diff options
| -rw-r--r-- | 0000_README | 4 | ||||
| -rw-r--r-- | 1106_linux-4.4.107.patch | 3190 |
2 files changed, 3194 insertions, 0 deletions
diff --git a/0000_README b/0000_README index 84960c9b..66f2735d 100644 --- a/0000_README +++ b/0000_README @@ -467,6 +467,10 @@ Patch: 1105_linux-4.4.106.patch From: http://www.kernel.org Desc: Linux 4.4.106 +Patch: 1106_linux-4.4.107.patch +From: http://www.kernel.org +Desc: Linux 4.4.107 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1106_linux-4.4.107.patch b/1106_linux-4.4.107.patch new file mode 100644 index 00000000..7176fc37 --- /dev/null +++ b/1106_linux-4.4.107.patch @@ -0,0 +1,3190 @@ +diff --git a/Makefile b/Makefile +index 8225da6b520f..f7997b15d055 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 4 +-SUBLEVEL = 106 ++SUBLEVEL = 107 + EXTRAVERSION = + NAME = Blurry Fish Butt + +diff --git a/arch/blackfin/Kconfig b/arch/blackfin/Kconfig +index af76634f8d98..934573cc1134 100644 +--- a/arch/blackfin/Kconfig ++++ b/arch/blackfin/Kconfig +@@ -318,11 +318,14 @@ config BF53x + + config GPIO_ADI + def_bool y ++ depends on !PINCTRL + depends on (BF51x || BF52x || BF53x || BF538 || BF539 || BF561) + +-config PINCTRL ++config PINCTRL_BLACKFIN_ADI2 + def_bool y +- depends on BF54x || BF60x ++ depends on (BF54x || BF60x) ++ select PINCTRL ++ select PINCTRL_ADI2 + + config MEM_MT48LC64M4A2FB_7E + bool +diff --git a/arch/blackfin/Kconfig.debug b/arch/blackfin/Kconfig.debug +index f3337ee03621..a93cf06a4d6f 100644 +--- a/arch/blackfin/Kconfig.debug ++++ b/arch/blackfin/Kconfig.debug +@@ -17,6 +17,7 @@ config DEBUG_VERBOSE + + config DEBUG_MMRS + tristate "Generate Blackfin MMR tree" ++ depends on !PINCTRL + select DEBUG_FS + help + Create a tree of Blackfin MMRs via the debugfs tree. If +diff --git a/arch/openrisc/include/asm/uaccess.h b/arch/openrisc/include/asm/uaccess.h +index 5cc6b4f1b795..1a836afb636d 100644 +--- a/arch/openrisc/include/asm/uaccess.h ++++ b/arch/openrisc/include/asm/uaccess.h +@@ -215,7 +215,7 @@ do { \ + case 1: __get_user_asm(x, ptr, retval, "l.lbz"); break; \ + case 2: __get_user_asm(x, ptr, retval, "l.lhz"); break; \ + case 4: __get_user_asm(x, ptr, retval, "l.lwz"); break; \ +- case 8: __get_user_asm2(x, ptr, retval); \ ++ case 8: __get_user_asm2(x, ptr, retval); break; \ + default: (x) = __get_user_bad(); \ + } \ + } while (0) +diff --git a/arch/powerpc/perf/hv-24x7.c b/arch/powerpc/perf/hv-24x7.c +index 9f9dfda9ed2c..e8ca0fad2e69 100644 +--- a/arch/powerpc/perf/hv-24x7.c ++++ b/arch/powerpc/perf/hv-24x7.c +@@ -514,7 +514,7 @@ static int memord(const void *d1, size_t s1, const void *d2, size_t s2) + { + if (s1 < s2) + return 1; +- if (s2 > s1) ++ if (s1 > s2) + return -1; + + return memcmp(d1, d2, s1); +diff --git a/arch/powerpc/platforms/powernv/opal-async.c b/arch/powerpc/platforms/powernv/opal-async.c +index bdc8c0c71d15..4c00b37b09bc 100644 +--- a/arch/powerpc/platforms/powernv/opal-async.c ++++ b/arch/powerpc/platforms/powernv/opal-async.c +@@ -39,18 +39,18 @@ int __opal_async_get_token(void) + int token; + + spin_lock_irqsave(&opal_async_comp_lock, flags); +- token = find_first_bit(opal_async_complete_map, opal_max_async_tokens); ++ token = find_first_zero_bit(opal_async_token_map, opal_max_async_tokens); + if (token >= opal_max_async_tokens) { + token = -EBUSY; + goto out; + } + +- if (__test_and_set_bit(token, opal_async_token_map)) { ++ if (!__test_and_clear_bit(token, opal_async_complete_map)) { + token = -EBUSY; + goto out; + } + +- __clear_bit(token, opal_async_complete_map); ++ __set_bit(token, opal_async_token_map); + + out: + spin_unlock_irqrestore(&opal_async_comp_lock, flags); +diff --git a/arch/powerpc/platforms/powernv/setup.c b/arch/powerpc/platforms/powernv/setup.c +index a9a8fa37a555..f48afc06ba14 100644 +--- a/arch/powerpc/platforms/powernv/setup.c ++++ b/arch/powerpc/platforms/powernv/setup.c +@@ -295,7 +295,7 @@ static unsigned long pnv_get_proc_freq(unsigned int cpu) + { + unsigned long ret_freq; + +- ret_freq = cpufreq_quick_get(cpu) * 1000ul; ++ ret_freq = cpufreq_get(cpu) * 1000ul; + + /* + * If the backend cpufreq driver does not exist, +diff --git a/arch/powerpc/sysdev/ipic.c b/arch/powerpc/sysdev/ipic.c +index f76ee39cb337..800a591695c0 100644 +--- a/arch/powerpc/sysdev/ipic.c ++++ b/arch/powerpc/sysdev/ipic.c +@@ -845,12 +845,12 @@ void ipic_disable_mcp(enum ipic_mcp_irq mcp_irq) + + u32 ipic_get_mcp_status(void) + { +- return ipic_read(primary_ipic->regs, IPIC_SERMR); ++ return ipic_read(primary_ipic->regs, IPIC_SERSR); + } + + void ipic_clear_mcp_status(u32 mask) + { +- ipic_write(primary_ipic->regs, IPIC_SERMR, mask); ++ ipic_write(primary_ipic->regs, IPIC_SERSR, mask); + } + + /* Return an interrupt vector or NO_IRQ if no interrupt is pending. */ +diff --git a/arch/x86/crypto/salsa20_glue.c b/arch/x86/crypto/salsa20_glue.c +index 399a29d067d6..cb91a64a99e7 100644 +--- a/arch/x86/crypto/salsa20_glue.c ++++ b/arch/x86/crypto/salsa20_glue.c +@@ -59,13 +59,6 @@ static int encrypt(struct blkcipher_desc *desc, + + salsa20_ivsetup(ctx, walk.iv); + +- if (likely(walk.nbytes == nbytes)) +- { +- salsa20_encrypt_bytes(ctx, walk.src.virt.addr, +- walk.dst.virt.addr, nbytes); +- return blkcipher_walk_done(desc, &walk, 0); +- } +- + while (walk.nbytes >= 64) { + salsa20_encrypt_bytes(ctx, walk.src.virt.addr, + walk.dst.virt.addr, +diff --git a/crypto/hmac.c b/crypto/hmac.c +index 72e38c098bb3..ba07fb6221ae 100644 +--- a/crypto/hmac.c ++++ b/crypto/hmac.c +@@ -194,11 +194,15 @@ static int hmac_create(struct crypto_template *tmpl, struct rtattr **tb) + salg = shash_attr_alg(tb[1], 0, 0); + if (IS_ERR(salg)) + return PTR_ERR(salg); ++ alg = &salg->base; + ++ /* The underlying hash algorithm must be unkeyed */ + err = -EINVAL; ++ if (crypto_shash_alg_has_setkey(salg)) ++ goto out_put_alg; ++ + ds = salg->digestsize; + ss = salg->statesize; +- alg = &salg->base; + if (ds > alg->cra_blocksize || + ss < alg->cra_blocksize) + goto out_put_alg; +diff --git a/crypto/salsa20_generic.c b/crypto/salsa20_generic.c +index f550b5d94630..d7da0eea5622 100644 +--- a/crypto/salsa20_generic.c ++++ b/crypto/salsa20_generic.c +@@ -188,13 +188,6 @@ static int encrypt(struct blkcipher_desc *desc, + + salsa20_ivsetup(ctx, walk.iv); + +- if (likely(walk.nbytes == nbytes)) +- { +- salsa20_encrypt_bytes(ctx, walk.dst.virt.addr, +- walk.src.virt.addr, nbytes); +- return blkcipher_walk_done(desc, &walk, 0); +- } +- + while (walk.nbytes >= 64) { + salsa20_encrypt_bytes(ctx, walk.dst.virt.addr, + walk.src.virt.addr, +diff --git a/crypto/shash.c b/crypto/shash.c +index b2cd109d9171..5444b429e35d 100644 +--- a/crypto/shash.c ++++ b/crypto/shash.c +@@ -24,11 +24,12 @@ + + static const struct crypto_type crypto_shash_type; + +-static int shash_no_setkey(struct crypto_shash *tfm, const u8 *key, +- unsigned int keylen) ++int shash_no_setkey(struct crypto_shash *tfm, const u8 *key, ++ unsigned int keylen) + { + return -ENOSYS; + } ++EXPORT_SYMBOL_GPL(shash_no_setkey); + + static int shash_setkey_unaligned(struct crypto_shash *tfm, const u8 *key, + unsigned int keylen) +diff --git a/crypto/tcrypt.c b/crypto/tcrypt.c +index 46a4a757d478..f522828d45c9 100644 +--- a/crypto/tcrypt.c ++++ b/crypto/tcrypt.c +@@ -410,7 +410,7 @@ static void test_aead_speed(const char *algo, int enc, unsigned int secs, + } + + sg_init_aead(sg, xbuf, +- *b_size + (enc ? authsize : 0)); ++ *b_size + (enc ? 0 : authsize)); + + sg_init_aead(sgout, xoutbuf, + *b_size + (enc ? authsize : 0)); +@@ -418,7 +418,9 @@ static void test_aead_speed(const char *algo, int enc, unsigned int secs, + sg_set_buf(&sg[0], assoc, aad_size); + sg_set_buf(&sgout[0], assoc, aad_size); + +- aead_request_set_crypt(req, sg, sgout, *b_size, iv); ++ aead_request_set_crypt(req, sg, sgout, ++ *b_size + (enc ? 0 : authsize), ++ iv); + aead_request_set_ad(req, aad_size); + + if (secs) +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index 1ccad79ce77c..ce120fbe229e 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -1050,6 +1050,10 @@ static int btusb_open(struct hci_dev *hdev) + return err; + + data->intf->needs_remote_wakeup = 1; ++ /* device specific wakeup source enabled and required for USB ++ * remote wakeup while host is suspended ++ */ ++ device_wakeup_enable(&data->udev->dev); + + if (test_and_set_bit(BTUSB_INTR_RUNNING, &data->flags)) + goto done; +@@ -1113,6 +1117,7 @@ static int btusb_close(struct hci_dev *hdev) + goto failed; + + data->intf->needs_remote_wakeup = 0; ++ device_wakeup_disable(&data->udev->dev); + usb_autopm_put_interface(data->intf); + + failed: +diff --git a/drivers/bus/arm-ccn.c b/drivers/bus/arm-ccn.c +index 0f54cb7ddcbb..e764e8ebb86b 100644 +--- a/drivers/bus/arm-ccn.c ++++ b/drivers/bus/arm-ccn.c +@@ -1260,6 +1260,7 @@ static int arm_ccn_pmu_init(struct arm_ccn *ccn) + + /* Perf driver registration */ + ccn->dt.pmu = (struct pmu) { ++ .module = THIS_MODULE, + .attr_groups = arm_ccn_pmu_attr_groups, + .task_ctx_nr = perf_invalid_context, + .event_init = arm_ccn_pmu_event_init, +diff --git a/drivers/clk/imx/clk-imx6q.c b/drivers/clk/imx/clk-imx6q.c +index aab64205d866..a0df83e6b84b 100644 +--- a/drivers/clk/imx/clk-imx6q.c ++++ b/drivers/clk/imx/clk-imx6q.c +@@ -419,7 +419,7 @@ static void __init imx6q_clocks_init(struct device_node *ccm_node) + clk[IMX6QDL_CLK_GPU2D_CORE] = imx_clk_gate2("gpu2d_core", "gpu2d_core_podf", base + 0x6c, 24); + clk[IMX6QDL_CLK_GPU3D_CORE] = imx_clk_gate2("gpu3d_core", "gpu3d_core_podf", base + 0x6c, 26); + clk[IMX6QDL_CLK_HDMI_IAHB] = imx_clk_gate2("hdmi_iahb", "ahb", base + 0x70, 0); +- clk[IMX6QDL_CLK_HDMI_ISFR] = imx_clk_gate2("hdmi_isfr", "video_27m", base + 0x70, 4); ++ clk[IMX6QDL_CLK_HDMI_ISFR] = imx_clk_gate2("hdmi_isfr", "mipi_core_cfg", base + 0x70, 4); + clk[IMX6QDL_CLK_I2C1] = imx_clk_gate2("i2c1", "ipg_per", base + 0x70, 6); + clk[IMX6QDL_CLK_I2C2] = imx_clk_gate2("i2c2", "ipg_per", base + 0x70, 8); + clk[IMX6QDL_CLK_I2C3] = imx_clk_gate2("i2c3", "ipg_per", base + 0x70, 10); +diff --git a/drivers/clk/mediatek/clk-mtk.h b/drivers/clk/mediatek/clk-mtk.h +index 32d2e455eb3f..8e501c219946 100644 +--- a/drivers/clk/mediatek/clk-mtk.h ++++ b/drivers/clk/mediatek/clk-mtk.h +@@ -174,6 +174,7 @@ struct mtk_pll_data { + uint32_t pcw_reg; + int pcw_shift; + const struct mtk_pll_div_table *div_table; ++ const char *parent_name; + }; + + void mtk_clk_register_plls(struct device_node *node, +diff --git a/drivers/clk/mediatek/clk-pll.c b/drivers/clk/mediatek/clk-pll.c +index 966cab1348da..1c5b081ad5a1 100644 +--- a/drivers/clk/mediatek/clk-pll.c ++++ b/drivers/clk/mediatek/clk-pll.c +@@ -302,7 +302,10 @@ static struct clk *mtk_clk_register_pll(const struct mtk_pll_data *data, + + init.name = data->name; + init.ops = &mtk_pll_ops; +- init.parent_names = &parent_name; ++ if (data->parent_name) ++ init.parent_names = &data->parent_name; ++ else ++ init.parent_names = &parent_name; + init.num_parents = 1; + + clk = clk_register(NULL, &pll->hw); +diff --git a/drivers/clk/tegra/clk-tegra30.c b/drivers/clk/tegra/clk-tegra30.c +index b90db615c29e..8c41c6fcb9ee 100644 +--- a/drivers/clk/tegra/clk-tegra30.c ++++ b/drivers/clk/tegra/clk-tegra30.c +@@ -1063,7 +1063,7 @@ static void __init tegra30_super_clk_init(void) + * U71 divider of cclk_lp. + */ + clk = tegra_clk_register_divider("pll_p_out3_cclklp", "pll_p_out3", +- clk_base + SUPER_CCLKG_DIVIDER, 0, ++ clk_base + SUPER_CCLKLP_DIVIDER, 0, + TEGRA_DIVIDER_INT, 16, 8, 1, NULL); + clk_register_clkdev(clk, "pll_p_out3_cclklp", NULL); + +diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c +index 3ecec1445adf..8b9e28f1e3f5 100644 +--- a/drivers/dma/dmaengine.c ++++ b/drivers/dma/dmaengine.c +@@ -1023,12 +1023,14 @@ static struct dmaengine_unmap_pool *__get_unmap_pool(int nr) + switch (order) { + case 0 ... 1: + return &unmap_pool[0]; ++#if IS_ENABLED(CONFIG_DMA_ENGINE_RAID) + case 2 ... 4: + return &unmap_pool[1]; + case 5 ... 7: + return &unmap_pool[2]; + case 8: + return &unmap_pool[3]; ++#endif + default: + BUG(); + return NULL; +diff --git a/drivers/dma/dmatest.c b/drivers/dma/dmatest.c +index 1c7568c0055a..7254c20007f8 100644 +--- a/drivers/dma/dmatest.c ++++ b/drivers/dma/dmatest.c +@@ -148,6 +148,12 @@ MODULE_PARM_DESC(run, "Run the test (default: false)"); + #define PATTERN_OVERWRITE 0x20 + #define PATTERN_COUNT_MASK 0x1f + ++/* poor man's completion - we want to use wait_event_freezable() on it */ ++struct dmatest_done { ++ bool done; ++ wait_queue_head_t *wait; ++}; ++ + struct dmatest_thread { + struct list_head node; + struct dmatest_info *info; +@@ -156,6 +162,8 @@ struct dmatest_thread { + u8 **srcs; + u8 **dsts; + enum dma_transaction_type type; ++ wait_queue_head_t done_wait; ++ struct dmatest_done test_done; + bool done; + }; + +@@ -316,18 +324,25 @@ static unsigned int dmatest_verify(u8 **bufs, unsigned int start, + return error_count; + } + +-/* poor man's completion - we want to use wait_event_freezable() on it */ +-struct dmatest_done { +- bool done; +- wait_queue_head_t *wait; +-}; + + static void dmatest_callback(void *arg) + { + struct dmatest_done *done = arg; +- +- done->done = true; +- wake_up_all(done->wait); ++ struct dmatest_thread *thread = ++ container_of(arg, struct dmatest_thread, done_wait); ++ if (!thread->done) { ++ done->done = true; ++ wake_up_all(done->wait); ++ } else { ++ /* ++ * If thread->done, it means that this callback occurred ++ * after the parent thread has cleaned up. This can ++ * happen in the case that driver doesn't implement ++ * the terminate_all() functionality and a dma operation ++ * did not occur within the timeout period ++ */ ++ WARN(1, "dmatest: Kernel memory may be corrupted!!\n"); ++ } + } + + static unsigned int min_odd(unsigned int x, unsigned int y) +@@ -398,9 +413,8 @@ static unsigned long long dmatest_KBs(s64 runtime, unsigned long long len) + */ + static int dmatest_func(void *data) + { +- DECLARE_WAIT_QUEUE_HEAD_ONSTACK(done_wait); + struct dmatest_thread *thread = data; +- struct dmatest_done done = { .wait = &done_wait }; ++ struct dmatest_done *done = &thread->test_done; + struct dmatest_info *info; + struct dmatest_params *params; + struct dma_chan *chan; +@@ -605,9 +619,9 @@ static int dmatest_func(void *data) + continue; + } + +- done.done = false; ++ done->done = false; + tx->callback = dmatest_callback; +- tx->callback_param = &done; ++ tx->callback_param = done; + cookie = tx->tx_submit(tx); + + if (dma_submit_error(cookie)) { +@@ -620,21 +634,12 @@ static int dmatest_func(void *data) + } + dma_async_issue_pending(chan); + +- wait_event_freezable_timeout(done_wait, done.done, ++ wait_event_freezable_timeout(thread->done_wait, done->done, + msecs_to_jiffies(params->timeout)); + + status = dma_async_is_tx_complete(chan, cookie, NULL, NULL); + +- if (!done.done) { +- /* +- * We're leaving the timed out dma operation with +- * dangling pointer to done_wait. To make this +- * correct, we'll need to allocate wait_done for +- * each test iteration and perform "who's gonna +- * free it this time?" dancing. For now, just +- * leave it dangling. +- */ +- WARN(1, "dmatest: Kernel stack may be corrupted!!\n"); ++ if (!done->done) { + dmaengine_unmap_put(um); + result("test timed out", total_tests, src_off, dst_off, + len, 0); +@@ -708,7 +713,7 @@ err_thread_type: + dmatest_KBs(runtime, total_len), ret); + + /* terminate all transfers on specified channels */ +- if (ret) ++ if (ret || failed_tests) + dmaengine_terminate_all(chan); + + thread->done = true; +@@ -766,6 +771,8 @@ static int dmatest_add_threads(struct dmatest_info *info, + thread->info = info; + thread->chan = dtc->chan; + thread->type = type; ++ thread->test_done.wait = &thread->done_wait; ++ init_waitqueue_head(&thread->done_wait); + smp_wmb(); + thread->task = kthread_create(dmatest_func, thread, "%s-%s%u", + dma_chan_name(chan), op, i); +diff --git a/drivers/dma/ti-dma-crossbar.c b/drivers/dma/ti-dma-crossbar.c +index 149ec2bd9bc6..8100ede095d5 100644 +--- a/drivers/dma/ti-dma-crossbar.c ++++ b/drivers/dma/ti-dma-crossbar.c +@@ -46,12 +46,12 @@ struct ti_am335x_xbar_data { + + struct ti_am335x_xbar_map { + u16 dma_line; +- u16 mux_val; ++ u8 mux_val; + }; + +-static inline void ti_am335x_xbar_write(void __iomem *iomem, int event, u16 val) ++static inline void ti_am335x_xbar_write(void __iomem *iomem, int event, u8 val) + { +- writeb_relaxed(val & 0x1f, iomem + event); ++ writeb_relaxed(val, iomem + event); + } + + static void ti_am335x_xbar_free(struct device *dev, void *route_data) +@@ -102,7 +102,7 @@ static void *ti_am335x_xbar_route_allocate(struct of_phandle_args *dma_spec, + } + + map->dma_line = (u16)dma_spec->args[0]; +- map->mux_val = (u16)dma_spec->args[2]; ++ map->mux_val = (u8)dma_spec->args[2]; + + dma_spec->args[2] = 0; + dma_spec->args_count = 2; +diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c +index 78fe416126d1..ef467ae6dc40 100644 +--- a/drivers/firmware/efi/efi.c ++++ b/drivers/firmware/efi/efi.c +@@ -310,7 +310,6 @@ int __init efi_mem_desc_lookup(u64 phys_addr, efi_memory_desc_t *out_md) + + early_memunmap(md, sizeof (*md)); + } +- pr_err_once("requested map not found.\n"); + return -ENOENT; + } + +diff --git a/drivers/firmware/efi/esrt.c b/drivers/firmware/efi/esrt.c +index 0ca4c34f9441..341b8c686ec7 100644 +--- a/drivers/firmware/efi/esrt.c ++++ b/drivers/firmware/efi/esrt.c +@@ -253,7 +253,7 @@ void __init efi_esrt_init(void) + + rc = efi_mem_desc_lookup(efi.esrt, &md); + if (rc < 0) { +- pr_err("ESRT header is not in the memory map.\n"); ++ pr_warn("ESRT header is not in the memory map.\n"); + return; + } + +diff --git a/drivers/gpu/drm/omapdrm/omap_gem_dmabuf.c b/drivers/gpu/drm/omapdrm/omap_gem_dmabuf.c +index 27c297672076..d2d1c9a34da1 100644 +--- a/drivers/gpu/drm/omapdrm/omap_gem_dmabuf.c ++++ b/drivers/gpu/drm/omapdrm/omap_gem_dmabuf.c +@@ -142,9 +142,6 @@ static int omap_gem_dmabuf_mmap(struct dma_buf *buffer, + struct drm_gem_object *obj = buffer->priv; + int ret = 0; + +- if (WARN_ON(!obj->filp)) +- return -EINVAL; +- + ret = drm_gem_mmap_obj(obj, omap_gem_mmap_size(obj), vma); + if (ret < 0) + return ret; +diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c +index b6f16804e73b..d9007cc37be1 100644 +--- a/drivers/gpu/drm/radeon/si_dpm.c ++++ b/drivers/gpu/drm/radeon/si_dpm.c +@@ -3029,6 +3029,16 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev, + max_sclk = 75000; + max_mclk = 80000; + } ++ } else if (rdev->family == CHIP_OLAND) { ++ if ((rdev->pdev->revision == 0xC7) || ++ (rdev->pdev->revision == 0x80) || ++ (rdev->pdev->revision == 0x81) || ++ (rdev->pdev->revision == 0x83) || ++ (rdev->pdev->revision == 0x87) || ++ (rdev->pdev->device == 0x6604) || ++ (rdev->pdev->device == 0x6605)) { ++ max_sclk = 75000; ++ } + } + /* Apply dpm quirks */ + while (p && p->chip_device != 0) { +diff --git a/drivers/hwtracing/intel_th/pci.c b/drivers/hwtracing/intel_th/pci.c +index 32c6a40a408f..ea85330603b2 100644 +--- a/drivers/hwtracing/intel_th/pci.c ++++ b/drivers/hwtracing/intel_th/pci.c +@@ -82,6 +82,11 @@ static const struct pci_device_id intel_th_pci_id_table[] = { + PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x9da6), + .driver_data = (kernel_ulong_t)0, + }, ++ { ++ /* Gemini Lake */ ++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x318e), ++ .driver_data = (kernel_ulong_t)0, ++ }, + { 0 }, + }; + +diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c +index 43d5166db4c6..e354358db77b 100644 +--- a/drivers/infiniband/core/cma.c ++++ b/drivers/infiniband/core/cma.c +@@ -1353,7 +1353,7 @@ static struct rdma_id_private *cma_id_from_event(struct ib_cm_id *cm_id, + return id_priv; + } + +-static inline int cma_user_data_offset(struct rdma_id_private *id_priv) ++static inline u8 cma_user_data_offset(struct rdma_id_private *id_priv) + { + return cma_family(id_priv) == AF_IB ? 0 : sizeof(struct cma_hdr); + } +@@ -1731,7 +1731,8 @@ static int cma_req_handler(struct ib_cm_id *cm_id, struct ib_cm_event *ib_event) + struct rdma_id_private *listen_id, *conn_id; + struct rdma_cm_event event; + struct net_device *net_dev; +- int offset, ret; ++ u8 offset; ++ int ret; + + listen_id = cma_id_from_event(cm_id, ib_event, &net_dev); + if (IS_ERR(listen_id)) +@@ -3118,7 +3119,8 @@ static int cma_resolve_ib_udp(struct rdma_id_private *id_priv, + struct ib_cm_sidr_req_param req; + struct ib_cm_id *id; + void *private_data; +- int offset, ret; ++ u8 offset; ++ int ret; + + memset(&req, 0, sizeof req); + offset = cma_user_data_offset(id_priv); +@@ -3175,7 +3177,8 @@ static int cma_connect_ib(struct rdma_id_private *id_priv, + struct rdma_route *route; + void *private_data; + struct ib_cm_id *id; +- int offset, ret; ++ u8 offset; ++ int ret; + + memset(&req, 0, sizeof req); + offset = cma_user_data_offset(id_priv); +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c +index 8f8c3af9f4e8..d3f0a384faad 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c +@@ -1044,10 +1044,15 @@ static void __ipoib_ib_dev_flush(struct ipoib_dev_priv *priv, + ipoib_ib_dev_down(dev); + + if (level == IPOIB_FLUSH_HEAVY) { ++ rtnl_lock(); + if (test_bit(IPOIB_FLAG_INITIALIZED, &priv->flags)) + ipoib_ib_dev_stop(dev); +- if (ipoib_ib_dev_open(dev) != 0) ++ ++ result = ipoib_ib_dev_open(dev); ++ rtnl_unlock(); ++ if (result) + return; ++ + if (netif_queue_stopped(dev)) + netif_start_queue(dev); + } +diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h +index dbf09836ff30..d1051e3ce819 100644 +--- a/drivers/input/serio/i8042-x86ia64io.h ++++ b/drivers/input/serio/i8042-x86ia64io.h +@@ -520,6 +520,13 @@ static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "IC4I"), + }, + }, ++ { ++ /* TUXEDO BU1406 */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Notebook"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "N24_25BU"), ++ }, ++ }, + { } + }; + +diff --git a/drivers/md/bcache/request.c b/drivers/md/bcache/request.c +index 525ce56524ba..e73aeb0e892c 100644 +--- a/drivers/md/bcache/request.c ++++ b/drivers/md/bcache/request.c +@@ -468,6 +468,7 @@ struct search { + unsigned recoverable:1; + unsigned write:1; + unsigned read_dirty_data:1; ++ unsigned cache_missed:1; + + unsigned long start_time; + +@@ -653,6 +654,7 @@ static inline struct search *search_alloc(struct bio *bio, + + s->orig_bio = bio; + s->cache_miss = NULL; ++ s->cache_missed = 0; + s->d = d; + s->recoverable = 1; + s->write = (bio->bi_rw & REQ_WRITE) != 0; +@@ -776,7 +778,7 @@ static void cached_dev_read_done_bh(struct closure *cl) + struct cached_dev *dc = container_of(s->d, struct cached_dev, disk); + + bch_mark_cache_accounting(s->iop.c, s->d, +- !s->cache_miss, s->iop.bypass); ++ !s->cache_missed, s->iop.bypass); + trace_bcache_read(s->orig_bio, !s->cache_miss, s->iop.bypass); + + if (s->iop.error) +@@ -795,6 +797,8 @@ static int cached_dev_cache_miss(struct btree *b, struct search *s, + struct cached_dev *dc = container_of(s->d, struct cached_dev, disk); + struct bio *miss, *cache_bio; + ++ s->cache_missed = 1; ++ + if (s->cache_miss || s->iop.bypass) { + miss = bio_next_split(bio, sectors, GFP_NOIO, s->d->bio_split); + ret = miss == bio ? MAP_DONE : MAP_CONTINUE; +diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c +index c5ceea9222ff..8eaadd9869bc 100644 +--- a/drivers/md/bcache/super.c ++++ b/drivers/md/bcache/super.c +@@ -2083,6 +2083,7 @@ static void bcache_exit(void) + if (bcache_major) + unregister_blkdev(bcache_major, "bcache"); + unregister_reboot_notifier(&reboot); ++ mutex_destroy(&bch_register_lock); + } + + static int __init bcache_init(void) +@@ -2101,14 +2102,15 @@ static int __init bcache_init(void) + bcache_major = register_blkdev(0, "bcache"); + if (bcache_major < 0) { + unregister_reboot_notifier(&reboot); ++ mutex_destroy(&bch_register_lock); + return bcache_major; + } + + if (!(bcache_wq = create_workqueue("bcache")) || + !(bcache_kobj = kobject_create_and_add("bcache", fs_kobj)) || +- sysfs_create_files(bcache_kobj, files) || + bch_request_init() || +- bch_debug_init(bcache_kobj)) ++ bch_debug_init(bcache_kobj) || ++ sysfs_create_files(bcache_kobj, files)) + goto err; + + return 0; +diff --git a/drivers/md/md-cluster.c b/drivers/md/md-cluster.c +index d6a1126d85ce..494d01d0e92a 100644 +--- a/drivers/md/md-cluster.c ++++ b/drivers/md/md-cluster.c +@@ -821,6 +821,7 @@ static int leave(struct mddev *mddev) + lockres_free(cinfo->no_new_dev_lockres); + lockres_free(cinfo->bitmap_lockres); + dlm_release_lockspace(cinfo->lockspace, 2); ++ kfree(cinfo); + return 0; + } + +diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c +index d55bf85b76ce..86ab6d14d782 100644 +--- a/drivers/md/raid5.c ++++ b/drivers/md/raid5.c +@@ -1681,8 +1681,11 @@ static void ops_complete_reconstruct(void *stripe_head_ref) + struct r5dev *dev = &sh->dev[i]; + + if (dev->written || i == pd_idx || i == qd_idx) { +- if (!discard && !test_bit(R5_SkipCopy, &dev->flags)) ++ if (!discard && !test_bit(R5_SkipCopy, &dev->flags)) { + set_bit(R5_UPTODATE, &dev->flags); ++ if (test_bit(STRIPE_EXPAND_READY, &sh->state)) ++ set_bit(R5_Expanded, &dev->flags); ++ } + if (fua) + set_bit(R5_WantFUA, &dev->flags); + if (sync) +diff --git a/drivers/mmc/host/mtk-sd.c b/drivers/mmc/host/mtk-sd.c +index 33dfd7e72516..0bf0d0e9dbdb 100644 +--- a/drivers/mmc/host/mtk-sd.c ++++ b/drivers/mmc/host/mtk-sd.c +@@ -570,7 +570,7 @@ static void msdc_set_mclk(struct msdc_host *host, unsigned char timing, u32 hz) + } + } + sdr_set_field(host->base + MSDC_CFG, MSDC_CFG_CKMOD | MSDC_CFG_CKDIV, +- (mode << 8) | (div % 0xff)); ++ (mode << 8) | div); + sdr_set_bits(host->base + MSDC_CFG, MSDC_CFG_CKPDN); + while (!(readl(host->base + MSDC_CFG) & MSDC_CFG_CKSTB)) + cpu_relax(); +@@ -1540,7 +1540,7 @@ static int msdc_drv_probe(struct platform_device *pdev) + host->src_clk_freq = clk_get_rate(host->src_clk); + /* Set host parameters to mmc */ + mmc->ops = &mt_msdc_ops; +- mmc->f_min = host->src_clk_freq / (4 * 255); ++ mmc->f_min = DIV_ROUND_UP(host->src_clk_freq, 4 * 255); + + mmc->caps |= MMC_CAP_ERASE | MMC_CAP_CMD23; + mmc->caps |= MMC_CAP_RUNTIME_RESUME; +diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c +index f971d92f7b41..74dd48f2bd89 100644 +--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c ++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c +@@ -1,7 +1,7 @@ + /* + * Broadcom GENET (Gigabit Ethernet) controller driver + * +- * Copyright (c) 2014 Broadcom Corporation ++ * Copyright (c) 2014-2017 Broadcom + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 as +@@ -778,8 +778,9 @@ static const struct bcmgenet_stats bcmgenet_gstrings_stats[] = { + STAT_GENET_RUNT("rx_runt_bytes", mib.rx_runt_bytes), + /* Misc UniMAC counters */ + STAT_GENET_MISC("rbuf_ovflow_cnt", mib.rbuf_ovflow_cnt, +- UMAC_RBUF_OVFL_CNT), +- STAT_GENET_MISC("rbuf_err_cnt", mib.rbuf_err_cnt, UMAC_RBUF_ERR_CNT), ++ UMAC_RBUF_OVFL_CNT_V1), ++ STAT_GENET_MISC("rbuf_err_cnt", mib.rbuf_err_cnt, ++ UMAC_RBUF_ERR_CNT_V1), + STAT_GENET_MISC("mdf_err_cnt", mib.mdf_err_cnt, UMAC_MDF_ERR_CNT), + STAT_GENET_SOFT_MIB("alloc_rx_buff_failed", mib.alloc_rx_buff_failed), + STAT_GENET_SOFT_MIB("rx_dma_failed", mib.rx_dma_failed), +@@ -821,6 +822,45 @@ static void bcmgenet_get_strings(struct net_device *dev, u32 stringset, + } + } + ++static u32 bcmgenet_update_stat_misc(struct bcmgenet_priv *priv, u16 offset) ++{ ++ u16 new_offset; ++ u32 val; ++ ++ switch (offset) { ++ case UMAC_RBUF_OVFL_CNT_V1: ++ if (GENET_IS_V2(priv)) ++ new_offset = RBUF_OVFL_CNT_V2; ++ else ++ new_offset = RBUF_OVFL_CNT_V3PLUS; ++ ++ val = bcmgenet_rbuf_readl(priv, new_offset); ++ /* clear if overflowed */ ++ if (val == ~0) ++ bcmgenet_rbuf_writel(priv, 0, new_offset); ++ break; ++ case UMAC_RBUF_ERR_CNT_V1: ++ if (GENET_IS_V2(priv)) ++ new_offset = RBUF_ERR_CNT_V2; ++ else ++ new_offset = RBUF_ERR_CNT_V3PLUS; ++ ++ val = bcmgenet_rbuf_readl(priv, new_offset); ++ /* clear if overflowed */ ++ if (val == ~0) ++ bcmgenet_rbuf_writel(priv, 0, new_offset); ++ break; ++ default: ++ val = bcmgenet_umac_readl(priv, offset); ++ /* clear if overflowed */ ++ if (val == ~0) ++ bcmgenet_umac_writel(priv, 0, offset); ++ break; ++ } ++ ++ return val; ++} ++ + static void bcmgenet_update_mib_counters(struct bcmgenet_priv *priv) + { + int i, j = 0; +@@ -836,19 +876,28 @@ static void bcmgenet_update_mib_counters(struct bcmgenet_priv *priv) + case BCMGENET_STAT_NETDEV: + case BCMGENET_STAT_SOFT: + continue; +- case BCMGENET_STAT_MIB_RX: +- case BCMGENET_STAT_MIB_TX: + case BCMGENET_STAT_RUNT: +- if (s->type != BCMGENET_STAT_MIB_RX) +- offset = BCMGENET_STAT_OFFSET; ++ offset += BCMGENET_STAT_OFFSET; ++ /* fall through */ ++ case BCMGENET_STAT_MIB_TX: ++ offset += BCMGENET_STAT_OFFSET; ++ /* fall through */ ++ case BCMGENET_STAT_MIB_RX: + val = bcmgenet_umac_readl(priv, + UMAC_MIB_START + j + offset); ++ offset = 0; /* Reset Offset */ + break; + case BCMGENET_STAT_MISC: +- val = bcmgenet_umac_readl(priv, s->reg_offset); +- /* clear if overflowed */ +- if (val == ~0) +- bcmgenet_umac_writel(priv, 0, s->reg_offset); ++ if (GENET_IS_V1(priv)) { ++ val = bcmgenet_umac_readl(priv, s->reg_offset); ++ /* clear if overflowed */ ++ if (val == ~0) ++ bcmgenet_umac_writel(priv, 0, ++ s->reg_offset); ++ } else { ++ val = bcmgenet_update_stat_misc(priv, ++ s->reg_offset); ++ } + break; + } + +@@ -2901,6 +2950,8 @@ err_irq0: + err_fini_dma: + bcmgenet_fini_dma(priv); + err_clk_disable: ++ if (priv->internal_phy) ++ bcmgenet_power_down(priv, GENET_POWER_PASSIVE); + clk_disable_unprepare(priv->clk); + return ret; + } +@@ -3277,6 +3328,12 @@ static void bcmgenet_set_hw_params(struct bcmgenet_priv *priv) + */ + gphy_rev = reg & 0xffff; + ++ /* This is reserved so should require special treatment */ ++ if (gphy_rev == 0 || gphy_rev == 0x01ff) { ++ pr_warn("Invalid GPHY revision detected: 0x%04x\n", gphy_rev); ++ return; ++ } ++ + /* This is the good old scheme, just GPHY major, no minor nor patch */ + if ((gphy_rev & 0xf0) != 0) + priv->gphy_rev = gphy_rev << 8; +@@ -3285,12 +3342,6 @@ static void bcmgenet_set_hw_params(struct bcmgenet_priv *priv) + else if ((gphy_rev & 0xff00) != 0) + priv->gphy_rev = gphy_rev; + +- /* This is reserved so should require special treatment */ +- else if (gphy_rev == 0 || gphy_rev == 0x01ff) { +- pr_warn("Invalid GPHY revision detected: 0x%04x\n", gphy_rev); +- return; +- } +- + #ifdef CONFIG_PHYS_ADDR_T_64BIT + if (!(params->flags & GENET_HAS_40BITS)) + pr_warn("GENET does not support 40-bits PA\n"); +@@ -3333,6 +3384,7 @@ static int bcmgenet_probe(struct platform_device *pdev) + const void *macaddr; + struct resource *r; + int err = -EIO; ++ const char *phy_mode_str; + + /* Up to GENET_MAX_MQ_CNT + 1 TX queues and RX queues */ + dev = alloc_etherdev_mqs(sizeof(*priv), GENET_MAX_MQ_CNT + 1, +@@ -3438,6 +3490,13 @@ static int bcmgenet_probe(struct platform_device *pdev) + priv->clk_eee = NULL; + } + ++ /* If this is an internal GPHY, power it on now, before UniMAC is ++ * brought out of reset as absolutely no UniMAC activity is allowed ++ */ ++ if (dn && !of_property_read_string(dn, "phy-mode", &phy_mode_str) && ++ !strcasecmp(phy_mode_str, "internal")) ++ bcmgenet_power_up(priv, GENET_POWER_PASSIVE); ++ + err = reset_umac(priv); + if (err) + goto err_clk_disable; +@@ -3604,6 +3663,8 @@ static int bcmgenet_resume(struct device *d) + return 0; + + out_clk_disable: ++ if (priv->internal_phy) ++ bcmgenet_power_down(priv, GENET_POWER_PASSIVE); + clk_disable_unprepare(priv->clk); + return ret; + } +diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.h b/drivers/net/ethernet/broadcom/genet/bcmgenet.h +index 967367557309..cef53f2d9854 100644 +--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.h ++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.h +@@ -1,5 +1,5 @@ + /* +- * Copyright (c) 2014 Broadcom Corporation ++ * Copyright (c) 2014-2017 Broadcom + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 as +@@ -214,7 +214,9 @@ struct bcmgenet_mib_counters { + #define MDIO_REG_SHIFT 16 + #define MDIO_REG_MASK 0x1F + +-#define UMAC_RBUF_OVFL_CNT 0x61C ++#define UMAC_RBUF_OVFL_CNT_V1 0x61C ++#define RBUF_OVFL_CNT_V2 0x80 ++#define RBUF_OVFL_CNT_V3PLUS 0x94 + + #define UMAC_MPD_CTRL 0x620 + #define MPD_EN (1 << 0) +@@ -224,7 +226,9 @@ struct bcmgenet_mib_counters { + + #define UMAC_MPD_PW_MS 0x624 + #define UMAC_MPD_PW_LS 0x628 +-#define UMAC_RBUF_ERR_CNT 0x634 ++#define UMAC_RBUF_ERR_CNT_V1 0x634 ++#define RBUF_ERR_CNT_V2 0x84 ++#define RBUF_ERR_CNT_V3PLUS 0x98 + #define UMAC_MDF_ERR_CNT 0x638 + #define UMAC_MDF_CTRL 0x650 + #define UMAC_MDF_ADDR 0x654 +diff --git a/drivers/net/ethernet/mellanox/mlx4/cmd.c b/drivers/net/ethernet/mellanox/mlx4/cmd.c +index d48d5793407d..fc222df47aa9 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/cmd.c ++++ b/drivers/net/ethernet/mellanox/mlx4/cmd.c +@@ -2278,6 +2278,17 @@ static int sync_toggles(struct mlx4_dev *dev) + rd_toggle = swab32(readl(&priv->mfunc.comm->slave_read)); + if (wr_toggle == 0xffffffff || rd_toggle == 0xffffffff) { + /* PCI might be offline */ ++ ++ /* If device removal has been requested, ++ * do not continue retrying. ++ */ ++ if (dev->persist->interface_state & ++ MLX4_INTERFACE_STATE_NOWAIT) { ++ mlx4_warn(dev, ++ "communication channel is offline\n"); ++ return -EIO; ++ } ++ + msleep(100); + wr_toggle = swab32(readl(&priv->mfunc.comm-> + slave_write)); +diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c +index 99361352ed0d..a7d3144c2388 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/main.c ++++ b/drivers/net/ethernet/mellanox/mlx4/main.c +@@ -1763,6 +1763,14 @@ static int mlx4_comm_check_offline(struct mlx4_dev *dev) + (u32)(1 << COMM_CHAN_OFFLINE_OFFSET)); + if (!offline_bit) + return 0; ++ ++ /* If device removal has been requested, ++ * do not continue retrying. ++ */ ++ if (dev->persist->interface_state & ++ MLX4_INTERFACE_STATE_NOWAIT) ++ break; ++ + /* There are cases as part of AER/Reset flow that PF needs + * around 100 msec to load. We therefore sleep for 100 msec + * to allow other tasks to make use of that CPU during this +@@ -3690,6 +3698,9 @@ static void mlx4_remove_one(struct pci_dev *pdev) + struct mlx4_priv *priv = mlx4_priv(dev); + int active_vfs = 0; + ++ if (mlx4_is_slave(dev)) ++ persist->interface_state |= MLX4_INTERFACE_STATE_NOWAIT; ++ + mutex_lock(&persist->interface_state_mutex); + persist->interface_state |= MLX4_INTERFACE_STATE_DELETION; + mutex_unlock(&persist->interface_state_mutex); +diff --git a/drivers/net/ethernet/mellanox/mlxsw/reg.h b/drivers/net/ethernet/mellanox/mlxsw/reg.h +index 236fb5d2ad69..c7fe61f1f89f 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/reg.h ++++ b/drivers/net/ethernet/mellanox/mlxsw/reg.h +@@ -599,7 +599,7 @@ static inline void mlxsw_reg_spvid_pack(char *payload, u8 local_port, u16 pvid) + #define MLXSW_REG_SPVM_ID 0x200F + #define MLXSW_REG_SPVM_BASE_LEN 0x04 /* base length, without records */ + #define MLXSW_REG_SPVM_REC_LEN 0x04 /* record length */ +-#define MLXSW_REG_SPVM_REC_MAX_COUNT 256 ++#define MLXSW_REG_SPVM_REC_MAX_COUNT 255 + #define MLXSW_REG_SPVM_LEN (MLXSW_REG_SPVM_BASE_LEN + \ + MLXSW_REG_SPVM_REC_LEN * MLXSW_REG_SPVM_REC_MAX_COUNT) + +@@ -1139,7 +1139,7 @@ static inline void mlxsw_reg_sfmr_pack(char *payload, + #define MLXSW_REG_SPVMLR_ID 0x2020 + #define MLXSW_REG_SPVMLR_BASE_LEN 0x04 /* base length, without records */ + #define MLXSW_REG_SPVMLR_REC_LEN 0x04 /* record length */ +-#define MLXSW_REG_SPVMLR_REC_MAX_COUNT 256 ++#define MLXSW_REG_SPVMLR_REC_MAX_COUNT 255 + #define MLXSW_REG_SPVMLR_LEN (MLXSW_REG_SPVMLR_BASE_LEN + \ + MLXSW_REG_SPVMLR_REC_LEN * \ + MLXSW_REG_SPVMLR_REC_MAX_COUNT) +diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c +index cbe9a330117a..063aca17e698 100644 +--- a/drivers/net/ethernet/sfc/ef10.c ++++ b/drivers/net/ethernet/sfc/ef10.c +@@ -4307,7 +4307,7 @@ static int efx_ef10_set_mac_address(struct efx_nic *efx) + * MCFW do not support VFs. + */ + rc = efx_ef10_vport_set_mac_address(efx); +- } else { ++ } else if (rc) { + efx_mcdi_display_error(efx, MC_CMD_VADAPTOR_SET_MAC, + sizeof(inbuf), NULL, 0, rc); + } +diff --git a/drivers/net/fjes/fjes_main.c b/drivers/net/fjes/fjes_main.c +index 0ddb54fe3d91..a539e831b4b1 100644 +--- a/drivers/net/fjes/fjes_main.c ++++ b/drivers/net/fjes/fjes_main.c +@@ -1205,7 +1205,7 @@ static void fjes_netdev_setup(struct net_device *netdev) + fjes_set_ethtool_ops(netdev); + netdev->mtu = fjes_support_mtu[0]; + netdev->flags |= IFF_BROADCAST; +- netdev->features |= NETIF_F_HW_CSUM | NETIF_F_HW_VLAN_CTAG_FILTER; ++ netdev->features |= NETIF_F_HW_VLAN_CTAG_FILTER; + } + + static void fjes_irq_watch_task(struct work_struct *work) +diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c +index 40cd86614677..9897cabec371 100644 +--- a/drivers/net/macvlan.c ++++ b/drivers/net/macvlan.c +@@ -441,7 +441,7 @@ static rx_handler_result_t macvlan_handle_frame(struct sk_buff **pskb) + struct macvlan_dev, list); + else + vlan = macvlan_hash_lookup(port, eth->h_dest); +- if (vlan == NULL) ++ if (!vlan || vlan->mode == MACVLAN_MODE_SOURCE) + return RX_HANDLER_PASS; + + dev = vlan->dev; +diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c +index dc454138d600..e2decf71c6d1 100644 +--- a/drivers/net/ppp/ppp_generic.c ++++ b/drivers/net/ppp/ppp_generic.c +@@ -942,6 +942,7 @@ static __net_exit void ppp_exit_net(struct net *net) + unregister_netdevice_many(&list); + rtnl_unlock(); + ++ mutex_destroy(&pn->all_ppp_mutex); + idr_destroy(&pn->units_idr); + } + +diff --git a/drivers/net/wimax/i2400m/usb.c b/drivers/net/wimax/i2400m/usb.c +index e7f5910a6519..f8eb66ef2944 100644 +--- a/drivers/net/wimax/i2400m/usb.c ++++ b/drivers/net/wimax/i2400m/usb.c +@@ -467,6 +467,9 @@ int i2400mu_probe(struct usb_interface *iface, + struct i2400mu *i2400mu; + struct usb_device *usb_dev = interface_to_usbdev(iface); + ++ if (iface->cur_altsetting->desc.bNumEndpoints < 4) ++ return -ENODEV; ++ + if (usb_dev->speed != USB_SPEED_HIGH) + dev_err(dev, "device not connected as high speed\n"); + +diff --git a/drivers/net/wireless/ath/ath9k/tx99.c b/drivers/net/wireless/ath/ath9k/tx99.c +index b4e6304afd40..7ee1a3183a06 100644 +--- a/drivers/net/wireless/ath/ath9k/tx99.c ++++ b/drivers/net/wireless/ath/ath9k/tx99.c +@@ -180,6 +180,9 @@ static ssize_t write_file_tx99(struct file *file, const char __user *user_buf, + ssize_t len; + int r; + ++ if (count < 1) ++ return -EINVAL; ++ + if (sc->cur_chan->nvifs > 1) + return -EOPNOTSUPP; + +@@ -187,6 +190,8 @@ static ssize_t write_file_tx99(struct file *file, const char __user *user_buf, + if (copy_from_user(buf, user_buf, len)) + return -EFAULT; + ++ buf[len] = '\0'; ++ + if (strtobool(buf, &start)) + return -EINVAL; + +diff --git a/drivers/pci/pcie/pme.c b/drivers/pci/pcie/pme.c +index 63fc63911295..deb903112974 100644 +--- a/drivers/pci/pcie/pme.c ++++ b/drivers/pci/pcie/pme.c +@@ -233,6 +233,9 @@ static void pcie_pme_work_fn(struct work_struct *work) + break; + + pcie_capability_read_dword(port, PCI_EXP_RTSTA, &rtsta); ++ if (rtsta == (u32) ~0) ++ break; ++ + if (rtsta & PCI_EXP_RTSTA_PME) { + /* + * Clear PME status of the port. If there are other +@@ -280,7 +283,7 @@ static irqreturn_t pcie_pme_irq(int irq, void *context) + spin_lock_irqsave(&data->lock, flags); + pcie_capability_read_dword(port, PCI_EXP_RTSTA, &rtsta); + +- if (!(rtsta & PCI_EXP_RTSTA_PME)) { ++ if (rtsta == (u32) ~0 || !(rtsta & PCI_EXP_RTSTA_PME)) { + spin_unlock_irqrestore(&data->lock, flags); + return IRQ_NONE; + } +diff --git a/drivers/pci/remove.c b/drivers/pci/remove.c +index 8a280e9c2ad1..7e67af2bb366 100644 +--- a/drivers/pci/remove.c ++++ b/drivers/pci/remove.c +@@ -20,9 +20,9 @@ static void pci_stop_dev(struct pci_dev *dev) + pci_pme_active(dev, false); + + if (dev->is_added) { ++ device_release_driver(&dev->dev); + pci_proc_detach_device(dev); + pci_remove_sysfs_dev_files(dev); +- device_release_driver(&dev->dev); + dev->is_added = 0; + } + +diff --git a/drivers/pinctrl/Kconfig b/drivers/pinctrl/Kconfig +index 312c78b27a32..073b6d1e5efa 100644 +--- a/drivers/pinctrl/Kconfig ++++ b/drivers/pinctrl/Kconfig +@@ -26,7 +26,8 @@ config DEBUG_PINCTRL + + config PINCTRL_ADI2 + bool "ADI pin controller driver" +- depends on BLACKFIN ++ depends on (BF54x || BF60x) ++ depends on !GPIO_ADI + select PINMUX + select IRQ_DOMAIN + help +diff --git a/drivers/rtc/rtc-pcf8563.c b/drivers/rtc/rtc-pcf8563.c +index c8f95b8e463a..45b5a3d47ccf 100644 +--- a/drivers/rtc/rtc-pcf8563.c ++++ b/drivers/rtc/rtc-pcf8563.c +@@ -427,7 +427,7 @@ static unsigned long pcf8563_clkout_recalc_rate(struct clk_hw *hw, + return 0; + + buf &= PCF8563_REG_CLKO_F_MASK; +- return clkout_rates[ret]; ++ return clkout_rates[buf]; + } + + static long pcf8563_clkout_round_rate(struct clk_hw *hw, unsigned long rate, +diff --git a/drivers/scsi/bfa/bfad_debugfs.c b/drivers/scsi/bfa/bfad_debugfs.c +index 74a307c0a240..8f1c58d4d5b5 100644 +--- a/drivers/scsi/bfa/bfad_debugfs.c ++++ b/drivers/scsi/bfa/bfad_debugfs.c +@@ -254,7 +254,8 @@ bfad_debugfs_write_regrd(struct file *file, const char __user *buf, + struct bfad_s *bfad = port->bfad; + struct bfa_s *bfa = &bfad->bfa; + struct bfa_ioc_s *ioc = &bfa->ioc; +- int addr, len, rc, i; ++ int addr, rc, i; ++ u32 len; + u32 *regbuf; + void __iomem *rb, *reg_addr; + unsigned long flags; +@@ -265,7 +266,7 @@ bfad_debugfs_write_regrd(struct file *file, const char __user *buf, + return PTR_ERR(kern_buf); + + rc = sscanf(kern_buf, "%x:%x", &addr, &len); +- if (rc < 2) { ++ if (rc < 2 || len > (UINT_MAX >> 2)) { + printk(KERN_INFO + "bfad[%d]: %s failed to read user buf\n", + bfad->inst_no, __func__); +diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c +index e9ce74afd13f..0c87f341fed4 100644 +--- a/drivers/scsi/hpsa.c ++++ b/drivers/scsi/hpsa.c +@@ -3466,7 +3466,7 @@ exit_failed: + * # (integer code indicating one of several NOT READY states + * describing why a volume is to be kept offline) + */ +-static int hpsa_volume_offline(struct ctlr_info *h, ++static unsigned char hpsa_volume_offline(struct ctlr_info *h, + unsigned char scsi3addr[]) + { + struct CommandList *c; +@@ -3486,7 +3486,7 @@ static int hpsa_volume_offline(struct ctlr_info *h, + rc = hpsa_scsi_do_simple_cmd(h, c, DEFAULT_REPLY_QUEUE, NO_TIMEOUT); + if (rc) { + cmd_free(h, c); +- return 0; ++ return HPSA_VPD_LV_STATUS_UNSUPPORTED; + } + sense = c->err_info->SenseInfo; + if (c->err_info->SenseLen > sizeof(c->err_info->SenseInfo)) +@@ -3497,19 +3497,13 @@ static int hpsa_volume_offline(struct ctlr_info *h, + cmd_status = c->err_info->CommandStatus; + scsi_status = c->err_info->ScsiStatus; + cmd_free(h, c); +- /* Is the volume 'not ready'? */ +- if (cmd_status != CMD_TARGET_STATUS || +- scsi_status != SAM_STAT_CHECK_CONDITION || +- sense_key != NOT_READY || +- asc != ASC_LUN_NOT_READY) { +- return 0; +- } + + /* Determine the reason for not ready state */ + ldstat = hpsa_get_volume_status(h, scsi3addr); + + /* Keep volume offline in certain cases: */ + switch (ldstat) { ++ case HPSA_LV_FAILED: + case HPSA_LV_UNDERGOING_ERASE: + case HPSA_LV_NOT_AVAILABLE: + case HPSA_LV_UNDERGOING_RPI: +@@ -3531,7 +3525,7 @@ static int hpsa_volume_offline(struct ctlr_info *h, + default: + break; + } +- return 0; ++ return HPSA_LV_OK; + } + + /* +@@ -3615,10 +3609,10 @@ static int hpsa_update_device_info(struct ctlr_info *h, + /* Do an inquiry to the device to see what it is. */ + if (hpsa_scsi_do_inquiry(h, scsi3addr, 0, inq_buff, + (unsigned char) OBDR_TAPE_INQ_SIZE) != 0) { +- /* Inquiry failed (msg printed already) */ + dev_err(&h->pdev->dev, +- "hpsa_update_device_info: inquiry failed\n"); +- rc = -EIO; ++ "%s: inquiry failed, device will be skipped.\n", ++ __func__); ++ rc = HPSA_INQUIRY_FAILED; + goto bail_out; + } + +@@ -3638,15 +3632,19 @@ static int hpsa_update_device_info(struct ctlr_info *h, + + if (this_device->devtype == TYPE_DISK && + is_logical_dev_addr_mode(scsi3addr)) { +- int volume_offline; ++ unsigned char volume_offline; + + hpsa_get_raid_level(h, scsi3addr, &this_device->raid_level); + if (h->fw_support & MISC_FW_RAID_OFFLOAD_BASIC) + hpsa_get_ioaccel_status(h, scsi3addr, this_device); + volume_offline = hpsa_volume_offline(h, scsi3addr); +- if (volume_offline < 0 || volume_offline > 0xff) +- volume_offline = HPSA_VPD_LV_STATUS_UNSUPPORTED; +- this_device->volume_offline = volume_offline & 0xff; ++ if (volume_offline == HPSA_LV_FAILED) { ++ rc = HPSA_LV_FAILED; ++ dev_err(&h->pdev->dev, ++ "%s: LV failed, device will be skipped.\n", ++ __func__); ++ goto bail_out; ++ } + } else { + this_device->raid_level = RAID_UNKNOWN; + this_device->offload_config = 0; +@@ -4115,8 +4113,7 @@ static void hpsa_update_scsi_devices(struct ctlr_info *h) + goto out; + } + if (rc) { +- dev_warn(&h->pdev->dev, +- "Inquiry failed, skipping device.\n"); ++ h->drv_req_rescan = 1; + continue; + } + +@@ -5257,7 +5254,7 @@ static void hpsa_scan_complete(struct ctlr_info *h) + + spin_lock_irqsave(&h->scan_lock, flags); + h->scan_finished = 1; +- wake_up_all(&h->scan_wait_queue); ++ wake_up(&h->scan_wait_queue); + spin_unlock_irqrestore(&h->scan_lock, flags); + } + +@@ -5275,11 +5272,23 @@ static void hpsa_scan_start(struct Scsi_Host *sh) + if (unlikely(lockup_detected(h))) + return hpsa_scan_complete(h); + ++ /* ++ * If a scan is already waiting to run, no need to add another ++ */ ++ spin_lock_irqsave(&h->scan_lock, flags); ++ if (h->scan_waiting) { ++ spin_unlock_irqrestore(&h->scan_lock, flags); ++ return; ++ } ++ ++ spin_unlock_irqrestore(&h->scan_lock, flags); ++ + /* wait until any scan already in progress is finished. */ + while (1) { + spin_lock_irqsave(&h->scan_lock, flags); + if (h->scan_finished) + break; ++ h->scan_waiting = 1; + spin_unlock_irqrestore(&h->scan_lock, flags); + wait_event(h->scan_wait_queue, h->scan_finished); + /* Note: We don't need to worry about a race between this +@@ -5289,6 +5298,7 @@ static void hpsa_scan_start(struct Scsi_Host *sh) + */ + } + h->scan_finished = 0; /* mark scan as in progress */ ++ h->scan_waiting = 0; + spin_unlock_irqrestore(&h->scan_lock, flags); + + if (unlikely(lockup_detected(h))) +@@ -8505,6 +8515,7 @@ reinit_after_soft_reset: + init_waitqueue_head(&h->event_sync_wait_queue); + mutex_init(&h->reset_mutex); + h->scan_finished = 1; /* no scan currently in progress */ ++ h->scan_waiting = 0; + + pci_set_drvdata(pdev, h); + h->ndevices = 0; +@@ -8797,6 +8808,8 @@ static void hpsa_remove_one(struct pci_dev *pdev) + destroy_workqueue(h->rescan_ctlr_wq); + destroy_workqueue(h->resubmit_wq); + ++ hpsa_delete_sas_host(h); ++ + /* + * Call before disabling interrupts. + * scsi_remove_host can trigger I/O operations especially +@@ -8831,8 +8844,6 @@ static void hpsa_remove_one(struct pci_dev *pdev) + h->lockup_detected = NULL; /* init_one 2 */ + /* (void) pci_disable_pcie_error_reporting(pdev); */ /* init_one 1 */ + +- hpsa_delete_sas_host(h); +- + kfree(h); /* init_one 1 */ + } + +@@ -9324,9 +9335,9 @@ static void hpsa_free_sas_phy(struct hpsa_sas_phy *hpsa_sas_phy) + struct sas_phy *phy = hpsa_sas_phy->phy; + + sas_port_delete_phy(hpsa_sas_phy->parent_port->port, phy); +- sas_phy_free(phy); + if (hpsa_sas_phy->added_to_port) + list_del(&hpsa_sas_phy->phy_list_entry); ++ sas_phy_delete(phy); + kfree(hpsa_sas_phy); + } + +diff --git a/drivers/scsi/hpsa.h b/drivers/scsi/hpsa.h +index ae5beda1bdb5..0e602750487a 100644 +--- a/drivers/scsi/hpsa.h ++++ b/drivers/scsi/hpsa.h +@@ -200,6 +200,7 @@ struct ctlr_info { + dma_addr_t errinfo_pool_dhandle; + unsigned long *cmd_pool_bits; + int scan_finished; ++ u8 scan_waiting : 1; + spinlock_t scan_lock; + wait_queue_head_t scan_wait_queue; + +diff --git a/drivers/scsi/hpsa_cmd.h b/drivers/scsi/hpsa_cmd.h +index d92ef0d352b5..26488e2a7f02 100644 +--- a/drivers/scsi/hpsa_cmd.h ++++ b/drivers/scsi/hpsa_cmd.h +@@ -155,6 +155,7 @@ + #define CFGTBL_BusType_Fibre2G 0x00000200l + + /* VPD Inquiry types */ ++#define HPSA_INQUIRY_FAILED 0x02 + #define HPSA_VPD_SUPPORTED_PAGES 0x00 + #define HPSA_VPD_LV_DEVICE_GEOMETRY 0xC1 + #define HPSA_VPD_LV_IOACCEL_STATUS 0xC2 +@@ -164,6 +165,7 @@ + /* Logical volume states */ + #define HPSA_VPD_LV_STATUS_UNSUPPORTED 0xff + #define HPSA_LV_OK 0x0 ++#define HPSA_LV_FAILED 0x01 + #define HPSA_LV_NOT_AVAILABLE 0x0b + #define HPSA_LV_UNDERGOING_ERASE 0x0F + #define HPSA_LV_UNDERGOING_RPI 0x12 +diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c +index 11cdb172cfaf..60720e5b1ebc 100644 +--- a/drivers/scsi/scsi_devinfo.c ++++ b/drivers/scsi/scsi_devinfo.c +@@ -160,7 +160,7 @@ static struct { + {"DGC", "RAID", NULL, BLIST_SPARSELUN}, /* Dell PV 650F, storage on LUN 0 */ + {"DGC", "DISK", NULL, BLIST_SPARSELUN}, /* Dell PV 650F, no storage on LUN 0 */ + {"EMC", "Invista", "*", BLIST_SPARSELUN | BLIST_LARGELUN}, +- {"EMC", "SYMMETRIX", NULL, BLIST_SPARSELUN | BLIST_LARGELUN | BLIST_FORCELUN}, ++ {"EMC", "SYMMETRIX", NULL, BLIST_SPARSELUN | BLIST_LARGELUN | BLIST_REPORTLUN2}, + {"EMULEX", "MD21/S2 ESDI", NULL, BLIST_SINGLELUN}, + {"easyRAID", "16P", NULL, BLIST_NOREPORTLUN}, + {"easyRAID", "X6P", NULL, BLIST_NOREPORTLUN}, +diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c +index 7e1681cf287c..dd72205ba298 100644 +--- a/drivers/scsi/sd.c ++++ b/drivers/scsi/sd.c +@@ -233,11 +233,15 @@ manage_start_stop_store(struct device *dev, struct device_attribute *attr, + { + struct scsi_disk *sdkp = to_scsi_disk(dev); + struct scsi_device *sdp = sdkp->device; ++ bool v; + + if (!capable(CAP_SYS_ADMIN)) + return -EACCES; + +- sdp->manage_start_stop = simple_strtoul(buf, NULL, 10); ++ if (kstrtobool(buf, &v)) ++ return -EINVAL; ++ ++ sdp->manage_start_stop = v; + + return count; + } +@@ -255,6 +259,7 @@ static ssize_t + allow_restart_store(struct device *dev, struct device_attribute *attr, + const char *buf, size_t count) + { ++ bool v; + struct scsi_disk *sdkp = to_scsi_disk(dev); + struct scsi_device *sdp = sdkp->device; + +@@ -264,7 +269,10 @@ allow_restart_store(struct device *dev, struct device_attribute *attr, + if (sdp->type != TYPE_DISK) + return -EINVAL; + +- sdp->allow_restart = simple_strtoul(buf, NULL, 10); ++ if (kstrtobool(buf, &v)) ++ return -EINVAL; ++ ++ sdp->allow_restart = v; + + return count; + } +diff --git a/drivers/staging/vt6655/device_main.c b/drivers/staging/vt6655/device_main.c +index fefbf826c622..8fd8f3a2d1bf 100644 +--- a/drivers/staging/vt6655/device_main.c ++++ b/drivers/staging/vt6655/device_main.c +@@ -1693,10 +1693,11 @@ static int vt6655_suspend(struct pci_dev *pcid, pm_message_t state) + MACbShutdown(priv->PortOffset); + + pci_disable_device(pcid); +- pci_set_power_state(pcid, pci_choose_state(pcid, state)); + + spin_unlock_irqrestore(&priv->lock, flags); + ++ pci_set_power_state(pcid, pci_choose_state(pcid, state)); ++ + return 0; + } + +diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c +index bb73401f5761..8a4092cd97ee 100644 +--- a/drivers/target/iscsi/iscsi_target.c ++++ b/drivers/target/iscsi/iscsi_target.c +@@ -674,6 +674,7 @@ static int iscsit_add_reject_from_cmd( + unsigned char *buf) + { + struct iscsi_conn *conn; ++ const bool do_put = cmd->se_cmd.se_tfo != NULL; + + if (!cmd->conn) { + pr_err("cmd->conn is NULL for ITT: 0x%08x\n", +@@ -704,7 +705,7 @@ static int iscsit_add_reject_from_cmd( + * Perform the kref_put now if se_cmd has already been setup by + * scsit_setup_scsi_cmd() + */ +- if (cmd->se_cmd.se_tfo != NULL) { ++ if (do_put) { + pr_debug("iscsi reject: calling target_put_sess_cmd >>>>>>\n"); + target_put_sess_cmd(&cmd->se_cmd); + } +diff --git a/drivers/target/iscsi/iscsi_target_configfs.c b/drivers/target/iscsi/iscsi_target_configfs.c +index 634ad3662ed6..8c49bc3dcc8c 100644 +--- a/drivers/target/iscsi/iscsi_target_configfs.c ++++ b/drivers/target/iscsi/iscsi_target_configfs.c +@@ -1210,7 +1210,7 @@ static struct se_portal_group *lio_target_tiqn_addtpg( + + ret = core_tpg_register(wwn, &tpg->tpg_se_tpg, SCSI_PROTOCOL_ISCSI); + if (ret < 0) +- return NULL; ++ goto free_out; + + ret = iscsit_tpg_add_portal_group(tiqn, tpg); + if (ret != 0) +@@ -1222,6 +1222,7 @@ static struct se_portal_group *lio_target_tiqn_addtpg( + return &tpg->tpg_se_tpg; + out: + core_tpg_deregister(&tpg->tpg_se_tpg); ++free_out: + kfree(tpg); + return NULL; + } +diff --git a/drivers/target/target_core_alua.c b/drivers/target/target_core_alua.c +index 49aba4a31747..1fe782f9ee81 100644 +--- a/drivers/target/target_core_alua.c ++++ b/drivers/target/target_core_alua.c +@@ -1010,7 +1010,7 @@ static void core_alua_queue_state_change_ua(struct t10_alua_tg_pt_gp *tg_pt_gp) + static void core_alua_do_transition_tg_pt_work(struct work_struct *work) + { + struct t10_alua_tg_pt_gp *tg_pt_gp = container_of(work, +- struct t10_alua_tg_pt_gp, tg_pt_gp_transition_work.work); ++ struct t10_alua_tg_pt_gp, tg_pt_gp_transition_work); + struct se_device *dev = tg_pt_gp->tg_pt_gp_dev; + bool explicit = (tg_pt_gp->tg_pt_gp_alua_access_status == + ALUA_STATUS_ALTERED_BY_EXPLICIT_STPG); +@@ -1073,17 +1073,8 @@ static int core_alua_do_transition_tg_pt( + /* + * Flush any pending transitions + */ +- if (!explicit && tg_pt_gp->tg_pt_gp_implicit_trans_secs && +- atomic_read(&tg_pt_gp->tg_pt_gp_alua_access_state) == +- ALUA_ACCESS_STATE_TRANSITION) { +- /* Just in case */ +- tg_pt_gp->tg_pt_gp_alua_pending_state = new_state; +- tg_pt_gp->tg_pt_gp_transition_complete = &wait; +- flush_delayed_work(&tg_pt_gp->tg_pt_gp_transition_work); +- wait_for_completion(&wait); +- tg_pt_gp->tg_pt_gp_transition_complete = NULL; +- return 0; +- } ++ if (!explicit) ++ flush_work(&tg_pt_gp->tg_pt_gp_transition_work); + + /* + * Save the old primary ALUA access state, and set the current state +@@ -1114,17 +1105,9 @@ static int core_alua_do_transition_tg_pt( + atomic_inc(&tg_pt_gp->tg_pt_gp_ref_cnt); + spin_unlock(&dev->t10_alua.tg_pt_gps_lock); + +- if (!explicit && tg_pt_gp->tg_pt_gp_implicit_trans_secs) { +- unsigned long transition_tmo; +- +- transition_tmo = tg_pt_gp->tg_pt_gp_implicit_trans_secs * HZ; +- queue_delayed_work(tg_pt_gp->tg_pt_gp_dev->tmr_wq, +- &tg_pt_gp->tg_pt_gp_transition_work, +- transition_tmo); +- } else { ++ schedule_work(&tg_pt_gp->tg_pt_gp_transition_work); ++ if (explicit) { + tg_pt_gp->tg_pt_gp_transition_complete = &wait; +- queue_delayed_work(tg_pt_gp->tg_pt_gp_dev->tmr_wq, +- &tg_pt_gp->tg_pt_gp_transition_work, 0); + wait_for_completion(&wait); + tg_pt_gp->tg_pt_gp_transition_complete = NULL; + } +@@ -1692,8 +1675,8 @@ struct t10_alua_tg_pt_gp *core_alua_allocate_tg_pt_gp(struct se_device *dev, + mutex_init(&tg_pt_gp->tg_pt_gp_md_mutex); + spin_lock_init(&tg_pt_gp->tg_pt_gp_lock); + atomic_set(&tg_pt_gp->tg_pt_gp_ref_cnt, 0); +- INIT_DELAYED_WORK(&tg_pt_gp->tg_pt_gp_transition_work, +- core_alua_do_transition_tg_pt_work); ++ INIT_WORK(&tg_pt_gp->tg_pt_gp_transition_work, ++ core_alua_do_transition_tg_pt_work); + tg_pt_gp->tg_pt_gp_dev = dev; + atomic_set(&tg_pt_gp->tg_pt_gp_alua_access_state, + ALUA_ACCESS_STATE_ACTIVE_OPTIMIZED); +@@ -1801,7 +1784,7 @@ void core_alua_free_tg_pt_gp( + dev->t10_alua.alua_tg_pt_gps_counter--; + spin_unlock(&dev->t10_alua.tg_pt_gps_lock); + +- flush_delayed_work(&tg_pt_gp->tg_pt_gp_transition_work); ++ flush_work(&tg_pt_gp->tg_pt_gp_transition_work); + + /* + * Allow a struct t10_alua_tg_pt_gp_member * referenced by +diff --git a/drivers/target/target_core_file.c b/drivers/target/target_core_file.c +index 041a56987845..2e35db7f4aac 100644 +--- a/drivers/target/target_core_file.c ++++ b/drivers/target/target_core_file.c +@@ -466,6 +466,10 @@ fd_execute_unmap(struct se_cmd *cmd, sector_t lba, sector_t nolb) + struct inode *inode = file->f_mapping->host; + int ret; + ++ if (!nolb) { ++ return 0; ++ } ++ + if (cmd->se_dev->dev_attrib.pi_prot_type) { + ret = fd_do_prot_unmap(cmd, lba, nolb); + if (ret) +diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c +index e7933115087a..e38b4582d43e 100644 +--- a/drivers/target/target_core_pr.c ++++ b/drivers/target/target_core_pr.c +@@ -56,8 +56,10 @@ void core_pr_dump_initiator_port( + char *buf, + u32 size) + { +- if (!pr_reg->isid_present_at_reg) ++ if (!pr_reg->isid_present_at_reg) { + buf[0] = '\0'; ++ return; ++ } + + snprintf(buf, size, ",i,0x%s", pr_reg->pr_reg_isid); + } +diff --git a/drivers/thermal/step_wise.c b/drivers/thermal/step_wise.c +index ea9366ad3e6b..7814d18e8940 100644 +--- a/drivers/thermal/step_wise.c ++++ b/drivers/thermal/step_wise.c +@@ -31,8 +31,7 @@ + * If the temperature is higher than a trip point, + * a. if the trend is THERMAL_TREND_RAISING, use higher cooling + * state for this trip point +- * b. if the trend is THERMAL_TREND_DROPPING, use lower cooling +- * state for this trip point ++ * b. if the trend is THERMAL_TREND_DROPPING, do nothing + * c. if the trend is THERMAL_TREND_RAISE_FULL, use upper limit + * for this trip point + * d. if the trend is THERMAL_TREND_DROP_FULL, use lower limit +@@ -94,9 +93,11 @@ static unsigned long get_target_state(struct thermal_instance *instance, + if (!throttle) + next_target = THERMAL_NO_TARGET; + } else { +- next_target = cur_state - 1; +- if (next_target > instance->upper) +- next_target = instance->upper; ++ if (!throttle) { ++ next_target = cur_state - 1; ++ if (next_target > instance->upper) ++ next_target = instance->upper; ++ } + } + break; + case THERMAL_TREND_DROP_FULL: +diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c +index b1ece1f618c8..f6fde903fcad 100644 +--- a/drivers/usb/core/config.c ++++ b/drivers/usb/core/config.c +@@ -521,6 +521,9 @@ static int usb_parse_configuration(struct usb_device *dev, int cfgidx, + unsigned iad_num = 0; + + memcpy(&config->desc, buffer, USB_DT_CONFIG_SIZE); ++ nintf = nintf_orig = config->desc.bNumInterfaces; ++ config->desc.bNumInterfaces = 0; // Adjusted later ++ + if (config->desc.bDescriptorType != USB_DT_CONFIG || + config->desc.bLength < USB_DT_CONFIG_SIZE || + config->desc.bLength > size) { +@@ -534,7 +537,6 @@ static int usb_parse_configuration(struct usb_device *dev, int cfgidx, + buffer += config->desc.bLength; + size -= config->desc.bLength; + +- nintf = nintf_orig = config->desc.bNumInterfaces; + if (nintf > USB_MAXINTERFACES) { + dev_warn(ddev, "config %d has too many interfaces: %d, " + "using maximum allowed: %d\n", +diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c +index 6a07570a90e6..f7481c4e2bc9 100644 +--- a/drivers/usb/host/xhci-mem.c ++++ b/drivers/usb/host/xhci-mem.c +@@ -1017,10 +1017,9 @@ int xhci_alloc_virt_device(struct xhci_hcd *xhci, int slot_id, + return 0; + } + +- xhci->devs[slot_id] = kzalloc(sizeof(*xhci->devs[slot_id]), flags); +- if (!xhci->devs[slot_id]) ++ dev = kzalloc(sizeof(*dev), flags); ++ if (!dev) + return 0; +- dev = xhci->devs[slot_id]; + + /* Allocate the (output) device context that will be used in the HC. */ + dev->out_ctx = xhci_alloc_container_ctx(xhci, XHCI_CTX_TYPE_DEVICE, flags); +@@ -1068,9 +1067,17 @@ int xhci_alloc_virt_device(struct xhci_hcd *xhci, int slot_id, + &xhci->dcbaa->dev_context_ptrs[slot_id], + le64_to_cpu(xhci->dcbaa->dev_context_ptrs[slot_id])); + ++ xhci->devs[slot_id] = dev; ++ + return 1; + fail: +- xhci_free_virt_device(xhci, slot_id); ++ ++ if (dev->in_ctx) ++ xhci_free_container_ctx(xhci, dev->in_ctx); ++ if (dev->out_ctx) ++ xhci_free_container_ctx(xhci, dev->out_ctx); ++ kfree(dev); ++ + return 0; + } + +diff --git a/drivers/usb/musb/da8xx.c b/drivers/usb/musb/da8xx.c +index 9a9c82a4d35d..d6a8e325950c 100644 +--- a/drivers/usb/musb/da8xx.c ++++ b/drivers/usb/musb/da8xx.c +@@ -350,7 +350,15 @@ static irqreturn_t da8xx_musb_interrupt(int irq, void *hci) + musb->xceiv->otg->state = OTG_STATE_A_WAIT_VRISE; + portstate(musb->port1_status |= USB_PORT_STAT_POWER); + del_timer(&otg_workaround); +- } else { ++ } else if (!(musb->int_usb & MUSB_INTR_BABBLE)){ ++ /* ++ * When babble condition happens, drvvbus interrupt ++ * is also generated. Ignore this drvvbus interrupt ++ * and let babble interrupt handler recovers the ++ * controller; otherwise, the host-mode flag is lost ++ * due to the MUSB_DEV_MODE() call below and babble ++ * recovery logic will not called. ++ */ + musb->is_active = 0; + MUSB_DEV_MODE(musb); + otg->default_a = 0; +diff --git a/drivers/usb/phy/phy-isp1301.c b/drivers/usb/phy/phy-isp1301.c +index db68156568e6..b3b33cf7ddf6 100644 +--- a/drivers/usb/phy/phy-isp1301.c ++++ b/drivers/usb/phy/phy-isp1301.c +@@ -33,6 +33,12 @@ static const struct i2c_device_id isp1301_id[] = { + }; + MODULE_DEVICE_TABLE(i2c, isp1301_id); + ++static const struct of_device_id isp1301_of_match[] = { ++ {.compatible = "nxp,isp1301" }, ++ { }, ++}; ++MODULE_DEVICE_TABLE(of, isp1301_of_match); ++ + static struct i2c_client *isp1301_i2c_client; + + static int __isp1301_write(struct isp1301 *isp, u8 reg, u8 value, u8 clear) +@@ -130,6 +136,7 @@ static int isp1301_remove(struct i2c_client *client) + static struct i2c_driver isp1301_driver = { + .driver = { + .name = DRV_NAME, ++ .of_match_table = of_match_ptr(isp1301_of_match), + }, + .probe = isp1301_probe, + .remove = isp1301_remove, +diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h +index fb96755550ec..c10eceb76c39 100644 +--- a/drivers/usb/storage/unusual_devs.h ++++ b/drivers/usb/storage/unusual_devs.h +@@ -2149,6 +2149,13 @@ UNUSUAL_DEV(0x152d, 0x9561, 0x0000, 0x9999, + USB_SC_DEVICE, USB_PR_DEVICE, NULL, + US_FL_NO_REPORT_OPCODES), + ++/* Reported by David Kozub <zub@linux.fjfi.cvut.cz> */ ++UNUSUAL_DEV(0x152d, 0x0578, 0x0000, 0x9999, ++ "JMicron", ++ "JMS567", ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, ++ US_FL_BROKEN_FUA), ++ + /* + * Patch by Constantin Baranov <const@tltsu.ru> + * Report by Andreas Koenecke. +diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h +index a37ed1e59e99..2f80163ffb94 100644 +--- a/drivers/usb/storage/unusual_uas.h ++++ b/drivers/usb/storage/unusual_uas.h +@@ -141,6 +141,13 @@ UNUSUAL_DEV(0x152d, 0x0567, 0x0000, 0x9999, + USB_SC_DEVICE, USB_PR_DEVICE, NULL, + US_FL_BROKEN_FUA | US_FL_NO_REPORT_OPCODES), + ++/* Reported-by: David Kozub <zub@linux.fjfi.cvut.cz> */ ++UNUSUAL_DEV(0x152d, 0x0578, 0x0000, 0x9999, ++ "JMicron", ++ "JMS567", ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, ++ US_FL_BROKEN_FUA), ++ + /* Reported-by: Hans de Goede <hdegoede@redhat.com> */ + UNUSUAL_DEV(0x2109, 0x0711, 0x0000, 0x9999, + "VIA", +diff --git a/drivers/usb/usbip/stub_tx.c b/drivers/usb/usbip/stub_tx.c +index 021003c4de53..af858d52608a 100644 +--- a/drivers/usb/usbip/stub_tx.c ++++ b/drivers/usb/usbip/stub_tx.c +@@ -178,6 +178,13 @@ static int stub_send_ret_submit(struct stub_device *sdev) + memset(&pdu_header, 0, sizeof(pdu_header)); + memset(&msg, 0, sizeof(msg)); + ++ if (urb->actual_length > 0 && !urb->transfer_buffer) { ++ dev_err(&sdev->udev->dev, ++ "urb: actual_length %d transfer_buffer null\n", ++ urb->actual_length); ++ return -1; ++ } ++ + if (usb_pipetype(urb->pipe) == PIPE_ISOCHRONOUS) + iovnum = 2 + urb->number_of_packets; + else +diff --git a/drivers/video/fbdev/au1200fb.c b/drivers/video/fbdev/au1200fb.c +index f9507b1894df..789d3f16ff9f 100644 +--- a/drivers/video/fbdev/au1200fb.c ++++ b/drivers/video/fbdev/au1200fb.c +@@ -1680,8 +1680,10 @@ static int au1200fb_drv_probe(struct platform_device *dev) + + fbi = framebuffer_alloc(sizeof(struct au1200fb_device), + &dev->dev); +- if (!fbi) ++ if (!fbi) { ++ ret = -ENOMEM; + goto failed; ++ } + + _au1200fb_infos[plane] = fbi; + fbdev = fbi->par; +@@ -1699,7 +1701,8 @@ static int au1200fb_drv_probe(struct platform_device *dev) + if (!fbdev->fb_mem) { + print_err("fail to allocate frambuffer (size: %dK))", + fbdev->fb_len / 1024); +- return -ENOMEM; ++ ret = -ENOMEM; ++ goto failed; + } + + /* +diff --git a/drivers/video/fbdev/controlfb.h b/drivers/video/fbdev/controlfb.h +index 6026c60fc100..261522fabdac 100644 +--- a/drivers/video/fbdev/controlfb.h ++++ b/drivers/video/fbdev/controlfb.h +@@ -141,5 +141,7 @@ static struct max_cmodes control_mac_modes[] = { + {{ 1, 2}}, /* 1152x870, 75Hz */ + {{ 0, 1}}, /* 1280x960, 75Hz */ + {{ 0, 1}}, /* 1280x1024, 75Hz */ ++ {{ 1, 2}}, /* 1152x768, 60Hz */ ++ {{ 0, 1}}, /* 1600x1024, 60Hz */ + }; + +diff --git a/drivers/video/fbdev/udlfb.c b/drivers/video/fbdev/udlfb.c +index e9c2f7ba3c8e..53326badfb61 100644 +--- a/drivers/video/fbdev/udlfb.c ++++ b/drivers/video/fbdev/udlfb.c +@@ -769,11 +769,11 @@ static int dlfb_get_edid(struct dlfb_data *dev, char *edid, int len) + + for (i = 0; i < len; i++) { + ret = usb_control_msg(dev->udev, +- usb_rcvctrlpipe(dev->udev, 0), (0x02), +- (0x80 | (0x02 << 5)), i << 8, 0xA1, rbuf, 2, +- HZ); +- if (ret < 1) { +- pr_err("Read EDID byte %d failed err %x\n", i, ret); ++ usb_rcvctrlpipe(dev->udev, 0), 0x02, ++ (0x80 | (0x02 << 5)), i << 8, 0xA1, ++ rbuf, 2, USB_CTRL_GET_TIMEOUT); ++ if (ret < 2) { ++ pr_err("Read EDID byte %d failed: %d\n", i, ret); + i--; + break; + } +diff --git a/fs/afs/callback.c b/fs/afs/callback.c +index 7ef637d7f3a5..7d54efd73519 100644 +--- a/fs/afs/callback.c ++++ b/fs/afs/callback.c +@@ -362,7 +362,7 @@ static void afs_callback_updater(struct work_struct *work) + { + struct afs_server *server; + struct afs_vnode *vnode, *xvnode; +- time_t now; ++ time64_t now; + long timeout; + int ret; + +@@ -370,7 +370,7 @@ static void afs_callback_updater(struct work_struct *work) + + _enter(""); + +- now = get_seconds(); ++ now = ktime_get_real_seconds(); + + /* find the first vnode to update */ + spin_lock(&server->cb_lock); +@@ -424,7 +424,8 @@ static void afs_callback_updater(struct work_struct *work) + + /* and then reschedule */ + _debug("reschedule"); +- vnode->update_at = get_seconds() + afs_vnode_update_timeout; ++ vnode->update_at = ktime_get_real_seconds() + ++ afs_vnode_update_timeout; + + spin_lock(&server->cb_lock); + +diff --git a/fs/afs/file.c b/fs/afs/file.c +index 999bc3caec92..cf8a07e282a6 100644 +--- a/fs/afs/file.c ++++ b/fs/afs/file.c +@@ -29,6 +29,7 @@ static int afs_readpages(struct file *filp, struct address_space *mapping, + + const struct file_operations afs_file_operations = { + .open = afs_open, ++ .flush = afs_flush, + .release = afs_release, + .llseek = generic_file_llseek, + .read_iter = generic_file_read_iter, +diff --git a/fs/afs/fsclient.c b/fs/afs/fsclient.c +index c2e930ec2888..10ce44214005 100644 +--- a/fs/afs/fsclient.c ++++ b/fs/afs/fsclient.c +@@ -105,7 +105,7 @@ static void xdr_decode_AFSFetchStatus(const __be32 **_bp, + vnode->vfs_inode.i_mode = mode; + } + +- vnode->vfs_inode.i_ctime.tv_sec = status->mtime_server; ++ vnode->vfs_inode.i_ctime.tv_sec = status->mtime_client; + vnode->vfs_inode.i_mtime = vnode->vfs_inode.i_ctime; + vnode->vfs_inode.i_atime = vnode->vfs_inode.i_ctime; + vnode->vfs_inode.i_version = data_version; +@@ -139,7 +139,7 @@ static void xdr_decode_AFSCallBack(const __be32 **_bp, struct afs_vnode *vnode) + vnode->cb_version = ntohl(*bp++); + vnode->cb_expiry = ntohl(*bp++); + vnode->cb_type = ntohl(*bp++); +- vnode->cb_expires = vnode->cb_expiry + get_seconds(); ++ vnode->cb_expires = vnode->cb_expiry + ktime_get_real_seconds(); + *_bp = bp; + } + +@@ -703,8 +703,8 @@ int afs_fs_create(struct afs_server *server, + memset(bp, 0, padsz); + bp = (void *) bp + padsz; + } +- *bp++ = htonl(AFS_SET_MODE); +- *bp++ = 0; /* mtime */ ++ *bp++ = htonl(AFS_SET_MODE | AFS_SET_MTIME); ++ *bp++ = htonl(vnode->vfs_inode.i_mtime.tv_sec); /* mtime */ + *bp++ = 0; /* owner */ + *bp++ = 0; /* group */ + *bp++ = htonl(mode & S_IALLUGO); /* unix mode */ +@@ -981,8 +981,8 @@ int afs_fs_symlink(struct afs_server *server, + memset(bp, 0, c_padsz); + bp = (void *) bp + c_padsz; + } +- *bp++ = htonl(AFS_SET_MODE); +- *bp++ = 0; /* mtime */ ++ *bp++ = htonl(AFS_SET_MODE | AFS_SET_MTIME); ++ *bp++ = htonl(vnode->vfs_inode.i_mtime.tv_sec); /* mtime */ + *bp++ = 0; /* owner */ + *bp++ = 0; /* group */ + *bp++ = htonl(S_IRWXUGO); /* unix mode */ +@@ -1192,8 +1192,8 @@ static int afs_fs_store_data64(struct afs_server *server, + *bp++ = htonl(vnode->fid.vnode); + *bp++ = htonl(vnode->fid.unique); + +- *bp++ = 0; /* mask */ +- *bp++ = 0; /* mtime */ ++ *bp++ = htonl(AFS_SET_MTIME); /* mask */ ++ *bp++ = htonl(vnode->vfs_inode.i_mtime.tv_sec); /* mtime */ + *bp++ = 0; /* owner */ + *bp++ = 0; /* group */ + *bp++ = 0; /* unix mode */ +@@ -1225,7 +1225,7 @@ int afs_fs_store_data(struct afs_server *server, struct afs_writeback *wb, + _enter(",%x,{%x:%u},,", + key_serial(wb->key), vnode->fid.vid, vnode->fid.vnode); + +- size = to - offset; ++ size = (loff_t)to - (loff_t)offset; + if (first != last) + size += (loff_t)(last - first) << PAGE_SHIFT; + pos = (loff_t)first << PAGE_SHIFT; +@@ -1269,8 +1269,8 @@ int afs_fs_store_data(struct afs_server *server, struct afs_writeback *wb, + *bp++ = htonl(vnode->fid.vnode); + *bp++ = htonl(vnode->fid.unique); + +- *bp++ = 0; /* mask */ +- *bp++ = 0; /* mtime */ ++ *bp++ = htonl(AFS_SET_MTIME); /* mask */ ++ *bp++ = htonl(vnode->vfs_inode.i_mtime.tv_sec); /* mtime */ + *bp++ = 0; /* owner */ + *bp++ = 0; /* group */ + *bp++ = 0; /* unix mode */ +diff --git a/fs/afs/inode.c b/fs/afs/inode.c +index e06f5a23352a..f8fa92b1d43c 100644 +--- a/fs/afs/inode.c ++++ b/fs/afs/inode.c +@@ -69,9 +69,9 @@ static int afs_inode_map_status(struct afs_vnode *vnode, struct key *key) + + set_nlink(inode, vnode->status.nlink); + inode->i_uid = vnode->status.owner; +- inode->i_gid = GLOBAL_ROOT_GID; ++ inode->i_gid = vnode->status.group; + inode->i_size = vnode->status.size; +- inode->i_ctime.tv_sec = vnode->status.mtime_server; ++ inode->i_ctime.tv_sec = vnode->status.mtime_client; + inode->i_ctime.tv_nsec = 0; + inode->i_atime = inode->i_mtime = inode->i_ctime; + inode->i_blocks = 0; +@@ -244,12 +244,13 @@ struct inode *afs_iget(struct super_block *sb, struct key *key, + vnode->cb_version = 0; + vnode->cb_expiry = 0; + vnode->cb_type = 0; +- vnode->cb_expires = get_seconds(); ++ vnode->cb_expires = ktime_get_real_seconds(); + } else { + vnode->cb_version = cb->version; + vnode->cb_expiry = cb->expiry; + vnode->cb_type = cb->type; +- vnode->cb_expires = vnode->cb_expiry + get_seconds(); ++ vnode->cb_expires = vnode->cb_expiry + ++ ktime_get_real_seconds(); + } + } + +@@ -322,7 +323,7 @@ int afs_validate(struct afs_vnode *vnode, struct key *key) + !test_bit(AFS_VNODE_CB_BROKEN, &vnode->flags) && + !test_bit(AFS_VNODE_MODIFIED, &vnode->flags) && + !test_bit(AFS_VNODE_ZAP_DATA, &vnode->flags)) { +- if (vnode->cb_expires < get_seconds() + 10) { ++ if (vnode->cb_expires < ktime_get_real_seconds() + 10) { + _debug("callback expired"); + set_bit(AFS_VNODE_CB_BROKEN, &vnode->flags); + } else { +diff --git a/fs/afs/internal.h b/fs/afs/internal.h +index 71d5982312f3..1330b2a695ff 100644 +--- a/fs/afs/internal.h ++++ b/fs/afs/internal.h +@@ -11,6 +11,7 @@ + + #include <linux/compiler.h> + #include <linux/kernel.h> ++#include <linux/ktime.h> + #include <linux/fs.h> + #include <linux/pagemap.h> + #include <linux/skbuff.h> +@@ -247,7 +248,7 @@ struct afs_cache_vhash { + */ + struct afs_vlocation { + atomic_t usage; +- time_t time_of_death; /* time at which put reduced usage to 0 */ ++ time64_t time_of_death; /* time at which put reduced usage to 0 */ + struct list_head link; /* link in cell volume location list */ + struct list_head grave; /* link in master graveyard list */ + struct list_head update; /* link in master update list */ +@@ -258,7 +259,7 @@ struct afs_vlocation { + struct afs_cache_vlocation vldb; /* volume information DB record */ + struct afs_volume *vols[3]; /* volume access record pointer (index by type) */ + wait_queue_head_t waitq; /* status change waitqueue */ +- time_t update_at; /* time at which record should be updated */ ++ time64_t update_at; /* time at which record should be updated */ + spinlock_t lock; /* access lock */ + afs_vlocation_state_t state; /* volume location state */ + unsigned short upd_rej_cnt; /* ENOMEDIUM count during update */ +@@ -271,7 +272,7 @@ struct afs_vlocation { + */ + struct afs_server { + atomic_t usage; +- time_t time_of_death; /* time at which put reduced usage to 0 */ ++ time64_t time_of_death; /* time at which put reduced usage to 0 */ + struct in_addr addr; /* server address */ + struct afs_cell *cell; /* cell in which server resides */ + struct list_head link; /* link in cell's server list */ +@@ -374,8 +375,8 @@ struct afs_vnode { + struct rb_node server_rb; /* link in server->fs_vnodes */ + struct rb_node cb_promise; /* link in server->cb_promises */ + struct work_struct cb_broken_work; /* work to be done on callback break */ +- time_t cb_expires; /* time at which callback expires */ +- time_t cb_expires_at; /* time used to order cb_promise */ ++ time64_t cb_expires; /* time at which callback expires */ ++ time64_t cb_expires_at; /* time used to order cb_promise */ + unsigned cb_version; /* callback version */ + unsigned cb_expiry; /* callback expiry time */ + afs_callback_type_t cb_type; /* type of callback */ +@@ -749,6 +750,7 @@ extern int afs_writepages(struct address_space *, struct writeback_control *); + extern void afs_pages_written_back(struct afs_vnode *, struct afs_call *); + extern ssize_t afs_file_write(struct kiocb *, struct iov_iter *); + extern int afs_writeback_all(struct afs_vnode *); ++extern int afs_flush(struct file *, fl_owner_t); + extern int afs_fsync(struct file *, loff_t, loff_t, int); + + +diff --git a/fs/afs/security.c b/fs/afs/security.c +index 8d010422dc89..bfa9d3428383 100644 +--- a/fs/afs/security.c ++++ b/fs/afs/security.c +@@ -340,17 +340,22 @@ int afs_permission(struct inode *inode, int mask) + } else { + if (!(access & AFS_ACE_LOOKUP)) + goto permission_denied; ++ if ((mask & MAY_EXEC) && !(inode->i_mode & S_IXUSR)) ++ goto permission_denied; + if (mask & (MAY_EXEC | MAY_READ)) { + if (!(access & AFS_ACE_READ)) + goto permission_denied; ++ if (!(inode->i_mode & S_IRUSR)) ++ goto permission_denied; + } else if (mask & MAY_WRITE) { + if (!(access & AFS_ACE_WRITE)) + goto permission_denied; ++ if (!(inode->i_mode & S_IWUSR)) ++ goto permission_denied; + } + } + + key_put(key); +- ret = generic_permission(inode, mask); + _leave(" = %d", ret); + return ret; + +diff --git a/fs/afs/server.c b/fs/afs/server.c +index f342acf3547d..3bc1a46f0bd6 100644 +--- a/fs/afs/server.c ++++ b/fs/afs/server.c +@@ -237,7 +237,7 @@ void afs_put_server(struct afs_server *server) + spin_lock(&afs_server_graveyard_lock); + if (atomic_read(&server->usage) == 0) { + list_move_tail(&server->grave, &afs_server_graveyard); +- server->time_of_death = get_seconds(); ++ server->time_of_death = ktime_get_real_seconds(); + queue_delayed_work(afs_wq, &afs_server_reaper, + afs_server_timeout * HZ); + } +@@ -272,9 +272,9 @@ static void afs_reap_server(struct work_struct *work) + LIST_HEAD(corpses); + struct afs_server *server; + unsigned long delay, expiry; +- time_t now; ++ time64_t now; + +- now = get_seconds(); ++ now = ktime_get_real_seconds(); + spin_lock(&afs_server_graveyard_lock); + + while (!list_empty(&afs_server_graveyard)) { +diff --git a/fs/afs/vlocation.c b/fs/afs/vlocation.c +index 52976785a32c..ee9015c0db5a 100644 +--- a/fs/afs/vlocation.c ++++ b/fs/afs/vlocation.c +@@ -340,7 +340,8 @@ static void afs_vlocation_queue_for_updates(struct afs_vlocation *vl) + struct afs_vlocation *xvl; + + /* wait at least 10 minutes before updating... */ +- vl->update_at = get_seconds() + afs_vlocation_update_timeout; ++ vl->update_at = ktime_get_real_seconds() + ++ afs_vlocation_update_timeout; + + spin_lock(&afs_vlocation_updates_lock); + +@@ -506,7 +507,7 @@ void afs_put_vlocation(struct afs_vlocation *vl) + if (atomic_read(&vl->usage) == 0) { + _debug("buried"); + list_move_tail(&vl->grave, &afs_vlocation_graveyard); +- vl->time_of_death = get_seconds(); ++ vl->time_of_death = ktime_get_real_seconds(); + queue_delayed_work(afs_wq, &afs_vlocation_reap, + afs_vlocation_timeout * HZ); + +@@ -543,11 +544,11 @@ static void afs_vlocation_reaper(struct work_struct *work) + LIST_HEAD(corpses); + struct afs_vlocation *vl; + unsigned long delay, expiry; +- time_t now; ++ time64_t now; + + _enter(""); + +- now = get_seconds(); ++ now = ktime_get_real_seconds(); + spin_lock(&afs_vlocation_graveyard_lock); + + while (!list_empty(&afs_vlocation_graveyard)) { +@@ -622,13 +623,13 @@ static void afs_vlocation_updater(struct work_struct *work) + { + struct afs_cache_vlocation vldb; + struct afs_vlocation *vl, *xvl; +- time_t now; ++ time64_t now; + long timeout; + int ret; + + _enter(""); + +- now = get_seconds(); ++ now = ktime_get_real_seconds(); + + /* find a record to update */ + spin_lock(&afs_vlocation_updates_lock); +@@ -684,7 +685,8 @@ static void afs_vlocation_updater(struct work_struct *work) + + /* and then reschedule */ + _debug("reschedule"); +- vl->update_at = get_seconds() + afs_vlocation_update_timeout; ++ vl->update_at = ktime_get_real_seconds() + ++ afs_vlocation_update_timeout; + + spin_lock(&afs_vlocation_updates_lock); + +diff --git a/fs/afs/write.c b/fs/afs/write.c +index 0714abcd7f32..5cfc05ca184c 100644 +--- a/fs/afs/write.c ++++ b/fs/afs/write.c +@@ -148,12 +148,12 @@ int afs_write_begin(struct file *file, struct address_space *mapping, + kfree(candidate); + return -ENOMEM; + } +- *pagep = page; +- /* page won't leak in error case: it eventually gets cleaned off LRU */ + + if (!PageUptodate(page) && len != PAGE_CACHE_SIZE) { + ret = afs_fill_page(vnode, key, index << PAGE_CACHE_SHIFT, page); + if (ret < 0) { ++ unlock_page(page); ++ put_page(page); + kfree(candidate); + _leave(" = %d [prep]", ret); + return ret; +@@ -161,6 +161,9 @@ int afs_write_begin(struct file *file, struct address_space *mapping, + SetPageUptodate(page); + } + ++ /* page won't leak in error case: it eventually gets cleaned off LRU */ ++ *pagep = page; ++ + try_again: + spin_lock(&vnode->writeback_lock); + +@@ -296,10 +299,14 @@ static void afs_kill_pages(struct afs_vnode *vnode, bool error, + ASSERTCMP(pv.nr, ==, count); + + for (loop = 0; loop < count; loop++) { +- ClearPageUptodate(pv.pages[loop]); ++ struct page *page = pv.pages[loop]; ++ ClearPageUptodate(page); + if (error) +- SetPageError(pv.pages[loop]); +- end_page_writeback(pv.pages[loop]); ++ SetPageError(page); ++ if (PageWriteback(page)) ++ end_page_writeback(page); ++ if (page->index >= first) ++ first = page->index + 1; + } + + __pagevec_release(&pv); +@@ -503,6 +510,7 @@ static int afs_writepages_region(struct address_space *mapping, + + if (PageWriteback(page) || !PageDirty(page)) { + unlock_page(page); ++ put_page(page); + continue; + } + +@@ -739,6 +747,20 @@ out: + return ret; + } + ++/* ++ * Flush out all outstanding writes on a file opened for writing when it is ++ * closed. ++ */ ++int afs_flush(struct file *file, fl_owner_t id) ++{ ++ _enter(""); ++ ++ if ((file->f_mode & FMODE_WRITE) == 0) ++ return 0; ++ ++ return vfs_fsync(file, 0); ++} ++ + /* + * notification that a previously read-only page is about to become writable + * - if it returns an error, the caller will deliver a bus error signal +diff --git a/fs/autofs4/waitq.c b/fs/autofs4/waitq.c +index fe6e7050fe50..98198c57370b 100644 +--- a/fs/autofs4/waitq.c ++++ b/fs/autofs4/waitq.c +@@ -174,7 +174,6 @@ static void autofs4_notify_daemon(struct autofs_sb_info *sbi, + + mutex_unlock(&sbi->wq_mutex); + +- if (autofs4_write(sbi, pipe, &pkt, pktsz)) + switch (ret = autofs4_write(sbi, pipe, &pkt, pktsz)) { + case 0: + break; +diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c +index bebd6517355d..af1da85da509 100644 +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -6735,6 +6735,20 @@ static noinline int uncompress_inline(struct btrfs_path *path, + max_size = min_t(unsigned long, PAGE_CACHE_SIZE, max_size); + ret = btrfs_decompress(compress_type, tmp, page, + extent_offset, inline_size, max_size); ++ ++ /* ++ * decompression code contains a memset to fill in any space between the end ++ * of the uncompressed data and the end of max_size in case the decompressed ++ * data ends up shorter than ram_bytes. That doesn't cover the hole between ++ * the end of an inline extent and the beginning of the next block, so we ++ * cover that region here. ++ */ ++ ++ if (max_size + pg_offset < PAGE_SIZE) { ++ char *map = kmap(page); ++ memset(map + pg_offset + max_size, 0, PAGE_SIZE - max_size - pg_offset); ++ kunmap(page); ++ } + kfree(tmp); + return ret; + } +diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c +index ead89489ae71..35e6e0b2cf34 100644 +--- a/fs/ceph/mds_client.c ++++ b/fs/ceph/mds_client.c +@@ -1400,6 +1400,29 @@ static int __close_session(struct ceph_mds_client *mdsc, + return request_close_session(mdsc, session); + } + ++static bool drop_negative_children(struct dentry *dentry) ++{ ++ struct dentry *child; ++ bool all_negative = true; ++ ++ if (!d_is_dir(dentry)) ++ goto out; ++ ++ spin_lock(&dentry->d_lock); ++ list_for_each_entry(child, &dentry->d_subdirs, d_child) { ++ if (d_really_is_positive(child)) { ++ all_negative = false; ++ break; ++ } ++ } ++ spin_unlock(&dentry->d_lock); ++ ++ if (all_negative) ++ shrink_dcache_parent(dentry); ++out: ++ return all_negative; ++} ++ + /* + * Trim old(er) caps. + * +@@ -1445,16 +1468,27 @@ static int trim_caps_cb(struct inode *inode, struct ceph_cap *cap, void *arg) + if ((used | wanted) & ~oissued & mine) + goto out; /* we need these caps */ + +- session->s_trim_caps--; + if (oissued) { + /* we aren't the only cap.. just remove us */ + __ceph_remove_cap(cap, true); ++ session->s_trim_caps--; + } else { ++ struct dentry *dentry; + /* try dropping referring dentries */ + spin_unlock(&ci->i_ceph_lock); +- d_prune_aliases(inode); +- dout("trim_caps_cb %p cap %p pruned, count now %d\n", +- inode, cap, atomic_read(&inode->i_count)); ++ dentry = d_find_any_alias(inode); ++ if (dentry && drop_negative_children(dentry)) { ++ int count; ++ dput(dentry); ++ d_prune_aliases(inode); ++ count = atomic_read(&inode->i_count); ++ if (count == 1) ++ session->s_trim_caps--; ++ dout("trim_caps_cb %p cap %p pruned, count now %d\n", ++ inode, cap, count); ++ } else { ++ dput(dentry); ++ } + return 0; + } + +diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c +index 31a3e480d484..403c4bae3e18 100644 +--- a/fs/ext4/extents.c ++++ b/fs/ext4/extents.c +@@ -4746,6 +4746,7 @@ retry: + EXT4_INODE_EOFBLOCKS); + } + ext4_mark_inode_dirty(handle, inode); ++ ext4_update_inode_fsync_trans(handle, inode, 1); + ret2 = ext4_journal_stop(handle); + if (ret2) + break; +diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c +index 6445d84266fa..4c36dca486cc 100644 +--- a/fs/ext4/namei.c ++++ b/fs/ext4/namei.c +@@ -1403,6 +1403,10 @@ static struct buffer_head * ext4_find_entry (struct inode *dir, + "falling back\n")); + } + nblocks = dir->i_size >> EXT4_BLOCK_SIZE_BITS(sb); ++ if (!nblocks) { ++ ret = NULL; ++ goto cleanup_and_exit; ++ } + start = EXT4_I(dir)->i_dir_start_lookup; + if (start >= nblocks) + start = 0; +diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c +index 60d6fc2e0e4b..22b30249fbcb 100644 +--- a/fs/fs-writeback.c ++++ b/fs/fs-writeback.c +@@ -173,19 +173,33 @@ static void wb_wakeup(struct bdi_writeback *wb) + spin_unlock_bh(&wb->work_lock); + } + ++static void finish_writeback_work(struct bdi_writeback *wb, ++ struct wb_writeback_work *work) ++{ ++ struct wb_completion *done = work->done; ++ ++ if (work->auto_free) ++ kfree(work); ++ if (done && atomic_dec_and_test(&done->cnt)) ++ wake_up_all(&wb->bdi->wb_waitq); ++} ++ + static void wb_queue_work(struct bdi_writeback *wb, + struct wb_writeback_work *work) + { + trace_writeback_queue(wb, work); + +- spin_lock_bh(&wb->work_lock); +- if (!test_bit(WB_registered, &wb->state)) +- goto out_unlock; + if (work->done) + atomic_inc(&work->done->cnt); +- list_add_tail(&work->list, &wb->work_list); +- mod_delayed_work(bdi_wq, &wb->dwork, 0); +-out_unlock: ++ ++ spin_lock_bh(&wb->work_lock); ++ ++ if (test_bit(WB_registered, &wb->state)) { ++ list_add_tail(&work->list, &wb->work_list); ++ mod_delayed_work(bdi_wq, &wb->dwork, 0); ++ } else ++ finish_writeback_work(wb, work); ++ + spin_unlock_bh(&wb->work_lock); + } + +@@ -1839,16 +1853,9 @@ static long wb_do_writeback(struct bdi_writeback *wb) + + set_bit(WB_writeback_running, &wb->state); + while ((work = get_next_work_item(wb)) != NULL) { +- struct wb_completion *done = work->done; +- + trace_writeback_exec(wb, work); +- + wrote += wb_writeback(wb, work); +- +- if (work->auto_free) +- kfree(work); +- if (done && atomic_dec_and_test(&done->cnt)) +- wake_up_all(&wb->bdi->wb_waitq); ++ finish_writeback_work(wb, work); + } + + /* +diff --git a/fs/gfs2/file.c b/fs/gfs2/file.c +index 5e425469f0c2..1543aa1b2a93 100644 +--- a/fs/gfs2/file.c ++++ b/fs/gfs2/file.c +@@ -255,7 +255,7 @@ static int do_gfs2_set_flags(struct file *filp, u32 reqflags, u32 mask) + goto out; + } + if ((flags ^ new_flags) & GFS2_DIF_JDATA) { +- if (flags & GFS2_DIF_JDATA) ++ if (new_flags & GFS2_DIF_JDATA) + gfs2_log_flush(sdp, ip->i_gl, NORMAL_FLUSH); + error = filemap_fdatawrite(inode->i_mapping); + if (error) +@@ -263,6 +263,8 @@ static int do_gfs2_set_flags(struct file *filp, u32 reqflags, u32 mask) + error = filemap_fdatawait(inode->i_mapping); + if (error) + goto out; ++ if (new_flags & GFS2_DIF_JDATA) ++ gfs2_ordered_del_inode(ip); + } + error = gfs2_trans_begin(sdp, RES_DINODE, 0); + if (error) +diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c +index 10410e8b5853..63498e1a542a 100644 +--- a/fs/nfs/nfs4client.c ++++ b/fs/nfs/nfs4client.c +@@ -895,9 +895,9 @@ static void nfs4_session_set_rwsize(struct nfs_server *server) + server_resp_sz = sess->fc_attrs.max_resp_sz - nfs41_maxread_overhead; + server_rqst_sz = sess->fc_attrs.max_rqst_sz - nfs41_maxwrite_overhead; + +- if (server->rsize > server_resp_sz) ++ if (!server->rsize || server->rsize > server_resp_sz) + server->rsize = server_resp_sz; +- if (server->wsize > server_rqst_sz) ++ if (!server->wsize || server->wsize > server_rqst_sz) + server->wsize = server_rqst_sz; + #endif /* CONFIG_NFS_V4_1 */ + } +diff --git a/fs/nfsd/nfssvc.c b/fs/nfsd/nfssvc.c +index 5be1fa6b676d..b6eb56d18568 100644 +--- a/fs/nfsd/nfssvc.c ++++ b/fs/nfsd/nfssvc.c +@@ -151,7 +151,8 @@ int nfsd_vers(int vers, enum vers_op change) + + int nfsd_minorversion(u32 minorversion, enum vers_op change) + { +- if (minorversion > NFSD_SUPPORTED_MINOR_VERSION) ++ if (minorversion > NFSD_SUPPORTED_MINOR_VERSION && ++ change != NFSD_AVAIL) + return -1; + switch(change) { + case NFSD_SET: +@@ -329,23 +330,20 @@ static void nfsd_last_thread(struct svc_serv *serv, struct net *net) + + void nfsd_reset_versions(void) + { +- int found_one = 0; + int i; + +- for (i = NFSD_MINVERS; i < NFSD_NRVERS; i++) { +- if (nfsd_program.pg_vers[i]) +- found_one = 1; +- } +- +- if (!found_one) { +- for (i = NFSD_MINVERS; i < NFSD_NRVERS; i++) +- nfsd_program.pg_vers[i] = nfsd_version[i]; +-#if defined(CONFIG_NFSD_V2_ACL) || defined(CONFIG_NFSD_V3_ACL) +- for (i = NFSD_ACL_MINVERS; i < NFSD_ACL_NRVERS; i++) +- nfsd_acl_program.pg_vers[i] = +- nfsd_acl_version[i]; +-#endif +- } ++ for (i = 0; i < NFSD_NRVERS; i++) ++ if (nfsd_vers(i, NFSD_TEST)) ++ return; ++ ++ for (i = 0; i < NFSD_NRVERS; i++) ++ if (i != 4) ++ nfsd_vers(i, NFSD_SET); ++ else { ++ int minor = 0; ++ while (nfsd_minorversion(minor, NFSD_SET) >= 0) ++ minor++; ++ } + } + + /* +diff --git a/fs/proc/proc_tty.c b/fs/proc/proc_tty.c +index 15f327bed8c6..7340c36978a3 100644 +--- a/fs/proc/proc_tty.c ++++ b/fs/proc/proc_tty.c +@@ -14,6 +14,7 @@ + #include <linux/tty.h> + #include <linux/seq_file.h> + #include <linux/bitops.h> ++#include "internal.h" + + /* + * The /proc/tty directory inodes... +@@ -164,7 +165,7 @@ void proc_tty_unregister_driver(struct tty_driver *driver) + if (!ent) + return; + +- remove_proc_entry(driver->driver_name, proc_tty_driver); ++ remove_proc_entry(ent->name, proc_tty_driver); + + driver->proc_entry = NULL; + } +diff --git a/fs/udf/super.c b/fs/udf/super.c +index 81155b9b445b..ee09c97f3ab2 100644 +--- a/fs/udf/super.c ++++ b/fs/udf/super.c +@@ -705,7 +705,7 @@ static loff_t udf_check_vsd(struct super_block *sb) + else + sectorsize = sb->s_blocksize; + +- sector += (sbi->s_session << sb->s_blocksize_bits); ++ sector += (((loff_t)sbi->s_session) << sb->s_blocksize_bits); + + udf_debug("Starting at sector %u (%ld byte sectors)\n", + (unsigned int)(sector >> sb->s_blocksize_bits), +diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c +index 66cdb44616d5..59d58bdad7d3 100644 +--- a/fs/userfaultfd.c ++++ b/fs/userfaultfd.c +@@ -386,7 +386,7 @@ int handle_userfault(struct vm_area_struct *vma, unsigned long address, + * in such case. + */ + down_read(&mm->mmap_sem); +- ret = 0; ++ ret = VM_FAULT_NOPAGE; + } + } + +diff --git a/fs/xfs/libxfs/xfs_bmap.c b/fs/xfs/libxfs/xfs_bmap.c +index 75884aecf920..d98ba57ef01a 100644 +--- a/fs/xfs/libxfs/xfs_bmap.c ++++ b/fs/xfs/libxfs/xfs_bmap.c +@@ -2670,7 +2670,7 @@ xfs_bmap_add_extent_unwritten_real( + &i))) + goto done; + XFS_WANT_CORRUPTED_GOTO(mp, i == 0, done); +- cur->bc_rec.b.br_state = XFS_EXT_NORM; ++ cur->bc_rec.b.br_state = new->br_state; + if ((error = xfs_btree_insert(cur, &i))) + goto done; + XFS_WANT_CORRUPTED_GOTO(mp, i == 1, done); +diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c +index 8cab78eeb0c2..b34d1685936d 100644 +--- a/fs/xfs/xfs_log_recover.c ++++ b/fs/xfs/xfs_log_recover.c +@@ -738,7 +738,7 @@ xlog_find_head( + * in the in-core log. The following number can be made tighter if + * we actually look at the block size of the filesystem. + */ +- num_scan_bblks = XLOG_TOTAL_REC_SHIFT(log); ++ num_scan_bblks = min_t(int, log_bbnum, XLOG_TOTAL_REC_SHIFT(log)); + if (head_blk >= num_scan_bblks) { + /* + * We are guaranteed that the entire check can be performed +diff --git a/include/crypto/internal/hash.h b/include/crypto/internal/hash.h +index a25414ce2898..9779c35f8454 100644 +--- a/include/crypto/internal/hash.h ++++ b/include/crypto/internal/hash.h +@@ -83,6 +83,14 @@ int ahash_register_instance(struct crypto_template *tmpl, + struct ahash_instance *inst); + void ahash_free_instance(struct crypto_instance *inst); + ++int shash_no_setkey(struct crypto_shash *tfm, const u8 *key, ++ unsigned int keylen); ++ ++static inline bool crypto_shash_alg_has_setkey(struct shash_alg *alg) ++{ ++ return alg->setkey != shash_no_setkey; ++} ++ + int crypto_init_ahash_spawn(struct crypto_ahash_spawn *spawn, + struct hash_alg_common *alg, + struct crypto_instance *inst); +diff --git a/include/linux/mlx4/device.h b/include/linux/mlx4/device.h +index d3133be12d92..7fde8af9b87e 100644 +--- a/include/linux/mlx4/device.h ++++ b/include/linux/mlx4/device.h +@@ -460,6 +460,7 @@ enum { + enum { + MLX4_INTERFACE_STATE_UP = 1 << 0, + MLX4_INTERFACE_STATE_DELETION = 1 << 1, ++ MLX4_INTERFACE_STATE_NOWAIT = 1 << 2, + }; + + #define MSTR_SM_CHANGE_MASK (MLX4_EQ_PORT_INFO_MSTR_SM_SL_CHANGE_MASK | \ +diff --git a/include/linux/mman.h b/include/linux/mman.h +index 16373c8f5f57..369bc3405a6d 100644 +--- a/include/linux/mman.h ++++ b/include/linux/mman.h +@@ -63,8 +63,9 @@ static inline int arch_validate_prot(unsigned long prot) + * ("bit1" and "bit2" must be single bits) + */ + #define _calc_vm_trans(x, bit1, bit2) \ ++ ((!(bit1) || !(bit2)) ? 0 : \ + ((bit1) <= (bit2) ? ((x) & (bit1)) * ((bit2) / (bit1)) \ +- : ((x) & (bit1)) / ((bit1) / (bit2))) ++ : ((x) & (bit1)) / ((bit1) / (bit2)))) + + /* + * Combine the mmap "prot" argument into "vm_flags" used internally. +diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h +index 8555321306fb..9982a2bcb880 100644 +--- a/include/target/target_core_base.h ++++ b/include/target/target_core_base.h +@@ -299,7 +299,7 @@ struct t10_alua_tg_pt_gp { + struct list_head tg_pt_gp_lun_list; + struct se_lun *tg_pt_gp_alua_lun; + struct se_node_acl *tg_pt_gp_alua_nacl; +- struct delayed_work tg_pt_gp_transition_work; ++ struct work_struct tg_pt_gp_transition_work; + struct completion *tg_pt_gp_transition_complete; + }; + +diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c +index e984f059e5fc..a996f7356216 100644 +--- a/kernel/sched/deadline.c ++++ b/kernel/sched/deadline.c +@@ -441,13 +441,13 @@ static void replenish_dl_entity(struct sched_dl_entity *dl_se, + * + * This function returns true if: + * +- * runtime / (deadline - t) > dl_runtime / dl_period , ++ * runtime / (deadline - t) > dl_runtime / dl_deadline , + * + * IOW we can't recycle current parameters. + * +- * Notice that the bandwidth check is done against the period. For ++ * Notice that the bandwidth check is done against the deadline. For + * task with deadline equal to period this is the same of using +- * dl_deadline instead of dl_period in the equation above. ++ * dl_period instead of dl_deadline in the equation above. + */ + static bool dl_entity_overflow(struct sched_dl_entity *dl_se, + struct sched_dl_entity *pi_se, u64 t) +@@ -472,7 +472,7 @@ static bool dl_entity_overflow(struct sched_dl_entity *dl_se, + * of anything below microseconds resolution is actually fiction + * (but still we want to give the user that illusion >;). + */ +- left = (pi_se->dl_period >> DL_SCALE) * (dl_se->runtime >> DL_SCALE); ++ left = (pi_se->dl_deadline >> DL_SCALE) * (dl_se->runtime >> DL_SCALE); + right = ((dl_se->deadline - t) >> DL_SCALE) * + (pi_se->dl_runtime >> DL_SCALE); + +@@ -510,10 +510,15 @@ static void update_dl_entity(struct sched_dl_entity *dl_se, + } + } + ++static inline u64 dl_next_period(struct sched_dl_entity *dl_se) ++{ ++ return dl_se->deadline - dl_se->dl_deadline + dl_se->dl_period; ++} ++ + /* + * If the entity depleted all its runtime, and if we want it to sleep + * while waiting for some new execution time to become available, we +- * set the bandwidth enforcement timer to the replenishment instant ++ * set the bandwidth replenishment timer to the replenishment instant + * and try to activate it. + * + * Notice that it is important for the caller to know if the timer +@@ -535,7 +540,7 @@ static int start_dl_timer(struct task_struct *p) + * that it is actually coming from rq->clock and not from + * hrtimer's time base reading. + */ +- act = ns_to_ktime(dl_se->deadline); ++ act = ns_to_ktime(dl_next_period(dl_se)); + now = hrtimer_cb_get_time(timer); + delta = ktime_to_ns(now) - rq_clock(rq); + act = ktime_add_ns(act, delta); +@@ -699,6 +704,37 @@ void init_dl_task_timer(struct sched_dl_entity *dl_se) + timer->function = dl_task_timer; + } + ++/* ++ * During the activation, CBS checks if it can reuse the current task's ++ * runtime and period. If the deadline of the task is in the past, CBS ++ * cannot use the runtime, and so it replenishes the task. This rule ++ * works fine for implicit deadline tasks (deadline == period), and the ++ * CBS was designed for implicit deadline tasks. However, a task with ++ * constrained deadline (deadine < period) might be awakened after the ++ * deadline, but before the next period. In this case, replenishing the ++ * task would allow it to run for runtime / deadline. As in this case ++ * deadline < period, CBS enables a task to run for more than the ++ * runtime / period. In a very loaded system, this can cause a domino ++ * effect, making other tasks miss their deadlines. ++ * ++ * To avoid this problem, in the activation of a constrained deadline ++ * task after the deadline but before the next period, throttle the ++ * task and set the replenishing timer to the begin of the next period, ++ * unless it is boosted. ++ */ ++static inline void dl_check_constrained_dl(struct sched_dl_entity *dl_se) ++{ ++ struct task_struct *p = dl_task_of(dl_se); ++ struct rq *rq = rq_of_dl_rq(dl_rq_of_se(dl_se)); ++ ++ if (dl_time_before(dl_se->deadline, rq_clock(rq)) && ++ dl_time_before(rq_clock(rq), dl_next_period(dl_se))) { ++ if (unlikely(dl_se->dl_boosted || !start_dl_timer(p))) ++ return; ++ dl_se->dl_throttled = 1; ++ } ++} ++ + static + int dl_runtime_exceeded(struct sched_dl_entity *dl_se) + { +@@ -953,6 +989,11 @@ static void dequeue_dl_entity(struct sched_dl_entity *dl_se) + __dequeue_dl_entity(dl_se); + } + ++static inline bool dl_is_constrained(struct sched_dl_entity *dl_se) ++{ ++ return dl_se->dl_deadline < dl_se->dl_period; ++} ++ + static void enqueue_task_dl(struct rq *rq, struct task_struct *p, int flags) + { + struct task_struct *pi_task = rt_mutex_get_top_task(p); +@@ -978,6 +1019,15 @@ static void enqueue_task_dl(struct rq *rq, struct task_struct *p, int flags) + return; + } + ++ /* ++ * Check if a constrained deadline task was activated ++ * after the deadline but before the next period. ++ * If that is the case, the task will be throttled and ++ * the replenishment timer will be set to the next period. ++ */ ++ if (!p->dl.dl_throttled && dl_is_constrained(&p->dl)) ++ dl_check_constrained_dl(&p->dl); ++ + /* + * If p is throttled, we do nothing. In fact, if it exhausted + * its budget it needs a replenishment and, since it now is on +diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c +index faa75afcb7fe..95fefb364dab 100644 +--- a/kernel/sched/rt.c ++++ b/kernel/sched/rt.c +@@ -1960,8 +1960,9 @@ static void pull_rt_task(struct rq *this_rq) + bool resched = false; + struct task_struct *p; + struct rq *src_rq; ++ int rt_overload_count = rt_overloaded(this_rq); + +- if (likely(!rt_overloaded(this_rq))) ++ if (likely(!rt_overload_count)) + return; + + /* +@@ -1970,6 +1971,11 @@ static void pull_rt_task(struct rq *this_rq) + */ + smp_rmb(); + ++ /* If we are the only overloaded CPU do nothing */ ++ if (rt_overload_count == 1 && ++ cpumask_test_cpu(this_rq->cpu, this_rq->rd->rto_mask)) ++ return; ++ + #ifdef HAVE_RT_PUSH_IPI + if (sched_feat(RT_PUSH_IPI)) { + tell_cpu_to_push(this_rq); +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c +index b64f35afee4e..61d0960559c8 100644 +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -3384,37 +3384,30 @@ static const struct file_operations show_traces_fops = { + .llseek = seq_lseek, + }; + +-/* +- * The tracer itself will not take this lock, but still we want +- * to provide a consistent cpumask to user-space: +- */ +-static DEFINE_MUTEX(tracing_cpumask_update_lock); +- +-/* +- * Temporary storage for the character representation of the +- * CPU bitmask (and one more byte for the newline): +- */ +-static char mask_str[NR_CPUS + 1]; +- + static ssize_t + tracing_cpumask_read(struct file *filp, char __user *ubuf, + size_t count, loff_t *ppos) + { + struct trace_array *tr = file_inode(filp)->i_private; ++ char *mask_str; + int len; + +- mutex_lock(&tracing_cpumask_update_lock); ++ len = snprintf(NULL, 0, "%*pb\n", ++ cpumask_pr_args(tr->tracing_cpumask)) + 1; ++ mask_str = kmalloc(len, GFP_KERNEL); ++ if (!mask_str) ++ return -ENOMEM; + +- len = snprintf(mask_str, count, "%*pb\n", ++ len = snprintf(mask_str, len, "%*pb\n", + cpumask_pr_args(tr->tracing_cpumask)); + if (len >= count) { + count = -EINVAL; + goto out_err; + } +- count = simple_read_from_buffer(ubuf, count, ppos, mask_str, NR_CPUS+1); ++ count = simple_read_from_buffer(ubuf, count, ppos, mask_str, len); + + out_err: +- mutex_unlock(&tracing_cpumask_update_lock); ++ kfree(mask_str); + + return count; + } +@@ -3434,8 +3427,6 @@ tracing_cpumask_write(struct file *filp, const char __user *ubuf, + if (err) + goto err_unlock; + +- mutex_lock(&tracing_cpumask_update_lock); +- + local_irq_disable(); + arch_spin_lock(&tr->max_lock); + for_each_tracing_cpu(cpu) { +@@ -3458,8 +3449,6 @@ tracing_cpumask_write(struct file *filp, const char __user *ubuf, + local_irq_enable(); + + cpumask_copy(tr->tracing_cpumask, tracing_cpumask_new); +- +- mutex_unlock(&tracing_cpumask_update_lock); + free_cpumask_var(tracing_cpumask_new); + + return count; +diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c +index 97fc19f001bf..55dcb2b20b59 100644 +--- a/net/bridge/br_netfilter_hooks.c ++++ b/net/bridge/br_netfilter_hooks.c +@@ -701,18 +701,20 @@ static unsigned int nf_bridge_mtu_reduction(const struct sk_buff *skb) + + static int br_nf_dev_queue_xmit(struct net *net, struct sock *sk, struct sk_buff *skb) + { +- struct nf_bridge_info *nf_bridge; +- unsigned int mtu_reserved; ++ struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb); ++ unsigned int mtu, mtu_reserved; + + mtu_reserved = nf_bridge_mtu_reduction(skb); ++ mtu = skb->dev->mtu; ++ ++ if (nf_bridge->frag_max_size && nf_bridge->frag_max_size < mtu) ++ mtu = nf_bridge->frag_max_size; + +- if (skb_is_gso(skb) || skb->len + mtu_reserved <= skb->dev->mtu) { ++ if (skb_is_gso(skb) || skb->len + mtu_reserved <= mtu) { + nf_bridge_info_free(skb); + return br_dev_queue_push_xmit(net, sk, skb); + } + +- nf_bridge = nf_bridge_info_get(skb); +- + /* This is wrong! We should preserve the original fragment + * boundaries by preserving frag_list rather than refragmenting. + */ +diff --git a/net/core/dev.c b/net/core/dev.c +index 630704d8d6a2..3b67c1e5756f 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -1300,6 +1300,7 @@ void netdev_notify_peers(struct net_device *dev) + { + rtnl_lock(); + call_netdevice_notifiers(NETDEV_NOTIFY_PEERS, dev); ++ call_netdevice_notifiers(NETDEV_RESEND_IGMP, dev); + rtnl_unlock(); + } + EXPORT_SYMBOL(netdev_notify_peers); +diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c +index d48281ca9c72..ec8f6a6485e3 100644 +--- a/net/l2tp/l2tp_core.c ++++ b/net/l2tp/l2tp_core.c +@@ -1856,7 +1856,7 @@ static __net_exit void l2tp_exit_net(struct net *net) + + rcu_read_lock_bh(); + list_for_each_entry_rcu(tunnel, &pn->l2tp_tunnel_list, list) { +- (void)l2tp_tunnel_delete(tunnel); ++ l2tp_tunnel_delete(tunnel); + } + rcu_read_unlock_bh(); + } +diff --git a/net/l2tp/l2tp_netlink.c b/net/l2tp/l2tp_netlink.c +index 665cc74df5c5..fb3248ff8b48 100644 +--- a/net/l2tp/l2tp_netlink.c ++++ b/net/l2tp/l2tp_netlink.c +@@ -285,7 +285,7 @@ static int l2tp_nl_cmd_tunnel_delete(struct sk_buff *skb, struct genl_info *info + l2tp_tunnel_notify(&l2tp_nl_family, info, + tunnel, L2TP_CMD_TUNNEL_DELETE); + +- (void) l2tp_tunnel_delete(tunnel); ++ l2tp_tunnel_delete(tunnel); + + out: + return ret; +diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c +index 9e1ded80a992..1cbc7bd26de3 100644 +--- a/net/mac80211/mesh.c ++++ b/net/mac80211/mesh.c +@@ -295,8 +295,6 @@ int mesh_add_meshconf_ie(struct ieee80211_sub_if_data *sdata, + /* Mesh PS mode. See IEEE802.11-2012 8.4.2.100.8 */ + *pos |= ifmsh->ps_peers_deep_sleep ? + IEEE80211_MESHCONF_CAPAB_POWER_SAVE_LEVEL : 0x00; +- *pos++ = 0x00; +- + return 0; + } + +diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c +index e7c1b052c2a3..2c937c16dc27 100644 +--- a/net/netfilter/ipvs/ip_vs_ctl.c ++++ b/net/netfilter/ipvs/ip_vs_ctl.c +@@ -1999,12 +1999,16 @@ static int ip_vs_info_seq_show(struct seq_file *seq, void *v) + seq_puts(seq, + " -> RemoteAddress:Port Forward Weight ActiveConn InActConn\n"); + } else { ++ struct net *net = seq_file_net(seq); ++ struct netns_ipvs *ipvs = net_ipvs(net); + const struct ip_vs_service *svc = v; + const struct ip_vs_iter *iter = seq->private; + const struct ip_vs_dest *dest; + struct ip_vs_scheduler *sched = rcu_dereference(svc->scheduler); + char *sched_name = sched ? sched->name : "none"; + ++ if (svc->ipvs != ipvs) ++ return 0; + if (iter->table == ip_vs_svc_table) { + #ifdef CONFIG_IP_VS_IPV6 + if (svc->af == AF_INET6) +diff --git a/net/socket.c b/net/socket.c +index fbfa9d2492cf..2cf4f25f5c2b 100644 +--- a/net/socket.c ++++ b/net/socket.c +@@ -1697,6 +1697,7 @@ SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size, + /* We assume all kernel code knows the size of sockaddr_storage */ + msg.msg_namelen = 0; + msg.msg_iocb = NULL; ++ msg.msg_flags = 0; + if (sock->file->f_flags & O_NONBLOCK) + flags |= MSG_DONTWAIT; + err = sock_recvmsg(sock, &msg, iov_iter_count(&msg.msg_iter), flags); +diff --git a/security/keys/request_key.c b/security/keys/request_key.c +index 2ce733342b5a..3ae3acf473c8 100644 +--- a/security/keys/request_key.c ++++ b/security/keys/request_key.c +@@ -250,11 +250,12 @@ static int construct_key(struct key *key, const void *callout_info, + * The keyring selected is returned with an extra reference upon it which the + * caller must release. + */ +-static void construct_get_dest_keyring(struct key **_dest_keyring) ++static int construct_get_dest_keyring(struct key **_dest_keyring) + { + struct request_key_auth *rka; + const struct cred *cred = current_cred(); + struct key *dest_keyring = *_dest_keyring, *authkey; ++ int ret; + + kenter("%p", dest_keyring); + +@@ -263,6 +264,8 @@ static void construct_get_dest_keyring(struct key **_dest_keyring) + /* the caller supplied one */ + key_get(dest_keyring); + } else { ++ bool do_perm_check = true; ++ + /* use a default keyring; falling through the cases until we + * find one that we actually have */ + switch (cred->jit_keyring) { +@@ -277,8 +280,10 @@ static void construct_get_dest_keyring(struct key **_dest_keyring) + dest_keyring = + key_get(rka->dest_keyring); + up_read(&authkey->sem); +- if (dest_keyring) ++ if (dest_keyring) { ++ do_perm_check = false; + break; ++ } + } + + case KEY_REQKEY_DEFL_THREAD_KEYRING: +@@ -313,11 +318,29 @@ static void construct_get_dest_keyring(struct key **_dest_keyring) + default: + BUG(); + } ++ ++ /* ++ * Require Write permission on the keyring. This is essential ++ * because the default keyring may be the session keyring, and ++ * joining a keyring only requires Search permission. ++ * ++ * However, this check is skipped for the "requestor keyring" so ++ * that /sbin/request-key can itself use request_key() to add ++ * keys to the original requestor's destination keyring. ++ */ ++ if (dest_keyring && do_perm_check) { ++ ret = key_permission(make_key_ref(dest_keyring, 1), ++ KEY_NEED_WRITE); ++ if (ret) { ++ key_put(dest_keyring); ++ return ret; ++ } ++ } + } + + *_dest_keyring = dest_keyring; + kleave(" [dk %d]", key_serial(dest_keyring)); +- return; ++ return 0; + } + + /* +@@ -442,12 +465,16 @@ static struct key *construct_key_and_link(struct keyring_search_context *ctx, + + if (ctx->index_key.type == &key_type_keyring) + return ERR_PTR(-EPERM); +- +- user = key_user_lookup(current_fsuid()); +- if (!user) +- return ERR_PTR(-ENOMEM); + +- construct_get_dest_keyring(&dest_keyring); ++ ret = construct_get_dest_keyring(&dest_keyring); ++ if (ret) ++ goto error; ++ ++ user = key_user_lookup(current_fsuid()); ++ if (!user) { ++ ret = -ENOMEM; ++ goto error_put_dest_keyring; ++ } + + ret = construct_alloc_key(ctx, dest_keyring, flags, user, &key); + key_user_put(user); +@@ -462,7 +489,7 @@ static struct key *construct_key_and_link(struct keyring_search_context *ctx, + } else if (ret == -EINPROGRESS) { + ret = 0; + } else { +- goto couldnt_alloc_key; ++ goto error_put_dest_keyring; + } + + key_put(dest_keyring); +@@ -472,8 +499,9 @@ static struct key *construct_key_and_link(struct keyring_search_context *ctx, + construction_failed: + key_negate_and_link(key, key_negative_timeout, NULL, NULL); + key_put(key); +-couldnt_alloc_key: ++error_put_dest_keyring: + key_put(dest_keyring); ++error: + kleave(" = %d", ret); + return ERR_PTR(ret); + } +diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c +index 520a32a12f8a..415be561fad3 100644 +--- a/tools/perf/util/symbol.c ++++ b/tools/perf/util/symbol.c +@@ -200,7 +200,7 @@ void symbols__fixup_end(struct rb_root *symbols) + + /* Last entry */ + if (curr->end == curr->start) +- curr->end = roundup(curr->start, 4096); ++ curr->end = roundup(curr->start, 4096) + 4096; + } + + void __map_groups__fixup_end(struct map_groups *mg, enum map_type type) +diff --git a/tools/testing/selftests/vm/Makefile b/tools/testing/selftests/vm/Makefile +index e4bb1de1d526..b5f08e8cab33 100644 +--- a/tools/testing/selftests/vm/Makefile ++++ b/tools/testing/selftests/vm/Makefile +@@ -1,5 +1,9 @@ + # Makefile for vm selftests + ++ifndef OUTPUT ++ OUTPUT := $(shell pwd) ++endif ++ + CFLAGS = -Wall -I ../../../../usr/include $(EXTRA_CFLAGS) + BINARIES = compaction_test + BINARIES += hugepage-mmap |