2->p, + (chain+n-1) - partial); +- while (partial > chain) { +- BUFFER_TRACE(partial->bh, "call brelse"); +- brelse(partial->bh); +- } +- while (partial2 > chain2) { +- BUFFER_TRACE(partial2->bh, "call brelse"); +- brelse(partial2->bh); +- } +- return 0; ++ goto cleanup; + } + + /* +@@ -1410,8 +1399,6 @@ end_range: + partial->p + 1, + (__le32 *)partial->bh->b_data+addr_per_block, + (chain+n-1) - partial); +- BUFFER_TRACE(partial->bh, "call brelse"); +- brelse(partial->bh); + partial--; + } + if (partial2 > chain2 && depth2 <= depth) { +@@ -1419,11 +1406,21 @@ end_range: + (__le32 *)partial2->bh->b_data, + partial2->p, + (chain2+n2-1) - partial2); +- BUFFER_TRACE(partial2->bh, "call brelse"); +- brelse(partial2->bh); + partial2--; + } + } ++ ++cleanup: ++ while (p && p > chain) { ++ BUFFER_TRACE(p->bh, "call brelse"); ++ brelse(p->bh); ++ p--; ++ } ++ while (p2 && p2 > chain2) { ++ BUFFER_TRACE(p2->bh, "call brelse"); ++ brelse(p2->bh); ++ p2--; ++ } + return 0; + + do_indirects: +@@ -1431,7 +1428,7 @@ do_indirects: + switch (offsets[0]) { + default: + if (++n >= n2) +- return 0; ++ break; + nr = i_data[EXT4_IND_BLOCK]; + if (nr) { + ext4_free_branches(handle, inode, NULL, &nr, &nr+1, 1); +@@ -1439,7 +1436,7 @@ do_indirects: + } + case EXT4_IND_BLOCK: + if (++n >= n2) +- return 0; ++ break; + nr = i_data[EXT4_DIND_BLOCK]; + if (nr) { + ext4_free_branches(handle, inode, NULL, &nr, &nr+1, 2); +@@ -1447,7 +1444,7 @@ do_indirects: + } + case EXT4_DIND_BLOCK: + if (++n >= n2) +- return 0; ++ break; + nr = i_data[EXT4_TIND_BLOCK]; + if (nr) { + ext4_free_branches(handle, inode, NULL, &nr, &nr+1, 3); +@@ -1456,5 +1453,5 @@ do_indirects: + case EXT4_TIND_BLOCK: + ; + } +- return 0; ++ goto cleanup; + } +diff --git a/fs/f2fs/inline.c b/fs/f2fs/inline.c +index 888a9dc13677..506e365cf903 100644 +--- a/fs/f2fs/inline.c ++++ b/fs/f2fs/inline.c +@@ -656,6 +656,12 @@ int f2fs_read_inline_dir(struct file *file, struct dir_context *ctx, + if (IS_ERR(ipage)) + return PTR_ERR(ipage); + ++ /* ++ * f2fs_readdir was protected by inode.i_rwsem, it is safe to access ++ * ipage without page's lock held. ++ */ ++ unlock_page(ipage); ++ + inline_dentry = inline_data_addr(inode, ipage); + + make_dentry_ptr_inline(inode, &d, inline_dentry); +@@ -664,7 +670,7 @@ int f2fs_read_inline_dir(struct file *file, struct dir_context *ctx, + if (!err) + ctx->pos = d.max; + +- f2fs_put_page(ipage, 1); ++ f2fs_put_page(ipage, 0); + return err < 0 ? err : 0; + } + +diff --git a/fs/f2fs/trace.c b/fs/f2fs/trace.c +index bccbbf2616d2..8ac1851a21c0 100644 +--- a/fs/f2fs/trace.c ++++ b/fs/f2fs/trace.c +@@ -61,6 +61,7 @@ void f2fs_trace_pid(struct page *page) + + set_page_private(page, (unsigned long)pid); + ++retry: + if (radix_tree_preload(GFP_NOFS)) + return; + +@@ -71,7 +72,12 @@ void f2fs_trace_pid(struct page *page) + if (p) + radix_tree_delete(&pids, pid); + +- f2fs_radix_tree_insert(&pids, pid, current); ++ if (radix_tree_insert(&pids, pid, current)) { ++ spin_unlock(&pids_lock); ++ radix_tree_preload_end(); ++ cond_resched(); ++ goto retry; ++ } + + trace_printk("%3x:%3x %4x %-16s\n", + MAJOR(inode->i_sb->s_dev), MINOR(inode->i_sb->s_dev), +diff --git a/fs/file.c b/fs/file.c +index 4eecbf4244a5..0c25b980affe 100644 +--- a/fs/file.c ++++ b/fs/file.c +@@ -462,6 +462,7 @@ struct files_struct init_files = { + .full_fds_bits = init_files.full_fds_bits_init, + }, + .file_lock = __SPIN_LOCK_UNLOCKED(init_files.file_lock), ++ .resize_wait = __WAIT_QUEUE_HEAD_INITIALIZER(init_files.resize_wait), + }; + + static unsigned int find_next_fd(struct fdtable *fdt, unsigned int start) +diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c +index 3c1c31321d9b..d11401afd52f 100644 +--- a/fs/jbd2/commit.c ++++ b/fs/jbd2/commit.c +@@ -693,9 +693,11 @@ void jbd2_journal_commit_transaction(journal_t *journal) + the last tag we set up. */ + + tag->t_flags |= cpu_to_be16(JBD2_FLAG_LAST_TAG); +- +- jbd2_descriptor_block_csum_set(journal, descriptor); + start_journal_io: ++ if (descriptor) ++ jbd2_descriptor_block_csum_set(journal, ++ descriptor); ++ + for (i = 0; i < bufs; i++) { + struct buffer_head *bh = wbuf[i]; + /* +diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c +index 61d48f0c41a1..0c8f77db60e2 100644 +--- a/fs/jbd2/journal.c ++++ b/fs/jbd2/journal.c +@@ -1343,6 +1343,10 @@ static int journal_reset(journal_t *journal) + return jbd2_journal_start_thread(journal); + } + ++/* ++ * This function expects that the caller will have locked the journal ++ * buffer head, and will return with it unlocked ++ */ + static int jbd2_write_superblock(journal_t *journal, int write_flags) + { + struct buffer_head *bh = journal->j_sb_buffer; +@@ -1352,7 +1356,6 @@ static int jbd2_write_superblock(journal_t *journal, int write_flags) + trace_jbd2_write_superblock(journal, write_flags); + if (!(journal->j_flags & JBD2_BARRIER)) + write_flags &= ~(REQ_FUA | REQ_PREFLUSH); +- lock_buffer(bh); + if (buffer_write_io_error(bh)) { + /* + * Oh, dear. A previous attempt to write the journal +@@ -1411,6 +1414,7 @@ int jbd2_journal_update_sb_log_tail(journal_t *journal, tid_t tail_tid, + jbd_debug(1, "JBD2: updating superblock (start %lu, seq %u)\n", + tail_block, tail_tid); + ++ lock_buffer(journal->j_sb_buffer); + sb->s_sequence = cpu_to_be32(tail_tid); + sb->s_start = cpu_to_be32(tail_block); + +@@ -1441,18 +1445,17 @@ static void jbd2_mark_journal_empty(journal_t *journal, int write_op) + journal_superblock_t *sb = journal->j_superblock; + + BUG_ON(!mutex_is_locked(&journal->j_checkpoint_mutex)); +- read_lock(&journal->j_state_lock); +- /* Is it already empty? */ +- if (sb->s_start == 0) { +- read_unlock(&journal->j_state_lock); ++ lock_buffer(journal->j_sb_buffer); ++ if (sb->s_start == 0) { /* Is it already empty? */ ++ unlock_buffer(journal->j_sb_buffer); + return; + } ++ + jbd_debug(1, "JBD2: Marking journal as empty (seq %d)\n", + journal->j_tail_sequence); + + sb->s_sequence = cpu_to_be32(journal->j_tail_sequence); + sb->s_start = cpu_to_be32(0); +- read_unlock(&journal->j_state_lock); + + jbd2_write_superblock(journal, write_op); + +@@ -1475,9 +1478,8 @@ void jbd2_journal_update_sb_errno(journal_t *journal) + journal_superblock_t *sb = journal->j_superblock; + int errcode; + +- read_lock(&journal->j_state_lock); ++ lock_buffer(journal->j_sb_buffer); + errcode = journal->j_errno; +- read_unlock(&journal->j_state_lock); + if (errcode == -ESHUTDOWN) + errcode = 0; + jbd_debug(1, "JBD2: updating superblock error (errno %d)\n", errcode); +@@ -1881,28 +1883,27 @@ int jbd2_journal_set_features (journal_t *journal, unsigned long compat, + + sb = journal->j_superblock; + ++ /* Load the checksum driver if necessary */ ++ if ((journal->j_chksum_driver == NULL) && ++ INCOMPAT_FEATURE_ON(JBD2_FEATURE_INCOMPAT_CSUM_V3)) { ++ journal->j_chksum_driver = crypto_alloc_shash("crc32c", 0, 0); ++ if (IS_ERR(journal->j_chksum_driver)) { ++ printk(KERN_ERR "JBD2: Cannot load crc32c driver.\n"); ++ journal->j_chksum_driver = NULL; ++ return 0; ++ } ++ /* Precompute checksum seed for all metadata */ ++ journal->j_csum_seed = jbd2_chksum(journal, ~0, sb->s_uuid, ++ sizeof(sb->s_uuid)); ++ } ++ ++ lock_buffer(journal->j_sb_buffer); ++ + /* If enabling v3 checksums, update superblock */ + if (INCOMPAT_FEATURE_ON(JBD2_FEATURE_INCOMPAT_CSUM_V3)) { + sb->s_checksum_type = JBD2_CRC32C_CHKSUM; + sb->s_feature_compat &= + ~cpu_to_be32(JBD2_FEATURE_COMPAT_CHECKSUM); +- +- /* Load the checksum driver */ +- if (journal->j_chksum_driver == NULL) { +- journal->j_chksum_driver = crypto_alloc_shash("crc32c", +- 0, 0); +- if (IS_ERR(journal->j_chksum_driver)) { +- printk(KERN_ERR "JBD2: Cannot load crc32c " +- "driver.\n"); +- journal->j_chksum_driver = NULL; +- return 0; +- } +- +- /* Precompute checksum seed for all metadata */ +- journal->j_csum_seed = jbd2_chksum(journal, ~0, +- sb->s_uuid, +- sizeof(sb->s_uuid)); +- } + } + + /* If enabling v1 checksums, downgrade superblock */ +@@ -1914,6 +1915,7 @@ int jbd2_journal_set_features (journal_t *journal, unsigned long compat, + sb->s_feature_compat |= cpu_to_be32(compat); + sb->s_feature_ro_compat |= cpu_to_be32(ro); + sb->s_feature_incompat |= cpu_to_be32(incompat); ++ unlock_buffer(journal->j_sb_buffer); + + return 1; + #undef COMPAT_FEATURE_ON +diff --git a/fs/ocfs2/cluster/nodemanager.c b/fs/ocfs2/cluster/nodemanager.c +index c204ac9b49e5..81a0d5d82757 100644 +--- a/fs/ocfs2/cluster/nodemanager.c ++++ b/fs/ocfs2/cluster/nodemanager.c +@@ -621,13 +621,15 @@ static void o2nm_node_group_drop_item(struct config_group *group, + struct o2nm_node *node = to_o2nm_node(item); + struct o2nm_cluster *cluster = to_o2nm_cluster(group->cg_item.ci_parent); + +- o2net_disconnect_node(node); ++ if (cluster->cl_nodes[node->nd_num] == node) { ++ o2net_disconnect_node(node); + +- if (cluster->cl_has_local && +- (cluster->cl_local_node == node->nd_num)) { +- cluster->cl_has_local = 0; +- cluster->cl_local_node = O2NM_INVALID_NODE_NUM; +- o2net_stop_listening(node); ++ if (cluster->cl_has_local && ++ (cluster->cl_local_node == node->nd_num)) { ++ cluster->cl_has_local = 0; ++ cluster->cl_local_node = O2NM_INVALID_NODE_NUM; ++ o2net_stop_listening(node); ++ } + } + + /* XXX call into net to stop this node from trading messages */ +diff --git a/fs/read_write.c b/fs/read_write.c +index 57a00ef895b2..1c3eada2fe25 100644 +--- a/fs/read_write.c ++++ b/fs/read_write.c +@@ -1235,6 +1235,9 @@ COMPAT_SYSCALL_DEFINE5(preadv64v2, unsigned long, fd, + const struct compat_iovec __user *,vec, + unsigned long, vlen, loff_t, pos, rwf_t, flags) + { ++ if (pos == -1) ++ return do_compat_readv(fd, vec, vlen, flags); ++ + return do_compat_preadv64(fd, vec, vlen, pos, flags); + } + #endif +@@ -1341,6 +1344,9 @@ COMPAT_SYSCALL_DEFINE5(pwritev64v2, unsigned long, fd, + const struct compat_iovec __user *,vec, + unsigned long, vlen, loff_t, pos, rwf_t, flags) + { ++ if (pos == -1) ++ return do_compat_writev(fd, vec, vlen, flags); ++ + return do_compat_pwritev64(fd, vec, vlen, pos, flags); + } + #endif +diff --git a/include/linux/cgroup-defs.h b/include/linux/cgroup-defs.h +index e7905d9353e8..93a2469a9130 100644 +--- a/include/linux/cgroup-defs.h ++++ b/include/linux/cgroup-defs.h +@@ -523,7 +523,7 @@ struct cgroup_subsys { + void (*cancel_fork)(struct task_struct *task); + void (*fork)(struct task_struct *task); + void (*exit)(struct task_struct *task); +- void (*free)(struct task_struct *task); ++ void (*release)(struct task_struct *task); + void (*bind)(struct cgroup_subsys_state *root_css); + + bool early_init:1; +diff --git a/include/linux/cgroup.h b/include/linux/cgroup.h +index dddbc29e2009..8e83c9055ccb 100644 +--- a/include/linux/cgroup.h ++++ b/include/linux/cgroup.h +@@ -118,6 +118,7 @@ extern int cgroup_can_fork(struct task_struct *p); + extern void cgroup_cancel_fork(struct task_struct *p); + extern void cgroup_post_fork(struct task_struct *p); + void cgroup_exit(struct task_struct *p); ++void cgroup_release(struct task_struct *p); + void cgroup_free(struct task_struct *p); + + int cgroup_init_early(void); +@@ -668,6 +669,7 @@ static inline int cgroup_can_fork(struct task_struct *p) { return 0; } + static inline void cgroup_cancel_fork(struct task_struct *p) {} + static inline void cgroup_post_fork(struct task_struct *p) {} + static inline void cgroup_exit(struct task_struct *p) {} ++static inline void cgroup_release(struct task_struct *p) {} + static inline void cgroup_free(struct task_struct *p) {} + + static inline int cgroup_init_early(void) { return 0; } +diff --git a/include/linux/clk-provider.h b/include/linux/clk-provider.h +index 2f4e79fe7b86..3eb3376f1cc8 100644 +--- a/include/linux/clk-provider.h ++++ b/include/linux/clk-provider.h +@@ -743,6 +743,9 @@ unsigned int __clk_get_enable_count(struct clk *clk); + unsigned long clk_hw_get_rate(const struct clk_hw *hw); + unsigned long __clk_get_flags(struct clk *clk); + unsigned long clk_hw_get_flags(const struct clk_hw *hw); ++#define clk_hw_can_set_rate_parent(hw) \ ++ (clk_hw_get_flags((hw)) & CLK_SET_RATE_PARENT) ++ + bool clk_hw_is_prepared(const struct clk_hw *hw); + bool clk_hw_is_enabled(const struct clk_hw *hw); + bool __clk_is_enabled(struct clk *clk); +diff --git a/include/linux/filter.h b/include/linux/filter.h +index 42197b16dd78..56d2cda9931b 100644 +--- a/include/linux/filter.h ++++ b/include/linux/filter.h +@@ -741,7 +741,9 @@ bpf_jit_binary_alloc(unsigned int proglen, u8 **image_ptr, + unsigned int alignment, + bpf_jit_fill_hole_t bpf_fill_ill_insns); + void bpf_jit_binary_free(struct bpf_binary_header *hdr); +- ++u64 bpf_jit_alloc_exec_limit(void); ++void *bpf_jit_alloc_exec(unsigned long size); ++void bpf_jit_free_exec(void *addr); + void bpf_jit_free(struct bpf_prog *fp); + + struct bpf_prog *bpf_jit_blind_constants(struct bpf_prog *fp); +diff --git a/include/linux/irqdesc.h b/include/linux/irqdesc.h +index b6084898d330..234f0d1f8dca 100644 +--- a/include/linux/irqdesc.h ++++ b/include/linux/irqdesc.h +@@ -65,6 +65,7 @@ struct irq_desc { + unsigned int core_internal_state__do_not_mess_with_it; + unsigned int depth; /* nested irq disables */ + unsigned int wake_depth; /* nested wake enables */ ++ unsigned int tot_count; + unsigned int irq_count; /* For detecting broken IRQs */ + unsigned long last_unhandled; /* Aging timer for unhandled count */ + unsigned int irqs_unhandled; +diff --git a/include/linux/relay.h b/include/linux/relay.h +index e1bdf01a86e2..c759f96e39c1 100644 +--- a/include/linux/relay.h ++++ b/include/linux/relay.h +@@ -66,7 +66,7 @@ struct rchan + struct kref kref; /* channel refcount */ + void *private_data; /* for user-defined data */ + size_t last_toobig; /* tried to log event > subbuf size */ +- struct rchan_buf ** __percpu buf; /* per-cpu channel buffers */ ++ struct rchan_buf * __percpu *buf; /* per-cpu channel buffers */ + int is_global; /* One global buffer ? */ + struct list_head list; /* for channel list */ + struct dentry *parent; /* parent dentry passed to open */ +diff --git a/include/linux/ring_buffer.h b/include/linux/ring_buffer.h +index 5caa062a02b2..ca52b82128df 100644 +--- a/include/linux/ring_buffer.h ++++ b/include/linux/ring_buffer.h +@@ -123,7 +123,7 @@ ring_buffer_consume(struct ring_buffer *buffer, int cpu, u64 *ts, + unsigned long *lost_events); + + struct ring_buffer_iter * +-ring_buffer_read_prepare(struct ring_buffer *buffer, int cpu); ++ring_buffer_read_prepare(struct ring_buffer *buffer, int cpu, gfp_t flags); + void ring_buffer_read_prepare_sync(void); + void ring_buffer_read_start(struct ring_buffer_iter *iter); + void ring_buffer_read_finish(struct ring_buffer_iter *iter); +diff --git a/include/linux/sched/topology.h b/include/linux/sched/topology.h +index cf257c2e728d..5a92baa91e0c 100644 +--- a/include/linux/sched/topology.h ++++ b/include/linux/sched/topology.h +@@ -177,10 +177,10 @@ typedef int (*sched_domain_flags_f)(void); + #define SDTL_OVERLAP 0x01 + + struct sd_data { +- struct sched_domain **__percpu sd; +- struct sched_domain_shared **__percpu sds; +- struct sched_group **__percpu sg; +- struct sched_group_capacity **__percpu sgc; ++ struct sched_domain *__percpu *sd; ++ struct sched_domain_shared *__percpu *sds; ++ struct sched_group *__percpu *sg; ++ struct sched_group_capacity *__percpu *sgc; + }; + + struct sched_domain_topology_level { +diff --git a/include/net/netfilter/br_netfilter.h b/include/net/netfilter/br_netfilter.h +index 74af19c3a8f7..a4ba601b5d04 100644 +--- a/include/net/netfilter/br_netfilter.h ++++ b/include/net/netfilter/br_netfilter.h +@@ -49,7 +49,6 @@ static inline struct rtable *bridge_parent_rtable(const struct net_device *dev) + } + + struct net_device *setup_pre_routing(struct sk_buff *skb); +-void br_netfilter_enable(void); + + #if IS_ENABLED(CONFIG_IPV6) + int br_validate_ipv6(struct net *net, struct sk_buff *skb); +diff --git a/include/scsi/libfcoe.h b/include/scsi/libfcoe.h +index 722d3264d3bf..a4e41444f5fe 100644 +--- a/include/scsi/libfcoe.h ++++ b/include/scsi/libfcoe.h +@@ -79,7 +79,7 @@ enum fip_state { + * It must not change after fcoe_ctlr_init() sets it. + */ + enum fip_mode { +- FIP_MODE_AUTO = FIP_ST_AUTO, ++ FIP_MODE_AUTO, + FIP_MODE_NON_FIP, + FIP_MODE_FABRIC, + FIP_MODE_VN2VN, +@@ -250,7 +250,7 @@ struct fcoe_rport { + }; + + /* FIP API functions */ +-void fcoe_ctlr_init(struct fcoe_ctlr *, enum fip_state); ++void fcoe_ctlr_init(struct fcoe_ctlr *, enum fip_mode); + void fcoe_ctlr_destroy(struct fcoe_ctlr *); + void fcoe_ctlr_link_up(struct fcoe_ctlr *); + int fcoe_ctlr_link_down(struct fcoe_ctlr *); +diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c +index 7e79358b4473..694b1cc8d144 100644 +--- a/kernel/cgroup/cgroup.c ++++ b/kernel/cgroup/cgroup.c +@@ -187,7 +187,7 @@ static u64 css_serial_nr_next = 1; + */ + static u16 have_fork_callback __read_mostly; + static u16 have_exit_callback __read_mostly; +-static u16 have_free_callback __read_mostly; ++static u16 have_release_callback __read_mostly; + static u16 have_canfork_callback __read_mostly; + + /* cgroup namespace for init task */ +@@ -5112,7 +5112,7 @@ static void __init cgroup_init_subsys(struct cgroup_subsys *ss, bool early) + + have_fork_callback |= (bool)ss->fork << ss->id; + have_exit_callback |= (bool)ss->exit << ss->id; +- have_free_callback |= (bool)ss->free << ss->id; ++ have_release_callback |= (bool)ss->release << ss->id; + have_canfork_callback |= (bool)ss->can_fork << ss->id; + + /* At system boot, before all subsystems have been +@@ -5546,16 +5546,19 @@ void cgroup_exit(struct task_struct *tsk) + } while_each_subsys_mask(); + } + +-void cgroup_free(struct task_struct *task) ++void cgroup_release(struct task_struct *task) + { +- struct css_set *cset = task_css_set(task); + struct cgroup_subsys *ss; + int ssid; + +- do_each_subsys_mask(ss, ssid, have_free_callback) { +- ss->free(task); ++ do_each_subsys_mask(ss, ssid, have_release_callback) { ++ ss->release(task); + } while_each_subsys_mask(); ++} + ++void cgroup_free(struct task_struct *task) ++{ ++ struct css_set *cset = task_css_set(task); + put_css_set(cset); + } + +diff --git a/kernel/cgroup/pids.c b/kernel/cgroup/pids.c +index 9829c67ebc0a..c9960baaa14f 100644 +--- a/kernel/cgroup/pids.c ++++ b/kernel/cgroup/pids.c +@@ -247,7 +247,7 @@ static void pids_cancel_fork(struct task_struct *task) + pids_uncharge(pids, 1); + } + +-static void pids_free(struct task_struct *task) ++static void pids_release(struct task_struct *task) + { + struct pids_cgroup *pids = css_pids(task_css(task, pids_cgrp_id)); + +@@ -342,7 +342,7 @@ struct cgroup_subsys pids_cgrp_subsys = { + .cancel_attach = pids_cancel_attach, + .can_fork = pids_can_fork, + .cancel_fork = pids_cancel_fork, +- .free = pids_free, ++ .release = pids_release, + .legacy_cftypes = pids_files, + .dfl_cftypes = pids_files, + .threaded = true, +diff --git a/kernel/cpu.c b/kernel/cpu.c +index 32f0432f0c26..8c350dd81581 100644 +--- a/kernel/cpu.c ++++ b/kernel/cpu.c +@@ -314,6 +314,15 @@ void cpus_write_unlock(void) + + void lockdep_assert_cpus_held(void) + { ++ /* ++ * We can't have hotplug operations before userspace starts running, ++ * and some init codepaths will knowingly not take the hotplug lock. ++ * This is all valid, so mute lockdep until it makes sense to report ++ * unheld locks. ++ */ ++ if (system_state < SYSTEM_RUNNING) ++ return; ++ + percpu_rwsem_assert_held(&cpu_hotplug_lock); + } + +diff --git a/kernel/exit.c b/kernel/exit.c +index 5523fb0c20c8..95ce231ff5e2 100644 +--- a/kernel/exit.c ++++ b/kernel/exit.c +@@ -218,6 +218,7 @@ repeat: + } + + write_unlock_irq(&tasklist_lock); ++ cgroup_release(p); + release_thread(p); + call_rcu(&p->rcu, delayed_put_task_struct); + +diff --git a/kernel/irq/chip.c b/kernel/irq/chip.c +index 5a2ef92c2782..0fa7ef74303b 100644 +--- a/kernel/irq/chip.c ++++ b/kernel/irq/chip.c +@@ -834,7 +834,11 @@ void handle_percpu_irq(struct irq_desc *desc) + { + struct irq_chip *chip = irq_desc_get_chip(desc); + +- kstat_incr_irqs_this_cpu(desc); ++ /* ++ * PER CPU interrupts are not serialized. Do not touch ++ * desc->tot_count. ++ */ ++ __kstat_incr_irqs_this_cpu(desc); + + if (chip->irq_ack) + chip->irq_ack(&desc->irq_data); +@@ -863,7 +867,11 @@ void handle_percpu_devid_irq(struct irq_desc *desc) + unsigned int irq = irq_desc_get_irq(desc); + irqreturn_t res; + +- kstat_incr_irqs_this_cpu(desc); ++ /* ++ * PER CPU interrupts are not serialized. Do not touch ++ * desc->tot_count. ++ */ ++ __kstat_incr_irqs_this_cpu(desc); + + if (chip->irq_ack) + chip->irq_ack(&desc->irq_data); +diff --git a/kernel/irq/internals.h b/kernel/irq/internals.h +index 44ed5f8c8759..4ef7f3b820ce 100644 +--- a/kernel/irq/internals.h ++++ b/kernel/irq/internals.h +@@ -240,12 +240,18 @@ static inline void irq_state_set_masked(struct irq_desc *desc) + + #undef __irqd_to_state + +-static inline void kstat_incr_irqs_this_cpu(struct irq_desc *desc) ++static inline void __kstat_incr_irqs_this_cpu(struct irq_desc *desc) + { + __this_cpu_inc(*desc->kstat_irqs); + __this_cpu_inc(kstat.irqs_sum); + } + ++static inline void kstat_incr_irqs_this_cpu(struct irq_desc *desc) ++{ ++ __kstat_incr_irqs_this_cpu(desc); ++ desc->tot_count++; ++} ++ + static inline int irq_desc_get_node(struct irq_desc *desc) + { + return irq_common_data_get_node(&desc->irq_common_data); +diff --git a/kernel/irq/irqdesc.c b/kernel/irq/irqdesc.c +index e97bbae947f0..c2bfb11a9d05 100644 +--- a/kernel/irq/irqdesc.c ++++ b/kernel/irq/irqdesc.c +@@ -119,6 +119,7 @@ static void desc_set_defaults(unsigned int irq, struct irq_desc *desc, int node, + desc->depth = 1; + desc->irq_count = 0; + desc->irqs_unhandled = 0; ++ desc->tot_count = 0; + desc->name = NULL; + desc->owner = owner; + for_each_possible_cpu(cpu) +@@ -895,11 +896,15 @@ unsigned int kstat_irqs_cpu(unsigned int irq, int cpu) + unsigned int kstat_irqs(unsigned int irq) + { + struct irq_desc *desc = irq_to_desc(irq); +- int cpu; + unsigned int sum = 0; ++ int cpu; + + if (!desc || !desc->kstat_irqs) + return 0; ++ if (!irq_settings_is_per_cpu_devid(desc) && ++ !irq_settings_is_per_cpu(desc)) ++ return desc->tot_count; ++ + for_each_possible_cpu(cpu) + sum += *per_cpu_ptr(desc->kstat_irqs, cpu); + return sum; +diff --git a/kernel/sched/debug.c b/kernel/sched/debug.c +index 2f93e4a2d9f6..187c04a34ba1 100644 +--- a/kernel/sched/debug.c ++++ b/kernel/sched/debug.c +@@ -339,6 +339,7 @@ void register_sched_domain_sysctl(void) + { + static struct ctl_table *cpu_entries; + static struct ctl_table **cpu_idx; ++ static bool init_done = false; + char buf[32]; + int i; + +@@ -368,7 +369,10 @@ void register_sched_domain_sysctl(void) + if (!cpumask_available(sd_sysctl_cpus)) { + if (!alloc_cpumask_var(&sd_sysctl_cpus, GFP_KERNEL)) + return; ++ } + ++ if (!init_done) { ++ init_done = true; + /* init to possible to not have holes in @cpu_entries */ + cpumask_copy(sd_sysctl_cpus, cpu_possible_mask); + } +diff --git a/kernel/sched/topology.c b/kernel/sched/topology.c +index 659e075ef70b..9dcd80ed9d4c 100644 +--- a/kernel/sched/topology.c ++++ b/kernel/sched/topology.c +@@ -499,7 +499,7 @@ static int __init isolated_cpu_setup(char *str) + __setup("isolcpus=", isolated_cpu_setup); + + struct s_data { +- struct sched_domain ** __percpu sd; ++ struct sched_domain * __percpu *sd; + struct root_domain *rd; + }; + +diff --git a/kernel/sysctl.c b/kernel/sysctl.c +index a7acb058b776..34a3b8a262a9 100644 +--- a/kernel/sysctl.c ++++ b/kernel/sysctl.c +@@ -125,6 +125,7 @@ static int __maybe_unused one = 1; + static int __maybe_unused two = 2; + static int __maybe_unused four = 4; + static unsigned long one_ul = 1; ++static unsigned long long_max = LONG_MAX; + static int one_hundred = 100; + static int one_thousand = 1000; + #ifdef CONFIG_PRINTK +@@ -1681,6 +1682,8 @@ static struct ctl_table fs_table[] = { + .maxlen = sizeof(files_stat.max_files), + .mode = 0644, + .proc_handler = proc_doulongvec_minmax, ++ .extra1 = &zero, ++ .extra2 = &long_max, + }, + { + .procname = "nr_open", +diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c +index a1d5e0949dcf..5f7f4f07499f 100644 +--- a/kernel/trace/ring_buffer.c ++++ b/kernel/trace/ring_buffer.c +@@ -4010,6 +4010,7 @@ EXPORT_SYMBOL_GPL(ring_buffer_consume); + * ring_buffer_read_prepare - Prepare for a non consuming read of the buffer + * @buffer: The ring buffer to read from + * @cpu: The cpu buffer to iterate over ++ * @flags: gfp flags to use for memory allocation + * + * This performs the initial preparations necessary to iterate + * through the buffer. Memory is allocated, buffer recording +@@ -4027,7 +4028,7 @@ EXPORT_SYMBOL_GPL(ring_buffer_consume); + * This overall must be paired with ring_buffer_read_finish. + */ + struct ring_buffer_iter * +-ring_buffer_read_prepare(struct ring_buffer *buffer, int cpu) ++ring_buffer_read_prepare(struct ring_buffer *buffer, int cpu, gfp_t flags) + { + struct ring_buffer_per_cpu *cpu_buffer; + struct ring_buffer_iter *iter; +@@ -4035,7 +4036,7 @@ ring_buffer_read_prepare(struct ring_buffer *buffer, int cpu) + if (!cpumask_test_cpu(cpu, buffer->cpumask)) + return NULL; + +- iter = kmalloc(sizeof(*iter), GFP_KERNEL); ++ iter = kmalloc(sizeof(*iter), flags); + if (!iter) + return NULL; + +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c +index 287e61aba57c..ffddb5ac255c 100644 +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -3901,7 +3901,8 @@ __tracing_open(struct inode *inode, struct file *file, bool snapshot) + if (iter->cpu_file == RING_BUFFER_ALL_CPUS) { + for_each_tracing_cpu(cpu) { + iter->buffer_iter[cpu] = +- ring_buffer_read_prepare(iter->trace_buffer->buffer, cpu); ++ ring_buffer_read_prepare(iter->trace_buffer->buffer, ++ cpu, GFP_KERNEL); + } + ring_buffer_read_prepare_sync(); + for_each_tracing_cpu(cpu) { +@@ -3911,7 +3912,8 @@ __tracing_open(struct inode *inode, struct file *file, bool snapshot) + } else { + cpu = iter->cpu_file; + iter->buffer_iter[cpu] = +- ring_buffer_read_prepare(iter->trace_buffer->buffer, cpu); ++ ring_buffer_read_prepare(iter->trace_buffer->buffer, ++ cpu, GFP_KERNEL); + ring_buffer_read_prepare_sync(); + ring_buffer_read_start(iter->buffer_iter[cpu]); + tracing_iter_reset(iter, cpu); +diff --git a/kernel/trace/trace_kdb.c b/kernel/trace/trace_kdb.c +index d953c163a079..810d78a8d14c 100644 +--- a/kernel/trace/trace_kdb.c ++++ b/kernel/trace/trace_kdb.c +@@ -51,14 +51,16 @@ static void ftrace_dump_buf(int skip_lines, long cpu_file) + if (cpu_file == RING_BUFFER_ALL_CPUS) { + for_each_tracing_cpu(cpu) { + iter.buffer_iter[cpu] = +- ring_buffer_read_prepare(iter.trace_buffer->buffer, cpu); ++ ring_buffer_read_prepare(iter.trace_buffer->buffer, ++ cpu, GFP_ATOMIC); + ring_buffer_read_start(iter.buffer_iter[cpu]); + tracing_iter_reset(&iter, cpu); + } + } else { + iter.cpu_file = cpu_file; + iter.buffer_iter[cpu_file] = +- ring_buffer_read_prepare(iter.trace_buffer->buffer, cpu_file); ++ ring_buffer_read_prepare(iter.trace_buffer->buffer, ++ cpu_file, GFP_ATOMIC); + ring_buffer_read_start(iter.buffer_iter[cpu_file]); + tracing_iter_reset(&iter, cpu_file); + } +diff --git a/lib/bsearch.c b/lib/bsearch.c +index 18b445b010c3..82512fe7b33c 100644 +--- a/lib/bsearch.c ++++ b/lib/bsearch.c +@@ -11,6 +11,7 @@ + + #include <linux/export.h> + #include <linux/bsearch.h> ++#include <linux/kprobes.h> + + /* + * bsearch - binary search an array of elements +@@ -53,3 +54,4 @@ void *bsearch(const void *key, const void *base, size_t num, size_t size, + return NULL; + } + EXPORT_SYMBOL(bsearch); ++NOKPROBE_SYMBOL(bsearch); +diff --git a/lib/int_sqrt.c b/lib/int_sqrt.c +index 036c96781ea8..67bb300b5b46 100644 +--- a/lib/int_sqrt.c ++++ b/lib/int_sqrt.c +@@ -8,6 +8,7 @@ + + #include <linux/kernel.h> + #include <linux/export.h> ++#include <linux/bitops.h> + + /** + * int_sqrt - rough approximation to sqrt +@@ -22,10 +23,7 @@ unsigned long int_sqrt(unsigned long x) + if (x <= 1) + return x; + +- m = 1UL << (BITS_PER_LONG - 2); +- while (m > x) +- m >>= 2; +- ++ m = 1UL << (__fls(x) & ~1UL); + while (m != 0) { + b = y + m; + y >>= 1; +diff --git a/lib/raid6/Makefile b/lib/raid6/Makefile +index ad523be0313b..e0f3b38d6dcb 100644 +--- a/lib/raid6/Makefile ++++ b/lib/raid6/Makefile +@@ -40,7 +40,7 @@ endif + ifeq ($(CONFIG_KERNEL_MODE_NEON),y) + NEON_FLAGS := -ffreestanding + ifeq ($(ARCH),arm) +-NEON_FLAGS += -mfloat-abi=softfp -mfpu=neon ++NEON_FLAGS += -march=armv7-a -mfloat-abi=softfp -mfpu=neon + endif + CFLAGS_recov_neon_inner.o += $(NEON_FLAGS) + ifeq ($(ARCH),arm64) +diff --git a/mm/cma.c b/mm/cma.c +index 022e52bd8370..5749c9b3b5d0 100644 +--- a/mm/cma.c ++++ b/mm/cma.c +@@ -348,12 +348,14 @@ int __init cma_declare_contiguous(phys_addr_t base, + + ret = cma_init_reserved_mem(base, size, order_per_bit, name, res_cma); + if (ret) +- goto err; ++ goto free_mem; + + pr_info("Reserved %ld MiB at %pa\n", (unsigned long)size / SZ_1M, + &base); + return 0; + ++free_mem: ++ memblock_free(base, size); + err: + pr_err("Failed to reserve %ld MiB\n", (unsigned long)size / SZ_1M); + return ret; +diff --git a/mm/mempolicy.c b/mm/mempolicy.c +index 1331645a3794..6ca0225335eb 100644 +--- a/mm/mempolicy.c ++++ b/mm/mempolicy.c +@@ -349,7 +349,7 @@ static void mpol_rebind_policy(struct mempolicy *pol, const nodemask_t *newmask) + { + if (!pol) + return; +- if (!mpol_store_user_nodemask(pol) && ++ if (!mpol_store_user_nodemask(pol) && !(pol->flags & MPOL_F_LOCAL) && + nodes_equal(pol->w.cpuset_mems_allowed, *newmask)) + return; + +@@ -427,6 +427,13 @@ static inline bool queue_pages_required(struct page *page, + return node_isset(nid, *qp->nmask) == !(flags & MPOL_MF_INVERT); + } + ++/* ++ * queue_pages_pmd() has three possible return values: ++ * 1 - pages are placed on the right node or queued successfully. ++ * 0 - THP was split. ++ * -EIO - is migration entry or MPOL_MF_STRICT was specified and an existing ++ * page was already on a node that does not follow the policy. ++ */ + static int queue_pages_pmd(pmd_t *pmd, spinlock_t *ptl, unsigned long addr, + unsigned long end, struct mm_walk *walk) + { +@@ -436,7 +443,7 @@ static int queue_pages_pmd(pmd_t *pmd, spinlock_t *ptl, unsigned long addr, + unsigned long flags; + + if (unlikely(is_pmd_migration_entry(*pmd))) { +- ret = 1; ++ ret = -EIO; + goto unlock; + } + page = pmd_page(*pmd); +@@ -462,8 +469,15 @@ static int queue_pages_pmd(pmd_t *pmd, spinlock_t *ptl, unsigned long addr, + ret = 1; + flags = qp->flags; + /* go to thp migration */ +- if (flags & (MPOL_MF_MOVE | MPOL_MF_MOVE_ALL)) ++ if (flags & (MPOL_MF_MOVE | MPOL_MF_MOVE_ALL)) { ++ if (!vma_migratable(walk->vma)) { ++ ret = -EIO; ++ goto unlock; ++ } ++ + migrate_page_add(page, qp->pagelist, flags); ++ } else ++ ret = -EIO; + unlock: + spin_unlock(ptl); + out: +@@ -488,8 +502,10 @@ static int queue_pages_pte_range(pmd_t *pmd, unsigned long addr, + ptl = pmd_trans_huge_lock(pmd, vma); + if (ptl) { + ret = queue_pages_pmd(pmd, ptl, addr, end, walk); +- if (ret) ++ if (ret > 0) + return 0; ++ else if (ret < 0) ++ return ret; + } + + if (pmd_trans_unstable(pmd)) +@@ -526,11 +542,16 @@ retry: + goto retry; + } + +- migrate_page_add(page, qp->pagelist, flags); ++ if (flags & (MPOL_MF_MOVE | MPOL_MF_MOVE_ALL)) { ++ if (!vma_migratable(vma)) ++ break; ++ migrate_page_add(page, qp->pagelist, flags); ++ } else ++ break; + } + pte_unmap_unlock(pte - 1, ptl); + cond_resched(); +- return 0; ++ return addr != end ? -EIO : 0; + } + + static int queue_pages_hugetlb(pte_t *pte, unsigned long hmask, +@@ -600,7 +621,12 @@ static int queue_pages_test_walk(unsigned long start, unsigned long end, + unsigned long endvma = vma->vm_end; + unsigned long flags = qp->flags; + +- if (!vma_migratable(vma)) ++ /* ++ * Need check MPOL_MF_STRICT to return -EIO if possible ++ * regardless of vma_migratable ++ */ ++ if (!vma_migratable(vma) && ++ !(flags & MPOL_MF_STRICT)) + return 1; + + if (endvma > end) +@@ -627,7 +653,7 @@ static int queue_pages_test_walk(unsigned long start, unsigned long end, + } + + /* queue pages from current vma */ +- if (flags & (MPOL_MF_MOVE | MPOL_MF_MOVE_ALL)) ++ if (flags & MPOL_MF_VALID) + return 0; + return 1; + } +diff --git a/mm/page_alloc.c b/mm/page_alloc.c +index 40075c1946b3..923deb33bf34 100644 +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -1764,8 +1764,8 @@ inline void post_alloc_hook(struct page *page, unsigned int order, + + arch_alloc_page(page, order); + kernel_map_pages(page, 1 << order, 1); +- kernel_poison_pages(page, 1 << order, 1); + kasan_alloc_pages(page, order); ++ kernel_poison_pages(page, 1 << order, 1); + set_page_owner(page, order, gfp_flags); + } + +diff --git a/mm/page_ext.c b/mm/page_ext.c +index 2c44f5b78435..dece2bdf86fe 100644 +--- a/mm/page_ext.c ++++ b/mm/page_ext.c +@@ -271,6 +271,7 @@ static void free_page_ext(void *addr) + table_size = get_entry_size() * PAGES_PER_SECTION; + + BUG_ON(PageReserved(page)); ++ kmemleak_free(addr); + free_pages_exact(addr, table_size); + } + } +diff --git a/mm/page_poison.c b/mm/page_poison.c +index e83fd44867de..a7ba9e315a12 100644 +--- a/mm/page_poison.c ++++ b/mm/page_poison.c +@@ -6,6 +6,7 @@ + #include <linux/page_ext.h> + #include <linux/poison.h> + #include <linux/ratelimit.h> ++#include <linux/kasan.h> + + static bool want_page_poisoning __read_mostly; + +@@ -34,7 +35,10 @@ static void poison_page(struct page *page) + { + void *addr = kmap_atomic(page); + ++ /* KASAN still think the page is in-use, so skip it. */ ++ kasan_disable_current(); + memset(addr, PAGE_POISON, PAGE_SIZE); ++ kasan_enable_current(); + kunmap_atomic(addr); + } + +diff --git a/mm/slab.c b/mm/slab.c +index 09df506ae830..f4658468b23e 100644 +--- a/mm/slab.c ++++ b/mm/slab.c +@@ -563,14 +563,6 @@ static void start_cpu_timer(int cpu) + + static void init_arraycache(struct array_cache *ac, int limit, int batch) + { +- /* +- * The array_cache structures contain pointers to free object. +- * However, when such objects are allocated or transferred to another +- * cache the pointers are not cleared and they could be counted as +- * valid references during a kmemleak scan. Therefore, kmemleak must +- * not scan such objects. +- */ +- kmemleak_no_scan(ac); + if (ac) { + ac->avail = 0; + ac->limit = limit; +@@ -586,6 +578,14 @@ static struct array_cache *alloc_arraycache(int node, int entries, + struct array_cache *ac = NULL; + + ac = kmalloc_node(memsize, gfp, node); ++ /* ++ * The array_cache structures contain pointers to free object. ++ * However, when such objects are allocated or transferred to another ++ * cache the pointers are not cleared and they could be counted as ++ * valid references during a kmemleak scan. Therefore, kmemleak must ++ * not scan such objects. ++ */ ++ kmemleak_no_scan(ac); + init_arraycache(ac, entries, batchcount); + return ac; + } +@@ -680,6 +680,7 @@ static struct alien_cache *__alloc_alien_cache(int node, int entries, + + alc = kmalloc_node(memsize, gfp, node); + if (alc) { ++ kmemleak_no_scan(alc); + init_arraycache(&alc->ac, entries, batch); + spin_lock_init(&alc->lock); + } +diff --git a/mm/vmalloc.c b/mm/vmalloc.c +index 8d9f636d0c98..6c906f6f16cc 100644 +--- a/mm/vmalloc.c ++++ b/mm/vmalloc.c +@@ -498,7 +498,11 @@ nocache: + } + + found: +- if (addr + size > vend) ++ /* ++ * Check also calculated address against the vstart, ++ * because it can be 0 because of big align request. ++ */ ++ if (addr + size > vend || addr < vstart) + goto overflow; + + va->va_start = addr; +diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c +index 3f3859b8d49f..5fd283d9929e 100644 +--- a/net/bridge/br_netfilter_hooks.c ++++ b/net/bridge/br_netfilter_hooks.c +@@ -881,11 +881,6 @@ static const struct nf_br_ops br_ops = { + .br_dev_xmit_hook = br_nf_dev_xmit, + }; + +-void br_netfilter_enable(void) +-{ +-} +-EXPORT_SYMBOL_GPL(br_netfilter_enable); +- + /* For br_nf_post_routing, we need (prio = NF_BR_PRI_LAST), because + * br_dev_queue_push_xmit is called afterwards */ + static const struct nf_hook_ops br_nf_ops[] = { +diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c +index f07357ba9629..06520bf30f29 100644 +--- a/net/netfilter/nf_conntrack_core.c ++++ b/net/netfilter/nf_conntrack_core.c +@@ -763,10 +763,18 @@ __nf_conntrack_confirm(struct sk_buff *skb) + * REJECT will give spurious warnings here. + */ + +- /* No external references means no one else could have +- * confirmed us. ++ /* Another skb with the same unconfirmed conntrack may ++ * win the race. This may happen for bridge(br_flood) ++ * or broadcast/multicast packets do skb_clone with ++ * unconfirmed conntrack. + */ +- WARN_ON(nf_ct_is_confirmed(ct)); ++ if (unlikely(nf_ct_is_confirmed(ct))) { ++ WARN_ON_ONCE(1); ++ nf_conntrack_double_unlock(hash, reply_hash); ++ local_bh_enable(); ++ return NF_DROP; ++ } ++ + pr_debug("Confirming conntrack %p\n", ct); + /* We have to check the DYING flag after unlink to prevent + * a race against nf_ct_get_next_corpse() possibly called from +diff --git a/net/netfilter/xt_physdev.c b/net/netfilter/xt_physdev.c +index bb33598e4530..ec247d8370e8 100644 +--- a/net/netfilter/xt_physdev.c ++++ b/net/netfilter/xt_physdev.c +@@ -96,8 +96,7 @@ match_outdev: + static int physdev_mt_check(const struct xt_mtchk_param *par) + { + const struct xt_physdev_info *info = par->matchinfo; +- +- br_netfilter_enable(); ++ static bool brnf_probed __read_mostly; + + if (!(info->bitmask & XT_PHYSDEV_OP_MASK) || + info->bitmask & ~XT_PHYSDEV_OP_MASK) +@@ -113,6 +112,12 @@ static int physdev_mt_check(const struct xt_mtchk_param *par) + if (par->hook_mask & (1 << NF_INET_LOCAL_OUT)) + return -EINVAL; + } ++ ++ if (!brnf_probed) { ++ brnf_probed = true; ++ request_module("br_netfilter"); ++ } ++ + return 0; + } + +diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c +index a5d9c0146ac3..b72aa48f6478 100644 +--- a/security/selinux/hooks.c ++++ b/security/selinux/hooks.c +@@ -3339,12 +3339,16 @@ static int selinux_inode_setsecurity(struct inode *inode, const char *name, + const void *value, size_t size, int flags) + { + struct inode_security_struct *isec = inode_security_novalidate(inode); ++ struct superblock_security_struct *sbsec = inode->i_sb->s_security; + u32 newsid; + int rc; + + if (strcmp(name, XATTR_SELINUX_SUFFIX)) + return -EOPNOTSUPP; + ++ if (!(sbsec->flags & SBLABEL_MNT)) ++ return -EOPNOTSUPP; ++ + if (!value || !size) + return -EACCES; + +@@ -6103,7 +6107,10 @@ static void selinux_inode_invalidate_secctx(struct inode *inode) + */ + static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen) + { +- return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0); ++ int rc = selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ++ ctx, ctxlen, 0); ++ /* Do not return error when suppressing label (SBLABEL_MNT not set). */ ++ return rc == -EOPNOTSUPP ? 0 : rc; + } + + /* +diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c +index 1a63d456a3dc..182e4afd21eb 100644 +--- a/sound/core/pcm_native.c ++++ b/sound/core/pcm_native.c +@@ -1482,6 +1482,14 @@ int snd_pcm_suspend_all(struct snd_pcm *pcm) + /* FIXME: the open/close code should lock this as well */ + if (substream->runtime == NULL) + continue; ++ ++ /* ++ * Skip BE dai link PCM's that are internal and may ++ * not have their substream ops set. ++ */ ++ if (!substream->ops) ++ continue; ++ + err = snd_pcm_suspend(substream); + if (err < 0 && err != -EBUSY) + return err; +diff --git a/sound/soc/fsl/fsl-asoc-card.c b/sound/soc/fsl/fsl-asoc-card.c +index 2db4d0c80d33..393100edd5fd 100644 +--- a/sound/soc/fsl/fsl-asoc-card.c ++++ b/sound/soc/fsl/fsl-asoc-card.c +@@ -689,6 +689,7 @@ static int fsl_asoc_card_probe(struct platform_device *pdev) + asrc_fail: + of_node_put(asrc_np); + of_node_put(codec_np); ++ put_device(&cpu_pdev->dev); + fail: + of_node_put(cpu_np); + +diff --git a/sound/soc/fsl/imx-sgtl5000.c b/sound/soc/fsl/imx-sgtl5000.c +index b99e0b5e00e9..8e525f7ac08d 100644 +--- a/sound/soc/fsl/imx-sgtl5000.c ++++ b/sound/soc/fsl/imx-sgtl5000.c +@@ -115,6 +115,7 @@ static int imx_sgtl5000_probe(struct platform_device *pdev) + ret = -EPROBE_DEFER; + goto fail; + } ++ put_device(&ssi_pdev->dev); + codec_dev = of_find_i2c_device_by_node(codec_np); + if (!codec_dev) { + dev_err(&pdev->dev, "failed to find codec platform device\n"); +diff --git a/tools/lib/traceevent/event-parse.c b/tools/lib/traceevent/event-parse.c +index 9a17bc27296e..3955ba9e6fcb 100644 +--- a/tools/lib/traceevent/event-parse.c ++++ b/tools/lib/traceevent/event-parse.c +@@ -2430,7 +2430,7 @@ static int arg_num_eval(struct print_arg *arg, long long *val) + static char *arg_eval (struct print_arg *arg) + { + long long val; +- static char buf[20]; ++ static char buf[24]; + + switch (arg->type) { + case PRINT_ATOM: +diff --git a/tools/perf/builtin-c2c.c b/tools/perf/builtin-c2c.c +index fb76423022e8..32e64a8a6443 100644 +--- a/tools/perf/builtin-c2c.c ++++ b/tools/perf/builtin-c2c.c +@@ -1935,6 +1935,12 @@ static int setup_nodes(struct perf_session *session) + if (!set) + return -ENOMEM; + ++ nodes[node] = set; ++ ++ /* empty node, skip */ ++ if (cpu_map__empty(map)) ++ continue; ++ + for (cpu = 0; cpu < map->nr; cpu++) { + set_bit(map->map[cpu], set); + +@@ -1943,8 +1949,6 @@ static int setup_nodes(struct perf_session *session) + + cpu2node[map->map[cpu]] = node; + } +- +- nodes[node] = set; + } + + setup_nodes_header(); +diff --git a/tools/perf/tests/evsel-tp-sched.c b/tools/perf/tests/evsel-tp-sched.c +index 67bcbf876776..d0406116c905 100644 +--- a/tools/perf/tests/evsel-tp-sched.c ++++ b/tools/perf/tests/evsel-tp-sched.c +@@ -43,7 +43,7 @@ int test__perf_evsel__tp_sched_test(struct test *test __maybe_unused, int subtes + return -1; + } + +- if (perf_evsel__test_field(evsel, "prev_comm", 16, true)) ++ if (perf_evsel__test_field(evsel, "prev_comm", 16, false)) + ret = -1; + + if (perf_evsel__test_field(evsel, "prev_pid", 4, true)) +@@ -55,7 +55,7 @@ int test__perf_evsel__tp_sched_test(struct test *test __maybe_unused, int subtes + if (perf_evsel__test_field(evsel, "prev_state", sizeof(long), true)) + ret = -1; + +- if (perf_evsel__test_field(evsel, "next_comm", 16, true)) ++ if (perf_evsel__test_field(evsel, "next_comm", 16, false)) + ret = -1; + + if (perf_evsel__test_field(evsel, "next_pid", 4, true)) +@@ -73,7 +73,7 @@ int test__perf_evsel__tp_sched_test(struct test *test __maybe_unused, int subtes + return -1; + } + +- if (perf_evsel__test_field(evsel, "comm", 16, true)) ++ if (perf_evsel__test_field(evsel, "comm", 16, false)) + ret = -1; + + if (perf_evsel__test_field(evsel, "pid", 4, true))
