commit: bb672c80be123345ed76ec976ad159b5cb0c6ab5 Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> AuthorDate: Fri Aug 24 11:42:53 2018 +0000 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> CommitDate: Fri Aug 24 11:42:53 2018 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=bb672c80
Linux patch 4.9.124 0000_README | 4 + 1123_linux-4.9.124.patch | 4071 ++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 4075 insertions(+) diff --git a/0000_README b/0000_README index 41e0394..a65a30e 100644 --- a/0000_README +++ b/0000_README @@ -535,6 +535,10 @@ Patch: 1122_linux-4.9.123.patch From: http://www.kernel.org Desc: Linux 4.9.123 +Patch: 1123_linux-4.9.124.patch +From: http://www.kernel.org +Desc: Linux 4.9.124 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1123_linux-4.9.124.patch b/1123_linux-4.9.124.patch new file mode 100644 index 0000000..212c43c --- /dev/null +++ b/1123_linux-4.9.124.patch @@ -0,0 +1,4071 @@ +diff --git a/Makefile b/Makefile +index b11e375bb18e..53d57acfc17e 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 9 +-SUBLEVEL = 123 ++SUBLEVEL = 124 + EXTRAVERSION = + NAME = Roaring Lionus + +diff --git a/arch/arc/Makefile b/arch/arc/Makefile +index 19cce226d1a8..8447eed836ef 100644 +--- a/arch/arc/Makefile ++++ b/arch/arc/Makefile +@@ -18,7 +18,7 @@ endif + + KBUILD_DEFCONFIG := nsim_700_defconfig + +-cflags-y += -fno-common -pipe -fno-builtin -D__linux__ ++cflags-y += -fno-common -pipe -fno-builtin -mmedium-calls -D__linux__ + cflags-$(CONFIG_ISA_ARCOMPACT) += -mA7 + cflags-$(CONFIG_ISA_ARCV2) += -mcpu=archs + +@@ -141,16 +141,3 @@ dtbs: scripts + + archclean: + $(Q)$(MAKE) $(clean)=$(boot) +- +-# Hacks to enable final link due to absence of link-time branch relexation +-# and gcc choosing optimal(shorter) branches at -O3 +-# +-# vineetg Feb 2010: -mlong-calls switched off for overall kernel build +-# However lib/decompress_inflate.o (.init.text) calls +-# zlib_inflate_workspacesize (.text) causing relocation errors. +-# Thus forcing all exten calls in this file to be long calls +-export CFLAGS_decompress_inflate.o = -mmedium-calls +-export CFLAGS_initramfs.o = -mmedium-calls +-ifdef CONFIG_SMP +-export CFLAGS_core.o = -mmedium-calls +-endif +diff --git a/arch/arc/include/asm/mach_desc.h b/arch/arc/include/asm/mach_desc.h +index c28e6c347b49..871f3cb16af9 100644 +--- a/arch/arc/include/asm/mach_desc.h ++++ b/arch/arc/include/asm/mach_desc.h +@@ -34,9 +34,7 @@ struct machine_desc { + const char *name; + const char **dt_compat; + void (*init_early)(void); +-#ifdef CONFIG_SMP + void (*init_per_cpu)(unsigned int); +-#endif + void (*init_machine)(void); + void (*init_late)(void); + +diff --git a/arch/arc/kernel/irq.c b/arch/arc/kernel/irq.c +index 538b36afe89e..62b185057c04 100644 +--- a/arch/arc/kernel/irq.c ++++ b/arch/arc/kernel/irq.c +@@ -31,10 +31,10 @@ void __init init_IRQ(void) + /* a SMP H/w block could do IPI IRQ request here */ + if (plat_smp_ops.init_per_cpu) + plat_smp_ops.init_per_cpu(smp_processor_id()); ++#endif + + if (machine_desc->init_per_cpu) + machine_desc->init_per_cpu(smp_processor_id()); +-#endif + } + + /* +diff --git a/arch/arc/kernel/process.c b/arch/arc/kernel/process.c +index a41a79a4f4fe..0e8c0151a390 100644 +--- a/arch/arc/kernel/process.c ++++ b/arch/arc/kernel/process.c +@@ -44,7 +44,8 @@ SYSCALL_DEFINE0(arc_gettls) + SYSCALL_DEFINE3(arc_usr_cmpxchg, int *, uaddr, int, expected, int, new) + { + struct pt_regs *regs = current_pt_regs(); +- int uval = -EFAULT; ++ u32 uval; ++ int ret; + + /* + * This is only for old cores lacking LLOCK/SCOND, which by defintion +@@ -57,23 +58,47 @@ SYSCALL_DEFINE3(arc_usr_cmpxchg, int *, uaddr, int, expected, int, new) + /* Z indicates to userspace if operation succeded */ + regs->status32 &= ~STATUS_Z_MASK; + +- if (!access_ok(VERIFY_WRITE, uaddr, sizeof(int))) +- return -EFAULT; ++ ret = access_ok(VERIFY_WRITE, uaddr, sizeof(*uaddr)); ++ if (!ret) ++ goto fail; + ++again: + preempt_disable(); + +- if (__get_user(uval, uaddr)) +- goto done; ++ ret = __get_user(uval, uaddr); ++ if (ret) ++ goto fault; + +- if (uval == expected) { +- if (!__put_user(new, uaddr)) +- regs->status32 |= STATUS_Z_MASK; +- } ++ if (uval != expected) ++ goto out; + +-done: +- preempt_enable(); ++ ret = __put_user(new, uaddr); ++ if (ret) ++ goto fault; ++ ++ regs->status32 |= STATUS_Z_MASK; + ++out: ++ preempt_enable(); + return uval; ++ ++fault: ++ preempt_enable(); ++ ++ if (unlikely(ret != -EFAULT)) ++ goto fail; ++ ++ down_read(¤t->mm->mmap_sem); ++ ret = fixup_user_fault(current, current->mm, (unsigned long) uaddr, ++ FAULT_FLAG_WRITE, NULL); ++ up_read(¤t->mm->mmap_sem); ++ ++ if (likely(!ret)) ++ goto again; ++ ++fail: ++ force_sig(SIGSEGV, current); ++ return ret; + } + + void arch_cpu_idle(void) +diff --git a/arch/arm/boot/dts/am3517.dtsi b/arch/arm/boot/dts/am3517.dtsi +index 0db19d39d24c..d022b6b03273 100644 +--- a/arch/arm/boot/dts/am3517.dtsi ++++ b/arch/arm/boot/dts/am3517.dtsi +@@ -74,6 +74,11 @@ + }; + }; + ++/* Table Table 5-79 of the TRM shows 480ab000 is reserved */ ++&usb_otg_hs { ++ status = "disabled"; ++}; ++ + &iva { + status = "disabled"; + }; +diff --git a/arch/arm/boot/dts/am437x-sk-evm.dts b/arch/arm/boot/dts/am437x-sk-evm.dts +index 319d94205350..6482ada22015 100644 +--- a/arch/arm/boot/dts/am437x-sk-evm.dts ++++ b/arch/arm/boot/dts/am437x-sk-evm.dts +@@ -533,6 +533,8 @@ + + touchscreen-size-x = <480>; + touchscreen-size-y = <272>; ++ ++ wakeup-source; + }; + + tlv320aic3106: tlv320aic3106@1b { +diff --git a/arch/arm/boot/dts/bcm-cygnus.dtsi b/arch/arm/boot/dts/bcm-cygnus.dtsi +index fabc9f36c408..5ad61537990e 100644 +--- a/arch/arm/boot/dts/bcm-cygnus.dtsi ++++ b/arch/arm/boot/dts/bcm-cygnus.dtsi +@@ -128,7 +128,7 @@ + reg = <0x18008000 0x100>; + #address-cells = <1>; + #size-cells = <0>; +- interrupts = <GIC_SPI 85 IRQ_TYPE_NONE>; ++ interrupts = <GIC_SPI 85 IRQ_TYPE_LEVEL_HIGH>; + clock-frequency = <100000>; + status = "disabled"; + }; +@@ -157,7 +157,7 @@ + reg = <0x1800b000 0x100>; + #address-cells = <1>; + #size-cells = <0>; +- interrupts = <GIC_SPI 86 IRQ_TYPE_NONE>; ++ interrupts = <GIC_SPI 86 IRQ_TYPE_LEVEL_HIGH>; + clock-frequency = <100000>; + status = "disabled"; + }; +@@ -168,7 +168,7 @@ + + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 0>; +- interrupt-map = <0 0 0 0 &gic GIC_SPI 100 IRQ_TYPE_NONE>; ++ interrupt-map = <0 0 0 0 &gic GIC_SPI 100 IRQ_TYPE_LEVEL_HIGH>; + + linux,pci-domain = <0>; + +@@ -190,10 +190,10 @@ + compatible = "brcm,iproc-msi"; + msi-controller; + interrupt-parent = <&gic>; +- interrupts = <GIC_SPI 96 IRQ_TYPE_NONE>, +- <GIC_SPI 97 IRQ_TYPE_NONE>, +- <GIC_SPI 98 IRQ_TYPE_NONE>, +- <GIC_SPI 99 IRQ_TYPE_NONE>; ++ interrupts = <GIC_SPI 96 IRQ_TYPE_LEVEL_HIGH>, ++ <GIC_SPI 97 IRQ_TYPE_LEVEL_HIGH>, ++ <GIC_SPI 98 IRQ_TYPE_LEVEL_HIGH>, ++ <GIC_SPI 99 IRQ_TYPE_LEVEL_HIGH>; + }; + }; + +@@ -203,7 +203,7 @@ + + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 0>; +- interrupt-map = <0 0 0 0 &gic GIC_SPI 106 IRQ_TYPE_NONE>; ++ interrupt-map = <0 0 0 0 &gic GIC_SPI 106 IRQ_TYPE_LEVEL_HIGH>; + + linux,pci-domain = <1>; + +@@ -225,10 +225,10 @@ + compatible = "brcm,iproc-msi"; + msi-controller; + interrupt-parent = <&gic>; +- interrupts = <GIC_SPI 102 IRQ_TYPE_NONE>, +- <GIC_SPI 103 IRQ_TYPE_NONE>, +- <GIC_SPI 104 IRQ_TYPE_NONE>, +- <GIC_SPI 105 IRQ_TYPE_NONE>; ++ interrupts = <GIC_SPI 102 IRQ_TYPE_LEVEL_HIGH>, ++ <GIC_SPI 103 IRQ_TYPE_LEVEL_HIGH>, ++ <GIC_SPI 104 IRQ_TYPE_LEVEL_HIGH>, ++ <GIC_SPI 105 IRQ_TYPE_LEVEL_HIGH>; + }; + }; + +diff --git a/arch/arm/boot/dts/bcm-nsp.dtsi b/arch/arm/boot/dts/bcm-nsp.dtsi +index 65e0db1d3bd7..6e3d3b50824e 100644 +--- a/arch/arm/boot/dts/bcm-nsp.dtsi ++++ b/arch/arm/boot/dts/bcm-nsp.dtsi +@@ -288,7 +288,7 @@ + reg = <0x38000 0x50>; + #address-cells = <1>; + #size-cells = <0>; +- interrupts = <GIC_SPI 89 IRQ_TYPE_NONE>; ++ interrupts = <GIC_SPI 89 IRQ_TYPE_LEVEL_HIGH>; + clock-frequency = <100000>; + }; + +@@ -375,7 +375,7 @@ + + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 0>; +- interrupt-map = <0 0 0 0 &gic GIC_SPI 131 IRQ_TYPE_NONE>; ++ interrupt-map = <0 0 0 0 &gic GIC_SPI 131 IRQ_TYPE_LEVEL_HIGH>; + + linux,pci-domain = <0>; + +@@ -397,10 +397,10 @@ + compatible = "brcm,iproc-msi"; + msi-controller; + interrupt-parent = <&gic>; +- interrupts = <GIC_SPI 127 IRQ_TYPE_NONE>, +- <GIC_SPI 128 IRQ_TYPE_NONE>, +- <GIC_SPI 129 IRQ_TYPE_NONE>, +- <GIC_SPI 130 IRQ_TYPE_NONE>; ++ interrupts = <GIC_SPI 127 IRQ_TYPE_LEVEL_HIGH>, ++ <GIC_SPI 128 IRQ_TYPE_LEVEL_HIGH>, ++ <GIC_SPI 129 IRQ_TYPE_LEVEL_HIGH>, ++ <GIC_SPI 130 IRQ_TYPE_LEVEL_HIGH>; + brcm,pcie-msi-inten; + }; + }; +@@ -411,7 +411,7 @@ + + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 0>; +- interrupt-map = <0 0 0 0 &gic GIC_SPI 137 IRQ_TYPE_NONE>; ++ interrupt-map = <0 0 0 0 &gic GIC_SPI 137 IRQ_TYPE_LEVEL_HIGH>; + + linux,pci-domain = <1>; + +@@ -433,10 +433,10 @@ + compatible = "brcm,iproc-msi"; + msi-controller; + interrupt-parent = <&gic>; +- interrupts = <GIC_SPI 133 IRQ_TYPE_NONE>, +- <GIC_SPI 134 IRQ_TYPE_NONE>, +- <GIC_SPI 135 IRQ_TYPE_NONE>, +- <GIC_SPI 136 IRQ_TYPE_NONE>; ++ interrupts = <GIC_SPI 133 IRQ_TYPE_LEVEL_HIGH>, ++ <GIC_SPI 134 IRQ_TYPE_LEVEL_HIGH>, ++ <GIC_SPI 135 IRQ_TYPE_LEVEL_HIGH>, ++ <GIC_SPI 136 IRQ_TYPE_LEVEL_HIGH>; + brcm,pcie-msi-inten; + }; + }; +@@ -447,7 +447,7 @@ + + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 0>; +- interrupt-map = <0 0 0 0 &gic GIC_SPI 143 IRQ_TYPE_NONE>; ++ interrupt-map = <0 0 0 0 &gic GIC_SPI 143 IRQ_TYPE_LEVEL_HIGH>; + + linux,pci-domain = <2>; + +@@ -469,10 +469,10 @@ + compatible = "brcm,iproc-msi"; + msi-controller; + interrupt-parent = <&gic>; +- interrupts = <GIC_SPI 139 IRQ_TYPE_NONE>, +- <GIC_SPI 140 IRQ_TYPE_NONE>, +- <GIC_SPI 141 IRQ_TYPE_NONE>, +- <GIC_SPI 142 IRQ_TYPE_NONE>; ++ interrupts = <GIC_SPI 139 IRQ_TYPE_LEVEL_HIGH>, ++ <GIC_SPI 140 IRQ_TYPE_LEVEL_HIGH>, ++ <GIC_SPI 141 IRQ_TYPE_LEVEL_HIGH>, ++ <GIC_SPI 142 IRQ_TYPE_LEVEL_HIGH>; + brcm,pcie-msi-inten; + }; + }; +diff --git a/arch/arm/boot/dts/da850.dtsi b/arch/arm/boot/dts/da850.dtsi +index f79e1b91c680..51ab92fa7a6a 100644 +--- a/arch/arm/boot/dts/da850.dtsi ++++ b/arch/arm/boot/dts/da850.dtsi +@@ -377,11 +377,7 @@ + gpio-controller; + #gpio-cells = <2>; + reg = <0x226000 0x1000>; +- interrupts = <42 IRQ_TYPE_EDGE_BOTH +- 43 IRQ_TYPE_EDGE_BOTH 44 IRQ_TYPE_EDGE_BOTH +- 45 IRQ_TYPE_EDGE_BOTH 46 IRQ_TYPE_EDGE_BOTH +- 47 IRQ_TYPE_EDGE_BOTH 48 IRQ_TYPE_EDGE_BOTH +- 49 IRQ_TYPE_EDGE_BOTH 50 IRQ_TYPE_EDGE_BOTH>; ++ interrupts = <42 43 44 45 46 47 48 49 50>; + ti,ngpio = <144>; + ti,davinci-gpio-unbanked = <0>; + status = "disabled"; +diff --git a/arch/arm/configs/imx_v4_v5_defconfig b/arch/arm/configs/imx_v4_v5_defconfig +index 5f013c9fc1ed..8290c9ace6e9 100644 +--- a/arch/arm/configs/imx_v4_v5_defconfig ++++ b/arch/arm/configs/imx_v4_v5_defconfig +@@ -145,9 +145,11 @@ CONFIG_USB_STORAGE=y + CONFIG_USB_CHIPIDEA=y + CONFIG_USB_CHIPIDEA_UDC=y + CONFIG_USB_CHIPIDEA_HOST=y ++CONFIG_USB_CHIPIDEA_ULPI=y + CONFIG_NOP_USB_XCEIV=y + CONFIG_USB_GADGET=y + CONFIG_USB_ETH=m ++CONFIG_USB_ULPI_BUS=y + CONFIG_MMC=y + CONFIG_MMC_SDHCI=y + CONFIG_MMC_SDHCI_PLTFM=y +diff --git a/arch/arm/configs/imx_v6_v7_defconfig b/arch/arm/configs/imx_v6_v7_defconfig +index 8ec4dbbb50b0..6b7d4f535984 100644 +--- a/arch/arm/configs/imx_v6_v7_defconfig ++++ b/arch/arm/configs/imx_v6_v7_defconfig +@@ -271,6 +271,7 @@ CONFIG_USB_STORAGE=y + CONFIG_USB_CHIPIDEA=y + CONFIG_USB_CHIPIDEA_UDC=y + CONFIG_USB_CHIPIDEA_HOST=y ++CONFIG_USB_CHIPIDEA_ULPI=y + CONFIG_USB_SERIAL=m + CONFIG_USB_SERIAL_GENERIC=y + CONFIG_USB_SERIAL_FTDI_SIO=m +@@ -307,6 +308,7 @@ CONFIG_USB_GADGETFS=m + CONFIG_USB_FUNCTIONFS=m + CONFIG_USB_MASS_STORAGE=m + CONFIG_USB_G_SERIAL=m ++CONFIG_USB_ULPI_BUS=y + CONFIG_MMC=y + CONFIG_MMC_SDHCI=y + CONFIG_MMC_SDHCI_PLTFM=y +diff --git a/arch/arm/mach-omap2/omap-smp.c b/arch/arm/mach-omap2/omap-smp.c +index b4de3da6dffa..f7f36da80f40 100644 +--- a/arch/arm/mach-omap2/omap-smp.c ++++ b/arch/arm/mach-omap2/omap-smp.c +@@ -104,6 +104,45 @@ void omap5_erratum_workaround_801819(void) + static inline void omap5_erratum_workaround_801819(void) { } + #endif + ++#ifdef CONFIG_HARDEN_BRANCH_PREDICTOR ++/* ++ * Configure ACR and enable ACTLR[0] (Enable invalidates of BTB with ++ * ICIALLU) to activate the workaround for secondary Core. ++ * NOTE: it is assumed that the primary core's configuration is done ++ * by the boot loader (kernel will detect a misconfiguration and complain ++ * if this is not done). ++ * ++ * In General Purpose(GP) devices, ACR bit settings can only be done ++ * by ROM code in "secure world" using the smc call and there is no ++ * option to update the "firmware" on such devices. This also works for ++ * High security(HS) devices, as a backup option in case the ++ * "update" is not done in the "security firmware". ++ */ ++static void omap5_secondary_harden_predictor(void) ++{ ++ u32 acr, acr_mask; ++ ++ asm volatile ("mrc p15, 0, %0, c1, c0, 1" : "=r" (acr)); ++ ++ /* ++ * ACTLR[0] (Enable invalidates of BTB with ICIALLU) ++ */ ++ acr_mask = BIT(0); ++ ++ /* Do we already have it done.. if yes, skip expensive smc */ ++ if ((acr & acr_mask) == acr_mask) ++ return; ++ ++ acr |= acr_mask; ++ omap_smc1(OMAP5_DRA7_MON_SET_ACR_INDEX, acr); ++ ++ pr_debug("%s: ARM ACR setup for CVE_2017_5715 applied on CPU%d\n", ++ __func__, smp_processor_id()); ++} ++#else ++static inline void omap5_secondary_harden_predictor(void) { } ++#endif ++ + static void omap4_secondary_init(unsigned int cpu) + { + /* +@@ -126,6 +165,8 @@ static void omap4_secondary_init(unsigned int cpu) + set_cntfreq(); + /* Configure ACR to disable streaming WA for 801819 */ + omap5_erratum_workaround_801819(); ++ /* Enable ACR to allow for ICUALLU workaround */ ++ omap5_secondary_harden_predictor(); + } + + /* +diff --git a/arch/arm/mach-pxa/irq.c b/arch/arm/mach-pxa/irq.c +index 9c10248fadcc..4e8c2116808e 100644 +--- a/arch/arm/mach-pxa/irq.c ++++ b/arch/arm/mach-pxa/irq.c +@@ -185,7 +185,7 @@ static int pxa_irq_suspend(void) + { + int i; + +- for (i = 0; i < pxa_internal_irq_nr / 32; i++) { ++ for (i = 0; i < DIV_ROUND_UP(pxa_internal_irq_nr, 32); i++) { + void __iomem *base = irq_base(i); + + saved_icmr[i] = __raw_readl(base + ICMR); +@@ -204,7 +204,7 @@ static void pxa_irq_resume(void) + { + int i; + +- for (i = 0; i < pxa_internal_irq_nr / 32; i++) { ++ for (i = 0; i < DIV_ROUND_UP(pxa_internal_irq_nr, 32); i++) { + void __iomem *base = irq_base(i); + + __raw_writel(saved_icmr[i], base + ICMR); +diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c +index 4c587ad8bfe3..1565d6b67163 100644 +--- a/arch/arm/mm/init.c ++++ b/arch/arm/mm/init.c +@@ -722,19 +722,28 @@ int __mark_rodata_ro(void *unused) + return 0; + } + ++static int kernel_set_to_readonly __read_mostly; ++ + void mark_rodata_ro(void) + { ++ kernel_set_to_readonly = 1; + stop_machine(__mark_rodata_ro, NULL, NULL); + } + + void set_kernel_text_rw(void) + { ++ if (!kernel_set_to_readonly) ++ return; ++ + set_section_perms(ro_perms, ARRAY_SIZE(ro_perms), false, + current->active_mm); + } + + void set_kernel_text_ro(void) + { ++ if (!kernel_set_to_readonly) ++ return; ++ + set_section_perms(ro_perms, ARRAY_SIZE(ro_perms), true, + current->active_mm); + } +diff --git a/arch/arm64/boot/dts/broadcom/ns2.dtsi b/arch/arm64/boot/dts/broadcom/ns2.dtsi +index a16b1b3f9fc6..8a94ec8035d3 100644 +--- a/arch/arm64/boot/dts/broadcom/ns2.dtsi ++++ b/arch/arm64/boot/dts/broadcom/ns2.dtsi +@@ -393,7 +393,7 @@ + reg = <0x66080000 0x100>; + #address-cells = <1>; + #size-cells = <0>; +- interrupts = <GIC_SPI 394 IRQ_TYPE_NONE>; ++ interrupts = <GIC_SPI 394 IRQ_TYPE_LEVEL_HIGH>; + clock-frequency = <100000>; + status = "disabled"; + }; +@@ -421,7 +421,7 @@ + reg = <0x660b0000 0x100>; + #address-cells = <1>; + #size-cells = <0>; +- interrupts = <GIC_SPI 395 IRQ_TYPE_NONE>; ++ interrupts = <GIC_SPI 395 IRQ_TYPE_LEVEL_HIGH>; + clock-frequency = <100000>; + status = "disabled"; + }; +diff --git a/arch/arm64/kernel/smp.c b/arch/arm64/kernel/smp.c +index a70f7d3361c4..cfd33f18f437 100644 +--- a/arch/arm64/kernel/smp.c ++++ b/arch/arm64/kernel/smp.c +@@ -205,7 +205,7 @@ int __cpu_up(unsigned int cpu, struct task_struct *idle) + * This is the secondary CPU boot entry. We're using this CPUs + * idle thread stack, but a set of temporary page tables. + */ +-asmlinkage void secondary_start_kernel(void) ++asmlinkage notrace void secondary_start_kernel(void) + { + struct mm_struct *mm = &init_mm; + unsigned int cpu = smp_processor_id(); +diff --git a/arch/m68k/include/asm/mcf_pgalloc.h b/arch/m68k/include/asm/mcf_pgalloc.h +index fb95aed5f428..dac7564a48da 100644 +--- a/arch/m68k/include/asm/mcf_pgalloc.h ++++ b/arch/m68k/include/asm/mcf_pgalloc.h +@@ -43,6 +43,7 @@ extern inline pmd_t *pmd_alloc_kernel(pgd_t *pgd, unsigned long address) + static inline void __pte_free_tlb(struct mmu_gather *tlb, pgtable_t page, + unsigned long address) + { ++ pgtable_page_dtor(page); + __free_page(page); + } + +@@ -73,8 +74,9 @@ static inline struct page *pte_alloc_one(struct mm_struct *mm, + return page; + } + +-extern inline void pte_free(struct mm_struct *mm, struct page *page) ++static inline void pte_free(struct mm_struct *mm, struct page *page) + { ++ pgtable_page_dtor(page); + __free_page(page); + } + +diff --git a/arch/parisc/include/asm/spinlock.h b/arch/parisc/include/asm/spinlock.h +index e32936cd7f10..7031483b110c 100644 +--- a/arch/parisc/include/asm/spinlock.h ++++ b/arch/parisc/include/asm/spinlock.h +@@ -26,7 +26,6 @@ static inline void arch_spin_lock_flags(arch_spinlock_t *x, + { + volatile unsigned int *a; + +- mb(); + a = __ldcw_align(x); + while (__ldcw(a) == 0) + while (*a == 0) +@@ -36,16 +35,15 @@ static inline void arch_spin_lock_flags(arch_spinlock_t *x, + local_irq_disable(); + } else + cpu_relax(); +- mb(); + } + + static inline void arch_spin_unlock(arch_spinlock_t *x) + { + volatile unsigned int *a; +- mb(); ++ + a = __ldcw_align(x); +- *a = 1; + mb(); ++ *a = 1; + } + + static inline int arch_spin_trylock(arch_spinlock_t *x) +@@ -53,10 +51,8 @@ static inline int arch_spin_trylock(arch_spinlock_t *x) + volatile unsigned int *a; + int ret; + +- mb(); + a = __ldcw_align(x); + ret = __ldcw(a) != 0; +- mb(); + + return ret; + } +diff --git a/arch/parisc/kernel/syscall.S b/arch/parisc/kernel/syscall.S +index 4886a6db42e9..5f7e57fcaeef 100644 +--- a/arch/parisc/kernel/syscall.S ++++ b/arch/parisc/kernel/syscall.S +@@ -629,12 +629,12 @@ cas_action: + stw %r1, 4(%sr2,%r20) + #endif + /* The load and store could fail */ +-1: ldw,ma 0(%r26), %r28 ++1: ldw 0(%r26), %r28 + sub,<> %r28, %r25, %r0 +-2: stw,ma %r24, 0(%r26) ++2: stw %r24, 0(%r26) + /* Free lock */ + sync +- stw,ma %r20, 0(%sr2,%r20) ++ stw %r20, 0(%sr2,%r20) + #if ENABLE_LWS_DEBUG + /* Clear thread register indicator */ + stw %r0, 4(%sr2,%r20) +@@ -798,30 +798,30 @@ cas2_action: + ldo 1(%r0),%r28 + + /* 8bit CAS */ +-13: ldb,ma 0(%r26), %r29 ++13: ldb 0(%r26), %r29 + sub,= %r29, %r25, %r0 + b,n cas2_end +-14: stb,ma %r24, 0(%r26) ++14: stb %r24, 0(%r26) + b cas2_end + copy %r0, %r28 + nop + nop + + /* 16bit CAS */ +-15: ldh,ma 0(%r26), %r29 ++15: ldh 0(%r26), %r29 + sub,= %r29, %r25, %r0 + b,n cas2_end +-16: sth,ma %r24, 0(%r26) ++16: sth %r24, 0(%r26) + b cas2_end + copy %r0, %r28 + nop + nop + + /* 32bit CAS */ +-17: ldw,ma 0(%r26), %r29 ++17: ldw 0(%r26), %r29 + sub,= %r29, %r25, %r0 + b,n cas2_end +-18: stw,ma %r24, 0(%r26) ++18: stw %r24, 0(%r26) + b cas2_end + copy %r0, %r28 + nop +@@ -829,10 +829,10 @@ cas2_action: + + /* 64bit CAS */ + #ifdef CONFIG_64BIT +-19: ldd,ma 0(%r26), %r29 ++19: ldd 0(%r26), %r29 + sub,*= %r29, %r25, %r0 + b,n cas2_end +-20: std,ma %r24, 0(%r26) ++20: std %r24, 0(%r26) + copy %r0, %r28 + #else + /* Compare first word */ +@@ -851,7 +851,7 @@ cas2_action: + cas2_end: + /* Free lock */ + sync +- stw,ma %r20, 0(%sr2,%r20) ++ stw %r20, 0(%sr2,%r20) + /* Enable interrupts */ + ssm PSW_SM_I, %r0 + /* Return to userspace, set no error */ +diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c +index e7ce2577f0c9..949a871e9506 100644 +--- a/arch/s390/net/bpf_jit_comp.c ++++ b/arch/s390/net/bpf_jit_comp.c +@@ -1386,6 +1386,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *fp) + goto free_addrs; + } + if (bpf_jit_prog(&jit, fp)) { ++ bpf_jit_binary_free(header); + fp = orig_fp; + goto free_addrs; + } +diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S +index d58d8dcb8245..76c1d85e749b 100644 +--- a/arch/x86/entry/entry_64.S ++++ b/arch/x86/entry/entry_64.S +@@ -774,7 +774,7 @@ ENTRY(\sym) + + call \do_sym + +- jmp error_exit /* %ebx: no swapgs flag */ ++ jmp error_exit + .endif + END(\sym) + .endm +@@ -1043,7 +1043,6 @@ END(paranoid_exit) + + /* + * Save all registers in pt_regs, and switch gs if needed. +- * Return: EBX=0: came from user mode; EBX=1: otherwise + */ + ENTRY(error_entry) + cld +@@ -1056,7 +1055,6 @@ ENTRY(error_entry) + * the kernel CR3 here. + */ + SWITCH_KERNEL_CR3 +- xorl %ebx, %ebx + testb $3, CS+8(%rsp) + jz .Lerror_kernelspace + +@@ -1087,7 +1085,6 @@ ENTRY(error_entry) + * for these here too. + */ + .Lerror_kernelspace: +- incl %ebx + leaq native_irq_return_iret(%rip), %rcx + cmpq %rcx, RIP+8(%rsp) + je .Lerror_bad_iret +@@ -1119,28 +1116,19 @@ ENTRY(error_entry) + + /* + * Pretend that the exception came from user mode: set up pt_regs +- * as if we faulted immediately after IRET and clear EBX so that +- * error_exit knows that we will be returning to user mode. ++ * as if we faulted immediately after IRET. + */ + mov %rsp, %rdi + call fixup_bad_iret + mov %rax, %rsp +- decl %ebx + jmp .Lerror_entry_from_usermode_after_swapgs + END(error_entry) + +- +-/* +- * On entry, EBX is a "return to kernel mode" flag: +- * 1: already in kernel mode, don't need SWAPGS +- * 0: user gsbase is loaded, we need SWAPGS and standard preparation for return to usermode +- */ + ENTRY(error_exit) +- movl %ebx, %eax + DISABLE_INTERRUPTS(CLBR_NONE) + TRACE_IRQS_OFF +- testl %eax, %eax +- jnz retint_kernel ++ testb $3, CS(%rsp) ++ jz retint_kernel + jmp retint_user + END(error_exit) + +diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c +index 3874eec972cd..ef32e5766a01 100644 +--- a/drivers/acpi/nfit/core.c ++++ b/drivers/acpi/nfit/core.c +@@ -201,6 +201,8 @@ int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm, + const u8 *uuid; + int rc, i; + ++ if (cmd_rc) ++ *cmd_rc = -EINVAL; + func = cmd; + if (cmd == ND_CMD_CALL) { + call_pkg = buf; +@@ -288,6 +290,8 @@ int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm, + * If we return an error (like elsewhere) then caller wouldn't + * be able to rely upon data returned to make calculation. + */ ++ if (cmd_rc) ++ *cmd_rc = 0; + return 0; + } + +diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c +index 0d028ead99e8..d81b984b72e4 100644 +--- a/drivers/ata/libahci.c ++++ b/drivers/ata/libahci.c +@@ -35,6 +35,7 @@ + #include <linux/kernel.h> + #include <linux/gfp.h> + #include <linux/module.h> ++#include <linux/nospec.h> + #include <linux/blkdev.h> + #include <linux/delay.h> + #include <linux/interrupt.h> +@@ -1124,10 +1125,12 @@ static ssize_t ahci_led_store(struct ata_port *ap, const char *buf, + + /* get the slot number from the message */ + pmp = (state & EM_MSG_LED_PMP_SLOT) >> 8; +- if (pmp < EM_MAX_SLOTS) ++ if (pmp < EM_MAX_SLOTS) { ++ pmp = array_index_nospec(pmp, EM_MAX_SLOTS); + emp = &pp->em_priv[pmp]; +- else ++ } else { + return -EINVAL; ++ } + + /* mask off the activity bits if we are in sw_activity + * mode, user should turn off sw_activity before setting +diff --git a/drivers/dma/k3dma.c b/drivers/dma/k3dma.c +index aabcb7934b05..cd7f67b2545c 100644 +--- a/drivers/dma/k3dma.c ++++ b/drivers/dma/k3dma.c +@@ -792,7 +792,7 @@ static struct dma_chan *k3_of_dma_simple_xlate(struct of_phandle_args *dma_spec, + struct k3_dma_dev *d = ofdma->of_dma_data; + unsigned int request = dma_spec->args[0]; + +- if (request > d->dma_requests) ++ if (request >= d->dma_requests) + return NULL; + + return dma_get_slave_channel(&(d->chans[request].vc.chan)); +diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c +index 2c449bdacb91..b9dad4e40bb8 100644 +--- a/drivers/dma/pl330.c ++++ b/drivers/dma/pl330.c +@@ -2951,7 +2951,7 @@ pl330_probe(struct amba_device *adev, const struct amba_id *id) + pd->src_addr_widths = PL330_DMA_BUSWIDTHS; + pd->dst_addr_widths = PL330_DMA_BUSWIDTHS; + pd->directions = BIT(DMA_DEV_TO_MEM) | BIT(DMA_MEM_TO_DEV); +- pd->residue_granularity = DMA_RESIDUE_GRANULARITY_SEGMENT; ++ pd->residue_granularity = DMA_RESIDUE_GRANULARITY_BURST; + pd->max_burst = ((pl330->quirks & PL330_QUIRK_BROKEN_NO_FLUSHP) ? + 1 : PL330_MAX_BURST); + +diff --git a/drivers/gpu/drm/arm/malidp_hw.c b/drivers/gpu/drm/arm/malidp_hw.c +index a6132f1d58c1..5eee325feb29 100644 +--- a/drivers/gpu/drm/arm/malidp_hw.c ++++ b/drivers/gpu/drm/arm/malidp_hw.c +@@ -432,7 +432,8 @@ const struct malidp_hw_device malidp_device[MALIDP_MAX_DEVICES] = { + .vsync_irq = MALIDP500_DE_IRQ_VSYNC, + }, + .se_irq_map = { +- .irq_mask = MALIDP500_SE_IRQ_CONF_MODE, ++ .irq_mask = MALIDP500_SE_IRQ_CONF_MODE | ++ MALIDP500_SE_IRQ_GLOBAL, + .vsync_irq = 0, + }, + .dc_irq_map = { +diff --git a/drivers/gpu/drm/armada/armada_hw.h b/drivers/gpu/drm/armada/armada_hw.h +index 27319a8335e2..345dc4d0851e 100644 +--- a/drivers/gpu/drm/armada/armada_hw.h ++++ b/drivers/gpu/drm/armada/armada_hw.h +@@ -160,6 +160,7 @@ enum { + CFG_ALPHAM_GRA = 0x1 << 16, + CFG_ALPHAM_CFG = 0x2 << 16, + CFG_ALPHA_MASK = 0xff << 8, ++#define CFG_ALPHA(x) ((x) << 8) + CFG_PIXCMD_MASK = 0xff, + }; + +diff --git a/drivers/gpu/drm/armada/armada_overlay.c b/drivers/gpu/drm/armada/armada_overlay.c +index 152b4e716269..6a9bba7206df 100644 +--- a/drivers/gpu/drm/armada/armada_overlay.c ++++ b/drivers/gpu/drm/armada/armada_overlay.c +@@ -27,6 +27,7 @@ struct armada_ovl_plane_properties { + uint16_t contrast; + uint16_t saturation; + uint32_t colorkey_mode; ++ uint32_t colorkey_enable; + }; + + struct armada_ovl_plane { +@@ -62,11 +63,13 @@ armada_ovl_update_attr(struct armada_ovl_plane_properties *prop, + writel_relaxed(0x00002000, dcrtc->base + LCD_SPU_CBSH_HUE); + + spin_lock_irq(&dcrtc->irq_lock); +- armada_updatel(prop->colorkey_mode | CFG_ALPHAM_GRA, +- CFG_CKMODE_MASK | CFG_ALPHAM_MASK | CFG_ALPHA_MASK, +- dcrtc->base + LCD_SPU_DMA_CTRL1); +- +- armada_updatel(ADV_GRACOLORKEY, 0, dcrtc->base + LCD_SPU_ADV_REG); ++ armada_updatel(prop->colorkey_mode, ++ CFG_CKMODE_MASK | CFG_ALPHAM_MASK | CFG_ALPHA_MASK, ++ dcrtc->base + LCD_SPU_DMA_CTRL1); ++ if (dcrtc->variant->has_spu_adv_reg) ++ armada_updatel(prop->colorkey_enable, ++ ADV_GRACOLORKEY | ADV_VIDCOLORKEY, ++ dcrtc->base + LCD_SPU_ADV_REG); + spin_unlock_irq(&dcrtc->irq_lock); + } + +@@ -340,8 +343,17 @@ static int armada_ovl_plane_set_property(struct drm_plane *plane, + dplane->prop.colorkey_vb |= K2B(val); + update_attr = true; + } else if (property == priv->colorkey_mode_prop) { +- dplane->prop.colorkey_mode &= ~CFG_CKMODE_MASK; +- dplane->prop.colorkey_mode |= CFG_CKMODE(val); ++ if (val == CKMODE_DISABLE) { ++ dplane->prop.colorkey_mode = ++ CFG_CKMODE(CKMODE_DISABLE) | ++ CFG_ALPHAM_CFG | CFG_ALPHA(255); ++ dplane->prop.colorkey_enable = 0; ++ } else { ++ dplane->prop.colorkey_mode = ++ CFG_CKMODE(val) | ++ CFG_ALPHAM_GRA | CFG_ALPHA(0); ++ dplane->prop.colorkey_enable = ADV_GRACOLORKEY; ++ } + update_attr = true; + } else if (property == priv->brightness_prop) { + dplane->prop.brightness = val - 256; +@@ -470,7 +482,9 @@ int armada_overlay_plane_create(struct drm_device *dev, unsigned long crtcs) + dplane->prop.colorkey_yr = 0xfefefe00; + dplane->prop.colorkey_ug = 0x01010100; + dplane->prop.colorkey_vb = 0x01010100; +- dplane->prop.colorkey_mode = CFG_CKMODE(CKMODE_RGB); ++ dplane->prop.colorkey_mode = CFG_CKMODE(CKMODE_RGB) | ++ CFG_ALPHAM_GRA | CFG_ALPHA(0); ++ dplane->prop.colorkey_enable = ADV_GRACOLORKEY; + dplane->prop.brightness = 0; + dplane->prop.contrast = 0x4000; + dplane->prop.saturation = 0x4000; +diff --git a/drivers/gpu/drm/exynos/exynos5433_drm_decon.c b/drivers/gpu/drm/exynos/exynos5433_drm_decon.c +index 6dd09c306bc1..bdcc6ec3c67b 100644 +--- a/drivers/gpu/drm/exynos/exynos5433_drm_decon.c ++++ b/drivers/gpu/drm/exynos/exynos5433_drm_decon.c +@@ -199,7 +199,7 @@ static void decon_win_set_pixfmt(struct decon_context *ctx, unsigned int win, + unsigned long val; + + val = readl(ctx->addr + DECON_WINCONx(win)); +- val &= ~WINCONx_BPPMODE_MASK; ++ val &= WINCONx_ENWIN_F; + + switch (fb->pixel_format) { + case DRM_FORMAT_XRGB1555: +@@ -291,8 +291,8 @@ static void decon_update_plane(struct exynos_drm_crtc *crtc, + COORDINATE_Y(state->crtc.y + state->crtc.h - 1); + writel(val, ctx->addr + DECON_VIDOSDxB(win)); + +- val = VIDOSD_Wx_ALPHA_R_F(0x0) | VIDOSD_Wx_ALPHA_G_F(0x0) | +- VIDOSD_Wx_ALPHA_B_F(0x0); ++ val = VIDOSD_Wx_ALPHA_R_F(0xff) | VIDOSD_Wx_ALPHA_G_F(0xff) | ++ VIDOSD_Wx_ALPHA_B_F(0xff); + writel(val, ctx->addr + DECON_VIDOSDxC(win)); + + val = VIDOSD_Wx_ALPHA_R_F(0x0) | VIDOSD_Wx_ALPHA_G_F(0x0) | +diff --git a/drivers/gpu/drm/exynos/exynos_drm_gsc.c b/drivers/gpu/drm/exynos/exynos_drm_gsc.c +index 52a9d269484e..4c81c79b15ea 100644 +--- a/drivers/gpu/drm/exynos/exynos_drm_gsc.c ++++ b/drivers/gpu/drm/exynos/exynos_drm_gsc.c +@@ -532,21 +532,25 @@ static int gsc_src_set_fmt(struct device *dev, u32 fmt) + GSC_IN_CHROMA_ORDER_CRCB); + break; + case DRM_FORMAT_NV21: ++ cfg |= (GSC_IN_CHROMA_ORDER_CRCB | GSC_IN_YUV420_2P); ++ break; + case DRM_FORMAT_NV61: +- cfg |= (GSC_IN_CHROMA_ORDER_CRCB | +- GSC_IN_YUV420_2P); ++ cfg |= (GSC_IN_CHROMA_ORDER_CRCB | GSC_IN_YUV422_2P); + break; + case DRM_FORMAT_YUV422: + cfg |= GSC_IN_YUV422_3P; + break; + case DRM_FORMAT_YUV420: ++ cfg |= (GSC_IN_CHROMA_ORDER_CBCR | GSC_IN_YUV420_3P); ++ break; + case DRM_FORMAT_YVU420: +- cfg |= GSC_IN_YUV420_3P; ++ cfg |= (GSC_IN_CHROMA_ORDER_CRCB | GSC_IN_YUV420_3P); + break; + case DRM_FORMAT_NV12: ++ cfg |= (GSC_IN_CHROMA_ORDER_CBCR | GSC_IN_YUV420_2P); ++ break; + case DRM_FORMAT_NV16: +- cfg |= (GSC_IN_CHROMA_ORDER_CBCR | +- GSC_IN_YUV420_2P); ++ cfg |= (GSC_IN_CHROMA_ORDER_CBCR | GSC_IN_YUV422_2P); + break; + default: + dev_err(ippdrv->dev, "invalid target yuv order 0x%x.\n", fmt); +@@ -806,18 +810,25 @@ static int gsc_dst_set_fmt(struct device *dev, u32 fmt) + GSC_OUT_CHROMA_ORDER_CRCB); + break; + case DRM_FORMAT_NV21: +- case DRM_FORMAT_NV61: + cfg |= (GSC_OUT_CHROMA_ORDER_CRCB | GSC_OUT_YUV420_2P); + break; ++ case DRM_FORMAT_NV61: ++ cfg |= (GSC_OUT_CHROMA_ORDER_CRCB | GSC_OUT_YUV422_2P); ++ break; + case DRM_FORMAT_YUV422: ++ cfg |= GSC_OUT_YUV422_3P; ++ break; + case DRM_FORMAT_YUV420: ++ cfg |= (GSC_OUT_CHROMA_ORDER_CBCR | GSC_OUT_YUV420_3P); ++ break; + case DRM_FORMAT_YVU420: +- cfg |= GSC_OUT_YUV420_3P; ++ cfg |= (GSC_OUT_CHROMA_ORDER_CRCB | GSC_OUT_YUV420_3P); + break; + case DRM_FORMAT_NV12: ++ cfg |= (GSC_OUT_CHROMA_ORDER_CBCR | GSC_OUT_YUV420_2P); ++ break; + case DRM_FORMAT_NV16: +- cfg |= (GSC_OUT_CHROMA_ORDER_CBCR | +- GSC_OUT_YUV420_2P); ++ cfg |= (GSC_OUT_CHROMA_ORDER_CBCR | GSC_OUT_YUV422_2P); + break; + default: + dev_err(ippdrv->dev, "invalid target yuv order 0x%x.\n", fmt); +diff --git a/drivers/gpu/drm/exynos/regs-gsc.h b/drivers/gpu/drm/exynos/regs-gsc.h +index 4704a993cbb7..16b39734115c 100644 +--- a/drivers/gpu/drm/exynos/regs-gsc.h ++++ b/drivers/gpu/drm/exynos/regs-gsc.h +@@ -138,6 +138,7 @@ + #define GSC_OUT_YUV420_3P (3 << 4) + #define GSC_OUT_YUV422_1P (4 << 4) + #define GSC_OUT_YUV422_2P (5 << 4) ++#define GSC_OUT_YUV422_3P (6 << 4) + #define GSC_OUT_YUV444 (7 << 4) + #define GSC_OUT_TILE_TYPE_MASK (1 << 2) + #define GSC_OUT_TILE_C_16x8 (0 << 2) +diff --git a/drivers/gpu/drm/nouveau/nouveau_gem.c b/drivers/gpu/drm/nouveau/nouveau_gem.c +index 909f69a302ee..505dca48b9f8 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_gem.c ++++ b/drivers/gpu/drm/nouveau/nouveau_gem.c +@@ -601,7 +601,7 @@ nouveau_gem_pushbuf_reloc_apply(struct nouveau_cli *cli, + struct nouveau_bo *nvbo; + uint32_t data; + +- if (unlikely(r->bo_index > req->nr_buffers)) { ++ if (unlikely(r->bo_index >= req->nr_buffers)) { + NV_PRINTK(err, cli, "reloc bo index invalid\n"); + ret = -EINVAL; + break; +@@ -611,7 +611,7 @@ nouveau_gem_pushbuf_reloc_apply(struct nouveau_cli *cli, + if (b->presumed.valid) + continue; + +- if (unlikely(r->reloc_bo_index > req->nr_buffers)) { ++ if (unlikely(r->reloc_bo_index >= req->nr_buffers)) { + NV_PRINTK(err, cli, "reloc container bo index invalid\n"); + ret = -EINVAL; + break; +diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c +index db951c4fd6dd..b1ad378cb2a6 100644 +--- a/drivers/hid/wacom_wac.c ++++ b/drivers/hid/wacom_wac.c +@@ -2429,8 +2429,14 @@ void wacom_setup_device_quirks(struct wacom *wacom) + if (features->type >= INTUOSHT && features->type <= BAMBOO_PT) + features->device_type |= WACOM_DEVICETYPE_PAD; + +- features->x_max = 4096; +- features->y_max = 4096; ++ if (features->type == INTUOSHT2) { ++ features->x_max = features->x_max / 10; ++ features->y_max = features->y_max / 10; ++ } ++ else { ++ features->x_max = 4096; ++ features->y_max = 4096; ++ } + } + else if (features->pktlen == WACOM_PKGLEN_BBTOUCH) { + features->device_type |= WACOM_DEVICETYPE_PAD; +diff --git a/drivers/i2c/busses/i2c-imx.c b/drivers/i2c/busses/i2c-imx.c +index 4d297d554e52..c4188308cefa 100644 +--- a/drivers/i2c/busses/i2c-imx.c ++++ b/drivers/i2c/busses/i2c-imx.c +@@ -665,9 +665,6 @@ static int i2c_imx_dma_read(struct imx_i2c_struct *i2c_imx, + struct imx_i2c_dma *dma = i2c_imx->dma; + struct device *dev = &i2c_imx->adapter.dev; + +- temp = imx_i2c_read_reg(i2c_imx, IMX_I2C_I2CR); +- temp |= I2CR_DMAEN; +- imx_i2c_write_reg(temp, i2c_imx, IMX_I2C_I2CR); + + dma->chan_using = dma->chan_rx; + dma->dma_transfer_dir = DMA_DEV_TO_MEM; +@@ -780,6 +777,7 @@ static int i2c_imx_read(struct imx_i2c_struct *i2c_imx, struct i2c_msg *msgs, bo + int i, result; + unsigned int temp; + int block_data = msgs->flags & I2C_M_RECV_LEN; ++ int use_dma = i2c_imx->dma && msgs->len >= DMA_THRESHOLD && !block_data; + + dev_dbg(&i2c_imx->adapter.dev, + "<%s> write slave address: addr=0x%x\n", +@@ -806,12 +804,14 @@ static int i2c_imx_read(struct imx_i2c_struct *i2c_imx, struct i2c_msg *msgs, bo + */ + if ((msgs->len - 1) || block_data) + temp &= ~I2CR_TXAK; ++ if (use_dma) ++ temp |= I2CR_DMAEN; + imx_i2c_write_reg(temp, i2c_imx, IMX_I2C_I2CR); + imx_i2c_read_reg(i2c_imx, IMX_I2C_I2DR); /* dummy read */ + + dev_dbg(&i2c_imx->adapter.dev, "<%s> read data\n", __func__); + +- if (i2c_imx->dma && msgs->len >= DMA_THRESHOLD && !block_data) ++ if (use_dma) + return i2c_imx_dma_read(i2c_imx, msgs, is_lastmsg); + + /* read data */ +diff --git a/drivers/iio/pressure/bmp280-core.c b/drivers/iio/pressure/bmp280-core.c +index 19aa957bd454..c9263acc190b 100644 +--- a/drivers/iio/pressure/bmp280-core.c ++++ b/drivers/iio/pressure/bmp280-core.c +@@ -347,10 +347,9 @@ static int bmp280_read_humid(struct bmp280_data *data, int *val, int *val2) + adc_humidity = be16_to_cpu(tmp); + comp_humidity = bmp280_compensate_humidity(data, adc_humidity); + +- *val = comp_humidity; +- *val2 = 1024; ++ *val = comp_humidity * 1000 / 1024; + +- return IIO_VAL_FRACTIONAL; ++ return IIO_VAL_INT; + } + + static int bmp280_read_raw(struct iio_dev *indio_dev, +diff --git a/drivers/infiniband/hw/mlx5/srq.c b/drivers/infiniband/hw/mlx5/srq.c +index 5c1dbe2f8757..d6e5002edb92 100644 +--- a/drivers/infiniband/hw/mlx5/srq.c ++++ b/drivers/infiniband/hw/mlx5/srq.c +@@ -268,18 +268,24 @@ struct ib_srq *mlx5_ib_create_srq(struct ib_pd *pd, + + desc_size = sizeof(struct mlx5_wqe_srq_next_seg) + + srq->msrq.max_gs * sizeof(struct mlx5_wqe_data_seg); +- if (desc_size == 0 || srq->msrq.max_gs > desc_size) +- return ERR_PTR(-EINVAL); ++ if (desc_size == 0 || srq->msrq.max_gs > desc_size) { ++ err = -EINVAL; ++ goto err_srq; ++ } + desc_size = roundup_pow_of_two(desc_size); + desc_size = max_t(size_t, 32, desc_size); +- if (desc_size < sizeof(struct mlx5_wqe_srq_next_seg)) +- return ERR_PTR(-EINVAL); ++ if (desc_size < sizeof(struct mlx5_wqe_srq_next_seg)) { ++ err = -EINVAL; ++ goto err_srq; ++ } + srq->msrq.max_avail_gather = (desc_size - sizeof(struct mlx5_wqe_srq_next_seg)) / + sizeof(struct mlx5_wqe_data_seg); + srq->msrq.wqe_shift = ilog2(desc_size); + buf_size = srq->msrq.max * desc_size; +- if (buf_size < desc_size) +- return ERR_PTR(-EINVAL); ++ if (buf_size < desc_size) { ++ err = -EINVAL; ++ goto err_srq; ++ } + in.type = init_attr->srq_type; + + if (pd->uobject) +diff --git a/drivers/infiniband/sw/rxe/rxe_req.c b/drivers/infiniband/sw/rxe/rxe_req.c +index 5b0ca35c06ab..47219ebd8ff2 100644 +--- a/drivers/infiniband/sw/rxe/rxe_req.c ++++ b/drivers/infiniband/sw/rxe/rxe_req.c +@@ -648,6 +648,9 @@ next_wqe: + } else { + goto exit; + } ++ if ((wqe->wr.send_flags & IB_SEND_SIGNALED) || ++ qp->sq_sig_type == IB_SIGNAL_ALL_WR) ++ rxe_run_task(&qp->comp.task, 1); + qp->req.wqe_index = next_index(qp->sq.queue, + qp->req.wqe_index); + goto next_wqe; +diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c +index b138b5cba286..6da66c3acd46 100644 +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -3734,6 +3734,13 @@ static int raid10_run(struct mddev *mddev) + disk->rdev->saved_raid_disk < 0) + conf->fullsync = 1; + } ++ ++ if (disk->replacement && ++ !test_bit(In_sync, &disk->replacement->flags) && ++ disk->replacement->saved_raid_disk < 0) { ++ conf->fullsync = 1; ++ } ++ + disk->recovery_disabled = mddev->recovery_disabled - 1; + } + +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h +index 7dd7490fdac1..f3f2d66432ab 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h +@@ -1529,6 +1529,7 @@ struct bnx2x { + struct link_vars link_vars; + u32 link_cnt; + struct bnx2x_link_report_data last_reported_link; ++ bool force_link_down; + + struct mdio_if_info mdio; + +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c +index 31287cec6e3a..2cd1dcd77559 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c +@@ -1265,6 +1265,11 @@ void __bnx2x_link_report(struct bnx2x *bp) + { + struct bnx2x_link_report_data cur_data; + ++ if (bp->force_link_down) { ++ bp->link_vars.link_up = 0; ++ return; ++ } ++ + /* reread mf_cfg */ + if (IS_PF(bp) && !CHIP_IS_E1(bp)) + bnx2x_read_mf_cfg(bp); +@@ -2822,6 +2827,7 @@ int bnx2x_nic_load(struct bnx2x *bp, int load_mode) + bp->pending_max = 0; + } + ++ bp->force_link_down = false; + if (bp->port.pmf) { + rc = bnx2x_initial_phy_init(bp, load_mode); + if (rc) +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c +index 554c4086b3c6..54dab4eac804 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c +@@ -10279,6 +10279,12 @@ static void bnx2x_sp_rtnl_task(struct work_struct *work) + bp->sp_rtnl_state = 0; + smp_mb(); + ++ /* Immediately indicate link as down */ ++ bp->link_vars.link_up = 0; ++ bp->force_link_down = true; ++ netif_carrier_off(bp->dev); ++ BNX2X_ERR("Indicating link is down due to Tx-timeout\n"); ++ + bnx2x_nic_unload(bp, UNLOAD_NORMAL, true); + bnx2x_nic_load(bp, LOAD_NORMAL); + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index 8777c3a4c095..72297b76944f 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -5560,7 +5560,7 @@ static int __bnxt_open_nic(struct bnxt *bp, bool irq_re_init, bool link_re_init) + rc = bnxt_request_irq(bp); + if (rc) { + netdev_err(bp->dev, "bnxt_request_irq err: %x\n", rc); +- goto open_err; ++ goto open_err_irq; + } + } + +@@ -5593,6 +5593,8 @@ static int __bnxt_open_nic(struct bnxt *bp, bool irq_re_init, bool link_re_init) + + open_err: + bnxt_disable_napi(bp); ++ ++open_err_irq: + bnxt_del_napi(bp); + + open_err_free_mem: +@@ -6862,11 +6864,11 @@ int bnxt_get_max_rings(struct bnxt *bp, int *max_rx, int *max_tx, bool shared) + int rx, tx, cp; + + _bnxt_get_max_rings(bp, &rx, &tx, &cp); ++ *max_rx = rx; ++ *max_tx = tx; + if (!rx || !tx || !cp) + return -ENOMEM; + +- *max_rx = rx; +- *max_tx = tx; + return bnxt_trim_rings(bp, max_rx, max_tx, cp, shared); + } + +diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c +index c395b21cb57b..c71a52a2f801 100644 +--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c ++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c +@@ -274,7 +274,7 @@ static void dcb_tx_queue_prio_enable(struct net_device *dev, int enable) + "Can't %s DCB Priority on port %d, TX Queue %d: err=%d\n", + enable ? "set" : "unset", pi->port_id, i, -err); + else +- txq->dcb_prio = value; ++ txq->dcb_prio = enable ? value : 0; + } + } + +diff --git a/drivers/net/ethernet/cisco/enic/enic_clsf.c b/drivers/net/ethernet/cisco/enic/enic_clsf.c +index 3c677ed3c29e..4d9014d5b36d 100644 +--- a/drivers/net/ethernet/cisco/enic/enic_clsf.c ++++ b/drivers/net/ethernet/cisco/enic/enic_clsf.c +@@ -78,7 +78,6 @@ void enic_rfs_flw_tbl_init(struct enic *enic) + enic->rfs_h.max = enic->config.num_arfs; + enic->rfs_h.free = enic->rfs_h.max; + enic->rfs_h.toclean = 0; +- enic_rfs_timer_start(enic); + } + + void enic_rfs_flw_tbl_free(struct enic *enic) +@@ -87,7 +86,6 @@ void enic_rfs_flw_tbl_free(struct enic *enic) + + enic_rfs_timer_stop(enic); + spin_lock_bh(&enic->rfs_h.lock); +- enic->rfs_h.free = 0; + for (i = 0; i < (1 << ENIC_RFS_FLW_BITSHIFT); i++) { + struct hlist_head *hhead; + struct hlist_node *tmp; +@@ -98,6 +96,7 @@ void enic_rfs_flw_tbl_free(struct enic *enic) + enic_delfltr(enic, n->fltr_id); + hlist_del(&n->node); + kfree(n); ++ enic->rfs_h.free++; + } + } + spin_unlock_bh(&enic->rfs_h.lock); +diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c +index 99f593be26e2..2e9bab45d419 100644 +--- a/drivers/net/ethernet/cisco/enic/enic_main.c ++++ b/drivers/net/ethernet/cisco/enic/enic_main.c +@@ -1760,7 +1760,7 @@ static int enic_open(struct net_device *netdev) + vnic_intr_unmask(&enic->intr[i]); + + enic_notify_timer_start(enic); +- enic_rfs_flw_tbl_init(enic); ++ enic_rfs_timer_start(enic); + + return 0; + +@@ -2692,6 +2692,7 @@ static int enic_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + enic->notify_timer.function = enic_notify_timer; + enic->notify_timer.data = (unsigned long)enic; + ++ enic_rfs_flw_tbl_init(enic); + enic_set_rx_coal_setting(enic); + INIT_WORK(&enic->reset, enic_reset); + INIT_WORK(&enic->tx_hang_reset, enic_tx_hang_reset); +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c +index ad3362293cbd..0d2baec546e1 100644 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c +@@ -1847,7 +1847,12 @@ s32 ixgbe_set_rar_generic(struct ixgbe_hw *hw, u32 index, u8 *addr, u32 vmdq, + if (enable_addr != 0) + rar_high |= IXGBE_RAH_AV; + ++ /* Record lower 32 bits of MAC address and then make ++ * sure that write is flushed to hardware before writing ++ * the upper 16 bits and setting the valid bit. ++ */ + IXGBE_WRITE_REG(hw, IXGBE_RAL(index), rar_low); ++ IXGBE_WRITE_FLUSH(hw); + IXGBE_WRITE_REG(hw, IXGBE_RAH(index), rar_high); + + return 0; +@@ -1879,8 +1884,13 @@ s32 ixgbe_clear_rar_generic(struct ixgbe_hw *hw, u32 index) + rar_high = IXGBE_READ_REG(hw, IXGBE_RAH(index)); + rar_high &= ~(0x0000FFFF | IXGBE_RAH_AV); + +- IXGBE_WRITE_REG(hw, IXGBE_RAL(index), 0); ++ /* Clear the address valid bit and upper 16 bits of the address ++ * before clearing the lower bits. This way we aren't updating ++ * a live filter. ++ */ + IXGBE_WRITE_REG(hw, IXGBE_RAH(index), rar_high); ++ IXGBE_WRITE_FLUSH(hw); ++ IXGBE_WRITE_REG(hw, IXGBE_RAL(index), 0); + + /* clear VMDq pool/queue selection for this RAR */ + hw->mac.ops.clear_vmdq(hw, index, IXGBE_CLEAR_VMDQ_ALL); +diff --git a/drivers/net/ethernet/qlogic/qed/qed_main.c b/drivers/net/ethernet/qlogic/qed/qed_main.c +index f36bd0bd37da..1ed13a165e58 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_main.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_main.c +@@ -502,8 +502,16 @@ static irqreturn_t qed_single_int(int irq, void *dev_instance) + /* Fastpath interrupts */ + for (j = 0; j < 64; j++) { + if ((0x2ULL << j) & status) { +- hwfn->simd_proto_handler[j].func( +- hwfn->simd_proto_handler[j].token); ++ struct qed_simd_fp_handler *p_handler = ++ &hwfn->simd_proto_handler[j]; ++ ++ if (p_handler->func) ++ p_handler->func(p_handler->token); ++ else ++ DP_NOTICE(hwfn, ++ "Not calling fastpath handler as it is NULL [handler #%d, status 0x%llx]\n", ++ j, status); ++ + status &= ~(0x2ULL << j); + rc = IRQ_HANDLED; + } +diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c +index ccbb04503b27..b53a18e365c2 100644 +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c +@@ -1128,6 +1128,8 @@ static ssize_t qlcnic_83xx_sysfs_flash_write_handler(struct file *filp, + struct qlcnic_adapter *adapter = dev_get_drvdata(dev); + + ret = kstrtoul(buf, 16, &data); ++ if (ret) ++ return ret; + + switch (data) { + case QLC_83XX_FLASH_SECTOR_ERASE_CMD: +diff --git a/drivers/net/ethernet/qualcomm/qca_spi.c b/drivers/net/ethernet/qualcomm/qca_spi.c +index 8bbb55f31909..21f546587e3d 100644 +--- a/drivers/net/ethernet/qualcomm/qca_spi.c ++++ b/drivers/net/ethernet/qualcomm/qca_spi.c +@@ -635,7 +635,7 @@ qcaspi_netdev_open(struct net_device *dev) + return ret; + } + +- netif_start_queue(qca->net_dev); ++ /* SPI thread takes care of TX queue */ + + return 0; + } +@@ -739,6 +739,9 @@ qcaspi_netdev_tx_timeout(struct net_device *dev) + qca->net_dev->stats.tx_errors++; + /* Trigger tx queue flush and QCA7000 reset */ + qca->sync = QCASPI_SYNC_UNKNOWN; ++ ++ if (qca->spi_thread) ++ wake_up_process(qca->spi_thread); + } + + static int +@@ -865,22 +868,22 @@ qca_spi_probe(struct spi_device *spi) + + if ((qcaspi_clkspeed < QCASPI_CLK_SPEED_MIN) || + (qcaspi_clkspeed > QCASPI_CLK_SPEED_MAX)) { +- dev_info(&spi->dev, "Invalid clkspeed: %d\n", +- qcaspi_clkspeed); ++ dev_err(&spi->dev, "Invalid clkspeed: %d\n", ++ qcaspi_clkspeed); + return -EINVAL; + } + + if ((qcaspi_burst_len < QCASPI_BURST_LEN_MIN) || + (qcaspi_burst_len > QCASPI_BURST_LEN_MAX)) { +- dev_info(&spi->dev, "Invalid burst len: %d\n", +- qcaspi_burst_len); ++ dev_err(&spi->dev, "Invalid burst len: %d\n", ++ qcaspi_burst_len); + return -EINVAL; + } + + if ((qcaspi_pluggable < QCASPI_PLUGGABLE_MIN) || + (qcaspi_pluggable > QCASPI_PLUGGABLE_MAX)) { +- dev_info(&spi->dev, "Invalid pluggable: %d\n", +- qcaspi_pluggable); ++ dev_err(&spi->dev, "Invalid pluggable: %d\n", ++ qcaspi_pluggable); + return -EINVAL; + } + +@@ -941,8 +944,8 @@ qca_spi_probe(struct spi_device *spi) + } + + if (register_netdev(qcaspi_devs)) { +- dev_info(&spi->dev, "Unable to register net device %s\n", +- qcaspi_devs->name); ++ dev_err(&spi->dev, "Unable to register net device %s\n", ++ qcaspi_devs->name); + free_netdev(qcaspi_devs); + return -EFAULT; + } +diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c +index 10d3a9f6349e..307ecd500dac 100644 +--- a/drivers/net/ethernet/renesas/ravb_main.c ++++ b/drivers/net/ethernet/renesas/ravb_main.c +@@ -955,6 +955,13 @@ static void ravb_adjust_link(struct net_device *ndev) + struct ravb_private *priv = netdev_priv(ndev); + struct phy_device *phydev = ndev->phydev; + bool new_state = false; ++ unsigned long flags; ++ ++ spin_lock_irqsave(&priv->lock, flags); ++ ++ /* Disable TX and RX right over here, if E-MAC change is ignored */ ++ if (priv->no_avb_link) ++ ravb_rcv_snd_disable(ndev); + + if (phydev->link) { + if (phydev->duplex != priv->duplex) { +@@ -972,18 +979,21 @@ static void ravb_adjust_link(struct net_device *ndev) + ravb_modify(ndev, ECMR, ECMR_TXF, 0); + new_state = true; + priv->link = phydev->link; +- if (priv->no_avb_link) +- ravb_rcv_snd_enable(ndev); + } + } else if (priv->link) { + new_state = true; + priv->link = 0; + priv->speed = 0; + priv->duplex = -1; +- if (priv->no_avb_link) +- ravb_rcv_snd_disable(ndev); + } + ++ /* Enable TX and RX right over here, if E-MAC change is ignored */ ++ if (priv->no_avb_link && phydev->link) ++ ravb_rcv_snd_enable(ndev); ++ ++ mmiowb(); ++ spin_unlock_irqrestore(&priv->lock, flags); ++ + if (new_state && netif_msg_link(priv)) + phy_print_status(phydev); + } +@@ -1085,52 +1095,18 @@ static int ravb_get_link_ksettings(struct net_device *ndev, + static int ravb_set_link_ksettings(struct net_device *ndev, + const struct ethtool_link_ksettings *cmd) + { +- struct ravb_private *priv = netdev_priv(ndev); +- unsigned long flags; +- int error; +- + if (!ndev->phydev) + return -ENODEV; + +- spin_lock_irqsave(&priv->lock, flags); +- +- /* Disable TX and RX */ +- ravb_rcv_snd_disable(ndev); +- +- error = phy_ethtool_ksettings_set(ndev->phydev, cmd); +- if (error) +- goto error_exit; +- +- if (cmd->base.duplex == DUPLEX_FULL) +- priv->duplex = 1; +- else +- priv->duplex = 0; +- +- ravb_set_duplex(ndev); +- +-error_exit: +- mdelay(1); +- +- /* Enable TX and RX */ +- ravb_rcv_snd_enable(ndev); +- +- mmiowb(); +- spin_unlock_irqrestore(&priv->lock, flags); +- +- return error; ++ return phy_ethtool_ksettings_set(ndev->phydev, cmd); + } + + static int ravb_nway_reset(struct net_device *ndev) + { +- struct ravb_private *priv = netdev_priv(ndev); + int error = -ENODEV; +- unsigned long flags; + +- if (ndev->phydev) { +- spin_lock_irqsave(&priv->lock, flags); ++ if (ndev->phydev) + error = phy_start_aneg(ndev->phydev); +- spin_unlock_irqrestore(&priv->lock, flags); +- } + + return error; + } +diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c +index c8fd99b3ca29..c59e8fe37069 100644 +--- a/drivers/net/ethernet/renesas/sh_eth.c ++++ b/drivers/net/ethernet/renesas/sh_eth.c +@@ -1743,8 +1743,15 @@ static void sh_eth_adjust_link(struct net_device *ndev) + { + struct sh_eth_private *mdp = netdev_priv(ndev); + struct phy_device *phydev = ndev->phydev; ++ unsigned long flags; + int new_state = 0; + ++ spin_lock_irqsave(&mdp->lock, flags); ++ ++ /* Disable TX and RX right over here, if E-MAC change is ignored */ ++ if (mdp->cd->no_psr || mdp->no_ether_link) ++ sh_eth_rcv_snd_disable(ndev); ++ + if (phydev->link) { + if (phydev->duplex != mdp->duplex) { + new_state = 1; +@@ -1763,18 +1770,21 @@ static void sh_eth_adjust_link(struct net_device *ndev) + sh_eth_modify(ndev, ECMR, ECMR_TXF, 0); + new_state = 1; + mdp->link = phydev->link; +- if (mdp->cd->no_psr || mdp->no_ether_link) +- sh_eth_rcv_snd_enable(ndev); + } + } else if (mdp->link) { + new_state = 1; + mdp->link = 0; + mdp->speed = 0; + mdp->duplex = -1; +- if (mdp->cd->no_psr || mdp->no_ether_link) +- sh_eth_rcv_snd_disable(ndev); + } + ++ /* Enable TX and RX right over here, if E-MAC change is ignored */ ++ if ((mdp->cd->no_psr || mdp->no_ether_link) && phydev->link) ++ sh_eth_rcv_snd_enable(ndev); ++ ++ mmiowb(); ++ spin_unlock_irqrestore(&mdp->lock, flags); ++ + if (new_state && netif_msg_link(mdp)) + phy_print_status(phydev); + } +@@ -1856,39 +1866,10 @@ static int sh_eth_get_link_ksettings(struct net_device *ndev, + static int sh_eth_set_link_ksettings(struct net_device *ndev, + const struct ethtool_link_ksettings *cmd) + { +- struct sh_eth_private *mdp = netdev_priv(ndev); +- unsigned long flags; +- int ret; +- + if (!ndev->phydev) + return -ENODEV; + +- spin_lock_irqsave(&mdp->lock, flags); +- +- /* disable tx and rx */ +- sh_eth_rcv_snd_disable(ndev); +- +- ret = phy_ethtool_ksettings_set(ndev->phydev, cmd); +- if (ret) +- goto error_exit; +- +- if (cmd->base.duplex == DUPLEX_FULL) +- mdp->duplex = 1; +- else +- mdp->duplex = 0; +- +- if (mdp->cd->set_duplex) +- mdp->cd->set_duplex(ndev); +- +-error_exit: +- mdelay(1); +- +- /* enable tx and rx */ +- sh_eth_rcv_snd_enable(ndev); +- +- spin_unlock_irqrestore(&mdp->lock, flags); +- +- return ret; ++ return phy_ethtool_ksettings_set(ndev->phydev, cmd); + } + + /* If it is ever necessary to increase SH_ETH_REG_DUMP_MAX_REGS, the +@@ -2079,18 +2060,10 @@ static void sh_eth_get_regs(struct net_device *ndev, struct ethtool_regs *regs, + + static int sh_eth_nway_reset(struct net_device *ndev) + { +- struct sh_eth_private *mdp = netdev_priv(ndev); +- unsigned long flags; +- int ret; +- + if (!ndev->phydev) + return -ENODEV; + +- spin_lock_irqsave(&mdp->lock, flags); +- ret = phy_start_aneg(ndev->phydev); +- spin_unlock_irqrestore(&mdp->lock, flags); +- +- return ret; ++ return phy_start_aneg(ndev->phydev); + } + + static u32 sh_eth_get_msglevel(struct net_device *ndev) +diff --git a/drivers/net/ethernet/stmicro/stmmac/Kconfig b/drivers/net/ethernet/stmicro/stmmac/Kconfig +index 4b78168a5f3c..0d03682faffb 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/Kconfig ++++ b/drivers/net/ethernet/stmicro/stmmac/Kconfig +@@ -83,7 +83,7 @@ config DWMAC_ROCKCHIP + config DWMAC_SOCFPGA + tristate "SOCFPGA dwmac support" + default ARCH_SOCFPGA +- depends on OF && (ARCH_SOCFPGA || COMPILE_TEST) ++ depends on OF && (ARCH_SOCFPGA || ARCH_STRATIX10 || COMPILE_TEST) + select MFD_SYSCON + help + Support for ethernet controller on Altera SOCFPGA +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c +index 0c420e97de1e..c3a78c113424 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c +@@ -55,6 +55,7 @@ struct socfpga_dwmac { + struct device *dev; + struct regmap *sys_mgr_base_addr; + struct reset_control *stmmac_rst; ++ struct reset_control *stmmac_ocp_rst; + void __iomem *splitter_base; + bool f2h_ptp_ref_clk; + struct tse_pcs pcs; +@@ -262,8 +263,8 @@ static int socfpga_dwmac_set_phy_mode(struct socfpga_dwmac *dwmac) + val = SYSMGR_EMACGRP_CTRL_PHYSEL_ENUM_GMII_MII; + + /* Assert reset to the enet controller before changing the phy mode */ +- if (dwmac->stmmac_rst) +- reset_control_assert(dwmac->stmmac_rst); ++ reset_control_assert(dwmac->stmmac_ocp_rst); ++ reset_control_assert(dwmac->stmmac_rst); + + regmap_read(sys_mgr_base_addr, reg_offset, &ctrl); + ctrl &= ~(SYSMGR_EMACGRP_CTRL_PHYSEL_MASK << reg_shift); +@@ -285,8 +286,8 @@ static int socfpga_dwmac_set_phy_mode(struct socfpga_dwmac *dwmac) + /* Deassert reset for the phy configuration to be sampled by + * the enet controller, and operation to start in requested mode + */ +- if (dwmac->stmmac_rst) +- reset_control_deassert(dwmac->stmmac_rst); ++ reset_control_deassert(dwmac->stmmac_ocp_rst); ++ reset_control_deassert(dwmac->stmmac_rst); + if (phymode == PHY_INTERFACE_MODE_SGMII) { + if (tse_pcs_init(dwmac->pcs.tse_pcs_base, &dwmac->pcs) != 0) { + dev_err(dwmac->dev, "Unable to initialize TSE PCS"); +@@ -321,6 +322,15 @@ static int socfpga_dwmac_probe(struct platform_device *pdev) + goto err_remove_config_dt; + } + ++ dwmac->stmmac_ocp_rst = devm_reset_control_get_optional(dev, "stmmaceth-ocp"); ++ if (IS_ERR(dwmac->stmmac_ocp_rst)) { ++ ret = PTR_ERR(dwmac->stmmac_ocp_rst); ++ dev_err(dev, "error getting reset control of ocp %d\n", ret); ++ goto err_remove_config_dt; ++ } ++ ++ reset_control_deassert(dwmac->stmmac_ocp_rst); ++ + ret = socfpga_dwmac_parse_data(dwmac, dev); + if (ret) { + dev_err(dev, "Unable to parse OF data\n"); +diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c +index 481c7bf0395b..413cf14dbacd 100644 +--- a/drivers/net/ethernet/ti/davinci_emac.c ++++ b/drivers/net/ethernet/ti/davinci_emac.c +@@ -1387,6 +1387,10 @@ static int emac_devioctl(struct net_device *ndev, struct ifreq *ifrq, int cmd) + + static int match_first_device(struct device *dev, void *data) + { ++ if (dev->parent && dev->parent->of_node) ++ return of_device_is_compatible(dev->parent->of_node, ++ "ti,davinci_mdio"); ++ + return !strncmp(dev_name(dev), "davinci_mdio", 12); + } + +diff --git a/drivers/net/hamradio/bpqether.c b/drivers/net/hamradio/bpqether.c +index 622ab3ab9e93..f5e0983ae2a1 100644 +--- a/drivers/net/hamradio/bpqether.c ++++ b/drivers/net/hamradio/bpqether.c +@@ -89,10 +89,6 @@ + static const char banner[] __initconst = KERN_INFO \ + "AX.25: bpqether driver version 004\n"; + +-static char bcast_addr[6]={0xFF,0xFF,0xFF,0xFF,0xFF,0xFF}; +- +-static char bpq_eth_addr[6]; +- + static int bpq_rcv(struct sk_buff *, struct net_device *, struct packet_type *, struct net_device *); + static int bpq_device_event(struct notifier_block *, unsigned long, void *); + +@@ -515,8 +511,8 @@ static int bpq_new_device(struct net_device *edev) + bpq->ethdev = edev; + bpq->axdev = ndev; + +- memcpy(bpq->dest_addr, bcast_addr, sizeof(bpq_eth_addr)); +- memcpy(bpq->acpt_addr, bcast_addr, sizeof(bpq_eth_addr)); ++ eth_broadcast_addr(bpq->dest_addr); ++ eth_broadcast_addr(bpq->acpt_addr); + + err = register_netdevice(ndev); + if (err) +diff --git a/drivers/net/ieee802154/at86rf230.c b/drivers/net/ieee802154/at86rf230.c +index 9f10da60e02d..ce3b7fb7eda0 100644 +--- a/drivers/net/ieee802154/at86rf230.c ++++ b/drivers/net/ieee802154/at86rf230.c +@@ -941,7 +941,7 @@ at86rf230_xmit(struct ieee802154_hw *hw, struct sk_buff *skb) + static int + at86rf230_ed(struct ieee802154_hw *hw, u8 *level) + { +- BUG_ON(!level); ++ WARN_ON(!level); + *level = 0xbe; + return 0; + } +@@ -1117,8 +1117,7 @@ at86rf230_set_hw_addr_filt(struct ieee802154_hw *hw, + if (changed & IEEE802154_AFILT_SADDR_CHANGED) { + u16 addr = le16_to_cpu(filt->short_addr); + +- dev_vdbg(&lp->spi->dev, +- "at86rf230_set_hw_addr_filt called for saddr\n"); ++ dev_vdbg(&lp->spi->dev, "%s called for saddr\n", __func__); + __at86rf230_write(lp, RG_SHORT_ADDR_0, addr); + __at86rf230_write(lp, RG_SHORT_ADDR_1, addr >> 8); + } +@@ -1126,8 +1125,7 @@ at86rf230_set_hw_addr_filt(struct ieee802154_hw *hw, + if (changed & IEEE802154_AFILT_PANID_CHANGED) { + u16 pan = le16_to_cpu(filt->pan_id); + +- dev_vdbg(&lp->spi->dev, +- "at86rf230_set_hw_addr_filt called for pan id\n"); ++ dev_vdbg(&lp->spi->dev, "%s called for pan id\n", __func__); + __at86rf230_write(lp, RG_PAN_ID_0, pan); + __at86rf230_write(lp, RG_PAN_ID_1, pan >> 8); + } +@@ -1136,15 +1134,13 @@ at86rf230_set_hw_addr_filt(struct ieee802154_hw *hw, + u8 i, addr[8]; + + memcpy(addr, &filt->ieee_addr, 8); +- dev_vdbg(&lp->spi->dev, +- "at86rf230_set_hw_addr_filt called for IEEE addr\n"); ++ dev_vdbg(&lp->spi->dev, "%s called for IEEE addr\n", __func__); + for (i = 0; i < 8; i++) + __at86rf230_write(lp, RG_IEEE_ADDR_0 + i, addr[i]); + } + + if (changed & IEEE802154_AFILT_PANC_CHANGED) { +- dev_vdbg(&lp->spi->dev, +- "at86rf230_set_hw_addr_filt called for panc change\n"); ++ dev_vdbg(&lp->spi->dev, "%s called for panc change\n", __func__); + if (filt->pan_coord) + at86rf230_write_subreg(lp, SR_AACK_I_AM_COORD, 1); + else +@@ -1248,7 +1244,6 @@ at86rf230_set_cca_mode(struct ieee802154_hw *hw, + return at86rf230_write_subreg(lp, SR_CCA_MODE, val); + } + +- + static int + at86rf230_set_cca_ed_level(struct ieee802154_hw *hw, s32 mbm) + { +diff --git a/drivers/net/ieee802154/fakelb.c b/drivers/net/ieee802154/fakelb.c +index ec387efb61d0..685398191995 100644 +--- a/drivers/net/ieee802154/fakelb.c ++++ b/drivers/net/ieee802154/fakelb.c +@@ -49,7 +49,7 @@ struct fakelb_phy { + + static int fakelb_hw_ed(struct ieee802154_hw *hw, u8 *level) + { +- BUG_ON(!level); ++ WARN_ON(!level); + *level = 0xbe; + + return 0; +diff --git a/drivers/net/ipvlan/ipvlan_main.c b/drivers/net/ipvlan/ipvlan_main.c +index 24eb5755604f..b299277361b7 100644 +--- a/drivers/net/ipvlan/ipvlan_main.c ++++ b/drivers/net/ipvlan/ipvlan_main.c +@@ -63,10 +63,23 @@ static int ipvlan_set_port_mode(struct ipvl_port *port, u16 nval) + { + struct ipvl_dev *ipvlan; + struct net_device *mdev = port->dev; +- int err = 0; ++ unsigned int flags; ++ int err; + + ASSERT_RTNL(); + if (port->mode != nval) { ++ list_for_each_entry(ipvlan, &port->ipvlans, pnode) { ++ flags = ipvlan->dev->flags; ++ if (nval == IPVLAN_MODE_L3 || nval == IPVLAN_MODE_L3S) { ++ err = dev_change_flags(ipvlan->dev, ++ flags | IFF_NOARP); ++ } else { ++ err = dev_change_flags(ipvlan->dev, ++ flags & ~IFF_NOARP); ++ } ++ if (unlikely(err)) ++ goto fail; ++ } + if (nval == IPVLAN_MODE_L3S) { + /* New mode is L3S */ + err = ipvlan_register_nf_hook(); +@@ -74,21 +87,28 @@ static int ipvlan_set_port_mode(struct ipvl_port *port, u16 nval) + mdev->l3mdev_ops = &ipvl_l3mdev_ops; + mdev->priv_flags |= IFF_L3MDEV_MASTER; + } else +- return err; ++ goto fail; + } else if (port->mode == IPVLAN_MODE_L3S) { + /* Old mode was L3S */ + mdev->priv_flags &= ~IFF_L3MDEV_MASTER; + ipvlan_unregister_nf_hook(); + mdev->l3mdev_ops = NULL; + } +- list_for_each_entry(ipvlan, &port->ipvlans, pnode) { +- if (nval == IPVLAN_MODE_L3 || nval == IPVLAN_MODE_L3S) +- ipvlan->dev->flags |= IFF_NOARP; +- else +- ipvlan->dev->flags &= ~IFF_NOARP; +- } + port->mode = nval; + } ++ return 0; ++ ++fail: ++ /* Undo the flags changes that have been done so far. */ ++ list_for_each_entry_continue_reverse(ipvlan, &port->ipvlans, pnode) { ++ flags = ipvlan->dev->flags; ++ if (port->mode == IPVLAN_MODE_L3 || ++ port->mode == IPVLAN_MODE_L3S) ++ dev_change_flags(ipvlan->dev, flags | IFF_NOARP); ++ else ++ dev_change_flags(ipvlan->dev, flags & ~IFF_NOARP); ++ } ++ + return err; + } + +diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c +index dc4f7ea95c9b..9504800217ed 100644 +--- a/drivers/net/usb/rtl8150.c ++++ b/drivers/net/usb/rtl8150.c +@@ -681,7 +681,7 @@ static void rtl8150_set_multicast(struct net_device *netdev) + (netdev->flags & IFF_ALLMULTI)) { + rx_creg &= 0xfffe; + rx_creg |= 0x0002; +- dev_info(&netdev->dev, "%s: allmulti set\n", netdev->name); ++ dev_dbg(&netdev->dev, "%s: allmulti set\n", netdev->name); + } else { + /* ~RX_MULTICAST, ~RX_PROMISCUOUS */ + rx_creg &= 0x00fc; +diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c +index 2cc0f28f4fd2..03d04011d653 100644 +--- a/drivers/net/usb/smsc75xx.c ++++ b/drivers/net/usb/smsc75xx.c +@@ -82,6 +82,9 @@ static bool turbo_mode = true; + module_param(turbo_mode, bool, 0644); + MODULE_PARM_DESC(turbo_mode, "Enable multiple frames per Rx transaction"); + ++static int smsc75xx_link_ok_nopm(struct usbnet *dev); ++static int smsc75xx_phy_gig_workaround(struct usbnet *dev); ++ + static int __must_check __smsc75xx_read_reg(struct usbnet *dev, u32 index, + u32 *data, int in_pm) + { +@@ -852,6 +855,9 @@ static int smsc75xx_phy_initialize(struct usbnet *dev) + return -EIO; + } + ++ /* phy workaround for gig link */ ++ smsc75xx_phy_gig_workaround(dev); ++ + smsc75xx_mdio_write(dev->net, dev->mii.phy_id, MII_ADVERTISE, + ADVERTISE_ALL | ADVERTISE_CSMA | ADVERTISE_PAUSE_CAP | + ADVERTISE_PAUSE_ASYM); +@@ -990,6 +996,62 @@ static int smsc75xx_wait_ready(struct usbnet *dev, int in_pm) + return -EIO; + } + ++static int smsc75xx_phy_gig_workaround(struct usbnet *dev) ++{ ++ struct mii_if_info *mii = &dev->mii; ++ int ret = 0, timeout = 0; ++ u32 buf, link_up = 0; ++ ++ /* Set the phy in Gig loopback */ ++ smsc75xx_mdio_write(dev->net, mii->phy_id, MII_BMCR, 0x4040); ++ ++ /* Wait for the link up */ ++ do { ++ link_up = smsc75xx_link_ok_nopm(dev); ++ usleep_range(10000, 20000); ++ timeout++; ++ } while ((!link_up) && (timeout < 1000)); ++ ++ if (timeout >= 1000) { ++ netdev_warn(dev->net, "Timeout waiting for PHY link up\n"); ++ return -EIO; ++ } ++ ++ /* phy reset */ ++ ret = smsc75xx_read_reg(dev, PMT_CTL, &buf); ++ if (ret < 0) { ++ netdev_warn(dev->net, "Failed to read PMT_CTL: %d\n", ret); ++ return ret; ++ } ++ ++ buf |= PMT_CTL_PHY_RST; ++ ++ ret = smsc75xx_write_reg(dev, PMT_CTL, buf); ++ if (ret < 0) { ++ netdev_warn(dev->net, "Failed to write PMT_CTL: %d\n", ret); ++ return ret; ++ } ++ ++ timeout = 0; ++ do { ++ usleep_range(10000, 20000); ++ ret = smsc75xx_read_reg(dev, PMT_CTL, &buf); ++ if (ret < 0) { ++ netdev_warn(dev->net, "Failed to read PMT_CTL: %d\n", ++ ret); ++ return ret; ++ } ++ timeout++; ++ } while ((buf & PMT_CTL_PHY_RST) && (timeout < 100)); ++ ++ if (timeout >= 100) { ++ netdev_warn(dev->net, "timeout waiting for PHY Reset\n"); ++ return -EIO; ++ } ++ ++ return 0; ++} ++ + static int smsc75xx_reset(struct usbnet *dev) + { + struct smsc75xx_priv *pdata = (struct smsc75xx_priv *)(dev->data[0]); +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c +index d46f086e6360..de52d826eb24 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c +@@ -4229,6 +4229,13 @@ void brcmf_sdio_remove(struct brcmf_sdio *bus) + brcmf_dbg(TRACE, "Enter\n"); + + if (bus) { ++ /* Stop watchdog task */ ++ if (bus->watchdog_tsk) { ++ send_sig(SIGTERM, bus->watchdog_tsk, 1); ++ kthread_stop(bus->watchdog_tsk); ++ bus->watchdog_tsk = NULL; ++ } ++ + /* De-register interrupt handler */ + brcmf_sdiod_intr_unregister(bus->sdiodev); + +diff --git a/drivers/nfc/pn533/usb.c b/drivers/nfc/pn533/usb.c +index 33ed78be2750..3a897f57cac5 100644 +--- a/drivers/nfc/pn533/usb.c ++++ b/drivers/nfc/pn533/usb.c +@@ -71,7 +71,7 @@ static void pn533_recv_response(struct urb *urb) + struct sk_buff *skb = NULL; + + if (!urb->status) { +- skb = alloc_skb(urb->actual_length, GFP_KERNEL); ++ skb = alloc_skb(urb->actual_length, GFP_ATOMIC); + if (!skb) { + nfc_err(&phy->udev->dev, "failed to alloc memory\n"); + } else { +@@ -180,7 +180,7 @@ static int pn533_usb_send_frame(struct pn533 *dev, + + if (dev->protocol_type == PN533_PROTO_REQ_RESP) { + /* request for response for sent packet directly */ +- rc = pn533_submit_urb_for_response(phy, GFP_ATOMIC); ++ rc = pn533_submit_urb_for_response(phy, GFP_KERNEL); + if (rc) + goto error; + } else if (dev->protocol_type == PN533_PROTO_REQ_ACK_RESP) { +diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c +index 64b40a12abcf..f12753eb3216 100644 +--- a/drivers/nvme/target/core.c ++++ b/drivers/nvme/target/core.c +@@ -578,6 +578,14 @@ static void nvmet_start_ctrl(struct nvmet_ctrl *ctrl) + } + + ctrl->csts = NVME_CSTS_RDY; ++ ++ /* ++ * Controllers that are not yet enabled should not really enforce the ++ * keep alive timeout, but we still want to track a timeout and cleanup ++ * in case a host died before it enabled the controller. Hence, simply ++ * reset the keep alive timer when the controller is enabled. ++ */ ++ mod_delayed_work(system_wq, &ctrl->ka_work, ctrl->kato * HZ); + } + + static void nvmet_clear_ctrl(struct nvmet_ctrl *ctrl) +diff --git a/drivers/pci/host/pci-host-common.c b/drivers/pci/host/pci-host-common.c +index e3c48b5deb93..5c90d7be2184 100644 +--- a/drivers/pci/host/pci-host-common.c ++++ b/drivers/pci/host/pci-host-common.c +@@ -45,7 +45,7 @@ static int gen_pci_parse_request_of_pci_ranges(struct device *dev, + + switch (resource_type(res)) { + case IORESOURCE_IO: +- err = pci_remap_iospace(res, iobase); ++ err = devm_pci_remap_iospace(dev, res, iobase); + if (err) { + dev_warn(dev, "error %d: failed to map resource %pR\n", + err, res); +diff --git a/drivers/pci/host/pci-versatile.c b/drivers/pci/host/pci-versatile.c +index b7dc07002f13..4096cce0ef0e 100644 +--- a/drivers/pci/host/pci-versatile.c ++++ b/drivers/pci/host/pci-versatile.c +@@ -89,7 +89,7 @@ static int versatile_pci_parse_request_of_pci_ranges(struct device *dev, + + switch (resource_type(res)) { + case IORESOURCE_IO: +- err = pci_remap_iospace(res, iobase); ++ err = devm_pci_remap_iospace(dev, res, iobase); + if (err) { + dev_warn(dev, "error %d: failed to map resource %pR\n", + err, res); +diff --git a/drivers/pci/host/pcie-rcar.c b/drivers/pci/host/pcie-rcar.c +index 62700d1896f4..d6196f7b1d58 100644 +--- a/drivers/pci/host/pcie-rcar.c ++++ b/drivers/pci/host/pcie-rcar.c +@@ -1102,7 +1102,7 @@ static int rcar_pcie_parse_request_of_pci_ranges(struct rcar_pcie *pci) + struct resource *res = win->res; + + if (resource_type(res) == IORESOURCE_IO) { +- err = pci_remap_iospace(res, iobase); ++ err = devm_pci_remap_iospace(dev, res, iobase); + if (err) { + dev_warn(dev, "error %d: failed to map resource %pR\n", + err, res); +diff --git a/drivers/pci/host/pcie-xilinx-nwl.c b/drivers/pci/host/pcie-xilinx-nwl.c +index 43eaa4afab94..94fdd295aae2 100644 +--- a/drivers/pci/host/pcie-xilinx-nwl.c ++++ b/drivers/pci/host/pcie-xilinx-nwl.c +@@ -532,7 +532,7 @@ static int nwl_pcie_init_irq_domain(struct nwl_pcie *pcie) + INTX_NUM, + &legacy_domain_ops, + pcie); +- ++ of_node_put(legacy_intc_node); + if (!pcie->legacy_irq_domain) { + dev_err(dev, "failed to create IRQ domain\n"); + return -ENOMEM; +diff --git a/drivers/pci/host/pcie-xilinx.c b/drivers/pci/host/pcie-xilinx.c +index c8616fadccf1..61332f4d51c3 100644 +--- a/drivers/pci/host/pcie-xilinx.c ++++ b/drivers/pci/host/pcie-xilinx.c +@@ -527,6 +527,7 @@ static int xilinx_pcie_init_irq_domain(struct xilinx_pcie_port *port) + port->leg_domain = irq_domain_add_linear(pcie_intc_node, 4, + &intx_domain_ops, + port); ++ of_node_put(pcie_intc_node); + if (!port->leg_domain) { + dev_err(dev, "Failed to get a INTx IRQ domain\n"); + return -ENODEV; +diff --git a/drivers/pci/hotplug/pci_hotplug_core.c b/drivers/pci/hotplug/pci_hotplug_core.c +index fea0b8b33589..0a3b3f72c94b 100644 +--- a/drivers/pci/hotplug/pci_hotplug_core.c ++++ b/drivers/pci/hotplug/pci_hotplug_core.c +@@ -455,8 +455,17 @@ int __pci_hp_register(struct hotplug_slot *slot, struct pci_bus *bus, + list_add(&slot->slot_list, &pci_hotplug_slot_list); + + result = fs_add_slot(pci_slot); ++ if (result) ++ goto err_list_del; ++ + kobject_uevent(&pci_slot->kobj, KOBJ_ADD); + dbg("Added slot %s to the list\n", name); ++ goto out; ++ ++err_list_del: ++ list_del(&slot->slot_list); ++ pci_slot->hotplug = NULL; ++ pci_destroy_slot(pci_slot); + out: + mutex_unlock(&pci_hp_mutex); + return result; +diff --git a/drivers/pci/hotplug/pciehp.h b/drivers/pci/hotplug/pciehp.h +index 2bba8481beb1..56c0b60df25e 100644 +--- a/drivers/pci/hotplug/pciehp.h ++++ b/drivers/pci/hotplug/pciehp.h +@@ -132,6 +132,7 @@ int pciehp_unconfigure_device(struct slot *p_slot); + void pciehp_queue_pushbutton_work(struct work_struct *work); + struct controller *pcie_init(struct pcie_device *dev); + int pcie_init_notification(struct controller *ctrl); ++void pcie_shutdown_notification(struct controller *ctrl); + int pciehp_enable_slot(struct slot *p_slot); + int pciehp_disable_slot(struct slot *p_slot); + void pcie_reenable_notification(struct controller *ctrl); +diff --git a/drivers/pci/hotplug/pciehp_core.c b/drivers/pci/hotplug/pciehp_core.c +index 6620b1095046..a7485bc1e975 100644 +--- a/drivers/pci/hotplug/pciehp_core.c ++++ b/drivers/pci/hotplug/pciehp_core.c +@@ -76,6 +76,12 @@ static int reset_slot(struct hotplug_slot *slot, int probe); + */ + static void release_slot(struct hotplug_slot *hotplug_slot) + { ++ struct slot *slot = hotplug_slot->private; ++ ++ /* queued work needs hotplug_slot name */ ++ cancel_delayed_work(&slot->work); ++ drain_workqueue(slot->wq); ++ + kfree(hotplug_slot->ops); + kfree(hotplug_slot->info); + kfree(hotplug_slot); +@@ -278,6 +284,7 @@ static void pciehp_remove(struct pcie_device *dev) + { + struct controller *ctrl = get_service_data(dev); + ++ pcie_shutdown_notification(ctrl); + cleanup_slot(ctrl); + pciehp_release_ctrl(ctrl); + } +diff --git a/drivers/pci/hotplug/pciehp_hpc.c b/drivers/pci/hotplug/pciehp_hpc.c +index 8d811ea353c8..8b8b096167d7 100644 +--- a/drivers/pci/hotplug/pciehp_hpc.c ++++ b/drivers/pci/hotplug/pciehp_hpc.c +@@ -562,8 +562,6 @@ static irqreturn_t pciehp_isr(int irq, void *dev_id) + { + struct controller *ctrl = (struct controller *)dev_id; + struct pci_dev *pdev = ctrl_dev(ctrl); +- struct pci_bus *subordinate = pdev->subordinate; +- struct pci_dev *dev; + struct slot *slot = ctrl->slot; + u16 status, events; + u8 present; +@@ -611,14 +609,9 @@ static irqreturn_t pciehp_isr(int irq, void *dev_id) + wake_up(&ctrl->queue); + } + +- if (subordinate) { +- list_for_each_entry(dev, &subordinate->devices, bus_list) { +- if (dev->ignore_hotplug) { +- ctrl_dbg(ctrl, "ignoring hotplug event %#06x (%s requested no hotplug)\n", +- events, pci_name(dev)); +- return IRQ_HANDLED; +- } +- } ++ if (pdev->ignore_hotplug) { ++ ctrl_dbg(ctrl, "ignoring hotplug event %#06x\n", events); ++ return IRQ_HANDLED; + } + + /* Check Attention Button Pressed */ +@@ -786,7 +779,7 @@ int pcie_init_notification(struct controller *ctrl) + return 0; + } + +-static void pcie_shutdown_notification(struct controller *ctrl) ++void pcie_shutdown_notification(struct controller *ctrl) + { + if (ctrl->notification_enabled) { + pcie_disable_notification(ctrl); +@@ -821,7 +814,7 @@ abort: + static void pcie_cleanup_slot(struct controller *ctrl) + { + struct slot *slot = ctrl->slot; +- cancel_delayed_work(&slot->work); ++ + destroy_workqueue(slot->wq); + kfree(slot); + } +@@ -902,7 +895,6 @@ abort: + + void pciehp_release_ctrl(struct controller *ctrl) + { +- pcie_shutdown_notification(ctrl); + pcie_cleanup_slot(ctrl); + kfree(ctrl); + } +diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c +index 9c13aeeeb973..6b3c5c4cbb37 100644 +--- a/drivers/pci/pci.c ++++ b/drivers/pci/pci.c +@@ -3407,6 +3407,44 @@ void pci_unmap_iospace(struct resource *res) + #endif + } + ++static void devm_pci_unmap_iospace(struct device *dev, void *ptr) ++{ ++ struct resource **res = ptr; ++ ++ pci_unmap_iospace(*res); ++} ++ ++/** ++ * devm_pci_remap_iospace - Managed pci_remap_iospace() ++ * @dev: Generic device to remap IO address for ++ * @res: Resource describing the I/O space ++ * @phys_addr: physical address of range to be mapped ++ * ++ * Managed pci_remap_iospace(). Map is automatically unmapped on driver ++ * detach. ++ */ ++int devm_pci_remap_iospace(struct device *dev, const struct resource *res, ++ phys_addr_t phys_addr) ++{ ++ const struct resource **ptr; ++ int error; ++ ++ ptr = devres_alloc(devm_pci_unmap_iospace, sizeof(*ptr), GFP_KERNEL); ++ if (!ptr) ++ return -ENOMEM; ++ ++ error = pci_remap_iospace(res, phys_addr); ++ if (error) { ++ devres_free(ptr); ++ } else { ++ *ptr = res; ++ devres_add(dev, ptr); ++ } ++ ++ return error; ++} ++EXPORT_SYMBOL(devm_pci_remap_iospace); ++ + static void __pci_set_master(struct pci_dev *dev, bool enable) + { + u16 old_cmd, cmd; +diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c +index 56340abe4fc6..16611cf3aba4 100644 +--- a/drivers/pci/probe.c ++++ b/drivers/pci/probe.c +@@ -1363,6 +1363,10 @@ static void pci_configure_mps(struct pci_dev *dev) + if (!pci_is_pcie(dev) || !bridge || !pci_is_pcie(bridge)) + return; + ++ /* MPS and MRRS fields are of type 'RsvdP' for VFs, short-circuit out */ ++ if (dev->is_virtfn) ++ return; ++ + mps = pcie_get_mps(dev); + p_mps = pcie_get_mps(bridge); + +diff --git a/drivers/pinctrl/bcm/pinctrl-nsp-mux.c b/drivers/pinctrl/bcm/pinctrl-nsp-mux.c +index 35c17653c694..87618a4e90e4 100644 +--- a/drivers/pinctrl/bcm/pinctrl-nsp-mux.c ++++ b/drivers/pinctrl/bcm/pinctrl-nsp-mux.c +@@ -460,8 +460,8 @@ static int nsp_pinmux_enable(struct pinctrl_dev *pctrl_dev, + const struct nsp_pin_function *func; + const struct nsp_pin_group *grp; + +- if (grp_select > pinctrl->num_groups || +- func_select > pinctrl->num_functions) ++ if (grp_select >= pinctrl->num_groups || ++ func_select >= pinctrl->num_functions) + return -EINVAL; + + func = &pinctrl->functions[func_select]; +@@ -577,6 +577,8 @@ static int nsp_pinmux_probe(struct platform_device *pdev) + return PTR_ERR(pinctrl->base0); + + res = platform_get_resource(pdev, IORESOURCE_MEM, 1); ++ if (!res) ++ return -EINVAL; + pinctrl->base1 = devm_ioremap_nocache(&pdev->dev, res->start, + resource_size(res)); + if (!pinctrl->base1) { +diff --git a/drivers/scsi/xen-scsifront.c b/drivers/scsi/xen-scsifront.c +index 9dc8687bf048..e1b32ed0aa20 100644 +--- a/drivers/scsi/xen-scsifront.c ++++ b/drivers/scsi/xen-scsifront.c +@@ -676,10 +676,17 @@ static int scsifront_dev_reset_handler(struct scsi_cmnd *sc) + static int scsifront_sdev_configure(struct scsi_device *sdev) + { + struct vscsifrnt_info *info = shost_priv(sdev->host); ++ int err; + +- if (info && current == info->curr) +- xenbus_printf(XBT_NIL, info->dev->nodename, ++ if (info && current == info->curr) { ++ err = xenbus_printf(XBT_NIL, info->dev->nodename, + info->dev_state_path, "%d", XenbusStateConnected); ++ if (err) { ++ xenbus_dev_error(info->dev, err, ++ "%s: writing dev_state_path", __func__); ++ return err; ++ } ++ } + + return 0; + } +@@ -687,10 +694,15 @@ static int scsifront_sdev_configure(struct scsi_device *sdev) + static void scsifront_sdev_destroy(struct scsi_device *sdev) + { + struct vscsifrnt_info *info = shost_priv(sdev->host); ++ int err; + +- if (info && current == info->curr) +- xenbus_printf(XBT_NIL, info->dev->nodename, ++ if (info && current == info->curr) { ++ err = xenbus_printf(XBT_NIL, info->dev->nodename, + info->dev_state_path, "%d", XenbusStateClosed); ++ if (err) ++ xenbus_dev_error(info->dev, err, ++ "%s: writing dev_state_path", __func__); ++ } + } + + static struct scsi_host_template scsifront_sht = { +@@ -1025,9 +1037,12 @@ static void scsifront_do_lun_hotplug(struct vscsifrnt_info *info, int op) + + if (scsi_add_device(info->host, chn, tgt, lun)) { + dev_err(&dev->dev, "scsi_add_device\n"); +- xenbus_printf(XBT_NIL, dev->nodename, ++ err = xenbus_printf(XBT_NIL, dev->nodename, + info->dev_state_path, + "%d", XenbusStateClosed); ++ if (err) ++ xenbus_dev_error(dev, err, ++ "%s: writing dev_state_path", __func__); + } + break; + case VSCSIFRONT_OP_DEL_LUN: +@@ -1041,10 +1056,14 @@ static void scsifront_do_lun_hotplug(struct vscsifrnt_info *info, int op) + } + break; + case VSCSIFRONT_OP_READD_LUN: +- if (device_state == XenbusStateConnected) +- xenbus_printf(XBT_NIL, dev->nodename, ++ if (device_state == XenbusStateConnected) { ++ err = xenbus_printf(XBT_NIL, dev->nodename, + info->dev_state_path, + "%d", XenbusStateConnected); ++ if (err) ++ xenbus_dev_error(dev, err, ++ "%s: writing dev_state_path", __func__); ++ } + break; + default: + break; +diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c +index 09921ef07ac5..3ae27b6ed07c 100644 +--- a/drivers/usb/dwc2/gadget.c ++++ b/drivers/usb/dwc2/gadget.c +@@ -3948,9 +3948,11 @@ int dwc2_gadget_init(struct dwc2_hsotg *hsotg, int irq) + } + + ret = usb_add_gadget_udc(dev, &hsotg->gadget); +- if (ret) ++ if (ret) { ++ dwc2_hsotg_ep_free_request(&hsotg->eps_out[0]->ep, ++ hsotg->ctrl_req); + return ret; +- ++ } + dwc2_hsotg_dump(hsotg); + + return 0; +@@ -3963,6 +3965,7 @@ int dwc2_gadget_init(struct dwc2_hsotg *hsotg, int irq) + int dwc2_hsotg_remove(struct dwc2_hsotg *hsotg) + { + usb_del_gadget_udc(&hsotg->gadget); ++ dwc2_hsotg_ep_free_request(&hsotg->eps_out[0]->ep, hsotg->ctrl_req); + + return 0; + } +diff --git a/drivers/usb/dwc2/hcd_intr.c b/drivers/usb/dwc2/hcd_intr.c +index 906f223542ee..8066fa9ac97b 100644 +--- a/drivers/usb/dwc2/hcd_intr.c ++++ b/drivers/usb/dwc2/hcd_intr.c +@@ -922,9 +922,8 @@ static int dwc2_xfercomp_isoc_split_in(struct dwc2_hsotg *hsotg, + frame_desc = &qtd->urb->iso_descs[qtd->isoc_frame_index]; + len = dwc2_get_actual_xfer_length(hsotg, chan, chnum, qtd, + DWC2_HC_XFER_COMPLETE, NULL); +- if (!len) { ++ if (!len && !qtd->isoc_split_offset) { + qtd->complete_split = 0; +- qtd->isoc_split_offset = 0; + return 0; + } + +diff --git a/drivers/usb/dwc3/dwc3-of-simple.c b/drivers/usb/dwc3/dwc3-of-simple.c +index a3e2200f5b5f..58526932d2b6 100644 +--- a/drivers/usb/dwc3/dwc3-of-simple.c ++++ b/drivers/usb/dwc3/dwc3-of-simple.c +@@ -132,8 +132,9 @@ static int dwc3_of_simple_remove(struct platform_device *pdev) + + of_platform_depopulate(dev); + +- pm_runtime_put_sync(dev); + pm_runtime_disable(dev); ++ pm_runtime_put_noidle(dev); ++ pm_runtime_set_suspended(dev); + + return 0; + } +diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c +index ca97f5b36e1b..2c022a08f163 100644 +--- a/drivers/usb/gadget/composite.c ++++ b/drivers/usb/gadget/composite.c +@@ -1712,6 +1712,8 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl) + */ + if (w_value && !f->get_alt) + break; ++ ++ spin_lock(&cdev->lock); + value = f->set_alt(f, w_index, w_value); + if (value == USB_GADGET_DELAYED_STATUS) { + DBG(cdev, +@@ -1721,6 +1723,7 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl) + DBG(cdev, "delayed_status count %d\n", + cdev->delayed_status); + } ++ spin_unlock(&cdev->lock); + break; + case USB_REQ_GET_INTERFACE: + if (ctrl->bRequestType != (USB_DIR_IN|USB_RECIP_INTERFACE)) +diff --git a/drivers/usb/host/xhci-tegra.c b/drivers/usb/host/xhci-tegra.c +index a59fafb4b329..97d57a94776a 100644 +--- a/drivers/usb/host/xhci-tegra.c ++++ b/drivers/usb/host/xhci-tegra.c +@@ -482,7 +482,7 @@ static void tegra_xusb_mbox_handle(struct tegra_xusb *tegra, + unsigned long mask; + unsigned int port; + bool idle, enable; +- int err; ++ int err = 0; + + memset(&rsp, 0, sizeof(rsp)); + +diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c +index 81f25213cb41..c190fabd1875 100644 +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -1056,8 +1056,13 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated) + command = readl(&xhci->op_regs->command); + command |= CMD_CRS; + writel(command, &xhci->op_regs->command); ++ /* ++ * Some controllers take up to 55+ ms to complete the controller ++ * restore so setting the timeout to 100ms. Xhci specification ++ * doesn't mention any timeout value. ++ */ + if (xhci_handshake(&xhci->op_regs->status, +- STS_RESTORE, 0, 10 * 1000)) { ++ STS_RESTORE, 0, 100 * 1000)) { + xhci_warn(xhci, "WARN: xHC restore state timeout\n"); + spin_unlock_irq(&xhci->lock); + return -ETIMEDOUT; +diff --git a/drivers/xen/manage.c b/drivers/xen/manage.c +index 9122ba25bb00..7abaaa5f0f67 100644 +--- a/drivers/xen/manage.c ++++ b/drivers/xen/manage.c +@@ -291,8 +291,15 @@ static void sysrq_handler(struct xenbus_watch *watch, const char **vec, + return; + } + +- if (sysrq_key != '\0') +- xenbus_printf(xbt, "control", "sysrq", "%c", '\0'); ++ if (sysrq_key != '\0') { ++ err = xenbus_printf(xbt, "control", "sysrq", "%c", '\0'); ++ if (err) { ++ pr_err("%s: Error %d writing sysrq in control/sysrq\n", ++ __func__, err); ++ xenbus_transaction_end(xbt, 1); ++ return; ++ } ++ } + + err = xenbus_transaction_end(xbt, 0); + if (err == -EAGAIN) +@@ -344,7 +351,12 @@ static int setup_shutdown_watcher(void) + continue; + snprintf(node, FEATURE_PATH_SIZE, "feature-%s", + shutdown_handlers[idx].command); +- xenbus_printf(XBT_NIL, "control", node, "%u", 1); ++ err = xenbus_printf(XBT_NIL, "control", node, "%u", 1); ++ if (err) { ++ pr_err("%s: Error %d writing %s\n", __func__, ++ err, node); ++ return err; ++ } + } + + return 0; +diff --git a/drivers/xen/xen-scsiback.c b/drivers/xen/xen-scsiback.c +index 980f32817305..992cb8fa272c 100644 +--- a/drivers/xen/xen-scsiback.c ++++ b/drivers/xen/xen-scsiback.c +@@ -1014,6 +1014,7 @@ static void scsiback_do_add_lun(struct vscsibk_info *info, const char *state, + { + struct v2p_entry *entry; + unsigned long flags; ++ int err; + + if (try) { + spin_lock_irqsave(&info->v2p_lock, flags); +@@ -1029,8 +1030,11 @@ static void scsiback_do_add_lun(struct vscsibk_info *info, const char *state, + scsiback_del_translation_entry(info, vir); + } + } else if (!try) { +- xenbus_printf(XBT_NIL, info->dev->nodename, state, ++ err = xenbus_printf(XBT_NIL, info->dev->nodename, state, + "%d", XenbusStateClosed); ++ if (err) ++ xenbus_dev_error(info->dev, err, ++ "%s: writing %s", __func__, state); + } + } + +@@ -1069,8 +1073,11 @@ static void scsiback_do_1lun_hotplug(struct vscsibk_info *info, int op, + snprintf(str, sizeof(str), "vscsi-devs/%s/p-dev", ent); + val = xenbus_read(XBT_NIL, dev->nodename, str, NULL); + if (IS_ERR(val)) { +- xenbus_printf(XBT_NIL, dev->nodename, state, ++ err = xenbus_printf(XBT_NIL, dev->nodename, state, + "%d", XenbusStateClosed); ++ if (err) ++ xenbus_dev_error(info->dev, err, ++ "%s: writing %s", __func__, state); + return; + } + strlcpy(phy, val, VSCSI_NAMELEN); +@@ -1081,8 +1088,11 @@ static void scsiback_do_1lun_hotplug(struct vscsibk_info *info, int op, + err = xenbus_scanf(XBT_NIL, dev->nodename, str, "%u:%u:%u:%u", + &vir.hst, &vir.chn, &vir.tgt, &vir.lun); + if (XENBUS_EXIST_ERR(err)) { +- xenbus_printf(XBT_NIL, dev->nodename, state, ++ err = xenbus_printf(XBT_NIL, dev->nodename, state, + "%d", XenbusStateClosed); ++ if (err) ++ xenbus_dev_error(info->dev, err, ++ "%s: writing %s", __func__, state); + return; + } + +diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c +index 4a6df2ce0f76..1f754336f801 100644 +--- a/fs/ceph/inode.c ++++ b/fs/ceph/inode.c +@@ -1077,6 +1077,7 @@ static struct dentry *splice_dentry(struct dentry *dn, struct inode *in) + if (IS_ERR(realdn)) { + pr_err("splice_dentry error %ld %p inode %p ino %llx.%llx\n", + PTR_ERR(realdn), dn, in, ceph_vinop(in)); ++ dput(dn); + dn = realdn; /* note realdn contains the error */ + goto out; + } else if (realdn) { +diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c +index 53e1890660a2..a49d0e5d7baf 100644 +--- a/fs/ext4/mballoc.c ++++ b/fs/ext4/mballoc.c +@@ -26,6 +26,7 @@ + #include <linux/log2.h> + #include <linux/module.h> + #include <linux/slab.h> ++#include <linux/nospec.h> + #include <linux/backing-dev.h> + #include <trace/events/ext4.h> + +@@ -2144,7 +2145,8 @@ ext4_mb_regular_allocator(struct ext4_allocation_context *ac) + * This should tell if fe_len is exactly power of 2 + */ + if ((ac->ac_g_ex.fe_len & (~(1 << (i - 1)))) == 0) +- ac->ac_2order = i - 1; ++ ac->ac_2order = array_index_nospec(i - 1, ++ sb->s_blocksize_bits + 2); + } + + /* if stream allocation is enabled, use global goal */ +diff --git a/fs/reiserfs/xattr.c b/fs/reiserfs/xattr.c +index e87aa21c30de..06a9fae202a7 100644 +--- a/fs/reiserfs/xattr.c ++++ b/fs/reiserfs/xattr.c +@@ -791,8 +791,10 @@ static int listxattr_filler(struct dir_context *ctx, const char *name, + return 0; + size = namelen + 1; + if (b->buf) { +- if (size > b->size) ++ if (b->pos + size > b->size) { ++ b->pos = -ERANGE; + return -ERANGE; ++ } + memcpy(b->buf + b->pos, name, namelen); + b->buf[b->pos + namelen] = 0; + } +diff --git a/include/linux/fsl/guts.h b/include/linux/fsl/guts.h +index 649e9171a9b3..270eef7d2267 100644 +--- a/include/linux/fsl/guts.h ++++ b/include/linux/fsl/guts.h +@@ -16,6 +16,7 @@ + #define __FSL_GUTS_H__ + + #include <linux/types.h> ++#include <linux/io.h> + + /** + * Global Utility Registers. +diff --git a/include/linux/pci.h b/include/linux/pci.h +index 36522905685b..78c9f4a91d94 100644 +--- a/include/linux/pci.h ++++ b/include/linux/pci.h +@@ -1190,6 +1190,8 @@ int pci_register_io_range(phys_addr_t addr, resource_size_t size); + unsigned long pci_address_to_pio(phys_addr_t addr); + phys_addr_t pci_pio_to_address(unsigned long pio); + int pci_remap_iospace(const struct resource *res, phys_addr_t phys_addr); ++int devm_pci_remap_iospace(struct device *dev, const struct resource *res, ++ phys_addr_t phys_addr); + void pci_unmap_iospace(struct resource *res); + + static inline pci_bus_addr_t pci_bus_address(struct pci_dev *pdev, int bar) +diff --git a/include/net/ipv6.h b/include/net/ipv6.h +index 407087d686a7..64b0e9df31c7 100644 +--- a/include/net/ipv6.h ++++ b/include/net/ipv6.h +@@ -312,14 +312,7 @@ struct ipv6_txoptions *ipv6_dup_options(struct sock *sk, + struct ipv6_txoptions *ipv6_renew_options(struct sock *sk, + struct ipv6_txoptions *opt, + int newtype, +- struct ipv6_opt_hdr __user *newopt, +- int newoptlen); +-struct ipv6_txoptions * +-ipv6_renew_options_kern(struct sock *sk, +- struct ipv6_txoptions *opt, +- int newtype, +- struct ipv6_opt_hdr *newopt, +- int newoptlen); ++ struct ipv6_opt_hdr *newopt); + struct ipv6_txoptions *ipv6_fixup_options(struct ipv6_txoptions *opt_space, + struct ipv6_txoptions *opt); + +diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h +index 23102da24dd9..c05db6ff2515 100644 +--- a/include/net/net_namespace.h ++++ b/include/net/net_namespace.h +@@ -116,6 +116,7 @@ struct net { + #endif + #if IS_ENABLED(CONFIG_NF_DEFRAG_IPV6) + struct netns_nf_frag nf_frag; ++ struct ctl_table_header *nf_frag_frags_hdr; + #endif + struct sock *nfnl; + struct sock *nfnl_stash; +diff --git a/include/net/netns/ipv6.h b/include/net/netns/ipv6.h +index 10d0848f5b8a..5cae575db07b 100644 +--- a/include/net/netns/ipv6.h ++++ b/include/net/netns/ipv6.h +@@ -89,7 +89,6 @@ struct netns_ipv6 { + + #if IS_ENABLED(CONFIG_NF_DEFRAG_IPV6) + struct netns_nf_frag { +- struct netns_sysctl_ipv6 sysctl; + struct netns_frags frags; + }; + #endif +diff --git a/include/net/tc_act/tc_tunnel_key.h b/include/net/tc_act/tc_tunnel_key.h +index 253f8da6c2a6..2dcd80d62206 100644 +--- a/include/net/tc_act/tc_tunnel_key.h ++++ b/include/net/tc_act/tc_tunnel_key.h +@@ -16,7 +16,6 @@ + struct tcf_tunnel_key_params { + struct rcu_head rcu; + int tcft_action; +- int action; + struct metadata_dst *tcft_enc_metadata; + }; + +diff --git a/include/net/tcp.h b/include/net/tcp.h +index 97d210535cdd..c3f4f6a9e6c3 100644 +--- a/include/net/tcp.h ++++ b/include/net/tcp.h +@@ -850,8 +850,6 @@ enum tcp_ca_event { + CA_EVENT_LOSS, /* loss timeout */ + CA_EVENT_ECN_NO_CE, /* ECT set, but not CE marked */ + CA_EVENT_ECN_IS_CE, /* received CE marked IP packet */ +- CA_EVENT_DELAYED_ACK, /* Delayed ack is sent */ +- CA_EVENT_NON_DELAYED_ACK, + }; + + /* Information about inbound ACK, passed to cong_ops->in_ack_event() */ +diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c +index 6599c7f3071d..61a15e538435 100644 +--- a/kernel/locking/lockdep.c ++++ b/kernel/locking/lockdep.c +@@ -1240,11 +1240,11 @@ unsigned long lockdep_count_forward_deps(struct lock_class *class) + this.parent = NULL; + this.class = class; + +- local_irq_save(flags); ++ raw_local_irq_save(flags); + arch_spin_lock(&lockdep_lock); + ret = __lockdep_count_forward_deps(&this); + arch_spin_unlock(&lockdep_lock); +- local_irq_restore(flags); ++ raw_local_irq_restore(flags); + + return ret; + } +@@ -1267,11 +1267,11 @@ unsigned long lockdep_count_backward_deps(struct lock_class *class) + this.parent = NULL; + this.class = class; + +- local_irq_save(flags); ++ raw_local_irq_save(flags); + arch_spin_lock(&lockdep_lock); + ret = __lockdep_count_backward_deps(&this); + arch_spin_unlock(&lockdep_lock); +- local_irq_restore(flags); ++ raw_local_irq_restore(flags); + + return ret; + } +@@ -4273,7 +4273,7 @@ void debug_check_no_locks_freed(const void *mem_from, unsigned long mem_len) + if (unlikely(!debug_locks)) + return; + +- local_irq_save(flags); ++ raw_local_irq_save(flags); + for (i = 0; i < curr->lockdep_depth; i++) { + hlock = curr->held_locks + i; + +@@ -4284,7 +4284,7 @@ void debug_check_no_locks_freed(const void *mem_from, unsigned long mem_len) + print_freed_lock_bug(curr, mem_from, mem_from + mem_len, hlock); + break; + } +- local_irq_restore(flags); ++ raw_local_irq_restore(flags); + } + EXPORT_SYMBOL_GPL(debug_check_no_locks_freed); + +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c +index 901c7f15f6e2..148c2210a2b8 100644 +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -2525,6 +2525,7 @@ out_nobuffer: + } + EXPORT_SYMBOL_GPL(trace_vbprintk); + ++__printf(3, 0) + static int + __trace_array_vprintk(struct ring_buffer *buffer, + unsigned long ip, const char *fmt, va_list args) +@@ -2579,12 +2580,14 @@ out_nobuffer: + return len; + } + ++__printf(3, 0) + int trace_array_vprintk(struct trace_array *tr, + unsigned long ip, const char *fmt, va_list args) + { + return __trace_array_vprintk(tr->trace_buffer.buffer, ip, fmt, args); + } + ++__printf(3, 0) + int trace_array_printk(struct trace_array *tr, + unsigned long ip, const char *fmt, ...) + { +@@ -2600,6 +2603,7 @@ int trace_array_printk(struct trace_array *tr, + return ret; + } + ++__printf(3, 4) + int trace_array_printk_buf(struct ring_buffer *buffer, + unsigned long ip, const char *fmt, ...) + { +@@ -2615,6 +2619,7 @@ int trace_array_printk_buf(struct ring_buffer *buffer, + return ret; + } + ++__printf(2, 0) + int trace_vprintk(unsigned long ip, const char *fmt, va_list args) + { + return trace_array_vprintk(&global_trace, ip, fmt, args); +diff --git a/mm/kasan/kasan.c b/mm/kasan/kasan.c +index 73c258129257..4ce386c44cf1 100644 +--- a/mm/kasan/kasan.c ++++ b/mm/kasan/kasan.c +@@ -660,12 +660,13 @@ void kasan_kfree_large(const void *ptr) + int kasan_module_alloc(void *addr, size_t size) + { + void *ret; ++ size_t scaled_size; + size_t shadow_size; + unsigned long shadow_start; + + shadow_start = (unsigned long)kasan_mem_to_shadow(addr); +- shadow_size = round_up(size >> KASAN_SHADOW_SCALE_SHIFT, +- PAGE_SIZE); ++ scaled_size = (size + KASAN_SHADOW_MASK) >> KASAN_SHADOW_SCALE_SHIFT; ++ shadow_size = round_up(scaled_size, PAGE_SIZE); + + if (WARN_ON(!PAGE_ALIGNED(shadow_start))) + return -EINVAL; +diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c +index 946f1c269b1f..1ae8c59fcb2d 100644 +--- a/net/batman-adv/bat_iv_ogm.c ++++ b/net/batman-adv/bat_iv_ogm.c +@@ -2704,7 +2704,7 @@ static int batadv_iv_gw_dump_entry(struct sk_buff *msg, u32 portid, u32 seq, + { + struct batadv_neigh_ifinfo *router_ifinfo = NULL; + struct batadv_neigh_node *router; +- struct batadv_gw_node *curr_gw; ++ struct batadv_gw_node *curr_gw = NULL; + int ret = 0; + void *hdr; + +@@ -2752,6 +2752,8 @@ static int batadv_iv_gw_dump_entry(struct sk_buff *msg, u32 portid, u32 seq, + ret = 0; + + out: ++ if (curr_gw) ++ batadv_gw_node_put(curr_gw); + if (router_ifinfo) + batadv_neigh_ifinfo_put(router_ifinfo); + if (router) +diff --git a/net/batman-adv/bat_v.c b/net/batman-adv/bat_v.c +index ed4ddf2059a6..4348118e7eac 100644 +--- a/net/batman-adv/bat_v.c ++++ b/net/batman-adv/bat_v.c +@@ -919,7 +919,7 @@ static int batadv_v_gw_dump_entry(struct sk_buff *msg, u32 portid, u32 seq, + { + struct batadv_neigh_ifinfo *router_ifinfo = NULL; + struct batadv_neigh_node *router; +- struct batadv_gw_node *curr_gw; ++ struct batadv_gw_node *curr_gw = NULL; + int ret = 0; + void *hdr; + +@@ -987,6 +987,8 @@ static int batadv_v_gw_dump_entry(struct sk_buff *msg, u32 portid, u32 seq, + ret = 0; + + out: ++ if (curr_gw) ++ batadv_gw_node_put(curr_gw); + if (router_ifinfo) + batadv_neigh_ifinfo_put(router_ifinfo); + if (router) +diff --git a/net/core/dev.c b/net/core/dev.c +index 5407d5f7b2d0..b85e789044d5 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -7945,7 +7945,8 @@ int dev_change_net_namespace(struct net_device *dev, struct net *net, const char + /* We get here if we can't use the current device name */ + if (!pat) + goto out; +- if (dev_get_valid_name(net, dev, pat) < 0) ++ err = dev_get_valid_name(net, dev, pat); ++ if (err < 0) + goto out; + } + +@@ -7957,7 +7958,6 @@ int dev_change_net_namespace(struct net_device *dev, struct net *net, const char + dev_close(dev); + + /* And unlink it from device chain */ +- err = -ENODEV; + unlist_netdevice(dev); + + synchronize_net(); +diff --git a/net/ieee802154/6lowpan/core.c b/net/ieee802154/6lowpan/core.c +index 83af5339e582..ba8bd24eb8b6 100644 +--- a/net/ieee802154/6lowpan/core.c ++++ b/net/ieee802154/6lowpan/core.c +@@ -90,12 +90,18 @@ static int lowpan_neigh_construct(struct net_device *dev, struct neighbour *n) + return 0; + } + ++static int lowpan_get_iflink(const struct net_device *dev) ++{ ++ return lowpan_802154_dev(dev)->wdev->ifindex; ++} ++ + static const struct net_device_ops lowpan_netdev_ops = { + .ndo_init = lowpan_dev_init, + .ndo_start_xmit = lowpan_xmit, + .ndo_open = lowpan_open, + .ndo_stop = lowpan_stop, + .ndo_neigh_construct = lowpan_neigh_construct, ++ .ndo_get_iflink = lowpan_get_iflink, + }; + + static void lowpan_setup(struct net_device *ldev) +diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c +index 06aa4948d0c0..4822459e8f42 100644 +--- a/net/ipv4/netfilter/ip_tables.c ++++ b/net/ipv4/netfilter/ip_tables.c +@@ -1913,6 +1913,7 @@ static struct xt_match ipt_builtin_mt[] __read_mostly = { + .checkentry = icmp_checkentry, + .proto = IPPROTO_ICMP, + .family = NFPROTO_IPV4, ++ .me = THIS_MODULE, + }, + }; + +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index 8f15eae3325b..9de77d946f5a 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -1696,7 +1696,7 @@ int tcp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int nonblock, + * shouldn't happen. + */ + if (WARN(before(*seq, TCP_SKB_CB(skb)->seq), +- "recvmsg bug: copied %X seq %X rcvnxt %X fl %X\n", ++ "TCP recvmsg seq # bug: copied %X, seq %X, rcvnxt %X, fl %X\n", + *seq, TCP_SKB_CB(skb)->seq, tp->rcv_nxt, + flags)) + break; +@@ -1711,7 +1711,7 @@ int tcp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int nonblock, + if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN) + goto found_fin_ok; + WARN(!(flags & MSG_PEEK), +- "recvmsg bug 2: copied %X seq %X rcvnxt %X fl %X\n", ++ "TCP recvmsg seq # bug 2: copied %X, seq %X, rcvnxt %X, fl %X\n", + *seq, TCP_SKB_CB(skb)->seq, tp->rcv_nxt, flags); + } + +diff --git a/net/ipv4/tcp_dctcp.c b/net/ipv4/tcp_dctcp.c +index 8905a0aec8ee..a08cedf9d286 100644 +--- a/net/ipv4/tcp_dctcp.c ++++ b/net/ipv4/tcp_dctcp.c +@@ -55,7 +55,6 @@ struct dctcp { + u32 dctcp_alpha; + u32 next_seq; + u32 ce_state; +- u32 delayed_ack_reserved; + u32 loss_cwnd; + }; + +@@ -96,7 +95,6 @@ static void dctcp_init(struct sock *sk) + + ca->dctcp_alpha = min(dctcp_alpha_on_init, DCTCP_MAX_ALPHA); + +- ca->delayed_ack_reserved = 0; + ca->loss_cwnd = 0; + ca->ce_state = 0; + +@@ -230,25 +228,6 @@ static void dctcp_state(struct sock *sk, u8 new_state) + } + } + +-static void dctcp_update_ack_reserved(struct sock *sk, enum tcp_ca_event ev) +-{ +- struct dctcp *ca = inet_csk_ca(sk); +- +- switch (ev) { +- case CA_EVENT_DELAYED_ACK: +- if (!ca->delayed_ack_reserved) +- ca->delayed_ack_reserved = 1; +- break; +- case CA_EVENT_NON_DELAYED_ACK: +- if (ca->delayed_ack_reserved) +- ca->delayed_ack_reserved = 0; +- break; +- default: +- /* Don't care for the rest. */ +- break; +- } +-} +- + static void dctcp_cwnd_event(struct sock *sk, enum tcp_ca_event ev) + { + switch (ev) { +@@ -258,10 +237,6 @@ static void dctcp_cwnd_event(struct sock *sk, enum tcp_ca_event ev) + case CA_EVENT_ECN_NO_CE: + dctcp_ce_state_1_to_0(sk); + break; +- case CA_EVENT_DELAYED_ACK: +- case CA_EVENT_NON_DELAYED_ACK: +- dctcp_update_ack_reserved(sk, ev); +- break; + default: + /* Don't care for the rest. */ + break; +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c +index 5f916953b28e..bd68f073570b 100644 +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -3444,8 +3444,6 @@ void tcp_send_delayed_ack(struct sock *sk) + int ato = icsk->icsk_ack.ato; + unsigned long timeout; + +- tcp_ca_event(sk, CA_EVENT_DELAYED_ACK); +- + if (ato > TCP_DELACK_MIN) { + const struct tcp_sock *tp = tcp_sk(sk); + int max_ato = HZ / 2; +@@ -3502,8 +3500,6 @@ void __tcp_send_ack(struct sock *sk, u32 rcv_nxt) + if (sk->sk_state == TCP_CLOSE) + return; + +- tcp_ca_event(sk, CA_EVENT_NON_DELAYED_ACK); +- + /* We are not putting this on the write queue, so + * tcp_transmit_skb() will set the ownership to this + * sock. +diff --git a/net/ipv6/calipso.c b/net/ipv6/calipso.c +index 8d772fea1dde..9742abf5ac26 100644 +--- a/net/ipv6/calipso.c ++++ b/net/ipv6/calipso.c +@@ -799,8 +799,7 @@ static int calipso_opt_update(struct sock *sk, struct ipv6_opt_hdr *hop) + { + struct ipv6_txoptions *old = txopt_get(inet6_sk(sk)), *txopts; + +- txopts = ipv6_renew_options_kern(sk, old, IPV6_HOPOPTS, +- hop, hop ? ipv6_optlen(hop) : 0); ++ txopts = ipv6_renew_options(sk, old, IPV6_HOPOPTS, hop); + txopt_put(old); + if (IS_ERR(txopts)) + return PTR_ERR(txopts); +@@ -1222,8 +1221,7 @@ static int calipso_req_setattr(struct request_sock *req, + if (IS_ERR(new)) + return PTR_ERR(new); + +- txopts = ipv6_renew_options_kern(sk, req_inet->ipv6_opt, IPV6_HOPOPTS, +- new, new ? ipv6_optlen(new) : 0); ++ txopts = ipv6_renew_options(sk, req_inet->ipv6_opt, IPV6_HOPOPTS, new); + + kfree(new); + +@@ -1260,8 +1258,7 @@ static void calipso_req_delattr(struct request_sock *req) + if (calipso_opt_del(req_inet->ipv6_opt->hopopt, &new)) + return; /* Nothing to do */ + +- txopts = ipv6_renew_options_kern(sk, req_inet->ipv6_opt, IPV6_HOPOPTS, +- new, new ? ipv6_optlen(new) : 0); ++ txopts = ipv6_renew_options(sk, req_inet->ipv6_opt, IPV6_HOPOPTS, new); + + if (!IS_ERR(txopts)) { + txopts = xchg(&req_inet->ipv6_opt, txopts); +diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c +index 139ceb68bd37..b909c772453f 100644 +--- a/net/ipv6/exthdrs.c ++++ b/net/ipv6/exthdrs.c +@@ -760,29 +760,21 @@ ipv6_dup_options(struct sock *sk, struct ipv6_txoptions *opt) + } + EXPORT_SYMBOL_GPL(ipv6_dup_options); + +-static int ipv6_renew_option(void *ohdr, +- struct ipv6_opt_hdr __user *newopt, int newoptlen, +- int inherit, +- struct ipv6_opt_hdr **hdr, +- char **p) ++static void ipv6_renew_option(int renewtype, ++ struct ipv6_opt_hdr **dest, ++ struct ipv6_opt_hdr *old, ++ struct ipv6_opt_hdr *new, ++ int newtype, char **p) + { +- if (inherit) { +- if (ohdr) { +- memcpy(*p, ohdr, ipv6_optlen((struct ipv6_opt_hdr *)ohdr)); +- *hdr = (struct ipv6_opt_hdr *)*p; +- *p += CMSG_ALIGN(ipv6_optlen(*hdr)); +- } +- } else { +- if (newopt) { +- if (copy_from_user(*p, newopt, newoptlen)) +- return -EFAULT; +- *hdr = (struct ipv6_opt_hdr *)*p; +- if (ipv6_optlen(*hdr) > newoptlen) +- return -EINVAL; +- *p += CMSG_ALIGN(newoptlen); +- } +- } +- return 0; ++ struct ipv6_opt_hdr *src; ++ ++ src = (renewtype == newtype ? new : old); ++ if (!src) ++ return; ++ ++ memcpy(*p, src, ipv6_optlen(src)); ++ *dest = (struct ipv6_opt_hdr *)*p; ++ *p += CMSG_ALIGN(ipv6_optlen(*dest)); + } + + /** +@@ -808,13 +800,11 @@ static int ipv6_renew_option(void *ohdr, + */ + struct ipv6_txoptions * + ipv6_renew_options(struct sock *sk, struct ipv6_txoptions *opt, +- int newtype, +- struct ipv6_opt_hdr __user *newopt, int newoptlen) ++ int newtype, struct ipv6_opt_hdr *newopt) + { + int tot_len = 0; + char *p; + struct ipv6_txoptions *opt2; +- int err; + + if (opt) { + if (newtype != IPV6_HOPOPTS && opt->hopopt) +@@ -827,8 +817,8 @@ ipv6_renew_options(struct sock *sk, struct ipv6_txoptions *opt, + tot_len += CMSG_ALIGN(ipv6_optlen(opt->dst1opt)); + } + +- if (newopt && newoptlen) +- tot_len += CMSG_ALIGN(newoptlen); ++ if (newopt) ++ tot_len += CMSG_ALIGN(ipv6_optlen(newopt)); + + if (!tot_len) + return NULL; +@@ -843,29 +833,19 @@ ipv6_renew_options(struct sock *sk, struct ipv6_txoptions *opt, + opt2->tot_len = tot_len; + p = (char *)(opt2 + 1); + +- err = ipv6_renew_option(opt ? opt->hopopt : NULL, newopt, newoptlen, +- newtype != IPV6_HOPOPTS, +- &opt2->hopopt, &p); +- if (err) +- goto out; +- +- err = ipv6_renew_option(opt ? opt->dst0opt : NULL, newopt, newoptlen, +- newtype != IPV6_RTHDRDSTOPTS, +- &opt2->dst0opt, &p); +- if (err) +- goto out; +- +- err = ipv6_renew_option(opt ? opt->srcrt : NULL, newopt, newoptlen, +- newtype != IPV6_RTHDR, +- (struct ipv6_opt_hdr **)&opt2->srcrt, &p); +- if (err) +- goto out; +- +- err = ipv6_renew_option(opt ? opt->dst1opt : NULL, newopt, newoptlen, +- newtype != IPV6_DSTOPTS, +- &opt2->dst1opt, &p); +- if (err) +- goto out; ++ ipv6_renew_option(IPV6_HOPOPTS, &opt2->hopopt, ++ (opt ? opt->hopopt : NULL), ++ newopt, newtype, &p); ++ ipv6_renew_option(IPV6_RTHDRDSTOPTS, &opt2->dst0opt, ++ (opt ? opt->dst0opt : NULL), ++ newopt, newtype, &p); ++ ipv6_renew_option(IPV6_RTHDR, ++ (struct ipv6_opt_hdr **)&opt2->srcrt, ++ (opt ? (struct ipv6_opt_hdr *)opt->srcrt : NULL), ++ newopt, newtype, &p); ++ ipv6_renew_option(IPV6_DSTOPTS, &opt2->dst1opt, ++ (opt ? opt->dst1opt : NULL), ++ newopt, newtype, &p); + + opt2->opt_nflen = (opt2->hopopt ? ipv6_optlen(opt2->hopopt) : 0) + + (opt2->dst0opt ? ipv6_optlen(opt2->dst0opt) : 0) + +@@ -873,37 +853,6 @@ ipv6_renew_options(struct sock *sk, struct ipv6_txoptions *opt, + opt2->opt_flen = (opt2->dst1opt ? ipv6_optlen(opt2->dst1opt) : 0); + + return opt2; +-out: +- sock_kfree_s(sk, opt2, opt2->tot_len); +- return ERR_PTR(err); +-} +- +-/** +- * ipv6_renew_options_kern - replace a specific ext hdr with a new one. +- * +- * @sk: sock from which to allocate memory +- * @opt: original options +- * @newtype: option type to replace in @opt +- * @newopt: new option of type @newtype to replace (kernel-mem) +- * @newoptlen: length of @newopt +- * +- * See ipv6_renew_options(). The difference is that @newopt is +- * kernel memory, rather than user memory. +- */ +-struct ipv6_txoptions * +-ipv6_renew_options_kern(struct sock *sk, struct ipv6_txoptions *opt, +- int newtype, struct ipv6_opt_hdr *newopt, +- int newoptlen) +-{ +- struct ipv6_txoptions *ret_val; +- const mm_segment_t old_fs = get_fs(); +- +- set_fs(KERNEL_DS); +- ret_val = ipv6_renew_options(sk, opt, newtype, +- (struct ipv6_opt_hdr __user *)newopt, +- newoptlen); +- set_fs(old_fs); +- return ret_val; + } + + struct ipv6_txoptions *ipv6_fixup_options(struct ipv6_txoptions *opt_space, +diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c +index c66b9a87e995..81fd35ed8732 100644 +--- a/net/ipv6/ipv6_sockglue.c ++++ b/net/ipv6/ipv6_sockglue.c +@@ -390,6 +390,12 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname, + case IPV6_DSTOPTS: + { + struct ipv6_txoptions *opt; ++ struct ipv6_opt_hdr *new = NULL; ++ ++ /* hop-by-hop / destination options are privileged option */ ++ retv = -EPERM; ++ if (optname != IPV6_RTHDR && !ns_capable(net->user_ns, CAP_NET_RAW)) ++ break; + + /* remove any sticky options header with a zero option + * length, per RFC3542. +@@ -401,17 +407,22 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname, + else if (optlen < sizeof(struct ipv6_opt_hdr) || + optlen & 0x7 || optlen > 8 * 255) + goto e_inval; +- +- /* hop-by-hop / destination options are privileged option */ +- retv = -EPERM; +- if (optname != IPV6_RTHDR && !ns_capable(net->user_ns, CAP_NET_RAW)) +- break; ++ else { ++ new = memdup_user(optval, optlen); ++ if (IS_ERR(new)) { ++ retv = PTR_ERR(new); ++ break; ++ } ++ if (unlikely(ipv6_optlen(new) > optlen)) { ++ kfree(new); ++ goto e_inval; ++ } ++ } + + opt = rcu_dereference_protected(np->opt, + lockdep_sock_is_held(sk)); +- opt = ipv6_renew_options(sk, opt, optname, +- (struct ipv6_opt_hdr __user *)optval, +- optlen); ++ opt = ipv6_renew_options(sk, opt, optname, new); ++ kfree(new); + if (IS_ERR(opt)) { + retv = PTR_ERR(opt); + break; +diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c +index 918c161e5b55..6c54c76847bf 100644 +--- a/net/ipv6/mcast.c ++++ b/net/ipv6/mcast.c +@@ -2084,7 +2084,8 @@ void ipv6_mc_dad_complete(struct inet6_dev *idev) + mld_send_initial_cr(idev); + idev->mc_dad_count--; + if (idev->mc_dad_count) +- mld_dad_start_timer(idev, idev->mc_maxdelay); ++ mld_dad_start_timer(idev, ++ unsolicited_report_interval(idev)); + } + } + +@@ -2096,7 +2097,8 @@ static void mld_dad_timer_expire(unsigned long data) + if (idev->mc_dad_count) { + idev->mc_dad_count--; + if (idev->mc_dad_count) +- mld_dad_start_timer(idev, idev->mc_maxdelay); ++ mld_dad_start_timer(idev, ++ unsolicited_report_interval(idev)); + } + in6_dev_put(idev); + } +@@ -2454,7 +2456,8 @@ static void mld_ifc_timer_expire(unsigned long data) + if (idev->mc_ifc_count) { + idev->mc_ifc_count--; + if (idev->mc_ifc_count) +- mld_ifc_start_timer(idev, idev->mc_maxdelay); ++ mld_ifc_start_timer(idev, ++ unsolicited_report_interval(idev)); + } + in6_dev_put(idev); + } +diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c +index 180f19526a80..21cad30e4546 100644 +--- a/net/ipv6/netfilter/ip6_tables.c ++++ b/net/ipv6/netfilter/ip6_tables.c +@@ -1934,6 +1934,7 @@ static struct xt_match ip6t_builtin_mt[] __read_mostly = { + .checkentry = icmp6_checkentry, + .proto = IPPROTO_ICMPV6, + .family = NFPROTO_IPV6, ++ .me = THIS_MODULE, + }, + }; + +diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c +index 722a9db8c6a7..ee33a6743f3b 100644 +--- a/net/ipv6/netfilter/nf_conntrack_reasm.c ++++ b/net/ipv6/netfilter/nf_conntrack_reasm.c +@@ -117,7 +117,7 @@ static int nf_ct_frag6_sysctl_register(struct net *net) + if (hdr == NULL) + goto err_reg; + +- net->nf_frag.sysctl.frags_hdr = hdr; ++ net->nf_frag_frags_hdr = hdr; + return 0; + + err_reg: +@@ -131,8 +131,8 @@ static void __net_exit nf_ct_frags6_sysctl_unregister(struct net *net) + { + struct ctl_table *table; + +- table = net->nf_frag.sysctl.frags_hdr->ctl_table_arg; +- unregister_net_sysctl_table(net->nf_frag.sysctl.frags_hdr); ++ table = net->nf_frag_frags_hdr->ctl_table_arg; ++ unregister_net_sysctl_table(net->nf_frag_frags_hdr); + if (!net_eq(net, &init_net)) + kfree(table); + } +diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c +index 2039fd7daf4e..db3586ba1211 100644 +--- a/net/netfilter/nf_conntrack_core.c ++++ b/net/netfilter/nf_conntrack_core.c +@@ -1822,7 +1822,7 @@ int nf_conntrack_set_hashsize(const char *val, struct kernel_param *kp) + return -EOPNOTSUPP; + + /* On boot, we can set this without any fancy locking. */ +- if (!nf_conntrack_htable_size) ++ if (!nf_conntrack_hash) + return param_set_uint(val, kp); + + rc = kstrtouint(val, 0, &hashsize); +diff --git a/net/netfilter/nf_conntrack_proto_dccp.c b/net/netfilter/nf_conntrack_proto_dccp.c +index a45bee52dccc..d5560ae8c4b3 100644 +--- a/net/netfilter/nf_conntrack_proto_dccp.c ++++ b/net/netfilter/nf_conntrack_proto_dccp.c +@@ -244,14 +244,14 @@ dccp_state_table[CT_DCCP_ROLE_MAX + 1][DCCP_PKT_SYNCACK + 1][CT_DCCP_MAX + 1] = + * We currently ignore Sync packets + * + * sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */ +- sIG, sIG, sIG, sIG, sIG, sIG, sIG, sIG, ++ sIV, sIG, sIG, sIG, sIG, sIG, sIG, sIG, + }, + [DCCP_PKT_SYNCACK] = { + /* + * We currently ignore SyncAck packets + * + * sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */ +- sIG, sIG, sIG, sIG, sIG, sIG, sIG, sIG, ++ sIV, sIG, sIG, sIG, sIG, sIG, sIG, sIG, + }, + }, + [CT_DCCP_ROLE_SERVER] = { +@@ -372,14 +372,14 @@ dccp_state_table[CT_DCCP_ROLE_MAX + 1][DCCP_PKT_SYNCACK + 1][CT_DCCP_MAX + 1] = + * We currently ignore Sync packets + * + * sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */ +- sIG, sIG, sIG, sIG, sIG, sIG, sIG, sIG, ++ sIV, sIG, sIG, sIG, sIG, sIG, sIG, sIG, + }, + [DCCP_PKT_SYNCACK] = { + /* + * We currently ignore SyncAck packets + * + * sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */ +- sIG, sIG, sIG, sIG, sIG, sIG, sIG, sIG, ++ sIV, sIG, sIG, sIG, sIG, sIG, sIG, sIG, + }, + }, + }; +diff --git a/net/netfilter/nf_log.c b/net/netfilter/nf_log.c +index e02fed784cd0..42938f9c467e 100644 +--- a/net/netfilter/nf_log.c ++++ b/net/netfilter/nf_log.c +@@ -426,6 +426,10 @@ static int nf_log_proc_dostring(struct ctl_table *table, int write, + if (write) { + struct ctl_table tmp = *table; + ++ /* proc_dostring() can append to existing strings, so we need to ++ * initialize it as an empty string. ++ */ ++ buf[0] = '\0'; + tmp.data = buf; + r = proc_dostring(&tmp, write, buffer, lenp, ppos); + if (r) +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index ea601f7ca2f8..24412e8f4061 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -2917,6 +2917,8 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len) + goto out_free; + } else if (reserve) { + skb_reserve(skb, -reserve); ++ if (len < reserve) ++ skb_reset_network_header(skb); + } + + /* Returns -EFAULT on error */ +@@ -4273,6 +4275,8 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, + } + + if (req->tp_block_nr) { ++ unsigned int min_frame_size; ++ + /* Sanity tests and some calculations */ + err = -EBUSY; + if (unlikely(rb->pg_vec)) +@@ -4295,12 +4299,12 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, + goto out; + if (unlikely(!PAGE_ALIGNED(req->tp_block_size))) + goto out; ++ min_frame_size = po->tp_hdrlen + po->tp_reserve; + if (po->tp_version >= TPACKET_V3 && +- req->tp_block_size <= +- BLK_PLUS_PRIV((u64)req_u->req3.tp_sizeof_priv) + sizeof(struct tpacket3_hdr)) ++ req->tp_block_size < ++ BLK_PLUS_PRIV((u64)req_u->req3.tp_sizeof_priv) + min_frame_size) + goto out; +- if (unlikely(req->tp_frame_size < po->tp_hdrlen + +- po->tp_reserve)) ++ if (unlikely(req->tp_frame_size < min_frame_size)) + goto out; + if (unlikely(req->tp_frame_size & (TPACKET_ALIGNMENT - 1))) + goto out; +diff --git a/net/qrtr/qrtr.c b/net/qrtr/qrtr.c +index ae5ac175b2be..7b670a9a375e 100644 +--- a/net/qrtr/qrtr.c ++++ b/net/qrtr/qrtr.c +@@ -621,6 +621,10 @@ static int qrtr_sendmsg(struct socket *sock, struct msghdr *msg, size_t len) + node = NULL; + if (addr->sq_node == QRTR_NODE_BCAST) { + enqueue_fn = qrtr_bcast_enqueue; ++ if (addr->sq_port != QRTR_PORT_CTRL) { ++ release_sock(sk); ++ return -ENOTCONN; ++ } + } else if (addr->sq_node == ipc->us.sq_node) { + enqueue_fn = qrtr_local_enqueue; + } else { +diff --git a/net/sched/act_tunnel_key.c b/net/sched/act_tunnel_key.c +index 901fb8bb9dce..41835f6e86bc 100644 +--- a/net/sched/act_tunnel_key.c ++++ b/net/sched/act_tunnel_key.c +@@ -39,7 +39,7 @@ static int tunnel_key_act(struct sk_buff *skb, const struct tc_action *a, + + tcf_lastuse_update(&t->tcf_tm); + bstats_cpu_update(this_cpu_ptr(t->common.cpu_bstats), skb); +- action = params->action; ++ action = READ_ONCE(t->tcf_action); + + switch (params->tcft_action) { + case TCA_TUNNEL_KEY_ACT_RELEASE: +@@ -170,7 +170,7 @@ static int tunnel_key_init(struct net *net, struct nlattr *nla, + + params_old = rtnl_dereference(t->params); + +- params_new->action = parm->action; ++ t->tcf_action = parm->action; + params_new->tcft_action = parm->t_action; + params_new->tcft_enc_metadata = metadata; + +@@ -242,13 +242,13 @@ static int tunnel_key_dump(struct sk_buff *skb, struct tc_action *a, + .index = t->tcf_index, + .refcnt = t->tcf_refcnt - ref, + .bindcnt = t->tcf_bindcnt - bind, ++ .action = t->tcf_action, + }; + struct tcf_t tm; + + params = rtnl_dereference(t->params); + + opt.t_action = params->tcft_action; +- opt.action = params->action; + + if (nla_put(skb, TCA_TUNNEL_KEY_PARMS, sizeof(opt), &opt)) + goto nla_put_failure; +diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c +index 36280e114959..5b75468b5acd 100644 +--- a/net/wireless/nl80211.c ++++ b/net/wireless/nl80211.c +@@ -5847,7 +5847,7 @@ do { \ + nl80211_check_s32); + /* + * Check HT operation mode based on +- * IEEE 802.11 2012 8.4.2.59 HT Operation element. ++ * IEEE 802.11-2016 9.4.2.57 HT Operation element. + */ + if (tb[NL80211_MESHCONF_HT_OPMODE]) { + ht_opmode = nla_get_u16(tb[NL80211_MESHCONF_HT_OPMODE]); +@@ -5857,22 +5857,9 @@ do { \ + IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT)) + return -EINVAL; + +- if ((ht_opmode & IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT) && +- (ht_opmode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT)) +- return -EINVAL; ++ /* NON_HT_STA bit is reserved, but some programs set it */ ++ ht_opmode &= ~IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT; + +- switch (ht_opmode & IEEE80211_HT_OP_MODE_PROTECTION) { +- case IEEE80211_HT_OP_MODE_PROTECTION_NONE: +- case IEEE80211_HT_OP_MODE_PROTECTION_20MHZ: +- if (ht_opmode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT) +- return -EINVAL; +- break; +- case IEEE80211_HT_OP_MODE_PROTECTION_NONMEMBER: +- case IEEE80211_HT_OP_MODE_PROTECTION_NONHT_MIXED: +- if (!(ht_opmode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT)) +- return -EINVAL; +- break; +- } + cfg->ht_opmode = ht_opmode; + mask |= (1 << (NL80211_MESHCONF_HT_OPMODE - 1)); + } +diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c +index 6a029358bfd1..bb61956c0f9c 100644 +--- a/net/xfrm/xfrm_user.c ++++ b/net/xfrm/xfrm_user.c +@@ -1628,9 +1628,11 @@ static inline size_t userpolicy_type_attrsize(void) + #ifdef CONFIG_XFRM_SUB_POLICY + static int copy_to_user_policy_type(u8 type, struct sk_buff *skb) + { +- struct xfrm_userpolicy_type upt = { +- .type = type, +- }; ++ struct xfrm_userpolicy_type upt; ++ ++ /* Sadly there are two holes in struct xfrm_userpolicy_type */ ++ memset(&upt, 0, sizeof(upt)); ++ upt.type = type; + + return nla_put(skb, XFRMA_POLICY_TYPE, sizeof(upt), &upt); + } +diff --git a/samples/bpf/parse_varlen.c b/samples/bpf/parse_varlen.c +index 95c16324760c..0b6f22feb2c9 100644 +--- a/samples/bpf/parse_varlen.c ++++ b/samples/bpf/parse_varlen.c +@@ -6,6 +6,7 @@ + */ + #define KBUILD_MODNAME "foo" + #include <linux/if_ether.h> ++#include <linux/if_vlan.h> + #include <linux/ip.h> + #include <linux/ipv6.h> + #include <linux/in.h> +@@ -108,11 +109,6 @@ static int parse_ipv6(void *data, uint64_t nh_off, void *data_end) + return 0; + } + +-struct vlan_hdr { +- uint16_t h_vlan_TCI; +- uint16_t h_vlan_encapsulated_proto; +-}; +- + SEC("varlen") + int handle_ingress(struct __sk_buff *skb) + { +diff --git a/samples/bpf/test_overhead_user.c b/samples/bpf/test_overhead_user.c +index d291167fd3c7..7dad9a3168e1 100644 +--- a/samples/bpf/test_overhead_user.c ++++ b/samples/bpf/test_overhead_user.c +@@ -6,6 +6,7 @@ + */ + #define _GNU_SOURCE + #include <sched.h> ++#include <errno.h> + #include <stdio.h> + #include <sys/types.h> + #include <asm/unistd.h> +@@ -44,8 +45,13 @@ static void test_task_rename(int cpu) + exit(1); + } + start_time = time_get_ns(); +- for (i = 0; i < MAX_CNT; i++) +- write(fd, buf, sizeof(buf)); ++ for (i = 0; i < MAX_CNT; i++) { ++ if (write(fd, buf, sizeof(buf)) < 0) { ++ printf("task rename failed: %s\n", strerror(errno)); ++ close(fd); ++ return; ++ } ++ } + printf("task_rename:%d: %lld events per sec\n", + cpu, MAX_CNT * 1000000000ll / (time_get_ns() - start_time)); + close(fd); +@@ -63,8 +69,13 @@ static void test_urandom_read(int cpu) + exit(1); + } + start_time = time_get_ns(); +- for (i = 0; i < MAX_CNT; i++) +- read(fd, buf, sizeof(buf)); ++ for (i = 0; i < MAX_CNT; i++) { ++ if (read(fd, buf, sizeof(buf)) < 0) { ++ printf("failed to read from /dev/urandom: %s\n", strerror(errno)); ++ close(fd); ++ return; ++ } ++ } + printf("urandom_read:%d: %lld events per sec\n", + cpu, MAX_CNT * 1000000000ll / (time_get_ns() - start_time)); + close(fd); +diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c +index a8a7fbc377f6..ca3ea985c100 100644 +--- a/security/smack/smack_lsm.c ++++ b/security/smack/smack_lsm.c +@@ -2307,6 +2307,7 @@ static void smack_task_to_inode(struct task_struct *p, struct inode *inode) + struct smack_known *skp = smk_of_task_struct(p); + + isp->smk_inode = skp; ++ isp->smk_flags |= SMK_INODE_INSTANT; + } + + /* +diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c +index ecd1c5fc8db8..965473d4129c 100644 +--- a/sound/core/seq/seq_clientmgr.c ++++ b/sound/core/seq/seq_clientmgr.c +@@ -2002,7 +2002,8 @@ static int snd_seq_ioctl_query_next_client(struct snd_seq_client *client, + struct snd_seq_client *cptr = NULL; + + /* search for next client */ +- info->client++; ++ if (info->client < INT_MAX) ++ info->client++; + if (info->client < 0) + info->client = 0; + for (; info->client < SNDRV_SEQ_MAX_CLIENTS; info->client++) { +diff --git a/tools/build/Makefile b/tools/build/Makefile +index 8332959fbca4..20d9ae11b6e1 100644 +--- a/tools/build/Makefile ++++ b/tools/build/Makefile +@@ -42,7 +42,7 @@ $(OUTPUT)fixdep-in.o: FORCE + $(Q)$(MAKE) $(build)=fixdep + + $(OUTPUT)fixdep: $(OUTPUT)fixdep-in.o +- $(QUIET_LINK)$(HOSTCC) $(LDFLAGS) -o $@ $< ++ $(QUIET_LINK)$(HOSTCC) $(HOSTLDFLAGS) -o $@ $< + + FORCE: + +diff --git a/tools/objtool/elf.c b/tools/objtool/elf.c +index 4e60e105583e..0d1acb704f64 100644 +--- a/tools/objtool/elf.c ++++ b/tools/objtool/elf.c +@@ -302,19 +302,34 @@ static int read_symbols(struct elf *elf) + continue; + sym->pfunc = sym->cfunc = sym; + coldstr = strstr(sym->name, ".cold."); +- if (coldstr) { +- coldstr[0] = '\0'; +- pfunc = find_symbol_by_name(elf, sym->name); +- coldstr[0] = '.'; +- +- if (!pfunc) { +- WARN("%s(): can't find parent function", +- sym->name); +- goto err; +- } +- +- sym->pfunc = pfunc; +- pfunc->cfunc = sym; ++ if (!coldstr) ++ continue; ++ ++ coldstr[0] = '\0'; ++ pfunc = find_symbol_by_name(elf, sym->name); ++ coldstr[0] = '.'; ++ ++ if (!pfunc) { ++ WARN("%s(): can't find parent function", ++ sym->name); ++ goto err; ++ } ++ ++ sym->pfunc = pfunc; ++ pfunc->cfunc = sym; ++ ++ /* ++ * Unfortunately, -fnoreorder-functions puts the child ++ * inside the parent. Remove the overlap so we can ++ * have sane assumptions. ++ * ++ * Note that pfunc->len now no longer matches ++ * pfunc->sym.st_size. ++ */ ++ if (sym->sec == pfunc->sec && ++ sym->offset >= pfunc->offset && ++ sym->offset + sym->len == pfunc->offset + pfunc->len) { ++ pfunc->len -= sym->len; + } + } + } +diff --git a/tools/perf/arch/powerpc/util/skip-callchain-idx.c b/tools/perf/arch/powerpc/util/skip-callchain-idx.c +index 0c370f81e002..bd630c222e65 100644 +--- a/tools/perf/arch/powerpc/util/skip-callchain-idx.c ++++ b/tools/perf/arch/powerpc/util/skip-callchain-idx.c +@@ -243,7 +243,7 @@ int arch_skip_callchain_idx(struct thread *thread, struct ip_callchain *chain) + u64 ip; + u64 skip_slot = -1; + +- if (chain->nr < 3) ++ if (!chain || chain->nr < 3) + return skip_slot; + + ip = chain->ips[2]; +diff --git a/tools/perf/bench/numa.c b/tools/perf/bench/numa.c +index 23cce5e5197a..ee9565a033f4 100644 +--- a/tools/perf/bench/numa.c ++++ b/tools/perf/bench/numa.c +@@ -1093,7 +1093,7 @@ static void *worker_thread(void *__tdata) + u8 *global_data; + u8 *process_data; + u8 *thread_data; +- u64 bytes_done; ++ u64 bytes_done, secs; + long work_done; + u32 l; + struct rusage rusage; +@@ -1249,7 +1249,8 @@ static void *worker_thread(void *__tdata) + timersub(&stop, &start0, &diff); + td->runtime_ns = diff.tv_sec * NSEC_PER_SEC; + td->runtime_ns += diff.tv_usec * NSEC_PER_USEC; +- td->speed_gbs = bytes_done / (td->runtime_ns / NSEC_PER_SEC) / 1e9; ++ secs = td->runtime_ns / NSEC_PER_SEC; ++ td->speed_gbs = secs ? bytes_done / secs / 1e9 : 0; + + getrusage(RUSAGE_THREAD, &rusage); + td->system_time_ns = rusage.ru_stime.tv_sec * NSEC_PER_SEC; +diff --git a/tools/perf/tests/topology.c b/tools/perf/tests/topology.c +index 98fe69ac553c..3e7cdefb0817 100644 +--- a/tools/perf/tests/topology.c ++++ b/tools/perf/tests/topology.c +@@ -42,6 +42,7 @@ static int session_write_header(char *path) + + perf_header__set_feat(&session->header, HEADER_CPU_TOPOLOGY); + perf_header__set_feat(&session->header, HEADER_NRCPUS); ++ perf_header__set_feat(&session->header, HEADER_ARCH); + + session->header.data_size += DATA_SIZE; + +diff --git a/tools/perf/util/llvm-utils.c b/tools/perf/util/llvm-utils.c +index bf7216b8731d..621f6527b790 100644 +--- a/tools/perf/util/llvm-utils.c ++++ b/tools/perf/util/llvm-utils.c +@@ -260,16 +260,16 @@ static const char *kinc_fetch_script = + "#!/usr/bin/env sh\n" + "if ! test -d \"$KBUILD_DIR\"\n" + "then\n" +-" exit -1\n" ++" exit 1\n" + "fi\n" + "if ! test -f \"$KBUILD_DIR/include/generated/autoconf.h\"\n" + "then\n" +-" exit -1\n" ++" exit 1\n" + "fi\n" + "TMPDIR=`mktemp -d`\n" + "if test -z \"$TMPDIR\"\n" + "then\n" +-" exit -1\n" ++" exit 1\n" + "fi\n" + "cat << EOF > $TMPDIR/Makefile\n" + "obj-y := dummy.o\n" +diff --git a/tools/testing/selftests/pstore/pstore_post_reboot_tests b/tools/testing/selftests/pstore/pstore_post_reboot_tests +index 6ccb154cb4aa..22f8df1ad7d4 100755 +--- a/tools/testing/selftests/pstore/pstore_post_reboot_tests ++++ b/tools/testing/selftests/pstore/pstore_post_reboot_tests +@@ -7,13 +7,16 @@ + # + # Released under the terms of the GPL v2. + ++# Kselftest framework requirement - SKIP code is 4. ++ksft_skip=4 ++ + . ./common_tests + + if [ -e $REBOOT_FLAG ]; then + rm $REBOOT_FLAG + else + prlog "pstore_crash_test has not been executed yet. we skip further tests." +- exit 0 ++ exit $ksft_skip + fi + + prlog -n "Mounting pstore filesystem ... " +diff --git a/tools/testing/selftests/static_keys/test_static_keys.sh b/tools/testing/selftests/static_keys/test_static_keys.sh +index 1261e3fa1e3a..5bba7796fb34 100755 +--- a/tools/testing/selftests/static_keys/test_static_keys.sh ++++ b/tools/testing/selftests/static_keys/test_static_keys.sh +@@ -1,6 +1,19 @@ + #!/bin/sh + # Runs static keys kernel module tests + ++# Kselftest framework requirement - SKIP code is 4. ++ksft_skip=4 ++ ++if ! /sbin/modprobe -q -n test_static_key_base; then ++ echo "static_key: module test_static_key_base is not found [SKIP]" ++ exit $ksft_skip ++fi ++ ++if ! /sbin/modprobe -q -n test_static_keys; then ++ echo "static_key: module test_static_keys is not found [SKIP]" ++ exit $ksft_skip ++fi ++ + if /sbin/modprobe -q test_static_key_base; then + if /sbin/modprobe -q test_static_keys; then + echo "static_key: ok" +diff --git a/tools/testing/selftests/sync/config b/tools/testing/selftests/sync/config +new file mode 100644 +index 000000000000..1ab7e8130db2 +--- /dev/null ++++ b/tools/testing/selftests/sync/config +@@ -0,0 +1,4 @@ ++CONFIG_STAGING=y ++CONFIG_ANDROID=y ++CONFIG_SYNC=y ++CONFIG_SW_SYNC=y +diff --git a/tools/testing/selftests/user/test_user_copy.sh b/tools/testing/selftests/user/test_user_copy.sh +index 350107f40c1d..0409270f998c 100755 +--- a/tools/testing/selftests/user/test_user_copy.sh ++++ b/tools/testing/selftests/user/test_user_copy.sh +@@ -1,6 +1,13 @@ + #!/bin/sh + # Runs copy_to/from_user infrastructure using test_user_copy kernel module + ++# Kselftest framework requirement - SKIP code is 4. ++ksft_skip=4 ++ ++if ! /sbin/modprobe -q -n test_user_copy; then ++ echo "user: module test_user_copy is not found [SKIP]" ++ exit $ksft_skip ++fi + if /sbin/modprobe -q test_user_copy; then + /sbin/modprobe -q -r test_user_copy + echo "user_copy: ok" +diff --git a/tools/testing/selftests/x86/sigreturn.c b/tools/testing/selftests/x86/sigreturn.c +index 246145b84a12..4d9dc3f2fd70 100644 +--- a/tools/testing/selftests/x86/sigreturn.c ++++ b/tools/testing/selftests/x86/sigreturn.c +@@ -610,21 +610,41 @@ static int test_valid_sigreturn(int cs_bits, bool use_16bit_ss, int force_ss) + */ + for (int i = 0; i < NGREG; i++) { + greg_t req = requested_regs[i], res = resulting_regs[i]; ++ + if (i == REG_TRAPNO || i == REG_IP) + continue; /* don't care */ +- if (i == REG_SP) { +- printf("\tSP: %llx -> %llx\n", (unsigned long long)req, +- (unsigned long long)res); + ++ if (i == REG_SP) { + /* +- * In many circumstances, the high 32 bits of rsp +- * are zeroed. For example, we could be a real +- * 32-bit program, or we could hit any of a number +- * of poorly-documented IRET or segmented ESP +- * oddities. If this happens, it's okay. ++ * If we were using a 16-bit stack segment, then ++ * the kernel is a bit stuck: IRET only restores ++ * the low 16 bits of ESP/RSP if SS is 16-bit. ++ * The kernel uses a hack to restore bits 31:16, ++ * but that hack doesn't help with bits 63:32. ++ * On Intel CPUs, bits 63:32 end up zeroed, and, on ++ * AMD CPUs, they leak the high bits of the kernel ++ * espfix64 stack pointer. There's very little that ++ * the kernel can do about it. ++ * ++ * Similarly, if we are returning to a 32-bit context, ++ * the CPU will often lose the high 32 bits of RSP. + */ +- if (res == (req & 0xFFFFFFFF)) +- continue; /* OK; not expected to work */ ++ ++ if (res == req) ++ continue; ++ ++ if (cs_bits != 64 && ((res ^ req) & 0xFFFFFFFF) == 0) { ++ printf("[NOTE]\tSP: %llx -> %llx\n", ++ (unsigned long long)req, ++ (unsigned long long)res); ++ continue; ++ } ++ ++ printf("[FAIL]\tSP mismatch: requested 0x%llx; got 0x%llx\n", ++ (unsigned long long)requested_regs[i], ++ (unsigned long long)resulting_regs[i]); ++ nerrs++; ++ continue; + } + + bool ignore_reg = false; +@@ -654,25 +674,18 @@ static int test_valid_sigreturn(int cs_bits, bool use_16bit_ss, int force_ss) + #endif + + /* Sanity check on the kernel */ +- if (i == REG_CX && requested_regs[i] != resulting_regs[i]) { ++ if (i == REG_CX && req != res) { + printf("[FAIL]\tCX (saved SP) mismatch: requested 0x%llx; got 0x%llx\n", +- (unsigned long long)requested_regs[i], +- (unsigned long long)resulting_regs[i]); ++ (unsigned long long)req, ++ (unsigned long long)res); + nerrs++; + continue; + } + +- if (requested_regs[i] != resulting_regs[i] && !ignore_reg) { +- /* +- * SP is particularly interesting here. The +- * usual cause of failures is that we hit the +- * nasty IRET case of returning to a 16-bit SS, +- * in which case bits 16:31 of the *kernel* +- * stack pointer persist in ESP. +- */ ++ if (req != res && !ignore_reg) { + printf("[FAIL]\tReg %d mismatch: requested 0x%llx; got 0x%llx\n", +- i, (unsigned long long)requested_regs[i], +- (unsigned long long)resulting_regs[i]); ++ i, (unsigned long long)req, ++ (unsigned long long)res); + nerrs++; + } + } +diff --git a/tools/testing/selftests/zram/zram.sh b/tools/testing/selftests/zram/zram.sh +index 683a292e3290..9399c4aeaa26 100755 +--- a/tools/testing/selftests/zram/zram.sh ++++ b/tools/testing/selftests/zram/zram.sh +@@ -1,6 +1,9 @@ + #!/bin/bash + TCID="zram.sh" + ++# Kselftest framework requirement - SKIP code is 4. ++ksft_skip=4 ++ + . ./zram_lib.sh + + run_zram () { +@@ -23,5 +26,5 @@ elif [ -b /dev/zram0 ]; then + else + echo "$TCID : No zram.ko module or /dev/zram0 device file not found" + echo "$TCID : CONFIG_ZRAM is not set" +- exit 1 ++ exit $ksft_skip + fi +diff --git a/tools/testing/selftests/zram/zram_lib.sh b/tools/testing/selftests/zram/zram_lib.sh +index f6a9c73e7a44..9e73a4fb9b0a 100755 +--- a/tools/testing/selftests/zram/zram_lib.sh ++++ b/tools/testing/selftests/zram/zram_lib.sh +@@ -18,6 +18,9 @@ MODULE=0 + dev_makeswap=-1 + dev_mounted=-1 + ++# Kselftest framework requirement - SKIP code is 4. ++ksft_skip=4 ++ + trap INT + + check_prereqs() +@@ -27,7 +30,7 @@ check_prereqs() + + if [ $uid -ne 0 ]; then + echo $msg must be run as root >&2 +- exit 0 ++ exit $ksft_skip + fi + } + +diff --git a/virt/kvm/arm/vgic/vgic-v3.c b/virt/kvm/arm/vgic/vgic-v3.c +index f1320063db28..c7924718990e 100644 +--- a/virt/kvm/arm/vgic/vgic-v3.c ++++ b/virt/kvm/arm/vgic/vgic-v3.c +@@ -337,11 +337,6 @@ int vgic_v3_probe(const struct gic_kvm_info *info) + pr_warn("GICV physical address 0x%llx not page aligned\n", + (unsigned long long)info->vcpu.start); + kvm_vgic_global_state.vcpu_base = 0; +- } else if (!PAGE_ALIGNED(resource_size(&info->vcpu))) { +- pr_warn("GICV size 0x%llx not a multiple of page size 0x%lx\n", +- (unsigned long long)resource_size(&info->vcpu), +- PAGE_SIZE); +- kvm_vgic_global_state.vcpu_base = 0; + } else { + kvm_vgic_global_state.vcpu_base = info->vcpu.start; + kvm_vgic_global_state.can_emulate_gicv2 = true; +diff --git a/virt/kvm/eventfd.c b/virt/kvm/eventfd.c +index 3f24eb1e8554..16e17ea06e1e 100644 +--- a/virt/kvm/eventfd.c ++++ b/virt/kvm/eventfd.c +@@ -405,11 +405,6 @@ kvm_irqfd_assign(struct kvm *kvm, struct kvm_irqfd *args) + if (events & POLLIN) + schedule_work(&irqfd->inject); + +- /* +- * do not drop the file until the irqfd is fully initialized, otherwise +- * we might race against the POLLHUP +- */ +- fdput(f); + #ifdef CONFIG_HAVE_KVM_IRQ_BYPASS + if (kvm_arch_has_irq_bypass()) { + irqfd->consumer.token = (void *)irqfd->eventfd; +@@ -425,6 +420,12 @@ kvm_irqfd_assign(struct kvm *kvm, struct kvm_irqfd *args) + #endif + + srcu_read_unlock(&kvm->irq_srcu, idx); ++ ++ /* ++ * do not drop the file until the irqfd is fully initialized, otherwise ++ * we might race against the POLLHUP ++ */ ++ fdput(f); + return 0; + + fail:
