diff options
| -rw-r--r-- | 0000_README | 4 | ||||
| -rw-r--r-- | 1019_linux-4.18.20.patch | 4811 |
2 files changed, 4815 insertions, 0 deletions
diff --git a/0000_README b/0000_README index 4d0ed54e..805997e8 100644 --- a/0000_README +++ b/0000_README @@ -119,6 +119,10 @@ Patch: 1018_linux-4.18.19.patch From: http://www.kernel.org Desc: Linux 4.18.19 +Patch: 1019_linux-4.18.20.patch +From: http://www.kernel.org +Desc: Linux 4.18.20 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1019_linux-4.18.20.patch b/1019_linux-4.18.20.patch new file mode 100644 index 00000000..6ea25b7b --- /dev/null +++ b/1019_linux-4.18.20.patch @@ -0,0 +1,4811 @@ +diff --git a/Makefile b/Makefile +index 71642133ba22..5f6697c4dbbc 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 18 +-SUBLEVEL = 19 ++SUBLEVEL = 20 + EXTRAVERSION = + NAME = Merciless Moray + +diff --git a/arch/alpha/include/asm/termios.h b/arch/alpha/include/asm/termios.h +index 6a8c53dec57e..b7c77bb1bfd2 100644 +--- a/arch/alpha/include/asm/termios.h ++++ b/arch/alpha/include/asm/termios.h +@@ -73,9 +73,15 @@ + }) + + #define user_termios_to_kernel_termios(k, u) \ +- copy_from_user(k, u, sizeof(struct termios)) ++ copy_from_user(k, u, sizeof(struct termios2)) + + #define kernel_termios_to_user_termios(u, k) \ ++ copy_to_user(u, k, sizeof(struct termios2)) ++ ++#define user_termios_to_kernel_termios_1(k, u) \ ++ copy_from_user(k, u, sizeof(struct termios)) ++ ++#define kernel_termios_to_user_termios_1(u, k) \ + copy_to_user(u, k, sizeof(struct termios)) + + #endif /* _ALPHA_TERMIOS_H */ +diff --git a/arch/alpha/include/uapi/asm/ioctls.h b/arch/alpha/include/uapi/asm/ioctls.h +index 3729d92d3fa8..dc8c20ac7191 100644 +--- a/arch/alpha/include/uapi/asm/ioctls.h ++++ b/arch/alpha/include/uapi/asm/ioctls.h +@@ -32,6 +32,11 @@ + #define TCXONC _IO('t', 30) + #define TCFLSH _IO('t', 31) + ++#define TCGETS2 _IOR('T', 42, struct termios2) ++#define TCSETS2 _IOW('T', 43, struct termios2) ++#define TCSETSW2 _IOW('T', 44, struct termios2) ++#define TCSETSF2 _IOW('T', 45, struct termios2) ++ + #define TIOCSWINSZ _IOW('t', 103, struct winsize) + #define TIOCGWINSZ _IOR('t', 104, struct winsize) + #define TIOCSTART _IO('t', 110) /* start output, like ^Q */ +diff --git a/arch/alpha/include/uapi/asm/termbits.h b/arch/alpha/include/uapi/asm/termbits.h +index de6c8360fbe3..4575ba34a0ea 100644 +--- a/arch/alpha/include/uapi/asm/termbits.h ++++ b/arch/alpha/include/uapi/asm/termbits.h +@@ -26,6 +26,19 @@ struct termios { + speed_t c_ospeed; /* output speed */ + }; + ++/* Alpha has identical termios and termios2 */ ++ ++struct termios2 { ++ tcflag_t c_iflag; /* input mode flags */ ++ tcflag_t c_oflag; /* output mode flags */ ++ tcflag_t c_cflag; /* control mode flags */ ++ tcflag_t c_lflag; /* local mode flags */ ++ cc_t c_cc[NCCS]; /* control characters */ ++ cc_t c_line; /* line discipline (== c_cc[19]) */ ++ speed_t c_ispeed; /* input speed */ ++ speed_t c_ospeed; /* output speed */ ++}; ++ + /* Alpha has matching termios and ktermios */ + + struct ktermios { +@@ -152,6 +165,7 @@ struct ktermios { + #define B3000000 00034 + #define B3500000 00035 + #define B4000000 00036 ++#define BOTHER 00037 + + #define CSIZE 00001400 + #define CS5 00000000 +@@ -169,6 +183,9 @@ struct ktermios { + #define CMSPAR 010000000000 /* mark or space (stick) parity */ + #define CRTSCTS 020000000000 /* flow control */ + ++#define CIBAUD 07600000 ++#define IBSHIFT 16 ++ + /* c_lflag bits */ + #define ISIG 0x00000080 + #define ICANON 0x00000100 +diff --git a/arch/arm/boot/dts/imx6ull-pinfunc.h b/arch/arm/boot/dts/imx6ull-pinfunc.h +index fdc46bb09cc1..3c12a6fb0b61 100644 +--- a/arch/arm/boot/dts/imx6ull-pinfunc.h ++++ b/arch/arm/boot/dts/imx6ull-pinfunc.h +@@ -14,14 +14,23 @@ + * The pin function ID is a tuple of + * <mux_reg conf_reg input_reg mux_mode input_val> + */ ++/* signals common for i.MX6UL and i.MX6ULL */ ++#undef MX6UL_PAD_UART5_TX_DATA__UART5_DTE_RX ++#define MX6UL_PAD_UART5_TX_DATA__UART5_DTE_RX 0x00BC 0x0348 0x0644 0x0 0x6 ++#undef MX6UL_PAD_UART5_RX_DATA__UART5_DCE_RX ++#define MX6UL_PAD_UART5_RX_DATA__UART5_DCE_RX 0x00C0 0x034C 0x0644 0x0 0x7 ++#undef MX6UL_PAD_ENET1_RX_EN__UART5_DCE_RTS ++#define MX6UL_PAD_ENET1_RX_EN__UART5_DCE_RTS 0x00CC 0x0358 0x0640 0x1 0x5 ++#undef MX6UL_PAD_ENET1_TX_DATA0__UART5_DTE_RTS ++#define MX6UL_PAD_ENET1_TX_DATA0__UART5_DTE_RTS 0x00D0 0x035C 0x0640 0x1 0x6 ++#undef MX6UL_PAD_CSI_DATA02__UART5_DCE_RTS ++#define MX6UL_PAD_CSI_DATA02__UART5_DCE_RTS 0x01EC 0x0478 0x0640 0x8 0x7 ++ ++/* signals for i.MX6ULL only */ + #define MX6ULL_PAD_UART1_TX_DATA__UART5_DTE_RX 0x0084 0x0310 0x0644 0x9 0x4 + #define MX6ULL_PAD_UART1_RX_DATA__UART5_DCE_RX 0x0088 0x0314 0x0644 0x9 0x5 + #define MX6ULL_PAD_UART1_CTS_B__UART5_DCE_RTS 0x008C 0x0318 0x0640 0x9 0x3 + #define MX6ULL_PAD_UART1_RTS_B__UART5_DTE_RTS 0x0090 0x031C 0x0640 0x9 0x4 +-#define MX6ULL_PAD_UART5_TX_DATA__UART5_DTE_RX 0x00BC 0x0348 0x0644 0x0 0x6 +-#define MX6ULL_PAD_UART5_RX_DATA__UART5_DCE_RX 0x00C0 0x034C 0x0644 0x0 0x7 +-#define MX6ULL_PAD_ENET1_RX_EN__UART5_DCE_RTS 0x00CC 0x0358 0x0640 0x1 0x5 +-#define MX6ULL_PAD_ENET1_TX_DATA0__UART5_DTE_RTS 0x00D0 0x035C 0x0640 0x1 0x6 + #define MX6ULL_PAD_ENET2_RX_DATA0__EPDC_SDDO08 0x00E4 0x0370 0x0000 0x9 0x0 + #define MX6ULL_PAD_ENET2_RX_DATA1__EPDC_SDDO09 0x00E8 0x0374 0x0000 0x9 0x0 + #define MX6ULL_PAD_ENET2_RX_EN__EPDC_SDDO10 0x00EC 0x0378 0x0000 0x9 0x0 +@@ -55,7 +64,6 @@ + #define MX6ULL_PAD_CSI_DATA00__ESAI_TX_HF_CLK 0x01E4 0x0470 0x0000 0x9 0x0 + #define MX6ULL_PAD_CSI_DATA01__ESAI_RX_HF_CLK 0x01E8 0x0474 0x0000 0x9 0x0 + #define MX6ULL_PAD_CSI_DATA02__ESAI_RX_FS 0x01EC 0x0478 0x0000 0x9 0x0 +-#define MX6ULL_PAD_CSI_DATA02__UART5_DCE_RTS 0x01EC 0x0478 0x0640 0x8 0x7 + #define MX6ULL_PAD_CSI_DATA03__ESAI_RX_CLK 0x01F0 0x047C 0x0000 0x9 0x0 + #define MX6ULL_PAD_CSI_DATA04__ESAI_TX_FS 0x01F4 0x0480 0x0000 0x9 0x0 + #define MX6ULL_PAD_CSI_DATA05__ESAI_TX_CLK 0x01F8 0x0484 0x0000 0x9 0x0 +diff --git a/arch/arm/configs/imx_v6_v7_defconfig b/arch/arm/configs/imx_v6_v7_defconfig +index 200ebda47e0c..254dcad97e67 100644 +--- a/arch/arm/configs/imx_v6_v7_defconfig ++++ b/arch/arm/configs/imx_v6_v7_defconfig +@@ -406,6 +406,7 @@ CONFIG_ZISOFS=y + CONFIG_UDF_FS=m + CONFIG_MSDOS_FS=m + CONFIG_VFAT_FS=y ++CONFIG_TMPFS_POSIX_ACL=y + CONFIG_JFFS2_FS=y + CONFIG_UBIFS_FS=y + CONFIG_NFS_FS=y +diff --git a/arch/arm/mm/proc-v7.S b/arch/arm/mm/proc-v7.S +index 6fe52819e014..339eb17c9808 100644 +--- a/arch/arm/mm/proc-v7.S ++++ b/arch/arm/mm/proc-v7.S +@@ -112,7 +112,7 @@ ENTRY(cpu_v7_hvc_switch_mm) + hvc #0 + ldmfd sp!, {r0 - r3} + b cpu_v7_switch_mm +-ENDPROC(cpu_v7_smc_switch_mm) ++ENDPROC(cpu_v7_hvc_switch_mm) + #endif + ENTRY(cpu_v7_iciallu_switch_mm) + mov r3, #0 +diff --git a/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi b/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi +index 3989876ab699..6c8bd13d64b8 100644 +--- a/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi ++++ b/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi +@@ -131,6 +131,9 @@ + reset-names = "stmmaceth"; + clocks = <&clkmgr STRATIX10_EMAC0_CLK>; + clock-names = "stmmaceth"; ++ tx-fifo-depth = <16384>; ++ rx-fifo-depth = <16384>; ++ snps,multicast-filter-bins = <256>; + status = "disabled"; + }; + +@@ -144,6 +147,9 @@ + reset-names = "stmmaceth"; + clocks = <&clkmgr STRATIX10_EMAC1_CLK>; + clock-names = "stmmaceth"; ++ tx-fifo-depth = <16384>; ++ rx-fifo-depth = <16384>; ++ snps,multicast-filter-bins = <256>; + status = "disabled"; + }; + +@@ -157,6 +163,9 @@ + reset-names = "stmmaceth"; + clocks = <&clkmgr STRATIX10_EMAC2_CLK>; + clock-names = "stmmaceth"; ++ tx-fifo-depth = <16384>; ++ rx-fifo-depth = <16384>; ++ snps,multicast-filter-bins = <256>; + status = "disabled"; + }; + +diff --git a/arch/arm64/boot/dts/altera/socfpga_stratix10_socdk.dts b/arch/arm64/boot/dts/altera/socfpga_stratix10_socdk.dts +index f9b1ef12db48..fb1b9ddd9f51 100644 +--- a/arch/arm64/boot/dts/altera/socfpga_stratix10_socdk.dts ++++ b/arch/arm64/boot/dts/altera/socfpga_stratix10_socdk.dts +@@ -76,7 +76,7 @@ + phy-mode = "rgmii"; + phy-handle = <&phy0>; + +- max-frame-size = <3800>; ++ max-frame-size = <9000>; + + mdio0 { + #address-cells = <1>; +diff --git a/arch/mips/include/asm/mach-loongson64/irq.h b/arch/mips/include/asm/mach-loongson64/irq.h +index 3644b68c0ccc..be9f727a9328 100644 +--- a/arch/mips/include/asm/mach-loongson64/irq.h ++++ b/arch/mips/include/asm/mach-loongson64/irq.h +@@ -10,7 +10,7 @@ + #define MIPS_CPU_IRQ_BASE 56 + + #define LOONGSON_UART_IRQ (MIPS_CPU_IRQ_BASE + 2) /* UART */ +-#define LOONGSON_HT1_IRQ (MIPS_CPU_IRQ_BASE + 3) /* HT1 */ ++#define LOONGSON_BRIDGE_IRQ (MIPS_CPU_IRQ_BASE + 3) /* CASCADE */ + #define LOONGSON_TIMER_IRQ (MIPS_CPU_IRQ_BASE + 7) /* CPU Timer */ + + #define LOONGSON_HT1_CFG_BASE loongson_sysconf.ht_control_base +diff --git a/arch/mips/kernel/crash.c b/arch/mips/kernel/crash.c +index d455363d51c3..4c07a43a3242 100644 +--- a/arch/mips/kernel/crash.c ++++ b/arch/mips/kernel/crash.c +@@ -36,6 +36,9 @@ static void crash_shutdown_secondary(void *passed_regs) + if (!cpu_online(cpu)) + return; + ++ /* We won't be sent IPIs any more. */ ++ set_cpu_online(cpu, false); ++ + local_irq_disable(); + if (!cpumask_test_cpu(cpu, &cpus_in_crash)) + crash_save_cpu(regs, cpu); +diff --git a/arch/mips/kernel/machine_kexec.c b/arch/mips/kernel/machine_kexec.c +index 8b574bcd39ba..4b3726e4fe3a 100644 +--- a/arch/mips/kernel/machine_kexec.c ++++ b/arch/mips/kernel/machine_kexec.c +@@ -118,6 +118,9 @@ machine_kexec(struct kimage *image) + *ptr = (unsigned long) phys_to_virt(*ptr); + } + ++ /* Mark offline BEFORE disabling local irq. */ ++ set_cpu_online(smp_processor_id(), false); ++ + /* + * we do not want to be bothered. + */ +diff --git a/arch/mips/loongson64/loongson-3/irq.c b/arch/mips/loongson64/loongson-3/irq.c +index cbeb20f9fc95..5605061f5f98 100644 +--- a/arch/mips/loongson64/loongson-3/irq.c ++++ b/arch/mips/loongson64/loongson-3/irq.c +@@ -96,51 +96,8 @@ void mach_irq_dispatch(unsigned int pending) + } + } + +-static struct irqaction cascade_irqaction = { +- .handler = no_action, +- .flags = IRQF_NO_SUSPEND, +- .name = "cascade", +-}; +- +-static inline void mask_loongson_irq(struct irq_data *d) +-{ +- clear_c0_status(0x100 << (d->irq - MIPS_CPU_IRQ_BASE)); +- irq_disable_hazard(); +- +- /* Workaround: UART IRQ may deliver to any core */ +- if (d->irq == LOONGSON_UART_IRQ) { +- int cpu = smp_processor_id(); +- int node_id = cpu_logical_map(cpu) / loongson_sysconf.cores_per_node; +- int core_id = cpu_logical_map(cpu) % loongson_sysconf.cores_per_node; +- u64 intenclr_addr = smp_group[node_id] | +- (u64)(&LOONGSON_INT_ROUTER_INTENCLR); +- u64 introuter_lpc_addr = smp_group[node_id] | +- (u64)(&LOONGSON_INT_ROUTER_LPC); +- +- *(volatile u32 *)intenclr_addr = 1 << 10; +- *(volatile u8 *)introuter_lpc_addr = 0x10 + (1<<core_id); +- } +-} +- +-static inline void unmask_loongson_irq(struct irq_data *d) +-{ +- /* Workaround: UART IRQ may deliver to any core */ +- if (d->irq == LOONGSON_UART_IRQ) { +- int cpu = smp_processor_id(); +- int node_id = cpu_logical_map(cpu) / loongson_sysconf.cores_per_node; +- int core_id = cpu_logical_map(cpu) % loongson_sysconf.cores_per_node; +- u64 intenset_addr = smp_group[node_id] | +- (u64)(&LOONGSON_INT_ROUTER_INTENSET); +- u64 introuter_lpc_addr = smp_group[node_id] | +- (u64)(&LOONGSON_INT_ROUTER_LPC); +- +- *(volatile u32 *)intenset_addr = 1 << 10; +- *(volatile u8 *)introuter_lpc_addr = 0x10 + (1<<core_id); +- } +- +- set_c0_status(0x100 << (d->irq - MIPS_CPU_IRQ_BASE)); +- irq_enable_hazard(); +-} ++static inline void mask_loongson_irq(struct irq_data *d) { } ++static inline void unmask_loongson_irq(struct irq_data *d) { } + + /* For MIPS IRQs which shared by all cores */ + static struct irq_chip loongson_irq_chip = { +@@ -183,12 +140,11 @@ void __init mach_init_irq(void) + chip->irq_set_affinity = plat_set_irq_affinity; + + irq_set_chip_and_handler(LOONGSON_UART_IRQ, +- &loongson_irq_chip, handle_level_irq); +- +- /* setup HT1 irq */ +- setup_irq(LOONGSON_HT1_IRQ, &cascade_irqaction); ++ &loongson_irq_chip, handle_percpu_irq); ++ irq_set_chip_and_handler(LOONGSON_BRIDGE_IRQ, ++ &loongson_irq_chip, handle_percpu_irq); + +- set_c0_status(STATUSF_IP2 | STATUSF_IP6); ++ set_c0_status(STATUSF_IP2 | STATUSF_IP3 | STATUSF_IP6); + } + + #ifdef CONFIG_HOTPLUG_CPU +diff --git a/arch/mips/pci/pci-legacy.c b/arch/mips/pci/pci-legacy.c +index f1e92bf743c2..3c3b1e6abb53 100644 +--- a/arch/mips/pci/pci-legacy.c ++++ b/arch/mips/pci/pci-legacy.c +@@ -127,8 +127,12 @@ static void pcibios_scanbus(struct pci_controller *hose) + if (pci_has_flag(PCI_PROBE_ONLY)) { + pci_bus_claim_resources(bus); + } else { ++ struct pci_bus *child; ++ + pci_bus_size_bridges(bus); + pci_bus_assign_resources(bus); ++ list_for_each_entry(child, &bus->children, node) ++ pcie_bus_configure_settings(child); + } + pci_bus_add_devices(bus); + } +diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile +index fb96206de317..2510ff9381d0 100644 +--- a/arch/powerpc/Makefile ++++ b/arch/powerpc/Makefile +@@ -244,7 +244,11 @@ cpu-as-$(CONFIG_4xx) += -Wa,-m405 + cpu-as-$(CONFIG_ALTIVEC) += $(call as-option,-Wa$(comma)-maltivec) + cpu-as-$(CONFIG_E200) += -Wa,-me200 + cpu-as-$(CONFIG_E500) += -Wa,-me500 +-cpu-as-$(CONFIG_PPC_BOOK3S_64) += -Wa,-mpower4 ++ ++# When using '-many -mpower4' gas will first try and find a matching power4 ++# mnemonic and failing that it will allow any valid mnemonic that GAS knows ++# about. GCC will pass -many to GAS when assembling, clang does not. ++cpu-as-$(CONFIG_PPC_BOOK3S_64) += -Wa,-mpower4 -Wa,-many + cpu-as-$(CONFIG_PPC_E500MC) += $(call as-option,-Wa$(comma)-me500mc) + + KBUILD_AFLAGS += $(cpu-as-y) +diff --git a/arch/powerpc/boot/crt0.S b/arch/powerpc/boot/crt0.S +index dcf2f15e6797..32dfe6d083f3 100644 +--- a/arch/powerpc/boot/crt0.S ++++ b/arch/powerpc/boot/crt0.S +@@ -47,8 +47,10 @@ p_end: .long _end + p_pstack: .long _platform_stack_top + #endif + +- .weak _zimage_start + .globl _zimage_start ++ /* Clang appears to require the .weak directive to be after the symbol ++ * is defined. See https://bugs.llvm.org/show_bug.cgi?id=38921 */ ++ .weak _zimage_start + _zimage_start: + .globl _zimage_start_lib + _zimage_start_lib: +diff --git a/arch/powerpc/include/asm/mmu-8xx.h b/arch/powerpc/include/asm/mmu-8xx.h +index 4f547752ae79..193f53116c7a 100644 +--- a/arch/powerpc/include/asm/mmu-8xx.h ++++ b/arch/powerpc/include/asm/mmu-8xx.h +@@ -34,20 +34,12 @@ + * respectively NA for All or X for Supervisor and no access for User. + * Then we use the APG to say whether accesses are according to Page rules or + * "all Supervisor" rules (Access to all) +- * We also use the 2nd APG bit for _PAGE_ACCESSED when having SWAP: +- * When that bit is not set access is done iaw "all user" +- * which means no access iaw page rules. +- * Therefore, we define 4 APG groups. lsb is _PMD_USER, 2nd is _PAGE_ACCESSED +- * 0x => No access => 11 (all accesses performed as user iaw page definition) +- * 10 => No user => 01 (all accesses performed according to page definition) +- * 11 => User => 00 (all accesses performed as supervisor iaw page definition) ++ * Therefore, we define 2 APG groups. lsb is _PMD_USER ++ * 0 => No user => 01 (all accesses performed according to page definition) ++ * 1 => User => 00 (all accesses performed as supervisor iaw page definition) + * We define all 16 groups so that all other bits of APG can take any value + */ +-#ifdef CONFIG_SWAP +-#define MI_APG_INIT 0xf4f4f4f4 +-#else + #define MI_APG_INIT 0x44444444 +-#endif + + /* The effective page number register. When read, contains the information + * about the last instruction TLB miss. When MI_RPN is written, bits in +@@ -115,20 +107,12 @@ + * Supervisor and no access for user and NA for ALL. + * Then we use the APG to say whether accesses are according to Page rules or + * "all Supervisor" rules (Access to all) +- * We also use the 2nd APG bit for _PAGE_ACCESSED when having SWAP: +- * When that bit is not set access is done iaw "all user" +- * which means no access iaw page rules. +- * Therefore, we define 4 APG groups. lsb is _PMD_USER, 2nd is _PAGE_ACCESSED +- * 0x => No access => 11 (all accesses performed as user iaw page definition) +- * 10 => No user => 01 (all accesses performed according to page definition) +- * 11 => User => 00 (all accesses performed as supervisor iaw page definition) ++ * Therefore, we define 2 APG groups. lsb is _PMD_USER ++ * 0 => No user => 01 (all accesses performed according to page definition) ++ * 1 => User => 00 (all accesses performed as supervisor iaw page definition) + * We define all 16 groups so that all other bits of APG can take any value + */ +-#ifdef CONFIG_SWAP +-#define MD_APG_INIT 0xf4f4f4f4 +-#else + #define MD_APG_INIT 0x44444444 +-#endif + + /* The effective page number register. When read, contains the information + * about the last instruction TLB miss. When MD_RPN is written, bits in +@@ -180,12 +164,6 @@ + */ + #define SPRN_M_TW 799 + +-/* APGs */ +-#define M_APG0 0x00000000 +-#define M_APG1 0x00000020 +-#define M_APG2 0x00000040 +-#define M_APG3 0x00000060 +- + #ifdef CONFIG_PPC_MM_SLICES + #include <asm/nohash/32/slice.h> + #define SLICE_ARRAY_SIZE (1 << (32 - SLICE_LOW_SHIFT - 1)) +diff --git a/arch/powerpc/kernel/eeh.c b/arch/powerpc/kernel/eeh.c +index 5746809cfaad..bf0a02038cad 100644 +--- a/arch/powerpc/kernel/eeh.c ++++ b/arch/powerpc/kernel/eeh.c +@@ -169,6 +169,11 @@ static size_t eeh_dump_dev_log(struct eeh_dev *edev, char *buf, size_t len) + int n = 0, l = 0; + char buffer[128]; + ++ if (!pdn) { ++ pr_warn("EEH: Note: No error log for absent device.\n"); ++ return 0; ++ } ++ + n += scnprintf(buf+n, len-n, "%04x:%02x:%02x.%01x\n", + pdn->phb->global_number, pdn->busno, + PCI_SLOT(pdn->devfn), PCI_FUNC(pdn->devfn)); +diff --git a/arch/powerpc/kernel/head_8xx.S b/arch/powerpc/kernel/head_8xx.S +index 6cab07e76732..19bdc65d05b8 100644 +--- a/arch/powerpc/kernel/head_8xx.S ++++ b/arch/powerpc/kernel/head_8xx.S +@@ -354,13 +354,14 @@ _ENTRY(ITLBMiss_cmp) + #if defined(ITLB_MISS_KERNEL) || defined(CONFIG_HUGETLB_PAGE) + mtcr r12 + #endif +- +-#ifdef CONFIG_SWAP +- rlwinm r11, r10, 31, _PAGE_ACCESSED >> 1 +-#endif + /* Load the MI_TWC with the attributes for this "segment." */ + mtspr SPRN_MI_TWC, r11 /* Set segment attributes */ + ++#ifdef CONFIG_SWAP ++ rlwinm r11, r10, 32-5, _PAGE_PRESENT ++ and r11, r11, r10 ++ rlwimi r10, r11, 0, _PAGE_PRESENT ++#endif + li r11, RPN_PATTERN | 0x200 + /* The Linux PTE won't go exactly into the MMU TLB. + * Software indicator bits 20 and 23 must be clear. +@@ -471,14 +472,22 @@ _ENTRY(DTLBMiss_jmp) + * above. + */ + rlwimi r11, r10, 0, _PAGE_GUARDED +-#ifdef CONFIG_SWAP +- /* _PAGE_ACCESSED has to be set. We use second APG bit for that, 0 +- * on that bit will represent a Non Access group +- */ +- rlwinm r11, r10, 31, _PAGE_ACCESSED >> 1 +-#endif + mtspr SPRN_MD_TWC, r11 + ++ /* Both _PAGE_ACCESSED and _PAGE_PRESENT has to be set. ++ * We also need to know if the insn is a load/store, so: ++ * Clear _PAGE_PRESENT and load that which will ++ * trap into DTLB Error with store bit set accordinly. ++ */ ++ /* PRESENT=0x1, ACCESSED=0x20 ++ * r11 = ((r10 & PRESENT) & ((r10 & ACCESSED) >> 5)); ++ * r10 = (r10 & ~PRESENT) | r11; ++ */ ++#ifdef CONFIG_SWAP ++ rlwinm r11, r10, 32-5, _PAGE_PRESENT ++ and r11, r11, r10 ++ rlwimi r10, r11, 0, _PAGE_PRESENT ++#endif + /* The Linux PTE won't go exactly into the MMU TLB. + * Software indicator bits 24, 25, 26, and 27 must be + * set. All other Linux PTE bits control the behavior +@@ -638,8 +647,8 @@ InstructionBreakpoint: + */ + DTLBMissIMMR: + mtcr r12 +- /* Set 512k byte guarded page and mark it valid and accessed */ +- li r10, MD_PS512K | MD_GUARDED | MD_SVALID | M_APG2 ++ /* Set 512k byte guarded page and mark it valid */ ++ li r10, MD_PS512K | MD_GUARDED | MD_SVALID + mtspr SPRN_MD_TWC, r10 + mfspr r10, SPRN_IMMR /* Get current IMMR */ + rlwinm r10, r10, 0, 0xfff80000 /* Get 512 kbytes boundary */ +@@ -657,8 +666,8 @@ _ENTRY(dtlb_miss_exit_2) + + DTLBMissLinear: + mtcr r12 +- /* Set 8M byte page and mark it valid and accessed */ +- li r11, MD_PS8MEG | MD_SVALID | M_APG2 ++ /* Set 8M byte page and mark it valid */ ++ li r11, MD_PS8MEG | MD_SVALID + mtspr SPRN_MD_TWC, r11 + rlwinm r10, r10, 0, 0x0f800000 /* 8xx supports max 256Mb RAM */ + ori r10, r10, 0xf0 | MD_SPS16K | _PAGE_PRIVILEGED | _PAGE_DIRTY | \ +@@ -676,8 +685,8 @@ _ENTRY(dtlb_miss_exit_3) + #ifndef CONFIG_PIN_TLB_TEXT + ITLBMissLinear: + mtcr r12 +- /* Set 8M byte page and mark it valid,accessed */ +- li r11, MI_PS8MEG | MI_SVALID | M_APG2 ++ /* Set 8M byte page and mark it valid */ ++ li r11, MI_PS8MEG | MI_SVALID + mtspr SPRN_MI_TWC, r11 + rlwinm r10, r10, 0, 0x0f800000 /* 8xx supports max 256Mb RAM */ + ori r10, r10, 0xf0 | MI_SPS16K | _PAGE_PRIVILEGED | _PAGE_DIRTY | \ +@@ -960,7 +969,7 @@ initial_mmu: + ori r8, r8, MI_EVALID /* Mark it valid */ + mtspr SPRN_MI_EPN, r8 + li r8, MI_PS8MEG /* Set 8M byte page */ +- ori r8, r8, MI_SVALID | M_APG2 /* Make it valid, APG 2 */ ++ ori r8, r8, MI_SVALID /* Make it valid */ + mtspr SPRN_MI_TWC, r8 + li r8, MI_BOOTINIT /* Create RPN for address 0 */ + mtspr SPRN_MI_RPN, r8 /* Store TLB entry */ +@@ -987,7 +996,7 @@ initial_mmu: + ori r8, r8, MD_EVALID /* Mark it valid */ + mtspr SPRN_MD_EPN, r8 + li r8, MD_PS512K | MD_GUARDED /* Set 512k byte page */ +- ori r8, r8, MD_SVALID | M_APG2 /* Make it valid and accessed */ ++ ori r8, r8, MD_SVALID /* Make it valid */ + mtspr SPRN_MD_TWC, r8 + mr r8, r9 /* Create paddr for TLB */ + ori r8, r8, MI_BOOTINIT|0x2 /* Inhibit cache -- Cort */ +diff --git a/arch/powerpc/kernel/module_64.c b/arch/powerpc/kernel/module_64.c +index b8d61e019d06..f7b1203bdaee 100644 +--- a/arch/powerpc/kernel/module_64.c ++++ b/arch/powerpc/kernel/module_64.c +@@ -685,7 +685,14 @@ int apply_relocate_add(Elf64_Shdr *sechdrs, + + case R_PPC64_REL32: + /* 32 bits relative (used by relative exception tables) */ +- *(u32 *)location = value - (unsigned long)location; ++ /* Convert value to relative */ ++ value -= (unsigned long)location; ++ if (value + 0x80000000 > 0xffffffff) { ++ pr_err("%s: REL32 %li out of range!\n", ++ me->name, (long int)value); ++ return -ENOEXEC; ++ } ++ *(u32 *)location = value; + break; + + case R_PPC64_TOCSAVE: +diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c +index 0e17dcb48720..6bfcb5a506af 100644 +--- a/arch/powerpc/kernel/traps.c ++++ b/arch/powerpc/kernel/traps.c +@@ -736,12 +736,17 @@ void machine_check_exception(struct pt_regs *regs) + if (check_io_access(regs)) + goto bail; + +- die("Machine check", regs, SIGBUS); +- + /* Must die if the interrupt is not recoverable */ + if (!(regs->msr & MSR_RI)) + nmi_panic(regs, "Unrecoverable Machine check"); + ++ if (!nested) ++ nmi_exit(); ++ ++ die("Machine check", regs, SIGBUS); ++ ++ return; ++ + bail: + if (!nested) + nmi_exit(); +diff --git a/arch/powerpc/mm/8xx_mmu.c b/arch/powerpc/mm/8xx_mmu.c +index cf77d755246d..5d53684c2ebd 100644 +--- a/arch/powerpc/mm/8xx_mmu.c ++++ b/arch/powerpc/mm/8xx_mmu.c +@@ -79,7 +79,7 @@ void __init MMU_init_hw(void) + for (; i < 32 && mem >= LARGE_PAGE_SIZE_8M; i++) { + mtspr(SPRN_MD_CTR, ctr | (i << 8)); + mtspr(SPRN_MD_EPN, (unsigned long)__va(addr) | MD_EVALID); +- mtspr(SPRN_MD_TWC, MD_PS8MEG | MD_SVALID | M_APG2); ++ mtspr(SPRN_MD_TWC, MD_PS8MEG | MD_SVALID); + mtspr(SPRN_MD_RPN, addr | flags | _PAGE_PRESENT); + addr += LARGE_PAGE_SIZE_8M; + mem -= LARGE_PAGE_SIZE_8M; +diff --git a/arch/powerpc/mm/dump_linuxpagetables.c b/arch/powerpc/mm/dump_linuxpagetables.c +index 876e2a3c79f2..bdf33b989f98 100644 +--- a/arch/powerpc/mm/dump_linuxpagetables.c ++++ b/arch/powerpc/mm/dump_linuxpagetables.c +@@ -418,12 +418,13 @@ static void walk_pagetables(struct pg_state *st) + unsigned int i; + unsigned long addr; + ++ addr = st->start_address; ++ + /* + * Traverse the linux pagetable structure and dump pages that are in + * the hash pagetable. + */ +- for (i = 0; i < PTRS_PER_PGD; i++, pgd++) { +- addr = KERN_VIRT_START + i * PGDIR_SIZE; ++ for (i = 0; i < PTRS_PER_PGD; i++, pgd++, addr += PGDIR_SIZE) { + if (!pgd_none(*pgd) && !pgd_huge(*pgd)) + /* pgd exists */ + walk_pud(st, pgd, addr); +@@ -472,9 +473,14 @@ static int ptdump_show(struct seq_file *m, void *v) + { + struct pg_state st = { + .seq = m, +- .start_address = KERN_VIRT_START, + .marker = address_markers, + }; ++ ++ if (radix_enabled()) ++ st.start_address = PAGE_OFFSET; ++ else ++ st.start_address = KERN_VIRT_START; ++ + /* Traverse kernel page tables */ + walk_pagetables(&st); + note_page(&st, 0, 0, 0); +diff --git a/arch/powerpc/mm/hugetlbpage.c b/arch/powerpc/mm/hugetlbpage.c +index 8a9a49c13865..a84c410e5090 100644 +--- a/arch/powerpc/mm/hugetlbpage.c ++++ b/arch/powerpc/mm/hugetlbpage.c +@@ -19,6 +19,7 @@ + #include <linux/moduleparam.h> + #include <linux/swap.h> + #include <linux/swapops.h> ++#include <linux/kmemleak.h> + #include <asm/pgtable.h> + #include <asm/pgalloc.h> + #include <asm/tlb.h> +@@ -112,6 +113,8 @@ static int __hugepte_alloc(struct mm_struct *mm, hugepd_t *hpdp, + for (i = i - 1 ; i >= 0; i--, hpdp--) + *hpdp = __hugepd(0); + kmem_cache_free(cachep, new); ++ } else { ++ kmemleak_ignore(new); + } + spin_unlock(ptl); + return 0; +diff --git a/arch/powerpc/mm/slice.c b/arch/powerpc/mm/slice.c +index 205fe557ca10..4f213ba33491 100644 +--- a/arch/powerpc/mm/slice.c ++++ b/arch/powerpc/mm/slice.c +@@ -61,6 +61,13 @@ static void slice_print_mask(const char *label, const struct slice_mask *mask) { + + #endif + ++static inline bool slice_addr_is_low(unsigned long addr) ++{ ++ u64 tmp = (u64)addr; ++ ++ return tmp < SLICE_LOW_TOP; ++} ++ + static void slice_range_to_mask(unsigned long start, unsigned long len, + struct slice_mask *ret) + { +@@ -70,7 +77,7 @@ static void slice_range_to_mask(unsigned long start, unsigned long len, + if (SLICE_NUM_HIGH) + bitmap_zero(ret->high_slices, SLICE_NUM_HIGH); + +- if (start < SLICE_LOW_TOP) { ++ if (slice_addr_is_low(start)) { + unsigned long mend = min(end, + (unsigned long)(SLICE_LOW_TOP - 1)); + +@@ -78,7 +85,7 @@ static void slice_range_to_mask(unsigned long start, unsigned long len, + - (1u << GET_LOW_SLICE_INDEX(start)); + } + +- if ((start + len) > SLICE_LOW_TOP) { ++ if (SLICE_NUM_HIGH && !slice_addr_is_low(end)) { + unsigned long start_index = GET_HIGH_SLICE_INDEX(start); + unsigned long align_end = ALIGN(end, (1UL << SLICE_HIGH_SHIFT)); + unsigned long count = GET_HIGH_SLICE_INDEX(align_end) - start_index; +@@ -133,7 +140,7 @@ static void slice_mask_for_free(struct mm_struct *mm, struct slice_mask *ret, + if (!slice_low_has_vma(mm, i)) + ret->low_slices |= 1u << i; + +- if (high_limit <= SLICE_LOW_TOP) ++ if (slice_addr_is_low(high_limit - 1)) + return; + + for (i = 0; i < GET_HIGH_SLICE_INDEX(high_limit); i++) +@@ -182,7 +189,7 @@ static bool slice_check_range_fits(struct mm_struct *mm, + unsigned long end = start + len - 1; + u64 low_slices = 0; + +- if (start < SLICE_LOW_TOP) { ++ if (slice_addr_is_low(start)) { + unsigned long mend = min(end, + (unsigned long)(SLICE_LOW_TOP - 1)); + +@@ -192,7 +199,7 @@ static bool slice_check_range_fits(struct mm_struct *mm, + if ((low_slices & available->low_slices) != low_slices) + return false; + +- if (SLICE_NUM_HIGH && ((start + len) > SLICE_LOW_TOP)) { ++ if (SLICE_NUM_HIGH && !slice_addr_is_low(end)) { + unsigned long start_index = GET_HIGH_SLICE_INDEX(start); + unsigned long align_end = ALIGN(end, (1UL << SLICE_HIGH_SHIFT)); + unsigned long count = GET_HIGH_SLICE_INDEX(align_end) - start_index; +@@ -303,7 +310,7 @@ static bool slice_scan_available(unsigned long addr, + int end, unsigned long *boundary_addr) + { + unsigned long slice; +- if (addr < SLICE_LOW_TOP) { ++ if (slice_addr_is_low(addr)) { + slice = GET_LOW_SLICE_INDEX(addr); + *boundary_addr = (slice + end) << SLICE_LOW_SHIFT; + return !!(available->low_slices & (1u << slice)); +@@ -706,7 +713,7 @@ unsigned int get_slice_psize(struct mm_struct *mm, unsigned long addr) + + VM_BUG_ON(radix_enabled()); + +- if (addr < SLICE_LOW_TOP) { ++ if (slice_addr_is_low(addr)) { + psizes = mm->context.low_slices_psize; + index = GET_LOW_SLICE_INDEX(addr); + } else { +diff --git a/arch/powerpc/mm/tlb_nohash.c b/arch/powerpc/mm/tlb_nohash.c +index 15fe5f0c8665..ae5d568e267f 100644 +--- a/arch/powerpc/mm/tlb_nohash.c ++++ b/arch/powerpc/mm/tlb_nohash.c +@@ -503,6 +503,9 @@ static void setup_page_sizes(void) + for (psize = 0; psize < MMU_PAGE_COUNT; ++psize) { + struct mmu_psize_def *def = &mmu_psize_defs[psize]; + ++ if (!def->shift) ++ continue; ++ + if (tlb1ps & (1U << (def->shift - 10))) { + def->flags |= MMU_PAGE_SIZE_DIRECT; + +diff --git a/arch/powerpc/platforms/powernv/memtrace.c b/arch/powerpc/platforms/powernv/memtrace.c +index b99283df8584..265669002da0 100644 +--- a/arch/powerpc/platforms/powernv/memtrace.c ++++ b/arch/powerpc/platforms/powernv/memtrace.c +@@ -119,17 +119,15 @@ static bool memtrace_offline_pages(u32 nid, u64 start_pfn, u64 nr_pages) + walk_memory_range(start_pfn, end_pfn, (void *)MEM_OFFLINE, + change_memblock_state); + +- lock_device_hotplug(); +- remove_memory(nid, start_pfn << PAGE_SHIFT, nr_pages << PAGE_SHIFT); +- unlock_device_hotplug(); + + return true; + } + + static u64 memtrace_alloc_node(u32 nid, u64 size) + { +- u64 start_pfn, end_pfn, nr_pages; ++ u64 start_pfn, end_pfn, nr_pages, pfn; + u64 base_pfn; ++ u64 bytes = memory_block_size_bytes(); + + if (!node_spanned_pages(nid)) + return 0; +@@ -142,8 +140,21 @@ static u64 memtrace_alloc_node(u32 nid, u64 size) + end_pfn = round_down(end_pfn - nr_pages, nr_pages); + + for (base_pfn = end_pfn; base_pfn > start_pfn; base_pfn -= nr_pages) { +- if (memtrace_offline_pages(nid, base_pfn, nr_pages) == true) ++ if (memtrace_offline_pages(nid, base_pfn, nr_pages) == true) { ++ /* ++ * Remove memory in memory block size chunks so that ++ * iomem resources are always split to the same size and ++ * we never try to remove memory that spans two iomem ++ * resources. ++ */ ++ lock_device_hotplug(); ++ end_pfn = base_pfn + nr_pages; ++ for (pfn = base_pfn; pfn < end_pfn; pfn += bytes>> PAGE_SHIFT) { ++ remove_memory(nid, pfn << PAGE_SHIFT, bytes); ++ } ++ unlock_device_hotplug(); + return base_pfn << PAGE_SHIFT; ++ } + } + + return 0; +diff --git a/arch/x86/include/asm/mce.h b/arch/x86/include/asm/mce.h +index 3a17107594c8..eb786f90f2d3 100644 +--- a/arch/x86/include/asm/mce.h ++++ b/arch/x86/include/asm/mce.h +@@ -216,6 +216,8 @@ static inline int umc_normaddr_to_sysaddr(u64 norm_addr, u16 nid, u8 umc, u64 *s + + int mce_available(struct cpuinfo_x86 *c); + bool mce_is_memory_error(struct mce *m); ++bool mce_is_correctable(struct mce *m); ++int mce_usable_address(struct mce *m); + + DECLARE_PER_CPU(unsigned, mce_exception_count); + DECLARE_PER_CPU(unsigned, mce_poll_count); +diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c +index 8c50754c09c1..c51b9d116be1 100644 +--- a/arch/x86/kernel/cpu/mcheck/mce.c ++++ b/arch/x86/kernel/cpu/mcheck/mce.c +@@ -489,7 +489,7 @@ static void mce_report_event(struct pt_regs *regs) + * be somewhat complicated (e.g. segment offset would require an instruction + * parser). So only support physical addresses up to page granuality for now. + */ +-static int mce_usable_address(struct mce *m) ++int mce_usable_address(struct mce *m) + { + if (!(m->status & MCI_STATUS_ADDRV)) + return 0; +@@ -509,6 +509,7 @@ static int mce_usable_address(struct mce *m) + + return 1; + } ++EXPORT_SYMBOL_GPL(mce_usable_address); + + bool mce_is_memory_error(struct mce *m) + { +@@ -538,7 +539,7 @@ bool mce_is_memory_error(struct mce *m) + } + EXPORT_SYMBOL_GPL(mce_is_memory_error); + +-static bool mce_is_correctable(struct mce *m) ++bool mce_is_correctable(struct mce *m) + { + if (m->cpuvendor == X86_VENDOR_AMD && m->status & MCI_STATUS_DEFERRED) + return false; +@@ -548,6 +549,7 @@ static bool mce_is_correctable(struct mce *m) + + return true; + } ++EXPORT_SYMBOL_GPL(mce_is_correctable); + + static bool cec_add_mce(struct mce *m) + { +diff --git a/arch/x86/kernel/cpu/mshyperv.c b/arch/x86/kernel/cpu/mshyperv.c +index 031082c96db8..12a67046fefb 100644 +--- a/arch/x86/kernel/cpu/mshyperv.c ++++ b/arch/x86/kernel/cpu/mshyperv.c +@@ -20,6 +20,7 @@ + #include <linux/interrupt.h> + #include <linux/irq.h> + #include <linux/kexec.h> ++#include <linux/i8253.h> + #include <asm/processor.h> + #include <asm/hypervisor.h> + #include <asm/hyperv-tlfs.h> +@@ -285,6 +286,16 @@ static void __init ms_hyperv_init_platform(void) + if (efi_enabled(EFI_BOOT)) + x86_platform.get_nmi_reason = hv_get_nmi_reason; + ++ /* ++ * Hyper-V VMs have a PIT emulation quirk such that zeroing the ++ * counter register during PIT shutdown restarts the PIT. So it ++ * continues to interrupt @18.2 HZ. Setting i8253_clear_counter ++ * to false tells pit_shutdown() not to zero the counter so that ++ * the PIT really is shutdown. Generation 2 VMs don't have a PIT, ++ * and setting this value has no effect. ++ */ ++ i8253_clear_counter_on_shutdown = false; ++ + #if IS_ENABLED(CONFIG_HYPERV) + /* + * Setup the hook to get control post apic initialization. +diff --git a/arch/x86/kernel/cpu/vmware.c b/arch/x86/kernel/cpu/vmware.c +index 8e005329648b..d805202c63cd 100644 +--- a/arch/x86/kernel/cpu/vmware.c ++++ b/arch/x86/kernel/cpu/vmware.c +@@ -77,7 +77,7 @@ static __init int setup_vmw_sched_clock(char *s) + } + early_param("no-vmw-sched-clock", setup_vmw_sched_clock); + +-static unsigned long long vmware_sched_clock(void) ++static unsigned long long notrace vmware_sched_clock(void) + { + unsigned long long ns; + +diff --git a/arch/x86/um/shared/sysdep/ptrace_32.h b/arch/x86/um/shared/sysdep/ptrace_32.h +index b94a108de1dc..ae00d22bce02 100644 +--- a/arch/x86/um/shared/sysdep/ptrace_32.h ++++ b/arch/x86/um/shared/sysdep/ptrace_32.h +@@ -10,20 +10,10 @@ + + static inline void update_debugregs(int seq) {} + +-/* syscall emulation path in ptrace */ +- +-#ifndef PTRACE_SYSEMU +-#define PTRACE_SYSEMU 31 +-#endif +- + void set_using_sysemu(int value); + int get_using_sysemu(void); + extern int sysemu_supported; + +-#ifndef PTRACE_SYSEMU_SINGLESTEP +-#define PTRACE_SYSEMU_SINGLESTEP 32 +-#endif +- + #define UPT_SYSCALL_ARG1(r) UPT_BX(r) + #define UPT_SYSCALL_ARG2(r) UPT_CX(r) + #define UPT_SYSCALL_ARG3(r) UPT_DX(r) +diff --git a/arch/xtensa/boot/Makefile b/arch/xtensa/boot/Makefile +index 53e4178711e6..8c20a7965bda 100644 +--- a/arch/xtensa/boot/Makefile ++++ b/arch/xtensa/boot/Makefile +@@ -34,7 +34,7 @@ boot-elf boot-redboot: $(addprefix $(obj)/,$(subdir-y)) \ + $(addprefix $(obj)/,$(host-progs)) + $(Q)$(MAKE) $(build)=$(obj)/$@ $(MAKECMDGOALS) + +-OBJCOPYFLAGS = --strip-all -R .comment -R .note.gnu.build-id -O binary ++OBJCOPYFLAGS = --strip-all -R .comment -R .notes -O binary + + vmlinux.bin: vmlinux FORCE + $(call if_changed,objcopy) +diff --git a/arch/xtensa/include/asm/processor.h b/arch/xtensa/include/asm/processor.h +index 5b0027d4ecc0..a39cd81b741a 100644 +--- a/arch/xtensa/include/asm/processor.h ++++ b/arch/xtensa/include/asm/processor.h +@@ -24,7 +24,11 @@ + # error Linux requires the Xtensa Windowed Registers Option. + #endif + +-#define ARCH_SLAB_MINALIGN XCHAL_DATA_WIDTH ++/* Xtensa ABI requires stack alignment to be at least 16 */ ++ ++#define STACK_ALIGN (XCHAL_DATA_WIDTH > 16 ? XCHAL_DATA_WIDTH : 16) ++ ++#define ARCH_SLAB_MINALIGN STACK_ALIGN + + /* + * User space process size: 1 GB. +diff --git a/arch/xtensa/kernel/head.S b/arch/xtensa/kernel/head.S +index 9c4e9433e536..3ceb76c7a4ae 100644 +--- a/arch/xtensa/kernel/head.S ++++ b/arch/xtensa/kernel/head.S +@@ -88,9 +88,12 @@ _SetupMMU: + initialize_mmu + #if defined(CONFIG_MMU) && XCHAL_HAVE_PTP_MMU && XCHAL_HAVE_SPANNING_WAY + rsr a2, excsave1 +- movi a3, 0x08000000 ++ movi a3, XCHAL_KSEG_PADDR ++ bltu a2, a3, 1f ++ sub a2, a2, a3 ++ movi a3, XCHAL_KSEG_SIZE + bgeu a2, a3, 1f +- movi a3, 0xd0000000 ++ movi a3, XCHAL_KSEG_CACHED_VADDR + add a2, a2, a3 + wsr a2, excsave1 + 1: +diff --git a/arch/xtensa/kernel/vmlinux.lds.S b/arch/xtensa/kernel/vmlinux.lds.S +index 70b731edc7b8..c430c96ea723 100644 +--- a/arch/xtensa/kernel/vmlinux.lds.S ++++ b/arch/xtensa/kernel/vmlinux.lds.S +@@ -131,6 +131,7 @@ SECTIONS + .fixup : { *(.fixup) } + + EXCEPTION_TABLE(16) ++ NOTES + /* Data section */ + + _sdata = .; +diff --git a/block/blk-core.c b/block/blk-core.c +index f9d2e1b66e05..41b7396c8658 100644 +--- a/block/blk-core.c ++++ b/block/blk-core.c +@@ -793,9 +793,8 @@ void blk_cleanup_queue(struct request_queue *q) + * dispatch may still be in-progress since we dispatch requests + * from more than one contexts. + * +- * No need to quiesce queue if it isn't initialized yet since +- * blk_freeze_queue() should be enough for cases of passthrough +- * request. ++ * We rely on driver to deal with the race in case that queue ++ * initialization isn't done. + */ + if (q->mq_ops && blk_queue_init_done(q)) + blk_mq_quiesce_queue(q); +diff --git a/crypto/crypto_user.c b/crypto/crypto_user.c +index 0e89b5457cab..ceeb2eaf28cf 100644 +--- a/crypto/crypto_user.c ++++ b/crypto/crypto_user.c +@@ -83,7 +83,7 @@ static int crypto_report_cipher(struct sk_buff *skb, struct crypto_alg *alg) + { + struct crypto_report_cipher rcipher; + +- strlcpy(rcipher.type, "cipher", sizeof(rcipher.type)); ++ strncpy(rcipher.type, "cipher", sizeof(rcipher.type)); + + rcipher.blocksize = alg->cra_blocksize; + rcipher.min_keysize = alg->cra_cipher.cia_min_keysize; +@@ -102,7 +102,7 @@ static int crypto_report_comp(struct sk_buff *skb, struct crypto_alg *alg) + { + struct crypto_report_comp rcomp; + +- strlcpy(rcomp.type, "compression", sizeof(rcomp.type)); ++ strncpy(rcomp.type, "compression", sizeof(rcomp.type)); + if (nla_put(skb, CRYPTOCFGA_REPORT_COMPRESS, + sizeof(struct crypto_report_comp), &rcomp)) + goto nla_put_failure; +@@ -116,7 +116,7 @@ static int crypto_report_acomp(struct sk_buff *skb, struct crypto_alg *alg) + { + struct crypto_report_acomp racomp; + +- strlcpy(racomp.type, "acomp", sizeof(racomp.type)); ++ strncpy(racomp.type, "acomp", sizeof(racomp.type)); + + if (nla_put(skb, CRYPTOCFGA_REPORT_ACOMP, + sizeof(struct crypto_report_acomp), &racomp)) +@@ -131,7 +131,7 @@ static int crypto_report_akcipher(struct sk_buff *skb, struct crypto_alg *alg) + { + struct crypto_report_akcipher rakcipher; + +- strlcpy(rakcipher.type, "akcipher", sizeof(rakcipher.type)); ++ strncpy(rakcipher.type, "akcipher", sizeof(rakcipher.type)); + + if (nla_put(skb, CRYPTOCFGA_REPORT_AKCIPHER, + sizeof(struct crypto_report_akcipher), &rakcipher)) +@@ -146,7 +146,7 @@ static int crypto_report_kpp(struct sk_buff *skb, struct crypto_alg *alg) + { + struct crypto_report_kpp rkpp; + +- strlcpy(rkpp.type, "kpp", sizeof(rkpp.type)); ++ strncpy(rkpp.type, "kpp", sizeof(rkpp.type)); + + if (nla_put(skb, CRYPTOCFGA_REPORT_KPP, + sizeof(struct crypto_report_kpp), &rkpp)) +@@ -160,10 +160,10 @@ nla_put_failure: + static int crypto_report_one(struct crypto_alg *alg, + struct crypto_user_alg *ualg, struct sk_buff *skb) + { +- strlcpy(ualg->cru_name, alg->cra_name, sizeof(ualg->cru_name)); +- strlcpy(ualg->cru_driver_name, alg->cra_driver_name, ++ strncpy(ualg->cru_name, alg->cra_name, sizeof(ualg->cru_name)); ++ strncpy(ualg->cru_driver_name, alg->cra_driver_name, + sizeof(ualg->cru_driver_name)); +- strlcpy(ualg->cru_module_name, module_name(alg->cra_module), ++ strncpy(ualg->cru_module_name, module_name(alg->cra_module), + sizeof(ualg->cru_module_name)); + + ualg->cru_type = 0; +@@ -176,7 +176,7 @@ static int crypto_report_one(struct crypto_alg *alg, + if (alg->cra_flags & CRYPTO_ALG_LARVAL) { + struct crypto_report_larval rl; + +- strlcpy(rl.type, "larval", sizeof(rl.type)); ++ strncpy(rl.type, "larval", sizeof(rl.type)); + if (nla_put(skb, CRYPTOCFGA_REPORT_LARVAL, + sizeof(struct crypto_report_larval), &rl)) + goto nla_put_failure; +diff --git a/drivers/acpi/acpica/dsopcode.c b/drivers/acpi/acpica/dsopcode.c +index 78f9de260d5f..e9fb0bf3c8d2 100644 +--- a/drivers/acpi/acpica/dsopcode.c ++++ b/drivers/acpi/acpica/dsopcode.c +@@ -417,10 +417,6 @@ acpi_ds_eval_region_operands(struct acpi_walk_state *walk_state, + ACPI_FORMAT_UINT64(obj_desc->region.address), + obj_desc->region.length)); + +- status = acpi_ut_add_address_range(obj_desc->region.space_id, +- obj_desc->region.address, +- obj_desc->region.length, node); +- + /* Now the address and length are valid for this opregion */ + + obj_desc->region.flags |= AOPOBJ_DATA_VALID; +diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c +index c0db96e8a81a..8eb123d47d54 100644 +--- a/drivers/acpi/nfit/core.c ++++ b/drivers/acpi/nfit/core.c +@@ -2835,9 +2835,9 @@ static int acpi_nfit_query_poison(struct acpi_nfit_desc *acpi_desc) + return rc; + + if (ars_status_process_records(acpi_desc)) +- return -ENOMEM; ++ dev_err(acpi_desc->dev, "Failed to process ARS records\n"); + +- return 0; ++ return rc; + } + + static int ars_register(struct acpi_nfit_desc *acpi_desc, +diff --git a/drivers/acpi/nfit/mce.c b/drivers/acpi/nfit/mce.c +index e9626bf6ca29..d6c1b10f6c25 100644 +--- a/drivers/acpi/nfit/mce.c ++++ b/drivers/acpi/nfit/mce.c +@@ -25,8 +25,12 @@ static int nfit_handle_mce(struct notifier_block *nb, unsigned long val, + struct acpi_nfit_desc *acpi_desc; + struct nfit_spa *nfit_spa; + +- /* We only care about memory errors */ +- if (!mce_is_memory_error(mce)) ++ /* We only care about uncorrectable memory errors */ ++ if (!mce_is_memory_error(mce) || mce_is_correctable(mce)) ++ return NOTIFY_DONE; ++ ++ /* Verify the address reported in the MCE is valid. */ ++ if (!mce_usable_address(mce)) + return NOTIFY_DONE; + + /* +diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c +index 321a9579556d..a9a8440a4945 100644 +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -4552,7 +4552,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = { + /* These specific Samsung models/firmware-revs do not handle LPM well */ + { "SAMSUNG MZMPC128HBFU-000MV", "CXM14M1Q", ATA_HORKAGE_NOLPM, }, + { "SAMSUNG SSD PM830 mSATA *", "CXM13D1Q", ATA_HORKAGE_NOLPM, }, +- { "SAMSUNG MZ7TD256HAFV-000L9", "DXT02L5Q", ATA_HORKAGE_NOLPM, }, ++ { "SAMSUNG MZ7TD256HAFV-000L9", NULL, ATA_HORKAGE_NOLPM, }, + + /* devices that don't properly handle queued TRIM commands */ + { "Micron_M500IT_*", "MU01", ATA_HORKAGE_NO_NCQ_TRIM | +diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c +index af7cb8e618fe..363b9102ebb0 100644 +--- a/drivers/block/zram/zram_drv.c ++++ b/drivers/block/zram/zram_drv.c +@@ -1637,6 +1637,11 @@ static const struct attribute_group zram_disk_attr_group = { + .attrs = zram_disk_attrs, + }; + ++static const struct attribute_group *zram_disk_attr_groups[] = { ++ &zram_disk_attr_group, ++ NULL, ++}; ++ + /* + * Allocate and initialize new zram device. the function returns + * '>= 0' device_id upon success, and negative value otherwise. +@@ -1717,24 +1722,15 @@ static int zram_add(void) + + zram->disk->queue->backing_dev_info->capabilities |= + (BDI_CAP_STABLE_WRITES | BDI_CAP_SYNCHRONOUS_IO); ++ disk_to_dev(zram->disk)->groups = zram_disk_attr_groups; + add_disk(zram->disk); + +- ret = sysfs_create_group(&disk_to_dev(zram->disk)->kobj, +- &zram_disk_attr_group); +- if (ret < 0) { +- pr_err("Error creating sysfs group for device %d\n", +- device_id); +- goto out_free_disk; +- } + strlcpy(zram->compressor, default_compressor, sizeof(zram->compressor)); + + zram_debugfs_register(zram); + pr_info("Added device: %s\n", zram->disk->disk_name); + return device_id; + +-out_free_disk: +- del_gendisk(zram->disk); +- put_disk(zram->disk); + out_free_queue: + blk_cleanup_queue(queue); + out_free_idr: +@@ -1763,16 +1759,6 @@ static int zram_remove(struct zram *zram) + mutex_unlock(&bdev->bd_mutex); + + zram_debugfs_unregister(zram); +- /* +- * Remove sysfs first, so no one will perform a disksize +- * store while we destroy the devices. This also helps during +- * hot_remove -- zram_reset_device() is the last holder of +- * ->init_lock, no later/concurrent disksize_store() or any +- * other sysfs handlers are possible. +- */ +- sysfs_remove_group(&disk_to_dev(zram->disk)->kobj, +- &zram_disk_attr_group); +- + /* Make sure all the pending I/O are finished */ + fsync_bdev(bdev); + zram_reset_device(zram); +diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c +index 66acbd063562..894103abe8a8 100644 +--- a/drivers/cdrom/cdrom.c ++++ b/drivers/cdrom/cdrom.c +@@ -2441,7 +2441,7 @@ static int cdrom_ioctl_select_disc(struct cdrom_device_info *cdi, + return -ENOSYS; + + if (arg != CDSL_CURRENT && arg != CDSL_NONE) { +- if ((int)arg >= cdi->capacity) ++ if (arg >= cdi->capacity) + return -EINVAL; + } + +diff --git a/drivers/clk/at91/clk-pll.c b/drivers/clk/at91/clk-pll.c +index 72b6091eb7b9..dc7fbc796cb6 100644 +--- a/drivers/clk/at91/clk-pll.c ++++ b/drivers/clk/at91/clk-pll.c +@@ -133,6 +133,9 @@ static unsigned long clk_pll_recalc_rate(struct clk_hw *hw, + { + struct clk_pll *pll = to_clk_pll(hw); + ++ if (!pll->div || !pll->mul) ++ return 0; ++ + return (parent_rate / pll->div) * (pll->mul + 1); + } + +diff --git a/drivers/clk/clk-s2mps11.c b/drivers/clk/clk-s2mps11.c +index d44e0eea31ec..0934d3724495 100644 +--- a/drivers/clk/clk-s2mps11.c ++++ b/drivers/clk/clk-s2mps11.c +@@ -245,6 +245,36 @@ static const struct platform_device_id s2mps11_clk_id[] = { + }; + MODULE_DEVICE_TABLE(platform, s2mps11_clk_id); + ++#ifdef CONFIG_OF ++/* ++ * Device is instantiated through parent MFD device and device matching is done ++ * through platform_device_id. ++ * ++ * However if device's DT node contains proper clock compatible and driver is ++ * built as a module, then the *module* matching will be done trough DT aliases. ++ * This requires of_device_id table. In the same time this will not change the ++ * actual *device* matching so do not add .of_match_table. ++ */ ++static const struct of_device_id s2mps11_dt_match[] = { ++ { ++ .compatible = "samsung,s2mps11-clk", ++ .data = (void *)S2MPS11X, ++ }, { ++ .compatible = "samsung,s2mps13-clk", ++ .data = (void *)S2MPS13X, ++ }, { ++ .compatible = "samsung,s2mps14-clk", ++ .data = (void *)S2MPS14X, ++ }, { ++ .compatible = "samsung,s5m8767-clk", ++ .data = (void *)S5M8767X, ++ }, { ++ /* Sentinel */ ++ }, ++}; ++MODULE_DEVICE_TABLE(of, s2mps11_dt_match); ++#endif ++ + static struct platform_driver s2mps11_clk_driver = { + .driver = { + .name = "s2mps11-clk", +diff --git a/drivers/clk/hisilicon/reset.c b/drivers/clk/hisilicon/reset.c +index 2a5015c736ce..43e82fa64422 100644 +--- a/drivers/clk/hisilicon/reset.c ++++ b/drivers/clk/hisilicon/reset.c +@@ -109,9 +109,8 @@ struct hisi_reset_controller *hisi_reset_init(struct platform_device *pdev) + return NULL; + + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); +- rstc->membase = devm_ioremap(&pdev->dev, +- res->start, resource_size(res)); +- if (!rstc->membase) ++ rstc->membase = devm_ioremap_resource(&pdev->dev, res); ++ if (IS_ERR(rstc->membase)) + return NULL; + + spin_lock_init(&rstc->lock); +diff --git a/drivers/clk/meson/axg.c b/drivers/clk/meson/axg.c +index bd4dbc696b88..cfd26fd7e404 100644 +--- a/drivers/clk/meson/axg.c ++++ b/drivers/clk/meson/axg.c +@@ -320,6 +320,7 @@ static struct clk_regmap axg_fclk_div2 = { + .ops = &clk_regmap_gate_ops, + .parent_names = (const char *[]){ "fclk_div2_div" }, + .num_parents = 1, ++ .flags = CLK_IS_CRITICAL, + }, + }; + +@@ -344,6 +345,18 @@ static struct clk_regmap axg_fclk_div3 = { + .ops = &clk_regmap_gate_ops, + .parent_names = (const char *[]){ "fclk_div3_div" }, + .num_parents = 1, ++ /* ++ * FIXME: ++ * This clock, as fdiv2, is used by the SCPI FW and is required ++ * by the platform to operate correctly. ++ * Until the following condition are met, we need this clock to ++ * be marked as critical: ++ * a) The SCPI generic driver claims and enable all the clocks ++ * it needs ++ * b) CCF has a clock hand-off mechanism to make the sure the ++ * clock stays on until the proper driver comes along ++ */ ++ .flags = CLK_IS_CRITICAL, + }, + }; + +diff --git a/drivers/clk/meson/gxbb.c b/drivers/clk/meson/gxbb.c +index 177fffb9ebef..902c63209785 100644 +--- a/drivers/clk/meson/gxbb.c ++++ b/drivers/clk/meson/gxbb.c +@@ -523,6 +523,18 @@ static struct clk_regmap gxbb_fclk_div3 = { + .ops = &clk_regmap_gate_ops, + .parent_names = (const char *[]){ "fclk_div3_div" }, + .num_parents = 1, ++ /* ++ * FIXME: ++ * This clock, as fdiv2, is used by the SCPI FW and is required ++ * by the platform to operate correctly. ++ * Until the following condition are met, we need this clock to ++ * be marked as critical: ++ * a) The SCPI generic driver claims and enable all the clocks ++ * it needs ++ * b) CCF has a clock hand-off mechanism to make the sure the ++ * clock stays on until the proper driver comes along ++ */ ++ .flags = CLK_IS_CRITICAL, + }, + }; + +diff --git a/drivers/clk/rockchip/clk-ddr.c b/drivers/clk/rockchip/clk-ddr.c +index e8075359366b..ebce5260068b 100644 +--- a/drivers/clk/rockchip/clk-ddr.c ++++ b/drivers/clk/rockchip/clk-ddr.c +@@ -80,16 +80,12 @@ static long rockchip_ddrclk_sip_round_rate(struct clk_hw *hw, + static u8 rockchip_ddrclk_get_parent(struct clk_hw *hw) + { + struct rockchip_ddrclk *ddrclk = to_rockchip_ddrclk_hw(hw); +- int num_parents = clk_hw_get_num_parents(hw); + u32 val; + + val = clk_readl(ddrclk->reg_base + + ddrclk->mux_offset) >> ddrclk->mux_shift; + val &= GENMASK(ddrclk->mux_width - 1, 0); + +- if (val >= num_parents) +- return -EINVAL; +- + return val; + } + +diff --git a/drivers/clk/rockchip/clk-rk3328.c b/drivers/clk/rockchip/clk-rk3328.c +index 252366a5231f..2c5426607790 100644 +--- a/drivers/clk/rockchip/clk-rk3328.c ++++ b/drivers/clk/rockchip/clk-rk3328.c +@@ -813,22 +813,22 @@ static struct rockchip_clk_branch rk3328_clk_branches[] __initdata = { + MMC(SCLK_SDMMC_DRV, "sdmmc_drv", "clk_sdmmc", + RK3328_SDMMC_CON0, 1), + MMC(SCLK_SDMMC_SAMPLE, "sdmmc_sample", "clk_sdmmc", +- RK3328_SDMMC_CON1, 1), ++ RK3328_SDMMC_CON1, 0), + + MMC(SCLK_SDIO_DRV, "sdio_drv", "clk_sdio", + RK3328_SDIO_CON0, 1), + MMC(SCLK_SDIO_SAMPLE, "sdio_sample", "clk_sdio", +- RK3328_SDIO_CON1, 1), ++ RK3328_SDIO_CON1, 0), + + MMC(SCLK_EMMC_DRV, "emmc_drv", "clk_emmc", + RK3328_EMMC_CON0, 1), + MMC(SCLK_EMMC_SAMPLE, "emmc_sample", "clk_emmc", +- RK3328_EMMC_CON1, 1), ++ RK3328_EMMC_CON1, 0), + + MMC(SCLK_SDMMC_EXT_DRV, "sdmmc_ext_drv", "clk_sdmmc_ext", + RK3328_SDMMC_EXT_CON0, 1), + MMC(SCLK_SDMMC_EXT_SAMPLE, "sdmmc_ext_sample", "clk_sdmmc_ext", +- RK3328_SDMMC_EXT_CON1, 1), ++ RK3328_SDMMC_EXT_CON1, 0), + }; + + static const char *const rk3328_critical_clocks[] __initconst = { +diff --git a/drivers/clk/sunxi-ng/ccu-sun50i-h6.c b/drivers/clk/sunxi-ng/ccu-sun50i-h6.c +index bdbfe78fe133..0f7a0ffd3f70 100644 +--- a/drivers/clk/sunxi-ng/ccu-sun50i-h6.c ++++ b/drivers/clk/sunxi-ng/ccu-sun50i-h6.c +@@ -224,7 +224,7 @@ static SUNXI_CCU_MP_WITH_MUX(psi_ahb1_ahb2_clk, "psi-ahb1-ahb2", + psi_ahb1_ahb2_parents, + 0x510, + 0, 5, /* M */ +- 16, 2, /* P */ ++ 8, 2, /* P */ + 24, 2, /* mux */ + 0); + +@@ -233,19 +233,19 @@ static const char * const ahb3_apb1_apb2_parents[] = { "osc24M", "osc32k", + "pll-periph0" }; + static SUNXI_CCU_MP_WITH_MUX(ahb3_clk, "ahb3", ahb3_apb1_apb2_parents, 0x51c, + 0, 5, /* M */ +- 16, 2, /* P */ ++ 8, 2, /* P */ + 24, 2, /* mux */ + 0); + + static SUNXI_CCU_MP_WITH_MUX(apb1_clk, "apb1", ahb3_apb1_apb2_parents, 0x520, + 0, 5, /* M */ +- 16, 2, /* P */ ++ 8, 2, /* P */ + 24, 2, /* mux */ + 0); + + static SUNXI_CCU_MP_WITH_MUX(apb2_clk, "apb2", ahb3_apb1_apb2_parents, 0x524, + 0, 5, /* M */ +- 16, 2, /* P */ ++ 8, 2, /* P */ + 24, 2, /* mux */ + 0); + +diff --git a/drivers/clocksource/i8253.c b/drivers/clocksource/i8253.c +index 9c38895542f4..d4350bb10b83 100644 +--- a/drivers/clocksource/i8253.c ++++ b/drivers/clocksource/i8253.c +@@ -20,6 +20,13 @@ + DEFINE_RAW_SPINLOCK(i8253_lock); + EXPORT_SYMBOL(i8253_lock); + ++/* ++ * Handle PIT quirk in pit_shutdown() where zeroing the counter register ++ * restarts the PIT, negating the shutdown. On platforms with the quirk, ++ * platform specific code can set this to false. ++ */ ++bool i8253_clear_counter_on_shutdown __ro_after_init = true; ++ + #ifdef CONFIG_CLKSRC_I8253 + /* + * Since the PIT overflows every tick, its not very useful +@@ -109,8 +116,11 @@ static int pit_shutdown(struct clock_event_device *evt) + raw_spin_lock(&i8253_lock); + + outb_p(0x30, PIT_MODE); +- outb_p(0, PIT_CH0); +- outb_p(0, PIT_CH0); ++ ++ if (i8253_clear_counter_on_shutdown) { ++ outb_p(0, PIT_CH0); ++ outb_p(0, PIT_CH0); ++ } + + raw_spin_unlock(&i8253_lock); + return 0; +diff --git a/drivers/firmware/efi/libstub/fdt.c b/drivers/firmware/efi/libstub/fdt.c +index 8830fa601e45..0c0d2312f4a8 100644 +--- a/drivers/firmware/efi/libstub/fdt.c ++++ b/drivers/firmware/efi/libstub/fdt.c +@@ -158,6 +158,10 @@ static efi_status_t update_fdt(efi_system_table_t *sys_table, void *orig_fdt, + return efi_status; + } + } ++ ++ /* shrink the FDT back to its minimum size */ ++ fdt_pack(fdt); ++ + return EFI_SUCCESS; + + fdt_set_fail: +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c +index a1c78f90eadf..b1a86f99011a 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c +@@ -574,7 +574,7 @@ void amdgpu_vmid_mgr_init(struct amdgpu_device *adev) + /* skip over VMID 0, since it is the system VM */ + for (j = 1; j < id_mgr->num_ids; ++j) { + amdgpu_vmid_reset(adev, i, j); +- amdgpu_sync_create(&id_mgr->ids[i].active); ++ amdgpu_sync_create(&id_mgr->ids[j].active); + list_add_tail(&id_mgr->ids[j].list, &id_mgr->ids_lru); + } + } +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c +index 2bd56760c744..b1cd8e9649b9 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c +@@ -62,6 +62,7 @@ int amdgpu_job_alloc(struct amdgpu_device *adev, unsigned num_ibs, + amdgpu_sync_create(&(*job)->sync); + amdgpu_sync_create(&(*job)->sched_sync); + (*job)->vram_lost_counter = atomic_read(&adev->vram_lost_counter); ++ (*job)->vm_pd_addr = AMDGPU_BO_INVALID_OFFSET; + + return 0; + } +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c +index f55f72a37ca8..c29d519fa381 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c +@@ -277,6 +277,7 @@ amdgpu_ucode_get_load_type(struct amdgpu_device *adev, int load_type) + case CHIP_PITCAIRN: + case CHIP_VERDE: + case CHIP_OLAND: ++ case CHIP_HAINAN: + return AMDGPU_FW_LOAD_DIRECT; + #endif + #ifdef CONFIG_DRM_AMDGPU_CIK +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c +index c31fff32a321..eb0ae9726cf7 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c +@@ -631,7 +631,8 @@ int amdgpu_vm_flush(struct amdgpu_ring *ring, struct amdgpu_job *job, bool need_ + } + + gds_switch_needed &= !!ring->funcs->emit_gds_switch; +- vm_flush_needed &= !!ring->funcs->emit_vm_flush; ++ vm_flush_needed &= !!ring->funcs->emit_vm_flush && ++ job->vm_pd_addr != AMDGPU_BO_INVALID_OFFSET; + pasid_mapping_needed &= adev->gmc.gmc_funcs->emit_pasid_mapping && + ring->funcs->emit_wreg; + +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c +index 644b2187507b..a6348bbb6fc7 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc.c +@@ -1045,9 +1045,6 @@ static enum surface_update_type get_plane_info_update_type(const struct dc_surfa + */ + update_flags->bits.bpp_change = 1; + +- if (u->gamma && dce_use_lut(u->plane_info->format)) +- update_flags->bits.gamma_change = 1; +- + if (memcmp(&u->plane_info->tiling_info, &u->surface->tiling_info, + sizeof(union dc_tiling_info)) != 0) { + update_flags->bits.swizzle_change = 1; +@@ -1064,7 +1061,6 @@ static enum surface_update_type get_plane_info_update_type(const struct dc_surfa + if (update_flags->bits.rotation_change + || update_flags->bits.stereo_format_change + || update_flags->bits.pixel_format_change +- || update_flags->bits.gamma_change + || update_flags->bits.bpp_change + || update_flags->bits.bandwidth_change + || update_flags->bits.output_tf_change) +@@ -1154,13 +1150,26 @@ static enum surface_update_type det_surface_update(const struct dc *dc, + if (u->coeff_reduction_factor) + update_flags->bits.coeff_reduction_change = 1; + ++ if (u->gamma) { ++ enum surface_pixel_format format = SURFACE_PIXEL_FORMAT_GRPH_BEGIN; ++ ++ if (u->plane_info) ++ format = u->plane_info->format; ++ else if (u->surface) ++ format = u->surface->format; ++ ++ if (dce_use_lut(format)) ++ update_flags->bits.gamma_change = 1; ++ } ++ + if (update_flags->bits.in_transfer_func_change) { + type = UPDATE_TYPE_MED; + elevate_update_type(&overall_type, type); + } + + if (update_flags->bits.input_csc_change +- || update_flags->bits.coeff_reduction_change) { ++ || update_flags->bits.coeff_reduction_change ++ || update_flags->bits.gamma_change) { + type = UPDATE_TYPE_FULL; + elevate_update_type(&overall_type, type); + } +diff --git a/drivers/gpu/drm/amd/display/modules/color/color_gamma.c b/drivers/gpu/drm/amd/display/modules/color/color_gamma.c +index eee0dfad6962..7d9fea6877bc 100644 +--- a/drivers/gpu/drm/amd/display/modules/color/color_gamma.c ++++ b/drivers/gpu/drm/amd/display/modules/color/color_gamma.c +@@ -968,10 +968,14 @@ static void build_evenly_distributed_points( + struct dividers dividers) + { + struct gamma_pixel *p = points; +- struct gamma_pixel *p_last = p + numberof_points - 1; ++ struct gamma_pixel *p_last; + + uint32_t i = 0; + ++ // This function should not gets called with 0 as a parameter ++ ASSERT(numberof_points > 0); ++ p_last = p + numberof_points - 1; ++ + do { + struct fixed31_32 value = dc_fixpt_from_fraction(i, + numberof_points - 1); +@@ -982,7 +986,7 @@ static void build_evenly_distributed_points( + + ++p; + ++i; +- } while (i != numberof_points); ++ } while (i < numberof_points); + + p->r = dc_fixpt_div(p_last->r, dividers.divider1); + p->g = dc_fixpt_div(p_last->g, dividers.divider1); +diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu8_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu8_hwmgr.c +index 617557bd8c24..b813e77d8e93 100644 +--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu8_hwmgr.c ++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu8_hwmgr.c +@@ -1222,14 +1222,17 @@ static int smu8_dpm_force_dpm_level(struct pp_hwmgr *hwmgr, + + static int smu8_dpm_powerdown_uvd(struct pp_hwmgr *hwmgr) + { +- if (PP_CAP(PHM_PlatformCaps_UVDPowerGating)) ++ if (PP_CAP(PHM_PlatformCaps_UVDPowerGating)) { ++ smu8_nbdpm_pstate_enable_disable(hwmgr, true, true); + return smum_send_msg_to_smc(hwmgr, PPSMC_MSG_UVDPowerOFF); ++ } + return 0; + } + + static int smu8_dpm_powerup_uvd(struct pp_hwmgr *hwmgr) + { + if (PP_CAP(PHM_PlatformCaps_UVDPowerGating)) { ++ smu8_nbdpm_pstate_enable_disable(hwmgr, false, true); + return smum_send_msg_to_smc_with_parameter( + hwmgr, + PPSMC_MSG_UVDPowerON, +diff --git a/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c b/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c +index 2d4ec8ac3a08..0b3ea7e9b805 100644 +--- a/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c ++++ b/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c +@@ -2303,11 +2303,13 @@ static uint32_t ci_get_offsetof(uint32_t type, uint32_t member) + case DRAM_LOG_BUFF_SIZE: + return offsetof(SMU7_SoftRegisters, DRAM_LOG_BUFF_SIZE); + } ++ break; + case SMU_Discrete_DpmTable: + switch (member) { + case LowSclkInterruptThreshold: + return offsetof(SMU7_Discrete_DpmTable, LowSclkInterruptT); + } ++ break; + } + pr_debug("can't get the offset of type %x member %x\n", type, member); + return 0; +diff --git a/drivers/gpu/drm/amd/powerplay/smumgr/fiji_smumgr.c b/drivers/gpu/drm/amd/powerplay/smumgr/fiji_smumgr.c +index 53df9405f43a..bb616a530d3c 100644 +--- a/drivers/gpu/drm/amd/powerplay/smumgr/fiji_smumgr.c ++++ b/drivers/gpu/drm/amd/powerplay/smumgr/fiji_smumgr.c +@@ -2372,6 +2372,7 @@ static uint32_t fiji_get_offsetof(uint32_t type, uint32_t member) + case DRAM_LOG_BUFF_SIZE: + return offsetof(SMU73_SoftRegisters, DRAM_LOG_BUFF_SIZE); + } ++ break; + case SMU_Discrete_DpmTable: + switch (member) { + case UvdBootLevel: +@@ -2383,6 +2384,7 @@ static uint32_t fiji_get_offsetof(uint32_t type, uint32_t member) + case LowSclkInterruptThreshold: + return offsetof(SMU73_Discrete_DpmTable, LowSclkInterruptThreshold); + } ++ break; + } + pr_warn("can't get the offset of type %x member %x\n", type, member); + return 0; +diff --git a/drivers/gpu/drm/amd/powerplay/smumgr/iceland_smumgr.c b/drivers/gpu/drm/amd/powerplay/smumgr/iceland_smumgr.c +index 415f691c3fa9..c15e15e657b8 100644 +--- a/drivers/gpu/drm/amd/powerplay/smumgr/iceland_smumgr.c ++++ b/drivers/gpu/drm/amd/powerplay/smumgr/iceland_smumgr.c +@@ -2246,11 +2246,13 @@ static uint32_t iceland_get_offsetof(uint32_t type, uint32_t member) + case DRAM_LOG_BUFF_SIZE: + return offsetof(SMU71_SoftRegisters, DRAM_LOG_BUFF_SIZE); + } ++ break; + case SMU_Discrete_DpmTable: + switch (member) { + case LowSclkInterruptThreshold: + return offsetof(SMU71_Discrete_DpmTable, LowSclkInterruptThreshold); + } ++ break; + } + pr_warn("can't get the offset of type %x member %x\n", type, member); + return 0; +diff --git a/drivers/gpu/drm/amd/powerplay/smumgr/tonga_smumgr.c b/drivers/gpu/drm/amd/powerplay/smumgr/tonga_smumgr.c +index 782b19fc2e70..a5b7a4484700 100644 +--- a/drivers/gpu/drm/amd/powerplay/smumgr/tonga_smumgr.c ++++ b/drivers/gpu/drm/amd/powerplay/smumgr/tonga_smumgr.c +@@ -2667,6 +2667,7 @@ static uint32_t tonga_get_offsetof(uint32_t type, uint32_t member) + case DRAM_LOG_BUFF_SIZE: + return offsetof(SMU72_SoftRegisters, DRAM_LOG_BUFF_SIZE); + } ++ break; + case SMU_Discrete_DpmTable: + switch (member) { + case UvdBootLevel: +@@ -2678,6 +2679,7 @@ static uint32_t tonga_get_offsetof(uint32_t type, uint32_t member) + case LowSclkInterruptThreshold: + return offsetof(SMU72_Discrete_DpmTable, LowSclkInterruptThreshold); + } ++ break; + } + pr_warn("can't get the offset of type %x member %x\n", type, member); + return 0; +diff --git a/drivers/gpu/drm/amd/powerplay/smumgr/vegam_smumgr.c b/drivers/gpu/drm/amd/powerplay/smumgr/vegam_smumgr.c +index 2de48959ac93..52834334bd53 100644 +--- a/drivers/gpu/drm/amd/powerplay/smumgr/vegam_smumgr.c ++++ b/drivers/gpu/drm/amd/powerplay/smumgr/vegam_smumgr.c +@@ -2267,6 +2267,7 @@ static uint32_t vegam_get_offsetof(uint32_t type, uint32_t member) + case DRAM_LOG_BUFF_SIZE: + return offsetof(SMU75_SoftRegisters, DRAM_LOG_BUFF_SIZE); + } ++ break; + case SMU_Discrete_DpmTable: + switch (member) { + case UvdBootLevel: +@@ -2278,6 +2279,7 @@ static uint32_t vegam_get_offsetof(uint32_t type, uint32_t member) + case LowSclkInterruptThreshold: + return offsetof(SMU75_Discrete_DpmTable, LowSclkInterruptThreshold); + } ++ break; + } + pr_warn("can't get the offset of type %x member %x\n", type, member); + return 0; +diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c +index 658830620ca3..9c166621e920 100644 +--- a/drivers/gpu/drm/drm_dp_mst_topology.c ++++ b/drivers/gpu/drm/drm_dp_mst_topology.c +@@ -1274,6 +1274,9 @@ static struct drm_dp_mst_branch *drm_dp_get_mst_branch_device(struct drm_dp_mst_ + mutex_lock(&mgr->lock); + mstb = mgr->mst_primary; + ++ if (!mstb) ++ goto out; ++ + for (i = 0; i < lct - 1; i++) { + int shift = (i % 2) ? 0 : 4; + int port_num = (rad[i / 2] >> shift) & 0xf; +diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c +index fe9c6c731e87..ee4a5e1221f1 100644 +--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c ++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c +@@ -30,6 +30,12 @@ struct drm_dmi_panel_orientation_data { + int orientation; + }; + ++static const struct drm_dmi_panel_orientation_data acer_s1003 = { ++ .width = 800, ++ .height = 1280, ++ .orientation = DRM_MODE_PANEL_ORIENTATION_RIGHT_UP, ++}; ++ + static const struct drm_dmi_panel_orientation_data asus_t100ha = { + .width = 800, + .height = 1280, +@@ -67,7 +73,13 @@ static const struct drm_dmi_panel_orientation_data lcd800x1280_rightside_up = { + }; + + static const struct dmi_system_id orientation_data[] = { +- { /* Asus T100HA */ ++ { /* Acer One 10 (S1003) */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Acer"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "One S1003"), ++ }, ++ .driver_data = (void *)&acer_s1003, ++ }, { /* Asus T100HA */ + .matches = { + DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), + DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T100HAN"), +diff --git a/drivers/gpu/drm/etnaviv/etnaviv_sched.c b/drivers/gpu/drm/etnaviv/etnaviv_sched.c +index 50d6b88cb7aa..5944f319c78b 100644 +--- a/drivers/gpu/drm/etnaviv/etnaviv_sched.c ++++ b/drivers/gpu/drm/etnaviv/etnaviv_sched.c +@@ -93,7 +93,7 @@ static void etnaviv_sched_timedout_job(struct drm_sched_job *sched_job) + * If the GPU managed to complete this jobs fence, the timout is + * spurious. Bail out. + */ +- if (fence_completed(gpu, submit->out_fence->seqno)) ++ if (dma_fence_is_signaled(submit->out_fence)) + return; + + /* +diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c +index b92595c477ef..8bd29075ae4e 100644 +--- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c ++++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c +@@ -122,6 +122,7 @@ static int hibmc_drm_fb_create(struct drm_fb_helper *helper, + hi_fbdev->fb = hibmc_framebuffer_init(priv->dev, &mode_cmd, gobj); + if (IS_ERR(hi_fbdev->fb)) { + ret = PTR_ERR(hi_fbdev->fb); ++ hi_fbdev->fb = NULL; + DRM_ERROR("failed to initialize framebuffer: %d\n", ret); + goto out_release_fbi; + } +diff --git a/drivers/gpu/drm/i915/gvt/gtt.h b/drivers/gpu/drm/i915/gvt/gtt.h +index 97e62647418a..5040bcd430d2 100644 +--- a/drivers/gpu/drm/i915/gvt/gtt.h ++++ b/drivers/gpu/drm/i915/gvt/gtt.h +@@ -35,7 +35,6 @@ + #define _GVT_GTT_H_ + + #define I915_GTT_PAGE_SHIFT 12 +-#define I915_GTT_PAGE_MASK (~(I915_GTT_PAGE_SIZE - 1)) + + struct intel_vgpu_mm; + +diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c +index 17c5097721e8..4b77325d135a 100644 +--- a/drivers/gpu/drm/i915/i915_gem.c ++++ b/drivers/gpu/drm/i915/i915_gem.c +@@ -1112,11 +1112,7 @@ i915_gem_shmem_pread(struct drm_i915_gem_object *obj, + offset = offset_in_page(args->offset); + for (idx = args->offset >> PAGE_SHIFT; remain; idx++) { + struct page *page = i915_gem_object_get_page(obj, idx); +- int length; +- +- length = remain; +- if (offset + length > PAGE_SIZE) +- length = PAGE_SIZE - offset; ++ unsigned int length = min_t(u64, remain, PAGE_SIZE - offset); + + ret = shmem_pread(page, offset, length, user_data, + page_to_phys(page) & obj_do_bit17_swizzling, +@@ -1562,11 +1558,7 @@ i915_gem_shmem_pwrite(struct drm_i915_gem_object *obj, + offset = offset_in_page(args->offset); + for (idx = args->offset >> PAGE_SHIFT; remain; idx++) { + struct page *page = i915_gem_object_get_page(obj, idx); +- int length; +- +- length = remain; +- if (offset + length > PAGE_SIZE) +- length = PAGE_SIZE - offset; ++ unsigned int length = min_t(u64, remain, PAGE_SIZE - offset); + + ret = shmem_pwrite(page, offset, length, user_data, + page_to_phys(page) & obj_do_bit17_swizzling, +diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c +index 22df17c8ca9b..b43bc767ec3d 100644 +--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c ++++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c +@@ -449,7 +449,7 @@ eb_validate_vma(struct i915_execbuffer *eb, + * any non-page-aligned or non-canonical addresses. + */ + if (unlikely(entry->flags & EXEC_OBJECT_PINNED && +- entry->offset != gen8_canonical_addr(entry->offset & PAGE_MASK))) ++ entry->offset != gen8_canonical_addr(entry->offset & I915_GTT_PAGE_MASK))) + return -EINVAL; + + /* pad_to_size was once a reserved field, so sanitize it */ +diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.h b/drivers/gpu/drm/i915/i915_gem_gtt.h +index aec4f73574f4..69f53faab644 100644 +--- a/drivers/gpu/drm/i915/i915_gem_gtt.h ++++ b/drivers/gpu/drm/i915/i915_gem_gtt.h +@@ -49,6 +49,8 @@ + #define I915_GTT_PAGE_SIZE I915_GTT_PAGE_SIZE_4K + #define I915_GTT_MAX_PAGE_SIZE I915_GTT_PAGE_SIZE_2M + ++#define I915_GTT_PAGE_MASK -I915_GTT_PAGE_SIZE ++ + #define I915_GTT_MIN_ALIGNMENT I915_GTT_PAGE_SIZE + + #define I915_FENCE_REG_NONE -1 +@@ -625,20 +627,20 @@ int i915_gem_gtt_insert(struct i915_address_space *vm, + u64 start, u64 end, unsigned int flags); + + /* Flags used by pin/bind&friends. */ +-#define PIN_NONBLOCK BIT(0) +-#define PIN_MAPPABLE BIT(1) +-#define PIN_ZONE_4G BIT(2) +-#define PIN_NONFAULT BIT(3) +-#define PIN_NOEVICT BIT(4) +- +-#define PIN_MBZ BIT(5) /* I915_VMA_PIN_OVERFLOW */ +-#define PIN_GLOBAL BIT(6) /* I915_VMA_GLOBAL_BIND */ +-#define PIN_USER BIT(7) /* I915_VMA_LOCAL_BIND */ +-#define PIN_UPDATE BIT(8) +- +-#define PIN_HIGH BIT(9) +-#define PIN_OFFSET_BIAS BIT(10) +-#define PIN_OFFSET_FIXED BIT(11) ++#define PIN_NONBLOCK BIT_ULL(0) ++#define PIN_MAPPABLE BIT_ULL(1) ++#define PIN_ZONE_4G BIT_ULL(2) ++#define PIN_NONFAULT BIT_ULL(3) ++#define PIN_NOEVICT BIT_ULL(4) ++ ++#define PIN_MBZ BIT_ULL(5) /* I915_VMA_PIN_OVERFLOW */ ++#define PIN_GLOBAL BIT_ULL(6) /* I915_VMA_GLOBAL_BIND */ ++#define PIN_USER BIT_ULL(7) /* I915_VMA_LOCAL_BIND */ ++#define PIN_UPDATE BIT_ULL(8) ++ ++#define PIN_HIGH BIT_ULL(9) ++#define PIN_OFFSET_BIAS BIT_ULL(10) ++#define PIN_OFFSET_FIXED BIT_ULL(11) + #define PIN_OFFSET_MASK (-I915_GTT_PAGE_SIZE) + + #endif +diff --git a/drivers/gpu/drm/i915/intel_audio.c b/drivers/gpu/drm/i915/intel_audio.c +index 3ea566f99450..391ad4123953 100644 +--- a/drivers/gpu/drm/i915/intel_audio.c ++++ b/drivers/gpu/drm/i915/intel_audio.c +@@ -134,6 +134,9 @@ static const struct { + /* HDMI N/CTS table */ + #define TMDS_297M 297000 + #define TMDS_296M 296703 ++#define TMDS_594M 594000 ++#define TMDS_593M 593407 ++ + static const struct { + int sample_rate; + int clock; +@@ -154,6 +157,20 @@ static const struct { + { 176400, TMDS_297M, 18816, 247500 }, + { 192000, TMDS_296M, 23296, 281250 }, + { 192000, TMDS_297M, 20480, 247500 }, ++ { 44100, TMDS_593M, 8918, 937500 }, ++ { 44100, TMDS_594M, 9408, 990000 }, ++ { 48000, TMDS_593M, 5824, 562500 }, ++ { 48000, TMDS_594M, 6144, 594000 }, ++ { 32000, TMDS_593M, 5824, 843750 }, ++ { 32000, TMDS_594M, 3072, 445500 }, ++ { 88200, TMDS_593M, 17836, 937500 }, ++ { 88200, TMDS_594M, 18816, 990000 }, ++ { 96000, TMDS_593M, 11648, 562500 }, ++ { 96000, TMDS_594M, 12288, 594000 }, ++ { 176400, TMDS_593M, 35672, 937500 }, ++ { 176400, TMDS_594M, 37632, 990000 }, ++ { 192000, TMDS_593M, 23296, 562500 }, ++ { 192000, TMDS_594M, 24576, 594000 }, + }; + + /* get AUD_CONFIG_PIXEL_CLOCK_HDMI_* value for mode */ +diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c +index 00486c744f24..b1e4f460f403 100644 +--- a/drivers/gpu/drm/i915/intel_display.c ++++ b/drivers/gpu/drm/i915/intel_display.c +@@ -12509,17 +12509,12 @@ static void intel_atomic_commit_tail(struct drm_atomic_state *state) + intel_check_cpu_fifo_underruns(dev_priv); + intel_check_pch_fifo_underruns(dev_priv); + +- if (!new_crtc_state->active) { +- /* +- * Make sure we don't call initial_watermarks +- * for ILK-style watermark updates. +- * +- * No clue what this is supposed to achieve. +- */ +- if (INTEL_GEN(dev_priv) >= 9) +- dev_priv->display.initial_watermarks(intel_state, +- to_intel_crtc_state(new_crtc_state)); +- } ++ /* FIXME unify this for all platforms */ ++ if (!new_crtc_state->active && ++ !HAS_GMCH_DISPLAY(dev_priv) && ++ dev_priv->display.initial_watermarks) ++ dev_priv->display.initial_watermarks(intel_state, ++ to_intel_crtc_state(new_crtc_state)); + } + } + +@@ -14383,7 +14378,7 @@ static int intel_framebuffer_init(struct intel_framebuffer *intel_fb, + fb->height < SKL_MIN_YUV_420_SRC_H || + (fb->width % 4) != 0 || (fb->height % 4) != 0)) { + DRM_DEBUG_KMS("src dimensions not correct for NV12\n"); +- return -EINVAL; ++ goto err; + } + + for (i = 0; i < fb->format->num_planes; i++) { +@@ -15216,13 +15211,9 @@ static void intel_sanitize_crtc(struct intel_crtc *crtc, + I915_READ(reg) & ~PIPECONF_FRAME_START_DELAY_MASK); + } + +- /* restore vblank interrupts to correct state */ +- drm_crtc_vblank_reset(&crtc->base); + if (crtc->active) { + struct intel_plane *plane; + +- drm_crtc_vblank_on(&crtc->base); +- + /* Disable everything but the primary plane */ + for_each_intel_plane_on_crtc(dev, crtc, plane) { + const struct intel_plane_state *plane_state = +@@ -15549,7 +15540,6 @@ intel_modeset_setup_hw_state(struct drm_device *dev, + struct drm_modeset_acquire_ctx *ctx) + { + struct drm_i915_private *dev_priv = to_i915(dev); +- enum pipe pipe; + struct intel_crtc *crtc; + struct intel_encoder *encoder; + int i; +@@ -15560,15 +15550,23 @@ intel_modeset_setup_hw_state(struct drm_device *dev, + /* HW state is read out, now we need to sanitize this mess. */ + get_encoder_power_domains(dev_priv); + +- intel_sanitize_plane_mapping(dev_priv); ++ /* ++ * intel_sanitize_plane_mapping() may need to do vblank ++ * waits, so we need vblank interrupts restored beforehand. ++ */ ++ for_each_intel_crtc(&dev_priv->drm, crtc) { ++ drm_crtc_vblank_reset(&crtc->base); + +- for_each_intel_encoder(dev, encoder) { +- intel_sanitize_encoder(encoder); ++ if (crtc->active) ++ drm_crtc_vblank_on(&crtc->base); + } + +- for_each_pipe(dev_priv, pipe) { +- crtc = intel_get_crtc_for_pipe(dev_priv, pipe); ++ intel_sanitize_plane_mapping(dev_priv); ++ ++ for_each_intel_encoder(dev, encoder) ++ intel_sanitize_encoder(encoder); + ++ for_each_intel_crtc(&dev_priv->drm, crtc) { + intel_sanitize_crtc(crtc, ctx); + intel_dump_pipe_config(crtc, crtc->config, + "[setup_hw_state]"); +diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c +index 8e465095fe06..5d6517d37236 100644 +--- a/drivers/gpu/drm/i915/intel_dp.c ++++ b/drivers/gpu/drm/i915/intel_dp.c +@@ -387,6 +387,22 @@ static bool intel_dp_link_params_valid(struct intel_dp *intel_dp, int link_rate, + return true; + } + ++static bool intel_dp_can_link_train_fallback_for_edp(struct intel_dp *intel_dp, ++ int link_rate, ++ uint8_t lane_count) ++{ ++ const struct drm_display_mode *fixed_mode = ++ intel_dp->attached_connector->panel.fixed_mode; ++ int mode_rate, max_rate; ++ ++ mode_rate = intel_dp_link_required(fixed_mode->clock, 18); ++ max_rate = intel_dp_max_data_rate(link_rate, lane_count); ++ if (mode_rate > max_rate) ++ return false; ++ ++ return true; ++} ++ + int intel_dp_get_link_train_fallback_values(struct intel_dp *intel_dp, + int link_rate, uint8_t lane_count) + { +@@ -396,9 +412,23 @@ int intel_dp_get_link_train_fallback_values(struct intel_dp *intel_dp, + intel_dp->num_common_rates, + link_rate); + if (index > 0) { ++ if (intel_dp_is_edp(intel_dp) && ++ !intel_dp_can_link_train_fallback_for_edp(intel_dp, ++ intel_dp->common_rates[index - 1], ++ lane_count)) { ++ DRM_DEBUG_KMS("Retrying Link training for eDP with same parameters\n"); ++ return 0; ++ } + intel_dp->max_link_rate = intel_dp->common_rates[index - 1]; + intel_dp->max_link_lane_count = lane_count; + } else if (lane_count > 1) { ++ if (intel_dp_is_edp(intel_dp) && ++ !intel_dp_can_link_train_fallback_for_edp(intel_dp, ++ intel_dp_max_common_rate(intel_dp), ++ lane_count >> 1)) { ++ DRM_DEBUG_KMS("Retrying Link training for eDP with same parameters\n"); ++ return 0; ++ } + intel_dp->max_link_rate = intel_dp_max_common_rate(intel_dp); + intel_dp->max_link_lane_count = lane_count >> 1; + } else { +@@ -4842,19 +4872,13 @@ intel_dp_long_pulse(struct intel_connector *connector, + */ + status = connector_status_disconnected; + goto out; +- } else { +- /* +- * If display is now connected check links status, +- * there has been known issues of link loss triggering +- * long pulse. +- * +- * Some sinks (eg. ASUS PB287Q) seem to perform some +- * weird HPD ping pong during modesets. So we can apparently +- * end up with HPD going low during a modeset, and then +- * going back up soon after. And once that happens we must +- * retrain the link to get a picture. That's in case no +- * userspace component reacted to intermittent HPD dip. +- */ ++ } ++ ++ /* ++ * Some external monitors do not signal loss of link synchronization ++ * with an IRQ_HPD, so force a link status check. ++ */ ++ if (!intel_dp_is_edp(intel_dp)) { + struct intel_encoder *encoder = &dp_to_dig_port(intel_dp)->base; + + intel_dp_retrain_link(encoder, ctx); +diff --git a/drivers/gpu/drm/i915/intel_dp_link_training.c b/drivers/gpu/drm/i915/intel_dp_link_training.c +index 3fcaa98b9055..667397541f10 100644 +--- a/drivers/gpu/drm/i915/intel_dp_link_training.c ++++ b/drivers/gpu/drm/i915/intel_dp_link_training.c +@@ -335,22 +335,14 @@ intel_dp_start_link_train(struct intel_dp *intel_dp) + return; + + failure_handling: +- /* Dont fallback and prune modes if its eDP */ +- if (!intel_dp_is_edp(intel_dp)) { +- DRM_DEBUG_KMS("[CONNECTOR:%d:%s] Link Training failed at link rate = %d, lane count = %d", +- intel_connector->base.base.id, +- intel_connector->base.name, +- intel_dp->link_rate, intel_dp->lane_count); +- if (!intel_dp_get_link_train_fallback_values(intel_dp, +- intel_dp->link_rate, +- intel_dp->lane_count)) +- /* Schedule a Hotplug Uevent to userspace to start modeset */ +- schedule_work(&intel_connector->modeset_retry_work); +- } else { +- DRM_ERROR("[CONNECTOR:%d:%s] Link Training failed at link rate = %d, lane count = %d", +- intel_connector->base.base.id, +- intel_connector->base.name, +- intel_dp->link_rate, intel_dp->lane_count); +- } ++ DRM_DEBUG_KMS("[CONNECTOR:%d:%s] Link Training failed at link rate = %d, lane count = %d", ++ intel_connector->base.base.id, ++ intel_connector->base.name, ++ intel_dp->link_rate, intel_dp->lane_count); ++ if (!intel_dp_get_link_train_fallback_values(intel_dp, ++ intel_dp->link_rate, ++ intel_dp->lane_count)) ++ /* Schedule a Hotplug Uevent to userspace to start modeset */ ++ schedule_work(&intel_connector->modeset_retry_work); + return; + } +diff --git a/drivers/gpu/drm/i915/intel_dp_mst.c b/drivers/gpu/drm/i915/intel_dp_mst.c +index 5890500a3a8b..80566cc347ee 100644 +--- a/drivers/gpu/drm/i915/intel_dp_mst.c ++++ b/drivers/gpu/drm/i915/intel_dp_mst.c +@@ -38,11 +38,11 @@ static bool intel_dp_mst_compute_config(struct intel_encoder *encoder, + struct intel_dp_mst_encoder *intel_mst = enc_to_mst(&encoder->base); + struct intel_digital_port *intel_dig_port = intel_mst->primary; + struct intel_dp *intel_dp = &intel_dig_port->dp; +- struct intel_connector *connector = +- to_intel_connector(conn_state->connector); ++ struct drm_connector *connector = conn_state->connector; ++ void *port = to_intel_connector(connector)->port; + struct drm_atomic_state *state = pipe_config->base.state; + int bpp; +- int lane_count, slots; ++ int lane_count, slots = 0; + const struct drm_display_mode *adjusted_mode = &pipe_config->base.adjusted_mode; + int mst_pbn; + bool reduce_m_n = drm_dp_has_quirk(&intel_dp->desc, +@@ -70,17 +70,23 @@ static bool intel_dp_mst_compute_config(struct intel_encoder *encoder, + + pipe_config->port_clock = intel_dp_max_link_rate(intel_dp); + +- if (drm_dp_mst_port_has_audio(&intel_dp->mst_mgr, connector->port)) ++ if (drm_dp_mst_port_has_audio(&intel_dp->mst_mgr, port)) + pipe_config->has_audio = true; + + mst_pbn = drm_dp_calc_pbn_mode(adjusted_mode->crtc_clock, bpp); + pipe_config->pbn = mst_pbn; + +- slots = drm_dp_atomic_find_vcpi_slots(state, &intel_dp->mst_mgr, +- connector->port, mst_pbn); +- if (slots < 0) { +- DRM_DEBUG_KMS("failed finding vcpi slots:%d\n", slots); +- return false; ++ /* Zombie connectors can't have VCPI slots */ ++ if (READ_ONCE(connector->registered)) { ++ slots = drm_dp_atomic_find_vcpi_slots(state, ++ &intel_dp->mst_mgr, ++ port, ++ mst_pbn); ++ if (slots < 0) { ++ DRM_DEBUG_KMS("failed finding vcpi slots:%d\n", ++ slots); ++ return false; ++ } + } + + intel_link_compute_m_n(bpp, lane_count, +@@ -307,9 +313,8 @@ static int intel_dp_mst_get_ddc_modes(struct drm_connector *connector) + struct edid *edid; + int ret; + +- if (!intel_dp) { ++ if (!READ_ONCE(connector->registered)) + return intel_connector_update_modes(connector, NULL); +- } + + edid = drm_dp_mst_get_edid(connector, &intel_dp->mst_mgr, intel_connector->port); + ret = intel_connector_update_modes(connector, edid); +@@ -324,9 +329,10 @@ intel_dp_mst_detect(struct drm_connector *connector, bool force) + struct intel_connector *intel_connector = to_intel_connector(connector); + struct intel_dp *intel_dp = intel_connector->mst_port; + +- if (!intel_dp) ++ if (!READ_ONCE(connector->registered)) + return connector_status_disconnected; +- return drm_dp_mst_detect_port(connector, &intel_dp->mst_mgr, intel_connector->port); ++ return drm_dp_mst_detect_port(connector, &intel_dp->mst_mgr, ++ intel_connector->port); + } + + static void +@@ -366,7 +372,7 @@ intel_dp_mst_mode_valid(struct drm_connector *connector, + int bpp = 24; /* MST uses fixed bpp */ + int max_rate, mode_rate, max_lanes, max_link_clock; + +- if (!intel_dp) ++ if (!READ_ONCE(connector->registered)) + return MODE_ERROR; + + if (mode->flags & DRM_MODE_FLAG_DBLSCAN) +@@ -398,7 +404,7 @@ static struct drm_encoder *intel_mst_atomic_best_encoder(struct drm_connector *c + struct intel_dp *intel_dp = intel_connector->mst_port; + struct intel_crtc *crtc = to_intel_crtc(state->crtc); + +- if (!intel_dp) ++ if (!READ_ONCE(connector->registered)) + return NULL; + return &intel_dp->mst_encoders[crtc->pipe]->base.base; + } +@@ -458,6 +464,10 @@ static struct drm_connector *intel_dp_add_mst_connector(struct drm_dp_mst_topolo + if (!intel_connector) + return NULL; + ++ intel_connector->get_hw_state = intel_dp_mst_get_hw_state; ++ intel_connector->mst_port = intel_dp; ++ intel_connector->port = port; ++ + connector = &intel_connector->base; + ret = drm_connector_init(dev, connector, &intel_dp_mst_connector_funcs, + DRM_MODE_CONNECTOR_DisplayPort); +@@ -468,10 +478,6 @@ static struct drm_connector *intel_dp_add_mst_connector(struct drm_dp_mst_topolo + + drm_connector_helper_add(connector, &intel_dp_mst_connector_helper_funcs); + +- intel_connector->get_hw_state = intel_dp_mst_get_hw_state; +- intel_connector->mst_port = intel_dp; +- intel_connector->port = port; +- + for_each_pipe(dev_priv, pipe) { + struct drm_encoder *enc = + &intel_dp->mst_encoders[pipe]->base.base; +@@ -510,7 +516,6 @@ static void intel_dp_register_mst_connector(struct drm_connector *connector) + static void intel_dp_destroy_mst_connector(struct drm_dp_mst_topology_mgr *mgr, + struct drm_connector *connector) + { +- struct intel_connector *intel_connector = to_intel_connector(connector); + struct drm_i915_private *dev_priv = to_i915(connector->dev); + + DRM_DEBUG_KMS("[CONNECTOR:%d:%s]\n", connector->base.id, connector->name); +@@ -519,10 +524,6 @@ static void intel_dp_destroy_mst_connector(struct drm_dp_mst_topology_mgr *mgr, + if (dev_priv->fbdev) + drm_fb_helper_remove_one_connector(&dev_priv->fbdev->helper, + connector); +- /* prevent race with the check in ->detect */ +- drm_modeset_lock(&connector->dev->mode_config.connection_mutex, NULL); +- intel_connector->mst_port = NULL; +- drm_modeset_unlock(&connector->dev->mode_config.connection_mutex); + + drm_connector_unreference(connector); + } +diff --git a/drivers/gpu/drm/i915/intel_lpe_audio.c b/drivers/gpu/drm/i915/intel_lpe_audio.c +index cdf19553ffac..5d5336fbe7b0 100644 +--- a/drivers/gpu/drm/i915/intel_lpe_audio.c ++++ b/drivers/gpu/drm/i915/intel_lpe_audio.c +@@ -297,8 +297,10 @@ void intel_lpe_audio_teardown(struct drm_i915_private *dev_priv) + lpe_audio_platdev_destroy(dev_priv); + + irq_free_desc(dev_priv->lpe_audio.irq); +-} + ++ dev_priv->lpe_audio.irq = -1; ++ dev_priv->lpe_audio.platdev = NULL; ++} + + /** + * intel_lpe_audio_notify() - notify lpe audio event +diff --git a/drivers/gpu/drm/i915/intel_lrc.c b/drivers/gpu/drm/i915/intel_lrc.c +index 7c4c8fb1dae4..0328ee704ee5 100644 +--- a/drivers/gpu/drm/i915/intel_lrc.c ++++ b/drivers/gpu/drm/i915/intel_lrc.c +@@ -425,7 +425,8 @@ static u64 execlists_update_context(struct i915_request *rq) + + reg_state[CTX_RING_TAIL+1] = intel_ring_set_tail(rq->ring, rq->tail); + +- /* True 32b PPGTT with dynamic page allocation: update PDP ++ /* ++ * True 32b PPGTT with dynamic page allocation: update PDP + * registers and point the unallocated PDPs to scratch page. + * PML4 is allocated during ppgtt init, so this is not needed + * in 48-bit mode. +@@ -433,6 +434,17 @@ static u64 execlists_update_context(struct i915_request *rq) + if (ppgtt && !i915_vm_is_48bit(&ppgtt->base)) + execlists_update_context_pdps(ppgtt, reg_state); + ++ /* ++ * Make sure the context image is complete before we submit it to HW. ++ * ++ * Ostensibly, writes (including the WCB) should be flushed prior to ++ * an uncached write such as our mmio register access, the empirical ++ * evidence (esp. on Braswell) suggests that the WC write into memory ++ * may not be visible to the HW prior to the completion of the UC ++ * register write and that we may begin execution from the context ++ * before its image is complete leading to invalid PD chasing. ++ */ ++ wmb(); + return ce->lrc_desc; + } + +diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c +index 8f19349a6055..72007d634359 100644 +--- a/drivers/gpu/drm/i915/intel_ringbuffer.c ++++ b/drivers/gpu/drm/i915/intel_ringbuffer.c +@@ -91,6 +91,7 @@ static int + gen4_render_ring_flush(struct i915_request *rq, u32 mode) + { + u32 cmd, *cs; ++ int i; + + /* + * read/write caches: +@@ -127,12 +128,45 @@ gen4_render_ring_flush(struct i915_request *rq, u32 mode) + cmd |= MI_INVALIDATE_ISP; + } + +- cs = intel_ring_begin(rq, 2); ++ i = 2; ++ if (mode & EMIT_INVALIDATE) ++ i += 20; ++ ++ cs = intel_ring_begin(rq, i); + if (IS_ERR(cs)) + return PTR_ERR(cs); + + *cs++ = cmd; +- *cs++ = MI_NOOP; ++ ++ /* ++ * A random delay to let the CS invalidate take effect? Without this ++ * delay, the GPU relocation path fails as the CS does not see ++ * the updated contents. Just as important, if we apply the flushes ++ * to the EMIT_FLUSH branch (i.e. immediately after the relocation ++ * write and before the invalidate on the next batch), the relocations ++ * still fail. This implies that is a delay following invalidation ++ * that is required to reset the caches as opposed to a delay to ++ * ensure the memory is written. ++ */ ++ if (mode & EMIT_INVALIDATE) { ++ *cs++ = GFX_OP_PIPE_CONTROL(4) | PIPE_CONTROL_QW_WRITE; ++ *cs++ = i915_ggtt_offset(rq->engine->scratch) | ++ PIPE_CONTROL_GLOBAL_GTT; ++ *cs++ = 0; ++ *cs++ = 0; ++ ++ for (i = 0; i < 12; i++) ++ *cs++ = MI_FLUSH; ++ ++ *cs++ = GFX_OP_PIPE_CONTROL(4) | PIPE_CONTROL_QW_WRITE; ++ *cs++ = i915_ggtt_offset(rq->engine->scratch) | ++ PIPE_CONTROL_GLOBAL_GTT; ++ *cs++ = 0; ++ *cs++ = 0; ++ } ++ ++ *cs++ = cmd; ++ + intel_ring_advance(rq, cs); + + return 0; +diff --git a/drivers/gpu/drm/msm/adreno/adreno_gpu.c b/drivers/gpu/drm/msm/adreno/adreno_gpu.c +index 17d0506d058c..48960c1d92bc 100644 +--- a/drivers/gpu/drm/msm/adreno/adreno_gpu.c ++++ b/drivers/gpu/drm/msm/adreno/adreno_gpu.c +@@ -477,8 +477,7 @@ static int adreno_get_legacy_pwrlevels(struct device *dev) + struct device_node *child, *node; + int ret; + +- node = of_find_compatible_node(dev->of_node, NULL, +- "qcom,gpu-pwrlevels"); ++ node = of_get_compatible_child(dev->of_node, "qcom,gpu-pwrlevels"); + if (!node) { + dev_err(dev, "Could not find the GPU powerlevels\n"); + return -ENXIO; +@@ -499,6 +498,8 @@ static int adreno_get_legacy_pwrlevels(struct device *dev) + dev_pm_opp_add(dev, val, 0); + } + ++ of_node_put(node); ++ + return 0; + } + +diff --git a/drivers/gpu/drm/nouveau/dispnv50/disp.c b/drivers/gpu/drm/nouveau/dispnv50/disp.c +index c3c8c84da113..c1e4aab9932e 100644 +--- a/drivers/gpu/drm/nouveau/dispnv50/disp.c ++++ b/drivers/gpu/drm/nouveau/dispnv50/disp.c +@@ -818,22 +818,16 @@ nv50_mstc_atomic_best_encoder(struct drm_connector *connector, + { + struct nv50_head *head = nv50_head(connector_state->crtc); + struct nv50_mstc *mstc = nv50_mstc(connector); +- if (mstc->port) { +- struct nv50_mstm *mstm = mstc->mstm; +- return &mstm->msto[head->base.index]->encoder; +- } +- return NULL; ++ ++ return &mstc->mstm->msto[head->base.index]->encoder; + } + + static struct drm_encoder * + nv50_mstc_best_encoder(struct drm_connector *connector) + { + struct nv50_mstc *mstc = nv50_mstc(connector); +- if (mstc->port) { +- struct nv50_mstm *mstm = mstc->mstm; +- return &mstm->msto[0]->encoder; +- } +- return NULL; ++ ++ return &mstc->mstm->msto[0]->encoder; + } + + static enum drm_mode_status +diff --git a/drivers/gpu/drm/nouveau/nouveau_backlight.c b/drivers/gpu/drm/nouveau/nouveau_backlight.c +index 408b955e5c39..6dd72bc32897 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_backlight.c ++++ b/drivers/gpu/drm/nouveau/nouveau_backlight.c +@@ -116,7 +116,7 @@ nv40_backlight_init(struct drm_connector *connector) + &nv40_bl_ops, &props); + + if (IS_ERR(bd)) { +- if (bl_connector.id > 0) ++ if (bl_connector.id >= 0) + ida_simple_remove(&bl_ida, bl_connector.id); + return PTR_ERR(bd); + } +@@ -249,7 +249,7 @@ nv50_backlight_init(struct drm_connector *connector) + nv_encoder, ops, &props); + + if (IS_ERR(bd)) { +- if (bl_connector.id > 0) ++ if (bl_connector.id >= 0) + ida_simple_remove(&bl_ida, bl_connector.id); + return PTR_ERR(bd); + } +diff --git a/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c b/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c +index f92fe205550b..e884183c018a 100644 +--- a/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c ++++ b/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c +@@ -285,6 +285,17 @@ static int dmm_txn_commit(struct dmm_txn *txn, bool wait) + } + + txn->last_pat->next_pa = 0; ++ /* ensure that the written descriptors are visible to DMM */ ++ wmb(); ++ ++ /* ++ * NOTE: the wmb() above should be enough, but there seems to be a bug ++ * in OMAP's memory barrier implementation, which in some rare cases may ++ * cause the writes not to be observable after wmb(). ++ */ ++ ++ /* read back to ensure the data is in RAM */ ++ readl(&txn->last_pat->next_pa); + + /* write to PAT_DESCR to clear out any pending transaction */ + dmm_write(dmm, 0x0, reg[PAT_DESCR][engine->id]); +diff --git a/drivers/gpu/drm/rcar-du/rcar_du_kms.c b/drivers/gpu/drm/rcar-du/rcar_du_kms.c +index f0bc7cc0e913..fb46df56f0c4 100644 +--- a/drivers/gpu/drm/rcar-du/rcar_du_kms.c ++++ b/drivers/gpu/drm/rcar-du/rcar_du_kms.c +@@ -516,12 +516,22 @@ int rcar_du_modeset_init(struct rcar_du_device *rcdu) + + dev->mode_config.min_width = 0; + dev->mode_config.min_height = 0; +- dev->mode_config.max_width = 4095; +- dev->mode_config.max_height = 2047; + dev->mode_config.normalize_zpos = true; + dev->mode_config.funcs = &rcar_du_mode_config_funcs; + dev->mode_config.helper_private = &rcar_du_mode_config_helper; + ++ if (rcdu->info->gen < 3) { ++ dev->mode_config.max_width = 4095; ++ dev->mode_config.max_height = 2047; ++ } else { ++ /* ++ * The Gen3 DU uses the VSP1 for memory access, and is limited ++ * to frame sizes of 8190x8190. ++ */ ++ dev->mode_config.max_width = 8190; ++ dev->mode_config.max_height = 8190; ++ } ++ + rcdu->num_crtcs = hweight8(rcdu->info->channels_mask); + + ret = rcar_du_properties_init(rcdu); +diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_drv.c b/drivers/gpu/drm/rockchip/rockchip_drm_drv.c +index f814d37b1db2..05368fa4f956 100644 +--- a/drivers/gpu/drm/rockchip/rockchip_drm_drv.c ++++ b/drivers/gpu/drm/rockchip/rockchip_drm_drv.c +@@ -442,6 +442,11 @@ static int rockchip_drm_platform_remove(struct platform_device *pdev) + return 0; + } + ++static void rockchip_drm_platform_shutdown(struct platform_device *pdev) ++{ ++ rockchip_drm_platform_remove(pdev); ++} ++ + static const struct of_device_id rockchip_drm_dt_ids[] = { + { .compatible = "rockchip,display-subsystem", }, + { /* sentinel */ }, +@@ -451,6 +456,7 @@ MODULE_DEVICE_TABLE(of, rockchip_drm_dt_ids); + static struct platform_driver rockchip_drm_platform_driver = { + .probe = rockchip_drm_platform_probe, + .remove = rockchip_drm_platform_remove, ++ .shutdown = rockchip_drm_platform_shutdown, + .driver = { + .name = "rockchip-drm", + .of_match_table = rockchip_drm_dt_ids, +diff --git a/drivers/hwmon/hwmon.c b/drivers/hwmon/hwmon.c +index e88c01961948..52918185578a 100644 +--- a/drivers/hwmon/hwmon.c ++++ b/drivers/hwmon/hwmon.c +@@ -631,8 +631,10 @@ __hwmon_device_register(struct device *dev, const char *name, void *drvdata, + if (info[i]->config[j] & HWMON_T_INPUT) { + err = hwmon_thermal_add_sensor(dev, + hwdev, j); +- if (err) +- goto free_device; ++ if (err) { ++ device_unregister(hdev); ++ goto ida_remove; ++ } + } + } + } +@@ -640,8 +642,6 @@ __hwmon_device_register(struct device *dev, const char *name, void *drvdata, + + return hdev; + +-free_device: +- device_unregister(hdev); + free_hwmon: + kfree(hwdev); + ida_remove: +diff --git a/drivers/input/touchscreen/wm97xx-core.c b/drivers/input/touchscreen/wm97xx-core.c +index 2566b4d8b342..73856c2a8ac0 100644 +--- a/drivers/input/touchscreen/wm97xx-core.c ++++ b/drivers/input/touchscreen/wm97xx-core.c +@@ -929,7 +929,8 @@ static int __init wm97xx_init(void) + + static void __exit wm97xx_exit(void) + { +- driver_unregister(&wm97xx_driver); ++ if (IS_BUILTIN(CONFIG_AC97_BUS)) ++ driver_unregister(&wm97xx_driver); + platform_driver_unregister(&wm97xx_mfd_driver); + } + +diff --git a/drivers/media/i2c/tvp5150.c b/drivers/media/i2c/tvp5150.c +index 805bd9c65940..8b450fc53202 100644 +--- a/drivers/media/i2c/tvp5150.c ++++ b/drivers/media/i2c/tvp5150.c +@@ -901,9 +901,6 @@ static int tvp5150_set_selection(struct v4l2_subdev *sd, + + /* tvp5150 has some special limits */ + rect.left = clamp(rect.left, 0, TVP5150_MAX_CROP_LEFT); +- rect.width = clamp_t(unsigned int, rect.width, +- TVP5150_H_MAX - TVP5150_MAX_CROP_LEFT - rect.left, +- TVP5150_H_MAX - rect.left); + rect.top = clamp(rect.top, 0, TVP5150_MAX_CROP_TOP); + + /* Calculate height based on current standard */ +@@ -917,9 +914,16 @@ static int tvp5150_set_selection(struct v4l2_subdev *sd, + else + hmax = TVP5150_V_MAX_OTHERS; + +- rect.height = clamp_t(unsigned int, rect.height, ++ /* ++ * alignments: ++ * - width = 2 due to UYVY colorspace ++ * - height, image = no special alignment ++ */ ++ v4l_bound_align_image(&rect.width, ++ TVP5150_H_MAX - TVP5150_MAX_CROP_LEFT - rect.left, ++ TVP5150_H_MAX - rect.left, 1, &rect.height, + hmax - TVP5150_MAX_CROP_TOP - rect.top, +- hmax - rect.top); ++ hmax - rect.top, 0, 0); + + tvp5150_write(sd, TVP5150_VERT_BLANKING_START, rect.top); + tvp5150_write(sd, TVP5150_VERT_BLANKING_STOP, +diff --git a/drivers/media/pci/cx23885/altera-ci.c b/drivers/media/pci/cx23885/altera-ci.c +index 70aec9bb7e95..07bf20c6c6fc 100644 +--- a/drivers/media/pci/cx23885/altera-ci.c ++++ b/drivers/media/pci/cx23885/altera-ci.c +@@ -665,6 +665,10 @@ static int altera_hw_filt_init(struct altera_ci_config *config, int hw_filt_nr) + } + + temp_int = append_internal(inter); ++ if (!temp_int) { ++ ret = -ENOMEM; ++ goto err; ++ } + inter->filts_used = 1; + inter->dev = config->dev; + inter->fpga_rw = config->fpga_rw; +@@ -699,6 +703,7 @@ err: + __func__, ret); + + kfree(pid_filt); ++ kfree(inter); + + return ret; + } +@@ -733,6 +738,10 @@ int altera_ci_init(struct altera_ci_config *config, int ci_nr) + } + + temp_int = append_internal(inter); ++ if (!temp_int) { ++ ret = -ENOMEM; ++ goto err; ++ } + inter->cis_used = 1; + inter->dev = config->dev; + inter->fpga_rw = config->fpga_rw; +@@ -801,6 +810,7 @@ err: + ci_dbg_print("%s: Cannot initialize CI: Error %d.\n", __func__, ret); + + kfree(state); ++ kfree(inter); + + return ret; + } +diff --git a/drivers/media/platform/coda/coda-common.c b/drivers/media/platform/coda/coda-common.c +index c7631e117dd3..1ae15d4ec5ed 100644 +--- a/drivers/media/platform/coda/coda-common.c ++++ b/drivers/media/platform/coda/coda-common.c +@@ -1719,7 +1719,8 @@ static int coda_s_ctrl(struct v4l2_ctrl *ctrl) + break; + case V4L2_CID_MPEG_VIDEO_H264_PROFILE: + /* TODO: switch between baseline and constrained baseline */ +- ctx->params.h264_profile_idc = 66; ++ if (ctx->inst_type == CODA_INST_ENCODER) ++ ctx->params.h264_profile_idc = 66; + break; + case V4L2_CID_MPEG_VIDEO_H264_LEVEL: + /* nothing to do, this is set by the encoder */ +diff --git a/drivers/mtd/devices/Kconfig b/drivers/mtd/devices/Kconfig +index 57b02c4b3f63..6072ea9a84f2 100644 +--- a/drivers/mtd/devices/Kconfig ++++ b/drivers/mtd/devices/Kconfig +@@ -207,7 +207,7 @@ comment "Disk-On-Chip Device Drivers" + config MTD_DOCG3 + tristate "M-Systems Disk-On-Chip G3" + select BCH +- select BCH_CONST_PARAMS ++ select BCH_CONST_PARAMS if !MTD_NAND_BCH + select BITREVERSE + ---help--- + This provides an MTD device driver for the M-Systems DiskOnChip +diff --git a/drivers/mtd/spi-nor/cadence-quadspi.c b/drivers/mtd/spi-nor/cadence-quadspi.c +index d7e10b36a0b9..0f0126901ac5 100644 +--- a/drivers/mtd/spi-nor/cadence-quadspi.c ++++ b/drivers/mtd/spi-nor/cadence-quadspi.c +@@ -1000,7 +1000,7 @@ static int cqspi_direct_read_execute(struct spi_nor *nor, u_char *buf, + err_unmap: + dma_unmap_single(nor->dev, dma_dst, len, DMA_DEV_TO_MEM); + +- return 0; ++ return ret; + } + + static ssize_t cqspi_read(struct spi_nor *nor, loff_t from, +diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c +index 2b01180be834..29661d45c6d0 100644 +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -3118,13 +3118,13 @@ static int bond_slave_netdev_event(unsigned long event, + case NETDEV_CHANGE: + /* For 802.3ad mode only: + * Getting invalid Speed/Duplex values here will put slave +- * in weird state. So mark it as link-down for the time ++ * in weird state. So mark it as link-fail for the time + * being and let link-monitoring (miimon) set it right when + * correct speeds/duplex are available. + */ + if (bond_update_speed_duplex(slave) && + BOND_MODE(bond) == BOND_MODE_8023AD) +- slave->link = BOND_LINK_DOWN; ++ slave->link = BOND_LINK_FAIL; + + if (BOND_MODE(bond) == BOND_MODE_8023AD) + bond_3ad_adapter_speed_duplex_changed(slave); +diff --git a/drivers/of/of_numa.c b/drivers/of/of_numa.c +index 27d9b4bba535..2411ed3c7303 100644 +--- a/drivers/of/of_numa.c ++++ b/drivers/of/of_numa.c +@@ -115,9 +115,14 @@ static int __init of_numa_parse_distance_map_v1(struct device_node *map) + distance = of_read_number(matrix, 1); + matrix++; + ++ if ((nodea == nodeb && distance != LOCAL_DISTANCE) || ++ (nodea != nodeb && distance <= LOCAL_DISTANCE)) { ++ pr_err("Invalid distance[node%d -> node%d] = %d\n", ++ nodea, nodeb, distance); ++ return -EINVAL; ++ } ++ + numa_set_distance(nodea, nodeb, distance); +- pr_debug("distance[node%d -> node%d] = %d\n", +- nodea, nodeb, distance); + + /* Set default distance of node B->A same as A->B */ + if (nodeb > nodea) +diff --git a/drivers/rtc/hctosys.c b/drivers/rtc/hctosys.c +index e79f2a181ad2..b9ec4a16db1f 100644 +--- a/drivers/rtc/hctosys.c ++++ b/drivers/rtc/hctosys.c +@@ -50,8 +50,10 @@ static int __init rtc_hctosys(void) + tv64.tv_sec = rtc_tm_to_time64(&tm); + + #if BITS_PER_LONG == 32 +- if (tv64.tv_sec > INT_MAX) ++ if (tv64.tv_sec > INT_MAX) { ++ err = -ERANGE; + goto err_read; ++ } + #endif + + err = do_settimeofday64(&tv64); +diff --git a/drivers/scsi/qla2xxx/qla_gs.c b/drivers/scsi/qla2xxx/qla_gs.c +index 7a3744006419..c492af5bcd95 100644 +--- a/drivers/scsi/qla2xxx/qla_gs.c ++++ b/drivers/scsi/qla2xxx/qla_gs.c +@@ -4410,9 +4410,9 @@ int qla24xx_async_gpnft(scsi_qla_host_t *vha, u8 fc4_type, srb_t *sp) + sp->u.iocb_cmd.timeout = qla2x00_async_iocb_timeout; + qla2x00_init_timer(sp, qla2x00_get_async_timeout(vha) + 2); + +- rspsz = sizeof(struct ct_sns_gpnft_rsp) + +- ((vha->hw->max_fibre_devices - 1) * +- sizeof(struct ct_sns_gpn_ft_data)); ++ rspsz = sp->u.iocb_cmd.u.ctarg.rsp_size; ++ memset(sp->u.iocb_cmd.u.ctarg.rsp, 0, sp->u.iocb_cmd.u.ctarg.rsp_size); ++ memset(sp->u.iocb_cmd.u.ctarg.req, 0, sp->u.iocb_cmd.u.ctarg.req_size); + + ct_sns = (struct ct_sns_pkt *)sp->u.iocb_cmd.u.ctarg.req; + /* CT_IU preamble */ +diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c +index 75d34def2361..f77e470152d0 100644 +--- a/drivers/scsi/qla2xxx/qla_init.c ++++ b/drivers/scsi/qla2xxx/qla_init.c +@@ -1742,25 +1742,15 @@ qla24xx_handle_plogi_done_event(struct scsi_qla_host *vha, struct event_arg *ea) + cid.b.rsvd_1 = 0; + + ql_dbg(ql_dbg_disc, vha, 0x20ec, +- "%s %d %8phC LoopID 0x%x in use post gnl\n", ++ "%s %d %8phC lid %#x in use with pid %06x post gnl\n", + __func__, __LINE__, ea->fcport->port_name, +- ea->fcport->loop_id); ++ ea->fcport->loop_id, cid.b24); + +- if (IS_SW_RESV_ADDR(cid)) { +- set_bit(ea->fcport->loop_id, vha->hw->loop_id_map); +- ea->fcport->loop_id = FC_NO_LOOP_ID; +- } else { +- qla2x00_clear_loop_id(ea->fcport); +- } ++ set_bit(ea->fcport->loop_id, vha->hw->loop_id_map); ++ ea->fcport->loop_id = FC_NO_LOOP_ID; + qla24xx_post_gnl_work(vha, ea->fcport); + break; + case MBS_PORT_ID_USED: +- ql_dbg(ql_dbg_disc, vha, 0x20ed, +- "%s %d %8phC NPortId %02x%02x%02x inuse post gidpn\n", +- __func__, __LINE__, ea->fcport->port_name, +- ea->fcport->d_id.b.domain, ea->fcport->d_id.b.area, +- ea->fcport->d_id.b.al_pa); +- + lid = ea->iop[1] & 0xffff; + qlt_find_sess_invalidate_other(vha, + wwn_to_u64(ea->fcport->port_name), +@@ -4501,6 +4491,7 @@ qla2x00_alloc_fcport(scsi_qla_host_t *vha, gfp_t flags) + fcport->loop_id = FC_NO_LOOP_ID; + qla2x00_set_fcport_state(fcport, FCS_UNCONFIGURED); + fcport->supported_classes = FC_COS_UNSPECIFIED; ++ fcport->fp_speed = PORT_SPEED_UNKNOWN; + + fcport->ct_desc.ct_sns = dma_alloc_coherent(&vha->hw->pdev->dev, + sizeof(struct ct_sns_pkt), &fcport->ct_desc.ct_sns_dma, +@@ -6515,7 +6506,7 @@ qla2x00_abort_isp(scsi_qla_host_t *vha) + * The next call disables the board + * completely. + */ +- ha->isp_ops->reset_adapter(vha); ++ qla2x00_abort_isp_cleanup(vha); + vha->flags.online = 0; + clear_bit(ISP_ABORT_RETRY, + &vha->dpc_flags); +@@ -6972,7 +6963,6 @@ qla24xx_nvram_config(scsi_qla_host_t *vha) + } + icb->firmware_options_2 &= cpu_to_le32( + ~(BIT_3 | BIT_2 | BIT_1 | BIT_0)); +- vha->flags.process_response_queue = 0; + if (ha->zio_mode != QLA_ZIO_DISABLED) { + ha->zio_mode = QLA_ZIO_MODE_6; + +@@ -6983,7 +6973,6 @@ qla24xx_nvram_config(scsi_qla_host_t *vha) + icb->firmware_options_2 |= cpu_to_le32( + (uint32_t)ha->zio_mode); + icb->interrupt_delay_timer = cpu_to_le16(ha->zio_timer); +- vha->flags.process_response_queue = 1; + } + + if (rval) { +diff --git a/drivers/scsi/qla2xxx/qla_iocb.c b/drivers/scsi/qla2xxx/qla_iocb.c +index 667055cbe155..3e94f15ce1cf 100644 +--- a/drivers/scsi/qla2xxx/qla_iocb.c ++++ b/drivers/scsi/qla2xxx/qla_iocb.c +@@ -1526,12 +1526,6 @@ qla24xx_start_scsi(srb_t *sp) + + /* Set chip new ring index. */ + WRT_REG_DWORD(req->req_q_in, req->ring_index); +- RD_REG_DWORD_RELAXED(&ha->iobase->isp24.hccr); +- +- /* Manage unprocessed RIO/ZIO commands in response queue. */ +- if (vha->flags.process_response_queue && +- rsp->ring_ptr->signature != RESPONSE_PROCESSED) +- qla24xx_process_response_queue(vha, rsp); + + spin_unlock_irqrestore(&ha->hardware_lock, flags); + return QLA_SUCCESS; +@@ -1725,12 +1719,6 @@ qla24xx_dif_start_scsi(srb_t *sp) + + /* Set chip new ring index. */ + WRT_REG_DWORD(req->req_q_in, req->ring_index); +- RD_REG_DWORD_RELAXED(&ha->iobase->isp24.hccr); +- +- /* Manage unprocessed RIO/ZIO commands in response queue. */ +- if (vha->flags.process_response_queue && +- rsp->ring_ptr->signature != RESPONSE_PROCESSED) +- qla24xx_process_response_queue(vha, rsp); + + spin_unlock_irqrestore(&ha->hardware_lock, flags); + +@@ -1880,11 +1868,6 @@ qla2xxx_start_scsi_mq(srb_t *sp) + /* Set chip new ring index. */ + WRT_REG_DWORD(req->req_q_in, req->ring_index); + +- /* Manage unprocessed RIO/ZIO commands in response queue. */ +- if (vha->flags.process_response_queue && +- rsp->ring_ptr->signature != RESPONSE_PROCESSED) +- qla24xx_process_response_queue(vha, rsp); +- + spin_unlock_irqrestore(&qpair->qp_lock, flags); + return QLA_SUCCESS; + +diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c +index f0ec13d48bf3..f301621e39d7 100644 +--- a/drivers/scsi/qla2xxx/qla_mbx.c ++++ b/drivers/scsi/qla2xxx/qla_mbx.c +@@ -3716,10 +3716,7 @@ qla2x00_set_idma_speed(scsi_qla_host_t *vha, uint16_t loop_id, + mcp->mb[0] = MBC_PORT_PARAMS; + mcp->mb[1] = loop_id; + mcp->mb[2] = BIT_0; +- if (IS_CNA_CAPABLE(vha->hw)) +- mcp->mb[3] = port_speed & (BIT_5|BIT_4|BIT_3|BIT_2|BIT_1|BIT_0); +- else +- mcp->mb[3] = port_speed & (BIT_2|BIT_1|BIT_0); ++ mcp->mb[3] = port_speed & (BIT_5|BIT_4|BIT_3|BIT_2|BIT_1|BIT_0); + mcp->mb[9] = vha->vp_idx; + mcp->out_mb = MBX_9|MBX_3|MBX_2|MBX_1|MBX_0; + mcp->in_mb = MBX_3|MBX_1|MBX_0; +diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c +index c5a963c2c86e..d0dc425f33f5 100644 +--- a/drivers/scsi/qla2xxx/qla_nvme.c ++++ b/drivers/scsi/qla2xxx/qla_nvme.c +@@ -604,7 +604,7 @@ void qla_nvme_abort(struct qla_hw_data *ha, struct srb *sp, int res) + { + int rval; + +- if (!test_bit(ABORT_ISP_ACTIVE, &sp->vha->dpc_flags)) { ++ if (ha->flags.fw_started) { + rval = ha->isp_ops->abort_command(sp); + if (!rval && !qla_nvme_wait_on_command(sp)) + ql_log(ql_log_warn, NULL, 0x2112, +@@ -657,9 +657,6 @@ void qla_nvme_delete(struct scsi_qla_host *vha) + __func__, fcport); + + nvme_fc_set_remoteport_devloss(fcport->nvme_remote_port, 0); +- init_completion(&fcport->nvme_del_done); +- nvme_fc_unregister_remoteport(fcport->nvme_remote_port); +- wait_for_completion(&fcport->nvme_del_done); + } + + if (vha->nvme_local_port) { +diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c +index 6dc1b1bd8069..27fbd437f412 100644 +--- a/drivers/scsi/qla2xxx/qla_target.c ++++ b/drivers/scsi/qla2xxx/qla_target.c +@@ -1257,7 +1257,8 @@ void qlt_schedule_sess_for_deletion(struct fc_port *sess) + qla24xx_chk_fcp_state(sess); + + ql_dbg(ql_dbg_tgt, sess->vha, 0xe001, +- "Scheduling sess %p for deletion\n", sess); ++ "Scheduling sess %p for deletion %8phC\n", ++ sess, sess->port_name); + + INIT_WORK(&sess->del_work, qla24xx_delete_sess_fn); + WARN_ON(!queue_work(sess->vha->hw->wq, &sess->del_work)); +diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.c b/drivers/scsi/qla2xxx/tcm_qla2xxx.c +index 7732e9336d43..edfcb98aa4ef 100644 +--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c ++++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c +@@ -718,10 +718,6 @@ static int tcm_qla2xxx_queue_status(struct se_cmd *se_cmd) + cmd->sg_cnt = 0; + cmd->offset = 0; + cmd->dma_data_direction = target_reverse_dma_direction(se_cmd); +- if (cmd->trc_flags & TRC_XMIT_STATUS) { +- pr_crit("Multiple calls for status = %p.\n", cmd); +- dump_stack(); +- } + cmd->trc_flags |= TRC_XMIT_STATUS; + + if (se_cmd->data_direction == DMA_FROM_DEVICE) { +diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c +index 41e9ac9fc138..4fd92b1802cd 100644 +--- a/drivers/scsi/scsi_lib.c ++++ b/drivers/scsi/scsi_lib.c +@@ -696,6 +696,12 @@ static bool scsi_end_request(struct request *req, blk_status_t error, + */ + scsi_mq_uninit_cmd(cmd); + ++ /* ++ * queue is still alive, so grab the ref for preventing it ++ * from being cleaned up during running queue. ++ */ ++ percpu_ref_get(&q->q_usage_counter); ++ + __blk_mq_end_request(req, error); + + if (scsi_target(sdev)->single_lun || +@@ -703,6 +709,8 @@ static bool scsi_end_request(struct request *req, blk_status_t error, + kblockd_schedule_work(&sdev->requeue_work); + else + blk_mq_run_hw_queues(q, true); ++ ++ percpu_ref_put(&q->q_usage_counter); + } else { + unsigned long flags; + +diff --git a/drivers/soc/ti/knav_qmss.h b/drivers/soc/ti/knav_qmss.h +index 3efc47e82973..bd040c29c4bf 100644 +--- a/drivers/soc/ti/knav_qmss.h ++++ b/drivers/soc/ti/knav_qmss.h +@@ -329,8 +329,8 @@ struct knav_range_ops { + }; + + struct knav_irq_info { +- int irq; +- u32 cpu_map; ++ int irq; ++ struct cpumask *cpu_mask; + }; + + struct knav_range_info { +diff --git a/drivers/soc/ti/knav_qmss_acc.c b/drivers/soc/ti/knav_qmss_acc.c +index 316e82e46f6c..2f7fb2dcc1d6 100644 +--- a/drivers/soc/ti/knav_qmss_acc.c ++++ b/drivers/soc/ti/knav_qmss_acc.c +@@ -205,18 +205,18 @@ static int knav_range_setup_acc_irq(struct knav_range_info *range, + { + struct knav_device *kdev = range->kdev; + struct knav_acc_channel *acc; +- unsigned long cpu_map; ++ struct cpumask *cpu_mask; + int ret = 0, irq; + u32 old, new; + + if (range->flags & RANGE_MULTI_QUEUE) { + acc = range->acc; + irq = range->irqs[0].irq; +- cpu_map = range->irqs[0].cpu_map; ++ cpu_mask = range->irqs[0].cpu_mask; + } else { + acc = range->acc + queue; + irq = range->irqs[queue].irq; +- cpu_map = range->irqs[queue].cpu_map; ++ cpu_mask = range->irqs[queue].cpu_mask; + } + + old = acc->open_mask; +@@ -239,8 +239,8 @@ static int knav_range_setup_acc_irq(struct knav_range_info *range, + acc->name, acc->name); + ret = request_irq(irq, knav_acc_int_handler, 0, acc->name, + range); +- if (!ret && cpu_map) { +- ret = irq_set_affinity_hint(irq, to_cpumask(&cpu_map)); ++ if (!ret && cpu_mask) { ++ ret = irq_set_affinity_hint(irq, cpu_mask); + if (ret) { + dev_warn(range->kdev->dev, + "Failed to set IRQ affinity\n"); +diff --git a/drivers/soc/ti/knav_qmss_queue.c b/drivers/soc/ti/knav_qmss_queue.c +index 6755f2af5619..ef36acc0e708 100644 +--- a/drivers/soc/ti/knav_qmss_queue.c ++++ b/drivers/soc/ti/knav_qmss_queue.c +@@ -118,19 +118,17 @@ static int knav_queue_setup_irq(struct knav_range_info *range, + struct knav_queue_inst *inst) + { + unsigned queue = inst->id - range->queue_base; +- unsigned long cpu_map; + int ret = 0, irq; + + if (range->flags & RANGE_HAS_IRQ) { + irq = range->irqs[queue].irq; +- cpu_map = range->irqs[queue].cpu_map; + ret = request_irq(irq, knav_queue_int_handler, 0, + inst->irq_name, inst); + if (ret) + return ret; + disable_irq(irq); +- if (cpu_map) { +- ret = irq_set_affinity_hint(irq, to_cpumask(&cpu_map)); ++ if (range->irqs[queue].cpu_mask) { ++ ret = irq_set_affinity_hint(irq, range->irqs[queue].cpu_mask); + if (ret) { + dev_warn(range->kdev->dev, + "Failed to set IRQ affinity\n"); +@@ -1262,9 +1260,19 @@ static int knav_setup_queue_range(struct knav_device *kdev, + + range->num_irqs++; + +- if (IS_ENABLED(CONFIG_SMP) && oirq.args_count == 3) +- range->irqs[i].cpu_map = +- (oirq.args[2] & 0x0000ff00) >> 8; ++ if (IS_ENABLED(CONFIG_SMP) && oirq.args_count == 3) { ++ unsigned long mask; ++ int bit; ++ ++ range->irqs[i].cpu_mask = devm_kzalloc(dev, ++ cpumask_size(), GFP_KERNEL); ++ if (!range->irqs[i].cpu_mask) ++ return -ENOMEM; ++ ++ mask = (oirq.args[2] & 0x0000ff00) >> 8; ++ for_each_set_bit(bit, &mask, BITS_PER_LONG) ++ cpumask_set_cpu(bit, range->irqs[i].cpu_mask); ++ } + } + + range->num_irqs = min(range->num_irqs, range->num_queues); +diff --git a/drivers/staging/iio/adc/ad7606.c b/drivers/staging/iio/adc/ad7606.c +index 25b9fcd5e3a4..ce3351832fb1 100644 +--- a/drivers/staging/iio/adc/ad7606.c ++++ b/drivers/staging/iio/adc/ad7606.c +@@ -26,9 +26,12 @@ + + #include "ad7606.h" + +-/* Scales are computed as 2.5/2**16 and 5/2**16 respectively */ ++/* ++ * Scales are computed as 5000/32768 and 10000/32768 respectively, ++ * so that when applied to the raw values they provide mV values ++ */ + static const unsigned int scale_avail[2][2] = { +- {0, 38147}, {0, 76294} ++ {0, 152588}, {0, 305176} + }; + + static int ad7606_reset(struct ad7606_state *st) +diff --git a/drivers/staging/most/video/video.c b/drivers/staging/most/video/video.c +index cf342eb58e10..ad7e28ab9a4f 100644 +--- a/drivers/staging/most/video/video.c ++++ b/drivers/staging/most/video/video.c +@@ -530,7 +530,7 @@ static int comp_disconnect_channel(struct most_interface *iface, + return 0; + } + +-static struct core_component comp_info = { ++static struct core_component comp = { + .name = "video", + .probe_channel = comp_probe_channel, + .disconnect_channel = comp_disconnect_channel, +@@ -565,7 +565,7 @@ static void __exit comp_exit(void) + } + spin_unlock_irq(&list_lock); + +- most_deregister_component(&comp_info); ++ most_deregister_component(&comp); + BUG_ON(!list_empty(&video_devices)); + } + +diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c +index 6ab982309e6a..441778100887 100644 +--- a/drivers/thermal/thermal_core.c ++++ b/drivers/thermal/thermal_core.c +@@ -1102,8 +1102,9 @@ void thermal_cooling_device_unregister(struct thermal_cooling_device *cdev) + mutex_unlock(&thermal_list_lock); + + ida_simple_remove(&thermal_cdev_ida, cdev->id); +- device_unregister(&cdev->device); ++ device_del(&cdev->device); + thermal_cooling_device_destroy_sysfs(cdev); ++ put_device(&cdev->device); + } + EXPORT_SYMBOL_GPL(thermal_cooling_device_unregister); + +diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c +index 243c96025053..47b41159a8bc 100644 +--- a/drivers/tty/serial/sc16is7xx.c ++++ b/drivers/tty/serial/sc16is7xx.c +@@ -657,7 +657,7 @@ static void sc16is7xx_handle_tx(struct uart_port *port) + uart_write_wakeup(port); + } + +-static void sc16is7xx_port_irq(struct sc16is7xx_port *s, int portno) ++static bool sc16is7xx_port_irq(struct sc16is7xx_port *s, int portno) + { + struct uart_port *port = &s->p[portno].port; + +@@ -666,7 +666,7 @@ static void sc16is7xx_port_irq(struct sc16is7xx_port *s, int portno) + + iir = sc16is7xx_port_read(port, SC16IS7XX_IIR_REG); + if (iir & SC16IS7XX_IIR_NO_INT_BIT) +- break; ++ return false; + + iir &= SC16IS7XX_IIR_ID_MASK; + +@@ -688,16 +688,23 @@ static void sc16is7xx_port_irq(struct sc16is7xx_port *s, int portno) + port->line, iir); + break; + } +- } while (1); ++ } while (0); ++ return true; + } + + static void sc16is7xx_ist(struct kthread_work *ws) + { + struct sc16is7xx_port *s = to_sc16is7xx_port(ws, irq_work); +- int i; + +- for (i = 0; i < s->devtype->nr_uart; ++i) +- sc16is7xx_port_irq(s, i); ++ while (1) { ++ bool keep_polling = false; ++ int i; ++ ++ for (i = 0; i < s->devtype->nr_uart; ++i) ++ keep_polling |= sc16is7xx_port_irq(s, i); ++ if (!keep_polling) ++ break; ++ } + } + + static irqreturn_t sc16is7xx_irq(int irq, void *dev_id) +diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c +index 3c55600a8236..671dc6a25e6c 100644 +--- a/drivers/tty/serial/sh-sci.c ++++ b/drivers/tty/serial/sh-sci.c +@@ -3045,6 +3045,7 @@ static struct uart_driver sci_uart_driver = { + static int sci_remove(struct platform_device *dev) + { + struct sci_port *port = platform_get_drvdata(dev); ++ unsigned int type = port->port.type; /* uart_remove_... clears it */ + + sci_ports_in_use &= ~BIT(port->port.line); + uart_remove_one_port(&sci_uart_driver, &port->port); +@@ -3055,8 +3056,7 @@ static int sci_remove(struct platform_device *dev) + sysfs_remove_file(&dev->dev.kobj, + &dev_attr_rx_fifo_trigger.attr); + } +- if (port->port.type == PORT_SCIFA || port->port.type == PORT_SCIFB || +- port->port.type == PORT_HSCIF) { ++ if (type == PORT_SCIFA || type == PORT_SCIFB || type == PORT_HSCIF) { + sysfs_remove_file(&dev->dev.kobj, + &dev_attr_rx_fifo_timeout.attr); + } +diff --git a/drivers/tty/tty_baudrate.c b/drivers/tty/tty_baudrate.c +index 3e827a3d48d5..b7dc2196f9d7 100644 +--- a/drivers/tty/tty_baudrate.c ++++ b/drivers/tty/tty_baudrate.c +@@ -77,7 +77,7 @@ speed_t tty_termios_baud_rate(struct ktermios *termios) + else + cbaud += 15; + } +- return baud_table[cbaud]; ++ return cbaud >= n_baud_table ? 0 : baud_table[cbaud]; + } + EXPORT_SYMBOL(tty_termios_baud_rate); + +@@ -113,7 +113,7 @@ speed_t tty_termios_input_baud_rate(struct ktermios *termios) + else + cbaud += 15; + } +- return baud_table[cbaud]; ++ return cbaud >= n_baud_table ? 0 : baud_table[cbaud]; + #else + return tty_termios_baud_rate(termios); + #endif +diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c +index 31d06f59c4e4..da45120d9453 100644 +--- a/drivers/tty/tty_io.c ++++ b/drivers/tty/tty_io.c +@@ -408,7 +408,7 @@ struct tty_driver *tty_find_polling_driver(char *name, int *line) + mutex_lock(&tty_mutex); + /* Search through the tty devices to look for a match */ + list_for_each_entry(p, &tty_drivers, tty_drivers) { +- if (strncmp(name, p->name, len) != 0) ++ if (!len || strncmp(name, p->name, len) != 0) + continue; + stp = str; + if (*stp == ',') +diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c +index 17fcd3b2e686..fe7914dffd8f 100644 +--- a/drivers/vhost/scsi.c ++++ b/drivers/vhost/scsi.c +@@ -964,7 +964,8 @@ vhost_scsi_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq) + prot_bytes = vhost32_to_cpu(vq, v_req_pi.pi_bytesin); + } + /* +- * Set prot_iter to data_iter, and advance past any ++ * Set prot_iter to data_iter and truncate it to ++ * prot_bytes, and advance data_iter past any + * preceeding prot_bytes that may be present. + * + * Also fix up the exp_data_len to reflect only the +@@ -973,6 +974,7 @@ vhost_scsi_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq) + if (prot_bytes) { + exp_data_len -= prot_bytes; + prot_iter = data_iter; ++ iov_iter_truncate(&prot_iter, prot_bytes); + iov_iter_advance(&data_iter, prot_bytes); + } + tag = vhost64_to_cpu(vq, v_req_pi.tag); +diff --git a/drivers/video/fbdev/aty/mach64_accel.c b/drivers/video/fbdev/aty/mach64_accel.c +index 2541a0e0de76..3ad46255f990 100644 +--- a/drivers/video/fbdev/aty/mach64_accel.c ++++ b/drivers/video/fbdev/aty/mach64_accel.c +@@ -127,7 +127,7 @@ void aty_init_engine(struct atyfb_par *par, struct fb_info *info) + + /* set host attributes */ + wait_for_fifo(13, par); +- aty_st_le32(HOST_CNTL, 0, par); ++ aty_st_le32(HOST_CNTL, HOST_BYTE_ALIGN, par); + + /* set pattern attributes */ + aty_st_le32(PAT_REG0, 0, par); +@@ -233,7 +233,8 @@ void atyfb_copyarea(struct fb_info *info, const struct fb_copyarea *area) + rotation = rotation24bpp(dx, direction); + } + +- wait_for_fifo(4, par); ++ wait_for_fifo(5, par); ++ aty_st_le32(DP_PIX_WIDTH, par->crtc.dp_pix_width, par); + aty_st_le32(DP_SRC, FRGD_SRC_BLIT, par); + aty_st_le32(SRC_Y_X, (sx << 16) | sy, par); + aty_st_le32(SRC_HEIGHT1_WIDTH1, (width << 16) | area->height, par); +@@ -269,7 +270,8 @@ void atyfb_fillrect(struct fb_info *info, const struct fb_fillrect *rect) + rotation = rotation24bpp(dx, DST_X_LEFT_TO_RIGHT); + } + +- wait_for_fifo(3, par); ++ wait_for_fifo(4, par); ++ aty_st_le32(DP_PIX_WIDTH, par->crtc.dp_pix_width, par); + aty_st_le32(DP_FRGD_CLR, color, par); + aty_st_le32(DP_SRC, + BKGD_SRC_BKGD_CLR | FRGD_SRC_FRGD_CLR | MONO_SRC_ONE, +@@ -284,7 +286,7 @@ void atyfb_imageblit(struct fb_info *info, const struct fb_image *image) + { + struct atyfb_par *par = (struct atyfb_par *) info->par; + u32 src_bytes, dx = image->dx, dy = image->dy, width = image->width; +- u32 pix_width_save, pix_width, host_cntl, rotation = 0, src, mix; ++ u32 pix_width, rotation = 0, src, mix; + + if (par->asleep) + return; +@@ -296,8 +298,7 @@ void atyfb_imageblit(struct fb_info *info, const struct fb_image *image) + return; + } + +- pix_width = pix_width_save = aty_ld_le32(DP_PIX_WIDTH, par); +- host_cntl = aty_ld_le32(HOST_CNTL, par) | HOST_BYTE_ALIGN; ++ pix_width = par->crtc.dp_pix_width; + + switch (image->depth) { + case 1: +@@ -345,7 +346,7 @@ void atyfb_imageblit(struct fb_info *info, const struct fb_image *image) + * since Rage 3D IIc we have DP_HOST_TRIPLE_EN bit + * this hwaccelerated triple has an issue with not aligned data + */ +- if (M64_HAS(HW_TRIPLE) && image->width % 8 == 0) ++ if (image->depth == 1 && M64_HAS(HW_TRIPLE) && image->width % 8 == 0) + pix_width |= DP_HOST_TRIPLE_EN; + } + +@@ -370,19 +371,18 @@ void atyfb_imageblit(struct fb_info *info, const struct fb_image *image) + mix = FRGD_MIX_D_XOR_S | BKGD_MIX_D; + } + +- wait_for_fifo(6, par); +- aty_st_le32(DP_WRITE_MASK, 0xFFFFFFFF, par); ++ wait_for_fifo(5, par); + aty_st_le32(DP_PIX_WIDTH, pix_width, par); + aty_st_le32(DP_MIX, mix, par); + aty_st_le32(DP_SRC, src, par); +- aty_st_le32(HOST_CNTL, host_cntl, par); ++ aty_st_le32(HOST_CNTL, HOST_BYTE_ALIGN, par); + aty_st_le32(DST_CNTL, DST_Y_TOP_TO_BOTTOM | DST_X_LEFT_TO_RIGHT | rotation, par); + + draw_rect(dx, dy, width, image->height, par); + src_bytes = (((image->width * image->depth) + 7) / 8) * image->height; + + /* manual triple each pixel */ +- if (info->var.bits_per_pixel == 24 && !(pix_width & DP_HOST_TRIPLE_EN)) { ++ if (image->depth == 1 && info->var.bits_per_pixel == 24 && !(pix_width & DP_HOST_TRIPLE_EN)) { + int inbit, outbit, mult24, byte_id_in_dword, width; + u8 *pbitmapin = (u8*)image->data, *pbitmapout; + u32 hostdword; +@@ -415,7 +415,7 @@ void atyfb_imageblit(struct fb_info *info, const struct fb_image *image) + } + } + wait_for_fifo(1, par); +- aty_st_le32(HOST_DATA0, hostdword, par); ++ aty_st_le32(HOST_DATA0, le32_to_cpu(hostdword), par); + } + } else { + u32 *pbitmap, dwords = (src_bytes + 3) / 4; +@@ -424,8 +424,4 @@ void atyfb_imageblit(struct fb_info *info, const struct fb_image *image) + aty_st_le32(HOST_DATA0, get_unaligned_le32(pbitmap), par); + } + } +- +- /* restore pix_width */ +- wait_for_fifo(1, par); +- aty_st_le32(DP_PIX_WIDTH, pix_width_save, par); + } +diff --git a/fs/9p/vfs_file.c b/fs/9p/vfs_file.c +index 03c9e325bfbc..3a2f37ad1f89 100644 +--- a/fs/9p/vfs_file.c ++++ b/fs/9p/vfs_file.c +@@ -204,6 +204,14 @@ static int v9fs_file_do_lock(struct file *filp, int cmd, struct file_lock *fl) + break; + if (schedule_timeout_interruptible(P9_LOCK_TIMEOUT) != 0) + break; ++ /* ++ * p9_client_lock_dotl overwrites flock.client_id with the ++ * server message, free and reuse the client name ++ */ ++ if (flock.client_id != fid->clnt->name) { ++ kfree(flock.client_id); ++ flock.client_id = fid->clnt->name; ++ } + } + + /* map 9p status to VFS status */ +@@ -235,6 +243,8 @@ out_unlock: + locks_lock_file_wait(filp, fl); + fl->fl_type = fl_type; + } ++ if (flock.client_id != fid->clnt->name) ++ kfree(flock.client_id); + out: + return res; + } +@@ -269,7 +279,7 @@ static int v9fs_file_getlock(struct file *filp, struct file_lock *fl) + + res = p9_client_getlock_dotl(fid, &glock); + if (res < 0) +- return res; ++ goto out; + /* map 9p lock type to os lock type */ + switch (glock.type) { + case P9_LOCK_TYPE_RDLCK: +@@ -290,7 +300,9 @@ static int v9fs_file_getlock(struct file *filp, struct file_lock *fl) + fl->fl_end = glock.start + glock.length - 1; + fl->fl_pid = -glock.proc_id; + } +- kfree(glock.client_id); ++out: ++ if (glock.client_id != fid->clnt->name) ++ kfree(glock.client_id); + return res; + } + +diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c +index 891b1aab3480..2012eaf80da5 100644 +--- a/fs/btrfs/disk-io.c ++++ b/fs/btrfs/disk-io.c +@@ -4404,13 +4404,23 @@ static int btrfs_destroy_pinned_extent(struct btrfs_fs_info *fs_info, + unpin = pinned_extents; + again: + while (1) { ++ /* ++ * The btrfs_finish_extent_commit() may get the same range as ++ * ours between find_first_extent_bit and clear_extent_dirty. ++ * Hence, hold the unused_bg_unpin_mutex to avoid double unpin ++ * the same extent range. ++ */ ++ mutex_lock(&fs_info->unused_bg_unpin_mutex); + ret = find_first_extent_bit(unpin, 0, &start, &end, + EXTENT_DIRTY, NULL); +- if (ret) ++ if (ret) { ++ mutex_unlock(&fs_info->unused_bg_unpin_mutex); + break; ++ } + + clear_extent_dirty(unpin, start, end); + btrfs_error_unpin_extent_range(fs_info, start, end); ++ mutex_unlock(&fs_info->unused_bg_unpin_mutex); + cond_resched(); + } + +diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c +index dc0f9d089b19..3e6c1baddda3 100644 +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -1537,12 +1537,11 @@ out_check: + } + btrfs_release_path(path); + +- if (cur_offset <= end && cow_start == (u64)-1) { ++ if (cur_offset <= end && cow_start == (u64)-1) + cow_start = cur_offset; +- cur_offset = end; +- } + + if (cow_start != (u64)-1) { ++ cur_offset = end; + ret = cow_file_range(inode, locked_page, cow_start, end, end, + page_started, nr_written, 1, NULL); + if (ret) +diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c +index c972920701a3..ec021bd947ba 100644 +--- a/fs/btrfs/ioctl.c ++++ b/fs/btrfs/ioctl.c +@@ -3499,6 +3499,8 @@ static int btrfs_extent_same_range(struct inode *src, u64 loff, u64 olen, + const u64 sz = BTRFS_I(src)->root->fs_info->sectorsize; + + len = round_down(i_size_read(src), sz) - loff; ++ if (len == 0) ++ return 0; + olen = len; + } + } +@@ -4291,9 +4293,17 @@ static noinline int btrfs_clone_files(struct file *file, struct file *file_src, + goto out_unlock; + if (len == 0) + olen = len = src->i_size - off; +- /* if we extend to eof, continue to block boundary */ +- if (off + len == src->i_size) ++ /* ++ * If we extend to eof, continue to block boundary if and only if the ++ * destination end offset matches the destination file's size, otherwise ++ * we would be corrupting data by placing the eof block into the middle ++ * of a file. ++ */ ++ if (off + len == src->i_size) { ++ if (!IS_ALIGNED(len, bs) && destoff + len < inode->i_size) ++ goto out_unlock; + len = ALIGN(src->i_size, bs) - off; ++ } + + if (len == 0) { + ret = 0; +diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c +index a866be999216..4b1eda26480b 100644 +--- a/fs/ceph/inode.c ++++ b/fs/ceph/inode.c +@@ -1135,8 +1135,12 @@ static struct dentry *splice_dentry(struct dentry *dn, struct inode *in) + if (IS_ERR(realdn)) { + pr_err("splice_dentry error %ld %p inode %p ino %llx.%llx\n", + PTR_ERR(realdn), dn, in, ceph_vinop(in)); +- dput(dn); +- dn = realdn; /* note realdn contains the error */ ++ dn = realdn; ++ /* ++ * Caller should release 'dn' in the case of error. ++ * If 'req->r_dentry' is passed to this function, ++ * caller should leave 'req->r_dentry' untouched. ++ */ + goto out; + } else if (realdn) { + dout("dn %p (%d) spliced with %p (%d) " +diff --git a/fs/configfs/symlink.c b/fs/configfs/symlink.c +index 78ffc2699993..a5c54af861f7 100644 +--- a/fs/configfs/symlink.c ++++ b/fs/configfs/symlink.c +@@ -64,7 +64,7 @@ static void fill_item_path(struct config_item * item, char * buffer, int length) + + /* back up enough to print this bus id with '/' */ + length -= cur; +- strncpy(buffer + length,config_item_name(p),cur); ++ memcpy(buffer + length, config_item_name(p), cur); + *(buffer + --length) = '/'; + } + } +diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c +index 2276137d0083..fc05c7f7bbcf 100644 +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -5763,9 +5763,10 @@ int ext4_mark_iloc_dirty(handle_t *handle, + { + int err = 0; + +- if (unlikely(ext4_forced_shutdown(EXT4_SB(inode->i_sb)))) ++ if (unlikely(ext4_forced_shutdown(EXT4_SB(inode->i_sb)))) { ++ put_bh(iloc->bh); + return -EIO; +- ++ } + if (IS_I_VERSION(inode)) + inode_inc_iversion(inode); + +diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c +index 377d516c475f..ffa25753e929 100644 +--- a/fs/ext4/namei.c ++++ b/fs/ext4/namei.c +@@ -126,6 +126,7 @@ static struct buffer_head *__ext4_read_dirblock(struct inode *inode, + if (!is_dx_block && type == INDEX) { + ext4_error_inode(inode, func, line, block, + "directory leaf block found instead of index block"); ++ brelse(bh); + return ERR_PTR(-EFSCORRUPTED); + } + if (!ext4_has_metadata_csum(inode->i_sb) || +@@ -2811,7 +2812,9 @@ int ext4_orphan_add(handle_t *handle, struct inode *inode) + list_del_init(&EXT4_I(inode)->i_orphan); + mutex_unlock(&sbi->s_orphan_lock); + } +- } ++ } else ++ brelse(iloc.bh); ++ + jbd_debug(4, "superblock will point to %lu\n", inode->i_ino); + jbd_debug(4, "orphan inode %lu will point to %d\n", + inode->i_ino, NEXT_ORPHAN(inode)); +diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c +index ebbc663d0798..a5efee34415f 100644 +--- a/fs/ext4/resize.c ++++ b/fs/ext4/resize.c +@@ -459,16 +459,18 @@ static int set_flexbg_block_bitmap(struct super_block *sb, handle_t *handle, + + BUFFER_TRACE(bh, "get_write_access"); + err = ext4_journal_get_write_access(handle, bh); +- if (err) ++ if (err) { ++ brelse(bh); + return err; ++ } + ext4_debug("mark block bitmap %#04llx (+%llu/%u)\n", + first_cluster, first_cluster - start, count2); + ext4_set_bits(bh->b_data, first_cluster - start, count2); + + err = ext4_handle_dirty_metadata(handle, NULL, bh); ++ brelse(bh); + if (unlikely(err)) + return err; +- brelse(bh); + } + + return 0; +@@ -605,7 +607,6 @@ handle_bb: + bh = bclean(handle, sb, block); + if (IS_ERR(bh)) { + err = PTR_ERR(bh); +- bh = NULL; + goto out; + } + overhead = ext4_group_overhead_blocks(sb, group); +@@ -618,9 +619,9 @@ handle_bb: + ext4_mark_bitmap_end(EXT4_B2C(sbi, group_data[i].blocks_count), + sb->s_blocksize * 8, bh->b_data); + err = ext4_handle_dirty_metadata(handle, NULL, bh); ++ brelse(bh); + if (err) + goto out; +- brelse(bh); + + handle_ib: + if (bg_flags[i] & EXT4_BG_INODE_UNINIT) +@@ -635,18 +636,16 @@ handle_ib: + bh = bclean(handle, sb, block); + if (IS_ERR(bh)) { + err = PTR_ERR(bh); +- bh = NULL; + goto out; + } + + ext4_mark_bitmap_end(EXT4_INODES_PER_GROUP(sb), + sb->s_blocksize * 8, bh->b_data); + err = ext4_handle_dirty_metadata(handle, NULL, bh); ++ brelse(bh); + if (err) + goto out; +- brelse(bh); + } +- bh = NULL; + + /* Mark group tables in block bitmap */ + for (j = 0; j < GROUP_TABLE_COUNT; j++) { +@@ -685,7 +684,6 @@ handle_ib: + } + + out: +- brelse(bh); + err2 = ext4_journal_stop(handle); + if (err2 && !err) + err = err2; +@@ -873,6 +871,7 @@ static int add_new_gdb(handle_t *handle, struct inode *inode, + err = ext4_handle_dirty_metadata(handle, NULL, gdb_bh); + if (unlikely(err)) { + ext4_std_error(sb, err); ++ iloc.bh = NULL; + goto exit_inode; + } + brelse(dind); +@@ -924,6 +923,7 @@ static int add_new_gdb_meta_bg(struct super_block *sb, + sizeof(struct buffer_head *), + GFP_NOFS); + if (!n_group_desc) { ++ brelse(gdb_bh); + err = -ENOMEM; + ext4_warning(sb, "not enough memory for %lu groups", + gdb_num + 1); +@@ -939,8 +939,6 @@ static int add_new_gdb_meta_bg(struct super_block *sb, + kvfree(o_group_desc); + BUFFER_TRACE(gdb_bh, "get_write_access"); + err = ext4_journal_get_write_access(handle, gdb_bh); +- if (unlikely(err)) +- brelse(gdb_bh); + return err; + } + +@@ -1124,8 +1122,10 @@ static void update_backups(struct super_block *sb, sector_t blk_off, char *data, + backup_block, backup_block - + ext4_group_first_block_no(sb, group)); + BUFFER_TRACE(bh, "get_write_access"); +- if ((err = ext4_journal_get_write_access(handle, bh))) ++ if ((err = ext4_journal_get_write_access(handle, bh))) { ++ brelse(bh); + break; ++ } + lock_buffer(bh); + memcpy(bh->b_data, data, size); + if (rest) +@@ -2023,7 +2023,7 @@ retry: + + err = ext4_alloc_flex_bg_array(sb, n_group + 1); + if (err) +- return err; ++ goto out; + + err = ext4_mb_alloc_groupinfo(sb, n_group + 1); + if (err) +@@ -2059,6 +2059,10 @@ retry: + n_blocks_count_retry = 0; + free_flex_gd(flex_gd); + flex_gd = NULL; ++ if (resize_inode) { ++ iput(resize_inode); ++ resize_inode = NULL; ++ } + goto retry; + } + +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index 8d91d50ccf42..8b8c351fa9c5 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -4053,6 +4053,14 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) + sbi->s_groups_count = blocks_count; + sbi->s_blockfile_groups = min_t(ext4_group_t, sbi->s_groups_count, + (EXT4_MAX_BLOCK_FILE_PHYS / EXT4_BLOCKS_PER_GROUP(sb))); ++ if (((u64)sbi->s_groups_count * sbi->s_inodes_per_group) != ++ le32_to_cpu(es->s_inodes_count)) { ++ ext4_msg(sb, KERN_ERR, "inodes count not valid: %u vs %llu", ++ le32_to_cpu(es->s_inodes_count), ++ ((u64)sbi->s_groups_count * sbi->s_inodes_per_group)); ++ ret = -EINVAL; ++ goto failed_mount; ++ } + db_count = (sbi->s_groups_count + EXT4_DESC_PER_BLOCK(sb) - 1) / + EXT4_DESC_PER_BLOCK(sb); + if (ext4_has_feature_meta_bg(sb)) { +@@ -4072,14 +4080,6 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) + ret = -ENOMEM; + goto failed_mount; + } +- if (((u64)sbi->s_groups_count * sbi->s_inodes_per_group) != +- le32_to_cpu(es->s_inodes_count)) { +- ext4_msg(sb, KERN_ERR, "inodes count not valid: %u vs %llu", +- le32_to_cpu(es->s_inodes_count), +- ((u64)sbi->s_groups_count * sbi->s_inodes_per_group)); +- ret = -EINVAL; +- goto failed_mount; +- } + + bgl_lock_init(sbi->s_blockgroup_lock); + +@@ -4488,6 +4488,7 @@ failed_mount6: + percpu_counter_destroy(&sbi->s_freeinodes_counter); + percpu_counter_destroy(&sbi->s_dirs_counter); + percpu_counter_destroy(&sbi->s_dirtyclusters_counter); ++ percpu_free_rwsem(&sbi->s_journal_flag_rwsem); + failed_mount5: + ext4_ext_release(sb); + ext4_release_system_zone(sb); +diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c +index f36fc5d5b257..4380c8630539 100644 +--- a/fs/ext4/xattr.c ++++ b/fs/ext4/xattr.c +@@ -1388,6 +1388,12 @@ retry: + bh = ext4_getblk(handle, ea_inode, block, 0); + if (IS_ERR(bh)) + return PTR_ERR(bh); ++ if (!bh) { ++ WARN_ON_ONCE(1); ++ EXT4_ERROR_INODE(ea_inode, ++ "ext4_getblk() return bh = NULL"); ++ return -EFSCORRUPTED; ++ } + ret = ext4_journal_get_write_access(handle, bh); + if (ret) + goto out; +@@ -2276,8 +2282,10 @@ static struct buffer_head *ext4_xattr_get_block(struct inode *inode) + if (!bh) + return ERR_PTR(-EIO); + error = ext4_xattr_check_block(inode, bh); +- if (error) ++ if (error) { ++ brelse(bh); + return ERR_PTR(error); ++ } + return bh; + } + +@@ -2397,6 +2405,8 @@ retry_inode: + error = ext4_xattr_block_set(handle, inode, &i, &bs); + } else if (error == -ENOSPC) { + if (EXT4_I(inode)->i_file_acl && !bs.s.base) { ++ brelse(bs.bh); ++ bs.bh = NULL; + error = ext4_xattr_block_find(inode, &i, &bs); + if (error) + goto cleanup; +@@ -2617,6 +2627,8 @@ out: + kfree(buffer); + if (is) + brelse(is->iloc.bh); ++ if (bs) ++ brelse(bs->bh); + kfree(is); + kfree(bs); + +@@ -2696,7 +2708,6 @@ int ext4_expand_extra_isize_ea(struct inode *inode, int new_extra_isize, + struct ext4_inode *raw_inode, handle_t *handle) + { + struct ext4_xattr_ibody_header *header; +- struct buffer_head *bh; + struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb); + static unsigned int mnt_count; + size_t min_offs; +@@ -2737,13 +2748,17 @@ retry: + * EA block can hold new_extra_isize bytes. + */ + if (EXT4_I(inode)->i_file_acl) { ++ struct buffer_head *bh; ++ + bh = sb_bread(inode->i_sb, EXT4_I(inode)->i_file_acl); + error = -EIO; + if (!bh) + goto cleanup; + error = ext4_xattr_check_block(inode, bh); +- if (error) ++ if (error) { ++ brelse(bh); + goto cleanup; ++ } + base = BHDR(bh); + end = bh->b_data + bh->b_size; + min_offs = end - base; +diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c +index 4a9ace7280b9..97f15787cfeb 100644 +--- a/fs/fuse/dev.c ++++ b/fs/fuse/dev.c +@@ -391,12 +391,19 @@ static void request_end(struct fuse_conn *fc, struct fuse_req *req) + if (test_bit(FR_BACKGROUND, &req->flags)) { + spin_lock(&fc->lock); + clear_bit(FR_BACKGROUND, &req->flags); +- if (fc->num_background == fc->max_background) ++ if (fc->num_background == fc->max_background) { + fc->blocked = 0; +- +- /* Wake up next waiter, if any */ +- if (!fc->blocked && waitqueue_active(&fc->blocked_waitq)) + wake_up(&fc->blocked_waitq); ++ } else if (!fc->blocked) { ++ /* ++ * Wake up next waiter, if any. It's okay to use ++ * waitqueue_active(), as we've already synced up ++ * fc->blocked with waiters with the wake_up() call ++ * above. ++ */ ++ if (waitqueue_active(&fc->blocked_waitq)) ++ wake_up(&fc->blocked_waitq); ++ } + + if (fc->num_background == fc->congestion_threshold && fc->sb) { + clear_bdi_congested(fc->sb->s_bdi, BLK_RW_SYNC); +@@ -1311,12 +1318,14 @@ static ssize_t fuse_dev_do_read(struct fuse_dev *fud, struct file *file, + goto out_end; + } + list_move_tail(&req->list, &fpq->processing); +- spin_unlock(&fpq->lock); ++ __fuse_get_request(req); + set_bit(FR_SENT, &req->flags); ++ spin_unlock(&fpq->lock); + /* matches barrier in request_wait_answer() */ + smp_mb__after_atomic(); + if (test_bit(FR_INTERRUPTED, &req->flags)) + queue_interrupt(fiq, req); ++ fuse_put_request(fc, req); + + return reqsize; + +@@ -1715,8 +1724,10 @@ static int fuse_retrieve(struct fuse_conn *fc, struct inode *inode, + req->in.args[1].size = total_len; + + err = fuse_request_send_notify_reply(fc, req, outarg->notify_unique); +- if (err) ++ if (err) { + fuse_retrieve_end(fc, req); ++ fuse_put_request(fc, req); ++ } + + return err; + } +@@ -1875,16 +1886,20 @@ static ssize_t fuse_dev_do_write(struct fuse_dev *fud, + + /* Is it an interrupt reply? */ + if (req->intr_unique == oh.unique) { ++ __fuse_get_request(req); + spin_unlock(&fpq->lock); + + err = -EINVAL; +- if (nbytes != sizeof(struct fuse_out_header)) ++ if (nbytes != sizeof(struct fuse_out_header)) { ++ fuse_put_request(fc, req); + goto err_finish; ++ } + + if (oh.error == -ENOSYS) + fc->no_interrupt = 1; + else if (oh.error == -EAGAIN) + queue_interrupt(&fc->iq, req); ++ fuse_put_request(fc, req); + + fuse_copy_finish(cs); + return nbytes; +diff --git a/fs/fuse/file.c b/fs/fuse/file.c +index aa23749a943b..2162771ce7d5 100644 +--- a/fs/fuse/file.c ++++ b/fs/fuse/file.c +@@ -2912,10 +2912,12 @@ fuse_direct_IO(struct kiocb *iocb, struct iov_iter *iter) + } + + if (io->async) { ++ bool blocking = io->blocking; ++ + fuse_aio_complete(io, ret < 0 ? ret : 0, -1); + + /* we have a non-extending, async request, so return */ +- if (!io->blocking) ++ if (!blocking) + return -EIOCBQUEUED; + + wait_for_completion(&wait); +diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c +index fd5bea55fd60..9c418249734d 100644 +--- a/fs/gfs2/bmap.c ++++ b/fs/gfs2/bmap.c +@@ -1652,10 +1652,16 @@ static int punch_hole(struct gfs2_inode *ip, u64 offset, u64 length) + if (ret < 0) + goto out; + +- /* issue read-ahead on metadata */ +- if (mp.mp_aheight > 1) { +- for (; ret > 1; ret--) { +- metapointer_range(&mp, mp.mp_aheight - ret, ++ /* On the first pass, issue read-ahead on metadata. */ ++ if (mp.mp_aheight > 1 && strip_h == ip->i_height - 1) { ++ unsigned int height = mp.mp_aheight - 1; ++ ++ /* No read-ahead for data blocks. */ ++ if (mp.mp_aheight - 1 == strip_h) ++ height--; ++ ++ for (; height >= mp.mp_aheight - ret; height--) { ++ metapointer_range(&mp, height, + start_list, start_aligned, + end_list, end_aligned, + &start, &end); +diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c +index b86249ebde11..1d62526738c4 100644 +--- a/fs/gfs2/rgrp.c ++++ b/fs/gfs2/rgrp.c +@@ -714,6 +714,7 @@ void gfs2_clear_rgrpd(struct gfs2_sbd *sdp) + + if (gl) { + glock_clear_object(gl, rgd); ++ gfs2_rgrp_brelse(rgd); + gfs2_glock_put(gl); + } + +@@ -1136,7 +1137,7 @@ static u32 count_unlinked(struct gfs2_rgrpd *rgd) + * @rgd: the struct gfs2_rgrpd describing the RG to read in + * + * Read in all of a Resource Group's header and bitmap blocks. +- * Caller must eventually call gfs2_rgrp_relse() to free the bitmaps. ++ * Caller must eventually call gfs2_rgrp_brelse() to free the bitmaps. + * + * Returns: errno + */ +diff --git a/fs/namespace.c b/fs/namespace.c +index bd2f4c68506a..e65254003cad 100644 +--- a/fs/namespace.c ++++ b/fs/namespace.c +@@ -780,9 +780,6 @@ static struct mountpoint *lookup_mountpoint(struct dentry *dentry) + + hlist_for_each_entry(mp, chain, m_hash) { + if (mp->m_dentry == dentry) { +- /* might be worth a WARN_ON() */ +- if (d_unlinked(dentry)) +- return ERR_PTR(-ENOENT); + mp->m_count++; + return mp; + } +@@ -796,6 +793,9 @@ static struct mountpoint *get_mountpoint(struct dentry *dentry) + int ret; + + if (d_mountpoint(dentry)) { ++ /* might be worth a WARN_ON() */ ++ if (d_unlinked(dentry)) ++ return ERR_PTR(-ENOENT); + mountpoint: + read_seqlock_excl(&mount_lock); + mp = lookup_mountpoint(dentry); +@@ -1625,8 +1625,13 @@ static int do_umount(struct mount *mnt, int flags) + + namespace_lock(); + lock_mount_hash(); +- event++; + ++ /* Recheck MNT_LOCKED with the locks held */ ++ retval = -EINVAL; ++ if (mnt->mnt.mnt_flags & MNT_LOCKED) ++ goto out; ++ ++ event++; + if (flags & MNT_DETACH) { + if (!list_empty(&mnt->mnt_list)) + umount_tree(mnt, UMOUNT_PROPAGATE); +@@ -1640,6 +1645,7 @@ static int do_umount(struct mount *mnt, int flags) + retval = 0; + } + } ++out: + unlock_mount_hash(); + namespace_unlock(); + return retval; +@@ -1730,7 +1736,7 @@ int ksys_umount(char __user *name, int flags) + goto dput_and_out; + if (!check_mnt(mnt)) + goto dput_and_out; +- if (mnt->mnt.mnt_flags & MNT_LOCKED) ++ if (mnt->mnt.mnt_flags & MNT_LOCKED) /* Check optimistically */ + goto dput_and_out; + retval = -EPERM; + if (flags & MNT_FORCE && !capable(CAP_SYS_ADMIN)) +@@ -1813,8 +1819,14 @@ struct mount *copy_tree(struct mount *mnt, struct dentry *dentry, + for (s = r; s; s = next_mnt(s, r)) { + if (!(flag & CL_COPY_UNBINDABLE) && + IS_MNT_UNBINDABLE(s)) { +- s = skip_mnt_tree(s); +- continue; ++ if (s->mnt.mnt_flags & MNT_LOCKED) { ++ /* Both unbindable and locked. */ ++ q = ERR_PTR(-EPERM); ++ goto out; ++ } else { ++ s = skip_mnt_tree(s); ++ continue; ++ } + } + if (!(flag & CL_COPY_MNT_NS_FILE) && + is_mnt_ns_file(s->mnt.mnt_root)) { +@@ -1867,7 +1879,7 @@ void drop_collected_mounts(struct vfsmount *mnt) + { + namespace_lock(); + lock_mount_hash(); +- umount_tree(real_mount(mnt), UMOUNT_SYNC); ++ umount_tree(real_mount(mnt), 0); + unlock_mount_hash(); + namespace_unlock(); + } +diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c +index 3c18c12a5c4c..b8615a4f5316 100644 +--- a/fs/nfs/nfs4state.c ++++ b/fs/nfs/nfs4state.c +@@ -2553,11 +2553,12 @@ static void nfs4_state_manager(struct nfs_client *clp) + nfs4_clear_state_manager_bit(clp); + /* Did we race with an attempt to give us more work? */ + if (clp->cl_state == 0) +- break; ++ return; + if (test_and_set_bit(NFS4CLNT_MANAGER_RUNNING, &clp->cl_state) != 0) +- break; ++ return; + } while (refcount_read(&clp->cl_count) > 1); +- return; ++ goto out_drain; ++ + out_error: + if (strlen(section)) + section_sep = ": "; +@@ -2565,6 +2566,7 @@ out_error: + " with error %d\n", section_sep, section, + clp->cl_hostname, -status); + ssleep(1); ++out_drain: + nfs4_end_drain_session(clp); + nfs4_clear_state_manager_bit(clp); + } +diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c +index 0dded931f119..7c78d10a58a0 100644 +--- a/fs/nfsd/nfs4proc.c ++++ b/fs/nfsd/nfs4proc.c +@@ -1048,6 +1048,9 @@ nfsd4_verify_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, + { + __be32 status; + ++ if (!cstate->save_fh.fh_dentry) ++ return nfserr_nofilehandle; ++ + status = nfs4_preprocess_stateid_op(rqstp, cstate, &cstate->save_fh, + src_stateid, RD_STATE, src, NULL); + if (status) { +diff --git a/fs/ocfs2/aops.c b/fs/ocfs2/aops.c +index 302cd7caa4a7..7578bd507c70 100644 +--- a/fs/ocfs2/aops.c ++++ b/fs/ocfs2/aops.c +@@ -2412,8 +2412,16 @@ static int ocfs2_dio_end_io(struct kiocb *iocb, + /* this io's submitter should not have unlocked this before we could */ + BUG_ON(!ocfs2_iocb_is_rw_locked(iocb)); + +- if (bytes > 0 && private) +- ret = ocfs2_dio_end_io_write(inode, private, offset, bytes); ++ if (bytes <= 0) ++ mlog_ratelimited(ML_ERROR, "Direct IO failed, bytes = %lld", ++ (long long)bytes); ++ if (private) { ++ if (bytes > 0) ++ ret = ocfs2_dio_end_io_write(inode, private, offset, ++ bytes); ++ else ++ ocfs2_dio_free_write_ctx(inode, private); ++ } + + ocfs2_iocb_clear_rw_locked(iocb); + +diff --git a/fs/ocfs2/cluster/masklog.h b/fs/ocfs2/cluster/masklog.h +index 308ea0eb35fd..a396096a5099 100644 +--- a/fs/ocfs2/cluster/masklog.h ++++ b/fs/ocfs2/cluster/masklog.h +@@ -178,6 +178,15 @@ do { \ + ##__VA_ARGS__); \ + } while (0) + ++#define mlog_ratelimited(mask, fmt, ...) \ ++do { \ ++ static DEFINE_RATELIMIT_STATE(_rs, \ ++ DEFAULT_RATELIMIT_INTERVAL, \ ++ DEFAULT_RATELIMIT_BURST); \ ++ if (__ratelimit(&_rs)) \ ++ mlog(mask, fmt, ##__VA_ARGS__); \ ++} while (0) ++ + #define mlog_errno(st) ({ \ + int _st = (st); \ + if (_st != -ERESTARTSYS && _st != -EINTR && \ +diff --git a/fs/ocfs2/dir.c b/fs/ocfs2/dir.c +index b048d4fa3959..c121abbdfc7d 100644 +--- a/fs/ocfs2/dir.c ++++ b/fs/ocfs2/dir.c +@@ -1897,8 +1897,7 @@ static int ocfs2_dir_foreach_blk_el(struct inode *inode, + /* On error, skip the f_pos to the + next block. */ + ctx->pos = (ctx->pos | (sb->s_blocksize - 1)) + 1; +- brelse(bh); +- continue; ++ break; + } + if (le64_to_cpu(de->inode)) { + unsigned char d_type = DT_UNKNOWN; +diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c +index da9b3ccfde23..f1dffd70a1c0 100644 +--- a/fs/overlayfs/dir.c ++++ b/fs/overlayfs/dir.c +@@ -461,6 +461,10 @@ static int ovl_create_over_whiteout(struct dentry *dentry, struct inode *inode, + if (IS_ERR(upper)) + goto out_unlock; + ++ err = -ESTALE; ++ if (d_is_negative(upper) || !IS_WHITEOUT(d_inode(upper))) ++ goto out_dput; ++ + newdentry = ovl_create_temp(workdir, cattr); + err = PTR_ERR(newdentry); + if (IS_ERR(newdentry)) +@@ -661,6 +665,11 @@ static int ovl_link(struct dentry *old, struct inode *newdir, + if (err) + goto out_drop_write; + ++ err = ovl_copy_up(new->d_parent); ++ if (err) ++ goto out_drop_write; ++ ++ + err = ovl_nlink_start(old, &locked); + if (err) + goto out_drop_write; +diff --git a/fs/overlayfs/namei.c b/fs/overlayfs/namei.c +index c2229f02389b..1531f81037b9 100644 +--- a/fs/overlayfs/namei.c ++++ b/fs/overlayfs/namei.c +@@ -441,8 +441,10 @@ int ovl_verify_set_fh(struct dentry *dentry, const char *name, + + fh = ovl_encode_real_fh(real, is_upper); + err = PTR_ERR(fh); +- if (IS_ERR(fh)) ++ if (IS_ERR(fh)) { ++ fh = NULL; + goto fail; ++ } + + err = ovl_verify_fh(dentry, name, fh); + if (set && err == -ENODATA) +diff --git a/fs/udf/super.c b/fs/udf/super.c +index 74b13347cd94..e557d1317d0e 100644 +--- a/fs/udf/super.c ++++ b/fs/udf/super.c +@@ -613,14 +613,11 @@ static int udf_remount_fs(struct super_block *sb, int *flags, char *options) + struct udf_options uopt; + struct udf_sb_info *sbi = UDF_SB(sb); + int error = 0; +- struct logicalVolIntegrityDescImpUse *lvidiu = udf_sb_lvidiu(sb); ++ ++ if (!(*flags & SB_RDONLY) && UDF_QUERY_FLAG(sb, UDF_FLAG_RW_INCOMPAT)) ++ return -EACCES; + + sync_filesystem(sb); +- if (lvidiu) { +- int write_rev = le16_to_cpu(lvidiu->minUDFWriteRev); +- if (write_rev > UDF_MAX_WRITE_VERSION && !(*flags & SB_RDONLY)) +- return -EACCES; +- } + + uopt.flags = sbi->s_flags; + uopt.uid = sbi->s_uid; +@@ -1317,6 +1314,7 @@ static int udf_load_partdesc(struct super_block *sb, sector_t block) + ret = -EACCES; + goto out_bh; + } ++ UDF_SET_FLAG(sb, UDF_FLAG_RW_INCOMPAT); + ret = udf_load_vat(sb, i, type1_idx); + if (ret < 0) + goto out_bh; +@@ -2215,10 +2213,12 @@ static int udf_fill_super(struct super_block *sb, void *options, int silent) + UDF_MAX_READ_VERSION); + ret = -EINVAL; + goto error_out; +- } else if (minUDFWriteRev > UDF_MAX_WRITE_VERSION && +- !sb_rdonly(sb)) { +- ret = -EACCES; +- goto error_out; ++ } else if (minUDFWriteRev > UDF_MAX_WRITE_VERSION) { ++ if (!sb_rdonly(sb)) { ++ ret = -EACCES; ++ goto error_out; ++ } ++ UDF_SET_FLAG(sb, UDF_FLAG_RW_INCOMPAT); + } + + sbi->s_udfrev = minUDFWriteRev; +@@ -2236,10 +2236,12 @@ static int udf_fill_super(struct super_block *sb, void *options, int silent) + } + + if (sbi->s_partmaps[sbi->s_partition].s_partition_flags & +- UDF_PART_FLAG_READ_ONLY && +- !sb_rdonly(sb)) { +- ret = -EACCES; +- goto error_out; ++ UDF_PART_FLAG_READ_ONLY) { ++ if (!sb_rdonly(sb)) { ++ ret = -EACCES; ++ goto error_out; ++ } ++ UDF_SET_FLAG(sb, UDF_FLAG_RW_INCOMPAT); + } + + if (udf_find_fileset(sb, &fileset, &rootdir)) { +diff --git a/fs/udf/udf_sb.h b/fs/udf/udf_sb.h +index 9dd3e1b9619e..f8e0d200271d 100644 +--- a/fs/udf/udf_sb.h ++++ b/fs/udf/udf_sb.h +@@ -30,6 +30,8 @@ + #define UDF_FLAG_LASTBLOCK_SET 16 + #define UDF_FLAG_BLOCKSIZE_SET 17 + #define UDF_FLAG_INCONSISTENT 18 ++#define UDF_FLAG_RW_INCOMPAT 19 /* Set when we find RW incompatible ++ * feature */ + + #define UDF_PART_FLAG_UNALLOC_BITMAP 0x0001 + #define UDF_PART_FLAG_UNALLOC_TABLE 0x0002 +diff --git a/include/linux/ceph/libceph.h b/include/linux/ceph/libceph.h +index 49c93b9308d7..68bb09c29ce8 100644 +--- a/include/linux/ceph/libceph.h ++++ b/include/linux/ceph/libceph.h +@@ -81,7 +81,13 @@ struct ceph_options { + + #define CEPH_MSG_MAX_FRONT_LEN (16*1024*1024) + #define CEPH_MSG_MAX_MIDDLE_LEN (16*1024*1024) +-#define CEPH_MSG_MAX_DATA_LEN (16*1024*1024) ++ ++/* ++ * Handle the largest possible rbd object in one message. ++ * There is no limit on the size of cephfs objects, but it has to obey ++ * rsize and wsize mount options anyway. ++ */ ++#define CEPH_MSG_MAX_DATA_LEN (32*1024*1024) + + #define CEPH_AUTH_NAME_DEFAULT "guest" + +diff --git a/include/linux/i8253.h b/include/linux/i8253.h +index e6bb36a97519..8336b2f6f834 100644 +--- a/include/linux/i8253.h ++++ b/include/linux/i8253.h +@@ -21,6 +21,7 @@ + #define PIT_LATCH ((PIT_TICK_RATE + HZ/2) / HZ) + + extern raw_spinlock_t i8253_lock; ++extern bool i8253_clear_counter_on_shutdown; + extern struct clock_event_device i8253_clockevent; + extern void clockevent_i8253_init(bool oneshot); + +diff --git a/include/linux/mtd/nand.h b/include/linux/mtd/nand.h +index abe975c87b90..78b86dea2f29 100644 +--- a/include/linux/mtd/nand.h ++++ b/include/linux/mtd/nand.h +@@ -324,9 +324,8 @@ static inline unsigned int nanddev_ntargets(const struct nand_device *nand) + */ + static inline unsigned int nanddev_neraseblocks(const struct nand_device *nand) + { +- return (u64)nand->memorg.luns_per_target * +- nand->memorg.eraseblocks_per_lun * +- nand->memorg.pages_per_eraseblock; ++ return nand->memorg.ntargets * nand->memorg.luns_per_target * ++ nand->memorg.eraseblocks_per_lun; + } + + /** +diff --git a/include/linux/nmi.h b/include/linux/nmi.h +index b8d868d23e79..50d143995338 100644 +--- a/include/linux/nmi.h ++++ b/include/linux/nmi.h +@@ -113,6 +113,8 @@ static inline int hardlockup_detector_perf_init(void) { return 0; } + void watchdog_nmi_stop(void); + void watchdog_nmi_start(void); + int watchdog_nmi_probe(void); ++int watchdog_nmi_enable(unsigned int cpu); ++void watchdog_nmi_disable(unsigned int cpu); + + /** + * touch_nmi_watchdog - restart NMI watchdog timeout. +diff --git a/include/xen/xen-ops.h b/include/xen/xen-ops.h +index fd18c974a619..f6e798d42069 100644 +--- a/include/xen/xen-ops.h ++++ b/include/xen/xen-ops.h +@@ -41,7 +41,7 @@ int xen_setup_shutdown_event(void); + + extern unsigned long *xen_contiguous_bitmap; + +-#ifdef CONFIG_XEN_PV ++#if defined(CONFIG_XEN_PV) || defined(CONFIG_ARM) || defined(CONFIG_ARM64) + int xen_create_contiguous_region(phys_addr_t pstart, unsigned int order, + unsigned int address_bits, + dma_addr_t *dma_handle); +diff --git a/kernel/debug/kdb/kdb_bt.c b/kernel/debug/kdb/kdb_bt.c +index 6ad4a9fcbd6f..7921ae4fca8d 100644 +--- a/kernel/debug/kdb/kdb_bt.c ++++ b/kernel/debug/kdb/kdb_bt.c +@@ -179,14 +179,14 @@ kdb_bt(int argc, const char **argv) + kdb_printf("no process for cpu %ld\n", cpu); + return 0; + } +- sprintf(buf, "btt 0x%p\n", KDB_TSK(cpu)); ++ sprintf(buf, "btt 0x%px\n", KDB_TSK(cpu)); + kdb_parse(buf); + return 0; + } + kdb_printf("btc: cpu status: "); + kdb_parse("cpu\n"); + for_each_online_cpu(cpu) { +- sprintf(buf, "btt 0x%p\n", KDB_TSK(cpu)); ++ sprintf(buf, "btt 0x%px\n", KDB_TSK(cpu)); + kdb_parse(buf); + touch_nmi_watchdog(); + } +diff --git a/kernel/debug/kdb/kdb_main.c b/kernel/debug/kdb/kdb_main.c +index 2ddfce8f1e8f..f338d23b112b 100644 +--- a/kernel/debug/kdb/kdb_main.c ++++ b/kernel/debug/kdb/kdb_main.c +@@ -1192,7 +1192,7 @@ static int kdb_local(kdb_reason_t reason, int error, struct pt_regs *regs, + if (reason == KDB_REASON_DEBUG) { + /* special case below */ + } else { +- kdb_printf("\nEntering kdb (current=0x%p, pid %d) ", ++ kdb_printf("\nEntering kdb (current=0x%px, pid %d) ", + kdb_current, kdb_current ? kdb_current->pid : 0); + #if defined(CONFIG_SMP) + kdb_printf("on processor %d ", raw_smp_processor_id()); +@@ -1208,7 +1208,7 @@ static int kdb_local(kdb_reason_t reason, int error, struct pt_regs *regs, + */ + switch (db_result) { + case KDB_DB_BPT: +- kdb_printf("\nEntering kdb (0x%p, pid %d) ", ++ kdb_printf("\nEntering kdb (0x%px, pid %d) ", + kdb_current, kdb_current->pid); + #if defined(CONFIG_SMP) + kdb_printf("on processor %d ", raw_smp_processor_id()); +@@ -2048,7 +2048,7 @@ static int kdb_lsmod(int argc, const char **argv) + if (mod->state == MODULE_STATE_UNFORMED) + continue; + +- kdb_printf("%-20s%8u 0x%p ", mod->name, ++ kdb_printf("%-20s%8u 0x%px ", mod->name, + mod->core_layout.size, (void *)mod); + #ifdef CONFIG_MODULE_UNLOAD + kdb_printf("%4d ", module_refcount(mod)); +@@ -2059,7 +2059,7 @@ static int kdb_lsmod(int argc, const char **argv) + kdb_printf(" (Loading)"); + else + kdb_printf(" (Live)"); +- kdb_printf(" 0x%p", mod->core_layout.base); ++ kdb_printf(" 0x%px", mod->core_layout.base); + + #ifdef CONFIG_MODULE_UNLOAD + { +@@ -2341,7 +2341,7 @@ void kdb_ps1(const struct task_struct *p) + return; + + cpu = kdb_process_cpu(p); +- kdb_printf("0x%p %8d %8d %d %4d %c 0x%p %c%s\n", ++ kdb_printf("0x%px %8d %8d %d %4d %c 0x%px %c%s\n", + (void *)p, p->pid, p->parent->pid, + kdb_task_has_cpu(p), kdb_process_cpu(p), + kdb_task_state_char(p), +@@ -2354,7 +2354,7 @@ void kdb_ps1(const struct task_struct *p) + } else { + if (KDB_TSK(cpu) != p) + kdb_printf(" Error: does not match running " +- "process table (0x%p)\n", KDB_TSK(cpu)); ++ "process table (0x%px)\n", KDB_TSK(cpu)); + } + } + } +@@ -2692,7 +2692,7 @@ int kdb_register_flags(char *cmd, + for_each_kdbcmd(kp, i) { + if (kp->cmd_name && (strcmp(kp->cmd_name, cmd) == 0)) { + kdb_printf("Duplicate kdb command registered: " +- "%s, func %p help %s\n", cmd, func, help); ++ "%s, func %px help %s\n", cmd, func, help); + return 1; + } + } +diff --git a/kernel/debug/kdb/kdb_support.c b/kernel/debug/kdb/kdb_support.c +index 990b3cc526c8..987eb73284d2 100644 +--- a/kernel/debug/kdb/kdb_support.c ++++ b/kernel/debug/kdb/kdb_support.c +@@ -40,7 +40,7 @@ + int kdbgetsymval(const char *symname, kdb_symtab_t *symtab) + { + if (KDB_DEBUG(AR)) +- kdb_printf("kdbgetsymval: symname=%s, symtab=%p\n", symname, ++ kdb_printf("kdbgetsymval: symname=%s, symtab=%px\n", symname, + symtab); + memset(symtab, 0, sizeof(*symtab)); + symtab->sym_start = kallsyms_lookup_name(symname); +@@ -88,7 +88,7 @@ int kdbnearsym(unsigned long addr, kdb_symtab_t *symtab) + char *knt1 = NULL; + + if (KDB_DEBUG(AR)) +- kdb_printf("kdbnearsym: addr=0x%lx, symtab=%p\n", addr, symtab); ++ kdb_printf("kdbnearsym: addr=0x%lx, symtab=%px\n", addr, symtab); + memset(symtab, 0, sizeof(*symtab)); + + if (addr < 4096) +@@ -149,7 +149,7 @@ int kdbnearsym(unsigned long addr, kdb_symtab_t *symtab) + symtab->mod_name = "kernel"; + if (KDB_DEBUG(AR)) + kdb_printf("kdbnearsym: returns %d symtab->sym_start=0x%lx, " +- "symtab->mod_name=%p, symtab->sym_name=%p (%s)\n", ret, ++ "symtab->mod_name=%px, symtab->sym_name=%px (%s)\n", ret, + symtab->sym_start, symtab->mod_name, symtab->sym_name, + symtab->sym_name); + +@@ -887,13 +887,13 @@ void debug_kusage(void) + __func__, dah_first); + if (dah_first) { + h_used = (struct debug_alloc_header *)debug_alloc_pool; +- kdb_printf("%s: h_used %p size %d\n", __func__, h_used, ++ kdb_printf("%s: h_used %px size %d\n", __func__, h_used, + h_used->size); + } + do { + h_used = (struct debug_alloc_header *) + ((char *)h_free + dah_overhead + h_free->size); +- kdb_printf("%s: h_used %p size %d caller %p\n", ++ kdb_printf("%s: h_used %px size %d caller %px\n", + __func__, h_used, h_used->size, h_used->caller); + h_free = (struct debug_alloc_header *) + (debug_alloc_pool + h_free->next); +@@ -902,7 +902,7 @@ void debug_kusage(void) + ((char *)h_free + dah_overhead + h_free->size); + if ((char *)h_used - debug_alloc_pool != + sizeof(debug_alloc_pool_aligned)) +- kdb_printf("%s: h_used %p size %d caller %p\n", ++ kdb_printf("%s: h_used %px size %d caller %px\n", + __func__, h_used, h_used->size, h_used->caller); + out: + spin_unlock(&dap_lock); +diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c +index 6b71860f3998..4a8f3780aae5 100644 +--- a/kernel/trace/trace_kprobe.c ++++ b/kernel/trace/trace_kprobe.c +@@ -71,9 +71,23 @@ static nokprobe_inline bool trace_kprobe_within_module(struct trace_kprobe *tk, + return strncmp(mod->name, name, len) == 0 && name[len] == ':'; + } + +-static nokprobe_inline bool trace_kprobe_is_on_module(struct trace_kprobe *tk) ++static nokprobe_inline bool trace_kprobe_module_exist(struct trace_kprobe *tk) + { +- return !!strchr(trace_kprobe_symbol(tk), ':'); ++ char *p; ++ bool ret; ++ ++ if (!tk->symbol) ++ return false; ++ p = strchr(tk->symbol, ':'); ++ if (!p) ++ return true; ++ *p = '\0'; ++ mutex_lock(&module_mutex); ++ ret = !!find_module(tk->symbol); ++ mutex_unlock(&module_mutex); ++ *p = ':'; ++ ++ return ret; + } + + static nokprobe_inline unsigned long trace_kprobe_nhit(struct trace_kprobe *tk) +@@ -520,19 +534,13 @@ static int __register_trace_kprobe(struct trace_kprobe *tk) + else + ret = register_kprobe(&tk->rp.kp); + +- if (ret == 0) ++ if (ret == 0) { + tk->tp.flags |= TP_FLAG_REGISTERED; +- else { +- if (ret == -ENOENT && trace_kprobe_is_on_module(tk)) { +- pr_warn("This probe might be able to register after target module is loaded. Continue.\n"); +- ret = 0; +- } else if (ret == -EILSEQ) { +- pr_warn("Probing address(0x%p) is not an instruction boundary.\n", +- tk->rp.kp.addr); +- ret = -EINVAL; +- } ++ } else if (ret == -EILSEQ) { ++ pr_warn("Probing address(0x%p) is not an instruction boundary.\n", ++ tk->rp.kp.addr); ++ ret = -EINVAL; + } +- + return ret; + } + +@@ -595,6 +603,11 @@ static int register_trace_kprobe(struct trace_kprobe *tk) + + /* Register k*probe */ + ret = __register_trace_kprobe(tk); ++ if (ret == -ENOENT && !trace_kprobe_module_exist(tk)) { ++ pr_warn("This probe might be able to register after target module is loaded. Continue.\n"); ++ ret = 0; ++ } ++ + if (ret < 0) + unregister_kprobe_event(tk); + else +diff --git a/lib/ubsan.c b/lib/ubsan.c +index 59fee96c29a0..e4162f59a81c 100644 +--- a/lib/ubsan.c ++++ b/lib/ubsan.c +@@ -427,8 +427,7 @@ void __ubsan_handle_shift_out_of_bounds(struct shift_out_of_bounds_data *data, + EXPORT_SYMBOL(__ubsan_handle_shift_out_of_bounds); + + +-void __noreturn +-__ubsan_handle_builtin_unreachable(struct unreachable_data *data) ++void __ubsan_handle_builtin_unreachable(struct unreachable_data *data) + { + unsigned long flags; + +diff --git a/mm/hugetlb.c b/mm/hugetlb.c +index 5b38fbef9441..bf15bd78846b 100644 +--- a/mm/hugetlb.c ++++ b/mm/hugetlb.c +@@ -3240,7 +3240,7 @@ static int is_hugetlb_entry_hwpoisoned(pte_t pte) + int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src, + struct vm_area_struct *vma) + { +- pte_t *src_pte, *dst_pte, entry; ++ pte_t *src_pte, *dst_pte, entry, dst_entry; + struct page *ptepage; + unsigned long addr; + int cow; +@@ -3268,15 +3268,30 @@ int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src, + break; + } + +- /* If the pagetables are shared don't copy or take references */ +- if (dst_pte == src_pte) ++ /* ++ * If the pagetables are shared don't copy or take references. ++ * dst_pte == src_pte is the common case of src/dest sharing. ++ * ++ * However, src could have 'unshared' and dst shares with ++ * another vma. If dst_pte !none, this implies sharing. ++ * Check here before taking page table lock, and once again ++ * after taking the lock below. ++ */ ++ dst_entry = huge_ptep_get(dst_pte); ++ if ((dst_pte == src_pte) || !huge_pte_none(dst_entry)) + continue; + + dst_ptl = huge_pte_lock(h, dst, dst_pte); + src_ptl = huge_pte_lockptr(h, src, src_pte); + spin_lock_nested(src_ptl, SINGLE_DEPTH_NESTING); + entry = huge_ptep_get(src_pte); +- if (huge_pte_none(entry)) { /* skip none entry */ ++ dst_entry = huge_ptep_get(dst_pte); ++ if (huge_pte_none(entry) || !huge_pte_none(dst_entry)) { ++ /* ++ * Skip if src entry none. Also, skip in the ++ * unlikely case dst entry !none as this implies ++ * sharing with another vma. ++ */ + ; + } else if (unlikely(is_hugetlb_entry_migration(entry) || + is_hugetlb_entry_hwpoisoned(entry))) { +diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c +index 785252397e35..03fd2d08c361 100644 +--- a/mm/memory_hotplug.c ++++ b/mm/memory_hotplug.c +@@ -587,6 +587,7 @@ int __remove_pages(struct zone *zone, unsigned long phys_start_pfn, + for (i = 0; i < sections_to_remove; i++) { + unsigned long pfn = phys_start_pfn + i*PAGES_PER_SECTION; + ++ cond_resched(); + ret = __remove_section(zone, __pfn_to_section(pfn), map_offset, + altmap); + map_offset = 0; +diff --git a/mm/mempolicy.c b/mm/mempolicy.c +index 01f1a14facc4..73fd00d2df8c 100644 +--- a/mm/mempolicy.c ++++ b/mm/mempolicy.c +@@ -2046,8 +2046,36 @@ alloc_pages_vma(gfp_t gfp, int order, struct vm_area_struct *vma, + nmask = policy_nodemask(gfp, pol); + if (!nmask || node_isset(hpage_node, *nmask)) { + mpol_cond_put(pol); +- page = __alloc_pages_node(hpage_node, +- gfp | __GFP_THISNODE, order); ++ /* ++ * We cannot invoke reclaim if __GFP_THISNODE ++ * is set. Invoking reclaim with ++ * __GFP_THISNODE set, would cause THP ++ * allocations to trigger heavy swapping ++ * despite there may be tons of free memory ++ * (including potentially plenty of THP ++ * already available in the buddy) on all the ++ * other NUMA nodes. ++ * ++ * At most we could invoke compaction when ++ * __GFP_THISNODE is set (but we would need to ++ * refrain from invoking reclaim even if ++ * compaction returned COMPACT_SKIPPED because ++ * there wasn't not enough memory to succeed ++ * compaction). For now just avoid ++ * __GFP_THISNODE instead of limiting the ++ * allocation path to a strict and single ++ * compaction invocation. ++ * ++ * Supposedly if direct reclaim was enabled by ++ * the caller, the app prefers THP regardless ++ * of the node it comes from so this would be ++ * more desiderable behavior than only ++ * providing THP originated from the local ++ * node in such case. ++ */ ++ if (!(gfp & __GFP_DIRECT_RECLAIM)) ++ gfp |= __GFP_THISNODE; ++ page = __alloc_pages_node(hpage_node, gfp, order); + goto out; + } + } +diff --git a/mm/swapfile.c b/mm/swapfile.c +index 18185ae4f223..f8b846b5108c 100644 +--- a/mm/swapfile.c ++++ b/mm/swapfile.c +@@ -2837,7 +2837,7 @@ static struct swap_info_struct *alloc_swap_info(void) + unsigned int type; + int i; + +- p = kzalloc(sizeof(*p), GFP_KERNEL); ++ p = kvzalloc(sizeof(*p), GFP_KERNEL); + if (!p) + return ERR_PTR(-ENOMEM); + +@@ -2848,7 +2848,7 @@ static struct swap_info_struct *alloc_swap_info(void) + } + if (type >= MAX_SWAPFILES) { + spin_unlock(&swap_lock); +- kfree(p); ++ kvfree(p); + return ERR_PTR(-EPERM); + } + if (type >= nr_swapfiles) { +@@ -2862,7 +2862,7 @@ static struct swap_info_struct *alloc_swap_info(void) + smp_wmb(); + nr_swapfiles++; + } else { +- kfree(p); ++ kvfree(p); + p = swap_info[type]; + /* + * Do not memset this entry: a racing procfs swap_next() +diff --git a/net/9p/protocol.c b/net/9p/protocol.c +index 931ea00c4fed..ce7c221ca18b 100644 +--- a/net/9p/protocol.c ++++ b/net/9p/protocol.c +@@ -46,10 +46,15 @@ p9pdu_writef(struct p9_fcall *pdu, int proto_version, const char *fmt, ...); + void p9stat_free(struct p9_wstat *stbuf) + { + kfree(stbuf->name); ++ stbuf->name = NULL; + kfree(stbuf->uid); ++ stbuf->uid = NULL; + kfree(stbuf->gid); ++ stbuf->gid = NULL; + kfree(stbuf->muid); ++ stbuf->muid = NULL; + kfree(stbuf->extension); ++ stbuf->extension = NULL; + } + EXPORT_SYMBOL(p9stat_free); + +diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c +index 3d5280425027..2d3723606fb0 100644 +--- a/net/netfilter/nf_conntrack_core.c ++++ b/net/netfilter/nf_conntrack_core.c +@@ -929,19 +929,22 @@ static unsigned int early_drop_list(struct net *net, + return drops; + } + +-static noinline int early_drop(struct net *net, unsigned int _hash) ++static noinline int early_drop(struct net *net, unsigned int hash) + { +- unsigned int i; ++ unsigned int i, bucket; + + for (i = 0; i < NF_CT_EVICTION_RANGE; i++) { + struct hlist_nulls_head *ct_hash; +- unsigned int hash, hsize, drops; ++ unsigned int hsize, drops; + + rcu_read_lock(); + nf_conntrack_get_ht(&ct_hash, &hsize); +- hash = reciprocal_scale(_hash++, hsize); ++ if (!i) ++ bucket = reciprocal_scale(hash, hsize); ++ else ++ bucket = (bucket + 1) % hsize; + +- drops = early_drop_list(net, &ct_hash[hash]); ++ drops = early_drop_list(net, &ct_hash[bucket]); + rcu_read_unlock(); + + if (drops) { +diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c +index 30afbd236656..b53cc0960b5d 100644 +--- a/net/sunrpc/xdr.c ++++ b/net/sunrpc/xdr.c +@@ -639,11 +639,10 @@ void xdr_truncate_encode(struct xdr_stream *xdr, size_t len) + WARN_ON_ONCE(xdr->iov); + return; + } +- if (fraglen) { ++ if (fraglen) + xdr->end = head->iov_base + head->iov_len; +- xdr->page_ptr--; +- } + /* (otherwise assume xdr->end is already set) */ ++ xdr->page_ptr--; + head->iov_len = len; + buf->len = len; + xdr->p = head->iov_base + head->iov_len; +diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c +index 4680a217d0fa..46ec7be75d4b 100644 +--- a/security/selinux/hooks.c ++++ b/security/selinux/hooks.c +@@ -5306,6 +5306,9 @@ static int selinux_sctp_bind_connect(struct sock *sk, int optname, + addr_buf = address; + + while (walk_size < addrlen) { ++ if (walk_size + sizeof(sa_family_t) > addrlen) ++ return -EINVAL; ++ + addr = addr_buf; + switch (addr->sa_family) { + case AF_UNSPEC: +diff --git a/tools/perf/util/pmu.c b/tools/perf/util/pmu.c +index 02580f3ded1a..0b88ec9381e7 100644 +--- a/tools/perf/util/pmu.c ++++ b/tools/perf/util/pmu.c +@@ -779,7 +779,7 @@ static void pmu_add_cpu_aliases(struct list_head *head, struct perf_pmu *pmu) + + if (!is_arm_pmu_core(name)) { + pname = pe->pmu ? pe->pmu : "cpu"; +- if (strncmp(pname, name, strlen(pname))) ++ if (strcmp(pname, name)) + continue; + } + +diff --git a/tools/testing/selftests/powerpc/tm/tm-tmspr.c b/tools/testing/selftests/powerpc/tm/tm-tmspr.c +index 2bda81c7bf23..df1d7d4b1c89 100644 +--- a/tools/testing/selftests/powerpc/tm/tm-tmspr.c ++++ b/tools/testing/selftests/powerpc/tm/tm-tmspr.c +@@ -98,7 +98,7 @@ void texasr(void *in) + + int test_tmspr() + { +- pthread_t thread; ++ pthread_t *thread; + int thread_num; + unsigned long i; + +@@ -107,21 +107,28 @@ int test_tmspr() + /* To cause some context switching */ + thread_num = 10 * sysconf(_SC_NPROCESSORS_ONLN); + ++ thread = malloc(thread_num * sizeof(pthread_t)); ++ if (thread == NULL) ++ return EXIT_FAILURE; ++ + /* Test TFIAR and TFHAR */ +- for (i = 0 ; i < thread_num ; i += 2){ +- if (pthread_create(&thread, NULL, (void*)tfiar_tfhar, (void *)i)) ++ for (i = 0; i < thread_num; i += 2) { ++ if (pthread_create(&thread[i], NULL, (void *)tfiar_tfhar, ++ (void *)i)) + return EXIT_FAILURE; + } +- if (pthread_join(thread, NULL) != 0) +- return EXIT_FAILURE; +- + /* Test TEXASR */ +- for (i = 0 ; i < thread_num ; i++){ +- if (pthread_create(&thread, NULL, (void*)texasr, (void *)i)) ++ for (i = 1; i < thread_num; i += 2) { ++ if (pthread_create(&thread[i], NULL, (void *)texasr, (void *)i)) + return EXIT_FAILURE; + } +- if (pthread_join(thread, NULL) != 0) +- return EXIT_FAILURE; ++ ++ for (i = 0; i < thread_num; i++) { ++ if (pthread_join(thread[i], NULL) != 0) ++ return EXIT_FAILURE; ++ } ++ ++ free(thread); + + if (passed) + return 0; |