diff --git a/config/kernel/linux-sunxi64-dev.config b/config/kernel/linux-sunxi64-dev.config index c7ce8fdb8..751c95b7e 100644 --- a/config/kernel/linux-sunxi64-dev.config +++ b/config/kernel/linux-sunxi64-dev.config @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/arm64 4.19.2 Kernel Configuration +# Linux/arm64 4.19.6 Kernel Configuration # # @@ -4389,6 +4389,7 @@ CONFIG_USB_GADGET=y # CONFIG_USB_GADGET_DEBUG_FS is not set CONFIG_USB_GADGET_VBUS_DRAW=2 CONFIG_USB_GADGET_STORAGE_NUM_BUFFERS=2 +CONFIG_U_SERIAL_CONSOLE=y # # USB Peripheral Controller @@ -4405,8 +4406,85 @@ CONFIG_USB_GADGET_STORAGE_NUM_BUFFERS=2 # CONFIG_USB_NET2272 is not set # CONFIG_USB_GADGET_XILINX is not set # CONFIG_USB_DUMMY_HCD is not set -# CONFIG_USB_CONFIGFS is not set -# CONFIG_TYPEC is not set +CONFIG_USB_LIBCOMPOSITE=m +CONFIG_USB_F_ACM=m +CONFIG_USB_F_SS_LB=m +CONFIG_USB_U_SERIAL=m +CONFIG_USB_U_ETHER=m +CONFIG_USB_U_AUDIO=m +CONFIG_USB_F_SERIAL=m +CONFIG_USB_F_OBEX=m +CONFIG_USB_F_NCM=m +CONFIG_USB_F_ECM=m +CONFIG_USB_F_EEM=m +CONFIG_USB_F_SUBSET=m +CONFIG_USB_F_RNDIS=m +CONFIG_USB_F_MASS_STORAGE=m +CONFIG_USB_F_FS=m +CONFIG_USB_F_UAC1=m +CONFIG_USB_F_UAC2=m +CONFIG_USB_F_UVC=m +CONFIG_USB_F_MIDI=m +CONFIG_USB_F_HID=m +CONFIG_USB_F_PRINTER=m +CONFIG_USB_CONFIGFS=m +CONFIG_USB_CONFIGFS_SERIAL=y +CONFIG_USB_CONFIGFS_ACM=y +CONFIG_USB_CONFIGFS_OBEX=y +CONFIG_USB_CONFIGFS_NCM=y +CONFIG_USB_CONFIGFS_ECM=y +CONFIG_USB_CONFIGFS_ECM_SUBSET=y +CONFIG_USB_CONFIGFS_RNDIS=y +CONFIG_USB_CONFIGFS_EEM=y +CONFIG_USB_CONFIGFS_MASS_STORAGE=y +CONFIG_USB_CONFIGFS_F_LB_SS=y +CONFIG_USB_CONFIGFS_F_FS=y +CONFIG_USB_CONFIGFS_F_UAC1=y +# CONFIG_USB_CONFIGFS_F_UAC1_LEGACY is not set +CONFIG_USB_CONFIGFS_F_UAC2=y +CONFIG_USB_CONFIGFS_F_MIDI=y +CONFIG_USB_CONFIGFS_F_HID=y +CONFIG_USB_CONFIGFS_F_UVC=y +CONFIG_USB_CONFIGFS_F_PRINTER=y +CONFIG_USB_ZERO=m +# CONFIG_USB_ZERO_HNPTEST is not set +CONFIG_USB_AUDIO=m +# CONFIG_GADGET_UAC1 is not set +CONFIG_USB_ETH=m +CONFIG_USB_ETH_RNDIS=y +CONFIG_USB_ETH_EEM=y +CONFIG_USB_G_NCM=m +CONFIG_USB_GADGETFS=m +CONFIG_USB_FUNCTIONFS=m +CONFIG_USB_FUNCTIONFS_ETH=y +CONFIG_USB_FUNCTIONFS_RNDIS=y +CONFIG_USB_FUNCTIONFS_GENERIC=y +CONFIG_USB_MASS_STORAGE=m +CONFIG_USB_G_SERIAL=m +CONFIG_USB_MIDI_GADGET=m +CONFIG_USB_G_PRINTER=m +CONFIG_USB_CDC_COMPOSITE=m +CONFIG_USB_G_ACM_MS=m +CONFIG_USB_G_MULTI=m +CONFIG_USB_G_MULTI_RNDIS=y +CONFIG_USB_G_MULTI_CDC=y +CONFIG_USB_G_HID=m +# CONFIG_USB_G_DBGP is not set +CONFIG_USB_G_WEBCAM=m +CONFIG_TYPEC=m +# CONFIG_TYPEC_TCPM is not set +# CONFIG_TYPEC_UCSI is not set +CONFIG_TYPEC_TPS6598X=m + +# +# USB Type-C Multiplexer/DeMultiplexer Switch support +# +CONFIG_TYPEC_MUX_PI3USB30532=m + +# +# USB Type-C Alternate Mode drivers +# +CONFIG_TYPEC_DP_ALTMODE=m CONFIG_USB_LED_TRIG=y # CONFIG_USB_ULPI_BUS is not set # CONFIG_UWB is not set @@ -4537,20 +4615,20 @@ CONFIG_RTC_INTF_DEV=y # # I2C RTC drivers # -# CONFIG_RTC_DRV_ABB5ZES3 is not set -# CONFIG_RTC_DRV_ABX80X is not set +CONFIG_RTC_DRV_ABB5ZES3=m +CONFIG_RTC_DRV_ABX80X=m CONFIG_RTC_DRV_DS1307=m CONFIG_RTC_DRV_DS1307_CENTURY=y CONFIG_RTC_DRV_DS1374=m CONFIG_RTC_DRV_DS1374_WDT=y CONFIG_RTC_DRV_DS1672=m -# CONFIG_RTC_DRV_HYM8563 is not set +CONFIG_RTC_DRV_HYM8563=m CONFIG_RTC_DRV_MAX6900=m -# CONFIG_RTC_DRV_RS5C372 is not set +CONFIG_RTC_DRV_RS5C372=m CONFIG_RTC_DRV_ISL1208=m CONFIG_RTC_DRV_ISL12022=m CONFIG_RTC_DRV_ISL12026=m -# CONFIG_RTC_DRV_X1205 is not set +CONFIG_RTC_DRV_X1205=m CONFIG_RTC_DRV_PCF8523=m CONFIG_RTC_DRV_PCF85063=m CONFIG_RTC_DRV_PCF85363=m @@ -4558,32 +4636,32 @@ CONFIG_RTC_DRV_PCF8563=m CONFIG_RTC_DRV_PCF8583=m CONFIG_RTC_DRV_M41T80=m CONFIG_RTC_DRV_M41T80_WDT=y -# CONFIG_RTC_DRV_BQ32K is not set -# CONFIG_RTC_DRV_S35390A is not set -# CONFIG_RTC_DRV_FM3130 is not set -# CONFIG_RTC_DRV_RX8010 is not set -# CONFIG_RTC_DRV_RX8581 is not set -# CONFIG_RTC_DRV_RX8025 is not set -# CONFIG_RTC_DRV_EM3027 is not set -# CONFIG_RTC_DRV_RV8803 is not set +CONFIG_RTC_DRV_BQ32K=m +CONFIG_RTC_DRV_S35390A=m +CONFIG_RTC_DRV_FM3130=m +CONFIG_RTC_DRV_RX8010=m +CONFIG_RTC_DRV_RX8581=m +CONFIG_RTC_DRV_RX8025=m +CONFIG_RTC_DRV_EM3027=m +CONFIG_RTC_DRV_RV8803=m CONFIG_RTC_DRV_S5M=m # # SPI RTC drivers # -# CONFIG_RTC_DRV_M41T93 is not set -# CONFIG_RTC_DRV_M41T94 is not set +CONFIG_RTC_DRV_M41T93=m +CONFIG_RTC_DRV_M41T94=m CONFIG_RTC_DRV_DS1302=m CONFIG_RTC_DRV_DS1305=m CONFIG_RTC_DRV_DS1343=m CONFIG_RTC_DRV_DS1347=m CONFIG_RTC_DRV_DS1390=m CONFIG_RTC_DRV_MAX6916=m -# CONFIG_RTC_DRV_R9701 is not set -# CONFIG_RTC_DRV_RX4581 is not set -# CONFIG_RTC_DRV_RX6110 is not set -# CONFIG_RTC_DRV_RS5C348 is not set -# CONFIG_RTC_DRV_MAX6902 is not set +CONFIG_RTC_DRV_R9701=m +CONFIG_RTC_DRV_RX4581=m +CONFIG_RTC_DRV_RX6110=m +CONFIG_RTC_DRV_RS5C348=m +CONFIG_RTC_DRV_MAX6902=m CONFIG_RTC_DRV_PCF2123=m CONFIG_RTC_DRV_MCP795=m CONFIG_RTC_I2C_AND_SPI=y @@ -4964,88 +5042,99 @@ CONFIG_IIO_TRIGGERED_BUFFER=m CONFIG_IIO_CONFIGFS=m CONFIG_IIO_TRIGGER=y CONFIG_IIO_CONSUMERS_PER_TRIGGER=2 -# CONFIG_IIO_SW_DEVICE is not set -# CONFIG_IIO_SW_TRIGGER is not set +CONFIG_IIO_SW_DEVICE=m +CONFIG_IIO_SW_TRIGGER=m +CONFIG_IIO_TRIGGERED_EVENT=m # # Accelerometers # -# CONFIG_ADIS16201 is not set -# CONFIG_ADIS16209 is not set -# CONFIG_ADXL345_I2C is not set -# CONFIG_ADXL345_SPI is not set -# CONFIG_BMA180 is not set -# CONFIG_BMA220 is not set -# CONFIG_BMC150_ACCEL is not set -# CONFIG_DA280 is not set -# CONFIG_DA311 is not set -# CONFIG_DMARD06 is not set -# CONFIG_DMARD09 is not set -# CONFIG_DMARD10 is not set +CONFIG_ADIS16201=m +CONFIG_ADIS16209=m +CONFIG_ADXL345=m +CONFIG_ADXL345_I2C=m +CONFIG_ADXL345_SPI=m +CONFIG_BMA180=m +CONFIG_BMA220=m +CONFIG_BMC150_ACCEL=m +CONFIG_BMC150_ACCEL_I2C=m +CONFIG_BMC150_ACCEL_SPI=m +CONFIG_DA280=m +CONFIG_DA311=m +CONFIG_DMARD06=m +CONFIG_DMARD09=m +CONFIG_DMARD10=m CONFIG_HID_SENSOR_ACCEL_3D=m -# CONFIG_IIO_CROS_EC_ACCEL_LEGACY is not set -# CONFIG_IIO_ST_ACCEL_3AXIS is not set -# CONFIG_KXSD9 is not set -# CONFIG_KXCJK1013 is not set -# CONFIG_MC3230 is not set -# CONFIG_MMA7455_I2C is not set -# CONFIG_MMA7455_SPI is not set -# CONFIG_MMA7660 is not set -# CONFIG_MMA8452 is not set -# CONFIG_MMA9551 is not set -# CONFIG_MMA9553 is not set -# CONFIG_MXC4005 is not set -# CONFIG_MXC6255 is not set -# CONFIG_SCA3000 is not set -# CONFIG_STK8312 is not set -# CONFIG_STK8BA50 is not set +CONFIG_IIO_CROS_EC_ACCEL_LEGACY=m +CONFIG_IIO_ST_ACCEL_3AXIS=m +CONFIG_IIO_ST_ACCEL_I2C_3AXIS=m +CONFIG_IIO_ST_ACCEL_SPI_3AXIS=m +CONFIG_KXSD9=m +CONFIG_KXSD9_SPI=m +CONFIG_KXSD9_I2C=m +CONFIG_KXCJK1013=m +CONFIG_MC3230=m +CONFIG_MMA7455=m +CONFIG_MMA7455_I2C=m +CONFIG_MMA7455_SPI=m +CONFIG_MMA7660=m +CONFIG_MMA8452=m +CONFIG_MMA9551_CORE=m +CONFIG_MMA9551=m +CONFIG_MMA9553=m +CONFIG_MXC4005=m +CONFIG_MXC6255=m +CONFIG_SCA3000=m +CONFIG_STK8312=m +CONFIG_STK8BA50=m # # Analog to digital converters # -# CONFIG_AD7266 is not set -# CONFIG_AD7291 is not set -# CONFIG_AD7298 is not set -# CONFIG_AD7476 is not set -# CONFIG_AD7766 is not set -# CONFIG_AD7791 is not set -# CONFIG_AD7793 is not set -# CONFIG_AD7887 is not set -# CONFIG_AD7923 is not set -# CONFIG_AD799X is not set +CONFIG_AD_SIGMA_DELTA=m +CONFIG_AD7266=m +CONFIG_AD7291=m +CONFIG_AD7298=m +CONFIG_AD7476=m +CONFIG_AD7766=m +CONFIG_AD7791=m +CONFIG_AD7793=m +CONFIG_AD7887=m +CONFIG_AD7923=m +CONFIG_AD799X=m CONFIG_AXP20X_ADC=m CONFIG_AXP288_ADC=m -# CONFIG_CC10001_ADC is not set -# CONFIG_ENVELOPE_DETECTOR is not set -# CONFIG_HI8435 is not set +CONFIG_CC10001_ADC=m +CONFIG_ENVELOPE_DETECTOR=m +CONFIG_HI8435=m # CONFIG_HX711 is not set -# CONFIG_INA2XX_ADC is not set -# CONFIG_LTC2471 is not set -# CONFIG_LTC2485 is not set -# CONFIG_LTC2497 is not set -# CONFIG_MAX1027 is not set -# CONFIG_MAX11100 is not set -# CONFIG_MAX1118 is not set -# CONFIG_MAX1363 is not set -# CONFIG_MAX9611 is not set -# CONFIG_MCP320X is not set -# CONFIG_MCP3422 is not set +CONFIG_INA2XX_ADC=m +CONFIG_LTC2471=m +CONFIG_LTC2485=m +CONFIG_LTC2497=m +CONFIG_MAX1027=m +CONFIG_MAX11100=m +CONFIG_MAX1118=m +CONFIG_MAX1363=m +CONFIG_MAX9611=m +CONFIG_MCP320X=m +CONFIG_MCP3422=m # CONFIG_NAU7802 is not set # CONFIG_QCOM_SPMI_IADC is not set # CONFIG_QCOM_SPMI_VADC is not set # CONFIG_SD_ADC_MODULATOR is not set CONFIG_SUN4I_GPADC=m -# CONFIG_TI_ADC081C is not set -# CONFIG_TI_ADC0832 is not set -# CONFIG_TI_ADC084S021 is not set -# CONFIG_TI_ADC12138 is not set -# CONFIG_TI_ADC108S102 is not set -# CONFIG_TI_ADC128S052 is not set -# CONFIG_TI_ADC161S626 is not set -# CONFIG_TI_ADS1015 is not set -# CONFIG_TI_ADS7950 is not set -# CONFIG_TI_ADS8688 is not set -# CONFIG_TI_TLC4541 is not set +CONFIG_TI_ADC081C=m +CONFIG_TI_ADC0832=m +CONFIG_TI_ADC084S021=m +CONFIG_TI_ADC12138=m +CONFIG_TI_ADC108S102=m +CONFIG_TI_ADC128S052=m +CONFIG_TI_ADC161S626=m +CONFIG_TI_ADS1015=m +CONFIG_TI_ADS7950=m +CONFIG_TI_ADS8688=m +CONFIG_TI_TLC4541=m # CONFIG_VF610_ADC is not set # @@ -5074,11 +5163,15 @@ CONFIG_BME680_SPI=m # CONFIG_HID_SENSOR_IIO_COMMON=m CONFIG_HID_SENSOR_IIO_TRIGGER=m +CONFIG_IIO_MS_SENSORS_I2C=m # # SSP Sensor Common # # CONFIG_IIO_SSP_SENSORHUB is not set +CONFIG_IIO_ST_SENSORS_I2C=m +CONFIG_IIO_ST_SENSORS_SPI=m +CONFIG_IIO_ST_SENSORS_CORE=m # # Counters @@ -5122,6 +5215,9 @@ CONFIG_TI_DAC5571=m # # IIO dummy driver # +CONFIG_IIO_SIMPLE_DUMMY=m +# CONFIG_IIO_SIMPLE_DUMMY_EVENTS is not set +# CONFIG_IIO_SIMPLE_DUMMY_BUFFER is not set # # Frequency Synthesizers DDS/PLL @@ -5140,16 +5236,21 @@ CONFIG_TI_DAC5571=m # # Digital gyroscope sensors # -# CONFIG_ADIS16080 is not set -# CONFIG_ADIS16130 is not set -# CONFIG_ADIS16136 is not set -# CONFIG_ADIS16260 is not set -# CONFIG_ADXRS450 is not set -# CONFIG_BMG160 is not set +CONFIG_ADIS16080=m +CONFIG_ADIS16130=m +CONFIG_ADIS16136=m +CONFIG_ADIS16260=m +CONFIG_ADXRS450=m +CONFIG_BMG160=m +CONFIG_BMG160_I2C=m +CONFIG_BMG160_SPI=m CONFIG_HID_SENSOR_GYRO_3D=m -# CONFIG_MPU3050_I2C is not set -# CONFIG_IIO_ST_GYRO_3AXIS is not set -# CONFIG_ITG3200 is not set +CONFIG_MPU3050=m +CONFIG_MPU3050_I2C=m +CONFIG_IIO_ST_GYRO_3AXIS=m +CONFIG_IIO_ST_GYRO_I2C_3AXIS=m +CONFIG_IIO_ST_GYRO_SPI_3AXIS=m +CONFIG_ITG3200=m # # Health Sensors @@ -5166,14 +5267,16 @@ CONFIG_HID_SENSOR_GYRO_3D=m # # Humidity sensors # -# CONFIG_AM2315 is not set -# CONFIG_DHT11 is not set -# CONFIG_HDC100X is not set +CONFIG_AM2315=m +CONFIG_DHT11=m +CONFIG_HDC100X=m CONFIG_HID_SENSOR_HUMIDITY=m -# CONFIG_HTS221 is not set -# CONFIG_HTU21 is not set -# CONFIG_SI7005 is not set -# CONFIG_SI7020 is not set +CONFIG_HTS221=m +CONFIG_HTS221_I2C=m +CONFIG_HTS221_SPI=m +CONFIG_HTU21=m +CONFIG_SI7005=m +CONFIG_SI7020=m # # Inertial measurement units @@ -5186,64 +5289,72 @@ CONFIG_HID_SENSOR_HUMIDITY=m # CONFIG_INV_MPU6050_I2C is not set # CONFIG_INV_MPU6050_SPI is not set # CONFIG_IIO_ST_LSM6DSX is not set +CONFIG_IIO_ADIS_LIB=m +CONFIG_IIO_ADIS_LIB_BUFFER=y # # Light sensors # -# CONFIG_ADJD_S311 is not set -# CONFIG_AL3320A is not set -# CONFIG_APDS9300 is not set -# CONFIG_APDS9960 is not set -# CONFIG_BH1750 is not set -# CONFIG_BH1780 is not set -# CONFIG_CM32181 is not set -# CONFIG_CM3232 is not set -# CONFIG_CM3323 is not set -# CONFIG_CM3605 is not set -# CONFIG_CM36651 is not set -# CONFIG_GP2AP020A00F is not set -# CONFIG_SENSORS_ISL29018 is not set -# CONFIG_SENSORS_ISL29028 is not set -# CONFIG_ISL29125 is not set +CONFIG_ADJD_S311=m +CONFIG_AL3320A=m +CONFIG_APDS9300=m +CONFIG_APDS9960=m +CONFIG_BH1750=m +CONFIG_BH1780=m +CONFIG_CM32181=m +CONFIG_CM3232=m +CONFIG_CM3323=m +CONFIG_CM3605=m +CONFIG_CM36651=m +CONFIG_GP2AP020A00F=m +CONFIG_SENSORS_ISL29018=m +CONFIG_SENSORS_ISL29028=m +CONFIG_ISL29125=m CONFIG_HID_SENSOR_ALS=m CONFIG_HID_SENSOR_PROX=m -# CONFIG_JSA1212 is not set -# CONFIG_RPR0521 is not set -# CONFIG_LTR501 is not set +CONFIG_JSA1212=m +CONFIG_RPR0521=m +CONFIG_LTR501=m CONFIG_LV0104CS=m -# CONFIG_MAX44000 is not set -# CONFIG_OPT3001 is not set -# CONFIG_PA12203001 is not set +CONFIG_MAX44000=m +CONFIG_OPT3001=m +CONFIG_PA12203001=m CONFIG_SI1133=m -# CONFIG_SI1145 is not set -# CONFIG_STK3310 is not set -# CONFIG_ST_UVIS25 is not set -# CONFIG_TCS3414 is not set -# CONFIG_TCS3472 is not set -# CONFIG_SENSORS_TSL2563 is not set -# CONFIG_TSL2583 is not set +CONFIG_SI1145=m +CONFIG_STK3310=m +CONFIG_ST_UVIS25=m +CONFIG_ST_UVIS25_I2C=m +CONFIG_ST_UVIS25_SPI=m +CONFIG_TCS3414=m +CONFIG_TCS3472=m +CONFIG_SENSORS_TSL2563=m +CONFIG_TSL2583=m CONFIG_TSL2772=m -# CONFIG_TSL4531 is not set -# CONFIG_US5182D is not set -# CONFIG_VCNL4000 is not set -# CONFIG_VEML6070 is not set -# CONFIG_VL6180 is not set -# CONFIG_ZOPT2201 is not set +CONFIG_TSL4531=m +CONFIG_US5182D=m +CONFIG_VCNL4000=m +CONFIG_VEML6070=m +CONFIG_VL6180=m +CONFIG_ZOPT2201=m # # Magnetometer sensors # -# CONFIG_AK8974 is not set -# CONFIG_AK8975 is not set -# CONFIG_AK09911 is not set -# CONFIG_BMC150_MAGN_I2C is not set -# CONFIG_BMC150_MAGN_SPI is not set -# CONFIG_MAG3110 is not set +CONFIG_AK8974=m +CONFIG_AK8975=m +CONFIG_AK09911=m +CONFIG_BMC150_MAGN=m +CONFIG_BMC150_MAGN_I2C=m +CONFIG_BMC150_MAGN_SPI=m +CONFIG_MAG3110=m CONFIG_HID_SENSOR_MAGNETOMETER_3D=m -# CONFIG_MMC35240 is not set -# CONFIG_IIO_ST_MAGN_3AXIS is not set -# CONFIG_SENSORS_HMC5843_I2C is not set -# CONFIG_SENSORS_HMC5843_SPI is not set +CONFIG_MMC35240=m +CONFIG_IIO_ST_MAGN_3AXIS=m +CONFIG_IIO_ST_MAGN_I2C_3AXIS=m +CONFIG_IIO_ST_MAGN_SPI_3AXIS=m +CONFIG_SENSORS_HMC5843=m +CONFIG_SENSORS_HMC5843_I2C=m +CONFIG_SENSORS_HMC5843_SPI=m # # Multiplexers @@ -5259,7 +5370,9 @@ CONFIG_HID_SENSOR_DEVICE_ROTATION=m # # Triggers - standalone # +CONFIG_IIO_HRTIMER_TRIGGER=m # CONFIG_IIO_INTERRUPT_TRIGGER is not set +CONFIG_IIO_TIGHTLOOP_TRIGGER=m # CONFIG_IIO_SYSFS_TRIGGER is not set # @@ -5283,8 +5396,10 @@ CONFIG_MCP4018=m # Pressure sensors # # CONFIG_ABP060MG is not set -# CONFIG_BMP280 is not set -CONFIG_HID_SENSOR_PRESS=m +CONFIG_BMP280=m +CONFIG_BMP280_I2C=m +CONFIG_BMP280_SPI=m +# CONFIG_HID_SENSOR_PRESS is not set # CONFIG_HP03 is not set # CONFIG_MPL115_I2C is not set # CONFIG_MPL115_SPI is not set @@ -5319,18 +5434,18 @@ CONFIG_ISL29501=m # # Temperature sensors # -# CONFIG_MAXIM_THERMOCOUPLE is not set +CONFIG_MAXIM_THERMOCOUPLE=m CONFIG_HID_SENSOR_TEMP=m -# CONFIG_MLX90614 is not set -CONFIG_MLX90632=m -# CONFIG_TMP006 is not set -# CONFIG_TMP007 is not set -# CONFIG_TSYS01 is not set -# CONFIG_TSYS02D is not set +CONFIG_MLX90614=m +# CONFIG_MLX90632 is not set +CONFIG_TMP006=m +CONFIG_TMP007=m +CONFIG_TSYS01=m +CONFIG_TSYS02D=m CONFIG_PWM=y CONFIG_PWM_SYSFS=y # CONFIG_PWM_FSL_FTM is not set -# CONFIG_PWM_PCA9685 is not set +CONFIG_PWM_PCA9685=m CONFIG_PWM_SUN4I=m # @@ -5499,8 +5614,10 @@ CONFIG_CACHEFILES=m # # CD-ROM/DVD Filesystems # -# CONFIG_ISO9660_FS is not set -# CONFIG_UDF_FS is not set +CONFIG_ISO9660_FS=m +CONFIG_JOLIET=y +# CONFIG_ZISOFS is not set +CONFIG_UDF_FS=m # # DOS/FAT/NT Filesystems @@ -5549,17 +5666,17 @@ CONFIG_ECRYPT_FS=m CONFIG_SQUASHFS=y CONFIG_SQUASHFS_FILE_CACHE=y # CONFIG_SQUASHFS_FILE_DIRECT is not set -CONFIG_SQUASHFS_DECOMP_SINGLE=y +# CONFIG_SQUASHFS_DECOMP_SINGLE is not set # CONFIG_SQUASHFS_DECOMP_MULTI is not set -# CONFIG_SQUASHFS_DECOMP_MULTI_PERCPU is not set -# CONFIG_SQUASHFS_XATTR is not set +CONFIG_SQUASHFS_DECOMP_MULTI_PERCPU=y +CONFIG_SQUASHFS_XATTR=y CONFIG_SQUASHFS_ZLIB=y -# CONFIG_SQUASHFS_LZ4 is not set -# CONFIG_SQUASHFS_LZO is not set -# CONFIG_SQUASHFS_XZ is not set -# CONFIG_SQUASHFS_ZSTD is not set +CONFIG_SQUASHFS_LZ4=y +CONFIG_SQUASHFS_LZO=y +CONFIG_SQUASHFS_XZ=y +CONFIG_SQUASHFS_ZSTD=y # CONFIG_SQUASHFS_4K_DEVBLK_SIZE is not set -# CONFIG_SQUASHFS_EMBEDDED is not set +CONFIG_SQUASHFS_EMBEDDED=y CONFIG_SQUASHFS_FRAGMENT_CACHE_SIZE=3 # CONFIG_VXFS_FS is not set # CONFIG_MINIX_FS is not set diff --git a/patch/kernel/sunxi-dev/patch-4.19.4-5.patch b/patch/kernel/sunxi-dev/patch-4.19.4-5.patch new file mode 100644 index 000000000..008e8595f --- /dev/null +++ b/patch/kernel/sunxi-dev/patch-4.19.4-5.patch @@ -0,0 +1,4298 @@ +diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt +index 92eb1f42240d..fa4eec22816d 100644 +--- a/Documentation/admin-guide/kernel-parameters.txt ++++ b/Documentation/admin-guide/kernel-parameters.txt +@@ -1063,7 +1063,7 @@ + earlyprintk=serial[,0x...[,baudrate]] + earlyprintk=ttySn[,baudrate] + earlyprintk=dbgp[debugController#] +- earlyprintk=pciserial,bus:device.function[,baudrate] ++ earlyprintk=pciserial[,force],bus:device.function[,baudrate] + earlyprintk=xdbc[xhciController#] + + earlyprintk is useful when the kernel crashes before +@@ -1095,6 +1095,10 @@ + + The sclp output can only be used on s390. + ++ The optional "force" to "pciserial" enables use of a ++ PCI device even when its classcode is not of the ++ UART class. ++ + edac_report= [HW,EDAC] Control how to report EDAC event + Format: {"on" | "off" | "force"} + on: enable EDAC to report H/W event. May be overridden +@@ -4683,6 +4687,8 @@ + prevent spurious wakeup); + n = USB_QUIRK_DELAY_CTRL_MSG (Device needs a + pause after every control message); ++ o = USB_QUIRK_HUB_SLOW_RESET (Hub needs extra ++ delay after resetting its port); + Example: quirks=0781:5580:bk,0a5c:5834:gij + + usbhid.mousepoll= +diff --git a/Documentation/x86/x86_64/mm.txt b/Documentation/x86/x86_64/mm.txt +index 5432a96d31ff..05ef53d83a41 100644 +--- a/Documentation/x86/x86_64/mm.txt ++++ b/Documentation/x86/x86_64/mm.txt +@@ -4,8 +4,9 @@ Virtual memory map with 4 level page tables: + 0000000000000000 - 00007fffffffffff (=47 bits) user space, different per mm + hole caused by [47:63] sign extension + ffff800000000000 - ffff87ffffffffff (=43 bits) guard hole, reserved for hypervisor +-ffff880000000000 - ffffc7ffffffffff (=64 TB) direct mapping of all phys. memory +-ffffc80000000000 - ffffc8ffffffffff (=40 bits) hole ++ffff880000000000 - ffff887fffffffff (=39 bits) LDT remap for PTI ++ffff888000000000 - ffffc87fffffffff (=64 TB) direct mapping of all phys. memory ++ffffc88000000000 - ffffc8ffffffffff (=39 bits) hole + ffffc90000000000 - ffffe8ffffffffff (=45 bits) vmalloc/ioremap space + ffffe90000000000 - ffffe9ffffffffff (=40 bits) hole + ffffea0000000000 - ffffeaffffffffff (=40 bits) virtual memory map (1TB) +@@ -30,8 +31,9 @@ Virtual memory map with 5 level page tables: + 0000000000000000 - 00ffffffffffffff (=56 bits) user space, different per mm + hole caused by [56:63] sign extension + ff00000000000000 - ff0fffffffffffff (=52 bits) guard hole, reserved for hypervisor +-ff10000000000000 - ff8fffffffffffff (=55 bits) direct mapping of all phys. memory +-ff90000000000000 - ff9fffffffffffff (=52 bits) LDT remap for PTI ++ff10000000000000 - ff10ffffffffffff (=48 bits) LDT remap for PTI ++ff11000000000000 - ff90ffffffffffff (=55 bits) direct mapping of all phys. memory ++ff91000000000000 - ff9fffffffffffff (=3840 TB) hole + ffa0000000000000 - ffd1ffffffffffff (=54 bits) vmalloc/ioremap space (12800 TB) + ffd2000000000000 - ffd3ffffffffffff (=49 bits) hole + ffd4000000000000 - ffd5ffffffffffff (=49 bits) virtual memory map (512TB) +diff --git a/Makefile b/Makefile +index 1f3c7adeea63..a07830185bdf 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 19 +-SUBLEVEL = 4 ++SUBLEVEL = 5 + EXTRAVERSION = + NAME = "People's Front" + +diff --git a/arch/arm/boot/dts/imx53-ppd.dts b/arch/arm/boot/dts/imx53-ppd.dts +index cdb90bee7b4a..f202396e3f2a 100644 +--- a/arch/arm/boot/dts/imx53-ppd.dts ++++ b/arch/arm/boot/dts/imx53-ppd.dts +@@ -55,7 +55,7 @@ + }; + + chosen { +- stdout-path = "&uart1:115200n8"; ++ stdout-path = "serial0:115200n8"; + }; + + memory@70000000 { +diff --git a/arch/arm/boot/dts/imx6sll.dtsi b/arch/arm/boot/dts/imx6sll.dtsi +index 000e6136a9d6..3e6ffaf5f104 100644 +--- a/arch/arm/boot/dts/imx6sll.dtsi ++++ b/arch/arm/boot/dts/imx6sll.dtsi +@@ -709,7 +709,7 @@ + i2c1: i2c@21a0000 { + #address-cells = <1>; + #size-cells = <0>; +- compatible = "fs,imx6sll-i2c", "fsl,imx21-i2c"; ++ compatible = "fsl,imx6sll-i2c", "fsl,imx21-i2c"; + reg = <0x021a0000 0x4000>; + interrupts = ; + clocks = <&clks IMX6SLL_CLK_I2C1>; +diff --git a/arch/arm/boot/dts/vf610m4-colibri.dts b/arch/arm/boot/dts/vf610m4-colibri.dts +index 41ec66a96990..ca6249558760 100644 +--- a/arch/arm/boot/dts/vf610m4-colibri.dts ++++ b/arch/arm/boot/dts/vf610m4-colibri.dts +@@ -50,8 +50,8 @@ + compatible = "fsl,vf610m4"; + + chosen { +- bootargs = "console=ttyLP2,115200 clk_ignore_unused init=/linuxrc rw"; +- stdout-path = "&uart2"; ++ bootargs = "clk_ignore_unused init=/linuxrc rw"; ++ stdout-path = "serial2:115200"; + }; + + memory@8c000000 { +diff --git a/arch/arm64/boot/dts/renesas/r8a7795.dtsi b/arch/arm64/boot/dts/renesas/r8a7795.dtsi +index fb9d08ad7659..c87eed77de2c 100644 +--- a/arch/arm64/boot/dts/renesas/r8a7795.dtsi ++++ b/arch/arm64/boot/dts/renesas/r8a7795.dtsi +@@ -662,7 +662,7 @@ + clock-names = "fck", "brg_int", "scif_clk"; + dmas = <&dmac1 0x35>, <&dmac1 0x34>, + <&dmac2 0x35>, <&dmac2 0x34>; +- dma-names = "tx", "rx"; ++ dma-names = "tx", "rx", "tx", "rx"; + power-domains = <&sysc R8A7795_PD_ALWAYS_ON>; + resets = <&cpg 518>; + status = "disabled"; +diff --git a/arch/arm64/boot/dts/renesas/r8a77980-condor.dts b/arch/arm64/boot/dts/renesas/r8a77980-condor.dts +index 9f25c407dfd7..e830b6162375 100644 +--- a/arch/arm64/boot/dts/renesas/r8a77980-condor.dts ++++ b/arch/arm64/boot/dts/renesas/r8a77980-condor.dts +@@ -15,7 +15,7 @@ + + aliases { + serial0 = &scif0; +- ethernet0 = &avb; ++ ethernet0 = &gether; + }; + + chosen { +@@ -47,23 +47,6 @@ + }; + }; + +-&avb { +- pinctrl-0 = <&avb_pins>; +- pinctrl-names = "default"; +- +- phy-mode = "rgmii-id"; +- phy-handle = <&phy0>; +- renesas,no-ether-link; +- status = "okay"; +- +- phy0: ethernet-phy@0 { +- rxc-skew-ps = <1500>; +- reg = <0>; +- interrupt-parent = <&gpio1>; +- interrupts = <17 IRQ_TYPE_LEVEL_LOW>; +- }; +-}; +- + &canfd { + pinctrl-0 = <&canfd0_pins>; + pinctrl-names = "default"; +@@ -82,6 +65,23 @@ + clock-frequency = <32768>; + }; + ++&gether { ++ pinctrl-0 = <&gether_pins>; ++ pinctrl-names = "default"; ++ ++ phy-mode = "rgmii-id"; ++ phy-handle = <&phy0>; ++ renesas,no-ether-link; ++ status = "okay"; ++ ++ phy0: ethernet-phy@0 { ++ rxc-skew-ps = <1500>; ++ reg = <0>; ++ interrupt-parent = <&gpio4>; ++ interrupts = <23 IRQ_TYPE_LEVEL_LOW>; ++ }; ++}; ++ + &i2c0 { + pinctrl-0 = <&i2c0_pins>; + pinctrl-names = "default"; +@@ -118,16 +118,17 @@ + }; + + &pfc { +- avb_pins: avb { +- groups = "avb_mdio", "avb_rgmii"; +- function = "avb"; +- }; +- + canfd0_pins: canfd0 { + groups = "canfd0_data_a"; + function = "canfd0"; + }; + ++ gether_pins: gether { ++ groups = "gether_mdio_a", "gether_rgmii", ++ "gether_txcrefclk", "gether_txcrefclk_mega"; ++ function = "gether"; ++ }; ++ + i2c0_pins: i2c0 { + groups = "i2c0"; + function = "i2c0"; +diff --git a/arch/arm64/include/asm/percpu.h b/arch/arm64/include/asm/percpu.h +index 9234013e759e..21a81b59a0cc 100644 +--- a/arch/arm64/include/asm/percpu.h ++++ b/arch/arm64/include/asm/percpu.h +@@ -96,6 +96,7 @@ static inline unsigned long __percpu_##op(void *ptr, \ + : [val] "Ir" (val)); \ + break; \ + default: \ ++ ret = 0; \ + BUILD_BUG(); \ + } \ + \ +@@ -125,6 +126,7 @@ static inline unsigned long __percpu_read(void *ptr, int size) + ret = READ_ONCE(*(u64 *)ptr); + break; + default: ++ ret = 0; + BUILD_BUG(); + } + +@@ -194,6 +196,7 @@ static inline unsigned long __percpu_xchg(void *ptr, unsigned long val, + : [val] "r" (val)); + break; + default: ++ ret = 0; + BUILD_BUG(); + } + +diff --git a/arch/arm64/kernel/probes/kprobes.c b/arch/arm64/kernel/probes/kprobes.c +index e78c3ef04d95..b5a367d4bba6 100644 +--- a/arch/arm64/kernel/probes/kprobes.c ++++ b/arch/arm64/kernel/probes/kprobes.c +@@ -23,7 +23,9 @@ + #include + #include + #include ++#include + #include ++#include + #include + #include + #include +@@ -42,10 +44,21 @@ DEFINE_PER_CPU(struct kprobe_ctlblk, kprobe_ctlblk); + static void __kprobes + post_kprobe_handler(struct kprobe_ctlblk *, struct pt_regs *); + ++static int __kprobes patch_text(kprobe_opcode_t *addr, u32 opcode) ++{ ++ void *addrs[1]; ++ u32 insns[1]; ++ ++ addrs[0] = addr; ++ insns[0] = opcode; ++ ++ return aarch64_insn_patch_text(addrs, insns, 1); ++} ++ + static void __kprobes arch_prepare_ss_slot(struct kprobe *p) + { + /* prepare insn slot */ +- p->ainsn.api.insn[0] = cpu_to_le32(p->opcode); ++ patch_text(p->ainsn.api.insn, p->opcode); + + flush_icache_range((uintptr_t) (p->ainsn.api.insn), + (uintptr_t) (p->ainsn.api.insn) + +@@ -118,15 +131,15 @@ int __kprobes arch_prepare_kprobe(struct kprobe *p) + return 0; + } + +-static int __kprobes patch_text(kprobe_opcode_t *addr, u32 opcode) ++void *alloc_insn_page(void) + { +- void *addrs[1]; +- u32 insns[1]; ++ void *page; + +- addrs[0] = (void *)addr; +- insns[0] = (u32)opcode; ++ page = vmalloc_exec(PAGE_SIZE); ++ if (page) ++ set_memory_ro((unsigned long)page, 1); + +- return aarch64_insn_patch_text(addrs, insns, 1); ++ return page; + } + + /* arm kprobe: install breakpoint in text */ +diff --git a/arch/mips/configs/cavium_octeon_defconfig b/arch/mips/configs/cavium_octeon_defconfig +index 490b12af103c..c52d0efacd14 100644 +--- a/arch/mips/configs/cavium_octeon_defconfig ++++ b/arch/mips/configs/cavium_octeon_defconfig +@@ -140,6 +140,7 @@ CONFIG_RTC_CLASS=y + CONFIG_RTC_DRV_DS1307=y + CONFIG_STAGING=y + CONFIG_OCTEON_ETHERNET=y ++CONFIG_OCTEON_USB=y + # CONFIG_IOMMU_SUPPORT is not set + CONFIG_RAS=y + CONFIG_EXT4_FS=y +diff --git a/arch/riscv/include/asm/uaccess.h b/arch/riscv/include/asm/uaccess.h +index 473cfc84e412..8c3e3e3c8be1 100644 +--- a/arch/riscv/include/asm/uaccess.h ++++ b/arch/riscv/include/asm/uaccess.h +@@ -400,13 +400,13 @@ extern unsigned long __must_check __asm_copy_from_user(void *to, + static inline unsigned long + raw_copy_from_user(void *to, const void __user *from, unsigned long n) + { +- return __asm_copy_to_user(to, from, n); ++ return __asm_copy_from_user(to, from, n); + } + + static inline unsigned long + raw_copy_to_user(void __user *to, const void *from, unsigned long n) + { +- return __asm_copy_from_user(to, from, n); ++ return __asm_copy_to_user(to, from, n); + } + + extern long strncpy_from_user(char *dest, const char __user *src, long count); +diff --git a/arch/s390/boot/compressed/Makefile b/arch/s390/boot/compressed/Makefile +index 04609478d18b..b375c6c5ae7b 100644 +--- a/arch/s390/boot/compressed/Makefile ++++ b/arch/s390/boot/compressed/Makefile +@@ -20,7 +20,7 @@ KBUILD_CFLAGS := $(KBUILD_CFLAGS_DECOMPRESSOR) + OBJECTS := $(addprefix $(obj)/,$(obj-y)) + + LDFLAGS_vmlinux := --oformat $(LD_BFD) -e startup -T +-$(obj)/vmlinux: $(obj)/vmlinux.lds $(objtree)/arch/s390/boot/startup.a $(OBJECTS) ++$(obj)/vmlinux: $(obj)/vmlinux.lds $(objtree)/arch/s390/boot/startup.a $(OBJECTS) FORCE + $(call if_changed,ld) + + # extract required uncompressed vmlinux symbols and adjust them to reflect offsets inside vmlinux.bin +@@ -51,17 +51,17 @@ suffix-$(CONFIG_KERNEL_LZMA) := .lzma + suffix-$(CONFIG_KERNEL_LZO) := .lzo + suffix-$(CONFIG_KERNEL_XZ) := .xz + +-$(obj)/vmlinux.bin.gz: $(vmlinux.bin.all-y) ++$(obj)/vmlinux.bin.gz: $(vmlinux.bin.all-y) FORCE + $(call if_changed,gzip) +-$(obj)/vmlinux.bin.bz2: $(vmlinux.bin.all-y) ++$(obj)/vmlinux.bin.bz2: $(vmlinux.bin.all-y) FORCE + $(call if_changed,bzip2) +-$(obj)/vmlinux.bin.lz4: $(vmlinux.bin.all-y) ++$(obj)/vmlinux.bin.lz4: $(vmlinux.bin.all-y) FORCE + $(call if_changed,lz4) +-$(obj)/vmlinux.bin.lzma: $(vmlinux.bin.all-y) ++$(obj)/vmlinux.bin.lzma: $(vmlinux.bin.all-y) FORCE + $(call if_changed,lzma) +-$(obj)/vmlinux.bin.lzo: $(vmlinux.bin.all-y) ++$(obj)/vmlinux.bin.lzo: $(vmlinux.bin.all-y) FORCE + $(call if_changed,lzo) +-$(obj)/vmlinux.bin.xz: $(vmlinux.bin.all-y) ++$(obj)/vmlinux.bin.xz: $(vmlinux.bin.all-y) FORCE + $(call if_changed,xzkern) + + LDFLAGS_piggy.o := -r --format binary --oformat $(LD_BFD) -T +diff --git a/arch/s390/include/asm/mmu_context.h b/arch/s390/include/asm/mmu_context.h +index 0717ee76885d..f1ab9420ccfb 100644 +--- a/arch/s390/include/asm/mmu_context.h ++++ b/arch/s390/include/asm/mmu_context.h +@@ -45,8 +45,6 @@ static inline int init_new_context(struct task_struct *tsk, + mm->context.asce_limit = STACK_TOP_MAX; + mm->context.asce = __pa(mm->pgd) | _ASCE_TABLE_LENGTH | + _ASCE_USER_BITS | _ASCE_TYPE_REGION3; +- /* pgd_alloc() did not account this pud */ +- mm_inc_nr_puds(mm); + break; + case -PAGE_SIZE: + /* forked 5-level task, set new asce with new_mm->pgd */ +@@ -62,9 +60,6 @@ static inline int init_new_context(struct task_struct *tsk, + /* forked 2-level compat task, set new asce with new mm->pgd */ + mm->context.asce = __pa(mm->pgd) | _ASCE_TABLE_LENGTH | + _ASCE_USER_BITS | _ASCE_TYPE_SEGMENT; +- /* pgd_alloc() did not account this pmd */ +- mm_inc_nr_pmds(mm); +- mm_inc_nr_puds(mm); + } + crst_table_init((unsigned long *) mm->pgd, pgd_entry_type(mm)); + return 0; +diff --git a/arch/s390/include/asm/pgalloc.h b/arch/s390/include/asm/pgalloc.h +index f0f9bcf94c03..5ee733720a57 100644 +--- a/arch/s390/include/asm/pgalloc.h ++++ b/arch/s390/include/asm/pgalloc.h +@@ -36,11 +36,11 @@ static inline void crst_table_init(unsigned long *crst, unsigned long entry) + + static inline unsigned long pgd_entry_type(struct mm_struct *mm) + { +- if (mm->context.asce_limit <= _REGION3_SIZE) ++ if (mm_pmd_folded(mm)) + return _SEGMENT_ENTRY_EMPTY; +- if (mm->context.asce_limit <= _REGION2_SIZE) ++ if (mm_pud_folded(mm)) + return _REGION3_ENTRY_EMPTY; +- if (mm->context.asce_limit <= _REGION1_SIZE) ++ if (mm_p4d_folded(mm)) + return _REGION2_ENTRY_EMPTY; + return _REGION1_ENTRY_EMPTY; + } +diff --git a/arch/s390/include/asm/pgtable.h b/arch/s390/include/asm/pgtable.h +index 0e7cb0dc9c33..de05466ce50c 100644 +--- a/arch/s390/include/asm/pgtable.h ++++ b/arch/s390/include/asm/pgtable.h +@@ -485,6 +485,24 @@ static inline int is_module_addr(void *addr) + _REGION_ENTRY_PROTECT | \ + _REGION_ENTRY_NOEXEC) + ++static inline bool mm_p4d_folded(struct mm_struct *mm) ++{ ++ return mm->context.asce_limit <= _REGION1_SIZE; ++} ++#define mm_p4d_folded(mm) mm_p4d_folded(mm) ++ ++static inline bool mm_pud_folded(struct mm_struct *mm) ++{ ++ return mm->context.asce_limit <= _REGION2_SIZE; ++} ++#define mm_pud_folded(mm) mm_pud_folded(mm) ++ ++static inline bool mm_pmd_folded(struct mm_struct *mm) ++{ ++ return mm->context.asce_limit <= _REGION3_SIZE; ++} ++#define mm_pmd_folded(mm) mm_pmd_folded(mm) ++ + static inline int mm_has_pgste(struct mm_struct *mm) + { + #ifdef CONFIG_PGSTE +diff --git a/arch/s390/include/asm/tlb.h b/arch/s390/include/asm/tlb.h +index 457b7ba0fbb6..b31c779cf581 100644 +--- a/arch/s390/include/asm/tlb.h ++++ b/arch/s390/include/asm/tlb.h +@@ -136,7 +136,7 @@ static inline void pte_free_tlb(struct mmu_gather *tlb, pgtable_t pte, + static inline void pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmd, + unsigned long address) + { +- if (tlb->mm->context.asce_limit <= _REGION3_SIZE) ++ if (mm_pmd_folded(tlb->mm)) + return; + pgtable_pmd_page_dtor(virt_to_page(pmd)); + tlb_remove_table(tlb, pmd); +@@ -152,7 +152,7 @@ static inline void pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmd, + static inline void p4d_free_tlb(struct mmu_gather *tlb, p4d_t *p4d, + unsigned long address) + { +- if (tlb->mm->context.asce_limit <= _REGION1_SIZE) ++ if (mm_p4d_folded(tlb->mm)) + return; + tlb_remove_table(tlb, p4d); + } +@@ -167,7 +167,7 @@ static inline void p4d_free_tlb(struct mmu_gather *tlb, p4d_t *p4d, + static inline void pud_free_tlb(struct mmu_gather *tlb, pud_t *pud, + unsigned long address) + { +- if (tlb->mm->context.asce_limit <= _REGION2_SIZE) ++ if (mm_pud_folded(tlb->mm)) + return; + tlb_remove_table(tlb, pud); + } +diff --git a/arch/s390/kernel/perf_cpum_cf.c b/arch/s390/kernel/perf_cpum_cf.c +index cc085e2d2ce9..74091fd3101e 100644 +--- a/arch/s390/kernel/perf_cpum_cf.c ++++ b/arch/s390/kernel/perf_cpum_cf.c +@@ -373,7 +373,7 @@ static int __hw_perf_event_init(struct perf_event *event) + return -ENOENT; + + if (ev > PERF_CPUM_CF_MAX_CTR) +- return -EINVAL; ++ return -ENOENT; + + /* Obtain the counter set to which the specified counter belongs */ + set = get_counter_set(ev); +diff --git a/arch/s390/kernel/vdso32/Makefile b/arch/s390/kernel/vdso32/Makefile +index c5c856f320bc..04dd3e2c3bd9 100644 +--- a/arch/s390/kernel/vdso32/Makefile ++++ b/arch/s390/kernel/vdso32/Makefile +@@ -36,7 +36,7 @@ UBSAN_SANITIZE := n + $(obj)/vdso32_wrapper.o : $(obj)/vdso32.so + + # link rule for the .so file, .lds has to be first +-$(obj)/vdso32.so.dbg: $(src)/vdso32.lds $(obj-vdso32) ++$(obj)/vdso32.so.dbg: $(src)/vdso32.lds $(obj-vdso32) FORCE + $(call if_changed,vdso32ld) + + # strip rule for the .so file +@@ -45,12 +45,12 @@ $(obj)/%.so: $(obj)/%.so.dbg FORCE + $(call if_changed,objcopy) + + # assembly rules for the .S files +-$(obj-vdso32): %.o: %.S ++$(obj-vdso32): %.o: %.S FORCE + $(call if_changed_dep,vdso32as) + + # actual build commands + quiet_cmd_vdso32ld = VDSO32L $@ +- cmd_vdso32ld = $(CC) $(c_flags) -Wl,-T $^ -o $@ ++ cmd_vdso32ld = $(CC) $(c_flags) -Wl,-T $(filter %.lds %.o,$^) -o $@ + quiet_cmd_vdso32as = VDSO32A $@ + cmd_vdso32as = $(CC) $(a_flags) -c -o $@ $< + +diff --git a/arch/s390/kernel/vdso64/Makefile b/arch/s390/kernel/vdso64/Makefile +index 15b1ceafc4c1..ddebc26cd949 100644 +--- a/arch/s390/kernel/vdso64/Makefile ++++ b/arch/s390/kernel/vdso64/Makefile +@@ -36,7 +36,7 @@ UBSAN_SANITIZE := n + $(obj)/vdso64_wrapper.o : $(obj)/vdso64.so + + # link rule for the .so file, .lds has to be first +-$(obj)/vdso64.so.dbg: $(src)/vdso64.lds $(obj-vdso64) ++$(obj)/vdso64.so.dbg: $(src)/vdso64.lds $(obj-vdso64) FORCE + $(call if_changed,vdso64ld) + + # strip rule for the .so file +@@ -45,12 +45,12 @@ $(obj)/%.so: $(obj)/%.so.dbg FORCE + $(call if_changed,objcopy) + + # assembly rules for the .S files +-$(obj-vdso64): %.o: %.S ++$(obj-vdso64): %.o: %.S FORCE + $(call if_changed_dep,vdso64as) + + # actual build commands + quiet_cmd_vdso64ld = VDSO64L $@ +- cmd_vdso64ld = $(CC) $(c_flags) -Wl,-T $^ -o $@ ++ cmd_vdso64ld = $(CC) $(c_flags) -Wl,-T $(filter %.lds %.o,$^) -o $@ + quiet_cmd_vdso64as = VDSO64A $@ + cmd_vdso64as = $(CC) $(a_flags) -c -o $@ $< + +diff --git a/arch/s390/mm/pgalloc.c b/arch/s390/mm/pgalloc.c +index 76d89ee8b428..814f26520aa2 100644 +--- a/arch/s390/mm/pgalloc.c ++++ b/arch/s390/mm/pgalloc.c +@@ -101,6 +101,7 @@ int crst_table_upgrade(struct mm_struct *mm, unsigned long end) + mm->context.asce_limit = _REGION1_SIZE; + mm->context.asce = __pa(mm->pgd) | _ASCE_TABLE_LENGTH | + _ASCE_USER_BITS | _ASCE_TYPE_REGION2; ++ mm_inc_nr_puds(mm); + } else { + crst_table_init(table, _REGION1_ENTRY_EMPTY); + pgd_populate(mm, (pgd_t *) table, (p4d_t *) pgd); +diff --git a/arch/s390/numa/numa.c b/arch/s390/numa/numa.c +index 5bd374491f94..6c151b42e65d 100644 +--- a/arch/s390/numa/numa.c ++++ b/arch/s390/numa/numa.c +@@ -54,6 +54,7 @@ int __node_distance(int a, int b) + { + return mode->distance ? mode->distance(a, b) : 0; + } ++EXPORT_SYMBOL(__node_distance); + + int numa_debug_enabled; + +diff --git a/arch/um/os-Linux/skas/process.c b/arch/um/os-Linux/skas/process.c +index c94c3bd70ccd..df4a985716eb 100644 +--- a/arch/um/os-Linux/skas/process.c ++++ b/arch/um/os-Linux/skas/process.c +@@ -610,6 +610,11 @@ int start_idle_thread(void *stack, jmp_buf *switch_buf) + fatal_sigsegv(); + } + longjmp(*switch_buf, 1); ++ ++ /* unreachable */ ++ printk(UM_KERN_ERR "impossible long jump!"); ++ fatal_sigsegv(); ++ return 0; + } + + void initial_thread_cb_skas(void (*proc)(void *), void *arg) +diff --git a/arch/x86/include/asm/page_64_types.h b/arch/x86/include/asm/page_64_types.h +index 6afac386a434..b99d497e342d 100644 +--- a/arch/x86/include/asm/page_64_types.h ++++ b/arch/x86/include/asm/page_64_types.h +@@ -33,12 +33,14 @@ + + /* + * Set __PAGE_OFFSET to the most negative possible address + +- * PGDIR_SIZE*16 (pgd slot 272). The gap is to allow a space for a +- * hypervisor to fit. Choosing 16 slots here is arbitrary, but it's +- * what Xen requires. ++ * PGDIR_SIZE*17 (pgd slot 273). ++ * ++ * The gap is to allow a space for LDT remap for PTI (1 pgd slot) and space for ++ * a hypervisor (16 slots). Choosing 16 slots for a hypervisor is arbitrary, ++ * but it's what Xen requires. + */ +-#define __PAGE_OFFSET_BASE_L5 _AC(0xff10000000000000, UL) +-#define __PAGE_OFFSET_BASE_L4 _AC(0xffff880000000000, UL) ++#define __PAGE_OFFSET_BASE_L5 _AC(0xff11000000000000, UL) ++#define __PAGE_OFFSET_BASE_L4 _AC(0xffff888000000000, UL) + + #ifdef CONFIG_DYNAMIC_MEMORY_LAYOUT + #define __PAGE_OFFSET page_offset_base +diff --git a/arch/x86/include/asm/pgtable_64_types.h b/arch/x86/include/asm/pgtable_64_types.h +index 04edd2d58211..84bd9bdc1987 100644 +--- a/arch/x86/include/asm/pgtable_64_types.h ++++ b/arch/x86/include/asm/pgtable_64_types.h +@@ -111,9 +111,7 @@ extern unsigned int ptrs_per_p4d; + */ + #define MAXMEM (1UL << MAX_PHYSMEM_BITS) + +-#define LDT_PGD_ENTRY_L4 -3UL +-#define LDT_PGD_ENTRY_L5 -112UL +-#define LDT_PGD_ENTRY (pgtable_l5_enabled() ? LDT_PGD_ENTRY_L5 : LDT_PGD_ENTRY_L4) ++#define LDT_PGD_ENTRY -240UL + #define LDT_BASE_ADDR (LDT_PGD_ENTRY << PGDIR_SHIFT) + #define LDT_END_ADDR (LDT_BASE_ADDR + PGDIR_SIZE) + +diff --git a/arch/x86/kernel/early_printk.c b/arch/x86/kernel/early_printk.c +index 5e801c8c8ce7..374a52fa5296 100644 +--- a/arch/x86/kernel/early_printk.c ++++ b/arch/x86/kernel/early_printk.c +@@ -213,8 +213,9 @@ static unsigned int mem32_serial_in(unsigned long addr, int offset) + * early_pci_serial_init() + * + * This function is invoked when the early_printk param starts with "pciserial" +- * The rest of the param should be ",B:D.F,baud" where B, D & F describe the +- * location of a PCI device that must be a UART device. ++ * The rest of the param should be "[force],B:D.F,baud", where B, D & F describe ++ * the location of a PCI device that must be a UART device. "force" is optional ++ * and overrides the use of an UART device with a wrong PCI class code. + */ + static __init void early_pci_serial_init(char *s) + { +@@ -224,17 +225,23 @@ static __init void early_pci_serial_init(char *s) + u32 classcode, bar0; + u16 cmdreg; + char *e; ++ int force = 0; + +- +- /* +- * First, part the param to get the BDF values +- */ + if (*s == ',') + ++s; + + if (*s == 0) + return; + ++ /* Force the use of an UART device with wrong class code */ ++ if (!strncmp(s, "force,", 6)) { ++ force = 1; ++ s += 6; ++ } ++ ++ /* ++ * Part the param to get the BDF values ++ */ + bus = (u8)simple_strtoul(s, &e, 16); + s = e; + if (*s != ':') +@@ -253,7 +260,7 @@ static __init void early_pci_serial_init(char *s) + s++; + + /* +- * Second, find the device from the BDF ++ * Find the device from the BDF + */ + cmdreg = read_pci_config(bus, slot, func, PCI_COMMAND); + classcode = read_pci_config(bus, slot, func, PCI_CLASS_REVISION); +@@ -264,8 +271,10 @@ static __init void early_pci_serial_init(char *s) + */ + if (((classcode >> 16 != PCI_CLASS_COMMUNICATION_MODEM) && + (classcode >> 16 != PCI_CLASS_COMMUNICATION_SERIAL)) || +- (((classcode >> 8) & 0xff) != 0x02)) /* 16550 I/F at BAR0 */ +- return; ++ (((classcode >> 8) & 0xff) != 0x02)) /* 16550 I/F at BAR0 */ { ++ if (!force) ++ return; ++ } + + /* + * Determine if it is IO or memory mapped +@@ -289,7 +298,7 @@ static __init void early_pci_serial_init(char *s) + } + + /* +- * Lastly, initialize the hardware ++ * Initialize the hardware + */ + if (*s) { + if (strcmp(s, "nocfg") == 0) +diff --git a/arch/x86/kernel/ldt.c b/arch/x86/kernel/ldt.c +index 733e6ace0fa4..65590eee6289 100644 +--- a/arch/x86/kernel/ldt.c ++++ b/arch/x86/kernel/ldt.c +@@ -199,14 +199,6 @@ static void sanity_check_ldt_mapping(struct mm_struct *mm) + /* + * If PTI is enabled, this maps the LDT into the kernelmode and + * usermode tables for the given mm. +- * +- * There is no corresponding unmap function. Even if the LDT is freed, we +- * leave the PTEs around until the slot is reused or the mm is destroyed. +- * This is harmless: the LDT is always in ordinary memory, and no one will +- * access the freed slot. +- * +- * If we wanted to unmap freed LDTs, we'd also need to do a flush to make +- * it useful, and the flush would slow down modify_ldt(). + */ + static int + map_ldt_struct(struct mm_struct *mm, struct ldt_struct *ldt, int slot) +@@ -214,8 +206,7 @@ map_ldt_struct(struct mm_struct *mm, struct ldt_struct *ldt, int slot) + unsigned long va; + bool is_vmalloc; + spinlock_t *ptl; +- pgd_t *pgd; +- int i; ++ int i, nr_pages; + + if (!static_cpu_has(X86_FEATURE_PTI)) + return 0; +@@ -229,16 +220,11 @@ map_ldt_struct(struct mm_struct *mm, struct ldt_struct *ldt, int slot) + /* Check if the current mappings are sane */ + sanity_check_ldt_mapping(mm); + +- /* +- * Did we already have the top level entry allocated? We can't +- * use pgd_none() for this because it doens't do anything on +- * 4-level page table kernels. +- */ +- pgd = pgd_offset(mm, LDT_BASE_ADDR); +- + is_vmalloc = is_vmalloc_addr(ldt->entries); + +- for (i = 0; i * PAGE_SIZE < ldt->nr_entries * LDT_ENTRY_SIZE; i++) { ++ nr_pages = DIV_ROUND_UP(ldt->nr_entries * LDT_ENTRY_SIZE, PAGE_SIZE); ++ ++ for (i = 0; i < nr_pages; i++) { + unsigned long offset = i << PAGE_SHIFT; + const void *src = (char *)ldt->entries + offset; + unsigned long pfn; +@@ -272,13 +258,39 @@ map_ldt_struct(struct mm_struct *mm, struct ldt_struct *ldt, int slot) + /* Propagate LDT mapping to the user page-table */ + map_ldt_struct_to_user(mm); + +- va = (unsigned long)ldt_slot_va(slot); +- flush_tlb_mm_range(mm, va, va + LDT_SLOT_STRIDE, 0); +- + ldt->slot = slot; + return 0; + } + ++static void unmap_ldt_struct(struct mm_struct *mm, struct ldt_struct *ldt) ++{ ++ unsigned long va; ++ int i, nr_pages; ++ ++ if (!ldt) ++ return; ++ ++ /* LDT map/unmap is only required for PTI */ ++ if (!static_cpu_has(X86_FEATURE_PTI)) ++ return; ++ ++ nr_pages = DIV_ROUND_UP(ldt->nr_entries * LDT_ENTRY_SIZE, PAGE_SIZE); ++ ++ for (i = 0; i < nr_pages; i++) { ++ unsigned long offset = i << PAGE_SHIFT; ++ spinlock_t *ptl; ++ pte_t *ptep; ++ ++ va = (unsigned long)ldt_slot_va(ldt->slot) + offset; ++ ptep = get_locked_pte(mm, va, &ptl); ++ pte_clear(mm, va, ptep); ++ pte_unmap_unlock(ptep, ptl); ++ } ++ ++ va = (unsigned long)ldt_slot_va(ldt->slot); ++ flush_tlb_mm_range(mm, va, va + nr_pages * PAGE_SIZE, 0); ++} ++ + #else /* !CONFIG_PAGE_TABLE_ISOLATION */ + + static int +@@ -286,6 +298,10 @@ map_ldt_struct(struct mm_struct *mm, struct ldt_struct *ldt, int slot) + { + return 0; + } ++ ++static void unmap_ldt_struct(struct mm_struct *mm, struct ldt_struct *ldt) ++{ ++} + #endif /* CONFIG_PAGE_TABLE_ISOLATION */ + + static void free_ldt_pgtables(struct mm_struct *mm) +@@ -524,6 +540,7 @@ static int write_ldt(void __user *ptr, unsigned long bytecount, int oldmode) + } + + install_ldt(mm, new_ldt); ++ unmap_ldt_struct(mm, old_ldt); + free_ldt_struct(old_ldt); + error = 0; + +diff --git a/arch/x86/xen/mmu_pv.c b/arch/x86/xen/mmu_pv.c +index dd461c0167ef..2c84c6ad8b50 100644 +--- a/arch/x86/xen/mmu_pv.c ++++ b/arch/x86/xen/mmu_pv.c +@@ -1897,7 +1897,7 @@ void __init xen_setup_kernel_pagetable(pgd_t *pgd, unsigned long max_pfn) + init_top_pgt[0] = __pgd(0); + + /* Pre-constructed entries are in pfn, so convert to mfn */ +- /* L4[272] -> level3_ident_pgt */ ++ /* L4[273] -> level3_ident_pgt */ + /* L4[511] -> level3_kernel_pgt */ + convert_pfn_mfn(init_top_pgt); + +@@ -1917,8 +1917,8 @@ void __init xen_setup_kernel_pagetable(pgd_t *pgd, unsigned long max_pfn) + addr[0] = (unsigned long)pgd; + addr[1] = (unsigned long)l3; + addr[2] = (unsigned long)l2; +- /* Graft it onto L4[272][0]. Note that we creating an aliasing problem: +- * Both L4[272][0] and L4[511][510] have entries that point to the same ++ /* Graft it onto L4[273][0]. Note that we creating an aliasing problem: ++ * Both L4[273][0] and L4[511][510] have entries that point to the same + * L2 (PMD) tables. Meaning that if you modify it in __va space + * it will be also modified in the __ka space! (But if you just + * modify the PMD table to point to other PTE's or none, then you +diff --git a/block/bio.c b/block/bio.c +index 0093bed81c0e..41173710430c 100644 +--- a/block/bio.c ++++ b/block/bio.c +@@ -1261,6 +1261,7 @@ struct bio *bio_copy_user_iov(struct request_queue *q, + if (ret) + goto cleanup; + } else { ++ zero_fill_bio(bio); + iov_iter_advance(iter, bio->bi_iter.bi_size); + } + +diff --git a/drivers/acpi/acpi_platform.c b/drivers/acpi/acpi_platform.c +index eaa60c94205a..1f32caa87686 100644 +--- a/drivers/acpi/acpi_platform.c ++++ b/drivers/acpi/acpi_platform.c +@@ -30,6 +30,7 @@ static const struct acpi_device_id forbidden_id_list[] = { + {"PNP0200", 0}, /* AT DMA Controller */ + {"ACPI0009", 0}, /* IOxAPIC */ + {"ACPI000A", 0}, /* IOAPIC */ ++ {"SMB0001", 0}, /* ACPI SMBUS virtual device */ + {"", 0}, + }; + +diff --git a/drivers/block/brd.c b/drivers/block/brd.c +index df8103dd40ac..c18586fccb6f 100644 +--- a/drivers/block/brd.c ++++ b/drivers/block/brd.c +@@ -396,15 +396,14 @@ static struct brd_device *brd_alloc(int i) + disk->first_minor = i * max_part; + disk->fops = &brd_fops; + disk->private_data = brd; +- disk->queue = brd->brd_queue; + disk->flags = GENHD_FL_EXT_DEVT; + sprintf(disk->disk_name, "ram%d", i); + set_capacity(disk, rd_size * 2); +- disk->queue->backing_dev_info->capabilities |= BDI_CAP_SYNCHRONOUS_IO; ++ brd->brd_queue->backing_dev_info->capabilities |= BDI_CAP_SYNCHRONOUS_IO; + + /* Tell the block layer that this is not a rotational device */ +- blk_queue_flag_set(QUEUE_FLAG_NONROT, disk->queue); +- blk_queue_flag_clear(QUEUE_FLAG_ADD_RANDOM, disk->queue); ++ blk_queue_flag_set(QUEUE_FLAG_NONROT, brd->brd_queue); ++ blk_queue_flag_clear(QUEUE_FLAG_ADD_RANDOM, brd->brd_queue); + + return brd; + +@@ -436,6 +435,7 @@ static struct brd_device *brd_init_one(int i, bool *new) + + brd = brd_alloc(i); + if (brd) { ++ brd->brd_disk->queue = brd->brd_queue; + add_disk(brd->brd_disk); + list_add_tail(&brd->brd_list, &brd_devices); + } +@@ -503,8 +503,14 @@ static int __init brd_init(void) + + /* point of no return */ + +- list_for_each_entry(brd, &brd_devices, brd_list) ++ list_for_each_entry(brd, &brd_devices, brd_list) { ++ /* ++ * associate with queue just before adding disk for ++ * avoiding to mess up failure path ++ */ ++ brd->brd_disk->queue = brd->brd_queue; + add_disk(brd->brd_disk); ++ } + + blk_register_region(MKDEV(RAMDISK_MAJOR, 0), 1UL << MINORBITS, + THIS_MODULE, brd_probe, NULL, NULL); +diff --git a/drivers/clk/clk-fixed-factor.c b/drivers/clk/clk-fixed-factor.c +index 20724abd38bd..7df6b5b1e7ee 100644 +--- a/drivers/clk/clk-fixed-factor.c ++++ b/drivers/clk/clk-fixed-factor.c +@@ -210,6 +210,7 @@ static int of_fixed_factor_clk_remove(struct platform_device *pdev) + { + struct clk *clk = platform_get_drvdata(pdev); + ++ of_clk_del_provider(pdev->dev.of_node); + clk_unregister_fixed_factor(clk); + + return 0; +diff --git a/drivers/clk/clk-fixed-rate.c b/drivers/clk/clk-fixed-rate.c +index b5c46b3f8764..6d6475c32ee5 100644 +--- a/drivers/clk/clk-fixed-rate.c ++++ b/drivers/clk/clk-fixed-rate.c +@@ -200,6 +200,7 @@ static int of_fixed_clk_remove(struct platform_device *pdev) + { + struct clk *clk = platform_get_drvdata(pdev); + ++ of_clk_del_provider(pdev->dev.of_node); + clk_unregister_fixed_rate(clk); + + return 0; +diff --git a/drivers/clk/meson/axg.c b/drivers/clk/meson/axg.c +index 8cf74fc423e6..02229d051d77 100644 +--- a/drivers/clk/meson/axg.c ++++ b/drivers/clk/meson/axg.c +@@ -96,7 +96,6 @@ static struct clk_regmap axg_sys_pll = { + .ops = &meson_clk_pll_ro_ops, + .parent_names = (const char *[]){ "xtal" }, + .num_parents = 1, +- .flags = CLK_GET_RATE_NOCACHE, + }, + }; + +@@ -713,12 +712,14 @@ static struct clk_regmap axg_pcie_mux = { + .offset = HHI_PCIE_PLL_CNTL6, + .mask = 0x1, + .shift = 2, ++ /* skip the parent mpll3, reserved for debug */ ++ .table = (u32[]){ 1 }, + }, + .hw.init = &(struct clk_init_data){ + .name = "pcie_mux", + .ops = &clk_regmap_mux_ops, +- .parent_names = (const char *[]){ "mpll3", "pcie_pll" }, +- .num_parents = 2, ++ .parent_names = (const char *[]){ "pcie_pll" }, ++ .num_parents = 1, + .flags = CLK_SET_RATE_PARENT, + }, + }; +diff --git a/drivers/clk/meson/gxbb.c b/drivers/clk/meson/gxbb.c +index 6435d86118f1..6628ffa31383 100644 +--- a/drivers/clk/meson/gxbb.c ++++ b/drivers/clk/meson/gxbb.c +@@ -213,7 +213,6 @@ static struct clk_regmap gxbb_fixed_pll = { + .ops = &meson_clk_pll_ro_ops, + .parent_names = (const char *[]){ "xtal" }, + .num_parents = 1, +- .flags = CLK_GET_RATE_NOCACHE, + }, + }; + +@@ -276,6 +275,10 @@ static struct clk_regmap gxbb_hdmi_pll = { + .ops = &meson_clk_pll_ro_ops, + .parent_names = (const char *[]){ "hdmi_pll_pre_mult" }, + .num_parents = 1, ++ /* ++ * Display directly handle hdmi pll registers ATM, we need ++ * NOCACHE to keep our view of the clock as accurate as possible ++ */ + .flags = CLK_GET_RATE_NOCACHE, + }, + }; +@@ -334,6 +337,10 @@ static struct clk_regmap gxl_hdmi_pll = { + .ops = &meson_clk_pll_ro_ops, + .parent_names = (const char *[]){ "xtal" }, + .num_parents = 1, ++ /* ++ * Display directly handle hdmi pll registers ATM, we need ++ * NOCACHE to keep our view of the clock as accurate as possible ++ */ + .flags = CLK_GET_RATE_NOCACHE, + }, + }; +@@ -371,7 +378,6 @@ static struct clk_regmap gxbb_sys_pll = { + .ops = &meson_clk_pll_ro_ops, + .parent_names = (const char *[]){ "xtal" }, + .num_parents = 1, +- .flags = CLK_GET_RATE_NOCACHE, + }, + }; + +@@ -418,7 +424,6 @@ static struct clk_regmap gxbb_gp0_pll = { + .ops = &meson_clk_pll_ops, + .parent_names = (const char *[]){ "xtal" }, + .num_parents = 1, +- .flags = CLK_GET_RATE_NOCACHE, + }, + }; + +@@ -472,7 +477,6 @@ static struct clk_regmap gxl_gp0_pll = { + .ops = &meson_clk_pll_ops, + .parent_names = (const char *[]){ "xtal" }, + .num_parents = 1, +- .flags = CLK_GET_RATE_NOCACHE, + }, + }; + +diff --git a/drivers/clk/meson/meson8b.c b/drivers/clk/meson/meson8b.c +index 7447d96a265f..74697e145dde 100644 +--- a/drivers/clk/meson/meson8b.c ++++ b/drivers/clk/meson/meson8b.c +@@ -132,7 +132,6 @@ static struct clk_regmap meson8b_fixed_pll = { + .ops = &meson_clk_pll_ro_ops, + .parent_names = (const char *[]){ "xtal" }, + .num_parents = 1, +- .flags = CLK_GET_RATE_NOCACHE, + }, + }; + +@@ -169,7 +168,6 @@ static struct clk_regmap meson8b_vid_pll = { + .ops = &meson_clk_pll_ro_ops, + .parent_names = (const char *[]){ "xtal" }, + .num_parents = 1, +- .flags = CLK_GET_RATE_NOCACHE, + }, + }; + +@@ -207,7 +205,6 @@ static struct clk_regmap meson8b_sys_pll = { + .ops = &meson_clk_pll_ro_ops, + .parent_names = (const char *[]){ "xtal" }, + .num_parents = 1, +- .flags = CLK_GET_RATE_NOCACHE, + }, + }; + +diff --git a/drivers/clk/renesas/r9a06g032-clocks.c b/drivers/clk/renesas/r9a06g032-clocks.c +index a0b6ecdc63dd..6d2b56891559 100644 +--- a/drivers/clk/renesas/r9a06g032-clocks.c ++++ b/drivers/clk/renesas/r9a06g032-clocks.c +@@ -539,7 +539,8 @@ r9a06g032_div_round_rate(struct clk_hw *hw, + * several uarts attached to this divider, and changing this impacts + * everyone. + */ +- if (clk->index == R9A06G032_DIV_UART) { ++ if (clk->index == R9A06G032_DIV_UART || ++ clk->index == R9A06G032_DIV_P2_PG) { + pr_devel("%s div uart hack!\n", __func__); + return clk_get_rate(hw->clk); + } +diff --git a/drivers/clk/samsung/clk-exynos5420.c b/drivers/clk/samsung/clk-exynos5420.c +index 95e1bf69449b..d4f77c4eb277 100644 +--- a/drivers/clk/samsung/clk-exynos5420.c ++++ b/drivers/clk/samsung/clk-exynos5420.c +@@ -281,6 +281,7 @@ static const struct samsung_clk_reg_dump exynos5420_set_clksrc[] = { + { .offset = GATE_BUS_TOP, .value = 0xffffffff, }, + { .offset = GATE_BUS_DISP1, .value = 0xffffffff, }, + { .offset = GATE_IP_PERIC, .value = 0xffffffff, }, ++ { .offset = GATE_IP_PERIS, .value = 0xffffffff, }, + }; + + static int exynos5420_clk_suspend(void) +diff --git a/drivers/clk/ti/clk.c b/drivers/clk/ti/clk.c +index 7d22e1af2247..27e0979b3158 100644 +--- a/drivers/clk/ti/clk.c ++++ b/drivers/clk/ti/clk.c +@@ -129,7 +129,7 @@ int ti_clk_setup_ll_ops(struct ti_clk_ll_ops *ops) + void __init ti_dt_clocks_register(struct ti_dt_clk oclks[]) + { + struct ti_dt_clk *c; +- struct device_node *node; ++ struct device_node *node, *parent; + struct clk *clk; + struct of_phandle_args clkspec; + char buf[64]; +@@ -164,8 +164,12 @@ void __init ti_dt_clocks_register(struct ti_dt_clk oclks[]) + continue; + + node = of_find_node_by_name(NULL, buf); +- if (num_args) +- node = of_find_node_by_name(node, "clk"); ++ if (num_args) { ++ parent = node; ++ node = of_get_child_by_name(parent, "clk"); ++ of_node_put(parent); ++ } ++ + clkspec.np = node; + clkspec.args_count = num_args; + for (i = 0; i < num_args; i++) { +@@ -173,11 +177,12 @@ void __init ti_dt_clocks_register(struct ti_dt_clk oclks[]) + if (ret) { + pr_warn("Bad tag in %s at %d: %s\n", + c->node_name, i, tags[i]); ++ of_node_put(node); + return; + } + } + clk = of_clk_get_from_provider(&clkspec); +- ++ of_node_put(node); + if (!IS_ERR(clk)) { + c->lk.clk = clk; + clkdev_add(&c->lk); +diff --git a/drivers/gnss/serial.c b/drivers/gnss/serial.c +index b01ba4438501..31e891f00175 100644 +--- a/drivers/gnss/serial.c ++++ b/drivers/gnss/serial.c +@@ -13,6 +13,7 @@ + #include + #include + #include ++#include + #include + #include + +@@ -63,7 +64,7 @@ static int gnss_serial_write_raw(struct gnss_device *gdev, + int ret; + + /* write is only buffered synchronously */ +- ret = serdev_device_write(serdev, buf, count, 0); ++ ret = serdev_device_write(serdev, buf, count, MAX_SCHEDULE_TIMEOUT); + if (ret < 0) + return ret; + +diff --git a/drivers/gnss/sirf.c b/drivers/gnss/sirf.c +index 79cb98950013..71d014edd167 100644 +--- a/drivers/gnss/sirf.c ++++ b/drivers/gnss/sirf.c +@@ -16,6 +16,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -83,7 +84,7 @@ static int sirf_write_raw(struct gnss_device *gdev, const unsigned char *buf, + int ret; + + /* write is only buffered synchronously */ +- ret = serdev_device_write(serdev, buf, count, 0); ++ ret = serdev_device_write(serdev, buf, count, MAX_SCHEDULE_TIMEOUT); + if (ret < 0) + return ret; + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index 6903fe6c894b..ef5c6af4d964 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -3167,7 +3167,7 @@ void dm_drm_plane_destroy_state(struct drm_plane *plane, + static const struct drm_plane_funcs dm_plane_funcs = { + .update_plane = drm_atomic_helper_update_plane, + .disable_plane = drm_atomic_helper_disable_plane, +- .destroy = drm_plane_cleanup, ++ .destroy = drm_primary_helper_destroy, + .reset = dm_drm_plane_reset, + .atomic_duplicate_state = dm_drm_plane_duplicate_state, + .atomic_destroy_state = dm_drm_plane_destroy_state, +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h +index a29dc35954c9..aba2c5c1d2f8 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h +@@ -173,8 +173,6 @@ struct amdgpu_dm_connector { + struct mutex hpd_lock; + + bool fake_enable; +- +- bool mst_connected; + }; + + #define to_amdgpu_dm_connector(x) container_of(x, struct amdgpu_dm_connector, base) +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c +index 9a300732ba37..4cc45a1d21db 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c +@@ -317,12 +317,7 @@ dm_dp_create_fake_mst_encoder(struct amdgpu_dm_connector *connector) + struct amdgpu_device *adev = dev->dev_private; + struct amdgpu_encoder *amdgpu_encoder; + struct drm_encoder *encoder; +- const struct drm_connector_helper_funcs *connector_funcs = +- connector->base.helper_private; +- struct drm_encoder *enc_master = +- connector_funcs->best_encoder(&connector->base); + +- DRM_DEBUG_KMS("enc master is %p\n", enc_master); + amdgpu_encoder = kzalloc(sizeof(*amdgpu_encoder), GFP_KERNEL); + if (!amdgpu_encoder) + return NULL; +@@ -352,25 +347,6 @@ dm_dp_add_mst_connector(struct drm_dp_mst_topology_mgr *mgr, + struct amdgpu_device *adev = dev->dev_private; + struct amdgpu_dm_connector *aconnector; + struct drm_connector *connector; +- struct drm_connector_list_iter conn_iter; +- +- drm_connector_list_iter_begin(dev, &conn_iter); +- drm_for_each_connector_iter(connector, &conn_iter) { +- aconnector = to_amdgpu_dm_connector(connector); +- if (aconnector->mst_port == master +- && !aconnector->port) { +- DRM_INFO("DM_MST: reusing connector: %p [id: %d] [master: %p]\n", +- aconnector, connector->base.id, aconnector->mst_port); +- +- aconnector->port = port; +- drm_connector_set_path_property(connector, pathprop); +- +- drm_connector_list_iter_end(&conn_iter); +- aconnector->mst_connected = true; +- return &aconnector->base; +- } +- } +- drm_connector_list_iter_end(&conn_iter); + + aconnector = kzalloc(sizeof(*aconnector), GFP_KERNEL); + if (!aconnector) +@@ -419,8 +395,6 @@ dm_dp_add_mst_connector(struct drm_dp_mst_topology_mgr *mgr, + */ + amdgpu_dm_connector_funcs_reset(connector); + +- aconnector->mst_connected = true; +- + DRM_INFO("DM_MST: added connector: %p [id: %d] [master: %p]\n", + aconnector, connector->base.id, aconnector->mst_port); + +@@ -432,6 +406,9 @@ dm_dp_add_mst_connector(struct drm_dp_mst_topology_mgr *mgr, + static void dm_dp_destroy_mst_connector(struct drm_dp_mst_topology_mgr *mgr, + struct drm_connector *connector) + { ++ struct amdgpu_dm_connector *master = container_of(mgr, struct amdgpu_dm_connector, mst_mgr); ++ struct drm_device *dev = master->base.dev; ++ struct amdgpu_device *adev = dev->dev_private; + struct amdgpu_dm_connector *aconnector = to_amdgpu_dm_connector(connector); + + DRM_INFO("DM_MST: Disabling connector: %p [id: %d] [master: %p]\n", +@@ -445,7 +422,10 @@ static void dm_dp_destroy_mst_connector(struct drm_dp_mst_topology_mgr *mgr, + aconnector->dc_sink = NULL; + } + +- aconnector->mst_connected = false; ++ drm_connector_unregister(connector); ++ if (adev->mode_info.rfbdev) ++ drm_fb_helper_remove_one_connector(&adev->mode_info.rfbdev->helper, connector); ++ drm_connector_put(connector); + } + + static void dm_dp_mst_hotplug(struct drm_dp_mst_topology_mgr *mgr) +@@ -456,18 +436,10 @@ static void dm_dp_mst_hotplug(struct drm_dp_mst_topology_mgr *mgr) + drm_kms_helper_hotplug_event(dev); + } + +-static void dm_dp_mst_link_status_reset(struct drm_connector *connector) +-{ +- mutex_lock(&connector->dev->mode_config.mutex); +- drm_connector_set_link_status_property(connector, DRM_MODE_LINK_STATUS_BAD); +- mutex_unlock(&connector->dev->mode_config.mutex); +-} +- + static void dm_dp_mst_register_connector(struct drm_connector *connector) + { + struct drm_device *dev = connector->dev; + struct amdgpu_device *adev = dev->dev_private; +- struct amdgpu_dm_connector *aconnector = to_amdgpu_dm_connector(connector); + + if (adev->mode_info.rfbdev) + drm_fb_helper_add_one_connector(&adev->mode_info.rfbdev->helper, connector); +@@ -475,9 +447,6 @@ static void dm_dp_mst_register_connector(struct drm_connector *connector) + DRM_ERROR("adev->mode_info.rfbdev is NULL\n"); + + drm_connector_register(connector); +- +- if (aconnector->mst_connected) +- dm_dp_mst_link_status_reset(connector); + } + + static const struct drm_dp_mst_topology_cbs dm_mst_cbs = { +diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c +index ff0bfc65a8c1..b506e3622b08 100644 +--- a/drivers/gpu/drm/drm_edid.c ++++ b/drivers/gpu/drm/drm_edid.c +@@ -122,6 +122,9 @@ static const struct edid_quirk { + /* SDC panel of Lenovo B50-80 reports 8 bpc, but is a 6 bpc panel */ + { "SDC", 0x3652, EDID_QUIRK_FORCE_6BPC }, + ++ /* BOE model 0x0771 reports 8 bpc, but is a 6 bpc panel */ ++ { "BOE", 0x0771, EDID_QUIRK_FORCE_6BPC }, ++ + /* Belinea 10 15 55 */ + { "MAX", 1516, EDID_QUIRK_PREFER_LARGE_60 }, + { "MAX", 0x77e, EDID_QUIRK_PREFER_LARGE_60 }, +diff --git a/drivers/gpu/drm/exynos/exynos5433_drm_decon.c b/drivers/gpu/drm/exynos/exynos5433_drm_decon.c +index 94529aa82339..aef487dd8731 100644 +--- a/drivers/gpu/drm/exynos/exynos5433_drm_decon.c ++++ b/drivers/gpu/drm/exynos/exynos5433_drm_decon.c +@@ -164,13 +164,6 @@ static u32 decon_get_frame_count(struct decon_context *ctx, bool end) + return frm; + } + +-static u32 decon_get_vblank_counter(struct exynos_drm_crtc *crtc) +-{ +- struct decon_context *ctx = crtc->ctx; +- +- return decon_get_frame_count(ctx, false); +-} +- + static void decon_setup_trigger(struct decon_context *ctx) + { + if (!ctx->crtc->i80_mode && !(ctx->out_type & I80_HW_TRG)) +@@ -536,7 +529,6 @@ static const struct exynos_drm_crtc_ops decon_crtc_ops = { + .disable = decon_disable, + .enable_vblank = decon_enable_vblank, + .disable_vblank = decon_disable_vblank, +- .get_vblank_counter = decon_get_vblank_counter, + .atomic_begin = decon_atomic_begin, + .update_plane = decon_update_plane, + .disable_plane = decon_disable_plane, +@@ -554,7 +546,6 @@ static int decon_bind(struct device *dev, struct device *master, void *data) + int ret; + + ctx->drm_dev = drm_dev; +- drm_dev->max_vblank_count = 0xffffffff; + + for (win = ctx->first_win; win < WINDOWS_NR; win++) { + ctx->configs[win].pixel_formats = decon_formats; +diff --git a/drivers/gpu/drm/exynos/exynos_drm_crtc.c b/drivers/gpu/drm/exynos/exynos_drm_crtc.c +index eea90251808f..2696289ecc78 100644 +--- a/drivers/gpu/drm/exynos/exynos_drm_crtc.c ++++ b/drivers/gpu/drm/exynos/exynos_drm_crtc.c +@@ -162,16 +162,6 @@ static void exynos_drm_crtc_disable_vblank(struct drm_crtc *crtc) + exynos_crtc->ops->disable_vblank(exynos_crtc); + } + +-static u32 exynos_drm_crtc_get_vblank_counter(struct drm_crtc *crtc) +-{ +- struct exynos_drm_crtc *exynos_crtc = to_exynos_crtc(crtc); +- +- if (exynos_crtc->ops->get_vblank_counter) +- return exynos_crtc->ops->get_vblank_counter(exynos_crtc); +- +- return 0; +-} +- + static const struct drm_crtc_funcs exynos_crtc_funcs = { + .set_config = drm_atomic_helper_set_config, + .page_flip = drm_atomic_helper_page_flip, +@@ -181,7 +171,6 @@ static const struct drm_crtc_funcs exynos_crtc_funcs = { + .atomic_destroy_state = drm_atomic_helper_crtc_destroy_state, + .enable_vblank = exynos_drm_crtc_enable_vblank, + .disable_vblank = exynos_drm_crtc_disable_vblank, +- .get_vblank_counter = exynos_drm_crtc_get_vblank_counter, + }; + + struct exynos_drm_crtc *exynos_drm_crtc_create(struct drm_device *drm_dev, +diff --git a/drivers/gpu/drm/exynos/exynos_drm_drv.h b/drivers/gpu/drm/exynos/exynos_drm_drv.h +index c737c4bd2c19..630f1edc5de2 100644 +--- a/drivers/gpu/drm/exynos/exynos_drm_drv.h ++++ b/drivers/gpu/drm/exynos/exynos_drm_drv.h +@@ -133,7 +133,6 @@ struct exynos_drm_crtc_ops { + void (*disable)(struct exynos_drm_crtc *crtc); + int (*enable_vblank)(struct exynos_drm_crtc *crtc); + void (*disable_vblank)(struct exynos_drm_crtc *crtc); +- u32 (*get_vblank_counter)(struct exynos_drm_crtc *crtc); + enum drm_mode_status (*mode_valid)(struct exynos_drm_crtc *crtc, + const struct drm_display_mode *mode); + bool (*mode_fixup)(struct exynos_drm_crtc *crtc, +diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h +index 4aca5344863d..d6c25bea4382 100644 +--- a/drivers/gpu/drm/i915/i915_drv.h ++++ b/drivers/gpu/drm/i915/i915_drv.h +@@ -2248,7 +2248,7 @@ static inline struct scatterlist *__sg_next(struct scatterlist *sg) + #define for_each_sgt_dma(__dmap, __iter, __sgt) \ + for ((__iter) = __sgt_iter((__sgt)->sgl, true); \ + ((__dmap) = (__iter).dma + (__iter).curr); \ +- (((__iter).curr += PAGE_SIZE) >= (__iter).max) ? \ ++ (((__iter).curr += I915_GTT_PAGE_SIZE) >= (__iter).max) ? \ + (__iter) = __sgt_iter(__sg_next((__iter).sgp), true), 0 : 0) + + /** +diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c +index 294a143b85f5..5f57f4e1fbc8 100644 +--- a/drivers/gpu/drm/i915/i915_gem_gtt.c ++++ b/drivers/gpu/drm/i915/i915_gem_gtt.c +@@ -1058,7 +1058,7 @@ gen8_ppgtt_insert_pte_entries(struct i915_hw_ppgtt *ppgtt, + do { + vaddr[idx->pte] = pte_encode | iter->dma; + +- iter->dma += PAGE_SIZE; ++ iter->dma += I915_GTT_PAGE_SIZE; + if (iter->dma >= iter->max) { + iter->sg = __sg_next(iter->sg); + if (!iter->sg) { +@@ -1770,7 +1770,7 @@ static void gen6_dump_ppgtt(struct i915_hw_ppgtt *base, struct seq_file *m) + + seq_printf(m, "\t\t(%03d, %04d) %08llx: ", + pde, pte, +- (pde * GEN6_PTES + pte) * PAGE_SIZE); ++ (pde * GEN6_PTES + pte) * I915_GTT_PAGE_SIZE); + for (i = 0; i < 4; i++) { + if (vaddr[pte + i] != scratch_pte) + seq_printf(m, " %08x", vaddr[pte + i]); +@@ -1910,7 +1910,7 @@ static void gen6_ppgtt_insert_entries(struct i915_address_space *vm, + do { + vaddr[act_pte] = pte_encode | GEN6_PTE_ADDR_ENCODE(iter.dma); + +- iter.dma += PAGE_SIZE; ++ iter.dma += I915_GTT_PAGE_SIZE; + if (iter.dma == iter.max) { + iter.sg = __sg_next(iter.sg); + if (!iter.sg) +@@ -2048,7 +2048,7 @@ static int pd_vma_bind(struct i915_vma *vma, + { + struct i915_ggtt *ggtt = i915_vm_to_ggtt(vma->vm); + struct gen6_hw_ppgtt *ppgtt = vma->private; +- u32 ggtt_offset = i915_ggtt_offset(vma) / PAGE_SIZE; ++ u32 ggtt_offset = i915_ggtt_offset(vma) / I915_GTT_PAGE_SIZE; + struct i915_page_table *pt; + unsigned int pde; + +@@ -2174,7 +2174,7 @@ static struct i915_hw_ppgtt *gen6_ppgtt_create(struct drm_i915_private *i915) + ppgtt->base.vm.i915 = i915; + ppgtt->base.vm.dma = &i915->drm.pdev->dev; + +- ppgtt->base.vm.total = I915_PDES * GEN6_PTES * PAGE_SIZE; ++ ppgtt->base.vm.total = I915_PDES * GEN6_PTES * I915_GTT_PAGE_SIZE; + + i915_address_space_init(&ppgtt->base.vm, i915); + +@@ -3031,7 +3031,7 @@ static unsigned int gen8_get_total_gtt_size(u16 bdw_gmch_ctl) + bdw_gmch_ctl = 1 << bdw_gmch_ctl; + + #ifdef CONFIG_X86_32 +- /* Limit 32b platforms to a 2GB GGTT: 4 << 20 / pte size * PAGE_SIZE */ ++ /* Limit 32b platforms to a 2GB GGTT: 4 << 20 / pte size * I915_GTT_PAGE_SIZE */ + if (bdw_gmch_ctl > 4) + bdw_gmch_ctl = 4; + #endif +@@ -3729,9 +3729,9 @@ rotate_pages(const dma_addr_t *in, unsigned int offset, + * the entries so the sg list can be happily traversed. + * The only thing we need are DMA addresses. + */ +- sg_set_page(sg, NULL, PAGE_SIZE, 0); ++ sg_set_page(sg, NULL, I915_GTT_PAGE_SIZE, 0); + sg_dma_address(sg) = in[offset + src_idx]; +- sg_dma_len(sg) = PAGE_SIZE; ++ sg_dma_len(sg) = I915_GTT_PAGE_SIZE; + sg = sg_next(sg); + src_idx -= stride; + } +@@ -3744,7 +3744,7 @@ static noinline struct sg_table * + intel_rotate_pages(struct intel_rotation_info *rot_info, + struct drm_i915_gem_object *obj) + { +- const unsigned long n_pages = obj->base.size / PAGE_SIZE; ++ const unsigned long n_pages = obj->base.size / I915_GTT_PAGE_SIZE; + unsigned int size = intel_rotation_info_size(rot_info); + struct sgt_iter sgt_iter; + dma_addr_t dma_addr; +diff --git a/drivers/hid/hid-alps.c b/drivers/hid/hid-alps.c +index aec253b44156..3cd7229b6e54 100644 +--- a/drivers/hid/hid-alps.c ++++ b/drivers/hid/hid-alps.c +@@ -660,6 +660,20 @@ exit: + return ret; + } + ++static int alps_sp_open(struct input_dev *dev) ++{ ++ struct hid_device *hid = input_get_drvdata(dev); ++ ++ return hid_hw_open(hid); ++} ++ ++static void alps_sp_close(struct input_dev *dev) ++{ ++ struct hid_device *hid = input_get_drvdata(dev); ++ ++ hid_hw_close(hid); ++} ++ + static int alps_input_configured(struct hid_device *hdev, struct hid_input *hi) + { + struct alps_dev *data = hid_get_drvdata(hdev); +@@ -733,6 +747,10 @@ static int alps_input_configured(struct hid_device *hdev, struct hid_input *hi) + input2->id.version = input->id.version; + input2->dev.parent = input->dev.parent; + ++ input_set_drvdata(input2, hdev); ++ input2->open = alps_sp_open; ++ input2->close = alps_sp_close; ++ + __set_bit(EV_KEY, input2->evbit); + data->sp_btn_cnt = (data->sp_btn_info & 0x0F); + for (i = 0; i < data->sp_btn_cnt; i++) +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index bc49909aba8e..501c05cbec7e 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -799,6 +799,7 @@ + #define USB_DEVICE_ID_MS_TOUCH_COVER_2 0x07a7 + #define USB_DEVICE_ID_MS_TYPE_COVER_2 0x07a9 + #define USB_DEVICE_ID_MS_POWER_COVER 0x07da ++#define USB_DEVICE_ID_MS_PIXART_MOUSE 0x00cb + + #define USB_VENDOR_ID_MOJO 0x8282 + #define USB_DEVICE_ID_RETRO_ADAPTER 0x3201 +@@ -921,6 +922,9 @@ + #define USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3003 0x3003 + #define USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3008 0x3008 + ++#define I2C_VENDOR_ID_RAYDIUM 0x2386 ++#define I2C_PRODUCT_ID_RAYDIUM_4B33 0x4b33 ++ + #define USB_VENDOR_ID_RAZER 0x1532 + #define USB_DEVICE_ID_RAZER_BLADE_14 0x011D + +@@ -1195,6 +1199,8 @@ + #define USB_DEVICE_ID_PRIMAX_MOUSE_4D22 0x4d22 + #define USB_DEVICE_ID_PRIMAX_KEYBOARD 0x4e05 + #define USB_DEVICE_ID_PRIMAX_REZEL 0x4e72 ++#define USB_DEVICE_ID_PRIMAX_PIXART_MOUSE_4D0F 0x4d0f ++#define USB_DEVICE_ID_PRIMAX_PIXART_MOUSE_4E22 0x4e22 + + + #define USB_VENDOR_ID_RISO_KAGAKU 0x1294 /* Riso Kagaku Corp. */ +diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c +index 249d49b6b16c..0a0605a7e481 100644 +--- a/drivers/hid/hid-quirks.c ++++ b/drivers/hid/hid-quirks.c +@@ -106,7 +106,7 @@ static const struct hid_device_id hid_quirks[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_MOUSE_C05A), HID_QUIRK_ALWAYS_POLL }, + { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_MOUSE_C06A), HID_QUIRK_ALWAYS_POLL }, + { HID_USB_DEVICE(USB_VENDOR_ID_MCS, USB_DEVICE_ID_MCS_GAMEPADBLOCK), HID_QUIRK_MULTI_INPUT }, +- { HID_USB_DEVICE(USB_VENDOR_ID_MGE, USB_DEVICE_ID_MGE_UPS), HID_QUIRK_NOGET }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_PIXART_MOUSE), HID_QUIRK_ALWAYS_POLL }, + { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_POWER_COVER), HID_QUIRK_NO_INIT_REPORTS }, + { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_SURFACE_PRO_2), HID_QUIRK_NO_INIT_REPORTS }, + { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TOUCH_COVER_2), HID_QUIRK_NO_INIT_REPORTS }, +@@ -129,6 +129,8 @@ static const struct hid_device_id hid_quirks[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN), HID_QUIRK_NO_INIT_REPORTS }, + { HID_USB_DEVICE(USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_USB_OPTICAL_MOUSE), HID_QUIRK_ALWAYS_POLL }, + { HID_USB_DEVICE(USB_VENDOR_ID_PRIMAX, USB_DEVICE_ID_PRIMAX_MOUSE_4D22), HID_QUIRK_ALWAYS_POLL }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_PRIMAX, USB_DEVICE_ID_PRIMAX_PIXART_MOUSE_4D0F), HID_QUIRK_ALWAYS_POLL }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_PRIMAX, USB_DEVICE_ID_PRIMAX_PIXART_MOUSE_4E22), HID_QUIRK_ALWAYS_POLL }, + { HID_USB_DEVICE(USB_VENDOR_ID_PRODIGE, USB_DEVICE_ID_PRODIGE_CORDLESS), HID_QUIRK_NOGET }, + { HID_USB_DEVICE(USB_VENDOR_ID_QUANTA, USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3001), HID_QUIRK_NOGET }, + { HID_USB_DEVICE(USB_VENDOR_ID_QUANTA, USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3003), HID_QUIRK_NOGET }, +diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c +index 4e3592e7a3f7..88daa388e1f6 100644 +--- a/drivers/hid/i2c-hid/i2c-hid.c ++++ b/drivers/hid/i2c-hid/i2c-hid.c +@@ -48,6 +48,7 @@ + #define I2C_HID_QUIRK_SET_PWR_WAKEUP_DEV BIT(0) + #define I2C_HID_QUIRK_NO_IRQ_AFTER_RESET BIT(1) + #define I2C_HID_QUIRK_NO_RUNTIME_PM BIT(2) ++#define I2C_HID_QUIRK_DELAY_AFTER_SLEEP BIT(3) + + /* flags */ + #define I2C_HID_STARTED 0 +@@ -157,6 +158,8 @@ struct i2c_hid { + + bool irq_wake_enabled; + struct mutex reset_lock; ++ ++ unsigned long sleep_delay; + }; + + static const struct i2c_hid_quirks { +@@ -171,6 +174,8 @@ static const struct i2c_hid_quirks { + { I2C_VENDOR_ID_HANTICK, I2C_PRODUCT_ID_HANTICK_5288, + I2C_HID_QUIRK_NO_IRQ_AFTER_RESET | + I2C_HID_QUIRK_NO_RUNTIME_PM }, ++ { I2C_VENDOR_ID_RAYDIUM, I2C_PRODUCT_ID_RAYDIUM_4B33, ++ I2C_HID_QUIRK_DELAY_AFTER_SLEEP }, + { 0, 0 } + }; + +@@ -386,6 +391,7 @@ static int i2c_hid_set_power(struct i2c_client *client, int power_state) + { + struct i2c_hid *ihid = i2c_get_clientdata(client); + int ret; ++ unsigned long now, delay; + + i2c_hid_dbg(ihid, "%s\n", __func__); + +@@ -403,9 +409,22 @@ static int i2c_hid_set_power(struct i2c_client *client, int power_state) + goto set_pwr_exit; + } + ++ if (ihid->quirks & I2C_HID_QUIRK_DELAY_AFTER_SLEEP && ++ power_state == I2C_HID_PWR_ON) { ++ now = jiffies; ++ if (time_after(ihid->sleep_delay, now)) { ++ delay = jiffies_to_usecs(ihid->sleep_delay - now); ++ usleep_range(delay, delay + 1); ++ } ++ } ++ + ret = __i2c_hid_command(client, &hid_set_power_cmd, power_state, + 0, NULL, 0, NULL, 0); + ++ if (ihid->quirks & I2C_HID_QUIRK_DELAY_AFTER_SLEEP && ++ power_state == I2C_HID_PWR_SLEEP) ++ ihid->sleep_delay = jiffies + msecs_to_jiffies(20); ++ + if (ret) + dev_err(&client->dev, "failed to change power setting.\n"); + +diff --git a/drivers/hid/uhid.c b/drivers/hid/uhid.c +index 3c5507313606..051639c09f72 100644 +--- a/drivers/hid/uhid.c ++++ b/drivers/hid/uhid.c +@@ -12,6 +12,7 @@ + + #include + #include ++#include + #include + #include + #include +@@ -722,6 +723,17 @@ static ssize_t uhid_char_write(struct file *file, const char __user *buffer, + + switch (uhid->input_buf.type) { + case UHID_CREATE: ++ /* ++ * 'struct uhid_create_req' contains a __user pointer which is ++ * copied from, so it's unsafe to allow this with elevated ++ * privileges (e.g. from a setuid binary) or via kernel_write(). ++ */ ++ if (file->f_cred != current_cred() || uaccess_kernel()) { ++ pr_err_once("UHID_CREATE from different security context by process %d (%s), this is not allowed.\n", ++ task_tgid_vnr(current), current->comm); ++ ret = -EACCES; ++ goto unlock; ++ } + ret = uhid_dev_create(uhid, &uhid->input_buf); + break; + case UHID_CREATE2: +diff --git a/drivers/hwmon/ibmpowernv.c b/drivers/hwmon/ibmpowernv.c +index 83472808c816..64d05edff130 100644 +--- a/drivers/hwmon/ibmpowernv.c ++++ b/drivers/hwmon/ibmpowernv.c +@@ -181,7 +181,7 @@ static ssize_t show_label(struct device *dev, struct device_attribute *devattr, + return sprintf(buf, "%s\n", sdata->label); + } + +-static int __init get_logical_cpu(int hwcpu) ++static int get_logical_cpu(int hwcpu) + { + int cpu; + +@@ -192,9 +192,8 @@ static int __init get_logical_cpu(int hwcpu) + return -ENOENT; + } + +-static void __init make_sensor_label(struct device_node *np, +- struct sensor_data *sdata, +- const char *label) ++static void make_sensor_label(struct device_node *np, ++ struct sensor_data *sdata, const char *label) + { + u32 id; + size_t n; +diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig +index 451d4ae50e66..ac4b09642f63 100644 +--- a/drivers/i2c/busses/Kconfig ++++ b/drivers/i2c/busses/Kconfig +@@ -751,7 +751,7 @@ config I2C_OCORES + + config I2C_OMAP + tristate "OMAP I2C adapter" +- depends on ARCH_OMAP ++ depends on ARCH_OMAP || ARCH_K3 + default y if MACH_OMAP_H3 || MACH_OMAP_OSK + help + If you say yes to this option, support will be included for the +diff --git a/drivers/i2c/busses/i2c-qcom-geni.c b/drivers/i2c/busses/i2c-qcom-geni.c +index 9f2eb02481d3..d7329177b0ea 100644 +--- a/drivers/i2c/busses/i2c-qcom-geni.c ++++ b/drivers/i2c/busses/i2c-qcom-geni.c +@@ -590,18 +590,19 @@ static int geni_i2c_probe(struct platform_device *pdev) + + dev_dbg(&pdev->dev, "i2c fifo/se-dma mode. fifo depth:%d\n", tx_depth); + +- ret = i2c_add_adapter(&gi2c->adap); +- if (ret) { +- dev_err(&pdev->dev, "Error adding i2c adapter %d\n", ret); +- return ret; +- } +- + gi2c->suspended = 1; + pm_runtime_set_suspended(gi2c->se.dev); + pm_runtime_set_autosuspend_delay(gi2c->se.dev, I2C_AUTO_SUSPEND_DELAY); + pm_runtime_use_autosuspend(gi2c->se.dev); + pm_runtime_enable(gi2c->se.dev); + ++ ret = i2c_add_adapter(&gi2c->adap); ++ if (ret) { ++ dev_err(&pdev->dev, "Error adding i2c adapter %d\n", ret); ++ pm_runtime_disable(gi2c->se.dev); ++ return ret; ++ } ++ + return 0; + } + +@@ -609,8 +610,8 @@ static int geni_i2c_remove(struct platform_device *pdev) + { + struct geni_i2c_dev *gi2c = platform_get_drvdata(pdev); + +- pm_runtime_disable(gi2c->se.dev); + i2c_del_adapter(&gi2c->adap); ++ pm_runtime_disable(gi2c->se.dev); + return 0; + } + +diff --git a/drivers/media/v4l2-core/v4l2-event.c b/drivers/media/v4l2-core/v4l2-event.c +index a3ef1f50a4b3..481e3c65cf97 100644 +--- a/drivers/media/v4l2-core/v4l2-event.c ++++ b/drivers/media/v4l2-core/v4l2-event.c +@@ -193,6 +193,22 @@ int v4l2_event_pending(struct v4l2_fh *fh) + } + EXPORT_SYMBOL_GPL(v4l2_event_pending); + ++static void __v4l2_event_unsubscribe(struct v4l2_subscribed_event *sev) ++{ ++ struct v4l2_fh *fh = sev->fh; ++ unsigned int i; ++ ++ lockdep_assert_held(&fh->subscribe_lock); ++ assert_spin_locked(&fh->vdev->fh_lock); ++ ++ /* Remove any pending events for this subscription */ ++ for (i = 0; i < sev->in_use; i++) { ++ list_del(&sev->events[sev_pos(sev, i)].list); ++ fh->navailable--; ++ } ++ list_del(&sev->list); ++} ++ + int v4l2_event_subscribe(struct v4l2_fh *fh, + const struct v4l2_event_subscription *sub, unsigned elems, + const struct v4l2_subscribed_event_ops *ops) +@@ -224,27 +240,23 @@ int v4l2_event_subscribe(struct v4l2_fh *fh, + + spin_lock_irqsave(&fh->vdev->fh_lock, flags); + found_ev = v4l2_event_subscribed(fh, sub->type, sub->id); ++ if (!found_ev) ++ list_add(&sev->list, &fh->subscribed); + spin_unlock_irqrestore(&fh->vdev->fh_lock, flags); + + if (found_ev) { + /* Already listening */ + kvfree(sev); +- goto out_unlock; +- } +- +- if (sev->ops && sev->ops->add) { ++ } else if (sev->ops && sev->ops->add) { + ret = sev->ops->add(sev, elems); + if (ret) { ++ spin_lock_irqsave(&fh->vdev->fh_lock, flags); ++ __v4l2_event_unsubscribe(sev); ++ spin_unlock_irqrestore(&fh->vdev->fh_lock, flags); + kvfree(sev); +- goto out_unlock; + } + } + +- spin_lock_irqsave(&fh->vdev->fh_lock, flags); +- list_add(&sev->list, &fh->subscribed); +- spin_unlock_irqrestore(&fh->vdev->fh_lock, flags); +- +-out_unlock: + mutex_unlock(&fh->subscribe_lock); + + return ret; +@@ -279,7 +291,6 @@ int v4l2_event_unsubscribe(struct v4l2_fh *fh, + { + struct v4l2_subscribed_event *sev; + unsigned long flags; +- int i; + + if (sub->type == V4L2_EVENT_ALL) { + v4l2_event_unsubscribe_all(fh); +@@ -291,14 +302,8 @@ int v4l2_event_unsubscribe(struct v4l2_fh *fh, + spin_lock_irqsave(&fh->vdev->fh_lock, flags); + + sev = v4l2_event_subscribed(fh, sub->type, sub->id); +- if (sev != NULL) { +- /* Remove any pending events for this subscription */ +- for (i = 0; i < sev->in_use; i++) { +- list_del(&sev->events[sev_pos(sev, i)].list); +- fh->navailable--; +- } +- list_del(&sev->list); +- } ++ if (sev != NULL) ++ __v4l2_event_unsubscribe(sev); + + spin_unlock_irqrestore(&fh->vdev->fh_lock, flags); + +diff --git a/drivers/misc/atmel-ssc.c b/drivers/misc/atmel-ssc.c +index b2a0340f277e..d8e3cc2dc747 100644 +--- a/drivers/misc/atmel-ssc.c ++++ b/drivers/misc/atmel-ssc.c +@@ -132,7 +132,7 @@ static const struct of_device_id atmel_ssc_dt_ids[] = { + MODULE_DEVICE_TABLE(of, atmel_ssc_dt_ids); + #endif + +-static inline const struct atmel_ssc_platform_data * __init ++static inline const struct atmel_ssc_platform_data * + atmel_ssc_get_driver_data(struct platform_device *pdev) + { + if (pdev->dev.of_node) { +diff --git a/drivers/misc/sgi-gru/grukdump.c b/drivers/misc/sgi-gru/grukdump.c +index 313da3150262..1540a7785e14 100644 +--- a/drivers/misc/sgi-gru/grukdump.c ++++ b/drivers/misc/sgi-gru/grukdump.c +@@ -27,6 +27,9 @@ + #include + #include + #include ++ ++#include ++ + #include "gru.h" + #include "grutables.h" + #include "gruhandles.h" +@@ -196,6 +199,7 @@ int gru_dump_chiplet_request(unsigned long arg) + /* Currently, only dump by gid is implemented */ + if (req.gid >= gru_max_gids) + return -EINVAL; ++ req.gid = array_index_nospec(req.gid, gru_max_gids); + + gru = GID_TO_GRU(req.gid); + ubuf = req.buf; +diff --git a/drivers/mtd/nand/raw/atmel/nand-controller.c b/drivers/mtd/nand/raw/atmel/nand-controller.c +index a594fb1e9a99..32e95af486a2 100644 +--- a/drivers/mtd/nand/raw/atmel/nand-controller.c ++++ b/drivers/mtd/nand/raw/atmel/nand-controller.c +@@ -2061,8 +2061,7 @@ atmel_hsmc_nand_controller_legacy_init(struct atmel_hsmc_nand_controller *nc) + int ret; + + nand_np = dev->of_node; +- nfc_np = of_find_compatible_node(dev->of_node, NULL, +- "atmel,sama5d3-nfc"); ++ nfc_np = of_get_compatible_child(dev->of_node, "atmel,sama5d3-nfc"); + if (!nfc_np) { + dev_err(dev, "Could not find device node for sama5d3-nfc\n"); + return -ENODEV; +@@ -2476,15 +2475,19 @@ static int atmel_nand_controller_probe(struct platform_device *pdev) + } + + if (caps->legacy_of_bindings) { ++ struct device_node *nfc_node; + u32 ale_offs = 21; + + /* + * If we are parsing legacy DT props and the DT contains a + * valid NFC node, forward the request to the sama5 logic. + */ +- if (of_find_compatible_node(pdev->dev.of_node, NULL, +- "atmel,sama5d3-nfc")) ++ nfc_node = of_get_compatible_child(pdev->dev.of_node, ++ "atmel,sama5d3-nfc"); ++ if (nfc_node) { + caps = &atmel_sama5_nand_caps; ++ of_node_put(nfc_node); ++ } + + /* + * Even if the compatible says we are dealing with an +diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c +index b939a4c10b84..c89c7d4900d7 100644 +--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c ++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c +@@ -528,7 +528,6 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb, + context = &priv->tx_contexts[i]; + + context->echo_index = i; +- can_put_echo_skb(skb, netdev, context->echo_index); + ++priv->active_tx_contexts; + if (priv->active_tx_contexts >= (int)dev->max_tx_urbs) + netif_stop_queue(netdev); +@@ -553,7 +552,6 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb, + dev_kfree_skb(skb); + spin_lock_irqsave(&priv->tx_contexts_lock, flags); + +- can_free_echo_skb(netdev, context->echo_index); + context->echo_index = dev->max_tx_urbs; + --priv->active_tx_contexts; + netif_wake_queue(netdev); +@@ -564,6 +562,8 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb, + + context->priv = priv; + ++ can_put_echo_skb(skb, netdev, context->echo_index); ++ + usb_fill_bulk_urb(urb, dev->udev, + usb_sndbulkpipe(dev->udev, + dev->bulk_out->bEndpointAddress), +diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c +index c084bae5ec0a..5fc0be564274 100644 +--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c ++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c +@@ -1019,6 +1019,11 @@ kvaser_usb_hydra_error_frame(struct kvaser_usb_net_priv *priv, + new_state : CAN_STATE_ERROR_ACTIVE; + + can_change_state(netdev, cf, tx_state, rx_state); ++ ++ if (priv->can.restart_ms && ++ old_state >= CAN_STATE_BUS_OFF && ++ new_state < CAN_STATE_BUS_OFF) ++ cf->can_id |= CAN_ERR_RESTARTED; + } + + if (new_state == CAN_STATE_BUS_OFF) { +@@ -1028,11 +1033,6 @@ kvaser_usb_hydra_error_frame(struct kvaser_usb_net_priv *priv, + + can_bus_off(netdev); + } +- +- if (priv->can.restart_ms && +- old_state >= CAN_STATE_BUS_OFF && +- new_state < CAN_STATE_BUS_OFF) +- cf->can_id |= CAN_ERR_RESTARTED; + } + + if (!skb) { +diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c +index 26dc6782b475..4f34808f1e06 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c ++++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c +@@ -590,7 +590,7 @@ int aq_nic_set_multicast_list(struct aq_nic_s *self, struct net_device *ndev) + } + } + +- if (i > 0 && i < AQ_HW_MULTICAST_ADDRESS_MAX) { ++ if (i > 0 && i <= AQ_HW_MULTICAST_ADDRESS_MAX) { + packet_filter |= IFF_MULTICAST; + self->mc_list.count = i; + self->aq_hw_ops->hw_multicast_list_set(self->aq_hw, +diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c +index d1e1a0ba8615..7134d0d4cdf7 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c ++++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c +@@ -172,6 +172,27 @@ bool aq_ring_tx_clean(struct aq_ring_s *self) + return !!budget; + } + ++static void aq_rx_checksum(struct aq_ring_s *self, ++ struct aq_ring_buff_s *buff, ++ struct sk_buff *skb) ++{ ++ if (!(self->aq_nic->ndev->features & NETIF_F_RXCSUM)) ++ return; ++ ++ if (unlikely(buff->is_cso_err)) { ++ ++self->stats.rx.errors; ++ skb->ip_summed = CHECKSUM_NONE; ++ return; ++ } ++ if (buff->is_ip_cso) { ++ __skb_incr_checksum_unnecessary(skb); ++ if (buff->is_udp_cso || buff->is_tcp_cso) ++ __skb_incr_checksum_unnecessary(skb); ++ } else { ++ skb->ip_summed = CHECKSUM_NONE; ++ } ++} ++ + #define AQ_SKB_ALIGN SKB_DATA_ALIGN(sizeof(struct skb_shared_info)) + int aq_ring_rx_clean(struct aq_ring_s *self, + struct napi_struct *napi, +@@ -267,18 +288,8 @@ int aq_ring_rx_clean(struct aq_ring_s *self, + } + + skb->protocol = eth_type_trans(skb, ndev); +- if (unlikely(buff->is_cso_err)) { +- ++self->stats.rx.errors; +- skb->ip_summed = CHECKSUM_NONE; +- } else { +- if (buff->is_ip_cso) { +- __skb_incr_checksum_unnecessary(skb); +- if (buff->is_udp_cso || buff->is_tcp_cso) +- __skb_incr_checksum_unnecessary(skb); +- } else { +- skb->ip_summed = CHECKSUM_NONE; +- } +- } ++ ++ aq_rx_checksum(self, buff, skb); + + skb_set_hash(skb, buff->rss_hash, + buff->is_hash_l4 ? PKT_HASH_TYPE_L4 : +diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c +index 1d44a386e7d3..88705dee5b95 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c ++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c +@@ -655,9 +655,9 @@ static int hw_atl_b0_hw_ring_rx_receive(struct aq_hw_s *self, + struct hw_atl_rxd_wb_s *rxd_wb = (struct hw_atl_rxd_wb_s *) + &ring->dx_ring[ring->hw_head * HW_ATL_B0_RXD_SIZE]; + +- unsigned int is_err = 1U; + unsigned int is_rx_check_sum_enabled = 0U; + unsigned int pkt_type = 0U; ++ u8 rx_stat = 0U; + + if (!(rxd_wb->status & 0x1U)) { /* RxD is not done */ + break; +@@ -665,35 +665,35 @@ static int hw_atl_b0_hw_ring_rx_receive(struct aq_hw_s *self, + + buff = &ring->buff_ring[ring->hw_head]; + +- is_err = (0x0000003CU & rxd_wb->status); ++ rx_stat = (0x0000003CU & rxd_wb->status) >> 2; + + is_rx_check_sum_enabled = (rxd_wb->type) & (0x3U << 19); +- is_err &= ~0x20U; /* exclude validity bit */ + + pkt_type = 0xFFU & (rxd_wb->type >> 4); + +- if (is_rx_check_sum_enabled) { +- if (0x0U == (pkt_type & 0x3U)) +- buff->is_ip_cso = (is_err & 0x08U) ? 0U : 1U; ++ if (is_rx_check_sum_enabled & BIT(0) && ++ (0x0U == (pkt_type & 0x3U))) ++ buff->is_ip_cso = (rx_stat & BIT(1)) ? 0U : 1U; + ++ if (is_rx_check_sum_enabled & BIT(1)) { + if (0x4U == (pkt_type & 0x1CU)) +- buff->is_udp_cso = buff->is_cso_err ? 0U : 1U; ++ buff->is_udp_cso = (rx_stat & BIT(2)) ? 0U : ++ !!(rx_stat & BIT(3)); + else if (0x0U == (pkt_type & 0x1CU)) +- buff->is_tcp_cso = buff->is_cso_err ? 0U : 1U; +- +- /* Checksum offload workaround for small packets */ +- if (rxd_wb->pkt_len <= 60) { +- buff->is_ip_cso = 0U; +- buff->is_cso_err = 0U; +- } ++ buff->is_tcp_cso = (rx_stat & BIT(2)) ? 0U : ++ !!(rx_stat & BIT(3)); ++ } ++ buff->is_cso_err = !!(rx_stat & 0x6); ++ /* Checksum offload workaround for small packets */ ++ if (unlikely(rxd_wb->pkt_len <= 60)) { ++ buff->is_ip_cso = 0U; ++ buff->is_cso_err = 0U; + } +- +- is_err &= ~0x18U; + + dma_unmap_page(ndev, buff->pa, buff->len, DMA_FROM_DEVICE); + +- if (is_err || rxd_wb->type & 0x1000U) { +- /* status error or DMA error */ ++ if ((rx_stat & BIT(0)) || rxd_wb->type & 0x1000U) { ++ /* MAC error or DMA error */ + buff->is_error = 1U; + } else { + if (self->aq_nic_cfg->is_rss) { +@@ -915,6 +915,12 @@ static int hw_atl_b0_hw_interrupt_moderation_set(struct aq_hw_s *self) + static int hw_atl_b0_hw_stop(struct aq_hw_s *self) + { + hw_atl_b0_hw_irq_disable(self, HW_ATL_B0_INT_MASK); ++ ++ /* Invalidate Descriptor Cache to prevent writing to the cached ++ * descriptors and to the data pointer of those descriptors ++ */ ++ hw_atl_rdm_rx_dma_desc_cache_init_set(self, 1); ++ + return aq_hw_err_from_flags(self); + } + +diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.c +index 10ba035dadb1..10ec5dc88e24 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.c ++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.c +@@ -619,6 +619,14 @@ void hw_atl_rpb_rx_flow_ctl_mode_set(struct aq_hw_s *aq_hw, u32 rx_flow_ctl_mode + HW_ATL_RPB_RX_FC_MODE_SHIFT, rx_flow_ctl_mode); + } + ++void hw_atl_rdm_rx_dma_desc_cache_init_set(struct aq_hw_s *aq_hw, u32 init) ++{ ++ aq_hw_write_reg_bit(aq_hw, HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_ADR, ++ HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_MSK, ++ HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_SHIFT, ++ init); ++} ++ + void hw_atl_rpb_rx_pkt_buff_size_per_tc_set(struct aq_hw_s *aq_hw, + u32 rx_pkt_buff_size_per_tc, u32 buffer) + { +diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.h b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.h +index dfb426f2dc2c..b3bf64b48b93 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.h ++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.h +@@ -325,6 +325,9 @@ void hw_atl_rpb_rx_pkt_buff_size_per_tc_set(struct aq_hw_s *aq_hw, + u32 rx_pkt_buff_size_per_tc, + u32 buffer); + ++/* set rdm rx dma descriptor cache init */ ++void hw_atl_rdm_rx_dma_desc_cache_init_set(struct aq_hw_s *aq_hw, u32 init); ++ + /* set rx xoff enable (per tc) */ + void hw_atl_rpb_rx_xoff_en_per_tc_set(struct aq_hw_s *aq_hw, u32 rx_xoff_en_per_tc, + u32 buffer); +diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh_internal.h b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh_internal.h +index e0cf70120f1d..e2ecdb1c5a5c 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh_internal.h ++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh_internal.h +@@ -293,6 +293,24 @@ + /* default value of bitfield desc{d}_reset */ + #define HW_ATL_RDM_DESCDRESET_DEFAULT 0x0 + ++/* rdm_desc_init_i bitfield definitions ++ * preprocessor definitions for the bitfield rdm_desc_init_i. ++ * port="pif_rdm_desc_init_i" ++ */ ++ ++/* register address for bitfield rdm_desc_init_i */ ++#define HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_ADR 0x00005a00 ++/* bitmask for bitfield rdm_desc_init_i */ ++#define HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_MSK 0xffffffff ++/* inverted bitmask for bitfield rdm_desc_init_i */ ++#define HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_MSKN 0x00000000 ++/* lower bit position of bitfield rdm_desc_init_i */ ++#define HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_SHIFT 0 ++/* width of bitfield rdm_desc_init_i */ ++#define HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_WIDTH 32 ++/* default value of bitfield rdm_desc_init_i */ ++#define HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_DEFAULT 0x0 ++ + /* rx int_desc_wrb_en bitfield definitions + * preprocessor definitions for the bitfield "int_desc_wrb_en". + * port="pif_rdm_int_desc_wrb_en_i" +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c +index ac13cb2b168e..68026a5ad7e7 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c +@@ -304,6 +304,10 @@ int hclge_cmd_queue_init(struct hclge_dev *hdev) + { + int ret; + ++ /* Setup the lock for command queue */ ++ spin_lock_init(&hdev->hw.cmq.csq.lock); ++ spin_lock_init(&hdev->hw.cmq.crq.lock); ++ + /* Setup the queue entries for use cmd queue */ + hdev->hw.cmq.csq.desc_num = HCLGE_NIC_CMQ_DESC_NUM; + hdev->hw.cmq.crq.desc_num = HCLGE_NIC_CMQ_DESC_NUM; +@@ -337,18 +341,20 @@ int hclge_cmd_init(struct hclge_dev *hdev) + u32 version; + int ret; + ++ spin_lock_bh(&hdev->hw.cmq.csq.lock); ++ spin_lock_bh(&hdev->hw.cmq.crq.lock); ++ + hdev->hw.cmq.csq.next_to_clean = 0; + hdev->hw.cmq.csq.next_to_use = 0; + hdev->hw.cmq.crq.next_to_clean = 0; + hdev->hw.cmq.crq.next_to_use = 0; + +- /* Setup the lock for command queue */ +- spin_lock_init(&hdev->hw.cmq.csq.lock); +- spin_lock_init(&hdev->hw.cmq.crq.lock); +- + hclge_cmd_init_regs(&hdev->hw); + clear_bit(HCLGE_STATE_CMD_DISABLE, &hdev->state); + ++ spin_unlock_bh(&hdev->hw.cmq.crq.lock); ++ spin_unlock_bh(&hdev->hw.cmq.csq.lock); ++ + ret = hclge_cmd_query_firmware_version(&hdev->hw, &version); + if (ret) { + dev_err(&hdev->pdev->dev, +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +index db763450e5e3..340baf6a470c 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +@@ -2804,14 +2804,17 @@ static void hclge_reset(struct hclge_dev *hdev) + handle = &hdev->vport[0].nic; + rtnl_lock(); + hclge_notify_client(hdev, HNAE3_DOWN_CLIENT); ++ rtnl_unlock(); + + if (!hclge_reset_wait(hdev)) { ++ rtnl_lock(); + hclge_notify_client(hdev, HNAE3_UNINIT_CLIENT); + hclge_reset_ae_dev(hdev->ae_dev); + hclge_notify_client(hdev, HNAE3_INIT_CLIENT); + + hclge_clear_reset_cause(hdev); + } else { ++ rtnl_lock(); + /* schedule again to check pending resets later */ + set_bit(hdev->reset_type, &hdev->reset_pending); + hclge_reset_task_schedule(hdev); +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c +index f34851c91eb3..e08e82020402 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c +@@ -458,6 +458,12 @@ void hclge_mbx_handler(struct hclge_dev *hdev) + + /* handle all the mailbox requests in the queue */ + while (!hclge_cmd_crq_empty(&hdev->hw)) { ++ if (test_bit(HCLGE_STATE_CMD_DISABLE, &hdev->state)) { ++ dev_warn(&hdev->pdev->dev, ++ "command queue needs re-initializing\n"); ++ return; ++ } ++ + desc = &crq->desc[crq->next_to_use]; + req = (struct hclge_mbx_vf_to_pf_cmd *)desc->data; + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c +index 5db70a1451c5..48235dc2dd56 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c +@@ -1167,14 +1167,14 @@ static int hclge_pfc_setup_hw(struct hclge_dev *hdev) + */ + static int hclge_bp_setup_hw(struct hclge_dev *hdev, u8 tc) + { +- struct hclge_vport *vport = hdev->vport; +- u32 i, k, qs_bitmap; +- int ret; ++ int i; + + for (i = 0; i < HCLGE_BP_GRP_NUM; i++) { +- qs_bitmap = 0; ++ u32 qs_bitmap = 0; ++ int k, ret; + + for (k = 0; k < hdev->num_alloc_vport; k++) { ++ struct hclge_vport *vport = &hdev->vport[k]; + u16 qs_id = vport->qs_offset + tc; + u8 grp, sub_grp; + +@@ -1184,8 +1184,6 @@ static int hclge_bp_setup_hw(struct hclge_dev *hdev, u8 tc) + HCLGE_BP_SUB_GRP_ID_S); + if (i == grp) + qs_bitmap |= (1 << sub_grp); +- +- vport++; + } + + ret = hclge_tm_qs_bp_cfg(hdev, tc, i, qs_bitmap); +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c +index 320043e87fc6..5570fb5dc2eb 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c +@@ -1065,6 +1065,8 @@ static int hclgevf_reset(struct hclgevf_dev *hdev) + /* bring down the nic to stop any ongoing TX/RX */ + hclgevf_notify_client(hdev, HNAE3_DOWN_CLIENT); + ++ rtnl_unlock(); ++ + /* check if VF could successfully fetch the hardware reset completion + * status from the hardware + */ +@@ -1076,12 +1078,15 @@ static int hclgevf_reset(struct hclgevf_dev *hdev) + ret); + + dev_warn(&hdev->pdev->dev, "VF reset failed, disabling VF!\n"); ++ rtnl_lock(); + hclgevf_notify_client(hdev, HNAE3_UNINIT_CLIENT); + + rtnl_unlock(); + return ret; + } + ++ rtnl_lock(); ++ + /* now, re-initialize the nic client and ae device*/ + ret = hclgevf_reset_stack(hdev); + if (ret) +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index ac685ad4d877..6eccfa82ca94 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -11926,6 +11926,8 @@ static int i40e_config_netdev(struct i40e_vsi *vsi) + NETIF_F_GSO_GRE | + NETIF_F_GSO_GRE_CSUM | + NETIF_F_GSO_PARTIAL | ++ NETIF_F_GSO_IPXIP4 | ++ NETIF_F_GSO_IPXIP6 | + NETIF_F_GSO_UDP_TUNNEL | + NETIF_F_GSO_UDP_TUNNEL_CSUM | + NETIF_F_SCTP_CRC | +diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool.c b/drivers/net/ethernet/intel/ice/ice_ethtool.c +index 9d6754f65a1a..4c5c87b158f5 100644 +--- a/drivers/net/ethernet/intel/ice/ice_ethtool.c ++++ b/drivers/net/ethernet/intel/ice/ice_ethtool.c +@@ -797,10 +797,15 @@ ice_set_pauseparam(struct net_device *netdev, struct ethtool_pauseparam *pause) + } + + if (!test_bit(__ICE_DOWN, pf->state)) { +- /* Give it a little more time to try to come back */ ++ /* Give it a little more time to try to come back. If still ++ * down, restart autoneg link or reinitialize the interface. ++ */ + msleep(75); + if (!test_bit(__ICE_DOWN, pf->state)) + return ice_nway_reset(netdev); ++ ++ ice_down(vsi); ++ ice_up(vsi); + } + + return err; +diff --git a/drivers/net/ethernet/intel/ice/ice_txrx.c b/drivers/net/ethernet/intel/ice/ice_txrx.c +index 6481e3d86374..0c95c8f83432 100644 +--- a/drivers/net/ethernet/intel/ice/ice_txrx.c ++++ b/drivers/net/ethernet/intel/ice/ice_txrx.c +@@ -1519,7 +1519,7 @@ int ice_tso(struct ice_tx_buf *first, struct ice_tx_offload_params *off) + + /* update gso_segs and bytecount */ + first->gso_segs = skb_shinfo(skb)->gso_segs; +- first->bytecount = (first->gso_segs - 1) * off->header_len; ++ first->bytecount += (first->gso_segs - 1) * off->header_len; + + cd_tso_len = skb->len - off->header_len; + cd_mss = skb_shinfo(skb)->gso_size; +diff --git a/drivers/net/ethernet/intel/ice/ice_type.h b/drivers/net/ethernet/intel/ice/ice_type.h +index 97c366e0ca59..ba11b5898833 100644 +--- a/drivers/net/ethernet/intel/ice/ice_type.h ++++ b/drivers/net/ethernet/intel/ice/ice_type.h +@@ -83,12 +83,12 @@ struct ice_link_status { + u64 phy_type_low; + u16 max_frame_size; + u16 link_speed; ++ u16 req_speeds; + u8 lse_ena; /* Link Status Event notification */ + u8 link_info; + u8 an_info; + u8 ext_info; + u8 pacing; +- u8 req_speeds; + /* Refer to #define from module_type[ICE_MODULE_TYPE_TOTAL_BYTE] of + * ice_aqc_get_phy_caps structure + */ +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c +index 3c6f01c41b78..eea63a99f29c 100644 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c +@@ -721,8 +721,10 @@ static inline void ixgbe_vf_reset_event(struct ixgbe_adapter *adapter, u32 vf) + ixgbe_set_vmvir(adapter, vfinfo->pf_vlan, + adapter->default_up, vf); + +- if (vfinfo->spoofchk_enabled) ++ if (vfinfo->spoofchk_enabled) { + hw->mac.ops.set_vlan_anti_spoofing(hw, true, vf); ++ hw->mac.ops.set_mac_anti_spoofing(hw, true, vf); ++ } + } + + /* reset multicast table array for vf */ +diff --git a/drivers/net/ethernet/qlogic/qed/qed_fcoe.c b/drivers/net/ethernet/qlogic/qed/qed_fcoe.c +index cc1b373c0ace..46dc93d3b9b5 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_fcoe.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_fcoe.c +@@ -147,7 +147,8 @@ qed_sp_fcoe_func_start(struct qed_hwfn *p_hwfn, + "Cannot satisfy CQ amount. CQs requested %d, CQs available %d. Aborting function start\n", + fcoe_pf_params->num_cqs, + p_hwfn->hw_info.feat_num[QED_FCOE_CQ]); +- return -EINVAL; ++ rc = -EINVAL; ++ goto err; + } + + p_data->mtu = cpu_to_le16(fcoe_pf_params->mtu); +@@ -156,14 +157,14 @@ qed_sp_fcoe_func_start(struct qed_hwfn *p_hwfn, + + rc = qed_cxt_acquire_cid(p_hwfn, PROTOCOLID_FCOE, &dummy_cid); + if (rc) +- return rc; ++ goto err; + + cxt_info.iid = dummy_cid; + rc = qed_cxt_get_cid_info(p_hwfn, &cxt_info); + if (rc) { + DP_NOTICE(p_hwfn, "Cannot find context info for dummy cid=%d\n", + dummy_cid); +- return rc; ++ goto err; + } + p_cxt = cxt_info.p_cxt; + SET_FIELD(p_cxt->tstorm_ag_context.flags3, +@@ -240,6 +241,10 @@ qed_sp_fcoe_func_start(struct qed_hwfn *p_hwfn, + rc = qed_spq_post(p_hwfn, p_ent, NULL); + + return rc; ++ ++err: ++ qed_sp_destroy_request(p_hwfn, p_ent); ++ return rc; + } + + static int +diff --git a/drivers/net/ethernet/qlogic/qed/qed_iscsi.c b/drivers/net/ethernet/qlogic/qed/qed_iscsi.c +index 1135387bd99d..4f8a685d1a55 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_iscsi.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_iscsi.c +@@ -200,6 +200,7 @@ qed_sp_iscsi_func_start(struct qed_hwfn *p_hwfn, + "Cannot satisfy CQ amount. Queues requested %d, CQs available %d. Aborting function start\n", + p_params->num_queues, + p_hwfn->hw_info.feat_num[QED_ISCSI_CQ]); ++ qed_sp_destroy_request(p_hwfn, p_ent); + return -EINVAL; + } + +diff --git a/drivers/net/ethernet/qlogic/qed/qed_l2.c b/drivers/net/ethernet/qlogic/qed/qed_l2.c +index 82a1bd1f8a8c..67c02ea93906 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_l2.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_l2.c +@@ -740,8 +740,7 @@ int qed_sp_vport_update(struct qed_hwfn *p_hwfn, + + rc = qed_sp_vport_update_rss(p_hwfn, p_ramrod, p_rss_params); + if (rc) { +- /* Return spq entry which is taken in qed_sp_init_request()*/ +- qed_spq_return_entry(p_hwfn, p_ent); ++ qed_sp_destroy_request(p_hwfn, p_ent); + return rc; + } + +@@ -1355,6 +1354,7 @@ qed_filter_ucast_common(struct qed_hwfn *p_hwfn, + DP_NOTICE(p_hwfn, + "%d is not supported yet\n", + p_filter_cmd->opcode); ++ qed_sp_destroy_request(p_hwfn, *pp_ent); + return -EINVAL; + } + +@@ -2056,13 +2056,13 @@ qed_configure_rfs_ntuple_filter(struct qed_hwfn *p_hwfn, + } else { + rc = qed_fw_vport(p_hwfn, p_params->vport_id, &abs_vport_id); + if (rc) +- return rc; ++ goto err; + + if (p_params->qid != QED_RFS_NTUPLE_QID_RSS) { + rc = qed_fw_l2_queue(p_hwfn, p_params->qid, + &abs_rx_q_id); + if (rc) +- return rc; ++ goto err; + + p_ramrod->rx_qid_valid = 1; + p_ramrod->rx_qid = cpu_to_le16(abs_rx_q_id); +@@ -2083,6 +2083,10 @@ qed_configure_rfs_ntuple_filter(struct qed_hwfn *p_hwfn, + (u64)p_params->addr, p_params->length); + + return qed_spq_post(p_hwfn, p_ent, NULL); ++ ++err: ++ qed_sp_destroy_request(p_hwfn, p_ent); ++ return rc; + } + + int qed_get_rxq_coalesce(struct qed_hwfn *p_hwfn, +diff --git a/drivers/net/ethernet/qlogic/qed/qed_rdma.c b/drivers/net/ethernet/qlogic/qed/qed_rdma.c +index c71391b9c757..62113438c880 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_rdma.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_rdma.c +@@ -1514,6 +1514,7 @@ qed_rdma_register_tid(void *rdma_cxt, + default: + rc = -EINVAL; + DP_VERBOSE(p_hwfn, QED_MSG_RDMA, "rc = %d\n", rc); ++ qed_sp_destroy_request(p_hwfn, p_ent); + return rc; + } + SET_FIELD(p_ramrod->flags1, +diff --git a/drivers/net/ethernet/qlogic/qed/qed_roce.c b/drivers/net/ethernet/qlogic/qed/qed_roce.c +index f9167d1354bb..e49fada85410 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_roce.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_roce.c +@@ -745,6 +745,7 @@ static int qed_roce_sp_destroy_qp_responder(struct qed_hwfn *p_hwfn, + DP_NOTICE(p_hwfn, + "qed destroy responder failed: cannot allocate memory (ramrod). rc = %d\n", + rc); ++ qed_sp_destroy_request(p_hwfn, p_ent); + return rc; + } + +diff --git a/drivers/net/ethernet/qlogic/qed/qed_sp.h b/drivers/net/ethernet/qlogic/qed/qed_sp.h +index e95431f6acd4..3157c0d99441 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_sp.h ++++ b/drivers/net/ethernet/qlogic/qed/qed_sp.h +@@ -167,6 +167,9 @@ struct qed_spq_entry { + enum spq_mode comp_mode; + struct qed_spq_comp_cb comp_cb; + struct qed_spq_comp_done comp_done; /* SPQ_MODE_EBLOCK */ ++ ++ /* Posted entry for unlimited list entry in EBLOCK mode */ ++ struct qed_spq_entry *post_ent; + }; + + struct qed_eq { +@@ -396,6 +399,17 @@ struct qed_sp_init_data { + struct qed_spq_comp_cb *p_comp_data; + }; + ++/** ++ * @brief Returns a SPQ entry to the pool / frees the entry if allocated. ++ * Should be called on in error flows after initializing the SPQ entry ++ * and before posting it. ++ * ++ * @param p_hwfn ++ * @param p_ent ++ */ ++void qed_sp_destroy_request(struct qed_hwfn *p_hwfn, ++ struct qed_spq_entry *p_ent); ++ + int qed_sp_init_request(struct qed_hwfn *p_hwfn, + struct qed_spq_entry **pp_ent, + u8 cmd, +diff --git a/drivers/net/ethernet/qlogic/qed/qed_sp_commands.c b/drivers/net/ethernet/qlogic/qed/qed_sp_commands.c +index 77b6248ad3b9..888274fa208b 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_sp_commands.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_sp_commands.c +@@ -47,6 +47,19 @@ + #include "qed_sp.h" + #include "qed_sriov.h" + ++void qed_sp_destroy_request(struct qed_hwfn *p_hwfn, ++ struct qed_spq_entry *p_ent) ++{ ++ /* qed_spq_get_entry() can either get an entry from the free_pool, ++ * or, if no entries are left, allocate a new entry and add it to ++ * the unlimited_pending list. ++ */ ++ if (p_ent->queue == &p_hwfn->p_spq->unlimited_pending) ++ kfree(p_ent); ++ else ++ qed_spq_return_entry(p_hwfn, p_ent); ++} ++ + int qed_sp_init_request(struct qed_hwfn *p_hwfn, + struct qed_spq_entry **pp_ent, + u8 cmd, u8 protocol, struct qed_sp_init_data *p_data) +@@ -80,7 +93,7 @@ int qed_sp_init_request(struct qed_hwfn *p_hwfn, + + case QED_SPQ_MODE_BLOCK: + if (!p_data->p_comp_data) +- return -EINVAL; ++ goto err; + + p_ent->comp_cb.cookie = p_data->p_comp_data->cookie; + break; +@@ -95,7 +108,7 @@ int qed_sp_init_request(struct qed_hwfn *p_hwfn, + default: + DP_NOTICE(p_hwfn, "Unknown SPQE completion mode %d\n", + p_ent->comp_mode); +- return -EINVAL; ++ goto err; + } + + DP_VERBOSE(p_hwfn, QED_MSG_SPQ, +@@ -109,6 +122,11 @@ int qed_sp_init_request(struct qed_hwfn *p_hwfn, + memset(&p_ent->ramrod, 0, sizeof(p_ent->ramrod)); + + return 0; ++ ++err: ++ qed_sp_destroy_request(p_hwfn, p_ent); ++ ++ return -EINVAL; + } + + static enum tunnel_clss qed_tunn_clss_to_fw_clss(u8 type) +diff --git a/drivers/net/ethernet/qlogic/qed/qed_spq.c b/drivers/net/ethernet/qlogic/qed/qed_spq.c +index 1673fc90027f..7106ad17afe2 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_spq.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_spq.c +@@ -142,6 +142,7 @@ static int qed_spq_block(struct qed_hwfn *p_hwfn, + + DP_INFO(p_hwfn, "Ramrod is stuck, requesting MCP drain\n"); + rc = qed_mcp_drain(p_hwfn, p_ptt); ++ qed_ptt_release(p_hwfn, p_ptt); + if (rc) { + DP_NOTICE(p_hwfn, "MCP drain failed\n"); + goto err; +@@ -150,18 +151,15 @@ static int qed_spq_block(struct qed_hwfn *p_hwfn, + /* Retry after drain */ + rc = __qed_spq_block(p_hwfn, p_ent, p_fw_ret, true); + if (!rc) +- goto out; ++ return 0; + + comp_done = (struct qed_spq_comp_done *)p_ent->comp_cb.cookie; +- if (comp_done->done == 1) ++ if (comp_done->done == 1) { + if (p_fw_ret) + *p_fw_ret = comp_done->fw_return_code; +-out: +- qed_ptt_release(p_hwfn, p_ptt); +- return 0; +- ++ return 0; ++ } + err: +- qed_ptt_release(p_hwfn, p_ptt); + DP_NOTICE(p_hwfn, + "Ramrod is stuck [CID %08x cmd %02x protocol %02x echo %04x]\n", + le32_to_cpu(p_ent->elem.hdr.cid), +@@ -685,6 +683,8 @@ static int qed_spq_add_entry(struct qed_hwfn *p_hwfn, + /* EBLOCK responsible to free the allocated p_ent */ + if (p_ent->comp_mode != QED_SPQ_MODE_EBLOCK) + kfree(p_ent); ++ else ++ p_ent->post_ent = p_en2; + + p_ent = p_en2; + } +@@ -768,6 +768,25 @@ static int qed_spq_pend_post(struct qed_hwfn *p_hwfn) + SPQ_HIGH_PRI_RESERVE_DEFAULT); + } + ++/* Avoid overriding of SPQ entries when getting out-of-order completions, by ++ * marking the completions in a bitmap and increasing the chain consumer only ++ * for the first successive completed entries. ++ */ ++static void qed_spq_comp_bmap_update(struct qed_hwfn *p_hwfn, __le16 echo) ++{ ++ u16 pos = le16_to_cpu(echo) % SPQ_RING_SIZE; ++ struct qed_spq *p_spq = p_hwfn->p_spq; ++ ++ __set_bit(pos, p_spq->p_comp_bitmap); ++ while (test_bit(p_spq->comp_bitmap_idx, ++ p_spq->p_comp_bitmap)) { ++ __clear_bit(p_spq->comp_bitmap_idx, ++ p_spq->p_comp_bitmap); ++ p_spq->comp_bitmap_idx++; ++ qed_chain_return_produced(&p_spq->chain); ++ } ++} ++ + int qed_spq_post(struct qed_hwfn *p_hwfn, + struct qed_spq_entry *p_ent, u8 *fw_return_code) + { +@@ -825,11 +844,12 @@ int qed_spq_post(struct qed_hwfn *p_hwfn, + p_ent->queue == &p_spq->unlimited_pending); + + if (p_ent->queue == &p_spq->unlimited_pending) { +- /* This is an allocated p_ent which does not need to +- * return to pool. +- */ ++ struct qed_spq_entry *p_post_ent = p_ent->post_ent; ++ + kfree(p_ent); +- return rc; ++ ++ /* Return the entry which was actually posted */ ++ p_ent = p_post_ent; + } + + if (rc) +@@ -843,7 +863,7 @@ int qed_spq_post(struct qed_hwfn *p_hwfn, + spq_post_fail2: + spin_lock_bh(&p_spq->lock); + list_del(&p_ent->list); +- qed_chain_return_produced(&p_spq->chain); ++ qed_spq_comp_bmap_update(p_hwfn, p_ent->elem.hdr.echo); + + spq_post_fail: + /* return to the free pool */ +@@ -875,25 +895,8 @@ int qed_spq_completion(struct qed_hwfn *p_hwfn, + spin_lock_bh(&p_spq->lock); + list_for_each_entry_safe(p_ent, tmp, &p_spq->completion_pending, list) { + if (p_ent->elem.hdr.echo == echo) { +- u16 pos = le16_to_cpu(echo) % SPQ_RING_SIZE; +- + list_del(&p_ent->list); +- +- /* Avoid overriding of SPQ entries when getting +- * out-of-order completions, by marking the completions +- * in a bitmap and increasing the chain consumer only +- * for the first successive completed entries. +- */ +- __set_bit(pos, p_spq->p_comp_bitmap); +- +- while (test_bit(p_spq->comp_bitmap_idx, +- p_spq->p_comp_bitmap)) { +- __clear_bit(p_spq->comp_bitmap_idx, +- p_spq->p_comp_bitmap); +- p_spq->comp_bitmap_idx++; +- qed_chain_return_produced(&p_spq->chain); +- } +- ++ qed_spq_comp_bmap_update(p_hwfn, echo); + p_spq->comp_count++; + found = p_ent; + break; +@@ -932,11 +935,9 @@ int qed_spq_completion(struct qed_hwfn *p_hwfn, + QED_MSG_SPQ, + "Got a completion without a callback function\n"); + +- if ((found->comp_mode != QED_SPQ_MODE_EBLOCK) || +- (found->queue == &p_spq->unlimited_pending)) ++ if (found->comp_mode != QED_SPQ_MODE_EBLOCK) + /* EBLOCK is responsible for returning its own entry into the +- * free list, unless it originally added the entry into the +- * unlimited pending list. ++ * free list. + */ + qed_spq_return_entry(p_hwfn, found); + +diff --git a/drivers/net/ethernet/qlogic/qed/qed_sriov.c b/drivers/net/ethernet/qlogic/qed/qed_sriov.c +index 9b08a9d9e151..ca6290fa0f30 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_sriov.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_sriov.c +@@ -101,6 +101,7 @@ static int qed_sp_vf_start(struct qed_hwfn *p_hwfn, struct qed_vf_info *p_vf) + default: + DP_NOTICE(p_hwfn, "Unknown VF personality %d\n", + p_hwfn->hw_info.personality); ++ qed_sp_destroy_request(p_hwfn, p_ent); + return -EINVAL; + } + +diff --git a/drivers/net/ethernet/stmicro/stmmac/common.h b/drivers/net/ethernet/stmicro/stmmac/common.h +index b1b305f8f414..272b9ca66314 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/common.h ++++ b/drivers/net/ethernet/stmicro/stmmac/common.h +@@ -365,7 +365,8 @@ struct dma_features { + + /* GMAC TX FIFO is 8K, Rx FIFO is 16K */ + #define BUF_SIZE_16KiB 16384 +-#define BUF_SIZE_8KiB 8192 ++/* RX Buffer size must be < 8191 and multiple of 4/8/16 bytes */ ++#define BUF_SIZE_8KiB 8188 + #define BUF_SIZE_4KiB 4096 + #define BUF_SIZE_2KiB 2048 + +diff --git a/drivers/net/ethernet/stmicro/stmmac/descs_com.h b/drivers/net/ethernet/stmicro/stmmac/descs_com.h +index ca9d7e48034c..40d6356a7e73 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/descs_com.h ++++ b/drivers/net/ethernet/stmicro/stmmac/descs_com.h +@@ -31,7 +31,7 @@ + /* Enhanced descriptors */ + static inline void ehn_desc_rx_set_on_ring(struct dma_desc *p, int end) + { +- p->des1 |= cpu_to_le32(((BUF_SIZE_8KiB - 1) ++ p->des1 |= cpu_to_le32((BUF_SIZE_8KiB + << ERDES1_BUFFER2_SIZE_SHIFT) + & ERDES1_BUFFER2_SIZE_MASK); + +diff --git a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c +index 77914c89d749..5ef91a790f9d 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c ++++ b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c +@@ -262,7 +262,7 @@ static void enh_desc_init_rx_desc(struct dma_desc *p, int disable_rx_ic, + int mode, int end) + { + p->des0 |= cpu_to_le32(RDES0_OWN); +- p->des1 |= cpu_to_le32((BUF_SIZE_8KiB - 1) & ERDES1_BUFFER1_SIZE_MASK); ++ p->des1 |= cpu_to_le32(BUF_SIZE_8KiB & ERDES1_BUFFER1_SIZE_MASK); + + if (mode == STMMAC_CHAIN_MODE) + ehn_desc_rx_set_on_chain(p); +diff --git a/drivers/net/ethernet/stmicro/stmmac/ring_mode.c b/drivers/net/ethernet/stmicro/stmmac/ring_mode.c +index a7ffc73fffe8..bc83ced94e1b 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/ring_mode.c ++++ b/drivers/net/ethernet/stmicro/stmmac/ring_mode.c +@@ -140,7 +140,7 @@ static void clean_desc3(void *priv_ptr, struct dma_desc *p) + static int set_16kib_bfsize(int mtu) + { + int ret = 0; +- if (unlikely(mtu >= BUF_SIZE_8KiB)) ++ if (unlikely(mtu > BUF_SIZE_8KiB)) + ret = BUF_SIZE_16KiB; + return ret; + } +diff --git a/drivers/net/wireless/mediatek/mt76/mt76x0/phy.c b/drivers/net/wireless/mediatek/mt76/mt76x0/phy.c +index 5da7bfbe907f..14e8c575f6c3 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt76x0/phy.c ++++ b/drivers/net/wireless/mediatek/mt76/mt76x0/phy.c +@@ -757,10 +757,10 @@ __mt76x0_phy_set_channel(struct mt76x0_dev *dev, + /* Vendor driver don't do it */ + /* mt76x0_phy_set_tx_power(dev, channel, rf_bw_band); */ + ++ mt76x0_vco_cal(dev, channel); + if (scan) +- mt76x0_vco_cal(dev, channel); ++ mt76x0_mcu_calibrate(dev, MCU_CAL_RXDCOC, 1); + +- mt76x0_mcu_calibrate(dev, MCU_CAL_RXDCOC, 1); + mt76x0_phy_set_chan_pwr(dev, channel); + + dev->mt76.chandef = *chandef; +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index 6bb9908bf46f..0ba301f7e8b4 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -1519,8 +1519,10 @@ static void __nvme_revalidate_disk(struct gendisk *disk, struct nvme_id_ns *id) + if (ns->ndev) + nvme_nvm_update_nvm_info(ns); + #ifdef CONFIG_NVME_MULTIPATH +- if (ns->head->disk) ++ if (ns->head->disk) { + nvme_update_disk_info(ns->head->disk, ns, id); ++ blk_queue_stack_limits(ns->head->disk->queue, ns->queue); ++ } + #endif + } + +diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c +index b71c9ad1bf45..c27af277e14e 100644 +--- a/drivers/nvme/host/multipath.c ++++ b/drivers/nvme/host/multipath.c +@@ -257,6 +257,7 @@ int nvme_mpath_alloc_disk(struct nvme_ctrl *ctrl, struct nvme_ns_head *head) + blk_queue_flag_set(QUEUE_FLAG_NONROT, q); + /* set to a default value for 512 until disk is validated */ + blk_queue_logical_block_size(q, 512); ++ blk_set_stacking_limits(&q->limits); + + /* we need to propagate up the VMC settings */ + if (ctrl->vwc & NVME_CTRL_VWC_PRESENT) +diff --git a/drivers/of/device.c b/drivers/of/device.c +index 5957cd4fa262..40b9051a7fce 100644 +--- a/drivers/of/device.c ++++ b/drivers/of/device.c +@@ -149,9 +149,11 @@ int of_dma_configure(struct device *dev, struct device_node *np, bool force_dma) + * set by the driver. + */ + mask = DMA_BIT_MASK(ilog2(dma_addr + size - 1) + 1); +- dev->bus_dma_mask = mask; + dev->coherent_dma_mask &= mask; + *dev->dma_mask &= mask; ++ /* ...but only set bus mask if we found valid dma-ranges earlier */ ++ if (!ret) ++ dev->bus_dma_mask = mask; + + coherent = of_dma_is_coherent(np); + dev_dbg(dev, "device is%sdma coherent\n", +diff --git a/drivers/platform/x86/acerhdf.c b/drivers/platform/x86/acerhdf.c +index ea22591ee66f..53dfe67807e3 100644 +--- a/drivers/platform/x86/acerhdf.c ++++ b/drivers/platform/x86/acerhdf.c +@@ -233,6 +233,7 @@ static const struct bios_settings bios_tbl[] = { + {"Gateway", "LT31", "v1.3201", 0x55, 0x58, {0x9e, 0x00}, 0}, + {"Gateway", "LT31", "v1.3302", 0x55, 0x58, {0x9e, 0x00}, 0}, + {"Gateway", "LT31", "v1.3303t", 0x55, 0x58, {0x9e, 0x00}, 0}, ++ {"Gateway", "LT31", "v1.3307", 0x55, 0x58, {0x9e, 0x00}, 0}, + /* Packard Bell */ + {"Packard Bell", "DOA150", "v0.3104", 0x55, 0x58, {0x21, 0x00}, 0}, + {"Packard Bell", "DOA150", "v0.3105", 0x55, 0x58, {0x20, 0x00}, 0}, +diff --git a/drivers/platform/x86/intel_telemetry_debugfs.c b/drivers/platform/x86/intel_telemetry_debugfs.c +index ffd0474b0531..1423fa8710fd 100644 +--- a/drivers/platform/x86/intel_telemetry_debugfs.c ++++ b/drivers/platform/x86/intel_telemetry_debugfs.c +@@ -951,12 +951,16 @@ static int __init telemetry_debugfs_init(void) + debugfs_conf = (struct telemetry_debugfs_conf *)id->driver_data; + + err = telemetry_pltconfig_valid(); +- if (err < 0) ++ if (err < 0) { ++ pr_info("Invalid pltconfig, ensure IPC1 device is enabled in BIOS\n"); + return -ENODEV; ++ } + + err = telemetry_debugfs_check_evts(); +- if (err < 0) ++ if (err < 0) { ++ pr_info("telemetry_debugfs_check_evts failed\n"); + return -EINVAL; ++ } + + register_pm_notifier(&pm_notifier); + +diff --git a/drivers/s390/net/qeth_core.h b/drivers/s390/net/qeth_core.h +index 34e0d476c5c6..970654fcc48d 100644 +--- a/drivers/s390/net/qeth_core.h ++++ b/drivers/s390/net/qeth_core.h +@@ -826,6 +826,11 @@ struct qeth_trap_id { + /*some helper functions*/ + #define QETH_CARD_IFNAME(card) (((card)->dev)? (card)->dev->name : "") + ++static inline bool qeth_netdev_is_registered(struct net_device *dev) ++{ ++ return dev->netdev_ops != NULL; ++} ++ + static inline void qeth_scrub_qdio_buffer(struct qdio_buffer *buf, + unsigned int elements) + { +diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c +index b5e38531733f..76b2fba5fba2 100644 +--- a/drivers/s390/net/qeth_l2_main.c ++++ b/drivers/s390/net/qeth_l2_main.c +@@ -854,7 +854,8 @@ static void qeth_l2_remove_device(struct ccwgroup_device *cgdev) + + if (cgdev->state == CCWGROUP_ONLINE) + qeth_l2_set_offline(cgdev); +- unregister_netdev(card->dev); ++ if (qeth_netdev_is_registered(card->dev)) ++ unregister_netdev(card->dev); + } + + static const struct ethtool_ops qeth_l2_ethtool_ops = { +@@ -894,7 +895,7 @@ static int qeth_l2_setup_netdev(struct qeth_card *card) + { + int rc; + +- if (card->dev->netdev_ops) ++ if (qeth_netdev_is_registered(card->dev)) + return 0; + + card->dev->priv_flags |= IFF_UNICAST_FLT; +diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c +index ada258c01a08..b7f6a8384543 100644 +--- a/drivers/s390/net/qeth_l3_main.c ++++ b/drivers/s390/net/qeth_l3_main.c +@@ -279,9 +279,6 @@ static void qeth_l3_clear_ip_htable(struct qeth_card *card, int recover) + + QETH_CARD_TEXT(card, 4, "clearip"); + +- if (recover && card->options.sniffer) +- return; +- + spin_lock_bh(&card->ip_lock); + + hash_for_each_safe(card->ip_htable, i, tmp, addr, hnode) { +@@ -664,6 +661,8 @@ static int qeth_l3_register_addr_entry(struct qeth_card *card, + int rc = 0; + int cnt = 3; + ++ if (card->options.sniffer) ++ return 0; + + if (addr->proto == QETH_PROT_IPV4) { + QETH_CARD_TEXT(card, 2, "setaddr4"); +@@ -698,6 +697,9 @@ static int qeth_l3_deregister_addr_entry(struct qeth_card *card, + { + int rc = 0; + ++ if (card->options.sniffer) ++ return 0; ++ + if (addr->proto == QETH_PROT_IPV4) { + QETH_CARD_TEXT(card, 2, "deladdr4"); + QETH_CARD_HEX(card, 3, &addr->u.a4.addr, sizeof(int)); +@@ -2512,7 +2514,7 @@ static int qeth_l3_setup_netdev(struct qeth_card *card) + { + int rc; + +- if (card->dev->netdev_ops) ++ if (qeth_netdev_is_registered(card->dev)) + return 0; + + if (card->info.type == QETH_CARD_TYPE_OSD || +@@ -2609,7 +2611,8 @@ static void qeth_l3_remove_device(struct ccwgroup_device *cgdev) + if (cgdev->state == CCWGROUP_ONLINE) + qeth_l3_set_offline(cgdev); + +- unregister_netdev(card->dev); ++ if (qeth_netdev_is_registered(card->dev)) ++ unregister_netdev(card->dev); + qeth_l3_clear_ip_htable(card, 0); + qeth_l3_clear_ipato_list(card); + } +diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c +index 3649b83ef863..effba6ce0caa 100644 +--- a/drivers/tty/serial/sh-sci.c ++++ b/drivers/tty/serial/sh-sci.c +@@ -1614,10 +1614,10 @@ static void sci_request_dma(struct uart_port *port) + hrtimer_init(&s->rx_timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL); + s->rx_timer.function = rx_timer_fn; + ++ s->chan_rx_saved = s->chan_rx = chan; ++ + if (port->type == PORT_SCIFA || port->type == PORT_SCIFB) + sci_submit_rx(s); +- +- s->chan_rx_saved = s->chan_rx = chan; + } + } + +diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c +index 9916edda5271..2762148c169d 100644 +--- a/drivers/uio/uio.c ++++ b/drivers/uio/uio.c +@@ -959,6 +959,8 @@ int __uio_register_device(struct module *owner, + if (ret) + goto err_uio_dev_add_attributes; + ++ info->uio_dev = idev; ++ + if (info->irq && (info->irq != UIO_IRQ_CUSTOM)) { + /* + * Note that we deliberately don't use devm_request_irq +@@ -970,11 +972,12 @@ int __uio_register_device(struct module *owner, + */ + ret = request_irq(info->irq, uio_interrupt, + info->irq_flags, info->name, idev); +- if (ret) ++ if (ret) { ++ info->uio_dev = NULL; + goto err_request_irq; ++ } + } + +- info->uio_dev = idev; + return 0; + + err_request_irq: +diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c +index 9ede35cecb12..40c64c7ab5e4 100644 +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -1711,6 +1711,9 @@ static const struct usb_device_id acm_ids[] = { + { USB_DEVICE(0x0572, 0x1328), /* Shiro / Aztech USB MODEM UM-3100 */ + .driver_info = NO_UNION_NORMAL, /* has no union descriptor */ + }, ++ { USB_DEVICE(0x0572, 0x1349), /* Hiro (Conexant) USB MODEM H50228 */ ++ .driver_info = NO_UNION_NORMAL, /* has no union descriptor */ ++ }, + { USB_DEVICE(0x20df, 0x0001), /* Simtec Electronics Entropy Key */ + .driver_info = QUIRK_CONTROL_LINE_STATE, }, + { USB_DEVICE(0x2184, 0x001c) }, /* GW Instek AFG-2225 */ +diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c +index 462ce49f683a..6e0823790bee 100644 +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -2791,6 +2791,7 @@ static int hub_port_reset(struct usb_hub *hub, int port1, + int i, status; + u16 portchange, portstatus; + struct usb_port *port_dev = hub->ports[port1 - 1]; ++ int reset_recovery_time; + + if (!hub_is_superspeed(hub->hdev)) { + if (warm) { +@@ -2882,11 +2883,18 @@ static int hub_port_reset(struct usb_hub *hub, int port1, + + done: + if (status == 0) { +- /* TRSTRCY = 10 ms; plus some extra */ + if (port_dev->quirks & USB_PORT_QUIRK_FAST_ENUM) + usleep_range(10000, 12000); +- else +- msleep(10 + 40); ++ else { ++ /* TRSTRCY = 10 ms; plus some extra */ ++ reset_recovery_time = 10 + 40; ++ ++ /* Hub needs extra delay after resetting its port. */ ++ if (hub->hdev->quirks & USB_QUIRK_HUB_SLOW_RESET) ++ reset_recovery_time += 100; ++ ++ msleep(reset_recovery_time); ++ } + + if (udev) { + struct usb_hcd *hcd = bus_to_hcd(udev->bus); +diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c +index 178d6c6063c0..f9ff03e6af93 100644 +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -128,6 +128,9 @@ static int quirks_param_set(const char *val, const struct kernel_param *kp) + case 'n': + flags |= USB_QUIRK_DELAY_CTRL_MSG; + break; ++ case 'o': ++ flags |= USB_QUIRK_HUB_SLOW_RESET; ++ break; + /* Ignore unrecognized flag characters */ + } + } +@@ -380,6 +383,9 @@ static const struct usb_device_id usb_quirk_list[] = { + { USB_DEVICE(0x1a0a, 0x0200), .driver_info = + USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL }, + ++ /* Terminus Technology Inc. Hub */ ++ { USB_DEVICE(0x1a40, 0x0101), .driver_info = USB_QUIRK_HUB_SLOW_RESET }, ++ + /* Corsair K70 RGB */ + { USB_DEVICE(0x1b1c, 0x1b13), .driver_info = USB_QUIRK_DELAY_INIT }, + +@@ -391,6 +397,9 @@ static const struct usb_device_id usb_quirk_list[] = { + { USB_DEVICE(0x1b1c, 0x1b20), .driver_info = USB_QUIRK_DELAY_INIT | + USB_QUIRK_DELAY_CTRL_MSG }, + ++ /* Corsair K70 LUX RGB */ ++ { USB_DEVICE(0x1b1c, 0x1b33), .driver_info = USB_QUIRK_DELAY_INIT }, ++ + /* Corsair K70 LUX */ + { USB_DEVICE(0x1b1c, 0x1b36), .driver_info = USB_QUIRK_DELAY_INIT }, + +@@ -411,6 +420,11 @@ static const struct usb_device_id usb_quirk_list[] = { + { USB_DEVICE(0x2040, 0x7200), .driver_info = + USB_QUIRK_CONFIG_INTF_STRINGS }, + ++ /* Raydium Touchscreen */ ++ { USB_DEVICE(0x2386, 0x3114), .driver_info = USB_QUIRK_NO_LPM }, ++ ++ { USB_DEVICE(0x2386, 0x3119), .driver_info = USB_QUIRK_NO_LPM }, ++ + /* DJI CineSSD */ + { USB_DEVICE(0x2ca3, 0x0031), .driver_info = USB_QUIRK_NO_LPM }, + +diff --git a/drivers/usb/misc/appledisplay.c b/drivers/usb/misc/appledisplay.c +index d746c26a8055..6a0c60badfa0 100644 +--- a/drivers/usb/misc/appledisplay.c ++++ b/drivers/usb/misc/appledisplay.c +@@ -50,6 +50,7 @@ static const struct usb_device_id appledisplay_table[] = { + { APPLEDISPLAY_DEVICE(0x9219) }, + { APPLEDISPLAY_DEVICE(0x921c) }, + { APPLEDISPLAY_DEVICE(0x921d) }, ++ { APPLEDISPLAY_DEVICE(0x9222) }, + { APPLEDISPLAY_DEVICE(0x9236) }, + + /* Terminating entry */ +diff --git a/drivers/xen/grant-table.c b/drivers/xen/grant-table.c +index 84575baceebc..97341fa75458 100644 +--- a/drivers/xen/grant-table.c ++++ b/drivers/xen/grant-table.c +@@ -914,7 +914,7 @@ int gnttab_dma_free_pages(struct gnttab_dma_alloc_args *args) + + ret = xenmem_reservation_increase(args->nr_pages, args->frames); + if (ret != args->nr_pages) { +- pr_debug("Failed to decrease reservation for DMA buffer\n"); ++ pr_debug("Failed to increase reservation for DMA buffer\n"); + ret = -EFAULT; + } else { + ret = 0; +diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c +index 77a83790a31f..2543f24d23f8 100644 +--- a/fs/afs/rxrpc.c ++++ b/fs/afs/rxrpc.c +@@ -500,7 +500,6 @@ static void afs_deliver_to_call(struct afs_call *call) + case -EINPROGRESS: + case -EAGAIN: + goto out; +- case -EIO: + case -ECONNABORTED: + ASSERTCMP(state, ==, AFS_CALL_COMPLETE); + goto done; +@@ -509,6 +508,10 @@ static void afs_deliver_to_call(struct afs_call *call) + rxrpc_kernel_abort_call(call->net->socket, call->rxcall, + abort_code, ret, "KIV"); + goto local_abort; ++ case -EIO: ++ pr_err("kAFS: Call %u in bad state %u\n", ++ call->debug_id, state); ++ /* Fall through */ + case -ENODATA: + case -EBADMSG: + case -EMSGSIZE: +diff --git a/fs/ceph/quota.c b/fs/ceph/quota.c +index 32d4f13784ba..03f4d24db8fe 100644 +--- a/fs/ceph/quota.c ++++ b/fs/ceph/quota.c +@@ -237,7 +237,8 @@ static bool check_quota_exceeded(struct inode *inode, enum quota_check_op op, + ceph_put_snap_realm(mdsc, realm); + realm = next; + } +- ceph_put_snap_realm(mdsc, realm); ++ if (realm) ++ ceph_put_snap_realm(mdsc, realm); + up_read(&mdsc->snap_rwsem); + + return exceeded; +diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c +index 7065426b3280..fb32f3d6925e 100644 +--- a/fs/cifs/cifsfs.c ++++ b/fs/cifs/cifsfs.c +@@ -981,8 +981,8 @@ static int cifs_clone_file_range(struct file *src_file, loff_t off, + struct inode *src_inode = file_inode(src_file); + struct inode *target_inode = file_inode(dst_file); + struct cifsFileInfo *smb_file_src = src_file->private_data; +- struct cifsFileInfo *smb_file_target = dst_file->private_data; +- struct cifs_tcon *target_tcon = tlink_tcon(smb_file_target->tlink); ++ struct cifsFileInfo *smb_file_target; ++ struct cifs_tcon *target_tcon; + unsigned int xid; + int rc; + +@@ -996,6 +996,9 @@ static int cifs_clone_file_range(struct file *src_file, loff_t off, + goto out; + } + ++ smb_file_target = dst_file->private_data; ++ target_tcon = tlink_tcon(smb_file_target->tlink); ++ + /* + * Note: cifs case is easier than btrfs since server responsible for + * checks for proper open modes and file type and if it wants +diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c +index 89985a0a6819..812da3e56a22 100644 +--- a/fs/cifs/smb2ops.c ++++ b/fs/cifs/smb2ops.c +@@ -686,6 +686,7 @@ move_smb2_ea_to_cifs(char *dst, size_t dst_size, + int rc = 0; + unsigned int ea_name_len = ea_name ? strlen(ea_name) : 0; + char *name, *value; ++ size_t buf_size = dst_size; + size_t name_len, value_len, user_name_len; + + while (src_size > 0) { +@@ -721,9 +722,10 @@ move_smb2_ea_to_cifs(char *dst, size_t dst_size, + /* 'user.' plus a terminating null */ + user_name_len = 5 + 1 + name_len; + +- rc += user_name_len; +- +- if (dst_size >= user_name_len) { ++ if (buf_size == 0) { ++ /* skip copy - calc size only */ ++ rc += user_name_len; ++ } else if (dst_size >= user_name_len) { + dst_size -= user_name_len; + memcpy(dst, "user.", 5); + dst += 5; +@@ -731,8 +733,7 @@ move_smb2_ea_to_cifs(char *dst, size_t dst_size, + dst += name_len; + *dst = 0; + ++dst; +- } else if (dst_size == 0) { +- /* skip copy - calc size only */ ++ rc += user_name_len; + } else { + /* stop before overrun buffer */ + rc = -ERANGE; +diff --git a/fs/exofs/super.c b/fs/exofs/super.c +index 41cf2fbee50d..7d61e3fa378c 100644 +--- a/fs/exofs/super.c ++++ b/fs/exofs/super.c +@@ -101,6 +101,7 @@ static int parse_options(char *options, struct exofs_mountopt *opts) + token = match_token(p, tokens, args); + switch (token) { + case Opt_name: ++ kfree(opts->dev_name); + opts->dev_name = match_strdup(&args[0]); + if (unlikely(!opts->dev_name)) { + EXOFS_ERR("Error allocating dev_name"); +@@ -866,8 +867,10 @@ static struct dentry *exofs_mount(struct file_system_type *type, + int ret; + + ret = parse_options(data, &opts); +- if (ret) ++ if (ret) { ++ kfree(opts.dev_name); + return ERR_PTR(ret); ++ } + + if (!opts.dev_name) + opts.dev_name = dev_name; +diff --git a/fs/hfs/brec.c b/fs/hfs/brec.c +index 9a8772465a90..da25c49203cc 100644 +--- a/fs/hfs/brec.c ++++ b/fs/hfs/brec.c +@@ -425,6 +425,10 @@ skip: + if (new_node) { + __be32 cnid; + ++ if (!new_node->parent) { ++ hfs_btree_inc_height(tree); ++ new_node->parent = tree->root; ++ } + fd->bnode = hfs_bnode_find(tree, new_node->parent); + /* create index key and entry */ + hfs_bnode_read_key(new_node, fd->search_key, 14); +diff --git a/fs/hfsplus/brec.c b/fs/hfsplus/brec.c +index ed8eacb34452..aa17a392b414 100644 +--- a/fs/hfsplus/brec.c ++++ b/fs/hfsplus/brec.c +@@ -429,6 +429,10 @@ skip: + if (new_node) { + __be32 cnid; + ++ if (!new_node->parent) { ++ hfs_btree_inc_height(tree); ++ new_node->parent = tree->root; ++ } + fd->bnode = hfs_bnode_find(tree, new_node->parent); + /* create index key and entry */ + hfs_bnode_read_key(new_node, fd->search_key, 14); +diff --git a/fs/reiserfs/xattr.c b/fs/reiserfs/xattr.c +index 48cdfc81fe10..32d8986c26fb 100644 +--- a/fs/reiserfs/xattr.c ++++ b/fs/reiserfs/xattr.c +@@ -185,6 +185,7 @@ struct reiserfs_dentry_buf { + struct dir_context ctx; + struct dentry *xadir; + int count; ++ int err; + struct dentry *dentries[8]; + }; + +@@ -207,6 +208,7 @@ fill_with_dentries(struct dir_context *ctx, const char *name, int namelen, + + dentry = lookup_one_len(name, dbuf->xadir, namelen); + if (IS_ERR(dentry)) { ++ dbuf->err = PTR_ERR(dentry); + return PTR_ERR(dentry); + } else if (d_really_is_negative(dentry)) { + /* A directory entry exists, but no file? */ +@@ -215,6 +217,7 @@ fill_with_dentries(struct dir_context *ctx, const char *name, int namelen, + "not found for file %pd.\n", + dentry, dbuf->xadir); + dput(dentry); ++ dbuf->err = -EIO; + return -EIO; + } + +@@ -262,6 +265,10 @@ static int reiserfs_for_each_xattr(struct inode *inode, + err = reiserfs_readdir_inode(d_inode(dir), &buf.ctx); + if (err) + break; ++ if (buf.err) { ++ err = buf.err; ++ break; ++ } + if (!buf.count) + break; + for (i = 0; !err && i < buf.count && buf.dentries[i]; i++) { +diff --git a/include/linux/mtd/nand.h b/include/linux/mtd/nand.h +index 78b86dea2f29..7f53ece2c039 100644 +--- a/include/linux/mtd/nand.h ++++ b/include/linux/mtd/nand.h +@@ -568,7 +568,7 @@ static inline void nanddev_pos_next_eraseblock(struct nand_device *nand, + } + + /** +- * nanddev_pos_next_eraseblock() - Move a position to the next page ++ * nanddev_pos_next_page() - Move a position to the next page + * @nand: NAND device + * @pos: the position to update + * +diff --git a/include/linux/netfilter/ipset/ip_set.h b/include/linux/netfilter/ipset/ip_set.h +index 34fc80f3eb90..1d100efe74ec 100644 +--- a/include/linux/netfilter/ipset/ip_set.h ++++ b/include/linux/netfilter/ipset/ip_set.h +@@ -314,7 +314,7 @@ enum { + extern ip_set_id_t ip_set_get_byname(struct net *net, + const char *name, struct ip_set **set); + extern void ip_set_put_byindex(struct net *net, ip_set_id_t index); +-extern const char *ip_set_name_byindex(struct net *net, ip_set_id_t index); ++extern void ip_set_name_byindex(struct net *net, ip_set_id_t index, char *name); + extern ip_set_id_t ip_set_nfnl_get_byindex(struct net *net, ip_set_id_t index); + extern void ip_set_nfnl_put(struct net *net, ip_set_id_t index); + +diff --git a/include/linux/netfilter/ipset/ip_set_comment.h b/include/linux/netfilter/ipset/ip_set_comment.h +index 8e2bab1e8e90..70877f8de7e9 100644 +--- a/include/linux/netfilter/ipset/ip_set_comment.h ++++ b/include/linux/netfilter/ipset/ip_set_comment.h +@@ -43,11 +43,11 @@ ip_set_init_comment(struct ip_set *set, struct ip_set_comment *comment, + rcu_assign_pointer(comment->c, c); + } + +-/* Used only when dumping a set, protected by rcu_read_lock_bh() */ ++/* Used only when dumping a set, protected by rcu_read_lock() */ + static inline int + ip_set_put_comment(struct sk_buff *skb, const struct ip_set_comment *comment) + { +- struct ip_set_comment_rcu *c = rcu_dereference_bh(comment->c); ++ struct ip_set_comment_rcu *c = rcu_dereference(comment->c); + + if (!c) + return 0; +diff --git a/include/linux/usb/quirks.h b/include/linux/usb/quirks.h +index b7a99ce56bc9..a1be64c9940f 100644 +--- a/include/linux/usb/quirks.h ++++ b/include/linux/usb/quirks.h +@@ -66,4 +66,7 @@ + /* Device needs a pause after every control message. */ + #define USB_QUIRK_DELAY_CTRL_MSG BIT(13) + ++/* Hub needs extra delay after resetting its port. */ ++#define USB_QUIRK_HUB_SLOW_RESET BIT(14) ++ + #endif /* __LINUX_USB_QUIRKS_H */ +diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h +index e23290ffdc77..325ec6ef0a76 100644 +--- a/include/uapi/linux/netfilter/nf_tables.h ++++ b/include/uapi/linux/netfilter/nf_tables.h +@@ -1581,8 +1581,8 @@ enum nft_ng_attributes { + NFTA_NG_MODULUS, + NFTA_NG_TYPE, + NFTA_NG_OFFSET, +- NFTA_NG_SET_NAME, +- NFTA_NG_SET_ID, ++ NFTA_NG_SET_NAME, /* deprecated */ ++ NFTA_NG_SET_ID, /* deprecated */ + __NFTA_NG_MAX + }; + #define NFTA_NG_MAX (__NFTA_NG_MAX - 1) +diff --git a/include/uapi/linux/netfilter_bridge.h b/include/uapi/linux/netfilter_bridge.h +index 156ccd089df1..1610fdbab98d 100644 +--- a/include/uapi/linux/netfilter_bridge.h ++++ b/include/uapi/linux/netfilter_bridge.h +@@ -11,6 +11,10 @@ + #include + #include + ++#ifndef __KERNEL__ ++#include /* for INT_MIN, INT_MAX */ ++#endif ++ + /* Bridge Hooks */ + /* After promisc drops, checksum checks. */ + #define NF_BR_PRE_ROUTING 0 +diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c +index 675eb6d36e47..382c09dddf93 100644 +--- a/kernel/bpf/syscall.c ++++ b/kernel/bpf/syscall.c +@@ -1974,6 +1974,7 @@ static int bpf_prog_get_info_by_fd(struct bpf_prog *prog, + info.jited_prog_len = 0; + info.xlated_prog_len = 0; + info.nr_jited_ksyms = 0; ++ info.nr_jited_func_lens = 0; + goto done; + } + +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index ad97f3ba5ec5..35551110d277 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -5854,11 +5854,14 @@ void __init sched_init_smp(void) + /* + * There's no userspace yet to cause hotplug operations; hence all the + * CPU masks are stable and all blatant races in the below code cannot +- * happen. ++ * happen. The hotplug lock is nevertheless taken to satisfy lockdep, ++ * but there won't be any contention on it. + */ ++ cpus_read_lock(); + mutex_lock(&sched_domains_mutex); + sched_init_domains(cpu_active_mask); + mutex_unlock(&sched_domains_mutex); ++ cpus_read_unlock(); + + /* Move init over to a non-isolated CPU */ + if (set_cpus_allowed_ptr(current, housekeeping_cpumask(HK_FLAG_DOMAIN)) < 0) +diff --git a/lib/raid6/test/Makefile b/lib/raid6/test/Makefile +index 5d73f5cb4d8a..79777645cac9 100644 +--- a/lib/raid6/test/Makefile ++++ b/lib/raid6/test/Makefile +@@ -27,7 +27,7 @@ ifeq ($(ARCH),arm) + CFLAGS += -I../../../arch/arm/include -mfpu=neon + HAS_NEON = yes + endif +-ifeq ($(ARCH),arm64) ++ifeq ($(ARCH),aarch64) + CFLAGS += -I../../../arch/arm64/include + HAS_NEON = yes + endif +@@ -41,7 +41,7 @@ ifeq ($(IS_X86),yes) + gcc -c -x assembler - >&/dev/null && \ + rm ./-.o && echo -DCONFIG_AS_AVX512=1) + else ifeq ($(HAS_NEON),yes) +- OBJS += neon.o neon1.o neon2.o neon4.o neon8.o ++ OBJS += neon.o neon1.o neon2.o neon4.o neon8.o recov_neon.o recov_neon_inner.o + CFLAGS += -DCONFIG_KERNEL_MODE_NEON=1 + else + HAS_ALTIVEC := $(shell printf '\#include \nvector int a;\n' |\ +diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c +index 0a187196aeed..9a1c27c61de8 100644 +--- a/net/ceph/messenger.c ++++ b/net/ceph/messenger.c +@@ -593,9 +593,15 @@ static int ceph_tcp_sendpage(struct socket *sock, struct page *page, + struct bio_vec bvec; + int ret; + +- /* sendpage cannot properly handle pages with page_count == 0, +- * we need to fallback to sendmsg if that's the case */ +- if (page_count(page) >= 1) ++ /* ++ * sendpage cannot properly handle pages with page_count == 0, ++ * we need to fall back to sendmsg if that's the case. ++ * ++ * Same goes for slab pages: skb_can_coalesce() allows ++ * coalescing neighboring slab objects into a single frag which ++ * triggers one of hardened usercopy checks. ++ */ ++ if (page_count(page) >= 1 && !PageSlab(page)) + return __ceph_tcp_sendpage(sock, page, offset, size, more); + + bvec.bv_page = page; +diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c +index 8f68a518d9db..f76bd4d15704 100644 +--- a/net/ipv6/netfilter/nf_conntrack_reasm.c ++++ b/net/ipv6/netfilter/nf_conntrack_reasm.c +@@ -587,11 +587,16 @@ int nf_ct_frag6_gather(struct net *net, struct sk_buff *skb, u32 user) + */ + ret = -EINPROGRESS; + if (fq->q.flags == (INET_FRAG_FIRST_IN | INET_FRAG_LAST_IN) && +- fq->q.meat == fq->q.len && +- nf_ct_frag6_reasm(fq, skb, dev)) +- ret = 0; +- else ++ fq->q.meat == fq->q.len) { ++ unsigned long orefdst = skb->_skb_refdst; ++ ++ skb->_skb_refdst = 0UL; ++ if (nf_ct_frag6_reasm(fq, skb, dev)) ++ ret = 0; ++ skb->_skb_refdst = orefdst; ++ } else { + skb_dst_drop(skb); ++ } + + out_unlock: + spin_unlock_bh(&fq->q.lock); +diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c +index bc4bd247bb7d..1577f2f76060 100644 +--- a/net/netfilter/ipset/ip_set_core.c ++++ b/net/netfilter/ipset/ip_set_core.c +@@ -55,11 +55,15 @@ MODULE_AUTHOR("Jozsef Kadlecsik "); + MODULE_DESCRIPTION("core IP set support"); + MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_IPSET); + +-/* When the nfnl mutex is held: */ ++/* When the nfnl mutex or ip_set_ref_lock is held: */ + #define ip_set_dereference(p) \ +- rcu_dereference_protected(p, lockdep_nfnl_is_held(NFNL_SUBSYS_IPSET)) ++ rcu_dereference_protected(p, \ ++ lockdep_nfnl_is_held(NFNL_SUBSYS_IPSET) || \ ++ lockdep_is_held(&ip_set_ref_lock)) + #define ip_set(inst, id) \ + ip_set_dereference((inst)->ip_set_list)[id] ++#define ip_set_ref_netlink(inst,id) \ ++ rcu_dereference_raw((inst)->ip_set_list)[id] + + /* The set types are implemented in modules and registered set types + * can be found in ip_set_type_list. Adding/deleting types is +@@ -693,21 +697,20 @@ ip_set_put_byindex(struct net *net, ip_set_id_t index) + EXPORT_SYMBOL_GPL(ip_set_put_byindex); + + /* Get the name of a set behind a set index. +- * We assume the set is referenced, so it does exist and +- * can't be destroyed. The set cannot be renamed due to +- * the referencing either. +- * ++ * Set itself is protected by RCU, but its name isn't: to protect against ++ * renaming, grab ip_set_ref_lock as reader (see ip_set_rename()) and copy the ++ * name. + */ +-const char * +-ip_set_name_byindex(struct net *net, ip_set_id_t index) ++void ++ip_set_name_byindex(struct net *net, ip_set_id_t index, char *name) + { +- const struct ip_set *set = ip_set_rcu_get(net, index); ++ struct ip_set *set = ip_set_rcu_get(net, index); + + BUG_ON(!set); +- BUG_ON(set->ref == 0); + +- /* Referenced, so it's safe */ +- return set->name; ++ read_lock_bh(&ip_set_ref_lock); ++ strncpy(name, set->name, IPSET_MAXNAMELEN); ++ read_unlock_bh(&ip_set_ref_lock); + } + EXPORT_SYMBOL_GPL(ip_set_name_byindex); + +@@ -961,7 +964,7 @@ static int ip_set_create(struct net *net, struct sock *ctnl, + /* Wraparound */ + goto cleanup; + +- list = kcalloc(i, sizeof(struct ip_set *), GFP_KERNEL); ++ list = kvcalloc(i, sizeof(struct ip_set *), GFP_KERNEL); + if (!list) + goto cleanup; + /* nfnl mutex is held, both lists are valid */ +@@ -973,7 +976,7 @@ static int ip_set_create(struct net *net, struct sock *ctnl, + /* Use new list */ + index = inst->ip_set_max; + inst->ip_set_max = i; +- kfree(tmp); ++ kvfree(tmp); + ret = 0; + } else if (ret) { + goto cleanup; +@@ -1153,7 +1156,7 @@ static int ip_set_rename(struct net *net, struct sock *ctnl, + if (!set) + return -ENOENT; + +- read_lock_bh(&ip_set_ref_lock); ++ write_lock_bh(&ip_set_ref_lock); + if (set->ref != 0) { + ret = -IPSET_ERR_REFERENCED; + goto out; +@@ -1170,7 +1173,7 @@ static int ip_set_rename(struct net *net, struct sock *ctnl, + strncpy(set->name, name2, IPSET_MAXNAMELEN); + + out: +- read_unlock_bh(&ip_set_ref_lock); ++ write_unlock_bh(&ip_set_ref_lock); + return ret; + } + +@@ -1252,7 +1255,7 @@ ip_set_dump_done(struct netlink_callback *cb) + struct ip_set_net *inst = + (struct ip_set_net *)cb->args[IPSET_CB_NET]; + ip_set_id_t index = (ip_set_id_t)cb->args[IPSET_CB_INDEX]; +- struct ip_set *set = ip_set(inst, index); ++ struct ip_set *set = ip_set_ref_netlink(inst, index); + + if (set->variant->uref) + set->variant->uref(set, cb, false); +@@ -1441,7 +1444,7 @@ next_set: + release_refcount: + /* If there was an error or set is done, release set */ + if (ret || !cb->args[IPSET_CB_ARG0]) { +- set = ip_set(inst, index); ++ set = ip_set_ref_netlink(inst, index); + if (set->variant->uref) + set->variant->uref(set, cb, false); + pr_debug("release set %s\n", set->name); +@@ -2059,7 +2062,7 @@ ip_set_net_init(struct net *net) + if (inst->ip_set_max >= IPSET_INVALID_ID) + inst->ip_set_max = IPSET_INVALID_ID - 1; + +- list = kcalloc(inst->ip_set_max, sizeof(struct ip_set *), GFP_KERNEL); ++ list = kvcalloc(inst->ip_set_max, sizeof(struct ip_set *), GFP_KERNEL); + if (!list) + return -ENOMEM; + inst->is_deleted = false; +@@ -2087,7 +2090,7 @@ ip_set_net_exit(struct net *net) + } + } + nfnl_unlock(NFNL_SUBSYS_IPSET); +- kfree(rcu_dereference_protected(inst->ip_set_list, 1)); ++ kvfree(rcu_dereference_protected(inst->ip_set_list, 1)); + } + + static struct pernet_operations ip_set_net_ops = { +diff --git a/net/netfilter/ipset/ip_set_hash_netportnet.c b/net/netfilter/ipset/ip_set_hash_netportnet.c +index d391485a6acd..613e18e720a4 100644 +--- a/net/netfilter/ipset/ip_set_hash_netportnet.c ++++ b/net/netfilter/ipset/ip_set_hash_netportnet.c +@@ -213,13 +213,13 @@ hash_netportnet4_uadt(struct ip_set *set, struct nlattr *tb[], + + if (tb[IPSET_ATTR_CIDR]) { + e.cidr[0] = nla_get_u8(tb[IPSET_ATTR_CIDR]); +- if (!e.cidr[0] || e.cidr[0] > HOST_MASK) ++ if (e.cidr[0] > HOST_MASK) + return -IPSET_ERR_INVALID_CIDR; + } + + if (tb[IPSET_ATTR_CIDR2]) { + e.cidr[1] = nla_get_u8(tb[IPSET_ATTR_CIDR2]); +- if (!e.cidr[1] || e.cidr[1] > HOST_MASK) ++ if (e.cidr[1] > HOST_MASK) + return -IPSET_ERR_INVALID_CIDR; + } + +@@ -493,13 +493,13 @@ hash_netportnet6_uadt(struct ip_set *set, struct nlattr *tb[], + + if (tb[IPSET_ATTR_CIDR]) { + e.cidr[0] = nla_get_u8(tb[IPSET_ATTR_CIDR]); +- if (!e.cidr[0] || e.cidr[0] > HOST_MASK) ++ if (e.cidr[0] > HOST_MASK) + return -IPSET_ERR_INVALID_CIDR; + } + + if (tb[IPSET_ATTR_CIDR2]) { + e.cidr[1] = nla_get_u8(tb[IPSET_ATTR_CIDR2]); +- if (!e.cidr[1] || e.cidr[1] > HOST_MASK) ++ if (e.cidr[1] > HOST_MASK) + return -IPSET_ERR_INVALID_CIDR; + } + +diff --git a/net/netfilter/ipset/ip_set_list_set.c b/net/netfilter/ipset/ip_set_list_set.c +index 072a658fde04..4eef55da0878 100644 +--- a/net/netfilter/ipset/ip_set_list_set.c ++++ b/net/netfilter/ipset/ip_set_list_set.c +@@ -148,9 +148,7 @@ __list_set_del_rcu(struct rcu_head * rcu) + { + struct set_elem *e = container_of(rcu, struct set_elem, rcu); + struct ip_set *set = e->set; +- struct list_set *map = set->data; + +- ip_set_put_byindex(map->net, e->id); + ip_set_ext_destroy(set, e); + kfree(e); + } +@@ -158,15 +156,21 @@ __list_set_del_rcu(struct rcu_head * rcu) + static inline void + list_set_del(struct ip_set *set, struct set_elem *e) + { ++ struct list_set *map = set->data; ++ + set->elements--; + list_del_rcu(&e->list); ++ ip_set_put_byindex(map->net, e->id); + call_rcu(&e->rcu, __list_set_del_rcu); + } + + static inline void +-list_set_replace(struct set_elem *e, struct set_elem *old) ++list_set_replace(struct ip_set *set, struct set_elem *e, struct set_elem *old) + { ++ struct list_set *map = set->data; ++ + list_replace_rcu(&old->list, &e->list); ++ ip_set_put_byindex(map->net, old->id); + call_rcu(&old->rcu, __list_set_del_rcu); + } + +@@ -298,7 +302,7 @@ list_set_uadd(struct ip_set *set, void *value, const struct ip_set_ext *ext, + INIT_LIST_HEAD(&e->list); + list_set_init_extensions(set, ext, e); + if (n) +- list_set_replace(e, n); ++ list_set_replace(set, e, n); + else if (next) + list_add_tail_rcu(&e->list, &next->list); + else if (prev) +@@ -486,6 +490,7 @@ list_set_list(const struct ip_set *set, + const struct list_set *map = set->data; + struct nlattr *atd, *nested; + u32 i = 0, first = cb->args[IPSET_CB_ARG0]; ++ char name[IPSET_MAXNAMELEN]; + struct set_elem *e; + int ret = 0; + +@@ -504,8 +509,8 @@ list_set_list(const struct ip_set *set, + nested = ipset_nest_start(skb, IPSET_ATTR_DATA); + if (!nested) + goto nla_put_failure; +- if (nla_put_string(skb, IPSET_ATTR_NAME, +- ip_set_name_byindex(map->net, e->id))) ++ ip_set_name_byindex(map->net, e->id, name); ++ if (nla_put_string(skb, IPSET_ATTR_NAME, name)) + goto nla_put_failure; + if (ip_set_put_extensions(skb, set, e, true)) + goto nla_put_failure; +diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c +index 32535eea51b2..ad2fe6a7e47d 100644 +--- a/net/netfilter/nft_compat.c ++++ b/net/netfilter/nft_compat.c +@@ -54,9 +54,11 @@ static bool nft_xt_put(struct nft_xt *xt) + return false; + } + +-static int nft_compat_chain_validate_dependency(const char *tablename, +- const struct nft_chain *chain) ++static int nft_compat_chain_validate_dependency(const struct nft_ctx *ctx, ++ const char *tablename) + { ++ enum nft_chain_types type = NFT_CHAIN_T_DEFAULT; ++ const struct nft_chain *chain = ctx->chain; + const struct nft_base_chain *basechain; + + if (!tablename || +@@ -64,9 +66,12 @@ static int nft_compat_chain_validate_dependency(const char *tablename, + return 0; + + basechain = nft_base_chain(chain); +- if (strcmp(tablename, "nat") == 0 && +- basechain->type->type != NFT_CHAIN_T_NAT) +- return -EINVAL; ++ if (strcmp(tablename, "nat") == 0) { ++ if (ctx->family != NFPROTO_BRIDGE) ++ type = NFT_CHAIN_T_NAT; ++ if (basechain->type->type != type) ++ return -EINVAL; ++ } + + return 0; + } +@@ -323,8 +328,7 @@ static int nft_target_validate(const struct nft_ctx *ctx, + if (target->hooks && !(hook_mask & target->hooks)) + return -EINVAL; + +- ret = nft_compat_chain_validate_dependency(target->table, +- ctx->chain); ++ ret = nft_compat_chain_validate_dependency(ctx, target->table); + if (ret < 0) + return ret; + } +@@ -570,8 +574,7 @@ static int nft_match_validate(const struct nft_ctx *ctx, + if (match->hooks && !(hook_mask & match->hooks)) + return -EINVAL; + +- ret = nft_compat_chain_validate_dependency(match->table, +- ctx->chain); ++ ret = nft_compat_chain_validate_dependency(ctx, match->table); + if (ret < 0) + return ret; + } +diff --git a/net/netfilter/nft_numgen.c b/net/netfilter/nft_numgen.c +index 649d1700ec5b..3cc1b3dc3c3c 100644 +--- a/net/netfilter/nft_numgen.c ++++ b/net/netfilter/nft_numgen.c +@@ -24,7 +24,6 @@ struct nft_ng_inc { + u32 modulus; + atomic_t counter; + u32 offset; +- struct nft_set *map; + }; + + static u32 nft_ng_inc_gen(struct nft_ng_inc *priv) +@@ -48,34 +47,11 @@ static void nft_ng_inc_eval(const struct nft_expr *expr, + regs->data[priv->dreg] = nft_ng_inc_gen(priv); + } + +-static void nft_ng_inc_map_eval(const struct nft_expr *expr, +- struct nft_regs *regs, +- const struct nft_pktinfo *pkt) +-{ +- struct nft_ng_inc *priv = nft_expr_priv(expr); +- const struct nft_set *map = priv->map; +- const struct nft_set_ext *ext; +- u32 result; +- bool found; +- +- result = nft_ng_inc_gen(priv); +- found = map->ops->lookup(nft_net(pkt), map, &result, &ext); +- +- if (!found) +- return; +- +- nft_data_copy(®s->data[priv->dreg], +- nft_set_ext_data(ext), map->dlen); +-} +- + static const struct nla_policy nft_ng_policy[NFTA_NG_MAX + 1] = { + [NFTA_NG_DREG] = { .type = NLA_U32 }, + [NFTA_NG_MODULUS] = { .type = NLA_U32 }, + [NFTA_NG_TYPE] = { .type = NLA_U32 }, + [NFTA_NG_OFFSET] = { .type = NLA_U32 }, +- [NFTA_NG_SET_NAME] = { .type = NLA_STRING, +- .len = NFT_SET_MAXNAMELEN - 1 }, +- [NFTA_NG_SET_ID] = { .type = NLA_U32 }, + }; + + static int nft_ng_inc_init(const struct nft_ctx *ctx, +@@ -101,22 +77,6 @@ static int nft_ng_inc_init(const struct nft_ctx *ctx, + NFT_DATA_VALUE, sizeof(u32)); + } + +-static int nft_ng_inc_map_init(const struct nft_ctx *ctx, +- const struct nft_expr *expr, +- const struct nlattr * const tb[]) +-{ +- struct nft_ng_inc *priv = nft_expr_priv(expr); +- u8 genmask = nft_genmask_next(ctx->net); +- +- nft_ng_inc_init(ctx, expr, tb); +- +- priv->map = nft_set_lookup_global(ctx->net, ctx->table, +- tb[NFTA_NG_SET_NAME], +- tb[NFTA_NG_SET_ID], genmask); +- +- return PTR_ERR_OR_ZERO(priv->map); +-} +- + static int nft_ng_dump(struct sk_buff *skb, enum nft_registers dreg, + u32 modulus, enum nft_ng_types type, u32 offset) + { +@@ -143,27 +103,10 @@ static int nft_ng_inc_dump(struct sk_buff *skb, const struct nft_expr *expr) + priv->offset); + } + +-static int nft_ng_inc_map_dump(struct sk_buff *skb, +- const struct nft_expr *expr) +-{ +- const struct nft_ng_inc *priv = nft_expr_priv(expr); +- +- if (nft_ng_dump(skb, priv->dreg, priv->modulus, +- NFT_NG_INCREMENTAL, priv->offset) || +- nla_put_string(skb, NFTA_NG_SET_NAME, priv->map->name)) +- goto nla_put_failure; +- +- return 0; +- +-nla_put_failure: +- return -1; +-} +- + struct nft_ng_random { + enum nft_registers dreg:8; + u32 modulus; + u32 offset; +- struct nft_set *map; + }; + + static u32 nft_ng_random_gen(struct nft_ng_random *priv) +@@ -183,25 +126,6 @@ static void nft_ng_random_eval(const struct nft_expr *expr, + regs->data[priv->dreg] = nft_ng_random_gen(priv); + } + +-static void nft_ng_random_map_eval(const struct nft_expr *expr, +- struct nft_regs *regs, +- const struct nft_pktinfo *pkt) +-{ +- struct nft_ng_random *priv = nft_expr_priv(expr); +- const struct nft_set *map = priv->map; +- const struct nft_set_ext *ext; +- u32 result; +- bool found; +- +- result = nft_ng_random_gen(priv); +- found = map->ops->lookup(nft_net(pkt), map, &result, &ext); +- if (!found) +- return; +- +- nft_data_copy(®s->data[priv->dreg], +- nft_set_ext_data(ext), map->dlen); +-} +- + static int nft_ng_random_init(const struct nft_ctx *ctx, + const struct nft_expr *expr, + const struct nlattr * const tb[]) +@@ -226,21 +150,6 @@ static int nft_ng_random_init(const struct nft_ctx *ctx, + NFT_DATA_VALUE, sizeof(u32)); + } + +-static int nft_ng_random_map_init(const struct nft_ctx *ctx, +- const struct nft_expr *expr, +- const struct nlattr * const tb[]) +-{ +- struct nft_ng_random *priv = nft_expr_priv(expr); +- u8 genmask = nft_genmask_next(ctx->net); +- +- nft_ng_random_init(ctx, expr, tb); +- priv->map = nft_set_lookup_global(ctx->net, ctx->table, +- tb[NFTA_NG_SET_NAME], +- tb[NFTA_NG_SET_ID], genmask); +- +- return PTR_ERR_OR_ZERO(priv->map); +-} +- + static int nft_ng_random_dump(struct sk_buff *skb, const struct nft_expr *expr) + { + const struct nft_ng_random *priv = nft_expr_priv(expr); +@@ -249,22 +158,6 @@ static int nft_ng_random_dump(struct sk_buff *skb, const struct nft_expr *expr) + priv->offset); + } + +-static int nft_ng_random_map_dump(struct sk_buff *skb, +- const struct nft_expr *expr) +-{ +- const struct nft_ng_random *priv = nft_expr_priv(expr); +- +- if (nft_ng_dump(skb, priv->dreg, priv->modulus, +- NFT_NG_RANDOM, priv->offset) || +- nla_put_string(skb, NFTA_NG_SET_NAME, priv->map->name)) +- goto nla_put_failure; +- +- return 0; +- +-nla_put_failure: +- return -1; +-} +- + static struct nft_expr_type nft_ng_type; + static const struct nft_expr_ops nft_ng_inc_ops = { + .type = &nft_ng_type, +@@ -274,14 +167,6 @@ static const struct nft_expr_ops nft_ng_inc_ops = { + .dump = nft_ng_inc_dump, + }; + +-static const struct nft_expr_ops nft_ng_inc_map_ops = { +- .type = &nft_ng_type, +- .size = NFT_EXPR_SIZE(sizeof(struct nft_ng_inc)), +- .eval = nft_ng_inc_map_eval, +- .init = nft_ng_inc_map_init, +- .dump = nft_ng_inc_map_dump, +-}; +- + static const struct nft_expr_ops nft_ng_random_ops = { + .type = &nft_ng_type, + .size = NFT_EXPR_SIZE(sizeof(struct nft_ng_random)), +@@ -290,14 +175,6 @@ static const struct nft_expr_ops nft_ng_random_ops = { + .dump = nft_ng_random_dump, + }; + +-static const struct nft_expr_ops nft_ng_random_map_ops = { +- .type = &nft_ng_type, +- .size = NFT_EXPR_SIZE(sizeof(struct nft_ng_random)), +- .eval = nft_ng_random_map_eval, +- .init = nft_ng_random_map_init, +- .dump = nft_ng_random_map_dump, +-}; +- + static const struct nft_expr_ops * + nft_ng_select_ops(const struct nft_ctx *ctx, const struct nlattr * const tb[]) + { +@@ -312,12 +189,8 @@ nft_ng_select_ops(const struct nft_ctx *ctx, const struct nlattr * const tb[]) + + switch (type) { + case NFT_NG_INCREMENTAL: +- if (tb[NFTA_NG_SET_NAME]) +- return &nft_ng_inc_map_ops; + return &nft_ng_inc_ops; + case NFT_NG_RANDOM: +- if (tb[NFTA_NG_SET_NAME]) +- return &nft_ng_random_map_ops; + return &nft_ng_random_ops; + } + +diff --git a/net/netfilter/xt_IDLETIMER.c b/net/netfilter/xt_IDLETIMER.c +index 5ee859193783..25453a16385e 100644 +--- a/net/netfilter/xt_IDLETIMER.c ++++ b/net/netfilter/xt_IDLETIMER.c +@@ -116,6 +116,22 @@ static void idletimer_tg_expired(struct timer_list *t) + schedule_work(&timer->work); + } + ++static int idletimer_check_sysfs_name(const char *name, unsigned int size) ++{ ++ int ret; ++ ++ ret = xt_check_proc_name(name, size); ++ if (ret < 0) ++ return ret; ++ ++ if (!strcmp(name, "power") || ++ !strcmp(name, "subsystem") || ++ !strcmp(name, "uevent")) ++ return -EINVAL; ++ ++ return 0; ++} ++ + static int idletimer_tg_create(struct idletimer_tg_info *info) + { + int ret; +@@ -126,6 +142,10 @@ static int idletimer_tg_create(struct idletimer_tg_info *info) + goto out; + } + ++ ret = idletimer_check_sysfs_name(info->label, sizeof(info->label)); ++ if (ret < 0) ++ goto out_free_timer; ++ + sysfs_attr_init(&info->timer->attr.attr); + info->timer->attr.attr.name = kstrdup(info->label, GFP_KERNEL); + if (!info->timer->attr.attr.name) { +diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c +index b53cc0960b5d..ac16f509c95c 100644 +--- a/net/sunrpc/xdr.c ++++ b/net/sunrpc/xdr.c +@@ -512,7 +512,7 @@ EXPORT_SYMBOL_GPL(xdr_commit_encode); + static __be32 *xdr_get_next_encode_buffer(struct xdr_stream *xdr, + size_t nbytes) + { +- static __be32 *p; ++ __be32 *p; + int space_left; + int frag1bytes, frag2bytes; + +diff --git a/scripts/package/mkdebian b/scripts/package/mkdebian +index 663a7f343b42..edcad61fe3cd 100755 +--- a/scripts/package/mkdebian ++++ b/scripts/package/mkdebian +@@ -88,6 +88,7 @@ set_debarch() { + version=$KERNELRELEASE + if [ -n "$KDEB_PKGVERSION" ]; then + packageversion=$KDEB_PKGVERSION ++ revision=${packageversion##*-} + else + revision=$(cat .version 2>/dev/null||echo 1) + packageversion=$version-$revision +@@ -205,10 +206,12 @@ cat < debian/rules + #!$(command -v $MAKE) -f + + build: +- \$(MAKE) KERNELRELEASE=${version} ARCH=${ARCH} KBUILD_SRC= ++ \$(MAKE) KERNELRELEASE=${version} ARCH=${ARCH} \ ++ KBUILD_BUILD_VERSION=${revision} KBUILD_SRC= + + binary-arch: +- \$(MAKE) KERNELRELEASE=${version} ARCH=${ARCH} KBUILD_SRC= intdeb-pkg ++ \$(MAKE) KERNELRELEASE=${version} ARCH=${ARCH} \ ++ KBUILD_BUILD_VERSION=${revision} KBUILD_SRC= intdeb-pkg + + clean: + rm -rf debian/*tmp debian/files +diff --git a/scripts/setlocalversion b/scripts/setlocalversion +index 79f7dd57d571..71f39410691b 100755 +--- a/scripts/setlocalversion ++++ b/scripts/setlocalversion +@@ -74,7 +74,7 @@ scm_version() + fi + + # Check for uncommitted changes +- if git status -uno --porcelain | grep -qv '^.. scripts/package'; then ++ if git diff-index --name-only HEAD | grep -qv "^scripts/package"; then + printf '%s' -dirty + fi + +diff --git a/security/apparmor/lib.c b/security/apparmor/lib.c +index 974affe50531..76491e7f4177 100644 +--- a/security/apparmor/lib.c ++++ b/security/apparmor/lib.c +@@ -90,10 +90,12 @@ const char *aa_splitn_fqname(const char *fqname, size_t n, const char **ns_name, + const char *end = fqname + n; + const char *name = skipn_spaces(fqname, n); + +- if (!name) +- return NULL; + *ns_name = NULL; + *ns_len = 0; ++ ++ if (!name) ++ return NULL; ++ + if (name[0] == ':') { + char *split = strnchr(&name[1], end - &name[1], ':'); + *ns_name = skipn_spaces(&name[1], end - &name[1]); +diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c +index 0166a3d7cd55..dffd60cebc31 100644 +--- a/sound/pci/hda/patch_ca0132.c ++++ b/sound/pci/hda/patch_ca0132.c +@@ -7395,7 +7395,7 @@ static void ca0132_free(struct hda_codec *codec) + + snd_hda_power_down(codec); + if (spec->mem_base) +- iounmap(spec->mem_base); ++ pci_iounmap(codec->bus->pci, spec->mem_base); + kfree(spec->spec_init_verbs); + kfree(codec->spec); + } +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 1070749c3cf4..e58537e13ad3 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -6481,6 +6481,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x103c, 0x2336, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), + SND_PCI_QUIRK(0x103c, 0x2337, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), + SND_PCI_QUIRK(0x103c, 0x221c, "HP EliteBook 755 G2", ALC280_FIXUP_HP_HEADSET_MIC), ++ SND_PCI_QUIRK(0x103c, 0x820d, "HP Pavilion 15", ALC269_FIXUP_HP_MUTE_LED_MIC3), + SND_PCI_QUIRK(0x103c, 0x8256, "HP", ALC221_FIXUP_HP_FRONT_MIC), + SND_PCI_QUIRK(0x103c, 0x827e, "HP x360", ALC295_FIXUP_HP_X360), + SND_PCI_QUIRK(0x103c, 0x82bf, "HP", ALC221_FIXUP_HP_MIC_NO_PRESENCE), +diff --git a/tools/perf/jvmti/jvmti_agent.c b/tools/perf/jvmti/jvmti_agent.c +index ac1bcdc17dae..f7eb63cbbc65 100644 +--- a/tools/perf/jvmti/jvmti_agent.c ++++ b/tools/perf/jvmti/jvmti_agent.c +@@ -125,7 +125,7 @@ perf_get_timestamp(void) + } + + static int +-debug_cache_init(void) ++create_jit_cache_dir(void) + { + char str[32]; + char *base, *p; +@@ -144,8 +144,13 @@ debug_cache_init(void) + + strftime(str, sizeof(str), JIT_LANG"-jit-%Y%m%d", &tm); + +- snprintf(jit_path, PATH_MAX - 1, "%s/.debug/", base); +- ++ ret = snprintf(jit_path, PATH_MAX, "%s/.debug/", base); ++ if (ret >= PATH_MAX) { ++ warnx("jvmti: cannot generate jit cache dir because %s/.debug/" ++ " is too long, please check the cwd, JITDUMPDIR, and" ++ " HOME variables", base); ++ return -1; ++ } + ret = mkdir(jit_path, 0755); + if (ret == -1) { + if (errno != EEXIST) { +@@ -154,20 +159,32 @@ debug_cache_init(void) + } + } + +- snprintf(jit_path, PATH_MAX - 1, "%s/.debug/jit", base); ++ ret = snprintf(jit_path, PATH_MAX, "%s/.debug/jit", base); ++ if (ret >= PATH_MAX) { ++ warnx("jvmti: cannot generate jit cache dir because" ++ " %s/.debug/jit is too long, please check the cwd," ++ " JITDUMPDIR, and HOME variables", base); ++ return -1; ++ } + ret = mkdir(jit_path, 0755); + if (ret == -1) { + if (errno != EEXIST) { +- warn("cannot create jit cache dir %s", jit_path); ++ warn("jvmti: cannot create jit cache dir %s", jit_path); + return -1; + } + } + +- snprintf(jit_path, PATH_MAX - 1, "%s/.debug/jit/%s.XXXXXXXX", base, str); +- ++ ret = snprintf(jit_path, PATH_MAX, "%s/.debug/jit/%s.XXXXXXXX", base, str); ++ if (ret >= PATH_MAX) { ++ warnx("jvmti: cannot generate jit cache dir because" ++ " %s/.debug/jit/%s.XXXXXXXX is too long, please check" ++ " the cwd, JITDUMPDIR, and HOME variables", ++ base, str); ++ return -1; ++ } + p = mkdtemp(jit_path); + if (p != jit_path) { +- warn("cannot create jit cache dir %s", jit_path); ++ warn("jvmti: cannot create jit cache dir %s", jit_path); + return -1; + } + +@@ -228,7 +245,7 @@ void *jvmti_open(void) + { + char dump_path[PATH_MAX]; + struct jitheader header; +- int fd; ++ int fd, ret; + FILE *fp; + + init_arch_timestamp(); +@@ -245,12 +262,22 @@ void *jvmti_open(void) + + memset(&header, 0, sizeof(header)); + +- debug_cache_init(); ++ /* ++ * jitdump file dir ++ */ ++ if (create_jit_cache_dir() < 0) ++ return NULL; + + /* + * jitdump file name + */ +- scnprintf(dump_path, PATH_MAX, "%s/jit-%i.dump", jit_path, getpid()); ++ ret = snprintf(dump_path, PATH_MAX, "%s/jit-%i.dump", jit_path, getpid()); ++ if (ret >= PATH_MAX) { ++ warnx("jvmti: cannot generate jitdump file full path because" ++ " %s/jit-%i.dump is too long, please check the cwd," ++ " JITDUMPDIR, and HOME variables", jit_path, getpid()); ++ return NULL; ++ } + + fd = open(dump_path, O_CREAT|O_TRUNC|O_RDWR, 0666); + if (fd == -1) +diff --git a/tools/perf/tests/attr/test-record-group-sampling b/tools/perf/tests/attr/test-record-group-sampling +index 8a33ca4f9e1f..f0729c454f16 100644 +--- a/tools/perf/tests/attr/test-record-group-sampling ++++ b/tools/perf/tests/attr/test-record-group-sampling +@@ -37,4 +37,3 @@ sample_freq=0 + sample_period=0 + freq=0 + write_backward=0 +-sample_id_all=0 +diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c +index e596ae358c4d..03a72310315f 100644 +--- a/tools/perf/util/evsel.c ++++ b/tools/perf/util/evsel.c +@@ -952,7 +952,6 @@ void perf_evsel__config(struct perf_evsel *evsel, struct record_opts *opts, + attr->sample_freq = 0; + attr->sample_period = 0; + attr->write_backward = 0; +- attr->sample_id_all = 0; + } + + if (opts->no_samples) +diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c +index 29770ea61768..6e70cc00c161 100644 +--- a/tools/perf/util/symbol-elf.c ++++ b/tools/perf/util/symbol-elf.c +@@ -324,7 +324,17 @@ int dso__synthesize_plt_symbols(struct dso *dso, struct symsrc *ss) + plt_entry_size = 16; + break; + +- default: /* FIXME: s390/alpha/mips/parisc/poperpc/sh/sparc/xtensa need to be checked */ ++ case EM_SPARC: ++ plt_header_size = 48; ++ plt_entry_size = 12; ++ break; ++ ++ case EM_SPARCV9: ++ plt_header_size = 128; ++ plt_entry_size = 32; ++ break; ++ ++ default: /* FIXME: s390/alpha/mips/parisc/poperpc/sh/xtensa need to be checked */ + plt_header_size = shdr_plt.sh_entsize; + plt_entry_size = shdr_plt.sh_entsize; + break; +diff --git a/tools/perf/util/unwind-libdw.c b/tools/perf/util/unwind-libdw.c +index 6f318b15950e..5eff9bfc5758 100644 +--- a/tools/perf/util/unwind-libdw.c ++++ b/tools/perf/util/unwind-libdw.c +@@ -45,13 +45,13 @@ static int __report_module(struct addr_location *al, u64 ip, + Dwarf_Addr s; + + dwfl_module_info(mod, NULL, &s, NULL, NULL, NULL, NULL, NULL); +- if (s != al->map->start) ++ if (s != al->map->start - al->map->pgoff) + mod = 0; + } + + if (!mod) + mod = dwfl_report_elf(ui->dwfl, dso->short_name, +- (dso->symsrc_filename ? dso->symsrc_filename : dso->long_name), -1, al->map->start, ++ (dso->symsrc_filename ? dso->symsrc_filename : dso->long_name), -1, al->map->start - al->map->pgoff, + false); + + return mod && dwfl_addrmodule(ui->dwfl, ip) == mod ? 0 : -1; diff --git a/patch/kernel/sunxi-dev/patch-4.19.5-6.patch b/patch/kernel/sunxi-dev/patch-4.19.5-6.patch new file mode 100644 index 000000000..91b0881af --- /dev/null +++ b/patch/kernel/sunxi-dev/patch-4.19.5-6.patch @@ -0,0 +1,4624 @@ +diff --git a/Documentation/admin-guide/security-bugs.rst b/Documentation/admin-guide/security-bugs.rst +index 30491d91e93d..30187d49dc2c 100644 +--- a/Documentation/admin-guide/security-bugs.rst ++++ b/Documentation/admin-guide/security-bugs.rst +@@ -26,23 +26,35 @@ information is helpful. Any exploit code is very helpful and will not + be released without consent from the reporter unless it has already been + made public. + +-Disclosure +----------- +- +-The goal of the Linux kernel security team is to work with the bug +-submitter to understand and fix the bug. We prefer to publish the fix as +-soon as possible, but try to avoid public discussion of the bug itself +-and leave that to others. +- +-Publishing the fix may be delayed when the bug or the fix is not yet +-fully understood, the solution is not well-tested or for vendor +-coordination. However, we expect these delays to be short, measurable in +-days, not weeks or months. A release date is negotiated by the security +-team working with the bug submitter as well as vendors. However, the +-kernel security team holds the final say when setting a timeframe. The +-timeframe varies from immediate (esp. if it's already publicly known bug) +-to a few weeks. As a basic default policy, we expect report date to +-release date to be on the order of 7 days. ++Disclosure and embargoed information ++------------------------------------ ++ ++The security list is not a disclosure channel. For that, see Coordination ++below. ++ ++Once a robust fix has been developed, the release process starts. Fixes ++for publicly known bugs are released immediately. ++ ++Although our preference is to release fixes for publicly undisclosed bugs ++as soon as they become available, this may be postponed at the request of ++the reporter or an affected party for up to 7 calendar days from the start ++of the release process, with an exceptional extension to 14 calendar days ++if it is agreed that the criticality of the bug requires more time. The ++only valid reason for deferring the publication of a fix is to accommodate ++the logistics of QA and large scale rollouts which require release ++coordination. ++ ++Whilst embargoed information may be shared with trusted individuals in ++order to develop a fix, such information will not be published alongside ++the fix or on any other disclosure channel without the permission of the ++reporter. This includes but is not limited to the original bug report ++and followup discussions (if any), exploits, CVE information or the ++identity of the reporter. ++ ++In other words our only interest is in getting bugs fixed. All other ++information submitted to the security list and any followup discussions ++of the report are treated confidentially even after the embargo has been ++lifted, in perpetuity. + + Coordination + ------------ +@@ -68,7 +80,7 @@ may delay the bug handling. If a reporter wishes to have a CVE identifier + assigned ahead of public disclosure, they will need to contact the private + linux-distros list, described above. When such a CVE identifier is known + before a patch is provided, it is desirable to mention it in the commit +-message, though. ++message if the reporter agrees. + + Non-disclosure agreements + ------------------------- +diff --git a/Documentation/devicetree/bindings/net/can/holt_hi311x.txt b/Documentation/devicetree/bindings/net/can/holt_hi311x.txt +index 903a78da65be..3a9926f99937 100644 +--- a/Documentation/devicetree/bindings/net/can/holt_hi311x.txt ++++ b/Documentation/devicetree/bindings/net/can/holt_hi311x.txt +@@ -17,7 +17,7 @@ Example: + reg = <1>; + clocks = <&clk32m>; + interrupt-parent = <&gpio4>; +- interrupts = <13 IRQ_TYPE_EDGE_RISING>; ++ interrupts = <13 IRQ_TYPE_LEVEL_HIGH>; + vdd-supply = <®5v0>; + xceiver-supply = <®5v0>; + }; +diff --git a/MAINTAINERS b/MAINTAINERS +index b2f710eee67a..9e9b19ecf6f7 100644 +--- a/MAINTAINERS ++++ b/MAINTAINERS +@@ -13769,6 +13769,7 @@ F: drivers/i2c/busses/i2c-stm32* + + STABLE BRANCH + M: Greg Kroah-Hartman ++M: Sasha Levin + L: stable@vger.kernel.org + S: Supported + F: Documentation/process/stable-kernel-rules.rst +diff --git a/Makefile b/Makefile +index a07830185bdf..20cbb8e84650 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 19 +-SUBLEVEL = 5 ++SUBLEVEL = 6 + EXTRAVERSION = + NAME = "People's Front" + +diff --git a/arch/powerpc/include/asm/io.h b/arch/powerpc/include/asm/io.h +index e0331e754568..b855f56489ac 100644 +--- a/arch/powerpc/include/asm/io.h ++++ b/arch/powerpc/include/asm/io.h +@@ -285,19 +285,13 @@ extern void _memcpy_toio(volatile void __iomem *dest, const void *src, + * their hooks, a bitfield is reserved for use by the platform near the + * top of MMIO addresses (not PIO, those have to cope the hard way). + * +- * This bit field is 12 bits and is at the top of the IO virtual +- * addresses PCI_IO_INDIRECT_TOKEN_MASK. ++ * The highest address in the kernel virtual space are: + * +- * The kernel virtual space is thus: ++ * d0003fffffffffff # with Hash MMU ++ * c00fffffffffffff # with Radix MMU + * +- * 0xD000000000000000 : vmalloc +- * 0xD000080000000000 : PCI PHB IO space +- * 0xD000080080000000 : ioremap +- * 0xD0000fffffffffff : end of ioremap region +- * +- * Since the top 4 bits are reserved as the region ID, we use thus +- * the next 12 bits and keep 4 bits available for the future if the +- * virtual address space is ever to be extended. ++ * The top 4 bits are reserved as the region ID on hash, leaving us 8 bits ++ * that can be used for the field. + * + * The direct IO mapping operations will then mask off those bits + * before doing the actual access, though that only happen when +@@ -309,8 +303,8 @@ extern void _memcpy_toio(volatile void __iomem *dest, const void *src, + */ + + #ifdef CONFIG_PPC_INDIRECT_MMIO +-#define PCI_IO_IND_TOKEN_MASK 0x0fff000000000000ul +-#define PCI_IO_IND_TOKEN_SHIFT 48 ++#define PCI_IO_IND_TOKEN_SHIFT 52 ++#define PCI_IO_IND_TOKEN_MASK (0xfful << PCI_IO_IND_TOKEN_SHIFT) + #define PCI_FIX_ADDR(addr) \ + ((PCI_IO_ADDR)(((unsigned long)(addr)) & ~PCI_IO_IND_TOKEN_MASK)) + #define PCI_GET_ADDR_TOKEN(addr) \ +diff --git a/arch/powerpc/kvm/trace.h b/arch/powerpc/kvm/trace.h +index 491b0f715d6b..ea1d7c808319 100644 +--- a/arch/powerpc/kvm/trace.h ++++ b/arch/powerpc/kvm/trace.h +@@ -6,8 +6,6 @@ + + #undef TRACE_SYSTEM + #define TRACE_SYSTEM kvm +-#define TRACE_INCLUDE_PATH . +-#define TRACE_INCLUDE_FILE trace + + /* + * Tracepoint for guest mode entry. +@@ -120,4 +118,10 @@ TRACE_EVENT(kvm_check_requests, + #endif /* _TRACE_KVM_H */ + + /* This part must be outside protection */ ++#undef TRACE_INCLUDE_PATH ++#undef TRACE_INCLUDE_FILE ++ ++#define TRACE_INCLUDE_PATH . ++#define TRACE_INCLUDE_FILE trace ++ + #include +diff --git a/arch/powerpc/kvm/trace_booke.h b/arch/powerpc/kvm/trace_booke.h +index ac640e81fdc5..3837842986aa 100644 +--- a/arch/powerpc/kvm/trace_booke.h ++++ b/arch/powerpc/kvm/trace_booke.h +@@ -6,8 +6,6 @@ + + #undef TRACE_SYSTEM + #define TRACE_SYSTEM kvm_booke +-#define TRACE_INCLUDE_PATH . +-#define TRACE_INCLUDE_FILE trace_booke + + #define kvm_trace_symbol_exit \ + {0, "CRITICAL"}, \ +@@ -218,4 +216,11 @@ TRACE_EVENT(kvm_booke_queue_irqprio, + #endif + + /* This part must be outside protection */ ++ ++#undef TRACE_INCLUDE_PATH ++#undef TRACE_INCLUDE_FILE ++ ++#define TRACE_INCLUDE_PATH . ++#define TRACE_INCLUDE_FILE trace_booke ++ + #include +diff --git a/arch/powerpc/kvm/trace_hv.h b/arch/powerpc/kvm/trace_hv.h +index bcfe8a987f6a..8a1e3b0047f1 100644 +--- a/arch/powerpc/kvm/trace_hv.h ++++ b/arch/powerpc/kvm/trace_hv.h +@@ -9,8 +9,6 @@ + + #undef TRACE_SYSTEM + #define TRACE_SYSTEM kvm_hv +-#define TRACE_INCLUDE_PATH . +-#define TRACE_INCLUDE_FILE trace_hv + + #define kvm_trace_symbol_hcall \ + {H_REMOVE, "H_REMOVE"}, \ +@@ -497,4 +495,11 @@ TRACE_EVENT(kvmppc_run_vcpu_exit, + #endif /* _TRACE_KVM_HV_H */ + + /* This part must be outside protection */ ++ ++#undef TRACE_INCLUDE_PATH ++#undef TRACE_INCLUDE_FILE ++ ++#define TRACE_INCLUDE_PATH . ++#define TRACE_INCLUDE_FILE trace_hv ++ + #include +diff --git a/arch/powerpc/kvm/trace_pr.h b/arch/powerpc/kvm/trace_pr.h +index 2f9a8829552b..46a46d328fbf 100644 +--- a/arch/powerpc/kvm/trace_pr.h ++++ b/arch/powerpc/kvm/trace_pr.h +@@ -8,8 +8,6 @@ + + #undef TRACE_SYSTEM + #define TRACE_SYSTEM kvm_pr +-#define TRACE_INCLUDE_PATH . +-#define TRACE_INCLUDE_FILE trace_pr + + TRACE_EVENT(kvm_book3s_reenter, + TP_PROTO(int r, struct kvm_vcpu *vcpu), +@@ -257,4 +255,11 @@ TRACE_EVENT(kvm_exit, + #endif /* _TRACE_KVM_H */ + + /* This part must be outside protection */ ++ ++#undef TRACE_INCLUDE_PATH ++#undef TRACE_INCLUDE_FILE ++ ++#define TRACE_INCLUDE_PATH . ++#define TRACE_INCLUDE_FILE trace_pr ++ + #include +diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c +index 055b211b7126..5500e4edabc6 100644 +--- a/arch/powerpc/mm/numa.c ++++ b/arch/powerpc/mm/numa.c +@@ -1179,7 +1179,7 @@ static long vphn_get_associativity(unsigned long cpu, + + switch (rc) { + case H_FUNCTION: +- printk(KERN_INFO ++ printk_once(KERN_INFO + "VPHN is not supported. Disabling polling...\n"); + stop_topology_update(); + break; +diff --git a/arch/riscv/Makefile b/arch/riscv/Makefile +index 61ec42405ec9..110be14e6122 100644 +--- a/arch/riscv/Makefile ++++ b/arch/riscv/Makefile +@@ -82,4 +82,8 @@ core-y += arch/riscv/kernel/ arch/riscv/mm/ + + libs-y += arch/riscv/lib/ + ++PHONY += vdso_install ++vdso_install: ++ $(Q)$(MAKE) $(build)=arch/riscv/kernel/vdso $@ ++ + all: vmlinux +diff --git a/arch/riscv/kernel/module.c b/arch/riscv/kernel/module.c +index 3303ed2cd419..7dd308129b40 100644 +--- a/arch/riscv/kernel/module.c ++++ b/arch/riscv/kernel/module.c +@@ -21,7 +21,7 @@ static int apply_r_riscv_32_rela(struct module *me, u32 *location, Elf_Addr v) + { + if (v != (u32)v) { + pr_err("%s: value %016llx out of range for 32-bit field\n", +- me->name, v); ++ me->name, (long long)v); + return -EINVAL; + } + *location = v; +@@ -102,7 +102,7 @@ static int apply_r_riscv_pcrel_hi20_rela(struct module *me, u32 *location, + if (offset != (s32)offset) { + pr_err( + "%s: target %016llx can not be addressed by the 32-bit offset from PC = %p\n", +- me->name, v, location); ++ me->name, (long long)v, location); + return -EINVAL; + } + +@@ -144,7 +144,7 @@ static int apply_r_riscv_hi20_rela(struct module *me, u32 *location, + if (IS_ENABLED(CMODEL_MEDLOW)) { + pr_err( + "%s: target %016llx can not be addressed by the 32-bit offset from PC = %p\n", +- me->name, v, location); ++ me->name, (long long)v, location); + return -EINVAL; + } + +@@ -188,7 +188,7 @@ static int apply_r_riscv_got_hi20_rela(struct module *me, u32 *location, + } else { + pr_err( + "%s: can not generate the GOT entry for symbol = %016llx from PC = %p\n", +- me->name, v, location); ++ me->name, (long long)v, location); + return -EINVAL; + } + +@@ -212,7 +212,7 @@ static int apply_r_riscv_call_plt_rela(struct module *me, u32 *location, + } else { + pr_err( + "%s: target %016llx can not be addressed by the 32-bit offset from PC = %p\n", +- me->name, v, location); ++ me->name, (long long)v, location); + return -EINVAL; + } + } +@@ -234,7 +234,7 @@ static int apply_r_riscv_call_rela(struct module *me, u32 *location, + if (offset != fill_v) { + pr_err( + "%s: target %016llx can not be addressed by the 32-bit offset from PC = %p\n", +- me->name, v, location); ++ me->name, (long long)v, location); + return -EINVAL; + } + +diff --git a/arch/x86/events/intel/uncore_snb.c b/arch/x86/events/intel/uncore_snb.c +index 8527c3e1038b..bfa25814fe5f 100644 +--- a/arch/x86/events/intel/uncore_snb.c ++++ b/arch/x86/events/intel/uncore_snb.c +@@ -15,6 +15,25 @@ + #define PCI_DEVICE_ID_INTEL_SKL_HQ_IMC 0x1910 + #define PCI_DEVICE_ID_INTEL_SKL_SD_IMC 0x190f + #define PCI_DEVICE_ID_INTEL_SKL_SQ_IMC 0x191f ++#define PCI_DEVICE_ID_INTEL_KBL_Y_IMC 0x590c ++#define PCI_DEVICE_ID_INTEL_KBL_U_IMC 0x5904 ++#define PCI_DEVICE_ID_INTEL_KBL_UQ_IMC 0x5914 ++#define PCI_DEVICE_ID_INTEL_KBL_SD_IMC 0x590f ++#define PCI_DEVICE_ID_INTEL_KBL_SQ_IMC 0x591f ++#define PCI_DEVICE_ID_INTEL_CFL_2U_IMC 0x3ecc ++#define PCI_DEVICE_ID_INTEL_CFL_4U_IMC 0x3ed0 ++#define PCI_DEVICE_ID_INTEL_CFL_4H_IMC 0x3e10 ++#define PCI_DEVICE_ID_INTEL_CFL_6H_IMC 0x3ec4 ++#define PCI_DEVICE_ID_INTEL_CFL_2S_D_IMC 0x3e0f ++#define PCI_DEVICE_ID_INTEL_CFL_4S_D_IMC 0x3e1f ++#define PCI_DEVICE_ID_INTEL_CFL_6S_D_IMC 0x3ec2 ++#define PCI_DEVICE_ID_INTEL_CFL_8S_D_IMC 0x3e30 ++#define PCI_DEVICE_ID_INTEL_CFL_4S_W_IMC 0x3e18 ++#define PCI_DEVICE_ID_INTEL_CFL_6S_W_IMC 0x3ec6 ++#define PCI_DEVICE_ID_INTEL_CFL_8S_W_IMC 0x3e31 ++#define PCI_DEVICE_ID_INTEL_CFL_4S_S_IMC 0x3e33 ++#define PCI_DEVICE_ID_INTEL_CFL_6S_S_IMC 0x3eca ++#define PCI_DEVICE_ID_INTEL_CFL_8S_S_IMC 0x3e32 + + /* SNB event control */ + #define SNB_UNC_CTL_EV_SEL_MASK 0x000000ff +@@ -569,7 +588,82 @@ static const struct pci_device_id skl_uncore_pci_ids[] = { + PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_SKL_SQ_IMC), + .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0), + }, +- ++ { /* IMC */ ++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_KBL_Y_IMC), ++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0), ++ }, ++ { /* IMC */ ++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_KBL_U_IMC), ++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0), ++ }, ++ { /* IMC */ ++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_KBL_UQ_IMC), ++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0), ++ }, ++ { /* IMC */ ++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_KBL_SD_IMC), ++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0), ++ }, ++ { /* IMC */ ++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_KBL_SQ_IMC), ++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0), ++ }, ++ { /* IMC */ ++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_2U_IMC), ++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0), ++ }, ++ { /* IMC */ ++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_4U_IMC), ++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0), ++ }, ++ { /* IMC */ ++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_4H_IMC), ++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0), ++ }, ++ { /* IMC */ ++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_6H_IMC), ++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0), ++ }, ++ { /* IMC */ ++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_2S_D_IMC), ++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0), ++ }, ++ { /* IMC */ ++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_4S_D_IMC), ++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0), ++ }, ++ { /* IMC */ ++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_6S_D_IMC), ++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0), ++ }, ++ { /* IMC */ ++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_8S_D_IMC), ++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0), ++ }, ++ { /* IMC */ ++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_4S_W_IMC), ++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0), ++ }, ++ { /* IMC */ ++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_6S_W_IMC), ++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0), ++ }, ++ { /* IMC */ ++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_8S_W_IMC), ++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0), ++ }, ++ { /* IMC */ ++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_4S_S_IMC), ++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0), ++ }, ++ { /* IMC */ ++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_6S_S_IMC), ++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0), ++ }, ++ { /* IMC */ ++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_8S_S_IMC), ++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0), ++ }, + { /* end: all zeroes */ }, + }; + +@@ -618,6 +712,25 @@ static const struct imc_uncore_pci_dev desktop_imc_pci_ids[] = { + IMC_DEV(SKL_HQ_IMC, &skl_uncore_pci_driver), /* 6th Gen Core H Quad Core */ + IMC_DEV(SKL_SD_IMC, &skl_uncore_pci_driver), /* 6th Gen Core S Dual Core */ + IMC_DEV(SKL_SQ_IMC, &skl_uncore_pci_driver), /* 6th Gen Core S Quad Core */ ++ IMC_DEV(KBL_Y_IMC, &skl_uncore_pci_driver), /* 7th Gen Core Y */ ++ IMC_DEV(KBL_U_IMC, &skl_uncore_pci_driver), /* 7th Gen Core U */ ++ IMC_DEV(KBL_UQ_IMC, &skl_uncore_pci_driver), /* 7th Gen Core U Quad Core */ ++ IMC_DEV(KBL_SD_IMC, &skl_uncore_pci_driver), /* 7th Gen Core S Dual Core */ ++ IMC_DEV(KBL_SQ_IMC, &skl_uncore_pci_driver), /* 7th Gen Core S Quad Core */ ++ IMC_DEV(CFL_2U_IMC, &skl_uncore_pci_driver), /* 8th Gen Core U 2 Cores */ ++ IMC_DEV(CFL_4U_IMC, &skl_uncore_pci_driver), /* 8th Gen Core U 4 Cores */ ++ IMC_DEV(CFL_4H_IMC, &skl_uncore_pci_driver), /* 8th Gen Core H 4 Cores */ ++ IMC_DEV(CFL_6H_IMC, &skl_uncore_pci_driver), /* 8th Gen Core H 6 Cores */ ++ IMC_DEV(CFL_2S_D_IMC, &skl_uncore_pci_driver), /* 8th Gen Core S 2 Cores Desktop */ ++ IMC_DEV(CFL_4S_D_IMC, &skl_uncore_pci_driver), /* 8th Gen Core S 4 Cores Desktop */ ++ IMC_DEV(CFL_6S_D_IMC, &skl_uncore_pci_driver), /* 8th Gen Core S 6 Cores Desktop */ ++ IMC_DEV(CFL_8S_D_IMC, &skl_uncore_pci_driver), /* 8th Gen Core S 8 Cores Desktop */ ++ IMC_DEV(CFL_4S_W_IMC, &skl_uncore_pci_driver), /* 8th Gen Core S 4 Cores Work Station */ ++ IMC_DEV(CFL_6S_W_IMC, &skl_uncore_pci_driver), /* 8th Gen Core S 6 Cores Work Station */ ++ IMC_DEV(CFL_8S_W_IMC, &skl_uncore_pci_driver), /* 8th Gen Core S 8 Cores Work Station */ ++ IMC_DEV(CFL_4S_S_IMC, &skl_uncore_pci_driver), /* 8th Gen Core S 4 Cores Server */ ++ IMC_DEV(CFL_6S_S_IMC, &skl_uncore_pci_driver), /* 8th Gen Core S 6 Cores Server */ ++ IMC_DEV(CFL_8S_S_IMC, &skl_uncore_pci_driver), /* 8th Gen Core S 8 Cores Server */ + { /* end marker */ } + }; + +diff --git a/block/bio.c b/block/bio.c +index 41173710430c..c4ef8aa46452 100644 +--- a/block/bio.c ++++ b/block/bio.c +@@ -605,6 +605,7 @@ void __bio_clone_fast(struct bio *bio, struct bio *bio_src) + if (bio_flagged(bio_src, BIO_THROTTLED)) + bio_set_flag(bio, BIO_THROTTLED); + bio->bi_opf = bio_src->bi_opf; ++ bio->bi_ioprio = bio_src->bi_ioprio; + bio->bi_write_hint = bio_src->bi_write_hint; + bio->bi_iter = bio_src->bi_iter; + bio->bi_io_vec = bio_src->bi_io_vec; +diff --git a/block/bounce.c b/block/bounce.c +index 418677dcec60..abb50e7e5fab 100644 +--- a/block/bounce.c ++++ b/block/bounce.c +@@ -248,6 +248,7 @@ static struct bio *bounce_clone_bio(struct bio *bio_src, gfp_t gfp_mask, + return NULL; + bio->bi_disk = bio_src->bi_disk; + bio->bi_opf = bio_src->bi_opf; ++ bio->bi_ioprio = bio_src->bi_ioprio; + bio->bi_write_hint = bio_src->bi_write_hint; + bio->bi_iter.bi_sector = bio_src->bi_iter.bi_sector; + bio->bi_iter.bi_size = bio_src->bi_iter.bi_size; +diff --git a/crypto/simd.c b/crypto/simd.c +index ea7240be3001..78e8d037ae2b 100644 +--- a/crypto/simd.c ++++ b/crypto/simd.c +@@ -124,8 +124,9 @@ static int simd_skcipher_init(struct crypto_skcipher *tfm) + + ctx->cryptd_tfm = cryptd_tfm; + +- reqsize = sizeof(struct skcipher_request); +- reqsize += crypto_skcipher_reqsize(&cryptd_tfm->base); ++ reqsize = crypto_skcipher_reqsize(cryptd_skcipher_child(cryptd_tfm)); ++ reqsize = max(reqsize, crypto_skcipher_reqsize(&cryptd_tfm->base)); ++ reqsize += sizeof(struct skcipher_request); + + crypto_skcipher_set_reqsize(tfm, reqsize); + +diff --git a/drivers/acpi/acpica/dsopcode.c b/drivers/acpi/acpica/dsopcode.c +index e9fb0bf3c8d2..78f9de260d5f 100644 +--- a/drivers/acpi/acpica/dsopcode.c ++++ b/drivers/acpi/acpica/dsopcode.c +@@ -417,6 +417,10 @@ acpi_ds_eval_region_operands(struct acpi_walk_state *walk_state, + ACPI_FORMAT_UINT64(obj_desc->region.address), + obj_desc->region.length)); + ++ status = acpi_ut_add_address_range(obj_desc->region.space_id, ++ obj_desc->region.address, ++ obj_desc->region.length, node); ++ + /* Now the address and length are valid for this opregion */ + + obj_desc->region.flags |= AOPOBJ_DATA_VALID; +diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c +index f2b6f4da1034..fdabd0b74492 100644 +--- a/drivers/block/floppy.c ++++ b/drivers/block/floppy.c +@@ -4151,10 +4151,11 @@ static int __floppy_read_block_0(struct block_device *bdev, int drive) + bio.bi_end_io = floppy_rb0_cb; + bio_set_op_attrs(&bio, REQ_OP_READ, 0); + ++ init_completion(&cbdata.complete); ++ + submit_bio(&bio); + process_fd_request(); + +- init_completion(&cbdata.complete); + wait_for_completion(&cbdata.complete); + + __free_page(page); +diff --git a/drivers/cpufreq/imx6q-cpufreq.c b/drivers/cpufreq/imx6q-cpufreq.c +index b2ff423ad7f8..f4880a4f865b 100644 +--- a/drivers/cpufreq/imx6q-cpufreq.c ++++ b/drivers/cpufreq/imx6q-cpufreq.c +@@ -159,8 +159,13 @@ static int imx6q_set_target(struct cpufreq_policy *policy, unsigned int index) + /* Ensure the arm clock divider is what we expect */ + ret = clk_set_rate(clks[ARM].clk, new_freq * 1000); + if (ret) { ++ int ret1; ++ + dev_err(cpu_dev, "failed to set clock rate: %d\n", ret); +- regulator_set_voltage_tol(arm_reg, volt_old, 0); ++ ret1 = regulator_set_voltage_tol(arm_reg, volt_old, 0); ++ if (ret1) ++ dev_warn(cpu_dev, ++ "failed to restore vddarm voltage: %d\n", ret1); + return ret; + } + +diff --git a/drivers/firmware/efi/arm-init.c b/drivers/firmware/efi/arm-init.c +index 388a929baf95..1a6a77df8a5e 100644 +--- a/drivers/firmware/efi/arm-init.c ++++ b/drivers/firmware/efi/arm-init.c +@@ -265,6 +265,10 @@ void __init efi_init(void) + (params.mmap & ~PAGE_MASK))); + + init_screen_info(); ++ ++ /* ARM does not permit early mappings to persist across paging_init() */ ++ if (IS_ENABLED(CONFIG_ARM)) ++ efi_memmap_unmap(); + } + + static int __init register_gop_device(void) +diff --git a/drivers/firmware/efi/arm-runtime.c b/drivers/firmware/efi/arm-runtime.c +index 922cfb813109..a00934d263c5 100644 +--- a/drivers/firmware/efi/arm-runtime.c ++++ b/drivers/firmware/efi/arm-runtime.c +@@ -110,7 +110,7 @@ static int __init arm_enable_runtime_services(void) + { + u64 mapsize; + +- if (!efi_enabled(EFI_BOOT) || !efi_enabled(EFI_MEMMAP)) { ++ if (!efi_enabled(EFI_BOOT)) { + pr_info("EFI services will not be available.\n"); + return 0; + } +diff --git a/drivers/firmware/efi/libstub/Makefile b/drivers/firmware/efi/libstub/Makefile +index 14c40a7750d1..c51627660dbb 100644 +--- a/drivers/firmware/efi/libstub/Makefile ++++ b/drivers/firmware/efi/libstub/Makefile +@@ -16,7 +16,8 @@ cflags-$(CONFIG_X86) += -m$(BITS) -D__KERNEL__ -O2 \ + cflags-$(CONFIG_ARM64) := $(subst -pg,,$(KBUILD_CFLAGS)) -fpie \ + $(DISABLE_STACKLEAK_PLUGIN) + cflags-$(CONFIG_ARM) := $(subst -pg,,$(KBUILD_CFLAGS)) \ +- -fno-builtin -fpic -mno-single-pic-base ++ -fno-builtin -fpic \ ++ $(call cc-option,-mno-single-pic-base) + + cflags-$(CONFIG_EFI_ARMSTUB) += -I$(srctree)/scripts/dtc/libfdt + +diff --git a/drivers/firmware/efi/memmap.c b/drivers/firmware/efi/memmap.c +index 5fc70520e04c..1907db2b38d8 100644 +--- a/drivers/firmware/efi/memmap.c ++++ b/drivers/firmware/efi/memmap.c +@@ -118,6 +118,9 @@ int __init efi_memmap_init_early(struct efi_memory_map_data *data) + + void __init efi_memmap_unmap(void) + { ++ if (!efi_enabled(EFI_MEMMAP)) ++ return; ++ + if (!efi.memmap.late) { + unsigned long size; + +diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c +index 25187403e3ac..a8e01d99919c 100644 +--- a/drivers/gpio/gpiolib.c ++++ b/drivers/gpio/gpiolib.c +@@ -1285,7 +1285,7 @@ int gpiochip_add_data_with_key(struct gpio_chip *chip, void *data, + gdev->descs = kcalloc(chip->ngpio, sizeof(gdev->descs[0]), GFP_KERNEL); + if (!gdev->descs) { + status = -ENOMEM; +- goto err_free_gdev; ++ goto err_free_ida; + } + + if (chip->ngpio == 0) { +@@ -1413,8 +1413,9 @@ err_free_label: + kfree_const(gdev->label); + err_free_descs: + kfree(gdev->descs); +-err_free_gdev: ++err_free_ida: + ida_simple_remove(&gpio_ida, gdev->id); ++err_free_gdev: + /* failures here can mean systems won't boot... */ + pr_err("%s: GPIOs %d..%d (%s) failed to register, %d\n", __func__, + gdev->base, gdev->base + gdev->ngpio - 1, +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c +index 0c791e35acf0..79bd8bd97fae 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c +@@ -496,8 +496,11 @@ void amdgpu_amdkfd_set_compute_idle(struct kgd_dev *kgd, bool idle) + { + struct amdgpu_device *adev = (struct amdgpu_device *)kgd; + +- amdgpu_dpm_switch_power_profile(adev, +- PP_SMC_POWER_PROFILE_COMPUTE, !idle); ++ if (adev->powerplay.pp_funcs && ++ adev->powerplay.pp_funcs->switch_power_profile) ++ amdgpu_dpm_switch_power_profile(adev, ++ PP_SMC_POWER_PROFILE_COMPUTE, ++ !idle); + } + + bool amdgpu_amdkfd_is_kfd_vmid(struct amdgpu_device *adev, u32 vmid) +diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c +index ad151fefa41f..db406a35808f 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c +@@ -45,6 +45,7 @@ MODULE_FIRMWARE("amdgpu/tahiti_mc.bin"); + MODULE_FIRMWARE("amdgpu/pitcairn_mc.bin"); + MODULE_FIRMWARE("amdgpu/verde_mc.bin"); + MODULE_FIRMWARE("amdgpu/oland_mc.bin"); ++MODULE_FIRMWARE("amdgpu/hainan_mc.bin"); + MODULE_FIRMWARE("amdgpu/si58_mc.bin"); + + #define MC_SEQ_MISC0__MT__MASK 0xf0000000 +diff --git a/drivers/gpu/drm/amd/amdgpu/vega10_ih.c b/drivers/gpu/drm/amd/amdgpu/vega10_ih.c +index 5ae5ed2e62d6..21bc12e02311 100644 +--- a/drivers/gpu/drm/amd/amdgpu/vega10_ih.c ++++ b/drivers/gpu/drm/amd/amdgpu/vega10_ih.c +@@ -129,7 +129,7 @@ static int vega10_ih_irq_init(struct amdgpu_device *adev) + else + wptr_off = adev->wb.gpu_addr + (adev->irq.ih.wptr_offs * 4); + WREG32_SOC15(OSSSYS, 0, mmIH_RB_WPTR_ADDR_LO, lower_32_bits(wptr_off)); +- WREG32_SOC15(OSSSYS, 0, mmIH_RB_WPTR_ADDR_HI, upper_32_bits(wptr_off) & 0xFF); ++ WREG32_SOC15(OSSSYS, 0, mmIH_RB_WPTR_ADDR_HI, upper_32_bits(wptr_off) & 0xFFFF); + + /* set rptr, wptr to 0 */ + WREG32_SOC15(OSSSYS, 0, mmIH_RB_RPTR, 0); +diff --git a/drivers/gpu/drm/ast/ast_drv.c b/drivers/gpu/drm/ast/ast_drv.c +index 69dab82a3771..bf589c53b908 100644 +--- a/drivers/gpu/drm/ast/ast_drv.c ++++ b/drivers/gpu/drm/ast/ast_drv.c +@@ -60,8 +60,29 @@ static const struct pci_device_id pciidlist[] = { + + MODULE_DEVICE_TABLE(pci, pciidlist); + ++static void ast_kick_out_firmware_fb(struct pci_dev *pdev) ++{ ++ struct apertures_struct *ap; ++ bool primary = false; ++ ++ ap = alloc_apertures(1); ++ if (!ap) ++ return; ++ ++ ap->ranges[0].base = pci_resource_start(pdev, 0); ++ ap->ranges[0].size = pci_resource_len(pdev, 0); ++ ++#ifdef CONFIG_X86 ++ primary = pdev->resource[PCI_ROM_RESOURCE].flags & IORESOURCE_ROM_SHADOW; ++#endif ++ drm_fb_helper_remove_conflicting_framebuffers(ap, "astdrmfb", primary); ++ kfree(ap); ++} ++ + static int ast_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + { ++ ast_kick_out_firmware_fb(pdev); ++ + return drm_get_pci_dev(pdev, ent, &driver); + } + +diff --git a/drivers/gpu/drm/ast/ast_mode.c b/drivers/gpu/drm/ast/ast_mode.c +index 5e77d456d9bb..7c6ac3cadb6b 100644 +--- a/drivers/gpu/drm/ast/ast_mode.c ++++ b/drivers/gpu/drm/ast/ast_mode.c +@@ -568,6 +568,7 @@ static int ast_crtc_do_set_base(struct drm_crtc *crtc, + } + ast_bo_unreserve(bo); + ++ ast_set_offset_reg(crtc); + ast_set_start_address_crt1(crtc, (u32)gpu_addr); + + return 0; +@@ -1254,7 +1255,7 @@ static int ast_cursor_move(struct drm_crtc *crtc, + ast_set_index_reg(ast, AST_IO_CRTC_PORT, 0xc7, ((y >> 8) & 0x07)); + + /* dummy write to fire HWC */ +- ast_set_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xCB, 0xFF, 0x00); ++ ast_show_cursor(crtc); + + return 0; + } +diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c +index 9628dd617826..9214c8b02484 100644 +--- a/drivers/gpu/drm/drm_fb_helper.c ++++ b/drivers/gpu/drm/drm_fb_helper.c +@@ -200,6 +200,9 @@ int drm_fb_helper_single_add_all_connectors(struct drm_fb_helper *fb_helper) + mutex_lock(&fb_helper->lock); + drm_connector_list_iter_begin(dev, &conn_iter); + drm_for_each_connector_iter(connector, &conn_iter) { ++ if (connector->connector_type == DRM_MODE_CONNECTOR_WRITEBACK) ++ continue; ++ + ret = __drm_fb_helper_add_one_connector(fb_helper, connector); + if (ret) + goto fail; +diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c +index 43ae9de12ba3..c3a64d6a18df 100644 +--- a/drivers/gpu/drm/i915/intel_pm.c ++++ b/drivers/gpu/drm/i915/intel_pm.c +@@ -2492,6 +2492,9 @@ static uint32_t ilk_compute_pri_wm(const struct intel_crtc_state *cstate, + uint32_t method1, method2; + int cpp; + ++ if (mem_value == 0) ++ return U32_MAX; ++ + if (!intel_wm_plane_visible(cstate, pstate)) + return 0; + +@@ -2521,6 +2524,9 @@ static uint32_t ilk_compute_spr_wm(const struct intel_crtc_state *cstate, + uint32_t method1, method2; + int cpp; + ++ if (mem_value == 0) ++ return U32_MAX; ++ + if (!intel_wm_plane_visible(cstate, pstate)) + return 0; + +@@ -2544,6 +2550,9 @@ static uint32_t ilk_compute_cur_wm(const struct intel_crtc_state *cstate, + { + int cpp; + ++ if (mem_value == 0) ++ return U32_MAX; ++ + if (!intel_wm_plane_visible(cstate, pstate)) + return 0; + +@@ -2998,6 +3007,34 @@ static void snb_wm_latency_quirk(struct drm_i915_private *dev_priv) + intel_print_wm_latency(dev_priv, "Cursor", dev_priv->wm.cur_latency); + } + ++static void snb_wm_lp3_irq_quirk(struct drm_i915_private *dev_priv) ++{ ++ /* ++ * On some SNB machines (Thinkpad X220 Tablet at least) ++ * LP3 usage can cause vblank interrupts to be lost. ++ * The DEIIR bit will go high but it looks like the CPU ++ * never gets interrupted. ++ * ++ * It's not clear whether other interrupt source could ++ * be affected or if this is somehow limited to vblank ++ * interrupts only. To play it safe we disable LP3 ++ * watermarks entirely. ++ */ ++ if (dev_priv->wm.pri_latency[3] == 0 && ++ dev_priv->wm.spr_latency[3] == 0 && ++ dev_priv->wm.cur_latency[3] == 0) ++ return; ++ ++ dev_priv->wm.pri_latency[3] = 0; ++ dev_priv->wm.spr_latency[3] = 0; ++ dev_priv->wm.cur_latency[3] = 0; ++ ++ DRM_DEBUG_KMS("LP3 watermarks disabled due to potential for lost interrupts\n"); ++ intel_print_wm_latency(dev_priv, "Primary", dev_priv->wm.pri_latency); ++ intel_print_wm_latency(dev_priv, "Sprite", dev_priv->wm.spr_latency); ++ intel_print_wm_latency(dev_priv, "Cursor", dev_priv->wm.cur_latency); ++} ++ + static void ilk_setup_wm_latency(struct drm_i915_private *dev_priv) + { + intel_read_wm_latency(dev_priv, dev_priv->wm.pri_latency); +@@ -3014,8 +3051,10 @@ static void ilk_setup_wm_latency(struct drm_i915_private *dev_priv) + intel_print_wm_latency(dev_priv, "Sprite", dev_priv->wm.spr_latency); + intel_print_wm_latency(dev_priv, "Cursor", dev_priv->wm.cur_latency); + +- if (IS_GEN6(dev_priv)) ++ if (IS_GEN6(dev_priv)) { + snb_wm_latency_quirk(dev_priv); ++ snb_wm_lp3_irq_quirk(dev_priv); ++ } + } + + static void skl_setup_wm_latency(struct drm_i915_private *dev_priv) +diff --git a/drivers/gpu/drm/vc4/vc4_kms.c b/drivers/gpu/drm/vc4/vc4_kms.c +index ca5aa7fba769..f4d8a730e821 100644 +--- a/drivers/gpu/drm/vc4/vc4_kms.c ++++ b/drivers/gpu/drm/vc4/vc4_kms.c +@@ -216,6 +216,12 @@ static int vc4_atomic_commit(struct drm_device *dev, + return 0; + } + ++ /* We know for sure we don't want an async update here. Set ++ * state->legacy_cursor_update to false to prevent ++ * drm_atomic_helper_setup_commit() from auto-completing ++ * commit->flip_done. ++ */ ++ state->legacy_cursor_update = false; + ret = drm_atomic_helper_setup_commit(state, nonblock); + if (ret) + return ret; +diff --git a/drivers/hid/hid-steam.c b/drivers/hid/hid-steam.c +index 0422ec2b13d2..dc4128bfe2ca 100644 +--- a/drivers/hid/hid-steam.c ++++ b/drivers/hid/hid-steam.c +@@ -23,8 +23,9 @@ + * In order to avoid breaking them this driver creates a layered hidraw device, + * so it can detect when the client is running and then: + * - it will not send any command to the controller. +- * - this input device will be disabled, to avoid double input of the same ++ * - this input device will be removed, to avoid double input of the same + * user action. ++ * When the client is closed, this input device will be created again. + * + * For additional functions, such as changing the right-pad margin or switching + * the led, you can use the user-space tool at: +@@ -113,7 +114,7 @@ struct steam_device { + spinlock_t lock; + struct hid_device *hdev, *client_hdev; + struct mutex mutex; +- bool client_opened, input_opened; ++ bool client_opened; + struct input_dev __rcu *input; + unsigned long quirks; + struct work_struct work_connect; +@@ -279,18 +280,6 @@ static void steam_set_lizard_mode(struct steam_device *steam, bool enable) + } + } + +-static void steam_update_lizard_mode(struct steam_device *steam) +-{ +- mutex_lock(&steam->mutex); +- if (!steam->client_opened) { +- if (steam->input_opened) +- steam_set_lizard_mode(steam, false); +- else +- steam_set_lizard_mode(steam, lizard_mode); +- } +- mutex_unlock(&steam->mutex); +-} +- + static int steam_input_open(struct input_dev *dev) + { + struct steam_device *steam = input_get_drvdata(dev); +@@ -301,7 +290,6 @@ static int steam_input_open(struct input_dev *dev) + return ret; + + mutex_lock(&steam->mutex); +- steam->input_opened = true; + if (!steam->client_opened && lizard_mode) + steam_set_lizard_mode(steam, false); + mutex_unlock(&steam->mutex); +@@ -313,7 +301,6 @@ static void steam_input_close(struct input_dev *dev) + struct steam_device *steam = input_get_drvdata(dev); + + mutex_lock(&steam->mutex); +- steam->input_opened = false; + if (!steam->client_opened && lizard_mode) + steam_set_lizard_mode(steam, true); + mutex_unlock(&steam->mutex); +@@ -400,7 +387,7 @@ static int steam_battery_register(struct steam_device *steam) + return 0; + } + +-static int steam_register(struct steam_device *steam) ++static int steam_input_register(struct steam_device *steam) + { + struct hid_device *hdev = steam->hdev; + struct input_dev *input; +@@ -414,17 +401,6 @@ static int steam_register(struct steam_device *steam) + return 0; + } + +- /* +- * Unlikely, but getting the serial could fail, and it is not so +- * important, so make up a serial number and go on. +- */ +- if (steam_get_serial(steam) < 0) +- strlcpy(steam->serial_no, "XXXXXXXXXX", +- sizeof(steam->serial_no)); +- +- hid_info(hdev, "Steam Controller '%s' connected", +- steam->serial_no); +- + input = input_allocate_device(); + if (!input) + return -ENOMEM; +@@ -492,11 +468,6 @@ static int steam_register(struct steam_device *steam) + goto input_register_fail; + + rcu_assign_pointer(steam->input, input); +- +- /* ignore battery errors, we can live without it */ +- if (steam->quirks & STEAM_QUIRK_WIRELESS) +- steam_battery_register(steam); +- + return 0; + + input_register_fail: +@@ -504,27 +475,88 @@ input_register_fail: + return ret; + } + +-static void steam_unregister(struct steam_device *steam) ++static void steam_input_unregister(struct steam_device *steam) + { + struct input_dev *input; ++ rcu_read_lock(); ++ input = rcu_dereference(steam->input); ++ rcu_read_unlock(); ++ if (!input) ++ return; ++ RCU_INIT_POINTER(steam->input, NULL); ++ synchronize_rcu(); ++ input_unregister_device(input); ++} ++ ++static void steam_battery_unregister(struct steam_device *steam) ++{ + struct power_supply *battery; + + rcu_read_lock(); +- input = rcu_dereference(steam->input); + battery = rcu_dereference(steam->battery); + rcu_read_unlock(); + +- if (battery) { +- RCU_INIT_POINTER(steam->battery, NULL); +- synchronize_rcu(); +- power_supply_unregister(battery); ++ if (!battery) ++ return; ++ RCU_INIT_POINTER(steam->battery, NULL); ++ synchronize_rcu(); ++ power_supply_unregister(battery); ++} ++ ++static int steam_register(struct steam_device *steam) ++{ ++ int ret; ++ ++ /* ++ * This function can be called several times in a row with the ++ * wireless adaptor, without steam_unregister() between them, because ++ * another client send a get_connection_status command, for example. ++ * The battery and serial number are set just once per device. ++ */ ++ if (!steam->serial_no[0]) { ++ /* ++ * Unlikely, but getting the serial could fail, and it is not so ++ * important, so make up a serial number and go on. ++ */ ++ if (steam_get_serial(steam) < 0) ++ strlcpy(steam->serial_no, "XXXXXXXXXX", ++ sizeof(steam->serial_no)); ++ ++ hid_info(steam->hdev, "Steam Controller '%s' connected", ++ steam->serial_no); ++ ++ /* ignore battery errors, we can live without it */ ++ if (steam->quirks & STEAM_QUIRK_WIRELESS) ++ steam_battery_register(steam); ++ ++ mutex_lock(&steam_devices_lock); ++ list_add(&steam->list, &steam_devices); ++ mutex_unlock(&steam_devices_lock); + } +- if (input) { +- RCU_INIT_POINTER(steam->input, NULL); +- synchronize_rcu(); ++ ++ mutex_lock(&steam->mutex); ++ if (!steam->client_opened) { ++ steam_set_lizard_mode(steam, lizard_mode); ++ ret = steam_input_register(steam); ++ } else { ++ ret = 0; ++ } ++ mutex_unlock(&steam->mutex); ++ ++ return ret; ++} ++ ++static void steam_unregister(struct steam_device *steam) ++{ ++ steam_battery_unregister(steam); ++ steam_input_unregister(steam); ++ if (steam->serial_no[0]) { + hid_info(steam->hdev, "Steam Controller '%s' disconnected", + steam->serial_no); +- input_unregister_device(input); ++ mutex_lock(&steam_devices_lock); ++ list_del(&steam->list); ++ mutex_unlock(&steam_devices_lock); ++ steam->serial_no[0] = 0; + } + } + +@@ -600,6 +632,9 @@ static int steam_client_ll_open(struct hid_device *hdev) + mutex_lock(&steam->mutex); + steam->client_opened = true; + mutex_unlock(&steam->mutex); ++ ++ steam_input_unregister(steam); ++ + return ret; + } + +@@ -609,13 +644,13 @@ static void steam_client_ll_close(struct hid_device *hdev) + + mutex_lock(&steam->mutex); + steam->client_opened = false; +- if (steam->input_opened) +- steam_set_lizard_mode(steam, false); +- else +- steam_set_lizard_mode(steam, lizard_mode); + mutex_unlock(&steam->mutex); + + hid_hw_close(steam->hdev); ++ if (steam->connected) { ++ steam_set_lizard_mode(steam, lizard_mode); ++ steam_input_register(steam); ++ } + } + + static int steam_client_ll_raw_request(struct hid_device *hdev, +@@ -744,11 +779,6 @@ static int steam_probe(struct hid_device *hdev, + } + } + +- mutex_lock(&steam_devices_lock); +- steam_update_lizard_mode(steam); +- list_add(&steam->list, &steam_devices); +- mutex_unlock(&steam_devices_lock); +- + return 0; + + hid_hw_open_fail: +@@ -774,10 +804,6 @@ static void steam_remove(struct hid_device *hdev) + return; + } + +- mutex_lock(&steam_devices_lock); +- list_del(&steam->list); +- mutex_unlock(&steam_devices_lock); +- + hid_destroy_device(steam->client_hdev); + steam->client_opened = false; + cancel_work_sync(&steam->work_connect); +@@ -792,12 +818,14 @@ static void steam_remove(struct hid_device *hdev) + static void steam_do_connect_event(struct steam_device *steam, bool connected) + { + unsigned long flags; ++ bool changed; + + spin_lock_irqsave(&steam->lock, flags); ++ changed = steam->connected != connected; + steam->connected = connected; + spin_unlock_irqrestore(&steam->lock, flags); + +- if (schedule_work(&steam->work_connect) == 0) ++ if (changed && schedule_work(&steam->work_connect) == 0) + dbg_hid("%s: connected=%d event already queued\n", + __func__, connected); + } +@@ -1019,13 +1047,8 @@ static int steam_raw_event(struct hid_device *hdev, + return 0; + rcu_read_lock(); + input = rcu_dereference(steam->input); +- if (likely(input)) { ++ if (likely(input)) + steam_do_input_event(steam, input, data); +- } else { +- dbg_hid("%s: input data without connect event\n", +- __func__); +- steam_do_connect_event(steam, true); +- } + rcu_read_unlock(); + break; + case STEAM_EV_CONNECT: +@@ -1074,7 +1097,10 @@ static int steam_param_set_lizard_mode(const char *val, + + mutex_lock(&steam_devices_lock); + list_for_each_entry(steam, &steam_devices, list) { +- steam_update_lizard_mode(steam); ++ mutex_lock(&steam->mutex); ++ if (!steam->client_opened) ++ steam_set_lizard_mode(steam, lizard_mode); ++ mutex_unlock(&steam->mutex); + } + mutex_unlock(&steam_devices_lock); + return 0; +diff --git a/drivers/infiniband/hw/hfi1/user_sdma.c b/drivers/infiniband/hw/hfi1/user_sdma.c +index 5c88706121c1..39134dd305f5 100644 +--- a/drivers/infiniband/hw/hfi1/user_sdma.c ++++ b/drivers/infiniband/hw/hfi1/user_sdma.c +@@ -328,7 +328,6 @@ int hfi1_user_sdma_process_request(struct hfi1_filedata *fd, + u8 opcode, sc, vl; + u16 pkey; + u32 slid; +- int req_queued = 0; + u16 dlid; + u32 selector; + +@@ -392,7 +391,6 @@ int hfi1_user_sdma_process_request(struct hfi1_filedata *fd, + req->data_len = 0; + req->pq = pq; + req->cq = cq; +- req->status = -1; + req->ahg_idx = -1; + req->iov_idx = 0; + req->sent = 0; +@@ -400,12 +398,14 @@ int hfi1_user_sdma_process_request(struct hfi1_filedata *fd, + req->seqcomp = 0; + req->seqsubmitted = 0; + req->tids = NULL; +- req->done = 0; + req->has_error = 0; + INIT_LIST_HEAD(&req->txps); + + memcpy(&req->info, &info, sizeof(info)); + ++ /* The request is initialized, count it */ ++ atomic_inc(&pq->n_reqs); ++ + if (req_opcode(info.ctrl) == EXPECTED) { + /* expected must have a TID info and at least one data vector */ + if (req->data_iovs < 2) { +@@ -500,7 +500,6 @@ int hfi1_user_sdma_process_request(struct hfi1_filedata *fd, + ret = pin_vector_pages(req, &req->iovs[i]); + if (ret) { + req->data_iovs = i; +- req->status = ret; + goto free_req; + } + req->data_len += req->iovs[i].iov.iov_len; +@@ -561,14 +560,10 @@ int hfi1_user_sdma_process_request(struct hfi1_filedata *fd, + req->ahg_idx = sdma_ahg_alloc(req->sde); + + set_comp_state(pq, cq, info.comp_idx, QUEUED, 0); +- atomic_inc(&pq->n_reqs); +- req_queued = 1; + /* Send the first N packets in the request to buy us some time */ + ret = user_sdma_send_pkts(req, pcount); +- if (unlikely(ret < 0 && ret != -EBUSY)) { +- req->status = ret; ++ if (unlikely(ret < 0 && ret != -EBUSY)) + goto free_req; +- } + + /* + * It is possible that the SDMA engine would have processed all the +@@ -588,14 +583,8 @@ int hfi1_user_sdma_process_request(struct hfi1_filedata *fd, + while (req->seqsubmitted != req->info.npkts) { + ret = user_sdma_send_pkts(req, pcount); + if (ret < 0) { +- if (ret != -EBUSY) { +- req->status = ret; +- WRITE_ONCE(req->has_error, 1); +- if (READ_ONCE(req->seqcomp) == +- req->seqsubmitted - 1) +- goto free_req; +- return ret; +- } ++ if (ret != -EBUSY) ++ goto free_req; + wait_event_interruptible_timeout( + pq->busy.wait_dma, + (pq->state == SDMA_PKT_Q_ACTIVE), +@@ -606,10 +595,19 @@ int hfi1_user_sdma_process_request(struct hfi1_filedata *fd, + *count += idx; + return 0; + free_req: +- user_sdma_free_request(req, true); +- if (req_queued) ++ /* ++ * If the submitted seqsubmitted == npkts, the completion routine ++ * controls the final state. If sequbmitted < npkts, wait for any ++ * outstanding packets to finish before cleaning up. ++ */ ++ if (req->seqsubmitted < req->info.npkts) { ++ if (req->seqsubmitted) ++ wait_event(pq->busy.wait_dma, ++ (req->seqcomp == req->seqsubmitted - 1)); ++ user_sdma_free_request(req, true); + pq_update(pq); +- set_comp_state(pq, cq, info.comp_idx, ERROR, req->status); ++ set_comp_state(pq, cq, info.comp_idx, ERROR, ret); ++ } + return ret; + } + +@@ -917,7 +915,6 @@ dosend: + ret = sdma_send_txlist(req->sde, &pq->busy, &req->txps, &count); + req->seqsubmitted += count; + if (req->seqsubmitted == req->info.npkts) { +- WRITE_ONCE(req->done, 1); + /* + * The txreq has already been submitted to the HW queue + * so we can free the AHG entry now. Corruption will not +@@ -1365,11 +1362,15 @@ static int set_txreq_header_ahg(struct user_sdma_request *req, + return idx; + } + +-/* +- * SDMA tx request completion callback. Called when the SDMA progress +- * state machine gets notification that the SDMA descriptors for this +- * tx request have been processed by the DMA engine. Called in +- * interrupt context. ++/** ++ * user_sdma_txreq_cb() - SDMA tx request completion callback. ++ * @txreq: valid sdma tx request ++ * @status: success/failure of request ++ * ++ * Called when the SDMA progress state machine gets notification that ++ * the SDMA descriptors for this tx request have been processed by the ++ * DMA engine. Called in interrupt context. ++ * Only do work on completed sequences. + */ + static void user_sdma_txreq_cb(struct sdma_txreq *txreq, int status) + { +@@ -1378,7 +1379,7 @@ static void user_sdma_txreq_cb(struct sdma_txreq *txreq, int status) + struct user_sdma_request *req; + struct hfi1_user_sdma_pkt_q *pq; + struct hfi1_user_sdma_comp_q *cq; +- u16 idx; ++ enum hfi1_sdma_comp_state state = COMPLETE; + + if (!tx->req) + return; +@@ -1391,31 +1392,19 @@ static void user_sdma_txreq_cb(struct sdma_txreq *txreq, int status) + SDMA_DBG(req, "SDMA completion with error %d", + status); + WRITE_ONCE(req->has_error, 1); ++ state = ERROR; + } + + req->seqcomp = tx->seqnum; + kmem_cache_free(pq->txreq_cache, tx); +- tx = NULL; +- +- idx = req->info.comp_idx; +- if (req->status == -1 && status == SDMA_TXREQ_S_OK) { +- if (req->seqcomp == req->info.npkts - 1) { +- req->status = 0; +- user_sdma_free_request(req, false); +- pq_update(pq); +- set_comp_state(pq, cq, idx, COMPLETE, 0); +- } +- } else { +- if (status != SDMA_TXREQ_S_OK) +- req->status = status; +- if (req->seqcomp == (READ_ONCE(req->seqsubmitted) - 1) && +- (READ_ONCE(req->done) || +- READ_ONCE(req->has_error))) { +- user_sdma_free_request(req, false); +- pq_update(pq); +- set_comp_state(pq, cq, idx, ERROR, req->status); +- } +- } ++ ++ /* sequence isn't complete? We are done */ ++ if (req->seqcomp != req->info.npkts - 1) ++ return; ++ ++ user_sdma_free_request(req, false); ++ set_comp_state(pq, cq, req->info.comp_idx, state, status); ++ pq_update(pq); + } + + static inline void pq_update(struct hfi1_user_sdma_pkt_q *pq) +@@ -1448,6 +1437,8 @@ static void user_sdma_free_request(struct user_sdma_request *req, bool unpin) + if (!node) + continue; + ++ req->iovs[i].node = NULL; ++ + if (unpin) + hfi1_mmu_rb_remove(req->pq->handler, + &node->rb); +diff --git a/drivers/infiniband/hw/hfi1/user_sdma.h b/drivers/infiniband/hw/hfi1/user_sdma.h +index d2bc77f75253..0ae06456c868 100644 +--- a/drivers/infiniband/hw/hfi1/user_sdma.h ++++ b/drivers/infiniband/hw/hfi1/user_sdma.h +@@ -205,8 +205,6 @@ struct user_sdma_request { + /* Writeable fields shared with interrupt */ + u64 seqcomp ____cacheline_aligned_in_smp; + u64 seqsubmitted; +- /* status of the last txreq completed */ +- int status; + + /* Send side fields */ + struct list_head txps ____cacheline_aligned_in_smp; +@@ -228,7 +226,6 @@ struct user_sdma_request { + u16 tididx; + /* progress index moving along the iovs array */ + u8 iov_idx; +- u8 done; + u8 has_error; + + struct user_sdma_iovec iovs[MAX_VECTORS_PER_REQ]; +diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c +index 55d33500d55e..5e85f3cca867 100644 +--- a/drivers/input/mouse/synaptics.c ++++ b/drivers/input/mouse/synaptics.c +@@ -99,9 +99,7 @@ static int synaptics_mode_cmd(struct psmouse *psmouse, u8 mode) + int synaptics_detect(struct psmouse *psmouse, bool set_properties) + { + struct ps2dev *ps2dev = &psmouse->ps2dev; +- u8 param[4]; +- +- param[0] = 0; ++ u8 param[4] = { 0 }; + + ps2_command(ps2dev, param, PSMOUSE_CMD_SETRES); + ps2_command(ps2dev, param, PSMOUSE_CMD_SETRES); +diff --git a/drivers/media/i2c/ov5640.c b/drivers/media/i2c/ov5640.c +index 7b662bd1c7a0..30b15e91d8be 100644 +--- a/drivers/media/i2c/ov5640.c ++++ b/drivers/media/i2c/ov5640.c +@@ -288,10 +288,10 @@ static const struct reg_value ov5640_init_setting_30fps_VGA[] = { + {0x3a0d, 0x04, 0, 0}, {0x3a14, 0x03, 0, 0}, {0x3a15, 0xd8, 0, 0}, + {0x4001, 0x02, 0, 0}, {0x4004, 0x02, 0, 0}, {0x3000, 0x00, 0, 0}, + {0x3002, 0x1c, 0, 0}, {0x3004, 0xff, 0, 0}, {0x3006, 0xc3, 0, 0}, +- {0x300e, 0x45, 0, 0}, {0x302e, 0x08, 0, 0}, {0x4300, 0x3f, 0, 0}, ++ {0x302e, 0x08, 0, 0}, {0x4300, 0x3f, 0, 0}, + {0x501f, 0x00, 0, 0}, {0x4713, 0x03, 0, 0}, {0x4407, 0x04, 0, 0}, + {0x440e, 0x00, 0, 0}, {0x460b, 0x35, 0, 0}, {0x460c, 0x22, 0, 0}, +- {0x4837, 0x0a, 0, 0}, {0x4800, 0x04, 0, 0}, {0x3824, 0x02, 0, 0}, ++ {0x4837, 0x0a, 0, 0}, {0x3824, 0x02, 0, 0}, + {0x5000, 0xa7, 0, 0}, {0x5001, 0xa3, 0, 0}, {0x5180, 0xff, 0, 0}, + {0x5181, 0xf2, 0, 0}, {0x5182, 0x00, 0, 0}, {0x5183, 0x14, 0, 0}, + {0x5184, 0x25, 0, 0}, {0x5185, 0x24, 0, 0}, {0x5186, 0x09, 0, 0}, +@@ -910,6 +910,26 @@ static int ov5640_mod_reg(struct ov5640_dev *sensor, u16 reg, + } + + /* download ov5640 settings to sensor through i2c */ ++static int ov5640_set_timings(struct ov5640_dev *sensor, ++ const struct ov5640_mode_info *mode) ++{ ++ int ret; ++ ++ ret = ov5640_write_reg16(sensor, OV5640_REG_TIMING_DVPHO, mode->hact); ++ if (ret < 0) ++ return ret; ++ ++ ret = ov5640_write_reg16(sensor, OV5640_REG_TIMING_DVPVO, mode->vact); ++ if (ret < 0) ++ return ret; ++ ++ ret = ov5640_write_reg16(sensor, OV5640_REG_TIMING_HTS, mode->htot); ++ if (ret < 0) ++ return ret; ++ ++ return ov5640_write_reg16(sensor, OV5640_REG_TIMING_VTS, mode->vtot); ++} ++ + static int ov5640_load_regs(struct ov5640_dev *sensor, + const struct ov5640_mode_info *mode) + { +@@ -937,7 +957,13 @@ static int ov5640_load_regs(struct ov5640_dev *sensor, + usleep_range(1000 * delay_ms, 1000 * delay_ms + 100); + } + +- return ret; ++ return ov5640_set_timings(sensor, mode); ++} ++ ++static int ov5640_set_autoexposure(struct ov5640_dev *sensor, bool on) ++{ ++ return ov5640_mod_reg(sensor, OV5640_REG_AEC_PK_MANUAL, ++ BIT(0), on ? 0 : BIT(0)); + } + + /* read exposure, in number of line periods */ +@@ -996,6 +1022,18 @@ static int ov5640_get_gain(struct ov5640_dev *sensor) + return gain & 0x3ff; + } + ++static int ov5640_set_gain(struct ov5640_dev *sensor, int gain) ++{ ++ return ov5640_write_reg16(sensor, OV5640_REG_AEC_PK_REAL_GAIN, ++ (u16)gain & 0x3ff); ++} ++ ++static int ov5640_set_autogain(struct ov5640_dev *sensor, bool on) ++{ ++ return ov5640_mod_reg(sensor, OV5640_REG_AEC_PK_MANUAL, ++ BIT(1), on ? 0 : BIT(1)); ++} ++ + static int ov5640_set_stream_dvp(struct ov5640_dev *sensor, bool on) + { + int ret; +@@ -1104,12 +1142,25 @@ static int ov5640_set_stream_mipi(struct ov5640_dev *sensor, bool on) + { + int ret; + +- ret = ov5640_mod_reg(sensor, OV5640_REG_MIPI_CTRL00, BIT(5), +- on ? 0 : BIT(5)); +- if (ret) +- return ret; +- ret = ov5640_write_reg(sensor, OV5640_REG_PAD_OUTPUT00, +- on ? 0x00 : 0x70); ++ /* ++ * Enable/disable the MIPI interface ++ * ++ * 0x300e = on ? 0x45 : 0x40 ++ * ++ * FIXME: the sensor manual (version 2.03) reports ++ * [7:5] = 000 : 1 data lane mode ++ * [7:5] = 001 : 2 data lanes mode ++ * But this settings do not work, while the following ones ++ * have been validated for 2 data lanes mode. ++ * ++ * [7:5] = 010 : 2 data lanes mode ++ * [4] = 0 : Power up MIPI HS Tx ++ * [3] = 0 : Power up MIPI LS Rx ++ * [2] = 1/0 : MIPI interface enable/disable ++ * [1:0] = 01/00: FIXME: 'debug' ++ */ ++ ret = ov5640_write_reg(sensor, OV5640_REG_IO_MIPI_CTRL00, ++ on ? 0x45 : 0x40); + if (ret) + return ret; + +@@ -1333,7 +1384,7 @@ static int ov5640_set_ae_target(struct ov5640_dev *sensor, int target) + return ov5640_write_reg(sensor, OV5640_REG_AEC_CTRL1F, fast_low); + } + +-static int ov5640_binning_on(struct ov5640_dev *sensor) ++static int ov5640_get_binning(struct ov5640_dev *sensor) + { + u8 temp; + int ret; +@@ -1341,8 +1392,8 @@ static int ov5640_binning_on(struct ov5640_dev *sensor) + ret = ov5640_read_reg(sensor, OV5640_REG_TIMING_TC_REG21, &temp); + if (ret) + return ret; +- temp &= 0xfe; +- return temp ? 1 : 0; ++ ++ return temp & BIT(0); + } + + static int ov5640_set_binning(struct ov5640_dev *sensor, bool enable) +@@ -1387,30 +1438,6 @@ static int ov5640_set_virtual_channel(struct ov5640_dev *sensor) + return ov5640_write_reg(sensor, OV5640_REG_DEBUG_MODE, temp); + } + +-static int ov5640_set_timings(struct ov5640_dev *sensor, +- const struct ov5640_mode_info *mode) +-{ +- int ret; +- +- ret = ov5640_write_reg16(sensor, OV5640_REG_TIMING_DVPHO, mode->hact); +- if (ret < 0) +- return ret; +- +- ret = ov5640_write_reg16(sensor, OV5640_REG_TIMING_DVPVO, mode->vact); +- if (ret < 0) +- return ret; +- +- ret = ov5640_write_reg16(sensor, OV5640_REG_TIMING_HTS, mode->htot); +- if (ret < 0) +- return ret; +- +- ret = ov5640_write_reg16(sensor, OV5640_REG_TIMING_VTS, mode->vtot); +- if (ret < 0) +- return ret; +- +- return 0; +-} +- + static const struct ov5640_mode_info * + ov5640_find_mode(struct ov5640_dev *sensor, enum ov5640_frame_rate fr, + int width, int height, bool nearest) +@@ -1452,7 +1479,7 @@ static int ov5640_set_mode_exposure_calc(struct ov5640_dev *sensor, + if (ret < 0) + return ret; + prev_shutter = ret; +- ret = ov5640_binning_on(sensor); ++ ret = ov5640_get_binning(sensor); + if (ret < 0) + return ret; + if (ret && mode->id != OV5640_MODE_720P_1280_720 && +@@ -1573,7 +1600,7 @@ static int ov5640_set_mode_exposure_calc(struct ov5640_dev *sensor, + } + + /* set capture gain */ +- ret = __v4l2_ctrl_s_ctrl(sensor->ctrls.gain, cap_gain16); ++ ret = ov5640_set_gain(sensor, cap_gain16); + if (ret) + return ret; + +@@ -1586,7 +1613,7 @@ static int ov5640_set_mode_exposure_calc(struct ov5640_dev *sensor, + } + + /* set exposure */ +- return __v4l2_ctrl_s_ctrl(sensor->ctrls.exposure, cap_shutter); ++ return ov5640_set_exposure(sensor, cap_shutter); + } + + /* +@@ -1594,25 +1621,13 @@ static int ov5640_set_mode_exposure_calc(struct ov5640_dev *sensor, + * change mode directly + */ + static int ov5640_set_mode_direct(struct ov5640_dev *sensor, +- const struct ov5640_mode_info *mode, +- s32 exposure) ++ const struct ov5640_mode_info *mode) + { +- int ret; +- + if (!mode->reg_data) + return -EINVAL; + + /* Write capture setting */ +- ret = ov5640_load_regs(sensor, mode); +- if (ret < 0) +- return ret; +- +- /* turn auto gain/exposure back on for direct mode */ +- ret = __v4l2_ctrl_s_ctrl(sensor->ctrls.auto_gain, 1); +- if (ret) +- return ret; +- +- return __v4l2_ctrl_s_ctrl(sensor->ctrls.auto_exp, exposure); ++ return ov5640_load_regs(sensor, mode); + } + + static int ov5640_set_mode(struct ov5640_dev *sensor) +@@ -1620,27 +1635,31 @@ static int ov5640_set_mode(struct ov5640_dev *sensor) + const struct ov5640_mode_info *mode = sensor->current_mode; + const struct ov5640_mode_info *orig_mode = sensor->last_mode; + enum ov5640_downsize_mode dn_mode, orig_dn_mode; +- s32 exposure; ++ bool auto_gain = sensor->ctrls.auto_gain->val == 1; ++ bool auto_exp = sensor->ctrls.auto_exp->val == V4L2_EXPOSURE_AUTO; + int ret; + + dn_mode = mode->dn_mode; + orig_dn_mode = orig_mode->dn_mode; + + /* auto gain and exposure must be turned off when changing modes */ +- ret = __v4l2_ctrl_s_ctrl(sensor->ctrls.auto_gain, 0); +- if (ret) +- return ret; ++ if (auto_gain) { ++ ret = ov5640_set_autogain(sensor, false); ++ if (ret) ++ return ret; ++ } + +- exposure = sensor->ctrls.auto_exp->val; +- ret = ov5640_set_exposure(sensor, V4L2_EXPOSURE_MANUAL); +- if (ret) +- return ret; ++ if (auto_exp) { ++ ret = ov5640_set_autoexposure(sensor, false); ++ if (ret) ++ goto restore_auto_gain; ++ } + + if ((dn_mode == SUBSAMPLING && orig_dn_mode == SCALING) || + (dn_mode == SCALING && orig_dn_mode == SUBSAMPLING)) { + /* + * change between subsampling and scaling +- * go through exposure calucation ++ * go through exposure calculation + */ + ret = ov5640_set_mode_exposure_calc(sensor, mode); + } else { +@@ -1648,15 +1667,16 @@ static int ov5640_set_mode(struct ov5640_dev *sensor) + * change inside subsampling or scaling + * download firmware directly + */ +- ret = ov5640_set_mode_direct(sensor, mode, exposure); ++ ret = ov5640_set_mode_direct(sensor, mode); + } +- + if (ret < 0) +- return ret; ++ goto restore_auto_exp_gain; + +- ret = ov5640_set_timings(sensor, mode); +- if (ret < 0) +- return ret; ++ /* restore auto gain and exposure */ ++ if (auto_gain) ++ ov5640_set_autogain(sensor, true); ++ if (auto_exp) ++ ov5640_set_autoexposure(sensor, true); + + ret = ov5640_set_binning(sensor, dn_mode != SCALING); + if (ret < 0) +@@ -1678,6 +1698,15 @@ static int ov5640_set_mode(struct ov5640_dev *sensor) + sensor->last_mode = mode; + + return 0; ++ ++restore_auto_exp_gain: ++ if (auto_exp) ++ ov5640_set_autoexposure(sensor, true); ++restore_auto_gain: ++ if (auto_gain) ++ ov5640_set_autogain(sensor, true); ++ ++ return ret; + } + + static int ov5640_set_framefmt(struct ov5640_dev *sensor, +@@ -1790,23 +1819,69 @@ static int ov5640_set_power(struct ov5640_dev *sensor, bool on) + if (ret) + goto power_off; + ++ /* We're done here for DVP bus, while CSI-2 needs setup. */ ++ if (sensor->ep.bus_type != V4L2_MBUS_CSI2) ++ return 0; ++ ++ /* ++ * Power up MIPI HS Tx and LS Rx; 2 data lanes mode ++ * ++ * 0x300e = 0x40 ++ * [7:5] = 010 : 2 data lanes mode (see FIXME note in ++ * "ov5640_set_stream_mipi()") ++ * [4] = 0 : Power up MIPI HS Tx ++ * [3] = 0 : Power up MIPI LS Rx ++ * [2] = 0 : MIPI interface disabled ++ */ ++ ret = ov5640_write_reg(sensor, ++ OV5640_REG_IO_MIPI_CTRL00, 0x40); ++ if (ret) ++ goto power_off; ++ ++ /* ++ * Gate clock and set LP11 in 'no packets mode' (idle) ++ * ++ * 0x4800 = 0x24 ++ * [5] = 1 : Gate clock when 'no packets' ++ * [2] = 1 : MIPI bus in LP11 when 'no packets' ++ */ ++ ret = ov5640_write_reg(sensor, ++ OV5640_REG_MIPI_CTRL00, 0x24); ++ if (ret) ++ goto power_off; ++ ++ /* ++ * Set data lanes and clock in LP11 when 'sleeping' ++ * ++ * 0x3019 = 0x70 ++ * [6] = 1 : MIPI data lane 2 in LP11 when 'sleeping' ++ * [5] = 1 : MIPI data lane 1 in LP11 when 'sleeping' ++ * [4] = 1 : MIPI clock lane in LP11 when 'sleeping' ++ */ ++ ret = ov5640_write_reg(sensor, ++ OV5640_REG_PAD_OUTPUT00, 0x70); ++ if (ret) ++ goto power_off; ++ ++ /* Give lanes some time to coax into LP11 state. */ ++ usleep_range(500, 1000); ++ ++ } else { + if (sensor->ep.bus_type == V4L2_MBUS_CSI2) { +- /* +- * start streaming briefly followed by stream off in +- * order to coax the clock lane into LP-11 state. +- */ +- ret = ov5640_set_stream_mipi(sensor, true); +- if (ret) +- goto power_off; +- usleep_range(1000, 2000); +- ret = ov5640_set_stream_mipi(sensor, false); +- if (ret) +- goto power_off; ++ /* Reset MIPI bus settings to their default values. */ ++ ov5640_write_reg(sensor, ++ OV5640_REG_IO_MIPI_CTRL00, 0x58); ++ ov5640_write_reg(sensor, ++ OV5640_REG_MIPI_CTRL00, 0x04); ++ ov5640_write_reg(sensor, ++ OV5640_REG_PAD_OUTPUT00, 0x00); + } + +- return 0; ++ ov5640_set_power_off(sensor); + } + ++ return 0; ++ + power_off: + ov5640_set_power_off(sensor); + return ret; +@@ -2144,20 +2219,20 @@ static int ov5640_set_ctrl_white_balance(struct ov5640_dev *sensor, int awb) + return ret; + } + +-static int ov5640_set_ctrl_exposure(struct ov5640_dev *sensor, int exp) ++static int ov5640_set_ctrl_exposure(struct ov5640_dev *sensor, ++ enum v4l2_exposure_auto_type auto_exposure) + { + struct ov5640_ctrls *ctrls = &sensor->ctrls; +- bool auto_exposure = (exp == V4L2_EXPOSURE_AUTO); ++ bool auto_exp = (auto_exposure == V4L2_EXPOSURE_AUTO); + int ret = 0; + + if (ctrls->auto_exp->is_new) { +- ret = ov5640_mod_reg(sensor, OV5640_REG_AEC_PK_MANUAL, +- BIT(0), auto_exposure ? 0 : BIT(0)); ++ ret = ov5640_set_autoexposure(sensor, auto_exp); + if (ret) + return ret; + } + +- if (!auto_exposure && ctrls->exposure->is_new) { ++ if (!auto_exp && ctrls->exposure->is_new) { + u16 max_exp; + + ret = ov5640_read_reg16(sensor, OV5640_REG_AEC_PK_VTS, +@@ -2177,25 +2252,19 @@ static int ov5640_set_ctrl_exposure(struct ov5640_dev *sensor, int exp) + return ret; + } + +-static int ov5640_set_ctrl_gain(struct ov5640_dev *sensor, int auto_gain) ++static int ov5640_set_ctrl_gain(struct ov5640_dev *sensor, bool auto_gain) + { + struct ov5640_ctrls *ctrls = &sensor->ctrls; + int ret = 0; + + if (ctrls->auto_gain->is_new) { +- ret = ov5640_mod_reg(sensor, OV5640_REG_AEC_PK_MANUAL, +- BIT(1), +- ctrls->auto_gain->val ? 0 : BIT(1)); ++ ret = ov5640_set_autogain(sensor, auto_gain); + if (ret) + return ret; + } + +- if (!auto_gain && ctrls->gain->is_new) { +- u16 gain = (u16)ctrls->gain->val; +- +- ret = ov5640_write_reg16(sensor, OV5640_REG_AEC_PK_REAL_GAIN, +- gain & 0x3ff); +- } ++ if (!auto_gain && ctrls->gain->is_new) ++ ret = ov5640_set_gain(sensor, ctrls->gain->val); + + return ret; + } +@@ -2268,16 +2337,12 @@ static int ov5640_g_volatile_ctrl(struct v4l2_ctrl *ctrl) + + switch (ctrl->id) { + case V4L2_CID_AUTOGAIN: +- if (!ctrl->val) +- return 0; + val = ov5640_get_gain(sensor); + if (val < 0) + return val; + sensor->ctrls.gain->val = val; + break; + case V4L2_CID_EXPOSURE_AUTO: +- if (ctrl->val == V4L2_EXPOSURE_MANUAL) +- return 0; + val = ov5640_get_exposure(sensor); + if (val < 0) + return val; +diff --git a/drivers/mmc/host/sdhci-pci-core.c b/drivers/mmc/host/sdhci-pci-core.c +index 7bfd366d970d..c4115bae5db1 100644 +--- a/drivers/mmc/host/sdhci-pci-core.c ++++ b/drivers/mmc/host/sdhci-pci-core.c +@@ -12,6 +12,7 @@ + * - JMicron (hardware and technical support) + */ + ++#include + #include + #include + #include +@@ -462,6 +463,9 @@ struct intel_host { + u32 dsm_fns; + int drv_strength; + bool d3_retune; ++ bool rpm_retune_ok; ++ u32 glk_rx_ctrl1; ++ u32 glk_tun_val; + }; + + static const guid_t intel_dsm_guid = +@@ -791,6 +795,77 @@ cleanup: + return ret; + } + ++#ifdef CONFIG_PM ++#define GLK_RX_CTRL1 0x834 ++#define GLK_TUN_VAL 0x840 ++#define GLK_PATH_PLL GENMASK(13, 8) ++#define GLK_DLY GENMASK(6, 0) ++/* Workaround firmware failing to restore the tuning value */ ++static void glk_rpm_retune_wa(struct sdhci_pci_chip *chip, bool susp) ++{ ++ struct sdhci_pci_slot *slot = chip->slots[0]; ++ struct intel_host *intel_host = sdhci_pci_priv(slot); ++ struct sdhci_host *host = slot->host; ++ u32 glk_rx_ctrl1; ++ u32 glk_tun_val; ++ u32 dly; ++ ++ if (intel_host->rpm_retune_ok || !mmc_can_retune(host->mmc)) ++ return; ++ ++ glk_rx_ctrl1 = sdhci_readl(host, GLK_RX_CTRL1); ++ glk_tun_val = sdhci_readl(host, GLK_TUN_VAL); ++ ++ if (susp) { ++ intel_host->glk_rx_ctrl1 = glk_rx_ctrl1; ++ intel_host->glk_tun_val = glk_tun_val; ++ return; ++ } ++ ++ if (!intel_host->glk_tun_val) ++ return; ++ ++ if (glk_rx_ctrl1 != intel_host->glk_rx_ctrl1) { ++ intel_host->rpm_retune_ok = true; ++ return; ++ } ++ ++ dly = FIELD_PREP(GLK_DLY, FIELD_GET(GLK_PATH_PLL, glk_rx_ctrl1) + ++ (intel_host->glk_tun_val << 1)); ++ if (dly == FIELD_GET(GLK_DLY, glk_rx_ctrl1)) ++ return; ++ ++ glk_rx_ctrl1 = (glk_rx_ctrl1 & ~GLK_DLY) | dly; ++ sdhci_writel(host, glk_rx_ctrl1, GLK_RX_CTRL1); ++ ++ intel_host->rpm_retune_ok = true; ++ chip->rpm_retune = true; ++ mmc_retune_needed(host->mmc); ++ pr_info("%s: Requiring re-tune after rpm resume", mmc_hostname(host->mmc)); ++} ++ ++static void glk_rpm_retune_chk(struct sdhci_pci_chip *chip, bool susp) ++{ ++ if (chip->pdev->device == PCI_DEVICE_ID_INTEL_GLK_EMMC && ++ !chip->rpm_retune) ++ glk_rpm_retune_wa(chip, susp); ++} ++ ++static int glk_runtime_suspend(struct sdhci_pci_chip *chip) ++{ ++ glk_rpm_retune_chk(chip, true); ++ ++ return sdhci_cqhci_runtime_suspend(chip); ++} ++ ++static int glk_runtime_resume(struct sdhci_pci_chip *chip) ++{ ++ glk_rpm_retune_chk(chip, false); ++ ++ return sdhci_cqhci_runtime_resume(chip); ++} ++#endif ++ + #ifdef CONFIG_ACPI + static int ni_set_max_freq(struct sdhci_pci_slot *slot) + { +@@ -879,8 +954,8 @@ static const struct sdhci_pci_fixes sdhci_intel_glk_emmc = { + .resume = sdhci_cqhci_resume, + #endif + #ifdef CONFIG_PM +- .runtime_suspend = sdhci_cqhci_runtime_suspend, +- .runtime_resume = sdhci_cqhci_runtime_resume, ++ .runtime_suspend = glk_runtime_suspend, ++ .runtime_resume = glk_runtime_resume, + #endif + .quirks = SDHCI_QUIRK_NO_ENDATTR_IN_NOPDESC, + .quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN | +@@ -1762,8 +1837,13 @@ static struct sdhci_pci_slot *sdhci_pci_probe_slot( + device_init_wakeup(&pdev->dev, true); + + if (slot->cd_idx >= 0) { +- ret = mmc_gpiod_request_cd(host->mmc, NULL, slot->cd_idx, ++ ret = mmc_gpiod_request_cd(host->mmc, "cd", slot->cd_idx, + slot->cd_override_level, 0, NULL); ++ if (ret && ret != -EPROBE_DEFER) ++ ret = mmc_gpiod_request_cd(host->mmc, NULL, ++ slot->cd_idx, ++ slot->cd_override_level, ++ 0, NULL); + if (ret == -EPROBE_DEFER) + goto remove; + +diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c +index 49163570a63a..3b3f88ffab53 100644 +--- a/drivers/net/can/dev.c ++++ b/drivers/net/can/dev.c +@@ -477,6 +477,34 @@ void can_put_echo_skb(struct sk_buff *skb, struct net_device *dev, + } + EXPORT_SYMBOL_GPL(can_put_echo_skb); + ++struct sk_buff *__can_get_echo_skb(struct net_device *dev, unsigned int idx, u8 *len_ptr) ++{ ++ struct can_priv *priv = netdev_priv(dev); ++ struct sk_buff *skb = priv->echo_skb[idx]; ++ struct canfd_frame *cf; ++ ++ if (idx >= priv->echo_skb_max) { ++ netdev_err(dev, "%s: BUG! Trying to access can_priv::echo_skb out of bounds (%u/max %u)\n", ++ __func__, idx, priv->echo_skb_max); ++ return NULL; ++ } ++ ++ if (!skb) { ++ netdev_err(dev, "%s: BUG! Trying to echo non existing skb: can_priv::echo_skb[%u]\n", ++ __func__, idx); ++ return NULL; ++ } ++ ++ /* Using "struct canfd_frame::len" for the frame ++ * length is supported on both CAN and CANFD frames. ++ */ ++ cf = (struct canfd_frame *)skb->data; ++ *len_ptr = cf->len; ++ priv->echo_skb[idx] = NULL; ++ ++ return skb; ++} ++ + /* + * Get the skb from the stack and loop it back locally + * +@@ -486,22 +514,16 @@ EXPORT_SYMBOL_GPL(can_put_echo_skb); + */ + unsigned int can_get_echo_skb(struct net_device *dev, unsigned int idx) + { +- struct can_priv *priv = netdev_priv(dev); +- +- BUG_ON(idx >= priv->echo_skb_max); +- +- if (priv->echo_skb[idx]) { +- struct sk_buff *skb = priv->echo_skb[idx]; +- struct can_frame *cf = (struct can_frame *)skb->data; +- u8 dlc = cf->can_dlc; ++ struct sk_buff *skb; ++ u8 len; + +- netif_rx(priv->echo_skb[idx]); +- priv->echo_skb[idx] = NULL; ++ skb = __can_get_echo_skb(dev, idx, &len); ++ if (!skb) ++ return 0; + +- return dlc; +- } ++ netif_rx(skb); + +- return 0; ++ return len; + } + EXPORT_SYMBOL_GPL(can_get_echo_skb); + +diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c +index 8e972ef08637..75ce11395ee8 100644 +--- a/drivers/net/can/flexcan.c ++++ b/drivers/net/can/flexcan.c +@@ -135,13 +135,12 @@ + + /* FLEXCAN interrupt flag register (IFLAG) bits */ + /* Errata ERR005829 step7: Reserve first valid MB */ +-#define FLEXCAN_TX_MB_RESERVED_OFF_FIFO 8 +-#define FLEXCAN_TX_MB_OFF_FIFO 9 ++#define FLEXCAN_TX_MB_RESERVED_OFF_FIFO 8 + #define FLEXCAN_TX_MB_RESERVED_OFF_TIMESTAMP 0 +-#define FLEXCAN_TX_MB_OFF_TIMESTAMP 1 +-#define FLEXCAN_RX_MB_OFF_TIMESTAMP_FIRST (FLEXCAN_TX_MB_OFF_TIMESTAMP + 1) +-#define FLEXCAN_RX_MB_OFF_TIMESTAMP_LAST 63 +-#define FLEXCAN_IFLAG_MB(x) BIT(x) ++#define FLEXCAN_TX_MB 63 ++#define FLEXCAN_RX_MB_OFF_TIMESTAMP_FIRST (FLEXCAN_TX_MB_RESERVED_OFF_TIMESTAMP + 1) ++#define FLEXCAN_RX_MB_OFF_TIMESTAMP_LAST (FLEXCAN_TX_MB - 1) ++#define FLEXCAN_IFLAG_MB(x) BIT(x & 0x1f) + #define FLEXCAN_IFLAG_RX_FIFO_OVERFLOW BIT(7) + #define FLEXCAN_IFLAG_RX_FIFO_WARN BIT(6) + #define FLEXCAN_IFLAG_RX_FIFO_AVAILABLE BIT(5) +@@ -259,9 +258,7 @@ struct flexcan_priv { + struct can_rx_offload offload; + + struct flexcan_regs __iomem *regs; +- struct flexcan_mb __iomem *tx_mb; + struct flexcan_mb __iomem *tx_mb_reserved; +- u8 tx_mb_idx; + u32 reg_ctrl_default; + u32 reg_imask1_default; + u32 reg_imask2_default; +@@ -515,6 +512,7 @@ static int flexcan_get_berr_counter(const struct net_device *dev, + static netdev_tx_t flexcan_start_xmit(struct sk_buff *skb, struct net_device *dev) + { + const struct flexcan_priv *priv = netdev_priv(dev); ++ struct flexcan_regs __iomem *regs = priv->regs; + struct can_frame *cf = (struct can_frame *)skb->data; + u32 can_id; + u32 data; +@@ -537,17 +535,17 @@ static netdev_tx_t flexcan_start_xmit(struct sk_buff *skb, struct net_device *de + + if (cf->can_dlc > 0) { + data = be32_to_cpup((__be32 *)&cf->data[0]); +- priv->write(data, &priv->tx_mb->data[0]); ++ priv->write(data, ®s->mb[FLEXCAN_TX_MB].data[0]); + } + if (cf->can_dlc > 4) { + data = be32_to_cpup((__be32 *)&cf->data[4]); +- priv->write(data, &priv->tx_mb->data[1]); ++ priv->write(data, ®s->mb[FLEXCAN_TX_MB].data[1]); + } + + can_put_echo_skb(skb, dev, 0); + +- priv->write(can_id, &priv->tx_mb->can_id); +- priv->write(ctrl, &priv->tx_mb->can_ctrl); ++ priv->write(can_id, ®s->mb[FLEXCAN_TX_MB].can_id); ++ priv->write(ctrl, ®s->mb[FLEXCAN_TX_MB].can_ctrl); + + /* Errata ERR005829 step8: + * Write twice INACTIVE(0x8) code to first MB. +@@ -563,9 +561,13 @@ static netdev_tx_t flexcan_start_xmit(struct sk_buff *skb, struct net_device *de + static void flexcan_irq_bus_err(struct net_device *dev, u32 reg_esr) + { + struct flexcan_priv *priv = netdev_priv(dev); ++ struct flexcan_regs __iomem *regs = priv->regs; + struct sk_buff *skb; + struct can_frame *cf; + bool rx_errors = false, tx_errors = false; ++ u32 timestamp; ++ ++ timestamp = priv->read(®s->timer) << 16; + + skb = alloc_can_err_skb(dev, &cf); + if (unlikely(!skb)) +@@ -612,17 +614,21 @@ static void flexcan_irq_bus_err(struct net_device *dev, u32 reg_esr) + if (tx_errors) + dev->stats.tx_errors++; + +- can_rx_offload_irq_queue_err_skb(&priv->offload, skb); ++ can_rx_offload_queue_sorted(&priv->offload, skb, timestamp); + } + + static void flexcan_irq_state(struct net_device *dev, u32 reg_esr) + { + struct flexcan_priv *priv = netdev_priv(dev); ++ struct flexcan_regs __iomem *regs = priv->regs; + struct sk_buff *skb; + struct can_frame *cf; + enum can_state new_state, rx_state, tx_state; + int flt; + struct can_berr_counter bec; ++ u32 timestamp; ++ ++ timestamp = priv->read(®s->timer) << 16; + + flt = reg_esr & FLEXCAN_ESR_FLT_CONF_MASK; + if (likely(flt == FLEXCAN_ESR_FLT_CONF_ACTIVE)) { +@@ -652,7 +658,7 @@ static void flexcan_irq_state(struct net_device *dev, u32 reg_esr) + if (unlikely(new_state == CAN_STATE_BUS_OFF)) + can_bus_off(dev); + +- can_rx_offload_irq_queue_err_skb(&priv->offload, skb); ++ can_rx_offload_queue_sorted(&priv->offload, skb, timestamp); + } + + static inline struct flexcan_priv *rx_offload_to_priv(struct can_rx_offload *offload) +@@ -720,9 +726,14 @@ static unsigned int flexcan_mailbox_read(struct can_rx_offload *offload, + priv->write(BIT(n - 32), ®s->iflag2); + } else { + priv->write(FLEXCAN_IFLAG_RX_FIFO_AVAILABLE, ®s->iflag1); +- priv->read(®s->timer); + } + ++ /* Read the Free Running Timer. It is optional but recommended ++ * to unlock Mailbox as soon as possible and make it available ++ * for reception. ++ */ ++ priv->read(®s->timer); ++ + return 1; + } + +@@ -732,9 +743,9 @@ static inline u64 flexcan_read_reg_iflag_rx(struct flexcan_priv *priv) + struct flexcan_regs __iomem *regs = priv->regs; + u32 iflag1, iflag2; + +- iflag2 = priv->read(®s->iflag2) & priv->reg_imask2_default; +- iflag1 = priv->read(®s->iflag1) & priv->reg_imask1_default & +- ~FLEXCAN_IFLAG_MB(priv->tx_mb_idx); ++ iflag2 = priv->read(®s->iflag2) & priv->reg_imask2_default & ++ ~FLEXCAN_IFLAG_MB(FLEXCAN_TX_MB); ++ iflag1 = priv->read(®s->iflag1) & priv->reg_imask1_default; + + return (u64)iflag2 << 32 | iflag1; + } +@@ -746,11 +757,9 @@ static irqreturn_t flexcan_irq(int irq, void *dev_id) + struct flexcan_priv *priv = netdev_priv(dev); + struct flexcan_regs __iomem *regs = priv->regs; + irqreturn_t handled = IRQ_NONE; +- u32 reg_iflag1, reg_esr; ++ u32 reg_iflag2, reg_esr; + enum can_state last_state = priv->can.state; + +- reg_iflag1 = priv->read(®s->iflag1); +- + /* reception interrupt */ + if (priv->devtype_data->quirks & FLEXCAN_QUIRK_USE_OFF_TIMESTAMP) { + u64 reg_iflag; +@@ -764,6 +773,9 @@ static irqreturn_t flexcan_irq(int irq, void *dev_id) + break; + } + } else { ++ u32 reg_iflag1; ++ ++ reg_iflag1 = priv->read(®s->iflag1); + if (reg_iflag1 & FLEXCAN_IFLAG_RX_FIFO_AVAILABLE) { + handled = IRQ_HANDLED; + can_rx_offload_irq_offload_fifo(&priv->offload); +@@ -779,17 +791,22 @@ static irqreturn_t flexcan_irq(int irq, void *dev_id) + } + } + ++ reg_iflag2 = priv->read(®s->iflag2); ++ + /* transmission complete interrupt */ +- if (reg_iflag1 & FLEXCAN_IFLAG_MB(priv->tx_mb_idx)) { ++ if (reg_iflag2 & FLEXCAN_IFLAG_MB(FLEXCAN_TX_MB)) { ++ u32 reg_ctrl = priv->read(®s->mb[FLEXCAN_TX_MB].can_ctrl); ++ + handled = IRQ_HANDLED; +- stats->tx_bytes += can_get_echo_skb(dev, 0); ++ stats->tx_bytes += can_rx_offload_get_echo_skb(&priv->offload, ++ 0, reg_ctrl << 16); + stats->tx_packets++; + can_led_event(dev, CAN_LED_EVENT_TX); + + /* after sending a RTR frame MB is in RX mode */ + priv->write(FLEXCAN_MB_CODE_TX_INACTIVE, +- &priv->tx_mb->can_ctrl); +- priv->write(FLEXCAN_IFLAG_MB(priv->tx_mb_idx), ®s->iflag1); ++ ®s->mb[FLEXCAN_TX_MB].can_ctrl); ++ priv->write(FLEXCAN_IFLAG_MB(FLEXCAN_TX_MB), ®s->iflag2); + netif_wake_queue(dev); + } + +@@ -931,15 +948,13 @@ static int flexcan_chip_start(struct net_device *dev) + reg_mcr &= ~FLEXCAN_MCR_MAXMB(0xff); + reg_mcr |= FLEXCAN_MCR_FRZ | FLEXCAN_MCR_HALT | FLEXCAN_MCR_SUPV | + FLEXCAN_MCR_WRN_EN | FLEXCAN_MCR_SRX_DIS | FLEXCAN_MCR_IRMQ | +- FLEXCAN_MCR_IDAM_C; ++ FLEXCAN_MCR_IDAM_C | FLEXCAN_MCR_MAXMB(FLEXCAN_TX_MB); + +- if (priv->devtype_data->quirks & FLEXCAN_QUIRK_USE_OFF_TIMESTAMP) { ++ if (priv->devtype_data->quirks & FLEXCAN_QUIRK_USE_OFF_TIMESTAMP) + reg_mcr &= ~FLEXCAN_MCR_FEN; +- reg_mcr |= FLEXCAN_MCR_MAXMB(priv->offload.mb_last); +- } else { +- reg_mcr |= FLEXCAN_MCR_FEN | +- FLEXCAN_MCR_MAXMB(priv->tx_mb_idx); +- } ++ else ++ reg_mcr |= FLEXCAN_MCR_FEN; ++ + netdev_dbg(dev, "%s: writing mcr=0x%08x", __func__, reg_mcr); + priv->write(reg_mcr, ®s->mcr); + +@@ -982,16 +997,17 @@ static int flexcan_chip_start(struct net_device *dev) + priv->write(reg_ctrl2, ®s->ctrl2); + } + +- /* clear and invalidate all mailboxes first */ +- for (i = priv->tx_mb_idx; i < ARRAY_SIZE(regs->mb); i++) { +- priv->write(FLEXCAN_MB_CODE_RX_INACTIVE, +- ®s->mb[i].can_ctrl); +- } +- + if (priv->devtype_data->quirks & FLEXCAN_QUIRK_USE_OFF_TIMESTAMP) { +- for (i = priv->offload.mb_first; i <= priv->offload.mb_last; i++) ++ for (i = priv->offload.mb_first; i <= priv->offload.mb_last; i++) { + priv->write(FLEXCAN_MB_CODE_RX_EMPTY, + ®s->mb[i].can_ctrl); ++ } ++ } else { ++ /* clear and invalidate unused mailboxes first */ ++ for (i = FLEXCAN_TX_MB_RESERVED_OFF_FIFO; i <= ARRAY_SIZE(regs->mb); i++) { ++ priv->write(FLEXCAN_MB_CODE_RX_INACTIVE, ++ ®s->mb[i].can_ctrl); ++ } + } + + /* Errata ERR005829: mark first TX mailbox as INACTIVE */ +@@ -1000,7 +1016,7 @@ static int flexcan_chip_start(struct net_device *dev) + + /* mark TX mailbox as INACTIVE */ + priv->write(FLEXCAN_MB_CODE_TX_INACTIVE, +- &priv->tx_mb->can_ctrl); ++ ®s->mb[FLEXCAN_TX_MB].can_ctrl); + + /* acceptance mask/acceptance code (accept everything) */ + priv->write(0x0, ®s->rxgmask); +@@ -1355,17 +1371,13 @@ static int flexcan_probe(struct platform_device *pdev) + priv->devtype_data = devtype_data; + priv->reg_xceiver = reg_xceiver; + +- if (priv->devtype_data->quirks & FLEXCAN_QUIRK_USE_OFF_TIMESTAMP) { +- priv->tx_mb_idx = FLEXCAN_TX_MB_OFF_TIMESTAMP; ++ if (priv->devtype_data->quirks & FLEXCAN_QUIRK_USE_OFF_TIMESTAMP) + priv->tx_mb_reserved = ®s->mb[FLEXCAN_TX_MB_RESERVED_OFF_TIMESTAMP]; +- } else { +- priv->tx_mb_idx = FLEXCAN_TX_MB_OFF_FIFO; ++ else + priv->tx_mb_reserved = ®s->mb[FLEXCAN_TX_MB_RESERVED_OFF_FIFO]; +- } +- priv->tx_mb = ®s->mb[priv->tx_mb_idx]; + +- priv->reg_imask1_default = FLEXCAN_IFLAG_MB(priv->tx_mb_idx); +- priv->reg_imask2_default = 0; ++ priv->reg_imask1_default = 0; ++ priv->reg_imask2_default = FLEXCAN_IFLAG_MB(FLEXCAN_TX_MB); + + priv->offload.mailbox_read = flexcan_mailbox_read; + +diff --git a/drivers/net/can/rx-offload.c b/drivers/net/can/rx-offload.c +index d94dae216820..727691dd08fb 100644 +--- a/drivers/net/can/rx-offload.c ++++ b/drivers/net/can/rx-offload.c +@@ -209,7 +209,54 @@ int can_rx_offload_irq_offload_fifo(struct can_rx_offload *offload) + } + EXPORT_SYMBOL_GPL(can_rx_offload_irq_offload_fifo); + +-int can_rx_offload_irq_queue_err_skb(struct can_rx_offload *offload, struct sk_buff *skb) ++int can_rx_offload_queue_sorted(struct can_rx_offload *offload, ++ struct sk_buff *skb, u32 timestamp) ++{ ++ struct can_rx_offload_cb *cb; ++ unsigned long flags; ++ ++ if (skb_queue_len(&offload->skb_queue) > ++ offload->skb_queue_len_max) ++ return -ENOMEM; ++ ++ cb = can_rx_offload_get_cb(skb); ++ cb->timestamp = timestamp; ++ ++ spin_lock_irqsave(&offload->skb_queue.lock, flags); ++ __skb_queue_add_sort(&offload->skb_queue, skb, can_rx_offload_compare); ++ spin_unlock_irqrestore(&offload->skb_queue.lock, flags); ++ ++ can_rx_offload_schedule(offload); ++ ++ return 0; ++} ++EXPORT_SYMBOL_GPL(can_rx_offload_queue_sorted); ++ ++unsigned int can_rx_offload_get_echo_skb(struct can_rx_offload *offload, ++ unsigned int idx, u32 timestamp) ++{ ++ struct net_device *dev = offload->dev; ++ struct net_device_stats *stats = &dev->stats; ++ struct sk_buff *skb; ++ u8 len; ++ int err; ++ ++ skb = __can_get_echo_skb(dev, idx, &len); ++ if (!skb) ++ return 0; ++ ++ err = can_rx_offload_queue_sorted(offload, skb, timestamp); ++ if (err) { ++ stats->rx_errors++; ++ stats->tx_fifo_errors++; ++ } ++ ++ return len; ++} ++EXPORT_SYMBOL_GPL(can_rx_offload_get_echo_skb); ++ ++int can_rx_offload_queue_tail(struct can_rx_offload *offload, ++ struct sk_buff *skb) + { + if (skb_queue_len(&offload->skb_queue) > + offload->skb_queue_len_max) +@@ -220,7 +267,7 @@ int can_rx_offload_irq_queue_err_skb(struct can_rx_offload *offload, struct sk_b + + return 0; + } +-EXPORT_SYMBOL_GPL(can_rx_offload_irq_queue_err_skb); ++EXPORT_SYMBOL_GPL(can_rx_offload_queue_tail); + + static int can_rx_offload_init_queue(struct net_device *dev, struct can_rx_offload *offload, unsigned int weight) + { +diff --git a/drivers/net/can/spi/hi311x.c b/drivers/net/can/spi/hi311x.c +index 53e320c92a8b..ddaf46239e39 100644 +--- a/drivers/net/can/spi/hi311x.c ++++ b/drivers/net/can/spi/hi311x.c +@@ -760,7 +760,7 @@ static int hi3110_open(struct net_device *net) + { + struct hi3110_priv *priv = netdev_priv(net); + struct spi_device *spi = priv->spi; +- unsigned long flags = IRQF_ONESHOT | IRQF_TRIGGER_RISING; ++ unsigned long flags = IRQF_ONESHOT | IRQF_TRIGGER_HIGH; + int ret; + + ret = open_candev(net); +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +index 5444e6213d45..64a794be7fcb 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +@@ -5997,7 +5997,8 @@ static int brcmf_construct_chaninfo(struct brcmf_cfg80211_info *cfg, + * for subsequent chanspecs. + */ + channel->flags = IEEE80211_CHAN_NO_HT40 | +- IEEE80211_CHAN_NO_80MHZ; ++ IEEE80211_CHAN_NO_80MHZ | ++ IEEE80211_CHAN_NO_160MHZ; + ch.bw = BRCMU_CHAN_BW_20; + cfg->d11inf.encchspec(&ch); + chaninfo = ch.chspec; +diff --git a/drivers/net/wireless/intel/iwlwifi/fw/acpi.h b/drivers/net/wireless/intel/iwlwifi/fw/acpi.h +index cb5f32c1d705..0b3b1223cff7 100644 +--- a/drivers/net/wireless/intel/iwlwifi/fw/acpi.h ++++ b/drivers/net/wireless/intel/iwlwifi/fw/acpi.h +@@ -6,6 +6,7 @@ + * GPL LICENSE SUMMARY + * + * Copyright(c) 2017 Intel Deutschland GmbH ++ * Copyright(c) 2018 Intel Corporation + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of version 2 of the GNU General Public License as +@@ -29,6 +30,7 @@ + * BSD LICENSE + * + * Copyright(c) 2017 Intel Deutschland GmbH ++ * Copyright(c) 2018 Intel Corporation + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without +@@ -84,7 +86,7 @@ + #define ACPI_WRDS_WIFI_DATA_SIZE (ACPI_SAR_TABLE_SIZE + 2) + #define ACPI_EWRD_WIFI_DATA_SIZE ((ACPI_SAR_PROFILE_NUM - 1) * \ + ACPI_SAR_TABLE_SIZE + 3) +-#define ACPI_WGDS_WIFI_DATA_SIZE 18 ++#define ACPI_WGDS_WIFI_DATA_SIZE 19 + #define ACPI_WRDD_WIFI_DATA_SIZE 2 + #define ACPI_SPLC_WIFI_DATA_SIZE 2 + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c +index 48a3611d6a31..4d49a1a3f504 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c +@@ -880,7 +880,7 @@ static int iwl_mvm_sar_geo_init(struct iwl_mvm *mvm) + IWL_DEBUG_RADIO(mvm, "Sending GEO_TX_POWER_LIMIT\n"); + + BUILD_BUG_ON(ACPI_NUM_GEO_PROFILES * ACPI_WGDS_NUM_BANDS * +- ACPI_WGDS_TABLE_SIZE != ACPI_WGDS_WIFI_DATA_SIZE); ++ ACPI_WGDS_TABLE_SIZE + 1 != ACPI_WGDS_WIFI_DATA_SIZE); + + BUILD_BUG_ON(ACPI_NUM_GEO_PROFILES > IWL_NUM_GEO_PROFILES); + +@@ -915,6 +915,11 @@ static int iwl_mvm_sar_get_ewrd_table(struct iwl_mvm *mvm) + return -ENOENT; + } + ++static int iwl_mvm_sar_get_wgds_table(struct iwl_mvm *mvm) ++{ ++ return -ENOENT; ++} ++ + static int iwl_mvm_sar_geo_init(struct iwl_mvm *mvm) + { + return 0; +@@ -941,8 +946,11 @@ static int iwl_mvm_sar_init(struct iwl_mvm *mvm) + IWL_DEBUG_RADIO(mvm, + "WRDS SAR BIOS table invalid or unavailable. (%d)\n", + ret); +- /* if not available, don't fail and don't bother with EWRD */ +- return 0; ++ /* ++ * If not available, don't fail and don't bother with EWRD. ++ * Return 1 to tell that we can't use WGDS either. ++ */ ++ return 1; + } + + ret = iwl_mvm_sar_get_ewrd_table(mvm); +@@ -955,9 +963,13 @@ static int iwl_mvm_sar_init(struct iwl_mvm *mvm) + /* choose profile 1 (WRDS) as default for both chains */ + ret = iwl_mvm_sar_select_profile(mvm, 1, 1); + +- /* if we don't have profile 0 from BIOS, just skip it */ ++ /* ++ * If we don't have profile 0 from BIOS, just skip it. This ++ * means that SAR Geo will not be enabled either, even if we ++ * have other valid profiles. ++ */ + if (ret == -ENOENT) +- return 0; ++ return 1; + + return ret; + } +@@ -1155,11 +1167,19 @@ int iwl_mvm_up(struct iwl_mvm *mvm) + iwl_mvm_unref(mvm, IWL_MVM_REF_UCODE_DOWN); + + ret = iwl_mvm_sar_init(mvm); +- if (ret) +- goto error; ++ if (ret == 0) { ++ ret = iwl_mvm_sar_geo_init(mvm); ++ } else if (ret > 0 && !iwl_mvm_sar_get_wgds_table(mvm)) { ++ /* ++ * If basic SAR is not available, we check for WGDS, ++ * which should *not* be available either. If it is ++ * available, issue an error, because we can't use SAR ++ * Geo without basic SAR. ++ */ ++ IWL_ERR(mvm, "BIOS contains WGDS but no WRDS\n"); ++ } + +- ret = iwl_mvm_sar_geo_init(mvm); +- if (ret) ++ if (ret < 0) + goto error; + + iwl_mvm_leds_sync(mvm); +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +index 155cc2ac0120..afed549f5645 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +@@ -306,8 +306,12 @@ struct ieee80211_regdomain *iwl_mvm_get_regdomain(struct wiphy *wiphy, + goto out; + } + +- if (changed) +- *changed = (resp->status == MCC_RESP_NEW_CHAN_PROFILE); ++ if (changed) { ++ u32 status = le32_to_cpu(resp->status); ++ ++ *changed = (status == MCC_RESP_NEW_CHAN_PROFILE || ++ status == MCC_RESP_ILLEGAL); ++ } + + regd = iwl_parse_nvm_mcc_info(mvm->trans->dev, mvm->cfg, + __le32_to_cpu(resp->n_channels), +@@ -4416,10 +4420,6 @@ static void iwl_mvm_mac_sta_statistics(struct ieee80211_hw *hw, + sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL_AVG); + } + +- if (!fw_has_capa(&mvm->fw->ucode_capa, +- IWL_UCODE_TLV_CAPA_RADIO_BEACON_STATS)) +- return; +- + /* if beacon filtering isn't on mac80211 does it anyway */ + if (!(vif->driver_flags & IEEE80211_VIF_BEACON_FILTER)) + return; +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c b/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c +index cf48517944ec..f2579c94ffdb 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c +@@ -545,9 +545,8 @@ iwl_mvm_update_mcc(struct iwl_mvm *mvm, const char *alpha2, + } + + IWL_DEBUG_LAR(mvm, +- "MCC response status: 0x%x. new MCC: 0x%x ('%c%c') change: %d n_chans: %d\n", +- status, mcc, mcc >> 8, mcc & 0xff, +- !!(status == MCC_RESP_NEW_CHAN_PROFILE), n_channels); ++ "MCC response status: 0x%x. new MCC: 0x%x ('%c%c') n_chans: %d\n", ++ status, mcc, mcc >> 8, mcc & 0xff, n_channels); + + exit: + iwl_free_resp(&cmd); +diff --git a/drivers/opp/ti-opp-supply.c b/drivers/opp/ti-opp-supply.c +index 9e5a9a3112c9..3f4fb4dbbe33 100644 +--- a/drivers/opp/ti-opp-supply.c ++++ b/drivers/opp/ti-opp-supply.c +@@ -288,7 +288,10 @@ static int ti_opp_supply_set_opp(struct dev_pm_set_opp_data *data) + int ret; + + vdd_uv = _get_optimal_vdd_voltage(dev, &opp_data, +- new_supply_vbb->u_volt); ++ new_supply_vdd->u_volt); ++ ++ if (new_supply_vdd->u_volt_min < vdd_uv) ++ new_supply_vdd->u_volt_min = vdd_uv; + + /* Scaling up? Scale voltage before frequency */ + if (freq > old_freq) { +diff --git a/drivers/pinctrl/meson/pinctrl-meson-gxbb.c b/drivers/pinctrl/meson/pinctrl-meson-gxbb.c +index 4ceb06f8a33c..4edeb4cae72a 100644 +--- a/drivers/pinctrl/meson/pinctrl-meson-gxbb.c ++++ b/drivers/pinctrl/meson/pinctrl-meson-gxbb.c +@@ -830,7 +830,7 @@ static struct meson_bank meson_gxbb_periphs_banks[] = { + + static struct meson_bank meson_gxbb_aobus_banks[] = { + /* name first last irq pullen pull dir out in */ +- BANK("AO", GPIOAO_0, GPIOAO_13, 0, 13, 0, 0, 0, 16, 0, 0, 0, 16, 1, 0), ++ BANK("AO", GPIOAO_0, GPIOAO_13, 0, 13, 0, 16, 0, 0, 0, 0, 0, 16, 1, 0), + }; + + static struct meson_pinctrl_data meson_gxbb_periphs_pinctrl_data = { +diff --git a/drivers/pinctrl/meson/pinctrl-meson-gxl.c b/drivers/pinctrl/meson/pinctrl-meson-gxl.c +index 7dae1d7bf6b0..158f618f1695 100644 +--- a/drivers/pinctrl/meson/pinctrl-meson-gxl.c ++++ b/drivers/pinctrl/meson/pinctrl-meson-gxl.c +@@ -807,7 +807,7 @@ static struct meson_bank meson_gxl_periphs_banks[] = { + + static struct meson_bank meson_gxl_aobus_banks[] = { + /* name first last irq pullen pull dir out in */ +- BANK("AO", GPIOAO_0, GPIOAO_9, 0, 9, 0, 0, 0, 16, 0, 0, 0, 16, 1, 0), ++ BANK("AO", GPIOAO_0, GPIOAO_9, 0, 9, 0, 16, 0, 0, 0, 0, 0, 16, 1, 0), + }; + + static struct meson_pinctrl_data meson_gxl_periphs_pinctrl_data = { +diff --git a/drivers/pinctrl/meson/pinctrl-meson.c b/drivers/pinctrl/meson/pinctrl-meson.c +index 29a458da78db..4f3ab18636a3 100644 +--- a/drivers/pinctrl/meson/pinctrl-meson.c ++++ b/drivers/pinctrl/meson/pinctrl-meson.c +@@ -192,7 +192,7 @@ static int meson_pinconf_set(struct pinctrl_dev *pcdev, unsigned int pin, + dev_dbg(pc->dev, "pin %u: disable bias\n", pin); + + meson_calc_reg_and_bit(bank, pin, REG_PULL, ®, &bit); +- ret = regmap_update_bits(pc->reg_pull, reg, ++ ret = regmap_update_bits(pc->reg_pullen, reg, + BIT(bit), 0); + if (ret) + return ret; +diff --git a/drivers/pinctrl/meson/pinctrl-meson8.c b/drivers/pinctrl/meson/pinctrl-meson8.c +index c6d79315218f..86466173114d 100644 +--- a/drivers/pinctrl/meson/pinctrl-meson8.c ++++ b/drivers/pinctrl/meson/pinctrl-meson8.c +@@ -1053,7 +1053,7 @@ static struct meson_bank meson8_cbus_banks[] = { + + static struct meson_bank meson8_aobus_banks[] = { + /* name first last irq pullen pull dir out in */ +- BANK("AO", GPIOAO_0, GPIO_TEST_N, 0, 13, 0, 0, 0, 16, 0, 0, 0, 16, 1, 0), ++ BANK("AO", GPIOAO_0, GPIO_TEST_N, 0, 13, 0, 16, 0, 0, 0, 0, 0, 16, 1, 0), + }; + + static struct meson_pinctrl_data meson8_cbus_pinctrl_data = { +diff --git a/drivers/pinctrl/meson/pinctrl-meson8b.c b/drivers/pinctrl/meson/pinctrl-meson8b.c +index bb2a30964fc6..647ad15d5c3c 100644 +--- a/drivers/pinctrl/meson/pinctrl-meson8b.c ++++ b/drivers/pinctrl/meson/pinctrl-meson8b.c +@@ -906,7 +906,7 @@ static struct meson_bank meson8b_cbus_banks[] = { + + static struct meson_bank meson8b_aobus_banks[] = { + /* name first lastc irq pullen pull dir out in */ +- BANK("AO", GPIOAO_0, GPIO_TEST_N, 0, 13, 0, 0, 0, 16, 0, 0, 0, 16, 1, 0), ++ BANK("AO", GPIOAO_0, GPIO_TEST_N, 0, 13, 0, 16, 0, 0, 0, 0, 0, 16, 1, 0), + }; + + static struct meson_pinctrl_data meson8b_cbus_pinctrl_data = { +diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c +index df0c5776d49b..a5a19ff10535 100644 +--- a/drivers/rtc/rtc-cmos.c ++++ b/drivers/rtc/rtc-cmos.c +@@ -257,6 +257,7 @@ static int cmos_read_alarm(struct device *dev, struct rtc_wkalrm *t) + struct cmos_rtc *cmos = dev_get_drvdata(dev); + unsigned char rtc_control; + ++ /* This not only a rtc_op, but also called directly */ + if (!is_valid_irq(cmos->irq)) + return -EIO; + +@@ -452,6 +453,7 @@ static int cmos_set_alarm(struct device *dev, struct rtc_wkalrm *t) + unsigned char mon, mday, hrs, min, sec, rtc_control; + int ret; + ++ /* This not only a rtc_op, but also called directly */ + if (!is_valid_irq(cmos->irq)) + return -EIO; + +@@ -516,9 +518,6 @@ static int cmos_alarm_irq_enable(struct device *dev, unsigned int enabled) + struct cmos_rtc *cmos = dev_get_drvdata(dev); + unsigned long flags; + +- if (!is_valid_irq(cmos->irq)) +- return -EINVAL; +- + spin_lock_irqsave(&rtc_lock, flags); + + if (enabled) +@@ -579,6 +578,12 @@ static const struct rtc_class_ops cmos_rtc_ops = { + .alarm_irq_enable = cmos_alarm_irq_enable, + }; + ++static const struct rtc_class_ops cmos_rtc_ops_no_alarm = { ++ .read_time = cmos_read_time, ++ .set_time = cmos_set_time, ++ .proc = cmos_procfs, ++}; ++ + /*----------------------------------------------------------------*/ + + /* +@@ -855,9 +860,12 @@ cmos_do_probe(struct device *dev, struct resource *ports, int rtc_irq) + dev_dbg(dev, "IRQ %d is already in use\n", rtc_irq); + goto cleanup1; + } ++ ++ cmos_rtc.rtc->ops = &cmos_rtc_ops; ++ } else { ++ cmos_rtc.rtc->ops = &cmos_rtc_ops_no_alarm; + } + +- cmos_rtc.rtc->ops = &cmos_rtc_ops; + cmos_rtc.rtc->nvram_old_abi = true; + retval = rtc_register_device(cmos_rtc.rtc); + if (retval) +diff --git a/drivers/rtc/rtc-pcf2127.c b/drivers/rtc/rtc-pcf2127.c +index 9f99a0966550..7cb786d76e3c 100644 +--- a/drivers/rtc/rtc-pcf2127.c ++++ b/drivers/rtc/rtc-pcf2127.c +@@ -303,6 +303,9 @@ static int pcf2127_i2c_gather_write(void *context, + memcpy(buf + 1, val, val_size); + + ret = i2c_master_send(client, buf, val_size + 1); ++ ++ kfree(buf); ++ + if (ret != val_size + 1) + return ret < 0 ? ret : -EIO; + +diff --git a/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c +index 8f60f0e04599..410eccf0bc5e 100644 +--- a/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c ++++ b/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c +@@ -904,11 +904,9 @@ static void start_delivery_v1_hw(struct hisi_sas_dq *dq) + { + struct hisi_hba *hisi_hba = dq->hisi_hba; + struct hisi_sas_slot *s, *s1, *s2 = NULL; +- struct list_head *dq_list; + int dlvry_queue = dq->id; + int wp; + +- dq_list = &dq->list; + list_for_each_entry_safe(s, s1, &dq->list, delivery) { + if (!s->ready) + break; +diff --git a/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c +index 9c5c5a601332..1c4ea58da1ae 100644 +--- a/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c ++++ b/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c +@@ -1666,11 +1666,9 @@ static void start_delivery_v2_hw(struct hisi_sas_dq *dq) + { + struct hisi_hba *hisi_hba = dq->hisi_hba; + struct hisi_sas_slot *s, *s1, *s2 = NULL; +- struct list_head *dq_list; + int dlvry_queue = dq->id; + int wp; + +- dq_list = &dq->list; + list_for_each_entry_safe(s, s1, &dq->list, delivery) { + if (!s->ready) + break; +diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +index 08b503e274b8..687ff61bba9f 100644 +--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c ++++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +@@ -883,11 +883,9 @@ static void start_delivery_v3_hw(struct hisi_sas_dq *dq) + { + struct hisi_hba *hisi_hba = dq->hisi_hba; + struct hisi_sas_slot *s, *s1, *s2 = NULL; +- struct list_head *dq_list; + int dlvry_queue = dq->id; + int wp; + +- dq_list = &dq->list; + list_for_each_entry_safe(s, s1, &dq->list, delivery) { + if (!s->ready) + break; +diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c +index aec5b10a8c85..ca6c3982548d 100644 +--- a/drivers/scsi/lpfc/lpfc_debugfs.c ++++ b/drivers/scsi/lpfc/lpfc_debugfs.c +@@ -700,6 +700,8 @@ lpfc_debugfs_nodelist_data(struct lpfc_vport *vport, char *buf, int size) + rport = lpfc_ndlp_get_nrport(ndlp); + if (rport) + nrport = rport->remoteport; ++ else ++ nrport = NULL; + spin_unlock(&phba->hbalock); + if (!nrport) + continue; +diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c +index 431742201709..3ad460219fd6 100644 +--- a/drivers/tty/n_tty.c ++++ b/drivers/tty/n_tty.c +@@ -152,17 +152,28 @@ static inline unsigned char *echo_buf_addr(struct n_tty_data *ldata, size_t i) + return &ldata->echo_buf[i & (N_TTY_BUF_SIZE - 1)]; + } + ++/* If we are not echoing the data, perhaps this is a secret so erase it */ ++static void zero_buffer(struct tty_struct *tty, u8 *buffer, int size) ++{ ++ bool icanon = !!L_ICANON(tty); ++ bool no_echo = !L_ECHO(tty); ++ ++ if (icanon && no_echo) ++ memset(buffer, 0x00, size); ++} ++ + static int tty_copy_to_user(struct tty_struct *tty, void __user *to, + size_t tail, size_t n) + { + struct n_tty_data *ldata = tty->disc_data; + size_t size = N_TTY_BUF_SIZE - tail; +- const void *from = read_buf_addr(ldata, tail); ++ void *from = read_buf_addr(ldata, tail); + int uncopied; + + if (n > size) { + tty_audit_add_data(tty, from, size); + uncopied = copy_to_user(to, from, size); ++ zero_buffer(tty, from, size - uncopied); + if (uncopied) + return uncopied; + to += size; +@@ -171,7 +182,9 @@ static int tty_copy_to_user(struct tty_struct *tty, void __user *to, + } + + tty_audit_add_data(tty, from, n); +- return copy_to_user(to, from, n); ++ uncopied = copy_to_user(to, from, n); ++ zero_buffer(tty, from, n - uncopied); ++ return uncopied; + } + + /** +@@ -1960,11 +1973,12 @@ static int copy_from_read_buf(struct tty_struct *tty, + n = min(head - ldata->read_tail, N_TTY_BUF_SIZE - tail); + n = min(*nr, n); + if (n) { +- const unsigned char *from = read_buf_addr(ldata, tail); ++ unsigned char *from = read_buf_addr(ldata, tail); + retval = copy_to_user(*b, from, n); + n -= retval; + is_eof = n == 1 && *from == EOF_CHAR(tty); + tty_audit_add_data(tty, from, n); ++ zero_buffer(tty, from, n); + smp_store_release(&ldata->read_tail, ldata->read_tail + n); + /* Turn single EOF into zero-length read */ + if (L_EXTPROC(tty) && ldata->icanon && is_eof && +diff --git a/drivers/tty/tty_buffer.c b/drivers/tty/tty_buffer.c +index c996b6859c5e..ae3ce330200e 100644 +--- a/drivers/tty/tty_buffer.c ++++ b/drivers/tty/tty_buffer.c +@@ -468,11 +468,15 @@ receive_buf(struct tty_port *port, struct tty_buffer *head, int count) + { + unsigned char *p = char_buf_ptr(head, head->read); + char *f = NULL; ++ int n; + + if (~head->flags & TTYB_NORMAL) + f = flag_buf_ptr(head, head->read); + +- return port->client_ops->receive_buf(port, p, f, count); ++ n = port->client_ops->receive_buf(port, p, f, count); ++ if (n > 0) ++ memset(p, 0, n); ++ return n; + } + + /** +diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c +index 6e0823790bee..f79979ae482a 100644 +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -2847,7 +2847,9 @@ static int hub_port_reset(struct usb_hub *hub, int port1, + USB_PORT_FEAT_C_BH_PORT_RESET); + usb_clear_port_feature(hub->hdev, port1, + USB_PORT_FEAT_C_PORT_LINK_STATE); +- usb_clear_port_feature(hub->hdev, port1, ++ ++ if (udev) ++ usb_clear_port_feature(hub->hdev, port1, + USB_PORT_FEAT_C_CONNECTION); + + /* +diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c +index 88c80fcc39f5..fec97465ccac 100644 +--- a/drivers/usb/dwc3/core.c ++++ b/drivers/usb/dwc3/core.c +@@ -1499,6 +1499,7 @@ static int dwc3_probe(struct platform_device *pdev) + + err5: + dwc3_event_buffers_cleanup(dwc); ++ dwc3_ulpi_exit(dwc); + + err4: + dwc3_free_scratch_buffers(dwc); +diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c +index 1286076a8890..842795856bf4 100644 +--- a/drivers/usb/dwc3/dwc3-pci.c ++++ b/drivers/usb/dwc3/dwc3-pci.c +@@ -283,8 +283,10 @@ err: + static void dwc3_pci_remove(struct pci_dev *pci) + { + struct dwc3_pci *dwc = pci_get_drvdata(pci); ++ struct pci_dev *pdev = dwc->pci; + +- gpiod_remove_lookup_table(&platform_bytcr_gpios); ++ if (pdev->device == PCI_DEVICE_ID_INTEL_BYT) ++ gpiod_remove_lookup_table(&platform_bytcr_gpios); + #ifdef CONFIG_PM + cancel_work_sync(&dwc->wakeup_work); + #endif +diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c +index 2b53194081ba..2de1a3971a26 100644 +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -1072,7 +1072,7 @@ static void dwc3_prepare_one_trb_sg(struct dwc3_ep *dep, + /* Now prepare one extra TRB to align transfer size */ + trb = &dep->trb_pool[dep->trb_enqueue]; + __dwc3_prepare_one_trb(dep, trb, dwc->bounce_addr, +- maxp - rem, false, 0, ++ maxp - rem, false, 1, + req->request.stream_id, + req->request.short_not_ok, + req->request.no_interrupt); +@@ -1116,7 +1116,7 @@ static void dwc3_prepare_one_trb_linear(struct dwc3_ep *dep, + /* Now prepare one extra TRB to align transfer size */ + trb = &dep->trb_pool[dep->trb_enqueue]; + __dwc3_prepare_one_trb(dep, trb, dwc->bounce_addr, maxp - rem, +- false, 0, req->request.stream_id, ++ false, 1, req->request.stream_id, + req->request.short_not_ok, + req->request.no_interrupt); + } else if (req->request.zero && req->request.length && +@@ -1132,7 +1132,7 @@ static void dwc3_prepare_one_trb_linear(struct dwc3_ep *dep, + /* Now prepare one extra TRB to handle ZLP */ + trb = &dep->trb_pool[dep->trb_enqueue]; + __dwc3_prepare_one_trb(dep, trb, dwc->bounce_addr, 0, +- false, 0, req->request.stream_id, ++ false, 1, req->request.stream_id, + req->request.short_not_ok, + req->request.no_interrupt); + } else { +@@ -2250,7 +2250,7 @@ static int dwc3_gadget_ep_reclaim_completed_trb(struct dwc3_ep *dep, + * with one TRB pending in the ring. We need to manually clear HWO bit + * from that TRB. + */ +- if ((req->zero || req->unaligned) && (trb->ctrl & DWC3_TRB_CTRL_HWO)) { ++ if ((req->zero || req->unaligned) && !(trb->ctrl & DWC3_TRB_CTRL_CHN)) { + trb->ctrl &= ~DWC3_TRB_CTRL_HWO; + return 1; + } +diff --git a/drivers/usb/host/xhci-histb.c b/drivers/usb/host/xhci-histb.c +index 27f00160332e..3c4abb5a1c3f 100644 +--- a/drivers/usb/host/xhci-histb.c ++++ b/drivers/usb/host/xhci-histb.c +@@ -325,14 +325,16 @@ static int xhci_histb_remove(struct platform_device *dev) + struct xhci_hcd_histb *histb = platform_get_drvdata(dev); + struct usb_hcd *hcd = histb->hcd; + struct xhci_hcd *xhci = hcd_to_xhci(hcd); ++ struct usb_hcd *shared_hcd = xhci->shared_hcd; + + xhci->xhc_state |= XHCI_STATE_REMOVING; + +- usb_remove_hcd(xhci->shared_hcd); ++ usb_remove_hcd(shared_hcd); ++ xhci->shared_hcd = NULL; + device_wakeup_disable(&dev->dev); + + usb_remove_hcd(hcd); +- usb_put_hcd(xhci->shared_hcd); ++ usb_put_hcd(shared_hcd); + + xhci_histb_host_disable(histb); + usb_put_hcd(hcd); +diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c +index 12eea73d9f20..94aca1b5ac8a 100644 +--- a/drivers/usb/host/xhci-hub.c ++++ b/drivers/usb/host/xhci-hub.c +@@ -876,7 +876,7 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd, + status |= USB_PORT_STAT_SUSPEND; + } + if ((raw_port_status & PORT_PLS_MASK) == XDEV_RESUME && +- !DEV_SUPERSPEED_ANY(raw_port_status)) { ++ !DEV_SUPERSPEED_ANY(raw_port_status) && hcd->speed < HCD_USB3) { + if ((raw_port_status & PORT_RESET) || + !(raw_port_status & PORT_PE)) + return 0xffffffff; +@@ -921,7 +921,7 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd, + time_left = wait_for_completion_timeout( + &bus_state->rexit_done[wIndex], + msecs_to_jiffies( +- XHCI_MAX_REXIT_TIMEOUT)); ++ XHCI_MAX_REXIT_TIMEOUT_MS)); + spin_lock_irqsave(&xhci->lock, flags); + + if (time_left) { +@@ -935,7 +935,7 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd, + } else { + int port_status = readl(port->addr); + xhci_warn(xhci, "Port resume took longer than %i msec, port status = 0x%x\n", +- XHCI_MAX_REXIT_TIMEOUT, ++ XHCI_MAX_REXIT_TIMEOUT_MS, + port_status); + status |= USB_PORT_STAT_SUSPEND; + clear_bit(wIndex, &bus_state->rexit_ports); +@@ -1474,15 +1474,18 @@ int xhci_bus_suspend(struct usb_hcd *hcd) + unsigned long flags; + struct xhci_hub *rhub; + struct xhci_port **ports; ++ u32 portsc_buf[USB_MAXCHILDREN]; ++ bool wake_enabled; + + rhub = xhci_get_rhub(hcd); + ports = rhub->ports; + max_ports = rhub->num_ports; + bus_state = &xhci->bus_state[hcd_index(hcd)]; ++ wake_enabled = hcd->self.root_hub->do_remote_wakeup; + + spin_lock_irqsave(&xhci->lock, flags); + +- if (hcd->self.root_hub->do_remote_wakeup) { ++ if (wake_enabled) { + if (bus_state->resuming_ports || /* USB2 */ + bus_state->port_remote_wakeup) { /* USB3 */ + spin_unlock_irqrestore(&xhci->lock, flags); +@@ -1490,26 +1493,36 @@ int xhci_bus_suspend(struct usb_hcd *hcd) + return -EBUSY; + } + } +- +- port_index = max_ports; ++ /* ++ * Prepare ports for suspend, but don't write anything before all ports ++ * are checked and we know bus suspend can proceed ++ */ + bus_state->bus_suspended = 0; ++ port_index = max_ports; + while (port_index--) { +- /* suspend the port if the port is not suspended */ + u32 t1, t2; +- int slot_id; + + t1 = readl(ports[port_index]->addr); + t2 = xhci_port_state_to_neutral(t1); ++ portsc_buf[port_index] = 0; + +- if ((t1 & PORT_PE) && !(t1 & PORT_PLS_MASK)) { +- xhci_dbg(xhci, "port %d not suspended\n", port_index); +- slot_id = xhci_find_slot_id_by_port(hcd, xhci, +- port_index + 1); +- if (slot_id) { ++ /* Bail out if a USB3 port has a new device in link training */ ++ if ((t1 & PORT_PLS_MASK) == XDEV_POLLING) { ++ bus_state->bus_suspended = 0; ++ spin_unlock_irqrestore(&xhci->lock, flags); ++ xhci_dbg(xhci, "Bus suspend bailout, port in polling\n"); ++ return -EBUSY; ++ } ++ ++ /* suspend ports in U0, or bail out for new connect changes */ ++ if ((t1 & PORT_PE) && (t1 & PORT_PLS_MASK) == XDEV_U0) { ++ if ((t1 & PORT_CSC) && wake_enabled) { ++ bus_state->bus_suspended = 0; + spin_unlock_irqrestore(&xhci->lock, flags); +- xhci_stop_device(xhci, slot_id, 1); +- spin_lock_irqsave(&xhci->lock, flags); ++ xhci_dbg(xhci, "Bus suspend bailout, port connect change\n"); ++ return -EBUSY; + } ++ xhci_dbg(xhci, "port %d not suspended\n", port_index); + t2 &= ~PORT_PLS_MASK; + t2 |= PORT_LINK_STROBE | XDEV_U3; + set_bit(port_index, &bus_state->bus_suspended); +@@ -1518,7 +1531,7 @@ int xhci_bus_suspend(struct usb_hcd *hcd) + * including the USB 3.0 roothub, but only if CONFIG_PM + * is enabled, so also enable remote wake here. + */ +- if (hcd->self.root_hub->do_remote_wakeup) { ++ if (wake_enabled) { + if (t1 & PORT_CONNECT) { + t2 |= PORT_WKOC_E | PORT_WKDISC_E; + t2 &= ~PORT_WKCONN_E; +@@ -1538,7 +1551,26 @@ int xhci_bus_suspend(struct usb_hcd *hcd) + + t1 = xhci_port_state_to_neutral(t1); + if (t1 != t2) +- writel(t2, ports[port_index]->addr); ++ portsc_buf[port_index] = t2; ++ } ++ ++ /* write port settings, stopping and suspending ports if needed */ ++ port_index = max_ports; ++ while (port_index--) { ++ if (!portsc_buf[port_index]) ++ continue; ++ if (test_bit(port_index, &bus_state->bus_suspended)) { ++ int slot_id; ++ ++ slot_id = xhci_find_slot_id_by_port(hcd, xhci, ++ port_index + 1); ++ if (slot_id) { ++ spin_unlock_irqrestore(&xhci->lock, flags); ++ xhci_stop_device(xhci, slot_id, 1); ++ spin_lock_irqsave(&xhci->lock, flags); ++ } ++ } ++ writel(portsc_buf[port_index], ports[port_index]->addr); + } + hcd->state = HC_STATE_SUSPENDED; + bus_state->next_statechange = jiffies + msecs_to_jiffies(10); +diff --git a/drivers/usb/host/xhci-mtk.c b/drivers/usb/host/xhci-mtk.c +index 71d0d33c3286..60987c787e44 100644 +--- a/drivers/usb/host/xhci-mtk.c ++++ b/drivers/usb/host/xhci-mtk.c +@@ -590,12 +590,14 @@ static int xhci_mtk_remove(struct platform_device *dev) + struct xhci_hcd_mtk *mtk = platform_get_drvdata(dev); + struct usb_hcd *hcd = mtk->hcd; + struct xhci_hcd *xhci = hcd_to_xhci(hcd); ++ struct usb_hcd *shared_hcd = xhci->shared_hcd; + +- usb_remove_hcd(xhci->shared_hcd); ++ usb_remove_hcd(shared_hcd); ++ xhci->shared_hcd = NULL; + device_init_wakeup(&dev->dev, false); + + usb_remove_hcd(hcd); +- usb_put_hcd(xhci->shared_hcd); ++ usb_put_hcd(shared_hcd); + usb_put_hcd(hcd); + xhci_mtk_sch_exit(mtk); + xhci_mtk_clks_disable(mtk); +diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c +index 51dd8e00c4f8..beeda27b3789 100644 +--- a/drivers/usb/host/xhci-pci.c ++++ b/drivers/usb/host/xhci-pci.c +@@ -231,6 +231,11 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) + if (pdev->vendor == PCI_VENDOR_ID_TI && pdev->device == 0x8241) + xhci->quirks |= XHCI_LIMIT_ENDPOINT_INTERVAL_7; + ++ if ((pdev->vendor == PCI_VENDOR_ID_BROADCOM || ++ pdev->vendor == PCI_VENDOR_ID_CAVIUM) && ++ pdev->device == 0x9026) ++ xhci->quirks |= XHCI_RESET_PLL_ON_DISCONNECT; ++ + if (xhci->quirks & XHCI_RESET_ON_RESUME) + xhci_dbg_trace(xhci, trace_xhci_dbg_quirks, + "QUIRK: Resetting on resume"); +@@ -356,6 +361,7 @@ static void xhci_pci_remove(struct pci_dev *dev) + if (xhci->shared_hcd) { + usb_remove_hcd(xhci->shared_hcd); + usb_put_hcd(xhci->shared_hcd); ++ xhci->shared_hcd = NULL; + } + + /* Workaround for spurious wakeups at shutdown with HSW */ +diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c +index 94e939249b2b..e5da8ce62914 100644 +--- a/drivers/usb/host/xhci-plat.c ++++ b/drivers/usb/host/xhci-plat.c +@@ -359,14 +359,16 @@ static int xhci_plat_remove(struct platform_device *dev) + struct xhci_hcd *xhci = hcd_to_xhci(hcd); + struct clk *clk = xhci->clk; + struct clk *reg_clk = xhci->reg_clk; ++ struct usb_hcd *shared_hcd = xhci->shared_hcd; + + xhci->xhc_state |= XHCI_STATE_REMOVING; + +- usb_remove_hcd(xhci->shared_hcd); ++ usb_remove_hcd(shared_hcd); ++ xhci->shared_hcd = NULL; + usb_phy_shutdown(hcd->usb_phy); + + usb_remove_hcd(hcd); +- usb_put_hcd(xhci->shared_hcd); ++ usb_put_hcd(shared_hcd); + + clk_disable_unprepare(clk); + clk_disable_unprepare(reg_clk); +diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c +index cd4659703647..9ae17a666bdb 100644 +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -1517,6 +1517,35 @@ static void handle_device_notification(struct xhci_hcd *xhci, + usb_wakeup_notification(udev->parent, udev->portnum); + } + ++/* ++ * Quirk hanlder for errata seen on Cavium ThunderX2 processor XHCI ++ * Controller. ++ * As per ThunderX2errata-129 USB 2 device may come up as USB 1 ++ * If a connection to a USB 1 device is followed by another connection ++ * to a USB 2 device. ++ * ++ * Reset the PHY after the USB device is disconnected if device speed ++ * is less than HCD_USB3. ++ * Retry the reset sequence max of 4 times checking the PLL lock status. ++ * ++ */ ++static void xhci_cavium_reset_phy_quirk(struct xhci_hcd *xhci) ++{ ++ struct usb_hcd *hcd = xhci_to_hcd(xhci); ++ u32 pll_lock_check; ++ u32 retry_count = 4; ++ ++ do { ++ /* Assert PHY reset */ ++ writel(0x6F, hcd->regs + 0x1048); ++ udelay(10); ++ /* De-assert the PHY reset */ ++ writel(0x7F, hcd->regs + 0x1048); ++ udelay(200); ++ pll_lock_check = readl(hcd->regs + 0x1070); ++ } while (!(pll_lock_check & 0x1) && --retry_count); ++} ++ + static void handle_port_status(struct xhci_hcd *xhci, + union xhci_trb *event) + { +@@ -1552,6 +1581,13 @@ static void handle_port_status(struct xhci_hcd *xhci, + goto cleanup; + } + ++ /* We might get interrupts after shared_hcd is removed */ ++ if (port->rhub == &xhci->usb3_rhub && xhci->shared_hcd == NULL) { ++ xhci_dbg(xhci, "ignore port event for removed USB3 hcd\n"); ++ bogus_port_status = true; ++ goto cleanup; ++ } ++ + hcd = port->rhub->hcd; + bus_state = &xhci->bus_state[hcd_index(hcd)]; + hcd_portnum = port->hcd_portnum; +@@ -1635,7 +1671,7 @@ static void handle_port_status(struct xhci_hcd *xhci, + * RExit to a disconnect state). If so, let the the driver know it's + * out of the RExit state. + */ +- if (!DEV_SUPERSPEED_ANY(portsc) && ++ if (!DEV_SUPERSPEED_ANY(portsc) && hcd->speed < HCD_USB3 && + test_and_clear_bit(hcd_portnum, + &bus_state->rexit_ports)) { + complete(&bus_state->rexit_done[hcd_portnum]); +@@ -1643,8 +1679,12 @@ static void handle_port_status(struct xhci_hcd *xhci, + goto cleanup; + } + +- if (hcd->speed < HCD_USB3) ++ if (hcd->speed < HCD_USB3) { + xhci_test_and_clear_bit(xhci, port, PORT_PLC); ++ if ((xhci->quirks & XHCI_RESET_PLL_ON_DISCONNECT) && ++ (portsc & PORT_CSC) && !(portsc & PORT_CONNECT)) ++ xhci_cavium_reset_phy_quirk(xhci); ++ } + + cleanup: + /* Update event ring dequeue pointer before dropping the lock */ +@@ -2247,6 +2287,7 @@ static int handle_tx_event(struct xhci_hcd *xhci, + goto cleanup; + case COMP_RING_UNDERRUN: + case COMP_RING_OVERRUN: ++ case COMP_STOPPED_LENGTH_INVALID: + goto cleanup; + default: + xhci_err(xhci, "ERROR Transfer event for unknown stream ring slot %u ep %u\n", +diff --git a/drivers/usb/host/xhci-tegra.c b/drivers/usb/host/xhci-tegra.c +index 4b463e5202a4..b1cce989bd12 100644 +--- a/drivers/usb/host/xhci-tegra.c ++++ b/drivers/usb/host/xhci-tegra.c +@@ -1240,6 +1240,7 @@ static int tegra_xusb_remove(struct platform_device *pdev) + + usb_remove_hcd(xhci->shared_hcd); + usb_put_hcd(xhci->shared_hcd); ++ xhci->shared_hcd = NULL; + usb_remove_hcd(tegra->hcd); + usb_put_hcd(tegra->hcd); + +diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c +index 0420eefa647a..c928dbbff881 100644 +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -719,8 +719,6 @@ static void xhci_stop(struct usb_hcd *hcd) + + /* Only halt host and free memory after both hcds are removed */ + if (!usb_hcd_is_primary_hcd(hcd)) { +- /* usb core will free this hcd shortly, unset pointer */ +- xhci->shared_hcd = NULL; + mutex_unlock(&xhci->mutex); + return; + } +diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h +index 6230a578324c..e936e4c8af98 100644 +--- a/drivers/usb/host/xhci.h ++++ b/drivers/usb/host/xhci.h +@@ -1678,7 +1678,7 @@ struct xhci_bus_state { + * It can take up to 20 ms to transition from RExit to U0 on the + * Intel Lynx Point LP xHCI host. + */ +-#define XHCI_MAX_REXIT_TIMEOUT (20 * 1000) ++#define XHCI_MAX_REXIT_TIMEOUT_MS 20 + + static inline unsigned int hcd_index(struct usb_hcd *hcd) + { +@@ -1846,6 +1846,7 @@ struct xhci_hcd { + #define XHCI_SUSPEND_DELAY BIT_ULL(30) + #define XHCI_INTEL_USB_ROLE_SW BIT_ULL(31) + #define XHCI_ZERO_64B_REGS BIT_ULL(32) ++#define XHCI_RESET_PLL_ON_DISCONNECT BIT_ULL(34) + + unsigned int num_active_eps; + unsigned int limit_active_eps; +diff --git a/fs/9p/vfs_dir.c b/fs/9p/vfs_dir.c +index b0405d6aac85..48db9a9f13f9 100644 +--- a/fs/9p/vfs_dir.c ++++ b/fs/9p/vfs_dir.c +@@ -76,15 +76,6 @@ static inline int dt_type(struct p9_wstat *mistat) + return rettype; + } + +-static void p9stat_init(struct p9_wstat *stbuf) +-{ +- stbuf->name = NULL; +- stbuf->uid = NULL; +- stbuf->gid = NULL; +- stbuf->muid = NULL; +- stbuf->extension = NULL; +-} +- + /** + * v9fs_alloc_rdir_buf - Allocate buffer used for read and readdir + * @filp: opened file structure +@@ -145,12 +136,10 @@ static int v9fs_dir_readdir(struct file *file, struct dir_context *ctx) + rdir->tail = n; + } + while (rdir->head < rdir->tail) { +- p9stat_init(&st); + err = p9stat_read(fid->clnt, rdir->buf + rdir->head, + rdir->tail - rdir->head, &st); + if (err) { + p9_debug(P9_DEBUG_VFS, "returned %d\n", err); +- p9stat_free(&st); + return -EIO; + } + reclen = st.size+2; +diff --git a/fs/bfs/inode.c b/fs/bfs/inode.c +index 9a69392f1fb3..d81c148682e7 100644 +--- a/fs/bfs/inode.c ++++ b/fs/bfs/inode.c +@@ -350,7 +350,8 @@ static int bfs_fill_super(struct super_block *s, void *data, int silent) + + s->s_magic = BFS_MAGIC; + +- if (le32_to_cpu(bfs_sb->s_start) > le32_to_cpu(bfs_sb->s_end)) { ++ if (le32_to_cpu(bfs_sb->s_start) > le32_to_cpu(bfs_sb->s_end) || ++ le32_to_cpu(bfs_sb->s_start) < BFS_BSIZE) { + printf("Superblock is corrupted\n"); + goto out1; + } +@@ -359,9 +360,11 @@ static int bfs_fill_super(struct super_block *s, void *data, int silent) + sizeof(struct bfs_inode) + + BFS_ROOT_INO - 1; + imap_len = (info->si_lasti / 8) + 1; +- info->si_imap = kzalloc(imap_len, GFP_KERNEL); +- if (!info->si_imap) ++ info->si_imap = kzalloc(imap_len, GFP_KERNEL | __GFP_NOWARN); ++ if (!info->si_imap) { ++ printf("Cannot allocate %u bytes\n", imap_len); + goto out1; ++ } + for (i = 0; i < BFS_ROOT_INO; i++) + set_bit(i, info->si_imap); + +diff --git a/fs/dax.c b/fs/dax.c +index 0fb270f0a0ef..b0cd1364c68f 100644 +--- a/fs/dax.c ++++ b/fs/dax.c +@@ -217,6 +217,9 @@ static inline void *unlock_slot(struct address_space *mapping, void **slot) + return (void *)entry; + } + ++static void put_unlocked_mapping_entry(struct address_space *mapping, ++ pgoff_t index, void *entry); ++ + /* + * Lookup entry in radix tree, wait for it to become unlocked if it is + * exceptional entry and return it. The caller must call +@@ -256,8 +259,10 @@ static void *__get_unlocked_mapping_entry(struct address_space *mapping, + revalidate = wait_fn(); + finish_wait(wq, &ewait.wait); + xa_lock_irq(&mapping->i_pages); +- if (revalidate) ++ if (revalidate) { ++ put_unlocked_mapping_entry(mapping, index, entry); + return ERR_PTR(-EAGAIN); ++ } + } + } + +diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c +index 8748539c04ed..7f8bb0868c0f 100644 +--- a/fs/gfs2/bmap.c ++++ b/fs/gfs2/bmap.c +@@ -826,7 +826,7 @@ static int gfs2_iomap_get(struct inode *inode, loff_t pos, loff_t length, + ret = gfs2_meta_inode_buffer(ip, &dibh); + if (ret) + goto unlock; +- iomap->private = dibh; ++ mp->mp_bh[0] = dibh; + + if (gfs2_is_stuffed(ip)) { + if (flags & IOMAP_WRITE) { +@@ -863,9 +863,6 @@ unstuff: + len = lblock_stop - lblock + 1; + iomap->length = len << inode->i_blkbits; + +- get_bh(dibh); +- mp->mp_bh[0] = dibh; +- + height = ip->i_height; + while ((lblock + 1) * sdp->sd_sb.sb_bsize > sdp->sd_heightsize[height]) + height++; +@@ -898,8 +895,6 @@ out: + iomap->bdev = inode->i_sb->s_bdev; + unlock: + up_read(&ip->i_rw_mutex); +- if (ret && dibh) +- brelse(dibh); + return ret; + + do_alloc: +@@ -980,9 +975,9 @@ static void gfs2_iomap_journaled_page_done(struct inode *inode, loff_t pos, + + static int gfs2_iomap_begin_write(struct inode *inode, loff_t pos, + loff_t length, unsigned flags, +- struct iomap *iomap) ++ struct iomap *iomap, ++ struct metapath *mp) + { +- struct metapath mp = { .mp_aheight = 1, }; + struct gfs2_inode *ip = GFS2_I(inode); + struct gfs2_sbd *sdp = GFS2_SB(inode); + unsigned int data_blocks = 0, ind_blocks = 0, rblocks; +@@ -996,9 +991,9 @@ static int gfs2_iomap_begin_write(struct inode *inode, loff_t pos, + unstuff = gfs2_is_stuffed(ip) && + pos + length > gfs2_max_stuffed_size(ip); + +- ret = gfs2_iomap_get(inode, pos, length, flags, iomap, &mp); ++ ret = gfs2_iomap_get(inode, pos, length, flags, iomap, mp); + if (ret) +- goto out_release; ++ goto out_unlock; + + alloc_required = unstuff || iomap->type == IOMAP_HOLE; + +@@ -1013,7 +1008,7 @@ static int gfs2_iomap_begin_write(struct inode *inode, loff_t pos, + + ret = gfs2_quota_lock_check(ip, &ap); + if (ret) +- goto out_release; ++ goto out_unlock; + + ret = gfs2_inplace_reserve(ip, &ap); + if (ret) +@@ -1038,17 +1033,15 @@ static int gfs2_iomap_begin_write(struct inode *inode, loff_t pos, + ret = gfs2_unstuff_dinode(ip, NULL); + if (ret) + goto out_trans_end; +- release_metapath(&mp); +- brelse(iomap->private); +- iomap->private = NULL; ++ release_metapath(mp); + ret = gfs2_iomap_get(inode, iomap->offset, iomap->length, +- flags, iomap, &mp); ++ flags, iomap, mp); + if (ret) + goto out_trans_end; + } + + if (iomap->type == IOMAP_HOLE) { +- ret = gfs2_iomap_alloc(inode, iomap, flags, &mp); ++ ret = gfs2_iomap_alloc(inode, iomap, flags, mp); + if (ret) { + gfs2_trans_end(sdp); + gfs2_inplace_release(ip); +@@ -1056,7 +1049,6 @@ static int gfs2_iomap_begin_write(struct inode *inode, loff_t pos, + goto out_qunlock; + } + } +- release_metapath(&mp); + if (!gfs2_is_stuffed(ip) && gfs2_is_jdata(ip)) + iomap->page_done = gfs2_iomap_journaled_page_done; + return 0; +@@ -1069,10 +1061,7 @@ out_trans_fail: + out_qunlock: + if (alloc_required) + gfs2_quota_unlock(ip); +-out_release: +- if (iomap->private) +- brelse(iomap->private); +- release_metapath(&mp); ++out_unlock: + gfs2_write_unlock(inode); + return ret; + } +@@ -1088,10 +1077,10 @@ static int gfs2_iomap_begin(struct inode *inode, loff_t pos, loff_t length, + + trace_gfs2_iomap_start(ip, pos, length, flags); + if ((flags & IOMAP_WRITE) && !(flags & IOMAP_DIRECT)) { +- ret = gfs2_iomap_begin_write(inode, pos, length, flags, iomap); ++ ret = gfs2_iomap_begin_write(inode, pos, length, flags, iomap, &mp); + } else { + ret = gfs2_iomap_get(inode, pos, length, flags, iomap, &mp); +- release_metapath(&mp); ++ + /* + * Silently fall back to buffered I/O for stuffed files or if + * we've hot a hole (see gfs2_file_direct_write). +@@ -1100,6 +1089,11 @@ static int gfs2_iomap_begin(struct inode *inode, loff_t pos, loff_t length, + iomap->type != IOMAP_MAPPED) + ret = -ENOTBLK; + } ++ if (!ret) { ++ get_bh(mp.mp_bh[0]); ++ iomap->private = mp.mp_bh[0]; ++ } ++ release_metapath(&mp); + trace_gfs2_iomap_end(ip, iomap, ret); + return ret; + } +diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c +index 6b84ef6ccff3..b041cb8ae383 100644 +--- a/fs/gfs2/ops_fstype.c ++++ b/fs/gfs2/ops_fstype.c +@@ -72,13 +72,13 @@ static struct gfs2_sbd *init_sbd(struct super_block *sb) + if (!sdp) + return NULL; + +- sb->s_fs_info = sdp; + sdp->sd_vfs = sb; + sdp->sd_lkstats = alloc_percpu(struct gfs2_pcpu_lkstats); + if (!sdp->sd_lkstats) { + kfree(sdp); + return NULL; + } ++ sb->s_fs_info = sdp; + + set_bit(SDF_NOJOURNALID, &sdp->sd_flags); + gfs2_tune_init(&sdp->sd_tune); +diff --git a/fs/nfs/callback_proc.c b/fs/nfs/callback_proc.c +index fa515d5ea5ba..7b861bbc0b43 100644 +--- a/fs/nfs/callback_proc.c ++++ b/fs/nfs/callback_proc.c +@@ -66,7 +66,7 @@ __be32 nfs4_callback_getattr(void *argp, void *resp, + out_iput: + rcu_read_unlock(); + trace_nfs4_cb_getattr(cps->clp, &args->fh, inode, -ntohl(res->status)); +- iput(inode); ++ nfs_iput_and_deactive(inode); + out: + dprintk("%s: exit with status = %d\n", __func__, ntohl(res->status)); + return res->status; +@@ -108,7 +108,7 @@ __be32 nfs4_callback_recall(void *argp, void *resp, + } + trace_nfs4_cb_recall(cps->clp, &args->fh, inode, + &args->stateid, -ntohl(res)); +- iput(inode); ++ nfs_iput_and_deactive(inode); + out: + dprintk("%s: exit with status = %d\n", __func__, ntohl(res)); + return res; +diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c +index f033f3a69a3b..75fe92eaa681 100644 +--- a/fs/nfs/delegation.c ++++ b/fs/nfs/delegation.c +@@ -849,16 +849,23 @@ nfs_delegation_find_inode_server(struct nfs_server *server, + const struct nfs_fh *fhandle) + { + struct nfs_delegation *delegation; +- struct inode *res = NULL; ++ struct inode *freeme, *res = NULL; + + list_for_each_entry_rcu(delegation, &server->delegations, super_list) { + spin_lock(&delegation->lock); + if (delegation->inode != NULL && + nfs_compare_fh(fhandle, &NFS_I(delegation->inode)->fh) == 0) { +- res = igrab(delegation->inode); ++ freeme = igrab(delegation->inode); ++ if (freeme && nfs_sb_active(freeme->i_sb)) ++ res = freeme; + spin_unlock(&delegation->lock); + if (res != NULL) + return res; ++ if (freeme) { ++ rcu_read_unlock(); ++ iput(freeme); ++ rcu_read_lock(); ++ } + return ERR_PTR(-EAGAIN); + } + spin_unlock(&delegation->lock); +diff --git a/fs/notify/fanotify/fanotify.c b/fs/notify/fanotify/fanotify.c +index 94b52157bf8d..29dee9630eec 100644 +--- a/fs/notify/fanotify/fanotify.c ++++ b/fs/notify/fanotify/fanotify.c +@@ -115,12 +115,12 @@ static bool fanotify_should_send_event(struct fsnotify_iter_info *iter_info, + continue; + mark = iter_info->marks[type]; + /* +- * if the event is for a child and this inode doesn't care about +- * events on the child, don't send it! ++ * If the event is for a child and this mark doesn't care about ++ * events on a child, don't send it! + */ +- if (type == FSNOTIFY_OBJ_TYPE_INODE && +- (event_mask & FS_EVENT_ON_CHILD) && +- !(mark->mask & FS_EVENT_ON_CHILD)) ++ if (event_mask & FS_EVENT_ON_CHILD && ++ (type != FSNOTIFY_OBJ_TYPE_INODE || ++ !(mark->mask & FS_EVENT_ON_CHILD))) + continue; + + marks_mask |= mark->mask; +diff --git a/fs/notify/fsnotify.c b/fs/notify/fsnotify.c +index f43ea1aad542..170a733454f7 100644 +--- a/fs/notify/fsnotify.c ++++ b/fs/notify/fsnotify.c +@@ -161,9 +161,9 @@ int __fsnotify_parent(const struct path *path, struct dentry *dentry, __u32 mask + parent = dget_parent(dentry); + p_inode = parent->d_inode; + +- if (unlikely(!fsnotify_inode_watches_children(p_inode))) ++ if (unlikely(!fsnotify_inode_watches_children(p_inode))) { + __fsnotify_update_child_dentry_flags(p_inode); +- else if (p_inode->i_fsnotify_mask & mask) { ++ } else if (p_inode->i_fsnotify_mask & mask & ALL_FSNOTIFY_EVENTS) { + struct name_snapshot name; + + /* we are notifying a parent so come up with the new mask which +@@ -193,7 +193,7 @@ static int send_to_group(struct inode *to_tell, + struct fsnotify_iter_info *iter_info) + { + struct fsnotify_group *group = NULL; +- __u32 test_mask = (mask & ~FS_EVENT_ON_CHILD); ++ __u32 test_mask = (mask & ALL_FSNOTIFY_EVENTS); + __u32 marks_mask = 0; + __u32 marks_ignored_mask = 0; + struct fsnotify_mark *mark; +@@ -324,14 +324,17 @@ int fsnotify(struct inode *to_tell, __u32 mask, const void *data, int data_is, + struct fsnotify_iter_info iter_info = {}; + struct mount *mnt; + int ret = 0; +- /* global tests shouldn't care about events on child only the specific event */ +- __u32 test_mask = (mask & ~FS_EVENT_ON_CHILD); ++ __u32 test_mask = (mask & ALL_FSNOTIFY_EVENTS); + + if (data_is == FSNOTIFY_EVENT_PATH) + mnt = real_mount(((const struct path *)data)->mnt); + else + mnt = NULL; + ++ /* An event "on child" is not intended for a mount mark */ ++ if (mask & FS_EVENT_ON_CHILD) ++ mnt = NULL; ++ + /* + * Optimization: srcu_read_lock() has a memory barrier which can + * be expensive. It protects walking the *_fsnotify_marks lists. +@@ -389,7 +392,7 @@ static __init int fsnotify_init(void) + { + int ret; + +- BUG_ON(hweight32(ALL_FSNOTIFY_EVENTS) != 23); ++ BUG_ON(hweight32(ALL_FSNOTIFY_BITS) != 23); + + ret = init_srcu_struct(&fsnotify_mark_srcu); + if (ret) +diff --git a/include/linux/can/dev.h b/include/linux/can/dev.h +index a83e1f632eb7..f01623aef2f7 100644 +--- a/include/linux/can/dev.h ++++ b/include/linux/can/dev.h +@@ -169,6 +169,7 @@ void can_change_state(struct net_device *dev, struct can_frame *cf, + + void can_put_echo_skb(struct sk_buff *skb, struct net_device *dev, + unsigned int idx); ++struct sk_buff *__can_get_echo_skb(struct net_device *dev, unsigned int idx, u8 *len_ptr); + unsigned int can_get_echo_skb(struct net_device *dev, unsigned int idx); + void can_free_echo_skb(struct net_device *dev, unsigned int idx); + +diff --git a/include/linux/can/rx-offload.h b/include/linux/can/rx-offload.h +index cb31683bbe15..8268811a697e 100644 +--- a/include/linux/can/rx-offload.h ++++ b/include/linux/can/rx-offload.h +@@ -41,7 +41,12 @@ int can_rx_offload_add_timestamp(struct net_device *dev, struct can_rx_offload * + int can_rx_offload_add_fifo(struct net_device *dev, struct can_rx_offload *offload, unsigned int weight); + int can_rx_offload_irq_offload_timestamp(struct can_rx_offload *offload, u64 reg); + int can_rx_offload_irq_offload_fifo(struct can_rx_offload *offload); +-int can_rx_offload_irq_queue_err_skb(struct can_rx_offload *offload, struct sk_buff *skb); ++int can_rx_offload_queue_sorted(struct can_rx_offload *offload, ++ struct sk_buff *skb, u32 timestamp); ++unsigned int can_rx_offload_get_echo_skb(struct can_rx_offload *offload, ++ unsigned int idx, u32 timestamp); ++int can_rx_offload_queue_tail(struct can_rx_offload *offload, ++ struct sk_buff *skb); + void can_rx_offload_reset(struct can_rx_offload *offload); + void can_rx_offload_del(struct can_rx_offload *offload); + void can_rx_offload_enable(struct can_rx_offload *offload); +diff --git a/include/linux/fsnotify_backend.h b/include/linux/fsnotify_backend.h +index b8f4182f42f1..4599d1c95f8c 100644 +--- a/include/linux/fsnotify_backend.h ++++ b/include/linux/fsnotify_backend.h +@@ -68,15 +68,20 @@ + + #define ALL_FSNOTIFY_PERM_EVENTS (FS_OPEN_PERM | FS_ACCESS_PERM) + ++/* Events that can be reported to backends */ + #define ALL_FSNOTIFY_EVENTS (FS_ACCESS | FS_MODIFY | FS_ATTRIB | \ + FS_CLOSE_WRITE | FS_CLOSE_NOWRITE | FS_OPEN | \ + FS_MOVED_FROM | FS_MOVED_TO | FS_CREATE | \ + FS_DELETE | FS_DELETE_SELF | FS_MOVE_SELF | \ + FS_UNMOUNT | FS_Q_OVERFLOW | FS_IN_IGNORED | \ +- FS_OPEN_PERM | FS_ACCESS_PERM | FS_EXCL_UNLINK | \ +- FS_ISDIR | FS_IN_ONESHOT | FS_DN_RENAME | \ ++ FS_OPEN_PERM | FS_ACCESS_PERM | FS_DN_RENAME) ++ ++/* Extra flags that may be reported with event or control handling of events */ ++#define ALL_FSNOTIFY_FLAGS (FS_EXCL_UNLINK | FS_ISDIR | FS_IN_ONESHOT | \ + FS_DN_MULTISHOT | FS_EVENT_ON_CHILD) + ++#define ALL_FSNOTIFY_BITS (ALL_FSNOTIFY_EVENTS | ALL_FSNOTIFY_FLAGS) ++ + struct fsnotify_group; + struct fsnotify_event; + struct fsnotify_mark; +diff --git a/include/linux/pfn_t.h b/include/linux/pfn_t.h +index 21713dc14ce2..673546ba7342 100644 +--- a/include/linux/pfn_t.h ++++ b/include/linux/pfn_t.h +@@ -10,7 +10,7 @@ + * PFN_DEV - pfn is not covered by system memmap by default + * PFN_MAP - pfn has a dynamic page mapping established by a device driver + */ +-#define PFN_FLAGS_MASK (((u64) ~PAGE_MASK) << (BITS_PER_LONG_LONG - PAGE_SHIFT)) ++#define PFN_FLAGS_MASK (((u64) (~PAGE_MASK)) << (BITS_PER_LONG_LONG - PAGE_SHIFT)) + #define PFN_SG_CHAIN (1ULL << (BITS_PER_LONG_LONG - 1)) + #define PFN_SG_LAST (1ULL << (BITS_PER_LONG_LONG - 2)) + #define PFN_DEV (1ULL << (BITS_PER_LONG_LONG - 3)) +diff --git a/include/net/sock.h b/include/net/sock.h +index c64a1cff9eb3..f18dbd6da906 100644 +--- a/include/net/sock.h ++++ b/include/net/sock.h +@@ -1491,6 +1491,7 @@ static inline void lock_sock(struct sock *sk) + lock_sock_nested(sk, 0); + } + ++void __release_sock(struct sock *sk); + void release_sock(struct sock *sk); + + /* BH context may only use the following locking interface. */ +diff --git a/kernel/debug/kdb/kdb_io.c b/kernel/debug/kdb/kdb_io.c +index ed5d34925ad0..6a4b41484afe 100644 +--- a/kernel/debug/kdb/kdb_io.c ++++ b/kernel/debug/kdb/kdb_io.c +@@ -216,7 +216,7 @@ static char *kdb_read(char *buffer, size_t bufsize) + int count; + int i; + int diag, dtab_count; +- int key; ++ int key, buf_size, ret; + + + diag = kdbgetintenv("DTABCOUNT", &dtab_count); +@@ -336,9 +336,8 @@ poll_again: + else + p_tmp = tmpbuffer; + len = strlen(p_tmp); +- count = kallsyms_symbol_complete(p_tmp, +- sizeof(tmpbuffer) - +- (p_tmp - tmpbuffer)); ++ buf_size = sizeof(tmpbuffer) - (p_tmp - tmpbuffer); ++ count = kallsyms_symbol_complete(p_tmp, buf_size); + if (tab == 2 && count > 0) { + kdb_printf("\n%d symbols are found.", count); + if (count > dtab_count) { +@@ -350,9 +349,13 @@ poll_again: + } + kdb_printf("\n"); + for (i = 0; i < count; i++) { +- if (WARN_ON(!kallsyms_symbol_next(p_tmp, i))) ++ ret = kallsyms_symbol_next(p_tmp, i, buf_size); ++ if (WARN_ON(!ret)) + break; +- kdb_printf("%s ", p_tmp); ++ if (ret != -E2BIG) ++ kdb_printf("%s ", p_tmp); ++ else ++ kdb_printf("%s... ", p_tmp); + *(p_tmp + len) = '\0'; + } + if (i >= dtab_count) +diff --git a/kernel/debug/kdb/kdb_private.h b/kernel/debug/kdb/kdb_private.h +index 1e5a502ba4a7..2118d8258b7c 100644 +--- a/kernel/debug/kdb/kdb_private.h ++++ b/kernel/debug/kdb/kdb_private.h +@@ -83,7 +83,7 @@ typedef struct __ksymtab { + unsigned long sym_start; + unsigned long sym_end; + } kdb_symtab_t; +-extern int kallsyms_symbol_next(char *prefix_name, int flag); ++extern int kallsyms_symbol_next(char *prefix_name, int flag, int buf_size); + extern int kallsyms_symbol_complete(char *prefix_name, int max_len); + + /* Exported Symbols for kernel loadable modules to use. */ +diff --git a/kernel/debug/kdb/kdb_support.c b/kernel/debug/kdb/kdb_support.c +index 987eb73284d2..b14b0925c184 100644 +--- a/kernel/debug/kdb/kdb_support.c ++++ b/kernel/debug/kdb/kdb_support.c +@@ -221,11 +221,13 @@ int kallsyms_symbol_complete(char *prefix_name, int max_len) + * Parameters: + * prefix_name prefix of a symbol name to lookup + * flag 0 means search from the head, 1 means continue search. ++ * buf_size maximum length that can be written to prefix_name ++ * buffer + * Returns: + * 1 if a symbol matches the given prefix. + * 0 if no string found + */ +-int kallsyms_symbol_next(char *prefix_name, int flag) ++int kallsyms_symbol_next(char *prefix_name, int flag, int buf_size) + { + int prefix_len = strlen(prefix_name); + static loff_t pos; +@@ -235,10 +237,8 @@ int kallsyms_symbol_next(char *prefix_name, int flag) + pos = 0; + + while ((name = kdb_walk_kallsyms(&pos))) { +- if (strncmp(name, prefix_name, prefix_len) == 0) { +- strncpy(prefix_name, name, strlen(name)+1); +- return 1; +- } ++ if (!strncmp(name, prefix_name, prefix_len)) ++ return strscpy(prefix_name, name, buf_size); + } + return 0; + } +diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c +index 0b760c1369f7..15301ed19da6 100644 +--- a/kernel/rcu/tree.c ++++ b/kernel/rcu/tree.c +@@ -2662,6 +2662,15 @@ void rcu_check_callbacks(int user) + rcu_bh_qs(); + } + rcu_preempt_check_callbacks(); ++ /* The load-acquire pairs with the store-release setting to true. */ ++ if (smp_load_acquire(this_cpu_ptr(&rcu_dynticks.rcu_urgent_qs))) { ++ /* Idle and userspace execution already are quiescent states. */ ++ if (!rcu_is_cpu_rrupt_from_idle() && !user) { ++ set_tsk_need_resched(current); ++ set_preempt_need_resched(); ++ } ++ __this_cpu_write(rcu_dynticks.rcu_urgent_qs, false); ++ } + if (rcu_pending()) + invoke_rcu_core(); + +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index 908c9cdae2f0..1162552dc3cc 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -5672,11 +5672,11 @@ static int wake_affine(struct sched_domain *sd, struct task_struct *p, + return target; + } + +-static unsigned long cpu_util_wake(int cpu, struct task_struct *p); ++static unsigned long cpu_util_without(int cpu, struct task_struct *p); + +-static unsigned long capacity_spare_wake(int cpu, struct task_struct *p) ++static unsigned long capacity_spare_without(int cpu, struct task_struct *p) + { +- return max_t(long, capacity_of(cpu) - cpu_util_wake(cpu, p), 0); ++ return max_t(long, capacity_of(cpu) - cpu_util_without(cpu, p), 0); + } + + /* +@@ -5736,7 +5736,7 @@ find_idlest_group(struct sched_domain *sd, struct task_struct *p, + + avg_load += cfs_rq_load_avg(&cpu_rq(i)->cfs); + +- spare_cap = capacity_spare_wake(i, p); ++ spare_cap = capacity_spare_without(i, p); + + if (spare_cap > max_spare_cap) + max_spare_cap = spare_cap; +@@ -5887,8 +5887,8 @@ static inline int find_idlest_cpu(struct sched_domain *sd, struct task_struct *p + return prev_cpu; + + /* +- * We need task's util for capacity_spare_wake, sync it up to prev_cpu's +- * last_update_time. ++ * We need task's util for capacity_spare_without, sync it up to ++ * prev_cpu's last_update_time. + */ + if (!(sd_flag & SD_BALANCE_FORK)) + sync_entity_load_avg(&p->se); +@@ -6214,10 +6214,19 @@ static inline unsigned long cpu_util(int cpu) + } + + /* +- * cpu_util_wake: Compute CPU utilization with any contributions from +- * the waking task p removed. ++ * cpu_util_without: compute cpu utilization without any contributions from *p ++ * @cpu: the CPU which utilization is requested ++ * @p: the task which utilization should be discounted ++ * ++ * The utilization of a CPU is defined by the utilization of tasks currently ++ * enqueued on that CPU as well as tasks which are currently sleeping after an ++ * execution on that CPU. ++ * ++ * This method returns the utilization of the specified CPU by discounting the ++ * utilization of the specified task, whenever the task is currently ++ * contributing to the CPU utilization. + */ +-static unsigned long cpu_util_wake(int cpu, struct task_struct *p) ++static unsigned long cpu_util_without(int cpu, struct task_struct *p) + { + struct cfs_rq *cfs_rq; + unsigned int util; +@@ -6229,7 +6238,7 @@ static unsigned long cpu_util_wake(int cpu, struct task_struct *p) + cfs_rq = &cpu_rq(cpu)->cfs; + util = READ_ONCE(cfs_rq->avg.util_avg); + +- /* Discount task's blocked util from CPU's util */ ++ /* Discount task's util from CPU's util */ + util -= min_t(unsigned int, util, task_util(p)); + + /* +@@ -6238,14 +6247,14 @@ static unsigned long cpu_util_wake(int cpu, struct task_struct *p) + * a) if *p is the only task sleeping on this CPU, then: + * cpu_util (== task_util) > util_est (== 0) + * and thus we return: +- * cpu_util_wake = (cpu_util - task_util) = 0 ++ * cpu_util_without = (cpu_util - task_util) = 0 + * + * b) if other tasks are SLEEPING on this CPU, which is now exiting + * IDLE, then: + * cpu_util >= task_util + * cpu_util > util_est (== 0) + * and thus we discount *p's blocked utilization to return: +- * cpu_util_wake = (cpu_util - task_util) >= 0 ++ * cpu_util_without = (cpu_util - task_util) >= 0 + * + * c) if other tasks are RUNNABLE on that CPU and + * util_est > cpu_util +@@ -6258,8 +6267,33 @@ static unsigned long cpu_util_wake(int cpu, struct task_struct *p) + * covered by the following code when estimated utilization is + * enabled. + */ +- if (sched_feat(UTIL_EST)) +- util = max(util, READ_ONCE(cfs_rq->avg.util_est.enqueued)); ++ if (sched_feat(UTIL_EST)) { ++ unsigned int estimated = ++ READ_ONCE(cfs_rq->avg.util_est.enqueued); ++ ++ /* ++ * Despite the following checks we still have a small window ++ * for a possible race, when an execl's select_task_rq_fair() ++ * races with LB's detach_task(): ++ * ++ * detach_task() ++ * p->on_rq = TASK_ON_RQ_MIGRATING; ++ * ---------------------------------- A ++ * deactivate_task() \ ++ * dequeue_task() + RaceTime ++ * util_est_dequeue() / ++ * ---------------------------------- B ++ * ++ * The additional check on "current == p" it's required to ++ * properly fix the execl regression and it helps in further ++ * reducing the chances for the above race. ++ */ ++ if (unlikely(task_on_rq_queued(p) || current == p)) { ++ estimated -= min_t(unsigned int, estimated, ++ (_task_util_est(p) | UTIL_AVG_UNCHANGED)); ++ } ++ util = max(util, estimated); ++ } + + /* + * Utilization (estimated) can exceed the CPU capacity, thus let's +diff --git a/mm/memory.c b/mm/memory.c +index c467102a5cbc..5c5df53dbdf9 100644 +--- a/mm/memory.c ++++ b/mm/memory.c +@@ -3745,10 +3745,36 @@ static vm_fault_t do_fault(struct vm_fault *vmf) + struct vm_area_struct *vma = vmf->vma; + vm_fault_t ret; + +- /* The VMA was not fully populated on mmap() or missing VM_DONTEXPAND */ +- if (!vma->vm_ops->fault) +- ret = VM_FAULT_SIGBUS; +- else if (!(vmf->flags & FAULT_FLAG_WRITE)) ++ /* ++ * The VMA was not fully populated on mmap() or missing VM_DONTEXPAND ++ */ ++ if (!vma->vm_ops->fault) { ++ /* ++ * If we find a migration pmd entry or a none pmd entry, which ++ * should never happen, return SIGBUS ++ */ ++ if (unlikely(!pmd_present(*vmf->pmd))) ++ ret = VM_FAULT_SIGBUS; ++ else { ++ vmf->pte = pte_offset_map_lock(vmf->vma->vm_mm, ++ vmf->pmd, ++ vmf->address, ++ &vmf->ptl); ++ /* ++ * Make sure this is not a temporary clearing of pte ++ * by holding ptl and checking again. A R/M/W update ++ * of pte involves: take ptl, clearing the pte so that ++ * we don't have concurrent modification by hardware ++ * followed by an update. ++ */ ++ if (unlikely(pte_none(*vmf->pte))) ++ ret = VM_FAULT_SIGBUS; ++ else ++ ret = VM_FAULT_NOPAGE; ++ ++ pte_unmap_unlock(vmf->pte, vmf->ptl); ++ } ++ } else if (!(vmf->flags & FAULT_FLAG_WRITE)) + ret = do_read_fault(vmf); + else if (!(vma->vm_flags & VM_SHARED)) + ret = do_cow_fault(vmf); +diff --git a/mm/page_alloc.c b/mm/page_alloc.c +index e2ef1c17942f..b721631d78ab 100644 +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -4055,17 +4055,6 @@ __alloc_pages_slowpath(gfp_t gfp_mask, unsigned int order, + unsigned int cpuset_mems_cookie; + int reserve_flags; + +- /* +- * In the slowpath, we sanity check order to avoid ever trying to +- * reclaim >= MAX_ORDER areas which will never succeed. Callers may +- * be using allocators in order of preference for an area that is +- * too large. +- */ +- if (order >= MAX_ORDER) { +- WARN_ON_ONCE(!(gfp_mask & __GFP_NOWARN)); +- return NULL; +- } +- + /* + * We also sanity check to catch abuse of atomic reserves being used by + * callers that are not in atomic context. +@@ -4359,6 +4348,15 @@ __alloc_pages_nodemask(gfp_t gfp_mask, unsigned int order, int preferred_nid, + gfp_t alloc_mask; /* The gfp_t that was actually used for allocation */ + struct alloc_context ac = { }; + ++ /* ++ * There are several places where we assume that the order value is sane ++ * so bail out early if the request is out of bound. ++ */ ++ if (unlikely(order >= MAX_ORDER)) { ++ WARN_ON_ONCE(!(gfp_mask & __GFP_NOWARN)); ++ return NULL; ++ } ++ + gfp_mask &= gfp_allowed_mask; + alloc_mask = gfp_mask; + if (!prepare_alloc_pages(gfp_mask, order, preferred_nid, nodemask, &ac, &alloc_mask, &alloc_flags)) +@@ -7690,6 +7688,14 @@ bool has_unmovable_pages(struct zone *zone, struct page *page, int count, + if (PageReserved(page)) + goto unmovable; + ++ /* ++ * If the zone is movable and we have ruled out all reserved ++ * pages then it should be reasonably safe to assume the rest ++ * is movable. ++ */ ++ if (zone_idx(zone) == ZONE_MOVABLE) ++ continue; ++ + /* + * Hugepages are not in LRU lists, but they're movable. + * We need not scan over tail pages bacause we don't +diff --git a/mm/shmem.c b/mm/shmem.c +index 446942677cd4..38d228a30fdc 100644 +--- a/mm/shmem.c ++++ b/mm/shmem.c +@@ -2610,9 +2610,7 @@ static loff_t shmem_file_llseek(struct file *file, loff_t offset, int whence) + inode_lock(inode); + /* We're holding i_mutex so we can access i_size directly */ + +- if (offset < 0) +- offset = -EINVAL; +- else if (offset >= inode->i_size) ++ if (offset < 0 || offset >= inode->i_size) + offset = -ENXIO; + else { + start = offset >> PAGE_SHIFT; +diff --git a/mm/slab.c b/mm/slab.c +index aa76a70e087e..d73c7a4820a4 100644 +--- a/mm/slab.c ++++ b/mm/slab.c +@@ -3675,6 +3675,8 @@ __do_kmalloc_node(size_t size, gfp_t flags, int node, unsigned long caller) + struct kmem_cache *cachep; + void *ret; + ++ if (unlikely(size > KMALLOC_MAX_CACHE_SIZE)) ++ return NULL; + cachep = kmalloc_slab(size, flags); + if (unlikely(ZERO_OR_NULL_PTR(cachep))) + return cachep; +@@ -3710,6 +3712,8 @@ static __always_inline void *__do_kmalloc(size_t size, gfp_t flags, + struct kmem_cache *cachep; + void *ret; + ++ if (unlikely(size > KMALLOC_MAX_CACHE_SIZE)) ++ return NULL; + cachep = kmalloc_slab(size, flags); + if (unlikely(ZERO_OR_NULL_PTR(cachep))) + return cachep; +diff --git a/mm/slab_common.c b/mm/slab_common.c +index fea3376f9816..3a7ac4f15194 100644 +--- a/mm/slab_common.c ++++ b/mm/slab_common.c +@@ -1027,18 +1027,18 @@ struct kmem_cache *kmalloc_slab(size_t size, gfp_t flags) + { + unsigned int index; + +- if (unlikely(size > KMALLOC_MAX_SIZE)) { +- WARN_ON_ONCE(!(flags & __GFP_NOWARN)); +- return NULL; +- } +- + if (size <= 192) { + if (!size) + return ZERO_SIZE_PTR; + + index = size_index[size_index_elem(size)]; +- } else ++ } else { ++ if (unlikely(size > KMALLOC_MAX_CACHE_SIZE)) { ++ WARN_ON(1); ++ return NULL; ++ } + index = fls(size - 1); ++ } + + #ifdef CONFIG_ZONE_DMA + if (unlikely((flags & GFP_DMA))) +diff --git a/mm/z3fold.c b/mm/z3fold.c +index 4b366d181f35..aee9b0b8d907 100644 +--- a/mm/z3fold.c ++++ b/mm/z3fold.c +@@ -99,6 +99,7 @@ struct z3fold_header { + #define NCHUNKS ((PAGE_SIZE - ZHDR_SIZE_ALIGNED) >> CHUNK_SHIFT) + + #define BUDDY_MASK (0x3) ++#define BUDDY_SHIFT 2 + + /** + * struct z3fold_pool - stores metadata for each z3fold pool +@@ -145,7 +146,7 @@ enum z3fold_page_flags { + MIDDLE_CHUNK_MAPPED, + NEEDS_COMPACTING, + PAGE_STALE, +- UNDER_RECLAIM ++ PAGE_CLAIMED, /* by either reclaim or free */ + }; + + /***************** +@@ -174,7 +175,7 @@ static struct z3fold_header *init_z3fold_page(struct page *page, + clear_bit(MIDDLE_CHUNK_MAPPED, &page->private); + clear_bit(NEEDS_COMPACTING, &page->private); + clear_bit(PAGE_STALE, &page->private); +- clear_bit(UNDER_RECLAIM, &page->private); ++ clear_bit(PAGE_CLAIMED, &page->private); + + spin_lock_init(&zhdr->page_lock); + kref_init(&zhdr->refcount); +@@ -223,8 +224,11 @@ static unsigned long encode_handle(struct z3fold_header *zhdr, enum buddy bud) + unsigned long handle; + + handle = (unsigned long)zhdr; +- if (bud != HEADLESS) +- handle += (bud + zhdr->first_num) & BUDDY_MASK; ++ if (bud != HEADLESS) { ++ handle |= (bud + zhdr->first_num) & BUDDY_MASK; ++ if (bud == LAST) ++ handle |= (zhdr->last_chunks << BUDDY_SHIFT); ++ } + return handle; + } + +@@ -234,6 +238,12 @@ static struct z3fold_header *handle_to_z3fold_header(unsigned long handle) + return (struct z3fold_header *)(handle & PAGE_MASK); + } + ++/* only for LAST bud, returns zero otherwise */ ++static unsigned short handle_to_chunks(unsigned long handle) ++{ ++ return (handle & ~PAGE_MASK) >> BUDDY_SHIFT; ++} ++ + /* + * (handle & BUDDY_MASK) < zhdr->first_num is possible in encode_handle + * but that doesn't matter. because the masking will result in the +@@ -720,37 +730,39 @@ static void z3fold_free(struct z3fold_pool *pool, unsigned long handle) + page = virt_to_page(zhdr); + + if (test_bit(PAGE_HEADLESS, &page->private)) { +- /* HEADLESS page stored */ +- bud = HEADLESS; +- } else { +- z3fold_page_lock(zhdr); +- bud = handle_to_buddy(handle); +- +- switch (bud) { +- case FIRST: +- zhdr->first_chunks = 0; +- break; +- case MIDDLE: +- zhdr->middle_chunks = 0; +- zhdr->start_middle = 0; +- break; +- case LAST: +- zhdr->last_chunks = 0; +- break; +- default: +- pr_err("%s: unknown bud %d\n", __func__, bud); +- WARN_ON(1); +- z3fold_page_unlock(zhdr); +- return; ++ /* if a headless page is under reclaim, just leave. ++ * NB: we use test_and_set_bit for a reason: if the bit ++ * has not been set before, we release this page ++ * immediately so we don't care about its value any more. ++ */ ++ if (!test_and_set_bit(PAGE_CLAIMED, &page->private)) { ++ spin_lock(&pool->lock); ++ list_del(&page->lru); ++ spin_unlock(&pool->lock); ++ free_z3fold_page(page); ++ atomic64_dec(&pool->pages_nr); + } ++ return; + } + +- if (bud == HEADLESS) { +- spin_lock(&pool->lock); +- list_del(&page->lru); +- spin_unlock(&pool->lock); +- free_z3fold_page(page); +- atomic64_dec(&pool->pages_nr); ++ /* Non-headless case */ ++ z3fold_page_lock(zhdr); ++ bud = handle_to_buddy(handle); ++ ++ switch (bud) { ++ case FIRST: ++ zhdr->first_chunks = 0; ++ break; ++ case MIDDLE: ++ zhdr->middle_chunks = 0; ++ break; ++ case LAST: ++ zhdr->last_chunks = 0; ++ break; ++ default: ++ pr_err("%s: unknown bud %d\n", __func__, bud); ++ WARN_ON(1); ++ z3fold_page_unlock(zhdr); + return; + } + +@@ -758,7 +770,7 @@ static void z3fold_free(struct z3fold_pool *pool, unsigned long handle) + atomic64_dec(&pool->pages_nr); + return; + } +- if (test_bit(UNDER_RECLAIM, &page->private)) { ++ if (test_bit(PAGE_CLAIMED, &page->private)) { + z3fold_page_unlock(zhdr); + return; + } +@@ -836,20 +848,30 @@ static int z3fold_reclaim_page(struct z3fold_pool *pool, unsigned int retries) + } + list_for_each_prev(pos, &pool->lru) { + page = list_entry(pos, struct page, lru); ++ ++ /* this bit could have been set by free, in which case ++ * we pass over to the next page in the pool. ++ */ ++ if (test_and_set_bit(PAGE_CLAIMED, &page->private)) ++ continue; ++ ++ zhdr = page_address(page); + if (test_bit(PAGE_HEADLESS, &page->private)) +- /* candidate found */ + break; + +- zhdr = page_address(page); +- if (!z3fold_page_trylock(zhdr)) ++ if (!z3fold_page_trylock(zhdr)) { ++ zhdr = NULL; + continue; /* can't evict at this point */ ++ } + kref_get(&zhdr->refcount); + list_del_init(&zhdr->buddy); + zhdr->cpu = -1; +- set_bit(UNDER_RECLAIM, &page->private); + break; + } + ++ if (!zhdr) ++ break; ++ + list_del_init(&page->lru); + spin_unlock(&pool->lock); + +@@ -898,6 +920,7 @@ next: + if (test_bit(PAGE_HEADLESS, &page->private)) { + if (ret == 0) { + free_z3fold_page(page); ++ atomic64_dec(&pool->pages_nr); + return 0; + } + spin_lock(&pool->lock); +@@ -905,7 +928,7 @@ next: + spin_unlock(&pool->lock); + } else { + z3fold_page_lock(zhdr); +- clear_bit(UNDER_RECLAIM, &page->private); ++ clear_bit(PAGE_CLAIMED, &page->private); + if (kref_put(&zhdr->refcount, + release_z3fold_page_locked)) { + atomic64_dec(&pool->pages_nr); +@@ -964,7 +987,7 @@ static void *z3fold_map(struct z3fold_pool *pool, unsigned long handle) + set_bit(MIDDLE_CHUNK_MAPPED, &page->private); + break; + case LAST: +- addr += PAGE_SIZE - (zhdr->last_chunks << CHUNK_SHIFT); ++ addr += PAGE_SIZE - (handle_to_chunks(handle) << CHUNK_SHIFT); + break; + default: + pr_err("unknown buddy id %d\n", buddy); +diff --git a/net/can/raw.c b/net/can/raw.c +index 1051eee82581..3aab7664933f 100644 +--- a/net/can/raw.c ++++ b/net/can/raw.c +@@ -745,18 +745,19 @@ static int raw_sendmsg(struct socket *sock, struct msghdr *msg, size_t size) + } else + ifindex = ro->ifindex; + +- if (ro->fd_frames) { ++ dev = dev_get_by_index(sock_net(sk), ifindex); ++ if (!dev) ++ return -ENXIO; ++ ++ err = -EINVAL; ++ if (ro->fd_frames && dev->mtu == CANFD_MTU) { + if (unlikely(size != CANFD_MTU && size != CAN_MTU)) +- return -EINVAL; ++ goto put_dev; + } else { + if (unlikely(size != CAN_MTU)) +- return -EINVAL; ++ goto put_dev; + } + +- dev = dev_get_by_index(sock_net(sk), ifindex); +- if (!dev) +- return -ENXIO; +- + skb = sock_alloc_send_skb(sk, size + sizeof(struct can_skb_priv), + msg->msg_flags & MSG_DONTWAIT, &err); + if (!skb) +diff --git a/net/core/sock.c b/net/core/sock.c +index 3730eb855095..748765e35423 100644 +--- a/net/core/sock.c ++++ b/net/core/sock.c +@@ -2317,7 +2317,7 @@ static void __lock_sock(struct sock *sk) + finish_wait(&sk->sk_lock.wq, &wait); + } + +-static void __release_sock(struct sock *sk) ++void __release_sock(struct sock *sk) + __releases(&sk->sk_lock.slock) + __acquires(&sk->sk_lock.slock) + { +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index bbd07736fb0f..a32a0f4cc138 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -2403,16 +2403,10 @@ adjudge_to_death: + sock_hold(sk); + sock_orphan(sk); + +- /* It is the last release_sock in its life. It will remove backlog. */ +- release_sock(sk); +- +- +- /* Now socket is owned by kernel and we acquire BH lock +- * to finish close. No need to check for user refs. +- */ + local_bh_disable(); + bh_lock_sock(sk); +- WARN_ON(sock_owned_by_user(sk)); ++ /* remove backlog if any, without releasing ownership. */ ++ __release_sock(sk); + + percpu_counter_inc(sk->sk_prot->orphan_count); + +@@ -2481,6 +2475,7 @@ adjudge_to_death: + out: + bh_unlock_sock(sk); + local_bh_enable(); ++ release_sock(sk); + sock_put(sk); + } + EXPORT_SYMBOL(tcp_close); +diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c +index 1beeea9549fa..b99e73a7e7e0 100644 +--- a/net/llc/af_llc.c ++++ b/net/llc/af_llc.c +@@ -730,7 +730,6 @@ static int llc_ui_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, + struct sk_buff *skb = NULL; + struct sock *sk = sock->sk; + struct llc_sock *llc = llc_sk(sk); +- unsigned long cpu_flags; + size_t copied = 0; + u32 peek_seq = 0; + u32 *seq, skb_len; +@@ -855,9 +854,8 @@ static int llc_ui_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, + goto copy_uaddr; + + if (!(flags & MSG_PEEK)) { +- spin_lock_irqsave(&sk->sk_receive_queue.lock, cpu_flags); +- sk_eat_skb(sk, skb); +- spin_unlock_irqrestore(&sk->sk_receive_queue.lock, cpu_flags); ++ skb_unlink(skb, &sk->sk_receive_queue); ++ kfree_skb(skb); + *seq = 0; + } + +@@ -878,9 +876,8 @@ copy_uaddr: + llc_cmsg_rcv(msg, skb); + + if (!(flags & MSG_PEEK)) { +- spin_lock_irqsave(&sk->sk_receive_queue.lock, cpu_flags); +- sk_eat_skb(sk, skb); +- spin_unlock_irqrestore(&sk->sk_receive_queue.lock, cpu_flags); ++ skb_unlink(skb, &sk->sk_receive_queue); ++ kfree_skb(skb); + *seq = 0; + } + +diff --git a/net/sctp/associola.c b/net/sctp/associola.c +index a827a1f562bf..6a28b96e779e 100644 +--- a/net/sctp/associola.c ++++ b/net/sctp/associola.c +@@ -499,8 +499,9 @@ void sctp_assoc_set_primary(struct sctp_association *asoc, + void sctp_assoc_rm_peer(struct sctp_association *asoc, + struct sctp_transport *peer) + { +- struct list_head *pos; +- struct sctp_transport *transport; ++ struct sctp_transport *transport; ++ struct list_head *pos; ++ struct sctp_chunk *ch; + + pr_debug("%s: association:%p addr:%pISpc\n", + __func__, asoc, &peer->ipaddr.sa); +@@ -564,7 +565,6 @@ void sctp_assoc_rm_peer(struct sctp_association *asoc, + */ + if (!list_empty(&peer->transmitted)) { + struct sctp_transport *active = asoc->peer.active_path; +- struct sctp_chunk *ch; + + /* Reset the transport of each chunk on this list */ + list_for_each_entry(ch, &peer->transmitted, +@@ -586,6 +586,10 @@ void sctp_assoc_rm_peer(struct sctp_association *asoc, + sctp_transport_hold(active); + } + ++ list_for_each_entry(ch, &asoc->outqueue.out_chunk_list, list) ++ if (ch->transport == peer) ++ ch->transport = NULL; ++ + asoc->peer.transport_count--; + + sctp_transport_free(peer); +diff --git a/net/sunrpc/auth_generic.c b/net/sunrpc/auth_generic.c +index f1df9837f1ac..1ac08dcbf85d 100644 +--- a/net/sunrpc/auth_generic.c ++++ b/net/sunrpc/auth_generic.c +@@ -281,13 +281,7 @@ static bool generic_key_to_expire(struct rpc_cred *cred) + { + struct auth_cred *acred = &container_of(cred, struct generic_cred, + gc_base)->acred; +- bool ret; +- +- get_rpccred(cred); +- ret = test_bit(RPC_CRED_KEY_EXPIRE_SOON, &acred->ac_flags); +- put_rpccred(cred); +- +- return ret; ++ return test_bit(RPC_CRED_KEY_EXPIRE_SOON, &acred->ac_flags); + } + + static const struct rpc_credops generic_credops = { +diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c +index e9394e7adc84..f4eadd3f7350 100644 +--- a/security/selinux/ss/policydb.c ++++ b/security/selinux/ss/policydb.c +@@ -1101,7 +1101,7 @@ static int str_read(char **strp, gfp_t flags, void *fp, u32 len) + if ((len == 0) || (len == (u32)-1)) + return -EINVAL; + +- str = kmalloc(len + 1, flags); ++ str = kmalloc(len + 1, flags | __GFP_NOWARN); + if (!str) + return -ENOMEM; + +diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c +index f8d4a419f3af..467039b342b5 100644 +--- a/sound/core/oss/pcm_oss.c ++++ b/sound/core/oss/pcm_oss.c +@@ -1062,8 +1062,8 @@ static int snd_pcm_oss_change_params_locked(struct snd_pcm_substream *substream) + runtime->oss.channels = params_channels(params); + runtime->oss.rate = params_rate(params); + +- vfree(runtime->oss.buffer); +- runtime->oss.buffer = vmalloc(runtime->oss.period_bytes); ++ kvfree(runtime->oss.buffer); ++ runtime->oss.buffer = kvzalloc(runtime->oss.period_bytes, GFP_KERNEL); + if (!runtime->oss.buffer) { + err = -ENOMEM; + goto failure; +@@ -2328,7 +2328,7 @@ static void snd_pcm_oss_release_substream(struct snd_pcm_substream *substream) + { + struct snd_pcm_runtime *runtime; + runtime = substream->runtime; +- vfree(runtime->oss.buffer); ++ kvfree(runtime->oss.buffer); + runtime->oss.buffer = NULL; + #ifdef CONFIG_SND_PCM_OSS_PLUGINS + snd_pcm_oss_plugin_clear(substream); +diff --git a/sound/core/oss/pcm_plugin.c b/sound/core/oss/pcm_plugin.c +index 0391cb1a4f19..71571d992159 100644 +--- a/sound/core/oss/pcm_plugin.c ++++ b/sound/core/oss/pcm_plugin.c +@@ -66,8 +66,8 @@ static int snd_pcm_plugin_alloc(struct snd_pcm_plugin *plugin, snd_pcm_uframes_t + return -ENXIO; + size /= 8; + if (plugin->buf_frames < frames) { +- vfree(plugin->buf); +- plugin->buf = vmalloc(size); ++ kvfree(plugin->buf); ++ plugin->buf = kvzalloc(size, GFP_KERNEL); + plugin->buf_frames = frames; + } + if (!plugin->buf) { +@@ -191,7 +191,7 @@ int snd_pcm_plugin_free(struct snd_pcm_plugin *plugin) + if (plugin->private_free) + plugin->private_free(plugin); + kfree(plugin->buf_channels); +- vfree(plugin->buf); ++ kvfree(plugin->buf); + kfree(plugin); + return 0; + } +diff --git a/tools/power/cpupower/bench/Makefile b/tools/power/cpupower/bench/Makefile +index d79ab161cc75..f68b4bc55273 100644 +--- a/tools/power/cpupower/bench/Makefile ++++ b/tools/power/cpupower/bench/Makefile +@@ -9,7 +9,7 @@ endif + ifeq ($(strip $(STATIC)),true) + LIBS = -L../ -L$(OUTPUT) -lm + OBJS = $(OUTPUT)main.o $(OUTPUT)parse.o $(OUTPUT)system.o $(OUTPUT)benchmark.o \ +- $(OUTPUT)../lib/cpufreq.o $(OUTPUT)../lib/sysfs.o ++ $(OUTPUT)../lib/cpufreq.o $(OUTPUT)../lib/cpupower.o + else + LIBS = -L../ -L$(OUTPUT) -lm -lcpupower + OBJS = $(OUTPUT)main.o $(OUTPUT)parse.o $(OUTPUT)system.o $(OUTPUT)benchmark.o +diff --git a/tools/power/cpupower/lib/cpufreq.c b/tools/power/cpupower/lib/cpufreq.c +index 1b993fe1ce23..0c0f3e3f0d80 100644 +--- a/tools/power/cpupower/lib/cpufreq.c ++++ b/tools/power/cpupower/lib/cpufreq.c +@@ -28,7 +28,7 @@ static unsigned int sysfs_cpufreq_read_file(unsigned int cpu, const char *fname, + + snprintf(path, sizeof(path), PATH_TO_CPU "cpu%u/cpufreq/%s", + cpu, fname); +- return sysfs_read_file(path, buf, buflen); ++ return cpupower_read_sysfs(path, buf, buflen); + } + + /* helper function to write a new value to a /sys file */ +diff --git a/tools/power/cpupower/lib/cpuidle.c b/tools/power/cpupower/lib/cpuidle.c +index 9bd4c7655fdb..852d25462388 100644 +--- a/tools/power/cpupower/lib/cpuidle.c ++++ b/tools/power/cpupower/lib/cpuidle.c +@@ -319,7 +319,7 @@ static unsigned int sysfs_cpuidle_read_file(const char *fname, char *buf, + + snprintf(path, sizeof(path), PATH_TO_CPU "cpuidle/%s", fname); + +- return sysfs_read_file(path, buf, buflen); ++ return cpupower_read_sysfs(path, buf, buflen); + } + + +diff --git a/tools/power/cpupower/lib/cpupower.c b/tools/power/cpupower/lib/cpupower.c +index 9c395ec924de..9711d628b0f4 100644 +--- a/tools/power/cpupower/lib/cpupower.c ++++ b/tools/power/cpupower/lib/cpupower.c +@@ -15,7 +15,7 @@ + #include "cpupower.h" + #include "cpupower_intern.h" + +-unsigned int sysfs_read_file(const char *path, char *buf, size_t buflen) ++unsigned int cpupower_read_sysfs(const char *path, char *buf, size_t buflen) + { + int fd; + ssize_t numread; +@@ -95,7 +95,7 @@ static int sysfs_topology_read_file(unsigned int cpu, const char *fname, int *re + + snprintf(path, sizeof(path), PATH_TO_CPU "cpu%u/topology/%s", + cpu, fname); +- if (sysfs_read_file(path, linebuf, MAX_LINE_LEN) == 0) ++ if (cpupower_read_sysfs(path, linebuf, MAX_LINE_LEN) == 0) + return -1; + *result = strtol(linebuf, &endp, 0); + if (endp == linebuf || errno == ERANGE) +diff --git a/tools/power/cpupower/lib/cpupower_intern.h b/tools/power/cpupower/lib/cpupower_intern.h +index 92affdfbe417..4887c76d23f8 100644 +--- a/tools/power/cpupower/lib/cpupower_intern.h ++++ b/tools/power/cpupower/lib/cpupower_intern.h +@@ -3,4 +3,4 @@ + #define MAX_LINE_LEN 4096 + #define SYSFS_PATH_MAX 255 + +-unsigned int sysfs_read_file(const char *path, char *buf, size_t buflen); ++unsigned int cpupower_read_sysfs(const char *path, char *buf, size_t buflen); +diff --git a/tools/testing/nvdimm/test/nfit.c b/tools/testing/nvdimm/test/nfit.c +index cffc2c5a778d..ec50d2a95076 100644 +--- a/tools/testing/nvdimm/test/nfit.c ++++ b/tools/testing/nvdimm/test/nfit.c +@@ -139,8 +139,8 @@ static u32 handle[] = { + [6] = NFIT_DIMM_HANDLE(1, 0, 0, 0, 1), + }; + +-static unsigned long dimm_fail_cmd_flags[NUM_DCR]; +-static int dimm_fail_cmd_code[NUM_DCR]; ++static unsigned long dimm_fail_cmd_flags[ARRAY_SIZE(handle)]; ++static int dimm_fail_cmd_code[ARRAY_SIZE(handle)]; + + static const struct nd_intel_smart smart_def = { + .flags = ND_INTEL_SMART_HEALTH_VALID +@@ -203,7 +203,7 @@ struct nfit_test { + unsigned long deadline; + spinlock_t lock; + } ars_state; +- struct device *dimm_dev[NUM_DCR]; ++ struct device *dimm_dev[ARRAY_SIZE(handle)]; + struct nd_intel_smart *smart; + struct nd_intel_smart_threshold *smart_threshold; + struct badrange badrange; +@@ -2678,7 +2678,7 @@ static int nfit_test_probe(struct platform_device *pdev) + u32 nfit_handle = __to_nfit_memdev(nfit_mem)->device_handle; + int i; + +- for (i = 0; i < NUM_DCR; i++) ++ for (i = 0; i < ARRAY_SIZE(handle); i++) + if (nfit_handle == handle[i]) + dev_set_drvdata(nfit_test->dimm_dev[i], + nfit_mem);