commit: daab833868f848c96d0cab44ab916432aa75011f Author: Alice Ferrazzi <alicef <AT> gentoo <DOT> org> AuthorDate: Thu Dec 14 08:57:40 2017 +0000 Commit: Alice Ferrazzi <alicef <AT> gentoo <DOT> org> CommitDate: Thu Dec 14 08:57:40 2017 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=daab8338
Added linux patch 4.9.69 0000_README | 4 + 1068_linux-4.9.69.patch | 4127 +++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 4131 insertions(+) diff --git a/0000_README b/0000_README index 7f2750d..4f00249 100644 --- a/0000_README +++ b/0000_README @@ -315,6 +315,10 @@ Patch: 1067_linux-4.9.68.patch From: http://www.kernel.org Desc: Linux 4.9.68 +Patch: 1068_linux-4.9.69.patch +From: http://www.kernel.org +Desc: Linux 4.9.69 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1068_linux-4.9.69.patch b/1068_linux-4.9.69.patch new file mode 100644 index 0000000..8a9fa5e --- /dev/null +++ b/1068_linux-4.9.69.patch @@ -0,0 +1,4127 @@ +diff --git a/Documentation/devicetree/bindings/usb/usb-device.txt b/Documentation/devicetree/bindings/usb/usb-device.txt +index 1c35e7b665e1..03ab8f5eab40 100644 +--- a/Documentation/devicetree/bindings/usb/usb-device.txt ++++ b/Documentation/devicetree/bindings/usb/usb-device.txt +@@ -11,7 +11,7 @@ Required properties: + be used, but a device adhering to this binding may leave out all except + for usbVID,PID. + - reg: the port number which this device is connecting to, the range +- is 1-31. ++ is 1-255. + + Example: + +diff --git a/Makefile b/Makefile +index dfe17af517b2..8f2819bf8135 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 9 +-SUBLEVEL = 68 ++SUBLEVEL = 69 + EXTRAVERSION = + NAME = Roaring Lionus + +diff --git a/arch/arm/include/asm/assembler.h b/arch/arm/include/asm/assembler.h +index 68b06f9c65de..12f99fd2e3b2 100644 +--- a/arch/arm/include/asm/assembler.h ++++ b/arch/arm/include/asm/assembler.h +@@ -516,4 +516,22 @@ THUMB( orr \reg , \reg , #PSR_T_BIT ) + #endif + .endm + ++ .macro bug, msg, line ++#ifdef CONFIG_THUMB2_KERNEL ++1: .inst 0xde02 ++#else ++1: .inst 0xe7f001f2 ++#endif ++#ifdef CONFIG_DEBUG_BUGVERBOSE ++ .pushsection .rodata.str, "aMS", %progbits, 1 ++2: .asciz "\msg" ++ .popsection ++ .pushsection __bug_table, "aw" ++ .align 2 ++ .word 1b, 2b ++ .hword \line ++ .popsection ++#endif ++ .endm ++ + #endif /* __ASM_ASSEMBLER_H__ */ +diff --git a/arch/arm/include/asm/kvm_arm.h b/arch/arm/include/asm/kvm_arm.h +index e22089fb44dc..98d6de177b7a 100644 +--- a/arch/arm/include/asm/kvm_arm.h ++++ b/arch/arm/include/asm/kvm_arm.h +@@ -161,8 +161,7 @@ + #else + #define VTTBR_X (5 - KVM_T0SZ) + #endif +-#define VTTBR_BADDR_SHIFT (VTTBR_X - 1) +-#define VTTBR_BADDR_MASK (((_AC(1, ULL) << (40 - VTTBR_X)) - 1) << VTTBR_BADDR_SHIFT) ++#define VTTBR_BADDR_MASK (((_AC(1, ULL) << (40 - VTTBR_X)) - 1) << VTTBR_X) + #define VTTBR_VMID_SHIFT _AC(48, ULL) + #define VTTBR_VMID_MASK(size) (_AT(u64, (1 << size) - 1) << VTTBR_VMID_SHIFT) + +@@ -209,6 +208,7 @@ + #define HSR_EC_IABT_HYP (0x21) + #define HSR_EC_DABT (0x24) + #define HSR_EC_DABT_HYP (0x25) ++#define HSR_EC_MAX (0x3f) + + #define HSR_WFI_IS_WFE (_AC(1, UL) << 0) + +diff --git a/arch/arm/include/asm/uaccess.h b/arch/arm/include/asm/uaccess.h +index 1f59ea051bab..b7e0125c0bbf 100644 +--- a/arch/arm/include/asm/uaccess.h ++++ b/arch/arm/include/asm/uaccess.h +@@ -478,11 +478,10 @@ extern unsigned long __must_check + arm_copy_from_user(void *to, const void __user *from, unsigned long n); + + static inline unsigned long __must_check +-__copy_from_user(void *to, const void __user *from, unsigned long n) ++__arch_copy_from_user(void *to, const void __user *from, unsigned long n) + { + unsigned int __ua_flags; + +- check_object_size(to, n, false); + __ua_flags = uaccess_save_and_enable(); + n = arm_copy_from_user(to, from, n); + uaccess_restore(__ua_flags); +@@ -495,18 +494,15 @@ extern unsigned long __must_check + __copy_to_user_std(void __user *to, const void *from, unsigned long n); + + static inline unsigned long __must_check +-__copy_to_user(void __user *to, const void *from, unsigned long n) ++__arch_copy_to_user(void __user *to, const void *from, unsigned long n) + { + #ifndef CONFIG_UACCESS_WITH_MEMCPY + unsigned int __ua_flags; +- +- check_object_size(from, n, true); + __ua_flags = uaccess_save_and_enable(); + n = arm_copy_to_user(to, from, n); + uaccess_restore(__ua_flags); + return n; + #else +- check_object_size(from, n, true); + return arm_copy_to_user(to, from, n); + #endif + } +@@ -526,25 +522,49 @@ __clear_user(void __user *addr, unsigned long n) + } + + #else +-#define __copy_from_user(to, from, n) (memcpy(to, (void __force *)from, n), 0) +-#define __copy_to_user(to, from, n) (memcpy((void __force *)to, from, n), 0) ++#define __arch_copy_from_user(to, from, n) \ ++ (memcpy(to, (void __force *)from, n), 0) ++#define __arch_copy_to_user(to, from, n) \ ++ (memcpy((void __force *)to, from, n), 0) + #define __clear_user(addr, n) (memset((void __force *)addr, 0, n), 0) + #endif + +-static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n) ++static inline unsigned long __must_check ++__copy_from_user(void *to, const void __user *from, unsigned long n) ++{ ++ check_object_size(to, n, false); ++ return __arch_copy_from_user(to, from, n); ++} ++ ++static inline unsigned long __must_check ++copy_from_user(void *to, const void __user *from, unsigned long n) + { + unsigned long res = n; ++ ++ check_object_size(to, n, false); ++ + if (likely(access_ok(VERIFY_READ, from, n))) +- res = __copy_from_user(to, from, n); ++ res = __arch_copy_from_user(to, from, n); + if (unlikely(res)) + memset(to + (n - res), 0, res); + return res; + } + +-static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n) ++static inline unsigned long __must_check ++__copy_to_user(void __user *to, const void *from, unsigned long n) + { ++ check_object_size(from, n, true); ++ ++ return __arch_copy_to_user(to, from, n); ++} ++ ++static inline unsigned long __must_check ++copy_to_user(void __user *to, const void *from, unsigned long n) ++{ ++ check_object_size(from, n, true); ++ + if (access_ok(VERIFY_WRITE, to, n)) +- n = __copy_to_user(to, from, n); ++ n = __arch_copy_to_user(to, from, n); + return n; + } + +diff --git a/arch/arm/kernel/entry-header.S b/arch/arm/kernel/entry-header.S +index 6391728c8f03..e056c9a9aa9d 100644 +--- a/arch/arm/kernel/entry-header.S ++++ b/arch/arm/kernel/entry-header.S +@@ -299,6 +299,8 @@ + mov r2, sp + ldr r1, [r2, #\offset + S_PSR] @ get calling cpsr + ldr lr, [r2, #\offset + S_PC]! @ get pc ++ tst r1, #PSR_I_BIT | 0x0f ++ bne 1f + msr spsr_cxsf, r1 @ save in spsr_svc + #if defined(CONFIG_CPU_V6) || defined(CONFIG_CPU_32v6K) + @ We must avoid clrex due to Cortex-A15 erratum #830321 +@@ -313,6 +315,7 @@ + @ after ldm {}^ + add sp, sp, #\offset + PT_REGS_SIZE + movs pc, lr @ return & move spsr_svc into cpsr ++1: bug "Returning to usermode but unexpected PSR bits set?", \@ + #elif defined(CONFIG_CPU_V7M) + @ V7M restore. + @ Note that we don't need to do clrex here as clearing the local +@@ -328,6 +331,8 @@ + ldr r1, [sp, #\offset + S_PSR] @ get calling cpsr + ldr lr, [sp, #\offset + S_PC] @ get pc + add sp, sp, #\offset + S_SP ++ tst r1, #PSR_I_BIT | 0x0f ++ bne 1f + msr spsr_cxsf, r1 @ save in spsr_svc + + @ We must avoid clrex due to Cortex-A15 erratum #830321 +@@ -340,6 +345,7 @@ + .endif + add sp, sp, #PT_REGS_SIZE - S_SP + movs pc, lr @ return & move spsr_svc into cpsr ++1: bug "Returning to usermode but unexpected PSR bits set?", \@ + #endif /* !CONFIG_THUMB2_KERNEL */ + .endm + +diff --git a/arch/arm/kvm/handle_exit.c b/arch/arm/kvm/handle_exit.c +index 066b6d4508ce..42f5daf715d0 100644 +--- a/arch/arm/kvm/handle_exit.c ++++ b/arch/arm/kvm/handle_exit.c +@@ -79,7 +79,19 @@ static int kvm_handle_wfx(struct kvm_vcpu *vcpu, struct kvm_run *run) + return 1; + } + ++static int kvm_handle_unknown_ec(struct kvm_vcpu *vcpu, struct kvm_run *run) ++{ ++ u32 hsr = kvm_vcpu_get_hsr(vcpu); ++ ++ kvm_pr_unimpl("Unknown exception class: hsr: %#08x\n", ++ hsr); ++ ++ kvm_inject_undefined(vcpu); ++ return 1; ++} ++ + static exit_handle_fn arm_exit_handlers[] = { ++ [0 ... HSR_EC_MAX] = kvm_handle_unknown_ec, + [HSR_EC_WFI] = kvm_handle_wfx, + [HSR_EC_CP15_32] = kvm_handle_cp15_32, + [HSR_EC_CP15_64] = kvm_handle_cp15_64, +@@ -98,13 +110,6 @@ static exit_handle_fn kvm_get_exit_handler(struct kvm_vcpu *vcpu) + { + u8 hsr_ec = kvm_vcpu_trap_get_class(vcpu); + +- if (hsr_ec >= ARRAY_SIZE(arm_exit_handlers) || +- !arm_exit_handlers[hsr_ec]) { +- kvm_err("Unknown exception class: hsr: %#08x\n", +- (unsigned int)kvm_vcpu_get_hsr(vcpu)); +- BUG(); +- } +- + return arm_exit_handlers[hsr_ec]; + } + +diff --git a/arch/arm/mach-omap2/gpmc-onenand.c b/arch/arm/mach-omap2/gpmc-onenand.c +index 8633c703546a..2944af820558 100644 +--- a/arch/arm/mach-omap2/gpmc-onenand.c ++++ b/arch/arm/mach-omap2/gpmc-onenand.c +@@ -367,7 +367,7 @@ static int gpmc_onenand_setup(void __iomem *onenand_base, int *freq_ptr) + return ret; + } + +-void gpmc_onenand_init(struct omap_onenand_platform_data *_onenand_data) ++int gpmc_onenand_init(struct omap_onenand_platform_data *_onenand_data) + { + int err; + struct device *dev = &gpmc_onenand_device.dev; +@@ -393,15 +393,17 @@ void gpmc_onenand_init(struct omap_onenand_platform_data *_onenand_data) + if (err < 0) { + dev_err(dev, "Cannot request GPMC CS %d, error %d\n", + gpmc_onenand_data->cs, err); +- return; ++ return err; + } + + gpmc_onenand_resource.end = gpmc_onenand_resource.start + + ONENAND_IO_SIZE - 1; + +- if (platform_device_register(&gpmc_onenand_device) < 0) { ++ err = platform_device_register(&gpmc_onenand_device); ++ if (err) { + dev_err(dev, "Unable to register OneNAND device\n"); + gpmc_cs_free(gpmc_onenand_data->cs); +- return; + } ++ ++ return err; + } +diff --git a/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c b/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c +index 1cc4a6f3954e..bca54154e14f 100644 +--- a/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c ++++ b/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c +@@ -3828,16 +3828,20 @@ static struct omap_hwmod_ocp_if *omap3xxx_dss_hwmod_ocp_ifs[] __initdata = { + * Return: 0 if device named @dev_name is not likely to be accessible, + * or 1 if it is likely to be accessible. + */ +-static int __init omap3xxx_hwmod_is_hs_ip_block_usable(struct device_node *bus, +- const char *dev_name) ++static bool __init omap3xxx_hwmod_is_hs_ip_block_usable(struct device_node *bus, ++ const char *dev_name) + { ++ struct device_node *node; ++ bool available; ++ + if (!bus) +- return (omap_type() == OMAP2_DEVICE_TYPE_GP) ? 1 : 0; ++ return omap_type() == OMAP2_DEVICE_TYPE_GP; + +- if (of_device_is_available(of_find_node_by_name(bus, dev_name))) +- return 1; ++ node = of_get_child_by_name(bus, dev_name); ++ available = of_device_is_available(node); ++ of_node_put(node); + +- return 0; ++ return available; + } + + int __init omap3xxx_hwmod_init(void) +@@ -3906,15 +3910,20 @@ int __init omap3xxx_hwmod_init(void) + + if (h_sham && omap3xxx_hwmod_is_hs_ip_block_usable(bus, "sham")) { + r = omap_hwmod_register_links(h_sham); +- if (r < 0) ++ if (r < 0) { ++ of_node_put(bus); + return r; ++ } + } + + if (h_aes && omap3xxx_hwmod_is_hs_ip_block_usable(bus, "aes")) { + r = omap_hwmod_register_links(h_aes); +- if (r < 0) ++ if (r < 0) { ++ of_node_put(bus); + return r; ++ } + } ++ of_node_put(bus); + + /* + * Register hwmod links specific to certain ES levels of a +diff --git a/arch/arm64/include/asm/kvm_arm.h b/arch/arm64/include/asm/kvm_arm.h +index 2a2752b5b6aa..0dbc1c6ab7dc 100644 +--- a/arch/arm64/include/asm/kvm_arm.h ++++ b/arch/arm64/include/asm/kvm_arm.h +@@ -170,8 +170,7 @@ + #define VTCR_EL2_FLAGS (VTCR_EL2_COMMON_BITS | VTCR_EL2_TGRAN_FLAGS) + #define VTTBR_X (VTTBR_X_TGRAN_MAGIC - VTCR_EL2_T0SZ_IPA) + +-#define VTTBR_BADDR_SHIFT (VTTBR_X - 1) +-#define VTTBR_BADDR_MASK (((UL(1) << (PHYS_MASK_SHIFT - VTTBR_X)) - 1) << VTTBR_BADDR_SHIFT) ++#define VTTBR_BADDR_MASK (((UL(1) << (PHYS_MASK_SHIFT - VTTBR_X)) - 1) << VTTBR_X) + #define VTTBR_VMID_SHIFT (UL(48)) + #define VTTBR_VMID_MASK(size) (_AT(u64, (1 << size) - 1) << VTTBR_VMID_SHIFT) + +diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c +index 01753cd7d3f0..0e7394915c70 100644 +--- a/arch/arm64/kernel/process.c ++++ b/arch/arm64/kernel/process.c +@@ -255,6 +255,15 @@ int copy_thread(unsigned long clone_flags, unsigned long stack_start, + + memset(&p->thread.cpu_context, 0, sizeof(struct cpu_context)); + ++ /* ++ * In case p was allocated the same task_struct pointer as some ++ * other recently-exited task, make sure p is disassociated from ++ * any cpu that may have run that now-exited task recently. ++ * Otherwise we could erroneously skip reloading the FPSIMD ++ * registers for p. ++ */ ++ fpsimd_flush_task_state(p); ++ + if (likely(!(p->flags & PF_KTHREAD))) { + *childregs = *current_pt_regs(); + childregs->regs[0] = 0; +diff --git a/arch/arm64/kvm/handle_exit.c b/arch/arm64/kvm/handle_exit.c +index a204adf29f0a..85baadab02d3 100644 +--- a/arch/arm64/kvm/handle_exit.c ++++ b/arch/arm64/kvm/handle_exit.c +@@ -125,7 +125,19 @@ static int kvm_handle_guest_debug(struct kvm_vcpu *vcpu, struct kvm_run *run) + return ret; + } + ++static int kvm_handle_unknown_ec(struct kvm_vcpu *vcpu, struct kvm_run *run) ++{ ++ u32 hsr = kvm_vcpu_get_hsr(vcpu); ++ ++ kvm_pr_unimpl("Unknown exception class: hsr: %#08x -- %s\n", ++ hsr, esr_get_class_string(hsr)); ++ ++ kvm_inject_undefined(vcpu); ++ return 1; ++} ++ + static exit_handle_fn arm_exit_handlers[] = { ++ [0 ... ESR_ELx_EC_MAX] = kvm_handle_unknown_ec, + [ESR_ELx_EC_WFx] = kvm_handle_wfx, + [ESR_ELx_EC_CP15_32] = kvm_handle_cp15_32, + [ESR_ELx_EC_CP15_64] = kvm_handle_cp15_64, +@@ -151,13 +163,6 @@ static exit_handle_fn kvm_get_exit_handler(struct kvm_vcpu *vcpu) + u32 hsr = kvm_vcpu_get_hsr(vcpu); + u8 hsr_ec = ESR_ELx_EC(hsr); + +- if (hsr_ec >= ARRAY_SIZE(arm_exit_handlers) || +- !arm_exit_handlers[hsr_ec]) { +- kvm_err("Unknown exception class: hsr: %#08x -- %s\n", +- hsr, esr_get_class_string(hsr)); +- BUG(); +- } +- + return arm_exit_handlers[hsr_ec]; + } + +diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile +index 617dece67924..a60c9c6e5cc1 100644 +--- a/arch/powerpc/Makefile ++++ b/arch/powerpc/Makefile +@@ -72,8 +72,15 @@ GNUTARGET := powerpc + MULTIPLEWORD := -mmultiple + endif + +-cflags-$(CONFIG_CPU_BIG_ENDIAN) += $(call cc-option,-mbig-endian) ++ifdef CONFIG_PPC64 ++cflags-$(CONFIG_CPU_BIG_ENDIAN) += $(call cc-option,-mabi=elfv1) ++cflags-$(CONFIG_CPU_BIG_ENDIAN) += $(call cc-option,-mcall-aixdesc) ++aflags-$(CONFIG_CPU_BIG_ENDIAN) += $(call cc-option,-mabi=elfv1) ++aflags-$(CONFIG_CPU_LITTLE_ENDIAN) += -mabi=elfv2 ++endif ++ + cflags-$(CONFIG_CPU_LITTLE_ENDIAN) += -mlittle-endian ++cflags-$(CONFIG_CPU_BIG_ENDIAN) += $(call cc-option,-mbig-endian) + ifneq ($(cc-name),clang) + cflags-$(CONFIG_CPU_LITTLE_ENDIAN) += -mno-strict-align + endif +@@ -113,7 +120,9 @@ ifeq ($(CONFIG_CPU_LITTLE_ENDIAN),y) + CFLAGS-$(CONFIG_PPC64) += $(call cc-option,-mabi=elfv2,$(call cc-option,-mcall-aixdesc)) + AFLAGS-$(CONFIG_PPC64) += $(call cc-option,-mabi=elfv2) + else ++CFLAGS-$(CONFIG_PPC64) += $(call cc-option,-mabi=elfv1) + CFLAGS-$(CONFIG_PPC64) += $(call cc-option,-mcall-aixdesc) ++AFLAGS-$(CONFIG_PPC64) += $(call cc-option,-mabi=elfv1) + endif + CFLAGS-$(CONFIG_PPC64) += $(call cc-option,-mcmodel=medium,$(call cc-option,-mminimal-toc)) + CFLAGS-$(CONFIG_PPC64) += $(call cc-option,-mno-pointers-to-nested-functions) +diff --git a/arch/powerpc/include/asm/checksum.h b/arch/powerpc/include/asm/checksum.h +index 1e8fceb308a5..a67bb09585f4 100644 +--- a/arch/powerpc/include/asm/checksum.h ++++ b/arch/powerpc/include/asm/checksum.h +@@ -100,7 +100,7 @@ static inline __wsum csum_add(__wsum csum, __wsum addend) + + #ifdef __powerpc64__ + res += (__force u64)addend; +- return (__force __wsum)((u32)res + (res >> 32)); ++ return (__force __wsum) from64to32(res); + #else + asm("addc %0,%0,%1;" + "addze %0,%0;" +diff --git a/arch/powerpc/kernel/cpu_setup_power.S b/arch/powerpc/kernel/cpu_setup_power.S +index 7803756998e2..9e05c8828ee2 100644 +--- a/arch/powerpc/kernel/cpu_setup_power.S ++++ b/arch/powerpc/kernel/cpu_setup_power.S +@@ -97,6 +97,7 @@ _GLOBAL(__setup_cpu_power9) + beqlr + li r0,0 + mtspr SPRN_LPID,r0 ++ mtspr SPRN_PID,r0 + mfspr r3,SPRN_LPCR + LOAD_REG_IMMEDIATE(r4, LPCR_PECEDH | LPCR_PECE_HVEE | LPCR_HVICE) + or r3, r3, r4 +@@ -119,6 +120,7 @@ _GLOBAL(__restore_cpu_power9) + beqlr + li r0,0 + mtspr SPRN_LPID,r0 ++ mtspr SPRN_PID,r0 + mfspr r3,SPRN_LPCR + LOAD_REG_IMMEDIATE(r4, LPCR_PECEDH | LPCR_PECE_HVEE | LPCR_HVICE) + or r3, r3, r4 +diff --git a/arch/powerpc/mm/pgtable-radix.c b/arch/powerpc/mm/pgtable-radix.c +index 9a25dce87875..44c33ee397a0 100644 +--- a/arch/powerpc/mm/pgtable-radix.c ++++ b/arch/powerpc/mm/pgtable-radix.c +@@ -173,6 +173,10 @@ static void __init radix_init_pgtable(void) + */ + register_process_table(__pa(process_tb), 0, PRTB_SIZE_SHIFT - 12); + pr_info("Process table %p and radix root for kernel: %p\n", process_tb, init_mm.pgd); ++ asm volatile("ptesync" : : : "memory"); ++ asm volatile(PPC_TLBIE_5(%0,%1,2,1,1) : : ++ "r" (TLBIEL_INVAL_SET_LPID), "r" (0)); ++ asm volatile("eieio; tlbsync; ptesync" : : : "memory"); + } + + static void __init radix_init_partition_table(void) +diff --git a/arch/powerpc/platforms/powernv/pci-ioda.c b/arch/powerpc/platforms/powernv/pci-ioda.c +index dcdfee0cd4f2..f602307a4386 100644 +--- a/arch/powerpc/platforms/powernv/pci-ioda.c ++++ b/arch/powerpc/platforms/powernv/pci-ioda.c +@@ -2623,6 +2623,9 @@ static long pnv_pci_ioda2_table_alloc_pages(int nid, __u64 bus_offset, + level_shift = entries_shift + 3; + level_shift = max_t(unsigned, level_shift, PAGE_SHIFT); + ++ if ((level_shift - 3) * levels + page_shift >= 60) ++ return -EINVAL; ++ + /* Allocate TCE table */ + addr = pnv_pci_ioda2_table_do_alloc_pages(nid, level_shift, + levels, tce_table_size, &offset, &total_allocated); +diff --git a/arch/powerpc/sysdev/axonram.c b/arch/powerpc/sysdev/axonram.c +index ada29eaed6e2..f523ac883150 100644 +--- a/arch/powerpc/sysdev/axonram.c ++++ b/arch/powerpc/sysdev/axonram.c +@@ -274,7 +274,9 @@ static int axon_ram_probe(struct platform_device *device) + if (bank->disk->major > 0) + unregister_blkdev(bank->disk->major, + bank->disk->disk_name); +- del_gendisk(bank->disk); ++ if (bank->disk->flags & GENHD_FL_UP) ++ del_gendisk(bank->disk); ++ put_disk(bank->disk); + } + device->dev.platform_data = NULL; + if (bank->io_addr != 0) +@@ -299,6 +301,7 @@ axon_ram_remove(struct platform_device *device) + device_remove_file(&device->dev, &dev_attr_ecc); + free_irq(bank->irq_id, device); + del_gendisk(bank->disk); ++ put_disk(bank->disk); + iounmap((void __iomem *) bank->io_addr); + kfree(bank); + +diff --git a/arch/s390/kernel/syscalls.S b/arch/s390/kernel/syscalls.S +index 9b59e6212d8f..709da452413d 100644 +--- a/arch/s390/kernel/syscalls.S ++++ b/arch/s390/kernel/syscalls.S +@@ -369,10 +369,10 @@ SYSCALL(sys_recvmmsg,compat_sys_recvmmsg) + SYSCALL(sys_sendmmsg,compat_sys_sendmmsg) + SYSCALL(sys_socket,sys_socket) + SYSCALL(sys_socketpair,compat_sys_socketpair) /* 360 */ +-SYSCALL(sys_bind,sys_bind) +-SYSCALL(sys_connect,sys_connect) ++SYSCALL(sys_bind,compat_sys_bind) ++SYSCALL(sys_connect,compat_sys_connect) + SYSCALL(sys_listen,sys_listen) +-SYSCALL(sys_accept4,sys_accept4) ++SYSCALL(sys_accept4,compat_sys_accept4) + SYSCALL(sys_getsockopt,compat_sys_getsockopt) /* 365 */ + SYSCALL(sys_setsockopt,compat_sys_setsockopt) + SYSCALL(sys_getsockname,compat_sys_getsockname) +diff --git a/arch/s390/kvm/priv.c b/arch/s390/kvm/priv.c +index e18435355c16..c2905a10cb37 100644 +--- a/arch/s390/kvm/priv.c ++++ b/arch/s390/kvm/priv.c +@@ -197,8 +197,6 @@ static int try_handle_skey(struct kvm_vcpu *vcpu) + VCPU_EVENT(vcpu, 4, "%s", "retrying storage key operation"); + return -EAGAIN; + } +- if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE) +- return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP); + return 0; + } + +@@ -209,6 +207,9 @@ static int handle_iske(struct kvm_vcpu *vcpu) + int reg1, reg2; + int rc; + ++ if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE) ++ return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP); ++ + rc = try_handle_skey(vcpu); + if (rc) + return rc != -EAGAIN ? rc : 0; +@@ -238,6 +239,9 @@ static int handle_rrbe(struct kvm_vcpu *vcpu) + int reg1, reg2; + int rc; + ++ if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE) ++ return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP); ++ + rc = try_handle_skey(vcpu); + if (rc) + return rc != -EAGAIN ? rc : 0; +@@ -273,6 +277,9 @@ static int handle_sske(struct kvm_vcpu *vcpu) + int reg1, reg2; + int rc; + ++ if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE) ++ return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP); ++ + rc = try_handle_skey(vcpu); + if (rc) + return rc != -EAGAIN ? rc : 0; +diff --git a/arch/sparc/mm/init_64.c b/arch/sparc/mm/init_64.c +index 57154c638e71..0f183ffe3416 100644 +--- a/arch/sparc/mm/init_64.c ++++ b/arch/sparc/mm/init_64.c +@@ -2391,9 +2391,16 @@ void __init mem_init(void) + { + high_memory = __va(last_valid_pfn << PAGE_SHIFT); + +- register_page_bootmem_info(); + free_all_bootmem(); + ++ /* ++ * Must be done after boot memory is put on freelist, because here we ++ * might set fields in deferred struct pages that have not yet been ++ * initialized, and free_all_bootmem() initializes all the reserved ++ * deferred pages for us. ++ */ ++ register_page_bootmem_info(); ++ + /* + * Set up the zero page, mark it reserved, so that page count + * is not manipulated when freeing the page from user ptes. +diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h +index bdde80731f49..cbd1d44da2d3 100644 +--- a/arch/x86/include/asm/kvm_host.h ++++ b/arch/x86/include/asm/kvm_host.h +@@ -1397,4 +1397,7 @@ static inline int kvm_cpu_get_apicid(int mps_cpu) + #endif + } + ++void kvm_arch_mmu_notifier_invalidate_range(struct kvm *kvm, ++ unsigned long start, unsigned long end); ++ + #endif /* _ASM_X86_KVM_HOST_H */ +diff --git a/arch/x86/kernel/hpet.c b/arch/x86/kernel/hpet.c +index 932348fbb6ea..9512529e8eab 100644 +--- a/arch/x86/kernel/hpet.c ++++ b/arch/x86/kernel/hpet.c +@@ -354,7 +354,7 @@ static int hpet_resume(struct clock_event_device *evt, int timer) + + irq_domain_deactivate_irq(irq_get_irq_data(hdev->irq)); + irq_domain_activate_irq(irq_get_irq_data(hdev->irq)); +- disable_irq(hdev->irq); ++ disable_hardirq(hdev->irq); + irq_set_affinity(hdev->irq, cpumask_of(hdev->cpu)); + enable_irq(hdev->irq); + } +diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c +index f0d3de153e29..9aa62ab13ae8 100644 +--- a/arch/x86/kvm/vmx.c ++++ b/arch/x86/kvm/vmx.c +@@ -6413,12 +6413,7 @@ static __init int hardware_setup(void) + memset(vmx_vmread_bitmap, 0xff, PAGE_SIZE); + memset(vmx_vmwrite_bitmap, 0xff, PAGE_SIZE); + +- /* +- * Allow direct access to the PC debug port (it is often used for I/O +- * delays, but the vmexits simply slow things down). +- */ + memset(vmx_io_bitmap_a, 0xff, PAGE_SIZE); +- clear_bit(0x80, vmx_io_bitmap_a); + + memset(vmx_io_bitmap_b, 0xff, PAGE_SIZE); + +@@ -7208,9 +7203,8 @@ static int handle_vmoff(struct kvm_vcpu *vcpu) + static int handle_vmclear(struct kvm_vcpu *vcpu) + { + struct vcpu_vmx *vmx = to_vmx(vcpu); ++ u32 zero = 0; + gpa_t vmptr; +- struct vmcs12 *vmcs12; +- struct page *page; + + if (!nested_vmx_check_permission(vcpu)) + return 1; +@@ -7221,22 +7215,9 @@ static int handle_vmclear(struct kvm_vcpu *vcpu) + if (vmptr == vmx->nested.current_vmptr) + nested_release_vmcs12(vmx); + +- page = nested_get_page(vcpu, vmptr); +- if (page == NULL) { +- /* +- * For accurate processor emulation, VMCLEAR beyond available +- * physical memory should do nothing at all. However, it is +- * possible that a nested vmx bug, not a guest hypervisor bug, +- * resulted in this case, so let's shut down before doing any +- * more damage: +- */ +- kvm_make_request(KVM_REQ_TRIPLE_FAULT, vcpu); +- return 1; +- } +- vmcs12 = kmap(page); +- vmcs12->launch_state = 0; +- kunmap(page); +- nested_release_page(page); ++ kvm_vcpu_write_guest(vcpu, ++ vmptr + offsetof(struct vmcs12, launch_state), ++ &zero, sizeof(zero)); + + nested_free_vmcs02(vmx, vmptr); + +@@ -10903,8 +10884,10 @@ static void nested_vmx_vmexit(struct kvm_vcpu *vcpu, u32 exit_reason, + */ + static void vmx_leave_nested(struct kvm_vcpu *vcpu) + { +- if (is_guest_mode(vcpu)) ++ if (is_guest_mode(vcpu)) { ++ to_vmx(vcpu)->nested.nested_run_pending = 0; + nested_vmx_vmexit(vcpu, -1, 0, 0); ++ } + free_nested(to_vmx(vcpu)); + } + +diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c +index 02d45296a97c..26b580ad268f 100644 +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -6526,6 +6526,20 @@ static void kvm_vcpu_flush_tlb(struct kvm_vcpu *vcpu) + kvm_x86_ops->tlb_flush(vcpu); + } + ++void kvm_arch_mmu_notifier_invalidate_range(struct kvm *kvm, ++ unsigned long start, unsigned long end) ++{ ++ unsigned long apic_address; ++ ++ /* ++ * The physical address of apic access page is stored in the VMCS. ++ * Update it when it becomes invalid. ++ */ ++ apic_address = gfn_to_hva(kvm, APIC_DEFAULT_PHYS_BASE >> PAGE_SHIFT); ++ if (start <= apic_address && apic_address < end) ++ kvm_make_all_cpus_request(kvm, KVM_REQ_APIC_PAGE_RELOAD); ++} ++ + void kvm_vcpu_reload_apic_access_page(struct kvm_vcpu *vcpu) + { + struct page *page = NULL; +diff --git a/arch/x86/pci/broadcom_bus.c b/arch/x86/pci/broadcom_bus.c +index bb461cfd01ab..526536c81ddc 100644 +--- a/arch/x86/pci/broadcom_bus.c ++++ b/arch/x86/pci/broadcom_bus.c +@@ -97,7 +97,7 @@ static int __init broadcom_postcore_init(void) + * We should get host bridge information from ACPI unless the BIOS + * doesn't support it. + */ +- if (acpi_os_get_root_pointer()) ++ if (!acpi_disabled && acpi_os_get_root_pointer()) + return 0; + #endif + +diff --git a/arch/x86/platform/uv/tlb_uv.c b/arch/x86/platform/uv/tlb_uv.c +index 9e42842e924a..0f0175186f1b 100644 +--- a/arch/x86/platform/uv/tlb_uv.c ++++ b/arch/x86/platform/uv/tlb_uv.c +@@ -1848,7 +1848,6 @@ static void pq_init(int node, int pnode) + + ops.write_payload_first(pnode, first); + ops.write_payload_last(pnode, last); +- ops.write_g_sw_ack(pnode, 0xffffUL); + + /* in effect, all msg_type's are set to MSG_NOOP */ + memset(pqp, 0, sizeof(struct bau_pq_entry) * DEST_Q_SIZE); +diff --git a/block/blk-core.c b/block/blk-core.c +index b1c76aa73492..23daf40be371 100644 +--- a/block/blk-core.c ++++ b/block/blk-core.c +@@ -527,8 +527,8 @@ void blk_set_queue_dying(struct request_queue *q) + + blk_queue_for_each_rl(rl, q) { + if (rl->rq_pool) { +- wake_up(&rl->wait[BLK_RW_SYNC]); +- wake_up(&rl->wait[BLK_RW_ASYNC]); ++ wake_up_all(&rl->wait[BLK_RW_SYNC]); ++ wake_up_all(&rl->wait[BLK_RW_ASYNC]); + } + } + } +diff --git a/block/blk-mq-sysfs.c b/block/blk-mq-sysfs.c +index 01fb455d3377..8c0894e0713b 100644 +--- a/block/blk-mq-sysfs.c ++++ b/block/blk-mq-sysfs.c +@@ -429,7 +429,7 @@ void blk_mq_hctx_kobj_init(struct blk_mq_hw_ctx *hctx) + kobject_init(&hctx->kobj, &blk_mq_hw_ktype); + } + +-static void blk_mq_sysfs_init(struct request_queue *q) ++void blk_mq_sysfs_init(struct request_queue *q) + { + struct blk_mq_ctx *ctx; + int cpu; +@@ -449,8 +449,6 @@ int blk_mq_register_dev(struct device *dev, struct request_queue *q) + + blk_mq_disable_hotplug(); + +- blk_mq_sysfs_init(q); +- + ret = kobject_add(&q->mq_kobj, kobject_get(&dev->kobj), "%s", "mq"); + if (ret < 0) + goto out; +diff --git a/block/blk-mq.c b/block/blk-mq.c +index 7b597ec4e9c5..10f8f94b7f20 100644 +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -1707,7 +1707,6 @@ static void blk_mq_init_cpu_queues(struct request_queue *q, + struct blk_mq_ctx *__ctx = per_cpu_ptr(q->queue_ctx, i); + struct blk_mq_hw_ctx *hctx; + +- memset(__ctx, 0, sizeof(*__ctx)); + __ctx->cpu = i; + spin_lock_init(&__ctx->lock); + INIT_LIST_HEAD(&__ctx->rq_list); +@@ -1970,6 +1969,9 @@ struct request_queue *blk_mq_init_allocated_queue(struct blk_mq_tag_set *set, + if (!q->queue_ctx) + goto err_exit; + ++ /* init q->mq_kobj and sw queues' kobjects */ ++ blk_mq_sysfs_init(q); ++ + q->queue_hw_ctx = kzalloc_node(nr_cpu_ids * sizeof(*(q->queue_hw_ctx)), + GFP_KERNEL, set->numa_node); + if (!q->queue_hw_ctx) +diff --git a/block/blk-mq.h b/block/blk-mq.h +index e5d25249028c..c55bcf67b956 100644 +--- a/block/blk-mq.h ++++ b/block/blk-mq.h +@@ -50,6 +50,7 @@ static inline struct blk_mq_hw_ctx *blk_mq_map_queue(struct request_queue *q, + /* + * sysfs helpers + */ ++extern void blk_mq_sysfs_init(struct request_queue *q); + extern int blk_mq_sysfs_register(struct request_queue *q); + extern void blk_mq_sysfs_unregister(struct request_queue *q); + extern void blk_mq_hctx_kobj_init(struct blk_mq_hw_ctx *hctx); +diff --git a/crypto/asymmetric_keys/pkcs7_verify.c b/crypto/asymmetric_keys/pkcs7_verify.c +index 2ffd69769466..5a37962d2199 100644 +--- a/crypto/asymmetric_keys/pkcs7_verify.c ++++ b/crypto/asymmetric_keys/pkcs7_verify.c +@@ -150,7 +150,7 @@ static int pkcs7_find_key(struct pkcs7_message *pkcs7, + pr_devel("Sig %u: Found cert serial match X.509[%u]\n", + sinfo->index, certix); + +- if (x509->pub->pkey_algo != sinfo->sig->pkey_algo) { ++ if (strcmp(x509->pub->pkey_algo, sinfo->sig->pkey_algo) != 0) { + pr_warn("Sig %u: X.509 algo and PKCS#7 sig algo don't match\n", + sinfo->index); + continue; +diff --git a/crypto/asymmetric_keys/x509_cert_parser.c b/crypto/asymmetric_keys/x509_cert_parser.c +index c80765b211cf..029f7051f2be 100644 +--- a/crypto/asymmetric_keys/x509_cert_parser.c ++++ b/crypto/asymmetric_keys/x509_cert_parser.c +@@ -408,6 +408,8 @@ int x509_extract_key_data(void *context, size_t hdrlen, + ctx->cert->pub->pkey_algo = "rsa"; + + /* Discard the BIT STRING metadata */ ++ if (vlen < 1 || *(const u8 *)value != 0) ++ return -EBADMSG; + ctx->key = value + 1; + ctx->key_size = vlen - 1; + return 0; +diff --git a/crypto/asymmetric_keys/x509_public_key.c b/crypto/asymmetric_keys/x509_public_key.c +index fb732296cd36..e16009a8da9c 100644 +--- a/crypto/asymmetric_keys/x509_public_key.c ++++ b/crypto/asymmetric_keys/x509_public_key.c +@@ -125,7 +125,7 @@ int x509_check_for_self_signed(struct x509_certificate *cert) + } + + ret = -EKEYREJECTED; +- if (cert->pub->pkey_algo != cert->sig->pkey_algo) ++ if (strcmp(cert->pub->pkey_algo, cert->sig->pkey_algo) != 0) + goto out; + + ret = public_key_verify_signature(cert->pub, cert->sig); +diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c +index 051b6158d1b7..8d22acdf90f0 100644 +--- a/drivers/ata/libata-sff.c ++++ b/drivers/ata/libata-sff.c +@@ -1481,7 +1481,6 @@ unsigned int ata_sff_qc_issue(struct ata_queued_cmd *qc) + break; + + default: +- WARN_ON_ONCE(1); + return AC_ERR_SYSTEM; + } + +diff --git a/drivers/atm/horizon.c b/drivers/atm/horizon.c +index 5fc81e240c24..e55f418d6ab9 100644 +--- a/drivers/atm/horizon.c ++++ b/drivers/atm/horizon.c +@@ -2802,7 +2802,7 @@ static int hrz_probe(struct pci_dev *pci_dev, + return err; + + out_free_irq: +- free_irq(dev->irq, dev); ++ free_irq(irq, dev); + out_free: + kfree(dev); + out_release: +diff --git a/drivers/base/isa.c b/drivers/base/isa.c +index cd6ccdcf9df0..372d10af2600 100644 +--- a/drivers/base/isa.c ++++ b/drivers/base/isa.c +@@ -39,7 +39,7 @@ static int isa_bus_probe(struct device *dev) + { + struct isa_driver *isa_driver = dev->platform_data; + +- if (isa_driver->probe) ++ if (isa_driver && isa_driver->probe) + return isa_driver->probe(dev, to_isa_dev(dev)->id); + + return 0; +@@ -49,7 +49,7 @@ static int isa_bus_remove(struct device *dev) + { + struct isa_driver *isa_driver = dev->platform_data; + +- if (isa_driver->remove) ++ if (isa_driver && isa_driver->remove) + return isa_driver->remove(dev, to_isa_dev(dev)->id); + + return 0; +@@ -59,7 +59,7 @@ static void isa_bus_shutdown(struct device *dev) + { + struct isa_driver *isa_driver = dev->platform_data; + +- if (isa_driver->shutdown) ++ if (isa_driver && isa_driver->shutdown) + isa_driver->shutdown(dev, to_isa_dev(dev)->id); + } + +@@ -67,7 +67,7 @@ static int isa_bus_suspend(struct device *dev, pm_message_t state) + { + struct isa_driver *isa_driver = dev->platform_data; + +- if (isa_driver->suspend) ++ if (isa_driver && isa_driver->suspend) + return isa_driver->suspend(dev, to_isa_dev(dev)->id, state); + + return 0; +@@ -77,7 +77,7 @@ static int isa_bus_resume(struct device *dev) + { + struct isa_driver *isa_driver = dev->platform_data; + +- if (isa_driver->resume) ++ if (isa_driver && isa_driver->resume) + return isa_driver->resume(dev, to_isa_dev(dev)->id); + + return 0; +diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c +index c9914d653968..b7c0b69a02f5 100644 +--- a/drivers/block/zram/zram_drv.c ++++ b/drivers/block/zram/zram_drv.c +@@ -1286,6 +1286,8 @@ static int zram_add(void) + blk_queue_io_min(zram->disk->queue, PAGE_SIZE); + blk_queue_io_opt(zram->disk->queue, PAGE_SIZE); + zram->disk->queue->limits.discard_granularity = PAGE_SIZE; ++ zram->disk->queue->limits.max_sectors = SECTORS_PER_PAGE; ++ zram->disk->queue->limits.chunk_sectors = 0; + blk_queue_max_discard_sectors(zram->disk->queue, UINT_MAX); + /* + * zram_bio_discard() will clear all logical blocks if logical block +diff --git a/drivers/bus/arm-cci.c b/drivers/bus/arm-cci.c +index 890082315054..10f56133b281 100644 +--- a/drivers/bus/arm-cci.c ++++ b/drivers/bus/arm-cci.c +@@ -1755,14 +1755,17 @@ static int cci_pmu_probe(struct platform_device *pdev) + raw_spin_lock_init(&cci_pmu->hw_events.pmu_lock); + mutex_init(&cci_pmu->reserve_mutex); + atomic_set(&cci_pmu->active_events, 0); +- cpumask_set_cpu(smp_processor_id(), &cci_pmu->cpus); ++ cpumask_set_cpu(get_cpu(), &cci_pmu->cpus); + + ret = cci_pmu_init(cci_pmu, pdev); +- if (ret) ++ if (ret) { ++ put_cpu(); + return ret; ++ } + + cpuhp_state_add_instance_nocalls(CPUHP_AP_PERF_ARM_CCI_ONLINE, + &cci_pmu->node); ++ put_cpu(); + pr_info("ARM %s PMU driver probed", cci_pmu->model->name); + return 0; + } +diff --git a/drivers/bus/arm-ccn.c b/drivers/bus/arm-ccn.c +index aee83462b796..f0249899fc96 100644 +--- a/drivers/bus/arm-ccn.c ++++ b/drivers/bus/arm-ccn.c +@@ -1271,6 +1271,10 @@ static int arm_ccn_pmu_init(struct arm_ccn *ccn) + int len = snprintf(NULL, 0, "ccn_%d", ccn->dt.id); + + name = devm_kzalloc(ccn->dev, len + 1, GFP_KERNEL); ++ if (!name) { ++ err = -ENOMEM; ++ goto error_choose_name; ++ } + snprintf(name, len + 1, "ccn_%d", ccn->dt.id); + } + +@@ -1297,7 +1301,7 @@ static int arm_ccn_pmu_init(struct arm_ccn *ccn) + } + + /* Pick one CPU which we will use to collect data from CCN... */ +- cpumask_set_cpu(smp_processor_id(), &ccn->dt.cpu); ++ cpumask_set_cpu(get_cpu(), &ccn->dt.cpu); + + /* Also make sure that the overflow interrupt is handled by this CPU */ + if (ccn->irq) { +@@ -1314,10 +1318,13 @@ static int arm_ccn_pmu_init(struct arm_ccn *ccn) + + cpuhp_state_add_instance_nocalls(CPUHP_AP_PERF_ARM_CCN_ONLINE, + &ccn->dt.node); ++ put_cpu(); + return 0; + + error_pmu_register: + error_set_affinity: ++ put_cpu(); ++error_choose_name: + ida_simple_remove(&arm_ccn_pmu_ida, ccn->dt.id); + for (i = 0; i < ccn->num_xps; i++) + writel(0, ccn->xp[i].base + CCN_XP_DT_CONTROL); +@@ -1578,8 +1585,8 @@ static int __init arm_ccn_init(void) + + static void __exit arm_ccn_exit(void) + { +- cpuhp_remove_multi_state(CPUHP_AP_PERF_ARM_CCN_ONLINE); + platform_driver_unregister(&arm_ccn_driver); ++ cpuhp_remove_multi_state(CPUHP_AP_PERF_ARM_CCN_ONLINE); + } + + module_init(arm_ccn_init); +diff --git a/drivers/clk/uniphier/clk-uniphier-sys.c b/drivers/clk/uniphier/clk-uniphier-sys.c +index 5d029991047d..481225adef87 100644 +--- a/drivers/clk/uniphier/clk-uniphier-sys.c ++++ b/drivers/clk/uniphier/clk-uniphier-sys.c +@@ -98,7 +98,7 @@ const struct uniphier_clk_data uniphier_sld8_sys_clk_data[] = { + const struct uniphier_clk_data uniphier_pro5_sys_clk_data[] = { + UNIPHIER_CLK_FACTOR("spll", -1, "ref", 120, 1), /* 2400 MHz */ + UNIPHIER_CLK_FACTOR("dapll1", -1, "ref", 128, 1), /* 2560 MHz */ +- UNIPHIER_CLK_FACTOR("dapll2", -1, "ref", 144, 125), /* 2949.12 MHz */ ++ UNIPHIER_CLK_FACTOR("dapll2", -1, "dapll1", 144, 125), /* 2949.12 MHz */ + UNIPHIER_CLK_FACTOR("uart", 0, "dapll2", 1, 40), + UNIPHIER_CLK_FACTOR("i2c", 1, "spll", 1, 48), + UNIPHIER_PRO5_SYS_CLK_SD, +diff --git a/drivers/crypto/s5p-sss.c b/drivers/crypto/s5p-sss.c +index dce1af0ce85c..a668286d62cb 100644 +--- a/drivers/crypto/s5p-sss.c ++++ b/drivers/crypto/s5p-sss.c +@@ -805,8 +805,9 @@ static int s5p_aes_probe(struct platform_device *pdev) + dev_warn(dev, "feed control interrupt is not available.\n"); + goto err_irq; + } +- err = devm_request_irq(dev, pdata->irq_fc, s5p_aes_interrupt, +- IRQF_SHARED, pdev->name, pdev); ++ err = devm_request_threaded_irq(dev, pdata->irq_fc, NULL, ++ s5p_aes_interrupt, IRQF_ONESHOT, ++ pdev->name, pdev); + if (err < 0) { + dev_warn(dev, "feed control interrupt is not available.\n"); + goto err_irq; +diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c +index e2d323fa2437..1c8d79d93098 100644 +--- a/drivers/crypto/talitos.c ++++ b/drivers/crypto/talitos.c +@@ -1232,12 +1232,11 @@ static int ipsec_esp(struct talitos_edesc *edesc, struct aead_request *areq, + sg_link_tbl_len += authsize; + } + +- sg_count = talitos_sg_map(dev, areq->src, cryptlen, edesc, +- &desc->ptr[4], sg_count, areq->assoclen, +- tbl_off); ++ ret = talitos_sg_map(dev, areq->src, sg_link_tbl_len, edesc, ++ &desc->ptr[4], sg_count, areq->assoclen, tbl_off); + +- if (sg_count > 1) { +- tbl_off += sg_count; ++ if (ret > 1) { ++ tbl_off += ret; + sync_needed = true; + } + +@@ -1248,14 +1247,15 @@ static int ipsec_esp(struct talitos_edesc *edesc, struct aead_request *areq, + dma_map_sg(dev, areq->dst, sg_count, DMA_FROM_DEVICE); + } + +- sg_count = talitos_sg_map(dev, areq->dst, cryptlen, edesc, +- &desc->ptr[5], sg_count, areq->assoclen, +- tbl_off); ++ ret = talitos_sg_map(dev, areq->dst, cryptlen, edesc, &desc->ptr[5], ++ sg_count, areq->assoclen, tbl_off); + + if (desc->hdr & DESC_HDR_TYPE_IPSEC_ESP) + to_talitos_ptr_ext_or(&desc->ptr[5], authsize, is_sec1); + +- if (sg_count > 1) { ++ /* ICV data */ ++ if (ret > 1) { ++ tbl_off += ret; + edesc->icv_ool = true; + sync_needed = true; + +@@ -1265,9 +1265,7 @@ static int ipsec_esp(struct talitos_edesc *edesc, struct aead_request *areq, + sizeof(struct talitos_ptr) + authsize; + + /* Add an entry to the link table for ICV data */ +- tbl_ptr += sg_count - 1; +- to_talitos_ptr_ext_set(tbl_ptr, 0, is_sec1); +- tbl_ptr++; ++ to_talitos_ptr_ext_set(tbl_ptr - 1, 0, is_sec1); + to_talitos_ptr_ext_set(tbl_ptr, DESC_PTR_LNKTBL_RETURN, + is_sec1); + to_talitos_ptr_len(tbl_ptr, authsize, is_sec1); +@@ -1275,18 +1273,33 @@ static int ipsec_esp(struct talitos_edesc *edesc, struct aead_request *areq, + /* icv data follows link tables */ + to_talitos_ptr(tbl_ptr, edesc->dma_link_tbl + offset, + is_sec1); ++ } else { ++ dma_addr_t addr = edesc->dma_link_tbl; ++ ++ if (is_sec1) ++ addr += areq->assoclen + cryptlen; ++ else ++ addr += sizeof(struct talitos_ptr) * tbl_off; ++ ++ to_talitos_ptr(&desc->ptr[6], addr, is_sec1); ++ to_talitos_ptr_len(&desc->ptr[6], authsize, is_sec1); ++ } ++ } else if (!(desc->hdr & DESC_HDR_TYPE_IPSEC_ESP)) { ++ ret = talitos_sg_map(dev, areq->dst, authsize, edesc, ++ &desc->ptr[6], sg_count, areq->assoclen + ++ cryptlen, ++ tbl_off); ++ if (ret > 1) { ++ tbl_off += ret; ++ edesc->icv_ool = true; ++ sync_needed = true; ++ } else { ++ edesc->icv_ool = false; + } + } else { + edesc->icv_ool = false; + } + +- /* ICV data */ +- if (!(desc->hdr & DESC_HDR_TYPE_IPSEC_ESP)) { +- to_talitos_ptr_len(&desc->ptr[6], authsize, is_sec1); +- to_talitos_ptr(&desc->ptr[6], edesc->dma_link_tbl + +- areq->assoclen + cryptlen, is_sec1); +- } +- + /* iv out */ + if (desc->hdr & DESC_HDR_TYPE_IPSEC_ESP) + map_single_talitos_ptr(dev, &desc->ptr[6], ivsize, ctx->iv, +@@ -1494,12 +1507,20 @@ static int ablkcipher_setkey(struct crypto_ablkcipher *cipher, + const u8 *key, unsigned int keylen) + { + struct talitos_ctx *ctx = crypto_ablkcipher_ctx(cipher); ++ u32 tmp[DES_EXPKEY_WORDS]; + + if (keylen > TALITOS_MAX_KEY_SIZE) { + crypto_ablkcipher_set_flags(cipher, CRYPTO_TFM_RES_BAD_KEY_LEN); + return -EINVAL; + } + ++ if (unlikely(crypto_ablkcipher_get_flags(cipher) & ++ CRYPTO_TFM_REQ_WEAK_KEY) && ++ !des_ekey(tmp, key)) { ++ crypto_ablkcipher_set_flags(cipher, CRYPTO_TFM_RES_WEAK_KEY); ++ return -EINVAL; ++ } ++ + memcpy(&ctx->key, key, keylen); + ctx->keylen = keylen; + +@@ -2614,7 +2635,7 @@ static struct talitos_alg_template driver_algs[] = { + .ivsize = AES_BLOCK_SIZE, + } + }, +- .desc_hdr_template = DESC_HDR_TYPE_COMMON_NONSNOOP_NO_AFEU | ++ .desc_hdr_template = DESC_HDR_TYPE_AESU_CTR_NONSNOOP | + DESC_HDR_SEL0_AESU | + DESC_HDR_MODE0_AESU_CTR, + }, +@@ -3047,6 +3068,11 @@ static struct talitos_crypto_alg *talitos_alg_alloc(struct device *dev, + t_alg->algt.alg.aead.setkey = aead_setkey; + t_alg->algt.alg.aead.encrypt = aead_encrypt; + t_alg->algt.alg.aead.decrypt = aead_decrypt; ++ if (!(priv->features & TALITOS_FTR_SHA224_HWINIT) && ++ !strncmp(alg->cra_name, "authenc(hmac(sha224)", 20)) { ++ kfree(t_alg); ++ return ERR_PTR(-ENOTSUPP); ++ } + break; + case CRYPTO_ALG_TYPE_AHASH: + alg = &t_alg->algt.alg.hash.halg.base; +diff --git a/drivers/edac/i5000_edac.c b/drivers/edac/i5000_edac.c +index 72e07e3cf718..16e0eb523439 100644 +--- a/drivers/edac/i5000_edac.c ++++ b/drivers/edac/i5000_edac.c +@@ -227,7 +227,7 @@ + #define NREC_RDWR(x) (((x)>>11) & 1) + #define NREC_RANK(x) (((x)>>8) & 0x7) + #define NRECMEMB 0xC0 +-#define NREC_CAS(x) (((x)>>16) & 0xFFFFFF) ++#define NREC_CAS(x) (((x)>>16) & 0xFFF) + #define NREC_RAS(x) ((x) & 0x7FFF) + #define NRECFGLOG 0xC4 + #define NREEECFBDA 0xC8 +@@ -371,7 +371,7 @@ struct i5000_error_info { + /* These registers are input ONLY if there was a + * Non-Recoverable Error */ + u16 nrecmema; /* Non-Recoverable Mem log A */ +- u16 nrecmemb; /* Non-Recoverable Mem log B */ ++ u32 nrecmemb; /* Non-Recoverable Mem log B */ + + }; + +@@ -407,7 +407,7 @@ static void i5000_get_error_info(struct mem_ctl_info *mci, + NERR_FAT_FBD, &info->nerr_fat_fbd); + pci_read_config_word(pvt->branchmap_werrors, + NRECMEMA, &info->nrecmema); +- pci_read_config_word(pvt->branchmap_werrors, ++ pci_read_config_dword(pvt->branchmap_werrors, + NRECMEMB, &info->nrecmemb); + + /* Clear the error bits, by writing them back */ +@@ -1293,7 +1293,7 @@ static int i5000_init_csrows(struct mem_ctl_info *mci) + dimm->mtype = MEM_FB_DDR2; + + /* ask what device type on this row */ +- if (MTR_DRAM_WIDTH(mtr)) ++ if (MTR_DRAM_WIDTH(mtr) == 8) + dimm->dtype = DEV_X8; + else + dimm->dtype = DEV_X4; +diff --git a/drivers/edac/i5400_edac.c b/drivers/edac/i5400_edac.c +index 6ef6ad1ba16e..2ea2f32e608b 100644 +--- a/drivers/edac/i5400_edac.c ++++ b/drivers/edac/i5400_edac.c +@@ -368,7 +368,7 @@ struct i5400_error_info { + + /* These registers are input ONLY if there was a Non-Rec Error */ + u16 nrecmema; /* Non-Recoverable Mem log A */ +- u16 nrecmemb; /* Non-Recoverable Mem log B */ ++ u32 nrecmemb; /* Non-Recoverable Mem log B */ + + }; + +@@ -458,7 +458,7 @@ static void i5400_get_error_info(struct mem_ctl_info *mci, + NERR_FAT_FBD, &info->nerr_fat_fbd); + pci_read_config_word(pvt->branchmap_werrors, + NRECMEMA, &info->nrecmema); +- pci_read_config_word(pvt->branchmap_werrors, ++ pci_read_config_dword(pvt->branchmap_werrors, + NRECMEMB, &info->nrecmemb); + + /* Clear the error bits, by writing them back */ +@@ -1207,13 +1207,14 @@ static int i5400_init_dimms(struct mem_ctl_info *mci) + + dimm->nr_pages = size_mb << 8; + dimm->grain = 8; +- dimm->dtype = MTR_DRAM_WIDTH(mtr) ? DEV_X8 : DEV_X4; ++ dimm->dtype = MTR_DRAM_WIDTH(mtr) == 8 ? ++ DEV_X8 : DEV_X4; + dimm->mtype = MEM_FB_DDR2; + /* + * The eccc mechanism is SDDC (aka SECC), with + * is similar to Chipkill. + */ +- dimm->edac_mode = MTR_DRAM_WIDTH(mtr) ? ++ dimm->edac_mode = MTR_DRAM_WIDTH(mtr) == 8 ? + EDAC_S8ECD8ED : EDAC_S4ECD4ED; + ndimms++; + } +diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c +index a4944e22f294..2f48f848865f 100644 +--- a/drivers/firmware/efi/efi.c ++++ b/drivers/firmware/efi/efi.c +@@ -120,8 +120,7 @@ static ssize_t systab_show(struct kobject *kobj, + return str - buf; + } + +-static struct kobj_attribute efi_attr_systab = +- __ATTR(systab, 0400, systab_show, NULL); ++static struct kobj_attribute efi_attr_systab = __ATTR_RO_MODE(systab, 0400); + + #define EFI_FIELD(var) efi.var + +diff --git a/drivers/firmware/efi/esrt.c b/drivers/firmware/efi/esrt.c +index 14914074f716..307ec1c11276 100644 +--- a/drivers/firmware/efi/esrt.c ++++ b/drivers/firmware/efi/esrt.c +@@ -106,7 +106,7 @@ static const struct sysfs_ops esre_attr_ops = { + }; + + /* Generic ESRT Entry ("ESRE") support. */ +-static ssize_t esre_fw_class_show(struct esre_entry *entry, char *buf) ++static ssize_t fw_class_show(struct esre_entry *entry, char *buf) + { + char *str = buf; + +@@ -117,18 +117,16 @@ static ssize_t esre_fw_class_show(struct esre_entry *entry, char *buf) + return str - buf; + } + +-static struct esre_attribute esre_fw_class = __ATTR(fw_class, 0400, +- esre_fw_class_show, NULL); ++static struct esre_attribute esre_fw_class = __ATTR_RO_MODE(fw_class, 0400); + + #define esre_attr_decl(name, size, fmt) \ +-static ssize_t esre_##name##_show(struct esre_entry *entry, char *buf) \ ++static ssize_t name##_show(struct esre_entry *entry, char *buf) \ + { \ + return sprintf(buf, fmt "\n", \ + le##size##_to_cpu(entry->esre.esre1->name)); \ + } \ + \ +-static struct esre_attribute esre_##name = __ATTR(name, 0400, \ +- esre_##name##_show, NULL) ++static struct esre_attribute esre_##name = __ATTR_RO_MODE(name, 0400) + + esre_attr_decl(fw_type, 32, "%u"); + esre_attr_decl(fw_version, 32, "%u"); +@@ -193,14 +191,13 @@ static int esre_create_sysfs_entry(void *esre, int entry_num) + + /* support for displaying ESRT fields at the top level */ + #define esrt_attr_decl(name, size, fmt) \ +-static ssize_t esrt_##name##_show(struct kobject *kobj, \ ++static ssize_t name##_show(struct kobject *kobj, \ + struct kobj_attribute *attr, char *buf)\ + { \ + return sprintf(buf, fmt "\n", le##size##_to_cpu(esrt->name)); \ + } \ + \ +-static struct kobj_attribute esrt_##name = __ATTR(name, 0400, \ +- esrt_##name##_show, NULL) ++static struct kobj_attribute esrt_##name = __ATTR_RO_MODE(name, 0400) + + esrt_attr_decl(fw_resource_count, 32, "%u"); + esrt_attr_decl(fw_resource_count_max, 32, "%u"); +@@ -431,7 +428,7 @@ static int __init esrt_sysfs_init(void) + err_remove_esrt: + kobject_put(esrt_kobj); + err: +- kfree(esrt); ++ memunmap(esrt); + esrt = NULL; + return error; + } +diff --git a/drivers/firmware/efi/runtime-map.c b/drivers/firmware/efi/runtime-map.c +index 8e64b77aeac9..f377609ff141 100644 +--- a/drivers/firmware/efi/runtime-map.c ++++ b/drivers/firmware/efi/runtime-map.c +@@ -63,11 +63,11 @@ static ssize_t map_attr_show(struct kobject *kobj, struct attribute *attr, + return map_attr->show(entry, buf); + } + +-static struct map_attribute map_type_attr = __ATTR_RO(type); +-static struct map_attribute map_phys_addr_attr = __ATTR_RO(phys_addr); +-static struct map_attribute map_virt_addr_attr = __ATTR_RO(virt_addr); +-static struct map_attribute map_num_pages_attr = __ATTR_RO(num_pages); +-static struct map_attribute map_attribute_attr = __ATTR_RO(attribute); ++static struct map_attribute map_type_attr = __ATTR_RO_MODE(type, 0400); ++static struct map_attribute map_phys_addr_attr = __ATTR_RO_MODE(phys_addr, 0400); ++static struct map_attribute map_virt_addr_attr = __ATTR_RO_MODE(virt_addr, 0400); ++static struct map_attribute map_num_pages_attr = __ATTR_RO_MODE(num_pages, 0400); ++static struct map_attribute map_attribute_attr = __ATTR_RO_MODE(attribute, 0400); + + /* + * These are default attributes that are added for every memmap entry. +diff --git a/drivers/gpio/gpio-altera.c b/drivers/gpio/gpio-altera.c +index 5bddbd507ca9..3fe6a21e05a5 100644 +--- a/drivers/gpio/gpio-altera.c ++++ b/drivers/gpio/gpio-altera.c +@@ -90,21 +90,18 @@ static int altera_gpio_irq_set_type(struct irq_data *d, + + altera_gc = gpiochip_get_data(irq_data_get_irq_chip_data(d)); + +- if (type == IRQ_TYPE_NONE) ++ if (type == IRQ_TYPE_NONE) { ++ irq_set_handler_locked(d, handle_bad_irq); + return 0; +- if (type == IRQ_TYPE_LEVEL_HIGH && +- altera_gc->interrupt_trigger == IRQ_TYPE_LEVEL_HIGH) +- return 0; +- if (type == IRQ_TYPE_EDGE_RISING && +- altera_gc->interrupt_trigger == IRQ_TYPE_EDGE_RISING) +- return 0; +- if (type == IRQ_TYPE_EDGE_FALLING && +- altera_gc->interrupt_trigger == IRQ_TYPE_EDGE_FALLING) +- return 0; +- if (type == IRQ_TYPE_EDGE_BOTH && +- altera_gc->interrupt_trigger == IRQ_TYPE_EDGE_BOTH) ++ } ++ if (type == altera_gc->interrupt_trigger) { ++ if (type == IRQ_TYPE_LEVEL_HIGH) ++ irq_set_handler_locked(d, handle_level_irq); ++ else ++ irq_set_handler_locked(d, handle_simple_irq); + return 0; +- ++ } ++ irq_set_handler_locked(d, handle_bad_irq); + return -EINVAL; + } + +@@ -230,7 +227,6 @@ static void altera_gpio_irq_edge_handler(struct irq_desc *desc) + chained_irq_exit(chip, desc); + } + +- + static void altera_gpio_irq_leveL_high_handler(struct irq_desc *desc) + { + struct altera_gpio_chip *altera_gc; +@@ -310,7 +306,7 @@ static int altera_gpio_probe(struct platform_device *pdev) + altera_gc->interrupt_trigger = reg; + + ret = gpiochip_irqchip_add(&altera_gc->mmchip.gc, &altera_irq_chip, 0, +- handle_simple_irq, IRQ_TYPE_NONE); ++ handle_bad_irq, IRQ_TYPE_NONE); + + if (ret) { + dev_err(&pdev->dev, "could not add irqchip\n"); +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +index e41d4baebf86..ce9797b6f9c7 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +@@ -2020,8 +2020,11 @@ int amdgpu_device_resume(struct drm_device *dev, bool resume, bool fbcon) + } + + r = amdgpu_late_init(adev); +- if (r) ++ if (r) { ++ if (fbcon) ++ console_unlock(); + return r; ++ } + + /* pin cursors */ + list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) { +diff --git a/drivers/gpu/drm/armada/Makefile b/drivers/gpu/drm/armada/Makefile +index 26412d2f8c98..ffd673615772 100644 +--- a/drivers/gpu/drm/armada/Makefile ++++ b/drivers/gpu/drm/armada/Makefile +@@ -4,5 +4,3 @@ armada-y += armada_510.o + armada-$(CONFIG_DEBUG_FS) += armada_debugfs.o + + obj-$(CONFIG_DRM_ARMADA) := armada.o +- +-CFLAGS_armada_trace.o := -I$(src) +diff --git a/drivers/gpu/drm/exynos/exynos_drm_gem.c b/drivers/gpu/drm/exynos/exynos_drm_gem.c +index f2ae72ba7d5a..2abc47b554ab 100644 +--- a/drivers/gpu/drm/exynos/exynos_drm_gem.c ++++ b/drivers/gpu/drm/exynos/exynos_drm_gem.c +@@ -246,6 +246,15 @@ struct exynos_drm_gem *exynos_drm_gem_create(struct drm_device *dev, + if (IS_ERR(exynos_gem)) + return exynos_gem; + ++ if (!is_drm_iommu_supported(dev) && (flags & EXYNOS_BO_NONCONTIG)) { ++ /* ++ * when no IOMMU is available, all allocated buffers are ++ * contiguous anyway, so drop EXYNOS_BO_NONCONTIG flag ++ */ ++ flags &= ~EXYNOS_BO_NONCONTIG; ++ DRM_WARN("Non-contiguous allocation is not supported without IOMMU, falling back to contiguous buffer\n"); ++ } ++ + /* set memory type and cache attribute from user side. */ + exynos_gem->flags = flags; + +diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig +index cd4599c0523b..db607d51ee2b 100644 +--- a/drivers/hid/Kconfig ++++ b/drivers/hid/Kconfig +@@ -175,11 +175,11 @@ config HID_CHERRY + Support for Cherry Cymotion keyboard. + + config HID_CHICONY +- tristate "Chicony Tactical pad" ++ tristate "Chicony devices" + depends on HID + default !EXPERT + ---help--- +- Support for Chicony Tactical pad. ++ Support for Chicony Tactical pad and special keys on Chicony keyboards. + + config HID_CORSAIR + tristate "Corsair devices" +diff --git a/drivers/hid/hid-chicony.c b/drivers/hid/hid-chicony.c +index bc3cec199fee..f04ed9aabc3f 100644 +--- a/drivers/hid/hid-chicony.c ++++ b/drivers/hid/hid-chicony.c +@@ -86,6 +86,7 @@ static const struct hid_device_id ch_devices[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_WIRELESS2) }, + { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_AK1D) }, + { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_ACER_SWITCH12) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_JESS, USB_DEVICE_ID_JESS_ZEN_AIO_KBD) }, + { } + }; + MODULE_DEVICE_TABLE(hid, ch_devices); +diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c +index 4f3f5749b0c1..bdde8859e191 100644 +--- a/drivers/hid/hid-core.c ++++ b/drivers/hid/hid-core.c +@@ -1906,6 +1906,7 @@ static const struct hid_device_id hid_have_special_driver[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A081) }, + { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A0C2) }, + { HID_USB_DEVICE(USB_VENDOR_ID_HUION, USB_DEVICE_ID_HUION_TABLET) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_JESS, USB_DEVICE_ID_JESS_ZEN_AIO_KBD) }, + { HID_USB_DEVICE(USB_VENDOR_ID_JESS2, USB_DEVICE_ID_JESS2_COLOR_RUMBLE_PAD) }, + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ION, USB_DEVICE_ID_ICADE) }, + { HID_USB_DEVICE(USB_VENDOR_ID_KENSINGTON, USB_DEVICE_ID_KS_SLIMBLADE) }, +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 08fd3f831d62..433d5f675c03 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -558,6 +558,7 @@ + + #define USB_VENDOR_ID_JESS 0x0c45 + #define USB_DEVICE_ID_JESS_YUREX 0x1010 ++#define USB_DEVICE_ID_JESS_ZEN_AIO_KBD 0x5112 + + #define USB_VENDOR_ID_JESS2 0x0f30 + #define USB_DEVICE_ID_JESS2_COLOR_RUMBLE_PAD 0x0111 +diff --git a/drivers/i2c/busses/i2c-riic.c b/drivers/i2c/busses/i2c-riic.c +index 8f11d347b3ec..c811af4c8d81 100644 +--- a/drivers/i2c/busses/i2c-riic.c ++++ b/drivers/i2c/busses/i2c-riic.c +@@ -218,8 +218,12 @@ static irqreturn_t riic_tend_isr(int irq, void *data) + } + + if (riic->is_last || riic->err) { +- riic_clear_set_bit(riic, 0, ICIER_SPIE, RIIC_ICIER); ++ riic_clear_set_bit(riic, ICIER_TEIE, ICIER_SPIE, RIIC_ICIER); + writeb(ICCR2_SP, riic->base + RIIC_ICCR2); ++ } else { ++ /* Transfer is complete, but do not send STOP */ ++ riic_clear_set_bit(riic, ICIER_TEIE, 0, RIIC_ICIER); ++ complete(&riic->msg_done); + } + + return IRQ_HANDLED; +diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c +index c22454383976..709d6491d243 100644 +--- a/drivers/infiniband/hw/mlx4/qp.c ++++ b/drivers/infiniband/hw/mlx4/qp.c +@@ -1669,7 +1669,7 @@ static int __mlx4_ib_modify_qp(struct ib_qp *ibqp, + context->mtu_msgmax = (IB_MTU_4096 << 5) | + ilog2(dev->dev->caps.max_gso_sz); + else +- context->mtu_msgmax = (IB_MTU_4096 << 5) | 12; ++ context->mtu_msgmax = (IB_MTU_4096 << 5) | 13; + } else if (attr_mask & IB_QP_PATH_MTU) { + if (attr->path_mtu < IB_MTU_256 || attr->path_mtu > IB_MTU_4096) { + pr_err("path MTU (%u) is invalid\n", +diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c +index 786f640fc462..a2120ff0ef4c 100644 +--- a/drivers/infiniband/hw/mlx5/main.c ++++ b/drivers/infiniband/hw/mlx5/main.c +@@ -2514,6 +2514,8 @@ static int create_umr_res(struct mlx5_ib_dev *dev) + qp->real_qp = qp; + qp->uobject = NULL; + qp->qp_type = MLX5_IB_QPT_REG_UMR; ++ qp->send_cq = init_attr->send_cq; ++ qp->recv_cq = init_attr->recv_cq; + + attr->qp_state = IB_QPS_INIT; + attr->port_num = 1; +diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c +index 002f8a421efa..88bbc8ccc5e3 100644 +--- a/drivers/iommu/intel-iommu.c ++++ b/drivers/iommu/intel-iommu.c +@@ -2245,10 +2245,12 @@ static int __domain_mapping(struct dmar_domain *domain, unsigned long iov_pfn, + uint64_t tmp; + + if (!sg_res) { ++ unsigned int pgoff = sg->offset & ~PAGE_MASK; ++ + sg_res = aligned_nrpages(sg->offset, sg->length); +- sg->dma_address = ((dma_addr_t)iov_pfn << VTD_PAGE_SHIFT) + sg->offset; ++ sg->dma_address = ((dma_addr_t)iov_pfn << VTD_PAGE_SHIFT) + pgoff; + sg->dma_length = sg->length; +- pteval = page_to_phys(sg_page(sg)) | prot; ++ pteval = (sg_phys(sg) - pgoff) | prot; + phys_pfn = pteval >> VTD_PAGE_SHIFT; + } + +@@ -3894,7 +3896,7 @@ static int intel_nontranslate_map_sg(struct device *hddev, + + for_each_sg(sglist, sg, nelems, i) { + BUG_ON(!sg_page(sg)); +- sg->dma_address = page_to_phys(sg_page(sg)) + sg->offset; ++ sg->dma_address = sg_phys(sg); + sg->dma_length = sg->length; + } + return nelems; +diff --git a/drivers/irqchip/irq-crossbar.c b/drivers/irqchip/irq-crossbar.c +index 05bbf171df37..1070b7b959f2 100644 +--- a/drivers/irqchip/irq-crossbar.c ++++ b/drivers/irqchip/irq-crossbar.c +@@ -199,7 +199,7 @@ static const struct irq_domain_ops crossbar_domain_ops = { + static int __init crossbar_of_init(struct device_node *node) + { + int i, size, reserved = 0; +- u32 max = 0, entry; ++ u32 max = 0, entry, reg_size; + const __be32 *irqsr; + int ret = -ENOMEM; + +@@ -276,9 +276,9 @@ static int __init crossbar_of_init(struct device_node *node) + if (!cb->register_offsets) + goto err_irq_map; + +- of_property_read_u32(node, "ti,reg-size", &size); ++ of_property_read_u32(node, "ti,reg-size", ®_size); + +- switch (size) { ++ switch (reg_size) { + case 1: + cb->write = crossbar_writeb; + break; +@@ -304,7 +304,7 @@ static int __init crossbar_of_init(struct device_node *node) + continue; + + cb->register_offsets[i] = reserved; +- reserved += size; ++ reserved += reg_size; + } + + of_property_read_u32(node, "ti,irqs-safe-map", &cb->safe_map); +diff --git a/drivers/media/rc/lirc_dev.c b/drivers/media/rc/lirc_dev.c +index 6ebe89551961..f4509ef9922b 100644 +--- a/drivers/media/rc/lirc_dev.c ++++ b/drivers/media/rc/lirc_dev.c +@@ -446,6 +446,8 @@ int lirc_dev_fop_open(struct inode *inode, struct file *file) + return -ERESTARTSYS; + + ir = irctls[iminor(inode)]; ++ mutex_unlock(&lirc_dev_lock); ++ + if (!ir) { + retval = -ENODEV; + goto error; +@@ -486,8 +488,6 @@ int lirc_dev_fop_open(struct inode *inode, struct file *file) + } + + error: +- mutex_unlock(&lirc_dev_lock); +- + nonseekable_open(inode, file); + + return retval; +diff --git a/drivers/media/usb/dvb-usb/dibusb-common.c b/drivers/media/usb/dvb-usb/dibusb-common.c +index 8207e6900656..bcacb0f22028 100644 +--- a/drivers/media/usb/dvb-usb/dibusb-common.c ++++ b/drivers/media/usb/dvb-usb/dibusb-common.c +@@ -223,8 +223,20 @@ EXPORT_SYMBOL(dibusb_i2c_algo); + + int dibusb_read_eeprom_byte(struct dvb_usb_device *d, u8 offs, u8 *val) + { +- u8 wbuf[1] = { offs }; +- return dibusb_i2c_msg(d, 0x50, wbuf, 1, val, 1); ++ u8 *buf; ++ int rc; ++ ++ buf = kmalloc(2, GFP_KERNEL); ++ if (!buf) ++ return -ENOMEM; ++ ++ buf[0] = offs; ++ ++ rc = dibusb_i2c_msg(d, 0x50, &buf[0], 1, &buf[1], 1); ++ *val = buf[1]; ++ kfree(buf); ++ ++ return rc; + } + EXPORT_SYMBOL(dibusb_read_eeprom_byte); + +diff --git a/drivers/memory/omap-gpmc.c b/drivers/memory/omap-gpmc.c +index 5457c361ad58..bf0fe0137dfe 100644 +--- a/drivers/memory/omap-gpmc.c ++++ b/drivers/memory/omap-gpmc.c +@@ -1947,9 +1947,7 @@ static int gpmc_probe_onenand_child(struct platform_device *pdev, + if (!of_property_read_u32(child, "dma-channel", &val)) + gpmc_onenand_data->dma_channel = val; + +- gpmc_onenand_init(gpmc_onenand_data); +- +- return 0; ++ return gpmc_onenand_init(gpmc_onenand_data); + } + #else + static int gpmc_probe_onenand_child(struct platform_device *pdev, +diff --git a/drivers/net/can/ti_hecc.c b/drivers/net/can/ti_hecc.c +index 6749b1829469..4d01d7bc24ef 100644 +--- a/drivers/net/can/ti_hecc.c ++++ b/drivers/net/can/ti_hecc.c +@@ -652,6 +652,9 @@ static int ti_hecc_rx_poll(struct napi_struct *napi, int quota) + mbx_mask = hecc_read(priv, HECC_CANMIM); + mbx_mask |= HECC_TX_MBOX_MASK; + hecc_write(priv, HECC_CANMIM, mbx_mask); ++ } else { ++ /* repoll is done only if whole budget is used */ ++ num_pkts = quota; + } + + return num_pkts; +diff --git a/drivers/net/can/usb/ems_usb.c b/drivers/net/can/usb/ems_usb.c +index b3d02759c226..b00358297424 100644 +--- a/drivers/net/can/usb/ems_usb.c ++++ b/drivers/net/can/usb/ems_usb.c +@@ -288,6 +288,8 @@ static void ems_usb_read_interrupt_callback(struct urb *urb) + + case -ECONNRESET: /* unlink */ + case -ENOENT: ++ case -EPIPE: ++ case -EPROTO: + case -ESHUTDOWN: + return; + +diff --git a/drivers/net/can/usb/esd_usb2.c b/drivers/net/can/usb/esd_usb2.c +index 9fdb0f0bfa06..c6dcf93675c0 100644 +--- a/drivers/net/can/usb/esd_usb2.c ++++ b/drivers/net/can/usb/esd_usb2.c +@@ -393,6 +393,8 @@ static void esd_usb2_read_bulk_callback(struct urb *urb) + break; + + case -ENOENT: ++ case -EPIPE: ++ case -EPROTO: + case -ESHUTDOWN: + return; + +diff --git a/drivers/net/can/usb/kvaser_usb.c b/drivers/net/can/usb/kvaser_usb.c +index 4224e066cb16..c9d61a6dfb7a 100644 +--- a/drivers/net/can/usb/kvaser_usb.c ++++ b/drivers/net/can/usb/kvaser_usb.c +@@ -609,8 +609,8 @@ static int kvaser_usb_wait_msg(const struct kvaser_usb *dev, u8 id, + } + + if (pos + tmp->len > actual_len) { +- dev_err(dev->udev->dev.parent, +- "Format error\n"); ++ dev_err_ratelimited(dev->udev->dev.parent, ++ "Format error\n"); + break; + } + +@@ -813,6 +813,7 @@ static int kvaser_usb_simple_msg_async(struct kvaser_usb_net_priv *priv, + if (err) { + netdev_err(netdev, "Error transmitting URB\n"); + usb_unanchor_urb(urb); ++ kfree(buf); + usb_free_urb(urb); + return err; + } +@@ -1325,6 +1326,8 @@ static void kvaser_usb_read_bulk_callback(struct urb *urb) + case 0: + break; + case -ENOENT: ++ case -EPIPE: ++ case -EPROTO: + case -ESHUTDOWN: + return; + default: +@@ -1333,7 +1336,7 @@ static void kvaser_usb_read_bulk_callback(struct urb *urb) + goto resubmit_urb; + } + +- while (pos <= urb->actual_length - MSG_HEADER_LEN) { ++ while (pos <= (int)(urb->actual_length - MSG_HEADER_LEN)) { + msg = urb->transfer_buffer + pos; + + /* The Kvaser firmware can only read and write messages that +@@ -1352,7 +1355,8 @@ static void kvaser_usb_read_bulk_callback(struct urb *urb) + } + + if (pos + msg->len > urb->actual_length) { +- dev_err(dev->udev->dev.parent, "Format error\n"); ++ dev_err_ratelimited(dev->udev->dev.parent, ++ "Format error\n"); + break; + } + +@@ -1768,6 +1772,7 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb, + spin_unlock_irqrestore(&priv->tx_contexts_lock, flags); + + usb_unanchor_urb(urb); ++ kfree(buf); + + stats->tx_dropped++; + +diff --git a/drivers/net/can/usb/usb_8dev.c b/drivers/net/can/usb/usb_8dev.c +index d000cb62d6ae..27861c417c94 100644 +--- a/drivers/net/can/usb/usb_8dev.c ++++ b/drivers/net/can/usb/usb_8dev.c +@@ -524,6 +524,8 @@ static void usb_8dev_read_bulk_callback(struct urb *urb) + break; + + case -ENOENT: ++ case -EPIPE: ++ case -EPROTO: + case -ESHUTDOWN: + return; + +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c +index 4febe60eadc2..5d958b5bb8b1 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c +@@ -13293,17 +13293,15 @@ static int bnx2x_init_dev(struct bnx2x *bp, struct pci_dev *pdev, + dev->vlan_features = NETIF_F_SG | NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM | + NETIF_F_TSO | NETIF_F_TSO_ECN | NETIF_F_TSO6 | NETIF_F_HIGHDMA; + +- /* VF with OLD Hypervisor or old PF do not support filtering */ + if (IS_PF(bp)) { + if (chip_is_e1x) + bp->accept_any_vlan = true; + else + dev->hw_features |= NETIF_F_HW_VLAN_CTAG_FILTER; +-#ifdef CONFIG_BNX2X_SRIOV +- } else if (bp->acquire_resp.pfdev_info.pf_cap & PFVF_CAP_VLAN_FILTER) { +- dev->hw_features |= NETIF_F_HW_VLAN_CTAG_FILTER; +-#endif + } ++ /* For VF we'll know whether to enable VLAN filtering after ++ * getting a response to CHANNEL_TLV_ACQUIRE from PF. ++ */ + + dev->features |= dev->hw_features | NETIF_F_HW_VLAN_CTAG_RX; + dev->features |= NETIF_F_HIGHDMA; +@@ -13735,7 +13733,7 @@ static int bnx2x_ptp_adjfreq(struct ptp_clock_info *ptp, s32 ppb) + if (!netif_running(bp->dev)) { + DP(BNX2X_MSG_PTP, + "PTP adjfreq called while the interface is down\n"); +- return -EFAULT; ++ return -ENETDOWN; + } + + if (ppb < 0) { +@@ -13794,6 +13792,12 @@ static int bnx2x_ptp_adjtime(struct ptp_clock_info *ptp, s64 delta) + { + struct bnx2x *bp = container_of(ptp, struct bnx2x, ptp_clock_info); + ++ if (!netif_running(bp->dev)) { ++ DP(BNX2X_MSG_PTP, ++ "PTP adjtime called while the interface is down\n"); ++ return -ENETDOWN; ++ } ++ + DP(BNX2X_MSG_PTP, "PTP adjtime called, delta = %llx\n", delta); + + timecounter_adjtime(&bp->timecounter, delta); +@@ -13806,6 +13810,12 @@ static int bnx2x_ptp_gettime(struct ptp_clock_info *ptp, struct timespec64 *ts) + struct bnx2x *bp = container_of(ptp, struct bnx2x, ptp_clock_info); + u64 ns; + ++ if (!netif_running(bp->dev)) { ++ DP(BNX2X_MSG_PTP, ++ "PTP gettime called while the interface is down\n"); ++ return -ENETDOWN; ++ } ++ + ns = timecounter_read(&bp->timecounter); + + DP(BNX2X_MSG_PTP, "PTP gettime called, ns = %llu\n", ns); +@@ -13821,6 +13831,12 @@ static int bnx2x_ptp_settime(struct ptp_clock_info *ptp, + struct bnx2x *bp = container_of(ptp, struct bnx2x, ptp_clock_info); + u64 ns; + ++ if (!netif_running(bp->dev)) { ++ DP(BNX2X_MSG_PTP, ++ "PTP settime called while the interface is down\n"); ++ return -ENETDOWN; ++ } ++ + ns = timespec64_to_ns(ts); + + DP(BNX2X_MSG_PTP, "PTP settime called, ns = %llu\n", ns); +@@ -13988,6 +14004,14 @@ static int bnx2x_init_one(struct pci_dev *pdev, + rc = bnx2x_vfpf_acquire(bp, tx_count, rx_count); + if (rc) + goto init_one_freemem; ++ ++#ifdef CONFIG_BNX2X_SRIOV ++ /* VF with OLD Hypervisor or old PF do not support filtering */ ++ if (bp->acquire_resp.pfdev_info.pf_cap & PFVF_CAP_VLAN_FILTER) { ++ dev->hw_features |= NETIF_F_HW_VLAN_CTAG_FILTER; ++ dev->features |= NETIF_F_HW_VLAN_CTAG_FILTER; ++ } ++#endif + } + + /* Enable SRIOV if capability found in configuration space */ +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c +index 3f77d0863543..c6e059119b22 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c +@@ -434,7 +434,9 @@ static int bnx2x_vf_mac_vlan_config(struct bnx2x *bp, + + /* Add/Remove the filter */ + rc = bnx2x_config_vlan_mac(bp, &ramrod); +- if (rc && rc != -EEXIST) { ++ if (rc == -EEXIST) ++ return 0; ++ if (rc) { + BNX2X_ERR("Failed to %s %s\n", + filter->add ? "add" : "delete", + (filter->type == BNX2X_VF_FILTER_VLAN_MAC) ? +@@ -444,6 +446,8 @@ static int bnx2x_vf_mac_vlan_config(struct bnx2x *bp, + return rc; + } + ++ filter->applied = true; ++ + return 0; + } + +@@ -471,6 +475,8 @@ int bnx2x_vf_mac_vlan_config_list(struct bnx2x *bp, struct bnx2x_virtf *vf, + BNX2X_ERR("Managed only %d/%d filters - rolling back\n", + i, filters->count + 1); + while (--i >= 0) { ++ if (!filters->filters[i].applied) ++ continue; + filters->filters[i].add = !filters->filters[i].add; + bnx2x_vf_mac_vlan_config(bp, vf, qid, + &filters->filters[i], +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h +index 7a6d406f4c11..888d0b6632e8 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h +@@ -114,6 +114,7 @@ struct bnx2x_vf_mac_vlan_filter { + (BNX2X_VF_FILTER_MAC | BNX2X_VF_FILTER_VLAN) /*shortcut*/ + + bool add; ++ bool applied; + u8 *mac; + u16 vid; + }; +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c +index bfae300cf25f..c2d327d9dff0 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c +@@ -868,7 +868,7 @@ int bnx2x_vfpf_set_mcast(struct net_device *dev) + struct bnx2x *bp = netdev_priv(dev); + struct vfpf_set_q_filters_tlv *req = &bp->vf2pf_mbox->req.set_q_filters; + struct pfvf_general_resp_tlv *resp = &bp->vf2pf_mbox->resp.general_resp; +- int rc, i = 0; ++ int rc = 0, i = 0; + struct netdev_hw_addr *ha; + + if (bp->state != BNX2X_STATE_OPEN) { +@@ -883,6 +883,15 @@ int bnx2x_vfpf_set_mcast(struct net_device *dev) + /* Get Rx mode requested */ + DP(NETIF_MSG_IFUP, "dev->flags = %x\n", dev->flags); + ++ /* We support PFVF_MAX_MULTICAST_PER_VF mcast addresses tops */ ++ if (netdev_mc_count(dev) > PFVF_MAX_MULTICAST_PER_VF) { ++ DP(NETIF_MSG_IFUP, ++ "VF supports not more than %d multicast MAC addresses\n", ++ PFVF_MAX_MULTICAST_PER_VF); ++ rc = -EINVAL; ++ goto out; ++ } ++ + netdev_for_each_mc_addr(ha, dev) { + DP(NETIF_MSG_IFUP, "Adding mcast MAC: %pM\n", + bnx2x_mc_addr(ha)); +@@ -890,16 +899,6 @@ int bnx2x_vfpf_set_mcast(struct net_device *dev) + i++; + } + +- /* We support four PFVF_MAX_MULTICAST_PER_VF mcast +- * addresses tops +- */ +- if (i >= PFVF_MAX_MULTICAST_PER_VF) { +- DP(NETIF_MSG_IFUP, +- "VF supports not more than %d multicast MAC addresses\n", +- PFVF_MAX_MULTICAST_PER_VF); +- return -EINVAL; +- } +- + req->n_multicast = i; + req->flags |= VFPF_SET_Q_FILTERS_MULTICAST_CHANGED; + req->vf_qid = 0; +@@ -924,7 +923,7 @@ int bnx2x_vfpf_set_mcast(struct net_device *dev) + out: + bnx2x_vfpf_finalize(bp, &req->first_tlv); + +- return 0; ++ return rc; + } + + /* request pf to add a vlan for the vf */ +diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c +index b8778e7b1f79..7c6c1468628b 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -404,7 +404,7 @@ static int ibmvnic_open(struct net_device *netdev) + send_map_query(adapter); + for (i = 0; i < rxadd_subcrqs; i++) { + init_rx_pool(adapter, &adapter->rx_pool[i], +- IBMVNIC_BUFFS_PER_POOL, i, ++ adapter->req_rx_add_entries_per_subcrq, i, + be64_to_cpu(size_array[i]), 1); + if (alloc_rx_pool(adapter, &adapter->rx_pool[i])) { + dev_err(dev, "Couldn't alloc rx pool\n"); +@@ -419,23 +419,23 @@ static int ibmvnic_open(struct net_device *netdev) + for (i = 0; i < tx_subcrqs; i++) { + tx_pool = &adapter->tx_pool[i]; + tx_pool->tx_buff = +- kcalloc(adapter->max_tx_entries_per_subcrq, ++ kcalloc(adapter->req_tx_entries_per_subcrq, + sizeof(struct ibmvnic_tx_buff), GFP_KERNEL); + if (!tx_pool->tx_buff) + goto tx_pool_alloc_failed; + + if (alloc_long_term_buff(adapter, &tx_pool->long_term_buff, +- adapter->max_tx_entries_per_subcrq * ++ adapter->req_tx_entries_per_subcrq * + adapter->req_mtu)) + goto tx_ltb_alloc_failed; + + tx_pool->free_map = +- kcalloc(adapter->max_tx_entries_per_subcrq, ++ kcalloc(adapter->req_tx_entries_per_subcrq, + sizeof(int), GFP_KERNEL); + if (!tx_pool->free_map) + goto tx_fm_alloc_failed; + +- for (j = 0; j < adapter->max_tx_entries_per_subcrq; j++) ++ for (j = 0; j < adapter->req_tx_entries_per_subcrq; j++) + tx_pool->free_map[j] = j; + + tx_pool->consumer_index = 0; +@@ -705,6 +705,7 @@ static int ibmvnic_xmit(struct sk_buff *skb, struct net_device *netdev) + u8 *hdrs = (u8 *)&adapter->tx_rx_desc_req; + struct device *dev = &adapter->vdev->dev; + struct ibmvnic_tx_buff *tx_buff = NULL; ++ struct ibmvnic_sub_crq_queue *tx_scrq; + struct ibmvnic_tx_pool *tx_pool; + unsigned int tx_send_failed = 0; + unsigned int tx_map_failed = 0; +@@ -724,6 +725,7 @@ static int ibmvnic_xmit(struct sk_buff *skb, struct net_device *netdev) + int ret = 0; + + tx_pool = &adapter->tx_pool[queue_num]; ++ tx_scrq = adapter->tx_scrq[queue_num]; + txq = netdev_get_tx_queue(netdev, skb_get_queue_mapping(skb)); + handle_array = (u64 *)((u8 *)(adapter->login_rsp_buf) + + be32_to_cpu(adapter->login_rsp_buf-> +@@ -744,7 +746,7 @@ static int ibmvnic_xmit(struct sk_buff *skb, struct net_device *netdev) + + tx_pool->consumer_index = + (tx_pool->consumer_index + 1) % +- adapter->max_tx_entries_per_subcrq; ++ adapter->req_tx_entries_per_subcrq; + + tx_buff = &tx_pool->tx_buff[index]; + tx_buff->skb = skb; +@@ -817,7 +819,7 @@ static int ibmvnic_xmit(struct sk_buff *skb, struct net_device *netdev) + + if (tx_pool->consumer_index == 0) + tx_pool->consumer_index = +- adapter->max_tx_entries_per_subcrq - 1; ++ adapter->req_tx_entries_per_subcrq - 1; + else + tx_pool->consumer_index--; + +@@ -826,6 +828,14 @@ static int ibmvnic_xmit(struct sk_buff *skb, struct net_device *netdev) + ret = NETDEV_TX_BUSY; + goto out; + } ++ ++ atomic_inc(&tx_scrq->used); ++ ++ if (atomic_read(&tx_scrq->used) >= adapter->req_tx_entries_per_subcrq) { ++ netdev_info(netdev, "Stopping queue %d\n", queue_num); ++ netif_stop_subqueue(netdev, queue_num); ++ } ++ + tx_packets++; + tx_bytes += skb->len; + txq->trans_start = jiffies; +@@ -1220,6 +1230,7 @@ static struct ibmvnic_sub_crq_queue *init_sub_crq_queue(struct ibmvnic_adapter + scrq->adapter = adapter; + scrq->size = 4 * PAGE_SIZE / sizeof(*scrq->msgs); + scrq->cur = 0; ++ atomic_set(&scrq->used, 0); + scrq->rx_skb_top = NULL; + spin_lock_init(&scrq->lock); + +@@ -1368,14 +1379,28 @@ static int ibmvnic_complete_tx(struct ibmvnic_adapter *adapter, + DMA_TO_DEVICE); + } + +- if (txbuff->last_frag) ++ if (txbuff->last_frag) { ++ atomic_dec(&scrq->used); ++ ++ if (atomic_read(&scrq->used) <= ++ (adapter->req_tx_entries_per_subcrq / 2) && ++ netif_subqueue_stopped(adapter->netdev, ++ txbuff->skb)) { ++ netif_wake_subqueue(adapter->netdev, ++ scrq->pool_index); ++ netdev_dbg(adapter->netdev, ++ "Started queue %d\n", ++ scrq->pool_index); ++ } ++ + dev_kfree_skb_any(txbuff->skb); ++ } + + adapter->tx_pool[pool].free_map[adapter->tx_pool[pool]. + producer_index] = index; + adapter->tx_pool[pool].producer_index = + (adapter->tx_pool[pool].producer_index + 1) % +- adapter->max_tx_entries_per_subcrq; ++ adapter->req_tx_entries_per_subcrq; + } + /* remove tx_comp scrq*/ + next->tx_comp.first = 0; +diff --git a/drivers/net/ethernet/ibm/ibmvnic.h b/drivers/net/ethernet/ibm/ibmvnic.h +index dd775d951b73..892eda346e54 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.h ++++ b/drivers/net/ethernet/ibm/ibmvnic.h +@@ -863,6 +863,7 @@ struct ibmvnic_sub_crq_queue { + spinlock_t lock; + struct sk_buff *rx_skb_top; + struct ibmvnic_adapter *adapter; ++ atomic_t used; + }; + + struct ibmvnic_long_term_buff { +diff --git a/drivers/net/phy/spi_ks8995.c b/drivers/net/phy/spi_ks8995.c +index 93ffedfa2994..1e2d4f1179da 100644 +--- a/drivers/net/phy/spi_ks8995.c ++++ b/drivers/net/phy/spi_ks8995.c +@@ -491,13 +491,14 @@ static int ks8995_probe(struct spi_device *spi) + if (err) + return err; + +- ks->regs_attr.size = ks->chip->regs_size; + memcpy(&ks->regs_attr, &ks8995_registers_attr, sizeof(ks->regs_attr)); ++ ks->regs_attr.size = ks->chip->regs_size; + + err = ks8995_reset(ks); + if (err) + return err; + ++ sysfs_attr_init(&ks->regs_attr.attr); + err = sysfs_create_bin_file(&spi->dev.kobj, &ks->regs_attr); + if (err) { + dev_err(&spi->dev, "unable to create sysfs file, err=%d\n", +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c +index 8e3c6f4bdaa0..edffe5aeeeb1 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c +@@ -4080,8 +4080,8 @@ static void brcmf_sdio_firmware_callback(struct device *dev, int err, + sdio_release_host(sdiodev->func[1]); + fail: + brcmf_dbg(TRACE, "failed: dev=%s, err=%d\n", dev_name(dev), err); +- device_release_driver(dev); + device_release_driver(&sdiodev->func[2]->dev); ++ device_release_driver(dev); + } + + struct brcmf_sdio *brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev) +diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c +index d2a28a9d3209..4b462dc21c41 100644 +--- a/drivers/net/wireless/mac80211_hwsim.c ++++ b/drivers/net/wireless/mac80211_hwsim.c +@@ -3047,6 +3047,7 @@ static int hwsim_new_radio_nl(struct sk_buff *msg, struct genl_info *info) + { + struct hwsim_new_radio_params param = { 0 }; + const char *hwname = NULL; ++ int ret; + + param.reg_strict = info->attrs[HWSIM_ATTR_REG_STRICT_REG]; + param.p2p_device = info->attrs[HWSIM_ATTR_SUPPORT_P2P_DEVICE]; +@@ -3086,7 +3087,9 @@ static int hwsim_new_radio_nl(struct sk_buff *msg, struct genl_info *info) + param.regd = hwsim_world_regdom_custom[idx]; + } + +- return mac80211_hwsim_new_radio(info, ¶m); ++ ret = mac80211_hwsim_new_radio(info, ¶m); ++ kfree(hwname); ++ return ret; + } + + static int hwsim_del_radio_nl(struct sk_buff *msg, struct genl_info *info) +diff --git a/drivers/rapidio/devices/rio_mport_cdev.c b/drivers/rapidio/devices/rio_mport_cdev.c +index 9013a585507e..f32fc704cb7e 100644 +--- a/drivers/rapidio/devices/rio_mport_cdev.c ++++ b/drivers/rapidio/devices/rio_mport_cdev.c +@@ -964,7 +964,8 @@ rio_dma_transfer(struct file *filp, u32 transfer_mode, + req->sgt.sgl, req->sgt.nents, dir); + if (nents == -EFAULT) { + rmcd_error("Failed to map SG list"); +- return -EFAULT; ++ ret = -EFAULT; ++ goto err_pg; + } + + ret = do_dma_request(req, xfer, sync, nents); +diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c +index 4df3cdcf88ce..9c9563312a3d 100644 +--- a/drivers/scsi/lpfc/lpfc_els.c ++++ b/drivers/scsi/lpfc/lpfc_els.c +@@ -8185,11 +8185,17 @@ lpfc_cmpl_reg_new_vport(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmb) + spin_lock_irq(shost->host_lock); + vport->fc_flag |= FC_VPORT_NEEDS_REG_VPI; + spin_unlock_irq(shost->host_lock); +- if (vport->port_type == LPFC_PHYSICAL_PORT +- && !(vport->fc_flag & FC_LOGO_RCVD_DID_CHNG)) +- lpfc_issue_init_vfi(vport); +- else ++ if (mb->mbxStatus == MBX_NOT_FINISHED) ++ break; ++ if ((vport->port_type == LPFC_PHYSICAL_PORT) && ++ !(vport->fc_flag & FC_LOGO_RCVD_DID_CHNG)) { ++ if (phba->sli_rev == LPFC_SLI_REV4) ++ lpfc_issue_init_vfi(vport); ++ else ++ lpfc_initial_flogi(vport); ++ } else { + lpfc_initial_fdisc(vport); ++ } + break; + } + } else { +diff --git a/drivers/scsi/qla2xxx/qla_dbg.c b/drivers/scsi/qla2xxx/qla_dbg.c +index 658e4d15cb71..ce4ac769a9a2 100644 +--- a/drivers/scsi/qla2xxx/qla_dbg.c ++++ b/drivers/scsi/qla2xxx/qla_dbg.c +@@ -2707,13 +2707,9 @@ ql_dump_buffer(uint32_t level, scsi_qla_host_t *vha, int32_t id, + "%-+5d 0 1 2 3 4 5 6 7 8 9 A B C D E F\n", size); + ql_dbg(level, vha, id, + "----- -----------------------------------------------\n"); +- for (cnt = 0; cnt < size; cnt++, buf++) { +- if (cnt % 16 == 0) +- ql_dbg(level, vha, id, "%04x:", cnt & ~0xFU); +- printk(" %02x", *buf); +- if (cnt % 16 == 15) +- printk("\n"); ++ for (cnt = 0; cnt < size; cnt += 16) { ++ ql_dbg(level, vha, id, "%04x: ", cnt); ++ print_hex_dump(KERN_CONT, "", DUMP_PREFIX_NONE, 16, 1, ++ buf + cnt, min(16U, size - cnt), false); + } +- if (cnt % 16 != 0) +- printk("\n"); + } +diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c +index d8099c7cab00..c7b770075caa 100644 +--- a/drivers/scsi/scsi_lib.c ++++ b/drivers/scsi/scsi_lib.c +@@ -2041,11 +2041,13 @@ static void __scsi_init_queue(struct Scsi_Host *shost, struct request_queue *q) + q->limits.cluster = 0; + + /* +- * set a reasonable default alignment on word boundaries: the +- * host and device may alter it using +- * blk_queue_update_dma_alignment() later. ++ * Set a reasonable default alignment: The larger of 32-byte (dword), ++ * which is a common minimum for HBAs, and the minimum DMA alignment, ++ * which is set by the platform. ++ * ++ * Devices that require a bigger alignment can increase it later. + */ +- blk_queue_dma_alignment(q, 0x03); ++ blk_queue_dma_alignment(q, max(4, dma_get_cache_alignment()) - 1); + } + + struct request_queue *__scsi_alloc_queue(struct Scsi_Host *shost, +diff --git a/drivers/spi/Kconfig b/drivers/spi/Kconfig +index 8e281e47afec..b7995474148c 100644 +--- a/drivers/spi/Kconfig ++++ b/drivers/spi/Kconfig +@@ -365,7 +365,6 @@ config SPI_FSL_SPI + config SPI_FSL_DSPI + tristate "Freescale DSPI controller" + select REGMAP_MMIO +- depends on HAS_DMA + depends on SOC_VF610 || SOC_LS1021A || ARCH_LAYERSCAPE || COMPILE_TEST + help + This enables support for the Freescale DSPI controller in master +diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c +index c61ddbf94bc7..16c67120d72b 100644 +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -3092,15 +3092,10 @@ void dwc3_gadget_exit(struct dwc3 *dwc) + + int dwc3_gadget_suspend(struct dwc3 *dwc) + { +- int ret; +- + if (!dwc->gadget_driver) + return 0; + +- ret = dwc3_gadget_run_stop(dwc, false, false); +- if (ret < 0) +- return ret; +- ++ dwc3_gadget_run_stop(dwc, false, false); + dwc3_disconnect_gadget(dwc); + __dwc3_gadget_stop(dwc); + +diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c +index 502a096fc380..a5ca409dc97e 100644 +--- a/drivers/usb/gadget/configfs.c ++++ b/drivers/usb/gadget/configfs.c +@@ -269,6 +269,7 @@ static ssize_t gadget_dev_desc_UDC_store(struct config_item *item, + ret = unregister_gadget(gi); + if (ret) + goto err; ++ kfree(name); + } else { + if (gi->composite.gadget_driver.udc_name) { + ret = -EBUSY; +diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c +index 4fce83266926..346a630cebd5 100644 +--- a/drivers/usb/gadget/function/f_fs.c ++++ b/drivers/usb/gadget/function/f_fs.c +@@ -2262,9 +2262,18 @@ static int __ffs_data_do_os_desc(enum ffs_os_desc_type type, + int i; + + if (len < sizeof(*d) || +- d->bFirstInterfaceNumber >= ffs->interfaces_count || +- d->Reserved1) ++ d->bFirstInterfaceNumber >= ffs->interfaces_count) + return -EINVAL; ++ if (d->Reserved1 != 1) { ++ /* ++ * According to the spec, Reserved1 must be set to 1 ++ * but older kernels incorrectly rejected non-zero ++ * values. We fix it here to avoid returning EINVAL ++ * in response to values we used to accept. ++ */ ++ pr_debug("usb_ext_compat_desc::Reserved1 forced to 1\n"); ++ d->Reserved1 = 1; ++ } + for (i = 0; i < ARRAY_SIZE(d->Reserved2); ++i) + if (d->Reserved2[i]) + return -EINVAL; +diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c +index f69dbd4bcd18..b8534d3f8bb0 100644 +--- a/drivers/usb/gadget/legacy/inode.c ++++ b/drivers/usb/gadget/legacy/inode.c +@@ -1819,8 +1819,10 @@ dev_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr) + + spin_lock_irq (&dev->lock); + value = -EINVAL; +- if (dev->buf) ++ if (dev->buf) { ++ kfree(kbuf); + goto fail; ++ } + dev->buf = kbuf; + + /* full or low speed config */ +diff --git a/drivers/usb/gadget/udc/net2280.c b/drivers/usb/gadget/udc/net2280.c +index 33f3987218f7..d133252ef2c3 100644 +--- a/drivers/usb/gadget/udc/net2280.c ++++ b/drivers/usb/gadget/udc/net2280.c +@@ -1146,15 +1146,15 @@ static int scan_dma_completions(struct net2280_ep *ep) + */ + while (!list_empty(&ep->queue)) { + struct net2280_request *req; +- u32 tmp; ++ u32 req_dma_count; + + req = list_entry(ep->queue.next, + struct net2280_request, queue); + if (!req->valid) + break; + rmb(); +- tmp = le32_to_cpup(&req->td->dmacount); +- if ((tmp & BIT(VALID_BIT)) != 0) ++ req_dma_count = le32_to_cpup(&req->td->dmacount); ++ if ((req_dma_count & BIT(VALID_BIT)) != 0) + break; + + /* SHORT_PACKET_TRANSFERRED_INTERRUPT handles "usb-short" +@@ -1163,40 +1163,41 @@ static int scan_dma_completions(struct net2280_ep *ep) + */ + if (unlikely(req->td->dmadesc == 0)) { + /* paranoia */ +- tmp = readl(&ep->dma->dmacount); +- if (tmp & DMA_BYTE_COUNT_MASK) ++ u32 const ep_dmacount = readl(&ep->dma->dmacount); ++ ++ if (ep_dmacount & DMA_BYTE_COUNT_MASK) + break; + /* single transfer mode */ +- dma_done(ep, req, tmp, 0); ++ dma_done(ep, req, req_dma_count, 0); + num_completed++; + break; + } else if (!ep->is_in && + (req->req.length % ep->ep.maxpacket) && + !(ep->dev->quirks & PLX_PCIE)) { + +- tmp = readl(&ep->regs->ep_stat); ++ u32 const ep_stat = readl(&ep->regs->ep_stat); + /* AVOID TROUBLE HERE by not issuing short reads from + * your gadget driver. That helps avoids errata 0121, + * 0122, and 0124; not all cases trigger the warning. + */ +- if ((tmp & BIT(NAK_OUT_PACKETS)) == 0) { ++ if ((ep_stat & BIT(NAK_OUT_PACKETS)) == 0) { + ep_warn(ep->dev, "%s lost packet sync!\n", + ep->ep.name); + req->req.status = -EOVERFLOW; + } else { +- tmp = readl(&ep->regs->ep_avail); +- if (tmp) { ++ u32 const ep_avail = readl(&ep->regs->ep_avail); ++ if (ep_avail) { + /* fifo gets flushed later */ + ep->out_overflow = 1; + ep_dbg(ep->dev, + "%s dma, discard %d len %d\n", +- ep->ep.name, tmp, ++ ep->ep.name, ep_avail, + req->req.length); + req->req.status = -EOVERFLOW; + } + } + } +- dma_done(ep, req, tmp, 0); ++ dma_done(ep, req, req_dma_count, 0); + num_completed++; + } + +diff --git a/drivers/usb/gadget/udc/pxa27x_udc.c b/drivers/usb/gadget/udc/pxa27x_udc.c +index 7fa60f5b7ae4..afd6b86458c5 100644 +--- a/drivers/usb/gadget/udc/pxa27x_udc.c ++++ b/drivers/usb/gadget/udc/pxa27x_udc.c +@@ -2534,9 +2534,10 @@ static int pxa_udc_remove(struct platform_device *_dev) + usb_del_gadget_udc(&udc->gadget); + pxa_cleanup_debugfs(udc); + +- if (!IS_ERR_OR_NULL(udc->transceiver)) ++ if (!IS_ERR_OR_NULL(udc->transceiver)) { + usb_unregister_notifier(udc->transceiver, &pxa27x_udc_phy); +- usb_put_phy(udc->transceiver); ++ usb_put_phy(udc->transceiver); ++ } + + udc->transceiver = NULL; + the_controller = NULL; +diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c +index bb89e24c48b4..2197a50ed2ab 100644 +--- a/drivers/usb/gadget/udc/renesas_usb3.c ++++ b/drivers/usb/gadget/udc/renesas_usb3.c +@@ -222,7 +222,7 @@ + #define USB3_EP0_SS_MAX_PACKET_SIZE 512 + #define USB3_EP0_HSFS_MAX_PACKET_SIZE 64 + #define USB3_EP0_BUF_SIZE 8 +-#define USB3_MAX_NUM_PIPES 30 ++#define USB3_MAX_NUM_PIPES 6 /* This includes PIPE 0 */ + #define USB3_WAIT_US 3 + + struct renesas_usb3; +diff --git a/drivers/virtio/virtio.c b/drivers/virtio/virtio.c +index 7062bb0975a5..462e183609b6 100644 +--- a/drivers/virtio/virtio.c ++++ b/drivers/virtio/virtio.c +@@ -323,6 +323,8 @@ int register_virtio_device(struct virtio_device *dev) + /* device_register() causes the bus infrastructure to look for a + * matching driver. */ + err = device_register(&dev->dev); ++ if (err) ++ ida_simple_remove(&virtio_index_ida, dev->index); + out: + if (err) + add_status(dev, VIRTIO_CONFIG_S_FAILED); +diff --git a/fs/afs/cmservice.c b/fs/afs/cmservice.c +index d764236072b1..8d2c5180e015 100644 +--- a/fs/afs/cmservice.c ++++ b/fs/afs/cmservice.c +@@ -106,6 +106,9 @@ bool afs_cm_incoming_call(struct afs_call *call) + case CBProbe: + call->type = &afs_SRXCBProbe; + return true; ++ case CBProbeUuid: ++ call->type = &afs_SRXCBProbeUuid; ++ return true; + case CBTellMeAboutYourself: + call->type = &afs_SRXCBTellMeAboutYourself; + return true; +diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c +index c4cff5cc9c93..a29730c44850 100644 +--- a/fs/btrfs/extent-tree.c ++++ b/fs/btrfs/extent-tree.c +@@ -9362,6 +9362,7 @@ int btrfs_drop_snapshot(struct btrfs_root *root, + ret = btrfs_del_root(trans, tree_root, &root->root_key); + if (ret) { + btrfs_abort_transaction(trans, ret); ++ err = ret; + goto out_end_trans; + } + +diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c +index 65566d5fcf39..1e5321d1ed22 100644 +--- a/fs/nfs/dir.c ++++ b/fs/nfs/dir.c +@@ -2098,7 +2098,7 @@ int nfs_rename(struct inode *old_dir, struct dentry *old_dentry, + if (new_inode != NULL) + nfs_drop_nlink(new_inode); + d_move(old_dentry, new_dentry); +- nfs_set_verifier(new_dentry, ++ nfs_set_verifier(old_dentry, + nfs_save_change_attribute(new_dir)); + } else if (error == -ENOENT) + nfs_dentry_handle_enoent(old_dentry); +diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c +index fe9a9a183b2d..98ca9f1b6a07 100644 +--- a/fs/xfs/xfs_inode.c ++++ b/fs/xfs/xfs_inode.c +@@ -2386,6 +2386,7 @@ xfs_ifree_cluster( + */ + if (ip->i_ino != inum + i) { + xfs_iunlock(ip, XFS_ILOCK_EXCL); ++ rcu_read_unlock(); + continue; + } + } +diff --git a/include/linux/dma-mapping.h b/include/linux/dma-mapping.h +index 08528afdf58b..704caae69c42 100644 +--- a/include/linux/dma-mapping.h ++++ b/include/linux/dma-mapping.h +@@ -659,7 +659,6 @@ static inline void *dma_zalloc_coherent(struct device *dev, size_t size, + return ret; + } + +-#ifdef CONFIG_HAS_DMA + static inline int dma_get_cache_alignment(void) + { + #ifdef ARCH_DMA_MINALIGN +@@ -667,7 +666,6 @@ static inline int dma_get_cache_alignment(void) + #endif + return 1; + } +-#endif + + /* flags for the coherent memory api */ + #define DMA_MEMORY_MAP 0x01 +diff --git a/include/linux/genalloc.h b/include/linux/genalloc.h +index 29d4385903d4..206fe3bccccc 100644 +--- a/include/linux/genalloc.h ++++ b/include/linux/genalloc.h +@@ -32,6 +32,7 @@ + + #include <linux/types.h> + #include <linux/spinlock_types.h> ++#include <linux/atomic.h> + + struct device; + struct device_node; +@@ -70,7 +71,7 @@ struct gen_pool { + */ + struct gen_pool_chunk { + struct list_head next_chunk; /* next chunk in pool */ +- atomic_t avail; ++ atomic_long_t avail; + phys_addr_t phys_addr; /* physical starting address of memory chunk */ + unsigned long start_addr; /* start address of memory chunk */ + unsigned long end_addr; /* end address of memory chunk (inclusive) */ +diff --git a/include/linux/mmu_notifier.h b/include/linux/mmu_notifier.h +index 25c0dc31f084..854dfa6fa6e3 100644 +--- a/include/linux/mmu_notifier.h ++++ b/include/linux/mmu_notifier.h +@@ -381,18 +381,6 @@ static inline void mmu_notifier_mm_destroy(struct mm_struct *mm) + ___pmd; \ + }) + +-#define pmdp_huge_get_and_clear_notify(__mm, __haddr, __pmd) \ +-({ \ +- unsigned long ___haddr = __haddr & HPAGE_PMD_MASK; \ +- pmd_t ___pmd; \ +- \ +- ___pmd = pmdp_huge_get_and_clear(__mm, __haddr, __pmd); \ +- mmu_notifier_invalidate_range(__mm, ___haddr, \ +- ___haddr + HPAGE_PMD_SIZE); \ +- \ +- ___pmd; \ +-}) +- + /* + * set_pte_at_notify() sets the pte _after_ running the notifier. + * This is safe to start by updating the secondary MMUs, because the primary MMU +@@ -480,7 +468,6 @@ static inline void mmu_notifier_mm_destroy(struct mm_struct *mm) + #define pmdp_clear_young_notify pmdp_test_and_clear_young + #define ptep_clear_flush_notify ptep_clear_flush + #define pmdp_huge_clear_flush_notify pmdp_huge_clear_flush +-#define pmdp_huge_get_and_clear_notify pmdp_huge_get_and_clear + #define set_pte_at_notify set_pte_at + + #endif /* CONFIG_MMU_NOTIFIER */ +diff --git a/include/linux/omap-gpmc.h b/include/linux/omap-gpmc.h +index 35d0fd7a4948..e821a3132a3e 100644 +--- a/include/linux/omap-gpmc.h ++++ b/include/linux/omap-gpmc.h +@@ -88,10 +88,11 @@ static inline int gpmc_nand_init(struct omap_nand_platform_data *d, + #endif + + #if IS_ENABLED(CONFIG_MTD_ONENAND_OMAP2) +-extern void gpmc_onenand_init(struct omap_onenand_platform_data *d); ++extern int gpmc_onenand_init(struct omap_onenand_platform_data *d); + #else + #define board_onenand_data NULL +-static inline void gpmc_onenand_init(struct omap_onenand_platform_data *d) ++static inline int gpmc_onenand_init(struct omap_onenand_platform_data *d) + { ++ return 0; + } + #endif +diff --git a/include/linux/sysfs.h b/include/linux/sysfs.h +index c6f0f0d0e17e..00a1f330f93a 100644 +--- a/include/linux/sysfs.h ++++ b/include/linux/sysfs.h +@@ -116,6 +116,12 @@ struct attribute_group { + .show = _name##_show, \ + } + ++#define __ATTR_RO_MODE(_name, _mode) { \ ++ .attr = { .name = __stringify(_name), \ ++ .mode = VERIFY_OCTAL_PERMISSIONS(_mode) }, \ ++ .show = _name##_show, \ ++} ++ + #define __ATTR_WO(_name) { \ + .attr = { .name = __stringify(_name), .mode = S_IWUSR }, \ + .store = _name##_store, \ +diff --git a/include/scsi/libsas.h b/include/scsi/libsas.h +index dae99d7d2bc0..706a7017885c 100644 +--- a/include/scsi/libsas.h ++++ b/include/scsi/libsas.h +@@ -165,11 +165,11 @@ struct expander_device { + + struct sata_device { + unsigned int class; +- struct smp_resp rps_resp; /* report_phy_sata_resp */ + u8 port_no; /* port number, if this is a PM (Port) */ + + struct ata_port *ap; + struct ata_host ata_host; ++ struct smp_resp rps_resp ____cacheline_aligned; /* report_phy_sata_resp */ + u8 fis[ATA_RESP_FIS_SIZE]; + }; + +diff --git a/kernel/bpf/percpu_freelist.c b/kernel/bpf/percpu_freelist.c +index 5c51d1985b51..673fa6fe2d73 100644 +--- a/kernel/bpf/percpu_freelist.c ++++ b/kernel/bpf/percpu_freelist.c +@@ -78,8 +78,10 @@ struct pcpu_freelist_node *pcpu_freelist_pop(struct pcpu_freelist *s) + { + struct pcpu_freelist_head *head; + struct pcpu_freelist_node *node; ++ unsigned long flags; + int orig_cpu, cpu; + ++ local_irq_save(flags); + orig_cpu = cpu = raw_smp_processor_id(); + while (1) { + head = per_cpu_ptr(s->freelist, cpu); +@@ -87,14 +89,16 @@ struct pcpu_freelist_node *pcpu_freelist_pop(struct pcpu_freelist *s) + node = head->first; + if (node) { + head->first = node->next; +- raw_spin_unlock(&head->lock); ++ raw_spin_unlock_irqrestore(&head->lock, flags); + return node; + } + raw_spin_unlock(&head->lock); + cpu = cpumask_next(cpu, cpu_possible_mask); + if (cpu >= nr_cpu_ids) + cpu = 0; +- if (cpu == orig_cpu) ++ if (cpu == orig_cpu) { ++ local_irq_restore(flags); + return NULL; ++ } + } + } +diff --git a/kernel/cpu.c b/kernel/cpu.c +index 26a4f74bff83..e1436ca4aed0 100644 +--- a/kernel/cpu.c ++++ b/kernel/cpu.c +@@ -1321,11 +1321,6 @@ static struct cpuhp_step cpuhp_bp_states[] = { + .teardown.single = NULL, + .cant_stop = true, + }, +- [CPUHP_AP_SMPCFD_DYING] = { +- .name = "smpcfd:dying", +- .startup.single = NULL, +- .teardown.single = smpcfd_dying_cpu, +- }, + /* + * Handled on controll processor until the plugged processor manages + * this itself. +@@ -1367,6 +1362,11 @@ static struct cpuhp_step cpuhp_ap_states[] = { + .startup.single = NULL, + .teardown.single = rcutree_dying_cpu, + }, ++ [CPUHP_AP_SMPCFD_DYING] = { ++ .name = "smpcfd:dying", ++ .startup.single = NULL, ++ .teardown.single = smpcfd_dying_cpu, ++ }, + /* Entry state on starting. Interrupts enabled from here on. Transient + * state for synchronsization */ + [CPUHP_AP_ONLINE] = { +diff --git a/kernel/debug/kdb/kdb_io.c b/kernel/debug/kdb/kdb_io.c +index fc1ef736253c..77777d918676 100644 +--- a/kernel/debug/kdb/kdb_io.c ++++ b/kernel/debug/kdb/kdb_io.c +@@ -349,7 +349,7 @@ static char *kdb_read(char *buffer, size_t bufsize) + } + kdb_printf("\n"); + for (i = 0; i < count; i++) { +- if (kallsyms_symbol_next(p_tmp, i) < 0) ++ if (WARN_ON(!kallsyms_symbol_next(p_tmp, i))) + break; + kdb_printf("%s ", p_tmp); + *(p_tmp + len) = '\0'; +diff --git a/kernel/jump_label.c b/kernel/jump_label.c +index a9b8cf500591..def4548ea40c 100644 +--- a/kernel/jump_label.c ++++ b/kernel/jump_label.c +@@ -612,7 +612,7 @@ static __init int jump_label_test(void) + + return 0; + } +-late_initcall(jump_label_test); ++early_initcall(jump_label_test); + #endif /* STATIC_KEYS_SELFTEST */ + + #endif /* HAVE_JUMP_LABEL */ +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index 7a68c631d5b5..3d862f5b0331 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -5451,7 +5451,7 @@ static int select_idle_cpu(struct task_struct *p, struct sched_domain *sd, int t + * Due to large variance we need a large fuzz factor; hackbench in + * particularly is sensitive here. + */ +- if ((avg_idle / 512) < avg_cost) ++ if (sched_feat(SIS_AVG_CPU) && (avg_idle / 512) < avg_cost) + return -1; + + time = local_clock(); +diff --git a/kernel/sched/features.h b/kernel/sched/features.h +index 69631fa46c2f..1b3c8189b286 100644 +--- a/kernel/sched/features.h ++++ b/kernel/sched/features.h +@@ -51,6 +51,11 @@ SCHED_FEAT(NONTASK_CAPACITY, true) + */ + SCHED_FEAT(TTWU_QUEUE, true) + ++/* ++ * When doing wakeups, attempt to limit superfluous scans of the LLC domain. ++ */ ++SCHED_FEAT(SIS_AVG_CPU, false) ++ + #ifdef HAVE_RT_PUSH_IPI + /* + * In order to avoid a thundering herd attack of CPUs that are +diff --git a/kernel/workqueue.c b/kernel/workqueue.c +index 296dcca77f33..181c2ad0cb54 100644 +--- a/kernel/workqueue.c ++++ b/kernel/workqueue.c +@@ -1506,6 +1506,7 @@ static void __queue_delayed_work(int cpu, struct workqueue_struct *wq, + struct timer_list *timer = &dwork->timer; + struct work_struct *work = &dwork->work; + ++ WARN_ON_ONCE(!wq); + WARN_ON_ONCE(timer->function != delayed_work_timer_fn || + timer->data != (unsigned long)dwork); + WARN_ON_ONCE(timer_pending(timer)); +diff --git a/lib/asn1_decoder.c b/lib/asn1_decoder.c +index 1ef0cec38d78..dc14beae2c9a 100644 +--- a/lib/asn1_decoder.c ++++ b/lib/asn1_decoder.c +@@ -313,42 +313,47 @@ int asn1_ber_decoder(const struct asn1_decoder *decoder, + + /* Decide how to handle the operation */ + switch (op) { +- case ASN1_OP_MATCH_ANY_ACT: +- case ASN1_OP_MATCH_ANY_ACT_OR_SKIP: +- case ASN1_OP_COND_MATCH_ANY_ACT: +- case ASN1_OP_COND_MATCH_ANY_ACT_OR_SKIP: +- ret = actions[machine[pc + 1]](context, hdr, tag, data + dp, len); +- if (ret < 0) +- return ret; +- goto skip_data; +- +- case ASN1_OP_MATCH_ACT: +- case ASN1_OP_MATCH_ACT_OR_SKIP: +- case ASN1_OP_COND_MATCH_ACT_OR_SKIP: +- ret = actions[machine[pc + 2]](context, hdr, tag, data + dp, len); +- if (ret < 0) +- return ret; +- goto skip_data; +- + case ASN1_OP_MATCH: + case ASN1_OP_MATCH_OR_SKIP: ++ case ASN1_OP_MATCH_ACT: ++ case ASN1_OP_MATCH_ACT_OR_SKIP: + case ASN1_OP_MATCH_ANY: + case ASN1_OP_MATCH_ANY_OR_SKIP: ++ case ASN1_OP_MATCH_ANY_ACT: ++ case ASN1_OP_MATCH_ANY_ACT_OR_SKIP: + case ASN1_OP_COND_MATCH_OR_SKIP: ++ case ASN1_OP_COND_MATCH_ACT_OR_SKIP: + case ASN1_OP_COND_MATCH_ANY: + case ASN1_OP_COND_MATCH_ANY_OR_SKIP: +- skip_data: ++ case ASN1_OP_COND_MATCH_ANY_ACT: ++ case ASN1_OP_COND_MATCH_ANY_ACT_OR_SKIP: ++ + if (!(flags & FLAG_CONS)) { + if (flags & FLAG_INDEFINITE_LENGTH) { ++ size_t tmp = dp; ++ + ret = asn1_find_indefinite_length( +- data, datalen, &dp, &len, &errmsg); ++ data, datalen, &tmp, &len, &errmsg); + if (ret < 0) + goto error; +- } else { +- dp += len; + } + pr_debug("- LEAF: %zu\n", len); + } ++ ++ if (op & ASN1_OP_MATCH__ACT) { ++ unsigned char act; ++ ++ if (op & ASN1_OP_MATCH__ANY) ++ act = machine[pc + 1]; ++ else ++ act = machine[pc + 2]; ++ ret = actions[act](context, hdr, tag, data + dp, len); ++ if (ret < 0) ++ return ret; ++ } ++ ++ if (!(flags & FLAG_CONS)) ++ dp += len; + pc += asn1_op_lengths[op]; + goto next_op; + +@@ -434,6 +439,8 @@ int asn1_ber_decoder(const struct asn1_decoder *decoder, + else + act = machine[pc + 1]; + ret = actions[act](context, hdr, 0, data + tdp, len); ++ if (ret < 0) ++ return ret; + } + pc += asn1_op_lengths[op]; + goto next_op; +diff --git a/lib/dynamic_debug.c b/lib/dynamic_debug.c +index da796e2dc4f5..c7c96bc7654a 100644 +--- a/lib/dynamic_debug.c ++++ b/lib/dynamic_debug.c +@@ -360,6 +360,10 @@ static int ddebug_parse_query(char *words[], int nwords, + if (parse_lineno(last, &query->last_lineno) < 0) + return -EINVAL; + ++ /* special case for last lineno not specified */ ++ if (query->last_lineno == 0) ++ query->last_lineno = UINT_MAX; ++ + if (query->last_lineno < query->first_lineno) { + pr_err("last-line:%d < 1st-line:%d\n", + query->last_lineno, +diff --git a/lib/genalloc.c b/lib/genalloc.c +index 144fe6b1a03e..ca06adc4f445 100644 +--- a/lib/genalloc.c ++++ b/lib/genalloc.c +@@ -194,7 +194,7 @@ int gen_pool_add_virt(struct gen_pool *pool, unsigned long virt, phys_addr_t phy + chunk->phys_addr = phys; + chunk->start_addr = virt; + chunk->end_addr = virt + size - 1; +- atomic_set(&chunk->avail, size); ++ atomic_long_set(&chunk->avail, size); + + spin_lock(&pool->lock); + list_add_rcu(&chunk->next_chunk, &pool->chunks); +@@ -304,7 +304,7 @@ unsigned long gen_pool_alloc_algo(struct gen_pool *pool, size_t size, + nbits = (size + (1UL << order) - 1) >> order; + rcu_read_lock(); + list_for_each_entry_rcu(chunk, &pool->chunks, next_chunk) { +- if (size > atomic_read(&chunk->avail)) ++ if (size > atomic_long_read(&chunk->avail)) + continue; + + start_bit = 0; +@@ -324,7 +324,7 @@ unsigned long gen_pool_alloc_algo(struct gen_pool *pool, size_t size, + + addr = chunk->start_addr + ((unsigned long)start_bit << order); + size = nbits << order; +- atomic_sub(size, &chunk->avail); ++ atomic_long_sub(size, &chunk->avail); + break; + } + rcu_read_unlock(); +@@ -390,7 +390,7 @@ void gen_pool_free(struct gen_pool *pool, unsigned long addr, size_t size) + remain = bitmap_clear_ll(chunk->bits, start_bit, nbits); + BUG_ON(remain); + size = nbits << order; +- atomic_add(size, &chunk->avail); ++ atomic_long_add(size, &chunk->avail); + rcu_read_unlock(); + return; + } +@@ -464,7 +464,7 @@ size_t gen_pool_avail(struct gen_pool *pool) + + rcu_read_lock(); + list_for_each_entry_rcu(chunk, &pool->chunks, next_chunk) +- avail += atomic_read(&chunk->avail); ++ avail += atomic_long_read(&chunk->avail); + rcu_read_unlock(); + return avail; + } +diff --git a/mm/huge_memory.c b/mm/huge_memory.c +index 3cae1dcf069c..c234c078693c 100644 +--- a/mm/huge_memory.c ++++ b/mm/huge_memory.c +@@ -1509,37 +1509,69 @@ int change_huge_pmd(struct vm_area_struct *vma, pmd_t *pmd, + { + struct mm_struct *mm = vma->vm_mm; + spinlock_t *ptl; +- int ret = 0; ++ pmd_t entry; ++ bool preserve_write; ++ int ret; + + ptl = __pmd_trans_huge_lock(pmd, vma); +- if (ptl) { +- pmd_t entry; +- bool preserve_write = prot_numa && pmd_write(*pmd); +- ret = 1; ++ if (!ptl) ++ return 0; + +- /* +- * Avoid trapping faults against the zero page. The read-only +- * data is likely to be read-cached on the local CPU and +- * local/remote hits to the zero page are not interesting. +- */ +- if (prot_numa && is_huge_zero_pmd(*pmd)) { +- spin_unlock(ptl); +- return ret; +- } ++ preserve_write = prot_numa && pmd_write(*pmd); ++ ret = 1; + +- if (!prot_numa || !pmd_protnone(*pmd)) { +- entry = pmdp_huge_get_and_clear_notify(mm, addr, pmd); +- entry = pmd_modify(entry, newprot); +- if (preserve_write) +- entry = pmd_mkwrite(entry); +- ret = HPAGE_PMD_NR; +- set_pmd_at(mm, addr, pmd, entry); +- BUG_ON(vma_is_anonymous(vma) && !preserve_write && +- pmd_write(entry)); +- } +- spin_unlock(ptl); +- } ++ /* ++ * Avoid trapping faults against the zero page. The read-only ++ * data is likely to be read-cached on the local CPU and ++ * local/remote hits to the zero page are not interesting. ++ */ ++ if (prot_numa && is_huge_zero_pmd(*pmd)) ++ goto unlock; ++ ++ if (prot_numa && pmd_protnone(*pmd)) ++ goto unlock; ++ ++ /* ++ * In case prot_numa, we are under down_read(mmap_sem). It's critical ++ * to not clear pmd intermittently to avoid race with MADV_DONTNEED ++ * which is also under down_read(mmap_sem): ++ * ++ * CPU0: CPU1: ++ * change_huge_pmd(prot_numa=1) ++ * pmdp_huge_get_and_clear_notify() ++ * madvise_dontneed() ++ * zap_pmd_range() ++ * pmd_trans_huge(*pmd) == 0 (without ptl) ++ * // skip the pmd ++ * set_pmd_at(); ++ * // pmd is re-established ++ * ++ * The race makes MADV_DONTNEED miss the huge pmd and don't clear it ++ * which may break userspace. ++ * ++ * pmdp_invalidate() is required to make sure we don't miss ++ * dirty/young flags set by hardware. ++ */ ++ entry = *pmd; ++ pmdp_invalidate(vma, addr, pmd); + ++ /* ++ * Recover dirty/young flags. It relies on pmdp_invalidate to not ++ * corrupt them. ++ */ ++ if (pmd_dirty(*pmd)) ++ entry = pmd_mkdirty(entry); ++ if (pmd_young(*pmd)) ++ entry = pmd_mkyoung(entry); ++ ++ entry = pmd_modify(entry, newprot); ++ if (preserve_write) ++ entry = pmd_mkwrite(entry); ++ ret = HPAGE_PMD_NR; ++ set_pmd_at(mm, addr, pmd, entry); ++ BUG_ON(vma_is_anonymous(vma) && !preserve_write && pmd_write(entry)); ++unlock: ++ spin_unlock(ptl); + return ret; + } + +diff --git a/mm/zsmalloc.c b/mm/zsmalloc.c +index 1689bb58e0d1..d3548c48369f 100644 +--- a/mm/zsmalloc.c ++++ b/mm/zsmalloc.c +@@ -1407,7 +1407,7 @@ void *zs_map_object(struct zs_pool *pool, unsigned long handle, + * pools/users, we can't allow mapping in interrupt context + * because it can corrupt another users mappings. + */ +- WARN_ON_ONCE(in_interrupt()); ++ BUG_ON(in_interrupt()); + + /* From now on, migration cannot move the object */ + pin_tag(handle); +diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c +index 713c09a74b90..0c9ded247ebb 100644 +--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c ++++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c +@@ -158,6 +158,10 @@ static unsigned int ipv4_conntrack_local(void *priv, + if (skb->len < sizeof(struct iphdr) || + ip_hdrlen(skb) < sizeof(struct iphdr)) + return NF_ACCEPT; ++ ++ if (ip_is_fragment(ip_hdr(skb))) /* IP_NODEFRAG setsockopt set */ ++ return NF_ACCEPT; ++ + return nf_conntrack_in(state->net, PF_INET, state->hook, skb); + } + +diff --git a/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c b/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c +index f8aad03d674b..6f5e8d01b876 100644 +--- a/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c ++++ b/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c +@@ -255,11 +255,6 @@ nf_nat_ipv4_fn(void *priv, struct sk_buff *skb, + /* maniptype == SRC for postrouting. */ + enum nf_nat_manip_type maniptype = HOOK2MANIP(state->hook); + +- /* We never see fragments: conntrack defrags on pre-routing +- * and local-out, and nf_nat_out protects post-routing. +- */ +- NF_CT_ASSERT(!ip_is_fragment(ip_hdr(skb))); +- + ct = nf_ct_get(skb, &ctinfo); + /* Can't track? It's not due to stress, or conntrack would + * have dropped it. Hence it's the user's responsibilty to +diff --git a/net/ipv4/route.c b/net/ipv4/route.c +index 6a5b7783932e..7ac319222558 100644 +--- a/net/ipv4/route.c ++++ b/net/ipv4/route.c +@@ -630,9 +630,12 @@ static void update_or_create_fnhe(struct fib_nh *nh, __be32 daddr, __be32 gw, + struct fnhe_hash_bucket *hash; + struct fib_nh_exception *fnhe; + struct rtable *rt; ++ u32 genid, hval; + unsigned int i; + int depth; +- u32 hval = fnhe_hashfun(daddr); ++ ++ genid = fnhe_genid(dev_net(nh->nh_dev)); ++ hval = fnhe_hashfun(daddr); + + spin_lock_bh(&fnhe_lock); + +@@ -655,12 +658,13 @@ static void update_or_create_fnhe(struct fib_nh *nh, __be32 daddr, __be32 gw, + } + + if (fnhe) { ++ if (fnhe->fnhe_genid != genid) ++ fnhe->fnhe_genid = genid; + if (gw) + fnhe->fnhe_gw = gw; +- if (pmtu) { ++ if (pmtu) + fnhe->fnhe_pmtu = pmtu; +- fnhe->fnhe_expires = max(1UL, expires); +- } ++ fnhe->fnhe_expires = max(1UL, expires); + /* Update all cached dsts too */ + rt = rcu_dereference(fnhe->fnhe_rth_input); + if (rt) +@@ -679,7 +683,7 @@ static void update_or_create_fnhe(struct fib_nh *nh, __be32 daddr, __be32 gw, + fnhe->fnhe_next = hash->chain; + rcu_assign_pointer(hash->chain, fnhe); + } +- fnhe->fnhe_genid = fnhe_genid(dev_net(nh->nh_dev)); ++ fnhe->fnhe_genid = genid; + fnhe->fnhe_daddr = daddr; + fnhe->fnhe_gw = gw; + fnhe->fnhe_pmtu = pmtu; +diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c +index 46ad699937fd..8285a1c108c9 100644 +--- a/net/ipv6/af_inet6.c ++++ b/net/ipv6/af_inet6.c +@@ -909,12 +909,12 @@ static int __init inet6_init(void) + err = register_pernet_subsys(&inet6_net_ops); + if (err) + goto register_pernet_fail; +- err = icmpv6_init(); +- if (err) +- goto icmp_fail; + err = ip6_mr_init(); + if (err) + goto ipmr_fail; ++ err = icmpv6_init(); ++ if (err) ++ goto icmp_fail; + err = ndisc_init(); + if (err) + goto ndisc_fail; +@@ -1044,10 +1044,10 @@ static int __init inet6_init(void) + ndisc_cleanup(); + ndisc_fail: + ip6_mr_cleanup(); +-ipmr_fail: +- icmpv6_cleanup(); + icmp_fail: + unregister_pernet_subsys(&inet6_net_ops); ++ipmr_fail: ++ icmpv6_cleanup(); + register_pernet_fail: + sock_unregister(PF_INET6); + rtnl_unregister_all(PF_INET6); +diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c +index e9b14e3493f2..c46066c5dc27 100644 +--- a/net/ipv6/ip6_gre.c ++++ b/net/ipv6/ip6_gre.c +@@ -461,7 +461,7 @@ static int ip6gre_rcv(struct sk_buff *skb, const struct tnl_ptk_info *tpi) + &ipv6h->saddr, &ipv6h->daddr, tpi->key, + tpi->proto); + if (tunnel) { +- ip6_tnl_rcv(tunnel, skb, tpi, NULL, false); ++ ip6_tnl_rcv(tunnel, skb, tpi, NULL, log_ecn_error); + + return PACKET_RCVD; + } +diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c +index 67e882d49195..912333586de6 100644 +--- a/net/ipv6/ip6_vti.c ++++ b/net/ipv6/ip6_vti.c +@@ -485,11 +485,15 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl) + if (!skb->ignore_df && skb->len > mtu) { + skb_dst(skb)->ops->update_pmtu(dst, NULL, skb, mtu); + +- if (skb->protocol == htons(ETH_P_IPV6)) ++ if (skb->protocol == htons(ETH_P_IPV6)) { ++ if (mtu < IPV6_MIN_MTU) ++ mtu = IPV6_MIN_MTU; ++ + icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu); +- else ++ } else { + icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, + htonl(mtu)); ++ } + + return -EMSGSIZE; + } +diff --git a/net/rds/tcp.c b/net/rds/tcp.c +index 20e2923dc827..78f976d32018 100644 +--- a/net/rds/tcp.c ++++ b/net/rds/tcp.c +@@ -478,9 +478,10 @@ static void __net_exit rds_tcp_exit_net(struct net *net) + * we do need to clean up the listen socket here. + */ + if (rtn->rds_tcp_listen_sock) { +- rds_tcp_listen_stop(rtn->rds_tcp_listen_sock); ++ struct socket *lsock = rtn->rds_tcp_listen_sock; ++ + rtn->rds_tcp_listen_sock = NULL; +- flush_work(&rtn->rds_tcp_accept_w); ++ rds_tcp_listen_stop(lsock, &rtn->rds_tcp_accept_w); + } + } + +@@ -517,10 +518,10 @@ static void rds_tcp_kill_sock(struct net *net) + struct rds_tcp_connection *tc, *_tc; + LIST_HEAD(tmp_list); + struct rds_tcp_net *rtn = net_generic(net, rds_tcp_netid); ++ struct socket *lsock = rtn->rds_tcp_listen_sock; + +- rds_tcp_listen_stop(rtn->rds_tcp_listen_sock); + rtn->rds_tcp_listen_sock = NULL; +- flush_work(&rtn->rds_tcp_accept_w); ++ rds_tcp_listen_stop(lsock, &rtn->rds_tcp_accept_w); + spin_lock_irq(&rds_tcp_conn_lock); + list_for_each_entry_safe(tc, _tc, &rds_tcp_conn_list, t_tcp_node) { + struct net *c_net = read_pnet(&tc->t_cpath->cp_conn->c_net); +@@ -540,8 +541,12 @@ static void rds_tcp_kill_sock(struct net *net) + void *rds_tcp_listen_sock_def_readable(struct net *net) + { + struct rds_tcp_net *rtn = net_generic(net, rds_tcp_netid); ++ struct socket *lsock = rtn->rds_tcp_listen_sock; ++ ++ if (!lsock) ++ return NULL; + +- return rtn->rds_tcp_listen_sock->sk->sk_user_data; ++ return lsock->sk->sk_user_data; + } + + static int rds_tcp_dev_event(struct notifier_block *this, +diff --git a/net/rds/tcp.h b/net/rds/tcp.h +index 9a1cc8906576..56ea6620fcf9 100644 +--- a/net/rds/tcp.h ++++ b/net/rds/tcp.h +@@ -66,7 +66,7 @@ void rds_tcp_state_change(struct sock *sk); + + /* tcp_listen.c */ + struct socket *rds_tcp_listen_init(struct net *); +-void rds_tcp_listen_stop(struct socket *); ++void rds_tcp_listen_stop(struct socket *sock, struct work_struct *acceptor); + void rds_tcp_listen_data_ready(struct sock *sk); + int rds_tcp_accept_one(struct socket *sock); + int rds_tcp_keepalive(struct socket *sock); +diff --git a/net/rds/tcp_listen.c b/net/rds/tcp_listen.c +index 525b624fec8b..185a56b1e29c 100644 +--- a/net/rds/tcp_listen.c ++++ b/net/rds/tcp_listen.c +@@ -227,6 +227,9 @@ void rds_tcp_listen_data_ready(struct sock *sk) + * before it has been accepted and the accepter has set up their + * data_ready.. we only want to queue listen work for our listening + * socket ++ * ++ * (*ready)() may be null if we are racing with netns delete, and ++ * the listen socket is being torn down. + */ + if (sk->sk_state == TCP_LISTEN) + rds_tcp_accept_work(sk); +@@ -235,7 +238,8 @@ void rds_tcp_listen_data_ready(struct sock *sk) + + out: + read_unlock_bh(&sk->sk_callback_lock); +- ready(sk); ++ if (ready) ++ ready(sk); + } + + struct socket *rds_tcp_listen_init(struct net *net) +@@ -275,7 +279,7 @@ struct socket *rds_tcp_listen_init(struct net *net) + return NULL; + } + +-void rds_tcp_listen_stop(struct socket *sock) ++void rds_tcp_listen_stop(struct socket *sock, struct work_struct *acceptor) + { + struct sock *sk; + +@@ -296,5 +300,6 @@ void rds_tcp_listen_stop(struct socket *sock) + + /* wait for accepts to stop and close the socket */ + flush_workqueue(rds_wq); ++ flush_work(acceptor); + sock_release(sock); + } +diff --git a/net/sctp/socket.c b/net/sctp/socket.c +index c062ceae19e6..c2ab864da50d 100644 +--- a/net/sctp/socket.c ++++ b/net/sctp/socket.c +@@ -82,8 +82,8 @@ + /* Forward declarations for internal helper functions. */ + static int sctp_writeable(struct sock *sk); + static void sctp_wfree(struct sk_buff *skb); +-static int sctp_wait_for_sndbuf(struct sctp_association *, long *timeo_p, +- size_t msg_len); ++static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p, ++ size_t msg_len, struct sock **orig_sk); + static int sctp_wait_for_packet(struct sock *sk, int *err, long *timeo_p); + static int sctp_wait_for_connect(struct sctp_association *, long *timeo_p); + static int sctp_wait_for_accept(struct sock *sk, long timeo); +@@ -1957,9 +1957,16 @@ static int sctp_sendmsg(struct sock *sk, struct msghdr *msg, size_t msg_len) + + timeo = sock_sndtimeo(sk, msg->msg_flags & MSG_DONTWAIT); + if (!sctp_wspace(asoc)) { +- err = sctp_wait_for_sndbuf(asoc, &timeo, msg_len); +- if (err) ++ /* sk can be changed by peel off when waiting for buf. */ ++ err = sctp_wait_for_sndbuf(asoc, &timeo, msg_len, &sk); ++ if (err) { ++ if (err == -ESRCH) { ++ /* asoc is already dead. */ ++ new_asoc = NULL; ++ err = -EPIPE; ++ } + goto out_free; ++ } + } + + /* If an address is passed with the sendto/sendmsg call, it is used +@@ -4771,12 +4778,6 @@ int sctp_do_peeloff(struct sock *sk, sctp_assoc_t id, struct socket **sockp) + if (!asoc) + return -EINVAL; + +- /* If there is a thread waiting on more sndbuf space for +- * sending on this asoc, it cannot be peeled. +- */ +- if (waitqueue_active(&asoc->wait)) +- return -EBUSY; +- + /* An association cannot be branched off from an already peeled-off + * socket, nor is this supported for tcp style sockets. + */ +@@ -7440,7 +7441,7 @@ void sctp_sock_rfree(struct sk_buff *skb) + + /* Helper function to wait for space in the sndbuf. */ + static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p, +- size_t msg_len) ++ size_t msg_len, struct sock **orig_sk) + { + struct sock *sk = asoc->base.sk; + int err = 0; +@@ -7457,10 +7458,11 @@ static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p, + for (;;) { + prepare_to_wait_exclusive(&asoc->wait, &wait, + TASK_INTERRUPTIBLE); ++ if (asoc->base.dead) ++ goto do_dead; + if (!*timeo_p) + goto do_nonblock; +- if (sk->sk_err || asoc->state >= SCTP_STATE_SHUTDOWN_PENDING || +- asoc->base.dead) ++ if (sk->sk_err || asoc->state >= SCTP_STATE_SHUTDOWN_PENDING) + goto do_error; + if (signal_pending(current)) + goto do_interrupted; +@@ -7473,11 +7475,17 @@ static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p, + release_sock(sk); + current_timeo = schedule_timeout(current_timeo); + lock_sock(sk); ++ if (sk != asoc->base.sk) { ++ release_sock(sk); ++ sk = asoc->base.sk; ++ lock_sock(sk); ++ } + + *timeo_p = current_timeo; + } + + out: ++ *orig_sk = sk; + finish_wait(&asoc->wait, &wait); + + /* Release the association's refcnt. */ +@@ -7485,6 +7493,10 @@ static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p, + + return err; + ++do_dead: ++ err = -ESRCH; ++ goto out; ++ + do_error: + err = -EPIPE; + goto out; +diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c +index 5db68b371db2..600eacce653a 100644 +--- a/net/sunrpc/sched.c ++++ b/net/sunrpc/sched.c +@@ -274,10 +274,9 @@ static inline void rpc_task_set_debuginfo(struct rpc_task *task) + + static void rpc_set_active(struct rpc_task *task) + { +- trace_rpc_task_begin(task->tk_client, task, NULL); +- + rpc_task_set_debuginfo(task); + set_bit(RPC_TASK_ACTIVE, &task->tk_runstate); ++ trace_rpc_task_begin(task->tk_client, task, NULL); + } + + /* +diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c +index 8ce5711ea21b..f19e6a57e118 100644 +--- a/net/xfrm/xfrm_policy.c ++++ b/net/xfrm/xfrm_policy.c +@@ -1393,6 +1393,7 @@ static struct xfrm_policy *clone_policy(const struct xfrm_policy *old, int dir) + newp->xfrm_nr = old->xfrm_nr; + newp->index = old->index; + newp->type = old->type; ++ newp->family = old->family; + memcpy(newp->xfrm_vec, old->xfrm_vec, + newp->xfrm_nr*sizeof(struct xfrm_tmpl)); + spin_lock_bh(&net->xfrm.xfrm_policy_lock); +diff --git a/scripts/coccicheck b/scripts/coccicheck +index ec487b8e7051..c36b04b41686 100755 +--- a/scripts/coccicheck ++++ b/scripts/coccicheck +@@ -29,12 +29,6 @@ else + VERBOSE=0 + fi + +-if [ -z "$J" ]; then +- NPROC=$(getconf _NPROCESSORS_ONLN) +-else +- NPROC="$J" +-fi +- + FLAGS="--very-quiet" + + # You can use SPFLAGS to append extra arguments to coccicheck or override any +@@ -69,6 +63,9 @@ if [ "$C" = "1" -o "$C" = "2" ]; then + # Take only the last argument, which is the C file to test + shift $(( $# - 1 )) + OPTIONS="$COCCIINCLUDE $1" ++ ++ # No need to parallelize Coccinelle since this mode takes one input file. ++ NPROC=1 + else + ONLINE=0 + if [ "$KBUILD_EXTMOD" = "" ] ; then +@@ -76,6 +73,12 @@ else + else + OPTIONS="--dir $KBUILD_EXTMOD $COCCIINCLUDE" + fi ++ ++ if [ -z "$J" ]; then ++ NPROC=$(getconf _NPROCESSORS_ONLN) ++ else ++ NPROC="$J" ++ fi + fi + + if [ "$KBUILD_EXTMOD" != "" ] ; then +diff --git a/scripts/module-common.lds b/scripts/module-common.lds +index 73a2c7da0e55..53234e85192a 100644 +--- a/scripts/module-common.lds ++++ b/scripts/module-common.lds +@@ -19,4 +19,6 @@ SECTIONS { + + . = ALIGN(8); + .init_array 0 : { *(SORT(.init_array.*)) *(.init_array) } ++ ++ __jump_table 0 : ALIGN(8) { KEEP(*(__jump_table)) } + } +diff --git a/scripts/package/Makefile b/scripts/package/Makefile +index 71b4a8af9d4d..7badec3498b8 100644 +--- a/scripts/package/Makefile ++++ b/scripts/package/Makefile +@@ -39,10 +39,9 @@ if test "$(objtree)" != "$(srctree)"; then \ + false; \ + fi ; \ + $(srctree)/scripts/setlocalversion --save-scmversion; \ +-ln -sf $(srctree) $(2); \ + tar -cz $(RCS_TAR_IGNORE) -f $(2).tar.gz \ +- $(addprefix $(2)/,$(TAR_CONTENT) $(3)); \ +-rm -f $(2) $(objtree)/.scmversion ++ --transform 's:^:$(2)/:S' $(TAR_CONTENT) $(3); \ ++rm -f $(objtree)/.scmversion + + # rpm-pkg + # --------------------------------------------------------------------------- +diff --git a/security/keys/request_key.c b/security/keys/request_key.c +index 5030fcf23681..cb7f8f730c6d 100644 +--- a/security/keys/request_key.c ++++ b/security/keys/request_key.c +@@ -250,11 +250,12 @@ static int construct_key(struct key *key, const void *callout_info, + * The keyring selected is returned with an extra reference upon it which the + * caller must release. + */ +-static void construct_get_dest_keyring(struct key **_dest_keyring) ++static int construct_get_dest_keyring(struct key **_dest_keyring) + { + struct request_key_auth *rka; + const struct cred *cred = current_cred(); + struct key *dest_keyring = *_dest_keyring, *authkey; ++ int ret; + + kenter("%p", dest_keyring); + +@@ -263,6 +264,8 @@ static void construct_get_dest_keyring(struct key **_dest_keyring) + /* the caller supplied one */ + key_get(dest_keyring); + } else { ++ bool do_perm_check = true; ++ + /* use a default keyring; falling through the cases until we + * find one that we actually have */ + switch (cred->jit_keyring) { +@@ -277,8 +280,10 @@ static void construct_get_dest_keyring(struct key **_dest_keyring) + dest_keyring = + key_get(rka->dest_keyring); + up_read(&authkey->sem); +- if (dest_keyring) ++ if (dest_keyring) { ++ do_perm_check = false; + break; ++ } + } + + case KEY_REQKEY_DEFL_THREAD_KEYRING: +@@ -313,11 +318,29 @@ static void construct_get_dest_keyring(struct key **_dest_keyring) + default: + BUG(); + } ++ ++ /* ++ * Require Write permission on the keyring. This is essential ++ * because the default keyring may be the session keyring, and ++ * joining a keyring only requires Search permission. ++ * ++ * However, this check is skipped for the "requestor keyring" so ++ * that /sbin/request-key can itself use request_key() to add ++ * keys to the original requestor's destination keyring. ++ */ ++ if (dest_keyring && do_perm_check) { ++ ret = key_permission(make_key_ref(dest_keyring, 1), ++ KEY_NEED_WRITE); ++ if (ret) { ++ key_put(dest_keyring); ++ return ret; ++ } ++ } + } + + *_dest_keyring = dest_keyring; + kleave(" [dk %d]", key_serial(dest_keyring)); +- return; ++ return 0; + } + + /* +@@ -443,11 +466,15 @@ static struct key *construct_key_and_link(struct keyring_search_context *ctx, + if (ctx->index_key.type == &key_type_keyring) + return ERR_PTR(-EPERM); + +- user = key_user_lookup(current_fsuid()); +- if (!user) +- return ERR_PTR(-ENOMEM); ++ ret = construct_get_dest_keyring(&dest_keyring); ++ if (ret) ++ goto error; + +- construct_get_dest_keyring(&dest_keyring); ++ user = key_user_lookup(current_fsuid()); ++ if (!user) { ++ ret = -ENOMEM; ++ goto error_put_dest_keyring; ++ } + + ret = construct_alloc_key(ctx, dest_keyring, flags, user, &key); + key_user_put(user); +@@ -462,7 +489,7 @@ static struct key *construct_key_and_link(struct keyring_search_context *ctx, + } else if (ret == -EINPROGRESS) { + ret = 0; + } else { +- goto couldnt_alloc_key; ++ goto error_put_dest_keyring; + } + + key_put(dest_keyring); +@@ -472,8 +499,9 @@ static struct key *construct_key_and_link(struct keyring_search_context *ctx, + construction_failed: + key_negate_and_link(key, key_negative_timeout, NULL, NULL); + key_put(key); +-couldnt_alloc_key: ++error_put_dest_keyring: + key_put(dest_keyring); ++error: + kleave(" = %d", ret); + return ERR_PTR(ret); + } +diff --git a/sound/core/pcm.c b/sound/core/pcm.c +index 8e980aa678d0..074363b63cc4 100644 +--- a/sound/core/pcm.c ++++ b/sound/core/pcm.c +@@ -149,7 +149,9 @@ static int snd_pcm_control_ioctl(struct snd_card *card, + err = -ENXIO; + goto _error; + } ++ mutex_lock(&pcm->open_mutex); + err = snd_pcm_info_user(substream, info); ++ mutex_unlock(&pcm->open_mutex); + _error: + mutex_unlock(®ister_mutex); + return err; +diff --git a/sound/core/seq/seq_timer.c b/sound/core/seq/seq_timer.c +index 37d9cfbc29f9..b80985fbc334 100644 +--- a/sound/core/seq/seq_timer.c ++++ b/sound/core/seq/seq_timer.c +@@ -355,7 +355,7 @@ static int initialize_timer(struct snd_seq_timer *tmr) + unsigned long freq; + + t = tmr->timeri->timer; +- if (snd_BUG_ON(!t)) ++ if (!t) + return -EINVAL; + + freq = tmr->preferred_resolution; +diff --git a/sound/soc/sh/rcar/ssiu.c b/sound/soc/sh/rcar/ssiu.c +index 6f9b388ec5a8..3f95d6b88f8c 100644 +--- a/sound/soc/sh/rcar/ssiu.c ++++ b/sound/soc/sh/rcar/ssiu.c +@@ -44,7 +44,11 @@ static int rsnd_ssiu_init(struct rsnd_mod *mod, + mask1 = (1 << 4) | (1 << 20); /* mask sync bit */ + mask2 = (1 << 4); /* mask sync bit */ + val1 = val2 = 0; +- if (rsnd_ssi_is_pin_sharing(io)) { ++ if (id == 8) { ++ /* ++ * SSI8 pin is sharing with SSI7, nothing to do. ++ */ ++ } else if (rsnd_ssi_is_pin_sharing(io)) { + int shift = -1; + + switch (id) { +diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c +index 9133d3e53d9d..24c897f0b571 100644 +--- a/sound/usb/mixer.c ++++ b/sound/usb/mixer.c +@@ -204,6 +204,10 @@ static int snd_usb_copy_string_desc(struct mixer_build *state, + int index, char *buf, int maxlen) + { + int len = usb_string(state->chip->dev, index, buf, maxlen - 1); ++ ++ if (len < 0) ++ return 0; ++ + buf[len] = 0; + return len; + } +@@ -2168,13 +2172,14 @@ static int parse_audio_selector_unit(struct mixer_build *state, int unitid, + if (len) + ; + else if (nameid) +- snd_usb_copy_string_desc(state, nameid, kctl->id.name, ++ len = snd_usb_copy_string_desc(state, nameid, kctl->id.name, + sizeof(kctl->id.name)); +- else { ++ else + len = get_term_name(state, &state->oterm, + kctl->id.name, sizeof(kctl->id.name), 0); +- if (!len) +- strlcpy(kctl->id.name, "USB", sizeof(kctl->id.name)); ++ ++ if (!len) { ++ strlcpy(kctl->id.name, "USB", sizeof(kctl->id.name)); + + if (desc->bDescriptorSubtype == UAC2_CLOCK_SELECTOR) + append_ctl_name(kctl, " Clock Source"); +diff --git a/tools/hv/hv_kvp_daemon.c b/tools/hv/hv_kvp_daemon.c +index bc7adb84e679..60a94b3e532e 100644 +--- a/tools/hv/hv_kvp_daemon.c ++++ b/tools/hv/hv_kvp_daemon.c +@@ -193,11 +193,14 @@ static void kvp_update_mem_state(int pool) + for (;;) { + readp = &record[records_read]; + records_read += fread(readp, sizeof(struct kvp_record), +- ENTRIES_PER_BLOCK * num_blocks, +- filep); ++ ENTRIES_PER_BLOCK * num_blocks - records_read, ++ filep); + + if (ferror(filep)) { +- syslog(LOG_ERR, "Failed to read file, pool: %d", pool); ++ syslog(LOG_ERR, ++ "Failed to read file, pool: %d; error: %d %s", ++ pool, errno, strerror(errno)); ++ kvp_release_lock(pool); + exit(EXIT_FAILURE); + } + +@@ -210,6 +213,7 @@ static void kvp_update_mem_state(int pool) + + if (record == NULL) { + syslog(LOG_ERR, "malloc failed"); ++ kvp_release_lock(pool); + exit(EXIT_FAILURE); + } + continue; +@@ -224,15 +228,11 @@ static void kvp_update_mem_state(int pool) + fclose(filep); + kvp_release_lock(pool); + } ++ + static int kvp_file_init(void) + { + int fd; +- FILE *filep; +- size_t records_read; + char *fname; +- struct kvp_record *record; +- struct kvp_record *readp; +- int num_blocks; + int i; + int alloc_unit = sizeof(struct kvp_record) * ENTRIES_PER_BLOCK; + +@@ -246,61 +246,19 @@ static int kvp_file_init(void) + + for (i = 0; i < KVP_POOL_COUNT; i++) { + fname = kvp_file_info[i].fname; +- records_read = 0; +- num_blocks = 1; + sprintf(fname, "%s/.kvp_pool_%d", KVP_CONFIG_LOC, i); + fd = open(fname, O_RDWR | O_CREAT | O_CLOEXEC, 0644 /* rw-r--r-- */); + + if (fd == -1) + return 1; + +- +- filep = fopen(fname, "re"); +- if (!filep) { +- close(fd); +- return 1; +- } +- +- record = malloc(alloc_unit * num_blocks); +- if (record == NULL) { +- fclose(filep); +- close(fd); +- return 1; +- } +- for (;;) { +- readp = &record[records_read]; +- records_read += fread(readp, sizeof(struct kvp_record), +- ENTRIES_PER_BLOCK, +- filep); +- +- if (ferror(filep)) { +- syslog(LOG_ERR, "Failed to read file, pool: %d", +- i); +- exit(EXIT_FAILURE); +- } +- +- if (!feof(filep)) { +- /* +- * We have more data to read. +- */ +- num_blocks++; +- record = realloc(record, alloc_unit * +- num_blocks); +- if (record == NULL) { +- fclose(filep); +- close(fd); +- return 1; +- } +- continue; +- } +- break; +- } + kvp_file_info[i].fd = fd; +- kvp_file_info[i].num_blocks = num_blocks; +- kvp_file_info[i].records = record; +- kvp_file_info[i].num_records = records_read; +- fclose(filep); +- ++ kvp_file_info[i].num_blocks = 1; ++ kvp_file_info[i].records = malloc(alloc_unit); ++ if (kvp_file_info[i].records == NULL) ++ return 1; ++ kvp_file_info[i].num_records = 0; ++ kvp_update_mem_state(i); + } + + return 0; +diff --git a/tools/testing/selftests/powerpc/harness.c b/tools/testing/selftests/powerpc/harness.c +index 248a820048df..66d31de60b9a 100644 +--- a/tools/testing/selftests/powerpc/harness.c ++++ b/tools/testing/selftests/powerpc/harness.c +@@ -114,9 +114,11 @@ int test_harness(int (test_function)(void), char *name) + + rc = run_test(test_function, name); + +- if (rc == MAGIC_SKIP_RETURN_VALUE) ++ if (rc == MAGIC_SKIP_RETURN_VALUE) { + test_skip(name); +- else ++ /* so that skipped test is not marked as failed */ ++ rc = 0; ++ } else + test_finish(name, rc); + + return rc; +diff --git a/tools/testing/selftests/x86/fsgsbase.c b/tools/testing/selftests/x86/fsgsbase.c +index 9b4610c6d3fb..f249e042b3b5 100644 +--- a/tools/testing/selftests/x86/fsgsbase.c ++++ b/tools/testing/selftests/x86/fsgsbase.c +@@ -245,7 +245,7 @@ void do_unexpected_base(void) + long ret; + asm volatile ("int $0x80" + : "=a" (ret) : "a" (243), "b" (low_desc) +- : "flags"); ++ : "r8", "r9", "r10", "r11"); + memcpy(&desc, low_desc, sizeof(desc)); + munmap(low_desc, sizeof(desc)); + +diff --git a/tools/testing/selftests/x86/ldt_gdt.c b/tools/testing/selftests/x86/ldt_gdt.c +index f936a3cd3e35..ac1a7a3f87b2 100644 +--- a/tools/testing/selftests/x86/ldt_gdt.c ++++ b/tools/testing/selftests/x86/ldt_gdt.c +@@ -45,6 +45,12 @@ + #define AR_DB (1 << 22) + #define AR_G (1 << 23) + ++#ifdef __x86_64__ ++# define INT80_CLOBBERS "r8", "r9", "r10", "r11" ++#else ++# define INT80_CLOBBERS ++#endif ++ + static int nerrs; + + /* Points to an array of 1024 ints, each holding its own index. */ +@@ -649,7 +655,7 @@ static int invoke_set_thread_area(void) + asm volatile ("int $0x80" + : "=a" (ret), "+m" (low_user_desc) : + "a" (243), "b" (low_user_desc) +- : "flags"); ++ : INT80_CLOBBERS); + return ret; + } + +@@ -718,7 +724,7 @@ static void test_gdt_invalidation(void) + "+a" (eax) + : "m" (low_user_desc_clear), + [arg1] "r" ((unsigned int)(unsigned long)low_user_desc_clear) +- : "flags"); ++ : INT80_CLOBBERS); + + if (sel != 0) { + result = "FAIL"; +@@ -749,7 +755,7 @@ static void test_gdt_invalidation(void) + "+a" (eax) + : "m" (low_user_desc_clear), + [arg1] "r" ((unsigned int)(unsigned long)low_user_desc_clear) +- : "flags"); ++ : INT80_CLOBBERS); + + if (sel != 0) { + result = "FAIL"; +@@ -782,7 +788,7 @@ static void test_gdt_invalidation(void) + "+a" (eax) + : "m" (low_user_desc_clear), + [arg1] "r" ((unsigned int)(unsigned long)low_user_desc_clear) +- : "flags"); ++ : INT80_CLOBBERS); + + #ifdef __x86_64__ + syscall(SYS_arch_prctl, ARCH_GET_FS, &new_base); +@@ -835,7 +841,7 @@ static void test_gdt_invalidation(void) + "+a" (eax) + : "m" (low_user_desc_clear), + [arg1] "r" ((unsigned int)(unsigned long)low_user_desc_clear) +- : "flags"); ++ : INT80_CLOBBERS); + + #ifdef __x86_64__ + syscall(SYS_arch_prctl, ARCH_GET_GS, &new_base); +diff --git a/tools/testing/selftests/x86/mpx-hw.h b/tools/testing/selftests/x86/mpx-hw.h +index 093c190178a9..28b3c7c553a4 100644 +--- a/tools/testing/selftests/x86/mpx-hw.h ++++ b/tools/testing/selftests/x86/mpx-hw.h +@@ -51,14 +51,14 @@ + struct mpx_bd_entry { + union { + char x[MPX_BOUNDS_DIR_ENTRY_SIZE_BYTES]; +- void *contents[1]; ++ void *contents[0]; + }; + } __attribute__((packed)); + + struct mpx_bt_entry { + union { + char x[MPX_BOUNDS_TABLE_ENTRY_SIZE_BYTES]; +- unsigned long contents[1]; ++ unsigned long contents[0]; + }; + } __attribute__((packed)); + +diff --git a/tools/testing/selftests/x86/ptrace_syscall.c b/tools/testing/selftests/x86/ptrace_syscall.c +index b037ce9cf116..eaea92439708 100644 +--- a/tools/testing/selftests/x86/ptrace_syscall.c ++++ b/tools/testing/selftests/x86/ptrace_syscall.c +@@ -58,7 +58,8 @@ static void do_full_int80(struct syscall_args32 *args) + asm volatile ("int $0x80" + : "+a" (args->nr), + "+b" (args->arg0), "+c" (args->arg1), "+d" (args->arg2), +- "+S" (args->arg3), "+D" (args->arg4), "+r" (bp)); ++ "+S" (args->arg3), "+D" (args->arg4), "+r" (bp) ++ : : "r8", "r9", "r10", "r11"); + args->arg5 = bp; + #else + sys32_helper(args, int80_and_ret); +diff --git a/tools/testing/selftests/x86/single_step_syscall.c b/tools/testing/selftests/x86/single_step_syscall.c +index 50c26358e8b7..a48da95c18fd 100644 +--- a/tools/testing/selftests/x86/single_step_syscall.c ++++ b/tools/testing/selftests/x86/single_step_syscall.c +@@ -56,9 +56,11 @@ static volatile sig_atomic_t sig_traps; + #ifdef __x86_64__ + # define REG_IP REG_RIP + # define WIDTH "q" ++# define INT80_CLOBBERS "r8", "r9", "r10", "r11" + #else + # define REG_IP REG_EIP + # define WIDTH "l" ++# define INT80_CLOBBERS + #endif + + static unsigned long get_eflags(void) +@@ -140,7 +142,8 @@ int main() + + printf("[RUN]\tSet TF and check int80\n"); + set_eflags(get_eflags() | X86_EFLAGS_TF); +- asm volatile ("int $0x80" : "=a" (tmp) : "a" (SYS_getpid)); ++ asm volatile ("int $0x80" : "=a" (tmp) : "a" (SYS_getpid) ++ : INT80_CLOBBERS); + check_result(); + + /* +diff --git a/virt/kvm/arm/hyp/vgic-v2-sr.c b/virt/kvm/arm/hyp/vgic-v2-sr.c +index c8aeb7b91ec8..95021246ee26 100644 +--- a/virt/kvm/arm/hyp/vgic-v2-sr.c ++++ b/virt/kvm/arm/hyp/vgic-v2-sr.c +@@ -77,11 +77,7 @@ static void __hyp_text save_elrsr(struct kvm_vcpu *vcpu, void __iomem *base) + else + elrsr1 = 0; + +-#ifdef CONFIG_CPU_BIG_ENDIAN +- cpu_if->vgic_elrsr = ((u64)elrsr0 << 32) | elrsr1; +-#else + cpu_if->vgic_elrsr = ((u64)elrsr1 << 32) | elrsr0; +-#endif + } + + static void __hyp_text save_lrs(struct kvm_vcpu *vcpu, void __iomem *base) +diff --git a/virt/kvm/arm/vgic/vgic-irqfd.c b/virt/kvm/arm/vgic/vgic-irqfd.c +index f138ed2e9c63..a26c6773d6df 100644 +--- a/virt/kvm/arm/vgic/vgic-irqfd.c ++++ b/virt/kvm/arm/vgic/vgic-irqfd.c +@@ -112,8 +112,7 @@ int kvm_vgic_setup_default_irq_routing(struct kvm *kvm) + u32 nr = dist->nr_spis; + int i, ret; + +- entries = kcalloc(nr, sizeof(struct kvm_kernel_irq_routing_entry), +- GFP_KERNEL); ++ entries = kcalloc(nr, sizeof(*entries), GFP_KERNEL); + if (!entries) + return -ENOMEM; + +diff --git a/virt/kvm/arm/vgic/vgic-its.c b/virt/kvm/arm/vgic/vgic-its.c +index 4660a7d04eea..ebcaf4641d2b 100644 +--- a/virt/kvm/arm/vgic/vgic-its.c ++++ b/virt/kvm/arm/vgic/vgic-its.c +@@ -360,29 +360,6 @@ static int its_sync_lpi_pending_table(struct kvm_vcpu *vcpu) + return ret; + } + +-static unsigned long vgic_mmio_read_its_ctlr(struct kvm *vcpu, +- struct vgic_its *its, +- gpa_t addr, unsigned int len) +-{ +- u32 reg = 0; +- +- mutex_lock(&its->cmd_lock); +- if (its->creadr == its->cwriter) +- reg |= GITS_CTLR_QUIESCENT; +- if (its->enabled) +- reg |= GITS_CTLR_ENABLE; +- mutex_unlock(&its->cmd_lock); +- +- return reg; +-} +- +-static void vgic_mmio_write_its_ctlr(struct kvm *kvm, struct vgic_its *its, +- gpa_t addr, unsigned int len, +- unsigned long val) +-{ +- its->enabled = !!(val & GITS_CTLR_ENABLE); +-} +- + static unsigned long vgic_mmio_read_its_typer(struct kvm *kvm, + struct vgic_its *its, + gpa_t addr, unsigned int len) +@@ -687,6 +664,8 @@ static int vgic_its_alloc_collection(struct vgic_its *its, + return E_ITS_MAPC_COLLECTION_OOR; + + collection = kzalloc(sizeof(*collection), GFP_KERNEL); ++ if (!collection) ++ return -ENOMEM; + + collection->collection_id = coll_id; + collection->target_addr = COLLECTION_NOT_MAPPED; +@@ -1160,33 +1139,16 @@ static void vgic_mmio_write_its_cbaser(struct kvm *kvm, struct vgic_its *its, + #define ITS_CMD_SIZE 32 + #define ITS_CMD_OFFSET(reg) ((reg) & GENMASK(19, 5)) + +-/* +- * By writing to CWRITER the guest announces new commands to be processed. +- * To avoid any races in the first place, we take the its_cmd lock, which +- * protects our ring buffer variables, so that there is only one user +- * per ITS handling commands at a given time. +- */ +-static void vgic_mmio_write_its_cwriter(struct kvm *kvm, struct vgic_its *its, +- gpa_t addr, unsigned int len, +- unsigned long val) ++/* Must be called with the cmd_lock held. */ ++static void vgic_its_process_commands(struct kvm *kvm, struct vgic_its *its) + { + gpa_t cbaser; + u64 cmd_buf[4]; +- u32 reg; +- +- if (!its) +- return; +- +- mutex_lock(&its->cmd_lock); + +- reg = update_64bit_reg(its->cwriter, addr & 7, len, val); +- reg = ITS_CMD_OFFSET(reg); +- if (reg >= ITS_CMD_BUFFER_SIZE(its->cbaser)) { +- mutex_unlock(&its->cmd_lock); ++ /* Commands are only processed when the ITS is enabled. */ ++ if (!its->enabled) + return; +- } + +- its->cwriter = reg; + cbaser = CBASER_ADDRESS(its->cbaser); + + while (its->cwriter != its->creadr) { +@@ -1206,6 +1168,34 @@ static void vgic_mmio_write_its_cwriter(struct kvm *kvm, struct vgic_its *its, + if (its->creadr == ITS_CMD_BUFFER_SIZE(its->cbaser)) + its->creadr = 0; + } ++} ++ ++/* ++ * By writing to CWRITER the guest announces new commands to be processed. ++ * To avoid any races in the first place, we take the its_cmd lock, which ++ * protects our ring buffer variables, so that there is only one user ++ * per ITS handling commands at a given time. ++ */ ++static void vgic_mmio_write_its_cwriter(struct kvm *kvm, struct vgic_its *its, ++ gpa_t addr, unsigned int len, ++ unsigned long val) ++{ ++ u64 reg; ++ ++ if (!its) ++ return; ++ ++ mutex_lock(&its->cmd_lock); ++ ++ reg = update_64bit_reg(its->cwriter, addr & 7, len, val); ++ reg = ITS_CMD_OFFSET(reg); ++ if (reg >= ITS_CMD_BUFFER_SIZE(its->cbaser)) { ++ mutex_unlock(&its->cmd_lock); ++ return; ++ } ++ its->cwriter = reg; ++ ++ vgic_its_process_commands(kvm, its); + + mutex_unlock(&its->cmd_lock); + } +@@ -1286,6 +1276,39 @@ static void vgic_mmio_write_its_baser(struct kvm *kvm, + *regptr = reg; + } + ++static unsigned long vgic_mmio_read_its_ctlr(struct kvm *vcpu, ++ struct vgic_its *its, ++ gpa_t addr, unsigned int len) ++{ ++ u32 reg = 0; ++ ++ mutex_lock(&its->cmd_lock); ++ if (its->creadr == its->cwriter) ++ reg |= GITS_CTLR_QUIESCENT; ++ if (its->enabled) ++ reg |= GITS_CTLR_ENABLE; ++ mutex_unlock(&its->cmd_lock); ++ ++ return reg; ++} ++ ++static void vgic_mmio_write_its_ctlr(struct kvm *kvm, struct vgic_its *its, ++ gpa_t addr, unsigned int len, ++ unsigned long val) ++{ ++ mutex_lock(&its->cmd_lock); ++ ++ its->enabled = !!(val & GITS_CTLR_ENABLE); ++ ++ /* ++ * Try to process any pending commands. This function bails out early ++ * if the ITS is disabled or no commands have been queued. ++ */ ++ vgic_its_process_commands(kvm, its); ++ ++ mutex_unlock(&its->cmd_lock); ++} ++ + #define REGISTER_ITS_DESC(off, rd, wr, length, acc) \ + { \ + .reg_offset = off, \ +diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c +index f4c6d4f6d2e8..4569fdcab701 100644 +--- a/virt/kvm/kvm_main.c ++++ b/virt/kvm/kvm_main.c +@@ -125,6 +125,11 @@ EXPORT_SYMBOL_GPL(kvm_rebooting); + + static bool largepages_enabled = true; + ++__weak void kvm_arch_mmu_notifier_invalidate_range(struct kvm *kvm, ++ unsigned long start, unsigned long end) ++{ ++} ++ + bool kvm_is_reserved_pfn(kvm_pfn_t pfn) + { + if (pfn_valid(pfn)) +@@ -361,6 +366,9 @@ static void kvm_mmu_notifier_invalidate_range_start(struct mmu_notifier *mn, + kvm_flush_remote_tlbs(kvm); + + spin_unlock(&kvm->mmu_lock); ++ ++ kvm_arch_mmu_notifier_invalidate_range(kvm, start, end); ++ + srcu_read_unlock(&kvm->srcu, idx); + } +
