diff options
| author |   Mike Pagano <mpagano@gentoo.org> | 2021-11-26 07:00:42 -0500 |
|---|---|---|
| committer | Mike Pagano <mpagano@gentoo.org> | 2021-11-26 07:00:42 -0500 |
| commit | 327d60d57bb5b15ebd173069acab8bc6879f6c62 (patch) | |
| tree | cde3c55312e49a9e217755dd7486b6b82b525984 | |
| parent | Linux patch 4.14.255 (diff) | |
| download | linux-patches-327d60d57bb5b15ebd173069acab8bc6879f6c62.tar.gz linux-patches-327d60d57bb5b15ebd173069acab8bc6879f6c62.tar.bz2 linux-patches-327d60d57bb5b15ebd173069acab8bc6879f6c62.zip | |
Linux patch 4.14.2564.14-266
Signed-off-by: Mike Pagano <mpagano@gentoo.org>
| -rw-r--r-- | 0000_README | 4 | ||||
| -rw-r--r-- | 1255_linux-4.14.256.patch | 7692 |
2 files changed, 7696 insertions, 0 deletions
diff --git a/0000_README b/0000_README index 5c9d9f3b..c9e02ac7 100644 --- a/0000_README +++ b/0000_README @@ -1067,6 +1067,10 @@ Patch: 1254_linux-4.14.255.patch From: https://www.kernel.org Desc: Linux 4.14.255 +Patch: 1255_linux-4.14.256.patch +From: https://www.kernel.org +Desc: Linux 4.14.256 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1255_linux-4.14.256.patch b/1255_linux-4.14.256.patch new file mode 100644 index 00000000..3f38f263 --- /dev/null +++ b/1255_linux-4.14.256.patch @@ -0,0 +1,7692 @@ +diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt +index 3a1507362eb1e..6de214080bbfa 100644 +--- a/Documentation/admin-guide/kernel-parameters.txt ++++ b/Documentation/admin-guide/kernel-parameters.txt +@@ -5030,6 +5030,13 @@ + Disables the PV optimizations forcing the HVM guest to + run as generic HVM guest with no PV drivers. + ++ xen.balloon_boot_timeout= [XEN] ++ The time (in seconds) to wait before giving up to boot ++ in case initial ballooning fails to free enough memory. ++ Applies only when running as HVM or PVH guest and ++ started with less memory configured than allowed at ++ max. Default is 180. ++ + xen.event_eoi_delay= [XEN] + How long to delay EOI handling in case of event + storms (jiffies). Default is 10. +diff --git a/Documentation/devicetree/bindings/regulator/samsung,s5m8767.txt b/Documentation/devicetree/bindings/regulator/samsung,s5m8767.txt +index 093edda0c8dfc..6cd83d920155f 100644 +--- a/Documentation/devicetree/bindings/regulator/samsung,s5m8767.txt ++++ b/Documentation/devicetree/bindings/regulator/samsung,s5m8767.txt +@@ -13,6 +13,14 @@ common regulator binding documented in: + + + Required properties of the main device node (the parent!): ++ - s5m8767,pmic-buck-ds-gpios: GPIO specifiers for three host gpio's used ++ for selecting GPIO DVS lines. It is one-to-one mapped to dvs gpio lines. ++ ++ [1] If either of the 's5m8767,pmic-buck[2/3/4]-uses-gpio-dvs' optional ++ property is specified, then all the eight voltage values for the ++ 's5m8767,pmic-buck[2/3/4]-dvs-voltage' should be specified. ++ ++Optional properties of the main device node (the parent!): + - s5m8767,pmic-buck2-dvs-voltage: A set of 8 voltage values in micro-volt (uV) + units for buck2 when changing voltage using gpio dvs. Refer to [1] below + for additional information. +@@ -25,26 +33,13 @@ Required properties of the main device node (the parent!): + units for buck4 when changing voltage using gpio dvs. Refer to [1] below + for additional information. + +- - s5m8767,pmic-buck-ds-gpios: GPIO specifiers for three host gpio's used +- for selecting GPIO DVS lines. It is one-to-one mapped to dvs gpio lines. +- +- [1] If none of the 's5m8767,pmic-buck[2/3/4]-uses-gpio-dvs' optional +- property is specified, the 's5m8767,pmic-buck[2/3/4]-dvs-voltage' +- property should specify atleast one voltage level (which would be a +- safe operating voltage). +- +- If either of the 's5m8767,pmic-buck[2/3/4]-uses-gpio-dvs' optional +- property is specified, then all the eight voltage values for the +- 's5m8767,pmic-buck[2/3/4]-dvs-voltage' should be specified. +- +-Optional properties of the main device node (the parent!): + - s5m8767,pmic-buck2-uses-gpio-dvs: 'buck2' can be controlled by gpio dvs. + - s5m8767,pmic-buck3-uses-gpio-dvs: 'buck3' can be controlled by gpio dvs. + - s5m8767,pmic-buck4-uses-gpio-dvs: 'buck4' can be controlled by gpio dvs. + + Additional properties required if either of the optional properties are used: + +- - s5m8767,pmic-buck234-default-dvs-idx: Default voltage setting selected from ++ - s5m8767,pmic-buck-default-dvs-idx: Default voltage setting selected from + the possible 8 options selectable by the dvs gpios. The value of this + property should be between 0 and 7. If not specified or if out of range, the + default value of this property is set to 0. +diff --git a/Makefile b/Makefile +index 552f17dd25b41..dd00bb6d79ef7 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 14 +-SUBLEVEL = 255 ++SUBLEVEL = 256 + EXTRAVERSION = + NAME = Petit Gorille + +diff --git a/arch/arm/Makefile b/arch/arm/Makefile +index e7455058416ef..ce4ba57d4a65c 100644 +--- a/arch/arm/Makefile ++++ b/arch/arm/Makefile +@@ -66,15 +66,15 @@ KBUILD_CFLAGS += $(call cc-option,-fno-ipa-sra) + # Note that GCC does not numerically define an architecture version + # macro, but instead defines a whole series of macros which makes + # testing for a specific architecture or later rather impossible. +-arch-$(CONFIG_CPU_32v7M) =-D__LINUX_ARM_ARCH__=7 -march=armv7-m -Wa,-march=armv7-m +-arch-$(CONFIG_CPU_32v7) =-D__LINUX_ARM_ARCH__=7 $(call cc-option,-march=armv7-a,-march=armv5t -Wa$(comma)-march=armv7-a) +-arch-$(CONFIG_CPU_32v6) =-D__LINUX_ARM_ARCH__=6 $(call cc-option,-march=armv6,-march=armv5t -Wa$(comma)-march=armv6) ++arch-$(CONFIG_CPU_32v7M) =-D__LINUX_ARM_ARCH__=7 -march=armv7-m ++arch-$(CONFIG_CPU_32v7) =-D__LINUX_ARM_ARCH__=7 -march=armv7-a ++arch-$(CONFIG_CPU_32v6) =-D__LINUX_ARM_ARCH__=6 -march=armv6 + # Only override the compiler option if ARMv6. The ARMv6K extensions are + # always available in ARMv7 + ifeq ($(CONFIG_CPU_32v6),y) +-arch-$(CONFIG_CPU_32v6K) =-D__LINUX_ARM_ARCH__=6 $(call cc-option,-march=armv6k,-march=armv5t -Wa$(comma)-march=armv6k) ++arch-$(CONFIG_CPU_32v6K) =-D__LINUX_ARM_ARCH__=6 -march=armv6k + endif +-arch-$(CONFIG_CPU_32v5) =-D__LINUX_ARM_ARCH__=5 $(call cc-option,-march=armv5te,-march=armv4t) ++arch-$(CONFIG_CPU_32v5) =-D__LINUX_ARM_ARCH__=5 -march=armv5te + arch-$(CONFIG_CPU_32v4T) =-D__LINUX_ARM_ARCH__=4 -march=armv4t + arch-$(CONFIG_CPU_32v4) =-D__LINUX_ARM_ARCH__=4 -march=armv4 + arch-$(CONFIG_CPU_32v3) =-D__LINUX_ARM_ARCH__=3 -march=armv3 +@@ -88,7 +88,7 @@ tune-$(CONFIG_CPU_ARM720T) =-mtune=arm7tdmi + tune-$(CONFIG_CPU_ARM740T) =-mtune=arm7tdmi + tune-$(CONFIG_CPU_ARM9TDMI) =-mtune=arm9tdmi + tune-$(CONFIG_CPU_ARM940T) =-mtune=arm9tdmi +-tune-$(CONFIG_CPU_ARM946E) =$(call cc-option,-mtune=arm9e,-mtune=arm9tdmi) ++tune-$(CONFIG_CPU_ARM946E) =-mtune=arm9e + tune-$(CONFIG_CPU_ARM920T) =-mtune=arm9tdmi + tune-$(CONFIG_CPU_ARM922T) =-mtune=arm9tdmi + tune-$(CONFIG_CPU_ARM925T) =-mtune=arm9tdmi +@@ -96,11 +96,11 @@ tune-$(CONFIG_CPU_ARM926T) =-mtune=arm9tdmi + tune-$(CONFIG_CPU_FA526) =-mtune=arm9tdmi + tune-$(CONFIG_CPU_SA110) =-mtune=strongarm110 + tune-$(CONFIG_CPU_SA1100) =-mtune=strongarm1100 +-tune-$(CONFIG_CPU_XSCALE) =$(call cc-option,-mtune=xscale,-mtune=strongarm110) -Wa,-mcpu=xscale +-tune-$(CONFIG_CPU_XSC3) =$(call cc-option,-mtune=xscale,-mtune=strongarm110) -Wa,-mcpu=xscale +-tune-$(CONFIG_CPU_FEROCEON) =$(call cc-option,-mtune=marvell-f,-mtune=xscale) +-tune-$(CONFIG_CPU_V6) =$(call cc-option,-mtune=arm1136j-s,-mtune=strongarm) +-tune-$(CONFIG_CPU_V6K) =$(call cc-option,-mtune=arm1136j-s,-mtune=strongarm) ++tune-$(CONFIG_CPU_XSCALE) =-mtune=xscale ++tune-$(CONFIG_CPU_XSC3) =-mtune=xscale ++tune-$(CONFIG_CPU_FEROCEON) =-mtune=xscale ++tune-$(CONFIG_CPU_V6) =-mtune=arm1136j-s ++tune-$(CONFIG_CPU_V6K) =-mtune=arm1136j-s + + # Evaluate tune cc-option calls now + tune-y := $(tune-y) +diff --git a/arch/arm/boot/dts/at91-tse850-3.dts b/arch/arm/boot/dts/at91-tse850-3.dts +index 4ef80a703eda3..d31a4e633fb4a 100644 +--- a/arch/arm/boot/dts/at91-tse850-3.dts ++++ b/arch/arm/boot/dts/at91-tse850-3.dts +@@ -267,7 +267,7 @@ + &macb1 { + status = "okay"; + +- phy-mode = "rgmii"; ++ phy-mode = "rmii"; + + #address-cells = <1>; + #size-cells = <0>; +diff --git a/arch/arm/boot/dts/omap-gpmc-smsc9221.dtsi b/arch/arm/boot/dts/omap-gpmc-smsc9221.dtsi +index 7f6aefd134514..e7534fe9c53cf 100644 +--- a/arch/arm/boot/dts/omap-gpmc-smsc9221.dtsi ++++ b/arch/arm/boot/dts/omap-gpmc-smsc9221.dtsi +@@ -29,7 +29,7 @@ + compatible = "smsc,lan9221","smsc,lan9115"; + bank-width = <2>; + +- gpmc,mux-add-data; ++ gpmc,mux-add-data = <0>; + gpmc,cs-on-ns = <0>; + gpmc,cs-rd-off-ns = <42>; + gpmc,cs-wr-off-ns = <36>; +diff --git a/arch/arm/boot/dts/omap3-gta04.dtsi b/arch/arm/boot/dts/omap3-gta04.dtsi +index e83d0619b3b7c..ee028aa663fa6 100644 +--- a/arch/arm/boot/dts/omap3-gta04.dtsi ++++ b/arch/arm/boot/dts/omap3-gta04.dtsi +@@ -353,7 +353,7 @@ + compatible = "bosch,bma180"; + reg = <0x41>; + pinctrl-names = "default"; +- pintcrl-0 = <&bma180_pins>; ++ pinctrl-0 = <&bma180_pins>; + interrupt-parent = <&gpio4>; + interrupts = <19 IRQ_TYPE_LEVEL_HIGH>; /* GPIO_115 */ + }; +diff --git a/arch/arm/boot/dts/omap3-overo-tobiduo-common.dtsi b/arch/arm/boot/dts/omap3-overo-tobiduo-common.dtsi +index 82e98ee3023ad..3dbeb7a6c569c 100644 +--- a/arch/arm/boot/dts/omap3-overo-tobiduo-common.dtsi ++++ b/arch/arm/boot/dts/omap3-overo-tobiduo-common.dtsi +@@ -25,7 +25,7 @@ + compatible = "smsc,lan9221","smsc,lan9115"; + bank-width = <2>; + +- gpmc,mux-add-data; ++ gpmc,mux-add-data = <0>; + gpmc,cs-on-ns = <0>; + gpmc,cs-rd-off-ns = <42>; + gpmc,cs-wr-off-ns = <36>; +diff --git a/arch/arm/kernel/stacktrace.c b/arch/arm/kernel/stacktrace.c +index ba9b9a77bcd2c..31af81d46aaed 100644 +--- a/arch/arm/kernel/stacktrace.c ++++ b/arch/arm/kernel/stacktrace.c +@@ -52,8 +52,7 @@ int notrace unwind_frame(struct stackframe *frame) + + frame->sp = frame->fp; + frame->fp = *(unsigned long *)(fp); +- frame->pc = frame->lr; +- frame->lr = *(unsigned long *)(fp + 4); ++ frame->pc = *(unsigned long *)(fp + 4); + #else + /* check current frame pointer is within bounds */ + if (fp < low + 12 || fp > high - 4) +diff --git a/arch/arm/mm/Kconfig b/arch/arm/mm/Kconfig +index 50e0b45a22dba..77fd4446b5fc8 100644 +--- a/arch/arm/mm/Kconfig ++++ b/arch/arm/mm/Kconfig +@@ -757,7 +757,7 @@ config CPU_BIG_ENDIAN + config CPU_ENDIAN_BE8 + bool + depends on CPU_BIG_ENDIAN +- default CPU_V6 || CPU_V6K || CPU_V7 ++ default CPU_V6 || CPU_V6K || CPU_V7 || CPU_V7M + help + Support for the BE-8 (big-endian) mode on ARMv6 and ARMv7 processors. + +diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c +index d8cbe772f6901..4c417f3cbfd52 100644 +--- a/arch/arm/mm/mmu.c ++++ b/arch/arm/mm/mmu.c +@@ -416,9 +416,9 @@ void __set_fixmap(enum fixed_addresses idx, phys_addr_t phys, pgprot_t prot) + FIXADDR_END); + BUG_ON(idx >= __end_of_fixed_addresses); + +- /* we only support device mappings until pgprot_kernel has been set */ ++ /* We support only device mappings before pgprot_kernel is set. */ + if (WARN_ON(pgprot_val(prot) != pgprot_val(FIXMAP_PAGE_IO) && +- pgprot_val(pgprot_kernel) == 0)) ++ pgprot_val(prot) && pgprot_val(pgprot_kernel) == 0)) + return; + + if (pgprot_val(prot)) +diff --git a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi +index 0531843117f46..58028f23ad9aa 100644 +--- a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi ++++ b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi +@@ -573,7 +573,7 @@ + }; + + uart0: serial@ff000000 { +- compatible = "cdns,uart-r1p12", "xlnx,xuartps"; ++ compatible = "xlnx,zynqmp-uart", "cdns,uart-r1p12"; + status = "disabled"; + interrupt-parent = <&gic>; + interrupts = <0 21 4>; +@@ -582,7 +582,7 @@ + }; + + uart1: serial@ff010000 { +- compatible = "cdns,uart-r1p12", "xlnx,xuartps"; ++ compatible = "xlnx,zynqmp-uart", "cdns,uart-r1p12"; + status = "disabled"; + interrupt-parent = <&gic>; + interrupts = <0 22 4>; +diff --git a/arch/hexagon/lib/io.c b/arch/hexagon/lib/io.c +index 885c9626d5e08..e5dfed1cf151b 100644 +--- a/arch/hexagon/lib/io.c ++++ b/arch/hexagon/lib/io.c +@@ -40,6 +40,7 @@ void __raw_readsw(const void __iomem *addr, void *data, int len) + *dst++ = *src; + + } ++EXPORT_SYMBOL(__raw_readsw); + + /* + * __raw_writesw - read words a short at a time +@@ -60,6 +61,7 @@ void __raw_writesw(void __iomem *addr, const void *data, int len) + + + } ++EXPORT_SYMBOL(__raw_writesw); + + /* Pretty sure len is pre-adjusted for the length of the access already */ + void __raw_readsl(const void __iomem *addr, void *data, int len) +@@ -75,6 +77,7 @@ void __raw_readsl(const void __iomem *addr, void *data, int len) + + + } ++EXPORT_SYMBOL(__raw_readsl); + + void __raw_writesl(void __iomem *addr, const void *data, int len) + { +@@ -89,3 +92,4 @@ void __raw_writesl(void __iomem *addr, const void *data, int len) + + + } ++EXPORT_SYMBOL(__raw_writesl); +diff --git a/arch/ia64/Kconfig.debug b/arch/ia64/Kconfig.debug +index 677c409425df2..c27c13ca77f47 100644 +--- a/arch/ia64/Kconfig.debug ++++ b/arch/ia64/Kconfig.debug +@@ -42,7 +42,7 @@ config DISABLE_VHPT + + config IA64_DEBUG_CMPXCHG + bool "Turn on compare-and-exchange bug checking (slow!)" +- depends on DEBUG_KERNEL ++ depends on DEBUG_KERNEL && PRINTK + help + Selecting this option turns on bug checking for the IA-64 + compare-and-exchange instructions. This is slow! Itaniums +diff --git a/arch/m68k/Kconfig.machine b/arch/m68k/Kconfig.machine +index 5cd57b4d36156..4a1697fa9a37d 100644 +--- a/arch/m68k/Kconfig.machine ++++ b/arch/m68k/Kconfig.machine +@@ -185,6 +185,7 @@ config INIT_LCD + config MEMORY_RESERVE + int "Memory reservation (MiB)" + depends on (UCSIMM || UCDIMM) ++ default 0 + help + Reserve certain memory regions on 68x328 based boards. + +diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig +index 49c540790fd2d..85afd6b4297b2 100644 +--- a/arch/mips/Kconfig ++++ b/arch/mips/Kconfig +@@ -273,6 +273,9 @@ config BCM63XX + select SYS_SUPPORTS_32BIT_KERNEL + select SYS_SUPPORTS_BIG_ENDIAN + select SYS_HAS_EARLY_PRINTK ++ select SYS_HAS_CPU_BMIPS32_3300 ++ select SYS_HAS_CPU_BMIPS4350 ++ select SYS_HAS_CPU_BMIPS4380 + select SWAP_IO_SPACE + select GPIOLIB + select HAVE_CLK +@@ -1383,6 +1386,7 @@ config CPU_LOONGSON3 + select WEAK_REORDERING_BEYOND_LLSC + select MIPS_PGD_C0_CONTEXT + select MIPS_L1_CACHE_SHIFT_6 ++ select MIPS_FP_SUPPORT + select GPIOLIB + help + The Loongson 3 processor implements the MIPS64R2 instruction +diff --git a/arch/mips/bcm63xx/clk.c b/arch/mips/bcm63xx/clk.c +index 19577f771c1f0..d2a5054b0492b 100644 +--- a/arch/mips/bcm63xx/clk.c ++++ b/arch/mips/bcm63xx/clk.c +@@ -337,6 +337,12 @@ void clk_disable(struct clk *clk) + + EXPORT_SYMBOL(clk_disable); + ++struct clk *clk_get_parent(struct clk *clk) ++{ ++ return NULL; ++} ++EXPORT_SYMBOL(clk_get_parent); ++ + unsigned long clk_get_rate(struct clk *clk) + { + if (!clk) +diff --git a/arch/mips/generic/yamon-dt.c b/arch/mips/generic/yamon-dt.c +index b408dac722ac7..e5fcaafea3a42 100644 +--- a/arch/mips/generic/yamon-dt.c ++++ b/arch/mips/generic/yamon-dt.c +@@ -81,7 +81,7 @@ static unsigned int __init gen_fdt_mem_array( + __init int yamon_dt_append_memory(void *fdt, + const struct yamon_mem_region *regions) + { +- unsigned long phys_memsize, memsize; ++ unsigned long phys_memsize = 0, memsize; + __be32 mem_array[2 * MAX_MEM_ARRAY_ENTRIES]; + unsigned int mem_entries; + int i, err, mem_off; +diff --git a/arch/mips/include/asm/mips-cm.h b/arch/mips/include/asm/mips-cm.h +index 8bc5df49b0e1d..890e51b159e06 100644 +--- a/arch/mips/include/asm/mips-cm.h ++++ b/arch/mips/include/asm/mips-cm.h +@@ -15,6 +15,7 @@ + #ifndef __MIPS_ASM_MIPS_CM_H__ + #define __MIPS_ASM_MIPS_CM_H__ + ++#include <linux/bitfield.h> + #include <linux/bitops.h> + #include <linux/errno.h> + +@@ -157,8 +158,8 @@ GCR_ACCESSOR_RO(32, 0x030, rev) + #define CM_GCR_REV_MINOR GENMASK(7, 0) + + #define CM_ENCODE_REV(major, minor) \ +- (((major) << __ffs(CM_GCR_REV_MAJOR)) | \ +- ((minor) << __ffs(CM_GCR_REV_MINOR))) ++ (FIELD_PREP(CM_GCR_REV_MAJOR, major) | \ ++ FIELD_PREP(CM_GCR_REV_MINOR, minor)) + + #define CM_REV_CM2 CM_ENCODE_REV(6, 0) + #define CM_REV_CM2_5 CM_ENCODE_REV(7, 0) +@@ -366,10 +367,10 @@ static inline int mips_cm_revision(void) + static inline unsigned int mips_cm_max_vp_width(void) + { + extern int smp_num_siblings; +- uint32_t cfg; + + if (mips_cm_revision() >= CM_REV_CM3) +- return read_gcr_sys_config2() & CM_GCR_SYS_CONFIG2_MAXVPW; ++ return FIELD_GET(CM_GCR_SYS_CONFIG2_MAXVPW, ++ read_gcr_sys_config2()); + + if (mips_cm_present()) { + /* +@@ -377,8 +378,7 @@ static inline unsigned int mips_cm_max_vp_width(void) + * number of VP(E)s, and if that ever changes then this will + * need revisiting. + */ +- cfg = read_gcr_cl_config() & CM_GCR_Cx_CONFIG_PVPE; +- return (cfg >> __ffs(CM_GCR_Cx_CONFIG_PVPE)) + 1; ++ return FIELD_GET(CM_GCR_Cx_CONFIG_PVPE, read_gcr_cl_config()) + 1; + } + + if (IS_ENABLED(CONFIG_SMP)) +diff --git a/arch/mips/kernel/mips-cm.c b/arch/mips/kernel/mips-cm.c +index 50d3d74001cbe..51cfcb44e6703 100644 +--- a/arch/mips/kernel/mips-cm.c ++++ b/arch/mips/kernel/mips-cm.c +@@ -183,8 +183,7 @@ static void mips_cm_probe_l2sync(void) + phys_addr_t addr; + + /* L2-only sync was introduced with CM major revision 6 */ +- major_rev = (read_gcr_rev() & CM_GCR_REV_MAJOR) >> +- __ffs(CM_GCR_REV_MAJOR); ++ major_rev = FIELD_GET(CM_GCR_REV_MAJOR, read_gcr_rev()); + if (major_rev < 6) + return; + +@@ -267,13 +266,13 @@ void mips_cm_lock_other(unsigned int cluster, unsigned int core, + preempt_disable(); + + if (cm_rev >= CM_REV_CM3) { +- val = core << __ffs(CM3_GCR_Cx_OTHER_CORE); +- val |= vp << __ffs(CM3_GCR_Cx_OTHER_VP); ++ val = FIELD_PREP(CM3_GCR_Cx_OTHER_CORE, core) | ++ FIELD_PREP(CM3_GCR_Cx_OTHER_VP, vp); + + if (cm_rev >= CM_REV_CM3_5) { + val |= CM_GCR_Cx_OTHER_CLUSTER_EN; +- val |= cluster << __ffs(CM_GCR_Cx_OTHER_CLUSTER); +- val |= block << __ffs(CM_GCR_Cx_OTHER_BLOCK); ++ val |= FIELD_PREP(CM_GCR_Cx_OTHER_CLUSTER, cluster); ++ val |= FIELD_PREP(CM_GCR_Cx_OTHER_BLOCK, block); + } else { + WARN_ON(cluster != 0); + WARN_ON(block != CM_GCR_Cx_OTHER_BLOCK_LOCAL); +@@ -303,7 +302,7 @@ void mips_cm_lock_other(unsigned int cluster, unsigned int core, + spin_lock_irqsave(&per_cpu(cm_core_lock, curr_core), + per_cpu(cm_core_lock_flags, curr_core)); + +- val = core << __ffs(CM_GCR_Cx_OTHER_CORENUM); ++ val = FIELD_PREP(CM_GCR_Cx_OTHER_CORENUM, core); + } + + write_gcr_cl_other(val); +@@ -347,8 +346,8 @@ void mips_cm_error_report(void) + cm_other = read_gcr_error_mult(); + + if (revision < CM_REV_CM3) { /* CM2 */ +- cause = cm_error >> __ffs(CM_GCR_ERROR_CAUSE_ERRTYPE); +- ocause = cm_other >> __ffs(CM_GCR_ERROR_MULT_ERR2ND); ++ cause = FIELD_GET(CM_GCR_ERROR_CAUSE_ERRTYPE, cm_error); ++ ocause = FIELD_GET(CM_GCR_ERROR_MULT_ERR2ND, cm_other); + + if (!cause) + return; +@@ -390,8 +389,8 @@ void mips_cm_error_report(void) + ulong core_id_bits, vp_id_bits, cmd_bits, cmd_group_bits; + ulong cm3_cca_bits, mcp_bits, cm3_tr_bits, sched_bit; + +- cause = cm_error >> __ffs64(CM3_GCR_ERROR_CAUSE_ERRTYPE); +- ocause = cm_other >> __ffs(CM_GCR_ERROR_MULT_ERR2ND); ++ cause = FIELD_GET(CM3_GCR_ERROR_CAUSE_ERRTYPE, cm_error); ++ ocause = FIELD_GET(CM_GCR_ERROR_MULT_ERR2ND, cm_other); + + if (!cause) + return; +diff --git a/arch/mips/kernel/r2300_fpu.S b/arch/mips/kernel/r2300_fpu.S +index 3062ba66c5635..f7ce7b3971a4b 100644 +--- a/arch/mips/kernel/r2300_fpu.S ++++ b/arch/mips/kernel/r2300_fpu.S +@@ -29,8 +29,8 @@ + #define EX2(a,b) \ + 9: a,##b; \ + .section __ex_table,"a"; \ +- PTR 9b,bad_stack; \ +- PTR 9b+4,bad_stack; \ ++ PTR 9b,fault; \ ++ PTR 9b+4,fault; \ + .previous + + .set mips1 +diff --git a/arch/mips/kernel/syscall.c b/arch/mips/kernel/syscall.c +index 58c6f634b5506..d25b8566af98f 100644 +--- a/arch/mips/kernel/syscall.c ++++ b/arch/mips/kernel/syscall.c +@@ -233,12 +233,3 @@ SYSCALL_DEFINE3(cachectl, char *, addr, int, nbytes, int, op) + { + return -ENOSYS; + } +- +-/* +- * If we ever come here the user sp is bad. Zap the process right away. +- * Due to the bad stack signaling wouldn't work. +- */ +-asmlinkage void bad_stack(void) +-{ +- do_exit(SIGSEGV); +-} +diff --git a/arch/mips/lantiq/clk.c b/arch/mips/lantiq/clk.c +index a263d1b751ffe..a8e309dcd38d7 100644 +--- a/arch/mips/lantiq/clk.c ++++ b/arch/mips/lantiq/clk.c +@@ -160,6 +160,12 @@ void clk_deactivate(struct clk *clk) + } + EXPORT_SYMBOL(clk_deactivate); + ++struct clk *clk_get_parent(struct clk *clk) ++{ ++ return NULL; ++} ++EXPORT_SYMBOL(clk_get_parent); ++ + static inline u32 get_counter_resolution(void) + { + u32 res; +diff --git a/arch/mips/lantiq/xway/dma.c b/arch/mips/lantiq/xway/dma.c +index 805b3a6ab2d60..0de61165ef6e4 100644 +--- a/arch/mips/lantiq/xway/dma.c ++++ b/arch/mips/lantiq/xway/dma.c +@@ -22,6 +22,7 @@ + #include <linux/export.h> + #include <linux/spinlock.h> + #include <linux/clk.h> ++#include <linux/delay.h> + #include <linux/err.h> + + #include <lantiq_soc.h> +@@ -40,6 +41,7 @@ + #define LTQ_DMA_PCTRL 0x44 + #define LTQ_DMA_IRNEN 0xf4 + ++#define DMA_ID_CHNR GENMASK(26, 20) /* channel number */ + #define DMA_DESCPT BIT(3) /* descriptor complete irq */ + #define DMA_TX BIT(8) /* TX channel direction */ + #define DMA_CHAN_ON BIT(0) /* channel on / off bit */ +@@ -50,7 +52,6 @@ + #define DMA_POLL BIT(31) /* turn on channel polling */ + #define DMA_CLK_DIV4 BIT(6) /* polling clock divider */ + #define DMA_2W_BURST BIT(1) /* 2 word burst length */ +-#define DMA_MAX_CHANNEL 20 /* the soc has 20 channels */ + #define DMA_ETOP_ENDIANNESS (0xf << 8) /* endianness swap etop channels */ + #define DMA_WEIGHT (BIT(17) | BIT(16)) /* default channel wheight */ + +@@ -218,7 +219,7 @@ ltq_dma_init(struct platform_device *pdev) + { + struct clk *clk; + struct resource *res; +- unsigned id; ++ unsigned int id, nchannels; + int i; + + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); +@@ -234,21 +235,24 @@ ltq_dma_init(struct platform_device *pdev) + clk_enable(clk); + ltq_dma_w32_mask(0, DMA_RESET, LTQ_DMA_CTRL); + ++ usleep_range(1, 10); ++ + /* disable all interrupts */ + ltq_dma_w32(0, LTQ_DMA_IRNEN); + + /* reset/configure each channel */ +- for (i = 0; i < DMA_MAX_CHANNEL; i++) { ++ id = ltq_dma_r32(LTQ_DMA_ID); ++ nchannels = ((id & DMA_ID_CHNR) >> 20); ++ for (i = 0; i < nchannels; i++) { + ltq_dma_w32(i, LTQ_DMA_CS); + ltq_dma_w32(DMA_CHAN_RST, LTQ_DMA_CCTRL); + ltq_dma_w32(DMA_POLL | DMA_CLK_DIV4, LTQ_DMA_CPOLL); + ltq_dma_w32_mask(DMA_CHAN_ON, 0, LTQ_DMA_CCTRL); + } + +- id = ltq_dma_r32(LTQ_DMA_ID); + dev_info(&pdev->dev, + "Init done - hw rev: %X, ports: %d, channels: %d\n", +- id & 0x1f, (id >> 16) & 0xf, id >> 20); ++ id & 0x1f, (id >> 16) & 0xf, nchannels); + + return 0; + } +diff --git a/arch/mips/sni/time.c b/arch/mips/sni/time.c +index 0eb7d1e8821be..d741e24a21879 100644 +--- a/arch/mips/sni/time.c ++++ b/arch/mips/sni/time.c +@@ -18,14 +18,14 @@ static int a20r_set_periodic(struct clock_event_device *evt) + { + *(volatile u8 *)(A20R_PT_CLOCK_BASE + 12) = 0x34; + wmb(); +- *(volatile u8 *)(A20R_PT_CLOCK_BASE + 0) = SNI_COUNTER0_DIV; ++ *(volatile u8 *)(A20R_PT_CLOCK_BASE + 0) = SNI_COUNTER0_DIV & 0xff; + wmb(); + *(volatile u8 *)(A20R_PT_CLOCK_BASE + 0) = SNI_COUNTER0_DIV >> 8; + wmb(); + + *(volatile u8 *)(A20R_PT_CLOCK_BASE + 12) = 0xb4; + wmb(); +- *(volatile u8 *)(A20R_PT_CLOCK_BASE + 8) = SNI_COUNTER2_DIV; ++ *(volatile u8 *)(A20R_PT_CLOCK_BASE + 8) = SNI_COUNTER2_DIV & 0xff; + wmb(); + *(volatile u8 *)(A20R_PT_CLOCK_BASE + 8) = SNI_COUNTER2_DIV >> 8; + wmb(); +diff --git a/arch/parisc/kernel/entry.S b/arch/parisc/kernel/entry.S +index 843825a7e6e2a..0f2b4355064fa 100644 +--- a/arch/parisc/kernel/entry.S ++++ b/arch/parisc/kernel/entry.S +@@ -1849,8 +1849,8 @@ syscall_restore: + LDREG TI_TASK-THREAD_SZ_ALGN-FRAME_SIZE(%r30),%r1 + + /* Are we being ptraced? */ +- ldw TASK_FLAGS(%r1),%r19 +- ldi _TIF_SYSCALL_TRACE_MASK,%r2 ++ LDREG TI_FLAGS-THREAD_SZ_ALGN-FRAME_SIZE(%r30),%r19 ++ ldi _TIF_SINGLESTEP|_TIF_BLOCKSTEP,%r2 + and,COND(=) %r19,%r2,%r0 + b,n syscall_restore_rfi + +diff --git a/arch/parisc/kernel/smp.c b/arch/parisc/kernel/smp.c +index ab4d5580bb02b..45e3aadcecd2f 100644 +--- a/arch/parisc/kernel/smp.c ++++ b/arch/parisc/kernel/smp.c +@@ -32,6 +32,7 @@ + #include <linux/bitops.h> + #include <linux/ftrace.h> + #include <linux/cpu.h> ++#include <linux/kgdb.h> + + #include <linux/atomic.h> + #include <asm/current.h> +@@ -74,7 +75,10 @@ enum ipi_message_type { + IPI_CALL_FUNC, + IPI_CPU_START, + IPI_CPU_STOP, +- IPI_CPU_TEST ++ IPI_CPU_TEST, ++#ifdef CONFIG_KGDB ++ IPI_ENTER_KGDB, ++#endif + }; + + +@@ -170,7 +174,12 @@ ipi_interrupt(int irq, void *dev_id) + case IPI_CPU_TEST: + smp_debug(100, KERN_DEBUG "CPU%d is alive!\n", this_cpu); + break; +- ++#ifdef CONFIG_KGDB ++ case IPI_ENTER_KGDB: ++ smp_debug(100, KERN_DEBUG "CPU%d ENTER_KGDB\n", this_cpu); ++ kgdb_nmicallback(raw_smp_processor_id(), get_irq_regs()); ++ break; ++#endif + default: + printk(KERN_CRIT "Unknown IPI num on CPU%d: %lu\n", + this_cpu, which); +@@ -226,6 +235,12 @@ send_IPI_allbutself(enum ipi_message_type op) + } + } + ++#ifdef CONFIG_KGDB ++void kgdb_roundup_cpus(void) ++{ ++ send_IPI_allbutself(IPI_ENTER_KGDB); ++} ++#endif + + inline void + smp_send_stop(void) { send_IPI_allbutself(IPI_CPU_STOP); } +diff --git a/arch/parisc/mm/init.c b/arch/parisc/mm/init.c +index 8be075f81ce66..c8af5296cfd24 100644 +--- a/arch/parisc/mm/init.c ++++ b/arch/parisc/mm/init.c +@@ -895,9 +895,9 @@ void flush_tlb_all(void) + { + int do_recycle; + +- __inc_irq_stat(irq_tlb_count); + do_recycle = 0; + spin_lock(&sid_lock); ++ __inc_irq_stat(irq_tlb_count); + if (dirty_space_ids > RECYCLE_THRESHOLD) { + BUG_ON(recycle_inuse); /* FIXME: Use a semaphore/wait queue here */ + get_dirty_sids(&recycle_ndirty,recycle_dirty_array); +@@ -916,8 +916,8 @@ void flush_tlb_all(void) + #else + void flush_tlb_all(void) + { +- __inc_irq_stat(irq_tlb_count); + spin_lock(&sid_lock); ++ __inc_irq_stat(irq_tlb_count); + flush_tlb_all_local(NULL); + recycle_sids(); + spin_unlock(&sid_lock); +diff --git a/arch/powerpc/boot/dts/charon.dts b/arch/powerpc/boot/dts/charon.dts +index 0e00e508eaa6a..1c8fe20752e6a 100644 +--- a/arch/powerpc/boot/dts/charon.dts ++++ b/arch/powerpc/boot/dts/charon.dts +@@ -39,7 +39,7 @@ + }; + }; + +- memory { ++ memory@0 { + device_type = "memory"; + reg = <0x00000000 0x08000000>; // 128MB + }; +diff --git a/arch/powerpc/boot/dts/digsy_mtc.dts b/arch/powerpc/boot/dts/digsy_mtc.dts +index c280e75c86bfd..d4a0a367ed66b 100644 +--- a/arch/powerpc/boot/dts/digsy_mtc.dts ++++ b/arch/powerpc/boot/dts/digsy_mtc.dts +@@ -20,7 +20,7 @@ + model = "intercontrol,digsy-mtc"; + compatible = "intercontrol,digsy-mtc"; + +- memory { ++ memory@0 { + reg = <0x00000000 0x02000000>; // 32MB + }; + +diff --git a/arch/powerpc/boot/dts/lite5200.dts b/arch/powerpc/boot/dts/lite5200.dts +index 179a1785d6454..18d137a3393f0 100644 +--- a/arch/powerpc/boot/dts/lite5200.dts ++++ b/arch/powerpc/boot/dts/lite5200.dts +@@ -36,7 +36,7 @@ + }; + }; + +- memory { ++ memory@0 { + device_type = "memory"; + reg = <0x00000000 0x04000000>; // 64MB + }; +diff --git a/arch/powerpc/boot/dts/lite5200b.dts b/arch/powerpc/boot/dts/lite5200b.dts +index 5abb46c5cc951..29419cf81e044 100644 +--- a/arch/powerpc/boot/dts/lite5200b.dts ++++ b/arch/powerpc/boot/dts/lite5200b.dts +@@ -35,7 +35,7 @@ + led4 { gpios = <&gpio_simple 2 1>; }; + }; + +- memory { ++ memory@0 { + reg = <0x00000000 0x10000000>; // 256MB + }; + +diff --git a/arch/powerpc/boot/dts/media5200.dts b/arch/powerpc/boot/dts/media5200.dts +index b5413cb85f134..3d57463bc49da 100644 +--- a/arch/powerpc/boot/dts/media5200.dts ++++ b/arch/powerpc/boot/dts/media5200.dts +@@ -36,7 +36,7 @@ + }; + }; + +- memory { ++ memory@0 { + reg = <0x00000000 0x08000000>; // 128MB RAM + }; + +diff --git a/arch/powerpc/boot/dts/mpc5200b.dtsi b/arch/powerpc/boot/dts/mpc5200b.dtsi +index 969b2200b2f97..ecfba675b5611 100644 +--- a/arch/powerpc/boot/dts/mpc5200b.dtsi ++++ b/arch/powerpc/boot/dts/mpc5200b.dtsi +@@ -37,7 +37,7 @@ + }; + }; + +- memory: memory { ++ memory: memory@0 { + device_type = "memory"; + reg = <0x00000000 0x04000000>; // 64MB + }; +diff --git a/arch/powerpc/boot/dts/o2d.dts b/arch/powerpc/boot/dts/o2d.dts +index 9f6dd4d889b32..5a676e8141caf 100644 +--- a/arch/powerpc/boot/dts/o2d.dts ++++ b/arch/powerpc/boot/dts/o2d.dts +@@ -16,7 +16,7 @@ + model = "ifm,o2d"; + compatible = "ifm,o2d"; + +- memory { ++ memory@0 { + reg = <0x00000000 0x08000000>; // 128MB + }; + +diff --git a/arch/powerpc/boot/dts/o2d.dtsi b/arch/powerpc/boot/dts/o2d.dtsi +index cf073e693f24d..1b4df5f64b580 100644 +--- a/arch/powerpc/boot/dts/o2d.dtsi ++++ b/arch/powerpc/boot/dts/o2d.dtsi +@@ -23,7 +23,7 @@ + model = "ifm,o2d"; + compatible = "ifm,o2d"; + +- memory { ++ memory@0 { + reg = <0x00000000 0x04000000>; // 64MB + }; + +diff --git a/arch/powerpc/boot/dts/o2dnt2.dts b/arch/powerpc/boot/dts/o2dnt2.dts +index a0f5b97a4f06e..5184c461a205f 100644 +--- a/arch/powerpc/boot/dts/o2dnt2.dts ++++ b/arch/powerpc/boot/dts/o2dnt2.dts +@@ -16,7 +16,7 @@ + model = "ifm,o2dnt2"; + compatible = "ifm,o2d"; + +- memory { ++ memory@0 { + reg = <0x00000000 0x08000000>; // 128MB + }; + +diff --git a/arch/powerpc/boot/dts/o3dnt.dts b/arch/powerpc/boot/dts/o3dnt.dts +index acce49326491b..045b901719245 100644 +--- a/arch/powerpc/boot/dts/o3dnt.dts ++++ b/arch/powerpc/boot/dts/o3dnt.dts +@@ -16,7 +16,7 @@ + model = "ifm,o3dnt"; + compatible = "ifm,o2d"; + +- memory { ++ memory@0 { + reg = <0x00000000 0x04000000>; // 64MB + }; + +diff --git a/arch/powerpc/boot/dts/pcm032.dts b/arch/powerpc/boot/dts/pcm032.dts +index 576249bf2fb91..637e14286dde5 100644 +--- a/arch/powerpc/boot/dts/pcm032.dts ++++ b/arch/powerpc/boot/dts/pcm032.dts +@@ -26,7 +26,7 @@ + model = "phytec,pcm032"; + compatible = "phytec,pcm032"; + +- memory { ++ memory@0 { + reg = <0x00000000 0x08000000>; // 128MB + }; + +diff --git a/arch/powerpc/boot/dts/tqm5200.dts b/arch/powerpc/boot/dts/tqm5200.dts +index 1db07f6cf133c..68b9e8240fb5b 100644 +--- a/arch/powerpc/boot/dts/tqm5200.dts ++++ b/arch/powerpc/boot/dts/tqm5200.dts +@@ -36,7 +36,7 @@ + }; + }; + +- memory { ++ memory@0 { + device_type = "memory"; + reg = <0x00000000 0x04000000>; // 64MB + }; +diff --git a/arch/powerpc/include/asm/code-patching.h b/arch/powerpc/include/asm/code-patching.h +index ae6d4f3a1f481..fcfefb4dda794 100644 +--- a/arch/powerpc/include/asm/code-patching.h ++++ b/arch/powerpc/include/asm/code-patching.h +@@ -25,6 +25,7 @@ + #define BRANCH_ABSOLUTE 0x2 + + bool is_offset_in_branch_range(long offset); ++bool is_offset_in_cond_branch_range(long offset); + unsigned int create_branch(const unsigned int *addr, + unsigned long target, int flags); + unsigned int create_cond_branch(const unsigned int *addr, +diff --git a/arch/powerpc/lib/code-patching.c b/arch/powerpc/lib/code-patching.c +index c5154817178be..85f84b45d3a0a 100644 +--- a/arch/powerpc/lib/code-patching.c ++++ b/arch/powerpc/lib/code-patching.c +@@ -244,6 +244,11 @@ bool is_offset_in_branch_range(long offset) + return (offset >= -0x2000000 && offset <= 0x1fffffc && !(offset & 0x3)); + } + ++bool is_offset_in_cond_branch_range(long offset) ++{ ++ return offset >= -0x8000 && offset <= 0x7fff && !(offset & 0x3); ++} ++ + /* + * Helper to check if a given instruction is a conditional branch + * Derived from the conditional checks in analyse_instr() +@@ -297,7 +302,7 @@ unsigned int create_cond_branch(const unsigned int *addr, + offset = offset - (unsigned long)addr; + + /* Check we can represent the target in the instruction format */ +- if (offset < -0x8000 || offset > 0x7FFF || offset & 0x3) ++ if (!is_offset_in_cond_branch_range(offset)) + return 0; + + /* Mask out the flags and target, so they don't step on each other. */ +diff --git a/arch/powerpc/net/bpf_jit.h b/arch/powerpc/net/bpf_jit.h +index e5c1d30ee968b..5a0af7d8d2242 100644 +--- a/arch/powerpc/net/bpf_jit.h ++++ b/arch/powerpc/net/bpf_jit.h +@@ -15,6 +15,7 @@ + #ifndef __ASSEMBLY__ + + #include <asm/types.h> ++#include <asm/code-patching.h> + + #ifdef PPC64_ELF_ABI_v1 + #define FUNCTION_DESCR_SIZE 24 +@@ -176,13 +177,26 @@ + #define PPC_NEG(d, a) EMIT(PPC_INST_NEG | ___PPC_RT(d) | ___PPC_RA(a)) + + /* Long jump; (unconditional 'branch') */ +-#define PPC_JMP(dest) EMIT(PPC_INST_BRANCH | \ +- (((dest) - (ctx->idx * 4)) & 0x03fffffc)) ++#define PPC_JMP(dest) \ ++ do { \ ++ long offset = (long)(dest) - (ctx->idx * 4); \ ++ if (!is_offset_in_branch_range(offset)) { \ ++ pr_err_ratelimited("Branch offset 0x%lx (@%u) out of range\n", offset, ctx->idx); \ ++ return -ERANGE; \ ++ } \ ++ EMIT(PPC_INST_BRANCH | (offset & 0x03fffffc)); \ ++ } while (0) + /* "cond" here covers BO:BI fields. */ +-#define PPC_BCC_SHORT(cond, dest) EMIT(PPC_INST_BRANCH_COND | \ +- (((cond) & 0x3ff) << 16) | \ +- (((dest) - (ctx->idx * 4)) & \ +- 0xfffc)) ++#define PPC_BCC_SHORT(cond, dest) \ ++ do { \ ++ long offset = (long)(dest) - (ctx->idx * 4); \ ++ if (!is_offset_in_cond_branch_range(offset)) { \ ++ pr_err_ratelimited("Conditional branch offset 0x%lx (@%u) out of range\n", offset, ctx->idx); \ ++ return -ERANGE; \ ++ } \ ++ EMIT(PPC_INST_BRANCH_COND | (((cond) & 0x3ff) << 16) | (offset & 0xfffc)); \ ++ } while (0) ++ + /* Sign-extended 32-bit immediate load */ + #define PPC_LI32(d, i) do { \ + if ((int)(uintptr_t)(i) >= -32768 && \ +@@ -221,11 +235,6 @@ + #define PPC_FUNC_ADDR(d,i) do { PPC_LI32(d, i); } while(0) + #endif + +-static inline bool is_nearbranch(int offset) +-{ +- return (offset < 32768) && (offset >= -32768); +-} +- + /* + * The fly in the ointment of code size changing from pass to pass is + * avoided by padding the short branch case with a NOP. If code size differs +@@ -234,7 +243,7 @@ static inline bool is_nearbranch(int offset) + * state. + */ + #define PPC_BCC(cond, dest) do { \ +- if (is_nearbranch((dest) - (ctx->idx * 4))) { \ ++ if (is_offset_in_cond_branch_range((long)(dest) - (ctx->idx * 4))) { \ + PPC_BCC_SHORT(cond, dest); \ + PPC_NOP(); \ + } else { \ +diff --git a/arch/powerpc/net/bpf_jit_comp64.c b/arch/powerpc/net/bpf_jit_comp64.c +index b6374f6831a27..c504d5bc7d432 100644 +--- a/arch/powerpc/net/bpf_jit_comp64.c ++++ b/arch/powerpc/net/bpf_jit_comp64.c +@@ -235,7 +235,7 @@ static void bpf_jit_emit_func_call(u32 *image, struct codegen_context *ctx, u64 + PPC_BLRL(); + } + +-static void bpf_jit_emit_tail_call(u32 *image, struct codegen_context *ctx, u32 out) ++static int bpf_jit_emit_tail_call(u32 *image, struct codegen_context *ctx, u32 out) + { + /* + * By now, the eBPF program has already setup parameters in r3, r4 and r5 +@@ -296,7 +296,9 @@ static void bpf_jit_emit_tail_call(u32 *image, struct codegen_context *ctx, u32 + bpf_jit_emit_common_epilogue(image, ctx); + + PPC_BCTR(); ++ + /* out: */ ++ return 0; + } + + /* Assemble the body code between the prologue & epilogue */ +@@ -306,7 +308,7 @@ static int bpf_jit_build_body(struct bpf_prog *fp, u32 *image, + { + const struct bpf_insn *insn = fp->insnsi; + int flen = fp->len; +- int i; ++ int i, ret; + + /* Start of epilogue code - will only be valid 2nd pass onwards */ + u32 exit_addr = addrs[flen]; +@@ -357,18 +359,25 @@ static int bpf_jit_build_body(struct bpf_prog *fp, u32 *image, + PPC_SUB(dst_reg, dst_reg, src_reg); + goto bpf_alu32_trunc; + case BPF_ALU | BPF_ADD | BPF_K: /* (u32) dst += (u32) imm */ +- case BPF_ALU | BPF_SUB | BPF_K: /* (u32) dst -= (u32) imm */ + case BPF_ALU64 | BPF_ADD | BPF_K: /* dst += imm */ ++ if (!imm) { ++ goto bpf_alu32_trunc; ++ } else if (imm >= -32768 && imm < 32768) { ++ PPC_ADDI(dst_reg, dst_reg, IMM_L(imm)); ++ } else { ++ PPC_LI32(b2p[TMP_REG_1], imm); ++ PPC_ADD(dst_reg, dst_reg, b2p[TMP_REG_1]); ++ } ++ goto bpf_alu32_trunc; ++ case BPF_ALU | BPF_SUB | BPF_K: /* (u32) dst -= (u32) imm */ + case BPF_ALU64 | BPF_SUB | BPF_K: /* dst -= imm */ +- if (BPF_OP(code) == BPF_SUB) +- imm = -imm; +- if (imm) { +- if (imm >= -32768 && imm < 32768) +- PPC_ADDI(dst_reg, dst_reg, IMM_L(imm)); +- else { +- PPC_LI32(b2p[TMP_REG_1], imm); +- PPC_ADD(dst_reg, dst_reg, b2p[TMP_REG_1]); +- } ++ if (!imm) { ++ goto bpf_alu32_trunc; ++ } else if (imm > -32768 && imm <= 32768) { ++ PPC_ADDI(dst_reg, dst_reg, IMM_L(-imm)); ++ } else { ++ PPC_LI32(b2p[TMP_REG_1], imm); ++ PPC_SUB(dst_reg, dst_reg, b2p[TMP_REG_1]); + } + goto bpf_alu32_trunc; + case BPF_ALU | BPF_MUL | BPF_X: /* (u32) dst *= (u32) src */ +@@ -956,7 +965,9 @@ common_load: + */ + case BPF_JMP | BPF_TAIL_CALL: + ctx->seen |= SEEN_TAILCALL; +- bpf_jit_emit_tail_call(image, ctx, addrs[i + 1]); ++ ret = bpf_jit_emit_tail_call(image, ctx, addrs[i + 1]); ++ if (ret < 0) ++ return ret; + break; + + default: +diff --git a/arch/powerpc/platforms/85xx/mpc85xx_pm_ops.c b/arch/powerpc/platforms/85xx/mpc85xx_pm_ops.c +index f05325f0cc03b..ddd2953965aa1 100644 +--- a/arch/powerpc/platforms/85xx/mpc85xx_pm_ops.c ++++ b/arch/powerpc/platforms/85xx/mpc85xx_pm_ops.c +@@ -98,9 +98,8 @@ int __init mpc85xx_setup_pmc(void) + pr_err("Could not map guts node address\n"); + return -ENOMEM; + } ++ qoriq_pm_ops = &mpc85xx_pm_ops; + } + +- qoriq_pm_ops = &mpc85xx_pm_ops; +- + return 0; + } +diff --git a/arch/powerpc/sysdev/dcr-low.S b/arch/powerpc/sysdev/dcr-low.S +index e687bb2003ff0..5589fbe48bbdc 100644 +--- a/arch/powerpc/sysdev/dcr-low.S ++++ b/arch/powerpc/sysdev/dcr-low.S +@@ -15,7 +15,7 @@ + #include <asm/export.h> + + #define DCR_ACCESS_PROLOG(table) \ +- cmpli cr0,r3,1024; \ ++ cmplwi cr0,r3,1024; \ + rlwinm r3,r3,4,18,27; \ + lis r5,table@h; \ + ori r5,r5,table@l; \ +diff --git a/arch/s390/mm/gmap.c b/arch/s390/mm/gmap.c +index a29d2e88b00ef..fb121440b1c87 100644 +--- a/arch/s390/mm/gmap.c ++++ b/arch/s390/mm/gmap.c +@@ -665,9 +665,10 @@ void __gmap_zap(struct gmap *gmap, unsigned long gaddr) + vmaddr |= gaddr & ~PMD_MASK; + /* Get pointer to the page table entry */ + ptep = get_locked_pte(gmap->mm, vmaddr, &ptl); +- if (likely(ptep)) ++ if (likely(ptep)) { + ptep_zap_unused(gmap->mm, vmaddr, ptep, 0); +- pte_unmap_unlock(ptep, ptl); ++ pte_unmap_unlock(ptep, ptl); ++ } + } + } + EXPORT_SYMBOL_GPL(__gmap_zap); +diff --git a/arch/sh/Kconfig.debug b/arch/sh/Kconfig.debug +index d0767672640d8..4209405179262 100644 +--- a/arch/sh/Kconfig.debug ++++ b/arch/sh/Kconfig.debug +@@ -61,6 +61,7 @@ config DUMP_CODE + + config DWARF_UNWINDER + bool "Enable the DWARF unwinder for stacktraces" ++ depends on DEBUG_KERNEL + select FRAME_POINTER + depends on SUPERH32 + default n +diff --git a/arch/sh/include/asm/sfp-machine.h b/arch/sh/include/asm/sfp-machine.h +index d3c548443f2a6..dd195c6f3b9d8 100644 +--- a/arch/sh/include/asm/sfp-machine.h ++++ b/arch/sh/include/asm/sfp-machine.h +@@ -25,6 +25,14 @@ + #ifndef _SFP_MACHINE_H + #define _SFP_MACHINE_H + ++#ifdef __BIG_ENDIAN__ ++#define __BYTE_ORDER __BIG_ENDIAN ++#define __LITTLE_ENDIAN 0 ++#else ++#define __BYTE_ORDER __LITTLE_ENDIAN ++#define __BIG_ENDIAN 0 ++#endif ++ + #define _FP_W_TYPE_SIZE 32 + #define _FP_W_TYPE unsigned long + #define _FP_WS_TYPE signed long +diff --git a/arch/sh/kernel/cpu/sh4a/smp-shx3.c b/arch/sh/kernel/cpu/sh4a/smp-shx3.c +index 0d3637c494bfe..c1f66c35e0c12 100644 +--- a/arch/sh/kernel/cpu/sh4a/smp-shx3.c ++++ b/arch/sh/kernel/cpu/sh4a/smp-shx3.c +@@ -76,8 +76,9 @@ static void shx3_prepare_cpus(unsigned int max_cpus) + BUILD_BUG_ON(SMP_MSG_NR >= 8); + + for (i = 0; i < SMP_MSG_NR; i++) +- request_irq(104 + i, ipi_interrupt_handler, +- IRQF_PERCPU, "IPI", (void *)(long)i); ++ if (request_irq(104 + i, ipi_interrupt_handler, ++ IRQF_PERCPU, "IPI", (void *)(long)i)) ++ pr_err("Failed to request irq %d\n", i); + + for (i = 0; i < max_cpus; i++) + set_cpu_present(i, true); +diff --git a/arch/x86/events/intel/uncore_snbep.c b/arch/x86/events/intel/uncore_snbep.c +index 6b66285c6cede..b039d416fef34 100644 +--- a/arch/x86/events/intel/uncore_snbep.c ++++ b/arch/x86/events/intel/uncore_snbep.c +@@ -3383,6 +3383,9 @@ static int skx_cha_hw_config(struct intel_uncore_box *box, struct perf_event *ev + struct hw_perf_event_extra *reg1 = &event->hw.extra_reg; + struct extra_reg *er; + int idx = 0; ++ /* Any of the CHA events may be filtered by Thread/Core-ID.*/ ++ if (event->hw.config & SNBEP_CBO_PMON_CTL_TID_EN) ++ idx = SKX_CHA_MSR_PMON_BOX_FILTER_TID; + + for (er = skx_uncore_cha_extra_regs; er->msr; er++) { + if (er->event != (event->hw.config & er->config_mask)) +@@ -3450,6 +3453,7 @@ static struct event_constraint skx_uncore_iio_constraints[] = { + UNCORE_EVENT_CONSTRAINT(0xc0, 0xc), + UNCORE_EVENT_CONSTRAINT(0xc5, 0xc), + UNCORE_EVENT_CONSTRAINT(0xd4, 0xc), ++ UNCORE_EVENT_CONSTRAINT(0xd5, 0xc), + EVENT_CONSTRAINT_END + }; + +diff --git a/arch/x86/include/asm/page_64_types.h b/arch/x86/include/asm/page_64_types.h +index 50c8baaca4b06..4c807635e6244 100644 +--- a/arch/x86/include/asm/page_64_types.h ++++ b/arch/x86/include/asm/page_64_types.h +@@ -20,7 +20,7 @@ + #define THREAD_SIZE (PAGE_SIZE << THREAD_SIZE_ORDER) + #define CURRENT_MASK (~(THREAD_SIZE - 1)) + +-#define EXCEPTION_STACK_ORDER (0 + KASAN_STACK_ORDER) ++#define EXCEPTION_STACK_ORDER (1 + KASAN_STACK_ORDER) + #define EXCEPTION_STKSZ (PAGE_SIZE << EXCEPTION_STACK_ORDER) + + #define DEBUG_STACK_ORDER (EXCEPTION_STACK_ORDER + 1) +diff --git a/arch/x86/kernel/irq.c b/arch/x86/kernel/irq.c +index 3c2326b598208..fbcc303fb1f94 100644 +--- a/arch/x86/kernel/irq.c ++++ b/arch/x86/kernel/irq.c +@@ -274,8 +274,10 @@ void kvm_set_posted_intr_wakeup_handler(void (*handler)(void)) + { + if (handler) + kvm_posted_intr_wakeup_handler = handler; +- else ++ else { + kvm_posted_intr_wakeup_handler = dummy_handler; ++ synchronize_rcu(); ++ } + } + EXPORT_SYMBOL_GPL(kvm_set_posted_intr_wakeup_handler); + +diff --git a/crypto/pcrypt.c b/crypto/pcrypt.c +index 85082574c5154..62e11835f220e 100644 +--- a/crypto/pcrypt.c ++++ b/crypto/pcrypt.c +@@ -138,12 +138,14 @@ static void pcrypt_aead_enc(struct padata_priv *padata) + { + struct pcrypt_request *preq = pcrypt_padata_request(padata); + struct aead_request *req = pcrypt_request_ctx(preq); ++ int ret; + +- padata->info = crypto_aead_encrypt(req); ++ ret = crypto_aead_encrypt(req); + +- if (padata->info == -EINPROGRESS) ++ if (ret == -EINPROGRESS) + return; + ++ padata->info = ret; + padata_do_serial(padata); + } + +@@ -180,12 +182,14 @@ static void pcrypt_aead_dec(struct padata_priv *padata) + { + struct pcrypt_request *preq = pcrypt_padata_request(padata); + struct aead_request *req = pcrypt_request_ctx(preq); ++ int ret; + +- padata->info = crypto_aead_decrypt(req); ++ ret = crypto_aead_decrypt(req); + +- if (padata->info == -EINPROGRESS) ++ if (ret == -EINPROGRESS) + return; + ++ padata->info = ret; + padata_do_serial(padata); + } + +diff --git a/drivers/acpi/acpica/acglobal.h b/drivers/acpi/acpica/acglobal.h +index 95eed442703f2..2f4a3fee69e70 100644 +--- a/drivers/acpi/acpica/acglobal.h ++++ b/drivers/acpi/acpica/acglobal.h +@@ -255,6 +255,8 @@ extern struct acpi_bit_register_info + + ACPI_GLOBAL(u8, acpi_gbl_sleep_type_a); + ACPI_GLOBAL(u8, acpi_gbl_sleep_type_b); ++ACPI_GLOBAL(u8, acpi_gbl_sleep_type_a_s0); ++ACPI_GLOBAL(u8, acpi_gbl_sleep_type_b_s0); + + /***************************************************************************** + * +diff --git a/drivers/acpi/acpica/hwesleep.c b/drivers/acpi/acpica/hwesleep.c +index 12626d021a9b5..7f8c57177819f 100644 +--- a/drivers/acpi/acpica/hwesleep.c ++++ b/drivers/acpi/acpica/hwesleep.c +@@ -181,17 +181,13 @@ acpi_status acpi_hw_extended_sleep(u8 sleep_state) + + acpi_status acpi_hw_extended_wake_prep(u8 sleep_state) + { +- acpi_status status; + u8 sleep_type_value; + + ACPI_FUNCTION_TRACE(hw_extended_wake_prep); + +- status = acpi_get_sleep_type_data(ACPI_STATE_S0, +- &acpi_gbl_sleep_type_a, +- &acpi_gbl_sleep_type_b); +- if (ACPI_SUCCESS(status)) { ++ if (acpi_gbl_sleep_type_a_s0 != ACPI_SLEEP_TYPE_INVALID) { + sleep_type_value = +- ((acpi_gbl_sleep_type_a << ACPI_X_SLEEP_TYPE_POSITION) & ++ ((acpi_gbl_sleep_type_a_s0 << ACPI_X_SLEEP_TYPE_POSITION) & + ACPI_X_SLEEP_TYPE_MASK); + + (void)acpi_write((u64)(sleep_type_value | ACPI_X_SLEEP_ENABLE), +diff --git a/drivers/acpi/acpica/hwsleep.c b/drivers/acpi/acpica/hwsleep.c +index 1fe7387a00e67..2c54d08b20ca6 100644 +--- a/drivers/acpi/acpica/hwsleep.c ++++ b/drivers/acpi/acpica/hwsleep.c +@@ -218,7 +218,7 @@ acpi_status acpi_hw_legacy_sleep(u8 sleep_state) + + acpi_status acpi_hw_legacy_wake_prep(u8 sleep_state) + { +- acpi_status status; ++ acpi_status status = AE_OK; + struct acpi_bit_register_info *sleep_type_reg_info; + struct acpi_bit_register_info *sleep_enable_reg_info; + u32 pm1a_control; +@@ -231,10 +231,7 @@ acpi_status acpi_hw_legacy_wake_prep(u8 sleep_state) + * This is unclear from the ACPI Spec, but it is required + * by some machines. + */ +- status = acpi_get_sleep_type_data(ACPI_STATE_S0, +- &acpi_gbl_sleep_type_a, +- &acpi_gbl_sleep_type_b); +- if (ACPI_SUCCESS(status)) { ++ if (acpi_gbl_sleep_type_a_s0 != ACPI_SLEEP_TYPE_INVALID) { + sleep_type_reg_info = + acpi_hw_get_bit_register_info(ACPI_BITREG_SLEEP_TYPE); + sleep_enable_reg_info = +@@ -255,9 +252,9 @@ acpi_status acpi_hw_legacy_wake_prep(u8 sleep_state) + + /* Insert the SLP_TYP bits */ + +- pm1a_control |= (acpi_gbl_sleep_type_a << ++ pm1a_control |= (acpi_gbl_sleep_type_a_s0 << + sleep_type_reg_info->bit_position); +- pm1b_control |= (acpi_gbl_sleep_type_b << ++ pm1b_control |= (acpi_gbl_sleep_type_b_s0 << + sleep_type_reg_info->bit_position); + + /* Write the control registers and ignore any errors */ +diff --git a/drivers/acpi/acpica/hwxfsleep.c b/drivers/acpi/acpica/hwxfsleep.c +index e5c095ca6083a..827c3242225d9 100644 +--- a/drivers/acpi/acpica/hwxfsleep.c ++++ b/drivers/acpi/acpica/hwxfsleep.c +@@ -322,6 +322,13 @@ acpi_status acpi_enter_sleep_state_prep(u8 sleep_state) + return_ACPI_STATUS(status); + } + ++ status = acpi_get_sleep_type_data(ACPI_STATE_S0, ++ &acpi_gbl_sleep_type_a_s0, ++ &acpi_gbl_sleep_type_b_s0); ++ if (ACPI_FAILURE(status)) { ++ acpi_gbl_sleep_type_a_s0 = ACPI_SLEEP_TYPE_INVALID; ++ } ++ + /* Execute the _PTS method (Prepare To Sleep) */ + + arg_list.count = 1; +diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c +index 13e7b56e33aeb..30996effc491b 100644 +--- a/drivers/acpi/battery.c ++++ b/drivers/acpi/battery.c +@@ -193,7 +193,7 @@ static int acpi_battery_is_charged(struct acpi_battery *battery) + return 1; + + /* fallback to using design values for broken batteries */ +- if (battery->design_capacity == battery->capacity_now) ++ if (battery->design_capacity <= battery->capacity_now) + return 1; + + /* we don't do any sort of metric based on percentages */ +diff --git a/drivers/acpi/pmic/intel_pmic.c b/drivers/acpi/pmic/intel_pmic.c +index ca18e0d23df97..db63d3463617a 100644 +--- a/drivers/acpi/pmic/intel_pmic.c ++++ b/drivers/acpi/pmic/intel_pmic.c +@@ -216,31 +216,36 @@ static acpi_status intel_pmic_regs_handler(u32 function, + void *handler_context, void *region_context) + { + struct intel_pmic_opregion *opregion = region_context; +- int result = 0; ++ int result = -EINVAL; ++ ++ if (function == ACPI_WRITE) { ++ switch (address) { ++ case 0: ++ return AE_OK; ++ case 1: ++ opregion->ctx.addr |= (*value64 & 0xff) << 8; ++ return AE_OK; ++ case 2: ++ opregion->ctx.addr |= *value64 & 0xff; ++ return AE_OK; ++ case 3: ++ opregion->ctx.val = *value64 & 0xff; ++ return AE_OK; ++ case 4: ++ if (*value64) { ++ result = regmap_write(opregion->regmap, opregion->ctx.addr, ++ opregion->ctx.val); ++ } else { ++ result = regmap_read(opregion->regmap, opregion->ctx.addr, ++ &opregion->ctx.val); ++ } ++ opregion->ctx.addr = 0; ++ } ++ } + +- switch (address) { +- case 0: +- return AE_OK; +- case 1: +- opregion->ctx.addr |= (*value64 & 0xff) << 8; ++ if (function == ACPI_READ && address == 3) { ++ *value64 = opregion->ctx.val; + return AE_OK; +- case 2: +- opregion->ctx.addr |= *value64 & 0xff; +- return AE_OK; +- case 3: +- opregion->ctx.val = *value64 & 0xff; +- return AE_OK; +- case 4: +- if (*value64) { +- result = regmap_write(opregion->regmap, opregion->ctx.addr, +- opregion->ctx.val); +- } else { +- result = regmap_read(opregion->regmap, opregion->ctx.addr, +- &opregion->ctx.val); +- if (result == 0) +- *value64 = opregion->ctx.val; +- } +- memset(&opregion->ctx, 0x00, sizeof(opregion->ctx)); + } + + if (result < 0) { +diff --git a/drivers/android/binder.c b/drivers/android/binder.c +index 0db4b56460363..c5fd7908fc913 100644 +--- a/drivers/android/binder.c ++++ b/drivers/android/binder.c +@@ -484,6 +484,9 @@ enum binder_deferred_state { + * @files files_struct for process + * (protected by @files_lock) + * @files_lock mutex to protect @files ++ * @cred struct cred associated with the `struct file` ++ * in binder_open() ++ * (invariant after initialized) + * @deferred_work_node: element for binder_deferred_list + * (protected by binder_deferred_lock) + * @deferred_work: bitmap of deferred work to perform +@@ -532,6 +535,7 @@ struct binder_proc { + struct task_struct *tsk; + struct files_struct *files; + struct mutex files_lock; ++ const struct cred *cred; + struct hlist_node deferred_work_node; + int deferred_work; + bool is_dead; +@@ -2281,7 +2285,7 @@ static int binder_translate_binder(struct flat_binder_object *fp, + ret = -EINVAL; + goto done; + } +- if (security_binder_transfer_binder(proc->tsk, target_proc->tsk)) { ++ if (security_binder_transfer_binder(proc->cred, target_proc->cred)) { + ret = -EPERM; + goto done; + } +@@ -2327,7 +2331,7 @@ static int binder_translate_handle(struct flat_binder_object *fp, + proc->pid, thread->pid, fp->handle); + return -EINVAL; + } +- if (security_binder_transfer_binder(proc->tsk, target_proc->tsk)) { ++ if (security_binder_transfer_binder(proc->cred, target_proc->cred)) { + ret = -EPERM; + goto done; + } +@@ -2411,7 +2415,7 @@ static int binder_translate_fd(int fd, + ret = -EBADF; + goto err_fget; + } +- ret = security_binder_transfer_file(proc->tsk, target_proc->tsk, file); ++ ret = security_binder_transfer_file(proc->cred, target_proc->cred, file); + if (ret < 0) { + ret = -EPERM; + goto err_security; +@@ -2798,8 +2802,8 @@ static void binder_transaction(struct binder_proc *proc, + return_error_line = __LINE__; + goto err_invalid_target_handle; + } +- if (security_binder_transaction(proc->tsk, +- target_proc->tsk) < 0) { ++ if (security_binder_transaction(proc->cred, ++ target_proc->cred) < 0) { + return_error = BR_FAILED_REPLY; + return_error_param = -EPERM; + return_error_line = __LINE__; +@@ -2890,7 +2894,7 @@ static void binder_transaction(struct binder_proc *proc, + t->from = thread; + else + t->from = NULL; +- t->sender_euid = task_euid(proc->tsk); ++ t->sender_euid = proc->cred->euid; + t->to_proc = target_proc; + t->to_thread = target_thread; + t->code = tr->code; +@@ -4261,6 +4265,7 @@ static void binder_free_proc(struct binder_proc *proc) + BUG_ON(!list_empty(&proc->delivered_death)); + binder_alloc_deferred_release(&proc->alloc); + put_task_struct(proc->tsk); ++ put_cred(proc->cred); + binder_stats_deleted(BINDER_STAT_PROC); + kfree(proc); + } +@@ -4464,7 +4469,7 @@ static int binder_ioctl_set_ctx_mgr(struct file *filp) + ret = -EBUSY; + goto out; + } +- ret = security_binder_set_context_mgr(proc->tsk); ++ ret = security_binder_set_context_mgr(proc->cred); + if (ret < 0) + goto out; + if (uid_valid(context->binder_context_mgr_uid)) { +@@ -4717,6 +4722,7 @@ static int binder_open(struct inode *nodp, struct file *filp) + get_task_struct(current->group_leader); + proc->tsk = current->group_leader; + mutex_init(&proc->files_lock); ++ proc->cred = get_cred(filp->f_cred); + INIT_LIST_HEAD(&proc->todo); + proc->default_priority = task_nice(current); + binder_dev = container_of(filp->private_data, struct binder_device, +diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c +index 61dbe6fc29b91..2ae72f31cbe3c 100644 +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -2081,7 +2081,7 @@ unsigned int ata_read_log_page(struct ata_device *dev, u8 log, + + retry: + ata_tf_init(dev, &tf); +- if (dev->dma_mode && ata_id_has_read_log_dma_ext(dev->id) && ++ if (ata_dma_enabled(dev) && ata_id_has_read_log_dma_ext(dev->id) && + !(dev->horkage & ATA_HORKAGE_NO_DMA_LOG)) { + tf.command = ATA_CMD_READ_LOG_DMA_EXT; + tf.protocol = ATA_PROT_DMA; +diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c +index c398be4b17971..88a74ba4bd6ee 100644 +--- a/drivers/ata/libata-eh.c ++++ b/drivers/ata/libata-eh.c +@@ -114,6 +114,12 @@ static const unsigned long ata_eh_identify_timeouts[] = { + ULONG_MAX, + }; + ++static const unsigned long ata_eh_revalidate_timeouts[] = { ++ 15000, /* Some drives are slow to read log pages when waking-up */ ++ 15000, /* combined time till here is enough even for media access */ ++ ULONG_MAX, ++}; ++ + static const unsigned long ata_eh_flush_timeouts[] = { + 15000, /* be generous with flush */ + 15000, /* ditto */ +@@ -150,6 +156,8 @@ static const struct ata_eh_cmd_timeout_ent + ata_eh_cmd_timeout_table[ATA_EH_CMD_TIMEOUT_TABLE_SIZE] = { + { .commands = CMDS(ATA_CMD_ID_ATA, ATA_CMD_ID_ATAPI), + .timeouts = ata_eh_identify_timeouts, }, ++ { .commands = CMDS(ATA_CMD_READ_LOG_EXT, ATA_CMD_READ_LOG_DMA_EXT), ++ .timeouts = ata_eh_revalidate_timeouts, }, + { .commands = CMDS(ATA_CMD_READ_NATIVE_MAX, ATA_CMD_READ_NATIVE_MAX_EXT), + .timeouts = ata_eh_other_timeouts, }, + { .commands = CMDS(ATA_CMD_SET_MAX, ATA_CMD_SET_MAX_EXT), +diff --git a/drivers/auxdisplay/ht16k33.c b/drivers/auxdisplay/ht16k33.c +index eec69213dad4f..f35b7ff29efd2 100644 +--- a/drivers/auxdisplay/ht16k33.c ++++ b/drivers/auxdisplay/ht16k33.c +@@ -227,6 +227,15 @@ static const struct backlight_ops ht16k33_bl_ops = { + .check_fb = ht16k33_bl_check_fb, + }; + ++/* ++ * Blank events will be passed to the actual device handling the backlight when ++ * we return zero here. ++ */ ++static int ht16k33_blank(int blank, struct fb_info *info) ++{ ++ return 0; ++} ++ + static int ht16k33_mmap(struct fb_info *info, struct vm_area_struct *vma) + { + struct ht16k33_priv *priv = info->par; +@@ -239,6 +248,7 @@ static struct fb_ops ht16k33_fb_ops = { + .owner = THIS_MODULE, + .fb_read = fb_sys_read, + .fb_write = fb_sys_write, ++ .fb_blank = ht16k33_blank, + .fb_fillrect = sys_fillrect, + .fb_copyarea = sys_copyarea, + .fb_imageblit = sys_imageblit, +@@ -426,6 +436,33 @@ static int ht16k33_probe(struct i2c_client *client, + if (err) + return err; + ++ /* Backlight */ ++ memset(&bl_props, 0, sizeof(struct backlight_properties)); ++ bl_props.type = BACKLIGHT_RAW; ++ bl_props.max_brightness = MAX_BRIGHTNESS; ++ ++ bl = devm_backlight_device_register(&client->dev, DRIVER_NAME"-bl", ++ &client->dev, priv, ++ &ht16k33_bl_ops, &bl_props); ++ if (IS_ERR(bl)) { ++ dev_err(&client->dev, "failed to register backlight\n"); ++ return PTR_ERR(bl); ++ } ++ ++ err = of_property_read_u32(node, "default-brightness-level", ++ &dft_brightness); ++ if (err) { ++ dft_brightness = MAX_BRIGHTNESS; ++ } else if (dft_brightness > MAX_BRIGHTNESS) { ++ dev_warn(&client->dev, ++ "invalid default brightness level: %u, using %u\n", ++ dft_brightness, MAX_BRIGHTNESS); ++ dft_brightness = MAX_BRIGHTNESS; ++ } ++ ++ bl->props.brightness = dft_brightness; ++ ht16k33_bl_update_status(bl); ++ + /* Framebuffer (2 bytes per column) */ + BUILD_BUG_ON(PAGE_SIZE < HT16K33_FB_SIZE); + fbdev->buffer = (unsigned char *) get_zeroed_page(GFP_KERNEL); +@@ -458,6 +495,7 @@ static int ht16k33_probe(struct i2c_client *client, + fbdev->info->screen_size = HT16K33_FB_SIZE; + fbdev->info->fix = ht16k33_fb_fix; + fbdev->info->var = ht16k33_fb_var; ++ fbdev->info->bl_dev = bl; + fbdev->info->pseudo_palette = NULL; + fbdev->info->flags = FBINFO_FLAG_DEFAULT; + fbdev->info->par = priv; +@@ -470,34 +508,6 @@ static int ht16k33_probe(struct i2c_client *client, + if (err) + goto err_fbdev_unregister; + +- /* Backlight */ +- memset(&bl_props, 0, sizeof(struct backlight_properties)); +- bl_props.type = BACKLIGHT_RAW; +- bl_props.max_brightness = MAX_BRIGHTNESS; +- +- bl = devm_backlight_device_register(&client->dev, DRIVER_NAME"-bl", +- &client->dev, priv, +- &ht16k33_bl_ops, &bl_props); +- if (IS_ERR(bl)) { +- dev_err(&client->dev, "failed to register backlight\n"); +- err = PTR_ERR(bl); +- goto err_fbdev_unregister; +- } +- +- err = of_property_read_u32(node, "default-brightness-level", +- &dft_brightness); +- if (err) { +- dft_brightness = MAX_BRIGHTNESS; +- } else if (dft_brightness > MAX_BRIGHTNESS) { +- dev_warn(&client->dev, +- "invalid default brightness level: %u, using %u\n", +- dft_brightness, MAX_BRIGHTNESS); +- dft_brightness = MAX_BRIGHTNESS; +- } +- +- bl->props.brightness = dft_brightness; +- ht16k33_bl_update_status(bl); +- + ht16k33_fb_queue(priv); + return 0; + +diff --git a/drivers/auxdisplay/img-ascii-lcd.c b/drivers/auxdisplay/img-ascii-lcd.c +index 58403052514f0..4d57185037a0d 100644 +--- a/drivers/auxdisplay/img-ascii-lcd.c ++++ b/drivers/auxdisplay/img-ascii-lcd.c +@@ -284,6 +284,16 @@ static int img_ascii_lcd_display(struct img_ascii_lcd_ctx *ctx, + if (msg[count - 1] == '\n') + count--; + ++ if (!count) { ++ /* clear the LCD */ ++ devm_kfree(&ctx->pdev->dev, ctx->message); ++ ctx->message = NULL; ++ ctx->message_len = 0; ++ memset(ctx->curr, ' ', ctx->cfg->num_chars); ++ ctx->cfg->update(ctx); ++ return 0; ++ } ++ + new_msg = devm_kmalloc(&ctx->pdev->dev, count + 1, GFP_KERNEL); + if (!new_msg) + return -ENOMEM; +diff --git a/drivers/char/hw_random/mtk-rng.c b/drivers/char/hw_random/mtk-rng.c +index 8da7bcf54105f..41f7d893dfef2 100644 +--- a/drivers/char/hw_random/mtk-rng.c ++++ b/drivers/char/hw_random/mtk-rng.c +@@ -181,8 +181,13 @@ static int mtk_rng_runtime_resume(struct device *dev) + return mtk_rng_init(&priv->rng); + } + +-static UNIVERSAL_DEV_PM_OPS(mtk_rng_pm_ops, mtk_rng_runtime_suspend, +- mtk_rng_runtime_resume, NULL); ++static const struct dev_pm_ops mtk_rng_pm_ops = { ++ SET_RUNTIME_PM_OPS(mtk_rng_runtime_suspend, ++ mtk_rng_runtime_resume, NULL) ++ SET_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend, ++ pm_runtime_force_resume) ++}; ++ + #define MTK_RNG_PM_OPS (&mtk_rng_pm_ops) + #else /* CONFIG_PM */ + #define MTK_RNG_PM_OPS NULL +diff --git a/drivers/char/tpm/tpm2-space.c b/drivers/char/tpm/tpm2-space.c +index 115f0fb32179f..c7763a96cbaf3 100644 +--- a/drivers/char/tpm/tpm2-space.c ++++ b/drivers/char/tpm/tpm2-space.c +@@ -422,6 +422,9 @@ static int tpm2_map_response_body(struct tpm_chip *chip, u32 cc, u8 *rsp, + if (be32_to_cpu(data->capability) != TPM2_CAP_HANDLES) + return 0; + ++ if (be32_to_cpu(data->count) > (UINT_MAX - TPM_HEADER_SIZE - 9) / 4) ++ return -EFAULT; ++ + if (len != TPM_HEADER_SIZE + 9 + 4 * be32_to_cpu(data->count)) + return -EFAULT; + +diff --git a/drivers/cpuidle/sysfs.c b/drivers/cpuidle/sysfs.c +index 909bd2255978b..a29d7a6e68487 100644 +--- a/drivers/cpuidle/sysfs.c ++++ b/drivers/cpuidle/sysfs.c +@@ -415,6 +415,7 @@ static int cpuidle_add_state_sysfs(struct cpuidle_device *device) + &kdev->kobj, "state%d", i); + if (ret) { + kobject_put(&kobj->kobj); ++ kfree(kobj); + goto error_state; + } + kobject_uevent(&kobj->kobj, KOBJ_ADD); +@@ -545,6 +546,7 @@ static int cpuidle_add_driver_sysfs(struct cpuidle_device *dev) + &kdev->kobj, "driver"); + if (ret) { + kobject_put(&kdrv->kobj); ++ kfree(kdrv); + return ret; + } + +@@ -631,7 +633,6 @@ int cpuidle_add_sysfs(struct cpuidle_device *dev) + if (!kdev) + return -ENOMEM; + kdev->dev = dev; +- dev->kobj_dev = kdev; + + init_completion(&kdev->kobj_unregister); + +@@ -639,9 +640,11 @@ int cpuidle_add_sysfs(struct cpuidle_device *dev) + "cpuidle"); + if (error) { + kobject_put(&kdev->kobj); ++ kfree(kdev); + return error; + } + ++ dev->kobj_dev = kdev; + kobject_uevent(&kdev->kobj, KOBJ_ADD); + + return 0; +diff --git a/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c b/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c +index c64481160b711..180016e157771 100644 +--- a/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c ++++ b/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c +@@ -195,6 +195,13 @@ static int __adf_iov_putmsg(struct adf_accel_dev *accel_dev, u32 msg, u8 vf_nr) + val = ADF_CSR_RD(pmisc_bar_addr, pf2vf_offset); + } while ((val & int_bit) && (count++ < ADF_IOV_MSG_ACK_MAX_RETRY)); + ++ if (val != msg) { ++ dev_dbg(&GET_DEV(accel_dev), ++ "Collision - PFVF CSR overwritten by remote function\n"); ++ ret = -EIO; ++ goto out; ++ } ++ + if (val & int_bit) { + dev_dbg(&GET_DEV(accel_dev), "ACK not received from remote\n"); + val &= ~int_bit; +@@ -243,6 +250,11 @@ void adf_vf2pf_req_hndl(struct adf_accel_vf_info *vf_info) + + /* Read message from the VF */ + msg = ADF_CSR_RD(pmisc_addr, hw_data->get_pf2vf_offset(vf_nr)); ++ if (!(msg & ADF_VF2PF_INT)) { ++ dev_info(&GET_DEV(accel_dev), ++ "Spurious VF2PF interrupt, msg %X. Ignored\n", msg); ++ goto out; ++ } + + /* To ACK, clear the VF2PFINT bit */ + msg &= ~ADF_VF2PF_INT; +@@ -326,6 +338,7 @@ void adf_vf2pf_req_hndl(struct adf_accel_vf_info *vf_info) + if (resp && adf_iov_putmsg(accel_dev, resp, vf_nr)) + dev_err(&GET_DEV(accel_dev), "Failed to send response to VF\n"); + ++out: + /* re-enable interrupt on PF from this VF */ + adf_enable_vf2pf_interrupts(accel_dev, (1 << vf_nr)); + return; +diff --git a/drivers/crypto/qat/qat_common/adf_vf_isr.c b/drivers/crypto/qat/qat_common/adf_vf_isr.c +index ef90902c8200d..86274e3c6781d 100644 +--- a/drivers/crypto/qat/qat_common/adf_vf_isr.c ++++ b/drivers/crypto/qat/qat_common/adf_vf_isr.c +@@ -123,6 +123,11 @@ static void adf_pf2vf_bh_handler(void *data) + + /* Read the message from PF */ + msg = ADF_CSR_RD(pmisc_bar_addr, hw_data->get_pf2vf_offset(0)); ++ if (!(msg & ADF_PF2VF_INT)) { ++ dev_info(&GET_DEV(accel_dev), ++ "Spurious PF2VF interrupt, msg %X. Ignored\n", msg); ++ goto out; ++ } + + if (!(msg & ADF_PF2VF_MSGORIGIN_SYSTEM)) + /* Ignore legacy non-system (non-kernel) PF2VF messages */ +@@ -171,6 +176,7 @@ static void adf_pf2vf_bh_handler(void *data) + msg &= ~ADF_PF2VF_INT; + ADF_CSR_WR(pmisc_bar_addr, hw_data->get_pf2vf_offset(0), msg); + ++out: + /* Re-enable PF2VF interrupts */ + adf_enable_pf2vf_interrupts(accel_dev); + return; +diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c +index 22764cd30cc39..8c2da523a8ff6 100644 +--- a/drivers/dma/at_xdmac.c ++++ b/drivers/dma/at_xdmac.c +@@ -156,7 +156,7 @@ + #define AT_XDMAC_CC_WRIP (0x1 << 23) /* Write in Progress (read only) */ + #define AT_XDMAC_CC_WRIP_DONE (0x0 << 23) + #define AT_XDMAC_CC_WRIP_IN_PROGRESS (0x1 << 23) +-#define AT_XDMAC_CC_PERID(i) (0x7f & (i) << 24) /* Channel Peripheral Identifier */ ++#define AT_XDMAC_CC_PERID(i) ((0x7f & (i)) << 24) /* Channel Peripheral Identifier */ + #define AT_XDMAC_CDS_MSP 0x2C /* Channel Data Stride Memory Set Pattern */ + #define AT_XDMAC_CSUS 0x30 /* Channel Source Microblock Stride */ + #define AT_XDMAC_CDUS 0x34 /* Channel Destination Microblock Stride */ +diff --git a/drivers/dma/dmaengine.h b/drivers/dma/dmaengine.h +index 501c0b063f852..302f13efd35d9 100644 +--- a/drivers/dma/dmaengine.h ++++ b/drivers/dma/dmaengine.h +@@ -168,7 +168,7 @@ dmaengine_desc_get_callback_invoke(struct dma_async_tx_descriptor *tx, + static inline bool + dmaengine_desc_callback_valid(struct dmaengine_desc_callback *cb) + { +- return (cb->callback) ? true : false; ++ return cb->callback || cb->callback_result; + } + + #endif +diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c +index ddd5990211f8a..3dcc075813e72 100644 +--- a/drivers/edac/sb_edac.c ++++ b/drivers/edac/sb_edac.c +@@ -1014,7 +1014,7 @@ static u64 haswell_get_tohm(struct sbridge_pvt *pvt) + pci_read_config_dword(pvt->info.pci_vtd, HASWELL_TOHM_1, ®); + rc = ((reg << 6) | rc) << 26; + +- return rc | 0x1ffffff; ++ return rc | 0x3ffffff; + } + + static u64 knl_get_tolm(struct sbridge_pvt *pvt) +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c +index 3992e1cbb61ca..54f414279037e 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c +@@ -844,6 +844,7 @@ static int amdgpu_connector_vga_get_modes(struct drm_connector *connector) + + amdgpu_connector_get_edid(connector); + ret = amdgpu_connector_ddc_get_modes(connector); ++ amdgpu_get_native_mode(connector); + + return ret; + } +diff --git a/drivers/gpu/drm/drm_plane_helper.c b/drivers/gpu/drm/drm_plane_helper.c +index 06aee1741e96a..6d57bc01b531f 100644 +--- a/drivers/gpu/drm/drm_plane_helper.c ++++ b/drivers/gpu/drm/drm_plane_helper.c +@@ -243,7 +243,6 @@ int drm_plane_helper_check_update(struct drm_plane *plane, + .crtc_w = drm_rect_width(dst), + .crtc_h = drm_rect_height(dst), + .rotation = rotation, +- .visible = *visible, + }; + int ret; + +diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c +index b9403851f37f3..072a5f150dd61 100644 +--- a/drivers/gpu/drm/msm/msm_gem.c ++++ b/drivers/gpu/drm/msm/msm_gem.c +@@ -959,7 +959,7 @@ static struct drm_gem_object *_msm_gem_new(struct drm_device *dev, + + ret = msm_gem_new_impl(dev, size, flags, NULL, &obj, struct_mutex_locked); + if (ret) +- goto fail; ++ return ERR_PTR(ret); + + if (use_vram) { + struct msm_gem_vma *vma; +@@ -1029,7 +1029,7 @@ struct drm_gem_object *msm_gem_import(struct drm_device *dev, + + ret = msm_gem_new_impl(dev, size, MSM_BO_WC, dmabuf->resv, &obj, false); + if (ret) +- goto fail; ++ return ERR_PTR(ret); + + drm_gem_private_object_init(dev, obj, size); + +diff --git a/drivers/gpu/drm/udl/udl_connector.c b/drivers/gpu/drm/udl/udl_connector.c +index 9f9a49748d176..4588e773469d5 100644 +--- a/drivers/gpu/drm/udl/udl_connector.c ++++ b/drivers/gpu/drm/udl/udl_connector.c +@@ -37,7 +37,7 @@ static u8 *udl_get_edid(struct udl_device *udl) + ret = usb_control_msg(udl->udev, + usb_rcvctrlpipe(udl->udev, 0), (0x02), + (0x80 | (0x02 << 5)), i << 8, 0xA1, rbuf, 2, +- HZ); ++ 1000); + if (ret < 1) { + DRM_ERROR("Read EDID byte %d failed err %x\n", i, ret); + goto error; +diff --git a/drivers/hv/hyperv_vmbus.h b/drivers/hv/hyperv_vmbus.h +index a166de6efd99c..0996a246c80bb 100644 +--- a/drivers/hv/hyperv_vmbus.h ++++ b/drivers/hv/hyperv_vmbus.h +@@ -26,6 +26,7 @@ + #define _HYPERV_VMBUS_H + + #include <linux/list.h> ++#include <linux/bitops.h> + #include <asm/sync_bitops.h> + #include <linux/atomic.h> + #include <linux/hyperv.h> +diff --git a/drivers/hwmon/hwmon.c b/drivers/hwmon/hwmon.c +index 652973d83a07e..b1b5c1e97a430 100644 +--- a/drivers/hwmon/hwmon.c ++++ b/drivers/hwmon/hwmon.c +@@ -627,8 +627,10 @@ __hwmon_device_register(struct device *dev, const char *name, void *drvdata, + dev_set_drvdata(hdev, drvdata); + dev_set_name(hdev, HWMON_ID_FORMAT, id); + err = device_register(hdev); +- if (err) +- goto free_hwmon; ++ if (err) { ++ put_device(hdev); ++ goto ida_remove; ++ } + + if (dev && dev->of_node && chip && chip->ops->read && + chip->info[0]->type == hwmon_chip && +diff --git a/drivers/hwmon/pmbus/lm25066.c b/drivers/hwmon/pmbus/lm25066.c +index 10d17fb8f2836..ac2dd6cef0662 100644 +--- a/drivers/hwmon/pmbus/lm25066.c ++++ b/drivers/hwmon/pmbus/lm25066.c +@@ -69,22 +69,27 @@ static struct __coeff lm25066_coeff[6][PSC_NUM_CLASSES + 2] = { + [lm25056] = { + [PSC_VOLTAGE_IN] = { + .m = 16296, ++ .b = 1343, + .R = -2, + }, + [PSC_CURRENT_IN] = { + .m = 13797, ++ .b = -1833, + .R = -2, + }, + [PSC_CURRENT_IN_L] = { + .m = 6726, ++ .b = -537, + .R = -2, + }, + [PSC_POWER] = { + .m = 5501, ++ .b = -2908, + .R = -3, + }, + [PSC_POWER_L] = { + .m = 26882, ++ .b = -5646, + .R = -4, + }, + [PSC_TEMPERATURE] = { +@@ -96,26 +101,32 @@ static struct __coeff lm25066_coeff[6][PSC_NUM_CLASSES + 2] = { + [lm25066] = { + [PSC_VOLTAGE_IN] = { + .m = 22070, ++ .b = -1800, + .R = -2, + }, + [PSC_VOLTAGE_OUT] = { + .m = 22070, ++ .b = -1800, + .R = -2, + }, + [PSC_CURRENT_IN] = { + .m = 13661, ++ .b = -5200, + .R = -2, + }, + [PSC_CURRENT_IN_L] = { + .m = 6852, ++ .b = -3100, + .R = -2, + }, + [PSC_POWER] = { + .m = 736, ++ .b = -3300, + .R = -2, + }, + [PSC_POWER_L] = { + .m = 369, ++ .b = -1900, + .R = -2, + }, + [PSC_TEMPERATURE] = { +@@ -155,26 +166,32 @@ static struct __coeff lm25066_coeff[6][PSC_NUM_CLASSES + 2] = { + [lm5064] = { + [PSC_VOLTAGE_IN] = { + .m = 4611, ++ .b = -642, + .R = -2, + }, + [PSC_VOLTAGE_OUT] = { + .m = 4621, ++ .b = 423, + .R = -2, + }, + [PSC_CURRENT_IN] = { + .m = 10742, ++ .b = 1552, + .R = -2, + }, + [PSC_CURRENT_IN_L] = { + .m = 5456, ++ .b = 2118, + .R = -2, + }, + [PSC_POWER] = { + .m = 1204, ++ .b = 8524, + .R = -3, + }, + [PSC_POWER_L] = { + .m = 612, ++ .b = 11202, + .R = -3, + }, + [PSC_TEMPERATURE] = { +@@ -184,26 +201,32 @@ static struct __coeff lm25066_coeff[6][PSC_NUM_CLASSES + 2] = { + [lm5066] = { + [PSC_VOLTAGE_IN] = { + .m = 4587, ++ .b = -1200, + .R = -2, + }, + [PSC_VOLTAGE_OUT] = { + .m = 4587, ++ .b = -2400, + .R = -2, + }, + [PSC_CURRENT_IN] = { + .m = 10753, ++ .b = -1200, + .R = -2, + }, + [PSC_CURRENT_IN_L] = { + .m = 5405, ++ .b = -600, + .R = -2, + }, + [PSC_POWER] = { + .m = 1204, ++ .b = -6000, + .R = -3, + }, + [PSC_POWER_L] = { + .m = 605, ++ .b = -8000, + .R = -3, + }, + [PSC_TEMPERATURE] = { +diff --git a/drivers/i2c/busses/i2c-xlr.c b/drivers/i2c/busses/i2c-xlr.c +index 484bfa15d58ee..dc9e20941efd1 100644 +--- a/drivers/i2c/busses/i2c-xlr.c ++++ b/drivers/i2c/busses/i2c-xlr.c +@@ -434,11 +434,15 @@ static int xlr_i2c_probe(struct platform_device *pdev) + i2c_set_adapdata(&priv->adap, priv); + ret = i2c_add_numbered_adapter(&priv->adap); + if (ret < 0) +- return ret; ++ goto err_unprepare_clk; + + platform_set_drvdata(pdev, priv); + dev_info(&priv->adap.dev, "Added I2C Bus.\n"); + return 0; ++ ++err_unprepare_clk: ++ clk_unprepare(clk); ++ return ret; + } + + static int xlr_i2c_remove(struct platform_device *pdev) +diff --git a/drivers/iio/dac/ad5446.c b/drivers/iio/dac/ad5446.c +index b555552a0d803..d3a3d62869d83 100644 +--- a/drivers/iio/dac/ad5446.c ++++ b/drivers/iio/dac/ad5446.c +@@ -510,8 +510,15 @@ static int ad5622_write(struct ad5446_state *st, unsigned val) + { + struct i2c_client *client = to_i2c_client(st->dev); + __be16 data = cpu_to_be16(val); ++ int ret; ++ ++ ret = i2c_master_send(client, (char *)&data, sizeof(data)); ++ if (ret < 0) ++ return ret; ++ if (ret != sizeof(data)) ++ return -EIO; + +- return i2c_master_send(client, (char *)&data, sizeof(data)); ++ return 0; + } + + /** +diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c +index df1ecd29057f8..8862eb9a6fe43 100644 +--- a/drivers/infiniband/hw/mlx4/qp.c ++++ b/drivers/infiniband/hw/mlx4/qp.c +@@ -1144,8 +1144,10 @@ static int create_qp_common(struct mlx4_ib_dev *dev, struct ib_pd *pd, + if (dev->steering_support == + MLX4_STEERING_MODE_DEVICE_MANAGED) + qp->flags |= MLX4_IB_QP_NETIF; +- else ++ else { ++ err = -EINVAL; + goto err; ++ } + } + + memcpy(&backup_cap, &init_attr->cap, sizeof(backup_cap)); +diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c +index 6ae72accae3db..990e652cb4ca2 100644 +--- a/drivers/infiniband/hw/qedr/verbs.c ++++ b/drivers/infiniband/hw/qedr/verbs.c +@@ -2045,15 +2045,18 @@ int qedr_query_qp(struct ib_qp *ibqp, + int rc = 0; + + memset(¶ms, 0, sizeof(params)); +- +- rc = dev->ops->rdma_query_qp(dev->rdma_ctx, qp->qed_qp, ¶ms); +- if (rc) +- goto err; +- + memset(qp_attr, 0, sizeof(*qp_attr)); + memset(qp_init_attr, 0, sizeof(*qp_init_attr)); + +- qp_attr->qp_state = qedr_get_ibqp_state(params.state); ++ if (qp->qp_type != IB_QPT_GSI) { ++ rc = dev->ops->rdma_query_qp(dev->rdma_ctx, qp->qed_qp, ¶ms); ++ if (rc) ++ goto err; ++ qp_attr->qp_state = qedr_get_ibqp_state(params.state); ++ } else { ++ qp_attr->qp_state = qedr_get_ibqp_state(QED_ROCE_QP_STATE_RTS); ++ } ++ + qp_attr->cur_qp_state = qedr_get_ibqp_state(params.state); + qp_attr->path_mtu = ib_mtu_int_to_enum(params.mtu); + qp_attr->path_mig_state = IB_MIG_MIGRATED; +diff --git a/drivers/infiniband/sw/rxe/rxe_param.h b/drivers/infiniband/sw/rxe/rxe_param.h +index 1b596fbbe2516..77ac3fa756c25 100644 +--- a/drivers/infiniband/sw/rxe/rxe_param.h ++++ b/drivers/infiniband/sw/rxe/rxe_param.h +@@ -143,7 +143,7 @@ enum rxe_port_param { + RXE_PORT_MAX_MTU = IB_MTU_4096, + RXE_PORT_ACTIVE_MTU = IB_MTU_256, + RXE_PORT_GID_TBL_LEN = 1024, +- RXE_PORT_PORT_CAP_FLAGS = RDMA_CORE_CAP_PROT_ROCE_UDP_ENCAP, ++ RXE_PORT_PORT_CAP_FLAGS = IB_PORT_CM_SUP, + RXE_PORT_MAX_MSG_SZ = 0x800000, + RXE_PORT_BAD_PKEY_CNTR = 0, + RXE_PORT_QKEY_VIOL_CNTR = 0, +diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c +index ab4888d043f0c..b27a91fee7f76 100644 +--- a/drivers/input/mouse/elantech.c ++++ b/drivers/input/mouse/elantech.c +@@ -431,6 +431,19 @@ static void elantech_report_trackpoint(struct psmouse *psmouse, + case 0x16008020U: + case 0x26800010U: + case 0x36808000U: ++ ++ /* ++ * This firmware misreport coordinates for trackpoint ++ * occasionally. Discard packets outside of [-127, 127] range ++ * to prevent cursor jumps. ++ */ ++ if (packet[4] == 0x80 || packet[5] == 0x80 || ++ packet[1] >> 7 == packet[4] >> 7 || ++ packet[2] >> 7 == packet[5] >> 7) { ++ elantech_debug("discarding packet [%6ph]\n", packet); ++ break; ++ ++ } + x = packet[4] - (int)((packet[1]^0x80) << 1); + y = (int)((packet[2]^0x80) << 1) - packet[5]; + +diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h +index f20e54f41dde9..c218e107c0c8f 100644 +--- a/drivers/input/serio/i8042-x86ia64io.h ++++ b/drivers/input/serio/i8042-x86ia64io.h +@@ -276,6 +276,13 @@ static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "LifeBook S6230"), + }, + }, ++ { ++ /* Fujitsu Lifebook T725 laptop */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK T725"), ++ }, ++ }, + { + /* Fujitsu Lifebook U745 */ + .matches = { +@@ -844,6 +851,13 @@ static const struct dmi_system_id __initconst i8042_dmi_notimeout_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK AH544"), + }, + }, ++ { ++ /* Fujitsu Lifebook T725 laptop */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK T725"), ++ }, ++ }, + { + /* Fujitsu U574 laptop */ + /* https://bugzilla.kernel.org/show_bug.cgi?id=69731 */ +diff --git a/drivers/irqchip/irq-bcm6345-l1.c b/drivers/irqchip/irq-bcm6345-l1.c +index 43f8abe40878a..31ea6332ecb83 100644 +--- a/drivers/irqchip/irq-bcm6345-l1.c ++++ b/drivers/irqchip/irq-bcm6345-l1.c +@@ -143,7 +143,7 @@ static void bcm6345_l1_irq_handle(struct irq_desc *desc) + for_each_set_bit(hwirq, &pending, IRQS_PER_WORD) { + irq = irq_linear_revmap(intc->domain, base + hwirq); + if (irq) +- do_IRQ(irq); ++ generic_handle_irq(irq); + else + spurious_interrupt(); + } +diff --git a/drivers/irqchip/irq-s3c24xx.c b/drivers/irqchip/irq-s3c24xx.c +index c25ce5af091ad..e92ab62cc87d9 100644 +--- a/drivers/irqchip/irq-s3c24xx.c ++++ b/drivers/irqchip/irq-s3c24xx.c +@@ -368,11 +368,25 @@ static inline int s3c24xx_handle_intc(struct s3c_irq_intc *intc, + asmlinkage void __exception_irq_entry s3c24xx_handle_irq(struct pt_regs *regs) + { + do { +- if (likely(s3c_intc[0])) +- if (s3c24xx_handle_intc(s3c_intc[0], regs, 0)) +- continue; ++ /* ++ * For platform based machines, neither ERR nor NULL can happen here. ++ * The s3c24xx_handle_irq() will be set as IRQ handler iff this succeeds: ++ * ++ * s3c_intc[0] = s3c24xx_init_intc() ++ * ++ * If this fails, the next calls to s3c24xx_init_intc() won't be executed. ++ * ++ * For DT machine, s3c_init_intc_of() could set the IRQ handler without ++ * setting s3c_intc[0] only if it was called with num_ctrl=0. There is no ++ * such code path, so again the s3c_intc[0] will have a valid pointer if ++ * set_handle_irq() is called. ++ * ++ * Therefore in s3c24xx_handle_irq(), the s3c_intc[0] is always something. ++ */ ++ if (s3c24xx_handle_intc(s3c_intc[0], regs, 0)) ++ continue; + +- if (s3c_intc[2]) ++ if (!IS_ERR_OR_NULL(s3c_intc[2])) + if (s3c24xx_handle_intc(s3c_intc[2], regs, 64)) + continue; + +diff --git a/drivers/media/i2c/mt9p031.c b/drivers/media/i2c/mt9p031.c +index 91d822fc4443a..8e6ad6a6e68cb 100644 +--- a/drivers/media/i2c/mt9p031.c ++++ b/drivers/media/i2c/mt9p031.c +@@ -81,7 +81,9 @@ + #define MT9P031_PIXEL_CLOCK_INVERT (1 << 15) + #define MT9P031_PIXEL_CLOCK_SHIFT(n) ((n) << 8) + #define MT9P031_PIXEL_CLOCK_DIVIDE(n) ((n) << 0) +-#define MT9P031_FRAME_RESTART 0x0b ++#define MT9P031_RESTART 0x0b ++#define MT9P031_FRAME_PAUSE_RESTART (1 << 1) ++#define MT9P031_FRAME_RESTART (1 << 0) + #define MT9P031_SHUTTER_DELAY 0x0c + #define MT9P031_RST 0x0d + #define MT9P031_RST_ENABLE 1 +@@ -448,9 +450,23 @@ static int mt9p031_set_params(struct mt9p031 *mt9p031) + static int mt9p031_s_stream(struct v4l2_subdev *subdev, int enable) + { + struct mt9p031 *mt9p031 = to_mt9p031(subdev); ++ struct i2c_client *client = v4l2_get_subdevdata(subdev); ++ int val; + int ret; + + if (!enable) { ++ /* enable pause restart */ ++ val = MT9P031_FRAME_PAUSE_RESTART; ++ ret = mt9p031_write(client, MT9P031_RESTART, val); ++ if (ret < 0) ++ return ret; ++ ++ /* enable restart + keep pause restart set */ ++ val |= MT9P031_FRAME_RESTART; ++ ret = mt9p031_write(client, MT9P031_RESTART, val); ++ if (ret < 0) ++ return ret; ++ + /* Stop sensor readout */ + ret = mt9p031_set_output_control(mt9p031, + MT9P031_OUTPUT_CONTROL_CEN, 0); +@@ -470,6 +486,16 @@ static int mt9p031_s_stream(struct v4l2_subdev *subdev, int enable) + if (ret < 0) + return ret; + ++ /* ++ * - clear pause restart ++ * - don't clear restart as clearing restart manually can cause ++ * undefined behavior ++ */ ++ val = MT9P031_FRAME_RESTART; ++ ret = mt9p031_write(client, MT9P031_RESTART, val); ++ if (ret < 0) ++ return ret; ++ + return mt9p031_pll_enable(mt9p031); + } + +diff --git a/drivers/media/pci/cx23885/cx23885-alsa.c b/drivers/media/pci/cx23885/cx23885-alsa.c +index d8c3637e492e3..a7f34af6c65b0 100644 +--- a/drivers/media/pci/cx23885/cx23885-alsa.c ++++ b/drivers/media/pci/cx23885/cx23885-alsa.c +@@ -560,7 +560,7 @@ struct cx23885_audio_dev *cx23885_audio_register(struct cx23885_dev *dev) + SNDRV_DEFAULT_IDX1, SNDRV_DEFAULT_STR1, + THIS_MODULE, sizeof(struct cx23885_audio_dev), &card); + if (err < 0) +- goto error; ++ goto error_msg; + + chip = (struct cx23885_audio_dev *) card->private_data; + chip->dev = dev; +@@ -586,6 +586,7 @@ struct cx23885_audio_dev *cx23885_audio_register(struct cx23885_dev *dev) + + error: + snd_card_free(card); ++error_msg: + pr_err("%s(): Failed to register analog audio adapter\n", + __func__); + +diff --git a/drivers/media/pci/netup_unidvb/netup_unidvb_core.c b/drivers/media/pci/netup_unidvb/netup_unidvb_core.c +index 60e6cd5b3a032..03239fba87bf2 100644 +--- a/drivers/media/pci/netup_unidvb/netup_unidvb_core.c ++++ b/drivers/media/pci/netup_unidvb/netup_unidvb_core.c +@@ -267,19 +267,24 @@ static irqreturn_t netup_unidvb_isr(int irq, void *dev_id) + if ((reg40 & AVL_IRQ_ASSERTED) != 0) { + /* IRQ is being signaled */ + reg_isr = readw(ndev->bmmio0 + REG_ISR); +- if (reg_isr & NETUP_UNIDVB_IRQ_I2C0) { +- iret = netup_i2c_interrupt(&ndev->i2c[0]); +- } else if (reg_isr & NETUP_UNIDVB_IRQ_I2C1) { +- iret = netup_i2c_interrupt(&ndev->i2c[1]); +- } else if (reg_isr & NETUP_UNIDVB_IRQ_SPI) { ++ if (reg_isr & NETUP_UNIDVB_IRQ_SPI) + iret = netup_spi_interrupt(ndev->spi); +- } else if (reg_isr & NETUP_UNIDVB_IRQ_DMA1) { +- iret = netup_dma_interrupt(&ndev->dma[0]); +- } else if (reg_isr & NETUP_UNIDVB_IRQ_DMA2) { +- iret = netup_dma_interrupt(&ndev->dma[1]); +- } else if (reg_isr & NETUP_UNIDVB_IRQ_CI) { +- iret = netup_ci_interrupt(ndev); ++ else if (!ndev->old_fw) { ++ if (reg_isr & NETUP_UNIDVB_IRQ_I2C0) { ++ iret = netup_i2c_interrupt(&ndev->i2c[0]); ++ } else if (reg_isr & NETUP_UNIDVB_IRQ_I2C1) { ++ iret = netup_i2c_interrupt(&ndev->i2c[1]); ++ } else if (reg_isr & NETUP_UNIDVB_IRQ_DMA1) { ++ iret = netup_dma_interrupt(&ndev->dma[0]); ++ } else if (reg_isr & NETUP_UNIDVB_IRQ_DMA2) { ++ iret = netup_dma_interrupt(&ndev->dma[1]); ++ } else if (reg_isr & NETUP_UNIDVB_IRQ_CI) { ++ iret = netup_ci_interrupt(ndev); ++ } else { ++ goto err; ++ } + } else { ++err: + dev_err(&pci_dev->dev, + "%s(): unknown interrupt 0x%x\n", + __func__, reg_isr); +diff --git a/drivers/media/platform/mtk-vpu/mtk_vpu.c b/drivers/media/platform/mtk-vpu/mtk_vpu.c +index 853d598937f69..019a5e7e1a402 100644 +--- a/drivers/media/platform/mtk-vpu/mtk_vpu.c ++++ b/drivers/media/platform/mtk-vpu/mtk_vpu.c +@@ -817,7 +817,8 @@ static int mtk_vpu_probe(struct platform_device *pdev) + vpu->wdt.wq = create_singlethread_workqueue("vpu_wdt"); + if (!vpu->wdt.wq) { + dev_err(dev, "initialize wdt workqueue failed\n"); +- return -ENOMEM; ++ ret = -ENOMEM; ++ goto clk_unprepare; + } + INIT_WORK(&vpu->wdt.ws, vpu_wdt_reset_func); + mutex_init(&vpu->vpu_mutex); +@@ -916,6 +917,8 @@ disable_vpu_clk: + vpu_clock_disable(vpu); + workqueue_destroy: + destroy_workqueue(vpu->wdt.wq); ++clk_unprepare: ++ clk_unprepare(vpu->clk); + + return ret; + } +diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc.c b/drivers/media/platform/s5p-mfc/s5p_mfc.c +index 9942932ecbf9c..75be40608bae8 100644 +--- a/drivers/media/platform/s5p-mfc/s5p_mfc.c ++++ b/drivers/media/platform/s5p-mfc/s5p_mfc.c +@@ -1280,11 +1280,15 @@ static int s5p_mfc_probe(struct platform_device *pdev) + spin_lock_init(&dev->condlock); + dev->plat_dev = pdev; + if (!dev->plat_dev) { +- dev_err(&pdev->dev, "No platform data specified\n"); ++ mfc_err("No platform data specified\n"); + return -ENODEV; + } + + dev->variant = of_device_get_match_data(&pdev->dev); ++ if (!dev->variant) { ++ dev_err(&pdev->dev, "Failed to get device MFC hardware variant information\n"); ++ return -ENOENT; ++ } + + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); + dev->regs_base = devm_ioremap_resource(&pdev->dev, res); +diff --git a/drivers/media/radio/si470x/radio-si470x-i2c.c b/drivers/media/radio/si470x/radio-si470x-i2c.c +index 5275356143429..7e7fa23e17961 100644 +--- a/drivers/media/radio/si470x/radio-si470x-i2c.c ++++ b/drivers/media/radio/si470x/radio-si470x-i2c.c +@@ -20,7 +20,7 @@ + + /* driver definitions */ + #define DRIVER_AUTHOR "Joonyoung Shim <jy0922.shim@samsung.com>"; +-#define DRIVER_CARD "Silicon Labs Si470x FM Radio Receiver" ++#define DRIVER_CARD "Silicon Labs Si470x FM Radio" + #define DRIVER_DESC "I2C radio driver for Si470x FM Radio Receivers" + #define DRIVER_VERSION "1.0.2" + +diff --git a/drivers/media/radio/si470x/radio-si470x-usb.c b/drivers/media/radio/si470x/radio-si470x-usb.c +index aec528f52ca12..95581a8476191 100644 +--- a/drivers/media/radio/si470x/radio-si470x-usb.c ++++ b/drivers/media/radio/si470x/radio-si470x-usb.c +@@ -25,7 +25,7 @@ + + /* driver definitions */ + #define DRIVER_AUTHOR "Tobias Lorenz <tobias.lorenz@gmx.net>" +-#define DRIVER_CARD "Silicon Labs Si470x FM Radio Receiver" ++#define DRIVER_CARD "Silicon Labs Si470x FM Radio" + #define DRIVER_DESC "USB radio driver for Si470x FM Radio Receivers" + #define DRIVER_VERSION "1.0.10" + +diff --git a/drivers/media/rc/ite-cir.c b/drivers/media/rc/ite-cir.c +index c7eea16225e7b..7bc38e805acb2 100644 +--- a/drivers/media/rc/ite-cir.c ++++ b/drivers/media/rc/ite-cir.c +@@ -292,7 +292,7 @@ static irqreturn_t ite_cir_isr(int irq, void *data) + } + + /* check for the receive interrupt */ +- if (iflags & ITE_IRQ_RX_FIFO) { ++ if (iflags & (ITE_IRQ_RX_FIFO | ITE_IRQ_RX_FIFO_OVERRUN)) { + /* read the FIFO bytes */ + rx_bytes = + dev->params.get_rx_bytes(dev, rx_buf, +diff --git a/drivers/media/rc/mceusb.c b/drivers/media/rc/mceusb.c +index bbbbfd697f9c4..035b2455b26aa 100644 +--- a/drivers/media/rc/mceusb.c ++++ b/drivers/media/rc/mceusb.c +@@ -1080,6 +1080,7 @@ static void mceusb_dev_recv(struct urb *urb) + case -ECONNRESET: + case -ENOENT: + case -EILSEQ: ++ case -EPROTO: + case -ESHUTDOWN: + usb_unlink_urb(urb); + return; +diff --git a/drivers/media/usb/dvb-usb/az6027.c b/drivers/media/usb/dvb-usb/az6027.c +index 2e711362847e4..382c8075ef524 100644 +--- a/drivers/media/usb/dvb-usb/az6027.c ++++ b/drivers/media/usb/dvb-usb/az6027.c +@@ -394,6 +394,7 @@ static struct rc_map_table rc_map_az6027_table[] = { + /* remote control stuff (does not work with my box) */ + static int az6027_rc_query(struct dvb_usb_device *d, u32 *event, int *state) + { ++ *state = REMOTE_NO_KEY_PRESSED; + return 0; + } + +diff --git a/drivers/media/usb/dvb-usb/dibusb-common.c b/drivers/media/usb/dvb-usb/dibusb-common.c +index bcacb0f220282..3e45642ae186b 100644 +--- a/drivers/media/usb/dvb-usb/dibusb-common.c ++++ b/drivers/media/usb/dvb-usb/dibusb-common.c +@@ -226,7 +226,7 @@ int dibusb_read_eeprom_byte(struct dvb_usb_device *d, u8 offs, u8 *val) + u8 *buf; + int rc; + +- buf = kmalloc(2, GFP_KERNEL); ++ buf = kzalloc(2, GFP_KERNEL); + if (!buf) + return -ENOMEM; + +diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c +index fae811b9cde96..2b0ca32d71965 100644 +--- a/drivers/media/usb/uvc/uvc_v4l2.c ++++ b/drivers/media/usb/uvc/uvc_v4l2.c +@@ -446,10 +446,13 @@ static int uvc_v4l2_set_streamparm(struct uvc_streaming *stream, + uvc_simplify_fraction(&timeperframe.numerator, + &timeperframe.denominator, 8, 333); + +- if (parm->type == V4L2_BUF_TYPE_VIDEO_CAPTURE) ++ if (parm->type == V4L2_BUF_TYPE_VIDEO_CAPTURE) { + parm->parm.capture.timeperframe = timeperframe; +- else ++ parm->parm.capture.capability = V4L2_CAP_TIMEPERFRAME; ++ } else { + parm->parm.output.timeperframe = timeperframe; ++ parm->parm.output.capability = V4L2_CAP_TIMEPERFRAME; ++ } + + return 0; + } +diff --git a/drivers/memory/fsl_ifc.c b/drivers/memory/fsl_ifc.c +index 38b945eb410f3..9c0e70b047c39 100644 +--- a/drivers/memory/fsl_ifc.c ++++ b/drivers/memory/fsl_ifc.c +@@ -276,7 +276,7 @@ static int fsl_ifc_ctrl_probe(struct platform_device *dev) + + ret = fsl_ifc_ctrl_init(fsl_ifc_ctrl_dev); + if (ret < 0) +- goto err; ++ goto err_unmap_nandirq; + + init_waitqueue_head(&fsl_ifc_ctrl_dev->nand_wait); + +@@ -285,7 +285,7 @@ static int fsl_ifc_ctrl_probe(struct platform_device *dev) + if (ret != 0) { + dev_err(&dev->dev, "failed to install irq (%d)\n", + fsl_ifc_ctrl_dev->irq); +- goto err_irq; ++ goto err_unmap_nandirq; + } + + if (fsl_ifc_ctrl_dev->nand_irq) { +@@ -294,17 +294,16 @@ static int fsl_ifc_ctrl_probe(struct platform_device *dev) + if (ret != 0) { + dev_err(&dev->dev, "failed to install irq (%d)\n", + fsl_ifc_ctrl_dev->nand_irq); +- goto err_nandirq; ++ goto err_free_irq; + } + } + + return 0; + +-err_nandirq: +- free_irq(fsl_ifc_ctrl_dev->nand_irq, fsl_ifc_ctrl_dev); +- irq_dispose_mapping(fsl_ifc_ctrl_dev->nand_irq); +-err_irq: ++err_free_irq: + free_irq(fsl_ifc_ctrl_dev->irq, fsl_ifc_ctrl_dev); ++err_unmap_nandirq: ++ irq_dispose_mapping(fsl_ifc_ctrl_dev->nand_irq); + irq_dispose_mapping(fsl_ifc_ctrl_dev->irq); + err: + iounmap(fsl_ifc_ctrl_dev->gregs); +diff --git a/drivers/memstick/core/ms_block.c b/drivers/memstick/core/ms_block.c +index 22de7f5ed0323..ffe8757406713 100644 +--- a/drivers/memstick/core/ms_block.c ++++ b/drivers/memstick/core/ms_block.c +@@ -1730,7 +1730,7 @@ static int msb_init_card(struct memstick_dev *card) + msb->pages_in_block = boot_block->attr.block_size * 2; + msb->block_size = msb->page_size * msb->pages_in_block; + +- if (msb->page_size > PAGE_SIZE) { ++ if ((size_t)msb->page_size > PAGE_SIZE) { + /* this isn't supported by linux at all, anyway*/ + dbg("device page %d size isn't supported", msb->page_size); + return -EINVAL; +diff --git a/drivers/memstick/host/jmb38x_ms.c b/drivers/memstick/host/jmb38x_ms.c +index 08fa6400d2558..ba6cd576e9979 100644 +--- a/drivers/memstick/host/jmb38x_ms.c ++++ b/drivers/memstick/host/jmb38x_ms.c +@@ -905,7 +905,7 @@ static struct memstick_host *jmb38x_ms_alloc_host(struct jmb38x_ms *jm, int cnt) + + iounmap(host->addr); + err_out_free: +- kfree(msh); ++ memstick_free_host(msh); + return NULL; + } + +diff --git a/drivers/memstick/host/r592.c b/drivers/memstick/host/r592.c +index 2539984c1db1c..256634ec58b63 100644 +--- a/drivers/memstick/host/r592.c ++++ b/drivers/memstick/host/r592.c +@@ -841,15 +841,15 @@ static void r592_remove(struct pci_dev *pdev) + } + memstick_remove_host(dev->host); + ++ if (dev->dummy_dma_page) ++ dma_free_coherent(&pdev->dev, PAGE_SIZE, dev->dummy_dma_page, ++ dev->dummy_dma_page_physical_address); ++ + free_irq(dev->irq, dev); + iounmap(dev->mmio); + pci_release_regions(pdev); + pci_disable_device(pdev); + memstick_free_host(dev->host); +- +- if (dev->dummy_dma_page) +- dma_free_coherent(&pdev->dev, PAGE_SIZE, dev->dummy_dma_page, +- dev->dummy_dma_page_physical_address); + } + + #ifdef CONFIG_PM_SLEEP +diff --git a/drivers/mmc/host/Kconfig b/drivers/mmc/host/Kconfig +index 9ed786935a306..61c022db0e96b 100644 +--- a/drivers/mmc/host/Kconfig ++++ b/drivers/mmc/host/Kconfig +@@ -397,7 +397,7 @@ config MMC_OMAP_HS + + config MMC_WBSD + tristate "Winbond W83L51xD SD/MMC Card Interface support" +- depends on ISA_DMA_API ++ depends on ISA_DMA_API && !M68K + help + This selects the Winbond(R) W83L51xD Secure digital and + Multimedia card Interface. +diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c +index 44d317d71b4ce..6026b0b3ddcea 100644 +--- a/drivers/mmc/host/dw_mmc.c ++++ b/drivers/mmc/host/dw_mmc.c +@@ -2047,7 +2047,8 @@ static void dw_mci_tasklet_func(unsigned long priv) + * delayed. Allowing the transfer to take place + * avoids races and keeps things simple. + */ +- if (err != -ETIMEDOUT) { ++ if (err != -ETIMEDOUT && ++ host->dir_status == DW_MCI_RECV_STATUS) { + state = STATE_SENDING_DATA; + continue; + } +diff --git a/drivers/mmc/host/mxs-mmc.c b/drivers/mmc/host/mxs-mmc.c +index 7125687faf76a..d7601dc5e85dc 100644 +--- a/drivers/mmc/host/mxs-mmc.c ++++ b/drivers/mmc/host/mxs-mmc.c +@@ -579,6 +579,11 @@ static const struct of_device_id mxs_mmc_dt_ids[] = { + }; + MODULE_DEVICE_TABLE(of, mxs_mmc_dt_ids); + ++static void mxs_mmc_regulator_disable(void *regulator) ++{ ++ regulator_disable(regulator); ++} ++ + static int mxs_mmc_probe(struct platform_device *pdev) + { + const struct of_device_id *of_id = +@@ -622,6 +627,11 @@ static int mxs_mmc_probe(struct platform_device *pdev) + "Failed to enable vmmc regulator: %d\n", ret); + goto out_mmc_free; + } ++ ++ ret = devm_add_action_or_reset(&pdev->dev, mxs_mmc_regulator_disable, ++ reg_vmmc); ++ if (ret) ++ goto out_mmc_free; + } + + ssp->clk = devm_clk_get(&pdev->dev, NULL); +diff --git a/drivers/mtd/spi-nor/hisi-sfc.c b/drivers/mtd/spi-nor/hisi-sfc.c +index 9209d225e3152..e84a310dcc6cb 100644 +--- a/drivers/mtd/spi-nor/hisi-sfc.c ++++ b/drivers/mtd/spi-nor/hisi-sfc.c +@@ -485,7 +485,6 @@ static int hisi_spi_nor_remove(struct platform_device *pdev) + + hisi_spi_nor_unregister_all(host); + mutex_destroy(&host->lock); +- clk_disable_unprepare(host->clk); + return 0; + } + +diff --git a/drivers/net/bonding/bond_sysfs_slave.c b/drivers/net/bonding/bond_sysfs_slave.c +index 68bbac4715c35..1e1e77a40f182 100644 +--- a/drivers/net/bonding/bond_sysfs_slave.c ++++ b/drivers/net/bonding/bond_sysfs_slave.c +@@ -112,15 +112,15 @@ static ssize_t ad_partner_oper_port_state_show(struct slave *slave, char *buf) + } + static SLAVE_ATTR_RO(ad_partner_oper_port_state); + +-static const struct slave_attribute *slave_attrs[] = { +- &slave_attr_state, +- &slave_attr_mii_status, +- &slave_attr_link_failure_count, +- &slave_attr_perm_hwaddr, +- &slave_attr_queue_id, +- &slave_attr_ad_aggregator_id, +- &slave_attr_ad_actor_oper_port_state, +- &slave_attr_ad_partner_oper_port_state, ++static const struct attribute *slave_attrs[] = { ++ &slave_attr_state.attr, ++ &slave_attr_mii_status.attr, ++ &slave_attr_link_failure_count.attr, ++ &slave_attr_perm_hwaddr.attr, ++ &slave_attr_queue_id.attr, ++ &slave_attr_ad_aggregator_id.attr, ++ &slave_attr_ad_actor_oper_port_state.attr, ++ &slave_attr_ad_partner_oper_port_state.attr, + NULL + }; + +@@ -141,24 +141,10 @@ const struct sysfs_ops slave_sysfs_ops = { + + int bond_sysfs_slave_add(struct slave *slave) + { +- const struct slave_attribute **a; +- int err; +- +- for (a = slave_attrs; *a; ++a) { +- err = sysfs_create_file(&slave->kobj, &((*a)->attr)); +- if (err) { +- kobject_put(&slave->kobj); +- return err; +- } +- } +- +- return 0; ++ return sysfs_create_files(&slave->kobj, slave_attrs); + } + + void bond_sysfs_slave_del(struct slave *slave) + { +- const struct slave_attribute **a; +- +- for (a = slave_attrs; *a; ++a) +- sysfs_remove_file(&slave->kobj, &((*a)->attr)); ++ sysfs_remove_files(&slave->kobj, slave_attrs); + } +diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-common.h b/drivers/net/ethernet/amd/xgbe/xgbe-common.h +index b2cd3bdba9f89..533b8519ec352 100644 +--- a/drivers/net/ethernet/amd/xgbe/xgbe-common.h ++++ b/drivers/net/ethernet/amd/xgbe/xgbe-common.h +@@ -1331,6 +1331,10 @@ + #define MDIO_VEND2_PMA_CDR_CONTROL 0x8056 + #endif + ++#ifndef MDIO_VEND2_PMA_MISC_CTRL0 ++#define MDIO_VEND2_PMA_MISC_CTRL0 0x8090 ++#endif ++ + #ifndef MDIO_CTRL1_SPEED1G + #define MDIO_CTRL1_SPEED1G (MDIO_CTRL1_SPEED10G & ~BMCR_SPEED100) + #endif +@@ -1389,6 +1393,10 @@ + #define XGBE_PMA_RX_RST_0_RESET_ON 0x10 + #define XGBE_PMA_RX_RST_0_RESET_OFF 0x00 + ++#define XGBE_PMA_PLL_CTRL_MASK BIT(15) ++#define XGBE_PMA_PLL_CTRL_ENABLE BIT(15) ++#define XGBE_PMA_PLL_CTRL_DISABLE 0x0000 ++ + /* Bit setting and getting macros + * The get macro will extract the current bit field value from within + * the variable +diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c b/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c +index bb6f0dcea6eab..4a4370a470fd1 100644 +--- a/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c ++++ b/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c +@@ -1803,12 +1803,26 @@ static void xgbe_phy_rx_reset(struct xgbe_prv_data *pdata) + } + } + ++static void xgbe_phy_pll_ctrl(struct xgbe_prv_data *pdata, bool enable) ++{ ++ XMDIO_WRITE_BITS(pdata, MDIO_MMD_PMAPMD, MDIO_VEND2_PMA_MISC_CTRL0, ++ XGBE_PMA_PLL_CTRL_MASK, ++ enable ? XGBE_PMA_PLL_CTRL_ENABLE ++ : XGBE_PMA_PLL_CTRL_DISABLE); ++ ++ /* Wait for command to complete */ ++ usleep_range(100, 200); ++} ++ + static void xgbe_phy_perform_ratechange(struct xgbe_prv_data *pdata, + unsigned int cmd, unsigned int sub_cmd) + { + unsigned int s0 = 0; + unsigned int wait; + ++ /* Disable PLL re-initialization during FW command processing */ ++ xgbe_phy_pll_ctrl(pdata, false); ++ + /* Log if a previous command did not complete */ + if (XP_IOREAD_BITS(pdata, XP_DRIVER_INT_RO, STATUS)) { + netif_dbg(pdata, link, pdata->netdev, +@@ -1829,7 +1843,7 @@ static void xgbe_phy_perform_ratechange(struct xgbe_prv_data *pdata, + wait = XGBE_RATECHANGE_COUNT; + while (wait--) { + if (!XP_IOREAD_BITS(pdata, XP_DRIVER_INT_RO, STATUS)) +- return; ++ goto reenable_pll; + + usleep_range(1000, 2000); + } +@@ -1839,6 +1853,10 @@ static void xgbe_phy_perform_ratechange(struct xgbe_prv_data *pdata, + + /* Reset on error */ + xgbe_phy_rx_reset(pdata); ++ ++reenable_pll: ++ /* Enable PLL re-initialization */ ++ xgbe_phy_pll_ctrl(pdata, true); + } + + static void xgbe_phy_rrc(struct xgbe_prv_data *pdata) +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_init_ops.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_init_ops.h +index 1835d2e451c01..fc7fce642666c 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_init_ops.h ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_init_ops.h +@@ -635,11 +635,13 @@ static int bnx2x_ilt_client_mem_op(struct bnx2x *bp, int cli_num, + { + int i, rc; + struct bnx2x_ilt *ilt = BP_ILT(bp); +- struct ilt_client_info *ilt_cli = &ilt->clients[cli_num]; ++ struct ilt_client_info *ilt_cli; + + if (!ilt || !ilt->lines) + return -1; + ++ ilt_cli = &ilt->clients[cli_num]; ++ + if (ilt_cli->flags & (ILT_CLIENT_SKIP_INIT | ILT_CLIENT_SKIP_MEM)) + return 0; + +diff --git a/drivers/net/ethernet/cavium/thunder/nic_main.c b/drivers/net/ethernet/cavium/thunder/nic_main.c +index 819f38a3225db..7f8ea16ad0d0a 100644 +--- a/drivers/net/ethernet/cavium/thunder/nic_main.c ++++ b/drivers/net/ethernet/cavium/thunder/nic_main.c +@@ -1128,7 +1128,7 @@ static int nic_register_interrupts(struct nicpf *nic) + dev_err(&nic->pdev->dev, + "Request for #%d msix vectors failed, returned %d\n", + nic->num_vec, ret); +- return 1; ++ return ret; + } + + /* Register mailbox interrupt handler */ +diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_main.c b/drivers/net/ethernet/cavium/thunder/nicvf_main.c +index 98734a37b6f64..df1c4ba7e0c97 100644 +--- a/drivers/net/ethernet/cavium/thunder/nicvf_main.c ++++ b/drivers/net/ethernet/cavium/thunder/nicvf_main.c +@@ -1152,7 +1152,7 @@ static int nicvf_register_misc_interrupt(struct nicvf *nic) + if (ret < 0) { + netdev_err(nic->netdev, + "Req for #%d msix vectors failed\n", nic->num_vec); +- return 1; ++ return ret; + } + + sprintf(nic->irq_name[irq], "%s Mbox", "NICVF"); +@@ -1171,7 +1171,7 @@ static int nicvf_register_misc_interrupt(struct nicvf *nic) + if (!nicvf_check_pf_ready(nic)) { + nicvf_disable_intr(nic, NICVF_INTR_MBOX, 0); + nicvf_unregister_interrupts(nic); +- return 1; ++ return -EIO; + } + + return 0; +diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c +index 76ab6c0d40cf5..4befc885efb8d 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -3835,6 +3835,9 @@ static int init_crq_queue(struct ibmvnic_adapter *adapter) + crq->cur = 0; + spin_lock_init(&crq->lock); + ++ /* process any CRQs that were queued before we enabled interrupts */ ++ tasklet_schedule(&adapter->tasklet); ++ + return retrc; + + req_irq_failed: +diff --git a/drivers/net/ethernet/intel/i40e/i40e.h b/drivers/net/ethernet/intel/i40e/i40e.h +index d0c1bf5441d84..438e2675bc132 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e.h ++++ b/drivers/net/ethernet/intel/i40e/i40e.h +@@ -163,6 +163,7 @@ enum i40e_vsi_state_t { + __I40E_VSI_OVERFLOW_PROMISC, + __I40E_VSI_REINIT_REQUESTED, + __I40E_VSI_DOWN_REQUESTED, ++ __I40E_VSI_RELEASING, + /* This must be last as it determines the size of the BITMAP */ + __I40E_VSI_STATE_SIZE__, + }; +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index 1555d32ddb962..44a9c8aa3067a 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -2415,7 +2415,8 @@ static void i40e_sync_filters_subtask(struct i40e_pf *pf) + + for (v = 0; v < pf->num_alloc_vsi; v++) { + if (pf->vsi[v] && +- (pf->vsi[v]->flags & I40E_VSI_FLAG_FILTER_CHANGED)) { ++ (pf->vsi[v]->flags & I40E_VSI_FLAG_FILTER_CHANGED) && ++ !test_bit(__I40E_VSI_RELEASING, pf->vsi[v]->state)) { + int ret = i40e_sync_vsi_filters(pf->vsi[v]); + + if (ret) { +@@ -10098,7 +10099,7 @@ int i40e_vsi_release(struct i40e_vsi *vsi) + dev_info(&pf->pdev->dev, "Can't remove PF VSI\n"); + return -ENODEV; + } +- ++ set_bit(__I40E_VSI_RELEASING, vsi->state); + uplink_seid = vsi->uplink_seid; + if (vsi->type != I40E_VSI_SRIOV) { + if (vsi->netdev_registered) { +diff --git a/drivers/net/ethernet/intel/i40evf/i40evf_main.c b/drivers/net/ethernet/intel/i40evf/i40evf_main.c +index ad2dd5b747b23..6bc772401cff2 100644 +--- a/drivers/net/ethernet/intel/i40evf/i40evf_main.c ++++ b/drivers/net/ethernet/intel/i40evf/i40evf_main.c +@@ -2027,7 +2027,7 @@ static void i40evf_adminq_task(struct work_struct *work) + + /* check for error indications */ + val = rd32(hw, hw->aq.arq.len); +- if (val == 0xdeadbeef) /* indicates device in reset */ ++ if (val == 0xdeadbeef || val == 0xffffffff) /* device in reset */ + goto freedom; + oldval = val; + if (val & I40E_VF_ARQLEN1_ARQVFE_MASK) { +diff --git a/drivers/net/ethernet/sfc/ptp.c b/drivers/net/ethernet/sfc/ptp.c +index f226907926977..c50c1892e88da 100644 +--- a/drivers/net/ethernet/sfc/ptp.c ++++ b/drivers/net/ethernet/sfc/ptp.c +@@ -494,7 +494,7 @@ static int efx_ptp_get_attributes(struct efx_nic *efx) + } else if (rc == -EINVAL) { + fmt = MC_CMD_PTP_OUT_GET_ATTRIBUTES_SECONDS_NANOSECONDS; + } else if (rc == -EPERM) { +- netif_info(efx, probe, efx->net_dev, "no PTP support\n"); ++ pci_info(efx->pci_dev, "no PTP support\n"); + return rc; + } else { + efx_mcdi_display_error(efx, MC_CMD_PTP, sizeof(inbuf), +@@ -613,7 +613,7 @@ static int efx_ptp_disable(struct efx_nic *efx) + * should only have been called during probe. + */ + if (rc == -ENOSYS || rc == -EPERM) +- netif_info(efx, probe, efx->net_dev, "no PTP support\n"); ++ pci_info(efx->pci_dev, "no PTP support\n"); + else if (rc) + efx_mcdi_display_error(efx, MC_CMD_PTP, + MC_CMD_PTP_IN_DISABLE_LEN, +diff --git a/drivers/net/ethernet/sfc/siena_sriov.c b/drivers/net/ethernet/sfc/siena_sriov.c +index da7b94f346049..30d58f72725df 100644 +--- a/drivers/net/ethernet/sfc/siena_sriov.c ++++ b/drivers/net/ethernet/sfc/siena_sriov.c +@@ -1059,7 +1059,7 @@ void efx_siena_sriov_probe(struct efx_nic *efx) + return; + + if (efx_siena_sriov_cmd(efx, false, &efx->vi_scale, &count)) { +- netif_info(efx, probe, efx->net_dev, "no SR-IOV VFs probed\n"); ++ pci_info(efx->pci_dev, "no SR-IOV VFs probed\n"); + return; + } + if (count > 0 && count > max_vfs) +diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c +index e1ee9da38df7e..da536385075aa 100644 +--- a/drivers/net/ethernet/ti/davinci_emac.c ++++ b/drivers/net/ethernet/ti/davinci_emac.c +@@ -426,8 +426,20 @@ static int emac_set_coalesce(struct net_device *ndev, + u32 int_ctrl, num_interrupts = 0; + u32 prescale = 0, addnl_dvdr = 1, coal_intvl = 0; + +- if (!coal->rx_coalesce_usecs) +- return -EINVAL; ++ if (!coal->rx_coalesce_usecs) { ++ priv->coal_intvl = 0; ++ ++ switch (priv->version) { ++ case EMAC_VERSION_2: ++ emac_ctrl_write(EMAC_DM646X_CMINTCTRL, 0); ++ break; ++ default: ++ emac_ctrl_write(EMAC_CTRL_EWINTTCNT, 0); ++ break; ++ } ++ ++ return 0; ++ } + + coal_intvl = coal->rx_coalesce_usecs; + +diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c +index ef5e5b621ec59..755aa67412923 100644 +--- a/drivers/net/phy/micrel.c ++++ b/drivers/net/phy/micrel.c +@@ -876,8 +876,9 @@ static struct phy_driver ksphy_driver[] = { + .get_sset_count = kszphy_get_sset_count, + .get_strings = kszphy_get_strings, + .get_stats = kszphy_get_stats, +- .suspend = genphy_suspend, +- .resume = genphy_resume, ++ /* No suspend/resume callbacks because of errata DS80000700A, ++ * receiver error following software power down. ++ */ + }, { + .phy_id = PHY_ID_KSZ8041RNLI, + .phy_id_mask = MICREL_PHY_ID_MASK, +diff --git a/drivers/net/phy/phylink.c b/drivers/net/phy/phylink.c +index 17acecfda5420..89d8efe8753e5 100644 +--- a/drivers/net/phy/phylink.c ++++ b/drivers/net/phy/phylink.c +@@ -1022,7 +1022,7 @@ int phylink_ethtool_set_pauseparam(struct phylink *pl, + return -EOPNOTSUPP; + + if (!phylink_test(pl->supported, Asym_Pause) && +- !pause->autoneg && pause->rx_pause != pause->tx_pause) ++ pause->rx_pause != pause->tx_pause) + return -EINVAL; + + config->pause &= ~(MLO_PAUSE_AN | MLO_PAUSE_TXRX_MASK); +diff --git a/drivers/net/tun.c b/drivers/net/tun.c +index 2bf58239bd4b4..b616961267d09 100644 +--- a/drivers/net/tun.c ++++ b/drivers/net/tun.c +@@ -858,6 +858,7 @@ static netdev_tx_t tun_net_xmit(struct sk_buff *skb, struct net_device *dev) + { + struct tun_struct *tun = netdev_priv(dev); + int txq = skb->queue_mapping; ++ struct netdev_queue *queue; + struct tun_file *tfile; + u32 numqueues = 0; + +@@ -916,6 +917,10 @@ static netdev_tx_t tun_net_xmit(struct sk_buff *skb, struct net_device *dev) + if (skb_array_produce(&tfile->tx_array, skb)) + goto drop; + ++ /* NETIF_F_LLTX requires to do our own update of trans_start */ ++ queue = netdev_get_tx_queue(dev, txq); ++ queue->trans_start = jiffies; ++ + /* Notify and wake up reader process */ + if (tfile->flags & TUN_FASYNC) + kill_fasync(&tfile->fasync, SIGIO, POLL_IN); +diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c +index 3628fd7e606fd..98fc34ea78ffe 100644 +--- a/drivers/net/vmxnet3/vmxnet3_drv.c ++++ b/drivers/net/vmxnet3/vmxnet3_drv.c +@@ -3623,7 +3623,6 @@ vmxnet3_suspend(struct device *device) + vmxnet3_free_intr_resources(adapter); + + netif_device_detach(netdev); +- netif_tx_stop_all_queues(netdev); + + /* Create wake-up filters. */ + pmConf = adapter->pm_conf; +diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c +index e42546bc99efb..41ae999c685b8 100644 +--- a/drivers/net/wireless/ath/ath10k/mac.c ++++ b/drivers/net/wireless/ath/ath10k/mac.c +@@ -990,7 +990,7 @@ static int ath10k_monitor_vdev_start(struct ath10k *ar, int vdev_id) + arg.channel.min_power = 0; + arg.channel.max_power = channel->max_power * 2; + arg.channel.max_reg_power = channel->max_reg_power * 2; +- arg.channel.max_antenna_gain = channel->max_antenna_gain * 2; ++ arg.channel.max_antenna_gain = channel->max_antenna_gain; + + reinit_completion(&ar->vdev_setup_done); + +@@ -1432,7 +1432,7 @@ static int ath10k_vdev_start_restart(struct ath10k_vif *arvif, + arg.channel.min_power = 0; + arg.channel.max_power = chandef->chan->max_power * 2; + arg.channel.max_reg_power = chandef->chan->max_reg_power * 2; +- arg.channel.max_antenna_gain = chandef->chan->max_antenna_gain * 2; ++ arg.channel.max_antenna_gain = chandef->chan->max_antenna_gain; + + if (arvif->vdev_type == WMI_VDEV_TYPE_AP) { + arg.ssid = arvif->u.ap.ssid; +@@ -3091,7 +3091,7 @@ static int ath10k_update_channel_list(struct ath10k *ar) + ch->min_power = 0; + ch->max_power = channel->max_power * 2; + ch->max_reg_power = channel->max_reg_power * 2; +- ch->max_antenna_gain = channel->max_antenna_gain * 2; ++ ch->max_antenna_gain = channel->max_antenna_gain; + ch->reg_class_id = 0; /* FIXME */ + + /* FIXME: why use only legacy modes, why not any +diff --git a/drivers/net/wireless/ath/ath10k/usb.c b/drivers/net/wireless/ath/ath10k/usb.c +index 16d5fe6d1e2e4..0a76991d0c6cd 100644 +--- a/drivers/net/wireless/ath/ath10k/usb.c ++++ b/drivers/net/wireless/ath/ath10k/usb.c +@@ -536,7 +536,7 @@ static int ath10k_usb_submit_ctrl_in(struct ath10k *ar, + req, + USB_DIR_IN | USB_TYPE_VENDOR | + USB_RECIP_DEVICE, value, index, buf, +- size, 2 * HZ); ++ size, 2000); + + if (ret < 0) { + ath10k_warn(ar, "Failed to read usb control message: %d\n", +@@ -875,6 +875,11 @@ static int ath10k_usb_setup_pipe_resources(struct ath10k *ar, + le16_to_cpu(endpoint->wMaxPacketSize), + endpoint->bInterval); + } ++ ++ /* Ignore broken descriptors. */ ++ if (usb_endpoint_maxp(endpoint) == 0) ++ continue; ++ + urbcount = 0; + + pipe_num = +diff --git a/drivers/net/wireless/ath/ath10k/wmi.h b/drivers/net/wireless/ath/ath10k/wmi.h +index 947b74c64fec0..621f5597a3693 100644 +--- a/drivers/net/wireless/ath/ath10k/wmi.h ++++ b/drivers/net/wireless/ath/ath10k/wmi.h +@@ -1945,7 +1945,9 @@ struct wmi_channel { + union { + __le32 reginfo1; + struct { ++ /* note: power unit is 1 dBm */ + u8 antenna_max; ++ /* note: power unit is 0.5 dBm */ + u8 max_tx_power; + } __packed; + } __packed; +@@ -1965,6 +1967,7 @@ struct wmi_channel_arg { + u32 min_power; + u32 max_power; + u32 max_reg_power; ++ /* note: power unit is 1 dBm */ + u32 max_antenna_gain; + u32 reg_class_id; + enum wmi_phy_mode mode; +diff --git a/drivers/net/wireless/ath/ath6kl/usb.c b/drivers/net/wireless/ath/ath6kl/usb.c +index 53b66e9434c99..8b24964304b1f 100644 +--- a/drivers/net/wireless/ath/ath6kl/usb.c ++++ b/drivers/net/wireless/ath/ath6kl/usb.c +@@ -340,6 +340,11 @@ static int ath6kl_usb_setup_pipe_resources(struct ath6kl_usb *ar_usb) + le16_to_cpu(endpoint->wMaxPacketSize), + endpoint->bInterval); + } ++ ++ /* Ignore broken descriptors. */ ++ if (usb_endpoint_maxp(endpoint) == 0) ++ continue; ++ + urbcount = 0; + + pipe_num = +@@ -907,7 +912,7 @@ static int ath6kl_usb_submit_ctrl_in(struct ath6kl_usb *ar_usb, + req, + USB_DIR_IN | USB_TYPE_VENDOR | + USB_RECIP_DEVICE, value, index, buf, +- size, 2 * HZ); ++ size, 2000); + + if (ret < 0) { + ath6kl_warn("Failed to read usb control message: %d\n", ret); +diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c +index 173960682ea06..507d8c5149686 100644 +--- a/drivers/net/wireless/ath/ath9k/main.c ++++ b/drivers/net/wireless/ath/ath9k/main.c +@@ -529,8 +529,10 @@ irqreturn_t ath_isr(int irq, void *dev) + ath9k_debug_sync_cause(sc, sync_cause); + status &= ah->imask; /* discard unasked-for bits */ + +- if (test_bit(ATH_OP_HW_RESET, &common->op_flags)) ++ if (test_bit(ATH_OP_HW_RESET, &common->op_flags)) { ++ ath9k_hw_kill_interrupts(sc->sc_ah); + return IRQ_HANDLED; ++ } + + /* + * If there are no status bits set, then this interrupt was not +diff --git a/drivers/net/wireless/ath/dfs_pattern_detector.c b/drivers/net/wireless/ath/dfs_pattern_detector.c +index 78146607f16e8..acd85e5069346 100644 +--- a/drivers/net/wireless/ath/dfs_pattern_detector.c ++++ b/drivers/net/wireless/ath/dfs_pattern_detector.c +@@ -182,10 +182,12 @@ static void channel_detector_exit(struct dfs_pattern_detector *dpd, + if (cd == NULL) + return; + list_del(&cd->head); +- for (i = 0; i < dpd->num_radar_types; i++) { +- struct pri_detector *de = cd->detectors[i]; +- if (de != NULL) +- de->exit(de); ++ if (cd->detectors) { ++ for (i = 0; i < dpd->num_radar_types; i++) { ++ struct pri_detector *de = cd->detectors[i]; ++ if (de != NULL) ++ de->exit(de); ++ } + } + kfree(cd->detectors); + kfree(cd); +diff --git a/drivers/net/wireless/ath/wcn36xx/main.c b/drivers/net/wireless/ath/wcn36xx/main.c +index 2450f5f7f79f3..0dae1627ac0df 100644 +--- a/drivers/net/wireless/ath/wcn36xx/main.c ++++ b/drivers/net/wireless/ath/wcn36xx/main.c +@@ -133,7 +133,9 @@ static struct ieee80211_supported_band wcn_band_2ghz = { + .cap = IEEE80211_HT_CAP_GRN_FLD | + IEEE80211_HT_CAP_SGI_20 | + IEEE80211_HT_CAP_DSSSCCK40 | +- IEEE80211_HT_CAP_LSIG_TXOP_PROT, ++ IEEE80211_HT_CAP_LSIG_TXOP_PROT | ++ IEEE80211_HT_CAP_SGI_40 | ++ IEEE80211_HT_CAP_SUP_WIDTH_20_40, + .ht_supported = true, + .ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K, + .ampdu_density = IEEE80211_HT_MPDU_DENSITY_16, +diff --git a/drivers/net/wireless/ath/wcn36xx/smd.c b/drivers/net/wireless/ath/wcn36xx/smd.c +index 9c6590d5348ad..c5b5fbcd2066c 100644 +--- a/drivers/net/wireless/ath/wcn36xx/smd.c ++++ b/drivers/net/wireless/ath/wcn36xx/smd.c +@@ -2082,30 +2082,52 @@ static int wcn36xx_smd_delete_sta_context_ind(struct wcn36xx *wcn, + size_t len) + { + struct wcn36xx_hal_delete_sta_context_ind_msg *rsp = buf; +- struct wcn36xx_vif *tmp; ++ struct wcn36xx_vif *vif_priv; ++ struct ieee80211_vif *vif; ++ struct ieee80211_bss_conf *bss_conf; + struct ieee80211_sta *sta; ++ bool found = false; + + if (len != sizeof(*rsp)) { + wcn36xx_warn("Corrupted delete sta indication\n"); + return -EIO; + } + +- wcn36xx_dbg(WCN36XX_DBG_HAL, "delete station indication %pM index %d\n", +- rsp->addr2, rsp->sta_id); ++ wcn36xx_dbg(WCN36XX_DBG_HAL, ++ "delete station indication %pM index %d reason %d\n", ++ rsp->addr2, rsp->sta_id, rsp->reason_code); + +- list_for_each_entry(tmp, &wcn->vif_list, list) { ++ list_for_each_entry(vif_priv, &wcn->vif_list, list) { + rcu_read_lock(); +- sta = ieee80211_find_sta(wcn36xx_priv_to_vif(tmp), rsp->addr2); +- if (sta) +- ieee80211_report_low_ack(sta, 0); ++ vif = wcn36xx_priv_to_vif(vif_priv); ++ ++ if (vif->type == NL80211_IFTYPE_STATION) { ++ /* We could call ieee80211_find_sta too, but checking ++ * bss_conf is clearer. ++ */ ++ bss_conf = &vif->bss_conf; ++ if (vif_priv->sta_assoc && ++ !memcmp(bss_conf->bssid, rsp->addr2, ETH_ALEN)) { ++ found = true; ++ wcn36xx_dbg(WCN36XX_DBG_HAL, ++ "connection loss bss_index %d\n", ++ vif_priv->bss_index); ++ ieee80211_connection_loss(vif); ++ } ++ } else { ++ sta = ieee80211_find_sta(vif, rsp->addr2); ++ if (sta) { ++ found = true; ++ ieee80211_report_low_ack(sta, 0); ++ } ++ } ++ + rcu_read_unlock(); +- if (sta) ++ if (found) + return 0; + } + +- wcn36xx_warn("STA with addr %pM and index %d not found\n", +- rsp->addr2, +- rsp->sta_id); ++ wcn36xx_warn("BSS or STA with addr %pM not found\n", rsp->addr2); + return -ENOENT; + } + +diff --git a/drivers/net/wireless/broadcom/b43/phy_g.c b/drivers/net/wireless/broadcom/b43/phy_g.c +index 822dcaa8ace63..35ff139b1496e 100644 +--- a/drivers/net/wireless/broadcom/b43/phy_g.c ++++ b/drivers/net/wireless/broadcom/b43/phy_g.c +@@ -2310,7 +2310,7 @@ static u8 b43_gphy_aci_scan(struct b43_wldev *dev) + b43_phy_mask(dev, B43_PHY_G_CRS, 0x7FFF); + b43_set_all_gains(dev, 3, 8, 1); + +- start = (channel - 5 > 0) ? channel - 5 : 1; ++ start = (channel > 5) ? channel - 5 : 1; + end = (channel + 5 < 14) ? channel + 5 : 13; + + for (i = start; i <= end; i++) { +diff --git a/drivers/net/wireless/broadcom/b43legacy/radio.c b/drivers/net/wireless/broadcom/b43legacy/radio.c +index 9501420340a91..5b1e8890305c1 100644 +--- a/drivers/net/wireless/broadcom/b43legacy/radio.c ++++ b/drivers/net/wireless/broadcom/b43legacy/radio.c +@@ -299,7 +299,7 @@ u8 b43legacy_radio_aci_scan(struct b43legacy_wldev *dev) + & 0x7FFF); + b43legacy_set_all_gains(dev, 3, 8, 1); + +- start = (channel - 5 > 0) ? channel - 5 : 1; ++ start = (channel > 5) ? channel - 5 : 1; + end = (channel + 5 < 14) ? channel + 5 : 13; + + for (i = start; i <= end; i++) { +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/utils.c b/drivers/net/wireless/intel/iwlwifi/mvm/utils.c +index d2cada0ab4264..3303fc85d76f5 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/utils.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/utils.c +@@ -1029,6 +1029,9 @@ bool iwl_mvm_rx_diversity_allowed(struct iwl_mvm *mvm) + + lockdep_assert_held(&mvm->mutex); + ++ if (iwlmvm_mod_params.power_scheme != IWL_POWER_SCHEME_CAM) ++ return false; ++ + if (num_of_ant(iwl_mvm_get_valid_rx_ant(mvm)) == 1) + return false; + +diff --git a/drivers/net/wireless/marvell/libertas/if_usb.c b/drivers/net/wireless/marvell/libertas/if_usb.c +index aad82ff568835..bbfc89d9d65ab 100644 +--- a/drivers/net/wireless/marvell/libertas/if_usb.c ++++ b/drivers/net/wireless/marvell/libertas/if_usb.c +@@ -288,6 +288,7 @@ err_add_card: + if_usb_reset_device(cardp); + dealloc: + if_usb_free(cardp); ++ kfree(cardp); + + error: + return r; +@@ -312,6 +313,7 @@ static void if_usb_disconnect(struct usb_interface *intf) + + /* Unlink and free urb */ + if_usb_free(cardp); ++ kfree(cardp); + + usb_set_intfdata(intf, NULL); + usb_put_dev(interface_to_usbdev(intf)); +diff --git a/drivers/net/wireless/marvell/libertas_tf/if_usb.c b/drivers/net/wireless/marvell/libertas_tf/if_usb.c +index cae95362efd5b..ddc5f0de09606 100644 +--- a/drivers/net/wireless/marvell/libertas_tf/if_usb.c ++++ b/drivers/net/wireless/marvell/libertas_tf/if_usb.c +@@ -234,6 +234,7 @@ static int if_usb_probe(struct usb_interface *intf, + + dealloc: + if_usb_free(cardp); ++ kfree(cardp); + error: + lbtf_deb_leave(LBTF_DEB_MAIN); + return -ENOMEM; +@@ -258,6 +259,7 @@ static void if_usb_disconnect(struct usb_interface *intf) + + /* Unlink and free urb */ + if_usb_free(cardp); ++ kfree(cardp); + + usb_set_intfdata(intf, NULL); + usb_put_dev(interface_to_usbdev(intf)); +diff --git a/drivers/net/wireless/marvell/mwifiex/11n.c b/drivers/net/wireless/marvell/mwifiex/11n.c +index 7252069149115..2844f937cc659 100644 +--- a/drivers/net/wireless/marvell/mwifiex/11n.c ++++ b/drivers/net/wireless/marvell/mwifiex/11n.c +@@ -632,14 +632,15 @@ int mwifiex_send_delba(struct mwifiex_private *priv, int tid, u8 *peer_mac, + uint16_t del_ba_param_set; + + memset(&delba, 0, sizeof(delba)); +- delba.del_ba_param_set = cpu_to_le16(tid << DELBA_TID_POS); + +- del_ba_param_set = le16_to_cpu(delba.del_ba_param_set); ++ del_ba_param_set = tid << DELBA_TID_POS; ++ + if (initiator) + del_ba_param_set |= IEEE80211_DELBA_PARAM_INITIATOR_MASK; + else + del_ba_param_set &= ~IEEE80211_DELBA_PARAM_INITIATOR_MASK; + ++ delba.del_ba_param_set = cpu_to_le16(del_ba_param_set); + memcpy(&delba.peer_mac_addr, peer_mac, ETH_ALEN); + + /* We don't wait for the response of this command */ +diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c +index 79c50aebffc4b..a88bddc383894 100644 +--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c ++++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c +@@ -898,16 +898,20 @@ mwifiex_init_new_priv_params(struct mwifiex_private *priv, + switch (type) { + case NL80211_IFTYPE_STATION: + case NL80211_IFTYPE_ADHOC: +- priv->bss_role = MWIFIEX_BSS_ROLE_STA; ++ priv->bss_role = MWIFIEX_BSS_ROLE_STA; ++ priv->bss_type = MWIFIEX_BSS_TYPE_STA; + break; + case NL80211_IFTYPE_P2P_CLIENT: +- priv->bss_role = MWIFIEX_BSS_ROLE_STA; ++ priv->bss_role = MWIFIEX_BSS_ROLE_STA; ++ priv->bss_type = MWIFIEX_BSS_TYPE_P2P; + break; + case NL80211_IFTYPE_P2P_GO: +- priv->bss_role = MWIFIEX_BSS_ROLE_UAP; ++ priv->bss_role = MWIFIEX_BSS_ROLE_UAP; ++ priv->bss_type = MWIFIEX_BSS_TYPE_P2P; + break; + case NL80211_IFTYPE_AP: + priv->bss_role = MWIFIEX_BSS_ROLE_UAP; ++ priv->bss_type = MWIFIEX_BSS_TYPE_UAP; + break; + default: + mwifiex_dbg(adapter, ERROR, +@@ -1217,29 +1221,15 @@ mwifiex_cfg80211_change_virtual_intf(struct wiphy *wiphy, + break; + case NL80211_IFTYPE_P2P_CLIENT: + case NL80211_IFTYPE_P2P_GO: ++ if (mwifiex_cfg80211_deinit_p2p(priv)) ++ return -EFAULT; ++ + switch (type) { +- case NL80211_IFTYPE_STATION: +- if (mwifiex_cfg80211_deinit_p2p(priv)) +- return -EFAULT; +- priv->adapter->curr_iface_comb.p2p_intf--; +- priv->adapter->curr_iface_comb.sta_intf++; +- dev->ieee80211_ptr->iftype = type; +- if (mwifiex_deinit_priv_params(priv)) +- return -1; +- if (mwifiex_init_new_priv_params(priv, dev, type)) +- return -1; +- if (mwifiex_sta_init_cmd(priv, false, false)) +- return -1; +- break; + case NL80211_IFTYPE_ADHOC: +- if (mwifiex_cfg80211_deinit_p2p(priv)) +- return -EFAULT; ++ case NL80211_IFTYPE_STATION: + return mwifiex_change_vif_to_sta_adhoc(dev, curr_iftype, + type, params); +- break; + case NL80211_IFTYPE_AP: +- if (mwifiex_cfg80211_deinit_p2p(priv)) +- return -EFAULT; + return mwifiex_change_vif_to_ap(dev, curr_iftype, type, + params); + case NL80211_IFTYPE_UNSPECIFIED: +diff --git a/drivers/net/wireless/marvell/mwifiex/pcie.c b/drivers/net/wireless/marvell/mwifiex/pcie.c +index 5b12d5191acc5..9fcd070f2463c 100644 +--- a/drivers/net/wireless/marvell/mwifiex/pcie.c ++++ b/drivers/net/wireless/marvell/mwifiex/pcie.c +@@ -1316,6 +1316,14 @@ mwifiex_pcie_send_data(struct mwifiex_adapter *adapter, struct sk_buff *skb, + ret = -1; + goto done_unmap; + } ++ ++ /* The firmware (latest version 15.68.19.p21) of the 88W8897 PCIe+USB card ++ * seems to crash randomly after setting the TX ring write pointer when ++ * ASPM powersaving is enabled. A workaround seems to be keeping the bus ++ * busy by reading a random register afterwards. ++ */ ++ mwifiex_read_reg(adapter, PCI_VENDOR_ID, &rx_val); ++ + if ((mwifiex_pcie_txbd_not_full(card)) && + tx_param->next_pkt_len) { + /* have more packets and TxBD still can hold more */ +diff --git a/drivers/net/wireless/marvell/mwifiex/usb.c b/drivers/net/wireless/marvell/mwifiex/usb.c +index 44d5005188c93..202ce83cb7948 100644 +--- a/drivers/net/wireless/marvell/mwifiex/usb.c ++++ b/drivers/net/wireless/marvell/mwifiex/usb.c +@@ -491,6 +491,22 @@ static int mwifiex_usb_probe(struct usb_interface *intf, + } + } + ++ switch (card->usb_boot_state) { ++ case USB8XXX_FW_DNLD: ++ /* Reject broken descriptors. */ ++ if (!card->rx_cmd_ep || !card->tx_cmd_ep) ++ return -ENODEV; ++ if (card->bulk_out_maxpktsize == 0) ++ return -ENODEV; ++ break; ++ case USB8XXX_FW_READY: ++ /* Assume the driver can handle missing endpoints for now. */ ++ break; ++ default: ++ WARN_ON(1); ++ return -ENODEV; ++ } ++ + usb_set_intfdata(intf, card); + + ret = mwifiex_add_card(card, &card->fw_done, &usb_ops, +diff --git a/drivers/net/wireless/marvell/mwl8k.c b/drivers/net/wireless/marvell/mwl8k.c +index e39aaee92addb..d5f766044221a 100644 +--- a/drivers/net/wireless/marvell/mwl8k.c ++++ b/drivers/net/wireless/marvell/mwl8k.c +@@ -5788,8 +5788,8 @@ static void mwl8k_fw_state_machine(const struct firmware *fw, void *context) + fail: + priv->fw_state = FW_STATE_ERROR; + complete(&priv->firmware_loading_complete); +- device_release_driver(&priv->pdev->dev); + mwl8k_release_firmware(priv); ++ device_release_driver(&priv->pdev->dev); + } + + #define MAX_RESTART_ATTEMPTS 1 +diff --git a/drivers/net/wireless/realtek/rtl818x/rtl8187/rtl8225.c b/drivers/net/wireless/realtek/rtl818x/rtl8187/rtl8225.c +index e6668ffb77e65..49fb8bba3d91a 100644 +--- a/drivers/net/wireless/realtek/rtl818x/rtl8187/rtl8225.c ++++ b/drivers/net/wireless/realtek/rtl818x/rtl8187/rtl8225.c +@@ -31,7 +31,7 @@ u8 rtl818x_ioread8_idx(struct rtl8187_priv *priv, + usb_control_msg(priv->udev, usb_rcvctrlpipe(priv->udev, 0), + RTL8187_REQ_GET_REG, RTL8187_REQT_READ, + (unsigned long)addr, idx & 0x03, +- &priv->io_dmabuf->bits8, sizeof(val), HZ / 2); ++ &priv->io_dmabuf->bits8, sizeof(val), 500); + + val = priv->io_dmabuf->bits8; + mutex_unlock(&priv->io_mutex); +@@ -48,7 +48,7 @@ u16 rtl818x_ioread16_idx(struct rtl8187_priv *priv, + usb_control_msg(priv->udev, usb_rcvctrlpipe(priv->udev, 0), + RTL8187_REQ_GET_REG, RTL8187_REQT_READ, + (unsigned long)addr, idx & 0x03, +- &priv->io_dmabuf->bits16, sizeof(val), HZ / 2); ++ &priv->io_dmabuf->bits16, sizeof(val), 500); + + val = priv->io_dmabuf->bits16; + mutex_unlock(&priv->io_mutex); +@@ -65,7 +65,7 @@ u32 rtl818x_ioread32_idx(struct rtl8187_priv *priv, + usb_control_msg(priv->udev, usb_rcvctrlpipe(priv->udev, 0), + RTL8187_REQ_GET_REG, RTL8187_REQT_READ, + (unsigned long)addr, idx & 0x03, +- &priv->io_dmabuf->bits32, sizeof(val), HZ / 2); ++ &priv->io_dmabuf->bits32, sizeof(val), 500); + + val = priv->io_dmabuf->bits32; + mutex_unlock(&priv->io_mutex); +@@ -82,7 +82,7 @@ void rtl818x_iowrite8_idx(struct rtl8187_priv *priv, + usb_control_msg(priv->udev, usb_sndctrlpipe(priv->udev, 0), + RTL8187_REQ_SET_REG, RTL8187_REQT_WRITE, + (unsigned long)addr, idx & 0x03, +- &priv->io_dmabuf->bits8, sizeof(val), HZ / 2); ++ &priv->io_dmabuf->bits8, sizeof(val), 500); + + mutex_unlock(&priv->io_mutex); + } +@@ -96,7 +96,7 @@ void rtl818x_iowrite16_idx(struct rtl8187_priv *priv, + usb_control_msg(priv->udev, usb_sndctrlpipe(priv->udev, 0), + RTL8187_REQ_SET_REG, RTL8187_REQT_WRITE, + (unsigned long)addr, idx & 0x03, +- &priv->io_dmabuf->bits16, sizeof(val), HZ / 2); ++ &priv->io_dmabuf->bits16, sizeof(val), 500); + + mutex_unlock(&priv->io_mutex); + } +@@ -110,7 +110,7 @@ void rtl818x_iowrite32_idx(struct rtl8187_priv *priv, + usb_control_msg(priv->udev, usb_sndctrlpipe(priv->udev, 0), + RTL8187_REQ_SET_REG, RTL8187_REQT_WRITE, + (unsigned long)addr, idx & 0x03, +- &priv->io_dmabuf->bits32, sizeof(val), HZ / 2); ++ &priv->io_dmabuf->bits32, sizeof(val), 500); + + mutex_unlock(&priv->io_mutex); + } +@@ -186,7 +186,7 @@ static void rtl8225_write_8051(struct ieee80211_hw *dev, u8 addr, __le16 data) + usb_control_msg(priv->udev, usb_sndctrlpipe(priv->udev, 0), + RTL8187_REQ_SET_REG, RTL8187_REQT_WRITE, + addr, 0x8225, &priv->io_dmabuf->bits16, sizeof(data), +- HZ / 2); ++ 500); + + mutex_unlock(&priv->io_mutex); + +diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c +index 1131397454bd4..89e6a50b53da5 100644 +--- a/drivers/net/xen-netfront.c ++++ b/drivers/net/xen-netfront.c +@@ -1441,6 +1441,10 @@ static int netfront_resume(struct xenbus_device *dev) + + dev_dbg(&dev->dev, "%s\n", dev->nodename); + ++ netif_tx_lock_bh(info->netdev); ++ netif_device_detach(info->netdev); ++ netif_tx_unlock_bh(info->netdev); ++ + xennet_disconnect_backend(info); + return 0; + } +@@ -1990,6 +1994,10 @@ static int xennet_connect(struct net_device *dev) + * domain a kick because we've probably just requeued some + * packets. + */ ++ netif_tx_lock_bh(np->netdev); ++ netif_device_attach(np->netdev); ++ netif_tx_unlock_bh(np->netdev); ++ + netif_carrier_on(np->netdev); + for (j = 0; j < num_queues; ++j) { + queue = &np->queues[j]; +diff --git a/drivers/nfc/pn533/pn533.c b/drivers/nfc/pn533/pn533.c +index e3026e20f1696..52a1a2cae6c74 100644 +--- a/drivers/nfc/pn533/pn533.c ++++ b/drivers/nfc/pn533/pn533.c +@@ -2084,7 +2084,7 @@ static int pn533_fill_fragment_skbs(struct pn533 *dev, struct sk_buff *skb) + frag = pn533_alloc_skb(dev, frag_size); + if (!frag) { + skb_queue_purge(&dev->fragment_skb); +- break; ++ return -ENOMEM; + } + + if (!dev->tgt_mode) { +@@ -2154,7 +2154,7 @@ static int pn533_transceive(struct nfc_dev *nfc_dev, + /* jumbo frame ? */ + if (skb->len > PN533_CMD_DATAEXCH_DATA_MAXLEN) { + rc = pn533_fill_fragment_skbs(dev, skb); +- if (rc <= 0) ++ if (rc < 0) + goto error; + + skb = skb_dequeue(&dev->fragment_skb); +@@ -2226,7 +2226,7 @@ static int pn533_tm_send(struct nfc_dev *nfc_dev, struct sk_buff *skb) + /* let's split in multiple chunks if size's too big */ + if (skb->len > PN533_CMD_DATAEXCH_DATA_MAXLEN) { + rc = pn533_fill_fragment_skbs(dev, skb); +- if (rc <= 0) ++ if (rc < 0) + goto error; + + /* get the first skb */ +diff --git a/drivers/pci/host/pci-aardvark.c b/drivers/pci/host/pci-aardvark.c +index 4214f66d405be..a572b2fb7af81 100644 +--- a/drivers/pci/host/pci-aardvark.c ++++ b/drivers/pci/host/pci-aardvark.c +@@ -100,18 +100,19 @@ + #define PCIE_ISR0_MSI_INT_PENDING BIT(24) + #define PCIE_ISR0_INTX_ASSERT(val) BIT(16 + (val)) + #define PCIE_ISR0_INTX_DEASSERT(val) BIT(20 + (val)) +-#define PCIE_ISR0_ALL_MASK GENMASK(26, 0) ++#define PCIE_ISR0_ALL_MASK GENMASK(31, 0) + #define PCIE_ISR1_REG (CONTROL_BASE_ADDR + 0x48) + #define PCIE_ISR1_MASK_REG (CONTROL_BASE_ADDR + 0x4C) + #define PCIE_ISR1_POWER_STATE_CHANGE BIT(4) + #define PCIE_ISR1_FLUSH BIT(5) + #define PCIE_ISR1_INTX_ASSERT(val) BIT(8 + (val)) +-#define PCIE_ISR1_ALL_MASK GENMASK(11, 4) ++#define PCIE_ISR1_ALL_MASK GENMASK(31, 0) + #define PCIE_MSI_ADDR_LOW_REG (CONTROL_BASE_ADDR + 0x50) + #define PCIE_MSI_ADDR_HIGH_REG (CONTROL_BASE_ADDR + 0x54) + #define PCIE_MSI_STATUS_REG (CONTROL_BASE_ADDR + 0x58) + #define PCIE_MSI_MASK_REG (CONTROL_BASE_ADDR + 0x5C) + #define PCIE_MSI_PAYLOAD_REG (CONTROL_BASE_ADDR + 0x9C) ++#define PCIE_MSI_DATA_MASK GENMASK(15, 0) + + /* PCIe window configuration */ + #define OB_WIN_BASE_ADDR 0x4c00 +@@ -169,7 +170,7 @@ + #define PCIE_IRQ_MSI_INT2_DET BIT(21) + #define PCIE_IRQ_RC_DBELL_DET BIT(22) + #define PCIE_IRQ_EP_STATUS BIT(23) +-#define PCIE_IRQ_ALL_MASK 0xfff0fb ++#define PCIE_IRQ_ALL_MASK GENMASK(31, 0) + #define PCIE_IRQ_ENABLE_INTS_MASK PCIE_IRQ_CORE_INT + + /* Transaction types */ +@@ -447,7 +448,7 @@ static int advk_pcie_check_pio_status(struct advk_pcie *pcie, u32 *val) + else + str_posted = "Posted"; + +- dev_err(dev, "%s PIO Response Status: %s, %#x @ %#x\n", ++ dev_dbg(dev, "%s PIO Response Status: %s, %#x @ %#x\n", + str_posted, strcomp_status, reg, advk_readl(pcie, PIO_ADDR_LS)); + + return -EFAULT; +@@ -662,7 +663,7 @@ static int advk_msi_irq_domain_alloc(struct irq_domain *domain, + domain->host_data, handle_simple_irq, + NULL, NULL); + +- return hwirq; ++ return 0; + } + + static void advk_msi_irq_domain_free(struct irq_domain *domain, +@@ -840,8 +841,12 @@ static void advk_pcie_handle_msi(struct advk_pcie *pcie) + if (!(BIT(msi_idx) & msi_status)) + continue; + ++ /* ++ * msi_idx contains bits [4:0] of the msi_data and msi_data ++ * contains 16bit MSI interrupt number ++ */ + advk_writel(pcie, BIT(msi_idx), PCIE_MSI_STATUS_REG); +- msi_data = advk_readl(pcie, PCIE_MSI_PAYLOAD_REG) & 0xFF; ++ msi_data = advk_readl(pcie, PCIE_MSI_PAYLOAD_REG) & PCIE_MSI_DATA_MASK; + generic_handle_irq(msi_data); + } + +@@ -863,12 +868,6 @@ static void advk_pcie_handle_int(struct advk_pcie *pcie) + isr1_mask = advk_readl(pcie, PCIE_ISR1_MASK_REG); + isr1_status = isr1_val & ((~isr1_mask) & PCIE_ISR1_ALL_MASK); + +- if (!isr0_status && !isr1_status) { +- advk_writel(pcie, isr0_val, PCIE_ISR0_REG); +- advk_writel(pcie, isr1_val, PCIE_ISR1_REG); +- return; +- } +- + /* Process MSI interrupts */ + if (isr0_status & PCIE_ISR0_MSI_INT_PENDING) + advk_pcie_handle_msi(pcie); +diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c +index 2d7b06cfc6064..2c000b9b0a42e 100644 +--- a/drivers/pci/msi.c ++++ b/drivers/pci/msi.c +@@ -372,18 +372,6 @@ static void free_msi_irqs(struct pci_dev *dev) + for (i = 0; i < entry->nvec_used; i++) + BUG_ON(irq_has_action(entry->irq + i)); + +- pci_msi_teardown_msi_irqs(dev); +- +- list_for_each_entry_safe(entry, tmp, msi_list, list) { +- if (entry->msi_attrib.is_msix) { +- if (list_is_last(&entry->list, msi_list)) +- iounmap(entry->mask_base); +- } +- +- list_del(&entry->list); +- free_msi_entry(entry); +- } +- + if (dev->msi_irq_groups) { + sysfs_remove_groups(&dev->dev.kobj, dev->msi_irq_groups); + msi_attrs = dev->msi_irq_groups[0]->attrs; +@@ -399,6 +387,18 @@ static void free_msi_irqs(struct pci_dev *dev) + kfree(dev->msi_irq_groups); + dev->msi_irq_groups = NULL; + } ++ ++ pci_msi_teardown_msi_irqs(dev); ++ ++ list_for_each_entry_safe(entry, tmp, msi_list, list) { ++ if (entry->msi_attrib.is_msix) { ++ if (list_is_last(&entry->list, msi_list)) ++ iounmap(entry->mask_base); ++ } ++ ++ list_del(&entry->list); ++ free_msi_entry(entry); ++ } + } + + static void pci_intx_for_msi(struct pci_dev *dev, int enable) +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index eff361af792ad..1bfc24654b581 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -3414,6 +3414,7 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0032, quirk_no_bus_reset); + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x003c, quirk_no_bus_reset); + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0033, quirk_no_bus_reset); + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0034, quirk_no_bus_reset); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x003e, quirk_no_bus_reset); + + /* + * Some TI KeyStone C667X devices do not support bus/hot reset. The PCIESS +diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c +index 08ea74177de29..83f439906d316 100644 +--- a/drivers/pinctrl/core.c ++++ b/drivers/pinctrl/core.c +@@ -2061,6 +2061,8 @@ int pinctrl_enable(struct pinctrl_dev *pctldev) + if (error) { + dev_err(pctldev->dev, "could not claim hogs: %i\n", + error); ++ pinctrl_free_pindescs(pctldev, pctldev->desc->pins, ++ pctldev->desc->npins); + mutex_destroy(&pctldev->mutex); + kfree(pctldev); + +diff --git a/drivers/platform/x86/hp_accel.c b/drivers/platform/x86/hp_accel.c +index 9c3c83ef445bf..075332c6890d0 100644 +--- a/drivers/platform/x86/hp_accel.c ++++ b/drivers/platform/x86/hp_accel.c +@@ -383,9 +383,11 @@ static int lis3lv02d_add(struct acpi_device *device) + INIT_WORK(&hpled_led.work, delayed_set_status_worker); + ret = led_classdev_register(NULL, &hpled_led.led_classdev); + if (ret) { ++ i8042_remove_filter(hp_accel_i8042_filter); + lis3lv02d_joystick_disable(&lis3_dev); + lis3lv02d_poweroff(&lis3_dev); + flush_work(&hpled_led.work); ++ lis3lv02d_remove_fs(&lis3_dev); + return ret; + } + +diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c +index 30bc952ea5529..9d836d779d475 100644 +--- a/drivers/platform/x86/thinkpad_acpi.c ++++ b/drivers/platform/x86/thinkpad_acpi.c +@@ -8978,7 +8978,7 @@ static int fan_write_cmd_level(const char *cmd, int *rc) + + if (strlencmp(cmd, "level auto") == 0) + level = TP_EC_FAN_AUTO; +- else if ((strlencmp(cmd, "level disengaged") == 0) | ++ else if ((strlencmp(cmd, "level disengaged") == 0) || + (strlencmp(cmd, "level full-speed") == 0)) + level = TP_EC_FAN_FULLSPEED; + else if (sscanf(cmd, "level %d", &level) != 1) +diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c +index a56e997816b23..07c1e0829b19a 100644 +--- a/drivers/platform/x86/wmi.c ++++ b/drivers/platform/x86/wmi.c +@@ -307,7 +307,14 @@ static acpi_status __query_block(struct wmi_block *wblock, u8 instance, + * the WQxx method failed - we should disable collection anyway. + */ + if ((block->flags & ACPI_WMI_EXPENSIVE) && ACPI_SUCCESS(wc_status)) { +- status = acpi_execute_simple_method(handle, wc_method, 0); ++ /* ++ * Ignore whether this WCxx call succeeds or not since ++ * the previously executed WQxx method call might have ++ * succeeded, and returning the failing status code ++ * of this call would throw away the result of the WQxx ++ * call, potentially leaking memory. ++ */ ++ acpi_execute_simple_method(handle, wc_method, 0); + } + + return status; +diff --git a/drivers/power/supply/bq27xxx_battery_i2c.c b/drivers/power/supply/bq27xxx_battery_i2c.c +index 0b11ed472f338..12ffe62caa17b 100644 +--- a/drivers/power/supply/bq27xxx_battery_i2c.c ++++ b/drivers/power/supply/bq27xxx_battery_i2c.c +@@ -195,7 +195,8 @@ static int bq27xxx_battery_i2c_probe(struct i2c_client *client, + dev_err(&client->dev, + "Unable to register IRQ %d error %d\n", + client->irq, ret); +- return ret; ++ bq27xxx_battery_teardown(di); ++ goto err_failed; + } + } + +diff --git a/drivers/power/supply/max17042_battery.c b/drivers/power/supply/max17042_battery.c +index fe5331b23a948..4c8c86f8de3ed 100644 +--- a/drivers/power/supply/max17042_battery.c ++++ b/drivers/power/supply/max17042_battery.c +@@ -303,7 +303,10 @@ static int max17042_get_property(struct power_supply *psy, + val->intval = data * 625 / 8; + break; + case POWER_SUPPLY_PROP_CAPACITY: +- ret = regmap_read(map, MAX17042_RepSOC, &data); ++ if (chip->pdata->enable_current_sense) ++ ret = regmap_read(map, MAX17042_RepSOC, &data); ++ else ++ ret = regmap_read(map, MAX17042_VFSOC, &data); + if (ret < 0) + return ret; + +@@ -825,7 +828,8 @@ static void max17042_set_soc_threshold(struct max17042_chip *chip, u16 off) + regmap_read(map, MAX17042_RepSOC, &soc); + soc >>= 8; + soc_tr = (soc + off) << 8; +- soc_tr |= (soc - off); ++ if (off < soc) ++ soc_tr |= soc - off; + regmap_write(map, MAX17042_SALRT_Th, soc_tr); + } + +diff --git a/drivers/power/supply/rt5033_battery.c b/drivers/power/supply/rt5033_battery.c +index 9310b85f3405e..7eec7014086d8 100644 +--- a/drivers/power/supply/rt5033_battery.c ++++ b/drivers/power/supply/rt5033_battery.c +@@ -63,7 +63,7 @@ static int rt5033_battery_get_watt_prop(struct i2c_client *client, + regmap_read(battery->regmap, regh, &msb); + regmap_read(battery->regmap, regl, &lsb); + +- ret = ((msb << 4) + (lsb >> 4)) * 1250 / 1000; ++ ret = ((msb << 4) + (lsb >> 4)) * 1250; + + return ret; + } +diff --git a/drivers/regulator/s5m8767.c b/drivers/regulator/s5m8767.c +index 4836947e1521d..d558f806a4705 100644 +--- a/drivers/regulator/s5m8767.c ++++ b/drivers/regulator/s5m8767.c +@@ -845,18 +845,15 @@ static int s5m8767_pmic_probe(struct platform_device *pdev) + /* DS4 GPIO */ + gpio_direction_output(pdata->buck_ds[2], 0x0); + +- if (pdata->buck2_gpiodvs || pdata->buck3_gpiodvs || +- pdata->buck4_gpiodvs) { +- regmap_update_bits(s5m8767->iodev->regmap_pmic, +- S5M8767_REG_BUCK2CTRL, 1 << 1, +- (pdata->buck2_gpiodvs) ? (1 << 1) : (0 << 1)); +- regmap_update_bits(s5m8767->iodev->regmap_pmic, +- S5M8767_REG_BUCK3CTRL, 1 << 1, +- (pdata->buck3_gpiodvs) ? (1 << 1) : (0 << 1)); +- regmap_update_bits(s5m8767->iodev->regmap_pmic, +- S5M8767_REG_BUCK4CTRL, 1 << 1, +- (pdata->buck4_gpiodvs) ? (1 << 1) : (0 << 1)); +- } ++ regmap_update_bits(s5m8767->iodev->regmap_pmic, ++ S5M8767_REG_BUCK2CTRL, 1 << 1, ++ (pdata->buck2_gpiodvs) ? (1 << 1) : (0 << 1)); ++ regmap_update_bits(s5m8767->iodev->regmap_pmic, ++ S5M8767_REG_BUCK3CTRL, 1 << 1, ++ (pdata->buck3_gpiodvs) ? (1 << 1) : (0 << 1)); ++ regmap_update_bits(s5m8767->iodev->regmap_pmic, ++ S5M8767_REG_BUCK4CTRL, 1 << 1, ++ (pdata->buck4_gpiodvs) ? (1 << 1) : (0 << 1)); + + /* Initialize GPIO DVS registers */ + for (i = 0; i < 8; i++) { +diff --git a/drivers/s390/cio/css.c b/drivers/s390/cio/css.c +index 435e804b6b8b1..cf00baa3142f4 100644 +--- a/drivers/s390/cio/css.c ++++ b/drivers/s390/cio/css.c +@@ -337,8 +337,8 @@ static ssize_t dev_busid_show(struct device *dev, + struct subchannel *sch = to_subchannel(dev); + struct pmcw *pmcw = &sch->schib.pmcw; + +- if ((pmcw->st == SUBCHANNEL_TYPE_IO || +- pmcw->st == SUBCHANNEL_TYPE_MSG) && pmcw->dnv) ++ if ((pmcw->st == SUBCHANNEL_TYPE_IO && pmcw->dnv) || ++ (pmcw->st == SUBCHANNEL_TYPE_MSG && pmcw->w)) + return sysfs_emit(buf, "0.%x.%04x\n", sch->schid.ssid, + pmcw->dev); + else +diff --git a/drivers/scsi/advansys.c b/drivers/scsi/advansys.c +index 24e57e770432b..6efd17692a55a 100644 +--- a/drivers/scsi/advansys.c ++++ b/drivers/scsi/advansys.c +@@ -3370,8 +3370,8 @@ static void asc_prt_adv_board_info(struct seq_file *m, struct Scsi_Host *shost) + shost->host_no); + + seq_printf(m, +- " iop_base 0x%lx, cable_detect: %X, err_code %u\n", +- (unsigned long)v->iop_base, ++ " iop_base 0x%p, cable_detect: %X, err_code %u\n", ++ v->iop_base, + AdvReadWordRegister(iop_base,IOPW_SCSI_CFG1) & CABLE_DETECT, + v->err_code); + +diff --git a/drivers/scsi/csiostor/csio_lnode.c b/drivers/scsi/csiostor/csio_lnode.c +index 957767d383610..d1df694d9ed00 100644 +--- a/drivers/scsi/csiostor/csio_lnode.c ++++ b/drivers/scsi/csiostor/csio_lnode.c +@@ -611,7 +611,7 @@ csio_ln_vnp_read_cbfn(struct csio_hw *hw, struct csio_mb *mbp) + struct fc_els_csp *csp; + struct fc_els_cssp *clsp; + enum fw_retval retval; +- __be32 nport_id; ++ __be32 nport_id = 0; + + retval = FW_CMD_RETVAL_G(ntohl(rsp->alloc_to_len16)); + if (retval != FW_SUCCESS) { +diff --git a/drivers/scsi/dc395x.c b/drivers/scsi/dc395x.c +index 830b2d2dcf206..8490d0ff04ca7 100644 +--- a/drivers/scsi/dc395x.c ++++ b/drivers/scsi/dc395x.c +@@ -4809,6 +4809,7 @@ static int dc395x_init_one(struct pci_dev *dev, const struct pci_device_id *id) + /* initialise the adapter and everything we need */ + if (adapter_init(acb, io_port_base, io_port_len, irq)) { + dprintkl(KERN_INFO, "adapter init failed\n"); ++ acb = NULL; + goto fail; + } + +diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c +index 20deb6715c36e..6f9ba3272721a 100644 +--- a/drivers/scsi/lpfc/lpfc_sli.c ++++ b/drivers/scsi/lpfc/lpfc_sli.c +@@ -18777,6 +18777,7 @@ lpfc_drain_txq(struct lpfc_hba *phba) + fail_msg, + piocbq->iotag, piocbq->sli4_xritag); + list_add_tail(&piocbq->list, &completions); ++ fail_msg = NULL; + } + spin_unlock_irqrestore(&pring->ring_lock, iflags); + } +diff --git a/drivers/scsi/qla2xxx/qla_gbl.h b/drivers/scsi/qla2xxx/qla_gbl.h +index 89706341514e2..a9df91f7c1543 100644 +--- a/drivers/scsi/qla2xxx/qla_gbl.h ++++ b/drivers/scsi/qla2xxx/qla_gbl.h +@@ -132,7 +132,6 @@ extern int ql2xasynctmfenable; + extern int ql2xgffidenable; + extern int ql2xenabledif; + extern int ql2xenablehba_err_chk; +-extern int ql2xtargetreset; + extern int ql2xdontresethba; + extern uint64_t ql2xmaxlun; + extern int ql2xmdcapmask; +@@ -724,7 +723,6 @@ extern void qlafx00_abort_iocb(srb_t *, struct abort_iocb_entry_fx00 *); + extern void qlafx00_fxdisc_iocb(srb_t *, struct fxdisc_entry_fx00 *); + extern void qlafx00_timer_routine(scsi_qla_host_t *); + extern int qlafx00_rescan_isp(scsi_qla_host_t *); +-extern int qlafx00_loop_reset(scsi_qla_host_t *vha); + + /* qla82xx related functions */ + +diff --git a/drivers/scsi/qla2xxx/qla_mr.c b/drivers/scsi/qla2xxx/qla_mr.c +index e23a3d4c36f39..66ee206026612 100644 +--- a/drivers/scsi/qla2xxx/qla_mr.c ++++ b/drivers/scsi/qla2xxx/qla_mr.c +@@ -739,29 +739,6 @@ qlafx00_lun_reset(fc_port_t *fcport, uint64_t l, int tag) + return qla2x00_async_tm_cmd(fcport, TCF_LUN_RESET, l, tag); + } + +-int +-qlafx00_loop_reset(scsi_qla_host_t *vha) +-{ +- int ret; +- struct fc_port *fcport; +- struct qla_hw_data *ha = vha->hw; +- +- if (ql2xtargetreset) { +- list_for_each_entry(fcport, &vha->vp_fcports, list) { +- if (fcport->port_type != FCT_TARGET) +- continue; +- +- ret = ha->isp_ops->target_reset(fcport, 0, 0); +- if (ret != QLA_SUCCESS) { +- ql_dbg(ql_dbg_taskm, vha, 0x803d, +- "Bus Reset failed: Reset=%d " +- "d_id=%x.\n", ret, fcport->d_id.b24); +- } +- } +- } +- return QLA_SUCCESS; +-} +- + int + qlafx00_iospace_config(struct qla_hw_data *ha) + { +diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c +index ea60c6e603c06..d0f52c123bfb3 100644 +--- a/drivers/scsi/qla2xxx/qla_os.c ++++ b/drivers/scsi/qla2xxx/qla_os.c +@@ -188,12 +188,6 @@ MODULE_PARM_DESC(ql2xdbwr, + " 0 -- Regular doorbell.\n" + " 1 -- CAMRAM doorbell (faster).\n"); + +-int ql2xtargetreset = 1; +-module_param(ql2xtargetreset, int, S_IRUGO); +-MODULE_PARM_DESC(ql2xtargetreset, +- "Enable target reset." +- "Default is 1 - use hw defaults."); +- + int ql2xgffidenable; + module_param(ql2xgffidenable, int, S_IRUGO); + MODULE_PARM_DESC(ql2xgffidenable, +@@ -1652,27 +1646,10 @@ int + qla2x00_loop_reset(scsi_qla_host_t *vha) + { + int ret; +- struct fc_port *fcport; + struct qla_hw_data *ha = vha->hw; + +- if (IS_QLAFX00(ha)) { +- return qlafx00_loop_reset(vha); +- } +- +- if (ql2xtargetreset == 1 && ha->flags.enable_target_reset) { +- list_for_each_entry(fcport, &vha->vp_fcports, list) { +- if (fcport->port_type != FCT_TARGET) +- continue; +- +- ret = ha->isp_ops->target_reset(fcport, 0, 0); +- if (ret != QLA_SUCCESS) { +- ql_dbg(ql_dbg_taskm, vha, 0x802c, +- "Bus Reset failed: Reset=%d " +- "d_id=%x.\n", ret, fcport->d_id.b24); +- } +- } +- } +- ++ if (IS_QLAFX00(ha)) ++ return QLA_SUCCESS; + + if (ha->flags.enable_lip_full_login && !IS_CNA_CAPABLE(ha)) { + atomic_set(&vha->loop_state, LOOP_DOWN); +diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c +index bd8f9b03386ad..cb2db1c1e9f2a 100644 +--- a/drivers/scsi/qla2xxx/qla_target.c ++++ b/drivers/scsi/qla2xxx/qla_target.c +@@ -3095,8 +3095,7 @@ int qlt_xmit_response(struct qla_tgt_cmd *cmd, int xmit_type, + "RESET-RSP online/active/old-count/new-count = %d/%d/%d/%d.\n", + vha->flags.online, qla2x00_reset_active(vha), + cmd->reset_count, qpair->chip_reset); +- spin_unlock_irqrestore(qpair->qp_lock_ptr, flags); +- return 0; ++ goto out_unmap_unlock; + } + + /* Does F/W have an IOCBs for this request */ +@@ -3218,10 +3217,6 @@ int qlt_rdy_to_xfer(struct qla_tgt_cmd *cmd) + prm.sg = NULL; + prm.req_cnt = 1; + +- /* Calculate number of entries and segments required */ +- if (qlt_pci_map_calc_cnt(&prm) != 0) +- return -EAGAIN; +- + if (!qpair->fw_started || (cmd->reset_count != qpair->chip_reset) || + (cmd->sess && cmd->sess->deleted)) { + /* +@@ -3237,6 +3232,10 @@ int qlt_rdy_to_xfer(struct qla_tgt_cmd *cmd) + return 0; + } + ++ /* Calculate number of entries and segments required */ ++ if (qlt_pci_map_calc_cnt(&prm) != 0) ++ return -EAGAIN; ++ + spin_lock_irqsave(qpair->qp_lock_ptr, flags); + /* Does F/W have an IOCBs for this request */ + res = qlt_check_reserve_free_req(qpair, prm.req_cnt); +@@ -3671,9 +3670,6 @@ void qlt_free_cmd(struct qla_tgt_cmd *cmd) + + BUG_ON(cmd->cmd_in_wq); + +- if (cmd->sg_mapped) +- qlt_unmap_sg(cmd->vha, cmd); +- + if (!cmd->q_full) + qlt_decr_num_pend_cmds(cmd->vha); + +diff --git a/drivers/sh/maple/maple.c b/drivers/sh/maple/maple.c +index bec81c2404f78..1682fa3671bc3 100644 +--- a/drivers/sh/maple/maple.c ++++ b/drivers/sh/maple/maple.c +@@ -835,8 +835,10 @@ static int __init maple_bus_init(void) + + maple_queue_cache = KMEM_CACHE(maple_buffer, SLAB_HWCACHE_ALIGN); + +- if (!maple_queue_cache) ++ if (!maple_queue_cache) { ++ retval = -ENOMEM; + goto cleanup_bothirqs; ++ } + + INIT_LIST_HEAD(&maple_waitq); + INIT_LIST_HEAD(&maple_sentq); +@@ -849,6 +851,7 @@ static int __init maple_bus_init(void) + if (!mdev[i]) { + while (i-- > 0) + maple_free_dev(mdev[i]); ++ retval = -ENOMEM; + goto cleanup_cache; + } + baseunits[i] = mdev[i]; +diff --git a/drivers/soc/tegra/pmc.c b/drivers/soc/tegra/pmc.c +index 2422ed56895af..3574021a0a369 100644 +--- a/drivers/soc/tegra/pmc.c ++++ b/drivers/soc/tegra/pmc.c +@@ -395,7 +395,7 @@ static int tegra_powergate_power_up(struct tegra_powergate *pg, + + err = tegra_powergate_enable_clocks(pg); + if (err) +- goto disable_clks; ++ goto powergate_off; + + usleep_range(10, 20); + +@@ -407,7 +407,7 @@ static int tegra_powergate_power_up(struct tegra_powergate *pg, + + err = tegra_powergate_reset_deassert(pg); + if (err) +- goto powergate_off; ++ goto disable_clks; + + usleep_range(10, 20); + +diff --git a/drivers/spi/spi-bcm-qspi.c b/drivers/spi/spi-bcm-qspi.c +index 11adc2c13a74c..298b1dd463800 100644 +--- a/drivers/spi/spi-bcm-qspi.c ++++ b/drivers/spi/spi-bcm-qspi.c +@@ -1301,7 +1301,7 @@ int bcm_qspi_probe(struct platform_device *pdev, + &qspi->dev_ids[val]); + if (ret < 0) { + dev_err(&pdev->dev, "IRQ %s not found\n", name); +- goto qspi_probe_err; ++ goto qspi_unprepare_err; + } + + qspi->dev_ids[val].dev = qspi; +@@ -1316,7 +1316,7 @@ int bcm_qspi_probe(struct platform_device *pdev, + if (!num_ints) { + dev_err(&pdev->dev, "no IRQs registered, cannot init driver\n"); + ret = -EINVAL; +- goto qspi_probe_err; ++ goto qspi_unprepare_err; + } + + /* +@@ -1367,6 +1367,7 @@ int bcm_qspi_probe(struct platform_device *pdev, + + qspi_reg_err: + bcm_qspi_hw_uninit(qspi); ++qspi_unprepare_err: + clk_disable_unprepare(qspi->clk); + qspi_probe_err: + kfree(qspi->dev_ids); +diff --git a/drivers/spi/spi-pl022.c b/drivers/spi/spi-pl022.c +index 4797c57f42630..6d849945e87a2 100644 +--- a/drivers/spi/spi-pl022.c ++++ b/drivers/spi/spi-pl022.c +@@ -1703,12 +1703,13 @@ static int verify_controller_parameters(struct pl022 *pl022, + return -EINVAL; + } + } else { +- if (chip_info->duplex != SSP_MICROWIRE_CHANNEL_FULL_DUPLEX) ++ if (chip_info->duplex != SSP_MICROWIRE_CHANNEL_FULL_DUPLEX) { + dev_err(&pl022->adev->dev, + "Microwire half duplex mode requested," + " but this is only available in the" + " ST version of PL022\n"); +- return -EINVAL; ++ return -EINVAL; ++ } + } + } + return 0; +diff --git a/drivers/target/target_core_alua.c b/drivers/target/target_core_alua.c +index 928127642574b..18e67230fc6a3 100644 +--- a/drivers/target/target_core_alua.c ++++ b/drivers/target/target_core_alua.c +@@ -1711,7 +1711,6 @@ int core_alua_set_tg_pt_gp_id( + pr_err("Maximum ALUA alua_tg_pt_gps_count:" + " 0x0000ffff reached\n"); + spin_unlock(&dev->t10_alua.tg_pt_gps_lock); +- kmem_cache_free(t10_alua_tg_pt_gp_cache, tg_pt_gp); + return -ENOSPC; + } + again: +diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c +index cebef8e5a43d1..68b2fa562201c 100644 +--- a/drivers/target/target_core_device.c ++++ b/drivers/target/target_core_device.c +@@ -791,6 +791,8 @@ struct se_device *target_alloc_device(struct se_hba *hba, const char *name) + INIT_LIST_HEAD(&dev->t10_alua.lba_map_list); + spin_lock_init(&dev->t10_alua.lba_map_lock); + ++ INIT_WORK(&dev->delayed_cmd_work, target_do_delayed_work); ++ + dev->t10_wwn.t10_dev = dev; + dev->t10_alua.t10_dev = dev; + +diff --git a/drivers/target/target_core_internal.h b/drivers/target/target_core_internal.h +index 18e3eb16e7567..7060be69dc6a3 100644 +--- a/drivers/target/target_core_internal.h ++++ b/drivers/target/target_core_internal.h +@@ -149,6 +149,7 @@ void transport_clear_lun_ref(struct se_lun *); + void transport_send_task_abort(struct se_cmd *); + sense_reason_t target_cmd_size_check(struct se_cmd *cmd, unsigned int size); + void target_qf_do_work(struct work_struct *work); ++void target_do_delayed_work(struct work_struct *work); + bool target_check_wce(struct se_device *dev); + bool target_check_fua(struct se_device *dev); + void __target_execute_cmd(struct se_cmd *, bool); +diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c +index 852680e859217..c20997bf314e9 100644 +--- a/drivers/target/target_core_transport.c ++++ b/drivers/target/target_core_transport.c +@@ -1914,32 +1914,35 @@ static bool target_handle_task_attr(struct se_cmd *cmd) + */ + switch (cmd->sam_task_attr) { + case TCM_HEAD_TAG: ++ atomic_inc_mb(&dev->non_ordered); + pr_debug("Added HEAD_OF_QUEUE for CDB: 0x%02x\n", + cmd->t_task_cdb[0]); + return false; + case TCM_ORDERED_TAG: +- atomic_inc_mb(&dev->dev_ordered_sync); ++ atomic_inc_mb(&dev->delayed_cmd_count); + + pr_debug("Added ORDERED for CDB: 0x%02x to ordered list\n", + cmd->t_task_cdb[0]); +- +- /* +- * Execute an ORDERED command if no other older commands +- * exist that need to be completed first. +- */ +- if (!atomic_read(&dev->simple_cmds)) +- return false; + break; + default: + /* + * For SIMPLE and UNTAGGED Task Attribute commands + */ +- atomic_inc_mb(&dev->simple_cmds); ++ atomic_inc_mb(&dev->non_ordered); ++ ++ if (atomic_read(&dev->delayed_cmd_count) == 0) ++ return false; + break; + } + +- if (atomic_read(&dev->dev_ordered_sync) == 0) +- return false; ++ if (cmd->sam_task_attr != TCM_ORDERED_TAG) { ++ atomic_inc_mb(&dev->delayed_cmd_count); ++ /* ++ * We will account for this when we dequeue from the delayed ++ * list. ++ */ ++ atomic_dec_mb(&dev->non_ordered); ++ } + + spin_lock(&dev->delayed_cmd_lock); + list_add_tail(&cmd->se_delayed_node, &dev->delayed_cmd_list); +@@ -1947,6 +1950,12 @@ static bool target_handle_task_attr(struct se_cmd *cmd) + + pr_debug("Added CDB: 0x%02x Task Attr: 0x%02x to delayed CMD listn", + cmd->t_task_cdb[0], cmd->sam_task_attr); ++ /* ++ * We may have no non ordered cmds when this function started or we ++ * could have raced with the last simple/head cmd completing, so kick ++ * the delayed handler here. ++ */ ++ schedule_work(&dev->delayed_cmd_work); + return true; + } + +@@ -1997,29 +2006,48 @@ EXPORT_SYMBOL(target_execute_cmd); + * Process all commands up to the last received ORDERED task attribute which + * requires another blocking boundary + */ +-static void target_restart_delayed_cmds(struct se_device *dev) ++void target_do_delayed_work(struct work_struct *work) + { +- for (;;) { ++ struct se_device *dev = container_of(work, struct se_device, ++ delayed_cmd_work); ++ ++ spin_lock(&dev->delayed_cmd_lock); ++ while (!dev->ordered_sync_in_progress) { + struct se_cmd *cmd; + +- spin_lock(&dev->delayed_cmd_lock); +- if (list_empty(&dev->delayed_cmd_list)) { +- spin_unlock(&dev->delayed_cmd_lock); ++ if (list_empty(&dev->delayed_cmd_list)) + break; +- } + + cmd = list_entry(dev->delayed_cmd_list.next, + struct se_cmd, se_delayed_node); ++ ++ if (cmd->sam_task_attr == TCM_ORDERED_TAG) { ++ /* ++ * Check if we started with: ++ * [ordered] [simple] [ordered] ++ * and we are now at the last ordered so we have to wait ++ * for the simple cmd. ++ */ ++ if (atomic_read(&dev->non_ordered) > 0) ++ break; ++ ++ dev->ordered_sync_in_progress = true; ++ } ++ + list_del(&cmd->se_delayed_node); ++ atomic_dec_mb(&dev->delayed_cmd_count); + spin_unlock(&dev->delayed_cmd_lock); + ++ if (cmd->sam_task_attr != TCM_ORDERED_TAG) ++ atomic_inc_mb(&dev->non_ordered); ++ + cmd->transport_state |= CMD_T_SENT; + + __target_execute_cmd(cmd, true); + +- if (cmd->sam_task_attr == TCM_ORDERED_TAG) +- break; ++ spin_lock(&dev->delayed_cmd_lock); + } ++ spin_unlock(&dev->delayed_cmd_lock); + } + + /* +@@ -2037,14 +2065,17 @@ static void transport_complete_task_attr(struct se_cmd *cmd) + goto restart; + + if (cmd->sam_task_attr == TCM_SIMPLE_TAG) { +- atomic_dec_mb(&dev->simple_cmds); ++ atomic_dec_mb(&dev->non_ordered); + dev->dev_cur_ordered_id++; + } else if (cmd->sam_task_attr == TCM_HEAD_TAG) { ++ atomic_dec_mb(&dev->non_ordered); + dev->dev_cur_ordered_id++; + pr_debug("Incremented dev_cur_ordered_id: %u for HEAD_OF_QUEUE\n", + dev->dev_cur_ordered_id); + } else if (cmd->sam_task_attr == TCM_ORDERED_TAG) { +- atomic_dec_mb(&dev->dev_ordered_sync); ++ spin_lock(&dev->delayed_cmd_lock); ++ dev->ordered_sync_in_progress = false; ++ spin_unlock(&dev->delayed_cmd_lock); + + dev->dev_cur_ordered_id++; + pr_debug("Incremented dev_cur_ordered_id: %u for ORDERED\n", +@@ -2053,7 +2084,8 @@ static void transport_complete_task_attr(struct se_cmd *cmd) + cmd->se_cmd_flags &= ~SCF_TASK_ATTR_SET; + + restart: +- target_restart_delayed_cmds(dev); ++ if (atomic_read(&dev->delayed_cmd_count) > 0) ++ schedule_work(&dev->delayed_cmd_work); + } + + static void transport_complete_qf(struct se_cmd *cmd) +diff --git a/drivers/tty/serial/8250/8250_dw.c b/drivers/tty/serial/8250/8250_dw.c +index 4ca46aa64699d..8db5883803c9a 100644 +--- a/drivers/tty/serial/8250/8250_dw.c ++++ b/drivers/tty/serial/8250/8250_dw.c +@@ -683,7 +683,7 @@ static struct platform_driver dw8250_platform_driver = { + .name = "dw-apb-uart", + .pm = &dw8250_pm_ops, + .of_match_table = dw8250_of_match, +- .acpi_match_table = ACPI_PTR(dw8250_acpi_match), ++ .acpi_match_table = dw8250_acpi_match, + }, + .probe = dw8250_probe, + .remove = dw8250_remove, +diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c +index 3a9e27dd171eb..599d8a4f124a6 100644 +--- a/drivers/tty/serial/serial_core.c ++++ b/drivers/tty/serial/serial_core.c +@@ -232,7 +232,11 @@ static int uart_port_startup(struct tty_struct *tty, struct uart_state *state, + if (retval == 0) { + if (uart_console(uport) && uport->cons->cflag) { + tty->termios.c_cflag = uport->cons->cflag; ++ tty->termios.c_ispeed = uport->cons->ispeed; ++ tty->termios.c_ospeed = uport->cons->ospeed; + uport->cons->cflag = 0; ++ uport->cons->ispeed = 0; ++ uport->cons->ospeed = 0; + } + /* + * Initialise the hardware port settings. +@@ -300,8 +304,11 @@ static void uart_shutdown(struct tty_struct *tty, struct uart_state *state) + /* + * Turn off DTR and RTS early. + */ +- if (uport && uart_console(uport) && tty) ++ if (uport && uart_console(uport) && tty) { + uport->cons->cflag = tty->termios.c_cflag; ++ uport->cons->ispeed = tty->termios.c_ispeed; ++ uport->cons->ospeed = tty->termios.c_ospeed; ++ } + + if (!tty || C_HUPCL(tty)) + uart_port_dtr_rts(uport, 0); +@@ -2076,8 +2083,11 @@ uart_set_options(struct uart_port *port, struct console *co, + * Allow the setting of the UART parameters with a NULL console + * too: + */ +- if (co) ++ if (co) { + co->cflag = termios.c_cflag; ++ co->ispeed = termios.c_ispeed; ++ co->ospeed = termios.c_ospeed; ++ } + + return 0; + } +@@ -2211,6 +2221,8 @@ int uart_resume_port(struct uart_driver *drv, struct uart_port *uport) + */ + memset(&termios, 0, sizeof(struct ktermios)); + termios.c_cflag = uport->cons->cflag; ++ termios.c_ispeed = uport->cons->ispeed; ++ termios.c_ospeed = uport->cons->ospeed; + + /* + * If that's unset, use the tty termios setting. +diff --git a/drivers/tty/serial/xilinx_uartps.c b/drivers/tty/serial/xilinx_uartps.c +index 00a740b8ad273..cdd81c28893a0 100644 +--- a/drivers/tty/serial/xilinx_uartps.c ++++ b/drivers/tty/serial/xilinx_uartps.c +@@ -595,9 +595,10 @@ static void cdns_uart_start_tx(struct uart_port *port) + if (uart_circ_empty(&port->state->xmit)) + return; + ++ writel(CDNS_UART_IXR_TXEMPTY, port->membase + CDNS_UART_ISR); ++ + cdns_uart_handle_tx(port); + +- writel(CDNS_UART_IXR_TXEMPTY, port->membase + CDNS_UART_ISR); + /* Enable the TX Empty interrupt */ + writel(CDNS_UART_IXR_TXEMPTY, port->membase + CDNS_UART_IER); + } +diff --git a/drivers/tty/tty_buffer.c b/drivers/tty/tty_buffer.c +index cf11882d26025..a5b32dd056bef 100644 +--- a/drivers/tty/tty_buffer.c ++++ b/drivers/tty/tty_buffer.c +@@ -528,6 +528,9 @@ static void flush_to_ldisc(struct work_struct *work) + if (!count) + break; + head->read += count; ++ ++ if (need_resched()) ++ cond_resched(); + } + + mutex_unlock(&buf->lock); +diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c +index 77410fb42eab0..7142baf654bc9 100644 +--- a/drivers/usb/chipidea/core.c ++++ b/drivers/usb/chipidea/core.c +@@ -535,7 +535,7 @@ int hw_device_reset(struct ci_hdrc *ci) + return 0; + } + +-static irqreturn_t ci_irq(int irq, void *data) ++static irqreturn_t ci_irq_handler(int irq, void *data) + { + struct ci_hdrc *ci = data; + irqreturn_t ret = IRQ_NONE; +@@ -588,6 +588,15 @@ static irqreturn_t ci_irq(int irq, void *data) + return ret; + } + ++static void ci_irq(struct ci_hdrc *ci) ++{ ++ unsigned long flags; ++ ++ local_irq_save(flags); ++ ci_irq_handler(ci->irq, ci); ++ local_irq_restore(flags); ++} ++ + static int ci_cable_notifier(struct notifier_block *nb, unsigned long event, + void *ptr) + { +@@ -597,7 +606,7 @@ static int ci_cable_notifier(struct notifier_block *nb, unsigned long event, + cbl->connected = event; + cbl->changed = true; + +- ci_irq(ci->irq, ci); ++ ci_irq(ci); + return NOTIFY_DONE; + } + +@@ -1051,7 +1060,7 @@ static int ci_hdrc_probe(struct platform_device *pdev) + } + } + +- ret = devm_request_irq(dev, ci->irq, ci_irq, IRQF_SHARED, ++ ret = devm_request_irq(dev, ci->irq, ci_irq_handler, IRQF_SHARED, + ci->platdata->name, ci); + if (ret) + goto stop; +@@ -1175,11 +1184,11 @@ static void ci_extcon_wakeup_int(struct ci_hdrc *ci) + + if (!IS_ERR(cable_id->edev) && ci->is_otg && + (otgsc & OTGSC_IDIE) && (otgsc & OTGSC_IDIS)) +- ci_irq(ci->irq, ci); ++ ci_irq(ci); + + if (!IS_ERR(cable_vbus->edev) && ci->is_otg && + (otgsc & OTGSC_BSVIE) && (otgsc & OTGSC_BSVIS)) +- ci_irq(ci->irq, ci); ++ ci_irq(ci); + } + + static int ci_controller_resume(struct device *dev) +diff --git a/drivers/usb/gadget/legacy/hid.c b/drivers/usb/gadget/legacy/hid.c +index cccbb948821b2..a55d3761d777c 100644 +--- a/drivers/usb/gadget/legacy/hid.c ++++ b/drivers/usb/gadget/legacy/hid.c +@@ -103,8 +103,10 @@ static int do_config(struct usb_configuration *c) + + list_for_each_entry(e, &hidg_func_list, node) { + e->f = usb_get_function(e->fi); +- if (IS_ERR(e->f)) ++ if (IS_ERR(e->f)) { ++ status = PTR_ERR(e->f); + goto put; ++ } + status = usb_add_function(c, e->f); + if (status < 0) { + usb_put_function(e->f); +diff --git a/drivers/usb/host/max3421-hcd.c b/drivers/usb/host/max3421-hcd.c +index 1c047f28c88e4..2471c703d1fc1 100644 +--- a/drivers/usb/host/max3421-hcd.c ++++ b/drivers/usb/host/max3421-hcd.c +@@ -121,8 +121,6 @@ struct max3421_hcd { + + struct task_struct *spi_thread; + +- struct max3421_hcd *next; +- + enum max3421_rh_state rh_state; + /* lower 16 bits contain port status, upper 16 bits the change mask: */ + u32 port_status; +@@ -170,8 +168,6 @@ struct max3421_ep { + u8 retransmit; /* packet needs retransmission */ + }; + +-static struct max3421_hcd *max3421_hcd_list; +- + #define MAX3421_FIFO_SIZE 64 + + #define MAX3421_SPI_DIR_RD 0 /* read register from MAX3421 */ +@@ -1835,9 +1831,8 @@ max3421_probe(struct spi_device *spi) + } + set_bit(HCD_FLAG_POLL_RH, &hcd->flags); + max3421_hcd = hcd_to_max3421(hcd); +- max3421_hcd->next = max3421_hcd_list; +- max3421_hcd_list = max3421_hcd; + INIT_LIST_HEAD(&max3421_hcd->ep_list); ++ spi_set_drvdata(spi, max3421_hcd); + + max3421_hcd->tx = kmalloc(sizeof(*max3421_hcd->tx), GFP_KERNEL); + if (!max3421_hcd->tx) +@@ -1882,28 +1877,18 @@ error: + static int + max3421_remove(struct spi_device *spi) + { +- struct max3421_hcd *max3421_hcd = NULL, **prev; +- struct usb_hcd *hcd = NULL; ++ struct max3421_hcd *max3421_hcd; ++ struct usb_hcd *hcd; + unsigned long flags; + +- for (prev = &max3421_hcd_list; *prev; prev = &(*prev)->next) { +- max3421_hcd = *prev; +- hcd = max3421_to_hcd(max3421_hcd); +- if (hcd->self.controller == &spi->dev) +- break; +- } +- if (!max3421_hcd) { +- dev_err(&spi->dev, "no MAX3421 HCD found for SPI device %p\n", +- spi); +- return -ENODEV; +- } ++ max3421_hcd = spi_get_drvdata(spi); ++ hcd = max3421_to_hcd(max3421_hcd); + + usb_remove_hcd(hcd); + + spin_lock_irqsave(&max3421_hcd->lock, flags); + + kthread_stop(max3421_hcd->spi_thread); +- *prev = max3421_hcd->next; + + spin_unlock_irqrestore(&max3421_hcd->lock, flags); + +diff --git a/drivers/usb/host/ohci-tmio.c b/drivers/usb/host/ohci-tmio.c +index 0cf4b6dc89720..4c7846dc5eed1 100644 +--- a/drivers/usb/host/ohci-tmio.c ++++ b/drivers/usb/host/ohci-tmio.c +@@ -199,7 +199,7 @@ static int ohci_hcd_tmio_drv_probe(struct platform_device *dev) + if (usb_disabled()) + return -ENODEV; + +- if (!cell) ++ if (!cell || !regs || !config || !sram) + return -EINVAL; + + if (irq < 0) +diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c +index 65a930b3722eb..ad82d10d9cf5f 100644 +--- a/drivers/usb/host/xhci-hub.c ++++ b/drivers/usb/host/xhci-hub.c +@@ -174,7 +174,6 @@ static void xhci_common_hub_descriptor(struct xhci_hcd *xhci, + { + u16 temp; + +- desc->bPwrOn2PwrGood = 10; /* xhci section 5.4.9 says 20ms max */ + desc->bHubContrCurrent = 0; + + desc->bNbrPorts = ports; +@@ -208,6 +207,7 @@ static void xhci_usb2_hub_descriptor(struct usb_hcd *hcd, struct xhci_hcd *xhci, + desc->bDescriptorType = USB_DT_HUB; + temp = 1 + (ports / 8); + desc->bDescLength = USB_DT_HUB_NONVAR_SIZE + 2 * temp; ++ desc->bPwrOn2PwrGood = 10; /* xhci section 5.4.8 says 20ms */ + + /* The Device Removable bits are reported on a byte granularity. + * If the port doesn't exist within that byte, the bit is set to 0. +@@ -258,6 +258,7 @@ static void xhci_usb3_hub_descriptor(struct usb_hcd *hcd, struct xhci_hcd *xhci, + xhci_common_hub_descriptor(xhci, desc, ports); + desc->bDescriptorType = USB_DT_SS_HUB; + desc->bDescLength = USB_DT_SS_HUB_SIZE; ++ desc->bPwrOn2PwrGood = 50; /* usb 3.1 may fail if less than 100ms */ + + /* header decode latency should be zero for roothubs, + * see section 4.23.5.2. +diff --git a/drivers/usb/misc/iowarrior.c b/drivers/usb/misc/iowarrior.c +index 27e1ab9e1b079..2f13be1e3b8d3 100644 +--- a/drivers/usb/misc/iowarrior.c ++++ b/drivers/usb/misc/iowarrior.c +@@ -103,10 +103,6 @@ struct iowarrior { + /* globals */ + /*--------------*/ + +-/* +- * USB spec identifies 5 second timeouts. +- */ +-#define GET_TIMEOUT 5 + #define USB_REQ_GET_REPORT 0x01 + //#if 0 + static int usb_get_report(struct usb_device *dev, +@@ -118,7 +114,7 @@ static int usb_get_report(struct usb_device *dev, + USB_DIR_IN | USB_TYPE_CLASS | + USB_RECIP_INTERFACE, (type << 8) + id, + inter->desc.bInterfaceNumber, buf, size, +- GET_TIMEOUT*HZ); ++ USB_CTRL_GET_TIMEOUT); + } + //#endif + +@@ -133,7 +129,7 @@ static int usb_set_report(struct usb_interface *intf, unsigned char type, + USB_TYPE_CLASS | USB_RECIP_INTERFACE, + (type << 8) + id, + intf->cur_altsetting->desc.bInterfaceNumber, buf, +- size, HZ); ++ size, 1000); + } + + /*---------------------*/ +diff --git a/drivers/usb/musb/tusb6010.c b/drivers/usb/musb/tusb6010.c +index 7d7cb1c5ec808..9a7b5b2d7ccc7 100644 +--- a/drivers/usb/musb/tusb6010.c ++++ b/drivers/usb/musb/tusb6010.c +@@ -1108,6 +1108,11 @@ static int tusb_musb_init(struct musb *musb) + + /* dma address for async dma */ + mem = platform_get_resource(pdev, IORESOURCE_MEM, 0); ++ if (!mem) { ++ pr_debug("no async dma resource?\n"); ++ ret = -ENODEV; ++ goto done; ++ } + musb->async = mem->start; + + /* dma address for sync dma */ +diff --git a/drivers/usb/serial/keyspan.c b/drivers/usb/serial/keyspan.c +index 55a7684879906..ce5431bb42165 100644 +--- a/drivers/usb/serial/keyspan.c ++++ b/drivers/usb/serial/keyspan.c +@@ -2914,22 +2914,22 @@ static int keyspan_port_probe(struct usb_serial_port *port) + for (i = 0; i < ARRAY_SIZE(p_priv->in_buffer); ++i) { + p_priv->in_buffer[i] = kzalloc(IN_BUFLEN, GFP_KERNEL); + if (!p_priv->in_buffer[i]) +- goto err_in_buffer; ++ goto err_free_in_buffer; + } + + for (i = 0; i < ARRAY_SIZE(p_priv->out_buffer); ++i) { + p_priv->out_buffer[i] = kzalloc(OUT_BUFLEN, GFP_KERNEL); + if (!p_priv->out_buffer[i]) +- goto err_out_buffer; ++ goto err_free_out_buffer; + } + + p_priv->inack_buffer = kzalloc(INACK_BUFLEN, GFP_KERNEL); + if (!p_priv->inack_buffer) +- goto err_inack_buffer; ++ goto err_free_out_buffer; + + p_priv->outcont_buffer = kzalloc(OUTCONT_BUFLEN, GFP_KERNEL); + if (!p_priv->outcont_buffer) +- goto err_outcont_buffer; ++ goto err_free_inack_buffer; + + p_priv->device_details = d_details; + +@@ -2975,15 +2975,14 @@ static int keyspan_port_probe(struct usb_serial_port *port) + + return 0; + +-err_outcont_buffer: ++err_free_inack_buffer: + kfree(p_priv->inack_buffer); +-err_inack_buffer: ++err_free_out_buffer: + for (i = 0; i < ARRAY_SIZE(p_priv->out_buffer); ++i) + kfree(p_priv->out_buffer[i]); +-err_out_buffer: ++err_free_in_buffer: + for (i = 0; i < ARRAY_SIZE(p_priv->in_buffer); ++i) + kfree(p_priv->in_buffer[i]); +-err_in_buffer: + kfree(p_priv); + + return -ENOMEM; +diff --git a/drivers/video/console/sticon.c b/drivers/video/console/sticon.c +index 79c9bd8d30254..559a7305cadaa 100644 +--- a/drivers/video/console/sticon.c ++++ b/drivers/video/console/sticon.c +@@ -291,13 +291,13 @@ static unsigned long sticon_getxy(struct vc_data *conp, unsigned long pos, + static u8 sticon_build_attr(struct vc_data *conp, u8 color, u8 intens, + u8 blink, u8 underline, u8 reverse, u8 italic) + { +- u8 attr = ((color & 0x70) >> 1) | ((color & 7)); ++ u8 fg = color & 7; ++ u8 bg = (color & 0x70) >> 4; + +- if (reverse) { +- color = ((color >> 3) & 0x7) | ((color & 0x7) << 3); +- } +- +- return attr; ++ if (reverse) ++ return (fg << 3) | bg; ++ else ++ return (bg << 3) | fg; + } + + static void sticon_invert_region(struct vc_data *conp, u16 *p, int count) +diff --git a/drivers/video/fbdev/chipsfb.c b/drivers/video/fbdev/chipsfb.c +index f9b366d175875..413b465e69d8e 100644 +--- a/drivers/video/fbdev/chipsfb.c ++++ b/drivers/video/fbdev/chipsfb.c +@@ -332,7 +332,7 @@ static const struct fb_var_screeninfo chipsfb_var = { + + static void init_chips(struct fb_info *p, unsigned long addr) + { +- memset(p->screen_base, 0, 0x100000); ++ fb_memset(p->screen_base, 0, 0x100000); + + p->fix = chipsfb_fix; + p->fix.smem_start = addr; +diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig +index de228669a2c8b..8cb663ecbacc6 100644 +--- a/drivers/watchdog/Kconfig ++++ b/drivers/watchdog/Kconfig +@@ -1499,7 +1499,7 @@ config SIBYTE_WDOG + + config AR7_WDT + tristate "TI AR7 Watchdog Timer" +- depends on AR7 || (MIPS && COMPILE_TEST) ++ depends on AR7 || (MIPS && 32BIT && COMPILE_TEST) + help + Hardware driver for the TI AR7 Watchdog Timer. + +diff --git a/drivers/watchdog/f71808e_wdt.c b/drivers/watchdog/f71808e_wdt.c +index ae4974701e5c7..6fe9daf2367b5 100644 +--- a/drivers/watchdog/f71808e_wdt.c ++++ b/drivers/watchdog/f71808e_wdt.c +@@ -237,15 +237,17 @@ static int watchdog_set_timeout(int timeout) + + mutex_lock(&watchdog.lock); + +- watchdog.timeout = timeout; + if (timeout > 0xff) { + watchdog.timer_val = DIV_ROUND_UP(timeout, 60); + watchdog.minutes_mode = true; ++ timeout = watchdog.timer_val * 60; + } else { + watchdog.timer_val = timeout; + watchdog.minutes_mode = false; + } + ++ watchdog.timeout = timeout; ++ + mutex_unlock(&watchdog.lock); + + return 0; +diff --git a/drivers/watchdog/omap_wdt.c b/drivers/watchdog/omap_wdt.c +index 1b02bfa81b296..40c006ee8492d 100644 +--- a/drivers/watchdog/omap_wdt.c ++++ b/drivers/watchdog/omap_wdt.c +@@ -271,8 +271,12 @@ static int omap_wdt_probe(struct platform_device *pdev) + wdev->wdog.bootstatus = WDIOF_CARDRESET; + } + +- if (!early_enable) ++ if (early_enable) { ++ omap_wdt_start(&wdev->wdog); ++ set_bit(WDOG_HW_RUNNING, &wdev->wdog.status); ++ } else { + omap_wdt_disable(wdev); ++ } + + ret = watchdog_register_device(&wdev->wdog); + if (ret) { +diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c +index 92bb71c040f97..f2b06fdb06017 100644 +--- a/drivers/xen/balloon.c ++++ b/drivers/xen/balloon.c +@@ -58,6 +58,7 @@ + #include <linux/percpu-defs.h> + #include <linux/slab.h> + #include <linux/sysctl.h> ++#include <linux/moduleparam.h> + + #include <asm/page.h> + #include <asm/pgalloc.h> +@@ -74,6 +75,12 @@ + #include <xen/features.h> + #include <xen/page.h> + ++#undef MODULE_PARAM_PREFIX ++#define MODULE_PARAM_PREFIX "xen." ++ ++static uint __read_mostly balloon_boot_timeout = 180; ++module_param(balloon_boot_timeout, uint, 0444); ++ + static int xen_hotplug_unpopulated; + + #ifdef CONFIG_XEN_BALLOON_MEMORY_HOTPLUG +@@ -129,12 +136,12 @@ static struct ctl_table xen_root[] = { + * BP_ECANCELED: error, balloon operation canceled. + */ + +-enum bp_state { ++static enum bp_state { + BP_DONE, + BP_WAIT, + BP_EAGAIN, + BP_ECANCELED +-}; ++} balloon_state = BP_DONE; + + /* Main waiting point for xen-balloon thread. */ + static DECLARE_WAIT_QUEUE_HEAD(balloon_thread_wq); +@@ -212,18 +219,15 @@ static struct page *balloon_next_page(struct page *page) + return list_entry(next, struct page, lru); + } + +-static enum bp_state update_schedule(enum bp_state state) ++static void update_schedule(void) + { +- if (state == BP_WAIT) +- return BP_WAIT; +- +- if (state == BP_ECANCELED) +- return BP_ECANCELED; ++ if (balloon_state == BP_WAIT || balloon_state == BP_ECANCELED) ++ return; + +- if (state == BP_DONE) { ++ if (balloon_state == BP_DONE) { + balloon_stats.schedule_delay = 1; + balloon_stats.retry_count = 1; +- return BP_DONE; ++ return; + } + + ++balloon_stats.retry_count; +@@ -232,7 +236,8 @@ static enum bp_state update_schedule(enum bp_state state) + balloon_stats.retry_count > balloon_stats.max_retry_count) { + balloon_stats.schedule_delay = 1; + balloon_stats.retry_count = 1; +- return BP_ECANCELED; ++ balloon_state = BP_ECANCELED; ++ return; + } + + balloon_stats.schedule_delay <<= 1; +@@ -240,7 +245,7 @@ static enum bp_state update_schedule(enum bp_state state) + if (balloon_stats.schedule_delay > balloon_stats.max_schedule_delay) + balloon_stats.schedule_delay = balloon_stats.max_schedule_delay; + +- return BP_EAGAIN; ++ balloon_state = BP_EAGAIN; + } + + #ifdef CONFIG_XEN_BALLOON_MEMORY_HOTPLUG +@@ -574,9 +579,9 @@ static enum bp_state decrease_reservation(unsigned long nr_pages, gfp_t gfp) + * Stop waiting if either state is BP_DONE and ballooning action is + * needed, or if the credit has changed while state is not BP_DONE. + */ +-static bool balloon_thread_cond(enum bp_state state, long credit) ++static bool balloon_thread_cond(long credit) + { +- if (state == BP_DONE) ++ if (balloon_state == BP_DONE) + credit = 0; + + return current_credit() != credit || kthread_should_stop(); +@@ -590,13 +595,12 @@ static bool balloon_thread_cond(enum bp_state state, long credit) + */ + static int balloon_thread(void *unused) + { +- enum bp_state state = BP_DONE; + long credit; + unsigned long timeout; + + set_freezable(); + for (;;) { +- switch (state) { ++ switch (balloon_state) { + case BP_DONE: + case BP_ECANCELED: + timeout = 3600 * HZ; +@@ -612,7 +616,7 @@ static int balloon_thread(void *unused) + credit = current_credit(); + + wait_event_freezable_timeout(balloon_thread_wq, +- balloon_thread_cond(state, credit), timeout); ++ balloon_thread_cond(credit), timeout); + + if (kthread_should_stop()) + return 0; +@@ -623,22 +627,23 @@ static int balloon_thread(void *unused) + + if (credit > 0) { + if (balloon_is_inflated()) +- state = increase_reservation(credit); ++ balloon_state = increase_reservation(credit); + else +- state = reserve_additional_memory(); ++ balloon_state = reserve_additional_memory(); + } + + if (credit < 0) { + long n_pages; + + n_pages = min(-credit, si_mem_available()); +- state = decrease_reservation(n_pages, GFP_BALLOON); +- if (state == BP_DONE && n_pages != -credit && ++ balloon_state = decrease_reservation(n_pages, ++ GFP_BALLOON); ++ if (balloon_state == BP_DONE && n_pages != -credit && + n_pages < totalreserve_pages) +- state = BP_EAGAIN; ++ balloon_state = BP_EAGAIN; + } + +- state = update_schedule(state); ++ update_schedule(); + + mutex_unlock(&balloon_mutex); + +@@ -847,3 +852,38 @@ static int __init balloon_init(void) + return 0; + } + subsys_initcall(balloon_init); ++ ++static int __init balloon_wait_finish(void) ++{ ++ long credit, last_credit = 0; ++ unsigned long last_changed = 0; ++ ++ if (!xen_domain()) ++ return -ENODEV; ++ ++ /* PV guests don't need to wait. */ ++ if (xen_pv_domain() || !current_credit()) ++ return 0; ++ ++ pr_notice("Waiting for initial ballooning down having finished.\n"); ++ ++ while ((credit = current_credit()) < 0) { ++ if (credit != last_credit) { ++ last_changed = jiffies; ++ last_credit = credit; ++ } ++ if (balloon_state == BP_ECANCELED) { ++ pr_warn_once("Initial ballooning failed, %ld pages need to be freed.\n", ++ -credit); ++ if (jiffies - last_changed >= HZ * balloon_boot_timeout) ++ panic("Initial ballooning failed!\n"); ++ } ++ ++ schedule_timeout_interruptible(HZ / 10); ++ } ++ ++ pr_notice("Initial ballooning down finished.\n"); ++ ++ return 0; ++} ++late_initcall_sync(balloon_wait_finish); +diff --git a/drivers/xen/xen-pciback/conf_space_capability.c b/drivers/xen/xen-pciback/conf_space_capability.c +index e5694133ebe57..42f0f64fcba47 100644 +--- a/drivers/xen/xen-pciback/conf_space_capability.c ++++ b/drivers/xen/xen-pciback/conf_space_capability.c +@@ -160,7 +160,7 @@ static void *pm_ctrl_init(struct pci_dev *dev, int offset) + } + + out: +- return ERR_PTR(err); ++ return err ? ERR_PTR(err) : NULL; + } + + static const struct config_field caplist_pm[] = { +diff --git a/fs/btrfs/async-thread.c b/fs/btrfs/async-thread.c +index 92615badc1734..3dfe8d35235e1 100644 +--- a/fs/btrfs/async-thread.c ++++ b/fs/btrfs/async-thread.c +@@ -283,6 +283,13 @@ static void run_ordered_work(struct __btrfs_workqueue *wq, + ordered_list); + if (!test_bit(WORK_DONE_BIT, &work->flags)) + break; ++ /* ++ * Orders all subsequent loads after reading WORK_DONE_BIT, ++ * paired with the smp_mb__before_atomic in btrfs_work_helper ++ * this guarantees that the ordered function will see all ++ * updates from ordinary work function. ++ */ ++ smp_rmb(); + + /* + * we are going to call the ordered done function, but +@@ -368,6 +375,13 @@ static void normal_work_helper(struct btrfs_work *work) + thresh_exec_hook(wq); + work->func(work); + if (need_order) { ++ /* ++ * Ensures all memory accesses done in the work function are ++ * ordered before setting the WORK_DONE_BIT. Ensuring the thread ++ * which is going to executed the ordered work sees them. ++ * Pairs with the smp_rmb in run_ordered_work. ++ */ ++ smp_mb__before_atomic(); + set_bit(WORK_DONE_BIT, &work->flags); + run_ordered_work(wq, work); + } +diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c +index 372a10130ced1..8f2c7aa2e91a1 100644 +--- a/fs/btrfs/tree-log.c ++++ b/fs/btrfs/tree-log.c +@@ -2286,7 +2286,9 @@ again: + else { + ret = find_dir_range(log, path, dirid, key_type, + &range_start, &range_end); +- if (ret != 0) ++ if (ret < 0) ++ goto out; ++ else if (ret > 0) + break; + } + +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index 660469befb7f8..105334ebc102d 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -2952,8 +2952,8 @@ static int ext4_run_li_request(struct ext4_li_request *elr) + struct ext4_group_desc *gdp = NULL; + ext4_group_t group, ngroups; + struct super_block *sb; +- unsigned long timeout = 0; + int ret = 0; ++ u64 start_time; + + sb = elr->lr_super; + ngroups = EXT4_SB(sb)->s_groups_count; +@@ -2973,13 +2973,12 @@ static int ext4_run_li_request(struct ext4_li_request *elr) + ret = 1; + + if (!ret) { +- timeout = jiffies; ++ start_time = ktime_get_real_ns(); + ret = ext4_init_inode_table(sb, group, + elr->lr_timeout ? 0 : 1); + if (elr->lr_timeout == 0) { +- timeout = (jiffies - timeout) * +- elr->lr_sbi->s_li_wait_mult; +- elr->lr_timeout = timeout; ++ elr->lr_timeout = nsecs_to_jiffies((ktime_get_real_ns() - start_time) * ++ elr->lr_sbi->s_li_wait_mult); + } + elr->lr_next_sched = jiffies + elr->lr_timeout; + elr->lr_next_group = group + 1; +diff --git a/fs/jfs/jfs_mount.c b/fs/jfs/jfs_mount.c +index b5214c9ac47ac..f1a705d159043 100644 +--- a/fs/jfs/jfs_mount.c ++++ b/fs/jfs/jfs_mount.c +@@ -93,14 +93,14 @@ int jfs_mount(struct super_block *sb) + * (initialize mount inode from the superblock) + */ + if ((rc = chkSuper(sb))) { +- goto errout20; ++ goto out; + } + + ipaimap = diReadSpecial(sb, AGGREGATE_I, 0); + if (ipaimap == NULL) { + jfs_err("jfs_mount: Failed to read AGGREGATE_I"); + rc = -EIO; +- goto errout20; ++ goto out; + } + sbi->ipaimap = ipaimap; + +@@ -111,7 +111,7 @@ int jfs_mount(struct super_block *sb) + */ + if ((rc = diMount(ipaimap))) { + jfs_err("jfs_mount: diMount(ipaimap) failed w/rc = %d", rc); +- goto errout21; ++ goto err_ipaimap; + } + + /* +@@ -120,7 +120,7 @@ int jfs_mount(struct super_block *sb) + ipbmap = diReadSpecial(sb, BMAP_I, 0); + if (ipbmap == NULL) { + rc = -EIO; +- goto errout22; ++ goto err_umount_ipaimap; + } + + jfs_info("jfs_mount: ipbmap:0x%p", ipbmap); +@@ -132,7 +132,7 @@ int jfs_mount(struct super_block *sb) + */ + if ((rc = dbMount(ipbmap))) { + jfs_err("jfs_mount: dbMount failed w/rc = %d", rc); +- goto errout22; ++ goto err_ipbmap; + } + + /* +@@ -151,7 +151,7 @@ int jfs_mount(struct super_block *sb) + if (!ipaimap2) { + jfs_err("jfs_mount: Failed to read AGGREGATE_I"); + rc = -EIO; +- goto errout35; ++ goto err_umount_ipbmap; + } + sbi->ipaimap2 = ipaimap2; + +@@ -163,7 +163,7 @@ int jfs_mount(struct super_block *sb) + if ((rc = diMount(ipaimap2))) { + jfs_err("jfs_mount: diMount(ipaimap2) failed, rc = %d", + rc); +- goto errout35; ++ goto err_ipaimap2; + } + } else + /* Secondary aggregate inode table is not valid */ +@@ -180,7 +180,7 @@ int jfs_mount(struct super_block *sb) + jfs_err("jfs_mount: Failed to read FILESYSTEM_I"); + /* open fileset secondary inode allocation map */ + rc = -EIO; +- goto errout40; ++ goto err_umount_ipaimap2; + } + jfs_info("jfs_mount: ipimap:0x%p", ipimap); + +@@ -190,41 +190,34 @@ int jfs_mount(struct super_block *sb) + /* initialize fileset inode allocation map */ + if ((rc = diMount(ipimap))) { + jfs_err("jfs_mount: diMount failed w/rc = %d", rc); +- goto errout41; ++ goto err_ipimap; + } + +- goto out; ++ return rc; + + /* + * unwind on error + */ +- errout41: /* close fileset inode allocation map inode */ ++err_ipimap: ++ /* close fileset inode allocation map inode */ + diFreeSpecial(ipimap); +- +- errout40: /* fileset closed */ +- ++err_umount_ipaimap2: + /* close secondary aggregate inode allocation map */ +- if (ipaimap2) { ++ if (ipaimap2) + diUnmount(ipaimap2, 1); ++err_ipaimap2: ++ /* close aggregate inodes */ ++ if (ipaimap2) + diFreeSpecial(ipaimap2); +- } +- +- errout35: +- +- /* close aggregate block allocation map */ ++err_umount_ipbmap: /* close aggregate block allocation map */ + dbUnmount(ipbmap, 1); ++err_ipbmap: /* close aggregate inodes */ + diFreeSpecial(ipbmap); +- +- errout22: /* close aggregate inode allocation map */ +- ++err_umount_ipaimap: /* close aggregate inode allocation map */ + diUnmount(ipaimap, 1); +- +- errout21: /* close aggregate inodes */ ++err_ipaimap: /* close aggregate inodes */ + diFreeSpecial(ipaimap); +- errout20: /* aggregate closed */ +- +- out: +- ++out: + if (rc) + jfs_err("Mount JFS Failure: %d", rc); + +diff --git a/fs/nfs/flexfilelayout/flexfilelayoutdev.c b/fs/nfs/flexfilelayout/flexfilelayoutdev.c +index 2464b9b806988..17dee8fd9834f 100644 +--- a/fs/nfs/flexfilelayout/flexfilelayoutdev.c ++++ b/fs/nfs/flexfilelayout/flexfilelayoutdev.c +@@ -428,10 +428,10 @@ nfs4_ff_layout_prepare_ds(struct pnfs_layout_segment *lseg, u32 ds_idx, + goto out_fail; + + ds = mirror->mirror_ds->ds; ++ if (READ_ONCE(ds->ds_clp)) ++ goto out; + /* matching smp_wmb() in _nfs4_pnfs_v3/4_ds_connect */ + smp_rmb(); +- if (ds->ds_clp) +- goto out; + + /* FIXME: For now we assume the server sent only one version of NFS + * to use for the DS. +diff --git a/fs/nfs/pnfs_nfs.c b/fs/nfs/pnfs_nfs.c +index 29bdf1525d82b..5d7a69ffaaa29 100644 +--- a/fs/nfs/pnfs_nfs.c ++++ b/fs/nfs/pnfs_nfs.c +@@ -635,7 +635,7 @@ static int _nfs4_pnfs_v3_ds_connect(struct nfs_server *mds_srv, + } + + smp_wmb(); +- ds->ds_clp = clp; ++ WRITE_ONCE(ds->ds_clp, clp); + dprintk("%s [new] addr: %s\n", __func__, ds->ds_remotestr); + out: + return status; +@@ -708,7 +708,7 @@ static int _nfs4_pnfs_v4_ds_connect(struct nfs_server *mds_srv, + } + + smp_wmb(); +- ds->ds_clp = clp; ++ WRITE_ONCE(ds->ds_clp, clp); + dprintk("%s [new] addr: %s\n", __func__, ds->ds_remotestr); + out: + return status; +diff --git a/fs/nfs/write.c b/fs/nfs/write.c +index 767e46c09074b..010733c8bdcd3 100644 +--- a/fs/nfs/write.c ++++ b/fs/nfs/write.c +@@ -1037,25 +1037,11 @@ nfs_scan_commit_list(struct list_head *src, struct list_head *dst, + struct nfs_page *req, *tmp; + int ret = 0; + +-restart: + list_for_each_entry_safe(req, tmp, src, wb_list) { + kref_get(&req->wb_kref); + if (!nfs_lock_request(req)) { +- int status; +- +- /* Prevent deadlock with nfs_lock_and_join_requests */ +- if (!list_empty(dst)) { +- nfs_release_request(req); +- continue; +- } +- /* Ensure we make progress to prevent livelock */ +- mutex_unlock(&NFS_I(cinfo->inode)->commit_mutex); +- status = nfs_wait_on_request(req); + nfs_release_request(req); +- mutex_lock(&NFS_I(cinfo->inode)->commit_mutex); +- if (status < 0) +- break; +- goto restart; ++ continue; + } + nfs_request_remove_commit_list(req, cinfo); + clear_bit(PG_COMMIT_TO_DS, &req->wb_flags); +@@ -1904,6 +1890,7 @@ static int __nfs_commit_inode(struct inode *inode, int how, + int may_wait = how & FLUSH_SYNC; + int ret, nscan; + ++ how &= ~FLUSH_SYNC; + nfs_init_cinfo_from_inode(&cinfo, inode); + nfs_commit_begin(cinfo.mds); + for (;;) { +diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c +index 6a809517ca500..e671fbdd4b863 100644 +--- a/fs/ocfs2/file.c ++++ b/fs/ocfs2/file.c +@@ -490,10 +490,11 @@ int ocfs2_truncate_file(struct inode *inode, + * greater than page size, so we have to truncate them + * anyway. + */ +- unmap_mapping_range(inode->i_mapping, new_i_size + PAGE_SIZE - 1, 0, 1); +- truncate_inode_pages(inode->i_mapping, new_i_size); + + if (OCFS2_I(inode)->ip_dyn_features & OCFS2_INLINE_DATA_FL) { ++ unmap_mapping_range(inode->i_mapping, ++ new_i_size + PAGE_SIZE - 1, 0, 1); ++ truncate_inode_pages(inode->i_mapping, new_i_size); + status = ocfs2_truncate_inline(inode, di_bh, new_i_size, + i_size_read(inode), 1); + if (status) +@@ -512,6 +513,9 @@ int ocfs2_truncate_file(struct inode *inode, + goto bail_unlock_sem; + } + ++ unmap_mapping_range(inode->i_mapping, new_i_size + PAGE_SIZE - 1, 0, 1); ++ truncate_inode_pages(inode->i_mapping, new_i_size); ++ + status = ocfs2_commit_truncate(osb, inode, di_bh); + if (status < 0) { + mlog_errno(status); +diff --git a/fs/orangefs/dcache.c b/fs/orangefs/dcache.c +index ae782df5c063e..f764f4ba2411c 100644 +--- a/fs/orangefs/dcache.c ++++ b/fs/orangefs/dcache.c +@@ -26,8 +26,10 @@ static int orangefs_revalidate_lookup(struct dentry *dentry) + gossip_debug(GOSSIP_DCACHE_DEBUG, "%s: attempting lookup.\n", __func__); + + new_op = op_alloc(ORANGEFS_VFS_OP_LOOKUP); +- if (!new_op) ++ if (!new_op) { ++ ret = -ENOMEM; + goto out_put_parent; ++ } + + new_op->upcall.req.lookup.sym_follow = ORANGEFS_LOOKUP_LINK_NO_FOLLOW; + new_op->upcall.req.lookup.parent_refn = parent->refn; +diff --git a/fs/quota/quota_tree.c b/fs/quota/quota_tree.c +index 656f9ff63edda..833cd3e3758bf 100644 +--- a/fs/quota/quota_tree.c ++++ b/fs/quota/quota_tree.c +@@ -422,6 +422,7 @@ static int free_dqentry(struct qtree_mem_dqinfo *info, struct dquot *dquot, + quota_error(dquot->dq_sb, "Quota structure has offset to " + "other block (%u) than it should (%u)", blk, + (uint)(dquot->dq_off >> info->dqi_blocksize_bits)); ++ ret = -EIO; + goto out_buf; + } + ret = read_blk(info, blk, buf); +@@ -487,6 +488,13 @@ static int remove_tree(struct qtree_mem_dqinfo *info, struct dquot *dquot, + goto out_buf; + } + newblk = le32_to_cpu(ref[get_index(info, dquot->dq_id, depth)]); ++ if (newblk < QT_TREEOFF || newblk >= info->dqi_blocks) { ++ quota_error(dquot->dq_sb, "Getting block too big (%u >= %u)", ++ newblk, info->dqi_blocks); ++ ret = -EUCLEAN; ++ goto out_buf; ++ } ++ + if (depth == info->dqi_qtree_depth - 1) { + ret = free_dqentry(info, dquot, newblk); + newblk = 0; +@@ -586,6 +594,13 @@ static loff_t find_tree_dqentry(struct qtree_mem_dqinfo *info, + blk = le32_to_cpu(ref[get_index(info, dquot->dq_id, depth)]); + if (!blk) /* No reference? */ + goto out_buf; ++ if (blk < QT_TREEOFF || blk >= info->dqi_blocks) { ++ quota_error(dquot->dq_sb, "Getting block too big (%u >= %u)", ++ blk, info->dqi_blocks); ++ ret = -EUCLEAN; ++ goto out_buf; ++ } ++ + if (depth < info->dqi_qtree_depth - 1) + ret = find_tree_dqentry(info, dquot, blk, depth+1); + else +diff --git a/fs/tracefs/inode.c b/fs/tracefs/inode.c +index bea8ad876bf9a..0c123c5e70e08 100644 +--- a/fs/tracefs/inode.c ++++ b/fs/tracefs/inode.c +@@ -427,7 +427,8 @@ static struct dentry *__create_dir(const char *name, struct dentry *parent, + if (unlikely(!inode)) + return failed_creating(dentry); + +- inode->i_mode = S_IFDIR | S_IRWXU | S_IRUGO | S_IXUGO; ++ /* Do not set bits for OTH */ ++ inode->i_mode = S_IFDIR | S_IRWXU | S_IRUSR| S_IRGRP | S_IXUSR | S_IXGRP; + inode->i_op = ops; + inode->i_fop = &simple_dir_operations; + +diff --git a/include/linux/console.h b/include/linux/console.h +index b8920a031a3e3..beed8b1cb7e5c 100644 +--- a/include/linux/console.h ++++ b/include/linux/console.h +@@ -145,6 +145,8 @@ struct console { + short flags; + short index; + int cflag; ++ uint ispeed; ++ uint ospeed; + void *data; + struct console *next; + }; +diff --git a/include/linux/filter.h b/include/linux/filter.h +index 5ca676d646529..7c0e616362f05 100644 +--- a/include/linux/filter.h ++++ b/include/linux/filter.h +@@ -730,6 +730,7 @@ extern int bpf_jit_enable; + extern int bpf_jit_harden; + extern int bpf_jit_kallsyms; + extern long bpf_jit_limit; ++extern long bpf_jit_limit_max; + + typedef void (*bpf_jit_fill_hole_t)(void *area, unsigned int size); + +diff --git a/include/linux/libata.h b/include/linux/libata.h +index 23bc460e6d863..0e9f8fd37eb9d 100644 +--- a/include/linux/libata.h ++++ b/include/linux/libata.h +@@ -409,7 +409,7 @@ enum { + /* This should match the actual table size of + * ata_eh_cmd_timeout_table in libata-eh.c. + */ +- ATA_EH_CMD_TIMEOUT_TABLE_SIZE = 6, ++ ATA_EH_CMD_TIMEOUT_TABLE_SIZE = 7, + + /* Horkage types. May be set by libata or controller on drives + (some horkage may be drive/controller pair dependent */ +diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h +index c9258124e4175..569debc49f3d7 100644 +--- a/include/linux/lsm_hooks.h ++++ b/include/linux/lsm_hooks.h +@@ -1170,22 +1170,22 @@ + * + * @binder_set_context_mgr: + * Check whether @mgr is allowed to be the binder context manager. +- * @mgr contains the task_struct for the task being registered. ++ * @mgr contains the struct cred for the current binder process. + * Return 0 if permission is granted. + * @binder_transaction: + * Check whether @from is allowed to invoke a binder transaction call + * to @to. +- * @from contains the task_struct for the sending task. +- * @to contains the task_struct for the receiving task. ++ * @from contains the struct cred for the sending process. ++ * @to contains the struct cred for the receiving process. + * @binder_transfer_binder: + * Check whether @from is allowed to transfer a binder reference to @to. +- * @from contains the task_struct for the sending task. +- * @to contains the task_struct for the receiving task. ++ * @from contains the struct cred for the sending process. ++ * @to contains the struct cred for the receiving process. + * @binder_transfer_file: + * Check whether @from is allowed to transfer @file to @to. +- * @from contains the task_struct for the sending task. ++ * @from contains the struct cred for the sending process. + * @file contains the struct file being transferred. +- * @to contains the task_struct for the receiving task. ++ * @to contains the struct cred for the receiving process. + * + * @ptrace_access_check: + * Check permission before allowing the current process to trace the +@@ -1353,13 +1353,13 @@ + * @ctxlen points to the place to put the length of @ctx. + */ + union security_list_options { +- int (*binder_set_context_mgr)(struct task_struct *mgr); +- int (*binder_transaction)(struct task_struct *from, +- struct task_struct *to); +- int (*binder_transfer_binder)(struct task_struct *from, +- struct task_struct *to); +- int (*binder_transfer_file)(struct task_struct *from, +- struct task_struct *to, ++ int (*binder_set_context_mgr)(const struct cred *mgr); ++ int (*binder_transaction)(const struct cred *from, ++ const struct cred *to); ++ int (*binder_transfer_binder)(const struct cred *from, ++ const struct cred *to); ++ int (*binder_transfer_file)(const struct cred *from, ++ const struct cred *to, + struct file *file); + + int (*ptrace_access_check)(struct task_struct *child, +diff --git a/include/linux/rpmsg.h b/include/linux/rpmsg.h +index 10d6ae8bbb7df..1ab79e8dc0b8f 100644 +--- a/include/linux/rpmsg.h ++++ b/include/linux/rpmsg.h +@@ -202,7 +202,7 @@ static inline struct rpmsg_endpoint *rpmsg_create_ept(struct rpmsg_device *rpdev + /* This shouldn't be possible */ + WARN_ON(1); + +- return ERR_PTR(-ENXIO); ++ return NULL; + } + + static inline int rpmsg_send(struct rpmsg_endpoint *ept, void *data, int len) +diff --git a/include/linux/sched/task_stack.h b/include/linux/sched/task_stack.h +index cb4828aaa34fd..3461beb89b040 100644 +--- a/include/linux/sched/task_stack.h ++++ b/include/linux/sched/task_stack.h +@@ -25,7 +25,11 @@ static inline void *task_stack_page(const struct task_struct *task) + + static inline unsigned long *end_of_stack(const struct task_struct *task) + { ++#ifdef CONFIG_STACK_GROWSUP ++ return (unsigned long *)((unsigned long)task->stack + THREAD_SIZE) - 1; ++#else + return task->stack; ++#endif + } + + #elif !defined(__HAVE_THREAD_FUNCTIONS) +diff --git a/include/linux/security.h b/include/linux/security.h +index dab093af4ee8d..1c8968a267c2b 100644 +--- a/include/linux/security.h ++++ b/include/linux/security.h +@@ -197,13 +197,13 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts) + extern int security_init(void); + + /* Security operations */ +-int security_binder_set_context_mgr(struct task_struct *mgr); +-int security_binder_transaction(struct task_struct *from, +- struct task_struct *to); +-int security_binder_transfer_binder(struct task_struct *from, +- struct task_struct *to); +-int security_binder_transfer_file(struct task_struct *from, +- struct task_struct *to, struct file *file); ++int security_binder_set_context_mgr(const struct cred *mgr); ++int security_binder_transaction(const struct cred *from, ++ const struct cred *to); ++int security_binder_transfer_binder(const struct cred *from, ++ const struct cred *to); ++int security_binder_transfer_file(const struct cred *from, ++ const struct cred *to, struct file *file); + int security_ptrace_access_check(struct task_struct *child, unsigned int mode); + int security_ptrace_traceme(struct task_struct *parent); + int security_capget(struct task_struct *target, +@@ -424,25 +424,25 @@ static inline int security_init(void) + return 0; + } + +-static inline int security_binder_set_context_mgr(struct task_struct *mgr) ++static inline int security_binder_set_context_mgr(const struct cred *mgr) + { + return 0; + } + +-static inline int security_binder_transaction(struct task_struct *from, +- struct task_struct *to) ++static inline int security_binder_transaction(const struct cred *from, ++ const struct cred *to) + { + return 0; + } + +-static inline int security_binder_transfer_binder(struct task_struct *from, +- struct task_struct *to) ++static inline int security_binder_transfer_binder(const struct cred *from, ++ const struct cred *to) + { + return 0; + } + +-static inline int security_binder_transfer_file(struct task_struct *from, +- struct task_struct *to, ++static inline int security_binder_transfer_file(const struct cred *from, ++ const struct cred *to, + struct file *file) + { + return 0; +diff --git a/include/linux/virtio_net.h b/include/linux/virtio_net.h +index ca68826d84495..162761f72c142 100644 +--- a/include/linux/virtio_net.h ++++ b/include/linux/virtio_net.h +@@ -118,10 +118,15 @@ retry: + + if (hdr->gso_type != VIRTIO_NET_HDR_GSO_NONE) { + u16 gso_size = __virtio16_to_cpu(little_endian, hdr->gso_size); ++ unsigned int nh_off = p_off; + struct skb_shared_info *shinfo = skb_shinfo(skb); + ++ /* UFO may not include transport header in gso_size. */ ++ if (gso_type & SKB_GSO_UDP) ++ nh_off -= thlen; ++ + /* Too small packets are not really GSO ones. */ +- if (skb->len - p_off > gso_size) { ++ if (skb->len - nh_off > gso_size) { + shinfo->gso_size = gso_size; + shinfo->gso_type = gso_type; + +diff --git a/include/net/llc.h b/include/net/llc.h +index df282d9b40170..9c10b121b49b0 100644 +--- a/include/net/llc.h ++++ b/include/net/llc.h +@@ -72,7 +72,9 @@ struct llc_sap { + static inline + struct hlist_head *llc_sk_dev_hash(struct llc_sap *sap, int ifindex) + { +- return &sap->sk_dev_hash[ifindex % LLC_SK_DEV_HASH_ENTRIES]; ++ u32 bucket = hash_32(ifindex, LLC_SK_DEV_HASH_BITS); ++ ++ return &sap->sk_dev_hash[bucket]; + } + + static inline +diff --git a/include/rdma/rdma_netlink.h b/include/rdma/rdma_netlink.h +index c369703fcd69c..36cdc17de6909 100644 +--- a/include/rdma/rdma_netlink.h ++++ b/include/rdma/rdma_netlink.h +@@ -24,7 +24,7 @@ enum rdma_nl_flags { + * constant as well and the compiler checks they are the same. + */ + #define MODULE_ALIAS_RDMA_NETLINK(_index, _val) \ +- static inline void __chk_##_index(void) \ ++ static inline void __maybe_unused __chk_##_index(void) \ + { \ + BUILD_BUG_ON(_index != _val); \ + } \ +diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h +index 0d924e968c94b..336c9f71b750a 100644 +--- a/include/target/target_core_base.h ++++ b/include/target/target_core_base.h +@@ -771,8 +771,9 @@ struct se_device { + atomic_long_t read_bytes; + atomic_long_t write_bytes; + /* Active commands on this virtual SE device */ +- atomic_t simple_cmds; +- atomic_t dev_ordered_sync; ++ atomic_t non_ordered; ++ bool ordered_sync_in_progress; ++ atomic_t delayed_cmd_count; + atomic_t dev_qf_count; + u32 export_count; + spinlock_t delayed_cmd_lock; +@@ -795,6 +796,7 @@ struct se_device { + struct list_head dev_tmr_list; + struct workqueue_struct *tmr_wq; + struct work_struct qf_work_queue; ++ struct work_struct delayed_cmd_work; + struct list_head delayed_cmd_list; + struct list_head state_list; + struct list_head qf_cmd_list; +diff --git a/include/uapi/linux/pci_regs.h b/include/uapi/linux/pci_regs.h +index 87c2c840b27d4..c843929e0c4fe 100644 +--- a/include/uapi/linux/pci_regs.h ++++ b/include/uapi/linux/pci_regs.h +@@ -497,6 +497,12 @@ + #define PCI_EXP_DEVCTL_URRE 0x0008 /* Unsupported Request Reporting En. */ + #define PCI_EXP_DEVCTL_RELAX_EN 0x0010 /* Enable relaxed ordering */ + #define PCI_EXP_DEVCTL_PAYLOAD 0x00e0 /* Max_Payload_Size */ ++#define PCI_EXP_DEVCTL_PAYLOAD_128B 0x0000 /* 128 Bytes */ ++#define PCI_EXP_DEVCTL_PAYLOAD_256B 0x0020 /* 256 Bytes */ ++#define PCI_EXP_DEVCTL_PAYLOAD_512B 0x0040 /* 512 Bytes */ ++#define PCI_EXP_DEVCTL_PAYLOAD_1024B 0x0060 /* 1024 Bytes */ ++#define PCI_EXP_DEVCTL_PAYLOAD_2048B 0x0080 /* 2048 Bytes */ ++#define PCI_EXP_DEVCTL_PAYLOAD_4096B 0x00a0 /* 4096 Bytes */ + #define PCI_EXP_DEVCTL_EXT_TAG 0x0100 /* Extended Tag Field Enable */ + #define PCI_EXP_DEVCTL_PHANTOM 0x0200 /* Phantom Functions Enable */ + #define PCI_EXP_DEVCTL_AUX_PME 0x0400 /* Auxiliary Power PM Enable */ +diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c +index e7211b0fa27cf..485e319ba742a 100644 +--- a/kernel/bpf/core.c ++++ b/kernel/bpf/core.c +@@ -295,6 +295,7 @@ int bpf_jit_enable __read_mostly = IS_BUILTIN(CONFIG_BPF_JIT_ALWAYS_ON); + int bpf_jit_harden __read_mostly; + int bpf_jit_kallsyms __read_mostly; + long bpf_jit_limit __read_mostly; ++long bpf_jit_limit_max __read_mostly; + + static __always_inline void + bpf_get_prog_addr_region(const struct bpf_prog *prog, +@@ -508,7 +509,8 @@ u64 __weak bpf_jit_alloc_exec_limit(void) + static int __init bpf_jit_charge_init(void) + { + /* Only used as heuristic here to derive limit. */ +- bpf_jit_limit = min_t(u64, round_up(bpf_jit_alloc_exec_limit() >> 2, ++ bpf_jit_limit_max = bpf_jit_alloc_exec_limit(); ++ bpf_jit_limit = min_t(u64, round_up(bpf_jit_limit_max >> 2, + PAGE_SIZE), LONG_MAX); + return 0; + } +diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c +index 99783685f3d90..d5044ca33bd0b 100644 +--- a/kernel/cgroup/cgroup.c ++++ b/kernel/cgroup/cgroup.c +@@ -1599,6 +1599,7 @@ int rebind_subsystems(struct cgroup_root *dst_root, u16 ss_mask) + struct cgroup *dcgrp = &dst_root->cgrp; + struct cgroup_subsys *ss; + int ssid, i, ret; ++ u16 dfl_disable_ss_mask = 0; + + lockdep_assert_held(&cgroup_mutex); + +@@ -1615,8 +1616,28 @@ int rebind_subsystems(struct cgroup_root *dst_root, u16 ss_mask) + /* can't move between two non-dummy roots either */ + if (ss->root != &cgrp_dfl_root && dst_root != &cgrp_dfl_root) + return -EBUSY; ++ ++ /* ++ * Collect ssid's that need to be disabled from default ++ * hierarchy. ++ */ ++ if (ss->root == &cgrp_dfl_root) ++ dfl_disable_ss_mask |= 1 << ssid; ++ + } while_each_subsys_mask(); + ++ if (dfl_disable_ss_mask) { ++ struct cgroup *scgrp = &cgrp_dfl_root.cgrp; ++ ++ /* ++ * Controllers from default hierarchy that need to be rebound ++ * are all disabled together in one go. ++ */ ++ cgrp_dfl_root.subsys_mask &= ~dfl_disable_ss_mask; ++ WARN_ON(cgroup_apply_control(scgrp)); ++ cgroup_finalize_control(scgrp, 0); ++ } ++ + do_each_subsys_mask(ss, ssid, ss_mask) { + struct cgroup_root *src_root = ss->root; + struct cgroup *scgrp = &src_root->cgrp; +@@ -1625,10 +1646,12 @@ int rebind_subsystems(struct cgroup_root *dst_root, u16 ss_mask) + + WARN_ON(!css || cgroup_css(dcgrp, ss)); + +- /* disable from the source */ +- src_root->subsys_mask &= ~(1 << ssid); +- WARN_ON(cgroup_apply_control(scgrp)); +- cgroup_finalize_control(scgrp, 0); ++ if (src_root != &cgrp_dfl_root) { ++ /* disable from the source */ ++ src_root->subsys_mask &= ~(1 << ssid); ++ WARN_ON(cgroup_apply_control(scgrp)); ++ cgroup_finalize_control(scgrp, 0); ++ } + + /* rebind */ + RCU_INIT_POINTER(scgrp->subsys[ssid], NULL); +diff --git a/kernel/events/core.c b/kernel/events/core.c +index 236e7900e3fca..0736508d595b2 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -6110,7 +6110,6 @@ void perf_output_sample(struct perf_output_handle *handle, + static u64 perf_virt_to_phys(u64 virt) + { + u64 phys_addr = 0; +- struct page *p = NULL; + + if (!virt) + return 0; +@@ -6129,14 +6128,15 @@ static u64 perf_virt_to_phys(u64 virt) + * If failed, leave phys_addr as 0. + */ + if (current->mm != NULL) { ++ struct page *p; ++ + pagefault_disable(); +- if (__get_user_pages_fast(virt, 1, 0, &p) == 1) ++ if (__get_user_pages_fast(virt, 1, 0, &p) == 1) { + phys_addr = page_to_phys(p) + virt % PAGE_SIZE; ++ put_page(p); ++ } + pagefault_enable(); + } +- +- if (p) +- put_page(p); + } + + return phys_addr; +diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c +index 03e3ab61a2edd..ac0725b1ada75 100644 +--- a/kernel/locking/lockdep.c ++++ b/kernel/locking/lockdep.c +@@ -713,7 +713,7 @@ look_up_lock_class(struct lockdep_map *lock, unsigned int subclass) + if (DEBUG_LOCKS_WARN_ON(!irqs_disabled())) + return NULL; + +- hlist_for_each_entry_rcu(class, hash_head, hash_entry) { ++ hlist_for_each_entry_rcu_notrace(class, hash_head, hash_entry) { + if (class->key == key) { + /* + * Huh! same key, different name? Did someone trample +diff --git a/kernel/power/swap.c b/kernel/power/swap.c +index d7cdc426ee380..8b37085a66903 100644 +--- a/kernel/power/swap.c ++++ b/kernel/power/swap.c +@@ -292,7 +292,7 @@ static int hib_submit_io(int op, int op_flags, pgoff_t page_off, void *addr, + return error; + } + +-static blk_status_t hib_wait_io(struct hib_bio_batch *hb) ++static int hib_wait_io(struct hib_bio_batch *hb) + { + wait_event(hb->wait, atomic_read(&hb->count) == 0); + return blk_status_to_errno(hb->error); +@@ -1526,9 +1526,10 @@ end: + int swsusp_check(void) + { + int error; ++ void *holder; + + hib_resume_bdev = blkdev_get_by_dev(swsusp_resume_device, +- FMODE_READ, NULL); ++ FMODE_READ | FMODE_EXCL, &holder); + if (!IS_ERR(hib_resume_bdev)) { + set_blocksize(hib_resume_bdev, PAGE_SIZE); + clear_page(swsusp_header); +@@ -1550,7 +1551,7 @@ int swsusp_check(void) + + put: + if (error) +- blkdev_put(hib_resume_bdev, FMODE_READ); ++ blkdev_put(hib_resume_bdev, FMODE_READ | FMODE_EXCL); + else + pr_debug("PM: Image signature found, resuming\n"); + } else { +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index 7cedada731c1b..544a1cb66d90d 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -1852,6 +1852,9 @@ out: + + bool cpus_share_cache(int this_cpu, int that_cpu) + { ++ if (this_cpu == that_cpu) ++ return true; ++ + return per_cpu(sd_llc_id, this_cpu) == per_cpu(sd_llc_id, that_cpu); + } + #endif /* CONFIG_SMP */ +diff --git a/kernel/signal.c b/kernel/signal.c +index deb36b35c30be..3619ab24644f5 100644 +--- a/kernel/signal.c ++++ b/kernel/signal.c +@@ -1838,16 +1838,6 @@ static inline int may_ptrace_stop(void) + return 1; + } + +-/* +- * Return non-zero if there is a SIGKILL that should be waking us up. +- * Called with the siglock held. +- */ +-static int sigkill_pending(struct task_struct *tsk) +-{ +- return sigismember(&tsk->pending.signal, SIGKILL) || +- sigismember(&tsk->signal->shared_pending.signal, SIGKILL); +-} +- + /* + * This must be called with current->sighand->siglock held. + * +@@ -1873,17 +1863,16 @@ static void ptrace_stop(int exit_code, int why, int clear_code, siginfo_t *info) + * calling arch_ptrace_stop, so we must release it now. + * To preserve proper semantics, we must do this before + * any signal bookkeeping like checking group_stop_count. +- * Meanwhile, a SIGKILL could come in before we retake the +- * siglock. That must prevent us from sleeping in TASK_TRACED. +- * So after regaining the lock, we must check for SIGKILL. + */ + spin_unlock_irq(¤t->sighand->siglock); + arch_ptrace_stop(exit_code, info); + spin_lock_irq(¤t->sighand->siglock); +- if (sigkill_pending(current)) +- return; + } + ++ /* ++ * schedule() will not sleep if there is a pending signal that ++ * can awaken the task. ++ */ + set_special_state(TASK_TRACED); + + /* +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c +index 552104837845f..cb4f6f9e27059 100644 +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -1723,8 +1723,15 @@ void tracing_reset_all_online_cpus(void) + } + } + ++/* ++ * The tgid_map array maps from pid to tgid; i.e. the value stored at index i ++ * is the tgid last observed corresponding to pid=i. ++ */ + static int *tgid_map; + ++/* The maximum valid index into tgid_map. */ ++static size_t tgid_map_max; ++ + #define SAVED_CMDLINES_DEFAULT 128 + #define NO_CMDLINE_MAP UINT_MAX + static arch_spinlock_t trace_cmdline_lock = __ARCH_SPIN_LOCK_UNLOCKED; +@@ -1996,24 +2003,41 @@ void trace_find_cmdline(int pid, char comm[]) + preempt_enable(); + } + ++static int *trace_find_tgid_ptr(int pid) ++{ ++ /* ++ * Pairs with the smp_store_release in set_tracer_flag() to ensure that ++ * if we observe a non-NULL tgid_map then we also observe the correct ++ * tgid_map_max. ++ */ ++ int *map = smp_load_acquire(&tgid_map); ++ ++ if (unlikely(!map || pid > tgid_map_max)) ++ return NULL; ++ ++ return &map[pid]; ++} ++ + int trace_find_tgid(int pid) + { +- if (unlikely(!tgid_map || !pid || pid > PID_MAX_DEFAULT)) +- return 0; ++ int *ptr = trace_find_tgid_ptr(pid); + +- return tgid_map[pid]; ++ return ptr ? *ptr : 0; + } + + static int trace_save_tgid(struct task_struct *tsk) + { ++ int *ptr; ++ + /* treat recording of idle task as a success */ + if (!tsk->pid) + return 1; + +- if (unlikely(!tgid_map || tsk->pid > PID_MAX_DEFAULT)) ++ ptr = trace_find_tgid_ptr(tsk->pid); ++ if (!ptr) + return 0; + +- tgid_map[tsk->pid] = tsk->tgid; ++ *ptr = tsk->tgid; + return 1; + } + +@@ -4353,6 +4377,8 @@ int trace_keep_overwrite(struct tracer *tracer, u32 mask, int set) + + int set_tracer_flag(struct trace_array *tr, unsigned int mask, int enabled) + { ++ int *map; ++ + if ((mask == TRACE_ITER_RECORD_TGID) || + (mask == TRACE_ITER_RECORD_CMD)) + lockdep_assert_held(&event_mutex); +@@ -4375,9 +4401,19 @@ int set_tracer_flag(struct trace_array *tr, unsigned int mask, int enabled) + trace_event_enable_cmd_record(enabled); + + if (mask == TRACE_ITER_RECORD_TGID) { +- if (!tgid_map) +- tgid_map = kzalloc((PID_MAX_DEFAULT + 1) * sizeof(*tgid_map), +- GFP_KERNEL); ++ if (!tgid_map) { ++ tgid_map_max = pid_max; ++ map = kzalloc((tgid_map_max + 1) * sizeof(*tgid_map), ++ GFP_KERNEL); ++ ++ /* ++ * Pairs with smp_load_acquire() in ++ * trace_find_tgid_ptr() to ensure that if it observes ++ * the tgid_map we just allocated then it also observes ++ * the corresponding tgid_map_max value. ++ */ ++ smp_store_release(&tgid_map, map); ++ } + if (!tgid_map) { + tr->trace_flags &= ~TRACE_ITER_RECORD_TGID; + return -ENOMEM; +@@ -4752,18 +4788,14 @@ static void *saved_tgids_next(struct seq_file *m, void *v, loff_t *pos) + { + int pid = ++(*pos); + +- if (pid > PID_MAX_DEFAULT) +- return NULL; +- +- return &tgid_map[pid]; ++ return trace_find_tgid_ptr(pid); + } + + static void *saved_tgids_start(struct seq_file *m, loff_t *pos) + { +- if (!tgid_map || *pos > PID_MAX_DEFAULT) +- return NULL; ++ int pid = *pos; + +- return &tgid_map[*pos]; ++ return trace_find_tgid_ptr(pid); + } + + static void saved_tgids_stop(struct seq_file *m, void *v) +diff --git a/kernel/trace/tracing_map.c b/kernel/trace/tracing_map.c +index 35b2ba07f3c6f..379db35838b64 100644 +--- a/kernel/trace/tracing_map.c ++++ b/kernel/trace/tracing_map.c +@@ -703,29 +703,35 @@ int tracing_map_init(struct tracing_map *map) + return err; + } + +-static int cmp_entries_dup(const struct tracing_map_sort_entry **a, +- const struct tracing_map_sort_entry **b) ++static int cmp_entries_dup(const void *A, const void *B) + { ++ const struct tracing_map_sort_entry *a, *b; + int ret = 0; + +- if (memcmp((*a)->key, (*b)->key, (*a)->elt->map->key_size)) ++ a = *(const struct tracing_map_sort_entry **)A; ++ b = *(const struct tracing_map_sort_entry **)B; ++ ++ if (memcmp(a->key, b->key, a->elt->map->key_size)) + ret = 1; + + return ret; + } + +-static int cmp_entries_sum(const struct tracing_map_sort_entry **a, +- const struct tracing_map_sort_entry **b) ++static int cmp_entries_sum(const void *A, const void *B) + { + const struct tracing_map_elt *elt_a, *elt_b; ++ const struct tracing_map_sort_entry *a, *b; + struct tracing_map_sort_key *sort_key; + struct tracing_map_field *field; + tracing_map_cmp_fn_t cmp_fn; + void *val_a, *val_b; + int ret = 0; + +- elt_a = (*a)->elt; +- elt_b = (*b)->elt; ++ a = *(const struct tracing_map_sort_entry **)A; ++ b = *(const struct tracing_map_sort_entry **)B; ++ ++ elt_a = a->elt; ++ elt_b = b->elt; + + sort_key = &elt_a->map->sort_key; + +@@ -742,18 +748,21 @@ static int cmp_entries_sum(const struct tracing_map_sort_entry **a, + return ret; + } + +-static int cmp_entries_key(const struct tracing_map_sort_entry **a, +- const struct tracing_map_sort_entry **b) ++static int cmp_entries_key(const void *A, const void *B) + { + const struct tracing_map_elt *elt_a, *elt_b; ++ const struct tracing_map_sort_entry *a, *b; + struct tracing_map_sort_key *sort_key; + struct tracing_map_field *field; + tracing_map_cmp_fn_t cmp_fn; + void *val_a, *val_b; + int ret = 0; + +- elt_a = (*a)->elt; +- elt_b = (*b)->elt; ++ a = *(const struct tracing_map_sort_entry **)A; ++ b = *(const struct tracing_map_sort_entry **)B; ++ ++ elt_a = a->elt; ++ elt_b = b->elt; + + sort_key = &elt_a->map->sort_key; + +@@ -926,10 +935,8 @@ static void sort_secondary(struct tracing_map *map, + struct tracing_map_sort_key *primary_key, + struct tracing_map_sort_key *secondary_key) + { +- int (*primary_fn)(const struct tracing_map_sort_entry **, +- const struct tracing_map_sort_entry **); +- int (*secondary_fn)(const struct tracing_map_sort_entry **, +- const struct tracing_map_sort_entry **); ++ int (*primary_fn)(const void *, const void *); ++ int (*secondary_fn)(const void *, const void *); + unsigned i, start = 0, n_sub = 1; + + if (is_key(map, primary_key->field_idx)) +@@ -998,8 +1005,7 @@ int tracing_map_sort_entries(struct tracing_map *map, + unsigned int n_sort_keys, + struct tracing_map_sort_entry ***sort_entries) + { +- int (*cmp_entries_fn)(const struct tracing_map_sort_entry **, +- const struct tracing_map_sort_entry **); ++ int (*cmp_entries_fn)(const void *, const void *); + struct tracing_map_sort_entry *sort_entry, **entries; + int i, n_entries, ret; + +diff --git a/lib/decompress_unxz.c b/lib/decompress_unxz.c +index 25d59a95bd668..abea25310ac73 100644 +--- a/lib/decompress_unxz.c ++++ b/lib/decompress_unxz.c +@@ -167,7 +167,7 @@ + * memeq and memzero are not used much and any remotely sane implementation + * is fast enough. memcpy/memmove speed matters in multi-call mode, but + * the kernel image is decompressed in single-call mode, in which only +- * memcpy speed can matter and only if there is a lot of uncompressible data ++ * memmove speed can matter and only if there is a lot of uncompressible data + * (LZMA2 stores uncompressible chunks in uncompressed form). Thus, the + * functions below should just be kept small; it's probably not worth + * optimizing for speed. +diff --git a/lib/xz/xz_dec_lzma2.c b/lib/xz/xz_dec_lzma2.c +index 08c3c80499983..2c5197d6b944d 100644 +--- a/lib/xz/xz_dec_lzma2.c ++++ b/lib/xz/xz_dec_lzma2.c +@@ -387,7 +387,14 @@ static void dict_uncompressed(struct dictionary *dict, struct xz_buf *b, + + *left -= copy_size; + +- memcpy(dict->buf + dict->pos, b->in + b->in_pos, copy_size); ++ /* ++ * If doing in-place decompression in single-call mode and the ++ * uncompressed size of the file is larger than the caller ++ * thought (i.e. it is invalid input!), the buffers below may ++ * overlap and cause undefined behavior with memcpy(). ++ * With valid inputs memcpy() would be fine here. ++ */ ++ memmove(dict->buf + dict->pos, b->in + b->in_pos, copy_size); + dict->pos += copy_size; + + if (dict->full < dict->pos) +@@ -397,7 +404,11 @@ static void dict_uncompressed(struct dictionary *dict, struct xz_buf *b, + if (dict->pos == dict->end) + dict->pos = 0; + +- memcpy(b->out + b->out_pos, b->in + b->in_pos, ++ /* ++ * Like above but for multi-call mode: use memmove() ++ * to avoid undefined behavior with invalid input. ++ */ ++ memmove(b->out + b->out_pos, b->in + b->in_pos, + copy_size); + } + +@@ -421,6 +432,12 @@ static uint32_t dict_flush(struct dictionary *dict, struct xz_buf *b) + if (dict->pos == dict->end) + dict->pos = 0; + ++ /* ++ * These buffers cannot overlap even if doing in-place ++ * decompression because in multi-call mode dict->buf ++ * has been allocated by us in this file; it's not ++ * provided by the caller like in single-call mode. ++ */ + memcpy(b->out + b->out_pos, dict->buf + dict->start, + copy_size); + } +diff --git a/lib/xz/xz_dec_stream.c b/lib/xz/xz_dec_stream.c +index ac809b1e64f78..9e5b9ab537fea 100644 +--- a/lib/xz/xz_dec_stream.c ++++ b/lib/xz/xz_dec_stream.c +@@ -402,12 +402,12 @@ static enum xz_ret dec_stream_header(struct xz_dec *s) + * we will accept other check types too, but then the check won't + * be verified and a warning (XZ_UNSUPPORTED_CHECK) will be given. + */ ++ if (s->temp.buf[HEADER_MAGIC_SIZE + 1] > XZ_CHECK_MAX) ++ return XZ_OPTIONS_ERROR; ++ + s->check_type = s->temp.buf[HEADER_MAGIC_SIZE + 1]; + + #ifdef XZ_DEC_ANY_CHECK +- if (s->check_type > XZ_CHECK_MAX) +- return XZ_OPTIONS_ERROR; +- + if (s->check_type > XZ_CHECK_CRC32) + return XZ_UNSUPPORTED_CHECK; + #else +diff --git a/mm/oom_kill.c b/mm/oom_kill.c +index 6f1bed2111226..1fbed138554fe 100644 +--- a/mm/oom_kill.c ++++ b/mm/oom_kill.c +@@ -1095,25 +1095,22 @@ bool out_of_memory(struct oom_control *oc) + } + + /* +- * The pagefault handler calls here because it is out of memory, so kill a +- * memory-hogging task. If oom_lock is held by somebody else, a parallel oom +- * killing is already in progress so do nothing. ++ * The pagefault handler calls here because some allocation has failed. We have ++ * to take care of the memcg OOM here because this is the only safe context without ++ * any locks held but let the oom killer triggered from the allocation context care ++ * about the global OOM. + */ + void pagefault_out_of_memory(void) + { +- struct oom_control oc = { +- .zonelist = NULL, +- .nodemask = NULL, +- .memcg = NULL, +- .gfp_mask = 0, +- .order = 0, +- }; ++ static DEFINE_RATELIMIT_STATE(pfoom_rs, DEFAULT_RATELIMIT_INTERVAL, ++ DEFAULT_RATELIMIT_BURST); + + if (mem_cgroup_oom_synchronize(true)) + return; + +- if (!mutex_trylock(&oom_lock)) ++ if (fatal_signal_pending(current)) + return; +- out_of_memory(&oc); +- mutex_unlock(&oom_lock); ++ ++ if (__ratelimit(&pfoom_rs)) ++ pr_warn("Huh VM_FAULT_OOM leaked out to the #PF handler. Retrying PF\n"); + } +diff --git a/mm/slab.h b/mm/slab.h +index 485d9fbb8802f..93a2c91f5b43c 100644 +--- a/mm/slab.h ++++ b/mm/slab.h +@@ -146,7 +146,7 @@ static inline unsigned long kmem_cache_flags(unsigned long object_size, + #define SLAB_CACHE_FLAGS (SLAB_NOLEAKTRACE | SLAB_RECLAIM_ACCOUNT | \ + SLAB_TEMPORARY | SLAB_ACCOUNT) + #else +-#define SLAB_CACHE_FLAGS (0) ++#define SLAB_CACHE_FLAGS (SLAB_NOLEAKTRACE) + #endif + + /* Common flags available with current configuration */ +diff --git a/mm/zsmalloc.c b/mm/zsmalloc.c +index 633ebcac82f8d..6cdb49ae00010 100644 +--- a/mm/zsmalloc.c ++++ b/mm/zsmalloc.c +@@ -1901,10 +1901,11 @@ static inline void zs_pool_dec_isolated(struct zs_pool *pool) + VM_BUG_ON(atomic_long_read(&pool->isolated_pages) <= 0); + atomic_long_dec(&pool->isolated_pages); + /* +- * There's no possibility of racing, since wait_for_isolated_drain() +- * checks the isolated count under &class->lock after enqueuing +- * on migration_wait. ++ * Checking pool->destroying must happen after atomic_long_dec() ++ * for pool->isolated_pages above. Paired with the smp_mb() in ++ * zs_unregister_migration(). + */ ++ smp_mb__after_atomic(); + if (atomic_long_read(&pool->isolated_pages) == 0 && pool->destroying) + wake_up_all(&pool->migration_wait); + } +diff --git a/net/batman-adv/bridge_loop_avoidance.c b/net/batman-adv/bridge_loop_avoidance.c +index 12ecde765003f..89afb90458f41 100644 +--- a/net/batman-adv/bridge_loop_avoidance.c ++++ b/net/batman-adv/bridge_loop_avoidance.c +@@ -1598,13 +1598,16 @@ int batadv_bla_init(struct batadv_priv *bat_priv) + } + + /** +- * batadv_bla_check_bcast_duplist - Check if a frame is in the broadcast dup. ++ * batadv_bla_check_duplist() - Check if a frame is in the broadcast dup. + * @bat_priv: the bat priv with all the soft interface information +- * @skb: contains the bcast_packet to be checked ++ * @skb: contains the multicast packet to be checked ++ * @payload_ptr: pointer to position inside the head buffer of the skb ++ * marking the start of the data to be CRC'ed ++ * @orig: originator mac address, NULL if unknown + * +- * check if it is on our broadcast list. Another gateway might +- * have sent the same packet because it is connected to the same backbone, +- * so we have to remove this duplicate. ++ * Check if it is on our broadcast list. Another gateway might have sent the ++ * same packet because it is connected to the same backbone, so we have to ++ * remove this duplicate. + * + * This is performed by checking the CRC, which will tell us + * with a good chance that it is the same packet. If it is furthermore +@@ -1613,19 +1616,17 @@ int batadv_bla_init(struct batadv_priv *bat_priv) + * + * Return: true if a packet is in the duplicate list, false otherwise. + */ +-bool batadv_bla_check_bcast_duplist(struct batadv_priv *bat_priv, +- struct sk_buff *skb) ++static bool batadv_bla_check_duplist(struct batadv_priv *bat_priv, ++ struct sk_buff *skb, u8 *payload_ptr, ++ const u8 *orig) + { +- int i, curr; +- __be32 crc; +- struct batadv_bcast_packet *bcast_packet; + struct batadv_bcast_duplist_entry *entry; + bool ret = false; +- +- bcast_packet = (struct batadv_bcast_packet *)skb->data; ++ int i, curr; ++ __be32 crc; + + /* calculate the crc ... */ +- crc = batadv_skb_crc32(skb, (u8 *)(bcast_packet + 1)); ++ crc = batadv_skb_crc32(skb, payload_ptr); + + spin_lock_bh(&bat_priv->bla.bcast_duplist_lock); + +@@ -1644,8 +1645,21 @@ bool batadv_bla_check_bcast_duplist(struct batadv_priv *bat_priv, + if (entry->crc != crc) + continue; + +- if (batadv_compare_eth(entry->orig, bcast_packet->orig)) +- continue; ++ /* are the originators both known and not anonymous? */ ++ if (orig && !is_zero_ether_addr(orig) && ++ !is_zero_ether_addr(entry->orig)) { ++ /* If known, check if the new frame came from ++ * the same originator: ++ * We are safe to take identical frames from the ++ * same orig, if known, as multiplications in ++ * the mesh are detected via the (orig, seqno) pair. ++ * So we can be a bit more liberal here and allow ++ * identical frames from the same orig which the source ++ * host might have sent multiple times on purpose. ++ */ ++ if (batadv_compare_eth(entry->orig, orig)) ++ continue; ++ } + + /* this entry seems to match: same crc, not too old, + * and from another gw. therefore return true to forbid it. +@@ -1661,7 +1675,14 @@ bool batadv_bla_check_bcast_duplist(struct batadv_priv *bat_priv, + entry = &bat_priv->bla.bcast_duplist[curr]; + entry->crc = crc; + entry->entrytime = jiffies; +- ether_addr_copy(entry->orig, bcast_packet->orig); ++ ++ /* known originator */ ++ if (orig) ++ ether_addr_copy(entry->orig, orig); ++ /* anonymous originator */ ++ else ++ eth_zero_addr(entry->orig); ++ + bat_priv->bla.bcast_duplist_curr = curr; + + out: +@@ -1670,6 +1691,48 @@ out: + return ret; + } + ++/** ++ * batadv_bla_check_ucast_duplist() - Check if a frame is in the broadcast dup. ++ * @bat_priv: the bat priv with all the soft interface information ++ * @skb: contains the multicast packet to be checked, decapsulated from a ++ * unicast_packet ++ * ++ * Check if it is on our broadcast list. Another gateway might have sent the ++ * same packet because it is connected to the same backbone, so we have to ++ * remove this duplicate. ++ * ++ * Return: true if a packet is in the duplicate list, false otherwise. ++ */ ++static bool batadv_bla_check_ucast_duplist(struct batadv_priv *bat_priv, ++ struct sk_buff *skb) ++{ ++ return batadv_bla_check_duplist(bat_priv, skb, (u8 *)skb->data, NULL); ++} ++ ++/** ++ * batadv_bla_check_bcast_duplist() - Check if a frame is in the broadcast dup. ++ * @bat_priv: the bat priv with all the soft interface information ++ * @skb: contains the bcast_packet to be checked ++ * ++ * Check if it is on our broadcast list. Another gateway might have sent the ++ * same packet because it is connected to the same backbone, so we have to ++ * remove this duplicate. ++ * ++ * Return: true if a packet is in the duplicate list, false otherwise. ++ */ ++bool batadv_bla_check_bcast_duplist(struct batadv_priv *bat_priv, ++ struct sk_buff *skb) ++{ ++ struct batadv_bcast_packet *bcast_packet; ++ u8 *payload_ptr; ++ ++ bcast_packet = (struct batadv_bcast_packet *)skb->data; ++ payload_ptr = (u8 *)(bcast_packet + 1); ++ ++ return batadv_bla_check_duplist(bat_priv, skb, payload_ptr, ++ bcast_packet->orig); ++} ++ + /** + * batadv_bla_is_backbone_gw_orig - Check if the originator is a gateway for + * the VLAN identified by vid. +@@ -1884,6 +1947,14 @@ bool batadv_bla_rx(struct batadv_priv *bat_priv, struct sk_buff *skb, + packet_type == BATADV_UNICAST) + goto handled; + ++ /* potential duplicates from foreign BLA backbone gateways via ++ * multicast-in-unicast packets ++ */ ++ if (is_multicast_ether_addr(ethhdr->h_dest) && ++ packet_type == BATADV_UNICAST && ++ batadv_bla_check_ucast_duplist(bat_priv, skb)) ++ goto handled; ++ + ether_addr_copy(search_claim.addr, ethhdr->h_source); + search_claim.vid = vid; + claim = batadv_claim_hash_find(bat_priv, &search_claim); +diff --git a/net/batman-adv/fragmentation.c b/net/batman-adv/fragmentation.c +index 788d62073964b..4842436c55f32 100644 +--- a/net/batman-adv/fragmentation.c ++++ b/net/batman-adv/fragmentation.c +@@ -402,6 +402,7 @@ out: + + /** + * batadv_frag_create - create a fragment from skb ++ * @net_dev: outgoing device for fragment + * @skb: skb to create fragment from + * @frag_head: header to use in new fragment + * @fragment_size: size of new fragment +@@ -412,22 +413,25 @@ out: + * + * Return: the new fragment, NULL on error. + */ +-static struct sk_buff *batadv_frag_create(struct sk_buff *skb, ++static struct sk_buff *batadv_frag_create(struct net_device *net_dev, ++ struct sk_buff *skb, + struct batadv_frag_packet *frag_head, + unsigned int fragment_size) + { ++ unsigned int ll_reserved = LL_RESERVED_SPACE(net_dev); ++ unsigned int tailroom = net_dev->needed_tailroom; + struct sk_buff *skb_fragment; + unsigned int header_size = sizeof(*frag_head); + unsigned int mtu = fragment_size + header_size; + +- skb_fragment = netdev_alloc_skb(NULL, mtu + ETH_HLEN); ++ skb_fragment = dev_alloc_skb(ll_reserved + mtu + tailroom); + if (!skb_fragment) + goto err; + + skb_fragment->priority = skb->priority; + + /* Eat the last mtu-bytes of the skb */ +- skb_reserve(skb_fragment, header_size + ETH_HLEN); ++ skb_reserve(skb_fragment, ll_reserved + header_size); + skb_split(skb, skb_fragment, skb->len - fragment_size); + + /* Add the header */ +@@ -450,11 +454,12 @@ int batadv_frag_send_packet(struct sk_buff *skb, + struct batadv_orig_node *orig_node, + struct batadv_neigh_node *neigh_node) + { ++ struct net_device *net_dev = neigh_node->if_incoming->net_dev; + struct batadv_priv *bat_priv; + struct batadv_hard_iface *primary_if = NULL; + struct batadv_frag_packet frag_header; + struct sk_buff *skb_fragment; +- unsigned int mtu = neigh_node->if_incoming->net_dev->mtu; ++ unsigned int mtu = net_dev->mtu; + unsigned int header_size = sizeof(frag_header); + unsigned int max_fragment_size, num_fragments; + int ret; +@@ -514,7 +519,7 @@ int batadv_frag_send_packet(struct sk_buff *skb, + goto put_primary_if; + } + +- skb_fragment = batadv_frag_create(skb, &frag_header, ++ skb_fragment = batadv_frag_create(net_dev, skb, &frag_header, + max_fragment_size); + if (!skb_fragment) { + ret = -ENOMEM; +@@ -533,13 +538,14 @@ int batadv_frag_send_packet(struct sk_buff *skb, + frag_header.no++; + } + +- /* Make room for the fragment header. */ +- if (batadv_skb_head_push(skb, header_size) < 0 || +- pskb_expand_head(skb, header_size + ETH_HLEN, 0, GFP_ATOMIC) < 0) { +- ret = -ENOMEM; ++ /* make sure that there is at least enough head for the fragmentation ++ * and ethernet headers ++ */ ++ ret = skb_cow_head(skb, ETH_HLEN + header_size); ++ if (ret < 0) + goto put_primary_if; +- } + ++ skb_push(skb, header_size); + memcpy(skb->data, &frag_header, header_size); + + /* Send the last fragment */ +diff --git a/net/batman-adv/hard-interface.c b/net/batman-adv/hard-interface.c +index 9fdfa9984f024..7bdc5f26442ef 100644 +--- a/net/batman-adv/hard-interface.c ++++ b/net/batman-adv/hard-interface.c +@@ -558,6 +558,9 @@ static void batadv_hardif_recalc_extra_skbroom(struct net_device *soft_iface) + needed_headroom = lower_headroom + (lower_header_len - ETH_HLEN); + needed_headroom += batadv_max_header_len(); + ++ /* fragmentation headers don't strip the unicast/... header */ ++ needed_headroom += sizeof(struct batadv_frag_packet); ++ + soft_iface->needed_headroom = needed_headroom; + soft_iface->needed_tailroom = lower_tailroom; + } +diff --git a/net/batman-adv/multicast.c b/net/batman-adv/multicast.c +index d47865e0e6978..fc62f325f9ec3 100644 +--- a/net/batman-adv/multicast.c ++++ b/net/batman-adv/multicast.c +@@ -55,10 +55,12 @@ + #include <net/ip.h> + #include <net/ipv6.h> + ++#include "bridge_loop_avoidance.h" + #include "hard-interface.h" + #include "hash.h" + #include "log.h" + #include "packet.h" ++#include "send.h" + #include "translation-table.h" + #include "tvlv.h" + +@@ -1290,6 +1292,35 @@ void batadv_mcast_free(struct batadv_priv *bat_priv) + batadv_mcast_mla_tt_retract(bat_priv, NULL); + } + ++/** ++ * batadv_mcast_forw_send_orig() - send a multicast packet to an originator ++ * @bat_priv: the bat priv with all the soft interface information ++ * @skb: the multicast packet to send ++ * @vid: the vlan identifier ++ * @orig_node: the originator to send the packet to ++ * ++ * Return: NET_XMIT_DROP in case of error or NET_XMIT_SUCCESS otherwise. ++ */ ++int batadv_mcast_forw_send_orig(struct batadv_priv *bat_priv, ++ struct sk_buff *skb, ++ unsigned short vid, ++ struct batadv_orig_node *orig_node) ++{ ++ /* Avoid sending multicast-in-unicast packets to other BLA ++ * gateways - they already got the frame from the LAN side ++ * we share with them. ++ * TODO: Refactor to take BLA into account earlier, to avoid ++ * reducing the mcast_fanout count. ++ */ ++ if (batadv_bla_is_backbone_gw_orig(bat_priv, orig_node->orig, vid)) { ++ dev_kfree_skb(skb); ++ return NET_XMIT_SUCCESS; ++ } ++ ++ return batadv_send_skb_unicast(bat_priv, skb, BATADV_UNICAST, 0, ++ orig_node, vid); ++} ++ + /** + * batadv_mcast_purge_orig - reset originator global mcast state modifications + * @orig: the originator which is going to get purged +diff --git a/net/batman-adv/multicast.h b/net/batman-adv/multicast.h +index 2a78cddab0e97..8faf4f4e0c75b 100644 +--- a/net/batman-adv/multicast.h ++++ b/net/batman-adv/multicast.h +@@ -43,6 +43,11 @@ enum batadv_forw_mode + batadv_mcast_forw_mode(struct batadv_priv *bat_priv, struct sk_buff *skb, + struct batadv_orig_node **mcast_single_orig); + ++int batadv_mcast_forw_send_orig(struct batadv_priv *bat_priv, ++ struct sk_buff *skb, ++ unsigned short vid, ++ struct batadv_orig_node *orig_node); ++ + void batadv_mcast_init(struct batadv_priv *bat_priv); + + int batadv_mcast_flags_seq_print_text(struct seq_file *seq, void *offset); +@@ -65,6 +70,16 @@ static inline int batadv_mcast_init(struct batadv_priv *bat_priv) + return 0; + } + ++static inline int ++batadv_mcast_forw_send_orig(struct batadv_priv *bat_priv, ++ struct sk_buff *skb, ++ unsigned short vid, ++ struct batadv_orig_node *orig_node) ++{ ++ kfree_skb(skb); ++ return NET_XMIT_DROP; ++} ++ + static inline void batadv_mcast_free(struct batadv_priv *bat_priv) + { + } +diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c +index ba9dce04343a3..7a04ac96b121a 100644 +--- a/net/batman-adv/soft-interface.c ++++ b/net/batman-adv/soft-interface.c +@@ -359,9 +359,8 @@ send: + goto dropped; + ret = batadv_send_skb_via_gw(bat_priv, skb, vid); + } else if (mcast_single_orig) { +- ret = batadv_send_skb_unicast(bat_priv, skb, +- BATADV_UNICAST, 0, +- mcast_single_orig, vid); ++ ret = batadv_mcast_forw_send_orig(bat_priv, skb, vid, ++ mcast_single_orig); + } else { + if (batadv_dat_snoop_outgoing_arp_request(bat_priv, + skb)) +diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c +index 3905af1d300f7..13d070e7738db 100644 +--- a/net/bluetooth/l2cap_sock.c ++++ b/net/bluetooth/l2cap_sock.c +@@ -1329,6 +1329,9 @@ static void l2cap_sock_close_cb(struct l2cap_chan *chan) + { + struct sock *sk = chan->data; + ++ if (!sk) ++ return; ++ + l2cap_sock_kill(sk); + } + +@@ -1337,6 +1340,9 @@ static void l2cap_sock_teardown_cb(struct l2cap_chan *chan, int err) + struct sock *sk = chan->data; + struct sock *parent; + ++ if (!sk) ++ return; ++ + BT_DBG("chan %p state %s", chan, state_to_string(chan->state)); + + /* This callback can be called both for server (BT_LISTEN) +@@ -1520,8 +1526,10 @@ static void l2cap_sock_destruct(struct sock *sk) + { + BT_DBG("sk %p", sk); + +- if (l2cap_pi(sk)->chan) ++ if (l2cap_pi(sk)->chan) { ++ l2cap_pi(sk)->chan->data = NULL; + l2cap_chan_put(l2cap_pi(sk)->chan); ++ } + + if (l2cap_pi(sk)->rx_busy_skb) { + kfree_skb(l2cap_pi(sk)->rx_busy_skb); +diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c +index f681e7ce89457..a5cc8942fc3f8 100644 +--- a/net/bluetooth/sco.c ++++ b/net/bluetooth/sco.c +@@ -255,7 +255,8 @@ static int sco_connect(struct hci_dev *hdev, struct sock *sk) + return err; + } + +-static int sco_send_frame(struct sock *sk, struct msghdr *msg, int len) ++static int sco_send_frame(struct sock *sk, void *buf, int len, ++ unsigned int msg_flags) + { + struct sco_conn *conn = sco_pi(sk)->conn; + struct sk_buff *skb; +@@ -267,15 +268,11 @@ static int sco_send_frame(struct sock *sk, struct msghdr *msg, int len) + + BT_DBG("sk %p len %d", sk, len); + +- skb = bt_skb_send_alloc(sk, len, msg->msg_flags & MSG_DONTWAIT, &err); ++ skb = bt_skb_send_alloc(sk, len, msg_flags & MSG_DONTWAIT, &err); + if (!skb) + return err; + +- if (memcpy_from_msg(skb_put(skb, len), msg, len)) { +- kfree_skb(skb); +- return -EFAULT; +- } +- ++ memcpy(skb_put(skb, len), buf, len); + hci_send_sco(conn->hcon, skb); + + return len; +@@ -692,6 +689,7 @@ static int sco_sock_sendmsg(struct socket *sock, struct msghdr *msg, + size_t len) + { + struct sock *sk = sock->sk; ++ void *buf; + int err; + + BT_DBG("sock %p, sk %p", sock, sk); +@@ -703,14 +701,24 @@ static int sco_sock_sendmsg(struct socket *sock, struct msghdr *msg, + if (msg->msg_flags & MSG_OOB) + return -EOPNOTSUPP; + ++ buf = kmalloc(len, GFP_KERNEL); ++ if (!buf) ++ return -ENOMEM; ++ ++ if (memcpy_from_msg(buf, msg, len)) { ++ kfree(buf); ++ return -EFAULT; ++ } ++ + lock_sock(sk); + + if (sk->sk_state == BT_CONNECTED) +- err = sco_send_frame(sk, msg, len); ++ err = sco_send_frame(sk, buf, len, msg->msg_flags); + else + err = -ENOTCONN; + + release_sock(sk); ++ kfree(buf); + return err; + } + +diff --git a/net/core/stream.c b/net/core/stream.c +index 31839fb06d88c..cbe52b1690707 100644 +--- a/net/core/stream.c ++++ b/net/core/stream.c +@@ -195,9 +195,6 @@ void sk_stream_kill_queues(struct sock *sk) + /* First the read buffer. */ + __skb_queue_purge(&sk->sk_receive_queue); + +- /* Next, the error queue. */ +- __skb_queue_purge(&sk->sk_error_queue); +- + /* Next, the write queue. */ + WARN_ON(!skb_queue_empty(&sk->sk_write_queue)); + +diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c +index 069e3c4fcc447..ac1a32d5cad3c 100644 +--- a/net/core/sysctl_net_core.c ++++ b/net/core/sysctl_net_core.c +@@ -410,7 +410,7 @@ static struct ctl_table net_core_table[] = { + .mode = 0600, + .proc_handler = proc_dolongvec_minmax_bpf_restricted, + .extra1 = &long_one, +- .extra2 = &long_max, ++ .extra2 = &bpf_jit_limit_max, + }, + #endif + { +diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c +index e47d5047d5373..178a3b26f9d2c 100644 +--- a/net/ipv6/addrconf.c ++++ b/net/ipv6/addrconf.c +@@ -2996,6 +2996,9 @@ static void sit_add_v4_addrs(struct inet6_dev *idev) + memcpy(&addr.s6_addr32[3], idev->dev->dev_addr, 4); + + if (idev->dev->flags&IFF_POINTOPOINT) { ++ if (idev->cnf.addr_gen_mode == IN6_ADDR_GEN_MODE_NONE) ++ return; ++ + addr.s6_addr32[0] = htonl(0xfe800000); + scope = IFA_LINK; + plen = 64; +diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c +index 02bbc2f9f1f1e..13e67eb75d841 100644 +--- a/net/netfilter/nfnetlink_queue.c ++++ b/net/netfilter/nfnetlink_queue.c +@@ -543,7 +543,7 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue, + goto nla_put_failure; + + if (indev && entskb->dev && +- entskb->mac_header != entskb->network_header) { ++ skb_mac_header_was_set(entskb)) { + struct nfqnl_msg_packet_hw phw; + int len; + +diff --git a/net/nfc/core.c b/net/nfc/core.c +index c699d64a0753a..32a2dfc08f480 100644 +--- a/net/nfc/core.c ++++ b/net/nfc/core.c +@@ -106,13 +106,13 @@ int nfc_dev_up(struct nfc_dev *dev) + + device_lock(&dev->dev); + +- if (dev->rfkill && rfkill_blocked(dev->rfkill)) { +- rc = -ERFKILL; ++ if (!device_is_registered(&dev->dev)) { ++ rc = -ENODEV; + goto error; + } + +- if (!device_is_registered(&dev->dev)) { +- rc = -ENODEV; ++ if (dev->rfkill && rfkill_blocked(dev->rfkill)) { ++ rc = -ERFKILL; + goto error; + } + +@@ -1133,11 +1133,7 @@ int nfc_register_device(struct nfc_dev *dev) + if (rc) + pr_err("Could not register llcp device\n"); + +- rc = nfc_genl_device_added(dev); +- if (rc) +- pr_debug("The userspace won't be notified that the device %s was added\n", +- dev_name(&dev->dev)); +- ++ device_lock(&dev->dev); + dev->rfkill = rfkill_alloc(dev_name(&dev->dev), &dev->dev, + RFKILL_TYPE_NFC, &nfc_rfkill_ops, dev); + if (dev->rfkill) { +@@ -1146,6 +1142,12 @@ int nfc_register_device(struct nfc_dev *dev) + dev->rfkill = NULL; + } + } ++ device_unlock(&dev->dev); ++ ++ rc = nfc_genl_device_added(dev); ++ if (rc) ++ pr_debug("The userspace won't be notified that the device %s was added\n", ++ dev_name(&dev->dev)); + + return 0; + } +@@ -1162,10 +1164,17 @@ void nfc_unregister_device(struct nfc_dev *dev) + + pr_debug("dev_name=%s\n", dev_name(&dev->dev)); + ++ rc = nfc_genl_device_removed(dev); ++ if (rc) ++ pr_debug("The userspace won't be notified that the device %s " ++ "was removed\n", dev_name(&dev->dev)); ++ ++ device_lock(&dev->dev); + if (dev->rfkill) { + rfkill_unregister(dev->rfkill); + rfkill_destroy(dev->rfkill); + } ++ device_unlock(&dev->dev); + + if (dev->ops->check_presence) { + device_lock(&dev->dev); +@@ -1175,11 +1184,6 @@ void nfc_unregister_device(struct nfc_dev *dev) + cancel_work_sync(&dev->check_pres_work); + } + +- rc = nfc_genl_device_removed(dev); +- if (rc) +- pr_debug("The userspace won't be notified that the device %s " +- "was removed\n", dev_name(&dev->dev)); +- + nfc_llcp_unregister_device(dev); + + mutex_lock(&nfc_devlist_mutex); +diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c +index d3b7419f8b8f0..c73651faa5494 100644 +--- a/net/nfc/nci/core.c ++++ b/net/nfc/nci/core.c +@@ -156,12 +156,15 @@ inline int nci_request(struct nci_dev *ndev, + { + int rc; + +- if (!test_bit(NCI_UP, &ndev->flags)) +- return -ENETDOWN; +- + /* Serialize all requests */ + mutex_lock(&ndev->req_lock); +- rc = __nci_request(ndev, req, opt, timeout); ++ /* check the state after obtaing the lock against any races ++ * from nci_close_device when the device gets removed. ++ */ ++ if (test_bit(NCI_UP, &ndev->flags)) ++ rc = __nci_request(ndev, req, opt, timeout); ++ else ++ rc = -ENETDOWN; + mutex_unlock(&ndev->req_lock); + + return rc; +diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c +index 02a171916dd2b..8b211d164beea 100644 +--- a/net/vmw_vsock/af_vsock.c ++++ b/net/vmw_vsock/af_vsock.c +@@ -1166,6 +1166,8 @@ static int vsock_stream_connect(struct socket *sock, struct sockaddr *addr, + * non-blocking call. + */ + err = -EALREADY; ++ if (flags & O_NONBLOCK) ++ goto out; + break; + default: + if ((sk->sk_state == TCP_LISTEN) || +diff --git a/net/wireless/util.c b/net/wireless/util.c +index bf4dd297a4db4..94849702b518e 100644 +--- a/net/wireless/util.c ++++ b/net/wireless/util.c +@@ -1026,6 +1026,7 @@ int cfg80211_change_iface(struct cfg80211_registered_device *rdev, + + switch (otype) { + case NL80211_IFTYPE_AP: ++ case NL80211_IFTYPE_P2P_GO: + cfg80211_stop_ap(rdev, dev, true); + break; + case NL80211_IFTYPE_ADHOC: +diff --git a/samples/kprobes/kretprobe_example.c b/samples/kprobes/kretprobe_example.c +index 7f9060f435cde..da6de5e78e1dd 100644 +--- a/samples/kprobes/kretprobe_example.c ++++ b/samples/kprobes/kretprobe_example.c +@@ -83,7 +83,7 @@ static int __init kretprobe_init(void) + ret = register_kretprobe(&my_kretprobe); + if (ret < 0) { + pr_err("register_kretprobe failed, returned %d\n", ret); +- return -1; ++ return ret; + } + pr_info("Planted return probe at %s: %p\n", + my_kretprobe.kp.symbol_name, my_kretprobe.kp.addr); +diff --git a/scripts/leaking_addresses.pl b/scripts/leaking_addresses.pl +index 2977371b29563..de5196c08943a 100755 +--- a/scripts/leaking_addresses.pl ++++ b/scripts/leaking_addresses.pl +@@ -262,8 +262,9 @@ sub parse_file + + open my $fh, "<", $file or return; + while ( <$fh> ) { ++ chomp; + if (may_leak_address($_)) { +- print $file . ': ' . $_; ++ printf("$file: $_\n"); + } + } + close $fh; +diff --git a/security/apparmor/label.c b/security/apparmor/label.c +index 212a0f39ddae8..4e5450dee28a3 100644 +--- a/security/apparmor/label.c ++++ b/security/apparmor/label.c +@@ -1431,7 +1431,7 @@ bool aa_update_label_name(struct aa_ns *ns, struct aa_label *label, gfp_t gfp) + if (label->hname || labels_ns(label) != ns) + return res; + +- if (aa_label_acntsxprint(&name, ns, label, FLAGS_NONE, gfp) == -1) ++ if (aa_label_acntsxprint(&name, ns, label, FLAGS_NONE, gfp) < 0) + return res; + + ls = labels_set(label); +@@ -1681,7 +1681,7 @@ int aa_label_asxprint(char **strp, struct aa_ns *ns, struct aa_label *label, + + /** + * aa_label_acntsxprint - allocate a __counted string buffer and print label +- * @strp: buffer to write to. (MAY BE NULL if @size == 0) ++ * @strp: buffer to write to. + * @ns: namespace profile is being viewed from + * @label: label to view (NOT NULL) + * @flags: flags controlling what label info is printed +diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c +index 1d1a7053144b4..6e761b07cb3f0 100644 +--- a/security/integrity/evm/evm_main.c ++++ b/security/integrity/evm/evm_main.c +@@ -56,7 +56,7 @@ char *evm_config_xattrnames[] = { + NULL + }; + +-static int evm_fixmode; ++static int evm_fixmode __ro_after_init; + static int __init evm_set_fixmode(char *str) + { + if (strncmp(str, "fix", 3) == 0) +diff --git a/security/security.c b/security/security.c +index 4fbe4e495c021..737a5985343cd 100644 +--- a/security/security.c ++++ b/security/security.c +@@ -222,25 +222,25 @@ EXPORT_SYMBOL(unregister_lsm_notifier); + + /* Security operations */ + +-int security_binder_set_context_mgr(struct task_struct *mgr) ++int security_binder_set_context_mgr(const struct cred *mgr) + { + return call_int_hook(binder_set_context_mgr, 0, mgr); + } + +-int security_binder_transaction(struct task_struct *from, +- struct task_struct *to) ++int security_binder_transaction(const struct cred *from, ++ const struct cred *to) + { + return call_int_hook(binder_transaction, 0, from, to); + } + +-int security_binder_transfer_binder(struct task_struct *from, +- struct task_struct *to) ++int security_binder_transfer_binder(const struct cred *from, ++ const struct cred *to) + { + return call_int_hook(binder_transfer_binder, 0, from, to); + } + +-int security_binder_transfer_file(struct task_struct *from, +- struct task_struct *to, struct file *file) ++int security_binder_transfer_file(const struct cred *from, ++ const struct cred *to, struct file *file) + { + return call_int_hook(binder_transfer_file, 0, from, to, file); + } +diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c +index 895d369bc4103..9bb1d492f7047 100644 +--- a/security/selinux/hooks.c ++++ b/security/selinux/hooks.c +@@ -2136,21 +2136,18 @@ static inline u32 open_file_to_av(struct file *file) + + /* Hook functions begin here. */ + +-static int selinux_binder_set_context_mgr(struct task_struct *mgr) ++static int selinux_binder_set_context_mgr(const struct cred *mgr) + { +- u32 mysid = current_sid(); +- u32 mgrsid = task_sid(mgr); +- +- return avc_has_perm(mysid, mgrsid, SECCLASS_BINDER, ++ return avc_has_perm(current_sid(), cred_sid(mgr), SECCLASS_BINDER, + BINDER__SET_CONTEXT_MGR, NULL); + } + +-static int selinux_binder_transaction(struct task_struct *from, +- struct task_struct *to) ++static int selinux_binder_transaction(const struct cred *from, ++ const struct cred *to) + { + u32 mysid = current_sid(); +- u32 fromsid = task_sid(from); +- u32 tosid = task_sid(to); ++ u32 fromsid = cred_sid(from); ++ u32 tosid = cred_sid(to); + int rc; + + if (mysid != fromsid) { +@@ -2164,21 +2161,19 @@ static int selinux_binder_transaction(struct task_struct *from, + NULL); + } + +-static int selinux_binder_transfer_binder(struct task_struct *from, +- struct task_struct *to) ++static int selinux_binder_transfer_binder(const struct cred *from, ++ const struct cred *to) + { +- u32 fromsid = task_sid(from); +- u32 tosid = task_sid(to); +- +- return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER, ++ return avc_has_perm(cred_sid(from), cred_sid(to), ++ SECCLASS_BINDER, BINDER__TRANSFER, + NULL); + } + +-static int selinux_binder_transfer_file(struct task_struct *from, +- struct task_struct *to, ++static int selinux_binder_transfer_file(const struct cred *from, ++ const struct cred *to, + struct file *file) + { +- u32 sid = task_sid(to); ++ u32 sid = cred_sid(to); + struct file_security_struct *fsec = file->f_security; + struct dentry *dentry = file->f_path.dentry; + struct inode_security_struct *isec; +diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c +index 009e83ee2d002..a9c516362170a 100644 +--- a/security/smack/smackfs.c ++++ b/security/smack/smackfs.c +@@ -721,9 +721,7 @@ static void smk_cipso_doi(void) + printk(KERN_WARNING "%s:%d remove rc = %d\n", + __func__, __LINE__, rc); + +- doip = kmalloc(sizeof(struct cipso_v4_doi), GFP_KERNEL); +- if (doip == NULL) +- panic("smack: Failed to initialize cipso DOI.\n"); ++ doip = kmalloc(sizeof(struct cipso_v4_doi), GFP_KERNEL | __GFP_NOFAIL); + doip->map.std = NULL; + doip->doi = smk_cipso_doi_value; + doip->type = CIPSO_V4_MAP_PASS; +@@ -742,7 +740,7 @@ static void smk_cipso_doi(void) + if (rc != 0) { + printk(KERN_WARNING "%s:%d map add rc = %d\n", + __func__, __LINE__, rc); +- kfree(doip); ++ netlbl_cfg_cipsov4_del(doip->doi, &nai); + return; + } + } +@@ -859,6 +857,7 @@ static int smk_open_cipso(struct inode *inode, struct file *file) + static ssize_t smk_set_cipso(struct file *file, const char __user *buf, + size_t count, loff_t *ppos, int format) + { ++ struct netlbl_lsm_catmap *old_cat; + struct smack_known *skp; + struct netlbl_lsm_secattr ncats; + char mapcatset[SMK_CIPSOLEN]; +@@ -948,9 +947,11 @@ static ssize_t smk_set_cipso(struct file *file, const char __user *buf, + + rc = smk_netlbl_mls(maplevel, mapcatset, &ncats, SMK_CIPSOLEN); + if (rc >= 0) { +- netlbl_catmap_free(skp->smk_netlabel.attr.mls.cat); ++ old_cat = skp->smk_netlabel.attr.mls.cat; + skp->smk_netlabel.attr.mls.cat = ncats.attr.mls.cat; + skp->smk_netlabel.attr.mls.lvl = ncats.attr.mls.lvl; ++ synchronize_rcu(); ++ netlbl_catmap_free(old_cat); + rc = count; + } + +diff --git a/sound/core/oss/mixer_oss.c b/sound/core/oss/mixer_oss.c +index 379bf486ccc74..c91048fd28223 100644 +--- a/sound/core/oss/mixer_oss.c ++++ b/sound/core/oss/mixer_oss.c +@@ -145,11 +145,13 @@ static int snd_mixer_oss_devmask(struct snd_mixer_oss_file *fmixer) + + if (mixer == NULL) + return -EIO; ++ mutex_lock(&mixer->reg_mutex); + for (chn = 0; chn < 31; chn++) { + pslot = &mixer->slots[chn]; + if (pslot->put_volume || pslot->put_recsrc) + result |= 1 << chn; + } ++ mutex_unlock(&mixer->reg_mutex); + return result; + } + +@@ -161,11 +163,13 @@ static int snd_mixer_oss_stereodevs(struct snd_mixer_oss_file *fmixer) + + if (mixer == NULL) + return -EIO; ++ mutex_lock(&mixer->reg_mutex); + for (chn = 0; chn < 31; chn++) { + pslot = &mixer->slots[chn]; + if (pslot->put_volume && pslot->stereo) + result |= 1 << chn; + } ++ mutex_unlock(&mixer->reg_mutex); + return result; + } + +@@ -176,6 +180,7 @@ static int snd_mixer_oss_recmask(struct snd_mixer_oss_file *fmixer) + + if (mixer == NULL) + return -EIO; ++ mutex_lock(&mixer->reg_mutex); + if (mixer->put_recsrc && mixer->get_recsrc) { /* exclusive */ + result = mixer->mask_recsrc; + } else { +@@ -187,6 +192,7 @@ static int snd_mixer_oss_recmask(struct snd_mixer_oss_file *fmixer) + result |= 1 << chn; + } + } ++ mutex_unlock(&mixer->reg_mutex); + return result; + } + +@@ -197,11 +203,12 @@ static int snd_mixer_oss_get_recsrc(struct snd_mixer_oss_file *fmixer) + + if (mixer == NULL) + return -EIO; ++ mutex_lock(&mixer->reg_mutex); + if (mixer->put_recsrc && mixer->get_recsrc) { /* exclusive */ +- int err; + unsigned int index; +- if ((err = mixer->get_recsrc(fmixer, &index)) < 0) +- return err; ++ result = mixer->get_recsrc(fmixer, &index); ++ if (result < 0) ++ goto unlock; + result = 1 << index; + } else { + struct snd_mixer_oss_slot *pslot; +@@ -216,7 +223,10 @@ static int snd_mixer_oss_get_recsrc(struct snd_mixer_oss_file *fmixer) + } + } + } +- return mixer->oss_recsrc = result; ++ mixer->oss_recsrc = result; ++ unlock: ++ mutex_unlock(&mixer->reg_mutex); ++ return result; + } + + static int snd_mixer_oss_set_recsrc(struct snd_mixer_oss_file *fmixer, int recsrc) +@@ -229,6 +239,7 @@ static int snd_mixer_oss_set_recsrc(struct snd_mixer_oss_file *fmixer, int recsr + + if (mixer == NULL) + return -EIO; ++ mutex_lock(&mixer->reg_mutex); + if (mixer->get_recsrc && mixer->put_recsrc) { /* exclusive input */ + if (recsrc & ~mixer->oss_recsrc) + recsrc &= ~mixer->oss_recsrc; +@@ -254,6 +265,7 @@ static int snd_mixer_oss_set_recsrc(struct snd_mixer_oss_file *fmixer, int recsr + } + } + } ++ mutex_unlock(&mixer->reg_mutex); + return result; + } + +@@ -265,6 +277,7 @@ static int snd_mixer_oss_get_volume(struct snd_mixer_oss_file *fmixer, int slot) + + if (mixer == NULL || slot > 30) + return -EIO; ++ mutex_lock(&mixer->reg_mutex); + pslot = &mixer->slots[slot]; + left = pslot->volume[0]; + right = pslot->volume[1]; +@@ -272,15 +285,21 @@ static int snd_mixer_oss_get_volume(struct snd_mixer_oss_file *fmixer, int slot) + result = pslot->get_volume(fmixer, pslot, &left, &right); + if (!pslot->stereo) + right = left; +- if (snd_BUG_ON(left < 0 || left > 100)) +- return -EIO; +- if (snd_BUG_ON(right < 0 || right > 100)) +- return -EIO; ++ if (snd_BUG_ON(left < 0 || left > 100)) { ++ result = -EIO; ++ goto unlock; ++ } ++ if (snd_BUG_ON(right < 0 || right > 100)) { ++ result = -EIO; ++ goto unlock; ++ } + if (result >= 0) { + pslot->volume[0] = left; + pslot->volume[1] = right; + result = (left & 0xff) | ((right & 0xff) << 8); + } ++ unlock: ++ mutex_unlock(&mixer->reg_mutex); + return result; + } + +@@ -293,6 +312,7 @@ static int snd_mixer_oss_set_volume(struct snd_mixer_oss_file *fmixer, + + if (mixer == NULL || slot > 30) + return -EIO; ++ mutex_lock(&mixer->reg_mutex); + pslot = &mixer->slots[slot]; + if (left > 100) + left = 100; +@@ -303,10 +323,13 @@ static int snd_mixer_oss_set_volume(struct snd_mixer_oss_file *fmixer, + if (pslot->put_volume) + result = pslot->put_volume(fmixer, pslot, left, right); + if (result < 0) +- return result; ++ goto unlock; + pslot->volume[0] = left; + pslot->volume[1] = right; +- return (left & 0xff) | ((right & 0xff) << 8); ++ result = (left & 0xff) | ((right & 0xff) << 8); ++ unlock: ++ mutex_unlock(&mixer->reg_mutex); ++ return result; + } + + static int snd_mixer_oss_ioctl1(struct snd_mixer_oss_file *fmixer, unsigned int cmd, unsigned long arg) +diff --git a/sound/core/timer.c b/sound/core/timer.c +index eb31c13c8ed0d..c333ceb80d5f3 100644 +--- a/sound/core/timer.c ++++ b/sound/core/timer.c +@@ -583,13 +583,13 @@ static int snd_timer_stop1(struct snd_timer_instance *timeri, bool stop) + if (!timer) + return -EINVAL; + spin_lock_irqsave(&timer->lock, flags); ++ list_del_init(&timeri->ack_list); ++ list_del_init(&timeri->active_list); + if (!(timeri->flags & (SNDRV_TIMER_IFLG_RUNNING | + SNDRV_TIMER_IFLG_START))) { + result = -EBUSY; + goto unlock; + } +- list_del_init(&timeri->ack_list); +- list_del_init(&timeri->active_list); + if (timer->card && timer->card->shutdown) + goto unlock; + if (stop) { +@@ -624,23 +624,22 @@ static int snd_timer_stop1(struct snd_timer_instance *timeri, bool stop) + static int snd_timer_stop_slave(struct snd_timer_instance *timeri, bool stop) + { + unsigned long flags; ++ bool running; + + spin_lock_irqsave(&slave_active_lock, flags); +- if (!(timeri->flags & SNDRV_TIMER_IFLG_RUNNING)) { +- spin_unlock_irqrestore(&slave_active_lock, flags); +- return -EBUSY; +- } ++ running = timeri->flags & SNDRV_TIMER_IFLG_RUNNING; + timeri->flags &= ~SNDRV_TIMER_IFLG_RUNNING; + if (timeri->timer) { + spin_lock(&timeri->timer->lock); + list_del_init(&timeri->ack_list); + list_del_init(&timeri->active_list); +- snd_timer_notify1(timeri, stop ? SNDRV_TIMER_EVENT_STOP : +- SNDRV_TIMER_EVENT_PAUSE); ++ if (running) ++ snd_timer_notify1(timeri, stop ? SNDRV_TIMER_EVENT_STOP : ++ SNDRV_TIMER_EVENT_PAUSE); + spin_unlock(&timeri->timer->lock); + } + spin_unlock_irqrestore(&slave_active_lock, flags); +- return 0; ++ return running ? 0 : -EBUSY; + } + + /* +diff --git a/sound/isa/gus/gus_dma.c b/sound/isa/gus/gus_dma.c +index 36c27c8323601..2e27cd3427c87 100644 +--- a/sound/isa/gus/gus_dma.c ++++ b/sound/isa/gus/gus_dma.c +@@ -141,6 +141,8 @@ static void snd_gf1_dma_interrupt(struct snd_gus_card * gus) + } + block = snd_gf1_dma_next_block(gus); + spin_unlock(&gus->dma_lock); ++ if (!block) ++ return; + snd_gf1_dma_program(gus, block->addr, block->buf_addr, block->count, (unsigned short) block->cmd); + kfree(block); + #if 0 +diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c +index e399c5718ee60..de090a3d2b384 100644 +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -742,13 +742,17 @@ static int azx_intel_link_power(struct azx *chip, bool enable) + * the update-IRQ timing. The IRQ is issued before actually the + * data is processed. So, we need to process it afterwords in a + * workqueue. ++ * ++ * Returns 1 if OK to proceed, 0 for delay handling, -1 for skipping update + */ + static int azx_position_ok(struct azx *chip, struct azx_dev *azx_dev) + { + struct snd_pcm_substream *substream = azx_dev->core.substream; ++ struct snd_pcm_runtime *runtime = substream->runtime; + int stream = substream->stream; + u32 wallclk; + unsigned int pos; ++ snd_pcm_uframes_t hwptr, target; + + wallclk = azx_readl(chip, WALLCLK) - azx_dev->core.start_wallclk; + if (wallclk < (azx_dev->core.period_wallclk * 2) / 3) +@@ -785,6 +789,24 @@ static int azx_position_ok(struct azx *chip, struct azx_dev *azx_dev) + /* NG - it's below the first next period boundary */ + return chip->bdl_pos_adj ? 0 : -1; + azx_dev->core.start_wallclk += wallclk; ++ ++ if (azx_dev->core.no_period_wakeup) ++ return 1; /* OK, no need to check period boundary */ ++ ++ if (runtime->hw_ptr_base != runtime->hw_ptr_interrupt) ++ return 1; /* OK, already in hwptr updating process */ ++ ++ /* check whether the period gets really elapsed */ ++ pos = bytes_to_frames(runtime, pos); ++ hwptr = runtime->hw_ptr_base + pos; ++ if (hwptr < runtime->status->hw_ptr) ++ hwptr += runtime->buffer_size; ++ target = runtime->hw_ptr_interrupt + runtime->period_size; ++ if (hwptr < target) { ++ /* too early wakeup, process it later */ ++ return chip->bdl_pos_adj ? 0 : -1; ++ } ++ + return 1; /* OK, it's fine */ + } + +@@ -982,11 +1004,7 @@ static unsigned int azx_get_pos_skl(struct azx *chip, struct azx_dev *azx_dev) + if (azx_dev->core.substream->stream == SNDRV_PCM_STREAM_PLAYBACK) + return azx_skl_get_dpib_pos(chip, azx_dev); + +- /* For capture, we need to read posbuf, but it requires a delay +- * for the possible boundary overlap; the read of DPIB fetches the +- * actual posbuf +- */ +- udelay(20); ++ /* read of DPIB fetches the actual posbuf */ + azx_skl_get_dpib_pos(chip, azx_dev); + return azx_get_pos_posbuf(chip, azx_dev); + } +diff --git a/sound/soc/codecs/cs42l42.c b/sound/soc/codecs/cs42l42.c +index e6eeecc5446ef..7ff8b9f269713 100644 +--- a/sound/soc/codecs/cs42l42.c ++++ b/sound/soc/codecs/cs42l42.c +@@ -95,7 +95,7 @@ static const struct reg_default cs42l42_reg_defaults[] = { + { CS42L42_ASP_RX_INT_MASK, 0x1F }, + { CS42L42_ASP_TX_INT_MASK, 0x0F }, + { CS42L42_CODEC_INT_MASK, 0x03 }, +- { CS42L42_SRCPL_INT_MASK, 0xFF }, ++ { CS42L42_SRCPL_INT_MASK, 0x7F }, + { CS42L42_VPMON_INT_MASK, 0x01 }, + { CS42L42_PLL_LOCK_INT_MASK, 0x01 }, + { CS42L42_TSRS_PLUG_INT_MASK, 0x0F }, +@@ -132,7 +132,7 @@ static const struct reg_default cs42l42_reg_defaults[] = { + { CS42L42_MIXER_CHA_VOL, 0x3F }, + { CS42L42_MIXER_ADC_VOL, 0x3F }, + { CS42L42_MIXER_CHB_VOL, 0x3F }, +- { CS42L42_EQ_COEF_IN0, 0x22 }, ++ { CS42L42_EQ_COEF_IN0, 0x00 }, + { CS42L42_EQ_COEF_IN1, 0x00 }, + { CS42L42_EQ_COEF_IN2, 0x00 }, + { CS42L42_EQ_COEF_IN3, 0x00 }, +@@ -1805,8 +1805,9 @@ static int cs42l42_i2c_probe(struct i2c_client *i2c_client, + NULL, cs42l42_irq_thread, + IRQF_ONESHOT | IRQF_TRIGGER_LOW, + "cs42l42", cs42l42); +- +- if (ret != 0) ++ if (ret == -EPROBE_DEFER) ++ goto err_disable; ++ else if (ret != 0) + dev_err(&i2c_client->dev, + "Failed to request IRQ: %d\n", ret); + +diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c +index 7c013d237ea19..f72fe0cba30d8 100644 +--- a/sound/soc/soc-dapm.c ++++ b/sound/soc/soc-dapm.c +@@ -2491,8 +2491,13 @@ static struct snd_soc_dapm_widget *dapm_find_widget( + return NULL; + } + +-static int snd_soc_dapm_set_pin(struct snd_soc_dapm_context *dapm, +- const char *pin, int status) ++/* ++ * set the DAPM pin status: ++ * returns 1 when the value has been updated, 0 when unchanged, or a negative ++ * error code; called from kcontrol put callback ++ */ ++static int __snd_soc_dapm_set_pin(struct snd_soc_dapm_context *dapm, ++ const char *pin, int status) + { + struct snd_soc_dapm_widget *w = dapm_find_widget(dapm, pin, true); + int ret = 0; +@@ -2518,6 +2523,18 @@ static int snd_soc_dapm_set_pin(struct snd_soc_dapm_context *dapm, + return ret; + } + ++/* ++ * similar as __snd_soc_dapm_set_pin(), but returns 0 when successful; ++ * called from several API functions below ++ */ ++static int snd_soc_dapm_set_pin(struct snd_soc_dapm_context *dapm, ++ const char *pin, int status) ++{ ++ int ret = __snd_soc_dapm_set_pin(dapm, pin, status); ++ ++ return ret < 0 ? ret : 0; ++} ++ + /** + * snd_soc_dapm_sync_unlocked - scan and power dapm paths + * @dapm: DAPM context +@@ -3445,10 +3462,10 @@ int snd_soc_dapm_put_pin_switch(struct snd_kcontrol *kcontrol, + const char *pin = (const char *)kcontrol->private_value; + int ret; + +- if (ucontrol->value.integer.value[0]) +- ret = snd_soc_dapm_enable_pin(&card->dapm, pin); +- else +- ret = snd_soc_dapm_disable_pin(&card->dapm, pin); ++ mutex_lock_nested(&card->dapm_mutex, SND_SOC_DAPM_CLASS_RUNTIME); ++ ret = __snd_soc_dapm_set_pin(&card->dapm, pin, ++ !!ucontrol->value.integer.value[0]); ++ mutex_unlock(&card->dapm_mutex); + + snd_soc_dapm_sync(&card->dapm); + return ret; +diff --git a/sound/synth/emux/emux.c b/sound/synth/emux/emux.c +index b9981e8c00272..82b587afa6158 100644 +--- a/sound/synth/emux/emux.c ++++ b/sound/synth/emux/emux.c +@@ -101,7 +101,7 @@ int snd_emux_register(struct snd_emux *emu, struct snd_card *card, int index, ch + emu->name = kstrdup(name, GFP_KERNEL); + emu->voices = kcalloc(emu->max_voices, sizeof(struct snd_emux_voice), + GFP_KERNEL); +- if (emu->voices == NULL) ++ if (emu->name == NULL || emu->voices == NULL) + return -ENOMEM; + + /* create soundfont list */ +diff --git a/sound/usb/6fire/comm.c b/sound/usb/6fire/comm.c +index 161215d78d952..f29c115b9d564 100644 +--- a/sound/usb/6fire/comm.c ++++ b/sound/usb/6fire/comm.c +@@ -99,7 +99,7 @@ static int usb6fire_comm_send_buffer(u8 *buffer, struct usb_device *dev) + int actual_len; + + ret = usb_interrupt_msg(dev, usb_sndintpipe(dev, COMM_EP), +- buffer, buffer[1] + 2, &actual_len, HZ); ++ buffer, buffer[1] + 2, &actual_len, 1000); + if (ret < 0) + return ret; + else if (actual_len != buffer[1] + 2) +diff --git a/sound/usb/6fire/firmware.c b/sound/usb/6fire/firmware.c +index 9520b4cd70385..7a89111041edc 100644 +--- a/sound/usb/6fire/firmware.c ++++ b/sound/usb/6fire/firmware.c +@@ -166,7 +166,7 @@ static int usb6fire_fw_ezusb_write(struct usb_device *device, + + ret = usb_control_msg(device, usb_sndctrlpipe(device, 0), type, + USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE, +- value, 0, data, len, HZ); ++ value, 0, data, len, 1000); + if (ret < 0) + return ret; + else if (ret != len) +@@ -179,7 +179,7 @@ static int usb6fire_fw_ezusb_read(struct usb_device *device, + { + int ret = usb_control_msg(device, usb_rcvctrlpipe(device, 0), type, + USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE, value, +- 0, data, len, HZ); ++ 0, data, len, 1000); + if (ret < 0) + return ret; + else if (ret != len) +@@ -194,7 +194,7 @@ static int usb6fire_fw_fpga_write(struct usb_device *device, + int ret; + + ret = usb_bulk_msg(device, usb_sndbulkpipe(device, FPGA_EP), data, len, +- &actual_len, HZ); ++ &actual_len, 1000); + if (ret < 0) + return ret; + else if (actual_len != len) +diff --git a/sound/usb/line6/driver.c b/sound/usb/line6/driver.c +index 40ddfcd4e8e99..c629a2bf6d2ce 100644 +--- a/sound/usb/line6/driver.c ++++ b/sound/usb/line6/driver.c +@@ -117,12 +117,12 @@ static int line6_send_raw_message(struct usb_line6 *line6, const char *buffer, + retval = usb_interrupt_msg(line6->usbdev, + usb_sndintpipe(line6->usbdev, properties->ep_ctrl_w), + (char *)frag_buf, frag_size, +- &partial, LINE6_TIMEOUT * HZ); ++ &partial, LINE6_TIMEOUT); + } else { + retval = usb_bulk_msg(line6->usbdev, + usb_sndbulkpipe(line6->usbdev, properties->ep_ctrl_w), + (char *)frag_buf, frag_size, +- &partial, LINE6_TIMEOUT * HZ); ++ &partial, LINE6_TIMEOUT); + } + + if (retval) { +@@ -358,7 +358,7 @@ int line6_read_data(struct usb_line6 *line6, unsigned address, void *data, + ret = usb_control_msg(usbdev, usb_sndctrlpipe(usbdev, 0), 0x67, + USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT, + (datalen << 8) | 0x21, address, +- NULL, 0, LINE6_TIMEOUT * HZ); ++ NULL, 0, LINE6_TIMEOUT); + + if (ret < 0) { + dev_err(line6->ifcdev, "read request failed (error %d)\n", ret); +@@ -373,7 +373,7 @@ int line6_read_data(struct usb_line6 *line6, unsigned address, void *data, + USB_TYPE_VENDOR | USB_RECIP_DEVICE | + USB_DIR_IN, + 0x0012, 0x0000, len, 1, +- LINE6_TIMEOUT * HZ); ++ LINE6_TIMEOUT); + if (ret < 0) { + dev_err(line6->ifcdev, + "receive length failed (error %d)\n", ret); +@@ -401,7 +401,7 @@ int line6_read_data(struct usb_line6 *line6, unsigned address, void *data, + ret = usb_control_msg(usbdev, usb_rcvctrlpipe(usbdev, 0), 0x67, + USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN, + 0x0013, 0x0000, data, datalen, +- LINE6_TIMEOUT * HZ); ++ LINE6_TIMEOUT); + + if (ret < 0) + dev_err(line6->ifcdev, "read failed (error %d)\n", ret); +@@ -433,7 +433,7 @@ int line6_write_data(struct usb_line6 *line6, unsigned address, void *data, + ret = usb_control_msg(usbdev, usb_sndctrlpipe(usbdev, 0), 0x67, + USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT, + 0x0022, address, data, datalen, +- LINE6_TIMEOUT * HZ); ++ LINE6_TIMEOUT); + + if (ret < 0) { + dev_err(line6->ifcdev, +@@ -449,7 +449,7 @@ int line6_write_data(struct usb_line6 *line6, unsigned address, void *data, + USB_TYPE_VENDOR | USB_RECIP_DEVICE | + USB_DIR_IN, + 0x0012, 0x0000, +- status, 1, LINE6_TIMEOUT * HZ); ++ status, 1, LINE6_TIMEOUT); + + if (ret < 0) { + dev_err(line6->ifcdev, +diff --git a/sound/usb/line6/driver.h b/sound/usb/line6/driver.h +index dc97895547be4..80598698d7063 100644 +--- a/sound/usb/line6/driver.h ++++ b/sound/usb/line6/driver.h +@@ -31,7 +31,7 @@ + #define LINE6_FALLBACK_INTERVAL 10 + #define LINE6_FALLBACK_MAXPACKETSIZE 16 + +-#define LINE6_TIMEOUT 1 ++#define LINE6_TIMEOUT 1000 + #define LINE6_BUFSIZE_LISTEN 64 + #define LINE6_MIDI_MESSAGE_MAXLEN 256 + +diff --git a/sound/usb/line6/podhd.c b/sound/usb/line6/podhd.c +index 1513fbaf70c2e..b5573eb49cb45 100644 +--- a/sound/usb/line6/podhd.c ++++ b/sound/usb/line6/podhd.c +@@ -235,7 +235,7 @@ static int podhd_dev_start(struct usb_line6_podhd *pod) + ret = usb_control_msg(usbdev, usb_sndctrlpipe(usbdev, 0), + 0x67, USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT, + 0x11, 0, +- NULL, 0, LINE6_TIMEOUT * HZ); ++ NULL, 0, LINE6_TIMEOUT); + if (ret < 0) { + dev_err(pod->line6.ifcdev, "read request failed (error %d)\n", ret); + goto exit; +@@ -245,7 +245,7 @@ static int podhd_dev_start(struct usb_line6_podhd *pod) + ret = usb_control_msg(usbdev, usb_rcvctrlpipe(usbdev, 0), 0x67, + USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN, + 0x11, 0x0, +- init_bytes, 3, LINE6_TIMEOUT * HZ); ++ init_bytes, 3, LINE6_TIMEOUT); + if (ret < 0) { + dev_err(pod->line6.ifcdev, + "receive length failed (error %d)\n", ret); +@@ -265,7 +265,7 @@ static int podhd_dev_start(struct usb_line6_podhd *pod) + USB_REQ_SET_FEATURE, + USB_TYPE_STANDARD | USB_RECIP_DEVICE | USB_DIR_OUT, + 1, 0, +- NULL, 0, LINE6_TIMEOUT * HZ); ++ NULL, 0, LINE6_TIMEOUT); + exit: + kfree(init_bytes); + return ret; +diff --git a/sound/usb/line6/toneport.c b/sound/usb/line6/toneport.c +index 4bdedfa87487a..a4fc8dc2baf39 100644 +--- a/sound/usb/line6/toneport.c ++++ b/sound/usb/line6/toneport.c +@@ -133,7 +133,7 @@ static int toneport_send_cmd(struct usb_device *usbdev, int cmd1, int cmd2) + + ret = usb_control_msg(usbdev, usb_sndctrlpipe(usbdev, 0), 0x67, + USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT, +- cmd1, cmd2, NULL, 0, LINE6_TIMEOUT * HZ); ++ cmd1, cmd2, NULL, 0, LINE6_TIMEOUT); + + if (ret < 0) { + dev_err(&usbdev->dev, "send failed (error %d)\n", ret); +diff --git a/sound/usb/misc/ua101.c b/sound/usb/misc/ua101.c +index 386fbfd5c6176..1aeddab02aad1 100644 +--- a/sound/usb/misc/ua101.c ++++ b/sound/usb/misc/ua101.c +@@ -1032,7 +1032,7 @@ static int detect_usb_format(struct ua101 *ua) + fmt_playback->bSubframeSize * ua->playback.channels; + + epd = &ua->intf[INTF_CAPTURE]->altsetting[1].endpoint[0].desc; +- if (!usb_endpoint_is_isoc_in(epd)) { ++ if (!usb_endpoint_is_isoc_in(epd) || usb_endpoint_maxp(epd) == 0) { + dev_err(&ua->dev->dev, "invalid capture endpoint\n"); + return -ENXIO; + } +@@ -1040,7 +1040,7 @@ static int detect_usb_format(struct ua101 *ua) + ua->capture.max_packet_bytes = usb_endpoint_maxp(epd); + + epd = &ua->intf[INTF_PLAYBACK]->altsetting[1].endpoint[0].desc; +- if (!usb_endpoint_is_isoc_out(epd)) { ++ if (!usb_endpoint_is_isoc_out(epd) || usb_endpoint_maxp(epd) == 0) { + dev_err(&ua->dev->dev, "invalid playback endpoint\n"); + return -ENXIO; + } |